mcp-squared 0.4.0 → 0.7.0

package/dist/index.js

@@ -124,6 +124,274 @@ function ensureConfigDir(configPath) {
 var SOCKET_FILENAME = "mcp-squared.sock", INSTANCE_DIR_NAME = "instances", SOCKET_DIR_NAME = "sockets", DAEMON_DIR_NAME = "daemon", DAEMON_REGISTRY_FILENAME = "daemon.json", DAEMON_SOCKET_FILENAME = "daemon.sock", CONFIG_FILENAME = "mcp-squared.toml", CONFIG_DIR_NAME = ".mcp-squared", APP_NAME = "mcp-squared";
 var init_paths = () => {};
 
+// src/capabilities/inference.ts
+function createEmptyScores() {
+  return CAPABILITY_IDS.reduce((acc, capability) => {
+    acc[capability] = 0;
+    return acc;
+  }, {});
+}
+function extractSchemaSignal(schema) {
+  if (!schema || schema.type !== "object") {
+    return "";
+  }
+  const keys = Object.keys(schema.properties ?? {});
+  const required = schema.required ?? [];
+  return `${keys.join(" ")} ${required.join(" ")}`;
+}
+function scoreTextSignals(scores, text) {
+  for (const capability of CAPABILITY_IDS) {
+    for (const pattern of CAPABILITY_PATTERNS[capability]) {
+      if (pattern.test(text)) {
+        scores[capability] += 4;
+      }
+    }
+  }
+}
+function getHighestScoringCapability(scores) {
+  const bestScore = Math.max(...Object.values(scores));
+  if (bestScore <= 0) {
+    return "general";
+  }
+  for (const capability of CAPABILITY_PRIORITY) {
+    if (scores[capability] === bestScore) {
+      return capability;
+    }
+  }
+  return "general";
+}
+function inferNamespaceCapability(namespace, tools, capabilityOverrides = {}) {
+  const override = capabilityOverrides[namespace];
+  if (override) {
+    return override;
+  }
+  const scores = createEmptyScores();
+  const namespaceText = namespace.toLowerCase();
+  for (const hint of NAMESPACE_HINTS) {
+    if (hint.pattern.test(namespaceText)) {
+      scores[hint.capability] += hint.score;
+    }
+  }
+  for (const tool of tools) {
+    const signal = [
+      tool.name,
+      tool.description ?? "",
+      extractSchemaSignal(tool.inputSchema)
+    ].join(" ").toLowerCase();
+    scoreTextSignals(scores, signal);
+  }
+  return getHighestScoringCapability(scores);
+}
+function groupNamespacesByCapability(inventories, capabilityOverrides = {}) {
+  const grouped = CAPABILITY_IDS.reduce((acc, capability) => {
+    acc[capability] = [];
+    return acc;
+  }, {});
+  const byNamespace = {};
+  const sorted = [...inventories].sort((a, b) => a.namespace.localeCompare(b.namespace));
+  for (const inventory of sorted) {
+    const capability = inferNamespaceCapability(inventory.namespace, inventory.tools, capabilityOverrides);
+    byNamespace[inventory.namespace] = capability;
+    grouped[capability].push(inventory.namespace);
+  }
+  return { byNamespace, grouped };
+}
+var CAPABILITY_IDS, CAPABILITY_PRIORITY, NAMESPACE_HINTS, CAPABILITY_PATTERNS;
+var init_inference = __esm(() => {
+  CAPABILITY_IDS = [
+    "code_search",
+    "docs",
+    "browser_automation",
+    "issue_tracking",
+    "cms_content",
+    "design",
+    "ai_media_generation",
+    "hosting_deploy",
+    "time_util",
+    "research",
+    "general"
+  ];
+  CAPABILITY_PRIORITY = [
+    "code_search",
+    "docs",
+    "browser_automation",
+    "issue_tracking",
+    "cms_content",
+    "design",
+    "ai_media_generation",
+    "hosting_deploy",
+    "time_util",
+    "research",
+    "general"
+  ];
+  NAMESPACE_HINTS = [
+    {
+      capability: "code_search",
+      pattern: /(auggie|augment|ctxdb|code|source|repo|symbol|search)/i,
+      score: 24
+    },
+    {
+      capability: "docs",
+      pattern: /(context7|ref|docs?|documentation|shadcn)/i,
+      score: 18
+    },
+    {
+      capability: "browser_automation",
+      pattern: /(chrome|devtools|browser|playwright|puppeteer|webdriver)/i,
+      score: 24
+    },
+    {
+      capability: "issue_tracking",
+      pattern: /(linear|jira|issue|ticket|project|milestone)/i,
+      score: 20
+    },
+    {
+      capability: "cms_content",
+      pattern: /(sanity|content|cms|dataset|schema|studio)/i,
+      score: 20
+    },
+    {
+      capability: "design",
+      pattern: /(pencil|figma|ui|design|artifact|visual)/i,
+      score: 20
+    },
+    {
+      capability: "hosting_deploy",
+      pattern: /(vercel|host|hosting|domain|dns|vps|deploy|infra)/i,
+      score: 22
+    },
+    {
+      capability: "time_util",
+      pattern: /(time|timezone|clock|date|utc)/i,
+      score: 22
+    },
+    {
+      capability: "ai_media_generation",
+      pattern: /(wavespeed|stability|replicate|midjourney|dall.?e|runway|imagen|flux|fal\.ai|dreamstudio)/i,
+      score: 24
+    },
+    {
+      capability: "research",
+      pattern: /(exa|perplexity|firecrawl|crawl|scrape|research|search)/i,
+      score: 16
+    }
+  ];
+  CAPABILITY_PATTERNS = {
+    code_search: [
+      /\bcodebase\b/i,
+      /\bsource\b/i,
+      /\brepo(?:sitory)?\b/i,
+      /\bsymbol(?:s)?\b/i,
+      /\bdefinition(?:s)?\b/i,
+      /\breference(?:s)?\b/i,
+      /\busage(?:s)?\b/i,
+      /\bsearch_context\b/i,
+      /\bcodebase-retrieval\b/i,
+      /\bdirectory_path\b/i
+    ],
+    docs: [
+      /\bdoc(?:s|umentation)?\b/i,
+      /\bread_docs\b/i,
+      /\bquery-docs\b/i,
+      /\breference\b/i,
+      /\bmanual\b/i,
+      /\bknowledge\b/i,
+      /\bregist(?:ry|ries)\b/i,
+      /\bcomponent(?:s)?\b/i,
+      /\bexample(?:s)?\b/i
+    ],
+    browser_automation: [
+      /\bbrowser\b/i,
+      /\bdevtools\b/i,
+      /\bnavigate\b/i,
+      /\bclick\b/i,
+      /\bhover\b/i,
+      /\bnetwork\b/i,
+      /\bconsole\b/i,
+      /\bscreenshot\b/i,
+      /\bpage\b/i
+    ],
+    issue_tracking: [
+      /\bissue(?:s)?\b/i,
+      /\bticket(?:s)?\b/i,
+      /\bmilestone(?:s)?\b/i,
+      /\bcycle(?:s)?\b/i,
+      /\bproject(?:s)?\b/i,
+      /\bcomment(?:s)?\b/i,
+      /\blinear\b/i
+    ],
+    cms_content: [
+      /\bcms\b/i,
+      /\bcontent\b/i,
+      /\bdocument(?:s)?\b/i,
+      /\bdataset(?:s)?\b/i,
+      /\bschema\b/i,
+      /\bpublish\b/i,
+      /\bdraft(?:s)?\b/i,
+      /\bsanity\b/i,
+      /\bmigration\b/i
+    ],
+    design: [
+      /\bdesign\b/i,
+      /\bui\b/i,
+      /\bartifact\b/i,
+      /\bstyle_guide\b/i,
+      /\bscreenshot\b/i,
+      /\bdiagram\b/i,
+      /\bimage\b/i,
+      /\blayout\b/i,
+      /\bframe\b/i
+    ],
+    ai_media_generation: [
+      /\btext.to.image\b/i,
+      /\bimage.to.image\b/i,
+      /\btext.to.video\b/i,
+      /\binpaint(?:ing)?\b/i,
+      /\bupscal(?:e|ing)\b/i,
+      /\bgenerat(?:e|ion)\b.*\bimage/i,
+      /\bimage\b.*\bgenerat(?:e|ion)\b/i,
+      /\bai\b.*\b(?:image|photo|video)\b/i,
+      /\bstable.diffusion\b/i,
+      /\bdiffusion\b/i,
+      /\bprompt\b.*\b(?:image|visual)\b/i
+    ],
+    hosting_deploy: [
+      /\bdeploy(?:ment)?\b/i,
+      /\bhosting\b/i,
+      /\bdomain(?:s)?\b/i,
+      /\bdns\b/i,
+      /\bvps\b/i,
+      /\bvirtual_machine(?:s)?\b/i,
+      /\bfirewall\b/i,
+      /\bwebsite\b/i,
+      /\bbilling\b/i,
+      /\bnameserver(?:s)?\b/i
+    ],
+    time_util: [
+      /\btime\b/i,
+      /\btimezone\b/i,
+      /\butc\b/i,
+      /\bclock\b/i,
+      /\bdate\b/i,
+      /\bconvert_time\b/i,
+      /\bget_current_time\b/i
+    ],
+    research: [
+      /\bresearch\b/i,
+      /\bcrawl\b/i,
+      /\bscrape\b/i,
+      /\bextract\b/i,
+      /\bsemantic_search\b/i,
+      /\bweb_search\b/i,
+      /\bask\b/i,
+      /\bperplexity\b/i,
+      /\bfirecrawl\b/i,
+      /\bexa\b/i
+    ],
+    general: []
+  };
+});
+
 // src/embeddings/generator.ts
 import {
   env,
@@ -281,33 +549,147 @@ var init_embeddings = __esm(() => {
   init_generator();
 });
 
