Document MCP Inspector testing flow in AGENTS.md

Add an Inspector CLI recipe to the local-testing section, noting the
127.0.0.1-vs-localhost fetch gotcha, the streamable-http transport
flag, and that the tool surface boots without Clerk/Redis env.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: dprevoznik

AGENTS.md

@@ -134,6 +134,32 @@ Key MCP methods: `initialize`, `tools/list`, `tools/call`, `resources/list`, `pr
 
 The `KERNEL_API_KEY` env var is passed as the Bearer token and forwarded to the Kernel SDK for API calls. The `search_docs` tool works without network restrictions; other tools (`manage_browsers`, etc.) require connectivity to the Kernel platform API.
 
+#### Testing with the MCP Inspector
+
+The [MCP Inspector](https://github.com/modelcontextprotocol/inspector) CLI is the fastest way to exercise tools without hand-writing the JSON-RPC handshake. This flow has been run against a live server and works:
+
+```bash
+bun run dev  # starts on :3002
+
+# list tools
+npx -y @modelcontextprotocol/inspector --cli http://127.0.0.1:3002/mcp \
+  --transport streamable-http \
+  --header "Authorization: Bearer $KERNEL_API_KEY" \
+  --method tools/list
+
+# call a tool
+npx -y @modelcontextprotocol/inspector --cli http://127.0.0.1:3002/mcp \
+  --transport streamable-http \
+  --header "Authorization: Bearer $KERNEL_API_KEY" \
+  --method tools/call --tool-name manage_browsers --tool-arg action=create
+```
+
+Gotchas found while running this:
+
+- Use `http://127.0.0.1:3002/mcp`, **not** `localhost` — the Inspector's Node `fetch` resolves `localhost` to IPv6 and fails with `fetch failed`. `curl` works either way, which can be misleading.
+- Pass `--transport streamable-http` (bare `http` fails to connect).
+- The tool surface needs **no** `.env`/Clerk/Redis to test: the API-key bearer path skips Clerk verification and the `/mcp` route does not import the OAuth `const.ts`/Redis modules, so `bun run dev` boots clean and forwards your bearer straight to the SDK. (OAuth routes like `/token` and `/authorize` still need the full env.)
+
 ### Required secrets
 
 - `OP_SERVICE_ACCOUNT_TOKEN` — 1Password service account token for `op run` to resolve `.env` references