@1mcp/agent 0.35.0-beta.3 → 0.35.0

package/build/domains/admin/adminConfiguredServerService.js

@@ -1,7 +1,9 @@
 import { createHash } from 'node:crypto';
 import { mergeGlobalAndServerConfig } from '../../config/mcpConfigMerge.js';
+import { normalizeDisabledToolsForServer } from '../../core/server/disabledTools.js';
 import { GLOBAL_TRANSPORT_CONFIG_KEYS, transportConfigSchema, } from '../../core/types/index.js';
-import { fingerprintConfiguredServerDefaults, fingerprintConfiguredServerSecretValue, fingerprintConfiguredServerTarget, isConfiguredServerTargetDisabled, } from '../../domains/config-change/configChange.js';
+import { fingerprintConfiguredServerConfigDocument, fingerprintConfiguredServerDefaults, fingerprintConfiguredServerSecretValue, fingerprintConfiguredServerTarget, isConfiguredServerTargetDisabled, } from '../../domains/config-change/configChange.js';
+import { createServerInstallationWorkflow, } from '../../domains/installation/serverInstallationWorkflow.js';
 import { z } from 'zod';
 const ENV_PLACEHOLDER_PATTERN = /\$\{[^}]+\}|\$[A-Za-z_][A-Za-z0-9_]*/u;
 const previewTransportConfigSchema = transportConfigSchema.extend({
@@ -12,6 +14,365 @@ const previewTransportConfigSchema = transportConfigSchema.extend({
     })
         .optional(),
 });
+const configuredServerCreateSecretSchema = z
+    .object({
+    fieldPath: z.array(z.string()).min(2),
+    action: z.literal('replace'),
+    replacement: z.object({
+        kind: z.enum(['environmentReference', 'inlineSecret']),
+        value: z.string(),
+    }),
+})
+    .strict();
+const configuredServerCreateDraftSchema = z
+    .object({
+    name: z.string(),
+    enabled: z.boolean().optional(),
+    tags: z.array(z.string()).optional(),
+    transport: z
+        .object({
+        type: z.enum(['stdio', 'http', 'sse']),
+        command: z.string().optional(),
+        url: z.string().optional(),
+        args: z.array(z.string()).optional(),
+        cwd: z.string().optional(),
+        env: z.record(z.string(), z.string()).optional(),
+        headers: z.record(z.string(), z.string()).optional(),
+        timeout: z.number().optional(),
+        connectionTimeout: z.number().optional(),
+        requestTimeout: z.number().optional(),
+        restartOnExit: z.boolean().optional(),
+        maxRestarts: z.number().optional(),
+        restartDelay: z.number().optional(),
+    })
+        .strict(),
+    secrets: z.array(configuredServerCreateSecretSchema).optional(),
+})
+    .strict();
+const CONFIGURED_SERVER_CREATE_TRANSPORT_FIELD_KEYS = new Set([
+    'type',
+    'timeout',
+    'connectionTimeout',
+    'requestTimeout',
+    'url',
+    'headers',
+    'command',
+    'args',
+    'cwd',
+    'env',
+    'restartOnExit',
+    'maxRestarts',
+    'restartDelay',
+]);
+function normalizeConfiguredServerCreateDraft(value) {
+    const parsed = configuredServerCreateDraftSchema.safeParse(value);
+    if (!parsed.success) {
+        const record = value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+        const transport = record.transport && typeof record.transport === 'object' && !Array.isArray(record.transport)
+            ? record.transport
+            : {};
+        const transportType = transport.type === 'http' || transport.type === 'sse' ? transport.type : 'stdio';
+        return {
+            draft: {},
+            source: {
+                type: 'direct',
+                localName: typeof record.name === 'string' ? record.name : '',
+                transport: transportType,
+            },
+            validation: {
+                status: 'invalid',
+                errors: parsed.error.issues.map((issue) => ({
+                    fieldPath: issue.path.map(String),
+                    code: 'invalid_create_field',
+                    message: issue.message,
+                })),
+            },
+        };
+    }
+    const { transport } = parsed.data;
+    const draft = {
+        name: parsed.data.name,
+        enabled: parsed.data.enabled,
+        tags: parsed.data.tags,
+        transport: { ...transport },
+        secrets: parsed.data.secrets,
+    };
+    const secretContainer = transport.type === 'stdio' ? 'env' : 'headers';
+    const secretValues = configuredServerCreateSecretValues(draft, secretContainer);
+    const source = {
+        type: 'direct',
+        localName: parsed.data.name,
+        transport: transport.type,
+        enabled: parsed.data.enabled,
+        tags: parsed.data.tags,
+        command: transport.command,
+        url: transport.url,
+        args: transport.args,
+        cwd: transport.cwd,
+        env: mergeConfiguredServerCreateRecord(transport.env, secretContainer === 'env' ? secretValues : undefined),
+        headers: mergeConfiguredServerCreateRecord(transport.headers, secretContainer === 'headers' ? secretValues : undefined),
+        timeout: transport.timeout,
+        connectionTimeout: transport.connectionTimeout,
+        requestTimeout: transport.requestTimeout,
+        autoRestart: transport.restartOnExit,
+        maxRestarts: transport.maxRestarts,
+        restartDelay: transport.restartDelay,
+    };
+    return { draft, source, validation: { status: 'valid', errors: [] } };
+}
+function configuredServerCreateSecretValues(draft, container) {
+    const values = {};
+    for (const secret of draft.secrets ?? []) {
+        if (secret.fieldPath.length !== 2 || secret.fieldPath[0] !== container || !isValidFieldPath(secret.fieldPath)) {
+            continue;
+        }
+        if (!secret.replacement)
+            continue;
+        values[secret.fieldPath[1]] = replacementValue(secret.replacement);
+    }
+    return values;
+}
+function mergeConfiguredServerCreateRecord(base, additions) {
+    const merged = { ...base, ...additions };
+    return Object.keys(merged).length > 0 ? merged : undefined;
+}
+function createWorkflowValidation(workflow, config) {
+    const errors = [];
+    for (const [field, messages] of Object.entries(workflow.fieldErrors ?? {})) {
+        for (const message of messages) {
+            errors.push({
+                fieldPath: field === 'localName' ? ['name'] : ['transport', field],
+                code: 'invalid_create_field',
+                message,
+            });
+        }
+    }
+    if (workflow.status === 'exists' || workflow.status === 'template_conflict') {
+        errors.push({
+            fieldPath: ['name'],
+            code: workflow.status === 'template_conflict' ? 'template_name_conflict' : 'configured_server_name_conflict',
+            message: 'A configured server or Template Server definition already uses this name.',
+        });
+    }
+    if (config) {
+        const parsed = previewTransportConfigSchema.safeParse(config);
+        if (!parsed.success) {
+            for (const issue of parsed.error.issues) {
+                errors.push({
+                    fieldPath: ['transport', ...issue.path.map(String)],
