@samanhappy/mcphub 1.1.7 → 1.1.9

package/dist/services/mcpService.js

@@ -1,19 +1,22 @@
+import { isSafePassthroughHeader } from '../utils/passthroughHeaders.js';
 import { observeToolCall, setMetricsServer } from './metricsService.js';
 import { hasPersonalOAuth, PersonalOAuthContext, personalOAuthContexts, personalAuthorizationRequired, } from './personalOAuthService.js';
 import { preserveListFreshness, combineListFreshness, remainingListTtl, } from '../utils/listFreshness.js';
 import { expandServerConfig, getServerEnvironment } from './serverConfigEnvironment.js';
 import { getMcpRequestGroup } from '../utils/mcpRequestGroup.js';
 import { LegacyMcpClient } from '../clients/legacyMcpClient.js';
+import { getElicitationCapabilities, installElicitationRelay, isElicitationClientClosed, withElicitation, } from './elicitationService.js';
 import { LEGACY_PROTOCOL_VERSIONS } from '../utils/mcpProtocol.js';
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { createHash } from 'node:crypto';
 import { canAccessGroupRoute } from '../utils/groupAccess.js';
 import { canServeToolRequests } from '../utils/serverAvailability.js';
 import { assertToolCallArgumentsSafe, isToolCallGuardEnabled, ToolCallBlockedError, } from '../middlewares/toolCallGuard.js';
+import { applyHiddenParams, findToolConfig, removeHiddenArguments, } from '../utils/toolConfig.js';
 import { PrincipalRuntimeService } from './principalRuntimeService.js';
 import { UserContextService } from './userContextService.js';
 import { deleteCredentialBindings, missingCredentialError } from './credentialBindingService.js';
-import { CredentialBindingError, hasCredentialTemplate, hasPersonalAuthentication, resolveCredentialArguments, validateCredentialTemplate, } from '../utils/credentialTemplate.js';
+import { CredentialBindingError, hasCredentialTemplate, hasPersonalAuthentication, resolveCredentialArguments, hasUrlCredentialSlots, validateCredentialTemplate, } from '../utils/credentialTemplate.js';
 import os from 'os';
 import path from 'path';
 import fs from 'fs';
@@ -353,12 +356,12 @@ const setSessionIsolatedClient = (sessionId, serverName, client, transport) => {
  * Used when the server has `perSessionClient: true` in its config.
  * Uses a creation lock to prevent duplicate connections from concurrent calls.
  */
-const getOrCreateIsolatedClient = async (sessionId, serverInfo) => {
+const getOrCreateIsolatedClient = async (sessionId, serverInfo, downstream) => {
     // Quick check without lock — already exists
     const sessionClients = sessionIsolatedClients.get(sessionId);
     if (sessionClients) {
         const existing = sessionClients.get(serverInfo.name);
-        if (existing) {
+        if (existing && !isElicitationClientClosed(existing.client)) {
             return existing;
         }
     }
@@ -373,7 +376,7 @@ const getOrCreateIsolatedClient = async (sessionId, serverInfo) => {
         const sessionClientsAfterLock = sessionIsolatedClients.get(sessionId);
         if (sessionClientsAfterLock) {
             const existing = sessionClientsAfterLock.get(serverInfo.name);
-            if (existing) {
+            if (existing && !isElicitationClientClosed(existing.client)) {
                 return existing;
             }
         }
@@ -386,7 +389,7 @@ const getOrCreateIsolatedClient = async (sessionId, serverInfo) => {
         }
         const reservedClients = sessionIsolatedClients.get(sessionId);
         const transport = await createTransportFromConfig(serverInfo.name, serverConfig);
-        const client = createUpstreamMcpClient(serverInfo.name, () => serverInfo);
+        const client = createUpstreamMcpClient(serverInfo.name, () => serverInfo, downstream);
         try {
             await connectClientWithDiagnostics(client, transport, serverInfo.options || {});
         }
@@ -505,6 +508,8 @@ const hasDescriptionOverride = (config) => {
 const resolveDescriptionOverride = (defaultDescription, config) => {
     return hasDescriptionOverride(config) ? config?.description || '' : defaultDescription || '';
 };
+// The dashboard/API projection keeps the full input schema (the dashboard
+// lists every parameter to choose what to hide) and reports the configured list.
