@frontmcp/skills 1.8.6 → 1.9.0

package/catalog/frontmcp-development/references/official-plugins.md

@@ -1,11 +1,11 @@
 ---
 name: official-plugins
-description: Guide to the 6 official plugins for discovery, memory, auth, caching, flags, and monitoring
+description: Guide to the 7 official plugins for discovery, memory, auth, caching, flags, monitoring, and WebMCP
 ---
 
 # Official FrontMCP Plugins
 
-FrontMCP ships 6 official plugins that extend server behavior with cross-cutting concerns: semantic tool discovery, session memory, authorization workflows, result caching, feature gating, and visual monitoring. Install individually or via `@frontmcp/plugins` (meta-package re-exporting cache, codecall, and remember).
+FrontMCP ships 7 official plugins that extend server behavior with cross-cutting concerns: semantic tool discovery, session memory, authorization workflows, result caching, feature gating, visual monitoring, and exposing in-browser tools to browser agents (WebMCP). Install individually or via `@frontmcp/plugins` (meta-package re-exporting cache, codecall, and remember).
 
 > **Note:** The Dashboard plugin (`@frontmcp/plugin-dashboard`) is currently in **beta** and may not work correctly in all environments. It is not recommended for production use at this time.
 
@@ -16,6 +16,7 @@ FrontMCP ships 6 official plugins that extend server behavior with cross-cutting
 - Installing and configuring any official FrontMCP plugin (CodeCall, Remember, Approval, Cache, Feature Flags)
 - Adding session memory, tool caching, or authorization workflows to an existing server
 - Integrating feature flag services (LaunchDarkly, Split.io, Unleash) to gate tools at runtime
+- Exposing the tools of a FrontMCP server running in the browser to in-browser agents through WebMCP (`document.modelContext`)
 
 ### Recommended
 
@@ -98,7 +99,7 @@ class MyServer {}
 
 ### Modes
 
-- `codecall_only` -- Hides all tools from `list_tools` except CodeCall meta-tools. All other tools are discovered only via `codecall:search`. Best when the server has a large number of tools and you want the AI to search-then-execute. When `appIds` is set, only tools from those apps are hidden — tools from other apps remain visible.
+- `codecall_only` -- Hides all tools from `list_tools` except CodeCall meta-tools. All other tools are discovered only via `codecall:search` and reached only through CodeCall: a client's direct `tools/call` of a hidden tool is refused. Best when the server has a large number of tools and you want the AI to search-then-execute. When `appIds` is set, only tools from those apps are hidden — tools from other apps remain visible.
 - `codecall_opt_in` -- Shows all tools in `list_tools` normally. Tools opt-in to CodeCall execution via metadata. Useful when only some tools benefit from orchestrated execution.
 - `metadata_driven` -- Per-tool `metadata.codecall` controls visibility and CodeCall availability independently. Most granular control.
 
