mcp-google-multi 6.0.0-beta.1 → 6.0.0-beta.2

package/dist/metrics-tap.js

@@ -0,0 +1,95 @@
+import { isSchemaValidationText } from './arg-normalize.js';
+const PENDING_CAP = 1_000;
+// The detector lives next to the rewriter that consumes the same frames, so
+// the two can never drift apart. This tap sees the ORIGINAL prose:
+// withValidationEnvelope sits BELOW it and converts that same frame into an
+// envelope for the client, so classification here and the contract on the wire
+// stay independent.
+export { isSchemaValidationText };
+/**
+ * @param isKnownTool membership test against the REGISTERED tool set. The
+ * name on a `tools/call` frame is client-supplied, so a shape check alone
+ * would let a shape-valid but invented name reach disk and break the
+ * closed-vocabulary guarantee. A validation failure against a name the server
+ * never registered is a not-found, and is counted as one.
+ */
+export function tapUsageMetrics(transport, metrics, isKnownTool = () => false) {
+    const pending = new Map();
+    const recordValidation = (tool) => {
+        if (tool !== undefined && isKnownTool(tool))
+            metrics.recordRpc('schema_validation', tool);
+        else
+            metrics.recordRpc('tool_not_found');
+    };
+    const wrapper = {
+        start: () => transport.start(),
+        send: (message, options) => {
+            try {
+                const m = message;
+                // Responses only: a server-initiated REQUEST carries an id from a
+                // different id space, and evicting on it would drop a real pending call.
+                if (m.id !== undefined && message.method === undefined) {
+                    const tool = pending.get(m.id);
+                    pending.delete(m.id);
+                    if (m.error && typeof m.error.code === 'number') {
+                        if (m.error.code === -32602) {
+                            if (/unknown tool|not found/i.test(m.error.message ?? ''))
+                                metrics.recordRpc('tool_not_found');
+                            else
+                                recordValidation(tool);
+                        }
+                        else {
+                            metrics.recordRpc(m.error.code);
+                        }
+                    }
+                    else if (m.result?.isError === true) {
+                        const first = m.result.content?.[0]?.text;
+                        if (typeof first === 'string' && isSchemaValidationText(first)) {
+                            recordValidation(tool);
+                        }
+                    }
+                }
+            }
+            catch { /* the tap may never break the wire */ }
+            return transport.send(message, options);
+        },
+        close: () => transport.close(),
+    };
+    Object.defineProperty(wrapper, 'onmessage', {
+        get: () => transport.onmessage,
+        set: (handler) => {
+            transport.onmessage = handler
+                ? (message, extra) => {
+                    try {
+                        const m = message;
+                        if (m.id !== undefined && m.method === 'tools/call' && typeof m.params?.name === 'string') {
+                            if (pending.size >= PENDING_CAP)
+                                pending.clear();
+                            pending.set(m.id, m.params.name);
+                        }
+                    }
+                    catch { /* never break the wire */ }
+                    handler(message, extra);
+                }
+                : undefined;
+        },
+    });
+    for (const prop of ['onclose', 'onerror']) {
+        Object.defineProperty(wrapper, prop, {
+            get: () => transport[prop],
+            set: (v) => {
+                transport[prop] = v;
+            },
+        });
+    }
+    Object.defineProperty(wrapper, 'sessionId', { get: () => transport.sessionId });
+    if (transport.setProtocolVersion) {
+        wrapper.setProtocolVersion = (v) => transport.setProtocolVersion(v);
+    }
+    // v2-only; see the same forward in arg-normalize.ts. Both proxies compose,
+    // so a member dropped by either layer never reaches the real transport.
+    if (transport.setSupportedProtocolVersions) {
+        wrapper.setSupportedProtocolVersions = (v) => transport.setSupportedProtocolVersions(v);
+    }
+    return wrapper;
+}

