@wardby/cli 0.7.0 → 0.8.0

package/dist/import/create.js

@@ -3,6 +3,8 @@
  * attachments, secrets, datastores, webhooks, budget groups) to the database
  * from a validated bundle + reconciliation.
  */
+import { toolTimeoutProblem } from "../sandbox/tool-timeout.js";
+import { loadToolMaxTimeoutMs } from "../config/tool-timeout.js";
 import { Prisma } from "#prisma";
 import { scheduleStartFields } from "../core/schedule-start.js";
 import { createSecret, attachSecret } from "../core/secrets.js";
@@ -12,7 +14,7 @@ import { SecretCheckUnavailableError, SecretInValueError, createDbSecretWriteGua
 import { createWebhook } from "../core/webhooks.js";
 import { deriveJsonSchema } from "../sandbox/zod-params.js";
 import { toolSubject, zod3ToolWarnings } from "../core/zod3-window.js";
-import { findSameNamedAttachedTool, reservedToolNameReason } from "../core/tool-names.js";
+import { findSameNamedAttachedTool, findSameNamedMcpTool, reservedToolNameReason } from "../core/tool-names.js";
 import { ToolCapabilitiesPatchSchema, FETCH_WILDCARD } from "../sandbox/tool-capabilities.js";
 import { PostgresDatastore } from "../providers/datastore/postgres.js";
 import { decryptTransferEnvelope } from "../providers/secrets/transfer-envelope.js";
@@ -70,6 +72,13 @@ export async function createFromBundle(bundle, recon, opts) {
             warnings.push(`tool ${t.name}: failed to derive JSON schema, skipping`);
             continue;
         }
+        const timeoutProblem = t.timeoutMs === undefined || t.timeoutMs === null
+            ? undefined
+            : toolTimeoutProblem(t.timeoutMs, loadToolMaxTimeoutMs());
+        if (timeoutProblem) {
+            warnings.push(`tool ${t.name}: ${timeoutProblem} Skipping`);
+            continue;
+        }
         // Names are unique per owner: reuse the target owner's own same-named
         // tool (what upsert-by-name used to do), never another owner's. A
         // compound unique with a nullable column can't key an upsert, hence
@@ -83,6 +92,7 @@ export async function createFromBundle(bundle, recon, opts) {
                     code: t.code,
                     jsonSchema: schema.value,
                     ownerId,
+                    ...(t.timeoutMs !== undefined && t.timeoutMs !== null ? { timeoutMs: t.timeoutMs } : {}),
                 },
             }));
         toolIdMap.set(t.name, tool.id);
@@ -180,6 +190,11 @@ export async function createFromBundle(bundle, recon, opts) {
             warnings.push(`agent-tool ${at.agentName}/${at.toolName}: skipped — the agent already has a different tool with the same name (${clash.id})`);
             continue;
         }
+        const mcpClash = await findSameNamedMcpTool(db, agentId, eff(at.toolName));
+        if (mcpClash) {
+            warnings.push(`agent-tool ${at.agentName}/${at.toolName}: skipped — the agent already has a tool with this name from MCP server "${mcpClash.serverName}"`);
+            continue;
+        }
         const caps = capsPatch.data;
         // The importing operator is trusted with the database, so on an agent
         // this import owns it grants the bundle's capabilities in the owner's

package/dist/import/neutral-schema.d.ts

@@ -68,6 +68,7 @@ export declare const NeutralToolSchema: z.ZodObject<{
     jsonSchema: z.ZodDefault<z.ZodNullable<z.ZodUnknown>>;
     code: z.ZodString;
     secretSchema: z.ZodDefault<z.ZodString>;
+    timeoutMs: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
 }, z.core.$strip>;
 export type NeutralTool = z.infer<typeof NeutralToolSchema>;
 export declare const NeutralAgentToolSchema: z.ZodObject<{