@@ -115,7 +116,19 @@ CodeCallPlugin.init({
 });
 ```
 
-Without `appIds`, `codecall_only` mode hides ALL tools in the server. With `appIds`, only tools from the specified apps are hidden — tools from other apps remain directly callable.
+Without `appIds`, `codecall_only` mode hides every tool the plugin judges: all tools of the server when it is installed on the server, or its own app's tools and those of apps without a CodeCall plugin of their own when it is installed on an app. With `appIds`, only tools from the specified apps are hidden — tools from other apps remain directly callable. An app with its own CodeCall plugin is judged by that plugin alone, in `list_tools` and on a direct `tools/call` alike; up to 1.8.7 another app's `codecall_only` plugin hid its tools from `list_tools` while its own plugin still let clients call them.
+
+### Hidden Tools Are Not Directly Callable
+
+A tool CodeCall hides from `list_tools` (in any mode: every non-meta tool in `codecall_only` unless it sets
+`visibleInListTools: true`, any tool with `visibleInListTools: false` otherwise) is reachable only through CodeCall. A
+client's direct `tools/call` of it -- MCP, an MCP Apps widget, an in-page WebMCP agent, `DirectMcpServer.callTool()` --
+is answered exactly like a call of an unknown tool (`Tool "<name>" not found`), before its input is validated. Still
+allowed: CodeCall's own calls (`codecall:execute`, `codecall:invoke`), server-side composition (`this.callTool()` from
+a tool, agent or job), and the server's own system tools (such as `sendElicitationResult`). Give a tool that clients
+or widgets call directly `codecall: { visibleInListTools: true }`. Up to 1.8.7 the tool was only missing from the
+listing, and a client that knew its name ran it directly, past `includeTools`, `enabledInCodeCall`, the blocked
+namespaces and `directCalls`.
 
 ### VM Presets
 
@@ -143,7 +156,7 @@ Control how individual tools interact with CodeCall:
 @Tool({
   name: 'my_tool',
   codecall: {
-    visibleInListTools: false, // Hide from list_tools (only discoverable via codecall:search)
+    visibleInListTools: false, // Hide from list_tools; reached only through CodeCall (direct tools/call refused)
     enabledInCodeCall: true, // Available for execution via codecall:execute
     tags: ['data', 'query'], // Extra indexing hints for semantic search
   },
@@ -174,7 +187,7 @@ CodeCallPlugin.init({
 - `tool.appId` names the owning app for the tools its adapters and plugins provide too, so `includeTools: (tool) => tool.appId !== 'admin'` withholds every tool of app `admin`.
 - `codecall:searchSkills` and `codecall:searchKnowledge` run the SDK's `skills:filter` flow, so a skill a plugin withholds there (a flag-disabled skill, for one) is absent from both.
 - `directCalls.allowedTools` and `directCalls.filter` only narrow the base policy; listing a withheld tool does not make it callable. Unlisted tools are refused.
-- Hiding a tool from search is not the control; the refusal at execution is. Do not rely on `visibleInListTools` or search ranking to protect a tool.
+- Hiding a tool from search is not the control; the refusal at execution is. Do not rely on search ranking to protect a tool. Hiding it from `list_tools` (`visibleInListTools: false`) does also refuse a client's direct `tools/call` of it, but CodeCall's own surfaces then apply this policy.
 - `includeTools` and `directCalls.filter` receive the same object, with the tool's `annotations` and declared `metadata` (`tool.metadata?.annotations` is the same object as `tool.annotations`). It is a deep read-only copy, so a filter cannot change what the next decision reads.
 - Namespace bindings (`mail.send({...})` for a tool named `mail.send`) are AgentScript wrappers over `callTool()` inside the sandbox: they count toward `vm.maxSteps` and pass the rate limit and suspicious-sequence checks exactly like `callTool('mail.send', {...})`. A binding with no argument sends `{}`.
 - `codecall:execute` results never include a `stack`, in any environment. In `runtime_error`, `syntax_error` and `tool_error` messages, stack frames are dropped and absolute paths (POSIX, Windows, UNC, `file:` URLs, quoted paths) become `[path]`; other URLs are kept.
@@ -277,11 +290,20 @@ class MyTool extends ToolContext {
     // List keys matching pattern
     const keys = await this.remember.list({ pattern: 'user:*' });
 
+    // Update a value, keeping its metadata (and its expiry, unless a new `ttl` is given)
+    await this.remember.update('theme', 'light');
+
     return { content: [{ type: 'text', text: `Theme: ${theme}` }] };
   }
 }
 ```
 
+`update(key, value, { ttl? })` returns `false` for a key that does not exist. Without a `ttl` the entry keeps its
+current expiry, and `knows()` and `list()` stop reporting it once that passes, the same as `get()`; up to 1.8.7 an
+entry updated without a `ttl` stayed in `knows()` and `list()` after it expired. `knows()` and `list()` read each entry
+and check its own expiry, so they report exactly the keys `get()` returns a value for, even while the store still holds
+an expired key for up to a second.
+
 ### Memory Scopes
 
 - `session` -- Default scope. With a verified session, valid only for that session and cleared
@@ -346,6 +368,10 @@ clear the legacy prefixes manually if you want the storage back.
 - `forget` -- Remove a stored value by key
 - `list_memories` -- List all stored keys, optionally filtered by pattern
 
