@samanhappy/mcphub 1.0.35 → 1.0.37

package/dist/services/mcpService.js

@@ -1,3 +1,9 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { canAccessGroupRoute } from '../utils/groupAccess.js';
+import { PrincipalRuntimeService } from './principalRuntimeService.js';
+import { UserContextService } from './userContextService.js';
+import { deleteCredentialBindings, missingCredentialError } from './credentialBindingService.js';
+import { CredentialBindingError, hasCredentialTemplate, validateCredentialTemplate } from '../utils/credentialTemplate.js';
 import os from 'os';
 import path from 'path';
 import fs from 'fs';
@@ -519,8 +525,14 @@ const normalizeResourceForCache = (resource) => {
 };
 // Store all server information
 let serverInfos = [];
+// Bumped by every initializeClientsFromSettings pass. Connections are started
+// fire-and-forget and settle long after the pass that started them returned, so
+// a callback needs to know whether a later pass has run before it writes its
+// result anywhere. See the `liveServerInfo` helper in that function.
+let initGeneration = 0;
+const principalServerScope = new AsyncLocalStorage();
 const getVisibleServerInfos = () => {
-    return getDataService().filterData(serverInfos);
+    return getDataService().filterData(principalServerScope.getStore() ?? serverInfos);
 };
 const getVisibleServerByName = (name) => {
     return getVisibleServerInfos().find((serverInfo) => serverInfo.name === name);
@@ -656,7 +668,8 @@ export const summarizeServerConnections = (infos) => {
     };
 };
 export const getServerConnectionStats = () => {
-    return summarizeServerConnections(serverInfos);
+    // Personal definitions have no shared connection whose readiness can be checked.
+    return summarizeServerConnections(serverInfos.filter((info) => !hasCredentialTemplate(info.config)));
 };
 // Returns true if all enabled servers are connected
 export const connected = () => {
@@ -665,6 +678,7 @@ export const connected = () => {
 };
 // Global cleanup function to close all connections
 export const cleanupAllServers = () => {
+    principalRuntimes.invalidate();
     for (const serverInfo of serverInfos) {
         try {
             if (serverInfo.client) {
@@ -927,8 +941,10 @@ export const createTransportFromConfig = async (name, conf) => {
     let transport;
     const env = {
         ...process.env,
-        ...replaceEnvVars(conf.env || {}),
+        ...(hasCredentialTemplate(conf) ? conf.env : replaceEnvVars(conf.env || {})),
     };
+    // The encryption key belongs only to the hub, never to a child process.
+    delete env.MCPHUB_CREDENTIAL_ENCRYPTION_KEY;
     // SSRF guard: block URL/streamable-http transports from reaching
     // loopback / RFC1918 / link-local targets (e.g. cloud metadata service).
     // Admin-owned servers may legitimately target internal services, so they
@@ -941,11 +957,11 @@ export const createTransportFromConfig = async (name, conf) => {
     }
     if (conf.type === 'streamable-http') {
         const options = {};
-        let headers = conf.headers ? replaceEnvVars(conf.headers, env) : {};
+        let headers = conf.headers ? (hasCredentialTemplate(conf) ? conf.headers : replaceEnvVars(conf.headers, env)) : {};
         const baseFetch = createAbortIsolatingFetch(createFetchWithProxy(getProxyConfigFromEnv(env)));
         const requestAwareFetch = createRedirectValidatingFetch(createRequestContextAwareFetch(baseFetch, conf.passthroughHeaders), allowInternal);
         // Create OAuth provider if configured - SDK will handle authentication automatically
-        const authProvider = await createOAuthProvider(name, conf);
+        const authProvider = hasCredentialTemplate(conf) ? undefined : await createOAuthProvider(name, conf);
         if (authProvider) {
             options.authProvider = authProvider;
             // When the OAuth provider is active, strip any static Authorization
@@ -968,11 +984,11 @@ export const createTransportFromConfig = async (name, conf) => {
     else if (conf.url) {
         // SSE transport
         const options = {};
-        let headers = conf.headers ? replaceEnvVars(conf.headers, env) : {};
+        let headers = conf.headers ? (hasCredentialTemplate(conf) ? conf.headers : replaceEnvVars(conf.headers, env)) : {};
         const baseFetch = createAbortIsolatingFetch(createFetchWithProxy(getProxyConfigFromEnv(env)));
         const requestAwareFetch = createRedirectValidatingFetch(createRequestContextAwareFetch(baseFetch, conf.passthroughHeaders), allowInternal);
         // Create OAuth provider if configured - SDK will handle authentication automatically
-        const authProvider = await createOAuthProvider(name, conf);
+        const authProvider = hasCredentialTemplate(conf) ? undefined : await createOAuthProvider(name, conf);
         if (authProvider) {
             options.authProvider = authProvider;
             // Drop static Authorization header when OAuth manages auth (see above).
@@ -1032,7 +1048,10 @@ export const createTransportFromConfig = async (name, conf) => {
             env: env,
             stderr: 'pipe',
         });
-        if (transport.stderr) {
+        if (transport.stderr && hasCredentialTemplate(conf)) {
+            transport.stderr.on('data', () => undefined); // Personal upstream diagnostics can contain raw credentials.
