@ultimat3/mcp 9.0.0 → 11.0.0

package/CLAUDE.md

@@ -12,7 +12,7 @@ import. The CLI wires it.
 |---|---|
 | `wire.ts` | JSON-RPC types, error codes, protocol version, `JsonSchema` subset |
 | `registry.ts` | catalog + the first two security outcomes (visibility, scope) |
-| `audit.ts` | one structured line per `tools/call`, outcome → level |
+| `audit.ts` | one structured line per `tools/call` and per `resources/read`, outcome → level |
 | `validate-args.ts` | JSON-Schema-subset arg validation, applies defaults |
 | `server.ts` | JSON-RPC dispatch, `classify` for rate-limit buckets |
 | `from-action.ts` | action/query → tool; the "one authz system" projection; `toolsFrom` (sweep, skips) vs `toolsListed` (written out, refuses) |
@@ -113,6 +113,31 @@ import. The CLI wires it.
   terminal. `server.ts` renders it; the test pins it against `format()`, never a literal.
 - Every outcome is audited via `audit.ts`, hidden included, at `warn`. Never log arguments
   or row data — a denial reason naming a row is a leak wearing an audit line's clothes.
+  **On both surfaces**: `mcp.tool-call.<outcome>` from `toolsCall`, `mcp.resource-read.<outcome>`
+  from `resourcesRead`, one `LEVEL` table and one field builder behind them. `resources/read`
+  emitted nothing at all until 2026-08-23, so a URI walk over the four documents that describe an
+  app's whole policy and data map left no trace while the identical walk over tool NAMES was one
+  `warn` per attempt. Two EVENTS and not one, because an alert that buckets a document read as a
+  tool call cannot tell the two walks apart. `resources/list` and `tools/list` are both silent by
+  design — each is answered pre-filtered, so it reveals only what the caller could already see.
+  `resource-security.test.ts` reads BOTH streams: core's logger puts `error` on stderr.
+- **A tool that renders its OWN `isError` result may NAME the code it refused with**
+  (`McpToolResult.code`), and `outcomeForResult` sends it through the same `outcomeForCode` a
+  THROWN error goes through. Audit-only: `server.ts` never puts it on the wire, because the code is
+  already inside the rendered body. Without it every self-rendered refusal was `policy-denied` at
+  `warn` — so `@ultimat3/admin`'s `X_ADMIN_INVALID` (a client mistyping an argument the published
+  JSON Schema could not have refused: admin publishes a `type` per field and nothing else) sat in
+  the bucket this package's enumeration alert watches. `X_ADMIN_INVALID` is `ARGUMENT_CODES`;
+  `X_INPUT_INVALID` deliberately stays `failed`, because a projected action publishes its WHOLE
+  schema and input this server already validated failing inside it means the two have drifted.
+  A result naming no code keeps the conservative `policy-denied`.
+- **A `--` comment ends at the first CR *or* LF, because that is Postgres' own boundary set**
+  (`readonly-sql.ts`). `non_newline` is `[^\n\r]`, so a bare CR ends the comment for the SERVER
+  and did not for this scanner: `select 1;--\rupdate members set role='admin'` was one statement
+  with no mutating keyword to all five layer-3 checks at once — the statement split, the read-leader
+  check, the write-keyword scan, the forbidden-call scan and the `FOR UPDATE` regex all read the
+  stripped form — and `verbatim()` handed the caller's bytes back to run. `endOfLineComment` is the
+  lexer's set, never one character of it, the same shape `skipSingleQuoted` already had.
 - `security.test.ts` and `app-security.test.ts` are the executable contract for all of the
   above — the first over hand-built tools (each gate in isolation), the second over what an app
   actually declares (`defineAppMcp` projecting real actions and queries). Extend them, never
@@ -191,6 +216,17 @@ import. The CLI wires it.
 - `db.query` / `db.migrate` refuse structurally, in `readonly-sql.ts`, before the host runs
   (`X_MCP_QUERY_REJECTED` / `X_MCP_NOT_BRANCH_DB` — one code each, because they want different
   next commands).
+- `pg_notify` and the server-control / replication families are banned for the reason every other
+  family is: the same ban already exists in another spelling. `notify`/`listen`/`unlisten` are
+  WRITE KEYWORDS, so `pg_notify()` is `NOTIFY` as a call the keyword scan cannot see;
+  `pg_cancel_backend`/`pg_terminate_backend` establish that server control belongs, so
+  `pg_reload_*`, `pg_rotate_*`, `pg_switch_*`, `pg_promote` and `pg_wal_replay_*` join them; and
+  `pg_logical_slot_get_changes` is `nextval`'s argument exactly — it advances a slot's confirmed
+  position, a write with no keyword that no `ROLLBACK` undoes — which brings `pg_create_*`,
+  `pg_drop_*`, `pg_replication_*` and `pg_logical_*` with it. `pg_file_*` is the writing half of
+  `pg_read_*`. `txid_current`/`pg_current_xact_id` ASSIGN a transaction id a rollback does not
+  return. The catalog VIEWS beside them (`pg_replication_slots`, `pg_stat_replication`) are read
+  `from` and never called, so the call scan never sees them.
 - Banned SQL functions are matched as a **prefix of a CALLED function name**, so the family is the
   unit and a spelling nobody wrote down is refused rather than admitted — an exact-name list let
   `pg_sleep_for` past a ban on `pg_sleep`, and `set_config` past `SET`, which is already a write

