@anchrd/intel-api 0.14.0 → 0.16.0

package/dist/mcp/mcp.js

@@ -1,5 +1,11 @@
-import { AddBoardTaskInput, AppendTableRowsInput, ArchiveFlowInput, ArchiveNodeInput, CancelFlowRunInput, CompleteFlowRunStepInput, ConfigureBoardInput, CreateAgentInput, CreateFlowInput, CreateNodeInput, DefineTableInput, DeleteBoardTaskInput, DeleteTableRowsInput, ExecuteToolInput, GetAgentInput, GetBoardInput, GetFlowInput, GetFlowRunInput, GetFlowVersionInput, GetNodeInput, GetNodeVersionInput, GetTableInput, IntelId, ListAgentsInput, ListFlowRunsInput, ListFlowsInput, ListGrantsInput, ListNodesInput, MoveBoardTaskInput, NodeGraphInput, PauseAgentInput, PreviewFlowPublishInput, PublishFlowInput, RedefineTableInput, RelationGraphInput, RepairBoardTaskIdsInput, ResolveNodeLinksInput, RevokeGrantInput, RotateAgentKeyInput, RunAgentNowInput, SaveAgentDefinitionInput, SaveAttachmentInput, SaveFlowVersionInput, SaveNodeVersionInput, SearchInput, ShareInput, StartFlowRunInput, TestToolInput, UnpublishFlowInput, UpdateBoardTaskInput, UpdateFlowInput, UpdateNodeInput, UpdateTableRowsInput, } from "@anchrd/intel-contract";
-import { McpServer, ResourceTemplate, } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { IdempotencyKey, IntelId } from "@anchrd/intel-contract";
+import { ArchiveFlowInput, CreateFlowInput, GetFlowInput, GetFlowVersionInput, ListFlowsInput, PreviewFlowPublishInput, PublishFlowInput, RelationGraphInput, SaveFlowVersionInput, UnpublishFlowInput, UpdateFlowInput, } from "@anchrd/intel-contract/flow";
+import { CancelFlowRunInput, CompleteFlowRunStepInput, GetFlowRunInput, ListFlowRunsInput, StartFlowRunInput, } from "@anchrd/intel-contract/flow-run";
+import { ArchiveNodeInput, CreateNodeInput, GetNodeInput, GetNodeVersionInput, ListNodesInput, NodeGraphInput, ResolveNodeLinksInput, SaveAttachmentInput, SaveNodeVersionInput, SearchInput, UpdateNodeInput, } from "@anchrd/intel-contract/node";
+import { ListGrantsInput, RevokeGrantInput, ShareInput } from "@anchrd/intel-contract/share";
+import { AppendTableRowsInput, DefineTableInput, DeleteTableRowsInput, GetTableInput, RedefineTableInput, UpdateTableRowsInput, } from "@anchrd/intel-contract/table";
+import { ExecuteToolInput, TestToolInput } from "@anchrd/intel-contract/tool";
+import { McpServer, ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 import { z } from "zod";
 import { permits } from "../shared/gate-authorization/gate-authorization.js";
@@ -61,24 +67,24 @@ export async function handleMcp(request, deps) {
         canReadFlows: permits(deps.authorization, "flows", "read"),
         canCreateFlows: permits(deps.authorization, "flows", "create"),
     };
-    const agentActor = {
-        id: deps.authorization.identity.id,
-        email: deps.authorization.identity.email,
-        isAdmin: deps.authorization.can("intel", "admin"),
-        canRun: permits(deps.authorization, "agents", "run"),
-    };
     const server = new McpServer({ name: "intel", version: "0.1.0" });
     const EmptyInput = z.strictObject({});
     // `null` is the root: the whole tree as this caller may read it. The field is required rather
     // than defaulted so "everything" is always said, never fallen into.
-    const ExportManifestInput = z.strictObject({ nodeId: IntelId.nullable() });
+    const ExportManifestInput = z.strictObject({
+        nodeId: IntelId.nullable().describe('Folder or node to plan the export of, or `null` for the whole tree as this caller may read it. Required rather than defaulted, so "everything" is always said and never fallen into.'),
+    });
     // The zip travels inline as base64, which is MCP's one way of carrying bytes. ~14M characters is
     // ~10 MB of zip — the same order as the attachment inline limit, and for the same isolate-memory
     // reason. Bigger bundles take the HTTP door, which streams.
