@frontmcp/plugin-feature-flags 1.7.2 → 1.8.1

package/adapters/feature-flag-adapter.interface.d.ts

@@ -10,7 +10,17 @@ export interface FeatureFlagAdapter {
     isEnabled(flagKey: string, context: FeatureFlagContext): Promise<boolean>;
     /** Get the variant for a flag (for multi-variate flags). */
     getVariant(flagKey: string, context: FeatureFlagContext): Promise<FeatureFlagVariant>;
-    /** Batch evaluate multiple flags at once. */
+    /**
+     * Batch evaluate multiple flags at once.
+     *
+     * An adapter MAY omit a key it has no opinion on — a flag it has never heard of. An absent
+     * key means "unknown", and the caller applies the ref's `defaultValue`; a key present with
+     * `false` means the flag is genuinely disabled and `defaultValue` does NOT apply. Conflating
+     * the two makes `defaultValue` dead code and makes listing disagree with the execution gate.
+     *
+     * Adapters backed by a remote service (Split.io, LaunchDarkly, Unleash) always have an
+     * opinion, because the service applies its own default — they answer for every key.
+     */
     evaluateFlags(flagKeys: string[], context: FeatureFlagContext): Promise<Map<string, boolean>>;
     /** Destroy the adapter (disconnect, cleanup). */
     destroy(): Promise<void>;

package/adapters/feature-flag-adapter.interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"feature-flag-adapter.interface.d.ts","sourceRoot":"","sources":["../../src/adapters/feature-flag-adapter.interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAEpF;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,yDAAyD;IACzD,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5B,wDAAwD;IACxD,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1E,4DAA4D;IAC5D,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAEtF,6CAA6C;IAC7C,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAE9F,iDAAiD;IACjD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B"}
+{"version":3,"file":"feature-flag-adapter.interface.d.ts","sourceRoot":"","sources":["../../src/adapters/feature-flag-adapter.interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAEpF;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,yDAAyD;IACzD,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5B,wDAAwD;IACxD,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1E,4DAA4D;IAC5D,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAEtF;;;;;;;;;;OAUG;IACH,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAE9F,iDAAiD;IACjD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B"}

package/adapters/static.adapter.d.ts

@@ -1,5 +1,5 @@
-import type { FeatureFlagAdapter } from './feature-flag-adapter.interface';
 import type { FeatureFlagContext, FeatureFlagVariant } from '../feature-flag.types';
+import type { FeatureFlagAdapter } from './feature-flag-adapter.interface';
 /**
  * Static/in-memory feature flag adapter.
  * Flags are defined at construction time and don't change.
@@ -10,6 +10,11 @@ export declare class StaticFeatureFlagAdapter implements FeatureFlagAdapter {
     initialize(): Promise<void>;
     isEnabled(flagKey: string, _context: FeatureFlagContext): Promise<boolean>;
     getVariant(flagKey: string, _context: FeatureFlagContext): Promise<FeatureFlagVariant>;
+    /**
+     * A key this adapter has never been configured with is OMITTED rather than reported as
+     * `false`. Only then can the caller tell "the operator disabled it" from "nobody configured
+     * it" and apply the ref's `defaultValue` to the second case only.
+     */
     evaluateFlags(flagKeys: string[], context: FeatureFlagContext): Promise<Map<string, boolean>>;
     destroy(): Promise<void>;
 }

package/adapters/static.adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"static.adapter.d.ts","sourceRoot":"","sources":["../../src/adapters/static.adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAEpF;;;GAGG;AACH,qBAAa,wBAAyB,YAAW,kBAAkB;IACjE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA+C;gBAEzD,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,kBAAkB,CAAC;IAIzD,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAI3B,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC;IAO1E,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAWtF,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAQ7F,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAG/B"}
+{"version":3,"file":"static.adapter.d.ts","sourceRoot":"","sources":["../../src/adapters/static.adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAE3E;;;GAGG;AACH,qBAAa,wBAAyB,YAAW,kBAAkB;IACjE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA+C;gBAEzD,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,kBAAkB,CAAC;IAIzD,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAI3B,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC;IAO1E,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAW5F;;;;OAIG;IACG,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAS7F,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAG/B"}

package/esm/index.mjs

@@ -246,24 +246,15 @@ import {
   DynamicPlugin,
   FlowHooksOf,
   FRONTMCP_CONTEXT,
-  ListToolsHook,
+  FrontMcpContextStorage,
   ListResourcesHook,
+  ListResourceTemplatesHook,
+  ListToolsHook,
   Plugin,
   ProviderScope as ProviderScope2,
   ToolHook
 } from "@frontmcp/sdk";
 
-// plugins/plugin-feature-flags/src/feature-flag.symbols.ts
-var FeatureFlagAdapterToken = /* @__PURE__ */ Symbol(
-  "plugin:feature-flags:adapter"
-);
-var FeatureFlagConfigToken = /* @__PURE__ */ Symbol(
-  "plugin:feature-flags:config"
-);
-var FeatureFlagAccessorToken = /* @__PURE__ */ Symbol(
-  "plugin:feature-flags:accessor"
-);
-
 // plugins/plugin-feature-flags/src/adapters/static.adapter.ts
 var StaticFeatureFlagAdapter = class {
   flags;
@@ -288,9 +279,15 @@ var StaticFeatureFlagAdapter = class {
     }
     return { ...flag };
   }
+  /**
+   * A key this adapter has never been configured with is OMITTED rather than reported as
+   * `false`. Only then can the caller tell "the operator disabled it" from "nobody configured
+   * it" and apply the ref's `defaultValue` to the second case only.
+   */
   async evaluateFlags(flagKeys, context) {
     const results = /* @__PURE__ */ new Map();
     for (const key of flagKeys) {
+      if (this.flags[key] === void 0) continue;
       results.set(key, await this.isEnabled(key, context));
     }
     return results;
@@ -299,6 +296,28 @@ var StaticFeatureFlagAdapter = class {
   }
 };
 
+// plugins/plugin-feature-flags/src/feature-flag.context.ts
+function buildFeatureFlagContext(ctx, config) {
+  if (!ctx) return {};
+  const userId = config.userIdResolver ? config.userIdResolver(ctx) : ctx.authInfo?.extra?.["sub"] ?? ctx.authInfo?.extra?.["userId"] ?? ctx.authInfo?.clientId;
+  return {
+    userId: userId ?? void 0,
+    sessionId: ctx.sessionId,
+    attributes: config.attributesResolver ? config.attributesResolver(ctx) : {}
+  };
+}
+
+// plugins/plugin-feature-flags/src/feature-flag.symbols.ts
+var FeatureFlagAdapterToken = /* @__PURE__ */ Symbol(
+  "plugin:feature-flags:adapter"
+);
+var FeatureFlagConfigToken = /* @__PURE__ */ Symbol(
+  "plugin:feature-flags:config"
+);
+var FeatureFlagAccessorToken = /* @__PURE__ */ Symbol(
+  "plugin:feature-flags:accessor"
+);
+
 // plugins/plugin-feature-flags/src/providers/feature-flag-accessor.provider.ts
 import { Provider, ProviderScope } from "@frontmcp/sdk";
 var FeatureFlagAccessor = class {
@@ -362,13 +381,7 @@ var FeatureFlagAccessor = class {
    * Build the FeatureFlagContext from the current FrontMcpContext.
    */
   buildContext() {
-    const userId = this.config.userIdResolver ? this.config.userIdResolver(this.ctx) : this.ctx.authInfo?.extra?.["sub"] ?? this.ctx.authInfo?.extra?.["userId"] ?? this.ctx.authInfo?.clientId;
-    const attributes = this.config.attributesResolver ? this.config.attributesResolver(this.ctx) : {};
-    return {
-      userId: userId ?? void 0,
-      sessionId: this.ctx.sessionId,
-      attributes
-    };
+    return buildFeatureFlagContext(this.ctx, this.config);
   }
 };
 FeatureFlagAccessor = __decorateClass([
@@ -384,7 +397,10 @@ function createFeatureFlagAccessor(adapter, ctx, config) {
 
 // plugins/plugin-feature-flags/src/feature-flag.plugin.ts
 var ListPromptsHook = FlowHooksOf("prompts:list-prompts");
-var SearchSkillsHook = FlowHooksOf("skills:search");
+var ReadResourceHook = FlowHooksOf("resources:read-resource");
+var GetPromptHook = FlowHooksOf("prompts:get-prompt");
+var CompleteHook = FlowHooksOf("completion:complete");
+var FilterSkillsHook = FlowHooksOf("skills:filter");
 var FeatureFlagPlugin = class extends DynamicPlugin {
   options;
   constructor(options) {
@@ -419,6 +435,20 @@ var FeatureFlagPlugin = class extends DynamicPlugin {
     });
     flowCtx.state.set("resources", filtered);
   }
+  async filterListResourceTemplates(flowCtx) {
+    const { templates } = flowCtx.state;
+    if (!templates || templates.length === 0) return;
+    const flaggedTemplates = this.collectFlagRefs(templates, (item) => item.template.metadata.featureFlag);
+    if (flaggedTemplates.size === 0) return;
+    const adapter = this.get(FeatureFlagAdapterToken);
+    const flagResults = await this.batchEvaluateRefs(adapter, flaggedTemplates);
+    const filtered = templates.filter((item) => {
+      const ref = item.template.metadata.featureFlag;
+      if (!ref) return true;
+      return this.isRefEnabled(ref, flagResults);
+    });
+    flowCtx.state.set("templates", filtered);
+  }
   async filterListPrompts(flowCtx) {
     const { prompts } = flowCtx.state;
     if (!prompts || prompts.length === 0) return;
@@ -433,36 +463,57 @@ var FeatureFlagPlugin = class extends DynamicPlugin {
     });
     flowCtx.state.set("prompts", filtered);
   }
-  async filterSearchSkills(flowCtx) {
-    const { results } = flowCtx.state;
-    if (!results || results.length === 0) return;
-    const flaggedSkills = this.collectFlagRefs(results, (item) => item.metadata?.featureFlag);
+  async filterSkills(flowCtx) {
+    const { skills } = flowCtx.state;
+    if (!skills || skills.length === 0) return;
+    const flaggedSkills = this.collectFlagRefs(skills, (skill) => skill.metadata.featureFlag);
     if (flaggedSkills.size === 0) return;
     const adapter = this.get(FeatureFlagAdapterToken);
     const flagResults = await this.batchEvaluateRefs(adapter, flaggedSkills);
-    const filtered = results.filter((item) => {
-      const ref = item.metadata?.featureFlag;
+    const filtered = skills.filter((skill) => {
+      const ref = skill.metadata.featureFlag;
       if (!ref) return true;
       return this.isRefEnabled(ref, flagResults);
     });
-    flowCtx.state.set("results", filtered);
+    flowCtx.state.set("skills", filtered);
   }
   async gateToolExecution(flowCtx) {
-    const { tool } = flowCtx.state;
-    if (!tool) return;
-    const ref = tool.metadata?.featureFlag;
+    await this.gateEntryExecution("Tool", flowCtx.state.tool);
+  }
+  async gateResourceRead(flowCtx) {
+    await this.gateEntryExecution("Resource", flowCtx.state.resource);
+  }
+  async gatePromptGet(flowCtx) {
+    await this.gateEntryExecution("Prompt", flowCtx.state.prompt);
+  }
+  async gateCompletion(flowCtx) {
+    const { prompt, resource } = flowCtx.state;
+    if (prompt) await this.gateEntryExecution("Prompt", prompt);
+    if (resource) await this.gateEntryExecution("Resource", resource);
+  }
+  /**
+   * Shared execution gate for tools, resources and prompts.
+   *
+   * One implementation on purpose: the advisory existed because the tool path had a gate and
+   * the other two did not, and three copies would drift apart the same way.
+   */
+  async gateEntryExecution(kind, entry) {
+    if (!entry) return;
+    const metadata = entry.metadata;
+    const ref = metadata?.featureFlag;
     if (!ref) return;
-    const adapter = this.get(FeatureFlagAdapterToken);
     const key = typeof ref === "string" ? ref : ref.key;
     const defaultValue = typeof ref === "object" ? ref.defaultValue ?? false : false;
     let enabled;
     try {
-      enabled = await adapter.isEnabled(key, {});
+      const adapter = this.get(FeatureFlagAdapterToken);
+      const results = await adapter.evaluateFlags([key], this.currentFlagContext());
+      enabled = this.isRefEnabled(ref, results);
     } catch {
       enabled = defaultValue;
     }
     if (!enabled) {
-      throw new Error(`Tool "${tool.metadata.name}" is disabled by feature flag "${key}"`);
+      throw new Error(`${kind} "${metadata?.name}" is disabled by feature flag "${key}"`);
     }
   }
   // ─────────────────────────────────────────────────────────────────────────
@@ -489,7 +540,24 @@ var FeatureFlagPlugin = class extends DynamicPlugin {
    */
   async batchEvaluateRefs(adapter, refs) {
     const keys = Array.from(refs.keys());
-    return adapter.evaluateFlags(keys, {});
+    return adapter.evaluateFlags(keys, this.currentFlagContext());
+  }
+  /**
+   * The caller's evaluation context.
+   *
+   * Passing `{}` here asked the adapter "is this flag on for nobody in particular", which a
+   * targeted adapter can answer differently from "is it on for THIS caller" — enabling access
+   * the caller should not have. The context comes from the same `FrontMcpContext` the
+   * context-scoped accessor reads, so hooks and `this.featureFlags` agree.
+   */
+  currentFlagContext() {
+    try {
+      const ctx = this.get(FrontMcpContextStorage)?.getStore();
+      if (!ctx) return {};
+      return buildFeatureFlagContext(ctx, this.options);
+    } catch {
+      return {};
+    }
   }
   /**
    * Determine if a feature flag ref is enabled given adapter results.
@@ -498,9 +566,8 @@ var FeatureFlagPlugin = class extends DynamicPlugin {
    */
   isRefEnabled(ref, flagResults) {
     const key = typeof ref === "string" ? ref : ref.key;
-    const adapterResult = flagResults.get(key);
     const defaultValue = typeof ref === "object" ? ref.defaultValue ?? false : false;
-    if (adapterResult === true) return true;
+    if (flagResults.has(key)) return flagResults.get(key) === true;
     return defaultValue;
   }
 };
@@ -584,15 +651,27 @@ __decorateClass([
 __decorateClass([
   ListResourcesHook.Did("findResources", { priority: 50 })
 ], FeatureFlagPlugin.prototype, "filterListResources", 1);
+__decorateClass([
+  ListResourceTemplatesHook.Did("findTemplates", { priority: 50 })
+], FeatureFlagPlugin.prototype, "filterListResourceTemplates", 1);
 __decorateClass([
   ListPromptsHook.Did("findPrompts", { priority: 50 })
 ], FeatureFlagPlugin.prototype, "filterListPrompts", 1);
 __decorateClass([
-  SearchSkillsHook.Did("search", { priority: 50 })
-], FeatureFlagPlugin.prototype, "filterSearchSkills", 1);
+  FilterSkillsHook.Did("filterSkills", { priority: 50 })
+], FeatureFlagPlugin.prototype, "filterSkills", 1);
 __decorateClass([
   ToolHook.Will("execute", { priority: 50 })
 ], FeatureFlagPlugin.prototype, "gateToolExecution", 1);
+__decorateClass([
+  ReadResourceHook.Will("execute", { priority: 50 })
+], FeatureFlagPlugin.prototype, "gateResourceRead", 1);
+__decorateClass([
+  GetPromptHook.Will("execute", { priority: 50 })
+], FeatureFlagPlugin.prototype, "gatePromptGet", 1);
+__decorateClass([
+  CompleteHook.Will("complete", { priority: 50 })
+], FeatureFlagPlugin.prototype, "gateCompletion", 1);
 FeatureFlagPlugin = __decorateClass([
   Plugin({
     name: "feature-flags",

package/esm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/plugin-feature-flags",
-  "version": "1.7.2",
+  "version": "1.8.1",
   "description": "Feature flag plugin for FrontMCP - dynamically gate MCP capabilities behind feature flags",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -49,7 +49,7 @@
     }
   },
   "dependencies": {
-    "@frontmcp/sdk": "1.7.2"
+    "@frontmcp/sdk": "1.8.1"
   },
   "peerDependencies": {
     "@launchdarkly/node-server-sdk": "^9.0.0 || ^10.0.0",

package/feature-flag.context.d.ts

@@ -0,0 +1,12 @@
+import type { FrontMcpContext } from '@frontmcp/sdk';
+import type { FeatureFlagContext, FeatureFlagPluginOptions } from './feature-flag.types';
+/**
+ * Build the adapter evaluation context for the current caller.
+ *
+ * Shared by the context-scoped accessor and by the plugin's list/gate hooks. Those hooks used
+ * to pass `{}`, which asks a targeted adapter "is this flag on for nobody in particular" — a
+ * question it can answer differently from "is it on for THIS caller", letting a gate allow
+ * access the caller should not have.
+ */
+export declare function buildFeatureFlagContext(ctx: FrontMcpContext | undefined, config: Pick<FeatureFlagPluginOptions, 'userIdResolver' | 'attributesResolver'>): FeatureFlagContext;
+//# sourceMappingURL=feature-flag.context.d.ts.map

package/feature-flag.context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"feature-flag.context.d.ts","sourceRoot":"","sources":["../src/feature-flag.context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,OAAO,KAAK,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAEzF;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,eAAe,GAAG,SAAS,EAChC,MAAM,EAAE,IAAI,CAAC,wBAAwB,EAAE,gBAAgB,GAAG,oBAAoB,CAAC,GAC9E,kBAAkB,CAcpB"}