+// src/capabilities/semantic-classifier.ts
+var exports_semantic_classifier = {};
+__export(exports_semantic_classifier, {
+  SemanticCapabilityClassifier: () => SemanticCapabilityClassifier
+});
+
+class SemanticCapabilityClassifier {
+  generator;
+  confidenceThreshold;
+  referenceEmbeddings = null;
+  constructor(generator, options) {
+    this.generator = generator;
+    this.confidenceThreshold = options?.confidenceThreshold ?? 0.45;
+  }
+  async initializeReferences() {
+    const texts = CAPABILITY_IDS.map((id) => CAPABILITY_REFERENCE_TEXTS[id]);
+    const result = await this.generator.embedBatch(texts, false);
+    this.referenceEmbeddings = new Map;
+    for (let i = 0;i < CAPABILITY_IDS.length; i++) {
+      this.referenceEmbeddings.set(CAPABILITY_IDS[i], result.embeddings[i]);
+    }
+  }
+  isInitialized() {
+    return this.referenceEmbeddings !== null;
+  }
+  async classify(namespace, tools) {
+    if (!this.referenceEmbeddings) {
+      throw new Error("SemanticCapabilityClassifier not initialized. Call initializeReferences() first.");
+    }
+    const startTime = performance.now();
+    const signalText = this.buildSignalText(namespace, tools);
+    const signalResult = await this.generator.embed(signalText, true);
+    const scores = [];
+    for (const [capId, refEmb] of this.referenceEmbeddings) {
+      const similarity = EmbeddingGenerator.cosineSimilarity(signalResult.embedding, refEmb);
+      scores.push({ capability: capId, similarity });
+    }
+    scores.sort((a, b) => b.similarity - a.similarity);
+    const best = scores[0];
+    if (!best) {
+      throw new Error("No capability references available for classification");
+    }
+    const runnerUp = scores[1];
+    const inferenceMs = performance.now() - startTime;
+    return {
+      capability: best.capability,
+      confidence: best.similarity,
+      inferenceMs,
+      runnerUp: runnerUp ? { capability: runnerUp.capability, confidence: runnerUp.similarity } : undefined
+    };
+  }
+  async classifyBatch(inventories) {
+    const startTime = performance.now();
+    const overrides = {};
+    const classifications = [];
+    for (const { namespace, tools } of inventories) {
+      const result = await this.classify(namespace, tools);
+      classifications.push({ namespace, ...result });
+      if (result.confidence >= this.confidenceThreshold) {
+        overrides[namespace] = result.capability;
+      }
+    }
+    return {
+      overrides,
+      classifications,
+      inferenceMs: performance.now() - startTime
+    };
+  }
+  buildSignalText(namespace, tools) {
+    const parts = [namespace];
+    for (const tool of tools) {
+      parts.push(tool.name);
+      if (tool.description) {
+        parts.push(tool.description);
+      }
+      const schemaSignal = extractSchemaSignal(tool.inputSchema);
+      if (schemaSignal) {
+        parts.push(schemaSignal);
+      }
+    }
+    return parts.join(" ");
+  }
+}
+var CAPABILITY_REFERENCE_TEXTS;
+var init_semantic_classifier = __esm(() => {
+  init_generator();
+  init_inference();
+  CAPABILITY_REFERENCE_TEXTS = {
+    code_search: "Search source code, symbols, function definitions, class references, and code context across repositories and codebases. Find implementations, usages, and navigate source files.",
+    docs: "Query technical documentation, API references, library guides, SDK docs, component registries, and code example lookups. Read documentation pages and fetch reference material.",
+    browser_automation: "Automate web browser interactions: click elements, fill forms, take screenshots, inspect DOM nodes, navigate URLs, execute JavaScript in page context, and run browser diagnostics.",
+    issue_tracking: "Manage project management tickets, kanban boards, sprints, and work items. Create, update, and track issues in project trackers like Jira, Linear, Asana, and ClickUp.",
+    cms_content: "Manage wiki pages, knowledge base articles, content documents, blog posts, editorial workflows, and structured content. Create and organize content in systems like Notion, Confluence, and Sanity.",
+    design: "Create and inspect visual design artifacts, UI mockups, wireframes, and design system components. Work with design tools like Figma, Sketch, and Pencil for visual layout and styling.",
+    ai_media_generation: "Generate and edit images, videos, and visual media using AI models. Create images from text prompts, edit existing images with AI, upscale resolution, apply style transfer, inpaint or outpaint regions, and generate sequential or consistent media. Supports text-to-image, image-to-image, and AI-powered visual content creation.",
+    hosting_deploy: "Manage server deployments, cloud infrastructure, hosting configurations, CI/CD pipelines, containers, databases, DNS records, and domain management.",
+    time_util: "Convert between timezones, get current time, format dates, calculate time differences, and resolve scheduling utilities.",
+    research: "Search the web, collect information from multiple sources, synthesize findings, and perform web research and data gathering operations.",
+    general: "General-purpose utility operations, API integrations, data transformations, notifications, messaging, payments, and miscellaneous tool actions."
+  };
+});
+
 // src/tui/monitor-loader.ts
 var exports_monitor_loader = {};
 __export(exports_monitor_loader, {
   runMonitorTui: () => runMonitorTui
 });
+function getMonitorModuleSpecifier() {
+  const self = import.meta.url;
+  if (self.includes("/tui/")) {
+    return new URL("./monitor.js", self).href;
+  }
+  return "./tui/monitor.js";
+}
 async function loadMonitorModule() {
-  return import(MONITOR_MODULE_SPECIFIER);
+  return import(getMonitorModuleSpecifier());
 }
 async function runMonitorTui(options = {}) {
   const { runMonitorTui: runMonitor } = await loadMonitorModule();
   return runMonitor(options);
 }
-var MONITOR_MODULE_SPECIFIER = "./tui/monitor.js";
 
 // src/tui/config-loader.ts
 var exports_config_loader = {};
 __export(exports_config_loader, {
   runConfigTui: () => runConfigTui
 });
+function getConfigModuleSpecifier() {
+  const self = import.meta.url;
+  if (self.includes("/tui/")) {
+    return new URL("./config.js", self).href;
+  }
+  return "./tui/config.js";
+}
 function loadConfigModule() {
-  return import(CONFIG_MODULE_SPECIFIER);
+  return import(getConfigModuleSpecifier());
 }
 async function runConfigTui() {
   const { runConfigTui: _run } = await loadConfigModule();
   return _run();
 }
-var CONFIG_MODULE_SPECIFIER = "./tui/config.js";
 
 // src/init/runner.ts
 var exports_runner = {};
@@ -359,6 +741,15 @@ defaultDetailLevel = "L1"
 # Adjust or clear if your stack uses different code indexers.
 codeSearch = ["auggie", "ctxdb"]
 
+[operations.dynamicToolSurface]
+# Capability-first tool surface is always enabled.
+inference = "heuristic_with_overrides"
+refresh = "on_connect"
+
+[operations.dynamicToolSurface.capabilityOverrides]
+# Optional namespace -> capability pinning.
+# auggie = "code_search"
+
 [operations.embeddings]
 # Enable to use semantic or hybrid search modes.
 # Requires onnxruntime shared library on the system.
@@ -525,6 +916,9 @@ function parseArgs(args) {
       case "monitor":
         result.mode = "monitor";
         break;
+      case "status":
+        result.mode = "status";
+        break;
       case "daemon":
         result.mode = "daemon";
         break;
@@ -699,6 +1093,7 @@ Usage:
   mcp-squared init [options]    Generate a starter config file with security profile
   mcp-squared migrate [options] Apply config migrations to existing config
   mcp-squared install [options] Install MCP\xB2 into other MCP clients
+  mcp-squared status [options]  Show upstream server status and capability routing
   mcp-squared monitor [options] Launch server monitor TUI
   mcp-squared daemon [options]  Start shared MCP\xB2 daemon
   mcp-squared proxy [options]   Start stdio proxy (connects to daemon)
@@ -713,6 +1108,7 @@ Commands:
   init                          Generate a starter config with security profile
   migrate                       Apply one-time config migrations to existing config
   install                       Install MCP\xB2 as a server in other MCP clients
+  status                        Show upstream status and capability routing
   monitor                       Launch server monitor TUI
   daemon                        Start shared daemon for multiple clients
   proxy                         Start stdio proxy for daemon
@@ -752,6 +1148,9 @@ Install Options:
   --dry-run                     Preview changes without writing
   --no-interactive              Disable interactive prompts
 
+Status Options:
+  --verbose, -V                 Show schema parameters and extra detail
+
 Monitor Options:
   (daemon-first; attaches to shared daemon monitor by default)
   --refresh-interval=<ms>       Auto-refresh interval in milliseconds (default: 2000)
@@ -771,6 +1170,8 @@ Supported Tools:
   ${VALID_TOOL_IDS.join(", ")}
 
 Examples:
+  mcp-squared status            Show upstream status and capability routing table
+  mcp-squared status --verbose  Show status with schema parameters
   mcp-squared test github       Test connection to 'github' upstream
   mcp-squared test              Test all configured upstreams
   mcp-squared auth vercel-mcp   Authenticate with 'vercel-mcp' upstream (OAuth)
@@ -1039,6 +1440,7 @@ import { parse as parseToml } from "smol-toml";
 import { ZodError } from "zod";
 
 // src/config/schema.ts
+init_inference();
 import { z } from "zod";
 var LATEST_SCHEMA_VERSION = 1;
 var LogLevelSchema = z.enum([
@@ -1095,6 +1497,18 @@ var SecuritySchema = z.object({
 });
 var SearchModeSchema = z.enum(["fast", "semantic", "hybrid"]);
 var DetailLevelSchema = z.enum(["L0", "L1", "L2"]);
+var CapabilityIdSchema = z.enum(CAPABILITY_IDS);
+var DynamicToolSurfaceInferenceSchema = z.enum([
+  "heuristic_with_overrides",
+  "hybrid"
+]);
+var DynamicToolSurfaceRefreshSchema = z.enum(["on_connect"]);
+var DynamicToolSurfaceSchema = z.object({
+  inference: DynamicToolSurfaceInferenceSchema.default("heuristic_with_overrides"),
+  refresh: DynamicToolSurfaceRefreshSchema.default("on_connect"),
+  capabilityOverrides: z.record(z.string().min(1), CapabilityIdSchema).default({}),
+  semanticConfidenceThreshold: z.number().min(0).max(1).default(0.45)
+});
 var PreferredNamespacesByIntentSchema = z.object({
   codeSearch: z.array(z.string().min(1)).default([])
 });
@@ -1116,6 +1530,14 @@ var LoggingSchema = z.object({
 var EmbeddingsSchema = z.object({
   enabled: z.boolean().default(false)
 });
+var ResponseResourceSchema = z.object({
+  enabled: z.boolean().default(false),
+  thresholdBytes: z.number().int().min(1024).default(51200),
+  maxInlineLines: z.number().int().min(1).default(20),
+  maxResources: z.number().int().min(1).default(100),
+  ttlMs: z.number().int().min(0).default(600000)
+});
+var DEFAULT_RESPONSE_RESOURCE_CONFIG = ResponseResourceSchema.parse({});
 var SelectionCacheSchema = z.object({
   enabled: z.boolean().default(true),
   minCooccurrenceThreshold: z.number().int().min(1).default(2),
@@ -1132,10 +1554,17 @@ var OperationsSchema = z.object({
   index: IndexSchema.default({ refreshIntervalMs: 30000 }),
   logging: LoggingSchema.default({ level: "info" }),
   embeddings: EmbeddingsSchema.default({ enabled: false }),
+  responseResource: ResponseResourceSchema.default(DEFAULT_RESPONSE_RESOURCE_CONFIG),
   selectionCache: SelectionCacheSchema.default({
     enabled: true,
     minCooccurrenceThreshold: 2,
     maxBundleSuggestions: 3
+  }),
+  dynamicToolSurface: DynamicToolSurfaceSchema.default({
+    inference: "heuristic_with_overrides",
+    refresh: "on_connect",
+    capabilityOverrides: {},
+    semanticConfidenceThreshold: 0.45
   })
 }).default({
   findTools: {
@@ -1148,10 +1577,17 @@ var OperationsSchema = z.object({
   index: { refreshIntervalMs: 30000 },
   logging: { level: "info" },
   embeddings: { enabled: false },
+  responseResource: DEFAULT_RESPONSE_RESOURCE_CONFIG,
   selectionCache: {
     enabled: true,
     minCooccurrenceThreshold: 2,
     maxBundleSuggestions: 3
+  },
+  dynamicToolSurface: {
+    inference: "heuristic_with_overrides",
+    refresh: "on_connect",
+    capabilityOverrides: {},
+    semanticConfidenceThreshold: 0.45
   }
 });
 var ConfigSchema = z.object({
@@ -1205,6 +1641,34 @@ function migrateV0ToV1(config) {
 
 // src/config/load.ts
 init_paths();
+function isRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+function getDeprecatedDynamicToolSurfaceKeys(raw) {
+  const operations = raw["operations"];
+  if (!isRecord(operations)) {
+    return [];
+  }
+  const dynamicToolSurface = operations["dynamicToolSurface"];
+  if (!isRecord(dynamicToolSurface)) {
+    return [];
+  }
+  const deprecated = [];
+  if ("mode" in dynamicToolSurface) {
+    deprecated.push("operations.dynamicToolSurface.mode");
+  }
+  if ("naming" in dynamicToolSurface) {
+    deprecated.push("operations.dynamicToolSurface.naming");
+  }
+  return deprecated;
+}
+function warnDeprecatedDynamicToolSurfaceKeys(filePath, keys) {
+  if (keys.length === 0) {
+    return;
+  }
+  console.warn(`[mcp\xB2] Deprecated config keys in ${filePath}: ${keys.join(", ")}. Run 'mcp-squared migrate' to clean up legacy settings.`);
+}
+
 class ConfigError extends Error {
   cause;
   constructor(message, cause) {
@@ -1272,6 +1736,7 @@ async function loadConfigFromPath(filePath, source) {
   } catch (err) {
     throw new ConfigParseError(filePath, err);
   }
+  warnDeprecatedDynamicToolSurfaceKeys(filePath, getDeprecatedDynamicToolSurfaceKeys(rawConfig));
   const migrated = migrateConfig(rawConfig);
   let config;
   try {
@@ -4305,33 +4770,109 @@ Installation cancelled.`);
 }
 
