pi-mcp-adapter 2.25.0 → 2.26.0

package/CHANGELOG.md

@@ -7,6 +7,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.26.0] - 2026-08-14
+
+### Added
+- Added per-server `requestHeadersCommand` support for deriving fail-closed HTTP headers from the exact outbound request on every Streamable HTTP or SSE call. Thanks @kgreen18 for PR #353.
+- Added `settings.warnOnLargeDirectTools` to suppress the advisory for 75 or more resolved direct tools. Thanks @Roshvan for issue #358.
+
+### Changed
+- Refined request-header command result handling types without changing runtime behavior.
+
+### Fixed
+- Matched adapter-owned config and state paths to the host agent directory when Pi is rebranded, including its environment override and config directory. Thanks @mindplay-dk for issue #356.
+- Avoided O(tools²) cross-server tool-name collision scans at startup by skipping collision candidates when selectors are absent and sharing one indexed candidate set when `includeTools` or `excludeTools` is configured. Thanks @mjlbach for PR #357 and @cataldoc for issue #354.
+
 ## [2.25.0] - 2026-08-13
 
 ### Added

package/README.md

@@ -207,6 +207,7 @@ In the configuration examples below, `30000` is illustrative only. If `requestTi
 | `cwd` | Working directory; supports `${VAR}`, `$env:VAR`, and `~` expansion |
 | `url` | HTTP endpoint (StreamableHTTP with SSE fallback); supports raw `${VAR}` and `$env:VAR` interpolation, and missing URL variables fail before any request is sent |
 | `headers` | HTTP headers; supports `${VAR}` and `$env:VAR` interpolation. A value beginning with `!` runs a command when the HTTP server connects or OAuth authenticates; use `!!` for a literal leading `!`. |
+| `requestHeadersCommand` | Trusted executable run for every HTTP request. It receives a versioned JSON envelope containing `method`, `url`, and the exact `bodyBase64` on stdin, and must return a JSON object of headers on stdout. `command`, `args`, and `env` support environment interpolation. Use for caller-bound request signatures; failures stop the request. |
 | `auth` | `"bearer"` or `"oauth"` |
 | `oauth.grantType` | `"authorization_code"` (default) or `"client_credentials"` for non-interactive machine auth |
 | `oauth.clientId` | Pre-registered OAuth client ID. MCP 2026 prefers pre-registered clients or Client ID Metadata Documents; this adapter falls back to Dynamic Client Registration when the ID is omitted and the server supports it. |
@@ -310,6 +311,7 @@ When any enabled server uses `eager` or `keep-alive`, initialization also starts
     "toolResultRendering": "compact",
     "collapsedResultLines": 1,
     "notifyOnStartupConnect": true,
+    "warnOnLargeDirectTools": true,
     "hostConfigDiscovery": "off",
     "approveTools": ["github_delete_*", "notion_update_*"],
     "oauthDir": ".pi/mcp-oauth",
@@ -340,6 +342,7 @@ When any enabled server uses `eager` or `keep-alive`, initialization also starts
 | `oauthDir` | Legacy OAuth `tokens.json` import directory for this MCP config. Relative paths resolve from the active project cwd. `MCP_OAUTH_DIR` still wins when set. Persistent OAuth credentials are stored in the OS credential store, not this directory. |
 | `mcpServers.<name>.oauth.authorizationParams` | Extra authorization URL parameters for provider-specific OAuth extensions. Flow-owned parameters such as `client_id`, `redirect_uri`, `scope`, `state`, `code_challenge`, `response_type`, and `resource` cannot be overridden. |
 | `directTools` | Global default for all servers (default: false). Per-server overrides this. |
+| `warnOnLargeDirectTools` | Show the advisory when 75 or more direct tools resolve (default: `true`). Set to `false` to suppress only this advisory. |
 | `freezeDirectTools` | Keep direct-tool registration stable after the initial sync so automatic reconnects and list-change notifications do not rebuild the system prompt. Use `mcp({ connect: "server" })` or `/mcp reconnect <server>` to refresh deliberately. Default: false. |
 | `scriptMode` | Register the MCP-only `mcpScript` plain-JavaScript tool (default: true). Set to `false` to hide it. |
 | `disableProxyTool` | Hide the `mcp` proxy tool once configured direct tools are fully available from cache. |
@@ -544,7 +547,7 @@ To hide specific tools while still using `directTools: true`, add `excludeTools`
 
 `includeTools` and `excludeTools` filter direct tools, proxy search/list/describe, and the `/mcp` panel view.
 
-Each direct tool costs ~150-300 tokens in the system prompt (name + description + schema). Good for targeted sets of 5-20 tools. For servers with 75+ tools, stick with the proxy or pick specific tools with a `string[]`. If 75+ direct tools resolve, the adapter prints a warning but still registers the tools you configured.
+Each direct tool costs ~150-300 tokens in the system prompt (name + description + schema). Good for targeted sets of 5-20 tools. For servers with 75+ tools, stick with the proxy or pick specific tools with a `string[]`. If 75+ direct tools resolve, the adapter prints an advisory but still registers the tools you configured. Set `settings.warnOnLargeDirectTools` to `false` to suppress this advisory.
 
 Direct tools register from the metadata cache in the Pi agent dir (`~/.pi/agent/mcp-cache.json` by default, or `$PI_CODING_AGENT_DIR/mcp-cache.json` when set), so no server connections are needed at startup. On the first session after adding `directTools` to a new server, the cache won't exist yet — tools fall back to proxy-only while the cache populates, then the extension hot-loads the refreshed direct tools into the current session. Servers that advertise MCP list-change notifications refresh the current session when their tool or resource list changes. On Pi versions that expose `pi.unregisterTool()`, stale direct tools are removed from the registry during refresh; older Pi versions still deactivate them from the active tool set. To force a refresh: `/mcp reconnect <server>`.
 

