@samanhappy/mcphub 1.0.31 → 1.0.33

package/dist/services/mcpService.js

@@ -2,6 +2,7 @@ import os from 'os';
 import path from 'path';
 import fs from 'fs';
 import treeKill from 'tree-kill';
+import { isProcessTreeKillAvailable } from '../utils/processTree.js';
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { CallToolRequestSchema, ListToolsRequestSchema, ListPromptsRequestSchema, GetPromptRequestSchema, ListResourcesRequestSchema, ListResourceTemplatesRequestSchema, ReadResourceRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
 import { Client } from '@modelcontextprotocol/sdk/client/index.js';
@@ -16,6 +17,7 @@ import { ResilientJsonSchemaValidator } from '../utils/jsonSchemaValidator.js';
 import { getUserDao } from '../dao/index.js';
 import { expandEnvVars, replaceEnvVars, getNameSeparator } from '../config/index.js';
 import config from '../config/index.js';
+import { validateServerName } from '../utils/serverNameValidation.js';
 import { getGroup } from './sseService.js';
 import { getServerConfigInGroup, normalizeGroupServers } from './groupService.js';
 import { removeServerToolEmbeddings, saveToolsAsVectorEmbeddings } from './vectorSearchService.js';
@@ -35,6 +37,7 @@ import { MCP_APPS_CAPABILITIES, filterModelVisibleTools, hasMcpAppsCapability, i
 import { supportsCacheRefresh, injectRefreshFlag, clearRunnerCache } from '../utils/cacheUtils.js';
 const servers = {};
 import { setupClientKeepAlive } from './keepAliveService.js';
+import { logger } from '../utils/logger.js';
 /**
  * Check if proxychains4 is available on the system (Linux/macOS only).
  * Returns the path to proxychains4 if found, null otherwise.
@@ -77,12 +80,12 @@ const generateProxychainsConfig = (serverName, proxyConfig) => {
         if (fs.existsSync(proxyConfig.configPath)) {
             return proxyConfig.configPath;
         }
-        console.warn(`[${serverName}] Custom proxychains config not found: ${proxyConfig.configPath}`);
+        logger.warn(`[${serverName}] Custom proxychains config not found: ${proxyConfig.configPath}`);
         return null;
     }
     // Validate required fields
     if (!proxyConfig.host || !proxyConfig.port) {
-        console.warn(`[${serverName}] Proxy host and port are required for proxychains4`);
+        logger.warn(`[${serverName}] Proxy host and port are required for proxychains4`);
         return null;
     }
     const proxyType = proxyConfig.type || 'socks5';
@@ -114,7 +117,7 @@ ${proxyLine}
     // Write config file
     const configPath = path.join(tempDir, `${serverName.replace(/[^a-zA-Z0-9-_]/g, '_')}.conf`);
     fs.writeFileSync(configPath, configContent, 'utf-8');
-    console.log(`[${serverName}] Generated proxychains4 config: ${configPath}`);
+    logger.log(`[${serverName}] Generated proxychains4 config: ${configPath}`);
     return configPath;
 };
 /**
@@ -124,9 +127,20 @@ ${proxyLine}
 const isSafeCommand = (command) => {
     // Block shell builtins that could be used for command injection
     const blockedCommands = new Set([
-        'sh', 'bash', 'zsh', 'fish', 'csh', 'ksh', 'tcsh',
-        'cmd', 'powershell', 'pwsh',
-        'eval', 'exec', 'source', '.',
+        'sh',
+        'bash',
+        'zsh',
+        'fish',
+        'csh',
+        'ksh',
+        'tcsh',
+        'cmd',
+        'powershell',
+        'pwsh',
+        'eval',
+        'exec',
+        'source',
+        '.',
     ]);
     const basename = command.split('/').pop()?.split('\\').pop()?.toLowerCase() || '';
     if (blockedCommands.has(basename)) {
@@ -143,7 +157,7 @@ const isSafeCommand = (command) => {
  * Removes shell metacharacters and dangerous patterns.
  */
 const sanitizeArgs = (args) => {
-    return args.map(arg => {
+    return args.map((arg) => {
         // Remove shell metacharacters that could be used for injection
         // Allow common flags (-f, --flag, -vvv) and paths
         if (/^[a-zA-Z0-9._/\\:@=+,-]+$/.test(arg)) {
@@ -151,7 +165,7 @@ const sanitizeArgs = (args) => {
         }
         // For arguments with special characters, log a warning
         // Also block redirection operators (>, <, >>) and newlines
-        console.warn(`[proxychains] Potentially unsafe argument blocked: ${arg}`);
+        logger.warn(`[proxychains] Potentially unsafe argument blocked: ${arg}`);
         return arg.replace(/[;&|`$(){}[\]!><\n\r]/g, '');
     });
 };
@@ -166,30 +180,30 @@ const wrapWithProxychains = (serverName, command, args, proxyConfig) => {
     }
     // Check platform - Windows is not supported
     if (process.platform === 'win32') {
-        console.warn(`[${serverName}] proxychains4 proxy is not supported on Windows, ignoring proxy configuration`);
+        logger.warn(`[${serverName}] proxychains4 proxy is not supported on Windows, ignoring proxy configuration`);
         return { command, args };
     }
     // SECURITY: Validate command is safe
     if (!isSafeCommand(command)) {
-        console.error(`[${serverName}] Blocked unsafe command for proxychains4 wrapping: ${command}`);
+        logger.error(`[${serverName}] Blocked unsafe command for proxychains4 wrapping: ${command}`);
         throw new Error(`[${serverName}] Unsafe command blocked: ${command}. Shell builtins and metacharacters are not allowed.`);
     }
     // Find proxychains4 binary
     const proxychains4Path = findProxychains4();
     if (!proxychains4Path) {
-        console.warn(`[${serverName}] proxychains4 not found on system, install it with: apt install proxychains4 (Debian/Ubuntu) or brew install proxychains-ng (macOS)`);
+        logger.warn(`[${serverName}] proxychains4 not found on system, install it with: apt install proxychains4 (Debian/Ubuntu) or brew install proxychains-ng (macOS)`);
         return { command, args };
     }
     // Generate or get config file
     const configPath = generateProxychainsConfig(serverName, proxyConfig);
     if (!configPath) {
-        console.warn(`[${serverName}] Failed to setup proxychains4 configuration, skipping proxy`);
+        logger.warn(`[${serverName}] Failed to setup proxychains4 configuration, skipping proxy`);
         return { command, args };
     }
     // SECURITY: Sanitize arguments
     const sanitizedArgs = sanitizeArgs(args);
     // Wrap command with proxychains4
-    console.log(`[${serverName}] Using proxychains4 proxy: ${proxyConfig.type || 'socks5'}://${proxyConfig.host}:${proxyConfig.port}`);
+    logger.log(`[${serverName}] Using proxychains4 proxy: ${proxyConfig.type || 'socks5'}://${proxyConfig.host}:${proxyConfig.port}`);
     return {
         command: proxychains4Path,
         args: ['-f', configPath, command, ...sanitizedArgs],
@@ -237,7 +251,7 @@ export const getMcpServer = async (sessionId, group) => {
         servers[sessionId] = createMcpServer(descriptor.name, descriptor.version, descriptor);
     }
     else {
-        console.log(`MCP server already exists for sessionId: ${sessionId}`);
+        logger.log(`MCP server already exists for sessionId: ${sessionId}`);
     }
     return servers[sessionId];
 };
@@ -255,7 +269,7 @@ const closeIsolatedClient = (serverName, client, transport) => {
         client.close();
     }
     catch (e) {
-        console.warn(`[${serverName}] Error closing isolated client:`, e);
+        logger.warn(`[${serverName}] Error closing isolated client:`, e);
     }
     const candidateTransport = transport;
     const stdioPid = typeof candidateTransport.pid === 'number' ? candidateTransport.pid : null;
@@ -263,7 +277,7 @@ const closeIsolatedClient = (serverName, client, transport) => {
         transport.close();
     }
     catch (e) {
-        console.warn(`[${serverName}] Error closing isolated transport:`, e);
+        logger.warn(`[${serverName}] Error closing isolated transport:`, e);
     }
     // For stdio transports, kill the whole process tree to avoid orphans
     if (stdioPid) {
@@ -287,7 +301,7 @@ const cleanupIsolatedSession = (sessionId) => {
                 isolatedClientCreationLocks.delete(key);
             }
         }
-        console.log(`Cleaned up isolated clients for session: ${sessionId}`);
+        logger.log(`Cleaned up isolated clients for session: ${sessionId}`);
     }
     // Drop per-session OpenAPI cookie jars so authenticated state does not
     // outlive the downstream session.