 // src/migrate/runner.ts
+init_inference();
 import { readFileSync as readFileSync5 } from "fs";
 import { parse as parseToml4 } from "smol-toml";
 var DEFAULT_CODE_SEARCH_NAMESPACES = ["auggie", "ctxdb"];
-function isRecord(value) {
+var RESERVED_DESCRIBE_ACTION = "__describe_actions";
+function isRecord2(value) {
   return typeof value === "object" && value !== null;
 }
 function hasOwn(obj, key) {
   return Object.hasOwn(obj, key);
 }
+function toActionToken(value) {
+  const normalized = value.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "").replace(/_+/g, "_");
+  const token = normalized.length > 0 ? normalized : "tool";
+  const reservedNormalized = RESERVED_DESCRIBE_ACTION.replace(/^_+|_+$/g, "").replace(/_+/g, "_");
+  if (token === reservedNormalized) {
+    return `${RESERVED_DESCRIBE_ACTION}__tool`;
+  }
+  return token;
+}
+function isCapabilityId(value) {
+  return CAPABILITY_IDS.includes(value);
+}
+function hasLegacyDynamicToolSurfaceKeys(rawConfig) {
+  if (!isRecord2(rawConfig)) {
+    return false;
+  }
+  const operations = rawConfig["operations"];
+  if (!isRecord2(operations)) {
+    return false;
+  }
+  const dynamicToolSurface = operations["dynamicToolSurface"];
+  if (!isRecord2(dynamicToolSurface)) {
+    return false;
+  }
+  return hasOwn(dynamicToolSurface, "mode") || hasOwn(dynamicToolSurface, "naming");
+}
 function isCodeSearchExplicitlyConfigured(rawConfig) {
-  if (!isRecord(rawConfig)) {
+  if (!isRecord2(rawConfig)) {
     return false;
   }
   const operations = rawConfig["operations"];
-  if (!isRecord(operations)) {
+  if (!isRecord2(operations)) {
     return false;
   }
   const findTools = operations["findTools"];
-  if (!isRecord(findTools)) {
+  if (!isRecord2(findTools)) {
     return false;
   }
   const preferredNamespacesByIntent = findTools["preferredNamespacesByIntent"];
-  if (!isRecord(preferredNamespacesByIntent)) {
+  if (!isRecord2(preferredNamespacesByIntent)) {
     return false;
   }
   return hasOwn(preferredNamespacesByIntent, "codeSearch");
 }
+function dedupePreserveOrder(values) {
+  const seen = new Set;
+  const result = [];
+  for (const value of values) {
+    if (seen.has(value)) {
+      continue;
+    }
+    seen.add(value);
+    result.push(value);
+  }
+  return result;
+}
+function translateSecurityPattern(pattern, config) {
+  const [scopeRaw, actionRaw] = pattern.split(":", 2);
+  if (!scopeRaw || !actionRaw) {
+    return {
+      original: pattern,
+      translated: pattern,
+      changed: false,
+      unresolvedReason: "invalid pattern format"
+    };
+  }
+  const translatedAction = actionRaw === "*" ? "*" : toActionToken(actionRaw);
+  if (scopeRaw === "*") {
+    const translated2 = `*:${translatedAction}`;
+    return {
+      original: pattern,
+      translated: translated2,
+      changed: translated2 !== pattern
+    };
+  }
+  if (isCapabilityId(scopeRaw)) {
+    const translated2 = `${scopeRaw}:${translatedAction}`;
+    return {
+      original: pattern,
+      translated: translated2,
+      changed: translated2 !== pattern
+    };
+  }
+  const override = config.operations.dynamicToolSurface.capabilityOverrides[scopeRaw];
+  const capability = override ?? inferNamespaceCapability(scopeRaw, [], {});
+  const translated = `${capability}:${translatedAction}`;
+  return {
+    original: pattern,
+    translated,
+    changed: translated !== pattern
+  };
+}
 function applyCodeSearchPreferenceMigration(config, options) {
   if (options.codeSearchExplicitlyConfigured) {
     return { config, changed: false };
@@ -4353,6 +4894,53 @@ function applyCodeSearchPreferenceMigration(config, options) {
     }
   };
 }
+function applySecurityPatternMigration(config) {
+  const report = {
+    translated: [],
+    unresolved: []
+  };
+  const migrateList = (patterns) => {
+    const next = [];
+    for (const pattern of patterns) {
+      const translation = translateSecurityPattern(pattern, config);
+      next.push(translation.translated);
+      if (translation.unresolvedReason) {
+        report.unresolved.push({
+          pattern: translation.original,
+          reason: translation.unresolvedReason
+        });
+      } else if (translation.changed) {
+        report.translated.push({
+          from: translation.original,
+          to: translation.translated
+        });
+      }
+    }
+    return dedupePreserveOrder(next);
+  };
+  const allow = migrateList(config.security.tools.allow);
+  const block = migrateList(config.security.tools.block);
+  const confirm = migrateList(config.security.tools.confirm);
+  const changed = allow.join("|") !== config.security.tools.allow.join("|") || block.join("|") !== config.security.tools.block.join("|") || confirm.join("|") !== config.security.tools.confirm.join("|");
+  if (!changed && report.unresolved.length === 0) {
+    return { config, changed: false, report };
+  }
+  return {
+    changed,
+    report,
+    config: {
+      ...config,
+      security: {
+        ...config.security,
+        tools: {
+          allow,
+          block,
+          confirm
+        }
+      }
+    }
+  };
+}
 async function runMigrate(args) {
   const discovered = discoverConfigPath();
   if (!discovered) {
@@ -4362,21 +4950,50 @@ async function runMigrate(args) {
   const loaded = await loadConfigFromPath(discovered.path, discovered.source);
   const rawConfig = parseToml4(readFileSync5(discovered.path, "utf-8"));
   const codeSearchExplicitlyConfigured = isCodeSearchExplicitlyConfigured(rawConfig);
-  const { config: migratedConfig, changed } = applyCodeSearchPreferenceMigration(loaded.config, {
+  const hasLegacySurfaceKeys = hasLegacyDynamicToolSurfaceKeys(rawConfig);
+  const codeSearchMigration = applyCodeSearchPreferenceMigration(loaded.config, {
     codeSearchExplicitlyConfigured
   });
-  if (!changed) {
-    console.log(`No migration needed: code-search preferences already configured in ${discovered.path}`);
+  const securityMigration = applySecurityPatternMigration(codeSearchMigration.config);
+  const changed = codeSearchMigration.changed || securityMigration.changed || hasLegacySurfaceKeys;
+  if (!changed && securityMigration.report.unresolved.length === 0) {
+    console.log(`No migration needed for ${discovered.path}`);
     return;
   }
   if (args.dryRun) {
     console.log(`[dry-run] Would update ${discovered.path}`);
-    console.log('[dry-run] Set operations.findTools.preferredNamespacesByIntent.codeSearch = ["auggie", "ctxdb"]');
+    if (codeSearchMigration.changed) {
+      console.log('[dry-run] Set operations.findTools.preferredNamespacesByIntent.codeSearch = ["auggie", "ctxdb"]');
+    }
+    if (securityMigration.report.translated.length > 0) {
+      for (const item of securityMigration.report.translated) {
+        console.log(`[dry-run] Translate security pattern: ${item.from} -> ${item.to}`);
+      }
+    }
+    if (hasLegacySurfaceKeys) {
+      console.log("[dry-run] Remove deprecated keys: operations.dynamicToolSurface.mode, operations.dynamicToolSurface.naming");
+    }
+    if (securityMigration.report.unresolved.length > 0) {
+      for (const unresolved of securityMigration.report.unresolved) {
+        console.warn(`[dry-run] Unresolved security pattern '${unresolved.pattern}': ${unresolved.reason}`);
+      }
+    }
     return;
   }
-  await saveConfig(discovered.path, migratedConfig);
+  await saveConfig(discovered.path, securityMigration.config);
   console.log(`Updated ${discovered.path}`);
-  console.log('Set operations.findTools.preferredNamespacesByIntent.codeSearch = ["auggie", "ctxdb"]');
+  if (codeSearchMigration.changed) {
+    console.log('Set operations.findTools.preferredNamespacesByIntent.codeSearch = ["auggie", "ctxdb"]');
+  }
+  for (const item of securityMigration.report.translated) {
+    console.log(`Translated security pattern: ${item.from} -> ${item.to}`);
+  }
+  if (hasLegacySurfaceKeys) {
+    console.log("Removed deprecated keys: operations.dynamicToolSurface.mode, operations.dynamicToolSurface.naming");
+  }
+  for (const unresolved of securityMigration.report.unresolved) {
+    console.warn(`Unresolved security pattern '${unresolved.pattern}': ${unresolved.reason}. Please review manually.`);
+  }
 }
 