package/agent-dir.ts

@@ -2,10 +2,18 @@ import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
 
+export function getConfigDirName(): string {
+  const configDir = readPiConfig()?.configDir;
+  return typeof configDir === "string" && configDir.trim() ? configDir.trim() : ".pi";
+}
+
 export function getAgentDir(): string {
-  const configured = process.env.PI_CODING_AGENT_DIR?.trim();
+  const piConfig = readPiConfig();
+  const name = piConfig?.name;
+  const appName = typeof name === "string" && name.trim() ? name.trim() : "pi";
+  const configured = process.env[`${appName.toUpperCase()}_CODING_AGENT_DIR`]?.trim();
   if (!configured) {
-    return join(homedir(), ".pi", "agent");
+    return join(homedir(), getConfigDirName(), "agent");
   }
   if (configured === "~") {
     return homedir();
@@ -31,12 +39,12 @@ export function getAgentPath(...segments: string[]): string {
  *
  * Falls back to "pi", which is what pi's own APP_NAME resolves to.
  */
-function readPiConfig(): { name?: unknown; clientUri?: unknown } | undefined {
+function readPiConfig(): { name?: unknown; configDir?: unknown; clientUri?: unknown } | undefined {
   const dir = process.env.PI_PACKAGE_DIR?.trim()
   if (!dir) return undefined
   try {
     const manifest = JSON.parse(readFileSync(join(resolve(dir), "package.json"), "utf8")) as {
-      piConfig?: { name?: unknown; clientUri?: unknown }
+      piConfig?: { name?: unknown; configDir?: unknown; clientUri?: unknown }
     }
     return manifest.piConfig
   } catch {

package/cli.js

@@ -14,15 +14,36 @@ function expandHome(input) {
   return path.resolve(input);
 }
 
-const AGENT_DIR = process.env.PI_CODING_AGENT_DIR?.trim()
-  ? expandHome(process.env.PI_CODING_AGENT_DIR.trim())
-  : path.join(HOME, ".pi", "agent");
+function readPiConfig() {
+  const dir = process.env.PI_PACKAGE_DIR?.trim();
+  if (!dir) return undefined;
+  try {
+    return JSON.parse(fs.readFileSync(path.join(path.resolve(dir), "package.json"), "utf8")).piConfig;
+  } catch {
+    return undefined;
+  }
+}
+
+function getConfigDirName() {
+  const configDir = readPiConfig()?.configDir;
+  return typeof configDir === "string" && configDir.trim() ? configDir.trim() : ".pi";
+}
+
+function getAgentDir() {
+  const piConfig = readPiConfig();
+  const appName = typeof piConfig?.name === "string" && piConfig.name.trim() ? piConfig.name.trim() : "pi";
+  const configured = process.env[`${appName.toUpperCase()}_CODING_AGENT_DIR`]?.trim();
+  if (configured) return expandHome(configured);
+  return path.join(HOME, getConfigDirName(), "agent");
+}
+
+const AGENT_DIR = getAgentDir();
 const PI_CONFIG_PATH = path.join(AGENT_DIR, "mcp.json");
 const GENERIC_GLOBAL_CONFIG_PATH = path.join(HOME, ".config", "mcp", "mcp.json");
 const AGENTS_GLOBAL_CONFIG_PATH = path.join(HOME, ".agents", "mcp.json");
 const AGENTS_NESTED_GLOBAL_CONFIG_PATH = path.join(HOME, ".agents", "mcp", "mcp.json");
 const PROJECT_CONFIG_PATH = path.resolve(process.cwd(), ".mcp.json");
-const PROJECT_PI_CONFIG_PATH = path.resolve(process.cwd(), ".pi", "mcp.json");
+const PROJECT_PI_CONFIG_PATH = path.resolve(process.cwd(), getConfigDirName(), "mcp.json");
 
 const IMPORT_PATHS = {
   cursor: [path.join(HOME, ".cursor", "mcp.json")],

package/config.ts

@@ -4,7 +4,7 @@ import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { parse as parseToml } from "smol-toml";
 import stripJsonComments from "strip-json-comments";
-import { getAgentPath } from "./agent-dir.ts";
+import { getAgentPath, getConfigDirName } from "./agent-dir.ts";
 import { getAgentPluginSummaries, loadAgentPluginConfigs, type AgentPluginSummary } from "./agent-plugin-loader.ts";
 import { isServerDisabled, type HostConfigDiscovery, type McpConfig, type ServerEntry, type McpSettings, type ImportKind, type ServerProvenance } from "./types.ts";
 import { toStringRecord } from "./utils.ts";
@@ -15,7 +15,7 @@ const AGENTS_GLOBAL_CONFIG_PATHS = [
   join(homedir(), ".agents", "mcp", "mcp.json"),
 ] as const;
 const PROJECT_CONFIG_NAME = ".mcp.json";
-const PROJECT_PI_CONFIG_NAME = ".pi/mcp.json";
+const PROJECT_PI_CONFIG_NAME = "mcp.json";
 const REPOPROMPT_BINARY_CANDIDATES = [
   join(homedir(), "RepoPrompt", "repoprompt_cli"),
   "/Applications/Repo Prompt.app/Contents/MacOS/repoprompt-mcp",
@@ -177,7 +177,7 @@ export function getProjectConfigPath(cwd = process.cwd()): string {
 }
 
 export function getProjectPiConfigPath(cwd = process.cwd()): string {
-  return resolve(cwd, PROJECT_PI_CONFIG_NAME);
+  return resolve(cwd, getConfigDirName(), PROJECT_PI_CONFIG_NAME);
 }
 
 export function getConfigDiscoveryPaths(overridePath?: string, cwd = process.cwd()): ConfigDiscoveryPath[] {
@@ -471,7 +471,7 @@ function mergeConfigs(base: McpConfig, next: McpConfig): McpConfig {
 // different url, these MUST NOT be inherited from the lower-precedence entry —
 // otherwise the original endpoint's credentials would be shipped to the new
 // url. See the SECURITY note in mergeServerMaps.
-const URL_BOUND_AUTH_FIELDS = ["headers", "bearerToken", "bearerTokenEnv"] as const;
+const URL_BOUND_AUTH_FIELDS = ["headers", "bearerToken", "bearerTokenEnv", "requestHeadersCommand"] as const;
 
 function mergeServerMaps(
   base: Record<string, ServerEntry>,

package/direct-tools.ts

@@ -11,7 +11,7 @@ import { formatSchema } from "./tool-metadata.ts";
 import { resolveMcpResultContent, transformMcpContent, transformMcpResourceContents } from "./tool-registrar.ts";
 import { guardMcpOutput, guardedMcpDetails, resolveMcpOutputGuardOptions } from "./mcp-output-guard.ts";
 import { maybeStartUiSession, summarizeUiSessionResult, type UiSessionRuntime } from "./ui-session.ts";
-import { formatToolName, getToolNameCandidates, isServerDisabled, isToolAllowed, resolveToolPrefix } from "./types.ts";
+import { createToolSelectorCandidateIndex, formatToolName, getToolNameCandidates, isServerDisabled, isToolAllowed, resolveToolPrefix } from "./types.ts";
 import { isUiToolVisibleToModel } from "./ui-tool-visibility.ts";
 import { resourceNameToToolName } from "./resource-tools.ts";
 import { authenticate, supportsOAuth } from "./mcp-auth-flow.ts";
@@ -150,7 +150,10 @@ export function resolveDirectTools(
     if (!toolFilter) continue;
 
