@zackbart/connecta 0.31.0 → 0.32.0

package/dist/providers/stripe/skill.generated.js

@@ -3,8 +3,8 @@ export const skill = {
     "content": "- Lists are cursor-paginated: `limit` defaults to 10 and caps at 100, `starting_after` and `ending_before` take an object id and are mutually exclusive, and `has_more` says whether to continue. Page inside `execute_code`.\n- Search filters on a documented per-resource field set, not on arbitrary attributes. Charges search takes `amount`, `created`, `currency`, `customer`, `status`, `refunded`, `disputed`, `metadata`, `billing_details.address.postal_code`, and `payment_method_details.<source>.*` card fields — there is no `payment_intent` field. When the field you want is not searchable, retrieve the parent object and follow its reference (the PaymentIntent's `latest_charge`) instead of retrying the search with another spelling.\n- The account → `stripe_api_search` → `stripe_api_details` → `stripe_api_read` sequence is one program, not four turns: resolve the method once, then call that method as many times as the investigation needs in the same run.\n- Decline outcomes live on the charge — `outcome`, `failure_code`, `failure_message` — reached from the PaymentIntent's `latest_charge`, so \"why did this payment fail\" is a PaymentIntent read followed by one charge read.\n- Resolve ids before acting; never guess one. Stripe ids are typed prefixes — `cus_` customer, `sub_` subscription, `ch_` charge, `pi_` payment intent, `in_` invoice, `acct_` account — and a plausible-looking id belongs to a different object or to nobody.\n- Amounts are integers in the currency's minor unit: `1099` is 10.99 USD, and zero-decimal currencies like JPY take `10` for 10 JPY. Never send a decimal.\n- Treat every create, update, delete, refund, and report run as a write. For guest calls, classification, and routing, fetch `skills({ name: \"usage\" })`.\n",
     "instructionsHeading": "Account instructions",
     "fragments": {
-        "oauth": "\n\nThis OAuth session may expose both live and sandbox Stripe accounts. Discover the live account-selection tools, select the intended account and mode, then carry exact context fields such as `stripe_context` and `livemode` wherever the schema requires them. A live-mode write moves real money; a sandbox write changes test data. Never infer the account or mode from connector metadata.\n\n- Discover account and mode with the live account-selection tools before every account-scoped read or write. The published inventory has changed account-tool names; do not assume `list_available_accounts_or_orgs` is available. Select the intended result and carry the exact context fields required by the live schema unchanged. If the account, mode, or supported selector is ambiguous, stop and ask; never guess.\n- Organization accounts are not Stripe Connect connected accounts. A Connect call requires a separate API-key connector whose `connectedAccount` sends Stripe's documented `Stripe-Account` header; OAuth does not support that path.\n- Four generic tools reach any Stripe API method. Find the method with `stripe_api_search`, read its parameters with `stripe_api_details`, then call `stripe_api_read` (GET) or `stripe_api_write` (POST/PATCH/PUT/DELETE). Never guess a path or a parameter name — `stripe_api_details` is cheaper than a rejected write.\n- Prefer a dedicated tool when one covers the task: `get_balance_summary` for balances and `stripe_analytics` for Sigma or Metrics reporting. Use `stripe_api_search` for everything else instead of assuming a retired dedicated tool still exists.\n- `stripe_implementation_planner` and the query-execution intents of `stripe_analytics` create provider-side planning or query-run state. Connecta therefore classifies both as writes and enforces the configured pool trust policy; their retrieval paths stay behind the same tool boundary.\n- `stripe_api_write` carries the blast radius of the entire write API — every POST, PATCH, PUT, and DELETE, from a customer edit to a subscription cancellation. State the method and path explicitly; execution follows the configured pool trust policy.\n- Any `stripe_api_read` list or `stripe_api_search` that returns full objects belongs inside `execute_code`, projected to the fields the question needs before `return`. Neither `limit` nor `expand` substitutes for that: an unprojected list of customers or invoices truncates long before it answers, and a projected one keeps the customer's name, email, and address out of the transcript.\n- Find an object with `stripe_api_search` (or a list endpoint through `stripe_api_read`) and carry the `id` it returned into the write.\n- This connection's tool list is not a fixed set. Stripe gates parts of its MCP catalog by account, integration, and beta enrollment, so search this connector for what it actually exposes rather than assuming a documented tool is here.\n- Send an `Idempotency-Key` on every write you might retry, if the tool accepts it, and reuse the same key for the retry. A retry with a fresh key is a second charge, not a second attempt.\n",
-        "key": "\n\n- This is Connecta's REST connector to `api.stripe.com`, holding one operator-managed key. It reaches exactly one account in one mode, so there is no account selection and no `stripe_context` or `livemode` argument.\n- `stripe_api_search` finds API operations, not records: it searches the pinned API index and names the tool that calls each operation. `stripe_api_details` returns one operation's parameters with types, enums, and required names. Neither sends a request.\n- `stripe_api_read` calls GET operations, plus `POST /v1/invoices/create_preview`, which only previews. `stripe_api_write` calls every other POST and every DELETE, from a customer edit to a subscription cancellation, with `method` and `path` stated; execution follows the configured pool trust policy.\n- Paths are concrete: substitute ids into the template search returned (`/v1/payment_intents/pi_123`). Pass `query` and `body` as JSON objects named as `stripe_api_details` lists them. Connecta form-encodes v1 bodies and query lists (`expand: [\"latest_charge\"]`), sends v2 bodies as JSON, and pins `Stripe-Version` to the index's API version. Send `null` or `\"\"` to unset a field.\n- Every call is checked against the pinned index before it is sent. An unknown path returns the nearest operations; an unknown or missing parameter returns `validation.issues` with the accepted names. Nothing reached Stripe, so fix the call from that answer.\n- Results arrive as `{ status, data, page? }`. On a list, `page.next` is the cursor and `page.param` the query parameter to pass it as: `starting_after`, or `page` for search and v2 lists. Lists belong inside `execute_code`; pass `select` (dot paths such as `data.id` and `data.status`) to keep only the fields the question needs, which also keeps customer names, emails, and addresses out of the transcript.\n- `get_stripe_account_info` confirms the account, mode, and connected account; `get_balance_summary` returns available and pending balances. Use them when they answer the question.\n- Find records with list and search operations through `stripe_api_read` (`GET /v1/customers/search`, `GET /v1/charges` with `customer`) and carry the returned `id` into the write.\n- `stripe_api_write` sends an `Idempotency-Key` on every POST. Pass `idempotencyKey` for anything you might retry, or reuse the generated one the result returns. An ambiguous failure carries it in its message or as `uncertainCall.recovery.idempotencyKey`. Reuse it only with the exact original arguments and within Stripe's retention (v1 keys may be pruned after 24 hours); after that, look the object up before retrying. A retry with a fresh key is a second charge, not a second attempt.\n- Refused by design: operations that hand out a credential (ephemeral keys, Terminal connection tokens, account links (v1 and v2), Terminal onboarding links, Express login links, account sessions, customer sessions, billing portal sessions, file link creation, Financial Connections session creation, and the meter event session), Stripe Apps secret payloads (`expand` of `payload`), Issuing card `number` and `cvc` expansion on any Issuing path, multipart uploads such as `POST /v1/files` (use the Dashboard), and the meter event stream (send single events with `POST /v2/billing/meter_events`). Each refusal names its reason. Quote PDFs arrive from `files.stripe.com` as base64.\n- Secrets read as `\"[redacted]\"` in every result, expansions included: client secrets (PaymentIntents, SetupIntents, Checkout and Identity sessions, Sources, Financial Connections, invoice confirmation secrets), webhook and event destination signing secrets, Apps secret payloads, app-install authorization codes, Terminal Wi-Fi passwords, forwarded request header values, and Issuing card numbers and CVCs. Webhook and event destination URLs, file link URLs (in an expanded File, a list, or an event too), and pre-signed import URLs keep only their scheme and host. Identity verification `url`s come back whole. A Checkout Session's `url` comes back whole only for a guest payment session (`mode: \"payment\"`, no `customer` or `customer_account`, no customer creation, no saved payment method options); any other session returns only its scheme and host, because its page can show, reuse, or remove a customer's saved payment methods. Create those from your own server code, or send a payment link or the invoice's hosted page instead. These rules follow each object wherever it appears, expansions and events included. A `[redacted]` field is never the real value; do not send it back.\n- Failures of credential-bearing operations (webhook endpoints, Apps secrets, Terminal configurations, forwarding) carry Stripe's type, code, decline code, and param, not its message. Payment, billing, and account failures keep Stripe's message.\n- The hosted OAuth connection's natural-language Sigma, metrics, documentation search, implementation planner, and feedback tools do not exist with a key.\n",
