a2a-exposed 0.8.11 → 0.8.12

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "a2a-exposed",
-	"version": "0.8.11",
+	"version": "0.8.12",
 	"description": "Give any AI agent a public A2A (Agent2Agent) endpoint: a Cloudflare Worker, a wake webhook, or scheduled checks",
 	"type": "module",
 	"bin": {

package/worker/src/index.ts

@@ -10,7 +10,7 @@ import { renderWake, redact, cloudflareErrorHint, wakeUrlIsTunnelHost, defaultDe
 import { fetchCheckedWake } from "./wake-target.ts";
 import * as P from "./pairing.ts";
 import * as M from "./mcp.ts";
-import { accountIdOf, DASHBOARD_ACTOR_HEADER, matchOwnerRpc, ownerResponseLeaks, scrubOwnerClaims, type OwnerRpcRequest, type OwnerRpcResult } from "./owner-rpc.ts";
+import { accountIdOf, DASHBOARD_ACTOR_HEADER, matchOwnerRpc, ownerResponseLeaks, ownerRpcBody, scrubOwnerClaims, type OwnerRpcRequest, type OwnerRpcResult } from "./owner-rpc.ts";
 import { pairingAgent, pairingEventTarget, postPairingEvent } from "./pairing-events.ts";
 import { publicManageUrl, resolveTenant, type TenantContext, type WorkerBindings } from "./tenancy.ts";
 import { exportRows, redactExport, REDACTED_SQL_SKIP, scrubSecretText, toSql } from "./export.ts";
@@ -1060,6 +1060,17 @@ async function handleOwner(req: Request, ctx: TenantContext, ectx: ExecutionCont
 		}
 	}
 	if (seg[0] === "pairing") return await ownerPairing(req, ctx, ectx, m, seg.slice(1), body, trusted);
+	if (seg[0] === "mcp" && seg[1] && !seg[2] && m === "POST" && (seg[1] === "send" || seg[1] === "reply" || seg[1] === "mark_working")) {
+		const checked = ownerRpcBody(`POST /owner/mcp/${seg[1]}`, await body());
+		if (!checked.ok) return json({ error: checked.error }, 400);
+		try {
+			const text = await runTool(ctx, ectx, seg[1], checked.value);
+			return json({ text, isError: false });
+		} catch (e: any) {
+			if (e instanceof ToolError) return json({ text: `Error: ${e.message}`, isError: true });
+			throw e;
+		}
+	}
 	if (seg[0] === "mcp" && !seg[1] && m === "GET") {
 		const rows = await ctx.DB.prepare("SELECT label, client_id, client_name, redirect_host, scope, created_at, last_used_at, revoked_at, refresh_expires_ms FROM mcp_grants ORDER BY created_at").all();
 		return json({ enabled: mcpOn(ctx), url: oauthUrls(ctx).mcp, grants: (rows.results as Json[]).map((r) => ({ ...r, refresh_expires_ms: undefined,
@@ -2282,7 +2293,8 @@ export async function runOwnerRpc(ctx: TenantContext, ectx: ExecutionContext, in
 	}
 	const matched = matchOwnerRpc(raw?.method, raw?.path, raw?.query);
 	if (!matched.ok) return refuse(matched.reason === "query" ? 400 : 404, matched.reason === "query" ? "query is not allowed" : "not found", matched.reason);
-	if (raw?.body !== undefined && raw.body !== null) return refuse(400, "this call takes no body", "body");
+	const parsedBody = ownerRpcBody(matched.route.name, raw?.body);
+	if (!parsedBody.ok) return refuse(400, parsedBody.error, "body");
 	const actor = (raw as { actor?: unknown } | null)?.actor;
 	if (actor !== undefined && actor !== "human") return refuse(400, "actor is invalid", "actor");
 	const pairingDecision = matched.route.name === "POST /owner/pairing/:code/approve" || matched.route.name === "POST /owner/pairing/:code/deny";
@@ -2297,7 +2309,11 @@ export async function runOwnerRpc(ctx: TenantContext, ectx: ExecutionContext, in
 	const url = new URL(origin + matched.route.path + search);
 	const headers = new Headers({ "content-type": "application/json" });
 	if (actor === "human") headers.set(DASHBOARD_ACTOR_HEADER, "human");
-	const req = new Request(url, { method: matched.route.method, headers });
+	const req = new Request(url, {
+		method: matched.route.method,
+		headers,
+		body: parsedBody.value === undefined ? undefined : JSON.stringify(parsedBody.value),
+	});
 	let res: Response;
 	try { res = await handleOwner(req, ctx, ectx, url.pathname, url, true); }
 	catch (e: any) {