+        }
+        else if (transport.stderr) {
             observeStdioStderr(transport, transport.stderr, (message) => {
                 logger.log('Upstream server stderr', JSON.stringify({
                     serverName: name,
@@ -1056,6 +1075,9 @@ const callToolWithReconnect = async (serverInfo, toolParams, options, maxRetries
     if (!client) {
         throw new Error(`Client not found for server: ${serverInfo.name}`);
     }
+    if (hasCredentialTemplate(serverInfo.config)) {
+        return client.callTool(toolParams, undefined, options || {});
+    }
     for (let attempt = 0; attempt <= maxRetries; attempt++) {
         try {
             const result = await client.callTool(toolParams, undefined, options || {});
@@ -1183,6 +1205,7 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
     const allServers = await getServerDao().findAll();
     const existingServerInfos = serverInfos;
     const nextServerInfos = [];
+    const generation = ++initGeneration;
     try {
         for (const conf of allServers) {
             const { name } = conf;
@@ -1215,6 +1238,16 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
                 });
                 continue;
             }
+            if (hasCredentialTemplate(expandedConf)) {
+                validateCredentialTemplate(expandedConf);
+                nextServerInfos.push({
+                    name, owner: expandedConf.owner, visibility: expandedConf.visibility,
+                    sharedWithUsers: expandedConf.sharedWithUsers, enabled: true,
+                    status: 'disconnected', error: null, tools: [], prompts: [], resources: [],
+                    createTime: Date.now(), config: expandedConf,
+                });
+                continue;
+            }
             // On-demand stdio servers: skip startup connect; spawn lazily on first
             // tool call. startOnDemand is a stdio-only optimisation - HTTP/SSE and
             // OpenAPI servers have no deferred child process, so they connect normally.
@@ -1222,23 +1255,25 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
             // connection) so the tool list stays visible to agents even while sleeping.
             if (expandedConf.startOnDemand === true && isStdioServer(expandedConf)) {
                 const existingOnDemand = existingServerInfos.find((s) => s.name === name);
-                nextServerInfos.push({
-                    // Carry over cached tools/prompts/resources if the server was previously connected
-                    ...(existingOnDemand ?? {
-                        name,
-                        status: 'disconnected',
-                        error: null,
-                        tools: [],
-                        prompts: [],
-                        resources: [],
-                        createTime: Date.now(),
-                    }),
+                // Active calls, spawn promises and idle callbacks must share the same
+                // runtime object across reloads, not copies of its mutable state.
+                const onDemandInfo = existingOnDemand ?? {
+                    name,
+                    status: 'disconnected',
+                    error: null,
+                    tools: [],
+                    prompts: [],
+                    resources: [],
+                    createTime: Date.now(),
+                };
+                Object.assign(onDemandInfo, {
                     owner: expandedConf.owner,
                     visibility: expandedConf.visibility,
                     sharedWithUsers: expandedConf.sharedWithUsers,
                     enabled: true,
                     config: expandedConf,
                 });
+                nextServerInfos.push(onDemandInfo);
                 logger.log(`Skipping startup connect for on-demand server: ${name}`);
                 continue;
             }
@@ -1371,7 +1406,36 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
                 }
             }
             else {
-                transport = await createTransportFromConfig(name, expandedConf);
+                try {
+                    transport = await createTransportFromConfig(name, expandedConf);
+                }
+                catch (error) {
+                    // Fail this server only. Letting the error escape the loop hits the
+                    // outer catch, which restores `serverInfos` to its previous value -
+                    // empty at startup - so a single malformed config (an unparseable URL
+                    // rejected by assertSafeUrl, say) would drop every server from
+                    // getServersInfo and leave the whole fleet reporting 'connecting'.
+                    // The OpenAPI branch above already isolates its failures this way.
+                    logger.error('Failed to create transport for server', {
+                        serverName: name,
+                        error: summarizeErrorForLogging(error),
+                    });
+                    nextServerInfos.push({
+                        name,
+                        owner: expandedConf.owner,
+                        visibility: expandedConf.visibility,
+                        sharedWithUsers: expandedConf.sharedWithUsers,
+                        status: 'disconnected',
+                        error: `Failed to create transport: ${formatErrorForLogging(error)}`,
+                        tools: [],
+                        prompts: [],
+                        resources: [],
+                        createTime: Date.now(),
+                        enabled: true,
+                        config: expandedConf,
+                    });
+                    continue;
+                }
             }
             const serverInfoRef = {};
             const client = createUpstreamMcpClient(name, () => serverInfoRef.current);
@@ -1417,12 +1481,39 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
                 };
             }
             nextServerInfos.push(serverInfo);
+            // The connect below settles long after this loop returns. If another
+            // initialization pass has run by then, `serverInfo` may no longer be the
+            // object `serverInfos` holds for this server - even when the reuse guard
+            // "preserved" it, because preservation spreads the entry into a fresh
+            // object. Writing the result into a replaced object leaves the server
+            // stuck on 'connecting' for good while the log reports a successful
+            // connect and a full tool list.
+            //
+            // While this pass is still the newest one, `serverInfo` is the entry that
+            // will be published, so it is the right target even before the swap. Once
+            // a later pass has run, resolve the live entry by name and only apply the
+            // result if it still owns this client - which is exactly the case where
+            // the later pass preserved this server rather than reconnecting it.
+            const liveServerInfo = () => {
+                if (generation === initGeneration)
+                    return serverInfo;
+                const current = serverInfos.find((si) => si.name === name);
+                return current && current.client === client ? current : undefined;
+            };
             connectClientWithDiagnostics(client, transport, initRequestOptions || requestOptions)
                 .then(() => {
+                const info = liveServerInfo();
+                if (!info) {
+                    // Nothing will ever read this connection again, so shut it down
+                    // rather than leaving its stdio child process running.
+                    logger.log(`Discarding superseded connection result for server: ${name}`);
+                    closeServerRuntime(serverInfo);
+                    return;
+                }
                 logger.log(`Successfully connected client for server: ${name}`);
                 const serverVersion = client.getServerVersion?.();
-                serverInfo.version = serverVersion?.version;
-                serverInfo.instructions = client.getInstructions?.();
+                info.version = serverVersion?.version;
+                info.instructions = client.getInstructions?.();
                 const capabilities = client.getServerCapabilities();
                 logger.log('Server capabilities', JSON.stringify(capabilities));
                 let dataError = null;
@@ -1430,8 +1521,11 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
                     client
                         .listTools({}, initRequestOptions || requestOptions)
                         .then((tools) => {
+                        const target = liveServerInfo();
+                        if (!target)
+                            return;
                         logger.log(`Successfully listed ${tools.tools.length} tools for server: ${name}`);
-                        updateServerToolsCache(serverInfo, tools.tools, {
+                        updateServerToolsCache(target, tools.tools, {
                             reportEmbeddingProgress: options?.reportEmbeddingProgress === true && serverName === name,
                         });
                         // Broadcast only after tools are actually loaded into the cache.