     const ImportBundleInput = z.strictObject({
-        nodeId: IntelId.nullable(),
-        zipBase64: z.string().min(1).max(14_000_000),
-        idempotencyKey: z.string().min(8).max(200),
+        nodeId: IntelId.nullable().describe("Folder the bundle lands under, or `null` for the top level. The bundle's own structure is kept beneath it."),
+        zipBase64: z
+            .string()
+            .min(1)
+            .max(14_000_000)
+            .describe("The zip bundle, base64-encoded. Around 10 MB of zip; a bigger bundle takes the HTTP door, which streams instead of holding it in memory."),
+        idempotencyKey: IdempotencyKey,
     });
     function decodeZipBase64(value) {
         if (value.length % 4 !== 0 || !/^[A-Za-z0-9+/]*={0,2}$/.test(value)) {
@@ -111,7 +117,7 @@ export async function handleMcp(request, deps) {
         email: deps.authorization.identity.email,
         name: deps.authorization.identity.name ?? null,
     }));
-    if (permits(deps.authorization, "knowledge", "read")) {
+    if (permits(deps.authorization, "nodes", "read")) {
         server.registerTool("node_list", {
             title: "List nodes",
             description: "List authorized folders, documents, attachments, and tables under one parent.",
@@ -136,7 +142,7 @@ export async function handleMcp(request, deps) {
                 openWorldHint: false,
             },
         }, async (input) => text(await deps.nodes.get(actor, input.nodeId)));
-        server.registerTool("node_versions_list", {
+        server.registerTool("node_version_list", {
             title: "List node versions",
             description: "List immutable versions of one authorized node.",
             inputSchema: GetNodeInput,
@@ -213,33 +219,6 @@ export async function handleMcp(request, deps) {
                 openWorldHint: false,
             },
         }, async (input) => text(await deps.nodes.search(actor, input)));
-        // ⚠️ Plain `registerTool` and no alias: these tools are new with #139 and never had a
-        // `knowledge_` name, so inventing one would create a deprecated name that was never used —
-        // and #149, which removes the aliases, would then have one more thing to remove.
-        server.registerTool("agent_list", {
-            title: "List agents",
-            description: "List the authorized agents, over the whole tree or under one folder. Omit parentId for every agent, pass null for the root level.",
-            inputSchema: ListAgentsInput,
-            annotations: {
-                title: "List agents",
-                readOnlyHint: true,
-                destructiveHint: false,
-                idempotentHint: true,
-                openWorldHint: false,
-            },
-        }, async (input) => text(await deps.nodes.listAgents(actor, input)));
-        server.registerTool("agent_get", {
-            title: "Get agent",
-            description: "Read one authorized agent with its current definition: the nodes it references and their role, its schedules, and its model.",
-            inputSchema: GetAgentInput,
-            annotations: {
-                title: "Get agent",
-                readOnlyHint: true,
-                destructiveHint: false,
-                idempotentHint: true,
-                openWorldHint: false,
-            },
-        }, async (input) => text(await deps.nodes.getAgent(actor, input)));
         server.registerTool("node_table_get", {
             title: "Get node table",
             description: "Read one authorized table as column names and rows.",
@@ -252,22 +231,7 @@ export async function handleMcp(request, deps) {
                 openWorldHint: false,
             },
         }, async (input) => text(await deps.nodes.getTable(actor, input.nodeId)));
-        // A board answers whole: the statuses and every task, in one read. There is no per-task read
-        // beside it, because a card is small and the interesting question is almost always about
-        // several of them at once — what is in review, what waits for what (#285).
-        server.registerTool("board_get", {
-            title: "Get board",
-            description: "Read one authorized board: its status list and every task with its full field set. A board that has never been written answers with the default statuses and no tasks.",
-            inputSchema: GetBoardInput,
-            annotations: {
-                title: "Get board",
-                readOnlyHint: true,
-                destructiveHint: false,
-                idempotentHint: true,
-                openWorldHint: false,
-            },
-        }, async (input) => text(await deps.nodes.getBoard(actor, input)));
-        server.registerTool("node_links_list", {
+        server.registerTool("node_link_list", {
             title: "List node links",
             description: "List authorized outgoing links and backlinks for one node.",
             inputSchema: GetNodeInput,
@@ -281,12 +245,12 @@ export async function handleMcp(request, deps) {
         }, async (input) => text(await deps.nodes.listLinks(actor, input.nodeId)));
         // The reader's half of a document link (#41): the titles of the linked documents this caller
         // may see. There is no tool to create or delete a link — a relationship is written in the text
-        // and `node_save` is what records it, so there is only one way to make one.
+        // and `node_version_create` is what records it, so there is only one way to make one.
         //
         // ⚠️ A target this caller may not reach, or one that is gone, is simply absent from the answer.
         // The two are indistinguishable on purpose: telling them apart would confirm that a document
         // exists somewhere they cannot look.
-        server.registerTool("node_links_resolve", {
+        server.registerTool("node_link_resolve", {
             title: "Resolve node links",
             description: "Resolve document link targets to the titles this caller is authorized to see. Targets that are unreachable or deleted are absent from the result.",
             inputSchema: ResolveNodeLinksInput,
@@ -316,12 +280,12 @@ export async function handleMcp(request, deps) {
         // resource payload travels inline as base64 and would have to fit in Worker memory twice, the
         // same limit that caps `node_attachment_get` at 10 MB — a whole subtree is the case that limit
         // exists for. HTTP `GET /nodes/:nodeId/export` streams the real archive.
