mcp-coordinator 0.6.0 → 0.7.0

package/dist/src/tools/agents-tools.js

@@ -3,44 +3,68 @@ import { z } from "zod";
  * S1: agent registry MCP tools (4 tools).
  * register_agent, list_agents, heartbeat, agent_activity.
  */
-export function registerAgentTools(server, services, mcpLog) {
+export function registerAgentTools(server, services, mcpLog, getSessionClaims) {
     const { registry, activityTracker, sseEmitter, mqttBridge } = services;
     server.tool("register_agent", "Register agent as online with module list", {
         agent_id: z.string(),
         name: z.string(),
         modules: z.array(z.string()),
-    }, async ({ agent_id, name, modules }) => {
+    }, async ({ agent_id, name, modules }, extra) => {
+        const sessionId = extra.sessionId;
+        if (!sessionId)
+            throw new Error("MCP tool requires a session");
+        const claims = getSessionClaims(sessionId);
+        if (!claims)
+            throw new Error("Session has no captured claims (auth bug)");
         mcpLog.info({ tool: "register_agent", agent_id, name, module_count: modules.length }, "Tool called");
-        const agent = registry.register(agent_id, name, modules);
-        sseEmitter.emit("agent_online", { agent_id, name, modules });
+        const agent = registry.register(claims.org, agent_id, name, modules);
+        sseEmitter.emit("agent_online", { agent_id, name, modules }, { org_id: claims.org });
         mqttBridge.registerAgent(agent_id, name);
         return { content: [{ type: "text", text: JSON.stringify(agent) }] };
     });
     server.tool("list_agents", "List registered agents", {
         online_only: z.boolean().optional(),
-    }, async ({ online_only }) => {
-        const agents = online_only ? registry.listOnline() : registry.listAll();
+    }, async ({ online_only }, extra) => {
+        const sessionId = extra.sessionId;
+        if (!sessionId)
+            throw new Error("MCP tool requires a session");
+        const claims = getSessionClaims(sessionId);
+        if (!claims)
+            throw new Error("Session has no captured claims (auth bug)");
+        const agents = online_only ? registry.listOnline(claims.org) : registry.listAll(claims.org);
         return { content: [{ type: "text", text: JSON.stringify(agents) }] };
     });
     server.tool("heartbeat", "Update agent activity status and last seen timestamp", {
         agent_id: z.string(),
         current_file: z.string().optional(),
         current_thread: z.string().optional(),
-    }, async ({ agent_id, current_file, current_thread }) => {
-        registry.heartbeat(agent_id);
+    }, async ({ agent_id, current_file, current_thread }, extra) => {
+        const sessionId = extra.sessionId;
+        if (!sessionId)
+            throw new Error("MCP tool requires a session");
+        const claims = getSessionClaims(sessionId);
+        if (!claims)
+            throw new Error("Session has no captured claims (auth bug)");
+        registry.heartbeat(claims.org, agent_id);
         activityTracker.heartbeat(agent_id, {
             currentFile: current_file || null,
             currentThread: current_thread || null,
         });
-        const activity = activityTracker.getActivity(agent_id);
+        const activity = activityTracker.getActivity(claims.org, agent_id);
         sseEmitter.emit("agent_activity", {
             agent_id, activity_status: activity.activity_status,
             current_file: activity.current_file, current_thread: activity.current_thread,
-        });
+        }, { org_id: claims.org });
         return { content: [{ type: "text", text: JSON.stringify(activity) }] };
     });
-    server.tool("agent_activity", "Get activity status for all online agents", {}, async () => {
-        const activities = activityTracker.listAll({ idleAfterMinutes: 5 });
+    server.tool("agent_activity", "Get activity status for all online agents", {}, async (_args, extra) => {
+        const sessionId = extra.sessionId;
+        if (!sessionId)
+            throw new Error("MCP tool requires a session");
+        const claims = getSessionClaims(sessionId);
+        if (!claims)
+            throw new Error("Session has no captured claims (auth bug)");
+        const activities = activityTracker.listAll(claims.org, { idleAfterMinutes: 5 });
         return { content: [{ type: "text", text: JSON.stringify(activities) }] };
     });
 }