package/dist/import/neutral-schema.js

@@ -53,6 +53,8 @@ export const NeutralToolSchema = z.object({
     jsonSchema: z.unknown().nullable().default(null), // ignored; we re-derive (ruling 2)
     code: z.string(),
     secretSchema: z.string().default(""),
+    /** The tool's own time limit (ms); absent or null keeps the default. Checked against WARDBY_TOOL_MAX_TIMEOUT_MS on import. */
+    timeoutMs: z.number().int().nullable().optional(),
 });
 export const NeutralAgentToolSchema = z.object({
     agentName: z.string(),

package/dist/mcp/auth/grants-cli.d.ts

@@ -77,16 +77,18 @@ export interface MigrationReport {
 }
 export declare function migrationReport(db: ReportDb): Promise<MigrationReport>;
 export declare function formatMigrationReport(report: MigrationReport): string;
+/** A binding that belongs to its resource's owner; for an MCP server, boundName is the server name. */
+export type BindingKind = "secret" | "datastore" | "mcp_server";
 export interface AdoptedAgent {
     agentId: string;
     name: string;
     bindingsRemoved: {
-        kind: "secret" | "datastore";
+        kind: BindingKind;
         boundName: string;
         resourceId: string;
     }[];
     bindingsKept: {
-        kind: "secret" | "datastore";
+        kind: BindingKind;
         boundName: string;
     }[];
     capabilitiesStamped: string[];
@@ -126,7 +128,7 @@ export declare function formatAdoptResult(result: AdoptResult): string;
 export interface PruneResult {
     dryRun: boolean;
     removed: {
-        kind: "secret" | "datastore";
+        kind: BindingKind;
         agentId: string;
         agentName: string;
         boundName: string;
@@ -134,7 +136,7 @@ export interface PruneResult {
         resourceOwnerId: string | null;
     }[];
 }
-/** Deletes cross-owner secret/datastore bindings on owned agents, in one transaction. */
+/** Deletes cross-owner secret/datastore/MCP server bindings on owned agents, in one transaction. */
 export declare function pruneBindings(db: PrismaClient, opts: {
     dryRun: boolean;
 }): Promise<PruneResult>;

