@stage-labs/metro 0.1.0-beta.303 → 0.1.0-beta.304

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.303",
+  "version": "0.1.0-beta.304",
   "description": "The metro command line: run your agent on this machine, relaying its chat channels and connectors to Claude Code.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.303",
-  "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, and the standing rules loaded at each session start. No vendor credential ever sits in a config file.",
+  "version": "0.1.0-beta.304",
+  "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon (or one `mcp` server on mcp.metro.box), the orchestrator-only guard on the main thread, and the standing rules loaded at each session start. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",
     "url": "https://metro.box"

package/runtime/marketplace/plugin/METRO.md

@@ -15,6 +15,8 @@ You are the main thread of a Claude Code session that is connected to chat throu
 
 **Calls that need the owner's approval run in a worker.** The owner can make a metro tool on a channel wait for approval. On the main thread such a call is refused, because waiting for the answer would stop the whole session: hand that exact call to a background worker (`run_in_background: true`) and keep answering. The worker waits for the owner's answer on its own.
 
+**Connectors through the `mcp` server.** When the `mcp` server is present, it holds every connector tool behind two tools. Find what you need with `find_tools`: `select:notion.search,linear.create_issue` for exact names, keywords (`notion page update`) to rank, or `+slack send` to require `slack` in the tool name. Have a worker run them with `call_tool`, up to 10 independent calls in one go. When a call answers `needs_approval`, the owner is asked in chat and on the page: tell the person what is waiting, then wait for the channel message `Approved: <tool> (<id>)` or `Denied: <tool> (<id>)`. After an approval, have a worker call `call_tool` again with the same tool and arguments and `approval: "<id>"`.
+
 **Finish what was asked.** You work on your own. Nobody is watching a screen, and a question sent to chat may go unanswered for hours, so asking "Shall I?" about work already requested simply stops it. Anything reversible that follows from the request, do. Stop only for a destructive action or a genuine change of scope. Before you end a turn, read your own last paragraph: if it is a plan, a question, a list of next steps or a promise ("I'll…", "Next…"), then the work is not done, so do it now, retries and missing information included. End the turn when the task is finished, or when you are truly blocked on something only the person can give you.
 
 The exception is a person describing a problem, asking a question or thinking out loud. There the answer IS the deliverable: reply, and change nothing until they ask.

package/runtime/marketplace/plugin/bin/guard.mjs

@@ -23,6 +23,7 @@ const ORCHESTRATION = new Set([
 const IMAGE = /\.(png|jpe?g|gif|webp|bmp)$/i;
 const MCP = /^mcp__/;
 const METRO_MCP = /^mcp__metro__/;
+const FIND_TOOLS = 'mcp__plugin_metro_mcp__find_tools';
 const VOICE = process.env.METRO_SESSION === 'voice';
 
 function answer(decision, reason) {
@@ -54,7 +55,7 @@ function verdict(payload, input) {
       : 'A foreground subagent blinds the main thread: it cannot see or acknowledge inbound metro messages until the agent finishes. Re-issue the identical Agent call with run_in_background: true, then wait for the task notification.';
   if (VOICE) return null;
   if (ORCHESTRATION.has(tool)) return null;
-  if (METRO_MCP.test(tool)) return null;
+  if (METRO_MCP.test(tool) || tool === FIND_TOOLS) return null;
   if (MCP.test(tool))
     return `A connector call is work, not orchestration: ${tool} reads somebody's files, mail or records, and its answer can be long enough to crowd out the chat you are here to follow. Only metro's own tools run on this thread. Delegate it to a subagent with the Agent tool (run_in_background: true; the worker reaches every connector) and relay what it finds.`;
   if (tool === 'Read' && typeof input.file_path === 'string' && IMAGE.test(input.file_path)) return null;

package/runtime/marketplace/plugin/bin/metro-plugin.mjs

@@ -4,6 +4,7 @@ import { homedir } from 'node:os';
 import { join } from 'node:path';
 
 const agentsDir = () => process.env.METRO_AGENTS_DIR || join(homedir(), '.metro', 'agents');
+const MCP_TOKEN = /^mcp_[A-Za-z0-9_-]{43}$/;
 
 function readAgent() {
   const path = join(agentsDir(), 'agent.json');
@@ -17,8 +18,25 @@ function readAgent() {
   return parsed;
 }
 
-if (process.argv[2] !== 'headers') {
-  process.stderr.write('usage: metro-plugin.mjs headers\n');
+function readMcpToken() {
+  try {
+    const token = readFileSync(join(agentsDir(), 'mcp-token'), 'utf8').trim();
+    return MCP_TOKEN.test(token) ? token : null;
+  } catch {
+    return null;
+  }
+}
+
+const command = process.argv[2];
+
+if (command === 'mcp-headers') {
+  const token = readMcpToken();
+  if (token !== null) process.stdout.write(`${JSON.stringify({ Authorization: `Bearer ${token}` })}\n`);
+  process.exit(0);
+}
+
+if (command !== 'headers') {
+  process.stderr.write('usage: metro-plugin.mjs headers | mcp-headers\n');
   process.exit(1);
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/agent-user/view.ts