     const effectivePrefix = resolveToolPrefix(definition, prefix);
-    const getOtherCurrentCandidates = (toolName: string): Set<string> => {
+    const hasToolFilters =
+      (Array.isArray(definition.includeTools) && definition.includeTools.length > 0) ||
+      (Array.isArray(definition.excludeTools) && definition.excludeTools.length > 0);
+    const selectorCandidateIndex = hasToolFilters ? (() => {
       const candidates = new Set<string>();
       for (const [otherServerName, otherDefinition] of Object.entries(config.mcpServers)) {
         const otherCache = cache.servers[otherServerName];
@@ -167,14 +170,13 @@ export function resolveDirectTools(
           }
         }
       }
-      for (const candidate of getToolNameCandidates(toolName, serverName, effectivePrefix, false)) candidates.delete(candidate);
-      return candidates;
-    };
+      return createToolSelectorCandidateIndex(candidates);
+    })() : undefined;
 
     for (const tool of serverCache.tools ?? []) {
       if (!isUiToolVisibleToModel(tool.uiVisibility)) continue;
       if (toolFilter !== true && !toolFilter.includes(tool.name)) continue;
-      if (!isToolAllowed(tool.name, serverName, effectivePrefix, definition.includeTools, definition.excludeTools, getOtherCurrentCandidates(tool.name))) continue;
+      if (!isToolAllowed(tool.name, serverName, effectivePrefix, definition.includeTools, definition.excludeTools, selectorCandidateIndex)) continue;
       const prefixedName = formatToolName(tool.name, serverName, effectivePrefix);
       if (BUILTIN_NAMES.has(prefixedName)) {
         console.warn(`MCP: skipping direct tool "${prefixedName}" (collides with builtin)`);
@@ -200,7 +202,7 @@ export function resolveDirectTools(
       for (const resource of serverCache.resources ?? []) {
         const baseName = `read_${resourceNameToToolName(resource.name)}`;
         if (toolFilter !== true && !toolFilter.includes(baseName)) continue;
-        if (!isToolAllowed(baseName, serverName, effectivePrefix, definition.includeTools, definition.excludeTools, getOtherCurrentCandidates(baseName))) continue;
+        if (!isToolAllowed(baseName, serverName, effectivePrefix, definition.includeTools, definition.excludeTools, selectorCandidateIndex)) continue;
         const prefixedName = formatToolName(baseName, serverName, effectivePrefix);
         if (BUILTIN_NAMES.has(prefixedName)) {
           console.warn(`MCP: skipping direct resource tool "${prefixedName}" (collides with builtin)`);
@@ -222,7 +224,7 @@ export function resolveDirectTools(
     }
   }
 
-  if (specs.length >= DIRECT_TOOLS_ADVISORY_THRESHOLD) {
+  if (config.settings?.warnOnLargeDirectTools !== false && specs.length >= DIRECT_TOOLS_ADVISORY_THRESHOLD) {
     console.warn(`MCP: ${specs.length} direct tools resolved. Each direct tool adds prompt context; README guidance recommends targeted sets of 5-20 tools and using the proxy or an explicit string[] when 75+ direct tools would be registered.`);
   }
 
@@ -255,8 +257,10 @@ export function buildProxyDescription(
     const cachedEntry = cache?.servers?.[serverName];
     const entry = cachedEntry && isServerCacheValid(cachedEntry, definition) ? cachedEntry : undefined;
     const effectivePrefix = resolveToolPrefix(definition, prefix);
-    const getOtherCurrentCandidates = (toolName: string): Set<string> | undefined => {
-      if (!cache) return undefined;
+    const hasToolFilters =
+      (Array.isArray(definition.includeTools) && definition.includeTools.length > 0) ||
+      (Array.isArray(definition.excludeTools) && definition.excludeTools.length > 0);
+    const selectorCandidateIndex = hasToolFilters && cache ? (() => {
       const candidates = new Set<string>();
       for (const [otherServerName, otherDefinition] of Object.entries(config.mcpServers)) {
         const otherEntry = cache.servers[otherServerName];
@@ -273,17 +277,16 @@ export function buildProxyDescription(
           }
         }
       }
-      for (const candidate of getToolNameCandidates(toolName, serverName, effectivePrefix, false)) candidates.delete(candidate);
-      return candidates;
-    };
+      return createToolSelectorCandidateIndex(candidates);
+    })() : undefined;
     const toolCount = (entry?.tools ?? []).filter(
       (tool) => isUiToolVisibleToModel(tool.uiVisibility)
-        && isToolAllowed(tool.name, serverName, effectivePrefix, definition.includeTools, definition.excludeTools, getOtherCurrentCandidates(tool.name)),
+        && isToolAllowed(tool.name, serverName, effectivePrefix, definition.includeTools, definition.excludeTools, selectorCandidateIndex),
     ).length;
     const resourceCount = definition?.exposeResources !== false
       ? (entry?.resources ?? []).filter((resource) => {
           const baseName = `read_${resourceNameToToolName(resource.name)}`;
-          return isToolAllowed(baseName, serverName, effectivePrefix, definition.includeTools, definition.excludeTools, getOtherCurrentCandidates(baseName));
+          return isToolAllowed(baseName, serverName, effectivePrefix, definition.includeTools, definition.excludeTools, selectorCandidateIndex);
         }).length
       : 0;
     const totalItems = toolCount + resourceCount;

package/mcp-setup-panel.ts

@@ -1,6 +1,7 @@
 import { matchesKey, truncateToWidth, visibleWidth } from "@earendil-works/pi-tui";
 import { createPanelKeys, type PanelKeybindings, type PanelKeys } from "./panel-keys.ts";
 import type { ImportKind } from "./types.ts";
+import { getConfigDirName } from "./agent-dir.ts";
 import { KNOWN_SERVER_PRESETS, type ConfigWritePreview, type KnownServerPreset, type McpDiscoverySummary } from "./config.ts";
 import type { McpOnboardingState } from "./onboarding-state.ts";
 