 const buildToolWithDescriptionMetadata = (tool, toolConfig) => {
     const upstreamDescription = tool.description || '';
     return {
@@ -512,13 +517,15 @@ const buildToolWithDescriptionMetadata = (tool, toolConfig) => {
         description: resolveDescriptionOverride(upstreamDescription, toolConfig),
         defaultDescription: upstreamDescription,
         hasDescriptionOverride: hasDescriptionOverride(toolConfig),
+        ...(toolConfig?.hiddenParams?.length ? { hiddenParams: toolConfig.hiddenParams } : {}),
         enabled: toolConfig?.enabled !== false,
     };
 };
-// Apply any per-tool description override before the tool text is embedded for
-// Smart Routing search. Deliberately narrower than buildToolWithDescriptionMetadata:
-// only `description` (plus the hasDescriptionOverride marker used by the
-// tool-set hash) is touched, so serverInfo.tools (built by
+// Apply any per-tool description override and hidden parameters before the tool
+// text is embedded for Smart Routing search. Deliberately narrower than
+// buildToolWithDescriptionMetadata: only `description` (plus the
+// hasDescriptionOverride marker used by the tool-set hash) and `inputSchema`
+// are touched, so serverInfo.tools (built by
 // normalizeToolForCache/updateServerToolsCache) still never carries `enabled` --
 // preserving the existing invariant that execution gating reads the persisted
 // config directly, not this projection. Without this step, overrides only
@@ -529,16 +536,18 @@ const applyDescriptionOverridesForEmbedding = async (serverName, tools) => {
     if (!serverConfig?.tools) {
         return tools;
     }
+    // A partial sync passes only some tools; the key rule needs all of them
+    const runtimeNames = (getServerByName(serverName)?.tools ?? tools).map((tool) => tool.name);
     return tools.map((tool) => {
-        const bareToolName = normalizeToolNameForServer(serverName, tool.name);
-        const toolConfig = serverConfig.tools?.[tool.name] ?? serverConfig.tools?.[bareToolName];
+        const toolConfig = findToolConfig(serverConfig.tools, serverName, tool.name, runtimeNames);
+        const visibleTool = applyHiddenParams(tool, toolConfig);
         return hasDescriptionOverride(toolConfig)
             ? {
-                ...tool,
+                ...visibleTool,
                 description: resolveDescriptionOverride(tool.description, toolConfig),
                 hasDescriptionOverride: true,
             }
-            : tool;
+            : visibleTool;
     });
 };
 // Tail of the embedding tasks queued per server. A per-user connect and a
@@ -832,12 +841,13 @@ const updateServerResourcesCache = (serverInfo, resources) => {
 const logListChangedRefreshError = (listType) => {
     logger.warn(`Failed to refresh ${listType} list after upstream notification`);
 };
-const createUpstreamMcpClient = (name, getServerInfo) => {
-    return new LegacyMcpClient({
+const createUpstreamMcpClient = (name, getServerInfo, downstream) => {
+    const elicitation = getElicitationCapabilities(downstream);
+    const client = new LegacyMcpClient({
         name: `mcp-client-${name}`,
         version: '1.0.0',
     }, {
-        capabilities: MCP_APPS_CAPABILITIES,
+        capabilities: { ...MCP_APPS_CAPABILITIES, ...(elicitation ? { elicitation } : {}) },
         jsonSchemaValidator: new ResilientJsonSchemaValidator(),
         listChanged: {
             tools: {
@@ -887,6 +897,9 @@ const createUpstreamMcpClient = (name, getServerInfo) => {
             },
         },
     });
+    if (elicitation && downstream)
+        installElicitationRelay(client, downstream);
+    return client;
 };
 // Normalize and infer server type for safe client display
 const normalizeServerType = (type) => {
@@ -1162,7 +1175,7 @@ export const collectPassthroughHeaders = (requestHeaders, passthroughHeaderNames
     const passthroughHeaders = {};
     for (const headerName of passthroughHeaderNames) {
         const normalizedHeaderName = headerName.trim();
-        if (!normalizedHeaderName) {
+        if (!isSafePassthroughHeader(normalizedHeaderName)) {
             continue;
         }
         const headerValue = headerValueToString(getHeaderValue(requestHeaders, normalizedHeaderName));
@@ -1221,7 +1234,7 @@ export const createTransportFromConfig = async (name, conf) => {
     // skip the internal-IP blocklist. allowInternal also governs per-hop
     // redirect validation in createRedirectValidatingFetch below.
     const ownerUser = conf.owner ? await getUserDao().findByUsername(conf.owner) : null;
-    const allowInternal = !!ownerUser?.isAdmin;
+    const allowInternal = !!ownerUser?.isAdmin && !hasUrlCredentialSlots(conf);
     if (conf.url) {
         await assertSafeUrl(conf.url, { allowInternal });
     }
@@ -1351,8 +1364,18 @@ export const createTransportFromConfig = async (name, conf) => {
     }
     return transport;
 };
+// Call arguments without the tool's hidden parameters; `toolName` is the bare upstream name.