@@ -355,12 +369,12 @@ const getOrCreateIsolatedClient = async (sessionId, serverInfo) => {
         // Guard: the session was cleaned up during the async connect if its map was
         // deleted (identity no longer matches) — close the just-created connection.
         if (sessionIsolatedClients.get(sessionId) !== reservedClients) {
-            console.warn(`Session ${sessionId} was deleted during isolated client creation for ${serverInfo.name}, closing new client`);
+            logger.warn(`Session ${sessionId} was deleted during isolated client creation for ${serverInfo.name}, closing new client`);
             closeIsolatedClient(serverInfo.name, client, transport);
             throw new Error(`Session ${sessionId} no longer exists`);
         }
         setSessionIsolatedClient(sessionId, serverInfo.name, client, transport);
-        console.log(`Created isolated client for session ${sessionId} -> ${serverInfo.name}`);
+        logger.log(`Created isolated client for session ${sessionId} -> ${serverInfo.name}`);
         return { client, transport };
     })();
     isolatedClientCreationLocks.set(lockKey, createPromise);
@@ -382,10 +396,10 @@ const broadcastListChanged = (listType, sendNotification) => {
     Object.values(servers).forEach((server) => {
         sendNotification(server)
             .then(() => {
-            console.log(`${listType} list changed notification sent successfully`);
+            logger.log(`${listType} list changed notification sent successfully`);
         })
             .catch((error) => {
-            console.warn(`Failed to send ${listType} list changed notification:`, error.message);
+            logger.warn(`Failed to send ${listType} list changed notification:`, error.message);
         });
     });
 };
@@ -416,12 +430,12 @@ export const updateServerInfoVisibility = (serverName, visibility, sharedWithUse
 export const syncToolEmbedding = async (serverName, toolName) => {
     const serverInfo = getServerByName(serverName);
     if (!serverInfo) {
-        console.warn(`Server not found: ${serverName}`);
+        logger.warn(`Server not found: ${serverName}`);
         return;
     }
     const tool = serverInfo.tools.find((t) => t.name === toolName);
     if (!tool) {
-        console.warn(`Tool not found: ${toolName} on server: ${serverName}`);
+        logger.warn(`Tool not found: ${toolName} on server: ${serverName}`);
         return;
     }
     if (isAppOnlyTool(tool)) {
@@ -429,8 +443,8 @@ export const syncToolEmbedding = async (serverName, toolName) => {
     }
     // Save tool as vector embedding for search
     syncToolsAsVectorEmbeddings(serverName, [tool]).catch((error) => {
-        console.warn(`[EMBED_SYNC_ERROR] Failed to sync embedding for tool "${toolName}" on server "${serverName}"`);
-        console.error('Error syncing single tool embedding', { serverName, toolName, error });
+        logger.warn(`[EMBED_SYNC_ERROR] Failed to sync embedding for tool "${toolName}" on server "${serverName}"`);
+        logger.error('Error syncing single tool embedding', { serverName, toolName, error });
     });
 };
 // Helper function to clean $schema field from inputSchema
@@ -540,7 +554,7 @@ export const updateServerToolsCache = (serverInfo, tools, options) => {
     syncToolsAsVectorEmbeddings(serverInfo.name, serverInfo.tools, {
         reportProgress: options?.reportEmbeddingProgress === true,
     }).catch(() => {
-        console.warn('[EMBED_SYNC_ERROR] Failed to sync tool embeddings');
+        logger.warn('[EMBED_SYNC_ERROR] Failed to sync tool embeddings');
     });
 };
 const updateServerPromptsCache = (serverInfo, prompts) => {
@@ -550,7 +564,7 @@ const updateServerResourcesCache = (serverInfo, resources) => {
     serverInfo.resources = resources.map(normalizeResourceForCache);
 };
 const logListChangedRefreshError = (listType) => {
-    console.warn(`Failed to refresh ${listType} list after upstream notification`);
+    logger.warn(`Failed to refresh ${listType} list after upstream notification`);
 };
 const createUpstreamMcpClient = (name, getServerInfo) => {
     return new Client({
@@ -661,7 +675,7 @@ export const cleanupAllServers = () => {
             }
         }
         catch (error) {
-            console.warn('Error closing server', { serverName: serverInfo.name, error });
+            logger.warn('Error closing server', { serverName: serverInfo.name, error });
         }
     }
     serverInfos = [];
@@ -920,9 +934,7 @@ export const createTransportFromConfig = async (name, conf) => {
     // Admin-owned servers may legitimately target internal services, so they
     // skip the internal-IP blocklist. allowInternal also governs per-hop
     // redirect validation in createRedirectValidatingFetch below.