+                    code: 'invalid_transport_config',
+                    message: issue.message,
+                });
+            }
+        }
+    }
+    return { status: errors.length === 0 ? 'valid' : 'invalid', errors };
+}
+function validateConfiguredServerCreateSecrets(draft) {
+    const errors = [];
+    const expectedContainer = draft.transport?.type === 'stdio' ? 'env' : 'headers';
+    for (const [index, secret] of (draft.secrets ?? []).entries()) {
+        const basePath = ['secrets', String(index)];
+        if (!isValidFieldPath(secret.fieldPath) ||
+            secret.fieldPath.length !== 2 ||
+            secret.fieldPath[0] !== expectedContainer) {
+            errors.push({
+                fieldPath: [...basePath, 'fieldPath'],
+                code: 'unsupported_secret_field',
+                message: `Secret replacement must target ${expectedContainer} for the selected transport.`,
+            });
+        }
+        if (!secret.replacement) {
+            errors.push({
+                fieldPath: [...basePath, 'replacement'],
+                code: 'missing_secret_replacement',
+                message: 'Create secret actions require a replacement.',
+            });
+            continue;
+        }
+        if (secret.replacement.kind === 'environmentReference' && !isEnvironmentReferenceInput(secret.replacement.value)) {
+            errors.push({
+                fieldPath: [...basePath, 'replacement', 'value'],
+                code: 'invalid_environment_reference',
+                message: 'Environment reference must be an environment variable name or substitution expression.',
+            });
+        }
+        if (secret.replacement.kind === 'inlineSecret' && secret.replacement.value.length === 0) {
+            errors.push({
+                fieldPath: [...basePath, 'replacement', 'value'],
+                code: 'empty_inline_secret',
+                message: 'Inline secret replacement cannot be empty.',
+            });
+        }
+    }
+    return { status: errors.length === 0 ? 'valid' : 'invalid', errors };
+}
+function createConfiguredServerCreateContract() {
+    const transportFields = TRANSPORT_FIELD_DEFINITIONS.filter((definition) => CONFIGURED_SERVER_CREATE_TRANSPORT_FIELD_KEYS.has(definition.key)).map((definition) => ({
+        fieldPath: ['transport', definition.key],
+        label: definition.label,
+        control: definition.control,
+        value: definition.defaultValue,
+        options: definition.key === 'type' ? ['stdio', 'http', 'sse'] : definition.options,
+        editable: true,
+        applicableTransportTypes: definition.applicableTransportTypes?.filter((type) => type !== 'streamableHttp'),
+    }));
+    return {
+        schemaVersion: 1,
+        capabilities: {
+            create: { supported: true },
+            forceReplacement: { supported: false },
+            rawJson: { supported: false },
+            preview: { supported: true },
+            apply: { supported: true },
+        },
+        secretPolicy: {
+            allowedActions: ['replace'],
+            environmentReference: {
+                recommended: true,
+                storesSecretMaterial: false,
+                guidance: 'Store an environment variable name or substitution expression instead of secret material.',
+            },
+            inlineReplacement: {
+                emphasis: 'secondary',
+                guidance: 'Inline secret material is stored in the Runtime Scope configuration.',
+            },
+        },
+        fieldGroups: [
+            {
+                id: 'identity',
+                label: 'Identity',
+                fields: [
+                    { fieldPath: ['name'], label: 'Server Name', control: 'text', editable: true },
+                    { fieldPath: ['enabled'], label: 'Enabled', control: 'switch', value: true, editable: true },
+                    { fieldPath: ['tags'], label: 'Tags', control: 'tag-list', value: [], editable: true },
+                ],
+            },
+            { id: 'transport', label: 'Transport', fields: transportFields },
+        ],
+    };
+}
+function createConfiguredServerCreateDiff(proposed, draft) {
+    const diff = [
+        { fieldPath: ['name'], oldValue: undefined, newValue: proposed.id, riskFlags: [] },
+        { fieldPath: ['enabled'], oldValue: undefined, newValue: proposed.enabled, riskFlags: ['connection_critical'] },
+        { fieldPath: ['tags'], oldValue: undefined, newValue: proposed.tags, riskFlags: [] },
+    ];
+    for (const [key, value] of Object.entries(proposed.transport)) {
+        diff.push({
+            fieldPath: ['transport', key],
+            oldValue: undefined,
+            newValue: value,
+            riskFlags: previewRiskFlags([key]),
+        });
+    }
+    for (const secret of draft.secrets ?? []) {
+        diff.push({
+            fieldPath: secret.fieldPath,
+            oldValue: undefined,
+            newValue: previewSecretNewValue(secret),
+            secretAction: 'replace',
+            riskFlags: ['connection_critical', 'secret'],
+        });
+    }
+    return diff;
+}
+function previewSecretNewValue(secret) {
+    const replacement = secret.replacement;
+    if (!replacement)
+        return { present: false, value: '[REDACTED]', secret: true };
+    if (replacement.kind === 'environmentReference') {
+        return {
+            kind: 'environmentReference',
+            value: normalizeEnvironmentReference(replacement.value),
+            storesSecretMaterial: false,
+        };
+    }
+    return { present: true, value: '[REDACTED]', secret: true };
+}
+function configuredServerCreatePreviewFingerprint(input) {
+    const redactedDraft = {
+        ...input.draft,
+        secrets: input.draft.secrets?.map((secret) => ({
+            fieldPath: secret.fieldPath,
+            action: secret.action,
+            replacement: secret.replacement ? fingerprintSecretReplacement(secret.replacement) : undefined,
+        })),
+    };
+    return `preview_${createHash('sha256')
+        .update(stableStringify({
+        schemaVersion: 1,
+        configFingerprint: input.configFingerprint,
+        draft: redactedDraft,
+        proposed: input.proposed,
+        diff: input.diff,
+        validation: input.validation,
+        connectivityCheck: connectivityFingerprintFacts(input.connectivityCheck),
+    }))
+        .digest('hex')}`;
+}
+function connectivityFingerprintFacts(connectivityCheck) {
+    if (connectivityCheck.status !== 'passed')
+        return connectivityCheck;
+    return { status: connectivityCheck.status, mode: connectivityCheck.mode };
+}
+function previewCreateConfigChange(targetName, workflowStatus, changed) {
+    const status = workflowStatus === 'template_conflict'
+        ? 'template_conflict'
+        : workflowStatus === 'exists'
+            ? 'destination_conflict'
+            : changed