 // src/oauth/browser.ts
@@ -5878,6 +6495,159 @@ class SelectionTracker {
     this.sessionTools.clear();
   }
 }
+// src/server/index.ts
+init_inference();
+
+// src/capabilities/routing.ts
+var DESCRIBE_ACTION = "__describe_actions";
+function buildCanonicalRouteId(capability, instanceKey, toolName) {
+  return `${capability}:${instanceKey}:${toolName}`;
+}
+function buildInstanceActionBase(baseAction, instanceToken) {
+  return `${baseAction}__${instanceToken}`;
+}
+function allocateUniqueActionId(emittedActions, actionBase, index) {
+  let candidate = index === 0 ? actionBase : `${actionBase}__${index + 1}`;
+  const suffixMatch = actionBase.match(/^(.*)__(\d+)$/);
+  const dedupeBase = suffixMatch?.[1] ?? actionBase;
+  let dedupe = suffixMatch?.[2] ? Number.parseInt(suffixMatch[2], 10) + 1 : index + 2;
+  while (emittedActions.has(candidate)) {
+    candidate = `${dedupeBase}__${dedupe}`;
+    dedupe += 1;
+  }
+  emittedActions.add(candidate);
+  return candidate;
+}
+function resolveInstanceTokens(records) {
+  const byToken = new Map;
+  for (const record of records) {
+    const instanceKey = record.instanceKey ?? record.serverKey;
+    const token = toActionToken2(instanceKey);
+    const existing = byToken.get(token) ?? [];
+    if (!existing.includes(instanceKey)) {
+      existing.push(instanceKey);
+      existing.sort((a, b) => a.localeCompare(b));
+      byToken.set(token, existing);
+    }
+  }
+  const resolved = new Map;
+  for (const [token, instanceKeys] of [...byToken.entries()].sort((a, b) => a[0].localeCompare(b[0]))) {
+    instanceKeys.forEach((instanceKey, index) => {
+      resolved.set(instanceKey, index === 0 ? token : `${token}__${index + 1}`);
+    });
+  }
+  return resolved;
+}
+function toActionToken2(value) {
+  const normalized = value.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "").replace(/_+/g, "_");
+  return normalized.length > 0 ? normalized : "tool";
+}
+function buildCapabilityRouters(inventories, grouping, summarize) {
+  if (inventories.length === 0) {
+    return [];
+  }
+  const defaultSummarize = (desc, cap) => {
+    if (desc) {
+      const firstLine = desc.split(`
+`)[0]?.trim();
+      if (firstLine && firstLine.length > 0) {
+        return firstLine.length > 120 ? `${firstLine.slice(0, 117)}...` : firstLine;
+      }
+    }
+    const title = cap.split("_").map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
+    return `Execute ${title} action`;
+  };
+  const resolveSummary = summarize ?? defaultSummarize;
+  const candidates = [];
+  const reservedNormalized = toActionToken2(DESCRIBE_ACTION);
+  for (const inventory of inventories) {
+    const capability = grouping.byNamespace[inventory.namespace] ?? "general";
+    const instanceKey = inventory.namespace;
+    const instanceTitle = inventory.title ?? inventory.namespace;
+    const sortedTools = [...inventory.tools].sort((a, b) => a.name.localeCompare(b.name));
+    for (const tool of sortedTools) {
+      let baseAction = toActionToken2(tool.name);
+      if (baseAction === DESCRIBE_ACTION || baseAction === reservedNormalized) {
+        baseAction = `${DESCRIBE_ACTION}__tool`;
+      }
+      candidates.push({
+        capability,
+        action: baseAction,
+        baseAction,
+        serverKey: inventory.namespace,
+        instanceKey,
+        instanceTitle,
+        toolName: tool.name,
+        qualifiedName: `${inventory.namespace}:${tool.name}`,
+        canonicalRouteId: buildCanonicalRouteId(capability, instanceKey, tool.name),
+        collisionGroupSize: 1,
+        inputSchema: tool.inputSchema ?? { type: "object" },
+        summary: resolveSummary(tool.description ?? undefined, capability)
+      });
+    }
+  }
+  const byCapabilityAction = new Map;
+  for (const candidate of candidates) {
+    const key = `${candidate.capability}:${candidate.baseAction}`;
+    const existing = byCapabilityAction.get(key) ?? [];
+    existing.push(candidate);
+    byCapabilityAction.set(key, existing);
+  }
+  const resolved = [];
+  const sortedKeys = [...byCapabilityAction.keys()].sort((a, b) => a.localeCompare(b));
+  for (const key of sortedKeys) {
+    const records = (byCapabilityAction.get(key) ?? []).sort((a, b) => a.qualifiedName.localeCompare(b.qualifiedName));
+    if (records.length === 1) {
+      const [record] = records;
+      if (record) {
+        resolved.push({
+          ...record,
+          action: record.baseAction,
+          collisionGroupSize: 1,
+          legacyActions: []
+        });
+      }
+      continue;
+    }
+    const legacyActionsByQualifiedName = new Map;
+    records.forEach((record, index) => {
+      legacyActionsByQualifiedName.set(record.qualifiedName, index === 0 ? [] : [`${record.baseAction}__${index + 1}`]);
+    });
+    const instanceTokens = resolveInstanceTokens(records);
+    const byInstance = new Map;
+    for (const record of records) {
+      const instanceKey = record.instanceKey ?? record.serverKey;
+      const existing = byInstance.get(instanceKey) ?? [];
+      existing.push(record);
+      byInstance.set(instanceKey, existing);
+    }
+    const emittedActions = new Set;
+    for (const instanceKey of [...byInstance.keys()].sort((a, b) => a.localeCompare(b))) {
+      const instanceRecords = (byInstance.get(instanceKey) ?? []).sort((a, b) => a.qualifiedName.localeCompare(b.qualifiedName));
+      const instanceToken = instanceTokens.get(instanceKey) ?? toActionToken2(instanceKey);
+      const actionBase = buildInstanceActionBase(records[0]?.baseAction ?? "tool", instanceToken);
+      instanceRecords.forEach((record, index) => {
+        resolved.push({
+          ...record,
+          action: allocateUniqueActionId(emittedActions, actionBase, index),
+          collisionGroupSize: records.length,
+          legacyActions: legacyActionsByQualifiedName.get(record.qualifiedName) ?? []
+        });
+      });
+    }
+  }
+  const byCapability = new Map;
+  for (const route of resolved) {
+    const existing = byCapability.get(route.capability) ?? [];
+    existing.push(route);
+    byCapability.set(route.capability, existing);
+  }
+  return [...byCapability.entries()].map(([capability, actions]) => ({
+    capability,
+    actions: actions.sort((a, b) => a.action.localeCompare(b.action))
+  })).sort((a, b) => a.capability.localeCompare(b.capability));
+}
+
 // src/index/store.ts
 import { Database } from "bun:sqlite";
 function hashSchema2(schema) {
@@ -6424,6 +7194,9 @@ class Retriever {
   clearIndex() {
     this.indexStore.clear();
   }
+  getEmbeddingGenerator() {
+    return this.embeddingGenerator;
+  }
   async initializeEmbeddings() {
     if (!this.embeddingsAvailable) {
       return;
@@ -6545,60 +7318,68 @@ function cleanupExpiredTokens() {
     }
   }
 }
-function validateConfirmationToken(token, serverKey, toolName) {
+function validateConfirmationToken(token, capability, action) {
   cleanupExpiredTokens();
   const confirmation = pendingConfirmations.get(token);
   if (!confirmation) {
     return false;
   }
-  if (confirmation.serverKey !== serverKey || confirmation.toolName !== toolName) {
+  if (confirmation.capability !== capability || confirmation.action !== action) {
     return false;
   }
   pendingConfirmations.delete(token);
   return true;
 }
-function createConfirmationToken(serverKey, toolName) {
+function createConfirmationToken(capability, action) {
   cleanupExpiredTokens();
   const token = generateToken();
   pendingConfirmations.set(token, {
-    serverKey,
-    toolName,
+    capability,
+    action,
     createdAt: Date.now()
   });
   return token;
 }
 function evaluatePolicy(context, config) {
-  const { serverKey, toolName, confirmationToken } = context;
+  const capability = context.capability ?? context.serverKey;
+  const action = context.action ?? context.toolName;
+  const confirmationToken = context.confirmationToken;
   const { block, confirm, allow } = config.security.tools;
-  if (matchesAnyPattern(block, serverKey, toolName)) {
+  if (!capability || !action) {
     return {
       decision: "block",
-      reason: `Tool "${toolName}" on server "${serverKey}" is blocked by security policy`
+      reason: "Missing capability/action in security policy context"
     };
   }
-  if (matchesAnyPattern(allow, serverKey, toolName)) {
+  if (matchesAnyPattern(block, capability, action)) {
+    return {
+      decision: "block",
+      reason: `Action "${action}" in capability "${capability}" is blocked by security policy`
+    };
+  }
+  if (matchesAnyPattern(allow, capability, action)) {
     return {
       decision: "allow",
-      reason: `Tool "${toolName}" is allowed by security policy`
+      reason: `Action "${action}" is allowed by security policy`
     };
   }
-  if (matchesAnyPattern(confirm, serverKey, toolName)) {
-    if (confirmationToken && validateConfirmationToken(confirmationToken, serverKey, toolName)) {
+  if (matchesAnyPattern(confirm, capability, action)) {
+    if (confirmationToken && validateConfirmationToken(confirmationToken, capability, action)) {
       return {
         decision: "allow",
-        reason: `Tool "${toolName}" confirmed with valid token`
+        reason: `Action "${action}" confirmed with valid token`
       };
     }
-    const token = createConfirmationToken(serverKey, toolName);
+    const token = createConfirmationToken(capability, action);
     return {
       decision: "confirm",
-      reason: `Tool "${toolName}" on server "${serverKey}" requires confirmation`,
+      reason: `Action "${action}" in capability "${capability}" requires confirmation`,
       confirmationToken: token
     };
   }
   return {
     decision: "block",
-    reason: `Tool "${toolName}" on server "${serverKey}" is not in the allow or confirm list`
+    reason: `Action "${action}" in capability "${capability}" is not in the allow or confirm list`
   };
 }
 function compilePolicy(config) {
@@ -6763,6 +7544,26 @@ async function waitForProcessExit(proc, timeoutMs) {
 }
 
 // src/upstream/cataloger.ts
+var AUTH_ERROR_PATTERNS = [
+  "invalid_token",
+  "invalid token",
+  "unauthorized",
+  "no token provided",
+  "no authorization",
+  "api key",
+  "api_key",
+  "authentication required",
+  "authentication failed",
+  "invalid credentials",
+  "invalid api",
+  "forbidden",
+  "access denied",
+  "not authenticated"
+];
+function isAuthError(message) {
+  const lower = message.toLowerCase();
+  return AUTH_ERROR_PATTERNS.some((pattern) => lower.includes(pattern));
+}
 function resolveEnvVars(env2) {
   const resolved = {};
   for (const [key, value] of Object.entries(env2)) {
@@ -6843,7 +7644,7 @@ class Cataloger {
         if (err instanceof UnauthorizedError2 && connection.authProvider) {
           if (connection.authProvider.isNonInteractive()) {
             connection.authPending = true;
-            connection.status = "error";
+            connection.status = "needs_auth";
             connection.error = `OAuth authorization required. Run: mcp-squared auth ${key}`;
             return;
           }
@@ -6867,8 +7668,9 @@ class Cataloger {
       }));
       connection.status = "connected";
     } catch (err) {
-      connection.status = "error";
-      connection.error = err instanceof Error ? err.message : String(err);
+      const errorMsg = err instanceof Error ? err.message : String(err);
+      connection.status = isAuthError(errorMsg) ? "needs_auth" : "error";
+      connection.error = errorMsg;
       try {
         await this.cleanupConnection(connection);
       } catch (_cleanupErr) {}
@@ -7002,10 +7804,15 @@ class Cataloger {
       name: bareToolName,
       arguments: args
     });
-    return {
+    const response = {
       content: callResult.content,
       isError: callResult.isError
     };
+    const sc = callResult["structuredContent"];
+    if (sc != null && typeof sc === "object" && !Array.isArray(sc)) {
+      response.structuredContent = sc;
+    }
+    return response;
   }
   async refreshTools(key) {
     const connection = this.connections.get(key);
@@ -7030,13 +7837,14 @@ class Cataloger {
       if (err instanceof UnauthorizedError2 && connection.authProvider) {
         if (connection.authProvider.isNonInteractive()) {
           connection.authPending = true;
-          connection.status = "error";
+          connection.status = "needs_auth";
           connection.error = `OAuth authorization required. Run: mcp-squared auth ${key}`;
           return;
         }
       }
-      connection.status = "error";
-      connection.error = err instanceof Error ? err.message : String(err);
+      const errorMsg = err instanceof Error ? err.message : String(err);
+      connection.status = isAuthError(errorMsg) ? "needs_auth" : "error";
+      connection.error = errorMsg;
     }
   }
   async refreshAllTools() {
@@ -7341,6 +8149,37 @@ async function testUpstreamConnection(name, config, options = {}) {
     log("Done");
   }
 }
+// src/utils/capability-meta.ts
+function capabilityTitle(capability) {
+  return capability.split("_").map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
+}
+function capabilitySummary(capability) {
+  switch (capability) {
+    case "code_search":
+      return "Search and retrieve source-code context.";
+    case "docs":
+      return "Query and read technical documentation.";
+    case "browser_automation":
+      return "Automate browser interactions and diagnostics.";
+    case "issue_tracking":
+      return "Work with issues, tickets, and project tracking.";
+    case "cms_content":
+      return "Manage content and CMS resources.";
+    case "design":
+      return "Create and inspect design artifacts and visuals.";
+    case "ai_media_generation":
+      return "Generate and edit images and media using AI models.";
+    case "hosting_deploy":
+      return "Manage deployments, hosting, and infrastructure operations.";
+    case "time_util":
+      return "Resolve time, timezone, and date utilities.";
+    case "research":
+      return "Run web/research collection and synthesis operations.";
+    default:
+      return "Run general-purpose capability actions.";
+  }
+}
+
 // src/server/monitor-server.ts
 import { existsSync as existsSync10, unlinkSync as unlinkSync5 } from "fs";
 import { createServer as createServer3 } from "net";
@@ -7590,6 +8429,178 @@ class MonitorServer {
   }
 }
 