+// Looked up by the cached runtime name: findToolConfig removes one server prefix,
+// so a bare name that itself starts with the prefix (server `fc`, tool
+// `fc-scrape`) would otherwise resolve to the wrong entry.
+const withoutHiddenArguments = (serverInfo, toolName, args) => {
+    const runtimeName = `${serverInfo.name}${getNameSeparator()}${toolName}`;
+    const tool = serverInfo.tools?.find((candidate) => candidate.name === runtimeName);
+    const toolConfig = findToolConfig(serverInfo.config?.tools, serverInfo.name, runtimeName, (serverInfo.tools ?? []).map((candidate) => candidate.name));
+    return removeHiddenArguments(args, tool?.inputSchema, toolConfig);
+};
 // Helper function to handle client.callTool with reconnection logic
-const callToolWithReconnect = async (serverInfo, toolParams, options, maxRetries = 1, isolated) => {
+const callToolWithReconnect = async (serverInfo, toolParams, options, maxRetries = 1, isolated, extra) => {
     // Local, reassignable refs so a reconnect can swap in the new connection for
     // the next retry attempt. For isolated calls these track the per-session
     // client/transport; otherwise they mirror the shared serverInfo connection.
@@ -1361,17 +1384,33 @@ const callToolWithReconnect = async (serverInfo, toolParams, options, maxRetries
     if (!client) {
         throw new Error(`Client not found for server: ${serverInfo.name}`);
     }
+    // Both MCP call paths pass through here, so hidden parameters are dropped once.
+    toolParams = {
+        ...toolParams,
+        arguments: withoutHiddenArguments(serverInfo, toolParams.name, toolParams.arguments),
+    };
     if (hasPersonalAuthentication(serverInfo.config)) {
         return client.callTool(toolParams, options || {});
     }
     for (let attempt = 0; attempt <= maxRetries; attempt++) {
         try {
-            const result = await client.callTool(toolParams, options || {});
-            // Check auth error
-            checkAuthError(result);
+            const currentClient = client;
+            const result = await withElicitation(currentClient, extra?.mcpReq, options || {}, async (callOptions) => {
+                const result = await currentClient.callTool(toolParams, callOptions);
+                checkAuthError(result);
+                return result;
+            });
             return result;
         }
         catch (error) {
+            if (isElicitationClientClosed(client)) {
+                closeIsolatedClient(serverInfo.name, client, transport);
+                throw error;
+            }
+            // A cancelled queued call never reached the upstream. In particular, do
+            // not let the generic SSE retry replace its healthy isolated connection.
+            if (extra?.mcpReq?.signal.aborted)
+                throw error;
             const isHttp40xError = isRecoverableHttp4xxError(error);
             // Only retry for StreamableHTTPClientTransport and SSE transports
             const isStreamableHttp = transport instanceof StreamableHTTPClientTransport;
@@ -2094,11 +2133,8 @@ export const getServersInfo = async (page, limit, user) => {
         // as the dashboard sends, or bare, as a direct API call may) with no
         // normalization — check both so the dashboard reflects a disable set
         // either way instead of always showing enabled:true for one of them.
-        const toolsWithEnabled = tools.map((tool) => {
-            const bareToolName = normalizeToolNameForServer(name, tool.name);
-            const toolConfig = serverConfig?.tools?.[tool.name] ?? serverConfig?.tools?.[bareToolName];
-            return buildToolWithDescriptionMetadata(tool, toolConfig);
-        });
+        const runtimeNames = tools.map((tool) => tool.name);
+        const toolsWithEnabled = tools.map((tool) => buildToolWithDescriptionMetadata(tool, findToolConfig(serverConfig?.tools, name, tool.name, runtimeNames)));
         const promptsWithEnabled = prompts.map((prompt) => {
             const promptConfig = serverConfig?.prompts?.[prompt.name];
             return {
@@ -2339,12 +2375,12 @@ const filterToolsByConfig = async (serverName, tools) => {
         // If no tool configuration exists, all tools are enabled by default
         return tools;
     }
+    // Callers may pass a subset; the key rule needs every tool of the server
+    const runtimeNames = (getServerByName(serverName)?.tools ?? tools).map((tool) => tool.name);
     return tools.filter((tool) => {
-        // toggleTool stores the disable under whatever key string the caller used
-        // (bare upstream name or server-prefixed name, never normalized) — check
-        // both, same as findToolOnServer's execution-time gate.
-        const bareToolName = normalizeToolNameForServer(serverName, tool.name);
-        const toolConfig = serverConfig.tools?.[tool.name] ?? serverConfig.tools?.[bareToolName];
+        // A disable may be stored under the runtime or the bare name — same key rule
+        // as findToolOnServer's execution-time gate (findToolConfig).
