pi-profile-switch 0.11.0 → 0.12.0

package/README.md

@@ -2,7 +2,7 @@
 
 [English](README.md) | [中文](README.zh-CN.md)
 
-Named profiles for [Pi](https://github.com/badlogic/pi-mono). A profile is a named set of resources you define: skills, extensions, MCP servers, tools (including tools exposed by MCP servers and extensions), model defaults, and extra system-prompt instructions. Switch profiles inside a running Pi session — no restart.
+Named profiles for [Pi](https://github.com/badlogic/pi-mono). A profile is a named set of resources you define: skills, extensions, MCP servers, tools, per-server MCP tool selections (`mcp_tools`), model defaults, and extra system-prompt instructions. Switch profiles inside a running Pi session — no restart.
 
 ## Install
 
@@ -51,7 +51,7 @@ pi-profile-switch seeds the global `profiles/` directory with a starter **`ask`*
 }
 ```
 
-One profile can use every field at once. This example `impl` profile (`impl.json`) loads the TDD skill, the mcp-scripting skill (shipped by pi-mcp-adapter), and your internal skills; wires up two MCP servers; allows the built-in tools plus both servers' MCP tools by glob; and pins the model and standing instructions:
+One profile can use every field at once. This example `impl` profile (`impl.json`) loads the TDD skill, the mcp-scripting skill (shipped by pi-mcp-adapter), and your internal skills; wires up two MCP servers; allows the built-in tools; restricts GitHub MCP tools while denying Linear tools; and pins the model and standing instructions:
 
 ```json
 {
@@ -76,11 +76,15 @@ One profile can use every field at once. This example `impl` profile (`impl.json
     "ls",
     "bash",
     "edit",
-    "write",
-    "mcp__*",
-    "github_*",
-    "linear_*"
+    "write"
   ],
+  "mcp_tools": {
+    "github": [
+      "search",
+      "get_issue"
+    ],
+    "linear": []
+  },
   "defaultProvider": "anthropic",
   "defaultModel": "claude-sonnet-4-5",
   "defaultThinkingLevel": "high",
@@ -91,7 +95,10 @@ One profile can use every field at once. This example `impl` profile (`impl.json
 How fields resolve:
 
 - `skills`, `extensions`, `mcps`, `tools` take names or globs (e.g. `"internal-*"`) referencing resources you already installed or configured — profiles never copy them. Installed packages and files in standard locations are discovered automatically; no registration needed.
-- `tools` expands against Pi's live tool registry — built-ins, extension-provided tools, and tools exposed by MCP servers. MCP tools are registered as `mcp__<server>` (proxy) and `<server>_<tool>` (direct tools, the adapter's default `toolPrefix`), so globs like `mcp__*` and `github_*` cover them.
+- `tools` expands strictly against Pi's non-MCP tool registry — built-ins and extension-provided tools, attributed by registration ownership (`sourceInfo`). Available MCP tools remain usable independently of `tools`.
+- `mcp_tools` defines per-server MCP tool filtering: keys are literal configured server names and values are literal pi-mcp-adapter selectors (original or prefixed names; either form can select the same tool). Globs are not accepted. An omitted server keeps native access to all its tools; a nonempty array allows only matched tools; an empty array (`[]`) denies all tools for that server while leaving it enabled. Unmatched selectors remain restrictive and are not diagnosed, so confirm selectors with the adapter/server before writing them.
+- A nonempty `mcp_tools` requires `pi-mcp-adapter` even when `mcps` is omitted. Existing adapter `includeTools` filters are combined only when the profile uses identical selectors or the existing filter is `"*"`; otherwise activation fails before writing runtime files. Existing `excludeTools` restrictions continue to apply.
+- **Migration note:** Former MCP references in `tools` (e.g. `mcp__*`, `<server>_*`) no longer govern MCP access. Move desired MCP tool restrictions to `mcp_tools`.
 - `mcps` references servers from your pi-mcp-adapter configuration; connection details stay in the adapter's own config.
 - Any field you omit keeps plain Pi behavior.
 

package/README.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](README.md) | [中文](README.zh-CN.md)
 
-[Pi](https://github.com/badlogic/pi-mono) 的命名 profile 扩展。一个 profile 是你自定义的命名能力组合：skills、extensions、MCP server、tools（包括 MCP server 和 extension 提供的工具）、默认模型，以及追加到系统提示词的 instructions。在同一个运行中的 Pi 会话里切换这些组合，无需重启。
+[Pi](https://github.com/badlogic/pi-mono) 的命名 profile 扩展。一个 profile 是你自定义的命名能力组合：skills、extensions、MCP server、tools、按 server 细化的 MCP 工具控制（`mcp_tools`）、默认模型，以及追加到系统提示词的 instructions。在同一个运行中的 Pi 会话里切换这些组合，无需重启。
 
 ## 安装
 
@@ -51,7 +51,7 @@ pi-profile-switch 会向全局 `profiles/` 目录播种一个初始 **`ask`** pr
 }
 ```
 
-一个 profile 可以同时使用全部字段。下面这个 `impl` profile 示例（`impl.json`）加载 TDD skill、mcp-scripting skill（pi-mcp-adapter 自带）和你的内部 skills；接入两个 MCP server；tool 白名单用 glob 覆盖内建工具和这两个 server 的 MCP 工具；并钉住模型与常驻 instructions：
+一个 profile 可以同时使用全部字段。下面这个 `impl` profile 示例（`impl.json`）加载 TDD skill、mcp-scripting skill（pi-mcp-adapter 自带）和你的内部 skills；接入两个 MCP server；允许内建工具并按 server 细化 MCP 工具；同时钉住模型与常驻 instructions：
 