package/dist/src/tools/consultation-tools.d.ts

@@ -1,6 +1,7 @@
 import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import type { CoordinatorServices } from "../server-setup.js";
 import type { Logger } from "../logger.js";
+import type { AuthClaims } from "../auth.js";
 /**
  * S1 fix (partial): consultation domain tools extracted from server-setup.ts.
  *
@@ -18,4 +19,4 @@ import type { Logger } from "../logger.js";
  * straightforward following this pattern but kept out of this PR to minimize
  * the diff for reviewers.
  */
-export declare function registerConsultationTools(server: McpServer, services: CoordinatorServices, mcpLog: Logger): void;
+export declare function registerConsultationTools(server: McpServer, services: CoordinatorServices, mcpLog: Logger, getSessionClaims: (sessionId: string) => AuthClaims | null): void;

package/dist/src/tools/consultation-tools.js

@@ -18,24 +18,30 @@ import { runCommonAnnounceFlow } from "../announce-workflow.js";
  * straightforward following this pattern but kept out of this PR to minimize
  * the diff for reviewers.
  */
-export function registerConsultationTools(server, services, mcpLog) {
+export function registerConsultationTools(server, services, mcpLog, getSessionClaims) {
     const { registry, consultation, conflictDetector, contextProvider, sseEmitter, mqttBridge } = services;
     server.tool("announce_work", "Open a consultation thread before starting work", {
         agent_id: z.string(),
         subject: z.string(),
         plan: z.string().optional(),
         target_modules: z.array(z.string()),
-        target_files: z.array(z.string()),
-        depends_on_files: z.array(z.string()).optional(),
-        exports_affected: z.array(z.string()).optional(),
+        target_files: z.array(z.string()).describe("Repo-relative file paths (forward-slash, e.g. 'src/foo.ts'). Absolute paths are not accepted in team-mode."),
+        depends_on_files: z.array(z.string()).optional().describe("Repo-relative file paths your work depends on."),
+        exports_affected: z.array(z.string()).optional().describe("Repo-relative file paths whose exports your work modifies."),
         keep_open: z.boolean().optional().describe("Keep thread open even if no agents are concerned (for manual coordination like games or debates)"),
         assigned_to: z.string().optional().describe("Directed-dispatch: only this agent_id will be allowed to claim the thread. Use for lead→worker handoffs in maitre/chaine/relais presets. Implies keep_open=true."),
         target_symbols: z.array(z.string().max(256)).max(200).optional()
             .describe("Qualified symbol names you intend to touch (e.g. 'UserService.getById'). Used by Layer 0.5 to annotate same-file overlaps."),
-    }, async ({ agent_id, subject, plan, target_modules, target_files, depends_on_files, exports_affected, keep_open, assigned_to, target_symbols }) => {
+    }, async ({ agent_id, subject, plan, target_modules, target_files, depends_on_files, exports_affected, keep_open, assigned_to, target_symbols }, extra) => {
+        const sessionId = extra.sessionId;
+        if (!sessionId)
+            throw new Error("MCP tool requires a session");
+        const claims = getSessionClaims(sessionId);
+        if (!claims)
+            throw new Error("Session has no captured claims (auth bug)");
         mcpLog.info({ tool: "announce_work", agent_id, subject, target_modules, target_files, assigned_to }, "Tool called");
-        const conflicts = conflictDetector.detect({ agent_id, target_modules, target_files });
-        const thread = consultation.announceWork({
+        const conflicts = conflictDetector.detect({ org_id: claims.org, agent_id, target_modules, target_files });
+        const thread = consultation.announceWork(claims.org, {
             agent_id, subject, plan, target_modules, target_files, depends_on_files, exports_affected, keep_open, assigned_to,
         });
         if (conflicts.length > 0) {
@@ -43,7 +49,7 @@ export function registerConsultationTools(server, services, mcpLog) {
                 .run(JSON.stringify(conflicts), thread.id);