+                ? 'changed'
+                : 'failed';
+    return {
+        status,
+        operation: 'create_static',
+        configPath: '[redacted]',
+        target: {
+            name: targetName,
+            ...(workflowStatus === 'template_conflict'
+                ? { source: 'mcpTemplates' }
+                : workflowStatus === 'exists'
+                    ? { source: 'mcpServers' }
+                    : {}),
+        },
+        changed,
+        backup: { created: false },
+        retentionCleanup: { attempted: false, deletedPaths: [], warnings: [] },
+        reload: { status: 'skipped' },
+        warnings: [],
+    };
+}
+function createDraftCandidateName(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return '';
+    const name = value.name;
+    return typeof name === 'string' ? name : '';
+}
+function sanitizeCreateConfirmationFacts(facts) {
+    if (!facts)
+        return undefined;
+    const allowed = [
+        'previewConfirmed',
+        'targetNameConfirmed',
+        'secretChangeConfirmed',
+        'connectionCriticalConfirmed',
+        'connectivityFailureOverrideConfirmed',
+    ];
+    const sanitized = Object.fromEntries(allowed.filter((key) => key in facts).map((key) => [key, facts[key]]));
+    return Object.keys(sanitized).length ? sanitized : undefined;
+}
+function assertSuccessfulConfiguredServerCreate(configChange) {
+    if (configChange.status === 'changed')
+        return;
+    if (configChange.status === 'source_conflict') {
+        throw new AdminConfiguredServerApplyError('configured_server_stale_preview');
+    }
+    if (configChange.status === 'destination_conflict' || configChange.status === 'template_conflict') {
+        throw new AdminConfiguredServerApplyError('configured_server_destination_conflict');
+    }
+    throw new AdminConfiguredServerApplyError('configured_server_create_failed');
+}
 export class AdminConfiguredServerNotFoundError extends Error {
     targetName;
     code = 'configured_server_not_found';
@@ -26,60 +387,157 @@ export class AdminConfiguredServerService {
     constructor(options) {
         this.options = options;
     }
+    async getConfiguredServerCreateContract(input) {
+        return this.options.operationService.executeReadOnly({
+            context: input.context,
+            operationName: 'getConfiguredServerCreateContract',
+            run: async () => createConfiguredServerCreateContract(),
+        });
+    }
+    async previewConfiguredServerCreate(input) {
+        return this.options.operationService.executeDryRun({
+            context: input.context,
+            operationName: 'previewConfiguredServerCreate',
+            run: async () => this.previewConfiguredServerCreateResult(input),
+        });
+    }
+    async applyConfiguredServerCreate(input) {
+        const candidateName = createDraftCandidateName(input.draft);
+        const context = {
+            ...input.context,
+            target: { type: 'configured_server', id: candidateName },
+            confirmationFacts: sanitizeCreateConfirmationFacts(input.context.confirmationFacts),
+        };
+        return this.options.operationService.executeMutation({
+            context,
+            operationName: 'applyConfiguredServerCreate',
+            prepare: async () => {
+                const document = this.options.readConfigDocument() ?? {};
+                const preview = await this.previewConfiguredServerCreateResult({ ...input, connectivityCheck: 'auto' }, true, document);
+                if (preview.previewFingerprint !== input.previewFingerprint) {
+                    throw new AdminConfiguredServerApplyError('configured_server_stale_preview');
+                }
+                if (preview.validation.status !== 'valid' || !preview.configChange.changed) {
+                    throw new AdminConfiguredServerApplyError('configured_server_create_invalid');
+                }
+                const prepared = await this.resolveConfiguredServerCreate(input.draft, document);
+                if (!prepared.config) {
+                    throw new AdminConfiguredServerApplyError('configured_server_create_invalid');
+                }
+                if (prepared.enabled &&
+                    !wouldUseLocalStdioTransport(prepared.config) &&
+                    preview.connectivityCheck.status !== 'passed' &&
+                    !(preview.connectivityCheck.status === 'skipped' && preview.connectivityCheck.reason === 'checker_unavailable') &&
+                    !(preview.connectivityCheck.status === 'failed' &&
+                        input.context.confirmationFacts?.connectivityFailureOverrideConfirmed === true)) {
+                    throw new AdminConfiguredServerApplyError('configured_server_connectivity_blocked');
+                }
+                const secretChange = prepared.draft.secrets?.length;
+                const configFingerprint = fingerprintConfiguredServerConfigDocument(document);
+                return {
+                    confirmationRequirements: [
+                        { code: 'previewConfirmed', expected: input.previewFingerprint },
+                        { code: 'targetNameConfirmed', expected: prepared.targetName },
+                        { code: 'connectionCriticalConfirmed', expected: true },
+                        ...(secretChange ? [{ code: 'secretChangeConfirmed', expected: true }] : []),
+                        ...(preview.connectivityCheck.status === 'failed'
+                            ? [{ code: 'connectivityFailureOverrideConfirmed', expected: true }]
+                            : []),
+                    ],
+                    run: async () => {
+                        let configChange;
+                        try {
+                            configChange = await this.options.configChangeService.createStaticConfiguredServerTarget({
+                                targetName: prepared.targetName,
+                                serverConfig: prepared.config,
+                                operation: 'install',
+                                backup: 'skip',
+                                expectedConfigFingerprint: configFingerprint,
+                            });
+                        }
+                        catch {
+                            throw new AdminConfiguredServerApplyError('configured_server_create_failed');
+                        }
+                        assertSuccessfulConfiguredServerCreate(configChange);
+                        return {
+                            targetName: prepared.targetName,
+                            previewFingerprint: preview.previewFingerprint,
+                            configChange,
+                        };
+                    },
+                };
+            },
+        });
+    }
     async listConfiguredServers(input) {
         return this.options.operationService.executeReadOnly({
             context: input.context,
