appilot-mcp 0.3.0 → 0.4.0

package/dist/index.d.ts

@@ -2,7 +2,13 @@
 /**
  * Appilot MCP server entry point.
  *
- * Two transports, one tool surface (see server.ts):
+ * Two servers ship from this package. Appilot Studio (`server.ts`) writes an
+ * app's configuration, and is the default. Appilot (`userServer.ts`, started
+ * with `--runtime`) operates an already-configured app for the person using it.
+ * One MCP process serves one of them; the remote service serves both at once,
+ * on two paths.
+ *
+ * Two transports (see server.ts):
  *
  *   stdio (default)  The operator runs the process on their own machine or
  *                    inside their network, and it carries their credentials in

package/dist/index.js

@@ -2,7 +2,13 @@
 /**
  * Appilot MCP server entry point.
  *
- * Two transports, one tool surface (see server.ts):
+ * Two servers ship from this package. Appilot Studio (`server.ts`) writes an
+ * app's configuration, and is the default. Appilot (`userServer.ts`, started
+ * with `--runtime`) operates an already-configured app for the person using it.
+ * One MCP process serves one of them; the remote service serves both at once,
+ * on two paths.
+ *
+ * Two transports (see server.ts):
  *
  *   stdio (default)  The operator runs the process on their own machine or
  *                    inside their network, and it carries their credentials in
@@ -18,15 +24,20 @@
  * Server:   docs/architecture/appilot-mcp.md.
  */
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import { loadConnection, loadRemoteConfig, resolveTransport, RemoteConfigError } from './config.js';
+import { loadConnection, loadRemoteConfig, resolveServerSurface, resolveTransport, RemoteConfigError } from './config.js';
 import { createAppilotServer } from './server.js';
+import { createAppilotRuntimeServer } from './userServer.js';
 import { runCommand } from './cli.js';
 async function runStdio() {
     const conn = loadConnection();
-    const server = createAppilotServer(conn);
+    const runtime = resolveServerSurface() === 'runtime';
+    const server = runtime ? createAppilotRuntimeServer(conn) : createAppilotServer(conn);
     await server.connect(new StdioServerTransport());
     // stderr is safe for logs; stdout is the MCP transport.
-    process.stderr.write(`[appilot-mcp] connected · base=${conn.baseUrl ?? 'not-configured'} · token=${conn.token ? 'set' : 'none'}\n`);
+    const credential = runtime
+        ? `session=${conn.sessionToken ? 'set' : 'none'}`
+        : `token=${conn.token ? 'set' : 'none'}`;
+    process.stderr.write(`[appilot-mcp] connected · server=${runtime ? 'appilot (runtime)' : 'studio (config)'} · base=${conn.baseUrl ?? 'not-configured'} · ${credential}\n`);
 }
 async function runHttp() {
     const { startRemote } = await import('./remote/httpServer.js');

