@wardby/cli 0.7.0 → 0.8.0

package/dist/providers/coding-proxy/memory-ledger.d.ts

@@ -4,6 +4,7 @@ export declare class MemoryProxyLedger implements ProxyLedger {
     private readonly options;
     private readonly sessions;
     private readonly sessionByCapability;
+    private readonly sessionByMcpToken;
     private readonly requests;
     private readonly requestBySessionKey;
     private readonly startedAt;
@@ -11,6 +12,7 @@ export declare class MemoryProxyLedger implements ProxyLedger {
         now?: () => Date;
     });
     createSession(input: CreateProxySessionInput): Promise<void>;
+    findSessionByMcpTokenHash(mcpTokenHash: string): Promise<ProxySession | undefined>;
     findSessionByCapabilityHash(capabilityHash: string): Promise<ProxySession | null>;
     reserve(input: ReserveProxyRequestInput): Promise<ReserveProxyRequestResult>;
     complete(requestId: string, usage: ProxyUsage, actualCostUsd: number, upstreamStatus: number): Promise<ProxyRequest>;

package/dist/providers/coding-proxy/memory-ledger.js

@@ -10,6 +10,7 @@ function cloneSession(session) {
         terms: session.terms
             ? { version: session.terms.version, entry: { ...session.terms.entry, efforts: [...session.terms.entry.efforts] } }
             : null,
+        mcpTools: session.mcpTools ? structuredClone(session.mcpTools) : null,
     };
 }
 function cloneRequest(request) {
@@ -24,6 +25,7 @@ export class MemoryProxyLedger {
     options;
     sessions = new Map();
     sessionByCapability = new Map();
+    sessionByMcpToken = new Map();
     requests = new Map();
     requestBySessionKey = new Map();
     startedAt = new Map();
@@ -36,14 +38,27 @@ export class MemoryProxyLedger {
         }
         if (this.sessionByCapability.has(input.capabilityHash))
             throw new Error("proxy_capability_collision");
+        if (input.mcpTokenHash !== undefined && this.sessionByMcpToken.has(input.mcpTokenHash)) {
+            throw new Error("proxy_mcp_token_collision");
+        }
         const session = {
             ...input,
             allowedModels: [...input.allowedModels],
             status: "active",
             terms: input.terms ? normalizeProxyModelTerms(input.terms) : null,
+            mcpTools: input.mcpTools ? structuredClone(input.mcpTools) : null,
+            mcpTokenHash: input.mcpTokenHash ?? null,
+            mcpCallCount: 0,
         };
         this.sessions.set(session.id, session);
         this.sessionByCapability.set(session.capabilityHash, session.id);
+        if (session.mcpTokenHash !== null)
+            this.sessionByMcpToken.set(session.mcpTokenHash, session.id);
+    }
+    async findSessionByMcpTokenHash(mcpTokenHash) {
+        const id = this.sessionByMcpToken.get(mcpTokenHash);
+        const session = id ? this.sessions.get(id) : undefined;
+        return session ? cloneSession(session) : undefined;
     }
     async findSessionByCapabilityHash(capabilityHash) {
         const id = this.sessionByCapability.get(capabilityHash);

package/dist/providers/coding-proxy/prisma-ledger.d.ts

@@ -20,6 +20,7 @@ export declare class PrismaProxyLedger implements ProxyLedger {
     private transaction;
     createSession(input: CreateProxySessionInput): Promise<void>;
     findSessionByCapabilityHash(capabilityHash: string): Promise<ProxySession | null>;
+    findSessionByMcpTokenHash(mcpTokenHash: string): Promise<ProxySession | undefined>;
     reserve(input: ReserveProxyRequestInput): Promise<ReserveProxyRequestResult>;
     complete(requestId: string, usage: ProxyUsage, actualCostUsd: number, upstreamStatus: number): Promise<ProxyRequest>;
     /**