@@ -3,6 +3,8 @@ import { join } from 'node:path';
 import { errMsg, log } from '@metro-labs/core/log';
 import { isRecord } from '@metro-labs/core/is-record';
 import { agentsDir } from '../agents/files.js';
+import { mcpServerUrl } from '../mcp-server/config.js';
+import { MCP_TOKEN_FILE } from '../mcp-server/token.js';
 import { removeHome, writeHomeText } from './home-fs.js';
 import { closeMetroHome } from './metro-home.js';
 import { agentUser, agentViewDir, type AgentUser } from './user.js';
@@ -49,7 +51,8 @@ export function viewFiles(dir = agentsDir()): Map<string, string | null> {
     ['agent.json', agentFile(dir)],
     ['model.json', modelFile(dir)],
   ]);
-  for (const name of COPIED) files.set(name, existsSync(join(dir, name)) ? readText(join(dir, name)) : null);
+  const copied = mcpServerUrl() === null ? COPIED : [...COPIED, MCP_TOKEN_FILE];
+  for (const name of copied) files.set(name, existsSync(join(dir, name)) ? readText(join(dir, name)) : null);
   return files;
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/approvals/pending.ts

@@ -17,6 +17,7 @@ export interface PendingPrompt {
   line: string | undefined;
   at: number;
   call?: CallSource;
+  origin?: 'mcp-server';
 }
 
 interface Held extends PendingPrompt {
@@ -93,6 +94,8 @@ export const pendingPrompts = (): PendingPrompt[] => [...held.values()].map(show
 
 export const promptLine = (requestId: string): string | undefined => held.get(requestId)?.line;
 
+export const isPromptHeld = (requestId: string): boolean => held.has(requestId);
+
 function chatNotice(via: AnsweredVia, behavior: Behavior): string | undefined {
   if (via === 'expiry') return 'Expired, denied.';
   if (via === 'page') return behavior === 'allow' ? 'Approved on the page.' : 'Denied on the page.';
@@ -116,8 +119,12 @@ export async function answerPrompt(
   const entry = held.get(requestId);
   if (entry === undefined) return undefined;
   held.delete(requestId);
-  if (behavior === 'allow' && via !== 'expiry') grant(entry);
-  log.info({ requestId, tool: entry.tool, behavior, by: who === via ? via : `${via} ${who}` }, 'approvals: a Claude Code permission prompt answered');
+  const server = entry.origin === 'mcp-server';
+  if (behavior === 'allow' && via !== 'expiry' && !server) grant(entry);
+  log.info(
+    { requestId, tool: entry.tool, behavior, by: who === via ? via : `${via} ${who}` },
+    server ? 'approvals: an mcp.metro.box approval answered' : 'approvals: a Claude Code permission prompt answered',
+  );
   await entry.send(behavior);
   await tellChat(entry, via, behavior);
   return shown(entry);
@@ -152,7 +159,7 @@ export function revokeCallPrompts(route: CallRoute): void {
 
 export function settlePrompts(toolMatches: (tool: string) => boolean, args: Record<string, unknown>): void {
   for (const [id, entry] of held)
-    if (toolMatches(entry.tool) && previewMatches(entry.preview, args)) {
+    if (entry.origin !== 'mcp-server' && toolMatches(entry.tool) && previewMatches(entry.preview, args)) {
       held.delete(id);
       log.info({ requestId: id, tool: entry.tool }, 'approvals: the call reached metro, so Claude Code already closed the prompt');
     }

package/runtime/node_modules/@metro-labs/daemon/src/boot/boot.ts

@@ -25,6 +25,8 @@ import { connectorsReady, publishConnectors } from '../connectors/publication.js
 import { adoptOrgServerKeys } from '../connectors/org-adopt.js';
 import { readAgentKey } from '../connectors/agent-key.js';
 import { stopOrgConnectorSync, watchOrgConnectorSync } from '../connectors/org-sync-watch.js';
+import { stopMcpServer, watchMcpServer } from '../mcp-server/link.js';
+import { holdServerApproval } from '../mcp/server-approvals.js';
 import { ensureMetroPlugin } from '../claude/plugin-install.js';
 import { runningAsRoot } from '../metro-user/privilege.js';
 import { provisionAgentUser } from '../agent-user/provision.js';
@@ -161,6 +163,12 @@ installBearerSessions(agentsDir(), localOwner);
   startUploadReaper();
   startAttachReaper();
   watchOrgConnectorSync({ owner: localOwner, key: readAgentKey });
+  watchMcpServer({
+    owner: localOwner,
+    hold: (approval, answer) => {
+      holdServerApproval(approval, answer, emit);
+    },
+  });
   startCloudWatchPublisher();
   watchFallbackUsage();
   announceLocalEndpoint();
@@ -213,6 +221,9 @@ async function shutdown(): Promise<void> {
   shuttingDown = true;
   log.info('dispatcher shutting down');
   stopOrgConnectorSync(true);
+  stopMcpServer().catch((err: unknown) => {
+    log.warn({ err: errMsg(err) }, 'mcp-server: could not stop the approval relay');
+  });
   const leaving = leaveCallsForShutdown();
   unwatchSession();
   tunnel?.stop();

package/runtime/node_modules/@metro-labs/daemon/src/channels/inbound.ts

@@ -7,6 +7,7 @@ import {
   type SavedMedia,
 } from './media-note.js';
 import { buildWebhookNote } from './webhook-note.js';
+import { isMetroNotice } from './notice.js';
 import { replyMeta } from './addressed.js';
 import { reactContent, reactionEmoji } from './react-note.js';
 import {
@@ -285,7 +286,9 @@ export class InboundRelay {
     capSet(this.allowedLines, ALLOWED_LINES_MAX);
   }
 
