fix(mcp): treat empty capability objects as present; declare keyring

[fxinfo24]

Problem

An MCP server that advertises {"tools": {}} is silently reported as having no tools, and list_tools() returns [] — every tool the server exposes is hidden.

The MCP spec models capability members as objects whose presence signals support and whose contents are optional. _parse_server_capabilities collapsed them with bool(), and bool({}) is False.

Observed against a live server advertising 89 tools, of which ClawCodex surfaced 0. A sibling server advertising {"tools": {"listChanged": false}} worked purely because that dict happens to be truthy.

Root cause

tools=bool(tools_cap)          # {"tools": {}}  -> False
prompts=bool(caps.get("prompts"))
resources=bool(caps.get("resources"))

Fix

Test presence, not truthiness, for all three capabilities. The nested listChanged sub-flag keeps its existing isinstance(tools_cap, dict) guard, so the ch15 refresh wiring is unchanged.

Second issue: undeclared runtime dependencies

Two packages were imported by src/ but missing from dependencies:

• keyring — the OS keychain backing McpTokenStore in services/mcp/auth.py. The backend allowlist in auth.py is already written against keyring 25.x class names, so the dependency was clearly intended; without it, token storage failed closed and 27 MCP tests errored at collection.
• exceptiongroup (Python < 3.11) — anyio raises this backport, not the 3.11 builtin. _unwrap_exception_group_message guarded only with except NameError, so on 3.10 it returned str(exc) — literally the opaque "unhandled errors in a TaskGroup (1 sub-exception)" text the function exists to strip.

Verification

• New regression test fails on the old code (AssertionError: False is not true), passes on the new.
• MCP suite: 598 passed, 7 skipped on Python 3.11 (CI's pinned version).
• Full suite: 10894 passed, 15 skipped, 0 failed on Python 3.11.

Behavioural note for reviewers

This changes how every MCP server is interpreted: a server advertising {"tools": {}} now loads its tools instead of none. That is the spec-correct reading, but it is a deliberate behaviour change, hence the explicit call-out rather than a silent fix.

Note on Python 3.10

requires-python = ">=3.10" but CI only runs 3.11, so 3.10 is effectively unverified today. The exceptiongroup fix above matters specifically on 3.10. Worth considering a 3.10 CI leg or narrowing the floor — happy to follow up separately.

[github-actions]

Test Results

     5 files   1 021 suites   21m 59s ⏱️
16 105 tests 16 082 ✅ 22 💤 1 ❌
32 180 runs  32 108 ✅ 71 💤 1 ❌

For more details on these failures, see this check.

Results for commit 796aa32.

[agentforce314]

LGTM. Thank you!