@samanhappy/mcphub 1.0.18 → 1.0.20

package/dist/db/entities/SystemConfig.js.map

@@ -1 +1 @@
-{"version":3,"file":"SystemConfig.js","sourceRoot":"","sources":["../../../src/db/entities/SystemConfig.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAE5F;;;GAGG;AAEI,IAAM,YAAY,GAAlB,MAAM,YAAY;CA0CxB,CAAA;AAxCC;IADC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;;wCACxD;AAGX;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;6CAClB;AAG9B;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;6CAClB;AAG9B;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;kDACb;AAGnC;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;2DACJ;AAG5C;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;+CAChB;AAGhC;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;mDACjC;AAGvB;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;2CACpB;AAG5B;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;iDACd;AAGlC;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;0CACrB;AAG3B;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;0DACb;AAG/B;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;+CAChB;AAGhC;IADC,gBAAgB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;8BACjD,IAAI;+CAAC;AAGhB;IADC,gBAAgB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;8BACjD,IAAI;+CAAC;AAzCL,YAAY;IADxB,MAAM,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;GACrB,YAAY,CA0CxB;;AAED,eAAe,YAAY,CAAC"}
+{"version":3,"file":"SystemConfig.js","sourceRoot":"","sources":["../../../src/db/entities/SystemConfig.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAE5F;;;GAGG;AAEI,IAAM,YAAY,GAAlB,MAAM,YAAY;CA6CxB,CAAA;AA3CC;IADC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;;wCACxD;AAGX;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;6CAClB;AAG9B;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;6CAClB;AAG9B;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;kDACb;AAGnC;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;2DACJ;AAG5C;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;+CAChB;AAGhC;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;mDACjC;AAGvB;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;2CACpB;AAG5B;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;iDACd;AAGlC;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;0CACrB;AAG3B;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;0DACb;AAG/B;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;+CAChB;AAGhC;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;iDACd;AAGlC;IADC,gBAAgB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;8BACjD,IAAI;+CAAC;AAGhB;IADC,gBAAgB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;8BACjD,IAAI;+CAAC;AA5CL,YAAY;IADxB,MAAM,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;GACrB,YAAY,CA6CxB;;AAED,eAAe,YAAY,CAAC"}

package/dist/services/activityLoggingService.js

@@ -1,5 +1,10 @@
 import { getActivityDao, isActivityLoggingEnabled } from '../dao/DaoFactory.js';
-import { safeStringify as safeJsonStringify, sanitizeStringForLogging, } from '../utils/serialization.js';
+import { stringifyWithoutRedaction, sanitizeStringForLogging, } from '../utils/serialization.js';
+import { getCachedSystemConfig } from '../utils/systemConfigCache.js';
+const PAYLOAD_OMITTED = JSON.stringify({
+    _omitted: true,
+    _reason: 'activityLog.storeToolPayload is disabled',
+});
 /**
  * Service for logging tool call activities
  * Only logs when in database mode
@@ -32,14 +37,15 @@ export class ActivityLoggingService {
             return;
         }
         try {
+            const storePayload = this.shouldStoreToolPayload();
             const activity = {
                 timestamp: new Date(),
                 server: params.server,
                 tool: params.tool,
                 duration: params.duration,
                 status: params.status,
-                input: params.input ? this.safeStringify(params.input) : undefined,
-                output: params.output ? this.safeStringify(params.output) : undefined,
+                input: this.serializePayload(params.input, storePayload),
+                output: this.serializePayload(params.output, storePayload),
                 group: params.group,
                 username: params.username,
                 keyId: params.keyId,
@@ -57,12 +63,36 @@ export class ActivityLoggingService {
         }
     }
     /**
-     * Safely stringify an object, handling circular references
+     * Whether to persist full tool call payloads. Defaults to true; deployments
+     * that treat tool arguments as sensitive can opt out via system config.
+     */
+    shouldStoreToolPayload() {
+        return getCachedSystemConfig()?.activityLog?.storeToolPayload !== false;
+    }
+    /**
+     * Serialize a tool call payload for storage.