@@ -1452,8 +1546,11 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
                     client
                         .listPrompts({}, initRequestOptions || requestOptions)
                         .then((prompts) => {
+                        const target = liveServerInfo();
+                        if (!target)
+                            return;
                         logger.log(`Successfully listed ${prompts.prompts.length} prompts for server: ${name}`);
-                        updateServerPromptsCache(serverInfo, prompts.prompts);
+                        updateServerPromptsCache(target, prompts.prompts);
                         broadcastPromptListChanged();
                     })
                         .catch((error) => {
@@ -1468,8 +1565,11 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
                     client
                         .listResources({}, initRequestOptions || requestOptions)
                         .then((resources) => {
+                        const target = liveServerInfo();
+                        if (!target)
+                            return;
                         logger.log(`Successfully listed ${resources.resources.length} resources for server: ${name}`);
-                        updateServerResourcesCache(serverInfo, resources.resources);
+                        updateServerResourcesCache(target, resources.resources);
                         broadcastResourceListChanged();
                     })
                         .catch((error) => {
@@ -1481,18 +1581,24 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
                     });
                 }
                 if (!dataError) {
-                    serverInfo.status = 'connected';
-                    serverInfo.error = null;
+                    info.status = 'connected';
+                    info.error = null;
                     // Set up keep-alive ping for SSE connections via shared service
-                    setupServerKeepAlive(serverInfo, expandedConf);
+                    setupServerKeepAlive(info, expandedConf);
                 }
                 else {
-                    serverInfo.status = 'disconnected';
-                    serverInfo.error = `Failed to list data: ${formatErrorForLogging(dataError)}`;
-                    setupServerKeepAlive(serverInfo, expandedConf);
+                    info.status = 'disconnected';
+                    info.error = `Failed to list data: ${formatErrorForLogging(dataError)}`;
+                    setupServerKeepAlive(info, expandedConf);
                 }
             })
                 .catch(async (error) => {
+                const info = liveServerInfo();
+                if (!info) {
+                    logger.log(`Discarding superseded connection failure for server: ${name}`);
+                    closeServerRuntime(serverInfo);
+                    return;
+                }
                 // Check if this is an OAuth authorization error
                 const isOAuthError = error?.message?.includes('OAuth authorization required') ||
                     error?.message?.includes('Authorization required');
@@ -1501,10 +1607,10 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
                     // and stored the authorization URL in serverInfo.oauth
                     logger.log(`OAuth authorization required for server ${name}. Status should be set to 'oauth_required'.`);
                     // Make sure status is set correctly
-                    if (serverInfo.status !== 'oauth_required') {
-                        serverInfo.status = 'oauth_required';
+                    if (info.status !== 'oauth_required') {
+                        info.status = 'oauth_required';
                     }
-                    serverInfo.error = null;
+                    info.error = null;
                 }
                 else {
                     logger.error('Failed to connect client for server', {
@@ -1512,9 +1618,9 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
                         error: summarizeErrorForLogging(error),
                     });
                     // Other connection errors
-                    serverInfo.status = 'disconnected';
-                    serverInfo.error = `Failed to connect: ${formatErrorForLogging(error)}`;
-                    setupServerKeepAlive(serverInfo, expandedConf);
+                    info.status = 'disconnected';
+                    info.error = `Failed to connect: ${formatErrorForLogging(error)}`;
+                    setupServerKeepAlive(info, expandedConf);
                 }
             });
             logger.log(`Initialized client for server: ${name}`);
@@ -1596,16 +1702,47 @@ export const getServersInfo = async (page, limit, user) => {
     const filterServerInfos = shouldApplyUserFilter && dataService.filterData
         ? dataService.filterData(filteredServerInfos, user)
         : filteredServerInfos;
-    const infos = filterServerInfos
+    const principal = (user ||
+        UserContextService.getInstance().getCurrentUser());
+    const presentedInfos = await Promise.all(filterServerInfos.map(async (info) => {
+        if (!hasCredentialTemplate(info.config) ||
+            info.enabled === false ||
+            !principal?.username ||
+            principal.credentialEligible === false)
+            return info;
+        try {
+            const lease = await principalRuntimes.acquire(info.name, principal);
+            try {
+                return { ...lease.info, config: info.config };
+            }
+            finally {
+                lease.release();
+            }
+        }
+        catch (error) {
+            return {
+                ...info,
+                error: error instanceof CredentialBindingError
+                    ? error.message
+                    : 'Unable to resolve personal credentials',
+            };
+        }
+    }));
+    const infos = presentedInfos
         .filter((info) => requestedServerNames.has(info.name)) // Only include requested servers
         .map(({ name, version, instructions, owner, visibility, status, tools, prompts, resources, createTime, error, oauth, }) => {
         const serverConfig = allServers.find((server) => server.name === name);
         const enabled = serverConfig ? serverConfig.enabled !== false : true;
         const resolvedType = inferServerType(serverConfig);
         const oauthConnected = Boolean(serverConfig?.oauth?.accessToken || serverConfig?.oauth?.refreshToken);
-        // Add enabled status and custom description to each tool
+        // Add enabled status and custom description to each tool.
+        // toggleTool stores under whatever key the caller passed (prefixed,
+        // as the dashboard sends, or bare, as a direct API call may) with no
+        // normalization — check both so the dashboard reflects a disable set
+        // either way instead of always showing enabled:true for one of them.
         const toolsWithEnabled = tools.map((tool) => {
-            const toolConfig = serverConfig?.tools?.[tool.name];
+            const bareToolName = normalizeToolNameForServer(name, tool.name);
+            const toolConfig = serverConfig?.tools?.[tool.name] ?? serverConfig?.tools?.[bareToolName];
             return buildToolWithDescriptionMetadata(tool, toolConfig);
         });
         const promptsWithEnabled = prompts.map((prompt) => {
@@ -1653,6 +1790,7 @@ export const getServersInfo = async (page, limit, user) => {
             config: resolvedType || serverConfig?.description || serverConfig?.command
                 ? {
                     ...(resolvedType ? { type: resolvedType } : {}),
+                    ...(hasCredentialTemplate(serverConfig) ? { credentialTemplate: validateCredentialTemplate(serverConfig) } : {}),
                     ...(serverConfig?.description ? { description: serverConfig.description } : {}),
                     // Expose command so the frontend can determine if reinstall is
                     // supported (npx/uvx only). This is not a secret — it's the
@@ -1679,6 +1817,7 @@ export const getServerByOAuthState = (state) => {
  */
 export const reconnectServer = async (serverName) => {
     logger.log(`Reconnecting server: ${serverName}`);
+    principalRuntimes.invalidate({ serverName });
     const serverInfo = getServerByName(serverName);
     if (!serverInfo) {
         throw new Error(`Server not found: ${serverName}`);
@@ -1757,7 +1896,11 @@ const filterToolsByConfig = async (serverName, tools) => {
         return tools;
     }
     return tools.filter((tool) => {
-        const toolConfig = serverConfig.tools?.[tool.name];
+        // toggleTool stores the disable under whatever key string the caller used
+        // (bare upstream name or server-prefixed name, never normalized) — check
+        // both, same as findToolOnServer's execution-time gate.
+        const bareToolName = normalizeToolNameForServer(serverName, tool.name);
+        const toolConfig = serverConfig.tools?.[tool.name] ?? serverConfig.tools?.[bareToolName];
         // If tool is not in config, it's enabled by default
         return toolConfig?.enabled !== false;
     });
@@ -1804,6 +1947,7 @@ const classifyUnavailableReason = (qualifiedName) => {
 };
 // Add new server
 export const addServer = async (name, config) => {
+    validateCredentialTemplate(config);
     const server = { name, ...config };
     const result = await getServerDao().create(server);
     if (result) {
@@ -1824,6 +1968,7 @@ export const removeServer = async (name) => {
     // via npx / npm exec outlives the request and becomes an unkillable orphan
     // that leaks memory until the container is restarted.
     closeServer(name);
+    await deleteCredentialBindings({ serverName: name });
     try {
         await removeServerToolEmbeddings(name);
     }
@@ -1836,6 +1981,7 @@ export const removeServer = async (name) => {
 // Add or update server (supports overriding existing servers for MCPB)
 export const addOrUpdateServer = async (name, config, allowOverride = false) => {
     try {
+        validateCredentialTemplate(config);
         const exists = await getServerDao().exists(name);
         if (exists && !allowOverride) {
             return { success: false, message: 'Server name already exists' };
@@ -1883,7 +2029,14 @@ function checkAuthError(result) {
         }
     }
 }
+const clearIdleShutdown = (serverInfo) => {
+    if (serverInfo.idleTimeoutId) {
+        clearTimeout(serverInfo.idleTimeoutId);
+        serverInfo.idleTimeoutId = undefined;
+    }
+};
 const closeServerRuntime = (serverInfo) => {
+    clearIdleShutdown(serverInfo);
     if (serverInfo.keepAliveIntervalId) {
         clearInterval(serverInfo.keepAliveIntervalId);
         serverInfo.keepAliveIntervalId = undefined;
@@ -1917,6 +2070,7 @@ const closeServerRuntime = (serverInfo) => {
 // Close server client and transport (keeps the entry in serverInfos; the next
 // initializeClientsFromSettings rebuild drops it if it is no longer configured).
 export function closeServer(name) {
+    principalRuntimes.invalidate({ serverName: name });
     const serverInfo = serverInfos.find((serverInfo) => serverInfo.name === name);
     if (serverInfo) {
         closeServerRuntime(serverInfo);
@@ -1931,10 +2085,9 @@ export function closeServer(name) {
  * the server offers and trigger a cold-start on the next tool call.
  */
 const shutdownOnDemandServer = (serverInfo) => {
-    if (serverInfo.idleTimeoutId) {
-        clearTimeout(serverInfo.idleTimeoutId);
-        serverInfo.idleTimeoutId = undefined;
-    }
+    // Discovery priming may finish while a tool call is using the same child.
+    if (serverInfo.activeToolCalls)
+        return;
     // Close runtime (kills process) but intentionally keep tools/prompts/resources
     closeServerRuntime(serverInfo);
     serverInfo.status = 'disconnected';
@@ -1942,14 +2095,17 @@ const shutdownOnDemandServer = (serverInfo) => {
         `${serverInfo.tools.length} tools cached for next wake-up`);
 };
 /**
- * Resets (or starts) the idle-shutdown timer for an on-demand server.
- * Call this after every successful tool invocation.
+ * Starts the idle period once the last active call has finished.
  */
 const scheduleIdleShutdown = (serverInfo) => {
-    if (!serverInfo.config?.startOnDemand)
+    clearIdleShutdown(serverInfo);
+    if (!serverInfo.config?.startOnDemand ||
+        !isStdioServer(serverInfo.config) ||
+        hasCredentialTemplate(serverInfo.config) ||
+        serverInfo.status !== 'connected' ||
+        !serverInfo.client ||
+        serverInfo.activeToolCalls) {
         return;
-    if (serverInfo.idleTimeoutId) {
-        clearTimeout(serverInfo.idleTimeoutId);
     }
     const idleMs = serverInfo.config.idleTimeoutMs ?? 300000; // default 5 minutes
     serverInfo.idleTimeoutId = setTimeout(() => {
@@ -1958,6 +2114,19 @@ const scheduleIdleShutdown = (serverInfo) => {
         }
     }, idleMs);
 };
+const beginOnDemandToolCall = (serverInfo) => {
+    if (!serverInfo.config?.startOnDemand ||
+        !isStdioServer(serverInfo.config) ||
+        hasCredentialTemplate(serverInfo.config)) {
+        return undefined;
+    }
+    clearIdleShutdown(serverInfo);
+    serverInfo.activeToolCalls = (serverInfo.activeToolCalls ?? 0) + 1;
+    return () => {
+        serverInfo.activeToolCalls = serverInfo.activeToolCalls - 1;
+        scheduleIdleShutdown(serverInfo);
+    };
+};
 /**
  * Ensures an on-demand server is connected before a tool call proceeds.