-        server.registerTool("node_export_manifest", {
-            title: "Get export manifest",
+        server.registerTool("node_export", {
+            title: "Export nodes",
             description: "Plan a bundle export: the manifest of one authorized subtree (or the whole tree when nodeId is null) with each entry's bundle path, kind, and media type. Content bytes are fetched per node; the binary zip is served over HTTP.",
             inputSchema: ExportManifestInput,
             annotations: {
-                title: "Get export manifest",
+                title: "Export nodes",
                 readOnlyHint: true,
                 destructiveHint: false,
                 idempotentHint: true,
@@ -343,7 +307,7 @@ export async function handleMcp(request, deps) {
             },
         }, async () => text(await deps.nodes.reindex(actor)));
     }
-    if (permits(deps.authorization, "knowledge", "create")) {
+    if (permits(deps.authorization, "nodes", "create")) {
         server.registerTool("node_create", {
             title: "Create node",
             description: "Create a governed folder, document, attachment, or table node.",
@@ -356,83 +320,26 @@ export async function handleMcp(request, deps) {
                 openWorldHint: false,
             },
         }, async (input) => text(await deps.nodes.create(actor, input)));
-        /**
-         * ⚠️ There is no longer ANY tool result in Intel that contains a secret, and that is the whole
-         * of D29 seen from here. Until #207 this one tool answered with the Application key in plain
-         * text — a deliberate exception, because the result WAS the credential and a redacted answer
-         * would have meant "an agent you can create but never run". The exception is gone rather than
-         * weakened: the key now travels from Gate into the agent runtime over Intel's service binding
-         * inside this call, so there is nothing left to hand to a model. `agent_create`, `agent_get`,
-         * `agent_list` and every node read answer with `applicationId` alone, which names the principal
-         * without authenticating it.
-         */
-        server.registerTool("agent_create", {
-            title: "Create agent",
-            description: "Create an agent node with its first definition, and the Gate application it runs as. The definition names nodes and their role, schedules and a model — never accounts, secrets or channels. The agent's application key is handed to the agent runtime internally and never appears in this result; the agent can run straight away. A repeated idempotency key returns the existing agent and mints nothing.",
-            inputSchema: CreateAgentInput,
-            annotations: {
-                title: "Create agent",
-                readOnlyHint: false,
-                destructiveHint: false,
-                idempotentHint: true,
-                // Creating an agent creates a principal in Gate, which is a system outside Intel.
-                openWorldHint: true,
-            },
-        }, async (input) => text(await deps.nodes.createAgent(actor, input, { token: deps.bearer })));
     }
-    if (permits(deps.authorization, "knowledge", "write")) {
-        server.registerTool("agent_update", {
-            title: "Update agent definition",
-            description: "Append an immutable definition version to an agent using an optimistic base version.",
-            inputSchema: SaveAgentDefinitionInput,
-            annotations: {
-                title: "Update agent definition",
-                readOnlyHint: false,
-                destructiveHint: false,
-                idempotentHint: true,
-                openWorldHint: false,
-            },
-        }, async (input) => text(await deps.nodes.saveAgentDefinition(actor, input, { token: deps.bearer })));
-        /**
-         * The MCP half of the "Replace key" action in the agent profile (D29, #207).
-         *
-         * ⚠️ `knowledge/write` like `agent_update`, not `agents/run`: which principal an agent acts as
-         * is a property of the agent, changed by whoever may change the agent. And the result names the
-         * principal and the moment — never the key, which went to the runtime and nowhere else.
-         */
-        server.registerTool("agent_rotate_key", {
-            title: "Replace an agent's application key",
-            description: "Issue a new Gate application key for an agent and give it to the agent runtime. The previous key stops working immediately. Use it when a run fails with agent_key_missing, or when a key may have been exposed. The key itself is never returned.",
-            inputSchema: RotateAgentKeyInput,
-            annotations: {
-                title: "Replace an agent's application key",
-                readOnlyHint: false,
-                // The old key stops working the moment this runs, and anything still using it breaks.
-                destructiveHint: true,
-                // Asking twice issues twice, and the second answer invalidates the first key.
-                idempotentHint: false,
-                // The principal lives in Gate, which is a system outside Intel.
-                openWorldHint: true,
-            },
-        }, async (input) => text(await deps.nodes.rotateAgentKey(actor, input, { token: deps.bearer })));
-        server.registerTool("node_save", {
-            title: "Save node version",
+    if (permits(deps.authorization, "nodes", "write")) {
+        server.registerTool("node_version_create", {
+            title: "Create node version",
             description: "Append an immutable content version using an optimistic base version.",
             inputSchema: SaveNodeVersionInput,
             annotations: {
-                title: "Save node version",
+                title: "Create node version",
                 readOnlyHint: false,
                 destructiveHint: false,
                 idempotentHint: true,
                 openWorldHint: false,
             },
         }, async (input) => text(await deps.nodes.save(actor, input)));
-        server.registerTool("node_attachment_save", {
-            title: "Save node attachment",
+        server.registerTool("node_attachment_create", {
+            title: "Create node attachment version",
             description: "Append immutable base64 file bytes to an attachment node.",
             inputSchema: SaveAttachmentInput,
             annotations: {
-                title: "Save node attachment",
+                title: "Create node attachment version",
                 readOnlyHint: false,
                 destructiveHint: false,
                 idempotentHint: true,
@@ -443,12 +350,12 @@ export async function handleMcp(request, deps) {
         // the export — or a naked zipped folder — lands as a new subtree under the target. Same
         // service as HTTP, so authorization, limits, remapping, and the all-or-nothing write cannot
         // differ by surface; only the transport differs (inline base64 here, a streamed body there).
