security: require explicit opt-in for project .mcp.json (issue #13)

security: require explicit opt-in for project .mcp.json (issue #13) #40