nylorun 0.11.1-beta → 0.12.0-beta

package/CHANGELOG.md

@@ -1,5 +1,55 @@
 # nylorun
 
+## 0.12.0-beta
+
+### Major Changes
+
+- 50e2f7e: **Protocol 10: MCP credentials come from a session's vaults only.** Nylorun no longer signs the installation in to MCP servers with OAuth and no longer asks a credential resolver. Upgrade every package together; MIGRATION.md has the details.
+
+  - **Breaking (`@nylorun/runtime`): the MCP OAuth connect is gone.** `POST /v1/tenant/vaults/{vaultId}/oauth/start` and `GET /v1/oauth/callback` answer `404`. The vault credential type `oauth` and its refresh are gone: a credential is a `bearer` token or a `headers` map bound to a URL. Migration `0016_mcp_oauth_removed` drops the table of pending connects and deletes every `oauth` credential, writing one audit row each (actor `migration`); the Runtime logs `oauth_credential_removed` once for each, naming its vault, id and URL.
+  - **Breaking (`@nylorun/runtime`): the credential resolver is gone.** The gateway no longer asks the operator's resolver for a person's credential when the session's vaults hold none. A process that still sets a `NYLORUN_RESOLVER_*` variable logs `resolver_removed` and ignores it. Keep a person's own keys in their user vault and attach it to their sessions (`vaultIds`). `TenantConfig.resolver`, `TenantConfig.publicUrl`, `TenantConfig.vaultFetch`, `startEphemeralRuntime({ resolver })`, the `ResolverConfig` export and `VaultService`'s `fetch` option are removed; `NYLORUN_PUBLIC_URL` still sets the protected resource metadata's `resource`.
+  - **Breaking (`@nylorun/core`):** `PROTOCOL_VERSION` is 10 and `HOST_PROTOCOL` 4–10. `StartOAuthRequest`, `StartOAuthResponse`, the `oauth` variants of `CreateCredentialRequest` and `RotateCredentialRequest`, `oauth` in `CredentialInfo.type` and `CredentialInfo.expiresAt` are removed, and `ERROR_CODES` drops `oauth_client_required`, `oauth_state_invalid` and `oauth_failed`. `@nylorun/agents` and `@nylorun/cli` send protocol 10.
+  - **Breaking (`@nylorun/admin`):** `admin.vaults` loses its OAuth start method.
+  - **Breaking (`nylorun`):** the `connect` subcommand of `nylorun mcp` is removed (`nylorun mcp inspect` lists a server's tools instead), and the gateway's Compose service no longer passes the `NYLORUN_RESOLVER_*` variables.
+  - `@nylorun/studio`: the Credentials page loses the OAuth type, the Expires column and the OAuth connect hint.
+
+### Minor Changes
+
+- da93711: **Preview an MCP server's tools** (R2b C12). MIGRATION.md (protocol 10, "Previewing a server's tools") has the details.
+
+  - `@nylorun/core`: `McpPreviewRequestSchema` and `McpPreviewSchema` (`McpPreviewTool`), and the error code `mcp_preview_failed`.
+  - `@nylorun/runtime`: `POST /v1/tenant/mcp/preview` (the Management API) connects to a remote MCP server with the installation vault's credential for its URL (headers and `via`, no identity header), under the Host's address policy and within 15 s, and answers its server info, instructions, tools (model names, annotations, schema sizes) and renames; a `401` is `authRequired`, with the server's RFC 9728 protected-resource metadata. It runs in the keys service (`Keys.previewMcp`), which holds the plaintext, and calls no tool. Both OpenAPI documents list it.
+  - `@nylorun/admin`: `admin.mcp.preview({ url, type?, name?, vaultId? })`.
+  - `nylorun`: `nylorun mcp inspect <url> [--server <name>] [--vault <id>] [--sse] [--json]` prints the running Tenant's preview: a table of tools, the renames, or that the server needs a person's sign-in. Its `connect` subcommand still says it was removed, and now points to `inspect`.
+  - `@nylorun/studio`: **Preview tools** on each credential of the Credentials page lists the tools behind its URL.
+
+### Patch Changes
+
+- fed5e58: **Docs: reaching a person's accounts** (R2b C5). The READMEs describe MCP credentials as protocol 10 has them (a `bearer` token or a `headers` map per URL, with `via` and an identity header for an MCP gateway), and point to "MCP servers and HTTP tools" in DEPLOYMENT.md: the operator's flow from credential to preview, tool settings, deferral, stored results and the error codes a model sees, with gateway recipes for Arcade, ToolHive, Obot and Nylorun Cloud and the proxy pattern for gateways that mint per person. `HttpToolTarget.credential`'s doc (`@nylorun/core`) no longer names the removed credential resolver.
+- Pin core to the tested release.
+- Pin runtime to the tested release.
+- Pin studio to the tested release.
+- Updated dependencies [50e2f7e]
+- Updated dependencies [e0e39ff]
+- Updated dependencies [fed5e58]
+- Updated dependencies [18f9a2f]
+- Updated dependencies [da93711]
+- Updated dependencies [90a817d]
+- Updated dependencies [b8d10cb]
+  - @nylorun/core@0.17.0-beta
+
+## 0.11.2-beta
+
+### Patch Changes
+
+- 6711320: `/ready` no longer checks S2: its `checks` cover the listener, the Tenant, Postgres and Restate, and an unreachable S2 leaves it `200`. S2 only serves API listeners (history, SSE, AG-UI and A2A), so an outage degrades those reads and never makes the Runtime unready. S2's reachability stays in the Tenant's status (`GET /v1/tenant`, `streams.reachable`).
+- Pin core to the tested release.
+- Pin runtime to the tested release.
+- Pin studio to the tested release.
+- Updated dependencies [cf5eb9c]
+- Updated dependencies [2ed5fe0]
+  - @nylorun/core@0.16.0-beta
+
 ## 0.11.1-beta
 