-    const ownerUser = conf.owner
-        ? await getUserDao().findByUsername(conf.owner)
-        : null;
+    const ownerUser = conf.owner ? await getUserDao().findByUsername(conf.owner) : null;
     const allowInternal = !!ownerUser?.isAdmin;
     if (conf.url) {
         await assertSafeUrl(conf.url, { allowInternal });
@@ -943,7 +955,7 @@ export const createTransportFromConfig = async (name, conf) => {
             // Authorization value would override the valid access token and cause
             // 401 re-authorization loops.
             headers = stripAuthorizationHeader(headers);
-            console.log(`OAuth provider configured for server: ${name}`);
+            logger.log(`OAuth provider configured for server: ${name}`);
         }
         if (Object.keys(headers).length > 0) {
             options.requestInit = {
@@ -965,7 +977,7 @@ export const createTransportFromConfig = async (name, conf) => {
             options.authProvider = authProvider;
             // Drop static Authorization header when OAuth manages auth (see above).
             headers = stripAuthorizationHeader(headers);
-            console.log(`OAuth provider configured for server: ${name}`);
+            logger.log(`OAuth provider configured for server: ${name}`);
         }
         if (Object.keys(headers).length > 0) {
             options.eventSourceInit = {
@@ -1009,7 +1021,7 @@ export const createTransportFromConfig = async (name, conf) => {
         if (pendingReinstalls.has(name)) {
             resolvedArgs = injectRefreshFlag(conf.command, resolvedArgs);
             pendingReinstalls.delete(name);
-            console.log(`[${name}] Injected cache refresh flags for reinstall`);
+            logger.log(`[${name}] Injected cache refresh flags for reinstall`);
         }
         const { command: finalCommand, args: finalArgs } = wrapWithProxychains(name, conf.command, resolvedArgs, conf.proxy);
         // Create STDIO transport with potentially wrapped command
@@ -1022,10 +1034,10 @@ export const createTransportFromConfig = async (name, conf) => {
         });
         if (transport.stderr) {
             observeStdioStderr(transport, transport.stderr, (message) => {
-                console.log('Upstream server stderr', {
+                logger.log('Upstream server stderr', JSON.stringify({
                     serverName: name,
                     message,
-                });
+                }));
             });
         }
     }
@@ -1057,7 +1069,7 @@ const callToolWithReconnect = async (serverInfo, toolParams, options, maxRetries
             const isStreamableHttp = transport instanceof StreamableHTTPClientTransport;
             const isSSE = transport instanceof SSEClientTransport;
             if (attempt < maxRetries && transport && ((isStreamableHttp && isHttp40xError) || isSSE)) {
-                console.warn(`${isHttp40xError ? 'HTTP 40x error' : 'error'} detected for ${isStreamableHttp ? 'StreamableHTTP' : 'SSE'} server ${serverInfo.name}${isolated ? ` (isolated session ${isolated.sessionId})` : ''}, attempting reconnection (attempt ${attempt + 1}/${maxRetries + 1})`);
+                logger.warn(`${isHttp40xError ? 'HTTP 40x error' : 'error'} detected for ${isStreamableHttp ? 'StreamableHTTP' : 'SSE'} server ${serverInfo.name}${isolated ? ` (isolated session ${isolated.sessionId})` : ''}, attempting reconnection (attempt ${attempt + 1}/${maxRetries + 1})`);
                 try {
                     const server = await getServerDao().findById(serverInfo.name);
                     if (!server) {
@@ -1074,11 +1086,15 @@ const callToolWithReconnect = async (serverInfo, toolParams, options, maxRetries
                         try {
                             client.close();
                         }
-                        catch { /* empty */ }
+                        catch {
+                            /* empty */
+                        }
                         try {
                             transport.close();
                         }
-                        catch { /* empty */ }
+                        catch {
+                            /* empty */
+                        }
                         setSessionIsolatedClient(isolated.sessionId, serverInfo.name, newClient, newTransport);
                     }
                     else {
@@ -1090,11 +1106,15 @@ const callToolWithReconnect = async (serverInfo, toolParams, options, maxRetries
                         try {
                             serverInfo.client?.close();
                         }
-                        catch { /* empty */ }
+                        catch {
+                            /* empty */
+                        }
                         try {
                             transport.close();
                         }
-                        catch { /* empty */ }
+                        catch {
+                            /* empty */
+                        }
                         serverInfo.client = newClient;
                         serverInfo.transport = newTransport;
                         serverInfo.status = 'connected';
@@ -1108,18 +1128,18 @@ const callToolWithReconnect = async (serverInfo, toolParams, options, maxRetries
                         updateServerToolsCache(serverInfo, tools.tools);
                     }
                     catch (listToolsError) {
-                        console.warn('Failed to reload tools after reconnection', {
+                        logger.warn('Failed to reload tools after reconnection', {
                             serverName: serverInfo.name,
                             error: summarizeErrorForLogging(listToolsError),
                         });
                         // Continue anyway, as the connection might still work for the current tool
                     }
-                    console.log(`Successfully reconnected to server: ${serverInfo.name}`);
+                    logger.log(`Successfully reconnected to server: ${serverInfo.name}`);
                     // Continue to next attempt
                     continue;
                 }
                 catch (reconnectError) {
-                    console.error('Failed to reconnect to server', {
+                    logger.error('Failed to reconnect to server', {
                         serverName: serverInfo.name,
                         error: summarizeErrorForLogging(reconnectError),
                     });
@@ -1153,7 +1173,7 @@ const setupServerKeepAlive = (serverInfo, serverConfig) => {
                 throw error;
             }
         },
-    }).catch((error) => console.warn('Keepalive setup failed', {
+    }).catch((error) => logger.warn('Keepalive setup failed', {
         serverName: serverInfo.name,
         error: summarizeErrorForLogging(error),
     }));
@@ -1166,11 +1186,20 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
     try {
         for (const conf of allServers) {
             const { name } = conf;
+            // Names loaded from disk are not rejected (that would break existing
+            // configs on upgrade), but a strict client may drop the whole tools/list
+            // if the server name produces a non-conforming downstream tool name.