package/dist/mcp/auth/grants-cli.js

@@ -14,13 +14,13 @@
  *   owner's own bindings, deleting the rest, and stamping the new owner's
  *   consent on attachments of its own tools. Other attachments stay inert
  *   and are printed with the attach_tool call that re-grants them.
- * - prune-bindings deletes the secret/datastore bindings on owned agents
+ * - prune-bindings deletes the secret/datastore/MCP server bindings on owned agents
  *   whose resource another principal owns (inert at run time since the
  *   grants release) and prints each one: the "removed and listed" record.
  */
 import { parseArgs } from "node:util";
 import { Prisma } from "#prisma";
-import { canDelegate } from "../../core/grants.js";
+import { canDelegate, filterUnusableMcpServers } from "../../core/grants.js";
 import { resolvePrincipal } from "./principal.js";
 const USAGE = "Use grants migration-report [--json] | grants adopt-public --owner <subject> [--dry-run] [--keep-everyone-execute] | grants prune-bindings [--dry-run].";
 /** The attach_tool call (MCP) that re-grants an attachment's capabilities, for its owner to review and run. */
@@ -276,8 +276,14 @@ export async function adoptPublic(db, opts) {
                     include: { datastore: { select: { ownerId: true } } },
                     orderBy: { boundName: "asc" },
                 });
+                const mcpServers = await tx.agentMcpServer.findMany({
+                    where: { agentId: id },
+                    include: { server: { select: { id: true, name: true, ownerId: true } } },
+                    orderBy: { serverId: "asc" },
+                });
                 const foreignSecrets = secrets.filter((b) => b.secret.ownerId !== owner.id);
                 const foreignDatastores = datastores.filter((b) => b.datastore.ownerId !== owner.id);
+                const foreignMcpServers = await filterUnusableMcpServers(tx, () => owner.id, mcpServers);
                 for (const b of foreignSecrets) {
                     await tx.agentSecret.delete({ where: { agentId_secretId: { agentId: id, secretId: b.secretId } } });
                 }
@@ -286,6 +292,9 @@ export async function adoptPublic(db, opts) {
                         where: { agentId_datastoreId: { agentId: id, datastoreId: b.datastoreId } },
                     });
                 }
+                for (const b of foreignMcpServers) {
+                    await tx.agentMcpServer.delete({ where: { agentId_serverId: { agentId: id, serverId: b.serverId } } });
+                }
                 // Only the tool's owner could attach its private tool to a public
                 // agent or change that attachment's capabilities, so those carry
                 // the new owner's consent. Everything else stays inert.
@@ -350,6 +359,11 @@ export async function adoptPublic(db, opts) {
                             boundName: b.boundName,
                             resourceId: b.datastoreId,
                         })),
+                        ...foreignMcpServers.map((b) => ({
+                            kind: "mcp_server",
+                            boundName: b.server.name,
+                            resourceId: b.serverId,
+                        })),
                     ],
                     bindingsKept: [
                         ...secrets
@@ -358,6 +372,9 @@ export async function adoptPublic(db, opts) {
                         ...datastores
                             .filter((b) => b.datastore.ownerId === owner.id)
                             .map((b) => ({ kind: "datastore", boundName: b.boundName })),
+                        ...mcpServers
+                            .filter((b) => !foreignMcpServers.includes(b))
+                            .map((b) => ({ kind: "mcp_server", boundName: b.server.name })),
                     ],
                     capabilitiesStamped: own.map((at) => at.tool.name),
                     foreignTools: attachments
@@ -411,7 +428,7 @@ export function formatAdoptResult(result) {
     }
     return lines.join("\n");
 }
-/** Deletes cross-owner secret/datastore bindings on owned agents, in one transaction. */
+/** Deletes cross-owner secret/datastore/MCP server bindings on owned agents, in one transaction. */
 export async function pruneBindings(db, opts) {
     return db.$transaction(async (tx) => {
         const secrets = await tx.agentSecret.findMany({
@@ -424,8 +441,17 @@ export async function pruneBindings(db, opts) {
             include: { agent: { select: { name: true, ownerId: true } }, datastore: { select: { ownerId: true } } },
             orderBy: [{ agentId: "asc" }, { boundName: "asc" }],
         });
+        const mcpServers = await tx.agentMcpServer.findMany({
+            where: { agent: { ownerId: { not: null } } },
+            include: {
+                agent: { select: { name: true, ownerId: true } },
+                server: { select: { id: true, name: true, ownerId: true } },
+            },
+            orderBy: [{ agentId: "asc" }, { serverId: "asc" }],
+        });
         const foreignSecrets = secrets.filter((b) => b.secret.ownerId !== b.agent.ownerId);
         const foreignDatastores = datastores.filter((b) => b.datastore.ownerId !== b.agent.ownerId);
+        const foreignMcpServers = await filterUnusableMcpServers(tx, (b) => b.agent.ownerId, mcpServers);
         if (!opts.dryRun) {
             for (const b of foreignSecrets) {
                 await tx.agentSecret.delete({ where: { agentId_secretId: { agentId: b.agentId, secretId: b.secretId } } });
@@ -435,6 +461,11 @@ export async function pruneBindings(db, opts) {
                     where: { agentId_datastoreId: { agentId: b.agentId, datastoreId: b.datastoreId } },
                 });
             }
+            for (const b of foreignMcpServers) {
+                await tx.agentMcpServer.delete({
+                    where: { agentId_serverId: { agentId: b.agentId, serverId: b.serverId } },
+                });
+            }
         }
         return {
             dryRun: opts.dryRun,
@@ -455,6 +486,14 @@ export async function pruneBindings(db, opts) {
                     resourceId: b.datastoreId,
                     resourceOwnerId: b.datastore.ownerId,
                 })),
+                ...foreignMcpServers.map((b) => ({
+                    kind: "mcp_server",
+                    agentId: b.agentId,
+                    agentName: b.agent.name,
+                    boundName: b.server.name,
+                    resourceId: b.serverId,
+                    resourceOwnerId: b.server.ownerId,
+                })),
             ],
         };
     }, { isolationLevel: Prisma.TransactionIsolationLevel.Serializable });