             operationName: 'listConfiguredServers',
-            run: async () => ({ servers: this.readConfiguredServers() }),
+            run: async () => this.readConfiguredServers(),
         });
     }
     async getConfiguredServerDetail(input) {
+        const configuredState = this.readConfiguredServerState(input.targetName, input.targetSource);
+        const source = configuredState.source;
         const context = {
             ...input.context,
-            target: { type: 'configured_server', id: input.targetName },
+            target: { type: 'configured_server', id: `${source}:${input.targetName}` },
         };
         return this.options.operationService.executeReadOnly({
             context,
             operationName: 'getConfiguredServerDetail',
             run: async () => {
-                const { currentConfig, serverDefaults } = this.readConfiguredServerState(input.targetName);
-                const server = createConfiguredServerReadModel(input.targetName, mergeGlobalAndServerConfig(serverDefaults, currentConfig));
+                const { currentConfig, serverDefaults } = configuredState;
+                const server = createConfiguredServerReadModel(input.targetName, mergeGlobalAndServerConfig(serverDefaults, currentConfig), source, fingerprintConfiguredServerTarget(currentConfig), Object.hasOwn(currentConfig, 'instructionOverride') ? currentConfig.instructionOverride : undefined, Object.hasOwn(currentConfig, 'instructionOverride'));
                 return {
                     server,
                     editContract: createConfiguredServerEditContract(server, currentConfig, serverDefaults),
+                    ...(this.options.readToolInventory
+                        ? {
+                            toolInventory: await this.options.readToolInventory({
+                                targetName: input.targetName,
+                                source,
+                                config: currentConfig,
+                                ...(input.model ? { model: input.model } : {}),
+                            }),
+                        }
+                        : {}),
                 };
             },
         });
     }
     async previewConfiguredServerEdit(input) {
+        const configuredState = this.readConfiguredServerState(input.targetName, input.targetSource);
+        const source = configuredState.source;
         const context = {
             ...input.context,
-            target: { type: 'configured_server', id: input.targetName },
+            target: { type: 'configured_server', id: `${source}:${input.targetName}` },
         };
-        const { currentConfig, serverDefaults } = this.readConfiguredServerState(input.targetName);
+        const { currentConfig, serverDefaults } = configuredState;
         return this.options.operationService.executeDryRun({
             context,
             operationName: 'previewConfiguredServerEdit',
-            run: async () => this.previewConfiguredServerEditResult(input, currentConfig, serverDefaults),
+            run: async () => this.previewConfiguredServerEditResult(input, currentConfig, serverDefaults, false, source),
         });
     }
     async applyConfiguredServerEdit(input) {
+        const source = this.resolveConfiguredServerSource(input.targetName, input.targetSource);
         const context = {
             ...input.context,
-            target: { type: 'configured_server', id: input.targetName },
+            target: { type: 'configured_server', id: `${source}:${input.targetName}` },
             confirmationFacts: sanitizeApplyConfirmationFacts(input.context.confirmationFacts),
         };
         return this.options.operationService.executeMutation({
             context,
             operationName: 'applyConfiguredServerEdit',
             prepare: async () => {
-                const { currentConfig, serverDefaults } = this.readConfiguredServerState(input.targetName);
-                const preview = await this.previewConfiguredServerEditResult({ ...input, connectivityCheck: 'auto' }, currentConfig, serverDefaults, true);
+                const { currentConfig, serverDefaults } = this.readConfiguredServerState(input.targetName, source);
+                const preview = await this.previewConfiguredServerEditResult({ ...input, connectivityCheck: 'auto' }, currentConfig, serverDefaults, true, source);
                 const normalizedEdit = normalizeEditDraft(input.edit);
-                const currentReadModel = createConfiguredServerReadModel(input.targetName, mergeGlobalAndServerConfig(serverDefaults, currentConfig));
+                const currentReadModel = createConfiguredServerReadModel(input.targetName, mergeGlobalAndServerConfig(serverDefaults, currentConfig), source);
                 const applicableEdit = filterApplicableSecretEdits(normalizedEdit.edit, currentReadModel.secretInputs);
-                const proposedConfig = applyEditDraft(currentConfig, applicableEdit, serverDefaults);
-                const proposedReadModel = createConfiguredServerReadModel(preview.proposedTargetName, mergeGlobalAndServerConfig(serverDefaults, proposedConfig));
+                const proposedConfig = applyEditDraft(currentConfig, applicableEdit, serverDefaults, input.targetName);
+                const proposedReadModel = createConfiguredServerReadModel(preview.proposedTargetName, mergeGlobalAndServerConfig(serverDefaults, proposedConfig), source);
                 const connectionCritical = preview.diff.some((entry) => entry.riskFlags.includes('connection_critical'));
                 const secretChange = preview.diff.some((entry) => entry.riskFlags.includes('secret'));
                 if (preview.validation.status !== 'valid') {
@@ -107,6 +565,9 @@ export class AdminConfiguredServerService {
                             : []),
                         ...(secretChange ? [{ code: 'secretChangeConfirmed', expected: true }] : []),
                         ...(connectionCritical ? [{ code: 'connectionCriticalConfirmed', expected: true }] : []),
+                        ...(preview.toolSelection?.requiresZeroEnabledConfirmation
+                            ? [{ code: 'zeroEnabledToolsConfirmed', expected: true }]
+                            : []),
                         ...(preview.connectivityCheck.status === 'failed'
                             ? [{ code: 'connectivityFailureOverrideConfirmed', expected: true }]
                             : []),
@@ -114,6 +575,7 @@ export class AdminConfiguredServerService {
                     run: async () => {
                         const configChange = await this.options.configChangeService.editConfiguredServerTarget({
                             sourceName: input.targetName,
+                            targetSource: source,
                             targetName: preview.proposedTargetName,
                             serverConfig: proposedConfig,