package/dist/providers/coding-proxy/prisma-ledger.js

@@ -35,8 +35,26 @@ function sessionFromRow(row) {
         budgetExhaustedAt: row.budgetExhaustedAt ?? null,
         upstreamFailure: row.upstreamFailure ?? null,
         terms: sessionTerms(row),
+        mcpTools: sessionMcpTools(row),
+        mcpTokenHash: row.mcpTokenHash ?? null,
+        mcpCallCount: Number(row.mcpCallCount ?? 0),
     };
 }
+/** The session's pinned MCP tools; null when it has none. Anything but a list of pins refuses the session. */
+function sessionMcpTools(row) {
+    const stored = row.mcpTools ?? null;
+    if (stored === null)
+        return null;
+    if (!Array.isArray(stored) ||
+        !stored.every((pin) => typeof pin === "object" &&
+            pin !== null &&
+            typeof pin.exposedName === "string" &&
+            typeof pin.toolName === "string" &&
+            typeof pin.serverId === "string")) {
+        throw new Error("invalid_proxy_session_mcp_tools");
+    }
+    return stored;
+}
 /**
  * The session's stored model terms. Null only when both columns are null (a session from before
  * the catalog, which prices from the shipped fallback); terms that are partly present or cannot be
@@ -109,22 +127,32 @@ export class PrismaProxyLedger {
         await this.db.$executeRaw `
       INSERT INTO "CodingProxySession"
         ("id", "runId", "capabilityHash", "credentialRef", "protocol", "allowedModels", "deadlineAt",
-         "budgetUsd", "status", "registryTokenHash", "pricingVersion", "catalogEntry", "createdAt", "updatedAt")
+         "budgetUsd", "status", "registryTokenHash", "pricingVersion", "catalogEntry", "mcpTools", "mcpTokenHash",
+         "createdAt", "updatedAt")
       VALUES
         (${input.id}, ${input.runId}, ${input.capabilityHash}, ${input.credentialRef}, ${input.protocol}, ${models}::jsonb,
          ${input.deadlineAt}, ${input.budgetUsd}, 'active', ${input.registryTokenHash},
          ${terms?.version ?? null}, ${terms ? JSON.stringify(terms.entry) : null}::jsonb,
+         ${input.mcpTools ? JSON.stringify(input.mcpTools) : null}::jsonb, ${input.mcpTokenHash ?? null},
          CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
     `;
     }
     async findSessionByCapabilityHash(capabilityHash) {
         const rows = await this.db.$queryRaw `
       SELECT "id", "runId", "capabilityHash", "credentialRef", "protocol", "allowedModels", "deadlineAt", "budgetUsd", "status", "registryTokenHash",
-             "budgetExhaustedAt", "upstreamFailure", "pricingVersion", "catalogEntry"
+             "budgetExhaustedAt", "upstreamFailure", "pricingVersion", "catalogEntry", "mcpTools", "mcpTokenHash", "mcpCallCount"
       FROM "CodingProxySession" WHERE "capabilityHash" = ${capabilityHash}
     `;
         return rows[0] ? sessionFromRow(rows[0]) : null;
     }
+    async findSessionByMcpTokenHash(mcpTokenHash) {
+        const rows = await this.db.$queryRaw `
+      SELECT "id", "runId", "capabilityHash", "credentialRef", "protocol", "allowedModels", "deadlineAt", "budgetUsd", "status", "registryTokenHash",
+             "budgetExhaustedAt", "upstreamFailure", "pricingVersion", "catalogEntry", "mcpTools", "mcpTokenHash", "mcpCallCount"
+      FROM "CodingProxySession" WHERE "mcpTokenHash" = ${mcpTokenHash}
+    `;
+        return rows[0] ? sessionFromRow(rows[0]) : undefined;
+    }
     async reserve(input) {
         return this.transaction(async (tx) => {
             const sessions = await tx.$queryRaw `

package/dist/providers/coding-proxy/proxy.d.ts

@@ -1,4 +1,6 @@
 import type { ModelPricing } from "../llm/pricing-core.js";
+import { capabilityHash } from "./capability-hash.js";
+import type { McpToolPin } from "../../core/mcp-tools.js";
 import type { CredentialResolver, ProxyAuditSink, ProxyLedger, ProxyModelTerms, ProxyProtocol, ProxyRefusalRecord } from "./types.js";
 export declare const PROXY_MAX_BODY_BYTES: number;
 export declare const PROXY_MAX_OUTPUT_TOKENS = 1000000;
@@ -43,6 +45,10 @@ export interface CreateCodingProxySession {
     budgetUsd: number;
     /** The run's catalog entry recorded at dispatch; the session then prices and shapes requests from it. */
     terms?: ProxyModelTerms;
+    /** The run's pinned MCP tools (no URLs or secrets); only with mcpTokenHash, and only when there is one. */
+    mcpTools?: McpToolPin[];
+    /** SHA-256 (base64url) of the run's MCP token; the control plane mints and delivers the token itself. */
+    mcpTokenHash?: string;
 }
 export interface CreatedCodingProxySession {
     id: string;
@@ -70,7 +76,7 @@ export interface CodingProxyOptions {
      */
     onModelRequest?: (runId: string) => Promise<void>;
 }
-export declare function capabilityHash(capability: string): string;
+export { capabilityHash };
 export declare class CodingProxy {
     private readonly ledger;
     private readonly credentials;