package/dist/oauth-consent.d.ts

@@ -1,6 +1,4 @@
 import { OAuth2Client } from 'googleapis-common';
-export declare const LOOPBACK_PORT = 4242;
-export declare const LOOPBACK_REDIRECT = "http://localhost:4242/oauth2callback";
 /** GOOGLE_CLIENT_ID/SECRET absent — caller maps to E_CLIENT_CREDENTIALS_MISSING. */
 export declare class ClientCredentialsMissingError extends Error {
     constructor();
@@ -14,15 +12,32 @@ export declare class ConsentTimeoutError extends Error {
 export declare class ConsentDeniedError extends Error {
     constructor(reason: string);
 }
+export declare const TESTING_MODE_WARNING: string;
 export declare function hasClientCredentials(): boolean;
-/** Build the loopback OAuth2 client from env credentials (throws if unset). */
-export declare function buildConsentClient(): OAuth2Client;
 /**
- * Start the loopback server, await the OAuth redirect, validate the CSRF
- * `state` (RFC 6749 §10.12), and exchange the code. Returns the token set for
- * the caller to persist. Never process.exit's (safe inside a live server) and
- * times out so a stalled consent can't wedge a tool call.
+ * Build the loopback OAuth2 client from env credentials (throws if unset).
+ * `redirect` comes from openLoopbackConsent(): the port is only known once the
+ * listener is bound.
  */
-export declare function awaitLoopbackConsent(client: OAuth2Client, expectedState: string, opts?: {
+export declare function buildConsentClient(redirect: string): OAuth2Client;
+export interface LoopbackConsent {
+    /** `http://localhost:<ephemeral port>/oauth2callback` — build the auth URL from this. */
+    redirect: string;
+    /**
+     * Await the OAuth redirect, validate the CSRF `state` (RFC 6749 §10.12), and
+     * exchange the code. Returns the token set for the caller to persist.
+     */
+    finish(client: OAuth2Client, expectedState: string): Promise<Record<string, unknown>>;
+    /**
+     * Abandon the consent: shuts the listener down WITHOUT settling finish(), so
+     * an abandoned flow can never surface as an unhandled rejection later.
+     */
+    close(): void;
+}
+/**
+ * Bind the loopback listener first (ephemeral port), so the redirect URI is
+ * known before the auth URL is built and the callback can't race the browser.
+ */
+export declare function openLoopbackConsent(opts?: {
     timeoutMs?: number;
-}): Promise<Record<string, unknown>>;
+}): Promise<LoopbackConsent>;

