@nylorun/runtime 0.20.0-beta → 0.21.1-beta

package/dist/management-openapi.json

@@ -2,10 +2,10 @@
   "openapi": "3.2.0",
   "info": {
     "title": "Nylorun Management API",
-    "version": "0.20.0-beta",
+    "version": "0.21.1-beta",
     "x-nylorun-protocol": {
       "min": 4,
-      "max": 9,
+      "max": 10,
       "features": [
         "runtime-tenants",
         "admin-status",
@@ -94,10 +94,9 @@
               "sandbox_lost",
               "sandbox_expired",
               "issuer_unavailable",
-              "oauth_client_required",
-              "oauth_state_invalid",
-              "oauth_failed",
               "definition_files_missing",
+              "credential_rejected",
+              "mcp_preview_failed",
               "internal_error"
             ]
           },
@@ -2114,7 +2113,7 @@
             "type": "string",
             "enum": [
               "bearer",
-              "oauth"
+              "headers"
             ]
           },
           "binding": {
@@ -2129,9 +2128,28 @@
             ],
             "additionalProperties": false
           },
-          "expiresAt": {
+          "headerNames": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "via": {
             "type": "string"
           },
+          "identity": {
+            "type": "object",
+            "properties": {
+              "header": {
+                "type": "string",
+                "pattern": "^[!#$%&'*+.^_`|~0-9A-Za-z-]+$"
+              }
+            },
+            "required": [
+              "header"
+            ],
+            "additionalProperties": false
+          },
           "createdAt": {
             "type": "string"
           },
@@ -2183,6 +2201,22 @@
                   "token": {
                     "type": "string",
                     "minLength": 1
+                  },
+                  "via": {
+                    "type": "string"
+                  },
+                  "identity": {
+                    "type": "object",
+                    "properties": {
+                      "header": {
+                        "type": "string",
+                        "pattern": "^[!#$%&'*+.^_`|~0-9A-Za-z-]+$"
+                      }
+                    },
+                    "required": [
+                      "header"
+                    ],
+                    "additionalProperties": false
                   }
                 },
                 "required": [
@@ -2198,104 +2232,33 @@
                   "type": {
                     "type": "string",
                     "enum": [
-                      "oauth"
+                      "headers"
                     ]
                   },
                   "url": {
                     "type": "string",
                     "minLength": 1
                   },
-                  "accessToken": {
-                    "type": "string",
-                    "minLength": 1
+                  "headers": {
+                    "type": "object",
+                    "additionalProperties": {
+                      "type": "string",
+                      "minLength": 1
+                    }
                   },
-                  "expiresAt": {
-                    "type": [
-                      "string",
-                      "null"
-                    ],
-                    "minLength": 1
+                  "via": {
+                    "type": "string"
                   },
-                  "refresh": {
+                  "identity": {
                     "type": "object",
                     "properties": {
-                      "tokenEndpoint": {
-                        "type": "string",
-                        "minLength": 1
-                      },
-                      "clientId": {
+                      "header": {
                         "type": "string",
-                        "minLength": 1
-                      },
-                      "refreshToken": {
-                        "type": "string",
-                        "minLength": 1
-                      },
-                      "tokenEndpointAuth": {
-                        "oneOf": [
-                          {
-                            "type": "object",
-                            "properties": {
-                              "type": {
-                                "type": "string",
-                                "enum": [
-                                  "none"
-                                ]
-                              }
-                            },
-                            "required": [
-                              "type"
-                            ],
-                            "additionalProperties": false
-                          },
-                          {
-                            "type": "object",
-                            "properties": {
-                              "type": {
-                                "type": "string",
-                                "enum": [
-                                  "client_secret_basic"
-                                ]
-                              },
-                              "clientSecret": {
-                                "type": "string",
-                                "minLength": 1
-                              }
-                            },
-                            "required": [
-                              "type",
-                              "clientSecret"
-                            ],
-                            "additionalProperties": false
-                          },
-                          {
-                            "type": "object",
-                            "properties": {
-                              "type": {
-                                "type": "string",
-                                "enum": [
-                                  "client_secret_post"
-                                ]
-                              },
-                              "clientSecret": {