package/dist/mcp/auth/resource-server.d.ts

@@ -19,7 +19,9 @@ export declare const SCOPES_SUPPORTED: string[];
  * runs next to every coding run that names an entry; admin:view reads every
  * owner's runs (the admin viewer API); models:admin changes the model catalog,
  * which prices every principal's runs; power:manage scales the shared coding
- * proxy and native gateway to zero (power_sleep) and reads their state.
+ * proxy and native gateway to zero (power_sleep) and reads their state;
+ * hosts:admin registers host providers, whose approved tools run in the push
+ * and pull request flow.
  * A token scope only DELEGATES — it never authorizes on its own:
  * requireScope/requireAnyScope honour one only when one of the caller's
  * roles (McpRequestContext.roles, resolved live per request) grants it.

package/dist/mcp/auth/resource-server.js

@@ -30,6 +30,9 @@ export const SCOPES_SUPPORTED = [
     // Scale the coding proxy and native gateway to zero now (power_sleep) and
     // read their state (power_status); low-power mode only (docs/getting-started-gke.md).
     "power:manage",
+    // Register host providers and approve their tools (docs/host-providers.md).
+    // Bound tools decide who has permission and who wrote a comment.
+    "hosts:admin",
 ];
 /**
  * Scopes whose operations reach beyond the caller's own (or public)
@@ -40,7 +43,9 @@ export const SCOPES_SUPPORTED = [
  * runs next to every coding run that names an entry; admin:view reads every
  * owner's runs (the admin viewer API); models:admin changes the model catalog,
  * which prices every principal's runs; power:manage scales the shared coding
- * proxy and native gateway to zero (power_sleep) and reads their state.
+ * proxy and native gateway to zero (power_sleep) and reads their state;
+ * hosts:admin registers host providers, whose approved tools run in the push
+ * and pull request flow.
  * A token scope only DELEGATES — it never authorizes on its own:
  * requireScope/requireAnyScope honour one only when one of the caller's
  * roles (McpRequestContext.roles, resolved live per request) grants it.
@@ -52,16 +57,26 @@ export const PRIVILEGED_SCOPES = [
     "admin:view",
     "models:admin",
     "power:manage",
+    "hosts:admin",
 ];
 /**
  * The built-in roles and the permissions (privileged scope names) each
  * grants. No roles = member: every non-privileged scope, nothing privileged.
  */
 export const ROLE_PERMISSIONS = {
-    admin: ["agents:admin", "packages:approve", "services:manage", "admin:view", "models:admin", "power:manage"],
+    admin: [
+        "agents:admin",
+        "packages:approve",
+        "services:manage",
+        "admin:view",
+        "models:admin",
+        "power:manage",
+        "hosts:admin",
+    ],
     "package-approver": ["packages:approve"],
     "service-manager": ["services:manage"],
     "model-manager": ["models:admin"],
+    "host-manager": ["hosts:admin"],
 };
 export const ROLE_NAMES = Object.keys(ROLE_PERMISSIONS);
 export function isRoleName(name) {

package/dist/mcp/context.d.ts

@@ -15,6 +15,7 @@ import type { IssueTrackerRegistry } from "../providers/issue-tracker/types.js";
 import type { HostUserAuthorizerRegistry, ReviewHostRegistry } from "../providers/review-host/types.js";
 import type { Power } from "../core/power.js";
 import type { ChatProviderRegistry } from "../providers/chat/types.js";
+import type { safeFetch } from "../sandbox/safe-fetch.js";
 export type McpProviders = Pick<ProviderRegistry, "llm" | "engine" | "datastore" | "secrets" | "executor" | "memory"> & {
     reviewHosts?: ReviewHostRegistry;
     /** Issue trackers (Jira); empty or absent = no issue-tracker integration. */
@@ -31,6 +32,8 @@ export type McpProviders = Pick<ProviderRegistry, "llm" | "engine" | "datastore"
     repoAccess?: RepoAccessGate;
     /** Low-power mode (scale idle proxy/gateway to zero); absent = DISABLED_POWER. */
     power?: Power;
+    /** Overrides the outbound call to remote MCP servers (register/update/refresh_mcp_server) — tests only. */
+    sandboxFetch?: typeof safeFetch;
 };
 export interface McpRequestContext {
     principal: Principal;

