@zackbart/connecta 0.8.0 → 0.9.0

package/src/routes/mcp.ts

@@ -1,5 +1,9 @@
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
+import {
+  createMcpHandler,
+  isLegacyRequest,
+  McpServer,
+  WebStandardStreamableHTTPServerTransport,
+} from "@modelcontextprotocol/server";
 import type { ActivityActor, ActivityRequestContext } from "../activity.js";
 import { registerExecuteTool } from "../execute.js";
 import {
@@ -7,14 +11,11 @@ import {
   type AdmissionLease,
 } from "../executor-admission.js";
 import { registerMetaTools } from "../meta-tools.js";
-import { ScopedRegistry, type Registry, type RegistryView } from "../registry.js";
+import type { RegistryView } from "../registry.js";
 import { CONNECTA_INSTRUCTIONS } from "../skills.js";
-import { TOOLKIT_NAME_RE, type Toolkit } from "../toolkits.js";
-import type { Logger, ToolkitBinding } from "../types.js";
+import type { Logger } from "../types.js";
 import {
-  MAX_ECHOED_TOOLKIT_NAME,
   authorize,
-  loggableValue,
   type RouteContext,
   type RuntimeExecutionContext,
   type ServerOptions,
@@ -24,7 +25,7 @@ export const MCP_CORS_HEADERS = {
   "Access-Control-Allow-Origin": "*",
   "Access-Control-Allow-Methods": "GET, POST, DELETE, OPTIONS",
   "Access-Control-Allow-Headers":
-    "Content-Type, Authorization, mcp-protocol-version, mcp-session-id",
+    "Content-Type, Authorization, mcp-protocol-version, mcp-session-id, mcp-method, mcp-name",
 };
 
 // Browser-based MCP clients call /mcp cross-origin. Without CORS on every
@@ -142,167 +143,45 @@ function releaseAdmissionWithResponse(
   });
 }
 