+     *
+     * Payloads are stored verbatim (no field-level redaction): heuristic
+     * redaction corrupts the audit record on false positives and gives false
+     * assurance on false negatives, so the decision is whether to store at all.
+     */
+    serializePayload(payload, storePayload) {
+        if (payload === undefined || payload === null) {
+            return undefined;
+        }
+        if (!storePayload) {
+            return PAYLOAD_OMITTED;
+        }
+        return this.safeStringify(payload);
+    }
+    /**
+     * Stringify an object without redaction, handling circular references and
+     * capping the stored size.
      */
     safeStringify(obj) {
         try {
             // Limit the size of the stringified data
-            const str = safeJsonStringify(obj, 2);
+            const str = stringifyWithoutRedaction(obj, 2);
             // Limit to 100KB
             if (str.length > 100000) {
                 return JSON.stringify({
@@ -73,7 +103,7 @@ export class ActivityLoggingService {
             }
             return str;
         }
-        catch (error) {
+        catch (_error) {
             return JSON.stringify({
                 _error: 'Failed to stringify data',
                 _type: typeof obj,

package/dist/services/activityLoggingService.js.map

@@ -1 +1 @@
-{"version":3,"file":"activityLoggingService.js","sourceRoot":"","sources":["../../src/services/activityLoggingService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAEhF,OAAO,EACL,aAAa,IAAI,iBAAiB,EAClC,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AAEnC;;;GAGG;AACH,MAAM,OAAO,sBAAsB;IAG1B,MAAM,CAAC,WAAW;QACvB,IAAI,CAAC,sBAAsB,CAAC,QAAQ,EAAE,CAAC;YACrC,sBAAsB,CAAC,QAAQ,GAAG,IAAI,sBAAsB,EAAE,CAAC;QACjE,CAAC;QACD,OAAO,sBAAsB,CAAC,QAAQ,CAAC;IACzC,CAAC;IAED;QACE,oCAAoC;IACtC,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,wBAAwB,EAAE,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,MAajB;QACC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;QACrC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAA0B;gBACtC,SAAS,EAAE,IAAI,IAAI,EAAE;gBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;gBAClE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;gBACrE,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,YAAY,EAAE,MAAM,CAAC,YAAY;oBAC/B,CAAC,CAAC,wBAAwB,CAAC,MAAM,CAAC,YAAY,CAAC;oBAC/C,CAAC,CAAC,SAAS;aACd,CAAC;YAEF,MAAM,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,kDAAkD;YAClD,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,GAAQ;QAC5B,IAAI,CAAC;YACH,yCAAyC;YACzC,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACtC,iBAAiB;YACjB,IAAI,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;gBACxB,OAAO,IAAI,CAAC,SAAS,CAAC;oBACpB,UAAU,EAAE,IAAI;oBAChB,QAAQ,EAAE,yBAAyB;oBACnC,eAAe,EAAE,GAAG,CAAC,MAAM;iBAC5B,CAAC,CAAC;YACL,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,SAAS,CAAC;gBACpB,MAAM,EAAE,0BAA0B;gBAClC,KAAK,EAAE,OAAO,GAAG;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB;IACvC,OAAO,sBAAsB,CAAC,WAAW,EAAE,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"activityLoggingService.js","sourceRoot":"","sources":["../../src/services/activityLoggingService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAEhF,OAAO,EACL,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAEtE,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC;IACrC,QAAQ,EAAE,IAAI;IACd,OAAO,EAAE,0CAA0C;CACpD,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,OAAO,sBAAsB;IAG1B,MAAM,CAAC,WAAW;QACvB,IAAI,CAAC,sBAAsB,CAAC,QAAQ,EAAE,CAAC;YACrC,sBAAsB,CAAC,QAAQ,GAAG,IAAI,sBAAsB,EAAE,CAAC;QACjE,CAAC;QACD,OAAO,sBAAsB,CAAC,QAAQ,CAAC;IACzC,CAAC;IAED;QACE,oCAAoC;IACtC,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,wBAAwB,EAAE,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,MAajB;QACC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;QACrC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;YACnD,MAAM,QAAQ,GAA0B;gBACtC,SAAS,EAAE,IAAI,IAAI,EAAE;gBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,KAAK,EAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC;gBACxD,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC;gBAC1D,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,YAAY,EAAE,MAAM,CAAC,YAAY;oBAC/B,CAAC,CAAC,wBAAwB,CAAC,MAAM,CAAC,YAAY,CAAC;oBAC/C,CAAC,CAAC,SAAS;aACd,CAAC;YAEF,MAAM,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,kDAAkD;YAClD,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,sBAAsB;QAC5B,OAAO,qBAAqB,EAAE,EAAE,WAAW,EAAE,gBAAgB,KAAK,KAAK,CAAC;IAC1E,CAAC;IAED;;;;;;OAMG;IACK,gBAAgB,CAAC,OAAY,EAAE,YAAqB;QAC1D,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YAC9C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,eAAe,CAAC;QACzB,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAED;;;OAGG;IACK,aAAa,CAAC,GAAQ;QAC5B,IAAI,CAAC;YACH,yCAAyC;YACzC,MAAM,GAAG,GAAG,yBAAyB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC9C,iBAAiB;YACjB,IAAI,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;gBACxB,OAAO,IAAI,CAAC,SAAS,CAAC;oBACpB,UAAU,EAAE,IAAI;oBAChB,QAAQ,EAAE,yBAAyB;oBACnC,eAAe,EAAE,GAAG,CAAC,MAAM;iBAC5B,CAAC,CAAC;YACL,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,MAAM,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,SAAS,CAAC;gBACpB,MAAM,EAAE,0BAA0B;gBAClC,KAAK,EAAE,OAAO,GAAG;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB;IACvC,OAAO,sBAAsB,CAAC,WAAW,EAAE,CAAC;AAC9C,CAAC"}

package/dist/services/mcpService.js

@@ -10,6 +10,8 @@ import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js'
 import { StreamableHTTPClientTransport, } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
 import { normalizeHeaders } from '@modelcontextprotocol/sdk/shared/transport.js';
 import { createFetchWithProxy, getProxyConfigFromEnv } from './proxy.js';
+import { assertSafeUrl, createRedirectValidatingFetch } from '../utils/ssrf.js';
+import { getUserDao } from '../dao/index.js';
 import { expandEnvVars, replaceEnvVars, getNameSeparator } from '../config/index.js';
 import config from '../config/index.js';
 import { getGroup } from './sseService.js';
@@ -698,11 +700,23 @@ export const createTransportFromConfig = async (name, conf) => {
         ...process.env,
         ...replaceEnvVars(conf.env || {}),
     };
+    // SSRF guard: block URL/streamable-http transports from reaching
+    // loopback / RFC1918 / link-local targets (e.g. cloud metadata service).
+    // Admin-owned servers may legitimately target internal services, so they
+    // skip the internal-IP blocklist. allowInternal also governs per-hop
+    // redirect validation in createRedirectValidatingFetch below.
+    const ownerUser = conf.owner
+        ? await getUserDao().findByUsername(conf.owner)
+        : null;
+    const allowInternal = !!ownerUser?.isAdmin;
+    if (conf.url) {
+        await assertSafeUrl(conf.url, { allowInternal });
+    }
     if (conf.type === 'streamable-http') {
         const options = {};
         const headers = conf.headers ? replaceEnvVars(conf.headers, env) : {};
         const baseFetch = createFetchWithProxy(getProxyConfigFromEnv(env));
-        const requestAwareFetch = createRequestContextAwareFetch(baseFetch, conf.passthroughHeaders);
+        const requestAwareFetch = createRedirectValidatingFetch(createRequestContextAwareFetch(baseFetch, conf.passthroughHeaders), allowInternal);
         if (Object.keys(headers).length > 0) {
             options.requestInit = {
                 headers,
@@ -722,7 +736,7 @@ export const createTransportFromConfig = async (name, conf) => {
         const options = {};
         const headers = conf.headers ? replaceEnvVars(conf.headers, env) : {};
         const baseFetch = createFetchWithProxy(getProxyConfigFromEnv(env));
-        const requestAwareFetch = createRequestContextAwareFetch(baseFetch, conf.passthroughHeaders);
+        const requestAwareFetch = createRedirectValidatingFetch(createRequestContextAwareFetch(baseFetch, conf.passthroughHeaders), allowInternal);
         if (Object.keys(headers).length > 0) {
             options.eventSourceInit = {
                 headers,
@@ -989,6 +1003,9 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
                     serverInfo.tools = mcpTools;
                     serverInfo.openApiClient = openApiClient;
                     console.log(`Successfully initialized OpenAPI server: ${name} with ${mcpTools.length} tools`);
+                    // Broadcast now that tools are loaded. OpenAPI servers expose tools
+                    // only (no prompts/resources). See the standard-path note above.