package/dist/redaction.d.ts

@@ -16,6 +16,33 @@
  * server sees it, and there is no useful way to unsend it. The widget KEY beside
  * the secret is a publishable identifier meant to sit in public HTML, so it
  * travels either way.
+ *
+ * ## The runtime surface, and the decision it turns on
+ *
+ * The Appilot connector (`userServer.ts`) reads the page a person is looking at,
+ * and the remote transport carries what it reads into a third party's
+ * conversation, where it is stored and summarized. That is the hardest call in
+ * this module, so the decision and its limit are stated here rather than
+ * inferred from the code.
+ *
+ * The connector cannot filter page content, and that is deliberate. The runtime
+ * routes answer a page read with ONE `page_content` string: the DOM tool's
+ * result serialized and wrapped in a delimited untrusted-content block. Opening
+ * that block to drop a field would mean parsing a hostile string and re-closing
+ * a delimiter this package does not own, and the delimiter is the whole
+ * prompt-injection defence. So the content passes through verbatim, and what
+ * must never leave a page is settled below the bridge instead: `isSensitiveField`
+ * closes credential fields inside the responder, which is the single definition
+ * and the only one that can act before the value is serialized.
+ *
+ * What is left to decide here is how much the connector ASKS for, which is the
+ * same argument-side lever that refuses a vault credential above. Over the
+ * remote transport a page read is capped at `REMOTE_PAGE_TEXT_LIMIT`
+ * characters, whether the caller asked for more or asked for nothing at all, so
+ * a request for the whole body cannot deposit an entire screen of a customer's
+ * data in a conversation nobody can clear. Over stdio the caller's own number
+ * stands: the operator is reading their own browser on their own machine, and
+ * there is no third party in the path.
  */
 export declare const SECRET_WITHHELD_NOTICE = "The widget secret is not returned over the remote transport, because a tool result here is stored in this conversation. Read it once from the Backoffice widget-keys page, or run the Appilot MCP server locally over stdio.";
 interface ProvisionLike {
@@ -42,4 +69,28 @@ export declare const CREDENTIAL_REFUSED_NOTICE = "A tool credential (auth_secret
  * routes by some other path cannot slip one through.
  */
 export declare function refuseSecretOverRemote(body: unknown, transport: 'stdio' | 'http' | undefined): string | null;
+/**
+ * How much of a page one read may pull across the remote transport.
+ *
+ * Enough for a banner, an error, a dialog body or a form's worth of state.
+ * Not enough for a whole screen of somebody's customer records.
+ */
+export declare const REMOTE_PAGE_TEXT_LIMIT = 4000;
+export declare const PAGE_READ_CAPPED_NOTICE = "Page reads are capped at 4000 characters over the remote transport, because a tool result here is stored in this conversation. Read one region at a time rather than the whole page.";
+export interface PageReadArgs {
+    what?: string;
+    max_chars?: number;
+    [key: string]: unknown;
+}
+/**
+ * Clamp what a page read asks for, and say when the clamp bit.
+ *
+ * Returns the arguments to send and a note for the caller, which is null when
+ * nothing was changed. The `text` read is the only one that takes a character
+ * budget; an outline and a form state are bounded by the DOM tools themselves.
+ */
+export declare function clampPageRead(args: PageReadArgs, transport: 'stdio' | 'http' | undefined): {
+    args: PageReadArgs;
+    note: string | null;
+};
 export {};

package/dist/redaction.js

@@ -16,6 +16,33 @@
  * server sees it, and there is no useful way to unsend it. The widget KEY beside
  * the secret is a publishable identifier meant to sit in public HTML, so it