package/README.md

@@ -79,7 +79,7 @@ strand a well-behaved client.
 | A predicate audience sees the caller and nothing else | it is handed `McpCaller` — never the call arguments, so two calls with different inputs cannot answer differently. Must return the literal `true`; if it throws, the tool is hidden |
 | `tools/list` is answered per caller | filtered on every call against the caller the transport resolved — one per HTTP request, one per stdio connection — never a static catalog |
 | Gate order | visibility → scope → arguments → policy; the scope gate never waits on a policy run against attacker-supplied input |
-| Every outcome is audited | one line per `tools/call`; hidden/scope/policy at `warn`, ok at `info` — see `audit.ts` |
+| Every outcome is audited | one line per `tools/call`; hidden/scope/policy at `warn`, ok and invalid-args at `info` — see `audit.ts`. A tool that renders its OWN `isError` result may name the code it refused with (`McpToolResult.code`, audit-only, never on the wire) and is then classified by the same `outcomeForCode` a thrown error is — otherwise every self-rendered refusal lands in the `policy-denied` bucket a prober's name walk is alerted from |
 | Audit lines carry no payload | tool, outcome, actor, code. Never arguments, never rows |
 | No trusted-tool mode | there is no flag that skips policy evaluation |
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/mcp",
-  "version": "9.0.0",
+  "version": "11.0.0",
   "description": "MCP server, dev tools, and the action-to-tool projection — one authz system, two surfaces",
   "license": "MIT",
   "type": "module",
@@ -31,12 +31,12 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ultimat3/action": "9.0.0",
-    "@ultimat3/core": "9.0.0",
-    "@ultimat3/entity": "9.0.0",
-    "@ultimat3/jobs": "9.0.0",
-    "@ultimat3/policy": "9.0.0",
-    "@ultimat3/query": "9.0.0",
-    "@ultimat3/schema": "9.0.0"
+    "@ultimat3/action": "11.0.0",
+    "@ultimat3/core": "11.0.0",
+    "@ultimat3/entity": "11.0.0",
+    "@ultimat3/jobs": "11.0.0",
+    "@ultimat3/policy": "11.0.0",
+    "@ultimat3/query": "11.0.0",
+    "@ultimat3/schema": "11.0.0"
   }
 }

