@zackbart/connecta 0.4.0 → 0.5.0

package/dist/validate.d.ts

@@ -11,6 +11,27 @@ export interface ValidateToolInputOptions {
      * unusable. Default console.
      */
     logger?: Logger;
+    /**
+     * Fail-closed on a schema the validator cannot evaluate (default false =
+     * today's fail-open behavior). When true, a schema that cannot be compiled —
+     * or that only fails on first use, e.g. an unresolvable `$ref` — yields a
+     * non-retryable `invalid_args` error instead of passing the raw arguments
+     * through, so unvalidated input is never silently admitted. The happy path
+     * (a schema that compiles and validates) is unaffected.
+     */
+    failClosed?: boolean;
+}
+export interface PrecompileValidatorOptions {
+    /**
+     * Tool address used in the warning text, conventionally
+     * `"connectorId.toolName"`.
+     */
+    address: string;
+    /**
+     * Destination for the warning emitted when the schema cannot be compiled.
+     * Default console.
+     */
+    logger?: Logger;
 }
 /**
  * Validate call arguments against a tool's JSON Schema.
@@ -24,7 +45,9 @@ export interface ValidateToolInputOptions {
  *
  * A schema the validator cannot compile (or that only fails on first use, e.g.
  * an unresolvable `$ref`) is warned about once and then passed through — a
- * broken schema should not break an otherwise working tool.
+ * broken schema should not break an otherwise working tool. Pass
+ * `failClosed: true` to instead reject such calls with `invalid_args`, for
+ * callers that would rather refuse a call than forward unvalidated arguments.
  *
  * The compiled validator is cached by **schema object identity**, so pass a
  * stable object: hold the parsed manifest and hand the same schema back on
@@ -36,4 +59,13 @@ export interface ValidateToolInputOptions {
  * the `Connector` interface directly.
  */
 export declare function validateToolInput(schema: JsonSchema, args: unknown, opts: ValidateToolInputOptions): ConnectorCallError | null;
+/**
+ * Eagerly compile and cache a tool's inputSchema so a schema the validator
+ * cannot use surfaces once at connector construction rather than silently on
+ * the first call. Reuses the same module-level cache `validateToolInput` reads,
+ * so the runtime path hits the cache. Warning-only: it never throws and never
+ * changes call behavior. A schema that only fails on first `validate()` (e.g.
+ * an unresolvable `$ref`) still slips through here and is caught at call time.
+ */
+export declare function precompileValidator(schema: JsonSchema, opts: PrecompileValidatorOptions): void;
 //# sourceMappingURL=validate.d.ts.map

package/dist/validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAsBD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,OAAO,EACb,IAAI,EAAE,wBAAwB,GAC7B,kBAAkB,GAAG,IAAI,CA+B3B"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AA6BD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,OAAO,EACb,IAAI,EAAE,wBAAwB,GAC7B,kBAAkB,GAAG,IAAI,CAqC3B;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,0BAA0B,GAC/B,IAAI,CAQN"}