  *
@@ -2094,6 +2263,7 @@ const isStdioServer = (conf) => !!conf && (conf.type === 'stdio' || (!conf.type
  */
 const primeOnDemandServers = () => {
     const targets = serverInfos.filter((si) => si.config?.startOnDemand === true &&
+        !hasCredentialTemplate(si.config) &&
         isStdioServer(si.config) &&
         si.tools.length === 0 &&
         si.enabled !== false);
@@ -2103,9 +2273,9 @@ const primeOnDemandServers = () => {
     return Promise.allSettled(targets.map(async (si) => {
         try {
             await ensureServerReady(si);
-            // Sleep the child but keep the cached tool list visible to agents.
+            // Sleep the child unless a tool call is using it; keep the cached tool list.
             shutdownOnDemandServer(si);
-            logger.log('On-demand server primed and asleep');
+            logger.log('On-demand server tool cache primed');
         }
         catch (error) {
             logger.warn('Failed to prime on-demand server', {
@@ -2322,20 +2492,54 @@ const resolveNameFromGroup = (name, serverName, serverConfig) => {
     return replacePrefixedServerName(name, getExposedServerName(serverName, serverConfig), serverName);
 };
 const findToolOnServer = (serverInfo, toolName, allowRawName) => {
-    return serverInfo.tools.find((tool) => tool.name === toolName ||
+    const tool = serverInfo.tools.find((tool) => tool.name === toolName ||
         (allowRawName && normalizeToolNameForServer(serverInfo.name, tool.name) === toolName));
+    if (!tool) {
+        return undefined;
+    }
+    // A tool disabled via POST /api/servers/:server/tools/:tool/toggle must be
+    // unresolvable for execution, not just hidden from tools/list — otherwise a
+    // caller who already knows the tool name can invoke it regardless of the
+    // disabled flag.
+    //
+    // The runtime tool cache (serverInfo.tools, built by normalizeToolForCache)
+    // never carries an `enabled` field — that field only exists on the
+    // *projection* built for the dashboard/API (buildToolWithDescriptionMetadata),
+    // which is a different object. So the persisted per-tool config must be
+    // consulted directly here.
+    //
+    // toggleTool (serverController.ts) stores `tools[toolName] = ...` using
+    // whatever string the caller passed as :toolName, with no normalization.
+    // The dashboard sends the already-prefixed `tool.name`, matching what
+    // getServersInfo's toolsWithEnabled already reads — but any other caller
+    // (REST API used directly, scripts, docs examples) can just as validly
+    // pass the bare upstream name, which then never matches a prefixed-only
+    // lookup. Check both so a disable takes effect regardless of which form
+    // was used to set it.
+    const bareToolName = normalizeToolNameForServer(serverInfo.name, tool.name);
+    const toolConfig = serverInfo.config?.tools?.[tool.name] ?? serverInfo.config?.tools?.[bareToolName];
+    if (toolConfig && toolConfig.enabled === false) {
+        return undefined;
+    }
+    return tool;
 };
 const assertToolAvailableForRoute = (tool, appsRouteContext) => {
     if (isAppOnlyTool(tool) && !appsRouteContext.enabled) {
         throw new Error(`Tool '${tool.name}' is only available to MCP Apps`);
     }
 };
-const resolveToolInGroup = async (group, toolName, allowRawName) => {
+const resolveToolInGroup = async (group, toolName) => {
     const lookupGroup = getGroupLookupName(group);
     if (!lookupGroup) {
         return undefined;
     }
     const { filteredServerInfos, serverConfigsByName } = await getFilteredServerInfosForGroup(lookupGroup);
+    // Accept raw names only on single-upstream routes, even without client
+    // capabilities after session rebuild. Count configured servers as well so
+    // a disabled or disconnected peer cannot make a group appear unambiguous.
+    const allowRawName = !isSmartRoutingGroup(group) &&
+        serverConfigsByName.size <= 1 &&
+        filteredServerInfos.length === 1;
     for (const serverInfo of filteredServerInfos) {
         // A disconnected on-demand server may still have a cached tool list from a
         // previous wake-up; allow it through so it can be selected and woken by the
@@ -2402,7 +2606,7 @@ const projectToolForDownstream = (serverName, tool, appsRouteContext, serverConf
         name: projectNameForGroup(projectedTool.name, serverName, serverConfig),
     };
 };
-export const handleListToolsRequest = async (_, extra) => {
+const handleListToolsRequestImpl = async (_, extra) => {
     const sessionId = extra.sessionId || '';
     const group = getGroup(sessionId);
     logger.log(`Handling ListToolsRequest for group: ${group}`);
@@ -2446,7 +2650,7 @@ export const handleListToolsRequest = async (_, extra) => {
         tools: allTools,
     };
 };
-export const handleCallToolRequest = async (request, extra) => {
+const handleCallToolRequestImpl = async (request, extra) => {
     logger.log('Handling CallToolRequest for tool', summarizeToolRequestForLogging(request.params));
     const startTime = Date.now();
     const activityLogger = getActivityLoggingService();
@@ -2478,6 +2682,7 @@ export const handleCallToolRequest = async (request, extra) => {
     const keyName = bearerKeyContext.keyName || extra?.keyName || undefined;
     const sourceIp = requestContextService.getRequestContext()?.remoteAddress || undefined;
     let hostedReservation = null;
+    let releaseOnDemandToolCall;
     const reserveHostedIfNeeded = async (serverName, toolName) => {
         const hostedAuth = requestContextService.getHostedAuthContext();
         assertHostedToolAllowed(hostedAuth, serverName, toolName);
@@ -2527,7 +2732,7 @@ export const handleCallToolRequest = async (request, extra) => {
                 targetServerInfo = getVisibleServerByName(extra.server);
             }
             else if (getGroupLookupName(group)) {
-                const groupTool = await resolveToolInGroup(group, toolName, false);
+                const groupTool = await resolveToolInGroup(group, toolName);
                 if (groupTool) {
                     targetServerInfo = groupTool.serverInfo;
                     targetToolName = groupTool.toolName;
@@ -2547,6 +2752,7 @@ export const handleCallToolRequest = async (request, extra) => {
             }
             // If the target is an on-demand server that is not yet running, wake it up now.