-                                "type": "string",
-                                "minLength": 1
-                              }
-                            },
-                            "required": [
-                              "type",
-                              "clientSecret"
-                            ],
-                            "additionalProperties": false
-                          }
-                        ]
+                        "pattern": "^[!#$%&'*+.^_`|~0-9A-Za-z-]+$"
                       }
                     },
                     "required": [
-                      "tokenEndpoint",
-                      "clientId",
-                      "refreshToken",
-                      "tokenEndpointAuth"
+                      "header"
                     ],
                     "additionalProperties": false
                   }
@@ -2303,7 +2266,7 @@
                 "required": [
                   "type",
                   "url",
-                  "accessToken"
+                  "headers"
                 ],
                 "additionalProperties": false
               }
@@ -2339,7 +2302,7 @@
                   "type": "string",
                   "enum": [
                     "bearer",
-                    "oauth"
+                    "headers"
                   ]
                 },
                 "binding": {
@@ -2354,9 +2317,28 @@
                   ],
                   "additionalProperties": false
                 },
-                "expiresAt": {
+                "headerNames": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "via": {
                   "type": "string"
                 },
+                "identity": {
+                  "type": "object",
+                  "properties": {
+                    "header": {
+                      "type": "string",
+                      "pattern": "^[!#$%&'*+.^_`|~0-9A-Za-z-]+$"
+                    }
+                  },
+                  "required": [
+                    "header"
+                  ],
+                  "additionalProperties": false
+                },
                 "createdAt": {
                   "type": "string"
                 },
@@ -2407,6 +2389,28 @@
                   "token": {
                     "type": "string",
                     "minLength": 1
+                  },
+                  "via": {
+                    "type": [
+                      "string",
+                      "null"
+                    ]
+                  },
+                  "identity": {
+                    "type": [
+                      "object",
+                      "null"
+                    ],
+                    "properties": {
+                      "header": {
+                        "type": "string",
+                        "pattern": "^[!#$%&'*+.^_`|~0-9A-Za-z-]+$"
+                      }
+                    },
+                    "required": [
+                      "header"
+                    ],
+                    "additionalProperties": false
                   }
                 },
                 "required": [
@@ -2421,24 +2425,42 @@
                   "type": {
                     "type": "string",
                     "enum": [
-                      "oauth"
+                      "headers"
                     ]
                   },
-                  "accessToken": {
-                    "type": "string",
-                    "minLength": 1
+                  "headers": {
+                    "type": "object",
+                    "additionalProperties": {
+                      "type": "string",
+                      "minLength": 1
+                    }
                   },
-                  "expiresAt": {
+                  "via": {
                     "type": [
                       "string",
                       "null"
+                    ]
+                  },
+                  "identity": {
+                    "type": [
+                      "object",
+                      "null"
                     ],
-                    "minLength": 1
+                    "properties": {
+                      "header": {
+                        "type": "string",
+                        "pattern": "^[!#$%&'*+.^_`|~0-9A-Za-z-]+$"
+                      }
+                    },
+                    "required": [
+                      "header"
+                    ],
+                    "additionalProperties": false
                   }
                 },
                 "required": [
                   "type",
-                  "accessToken"
+                  "headers"
                 ],
                 "additionalProperties": false
               }
@@ -2452,44 +2474,134 @@
         ],
         "additionalProperties": false
       },
-      "StartOAuthResponse": {
+      "McpPreview": {
         "type": "object",
         "properties": {
-          "authorizeUrl": {
+          "name": {
             "type": "string"
           },
-          "expiresAt": {
+          "url": {
+            "type": "string"
+          },
+          "type": {
+            "type": "string",
+            "enum": [
+              "streamable-http",
+              "sse"
+            ]
+          },
+          "credentialSent": {
+            "type": "boolean"
+          },
+          "serverInfo": {
+            "type": "object",
+            "additionalProperties": {}
+          },
+          "instructions": {
             "type": "string"
+          },
+          "tools": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "serverToolName": {
+                  "type": "string"
+                },
+                "modelName": {
+                  "type": "string"
+                },
+                "description": {
+                  "type": "string"
+                },
+                "annotations": {
+                  "type": "object",
+                  "additionalProperties": {}
+                },