package/dist/validate.js

@@ -5,6 +5,9 @@ import { ConnectorCallError } from "./errors.js";
 // breaking a working tool). A WeakMap so schemas belonging to a discarded
 // connector are collectable, the same pattern compactSchema uses.
 const validators = new WeakMap();
+function unevaluableSchema(address) {
+    return new ConnectorCallError("invalid_args", `Cannot validate arguments for "${address}": its inputSchema could not be evaluated`);
+}
 function disableValidation(schema, address, logger, err) {
     validators.set(schema, null);
     logger.warn(`[connecta] tool "${address}" has an inputSchema the validator cannot use (${err instanceof Error ? err.message : String(err)}) — arguments are not validated`);
@@ -21,7 +24,9 @@ function disableValidation(schema, address, logger, err) {
  *
  * A schema the validator cannot compile (or that only fails on first use, e.g.
  * an unresolvable `$ref`) is warned about once and then passed through — a
- * broken schema should not break an otherwise working tool.
+ * broken schema should not break an otherwise working tool. Pass
+ * `failClosed: true` to instead reject such calls with `invalid_args`, for
+ * callers that would rather refuse a call than forward unvalidated arguments.
  *
  * The compiled validator is cached by **schema object identity**, so pass a
  * stable object: hold the parsed manifest and hand the same schema back on
@@ -45,13 +50,19 @@ export function validateToolInput(schema, args, opts) {
             validator = null;
         }
     }
+    // A schema the validator could not compile (or that a prior call disabled):
+    // pass through by default, refuse when the caller opted into fail-closed.
+    if (validator === null) {
+        return opts.failClosed ? unevaluableSchema(opts.address) : null;
+    }
     let result;
     try {
-        result = validator?.validate(args);
+        result = validator.validate(args);
     }
     catch (err) {
         // e.g. an unresolvable $ref — surfaces on first validate, not compile.
         disableValidation(schema, opts.address, logger, err);
+        return opts.failClosed ? unevaluableSchema(opts.address) : null;
     }
     if (result && !result.valid) {
         const units = result.errors.filter((u) => u.instanceLocation !== "#");
@@ -63,4 +74,23 @@ export function validateToolInput(schema, args, opts) {
     }
     return null;
 }
+/**
+ * Eagerly compile and cache a tool's inputSchema so a schema the validator
+ * cannot use surfaces once at connector construction rather than silently on
+ * the first call. Reuses the same module-level cache `validateToolInput` reads,
+ * so the runtime path hits the cache. Warning-only: it never throws and never
+ * changes call behavior. A schema that only fails on first `validate()` (e.g.
+ * an unresolvable `$ref`) still slips through here and is caught at call time.
+ */
+export function precompileValidator(schema, opts) {
+    if (validators.has(schema))
+        return;
+    const logger = opts.logger ?? console;
+    try {
+        validators.set(schema, new Validator(schema, "2020-12", false));
+    }
+    catch (err) {
+        disableValidation(schema, opts.address, logger, err);
+    }
+}
 //# sourceMappingURL=validate.js.map

package/dist/validate.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate.js","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAgBjD,8EAA8E;AAC9E,uEAAuE;AACvE,0EAA0E;AAC1E,kEAAkE;AAClE,MAAM,UAAU,GAAG,IAAI,OAAO,EAAgC,CAAC;AAE/D,SAAS,iBAAiB,CACxB,MAAkB,EAClB,OAAe,EACf,MAAc,EACd,GAAY;IAEZ,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC7B,MAAM,CAAC,IAAI,CACT,oBAAoB,OAAO,kDACzB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,iCAAiC,CAClC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAkB,EAClB,IAAa,EACb,IAA8B;IAE9B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC;IACtC,IAAI,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,SAAS,GAAG,IAAI,SAAS,CAAC,MAAe,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;YAC7D,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YACrD,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uEAAuE;QACvE,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,KAAK,GAAG,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;aACtD,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,gBAAgB,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;aAC/C,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,IAAI,kBAAkB,CAC3B,cAAc,EACd,0BAA0B,IAAI,CAAC,OAAO,MAAM,MAAM,IAAI,6CAA6C,EAAE,CACtG,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAsCjD,8EAA8E;AAC9E,uEAAuE;AACvE,0EAA0E;AAC1E,kEAAkE;AAClE,MAAM,UAAU,GAAG,IAAI,OAAO,EAAgC,CAAC;AAE/D,SAAS,iBAAiB,CAAC,OAAe;IACxC,OAAO,IAAI,kBAAkB,CAC3B,cAAc,EACd,kCAAkC,OAAO,2CAA2C,CACrF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAkB,EAClB,OAAe,EACf,MAAc,EACd,GAAY;IAEZ,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC7B,MAAM,CAAC,IAAI,CACT,oBAAoB,OAAO,kDACzB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,iCAAiC,CAClC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAkB,EAClB,IAAa,EACb,IAA8B;IAE9B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC;IACtC,IAAI,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,SAAS,GAAG,IAAI,SAAS,CAAC,MAAe,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;YAC7D,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YACrD,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;IACH,CAAC;IACD,4EAA4E;IAC5E,0EAA0E;IAC1E,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,CAAC;IACD,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uEAAuE;QACvE,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,CAAC;IACD,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,KAAK,GAAG,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;aACtD,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,gBAAgB,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;aAC/C,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,IAAI,kBAAkB,CAC3B,cAAc,EACd,0BAA0B,IAAI,CAAC,OAAO,MAAM,MAAM,IAAI,6CAA6C,EAAE,CACtG,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAkB,EAClB,IAAgC;IAEhC,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC;IACtC,IAAI,CAAC;QACH,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,SAAS,CAAC,MAAe,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IACvD,CAAC;AACH,CAAC"}

package/dist/version.d.ts

@@ -4,5 +4,5 @@
  * a bump that forgets this file fails the build rather than shipping a stale
  * version to `/health` and to downstream MCP handshakes.
  */
-export declare const CONNECTA_VERSION = "0.4.0";
+export declare const CONNECTA_VERSION = "0.5.0";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -4,5 +4,5 @@
  * a bump that forgets this file fails the build rather than shipping a stale
  * version to `/health` and to downstream MCP handshakes.
  */
-export const CONNECTA_VERSION = "0.4.0";
+export const CONNECTA_VERSION = "0.5.0";
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zackbart/connecta",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "type": "module",
   "sideEffects": false,
   "description": "One MCP to rule them all — a single MCP endpoint aggregating many downstream connectors behind nine meta-tools.",
@@ -64,7 +64,7 @@
     "test:node": "vitest run --project node",
     "test:workers": "vitest run --project workers",
     "check:examples": "tsc -p tsconfig.examples.node.json && tsc -p tsconfig.examples.worker.json",
-    "check:security": "npm audit --omit=dev --audit-level=high",
+    "check:security": "npm audit --omit=dev --audit-level=moderate",
     "check:package": "node scripts/check-package.mjs",
     "check": "npm run typecheck && npm run test && npm run build && npm run check:examples",
     "release:check": "npm run check && npm run check:security && npm run check:package",
@@ -76,6 +76,9 @@
     "@modelcontextprotocol/sdk": "1.29.0",
     "zod": "^4.4.3"
   },
+  "overrides": {
+    "@hono/node-server": "^2.0.12"
+  },
   "peerDependencies": {
     "@clerk/backend": "^3.12.0",
     "quickjs-emscripten": "^0.32.0"

package/src/activity.ts

@@ -42,6 +42,12 @@ export interface ToolCallActivityEvent {
   serverName: string;
   serverVersion: string;
   deploymentId?: string;
+  /**
+   * Name of the toolkit this connection selected with `?toolkit=`, when it
+   * selected one. Calls are recorded the same way with or without it; this only
+   * says which scoped view the call came through.
+   */
+  toolkitId?: string;
 }
 
 export interface ActivityPage {
@@ -83,6 +89,8 @@ export interface ActivityRequestContext {
   requestId: string;
   serverInfo: { name: string; version: string };
   deploymentId?: string;
+  /** Toolkit this connection is scoped to, when `?toolkit=` selected one. */
+  toolkitId?: string;
   defer?: (promise: Promise<unknown>) => void;
   logger: Logger;
 }
@@ -128,6 +136,7 @@ export function recordToolActivity(
     ...(context.deploymentId
       ? { deploymentId: context.deploymentId }
       : {}),
+    ...(context.toolkitId ? { toolkitId: context.toolkitId } : {}),
   };
   try {
     const result = context.sink.record(event);