 ```json
 {
@@ -76,11 +76,15 @@ pi-profile-switch 会向全局 `profiles/` 目录播种一个初始 **`ask`** pr
     "ls",
     "bash",
     "edit",
-    "write",
-    "mcp__*",
-    "github_*",
-    "linear_*"
+    "write"
   ],
+  "mcp_tools": {
+    "github": [
+      "search",
+      "get_issue"
+    ],
+    "linear": []
+  },
   "defaultProvider": "anthropic",
   "defaultModel": "claude-sonnet-4-5",
   "defaultThinkingLevel": "high",
@@ -91,7 +95,10 @@ pi-profile-switch 会向全局 `profiles/` 目录播种一个初始 **`ask`** pr
 字段解析规则：
 
 - `skills`、`extensions`、`mcps`、`tools` 接受名称或 glob（如 `"internal-*"`），引用你已安装或已配置的资源——profile 从不复制资源。已安装的包和标准目录下的文件会被自动发现，无需注册。
-- `tools` 针对 Pi 的实时工具注册表展开——内建工具、extension 提供的工具，以及 MCP server 暴露的工具。MCP 工具注册为 `mcp__<server>`（代理）和 `<server>_<tool>`（直接工具，adapter 默认 `toolPrefix`），因此 `mcp__*`、`github_*` 这类 glob 可以覆盖它们。
+- `tools` 仅针对 Pi 的非 MCP 工具展开（内建工具与 extension 提供的工具，根据注册归属 `sourceInfo` 判定）。可用的 MCP 工具独立于 `tools` 保持可用。
+- `mcp_tools` 按 server 细化 MCP 工具策略：键为字面 MCP server 名称，值为 pi-mcp-adapter 的字面 selector（原始名或带前缀名；两种写法都可能选中同一个工具）。此字段不接受 glob。省略的 server 保留其全部原生工具访问；非空数组仅允许匹配到的工具；空数组（`[]`）禁用该 server 的全部工具，同时保持 server 处于启用状态。未匹配的 selector 仍保持限制且不会收到诊断，因此编写前请通过 adapter/server 确认可用写法。
+- 非空的 `mcp_tools` 即使在省略 `mcps` 时也需要 `pi-mcp-adapter`。只有当 profile selector 与已有的 `includeTools` 字面值完全相同，或已有列表是 `"*"` 时才能安全组合；否则会在写入 runtime 文件前报错。已有的 `excludeTools` 限制仍然生效。
+- **迁移提示**：旧 profile 中写入 `tools` 的 MCP 工具名称或 glob（如 `mcp__*`、`<server>_*`）不再控制 MCP 访问；如有需要请迁移至 `mcp_tools`。
 - `mcps` 引用 pi-mcp-adapter 配置中的 server；连接细节留在 adapter 自己的配置里。
 - 未写的字段保持原生 Pi 行为。
 

package/examples/example.json

@@ -20,11 +20,15 @@
     "ls",
     "bash",
     "edit",
-    "write",
-    "mcp__*",
-    "github_*",
-    "linear_*"
+    "write"
   ],
+  "mcp_tools": {
+    "github": [
+      "github_search",
+      "get_issue"
+    ],
+    "linear": []
+  },
   "defaultProvider": "anthropic",
   "defaultModel": "claude-sonnet-4-5",
   "defaultThinkingLevel": "high",

package/extensions/pi-profile/index.ts

@@ -6,7 +6,7 @@ import { fileURLToPath } from "node:url";
 
 import { isRecord } from "../../src/json-file.ts";
 import { readTrustInputs } from "../../src/launcher/initial-profile.ts";
-import { discoverAdapterServerNames } from "../../src/mcp-config.ts";
+import { loadMergedMcpServers } from "../../src/mcp-config.ts";
 import { RuntimeStateStore } from "../../src/runtime-state-store.ts";
 import { runStartupNotifications, type NoticeSurface } from "../../src/startup-notifier.ts";
 import { applyLaunchPlan, readLaunchPlanFile } from "../../src/switching/apply-plan.ts";
@@ -221,13 +221,19 @@ export default function piProfileExtension(pi: ExtensionAPI): void {
 					const { projectTrusted } = await readTrustInputs({ agentDir: plan.agentDir, cwd: ctx.cwd });
 					const stateDir = plan.source === "project" ? path.join(ctx.cwd, ".pi") : getGlobalStateDir(plan.agentDir);
 					const state = await new RuntimeStateStore(stateDir).read();
+					const mcpDiscovery = await loadMergedMcpServers(
+						plan.agentDir,
+						projectTrusted ? ctx.cwd : undefined,
+					);
+					const discoveredMcpServers = Object.keys(mcpDiscovery.servers).sort();
+					const disabledMcpServers = discoveredMcpServers.filter(
+						(server) => mcpDiscovery.servers[server]?.disabled === true,
+					);
 					const report = buildStatusReport({
 						plan,
 						overlay: state.overlay,
-						discoveredMcpServers: await discoverAdapterServerNames(
-							plan.agentDir,
-							projectTrusted ? ctx.cwd : undefined,
-						),
+						discoveredMcpServers,
+						disabledMcpServers,
 						commands: pi.getCommands(),
 						tools: pi.getAllTools(),
 					});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-profile-switch",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "Named profiles for Pi: reference skills, extensions, MCP servers, and tools per workflow, switched without restarting. Install: npm install -g pi-profile-switch (not pi install).",
   "type": "module",
   "keywords": [
@@ -36,6 +36,7 @@
     "@earendil-works/pi-coding-agent": "*",
     "@types/node": "^24.0.0",
     "ajv": "^8.20.0",
+    "pi-mcp-adapter": "^2.38.0",
     "typescript": "^5.8.0",
     "vitest": "^3.0.0"
   },

