@vibesdotdev/mcp 1.0.0-rc.2 → 1.0.0-rc.5

package/dist/adapters/mcp/server.js

@@ -1,7 +1,8 @@
-import { McpServer, ResourceTemplate } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { CallToolRequestSchema, CallToolResultSchema, TextContentSchema, ResourceLinkSchema, CreateMessageResultSchema, ErrorCode, McpError } from '@modelcontextprotocol/sdk/types.js';
+import mcpPackage from '../../../package.json' with { type: 'json' };
+import { CallToolResultSchema, TextContentSchema, ResourceLinkSchema } from "@modelcontextprotocol/core";
+import { McpServer, ResourceTemplate, ProtocolError, ProtocolErrorCode, acceptedContent, inputRequired, isInputRequiredResult } from "@modelcontextprotocol/server";
 import z from 'zod/v4';
-import { safeParseAsync } from '@modelcontextprotocol/sdk/server/zod-compat.js';
+import { approvalRequestStateCodec } from "./tool-approval.js";
 const registeredTools = new WeakMap();
 const explicitResumeInputSchema = z.object({
     action: z.literal('resume'),
@@ -14,7 +15,7 @@ const receiptRestoreInputSchema = z.object({
     participantId: z.string()
 });
 const explicitSessionTargetSchema = z.object({ sessionId: z.string().trim().min(1) });
-import { admitConnectionCaller } from "./connection-identity.js";
+import { admitConnectionCaller, RELAY_ATTESTATION_SOURCE, STDIO_LAUNCH_SOURCE, verifiedConnectionPrincipal } from "./connection-identity.js";
 import { PROMPTS_MANIFEST_DESCRIPTOR_PREFIX, PROMPTS_MANIFEST_KIND_ID, promptsManifestDescriptorSchema } from '@vibesdotdev/ai-schemas';
 import { resolvePromptText } from '@vibesdotdev/tools/prompts/manifests';
 import { isDiscriminatedUnion, getDiscriminator, getDiscriminatorOptions, flattenDiscriminatedUnionToObject, isPlainUnion, resolveMcpDescription } from "../zod-mcp.js";
@@ -28,59 +29,16 @@ import { getLogger } from '@vibesdotdev/logging';
 import { invokeTool } from '@vibesdotdev/tools/execution/invoke';
 import { ToolInputValidationError } from '@vibesdotdev/tools/execution/input-validation';
 import { buildDirectToolCallContext } from '@vibesdotdev/tools/execution/direct-context';
-import { DEFAULT_AGENT_CAPABILITY_CEILING, TOOL_AGENT_CONTEXT_METADATA_KEY } from '@vibesdotdev/tools/schemas/runtime/capability-tier';
 import { isLocalToolId, localToolsOf } from '@vibesdotdev/tools/local/node/ensure-local-tools';
-import { detectMcpClientId } from '@vibesdotdev/tools/schemas/presets/registry';
-import { loadMcpConfig } from "../../config/load.js";
 import { formatLocalMcpToolDescription, vibesToolOrigin } from "./local-origin.js";
-import { normalizeHarness } from "./serve-identity.js";
 import { missingRequiredTools, selectMcpTools } from "./tool-selection.js";
-import { deriveTrustTier, wrapToolOutputText } from "./trust-tag.js";
+import { deriveTrustTier, shouldDropFromModelContext, wrapToolOutputText } from "./trust-tag.js";
 import { createProjectionBirthResource, PROJECTION_BIRTH_RESOURCE_URI, projectionCatalogHash } from "./projection.js";
 import { createMcpWireNameMap, mcpWireToolName } from "./mcp-wire-name.js";
 import { ambientMeta, formatAmbientPrefix, liftAmbientEnvelope } from "./ambient-envelope.js";
 import { computeMcpToolCatalog, createMcpToolCatalogCache, formatRegistrationFailureInstructions } from "./tool-catalog.js";
 import { runWithMcpSamplingCallback } from "./sampling-context.js";
-/**
- * Resolve the effective capability tier ceiling for an MCP connection from the
- * runtime's `mcp` ConfigManifest (`clientCapabilityCeilings`).
- *
- * Verified transport harness identity (`admitConnectionCaller`) takes
- * precedence over server-level `mcpClientId` and `preset`. Unconfigured
- * profiles fall back to the tools default ceiling (`'1'`).
- */
-export function resolveMcpClientCapabilityCeiling(config, input, source) {
-    const ceilings = config.clientCapabilityCeilings;
-    const candidates = [];
-    const pushCandidate = (raw) => {
-        const trimmed = raw?.trim().toLowerCase();
-        if (!trimmed)
-            return;
-        if (!candidates.includes(trimmed))
-            candidates.push(trimmed);
-        const normalized = (source ? normalizeHarness(source, trimmed) : undefined) ?? detectMcpClientId(trimmed) ?? undefined;
-        if (normalized && !candidates.includes(normalized))
-            candidates.push(normalized);
-    };
-    const verifiedHarness = input.admittedCaller?.harness;
-    if (verifiedHarness && verifiedHarness !== 'custom') {
-        pushCandidate(verifiedHarness);
-    }
-    pushCandidate(input.mcpClientId);
-    if (input.preset) {
-        pushCandidate(input.preset.replace(/^mcp:/i, ''));
-    }
-    if (verifiedHarness === 'custom') {
-        pushCandidate(verifiedHarness);
-    }
-    for (const candidate of candidates) {
-        const configured = ceilings[candidate];
-        if (configured !== undefined) {
-            return { profile: candidate, ceiling: configured };
-        }
-    }
-    return { profile: candidates[0], ceiling: DEFAULT_AGENT_CAPABILITY_CEILING };
-}
+import { requireMcpToolApproval } from "./tool-approval.js";
 /**
  * Project-local catalog ids (CLI `list --source=local` parity). Explicit
  * options win (tests, serve bootstrap); otherwise the tools this runtime's
@@ -139,7 +97,6 @@ const ToolHookFailureSchema = z.object({
     metadata: JsonObjectSchema.optional(),
     alternatives: z.array(z.string()).optional()
 });
-const SafetyReadOnlySchema = z.object({ readOnly: z.boolean().optional() });
 // SDK metadata and content contracts govern passthrough. Content stays required:
 // the SDK's default empty array must not classify ordinary domain output as MCP.