package/dist/providers/coding-proxy/proxy.js

@@ -1,7 +1,9 @@
-import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { randomBytes, randomUUID } from "node:crypto";
 import { shippedCatalog } from "../llm/catalog.js";
 import { SHIPPED_CATALOG_VERSION } from "../llm/catalog-shipped.js";
 import { deriveRegistryToken } from "../../coding/registry/token.js";
+import { capabilityHash } from "./capability-hash.js";
+import { CLAUDE_MCP_TOOL_PREFIX } from "../../coding/mcp-token.js";
 import { AnthropicSseUsageTracker, actualCostUsd, fingerprintRequest, parseAnthropicAuthoritativeUsage, parseAuthoritativeUsage, pricingSnapshot, safeUpstreamErrorCode, terminalUsageFromSseFrame, } from "./metering.js";
 import { conversationKey, estimateHold } from "./hold.js";
 import { estimateInterrupted, previousInput } from "./interrupted.js";
@@ -48,20 +50,19 @@ export class CodingProxyError extends Error {
         this.code = code;
     }
 }
-export function capabilityHash(capability) {
-    return createHash("sha256").update(capability).digest("base64url");
-}
+export { capabilityHash };
 // OpenAI Responses allowlist. Everything a request may carry is listed here;
 // anything else is refused before a credential is resolved. It mirrors what the
 // pinned Codex CLI (src/coding-worker/package.json) actually sends, recorded in
 // fixtures/codex-<version>-responses-requests.json. Only client-side tools
-// (function, custom, and namespaces of them) are allowed: a hosted tool (web
-// search, remote MCP, code interpreter, image generation, file search, ...), a
-// remote image or file, a stored prompt, or a previous response would make
-// OpenAI fetch or run something outside the worker's egress policy and outside
-// the token-metered budget. Tool names vary by model and Codex version, so they
-// are checked for shape, not against a fixed list: a client-side tool the model
-// calls is executed by the worker itself, which the container boundary governs.
+// (function, custom, namespaces of them, and the client-executed tool_search)
+// are allowed: a hosted tool (web search, remote MCP, code interpreter, image
+// generation, file search, ...), a remote image or file, a stored prompt, or a
+// previous response would make OpenAI fetch or run something outside the
+// worker's egress policy and outside the token-metered budget. Tool names vary
+// by model and Codex version, so they are checked for shape, not against a
+// fixed list: a client-side tool the model calls is executed by the worker
+// itself, which the container boundary governs.
 const OPENAI_REQUEST_KEYS = new Set([
     "model",
     "instructions",
@@ -151,13 +152,32 @@ function openAiToolName(value, code = "invalid_openai_request") {
     if (typeof value !== "string" || !OPENAI_TOOL_NAME.test(value))
         throw new CodingProxyError(400, code);
 }
-function validateOpenAiFunctionTool(tool) {
-    openAiOnlyKeys(tool, ["type", "name", "description", "strict", "parameters"], "invalid_openai_tool");
+function validateOpenAiFunctionTool(tool, inSearchOutput) {
+    openAiOnlyKeys(tool, inSearchOutput
+        ? ["type", "name", "description", "strict", "defer_loading", "parameters"]
+        : ["type", "name", "description", "strict", "parameters"], "invalid_openai_tool");
     openAiToolName(tool.name, "invalid_openai_tool");
     openAiOptional(tool.description, (value) => openAiString(value, MAX_TOOL_TEXT_BYTES, "invalid_openai_tool"));
     if (tool.strict !== undefined && typeof tool.strict !== "boolean") {
         throw new CodingProxyError(400, "invalid_openai_tool");
     }
+    // Codex marks the tools a tool_search_output loads with defer_loading: true,
+    // and sends it nowhere else. It only delays when the model sees the
+    // definition, which is checked in full.
+    if (tool.defer_loading !== undefined && tool.defer_loading !== true) {
+        throw new CodingProxyError(400, "invalid_openai_tool");
+    }
+    openAiOptional(tool.parameters, (value) => openAiRecord(value, "invalid_openai_tool"));
+}
+// The tool_search tool Codex sends for models whose metadata asks for it. Only
+// client execution: Codex runs the search over its own deferred tools and
+// returns them in a tool_search_output item. A server-executed search would
+// have OpenAI run it.
+function validateOpenAiToolSearchTool(tool) {
+    openAiOnlyKeys(tool, ["type", "execution", "description", "parameters"], "invalid_openai_tool");
+    if (tool.execution !== "client")
+        throw new CodingProxyError(400, "openai_tool_not_allowed:tool_search");
+    openAiOptional(tool.description, (value) => openAiString(value, MAX_TOOL_TEXT_BYTES, "invalid_openai_tool"));