package/dist/mcp/index.js

@@ -13,6 +13,9 @@
  * missing `AUTH_JWKS_URI`/`AUTH_SIGNING_KEY` a deployment running stdio-only
  * never needed to set.
  */
+import { loadToolMaxTimeoutMs } from "../config/tool-timeout.js";
+import { loadMcpServersMode } from "../config/mcp-servers.js";
+import { loadMcpMaxCallsPerRun } from "../config/mcp-call-limit.js";
 import { startupTestSimulators } from "../config/test-simulators.js";
 import { loadProviderConfig, loadMcpConfig, loadShutdownDrainSeconds, loadAuthConfig, loadGitHubEventConfig, loadJiraConfig, loadGitHubVcsConfig, loadBlobStoreConfig, } from "../config/providers.js";
 import { prisma } from "../core/db.js";
@@ -62,6 +65,8 @@ import { registerCostReportTools } from "./tools/cost-report.js";
 import { registerDatastoreTools } from "./tools/datastore.js";
 import { registerSubAgentTools } from "./tools/subagents.js";
 import { registerGrantTools } from "./tools/grants.js";
+import { registerHostProviderTools } from "./tools/host-providers.js";
+import { registerMcpServerTools } from "./tools/mcp-servers.js";
 import { registerRepositoryTools } from "./tools/repositories.js";
 import { registerIssueProjectTools } from "./tools/issue-projects.js";
 import { registerNotificationChannelTools } from "./tools/notification-channels.js";
@@ -140,6 +145,8 @@ export function registerAllTools(mcp, opts) {
     registerSubAgentTools(mcp);
     registerGrantTools(mcp);
     registerRepositoryTools(mcp);
+    registerHostProviderTools(mcp);
+    registerMcpServerTools(mcp);
     registerIssueProjectTools(mcp);
     registerNotificationChannelTools(mcp);
     registerHostAccountTools(mcp);
@@ -193,6 +200,10 @@ export function buildMcpProviders() {
         issueTrackers,
         repoAccess,
     };
+    // Read again at each tool call; checked here so a bad value stops start-up, not every run.
+    loadToolMaxTimeoutMs();
+    loadMcpServersMode();
+    loadMcpMaxCallsPerRun();
     const nativeExecutor = buildExecutor(providerConfig, nativeProviders, prisma);
     // One Power for the process, shared by both executors (wake) and the scheduler leader (sleep).
     const power = buildPower({ env: process.env, db: prisma });

