@wardby/cli 0.7.0 → 0.9.0

package/dist/mcp/tools/agents.js

@@ -7,6 +7,8 @@
  */
 import { Prisma } from "#prisma";
 import { z } from "zod";
+import { RUN_STEPS_LEVELS, loadRunStepsLevel, runStepsAboveCeilingWarning, } from "../../core/run-steps/config.js";
+import { codeProviderOf } from "../../coding/code-host.js";
 import { CodingProfilePatchSchema, CodingProfileSchema } from "../../coding/profile.js";
 import { DEFAULT_CLAUDE_MAX_OUTPUT_TOKENS, DEFAULT_CLAUDE_MAX_TURNS, MAX_CLAUDE_MAX_OUTPUT_TOKENS, MIN_CLAUDE_MAX_OUTPUT_TOKENS, DEFAULT_DEBUG_TRACE_MAX_MB, MAX_CODING_TURNS, MAX_DEBUG_TRACE_MAX_MB, isLocalRepository, } from "../../coding/protocol.js";
 import { loadBlobStoreConfig, loadContainerExecutorConfig } from "../../config/providers.js";
@@ -18,12 +20,15 @@ import { ModelUnavailableError } from "../../providers/llm/catalog-types.js";
 import { currentModelCatalog } from "../../providers/llm/catalog-store.js";
 import { validateCronExpression } from "../../core/cron.js";
 import { scheduleStartFields } from "../../core/schedule-start.js";
+import { preferIndexScans, withSerializableRetry } from "../../core/serializable-retry.js";
 import { modelSupportedEfforts } from "../../providers/llm/routing.js";
+import { agentMcpServerViews, codexUnavailableMcpTools, codexWriteToolsWarning } from "./mcp-servers.js";
+import { isCodexCoding } from "../../core/mcp-tools.js";
 import { PROJECT_KEY } from "../../providers/issue-tracker/types.js";
 import { LLM_EFFORT_LEVELS, isLlmEffort } from "../../providers/llm/types.js";
 import { requireReadableBudgetGroup } from "../auth/ownership.js";
 import { agentAccessResolver, agentNotFound, assertAgentAccess, readableAgentsWhere, requireAgentAccess, } from "../auth/access.js";
-import { EVERYONE_KEY, atLeast, canDelegate, deleteGrantsFor, effectiveAccess, isPublicWritable, } from "../../core/grants.js";
+import { EVERYONE_KEY, atLeast, canDelegate, deleteGrantsFor, effectiveAccess, isPublicWritable, filterUnusableMcpServers, } from "../../core/grants.js";
 import { projectTool } from "./tools.js";
 import { withZod3ToolWarnings } from "../../core/zod3-window.js";
 import { requireAnyScope, requireScope } from "../auth/resource-server.js";
@@ -120,6 +125,27 @@ function withProfileWarnings(agent) {
     const warnings = profileWarnings(profile, now);
     return warnings.length ? { ...shown, warnings } : shown;
 }
+// No JSON-schema enum on purpose: the zod check then refuses a bad value naming off, summary and detail.
+const RUN_STEPS_DESCRIPTION = "Run steps level for this agent's runs (owner only): off records nothing, summary one line per tool call or message " +
+    "(the default), detail also the tool input, the end of each tool's output and the model's text, readable only by the " +
+    "agent's owner and the run's starter. A run records the lower of this and the instance's WARDBY_RUN_STEPS, fixed " +
+    "when it starts. detail stores tool output: secrets the run was given are removed, but a secret that exists only in " +
+    "a file the run read can remain. Null clears it (summary).";
+/** For a warning only: an invalid WARDBY_RUN_STEPS stopped start-up already; never fails the tool call. */
+function runStepsCeiling() {
+    try {
+        return loadRunStepsLevel(process.env);
+    }
+    catch {
+        return undefined;
+    }
+}
+/** An agent as returned to operators: a warning when its runSteps is above the instance's ceiling. */
+function withRunStepsWarning(agent) {
+    const ceiling = runStepsCeiling();
+    const warning = ceiling ? runStepsAboveCeilingWarning(agent.runSteps, ceiling) : undefined;
+    return warning ? { ...agent, warnings: [...(agent.warnings ?? []), warning] } : agent;
+}
 const agentFields = {
     name: z.string().trim().min(1).max(MAX_AGENT_NAME_CHARS),
     systemPrompt: z.string().min(1).max(MAX_SYSTEM_PROMPT_CHARS),
@@ -136,6 +162,7 @@ const agentFields = {
     budgetGroupId: z.string().min(1).max(128),
     memoryEnabled: z.boolean(),
     effort: z.enum(LLM_EFFORT_LEVELS),
+    runSteps: z.enum(RUN_STEPS_LEVELS),
     nativeExecutionMode: z.enum(NATIVE_EXECUTION_MODES),
     defectProjectKey: z.string().regex(PROJECT_KEY, "must be an upper-case Jira project key"),
     defectIssueType: z.string().trim().min(1).max(100),
@@ -171,6 +198,7 @@ const CreateAgentSchema = z
     budgetGroupId: agentFields.budgetGroupId.optional(),
     memoryEnabled: agentFields.memoryEnabled.default(false),
     effort: agentFields.effort.optional(),
+    runSteps: agentFields.runSteps.optional(),
     nativeExecutionMode: agentFields.nativeExecutionMode.optional(),
     defectProjectKey: agentFields.defectProjectKey.optional(),
     defectIssueType: agentFields.defectIssueType.optional(),
@@ -229,6 +257,7 @@ const UpdateAgentSchema = z
     budgetGroupId: agentFields.budgetGroupId.nullable().optional(),
     memoryEnabled: agentFields.memoryEnabled.optional(),
     effort: agentFields.effort.nullable().optional(),
+    runSteps: agentFields.runSteps.nullable().optional(),
     nativeExecutionMode: agentFields.nativeExecutionMode.optional(),
     defectProjectKey: agentFields.defectProjectKey.nullable().optional(),
     defectIssueType: agentFields.defectIssueType.nullable().optional(),
@@ -491,7 +520,7 @@ export function registerAgentTools(mcp) {
                     type: "integer",
                     minimum: 1,
                     maximum: MAX_DELEGATIONS_PER_RUN,
-                    description: "Native agents with sub-agents: how many delegate_to_* calls one run may make, each to a different sub-agent " +
+                    description: "Native agents with sub-agents: how many delegate_to_* calls one run may make, to each sub-agent and repository at most once " +
                         "(one after another, or together with parallelDelegations). Default 1: route to exactly one.",
                 },
                 parallelDelegations: { type: "boolean", description: PARALLEL_DELEGATIONS_DESCRIPTION },
@@ -506,6 +535,7 @@ export function registerAgentTools(mcp) {
                     enum: [...LLM_EFFORT_LEVELS],
                     description: "Reasoning effort for native agents. Unset uses the provider default.",
                 },
+                runSteps: { type: "string", description: RUN_STEPS_DESCRIPTION },
                 nativeExecutionMode: {
                     type: "string",
                     enum: [...NATIVE_EXECUTION_MODES],
@@ -550,7 +580,7 @@ export function registerAgentTools(mcp) {
             const authorization = codingProfile
                 ? await authorizeRepositoryForSet(ctx, {
                     ownerId: ctx.principal.id,
-                    provider: "github",
+                    provider: codeProviderOf(codingProfile.repository),
                     repository: codingProfile.repository,
                     kind: "coding",
                     adminOverride: repositoryAdminOverride === true,
@@ -571,7 +601,7 @@ export function registerAgentTools(mcp) {
                 },
                 include: { codingProfile: true },
             });
-            return textResult(withProfileWarnings(withOperatorMode(agent)));
+            return textResult(withRunStepsWarning(withProfileWarnings(withOperatorMode(agent))));
         },
     });
     mcp.registerTool({
@@ -597,7 +627,7 @@ export function registerAgentTools(mcp) {
                     type: "integer",
                     minimum: 1,
                     maximum: MAX_DELEGATIONS_PER_RUN,
-                    description: "Native agents with sub-agents: how many delegate_to_* calls one run may make, each to a different sub-agent " +
+                    description: "Native agents with sub-agents: how many delegate_to_* calls one run may make, to each sub-agent and repository at most once " +
                         "(one after another, or together with parallelDelegations). Default 1: route to exactly one.",
                 },
                 parallelDelegations: { type: "boolean", description: PARALLEL_DELEGATIONS_DESCRIPTION },
@@ -612,6 +642,7 @@ export function registerAgentTools(mcp) {
                     enum: [...LLM_EFFORT_LEVELS, null],
                     description: "Reasoning effort for native agents. Null clears it back to the provider default.",
                 },
+                runSteps: { type: ["string", "null"], description: RUN_STEPS_DESCRIPTION },
                 nativeExecutionMode: {
                     type: "string",
                     enum: [...NATIVE_EXECUTION_MODES],
@@ -726,19 +757,21 @@ export function registerAgentTools(mcp) {
             // and budget-group membership direct what runs do with the owner's
             // repository access and money: owner-only, like the repository itself
             // (review I1/M1/M6). Write keeps name, prompt, model, budget amount,
-            // turns, effort, memory and schedule.