package/worker/src/owner-rpc.ts

@@ -1,7 +1,9 @@
 // Hosted owner RPC allowlist. The caller has checked that the account owns the tenant.
 // This list is the only paths that call may run, and it is stricter than
 // the owner HTTP API: routes that mint a peer token, return a setup secret, or accept a plaintext peer
-// token are not here. GET /owner/export is here only because runOwnerRpc redacts it first. Self-host never calls this.
+// token are not here. GET /owner/export is here only because runOwnerRpc redacts it first.
+// POST /owner/mcp/send, reply, and mark_working take a checked argument object. A peer token is not one of those arguments.
+// Self-host never calls this.
 
 import { ID_RE } from "./a2a.ts";
 import { credentialIsMasked, previewHeaderPlain } from "./wake.ts";
@@ -39,7 +41,10 @@ export interface OwnerRpcRequest {
 	path: string;
 	/** Allowlisted query parameters only. */
 	query?: Record<string, string>;
-	/** Refused. The owner HTTP API is where a body is accepted. */
+	/**
+	 * Tool arguments for `POST /owner/mcp/send`, `POST /owner/mcp/reply`, and `POST /owner/mcp/mark_working`.
+	 * Any other call refuses a body.
+	 */
 	body?: unknown;
 	/**
 	 * Approve or deny after a recent sign-in.
@@ -141,6 +146,9 @@ const ROUTES: RouteDef[] = [
 	{ method: "POST", name: "POST /owner/pairing/:code/deny", take: (s) => s.length === 4 && s[1] === "pairing" && USER_CODE.test(s[2]!) && s[3] === "deny", search: noQuery, path: (s) => `/owner/pairing/${s[2]}/deny` },
 	{ method: "GET", name: "GET /owner/mcp", take: (s) => s.length === 2 && s[1] === "mcp", search: noQuery, path: () => "/owner/mcp" },
 	{ method: "DELETE", name: "DELETE /owner/mcp/:label", take: (s) => s.length === 3 && s[1] === "mcp" && MCP_LABEL.test(s[2]!), search: noQuery, path: (s) => `/owner/mcp/${s[2]}` },
+	{ method: "POST", name: "POST /owner/mcp/send", take: (s) => s.length === 3 && s[1] === "mcp" && s[2] === "send", search: noQuery, path: () => "/owner/mcp/send" },
+	{ method: "POST", name: "POST /owner/mcp/reply", take: (s) => s.length === 3 && s[1] === "mcp" && s[2] === "reply", search: noQuery, path: () => "/owner/mcp/reply" },
+	{ method: "POST", name: "POST /owner/mcp/mark_working", take: (s) => s.length === 3 && s[1] === "mcp" && s[2] === "mark_working", search: noQuery, path: () => "/owner/mcp/mark_working" },
 	{ method: "GET", name: "GET /owner/outbound-peers", take: (s) => s.length === 2 && s[1] === "outbound-peers", search: noQuery, path: () => "/owner/outbound-peers" },
 	{ method: "DELETE", name: "DELETE /owner/outbound-peers/:alias", take: (s) => s.length === 3 && s[1] === "outbound-peers" && ALIAS.test(s[2]!) && s[2] !== "." && s[2] !== "..", search: noQuery, path: (s) => `/owner/outbound-peers/${s[2]}` },
 	{ method: "GET", name: "GET /owner/facade", take: (s) => s.length === 2 && s[1] === "facade", search: noQuery, path: () => "/owner/facade" },
@@ -166,6 +174,63 @@ export function matchOwnerRpc(method: unknown, path: unknown, query: unknown): O
 	return { ok: true, route: { method, path: def.path(seg), search, name: def.name } };
 }
 