+            if (isInit) {
+                const nameValidation = validateServerName(name);
+                if (!nameValidation.valid) {
+                    logger.warn(`Server name '${name}' does not match the MCP tool-name charset (${nameValidation.message}); downstream tool names may be rejected by strict clients`);
+                }
+            }
             // Expand environment variables in all configuration values
             const expandedConf = replaceEnvVars(conf);
             // Skip disabled servers
             if (expandedConf.enabled === false) {
-                console.log(`Skipping disabled server: ${name}`);
+                logger.log(`Skipping disabled server: ${name}`);
                 nextServerInfos.push({
                     name,
                     owner: expandedConf.owner,
@@ -1210,7 +1239,7 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
                     enabled: true,
                     config: expandedConf,
                 });
-                console.log(`Skipping startup connect for on-demand server: ${name}`);
+                logger.log(`Skipping startup connect for on-demand server: ${name}`);
                 continue;
             }
             // Reuse this server's existing runtime state instead of reconnecting when:
@@ -1226,8 +1255,7 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
             const existingServer = existingServerInfos.find((s) => s.name === name);
             const isDifferentServer = Boolean(serverName) && serverName !== name;
             const hasInflightOAuthAuthorization = existingServer?.status === 'oauth_required' &&
-                Boolean(expandedConf.oauth?.pendingAuthorization?.state ||
-                    existingServer.oauth?.state);
+                Boolean(expandedConf.oauth?.pendingAuthorization?.state || existingServer.oauth?.state);
             if (existingServer &&
                 (isDifferentServer ||
                     (!serverName && (existingServer.status === 'connected' || hasInflightOAuthAuthorization)))) {
@@ -1238,7 +1266,7 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
                     sharedWithUsers: expandedConf.sharedWithUsers,
                     enabled: expandedConf.enabled === undefined ? true : expandedConf.enabled,
                 });
-                console.log(hasInflightOAuthAuthorization
+                logger.log(hasInflightOAuthAuthorization
                     ? `Server '${name}' has an in-flight OAuth authorization; preserving existing state.`
                     : `Server '${name}' is already connected.`);
                 continue;
@@ -1248,7 +1276,7 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
             if (expandedConf.type === 'openapi') {
                 // Handle OpenAPI type servers
                 if (!expandedConf.openapi?.url && !expandedConf.openapi?.schema) {
-                    console.warn(`Skipping OpenAPI server '${name}': missing OpenAPI specification URL or schema`);
+                    logger.warn(`Skipping OpenAPI server '${name}': missing OpenAPI specification URL or schema`);
                     nextServerInfos.push({
                         name,
                         owner: expandedConf.owner,
@@ -1301,7 +1329,7 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
                             });
                         },
                     });
-                    console.log(`Initializing OpenAPI server: ${name}...`);
+                    logger.log(`Initializing OpenAPI server: ${name}...`);
                     // Perform async initialization
                     await openApiClient.initialize();
                     // Convert OpenAPI tools to MCP tool format
@@ -1315,7 +1343,7 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
                     serverInfo.status = 'connected';
                     serverInfo.tools = mcpTools;
                     serverInfo.openApiClient = openApiClient;
-                    console.log(`Successfully initialized OpenAPI server: ${name} with ${mcpTools.length} tools`);
+                    logger.log(`Successfully initialized OpenAPI server: ${name} with ${mcpTools.length} tools`);
                     // Broadcast now that tools are loaded. OpenAPI servers expose tools
                     // only (no prompts/resources). See the standard-path note above.
                     broadcastToolListChanged();
@@ -1323,8 +1351,8 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
                     syncToolsAsVectorEmbeddings(name, mcpTools, {
                         reportProgress: options?.reportEmbeddingProgress === true && serverName === name,
                     }).catch((error) => {
-                        console.warn(`[EMBED_SYNC_ERROR] Failed to sync OpenAPI embeddings for server "${name}"`);
-                        console.error('Error syncing OpenAPI tool embeddings', {
+                        logger.warn(`[EMBED_SYNC_ERROR] Failed to sync OpenAPI embeddings for server "${name}"`);
+                        logger.error('Error syncing OpenAPI tool embeddings', {
                             serverName: name,
                             error: summarizeErrorForLogging(error),
                         });
@@ -1332,7 +1360,7 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
                     continue;
                 }
                 catch (error) {
-                    console.error('Failed to initialize OpenAPI server', {
+                    logger.error('Failed to initialize OpenAPI server', {
                         serverName: name,
                         error: summarizeErrorForLogging(error),
                     });
@@ -1391,18 +1419,18 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
             nextServerInfos.push(serverInfo);
             connectClientWithDiagnostics(client, transport, initRequestOptions || requestOptions)
                 .then(() => {
-                console.log(`Successfully connected client for server: ${name}`);
+                logger.log(`Successfully connected client for server: ${name}`);
                 const serverVersion = client.getServerVersion?.();
                 serverInfo.version = serverVersion?.version;
                 serverInfo.instructions = client.getInstructions?.();
                 const capabilities = client.getServerCapabilities();
-                console.log('Server capabilities', JSON.stringify(capabilities));
+                logger.log('Server capabilities', JSON.stringify(capabilities));
                 let dataError = null;
                 if (capabilities?.tools) {
                     client
                         .listTools({}, initRequestOptions || requestOptions)
                         .then((tools) => {
-                        console.log(`Successfully listed ${tools.tools.length} tools for server: ${name}`);
+                        logger.log(`Successfully listed ${tools.tools.length} tools for server: ${name}`);
                         updateServerToolsCache(serverInfo, tools.tools, {
                             reportEmbeddingProgress: options?.reportEmbeddingProgress === true && serverName === name,
                         });
@@ -1413,7 +1441,7 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
                         broadcastToolListChanged();
                     })
                         .catch((error) => {
-                        console.error('Failed to list tools for server', {
+                        logger.error('Failed to list tools for server', {
                             serverName: name,
                             error: summarizeErrorForLogging(error),
                         });
@@ -1424,12 +1452,12 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
                     client
                         .listPrompts({}, initRequestOptions || requestOptions)
                         .then((prompts) => {
-                        console.log(`Successfully listed ${prompts.prompts.length} prompts for server: ${name}`);
+                        logger.log(`Successfully listed ${prompts.prompts.length} prompts for server: ${name}`);
                         updateServerPromptsCache(serverInfo, prompts.prompts);
                         broadcastPromptListChanged();
                     })
                         .catch((error) => {
-                        console.error('Failed to list prompts for server', {
+                        logger.error('Failed to list prompts for server', {
                             serverName: name,
                             error: summarizeErrorForLogging(error),
                         });
@@ -1440,12 +1468,12 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
                     client
                         .listResources({}, initRequestOptions || requestOptions)
                         .then((resources) => {
-                        console.log(`Successfully listed ${resources.resources.length} resources for server: ${name}`);
+                        logger.log(`Successfully listed ${resources.resources.length} resources for server: ${name}`);
                         updateServerResourcesCache(serverInfo, resources.resources);
                         broadcastResourceListChanged();
                     })
                         .catch((error) => {
-                        console.error('Failed to list resources for server', {
+                        logger.error('Failed to list resources for server', {
                             serverName: name,
                             error: summarizeErrorForLogging(error),
                         });
@@ -1471,7 +1499,7 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
                 if (isOAuthError) {
                     // OAuth provider should have already set the status to 'oauth_required'
                     // and stored the authorization URL in serverInfo.oauth
-                    console.log(`OAuth authorization required for server ${name}. Status should be set to 'oauth_required'.`);
+                    logger.log(`OAuth authorization required for server ${name}. Status should be set to 'oauth_required'.`);
                     // Make sure status is set correctly
                     if (serverInfo.status !== 'oauth_required') {
                         serverInfo.status = 'oauth_required';
@@ -1479,7 +1507,7 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
                     serverInfo.error = null;
                 }
                 else {
-                    console.error('Failed to connect client for server', {
+                    logger.error('Failed to connect client for server', {
                         serverName: name,
                         error: summarizeErrorForLogging(error),
                     });
@@ -1489,7 +1517,7 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
                     setupServerKeepAlive(serverInfo, expandedConf);
                 }
             });
-            console.log(`Initialized client for server: ${name}`);
+            logger.log(`Initialized client for server: ${name}`);
         }
     }
     catch (error) {
@@ -1650,14 +1678,14 @@ export const getServerByOAuthState = (state) => {
  * This will close the existing connection and reinitialize the server
  */
 export const reconnectServer = async (serverName) => {
-    console.log(`Reconnecting server: ${serverName}`);
+    logger.log(`Reconnecting server: ${serverName}`);
     const serverInfo = getServerByName(serverName);
     if (!serverInfo) {
         throw new Error(`Server not found: ${serverName}`);
     }
     const serverConfig = await getServerDao().findById(serverName);
     if (serverConfig?.enabled === false) {
-        console.log(`Skipping reconnect for disabled server: ${serverName}`);
+        logger.log(`Skipping reconnect for disabled server: ${serverName}`);
         return;
     }
     // Close existing connection if any
@@ -1666,7 +1694,7 @@ export const reconnectServer = async (serverName) => {
             serverInfo.client.close();
         }
         catch (error) {
-            console.warn('Error closing client for server', { serverName, error });
+            logger.warn('Error closing client for server', { serverName, error });
         }
     }
     if (serverInfo.transport) {
@@ -1674,7 +1702,7 @@ export const reconnectServer = async (serverName) => {
             serverInfo.transport.close();
         }
         catch (error) {
-            console.warn('Error closing transport for server', { serverName, error });
+            logger.warn('Error closing transport for server', { serverName, error });
         }
     }
     if (serverInfo.keepAliveIntervalId) {
@@ -1683,13 +1711,13 @@ export const reconnectServer = async (serverName) => {
     }
     // Reinitialize the server
     await initializeClientsFromSettings(false, serverName);
-    console.log(`Successfully reconnected server: ${serverName}`);
+    logger.log(`Successfully reconnected server: ${serverName}`);
 };
 // Reinstall server: clear package cache and reconnect.