         }
         const { updated, categorized, respondents, planQuality } = runCommonAnnounceFlow(services, thread.id, {
-            agent_id, subject, plan, target_modules, target_files, depends_on_files, exports_affected, keep_open, target_symbols,
+            org_id: claims.org, agent_id, subject, plan, target_modules, target_files, depends_on_files, exports_affected, keep_open, target_symbols,
         });
         sseEmitter.emit("thread_opened", {
             thread_id: thread.id, initiator: agent_id, subject, target_modules, conflicts,
@@ -51,9 +57,9 @@ export function registerConsultationTools(server, services, mcpLog) {
             mode: planQuality.mode,
             plan: plan || null,
             plan_quality: planQuality,
-        });
+        }, { org_id: claims.org });
         mqttBridge.publishConsultation(thread.id, agent_id, subject, target_modules);
-        const contextForInitiator = respondents.map((rid) => contextProvider.getRelevantContext(rid, { thread_id: updated.id, subject, target_modules, target_files })).filter((ctx) => ctx.modules.length > 0);
+        const contextForInitiator = respondents.map((rid) => contextProvider.getRelevantContext(claims.org, rid, { thread_id: updated.id, subject, target_modules, target_files })).filter((ctx) => ctx.modules.length > 0);
         return {
             content: [{
                     type: "text",
@@ -69,17 +75,23 @@ export function registerConsultationTools(server, services, mcpLog) {
         content: z.string(),
         context_snapshot: z.string().optional(),
         in_reply_to: z.string().optional(),
-    }, async ({ thread_id, agent_id, agent_name, type, content, context_snapshot, in_reply_to }) => {
+    }, async ({ thread_id, agent_id, agent_name, type, content, context_snapshot, in_reply_to }, extra) => {
+        const sessionId = extra.sessionId;
+        if (!sessionId)
+            throw new Error("MCP tool requires a session");
+        const claims = getSessionClaims(sessionId);
+        if (!claims)
+            throw new Error("Session has no captured claims (auth bug)");
         mcpLog.info({ tool: "post_to_thread", thread_id, agent_id, type }, "Tool called");
-        const msg = consultation.postToThread({
+        const msg = consultation.postToThread(claims.org, {
             thread_id, agent_id, agent_name, type, content, context_snapshot, in_reply_to,
         });
-        const thread = consultation.getThread(thread_id);
+        const thread = consultation.getThread(claims.org, thread_id);
         sseEmitter.emit("message_posted", {
             thread_id, agent_id, agent_name: agent_name || agent_id,
             type, content, round: thread?.round || 1,
             token_estimate: msg.token_estimate || 0,
-        });
+        }, { org_id: claims.org });
         mqttBridge.publishMessage(thread_id, agent_id, type, content);
         return { content: [{ type: "text", text: JSON.stringify(msg) }] };
     });
@@ -88,65 +100,107 @@ export function registerConsultationTools(server, services, mcpLog) {
         agent_id: z.string(),
         summary: z.string(),
         plan: z.string().optional(),
-    }, async ({ thread_id, agent_id, summary }) => {
+    }, async ({ thread_id, agent_id, summary }, extra) => {
+        const sessionId = extra.sessionId;
+        if (!sessionId)
+            throw new Error("MCP tool requires a session");
+        const claims = getSessionClaims(sessionId);
+        if (!claims)
+            throw new Error("Session has no captured claims (auth bug)");
         mcpLog.info({ tool: "propose_resolution", thread_id, agent_id }, "Tool called");
-        consultation.proposeResolution(thread_id, agent_id, summary);
-        sseEmitter.emit("resolution_proposed", { thread_id, agent_id, summary });
+        consultation.proposeResolution(claims.org, thread_id, agent_id, summary);
+        sseEmitter.emit("resolution_proposed", { thread_id, agent_id, summary }, { org_id: claims.org });
         mqttBridge.publishResolution(thread_id, "resolving", summary);
-        const thread = consultation.getThread(thread_id);