-        server.registerTool("node_import_bundle", {
-            title: "Import bundle",
+        server.registerTool("node_import", {
+            title: "Import nodes",
             description: "Import a zip bundle (base64) as a new subtree under an authorized target folder — null files at the root. Kinds come from manifest.json when present, from file extensions otherwise. Always creates new nodes; links and flow references between bundled entries are rewritten to the new IDs. Bundles beyond ~10 MB take the streaming HTTP route POST /nodes/:nodeId/import.",
             inputSchema: ImportBundleInput,
             annotations: {
-                title: "Import bundle",
+                title: "Import nodes",
                 readOnlyHint: false,
                 destructiveHint: false,
                 idempotentHint: true,
@@ -459,12 +366,12 @@ export async function handleMcp(request, deps) {
             zip: decodeZipBase64(input.zipBase64),
             idempotencyKey: input.idempotencyKey,
         })));
-        server.registerTool("node_table_define", {
-            title: "Define node table columns",
+        server.registerTool("node_table_create", {
+            title: "Create node table columns",
             description: "Write the column names of an empty table. The header is the contract every append is checked against and cannot be rewritten.",
             inputSchema: DefineTableInput,
             annotations: {
-                title: "Define node table columns",
+                title: "Create node table columns",
                 readOnlyHint: false,
                 destructiveHint: false,
                 idempotentHint: true,
@@ -473,12 +380,12 @@ export async function handleMcp(request, deps) {
         }, async (input) => text(await deps.nodes.defineTable(actor, input)));
         // The tool #40 exists for: an agent collecting findings on a schedule appends them without
         // reading or resending what is already there, and two agents appending at once lose nothing.
-        server.registerTool("node_table_append", {
-            title: "Append node table rows",
+        server.registerTool("node_table_row_create", {
+            title: "Create node table rows",
             description: "Append rows to a table without reading or resending its existing content. Each row must have exactly as many cells as the table has columns; a row that does not is rejected and nothing is written.",
             inputSchema: AppendTableRowsInput,
             annotations: {
-                title: "Append node table rows",
+                title: "Create node table rows",
                 readOnlyHint: false,
                 destructiveHint: false,
                 // The idempotency key makes a repeat of the same call a no-op; without one, appending
@@ -491,7 +398,7 @@ export async function handleMcp(request, deps) {
         // rows — they carry no IDs on purpose — so every mutation names the version the positions were
         // read from and is refused with `version_conflict` when the table moved on. No `knowledge_*`
         // alias: these tools are new under the post-#125 naming and never carried the old prefix.
-        server.registerTool("node_table_update_rows", {
+        server.registerTool("node_table_row_update", {
             title: "Update node table rows",
             description: "Replace rows at the given zero-based positions. Requires the baseVersionId the positions were read from (see node_table_get); answers version_conflict and writes nothing when the table has changed since. Each replacement row must match the column count.",
             inputSchema: UpdateTableRowsInput,
@@ -504,7 +411,7 @@ export async function handleMcp(request, deps) {
                 openWorldHint: false,
             },
         }, async (input) => text(await deps.nodes.updateTableRows(actor, input)));
-        server.registerTool("node_table_delete_rows", {
+        server.registerTool("node_table_row_delete", {
             title: "Delete node table rows",
             description: "Remove rows at the given zero-based positions. Requires the baseVersionId the positions were read from; answers version_conflict and writes nothing when the table has changed since.",
             inputSchema: DeleteTableRowsInput,
@@ -516,105 +423,18 @@ export async function handleMcp(request, deps) {
                 openWorldHint: false,
             },
         }, async (input) => text(await deps.nodes.deleteTableRows(actor, input)));
-        server.registerTool("node_table_redefine", {
-            title: "Redefine node table columns",
+        server.registerTool("node_table_update", {
+            title: "Update node table columns",
             description: "Change the header of a defined table through an explicit column mapping: each new column names the current column that fills it (rename or keep), names none to start empty (add), and a current column no entry names is removed with its cells. Requires the baseVersionId the mapping was read from. Defining over an existing header without a mapping stays refused.",
             inputSchema: RedefineTableInput,
             annotations: {
-                title: "Redefine node table columns",
+                title: "Update node table columns",
                 readOnlyHint: false,
                 destructiveHint: true,
                 idempotentHint: true,
                 openWorldHint: false,
             },
         }, async (input) => text(await deps.nodes.redefineTable(actor, input)));
-        /**
-         * The board's write surface (#285). No `knowledge_*` alias on any of them — these are new under
-         * the post-#125 naming.
-         *
-         * ⚠️ Not one of them takes a `baseVersionId`, and the descriptions say so. That is the property
-         * an agent has to be able to rely on: two agents working the same board at the same time touch
-         * different tasks, and neither is asked to read the whole board first or to retry a conflict
-         * that says nothing about what they were doing. The server applies each call by task id to the
-         * board as it stands at that moment.