 const mcpToolResponseSchema = CallToolResultSchema.extend({
@@ -223,51 +180,50 @@ function getSuggestedToolCallFromErrorMetadata(metadata) {
 function isZodLike(value) {
     return value instanceof z.ZodType;
 }
-function isSafetyCategory(safety) {
-    return typeof safety === 'string';
-}
-function deriveMcpAnnotations(safety) {
-    if (!safety)
-        return undefined;
-    const category = isSafetyCategory(safety) ? safety : safety.category;
-    const hints = isSafetyCategory(safety) ? undefined : safety;
-    // Default values based on category
-    const defaults = {
-        read: {
-            readOnlyHint: true,
-            destructiveHint: false,
-            idempotentHint: true,
-            openWorldHint: false
-        },
-        write: {
-            readOnlyHint: false,
-            destructiveHint: true,
-            idempotentHint: false,
-            openWorldHint: false
-        },
-        execute: {
-            readOnlyHint: false,
-            destructiveHint: false,
-            idempotentHint: false,
-            openWorldHint: true
-        }
-    }[category] ?? {
-        readOnlyHint: false,
-        destructiveHint: false,
-        idempotentHint: false,
-        openWorldHint: false
+function safetyFacts(value) {
+    if (value === undefined)
+        return { category: undefined };
+    if (typeof value === 'string')
+        return { category: value };
+    return {
+        category: value.category,
+        readOnly: value.readOnly,
+        idempotent: value.idempotent,
+        destructive: value.destructive,
+        openWorld: value.openWorld
     };
-    // Apply explicit overrides. `readOnly` is read defensively (the
-    // SafetyField type does not declare it yet) so a descriptor that declares
-    // an explicit readOnly hint is honored instead of silently taking the
-    // category default.
-    const parsedReadOnly = hints ? SafetyReadOnlySchema.safeParse(hints) : undefined;
-    const readOnly = parsedReadOnly?.success ? parsedReadOnly.data.readOnly : undefined;
+}
+/**
+ * MCP annotations are tool-level hints. For a multi-action tool they are the
+ * conservative union of the top-level safety and every declared action or
+ * variant. A single write/execute action must clear `readOnlyHint`; a single
+ * write action must set `destructiveHint`. A descriptor that declares no
+ * safety at all is treated as the spec's conservative default (not read-only,
+ * destructive, open-world) rather than advertising no hint.
+ */
+function deriveMcpAnnotations(source) {
+    const top = safetyFacts(source.safety);
+    const actions = Object.values(source.actionSafety ?? {}).map((value) => safetyFacts(value));
+    const variants = (source.variantSafety ?? []).filter((value) => value !== undefined).map(safetyFacts);
+    const all = [top, ...actions, ...variants];
+    const categories = all.map((facts) => facts.category).filter((category) => category !== undefined);
+    const anyNonRead = categories.some((category) => category !== 'read');
+    const anyWrite = categories.includes('write');
+    const anyExecute = categories.includes('execute');
+    const explicitReadOnly = [top, ...variants].map((facts) => facts.readOnly).find((value) => value !== undefined);
+    const explicitDestructive = [top, ...variants].map((facts) => facts.destructive).find((value) => value !== undefined);
+    const explicitIdempotent = [top, ...variants].map((facts) => facts.idempotent).find((value) => value !== undefined);
+    const explicitOpenWorld = [top, ...variants].map((facts) => facts.openWorld).find((value) => value !== undefined);
+    const readOnly = explicitReadOnly ?? (top.category === 'read' && !anyNonRead);
+    const destructive = explicitDestructive ?? (anyWrite || variants.some((facts) => facts.destructive === true));
+    const idempotent = explicitIdempotent ?? readOnly;
+    const declaredNetwork = source.permissions?.some((permission) => permission === 'canAccessNetwork' || permission === 'network') ?? false;
+    const openWorld = explicitOpenWorld ?? (anyExecute || declaredNetwork || variants.some((facts) => facts.openWorld === true));
     return {
-        readOnlyHint: readOnly ?? defaults.readOnlyHint,
-        destructiveHint: hints?.destructive ?? defaults.destructiveHint,
-        idempotentHint: hints?.idempotent ?? defaults.idempotentHint,
-        openWorldHint: hints?.openWorld ?? defaults.openWorldHint
+        readOnlyHint: readOnly,
+        destructiveHint: destructive,
+        idempotentHint: idempotent,
+        openWorldHint: openWorld
     };
 }
 function uniqueName(base, used) {
@@ -306,15 +262,13 @@ function buildResourceText(descriptor, resourceName, uri, variables) {
 }
 /** MCP prompt arguments arrive as strings; each manifest-declared argument becomes one. */
 function buildPromptArgsSchema(argumentsSchema) {
-    if (!argumentsSchema || argumentsSchema.length === 0)
-        return undefined;
     const argumentSchemas = {};
-    for (const arg of argumentsSchema) {
+    for (const arg of argumentsSchema ?? []) {
         // Describe the outer schema: the SDK lists an optional argument's own description.