+/** Send text cap. The owner HTTP body limit is 1 MiB; this keeps one argument inside that. */
+const TEXT_MAX = 100_000;
+const REPLY_STATES = new Set(["completed", "input-required", "working", "failed", "rejected"]);
+
+const MCP_ARGS: Record<string, { required: readonly string[]; optional: readonly string[] }> = {
+	"POST /owner/mcp/send": { required: ["to", "text"], optional: ["contextId", "taskId"] },
+	"POST /owner/mcp/reply": { required: ["taskId", "text"], optional: ["state"] },
+	"POST /owner/mcp/mark_working": { required: ["taskId"], optional: [] },
+};
+
+function mcpArgOk(key: string, value: string): string | null {
+	if (key === "to") return ALIAS.test(value) ? null : "to is invalid";
+	if (key === "text") {
+		if (!value.trim()) return "text is required";
+		if (value.length > TEXT_MAX) return "text is too long";
+		return null;
+	}
+	if (key === "taskId" || key === "contextId") return idOk(value) ? null : `${key} is invalid`;
+	if (key === "state") return REPLY_STATES.has(value) ? null : "state is invalid";
+	return "body is not allowed";
+}
+
+/**
+ * Body allowed on this owner RPC route.
+ * MCP send, reply, and mark_working receive a flat object of tool arguments.
+ * Every other route accepts only an absent body.
+ */
+export function ownerRpcBody(routeName: string, body: unknown): { ok: true; value?: Record<string, string> } | { ok: false; error: string } {
+	const spec = MCP_ARGS[routeName];
+	if (!spec) {
+		if (body !== undefined && body !== null) return { ok: false, error: "this call takes no body" };
+		return { ok: true };
+	}
+	if (body == null || typeof body !== "object" || Array.isArray(body)) return { ok: false, error: "body must be an object" };
+	const allowed = new Set([...spec.required, ...spec.optional]);
+	const keys = Object.keys(body);
+	if (keys.length > allowed.size || keys.some((key) => !allowed.has(key))) return { ok: false, error: "body is not allowed" };
+	const value: Record<string, string> = {};
+	for (const key of spec.required) {
+		const item = (body as Record<string, unknown>)[key];
+		if (item == null || item === "") return { ok: false, error: `${key} is required` };
+		if (typeof item !== "string") return { ok: false, error: `${key} is invalid` };
+		const why = mcpArgOk(key, item);
+		if (why) return { ok: false, error: why };
+		value[key] = item;
+	}
+	for (const key of spec.optional) {
+		if (!Object.prototype.hasOwnProperty.call(body, key)) continue;
+		const item = (body as Record<string, unknown>)[key];
+		if (typeof item !== "string" || !item) return { ok: false, error: `${key} is invalid` };
+		const why = mcpArgOk(key, item);
+		if (why) return { ok: false, error: why };
+		value[key] = item;
+	}
+	return { ok: true, value };
+}
+
 function stringLeaks(value: string, key: string | null): boolean {
 	if (TOKEN_RE.test(value) || SETUP_RE.test(value) || USERINFO_RE.test(value)) return true;
 	return key !== null && SECRET_KEYS.has(key.toLowerCase()) && value.length >= 16;

package/worker/src/version.ts

@@ -1,2 +1,2 @@
 /** Inbox build. Keep this equal to `version` in cli/package.json. */
-export const VERSION = "0.8.11";
+export const VERSION = "0.8.12";

package/worker/test/mcp.test.ts

@@ -492,6 +492,43 @@ test("tools: send / poll_outbound through synced peers; each peer's token stays
 	assert.equal((await s.owner("GET", "/owner/outbound-peers")).data.length, 1);
 });
 
