@edgehero/pi-dispatch 4.0.1 → 4.2.0

package/src/doctor.mjs

@@ -66,12 +66,14 @@ import { isTransientOverlayRead, overlayProviderProblem } from "./model-catalog.
 import { EMPTY_USD_FINGERPRINT, usdFingerprint } from "./dollar-fingerprint.mjs";
 import { splitModelEntry } from "./model-ref.mjs";
 import { ignoredOutputCapModels, outputCapView, outputUnboundable } from "./output-cap.mjs";
-import { KEYLESS_API_KEY, KEYLESS_HOW, MODEL_ENDPOINTS_FILE_NAME, MODEL_ENDPOINTS_INCLUDE_NAME, MODEL_ENDPOINT_ID_RE, OVERLAY_LINK_FIX, OVERLAY_NOT_A_FILE_FIX, RENAMED_PROVIDERS, baseUrlTarget, keylessVerdict, loadModelEndpoints, providerRenameHint, readOverlayModels, renderEndpointsInclude, unreportedUsageModels } from "./model-endpoints.mjs";
+import { KEYLESS_API_KEY, KEYLESS_HOW, MODEL_ENDPOINTS_FILE_NAME, MODEL_ENDPOINTS_INCLUDE_NAME, MODEL_ENDPOINT_ID_RE, OVERLAY_LINK_FIX, OVERLAY_NOT_A_FILE_FIX, RENAMED_PROVIDERS, baseUrlTarget, endpointsAt, keylessVerdict, loadModelEndpoints, providerRenameHint, readOverlayModels, renderEndpointsInclude, unreportedUsageModels } from "./model-endpoints.mjs";
 import { declaredEndpointsIn, endpointsDeclaredIn, reloadCommand, rulesFileIncludes, rulesPredateEndpointsLine } from "./egress-cli.mjs";
 import { loadPauseWindows, parseScopeString } from "./pause-windows.mjs";
 import { WAIT_AFTER_MAX_DEFAULT_MS, afterInstantMs, parseWaitProfiles } from "./wait-for.mjs";
 import { isForgeKind } from "./forges.mjs";
 import { findLiteralSecret, ADMIN_RE } from "./import-pi.mjs";
+import { mcpServerWhere, readOverlayMcp } from "./mcp-config.mjs";
+import { allowlistEntryFor, egressRefusalFor, packageRunnerHosts, parseAllowlist } from "./egress-allowlist.mjs";
 import { agentDirFrom, readHostPi } from "./host-pi.mjs";
 import { PACKAGES_SUBDIR, readStagedSkills, readStageManifest } from "./packages.mjs";
 import { copySkillTree } from "./copy-tree.mjs";
@@ -99,6 +101,8 @@ import { CONTAINER_HOME, SHIPPED_IMAGE_UID, SIZE_LABEL_CPU, SIZE_LABEL_MEM } fro
 import { DEFAULT_JOB_SIZE, cpuCeilingCenti, formatCpus, formatMemory, jobSizeDefaults, resolveJobSize } from "./job-size.mjs";
 import { SUGGEST_WINDOW_DAYS, cpusText, hostCap, refusalWords, sizeRefusal, suggestSize, suggestionCall, suggestionEvidence } from "./size-suggest.mjs";
 import { SIZING_RECORD_MAX_BYTES, readSizingRecords } from "./size-records.mjs";
+import { CAPACITY_WINDOWS, computeCapacity } from "./capacity.mjs";
+import { JOBS_ONLY, durationText, milliText, notSharedWhy, percentText, shareText } from "./capacity-cli.mjs";
 import { CGROUP_PARENT, cgroupParentFor, operatorQuotaCommand, readQuota, reservePlan, userQuotaCommand } from "./cpu-reserve.mjs";
 import { HOST_BUDGET_KEYS, computeHostBudget, hostBudgetSettings, largestFit, neverFits, projectBudgetRow, publishedBudget, readUserServiceLimits } from "./host-budget.mjs";
 import { makeImagePreflight, normalizeImageId } from "./image-preflight.mjs";
@@ -220,6 +224,9 @@ export async function runDoctor(shellVars = process.env, deps = {}) {
 		dollarKeysExist,
 		// Issue #504 part B: the applied split's envelope digest (`alloc:plan`), read once. Undefined means the default.
 		readAppliedSplit,
+		// Issue #599, phase 2: the capacity line's read of the run history (the run mirror and the logs directory).
+		// Undefined means the default, which reads the deployment's real Valkey and files.
+		readCapacity,
 		// --live (issue #278, INT-LIVE-PROBE-CONTRACT): read the backend declarations back off short-lived real containers.
 		// STRICTLY `=== true`, so only the CLI's own flag arms it: a truthy string from a caller that forwarded an
 		// option bag runs nothing. The fs, PID-liveness and nonce are seams so the sequence is driven without Docker.
@@ -383,7 +390,7 @@ export async function runDoctor(shellVars = process.env, deps = {}) {
 						return { ...(await valkeyAuthState(url, { context, withoutPassword })), passwordSet: Boolean(sent.password), from: sent.from };
 					}
 				: null;
-	const seams = { cwd, out, spawn, probeValkey, valkeyAuth: valkeyAuthSeam, readHosts, ...(modelCatalog ? { modelCatalog } : {}), ...(piModelLoader ? { piModelLoader } : {}), ...(dollarKeysExist ? { dollarKeysExist } : {}), ...(readAppliedSplit ? { readAppliedSplit } : {}), fileExists, nodeVersion, mkdir, chmod, rm, agentDir, platform, home, providerOracle, facts, jobUserIdentity, stat, passwd, readUnit, readEnvFile: readEnvFileShared, observationFs, jobsDirFs, jobsDirUid, valkeyOwner: valkeyOwnerSeam, isAlive, pid, runTimeouts, live: live === true, wallClock, ...(readRunRecords ? { readRunRecords } : {}), venueChecks, userName, proxyFilesExist, proxyFileIsDirectory, ...(includeNeeds ? { includeNeeds } : {}), ...(declaredEndpoints ? { declaredEndpoints } : {}), ...(readOverlayFile ? { readOverlayFile } : {}), ...(lstatOverlayFile ? { lstatOverlayFile } : {}), ...(hostAddresses ? { hostAddresses } : {}), ...(readProxyConf ? { readProxyConf } : {}), ...(readPackagedConf ? { readPackagedProxyConf: readPackagedConf } : {}), ...(readPodmanService ? { readPodmanService } : {}), serviceEnvFile: envValues === null ? null : serviceEnvFileOf(envValues, envPath, serviceEnvLoader(platform)) };
+	const seams = { cwd, out, spawn, probeValkey, valkeyAuth: valkeyAuthSeam, readHosts, ...(modelCatalog ? { modelCatalog } : {}), ...(piModelLoader ? { piModelLoader } : {}), ...(dollarKeysExist ? { dollarKeysExist } : {}), ...(readAppliedSplit ? { readAppliedSplit } : {}), ...(readCapacity ? { readCapacity } : {}), fileExists, nodeVersion, mkdir, chmod, rm, agentDir, platform, home, providerOracle, facts, jobUserIdentity, stat, passwd, readUnit, readEnvFile: readEnvFileShared, observationFs, jobsDirFs, jobsDirUid, valkeyOwner: valkeyOwnerSeam, isAlive, pid, runTimeouts, live: live === true, wallClock, ...(readRunRecords ? { readRunRecords } : {}), venueChecks, userName, proxyFilesExist, proxyFileIsDirectory, ...(includeNeeds ? { includeNeeds } : {}), ...(declaredEndpoints ? { declaredEndpoints } : {}), ...(readOverlayFile ? { readOverlayFile } : {}), ...(lstatOverlayFile ? { lstatOverlayFile } : {}), ...(hostAddresses ? { hostAddresses } : {}), ...(readProxyConf ? { readProxyConf } : {}), ...(readPackagedConf ? { readPackagedProxyConf: readPackagedConf } : {}), ...(readPodmanService ? { readPodmanService } : {}), serviceEnvFile: envValues === null ? null : serviceEnvFileOf(envValues, envPath, serviceEnvLoader(platform)) };
 	// Issue #471: every other service key, resolved ONCE for the whole run (the fix pass's re-collect and `--live` judge the
 	// same resolution). THE RULE (PR #474's round cap, after three rounds of trust patches): no program doctor starts is
 	// handed anything from `.env`. Every child gets this shell's own environment, the one it had before #471; a `.env`
@@ -595,7 +602,7 @@ export const ENV_FILE_READABLE_KEYS = Object.freeze(["PI_PAUSE_WINDOWS_FILE", "P
 export const GITHUB_SERVICE_KEYS = Object.freeze(["GITHUB_AUTH_SOURCE", "GITHUB_APP_ID", "GITHUB_APP_INSTALLATION_ID", "GITHUB_APP_PRIVATE_KEY_PATH", "GITHUB_APP_PRIVATE_KEY"]);
 /** Issue #471: the worker's settings doctor judges, which it read from this shell alone while the service read them from
  *  `.env`. TEMP is TMPDIR's twin in the worker's temp root; PI_CODING_AGENT_DIR is where the worker reads auth.json. */
-export const WORKER_SERVICE_KEYS = Object.freeze(["PI_JOB_IMAGE", "PI_JOB_MEMORY", "PI_JOB_CPUS", "PI_CONCURRENCY", ...Object.values(HOST_BUDGET_KEYS), "PI_TRIGGERS_FILE", "PI_LOGS_DIR", "PI_SETTINGS_FILE", "PI_SESSIONS_DIR", "PI_SESSIONS_TTL_DAYS", "PI_SESSION_MAX_AGE_DAYS", "PI_SESSION_MAX_CONTEXT_PCT", "PI_SESSION_MAX_RESUME_CHAIN", "PI_GLOBAL_PI_DIR", "PI_GLOBAL_ALLOW_EXTENSIONS", "PI_FORWARD_ENV", "PI_AUTH_FROM_PI", "PI_CODING_AGENT_DIR", "PI_BACKEND_FLOOR", "PI_SECRET_PROFILES", "PI_SECRET_RESOLVER_ROOTS", "PI_WAIT_PROFILES", "PI_WAIT_AFTER_MAX_MS", "PI_SANDBOX_RETENTION_HOURS", "PI_ALLOWED_MODELS", "PI_DISPATCH_RUN_ROOTS", "GITHUB_PAT_VAR", "TEMP", ...Object.values(DOLLAR_ENV_NAMES)]);
+export const WORKER_SERVICE_KEYS = Object.freeze(["PI_JOB_IMAGE", "PI_JOB_MEMORY", "PI_JOB_CPUS", "PI_CONCURRENCY", ...Object.values(HOST_BUDGET_KEYS), "PI_TRIGGERS_FILE", "PI_LOGS_DIR", "PI_LOG_RETENTION_DAYS", "PI_SETTINGS_FILE", "PI_SESSIONS_DIR", "PI_SESSIONS_TTL_DAYS", "PI_SESSION_MAX_AGE_DAYS", "PI_SESSION_MAX_CONTEXT_PCT", "PI_SESSION_MAX_RESUME_CHAIN", "PI_GLOBAL_PI_DIR", "PI_GLOBAL_ALLOW_EXTENSIONS", "PI_FORWARD_ENV", "PI_AUTH_FROM_PI", "PI_CODING_AGENT_DIR", "PI_BACKEND_FLOOR", "PI_SECRET_PROFILES", "PI_SECRET_RESOLVER_ROOTS", "PI_WAIT_PROFILES", "PI_WAIT_AFTER_MAX_MS", "PI_SANDBOX_RETENTION_HOURS", "PI_ALLOWED_MODELS", "PI_DISPATCH_RUN_ROOTS", "GITHUB_PAT_VAR", "TEMP", ...Object.values(DOLLAR_ENV_NAMES)]);
 /** Issue #471: the receiver's keys doctor judges its boot by (the receiver's unit reads the same `.env`). */
 export const RECEIVER_SERVICE_KEYS = Object.freeze(["WEBHOOK_SECRET", "RECEIVER_PORT", "GITLAB_TOKEN", "GITLAB_URL", "GITLAB_WEBHOOK_MODE", "GITLAB_WEBHOOK_SECRET", "FORGEJO_URL", "FORGEJO_TOKEN", "FORGEJO_WEBHOOK_SECRET", "AZURE_ORG_URL", "AZURE_TOKEN", "AZURE_WEBHOOK_MODE", "AZURE_WEBHOOK_SECRET", "AZURE_WEBHOOK_HEADER"]);
 /**
@@ -2594,6 +2601,11 @@ export async function collectChecks(shellVars, seams) {
 		// Said, rather than silently absent: "no peers" and "could not ask" are different facts.
 		checks.push({ ok: true, label: `Fleet: could not read the host registry (${printable(fleet.unreachable)})` });
 	}
+	// Issue #599, phase 2: how busy each host was over the last 7 days, one fact line per host, never a warning (nothing
+	// decides on it). On every deployment, a single host too: its own files are read when the run mirror is not. Read from
+	// the same Valkey the fleet was, with the registry rows just read (their running jobs count up to now), every Valkey
+	// call bounded and the whole read under `CAPACITY_DOCTOR_TIMEOUT_MS`, so a slow mirror costs this line, not the run.
+	checks.push(...(await doctorCapacity({ seams, env, home, url: valkeyUsable ? valkeyTalkUrl : null, hosts: fleet.hosts ?? [], localHost: workerNameOf(declaredWorkerName) })));
 	// Issue #504 part B: the APPLIED split names the envelope it was made for, and every host
 	// whose envelope differs refuses its governed jobs. Read whenever this command may talk to the Valkey (above), from
 	// the same Valkey the fleet was read from; with no split there, or no answer, nothing is said.
@@ -2718,6 +2730,23 @@ export async function collectChecks(shellVars, seams) {
 					},
 				},
 			});
+			// The overlay's MCP servers (REQ-MCP-OPERATOR-SERVERS), through the one parser (mcp-config.mjs).
+			let mcpAllowlist = [];
+			try {
+				mcpAllowlist = parseAllowlist(keylessIo.readFileSync(join(seams.cwd, "egress-allowlist.conf"), "utf8"));
+			} catch {
+				// No allowlist in this folder: every server outside a declared endpoint reads as unreachable, which it is.
+			}
+			checks.push(
+				...overlayMcpChecks({
+					overlay,
+					env,
+					fileExists,
+					read: () => readOverlayMcp(overlay, { readFileSync: seams.readOverlayFile ?? ((p, enc) => readFileSync(p, enc)), ...(seams.lstatOverlayFile ? { lstatSync: seams.lstatOverlayFile } : {}) }),
+					allowlist: mcpAllowlist,
+					endpoints: () => (seams.declaredEndpoints ?? ((a) => declaredEndpointsIn({ ...a, fs: keylessIo })))({ env, cwd: seams.cwd, platform: seams.platform ?? process.platform, valkeyUrl: env.VALKEY_URL ?? DEFAULT_VALKEY_URL }),
+				}),
+			);
 			const modelsPath = join(overlay, "models.json");
 			// Through the one reader (`readOverlayModels`, PR #520): an exists test answered false for a file under an
 			// unreadable directory, so this line passed in silence on a file nobody had read. Absent is a pass (nothing to
@@ -4722,21 +4751,15 @@ export function appliedSplitChecks(applied, mine, myName, peers) {
  */
 export async function defaultReadAppliedSplit(url) {
 	try {
-		const { makeRedisClient } = await import("./connection.mjs");
-		const client = makeRedisClient(url, { failFast: true, lazyConnect: true });
-		client.on("error", () => {});
-		try {
-			await client.connect();
-			const text = await client.get(ALLOC_PLAN_KEY);
+		return await withDoctorClient(url, async (client) => {
+			const text = await boundedOp(client.get(ALLOC_PLAN_KEY), DOCTOR_VALKEY_OP_TIMEOUT_MS);
 			if (text === null || text === undefined) return null;
 			let digest = null;
 			try {
 				digest = JSON.parse(text)?.envelopeDigest;
 			} catch {}
 			return typeof digest === "string" && /^[0-9a-f]{16}$/.test(digest) ? { digest } : { undecodable: true };
-		} finally {
-			client.disconnect();
-		}
+		});
 	} catch {
 		return null;
 	}
@@ -5900,6 +5923,79 @@ export function forgeUrlEgressChecks(env, forges = []) {
 	return checks;
 }
 
+/**
+ * The overlay's MCP servers (REQ-MCP-OPERATOR-SERVERS): whether `mcp.json` reads, each server a job may be offered,
+ * each one refused and why, no `mcp-auth.json` beside it, and, with the egress policy on, whether each streamable HTTP
+ * server is one the proxy lets a job reach. A refused server is one no job can use, so each is ✗; an unreachable one
+ * is ⚠, since the policy may be about to change.
+ * `read` throws the reader's errors; `endpoints` is called only when a server needs it.
+ */
+export function overlayMcpChecks({ overlay, env, fileExists, read, allowlist = [], endpoints = () => [] }) {
+	const checks = [];
+	const authPath = join(overlay, "mcp-auth.json");
+	if (fileExists(authPath)) {
+		checks.push({
+			ok: false,
+			label: "Overlay holds mcp-auth.json, pi's MCP sign-ins, which no job may hold",
+			fix: "delete mcp-auth.json from the overlay; a job's MCP server takes its credential as a ${NAME} reference from run.secrets: docs/mcp.md",
+			fixAction: {
+				tier: "prompt",
+				describe: `rm ${authPath}`,
+				run: async ({ rm }) => {
+					rm(authPath);
+					return { ok: true };
+				},
+			},
+		});
+	}
+	let parsed;
+	try {
+		parsed = read();
+	} catch (error) {
+		const why = error?.mcpConfig ? error.message : `cannot be read (${error?.code ?? "unreadable"})`;
+		checks.push({ ok: false, label: `Overlay mcp.json: ${why}`, fix: "re-run `pi-dispatch import-pi`, or fix the file: docs/mcp.md. Until it reads, no job can use an MCP server" });
+		return checks;
+	}
+	if (parsed === null) return checks;
+	const names = Object.keys(parsed.servers);
+	checks.push({ ok: true, label: names.length === 0 ? "Overlay mcp.json offers no MCP server" : `Overlay mcp.json offers ${names.length} MCP server${names.length === 1 ? "" : "s"} to triggers that name them (${names.join(", ")})` });
+	for (const { name, problem } of parsed.refused) {
+		checks.push({ ok: false, label: `Overlay mcp.json: server ${quotedShown(name)} is refused: ${problem}`, fix: "fix the entry and re-run `pi-dispatch import-pi`: docs/mcp.md. Until then no job can use it" });
+	}
+	let armed = false;
+	try {
+		armed = egressArmed(env) === true;
+	} catch {
+		// A malformed PI_EGRESS: the .env check reports it.
+	}
+	let declared = null;
+	for (const name of names) {
+		const server = parsed.servers[name];
+		if (server.packageRunner) {
+			const missing = packageRunnerHosts(server.command).filter((host) => allowlistEntryFor(allowlist, host) === null);
+			const listed = missing.length === 0;
+			const registry = missing.join(" and ");
+			checks.push({
+				ok: false,
+				warn: true,
+				label: `MCP server ${name} runs ${mcpServerWhere(server)}, which fetches the server from a package registry at the start of every job that uses it`,
+				fix: armed && !listed ? `install the server in the job image instead, or allowlist ${registry} in egress-allowlist.conf: docs/mcp.md` : "install the server in the job image instead, so every job runs the version you chose: docs/mcp.md",
+			});
+		}
+		if (!armed || server.transport !== "http" || server.enabled === false) continue;
+		declared ??= endpoints();
+		const refusal = egressRefusalFor(server.url, { allowlist, endpoints: declared });
+		if (refusal === null) continue;
+		checks.push({
+			ok: false,
+			warn: true,
+			label: `MCP server ${name} (${mcpServerWhere(server)}) is not reachable with the egress policy on: ${refusal}`,
+			fix: "use an https:// url and allowlist its host for 443, or declare its host and port in model-endpoints.json: docs/egress.md. Until then no job can reach it",
+		});
+	}
+	return checks;
+}
+
 /** The canary's three probes. ONE list: the loop names its containers from it and the sweep matches on it. */
 export const CANARY_PROBE_SLUGS = Object.freeze(["provider", "unlisted", "plainhttp"]);
 
@@ -6149,6 +6245,7 @@ async function egressChecks(env, seams, { dockerCode, imageCode, jobImage, endpo
 	const { declaredEndpoints = ({ env: e, cwd, platform }) => declaredEndpointsIn({ env: e, cwd, fs: { readFileSync, existsSync }, platform }), hostAddresses = () => lanIPv4Addresses(networkInterfaces()) } = seams;
 	const declared = declaredEndpoints({ env, cwd: seams.cwd, platform: seams.platform ?? process.platform });
 	const endpoints = declared.length > 0 && !(!custom && inFolder && !needs.rulesInclude) ? declared : [];
+	const mcpOnly = endpoints.length > 0 ? mcpOnlyEndpoints({ endpoints, ...overlayEndpointUsers(env, seams) }) : new Map();
 	if (endpoints.length > 0) {
 		const runtime = routeRuntimeFromFacts(seams.readFactsOnce ? await seams.readFactsOnce() : null, seams.platform ?? process.platform);
 		const addresses = hostAddresses();
@@ -6255,7 +6352,7 @@ async function egressChecks(env, seams, { dockerCode, imageCode, jobImage, endpo
 	// script. docker's probes keep `runCmdCapture` (its 30 s bound, stderr merged, SIGTERM at the bound) rather than the
 	// bounded step runner, so docker's spawns, and what a probe that never launched leaves for the teardown, are exactly
 	// what they were: pinned in doctor.test.mjs against the output and argv captured before the move.
-	const canary = await runEgressCanary({ run: liveRunVia(spawn), probeRun: (args) => runCmdCapture(spawn, "docker", args), proxy, image: jobImage, pid, gate, endpoints });
+	const canary = await runEgressCanary({ run: liveRunVia(spawn), probeRun: (args) => runCmdCapture(spawn, "docker", args), proxy, image: jobImage, pid, gate, endpoints, mcpOnly });
 	// Through a stale proxy the canary reads THAT proxy's policy (exec round 3): a failure is the proxy's to fix, never
 	// this deployment's allowlist, which it may not even mount.
 	checks.push(...(staleRunning ? canary.checks.map((c) => (c.ok ? c : { ...c, fix: `the canary ran through ${proxy}, which is not this deployment's proxy (above), so this says nothing about egress-allowlist.conf: ${replaceFix}, then re-run doctor` })) : canary.checks));
@@ -6349,8 +6446,10 @@ const CANARY_NO_WORKSPACE = "/nonexistent/pi-dispatch-egress-canary-mounts-nothi
  *
  * `endpoints` (issue #503) are the declared model endpoints to prove on the same network after the three
  * (`runEndpointProbes`), `[]` by default, so the conformance script and a deployment with none run exactly the three.
+ * `mcpOnly` maps the ids of those only an overlay MCP server uses (`mcpOnlyEndpoints`), whose `models` probe proves
+ * the route and is not judged as a model server's answer.
  */
-export async function runEgressCanary({ run, bin = "docker", proxy, image, pid = process.pid, user = null, probeRun = null, endpoints = [], size = DEFAULT_JOB_SIZE, hostCpus = null, gate = makeDetachGate((args, opts) => run(args, { timeoutMs: opts?.timeoutMs ?? CANARY_STEP_TIMEOUT_MS }), { bin }) }) {
+export async function runEgressCanary({ run, bin = "docker", proxy, image, pid = process.pid, user = null, probeRun = null, endpoints = [], mcpOnly = new Map(), size = DEFAULT_JOB_SIZE, hostCpus = null, gate = makeDetachGate((args, opts) => run(args, { timeoutMs: opts?.timeoutMs ?? CANARY_STEP_TIMEOUT_MS }), { bin }) }) {
 	const venue = canaryVenueFor(bin);
 	const probe = probeRun ?? ((args) => run(args, { timeoutMs: bin === "podman" ? PODMAN_FIRST_START_TIMEOUT_MS : RUN_TIMEOUTS.cmd }));
 	const checks = [];
@@ -6505,7 +6604,7 @@ export async function runEgressCanary({ run, bin = "docker", proxy, image, pid =
 			if (staleRunner) {
 				checks.push({ ok: false, warn: true, label: `${venue.prefix}Model endpoints: not probed, because the job image has no runner module (above), and their probes take the runner's route`, fix: "use a job image built after issue #427, then re-run doctor" });
 			} else {
-				checks.push(...(await runEndpointProbes({ probe, bin, pid, network: net, proxy, image, user, endpoints, venue, unfinished, size, hostCpus })));
+				checks.push(...(await runEndpointProbes({ probe, bin, pid, network: net, proxy, image, user, endpoints, mcpOnly, venue, unfinished, size, hostCpus })));
 			}
 		}
 	} finally {
@@ -6609,6 +6708,66 @@ function endpointsById(endpoints) {
 	return [...endpoints].sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
 }
 
+/**
+ * The declared endpoints that an overlay MCP server dials (an enabled streamable HTTP server's `url` in `mcp.json`, the
+ * servers doctor's own MCP check and the pickup judge) and no overlay model does (a provider's or a model's `baseUrl` in `models.json`), each matched by `endpointsAt`, as the
+ * pickup's egress check matches an MCP server to an endpoint. docs/egress.md has an operator declare an MCP server off
+ * port 443 there, and such a server does not serve `/v1/models`: it answers 404 or 405, and the `models` probe used to
+ * warn on every run that the port was not the model server's. Its tunnel is still opened and its route proved; only its
+ * answer is not judged as a model server's. An endpoint both use is probed as a model server, since a model needs that.
+ * A models.json that could not be read is not evidence that no model uses an endpoint, so nothing is MCP-only then.
+ * Returns a Map of endpoint id to `{ tls }`, `tls` when a server's url on it is `https:`: the probe's plain request then
+ * meets a TLS server, which closes the socket rather than answer (`endpointProbeCheck`).
+ */
+export function mcpOnlyEndpoints({ endpoints, mcp = null, models = null, modelsUnread = false }) {
+	if (modelsUnread || !Array.isArray(endpoints) || endpoints.length === 0) return new Map();
+	const idsAt = (urls) => new Set(urls.flatMap((url) => endpointsAt(url, endpoints).map((e) => e.id)));
+	const mcpUrls = Object.values(mcp?.servers ?? {})
+		.filter((server) => server.transport === "http" && server.enabled !== false)
+		.map((server) => server.url);
+	const modelUrls = [];
+	const providers = models?.providers;
+	for (const entry of providers !== null && typeof providers === "object" ? Object.values(providers) : []) {
+		if (entry === null || typeof entry !== "object") continue;
+		modelUrls.push(entry.baseUrl);
+		for (const model of Array.isArray(entry.models) ? entry.models : []) modelUrls.push(model?.baseUrl);
+	}
+	const byModels = idsAt(modelUrls);
+	const only = new Map();
+	for (const url of mcpUrls) {
+		for (const { id } of endpointsAt(url, endpoints)) {
+			if (byModels.has(id)) continue;
+			only.set(id, { tls: only.get(id)?.tls === true || new URL(url).protocol === "https:" });
+		}
+	}
+	return only;
+}
+
+/**
+ * The overlay's mcp.json and models.json for `mcpOnlyEndpoints`, through the readers the overlay section uses and its
+ * seams. An mcp.json that cannot be read offers no server here (its own line says why); a models.json that cannot be read
+ * is `modelsUnread`, which keeps every endpoint probed as a model server.
+ */
+function overlayEndpointUsers(env, seams) {
+	const overlay = env.PI_GLOBAL_PI_DIR;
+	if (typeof overlay !== "string" || !isAbsolute(overlay)) return {};
+	const io = { readFileSync: seams.readOverlayFile ?? ((p, enc) => readFileSync(p, enc)), ...(seams.lstatOverlayFile ? { lstatSync: seams.lstatOverlayFile } : {}) };
+	let mcp = null;
+	try {
+		mcp = readOverlayMcp(overlay, io);
+	} catch {
+		// Named by the overlay section's own line.
+	}
+	try {
+		return { mcp, models: readOverlayModels(overlay, io) };
+	} catch {
+		return { mcp, modelsUnread: true };
+	}
+}
+
+/** The `blocked` codes of a socket the far end closed: what an https server does with the probe's plain request. */
+const SOCKET_CLOSED_CODES = Object.freeze(["UND_ERR_SOCKET", "ECONNRESET"]);
+
 /** The exits each probe's script ends a READING with; any other exit is a container that did not run it. */
 const ENDPOINT_PROBE_READ_EXITS = Object.freeze({ models: [0, 3, 6], nextport: [0, 3, 6], plain: [0, 3] });
 
@@ -6621,8 +6780,8 @@ const ENDPOINT_PROBE_READ_EXITS = Object.freeze({ models: [0, 3, 6], nextport: [
  *   - `plain`: a 403 carrying squid's `X-Squid-Error: ERR_ACCESS_DENIED`. A bare 403 may be the server's own answer to a
  *     request the proxy forwarded.
  */
-function endpointProbeCheck({ slug, endpoint, answer, venue, bin, proxy, next }) {
-	const head = `${venue.prefix}Model endpoint ${endpoint.id}`;
+function endpointProbeCheck({ slug, endpoint, answer, venue, bin, proxy, next, mcpOnly = null }) {
+	const head = mcpOnly ? `${venue.prefix}MCP server endpoint ${endpoint.id}` : `${venue.prefix}Model endpoint ${endpoint.id}`;
 	const at = endpointAddress(endpoint.host, endpoint.port);
 	const reading = endpointProbeReading(answer);
 	const tag = { id: endpoint.id, probe: slug, kind: reading?.kind ?? null, status: reading?.status ?? null };
@@ -6637,6 +6796,19 @@ function endpointProbeCheck({ slug, endpoint, answer, venue, bin, proxy, next })
 	}
 	const reload = reloadCommand(bin, proxy);
 	if (slug === "models") {
+		// An endpoint only an overlay MCP server uses: any answer through the tunnel proves the route and the rule, and
+		// what it says to /v1/models is not a model server's answer (`mcpOnlyEndpoints`). Not reaching it still fails below.
+		if (mcpOnly && reading.kind === "reached") {
+			return { ok: true, warn: true, label: `${head}: the route through the proxy works (the tunnel to ${at} opened and the server answered ${reading.status}); no overlay model uses it, so it is not probed as a model server`, endpointProbe: tag };
+		}
+		// An https MCP server meets the probe's plain request as TLS servers do: it closes the socket (measured: undici reads
+		// UND_ERR_SOCKET, "other side closed"; a reset is the same fact). Only a CONNECT the proxy let through reaches the
+		// server to be closed by it, since a refused tunnel reads as `tunnel`, so the route is proved. Not a timeout, and
+		// not a code that says the proxy itself was not reached (ECONNREFUSED to it, a name it could not resolve).
+		if (mcpOnly?.tls && reading.kind === "blocked" && SOCKET_CLOSED_CODES.includes(reading.detail)) {
+			return { ok: true, warn: true, label: `${head}: the route through the proxy works (the tunnel to ${at} opened and the server closed a plain request, as a TLS server does: ${reading.detail}); no overlay model uses it, so it is not probed as a model server`, endpointProbe: tag };
+		}
+		const server = mcpOnly ? "MCP server" : "model server";
 		if (reading.kind === "reached" && reading.status === 200) return { ok: true, warn: true, label: `${head} answers through the proxy (GET http://${at}/v1/models through a CONNECT tunnel: 200)`, endpointProbe: tag };
 		// The SERVER refused the request for want of a key (vLLM --api-key, a gateway in front): the route and the rule are
 		// proved, since only an open tunnel carries the server's own answer. Said apart from a fault, still warn-tier.
@@ -6669,10 +6841,12 @@ function endpointProbeCheck({ slug, endpoint, answer, venue, bin, proxy, next })
 				: reading.kind === "reached"
 					? "check that this port is the model server's and that it serves the OpenAI-compatible API under /v1 (Ollama, llama-server, vLLM and LM Studio do)"
 					: timedOut
-						? "the server is there but stuck or busy (a model still loading, every slot taken): check its own log, then re-run doctor"
+						? mcpOnly
+							? "the server is there but stuck or busy: check its own log, then re-run doctor"
+							: "the server is there but stuck or busy (a model still loading, every slot taken): check its own log, then re-run doctor"
 						: bin === "podman"
-							? `start the model server, bound to this host's LAN address or 0.0.0.0 (never 127.0.0.1 alone), and declare a server on this host as host.containers.internal (docs/egress.md, "Local model servers"). A job meets this as "Connection error"`
-							: `start the model server, and check it listens where the proxy reaches it (docs/egress.md, "Local model servers"; on Docker Engine that is 172.17.0.1 or 0.0.0.0, never 127.0.0.1 alone). A job meets this as "Connection error"`;
+							? `start the ${server}, bound to this host's LAN address or 0.0.0.0 (never 127.0.0.1 alone), and declare a server on this host as host.containers.internal (docs/egress.md, "Local model servers"). A job meets this as "Connection error"`
+							: `start the ${server}, and check it listens where the proxy reaches it (docs/egress.md, "Local model servers"; on Docker Engine that is 172.17.0.1 or 0.0.0.0, never 127.0.0.1 alone). A job meets this as "Connection error"`;
 		return { ok: false, warn: true, label: `${head} does NOT answer: ${why}`, fix, endpointProbe: tag };
 	}
 	const wider = `the proxy's rules are wider than model-endpoints.conf renders: compare the include inside it (\`${bin} exec ${proxy} cat ${ENDPOINTS_INCLUDE_IN_PROXY}\`) with \`pi-dispatch egress render\`'s, check egress-allowlist.conf does not list ${endpoint.host}, then \`${reload}\``;
@@ -6721,7 +6895,7 @@ export function undeclaredPortNear(endpoint, endpoints) {
  * variable as well on docker: the runner's dispatcher sends an `http://` origin to HTTP_PROXY, which docker's canary
  * argv does not otherwise carry (podman's is a job's environment and has it).
  */
-async function runEndpointProbes({ probe, bin, pid, network, proxy, image, user, endpoints, venue, unfinished, size = DEFAULT_JOB_SIZE, hostCpus = null }) {
+async function runEndpointProbes({ probe, bin, pid, network, proxy, image, user, endpoints, mcpOnly = new Map(), venue, unfinished, size = DEFAULT_JOB_SIZE, hostCpus = null }) {
 	const checks = [];
 	for (const endpoint of endpointsById(endpoints)) {
 		const next = undeclaredPortNear(endpoint, endpoints);
@@ -6736,7 +6910,7 @@ async function runEndpointProbes({ probe, bin, pid, network, proxy, image, user,
 			const name = egressEndpointProbe(slug, endpoint.id, pid);
 			const answer = await probe(egressCanaryProbeArgs({ bin, slug, name, pid, network, proxy, image, url, user, script, httpProxy: true, size, hostCpus }));
 			if (answer?.code === null && answer.ended !== "error") unfinished.push(name);
-			checks.push(endpointProbeCheck({ slug, endpoint, answer, venue, bin, proxy, next }));
+			checks.push(endpointProbeCheck({ slug, endpoint, answer, venue, bin, proxy, next, mcpOnly: mcpOnly.get(endpoint.id) ?? null }));
 		}
 	}
 	return checks;
@@ -7389,16 +7563,9 @@ function workerNameOf(declared) {
 
 async function defaultReadHosts(url) {
 	try {
-		const { makeRedisClient } = await import("./connection.mjs");
 		const { readLiveHosts } = await import("./host-registry.mjs");
-		const client = makeRedisClient(url, { failFast: true, lazyConnect: true });
-		client.on("error", () => {});
-		try {
-			await client.connect();
-			return await readLiveHosts(client);
-		} finally {
-			client.disconnect();
-		}
+		// readLiveHosts bounds each of its own commands.
+		return await withDoctorClient(url, (client) => readLiveHosts(client));
 	} catch (err) {
 		return { unreachable: err?.message ?? "registry unreadable" };
 	}
@@ -7447,35 +7614,60 @@ export async function dollarKeysExistWith(client, { now = () => new Date(), dead
 /** `dollarKeysExistWith` over a fail-fast client on `url`, always disconnected. */
 export async function defaultDollarKeysExist(url) {
 	try {
-		const { makeRedisClient } = await import("./connection.mjs");
-		const client = makeRedisClient(url, { failFast: true, lazyConnect: true });
-		client.on("error", () => {});
-		try {
-			await client.connect();
-			return await dollarKeysExistWith(client);
-		} finally {
-			client.disconnect();
-		}
+		// dollarKeysExistWith bounds its whole read.
+		return await withDoctorClient(url, (client) => dollarKeysExistWith(client));
 	} catch {
 		return false;
 	}
 }
 
 async function defaultProbeValkey(url) {
-	const { makeRedisClient } = await import("./connection.mjs");
-	const client = makeRedisClient(url, { failFast: true, lazyConnect: true });
-	client.on("error", () => {}); // swallow connect errors + retries; reachability is the ✓/✗, not a trace
 	try {
-		await client.connect();
-		await client.ping();
-		return true;
+		return await withDoctorClient(url, async (client) => (await boundedOp(client.ping(), DOCTOR_VALKEY_OP_TIMEOUT_MS), true));
 	} catch {
 		return false;
+	}
+}
+
+/** How long doctor waits for a Valkey connection to be ready (the TCP connect AND the ready check), and for one command. */
+export const DOCTOR_VALKEY_CONNECT_TIMEOUT_MS = 5_000;
+export const DOCTOR_VALKEY_OP_TIMEOUT_MS = 5_000;
+
+/**
+ * One fail-fast client for one of doctor's own Valkey reads, its connection bounded, always dropped. Measured: a
+ * server that accepts the connection and never answers holds ioredis in its ready check forever (`failFast` bounds
+ * only the TCP connect), so doctor never exited; and `disconnect()` arms a 2 s timer a closed socket never clears, so
+ * the client is built with a disconnect timeout of 0 and its stream destroyed. Throws when the connection is not ready
+ * in time; `fn`'s own commands are the caller's to bound (`boundedOp`).
+ */
+export async function withDoctorClient(url, fn, { connectTimeoutMs = DOCTOR_VALKEY_CONNECT_TIMEOUT_MS, makeClient } = {}) {
+	const make = makeClient ?? (await import("./connection.mjs")).makeRedisClient;
+	const client = make(url, { failFast: true, lazyConnect: true, disconnectTimeoutMs: 0 });
+	client.on?.("error", () => {}); // swallow connect errors + retries; reachability is the ✓/✗, not a trace
+	try {
+		await connectWithin(client, connectTimeoutMs);
+		return await fn(client);
 	} finally {
-		client.disconnect();
+		try {
+			client.disconnect?.();
+			client.stream?.destroy?.();
+		} catch {
+			// a release that failed has stopped mattering
+		}
 	}
 }
 
+/** A command's reply, or a rejection after `ms` (the client is dropped by `withDoctorClient` either way). */
+export function boundedOp(promise, ms) {
+	return new Promise((resolve, reject) => {
+		const t = setTimeout(() => reject(new Error("timeout")), ms);
+		Promise.resolve(promise).then(
+			(v) => (clearTimeout(t), resolve(v)),
+			(e) => (clearTimeout(t), reject(e)),
+		);
+	});
+}
+
 /**
  * The deployment's default job size as doctor reads it (issue #596): `PI_JOB_MEMORY` and `PI_JOB_CPUS` through the
  * worker's own rule (`jobSizeDefaults`), or the built-in 4g and 2 when they do not parse (`jobSizeChecks` reports that as
@@ -7756,6 +7948,162 @@ export function hostBudgetChecks(view, { concurrency = 3, limits = [], env = {},
 	return checks;
 }
 
+/** The most the capacity read may take in doctor, all of it: a full mirror reads in well under a second. */
+export const CAPACITY_DOCTOR_TIMEOUT_MS = 5_000;
+
+/**
+ * The capacity lines (issue #599, phase 2): the report over the last 7 days (`capacity.mjs`, the CLI's function), read
+ * by `seams.readCapacity` (default: `readCapacityRecords` through a fail-fast client, `prune`-free and writing nothing).
+ * Never throws and never warns: an unreadable history is one line saying so.
+ */
+export async function doctorCapacity({ seams, env, home, url, hosts, localHost }) {
+	try {
+		const window = CAPACITY_WINDOWS["7d"];
+		const nowMs = (typeof seams.wallClock === "function" ? seams.wallClock : Date.now)();
+		const retention = typeof env.PI_LOG_RETENTION_DAYS === "string" && /^\d{1,6}$/.test(env.PI_LOG_RETENTION_DAYS) ? Number(env.PI_LOG_RETENTION_DAYS) : 30;
+		// The read is told to stop when the bound passes (`signal`): giving up on it is not enough, since a client still
+		// waiting on its connection would keep this process alive after doctor has printed everything.
+		const stop = new AbortController();
+		const args = { url, logsDir: logsDirPath(env, home), sinceMs: nowMs - window.ms, nowMs, retentionDays: retention, localHost, signal: stop.signal };
+		let timer;
+		const read = await Promise.race([
+			Promise.resolve()
+				.then(() => (seams.readCapacity ?? defaultReadCapacity)(args))
+				.finally(() => clearTimeout(timer)),
+			new Promise((resolve) => {
+				timer = setTimeout(() => {
+					stop.abort();
+					resolve(null);
+				}, seams.capacityTimeoutMs ?? CAPACITY_DOCTOR_TIMEOUT_MS);
+			}),
+		]);
+		if (read === null) return [{ ok: true, label: "Capacity: the run history did not answer in time, so nothing is shown (pi-dispatch capacity waits up to 2 s per Valkey call)" }];
+		const report = computeCapacity({ records: read.records, live: hosts, windowStartMs: nowMs - window.ms, nowMs, bucketMs: window.bucketMs, coverage: read.coverage });
+		return capacityChecks(report, { since: "7d" });
+	} catch (err) {
+		if (err?.[FORBIDDEN_READ]) throw err;
+		return [{ ok: true, label: `Capacity: not read (${printable(err?.message ?? "error")})` }];
+	}
+}
+
+/**
+ * Set by the test helper (test/helpers/doctor.mjs): from then on the DEFAULT capacity read throws an error doctor does
+ * not swallow, so a test that reaches the developer's real Valkey and logs directory fails loudly instead of printing
+ * whatever that machine holds.
+ */
+let defaultCapacityReadForbidden = false;
+export function forbidDefaultCapacityRead() {
+	defaultCapacityReadForbidden = true;
+}
+const FORBIDDEN_READ = Symbol("forbidden-read");
+
+/** How long the default read waits for its Valkey connection to be ready (the TCP connect and the ready check). */
+export const CAPACITY_CONNECT_TIMEOUT_MS = 2_000;
+
+/**
+ * The default capacity read: a fail-fast client, its connection bounded (`connectWithin`: a server that accepts TCP and
+ * never answers holds ioredis in its ready check forever) and DISCONNECTED when `signal` aborts, so a read doctor gave
+ * up on cannot keep the process alive.
+ */
+async function defaultReadCapacity({ url, logsDir, sinceMs, nowMs, retentionDays, localHost, signal }) {
+	if (defaultCapacityReadForbidden) throw Object.assign(new Error("doctor reached its real capacity read in a test: pass readCapacity"), { [FORBIDDEN_READ]: true });
+	const { readCapacityRecords } = await import("./capacity-records.mjs");
+	let client = null;
+	// Measured on ioredis 5.11: `disconnect()` ends the socket and arms a timer (`disconnectTimeout`, 2 s by default)
+	// that destroys it unless the socket's `close` clears it first, and the client's own failed ready check disconnects
+	// again after the close, arming one that nothing clears: a server that never answered held the process 2 s past
+	// doctor's bound. So the client is built with a disconnect timeout of 0 (no timer outlives the socket), its stream
+	// is destroyed in the same tick (the socket is closed by the time doctor prints), and it is dropped once.
+	const drop = () => {
+		const c = client;
+		client = null;
+		try {
+			c?.disconnect?.();
+			c?.stream?.destroy?.();
+		} catch {
+			// a release that failed has stopped mattering
+		}
+	};
+	signal?.addEventListener?.("abort", drop, { once: true });
+	if (url && !signal?.aborted) {
+		try {
+			const { makeRedisClient } = await import("./connection.mjs");
+			client = makeRedisClient(url, { failFast: true, lazyConnect: true, disconnectTimeoutMs: 0 });
+			client.on("error", () => {});
+			await connectWithin(client, CAPACITY_CONNECT_TIMEOUT_MS, signal);
+		} catch {
+			drop();
+		}
+	}
+	try {
+		return await readCapacityRecords({ redis: client, logsDir, sinceMs, nowMs, retentionDays, localHost, noMirrorReason: url ? "the Valkey did not answer: only this host's files were read" : "no Valkey to read: only this host's files were read" });
+	} finally {
+		signal?.removeEventListener?.("abort", drop);
+		drop();
+	}
+}
+
+/**
+ * `client.connect()`, or a rejection after `ms` or as soon as `signal` aborts (the client is then the caller's to
+ * disconnect). The timer goes with an abort, so nothing of a read doctor gave up on holds the process.
+ */
+export function connectWithin(client, ms, signal) {
+	return new Promise((resolve, reject) => {
+		const stop = () => (clearTimeout(t), reject(new Error("connect stopped")));
+		const t = setTimeout(() => (signal?.removeEventListener?.("abort", stop), reject(new Error("connect timeout"))), ms);
+		signal?.addEventListener?.("abort", stop, { once: true });
+		Promise.resolve(client.connect()).then(
+			(v) => (clearTimeout(t), signal?.removeEventListener?.("abort", stop), resolve(v)),
+			(e) => (clearTimeout(t), signal?.removeEventListener?.("abort", stop), reject(e)),
+		);
+	});
+}
+
+/**
+ * One fact line per host of a capacity report (`INT-CAPACITY-REPORT`), `{ ok: true, label }` each, never a warning:
+ * `Host a: last 7d busy 63% (avg 2.1 of 4 slots, full 12%), promised 48% memory / 40% CPU, used 18% CPU of 8, wait p50
+ * 40s p95 6m, most busy: web`, each part only when it is known, then what the line cannot see: the running jobs not
+ * counted, and the coverage when the history is cut, not shared, or this host's files only. Every control character is
+ * removed (the report admits none; this is the printer not relying on it).
