[DOCS] Document pentest static-only limits when zero tools are discovered

[hello-args]

Summary

mcts pentest on repos with zero discovered MCP tools still runs static analyzers (153+ findings on agent repositories with skill documentation) but reports attack_chains: 0 nodes — without explaining that attack graph requires tools. Users expect pentest coverage; verdict may exit 1 on skill noise while MCP attack surface untested (D5, C1).

---

Doc path

TBD — file path or URL

Problem

Pentest phases (pentest/runner.py):

Phase	Requires tools	agent repositories with skill documentation (0 tools)
static_metadata	No	runs — many skill findings
attack_chains	Yes (tool graph)	0 nodes, 0 paths
protocol_fuzz	Live + tools	skipped

 attack_graph = static_report.attack_graph or {}
 attack_paths = list(attack_graph.get("paths") or [])
 phases.append(
 PentestPhase(
 name="attack_chains",
 status="complete",
 findings=len(attack_paths),
 details={"nodes": len(attack_graph.get("nodes") or [])},
 )
 )

Empty graph ≠ "secure" — means discovery failed or static-only.

---

Expected

Document static-only pentest limits in CLI help.

Acceptance Criteria

• 0 tools → attack_chains status skipped not complete
• Report includes pentest_limits/coverage field
• CLI help documents static-only mode
• agent repositories with skill documentation pentest output explains 0 nodes
• Pairs with D4 readiness + D6 unknown surface

---