+// src/server/response-resource.ts
+import { randomBytes } from "crypto";
+class ResponseResourceManager {
+  static MAX_PREVIEW_BYTES = 2048;
+  config;
+  resources = new Map;
+  insertionOrder = [];
+  constructor(config) {
+    this.config = config;
+  }
+  isEnabled() {
+    return this.config.enabled;
+  }
+  shouldOffload(content) {
+    if (!this.config.enabled)
+      return false;
+    const { byteCount } = this.canonicalizeContent(content);
+    return byteCount > this.config.thresholdBytes;
+  }
+  offload(content, context) {
+    const { fullText, byteCount } = this.canonicalizeContent(content);
+    const id = this.generateId(context);
+    const uri = `mcp2://response/${context.capability}/${id}`;
+    const entry = {
+      uri,
+      name: `${context.capability}:${context.action} response`,
+      description: `Full response from ${context.capability}:${context.action} (${byteCount} bytes)`,
+      mimeType: "text/plain",
+      fullText,
+      byteCount,
+      createdAt: Date.now()
+    };
+    this.store(uri, entry);
+    const preview = this.buildPreview(fullText);
+    const pointer = {
+      truncated: true,
+      resource_uri: uri,
+      total_bytes: byteCount,
+      preview,
+      instructions: "Full response available via resources/read with the resource_uri above."
+    };
+    return {
+      resourceUri: uri,
+      inlineContent: [{ type: "text", text: JSON.stringify(pointer) }]
+    };
+  }
+  readResource(uri) {
+    const entry = this.resources.get(uri);
+    if (!entry)
+      return null;
+    if (Date.now() - entry.createdAt >= this.config.ttlMs) {
+      this.deleteResource(uri);
+      return null;
+    }
+    this.touchInsertionOrder(uri);
+    return {
+      contents: [
+        {
+          uri: entry.uri,
+          mimeType: entry.mimeType,
+          text: entry.fullText
+        }
+      ]
+    };
+  }
+  listResources() {
+    this.evictExpired();
+    const result = [];
+    for (const entry of this.resources.values()) {
+      result.push({
+        uri: entry.uri,
+        name: entry.name,
+        description: entry.description,
+        mimeType: entry.mimeType,
+        size: entry.byteCount
+      });
+    }
+    return result;
+  }
+  getResourceCount() {
+    return this.resources.size;
+  }
+  canonicalizeContent(content) {
+    const fullText = content.map((block) => block.text).join(`
+
+---
+
+`);
+    return {
+      fullText,
+      byteCount: this.measureBytes(fullText)
+    };
+  }
+  measureBytes(text) {
+    return Buffer.byteLength(text, "utf8");
+  }
+  generateId(context) {
+    const timestamp = Date.now().toString(36);
+    const random = randomBytes(4).toString("hex");
+    const actionSlug = context.action.toLowerCase().replace(/[^a-z0-9]+/g, "_").slice(0, 24);
+    return `${actionSlug}_${timestamp}_${random}`;
+  }
+  buildPreview(fullText) {
+    const lines = fullText.split(`
+`);
+    let preview;
+    if (lines.length <= this.config.maxInlineLines) {
+      preview = fullText;
+    } else {
+      preview = `${lines.slice(0, this.config.maxInlineLines).join(`
+`)}
+...`;
+    }
+    if (this.measureBytes(preview) > ResponseResourceManager.MAX_PREVIEW_BYTES) {
+      const truncated = this.truncateUtf8(preview, ResponseResourceManager.MAX_PREVIEW_BYTES);
+      return `${truncated}...`;
+    }
+    return preview;
+  }
+  truncateUtf8(text, maxBytes) {
+    const bytes = Buffer.from(text, "utf8");
+    if (bytes.length <= maxBytes)
+      return text;
+    const decoder = new TextDecoder("utf-8", { fatal: true });
+    for (let end = maxBytes;end > 0; end--) {
+      try {
+        return decoder.decode(bytes.subarray(0, end));
+      } catch {}
+    }
+    return "";
+  }
+  store(uri, entry) {
+    this.evictExpired();
+    while (this.resources.size >= this.config.maxResources && this.insertionOrder.length > 0) {
+      const oldest = this.insertionOrder[0];
+      if (!oldest)
+        break;
+      this.deleteResource(oldest);
+    }
+    this.resources.set(uri, entry);
+    this.touchInsertionOrder(uri);
+  }
+  evictExpired() {
+    const now = Date.now();
+    const toRemove = [];
+    for (const [uri, entry] of this.resources) {
+      if (now - entry.createdAt >= this.config.ttlMs) {
+        toRemove.push(uri);
+      }
+    }
+    for (const uri of toRemove) {
+      this.deleteResource(uri);
+    }
+  }
+  deleteResource(uri) {
+    this.resources.delete(uri);
+    this.removeFromInsertionOrder(uri);
+  }
+  removeFromInsertionOrder(uri) {
+    const idx = this.insertionOrder.indexOf(uri);
+    if (idx !== -1)
+      this.insertionOrder.splice(idx, 1);
+  }
+  appendToInsertionOrder(uri) {
+    this.insertionOrder.push(uri);
+  }
+  touchInsertionOrder(uri) {
+    this.removeFromInsertionOrder(uri);
+    this.appendToInsertionOrder(uri);
+  }
+}
+
 // src/server/stats.ts
 class StatsCollector {
   indexStore;
@@ -7778,18 +8789,23 @@ class StatsCollector {
 }
 