+        const thread = consultation.getThread(claims.org, thread_id);
         return { content: [{ type: "text", text: JSON.stringify(thread) }] };
     });
     server.tool("approve_resolution", "Approve the proposed resolution", {
         thread_id: z.string(),
         agent_id: z.string(),
-    }, async ({ thread_id, agent_id }) => {
+    }, async ({ thread_id, agent_id }, extra) => {
+        const sessionId = extra.sessionId;
+        if (!sessionId)
+            throw new Error("MCP tool requires a session");
+        const claims = getSessionClaims(sessionId);
+        if (!claims)
+            throw new Error("Session has no captured claims (auth bug)");
         mcpLog.info({ tool: "approve_resolution", thread_id, agent_id }, "Tool called");
-        const agentInfo = registry.get(agent_id);
-        consultation.approveResolution(thread_id, agent_id, agentInfo?.name);
-        const thread = consultation.getThread(thread_id);
+        const agentInfo = registry.get(claims.org, agent_id);
+        consultation.approveResolution(claims.org, thread_id, agent_id, agentInfo?.name ?? undefined);
+        const thread = consultation.getThread(claims.org, thread_id);
         return { content: [{ type: "text", text: JSON.stringify(thread) }] };
     });
     server.tool("contest_resolution", "Contest the proposed resolution", {
         thread_id: z.string(),
         agent_id: z.string(),
         reason: z.string(),
-    }, async ({ thread_id, agent_id, reason }) => {
+    }, async ({ thread_id, agent_id, reason }, extra) => {
+        const sessionId = extra.sessionId;
+        if (!sessionId)
+            throw new Error("MCP tool requires a session");
+        const claims = getSessionClaims(sessionId);
+        if (!claims)
+            throw new Error("Session has no captured claims (auth bug)");
         mcpLog.info({ tool: "contest_resolution", thread_id, agent_id }, "Tool called");
-        consultation.contestResolution(thread_id, agent_id, reason);
-        const thread = consultation.getThread(thread_id);
+        consultation.contestResolution(claims.org, thread_id, agent_id, reason);
+        const thread = consultation.getThread(claims.org, thread_id);
         return { content: [{ type: "text", text: JSON.stringify(thread) }] };
     });
     server.tool("close_thread", "Close a consultation thread", {
         thread_id: z.string(),
         agent_id: z.string(),
         summary: z.string(),
-    }, async ({ thread_id, agent_id, summary }) => {
+    }, async ({ thread_id, agent_id, summary }, extra) => {
+        const sessionId = extra.sessionId;
+        if (!sessionId)
+            throw new Error("MCP tool requires a session");
+        const claims = getSessionClaims(sessionId);
+        if (!claims)
+            throw new Error("Session has no captured claims (auth bug)");
         mcpLog.info({ tool: "close_thread", thread_id, agent_id }, "Tool called");
-        consultation.closeThread(thread_id, agent_id, summary);
+        consultation.closeThread(claims.org, thread_id, agent_id, summary);
         return { content: [{ type: "text", text: "closed" }] };
     });
     server.tool("cancel_thread", "Cancel a consultation thread", {
         thread_id: z.string(),
         agent_id: z.string(),
         reason: z.string().optional(),
-    }, async ({ thread_id, agent_id, reason }) => {
+    }, async ({ thread_id, agent_id, reason }, extra) => {
+        const sessionId = extra.sessionId;
+        if (!sessionId)
+            throw new Error("MCP tool requires a session");
+        const claims = getSessionClaims(sessionId);
+        if (!claims)
+            throw new Error("Session has no captured claims (auth bug)");
         mcpLog.info({ tool: "cancel_thread", thread_id, agent_id }, "Tool called");
-        consultation.cancelThread(thread_id, agent_id, reason);
-        sseEmitter.emit("thread_cancelled", { thread_id, reason });
+        consultation.cancelThread(claims.org, thread_id, agent_id, reason ?? undefined);
+        sseEmitter.emit("thread_cancelled", { thread_id, reason }, { org_id: claims.org });