+            // turns, effort, memory and schedule. The run steps level is the owner's too:
+            // detail records tool output that only the owner and the run's starter may read.
             const ownerOnlyChange = (existingKind) => args.codingProfile !== undefined ||
                 (args.kind !== undefined && args.kind !== existingKind) ||
-                args.budgetGroupId !== undefined;
+                args.budgetGroupId !== undefined ||
+                args.runSteps !== undefined;
             const refuseOwnerOnly = () => {
-                throw new McpError(403, `Agent "${args.id}": only its owner can change its coding profile, kind or budget group.`);
+                throw new McpError(403, `Agent "${args.id}": only its owner can change its coding profile, kind, budget group or run steps level.`);
             };
             if (!adminEdit && !isOwner && ownerOnlyChange(before.kind))
                 refuseOwnerOnly();
             const authorization = plannedRepository !== null && repositoryChanges(before)
                 ? await authorizeRepositoryForSet(ctx, {
                     ownerId: before.ownerId,
-                    provider: "github",
+                    provider: codeProviderOf(plannedRepository),
                     repository: plannedRepository,
                     kind: "coding",
                     adminOverride: args.repositoryAdminOverride === true,
@@ -774,6 +807,17 @@ export function registerAgentTools(mcp) {
                     await requireReadableBudgetGroup(tx, args.budgetGroupId, ctx.principal.id);
                 }
                 const nextKind = args.kind ?? existing.kind;
+                if (nextKind !== existing.kind) {
+                    // A write link without triggers is a coding agent's extra repository
+                    // and a native agent's plain write access; changing kind would
+                    // silently reinterpret it.
+                    const reinterpreted = await tx.agentRepository.count({
+                        where: { agentId: args.id, access: "write", triggers: { isEmpty: true } },
+                    });
+                    if (reinterpreted > 0) {
+                        throw new McpError(400, `Agent "${args.id}" has write repository links without triggers, which mean different things on native and coding agents; unlink them before changing its kind.`);
+                    }
+                }
                 // A coding repository is an owner binding (agentOwnerBindings): an
                 // agent everyone can write never gets one, as attach_* refuse theirs.
                 if (((nextKind === "coding" && existing.kind !== "coding") || repositoryChanges(existing)) &&
@@ -892,16 +936,59 @@ export function registerAgentTools(mcp) {
                     by: ctx.principal.id,
                 }, "coding package audit mode set");
             }
-            return textResult(withProfileWarnings(withOperatorMode(agent)));
+            const shown = withRunStepsWarning(withProfileWarnings(withOperatorMode(agent)));
+            // Becoming Codex (a provider switch, or a native agent becoming coding) leaves out every attached
+            // MCP tool the server doesn't mark read-only: say which, so the owner isn't surprised by a run.