+        const toolConfig = findToolConfig(serverConfig.tools, serverName, tool.name, runtimeNames);
         // If tool is not in config, it's enabled by default
         return toolConfig?.enabled !== false;
     });
@@ -2920,24 +2956,25 @@ const getMcpAppsRouteContext = async (sessionId, group) => {
         return eligible.length > 0 ? { enabled: true, serverInfos: eligible } : { enabled: false };
     }
     const { filteredServerInfos, serverConfigsByName } = await getFilteredServerInfosForGroup(group);
-    const connectedServerInfos = filteredServerInfos.filter((serverInfo) => serverInfo.status === 'connected' && !!serverInfo.client);
-    if (connectedServerInfos.length === 0) {
+    const eligibleServerInfos = filteredServerInfos.filter((serverInfo) => canServeToolRequests(serverInfo) &&
+        (!!serverInfo.client || serverInfo.config?.startOnDemand === true));
+    if (eligibleServerInfos.length === 0) {
         return { enabled: false };
     }
     // Connection availability must not turn an aggregate route into a raw-name
     // route: OpenAPI uses openApiClient, and tool calls acquire only the target
     // personal runtime. Match resolveToolInGroup's configured-route ambiguity check.
-    if (connectedServerInfos.length === 1 &&
+    if (eligibleServerInfos.length === 1 &&
         filteredServerInfos.length === 1 &&
         serverConfigsByName.size <= 1) {
         return {
             enabled: true,
-            serverInfo: connectedServerInfos[0],
+            serverInfo: eligibleServerInfos[0],
         };
     }
     return {
         enabled: true,
-        serverInfos: connectedServerInfos,
+        serverInfos: eligibleServerInfos,
     };
 };
 const normalizeToolNameForServer = (serverName, toolName) => {
@@ -2972,9 +3009,14 @@ const projectNameForGroup = (name, serverName, serverConfig) => {
 const resolveNameFromGroup = (name, serverName, serverConfig) => {
     return replacePrefixedServerName(name, getExposedServerName(serverName, serverConfig), serverName);
 };
-const findToolOnServer = (serverInfo, toolName, allowRawName) => {
-    const tool = serverInfo.tools.find((tool) => tool.name === toolName ||
-        (allowRawName && normalizeToolNameForServer(serverInfo.name, tool.name) === toolName));
+const findToolOnServer = (serverInfo, toolName, allowRawName, preferRawName = false) => {
+    // A listed upstream name takes precedence over a colliding legacy cache alias.
+    const rawTool = preferRawName && allowRawName
+        ? serverInfo.tools.find((tool) => normalizeToolNameForServer(serverInfo.name, tool.name) === toolName)
+        : undefined;
+    const tool = rawTool ||
+        serverInfo.tools.find((tool) => tool.name === toolName ||
+            (allowRawName && normalizeToolNameForServer(serverInfo.name, tool.name) === toolName));
     if (!tool) {
         return undefined;
     }
@@ -2989,16 +3031,11 @@ const findToolOnServer = (serverInfo, toolName, allowRawName) => {
     // which is a different object. So the persisted per-tool config must be
     // consulted directly here.
     //
-    // toggleTool (serverController.ts) stores `tools[toolName] = ...` using
-    // whatever string the caller passed as :toolName, with no normalization.
-    // The dashboard sends the already-prefixed `tool.name`, matching what
-    // getServersInfo's toolsWithEnabled already reads — but any other caller
-    // (REST API used directly, scripts, docs examples) can just as validly
-    // pass the bare upstream name, which then never matches a prefixed-only
-    // lookup. Check both so a disable takes effect regardless of which form
-    // was used to set it.
-    const bareToolName = normalizeToolNameForServer(serverInfo.name, tool.name);
-    const toolConfig = serverInfo.config?.tools?.[tool.name] ?? serverInfo.config?.tools?.[bareToolName];
+    // A disable may be stored under the runtime (prefixed) name, as the
+    // dashboard writes it, or under the bare upstream name, as a settings file
+    // or a direct API call may. findToolConfig checks both, and never reads
+    // another tool's runtime key as this tool's bare name.