                             expectedSourceFingerprint: fingerprintConfiguredServerTarget(currentConfig),
@@ -142,17 +604,22 @@ export class AdminConfiguredServerService {
     }
     async setConfiguredServerEnabledState(input, enabled) {
         const operationName = enabled ? 'enableConfiguredServer' : 'disableConfiguredServer';
+        const source = input.targetSource ?? 'mcpServers';
         const context = {
             ...input.context,
-            target: { type: 'configured_server', id: input.targetName },
+            target: { type: 'configured_server', id: `${source}:${input.targetName}` },
         };
         if (input.dryRun) {
             return this.options.operationService.executeDryRun({
                 context,
                 operationName,
                 run: async () => {
+                    if (source !== 'mcpServers') {
+                        throw new Error('Template Server definitions do not support enable or disable operations');
+                    }
                     const configChange = await this.options.configChangeService.previewConfiguredServerTargetEnabledState({
                         targetName: input.targetName,
+                        targetSource: source,
                         enabled,
                         backup: 'skip',
                     });
@@ -172,8 +639,12 @@ export class AdminConfiguredServerService {
             operationName,
             confirmationRequirements: input.confirmationRequirements,
             run: async () => {
+                if (source !== 'mcpServers') {
+                    throw new Error('Template Server definitions do not support enable or disable operations');
+                }
                 const configChange = await this.options.configChangeService.setConfiguredServerTargetEnabledState({
                     targetName: input.targetName,
+                    targetSource: source,
                     enabled,
                     backup: 'required',
                 });
@@ -190,49 +661,84 @@ export class AdminConfiguredServerService {
     readConfiguredServers() {
         const parsed = this.options.readConfigDocument();
         if (!parsed) {
-            return [];
+            return { servers: [], configFingerprint: fingerprintConfiguredServerConfigDocument({}) };
         }
-        return Object.entries(parsed.mcpServers ?? {}).map(([name, serverConfig]) => createConfiguredServerReadModel(name, mergeGlobalAndServerConfig(parsed.serverDefaults, serverConfig)));
+        return {
+            configFingerprint: fingerprintConfiguredServerConfigDocument(parsed),
+            servers: ['mcpServers', 'mcpTemplates'].flatMap((source) => Object.entries(parsed[source] ?? {}).map(([name, serverConfig]) => createConfiguredServerReadModel(name, mergeGlobalAndServerConfig(parsed.serverDefaults, serverConfig), source, fingerprintConfiguredServerTarget(serverConfig), Object.hasOwn(serverConfig, 'instructionOverride') ? serverConfig.instructionOverride : undefined, Object.hasOwn(serverConfig, 'instructionOverride')))),
+        };
     }
-    readConfiguredServerState(targetName) {
+    readConfiguredServerState(targetName, targetSource) {
         const parsed = this.options.readConfigDocument();
-        const currentConfig = parsed?.mcpServers?.[targetName];
+        const source = this.resolveConfiguredServerSource(targetName, targetSource, parsed);
+        const currentConfig = parsed?.[source]?.[targetName];
         if (!currentConfig) {
             throw new AdminConfiguredServerNotFoundError(targetName);
         }
-        return { currentConfig, serverDefaults: parsed?.serverDefaults };
+        return { currentConfig, serverDefaults: parsed?.serverDefaults, source };
+    }
+    resolveConfiguredServerSource(targetName, targetSource, document = this.options.readConfigDocument()) {
+        if (targetSource)
+            return targetSource;
+        return document?.mcpTemplates?.[targetName] ? 'mcpTemplates' : 'mcpServers';
     }
     readConfiguredServerConfig(targetName) {
         const parsed = this.options.readConfigDocument();
-        const currentConfig = parsed?.mcpServers?.[targetName];
+        const currentConfig = parsed?.mcpTemplates?.[targetName] ?? parsed?.mcpServers?.[targetName];
         if (!currentConfig) {
             throw new AdminConfiguredServerNotFoundError(targetName);
         }
         return currentConfig;
     }
-    async previewConfiguredServerEditResult(input, currentConfig, serverDefaults, requireCriticalConnectivity = false) {
+    async previewConfiguredServerEditResult(input, currentConfig, serverDefaults, requireCriticalConnectivity = false, source = 'mcpServers') {
         const normalizedEdit = normalizeEditDraft(input.edit);
-        const currentReadModel = createConfiguredServerReadModel(input.targetName, mergeGlobalAndServerConfig(serverDefaults, currentConfig));
+        const sourceValidation = validateEditForSource(source, normalizedEdit.edit);
+        const currentReadModel = createConfiguredServerReadModel(input.targetName, mergeGlobalAndServerConfig(serverDefaults, currentConfig), source);
         const secretValidation = validateSecretEditCapabilities(normalizedEdit.edit, currentReadModel.secretInputs);
         const transportApplicabilityValidation = validateTransportFieldApplicability(currentConfig, normalizedEdit.edit);
         const overrideValidation = validateTransportOverrideClears(currentConfig, normalizedEdit.edit);
         const applicableEdit = filterApplicableSecretEdits(normalizedEdit.edit, currentReadModel.secretInputs);
         const proposedTargetName = applicableEdit.id?.trim() || input.targetName;
-        const proposedConfig = applyEditDraft(currentConfig, applicableEdit, serverDefaults);
-        const proposedReadModel = createConfiguredServerReadModel(proposedTargetName, mergeGlobalAndServerConfig(serverDefaults, proposedConfig));
+        const proposedConfig = applyEditDraft(currentConfig, applicableEdit, serverDefaults, input.targetName);
+        const proposedReadModel = createConfiguredServerReadModel(proposedTargetName, mergeGlobalAndServerConfig(serverDefaults, proposedConfig), source);
         const proposedTransportType = configuredTransportType(proposedConfig);
         const serverValidation = validatePreviewServerConfig(proposedConfig);
-        const validation = mergeValidation(mergeValidation(mergeValidation(mergeValidation(normalizedEdit.validation, secretValidation), transportApplicabilityValidation), overrideValidation), serverValidation);
+        const currentToolInventory = this.options.readToolInventory
+            ? await this.options.readToolInventory({
+                targetName: input.targetName,
+                source,
+                config: currentConfig,
+                ...(input.model ? { model: input.model } : {}),
+            })
+            : undefined;