+            const wasCodex = before.kind === "coding" && isCodexCoding(before.codingProfile?.provider);
+            if (agent.kind === "coding" && isCodexCoding(agent.codingProfile?.provider) && !wasCodex) {
+                const writers = await codexUnavailableMcpTools(ctx.db, agent.id);
+                if (writers.length > 0) {
+                    return textResult({ ...shown, warnings: [...(shown.warnings ?? []), codexWriteToolsWarning(writers)] });
+                }
+            }
+            return textResult(shown);
         },
     });
     mcp.registerTool({
         name: "list_agents",
         scope: "agents:read",
-        description: "Lists the agents you can see. Each row has an `access` field, your level on that agent: owner > write > execute > read. When showing the agents as a table, include `access` as a column.",
-        inputSchema: { type: "object", properties: {}, additionalProperties: false },
-        handler: async (_args, ctx) => {
-            const [where, accessOf] = await Promise.all([readableAgentsWhere(ctx), agentAccessResolver(ctx)]);
+        description: "Lists the agents you can see. Each row has an `access` field, your level on that agent: owner > write > execute > read. When showing the agents as a table, include `access` as a column. " +
+            "summary: true returns only id, name, kind, model, codingProvider, budgetUsd, ownerId, runSteps and access per agent, for listings that don't need the full configuration. " +
+            "all: true lists every agent in the deployment (admins only, admin:view); an agent you have no grant on shows access `none`.",
+        inputSchema: {
+            type: "object",
+            properties: { summary: { type: "boolean" }, all: { type: "boolean" } },
+            additionalProperties: false,
+        },
+        handler: async (args, ctx) => {
+            if (args.all === true && !ctx.operator)
+                requireScope(ctx, ctx.canonicalUri, "admin:view");
+            const [where, accessOf] = await Promise.all([
+                args.all === true ? Promise.resolve({}) : readableAgentsWhere(ctx),
+                agentAccessResolver(ctx),
+            ]);
+            if (args.summary === true) {
+                const agents = await ctx.db.agent.findMany({
+                    where,
+                    select: {
+                        id: true,
+                        name: true,
+                        kind: true,
+                        model: true,
+                        budgetUsd: true,
+                        ownerId: true,
+                        runSteps: true,
+                        codingProfile: { select: { provider: true } },
+                    },
+                    orderBy: { name: "asc" },
+                });
+                return textResult(agents.map(({ codingProfile, budgetUsd, ...agent }) => ({
+                    ...agent,
+                    codingProvider: codingProfile?.provider ?? null,
+                    budgetUsd: Number(budgetUsd),
+                    access: accessOf(agent),
+                })));
+            }
             const agents = await ctx.db.agent.findMany({ where, include: { codingProfile: true } });
             return textResult(agents.map((agent) => ({ ...withOperatorMode(agent), access: accessOf(agent) })));
         },
@@ -923,8 +1010,9 @@ export function registerAgentTools(mcp) {
             // A7: a tool's code and schema are its owner's, whoever can read the
             // agent (the agent's owner included). Capabilities stay visible: config.
             return textResult({
-                ...withProfileWarnings(withOperatorMode(agent)),
+                ...withRunStepsWarning(withProfileWarnings(withOperatorMode(agent))),
                 access,
+                mcpServers: await agentMcpServerViews(ctx.db, agent.id),
                 // Zod 3 window: the caller's own tools carry their warnings (see core/zod3-window.ts).
                 tools: await Promise.all(agent.tools.map(async (attachment) => ({
                     ...attachment,
@@ -974,7 +1062,7 @@ export function registerAgentTools(mcp) {
     mcp.registerTool({
         name: "make_owner",
         scope: "agents:admin",
-        description: "Admins: gives an agent a new owner (an existing principal id). Secret and datastore bindings the new owner doesn't own are removed; tool capabilities the new owner never granted are suspended until they re-run attach_tool; sub-agent edges the new owner can't delegate are removed; between two owners every grant on the agent is reset (adopting an owner-less agent keeps them). Returns what changed.",
+        description: "Admins: gives an agent a new owner (an existing principal id). Secret, datastore and MCP server bindings the new owner doesn't own are removed; tool capabilities the new owner never granted are suspended until they re-run attach_tool; sub-agent edges the new owner can't delegate are removed; between two owners every grant on the agent is reset (adopting an owner-less agent keeps them). Returns what changed.",
         inputSchema: {
             type: "object",
             additionalProperties: false,
@@ -996,7 +1084,9 @@ export function registerAgentTools(mcp) {
             const principal = await ctx.db.principal.findUnique({ where: { id: newOwner } });
             if (!principal)
                 throw new McpError(400, `Principal "${newOwner}" not found.`);
-            const result = await ctx.db.$transaction(async (tx) => {
+            // Bounded retry: a concurrent grant or attach on the same rows aborts one side (Serializable).