-/** What one MCP connection may see: the full registry, or one toolkit's view. */
-interface McpScope {
-  registry: RegistryView;
-  /** Set only under `?toolkit=`; recorded on activity events. */
-  toolkitId?: string;
-}
-
-/** The one refusal a bound identity ever sees. Constant on purpose — see below. */
-const TOOLKIT_FORBIDDEN_BODY = JSON.stringify({
-  jsonrpc: "2.0",
-  id: null,
-  error: {
-    code: -32600,
-    message:
-      "Not permitted to use the requested toolkit. This credential is bound " +
-      "to a specific toolkit — check the ?toolkit= value in this deployment's " +
-      "MCP endpoint URL with the operator.",
-  },
-});
-
 /**
- * 403 for every binding refusal, with a body that does not depend on WHY.
- *
- * A bound identity asking for a toolkit it may not open, for a toolkit that does
- * not exist, or for no toolkit at all gets byte-identical responses, so a team
- * credential cannot be used to enumerate the org's other teams — the boundary
- * would leak the very structure it exists to hide. The operator log below is
- * where the three cases are told apart.
- */
-function toolkitForbidden(): Response {
-  return new Response(TOOLKIT_FORBIDDEN_BODY, {
-    status: 403,
-    headers: {
-      "Content-Type": "application/json",
-      "Cache-Control": "no-store",
-    },
-  });
-}
-
-/** How a rejected connection is named in the operator log. */
-function identityLabel(actor: ActivityActor): string {
-  return actor.id ? `${actor.kind} ${loggableValue(actor.id)}` : actor.kind;
-}
-
-/**
- * Resolve `?toolkit=<name>` into the registry view this connection may see,
- * enforcing the caller's toolkit binding (documentation/toolkits.md) on the way.
- *
- * For an UNBOUND identity (no binding configured — the pre-#37 shape):
- *
- * - absent → the full registry, byte-identical to a deployment with no toolkits
- * - known → a `ScopedRegistry` over that toolkit (the one visibility boundary)
- * - anything else, including `?toolkit=` with an empty value → an explicit
- *   404. Never a silent fallback to the full registry.
- *
- * For a BOUND identity, membership is checked FIRST and refusal is a flat 403:
- * a toolkit outside the binding, an unknown name, and (without `unscoped`) an
- * omitted `?toolkit=` are all refused before any `ScopedRegistry` is built, and
- * all three produce the same response.
- *
- * Neither error enumerates the configured toolkits: the name selects a scope, so
- * a wrong guess gets a flat refusal, not a directory.
+ * 404 for any `?toolkit=` value, kept after the feature's retirement (#178).
  *
- * Because of that — and because SDK clients treat a 404/403 on the transport
- * endpoint as a transport failure and discard the body — every rejection is also
- * logged operator-side (issue #47), which is the channel that actually reaches a
- * human. The log line may name the configured or bound toolkits; the response
- * still may not.
+ * Toolkits are gone, but the URLs that named them are not: clients were handed
+ * MCP endpoint URLs with `?toolkit=` baked in, and nothing about upgrading the
+ * server rotates them. Silently serving those clients the full registry would
+ * turn a former scoping boundary into fail-open — so a request still sending
+ * the param gets the same explicit 404 an unknown toolkit got before, plus an
+ * operator-side log line, which (as ever — issue #47) is the channel that
+ * actually reaches a human.
  */
-function resolveToolkitScope(
-  url: URL,
-  registry: Registry,
-  toolkits: ReadonlyMap<string, Toolkit> | undefined,
-  logger: Logger,
-  identity: { actor: ActivityActor; binding?: ToolkitBinding },
-):
-  | { ok: true; scope: McpScope }
-  | { ok: false; response: Response } {
-  const requested = url.searchParams.get("toolkit");
-  const binding = identity.binding;
-  const scopeFor = (toolkit: Toolkit) => ({
-    ok: true as const,
-    scope: {
-      registry: new ScopedRegistry(registry, toolkit),
-      toolkitId: toolkit.name,
-    },
-  });
-
-  if (binding) {
-    const who = identityLabel(identity.actor);
-    const bound = `Bound toolkits: ${binding.toolkits.join(", ") || "(none)"}${
-      binding.unscoped ? ", plus unscoped access" : ""
-    }.`;
-    if (requested === null) {
-      if (binding.unscoped) return { ok: true, scope: { registry } };
-      logger.warn(
-        `[connecta] refused an unscoped /mcp connection from ${who} with 403: ` +
-          "its toolkit binding does not allow the full registry. " +
-          bound +
-          " The client sees a transport-level failure and never the reason, so " +
-          "give it an MCP endpoint URL with a ?toolkit= value it is bound to.",
-      );
-      return { ok: false, response: toolkitForbidden() };
-    }
-    const permitted = binding.toolkits.includes(requested);
-    const toolkit = permitted ? toolkits?.get(requested) : undefined;
-    if (toolkit) return scopeFor(toolkit);
-    logger.warn(
-      `[connecta] refused an /mcp connection from ${who} with 403: it asked ` +
-        `for toolkit ${loggableValue(requested)}, which ` +
-        (permitted
-          ? "its binding allows but this deployment does not configure"
-          : "its toolkit binding does not include") +
-        ". " +
-        bound +
-        " The client sees a transport-level failure and never the reason, so " +
-        "check the ?toolkit= value in its MCP endpoint URL.",
-    );
-    return { ok: false, response: toolkitForbidden() };
-  }
-
-  if (requested === null) return { ok: true, scope: { registry } };
-  const toolkit = toolkits?.get(requested);
-  if (toolkit) return scopeFor(toolkit);
-  const configured = toolkits && toolkits.size > 0 ? [...toolkits.keys()] : [];
+function toolkitRetired(logger: Logger): Response {
   logger.warn(
-    "[connecta] rejected an /mcp connection asking for unknown toolkit " +
-      `${loggableValue(requested)} with 404. ` +
-      (configured.length > 0
-        ? `Configured toolkits: ${configured.join(", ")}.`
-        : "This deployment configures no toolkits, so no ?toolkit= value is accepted.") +
-      " The client sees a transport-level failure and never the reason, so " +
-      "check the ?toolkit= value in its MCP endpoint URL.",
+    "[connecta] rejected an /mcp connection carrying ?toolkit= with 404: " +
+      "toolkits were retired in issue #178 (see ethos.md) — one deployment " +
+      "serves one audience. The client sees a transport-level failure and " +
+      "never the reason, so remove the ?toolkit= value from its MCP endpoint " +
+      "URL, or point it at the deployment for its audience.",
   );
-  const label =
-    requested.length <= MAX_ECHOED_TOOLKIT_NAME &&
-    TOOLKIT_NAME_RE.test(requested)
-      ? `"${requested}"`
-      : "requested";
-  return {
-    ok: false,
-    response: new Response(
-      JSON.stringify({
-        jsonrpc: "2.0",
-        id: null,
-        error: {
-          code: -32600,
-          message:
-            `Unknown toolkit ${label}. Check the ?toolkit= value in this ` +
-            "deployment's MCP endpoint URL with the operator.",
-        },
-      }),
-      {
-        status: 404,
-        headers: {
-          "Content-Type": "application/json",
-          "Cache-Control": "no-store",
-        },
+  return new Response(
+    JSON.stringify({
+      jsonrpc: "2.0",
+      id: null,
+      error: {
+        code: -32600,
+        message:
+          "This deployment does not accept ?toolkit=. Toolkits were retired " +
+          "in issue #178 — remove the ?toolkit= value from the MCP endpoint " +
+          "URL, or ask the operator for the deployment serving this audience.",
       },
-    ),
-  };
+    }),
+    {
+      status: 404,
+      headers: {
+        "Content-Type": "application/json",
+        "Cache-Control": "no-store",
+      },
+    },
+  );
 }
 
