Add an official HOL Guard pre-tool security example

Proposal

Add a small official mcp-agent example showing how to protect MCP tool calls with HOL Guard through the existing AugmentedLLM.pre_tool_call(...) hook.

AugmentedLLM.pre_tool_call already receives the CallToolRequest before execution and can return False to prevent the tool from running, so this should not require a new core interception API.

The example would:

• install and invoke HOL Guard locally for the pending MCP tool call
• pass the tool name/arguments to Guard before call_tool
• allow only an explicit safe result to continue
• return False for deny/review/unknown/Guard-error paths so the downstream MCP tool executes zero times
• keep HOL Guard optional and outside mcp-agent core dependencies

A minimal implementation could live under examples/ alongside the existing MCP examples and subclass AugmentedLLM only to override pre_tool_call.

Why this fits mcp-agent

The repository already exposes the exact provider-neutral boundary needed for this integration: pre_tool_call(tool_call_id, request) -> CallToolRequest | bool, documented in source as running before execution with False preventing execution. This makes an official HOL Guard example useful without changing mcp-agent's runtime contract.

Acceptance shape

• one runnable HOL Guard example/docs entry in the official repository
• no new generic middleware or security API
• test/reproduction demonstrating a Guard-denied tool call does not reach the MCP server
• fail-closed behavior if Guard is unavailable or returns malformed/unknown output

I can contribute the focused example/tests if this placement makes sense.