         const description = arg.description ?? `${arg.name} argument`;
         argumentSchemas[arg.name] = arg.required ? z.string().describe(description) : z.string().optional().describe(description);
     }
-    return argumentSchemas;
+    return z.object(argumentSchemas);
 }
 function registerDescriptorMcpDefinitions(server, descriptors, runtime, logger, options = { announce: true }) {
     const resourceUris = new Set();
@@ -394,10 +348,18 @@ function registerDescriptorMcpDefinitions(server, descriptors, runtime, logger,
                     .withId(`${PROMPTS_MANIFEST_DESCRIPTOR_PREFIX}${promptId}`)
                     .firstDescriptor();
                 const manifest = registered ? promptsManifestDescriptorSchema.parse(registered).manifest : undefined;
-                const promptDescription = manifest
-                    ? resolveMcpDescription({ id: promptId, name: manifest.name, description: manifest.description || undefined })
-                    : `Prompt descriptor ${promptId}`;
-                const argsSchema = buildPromptArgsSchema(manifest?.arguments) ?? {};
+                if (!manifest) {
+                    // A tool names only real prompts/manifest descriptors. A missing
+                    // descriptor is a registration defect; do not advertise a placeholder.
+                    mcpLog.error(`Prompt '${promptId}' has no prompts/manifest descriptor; skipping`);
+                    continue;
+                }
+                const promptDescription = resolveMcpDescription({
+                    id: promptId,
+                    name: manifest.name,
+                    description: manifest.description || undefined
+                });
+                const argsSchema = buildPromptArgsSchema(manifest.arguments);
                 server.registerPrompt(name, {
                     description: promptDescription,
                     argsSchema
@@ -411,7 +373,7 @@ function registerDescriptorMcpDefinitions(server, descriptors, runtime, logger,
                                 role: 'user',
                                 content: {
                                     type: 'text',
-                                    text: text || `Prompt '${promptId}' has no prompts/manifest content to expose.`
+                                    text: text || `Prompt '${promptId}' rendered no text.`
                                 }
                             }
                         ]
@@ -439,25 +401,35 @@ function registerDescriptorMcpDefinitions(server, descriptors, runtime, logger,
  */
 export function buildServer(runtime, options, logger, catalog = computeMcpToolCatalog(runtime, options, logger, resolveLocalToolIds(runtime, options))) {
     const buildLog = logger.child('build');
-    const serverName = options.serverName ?? 'vibes';
-    const serverVersion = options.serverVersion ?? '0.0.0';
+    const serverName = options.serverName ?? 'mcp';
+    const serverVersion = options.serverVersion ?? mcpPackage.version;
     if (catalog.degradedKind) {
         // Constitution rule 13: empty tools/list must not look healthy. The
         // banner was composed (and error-logged) by the catalog fold.
         return new McpServer({ name: serverName, version: serverVersion }, {
             capabilities: catalog.capabilities,
-            instructions: catalog.instructions
+            instructions: catalog.instructions,
+            requestState: { verify: approvalRequestStateCodec.verify }
         });
     }
     const selected = catalog.selected;
     if (!selected) {
         throw new Error('MCP tool catalog is non-degraded but carries no selection');
     }
+    const requiredToolIds = new Set(selected.preset.requiredTools ?? []);
+    const missingRequiredLoaders = catalog.zombieCandidates.filter((id) => requiredToolIds.has(id));
+    if (missingRequiredLoaders.length > 0) {
+        throw new Error(`REQUIRED MCP TOOLS HAVE NO LOADER for preset ${selected.presetId}: ` +
+            `${missingRequiredLoaders.join(', ')}. A required continuity tool cannot be advertised ` +
+            'without an implementation; fix the composition before serving.');
+    }
     const enabledDescriptors = catalog.enabledDescriptors;
     const localToolIds = catalog.localToolIds;
     const descriptors = catalog.descriptors;
     createMcpWireNameMap(descriptors.map(descriptor => descriptor.id), options.mcpClientId, catalog.purposePresets);
-    const capabilities = catalog.capabilities;
+    const capabilities = options.buildProvenance && !catalog.capabilities.resources
+        ? { ...catalog.capabilities, resources: { listChanged: false } }
+        : catalog.capabilities;
     const instructions = catalog.instructions;
     const preScanFailedTools = [...catalog.preScanFailedTools];
     const failedTools = [...preScanFailedTools];
@@ -465,7 +437,8 @@ export function buildServer(runtime, options, logger, catalog = computeMcpToolCa
     const registeredToolIds = [];
     const server = new McpServer({ name: serverName, version: serverVersion }, {
         capabilities,
-        instructions: instructions || undefined
+        instructions: instructions || undefined,
+        requestState: { verify: approvalRequestStateCodec.verify }
     });
     for (const descriptor of descriptors) {
         if (!descriptor.schemas?.input) {
@@ -545,100 +518,6 @@ export function buildServer(runtime, options, logger, catalog = computeMcpToolCa
         appendMcpInstructions(server, birth.instructions);
     }
     registerDescriptorMcpDefinitions(server, descriptors, runtime, logger, { announce });
-    // Client auto-detection (2025-era scar tissue): when serve was spawned without
-    // --client, the base `mcp` preset applies and client-curated tools stay hidden.