+    const toolConfig = findToolConfig(serverInfo.config?.tools, serverInfo.name, tool.name, serverInfo.tools.map((candidate) => candidate.name));
     if (toolConfig && toolConfig.enabled === false) {
         return undefined;
     }
@@ -3028,7 +3065,7 @@ const resolveToolInGroup = async (group, toolName) => {
         }
         const serverConfig = serverConfigsByName.get(serverInfo.name);
         const internalToolName = resolveNameFromGroup(toolName, serverInfo.name, serverConfig);
-        const tool = findToolOnServer(serverInfo, internalToolName, allowRawName);
+        const tool = findToolOnServer(serverInfo, internalToolName, allowRawName, serverConfigsByName.size === 0);
         if (!tool) {
             continue;
         }
@@ -3040,6 +3077,17 @@ const resolveToolInGroup = async (group, toolName) => {
     }
     return undefined;
 };
+const findEnabledPromptOnServer = async (serverInfo, name, allowRawName = false) => {
+    if (serverInfo.status !== 'connected' || serverInfo.enabled === false)
+        return undefined;
+    const prompt = serverInfo.prompts.find((item) => item.name === name ||
+        (allowRawName && item.name === `${serverInfo.name}${getNameSeparator()}${name}`));
+    if (!prompt)
+        return undefined;
+    const config = await getServerDao().findById(serverInfo.name);
+    const promptConfig = findToolConfig(config?.prompts, serverInfo.name, prompt.name, serverInfo.prompts.map((item) => item.name));
+    return config?.enabled === false || promptConfig?.enabled === false ? undefined : prompt;
+};
 async function resolvePromptInGroup(group, promptName) {
     const lookupGroup = getGroupLookupName(group);
     if (!lookupGroup) {
@@ -3052,7 +3100,7 @@ async function resolvePromptInGroup(group, promptName) {
         }
         const serverConfig = serverConfigsByName.get(serverInfo.name);
         const internalPromptName = resolveNameFromGroup(promptName, serverInfo.name, serverConfig);
-        const prompt = serverInfo.prompts.find((item) => item.name === internalPromptName);
+        const prompt = await findEnabledPromptOnServer(serverInfo, internalPromptName);
         if (!prompt) {
             continue;
         }
@@ -3064,21 +3112,19 @@ async function resolvePromptInGroup(group, promptName) {
     }
     return undefined;
 }
-const projectToolForDownstream = (serverName, tool, appsRouteContext, serverConfig) => {
+const projectToolForDownstream = (serverName, tool, appsRouteContext, serverConfig, useRawName = false) => {
     if (!appsRouteContext.enabled && isAppOnlyTool(tool)) {
         return undefined;
     }
     const projectedTool = appsRouteContext.enabled ? tool : stripMcpAppsMetadata(tool);
-    // Single configured server: keep the existing raw (unqualified) name so
-    // widgets that call back with the bare tool name continue to work.
-    if (appsRouteContext.serverInfo) {
+    // Naming follows the route, independently of Apps capabilities or connection state.
+    if (useRawName) {
         return {
             ...projectedTool,
             name: normalizeToolNameForServer(serverName, projectedTool.name),
         };
     }
-    // Aggregate routes (Apps-enabled) or Apps disabled: qualify the
-    // name so it can still be routed to the right server unambiguously.
+    // Group and aggregate routes keep qualified names, including single-member groups.
     return {
         ...projectedTool,
         name: projectNameForGroup(projectedTool.name, serverName, serverConfig),
@@ -3091,6 +3137,7 @@ const listGroupTools = async (group, filteredServerInfos, serverConfigsByName, a
     await Promise.allSettled(filteredServerInfos
         .filter((si) => si.config?.startOnDemand === true && si.tools.length === 0 && si.spawningPromise)
         .map((si) => si.spawningPromise));
+    const useRawName = !!group && !isSmartRoutingGroup(group) && !(await findRouteGroup(group));
     const allTools = [];
     for (const serverInfo of filteredServerInfos) {
         if (serverInfo.tools && serverInfo.tools.length > 0) {
@@ -3099,17 +3146,18 @@ const listGroupTools = async (group, filteredServerInfos, serverConfigsByName, a
             let tools = await filterToolsByConfig(serverInfo.name, serverInfo.tools);
             // If this is a group request, apply group-level tool filtering
             tools = await filterToolsByGroup(group, serverInfo.name, tools, groupServerConfig);
-            // Apply custom descriptions from server configuration
+            // Apply custom descriptions and hidden parameters from server configuration
             const serverConfig = await getServerDao().findById(serverInfo.name);
+            const runtimeNames = serverInfo.tools.map((tool) => tool.name);
             const toolsWithCustomDescriptions = tools.map((tool) => {
-                const toolConfig = serverConfig?.tools?.[tool.name];
+                const toolConfig = findToolConfig(serverConfig?.tools, serverInfo.name, tool.name, runtimeNames);
                 return {
-                    ...tool,
+                    ...applyHiddenParams(tool, toolConfig),
                     description: resolveDescriptionOverride(tool.description, toolConfig),
                 };
             });
             allTools.push(...toolsWithCustomDescriptions.flatMap((tool) => {
-                const projectedTool = projectToolForDownstream(serverInfo.name, tool, appsRouteContext, groupServerConfig);
+                const projectedTool = projectToolForDownstream(serverInfo.name, tool, appsRouteContext, groupServerConfig, useRawName);
                 return projectedTool ? [projectedTool] : [];
             }));
         }
@@ -3266,28 +3314,33 @@ const handleCallToolRequestImpl = async (request, extra) => {
     };
     try {
         appsRouteContext = await getMcpAppsRouteContext(sessionId, group);
+        const lookupRoute = getGroupLookupName(group);
+        // Direct routes own their listed raw names, even when a tool is disabled.