+test("POST /owner/mcp/send, reply, and mark_working use the owner token", async (t) => {
+	const s = setup(); t.after(s.restore);
+	const a = await s.connect();
+	await s.owner("PUT", "/owner/outbound-peers/alpha", { url: "https://alpha.example.org", token: "tok-alpha" });
+	const noAuth = await s.call("POST", "/owner/mcp/send", { json: { to: "alpha", text: "hi" } });
+	assert.equal(noAuth.status, 401);
+	const mcpTok = await s.call("POST", "/owner/mcp/send", { json: { to: "alpha", text: "hi" }, headers: { authorization: `Bearer ${a.access_token}` } });
+	assert.equal(mcpTok.status, 401);
+	const peerTok = "a2aow_" + "c".repeat(43);
+	const peer = await s.call("POST", "/owner/mcp/send", { json: { to: "alpha", text: "hi" }, headers: { authorization: `Bearer ${peerTok}` } });
+	assert.equal(peer.status, 401);
+	assert.equal(s.peerCalls.length, 0, "a refused caller does not send");
+	const extra = await s.owner("POST", "/owner/mcp/send", { to: "alpha", text: "hi", token: "tok-alpha" });
+	assert.equal(extra.status, 400);
+	assert.equal(s.peerCalls.length, 0, "a token field is not a send");
+	const sent = await s.owner("POST", "/owner/mcp/send", { to: "alpha", text: "status?", contextId: "ctx-owner" });
+	assert.equal(sent.status, 200, sent.text);
+	assert.equal(sent.data.isError, false);
+	assert.match(sent.data.text, /task pt-alpha/);
+	assert.equal(sent.text.includes("tok-alpha"), false);
+	assert.equal(s.peerCalls.at(-1)!.auth, "Bearer tok-alpha");
+	assert.equal(s.peerCalls.at(-1)!.body.params.message.contextId, "ctx-owner");
+
+	const inbound = await s.inbound("barry", "please reply");
+	const taskId = inbound.task.id as string;
+	const working = await s.owner("POST", "/owner/mcp/mark_working", { taskId });
+	assert.equal(working.status, 200, working.text);
+	assert.equal(working.data.isError, false);
+	assert.match(working.data.text, new RegExp(`Task ${taskId} is now working`));
+	const replied = await s.owner("POST", "/owner/mcp/reply", { taskId, text: "done", state: "completed" });
+	assert.equal(replied.status, 200, replied.text);
+	assert.equal(replied.data.isError, false);
+	assert.equal((await s.owner("GET", `/owner/tasks/${taskId}`)).data.status.state, "completed");
+	const mcpReply = await s.call("POST", "/owner/mcp/reply", { json: { taskId, text: "no" }, headers: { authorization: `Bearer ${a.access_token}` } });
+	assert.equal(mcpReply.status, 401);
+});
+
 test("peer token encryption round-trips and is bound to the alias", async () => {
 	const sealed = await M.sealPeerToken("owner", "alpha", "secret");
 	assert.equal(await M.openPeerToken("owner", "alpha", sealed), "secret");