-         */
-        server.registerTool("board_configure", {
-            title: "Configure board statuses",
-            description: 'Write the board\'s whole status list, in the order it should be drawn. Adding, renaming and reordering columns are all this call. The "archived" status is part of every board and cannot be removed, and a status that tasks still sit in cannot be removed either. Set "terminal" on a column to say that standing in it means the work is finished — that is what decides whether a task waiting on another is still blocked. Several columns may be terminal; "archived" always is and cannot be set otherwise. Omitting it leaves an ordinary column not terminal.',
-            inputSchema: ConfigureBoardInput,
-            annotations: {
-                title: "Configure board statuses",
-                readOnlyHint: false,
-                // Removing a column is possible here, so this is not a purely additive write.
-                destructiveHint: true,
-                idempotentHint: true,
-                openWorldHint: false,
-            },
-        }, async (input) => text(await deps.nodes.configureBoard(actor, input)));
-        server.registerTool("board_task_add", {
-            title: "Add board task",
-            description: "Add one task to a board. The server assigns its id and its place in the order; name afterTaskId or beforeTaskId to put it between two cards, or neither to put it last in its column. parentId makes it a subtask of another task on the same board, dependsOn names tasks of the same board it waits for, and references names Intel nodes. dependsOn, labels and references are sets: naming the same task, word or node twice is refused rather than quietly folded together. Needs no baseVersionId: tasks are addressed by id, so parallel writers do not collide.",
-            inputSchema: AddBoardTaskInput,
-            annotations: {
-                title: "Add board task",
-                readOnlyHint: false,
-                destructiveHint: false,
-                idempotentHint: true,
-                openWorldHint: false,
-            },
-        }, async (input) => text(await deps.nodes.addBoardTask(actor, input)));
-        server.registerTool("board_task_update", {
-            title: "Update board task",
-            description: "Change what a task says: title, assignee, labels, dates, dependencies, description or references. Where a task SITS — its status, its parent, its order — is board_task_move instead. Every named field replaces its current value whole; fields that are not named stay as they are. dependsOn, labels and references are sets: appending to a list this task already holds is refused rather than quietly folded together, so read the current value before you write it back.",
-            inputSchema: UpdateBoardTaskInput,
-            annotations: {
-                title: "Update board task",
-                readOnlyHint: false,
-                // Every named field replaces what stood there; the version history keeps it, the task
-                // does not.
-                destructiveHint: true,
-                idempotentHint: true,
-                openWorldHint: false,
-            },
-        }, async (input) => text(await deps.nodes.updateBoardTask(actor, input)));
-        server.registerTool("board_task_move", {
-            title: "Move board task",
-            description: 'Move one task: into another status, under another parent, or between two neighbours. Archiving a task is this call with status "archived" — there is no separate verb, and nothing is deleted by it. Two moves on two different tasks both go through.',
-            inputSchema: MoveBoardTaskInput,
-            annotations: {
-                title: "Move board task",
-                readOnlyHint: false,
-                destructiveHint: false,
-                idempotentHint: true,
-                openWorldHint: false,
-            },
-        }, async (input) => text(await deps.nodes.moveBoardTask(actor, input)));
-        server.registerTool("board_task_delete", {
-            title: "Delete board task",
-            description: 'Remove a task AND every subtask under it, recursively. The answer counts everything that went, and dependsOn entries in the remaining tasks that pointed at a deleted one are removed with it. To take a task off the board without losing it, move it to the "archived" status instead.',
-            inputSchema: DeleteBoardTaskInput,
-            annotations: {
-                title: "Delete board task",
-                readOnlyHint: false,
-                destructiveHint: true,
-                idempotentHint: true,
-                openWorldHint: false,
-            },
-        }, async (input) => text(await deps.nodes.deleteBoardTask(actor, input)));
-        server.registerTool("board_repair_task_ids", {
-            title: "Repair repeated board task ids",
-            description: "Give a fresh id to every task entry on a board that repeats an id another entry already used. Only a board imported from a hand-written or foreign bundle can hold such a pair, and it cannot be repaired with the other calls: they address a task by id, so they would read, write or remove both entries at once. The first entry under an id keeps it — that is the one every parentId and dependsOn on the board already means — and each later one becomes its own task with everything else it carries, so nothing is lost and no edge is invented. The answer names each pair. A board that names every task once is refused rather than rewritten. Repeated STATUS ids are repaired with board_configure instead, by writing the status list with distinct ids.",
-            inputSchema: RepairBoardTaskIdsInput,
-            annotations: {
-                title: "Repair repeated board task ids",
-                readOnlyHint: false,
-                // Nothing is removed and nothing is overwritten: one entry gains an id of its own and
-                // every other field on every task stays exactly as it stood.