+            const result = await withSerializableRetry(() => ctx.db.$transaction(async (tx) => {
+                await preferIndexScans(tx);
                 const agent = await tx.agent.findUnique({ where: { id: args.agentId }, include: { codingProfile: true } });
                 if (!agent)
                     throw agentNotFound(args.agentId);
@@ -1015,7 +1105,10 @@ export function registerAgentTools(mcp) {
                         where: { agentId: agent.id, authorizedVia: approved },
                         orderBy: { repository: "asc" },
                     });
-                    await tx.agentRepository.updateMany({ where: { agentId: agent.id, authorizedVia: approved }, data: reset });
+                    await tx.agentRepository.updateMany({
+                        where: { agentId: agent.id, authorizedVia: approved },
+                        data: reset,
+                    });
                     revoked.push(...links.map((l) => l.repository));
                     const profile = await tx.codingAgentProfile.updateMany({
                         where: { agentId: agent.id, repositoryAuthorizedVia: approved },
@@ -1072,9 +1165,31 @@ export function registerAgentTools(mcp) {
                         where: { agentId: agent.id, datastoreId: { in: foreignDatastores.map((b) => b.datastoreId) } },
                     });
                 }
+                // MCP server attachments: the server's brokered secrets act for its
+                // owner, so a server the new owner neither owns nor holds use on is detached.
+                const mcpServers = await tx.agentMcpServer.findMany({
+                    where: { agentId: agent.id },
+                    include: { server: { select: { id: true, name: true, ownerId: true } } },
+                    orderBy: { serverId: "asc" },
+                });
+                const foreignMcpServers = await filterUnusableMcpServers(tx, () => newOwner, mcpServers);
+                if (foreignMcpServers.length > 0) {
+                    await tx.agentMcpServer.deleteMany({
+                        where: { agentId: agent.id, serverId: { in: foreignMcpServers.map((b) => b.serverId) } },
+                    });
+                }
                 const bindingsRemoved = [
                     ...foreignSecrets.map((b) => ({ kind: "secret", boundName: b.boundName, resourceId: b.secretId })),
-                    ...foreignDatastores.map((b) => ({ kind: "datastore", boundName: b.boundName, resourceId: b.datastoreId })),
+                    ...foreignDatastores.map((b) => ({
+                        kind: "datastore",
+                        boundName: b.boundName,
+                        resourceId: b.datastoreId,
+                    })),
+                    ...foreignMcpServers.map((b) => ({
+                        kind: "mcp_server",
+                        boundName: b.server.name,
+                        resourceId: b.serverId,
+                    })),
                 ];
                 // Tool capabilities: rows aren't rewritten; the runner ignores any
                 // the new owner never stamped (capabilitiesGrantedById).
@@ -1132,7 +1247,7 @@ export function registerAgentTools(mcp) {
                     everyoneGrant,
                     webhooksInactive,
                 };
-            }, { isolationLevel: Prisma.TransactionIsolationLevel.Serializable });
+            }, { isolationLevel: Prisma.TransactionIsolationLevel.Serializable }));
             return textResult(result);
         },
     });

package/dist/mcp/tools/grants.js

@@ -1,18 +1,22 @@
 /**
  * grant_access / revoke_access / list_access: the owner's sharing controls
- * (resource-sharing grants spec §3.11). Phase 1 shares agents only; other
- * resource types are refused as "not shareable yet".
+ * (resource-sharing grants spec §3.11). Agents and MCP servers are shareable;
+ * other resource types are refused as "not shareable yet".
  *
  * - Only the resource's owner (or the stdio operator) grants and revokes.