package/schemas/profiles.schema.json

@@ -38,7 +38,21 @@
       "items": {
         "type": "string"
       },
-      "description": "Tool names or globs expanded against Pi's live registry (including extension tools)."
+      "description": "Names or globs for non-MCP Pi built-ins and non-MCP extension tools; MCP tools are selected separately with mcp_tools."
+    },
+    "mcp_tools": {
+      "type": "object",
+      "propertyNames": {
+        "pattern": "^[^[*?\\]{}]+$"
+      },
+      "additionalProperties": {
+        "type": "array",
+        "items": {
+          "type": "string",
+          "pattern": "^[^[*?\\]{}]+$"
+        }
+      },
+      "description": "Per-server tool lists mapping literal MCP server names to arrays of literal pi-mcp-adapter tool selectors. Original and prefixed names can select the same tool; globs are not allowed. An omitted server allows all its tools; an empty list denies all its tools."
     },
     "defaultProvider": {
       "type": "string",

package/skills/profile-config/SKILL.md

@@ -54,8 +54,9 @@ All fields are optional. Undeclared fields keep native Pi behavior or current st
 | `description` | `string` | Short description of the profile (e.g. `"Read-only review profile"`). |
 | `skills` | `string[]` | Skill names or globs to reference. When undeclared, available skills are not narrowed. |
 | `extensions` | `string[]` | Extension identifiers or globs to reference. When undeclared, available extensions are not narrowed. |
-| `mcps` | `string[]` | MCP server names or globs to reference. When undeclared, there is no dependency on `pi-mcp-adapter`. |
-| `tools` | `string[]` | Whitelisted tool names or globs. When undeclared, tools are not narrowed and Pi's native tool set is kept. |
+| `mcps` | `string[]` | MCP server names or globs to reference. When undeclared, `mcps` itself adds no adapter requirement; a nonempty `mcp_tools` still requires `pi-mcp-adapter`. |
+| `tools` | `string[]` | Whitelisted non-MCP tool names or globs (built-in and extension tools only). Live MCP tools remain usable independently of `tools`. When undeclared, tools are not narrowed and Pi's native tool set is kept. |
+| `mcp_tools` | `Record<string, string[]>` | Per-server MCP tool selection: literal server names mapped to literal adapter selectors (original or prefixed names; both forms may select the same tool). Globs are rejected. An omitted server allows all tools; a nonempty array allows only matches; an empty array (`[]`) denies all tools while keeping the server enabled. An empty object (`{}`) behaves like omission. Nonempty declarations require `pi-mcp-adapter`, even when `mcps` is omitted. |
 | `defaultProvider` | `string` | Default model provider (e.g. `"anthropic"`, `"openai"`). Effective only when declared together with `defaultModel`. |
 | `defaultModel` | `string` | Default model name (e.g. `"claude-sonnet-4-5"`). Effective only when declared together with `defaultProvider`. |
 | `defaultThinkingLevel` | `string` | Default thinking level; allowed values: `"off"`, `"minimal"`, `"low"`, `"medium"`, `"high"`, `"xhigh"`, `"max"`. Effective only when the model declaration holds. |
@@ -105,12 +106,20 @@ When helping the user configure a profile, check or consult the following locati
 3. **MCP servers**:
    - Discovery locations: the standard configuration locations recognized by `pi-mcp-adapter` — on the global side `~/.config/mcp/mcp.json`, `~/.agents/mcp.json`, `~/.agents/mcp/mcp.json`, `<agentDir>/mcp.json`; trusted projects additionally have `<projectDir>/.mcp.json` and `<projectDir>/.pi/mcp.json`.
    - Reference identity: the server key names under the `mcpServers` object in those configuration files.
-   - A profile declaring `mcps` must also ensure the `pi-mcp-adapter` extension is available.
+   - A profile declaring nonempty `mcps` or nonempty `mcp_tools` must ensure the `pi-mcp-adapter` extension is available; omitting `mcps` does not remove the requirement for nonempty `mcp_tools`.
 4. **Tools**:
-   - Reference identity: tool names in Pi's live tool registry.
-   - Includes built-in tools (`read`, `write`, `edit`, `bash`, etc.), extension-contributed tools, and tools exposed by MCP servers (the proxy tool `mcp__<server>` and direct tools `<server>_<tool>`).
-   - Globs supported (e.g. `"mcp__*"`, `"github_*"`).
-5. **Narrowing boundary of project-level resources (important)**:
+   - Reference identity: non-MCP tool names in Pi's live tool registry.
+   - Includes built-in tools (`read`, `write`, `edit`, `bash`, etc.) and extension-contributed tools.
+   - MCP-owned tools are **not** controlled by `tools`; legacy references such as `"mcp__*"` or `"github_*"` in `tools` must be migrated to `mcp_tools`.
+5. **MCP Tools (`mcp_tools`)**:
+   - Reference identity: keys are literal configured MCP server names; values are literal pi-mcp-adapter selectors. Original and prefixed selectors can both match the same tool; globs are not accepted.
+   - Selectors are not checked against a live tool catalog. A selector matching no tool stays restrictive and produces no name diagnostic; verify selector forms with the adapter or MCP server before writing the profile.
+   - If the server already has nonempty `includeTools`, each requested selector must be identical to an existing literal or the existing list must include `"*"`; otherwise activation fails before runtime files are written. Existing `excludeTools` still applies.
+   - Omitting a server key preserves unrestricted access to that server's tools.
+   - An empty list (`[]`) denies all tools for that server while keeping the server enabled.
+   - A nonempty list (e.g. `["search", "get_issue"]`) allows only those tools across direct tools, gateway proxies, and scripts.
+   - Narrowing applies only to user-level MCP servers; project-level MCP servers cannot be narrowed by profiles.
+6. **Narrowing boundary of project-level resources (important)**:
    - A profile's resource selection (`skills`, `extensions`) **applies only to user-level resources** (the real agentDir and `~/.agents/skills`).
    - The visibility of project-level resources (project `.pi/skills`, project `.pi/extensions`, ancestor `.agents/skills`) is decided by Pi's project-trust determination: in a trusted project they are always visible under **any** profile; in an untrusted project they are never visible.
    - Therefore project-level resource visibility **does not narrow with profiles** — there is no need, and no guidance, to declare project-level resources in a profile.