 async function serveMcp(
@@ -310,61 +189,79 @@ async function serveMcp(
   opts: ServerOptions,
   baseUrl: string,
   actor: ActivityActor,
-  scope: McpScope,
+  registry: RegistryView,
   runtimeContext?: RuntimeExecutionContext,
 ): Promise<Response> {
-  // Fresh McpServer + transport per request (SDK ≥1.26 requirement), stateless.
-  const server = new McpServer(opts.serverInfo, {
-    instructions: CONNECTA_INSTRUCTIONS,
-  });
-  const activity: ActivityRequestContext | undefined = opts.activity
-    ? {
-        sink: opts.activity,
-        actor,
-        requestId: crypto.randomUUID(),
-        serverInfo: opts.serverInfo,
-        ...(opts.activityDeploymentId
-          ? { deploymentId: opts.activityDeploymentId }
-          : {}),
-        ...(scope.toolkitId ? { toolkitId: scope.toolkitId } : {}),
-        ...(runtimeContext?.waitUntil
-          ? { defer: runtimeContext.waitUntil.bind(runtimeContext) }
-          : {}),
-        logger: opts.logger,
-      }
-    : undefined;
-  // `scope.registry` is the connection's VIEW — the full registry, or one
-  // toolkit's ScopedRegistry. Nothing below may reach for `opts.registry`.
-  const registry = scope.registry;
-  registerMetaTools(server, registry, {
-    baseUrl,
-    ...(activity ? { activity } : {}),
-    ...(opts.defaultToolTimeoutMs !== undefined
-      ? { defaultToolTimeoutMs: opts.defaultToolTimeoutMs }
-      : {}),
-    ...(opts.probeTimeoutMs !== undefined
-      ? { probeTimeoutMs: opts.probeTimeoutMs }
-      : {}),
-    ...(opts.discoveryConcurrency !== undefined
-      ? { discoveryConcurrency: opts.discoveryConcurrency }
-      : {}),
-    requestSignal: request.signal,
-    ...(runtimeContext
-      ? { defer: runtimeContext.waitUntil.bind(runtimeContext) }
-      : {}),
-  });
-  if (opts.executor) {
-    registerExecuteTool(server, registry, {
+  const createServer = (): McpServer => {
+    const server = new McpServer(opts.serverInfo, {
+      instructions: CONNECTA_INSTRUCTIONS,
+      cacheHints: {
+        "tools/list": {
+          ttlMs: 3_600_000,
+          cacheScope: "private",
+        },
+      },
+    });
+    const activity: ActivityRequestContext | undefined = opts.activity
+      ? {
+          sink: opts.activity,
+          actor,
+          requestId: crypto.randomUUID(),
+          serverInfo: opts.serverInfo,
+          ...(opts.activityDeploymentId
+            ? { deploymentId: opts.activityDeploymentId }
+            : {}),
+          ...(runtimeContext?.waitUntil
+            ? { defer: runtimeContext.waitUntil.bind(runtimeContext) }
+            : {}),
+          logger: opts.logger,
+        }
+      : undefined;
+    registerMetaTools(server, registry, {
       baseUrl,
-      executor: opts.executor,
-      logger: opts.logger,
       ...(activity ? { activity } : {}),
-      requestSignal: request.signal,
+      ...(opts.defaultToolTimeoutMs !== undefined
+        ? { defaultToolTimeoutMs: opts.defaultToolTimeoutMs }
+        : {}),
+      ...(opts.probeTimeoutMs !== undefined
+        ? { probeTimeoutMs: opts.probeTimeoutMs }
+        : {}),
       ...(opts.discoveryConcurrency !== undefined
         ? { discoveryConcurrency: opts.discoveryConcurrency }
         : {}),
+      requestSignal: request.signal,
+      ...(runtimeContext
+        ? { defer: runtimeContext.waitUntil.bind(runtimeContext) }
+        : {}),
     });
+    if (opts.executor) {
+      registerExecuteTool(server, registry, {
+        baseUrl,
+        executor: opts.executor,
+        logger: opts.logger,
+        ...(activity ? { activity } : {}),
+        requestSignal: request.signal,
+        ...(opts.discoveryConcurrency !== undefined
+          ? { discoveryConcurrency: opts.discoveryConcurrency }
+          : {}),
+      });
+    }
+    return server;
+  };
+
+  // The v2 entry's built-in legacy fallback streams 2025 results as SSE.
+  // Connecta's established wire contract is JSON, so retain the documented
+  // user-land legacy branch with the same transport setting while the modern
+  // branch uses the fetch-native handler.
+  if (!(await isLegacyRequest(request))) {
+    return createMcpHandler(createServer, {
+      legacy: "reject",
+      onerror: (error) => opts.logger.error("[connecta] MCP handler error", error),
+    }).fetch(request);
   }
+
+  // Fresh server + transport per legacy request, stateless and JSON-shaped.
+  const server = createServer();
   const transport = new WebStandardStreamableHTTPServerTransport({
     enableJsonResponse: true,
   });
@@ -399,10 +296,8 @@ export function createMcpRoute(
     const {
       path,
       request,
-      url,
       baseUrl,
       runtimeContext,
-      sweepCredentials,
     } = context;
     if (path !== "/mcp") return null;
     let admission: AdmissionLease;
@@ -433,9 +328,7 @@ export function createMcpRoute(
       throw error;
     }
     try {
-      // Authenticate BEFORE resolving ?toolkit=: an unauthenticated caller
-      // must not be able to probe which toolkit names exist.
-      const authz = await authorize(request, baseUrl, opts.auth, opts.logger);
+      const authz = await authorize(request, baseUrl, opts.auth);
       if (!authz.ok) {
         return releaseAdmissionWithResponse(
           withMcpCors(authz.response),
@@ -443,26 +336,13 @@ export function createMcpRoute(
           request.signal,
         );
       }
-      const selected = resolveToolkitScope(
-        url,
-        opts.registry,
-        opts.toolkits,
-        opts.logger,
-        {
-          actor: authz.actor,
-          ...(authz.toolkitBinding
-            ? { binding: authz.toolkitBinding }
-            : {}),
-        },
-      );
-      if (!selected.ok) {
+      if (new URL(request.url).searchParams.has("toolkit")) {
         return releaseAdmissionWithResponse(
-          withMcpCors(selected.response),
+          withMcpCors(toolkitRetired(opts.logger)),
           admission,
           request.signal,
         );
       }
-      sweepCredentials();
       return releaseAdmissionWithResponse(
         withMcpCors(
           await serveMcp(
@@ -470,7 +350,7 @@ export function createMcpRoute(
             opts,
             baseUrl,
             authz.actor,
-            selected.scope,
+            opts.registry,
             runtimeContext,
           ),
         ),