package/src/connectors/api.ts

@@ -1,4 +1,4 @@
-import { validateToolInput } from "../validate.js";
+import { precompileValidator, validateToolInput } from "../validate.js";
 import type {
   Connector,
   ConnectorCredentialConfig,
@@ -29,6 +29,19 @@ export interface ApiOptions {
   /** Human-readable display name; the connector id remains the address prefix. */
   title?: string;
   description?: string;
+  /**
+   * Max inline result size (bytes) for this connector's tools before
+   * call_tool/batch_call truncate and stash the full text for get_result
+   * paging. Overrides the deployment's `maxResultBytes`; omit to inherit it.
+   * Must be a whole number of bytes >= 1; anything else warns at startup and
+   * is ignored.
+   */
+  maxResultBytes?: number;
+  /**
+   * Optional agent-facing usage guide (markdown) served by the `skills`
+   * meta-tool as `connector:<id>`. See `Connector.usageGuide`.
+   */
+  usageGuide?: string;
   /** Optional operator-managed credential exposed through ctx.credential and /ui. */
   credential?: ConnectorCredentialConfig;
   /** Optional validation behind /ui's Test action. */
@@ -49,6 +62,16 @@ export interface ApiOptions {
    * on loose coercion.
    */
   validateArgs?: boolean;
+  /**
+   * Fail-closed on a tool whose `inputSchema` the validator cannot evaluate
+   * (default false). The default surfaces such a schema as a one-time warning
+   * and then passes the raw arguments through, so a broken schema never breaks
+   * an otherwise working tool. Set true to instead reject those calls with a
+   * non-retryable `invalid_args` ConnectorCallError, so a schema that cannot be
+   * enforced never silently admits unvalidated input. Only consulted when
+   * `validateArgs` is not false.
+   */
+  strictValidation?: boolean;
   tools: ApiTool[];
 }
 
@@ -73,11 +96,22 @@ export function api(id: string, opts: ApiOptions): Connector {
   }));
   const byName = new Map(opts.tools.map((t) => [t.name, t]));
   const validateArgs = opts.validateArgs ?? true;
+  const strictValidation = opts.strictValidation ?? false;
+  if (validateArgs) {
+    // Compile each schema now so a validator-hostile inputSchema surfaces once
+    // here rather than silently on its first call. Warning-only; never throws.
+    for (const t of opts.tools) {
+      if (t.inputSchema)
+        precompileValidator(t.inputSchema, { address: `${id}.${t.name}` });
+    }
+  }
   return {
     id,
     title: opts.title,
     kind: "api",
     description: opts.description,
+    maxResultBytes: opts.maxResultBytes,
+    usageGuide: opts.usageGuide,
     credential: opts.credential,
     testCredential: opts.testCredential,
     testCredentials: opts.testCredentials,
@@ -95,6 +129,7 @@ export function api(id: string, opts: ApiOptions): Connector {
         const invalid = validateToolInput(tool.inputSchema, input, {
           address: `${id}.${name}`,
           logger: ctx.logger,
+          failClosed: strictValidation,
         });
         if (invalid) throw invalid;
       }

package/src/connectors/remote-mcp.ts

@@ -10,6 +10,7 @@ import type {
   Connector,
   ConnectorContext,
   ConnectorStatus,
+  Logger,
   ToolDef,
 } from "../types.js";
 
@@ -22,7 +23,33 @@ export interface RemoteMcpOptions {
   /** Human-readable display name; the connector id remains the address prefix. */
   title?: string;
   description?: string;
+  /**
+   * Max inline result size (bytes) for this connector's tools before
+   * call_tool/batch_call truncate and stash the full text for get_result
+   * paging. Overrides the deployment's `maxResultBytes`; omit to inherit it.
+   * Must be a whole number of bytes >= 1; anything else warns at startup and
+   * is ignored.
+   */
+  maxResultBytes?: number;
+  /**
+   * Optional agent-facing usage guide (markdown) served by the `skills`
+   * meta-tool as `connector:<id>`. See `Connector.usageGuide`.
+   */
+  usageGuide?: string;
   auth?: RemoteMcpAuth;
+  /**
+   * Refuse to connect to a non-`https://` `url` at construction (default
+   * false). Loopback hosts (`localhost`, `127.0.0.1`, `[::1]`) are always
+   * allowed for local development. Off by default, static `headers` credentials
+   * over a cleartext connection are warned about but permitted; set this true
+   * to make that misconfiguration a hard error instead.
+   */
+  requireHttps?: boolean;
+  /**
+   * Destination for the cleartext-credential warning emitted at construction.
+   * Default console.
+   */
+  logger?: Logger;
   /**
    * @internal Testing seam. When set, this transport is used instead of the
    * HTTP transport, letting tests point the connector at an in-process MCP
@@ -35,6 +62,15 @@ function msg(err: unknown): string {
   return err instanceof Error ? err.message : String(err);
 }
 