package/src/launcher/initial-profile.ts

@@ -14,8 +14,7 @@
 import path from "node:path";
 
 import { isRecord, readJsonFile } from "../json-file.ts";
-import { discoverAdapterServerNames } from "../mcp-config.ts";
-import { isAdapterExtension, MissingMcpAdapterError } from "../mcp-config.ts";
+import { isAdapterExtension, loadMergedMcpServers, MissingMcpAdapterError } from "../mcp-config.ts";
 import { ProfileCatalog, type ResolvedProfile } from "../profile-catalog.ts";
 import { ActivationError, defaultPlan, resolveProfile, type ActivationPlan } from "../profile-resolver.ts";
 import { resolveProjectTrust } from "../project-trust.ts";
@@ -159,24 +158,38 @@ export async function resolveInitialProfile(
 		return { plan, discovery, projectDir, projectTrusted, warnings };
 	}
 
+	const mcpToolsDef = (profile.definition as { mcp_tools?: Record<string, string[]> }).mcp_tools;
+	const hasMcpTools = mcpToolsDef !== undefined && Object.keys(mcpToolsDef).length > 0;
+	const needsMcp = Boolean(
+		profile.definition.mcps?.length ||
+		hasMcpTools ||
+		(options?.overlay?.disabledMcps?.length ?? 0) > 0,
+	);
+	const mcpDiscovery = needsMcp
+		? await loadMergedMcpServers(context.agentDir, projectDir)
+		: undefined;
+
 	const discovery = await discoverLauncherResources({ ...context, projectTrusted });
 	const plan = await resolveProfile({
 		profile,
 		skills: discovery.skills,
 		extensions: discovery.extensions,
 		validateModel: (model) => checkDeclaredModel(context.agentDir, model),
-		discoveredMcpServers: profile.definition.mcps?.length
-			? await discoverAdapterServerNames(context.agentDir, projectDir)
-			: undefined,
+		discoveredMcpServers: mcpDiscovery ? Object.keys(mcpDiscovery.servers).sort() : undefined,
+		mcpDiscovery,
 		overlay: options?.overlay,
 		liveToolNames: options?.liveToolNames,
 	});
 	warnings.push(...discovery.extensions.warnings(), ...unmatchedWarnings(plan));
 	if (plan.mcps !== undefined && !plan.extensions.some(isAdapterExtension)) {
-		// Fail before spawn: without the adapter in the active extension set
-		// nobody applies the allowlist, and the declared servers would either
-		// silently do nothing or leak through unfiltered.
-		throw new MissingMcpAdapterError(plan.profile);
+		throw new MissingMcpAdapterError(plan.profile, "mcps");
+	}
+	if (
+		plan.mcpTools !== undefined &&
+		Object.keys(plan.mcpTools).length > 0 &&
+		!plan.extensions.some(isAdapterExtension)
+	) {
+		throw new MissingMcpAdapterError(plan.profile, "mcp_tools");
 	}
 	return { plan, discovery, projectDir, projectTrusted, warnings };
 }

package/src/mcp-config.ts

@@ -43,9 +43,16 @@ export interface MergedMcpResult {
 	/** Servers defined in a trusted project's own config (`.mcp.json`,
 	 *  `.pi/mcp.json`). They are not the profile's to narrow. */
 	projectServers: Set<string>;
+	/** Winning origin of each discovered server: "project" if defined or
+	 *  shadowed by project-level configuration, "user" otherwise. */
+	serverOwners: Record<string, "user" | "project">;
 	baseConfig?: Record<string, unknown>;
 }
 