package/feature-flag.plugin.d.ts

@@ -1,4 +1,4 @@
-import { DynamicPlugin, FlowCtxOf, ProviderType } from '@frontmcp/sdk';
+import { DynamicPlugin, type FlowCtxOf, type ProviderType } from '@frontmcp/sdk';
 import type { FeatureFlagPluginOptions, FeatureFlagPluginOptionsInput } from './feature-flag.types';
 /**
  * FeatureFlagPlugin - Dynamic capability gating for FrontMCP.
@@ -35,20 +35,60 @@ export default class FeatureFlagPlugin extends DynamicPlugin<FeatureFlagPluginOp
      * Filter resources from list_resources based on feature flags.
      */
     filterListResources(flowCtx: FlowCtxOf<'resources:list-resources'>): Promise<void>;
+    /**
+     * Filter resource templates from resources/templates/list based on feature flags.
+     *
+     * GHSA-gf7p-j3hr-h5h4: templates were listed even when their flag was off.
+     */
+    filterListResourceTemplates(flowCtx: FlowCtxOf<'resources:list-resource-templates'>): Promise<void>;
     /**
      * Filter prompts from list_prompts based on feature flags.
      */
     filterListPrompts(flowCtx: any): Promise<void>;
     /**
-     * Filter skills from skills:search based on feature flags.
-     * Hooks after search stage, before finalize converts to output.
+     * Filter skills in the `skills:filter` flow, which every skill surface runs: MCP
+     * `skills/search`, `skills/list` and `skills/load`, SEP-2640 `skill://` resources, and the HTTP
+     * `/skills`, `/llm.txt` and `/llm_full.txt` endpoints. A skill removed here is absent from
+     * listings and not found when named.
+     *
+     * GHSA-gf7p-j3hr-h5h4: the only skill hook sat on `skills:search`, which the `skills/search`
+     * handler never ran and whose results carry no `featureFlag`, so no skill surface was gated.
      */
-    filterSearchSkills(flowCtx: any): Promise<void>;
+    filterSkills(flowCtx: FlowCtxOf<'skills:filter'>): Promise<void>;
     /**
      * Execution gate: block direct tool/call when the tool's feature flag is off.
      * This prevents bypassing the list filter via direct tool invocation.
      */
     gateToolExecution(flowCtx: FlowCtxOf<'tools:call-tool'>): Promise<void>;
+    /**
+     * Execution gate: block resources/read when the resource's feature flag is off.
+     *
+     * GHSA-gf7p-j3hr-h5h4: only tools had this gate, so a flagged resource was merely absent
+     * from resources/list and still readable by URI. Hiding a capability from a listing is not
+     * the same as withholding it — clients cache listings and hold URIs from earlier sessions.
+     */
+    gateResourceRead(flowCtx: any): Promise<void>;
+    /**
+     * Execution gate: block prompts/get when the prompt's feature flag is off.
+     *
+     * The same gap as resources (GHSA-gf7p-j3hr-h5h4): filtering prompts/list left the prompt
+     * retrievable by name.
+     */
+    gatePromptGet(flowCtx: any): Promise<void>;
+    /**
+     * Execution gate: block completion/complete for a prompt or resource whose feature flag is off.
+     *
+     * GHSA-gf7p-j3hr-h5h4: completion looked the entry up and ran its argument completers without
+     * a gate, so a disabled resource template still suggested its values.
+     */
+    gateCompletion(flowCtx: any): Promise<void>;
+    /**
+     * Shared execution gate for tools, resources and prompts.
+     *
+     * One implementation on purpose: the advisory existed because the tool path had a gate and
+     * the other two did not, and three copies would drift apart the same way.
+     */
+    private gateEntryExecution;
     /**
      * Collect unique flag keys from items that have a featureFlag metadata.
      */
@@ -57,6 +97,15 @@ export default class FeatureFlagPlugin extends DynamicPlugin<FeatureFlagPluginOp
      * Batch evaluate all collected flag refs via the adapter.
      */
     private batchEvaluateRefs;
+    /**
+     * The caller's evaluation context.
+     *
+     * Passing `{}` here asked the adapter "is this flag on for nobody in particular", which a
+     * targeted adapter can answer differently from "is it on for THIS caller" — enabling access
+     * the caller should not have. The context comes from the same `FrontMcpContext` the
+     * context-scoped accessor reads, so hooks and `this.featureFlags` agree.
+     */
+    private currentFlagContext;
     /**
      * Determine if a feature flag ref is enabled given adapter results.
      * For object-style refs, `defaultValue` acts as a fallback when the adapter