package/src/audit.ts

@@ -1,5 +1,5 @@
-// One structured line per `tools/call`, whatever the outcome — including the outcomes that
-// deliberately tell the caller nothing.
+// One structured line per `tools/call` and per `resources/read`, whatever the outcome — including
+// the outcomes that deliberately tell the caller nothing.
 //
 // The three-outcome model works by giving a prober no signal. That is a property of the
 // ANSWER, not of the system: enumeration is a pattern across many requests, so the refusal
@@ -36,11 +36,46 @@ export type McpOutcome =
  * entry classified a code no build can produce — and every real denial that reached it still had
  * to be recognised by one of the other two.
  */
-const DENIAL_CODES: ReadonlySet<string> = new Set(['X_FORBIDDEN', 'X_UNAUTHENTICATED']);
+const DENIAL_CODES: ReadonlySet<string> = new Set([
+  'X_ADMIN_DENIED',
+  'X_FORBIDDEN',
+  'X_UNAUTHENTICATED',
+]);
+
+/**
+ * Codes that mean the CALLER got the arguments wrong, in a way the published JSON Schema could
+ * not have refused. `X_ADMIN_INVALID` is the case: `@ultimat3/admin` publishes a `type` per field
+ * and nothing else, so an entity's own rules are the first thing a value meets, and a mistyped
+ * `admin.create` is a client misreading a schema — `invalid-args`, at `info`.
+ *
+ * `X_INPUT_INVALID` deliberately stays OUT: a projected action publishes its whole schema, so
+ * input this server already validated failing inside the action means the two have drifted, and
+ * that wants a human.
+ */
+const ARGUMENT_CODES: ReadonlySet<string> = new Set(['X_ADMIN_INVALID']);
 
 /** Classify a code a tool threw. Denials are outcome 3; everything else wants a human. */
 export function outcomeForCode(code: string): McpOutcome {
-  return DENIAL_CODES.has(code) ? 'policy-denied' : 'failed';
+  if (DENIAL_CODES.has(code)) return 'policy-denied';
+  return ARGUMENT_CODES.has(code) ? 'invalid-args' : 'failed';
+}
+
+/**
+ * Classify a result a tool RENDERED rather than threw.
+ *
+ * A tool may answer `isError` itself — `@ultimat3/admin` does, so the model reads code/cause/fix
+ * instead of a transport failure — and that answer used to be audited `policy-denied` at `warn`
+ * whatever it refused for. So a malformed `admin.create` landed in the bucket this file exists to
+ * make alertable: every refusal a prober can drive. A result that NAMES its code goes through
+ * `outcomeForCode`, the same classifier a thrown one goes through; one that names none keeps the
+ * conservative reading, because a tool cannot be assumed to have refused for a benign reason.
+ */
+export function outcomeForResult(result: {
+  readonly isError?: boolean;
+  readonly code?: string;
+}): McpOutcome {
+  if (result.isError !== true) return 'ok';
+  return result.code === undefined ? 'policy-denied' : outcomeForCode(result.code);
 }
 
 export interface McpAuditEntry {
@@ -53,19 +88,31 @@ export interface McpAuditEntry {
   readonly code?: string;
 }
 
+/** The same entry for the DOCUMENT surface, addressed by URI rather than by tool name. */
+export interface McpResourceAuditEntry {
+  readonly uri: string;
+  readonly outcome: McpOutcome;
+  readonly caller: McpCaller;
+  readonly scope?: string;
+  readonly code?: string;
+}
+
 /**
  * Severity per outcome. Every refusal a prober can drive is `warn` so one alert rule covers
  * the whole enumeration surface; `invalid-args` is a well-behaved client misreading a schema,
  * and an unexpected throw is the only `error` because it is the only one that is a bug.
  */
-const LEVEL = Object.freeze<Record<McpOutcome, 'info' | 'warn' | 'error'>>({
-  ok: 'info',
-  hidden: 'warn',
-  'scope-denied': 'warn',
-  'policy-denied': 'warn',
-  'invalid-args': 'info',
-  failed: 'error',
-});
+const LEVEL: ReadonlyMap<McpOutcome, 'info' | 'warn' | 'error'> = new Map([
+  ['ok', 'info'],
+  ['hidden', 'warn'],
+  ['scope-denied', 'warn'],
+  ['policy-denied', 'warn'],
+  ['invalid-args', 'info'],
+  ['failed', 'error'],
+]);
+// An outcome is a closed union, so the `Map` is total; `?? 'error'` is the type's witness, not a
+// reachable branch — a `Map` rather than a literal because the key is data (`proto-index`).
+const levelOf = (outcome: McpOutcome): 'info' | 'warn' | 'error' => LEVEL.get(outcome) ?? 'error';
 