+function setOwnRecordValue<T>(record: Record<string, T>, key: string, value: T): void {
+	Object.defineProperty(record, key, { value, enumerable: true, configurable: true, writable: true });
+}
+
 export interface McpConfigSource {
 	path: string;
 	isShared: boolean;
@@ -93,6 +100,7 @@ export async function loadMergedMcpServers(
 	const servers: Record<string, Record<string, unknown>> = {};
 	const sharedServers = new Set<string>();
 	const projectServers = new Set<string>();
+	const serverOwners: Record<string, "user" | "project"> = {};
 	let baseConfig: Record<string, unknown> | undefined;
 
 	for (const source of sources) {
@@ -116,21 +124,22 @@ export async function loadMergedMcpServers(
 			throw new McpConfigError(`"mcpServers" must be a JSON object: ${resolvedPath}`, resolvedPath);
 		}
 		for (const [name, def] of Object.entries(result.value.mcpServers)) {
+			// The real adapter copies server entries into an ordinary {} and
+			// cannot represent "__proto__" as a discoverable server name; align
+			// discovery so inherited prototype keys are never treated as servers.
+			if (name === "__proto__") continue;
 			if (source.isShared) {
 				sharedServers.add(name);
 			}
-			if (source.isProject === true) {
-				projectServers.add(name);
-			}
-			if (isRecord(def)) {
-				servers[name] = { ...(servers[name] ?? {}), ...def };
-			} else {
-				servers[name] = { ...(servers[name] ?? {}) };
-			}
+			if (source.isProject === true) projectServers.add(name);
+			setOwnRecordValue(serverOwners, name, source.isProject === true ? "project" : "user");
+			const previous = Object.hasOwn(servers, name) ? servers[name] : undefined;
+			const merged = isRecord(def) ? { ...(previous ?? {}), ...def } : { ...(previous ?? {}) };
+			setOwnRecordValue(servers, name, merged);
 		}
 	}
 
-	return { servers, sharedServers, projectServers, baseConfig };
+	return { servers, sharedServers, projectServers, serverOwners, baseConfig };
 }
 
 /** Server names the adapter would discover: standard global MCP configs,
@@ -146,10 +155,13 @@ export async function discoverAdapterServerNames(
 }
 
 export class MissingMcpAdapterError extends Error {
-	constructor(profile: string) {
+	constructor(profile: string, reason: "mcps" | "mcp_tools" = "mcps") {
 		super(
-			`profile "${profile}" declares MCP servers but pi-mcp-adapter is not active. ` +
-				`Select the adapter in the profile's extensions (e.g. via its npm package) or remove the "mcps" declaration.`,
+			reason === "mcp_tools"
+				? `profile "${profile}" declares MCP tools but pi-mcp-adapter is not active. ` +
+				  `Select the adapter in the profile's extensions (e.g. via its npm package) or remove the "mcp_tools" declaration.`
+				: `profile "${profile}" declares MCP servers but pi-mcp-adapter is not active. ` +
+				  `Select the adapter in the profile's extensions (e.g. via its npm package) or remove the "mcps" declaration.`,
 		);
 		this.name = "MissingMcpAdapterError";
 	}

package/src/profile-catalog.ts

@@ -44,6 +44,8 @@ export interface ProfileDefinition {
 	extensions?: string[];
 	mcps?: string[];
 	tools?: string[];
+	/** Literal adapter selectors (original or prefixed names); globs are rejected. */
+	mcp_tools?: Record<string, string[]>;
 	defaultProvider?: string;
 	defaultModel?: string;
 	defaultThinkingLevel?: string;
@@ -89,6 +91,49 @@ function readOptionalString(value: unknown, field: string, profileName: string,
 	return value;
 }
 
+function isGlobPattern(value: string): boolean {
+	return (
+		value.includes("*") ||
+		value.includes("?") ||
+		value.includes("[") ||
+		value.includes("]") ||
+		value.includes("{") ||
+		value.includes("}")
+	);
+}
+
+function readMcpTools(
+	value: unknown,
+	profileName: string,
+	filePath?: string,
+): Record<string, string[]> | undefined {
+	if (value === undefined) return undefined;
+	const prefix = filePath ? `${filePath}: ` : "";
+	if (!isRecord(value)) {
+		throw new CatalogError(`${prefix}profile "${profileName}": "mcp_tools" must be an object of string arrays`);
+	}
+	const entries: Array<[string, string[]]> = [];
+	for (const [server, tools] of Object.entries(value)) {
+		if (isGlobPattern(server)) {
+			throw new CatalogError(
+				`${prefix}profile "${profileName}": "mcp_tools" server "${server}" is a glob pattern; literal MCP server names are required`,
+			);
+		}
+		if (!Array.isArray(tools) || tools.some((entry) => typeof entry !== "string")) {
+			throw new CatalogError(`${prefix}profile "${profileName}": "mcp_tools" must be an object of string arrays`);
+		}
+		for (const tool of tools) {
+			if (isGlobPattern(tool)) {
+				throw new CatalogError(
+					`${prefix}profile "${profileName}": "mcp_tools" entry "${tool}" in server "${server}" is a glob pattern; literal adapter tool selectors are required`,
+				);
+			}
+		}
+		entries.push([server, [...tools]]);
+	}
+	return Object.fromEntries(entries);
+}
+
 /** Parses one raw profile definition; the single read-time validator so
  *  catalog files and any external writer stay loadable. */
 export function parseProfileDefinition(name: string, raw: unknown, filePath?: string): ProfileDefinition {
@@ -105,6 +150,8 @@ export function parseProfileDefinition(name: string, raw: unknown, filePath?: st
 		const entries = readStringArray(raw[field], field, name, filePath);
 		if (entries !== undefined) definition[field] = entries;
 	}
+	const mcpTools = readMcpTools(raw.mcp_tools, name, filePath);
+	if (mcpTools !== undefined) definition.mcp_tools = mcpTools;
 	const defaultProvider = readOptionalString(raw.defaultProvider, "defaultProvider", name, filePath);
 	if (defaultProvider !== undefined) definition.defaultProvider = defaultProvider;
 	const defaultModel = readOptionalString(raw.defaultModel, "defaultModel", name, filePath);