             // Concurrent callers are serialised via ensureServerReady's singleton promise.
+            releaseOnDemandToolCall = beginOnDemandToolCall(targetServerInfo);
             if (targetServerInfo.config?.startOnDemand && targetServerInfo.status !== 'connected') {
                 await ensureServerReady(targetServerInfo);
                 // Re-read status from the mutated serverInfo after async spawn
@@ -2626,6 +2832,7 @@ export const handleCallToolRequest = async (request, extra) => {
                     keyId,
                     keyName,
                     sourceIp,
+                    hasCredentialTemplate: hasCredentialTemplate(targetServerInfo.config),
                 });
                 return await maybeCompressToolResult({
                     content: [
@@ -2643,7 +2850,7 @@ export const handleCallToolRequest = async (request, extra) => {
             // Call the tool on the target server (MCP servers)
             // For servers with perSessionClient: true, use a per-session dedicated client
             let isolatedCtx;
-            if (targetServerInfo.config?.perSessionClient && sessionId) {
+            if (targetServerInfo.config?.perSessionClient && !hasCredentialTemplate(targetServerInfo.config) && sessionId) {
                 const isolated = await getOrCreateIsolatedClient(sessionId, targetServerInfo);
                 isolatedCtx = { sessionId, client: isolated.client, transport: isolated.transport };
             }
@@ -2674,8 +2881,6 @@ export const handleCallToolRequest = async (request, extra) => {
                 toolName: cleanToolName,
                 result: summarizeToolResultForLogging(result),
             });
-            // Reset idle-shutdown timer for on-demand servers after each successful call
-            scheduleIdleShutdown(targetServerInfo);
             // Log successful activity
             const duration = Date.now() - startTime;
             await activityLogger.logToolCall({
@@ -2690,6 +2895,7 @@ export const handleCallToolRequest = async (request, extra) => {
                 keyId,
                 keyName,
                 sourceIp,
+                hasCredentialTemplate: hasCredentialTemplate(targetServerInfo.config),
                 errorMessage: result.isError ? 'Tool returned error response' : undefined,
             });
             return await maybeCompressToolResult(result, {
@@ -2708,7 +2914,7 @@ export const handleCallToolRequest = async (request, extra) => {
         // (assertToolAvailableForRoute below still gates on appsRouteContext.enabled).
         const singleServerAppsRoute = !!appsRouteContext.serverInfo;
         const groupTool = !singleServerAppsRoute && lookupGroup
-            ? await resolveToolInGroup(lookupGroup, request.params.name, false)
+            ? await resolveToolInGroup(group, request.params.name)
             : undefined;
         const serverInfo = singleServerAppsRoute
             ? appsRouteContext.serverInfo
@@ -2723,6 +2929,7 @@ export const handleCallToolRequest = async (request, extra) => {
         // Wake the on-demand server before invoking the tool. It may be asleep with
         // a cached tool list (visible above) but no live client. Mirrors the
         // $smart call_tool path. See #1029.
+        releaseOnDemandToolCall = beginOnDemandToolCall(serverInfo);
         if (serverInfo.config?.startOnDemand && serverInfo.status !== 'connected') {
             await ensureServerReady(serverInfo);
         }
@@ -2789,6 +2996,7 @@ export const handleCallToolRequest = async (request, extra) => {
                 keyId,
                 keyName,
                 sourceIp,
+                hasCredentialTemplate: hasCredentialTemplate(serverInfo.config),
             });
             return await maybeCompressToolResult({
                 content: [
@@ -2806,7 +3014,7 @@ export const handleCallToolRequest = async (request, extra) => {
         // Handle MCP servers
         // For servers with perSessionClient: true, use a per-session dedicated client
         let isolatedCtx;
-        if (serverInfo.config?.perSessionClient && sessionId) {
+        if (serverInfo.config?.perSessionClient && !hasCredentialTemplate(serverInfo.config) && sessionId) {
             const isolated = await getOrCreateIsolatedClient(sessionId, serverInfo);
             isolatedCtx = { sessionId, client: isolated.client, transport: isolated.transport };
         }
@@ -2826,8 +3034,6 @@ export const handleCallToolRequest = async (request, extra) => {
             toolName: cleanToolName,
             result: summarizeToolResultForLogging(result),
         });
-        // Reset idle-shutdown timer for on-demand servers after each successful call
-        scheduleIdleShutdown(serverInfo);
         // Log successful activity
         const duration = Date.now() - startTime;
         await activityLogger.logToolCall({
@@ -2842,6 +3048,7 @@ export const handleCallToolRequest = async (request, extra) => {
             keyId,
             keyName,
             sourceIp,
+            hasCredentialTemplate: hasCredentialTemplate(serverInfo.config),
             errorMessage: result.isError ? 'Tool returned error response' : undefined,
         });
         return await maybeCompressToolResult(result, {
@@ -2880,6 +3087,7 @@ export const handleCallToolRequest = async (request, extra) => {
             keyId,
             keyName,
             sourceIp,
+            hasCredentialTemplate: hasCredentialTemplate(serverInfo?.config),
             // The reason is an internal diagnostic; the caller-facing message stays
             // identical for hidden and nonexistent targets.