  *   Admins get no implicit access: they may only list_access, for incident
  *   response ("who can reach this?"), and reassign with make_owner.
  * - One grant per resource and grantee, so granting again replaces the
  *   level (also downgrades). Everyone grants are capped below write.
- * - Takes effect on the next check; runs already in flight keep going.
+ * - Takes effect on the next check; runs already in flight keep going. For
+ *   MCP servers the check is every tool call: revoking or lowering a grant
+ *   below use also removes the attachments of agents whose owner can no
+ *   longer use the server, in the same transaction.
  */
 import { z } from "zod";
 import { Prisma } from "#prisma";
-import { EVERYONE_KEY, EVERYONE_MAX, LEVELS, agentOwnerBindings, SHAREABLE_TYPES, accessRank, atLeast, isLevel, isResourceType, principalGranteeKey, } from "../../core/grants.js";
+import { EVERYONE_KEY, EVERYONE_MAX, LEVELS, agentOwnerBindings, SHAREABLE_TYPES, accessRank, atLeast, isLevel, isResourceType, principalGranteeKey, pruneUnusableMcpAttachments, } from "../../core/grants.js";
+import { preferIndexScans, withSerializableRetry } from "../../core/serializable-retry.js";
 import { agentNotFound, assertAgentAccess, agentAccess } from "../auth/access.js";
 import { permissionsOf } from "../auth/resource-server.js";
 import { McpError } from "../errors.js";
@@ -54,10 +58,17 @@ async function resolveGrantee(db, grantee) {
     }
     return principal;
 }
-/** Grant management is the owner's (or the stdio operator's). Phase 1: agents. */
+/** Grant management is the owner's (or the stdio operator's). Agents and MCP servers. */
 async function requireOwnedResource(ctx, db, type, id) {
-    // Only "agent" reaches here in Phase 1 (shareableType).
-    void type;
+    if (type === "mcp_server") {
+        const server = await db.mcpServer.findUnique({ where: { id } });
+        // Missing and someone else's look the same. The stdio operator owns everything.
+        if (!server || (!ctx.operator && server.ownerId !== ctx.principal.id)) {
+            throw new McpError(404, `MCP server "${id}" not found.`);
+        }
+        return server;
+    }
+    // Only "agent" and "mcp_server" reach here (shareableType).
     const row = await db.agent.findUnique({ where: { id } });
     return (await assertAgentAccess(ctx, row, id, "owner", db)).agent;
 }
@@ -65,17 +76,21 @@ async function requireOwnedResource(ctx, db, type, id) {
  * The ownership check and the write in one Serializable transaction (review
  * M3): a concurrent make_owner, which resets grants in its own transaction,
  * conflicts instead of letting the old owner's grant land on the new
- * owner's agent.
+ * owner's agent. A conflict is retried a bounded number of times
+ * (withSerializableRetry); the last one still reaches the caller as a 409.
  */
 function inSerializable(ctx, fn) {
-    return ctx.db.$transaction((tx) => fn(tx), { isolationLevel: Prisma.TransactionIsolationLevel.Serializable });
+    return withSerializableRetry(() => ctx.db.$transaction(async (tx) => {
+        await preferIndexScans(tx);
+        return fn(tx);
+    }, { isolationLevel: Prisma.TransactionIsolationLevel.Serializable }));
 }
 function isAdmin(ctx) {
     return ctx.scopes.has("agents:admin") && permissionsOf(ctx.roles).has("agents:admin");
 }
 const TYPE_PROPERTIES = {
     // No enum: another type gets a clear "not shareable yet" from the handler.