@@ -556,7 +557,7 @@ export class McpSetupPanel {
           "3. ~/.agents/mcp/mcp.json",
           "4. <Pi agent dir>/mcp.json",
           "5. .mcp.json",
-          "6. .pi/mcp.json",
+          `6. ${getConfigDirName()}/mcp.json`,
           `Host discovery: ${this.discovery.hostConfigDiscovery}. Conflicts reported: ${this.discovery.conflicts.length}.`,
           ...this.discovery.conflicts.slice(0, 8).map((conflict) =>
             `${conflict.serverName}: ${conflict.sources.map((source) => source.path).join(" -> ")} (winner: ${conflict.winner.path})`,

package/metadata-cache.ts

@@ -19,11 +19,12 @@ import type {
   ToolMetadata,
   PromptMetadata,
 } from "./types.ts";
-import { formatPromptCommandName, formatToolName, getToolNameCandidates, isServerDisabled, isToolAllowed, resolveToolPrefix, type ToolPrefix } from "./types.ts";
+import { createToolSelectorCandidateIndex, formatPromptCommandName, formatToolName, getToolNameCandidates, isServerDisabled, isToolAllowed, resolveToolPrefix, type ToolPrefix } from "./types.ts";
 import { resourceNameToToolName } from "./resource-tools.ts";
 import {
   extractToolUiStreamMode,
   interpolateEnvRecord,
+  interpolateEnvVars,
   resolveBearerToken,
   resolveConfigPath,
   resolveServerUrl,
@@ -90,6 +91,14 @@ export function computeServerHash(definition: ServerEntry): string {
     cwd: resolveConfigPath(definition.cwd),
     url: resolveServerUrl(definition),
     headers: interpolateEnvRecord(definition.headers),
+    requestHeadersCommand: definition.requestHeadersCommand
+      ? {
+          command: interpolateEnvVars(definition.requestHeadersCommand.command),
+          args: definition.requestHeadersCommand.args?.map(interpolateEnvVars),
+          env: interpolateEnvRecord(definition.requestHeadersCommand.env),
+          timeoutMs: definition.requestHeadersCommand.timeoutMs,
+        }
+      : undefined,
     auth: definition.auth,
     protocolVersion: definition.protocolVersion,
     bearerToken: resolveBearerToken(definition),
@@ -184,8 +193,10 @@ export function reconstructToolMetadata(
   const metadata: ToolMetadata[] = [];
   const seenNames = new Set<string>();
   const effectivePrefix = resolveToolPrefix(definition, prefix);
-  const getOtherCurrentCandidates = (toolName: string): Set<string> | undefined => {
-    if (!configuredServers || !cache) return undefined;
+  const hasToolFilters =
+    (Array.isArray(definition.includeTools) && definition.includeTools.length > 0) ||
+    (Array.isArray(definition.excludeTools) && definition.excludeTools.length > 0);
+  const selectorCandidateIndex = hasToolFilters && configuredServers && cache ? (() => {
     const candidates = new Set<string>();
     for (const [otherServerName, otherDefinition] of Object.entries(configuredServers)) {
       const otherEntry = cache.servers[otherServerName];
@@ -202,16 +213,15 @@ export function reconstructToolMetadata(
         }
       }
     }
-    for (const candidate of getToolNameCandidates(toolName, serverName, effectivePrefix, false)) candidates.delete(candidate);
-    return candidates;
-  };
+    return createToolSelectorCandidateIndex(candidates);
+  })() : undefined;
 
   for (const tool of entry.tools ?? []) {
     if (!tool?.name) continue;
     if (!isUiToolVisibleToModel(tool.uiVisibility)) {
       continue;
     }
-    if (!isToolAllowed(tool.name, serverName, effectivePrefix, definition.includeTools, definition.excludeTools, getOtherCurrentCandidates(tool.name))) {
+    if (!isToolAllowed(tool.name, serverName, effectivePrefix, definition.includeTools, definition.excludeTools, selectorCandidateIndex)) {
       continue;
     }
 
@@ -236,7 +246,7 @@ export function reconstructToolMetadata(
     for (const resource of entry.resources ?? []) {
       if (!resource?.name || !resource?.uri) continue;
       const baseName = `read_${resourceNameToToolName(resource.name)}`;
-      if (!isToolAllowed(baseName, serverName, effectivePrefix, definition.includeTools, definition.excludeTools, getOtherCurrentCandidates(baseName))) {
+      if (!isToolAllowed(baseName, serverName, effectivePrefix, definition.includeTools, definition.excludeTools, selectorCandidateIndex)) {
         continue;
       }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-mcp-adapter",
-  "version": "2.25.0",
+  "version": "2.26.0",
   "description": "MCP (Model Context Protocol) adapter extension for Pi coding agent",
   "type": "module",
   "types": "./index.ts",
@@ -89,6 +89,7 @@
     "ui-app-bridge-helpers.ts",
     "config.ts",
     "server-manager.ts",
+    "request-headers-command.ts",
     "unix-socket-transport.ts",
     "json-schema-validator.ts",
     "session-recovery.ts",

package/request-headers-command.ts

@@ -0,0 +1,336 @@
+import { spawn, spawnSync, type ChildProcess } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import type { FetchLike } from "@modelcontextprotocol/client";
+import type { HttpRequestHeadersCommand } from "./types.ts";
+import { interpolateEnvVars } from "./utils.ts";
+
+const DEFAULT_TIMEOUT_MS = 10_000;
+const MAX_OUTPUT_BYTES = 64 * 1024;
+const USE_PROCESS_GROUP = process.platform !== "win32";
+const CLEANUP_TOKEN_ENV = "PI_MCP_REQUEST_HEADERS_CLEANUP_TOKEN";
+
+function isNoSuchProcessError(error: unknown): boolean {
+  return typeof error === "object" && error !== null && "code" in error && (error as NodeJS.ErrnoException).code === "ESRCH";
+}
+
+function runPosixPs(args: string[]): { status: number | null; stdout: string } {
+  if (process.env.PI_MCP_ADAPTER_TEST_FAIL_PS === "1") return { status: 1, stdout: "" };
+  return spawnSync("ps", args, { encoding: "utf8" });
+}
+
+function collectPosixDescendantPids(rootPid: number): number[] {
+  const result = runPosixPs(["-axo", "pid=,ppid="]);
+  if (result.status !== 0) {
+    throw new Error(`HTTP request headers command cleanup failed: ps exited with code ${result.status ?? "unknown"}`);
+  }
+
+  const childrenByParent = new Map<number, number[]>();
+  for (const line of result.stdout.split("\n")) {
+    const [pidText, ppidText] = line.trim().split(/\s+/, 2);
+    const pid = Number(pidText);
+    const ppid = Number(ppidText);
+    if (!Number.isInteger(pid) || !Number.isInteger(ppid)) continue;
+    const children = childrenByParent.get(ppid);
+    if (children) children.push(pid);
+    else childrenByParent.set(ppid, [pid]);
+  }
+
+  const descendants: number[] = [];
+  const stack = [...(childrenByParent.get(rootPid) ?? [])];
+  while (stack.length > 0) {
+    const pid = stack.pop()!;
+    descendants.push(pid);
+    stack.push(...(childrenByParent.get(pid) ?? []));
+  }
+  return descendants;
+}
+
+function collectPosixCleanupTokenPids(cleanupToken: string): number[] {
+  const result = runPosixPs(["axeww", "-o", "pid=,command="]);
+  if (result.status !== 0) {
+    throw new Error(`HTTP request headers command cleanup failed: ps exited with code ${result.status ?? "unknown"}`);
+  }
+
+  const needle = `${CLEANUP_TOKEN_ENV}=${cleanupToken}`;
+  const pids: number[] = [];
+  for (const line of result.stdout.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed.includes(needle)) continue;
+    const [pidText] = trimmed.split(/\s+/, 1);
+    const pid = Number(pidText);
+    if (Number.isInteger(pid) && pid !== process.pid) pids.push(pid);
+  }
+  return pids;
+}
+
+function assertPosixProcessDiscoveryAvailable(): void {
+  collectPosixDescendantPids(process.pid);
+  collectPosixCleanupTokenPids(`${process.pid}-preflight`);
+}
+
+function isTaskkillNoSuchProcess(result: ReturnType<typeof spawnSync>): boolean {
+  return `${result.stdout ?? ""}\n${result.stderr ?? ""}`.toLowerCase().includes("not found");
+}
+
+function signalPid(pid: number, signal: NodeJS.Signals): void {
+  try {
+    process.kill(pid, signal);
+  } catch (error) {
+    if (!isNoSuchProcessError(error)) throw error;
+  }
+}
+
+function signalProcessGroup(pid: number, signal: NodeJS.Signals): void {
+  try {
+    process.kill(-pid, signal);
+  } catch (error) {
+    if (!isNoSuchProcessError(error)) throw error;
+  }
+}
+
+function killRequestHeadersCommand(child: ChildProcess, trackedPosixDescendantPids = new Set<number>(), cleanupToken?: string): void {
+  if (process.platform === "win32" && child.pid !== undefined) {
+    const result = spawnSync("taskkill", ["/pid", String(child.pid), "/T", "/F"], {
+      encoding: "utf8",
+      windowsHide: true,
+    });
+    if (result.status === 0 || isTaskkillNoSuchProcess(result)) return;
+    throw new Error(`HTTP request headers command cleanup failed: taskkill exited with code ${result.status ?? "unknown"}`);
+  }
+
+  if (USE_PROCESS_GROUP && child.pid !== undefined) {
+    const frozenPids = new Set<number>();
+    let cleanupError: Error | undefined;
+    try {
+      signalProcessGroup(child.pid, "SIGSTOP");
+      for (const pid of trackedPosixDescendantPids) {
+        signalPid(pid, "SIGSTOP");
+        frozenPids.add(pid);
+      }
+      let stablePasses = 0;
+      for (let pass = 0; pass < 16; pass++) {
+        const candidates = [
+          ...collectPosixDescendantPids(child.pid),
+          ...(cleanupToken ? collectPosixCleanupTokenPids(cleanupToken) : []),
+        ];
+        const newPids = candidates.filter(pid => !frozenPids.has(pid));
+        if (newPids.length === 0) {
+          stablePasses++;
+          if (stablePasses >= 2) return;
+          continue;
+        }
+        stablePasses = 0;
+        for (const pid of newPids) {
+          signalPid(pid, "SIGSTOP");
+          frozenPids.add(pid);
+        }
+      }
+      cleanupError = new Error("HTTP request headers command cleanup failed: descendant process tree did not stabilize");
+    } catch (error) {
+      cleanupError = error instanceof Error ? error : new Error(String(error));
+    } finally {
+      signalProcessGroup(child.pid, "SIGKILL");
+      for (const pid of frozenPids) signalPid(pid, "SIGKILL");
+    }
+    if (cleanupError) throw cleanupError;
+    return;
+  }
+
+  child.kill("SIGKILL");
+}
+
+export interface HttpRequestCommandEnvelope {
+  version: 1;
+  method: string;
+  url: string;
+  bodyBase64: string;
+}
+
+type CommandResult =
+  | { status: "error"; error: Error }
+  | { status: "success"; headers: Headers };
+
+function resolvedCommand(config: HttpRequestHeadersCommand): {
+  command: string;
+  args: string[];
+  env: NodeJS.ProcessEnv;
+  timeoutMs: number;
+} {
+  if (!config || typeof config !== "object" || Array.isArray(config)) {
+    throw new Error("HTTP request headers command must be an object");
+  }
+  if (typeof config.command !== "string" || config.command.trim() === "") {
+    throw new Error("HTTP request headers command requires a non-empty command");
+  }
+  if (config.args !== undefined && (!Array.isArray(config.args) || config.args.some(arg => typeof arg !== "string"))) {
+    throw new Error("HTTP request headers command args must be strings");
+  }
+  if (config.env !== undefined && (
+    typeof config.env !== "object"
+    || Array.isArray(config.env)
+    || Object.values(config.env).some(value => typeof value !== "string")
+  )) {
+    throw new Error("HTTP request headers command env values must be strings");
+  }
+  const timeoutMs = config.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  if (!Number.isInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > 60_000) {
+    throw new Error("HTTP request headers command timeoutMs must be an integer between 1 and 60000");
+  }
+  return {
+    command: interpolateEnvVars(config.command),
+    args: (config.args ?? []).map(interpolateEnvVars),
+    env: {
+      ...process.env,
+      ...Object.fromEntries(
+        Object.entries(config.env ?? {}).map(([key, value]) => [key, interpolateEnvVars(value)]),
+      ),
+    },
+    timeoutMs,
+  };
+}
+
+async function invokeRequestHeadersCommand(
+  config: HttpRequestHeadersCommand,
+  envelope: HttpRequestCommandEnvelope,
+  signal: AbortSignal,
+): Promise<Headers> {
+  const resolved = resolvedCommand(config);
+  if (USE_PROCESS_GROUP) assertPosixProcessDiscoveryAvailable();
+  return new Promise<Headers>((resolve, reject) => {
+    let stdout = Buffer.alloc(0);
+    let settled = false;
+    const cleanupToken = randomUUID();
+    const child = spawn(resolved.command, resolved.args, {
+      env: { ...resolved.env, [CLEANUP_TOKEN_ENV]: cleanupToken },
+      stdio: ["pipe", "pipe", "ignore"],
+      windowsHide: true,
+      detached: USE_PROCESS_GROUP,
+    });
+
+    const trackedPosixDescendantPids = new Set<number>();
+    let trackingError: Error | undefined;
+    const trackPosixDescendants = () => {
+      if (!USE_PROCESS_GROUP || child.pid === undefined || settled || trackingError) return;
+      try {
+        for (const pid of collectPosixDescendantPids(child.pid)) trackedPosixDescendantPids.add(pid);
+        for (const pid of collectPosixCleanupTokenPids(cleanupToken)) trackedPosixDescendantPids.add(pid);
+      } catch (error) {
+        trackingError = error instanceof Error ? error : new Error(String(error));
+      }
+    };
+    const descendantTracker = USE_PROCESS_GROUP ? setInterval(trackPosixDescendants, 50) : undefined;
+    descendantTracker?.unref();
+
+    const finish = (result: CommandResult) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      if (descendantTracker) clearInterval(descendantTracker);
+      signal.removeEventListener("abort", abort);
+      if (result.status === "error") reject(result.error);
+      else resolve(result.headers);
+    };
+    const finishAfterKill = (result: CommandResult) => {
+      try {
+        killRequestHeadersCommand(child, trackedPosixDescendantPids, cleanupToken);
+        finish(result);
+      } catch (cleanupError) {
+        finish({ status: "error", error: cleanupError instanceof Error ? cleanupError : new Error(String(cleanupError)) });
+      }
+    };
+    const failAfterKill = (message: string) => {
+      finishAfterKill({ status: "error", error: trackingError ?? new Error(message) });
+    };
+    const abort = () => {
+      failAfterKill("HTTP request headers command aborted");
+    };
+    const timer = setTimeout(() => {
+      failAfterKill(`HTTP request headers command timed out after ${resolved.timeoutMs}ms`);
+    }, resolved.timeoutMs);
+
+    signal.addEventListener("abort", abort, { once: true });
+    if (signal.aborted) {
+      abort();
+      return;
+    }
+
+    child.on("error", () => finish({ status: "error", error: new Error("HTTP request headers command failed to start") }));
+    child.stdout.on("data", (chunk: Buffer | string) => {
+      if (settled) return;
+      stdout = Buffer.concat([stdout, Buffer.from(chunk)]);
+      if (stdout.byteLength > MAX_OUTPUT_BYTES) {
+        failAfterKill("HTTP request headers command output exceeded 64 KiB");
+      }
+    });
+    child.on("close", code => {
+      if (settled) return;
+      if (trackingError) {
+        failAfterKill(trackingError.message);
+        return;
+      }
+      if (code !== 0) {
+        failAfterKill(`HTTP request headers command exited with code ${code ?? "unknown"}`);
+        return;
+      }
+      let parsed: unknown;
+      try {
+        parsed = JSON.parse(stdout.toString("utf8"));
+      } catch {
+        finishAfterKill({ status: "error", error: new Error("HTTP request headers command returned invalid JSON") });
+        return;
+      }
+      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        finishAfterKill({ status: "error", error: new Error("HTTP request headers command must return a JSON object") });
+        return;
+      }
+      const entries = Object.entries(parsed);
+      if (entries.some(([, value]) => typeof value !== "string")) {
+        finishAfterKill({ status: "error", error: new Error("HTTP request headers command values must be strings") });
+        return;
+      }
+      try {
+        finishAfterKill({ status: "success", headers: new Headers(entries as Array<[string, string]>) });
+      } catch {
+        finishAfterKill({ status: "error", error: new Error("HTTP request headers command returned an invalid header") });
+      }
+    });
+
+    child.stdin.on("error", () => {});
+    child.stdin.end(JSON.stringify(envelope));
+  });
+}
+
+/** Wrap fetch so a trusted command can derive headers from the exact request. */
+export function createRequestHeadersCommandFetch(
+  config: HttpRequestHeadersCommand,
+  delegate: FetchLike = globalThis.fetch,
+): FetchLike {
+  // Validate static configuration before the first request.
+  resolvedCommand(config);
+  return async (input: URL | RequestInfo, init?: RequestInit): Promise<Response> => {
+    const request = new Request(input, init);
+    const body = Buffer.from(await request.clone().arrayBuffer());
+    const derived = await invokeRequestHeadersCommand(config, {
+      version: 1,
+      method: request.method.toUpperCase(),
+      url: request.url,
+      bodyBase64: body.toString("base64"),
+    }, request.signal);
+    const headers = new Headers(request.headers);
+    derived.forEach((value, name) => headers.set(name, value));
+    return delegate(new URL(request.url), {
+      method: request.method,
+      headers,
+      ...(request.method === "GET" || request.method === "HEAD" ? {} : { body }),
+      signal: request.signal,
+      cache: request.cache,
+      credentials: request.credentials,
+      integrity: request.integrity,
+      keepalive: request.keepalive,
+      mode: request.mode,
+      redirect: request.redirect,
+      referrer: request.referrer,
+      referrerPolicy: request.referrerPolicy,
+    });
+  };
+}