 // src/server/index.ts
+var DESCRIBE_ACTION2 = "__describe_actions";
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
 class McpSquaredServer {
   mcpServer;
   cataloger;
   retriever;
   config;
-  maxLimit;
   transport = null;
   ownsCataloger;
   selectionTracker;
   compiledPolicy;
   indexRefreshManager;
   statsCollector;
+  responseResourceManager;
   monitorServer;
   isCoreStarted = false;
   serverName;
@@ -7797,6 +8813,8 @@ class McpSquaredServer {
   safetyAgent;
   obsSink;
   guard;
+  baseToolsRegistered = false;
+  computedCapabilityOverrides = {};
   constructor(options = {}) {
     const name = options.name ?? "mcp-squared";
     const version = options.version ?? VERSION;
@@ -7811,11 +8829,11 @@ class McpSquaredServer {
     }
     this.config = options.config ?? DEFAULT_CONFIG;
     const findToolsConfig = this.config.operations.findTools;
-    this.maxLimit = options.maxLimit ?? findToolsConfig.maxLimit;
+    const retrieverMaxLimit = options.maxLimit ?? findToolsConfig.maxLimit;
     this.retriever = new Retriever(this.cataloger, {
       indexDbPath: options.indexDbPath,
       defaultLimit: options.defaultLimit ?? findToolsConfig.defaultLimit,
-      maxLimit: this.maxLimit,
+      maxLimit: retrieverMaxLimit,
       defaultMode: findToolsConfig.defaultMode
     });
     const safetyEnv = readSafetyEnv();
@@ -7839,6 +8857,8 @@ class McpSquaredServer {
       policy: loadedPolicy,
       sink: this.obsSink
     });
+    const rrConfig = this.config.operations.responseResource ?? DEFAULT_RESPONSE_RESOURCE_CONFIG;
+    this.responseResourceManager = new ResponseResourceManager(rrConfig);
     this.mcpServer = this.createMcpServer(name, version);
     this.selectionTracker = new SelectionTracker;
     this.compiledPolicy = compilePolicy(this.config);
@@ -7866,480 +8886,341 @@ class McpSquaredServer {
         });
       }
     });
-    this.registerMetaTools(this.mcpServer);
   }
   createMcpServer(name, version) {
     return new McpServer({
       name,
       version,
-      title: "MCP\xB2 Meta Router",
-      description: "Discover and execute tools across upstream MCP servers through a compact meta-tool interface."
+      title: "MCP\xB2 Capability Router",
+      description: "Execute capability-first tools routed to connected upstream MCP servers."
     }, {
       capabilities: {
-        tools: {}
+        tools: {},
+        ...this.responseResourceManager.isEnabled() ? { resources: {} } : {}
       },
       instructions: this.buildServerInstructions()
     });
   }
   buildServerInstructions() {
-    const codeSearchNamespaces = this.getCodeSearchNamespaces();
-    const codeSearchHint = codeSearchNamespaces.length > 0 ? ` Prefer these configured code-search namespaces when relevant: ${codeSearchNamespaces.join(", ")}.` : "";
     return [
-      "Use discovery-first workflow: call `find_tools` before defaulting to local shell discovery (for example `grep`/`rg`).",
-      `For codebase lookup tasks, start with \`find_tools\` queries such as "code search", "find symbol", or "references".${codeSearchHint}`,
-      "After choosing a candidate, call `describe_tools` to confirm schema, then call `execute` with a qualified tool name (`namespace:tool_name`).",
-      "If capabilities are unclear or a name is ambiguous, call `list_namespaces`."
+      "Tool surface is generated at connect time from inferred upstream capabilities.",
+      "Each capability tool accepts `action`, `arguments`, and optional `confirmation_token`.",
+      'Call a capability tool with `action = "__describe_actions"` to inspect available actions and schemas.',
+      "Use returned action IDs for execution calls; if disambiguation is required, choose one candidate action and retry."
     ].join(" ");
   }
-  getCodeSearchNamespaces() {
-    const configured = this.config.operations.findTools.preferredNamespacesByIntent.codeSearch;
-    const upstreamKeys = Object.keys(this.config.upstreams);
-    if (configured.length > 0) {
-      const deduped = [...new Set(configured)];
-      const present = deduped.filter((ns) => upstreamKeys.includes(ns));
-      return present.length > 0 ? present : deduped;
-    }
-    return upstreamKeys.filter((key) => /(auggie|augment|code|source|repo|search)/i.test(key));
-  }
-  isCodeSearchQuery(query) {
-    return /\b(codebase|source code|repository|repo)\b/i.test(query) || /\b(code search|search code|find symbol|symbol lookup|definition|references?|usages?)\b/i.test(query);
-  }
-  rankToolsForQuery(tools, query) {
-    if (!this.isCodeSearchQuery(query) || tools.length < 2) {
-      return tools;
-    }
-    const preferredNamespaces = new Set(this.getCodeSearchNamespaces());
-    const scored = tools.map((tool, index) => {
-      const haystack = `${tool.serverKey} ${tool.name} ${tool.description ?? ""}`.toLowerCase();
-      let score = 0;
-      if (preferredNamespaces.has(tool.serverKey))
-        score += 100;
-      if (/(auggie|augment)/i.test(tool.serverKey))
-        score += 40;
-      if (/\b(search|find|query|lookup)\b/.test(haystack))
-        score += 15;
-      if (/\b(code|symbol|definition|reference|repo|repository|source)\b/.test(haystack)) {
-        score += 20;
-      }
-      return { tool, index, score };
-    });
-    scored.sort((a, b) => {
-      if (a.score === b.score) {
-        return a.index - b.index;
-      }
-      return b.score - a.score;
-    });
-    return scored.map((entry) => entry.tool);
-  }
-  buildFindToolsGuidance(query) {
-    const guidance = {
-      nextStep: "Use describe_tools for selected candidates, then execute with a qualified name."
-    };
-    if (this.isCodeSearchQuery(query)) {
-      const preferredNamespaces = this.getCodeSearchNamespaces();
-      if (preferredNamespaces.length > 0) {
-        guidance.preferredNamespaces = preferredNamespaces;
-        guidance.note = "For codebase exploration, prefer these namespaces before local shell grep/rg.";
-      }
-    }
-    return guidance;
-  }
   createSessionServer() {
     const server = this.createMcpServer(this.serverName, this.serverVersion);
-    this.registerMetaTools(server);
+    this.registerConfiguredToolSurface(server);
     return server;
   }
-  runTaskSpan(taskName, run) {
-    return task_span(this.obsSink, {
-      agent: this.safetyAgent,
-      taskName,
-      playbook: this.guard.playbook,
-      env: this.guard.agentEnv
-    }, run);
+  registerConfiguredToolSurface(server) {
+    this.registerCapabilityRouters(server);
+    if (this.responseResourceManager.isEnabled()) {
+      this.registerResponseResources(server);
+    }
   }
-  filterToolsByPolicy(tools) {
-    return tools.map((tool) => {
-      const visibility = getToolVisibilityCompiled(tool.serverKey, tool.name, this.compiledPolicy);
-      if (!visibility.visible) {
-        return null;
-      }
-      return visibility.requiresConfirmation ? { ...tool, requiresConfirmation: true } : tool;
-    }).filter((t) => t !== null);
-  }
-  registerMetaTools(server) {
-    server.registerTool("find_tools", {
-      title: "Discover Upstream Tools",
-      description: "Call this first for capability discovery. Search available tools across all connected upstream MCP servers and return ranked tool summaries matching the query.",
-      annotations: {
-        readOnlyHint: true,
-        openWorldHint: false
-      },
-      inputSchema: {
-        query: z3.string().describe('Natural language query describing the task (for example: "code search", "find symbol", "create issue")'),
-        limit: z3.number().int().min(1).max(this.maxLimit).default(this.config.operations.findTools.defaultLimit).describe("Maximum number of results to return"),
-        mode: SearchModeSchema.optional().describe('Search mode: "fast" (FTS5), "semantic" (embeddings), or "hybrid" (FTS5 + rerank)'),
-        detail_level: DetailLevelSchema.optional().describe('Level of detail: "L0" (name only), "L1" (summary with description, default), "L2" (full schema)')
-      }
-    }, async (args) => this.runTaskSpan("find_tools", async () => {
-      const requestId = this.statsCollector.startRequest();
-      const startTime = Date.now();
-      let success = false;
-      try {
-        const result = await this.retriever.search(args.query, {
-          limit: args.limit,
-          mode: args.mode
-        });
-        const filteredTools = this.filterToolsByPolicy(result.tools);
-        const rankedTools = this.rankToolsForQuery(filteredTools, args.query);
-        const detailLevel = args.detail_level ?? this.config.operations.findTools.defaultDetailLevel;
-        const tools = this.formatToolsForDetailLevel(rankedTools, detailLevel);
-        const guidance = this.buildFindToolsGuidance(args.query);
-        const selectionCacheConfig = this.config.operations.selectionCache;
-        let suggestedTools;
-        if (selectionCacheConfig.enabled && selectionCacheConfig.maxBundleSuggestions > 0) {
-          const toolKeys = filteredTools.map((t) => `${t.serverKey}:${t.name}`);
-          const suggestions = this.retriever.getIndexStore().getSuggestedBundles(toolKeys, selectionCacheConfig.minCooccurrenceThreshold, selectionCacheConfig.maxBundleSuggestions);
-          if (suggestions.length > 0) {
-            suggestedTools = suggestions.map((s) => ({
-              tools: [s.toolKey],
-              frequency: s.count
-            }));
-          }
-        }
-        success = true;
+  registerResponseResources(server) {
+    const mgr = this.responseResourceManager;
+    server.registerResource("response-resources", "mcp2://response/{capability}/{id}", {
+      description: "Temporary resources containing full tool responses that exceeded the inline size threshold.",
+      mimeType: "text/plain"
+    }, async (uri) => {
+      const result = mgr.readResource(uri.href);
+      if (!result) {
         return {
-          content: [
+          contents: [
             {
-              type: "text",
+              uri: uri.href,
+              mimeType: "text/plain",
               text: JSON.stringify({
-                query: result.query,
-                totalMatches: filteredTools.length,
-                detailLevel,
-                searchMode: result.searchMode,
-                embeddingsAvailable: this.retriever.hasEmbeddings(),
-                tools,
-                guidance,
-                ...suggestedTools && { suggestedTools }
+                error: "Resource not found or expired"
               })
             }
           ]
         };
-      } finally {
-        const responseTime = Date.now() - startTime;
-        this.statsCollector.endRequest(requestId, success, responseTime, "find_tools", "mcp-squared");
       }
-    }));
-    server.registerTool("describe_tools", {
-      title: "Inspect Tool Schemas",
-      description: "After find_tools, fetch full JSON schemas for selected tools to validate required arguments before execution.",
-      annotations: {
-        readOnlyHint: true,
-        openWorldHint: false
-      },
-      inputSchema: {
-        tool_names: z3.array(z3.string()).min(1).max(20).describe("List of tool names to get schemas for")
+      return result;
+    });
+  }
+  runTaskSpan(taskName, run) {
+    return task_span(this.obsSink, {
+      agent: this.safetyAgent,
+      taskName,
+      playbook: this.guard.playbook,
+      env: this.guard.agentEnv
+    }, run);
+  }
+  capabilityTitle(capability) {
+    return capabilityTitle(capability);
+  }
+  capabilitySummary(capability) {
+    return capabilitySummary(capability);
+  }
+  actionSummary(description, capability) {
+    if (typeof description === "string") {
+      const singleLine = description.split(/\r?\n/, 1)[0]?.trim() ?? "";
+      if (singleLine.length > 0) {
+        return singleLine;
       }
-    }, async (args) => this.runTaskSpan("describe_tools", async () => {
-      const requestId = this.statsCollector.startRequest();
-      const startTime = Date.now();
-      let success = false;
-      try {
-        const result = this.retriever.getTools(args.tool_names);
-        const filteredTools = this.filterToolsByPolicy(result.tools);
-        const schemas = filteredTools.map((tool) => ({
-          name: tool.name,
-          qualifiedName: `${tool.serverKey}:${tool.name}`,
-          description: tool.description,
-          serverKey: tool.serverKey,
-          inputSchema: tool.inputSchema,
-          ...tool.requiresConfirmation && { requiresConfirmation: true }
-        }));
-        const toolKey = (tool) => `${tool.serverKey}:${tool.name}`;
-        const filteredKeys = new Set(filteredTools.map(toolKey));
-        const blocked = result.tools.filter((tool) => !filteredKeys.has(toolKey(tool))).map(toolKey);
-        const foundQualified = new Set(result.tools.map(toolKey));
-        const foundBare = new Set(result.tools.map((t) => t.name));
-        const ambiguousNames = new Set(result.ambiguous.map((a) => a.name));
-        const notFound = args.tool_names.filter((name) => !ambiguousNames.has(name) && !foundQualified.has(name) && !foundBare.has(name));
-        success = true;
-        return {
-          content: [
-            {
-              type: "text",
-              text: JSON.stringify({
-                schemas,
-                ambiguous: result.ambiguous.length > 0 ? result.ambiguous : undefined,
-                notFound: notFound.length > 0 ? notFound : undefined,
-                blocked: blocked.length > 0 ? blocked : undefined
-              })
-            }
-          ]
-        };
-      } finally {
-        const responseTime = Date.now() - startTime;
-        this.statsCollector.endRequest(requestId, success, responseTime, "describe_tools", "mcp-squared");
+    }
+    return `Execute ${this.capabilityTitle(capability)} action`;
+  }
+  buildCapabilityRouters() {
+    const status = this.cataloger.getStatus();
+    const inventories = [...status.entries()].filter(([, info]) => info.status === "connected").map(([namespace]) => ({
+      namespace,
+      title: this.config.upstreams[namespace]?.label ?? namespace,
+      tools: this.cataloger.getToolsForServer(namespace)
+    })).sort((a, b) => a.namespace.localeCompare(b.namespace));
+    if (inventories.length === 0) {
+      return [];
+    }
+    const overrides = {
+      ...this.computedCapabilityOverrides,
+      ...this.config.operations.dynamicToolSurface.capabilityOverrides
+    };
+    const grouping = groupNamespacesByCapability(inventories, overrides);
+    return buildCapabilityRouters(inventories, grouping, (desc, cap) => this.actionSummary(desc, cap));
+  }
+  getCapabilityRouter(capability) {
+    return this.buildCapabilityRouters().find((router) => router.capability === capability) ?? {
+      capability,
+      actions: []
+    };
+  }
+  registerCapabilityRouters(server) {
+    const routers = this.buildCapabilityRouters();
+    for (const router of routers) {
+      if (router.actions.length === 0) {
+        continue;
       }
-    }));
-    server.registerTool("execute", {
-      title: "Execute Upstream Tool",
-      description: "Execute an upstream tool after find_tools/describe_tools selection. The tool must exist and the arguments must match its schema.",
-      annotations: {
-        readOnlyHint: false,
-        destructiveHint: false,
-        openWorldHint: true
-      },
-      inputSchema: {
-        tool_name: z3.string().describe("Name of the tool to execute"),
-        arguments: z3.record(z3.string(), z3.unknown()).default({}).describe("Arguments to pass to the tool"),
-        confirmation_token: z3.string().optional().describe("Optional confirmation token for tools that require explicit confirmation")
-      }
-    }, async (args) => this.runTaskSpan("execute", async () => {
-      const requestId = this.statsCollector.startRequest();
-      const startTime = Date.now();
-      let success = false;
-      let toolName;
-      let serverKey;
-      try {
-        const lookupResult = this.cataloger.findTool(args.tool_name);
-        if (lookupResult.ambiguous) {
-          return {
-            content: [
-              {
-                type: "text",
-                text: JSON.stringify({
-                  error: `Ambiguous tool name "${args.tool_name}". Use a qualified name.`,
-                  alternatives: lookupResult.alternatives
-                })
-              }
-            ],
-            isError: true
-          };
-        }
-        if (!lookupResult.tool) {
-          return {
-            content: [
-              {
-                type: "text",
-                text: JSON.stringify({
-                  error: `Tool not found: ${args.tool_name}`
-                })
-              }
-            ],
-            isError: true
-          };
+      const capability = router.capability;
+      server.registerTool(capability, {
+        title: this.capabilityTitle(capability),
+        description: this.capabilitySummary(capability),
+        annotations: {
+          readOnlyHint: false,
+          destructiveHint: false,
+          openWorldHint: true
+        },
+        inputSchema: {
+          action: z3.string().describe(`Action ID for ${capability}. Use "${DESCRIBE_ACTION2}" to inspect available actions and schemas.`),
+          arguments: z3.record(z3.string(), z3.unknown()).default({}).describe("Arguments for the selected capability action"),
+          confirmation_token: z3.string().optional().describe("Optional confirmation token for actions that require explicit confirmation")
         }
-        const tool = lookupResult.tool;
-        toolName = tool.name;
-        serverKey = tool.serverKey;
-        const policyResult = evaluatePolicy({
-          serverKey: tool.serverKey,
