Run DungeonQ from a separate MCP client

DungeonQ now includes a small MCP client you can copy into another Node project. It uses the official MCP SDK and Node built-ins, connects through the public MCP interface, and imports no DungeonQ runtime code.

The example follows a concrete task: read an artificial order and its review policy, save a multiline review, read it back, then issue and use a one-use world ticket. The ticket works inside its synthetic world. Shipping stays pending.

The client receives only an actor endpoint and token. An operator can observe the session and explicitly apply a finite adaptation policy through a separate interface. A "continue" message simply resumes the client; it cannot approve that policy or give the client operator authority.

This is a reusable integration example for DungeonQ's defensive deception runtime: give a designated suspicious session a persistent world to work in while people or authorized defender agents prepare a response. Creating that time and space is the product goal; measured defensive effectiveness remains unproven.

To reproduce the complete example, use release v0.13.1 with Node 24.15+ and follow the guide below. The harness runs the consumer in a separate process, records its work, and independently checks the artificial origin. Its operator is a scripted fixture. This is an interoperability and authority-boundary test, not a live AI attack experiment.

Copyable client and setup:

https://github.com/Ranopha/dungeonq-astra/blob/v0.13.1/examples/mcp-shipping-consumer/README.md

Release and reproducible evidence:

https://github.com/Ranopha/dungeonq-astra/releases/tag/v0.13.1