-    // After initialize, we additive-register the detected preset and emit
-    // tools/listChanged.
-    //
-    // MCP 2026-07-28: tools/list MUST NOT vary per connection. This path mutates
-    // the catalog after initialize and is therefore gated behind an explicit
-    // opt-in (`allowClientAutoDetectUpgrade`, default OFF). Pass --client (or
-    // pack config) so the catalog is fixed at start.
-    // See docs/proposals/mcp-2026-07-28/FINDINGS.md.
-    if (!options.mcpClientId && options.allowClientAutoDetectUpgrade) {
-        const baselineIds = new Set(descriptors.map((descriptor) => descriptor.id));
-        server.server.oninitialized = () => {
-            const detected = settleNow(() => {
-                const clientName = server.server.getClientVersion()?.name;
-                const detectedClientId = detectMcpClientId(clientName, catalog.purposePresets);
-                if (!detectedClientId)
-                    return;
-                buildLog.warn('MCP catalog mutated after initialize (client auto-detect). ' +
-                    'Illegal under protocol 2026-07-28 — pass --client so the preset is fixed at start.', { clientName, detectedClientId });
-                // Same registration bound as the construct-time fold: a settled
-                // surface must not re-admit an unavailable descriptor through
-                // this opt-in mutation path. `zombieCandidates` is exactly the
-                // fold's unavailable set.
-                const settlementExcluded = catalog.loaderSettlement === 'settled' ? new Set(catalog.zombieCandidates) : null;
-                const upgraded = selectMcpTools(settlementExcluded
-                    ? enabledDescriptors.filter((descriptor) => !settlementExcluded.has(descriptor.id))
-                    : [...enabledDescriptors], { mcpClientId: detectedClientId, customPresets: catalog.purposePresets });
-                const additions = upgraded.descriptors.filter((descriptor) => !baselineIds.has(descriptor.id));
-                if (additions.length === 0)
-                    return;
-                let added = 0;
-                const upgradeFailures = [];
-                for (const descriptor of additions) {
-                    const registered = settleNow(() => registerTool(server, descriptor, runtime, { ...options, customPresets: catalog.purposePresets }, logger, localToolIds));
-                    if (!registered.ok) {
-                        const facts = valueFreeFailure(registered.cause);
-                        upgradeFailures.push(`${descriptor.id}: ${facts.name}`);
-                        // Error (not warn): continuity tools often land only via
-                        // this path when --client was omitted at serve start.
-                        buildLog.error(`Client-detected tool failed to register: ${descriptor.id}`, { error: facts });
-                        continue;
-                    }
-                    if (registered.value) {
-                        baselineIds.add(descriptor.id);
-                        added += 1;
-                    }
-                    else {
-                        upgradeFailures.push(`${descriptor.id}: schema conversion failed`);
-                        buildLog.error(`Client-detected tool failed to register: ${descriptor.id}`, { error: 'schema conversion failed' });
-                    }
-                }
-                // Initialize already returned construct-time instructions; patch
-                // so agents that re-read server state / later sessions see the gap.
-                // Hosts that only saw initialize may still miss this — error log
-                // remains load-bearing until listChanged + instructions re-push.
-                if (upgradeFailures.length > 0) {
-                    appendMcpInstructions(server, formatRegistrationFailureInstructions(upgradeFailures));
-                    buildLog.error(`Client-detected preset upgrade incomplete: ${upgradeFailures.length} tool(s) not advertised`, { upgradeFailures, added, detectedClientId });
-                }
-                // Required continuity tools for the detected client must not
-                // vanish silently (brain/presence class outage via auto-detect).
-                const stillMissingRequired = missingRequiredTools([...baselineIds], upgraded.preset);
-                if (stillMissingRequired.length > 0) {
-                    const section = `⚠ DEGRADED SURFACE: required tools missing after client auto-detect ` +
-                        `(${detectedClientId}): ${stillMissingRequired.join(', ')}. ` +
-                        `Report this to the user IMMEDIATELY; do NOT silently work around it.`;
-                    appendMcpInstructions(server, section);
-                    buildLog.error('REQUIRED MCP TOOLS MISSING after client auto-detect', {
-                        detectedClientId,
-                        stillMissingRequired
-                    });
-                }
-                buildLog.info('Client-detected preset upgrade', {
-                    clientName,
-                    detectedClientId,
-                    presetId: upgraded.presetId,
-                    added,
-                    addedTools: additions.map((descriptor) => descriptor.id),
-                    upgradeFailures
-                });
-            });
-            if (!detected.ok) {
-                const facts = valueFreeFailure(detected.cause);
-                // Whole-path failure (not per-tool): still a rule-13 injury —
-                // thin base preset can look healthy without continuity tools.
-                appendMcpInstructions(server, '⚠ DEGRADED SURFACE: client preset auto-detection failed after initialize. ' +
-                    'Continuity tools for the connected client may be missing. ' +
-                    'Report this to the user IMMEDIATELY; do NOT silently work around it. ' +
-                    'Diagnose: pass --client explicitly or check MCP initialize clientInfo.name.');
-                buildLog.error('Client preset auto-detection failed', { error: facts });
-            }
-        };
-    }
     // Own admission before asynchronous SDK schema parsing. RegisteredTool is
     // a public SDK handle; replacing it leaves admitted calls' schemas intact.