     openAiOptional(tool.parameters, (value) => openAiRecord(value, "invalid_openai_tool"));
 }
 function validateOpenAiCustomTool(tool) {
@@ -175,30 +195,57 @@ function validateOpenAiCustomTool(tool) {
     }
     openAiString(format.definition, MAX_TOOL_TEXT_BYTES, "invalid_openai_tool");
 }
-function validateOpenAiTools(value, count, nested = false) {
+// Every tool list (the request's tools, each additional_tools item, each
+// tool_search_output item) is capped at MAX_OPENAI_TOOLS entries on its own.
+// Across the request, `distinct` holds the `namespace/name` of each callable
+// tool and is capped too. Codex replays every earlier tool_search_output on
+// each turn, so a long run repeats the same definitions many times: each copy
+// is still validated, but only a tool not seen before adds to the shared cap.
+function validateOpenAiTools(value, distinct, { toolSearch = false, inSearchOutput = false, namespace, listed = { value: 0 }, } = {}) {
     if (!Array.isArray(value))
         throw new CodingProxyError(400, "invalid_openai_tool");
+    const callable = (name) => {
+        distinct.add(`${namespace ?? ""}/${name}`);
+        if (distinct.size > MAX_OPENAI_TOOLS)
+            throw new CodingProxyError(400, "invalid_openai_tool");
+    };
     for (const candidate of value) {
-        if (++count.value > MAX_OPENAI_TOOLS)
+        if (++listed.value > MAX_OPENAI_TOOLS)
             throw new CodingProxyError(400, "invalid_openai_tool");
         const tool = openAiRecord(candidate, "invalid_openai_tool");
         if (tool.type === "function") {
-            validateOpenAiFunctionTool(tool);
+            validateOpenAiFunctionTool(tool, inSearchOutput);
+            callable(tool.name);
         }
         else if (tool.type === "custom") {
             validateOpenAiCustomTool(tool);
+            callable(tool.name);
         }
-        else if (tool.type === "namespace" && !nested) {
+        else if (tool.type === "namespace" && namespace === undefined) {
             openAiOnlyKeys(tool, ["type", "name", "description", "tools"], "invalid_openai_tool");
             openAiToolName(tool.name, "invalid_openai_tool");
             openAiOptional(tool.description, (value) => openAiString(value, MAX_TOOL_TEXT_BYTES, "invalid_openai_tool"));
-            validateOpenAiTools(tool.tools, count, true);
+            validateOpenAiTools(tool.tools, distinct, { inSearchOutput, namespace: tool.name, listed });
+        }
+        else if (tool.type === "tool_search" && toolSearch) {
+            validateOpenAiToolSearchTool(tool);
+            callable("tool_search");
         }
         else {
             throw new CodingProxyError(400, openAiCode("openai_tool_not_allowed", tool.type));
         }
     }
 }
+// The arguments the model gave the client-side tool_search, as its parameters
+// in the captures declare them: a query and an optional result limit.
+function validateOpenAiToolSearchArguments(value) {
+    const args = openAiRecord(value);
+    openAiOnlyKeys(args, ["query", "limit"]);
+    openAiString(args.query, MAX_TOOL_TEXT_BYTES);
+    if (args.limit !== undefined && !(Number.isSafeInteger(args.limit) && args.limit > 0)) {
+        throw new CodingProxyError(400, "invalid_openai_request");
+    }
+}
 function validateOpenAiContentPart(value, allowed) {
     const part = openAiRecord(value);
     if (typeof part.type !== "string" || !allowed.has(part.type)) {
@@ -241,7 +288,7 @@ function validateOpenAiTextParts(value, type) {
         openAiString(part.text, PROXY_MAX_BODY_BYTES);
     }
 }
-function validateOpenAiInputItem(value, toolCount) {
+function validateOpenAiInputItem(value, distinctTools) {
     const item = openAiRecord(value);
     switch (item.type) {
         case undefined:
@@ -300,12 +347,32 @@ function validateOpenAiInputItem(value, toolCount) {
             openAiOptional(item.recipient, (value) => openAiString(value, MAX_OPENAI_ID_LENGTH));
             validateOpenAiContent(item.content, OPENAI_AGENT_MESSAGE_PARTS, false);
             return;
+        case "tool_search_call":
+            openAiOnlyKeys(item, ["type", "id", "call_id", "status", "execution", "arguments"]);
+            openAiOptional(item.id, openAiId);
+            openAiId(item.call_id);
+            openAiOptional(item.status, (value) => openAiString(value, 64));
+            if (item.execution !== "client")
+                throw new CodingProxyError(400, openAiCode("openai_input_not_allowed", item.type));
+            validateOpenAiToolSearchArguments(item.arguments);
+            return;
+        case "tool_search_output":
+            // The tools the client-side search loaded: each one passes the same checks