  * travels either way.
+ *
+ * ## The runtime surface, and the decision it turns on
+ *
+ * The Appilot connector (`userServer.ts`) reads the page a person is looking at,
+ * and the remote transport carries what it reads into a third party's
+ * conversation, where it is stored and summarized. That is the hardest call in
+ * this module, so the decision and its limit are stated here rather than
+ * inferred from the code.
+ *
+ * The connector cannot filter page content, and that is deliberate. The runtime
+ * routes answer a page read with ONE `page_content` string: the DOM tool's
+ * result serialized and wrapped in a delimited untrusted-content block. Opening
+ * that block to drop a field would mean parsing a hostile string and re-closing
+ * a delimiter this package does not own, and the delimiter is the whole
+ * prompt-injection defence. So the content passes through verbatim, and what
+ * must never leave a page is settled below the bridge instead: `isSensitiveField`
+ * closes credential fields inside the responder, which is the single definition
+ * and the only one that can act before the value is serialized.
+ *
+ * What is left to decide here is how much the connector ASKS for, which is the
+ * same argument-side lever that refuses a vault credential above. Over the
+ * remote transport a page read is capped at `REMOTE_PAGE_TEXT_LIMIT`
+ * characters, whether the caller asked for more or asked for nothing at all, so
+ * a request for the whole body cannot deposit an entire screen of a customer's
+ * data in a conversation nobody can clear. Over stdio the caller's own number
+ * stands: the operator is reading their own browser on their own machine, and
+ * there is no third party in the path.
  */
 export const SECRET_WITHHELD_NOTICE = 'The widget secret is not returned over the remote transport, because a tool result here is stored in this conversation. Read it once from the Backoffice widget-keys page, or run the Appilot MCP server locally over stdio.';
 /**
@@ -55,3 +82,35 @@ export function refuseSecretOverRemote(body, transport) {
         return null;
     return CREDENTIAL_REFUSED_NOTICE;
 }
+// -- the runtime surface -------------------------------------------------
+/**
+ * How much of a page one read may pull across the remote transport.
+ *
+ * Enough for a banner, an error, a dialog body or a form's worth of state.
+ * Not enough for a whole screen of somebody's customer records.
+ */
+export const REMOTE_PAGE_TEXT_LIMIT = 4000;
+export const PAGE_READ_CAPPED_NOTICE = `Page reads are capped at ${REMOTE_PAGE_TEXT_LIMIT} characters over the remote transport, because a tool result here is stored in this conversation. Read one region at a time rather than the whole page.`;
+/**
+ * Clamp what a page read asks for, and say when the clamp bit.
+ *
+ * Returns the arguments to send and a note for the caller, which is null when
+ * nothing was changed. The `text` read is the only one that takes a character
+ * budget; an outline and a form state are bounded by the DOM tools themselves.
+ */
+export function clampPageRead(args, transport) {
+    if (transport !== 'http')
+        return { args, note: null };
+    // Only the `text` read takes a budget. Sending one on an outline or a form
+    // state would be a field the route ignores, which reads later as a contract
+    // this package believed in.
+    if (args.what !== undefined && args.what !== 'text')
+        return { args, note: null };
+    const asked = typeof args.max_chars === 'number' && Number.isFinite(args.max_chars) ? args.max_chars : null;
+    if (asked !== null && asked <= REMOTE_PAGE_TEXT_LIMIT)
+        return { args, note: null };
+    return {
+        args: { ...args, max_chars: REMOTE_PAGE_TEXT_LIMIT },
+        note: asked === null ? null : PAGE_READ_CAPPED_NOTICE,
+    };
+}