 /**
  * Audit one call. `log` is a parameter so a test can read the line it produced; production
@@ -76,9 +123,41 @@ const LEVEL = Object.freeze<Record<McpOutcome, 'info' | 'warn' | 'error'>>({
  * that names `post p_42 in org o_9` is a row leak wearing an audit line's clothes.
  */
 export function auditToolCall(entry: McpAuditEntry, log: Logger = logger): void {
-  const fields: LogFields = {
-    surface: 'mcp',
+  // `<subsystem>.<event>.<outcome>`, matching every other structured line in the framework,
+  // so `x logs --json | grep mcp.tool-call.hidden` is the whole enumeration alert.
+  log[levelOf(entry.outcome)](`mcp.tool-call.${entry.outcome}`, {
     tool: entry.tool,
+    ...callerFields(entry),
+  });
+}
+
+/**
+ * Audit one `resources/read`, on the same three outcomes and at the same levels.
+ *
+ * The document surface owed this and emitted nothing at all: a URI walk over the four documents an
+ * app publishes — the manifest, the OpenAPI document, the route table and the entity schema, which
+ * together are its whole policy and data map — left no trace anywhere, while the identical walk
+ * over tool NAMES was one `warn` per attempt. The refusal that tells the caller nothing is exactly
+ * the one that has to reach whoever reads the logs.
+ *
+ * A separate EVENT rather than a `tool:` field holding a URI: an alert rule that buckets a
+ * document read as a tool call cannot tell the two walks apart, and a field named `tool` carrying
+ * `ultimate://manifest` is a lie a query has to work around forever.
+ *
+ * `resources/list` is deliberately NOT audited, exactly as `tools/list` is not — it is answered
+ * pre-filtered, so it reveals only what the caller could already see.
+ */
+export function auditResourceRead(entry: McpResourceAuditEntry, log: Logger = logger): void {
+  log[levelOf(entry.outcome)](`mcp.resource-read.${entry.outcome}`, {
+    resource: entry.uri,
+    ...callerFields(entry),
+  });
+}
+
+/** What every audit line carries whatever it is about. Fields carry the DECISION, never the data. */
+function callerFields(entry: McpResourceAuditEntry | McpAuditEntry): LogFields {
+  return {
+    surface: 'mcp',
     outcome: entry.outcome,
     actor: entry.caller.actor.id,
     actorKind: entry.caller.actor.kind,
@@ -86,7 +165,4 @@ export function auditToolCall(entry: McpAuditEntry, log: Logger = logger): void
     ...(entry.scope === undefined ? {} : { scope: entry.scope }),
     ...(entry.code === undefined ? {} : { code: entry.code }),
   };
-  // `<subsystem>.<event>.<outcome>`, matching every other structured line in the framework,
-  // so `x logs --json | grep mcp.tool-call.hidden` is the whole enumeration alert.
-  log[LEVEL[entry.outcome]](`mcp.tool-call.${entry.outcome}`, fields);
 }

package/src/errors.ts

@@ -42,7 +42,12 @@ registerErrorCodes(
   Object.fromEntries(Object.entries(MCP_ERROR_TITLES).map(([code, title]) => [code, { title }])),
 );
 
-const docsFor = (code: McpErrorCode): string => `https://ultimate.dev/errors/${code}`;
+// No `docs:` on the subclasses below. `UltimateError` fills it from `describeErrorCode(code).docs`,
+// which is `@ultimat3/core`'s `ERROR_DOCS_URL` — one page for every code, never one per code, because
+// `wiki/` is the framework's only public documentation surface and a code lives there in a TABLE ROW,
+// which has no anchor. The `https://ultimate.dev/errors/<code>` links this file built until 9.x
+// answered 404, host included, on every error it has ever thrown; restating the replacement here
+// would be the same constant in eight places waiting to drift again.
 