+        const toolEditValidation = validateConfiguredToolEdit(applicableEdit, currentToolInventory);
+        const validation = mergeValidation(mergeValidation(mergeValidation(mergeValidation(normalizedEdit.validation, secretValidation), transportApplicabilityValidation), overrideValidation), mergeValidation(mergeValidation(serverValidation, sourceValidation), toolEditValidation));
         const diff = createPreviewDiff(currentReadModel, proposedReadModel, applicableEdit);
+        pushDiff(diff, ['disabledTools'], currentConfig.disabledTools ?? [], proposedConfig.disabledTools ?? [], [
+            'tool_visibility',
+        ]);
+        pushDiff(diff, ['toolDescriptionOverrides'], currentConfig.toolDescriptionOverrides ?? {}, proposedConfig.toolDescriptionOverrides ?? {}, ['tool_metadata']);
         appendClearedOverrideDiff(diff, currentReadModel, proposedReadModel, applicableEdit);
         const changed = validation.status === 'valid' && diff.length > 0;
         const endpointChangedWithPreservedSecrets = endpointAuthorityChanged(currentConfig, proposedConfig) &&
             hasPreservedSecretInputs(currentReadModel.secretInputs.filter((input) => !proposedTransportType || transportFieldAppliesToType(input.fieldPath[0], proposedTransportType)), applicableEdit);
+        const proposedToolInventory = this.options.readToolInventory
+            ? await this.options.readToolInventory({
+                targetName: proposedTargetName,
+                source,
+                config: proposedConfig,
+                ...(input.model ? { model: input.model } : {}),
+            })
+            : undefined;
+        const toolSelection = currentToolInventory && proposedToolInventory
+            ? createConfiguredToolSelectionPreview(currentToolInventory, proposedToolInventory)
+            : undefined;
         return {
             targetName: input.targetName,
             proposedTargetName,
             previewFingerprint: previewFingerprint({
                 targetName: input.targetName,
+                targetSource: source,
                 sourceFingerprint: fingerprintConfiguredServerTarget(currentConfig),
                 globalConfigFingerprint: fingerprintConfiguredServerDefaults(serverDefaults),
                 edit: normalizedEdit.edit,
@@ -240,10 +746,11 @@ export class AdminConfiguredServerService {
                 proposed: proposedReadModel,
                 diff,
                 validation,
+                toolSelection,
             }),
             validation,
             diff,
-            configChange: previewConfigChange(input.targetName, changed),
+            configChange: previewConfigChange(input.targetName, changed, source),
             connectivityCheck: await this.previewConnectivityCheck({
                 targetName: proposedTargetName,
                 serverConfig: proposedConfig,
@@ -254,6 +761,7 @@ export class AdminConfiguredServerService {
                     (requireCriticalConnectivity && diff.some((entry) => entry.riskFlags.includes('connection_critical'))),
                 endpointChangedWithPreservedSecrets,
             }),
+            ...(toolSelection ? { toolSelection } : {}),
         };
     }
     async previewConnectivityCheck(input) {
@@ -280,6 +788,84 @@ export class AdminConfiguredServerService {
             serverConfig: input.serverConfig,
         });
     }
+    async previewConfiguredServerCreateResult(input, forceConnectivity = false, document = this.options.readConfigDocument() ?? {}) {
+        const prepared = await this.resolveConfiguredServerCreate(input.draft, document);
+        const proposedReadModel = prepared.config
+            ? createConfiguredServerReadModel(prepared.targetName, mergeGlobalAndServerConfig(document.serverDefaults, prepared.config))
+            : undefined;
+        const validation = prepared.validation;
+        const diff = proposedReadModel ? createConfiguredServerCreateDiff(proposedReadModel, prepared.draft) : [];
+        const changed = validation.status === 'valid' && prepared.workflow.status === 'preview';
+        const connectivityCheck = prepared.config
+            ? await this.previewConnectivityCheck({
+                targetName: prepared.targetName,
+                serverConfig: prepared.config,
+                enabled: prepared.enabled,
+                validationStatus: validation.status,
+                connectionCriticalChanged: true,
+                force: forceConnectivity || input.connectivityCheck === 'manual',
+                endpointChangedWithPreservedSecrets: false,
+            })
+            : { status: 'skipped', reason: 'validation_failed' };
+        const preview = {
+            targetName: prepared.targetName,
+            previewFingerprint: configuredServerCreatePreviewFingerprint({
+                configFingerprint: fingerprintConfiguredServerConfigDocument(document),
+                draft: prepared.draft,
+                proposed: proposedReadModel,
+                diff,
+                validation,
+                connectivityCheck,
+            }),
+            validation,
+            diff,
+            configChange: previewCreateConfigChange(prepared.targetName, prepared.workflow.status, changed),
+            connectivityCheck,
+            expectedReload: {
+                policy: 'observe_after_write',
+                possibleStatuses: ['observed', 'runtime_not_running', 'reload_disabled', 'failed'],
+            },
+        };
+        return preview;
+    }
+    async resolveConfiguredServerCreate(draftValue, document = this.options.readConfigDocument() ?? {}) {
+        const normalized = normalizeConfiguredServerCreateDraft(draftValue);
+        const workflow = createServerInstallationWorkflow({
+            findConfiguredTarget: (targetName) => {
+                if (document.mcpTemplates?.[targetName])
+                    return { name: targetName, source: 'mcpTemplates' };
+                if (document.mcpServers?.[targetName])
+                    return { name: targetName, source: 'mcpServers' };
+                return null;
+            },
+        });
+        const workflowResult = await workflow.run({ mode: 'preview', source: normalized.source });
+        const config = workflowResult.config;
+        const validation = mergeValidation(mergeValidation(normalized.validation, validateConfiguredServerCreateSecrets(normalized.draft)), createWorkflowValidation(workflowResult, config));
+        return {
+            draft: normalized.draft,
+            source: normalized.source,
+            targetName: normalized.source.localName,
+            enabled: normalized.source.enabled !== false,
+            workflow: workflowResult,
+            config,
+            validation,
+        };
+    }
+}
+function validateEditForSource(source, edit) {
+    if (source !== 'mcpTemplates')
+        return { status: 'valid', errors: [] };