package/dist/mcp/tools/agents.js

@@ -7,6 +7,7 @@
  */
 import { Prisma } from "#prisma";
 import { z } from "zod";
+import { codeProviderOf } from "../../coding/code-host.js";
 import { CodingProfilePatchSchema, CodingProfileSchema } from "../../coding/profile.js";
 import { DEFAULT_CLAUDE_MAX_OUTPUT_TOKENS, DEFAULT_CLAUDE_MAX_TURNS, MAX_CLAUDE_MAX_OUTPUT_TOKENS, MIN_CLAUDE_MAX_OUTPUT_TOKENS, DEFAULT_DEBUG_TRACE_MAX_MB, MAX_CODING_TURNS, MAX_DEBUG_TRACE_MAX_MB, isLocalRepository, } from "../../coding/protocol.js";
 import { loadBlobStoreConfig, loadContainerExecutorConfig } from "../../config/providers.js";
@@ -18,12 +19,15 @@ import { ModelUnavailableError } from "../../providers/llm/catalog-types.js";
 import { currentModelCatalog } from "../../providers/llm/catalog-store.js";
 import { validateCronExpression } from "../../core/cron.js";
 import { scheduleStartFields } from "../../core/schedule-start.js";
+import { preferIndexScans, withSerializableRetry } from "../../core/serializable-retry.js";
 import { modelSupportedEfforts } from "../../providers/llm/routing.js";
+import { agentMcpServerViews, codexUnavailableMcpTools, codexWriteToolsWarning } from "./mcp-servers.js";
+import { isCodexCoding } from "../../core/mcp-tools.js";
 import { PROJECT_KEY } from "../../providers/issue-tracker/types.js";
 import { LLM_EFFORT_LEVELS, isLlmEffort } from "../../providers/llm/types.js";
 import { requireReadableBudgetGroup } from "../auth/ownership.js";
 import { agentAccessResolver, agentNotFound, assertAgentAccess, readableAgentsWhere, requireAgentAccess, } from "../auth/access.js";
-import { EVERYONE_KEY, atLeast, canDelegate, deleteGrantsFor, effectiveAccess, isPublicWritable, } from "../../core/grants.js";
+import { EVERYONE_KEY, atLeast, canDelegate, deleteGrantsFor, effectiveAccess, isPublicWritable, filterUnusableMcpServers, } from "../../core/grants.js";
 import { projectTool } from "./tools.js";
 import { withZod3ToolWarnings } from "../../core/zod3-window.js";
 import { requireAnyScope, requireScope } from "../auth/resource-server.js";
@@ -491,7 +495,7 @@ export function registerAgentTools(mcp) {
                     type: "integer",
                     minimum: 1,
                     maximum: MAX_DELEGATIONS_PER_RUN,
-                    description: "Native agents with sub-agents: how many delegate_to_* calls one run may make, each to a different sub-agent " +
+                    description: "Native agents with sub-agents: how many delegate_to_* calls one run may make, to each sub-agent and repository at most once " +
                         "(one after another, or together with parallelDelegations). Default 1: route to exactly one.",
                 },
                 parallelDelegations: { type: "boolean", description: PARALLEL_DELEGATIONS_DESCRIPTION },
@@ -550,7 +554,7 @@ export function registerAgentTools(mcp) {
             const authorization = codingProfile
                 ? await authorizeRepositoryForSet(ctx, {
                     ownerId: ctx.principal.id,
-                    provider: "github",
+                    provider: codeProviderOf(codingProfile.repository),
                     repository: codingProfile.repository,
                     kind: "coding",
                     adminOverride: repositoryAdminOverride === true,
@@ -597,7 +601,7 @@ export function registerAgentTools(mcp) {
                     type: "integer",
                     minimum: 1,
                     maximum: MAX_DELEGATIONS_PER_RUN,
-                    description: "Native agents with sub-agents: how many delegate_to_* calls one run may make, each to a different sub-agent " +
+                    description: "Native agents with sub-agents: how many delegate_to_* calls one run may make, to each sub-agent and repository at most once " +
                         "(one after another, or together with parallelDelegations). Default 1: route to exactly one.",
                 },
                 parallelDelegations: { type: "boolean", description: PARALLEL_DELEGATIONS_DESCRIPTION },
@@ -738,7 +742,7 @@ export function registerAgentTools(mcp) {
             const authorization = plannedRepository !== null && repositoryChanges(before)
                 ? await authorizeRepositoryForSet(ctx, {
                     ownerId: before.ownerId,
-                    provider: "github",
+                    provider: codeProviderOf(plannedRepository),
                     repository: plannedRepository,
                     kind: "coding",
                     adminOverride: args.repositoryAdminOverride === true,
@@ -774,6 +778,17 @@ export function registerAgentTools(mcp) {
                     await requireReadableBudgetGroup(tx, args.budgetGroupId, ctx.principal.id);
                 }
                 const nextKind = args.kind ?? existing.kind;
+                if (nextKind !== existing.kind) {
+                    // A write link without triggers is a coding agent's extra repository
+                    // and a native agent's plain write access; changing kind would
+                    // silently reinterpret it.