package/dist/oauth-consent.js

@@ -2,13 +2,11 @@ import { OAuth2Client } from 'googleapis-common';
 import http from 'node:http';
 import { URL } from 'node:url';
 // Shared loopback OAuth consent (leg C of cc-auth), used by the account wizard
-// (B7). The `auth --account` CLI keeps its own inline copy for now; this module
-// is the reusable, live-server-safe form (throws typed errors instead of
-// process.exit, and times out so a never-completed consent can't wedge a tool
-// call forever). The redirect matches the CLI exactly so an existing registered
-// Desktop client keeps working.
-export const LOOPBACK_PORT = 4242;
-export const LOOPBACK_REDIRECT = `http://localhost:${LOOPBACK_PORT}/oauth2callback`;
+// (B7) and the `auth --account` CLI. Live-server-safe: typed errors instead of
+// process.exit, and a timeout so a never-completed consent can't wedge a tool
+// call forever. The listener binds an EPHEMERAL loopback port (RFC 8252 §7.3;
+// Google Desktop clients accept any http://localhost:<port> redirect), so a
+// second local process on a fixed port can never break auth.
 /** GOOGLE_CLIENT_ID/SECRET absent — caller maps to E_CLIENT_CREDENTIALS_MISSING. */
 export class ClientCredentialsMissingError extends Error {
     constructor() {
@@ -17,7 +15,7 @@ export class ClientCredentialsMissingError extends Error {
 }
 export class LoopbackPortInUseError extends Error {
     constructor() {
-        super(`E_LOOPBACK_PORT_IN_USE: port ${LOOPBACK_PORT} is already in use; close the other process and retry.`);
+        super('E_LOOPBACK_PORT_IN_USE: the loopback consent listener could not bind a port; retry.');
     }
 }
 export class ConsentTimeoutError extends Error {
@@ -30,80 +28,128 @@ export class ConsentDeniedError extends Error {
         super(`E_CONSENT_DENIED: ${reason}`);
     }
 }
+// Surfaced after every successful consent: the expiry is invisible until the
+// token dies a week later as reauth_required, so the moment of success is the
+// one place the warning is guaranteed to be seen. Full walkthrough in
+// docs/google-cloud-setup.md.
+export const TESTING_MODE_WARNING = 'Heads-up: while your OAuth client\'s Publishing status is "Testing", Google expires refresh tokens after 7 days (weekly re-auth for every account). ' +
+    'When your setup works, set it to "In production" at https://console.cloud.google.com/auth/audience. ' +
+    'No verification review is needed for personal use; see docs/google-cloud-setup.md.';
 export function hasClientCredentials() {
     return Boolean(process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET);
 }
-/** Build the loopback OAuth2 client from env credentials (throws if unset). */
-export function buildConsentClient() {
+/**
+ * Build the loopback OAuth2 client from env credentials (throws if unset).
+ * `redirect` comes from openLoopbackConsent(): the port is only known once the
+ * listener is bound.
+ */
+export function buildConsentClient(redirect) {
     if (!hasClientCredentials())
         throw new ClientCredentialsMissingError();
-    return new OAuth2Client(process.env.GOOGLE_CLIENT_ID, process.env.GOOGLE_CLIENT_SECRET, LOOPBACK_REDIRECT);
+    return new OAuth2Client(process.env.GOOGLE_CLIENT_ID, process.env.GOOGLE_CLIENT_SECRET, redirect);
 }
 /**
- * Start the loopback server, await the OAuth redirect, validate the CSRF
- * `state` (RFC 6749 §10.12), and exchange the code. Returns the token set for
- * the caller to persist. Never process.exit's (safe inside a live server) and
- * times out so a stalled consent can't wedge a tool call.
+ * Bind the loopback listener first (ephemeral port), so the redirect URI is
+ * known before the auth URL is built and the callback can't race the browser.
  */
-export function awaitLoopbackConsent(client, expectedState, opts = {}) {
+export function openLoopbackConsent(opts = {}) {
     const timeoutMs = opts.timeoutMs ?? 5 * 60_000;
-    return new Promise((resolve, reject) => {
+    return new Promise((resolveOpen, rejectOpen) => {
+        let redirect = '';
         let timer;
+        let closed = false;
+        let pending;
+        const shutdown = () => {
+            if (closed)
+                return;
+            closed = true;
+            if (timer)
+                clearTimeout(timer);
+            server.close();
+            server.closeAllConnections();
+        };
+        const fail = (err) => {
+            const p = pending;
+            pending = undefined;
+            shutdown();
+            p?.reject(err);
+        };
         const server = http.createServer(async (req, res) => {
             if (!req.url || !req.url.startsWith('/oauth2callback')) {
                 res.writeHead(404).end();
                 return;
             }
+            if (!pending) {
+                // Only reachable if something other than our own browser launch hit
+                // the port before finish() armed the exchange; nothing to do with it.
+                res.writeHead(503).end();
+                return;
+            }
+            const p = pending;
             const done = (code, body) => {
                 res.writeHead(code, { 'Content-Type': 'text/html' });
                 res.end(body);
-                if (timer)
-                    clearTimeout(timer);
-                server.close();
-                server.closeAllConnections();
             };
             try {
-                const qs = new URL(req.url, LOOPBACK_REDIRECT).searchParams;
+                const qs = new URL(req.url, redirect).searchParams;
                 const error = qs.get('error');
                 if (error) {
                     done(400, `<p>Authorization denied: ${error}</p>`);
-                    reject(new ConsentDeniedError(error));
+                    fail(new ConsentDeniedError(error));
                     return;
                 }
                 const returnedState = qs.get('state');
-                if (returnedState !== expectedState) {
-                    done(400, '<p>State mismatch — possible CSRF attempt. Aborting.</p>');
-                    reject(new Error('E_OAUTH_STATE_MISMATCH: OAuth state token mismatch'));
+                if (returnedState !== p.expectedState) {
+                    done(400, '<p>State mismatch: possible CSRF attempt. Aborting.</p>');
+                    fail(new Error('E_OAUTH_STATE_MISMATCH: OAuth state token mismatch'));
                     return;
                 }
                 const code = qs.get('code');
                 if (!code) {
                     done(400, '<p>No authorization code received.</p>');
-                    reject(new ConsentDeniedError('no authorization code received'));
+                    fail(new ConsentDeniedError('no authorization code received'));
                     return;
                 }
-                const { tokens } = await client.getToken(code);
+                const { tokens } = await p.client.getToken(code);
                 done(200, '<h2>Authentication successful!</h2><p>You can close this tab.</p>');
-                resolve(tokens);
+                pending = undefined;
+                shutdown();
+                p.resolve(tokens);
             }
             catch (e) {
                 done(500, '<p>Internal error during authentication.</p>');
-                reject(e);
+                fail(e);
             }
         });
         server.on('error', (err) => {
-            if (timer)
-                clearTimeout(timer);
-            reject(err.code === 'EADDRINUSE' ? new LoopbackPortInUseError() : err);
+            const mapped = err.code === 'EADDRINUSE' ? new LoopbackPortInUseError() : err;
+            if (pending) {
+                fail(mapped);
+            }
+            else {
+                shutdown();
+                rejectOpen(mapped);
+            }
         });
-        server.listen(LOOPBACK_PORT, '127.0.0.1', () => {
-            timer = setTimeout(() => {
-                server.close();
-                server.closeAllConnections();
-                reject(new ConsentTimeoutError());
-            }, timeoutMs);
+        // Bind to loopback only — never expose the OAuth callback to the local network.
+        server.listen(0, '127.0.0.1', () => {
+            redirect = `http://localhost:${server.address().port}/oauth2callback`;
+            timer = setTimeout(() => fail(new ConsentTimeoutError()), timeoutMs);
             // unref so a pending consent never keeps the process alive on its own.
             timer.unref?.();
+            resolveOpen({
+                redirect,
+                finish(client, expectedState) {
+                    return new Promise((resolve, reject) => {
+                        if (closed) {
+                            reject(new ConsentTimeoutError());
+                            return;
+                        }
+                        pending = { client, expectedState, resolve, reject };
+                    });
+                },
+                close: shutdown,
+            });
         });
     });
 }

package/dist/outbound-allowlist.d.ts

@@ -0,0 +1,34 @@
+export interface OutboundAllowlist {
+    entries: string[];
+    allows(email: string): boolean;
+}
+/** Parse GOOGLE_OUTBOUND_ALLOWLIST: comma-separated addresses and @domain
+ * suffixes ("a@b.com, @company.com"). null = feature off (nothing gated). */
+export declare function resolveOutboundAllowlist(env?: NodeJS.ProcessEnv): OutboundAllowlist | null;
+/** The addresses in `emails` the active allowlist rejects; [] when off. */
+export declare function outboundViolations(emails: string[], env?: NodeJS.ProcessEnv): string[];
+/** The standard error envelope for a blocked outbound target. */
+export declare function outboundDeniedEnvelope(kind: string, blocked: string[], account: string, env?: NodeJS.ProcessEnv): {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError: true;
+};
+/** Convenience: envelope when violations exist, else null. */
+export declare function checkOutbound(kind: string, emails: string[], account: string, env?: NodeJS.ProcessEnv): {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError: true;
+} | null;
+export declare function collectBodyRecipients(body: unknown): string[];
+/** Gate one escape-hatch/generated dispatch; envelope when blocked, else null. */
+export declare function checkOutboundForMethod(methodId: string, body: unknown, account: string, env?: NodeJS.ProcessEnv): {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError: true;
+} | null;