package/worker/test/owner-mcp.test.ts

@@ -0,0 +1,125 @@
+// Hosted owner RPC for send, reply, and mark_working. The caller has already checked that the account owns the tenant.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { sha256 } from "../src/a2a.ts";
+import { dispatch, runOwnerRpc } from "../src/index.ts";
+import { hostedTenantContext, resolveTenant, type WorkerBindings } from "../src/tenancy.ts";
+import { d1 } from "./d1.ts";
+
+const BASE = "https://carol.example.com";
+const ectx = { waitUntil() {}, passThroughOnException() {} };
+
+test("hosted control plane send, reply, and mark_working", async (t) => {
+	const DB = d1(new URL("../migrations/", import.meta.url));
+	const ownerToken = "hosted-owner-token";
+	const hash = await sha256(ownerToken);
+	const env = {
+		DB, TENANCY: "host", TENANT_SECRETS_KEY: "platform-key", PUBLIC_URL: BASE, OWNER_TOKEN: "platform-owner",
+	} as WorkerBindings;
+	const ctx = hostedTenantContext(env, {
+		id: "ten_carol", db: DB, publicUrl: BASE, ownerTokenHash: hash, status: "active",
+		config: { AGENT_NAME: "Carol" },
+	});
+	const peerCalls: { host: string; auth: string | null; body: any }[] = [];
+	const origFetch = globalThis.fetch;
+	globalThis.fetch = (async (input: any, init: any = {}) => {
+		const u = new URL(String(input));
+		if (u.pathname === "/.well-known/agent-card.json")
+			return Response.json({ name: u.host, supportedInterfaces: [{ url: `https://${u.host}/a2a`, protocolBinding: "JSONRPC", protocolVersion: "1.0" }] });
+		if (u.pathname === "/a2a") {
+			const body = JSON.parse(init.body);
+			const auth = new Headers(init.headers).get("authorization");
+			peerCalls.push({ host: u.host, auth, body });
+			if (auth !== `Bearer tok-${u.host.split(".")[0]}`) return new Response("no", { status: 401 });
+			if (body.method === "SendMessage") return Response.json({ jsonrpc: "2.0", id: body.id, result: { task: { id: `pt-${u.host.split(".")[0]}`, contextId: "ctx-out-1", status: { state: "TASK_STATE_SUBMITTED" } } } });
+		}
+		return new Response("not found", { status: 404 });
+	}) as typeof fetch;
+	t.after(() => { globalThis.fetch = origFetch; });
+
+	const http = async (method: string, path: string, auth: string | null, json?: unknown, headers: Record<string, string> = {}) => {
+		const h: Record<string, string> = { "content-type": "application/json", ...headers };
+		if (auth) h.authorization = auth;
+		const res = await dispatch(new Request(BASE + path, {
+			method, headers: h, body: json === undefined ? undefined : JSON.stringify(json),
+		}), ctx, ectx as any);
+		const text = await res.text();
+		let data: any = text;
+		try { data = JSON.parse(text); } catch { /* plain text */ }
+		return { status: res.status, data, text };
+	};
+	const rpc = (path: string, body?: unknown, extra: Record<string, unknown> = {}) =>
+		runOwnerRpc(ctx, ectx as any, { accountId: "acct_carol", method: "POST", path, ...(body === undefined ? {} : { body }), ...extra } as any);
+
+	const single = await runOwnerRpc(resolveTenant({ DB, PUBLIC_URL: BASE, OWNER_TOKEN: "owner-secret" } as WorkerBindings), ectx as any, {
+		accountId: "acct_carol", method: "POST", path: "/owner/mcp/send", body: { to: "alpha", text: "hi" },
+	});
+	assert.equal(single.status, 404, "self-host keeps the bearer owner API");
+
+	assert.equal((await http("POST", "/owner/mcp/send", null, { to: "alpha", text: "hi" })).status, 401);
+	assert.equal((await http("POST", "/owner/mcp/send", "Bearer platform-owner", { to: "alpha", text: "hi" })).status, 401);
+	assert.equal((await http("POST", "/owner/mcp/send", "Bearer a2aow_" + "c".repeat(43), { to: "alpha", text: "hi" })).status, 401);
+	const synced = await http("PUT", "/owner/outbound-peers/alpha", `Bearer ${ownerToken}`, { url: "https://alpha.example.org", token: "tok-alpha" });