+                    const reinterpreted = await tx.agentRepository.count({
+                        where: { agentId: args.id, access: "write", triggers: { isEmpty: true } },
+                    });
+                    if (reinterpreted > 0) {
+                        throw new McpError(400, `Agent "${args.id}" has write repository links without triggers, which mean different things on native and coding agents; unlink them before changing its kind.`);
+                    }
+                }
                 // A coding repository is an owner binding (agentOwnerBindings): an
                 // agent everyone can write never gets one, as attach_* refuse theirs.
                 if (((nextKind === "coding" && existing.kind !== "coding") || repositoryChanges(existing)) &&
@@ -892,16 +907,58 @@ export function registerAgentTools(mcp) {
                     by: ctx.principal.id,
                 }, "coding package audit mode set");
             }
-            return textResult(withProfileWarnings(withOperatorMode(agent)));
+            const shown = withProfileWarnings(withOperatorMode(agent));
+            // Becoming Codex (a provider switch, or a native agent becoming coding) leaves out every attached
+            // MCP tool the server doesn't mark read-only: say which, so the owner isn't surprised by a run.
+            const wasCodex = before.kind === "coding" && isCodexCoding(before.codingProfile?.provider);
+            if (agent.kind === "coding" && isCodexCoding(agent.codingProfile?.provider) && !wasCodex) {
+                const writers = await codexUnavailableMcpTools(ctx.db, agent.id);
+                if (writers.length > 0) {
+                    return textResult({ ...shown, warnings: [...(shown.warnings ?? []), codexWriteToolsWarning(writers)] });
+                }
+            }
+            return textResult(shown);
         },
     });
     mcp.registerTool({
         name: "list_agents",
         scope: "agents:read",
-        description: "Lists the agents you can see. Each row has an `access` field, your level on that agent: owner > write > execute > read. When showing the agents as a table, include `access` as a column.",
-        inputSchema: { type: "object", properties: {}, additionalProperties: false },
-        handler: async (_args, ctx) => {
-            const [where, accessOf] = await Promise.all([readableAgentsWhere(ctx), agentAccessResolver(ctx)]);
+        description: "Lists the agents you can see. Each row has an `access` field, your level on that agent: owner > write > execute > read. When showing the agents as a table, include `access` as a column. " +
+            "summary: true returns only id, name, kind, model, codingProvider, budgetUsd, ownerId and access per agent, for listings that don't need the full configuration. " +
+            "all: true lists every agent in the deployment (admins only, admin:view); an agent you have no grant on shows access `none`.",
+        inputSchema: {
+            type: "object",
+            properties: { summary: { type: "boolean" }, all: { type: "boolean" } },
+            additionalProperties: false,
+        },
+        handler: async (args, ctx) => {
+            if (args.all === true && !ctx.operator)
+                requireScope(ctx, ctx.canonicalUri, "admin:view");
+            const [where, accessOf] = await Promise.all([
+                args.all === true ? Promise.resolve({}) : readableAgentsWhere(ctx),
+                agentAccessResolver(ctx),
+            ]);
+            if (args.summary === true) {
+                const agents = await ctx.db.agent.findMany({
+                    where,
+                    select: {
+                        id: true,
+                        name: true,
+                        kind: true,
+                        model: true,
+                        budgetUsd: true,
+                        ownerId: true,
+                        codingProfile: { select: { provider: true } },
+                    },
+                    orderBy: { name: "asc" },
+                });
+                return textResult(agents.map(({ codingProfile, budgetUsd, ...agent }) => ({
+                    ...agent,
+                    codingProvider: codingProfile?.provider ?? null,
+                    budgetUsd: Number(budgetUsd),
+                    access: accessOf(agent),
+                })));
+            }
             const agents = await ctx.db.agent.findMany({ where, include: { codingProfile: true } });
             return textResult(agents.map((agent) => ({ ...withOperatorMode(agent), access: accessOf(agent) })));
         },
@@ -925,6 +982,7 @@ export function registerAgentTools(mcp) {
             return textResult({
                 ...withProfileWarnings(withOperatorMode(agent)),
                 access,
+                mcpServers: await agentMcpServerViews(ctx.db, agent.id),
                 // Zod 3 window: the caller's own tools carry their warnings (see core/zod3-window.ts).
                 tools: await Promise.all(agent.tools.map(async (attachment) => ({
                     ...attachment,