+            // as a top-level tool, so this cannot bring in a shape the proxy refuses.
+            openAiOnlyKeys(item, ["type", "id", "call_id", "status", "execution", "tools"]);
+            openAiOptional(item.id, openAiId);
+            openAiId(item.call_id);
+            openAiOptional(item.status, (value) => openAiString(value, 64));
+            if (item.execution !== "client")
+                throw new CodingProxyError(400, openAiCode("openai_input_not_allowed", item.type));
+            validateOpenAiTools(item.tools, distinctTools, { inSearchOutput: true });
+            return;
         case "additional_tools":
             openAiOnlyKeys(item, ["type", "id", "role", "tools"]);
             openAiOptional(item.id, openAiId);
             if (item.role !== undefined && item.role !== "developer")
                 throw new CodingProxyError(400, "invalid_openai_request");
-            validateOpenAiTools(item.tools, toolCount);
+            validateOpenAiTools(item.tools, distinctTools);
             return;
         default:
             throw new CodingProxyError(400, openAiCode("openai_input_not_allowed", item.type));
@@ -372,9 +439,9 @@ function validateOpenAiBody(body) {
         throw new CodingProxyError(400, "invalid_openai_request");
     }
     openAiOptional(body.instructions, (value) => openAiString(value, PROXY_MAX_BODY_BYTES));
-    const toolCount = { value: 0 };
+    const distinctTools = new Set();
     if (body.tools !== undefined)
-        validateOpenAiTools(body.tools, toolCount);
+        validateOpenAiTools(body.tools, distinctTools, { toolSearch: true });
     if (body.tool_choice !== undefined) {
         if (typeof body.tool_choice !== "string" || !OPENAI_TOOL_CHOICES.has(body.tool_choice)) {
             throw new CodingProxyError(400, "openai_tool_choice_not_allowed");
@@ -401,7 +468,7 @@ function validateOpenAiBody(body) {
         throw new CodingProxyError(400, "invalid_openai_request");
     }
     for (const item of body.input)
-        validateOpenAiInputItem(item, toolCount);
+        validateOpenAiInputItem(item, distinctTools);
 }
 function parseOpenAiRequest(rawBody) {
     if (Buffer.byteLength(rawBody) > PROXY_MAX_BODY_BYTES)
@@ -516,15 +583,33 @@ function validateStructuredOutputTool(value) {
     if (tool.cache_control !== undefined)
         validateCacheControl(tool.cache_control);
 }
-function validateApprovedTool(value) {
+/**
+ * One of the run's pinned MCP tools, as Claude Code advertises it: a plain client tool named
+ * `mcp__wardby_mcp__<exposed name>` (fixtures/claude-code-2.1.286-mcp-requests.json). Only the name
+ * is checked against the pins; the gateway checks the call itself again.
+ */
+function validateMcpTool(tool) {
+    onlyKeys(tool, ["name", "description", "input_schema", "cache_control", "type"]);
+    if ((tool.description !== undefined &&
+        (typeof tool.description !== "string" || tool.description.length > MAX_TOOL_TEXT_BYTES)) ||
+        (tool.type !== undefined && tool.type !== "custom")) {
+        throw new CodingProxyError(400, "tools_not_allowed");
+    }
+    record(tool.input_schema, "tools_not_allowed");
+    if (tool.cache_control !== undefined)
+        validateCacheControl(tool.cache_control);
+}
+function validateApprovedTool(value, mcpTools) {
     const tool = record(value, "tools_not_allowed");
     if (tool.name === WARDBY_COMMAND_TOOL)
         return validateCommandTool(tool);
     if (tool.name === STRUCTURED_OUTPUT_TOOL)
         return validateStructuredOutputTool(tool);
+    if (typeof tool.name === "string" && mcpTools.has(tool.name))
+        return validateMcpTool(tool);
     throw new CodingProxyError(400, "tools_not_allowed");
 }
-function validateToolUseBlock(value) {
+function validateToolUseBlock(value, mcpTools) {
     onlyKeys(value, ["type", "id", "name", "input"]);
     if (typeof value.id !== "string" || value.id.length < 1 || value.id.length > 512) {
         throw new CodingProxyError(400, "unsupported_anthropic_feature");
@@ -533,6 +618,9 @@ function validateToolUseBlock(value) {
         return validateCommandInput(value.input);
     if (value.name === STRUCTURED_OUTPUT_TOOL)
         return void record(value.input, "unsupported_anthropic_feature");
+    if (typeof value.name === "string" && mcpTools.has(value.name)) {
+        return void record(value.input, "unsupported_anthropic_feature");
+    }
     throw new CodingProxyError(400, "unsupported_anthropic_feature");
 }
 function validateToolResultBlock(value) {
@@ -559,7 +647,7 @@ function validateThinkingBlock(value) {
         throw new CodingProxyError(400, "unsupported_anthropic_feature");
     }
 }
-function validateMessageBlocks(value, role) {
+function validateMessageBlocks(value, role, mcpTools) {