     //
@@ -648,18 +527,26 @@ export function buildServer(runtime, options, logger, catalog = computeMcpToolCa
     // failures stay tool-result-shaped but stamp `_meta.errorCode`
     // (`INVALID_INPUT`), mirroring the execution path's capability-error
     // projection below.
-    server.server.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
+    server.server.setRequestHandler('tools/call', async (request, ctx) => {
         const invocation = runtime.acquireInvocation();
         try {
             const attempted = await settle(() => invocation.runtime.runInvocation(async () => {
                 const tool = registeredTools.get(server)?.get(request.params.name);
                 if (!tool?.registration.enabled)
-                    throw new McpError(ErrorCode.InvalidParams, `Unknown tool: ${request.params.name}`);
+                    throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Unknown tool: ${request.params.name}`);
                 if (request.params.task)
-                    throw new McpError(ErrorCode.InvalidParams, 'This tool does not support task execution');
-                const parsed = tool.registration.inputSchema ? await safeParseAsync(tool.registration.inputSchema, request.params.arguments) : { success: true, data: request.params.arguments };
-                if (!parsed.success) {
-                    const issues = formatZodIssues(parsed.error);
+                    throw new ProtocolError(ProtocolErrorCode.InvalidParams, 'This tool does not support task execution');
+                const schema = tool.registration.inputSchema;
+                const validated = schema
+                    ? await schema['~standard'].validate(request.params.arguments)
+                    : { value: request.params.arguments };
+                if ('issues' in validated && validated.issues) {
+                    const issues = formatZodIssues({
+                        issues: validated.issues.map((issue) => ({
+                            path: issue.path?.map((part) => typeof part === 'object' && part !== null && 'key' in part ? part.key : part),
+                            message: issue.message
+                        }))
+                    });
                     const text = `Invalid input for '${request.params.name}': ${issues}`;
                     // Omit structuredContent on isError: MCP clients that kept
                     // outputSchema validate it even on errors, and {ok:false,error}
@@ -670,13 +557,19 @@ export function buildServer(runtime, options, logger, catalog = computeMcpToolCa
                         _meta: { errorCode: 'INVALID_INPUT' }
                     };
                 }
-                return await tool.invoke(request.params.arguments, extra, invocation);
+                const result = await tool.invoke(request.params.arguments, ctx, invocation);
+                // Low-level tools/call handlers own the era projection the SDK's
+                // built-in handler would have applied: the 2025 wire codec wraps a
+                // non-object output schema and its structuredContent as `{result}`.
+                return isInputRequiredResult(result)
+                    ? result
+                    : server.server.projectCallToolResult(result, tool.registration.outputSchemaJson);
             }));
             if (attempted.ok)
                 return attempted.value;
             // McpError must escape so the SDK answers with a JSON-RPC error
             // response carrying its code and the request id.
-            if (attempted.cause instanceof McpError)
+            if (attempted.cause instanceof ProtocolError)
                 throw attempted.cause;
             const failure = projectMcpToolFailure(attempted.cause);
             return {
@@ -791,9 +684,30 @@ function normalizableOutputSchema(rawOutputSchema) {
     const cached = normalizableOutputSchemas.get(rawOutputSchema);
     if (cached)
         return cached.schema;
-    const schema = !isPlainUnion(rawOutputSchema) && !isDiscriminatedUnion(rawOutputSchema)
-        ? rawOutputSchema
-        : undefined;
+    let schema;
+    // MCP's 2025 wire requires an object-root output schema, and every
+    // structuredContent this server emits is an object. A union of object
+    // variants is object-shaped on every branch, so it is advertised: the
+    // 2025 codec wraps its non-object root and its structuredContent together.
+    // A non-object root (`z.unknown()`, arrays, primitives, mixed unions)
+    // would make clients demand structuredContent the text wire path never
+    // produces, so it is not advertised at all.
+    const isObjectOutput = (value) => {
+        if (value === null || typeof value !== 'object' || Array.isArray(value))
+            return false;
+        const json = value;
+        if (json['type'] === 'object')
+            return true;
+        for (const key of ['anyOf', 'oneOf']) {
+            const branches = json[key];
+            if (Array.isArray(branches) && branches.length > 0)
+                return branches.every(isObjectOutput);
+        }
+        return false;
+    };
+    const json = settleNow(() => rawOutputSchema.toJSONSchema());
+    if (json.ok && isObjectOutput(json.value))
+        schema = rawOutputSchema;
     normalizableOutputSchemas.set(rawOutputSchema, { schema });
     return schema;
 }
@@ -823,13 +737,16 @@ function registerTool(server, descriptor, runtime, options, logger, localToolIds
     // safeParseAsync(undefined, ...) which throws "undefined is not an object (evaluating 's._zod')".