         return { content: [{ type: "text", text: "cancelled" }] };
     });
     server.tool("get_thread", "Get a thread with all messages", {
         thread_id: z.string(),
-    }, async ({ thread_id }) => {
-        const result = consultation.getThreadWithMessages(thread_id);
+    }, async ({ thread_id }, extra) => {
+        const sessionId = extra.sessionId;
+        if (!sessionId)
+            throw new Error("MCP tool requires a session");
+        const claims = getSessionClaims(sessionId);
+        if (!claims)
+            throw new Error("Session has no captured claims (auth bug)");
+        const result = consultation.getThreadWithMessages(claims.org, thread_id);
         mcpLog.debug({ tool: "get_thread", thread_id, message_count: result?.messages.length }, "Tool called");
         return { content: [{ type: "text", text: JSON.stringify(result) }] };
     });
     server.tool("get_thread_updates", "Get new messages since timestamp", {
         agent_id: z.string(),
         since: z.string().optional(),
-    }, async ({ agent_id, since }) => {
-        const updates = consultation.getThreadUpdates(agent_id, since);
+    }, async ({ agent_id, since }, extra) => {
+        const sessionId = extra.sessionId;
+        if (!sessionId)
+            throw new Error("MCP tool requires a session");
+        const claims = getSessionClaims(sessionId);
+        if (!claims)
+            throw new Error("Session has no captured claims (auth bug)");
+        const updates = consultation.getThreadUpdates(claims.org, agent_id, since ?? undefined);
         return { content: [{ type: "text", text: JSON.stringify(updates) }] };
     });
     server.tool("list_threads", "List consultation threads", {
@@ -154,19 +208,31 @@ export function registerConsultationTools(server, services, mcpLog) {
         agent_id: z.string().optional(),
         module: z.string().optional(),
         assigned_to_me: z.string().optional().describe("Filter to threads claimable by this agent_id: open pool (assigned_to NULL) OR directed to me. Use for worker agents receiving directed dispatches."),
-    }, async ({ status, agent_id, module, assigned_to_me }) => {
-        const threads = consultation.listThreads({ status, agent_id, module, assigned_to_me });
+    }, async ({ status, agent_id, module, assigned_to_me }, extra) => {
+        const sessionId = extra.sessionId;
+        if (!sessionId)
+            throw new Error("MCP tool requires a session");
+        const claims = getSessionClaims(sessionId);
+        if (!claims)
+            throw new Error("Session has no captured claims (auth bug)");
+        const threads = consultation.listThreads(claims.org, { status, agent_id, module, assigned_to_me });
         mcpLog.debug({ tool: "list_threads", status, agent_id, module, assigned_to_me, result_count: threads.length }, "Tool called");
         return { content: [{ type: "text", text: JSON.stringify(threads) }] };
     });
     server.tool("log_action_summary", "Log a one-liner summary of an action", {
         session_id: z.string(),
         agent_id: z.string(),
-        file_path: z.string().optional(),
+        file_path: z.string().optional().describe("Repo-relative file path."),
         summary: z.string(),
-    }, async ({ session_id, agent_id, file_path, summary }) => {
-        const result = consultation.logActionSummary({ session_id, agent_id, file_path, summary });
-        sseEmitter.emit("action_summary", { agent_id, file_path, summary });
+    }, async ({ session_id, agent_id, file_path, summary }, extra) => {
+        const sessionId = extra.sessionId;
+        if (!sessionId)
+            throw new Error("MCP tool requires a session");
+        const claims = getSessionClaims(sessionId);
+        if (!claims)
+            throw new Error("Session has no captured claims (auth bug)");
+        const result = consultation.logActionSummary(claims.org, { session_id, agent_id, file_path, summary });
+        sseEmitter.emit("action_summary", { agent_id, file_path, summary }, { org_id: claims.org });
         return { content: [{ type: "text", text: JSON.stringify(result) }] };
     });
 }