package/src/routes/oauth.ts

@@ -30,7 +30,6 @@ async function handleOAuthManagementRequest(
     request,
     baseUrl,
     opts.auth,
-    opts.logger,
     "OAuth management",
   );
   if (!admin.ok) return admin.response;
@@ -61,11 +60,10 @@ async function handleOAuthManagementRequest(
       operationError = error;
     }
 
-    // The old grant and its catalog verdict are invalid after either operation,
+    // The old grant and its cached catalog are invalid after either operation,
     // including a partially failed physical cleanup whose epoch fence succeeded.
     try {
       await opts.registry.invalidateStored(connectorId);
-      await opts.registry.clearCredentialHealth(connectorId);
     } catch (error) {
       operationError ??= error;
     }
@@ -311,12 +309,8 @@ export async function routeOAuthCallback(
     return refused();
   }
   try {
-    await connector.finishAuth(code, connectorContext);
+    await connector.finishAuth(code, connectorContext, url.searchParams);
     await opts.registry.invalidateStored(id);
-    // Recovery, without a restart: the grant this connector was reported dead
-    // for has just been replaced, so drop the verdict rather than let a stale
-    // `auth_required` survive until the next scheduled check.
-    await opts.registry.clearCredentialHealth(id);
     return html(
       `Connected "${id}". You can close this window.`,
       200,