-          toolName: tool.name,
-          confirmationToken: args.confirmation_token
-        }, this.config);
-        if (policyResult.decision === "block") {
+      }, async (rawArgs) => this.runTaskSpan(capability, async () => {
+        const requestId = this.statsCollector.startRequest();
+        const startTime = Date.now();
+        let success = false;
+        try {
+          const liveRouter = this.getCapabilityRouter(capability);
+          const parsedArgs = isRecord3(rawArgs) ? { ...rawArgs } : {};
+          const action = typeof parsedArgs["action"] === "string" ? parsedArgs["action"] : "";
+          const confirmationToken = typeof parsedArgs["confirmation_token"] === "string" ? parsedArgs["confirmation_token"] : undefined;
+          const actionArgs = isRecord3(parsedArgs["arguments"]) ? parsedArgs["arguments"] : {};
+          if (action.length === 0) {
+            return {
+              content: [
+                {
+                  type: "text",
+                  text: JSON.stringify({
+                    error: "Missing required action",
+                    capability
+                  })
+                }
+              ],
+              isError: true
+            };
+          }
+          const visibleRoutes = liveRouter.actions.map((route) => {
+            const visibility = getToolVisibilityCompiled(capability, route.action, this.compiledPolicy);
+            if (!visibility.visible) {
+              return null;
+            }
+            return {
+              route,
+              requiresConfirmation: visibility.requiresConfirmation
+            };
+          }).filter((entry) => entry !== null);
+          const visibleActions = visibleRoutes.map(({ route, requiresConfirmation }) => {
+            const actionInfo = {
+              action: route.action,
+              summary: route.summary,
+              inputSchema: route.inputSchema,
+              requiresConfirmation
+            };
+            if ((route.collisionGroupSize ?? 1) > 1) {
+              actionInfo.baseAction = route.baseAction;
+              actionInfo.instance = route.instanceKey ?? route.serverKey;
+              actionInfo.instanceTitle = route.instanceTitle ?? route.instanceKey ?? route.serverKey;
+            }
+            return actionInfo;
+          }).sort((a, b) => a.action.localeCompare(b.action));
+          if (action === DESCRIBE_ACTION2) {
+            success = true;
+            return {
+              content: [
+                {
+                  type: "text",
+                  text: JSON.stringify({
+                    capability,
+                    actions: visibleActions,
+                    totalActions: visibleActions.length
+                  })
+                }
+              ]
+            };
+          }
+          const exactRoute = liveRouter.actions.find((entry) => entry.action === action || (entry.legacyActions ?? []).includes(action));
+          const ambiguousCandidates = visibleRoutes.filter(({ route }) => route.baseAction === action).map(({ route }) => route.action).sort((a, b) => a.localeCompare(b));
+          if (ambiguousCandidates.length > 1) {
+            return {
+              content: [
+                {
+                  type: "text",
+                  text: JSON.stringify({
+                    requires_disambiguation: true,
+                    capability,
+                    action,
+                    candidates: ambiguousCandidates
+                  })
+                }
+              ],
+              isError: true
+            };
+          }
+          const selectedRoute = exactRoute ?? (ambiguousCandidates.length === 1 ? visibleRoutes.find(({ route }) => route.baseAction === action)?.route : undefined);
+          if (selectedRoute == null) {
+            return {
+              content: [
+                {
+                  type: "text",
+                  text: JSON.stringify({
+                    error: "Unknown action",
+                    capability,
+                    action,
+                    availableActions: visibleActions.map((a) => a.action)
+                  })
+                }
+              ],
+              isError: true
+            };
+          }
+          const callResult = await this.executeRoutedTool({
+            capability,
+            action: selectedRoute.action,
+            policyAction: exactRoute != null ? action : selectedRoute.action,
+            routeId: selectedRoute.canonicalRouteId ?? `${capability}:${selectedRoute.action}`,
+            qualifiedToolName: selectedRoute.qualifiedName,
+            toolNameForCall: selectedRoute.qualifiedName,
+            args: actionArgs,
+            ...confirmationToken != null ? { confirmationToken } : {}
+          });
+          success = !callResult.isError;
+          return callResult;
+        } catch {
           return {
             content: [
               {
                 type: "text",
                 text: JSON.stringify({
-                  error: policyResult.reason,
-                  blocked: true
+                  error: "Action execution failed"
                 })
               }
             ],
             isError: true
           };
+        } finally {
+          const responseTime = Date.now() - startTime;
+          this.statsCollector.endRequest(requestId, success, responseTime, capability, "capability");
         }
-        if (policyResult.decision === "confirm") {
-          return {
-            content: [
-              {
-                type: "text",
-                text: JSON.stringify({
-                  requires_confirmation: true,
-                  confirmation_token: policyResult.confirmationToken,
-                  message: policyResult.reason
-                })
-              }
-            ],
-            isError: false
-          };
-        }
-        const qualifiedToolName = `${tool.serverKey}:${tool.name}`;
-        this.guard.enforce({
-          agent: this.safetyAgent,
-          tool: qualifiedToolName,
-          action: "call",
-          params: args.arguments
-        });
-        const result = await tool_span(this.obsSink, {
-          agent: this.safetyAgent,
-          tool: qualifiedToolName,
-          action: "call",
-          playbook: this.guard.playbook,
-          env: this.guard.agentEnv
-        }, () => this.cataloger.callTool(args.tool_name, args.arguments));
-        if (!result.isError && this.config.operations.selectionCache.enabled) {
-          const toolKey = `${tool.serverKey}:${tool.name}`;
-          this.selectionTracker.trackToolUsage(toolKey);
-          if (this.selectionTracker.getSessionToolCount() >= 2) {
-            this.selectionTracker.flushToStore(this.retriever.getIndexStore());
-          }
-        }
-        success = !result.isError;
-        return {
-          content: result.content.map((c) => {
-            if (typeof c === "object" && c !== null && "type" in c) {
-              return c;
-            }
-            return {
-              type: "text",
-              text: JSON.stringify(c)
-            };
-          }),
-          isError: result.isError
-        };
-      } catch (err) {
-        const errorMessage2 = err instanceof Error ? err.message : String(err);
-        return {
-          content: [
-            {
-              type: "text",
-              text: JSON.stringify({
-                error: errorMessage2
-              })
-            }
-          ],
-          isError: true
-        };
-      } finally {
-        const responseTime = Date.now() - startTime;
-        this.statsCollector.endRequest(requestId, success, responseTime, toolName, serverKey);
-      }
-    }));
-    server.registerTool("clear_selection_cache", {
-      title: "Reset Selection Cache",
-      description: "Clears all learned tool co-occurrence patterns. Use this to reset the selection cache if suggestions become stale or irrelevant.",
-      annotations: {
-        readOnlyHint: false,
-        destructiveHint: true,
-        idempotentHint: true,
-        openWorldHint: false
-      },
-      inputSchema: {}
-    }, async () => this.runTaskSpan("clear_selection_cache", async () => {
-      const requestId = this.statsCollector.startRequest();
-      const startTime = Date.now();
-      let success = false;
-      try {
-        const countBefore = this.retriever.getIndexStore().getCooccurrenceCount();
-        this.retriever.getIndexStore().clearCooccurrences();
-        this.selectionTracker.reset();
-        success = true;
-        return {
-          content: [
-            {
-              type: "text",
-              text: JSON.stringify({
-                message: "Selection cache cleared",
-                patternsRemoved: countBefore
-              })
-            }
-          ]
-        };
-      } finally {
-        const responseTime = Date.now() - startTime;
-        this.statsCollector.endRequest(requestId, success, responseTime, "clear_selection_cache", "mcp-squared");
-      }
-    }));
-    server.registerTool("list_namespaces", {
-      title: "List Upstream Namespaces",
-      description: "List available namespaces (upstream MCP servers) and optional tool names. Use this to discover routing options and disambiguate qualified names (namespace:tool_name).",
-      annotations: {
-        readOnlyHint: true,
-        openWorldHint: false
-      },
-      inputSchema: {
-        include_tools: z3.boolean().default(false).describe("If true, includes the list of tool names available in each namespace")
+      }));
+    }
+  }
+  normalizeToolResultContent(content) {
+    return content.map((entry) => {
+      if (typeof entry === "object" && entry !== null && "type" in entry) {
+        return entry;
       }
-    }, async (args) => this.runTaskSpan("list_namespaces", async () => {
-      const requestId = this.statsCollector.startRequest();
-      const startTime = Date.now();
-      let success = false;
-      try {
-        const status = this.cataloger.getStatus();
-        const namespaces = [];
-        for (const [key, info] of status) {
-          const tools = this.cataloger.getToolsForServer(key);
-          const namespace = {
-            name: key,
-            status: info.status,
-            toolCount: tools.length
-          };
-          if (info.error) {
-            namespace.error = info.error;
+      return {
+        type: "text",
+        text: JSON.stringify(entry)
+      };
+    });
+  }
+  async executeRoutedTool(args) {
+    const policyResult = evaluatePolicy({
+      capability: args.capability,
+      action: args.policyAction ?? args.action,
+      confirmationToken: args.confirmationToken
+    }, this.config);
+    if (policyResult.decision === "block") {
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify({
+              error: "Action blocked by security policy",
+              blocked: true
+            })
           }
-          if (args.include_tools && tools.length > 0) {
-            namespace.tools = tools.map((t) => t.name);
+        ],
+        isError: true
+      };
+    }
+    if (policyResult.decision === "confirm") {
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify({
+              requires_confirmation: true,
+              confirmation_token: policyResult.confirmationToken,
+              message: "Action requires confirmation by security policy"
+            })
           }
-          namespaces.push(namespace);
-        }
-        const conflicts = this.cataloger.getConflictingTools();
-        const conflictingTools = {};
-        for (const [toolName, qualifiedNames] of conflicts) {
-          conflictingTools[toolName] = qualifiedNames;
-        }
-        success = true;
+        ],
+        isError: false
+      };
+    }
+    this.guard.enforce({
+      agent: this.safetyAgent,
+      tool: args.routeId ?? `${args.capability}:${args.action}`,
+      action: "call",
+      params: args.args
+    });
+    const result = await tool_span(this.obsSink, {
+      agent: this.safetyAgent,
+      tool: args.routeId ?? `${args.capability}:${args.action}`,
+      action: "call",
+      playbook: this.guard.playbook,
+      env: this.guard.agentEnv
+    }, () => this.cataloger.callTool(args.toolNameForCall, args.args));
+    if (!result.isError && this.config.operations.selectionCache.enabled) {
+      const toolKey = args.routeId ?? `${args.capability}:${args.action}`;
+      this.selectionTracker.trackToolUsage(toolKey);
+      if (this.selectionTracker.getSessionToolCount() >= 2) {
+        this.selectionTracker.flushToStore(this.retriever.getIndexStore());
+      }
+    }
+    const normalizedContent = this.normalizeToolResultContent(result.content);
+    const structuredContent = result.structuredContent;
+    if (!result.isError && this.responseResourceManager.isEnabled() && this.responseResourceManager.shouldOffload(normalizedContent)) {
+      try {
+        const offloaded = this.responseResourceManager.offload(normalizedContent, { capability: args.capability, action: args.action });
         return {
-          content: [
-            {
-              type: "text",
-              text: JSON.stringify({
-                namespaces,
-                totalNamespaces: namespaces.length,
-                connectedCount: namespaces.filter((n) => n.status === "connected").length,
-                ...Object.keys(conflictingTools).length > 0 && {
-                  conflictingTools,
-                  conflictNote: "These tools exist on multiple servers. Use qualified names (namespace:tool_name) to disambiguate."
-                }
-              })
-            }
-          ]
+          content: offloaded.inlineContent,
+          isError: false,
+          ...structuredContent != null ? { structuredContent } : {}
         };
-      } finally {
-        const responseTime = Date.now() - startTime;
-        this.statsCollector.endRequest(requestId, success, responseTime, "list_namespaces", "mcp-squared");
-      }
-    }));
-  }
-  formatToolsForDetailLevel(tools, level) {
-    switch (level) {
-      case "L0":
-        return tools.map((t) => ({
-          name: t.name,
-          serverKey: t.serverKey,
-          ...t.requiresConfirmation && { requiresConfirmation: true }
-        }));
-      case "L2": {
-        return tools.map((t) => {
-          const { tool } = this.cataloger.findTool(`${t.serverKey}:${t.name}`);
-          return {
-            name: t.name,
-            description: t.description,
-            serverKey: t.serverKey,
-            inputSchema: tool?.inputSchema ?? { type: "object" },
-            ...t.requiresConfirmation && { requiresConfirmation: true }
-          };
-        });
-      }
-      default:
-        return tools.map((t) => ({
-          name: t.name,
-          description: t.description,
-          serverKey: t.serverKey,
-          ...t.requiresConfirmation && { requiresConfirmation: true }
-        }));
+      } catch {}
     }
+    return {
+      content: normalizedContent,
+      isError: result.isError ?? false,
+      ...structuredContent != null ? { structuredContent } : {}
+    };
   }
   syncIndex() {
     this.retriever.syncFromCataloger();
@@ -8363,8 +9244,39 @@ class McpSquaredServer {
   getToolStats(limit = 100) {
     return this.statsCollector.getToolStats(limit);
   }
+  async classifyNamespacesSemantic() {
+    const generator = this.retriever.getEmbeddingGenerator();
+    if (!generator) {
+      console.error("[mcp\xB2] Hybrid inference: embeddings not available, falling back to heuristic.");
+      return;
+    }
+    try {
+      const { SemanticCapabilityClassifier: SemanticCapabilityClassifier2 } = await Promise.resolve().then(() => (init_semantic_classifier(), exports_semantic_classifier));
+      const threshold = this.config.operations.dynamicToolSurface.semanticConfidenceThreshold;
+      const classifier = new SemanticCapabilityClassifier2(generator, {
+        confidenceThreshold: threshold
+      });
+      await classifier.initializeReferences();
+      const status = this.cataloger.getStatus();
+      const inventories = [...status.entries()].filter(([, info]) => info.status === "connected").map(([namespace]) => ({
+        namespace,
+        tools: this.cataloger.getToolsForServer(namespace)
+      }));
+      const result = await classifier.classifyBatch(inventories);
+      this.computedCapabilityOverrides = result.overrides;
+      const count = Object.keys(result.overrides).length;
+      console.error(`[mcp\xB2] Hybrid inference: classified ${count}/${inventories.length} namespaces semantically (${Math.round(result.inferenceMs)}ms).`);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      console.error(`[mcp\xB2] Hybrid inference: classification failed \u2014 ${message}. Falling back to heuristic.`);
+    }
+  }
   async start() {
     await this.startCore();
+    if (!this.baseToolsRegistered) {
+      this.registerConfiguredToolSurface(this.mcpServer);
+      this.baseToolsRegistered = true;
+    }
     this.transport = new StdioServerTransport2;
     await this.mcpServer.connect(this.transport);
     this.statsCollector.incrementActiveConnections();
@@ -8402,6 +9314,9 @@ class McpSquaredServer {
         console.error(`[mcp\xB2] Embeddings: initialization failed \u2014 ${message}. Falling back to fast (FTS5) search.`);
       }
     }
+    if (this.config.operations.dynamicToolSurface.inference === "hybrid") {
+      await this.classifyNamespacesSemantic();
+    }
     this.statsCollector.updateIndexRefreshTime(Date.now());
     this.indexRefreshManager.start();
     await this.monitorServer.start();
@@ -8429,6 +9344,250 @@ class McpSquaredServer {
   }
 }
 