package/feature-flag.plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"feature-flag.plugin.d.ts","sourceRoot":"","sources":["../src/feature-flag.plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,SAAS,EAOT,YAAY,EAEb,MAAM,eAAe,CAAC;AAEvB,OAAO,KAAK,EAAE,wBAAwB,EAAE,6BAA6B,EAAkB,MAAM,sBAAsB,CAAC;AAYpH;;;;;;;;;;;;;;;;;;GAkBG;AAaH,MAAM,CAAC,OAAO,OAAO,iBAAkB,SAAQ,aAAa,CAAC,wBAAwB,EAAE,6BAA6B,CAAC;IACnH,OAAO,EAAE,wBAAwB,CAAC;gBAEtB,OAAO,EAAE,6BAA6B;IAKlD;;OAEG;IACH,OAAgB,gBAAgB,GAAI,SAAS,6BAA6B,KAAG,YAAY,EAAE,CA0FzF;IAMF;;;OAGG;IAEG,eAAe,CAAC,OAAO,EAAE,SAAS,CAAC,kBAAkB,CAAC;IAmB5D;;OAEG;IAEG,mBAAmB,CAAC,OAAO,EAAE,SAAS,CAAC,0BAA0B,CAAC;IAmBxE;;OAEG;IAEG,iBAAiB,CAAC,OAAO,EAAE,GAAG;IAmBpC;;;OAGG;IAEG,kBAAkB,CAAC,OAAO,EAAE,GAAG;IAmBrC;;;OAGG;IAEG,iBAAiB,CAAC,OAAO,EAAE,SAAS,CAAC,iBAAiB,CAAC;IA2B7D;;OAEG;IACH,OAAO,CAAC,eAAe;IAcvB;;OAEG;YACW,iBAAiB;IAQ/B;;;;OAIG;IACH,OAAO,CAAC,YAAY;CAOrB"}
+{"version":3,"file":"feature-flag.plugin.d.ts","sourceRoot":"","sources":["../src/feature-flag.plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EAUb,KAAK,SAAS,EACd,KAAK,YAAY,EAClB,MAAM,eAAe,CAAC;AAMvB,OAAO,KAAK,EAEV,wBAAwB,EACxB,6BAA6B,EAE9B,MAAM,sBAAsB,CAAC;AAa9B;;;;;;;;;;;;;;;;;;GAkBG;AAaH,MAAM,CAAC,OAAO,OAAO,iBAAkB,SAAQ,aAAa,CAAC,wBAAwB,EAAE,6BAA6B,CAAC;IACnH,OAAO,EAAE,wBAAwB,CAAC;gBAEtB,OAAO,EAAE,6BAA6B;IAKlD;;OAEG;IACH,OAAgB,gBAAgB,GAAI,SAAS,6BAA6B,KAAG,YAAY,EAAE,CA0FzF;IAMF;;;OAGG;IAEG,eAAe,CAAC,OAAO,EAAE,SAAS,CAAC,kBAAkB,CAAC;IAmB5D;;OAEG;IAEG,mBAAmB,CAAC,OAAO,EAAE,SAAS,CAAC,0BAA0B,CAAC;IAmBxE;;;;OAIG;IAEG,2BAA2B,CAAC,OAAO,EAAE,SAAS,CAAC,mCAAmC,CAAC;IAmBzF;;OAEG;IAEG,iBAAiB,CAAC,OAAO,EAAE,GAAG;IAmBpC;;;;;;;;OAQG;IAEG,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,eAAe,CAAC;IAmBtD;;;OAGG;IAEG,iBAAiB,CAAC,OAAO,EAAE,SAAS,CAAC,iBAAiB,CAAC;IAI7D;;;;;;OAMG;IAEG,gBAAgB,CAAC,OAAO,EAAE,GAAG;IAInC;;;;;OAKG;IAEG,aAAa,CAAC,OAAO,EAAE,GAAG;IAIhC;;;;;OAKG;IAEG,cAAc,CAAC,OAAO,EAAE,GAAG;IAMjC;;;;;OAKG;YACW,kBAAkB;IA+BhC;;OAEG;IACH,OAAO,CAAC,eAAe;IAcvB;;OAEG;YACW,iBAAiB;IAQ/B;;;;;;;OAOG;IACH,OAAO,CAAC,kBAAkB;IAW1B;;;;OAIG;IACH,OAAO,CAAC,YAAY;CAWrB"}

package/feature-flag.types.d.ts

@@ -77,6 +77,9 @@ declare global {
     interface ExtendFrontMcpResourceMetadata {
         featureFlag?: FeatureFlagRef;
     }
+    interface ExtendFrontMcpResourceTemplateMetadata {
+        featureFlag?: FeatureFlagRef;
+    }
     interface ExtendFrontMcpPromptMetadata {
         featureFlag?: FeatureFlagRef;
     }