package/server-manager.ts

@@ -56,6 +56,7 @@ import {
   traceTransportKind,
   wrapTransportWithMcpTrace,
 } from "./mcp-trace.ts";
+import { createRequestHeadersCommandFetch } from "./request-headers-command.ts";
 
 const MAX_CAPTURED_STDERR_BYTES = 8 * 1024;
 const MAX_CAPTURED_STDERR_LINES = 3;
@@ -746,6 +747,9 @@ export class McpServerManager {
     }
 
     const requestInit = Object.keys(headers).length > 0 ? { headers } : undefined;
+    const requestFetch = definition.requestHeadersCommand
+      ? createRequestHeadersCommandFetch(definition.requestHeadersCommand)
+      : undefined;
     const createAuthProvider = (): McpOAuthProvider => new McpOAuthProvider(
       serverName,
       serverUrl,
@@ -772,6 +776,7 @@ export class McpServerManager {
       const authProvider = "provider" in authState ? authState.provider : undefined;
       const transportOptions = {
         ...(requestInit !== undefined ? { requestInit } : {}),
+        ...(requestFetch !== undefined ? { fetch: requestFetch } : {}),
         ...(authProvider !== undefined ? { authProvider } : {}),
         ...(authProvider !== undefined
           && definition.oauth !== false