     if (!Array.isArray(value) || value.length > 10_000)
         throw new CodingProxyError(400, "invalid_anthropic_request");
     for (const candidate of value) {
@@ -568,7 +656,7 @@ function validateMessageBlocks(value, role) {
             validateTextBlock(block);
         }
         else if (block.type === "tool_use" && role === "assistant") {
-            validateToolUseBlock(block);
+            validateToolUseBlock(block, mcpTools);
         }
         else if (block.type === "tool_result" && role === "user") {
             validateToolResultBlock(block);
@@ -624,7 +712,7 @@ function validateEffortConfig(value, { thinkingMode, efforts }, betas) {
         throw new CodingProxyError(400, "unsupported_anthropic_feature");
     }
 }
-function parseAnthropicRequest(rawBody, betaHeader, shape) {
+function parseAnthropicRequest(rawBody, betaHeader, shape, mcpTools) {
     const beta = parseAnthropicBeta(betaHeader);
     if (Buffer.byteLength(rawBody) > PROXY_MAX_BODY_BYTES)
         throw new CodingProxyError(413, "payload_too_large");
@@ -688,18 +776,20 @@ function parseAnthropicRequest(rawBody, betaHeader, shape) {
                 continue;
             }
         }
-        validateMessageBlocks(message.content, message.role);
+        validateMessageBlocks(message.content, message.role, mcpTools);
     }
     if (body.tools !== undefined) {
-        if (!Array.isArray(body.tools) || body.tools.length > 2)
+        // run_command and StructuredOutput, plus one per pinned MCP tool.
+        if (!Array.isArray(body.tools) || body.tools.length > 2 + mcpTools.size) {
             throw new CodingProxyError(400, "tools_not_allowed");
+        }
         const names = new Set();
         for (const tool of body.tools) {
             const definition = record(tool, "tools_not_allowed");
             if (typeof definition.name !== "string" || names.has(definition.name))
                 throw new CodingProxyError(400, "tools_not_allowed");
             names.add(definition.name);
-            validateApprovedTool(definition);
+            validateApprovedTool(definition, mcpTools);
         }
     }
     if (body.metadata !== undefined) {
@@ -760,13 +850,17 @@ function parseAnthropicRequest(rawBody, betaHeader, shape) {
         anthropicBeta: beta.header,
     };
 }
-function parseRequest(protocol, rawBody, anthropicBeta, shape) {
+/** The Claude tool names of a session's pinned MCP tools; empty for a session without pins. */
+function claudeMcpToolNames(pins) {
+    return new Set((pins ?? []).map((pin) => `${CLAUDE_MCP_TOOL_PREFIX}${pin.exposedName}`));
+}
+function parseRequest(protocol, rawBody, anthropicBeta, shape, mcpTools) {
     if (protocol !== "anthropic-messages" && anthropicBeta !== undefined) {
         throw new CodingProxyError(400, "invalid_anthropic_beta");
     }
     try {
         return protocol === "anthropic-messages"
-            ? parseAnthropicRequest(rawBody, anthropicBeta, shape)
+            ? parseAnthropicRequest(rawBody, anthropicBeta, shape, mcpTools)
             : parseOpenAiRequest(rawBody);
     }
     catch (error) {
@@ -874,6 +968,11 @@ export class CodingProxy {
             throw new Error("invalid_proxy_deadline");
         if (!input.credentialRef || input.credentialRef.length > 200)
             throw new Error("invalid_proxy_credential_reference");
+        // Both or neither: pins without a token could never be called, a token without pins lists nothing.
+        const mcp = input.mcpTools !== undefined || input.mcpTokenHash !== undefined;
+        if (mcp && (!input.mcpTools || input.mcpTools.length === 0 || !input.mcpTokenHash)) {
+            throw new Error("invalid_proxy_mcp_tools");
+        }
         const capability = `rrp_${randomBytes(32).toString("base64url")}`;
         const id = randomUUID();
         const registryTokenHash = capabilityHash(deriveRegistryToken(capability));
@@ -888,6 +987,7 @@ export class CodingProxy {
             budgetUsd: input.budgetUsd,
             registryTokenHash,
             terms: input.terms,
+            ...(mcp ? { mcpTools: input.mcpTools, mcpTokenHash: input.mcpTokenHash } : {}),
         });
         this.audit({ type: "session.created", runId: input.runId });
         return {
@@ -934,7 +1034,7 @@ export class CodingProxy {
         };
         let parsed;
         try {
-            parsed = parseRequest(input.protocol, input.rawBody, input.anthropicBeta, shape);
+            parsed = parseRequest(input.protocol, input.rawBody, input.anthropicBeta, shape, claudeMcpToolNames(session.mcpTools));
         }
         catch (error) {
             // The session is already authenticated and no credential has been

package/dist/providers/coding-proxy/runtime.d.ts

@@ -14,6 +14,12 @@ import type { ProxyAuditSink } from "./types.js";
  *  JSON). Exported so its header-mapping can be unit-tested directly,
  *  without needing a live upstream. */
 export declare function createRegistryUpstream(pinned: typeof globalThis.fetch): UpstreamFetch;
+/**
+ * WARDBY_MCP_GATEWAY_URL: the native gateway's base URL, which the /mcp route forwards to (its
+ * /coding-mcp route). Unset or empty: /mcp answers 503 mcp_unavailable. Anything but an http(s) URL
+ * without credentials, query or fragment stops start-up (the value is not echoed).
+ */
+export declare function loadMcpGatewayUrl(env: NodeJS.ProcessEnv): string | undefined;
 export interface CodingProxyRuntimeOptions {
     db: PrismaClient;
     /** The package registry's own client, so its traffic (many concurrent

package/dist/providers/coding-proxy/runtime.js

@@ -10,6 +10,7 @@ import { ModelRequestSeal } from "./dependency-cache/model-request-seal.js";
 import { DependencyCacheService } from "./dependency-cache/service.js";
 import { startDenyPortListener } from "./deny-port.js";
 import { EnvironmentCredentialResolver } from "./environment-credentials.js";
+import { createMcpRoute } from "./mcp-route.js";
 import { createMockUpstream, mockUpstreamFromEnv } from "./mock-upstream.js";
 import { CodingProxy } from "./proxy.js";
 import { PrismaProxyLedger } from "./prisma-ledger.js";
@@ -44,6 +45,32 @@ export function createRegistryUpstream(pinned) {
         },
     });
 }
+/**
+ * WARDBY_MCP_GATEWAY_URL: the native gateway's base URL, which the /mcp route forwards to (its
+ * /coding-mcp route). Unset or empty: /mcp answers 503 mcp_unavailable. Anything but an http(s) URL
+ * without credentials, query or fragment stops start-up (the value is not echoed).
+ */
+export function loadMcpGatewayUrl(env) {
+    const value = env.WARDBY_MCP_GATEWAY_URL?.trim();
+    if (!value)
+        return undefined;
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        url = undefined;
+    }
+    if (!url ||
+        (url.protocol !== "http:" && url.protocol !== "https:") ||
+        url.username ||
+        url.password ||
+        url.search ||
+        url.hash) {
+        throw new Error("WARDBY_MCP_GATEWAY_URL must be an http(s) URL without credentials, query or fragment");
+    }
+    return url.href.replace(/\/+$/, "");
+}
 /** Starts the trusted proxy with the fixed worker-only Docker endpoint, plus the deny port the enforcement witness probes. */
 export async function startConfiguredCodingProxy(options) {
     const env = options.env ?? process.env;
@@ -57,6 +84,8 @@ export async function startConfiguredCodingProxy(options) {
     const audit = mock
         ? (event) => options.audit?.({ ...event, mockUpstream: true })
         : options.audit;
+    // Throws on an invalid setting, before anything listens.
+    const mcpGatewayUrl = loadMcpGatewayUrl(env);
     // Throws (test_simulators_refused) on any refusal, before anything listens.
     const simulators = startupTestSimulators("coding-proxy", env);
     const buildPinnedFetch = options.createPinnedFetch ?? createPinnedProxyFetch;