-    resourceType: { type: "string", description: 'Only "agent" is shareable today.' },
+    resourceType: { type: "string", description: 'Agents and MCP servers are shareable: "agent" or "mcp_server".' },
     resourceId: { type: "string" },
 };
 const GRANTEE_PROPERTY = {
@@ -100,21 +115,22 @@ export function registerGrantTools(mcp) {
     mcp.registerTool({
         name: "grant_access",
         scope: "agents:write",
-        description: "Shares an agent you own with one principal or with everyone, at a level: " +
+        description: "Shares an agent or MCP server you own with one principal or with everyone, at a level: " +
             "read (see its config, never secret values or other owners' tool code); " +
             "execute (also trigger runs and see the runs they triggered); " +
             "write (also change its name, prompt, model, budget amount, max turns, effort, memory on/off and schedule, attach tools they can use and detach tools, and create webhooks). " +
             "Owner-only whatever the level: the coding profile (task, base ref, protected paths, task-override opt-in, image, packages, limits), kind, budget group, sub-agents, secret/datastore/repository bindings, tool capabilities, memory and datastore contents, grants, delete. " +
             "Consequences: execute lets them run your agent with your tools, secrets, datastores and repository, and every run shares the agent's memory; they supply no task text unless it's a coding agent with allowWebhookTaskOverride. " +
             "Write lets them rewrite what those runs do: the prompt can make a run use everything the agent can already reach (the capabilities you granted, its memory, its linked repositories), and on a coding agent the prompt is part of every coding task, so write directs work done with your GitHub access. " +
-            "Granting again replaces the level. Everyone may get write only on a native agent with no secrets, datastores, repositories, sub-agents or tool capabilities. The grantee must have signed in once.",
+            "MCP servers (resourceType mcp_server): read < use < write; use on an MCP server lets them attach it to their own agents; its tools then run with your server's credentials. Write adds nothing beyond use: only the owner updates, refreshes, deletes or re-grants a server. Lowering a grant to read (including everyone from use to read) detaches the server from every agent whose owner can no longer use it, and their runs' next call to it is refused. " +
+            "Granting again replaces the level. Everyone may get write only on a native agent with no secrets, datastores, repositories, sub-agents, MCP servers or tool capabilities. The grantee must have signed in once.",
         inputSchema: {
             type: "object",
             additionalProperties: false,
             properties: {
                 ...TYPE_PROPERTIES,
                 grantee: GRANTEE_PROPERTY,
-                level: { type: "string", description: "Agents: read < execute < write." },
+                level: { type: "string", description: "Agents: read < execute < write. MCP servers: read < use < write." },
             },
             required: ["resourceType", "resourceId", "grantee", "level"],
         },
@@ -124,7 +140,7 @@ export function registerGrantTools(mcp) {
             if (!isLevel(type, args.level)) {
                 throw new McpError(400, `Level "${args.level}" is not valid for ${type} (${LEVELS[type].join(" < ")}).`);
             }
-            const { resource, principal, grant } = await inSerializable(ctx, async (tx) => {
+            const { resource, principal, grant, attachmentsRemoved } = await inSerializable(ctx, async (tx) => {
                 const resource = await requireOwnedResource(ctx, tx, type, args.resourceId);
                 const principal = await resolveGrantee(tx, args.grantee);
                 if (principal && (principal.id === resource.ownerId || principal.id === ctx.principal.id)) {
@@ -154,7 +170,11 @@ export function registerGrantTools(mcp) {
                     },
                     update: { level: args.level, source: "owner", grantedById: ctx.principal.id },
                 });
-                return { resource, principal, grant };
+                // Below use, agents whose owner can no longer use the server lose it now (C1).