+	assert.equal(synced.status, 200, synced.text);
+
+	const missing = await rpc("/owner/mcp/send");
+	assert.equal(missing.status, 400);
+	assert.match(String((missing.body as { error?: string }).error), /body must be an object/);
+	const sneaky = await rpc("/owner/mcp/send", { to: "alpha", text: "hi", token: "tok-alpha" });
+	assert.equal(sneaky.status, 400);
+	assert.equal(peerCalls.length, 0);
+	const human = await rpc("/owner/mcp/send", { to: "alpha", text: "hi" }, { actor: "human" });
+	assert.equal(human.status, 400);
+	assert.equal(peerCalls.length, 0);
+	const badAccount = await runOwnerRpc(ctx, ectx as any, {
+		accountId: "../acct", method: "POST", path: "/owner/mcp/send", body: { to: "alpha", text: "hi" },
+	});
+	assert.equal(badAccount.status, 400);
+	assert.equal(peerCalls.length, 0);
+
+	const sent = await rpc("/owner/mcp/send", { to: "alpha", text: "status?", contextId: "ctx-hosted" });
+	assert.equal(sent.status, 200, JSON.stringify(sent.body));
+	const sentBody = sent.body as { text?: string; isError?: boolean };
+	assert.equal(sentBody.isError, false);
+	assert.match(sentBody.text || "", /task pt-alpha/);
+	assert.equal(JSON.stringify(sent.body).includes("tok-alpha"), false);
+	assert.equal(JSON.stringify(sent.body).includes(ownerToken), false);
+	assert.equal(peerCalls.at(-1)!.host, "alpha.example.org");
+	assert.equal(peerCalls.at(-1)!.auth, "Bearer tok-alpha");
+	assert.equal(peerCalls.at(-1)!.body.params.message.parts[0].text, "status?");
+	assert.equal(peerCalls.at(-1)!.body.params.message.contextId, "ctx-hosted");
+
+	const viaHttp = await http("POST", "/owner/mcp/send", `Bearer ${ownerToken}`, { to: "alpha", text: "from the owner token" });
+	assert.equal(viaHttp.status, 200, viaHttp.text);
+	assert.equal(viaHttp.data.isError, false);
+	assert.equal(viaHttp.text.includes("tok-alpha"), false);
+	assert.equal(peerCalls.at(-1)!.body.params.message.parts[0].text, "from the owner token");
+
+	const withBody = await runOwnerRpc(ctx, ectx as any, { accountId: "acct_carol", method: "GET", path: "/owner/peers", body: { label: "bob" } });
+	assert.equal(withBody.status, 400);
+	assert.equal((withBody.body as { error?: string }).error, "this call takes no body");
+	const minted = await rpc("/owner/peers", { label: "bob" });
+	assert.equal(minted.status, 404);
+
+	const issued = await http("POST", "/owner/peers", `Bearer ${ownerToken}`, { label: "ada" });
+	assert.match(issued.data.token || "", /^a2aow_/);
+	const inbound = await http("POST", "/", `Bearer ${issued.data.token}`, {
+		jsonrpc: "2.0", id: 1, method: "message/send",
+		params: { message: { kind: "message", role: "user", messageId: "m-ada", parts: [{ kind: "text", text: "hello" }] } },
+	}, { "a2a-version": "0.3" });
+	assert.equal(inbound.status, 200, inbound.text);
+	const taskId = inbound.data.result.id as string;
+	assert.ok(taskId);
+	const working = await rpc("/owner/mcp/mark_working", { taskId });
+	assert.equal(working.status, 200, JSON.stringify(working.body));
+	assert.match((working.body as { text?: string }).text || "", new RegExp(`Task ${taskId} is now working`));
+	const replied = await rpc("/owner/mcp/reply", { taskId, text: "done", state: "completed" });
+	assert.equal(replied.status, 200, JSON.stringify(replied.body));
+	assert.equal((replied.body as { isError?: boolean }).isError, false);
+	const task = await http("GET", `/owner/tasks/${taskId}`, `Bearer ${ownerToken}`);
+	assert.equal(task.data.status.state, "completed");
+	const unknown = await rpc("/owner/mcp/send", { to: "missing", text: "hi" });
+	assert.equal(unknown.status, 200);
+	assert.equal((unknown.body as { isError?: boolean }).isError, true);
+	assert.match((unknown.body as { text?: string }).text || "", /no peer "missing"/);
+});