+        const upstreamOwnsMetaName = SMART_ROUTING_META_TOOL_NAMES.has(request.params.name) &&
+            !!lookupRoute &&
+            !isSmartRoutingGroup(group) &&
+            !(await findRouteGroup(lookupRoute)) &&
+            getVisibleServerByName(lookupRoute)?.tools.some((tool) => normalizeToolNameForServer(lookupRoute, tool.name) === request.params.name);
         // Special handling for smart routing tools
-        if (request.params.name === 'search_tools') {
+        if (!upstreamOwnsMetaName && request.params.name === 'search_tools') {
             const { query, limit = 10 } = request.params.arguments || {};
             return await handleSearchToolsRequest(query, limit, sessionId, group);
         }
         // Special handling for describe_tool (progressive disclosure mode)
-        if (request.params.name === 'describe_tool') {
+        if (!upstreamOwnsMetaName && request.params.name === 'describe_tool') {
             const { toolName } = request.params.arguments || {};
             return await handleDescribeToolRequest(toolName, sessionId, group);
         }
         // Special handling for call_tool
-        if (request.params.name === 'call_tool') {
+        if (!upstreamOwnsMetaName && request.params.name === 'call_tool') {
             const { toolName } = request.params.arguments || {};
             if (!toolName) {
                 throw new Error('toolName parameter is required');
             }
             const { arguments: toolArgs } = request.params.arguments || {};
-            // A single connected server on an Apps-enabled route is addressed by
-            // its raw (unqualified) tool name, same as before. A multi-server
-            // Apps-enabled route falls through to qualified-name group
-            // resolution below, same as an ordinary (non-Apps) group route.
-            const singleServerAppsRoute = !!appsRouteContext.serverInfo;
+            // Preserve legacy raw aggregate calls; explicit routes use the shared
+            // resolver so cached names still obey group filtering.
+            const singleServerAppsRoute = !getGroupLookupName(group) && !!appsRouteContext.serverInfo;
             let targetServerInfo;
             let targetToolName = toolName;
             let targetTool;
@@ -3348,7 +3401,7 @@ const handleCallToolRequestImpl = async (request, extra) => {
                     arguments: summarizeArgumentsForLogging(finalArgs),
                 });
                 // Remove server prefix from tool name if present
-                const cleanToolName = normalizeToolNameForServer(targetServerInfo.name, targetToolName);
+                const cleanToolName = normalizeToolNameForServer(targetServerInfo.name, tool.name);
                 // Extract passthrough headers from extra or request context
                 let passthroughHeaders;
                 let requestHeaders = null;
@@ -3364,6 +3417,8 @@ const handleCallToolRequestImpl = async (request, extra) => {
                 if (requestHeaders && targetServerInfo.config?.openapi?.passthroughHeaders) {
                     passthroughHeaders = {};
                     for (const headerName of targetServerInfo.config.openapi.passthroughHeaders) {
+                        if (!isSafePassthroughHeader(headerName))
+                            continue;
                         // Handle different header name cases (Express normalizes headers to lowercase)
                         const headerValue = requestHeaders[headerName] || requestHeaders[headerName.toLowerCase()];
                         if (headerValue) {
@@ -3380,7 +3435,7 @@ const handleCallToolRequestImpl = async (request, extra) => {
                     throw new Error(`OpenAPI server '${targetServerInfo.name}' requires cookie-session state and is not yet available on stateless MCP requests`);
                 }
                 await reserveHostedIfNeeded(targetServerInfo.name, cleanToolName);
-                const result = await openApiClient.callTool(cleanToolName, finalArgs, passthroughHeaders, false, stateId);
+                const result = await openApiClient.callTool(cleanToolName, withoutHiddenArguments(targetServerInfo, cleanToolName, finalArgs), passthroughHeaders, false, stateId);
                 await settleHostedIfNeeded({
                     success: true,
                     requestContent: finalArgs,
@@ -3429,7 +3484,9 @@ const handleCallToolRequestImpl = async (request, extra) => {
                 if (!stateId) {
                     throw new Error(`Server '${targetServerInfo.name}' requires per-session client isolation and is not yet available on stateless MCP requests`);
                 }
-                const isolated = await getOrCreateIsolatedClient(stateId, targetServerInfo);
+                const isolated = await getOrCreateIsolatedClient(stateId, targetServerInfo, extra.mcpReq && !requestContextService.getRequestContext()?.stateless
+                    ? servers[sessionId]
+                    : undefined);