     // Skip output schemas that are plain unions or discriminated unions to avoid this SDK bug.
     const rawOutputSchema = descriptor.schemas.output === undefined ? undefined : requireToolZodSchema(descriptor.schemas.output, descriptor.id);
-    const outputSchema = rawOutputSchema ? normalizableOutputSchema(rawOutputSchema) : undefined;
-    // Derive MCP annotations from safety field
-    const annotations = deriveMcpAnnotations(descriptor.safety);
     // Trust-tag tier is derived from `safety` until `descriptor.capability.tier`
     // lands in the tier-spec PR (AI-SURFACE-2026-05.md §4.3 step 1). Captured
     // once at registration so it composes with cache-stable system prompts.
     const trustTier = deriveTrustTier(descriptor);
+    // A tier-3 result deliberately carries no structuredContent. Advertising
+    // an output schema would make a modern client demand content that this
+    // surface never emits, so the schema is not advertised at all.
+    const outputSchema = rawOutputSchema && !shouldDropFromModelContext(trustTier)
+        ? normalizableOutputSchema(rawOutputSchema)
+        : undefined;
     const toolAccessor = runtime.assets('tools/tool');
     const isDiscriminated = toolAccessor.isDiscriminated(descriptor.id);
     let variantSafety;
@@ -844,12 +761,25 @@ function registerTool(server, descriptor, runtime, options, logger, localToolIds
             }
         }
     }
+    // MCP annotations are the conservative union of the top-level safety and
+    // every per-action/variant safety. A write action can never be advertised
+    // as read-only just because the tool's default action is a read.
+    const annotationSource = {
+        safety: descriptor.safety,
+        permissions: descriptor.permissions
+    };
+    if (descriptor.schemas.actionSafety)
+        annotationSource.actionSafety = descriptor.schemas.actionSafety;
+    if (variantSafety)
+        annotationSource.variantSafety = Object.values(variantSafety);
+    const annotations = deriveMcpAnnotations(annotationSource);
     const isLocal = isLocalToolId(descriptor.id, localToolIds);
     const origin = vibesToolOrigin(isLocal);
     const description = formatLocalMcpToolDescription(getDescriptorMcpDescription(descriptor), isLocal);
     const dispatchRuntime = runtime;
     const vibesRegistrationMeta = {
         origin,
+        toolId: descriptor.id,
         category: descriptor.category,
         subcategory: descriptor.subcategory,
         tags: descriptor.tags,
@@ -857,6 +787,8 @@ function registerTool(server, descriptor, runtime, options, logger, localToolIds
         safety: descriptor.safety,
         mcpClientId: options.mcpClientId
     };
+    if (descriptor.schemas.actionSafety)
+        vibesRegistrationMeta.actionSafety = descriptor.schemas.actionSafety;
     if (variantSafety)
         vibesRegistrationMeta.variants = variantSafety;
     const registrationOptions = {
@@ -867,7 +799,7 @@ function registerTool(server, descriptor, runtime, options, logger, localToolIds
         annotations,
         _meta: { vibes: vibesRegistrationMeta }
     };
-    const handler = async (args, extra, boundInvocation) => {
+    const handler = async (args, ctx, boundInvocation) => {
         const callId = `mcp_${Date.now()}_${crypto.randomUUID()}`;
         // Per-call nonce for trust-tag wrapper (F4). Shared across all text items
         // and error paths in this tool call so the model can verify boundary integrity.
@@ -879,7 +811,7 @@ function registerTool(server, descriptor, runtime, options, logger, localToolIds
         const stalePrefix = options.staleBodyBanner?.() ?? null;
         let toolCallCtx;
         const callStarted = Date.now();
-        const traceStage = (stage) => logger.info('MCP invocation stage', { callId, tool: descriptor.id, stage, elapsedMs: Date.now() - callStarted });
+        const traceStage = (stage) => logger.debug('MCP invocation stage', { callId, tool: descriptor.id, stage, elapsedMs: Date.now() - callStarted });
         traceStage('start');
         const invocation = boundInvocation?.retain() ?? dispatchRuntime.acquireInvocation();
         const runtime = invocation.runtime;
@@ -910,15 +842,14 @@ function registerTool(server, descriptor, runtime, options, logger, localToolIds
                         resolvedArgs = { [discriminator]: defaultAction, ...resolvedArgs };
                     }
                 }
-                // The SDK callback does not currently populate `extra.sessionId` for
-                // WebStandard Streamable HTTP. The HTTP adapter therefore gives each
-                // connection a private identity cell when it builds the server. This is
-                // call data, never mutable process-global runtime scope.
-                const transportSessionId = extra.sessionId ?? options.resolveTransportSessionId?.();
+                // A 2025-era transport session is call data, never mutable
+                // process-global runtime scope. A 2026-era request carries its
+                // explicit session handle in the tool input instead.
+                const transportSessionId = ctx.sessionId ?? options.resolveTransportSessionId?.();
                 // A session-family call may name the participant it continues as
                 // (the documented bind flow). That is a binding hint the session layer
                 // verifies, not identity: agent identity comes only from the connection.