-                destructiveHint: false,
-                idempotentHint: true,
-                openWorldHint: false,
-            },
-        }, async (input) => text(await deps.nodes.repairBoardTaskIds(actor, input)));
         server.registerTool("node_update", {
             title: "Update node",
             description: "Rename, move, or describe a node.",
@@ -629,53 +449,53 @@ export async function handleMcp(request, deps) {
         }, async (input) => text(await deps.nodes.update(actor, input)));
         server.registerTool("node_archive", {
             title: "Archive node",
-            description: "Archive or restore one node using optimistic concurrency. Archiving an agent also switches off its Gate application; restoring switches it back on.",
+            description: "Archive or restore one node. Archiving hides it from listings and search and takes its vectors out of the index; nothing is deleted and every version stays readable, so restoring is the same call with `archived: false`.",
             inputSchema: ArchiveNodeInput,
             annotations: {
                 title: "Archive node",
                 readOnlyHint: false,
                 destructiveHint: true,
                 idempotentHint: true,
-                // The one node mutation that can reach a system outside Intel: archiving an agent
-                // switches its Gate Application (#182). Nothing else here leaves the installation.
-                openWorldHint: true,
+                // ⚠️ `true` until #418, and the reason is worth keeping: archiving an agent used to
+                // switch its Gate Application off (#182), which was the one node mutation that reached
+                // outside. With the agents parked nothing here leaves the installation — and an
+                // openWorldHint that is wrong in the cautious direction is still wrong, because it is
+                // the field a client decides on.
+                openWorldHint: false,
             },
-        }, 
-        // The caller's own bearer, exactly as the runtime proxy uses it and for the same reason:
-        // switching a machine principal is an act in Gate, performed by the person asking.
-        async (input) => text(await deps.nodes.archive(actor, input, { token: deps.bearer })));
+        }, async (input) => text(await deps.nodes.archive(actor, input)));
     }
-    if (permits(deps.authorization, "knowledge", "share")) {
-        server.registerTool("node_shares_list", {
-            title: "List node shares",
+    if (permits(deps.authorization, "nodes", "share")) {
+        server.registerTool("node_grant_list", {
+            title: "List node grants",
             description: "List direct grants for nodes the caller is allowed to manage.",
             inputSchema: ListGrantsInput,
             annotations: {
-                title: "List node shares",
+                title: "List node grants",
                 readOnlyHint: true,
                 destructiveHint: false,
                 idempotentHint: true,
                 openWorldHint: false,
             },
         }, async (input) => text(await deps.nodes.listGrants(actor, input.resourceId)));
-        server.registerTool("node_share", {
-            title: "Share node",
+        server.registerTool("node_grant_create", {
+            title: "Grant node access",
             description: "Grant inherited node access to a Gate user, verified email, or the organization.",
             inputSchema: ShareInput,
             annotations: {
-                title: "Share node",
+                title: "Grant node access",
                 readOnlyHint: false,
                 destructiveHint: false,
                 idempotentHint: true,
                 openWorldHint: false,
             },
         }, async (input) => text(await deps.nodes.share(actor, input)));
-        server.registerTool("node_revoke_share", {
-            title: "Revoke node share",
+        server.registerTool("node_grant_revoke", {
+            title: "Revoke node grant",
             description: "Revoke one direct node grant by ID.",
             inputSchema: RevokeGrantInput,
             annotations: {
-                title: "Revoke node share",
+                title: "Revoke node grant",
                 readOnlyHint: false,
                 destructiveHint: true,
                 idempotentHint: true,
@@ -684,7 +504,7 @@ export async function handleMcp(request, deps) {
         }, async (input) => text(await deps.nodes.revokeGrant(actor, input)));
     }
     if (permits(deps.authorization, "flows", "read")) {
-        server.registerTool("flows_list", {
+        server.registerTool("flow_list", {
             title: "List flows",
             description: "List authorized flows, either all of them or the ones filed in one folder of the shared tree.",
             inputSchema: ListFlowsInput,
@@ -711,7 +531,7 @@ export async function handleMcp(request, deps) {
         // Named like `knowledge_versions_list`, because it is the same question about the other kind of
         // thing in the tree. This pair is what turns the `versionId` that `flow_publish` and
         // `flow_publish_preview` demand into something an MCP client can actually obtain (#144).
-        server.registerTool("flow_versions_list", {
+        server.registerTool("flow_version_list", {
             title: "List flow versions",
             description: "List the immutable versions of one authorized flow, oldest first, marking which of them is published. Metadata only; flow_version_get loads a version's graph.",
             inputSchema: GetFlowInput,
@@ -735,7 +555,7 @@ export async function handleMcp(request, deps) {
                 openWorldHint: false,
             },
         }, async (input) => text(await deps.flows.getVersion(flowActor, input)));
-        server.registerTool("flow_calls_list", {
+        server.registerTool("flow_call_list", {
             title: "List called flows",
             description: "List the flows one flow calls, read out of its graph rather than out of where it is filed.",
             inputSchema: GetFlowInput,
@@ -750,7 +570,7 @@ export async function handleMcp(request, deps) {
         // ⚠️ Only nodes the requesting user may see are in the answer, placeholders included: an edge to
         // a grey box would already say that something is there. The same rule the screen follows,
         // because it is the same service (#19).
-        server.registerTool("flow_relation_graph", {
+        server.registerTool("flow_graph", {
             title: "Read the relation graph",
             description: "Read what accesses what for one folder or one flow: which flow reads which document and which flow calls which flow.",
             inputSchema: RelationGraphInput,
@@ -774,7 +594,7 @@ export async function handleMcp(request, deps) {
                 openWorldHint: false,
             },
         }, async (input) => text(await deps.flows.validate(flowActor, input.flowId)));
-        server.registerTool("flow_requirements_list", {
+        server.registerTool("flow_requirement_list", {
             title: "List what a flow needs",
             description: "List the documents and MCP tools one flow's graph names. Documents the calling user cannot see are counted rather than named, and no claim is made about whether anyone may reach them: for tools that cannot be known in advance, because the catalog is a live query with each user's own portal token.",
             inputSchema: GetFlowInput,
@@ -801,7 +621,7 @@ export async function handleMcp(request, deps) {
         // ⚠️ Model context like every other tool result: what a run did, never what it produced. The run
         // input and output are absent because a run reaches nodes and tools with the rights of
         // whoever started it, and only their own runs are the calling user's to read out that way.
-        server.registerTool("flow_runs_list", {
+        server.registerTool("flow_run_list", {
             title: "List flow runs",
             description: "List the runs of one flow, newest first, with status, start, duration, what triggered them, and for a failed run the step that ended it. Optionally only the failed ones. Runs the calling user may not see are absent, and a failure inside a called flow they may not see is named by the calling step alone.",
             inputSchema: ListFlowRunsInput,
@@ -813,7 +633,7 @@ export async function handleMcp(request, deps) {
                 openWorldHint: false,
             },
         }, async (input) => text(await deps.flows.listRuns(flowActor, input)));
-        server.registerTool("flow_run_steps_list", {
+        server.registerTool("flow_run_step_list", {
             title: "List flow run steps",
             description: "List every completed step of one run, oldest first, with its outcome, branch, and the reason a failed step gives, plus the call chain the run belongs to.",
             inputSchema: GetFlowRunInput,
@@ -827,7 +647,7 @@ export async function handleMcp(request, deps) {
         }, async (input) => text(await deps.flows.listRunSteps(flowActor, input.runId)));
     }
     // A flow has no share tool of its own. Sharing happens on the folder a flow is filed in, through
-    // node_share, so a narrower grant cannot sit beside the folder grant (ADR-0004 §2).
+    // node_grant_create, so a narrower grant cannot sit beside the folder grant (ADR-0004 §2).
     if (permits(deps.authorization, "flows", "create")) {
         server.registerTool("flow_create", {
             title: "Create flow",
@@ -869,12 +689,12 @@ export async function handleMcp(request, deps) {
                 openWorldHint: false,
             },
         }, async (input) => text(await deps.flows.archive(flowActor, input)));
-        server.registerTool("flow_save", {
-            title: "Save flow",
+        server.registerTool("flow_version_create", {
+            title: "Create flow version",
             description: "Append a validated immutable flow graph version with optimistic concurrency.",
             inputSchema: SaveFlowVersionInput,
             annotations: {
-                title: "Save flow",
+                title: "Create flow version",
                 readOnlyHint: false,
                 destructiveHint: false,
                 idempotentHint: true,
@@ -938,7 +758,7 @@ export async function handleMcp(request, deps) {
                 openWorldHint: false,
             },
         }, async (input) => text(await deps.flows.start(flowActor, input)));
-        server.registerTool("flow_run_complete_step", {
+        server.registerTool("flow_run_step_complete", {
             title: "Complete flow step",
             description: "Submit a node result or semantic branch to advance a durable run without persisting credentials.",
             inputSchema: CompleteFlowRunStepInput,
@@ -965,103 +785,8 @@ export async function handleMcp(request, deps) {
             },
         }, async (input) => text(await deps.flows.cancelRun(flowActor, input)));
     }
-    /**
-     * Driving an agent, over the same door the screen uses.
-     *
-     * ⚠️ The three below are the MCP half of the two head actions on the agent page — the repository's
-     * "one business layer, three thin surfaces" rule, kept in the same delivery. They call the runtime
-     * through `deps.agents`, which resolves the resource ACL and forwards the CALLER's bearer; a tool
-     * that reached the runtime with anything else would be Intel acting as somebody it is not.
-     */
-    if (permits(deps.authorization, "agents", "run")) {
-        server.registerTool("agent_pause", {
-            title: "Pause agent",
-            description: "Stop an agent from acting on its own: no schedule fires, no task and no mail is taken. Its chat keeps answering, and nothing is queued up for later.",
-            inputSchema: PauseAgentInput,
-            annotations: {
-                title: "Pause agent",
-                readOnlyHint: false,
-                // Nothing is deleted, and yet work that would have happened does not — a client deciding
-                // whether to ask first has to be told that.
