Harden MCP file and Assembly access

[tim-kos]

MCP callers must not inherit the server process’s filesystem or private-network access. Restrict file inputs and authenticated Assembly requests while retaining base64 uploads, public URL inputs, and upload resumption.

• Remove kind: 'path' from the advertised and runtime file-input schema. Server-side file downloads use the SDK’s existing public-host validation, redirect checks, and pinned DNS.
• Validate Assembly URLs and IDs before API operations. Resolve their IDs through the configured API endpoint so caller-controlled hosts, redirects, and DNS never receive the authenticated request.
• Add the SDK’s followRedirects option, preserving its default true, and disable API redirects in MCP. This also prevents redirect_url responses from sending MCP into the local network.
• Resume public URL uploads without requiring the original instructions. Retain base64 resumption, explicit custom API endpoints, sanitized missing-upload errors, and supported size-limit guidance.

Migration: local filesystem paths are no longer accepted by hosted, self-hosted, or stdio MCP. Use base64, a public URL, or npx -y @transloadit/node upload. Assembly references require a 32-character hexadecimal ID and a Transloadit URL or the configured API origin, without credentials, query parameters, or fragments.

Validation:

• 53 MCP unit tests pass, including HTTP regressions for path rejection, prepared bytes, resumption, private download rejection, Assembly references, credential routing, and API redirects under bearer and key/secret authentication.
• New Assembly/URL-resumption regressions failed before the fixes; four additional API-redirect regressions reproduced the redirect exposure.
• SDK regression verifies that existing callers still follow API redirects by default.
• corepack yarn check, corepack yarn verify:full, and git diff --check pass. Legacy wrapper documentation was regenerated and staged with the SDK documentation.
• Council’s empty-redirect finding was reproduced with two failing tests and fixed: redirects without a JSON object now produce a sanitized error.
• The follow-up council finding was reproduced with four failing tests and fixed: an empty configured endpoint now uses the same default as the SDK.
• Package changeset covers MCP and both SDK package names.