             errorMessage: unavailable
@@ -2899,8 +3107,11 @@ export const handleCallToolRequest = async (request, extra) => {
             isError: true,
         };
     }
+    finally {
+        releaseOnDemandToolCall?.();
+    }
 };
-export const handleGetPromptRequest = async (request, extra) => {
+const handleGetPromptRequestImpl = async (request, extra) => {
     try {
         const { name, arguments: promptArgs } = request.params;
         const sessionId = extra?.sessionId || '';
@@ -2989,7 +3200,7 @@ export const handleGetPromptRequest = async (request, extra) => {
         };
     }
 };
-export const handleListPromptsRequest = async (_, extra) => {
+const handleListPromptsRequestImpl = async (_, extra) => {
     const sessionId = extra.sessionId || '';
     const group = getGroup(sessionId);
     const lookupGroup = getGroupLookupName(group);
@@ -3033,7 +3244,7 @@ export const handleListPromptsRequest = async (_, extra) => {
         prompts: allPrompts,
     };
 };
-export const handleListResourcesRequest = async (_, extra) => {
+const handleListResourcesRequestImpl = async (_, extra) => {
     const sessionId = extra.sessionId || '';
     const group = getGroup(sessionId);
     const lookupGroup = getGroupLookupName(group);
@@ -3078,7 +3289,7 @@ export const handleListResourcesRequest = async (_, extra) => {
         resources: allResources,
     };
 };
-export const handleListResourceTemplatesRequest = async (_, extra) => {
+const handleListResourceTemplatesRequestImpl = async (_, extra) => {
     const sessionId = extra.sessionId || '';
     const group = getGroup(sessionId);
     const lookupGroup = getGroupLookupName(group);
@@ -3101,7 +3312,7 @@ export const handleListResourceTemplatesRequest = async (_, extra) => {
         resourceTemplates: results.flatMap((result) => result.status === 'fulfilled' ? result.value : []),
     };
 };
-export const handleReadResourceRequest = async (request, extra) => {
+const handleReadResourceRequestImpl = async (request, extra) => {
     try {
         const { uri } = request.params;
         const sessionId = extra.sessionId || '';
@@ -3198,6 +3409,197 @@ export const handleReadResourceRequest = async (request, extra) => {
         };
     }
 };
+// Personal runtimes never enter serverInfos, config exports, or shared embedding caches.
+const createPrincipalRuntime = async (name, resolvedConfig) => {
+    const info = {
+        name,
+        owner: resolvedConfig.owner,
+        visibility: resolvedConfig.visibility,
+        sharedWithUsers: resolvedConfig.sharedWithUsers,
+        enabled: true,
+        config: resolvedConfig,
+        options: resolvedConfig.options,
+        status: 'connecting',
+        error: null,
+        tools: [],
+        prompts: [],
+        resources: [],
+        createTime: Date.now(),
+    };
+    const safeMethods = new Set([
+        'callTool',
+        'getPrompt',
+        'readResource',
+        'listTools',
+        'listPrompts',
+        'listResources',
+        'listResourceTemplates',
+    ]);
+    const protectClient = (client) => new Proxy(client, {
+        get(target, property) {
+            const value = Reflect.get(target, property);
+            if (typeof value !== 'function')
+                return value;
+            if (!safeMethods.has(String(property)))
+                return value.bind(target);
+            return async (...args) => {
+                try {
+                    return await value.apply(target, args);
+                }
+                catch {
+                    info.status = 'disconnected';
+                    throw new CredentialBindingError(`Personal credential request failed for '${name}'. Check your binding in Credentials.`);
+                }
+            };
+        },
+    });
+    try {
+        if (resolvedConfig.type === 'openapi') {
+            const client = new OpenAPIClient(resolvedConfig);
+            await client.initialize();
+            info.openApiClient = protectClient(client);
+            info.tools = client
+                .getTools()
+                .map((tool) => ({
+                ...tool,
+                name: `${name}${getNameSeparator()}${tool.name}`,
+                inputSchema: cleanInputSchema(tool.inputSchema),
+            }));
+        }
+        else {
+            const transport = await createTransportFromConfig(name, resolvedConfig);
+            const client = new Client({ name: `mcp-client-${name}`, version: '1.0.0' }, {
+                capabilities: MCP_APPS_CAPABILITIES,
+                jsonSchemaValidator: new ResilientJsonSchemaValidator(),
+            });
+            info.transport = transport;
+            info.client = protectClient(client);
+            await client.connect(transport, resolvedConfig.options || {});
+            const capabilities = client.getServerCapabilities();
+            if (capabilities?.tools)
+                info.tools = (await client.listTools({}, resolvedConfig.options)).tools.map((tool) => normalizeToolForCache(name, tool));
+            if (capabilities?.prompts)
+                info.prompts = (await client.listPrompts({}, resolvedConfig.options)).prompts.map((prompt) => normalizePromptForCache(name, prompt));
+            if (capabilities?.resources)
+                info.resources = (await client.listResources({}, resolvedConfig.options)).resources.map(normalizeResourceForCache);
+            info.version = client.getServerVersion()?.version;
+            client.onclose = () => {
+                info.status = 'disconnected';
+            };
+        }
+        info.status = 'connected';
+        return info;
+    }
+    catch {
+        closeServerRuntime(info);
+        throw new CredentialBindingError(`Unable to connect '${name}' with your personal credentials. Check your binding in Credentials.`);
+    }
+};
+const principalRuntimes = new PrincipalRuntimeService(createPrincipalRuntime, closeServerRuntime);
+const withPrincipalServers = (handler, operation) => async (request, extra) => {
+    if (!serverInfos.some((info) => hasCredentialTemplate(info.config)))
+        return handler(request, extra);
+    // Built-in content does not require an upstream credential.