-                destructiveHint: true,
-                idempotentHint: true,
-                openWorldHint: false,
-            },
-        }, async (input) => text(await deps.agents.request({
-            actor: agentActor,
-            token: deps.bearer,
-            agentId: input.nodeId,
-            method: "POST",
-            path: "/pause",
-            body: "{}",
-        })));
-        server.registerTool("agent_resume", {
-            title: "Resume agent",
-            description: "Let a paused agent act again. Its schedules are armed from the definition as it stands now; nothing that was due while it stood still is caught up.",
-            inputSchema: PauseAgentInput,
-            annotations: {
-                title: "Resume agent",
-                readOnlyHint: false,
-                destructiveHint: false,
-                idempotentHint: true,
-                openWorldHint: false,
-            },
-        }, async (input) => text(await deps.agents.request({
-            actor: agentActor,
-            token: deps.bearer,
-            agentId: input.nodeId,
-            method: "POST",
-            path: "/resume",
-            body: "{}",
-        })));
-        /**
-         * ⚠️ The MCP half of the profile's cost figures, in the same delivery slice — the repository's
-         * "every user-visible capability has an Intel MCP equivalent" rule.
-         *
-         * ⚠️ Under `agents/run` beside pause and resume, not under `knowledge/read`. What an agent
-         * spends is as sensitive as what it did, and this answer stands beside the run list rather than
-         * beside the node.
-         *
-         * ⚠️ `status` travels with the numbers and is not flattened away. A client that read an empty
-         * `runs` list as "this agent is free" would be reporting a Cloudflare outage as a saving.
-         */
-        server.registerTool("agent_costs", {
-            title: "Agent costs",
-            description: "What one agent has actually cost, read from Cloudflare's AI Gateway log: per run, and as a total over the last 7 and 30 days. `status` says whether the numbers were read at all — `not_configured` and `unreadable` both mean no figures, never zero cost. `partial` means the read hit its page limit, so the totals are a floor.",
-            inputSchema: PauseAgentInput,
-            annotations: {
-                title: "Agent costs",
-                readOnlyHint: true,
-                destructiveHint: false,
-                idempotentHint: true,
-                openWorldHint: false,
-            },
-        }, async (input) => text(await deps.agentCosts.read(agentActor, input.nodeId)));
-        server.registerTool("agent_run_now", {
-            title: "Run agent now",
-            description: "Fire one of the agent's own schedules straight away, against the document or flow it names. The run appears in the agent's run list; a target the agent does not schedule is refused.",
-            inputSchema: RunAgentNowInput,
-            annotations: {
-                title: "Run agent now",
-                readOnlyHint: false,
-                destructiveHint: false,
-                // Every run is a new run, so asking twice runs it twice.
-                idempotentHint: false,
-                // The agent may reach whatever its own definition grants it, so what a run touches is not
-                // knowable from this schema.
-                openWorldHint: true,
-            },
-        }, async (input) => text(await deps.agents.request({
-            actor: agentActor,
-            token: deps.bearer,
-            agentId: input.nodeId,
-            method: "POST",
-            path: "/run",
-            body: JSON.stringify({ target: input.target }),
-        })));
-    }
     if (permits(deps.authorization, "tools", "read")) {
-        server.registerTool("tools_catalog_list", {
+        server.registerTool("tool_list", {
             title: "List tools",
             description: "List the MCP tools the calling user can reach through the portal, live rather than cached.",
             inputSchema: EmptyInput,
@@ -1073,12 +798,10 @@ export async function handleMcp(request, deps) {
                 openWorldHint: false,
             },
         }, async () => text(await deps.tools.catalog(toolActor)));
-        // The MCP twin of the picker in the agent profile (D30): whole servers, so an agent can be
-        // given tools from a client instead of from the screen. Assigning and removing is
-        // `agent_update` — a delegation is a field of the definition, not a surface of its own.
-        server.registerTool("tools_servers_list", {
+        // The servers behind the same live list (D30), as the portal itself names them.
+        server.registerTool("tool_server_list", {
             title: "List tool servers",
-            description: "List the MCP servers the calling user reaches through the portal, as the portal itself names them. These are the handles an agent definition may delegate.",
+            description: "List the MCP servers the calling user reaches through the portal, as the portal itself names them. The handle is the prefix on every tool name from that server, which is how tool_execute is routed.",
             inputSchema: EmptyInput,
             annotations: {
                 title: "List tool servers",
@@ -1090,7 +813,7 @@ export async function handleMcp(request, deps) {
         }, async () => text(await deps.tools.servers(toolActor)));
     }
     if (permits(deps.authorization, "tools", "test")) {
-        server.registerTool("tools_test", {
+        server.registerTool("tool_test", {
             title: "Test tool",
             description: "Validate input and execute one explicitly read-only cached MCP tool with the caller's Gate connection.",
             inputSchema: TestToolInput,
@@ -1104,7 +827,7 @@ export async function handleMcp(request, deps) {
         }, async (input) => text(await deps.tools.test(toolActor, input)));
     }
     if (permits(deps.authorization, "tools", "execute")) {
-        server.registerTool("tools_execute", {
+        server.registerTool("tool_execute", {
             title: "Execute tool",
             description: "Validate and execute a discovered MCP tool with the caller's just-in-time Gate connection.",
             inputSchema: ExecuteToolInput,