                 isolatedCtx = {
                     sessionId: stateId,
                     client: isolated.client,
@@ -3447,12 +3504,12 @@ const handleCallToolRequestImpl = async (request, extra) => {
                 arguments: summarizeArgumentsForLogging(finalArgs),
                 perSessionClient: !!targetServerInfo.config?.perSessionClient,
             });
-            const cleanToolName = normalizeToolNameForServer(targetServerInfo.name, targetToolName);
+            const cleanToolName = normalizeToolNameForServer(targetServerInfo.name, tool.name);
             await reserveHostedIfNeeded(targetServerInfo.name, cleanToolName);
             const result = await callToolWithReconnect(targetServerInfo, {
                 name: cleanToolName,
                 arguments: finalArgs,
-            }, targetServerInfo.options || {}, 1, isolatedCtx);
+            }, targetServerInfo.options || {}, 1, isolatedCtx, extra);
             await settleHostedIfNeeded({
                 success: !result.isError,
                 requestContent: finalArgs,
@@ -3488,13 +3545,9 @@ const handleCallToolRequestImpl = async (request, extra) => {
         }
         // Regular tool handling
         const lookupGroup = getGroupLookupName(group);
-        // A single connected server on an Apps-enabled route is addressed
-        // directly, using its raw (unqualified) tool name, same as before. A
-        // multi-server Apps-enabled route resolves via the qualified-name
-        // group lookup below, same as an ordinary (non-Apps) group route,
-        // just without stripping Apps metadata or hiding app-only tools
-        // (assertToolAvailableForRoute below still gates on appsRouteContext.enabled).
-        const singleServerAppsRoute = !!appsRouteContext.serverInfo;
+        // Explicit routes share name resolution and group filtering regardless of
+        // Apps support; keep legacy raw aggregate calls compatible.
+        const singleServerAppsRoute = !getGroupLookupName(group) && !!appsRouteContext.serverInfo;
         const groupTool = !singleServerAppsRoute && lookupGroup
             ? await resolveToolInGroup(group, request.params.name)
             : undefined;
@@ -3522,7 +3575,7 @@ const handleCallToolRequestImpl = async (request, extra) => {
             // For OpenAPI servers, use the OpenAPI client
             const openApiClient = serverInfo.openApiClient;
             // Remove server prefix from tool name if present
-            const cleanToolName = normalizeToolNameForServer(serverInfo.name, routeToolName);
+            const cleanToolName = normalizeToolNameForServer(serverInfo.name, tool.name);
             logger.log('Invoking OpenAPI tool', {
                 toolName: cleanToolName,
                 serverName: serverInfo.name,
@@ -3543,6 +3596,8 @@ const handleCallToolRequestImpl = async (request, extra) => {
             if (requestHeaders && serverInfo.config?.openapi?.passthroughHeaders) {
                 passthroughHeaders = {};
                 for (const headerName of serverInfo.config.openapi.passthroughHeaders) {
+                    if (!isSafePassthroughHeader(headerName))
+                        continue;
                     // Handle different header name cases (Express normalizes headers to lowercase)
                     const headerValue = requestHeaders[headerName] || requestHeaders[headerName.toLowerCase()];
                     if (headerValue) {
@@ -3560,7 +3615,7 @@ const handleCallToolRequestImpl = async (request, extra) => {
                 throw new Error(`OpenAPI server '${serverInfo.name}' requires cookie-session state and is not yet available on stateless MCP requests`);
             }
             await reserveHostedIfNeeded(serverInfo.name, cleanToolName);
-            const result = await openApiClient.callTool(cleanToolName, finalArgs, passthroughHeaders, false, stateId);
+            const result = await openApiClient.callTool(cleanToolName, withoutHiddenArguments(serverInfo, cleanToolName, finalArgs), passthroughHeaders, false, stateId);
             await settleHostedIfNeeded({
                 success: true,
                 requestContent: finalArgs,
@@ -3608,15 +3663,17 @@ const handleCallToolRequestImpl = async (request, extra) => {
             if (!stateId) {
                 throw new Error(`Server '${serverInfo.name}' requires per-session client isolation and is not yet available on stateless MCP requests`);
             }
-            const isolated = await getOrCreateIsolatedClient(stateId, serverInfo);
+            const isolated = await getOrCreateIsolatedClient(stateId, serverInfo, extra.mcpReq && !requestContextService.getRequestContext()?.stateless
+                ? servers[sessionId]
+                : undefined);
             isolatedCtx = { sessionId: stateId, client: isolated.client, transport: isolated.transport };
         }
         else if (!serverInfo.client) {
             throw new Error(`Client not found for server: ${serverInfo.name}`);