package/feature-flag.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"feature-flag.types.d.ts","sourceRoot":"","sources":["../src/feature-flag.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAMrD,+EAA+E;AAC/E,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,uDAAuD;AACvD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAE9E,mDAAmD;AACnD,MAAM,MAAM,wBAAwB,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC;AAEtE,6DAA6D;AAC7D,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,eAAe,KAAK,MAAM,GAAG,SAAS,CAAC;AAE1E,gEAAgE;AAChE,MAAM,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,eAAe,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAMnF,0DAA0D;AAC1D,UAAU,sBAAsB;IAC9B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,wBAAwB,CAAC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;CACzC;AAED,uDAAuD;AACvD,MAAM,WAAW,8BAA+B,SAAQ,sBAAsB;IAC5E,OAAO,EAAE,QAAQ,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,kBAAkB,CAAC,CAAC;CACrD;AAED,gCAAgC;AAChC,MAAM,WAAW,+BAAgC,SAAQ,sBAAsB;IAC7E,OAAO,EAAE,SAAS,CAAC;IACnB,MAAM,EAAE;QACN,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,oCAAoC;AACpC,MAAM,WAAW,oCAAqC,SAAQ,sBAAsB;IAClF,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE;QACN,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,+BAA+B;AAC/B,MAAM,WAAW,+BAAgC,SAAQ,sBAAsB;IAC7E,OAAO,EAAE,SAAS,CAAC;IACnB,MAAM,EAAE;QACN,GAAG,EAAE,MAAM,CAAC;QACZ,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED,+DAA+D;AAC/D,MAAM,WAAW,8BAA+B,SAAQ,sBAAsB;IAC5E,OAAO,EAAE,QAAQ,CAAC;IAClB,eAAe,EAAE,OAAO,2CAA2C,EAAE,kBAAkB,CAAC;CACzF;AAED,wCAAwC;AACxC,MAAM,MAAM,wBAAwB,GAChC,8BAA8B,GAC9B,+BAA+B,GAC/B,oCAAoC,GACpC,+BAA+B,GAC/B,8BAA8B,CAAC;AAEnC,oDAAoD;AACpD,MAAM,MAAM,6BAA6B,GAAG,wBAAwB,CAAC;AAMrE,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,0BAA0B;QAClC,WAAW,CAAC,EAAE,cAAc,CAAC;KAC9B;IACD,UAAU,8BAA8B;QACtC,WAAW,CAAC,EAAE,cAAc,CAAC;KAC9B;IACD,UAAU,4BAA4B;QACpC,WAAW,CAAC,EAAE,cAAc,CAAC;KAC9B;IACD,UAAU,2BAA2B;QACnC,WAAW,CAAC,EAAE,cAAc,CAAC;KAC9B;CACF"}
+{"version":3,"file":"feature-flag.types.d.ts","sourceRoot":"","sources":["../src/feature-flag.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAMrD,+EAA+E;AAC/E,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,uDAAuD;AACvD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAE9E,mDAAmD;AACnD,MAAM,MAAM,wBAAwB,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC;AAEtE,6DAA6D;AAC7D,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,eAAe,KAAK,MAAM,GAAG,SAAS,CAAC;AAE1E,gEAAgE;AAChE,MAAM,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,eAAe,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAMnF,0DAA0D;AAC1D,UAAU,sBAAsB;IAC9B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,wBAAwB,CAAC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;CACzC;AAED,uDAAuD;AACvD,MAAM,WAAW,8BAA+B,SAAQ,sBAAsB;IAC5E,OAAO,EAAE,QAAQ,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,kBAAkB,CAAC,CAAC;CACrD;AAED,gCAAgC;AAChC,MAAM,WAAW,+BAAgC,SAAQ,sBAAsB;IAC7E,OAAO,EAAE,SAAS,CAAC;IACnB,MAAM,EAAE;QACN,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,oCAAoC;AACpC,MAAM,WAAW,oCAAqC,SAAQ,sBAAsB;IAClF,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE;QACN,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,+BAA+B;AAC/B,MAAM,WAAW,+BAAgC,SAAQ,sBAAsB;IAC7E,OAAO,EAAE,SAAS,CAAC;IACnB,MAAM,EAAE;QACN,GAAG,EAAE,MAAM,CAAC;QACZ,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED,+DAA+D;AAC/D,MAAM,WAAW,8BAA+B,SAAQ,sBAAsB;IAC5E,OAAO,EAAE,QAAQ,CAAC;IAClB,eAAe,EAAE,OAAO,2CAA2C,EAAE,kBAAkB,CAAC;CACzF;AAED,wCAAwC;AACxC,MAAM,MAAM,wBAAwB,GAChC,8BAA8B,GAC9B,+BAA+B,GAC/B,oCAAoC,GACpC,+BAA+B,GAC/B,8BAA8B,CAAC;AAEnC,oDAAoD;AACpD,MAAM,MAAM,6BAA6B,GAAG,wBAAwB,CAAC;AAMrE,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,0BAA0B;QAClC,WAAW,CAAC,EAAE,cAAc,CAAC;KAC9B;IACD,UAAU,8BAA8B;QACtC,WAAW,CAAC,EAAE,cAAc,CAAC;KAC9B;IACD,UAAU,sCAAsC;QAC9C,WAAW,CAAC,EAAE,cAAc,CAAC;KAC9B;IACD,UAAU,4BAA4B;QACpC,WAAW,CAAC,EAAE,cAAc,CAAC;KAC9B;IACD,UAAU,2BAA2B;QACnC,WAAW,CAAC,EAAE,cAAc,CAAC;KAC9B;CACF"}

package/index.js

@@ -257,17 +257,6 @@ module.exports = __toCommonJS(index_exports);
 // plugins/plugin-feature-flags/src/feature-flag.plugin.ts
 var import_sdk2 = require("@frontmcp/sdk");
 
-// plugins/plugin-feature-flags/src/feature-flag.symbols.ts
-var FeatureFlagAdapterToken = /* @__PURE__ */ Symbol(
-  "plugin:feature-flags:adapter"
-);
-var FeatureFlagConfigToken = /* @__PURE__ */ Symbol(
-  "plugin:feature-flags:config"
-);
-var FeatureFlagAccessorToken = /* @__PURE__ */ Symbol(
-  "plugin:feature-flags:accessor"
-);
-
 // plugins/plugin-feature-flags/src/adapters/static.adapter.ts
 var StaticFeatureFlagAdapter = class {
   flags;
@@ -292,9 +281,15 @@ var StaticFeatureFlagAdapter = class {
     }
     return { ...flag };
   }
+  /**
+   * A key this adapter has never been configured with is OMITTED rather than reported as
+   * `false`. Only then can the caller tell "the operator disabled it" from "nobody configured
+   * it" and apply the ref's `defaultValue` to the second case only.
+   */
   async evaluateFlags(flagKeys, context) {
     const results = /* @__PURE__ */ new Map();
     for (const key of flagKeys) {
+      if (this.flags[key] === void 0) continue;
       results.set(key, await this.isEnabled(key, context));
     }
     return results;
@@ -303,6 +298,28 @@ var StaticFeatureFlagAdapter = class {
   }
 };
 
+// plugins/plugin-feature-flags/src/feature-flag.context.ts
+function buildFeatureFlagContext(ctx, config) {
+  if (!ctx) return {};
+  const userId = config.userIdResolver ? config.userIdResolver(ctx) : ctx.authInfo?.extra?.["sub"] ?? ctx.authInfo?.extra?.["userId"] ?? ctx.authInfo?.clientId;
+  return {
+    userId: userId ?? void 0,
+    sessionId: ctx.sessionId,
+    attributes: config.attributesResolver ? config.attributesResolver(ctx) : {}
+  };
+}
+
+// plugins/plugin-feature-flags/src/feature-flag.symbols.ts
+var FeatureFlagAdapterToken = /* @__PURE__ */ Symbol(
+  "plugin:feature-flags:adapter"
+);
+var FeatureFlagConfigToken = /* @__PURE__ */ Symbol(
+  "plugin:feature-flags:config"
+);
+var FeatureFlagAccessorToken = /* @__PURE__ */ Symbol(
+  "plugin:feature-flags:accessor"
+);
+
 // plugins/plugin-feature-flags/src/providers/feature-flag-accessor.provider.ts
 var import_sdk = require("@frontmcp/sdk");
 var FeatureFlagAccessor = class {
@@ -366,13 +383,7 @@ var FeatureFlagAccessor = class {
    * Build the FeatureFlagContext from the current FrontMcpContext.
    */
   buildContext() {
-    const userId = this.config.userIdResolver ? this.config.userIdResolver(this.ctx) : this.ctx.authInfo?.extra?.["sub"] ?? this.ctx.authInfo?.extra?.["userId"] ?? this.ctx.authInfo?.clientId;
-    const attributes = this.config.attributesResolver ? this.config.attributesResolver(this.ctx) : {};
-    return {
-      userId: userId ?? void 0,
-      sessionId: this.ctx.sessionId,
-      attributes
-    };
+    return buildFeatureFlagContext(this.ctx, this.config);
   }
 };
 FeatureFlagAccessor = __decorateClass([
@@ -388,7 +399,10 @@ function createFeatureFlagAccessor(adapter, ctx, config) {
 