package/worker/test/owner-rpc.test.ts

@@ -1,7 +1,7 @@
 // Owner RPC allowlist and response filter. No Durable Object: the hosted test calls TenantStore.owner.
 import { test } from "node:test";
 import assert from "node:assert/strict";
-import { accountIdOf, matchOwnerRpc, ownerResponseLeaks, scrubOwnerClaims } from "../src/owner-rpc.ts";
+import { accountIdOf, matchOwnerRpc, ownerResponseLeaks, ownerRpcBody, scrubOwnerClaims } from "../src/owner-rpc.ts";
 
 test("owner RPC allowlist is the management reads and the calls that do not return a secret", () => {
 	const ok = (method: string, path: string, query?: Record<string, string>) => {
@@ -22,6 +22,9 @@ test("owner RPC allowlist is the management reads and the calls that do not retu
 	assert.equal(ok("POST", "/owner/pairing/wdjb4827/deny")?.name, "POST /owner/pairing/:code/deny");
 	assert.equal(ok("GET", "/owner/mcp")?.name, "GET /owner/mcp");
 	assert.equal(ok("DELETE", "/owner/mcp/mcp-claude")?.path, "/owner/mcp/mcp-claude");
+	assert.equal(ok("POST", "/owner/mcp/send")?.name, "POST /owner/mcp/send");
+	assert.equal(ok("POST", "/owner/mcp/reply")?.path, "/owner/mcp/reply");
+	assert.equal(ok("POST", "/owner/mcp/mark_working")?.name, "POST /owner/mcp/mark_working");
 	assert.equal(ok("GET", "/owner/outbound-peers")?.name, "GET /owner/outbound-peers");
 	assert.equal(ok("DELETE", "/owner/outbound-peers/ada.bot")?.path, "/owner/outbound-peers/ada.bot");
 	assert.equal(ok("GET", "/owner/facade")?.name, "GET /owner/facade");
@@ -44,6 +47,9 @@ test("owner RPC allowlist is the management reads and the calls that do not retu
 	assert.deepEqual(refused("GET", "/owner/log", { n: "10" }), { ok: false, reason: "query" });
 	assert.deepEqual(refused("POST", "/owner/purge"), { ok: false, reason: "path" });
 	assert.deepEqual(refused("POST", "/owner/tasks/task-1/reply"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("POST", "/owner/mcp/send", { to: "alpha" }), { ok: false, reason: "query" });
+	assert.deepEqual(refused("POST", "/owner/mcp/poll_outbound"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("PUT", "/owner/mcp/send"), { ok: false, reason: "path" });
 	assert.deepEqual(refused("POST", "/owner/history"), { ok: false, reason: "path" });
 	assert.deepEqual(refused("GET", "/owner/peers/../export"), { ok: false, reason: "path" });
 	assert.deepEqual(refused("GET", "/owner/%2e%2e/peers"), { ok: false, reason: "path" });
@@ -58,6 +64,41 @@ test("owner RPC allowlist is the management reads and the calls that do not retu
 	assert.equal(accountIdOf(""), null);
 });
 