package/dist/src/tools/dependencies-tools.d.ts

@@ -1,8 +1,9 @@
 import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import type { CoordinatorServices } from "../server-setup.js";
 import type { Logger } from "../logger.js";
+import type { AuthClaims } from "../auth.js";
 /**
  * S1: dependency map MCP tools (3 tools).
  * set_dependency_map, get_blast_radius, get_module_info.
  */
-export declare function registerDependenciesTools(server: McpServer, services: CoordinatorServices, _mcpLog: Logger): void;
+export declare function registerDependenciesTools(server: McpServer, services: CoordinatorServices, _mcpLog: Logger, getSessionClaims: (sessionId: string) => AuthClaims | null): void;

package/dist/src/tools/dependencies-tools.js

@@ -3,25 +3,43 @@ import { z } from "zod";
  * S1: dependency map MCP tools (3 tools).
  * set_dependency_map, get_blast_radius, get_module_info.
  */
-export function registerDependenciesTools(server, services, _mcpLog) {
+export function registerDependenciesTools(server, services, _mcpLog, getSessionClaims) {
     const { depMap } = services;
     server.tool("set_dependency_map", "Load module dependency graph", {
         modules: z.string(), // JSON DependencyMap
-    }, async ({ modules }) => {
+    }, async ({ modules }, extra) => {
+        const sessionId = extra.sessionId;
+        if (!sessionId)
+            throw new Error("MCP tool requires a session");
+        const claims = getSessionClaims(sessionId);
+        if (!claims)
+            throw new Error("Session has no captured claims (auth bug)");
         const map = JSON.parse(modules);
-        depMap.setMap(map);
+        depMap.setMap(claims.org, map);
         return { content: [{ type: "text", text: "ok" }] };
     });
     server.tool("get_blast_radius", "Calculate impact of changes to a module", {
         module_id: z.string(),
-    }, async ({ module_id }) => {
-        const radius = depMap.getBlastRadius(module_id);
+    }, async ({ module_id }, extra) => {
+        const sessionId = extra.sessionId;
+        if (!sessionId)
+            throw new Error("MCP tool requires a session");
+        const claims = getSessionClaims(sessionId);
+        if (!claims)
+            throw new Error("Session has no captured claims (auth bug)");
+        const radius = depMap.getBlastRadius(claims.org, module_id);
         return { content: [{ type: "text", text: JSON.stringify(radius) }] };
     });
     server.tool("get_module_info", "Get module dependency info", {
         module_id: z.string(),
-    }, async ({ module_id }) => {
-        const info = depMap.getModuleInfo(module_id);
+    }, async ({ module_id }, extra) => {
+        const sessionId = extra.sessionId;
+        if (!sessionId)
+            throw new Error("MCP tool requires a session");
+        const claims = getSessionClaims(sessionId);
+        if (!claims)
+            throw new Error("Session has no captured claims (auth bug)");
+        const info = depMap.getModuleInfo(claims.org, module_id);
         return { content: [{ type: "text", text: JSON.stringify(info) }] };
     });
 }

package/dist/src/tools/files-tools.d.ts

@@ -1,8 +1,9 @@
 import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import type { CoordinatorServices } from "../server-setup.js";
 import type { Logger } from "../logger.js";
+import type { AuthClaims } from "../auth.js";
 /**
  * S1: file tracking MCP tools (3 tools).
  * hot_files, get_session_files, check_file_conflict.
  */
-export declare function registerFilesTools(server: McpServer, services: CoordinatorServices, _mcpLog: Logger): void;
+export declare function registerFilesTools(server: McpServer, services: CoordinatorServices, _mcpLog: Logger, getSessionClaims: (sessionId: string) => AuthClaims | null): void;

package/dist/src/tools/files-tools.js

@@ -3,26 +3,44 @@ import { z } from "zod";
  * S1: file tracking MCP tools (3 tools).
  * hot_files, get_session_files, check_file_conflict.
  */
-export function registerFilesTools(server, services, _mcpLog) {
+export function registerFilesTools(server, services, _mcpLog, getSessionClaims) {
     const { fileTracker } = services;
     server.tool("hot_files", "List files modified by multiple agents", {
         since_minutes: z.number().optional(),
-    }, async ({ since_minutes }) => {
-        const files = fileTracker.getHotFiles(since_minutes || 30);
+    }, async ({ since_minutes }, extra) => {
+        const sessionId = extra.sessionId;
+        if (!sessionId)
+            throw new Error("MCP tool requires a session");
+        const claims = getSessionClaims(sessionId);
+        if (!claims)
+            throw new Error("Session has no captured claims (auth bug)");
+        const files = fileTracker.getHotFiles(claims.org, since_minutes || 30);
         return { content: [{ type: "text", text: JSON.stringify(files) }] };
     });
     server.tool("get_session_files", "Get files modified in a session", {
         session_id: z.string(),
-    }, async ({ session_id }) => {
-        const files = fileTracker.getBySession(session_id);
+    }, async ({ session_id }, extra) => {
+        const sessionId = extra.sessionId;
+        if (!sessionId)
+            throw new Error("MCP tool requires a session");
+        const claims = getSessionClaims(sessionId);
+        if (!claims)
+            throw new Error("Session has no captured claims (auth bug)");
+        const files = fileTracker.getBySession(claims.org, session_id);
         return { content: [{ type: "text", text: JSON.stringify(files) }] };
     });
     server.tool("check_file_conflict", "Check if another agent is editing a file", {
-        file_path: z.string(),
+        file_path: z.string().describe("Repo-relative file path."),
         agent_id: z.string(),
         within_minutes: z.number().optional(),
-    }, async ({ file_path, agent_id, within_minutes }) => {
-        const result = fileTracker.checkFileConflict(file_path, agent_id, within_minutes || 30);
+    }, async ({ file_path, agent_id, within_minutes }, extra) => {
+        const sessionId = extra.sessionId;
+        if (!sessionId)
+            throw new Error("MCP tool requires a session");
+        const claims = getSessionClaims(sessionId);
+        if (!claims)
+            throw new Error("Session has no captured claims (auth bug)");
+        const result = fileTracker.checkFileConflict(claims.org, file_path, agent_id, within_minutes || 30);
         return { content: [{ type: "text", text: JSON.stringify(result) }] };
     });
 }