 // For npx: deletes ~/.npm/_npx before reconnect (--ignore-existing removed in npm 7+).
 // For uvx: schedules --refresh flag injection on next spawn via pendingReinstalls Set.
 export const reinstallServer = async (serverName) => {
-    console.log(`Reinstalling server: ${serverName}`);
+    logger.log(`Reinstalling server: ${serverName}`);
     const serverInfo = getServerByName(serverName);
     if (!serverInfo) {
         throw new Error(`Server not found: ${serverName}`);
@@ -1713,7 +1741,7 @@ export const reinstallServer = async (serverName) => {
         await clearRunnerCache(command);
         // Close and reconnect (will pick up pendingReinstalls flag for uvx)
         await reconnectServer(serverName);
-        console.log(`Successfully initiated reinstall for server: ${serverName}`);
+        logger.log(`Successfully initiated reinstall for server: ${serverName}`);
     }
     catch (error) {
         // Clean up pendingReinstalls on failure to avoid stale entries
@@ -1738,6 +1766,42 @@ const filterToolsByConfig = async (serverName, tools) => {
 const getServerByTool = (toolName) => {
     return getVisibleServerInfos().find((serverInfo) => serverInfo.enabled !== false && serverInfo.tools.some((tool) => tool.name === toolName));
 };
+/**
+ * Error thrown when the requested server/tool (or server/prompt) cannot be
+ * used by the current caller. `message` is the single safe text returned to
+ * the caller — intentionally identical whether the target is hidden from them
+ * or does not exist at all, so server/tool existence is never leaked through
+ * distinguishable authorization errors (see #1103). `reason` is an internal
+ * diagnostic recorded only in logs/activity, never surfaced to the caller.
+ */
+export class ToolUnavailableError extends Error {
+    constructor(message, reason) {
+        super(message);
+        this.reason = reason;
+        this.name = 'ToolUnavailableError';
+    }
+}
+/**
+ * Best-effort internal classification of why a qualified tool/prompt name was
+ * unavailable, for logs/activity only. The externally visible message must not
+ * vary with this result.
+ */
+const classifyUnavailableReason = (qualifiedName) => {
+    // Qualified names are `<server><separator><name>`; a bare name has no prefix.
+    const serverName = qualifiedName.split(getNameSeparator())[0];
+    const server = getServerByName(serverName);
+    if (!server) {
+        return 'server-or-name-not-found';
+    }
+    if (server.enabled === false) {
+        return 'server-disabled';
+    }
+    // Server exists and is enabled: distinguish a caller-hidden server from a
+    // tool/prompt that is missing (or group-filtered) on a visible server.
+    return getVisibleServerByName(serverName)
+        ? 'tool-or-prompt-not-found'
+        : 'server-hidden-from-caller';
+};
 // Add new server
 export const addServer = async (name, config) => {
     const server = { name, ...config };
@@ -1764,7 +1828,7 @@ export const removeServer = async (name) => {
         await removeServerToolEmbeddings(name);
     }
     catch (error) {
-        console.warn('Failed to remove embeddings for server', { serverName: name, error });
+        logger.warn('Failed to remove embeddings for server', { serverName: name, error });
     }
     serverInfos = serverInfos.filter((serverInfo) => serverInfo.name !== name);
     return { success: true, message: 'Server removed successfully' };
@@ -1793,7 +1857,7 @@ export const addOrUpdateServer = async (name, config, allowOverride = false) =>
         return { success: true, message: `Server ${action} successfully` };
     }
     catch (error) {
-        console.error('Failed to add/update server', { serverName: name, error });
+        logger.error('Failed to add/update server', { serverName: name, error });
         return { success: false, message: 'Failed to add/update server' };
     }
 };
@@ -1823,7 +1887,7 @@ const closeServerRuntime = (serverInfo) => {
     if (serverInfo.keepAliveIntervalId) {
         clearInterval(serverInfo.keepAliveIntervalId);
         serverInfo.keepAliveIntervalId = undefined;
-        console.log('Cleared MCP server keep-alive interval');
+        logger.log('Cleared MCP server keep-alive interval');
     }
     const candidateTransport = serverInfo.transport;
     const stdioPid = typeof candidateTransport?.pid === 'number' ? candidateTransport.pid : null;
@@ -1832,7 +1896,7 @@ const closeServerRuntime = (serverInfo) => {
             serverInfo.client.close();
         }
         catch {
-            console.warn('Error closing MCP client during runtime shutdown');
+            logger.warn('Error closing MCP client during runtime shutdown');
         }
         serverInfo.client = undefined;
     }
@@ -1841,14 +1905,14 @@ const closeServerRuntime = (serverInfo) => {
             serverInfo.transport.close();
         }
         catch {
-            console.warn('Error closing MCP transport during runtime shutdown');
+            logger.warn('Error closing MCP transport during runtime shutdown');
         }
         serverInfo.transport = undefined;
     }
     if (stdioPid) {
         killStdioProcessTree(serverInfo.name, stdioPid);
     }
-    console.log('Closed MCP server client and transport');
+    logger.log('Closed MCP server client and transport');
 };
 // Close server client and transport (keeps the entry in serverInfos; the next
 // initializeClientsFromSettings rebuild drops it if it is no longer configured).