+test("owner RPC accepts a tool-argument body only on send, reply, and mark_working", () => {
+	const absent = ownerRpcBody("GET /owner/peers", undefined);
+	assert.equal(absent.ok, true);
+	assert.equal(absent.ok && absent.value, undefined);
+	assert.equal(ownerRpcBody("GET /owner/peers", null).ok, true);
+	assert.deepEqual(ownerRpcBody("GET /owner/peers", { label: "bob" }), { ok: false, error: "this call takes no body" });
+	assert.deepEqual(ownerRpcBody("POST /owner/wake/test", {}), { ok: false, error: "this call takes no body" });
+
+	const sent = ownerRpcBody("POST /owner/mcp/send", { to: "alpha", text: "status?", contextId: "ctx-1" });
+	assert.deepEqual(sent, { ok: true, value: { to: "alpha", text: "status?", contextId: "ctx-1" } });
+	assert.deepEqual(ownerRpcBody("POST /owner/mcp/send", { to: "alpha", text: "status?", taskId: "task-1" }), {
+		ok: true, value: { to: "alpha", text: "status?", taskId: "task-1" },
+	});
+	assert.deepEqual(ownerRpcBody("POST /owner/mcp/reply", { taskId: "task-1", text: "done", state: "input-required" }), {
+		ok: true, value: { taskId: "task-1", text: "done", state: "input-required" },
+	});
+	assert.deepEqual(ownerRpcBody("POST /owner/mcp/mark_working", { taskId: "task-1" }), { ok: true, value: { taskId: "task-1" } });
+
+	assert.equal(ownerRpcBody("POST /owner/mcp/send", undefined).ok, false);
+	assert.equal(ownerRpcBody("POST /owner/mcp/send", null).ok, false);
+	assert.equal(ownerRpcBody("POST /owner/mcp/send", []).ok, false);
+	assert.equal(ownerRpcBody("POST /owner/mcp/send", "hi").ok, false);
+	assert.deepEqual(ownerRpcBody("POST /owner/mcp/send", {}), { ok: false, error: "to is required" });
+	assert.deepEqual(ownerRpcBody("POST /owner/mcp/send", { to: "alpha" }), { ok: false, error: "text is required" });
+	assert.deepEqual(ownerRpcBody("POST /owner/mcp/send", { to: "https://alpha.example", text: "hi" }), { ok: false, error: "to is invalid" });
+	assert.deepEqual(ownerRpcBody("POST /owner/mcp/send", { to: "alpha", text: "   " }), { ok: false, error: "text is required" });
+	assert.deepEqual(ownerRpcBody("POST /owner/mcp/send", { to: "alpha", text: "x".repeat(100_001) }), { ok: false, error: "text is too long" });
+	assert.deepEqual(ownerRpcBody("POST /owner/mcp/send", { to: "alpha", text: "hi", token: "tok-alpha" }), { ok: false, error: "body is not allowed" });
+	assert.deepEqual(ownerRpcBody("POST /owner/mcp/send", { to: "alpha", text: "hi", url: "https://evil.example" }), { ok: false, error: "body is not allowed" });
+	assert.deepEqual(ownerRpcBody("POST /owner/mcp/reply", { taskId: "task-1", text: "done", state: "canceled" }), { ok: false, error: "state is invalid" });
+	assert.deepEqual(ownerRpcBody("POST /owner/mcp/reply", { taskId: "task-1", text: "done", force: true }), { ok: false, error: "body is not allowed" });
+	assert.deepEqual(ownerRpcBody("POST /owner/mcp/mark_working", { taskId: ".." }), { ok: false, error: "taskId is invalid" });
+	assert.deepEqual(ownerRpcBody("POST /owner/mcp/mark_working", { taskId: "task-1", text: "no" }), { ok: false, error: "body is not allowed" });
+});
+
 test("owner RPC withholds peer tokens and decrypted secrets", () => {
 	const token = "a2aow_" + "a".repeat(43);
 	assert.equal(ownerResponseLeaks("a2aot_" + "Q".repeat(43)), true);