+                "schemaBytes": {
+                  "type": "integer",
+                  "minimum": 0
+                }
+              },
+              "required": [
+                "serverToolName",
+                "schemaBytes"
+              ],
+              "additionalProperties": false
+            }
+          },
+          "renamed": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "serverToolName": {
+                  "type": "string"
+                },
+                "name": {
+                  "type": "string"
+                }
+              },
+              "required": [
+                "serverToolName",
+                "name"
+              ],
+              "additionalProperties": false
+            }
+          },
+          "authRequired": {
+            "type": "object",
+            "properties": {
+              "resourceMetadataUrl": {
+                "type": "string"
+              },
+              "resourceMetadata": {
+                "type": "object",
+                "additionalProperties": {}
+              }
+            },
+            "additionalProperties": false
           }
         },
         "required": [
-          "authorizeUrl",
-          "expiresAt"
+          "name",
+          "url",
+          "type",
+          "credentialSent",
+          "tools",
+          "renamed"
         ],
         "additionalProperties": false
       },
-      "StartOAuthRequest": {
+      "McpPreviewRequest": {
         "type": "object",
         "properties": {
+          "requestId": {
+            "type": "string",
+            "minLength": 1
+          },
           "url": {
             "type": "string",
-            "minLength": 1,
-            "maxLength": 2048
+            "minLength": 1
           },
-          "server": {
+          "type": {
             "type": "string",
-            "minLength": 1,
-            "maxLength": 128
+            "enum": [
+              "streamable-http",
+              "sse"
+            ]
           },
-          "clientId": {
+          "name": {
             "type": "string",
-            "minLength": 1,
-            "maxLength": 512
+            "pattern": "^[A-Za-z0-9_-]{1,64}$"
+          },
+          "vaultId": {
+            "type": "string",
+            "minLength": 1
           }
         },
         "required": [
-          "url",
-          "server"
+          "url"
         ],
         "additionalProperties": false
       },
@@ -2964,10 +3076,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `9`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `9`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -3066,10 +3178,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `9`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `9`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -3178,10 +3290,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `9`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `9`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -3299,10 +3411,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `9`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `9`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -3434,10 +3546,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `9`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `9`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -3546,10 +3658,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `9`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `9`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -3649,10 +3761,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `9`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `9`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -3743,10 +3855,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `9`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `9`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -3844,10 +3956,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `9`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `9`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -3945,10 +4057,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `9`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `9`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -4044,10 +4156,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `9`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `9`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -4155,10 +4267,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `9`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `9`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -4304,10 +4416,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `9`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `9`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -4424,10 +4536,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `9`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `9`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -4525,10 +4637,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `9`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `9`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -4625,10 +4737,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `9`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `9`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -4737,10 +4849,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `9`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `9`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -4860,10 +4972,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `9`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `9`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -4969,10 +5081,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `9`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `9`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -5076,10 +5188,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `9`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `9`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -5164,7 +5276,7 @@
           "Vaults"
         ],
         "summary": "Add a credential",
-        "description": "A bearer token or OAuth tokens, bound to the URLs a tool may send them to.",
+        "description": "A bearer token, bound to the URL a tool may send it to.",
         "security": [
           {
             "managementKey": []
@@ -5186,10 +5298,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `9`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `9`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -5303,10 +5415,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `9`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `9`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -5420,10 +5532,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `9`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `9`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -5535,10 +5647,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `9`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `9`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -5663,10 +5775,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `9`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `9`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -5745,13 +5857,13 @@
         }
       }
     },
-    "/v1/tenant/vaults/{vaultId}/oauth/start": {
+    "/v1/tenant/mcp/preview": {
       "post": {
         "tags": [
-          "Vaults"
+          "MCP servers"
         ],
-        "summary": "Start an MCP OAuth connect",
-        "description": "Signs the installation in to the remote MCP server at `url` (declared as `server`) and stores its OAuth credential, bound to `url`, in this installation vault. The Runtime discovers the server's authorization server (RFC 9728, RFC 8414), registers itself (RFC 7591) unless `clientId` names a registered client, and answers the URL to open in a browser; the sign-in returns to `GET /v1/oauth/callback` within `expiresAt`. The callback URL is `NYLORUN_PUBLIC_URL` + `/v1/oauth/callback`, or this request's own origin when the Host has no public URL. Application keys acting for no one only. `oauth_client_required` when the server offers no registration and no `clientId` was given.",
+        "summary": "Preview an MCP server's tools",
+        "description": "Connects to the remote MCP server at `url` with the installation vault's credential for that URL (its headers and `via`; never an identity header), under the Host's address policy, lists its tools within 15 s and closes the connection. It never calls a tool. Each tool comes with the name the model would call it (`modelName`, made with `name`), its annotations and its input schema's size. A server that answers `401` is `authRequired`, with its RFC 9728 protected-resource metadata when it publishes any: it needs a person's sign-in, so reach it through a gateway (`via`), or with a key. No credential value is in the answer.",
         "security": [
           {
             "managementKey": []
@@ -5762,21 +5874,13 @@
         ],
         "x-nylorun-scopes": "never",
         "parameters": [
-          {
-            "schema": {
-              "type": "string"
-            },
-            "required": true,
-            "name": "vaultId",
-            "in": "path"
-          },
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `9`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `9`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -5786,18 +5890,18 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/StartOAuthRequest"
+                "$ref": "#/components/schemas/McpPreviewRequest"
               }
             }
           }
         },
         "responses": {
           "200": {
-            "description": "Where to send the browser",
+            "description": "The server's tools, or that it needs a credential (`authRequired`)",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/StartOAuthResponse"
+                  "$ref": "#/components/schemas/McpPreview"
                 }
               }
             }
@@ -5842,133 +5946,8 @@
               }
             }
           },
-          "426": {
-            "description": "`Nylorun-Protocol` missing or unsupported",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ProtocolRejected"
-                }
-              }
-            }
-          },
-          "502": {
-            "description": "The authorization server, or its discovery, failed or refused (`oauth_failed`)"
-          },
-          "503": {
-            "description": "The Tenant's storage or streams are unavailable",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Rejected"
-                }
-              }
-            }
-          }
-        }
-      }
-    },
-    "/v1/oauth/callback": {
-      "get": {
-        "tags": [
-          "Vaults"
-        ],
-        "summary": "Finish an MCP OAuth connect",
-        "description": "Where the authorization server sends the browser back with `code` and `state` (or `error`). Exchanges the code once and stores the credential; answers a small HTML page. Needs no credential and no `Nylorun-Protocol`. A `state` is used once, for ten minutes (`oauth_state_invalid`).",
-        "security": [
-          {
-            "applicationKey": []
-          },
-          {
-            "issuerToken": []
-          },
-          {}
-        ],
-        "x-nylorun-credentials": [
-          "application",
-          "subject",
-          "token"
-        ],
-        "x-nylorun-scopes": "any",
-        "parameters": [
-          {
-            "schema": {
-              "type": "string"
-            },
-            "required": false,
-            "name": "code",
-            "in": "query"
-          },
-          {
-            "schema": {
-              "type": "string"
-            },
-            "required": false,
-            "name": "state",
-            "in": "query"
-          },
-          {
-            "schema": {
-              "type": "string"
-            },
-            "required": false,
-            "name": "error",
-            "in": "query"
-          },
-          {
-            "schema": {
-              "type": "string",
-              "description": "The protocol version, `9`"
-            },
-            "required": false,
-            "description": "The protocol version, `9`",
-            "name": "Nylorun-Protocol",
-            "in": "header"
-          },
-          {
-            "schema": {
-              "type": "string",
-              "description": "The person an application key acts for"
-            },
-            "required": false,
-            "description": "The person an application key acts for",
-            "name": "Nylorun-Subject",
-            "in": "header"
-          },
-          {
-            "schema": {
-              "type": "string",
-              "description": "The subject's space-separated scopes; required with a subject"
-            },
-            "required": false,
-            "description": "The subject's space-separated scopes; required with a subject",
-            "name": "Nylorun-Scopes",
-            "in": "header"
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Connected",
-            "content": {
-              "text/html": {
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
-          },
-          "400": {
-            "description": "Invalid headers, path, body or cursor",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Rejected"
-                }
-              }
-            }
-          },
-          "401": {
-            "description": "No credential (`credential_required`), one the Tenant does not accept (`credential_invalid`), a token that expired (`token_expired`), or a token whose issuer's keys cannot be fetched now (`issuer_unavailable`). `WWW-Authenticate: Bearer` names the protected resource metadata (`resource_metadata`)",
+          "409": {
+            "description": "Several installation vaults hold a credential for the URL (name one with `vaultId`), or the one there cannot be used",
             "content": {
               "application/json": {
                 "schema": {
@@ -5977,18 +5956,18 @@
               }
             }
           },
-          "403": {
-            "description": "Not allowed for this credential or subject scope (`scope_required`; a token also gets `WWW-Authenticate: Bearer error=\"insufficient_scope\"` and the scope), a key of the other API (`key_role_mismatch`), or an application key from a browser (`origin_rejected`)",
+          "426": {
+            "description": "`Nylorun-Protocol` missing or unsupported",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/Rejected"
+                  "$ref": "#/components/schemas/ProtocolRejected"
                 }
               }
             }
           },
-          "404": {
-            "description": "Not found (`not_found`)",
+          "502": {
+            "description": "The server could not be listed (`mcp_preview_failed`): `details.failure` is the code a tool call would have failed with, such as `mcp.unreachable` for an address the Host refuses",
             "content": {
               "application/json": {
                 "schema": {
@@ -5997,19 +5976,6 @@
               }
             }
           },
-          "426": {
-            "description": "`Nylorun-Protocol` missing or unsupported",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ProtocolRejected"
-                }
-              }
-            }
-          },
-          "502": {
-            "description": "The authorization server refused the code (`oauth_failed`)"
-          },
           "503": {
             "description": "The Tenant's storage or streams are unavailable",
             "content": {
@@ -6042,10 +6008,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `9`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `9`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -6144,10 +6110,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `9`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `9`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -6266,10 +6232,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `9`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `9`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -6380,10 +6346,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `9`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `9`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -6480,10 +6446,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `9`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `9`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -6591,10 +6557,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `9`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `9`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -6691,10 +6657,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `9`"
+              "description": "The protocol version, `10`"
             },
             "required": true,
-            "description": "The protocol version, `9`",
+            "description": "The protocol version, `10`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -6800,7 +6766,11 @@
     },
     {
       "name": "Vaults",
-      "description": "The installation's credentials for agents' tools: API keys and MCP OAuth connections. Sessions attach a vault by id. `admin.vaults`."
+      "description": "The installation's and each person's credentials for agents' tools: API keys, bound to the URL they are sent to. Sessions attach a vault by id. `admin.vaults`."
+    },
+    {
+      "name": "MCP servers",
+      "description": "See a remote MCP server's tools before an agent names it, with the installation vault's credential for its URL: their model names, sizes and annotations, or that it needs a person's sign-in. `admin.mcp`."
     },
     {
       "name": "Signing keys",