@samanhappy/mcphub 1.1.8 → 1.1.10

package/dist/services/mcpService.js

@@ -5,6 +5,7 @@ import { preserveListFreshness, combineListFreshness, remainingListTtl, } from '
 import { expandServerConfig, getServerEnvironment } from './serverConfigEnvironment.js';
 import { getMcpRequestGroup } from '../utils/mcpRequestGroup.js';
 import { LegacyMcpClient } from '../clients/legacyMcpClient.js';
+import { getElicitationCapabilities, installElicitationRelay, isElicitationClientClosed, withElicitation, } from './elicitationService.js';
 import { LEGACY_PROTOCOL_VERSIONS } from '../utils/mcpProtocol.js';
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { createHash } from 'node:crypto';
@@ -15,7 +16,7 @@ import { applyHiddenParams, findToolConfig, removeHiddenArguments, } from '../ut
 import { PrincipalRuntimeService } from './principalRuntimeService.js';
 import { UserContextService } from './userContextService.js';
 import { deleteCredentialBindings, missingCredentialError } from './credentialBindingService.js';
-import { CredentialBindingError, hasCredentialTemplate, hasPersonalAuthentication, resolveCredentialArguments, validateCredentialTemplate, } from '../utils/credentialTemplate.js';
+import { CredentialBindingError, hasCredentialTemplate, hasPersonalAuthentication, resolveCredentialArguments, hasUrlCredentialSlots, validateCredentialTemplate, } from '../utils/credentialTemplate.js';
 import os from 'os';
 import path from 'path';
 import fs from 'fs';
@@ -355,12 +356,12 @@ const setSessionIsolatedClient = (sessionId, serverName, client, transport) => {
  * Used when the server has `perSessionClient: true` in its config.
  * Uses a creation lock to prevent duplicate connections from concurrent calls.
  */
-const getOrCreateIsolatedClient = async (sessionId, serverInfo) => {
+const getOrCreateIsolatedClient = async (sessionId, serverInfo, downstream) => {
     // Quick check without lock — already exists
     const sessionClients = sessionIsolatedClients.get(sessionId);
     if (sessionClients) {
         const existing = sessionClients.get(serverInfo.name);
-        if (existing) {
+        if (existing && !isElicitationClientClosed(existing.client)) {
             return existing;
         }
     }
@@ -375,7 +376,7 @@ const getOrCreateIsolatedClient = async (sessionId, serverInfo) => {
         const sessionClientsAfterLock = sessionIsolatedClients.get(sessionId);
         if (sessionClientsAfterLock) {
             const existing = sessionClientsAfterLock.get(serverInfo.name);
-            if (existing) {
+            if (existing && !isElicitationClientClosed(existing.client)) {
                 return existing;
             }
         }
@@ -388,7 +389,7 @@ const getOrCreateIsolatedClient = async (sessionId, serverInfo) => {
         }
         const reservedClients = sessionIsolatedClients.get(sessionId);
         const transport = await createTransportFromConfig(serverInfo.name, serverConfig);
-        const client = createUpstreamMcpClient(serverInfo.name, () => serverInfo);
+        const client = createUpstreamMcpClient(serverInfo.name, () => serverInfo, downstream);
         try {
             await connectClientWithDiagnostics(client, transport, serverInfo.options || {});
         }
@@ -840,12 +841,13 @@ const updateServerResourcesCache = (serverInfo, resources) => {
 const logListChangedRefreshError = (listType) => {
     logger.warn(`Failed to refresh ${listType} list after upstream notification`);
 };
-const createUpstreamMcpClient = (name, getServerInfo) => {
-    return new LegacyMcpClient({
+const createUpstreamMcpClient = (name, getServerInfo, downstream) => {
+    const elicitation = getElicitationCapabilities(downstream);
+    const client = new LegacyMcpClient({
         name: `mcp-client-${name}`,
         version: '1.0.0',
     }, {
-        capabilities: MCP_APPS_CAPABILITIES,
+        capabilities: { ...MCP_APPS_CAPABILITIES, ...(elicitation ? { elicitation } : {}) },
         jsonSchemaValidator: new ResilientJsonSchemaValidator(),
         listChanged: {
             tools: {
@@ -895,6 +897,9 @@ const createUpstreamMcpClient = (name, getServerInfo) => {
             },
         },
     });
+    if (elicitation && downstream)
+        installElicitationRelay(client, downstream);
+    return client;
 };
 // Normalize and infer server type for safe client display
 const normalizeServerType = (type) => {
@@ -1229,7 +1234,7 @@ export const createTransportFromConfig = async (name, conf) => {
     // skip the internal-IP blocklist. allowInternal also governs per-hop
     // redirect validation in createRedirectValidatingFetch below.