+                    broadcastToolListChanged();
                     // Save tools as vector embeddings for search
                     syncToolsAsVectorEmbeddings(name, mcpTools, {
                         reportProgress: options?.reportEmbeddingProgress === true && serverName === name,
@@ -1077,6 +1094,11 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
                         updateServerToolsCache(serverInfo, tools.tools, {
                             reportEmbeddingProgress: options?.reportEmbeddingProgress === true && serverName === name,
                         });
+                        // Broadcast only after tools are actually loaded into the cache.
+                        // The connection completes asynchronously, so callers (e.g. enabling
+                        // a server) cannot broadcast a correct tool list themselves — doing so
+                        // would race ahead of this point and push a stale (empty) list.
+                        broadcastToolListChanged();
                     })
                         .catch((error) => {
                         console.error('Failed to list tools for server', {
@@ -1092,6 +1114,7 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
                         .then((prompts) => {
                         console.log(`Successfully listed ${prompts.prompts.length} prompts for server: ${name}`);
                         updateServerPromptsCache(serverInfo, prompts.prompts);
+                        broadcastPromptListChanged();
                     })
                         .catch((error) => {
                         console.error('Failed to list prompts for server', {
@@ -1107,6 +1130,7 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
                         .then((resources) => {
                         console.log(`Successfully listed ${resources.resources.length} resources for server: ${name}`);
                         updateServerResourcesCache(serverInfo, resources.resources);
+                        broadcastResourceListChanged();
                     })
                         .catch((error) => {
                         console.error('Failed to list resources for server', {
@@ -1607,6 +1631,9 @@ const normalizeToolNameForServer = (serverName, toolName) => {
     return toolName.startsWith(prefix) ? toolName.substring(prefix.length) : toolName;
 };
 const getGroupLookupName = (group) => {
+    if (group === '$smart') {
+        return undefined;
+    }
     if (group?.startsWith('$smart/')) {
         return group.substring(7) || undefined;
     }
@@ -1749,7 +1776,10 @@ export const handleCallToolRequest = async (request, extra) => {
     // Extract group and key info from request context (set by SSE/HTTP handlers)
     // Fallback to extra for backward compatibility (e.g., direct API calls)
     const group = requestContextService.getGroupContext() || extra?.group || getGroup(sessionId) || undefined;
-    const username = requestContextService.getUsernameContext() || extra?.username || undefined;
+    const username = requestContextService.getUsernameContext() ||
+        extra?.username ||
+        (requestContextService.getKeyKindContext() === 'system' ? 'system' : undefined) ||
+        undefined;
     let appsRouteContext = { enabled: false };
     const keyId = bearerKeyContext.keyId || extra?.keyId || undefined;
     const keyName = bearerKeyContext.keyName || extra?.keyName || undefined;
@@ -1798,7 +1828,7 @@ export const handleCallToolRequest = async (request, extra) => {
             else if (extra && extra.server) {
                 targetServerInfo = getServerByName(extra.server);
             }
-            else if (group) {
+            else if (getGroupLookupName(group)) {
                 const groupTool = await resolveToolInGroup(group, toolName, appsRouteContext.enabled);
                 if (groupTool) {
                     targetServerInfo = groupTool.serverInfo;
@@ -1949,12 +1979,14 @@ export const handleCallToolRequest = async (request, extra) => {
             });
         }
         // Regular tool handling
-        const groupTool = !appsRouteContext.enabled && group
-            ? await resolveToolInGroup(group, request.params.name, appsRouteContext.enabled)
+        const lookupGroup = getGroupLookupName(group);
+        const groupTool = !appsRouteContext.enabled && lookupGroup
+            ? await resolveToolInGroup(lookupGroup, request.params.name, appsRouteContext.enabled)
             : undefined;
         const serverInfo = appsRouteContext.enabled
             ? appsRouteContext.serverInfo
-            : (groupTool?.serverInfo ?? (group ? undefined : getServerByTool(request.params.name)));
+            : (groupTool?.serverInfo ??
