@namzu/sdk 45.1.0 → 48.0.0

package/src/connector/mcp/client.ts

@@ -119,6 +119,7 @@ export class MCPClient {
 	private status: MCPConnectionStatus = 'disconnected'
 	private serverInfo?: { name: string; version?: string }
 	private serverCapabilities?: MCPServerCapabilities
+	private serverInstructions?: string
 	private era?: McpEra
 	private connectedAt?: number
 	private error?: string
@@ -312,6 +313,7 @@ export class MCPClient {
 
 		this.serverInfo = result.serverInfo
 		this.serverCapabilities = result.capabilities
+		this.serverInstructions = result.instructions
 
 		await this.notify('notifications/initialized', {})
 
@@ -486,6 +488,7 @@ export class MCPClient {
 		const result = this.modernInitializeResult(era.version, resolution.discover)
 		this.serverInfo = result.serverInfo
 		this.serverCapabilities = result.capabilities
+		this.serverInstructions = result.instructions
 
 		this.status = 'connected'
 		this.connectedAt = Date.now()
@@ -509,6 +512,9 @@ export class MCPClient {
 	 * not name itself is reported under the name the operator gave it.
 	 * Inventing a placeholder like "unknown" would put a word in the
 	 * server's mouth in the one field a person reads to identify it.
+	 *
+	 * `instructions` is left unset: the modern era has no `initialize`
+	 * round trip, so there is nothing in a `DiscoverResult` to carry it.
 	 */
 	private modernInitializeResult(
 		version: McpModernVersion,
@@ -558,6 +564,7 @@ export class MCPClient {
 			status: this.status,
 			serverInfo: this.serverInfo,
 			serverCapabilities: this.serverCapabilities,
+			serverInstructions: this.serverInstructions,
 			connectedAt: this.connectedAt,
 			error: this.error,
 		}
@@ -837,8 +844,19 @@ export class MCPClient {
 		}
 	}
 
-	onNotification(handler: (method: string, params?: Record<string, unknown>) => void): void {
+	/**
+	 * Returns an unsubscribe, mirroring {@link onLifecycle} below — a listener
+	 * that cannot be removed keeps whatever it closes over (a discovery
+	 * object, a logger, a caller's own state) referenced by this client for
+	 * as long as the client lives, even after the listener's own owner is
+	 * done with it.
+	 */
+	onNotification(handler: (method: string, params?: Record<string, unknown>) => void): () => void {
 		this.notificationHandlers.push(handler)
+		return () => {
+			const index = this.notificationHandlers.indexOf(handler)
+			if (index >= 0) this.notificationHandlers.splice(index, 1)
+		}
 	}
 
 	/**
@@ -851,9 +869,7 @@ export class MCPClient {
 	 * this adds no state, it just says out loud what the client already
 	 * knew.
 	 *
-	 * Returns an unsubscribe. `onNotification` above does not, which is the
-	 * bug this avoids repeating: a listener that cannot be removed keeps a
-	 * disposed host object alive for as long as the client lives.
+	 * Returns an unsubscribe, the same shape `onNotification` above returns.
 	 */
 	onLifecycle(listener: MCPEventListener): () => void {
 		this.lifecycleListeners.push(listener)

package/src/connector/mcp/discovery.ts

@@ -2,6 +2,8 @@ import { NAMZU } from '../../constants/telemetry/index.js'
 import type {
 	MCPDiscoveredTool,
 	MCPPromptDefinition,
+	MCPRequestOptions,
+	MCPResource,
 	MCPToolDefinition,
 } from '../../types/connector/index.js'
 import type { ToolDefinition } from '../../types/tool/index.js'
@@ -38,6 +40,13 @@ export interface MCPToolDiscoveryOptions {
 	 * knows which it is looking at.
 	 */
 	readonly onDrift?: (event: { serverName: string; clientId: string; drift: MCPToolDrift }) => void
+	/** The current policy refusals after each listing, including an empty list when they clear. */
+	readonly onRefused?: (event: {
+		serverName: string
+		clientId: string
+		kind: 'tools' | 'prompts' | 'resources'
+		refused: readonly { name: string; reason: 'not_allowed' | 'denied' }[]
+	}) => void
 	readonly logger?: Logger
 }
 
@@ -120,6 +129,12 @@ export class MCPToolDiscovery {
 		// having agreed to it.
 		const policy = this.options.policies?.[state.serverName] ?? this.options.policies?.['*']
 		const { admitted, refused } = applyToolPolicy(advertised, policy)
+		this.options.onRefused?.({
+			serverName: state.serverName,
+			clientId: client.id,
+			kind: 'tools',
+			refused,
+		})
 
 		if (refused.length > 0) {
 			this.log.warn('MCP tools refused by policy', {
@@ -168,6 +183,12 @@ export class MCPToolDiscovery {
 
 		const policy = this.options.policies?.[state.serverName] ?? this.options.policies?.['*']
 		const { admitted, refused } = applyNamePolicy(advertised, policy)
+		this.options.onRefused?.({
+			serverName: state.serverName,
+			clientId: client.id,
+			kind: 'prompts',
+			refused,
+		})
 
 		if (refused.length > 0) {
 			this.log.warn('MCP prompts refused by policy', {
@@ -180,6 +201,45 @@ export class MCPToolDiscovery {
 		return admitted
 	}
 
+	/**
+	 * The resources a server publishes, through the same admission gate its
+	 * tools and prompts go through.
+	 *
+	 * A server publishing a resource is the same trust question as one
+	 * publishing a tool or a prompt: the remote side must not decide what
+	 * enters the agent's registry. Policy is matched on the resource's own
+	 * `name`, as the server reports it — before this call existed,
+	 * `mcpToolset` read `client.listResources()` directly and admitted every
+	 * URI the server returned, so `deny`/`allow` governed tools and prompts
+	 * but not the one other surface a server can contribute by name.
+	 */
+	async discoverResourcesFrom(
+		client: MCPClient,
+		options?: MCPRequestOptions,
+	): Promise<MCPResource[]> {
+		const state = client.getState()
+		const advertised = await client.listResources(options)
+
+		const policy = this.options.policies?.[state.serverName] ?? this.options.policies?.['*']
+		const { admitted, refused } = applyNamePolicy(advertised, policy)
+		this.options.onRefused?.({
+			serverName: state.serverName,
+			clientId: client.id,
+			kind: 'resources',
+			refused,
+		})
+
+		if (refused.length > 0) {
+			this.log.warn('MCP resources refused by policy', {
+				[NAMZU.SERVER_NAME]: state.serverName,
+				'namzu.mcp.client_id': client.id,
+				'namzu.connector.refused': refused.map((r) => `${r.name} (${r.reason})`),
+			})
+		}
+
+		return admitted
+	}
+
 	async toToolDefinitions(): Promise<ToolDefinition[]> {
 		const discovered = await this.discoverAll()
 		return discovered.map((d) => {

package/src/connector/mcp/index.ts

@@ -41,6 +41,16 @@ export type { McpEnvelope, McpEnvelopeInput, MCPDecodedResult } from './envelope
 export { validateMcpHeaderAnnotations } from './x-mcp-header.js'
 export type { McpHeaderAnnotationVerdict, McpParamHeaderBinding } from './x-mcp-header.js'
 
+// `mcpToolset` (below) is now the ONE path new code should take onto a
+// `Toolset` from MCP (plan.md §4): tools, prompts and resources, discovered,
+// admitted and named together. `mcpToolToToolDefinition` and
+// `mcpPromptToToolDefinition` — the pieces `mcpToolset` wraps — were planned
+// to stop being exported here, but `packages/cli`'s own
+// `integrations/mcp/servers.ts` still calls `mcpToolToToolDefinition`
+// directly (its own naming convention, `mcp_<server>_<tool>`, predates
+// `mcp__`); migrating that CLI path — its tests assert the old names — is
+// item C1's job (plan.md's execution order), not this one's, so both stay
+// exported until C1 lands and removes them here.
 export {
 	mcpToolToToolDefinition,
 	toolDefinitionToMCPTool,
@@ -53,6 +63,9 @@ export {
 export { MCPToolDiscovery } from './discovery.js'
 export { mcpPromptToToolDefinition, renderPromptMessages } from './prompt-adapter.js'
 
+export { mcpToolset, mcpToolsetName } from './mcp-toolset.js'
+export type { MCPToolsetOptions, MCPToolsets } from './mcp-toolset.js'
+
 export { MCPConnectorBridge } from '../../bridge/mcp/connector/adapter.js'
 
 // The direction reverses in `server/`: everything else in this barrel is