+// src/status/runner.ts
+init_inference();
+
+// src/utils/context-stats.ts
+var CHARS_PER_TOKEN_ESTIMATE = 4;
+function estimateTokens(text) {
+  return Math.ceil(text.length / CHARS_PER_TOKEN_ESTIMATE);
+}
+function reconstructCapabilityToolMetadata(router) {
+  return {
+    name: router.capability,
+    title: capabilityTitle(router.capability),
+    description: capabilitySummary(router.capability),
+    annotations: {
+      readOnlyHint: false,
+      destructiveHint: false,
+      openWorldHint: true
+    },
+    inputSchema: {
+      type: "object",
+      properties: {
+        action: {
+          type: "string",
+          description: `Action ID for ${router.capability}. Use "__describe_actions" to inspect available actions and schemas.`
+        },
+        arguments: {
+          type: "object",
+          additionalProperties: {},
+          default: {},
+          description: "Arguments for the selected capability action"
+        },
+        confirmation_token: {
+          type: "string",
+          description: "Optional confirmation token for actions that require explicit confirmation"
+        }
+      },
+      required: ["action"]
+    }
+  };
+}
+function computeContextStats(upstreamTools, routers) {
+  const withoutTokens = upstreamTools.reduce((sum, tool) => {
+    const serialized = JSON.stringify({
+      name: tool.name,
+      description: tool.description,
+      inputSchema: tool.inputSchema
+    });
+    return sum + estimateTokens(serialized);
+  }, 0);
+  const activeRouters = routers.filter((r) => r.actions.length > 0);
+  const withTokens = activeRouters.reduce((sum, router) => {
+    const meta = reconstructCapabilityToolMetadata(router);
+    return sum + estimateTokens(JSON.stringify(meta));
+  }, 0);
+  const saved = withoutTokens - withTokens;
+  const percent = withoutTokens > 0 ? saved / withoutTokens * 100 : 0;
+  return {
+    withoutMcp2Tokens: withoutTokens,
+    withMcp2Tokens: withTokens,
+    savedTokens: saved,
+    savedPercent: Math.round(percent * 10) / 10,
+    upstreamToolCount: upstreamTools.length,
+    capabilityToolCount: activeRouters.length
+  };
+}
+
+// src/status/runner.ts
+var GREEN = "\x1B[32m";
+var YELLOW = "\x1B[33m";
+var RED = "\x1B[31m";
+var DIM = "\x1B[90m";
+var BOLD = "\x1B[1m";
+var RESET = "\x1B[0m";
+async function collectStatus(config) {
+  const cataloger = new Cataloger({ connectTimeoutMs: 15000 });
+  const upstreams = [];
+  try {
+    await cataloger.connectAll(config);
+    const status = cataloger.getStatus();
+    for (const [name, serverConfig] of Object.entries(config.upstreams)) {
+      if (!serverConfig.enabled) {
+        upstreams.push({
+          name,
+          enabled: false,
+          status: "disconnected",
+          toolCount: 0
+        });
+        continue;
+      }
+      const connStatus = status.get(name);
+      const connection = cataloger.getConnection(name);
+      upstreams.push({
+        name,
+        enabled: true,
+        status: connStatus?.status ?? "disconnected",
+        error: connStatus?.error,
+        toolCount: connection?.tools.length ?? 0,
+        serverName: connection?.serverName,
+        serverVersion: connection?.serverVersion
+      });
+    }
+    const inventories = [...status.entries()].filter(([, info]) => info.status === "connected").map(([namespace]) => ({
+      namespace,
+      title: config.upstreams[namespace]?.label ?? namespace,
+      tools: cataloger.getToolsForServer(namespace)
+    })).sort((a, b) => a.namespace.localeCompare(b.namespace));
+    let routers = [];
+    if (inventories.length > 0) {
+      const overrides = config.operations.dynamicToolSurface.capabilityOverrides ?? {};
+      const grouping = groupNamespacesByCapability(inventories, overrides);
+      routers = buildCapabilityRouters(inventories, grouping);
+    }
+    const allUpstreamTools = inventories.flatMap((inv) => inv.tools);
+    const contextStats = computeContextStats(allUpstreamTools, routers);
+    return { upstreams, routers, contextStats };
+  } finally {
+    await cataloger.disconnectAll();
+  }
+}
+function formatStatus(result, options) {
+  const lines = [];
+  lines.push("");
+  lines.push(`${BOLD}MCP\xB2 Status Report${RESET}`);
+  lines.push("");
+  lines.push(`${DIM}\u2500\u2500 Upstream Servers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500${RESET}`);
+  if (result.upstreams.length === 0) {
+    lines.push(`  ${DIM}(no upstreams configured)${RESET}`);
+  }
+  for (const upstream of result.upstreams) {
+    if (!upstream.enabled) {
+      lines.push(`  ${DIM}\u2298 ${upstream.name.padEnd(24)} disabled${RESET}`);
+      continue;
+    }
+    if (upstream.status === "connected") {
+      const toolInfo = `(${upstream.toolCount} tool${upstream.toolCount !== 1 ? "s" : ""})`;
+      const version = upstream.serverVersion ? `  ${DIM}v${upstream.serverVersion}${RESET}` : "";
+      lines.push(`  ${GREEN}\u2713${RESET} ${upstream.name.padEnd(24)} connected  ${toolInfo}${version}`);
+    } else if (upstream.status === "needs_auth") {
+      const errorMsg = upstream.error ?? "Authentication required";
+      lines.push(`  ${YELLOW}\u26A0${RESET} ${upstream.name.padEnd(24)} needs auth ${DIM}${errorMsg}${RESET}`);
+    } else if (upstream.status === "error") {
+      const errorMsg = upstream.error ?? "Unknown error";
+      lines.push(`  ${RED}\u2717${RESET} ${upstream.name.padEnd(24)} error      ${DIM}${errorMsg}${RESET}`);
+    } else {
+      lines.push(`  ${DIM}? ${upstream.name.padEnd(24)} ${upstream.status}${RESET}`);
+    }
+  }
+  lines.push("");
+  lines.push(`${DIM}\u2500\u2500 Capability Routing \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500${RESET}`);
+  if (result.routers.length === 0) {
+    lines.push(`  ${DIM}(no capabilities routed \u2014 no connected upstreams)${RESET}`);
+  }
+  let totalActions = 0;
+  for (const router of result.routers) {
+    const count = router.actions.length;
+    totalActions += count;
+    const plural = count !== 1 ? "s" : "";
+    lines.push(`  ${BOLD}${router.capability}${RESET} ${DIM}(${count} action${plural})${RESET}`);
+    if (count === 0) {
+      lines.push(`    ${DIM}(no actions)${RESET}`);
+    }
+    for (const action of router.actions) {
+      const actionName = action.action.padEnd(28);
+      const mapping = `${DIM}\u2192${RESET} ${action.qualifiedName}`;
+      if (options.verbose) {
+        const schemaKeys = Object.keys(action.inputSchema?.properties ?? {});
+        const params = schemaKeys.length > 0 ? ` ${DIM}(${schemaKeys.join(", ")})${RESET}` : "";
+        lines.push(`    ${actionName} ${mapping}${params}`);
+      } else {
+        lines.push(`    ${actionName} ${mapping}`);
+      }
+    }
+    lines.push("");
+  }
+  if (options.verbose && result.contextStats) {
+    const cs = result.contextStats;
+    if (cs.upstreamToolCount > 0) {
+      lines.push(`${DIM}\u2500\u2500 Context Savings \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500${RESET}`);
+      const fmt = (n) => n.toLocaleString("en-US");
+      const withoutLabel = `Without MCP\xB2:`;
+      const withLabel = `With MCP\xB2:`;
+      const savedLabel = `Saved:`;
+      lines.push(`  ${withoutLabel.padEnd(16)} ${fmt(cs.withoutMcp2Tokens).padStart(8)} tokens  ${DIM}(${cs.upstreamToolCount} tool${cs.upstreamToolCount !== 1 ? "s" : ""})${RESET}`);
+      lines.push(`  ${withLabel.padEnd(16)} ${fmt(cs.withMcp2Tokens).padStart(8)} tokens  ${DIM}(${cs.capabilityToolCount} tool${cs.capabilityToolCount !== 1 ? "s" : ""})${RESET}`);
+      if (cs.savedTokens > 0) {
+        lines.push(`  ${DIM}${"\u2500".repeat(40)}${RESET}`);
+        lines.push(`  ${GREEN}${savedLabel.padEnd(16)} ${fmt(cs.savedTokens).padStart(8)} tokens  (${cs.savedPercent}%)${RESET}`);
+      }
+      lines.push("");
+    }
+  }
+  const connected = result.upstreams.filter((u) => u.status === "connected").length;
+  const needsAuth = result.upstreams.filter((u) => u.status === "needs_auth").length;
+  const errors = result.upstreams.filter((u) => u.status === "error").length;
+  const disabled = result.upstreams.filter((u) => !u.enabled).length;
+  const capCount = result.routers.filter((r) => r.actions.length > 0).length;
+  const parts = [];
+  if (connected > 0)
+    parts.push(`${GREEN}${connected} connected${RESET}`);
+  if (needsAuth > 0)
+    parts.push(`${YELLOW}${needsAuth} needs auth${RESET}`);
+  if (errors > 0)
+    parts.push(`${RED}${errors} error${RESET}`);
+  if (disabled > 0)
+    parts.push(`${DIM}${disabled} disabled${RESET}`);
+  const actionSummary = totalActions > 0 ? `${totalActions} action${totalActions !== 1 ? "s" : ""} across ${capCount} capabilit${capCount !== 1 ? "ies" : "y"}` : "no actions";
+  lines.push(`${DIM}Summary:${RESET} ${parts.join(", ")} | ${actionSummary}`);
+  lines.push("");
+  return lines.join(`
+`);
+}
+async function runStatus(options) {
+  let config;
+  let configPath;
+  try {
+    const loaded = await loadConfig();
+    config = loaded.config;
+    configPath = loaded.path;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(`Error loading configuration: ${message}`);
+    console.error("Run 'mcp-squared config' to create or fix your configuration.");
+    process.exit(1);
+  }
+  const upstreamEntries = Object.entries(config.upstreams);
+  if (upstreamEntries.length === 0) {
+    console.error("Error: No upstreams configured. Run 'mcp-squared config' to add one.");
+    process.exit(1);
+  }
+  const validationIssues = validateConfig(config);
+  if (validationIssues.length > 0) {
+    console.error(formatValidationIssues(validationIssues));
+    console.error("");
+  }
+  if (options.verbose && configPath) {
+    console.log(`${DIM}Config: ${configPath}${RESET}`);
+  }
+  console.log("Connecting to upstream servers...");
+  const result = await collectStatus(config);
+  result.configPath = configPath;
+  const output = formatStatus(result, options);
+  console.log(output);
+}
+
 // src/index.ts
 function logSecurityProfile(config) {
   const { allow, confirm } = config.security.tools;
@@ -9153,6 +10312,9 @@ async function main(argv = process.argv.slice(2)) {
     case "monitor":
       await runMonitor(args.monitor);
       break;
+    case "status":
+      await runStatus({ verbose: args.testVerbose });
+      break;
     case "daemon":
       await runDaemon(args.daemon);
       break;