package/tool-metadata.ts

@@ -1,7 +1,7 @@
 import { getToolUiResourceUri } from "./ui-app-bridge-helpers.ts";
 import type { McpExtensionState } from "./state.ts";
 import type { ToolMetadata, McpTool, McpResource, ServerEntry, ToolPrefix } from "./types.ts";
-import { formatToolName, getToolNameCandidates, isToolAllowed, resolveToolPrefix } from "./types.ts";
+import { createToolSelectorCandidateIndex, formatToolName, getToolNameCandidates, isToolAllowed, resolveToolPrefix } from "./types.ts";
 import { resourceNameToToolName } from "./resource-tools.ts";
 import { extractToolUiStreamMode } from "./utils.ts";
 import { extractUiToolVisibility, isUiToolVisibleToModel } from "./ui-tool-visibility.ts";
@@ -20,48 +20,68 @@ export function buildToolMetadata(
   const failedTools: string[] = [];
   const seenNames = new Set<string>();
   const effectivePrefix = resolveToolPrefix(definition, prefix);
-  const getOtherCurrentCandidates = (toolName: string): Set<string> | undefined => {
-    if (!configuredServers) return undefined;
+  const hasToolFilters =
+    (Array.isArray(definition.includeTools) && definition.includeTools.length > 0) ||
+    (Array.isArray(definition.excludeTools) && definition.excludeTools.length > 0);
+  const selectorCandidateIndex = hasToolFilters && configuredServers ? (() => {
     const candidates = new Set<string>();
-    const addCandidates = (originalName: string, candidateServerName: string, candidatePrefix: ToolPrefix) => {
-      for (const candidate of getToolNameCandidates(originalName, candidateServerName, candidatePrefix, false)) candidates.add(candidate);
+    const additionalCandidatesByToolName = new Map<string, Set<string>>();
+    const evaluatedToolNames = new Set<string>();
+    const addCandidates = (
+      target: Set<string>,
+      originalName: string,
+      candidateServerName: string,
+      candidatePrefix: ToolPrefix,
+    ) => {
+      for (const candidate of getToolNameCandidates(originalName, candidateServerName, candidatePrefix, false)) target.add(candidate);
     };
 
     for (const tool of tools) {
-      if (tool?.name) addCandidates(tool.name, serverName, effectivePrefix);
+      if (!tool?.name) continue;
+      evaluatedToolNames.add(tool.name);
+      addCandidates(candidates, tool.name, serverName, effectivePrefix);
     }
     if (definition.exposeResources !== false) {
       for (const resource of resources) {
-        if (resource?.name && resource?.uri) addCandidates(`read_${resourceNameToToolName(resource.name)}`, serverName, effectivePrefix);
+        const baseName = `read_${resourceNameToToolName(resource.name)}`;
+        evaluatedToolNames.add(baseName);
+        if (resource?.name && resource?.uri) addCandidates(candidates, baseName, serverName, effectivePrefix);
       }
     }
     for (const [otherServerName, otherDefinition] of Object.entries(configuredServers)) {
       if (otherServerName === serverName) continue;
+      const otherPrefix = resolveToolPrefix(otherDefinition, prefix);
       const knownTools = knownMetadata?.get(otherServerName);
       if (knownTools) {
-        const otherPrefix = resolveToolPrefix(otherDefinition, prefix);
         for (const tool of knownTools) {
           candidates.add(tool.name);
-          addCandidates(tool.originalName, otherServerName, otherPrefix);
+          addCandidates(candidates, tool.originalName, otherServerName, otherPrefix);
         }
       } else if (!knownMetadata || includeMissingConfiguredCandidates) {
-        const otherPrefix = resolveToolPrefix(otherDefinition, prefix);
-        addCandidates(toolName, otherServerName, otherPrefix);
-        if (includeMissingConfiguredCandidates) {
-          for (const candidate of getToolNameCandidates(toolName, otherServerName, otherPrefix, false)) candidates.add(candidate.replace(/-/g, "_"));
+        for (const toolName of evaluatedToolNames) {
+          let additionalCandidates = additionalCandidatesByToolName.get(toolName);
+          if (!additionalCandidates) {
+            additionalCandidates = new Set<string>();
+            additionalCandidatesByToolName.set(toolName, additionalCandidates);
+          }
+          addCandidates(additionalCandidates, toolName, otherServerName, otherPrefix);
+          if (includeMissingConfiguredCandidates) {
+            for (const candidate of getToolNameCandidates(toolName, otherServerName, otherPrefix, false)) {
+              additionalCandidates.add(candidate.replace(/-/g, "_"));
+            }
+          }
         }
       }
     }
-    for (const candidate of getToolNameCandidates(toolName, serverName, effectivePrefix, false)) candidates.delete(candidate);
-    return candidates;
-  };
+    return createToolSelectorCandidateIndex(candidates, additionalCandidatesByToolName);
+  })() : undefined;
 
   for (const tool of tools) {
     if (!tool?.name) {
       failedTools.push("(unnamed)");
       continue;
     }
-    if (!isToolAllowed(tool.name, serverName, effectivePrefix, definition.includeTools, definition.excludeTools, getOtherCurrentCandidates(tool.name))) {
+    if (!isToolAllowed(tool.name, serverName, effectivePrefix, definition.includeTools, definition.excludeTools, selectorCandidateIndex)) {
       continue;
     }
 
@@ -97,7 +117,7 @@ export function buildToolMetadata(
   if (definition.exposeResources !== false) {
     for (const resource of resources) {
       const baseName = `read_${resourceNameToToolName(resource.name)}`;
-      if (!isToolAllowed(baseName, serverName, effectivePrefix, definition.includeTools, definition.excludeTools, getOtherCurrentCandidates(baseName))) {
+      if (!isToolAllowed(baseName, serverName, effectivePrefix, definition.includeTools, definition.excludeTools, selectorCandidateIndex)) {
         continue;
       }
 

package/types.ts

@@ -356,6 +356,19 @@ export interface OAuthConfig {
   skipIssuerMetadataValidation?: boolean;
 }
 
+/**
+ * Trusted executable invoked for every outbound HTTP request. The adapter
+ * writes a versioned JSON request envelope to stdin and expects a JSON object
+ * containing headers on stdout. This is intended for caller-bound signing
+ * schemes whose headers depend on the exact request body.
+ */
+export interface HttpRequestHeadersCommand {
+  command: string;
+  args?: string[];
+  env?: Record<string, string>;
+  timeoutMs?: number;
+}
+
 // Server configuration
 export interface ServerEntry {
   command?: string;
@@ -367,6 +380,8 @@ export interface ServerEntry {
   // HTTP fields
   url?: string;
   headers?: Record<string, string>;
+  /** Add or replace HTTP headers by running a trusted command for each request. */
+  requestHeadersCommand?: HttpRequestHeadersCommand;
   /** 
    * Authentication type:
    * - 'oauth' - Use OAuth 2.1 (auto-discovers endpoints, supports dynamic client registration)
@@ -489,6 +504,8 @@ export interface McpSettings {
   idleTimeout?: number; // minutes, default 10, 0 to disable
   requestTimeoutMs?: number; // milliseconds, overrides the SDK request timeout when > 0
   directTools?: boolean;
+  /** Show the advisory when 75 or more direct tools resolve. Defaults to true. */
+  warnOnLargeDirectTools?: boolean;
   /** Register the trusted MCP-only JavaScript scripting tool. Defaults to true; set false to hide it. */
   scriptMode?: boolean;
   /** Render MCP tool results as compact self-rendered rows by default, or as the legacy boxed row. */
@@ -789,6 +806,25 @@ function globToRegExp(pattern: string): RegExp {
   return new RegExp(`^${escaped}$`);
 }
 