     const ownerUser = conf.owner ? await getUserDao().findByUsername(conf.owner) : null;
-    const allowInternal = !!ownerUser?.isAdmin;
+    const allowInternal = !!ownerUser?.isAdmin && !hasUrlCredentialSlots(conf);
     if (conf.url) {
         await assertSafeUrl(conf.url, { allowInternal });
     }
@@ -1370,7 +1375,7 @@ const withoutHiddenArguments = (serverInfo, toolName, args) => {
     return removeHiddenArguments(args, tool?.inputSchema, toolConfig);
 };
 // Helper function to handle client.callTool with reconnection logic
-const callToolWithReconnect = async (serverInfo, toolParams, options, maxRetries = 1, isolated) => {
+const callToolWithReconnect = async (serverInfo, toolParams, options, maxRetries = 1, isolated, extra) => {
     // Local, reassignable refs so a reconnect can swap in the new connection for
     // the next retry attempt. For isolated calls these track the per-session
     // client/transport; otherwise they mirror the shared serverInfo connection.
@@ -1389,12 +1394,23 @@ const callToolWithReconnect = async (serverInfo, toolParams, options, maxRetries
     }
     for (let attempt = 0; attempt <= maxRetries; attempt++) {
         try {
-            const result = await client.callTool(toolParams, options || {});
-            // Check auth error
-            checkAuthError(result);
+            const currentClient = client;
+            const result = await withElicitation(currentClient, extra?.mcpReq, options || {}, async (callOptions) => {
+                const result = await currentClient.callTool(toolParams, callOptions);
+                checkAuthError(result);
+                return result;
+            });
             return result;
         }
         catch (error) {
+            if (isElicitationClientClosed(client)) {
+                closeIsolatedClient(serverInfo.name, client, transport);
+                throw error;
+            }
+            // A cancelled queued call never reached the upstream. In particular, do
+            // not let the generic SSE retry replace its healthy isolated connection.
+            if (extra?.mcpReq?.signal.aborted)
+                throw error;
             const isHttp40xError = isRecoverableHttp4xxError(error);
             // Only retry for StreamableHTTPClientTransport and SSE transports
             const isStreamableHttp = transport instanceof StreamableHTTPClientTransport;
@@ -2107,7 +2123,7 @@ export const getServersInfo = async (page, limit, user) => {
     }));
     const infos = presentedInfos
         .filter((info) => requestedServerNames.has(info.name)) // Only include requested servers
-        .map(({ name, version, packageVersion, latestVersion, updateAvailable, instructions, owner, visibility, status, tools, prompts, resources, createTime, error, oauth, }) => {
+        .map(({ name, version, client, packageVersion, latestVersion, updateAvailable, instructions, owner, visibility, status, tools, prompts, resources, createTime, error, oauth, }) => {
         const serverConfig = allServers.find((server) => server.name === name);
         const enabled = serverConfig ? serverConfig.enabled !== false : true;
         const resolvedType = inferServerType(serverConfig);
@@ -2138,6 +2154,9 @@ export const getServersInfo = async (page, limit, user) => {
         return {
             name,
             version,
+            protocolVersion: enabled && status === 'connected' && resolvedType !== 'openapi'
+                ? client?.getNegotiatedProtocolVersion?.()
+                : undefined,
             instructions,
             owner,
             visibility,
@@ -2940,24 +2959,25 @@ const getMcpAppsRouteContext = async (sessionId, group) => {
         return eligible.length > 0 ? { enabled: true, serverInfos: eligible } : { enabled: false };
     }
     const { filteredServerInfos, serverConfigsByName } = await getFilteredServerInfosForGroup(group);
-    const connectedServerInfos = filteredServerInfos.filter((serverInfo) => serverInfo.status === 'connected' && !!serverInfo.client);
-    if (connectedServerInfos.length === 0) {
+    const eligibleServerInfos = filteredServerInfos.filter((serverInfo) => canServeToolRequests(serverInfo) &&
+        (!!serverInfo.client || serverInfo.config?.startOnDemand === true));
+    if (eligibleServerInfos.length === 0) {
         return { enabled: false };
     }
     // Connection availability must not turn an aggregate route into a raw-name
     // route: OpenAPI uses openApiClient, and tool calls acquire only the target
     // personal runtime. Match resolveToolInGroup's configured-route ambiguity check.