+    const supportedTemplateMetadata = new Set(['instructionOverride', 'disabledTools', 'toolDescriptionOverrides']);
+    const unsupported = Object.keys(edit).filter((key) => !supportedTemplateMetadata.has(key));
+    return {
+        status: unsupported.length === 0 ? 'valid' : 'invalid',
+        errors: unsupported.map((key) => ({
+            fieldPath: [key],
+            code: 'template_edit_field_unsupported',
+            message: 'Template Server edits may only change instruction and tool metadata.',
+        })),
+    };
 }
 function assertSuccessfulConfigChange(configChange) {
     if (configChange.reload.status === 'failed') {
@@ -325,6 +911,7 @@ function sanitizeApplyConfirmationFacts(facts) {
         return undefined;
     const allowed = ['previewConfirmed', 'targetNameConfirmed', 'secretChangeConfirmed', 'connectionCriticalConfirmed'];
     allowed.push('connectivityFailureOverrideConfirmed');
+    allowed.push('zeroEnabledToolsConfirmed');
     const sanitized = Object.fromEntries(allowed.filter((key) => key in facts).map((key) => [key, facts[key]]));
     return Object.keys(sanitized).length > 0 ? sanitized : undefined;
 }
@@ -337,7 +924,17 @@ function mutationOutcome(enabled, changed) {
 function normalizeEditDraft(value) {
     const errors = [];
     const edit = {};
-    const supportedKeys = new Set(['id', 'enabled', 'tags', 'transport', 'secrets', 'clearTransportOverrides']);
+    const supportedKeys = new Set([
+        'id',
+        'enabled',
+        'tags',
+        'transport',
+        'secrets',
+        'clearTransportOverrides',
+        'instructionOverride',
+        'disabledTools',
+        'toolDescriptionOverrides',
+    ]);
     if (!value || typeof value !== 'object' || Array.isArray(value)) {
         return {
             edit,
@@ -399,6 +996,36 @@ function normalizeEditDraft(value) {
             });
         }
     }
+    if (record.disabledTools !== undefined) {
+        if (Array.isArray(record.disabledTools) && record.disabledTools.every((name) => typeof name === 'string')) {
+            edit.disabledTools = Array.from(new Set(record.disabledTools.map((name) => name.trim()).filter((name) => name.length > 0))).sort((left, right) => left.localeCompare(right));
+        }
+        else {
+            errors.push({
+                fieldPath: ['disabledTools'],
+                code: 'invalid_disabled_tools',
+                message: 'Disabled tools must be a list of logical tool names.',
+            });
+        }
+    }
+    if (record.toolDescriptionOverrides !== undefined) {
+        if (record.toolDescriptionOverrides &&
+            typeof record.toolDescriptionOverrides === 'object' &&
+            !Array.isArray(record.toolDescriptionOverrides) &&
+            Object.entries(record.toolDescriptionOverrides).every(([name, description]) => name.length > 0 && name === name.trim() && typeof description === 'string')) {
+            edit.toolDescriptionOverrides = Object.fromEntries(Object.entries(record.toolDescriptionOverrides)
+                .map(([name, description]) => [name, description.trim()])
+                .filter(([name, description]) => name.length > 0 && description.length > 0)
+                .sort(([left], [right]) => left.localeCompare(right)));
+        }
+        else {
+            errors.push({
+                fieldPath: ['toolDescriptionOverrides'],
+                code: 'invalid_tool_description_overrides',
+                message: 'Tool description overrides must map logical tool names to descriptions.',
+            });
+        }
+    }
     if (record.transport !== undefined) {
         if (record.transport && typeof record.transport === 'object' && !Array.isArray(record.transport)) {
             edit.transport = normalizeTransportEditDraft(record.transport, errors);
@@ -437,6 +1064,23 @@ function normalizeEditDraft(value) {
             });
         }
     }
+    if (record.instructionOverride !== undefined) {
+        const parsed = z
+            .discriminatedUnion('action', [
+            z.object({ action: z.literal('set'), value: z.string() }).strict(),
+            z.object({ action: z.literal('remove') }).strict(),
+        ])
+            .safeParse(record.instructionOverride);
+        if (parsed.success)
+            edit.instructionOverride = parsed.data;
+        else {
+            errors.push({
+                fieldPath: ['instructionOverride'],
+                code: 'invalid_instruction_override',
+                message: 'Instruction override must set a string value or remove the configured override.',
+            });
+        }
+    }
     return {
         edit,
         validation: { status: errors.length === 0 ? 'valid' : 'invalid', errors },
@@ -465,6 +1109,20 @@ function normalizeTransportEditDraft(record, errors) {
     }
     return transport;
 }
+function validateConfiguredToolEdit(edit, inventory) {
+    if (!inventory)
+        return { status: 'valid', errors: [] };
+    const allowedNames = new Set(inventory.rows.map((row) => row.name));
+    const requestedNames = new Set([...(edit.disabledTools ?? []), ...Object.keys(edit.toolDescriptionOverrides ?? {})]);
+    const errors = Array.from(requestedNames)
+        .filter((name) => !allowedNames.has(name))
+        .map((name) => ({
+        fieldPath: ['tools', name],
+        code: 'unknown_configured_tool',
+        message: 'Tool changes must refer to an observed tool or a retained unresolved entry.',
+    }));
+    return { status: errors.length === 0 ? 'valid' : 'invalid', errors };
+}
 function isSecretCapableRawTransportEdit(key, value) {
     if (key === 'url') {
         return isSecretCapableUrlEdit(value);
@@ -761,7 +1419,7 @@ function potentialSecretInput(fieldPath) {
     }
     return undefined;
 }
-function applyEditDraft(currentConfig, edit, serverDefaults) {
+function applyEditDraft(currentConfig, edit, serverDefaults, logicalServerName) {
     const nextConfig = cloneServerConfig(currentConfig);
     for (const key of edit.clearTransportOverrides ?? []) {
         delete nextConfig[key];
@@ -777,6 +1435,27 @@ function applyEditDraft(currentConfig, edit, serverDefaults) {
     if (Array.isArray(edit.tags)) {
         nextConfig.tags = edit.tags.filter((tag) => typeof tag === 'string');
     }
+    if (edit.instructionOverride?.action === 'set') {
+        nextConfig.instructionOverride = edit.instructionOverride.value;
+    }
+    else if (edit.instructionOverride?.action === 'remove') {
+        delete nextConfig.instructionOverride;
+    }
+    if (Array.isArray(edit.disabledTools)) {
+        const disabledTools = logicalServerName
+            ? normalizeDisabledToolsForServer(logicalServerName, edit.disabledTools)
+            : edit.disabledTools;
+        if (disabledTools.length === 0)
+            delete nextConfig.disabledTools;
+        else
+            nextConfig.disabledTools = disabledTools;
+    }
+    if (edit.toolDescriptionOverrides) {
