fix(security): enforce team access on mutable actions

Authorize cloud provider token access, audit sensitive operations, and
standardize public IDs across deployment and resource flows.

app/Mcp/Tools/ListProjects.php

@@ -8,26 +8,26 @@ use App\Models\Project;
 use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
-use Laravel\Mcp\Server\Attributes\Description;
-use Laravel\Mcp\Server\Attributes\Name;
 use Laravel\Mcp\Server\Tool;
 
-#[Name('list_projects')]
-#[Description('List projects owned by the authenticated team. Returns summary (uuid, name, description).')]
 class ListProjects extends Tool
 {
+    protected string $name = 'list_projects';
+
+    protected string $description = 'List projects owned by the authenticated team. Returns summary (uuid, name, description).';
+
     use BuildsResponse;
     use ResolvesTeam;
 
     public function handle(Request $request): Response
     {
-        if ($error = $this->ensureAbility($request, 'read')) {
+        if ($error = $this->ensureAbility($request, 'read', $this->name)) {
             return $error;
         }
 
         $teamId = $this->resolveTeamId($request);
         if (is_null($teamId)) {
-            return Response::error('Invalid token.');
+            return $this->mcpError($request, 'Invalid token.');
         }
 
         $args = $this->paginationArgs($request);
@@ -49,11 +49,11 @@ class ListProjects extends Tool
             ->values()
             ->all();
 
-        return $this->respond(
+        return $this->mcpSuccess($request, $this->respond(
             $summaries,
             [],
             $this->paginationMeta('list_projects', $args, $total),
-        );
+        ));
     }
 
     public function schema(JsonSchema $schema): array