+`tools.prefix` renames them (`prefix: 'memory_'` gives `memory_recall`, ...; each description names the prefixed siblings) and
+`tools.allowedScopes` rejects any other `scope` (including the default `session` when a call omits it) with a public `REMEMBER_SCOPE_NOT_ALLOWED` error that lists the allowed scopes. With `enabled` unset or `false` none is registered.
+With `RememberPlugin.init({ inject, useFactory })`, `tools` is read from the options the factory returns, at startup.
+
 All four take an optional `scope` (default `session`) and describe it to the model the same way:
 `session` is this session, or without one (stateless HTTP, MCP 2026-07-28) the signed-in caller
 across its requests; `user` is the signed-in caller across all of its sessions; `tool` is the tool
@@ -431,12 +457,20 @@ authInfo.extra.approvalContext = { type: 'project', identifier: resolvedProjectI
 2. A recorded **denial** for the caller (session, user, time-limited or context scope): refused
    with state `denied`. A denial outranks pre-approved contexts and any approval.
 3. The session context is one of `preApprovedContexts`: the tool runs.
-4. `alwaysPrompt: true`: refused with state `pending`.
-5. An approval for the caller that the tool's policy accepts: the tool runs. The caller's session,
+4. An approval for the caller that the tool's policy accepts: the tool runs. The caller's session,
    user, time-limited and context approvals all count (a context approval only when the session
    carries that context); its scope must be in `allowedScopes`, and it must be younger than
-   `maxTtlMs`, however it was stored.
-6. Otherwise refused with state `pending` (or `expired`).
+   `maxTtlMs`, however it was stored. With `alwaysPrompt: true` the approval is used up by this
+   call (only one of two concurrent calls gets it), so the next call needs a new one.
+5. Otherwise refused with state `pending` (or `expired`).
+
+Releases up to 1.8.7 refused every call of an `alwaysPrompt` tool, approved or not. The built-in store
+uses up an approval with the storage's atomic `deleteIfEquals()` (memory, Redis, Upstash, Vercel KV), so
+a denial or new approval recorded in the meantime is kept; a backend without it (Cloudflare KV, the
+filesystem, SQLite) has the approval deleted directly. A custom `ApprovalStore` should implement
+`consumeApproval()` (delete exactly that record, and only while it is still stored, in one step; resolve
+`true` only for the call that deleted it); without it the gate revokes the caller's approvals of the tool
+instead.
 
 A refused call throws `ApprovalRequiredError`; the client receives an error result whose text is
 exactly the tool's `approvalMessage` (or the default `Tool "<full name>" requires approval to
@@ -462,8 +496,10 @@ Installed on an app, `ApprovalPlugin` gates that app's tools (including those it
 plugins provide) against its own store, so two apps can each install it with separate stores. It
 also gates, against its store, the `approval` tools of apps with no approval plugin of their own,
 so such a tool never runs ungated because the plugin sits on another app (releases up to 1.8.2 ran
-them for anyone). Installed on the server, it gates every tool; a tool several plugins gate must
-pass each store's check, and a denial in any of them refuses the call.
+them for anyone). Installed on the server, it gates every tool. A tool several plugins gate (one on
+the server, one on its app) is decided once over all their stores: an approval in any of them lets
+it run -- one approval is enough, e.g. a grant through `this.approval` in the tool's app -- and a
+denial in any of them refuses the call. Releases up to 1.8.7 required an approval in each store.
 `this.approval` resolves the `ApprovalService` of the nearest `ApprovalPlugin` -- the one the
 tool's own app installed, otherwise the server's -- so with two apps each installing it, a grant
 or check in one app's tool uses that app's store. Releases up to 1.8.1 resolved the store of the
@@ -502,10 +538,12 @@ class DangerousActionTool extends ToolContext {
 ```
 
 Each grant records its grantor in `grantedBy`. Without one, it is the signed-in caller whose tool
-made the grant: `userGrantor(<user id>)`, i.e. `{ source: 'user', identifier: '<user id>', method:
-'interactive' }`. Without a signed-in user (no principal, or an anonymous `anon:` subject) it is
-`{ source: 'user' }` with no identifier. `revokeApproval()` records `revokedBy` the same way
-(`userRevoker(<user id>)`). Releases up to 1.8.5 recorded both as `'policy'`. Pass `grantedBy` to
+made the grant: `{ source: 'user', identifier: '<user id>', method: 'implicit' }` (a tool that grants
+through `this.approval` asked no one, so it is not an `'interactive'` answer; a tool that did ask passes
+`grantedBy: userGrantor(<user id>)`). Without a signed-in user (no principal, or an anonymous `anon:`
+subject) it is `{ source: 'user', method: 'implicit' }` with no identifier. `revokeApproval()` records
+`revokedBy` the same way and `getRevocations(toolId)` reads it back (kept 24 hours). Releases up to 1.8.5
+recorded both as `'policy'`; 1.8.6 recorded `'interactive'` and kept no `revokedBy`. Pass `grantedBy` to
 record anything else; `userGrantor`'s third argument is an options object, not the method:
 