-    if (connectedServerInfos.length === 1 &&
+    if (eligibleServerInfos.length === 1 &&
         filteredServerInfos.length === 1 &&
         serverConfigsByName.size <= 1) {
         return {
             enabled: true,
-            serverInfo: connectedServerInfos[0],
+            serverInfo: eligibleServerInfos[0],
         };
     }
     return {
         enabled: true,
-        serverInfos: connectedServerInfos,
+        serverInfos: eligibleServerInfos,
     };
 };
 const normalizeToolNameForServer = (serverName, toolName) => {
@@ -2992,9 +3012,14 @@ const projectNameForGroup = (name, serverName, serverConfig) => {
 const resolveNameFromGroup = (name, serverName, serverConfig) => {
     return replacePrefixedServerName(name, getExposedServerName(serverName, serverConfig), serverName);
 };
-const findToolOnServer = (serverInfo, toolName, allowRawName) => {
-    const tool = serverInfo.tools.find((tool) => tool.name === toolName ||
-        (allowRawName && normalizeToolNameForServer(serverInfo.name, tool.name) === toolName));
+const findToolOnServer = (serverInfo, toolName, allowRawName, preferRawName = false) => {
+    // A listed upstream name takes precedence over a colliding legacy cache alias.
+    const rawTool = preferRawName && allowRawName
+        ? serverInfo.tools.find((tool) => normalizeToolNameForServer(serverInfo.name, tool.name) === toolName)
+        : undefined;
+    const tool = rawTool ||
+        serverInfo.tools.find((tool) => tool.name === toolName ||
+            (allowRawName && normalizeToolNameForServer(serverInfo.name, tool.name) === toolName));
     if (!tool) {
         return undefined;
     }
@@ -3043,7 +3068,7 @@ const resolveToolInGroup = async (group, toolName) => {
         }
         const serverConfig = serverConfigsByName.get(serverInfo.name);
         const internalToolName = resolveNameFromGroup(toolName, serverInfo.name, serverConfig);
-        const tool = findToolOnServer(serverInfo, internalToolName, allowRawName);
+        const tool = findToolOnServer(serverInfo, internalToolName, allowRawName, serverConfigsByName.size === 0);
         if (!tool) {
             continue;
         }
@@ -3055,6 +3080,17 @@ const resolveToolInGroup = async (group, toolName) => {
     }
     return undefined;
 };
+const findEnabledPromptOnServer = async (serverInfo, name, allowRawName = false) => {
+    if (serverInfo.status !== 'connected' || serverInfo.enabled === false)
+        return undefined;
+    const prompt = serverInfo.prompts.find((item) => item.name === name ||
+        (allowRawName && item.name === `${serverInfo.name}${getNameSeparator()}${name}`));
+    if (!prompt)
+        return undefined;
+    const config = await getServerDao().findById(serverInfo.name);
+    const promptConfig = findToolConfig(config?.prompts, serverInfo.name, prompt.name, serverInfo.prompts.map((item) => item.name));
+    return config?.enabled === false || promptConfig?.enabled === false ? undefined : prompt;
+};
 async function resolvePromptInGroup(group, promptName) {
     const lookupGroup = getGroupLookupName(group);
     if (!lookupGroup) {
@@ -3067,7 +3103,7 @@ async function resolvePromptInGroup(group, promptName) {
         }
         const serverConfig = serverConfigsByName.get(serverInfo.name);
         const internalPromptName = resolveNameFromGroup(promptName, serverInfo.name, serverConfig);
-        const prompt = serverInfo.prompts.find((item) => item.name === internalPromptName);
+        const prompt = await findEnabledPromptOnServer(serverInfo, internalPromptName);
         if (!prompt) {
             continue;
         }
@@ -3079,21 +3115,19 @@ async function resolvePromptInGroup(group, promptName) {
     }
     return undefined;
 }
-const projectToolForDownstream = (serverName, tool, appsRouteContext, serverConfig) => {
+const projectToolForDownstream = (serverName, tool, appsRouteContext, serverConfig, useRawName = false) => {
     if (!appsRouteContext.enabled && isAppOnlyTool(tool)) {
         return undefined;
     }
     const projectedTool = appsRouteContext.enabled ? tool : stripMcpAppsMetadata(tool);
-    // Single configured server: keep the existing raw (unqualified) name so
-    // widgets that call back with the bare tool name continue to work.