-  private droppedSender(from: string, line: string, verified: unknown): boolean {
+  private droppedSender(ev: Record<string, unknown>, from: string, line: string): boolean {
+    if (isMetroNotice(ev)) return false;
+    const verified = ev.senderVerified;
     if (
       from.startsWith('metro://claude') ||
       from === 'metro://user' ||
@@ -311,7 +314,7 @@ export class InboundRelay {
     if (!this.deps.getStations().has(station)) return null;
     const from = str(ev.from);
     const line = str(ev.line);
-    if (this.droppedSender(from, line, ev.senderVerified)) return null;
+    if (this.droppedSender(ev, from, line)) return null;
     const text = str(ev.text);
     if (!replay && this.isDuplicate(station, line, evType, str(ev.messageId))) {
       this.deps.log(
@@ -337,7 +340,7 @@ export class InboundRelay {
     if (await this.handlePermissionReply(ev, base)) return;
     await this.notify('notifications/claude/channel', {
       content:
-        base.evType === 'system'
+        base.evType === 'system' && !isMetroNotice(ev)
           ? buildWebhookNote(base.text, str(ev.lineName), ev.payload)
           : base.text,
       meta: {

package/runtime/node_modules/@metro-labs/daemon/src/channels/notice.ts

@@ -0,0 +1,22 @@
+import { mintId, type MetroEvent } from '@metro-labs/core/events';
+import { isRecord } from '@metro-labs/core/is-record';
+import { asLine, Line } from '@metro-labs/core/lines';
+
+const NOTICE_FROM = 'metro://metro';
+const NOTICE_SOURCE = 'metro';
+
+export function metroNotice(line: string, text: string): MetroEvent {
+  return {
+    id: mintId(),
+    ts: new Date().toISOString(),
+    station: Line.station(line) ?? '',
+    line: asLine(line),
+    from: asLine(NOTICE_FROM),
+    to: asLine(line),
+    text,
+    event: { type: 'system', source: NOTICE_SOURCE },
+  };
+}
+
+export const isMetroNotice = (ev: Record<string, unknown>): boolean =>
+  ev.from === NOTICE_FROM && isRecord(ev.event) && ev.event.type === 'system' && ev.event.source === NOTICE_SOURCE;

package/runtime/node_modules/@metro-labs/daemon/src/claude/setup.ts

@@ -151,6 +151,7 @@ const PRIOR_METRO: ReadonlySet<string> = new Set([
   'e6b59eba825b4568dfa9ace5049fd9568a2e10d731719976ad2657084fd4e5f9',
   '5ce3f76d610aae91adc922d0edc6c8be1f27aa2fec4a5e3a6d6231a04fb9310b',
   'b910597d24f31fa479b130a2545f94dd23684d802d99e36b637fc57c818a33be',
+  'd3f7ed0f5175b9a7a77f06f6204ae0020369d0c8f6e2724196bb3c5822d4d8ba',
 ]);
 const PRIOR_STAGE: ReadonlySet<string> = new Set([
   'dd7d30474765de3865ddc87c1cf3220161ded09502027cdff18597e5df0aab43',

package/runtime/node_modules/@metro-labs/daemon/src/connectors/plugin-sync.ts

@@ -5,10 +5,12 @@ import { join } from 'node:path';
 import { errMsg, log } from '@metro-labs/core/log';
 import { claudeDir } from '../claude/files.js';
 import { loopbackBase } from '../files/attach-serve.js';
+import { MCP_SERVER_KEY, mcpServerUrl } from '../mcp-server/config.js';
 
 const MARKER = join('bin', 'metro-plugin.mjs');
 const FILE = '.mcp.json';
 const HELPER = 'node "${CLAUDE_PLUGIN_ROOT}/bin/metro-plugin.mjs" headers';
+const MCP_HELPER = 'node "${CLAUDE_PLUGIN_ROOT}/bin/metro-plugin.mjs" mcp-headers';
 const SLUG_MAX = 40;
 
 export interface PluginRow {
@@ -39,22 +41,25 @@ function availableKey(wanted: string, reserved: ReadonlySet<string>): string {
   return key;
 }
 
-export function serverKeysOf(rows: PluginRow[], saved?: ReadonlyMap<string, string>): Map<string, string> {
-  const keys = new Map(saved);
-  const reserved = new Set(keys.values());
+const reservedKeys = (): ReadonlySet<string> => new Set(mcpServerUrl() === null ? [] : [MCP_SERVER_KEY]);
+
+export function serverKeysOf(rows: PluginRow[], saved?: ReadonlyMap<string, string>, reserved: ReadonlySet<string> = reservedKeys()): Map<string, string> {
+  const keys = new Map([...(saved ?? [])].filter(([, key]) => !reserved.has(key)));
+  const used = new Set([...keys.values(), ...reserved]);
   for (const row of [...rows].sort((a, b) => a.id.localeCompare(b.id))) {
     if (keys.has(row.id)) continue;
-    const key = availableKey(serverKey(row.name), reserved);
-    reserved.add(key);
+    const key = availableKey(serverKey(row.name), used);
+    used.add(key);
     keys.set(row.id, key);
   }
   return keys;
 }
 
-export function pluginServers(rows: PluginRow[], base: string, keys: ReadonlyMap<string, string> = serverKeysOf(rows)): Record<string, PluginServer> {
+export function pluginServers(rows: PluginRow[], base: string, keys: ReadonlyMap<string, string> = serverKeysOf(rows), mcpUrl = mcpServerUrl()): Record<string, PluginServer> {
   const out: Record<string, PluginServer> = {};
   const visible = new Set(rows.map((row) => row.id));
   for (const [id, key] of keys) if (visible.has(id)) out[key] = { type: 'http', url: `${base}/relay/${id}`, headersHelper: HELPER };
+  if (mcpUrl !== null) out[MCP_SERVER_KEY] = { type: 'http', url: mcpUrl, headersHelper: MCP_HELPER };
   return out;
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/mcp/index.ts

@@ -19,6 +19,7 @@ import { errMsg } from '@metro-labs/core/log';
 import { channelLog, type McpSession } from './session.js';
 import { SessionSlot } from './session-slot.js';
 import { connectCallBridge } from './call-bridge.js';
+import { connectServerApprovals } from './server-approvals.js';
 import { handleIncomingDiagnostic } from './diagnostics.js';
 
 const isInitialize = (b: unknown): boolean =>
@@ -120,6 +121,7 @@ export async function createMetroMcp(options: { liveEvents?: boolean } = {}): Pr
   const voiceSlot = new SessionSlot(false, 'voice');
   activeSlots = [slot, voiceSlot];
   connectCallBridge(() => slot.current);
+  connectServerApprovals(() => slot.current);
 
   const httpHandler = async (
     req: IncomingMessage,

package/runtime/node_modules/@metro-labs/daemon/src/mcp/permission-prompt.ts

@@ -75,15 +75,16 @@ function metroLines(tool: string, input: Record<string, unknown>): string[] {
 
 const ARGS_MAX = 8;
 
-function connectorLines(name: string, tool: string, input: Record<string, unknown> | undefined): string[] {
-  const lines = [`Approval needed: ${tool}`, `Connector: ${name}`];
+function argLines(input: Record<string, unknown> | undefined): string[] {
   const args = Object.entries(input ?? {}).flatMap(([key, value]) => {
     const text = argText(value);
     return text === undefined ? [] : [`${key}: ${shorten(text)}`];
   });
-  lines.push(...args.slice(0, ARGS_MAX));
-  if (args.length > ARGS_MAX) lines.push(`(${String(args.length - ARGS_MAX)} more)`);
-  return lines;
+  return args.length > ARGS_MAX ? [...args.slice(0, ARGS_MAX), `(${String(args.length - ARGS_MAX)} more)`] : args;
+}
+
+function connectorLines(name: string, tool: string, input: Record<string, unknown> | undefined): string[] {
+  return [`Approval needed: ${tool}`, `Connector: ${name}`, ...argLines(input)];
 }
 
 function bodyLines(params: PermissionParams): string[] {
@@ -100,9 +101,27 @@ function bodyLines(params: PermissionParams): string[] {
   return [`Claude wants to run ${params.tool_name}: ${shorten(params.description)}`, '', ...raw];
 }
 
-export function promptBody(params: PermissionParams): string {
-  const answer = `Reply "yes ${params.request_id}" or "no ${params.request_id}"`;
-  const body = bodyLines(params).join('\n');
+function withAnswer(requestId: string, lines: string[]): string {
+  const answer = `Reply "yes ${requestId}" or "no ${requestId}"`;
+  const body = lines.join('\n');
   const room = PROMPT_MAX - answer.length - 3;
   return `${body.length > room ? `${body.slice(0, room)}…` : body}\n\n${answer}`;
 }
+
+export function promptBody(params: PermissionParams): string {
+  return withAnswer(params.request_id, bodyLines(params));
+}
+
+export interface ServerPrompt {
+  requestId: string;
+  tool: string;
+  connector: string | undefined;
+  preview: string;
+}
+
+export function serverPromptBody(prompt: ServerPrompt): string {
+  const { input } = readPreview(prompt.preview);
+  const raw = prompt.preview.trim() === '' ? [] : [shorten(prompt.preview, RAW_MAX)];
+  const args = input === undefined ? raw : argLines(input);
+  return withAnswer(prompt.requestId, [`Approval needed: ${prompt.tool}`, ...(prompt.connector === undefined ? [] : [`Connector: ${prompt.connector}`]), ...args]);
+}

package/runtime/node_modules/@metro-labs/daemon/src/mcp/permission-relay.ts

@@ -24,7 +24,7 @@ type PermissionRequest = z.infer<typeof PermissionRequestSchema>;
 
 const trainOf = (line: string): string => line.split('/')[2] ?? '';
 
-async function metroSend(line: string, text: string): Promise<void> {
+export async function metroSend(line: string, text: string): Promise<void> {
   await metroCall(trainOf(line), 'send', { line, text });
 }
 
@@ -36,15 +36,17 @@ export interface PermissionRelayDeps {
   log: (...a: unknown[]) => void;
 }
 
-const callChat = (deps: PermissionRelayDeps): string | undefined => {
+export type PromptLineDeps = Pick<PermissionRelayDeps, 'relay' | 'inScope' | 'live' | 'log'>;
+
+const callChat = (deps: PromptLineDeps): string | undefined => {
   const route = sharedCalls.snapshot();
   return route !== null && deps.inScope(route.line) ? route.line : undefined;
 };
 
-const ownerChat = (deps: PermissionRelayDeps, owner: OwnerLine | undefined): string | undefined =>
+const ownerChat = (deps: PromptLineDeps, owner: OwnerLine | undefined): string | undefined =>
   owner !== undefined && mayApprove(owner.line, owner.from) && deps.inScope(owner.line) && lineReceives(owner.line) ? owner.line : undefined;
 
-function relayLine(deps: PermissionRelayDeps, requestId: string, callLine?: string): string | undefined {
+export function relayLine(deps: PromptLineDeps, requestId: string, callLine?: string): string | undefined {
   if (!deps.live()) {
     deps.log('permission_request: live events are off, so no chat answer can arrive; held for the page only', requestId);
     return undefined;

package/runtime/node_modules/@metro-labs/daemon/src/mcp/server-approvals.ts

@@ -0,0 +1,109 @@
+import type { MetroEvent } from '@metro-labs/core/events';
+import { errMsg, log } from '@metro-labs/core/log';
+import type { McpApproval, McpDecision } from '@metro-labs/http/mcp-server-protocol';
+import { holdPrompt, isPromptHeld, type Behavior } from '../approvals/pending.js';
+import { ownerLine } from '../approvals/owner-line.js';
+import { metroNotice } from '../channels/notice.js';
+import { connectorGates } from '../connectors/gates.js';
+import { serverKey } from '../connectors/plugin-sync.js';
+import type { AnswerOutcome } from '../mcp-server/link.js';
+import { serverPromptBody } from './permission-prompt.js';
+import { metroSend, relayLine } from './permission-relay.js';
+import { channelLog, type McpSession } from './session.js';
+
+const RECENT_MS = 10 * 60_000;
+const RECENT_MAX = 1_000;
+
+const owner = {};
+const recent = new Map<string, number>();
+let current: () => McpSession | undefined = () => undefined;
+
+export function connectServerApprovals(session: () => McpSession | undefined): void {
+  current = session;
+}
+
+function promptLineFor(requestId: string): string | undefined {
+  const session = current();
+  if (session === undefined) return undefined;
+  return relayLine({ relay: session.relay, inScope: (line) => session.inScope(line), live: session.live, log: channelLog }, requestId);
+}
+
+const noticeLineFor = (line: string | undefined): string | undefined => line ?? current()?.relay.knownLine ?? ownerLine()?.line;
+
+function remember(id: string, now = Date.now()): void {
+  for (const [seen, at] of recent) if (now - at >= RECENT_MS) recent.delete(seen);
+  recent.set(id, now);
+  while (recent.size > RECENT_MAX) {
+    const oldest = recent.keys().next();
+    if (oldest.done) break;
+    recent.delete(oldest.value);
+  }
+}
+
+const answeredRecently = (id: string, now = Date.now()): boolean => now - (recent.get(id) ?? -Infinity) < RECENT_MS;
+
+function connectorName(key: string): string | undefined {
+  const names = new Set(connectorGates().filter((gate) => gate.server === key || serverKey(gate.name) === key).map((gate) => gate.name));
+  return names.size === 1 ? [...names][0] : undefined;
+}
+
+const noticeText = (tool: string, id: string, behavior: Behavior): string =>
+  behavior === 'allow' ? `Approved: ${tool} (${id}). Call call_tool again with the same arguments and approval: "${id}".` : `Denied: ${tool} (${id}).`;
+
+const requestedAt = (at: number, now = Date.now()): number => (Number.isFinite(at) && at > 0 ? Math.min(at, now) : now);
+
+interface Held {
+  id: string;
+  tool: string;
+  line: string | undefined;
+  answer: (decision: McpDecision) => Promise<AnswerOutcome>;
+  publish: (event: MetroEvent) => void;
+}
+
+async function deliver(held: Held, behavior: Behavior): Promise<void> {
+  const outcome = await held.answer(behavior);
+  if (outcome !== 'acknowledged') {
+    log.info({ id: held.id, outcome }, 'mcp-server: the answer was not taken, so the agent is not told');
+    return;
+  }
+  const line = noticeLineFor(held.line);
+  if (line === undefined) {
+    log.warn({ id: held.id }, 'mcp-server: no chat is known to tell the agent the answer');
+    return;
+  }
+  held.publish(metroNotice(line, noticeText(held.tool, held.id, behavior)));
+}
+
+function sender(held: Held): (behavior: Behavior) => Promise<void> {
+  return (behavior) => {
+    remember(held.id);
+    deliver(held, behavior).catch((err: unknown) => {
+      log.warn({ id: held.id, err: errMsg(err) }, 'mcp-server: the answer could not be delivered');
+    });
+    return Promise.resolve();
+  };
+}
+
+export function holdServerApproval(approval: McpApproval, answer: Held['answer'], publish: Held['publish']): boolean {
+  if (isPromptHeld(approval.id) || answeredRecently(approval.id)) return false;
+  const tool = `${approval.connector}.${approval.tool}`;
+  const name = connectorName(approval.connector);
+  const line = promptLineFor(approval.id);
+  const held: Held = { id: approval.id, tool, line, answer, publish };
+  holdPrompt(
+    { requestId: approval.id, tool, description: name ?? approval.connector, preview: approval.preview, line, at: requestedAt(approval.requestedAt), origin: 'mcp-server' },
+    owner,
+    sender(held),
+    line === undefined ? undefined : async (text) => metroSend(line, text),
+  );
+  log.info({ id: approval.id, tool, inChat: line !== undefined }, 'mcp-server: an approval is waiting for the owner');
+  if (line !== undefined)
+    metroSend(line, serverPromptBody({ requestId: approval.id, tool, connector: name, preview: approval.preview })).catch((err: unknown) => {
+      log.warn({ id: approval.id, err: errMsg(err) }, 'mcp-server: the approval prompt could not be posted');
+    });
+  return true;
+}
+
+export function forgetServerApprovals(): void {
+  recent.clear();
+}

package/runtime/node_modules/@metro-labs/daemon/src/mcp-server/config.ts

@@ -0,0 +1,29 @@
+import { log } from '@metro-labs/core/log';
+
+export const MCP_SERVER_KEY = 'mcp';
+
+const LOOPBACK = new Set(['localhost', '127.0.0.1', '[::1]']);
+
+let refused: string | undefined;
+
+function usable(raw: string): boolean {
+  let url: URL;
+  try {
+    url = new URL(raw);
+  } catch {
+    return false;
+  }
+  const secure = url.protocol === 'https:' || (url.protocol === 'http:' && LOOPBACK.has(url.hostname));
+  return secure && url.username === '' && url.password === '' && url.search === '' && url.hash === '';
+}
+
+export function mcpServerUrl(env: NodeJS.ProcessEnv = process.env): string | null {
+  const raw = env.METRO_MCP_SERVER_URL?.trim() ?? '';
+  if (raw === '') return null;
+  if (usable(raw)) return raw.replace(/\/+$/, '');
+  if (refused !== raw) {
+    refused = raw;
+    log.warn({ url: raw }, 'mcp-server: METRO_MCP_SERVER_URL must be an https url (http only on this machine), so it is ignored');
+  }
+  return null;
+}

package/runtime/node_modules/@metro-labs/daemon/src/mcp-server/link.ts

@@ -0,0 +1,186 @@
+import { errMsg, log } from '@metro-labs/core/log';
+import { MCP_APPROVAL_WAIT_MS, MCP_PATHS, mcpApprovalsOf, type McpApproval, type McpDecision } from '@metro-labs/http/mcp-server-protocol';
+import { agentsDir } from '../agents/files.js';
+import { readAgentKey, type AgentKey } from '../connectors/agent-key.js';
+import { agentCall, MetroApiRefusal, type AgentFetch, type MetroApi } from '../connectors/metro-api.js';
+import { mcpServerUrl } from './config.js';
+import { ensureMcpToken } from './token.js';
+
+export type AnswerOutcome = 'acknowledged' | 'gone' | 'stopped';
+
+export type HoldApproval = (approval: McpApproval, answer: (decision: McpDecision) => Promise<AnswerOutcome>) => void;
+
+export interface McpTiming {
+  retryMs: number;
+  retryMaxMs: number;
+  idleMs: number;
+  minPollMs: number;
+  pollTimeoutMs: number;
+}
+
+export interface McpLinkDeps {
+  url: string;
+  owner: () => string | null;
+  key: () => AgentKey | null;
+  dir: () => string;
+  hold: HoldApproval;
+  fetch?: AgentFetch;
+  timing?: Partial<McpTiming>;
+}
+
+const TIMING: McpTiming = { retryMs: 2_000, retryMaxMs: 60_000, idleMs: 30_000, minPollMs: 1_000, pollTimeoutMs: MCP_APPROVAL_WAIT_MS + 15_000 };
+const APPROVALS_MAX = 256 * 1024;
+
+const refusedWith = (err: unknown, status: number): boolean => err instanceof MetroApiRefusal && err.upstreamStatus === status;
+
+export class McpServerLink {
+  private readonly api: MetroApi;
+  private readonly timing: McpTiming;
+  private readonly abort = new AbortController();
+  private registered: string | null = null;
+  private failures = 0;
+  private running: Promise<void> | null = null;
+
+  constructor(private readonly deps: McpLinkDeps) {
+    this.api = { base: deps.url, fetch: deps.fetch ?? ((url, init) => fetch(url, init)), now: () => Date.now() };
+    this.timing = { ...TIMING, ...deps.timing };
+  }
+
+  private get stopped(): boolean {
+    return this.abort.signal.aborted;
+  }
+
+  start(): void {
+    this.running ??= this.run().catch((err: unknown) => {
+      log.error({ err: errMsg(err) }, 'mcp-server: the token and approval loop stopped');
+    });
+  }
+
+  async stop(): Promise<void> {
+    this.abort.abort();
+    await this.running;
+  }
+
+  async answer(id: string, decision: McpDecision): Promise<AnswerOutcome> {
+    for (let attempt = 0; !this.stopped; attempt += 1) {
+      if (attempt > 0) await this.pause(this.delay(attempt));
+      const key = this.enrolledKey();
+      if (key === null || this.stopped) continue;
+      try {
+        await agentCall(this.api, key, MCP_PATHS.answer, { id, decision }, { signal: this.abort.signal });
+        log.info({ id, decision }, 'mcp-server: the owner answer reached the server');
+        return 'acknowledged';
+      } catch (err) {
+        if (refusedWith(err, 404)) return 'gone';
+        if (refusedWith(err, 401)) this.registered = null;
+        if (!this.stopped) log.warn({ id, attempt: attempt + 1, err: errMsg(err) }, 'mcp-server: the owner answer did not reach the server; trying again');
+      }
+    }
+    return 'stopped';
+  }
+
+  private enrolledKey(): AgentKey | null {
+    try {
+      const key = this.deps.key();
+      const owner = this.deps.owner();
+      return key !== null && owner !== null && key.enrollment?.organization === owner ? key : null;
+    } catch (err) {
+      log.warn({ err: errMsg(err) }, 'mcp-server: the agent key could not be read');
+      return null;
+    }
+  }
+
+  private async run(): Promise<void> {
+    while (!this.stopped) {
+      const key = this.enrolledKey();
+      if (key === null) {
+        this.registered = null;
+        await this.pause(this.timing.idleMs);
+      } else if (await this.step(key)) this.failures = 0;
+      else await this.pause(this.delay(++this.failures));
+    }
+  }
+
+  private async step(key: AgentKey): Promise<boolean> {
+    let doing = 'register the MCP token';
+    try {
+      await this.register(key);
+      doing = 'ask for approvals';
+      await this.poll(key);
+      return true;
+    } catch (err) {
+      if (this.stopped) return true;
+      if (refusedWith(err, 401)) this.registered = null;
+      log.warn({ server: this.deps.url, failures: this.failures + 1, err: errMsg(err) }, `mcp-server: could not ${doing}; trying again`);
+      return false;
+    }
+  }
+
+  private async register(key: AgentKey): Promise<void> {
+    const token = ensureMcpToken(key.keyId, this.deps.dir());
+    if (token.fresh) log.info({ keyId: key.keyId }, 'mcp-server: made a new MCP token for this agent');
+    const binding = `${key.keyId} ${token.hash}`;
+    if (this.registered === binding) return;
+    await agentCall(this.api, key, MCP_PATHS.token, { tokenHash: token.hash }, { signal: this.abort.signal });
+    this.registered = binding;
+    log.info({ server: this.deps.url, keyId: key.keyId }, 'mcp-server: the MCP token is registered');
+  }
+
+  private async poll(key: AgentKey): Promise<void> {
+    const started = Date.now();
+    const answer = await agentCall(this.api, key, MCP_PATHS.approvals, {}, { signal: this.abort.signal, timeoutMs: this.timing.pollTimeoutMs, answerMax: APPROVALS_MAX });
+    const approvals = mcpApprovalsOf(answer);
+    for (const approval of approvals) this.receive(approval);
+    const rest = this.timing.minPollMs - (Date.now() - started);
+    if (approvals.length === 0 && rest > 0) await this.pause(rest);
+  }
+
+  private receive(approval: McpApproval): void {
+    try {
+      this.deps.hold(approval, (decision) => this.answer(approval.id, decision));
+    } catch (err) {
+      log.warn({ id: approval.id, err: errMsg(err) }, 'mcp-server: an approval could not be held');
+    }
+  }
+
+  private delay(attempt: number): number {
+    return Math.min(this.timing.retryMs * 2 ** Math.min(attempt - 1, 20), this.timing.retryMaxMs);
+  }
+
+  private pause(ms: number): Promise<void> {
+    if (this.stopped) return Promise.resolve();
+    const signal = this.abort.signal;
+    return new Promise((resolve) => {
+      const done = (): void => {
+        clearTimeout(timer);
+        signal.removeEventListener('abort', done);
+        resolve();
+      };
+      const timer = setTimeout(done, ms);
+      timer.unref();
+      signal.addEventListener('abort', done, { once: true });
+    });
+  }
+}
+
+let active: McpServerLink | null = null;
+
+export interface McpServerWatch {
+  owner: () => string | null;
+  hold: HoldApproval;
+}
+
+export function watchMcpServer(watch: McpServerWatch, env: NodeJS.ProcessEnv = process.env): boolean {
+  const url = mcpServerUrl(env);
+  if (url === null || active !== null) return false;
+  active = new McpServerLink({ url, owner: watch.owner, key: () => readAgentKey(), dir: agentsDir, hold: watch.hold });
+  active.start();
+  log.info({ server: url }, 'mcp-server: connector approvals relay from this server once the agent is enrolled');
+  return true;
+}
+
+export async function stopMcpServer(): Promise<void> {
+  const link = active;
+  active = null;
+  await link?.stop();
+}