package/dist/remote/consent.js

@@ -69,6 +69,7 @@ const scopeKeys = {
     'config:write': ['write', 'writeHelp'],
     'provision:write': ['provision', 'provisionHelp'],
     'feedback:write': ['feedback', 'feedbackHelp'],
+    'runtime:use': ['runtime', 'runtimeHelp'],
 };
 function scopeTitle(scope, locale) {
     const keys = scopeKeys[scope];

package/dist/remote/consentMessages.d.ts

@@ -43,6 +43,8 @@ declare const en: {
     readonly provisionHelp: "Create apps, manage domains, and issue widget keys within the token's access.";
     readonly feedback: "Send issue reports to Appilot";
     readonly feedbackHelp: "Share a report title, description, and technical context with Appilot. This sends information outside your organization.";
+    readonly runtime: "Use your app through this assistant";
+    readonly runtimeHelp: "Read the page you are sharing, answer from your app's knowledge, and run its guided procedures in your own browser. It runs as you, so it can do nothing your account cannot, and it cannot change any configuration.";
     readonly expired: "This sign-in link expired";
     readonly expiredHelp: "Start the connection again from the client that sent you here. A consent link is valid for ten minutes.";
     readonly invalid: "Invalid request";

package/dist/remote/consentMessages.js

@@ -42,6 +42,8 @@ const en = {
     provisionHelp: "Create apps, manage domains, and issue widget keys within the token's access.",
     feedback: 'Send issue reports to Appilot',
     feedbackHelp: 'Share a report title, description, and technical context with Appilot. This sends information outside your organization.',
+    runtime: 'Use your app through this assistant',
+    runtimeHelp: 'Read the page you are sharing, answer from your app\'s knowledge, and run its guided procedures in your own browser. It runs as you, so it can do nothing your account cannot, and it cannot change any configuration.',
     expired: 'This sign-in link expired',
     expiredHelp: 'Start the connection again from the client that sent you here. A consent link is valid for ten minutes.',
     invalid: 'Invalid request',
@@ -104,6 +106,8 @@ const es = {
     provisionHelp: 'Crear aplicaciones, gestionar dominios y emitir claves de widget dentro del acceso del token.',
     feedback: 'Enviar reportes de problemas a Appilot',
     feedbackHelp: 'Compartir un título, una descripción y contexto técnico con Appilot. Envía información fuera de tu organización.',
+    runtime: 'Usar tu aplicación desde este asistente',
+    runtimeHelp: 'Leer la página que compartes, responder con el conocimiento de tu aplicación y ejecutar sus procedimientos guiados en tu propio navegador. Actúa como tú, así que no puede hacer nada que tu cuenta no pueda, y no puede cambiar ninguna configuración.',
     expired: 'Este enlace de acceso venció',
     expiredHelp: 'Inicia de nuevo la conexión desde el cliente que te envió aquí. El enlace es válido durante diez minutos.',
     invalid: 'Solicitud inválida',
@@ -163,6 +167,8 @@ const de = {
     provisionHelp: 'Anwendungen erstellen, Domains verwalten und Widget-Schlüssel im Zugriffsumfang des Tokens ausstellen.',
     feedback: 'Problemberichte an Appilot senden',
     feedbackHelp: 'Titel, Beschreibung und technischen Kontext mit Appilot teilen. Dabei verlassen Informationen Ihre Organisation.',
+    runtime: 'Ihre Anwendung über diesen Assistenten nutzen',
+    runtimeHelp: 'Die geteilte Seite lesen, mit dem Wissen Ihrer Anwendung antworten und ihre geführten Abläufe in Ihrem eigenen Browser ausführen. Es handelt als Sie, kann also nichts, was Ihr Konto nicht kann, und keine Konfiguration ändern.',
     expired: 'Dieser Anmeldelink ist abgelaufen',
     expiredHelp: 'Starten Sie die Verbindung erneut im ursprünglichen Client. Der Link ist zehn Minuten gültig.',
     invalid: 'Ungültige Anfrage',

package/dist/remote/httpServer.d.ts

@@ -2,6 +2,13 @@
  * The remote Appilot MCP service: Streamable HTTP transport plus the OAuth
  * authorization server that fronts it.
  *
+ * One deployment answers for both servers, on two paths behind one authorization
+ * server. `/mcp` is Appilot Studio, which writes configuration for a developer.
+ * `/mcp/runtime` is Appilot, which operates a configured app for the person
+ * using it. They share the consent flow and nothing else: each path refuses a
+ * grant that was not approved for it, so a runtime connection cannot reach a
+ * Studio tool and a configuration connection cannot reach a runtime tool.
+ *
  * Stateless by construction. Each request builds its own MCP server bound to the
  * caller's own service token, which arrives sealed inside the bearer token and
  * never crosses between callers. Nothing is retained between requests, so a
@@ -12,6 +19,9 @@
 import { type Express } from 'express';
 import type { RemoteConfig } from '../config.js';
 import { AppilotOAuthProvider } from './oauth.js';
+/** Where each server answers. One deployment, two MCP resources, one authorization server. */
+export declare const STUDIO_MCP_PATH = "/mcp";
+export declare const RUNTIME_MCP_PATH = "/mcp/runtime";
 export interface RemoteAppOptions {
     /** Swappable in tests so no real instance is contacted. */
     provider?: AppilotOAuthProvider;