 // plugins/plugin-feature-flags/src/feature-flag.plugin.ts
 var ListPromptsHook = (0, import_sdk2.FlowHooksOf)("prompts:list-prompts");
-var SearchSkillsHook = (0, import_sdk2.FlowHooksOf)("skills:search");
+var ReadResourceHook = (0, import_sdk2.FlowHooksOf)("resources:read-resource");
+var GetPromptHook = (0, import_sdk2.FlowHooksOf)("prompts:get-prompt");
+var CompleteHook = (0, import_sdk2.FlowHooksOf)("completion:complete");
+var FilterSkillsHook = (0, import_sdk2.FlowHooksOf)("skills:filter");
 var FeatureFlagPlugin = class extends import_sdk2.DynamicPlugin {
   options;
   constructor(options) {
@@ -423,6 +437,20 @@ var FeatureFlagPlugin = class extends import_sdk2.DynamicPlugin {
     });
     flowCtx.state.set("resources", filtered);
   }
+  async filterListResourceTemplates(flowCtx) {
+    const { templates } = flowCtx.state;
+    if (!templates || templates.length === 0) return;
+    const flaggedTemplates = this.collectFlagRefs(templates, (item) => item.template.metadata.featureFlag);
+    if (flaggedTemplates.size === 0) return;
+    const adapter = this.get(FeatureFlagAdapterToken);
+    const flagResults = await this.batchEvaluateRefs(adapter, flaggedTemplates);
+    const filtered = templates.filter((item) => {
+      const ref = item.template.metadata.featureFlag;
+      if (!ref) return true;
+      return this.isRefEnabled(ref, flagResults);
+    });
+    flowCtx.state.set("templates", filtered);
+  }
   async filterListPrompts(flowCtx) {
     const { prompts } = flowCtx.state;
     if (!prompts || prompts.length === 0) return;
@@ -437,36 +465,57 @@ var FeatureFlagPlugin = class extends import_sdk2.DynamicPlugin {
     });
     flowCtx.state.set("prompts", filtered);
   }
-  async filterSearchSkills(flowCtx) {
-    const { results } = flowCtx.state;
-    if (!results || results.length === 0) return;
-    const flaggedSkills = this.collectFlagRefs(results, (item) => item.metadata?.featureFlag);
+  async filterSkills(flowCtx) {
+    const { skills } = flowCtx.state;
+    if (!skills || skills.length === 0) return;
+    const flaggedSkills = this.collectFlagRefs(skills, (skill) => skill.metadata.featureFlag);
     if (flaggedSkills.size === 0) return;
     const adapter = this.get(FeatureFlagAdapterToken);
     const flagResults = await this.batchEvaluateRefs(adapter, flaggedSkills);
-    const filtered = results.filter((item) => {
-      const ref = item.metadata?.featureFlag;
+    const filtered = skills.filter((skill) => {
+      const ref = skill.metadata.featureFlag;
       if (!ref) return true;
       return this.isRefEnabled(ref, flagResults);
     });
-    flowCtx.state.set("results", filtered);
+    flowCtx.state.set("skills", filtered);
   }
   async gateToolExecution(flowCtx) {
-    const { tool } = flowCtx.state;
-    if (!tool) return;
-    const ref = tool.metadata?.featureFlag;
+    await this.gateEntryExecution("Tool", flowCtx.state.tool);
+  }
+  async gateResourceRead(flowCtx) {
+    await this.gateEntryExecution("Resource", flowCtx.state.resource);
+  }
+  async gatePromptGet(flowCtx) {
+    await this.gateEntryExecution("Prompt", flowCtx.state.prompt);
+  }
+  async gateCompletion(flowCtx) {
+    const { prompt, resource } = flowCtx.state;
+    if (prompt) await this.gateEntryExecution("Prompt", prompt);
+    if (resource) await this.gateEntryExecution("Resource", resource);
+  }
+  /**
+   * Shared execution gate for tools, resources and prompts.
+   *
+   * One implementation on purpose: the advisory existed because the tool path had a gate and
+   * the other two did not, and three copies would drift apart the same way.
+   */
+  async gateEntryExecution(kind, entry) {
+    if (!entry) return;
+    const metadata = entry.metadata;
+    const ref = metadata?.featureFlag;
     if (!ref) return;
-    const adapter = this.get(FeatureFlagAdapterToken);
     const key = typeof ref === "string" ? ref : ref.key;
     const defaultValue = typeof ref === "object" ? ref.defaultValue ?? false : false;
     let enabled;
     try {
-      enabled = await adapter.isEnabled(key, {});
+      const adapter = this.get(FeatureFlagAdapterToken);
+      const results = await adapter.evaluateFlags([key], this.currentFlagContext());
+      enabled = this.isRefEnabled(ref, results);
     } catch {
       enabled = defaultValue;
     }
     if (!enabled) {
-      throw new Error(`Tool "${tool.metadata.name}" is disabled by feature flag "${key}"`);
+      throw new Error(`${kind} "${metadata?.name}" is disabled by feature flag "${key}"`);
     }
   }
   // ─────────────────────────────────────────────────────────────────────────
@@ -493,7 +542,24 @@ var FeatureFlagPlugin = class extends import_sdk2.DynamicPlugin {
    */
   async batchEvaluateRefs(adapter, refs) {
     const keys = Array.from(refs.keys());
-    return adapter.evaluateFlags(keys, {});
+    return adapter.evaluateFlags(keys, this.currentFlagContext());
+  }
+  /**
+   * The caller's evaluation context.
+   *
+   * Passing `{}` here asked the adapter "is this flag on for nobody in particular", which a
+   * targeted adapter can answer differently from "is it on for THIS caller" — enabling access
+   * the caller should not have. The context comes from the same `FrontMcpContext` the
+   * context-scoped accessor reads, so hooks and `this.featureFlags` agree.
+   */
+  currentFlagContext() {
+    try {
+      const ctx = this.get(import_sdk2.FrontMcpContextStorage)?.getStore();
+      if (!ctx) return {};
+      return buildFeatureFlagContext(ctx, this.options);
+    } catch {
+      return {};
+    }
   }
   /**
    * Determine if a feature flag ref is enabled given adapter results.
@@ -502,9 +568,8 @@ var FeatureFlagPlugin = class extends import_sdk2.DynamicPlugin {
    */
   isRefEnabled(ref, flagResults) {
     const key = typeof ref === "string" ? ref : ref.key;
-    const adapterResult = flagResults.get(key);
     const defaultValue = typeof ref === "object" ? ref.defaultValue ?? false : false;
-    if (adapterResult === true) return true;
+    if (flagResults.has(key)) return flagResults.get(key) === true;
     return defaultValue;
   }
 };
@@ -588,15 +653,27 @@ __decorateClass([
 __decorateClass([
   import_sdk2.ListResourcesHook.Did("findResources", { priority: 50 })
 ], FeatureFlagPlugin.prototype, "filterListResources", 1);
+__decorateClass([
+  import_sdk2.ListResourceTemplatesHook.Did("findTemplates", { priority: 50 })
+], FeatureFlagPlugin.prototype, "filterListResourceTemplates", 1);
 __decorateClass([
   ListPromptsHook.Did("findPrompts", { priority: 50 })
 ], FeatureFlagPlugin.prototype, "filterListPrompts", 1);
 __decorateClass([
-  SearchSkillsHook.Did("search", { priority: 50 })
-], FeatureFlagPlugin.prototype, "filterSearchSkills", 1);
+  FilterSkillsHook.Did("filterSkills", { priority: 50 })
+], FeatureFlagPlugin.prototype, "filterSkills", 1);
 __decorateClass([
   import_sdk2.ToolHook.Will("execute", { priority: 50 })
 ], FeatureFlagPlugin.prototype, "gateToolExecution", 1);
+__decorateClass([
+  ReadResourceHook.Will("execute", { priority: 50 })
+], FeatureFlagPlugin.prototype, "gateResourceRead", 1);
+__decorateClass([
+  GetPromptHook.Will("execute", { priority: 50 })
+], FeatureFlagPlugin.prototype, "gatePromptGet", 1);
+__decorateClass([
+  CompleteHook.Will("complete", { priority: 50 })
+], FeatureFlagPlugin.prototype, "gateCompletion", 1);
 FeatureFlagPlugin = __decorateClass([
   (0, import_sdk2.Plugin)({
     name: "feature-flags",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/plugin-feature-flags",
-  "version": "1.7.2",
+  "version": "1.8.1",
   "description": "Feature flag plugin for FrontMCP - dynamically gate MCP capabilities behind feature flags",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -49,7 +49,7 @@
     }
   },
   "dependencies": {
-    "@frontmcp/sdk": "1.7.2"
+    "@frontmcp/sdk": "1.8.1"
   },
   "peerDependencies": {
     "@launchdarkly/node-server-sdk": "^9.0.0 || ^10.0.0",