         }
-        const cleanToolName = normalizeToolNameForServer(serverInfo.name, routeToolName);
+        const cleanToolName = normalizeToolNameForServer(serverInfo.name, tool.name);
         await reserveHostedIfNeeded(serverInfo.name, cleanToolName);
-        const result = await callToolWithReconnect(serverInfo, { ...request.params, name: cleanToolName }, serverInfo.options || {}, 1, isolatedCtx);
+        const result = await callToolWithReconnect(serverInfo, { ...request.params, name: cleanToolName }, serverInfo.options || {}, 1, isolatedCtx, extra);
         await settleHostedIfNeeded({
             success: !result.isError,
             requestContent: request.params.arguments,
@@ -3715,7 +3772,7 @@ const handleGetPromptRequestImpl = async (request, extra) => {
         const { name, arguments: promptArgs } = request.params;
         const group = getMcpRequestGroup(extra);
         // Check built-in prompts first
-        const builtinPrompt = await getBuiltinPromptDao().findByName(name);
+        const builtinPrompt = !extra?.server && (await getBuiltinPromptDao().findByName(name));
         if (builtinPrompt && builtinPrompt.enabled !== false) {
             // Perform {{param}} template substitution
             let content = builtinPrompt.template;
@@ -3737,7 +3794,12 @@ const handleGetPromptRequestImpl = async (request, extra) => {
         let promptNameForServer = name;
         const lookupGroup = getGroupLookupName(group);
         if (extra && extra.server) {
-            server = getVisibleServerByName(extra.server);
+            const candidate = getVisibleServerByName(extra.server);
+            const prompt = candidate && (await findEnabledPromptOnServer(candidate, name, true));
+            if (prompt) {
+                server = candidate;
+                promptNameForServer = prompt.name;
+            }
         }
         else if (lookupGroup) {
             const groupPrompt = await resolvePromptInGroup(lookupGroup, name);
@@ -3747,10 +3809,14 @@ const handleGetPromptRequestImpl = async (request, extra) => {
             }
         }
         else {
-            // Find the first server that has this prompt
-            server = getVisibleServerInfos().find((serverInfo) => serverInfo.status === 'connected' &&
-                serverInfo.enabled !== false &&
-                serverInfo.prompts.find((prompt) => prompt.name === name));
+            for (const candidate of getVisibleServerInfos()) {
+                const prompt = await findEnabledPromptOnServer(candidate, name);
+                if (prompt) {
+                    server = candidate;
+                    promptNameForServer = prompt.name;
+                    break;
+                }
+            }
         }
         if (!server) {
             throw new ToolUnavailableError(`Prompt not available: ${name}`, classifyUnavailableReason(name));
@@ -3819,7 +3885,7 @@ const handleListPromptsRequestImpl = async (_, extra) => {
             let enabledPrompts = serverInfo.prompts;
             if (serverConfig && serverConfig.prompts) {
                 enabledPrompts = serverInfo.prompts.filter((prompt) => {
-                    const promptConfig = serverConfig.prompts?.[prompt.name];
+                    const promptConfig = findToolConfig(serverConfig.prompts, serverInfo.name, prompt.name, serverInfo.prompts.map((item) => item.name));
                     // If prompt is not in config, it's enabled by default
                     return promptConfig?.enabled !== false;
                 });
@@ -3986,6 +4052,12 @@ const handleReadResourceRequestImpl = async (request, extra) => {
                 ? [appsRouteContext.serverInfo]
                 : (appsRouteContext.serverInfos ?? []);
             for (const candidate of candidates) {
+                const config = await getServerDao().findById(candidate.name);
+                if (config?.resources?.[uri]?.enabled === false)
+                    continue;
+                const allowed = await filterResourcesByGroup(lookupGroup, candidate.name, [{ uri }], serverConfigsByName.get(candidate.name));
+                if (allowed.length === 0)
+                    continue;
                 // An on-demand candidate may be idle yet still advertise its cached widget
                 // link, so a host can read the ui:// resource before any tool call has
                 // woken it. Hold off its idle shutdown for every read, awake or not, so an
@@ -4181,7 +4253,7 @@ const withPrincipalServers = (handler, operation) => async (request, extra) => {
     if (!serverInfos.some((info) => hasPersonalAuthentication(info.config)))
         return handler(request, extra);
     // Built-in content does not require an upstream credential.
-    if (operation === 'prompt') {
+    if (operation === 'prompt' && !extra?.server) {
         const builtin = await getBuiltinPromptDao().findByName(request.params?.name);
         if (builtin && builtin.enabled !== false)
             return handler(request, extra);