 ### Patch Changes

package/README.md

@@ -49,7 +49,7 @@ nylorun sandbox rm <id> [--tenant <name>]   # delete a sandbox and its files
 nylorun key put <id> [--management] [--tenant <name>]   # create or rotate the Tenant's application key <id> (--management: a management key); prints it once
 nylorun key list [--tenant <name>] [--json] # the Tenant's keys: id, role, when issued
 nylorun key rm <id> [--tenant <name>]       # delete a key: it stops working at once
-nylorun mcp connect <url> --server <name> [--vault <id>] [--client-id <id>] [--tenant <name>] [--no-open]   # sign the Tenant in to a remote MCP server with OAuth
+nylorun mcp inspect <url> [--server <name>] [--vault <id>] [--sse] [--tenant <name>] [--json]   # a remote MCP server's tools, with the installation vault's credential
 nylorun doctor [--json]            # prerequisites and the Tenant's health
 nylorun telemetry [status|enable|disable]   # Studio's anonymous usage analytics
 nylorun sandbox enable --context <name> [--tenant <name>] [--host-address <ip>] [--bind-address <ip>] [--no-pull]
@@ -60,7 +60,9 @@ nylorun sandbox status [--tenant <name>] [--json]   # pods on a Kubernetes conte
 `up` and `down` are the Docker Compose spellings of `start` and `stop`: `down`
 stops the containers and keeps the volumes, so no Tenant data is lost. Removed
 commands exit 2 naming the replacement: `nylorun dev`, `nylorun configure`,
-`nylorun status --env` and `nylorun doctor sandbox`.
+`nylorun status --env`, `nylorun doctor sandbox` and the MCP OAuth `connect`
+subcommand of `nylorun mcp` (protocol 10: add a key or a gateway credential to a
+vault instead, and preview the server with `nylorun mcp inspect`).
 
 ## Tenants
 
@@ -186,17 +188,33 @@ key's id, role and when it was issued, never the keys; `nylorun key rm <id>`
 deletes one. Ids match `^[a-z][a-z0-9-]{0,31}$`; `studio` belongs to Studio and
 `bootstrap` to `NYLORUN_MANAGEMENT_KEY_FILE`, and both are refused. Putting an
 id that holds the other role is refused. Give each app server its own
-application key. `nylorun sandbox` and `nylorun mcp` use the linked project's
-keys, or the keys `cli` and `cli-management` they put once and keep in
+application key. `nylorun sandbox` and `nylorun mcp` use the linked project's keys, or the keys
+`cli` and `cli-management` they put once and keep in
 `<Host root>/cli-credentials.json` (mode 0600).
 