 ```typescript
@@ -627,7 +665,7 @@ class GlobalCacheServer {}
 Enable caching on individual tools via the `cache` metadata field:
 
 ```typescript
-// Enable caching with default TTL
+// Enable caching with default TTL (no sliding window)
 @Tool({ name: 'get_weather', cache: true })
 class GetWeatherTool extends ToolContext {
   /* ... */
@@ -664,6 +702,13 @@ CachePlugin.init({
 
 A tool is cached if it matches any pattern OR has `cache: true` (or a cache object) in its metadata. `cache: { ttl: 0 }` (or a negative TTL) turns caching off for the tool, even when it matches a pattern; up to 1.8.5 it cached the first result with no expiry.
 
+Only `slideWindow: true` refreshes the TTL on a hit (`ttl`, or the plugin's `defaultTTL` when the tool sets none).
+`cache: true` means the plugin defaults and never slides: an entry expires its TTL after it was written, however often it
+is read. Up to 1.8.7, `cache: true` slid on every hit and `{ slideWindow: true }` without a `ttl` never slid.
+
+A result the tool returns with `isError: true` (a `CallToolResult` reporting a failure) is never cached, so the next
+call runs the tool again; up to 1.8.7 the failure was served from the cache until the TTL ran out.
+
 ### Cache Bypass
 
 Send the bypass header to skip caching for a specific request:
@@ -673,6 +718,13 @@ x-frontmcp-disable-cache: true
 ```
 
 The header name is configurable via `bypassHeader` in the plugin options. Default: `'x-frontmcp-disable-cache'`.
+It must start with `x-frontmcp-` (case-insensitive): the plugin reads it from the request context, which keeps only a
+request's `x-frontmcp-*` headers. Any other name (`'x-no-cache'`) throws `CachePluginConfigurationError` when the
+plugin is created; up to 1.8.7 it was accepted and silently ignored.
+
+```typescript
+CachePlugin.init({ type: 'memory', bypassHeader: 'x-frontmcp-no-cache' }); // client sends `x-frontmcp-no-cache: 1`
+```
 
 ### Cache Key
 
@@ -711,7 +763,10 @@ A disabled flag filters the entry out of `tools/list`, `resources/list`, `prompt
 
 That matters because a listing is not an access control. Clients cache listings and hold
 resource URIs and prompt names from earlier sessions, so anything gated only at list time
-stays reachable by name. If the adapter is unavailable the gate uses the ref's
+stays reachable by name. The refusal is a public `FeatureFlagDisabledError` (`FEATURE_FLAG_DISABLED`, 403)
+that names the capability and the flag. `FeatureFlagPlugin.init()` with no (or an unknown) `adapter` throws a
+`FeatureFlagConfigurationError` at startup, and so does `adapter: 'custom'` without an `adapterInstance` that has
+`isEnabled()`, `getVariant()` and `evaluateFlags()` (it used to start and answer every request with a 500). If the adapter is unavailable the gate uses the ref's
 `defaultValue`, and a bare string ref (no default) fails closed.
 
 ### Installation
@@ -789,7 +844,7 @@ class CustomFlagServer {}
 - `splitio` -- Split.io integration. Requires `@splitsoftware/splitio` package.
 - `launchdarkly` -- LaunchDarkly integration. Requires `launchdarkly-node-server-sdk` package.
 - `unleash` -- Unleash integration. Requires `unleash-client` package.
-- `custom` -- Provide your own adapter instance implementing the `FeatureFlagAdapter` interface.
+- `custom` -- Provide your own adapter instance (`adapterInstance`, required) implementing the `FeatureFlagAdapter` interface.
 