package/runtime/node_modules/@metro-labs/daemon/src/mcp-server/token.ts

@@ -0,0 +1,50 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { isRecord } from '@metro-labs/core/is-record';
+import { writeSecure } from '@metro-labs/core/secure-fs';
+import { MCP_TOKEN_RE } from '@metro-labs/http/mcp-server-protocol';
+
+export const MCP_TOKEN_FILE = 'mcp-token';
+const BINDING_FILE = 'mcp-token.json';
+
+export interface McpToken {
+  token: string;
+  hash: string;
+  fresh: boolean;
+}
+
+export const mcpTokenHash = (token: string): string => createHash('sha256').update(token).digest('base64url');
+
+const readText = (path: string): string | null => {
+  try {
+    return readFileSync(path, 'utf8');
+  } catch {
+    return null;
+  }
+};
+
+export function readMcpToken(dir: string): string | null {
+  const text = readText(join(dir, MCP_TOKEN_FILE))?.trim() ?? '';
+  return MCP_TOKEN_RE.test(text) ? text : null;
+}
+
+function boundKeyId(dir: string): string | null {
+  const text = readText(join(dir, BINDING_FILE));
+  if (text === null) return null;
+  try {
+    const parsed: unknown = JSON.parse(text);
+    return isRecord(parsed) && parsed.version === 1 && typeof parsed.keyId === 'string' ? parsed.keyId : null;
+  } catch {
+    return null;
+  }
+}
+
+export function ensureMcpToken(keyId: string, dir: string): McpToken {
+  const kept = readMcpToken(dir);
+  if (kept !== null && boundKeyId(dir) === keyId) return { token: kept, hash: mcpTokenHash(kept), fresh: false };
+  const token = `mcp_${randomBytes(32).toString('base64url')}`;
+  writeSecure(join(dir, MCP_TOKEN_FILE), `${token}\n`);
+  writeSecure(join(dir, BINDING_FILE), `${JSON.stringify({ version: 1, keyId })}\n`);
+  return { token, hash: mcpTokenHash(token), fresh: true };
+}

package/runtime/node_modules/@metro-labs/http/package.json

@@ -24,7 +24,8 @@
     "./connector-input": "./src/connector-input.ts",
     "./connector-delivery": "./src/connector-delivery.ts",
     "./connector-migration": "./src/connector-migration.ts",
-    "./connector-grant": "./src/connector-grant.ts"
+    "./connector-grant": "./src/connector-grant.ts",
+    "./mcp-server-protocol": "./src/mcp-server-protocol.ts"
   },
   "scripts": {
     "build": "tsc",

package/runtime/node_modules/@metro-labs/http/src/connector-tools.ts

@@ -9,6 +9,7 @@ export interface RemoteTool {
   title: string;
   description: string;
   readOnly: boolean;
+  inputSchema?: Record<string, unknown>;
 }
 
 const TIMEOUT_MS = 15_000;
@@ -39,7 +40,7 @@ function toTool(raw: unknown): RemoteTool | null {
   if (!isRecord(raw) || typeof raw.name !== 'string') return null;
   const annotations = isRecord(raw.annotations) ? raw.annotations : {};
   const title = typeof raw.title === 'string' && raw.title !== '' ? raw.title : raw.name;
-  return { name: raw.name, title, description: typeof raw.description === 'string' ? raw.description : '', readOnly: annotations.readOnlyHint === true };
+  return { name: raw.name, title, description: typeof raw.description === 'string' ? raw.description : '', readOnly: annotations.readOnlyHint === true, ...(isRecord(raw.inputSchema) ? { inputSchema: raw.inputSchema } : {}) };
 }
 