-`nylorun mcp connect <url> --server <name>` signs the running Tenant in to a
-remote MCP server that uses OAuth: it opens the server's sign-in page in the
-browser and waits until the Runtime has stored the credential in the
-installation vault `mcp` (created if needed; `--vault <id>` picks another),
-which sessions attach with `vaultIds`. Pass `--client-id` when the server does
-not let clients register themselves. See
-[Connecting a remote MCP server with OAuth](../DEPLOYMENT.md#connecting-a-remote-mcp-server-with-oauth).
+## MCP servers
+
+An agent names its MCP servers by URL; the operator gives each URL a vault
+credential, a `bearer` token or a `headers` map, with `via` and an identity
+header when an MCP gateway holds each person's sign-in. Add it on Studio's
+Credentials page or with `@nylorun/admin` (no `nylorun` command adds one); the
+whole flow, with gateway recipes, is in
+[DEPLOYMENT.md](../DEPLOYMENT.md#mcp-servers-and-http-tools).
+
+`nylorun mcp inspect <url>` shows what a remote MCP server offers before an
+agent names it, through the running Tenant's Management API
+(`POST /v1/tenant/mcp/preview`, with the management key). The Runtime connects
+with the installation vault's credential for `<url>` (`--vault <id>` picks the
+vault when several hold one), lists the tools within 15 s and calls none. It
+prints a table of each tool's model name, input schema size, hints
+(`read-only`, `destructive`, `idempotent`) and description, then the tools
+renamed for the model. `--server` is the server name your manifest uses (default:
+the host's name, `linear` for `mcp.linear.app`); `--sse` speaks the older SSE
+transport; `--json` prints the Runtime's answer. A server that answers `401`
+needs a credential: it says so, and names the server's sign-in from its
+protected-resource metadata, since such a server needs a key in a vault or an
+MCP gateway that holds each person's sign-in. A server it cannot list exits 1 with
+the reason (`mcp.unreachable` for an address the Runtime refuses).
 
 ## The containers
 

package/dist/cli.js

@@ -52,14 +52,14 @@ async function main() {
         process.exitCode = await sandboxCommand(args, baselineEnv());
         return;
     }
-    if (command === "mcp") {
-        process.exitCode = await mcpCommand(args, baselineEnv());
-        return;
-    }
     if (command === "key") {
         process.exitCode = await keyCommand(args, baselineEnv());
         return;
     }
+    if (command === "mcp") {
+        process.exitCode = await mcpCommand(args, baselineEnv());
+        return;
+    }
     if (isStackCommand(command)) {
         process.exitCode = await stackCommand(command, args, baselineEnv());
         return;

package/dist/stack/commands.d.ts

@@ -137,7 +137,7 @@ export interface StackEndpoints {
     /** This call started the Runtime (it was not running before). */
     started: boolean;
 }
-/** The running Tenant's APIs and their keys (`nylorun sandbox`, `nylorun mcp`). */
+/** The running Tenant's APIs and their keys (`nylorun sandbox`). */
 export interface TenantApi {
     /** The Tenant's name. */
     name: string;

package/dist/stack/compose-file.d.ts

@@ -9,7 +9,7 @@
  * secrets, UID/GID, the Host root, the images) comes from `docker/.env`.
  *
  * The Tenant's state is its Postgres database, executed through Restate, with its
- * history in s2-lite; the Runtime's /ready checks all three. Postgres initialises the
+ * history in s2-lite; the Runtime's /ready checks Postgres and Restate. Postgres initialises the
  * database with C collation (`--locale=C`) and runs with `wal_level=logical`: the stream
  * relay feeds s2-lite from the record over logical replication (Durable Streams), and
  * `max_slot_wal_keep_size` caps the WAL a stuck relay can hold. The Runtime creates the

package/dist/stack/compose-file.js

@@ -10,7 +10,7 @@ import { PINNED_IMAGES } from "./images.js";
  * secrets, UID/GID, the Host root, the images) comes from `docker/.env`.
  *
  * The Tenant's state is its Postgres database, executed through Restate, with its
- * history in s2-lite; the Runtime's /ready checks all three. Postgres initialises the
+ * history in s2-lite; the Runtime's /ready checks Postgres and Restate. Postgres initialises the
  * database with C collation (`--locale=C`) and runs with `wal_level=logical`: the stream
  * relay feeds s2-lite from the record over logical replication (Durable Streams), and
  * `max_slot_wal_keep_size` caps the WAL a stuck relay can hold. The Runtime creates the
@@ -131,8 +131,8 @@ ${restateUi ? RESTATE_UI : RESTATE_CLOSED}    healthcheck:
     volumes:
       - s2-lite:/home/nonroot
     networks: [store]
-    # The s2 image has no shell or HTTP client, so it has no health check;
-    # the Runtime's /ready covers it.
+    # The s2 image has no shell or HTTP client, so it has no health check.
+    # Its reachability is in the Tenant's status (GET /v1/tenant, streams.reachable).
     restart: unless-stopped
 