+    if (operation === 'prompt') {
+        const builtin = await getBuiltinPromptDao().findByName(request.params?.name);
+        if (builtin && builtin.enabled !== false)
+            return handler(request, extra);
+    }
+    else if (operation === 'resource') {
+        const builtin = await getBuiltinResourceDao().findByUri(request.params?.uri);
+        if (builtin && builtin.enabled !== false)
+            return handler(request, extra);
+    }
+    const group = RequestContextService.getInstance().getGroupContext() ||
+        extra?.group ||
+        getGroup(extra?.sessionId || '') ||
+        undefined;
+    const { filteredServerInfos: candidates, serverConfigsByName } = await getFilteredServerInfosForGroup(getGroupLookupName(group));
+    const requestedName = ['call_tool', 'describe_tool'].includes(request?.params?.name)
+        ? request.params.arguments?.toolName
+        : request?.params?.name;
+    const target = candidates.find((info) => {
+        const exposedName = getExposedServerName(info.name, serverConfigsByName.get(info.name));
+        return (extra?.server === info.name ||
+            (typeof requestedName === 'string' &&
+                requestedName.startsWith(`${exposedName}${getNameSeparator()}`)));
+    });
+    // A call to a known target must not spawn or keep unrelated personal children alive.
+    const selected = target && (operation === 'tool' || operation === 'prompt') ? [target] : candidates;
+    const templated = selected.filter((info) => hasCredentialTemplate(info.config));
+    if (!templated.length)
+        return handler(request, extra);
+    const user = UserContextService.getInstance().getCurrentUser();
+    const releases = [];
+    const scoped = new Map(serverInfos.map((info) => [info.name, info]));
+    const failures = new Map();
+    try {
+        await Promise.all(templated.map(async (info) => {
+            try {
+                if (!user?.username ||
+                    user.credentialEligible === false ||
+                    RequestContextService.getInstance().getKeyKindContext() === 'system')
+                    throw missingCredentialError(info.name);
+                const lease = await principalRuntimes.acquire(info.name, user);
+                releases.push(lease.release);
+                scoped.set(info.name, lease.info);
+            }
+            catch (error) {
+                failures.set(info.name, error instanceof CredentialBindingError
+                    ? error
+                    : new CredentialBindingError('Unable to resolve personal credentials'));
+            }
+        }));
+        const requiredTarget = target ||
+            (candidates.length === 1 && operation !== 'list' && requestedName !== 'search_tools'
+                ? templated[0]
+                : undefined);
+        const failure = requiredTarget ? failures.get(requiredTarget.name) : undefined;
+        if (failure) {
+            if (operation === 'resource')
+                return {
+                    contents: [
+                        { uri: request.params?.uri || '', mimeType: 'text/plain', text: failure.message },
+                    ],
+                };
+            return { content: [{ type: 'text', text: failure.message }], isError: true };
+        }
+        // Dashboard/OpenAPI callers may address a tool by its raw name plus server.
+        let resolvedRequest = request;
+        if (operation === 'tool' &&
+            extra?.server &&
+            hasCredentialTemplate(scoped.get(extra.server)?.config)) {
+            const prefix = `${extra.server}${getNameSeparator()}`;
+            if (typeof requestedName === 'string' && !requestedName.startsWith(prefix)) {
+                resolvedRequest =
+                    request.params.name === 'call_tool'
+                        ? {
+                            ...request,
+                            params: {
+                                ...request.params,
+                                arguments: {
+                                    ...request.params.arguments,
+                                    toolName: `${prefix}${requestedName}`,
+                                },
+                            },
+                        }
+                        : { ...request, params: { ...request.params, name: `${prefix}${requestedName}` } };
+            }
+        }
+        return await principalServerScope.run([...scoped.values()], () => handler(resolvedRequest, extra));
+    }
+    finally {
+        for (const release of releases)
+            release();
+    }
+};
+export const handleListToolsRequest = withPrincipalServers(handleListToolsRequestImpl, 'list');
+export const handleCallToolRequest = withPrincipalServers(handleCallToolRequestImpl, 'tool');
+export const handleGetPromptRequest = withPrincipalServers(handleGetPromptRequestImpl, 'prompt');
+export const handleListPromptsRequest = withPrincipalServers(handleListPromptsRequestImpl, 'list');
+export const handleListResourcesRequest = withPrincipalServers(handleListResourcesRequestImpl, 'list');
+export const handleListResourceTemplatesRequest = withPrincipalServers(handleListResourceTemplatesRequestImpl, 'list');
+export const handleReadResourceRequest = withPrincipalServers(handleReadResourceRequestImpl, 'resource');
 export const createMcpServer = (name, version, options) => {
     const normalizedOptions = typeof options === 'string' ? { group: options } : (options ?? {});
     // Determine server name based on routing type
@@ -3229,13 +3631,8 @@ export const createMcpServer = (name, version, options) => {
     return server;
 };
 export const getFilteredServerInfosForGroup = async (group, options) => {
-    // Resolve group server configs. We look up the group directly from the DAO
-    // rather than going through getServerConfigsInGroup (which calls getAllGroups
-    // and applies filterData on groups). Groups don't carry a visibility field,
-    // so admin-owned groups would be filtered out for non-admin users even though
-    // bearer-key auth already authorized access and individual servers inside the
-    // group may be public. Server-level filterData below still enforces per-server
-    // visibility. Fix for #914.
+    // Resolve raw groups so legacy routing remains compatible, then enforce explicit visibility.
+    let matchedGroup = false;
     let serverConfigs = [];
     if (group) {
         const groupDao = getGroupDao();
@@ -3247,6 +3644,10 @@ export const getFilteredServerInfosForGroup = async (group, options) => {
             }
         }
         if (foundGroup) {
+            matchedGroup = true;
+            if (!canAccessGroupRoute(foundGroup)) {
+                return { filteredServerInfos: [], serverConfigsByName: new Map() };
+            }
             serverConfigs = normalizeGroupServers(foundGroup.servers || []);
         }
     }
@@ -3262,7 +3663,7 @@ export const getFilteredServerInfosForGroup = async (group, options) => {
             filteredServerInfos.push(serverInfo);
             continue;
         }
-        if (serverNamesInGroup.size === 0) {
+        if (!matchedGroup) {
             if (serverInfo.name === group) {
                 filteredServerInfos.push(serverInfo);
             }