-    if (appsRouteContext.serverInfo) {
+    // Naming follows the route, independently of Apps capabilities or connection state.
+    if (useRawName) {
         return {
             ...projectedTool,
             name: normalizeToolNameForServer(serverName, projectedTool.name),
         };
     }
-    // Aggregate routes (Apps-enabled) or Apps disabled: qualify the
-    // name so it can still be routed to the right server unambiguously.
+    // Group and aggregate routes keep qualified names, including single-member groups.
     return {
         ...projectedTool,
         name: projectNameForGroup(projectedTool.name, serverName, serverConfig),
@@ -3106,6 +3140,7 @@ const listGroupTools = async (group, filteredServerInfos, serverConfigsByName, a
     await Promise.allSettled(filteredServerInfos
         .filter((si) => si.config?.startOnDemand === true && si.tools.length === 0 && si.spawningPromise)
         .map((si) => si.spawningPromise));
+    const useRawName = !!group && !isSmartRoutingGroup(group) && !(await findRouteGroup(group));
     const allTools = [];
     for (const serverInfo of filteredServerInfos) {
         if (serverInfo.tools && serverInfo.tools.length > 0) {
@@ -3125,7 +3160,7 @@ const listGroupTools = async (group, filteredServerInfos, serverConfigsByName, a
                 };
             });
             allTools.push(...toolsWithCustomDescriptions.flatMap((tool) => {
-                const projectedTool = projectToolForDownstream(serverInfo.name, tool, appsRouteContext, groupServerConfig);
+                const projectedTool = projectToolForDownstream(serverInfo.name, tool, appsRouteContext, groupServerConfig, useRawName);
                 return projectedTool ? [projectedTool] : [];
             }));
         }
@@ -3282,28 +3317,33 @@ const handleCallToolRequestImpl = async (request, extra) => {
     };
     try {
         appsRouteContext = await getMcpAppsRouteContext(sessionId, group);
+        const lookupRoute = getGroupLookupName(group);
+        // Direct routes own their listed raw names, even when a tool is disabled.
+        const upstreamOwnsMetaName = SMART_ROUTING_META_TOOL_NAMES.has(request.params.name) &&
+            !!lookupRoute &&
+            !isSmartRoutingGroup(group) &&
+            !(await findRouteGroup(lookupRoute)) &&
+            getVisibleServerByName(lookupRoute)?.tools.some((tool) => normalizeToolNameForServer(lookupRoute, tool.name) === request.params.name);
         // Special handling for smart routing tools
-        if (request.params.name === 'search_tools') {
+        if (!upstreamOwnsMetaName && request.params.name === 'search_tools') {
             const { query, limit = 10 } = request.params.arguments || {};
             return await handleSearchToolsRequest(query, limit, sessionId, group);
         }
         // Special handling for describe_tool (progressive disclosure mode)
-        if (request.params.name === 'describe_tool') {
+        if (!upstreamOwnsMetaName && request.params.name === 'describe_tool') {
             const { toolName } = request.params.arguments || {};
             return await handleDescribeToolRequest(toolName, sessionId, group);
         }
         // Special handling for call_tool
-        if (request.params.name === 'call_tool') {
+        if (!upstreamOwnsMetaName && request.params.name === 'call_tool') {
             const { toolName } = request.params.arguments || {};
             if (!toolName) {
                 throw new Error('toolName parameter is required');
             }
             const { arguments: toolArgs } = request.params.arguments || {};
-            // A single connected server on an Apps-enabled route is addressed by
-            // its raw (unqualified) tool name, same as before. A multi-server
-            // Apps-enabled route falls through to qualified-name group
-            // resolution below, same as an ordinary (non-Apps) group route.
-            const singleServerAppsRoute = !!appsRouteContext.serverInfo;
+            // Preserve legacy raw aggregate calls; explicit routes use the shared
+            // resolver so cached names still obey group filtering.