+                const attachmentsRemoved = type === "mcp_server" && !atLeast(type, args.level, "use")
+                    ? await pruneUnusableMcpAttachments(tx, resource.id)
+                    : 0;
+                return { resource, principal, grant, attachmentsRemoved };
             });
             return textResult({
                 granted: true,
@@ -167,13 +187,14 @@ export function registerGrantTools(mcp) {
                         ? { principalId: principal.id, subject: principal.subject }
                         : { principalId: principal.id },
                 level: grant.level,
+                ...(attachmentsRemoved > 0 ? { attachmentsRemoved } : {}),
             });
         },
     });
     mcp.registerTool({
         name: "revoke_access",
         scope: "agents:write",
-        description: "Removes a grant on an agent you own. Idempotent. Takes effect on the next check (trigger, delegation, webhook fire); runs already in flight keep going.",
+        description: "Removes a grant on an agent or MCP server you own. Idempotent. Takes effect on the next check (trigger, delegation, webhook fire); runs already in flight keep going. For an MCP server the check is every tool call: the server is detached from every agent whose owner can no longer use it (your own agents are untouched), and a run's next call to it is refused with mcp_tool_not_allowed.",
         inputSchema: {
             type: "object",
             additionalProperties: false,
@@ -183,20 +204,25 @@ export function registerGrantTools(mcp) {
         handler: async (rawArgs, ctx) => {
             const args = parse(RevokeSchema, "revoke_access", rawArgs);
             const type = shareableType(args.resourceType);
-            const { count } = await inSerializable(ctx, async (tx) => {
+            const { count, attachmentsRemoved } = await inSerializable(ctx, async (tx) => {
                 const resource = await requireOwnedResource(ctx, tx, type, args.resourceId);
                 const granteeKey = args.grantee === "everyone"
                     ? EVERYONE_KEY
                     : principalGranteeKey((await resolveGrantee(tx, args.grantee)).id);
-                return tx.resourceGrant.deleteMany({ where: { resourceType: type, resourceId: resource.id, granteeKey } });
+                const { count } = await tx.resourceGrant.deleteMany({
+                    where: { resourceType: type, resourceId: resource.id, granteeKey },
+                });
+                // Agents whose owner can no longer use the server lose it now (C1).
+                const attachmentsRemoved = type === "mcp_server" ? await pruneUnusableMcpAttachments(tx, resource.id) : 0;
+                return { count, attachmentsRemoved };
             });
-            return textResult({ revoked: count > 0 });
+            return textResult({ revoked: count > 0, ...(attachmentsRemoved > 0 ? { attachmentsRemoved } : {}) });
         },
     });
     mcp.registerTool({
         name: "list_access",
         scope: "agents:read",
-        description: "Lists who an agent is shared with (grant metadata only). For its owner, the stdio operator, and admins (incident response).",
+        description: "Lists who an agent or MCP server is shared with (grant metadata only). For its owner, the stdio operator, and admins (incident response).",
         inputSchema: {
             type: "object",
             additionalProperties: false,
@@ -206,16 +232,28 @@ export function registerGrantTools(mcp) {
         handler: async (rawArgs, ctx) => {
             const args = parse(ListSchema, "list_access", rawArgs);
             const type = shareableType(args.resourceType);
-            const resource = await ctx.db.agent.findUnique({ where: { id: args.resourceId } });
-            if (!resource)
-                throw agentNotFound(args.resourceId);
-            if (!isAdmin(ctx)) {
-                const access = await agentAccess(ctx, resource);
-                if (!atLeast("agent", access, "read"))
+            let resource;
+            if (type === "mcp_server") {
+                const server = await ctx.db.mcpServer.findUnique({ where: { id: args.resourceId } });
+                // Owner, stdio operator or admin; anyone else sees a missing server.
+                if (!server || (!ctx.operator && !isAdmin(ctx) && server.ownerId !== ctx.principal.id)) {
+                    throw new McpError(404, `MCP server "${args.resourceId}" not found.`);
+                }
+                resource = server;
+            }
+            else {
+                const agent = await ctx.db.agent.findUnique({ where: { id: args.resourceId } });
+                if (!agent)
                     throw agentNotFound(args.resourceId);
-                if (access !== "owner") {
-                    throw new McpError(403, `Agent "${resource.id}": only its owner (or an admin) can list who it is shared with.`);
+                if (!isAdmin(ctx)) {
+                    const access = await agentAccess(ctx, agent);
+                    if (!atLeast("agent", access, "read"))
+                        throw agentNotFound(args.resourceId);
+                    if (access !== "owner") {
+                        throw new McpError(403, `Agent "${agent.id}": only its owner (or an admin) can list who it is shared with.`);
+                    }
                 }
+                resource = agent;
             }
             const grants = await ctx.db.resourceGrant.findMany({
                 where: { resourceType: type, resourceId: resource.id },

package/dist/mcp/tools/host-providers.d.ts

@@ -0,0 +1,2 @@
+import type { WardbyMcpServer } from "../server.js";
+export declare function registerHostProviderTools(mcp: WardbyMcpServer): void;