package/dist/remote/httpServer.js

@@ -2,6 +2,13 @@
  * The remote Appilot MCP service: Streamable HTTP transport plus the OAuth
  * authorization server that fronts it.
  *
+ * One deployment answers for both servers, on two paths behind one authorization
+ * server. `/mcp` is Appilot Studio, which writes configuration for a developer.
+ * `/mcp/runtime` is Appilot, which operates a configured app for the person
+ * using it. They share the consent flow and nothing else: each path refuses a
+ * grant that was not approved for it, so a runtime connection cannot reach a
+ * Studio tool and a configuration connection cannot reach a runtime tool.
+ *
  * Stateless by construction. Each request builds its own MCP server bound to the
  * caller's own service token, which arrives sealed inside the bearer token and
  * never crosses between callers. Nothing is retained between requests, so a
@@ -11,16 +18,20 @@
  */
 import express from 'express';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
-import { mcpAuthRouter, getOAuthProtectedResourceMetadataUrl } from '@modelcontextprotocol/sdk/server/auth/router.js';
+import { mcpAuthRouter, mcpAuthMetadataRouter, createOAuthMetadata, getOAuthProtectedResourceMetadataUrl, } from '@modelcontextprotocol/sdk/server/auth/router.js';
 import { requireBearerAuth } from '@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js';
 import { createAppilotServer } from '../server.js';
+import { createAppilotRuntimeServer, RUNTIME_SCOPE, RUNTIME_SCOPE_HELP } from '../userServer.js';
 import { consentLocale } from './consentMessages.js';
 import { renderErrorPage } from './consent.js';
-import { AppilotOAuthProvider, SUPPORTED_SCOPES } from './oauth.js';
+import { AppilotOAuthProvider, SERVICE_TOKEN_SCOPES, SUPPORTED_SCOPES } from './oauth.js';
 /** Where the docs root lands a person who follows the OAuth metadata. */
 const CONFIGURE_WITH_AI_PATH = '/docs/developers/configure-with-ai/overview';
 /** Body cap for a JSON-RPC request. A ConfigBundle import is the large one. */
 const MAX_BODY = '32mb';
+/** Where each server answers. One deployment, two MCP resources, one authorization server. */
+export const STUDIO_MCP_PATH = '/mcp';
+export const RUNTIME_MCP_PATH = '/mcp/runtime';
 export function createRemoteApp(config, options = {}) {
     const provider = options.provider ??
         new AppilotOAuthProvider({
@@ -30,7 +41,8 @@ export function createRemoteApp(config, options = {}) {
             handoffSecret: config.handoffSecret,
             secret: config.secret,
         });
-    const mcpUrl = new URL('/mcp', config.publicUrl);
+    const mcpUrl = new URL(STUDIO_MCP_PATH, config.publicUrl);
+    const runtimeMcpUrl = new URL(RUNTIME_MCP_PATH, config.publicUrl);
     const app = express();
     app.disable('x-powered-by');
     app.use(['/authorize', '/consent', '/connect/callback'], (_req, res, next) => {
@@ -49,6 +61,26 @@ export function createRemoteApp(config, options = {}) {
     app.get(['/health', '/healthz'], (_req, res) => {
         res.json({ status: 'ok', transport: 'http', instance: config.baseUrl });
     });
+    // The runtime resource's own metadata, mounted first.
+    //
+    // RFC 9728 puts a resource's metadata at a path-specific well-known URL, and
+    // the SDK mounts each one with a prefix match. `/…/mcp` therefore also matches
+    // `/…/mcp/runtime`, so the more specific resource has to be registered ahead
+    // of the more general one or a runtime client discovers the Studio resource
+    // and asks for the wrong scope.
+    app.use(mcpAuthMetadataRouter({
+        oauthMetadata: createOAuthMetadata({
+            provider,
+            issuerUrl: config.publicUrl,
+            baseUrl: config.publicUrl,
+            scopesSupported: [...SUPPORTED_SCOPES],
+            serviceDocumentationUrl: new URL(CONFIGURE_WITH_AI_PATH, config.docsUrl),
+        }),
+        resourceServerUrl: runtimeMcpUrl,
+        resourceName: 'Appilot',
+        scopesSupported: [RUNTIME_SCOPE],
+        serviceDocumentationUrl: new URL(CONFIGURE_WITH_AI_PATH, config.docsUrl),
+    }));
     // /.well-known/oauth-authorization-server, /authorize, /token, /register.
     // Must be mounted at the application root.
     app.use(mcpAuthRouter({
@@ -88,43 +120,95 @@ export function createRemoteApp(config, options = {}) {
         verifier: provider,
         resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(mcpUrl),
     });
-    app.post('/mcp', requireAuth, express.json({ limit: MAX_BODY }), async (req, res) => {
-        const auth = req.auth;
-        const extra = (auth?.extra ?? {});
-        // One server and one transport per request. The connection profile is the
-        // caller's own: the deployment's fixed instance URL, their service token,
-        // and the scopes the person actually approved, which the tool surface
-        // enforces so the consent screen describes a real limit.
-        const server = createAppilotServer({
-            baseUrl: config.baseUrl,
-            token: extra.pat,
-            defaultAppId: extra.appId,
-            transport: 'http',
-            grantedScopes: auth?.scopes ?? [],
-        });
-        const transport = new StreamableHTTPServerTransport({
-            sessionIdGenerator: undefined,
-            enableDnsRebindingProtection: true,
-            allowedHosts: config.allowedHosts,
-        });
-        res.on('close', () => {
-            void transport.close();
-            void server.close();
-        });
-        try {
-            await server.connect(transport);
-            await transport.handleRequest(req, res, req.body);
-        }
-        catch (err) {
-            if (!res.headersSent) {
-                res.status(500).json({
+    const requireRuntimeAuth = requireBearerAuth({
+        verifier: provider,
+        resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(runtimeMcpUrl),
+    });
+    /**
+     * Keep the two servers apart at the door.
+     *
+     * The tools enforce their own scopes one layer in, and that is not enough on
+     * its own: several Studio tools are pure and need no scope, so a runtime-only
+     * grant could still reach them if the endpoint let it through. The endpoint
+     * therefore decides first. Studio needs at least one configuration scope,
+     * Appilot needs `runtime:use`, and a grant approved for both reaches both,
+     * which is what approving both means.
+     */
+    function wrongServer(scopes, wanted) {
+        const granted = scopes ?? [];
+        const reaches = wanted === 'runtime'
+            ? granted.includes(RUNTIME_SCOPE)
+            : granted.some(scope => SERVICE_TOKEN_SCOPES.includes(scope));
+        if (reaches)
+            return null;
+        const held = granted.length ? granted.join(', ') : 'no scopes';
+        return wanted === 'runtime'
+            ? `This connection was approved for ${held}, which does not include ${RUNTIME_SCOPE}, so it reaches Appilot Studio at ${STUDIO_MCP_PATH} and not the Appilot connector. ${RUNTIME_SCOPE_HELP}`
+            : `This connection was approved for ${held}, which carries no configuration scope, so it reaches the Appilot connector at ${RUNTIME_MCP_PATH} and not Appilot Studio. Studio is a separate connection: add it in your assistant and approve it with a service token that carries config:read or config:write, which an organization administrator mints in the Backoffice under Service tokens.`;
+    }
+    function mcpEndpoint(surface) {
+        return async (req, res) => {
+            const auth = req.auth;
+            const extra = (auth?.extra ?? {});
+            const refusal = wrongServer(auth?.scopes, surface);
+            if (refusal) {
+                res.status(403).json({
                     jsonrpc: '2.0',
-                    error: { code: -32603, message: err instanceof Error ? err.message : 'Internal error' },
+                    error: { code: -32001, message: refusal },
                     id: null,
                 });
+                return;
             }
-        }
-    });
+            // One server and one transport per request. The connection profile is the
+            // caller's own: the deployment's fixed instance URL, the credential the
+            // approval sealed, and the scopes the person actually approved, which the
+            // tool surface enforces so the consent screen describes a real limit.
+            //
+            // The sealed credential is a service token for Studio and the person's
+            // own Appilot session for the connector. It is read here, never echoed,
+            // and the two never reach the same server.
+            const server = surface === 'runtime'
+                ? createAppilotRuntimeServer({
+                    baseUrl: config.baseUrl,
+                    sessionToken: extra.pat,
+                    transport: 'http',
+                    grantedScopes: auth?.scopes ?? [],
+                })
+                : createAppilotServer({
+                    baseUrl: config.baseUrl,
+                    token: extra.pat,
+                    defaultAppId: extra.appId,
+                    transport: 'http',
+                    grantedScopes: auth?.scopes ?? [],
+                });
+            const transport = new StreamableHTTPServerTransport({
+                sessionIdGenerator: undefined,
+                enableDnsRebindingProtection: true,
+                allowedHosts: config.allowedHosts,
+            });
+            res.on('close', () => {
+                void transport.close();
+                void server.close();
+            });
+            try {
+                await server.connect(transport);
+                await transport.handleRequest(req, res, req.body);
+            }
+            catch (err) {
+                if (!res.headersSent) {
+                    res.status(500).json({
+                        jsonrpc: '2.0',
+                        error: { code: -32603, message: err instanceof Error ? err.message : 'Internal error' },
+                        id: null,
+                    });
+                }
+            }
+        };
+    }
+    // The runtime path is registered first: express matches in order, and `/mcp`
+    // is a prefix of it in every other place this file touches.
+    app.post(RUNTIME_MCP_PATH, requireRuntimeAuth, express.json({ limit: MAX_BODY }), mcpEndpoint('runtime'));
+    app.post(STUDIO_MCP_PATH, requireAuth, express.json({ limit: MAX_BODY }), mcpEndpoint('studio'));
     // Stateless: there is no stream to resume and no session to delete.
     const methodNotAllowed = (_req, res) => {
         res.status(405).set('Allow', 'POST').json({
@@ -133,8 +217,10 @@ export function createRemoteApp(config, options = {}) {
             id: null,
         });
     };
-    app.get('/mcp', methodNotAllowed);
-    app.delete('/mcp', methodNotAllowed);
+    for (const path of [STUDIO_MCP_PATH, RUNTIME_MCP_PATH]) {
+        app.get(path, methodNotAllowed);
+        app.delete(path, methodNotAllowed);
+    }
     return app;
 }
 export function startRemote(config) {