 ### Using `this.featureFlags` in Tools
 
@@ -803,15 +858,24 @@ class BetaFeatureTool extends ToolContext {
       return { content: [{ type: 'text', text: 'Feature not available' }] };
     }
 
+    // Fail open: `true` when the adapter throws or has no answer for the flag
+    const engine = (await this.featureFlags.isEnabled('search-v2', true)) ? 'v2' : 'v1';
+
     // Get variant value (for multivariate flags)
     const variant = await this.featureFlags.getVariant('experiment-flag');
     // variant may be 'control', 'treatment-a', 'treatment-b', etc.
 
-    return { content: [{ type: 'text', text: `Running variant: ${variant}` }] };
+    return { content: [{ type: 'text', text: `Running variant: ${variant} on search ${engine}` }] };
   }
 }
 ```
 
+`isEnabled(key, defaultValue?)` answers `defaultValue` (else the plugin's `defaultValue`, else `false`) when the
+adapter throws or has no answer for the flag -- a key the `static` adapter was not given, or one a custom adapter's
+`evaluateFlags()` omits -- the same rule the gates apply to a ref's `defaultValue`. A flag the adapter answers keeps
+its answer, `false` included. Split.io, LaunchDarkly and Unleash answer every key with the service's own default. Up to
+1.8.7 the default applied only when the adapter threw, so `isEnabled('unknown-flag', true)` was `false`.
+
 ### Per-Tool Feature Flag Gating
 
 Tools gated by a feature flag are automatically hidden from `list_tools` and blocked from execution when the flag is off:
@@ -823,7 +887,7 @@ class BetaTool extends ToolContext {
   /* ... */
 }
 
-// Object with default value -- if flag evaluation fails, use the default
+// Object with default value -- if flag evaluation fails or the flag is unknown, use the default
 @Tool({
   name: 'experimental_tool',
   featureFlag: { key: 'experimental-flag', defaultValue: false },
@@ -953,6 +1017,51 @@ All official plugins use the static `init()` pattern inherited from `DynamicPlug
 class ProductionServer {}
 ```
 
+## 7. WebMCP Plugin (`@frontmcp/plugin-webmcp`)
+
+Exposes the tools of a FrontMCP server that runs **in the page** (`create()` from `@frontmcp/sdk` / `@frontmcp/react`) to in-browser agents through [WebMCP](https://webmachinelearning.github.io/webmcp/) — `document.modelContext`, which Gemini in Chrome, the Model Context Tool Inspector extension and DevTools' WebMCP pane use. WebMCP is in origin trial in Chrome/Edge (149–162); for local development enable `chrome://flags/#enable-webmcp-testing`.
+
+### Installation
+
+```typescript
+import { WebMcpPlugin } from '@frontmcp/plugin-webmcp';
+import { create } from '@frontmcp/sdk';
+
+const server = await create({
+  info: { name: 'shop', version: '1.0.0' },
+  tools: [SearchProducts, AddToCart],
+  plugins: [WebMcpPlugin.init({ prefix: 'shop.' })], // always .init(), with or without options
+});
+```
+
+The plugin is a transport adapter: it lists tools through the `tools:list-tools` flow and runs every agent call through `tools:call-tool`, both on the `'webmcp'` call surface — so hooks, authorities, quota and `availableWhen` apply. It keeps the registrations in sync with the tool registry (including `server.registerTool()` and React `useDynamicTool` tools) and unregisters everything on `server.dispose()`. Without `document.modelContext` (Node, unsupported browsers) it does nothing.
+
+### Options
+
+| Option         | Default                   | Description                                                                |
+| -------------- | ------------------------- | -------------------------------------------------------------------------- |
+| `prefix`       | `''`                      | Prepended to every exposed name                                            |
+| `include`      | all                       | `(tool) => boolean`, runs after `availableWhen` and authorities            |
+| `exposedTo`    | —                         | Other origins (e.g. an iframe's parent) the tools are offered to           |
+| `authContext`  | anonymous `webmcp` caller | `DirectAuthContext` or a function returning it, resolved per list and call |
+| `modelContext` | `document.modelContext`   | A polyfill or test double                                                  |
+
+### Choosing what agents see
+
+```typescript
+@Tool({ name: 'fill_checkout_form', availableWhen: { surface: ['webmcp'] } }) // browser agents only
+@Tool({ name: 'admin_reset', availableWhen: { surface: ['mcp'] } }) // never exposed through WebMCP
+```
+
+### Translation rules
+
+- Names: `prefix + name`, characters outside `[A-Za-z0-9_.-]` become `_` (`app:tool` → `app_tool`), max 128, collisions get `_2`, `_3`, …
+- Annotations: `readOnlyHint` → `readOnlyHint`; explicit `destructiveHint: true` → `consequentialHint`; explicit `openWorldHint: true` → `untrustedContentHint`.
+- Results: `{ content, structuredContent? }` without `_meta`; an `isError` result or server error rejects with its message.
+- Tools only — resources and prompts stay MCP-only; elicitation is unavailable to WebMCP callers.
+
+For other browsers, load a polyfill that installs `document.modelContext` (e.g. `@mcp-b/global`) before `create()`, or pass one as `modelContext`.
+
 ## Common Patterns
 