@@ -974,7 +1032,7 @@ export function registerAgentTools(mcp) {
     mcp.registerTool({
         name: "make_owner",
         scope: "agents:admin",
-        description: "Admins: gives an agent a new owner (an existing principal id). Secret and datastore bindings the new owner doesn't own are removed; tool capabilities the new owner never granted are suspended until they re-run attach_tool; sub-agent edges the new owner can't delegate are removed; between two owners every grant on the agent is reset (adopting an owner-less agent keeps them). Returns what changed.",
+        description: "Admins: gives an agent a new owner (an existing principal id). Secret, datastore and MCP server bindings the new owner doesn't own are removed; tool capabilities the new owner never granted are suspended until they re-run attach_tool; sub-agent edges the new owner can't delegate are removed; between two owners every grant on the agent is reset (adopting an owner-less agent keeps them). Returns what changed.",
         inputSchema: {
             type: "object",
             additionalProperties: false,
@@ -996,7 +1054,9 @@ export function registerAgentTools(mcp) {
             const principal = await ctx.db.principal.findUnique({ where: { id: newOwner } });
             if (!principal)
                 throw new McpError(400, `Principal "${newOwner}" not found.`);
-            const result = await ctx.db.$transaction(async (tx) => {
+            // Bounded retry: a concurrent grant or attach on the same rows aborts one side (Serializable).
+            const result = await withSerializableRetry(() => ctx.db.$transaction(async (tx) => {
+                await preferIndexScans(tx);
                 const agent = await tx.agent.findUnique({ where: { id: args.agentId }, include: { codingProfile: true } });
                 if (!agent)
                     throw agentNotFound(args.agentId);
@@ -1015,7 +1075,10 @@ export function registerAgentTools(mcp) {
                         where: { agentId: agent.id, authorizedVia: approved },
                         orderBy: { repository: "asc" },
                     });
-                    await tx.agentRepository.updateMany({ where: { agentId: agent.id, authorizedVia: approved }, data: reset });
+                    await tx.agentRepository.updateMany({
+                        where: { agentId: agent.id, authorizedVia: approved },
+                        data: reset,
+                    });
                     revoked.push(...links.map((l) => l.repository));
                     const profile = await tx.codingAgentProfile.updateMany({
                         where: { agentId: agent.id, repositoryAuthorizedVia: approved },
@@ -1072,9 +1135,31 @@ export function registerAgentTools(mcp) {
                         where: { agentId: agent.id, datastoreId: { in: foreignDatastores.map((b) => b.datastoreId) } },
                     });
                 }
+                // MCP server attachments: the server's brokered secrets act for its
+                // owner, so a server the new owner neither owns nor holds use on is detached.
+                const mcpServers = await tx.agentMcpServer.findMany({
+                    where: { agentId: agent.id },
+                    include: { server: { select: { id: true, name: true, ownerId: true } } },
+                    orderBy: { serverId: "asc" },
+                });
+                const foreignMcpServers = await filterUnusableMcpServers(tx, () => newOwner, mcpServers);
+                if (foreignMcpServers.length > 0) {
+                    await tx.agentMcpServer.deleteMany({
+                        where: { agentId: agent.id, serverId: { in: foreignMcpServers.map((b) => b.serverId) } },
+                    });
+                }
                 const bindingsRemoved = [
                     ...foreignSecrets.map((b) => ({ kind: "secret", boundName: b.boundName, resourceId: b.secretId })),
-                    ...foreignDatastores.map((b) => ({ kind: "datastore", boundName: b.boundName, resourceId: b.datastoreId })),
+                    ...foreignDatastores.map((b) => ({
+                        kind: "datastore",
+                        boundName: b.boundName,
+                        resourceId: b.datastoreId,
+                    })),
+                    ...foreignMcpServers.map((b) => ({
+                        kind: "mcp_server",
+                        boundName: b.server.name,
+                        resourceId: b.serverId,
+                    })),
                 ];
                 // Tool capabilities: rows aren't rewritten; the runner ignores any
                 // the new owner never stamped (capabilitiesGrantedById).
@@ -1132,7 +1217,7 @@ export function registerAgentTools(mcp) {
                     everyoneGrant,
                     webhooksInactive,
                 };
-            }, { isolationLevel: Prisma.TransactionIsolationLevel.Serializable });
+            }, { isolationLevel: Prisma.TransactionIsolationLevel.Serializable }));
             return textResult(result);
         },
     });