package/dist/outbound-allowlist.js

@@ -0,0 +1,108 @@
+// Opt-in outbound recipient allowlist for unattended deployments: a
+// prompt-injection blast-radius control (a hijacked agent cannot mail, invite
+// or share outside the operator's list), a safety feature first and an
+// enterprise checkbox second. FREE-core forever (ee-definition-v0 handoff).
+// Off by default: an unset/empty GOOGLE_OUTBOUND_ALLOWLIST gates nothing.
+/** Parse GOOGLE_OUTBOUND_ALLOWLIST: comma-separated addresses and @domain
+ * suffixes ("a@b.com, @company.com"). null = feature off (nothing gated). */
+export function resolveOutboundAllowlist(env = process.env) {
+    const raw = env.GOOGLE_OUTBOUND_ALLOWLIST;
+    if (raw === undefined || raw.trim() === '')
+        return null;
+    const entries = raw.split(',').map((s) => s.trim().toLowerCase()).filter(Boolean);
+    if (entries.length === 0)
+        return null;
+    const exact = new Set(entries.filter((e) => !e.startsWith('@')));
+    const domains = entries.filter((e) => e.startsWith('@'));
+    return {
+        entries,
+        allows(email) {
+            const a = email.trim().toLowerCase();
+            if (exact.has(a))
+                return true;
+            return domains.some((d) => a.endsWith(d));
+        },
+    };
+}
+/** The addresses in `emails` the active allowlist rejects; [] when off. */
+export function outboundViolations(emails, env = process.env) {
+    const list = resolveOutboundAllowlist(env);
+    if (!list)
+        return [];
+    return emails.map((e) => e.trim()).filter(Boolean).filter((e) => !list.allows(e));
+}
+/** The standard error envelope for a blocked outbound target. */
+export function outboundDeniedEnvelope(kind, blocked, account, env = process.env) {
+    const list = resolveOutboundAllowlist(env);
+    return {
+        content: [
+            {
+                type: 'text',
+                text: JSON.stringify({
+                    error: 'recipient_not_allowed',
+                    message: `${kind} blocked by the outbound allowlist: ${blocked.join(', ')}.`,
+                    hint: `GOOGLE_OUTBOUND_ALLOWLIST is active (${(list?.entries ?? []).join(', ')}). ` +
+                        'The operator must add the address (or its @domain) to the list, or unset the variable, to allow this target.',
+                    retriable: false,
+                    account,
+                }),
+            },
+        ],
+        isError: true,
+    };
+}
+/** Convenience: envelope when violations exist, else null. */
+export function checkOutbound(kind, emails, account, env = process.env) {
+    const blocked = outboundViolations(emails, env);
+    return blocked.length > 0 ? outboundDeniedEnvelope(kind, blocked, account, env) : null;
+}
+// Escape-hatch / generated-tool enforcement. Structured bodies are inspected
+// for the known recipient fields; RAW compose methods cannot be inspected
+// (base64 RFC 822), so with the allowlist active they are refused outright in
+// favor of the curated tools that enforce it.
+const RAW_SEND_METHODS = new Set(['gmail.users.messages.send', 'gmail.users.drafts.send', 'gmail.users.drafts.create', 'gmail.users.messages.insert', 'gmail.users.messages.import']);
+export function collectBodyRecipients(body) {
+    const out = [];
+    const walk = (v, depth) => {
+        if (!v || typeof v !== 'object' || depth > 4)
+            return;
+        if (Array.isArray(v)) {
+            for (const x of v)
+                walk(x, depth + 1);
+            return;
+        }
+        for (const [k, x] of Object.entries(v)) {
+            if ((k === 'emailAddress' || k === 'email') && typeof x === 'string' && x.includes('@'))
+                out.push(x);
+            else if (k === 'attendees' || k === 'permissions')
+                walk(x, depth + 1);
+            else if (typeof x === 'object')
+                walk(x, depth + 1);
+        }
+    };
+    walk(body, 0);
+    return out;
+}
+/** Gate one escape-hatch/generated dispatch; envelope when blocked, else null. */
+export function checkOutboundForMethod(methodId, body, account, env = process.env) {
+    if (!resolveOutboundAllowlist(env))
+        return null;
+    if (RAW_SEND_METHODS.has(methodId)) {
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: JSON.stringify({
+                        error: 'recipient_not_allowed',
+                        message: `${methodId} carries an uninspectable raw message while GOOGLE_OUTBOUND_ALLOWLIST is active.`,
+                        hint: 'Use gmail_send / gmail_create_draft, which enforce the allowlist on parsed recipients.',
+                        retriable: false,
+                        account,
+                    }),
+                },
+            ],
+            isError: true,
+        };
+    }
+    return checkOutbound(`${methodId} recipient`, collectBodyRecipients(body), account, env);
+}