package/src/profile-resolver.ts

@@ -27,6 +27,8 @@
 import { minimatch } from "minimatch";
 
 import type { DiscoveredExtensions } from "./extension-discovery.ts";
+import { isRecord } from "./json-file.ts";
+import { isAdapterExtension, type MergedMcpResult } from "./mcp-config.ts";
 import type { ProfileDefinition, ProfileModel, ProfileSource, ResolvedProfile } from "./profile-catalog.ts";
 
 /** Extracts a ProfileModel from flat definition keys, if declared. */
@@ -85,6 +87,10 @@ export interface ActivationPlan {
 	 *  surfaced in `/profile status`; undefined when the profile declares
 	 *  no `mcps` (no restriction). */
 	mcps?: string[];
+	/** Per-server MCP tool policy: literal adapter selectors per server. */
+	mcpTools?: Record<string, string[]>;
+	/** Prepared in-memory instance mcp.json config; never written to pi-profile.json */
+	instanceMcpConfig?: Record<string, unknown>;
 	/** Glob references (skills/extensions/MCP) that matched nothing this
 	 *  resolution — surfaced as warnings so zero-match typos are never silent.
 	 *  Tool globs are excluded: extension-contributed tools are unknowable
@@ -111,6 +117,11 @@ export interface ResolveInput {
 	 * fails rather than passing references through unchecked.
 	 */
 	discoveredMcpServers?: string[];
+	/**
+	 * Merged MCP configuration result. Carries server definitions, ownership,
+	 * and base settings.
+	 */
+	mcpDiscovery?: MergedMcpResult;
 	/**
 	 * The runtime overlay (ticket 06): temporary narrowing applied on top of
 	 * the profile definition at every resolution. Overlay references must
@@ -213,6 +224,10 @@ export async function resolveProfile(input: ResolveInput): Promise<ActivationPla
 	const definition: ProfileDefinition = profile.definition;
 	const unmatched: string[] = [];
 
+	if (input.mcpDiscovery !== undefined && input.discoveredMcpServers === undefined) {
+		input.discoveredMcpServers = Object.keys(input.mcpDiscovery.servers).sort();
+	}
+
 	let mcps: string[] | undefined;
 	if (definition.mcps !== undefined && definition.mcps.length > 0) {
 		if (input.discoveredMcpServers === undefined) {
@@ -286,6 +301,67 @@ export async function resolveProfile(input: ResolveInput): Promise<ActivationPla
 		}
 	}
 
+	const mcpToolsDef = (definition as ProfileDefinition & { mcp_tools?: Record<string, string[]> }).mcp_tools;
+	const mcpToolKeys = mcpToolsDef !== undefined ? Object.keys(mcpToolsDef) : [];
+
+	let mcpTools: Record<string, string[]> | undefined;
+	if (mcpToolKeys.length > 0) {
+		const hasAdapter = planExtensions.some((entry) => isAdapterExtension(entry));
+		if (!hasAdapter) {
+			throw new ActivationError(
+				`profile "${profile.name}" declares MCP tools but pi-mcp-adapter is not active. ` +
+					`Select the adapter in the profile's extensions (e.g. via its npm package) or remove the "mcp_tools" declaration.`,
+			);
+		}
+		if (input.mcpDiscovery === undefined) {
+			throw new ActivationError(
+				`profile "${profile.name}" declares MCP tools but no adapter server discovery is available`,
+			);
+		}
+
+		const mcpDiscovery = input.mcpDiscovery;
+		const usableCandidates = Object.keys(mcpDiscovery.servers)
+			.filter((s) => {
+				const isUser =
+					Object.hasOwn(mcpDiscovery.serverOwners, s) &&
+					mcpDiscovery.serverOwners[s] === "user" &&
+					!mcpDiscovery.projectServers.has(s);
+				const isEnabled = mcpDiscovery.servers[s]?.disabled !== true;
+				const isAllowedByMcps = mcps === undefined || mcps.includes(s);
+				return isUser && isEnabled && isAllowedByMcps;
+			})
+			.sort();
+		const candidateMsg = usableCandidates.length > 0 ? ` (usable candidates: ${usableCandidates.join(", ")})` : "";
+
+		for (const serverKey of mcpToolKeys) {
+			if (!Object.hasOwn(mcpDiscovery.servers, serverKey)) {
+				throw new ActivationError(`profile "${profile.name}": unknown MCP server "${serverKey}"${candidateMsg}`);
+			}
+			const isProject =
+				mcpDiscovery.serverOwners[serverKey] === "project" || mcpDiscovery.projectServers.has(serverKey);
+			if (isProject) {
+				throw new ActivationError(
+					`profile "${profile.name}": cannot narrow project-level MCP server "${serverKey}" (project-level servers are outside profile narrowing)`,
+				);
+			}
+			const isDisabled =
+				mcpDiscovery.servers[serverKey]?.disabled === true ||
+				(mcps !== undefined && !mcps.includes(serverKey));
+			if (isDisabled) {
+				throw new ActivationError(`profile "${profile.name}": MCP server "${serverKey}" is disabled${candidateMsg}`);
+			}
+		}
+
+		mcpTools = Object.fromEntries(
+			Object.entries(mcpToolsDef ?? {}).map(([server, selectors]) => [server, [...selectors]]),
+		);
+	}
+
+	let instanceMcpConfig: Record<string, unknown> | undefined;
+	if (input.mcpDiscovery !== undefined && (mcps !== undefined || mcpToolKeys.length > 0)) {
+		instanceMcpConfig = buildInstanceMcpConfig(profile.name, input.mcpDiscovery, mcps, mcpTools);
+	}
+
 	let tools: string[] | undefined;
 	if (toolReferences !== undefined) {
 		tools = expandReferences(toolReferences, BUILTIN_TOOL_NAMES, (name) => name, "tool", {
@@ -357,6 +433,120 @@ export async function resolveProfile(input: ResolveInput): Promise<ActivationPla
 		...(model !== undefined ? { model } : {}),
 		...(definition.instructions !== undefined ? { instructions: definition.instructions } : {}),
 		...(mcps !== undefined ? { mcps } : {}),
+		...(mcpTools !== undefined ? { mcpTools } : {}),
+		...(instanceMcpConfig !== undefined ? { instanceMcpConfig } : {}),
 		...(unmatched.length > 0 ? { unmatched } : {}),
 	};
 }
+
+function computeSafeMcpToolIntersection(
+	profileName: string,
+	serverName: string,
+	requestedTools: string[],
+	existingIncludes?: string[],
+): string[] {
+	if (
+		requestedTools.length === 0 ||
+		existingIncludes === undefined ||
+		existingIncludes.length === 0 ||
+		existingIncludes.includes("*")
+	) {
+		return [...requestedTools];
+	}
+
+	const unsafeSelector = requestedTools.find((selector) => !existingIncludes.includes(selector));
+	if (unsafeSelector !== undefined) {
+		throw new ActivationError(
+			`profile "${profileName}": unsafe MCP tool filter intersection for server "${serverName}": ` +
+				`selector ${JSON.stringify(unsafeSelector)} is not an exact member of existing includeTools; ` +
+				`use identical literals or an existing "*" allowlist to prove the restriction is safe`,
+		);
+	}
+	return [...requestedTools];
+}
+
+function setOwnRecordValue<T>(record: Record<string, T>, key: string, value: T): void {
+	Object.defineProperty(record, key, { value, enumerable: true, configurable: true, writable: true });
+}
+
+export function buildInstanceMcpConfig(
+	profileName: string,
+	mcpDiscovery: MergedMcpResult,
+	mcps?: string[],
+	mcpTools?: Record<string, string[]>,
+): Record<string, unknown> {
+	const filteredServers: Record<string, Record<string, unknown>> = {};
+	const userServers = Object.keys(mcpDiscovery.servers).filter(
+		(s) =>
+			Object.hasOwn(mcpDiscovery.serverOwners, s) &&
+			mcpDiscovery.serverOwners[s] === "user" &&
+			!mcpDiscovery.projectServers.has(s),
+	);
+
+	const serversToInclude = mcps !== undefined ? mcps : userServers;
+	for (const serverName of serversToInclude) {
+		const originalDef = Object.hasOwn(mcpDiscovery.servers, serverName)
+			? mcpDiscovery.servers[serverName]
+			: undefined;
+		if (originalDef !== undefined) {
+			const def = { ...originalDef };
+			if (mcps !== undefined) {
+				delete def.disabled;
+			}
+
+			if (mcpTools && Object.hasOwn(mcpTools, serverName)) {
+				if (
+					def.includeTools !== undefined &&
+					(!Array.isArray(def.includeTools) || !def.includeTools.every((t) => typeof t === "string"))
+				) {
+					throw new ActivationError(
+						`profile "${profileName}": unsafe MCP tool filter intersection for server "${serverName}": invalid existing includeTools`,
+					);
+				}
+				if (
+					def.excludeTools !== undefined &&
+					(!Array.isArray(def.excludeTools) || !def.excludeTools.every((t) => typeof t === "string"))
+				) {
+					throw new ActivationError(
+						`profile "${profileName}": unsafe MCP tool filter intersection for server "${serverName}": invalid existing excludeTools`,
+					);
+				}
+
+				const requested = mcpTools[serverName];
+				const existingIncludes = Array.isArray(def.includeTools) ? (def.includeTools as string[]) : undefined;
+				const existingExcludes = Array.isArray(def.excludeTools) ? (def.excludeTools as string[]) : undefined;
+
+				const safeTools = computeSafeMcpToolIntersection(
+					profileName,
+					serverName,
+					requested,
+					existingIncludes,
+				);
+
+				if (safeTools.length === 0) {
+					delete def.includeTools;
+					if (existingExcludes === undefined || !existingExcludes.includes("*")) {
+						def.excludeTools = [...(existingExcludes ?? []), "*"];
+					}
+				} else {
+					def.includeTools = safeTools;
+				}
+			}
+
+			setOwnRecordValue(filteredServers, serverName, def);
+		}
+	}
+
+	if (mcps !== undefined) {
+		for (const sharedName of mcpDiscovery.sharedServers) {
+			if (!mcps.includes(sharedName)) {
+				if (mcpDiscovery.projectServers.has(sharedName)) continue;
+				setOwnRecordValue(filteredServers, sharedName, { disabled: true });
+			}
+		}
+	}
+
+	return isRecord(mcpDiscovery.baseConfig)
+		? { ...mcpDiscovery.baseConfig, mcpServers: filteredServers }
+		: { mcpServers: filteredServers };
+}

package/src/settings-generator.ts

@@ -45,7 +45,7 @@ import { mkdir, mkdtemp, lstat, readdir, readFile, readlink, rm, stat, symlink,
 import { homedir } from "node:os";
 import path from "node:path";
 
-import type { ActivationPlan } from "./profile-resolver.ts";
+import { buildInstanceMcpConfig, type ActivationPlan } from "./profile-resolver.ts";
 import { getInstancesRootDir } from "./workspace.ts";
 import { isRecord } from "./json-file.ts";
 import { loadMergedMcpServers } from "./mcp-config.ts";
@@ -403,6 +403,7 @@ export async function writeRuntimeFiles(
 				...(plan.toolReferences !== undefined ? { toolReferences: plan.toolReferences } : {}),
 				...(plan.disabledTools !== undefined ? { disabledTools: plan.disabledTools } : {}),
 				...(plan.mcps !== undefined ? { mcps: plan.mcps } : {}),
+				...(plan.mcpTools !== undefined ? { mcpTools: plan.mcpTools } : {}),
 				// The resolved sets feed /profile status (absolute paths) and the
 				// glob-delta diff against the previous activation.
 				resolved: {
@@ -429,49 +430,36 @@ export async function writeRuntimeFiles(
 		await symlink(path.join(options.agentDir, "trust.json"), trustLink);
 	}
 
-	// MCP Servers generation (Ticket 04)
+	// MCP Servers generation (Ticket 04 & Separate MCP tool filtering)
 	const mcpTarget = path.join(options.agentDir, "mcp.json");
 	const mcpInstancePath = path.join(runtimeDir, "mcp.json");
-	if (plan.mcps === undefined) {
+	if (plan.instanceMcpConfig !== undefined) {
+		try { await rm(mcpInstancePath); } catch {}
+		await writeFile(mcpInstancePath, JSON.stringify(plan.instanceMcpConfig, null, 2));
+	} else if (
+		plan.mcps === undefined &&
+		(plan.mcpTools === undefined || Object.keys(plan.mcpTools).length === 0)
+	) {
 		// No restrictions, symlink
 		if (await exists(mcpTarget)) {
 			try { await rm(mcpInstancePath); } catch {}
 			await symlink(mcpTarget, mcpInstancePath);
 		}
 	} else {
-		// Filter MCP servers
+		// Filter MCP servers (fallback when instanceMcpConfig is not pre-populated)
 		try { await rm(mcpInstancePath); } catch {}
-		const { servers, sharedServers, projectServers, baseConfig } = await loadMergedMcpServers(
+		const discovery = await loadMergedMcpServers(
 			options.agentDir,
 			options.projectDir,
 			options.homeDir !== undefined ? { homeDir: options.homeDir } : undefined,
 		);
-
-		const allowedSet = new Set(plan.mcps);
-		const filteredServers: Record<string, unknown> = {};
-
-		for (const serverName of plan.mcps) {
-			if (servers[serverName] !== undefined) {
-				const def = { ...servers[serverName] };
-				delete def.disabled;
-				filteredServers[serverName] = def;
-			}
-		}
-
-		for (const sharedName of sharedServers) {
-			if (!allowedSet.has(sharedName)) {
-				// Project-level servers are not the profile's to narrow (the same
-				// boundary as project skills and extensions).
-				if (projectServers.has(sharedName)) continue;
-				filteredServers[sharedName] = { disabled: true };
-			}
-		}
-
-		const outputConfig: Record<string, unknown> = isRecord(baseConfig)
-			? { ...baseConfig, mcpServers: filteredServers }
-			: { mcpServers: filteredServers };
-
-		await writeFile(mcpInstancePath, JSON.stringify(outputConfig, null, 2));
+		const instanceMcpConfig = buildInstanceMcpConfig(
+			plan.profile,
+			discovery,
+			plan.mcps,
+			plan.mcpTools,
+		);
+		await writeFile(mcpInstancePath, JSON.stringify(instanceMcpConfig, null, 2));
 	}
 
 	// Instructions generation (Ticket 04)

package/src/switching/apply-plan.ts

@@ -8,13 +8,12 @@
  * surface so unit tests never need a real Pi.
  *
  * Steps:
- *   1. tools: re-expand the profile's raw tool references against Pi's LIVE
- *      tool registry (including extension- and MCP-provided tools) and
- *      call setActiveTools. This is the CURRENT strict-allowlist enforcement
- *      ensuring non-builtin tools obey profile restrictions; settings
- *      `defaultTools` provides only the boot baseline for built-ins.
- *      Literals that no tool provides are dropped with a warning — Pi
- *      silently ignores unknown names, so the warning is the only signal.
+ *   1. tools: re-expand the profile's raw references against Pi's LIVE
+ *      non-MCP tool registry and call setActiveTools while retaining
+ *      adapter-owned registrations. Settings `defaultTools` provides only
+ *      the boot baseline for built-ins. Literals that no Pi tool provides
+ *      are dropped with a warning — