New MCP tools added to mcp_controller.rb must ALSO be added to config/tinker/mcp_permissions.yml for the agent role that needs to use them. Without permissions, agents cannot call the tools - they will be blocked by the permission system even though the handler exists.