Add bulk_operations & create_collection tools; fix Gemini JSON Schema compatibility and inspector vulnerabilities

[Copilot]

Gemini's function-calling API enforces strict JSON Schema validation and rejects any array-typed parameter missing an items field, causing HTTP 400 errors when using this MCP server via Antigravity. Additionally, @modelcontextprotocol/inspector was pinned to a version with two known CVEs.

Schema fix — new tools with correct array definitions

Added two missing tools. Every array property includes an explicit items schema:

// bulk_operations — operations.create / .update use { type: "object" };
// .delete uses { type: "string" } (IDs, not objects)
{
  name: "bulk_operations",
  inputSchema: {
    properties: {
      operations: {
        type: "object",
        properties: {
          create: { type: "array", items: { type: "object" } },
          update: { type: "array", items: { type: "object" } },
          delete: { type: "array", items: { type: "string" } }
        }
      }
    }
  }
}

// create_collection — fields array also carries items
{
  name: "create_collection",
  inputSchema: {
    properties: {
      fields: { type: "array", items: { type: "object" } }
    }
  }
}

Handlers call the standard Directus REST endpoints (POST/PATCH/DELETE /items/:collection, POST /collections).

Dependency — inspector security upgrade

Package	Before	After	Fixes
@modelcontextprotocol/inspector	0.10.2	0.16.6	XSS via untrusted MCP server (≥0.16.6); missing proxy↔client auth (≥0.14.1)