 | Pattern                  | Correct                                                            | Incorrect                                                                       | Why                                                                                                      |
@@ -987,13 +1096,14 @@ class ProductionServer {}
 
 ## Troubleshooting
 
-| Problem                           | Cause                                                                            | Solution                                                                             |
-| --------------------------------- | -------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------ |
-| `this.remember` is undefined      | RememberPlugin not registered or missing `.init()`                               | Add `RememberPlugin.init({ type: 'memory' })` to `plugins` array                     |
-| Cache not working for a tool      | Tool name does not match any `toolPatterns` glob and `cache` metadata is not set | Add `cache: true` to `@Tool` decorator or add matching pattern to `toolPatterns`     |
-| Feature flag always returns false | Using `'static'` adapter with flag not in the `flags` map                        | Add the flag key to `flags: { 'my-flag': true }` or check adapter connection         |
-| Dashboard returns 404             | Plugin is in beta and auto-disabled in production (`NODE_ENV=production`)        | Dashboard is unstable — avoid in production. For dev: set `enabled: true` explicitly |
-| Approval webhook times out        | Callback URL not reachable from the external approval service                    | Verify `callbackPath` is publicly accessible and matches the webhook configuration   |
+| Problem                           | Cause                                                                                                                     | Solution                                                                                                                       |
+| --------------------------------- | ------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ |
+| `this.remember` is undefined      | RememberPlugin not registered or missing `.init()`                                                                        | Add `RememberPlugin.init({ type: 'memory' })` to `plugins` array                                                               |
+| Cache not working for a tool      | Tool name does not match any `toolPatterns` glob and `cache` metadata is not set                                          | Add `cache: true` to `@Tool` decorator or add matching pattern to `toolPatterns`                                               |
+| Feature flag always returns false | Using `'static'` adapter with flag not in the `flags` map                                                                 | Add the flag key to `flags: { 'my-flag': true }` or check adapter connection                                                   |
+| Dashboard returns 404             | Plugin is in beta and auto-disabled in production (`NODE_ENV=production`)                                                 | Dashboard is unstable — avoid in production. For dev: set `enabled: true` explicitly                                           |
+| Approval webhook times out        | Callback URL not reachable from the external approval service                                                             | Verify `callbackPath` is publicly accessible and matches the webhook configuration                                             |
+| WebMCP tools never appear         | No `document.modelContext` (flag off, no origin-trial token, non-HTTPS, no polyfill), or `WebMcpPlugin` without `.init()` | Enable `chrome://flags/#enable-webmcp-testing` or load `@mcp-b/global`; check `isWebMcpSupported()`; use `WebMcpPlugin.init()` |
 
 ## Examples
 

package/catalog/frontmcp-development/references/openapi-adapter.md

@@ -201,12 +201,60 @@ class IntegrationHub {}
 // Tools: github:createIssue, jira:createTicket, slack:postMessage, etc.
 ```
 
+## Options From Providers (`useFactory`)
+
+Build the options at startup from injected providers. The factory returns `OpenApiAdapterOptions` (or a promise of them); the adapter is built from them under the `name` given to `init()`:
+
+```typescript
+OpenapiAdapter.init({
+  name: 'billing',
+  inject: () => [BillingConfig] as const,
+  useFactory: (config: BillingConfig) => ({ name: 'billing', url: config.specUrl, baseUrl: config.baseUrl }),
+});
+```
+
+Until 1.8.7 this form failed startup with `Cannot read properties of undefined (reading 'name')` plus an unhandled rejection that could end the Node process.
+
 ## Filtering Operations
 
-Control which API operations become MCP tools:
+Control which API operations become MCP tools. Every `generateOptions` field is passed to `mcp-from-openapi`'s generator, and an operation becomes a tool only when it passes every filter you set:
 