 /**
  * OUTCOME 1 of three: a tool name reached the dispatcher that no VISIBLE tool answers to —
@@ -59,7 +64,6 @@ export class McpToolUnknownError extends UltimateError {
         input.visible.length > 0 ? input.visible.join(', ') : 'none'
       })`,
       fix: 'call tools/list to read the catalog this caller may use',
-      docs: docsFor('X_MCP_TOOL_UNKNOWN'),
     });
   }
 }
@@ -87,7 +91,6 @@ export class McpScopeDeniedError extends UltimateError {
         subject === 'tool'
           ? `reconnect with a token whose scopes include "${input.scope}" — the app's resolveToken(token) is what returns them — or drop "${input.scope}" from defineAppMcp({ scopes }); scopes are fixed for the life of a connection`
           : `reconnect with a token whose scopes include "${input.scope}" — the app's resolveToken(token) is what returns them — or drop scope: '${input.scope}' from the resource declaring "${input.name}"; scopes are fixed for the life of a connection`,
-      docs: docsFor('X_MCP_SCOPE_DENIED'),
     });
     this.scope = input.scope;
   }
@@ -100,7 +103,6 @@ export class McpArgsInvalidError extends UltimateError {
       code: 'X_MCP_ARGS_INVALID',
       cause: `arguments for "${input.name}" are invalid: ${input.issues.join('; ')}`,
       fix: `re-read the tool's inputSchema from tools/list and resend`,
-      docs: docsFor('X_MCP_ARGS_INVALID'),
     });
   }
 }
@@ -116,7 +118,6 @@ export class McpToolUnsafeError extends UltimateError {
       code: 'X_MCP_TOOL_UNSAFE',
       cause: `tool "${input.name}" declares no policy; an unguarded tool is a second door into the data`,
       fix: `add policy: '<resource>:<verb>' to the tool, reusing the permission its action uses`,
-      docs: docsFor('X_MCP_TOOL_UNSAFE'),
     });
   }
 }
@@ -143,7 +144,6 @@ export class McpToolUndeclaredError extends UltimateError {
       fix:
         "add mcp: { expose: true, description: '<what it does>' } beside the policy on each — " +
         "or drop it from the list and let include: 'exposed' project what opted in",
-      docs: docsFor('X_MCP_TOOL_UNDECLARED'),
     });
     this.names = input.names;
   }
@@ -176,7 +176,6 @@ export class McpToolDuplicateError extends UltimateError {
         sites.length > 0
           ? `rename one — "${input.name}" is projected by ${sites.join(' and ')}; change the name at one of them`
           : "rename one: the tool name is the primitive's export name, the `tools` record key, or an admin action's `name`",
-      docs: docsFor('X_MCP_TOOL_DUPLICATE'),
     });
     this.declaredBy = sites;
   }
@@ -194,7 +193,6 @@ export class McpResourceDuplicateError extends UltimateError {
       code: 'X_MCP_RESOURCE_DUPLICATE',
       cause: `two resources are registered at "${input.uri}"; a URI addresses one document`,
       fix: `give one of them its own URI — register({ uri: '${input.uri}-<what-it-is>', … }) — or drop the duplicate registration`,
-      docs: docsFor('X_MCP_RESOURCE_DUPLICATE'),
     });
   }
 }
@@ -215,7 +213,6 @@ export class McpScopeUnknownError extends UltimateError {
       code: 'X_MCP_SCOPE_UNKNOWN',
       cause: `scopes["${input.scope}"] names "${input.name}", which this server does not project (projected: ${projected})`,
       fix: `in defineAppMcp, spell it as one of the projected names above — or drop "${input.name}" from scopes["${input.scope}"]`,
-      docs: docsFor('X_MCP_SCOPE_UNKNOWN'),
     });
     this.projected = input.projected;
   }
@@ -239,7 +236,6 @@ export class McpScopeConflictError extends UltimateError {
       code: 'X_MCP_SCOPE_CONFLICT',
       cause: `tool "${input.name}" is claimed by two scopes ("${input.scopes[0]}" and "${input.scopes[1]}"); a tool carries one`,
       fix: `in defineAppMcp, keep "${input.name}" under the single scope a token must hold for it, and remove the other entry`,
-      docs: docsFor('X_MCP_SCOPE_CONFLICT'),
     });
     this.scopes = input.scopes;
   }
@@ -252,7 +248,6 @@ export class McpProtocolError extends UltimateError {
       code: 'X_MCP_PROTOCOL',
       cause: input.cause,
       fix: input.fix ?? `send a JSON-RPC 2.0 body: { jsonrpc: '2.0', id, method, params }`,
-      docs: docsFor('X_MCP_PROTOCOL'),
     });
   }
 }
@@ -275,7 +270,6 @@ export class McpQueryRejectedError extends UltimateError {
       code: 'X_MCP_QUERY_REJECTED',
       cause: input.cause,
       fix: input.fix,
-      docs: docsFor('X_MCP_QUERY_REJECTED'),
     });
   }
 }
@@ -295,7 +289,6 @@ export class McpNotBranchDbError extends UltimateError {
       code: 'X_MCP_NOT_BRANCH_DB',
       cause: input.cause,
       fix: input.fix,
-      docs: docsFor('X_MCP_NOT_BRANCH_DB'),
     });
   }
 }