+export interface ToolSelectorCandidateIndex {
+  readonly allCurrentCandidates: ReadonlySet<string>;
+  readonly matchingCountByPattern: Map<string, number>;
+  readonly matcherByPattern: Map<string, RegExp>;
+  readonly additionalCurrentCandidatesByToolName?: ReadonlyMap<string, ReadonlySet<string>>;
+}
+
+export function createToolSelectorCandidateIndex(
+  allCurrentCandidates: Set<string>,
+  additionalCurrentCandidatesByToolName?: ReadonlyMap<string, ReadonlySet<string>>,
+): ToolSelectorCandidateIndex {
+  return {
+    allCurrentCandidates,
+    matchingCountByPattern: new Map<string, number>(),
+    matcherByPattern: new Map<string, RegExp>(),
+    ...(additionalCurrentCandidatesByToolName ? { additionalCurrentCandidatesByToolName } : {}),
+  };
+}
+
 export function matchesToolPattern(candidates: Set<string>, patterns?: unknown): boolean {
   if (!Array.isArray(patterns) || patterns.length === 0) return false;
 
@@ -805,24 +841,71 @@ export function matchesToolPattern(candidates: Set<string>, patterns?: unknown):
   return false;
 }
 
+export type ToolSelectorCandidateContext = Set<string> | ToolSelectorCandidateIndex;
+
+function indexHasOtherCurrentMatch(
+  index: ToolSelectorCandidateIndex,
+  toolName: string,
+  currentCandidates: Set<string>,
+  pattern: string,
+): boolean {
+  const additionalCandidates = index.additionalCurrentCandidatesByToolName?.get(toolName);
+  const hasCandidate = (candidate: string): boolean =>
+    index.allCurrentCandidates.has(candidate) || additionalCandidates?.has(candidate) === true;
+  const isGlob = pattern.includes("*") || pattern.includes("?");
+  if (!isGlob) {
+    return hasCandidate(pattern) && !currentCandidates.has(pattern);
+  }
+
+  let matcher = index.matcherByPattern.get(pattern);
+  if (!matcher) {
+    matcher = globToRegExp(pattern);
+    index.matcherByPattern.set(pattern, matcher);
+  }
+  let matchingCount = index.matchingCountByPattern.get(pattern);
+  if (matchingCount === undefined) {
+    matchingCount = 0;
+    for (const candidate of index.allCurrentCandidates) {
+      if (matcher.test(candidate)) matchingCount++;
+    }
+    index.matchingCountByPattern.set(pattern, matchingCount);
+  }
+
+  let totalMatchingCount = matchingCount;
+  if (additionalCandidates) {
+    for (const candidate of additionalCandidates) {
+      if (!index.allCurrentCandidates.has(candidate) && matcher.test(candidate)) totalMatchingCount++;
+    }
+  }
+  if (totalMatchingCount === 0) return false;
+
+  let currentMatchingCount = 0;
+  for (const candidate of currentCandidates) {
+    if (hasCandidate(candidate) && matcher.test(candidate)) currentMatchingCount++;
+  }
+  return totalMatchingCount > currentMatchingCount;
+}
+
 function matchesToolSelector(
   toolName: string,
   serverName: string,
   prefix: ToolPrefix,
   patterns: unknown,
-  otherCurrentCandidates?: Set<string>,
+  otherCurrentCandidates?: ToolSelectorCandidateContext,
 ): boolean {
+  if (!Array.isArray(patterns) || patterns.length === 0) return false;
   const currentCandidates = getToolNameCandidates(toolName, serverName, prefix, false);
   if (matchesToolPattern(currentCandidates, patterns)) return true;
   if (!otherCurrentCandidates) return matchesToolPattern(getToolNameCandidates(toolName, serverName, prefix), patterns);
   const legacyCandidates = getToolNameCandidates(toolName, serverName, prefix);
   for (const candidate of currentCandidates) legacyCandidates.delete(candidate);
-  if (!Array.isArray(patterns)) return false;
-  return patterns.some(pattern =>
-    typeof pattern === "string"
-    && !matchesToolPattern(otherCurrentCandidates, [pattern])
-    && matchesToolPattern(legacyCandidates, [pattern]),
-  );
+  return patterns.some(pattern => {
+    if (typeof pattern !== "string" || !matchesToolPattern(legacyCandidates, [pattern])) return false;
+    const hasCollision = otherCurrentCandidates instanceof Set
+      ? matchesToolPattern(otherCurrentCandidates, [pattern])
+      : indexHasOtherCurrentMatch(otherCurrentCandidates, toolName, currentCandidates, pattern);
+    return !hasCollision;
+  });
 }
 
 export function isToolIncluded(
@@ -830,7 +913,7 @@ export function isToolIncluded(
   serverName: string,
   prefix: ToolPrefix,
   includeTools?: unknown,
-  otherCurrentCandidates?: Set<string>,
+  otherCurrentCandidates?: ToolSelectorCandidateContext,
 ): boolean {
   if (!Array.isArray(includeTools) || includeTools.length === 0) return true;
   return matchesToolSelector(toolName, serverName, prefix, includeTools, otherCurrentCandidates);
@@ -841,7 +924,7 @@ export function isToolExcluded(
   serverName: string,
   prefix: ToolPrefix,
   excludeTools?: unknown,
-  otherCurrentCandidates?: Set<string>,
+  otherCurrentCandidates?: ToolSelectorCandidateContext,
 ): boolean {
   return matchesToolSelector(toolName, serverName, prefix, excludeTools, otherCurrentCandidates);
 }
@@ -852,7 +935,7 @@ export function isToolAllowed(
   prefix: ToolPrefix,
   includeTools?: unknown,
   excludeTools?: unknown,
-  otherCurrentCandidates?: Set<string>,
+  otherCurrentCandidates?: ToolSelectorCandidateContext,
 ): boolean {
   return isToolIncluded(toolName, serverName, prefix, includeTools, otherCurrentCandidates)
     && !isToolExcluded(toolName, serverName, prefix, excludeTools, otherCurrentCandidates);