   rustfs: # the Object store (D35); not published, only the runtime and the gateway hold its credential
@@ -175,11 +175,7 @@ ${restateUi ? RESTATE_UI : RESTATE_CLOSED}    healthcheck:
       NYLORUN_OBJECT_STORE_ACCESS_KEY: nylorun
       NYLORUN_OBJECT_STORE_SECRET_KEY: \${NYLORUN_OBJECT_STORE_SECRET_KEY:?run nylorun start}
       # MCP servers and HTTP tools on this machine: \`localhost\` in their URLs means the Docker host.
-      NYLORUN_ENDPOINT_LOOPBACK: docker-host
-      # Your credential resolver, for people's own MCP credentials (DEPLOYMENT.md, Credentials);
-      # unset by default. Set both in the shell that runs \`nylorun start\`.
-      NYLORUN_RESOLVER_URL: \${NYLORUN_RESOLVER_URL:-}
-      NYLORUN_RESOLVER_TOKEN: \${NYLORUN_RESOLVER_TOKEN:-}${sandboxes ? SANDBOXES_GATEWAY_ENV : ""}
+      NYLORUN_ENDPOINT_LOOPBACK: docker-host${sandboxes ? SANDBOXES_GATEWAY_ENV : ""}
     extra_hosts:
       host.docker.internal: host-gateway # model servers, MCP servers and HTTP tools on this machine
     volumes:

package/dist/stack/index.d.ts

@@ -10,12 +10,12 @@ export declare function stackCommand(name: string, args: readonly string[], env:
 /** Entry for `nylorun sandbox ls|rm`. */
 export declare function sandboxCommand(args: readonly string[], env: Readonly<Record<string, string | undefined>>): Promise<number>;
 export { sandboxUsage } from "./sandbox.js";
-/** Entry for `nylorun mcp connect`. */
-export declare function mcpCommand(args: readonly string[], env: Readonly<Record<string, string | undefined>>): Promise<number>;
-export { mcpUsage } from "./mcp.js";
 /** Entry for `nylorun key put|list|rm`. */
 export declare function keyCommand(args: readonly string[], env: Readonly<Record<string, string | undefined>>): Promise<number>;
 export { keyUsage } from "./keys.js";
+/** Entry for `nylorun mcp inspect`. */
+export declare function mcpCommand(args: readonly string[], env: Readonly<Record<string, string | undefined>>): Promise<number>;
+export { mcpUsage } from "./mcp.js";
 /** `nylorun studio`, landing on `next` when given, else on the Tenant's page. */
 export declare function studioCommand(args: readonly string[], env: Readonly<Record<string, string | undefined>>, options?: {
     next?: string;

package/dist/stack/index.js

@@ -3,8 +3,8 @@ import { createInterface } from "node:readline/promises";
 import { runStackCommand, runStudioCommand } from "./commands.js";
 import { spawnDocker } from "./docker.js";
 import { keyCommand as runKeyCommand } from "./keys.js";
-import { sandboxCommand as runSandboxCommand } from "./sandbox.js";
 import { mcpCommand as runMcpCommand } from "./mcp.js";
+import { sandboxCommand as runSandboxCommand } from "./sandbox.js";
 import { pinnedVersion } from "./versions.js";
 import { loopbackPorts } from "./ports.js";
 export { ensureStack, isStackCommand, readStackStatus, stackUsage, studioLoginUrl, tenantStudioPath, STACK_SERVICES, } from "./commands.js";
@@ -86,16 +86,16 @@ export async function sandboxCommand(args, env) {
     return await runSandboxCommand(defaultStackDeps(env), args);
 }
 export { sandboxUsage } from "./sandbox.js";
-/** Entry for `nylorun mcp connect`. */
-export async function mcpCommand(args, env) {
-    return await runMcpCommand(defaultStackDeps(env), args);
-}
-export { mcpUsage } from "./mcp.js";
 /** Entry for `nylorun key put|list|rm`. */
 export async function keyCommand(args, env) {
     return await runKeyCommand(defaultStackDeps(env), args);
 }
 export { keyUsage } from "./keys.js";
+/** Entry for `nylorun mcp inspect`. */
+export async function mcpCommand(args, env) {
+    return await runMcpCommand(defaultStackDeps(env), args);
+}
+export { mcpUsage } from "./mcp.js";
 /** `nylorun studio`, landing on `next` when given, else on the Tenant's page. */
 export async function studioCommand(args, env, options = {}) {
     return await runStudioCommand(args, defaultStackDeps(env), options);

package/dist/stack/mcp.d.ts

@@ -1,8 +1,9 @@
+import type { McpPreview } from "@nylorun/core/contracts";
 import { type StackDeps } from "./commands.js";
-export declare const mcpUsage = "  mcp connect <url> --server <name> [--vault <id>] [--client-id <id>] [--tenant <name>] [--no-open]\n                                      sign the Tenant in to a remote MCP server with OAuth; the credential goes to the\n                                      installation vault mcp (or --vault), which sessions attach";
-/** The installation vault `connect` uses unless `--vault` names one. */
-export declare const MCP_VAULT_NAME = "mcp";
-/** How long `connect` waits for the browser sign-in: the Runtime keeps it for ten minutes. */
-export declare const CONNECT_TIMEOUT_MS: number;
-/** `nylorun mcp <connect> ...` */
+export declare const mcpUsage = "  mcp inspect <url> [--server <name>] [--vault <id>] [--sse] [--tenant <name>] [--json]\n                                      list a remote MCP server's tools with the installation vault's\n                                      credential for <url>: model names, schema sizes, renames, or\n                                      that it needs a person's sign-in (the Runtime calls no tool)";
+/** What the removed `connect` subcommand says since protocol 10. */
+export declare const MCP_CONNECT_REMOVED = "The connect subcommand of nylorun mcp was removed with MCP OAuth (protocol 10): add the server's key to an installation vault as a bearer or headers credential (Studio's Credentials page, or @nylorun/admin), or reach a server that needs a person's sign-in through a gateway (a credential with via). See its tools with nylorun mcp inspect <url>.";
+/** A preview as a person reads it: the server, a table of tools, the renames, or the sign-in hint. */
+export declare function previewLines(preview: McpPreview): string[];
+/** `nylorun mcp <inspect|connect> ...` */
 export declare function mcpCommand(deps: StackDeps, args: readonly string[]): Promise<number>;

package/dist/stack/mcp.js

@@ -1,114 +1,142 @@
 /**
- * `nylorun mcp connect <url> --server <name>`: signs the running local Tenant in to a remote MCP
- * server with OAuth (F9 C2), through its Management API with a management key (`runningTenantApi`).
- * The Runtime's keys module runs discovery, registration and the code exchange and seals the
- * credential in an installation vault (`mcp` unless `--vault` names one); this command only
- * opens the browser and waits for the credential to appear. It never starts the Tenant.
+ * `nylorun mcp inspect <url>`: a remote MCP server's tools before an agent names it (R2b C12),
+ * through the running local Tenant's Management API (`POST /v1/tenant/mcp/preview`) with the
+ * Project link's management key, else the Host root's (`runningTenantApi`). It never starts the
+ * Tenant, and the Runtime never calls a tool. Its `connect` subcommand (MCP OAuth) was removed
+ * in protocol 10, and says so.
  */
-import { randomUUID } from "node:crypto";
 import { PROTOCOL_HEADER, PROTOCOL_VERSION } from "@nylorun/core/compatibility";
 import { CliError } from "../errors.js";
 import { parseStackFlags, runningTenantApi } from "./commands.js";
-export const mcpUsage = `  mcp connect <url> --server <name> [--vault <id>] [--client-id <id>] [--tenant <name>] [--no-open]
-                                      sign the Tenant in to a remote MCP server with OAuth; the credential goes to the
-                                      installation vault mcp (or --vault), which sessions attach`;
-/** The installation vault `connect` uses unless `--vault` names one. */
-export const MCP_VAULT_NAME = "mcp";
-/** How long `connect` waits for the browser sign-in: the Runtime keeps it for ten minutes. */
-export const CONNECT_TIMEOUT_MS = 10 * 60_000;
+export const mcpUsage = `  mcp inspect <url> [--server <name>] [--vault <id>] [--sse] [--tenant <name>] [--json]
+                                      list a remote MCP server's tools with the installation vault's
+                                      credential for <url>: model names, schema sizes, renames, or
+                                      that it needs a person's sign-in (the Runtime calls no tool)`;
+const INSPECT_USAGE = "nylorun mcp inspect <url> [--server <name>] [--vault <id>] [--sse] [--tenant <name>] [--json]";
+/** What the removed `connect` subcommand says since protocol 10. */
+export const MCP_CONNECT_REMOVED = "The connect subcommand of nylorun mcp was removed with MCP OAuth (protocol 10): add the server's key to an installation vault as a bearer or headers credential (Studio's Credentials page, or @nylorun/admin), or reach a server that needs a person's sign-in through a gateway (a credential with via). See its tools with nylorun mcp inspect <url>.";
+/** The preview takes up to 15 s in the Runtime; the hop gets a margin. */
+const PREVIEW_TIMEOUT_MS = 30_000;
+const DESCRIPTION_CHARS = 60;
 const usageError = (message) => new CliError(message, 2);
-async function call(deps, api, method, path, body) {
-    const response = await deps.fetch(`${api.runtimeUrl}${path}`, {
-        method,
+async function inspect(deps, args) {
+    const flags = parseStackFlags(args, { booleans: ["--json", "--sse"], values: ["--server", "--vault", "--tenant"] }, INSPECT_USAGE);
+    if (flags.rest.length !== 1)
+        throw usageError(`Usage: ${INSPECT_USAGE}`);
+    const url = flags.rest[0];
+    const name = flags.values.get("--server");
+    const vaultId = flags.values.get("--vault");
+    const tenant = flags.values.get("--tenant");
+    const api = await runningTenantApi(deps, tenant === undefined ? {} : { name: tenant });
+    const response = await deps.fetch(`${api.runtimeUrl}/v1/tenant/mcp/preview`, {
+        method: "POST",
         headers: {
             authorization: `Bearer ${api.managementKey}`,
             [PROTOCOL_HEADER]: String(PROTOCOL_VERSION),
             accept: "application/json",
-            ...(body === undefined ? {} : { "content-type": "application/json" }),
+            "content-type": "application/json",
         },
-        ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+        body: JSON.stringify({
+            url,
+            ...(flags.booleans.has("--sse") ? { type: "sse" } : {}),
+            ...(name === undefined ? {} : { name }),
+            ...(vaultId === undefined ? {} : { vaultId }),
+        }),
         redirect: "error",
-        signal: AbortSignal.timeout(150_000),
+        signal: AbortSignal.timeout(PREVIEW_TIMEOUT_MS),
     });
-    const answer = (await response.json().catch(() => ({})));
-    if (!response.ok)
-        throw new CliError(`${method} ${path} returned ${response.status}${typeof answer.message === "string" ? `: ${answer.message}` : ""}`, 1);
-    return answer;
-}
-/** The URL as the vault binds it: origin, path and query, no default port, no fragment. */
-function bindingUrl(input) {
-    let url;
-    try {
-        url = new URL(input);
+    const body = (await response.json().catch(() => ({})));
+    if (response.status === 404 && body.code === "not_found")
+        throw new CliError(`Tenant ${api.name} runs a Runtime without MCP previews. Update it: npx nylorun@latest start.`, 1);
+    if (!response.ok) {
+        const details = body.details;
+        const failure = typeof details?.failure === "string" ? ` (${details.failure})` : "";
+        throw new CliError(typeof body.message === "string"
+            ? `${body.message}${failure}`
+            : `POST /v1/tenant/mcp/preview returned ${response.status}`, 1);
     }
-    catch {
-        throw usageError(`${input} is not a URL.`);
+    const preview = body;
+    if (flags.booleans.has("--json")) {
+        deps.out(JSON.stringify(preview, null, 2));
+        return 0;
     }
-    if (url.protocol !== "https:" && url.protocol !== "http:")
-        throw usageError(`${input} is not an http(s) URL.`);
-    if (url.username || url.password || url.hash)
-        throw usageError(`${input} must not carry userinfo or a fragment.`);
-    return `${url.origin}${url.pathname}${url.search}`;
+    for (const line of previewLines(preview))
+        deps.out(line);
+    return 0;
 }
-/** The installation vault named `mcp`, created when there is none. */
-async function mcpVault(deps, api) {
-    const { vaults } = await call(deps, api, "GET", "/v1/tenant/vaults");
-    const found = vaults.find((vault) => vault.ownerUserId === "installation" && vault.name === MCP_VAULT_NAME);
-    if (found)
-        return found;
-    const key = `nylorun-mcp-${randomUUID()}`;