package/src/index.ts

@@ -13,8 +13,8 @@ export type {
 export { appToolPrimitive, appToolPrimitives } from './app-tool';
 export type { AppMcp, AppToolSchemas, DefineAppMcpInput } from './app-tools';
 export { defineAppMcp } from './app-tools';
-export type { McpAuditEntry, McpOutcome } from './audit';
-export { auditToolCall, outcomeForCode } from './audit';
+export type { McpAuditEntry, McpOutcome, McpResourceAuditEntry } from './audit';
+export { auditResourceRead, auditToolCall, outcomeForCode } from './audit';
 export type { CreateDevServerInput } from './dev-host';
 export { createDevServer, devHost, frameworkIntrospection } from './dev-host';
 export type {

package/src/readonly-sql.ts

@@ -89,7 +89,22 @@ const WRITE_KEYWORDS = new Set([
  *  - ADVANCE A SEQUENCE (`nextval`, `setval`) — a write that leaves no keyword behind, and one
  *    `ROLLBACK` does not undo: a consumed sequence value is gone, so a read can silently burn the
  *    next id a real insert would have taken. `currval`/`lastval` read the session and stay legal.
+ *    `txid_current`/`pg_current_xact_id` are the same ban one level down: they ASSIGN a real
+ *    transaction id to a read, and a rollback does not give it back;
+ *  - PUBLISH A MESSAGE — `pg_notify` is `NOTIFY` spelled as a call, and `notify`, `listen` and
+ *    `unlisten` are all write keywords above. The keyword scan cannot see it: it is one token;
+ *  - CONTROL THE SERVER (`pg_reload_*`, `pg_rotate_*`, `pg_switch_*`, `pg_promote`,
+ *    `pg_wal_replay_*`) — the family `pg_cancel_backend`/`pg_terminate_backend` already
+ *    established, in the spellings that reconfigure or fail over the server rather than a backend;
+ *  - CONSUME THE REPLICATION STREAM (`pg_create_*`, `pg_drop_*`, `pg_replication_*`,
+ *    `pg_logical_*`) — `pg_logical_slot_get_changes` advances a slot's confirmed position, so the
+ *    changes it returned are gone for the real consumer. Exactly the `nextval` argument: a write
+ *    with no keyword, and no `ROLLBACK` undoes it. The catalog VIEWS beside them
+ *    (`pg_replication_slots`, `pg_stat_replication`) are read `from`, never called, so the call
+ *    scan never sees them;
+ *  - WRITE A FILE (`pg_file_*`) — the other half of `pg_read_*`, which was banned from the start.
  *
+
  * The prefix is applied to a CALL — a name followed by `(` — and never to a bare word, so a
  * column called `pg_sleep_for_seconds` stays readable. Quoting does not evade it: the scan reads
  * a form where a quoted identifier keeps its content, because `"pg_advisory_lock"(1)` is the same
@@ -101,15 +116,31 @@ const FORBIDDEN_FUNCTIONS = [
   'nextval',
   'pg_advisory_',
   'pg_cancel_backend',
+  'pg_create_',
+  'pg_current_xact_id',
+  'pg_drop_',
+  'pg_file_',
+  'pg_logical_',
   'pg_ls_',
+  'pg_notify',
+  'pg_promote',
   'pg_read_',
+  'pg_reload_',
+  'pg_replication_',
+  'pg_rotate_',
   'pg_sleep',
   'pg_stat_file',
   'pg_stat_reset',
+  // Not reachable from `pg_stat_reset`: the extension spells the same reset with the statistics
+  // view's name in the middle, so a prefix of one is not a prefix of the other.
+  'pg_stat_statements_reset',
+  'pg_switch_',
   'pg_terminate_backend',
   'pg_try_advisory_',
+  'pg_wal_replay_',
   'set_config',
   'setval',
+  'txid_current',
 ];
 
