refactor!: remove Sysdig Secure tools, redirect to @sysdig/secure-mcp-server

[alecron]

Summary

• Breaking change: removes the Sysdig Secure tools (list_runtime_events, get_event_info, get_event_process_tree) from this MCP server. Users who need them should install the new @sysdig/secure-mcp-server npm package, which provides full coverage of Sysdig Secure capabilities.
• The SysQL tools (generate_sysql, run_sysql) stay here since they can be used against both Monitor and Secure datasets.
• Drops the associated client extensions (client_process_tree.go) and trims policy-events.read from the documented permissions. GetMyPermissions* (used by permission filtering) is preserved in a new client_permissions.go.
• Updates README.md, internal/infra/mcp/tools/README.md and AGENTS.md to reflect the new Monitor-focused scope and to point Secure users to the new npm package.

Test plan

• just check (fmt + fix + govulncheck + lint + tests) passes locally
• go generate ./... regenerates mocks cleanly with the trimmed interface
• Pre-commit hooks pass on the commit
• Confirm CI is green on this PR
• Confirm Secure users have a clear migration path via the @sysdig/secure-mcp-server README

[Copilot]

Pull request overview

Refactors the MCP server to be Monitor-focused by removing Sysdig Secure-specific MCP tools and client extensions, and directing Secure users to the dedicated @sysdig/secure-mcp-server package.

Changes:

• Removes Sysdig Secure tools (list_runtime_events, get_event_info, get_event_process_tree) and their tests/integration coverage.
• Deletes the process-tree client extension and trims the extended client interface accordingly; preserves GetMyPermissions* via a new client_permissions.go.
• Updates documentation (README.md, tools README, AGENTS) to reflect the new scope and migration path.

Reviewed changes

Copilot reviewed 15 out of 16 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
README.md	Adds breaking-change notice and removes Secure tool docs/permission; repositions SysQL docs.
internal/infra/sysdig/mocks/client_extension.go	Regenerates mocks after removing process-tree methods from the extended interface.
internal/infra/sysdig/client_process_tree.go	Removes process-tree client extension implementation.
internal/infra/sysdig/client_process_tree_integration_test.go	Removes flaky integration tests tied to process-tree endpoints.
internal/infra/sysdig/client_permissions.go	Adds GetMyPermissions* client extension after splitting from process-tree file.
internal/infra/sysdig/client_extension.go	Updates extended client interface to drop process-tree response methods.
internal/infra/mcp/tools/tool_list_runtime_events.go	Removes Secure runtime events MCP tool.
internal/infra/mcp/tools/tool_list_runtime_events_test.go	Removes tests for the removed runtime events tool.
internal/infra/mcp/tools/tool_get_event_process_tree.go	Removes Secure process-tree MCP tool.
internal/infra/mcp/tools/tool_get_event_process_tree_test.go	Removes tests for the removed process-tree tool.
internal/infra/mcp/tools/tool_get_event_info.go	Removes Secure event-info MCP tool.
internal/infra/mcp/tools/tool_get_event_info_test.go	Removes tests for the removed event-info tool.
internal/infra/mcp/tools/README.md	Removes Secure tool table; adds pointer to @sysdig/secure-mcp-server; keeps SysQL tools.
cmd/server/main.go	Stops registering removed Secure tools; keeps SysQL + K8s Monitor tool registration.
AGENTS.md	Updates project positioning to Monitor-focused and points Secure users to the new package.

Files not reviewed (1)

• internal/infra/sysdig/mocks/client_extension.go: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.