@@ -1874,7 +1938,7 @@ const shutdownOnDemandServer = (serverInfo) => {
     // Close runtime (kills process) but intentionally keep tools/prompts/resources
     closeServerRuntime(serverInfo);
     serverInfo.status = 'disconnected';
-    console.log(`[${serverInfo.name}] On-demand server shut down after idle; ` +
+    logger.log(`[${serverInfo.name}] On-demand server shut down after idle; ` +
         `${serverInfo.tools.length} tools cached for next wake-up`);
 };
 /**
@@ -1932,7 +1996,7 @@ const ensureServerReady = async (serverInfo) => {
             return;
         }
         const name = rawConfig.name;
-        console.log(`[${name}] Cold-starting on-demand server…`);
+        logger.log(`[${name}] Cold-starting on-demand server…`);
         const transport = await createTransportFromConfig(name, expandedConf);
         const client = createUpstreamMcpClient(name, () => serverInfo);
         const serverRequestOptions = expandedConf.options || {};
@@ -1965,7 +2029,7 @@ const ensureServerReady = async (serverInfo) => {
                 broadcastToolListChanged();
             }
             catch (error) {
-                console.warn(`[${name}] Failed to list tools during wake`, {
+                logger.warn(`[${name}] Failed to list tools during wake`, {
                     error: summarizeErrorForLogging(error),
                 });
             }
@@ -1977,7 +2041,7 @@ const ensureServerReady = async (serverInfo) => {
                 updateServerPromptsCache(serverInfo, prompts.prompts);
             }
             catch (error) {
-                console.warn(`[${name}] Failed to list prompts during wake`, {
+                logger.warn(`[${name}] Failed to list prompts during wake`, {
                     error: summarizeErrorForLogging(error),
                 });
             }
@@ -1989,14 +2053,14 @@ const ensureServerReady = async (serverInfo) => {
                 updateServerResourcesCache(serverInfo, resources.resources);
             }
             catch (error) {
-                console.warn(`[${name}] Failed to list resources during wake`, {
+                logger.warn(`[${name}] Failed to list resources during wake`, {
                     error: summarizeErrorForLogging(error),
                 });
             }
         }
         // No-op for stdio transports; only SSE/streamable-http opt in via enableKeepAlive.
         setupServerKeepAlive(serverInfo, expandedConf);
-        console.log(`[${name}] On-demand server ready in ${Date.now() - spawnStart}ms` +
+        logger.log(`[${name}] On-demand server ready in ${Date.now() - spawnStart}ms` +
             ` (${toolCount} tools, ${promptCount} prompts, ${resourceCount} resources)`);
     })();
     serverInfo.spawningPromise = spawnPromise;
@@ -2035,16 +2099,16 @@ const primeOnDemandServers = () => {
         si.enabled !== false);
     if (targets.length === 0)
         return Promise.resolve();
-    console.log(`Priming ${targets.length} on-demand server(s) for tool discovery…`);
+    logger.log(`Priming ${targets.length} on-demand server(s) for tool discovery…`);
     return Promise.allSettled(targets.map(async (si) => {
         try {
             await ensureServerReady(si);
             // Sleep the child but keep the cached tool list visible to agents.
             shutdownOnDemandServer(si);
-            console.log('On-demand server primed and asleep');
+            logger.log('On-demand server primed and asleep');
         }
         catch (error) {
-            console.warn('Failed to prime on-demand server', {
+            logger.warn('Failed to prime on-demand server', {
                 error: summarizeErrorForLogging(error),
             });
         }
@@ -2073,7 +2137,28 @@ export const resetServerOAuthConnection = (name) => {
 // launched through a wrapper like `npx` / `npm exec`, the wrapper does not
 // forward signals to its descendants, so the real server process is left
 // running as an orphan. Walk the whole tree and force-kill it.
+//
+// When the process-lister tool tree-kill needs (`ps` on Linux) is missing —
+// e.g. slim Docker images without procps — tree-kill's internal spawn fails
+// with an unhandled 'error' event that would crash MCPHub. Fall back to
+// signaling just the direct child instead (issue #1072).
 function killStdioProcessTree(name, pid) {
+    const safeDirectKill = (signal) => {
+        try {
+            process.kill(pid, signal);
+        }
+        catch (err) {
+            const code = err.code;
+            if (code !== 'ESRCH') {
+                logger.warn('Failed to send signal to process', {
+                    serverName: name,
+                    pid,
+                    signal,
+                    err,
+                });
+            }
+        }
+    };
     const safeTreeKill = (signal) => {
         try {
             treeKill(pid, signal, (err) => {
@@ -2085,7 +2170,7 @@ function killStdioProcessTree(name, pid) {
                         // Pass the user-controlled `name` as a separate argument so a
                         // server named e.g. "%s" cannot inject format specifiers into the
                         // log line (CodeQL: use-of-externally-controlled-format-string).