+        if (Object.keys(edit.toolDescriptionOverrides).length === 0)
+            delete nextConfig.toolDescriptionOverrides;
+        else
+            nextConfig.toolDescriptionOverrides = { ...edit.toolDescriptionOverrides };
+    }
     if (edit.transport && typeof edit.transport === 'object') {
         const currentType = configuredTransportType(currentConfig);
         const proposedType = configuredTransportType({ ...currentConfig, ...edit.transport });
@@ -1160,12 +1839,12 @@ function isValidUrlOrEnvReference(value) {
         return false;
     }
 }
-function previewConfigChange(targetName, changed) {
+function previewConfigChange(targetName, changed, source = 'mcpServers') {
     return {
         status: changed ? 'changed' : 'unchanged',
         operation: 'set_static',
         configPath: '[redacted]',
-        target: { name: targetName, source: 'mcpServers' },
+        target: { name: targetName, source },
         changed,
         backup: { created: false },
         retentionCleanup: { attempted: false, deletedPaths: [], warnings: [] },
@@ -1178,6 +1857,7 @@ function previewFingerprint(input) {
         .update(stableStringify({
         schemaVersion: 2,
         targetName: input.targetName,
+        targetSource: input.targetSource,
         sourceFingerprint: input.sourceFingerprint,
         globalConfigFingerprint: input.globalConfigFingerprint,
         edit: redactEditDraftForFingerprint(input.edit),
@@ -1185,9 +1865,39 @@ function previewFingerprint(input) {
         proposed: input.proposed,
         diff: input.diff,
         validation: input.validation,
+        toolSelection: input.toolSelection,
     }))
         .digest('hex')}`;
 }
+function createConfiguredToolSelectionPreview(current, proposed) {
+    const currentRows = new Map(current.rows.map((row) => [row.name, row]));
+    const proposedRows = new Map(proposed.rows.map((row) => [row.name, row]));
+    const changedTools = Array.from(new Set([...currentRows.keys(), ...proposedRows.keys()]))
+        .filter((name) => {
+        const before = currentRows.get(name);
+        const after = proposedRows.get(name);
+        return (before?.enabled !== after?.enabled ||
+            before?.descriptionOverride !== after?.descriptionOverride ||
+            before?.effectiveDescription !== after?.effectiveDescription);
+    })
+        .sort((left, right) => left.localeCompare(right));
+    return {
+        capabilityGeneration: current.generation,
+        model: proposed.model,
+        changedTools,
+        counts: proposed.counts,
+        approximateTokens: {
+            before: current.approximateTokens.enabled,
+            after: proposed.approximateTokens.enabled,
+            savings: current.approximateTokens.enabled - proposed.approximateTokens.enabled,
+        },
+        targetEnabled: proposed.targetEnabled,
+        effect: proposed.targetEnabled ? 'immediate' : 'deferred_until_target_enabled',
+        requiresZeroEnabledConfirmation: changedTools.length > 0 &&
+            current.rows.some((row) => row.observed && row.enabled) &&
+            !proposed.rows.some((row) => row.observed && row.enabled),
+    };
+}
 function redactEditDraftForFingerprint(edit) {
     return {
         ...edit,
@@ -1215,6 +1925,9 @@ function createPreviewDiff(current, proposed, edit) {
     pushDiff(diff, ['id'], current.id, proposed.id, proposed.id === current.id ? [] : ['rename']);
     pushDiff(diff, ['enabled'], current.enabled, proposed.enabled, ['connection_critical']);
     pushDiff(diff, ['tags'], current.tags, proposed.tags, []);
+    if (edit.instructionOverride) {
+        pushDiff(diff, ['instructionOverride'], current.instructionOverride, proposed.instructionOverride, []);
+    }
     const secretEditedTopLevelKeys = new Set((edit.secrets ?? []).map((secret) => secret.fieldPath[0]));
     const transportEditedKeys = new Set(Object.keys(edit.transport ?? {}));
     const transportKeys = new Set([...Object.keys(current.transport), ...Object.keys(proposed.transport)]);
@@ -1351,11 +2064,15 @@ function stableStringify(value) {
     }
     return JSON.stringify(value);
 }
-function createConfiguredServerReadModel(name, serverConfig) {
+function createConfiguredServerReadModel(name, serverConfig, source = 'mcpServers', revision = fingerprintConfiguredServerTarget(serverConfig), instructionOverride = serverConfig.instructionOverride, hasInstructionOverride = Object.hasOwn(serverConfig, 'instructionOverride')) {
     const secretInputs = [];
     const transport = {};
     for (const [key, value] of Object.entries(serverConfig)) {
-        if (key === 'disabled' || key === 'tags') {
+        if (key === 'disabled' ||
+            key === 'tags' ||
+            key === 'instructionOverride' ||
+            key === 'disabledTools' ||
+            key === 'toolDescriptionOverrides') {
             continue;
         }
         if (key === 'env') {
@@ -1383,22 +2100,33 @@ function createConfiguredServerReadModel(name, serverConfig) {
     const enabled = !isConfiguredServerTargetDisabled(serverConfig.disabled);
     return {
         id: name,
-        source: 'mcpServers',
+        source,
         target: {
             type: 'configured_server',
             id: name,
-            source: 'mcpServers',
+            source,
         },
+        revision,
         enabled,
         tags: normalizeTags(serverConfig.tags),
         transportSummary: createTransportSummary(serverConfig, transport),
         mutationAvailability: {
-            available: true,
-            operations: ['enable', 'disable'],
+            available: source === 'mcpServers',
+            operations: source === 'mcpServers' ? ['enable', 'disable'] : [],
         },
-        actionState: createActionState(name, enabled),
+        actionState: source === 'mcpServers'
+            ? createActionState(name, enabled)
+            : {
+                enable: { available: false, label: `Enable ${name}`, disabledReason: 'already_enabled' },
+                disable: { available: false, label: `Disable ${name}`, disabledReason: 'already_disabled' },
+            },
         transport,
         secretInputs,
+        instructionOverride: !hasInstructionOverride
+            ? { state: 'upstream' }
+            : instructionOverride === ''
+                ? { state: 'suppress', value: '' }
+                : { state: 'replace', value: instructionOverride },
     };
 }
 const STDIO_TRANSPORT_TYPES = ['stdio'];
@@ -1413,7 +2141,6 @@ const TRANSPORT_FIELD_DEFINITIONS = [
     { key: 'timeout', label: 'Deprecated Timeout', control: 'number' },
     { key: 'connectionTimeout', label: 'Connection Timeout', control: 'number' },
     { key: 'requestTimeout', label: 'Request Timeout', control: 'number' },
-    { key: 'disabledTools', label: 'Disabled Tools', control: 'string-list', defaultValue: [] },
     { key: 'template', label: 'Template', control: 'record', defaultValue: {} },
     {
         key: 'url',