package/dist/src/tools/mqtt-tools.d.ts

@@ -1,9 +1,15 @@
 import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import type { CoordinatorServices } from "../server-setup.js";
 import type { Logger } from "../logger.js";
+import type { AuthClaims } from "../auth.js";
 /**
  * S1: MQTT listener MCP tools (3 tools).
  * wait_for_message, get_queued_messages, mqtt_publish.
  * Replaces what used to be a standalone mqtt-mcp-bridge sidecar.
+ *
+ * Note (Task 23.5): the MqttBridge message-queue API is keyed by agent_id,
+ * not by org. MQTT topic scoping and per-org ACLs are deferred to Task 22.
+ * We still require valid session claims here so callers are authenticated,
+ * even though the underlying bridge calls don't yet filter by claims.org.
  */
-export declare function registerMqttTools(server: McpServer, services: CoordinatorServices, _mcpLog: Logger): void;
+export declare function registerMqttTools(server: McpServer, services: CoordinatorServices, _mcpLog: Logger, getSessionClaims: (sessionId: string) => AuthClaims | null): void;

package/dist/src/tools/mqtt-tools.js

@@ -3,13 +3,24 @@ import { z } from "zod";
  * S1: MQTT listener MCP tools (3 tools).
  * wait_for_message, get_queued_messages, mqtt_publish.
  * Replaces what used to be a standalone mqtt-mcp-bridge sidecar.
+ *
+ * Note (Task 23.5): the MqttBridge message-queue API is keyed by agent_id,
+ * not by org. MQTT topic scoping and per-org ACLs are deferred to Task 22.
+ * We still require valid session claims here so callers are authenticated,
+ * even though the underlying bridge calls don't yet filter by claims.org.
  */
-export function registerMqttTools(server, services, _mcpLog) {
+export function registerMqttTools(server, services, _mcpLog, getSessionClaims) {
     const { mqttBridge } = services;
     server.tool("wait_for_message", "Block until an MQTT consultation message arrives or timeout", {
         agent_id: z.string(),
         timeout_seconds: z.number().optional(),
-    }, async ({ agent_id, timeout_seconds }) => {
+    }, async ({ agent_id, timeout_seconds }, extra) => {
+        const sessionId = extra.sessionId;
+        if (!sessionId)
+            throw new Error("MCP tool requires a session");
+        const claims = getSessionClaims(sessionId);
+        if (!claims)
+            throw new Error("Session has no captured claims (auth bug)");
         const timeoutMs = (timeout_seconds || 15) * 1000;
         const msg = await mqttBridge.waitForMessage(agent_id, timeoutMs);
         if (msg) {
@@ -19,14 +30,26 @@ export function registerMqttTools(server, services, _mcpLog) {
     });
     server.tool("get_queued_messages", "Get all queued MQTT messages without blocking", {
         agent_id: z.string(),
-    }, async ({ agent_id }) => {
+    }, async ({ agent_id }, extra) => {
+        const sessionId = extra.sessionId;
+        if (!sessionId)
+            throw new Error("MCP tool requires a session");
+        const claims = getSessionClaims(sessionId);
+        if (!claims)
+            throw new Error("Session has no captured claims (auth bug)");
         const messages = mqttBridge.getQueuedMessages(agent_id);
         return { content: [{ type: "text", text: JSON.stringify(messages) }] };
     });
     server.tool("mqtt_publish", "Publish a message to an MQTT topic", {
         topic: z.string(),
         payload: z.string(),
-    }, async ({ topic, payload }) => {
+    }, async ({ topic, payload }, extra) => {
+        const sessionId = extra.sessionId;
+        if (!sessionId)
+            throw new Error("MCP tool requires a session");
+        const claims = getSessionClaims(sessionId);
+        if (!claims)
+            throw new Error("Session has no captured claims (auth bug)");
         mqttBridge.mqttPublish(topic, payload);
         return { content: [{ type: "text", text: "published" }] };
     });