package/dist/registry.d.ts

@@ -1,7 +1,8 @@
-import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { McpServer } from "@modelcontextprotocol/server";
 import { z } from 'zod';
 import { type Policy } from './write-control.js';
 import type { ArgShape } from './arg-normalize.js';
+import type { Metrics } from './usage-metrics.js';
 export type Cud = 'read' | 'create' | 'update' | 'delete';
 export type DiscoveryMode = 'lazy' | 'curated' | 'eager';
 export declare function resolveDiscoveryMode(env?: NodeJS.ProcessEnv): DiscoveryMode;
@@ -30,16 +31,25 @@ export interface CatalogOperation {
     summary: string;
     args: string[];
     cud: Cud;
+    /** Present only when no scope bundle in the catalog can authorize this
+     * method, so the call cannot succeed on any account however it is
+     * configured. The tool stays callable: graceful dispatch then returns the
+     * real scope error rather than a bare "not found". */
+    unreachable?: true;
 }
 export declare function inferCud(name: string): Cud;
 export declare class ToolRegistry {
     private readonly server;
+    private readonly metrics;
     readonly tools: ToolEntry[];
     readonly policy: Policy;
     readonly registerTool: McpServer['registerTool'];
     private readonly revealed;
     private readonly jsonSchemaCache;
     private readonly argShapeCache;
+    /** Memoized isUngrantable verdict per tool: the answer depends on the frozen
+     * bundle catalog only, so it never changes within a process. */
+    private readonly ungrantable;
     private readonly compactOutput;
     private registeringMeta;
     /** Configured visibility mode (GOOGLE_DISCOVERY); default lazy = v5 exact. */
@@ -47,13 +57,41 @@ export declare class ToolRegistry {
     /** Agent-toggled runtime overlay (discover_all / discover_reset): lifts a
      * lazy surface to curated without touching the configured mode. */
     private expanded;
-    constructor(server: McpServer, policy: Policy, mode?: DiscoveryMode);
+    constructor(server: McpServer, policy: Policy, mode?: DiscoveryMode, metrics?: Metrics | null);
     registerMeta: McpServer['registerTool'];
     services(): string[];
     /** Declared input-schema keys + scalar kinds for one tool (tools/call arg
      * normalization; the kind drives value coercion on renamed keys). */
     argShape(name: string): ArgShape | undefined;
+    /** Declared argument keys for a tool, in declaration order; undefined when
+     * the tool is not registered. Backs unknown-argument screening, which needs
+     * the full key list rather than argShape's scalar-kind subset view. */
+    declaredKeys(name: string): readonly string[] | undefined;
+    /** Keys spelling a similar concept elsewhere in the same service, for the
+     * hint on a call whose key matched nothing. Kept only when a key is declared
+     * by at least two tools in the service or by a curated one, so one-off
+     * generated parameters do not become advice. */
+    siblingSpellings(tool: string, unknownKeys: string[]): Array<{
+        key: string;
+        tools: string[];
+    }>;
     catalog(service: string, query?: string): CatalogOperation[];
+    /** The metrics recorder, for hook sites (escape hatch); null when off. */
+    get usageMetrics(): Metrics | null;
+    /** Every registered tool name, hidden ones included: they stay callable, so
+     * a did-you-mean may legitimately point at one. */
+    toolNames(): string[];
+    /** Membership test against the REGISTERED tool set (hidden tools included:
+     * they stay callable). The metrics tap uses this so a client-supplied name
+     * can never enter the closed vocabulary. */
+    hasTool(name: string): boolean;
+    /** Op-name vocabulary for a service, split by provenance so the capped
+     * discover descriptions can list curated ops and only summarize the
+     * generated long tail. */
+    opNames(service: string): {
+        curated: string[];
+        generated: string[];
+    };
     reveal(service: string): boolean;
     /** discover_all: advertise the full curated set at once. Idempotent. */
     expand(): boolean;
@@ -63,6 +101,15 @@ export declare class ToolRegistry {
      * dispatch), zero correctness impact. */
     collapse(): boolean;
     private effectiveMode;
+    /**
+     * True when NO bundle in the catalog grants any of the method's alternative
+     * scopes, so the call cannot succeed on any account under any configuration.
+     * Static: it asks the catalog, not an account, so it is safe to cache.
+     * `classifyScope` with nothing granted and no profile reports `add_bundle`
+     * for a scope some bundle could supply and `unknown_scope` only when none
+     * can, which is exactly the distinction wanted here.
+     */
+    isUngrantable(tool: ToolEntry): boolean;
     isVisible(tool: ToolEntry): boolean;
     visibleCount(): {
         eager: number;