MCP resources could be a good pathway to supply source code for dependencies.
This could be provided with a tool to that searches dependency source code and returns resource urls.
Resources are intrinsically read only. They also don't have to reside within the bounds of the project, i.e. safe access outside the project directory.
But tools may be a better path here... especially seemless integration with our current tools.