-    return await call(deps, api, "POST", "/v1/tenant/vaults", {
-        requestId: key,
-        idempotencyKey: key,
-        name: MCP_VAULT_NAME,
-        scope: "installation",
-    });
+/** A preview as a person reads it: the server, a table of tools, the renames, or the sign-in hint. */
+export function previewLines(preview) {
+    const credential = preview.credentialSent
+        ? "with the installation vault's credential"
+        : "with no credential (no installation vault holds one for this URL)";
+    if (preview.authRequired) {
+        const metadata = preview.authRequired.resourceMetadata;
+        const servers = Array.isArray(metadata?.authorization_servers)
+            ? metadata.authorization_servers.filter((item) => typeof item === "string")
+            : [];
+        return [
+            preview.credentialSent
+                ? `The MCP server at ${preview.url} answered 401: it rejected the installation vault's credential.`
+                : `The MCP server at ${preview.url} answered 401: it needs a credential.`,
+            ...(servers.length > 0
+                ? [`It signs people in with ${servers.join(", ")} (${preview.authRequired.resourceMetadataUrl}).`]
+                : []),
+            "Nylorun holds no OAuth client: add the server's API key to an installation vault, or reach it",
+            "through a gateway that keeps each person's sign-in (a credential with via and an identity header).",
+        ];
+    }
+    const info = preview.serverInfo;
+    const label = info && typeof info.name === "string"
+        ? `${info.name}${typeof info.version === "string" ? ` ${info.version}` : ""}`
+        : preview.name;
+    const lines = [
+        `MCP server ${label} at ${preview.url}, ${credential}: ${preview.tools.length} ${preview.tools.length === 1 ? "tool" : "tools"}, named for the model as ${preview.name}__<tool>.`,
+    ];
+    if (preview.tools.length > 0) {
+        const rows = [
+            ["TOOL", "MODEL NAME", "SCHEMA", "HINTS", "DESCRIPTION"],
+            ...preview.tools.map((tool) => [
+                tool.serverToolName,
+                tool.modelName ?? "(left out: unusable input schema)",
+                `${tool.schemaBytes} B`,
+                hints(tool),
+                oneLine(tool.description ?? ""),
+            ]),
+        ];
+        const widths = rows[0].map((_, column) => Math.max(...rows.map((row) => row[column].length)));
+        lines.push("");
+        for (const row of rows)
+            lines.push(row
+                .map((cell, column) => (column === row.length - 1 ? cell : cell.padEnd(widths[column])))
+                .join("  ")
+                .trimEnd());
+    }
+    if (preview.renamed.length > 0) {
+        lines.push("", "Renamed for the model (characters outside A-Z, a-z, 0-9, _ and -, or past 64):");
+        for (const item of preview.renamed)
+            lines.push(`  ${item.serverToolName} -> ${item.name}`);
+    }
+    return lines;
 }
-/** Each credential of the vault bound to `url`, by id, with when it last changed. */
-async function credentialsFor(deps, api, vaultId, url) {
-    const { credentials } = await call(deps, api, "GET", `/v1/tenant/vaults/${encodeURIComponent(vaultId)}/credentials`);
-    return new Map(credentials
-        .filter((item) => item.type === "oauth" && item.binding.url === url)
-        .map((item) => [item.id, item.rotatedAt ?? item.createdAt]));
+function hints(tool) {
+    const annotations = tool.annotations ?? {};
+    const names = [
+        annotations.readOnlyHint === true ? "read-only" : undefined,
+        annotations.destructiveHint === true ? "destructive" : undefined,
+        annotations.idempotentHint === true ? "idempotent" : undefined,
+    ].filter((name) => name !== undefined);
+    return names.length === 0 ? "-" : names.join(",");
 }
-async function connect(deps, args) {
-    const usage = "nylorun mcp connect <url> --server <name> [--vault <id>] [--client-id <id>] [--tenant <name>] [--no-open]";
-    const flags = parseStackFlags(args, { booleans: ["--no-open"], values: ["--server", "--vault", "--client-id", "--tenant"] }, usage);
-    if (flags.rest.length !== 1)
-        throw usageError(`Usage: ${usage}`);
-    const server = flags.values.get("--server");
-    if (!server)
-        throw usageError(`--server names the MCP server, as the agent declares it. Usage: ${usage}`);
-    const url = bindingUrl(flags.rest[0]);
-    const clientId = flags.values.get("--client-id");
-    const name = flags.values.get("--tenant");
-    const api = await runningTenantApi(deps, name === undefined ? {} : { name });
-    const vaultId = flags.values.get("--vault") ?? (await mcpVault(deps, api)).id;
-    const before = await credentialsFor(deps, api, vaultId, url);
-    const started = await call(deps, api, "POST", `/v1/tenant/vaults/${encodeURIComponent(vaultId)}/oauth/start`, { url, server, ...(clientId === undefined ? {} : { clientId }) });
-    deps.out(`Sign in to ${server} in your browser:`);
-    deps.out(`  ${started.authorizeUrl}`);
-    if (!flags.booleans.has("--no-open"))
-        await deps.openBrowser(started.authorizeUrl);
-    deps.out("Waiting for the sign-in to finish…");
-    const deadline = Math.min(Date.now() + CONNECT_TIMEOUT_MS, Date.parse(started.expiresAt) || Infinity);
-    const pollMs = deps.pollMs ?? 1000;
-    while (Date.now() < deadline) {
-        await new Promise((resolve) => setTimeout(resolve, pollMs));
-        const now = await credentialsFor(deps, api, vaultId, url);
-        for (const [id, changed] of now)
-            if (before.get(id) !== changed) {
-                deps.out(`Connected ${server} (${url}): credential ${id} in installation vault ${vaultId}.`);
-                deps.out(`Sessions use it when they attach the vault: vaultIds: ["${vaultId}"].`);
-                return 0;
-            }
-    }
-    throw new CliError(`The sign-in to ${server} did not finish in time. Run "nylorun mcp connect" again; the browser page says why when the server refused it.`, 1);
+function oneLine(text) {
+    const flat = text.replace(/\s+/g, " ").trim();
+    return flat.length > DESCRIPTION_CHARS ? `${flat.slice(0, DESCRIPTION_CHARS - 1)}…` : flat;
 }
-/** `nylorun mcp <connect> ...` */
+/** `nylorun mcp <inspect|connect> ...` */
 export async function mcpCommand(deps, args) {
     const [sub, ...rest] = args;
+    if (sub === "inspect")
+        return inspect(deps, rest);
     if (sub === "connect")
-        return connect(deps, rest);
+        throw usageError(MCP_CONNECT_REMOVED);
     throw usageError(`Usage:\n${mcpUsage}`);
 }