 ```typescript
-// Filter by path prefix
+// Filter by OpenAPI tag
+OpenapiAdapter.init({
+  name: 'billing-api',
+  url: 'https://api.example.com/openapi.json',
+  generateOptions: {
+    includeTags: ['invoices', 'customers'], // carries one of these tags
+    excludeTags: ['internal'], // carries none of these
+  },
+});
+
+// Filter by path glob (`*` = within a segment, `**` = across segments, `?` = one character)
+OpenapiAdapter.init({
+  name: 'billing-api',
+  url: 'https://api.example.com/openapi.json',
+  generateOptions: {
+    includePaths: ['/invoices/**', '/customers/*'],
+    excludePaths: ['/invoices/*/admin/**'],
+  },
+});
+
+// Read-only tools only (annotations say readOnlyHint: true — GET/HEAD/OPTIONS/TRACE unless overridden)
+OpenapiAdapter.init({
+  name: 'billing-api',
+  url: 'https://api.example.com/openapi.json',
+  generateOptions: { readOnlyOnly: true },
+});
+
+// Filter by HTTP method (lower-case names)
+OpenapiAdapter.init({
+  name: 'billing-api',
+  url: 'https://api.example.com/openapi.json',
+  generateOptions: { excludeMethods: ['delete', 'put'] }, // or includeMethods: ['get']
+});
+
+// Custom filter (runs after every other filter)
 OpenapiAdapter.init({
   name: 'billing-api',
   url: 'https://api.example.com/openapi.json',
@@ -234,6 +282,8 @@ OpenapiAdapter.init({
 });
 ```
 
+The adapter's own defaults are `preferredStatusCodes: [200, 201, 202, 204]`, `includeDeprecated: false` and `includeAllResponses: true`; every other generator option (`maxToolNameLength`, `descriptionStrategy`, `target`, …) takes the value you set.
+
 ## Input Transforms
 
 Hide inputs from AI/users and inject values server-side:

package/catalog/frontmcp-guides/references/example-task-manager.md

@@ -31,8 +31,8 @@ An authenticated task management MCP server with CRUD tools, a Redis-backed prov
   },
   "devDependencies": {
     "@frontmcp/testing": "^1.0.0",
-    "jest": "^29.0.0",
-    "ts-jest": "^29.0.0",
+    "jest": "^30.0.0",
+    "ts-jest": "^29.4.0",
     "typescript": "^5.4.0",
   },
 }

package/catalog/frontmcp-guides/references/example-weather-api.md

@@ -30,8 +30,8 @@ A complete beginner MCP server that exposes a weather lookup tool and a static r
   },
   "devDependencies": {
     "@frontmcp/testing": "^1.0.0",
-    "jest": "^29.0.0",
-    "ts-jest": "^29.0.0",
+    "jest": "^30.0.0",
+    "ts-jest": "^29.4.0",
     "typescript": "^5.4.0",
   },
 }

package/catalog/frontmcp-observability/references/metrics-endpoint.md

@@ -29,6 +29,8 @@ class Server {}
 
 Then scrape: `curl http://localhost:3000/metrics` (the default port is `PORT`, else 3000) — Content-Type is the canonical Prometheus `text/plain; version=0.0.4; charset=utf-8`.
 
+`FrontMcpInstance.createFetchHandler(config)` (the Web-standard `(Request) => Response` handler) answers `GET /metrics` too — same body, auth and headers as the Express listener (it needs `@frontmcp/observability` installed, like the Express endpoint).
+
 ## Configuration
 
 ```typescript
@@ -105,7 +107,7 @@ Keep label values bounded (status codes, enum members, tool names) — unbounded
 
 ## Path conflict guard
 
-`metrics.path` MUST NOT collide with MCP transport paths (`/mcp`, `/sse`, `/messages`). The service constructor throws `MetricsPathConflictError` at startup if it detects an overlap.
+`metrics.path` MUST NOT collide with MCP transport paths (`/mcp`, `/sse`, `/messages`). The service constructor throws `MetricsPathConflictError` at startup if it detects an overlap. `createFetchHandler()` also throws `MetricsPathConflictError` when `metrics.path` equals its MCP entry path (`http.entryPath`, `/` when unset), since the metrics route would otherwise answer the MCP `GET` that opens the event stream.
 