+            const singleServerAppsRoute = !getGroupLookupName(group) && !!appsRouteContext.serverInfo;
             let targetServerInfo;
             let targetToolName = toolName;
             let targetTool;
@@ -3364,7 +3404,7 @@ const handleCallToolRequestImpl = async (request, extra) => {
                     arguments: summarizeArgumentsForLogging(finalArgs),
                 });
                 // Remove server prefix from tool name if present
-                const cleanToolName = normalizeToolNameForServer(targetServerInfo.name, targetToolName);
+                const cleanToolName = normalizeToolNameForServer(targetServerInfo.name, tool.name);
                 // Extract passthrough headers from extra or request context
                 let passthroughHeaders;
                 let requestHeaders = null;
@@ -3447,7 +3487,9 @@ const handleCallToolRequestImpl = async (request, extra) => {
                 if (!stateId) {
                     throw new Error(`Server '${targetServerInfo.name}' requires per-session client isolation and is not yet available on stateless MCP requests`);
                 }
-                const isolated = await getOrCreateIsolatedClient(stateId, targetServerInfo);
+                const isolated = await getOrCreateIsolatedClient(stateId, targetServerInfo, extra.mcpReq && !requestContextService.getRequestContext()?.stateless
+                    ? servers[sessionId]
+                    : undefined);
                 isolatedCtx = {
                     sessionId: stateId,
                     client: isolated.client,
@@ -3465,12 +3507,12 @@ const handleCallToolRequestImpl = async (request, extra) => {
                 arguments: summarizeArgumentsForLogging(finalArgs),
                 perSessionClient: !!targetServerInfo.config?.perSessionClient,
             });
-            const cleanToolName = normalizeToolNameForServer(targetServerInfo.name, targetToolName);
+            const cleanToolName = normalizeToolNameForServer(targetServerInfo.name, tool.name);
             await reserveHostedIfNeeded(targetServerInfo.name, cleanToolName);
             const result = await callToolWithReconnect(targetServerInfo, {
                 name: cleanToolName,
                 arguments: finalArgs,
-            }, targetServerInfo.options || {}, 1, isolatedCtx);
+            }, targetServerInfo.options || {}, 1, isolatedCtx, extra);
             await settleHostedIfNeeded({
                 success: !result.isError,
                 requestContent: finalArgs,
@@ -3506,13 +3548,9 @@ const handleCallToolRequestImpl = async (request, extra) => {
         }
         // Regular tool handling
         const lookupGroup = getGroupLookupName(group);
-        // A single connected server on an Apps-enabled route is addressed
-        // directly, using its raw (unqualified) tool name, same as before. A
-        // multi-server Apps-enabled route resolves via the qualified-name
-        // group lookup below, same as an ordinary (non-Apps) group route,
-        // just without stripping Apps metadata or hiding app-only tools
-        // (assertToolAvailableForRoute below still gates on appsRouteContext.enabled).
-        const singleServerAppsRoute = !!appsRouteContext.serverInfo;
+        // Explicit routes share name resolution and group filtering regardless of
+        // Apps support; keep legacy raw aggregate calls compatible.
+        const singleServerAppsRoute = !getGroupLookupName(group) && !!appsRouteContext.serverInfo;
         const groupTool = !singleServerAppsRoute && lookupGroup
             ? await resolveToolInGroup(group, request.params.name)
             : undefined;
@@ -3540,7 +3578,7 @@ const handleCallToolRequestImpl = async (request, extra) => {
             // For OpenAPI servers, use the OpenAPI client
             const openApiClient = serverInfo.openApiClient;
             // Remove server prefix from tool name if present
-            const cleanToolName = normalizeToolNameForServer(serverInfo.name, routeToolName);
+            const cleanToolName = normalizeToolNameForServer(serverInfo.name, tool.name);
             logger.log('Invoking OpenAPI tool', {
                 toolName: cleanToolName,
                 serverName: serverInfo.name,
@@ -3628,15 +3666,17 @@ const handleCallToolRequestImpl = async (request, extra) => {
             if (!stateId) {
                 throw new Error(`Server '${serverInfo.name}' requires per-session client isolation and is not yet available on stateless MCP requests`);
             }
-            const isolated = await getOrCreateIsolatedClient(stateId, serverInfo);
+            const isolated = await getOrCreateIsolatedClient(stateId, serverInfo, extra.mcpReq && !requestContextService.getRequestContext()?.stateless
+                ? servers[sessionId]
+                : undefined);
             isolatedCtx = { sessionId: stateId, client: isolated.client, transport: isolated.transport };
         }
         else if (!serverInfo.client) {
             throw new Error(`Client not found for server: ${serverInfo.name}`);