 async function endSession(url: URL, auth: ConnectorAuth, session: Map<string, string>, fetchImpl?: FetchLike): Promise<void> {

package/runtime/node_modules/@metro-labs/http/src/mcp-server-protocol.ts

@@ -0,0 +1,81 @@
+import { isRecord } from '@metro-labs/core/is-record';
+
+export const MCP_PATHS = { token: '/v1/token', approvals: '/v1/approvals', answer: '/v1/approvals/answer' } as const;
+export const MCP_FIND_DEFAULT = 5;
+export const MCP_FIND_MAX = 20;
+export const MCP_CALLS_MAX = 10;
+export const MCP_QUERY_MAX = 500;
+export const MCP_APPROVAL_WAIT_MS = 25_000;
+export const MCP_APPROVAL_ID_RE = /^[a-km-z]{5}$/;
+export const MCP_TOKEN_RE = /^mcp_[A-Za-z0-9_-]{43}$/;
+
+export type McpErrorCode = 'blocked' | 'needs_approval' | 'denied' | 'not_found' | 'signin' | 'unavailable' | 'vendor_error' | 'invalid';
+
+export interface McpFindRequest {
+  query: string;
+  max_results: number;
+}
+
+export interface McpCall {
+  tool: string;
+  arguments: Record<string, unknown>;
+  approval?: string;
+}
+
+export interface McpApproval {
+  id: string;
+  connector: string;
+  tool: string;
+  preview: string;
+  requestedAt: number;
+}
+
+export type McpDecision = 'allow' | 'deny';
+
+const TOOL_RE = /^([a-z0-9][a-z0-9-]{0,62})\.([A-Za-z0-9_][A-Za-z0-9_.:/-]{0,127})$/;
+
+export function splitMcpTool(name: string): { connector: string; tool: string } | null {
+  const match = TOOL_RE.exec(name);
+  return match === null ? null : { connector: match[1] ?? '', tool: match[2] ?? '' };
+}
+
+export function mcpFindRequestOf(raw: unknown): McpFindRequest {
+  if (!isRecord(raw) || typeof raw.query !== 'string' || raw.query.trim() === '' || raw.query.length > MCP_QUERY_MAX) throw new Error('find_tools needs a query of 1 to 500 characters.');
+  const wanted = raw.max_results ?? MCP_FIND_DEFAULT;
+  if (typeof wanted !== 'number' || !Number.isInteger(wanted) || wanted < 1) throw new Error('max_results must be a whole number from 1.');
+  return { query: raw.query.trim(), max_results: Math.min(wanted, MCP_FIND_MAX) };
+}
+
+function callOf(raw: unknown): McpCall {
+  if (!isRecord(raw) || typeof raw.tool !== 'string' || splitMcpTool(raw.tool) === null) throw new Error('Each call needs a tool named <connector>.<tool>, as find_tools returns it.');
+  const args = raw.arguments ?? {};
+  if (!isRecord(args)) throw new Error(`The arguments of ${raw.tool} must be an object.`);
+  if (raw.approval !== undefined && (typeof raw.approval !== 'string' || !MCP_APPROVAL_ID_RE.test(raw.approval))) throw new Error('approval must be the 5-letter id the approval request gave.');
+  return { tool: raw.tool, arguments: args, ...(typeof raw.approval === 'string' ? { approval: raw.approval } : {}) };
+}
+
+export function mcpCallsOf(raw: unknown): McpCall[] {
+  const calls = isRecord(raw) ? raw.calls : undefined;
+  if (!Array.isArray(calls) || calls.length === 0 || calls.length > MCP_CALLS_MAX) throw new Error(`call_tool needs 1 to ${String(MCP_CALLS_MAX)} calls.`);
+  return calls.map(callOf);
+}
+
+export function mcpTokenHashOf(raw: unknown): string {
+  if (!isRecord(raw) || typeof raw.tokenHash !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(raw.tokenHash)) throw new Error('tokenHash must be the base64url SHA-256 of the MCP token.');
+  return raw.tokenHash;
+}
+
+function approvalOf(raw: unknown): McpApproval | null {
+  if (!isRecord(raw) || typeof raw.id !== 'string' || !MCP_APPROVAL_ID_RE.test(raw.id) || typeof raw.connector !== 'string' || typeof raw.tool !== 'string' || typeof raw.preview !== 'string' || typeof raw.requestedAt !== 'number') return null;
+  return { id: raw.id, connector: raw.connector, tool: raw.tool, preview: raw.preview, requestedAt: raw.requestedAt };
+}
+
+export function mcpApprovalsOf(raw: unknown): McpApproval[] {
+  if (!isRecord(raw) || !Array.isArray(raw.approvals)) throw new Error('Mcp sent an unreadable approval list.');
+  return raw.approvals.map(approvalOf).filter((row): row is McpApproval => row !== null);
+}
+
+export function mcpAnswerOf(raw: unknown): { id: string; decision: McpDecision } {
+  if (!isRecord(raw) || typeof raw.id !== 'string' || !MCP_APPROVAL_ID_RE.test(raw.id) || (raw.decision !== 'allow' && raw.decision !== 'deny')) throw new Error('An answer needs the approval id and allow or deny.');
+  return { id: raw.id, decision: raw.decision };
+}

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.303"
+  "version": "0.1.0-beta.304"
 }

package/runtime/sdk-runner/runner.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.0-beta.303",
+  "version": "0.1.0-beta.304",
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "0.3.287",
     "@modelcontextprotocol/sdk": "^1.29.0",