package/dist/remote/oauth.d.ts

@@ -34,8 +34,17 @@ import { type ConsentLocale } from './consentMessages.js';
  * `feedback:write` is the one scope that governs sending data OUT of the
  * tenant, which is why it is separate from the config scopes rather than folded
  * into them.
+ *
+ * `runtime:use` is the odd one and it is the reason this list is not simply the
+ * service-token scopes. It authorizes the Appilot connector, which holds a
+ * person's own session and operates their app through the page they are looking
+ * at. It grants nothing over configuration, and the four config scopes grant
+ * nothing over the runtime surface: the two servers sit on separate paths, each
+ * refusing a grant that was not approved for it (see `remote/httpServer.ts`).
  */
-export declare const SUPPORTED_SCOPES: readonly ["config:read", "config:write", "provision:write", "feedback:write"];
+export declare const SUPPORTED_SCOPES: readonly ["config:read", "config:write", "provision:write", "feedback:write", "runtime:use"];
+/** The scopes a service token can carry. `runtime:use` is not one of them. */
+export declare const SERVICE_TOKEN_SCOPES: readonly string[];
 /** What the instance says a credential reaches. Absent on instances without /config/whoami. */
 export interface TokenIdentity {
     organizationName?: string | null;

package/dist/remote/oauth.js

@@ -35,12 +35,27 @@ import { renderConsentPage, renderConfirmPage, renderErrorPage } from './consent
  * `feedback:write` is the one scope that governs sending data OUT of the
  * tenant, which is why it is separate from the config scopes rather than folded
  * into them.
+ *
+ * `runtime:use` is the odd one and it is the reason this list is not simply the
+ * service-token scopes. It authorizes the Appilot connector, which holds a
+ * person's own session and operates their app through the page they are looking
+ * at. It grants nothing over configuration, and the four config scopes grant
+ * nothing over the runtime surface: the two servers sit on separate paths, each
+ * refusing a grant that was not approved for it (see `remote/httpServer.ts`).
  */
 export const SUPPORTED_SCOPES = [
     'config:read',
     'config:write',
     'provision:write',
     'feedback:write',
+    'runtime:use',
+];
+/** The scopes a service token can carry. `runtime:use` is not one of them. */
+export const SERVICE_TOKEN_SCOPES = [
+    'config:read',
+    'config:write',
+    'provision:write',
+    'feedback:write',
 ];
 /**
  * What to ask for when the client asks for nothing.
@@ -112,8 +127,11 @@ async function defaultVerifyServiceToken(baseUrl, pat) {
     if (res.status === 401 || res.status === 403)
         return null;
     if (res.status === 404) {
-        // Instance predates the self-check. Accept the token on shape alone.
-        return { organizationId: null, appId: null, scopes: [...SUPPORTED_SCOPES] };
+        // Instance predates the self-check. Accept the token on shape alone, and
+        // only for what a service token can ever carry: `runtime:use` names a
+        // person's session, so an instance that cannot answer must not be read as
+        // having said yes to it.
+        return { organizationId: null, appId: null, scopes: [...SERVICE_TOKEN_SCOPES] };
     }
     if (!res.ok) {
         throw new ServerError(`The Appilot instance answered ${res.status} while verifying the service token.`);