+        "oauth": "\n\nThis OAuth session may expose both live and sandbox Stripe accounts. Discover the live account-selection tools, select the intended account and mode, then carry exact context fields such as `stripe_context` and `livemode` wherever the schema requires them. A live-mode write moves real money; a sandbox write changes test data. Never infer the account or mode from connector metadata.\n\n- Discover account and mode with the live account-selection tools before every account-scoped read or write. The published inventory has changed account-tool names; do not assume `list_available_accounts_or_orgs` is available. Select the intended result and carry the exact context fields required by the live schema unchanged. If the account, mode, or supported selector is ambiguous, stop and ask; never guess.\n- Organization accounts are not Stripe Connect connected accounts. A Connect call requires a separate API-key connector whose `connectedAccount` sends Stripe's documented `Stripe-Account` header; OAuth does not support that path.\n- Four generic tools reach any Stripe API method. Find the method with `stripe_api_search`, read its parameters with `stripe_api_details`, then call `stripe_api_read` (GET) or `stripe_api_write` (POST/PATCH/PUT/DELETE). Never guess a path or a parameter name — `stripe_api_details` is cheaper than a rejected write.\n- Prefer a dedicated tool when one covers the task: `get_balance_summary` for balances and `stripe_analytics` for Sigma or Metrics reporting. Use `stripe_api_search` for everything else instead of assuming a retired dedicated tool still exists.\n- `stripe_implementation_planner` and the query-execution intents of `stripe_analytics` create provider-side planning or query-run state. Connecta therefore classifies both as writes, which a read-only endpoint refuses; their retrieval paths stay behind the same tool boundary.\n- `stripe_api_write` carries the blast radius of the entire write API — every POST, PATCH, PUT, and DELETE, from a customer edit to a subscription cancellation. State the method and path explicitly; a read-only endpoint refuses it.\n- Any `stripe_api_read` list or `stripe_api_search` that returns full objects belongs inside `execute_code`, projected to the fields the question needs before `return`. Neither `limit` nor `expand` substitutes for that: an unprojected list of customers or invoices truncates long before it answers, and a projected one keeps the customer's name, email, and address out of the transcript.\n- Find an object with `stripe_api_search` (or a list endpoint through `stripe_api_read`) and carry the `id` it returned into the write.\n- This connection's tool list is not a fixed set. Stripe gates parts of its MCP catalog by account, integration, and beta enrollment, so search this connector for what it actually exposes rather than assuming a documented tool is here.\n- Send an `Idempotency-Key` on every write you might retry, if the tool accepts it, and reuse the same key for the retry. A retry with a fresh key is a second charge, not a second attempt.\n",
+        "key": "\n\n- This is Connecta's REST connector to `api.stripe.com`, holding one operator-managed key. It reaches exactly one account in one mode, so there is no account selection and no `stripe_context` or `livemode` argument.\n- `stripe_api_search` finds API operations, not records: it searches the pinned API index and names the tool that calls each operation. `stripe_api_details` returns one operation's parameters with types, enums, and required names. Neither sends a request.\n- `stripe_api_read` calls GET operations, plus `POST /v1/invoices/create_preview`, which only previews. `stripe_api_write` calls every other POST and every DELETE, from a customer edit to a subscription cancellation, with `method` and `path` stated; a read-only endpoint refuses it.\n- Paths are concrete: substitute ids into the template search returned (`/v1/payment_intents/pi_123`). Pass `query` and `body` as JSON objects named as `stripe_api_details` lists them. Connecta form-encodes v1 bodies and query lists (`expand: [\"latest_charge\"]`), sends v2 bodies as JSON, and pins `Stripe-Version` to the index's API version. Send `null` or `\"\"` to unset a field.\n- Every call is checked against the pinned index before it is sent. An unknown path returns the nearest operations; an unknown or missing parameter returns `validation.issues` with the accepted names. Nothing reached Stripe, so fix the call from that answer.\n- Results arrive as `{ status, data, page? }`. On a list, `page.next` is the cursor and `page.param` the query parameter to pass it as: `starting_after`, or `page` for search and v2 lists. Lists belong inside `execute_code`; pass `select` (dot paths such as `data.id` and `data.status`) to keep only the fields the question needs, which also keeps customer names, emails, and addresses out of the transcript.\n- `get_stripe_account_info` confirms the account, mode, and connected account; `get_balance_summary` returns available and pending balances. Use them when they answer the question.\n- Find records with list and search operations through `stripe_api_read` (`GET /v1/customers/search`, `GET /v1/charges` with `customer`) and carry the returned `id` into the write.\n- `stripe_api_write` sends an `Idempotency-Key` on every POST. Pass `idempotencyKey` for anything you might retry, or reuse the generated one the result returns. An ambiguous failure carries it in its message or as `uncertainCall.recovery.idempotencyKey`. Reuse it only with the exact original arguments and within Stripe's retention (v1 keys may be pruned after 24 hours); after that, look the object up before retrying. A retry with a fresh key is a second charge, not a second attempt.\n- Refused by design: operations that hand out a credential (ephemeral keys, Terminal connection tokens, account links (v1 and v2), Terminal onboarding links, Express login links, account sessions, customer sessions, billing portal sessions, file link creation, Financial Connections session creation, and the meter event session), Stripe Apps secret payloads (`expand` of `payload`), Issuing card `number` and `cvc` expansion on any Issuing path, multipart uploads such as `POST /v1/files` (use the Dashboard), and the meter event stream (send single events with `POST /v2/billing/meter_events`). Each refusal names its reason. Quote PDFs arrive from `files.stripe.com` as base64.\n- Secrets read as `\"[redacted]\"` in every result, expansions included: client secrets (PaymentIntents, SetupIntents, Checkout and Identity sessions, Sources, Financial Connections, invoice confirmation secrets), webhook and event destination signing secrets, Apps secret payloads, app-install authorization codes, Terminal Wi-Fi passwords, forwarded request header values, and Issuing card numbers and CVCs. Webhook and event destination URLs, file link URLs (in an expanded File, a list, or an event too), and pre-signed import URLs keep only their scheme and host. Identity verification `url`s come back whole. A Checkout Session's `url` comes back whole only for a guest payment session (`mode: \"payment\"`, no `customer` or `customer_account`, no customer creation, no saved payment method options); any other session returns only its scheme and host, because its page can show, reuse, or remove a customer's saved payment methods. Create those from your own server code, or send a payment link or the invoice's hosted page instead. These rules follow each object wherever it appears, expansions and events included. A `[redacted]` field is never the real value; do not send it back.\n- Failures of credential-bearing operations (webhook endpoints, Apps secrets, Terminal configurations, forwarding) carry Stripe's type, code, decline code, and param, not its message. Payment, billing, and account failures keep Stripe's message.\n- The hosted OAuth connection's natural-language Sigma, metrics, documentation search, implementation planner, and feedback tools do not exist with a key.\n",
         "shared": "- Lists are cursor-paginated: `limit` defaults to 10 and caps at 100, `starting_after` and `ending_before` take an object id and are mutually exclusive, and `has_more` says whether to continue. Page inside `execute_code`.\n- Search filters on a documented per-resource field set, not on arbitrary attributes. Charges search takes `amount`, `created`, `currency`, `customer`, `status`, `refunded`, `disputed`, `metadata`, `billing_details.address.postal_code`, and `payment_method_details.<source>.*` card fields — there is no `payment_intent` field. When the field you want is not searchable, retrieve the parent object and follow its reference (the PaymentIntent's `latest_charge`) instead of retrying the search with another spelling.\n- The account → `stripe_api_search` → `stripe_api_details` → `stripe_api_read` sequence is one program, not four turns: resolve the method once, then call that method as many times as the investigation needs in the same run.\n- Decline outcomes live on the charge — `outcome`, `failure_code`, `failure_message` — reached from the PaymentIntent's `latest_charge`, so \"why did this payment fail\" is a PaymentIntent read followed by one charge read.\n- Resolve ids before acting; never guess one. Stripe ids are typed prefixes — `cus_` customer, `sub_` subscription, `ch_` charge, `pi_` payment intent, `in_` invoice, `acct_` account — and a plausible-looking id belongs to a different object or to nobody.\n- Amounts are integers in the currency's minor unit: `1099` is 10.99 USD, and zero-decimal currencies like JPY take `10` for 10 JPY. Never send a decimal.\n- Treat every create, update, delete, refund, and report run as a write. For guest calls, classification, and routing, fetch `skills({ name: \"usage\" })`.\n",
         "oauth_limits": "- Stripe answers a rate limit with `429` and a `Stripe-Rate-Limited-Reason` header; back off on that rather than retrying immediately. Stripe documents an account ceiling of 100 requests per second in live mode and 25 in sandbox mode, and any single endpoint is capped at 25 per second regardless of mode, so paging one list is the real constraint.\n- Use `search_stripe_documentation` when the shape of an object or a flow is unclear; it is a read and costs nothing but a call.\n- An `auth_required` failure means this connector's Stripe authorization is missing or expired: run `authorize_connector` for this connector id, then retry the same call unchanged. A rejected argument or a plan restriction comes back in Stripe's own words instead — read it rather than re-authorizing.\n",
         "key_limits": "- Stripe answers a rate limit with `429` and a `Stripe-Rate-Limited-Reason` header; back off on that rather than retrying immediately. Stripe documents an account ceiling of ",

package/dist/providers/vercel/index.js

@@ -169,11 +169,11 @@ const VERCEL_MCP_CLASSIFICATION = {
         },
         "filter_project_envs": {
             "verdict": "write",
-            "reason": "Lists project environment variables and can return decrypted values; reviewed as a write so the pool trust policy gates the disclosure (#801).",
+            "reason": "Lists project environment variables and can return decrypted values; reviewed as a write so a read-only endpoint refuses the disclosure (#801).",
         },
         "get_project_env": {
             "verdict": "write",
-            "reason": "Returns one environment variable's decrypted value; reviewed as a write so the pool trust policy gates the disclosure (#801).",
+            "reason": "Returns one environment variable's decrypted value; reviewed as a write so a read-only endpoint refuses the disclosure (#801).",
         },
         "create_project_env": {
             "verdict": "destructive",

package/dist/providers/vercel/skill.generated.js

@@ -3,8 +3,8 @@ export const skill = {
     "content": "- Resolve team, project, and deployment ids with list reads; never guess one. Team ids begin `team_`, project ids `prj_`, and deployment ids `dpl_`.\n- Diagnose a deployment by reading its state first (`readyState`, `errorCode`, `errorMessage`), then its build logs, then runtime logs for a deployment that built. Narrow time windows before raising limits.\n- Environment variable changes apply only to future deployments; a new deployment is a separate write. Promoting an existing deployment to production does not rebuild it.\n- Treat every create, update, delete, promotion, cancellation, and purchase as a write. For guest calls, classification, and routing, fetch `skills({ name: \"usage\" })`.\n",
     "instructionsHeading": "Account instructions",
     "fragments": {
-        "oauth": "\n\nTool names, descriptions, argument schemas, and result schemas come from Vercel's live server. Connecta applies release-reviewed classification; reviewed writes stay writes even when Vercel claims they only read.\n\n- Discover the live catalog before assuming a tool exists. Vercel can change the surface independently of a Connecta release, and account features may affect what the authorization can reach.\n- Complete authorization and grant access to the owning team before acting. Listing this server does not prove team access.\n- MCP pagination and arguments follow the live MCP schemas; do not apply REST pagination or argument shapes to them.\n- Diagnose deployments with `get_deployment`, then build logs, runtime error clusters, and runtime logs.\n- `get_project_env` and `filter_project_envs` can return decrypted environment values, so Connecta reviews them as writes and the pool's trust policy gates them. Prefer reading variable keys and targets without values.\n- Purchase tools change billing. Read a quote first and carry its price, idempotency key, and requested term into the confirmed purchase unchanged.\n- `get_access_to_vercel_url` creates a temporary access grant. Treat the URL it returns as a credential and do not expose it outside the requested task.\n- `deploy_to_vercel` and `import-claude-design-from-url` can create or update live projects. Read the target and deployment mode before invoking them.\n- An `auth_required` failure means this connector's OAuth grant is missing or expired. Run `authorize_connector` for this connector id, then retry.\n",
-        "key": "\n\n- This is Connecta's REST connector to `api.vercel.com`, holding one operator-managed access token. A default team routes calls; it does not narrow what the token can reach.\n- `vercel_api_search` finds API operations, not records: it searches the pinned API index and names the tool that calls each operation. `vercel_api_details` returns one operation's parameters with types, enums, and required names. Neither sends a request.\n- `vercel_api_read` calls GET operations, plus reviewed POSTs that only read: `POST /v2/observability/query`, registrar availability, price, and search, and `POST /v8/artifacts`. `vercel_api_write` calls every other POST, PUT, PATCH, and DELETE, with `method` and `path` stated; execution follows the configured pool trust policy.\n- Paths are concrete and carry the version search returned: `/v13/deployments/dpl_123`, not `/deployments/dpl_123`. Pass `query` and `body` as JSON objects named as `vercel_api_details` lists them. Every call is checked against the pinned index before it is sent: an unknown path returns the nearest operations, and an unknown or missing parameter returns `validation.issues` with the accepted names. Nothing reached Vercel, so fix the call from that answer.\n- Results arrive as `{ status, data, page? }`. On a list, `page.next` is the cursor and `page.param` the query parameter to pass it as: `until` (a millisecond timestamp from `pagination.next`) on most lists, `cursor` on newer ones. Lists belong inside `execute_code`; pass `select` (dot paths such as `deployments.uid` and `deployments.state`) to keep only the fields the question needs.\n- `list_teams` returns team ids and slugs and the connection's default team. `get_deployment_build_logs` reads a deployment's build events without following live output. `get_runtime_logs` collects the runtime log stream for at most `waitMs` or `maxRows`, then stops and says why. Generic reads refuse `follow` and the runtime-log stream, which never end on their own.\n- `vercel_api_upload` sends explicit text or base64 bytes to an octet-stream operation, such as `POST /v2/files` before a deployment (Connecta computes `x-vercel-digest`). `vercel_api_write` sends JSON only.\n- Environment values never come back. `list_project_env_vars` never decrypts. `upsert_project_env_var` (`upsert: false` for create-only), `update_project_env_var`, and `delete_project_env_var` return metadata without values; values are write input only. Generic reads refuse `GET /v1/projects/{idOrName}/env/{id}`, `GET /v10/projects/{idOrName}/env`, `GET /v1/env/{id}`, and any `decrypt`, and Connecta replaces the value of every environment variable in any result with `\"[redacted]\"`, including project reads, shared variables, and audit events.\n- Other secrets read as `[redacted]` in every result: credential-named fields and their whole contents (`token`, `secret`, `password`, `jwt`, `credentials`, `Authorization`, …), protection-bypass secrets (each bypass's metadata stays under a numbered placeholder), deploy hook URLs, drain and webhook headers and signing secrets (including the one a new webhook or drain returns), drain and webhook destination URLs and external route, rewrite, and redirect destinations beyond their scheme and host, the args and values of every header, cookie, and query rule (route transforms and conditions, firewall conditions), team invite codes, synced Global Config items, and credentials inside other URLs. Failures of every reviewed operation, and of any operation whose request takes a credential-named field, say only the status and a reviewed code. Read or rotate withheld secrets in the Vercel dashboard. A `[redacted]` field is never the real value; do not send it back.\n- Refused by design: endpoints that mint credentials (access tokens, AI Gateway API keys, project OIDC and trace tokens, Connect and SSO tokens, Edge Config tokens, KMS-signed tokens, Flags SDK keys, protection-bypass secrets, installation credential rotation), Connect authorization requests, project transfer requests (the code lets another team claim the project), KMS signing, a domain move-out (its answer is a transfer token), Global Config items, backups, and tokens, and domain transfer auth codes. Each refusal names its reason.\n- The hosted OAuth connection's documentation search, runtime error clusters, toolbar threads, agent runs, web analytics summaries, purchase quotes, `deploy_to_vercel`, and access grants for protected URLs do not exist with a token. Configure an OAuth connector for those.\n- A `429` carries Vercel's reset time; Vercel meters endpoints separately, so wait before retrying the same operation. An `auth_required` failure means the token is missing, expired, or outside this team: an operator must replace it in this connection in the operator UI, and `authorize_connector` returns that handoff. A rejected argument comes back in Vercel's own words; read it rather than replacing the token.\n",
+        "oauth": "\n\nTool names, descriptions, argument schemas, and result schemas come from Vercel's live server. Connecta applies release-reviewed classification; reviewed writes stay writes even when Vercel claims they only read.\n\n- Discover the live catalog before assuming a tool exists. Vercel can change the surface independently of a Connecta release, and account features may affect what the authorization can reach.\n- Complete authorization and grant access to the owning team before acting. Listing this server does not prove team access.\n- MCP pagination and arguments follow the live MCP schemas; do not apply REST pagination or argument shapes to them.\n- Diagnose deployments with `get_deployment`, then build logs, runtime error clusters, and runtime logs.\n- `get_project_env` and `filter_project_envs` can return decrypted environment values, so Connecta reviews them as writes, and a read-only endpoint refuses them. Prefer reading variable keys and targets without values.\n- Purchase tools change billing. Read a quote first and carry its price, idempotency key, and requested term into the confirmed purchase unchanged.\n- `get_access_to_vercel_url` creates a temporary access grant. Treat the URL it returns as a credential and do not expose it outside the requested task.\n- `deploy_to_vercel` and `import-claude-design-from-url` can create or update live projects. Read the target and deployment mode before invoking them.\n- An `auth_required` failure means this connector's OAuth grant is missing or expired. Run `authorize_connector` for this connector id, then retry.\n",
+        "key": "\n\n- This is Connecta's REST connector to `api.vercel.com`, holding one operator-managed access token. A default team routes calls; it does not narrow what the token can reach.\n- `vercel_api_search` finds API operations, not records: it searches the pinned API index and names the tool that calls each operation. `vercel_api_details` returns one operation's parameters with types, enums, and required names. Neither sends a request.\n- `vercel_api_read` calls GET operations, plus reviewed POSTs that only read: `POST /v2/observability/query`, registrar availability, price, and search, and `POST /v8/artifacts`. `vercel_api_write` calls every other POST, PUT, PATCH, and DELETE, with `method` and `path` stated; a read-only endpoint refuses it.\n- Paths are concrete and carry the version search returned: `/v13/deployments/dpl_123`, not `/deployments/dpl_123`. Pass `query` and `body` as JSON objects named as `vercel_api_details` lists them. Every call is checked against the pinned index before it is sent: an unknown path returns the nearest operations, and an unknown or missing parameter returns `validation.issues` with the accepted names. Nothing reached Vercel, so fix the call from that answer.\n- Results arrive as `{ status, data, page? }`. On a list, `page.next` is the cursor and `page.param` the query parameter to pass it as: `until` (a millisecond timestamp from `pagination.next`) on most lists, `cursor` on newer ones. Lists belong inside `execute_code`; pass `select` (dot paths such as `deployments.uid` and `deployments.state`) to keep only the fields the question needs.\n- `list_teams` returns team ids and slugs and the connection's default team. `get_deployment_build_logs` reads a deployment's build events without following live output. `get_runtime_logs` collects the runtime log stream for at most `waitMs` or `maxRows`, then stops and says why. Generic reads refuse `follow` and the runtime-log stream, which never end on their own.\n- `vercel_api_upload` sends explicit text or base64 bytes to an octet-stream operation, such as `POST /v2/files` before a deployment (Connecta computes `x-vercel-digest`). `vercel_api_write` sends JSON only.\n- Environment values never come back. `list_project_env_vars` never decrypts. `upsert_project_env_var` (`upsert: false` for create-only), `update_project_env_var`, and `delete_project_env_var` return metadata without values; values are write input only. Generic reads refuse `GET /v1/projects/{idOrName}/env/{id}`, `GET /v10/projects/{idOrName}/env`, `GET /v1/env/{id}`, and any `decrypt`, and Connecta replaces the value of every environment variable in any result with `\"[redacted]\"`, including project reads, shared variables, and audit events.\n- Other secrets read as `[redacted]` in every result: credential-named fields and their whole contents (`token`, `secret`, `password`, `jwt`, `credentials`, `Authorization`, …), protection-bypass secrets (each bypass's metadata stays under a numbered placeholder), deploy hook URLs, drain and webhook headers and signing secrets (including the one a new webhook or drain returns), drain and webhook destination URLs and external route, rewrite, and redirect destinations beyond their scheme and host, the args and values of every header, cookie, and query rule (route transforms and conditions, firewall conditions), team invite codes, synced Global Config items, and credentials inside other URLs. Failures of every reviewed operation, and of any operation whose request takes a credential-named field, say only the status and a reviewed code. Read or rotate withheld secrets in the Vercel dashboard. A `[redacted]` field is never the real value; do not send it back.\n- Refused by design: endpoints that mint credentials (access tokens, AI Gateway API keys, project OIDC and trace tokens, Connect and SSO tokens, Edge Config tokens, KMS-signed tokens, Flags SDK keys, protection-bypass secrets, installation credential rotation), Connect authorization requests, project transfer requests (the code lets another team claim the project), KMS signing, a domain move-out (its answer is a transfer token), Global Config items, backups, and tokens, and domain transfer auth codes. Each refusal names its reason.\n- The hosted OAuth connection's documentation search, runtime error clusters, toolbar threads, agent runs, web analytics summaries, purchase quotes, `deploy_to_vercel`, and access grants for protected URLs do not exist with a token. Configure an OAuth connector for those.\n- A `429` carries Vercel's reset time; Vercel meters endpoints separately, so wait before retrying the same operation. An `auth_required` failure means the token is missing, expired, or outside this team: an operator must replace it in this connection in the operator UI, and `authorize_connector` returns that handoff. A rejected argument comes back in Vercel's own words; read it rather than replacing the token.\n",
         "shared": "- Resolve team, project, and deployment ids with list reads; never guess one. Team ids begin `team_`, project ids `prj_`, and deployment ids `dpl_`.\n- Diagnose a deployment by reading its state first (`readyState`, `errorCode`, `errorMessage`), then its build logs, then runtime logs for a deployment that built. Narrow time windows before raising limits.\n- Environment variable changes apply only to future deployments; a new deployment is a separate write. Promoting an existing deployment to production does not rebuild it.\n- Treat every create, update, delete, promotion, cancellation, and purchase as a write. For guest calls, classification, and routing, fetch `skills({ name: \"usage\" })`.\n"
     }
 };

package/dist/providers/wispr-flow/index.d.ts

@@ -0,0 +1,14 @@
+import { type RemoteMcpAuth } from "../../connectors/remote-mcp.js";
+import { type ProviderOptions } from "../../provider.js";
+/** Wispr Flow's hosted Streamable HTTP endpoint, without a trailing slash. */
+export declare const WISPR_FLOW_MCP_ENDPOINT = "https://api.wisprflow.ai/connect/mcp";
+type WisprFlowOAuth = Extract<RemoteMcpAuth, {
+    type: "oauth";
+}>;
+export interface WisprFlowOptions extends ProviderOptions {
+    /** OAuth only; defaults to browser authorization with the advertised scopes. */
+    auth?: WisprFlowOAuth;
+}
+/** A maintained Wispr Flow Notetaker hosted-MCP connection. */
+export declare const wisprFlow: import("../../provider.js").ProviderFactory<WisprFlowOptions>;
+export {};

package/dist/providers/wispr-flow/index.js

@@ -0,0 +1,117 @@
+import { remoteMcp } from "../../connectors/remote-mcp.js";
+import { keys, optionsOf, variants } from "../../config-schema.js";
+import { defineProvider, PROVIDER_COMMON } from "../../provider.js";
+import { skill } from "./skill.generated.js";
+/** Wispr Flow's hosted Streamable HTTP endpoint, without a trailing slash. */
+export const WISPR_FLOW_MCP_ENDPOINT = "https://api.wisprflow.ai/connect/mcp";
+/**
+ * Reviewed public-source superset, 2026-10-13. Scalekit documents 14 reads;
+ * Claude's connector directory adds four task tools. Wispr's own help page
+ * describes read-only access, so the task writes remain classified even if
+ * this account never exposes them. No authenticated catalog or schemas were
+ * captured. Vendor names, schemas and results remain live.
+ */
+const CLASSIFICATION = {
+    tools: {
+        get_account_info: { verdict: "read", reason: "Returns the signed-in identity and calendar display-name aliases." },
+        get_calendar_event: { verdict: "read", reason: "Retrieves an existing calendar event and its attendees." },
+        get_meeting: {
+            verdict: "read",
+            reason: "Retrieves recorded notes, the summary, attendees and requested transcript ranges.",
+        },
+        get_meeting_by_calendar_id: {
+            verdict: "read",
+            reason: "Finds the existing recording linked to a calendar event and reads its content.",
+        },
+        get_meeting_participants_enriched: {
+            verdict: "read",
+            reason: "Reads participant information and identifies the signed-in attendee.",
+        },
+        get_scratchpad_note: { verdict: "read", reason: "Returns a bounded range of an existing Scratchpad note." },
+        get_upcoming_meeting: {
+            verdict: "read",
+            reason: "Reads an upcoming event and an available pre-read without generating one.",
+        },
+        list_meeting_series: {
+            verdict: "read",
+            reason: "Lists recorded occurrences of an existing recurring meeting series.",
+        },
+        list_upcoming_meetings: {
+            verdict: "read",
+            reason: "Lists upcoming calendar events and already-available pre-reads.",
+        },
+        resolve_calendar_link: {
+            verdict: "read",
+            reason: "Matches a pasted calendar or conference URL to an existing event.",
+        },
+        resolve_share_link: {
+            verdict: "read",
+            reason: "Reads an accessible shared note without creating a link or changing sharing permissions.",
+        },
+        search_calendar_events: { verdict: "read", reason: "Finds existing calendar events by date, attendees or text." },
+        search_meetings: {
+            verdict: "read",
+            reason: "Finds recorded meetings by title, summary, notes, dates or linked attendees.",
+        },
+        search_scratchpad_notes: { verdict: "read", reason: "Finds existing Scratchpad notes by text." },
+        get_task: { verdict: "read", reason: "Retrieves an existing task without changing its state." },
+        search_tasks: { verdict: "read", reason: "Finds existing tasks without changing them." },
+        add_task: {
+            verdict: "write",
+            reason: "Creates a new task; the reviewed operation appends rather than replacing an existing task.",
+        },
+        update_task: { verdict: "destructive", reason: "Changes the state or fields of an existing task." },
+    },
+};
+const OPTIONS = optionsOf()({
+    ...PROVIDER_COMMON,
+    auth: variants("type", {
+        oauth: optionsOf()({
+            ...keys("type", "clientMetadataUrl", "scope"),
+            client: optionsOf()(keys("issuer", "clientId", "clientSecret", "tokenEndpointAuthMethod")),
+        }).shape,
+    }),
+});
+function accountSummary(purpose) {
+    const summary = `Account-wide Notetaker access: ${purpose}`;
+    const bytes = new TextEncoder().encode(summary);
+    if (bytes.byteLength <= 120)
+        return summary;
+    // Streaming decode drops an incomplete final code point; reserve three bytes for the ellipsis.
+    return `${new TextDecoder().decode(bytes.subarray(0, 117), { stream: true }).trimEnd()}…`;
+}
+/** A maintained Wispr Flow Notetaker hosted-MCP connection. */
+export const wisprFlow = defineProvider({
+    name: "wispr-flow",
+    title: "Wispr Flow",
+    kind: "mcp",
+    readme: "Wispr Flow",
+    skill,
+    classify: CLASSIFICATION,
+    options: OPTIONS,
+    bundle: {
+        baselineGzip: 169009,
+        maxGzip: 229009,
+        note: "./providers/wispr-flow initial measured baseline is 169,009 B gzip for the hosted-MCP wrapper; the cap retains the existing baseline + 60,000 B provider headroom policy.",
+    },
+    create(id, options, provider) {
+        const ownership = options.authScope === "personal"
+            ? "Each person authorizes separately and may reach a different account."
+            : "One shared authorization selects the account for everyone using this connector.";
+        return remoteMcp(id, {
+            url: WISPR_FLOW_MCP_ENDPOINT,
+            ...provider.connectorOptions,
+            title: options.title ?? "Wispr Flow",
+            description: `Wispr Flow Notetaker meetings, Scratchpad notes, calendar events and tasks: ${options.purpose}`,
+            auth: { type: "oauth", scope: "openid offline_access", ...options.auth },
+            requireHttps: true,
+            classify: provider.classify,
+            usageGuide: provider.usageGuide({
+                context: [
+                    `Account-wide Notetaker access: ${options.purpose}. Personal and work accounts hold separate content. ${ownership} Confirm the identity with get_account_info. Dictation history and Notetaker chat history are unavailable.`,
+                ],
+                summary: accountSummary(options.purpose),
+            }),
+        });
+    },
+});

package/dist/providers/wispr-flow/skill.generated.js

@@ -0,0 +1,8 @@
+// Generated by scripts/generate-providers.mjs; do not edit.
+export const skill = {
+    "content": "- This connection reaches Notetaker meetings, summaries, notes, transcripts, participants and their email addresses, and tasks; Scratchpad notes; calendar events and linked recordings; upcoming meetings with available pre-reads; recurring series; accessible shared notes; and account identity. Meeting results name folders you own or that are shared with you; meetings outside folders list none. Another account needs another authorization. Use `get_account_info` to check which identity this grant reaches.\n- OAuth browser authorization is the only supported auth method. There is no API key. Prefer Google, Apple, Microsoft or enterprise SSO and finish sign-in within about five minutes. Email-and-password sign-in may not complete authorization; Wispr's help pages disagree. Consent covers the account's existing content, without per-meeting consent.\n- Search first, then retrieve by the returned id: `search_meetings` → `get_meeting`, `search_scratchpad_notes` → `get_scratchpad_note`, or `search_calendar_events` → `get_calendar_event`. Resolve pasted URLs with `resolve_calendar_link` or `resolve_share_link` instead of guessing ids. Use `get_meeting_by_calendar_id` for the recording linked to an event; an event without a recording is not missing meeting content. `get_upcoming_meeting` is for future events. For `list_meeting_series`, \"no earlier occurrence\" can mean a one-off meeting or a recording without a linked calendar event, not a failure.\n- `search_meetings` matches titles, summaries and notes, not transcripts. Set `field` to `title`, `content` or `both`; use `query`, `since` and `until` to narrow the request. `attendee_emails` with `attendee_match` set to `any` or `all` only finds recordings linked to calendar events. A missing attendee-filter match does not prove a person never attended. Results include an excerpt and up to five attendees; retrieve the meeting for full content and attendees.\n- List and search tools page with `cursor` and `limit`, normally 25 items and at most 200. Pass the returned `next_cursor` verbatim while `has_more` is true. `list_upcoming_meetings` allows at most 50 items and `window_hours` defaults to 24 with a maximum of 168. A `truncated` result needs a narrower query, even after paging. Reduce results inside `execute_code` before returning them.\n- Notes and transcripts are character-bounded. Read the continuation marker and repeat with `view_content.start_char` or `view_transcript.start_char` set to its exact offset. Request `view_transcript: {}` when source detail matters, then continue through the required ranges. Enterprise note and transcript reads are recorded in audit logs; do not read transcripts speculatively. Summaries are complete. Transcript retention deletes transcripts and audio, not summaries; an unavailable transcript may have expired.\n- Shared-note links require your own meeting-access permissions. If a link copied from email is rejected, ask the user to open it in a browser and pass the final Wispr Flow URL. Transcripts require ownership or an explicit email invitation plus the owner's organization allowing transcript sharing. Domain, team or anyone-with-link access yields summaries only. Reauthorization cannot widen those permissions. Return the provided `share_link` when asked for a link; never fabricate one or assume the link changes who can read it.\n- Timestamps are UTC. Present them in the user's time zone. For a whole local day, supply `since` at local midnight with its UTC offset and `until` at the next local midnight; the upper bound is exclusive. Upcoming pre-reads may be absent because the desktop app generates them on demand; these reads do not generate them.\n- Both official help articles describe read-only access and list tasks or action items as readable, while Wispr's own Claude directory listing advertises \"Create, update, and search action items\" and names `add_task` and `update_task`. Discover this account's actual tools before using them. If exposed, `get_task` and `search_tasks` read, `add_task` creates a new task and is a write, and `update_task` changes existing task state and is destructive. Unknown tools without an explicit, uncontradicted read annotation fail closed.\n- Mac and Windows accounts need Notetaker and MCP access. Personal or organization HIPAA BAA coverage removes all MCP tools. Enterprise administrators can disable MCP or require an approved IP network; Scratchpad and cloud-access policies may further restrict results. An empty catalog or policy denial requires checking account access, not repeated authorization.\n- For \"Too many requests\" or repeated searches that temporarily fail without explanation, wait about one minute before retrying and avoid speculative fan-out. There is no maintained per-runtime admission default; the operator may configure `callAdmission` for this deployment.\n- An `auth_required` failure means this connector's Wispr Flow authorization is missing or expired: run `authorize_connector` for this connector id, then retry the same call unchanged. For guest calls, classification and routing, fetch `skills({ name: \"usage\" })`.\n",
+    "instructionsHeading": "Account instructions",
+    "fragments": {
+        "content": "- This connection reaches Notetaker meetings, summaries, notes, transcripts, participants and their email addresses, and tasks; Scratchpad notes; calendar events and linked recordings; upcoming meetings with available pre-reads; recurring series; accessible shared notes; and account identity. Meeting results name folders you own or that are shared with you; meetings outside folders list none. Another account needs another authorization. Use `get_account_info` to check which identity this grant reaches.\n- OAuth browser authorization is the only supported auth method. There is no API key. Prefer Google, Apple, Microsoft or enterprise SSO and finish sign-in within about five minutes. Email-and-password sign-in may not complete authorization; Wispr's help pages disagree. Consent covers the account's existing content, without per-meeting consent.\n- Search first, then retrieve by the returned id: `search_meetings` → `get_meeting`, `search_scratchpad_notes` → `get_scratchpad_note`, or `search_calendar_events` → `get_calendar_event`. Resolve pasted URLs with `resolve_calendar_link` or `resolve_share_link` instead of guessing ids. Use `get_meeting_by_calendar_id` for the recording linked to an event; an event without a recording is not missing meeting content. `get_upcoming_meeting` is for future events. For `list_meeting_series`, \"no earlier occurrence\" can mean a one-off meeting or a recording without a linked calendar event, not a failure.\n- `search_meetings` matches titles, summaries and notes, not transcripts. Set `field` to `title`, `content` or `both`; use `query`, `since` and `until` to narrow the request. `attendee_emails` with `attendee_match` set to `any` or `all` only finds recordings linked to calendar events. A missing attendee-filter match does not prove a person never attended. Results include an excerpt and up to five attendees; retrieve the meeting for full content and attendees.\n- List and search tools page with `cursor` and `limit`, normally 25 items and at most 200. Pass the returned `next_cursor` verbatim while `has_more` is true. `list_upcoming_meetings` allows at most 50 items and `window_hours` defaults to 24 with a maximum of 168. A `truncated` result needs a narrower query, even after paging. Reduce results inside `execute_code` before returning them.\n- Notes and transcripts are character-bounded. Read the continuation marker and repeat with `view_content.start_char` or `view_transcript.start_char` set to its exact offset. Request `view_transcript: {}` when source detail matters, then continue through the required ranges. Enterprise note and transcript reads are recorded in audit logs; do not read transcripts speculatively. Summaries are complete. Transcript retention deletes transcripts and audio, not summaries; an unavailable transcript may have expired.\n- Shared-note links require your own meeting-access permissions. If a link copied from email is rejected, ask the user to open it in a browser and pass the final Wispr Flow URL. Transcripts require ownership or an explicit email invitation plus the owner's organization allowing transcript sharing. Domain, team or anyone-with-link access yields summaries only. Reauthorization cannot widen those permissions. Return the provided `share_link` when asked for a link; never fabricate one or assume the link changes who can read it.\n- Timestamps are UTC. Present them in the user's time zone. For a whole local day, supply `since` at local midnight with its UTC offset and `until` at the next local midnight; the upper bound is exclusive. Upcoming pre-reads may be absent because the desktop app generates them on demand; these reads do not generate them.\n- Both official help articles describe read-only access and list tasks or action items as readable, while Wispr's own Claude directory listing advertises \"Create, update, and search action items\" and names `add_task` and `update_task`. Discover this account's actual tools before using them. If exposed, `get_task` and `search_tasks` read, `add_task` creates a new task and is a write, and `update_task` changes existing task state and is destructive. Unknown tools without an explicit, uncontradicted read annotation fail closed.\n- Mac and Windows accounts need Notetaker and MCP access. Personal or organization HIPAA BAA coverage removes all MCP tools. Enterprise administrators can disable MCP or require an approved IP network; Scratchpad and cloud-access policies may further restrict results. An empty catalog or policy denial requires checking account access, not repeated authorization.\n- For \"Too many requests\" or repeated searches that temporarily fail without explanation, wait about one minute before retrying and avoid speculative fan-out. There is no maintained per-runtime admission default; the operator may configure `callAdmission` for this deployment.\n- An `auth_required` failure means this connector's Wispr Flow authorization is missing or expired: run `authorize_connector` for this connector id, then retry the same call unchanged. For guest calls, classification and routing, fetch `skills({ name: \"usage\" })`.\n"
+    }
+};

package/dist/routes/mcp.js

@@ -294,7 +294,7 @@ function toolkitRetired(logger, sentSecrets) {
         },
     });
 }
-function serveMcp(request, requestSignal, requestScope, opts, baseUrl, actor, registry, canManageAuth, principalKey, runtimeContext, trust = "read-only", pool, principalActor) {
+function serveMcp(request, requestSignal, requestScope, opts, baseUrl, actor, registry, canManageAuth, principalKey, runtimeContext, readOnly = false, pool, principalActor) {
     const sentSecrets = sentSecretsForRequest(requestScope);
     // Every McpServer the request builds is fresh and closes with its scope.
     // The modern handler tears its own down after the exchange; the legacy
@@ -361,7 +361,7 @@ function serveMcp(request, requestSignal, requestScope, opts, baseUrl, actor, re
             client,
             baseUrl,
             requestScope,
-            trust,
+            readOnly,
             canManageAuth,
             oauthConnectUrl: (id, force) => oauthConnectUrl(opts, baseUrl, id, principalKey, force),
             oauthConnectUnavailable: oauthConnectUnavailable(opts),
@@ -385,7 +385,7 @@ function serveMcp(request, requestSignal, requestScope, opts, baseUrl, actor, re
             requestSignal,
             ...(runtimeContext?.waitUntil ? { defer: runtimeContext.waitUntil.bind(runtimeContext) } : {}),
             ...executeLimits(opts.config),
-            trust,
+            readOnly,
         });
         servers.push(server);
         return server;
@@ -517,6 +517,8 @@ export function createMcpRoute(opts) {
     };
     function routeMcp(context) {
         const { path, request, baseUrl, runtimeContext } = context;
+        // Protected-resource metadata stays public, including when a grant is
+        // configured, so a fresh OAuth client can discover how to authenticate.
         if (path !== "/mcp" && !path.startsWith("/mcp/"))
             return Effect.succeed(null);
         // Admission, refusal bodies, SDK serialization and connector work share
@@ -644,7 +646,23 @@ export function createMcpRoute(opts) {
                 // one identical 404 so a credential never enumerates the other pools;
                 // the operator log is where the reason lives.
                 let access = authz;
-                let trust = opts.config.trust;
+                let readOnly = opts.config.readOnly;
+                if (poolName === undefined && opts.config.grant) {
+                    const denialReason = yield* Effect.promise(async () => {
+                        try {
+                            return (await opts.config.grant(authz.identity)) === true
+                                ? undefined
+                                : "default_grant_denied";
+                        }
+                        catch {
+                            return "default_grant_threw";
+                        }
+                    });
+                    if (denialReason !== undefined) {
+                        logFailure(opts.config.logger, "MCP default endpoint request denied", failureRecord({ reason: denialReason }));
+                        return cors(mcpRefusal(sentSecrets, 404, -33004, "MCP endpoint not found."));
+                    }
+                }
                 if (poolName !== undefined) {
                     const pool = opts.pools?.get(poolName);
                     const denialReason = !pool
@@ -662,7 +680,7 @@ export function createMcpRoute(opts) {
                         return cors(mcpRefusal(sentSecrets, 404, -33004, "MCP endpoint not found."));
                     }
                     access = intersectAccess(authz, pool.access);
-                    trust = pool.trust;
+                    readOnly = pool.readOnly;
                 }
                 let scopedRegistry;
                 try {
@@ -685,21 +703,23 @@ export function createMcpRoute(opts) {
                             if (current.subjectKey !== authz.subjectKey || current.principalKey !== authz.principalKey)
                                 return false;
                             validateAuthPermissions(current, opts.registry);
+                            if (poolName === undefined && opts.config.grant && (await opts.config.grant(current.identity)) !== true)
+                                return false;
                             let currentAccess = current;
-                            let currentTrust = opts.config.trust;
+                            let currentReadOnly = opts.config.readOnly;
                             if (poolName !== undefined) {
                                 const pool = opts.pools.get(poolName);
                                 if (!pool || (await pool.grant(current.identity)) !== true)
                                     return false;
                                 currentAccess = intersectAccess(current, pool.access);
-                                currentTrust = pool.trust;
+                                currentReadOnly = pool.readOnly;
                             }
                             const view = opts.registry.scoped({
                                 ...currentAccess,
                                 ...(current.subjectKey ? { subjectKey: current.subjectKey } : {}),
                                 ...(current.principalKey ? { principalKey: current.principalKey } : {}),
                             });
-                            if (classification === "write" && currentTrust !== "trusted")
+                            if (classification === "write" && currentReadOnly)
                                 return false;
                             if (address === undefined)
                                 return true;
@@ -716,7 +736,7 @@ export function createMcpRoute(opts) {
                                 return Boolean(tool &&
                                     (access === "catalog" ||
                                         (classification === "read" && tool.classification === "read") ||
-                                        currentTrust === "trusted"));
+                                        !currentReadOnly));
                             }
                             finally {
                                 await closeConnectorScope(resolved.connector, view.contextFor(resolved.connector.id, baseUrl, requestScope), runtimeContext?.waitUntil?.bind(runtimeContext));
@@ -740,7 +760,7 @@ export function createMcpRoute(opts) {
                 return cors(yield* serveMcp(localRequest, localAbort.signal, requestScope, opts, baseUrl, authz.actor, scopedRegistry, (id) => {
                     const connector = scopedRegistry.getConnector(id);
                     return Boolean(connector && mayManageConnector(authz, connector));
-                }, authz.principalKey, runtimeContext, trust, poolName, authz.identity.principal
+                }, authz.principalKey, runtimeContext, readOnly, poolName, authz.identity.principal
                     ? {
                         kind: authz.actor.kind,
                         id: authz.identity.principal.id,

package/dist/routes/operator.js

@@ -62,13 +62,20 @@ export function scopeFor(authz, connectorIds = authz.connectorIds) {
  * included, rather than quietly granting what remains.
  */
 export function visibleRegistry({ opts }, authz) {
-    return Effect.try({
-        try: () => {
-            validateAuthPermissions(authz, opts.registry);
-            return opts.registry.scoped(scopeFor(authz));
-        },
-        catch: (error) => new Answer(privateJson({ error: msg(error) }, { status: 403 })),
-    });
+    // Operator catalogs describe the default endpoint's view, never a pool view.
+    // Authentication alone cannot admit a caller that deployment code refuses.
+    const admission = opts.config.grant
+        ? Effect.tryPromise(async () => (await opts.config.grant(authz.identity)) === true).pipe(Effect.orElseSucceed(() => false))
+        : Effect.succeed(true);
+    return Effect.flatMap(admission, (allowed) => allowed
+        ? Effect.try({
+            try: () => {
+                validateAuthPermissions(authz, opts.registry);
+                return opts.registry.scoped(scopeFor(authz));
+            },
+            catch: (error) => new Answer(privateJson({ error: msg(error) }, { status: 403 })),
+        })
+        : refuse("not found", 404));
 }
 /**
  * Run one route program to its Response.

package/dist/routes/ui-config.js

@@ -154,7 +154,7 @@ function configRead(context) {
                 pools.push({
                     name,
                     path: `/mcp/${name}`,
-                    trust: pool.trust,
+                    readOnly: pool.readOnly,
                     grants: grants(intersectAccess(authz, pool.access), ids),
                 });
         }
@@ -199,7 +199,7 @@ function configRead(context) {
             you: {
                 interactive: authz.identity.interactive,
                 grants: grants(authz, ids),
-                trust: opts.config.trust,
+                readOnly: opts.config.readOnly,
                 pools,
                 permissions: {
                     activity: activity === "available" || activity === "unavailable",

package/dist/server.js

@@ -88,6 +88,9 @@ export function createFetchHandler(opts) {
             });
         }
         if (path.startsWith("/.well-known/")) {
+            const guardedMetadata = yield* routeMcp.handle(context);
+            if (guardedMetadata)
+                return guardedMetadata;
             const response = yield* metadata(request, baseUrl);
             if (response)
                 return response;

package/dist/skills.js

@@ -7,11 +7,12 @@ import { sentSecretsForRequest } from "./sent-secrets.js";
 const ROUTE = "Choose a route before discovery. One known-address read uses call_tool; one known-address write uses call_destructive_tool. Unknown-address read-only work starts with execute_code to discover, call, and return the answer; use the same route for reduction, multiple or dependent calls, loops, joins, or branches. Keep discovery and calls together when schemas suffice; do not return catalog matches alone. Sample unfamiliar reads.";
 const RECOVERY = 'When an auth error includes a handoff, give it to the user or operator. Use authorize_connector for a fresh link. Page resultId notices and format:"paged" handles with connecta.result(handleOrId, { page? }). Fetch skills({ name: "usage" }) only for missing guidance or program repair.';
 /**
- * The always-loaded MCP `instructions` string. A program runs reads and the
- * writes in trusted pools; a read-only pool routes every write to top-level
- * call_destructive_tool, where the host's permission prompt is the approval.
+ * The always-loaded MCP `instructions` string. An endpoint is writable or
+ * read-only: a writable one lets programs and call_destructive_tool write,
+ * and the client owns approval; a read-only one omits write tools from search
+ * and describe and refuses every write call. Guides may still name them.
  */
-export const CONNECTA_INSTRUCTIONS = `${ROUTE} Programs call reads in read-only pools and may also write in trusted pools. The execute_code description names this endpoint's trust. In a read-only pool, discover writes with search_tools then use call_destructive_tool. Never repeat a write to recover its output. ${RECOVERY}`;
+export const CONNECTA_INSTRUCTIONS = `${ROUTE} On a writable endpoint, programs and call_destructive_tool may write. On a read-only endpoint, search omits write tools and every write call is refused; guides may still name them. The execute_code description says which this endpoint is. Never repeat a write to recover its output. ${RECOVERY}`;
 export { USAGE_SKILL } from "./usage-guide.js";
 /** True when at least one of `connectors` carries a usage guide. */
 export function hasConnectorGuides(connectors) {

package/dist/tool-safety.js

@@ -14,9 +14,17 @@ export function classifyTool(definition, override, review) {
         ? "read"
         : "write";
 }
-/** The only permission decision for a connector call. Approval is host-owned. */
-export function surfaceAllowsTool(classification, surface, trust = "read-only") {
-    return (classification === "read" ||
-        surface === "call_destructive_tool" ||
-        (surface === "execute_code" && trust === "trusted"));
+/**
+ * The only permission decision for a connector call. Approval is client-owned.
+ * A read-only endpoint refuses every write on every surface; a writable one
+ * sends writes through call_destructive_tool and programs, never call_tool.
+ */
+export function writeRefusal(classification, surface, readOnly = false) {
+    if (classification === "read")
+        return undefined;
+    if (readOnly)
+        return "read_only_endpoint";
+    return surface === "call_destructive_tool" || surface === "execute_code"
+        ? undefined
+        : "destructive_tool_requires_approval";
 }

package/dist/types.d.ts

@@ -95,7 +95,7 @@ export interface ToolDef {
      * Standard MCP tool behavior hints plus provider-specific extensions.
      * The registry classifies these after deployment overrides and provider
      * review. Only a stored read verdict may use call_tool; program writes
-     * require a trusted pool. Approval belongs to the host.
+     * require a writable endpoint. Approval belongs to the host.
      */
     annotations?: ToolAnnotations;
 }

package/dist/ui.d.ts

@@ -9,7 +9,7 @@ export { CONNECTA_FAVICON_SVG, resolveBranding, isSafeHttpUrl, isSafeHttpsUrl, i
 export type OperatorPage = import("./operator-ui/view.js").OperatorPage;
 export declare function operatorPageForPath(path: string): OperatorPage | undefined;
 export declare function operatorPageTitle(page: OperatorPage, configuredTitle: string): string;
-/** Report the verdict the registry stored, independent of pool trust. */
+/** Report the verdict the registry stored, independent of whether an endpoint is read-only. */
 export declare function uiToolSafety(definition: ToolDef): UiToolSafety;
 /**
  * The fix-prompt key for a connector that is not usable. Chosen from the

package/dist/ui.js

@@ -40,7 +40,7 @@ export function operatorPageForPath(path) {
 export function operatorPageTitle(page, configuredTitle) {
     return `${OPERATOR_PAGE_LABELS[page]} — ${configuredTitle}`;
 }
-/** Report the verdict the registry stored, independent of pool trust. */
+/** Report the verdict the registry stored, independent of whether an endpoint is read-only. */
 export function uiToolSafety(definition) {
     if (definition.classification === "read")
         return "runs_in_programs";

package/dist/usage-guide.js

@@ -16,9 +16,9 @@ description: How to route work between one execute_code program and Connecta's e
 
 Read one account with call_tool: \`{ "address": "crm.get_account", "args": { "id": "acct_42" } }\`.
 Discover and call together when schemas suffice. search_tools covers catalog
-inspection and write discovery in read-only pools. Programs may
-write only in trusted pools; the tool description states this endpoint's trust.
-Unannotated tools fail closed to writes.
+inspection. On a read-only endpoint, as execute_code's description says, search
+omits writes (guides may name them) and each fails read_only_endpoint; tell the
+user. Unannotated tools fail closed to writes.
 
 ## The global and the envelopes
 

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const CONNECTA_VERSION = "0.31.0";
+export declare const CONNECTA_VERSION = "0.32.0";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Generated from package.json by scripts/generate-version.mjs.
 // Workers-safe: no runtime filesystem read or deployment override.
-export const CONNECTA_VERSION = "0.31.0";
+export const CONNECTA_VERSION = "0.32.0";