package/src/routes/shared.ts

@@ -1,16 +1,14 @@
-import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { Implementation } from "@modelcontextprotocol/server";
 import type { ActivityActor, ActivityReadGate, ActivityStore } from "../activity.js";
 import type { CredentialVault } from "../credentials.js";
 import type { DeferredWork } from "../connector-scope.js";
 import type { AdmissionController } from "../executor-admission.js";
 import type { Registry } from "../registry.js";
-import { resolveIdentityBinding, type Toolkit } from "../toolkits.js";
 import type {
   ConnectaBranding,
   Executor,
   InboundAuth,
   Logger,
-  ToolkitBinding,
 } from "../types.js";
 import { operatorPageForPath } from "../ui.js";
 
@@ -20,7 +18,7 @@ export interface ServerOptions {
   publicUrl?: string;
   // The SDK's Implementation shape: name/version plus optional title,
   // websiteUrl, and icons (MCP icons spec) that clients may render.
-  serverInfo: ConstructorParameters<typeof McpServer>[0];
+  serverInfo: Implementation;
   logger: Logger;
   activity?: ActivityStore;
   activityReadGate?: ActivityReadGate;
@@ -40,11 +38,6 @@ export interface ServerOptions {
   credentialVault?: CredentialVault;
   /** Optional browser UI and OAuth result-page labels. */
   branding?: ConnectaBranding;
-  /**
-   * Validated named scopes, selected per connection with `?toolkit=<name>` on
-   * `/mcp`. Omit (or leave empty) and every connection sees the full registry.
-   */
-  toolkits?: ReadonlyMap<string, Toolkit>;
 }
 
 export interface RuntimeExecutionContext {
@@ -59,7 +52,6 @@ export interface RouteContext {
   opts: ServerOptions;
   defer: DeferredWork | undefined;
   runtimeContext: RuntimeExecutionContext | undefined;
-  sweepCredentials(): void;
 }
 
 export function msg(err: unknown): string {
@@ -80,13 +72,13 @@ export function privateJson(
 const MAX_LOGGED_VALUE_LENGTH = 64;
 
 /**
- * Bounded, escaped form of a caller-influenced value (a rejected toolkit name,
- * identity id, or OAuth callback connector id) for the operator log. Goes
+ * Bounded, escaped form of a caller-influenced value (an identity id or OAuth
+ * callback connector id) for the operator log. Goes
  * through JSON.stringify so a caller-controlled newline or control character
  * cannot forge a log line, plus a hand-rolled escape for U+2028/U+2029, which
  * JSON.stringify leaves raw even though a log reader treats them as line
- * terminators. Truncated to a small shared cap (also the toolkit response's echo
- * limit), so an oversized value cannot flood the log either.
+ * terminators. Truncated to a small shared cap so an oversized value cannot
+ * flood the log either.
  */
 export function loggableValue(requested: string): string {
   const bounded = requested.slice(0, MAX_LOGGED_VALUE_LENGTH);
@@ -97,9 +89,6 @@ export function loggableValue(requested: string): string {
   return escaped + (bounded.length < requested.length ? " (truncated)" : "");
 }
 
-/** Length beyond which a rejected toolkit name is not echoed back. */
-export const MAX_ECHOED_TOOLKIT_NAME = MAX_LOGGED_VALUE_LENGTH;
-
 const ACTIVITY_ACTOR_NAMESPACE_RE = /^[\x21-\x7e]{1,256}$/;
 
 export function activityActorNamespace(
@@ -111,29 +100,16 @@ export function activityActorNamespace(
     : undefined;
 }
 
-/**
- * Refusal for an identity whose toolkit binding cannot be trusted — a malformed
- * declaration, or a malformed per-identity binding out of `authorize`. The
- * caller is authenticated, so this is a 403, and it is deliberately opaque: the
- * cause is an operator bug, and the operator reads it in the log, not the client.
- */
-function unusableBinding(): Response {
-  return privateJson({ error: "forbidden" }, { status: 403 });
-}
-
 export async function authorize(
   request: Request,
   baseUrl: string,
   auth: InboundAuth[],
-  logger: Logger,
 ): Promise<
   | {
       ok: true;
       actor: ActivityActor;
       /** True only when the admitting provider can also authorize UI mutation. */
       uiAdminEligible?: boolean;
-      /** The admitting identity's toolkit binding (documentation/toolkits.md). */
-      toolkitBinding?: ToolkitBinding;
     }
   | { ok: false; response: Response }
 > {
@@ -145,24 +121,6 @@ export async function authorize(
     const result = await provider.authorize(request, baseUrl);
     if (result.ok) {
       const subjectId = result.subjectId ?? result.userId;
-      // Re-validate both halves and cap the per-identity one by the provider's
-      // declaration (see resolveIdentityBinding). A binding that does not
-      // type-check at runtime refuses the request rather than evaporating:
-      // dropping it would hand the caller the full registry, which is the one
-      // outcome a binding exists to prevent.
-      const binding = resolveIdentityBinding(
-        provider.toolkitBinding,
-        result.toolkitBinding,
-      );
-      if (!binding.ok) {
-        logger.warn(
-          `[connecta] refused a request admitted by inbound auth provider ` +
-            `"${provider.kind}" with 403: ${binding.reason}. Until it is fixed ` +
-            "this provider cannot admit anyone, because connecta cannot tell " +
-            "which toolkits the identity may use.",
-        );
-        return { ok: false, response: unusableBinding() };
-      }
       const actorNamespace = activityActorNamespace(provider);
       return {
         ok: true,
@@ -176,7 +134,6 @@ export async function authorize(
         ...(result.userId && provider.uiAuth?.kind === "clerk"
           ? { uiAdminEligible: true }
           : {}),
-        ...(binding.binding ? { toolkitBinding: binding.binding } : {}),
       };
     }
     lastResponse = result.response;
@@ -195,49 +152,20 @@ export async function authorize(
   };
 }
 
-/**
- * True when this identity is confined to one or more toolkits — bound, without
- * `unscoped`. Such a credential belongs to a team's agent, not to the operator
- * running the deployment, so the deployment-wide operator surfaces (`/ui/data`,
- * `/ui/activity`, the credential API) refuse it: their payloads describe every
- * connector in the org, which is exactly what the binding exists to withhold.
- */
-export function isToolkitRestricted(
-  binding: ToolkitBinding | undefined,
-): boolean {
-  return Boolean(binding && !binding.unscoped);
-}
-
-/** The refusal the deployment-wide operator surfaces give a bound identity. */
-export function restrictedOperatorSurface(): Response {
-  return privateJson(
-    {
-      error:
-        "this credential is bound to a toolkit and may not read " +
-        "deployment-wide operator data",
-    },
-    { status: 403 },
-  );
-}
-
 export async function authorizeUiAdmin(
   request: Request,
   baseUrl: string,
   auth: InboundAuth[],
-  logger: Logger,
   purpose = "credential management",
 ): Promise<{ ok: true; userId: string } | { ok: false; response: Response }> {
   // Operator mutation is intentionally narrower than /mcp and /ui/data: only
   // an interactive Clerk provider may admit it. A static bearer token is useful
   // for headless tool calls but must not become a deployment-admin key.
   //
-  // EVERY Clerk provider gets a turn, the way the /mcp gate does, because the
-  // documented per-team pattern is several `clerkAuth(...)`s that differ only in
-  // `gate` and `toolkits` (documentation/toolkits.md). Stopping at the first would make
-  // admission depend on config order: the team-bound provider listed first
-  // would refuse the operator outright, and a refusal here — a failed gate, a
-  // missing user, a toolkit-bound identity — is exactly the case where a later
-  // provider is the one meant to admit. The last refusal is returned if none do.
+  // Every Clerk provider gets a turn, the way the /mcp gate does. Stopping at
+  // the first would make admission depend on config order: a failed gate or
+  // missing user may simply mean a later provider is the one meant to admit.
+  // The last refusal is returned if none do.
   const providers = auth.filter(
     (candidate) => candidate.uiAuth?.kind === "clerk",
   );
@@ -264,24 +192,6 @@ export async function authorizeUiAdmin(
       );
       continue;
     }
-    const binding = resolveIdentityBinding(
-      provider.toolkitBinding,
-      result.toolkitBinding,
-    );
-    if (!binding.ok) {
-      logger.warn(
-        `[connecta] refused an operator-mutation request admitted by inbound auth ` +
-          `provider "${provider.kind}" with 403: ${binding.reason}.`,
-      );
-      lastResponse = unusableBinding();
-      continue;
-    }
-    // A toolkit-bound identity is a team's credential, not a vault admin key:
-    // credentials are deployment-wide, so writing one reaches every toolkit.
-    if (isToolkitRestricted(binding.binding)) {
-      lastResponse = restrictedOperatorSurface();
-      continue;
-    }
     return { ok: true, userId: result.userId };
   }
   return {