package/providers/feature-flag-accessor.provider.d.ts

@@ -1,6 +1,6 @@
 import { FrontMcpContext } from '@frontmcp/sdk';
 import type { FeatureFlagAdapter } from '../adapters/feature-flag-adapter.interface';
-import type { FeatureFlagVariant, FeatureFlagPluginOptions, FeatureFlagRef } from '../feature-flag.types';
+import type { FeatureFlagPluginOptions, FeatureFlagRef, FeatureFlagVariant } from '../feature-flag.types';
 /**
  * Context-scoped accessor for feature flag evaluation.
  * Provides caching and context resolution from FrontMcpContext.

package/providers/feature-flag-accessor.provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"feature-flag-accessor.provider.d.ts","sourceRoot":"","sources":["../../src/providers/feature-flag-accessor.provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAA2B,MAAM,eAAe,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,KAAK,EAEV,kBAAkB,EAClB,wBAAwB,EACxB,cAAc,EACf,MAAM,uBAAuB,CAAC;AAE/B;;;GAGG;AACH,qBAKa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAkB;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2B;IAClD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA4D;gBAEtE,OAAO,EAAE,kBAAkB,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,wBAAwB;IAM/F;;OAEG;IACG,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IA4B1E;;OAEG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAK9D;;OAEG;IACG,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAKtE;;OAEG;IACG,UAAU,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;IAOvD;;OAEG;IACH,OAAO,CAAC,YAAY;CAerB;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,kBAAkB,EAC3B,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,wBAAwB,GAC/B,mBAAmB,CAErB"}
+{"version":3,"file":"feature-flag-accessor.provider.d.ts","sourceRoot":"","sources":["../../src/providers/feature-flag-accessor.provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAA2B,MAAM,eAAe,CAAC;AAEzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAErF,OAAO,KAAK,EAEV,wBAAwB,EACxB,cAAc,EACd,kBAAkB,EACnB,MAAM,uBAAuB,CAAC;AAE/B;;;GAGG;AACH,qBAKa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAkB;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2B;IAClD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA4D;gBAEtE,OAAO,EAAE,kBAAkB,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,wBAAwB;IAM/F;;OAEG;IACG,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IA4B1E;;OAEG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAK9D;;OAEG;IACG,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAKtE;;OAEG;IACG,UAAU,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;IAOvD;;OAEG;IACH,OAAO,CAAC,YAAY;CAGrB;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,kBAAkB,EAC3B,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,wBAAwB,GAC/B,mBAAmB,CAErB"}