+function isLoopbackHost(hostname: string): boolean {
+  return (
+    hostname === "localhost" ||
+    hostname === "127.0.0.1" ||
+    hostname === "[::1]" ||
+    hostname === "::1"
+  );
+}
+
 interface ConnectionState {
   client: Client | null;
   transport: Transport | null;
@@ -60,6 +96,27 @@ export function remoteMcp(id: string, opts: RemoteMcpOptions): Connector {
   // from the isolate singleton. Those are request-bound in Cloudflare Workers.
   const states = new WeakMap<object, ConnectionState>();
   const isOauth = opts.auth?.type === "oauth";
+  const logger = opts.logger ?? console;
+
+  // Check the destination scheme once at construction: buildTransport (and the
+  // SDK's fetch) attach any static credentials to every request, so an http://
+  // endpoint sends bearer tokens / API keys in cleartext. Loopback is exempt
+  // for local development.
+  const destination = new URL(opts.url);
+  const insecureDestination =
+    destination.protocol !== "https:" && !isLoopbackHost(destination.hostname);
+  if (insecureDestination) {
+    if (opts.requireHttps) {
+      throw new Error(
+        `[connecta] connector "${id}" url ${opts.url} is not https:// (and not loopback) — refusing to connect (requireHttps).`,
+      );
+    }
+    if (opts.auth?.type === "headers") {
+      logger.warn(
+        `[connecta] connector "${id}" sends static credentials to ${opts.url} over a non-https:// connection — those tokens will be transmitted in cleartext.`,
+      );
+    }
+  }
 
   /** Typed per-call auth signal; the SDK's UnauthorizedError stays as cause. */
   const authRequiredError = (cause: unknown) =>
@@ -98,6 +155,14 @@ export function remoteMcp(id: string, opts: RemoteMcpOptions): Connector {
     return state.provider;
   };
 
+  // NOTE: StreamableHTTPClientTransport speaks over fetch, which transparently
+  // follows 3xx redirects. A malicious or compromised downstream MCP could
+  // redirect to an internal address (e.g. http://169.254.169.254/…) and fetch
+  // would re-issue the request — potentially carrying static auth headers. The
+  // scheme check above only guards the first hop; a fully robust guard (manual
+  // redirect handling + per-hop re-validation + stripping auth headers cross-
+  // origin) lives in the SDK transport and is deferred to a future non-patch
+  // release rather than reimplemented here.
   const buildTransport = (
     ctx: ConnectorContext,
     state: ConnectionState,
@@ -200,6 +265,8 @@ export function remoteMcp(id: string, opts: RemoteMcpOptions): Connector {
     title: opts.title,
     kind: "mcp",
     description: opts.description,
+    maxResultBytes: opts.maxResultBytes,
+    usageGuide: opts.usageGuide,
 
     async listTools(ctx) {
       const state = stateFor(ctx);

package/src/credentials.ts

@@ -21,7 +21,8 @@ interface CredentialPlaintext {
 
 export interface CredentialFieldMetadata {
   configured: true;
-  lastFour: string;
+  /** Only emitted when the value is long enough that four chars don't leak much. */
+  lastFour?: string;
   updatedAt: string;
 }
 
@@ -200,7 +201,9 @@ export class CredentialVault {
         field,
         {
           configured: true as const,
-          lastFour: value.slice(-4),
+          // Only reveal the tail on values comfortably longer than four chars;
+          // for a short secret those four would be half of it.
+          ...(value.length >= 12 ? { lastFour: value.slice(-4) } : {}),
           updatedAt: credential.updatedAt,
         },
       ]),
@@ -208,7 +211,7 @@ export class CredentialVault {
     const single = fields.value;
     return {
       configured: true,
-      ...(single ? { lastFour: single.lastFour } : {}),
+      ...(single?.lastFour ? { lastFour: single.lastFour } : {}),
       updatedAt: credential.updatedAt,
       fields,
     };