 /** The family refusing `called`, or `undefined`. A prefix, so a new member is refused by default. */
@@ -291,8 +322,7 @@ function stripLiteralsAndComments(sql: string, identifiers: 'blank' | 'keep' = '
   while (i < sql.length) {
     const two = sql.slice(i, i + 2);
     if (two === '--') {
-      const end = sql.indexOf('\n', i);
-      i = end === -1 ? sql.length : end;
+      i = endOfLineComment(sql, i);
       out += ' ';
       continue;
     }
@@ -336,6 +366,24 @@ function stripLiteralsAndComments(sql: string, identifiers: 'blank' | 'keep' = '
   return out;
 }
 
+/**
+ * Where a `--` comment ends: the first CR **or** LF, or the end of the input.
+ *
+ * The boundary set is the lexer's, never one character of it. Postgres defines a line comment as
+ * `--` followed by `non_newline*`, and `non_newline` is `[^\n\r]` — so a bare CR ends the comment
+ * for the server. Scanning for `\n` alone blanked everything after a CR, and that tail is real SQL
+ * the server runs: `select 1;--\rupdate members set role='admin'` was one statement with no
+ * mutating keyword to every check in this file, and was handed back verbatim to be executed.
+ * Same shape as `skipSingleQuoted` below, which reads Postgres' escape rules rather than one of them.
+ */
+function endOfLineComment(sql: string, start: number): number {
+  for (let i = start + 2; i < sql.length; i += 1) {
+    const char = sql[i];
+    if (char === '\n' || char === '\r') return i;
+  }
+  return sql.length;
+}
+
 /** A quoted run's content: the delimiters dropped, SQL's doubled-quote escape collapsed. */
 function inner(run: string): string {
   const closed = run.length > 1 && run.endsWith(run[0] ?? '');

package/src/registry.ts

@@ -66,6 +66,16 @@ export type ContentBlock =
 export interface McpToolResult {
   readonly content: readonly ContentBlock[];
   readonly isError?: boolean;
+  /**
+   * The `X_*` code an `isError` result refused with. AUDIT ONLY — never written to the wire,
+   * because the code is already in the rendered body the model reads.
+   *
+   * A tool that renders its own refusal was otherwise audited `policy-denied` whatever it refused
+   * for, so a tool's own ARGUMENT check landed in the bucket a prober's name walk is alerted from.
+   * Naming the code sends it through `outcomeForCode`, the classifier a THROWN error already goes
+   * through. Absent keeps the conservative reading.
+   */
+  readonly code?: string;
 }
 
 export type ToolArgs = Record<string, unknown>;

package/src/server.ts

@@ -5,7 +5,7 @@
 
 import { singleLine, stringField } from '@ultimat3/core';
 import { formatIssues } from '@ultimat3/schema';
-import { auditToolCall, outcomeForCode } from './audit';
+import { auditResourceRead, auditToolCall, outcomeForCode, outcomeForResult } from './audit';
 import { McpScopeDeniedError } from './errors';
 import type { AnyMcpTool, McpCaller, McpToolResult, McpVerbClass, ToolListEntry } from './registry';
 import { ToolRegistry } from './registry';
@@ -202,12 +202,16 @@ export class McpServer {
       return errorResponse(id, INTERNAL_ERROR, `tool "${name}" failed unexpectedly`);
     }
 