+                (lookupGroup ? undefined : getServerByTool(request.params.name)));
         const routeToolName = groupTool?.toolName ?? request.params.name;
         const tool = groupTool?.tool ??
             (serverInfo
@@ -2144,11 +2176,12 @@ export const handleGetPromptRequest = async (request, extra) => {
         }
         let server;
         let promptNameForServer = name;
+        const lookupGroup = getGroupLookupName(group);
         if (extra && extra.server) {
             server = getServerByName(extra.server);
         }
-        else if (group) {
-            const groupPrompt = await resolvePromptInGroup(group, name);
+        else if (lookupGroup) {
+            const groupPrompt = await resolvePromptInGroup(lookupGroup, name);
             if (groupPrompt) {
                 server = groupPrompt.serverInfo;
                 promptNameForServer = groupPrompt.promptName;
@@ -2202,6 +2235,7 @@ export const handleGetPromptRequest = async (request, extra) => {
 export const handleListPromptsRequest = async (_, extra) => {
     const sessionId = extra.sessionId || '';
     const group = getGroup(sessionId);
+    const lookupGroup = getGroupLookupName(group);
     console.log(`Handling ListPromptsRequest for group: ${group}`);
     // Start with built-in prompts (only enabled ones)
     const builtinPrompts = await getBuiltinPromptDao().findEnabled();
@@ -2211,7 +2245,7 @@ export const handleListPromptsRequest = async (_, extra) => {
         description: bp.description,
         arguments: bp.arguments,
     }));
-    const { filteredServerInfos, serverConfigsByName } = await getFilteredServerInfosForGroup(group);
+    const { filteredServerInfos, serverConfigsByName } = await getFilteredServerInfosForGroup(lookupGroup);
     for (const serverInfo of filteredServerInfos) {
         if (serverInfo.prompts && serverInfo.prompts.length > 0) {
             const groupServerConfig = serverConfigsByName.get(serverInfo.name);
@@ -2225,7 +2259,7 @@ export const handleListPromptsRequest = async (_, extra) => {
                     return promptConfig?.enabled !== false;
                 });
             }
-            enabledPrompts = await filterPromptsByGroup(group, serverInfo.name, enabledPrompts, groupServerConfig);
+            enabledPrompts = await filterPromptsByGroup(lookupGroup, serverInfo.name, enabledPrompts, groupServerConfig);
             // Apply custom descriptions from server configuration
             const promptsWithCustomDescriptions = enabledPrompts.map((prompt) => {
                 const promptConfig = serverConfig?.prompts?.[prompt.name];
@@ -2245,6 +2279,7 @@ export const handleListPromptsRequest = async (_, extra) => {
 export const handleListResourcesRequest = async (_, extra) => {
     const sessionId = extra.sessionId || '';
     const group = getGroup(sessionId);
+    const lookupGroup = getGroupLookupName(group);
     console.log(`Handling ListResourcesRequest for group: ${group}`);
     const appsRouteContext = await getMcpAppsRouteContext(sessionId, group);
     // Start with built-in resources (only enabled ones)
@@ -2255,7 +2290,7 @@ export const handleListResourcesRequest = async (_, extra) => {
         description: br.description,
         mimeType: br.mimeType,
     }));
-    const { filteredServerInfos, serverConfigsByName } = await getFilteredServerInfosForGroup(group);
+    const { filteredServerInfos, serverConfigsByName } = await getFilteredServerInfosForGroup(lookupGroup);
     for (const serverInfo of filteredServerInfos) {
         if (serverInfo.resources && serverInfo.resources.length > 0) {
             // Filter resources based on server configuration
@@ -2267,7 +2302,7 @@ export const handleListResourcesRequest = async (_, extra) => {
                     return resourceConfig?.enabled !== false;
