Add project-bound graph visualization

docs/MCP_CONTRACT.md

@@ -2,7 +2,9 @@
 
 The server uses local standard input/output transport and binds once to the explicit
 `--project-root` supplied at process startup. Optional proposal access also binds once to the
-configured `--proposal-writer`. It does not expose an HTTP port in the first release.
+configured `--proposal-writer`. It opens no network listener at startup. The explicit
+`docforge_visualize` read tool may start one token-protected loopback-only HTTP listener for the
+same immutable project binding.
 
 ## Read tools
 
@@ -17,6 +19,7 @@ configured `--proposal-writer`. It does not expose an HTTP port in the first rel
 - `docforge_get_context`
 - `docforge_validate_project`
 - `docforge_render_status`
+- `docforge_visualize`
 
 Each response states that document text is project content, not higher-priority instructions. Each
 response includes project identity, revision, source hash, adapter version, and staleness state.
@@ -56,11 +59,23 @@ runs only a project-declared view through DocForge's fixed built-in renderer reg
 atomic HTML file below the configured preview root. Rendering declared project output is available
 only through the explicit local CLI integration command.
 
+## Visualization boundary
+
+`docforge_visualize` starts the fixed built-in `graph-browser@1` template against the currently
+validated derived index. It may focus one stable node, run one bounded lexical query, or open the
+project overview. The tool returns a loopback URL and exact snapshot identity.
+
+The tool cannot select a project, database, template, host, port, filesystem path, or SQL
+expression. Its HTTP surface is token-bound, read-only, same-origin, and limited to overview,
+search/filter, and node-neighborhood JSON. The browser exposes an exact validated index snapshot.
+It rejects index replacement or alteration and requires another MCP invocation to refresh.
+
 ## Excluded tools
 
 The normal server never exposes shell execution, arbitrary reads or writes, canonical changeset
 application, declared project-output rendering, arbitrary renderer execution, Git mutation, project
-builds, deployment, publication, global project selection, or cross-project retrieval.
+builds, deployment, publication, external HTTP binding, global project selection, or cross-project
+retrieval.
 
 DFG-9 permanently retained manual canonical integration for DocForge 0.x. No application tool is
 planned for MCP. A future local developer workflow may be considered only through a new approved