Add mcp-master binary and build target

New cmd/mcp-master/ entry point following the agent pattern:
cobra CLI with --config, version, and server commands.

Makefile: add mcp-master target, update all and clean targets.
Example config: deploy/examples/mcp-master.toml with all sections.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Makefile

@@ -8,6 +8,9 @@ mcp:
 mcp-agent:
 	CGO_ENABLED=0 go build $(LDFLAGS) -o mcp-agent ./cmd/mcp-agent
 
+mcp-master:
+	CGO_ENABLED=0 go build $(LDFLAGS) -o mcp-master ./cmd/mcp-master
+
 build:
 	go build ./...
 
@@ -30,6 +33,6 @@ proto-lint:
 	buf breaking --against '.git#branch=master,subdir=proto'
 
 clean:
-	rm -f mcp mcp-agent
+	rm -f mcp mcp-agent mcp-master
 
-all: vet lint test mcp mcp-agent
+all: vet lint test mcp mcp-agent mcp-master

cmd/mcp-master/main.go

@@ -0,0 +1,49 @@
+package main
+
+import (
+	"fmt"
+	"log"
+	"os"
+
+	"git.wntrmute.dev/mc/mcp/internal/config"
+	"git.wntrmute.dev/mc/mcp/internal/master"
+	"github.com/spf13/cobra"
+)
+
+var (
+	version = "dev"
+	cfgPath string
+)
+
+func main() {
+	root := &cobra.Command{
+		Use:   "mcp-master",
+		Short: "Metacircular Control Plane master",
+	}
+	root.PersistentFlags().StringVarP(&cfgPath, "config", "c", "", "config file path")
+
+	root.AddCommand(&cobra.Command{
+		Use:   "version",
+		Short: "Print version",
+		Run: func(cmd *cobra.Command, args []string) {
+			fmt.Println(version)
+		},
+	})
+
+	root.AddCommand(&cobra.Command{
+		Use:   "server",
+		Short: "Start the master server",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			cfg, err := config.LoadMasterConfig(cfgPath)
+			if err != nil {
+				return fmt.Errorf("load config: %w", err)
+			}
+			return master.Run(cfg, version)
+		},
+	})
+
+	if err := root.Execute(); err != nil {
+		log.Fatal(err)
+		os.Exit(1)
+	}
+}

deploy/examples/mcp-master.toml

@@ -0,0 +1,94 @@
+# MCP Master configuration
+#
+# Default location: /srv/mcp-master/mcp-master.toml
+# Override with: mcp-master server --config /path/to/mcp-master.toml
+
+# ------------------------------------------------------------------
+# gRPC server
+# ------------------------------------------------------------------
+[server]
+# Listen address for the gRPC server. Bind to the Tailnet interface.
+grpc_addr = "100.95.252.120:9555"
+tls_cert  = "/srv/mcp-master/certs/cert.pem"
+tls_key   = "/srv/mcp-master/certs/key.pem"
+
+# ------------------------------------------------------------------
+# Database
+# ------------------------------------------------------------------
+[database]
+path = "/srv/mcp-master/master.db"
+
+# ------------------------------------------------------------------
+# MCIAS (for validating inbound CLI/agent tokens)
+# ------------------------------------------------------------------
+[mcias]
+server_url   = "https://mcias.metacircular.net:8443"
+ca_cert      = "/srv/mcp-master/certs/ca.pem"
+service_name = "mcp-master"
+
+# ------------------------------------------------------------------
+# Master identity (for dialing agents)
+# ------------------------------------------------------------------
+[master]
+# Path to the MCIAS service token file used by the master to
+# authenticate to agents when forwarding deploys and edge routes.
+service_token_path = "/srv/mcp-master/mcias-token"
+
+# CA cert for verifying agent TLS certificates.
+ca_cert = "/srv/mcp-master/certs/ca.pem"
+
+# ------------------------------------------------------------------
+# Edge routing
+# ------------------------------------------------------------------
+[edge]
+# Public hostnames in service definitions must fall under one of these
+# domains. Validation uses proper domain label matching.
+allowed_domains = ["metacircular.net", "wntrmute.net"]
+
+# ------------------------------------------------------------------
+# Agent registration
+# ------------------------------------------------------------------
+[registration]
+# MCIAS service identities permitted to register.
+allowed_agents = ["agent-rift", "agent-svc", "agent-orion"]
+
+# Maximum registered nodes.
+max_nodes = 16
+
+# ------------------------------------------------------------------
+# Timeouts
+# ------------------------------------------------------------------
+[timeouts]
+deploy       = "5m"
+edge_route   = "30s"
+health_check = "5s"
+undeploy     = "2m"
+snapshot     = "10m"
+
+# ------------------------------------------------------------------
+# DNS (MCNS)
+# ------------------------------------------------------------------
+[mcns]
+server_url = "https://mcns.svc.mcp.metacircular.net:8443"
+ca_cert    = "/srv/mcp-master/certs/ca.pem"
+token_path = "/srv/mcp-master/mcns-token"
+zone       = "svc.mcp.metacircular.net"
+
+# ------------------------------------------------------------------
+# Logging
+# ------------------------------------------------------------------
+[log]
+level = "info"
+
+# ------------------------------------------------------------------
+# Bootstrap nodes
+# ------------------------------------------------------------------
+[[nodes]]
+name    = "rift"
+address = "100.95.252.120:9444"
+role    = "master"
+
+[[nodes]]
+name    = "svc"
+address = "100.106.232.4:9555"
+role    = "edge"