+ */
+export function capacityChecks(report, { since = "7d" } = {}) {
+	const out = [];
+	const localOnly = report?.coverage?.source === "local";
+	for (const h of Array.isArray(report?.hosts) ? report.hosts : []) {
+		const notes = [];
+		let line;
+		if (h.coveredMs === 0) {
+			line = `Host ${h.name}: last ${since} no history here`;
+			if (!h.shared) notes.push(notSharedWhy(h, report.coverage));
+		} else {
+			const c = h.capacity ?? {};
+			const slots = Number.isSafeInteger(c.slots) ? ` of ${c.slots} slots` : " at once";
+			const full = h.fullMs !== null ? `, full ${shareText(h.fullMs, h.coveredMs)}` : "";
+			const parts = [`busy ${shareText(h.busyMs, h.coveredMs)} (avg ${milliText(h.avgMilli ?? 0)}${slots}${full})`];
+			const promised = [h.promisedMemPerMille !== null ? `${percentText(h.promisedMemPerMille)} memory` : null, h.promisedCpuPerMille !== null ? `${percentText(h.promisedCpuPerMille)} CPU` : null].filter(Boolean);
+			if (promised.length > 0) parts.push(`promised ${promised.join(" / ")}`);
+			if (h.usedCpuPerMille !== null) parts.push(`used ${percentText(h.usedCpuPerMille)} CPU${Number.isSafeInteger(c.cpus) ? ` of ${c.cpus}` : ""}`);
+			if (h.waits?.n > 0) parts.push(`wait p50 ${durationText(h.waits.p50Ms)} p95 ${durationText(h.waits.p95Ms)}`);
+			if (h.projects?.length > 0) parts.push(`most busy: ${h.projects[0].project ?? "(no project)"}`);
+			line = `Host ${h.name}: last ${since} ${parts.join(", ")}`;
+			if (h.coverage.live > 0) notes.push(`${h.coverage.live} running now, counted to now`);
+			if (h.missingMs > 0) notes.push(`history from ${new Date(h.coverage.fromMs).toISOString().slice(0, 16).replace("T", " ")} UTC only${h.coverage.truncated ? " (the run mirror holds nothing older)" : ""}, earlier time counted as neither busy nor idle`);
+			// The reason with it: a run mirror that did not answer leaves a busy fleet reading nearly idle here.
+			// The reasons end in "only this host's files were read", which this clause already says.
+			const why = typeof report.coverage.reason === "string" ? report.coverage.reason.replace(/: only this host's files were read$/, "") : "";
+			if (localOnly) notes.push(`this host's files only${why ? ` (${why})` : ""}`);
+		}
+		if (h.coverage?.liveNotCounted > 0) notes.push(`${h.coverage.liveNotCounted} running now not counted`);
+		if (h.coverage?.liveUnreadable > 0) notes.push("its running jobs could not be read, not counted");
+		if (report.coverage?.liveRowMissing === h.name) notes.push("no live row read for it, so its running jobs are not known");
+		out.push({ ok: true, label: `${line}${notes.length > 0 ? `; ${notes.join("; ")}` : ""}`.replace(/[\u0000-\u001f\u007f-\u009f]/g, "") });
+	}
+	// What none of these lines can see, in the words every surface of the report uses (REQ-CAPACITY-INSIGHTS): a fact,
+	// never a warning, once after the hosts.
+	if (out.length > 0) out.push({ ok: true, label: JOBS_ONLY.replace(/\.$/, "") });
+	return out;
+}
+
 /**
  * The fleet's budgets (issue #596, phase 2), from the registry rows (this host's own included): one line per host that
  * publishes a budget (its budget, what its jobs hold, what its holds keep, and the largest project size that fits it),
@@ -8528,6 +8876,7 @@ export async function podmanChecks(env, seams, { jobImage, jobImageNote = "" })
 	// Issue #503: the declared model endpoints `--live` probes on this venue, `[]` for none; and whether the rules the
 	// proxy runs include their file (only the shipped proxy's account copy is read; another proxy must include it).
 	let endpoints = [];
+	let mcpOnly = new Map();
 	let endpointRulesInclude = true;
 	if (armed !== false) {
 		// `.State.Status` (issue #453): only `running` carries traffic; Podman reports paused and between-restarts states
@@ -8594,6 +8943,7 @@ export async function podmanChecks(env, seams, { jobImage, jobImageNote = "" })
 		const declaredList = declaredEndpoints({ env, cwd: seams.cwd, platform: seams.platform ?? process.platform });
 		if (declaredList.length > 0 && endpointRulesInclude) {
 			endpoints = declaredList;
+			mcpOnly = mcpOnlyEndpoints({ endpoints, ...overlayEndpointUsers(env, seams) });
 			// The helper as Podman 5 names it in `podman info` (`rootlessNetworkCmd`), else as this account's running rootless
 			// network shows it (`observeRootlessNetns`, the record or the 4.x argv the worker's widening check reads), else
 			// not known, which the route row says as such.
@@ -8617,7 +8967,7 @@ export async function podmanChecks(env, seams, { jobImage, jobImageNote = "" })
 		if (keeperNetwork) checks.push(keeperNetwork);
 	}
 
-	forLive = { run: true, user, relabel, info, imagePresent, egress: { armed, proxy, proxyRunning, keeperBlocked, endpoints } };
+	forLive = { run: true, user, relabel, info, imagePresent, egress: { armed, proxy, proxyRunning, keeperBlocked, endpoints, mcpOnly } };
 	return { checks, observed, relabel, imagesReadable, imageDigest, forLive };
 }
 
@@ -9142,7 +9492,7 @@ async function podmanEgressCanary({ podman, readInfo, run, image, pid, isAlive,
 	const endpoints = podman.egress.endpoints ?? [];
 	const more = endpoints.length > 0 ? `; then three per declared model endpoint (${endpointsById(endpoints).map((e) => e.id).join(", ")}), named ${EGRESS_ENDPOINT_PROBE_PREFIX}<probe>-<id>-${pid}, removed the same way` : "";
 	announce(`starting ${probes.slice(0, -1).join(", ")} and ${probes.at(-1)} from ${image} (as the job user ${podman.user}) on the --internal network ${egressCanaryNetwork(pid)}, with ${podman.egress.proxy} attached, to read the egress allowlist back; all three are removed when the canary ends${more}`);
-	const canary = await runEgressCanary({ run, bin: "podman", proxy: podman.egress.proxy, image, pid, user: podman.user, gate, endpoints, size, hostCpus: again.info?.hostCpus ?? null });
+	const canary = await runEgressCanary({ run, bin: "podman", proxy: podman.egress.proxy, image, pid, user: podman.user, gate, endpoints, mcpOnly: podman.egress.mcpOnly ?? new Map(), size, hostCpus: again.info?.hostCpus ?? null });
 	return { checks: [...checks, ...canary.checks], results: canary.results };
 }