-                        console.warn('Failed to send signal to process tree', {
+                        logger.warn('Failed to send signal to process tree', {
                             serverName: name,
                             pid,
                             signal,
@@ -2096,7 +2181,7 @@ function killStdioProcessTree(name, pid) {
             });
         }
         catch (err) {
-            console.warn('Failed to send signal to process tree', {
+            logger.warn('Failed to send signal to process tree', {
                 serverName: name,
                 pid,
                 signal,
@@ -2104,12 +2189,22 @@ function killStdioProcessTree(name, pid) {
             });
         }
     };
-    safeTreeKill('SIGTERM');
+    const safeKill = isProcessTreeKillAvailable()
+        ? safeTreeKill
+        : (signal) => {
+            logger.warn('Process lister unavailable, killing only the direct child process', {
+                serverName: name,
+                pid,
+                signal,
+            });
+            safeDirectKill(signal);
+        };
+    safeKill('SIGTERM');
     setTimeout(() => {
         if (!isProcessAlive(pid)) {
             return;
         }
-        safeTreeKill('SIGKILL');
+        safeKill('SIGKILL');
     }, STDIO_KILL_GRACE_PERIOD_MS);
 }
 function isProcessAlive(pid) {
@@ -2143,10 +2238,10 @@ export const toggleServerStatus = async (name, enabled) => {
             // Remove tool embeddings when server is disabled (for smart routing consistency)
             try {
                 await removeServerToolEmbeddings(name);
-                console.log(`Removed tool embeddings for disabled server: ${name}`);
+                logger.log(`Removed tool embeddings for disabled server: ${name}`);
             }
             catch (embeddingError) {
-                console.warn('Failed to remove embeddings for server', {
+                logger.warn('Failed to remove embeddings for server', {
                     serverName: name,
                     error: summarizeErrorForLogging(embeddingError),
                 });
@@ -2156,10 +2251,10 @@ export const toggleServerStatus = async (name, enabled) => {
             // If enabling, reconnect the server to restore connection and sync tool embeddings
             try {
                 await initializeClientsFromSettings(false, name);
-                console.log(`Re-enabled server ${name} and triggered tool embedding sync`);
+                logger.log(`Re-enabled server ${name} and triggered tool embedding sync`);
             }
             catch (reconnectError) {
-                console.warn('Failed to reconnect server during enable', {
+                logger.warn('Failed to reconnect server during enable', {
                     serverName: name,
                     error: summarizeErrorForLogging(reconnectError),
                 });
@@ -2168,7 +2263,7 @@ export const toggleServerStatus = async (name, enabled) => {
         return { success: true, message: `Server ${enabled ? 'enabled' : 'disabled'} successfully` };
     }
     catch (error) {
-        console.error('Failed to toggle server status', { serverName: name, error });
+        logger.error('Failed to toggle server status', { serverName: name, error });
         return { success: false, message: 'Failed to toggle server status' };
     }
 };
@@ -2310,7 +2405,7 @@ const projectToolForDownstream = (serverName, tool, appsRouteContext, serverConf
 export const handleListToolsRequest = async (_, extra) => {
     const sessionId = extra.sessionId || '';
     const group = getGroup(sessionId);
-    console.log(`Handling ListToolsRequest for group: ${group}`);
+    logger.log(`Handling ListToolsRequest for group: ${group}`);
     // Special handling for $smart group to return smart routing tools
     // Support both $smart and $smart/{group} patterns
     if (isSmartRoutingGroup(group)) {
@@ -2322,9 +2417,7 @@ export const handleListToolsRequest = async (_, extra) => {
     // so this list reflects the freshly cached tools instead of returning empty.
     // No wake is triggered from list itself; the prime handles that. See #1029.
     await Promise.allSettled(filteredServerInfos
-        .filter((si) => si.config?.startOnDemand === true &&
-        si.tools.length === 0 &&
-        si.spawningPromise)
+        .filter((si) => si.config?.startOnDemand === true && si.tools.length === 0 && si.spawningPromise)
         .map((si) => si.spawningPromise));
     const allTools = [];
     for (const serverInfo of filteredServerInfos) {
@@ -2354,7 +2447,7 @@ export const handleListToolsRequest = async (_, extra) => {
     };
 };
 export const handleCallToolRequest = async (request, extra) => {
-    console.log('Handling CallToolRequest for tool', summarizeToolRequestForLogging(request.params));
+    logger.log('Handling CallToolRequest for tool', summarizeToolRequestForLogging(request.params));
     const startTime = Date.now();
     const activityLogger = getActivityLoggingService();
     // Get request context for activity logging
@@ -2450,7 +2543,7 @@ export const handleCallToolRequest = async (request, extra) => {
                     serverInfo.tools.some((tool) => tool.name === toolName));
             }
             if (!targetServerInfo) {
-                throw new Error(`No available servers found with tool: ${toolName}`);
+                throw new ToolUnavailableError(`Tool not available: ${toolName}`, classifyUnavailableReason(toolName));
             }
             // If the target is an on-demand server that is not yet running, wake it up now.
             // Concurrent callers are serialised via ensureServerReady's singleton promise.
@@ -2467,7 +2560,7 @@ export const handleCallToolRequest = async (request, extra) => {
             // Check if the tool exists on the server
             const tool = targetTool ?? findToolOnServer(targetServerInfo, targetToolName, singleServerAppsRoute);
             if (!tool) {
-                throw new Error(`Tool '${toolName}' not found on server '${targetServerInfo.name}'`);
+                throw new ToolUnavailableError(`Tool not available: ${toolName}`, 'tool-not-found');
             }
             assertToolAvailableForRoute(tool, appsRouteContext);
             // Handle OpenAPI servers differently
@@ -2476,7 +2569,7 @@ export const handleCallToolRequest = async (request, extra) => {
                 const openApiClient = targetServerInfo.openApiClient;
                 // Use toolArgs if it has properties, otherwise fallback to request.params.arguments
                 const finalArgs = toolArgs && typeof toolArgs === 'object' ? toolArgs : {};
-                console.log('Invoking OpenAPI tool', {
+                logger.log('Invoking OpenAPI tool', {
                     toolName: targetToolName,
                     serverName: targetServerInfo.name,
                     arguments: summarizeArgumentsForLogging(finalArgs),
@@ -2514,7 +2607,7 @@ export const handleCallToolRequest = async (request, extra) => {
                     requestContent: finalArgs,
                     responseContent: result,
                 });
-                console.log('OpenAPI tool invocation result', {
+                logger.log('OpenAPI tool invocation result', {
                     serverName: targetServerInfo.name,
                     toolName: cleanToolName,
                     result: summarizeToolResultForLogging(result),
@@ -2559,7 +2652,7 @@ export const handleCallToolRequest = async (request, extra) => {
             }
             // Use toolArgs if it has properties, otherwise fallback to request.params.arguments
             const finalArgs = toolArgs && typeof toolArgs === 'object' ? toolArgs : {};
-            console.log('Invoking tool', {
+            logger.log('Invoking tool', {
                 toolName: targetToolName,
                 serverName: targetServerInfo.name,
                 arguments: summarizeArgumentsForLogging(finalArgs),
@@ -2576,7 +2669,7 @@ export const handleCallToolRequest = async (request, extra) => {
                 requestContent: finalArgs,
                 responseContent: result,
             });
-            console.log('Tool invocation result', {
+            logger.log('Tool invocation result', {
                 serverName: targetServerInfo.name,
                 toolName: cleanToolName,
                 result: summarizeToolResultForLogging(result),
@@ -2619,15 +2712,12 @@ export const handleCallToolRequest = async (request, extra) => {
             : undefined;
         const serverInfo = singleServerAppsRoute
             ? appsRouteContext.serverInfo
-            : (groupTool?.serverInfo ??
-                (lookupGroup ? undefined : getServerByTool(request.params.name)));
+            : (groupTool?.serverInfo ?? (lookupGroup ? undefined : getServerByTool(request.params.name)));
         const routeToolName = groupTool?.toolName ?? request.params.name;
         const tool = groupTool?.tool ??