-                const callMeta = '_meta' in extra ? asJsonObject(extra._meta) : undefined;
+                const callMeta = asJsonObject(ctx.mcpReq._meta);
                 const metaParticipantId = (isStringValue(callMeta?.participantId) && callMeta.participantId) ||
                     (isStringValue(callMeta?.['vibes/participantId']) &&
                         callMeta['vibes/participantId']) ||
@@ -929,15 +860,22 @@ function registerTool(server, descriptor, runtime, options, logger, localToolIds
                     callId,
                     logger: logger.child(callDescriptor.id)
                 };
-                if (extra.signal)
-                    baseToolCallCtx.signal = extra.signal;
-                if (extra.sendProgress)
+                baseToolCallCtx.signal = ctx.mcpReq.signal;
+                const progressToken = ctx.mcpReq._meta?.progressToken;
+                if (progressToken !== undefined) {
                     baseToolCallCtx.sendProgress = (progress) => {
-                        const update = { progress: progress.progress, total: progress.total };
+                        const update = {
+                            progressToken
+                        };
+                        if (progress.progress !== undefined)
+                            update.progress = progress.progress;
+                        if (progress.total !== undefined)
+                            update.total = progress.total;
                         if (progress.message)
                             update.message = progress.message;
-                        extra.sendProgress?.(update);
+                        void ctx.mcpReq.notify({ method: 'notifications/progress', params: update });
                     };
+                }
                 // Stamp trusted identity from the runtime's `auth/identity` (the same
                 // builder the tools-cli surface uses). The MCP stdio surface runs as an
                 // authenticated local account; without this, owner-scoped tools
@@ -951,33 +889,42 @@ function registerTool(server, descriptor, runtime, options, logger, localToolIds
                     : { ...directContext.caller };
                 // Admission (RC08 U7): identity only from what this connection's
                 // transport verified, before the hook bus or any observer runs.
+                const verifiedConnection = options.resolveVerifiedConnectionIdentity?.() ?? options.verifiedConnectionIdentity;
+                if ((verifiedConnection?.source === STDIO_LAUNCH_SOURCE ||
+                    verifiedConnection?.source === RELAY_ATTESTATION_SOURCE) &&
+                    typeof directContext.metadata?.actorUserId === 'string' &&
+                    !directContext.metadata.orgId &&
+                    runtime.hasContext('orgId')) {
+                    const actorUserId = directContext.metadata.actorUserId;
+                    const resolvedOrg = await settle(() => runtime.runInvocation(() => runtime.context('orgId'), {
+                        actor: { userId: actorUserId }
+                    }));
+                    if (resolvedOrg.ok && typeof resolvedOrg.value === 'string' && resolvedOrg.value.trim().length > 0) {
+                        const orgId = resolvedOrg.value.trim();
+                        directContext.metadata.orgId = orgId;
+                        directContext.metadata.organizationId = orgId;
+                    }
+                }
                 const admittedCaller = admitConnectionCaller({
-                    verified: options.resolveVerifiedConnectionIdentity?.() ?? options.verifiedConnectionIdentity,
+                    verified: verifiedConnection,
                     declared: options.resolveConnectionIdentity?.(),
                     call: caller,
                     principal: directContext.metadata
                 });
-                const mcpSettings = await loadMcpConfig(runtime);
-                const resolvedCeiling = resolveMcpClientCapabilityCeiling(mcpSettings, {
-                    admittedCaller,
-                    mcpClientId: options.mcpClientId,
-                    preset: options.preset
-                }, runtime);
-                const agentContext = {
-                    agentId: admittedCaller?.agentId ?? resolvedCeiling.profile ?? 'mcp-client',
-                    ceiling: resolvedCeiling.ceiling,
-                    callChain: []
-                };
+                // A harness is a transport, not a role. The call carries the
+                // direct consumer surface identity; the tools owner's policy is the
+                // only place that decides whether a tool is in bounds.
                 const metadata = {
                     ...directContext.metadata,
-                    'mcp.transportMode': options.mode,
-                    [TOOL_AGENT_CONTEXT_METADATA_KEY]: agentContext,
-                    agentCapabilityCeiling: resolvedCeiling.ceiling
+                    'mcp.transportMode': options.mode
                 };
                 if (transportSessionId)
                     metadata['mcp.transportSessionId'] = transportSessionId;
                 if (connectionKey)
                     metadata['mcp.connectionKey'] = connectionKey;
+                // The 2026 HTTP request owns a fresh server instance; explicit
+                // session handles, not an ambient binding, are its continuity.
+                metadata['mcp.protocolEra'] = ctx.mcpReq.envelope !== undefined ? 'modern' : 'legacy';
                 const directToolCallCtx = {
                     ...directContext,
                     caller: admittedCaller,
@@ -994,15 +941,14 @@ function registerTool(server, descriptor, runtime, options, logger, localToolIds
                     : directToolCallCtx;
                 traceStage('stamp-session');
                 const sessionStampedCtx = await stampMcpSessionCaller(runtime, server, preparedToolCallCtx, transportSessionId ?? connectionKey, options.mode, callDescriptor.id, resolvedArgs, logger);
-                const stampedToolCallCtx = {
-                    ...sessionStampedCtx,
-                    metadata: {
-                        ...sessionStampedCtx.metadata,
-                        [TOOL_AGENT_CONTEXT_METADATA_KEY]: agentContext,
-                        agentCapabilityCeiling: resolvedCeiling.ceiling
-                    }
-                };
+                const stampedToolCallCtx = sessionStampedCtx;
                 toolCallCtx = stampedToolCallCtx;
+                // The tool owner declares the approval contract; this surface carries
+                // the question to the connected client and fails closed when it cannot.
+                // Written in the multi-round-trip form so 2026 and 2025 share it.