package/dist/src/tools/status-tools.d.ts

@@ -1,8 +1,14 @@
 import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import type { CoordinatorServices } from "../server-setup.js";
 import type { Logger } from "../logger.js";
+import type { AuthClaims } from "../auth.js";
 /**
  * S1: status + coordination helper MCP tools (2 tools).
  * coordinator_status, wait_for_peers.
+ *
+ * Note (Task 23.5): both tools are org-scoped — coordinator_status reports
+ * agents/threads/files for the caller's org, and wait_for_peers polls the
+ * same org's registry. Neither surfaces system-global (cross-org) data, so
+ * both require valid claims and use claims.org throughout.
  */
-export declare function registerStatusTools(server: McpServer, services: CoordinatorServices, mcpLog: Logger): void;
+export declare function registerStatusTools(server: McpServer, services: CoordinatorServices, mcpLog: Logger, getSessionClaims: (sessionId: string) => AuthClaims | null): void;

package/dist/src/tools/status-tools.js

@@ -2,14 +2,25 @@ import { z } from "zod";
 /**
  * S1: status + coordination helper MCP tools (2 tools).
  * coordinator_status, wait_for_peers.
+ *
+ * Note (Task 23.5): both tools are org-scoped — coordinator_status reports
+ * agents/threads/files for the caller's org, and wait_for_peers polls the
+ * same org's registry. Neither surfaces system-global (cross-org) data, so
+ * both require valid claims and use claims.org throughout.
  */
-export function registerStatusTools(server, services, mcpLog) {
+export function registerStatusTools(server, services, mcpLog, getSessionClaims) {
     const { registry, consultation, fileTracker, mqttBridge } = services;
-    server.tool("coordinator_status", "Full system status", {}, async () => {
-        const online = registry.listOnline();
-        const openThreads = consultation.listThreads({ status: "open" });
-        const resolvingThreads = consultation.listThreads({ status: "resolving" });
-        const hotFiles = fileTracker.getHotFiles(30);
+    server.tool("coordinator_status", "Full system status", {}, async (_args, extra) => {
+        const sessionId = extra.sessionId;
+        if (!sessionId)
+            throw new Error("MCP tool requires a session");
+        const claims = getSessionClaims(sessionId);
+        if (!claims)
+            throw new Error("Session has no captured claims (auth bug)");
+        const online = registry.listOnline(claims.org);
+        const openThreads = consultation.listThreads(claims.org, { status: "open" });
+        const resolvingThreads = consultation.listThreads(claims.org, { status: "resolving" });
+        const hotFiles = fileTracker.getHotFiles(claims.org, 30);
         const status = {
             agents_online: online.length,
             agents: online.map((a) => ({ id: a.id, name: a.name, modules: JSON.parse(a.modules) })),
@@ -25,14 +36,20 @@ export function registerStatusTools(server, services, mcpLog) {
         agent_id: z.string(),
         min_peers: z.number().optional(),
         timeout_seconds: z.number().optional(),
-    }, async ({ agent_id, min_peers, timeout_seconds }) => {
+    }, async ({ agent_id, min_peers, timeout_seconds }, extra) => {
+        const sessionId = extra.sessionId;
+        if (!sessionId)
+            throw new Error("MCP tool requires a session");
+        const claims = getSessionClaims(sessionId);
+        if (!claims)
+            throw new Error("Session has no captured claims (auth bug)");
         const targetPeers = min_peers ?? 1;
         const timeoutMs = (timeout_seconds ?? 30) * 1000;
         const pollIntervalMs = 1000;
         const startedAt = Date.now();
         mcpLog.info({ tool: "wait_for_peers", agent_id, min_peers: targetPeers, timeout_seconds: timeoutMs / 1000 }, "Tool called");
         while (Date.now() - startedAt < timeoutMs) {
-            const peers = registry.listOnline().filter((a) => a.id !== agent_id);
+            const peers = registry.listOnline(claims.org).filter((a) => a.id !== agent_id);
             if (peers.length >= targetPeers) {
                 return {
                     content: [{
@@ -47,7 +64,7 @@ export function registerStatusTools(server, services, mcpLog) {
             }
             await new Promise((r) => setTimeout(r, pollIntervalMs));
         }
-        const finalPeers = registry.listOnline().filter((a) => a.id !== agent_id);
+        const finalPeers = registry.listOnline(claims.org).filter((a) => a.id !== agent_id);
         return {
             content: [{
                     type: "text",