package/src/execute.ts

@@ -5,7 +5,7 @@ import { recordToolActivity, type ActivityRequestContext } from "./activity.js";
 import { errorResult, jsonResult, type ToolResult } from "./meta-tools.js";
 import { classifyCallError, ConnectorCallError } from "./errors.js";
 import { unwrapMcpResult } from "./mcp-result.js";
-import type { Registry } from "./registry.js";
+import type { RegistryView } from "./registry.js";
 import type {
   Connector,
   Executor,
@@ -98,7 +98,7 @@ export function unwrapForSandbox(
  * the raw-address escape hatch. Broken connectors are skipped, not fatal.
  */
 export async function buildSandboxProviders(
-  registry: Registry,
+  registry: RegistryView,
   baseUrl: string,
   logger: Logger,
   activity?: ActivityRequestContext,
@@ -459,7 +459,7 @@ function guardResultValue(value: unknown): unknown {
 
 /** The execute_code handler. Exported for direct testing. */
 export function createExecuteTool(
-  registry: Registry,
+  registry: RegistryView,
   baseUrl: string,
   executor: Executor,
   logger: Logger,
@@ -527,7 +527,7 @@ Example: async () => { const r = await crm.search({ query: "roadmap" }); return
 /** Register the execute_code meta-tool. Only called when an executor is configured. */
 export function registerExecuteTool(
   server: McpServer,
-  registry: Registry,
+  registry: RegistryView,
   ctx: {
     baseUrl: string;
     executor: Executor;

package/src/executors/quickjs.ts

@@ -32,6 +32,14 @@ export interface QuickJsExecutorOptions {
 }
 
 const MAX_LOG_ENTRIES = 200;
+// Cap each entry AND the cumulative buffer at capture time so untrusted guest
+// code can't retain unbounded host memory: a single `console.log("x".repeat(N))`
+// otherwise copies the whole N-char guest string into a host array we hold for
+// the entire execution. 8k chars/entry is generous for glue-code logging (the
+// join in execute.ts trims the assembled log to 4k anyway), and 256k total
+// keeps the worst case — 200 maxed-out entries — bounded well under a MiB.
+const MAX_LOG_ENTRY_CHARS = 8_000;
+const MAX_LOG_TOTAL_CHARS = 256_000;
 
 function msg(err: unknown): string {
   return err instanceof Error ? err.message : String(err);
@@ -123,12 +131,32 @@ function installBridge(
   };
   armWake(bridge);
 
+  // Running total of chars actually retained in `logs`; once the cumulative
+  // budget is spent we push one marker and drop the rest, so a flood of large
+  // entries can't grow the host array without bound.
+  let logTotalChars = 0;
+  let logBudgetSpent = false;
   const logFn = ctx.newFunction("__log", (h) => {
-    if (logs.length < MAX_LOG_ENTRIES) {
-      logs.push(ctx.getString(h));
-    } else if (logs.length === MAX_LOG_ENTRIES) {
-      logs.push(`[log truncated after ${MAX_LOG_ENTRIES} entries]`);
+    if (logs.length >= MAX_LOG_ENTRIES) {
+      if (logs.length === MAX_LOG_ENTRIES) {
+        logs.push(`[log truncated after ${MAX_LOG_ENTRIES} entries]`);
+      }
+      return;
+    }
+    if (logBudgetSpent) return;
+    // Cap the entry before retaining it: `getString` yields a transient copy,
+    // but slicing here keeps only a bounded string alive in `logs`.
+    let entry = ctx.getString(h);
+    if (entry.length > MAX_LOG_ENTRY_CHARS) {
+      entry = `${entry.slice(0, MAX_LOG_ENTRY_CHARS)}…[entry truncated]`;
+    }
+    if (logTotalChars + entry.length > MAX_LOG_TOTAL_CHARS) {
+      logs.push("[log truncated: size budget exceeded]");
+      logBudgetSpent = true;
+      return;
     }
+    logs.push(entry);
+    logTotalChars += entry.length;
   });
   ctx.setProp(ctx.global, "__log", logFn);
   logFn.dispose();