 ## Common Patterns
 

package/catalog/frontmcp-production-readiness/examples/distributed-ha/ha-kubernetes-3-replicas.md

@@ -51,6 +51,7 @@ class MainApp {}
         provider: 'redis',
         host: process.env['REDIS_HOST'] || 'redis',
         port: 6379,
+        defaultTtlMs: 30 * 60_000, // slides while the owning pod serves the session; default 1 hour
       },
     },
   },
@@ -134,6 +135,12 @@ spec:
               value: distributed
             - name: REDIS_HOST
               value: redis
+            # Same secret on every pod: session ids are encrypted with it.
+            - name: MCP_SESSION_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: mcp-server
+                  key: session-secret
           ports:
             - containerPort: 3000
           livenessProbe:
@@ -210,9 +217,14 @@ kubectl exec -it deploy/redis -- redis-cli KEYS "mcp:ha:heartbeat:*"
 # 2) "mcp:ha:heartbeat:mcp-server-7b8f9-def34"
 # 3) "mcp:ha:heartbeat:mcp-server-7b8f9-ghi56"
 
+# Every pod listens on its relay channel: a request that reaches a pod which
+# does not own the session is relayed to the owner and answered from there.
+kubectl exec -it deploy/redis -- redis-cli PUBSUB CHANNELS "mcp:ha:notify:*"
+
 # Kill a pod and watch takeover
 kubectl delete pod mcp-server-7b8f9-abc12
-# After ~30s, its heartbeat expires and sessions are claimed by surviving pods
+# Until its heartbeat expires (~30s) its sessions answer 503 + Retry-After;
+# then surviving pods take them over and serve them.
 ```
 
 ## What This Demonstrates

package/catalog/frontmcp-production-readiness/examples/production-node-sdk/package-json-config.md

@@ -58,8 +58,8 @@ Shows the correct package.json configuration for publishing a FrontMCP SDK packa
 
   "devDependencies": {
     "@frontmcp/testing": "^1.0.0",
-    "jest": "^29.0.0",
-    "ts-jest": "^29.0.0",
+    "jest": "^30.0.0",
+    "ts-jest": "^29.4.0",
     "typescript": "^5.4.0",
     "zod": "^4.0.0",
   },

package/catalog/frontmcp-production-readiness/references/common-checklist.md

@@ -36,7 +36,8 @@ These checks apply to ALL deployment targets. Run them first, then proceed to yo
 - [ ] `security.dnsRebindingProtection.allowedHosts` (or `FRONTMCP_ALLOWED_HOSTS`) names the public
       hostname(s) — on a routable bind the derived default is **not** enforced, and FrontMCP logs a
       warning saying so
-- [ ] Startup logs show no `DNS-rebinding protection is not enforcing a Host allow-list` warning
+- [ ] Startup logs show no `DNS-rebinding protection is not enforcing a Host allow-list` warning, and
+      the production audit reports `[Security] DNS_REBINDING_PROTECTED` (not `DNS_REBINDING_NOT_ENFORCED`)
 - [ ] Include the port when the public URL uses a non-default one (`api.example.com:8443`)
 - [ ] `allowedOrigins` is set when a browser client connects, so a foreign `Origin` is refused
 
@@ -63,7 +64,7 @@ These checks apply to ALL deployment targets. Run them first, then proceed to yo
 - [ ] Per-client/per-IP limits are set
 - [ ] Throttle configuration uses `@FrontMcp({ throttle: {...} })`
 - [ ] Multi-instance: `throttle.storage` uses the storage shape `{ type: 'redis', redis: { config: { host, port } } }` (not the top-level `redis` shape, which silently falls back to auto-detection)
-- [ ] Decided what happens when the throttle Redis is down at startup: the default fails closed (`GuardStorageUnavailableError`); `throttle.storage.fallback: 'memory'` starts with per-instance counters instead
+- [ ] Decided what happens when the throttle Redis is down, at startup or mid-run: the default fails closed (`GuardStorageUnavailableError`); `throttle.storage.fallback: 'memory'` uses per-instance counters instead
 - [ ] Large payload limits are set to prevent memory exhaustion
 
 ### Dependencies