note: audit log wired into tool dispatch

includes/MCP/_tool_call_patch.php

@@ -0,0 +1,30 @@
+    private function handleToolCall(mixed $id, array $params, array $authRow): array {
+        $toolName  = $params['name'] ?? '';
+        $arguments = $params['arguments'] ?? [];
+
+        if (empty($toolName)) return $this->rpcError($id, -32602, 'Missing tool name');
+
+        $handler = $this->registry->getHandler($toolName);
+        if (!$handler) return $this->rpcError($id, -32601, "Unknown tool: {$toolName}");
+
+        $tool     = $this->registry->getTool($toolName);
+        $required = $tool['scope'] ?? 'read';
+        if ($required !== 'read') {
+            $keyScopes = array_map('trim', explode(',', $authRow['scopes']));
+            if (!in_array($required, $keyScopes, true) && !in_array('admin', $keyScopes, true)) {
+                \AskTamMCP\Core\Auth::logRequest($authRow, $toolName, false);
+                return $this->rpcError($id, -32000, "Insufficient scope. Required: {$required}");
+            }
+        }
+
+        try {
+            $result = $handler($arguments);
+            \AskTamMCP\Core\Auth::logRequest($authRow, $toolName, true);
+            return $this->rpcResult($id, [
+                'content' => [['type' => 'text', 'text' => is_string($result) ? $result : wp_json_encode($result)]],
+            ]);
+        } catch (\Throwable $e) {
+            \AskTamMCP\Core\Auth::logRequest($authRow, $toolName, false);
+            return $this->rpcError($id, -32000, $e->getMessage());
+        }
+    }