-            (serverInfo
-                ? findToolOnServer(serverInfo, routeToolName, singleServerAppsRoute)
-                : undefined);
+            (serverInfo ? findToolOnServer(serverInfo, routeToolName, singleServerAppsRoute) : undefined);
         if (!serverInfo || !tool) {
-            throw new Error(`Server not found: ${request.params.name}`);
+            throw new ToolUnavailableError(`Tool not available: ${request.params.name}`, classifyUnavailableReason(request.params.name));
         }
         assertToolAvailableForRoute(tool, appsRouteContext);
         // Wake the on-demand server before invoking the tool. It may be asleep with
@@ -2643,7 +2733,7 @@ export const handleCallToolRequest = async (request, extra) => {
             const openApiClient = serverInfo.openApiClient;
             // Remove server prefix from tool name if present
             const cleanToolName = normalizeToolNameForServer(serverInfo.name, routeToolName);
-            console.log('Invoking OpenAPI tool', {
+            logger.log('Invoking OpenAPI tool', {
                 toolName: cleanToolName,
                 serverName: serverInfo.name,
                 arguments: summarizeArgumentsForLogging(request.params.arguments),
@@ -2680,7 +2770,7 @@ export const handleCallToolRequest = async (request, extra) => {
                 requestContent: finalArgs,
                 responseContent: result,
             });
-            console.log('OpenAPI tool invocation result', {
+            logger.log('OpenAPI tool invocation result', {
                 serverName: serverInfo.name,
                 toolName: cleanToolName,
                 result: summarizeToolResultForLogging(result),
@@ -2731,7 +2821,7 @@ export const handleCallToolRequest = async (request, extra) => {
             requestContent: request.params.arguments,
             responseContent: result,
         });
-        console.log('Tool call result', {
+        logger.log('Tool call result', {
             serverName: serverInfo.name,
             toolName: cleanToolName,
             result: summarizeToolResultForLogging(result),
@@ -2761,7 +2851,13 @@ export const handleCallToolRequest = async (request, extra) => {
         });
     }
     catch (error) {
-        console.error('Error handling CallToolRequest', summarizeErrorForLogging(error));
+        const unavailable = error instanceof ToolUnavailableError
+            ? { message: error.message, reason: error.reason }
+            : undefined;
+        logger.error('Error handling CallToolRequest', {
+            ...summarizeErrorForLogging(error),
+            ...(unavailable ? { reason: unavailable.reason } : {}),
+        });
         // Log error activity
         const duration = Date.now() - startTime;
         await settleHostedIfNeeded({
@@ -2784,9 +2880,15 @@ export const handleCallToolRequest = async (request, extra) => {
             keyId,
             keyName,
             sourceIp,
-            errorMessage: formatErrorForLogging(error),
+            // The reason is an internal diagnostic; the caller-facing message stays
+            // identical for hidden and nonexistent targets.
+            errorMessage: unavailable
+                ? `${unavailable.message} (reason: ${unavailable.reason})`
+                : formatErrorForLogging(error),
         });
-        const safeErrorText = formatErrorForLogging(error);
+        // For unavailable-target errors, surface exactly the unified message (no
+        // error-class name, no reason) so hidden vs nonexistent is indistinguishable.
+        const safeErrorText = unavailable ? unavailable.message : formatErrorForLogging(error);
         return {
             content: [
                 {
@@ -2842,7 +2944,7 @@ export const handleGetPromptRequest = async (request, extra) => {
                 serverInfo.prompts.find((prompt) => prompt.name === name));
         }
         if (!server) {
-            throw new Error(`Server not found: ${name}`);
+            throw new ToolUnavailableError(`Prompt not available: ${name}`, classifyUnavailableReason(name));
         }
         // Remove server prefix from prompt name if present
         const separator = getNameSeparator();
@@ -2855,20 +2957,27 @@ export const handleGetPromptRequest = async (request, extra) => {
             arguments: promptArgs,
         };
         // Log the final promptParams
-        console.log('Calling getPrompt with params', {
+        logger.log('Calling getPrompt with params', {
             name: cleanPromptName || '',
             arguments: summarizeArgumentsForLogging(promptArgs),
         });
         const prompt = await server.client?.getPrompt(promptParams);
-        console.log('Received prompt', summarizePromptForLogging(prompt));
+        logger.log('Received prompt', summarizePromptForLogging(prompt));
         if (!prompt) {
             throw new Error(`Prompt not found: ${cleanPromptName}`);
         }
         return prompt;
     }
     catch (error) {
-        console.error('Error handling GetPromptRequest', summarizeErrorForLogging(error));
-        const safeErrorText = formatErrorForLogging(error);
+        const unavailable = error instanceof ToolUnavailableError
+            ? { message: error.message, reason: error.reason }
+            : undefined;
+        logger.error('Error handling GetPromptRequest', {
+            ...summarizeErrorForLogging(error),
+            ...(unavailable ? { reason: unavailable.reason } : {}),
+        });
+        // Surface exactly the unified message for unavailable targets (see #1103).
+        const safeErrorText = unavailable ? unavailable.message : formatErrorForLogging(error);
         return {
             content: [
                 {
@@ -2884,7 +2993,7 @@ export const handleListPromptsRequest = async (_, extra) => {
     const sessionId = extra.sessionId || '';
     const group = getGroup(sessionId);
     const lookupGroup = getGroupLookupName(group);
-    console.log(`Handling ListPromptsRequest for group: ${group}`);
+    logger.log(`Handling ListPromptsRequest for group: ${group}`);
     // Start with built-in prompts (only enabled ones)
     const builtinPrompts = await getBuiltinPromptDao().findEnabled();
     const allPrompts = builtinPrompts.map((bp) => normalizePromptForList({
@@ -2928,7 +3037,7 @@ export const handleListResourcesRequest = async (_, extra) => {
     const sessionId = extra.sessionId || '';
     const group = getGroup(sessionId);
     const lookupGroup = getGroupLookupName(group);
-    console.log(`Handling ListResourcesRequest for group: ${group}`);
+    logger.log(`Handling ListResourcesRequest for group: ${group}`);
     const appsRouteContext = await getMcpAppsRouteContext(sessionId, group);
     // Start with built-in resources (only enabled ones)
     const builtinResources = await getBuiltinResourceDao().findEnabled();
@@ -2973,7 +3082,7 @@ export const handleListResourceTemplatesRequest = async (_, extra) => {
     const sessionId = extra.sessionId || '';
     const group = getGroup(sessionId);
     const lookupGroup = getGroupLookupName(group);
-    console.log(`Handling ListResourceTemplatesRequest for group: ${group}`);
+    logger.log(`Handling ListResourceTemplatesRequest for group: ${group}`);
     const appsRouteContext = await getMcpAppsRouteContext(sessionId, group);
     const { filteredServerInfos, serverConfigsByName } = await getFilteredServerInfosForGroup(lookupGroup, {
         requireClient: true,
@@ -3076,7 +3185,7 @@ export const handleReadResourceRequest = async (request, extra) => {
             };
     }
     catch (error) {
-        console.error('Error handling ReadResourceRequest', summarizeErrorForLogging(error));
+        logger.error('Error handling ReadResourceRequest', summarizeErrorForLogging(error));
         const safeErrorText = formatErrorForLogging(error);
         return {
             contents: [