-    // A tool may answer `isError` itself (admin renders its own denial): still outcome 3.
+    // A tool may answer `isError` itself (admin renders its own denial). Outcome 3 unless it
+    // NAMED the code it refused with, in which case the same classifier a thrown error goes
+    // through decides — a tool's own argument check is not a denial a prober drove.
     auditToolCall({
       tool: name,
-      outcome: result.isError === true ? 'policy-denied' : 'ok',
+      outcome: outcomeForResult(result),
       caller,
+      ...(result.code === undefined ? {} : { code: result.code }),
     });
+    // `code` is audit-only and never reaches the wire: it is already inside the rendered body.
     const payload: Record<string, unknown> = { content: result.content };
     if (result.isError === true) payload['isError'] = true;
     return resultResponse(id, payload);
@@ -217,6 +221,11 @@ export class McpServer {
    * The same three-outcome shape `toolsCall` above applies, on the document surface. It took no
    * caller at all until 2026-08: every accepted token could list every URI and read every one of
    * them — the manifest, the OpenAPI document, the route table and the entity schema.
+   *
+   * And every outcome is AUDITED, hidden included, exactly as `toolsCall`'s are: this method
+   * emitted nothing at all, so a URI walk over those four documents was invisible while the same
+   * walk over tool names was one `warn` per attempt. `resources/list` stays silent, as
+   * `tools/list` does — it is answered pre-filtered.
    */
   private async resourcesRead(req: JsonRpcRequest, caller: McpCaller): Promise<JsonRpcResponse> {
     const id = req.id ?? null;
@@ -228,8 +237,11 @@ export class McpServer {
     const resolved = this.resources.resolve(uri, caller);
     switch (resolved.kind) {
       // OUTCOME 1. Absent AND hidden collapse to one answer with no `data`: this branch used to
-      // return `available: [...every uri]`, so one wrong guess enumerated the whole catalog.
+      // return `available: [...every uri]`, so one wrong guess enumerated the whole catalog. No
+      // `code` on the audit line either, because the wire carries none — the tool surface's
+      // `X_MCP_TOOL_UNKNOWN` is an error class this branch has no twin for.
       case 'not-found':
+        auditResourceRead({ uri, outcome: 'hidden', caller });
         return errorResponse(id, METHOD_NOT_FOUND, `resource not found: ${uri}`);
       // OUTCOME 2. The caller can already see this resource, so naming the missing scope leaks
       // nothing — and the fix travels with it, built by the error that owns the wording.
@@ -239,6 +251,13 @@ export class McpServer {
           scope: resolved.scope,
           subject: 'resource',
         });
+        auditResourceRead({
+          uri,
+          outcome: 'scope-denied',
+          caller,
+          scope: resolved.scope,
+          code: denial.code,
+        });
         return errorResponse(id, INVALID_REQUEST, `missing scope: ${resolved.scope}`, {
           code: denial.code,
           scope: resolved.scope,
@@ -258,12 +277,17 @@ export class McpServer {
     try {
       const contents = await this.resources.read(uri);
       if (contents === undefined) {
+        // The resolver said `ok` and the registry then had nothing: a bug here, not a walk, so it
+        // is `failed` in the log while the caller still gets the same not-found it would have.
+        auditResourceRead({ uri, outcome: 'failed', caller });
         return errorResponse(id, METHOD_NOT_FOUND, `resource not found: ${uri}`);
       }
+      auditResourceRead({ uri, outcome: 'ok', caller });
       return resultResponse(id, { contents: [contents] });
     } catch (error) {
       const framework = asFrameworkError(error);
       if (framework !== undefined) {
+        auditResourceRead({ uri, outcome: 'failed', caller, code: framework.code });
         return errorResponse(id, INTERNAL_ERROR, `resource "${uri}" could not be read`, {
           code: framework.code,
           cause: framework.cause,
@@ -272,6 +296,7 @@ export class McpServer {
       }
       // No internals: a provider's own message names a path, a query or a host the caller has no
       // business seeing, exactly as a failing tool's does.
+      auditResourceRead({ uri, outcome: 'failed', caller });
       return errorResponse(id, INTERNAL_ERROR, `resource "${uri}" could not be read`);
     }
   }