         }
-        const cleanToolName = normalizeToolNameForServer(serverInfo.name, routeToolName);
+        const cleanToolName = normalizeToolNameForServer(serverInfo.name, tool.name);
         await reserveHostedIfNeeded(serverInfo.name, cleanToolName);
-        const result = await callToolWithReconnect(serverInfo, { ...request.params, name: cleanToolName }, serverInfo.options || {}, 1, isolatedCtx);
+        const result = await callToolWithReconnect(serverInfo, { ...request.params, name: cleanToolName }, serverInfo.options || {}, 1, isolatedCtx, extra);
         await settleHostedIfNeeded({
             success: !result.isError,
             requestContent: request.params.arguments,
@@ -3735,7 +3775,7 @@ const handleGetPromptRequestImpl = async (request, extra) => {
         const { name, arguments: promptArgs } = request.params;
         const group = getMcpRequestGroup(extra);
         // Check built-in prompts first
-        const builtinPrompt = await getBuiltinPromptDao().findByName(name);
+        const builtinPrompt = !extra?.server && (await getBuiltinPromptDao().findByName(name));
         if (builtinPrompt && builtinPrompt.enabled !== false) {
             // Perform {{param}} template substitution
             let content = builtinPrompt.template;
@@ -3757,7 +3797,12 @@ const handleGetPromptRequestImpl = async (request, extra) => {
         let promptNameForServer = name;
         const lookupGroup = getGroupLookupName(group);
         if (extra && extra.server) {
-            server = getVisibleServerByName(extra.server);
+            const candidate = getVisibleServerByName(extra.server);
+            const prompt = candidate && (await findEnabledPromptOnServer(candidate, name, true));
+            if (prompt) {
+                server = candidate;
+                promptNameForServer = prompt.name;
+            }
         }
         else if (lookupGroup) {
             const groupPrompt = await resolvePromptInGroup(lookupGroup, name);
@@ -3767,10 +3812,14 @@ const handleGetPromptRequestImpl = async (request, extra) => {
             }
         }
         else {
-            // Find the first server that has this prompt
-            server = getVisibleServerInfos().find((serverInfo) => serverInfo.status === 'connected' &&
-                serverInfo.enabled !== false &&
-                serverInfo.prompts.find((prompt) => prompt.name === name));
+            for (const candidate of getVisibleServerInfos()) {
+                const prompt = await findEnabledPromptOnServer(candidate, name);
+                if (prompt) {
+                    server = candidate;
+                    promptNameForServer = prompt.name;
+                    break;
+                }
+            }
         }
         if (!server) {
             throw new ToolUnavailableError(`Prompt not available: ${name}`, classifyUnavailableReason(name));
@@ -3839,7 +3888,7 @@ const handleListPromptsRequestImpl = async (_, extra) => {
             let enabledPrompts = serverInfo.prompts;
             if (serverConfig && serverConfig.prompts) {
                 enabledPrompts = serverInfo.prompts.filter((prompt) => {
-                    const promptConfig = serverConfig.prompts?.[prompt.name];
+                    const promptConfig = findToolConfig(serverConfig.prompts, serverInfo.name, prompt.name, serverInfo.prompts.map((item) => item.name));
                     // If prompt is not in config, it's enabled by default
                     return promptConfig?.enabled !== false;
                 });
@@ -4006,6 +4055,12 @@ const handleReadResourceRequestImpl = async (request, extra) => {
                 ? [appsRouteContext.serverInfo]
                 : (appsRouteContext.serverInfos ?? []);
             for (const candidate of candidates) {
+                const config = await getServerDao().findById(candidate.name);
+                if (config?.resources?.[uri]?.enabled === false)
+                    continue;
+                const allowed = await filterResourcesByGroup(lookupGroup, candidate.name, [{ uri }], serverConfigsByName.get(candidate.name));
+                if (allowed.length === 0)
+                    continue;
                 // An on-demand candidate may be idle yet still advertise its cached widget
                 // link, so a host can read the ui:// resource before any tool call has
                 // woken it. Hold off its idle shutdown for every read, awake or not, so an
@@ -4201,7 +4256,7 @@ const withPrincipalServers = (handler, operation) => async (request, extra) => {
     if (!serverInfos.some((info) => hasPersonalAuthentication(info.config)))
         return handler(request, extra);
     // Built-in content does not require an upstream credential.
-    if (operation === 'prompt') {
+    if (operation === 'prompt' && !extra?.server) {
         const builtin = await getBuiltinPromptDao().findByName(request.params?.name);
         if (builtin && builtin.enabled !== false)
             return handler(request, extra);