@@ -123,8 +152,9 @@ export async function startConfiguredCodingProxy(options) {
         logger.warn({ module: "coding-proxy-runtime", event: "proxy.dependency_cache_no_blob_store" }, "coding proxy: WARDBY_DEPENDENCY_CACHE=true but no BLOB_STORE is configured; the dependency cache is off");
     }
     const seal = modelRequestSeal;
+    const ledger = new PrismaProxyLedger(options.db);
     const proxy = new CodingProxy({
-        ledger: new PrismaProxyLedger(options.db),
+        ledger,
         credentials: new EnvironmentCredentialResolver(env),
         audit,
         // WARDBY_TEST_SIMULATORS (test only; refused alongside the mock upstream): the scripted model,
@@ -146,6 +176,7 @@ export async function startConfiguredCodingProxy(options) {
             expectedHost: `${CODING_PROXY_ALIAS}:${CODING_PROXY_PORT}`,
             registry,
             ...(dependencyCache ? { dependencyCache } : {}),
+            mcp: createMcpRoute({ ledger, gatewayUrl: mcpGatewayUrl }),
             onRequest: options.onRequest,
         });
     }

package/dist/providers/coding-proxy/server.d.ts

@@ -1,3 +1,4 @@
+import { type IncomingMessage, type ServerResponse } from "node:http";
 import type { ProxyAuditEvent } from "./types.js";
 import { type CodingProxy } from "./proxy.js";
 import { type RegistryService } from "./registry/service.js";
@@ -19,6 +20,8 @@ export interface CodingProxyServerConfig {
     dependencyCache?: Pick<DependencyCacheService, "handle" | "uploadMs">;
     /** Time to receive a whole request (default HTTP_LIMITS.requestMs); a cache upload gets its upload window instead. */
     requestMs?: number;
+    /** The worker's MCP route (`/mcp`, createMcpRoute); absent, /mcp is not found. */
+    mcp?: (request: IncomingMessage, response: ServerResponse) => Promise<void>;
     onRequest?: (event: {
         protocol: ProxyProtocol | "other";
         status: number;

package/dist/providers/coding-proxy/server.js

@@ -6,6 +6,7 @@ import { logger } from "../../core/logger.js";
 import { CodingProxyError, PROXY_MAX_BODY_BYTES } from "./proxy.js";
 import { RegistryError } from "../../coding/registry/types.js";
 import { MAX_PLAN_BODY_BYTES } from "./registry/service.js";
+import { MCP_ROUTE_PATH } from "./mcp-route.js";
 const proxyLog = logger.child({ module: "coding-proxy" });
 /**
  * Writes a proxy audit event to the operator log. The events carry ids,
@@ -266,6 +267,15 @@ export async function startCodingProxyServer(proxy, config) {
                 });
                 return;
             }
+            if (request.url === MCP_ROUTE_PATH || request.url?.startsWith(`${MCP_ROUTE_PATH}?`)) {
+                if (!config.mcp) {
+                    closeIfBodyUnread(request, response);
+                    sendError(response, 404, "not_found");
+                    return;
+                }
+                await config.mcp(request, response);
+                return;
+            }
             if (request.method === "HEAD" && request.url === "/api/hello") {
                 response.writeHead(200, { "cache-control": "no-store" }).end();
                 return;