                 });
             }
-            enabledResources = await filterResourcesByGroup(group, serverInfo.name, enabledResources, serverConfigsByName.get(serverInfo.name));
+            enabledResources = await filterResourcesByGroup(lookupGroup, serverInfo.name, enabledResources, serverConfigsByName.get(serverInfo.name));
             // Apply custom descriptions from server configuration
             const resourcesWithCustomDescriptions = enabledResources.map((resource) => {
                 const resourceConfig = serverConfig?.resources?.[resource.uri];
@@ -2289,9 +2324,10 @@ export const handleListResourcesRequest = async (_, extra) => {
 export const handleListResourceTemplatesRequest = async (_, extra) => {
     const sessionId = extra.sessionId || '';
     const group = getGroup(sessionId);
+    const lookupGroup = getGroupLookupName(group);
     console.log(`Handling ListResourceTemplatesRequest for group: ${group}`);
     const appsRouteContext = await getMcpAppsRouteContext(sessionId, group);
-    const { filteredServerInfos, serverConfigsByName } = await getFilteredServerInfosForGroup(group, {
+    const { filteredServerInfos, serverConfigsByName } = await getFilteredServerInfosForGroup(lookupGroup, {
         requireClient: true,
     });
     const results = await Promise.allSettled(filteredServerInfos.map(async (serverInfo) => {
@@ -2299,7 +2335,7 @@ export const handleListResourceTemplatesRequest = async (_, extra) => {
             return [];
         }
         const templates = await serverInfo.client.listResourceTemplates({}, serverInfo.options || {});
-        const filteredTemplates = await filterResourceTemplatesByGroup(group, serverInfo.name, templates.resourceTemplates || [], serverConfigsByName.get(serverInfo.name));
+        const filteredTemplates = await filterResourceTemplatesByGroup(lookupGroup, serverInfo.name, templates.resourceTemplates || [], serverConfigsByName.get(serverInfo.name));
         return appsRouteContext.enabled
             ? filteredTemplates
             : filteredTemplates.map((template) => stripMcpAppsMetadata(template));
@@ -2313,6 +2349,7 @@ export const handleReadResourceRequest = async (request, extra) => {
         const { uri } = request.params;
         const sessionId = extra.sessionId || '';
         const group = getGroup(sessionId);
+        const lookupGroup = getGroupLookupName(group);
         const appsRouteContext = await getMcpAppsRouteContext(sessionId, group);
         // Check built-in resources first
         const builtinResource = await getBuiltinResourceDao().findByUri(uri);
@@ -2327,7 +2364,7 @@ export const handleReadResourceRequest = async (request, extra) => {
                 ],
             };
         }
-        const { filteredServerInfos, serverConfigsByName } = await getFilteredServerInfosForGroup(group);
+        const { filteredServerInfos, serverConfigsByName } = await getFilteredServerInfosForGroup(lookupGroup);
         let server;
         for (const serverInfo of filteredServerInfos) {
             if (serverInfo.status !== 'connected') {
@@ -2338,7 +2375,7 @@ export const handleReadResourceRequest = async (request, extra) => {
             if (serverConfig?.resources) {
                 enabledResources = enabledResources.filter((resource) => serverConfig.resources?.[resource.uri]?.enabled !== false);
             }
-            enabledResources = await filterResourcesByGroup(group, serverInfo.name, enabledResources, serverConfigsByName.get(serverInfo.name));
+            enabledResources = await filterResourcesByGroup(lookupGroup, serverInfo.name, enabledResources, serverConfigsByName.get(serverInfo.name));
             if (enabledResources.some((resource) => resource.uri === uri)) {
                 server = serverInfo;
                 break;