+                const approval = await requireMcpToolApproval(ctx, callDescriptor, resolvedArgs);
+                if (approval)
+                    return approval;
                 // Route through invokeTool so tools/tool hook bus events
                 // (contextBuild / beforeExecute / afterExecute / error) fire
                 // around execution. invokeTool handles discriminated dispatch
@@ -1014,21 +960,27 @@ function registerTool(server, descriptor, runtime, options, logger, localToolIds
                 if (options.toolExecutionTimeoutMs !== undefined && options.toolExecutionTimeoutMs > 0) {
                     execution.timeoutMs = options.toolExecutionTimeoutMs;
                 }
-                const detachAgentContextHook = runtime
-                    .hooks('tools/tool')
-                    .on('contextBuild', (event) => {
-                    if (event.callId === stampedToolCallCtx.callId) {
-                        event.metadata.set(TOOL_AGENT_CONTEXT_METADATA_KEY, agentContext);
-                    }
-                });
-                const rawOutput = await (async () => {
-                    try {
-                        return await runWithMcpSamplingCallback(options.scopedValues, (request) => server.server.request({ method: 'sampling/createMessage', params: request }, CreateMessageResultSchema, { relatedRequestId: extra.requestId }), () => invokeTool(execution));
+                const principal = verifiedConnectionPrincipal({ verified: verifiedConnection, metadata: directContext.metadata });
+                const rawOutput = await runWithMcpSamplingCallback(options.scopedValues, (request) => {
+                    if (options.sampling === 'off') {
+                        throw new CapabilityError('MCP sampling is disabled by configuration.', 'UNAVAILABLE', { reason: 'sampling-disabled', retryable: false });
                     }
-                    finally {
-                        detachAgentContextHook();
+                    // 2026-07-28 removed the server→client request channel.
+                    // Sampling is deprecated in that revision; a tool that
+                    // needs a model call must use its own provider rather
+                    // than hang on a channel the revision does not carry.
+                    if (ctx.mcpReq.envelope !== undefined) {
+                        throw new CapabilityError('MCP sampling is unavailable on protocol revision 2026-07-28; the tool must call its own model provider.', 'UNAVAILABLE', { reason: 'sampling-unavailable-modern', retryable: false });
                     }
-                })();
+                    return ctx.mcpReq.requestSampling(request, 
+                    // Keep the server-to-client request on this call's
+                    // response stream: a relayed stdio body reads that
+                    // stream, not a standalone SSE channel.
+                    { relatedRequestId: ctx.mcpReq.id });
+                }, 
+                // A verified connection is this host's own account: the call runs as
+                // its request principal, so caller-bearer clients see the login.
+                () => principal ? runtime.runInvocation(() => invokeTool(execution), { principal }) : invokeTool(execution));
                 traceStage('result');
                 const outputSchema = callDescriptor.schemas.output;
                 const lifted = liftAmbientEnvelope(rawOutput, isZodLike(outputSchema) ? outputSchema : undefined);
@@ -1071,6 +1023,8 @@ function registerTool(server, descriptor, runtime, options, logger, localToolIds
                         ...mcpResponse,
                         content: wrappedContent
                     };
+                    if (shouldDropFromModelContext(trustTier))
+                        delete result.structuredContent;
                     if (envelopeMeta)
                         result._meta = { ...mcpResponse._meta, ...envelopeMeta };
                     return result;
@@ -1124,7 +1078,9 @@ function registerTool(server, descriptor, runtime, options, logger, localToolIds
                 }
                 const result = { content };
                 // Plain object outputs retain typed data without requiring clients to parse text.
-                if (wired.structured)
+                // A tier-3 result is dropped from model context in BOTH text and
+                // structured form; leaving structuredContent would leak the payload.
+                if (wired.structured && !shouldDropFromModelContext(trustTier))
                     result.structuredContent = wired.structured;
                 if (envelopeMeta)
                     result._meta = envelopeMeta;
@@ -1316,6 +1272,16 @@ async function stampMcpSessionCaller(runtime, server, ctx, transportSessionId, m
         });
     }
     const isSessionFamilyTool = toolId === 'session' || toolId.startsWith('session-');
+    // A session-family call that names its durable target does not need an
+    // ambient transport binding. This is the normal shape on a 2026 HTTP
+    // request (one fresh server per request) and on a 2025 client that has
+    // not run `session init` on this connection yet.
+    const hasExplicitSessionTarget = mode === 'http' &&
+        ctx.metadata?.['mcp.protocolEra'] === 'modern' &&
+        isSessionFamilyTool &&
+        ((typeof input['sessionId'] === 'string' && input['sessionId'].trim().length > 0) ||
+            ['todoId', 'messageId'].some((key) => typeof input[key] === 'string' && input[key].trim().length > 0) ||
+            ['sessionIds', 'todoIds', 'messageIds'].some((key) => Array.isArray(input[key]) && input[key].length > 0));
     const { participantId: _hintParticipant, sessionId: _hintSession, ...unboundCaller } = ctx.caller ?? {};
     if (!runtime.hasContext('session/manager')) {
         return { ...ctx, caller: unboundCaller };
@@ -1377,7 +1343,7 @@ async function stampMcpSessionCaller(runtime, server, ctx, transportSessionId, m
             // participant identity, but without borrowing the closed session's custody.
             const explicitResume = toolId === 'session' && explicitResumeInputSchema.safeParse(input).success;
             if (!getNeedsId &&
-                (explicitResume || sessionUtils?.isSessionDiscoveryCall(toolId, input.action) ||
+                (hasExplicitSessionTarget || explicitResume || sessionUtils?.isSessionDiscoveryCall(toolId, input.action) ||
                     (!sessionUtils &&
                         toolId === 'session' &&
                         (input.action === 'init' || input.action === 'status')))) {