package/dist/stack/operator-keys.d.ts

@@ -19,7 +19,8 @@ export declare function listOperatorKeys(endpoint: OperateEndpoint): Promise<Ope
 export declare function deleteOperatorKey(endpoint: OperateEndpoint, id: string): Promise<boolean>;
 /**
  * Whether `key` reaches the Tenant at `runtimeUrl`: one authenticated read (`GET /v1/me`, which
- * every key reaches). An unknown key is the opaque 404; another answer is an error.
+ * every key reaches). An unknown key is `401 credential_invalid` (protocol 9; the opaque 404
+ * before), a key of no use here `403`; another answer is an error.
  */
 export declare function keyAuthenticates(fetch: FetchLike, runtimeUrl: string, key: string): Promise<boolean>;
 /**

package/dist/stack/operator-keys.js

@@ -43,7 +43,8 @@ export async function deleteOperatorKey(endpoint, id) {
 }
 /**
  * Whether `key` reaches the Tenant at `runtimeUrl`: one authenticated read (`GET /v1/me`, which
- * every key reaches). An unknown key is the opaque 404; another answer is an error.
+ * every key reaches). An unknown key is `401 credential_invalid` (protocol 9; the opaque 404
+ * before), a key of no use here `403`; another answer is an error.
  */
 export async function keyAuthenticates(fetch, runtimeUrl, key) {
     let response;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nylorun",
-  "version": "0.11.1-beta",
+  "version": "0.12.0-beta",
   "type": "module",
   "license": "Apache-2.0",
   "description": "Set up and run local Nylorun Tenants (Runtime and Studio) with Docker Compose",
@@ -30,7 +30,7 @@
     "prepack": "npm run build"
   },
   "dependencies": {
-    "@nylorun/core": "0.15.0-beta"
+    "@nylorun/core": "0.17.0-beta"
   },
   "devDependencies": {
     "typescript": "npm:@typescript/typescript6@^6.0.2",
@@ -41,7 +41,7 @@
     "nylorun": "dist/cli.js"
   },
   "nylorun": {
-    "runtime": "0.19.1-beta",
-    "studio": "0.22.1-beta"
+    "runtime": "0.21.0-beta",
+    "studio": "0.23.0-beta"
   }
 }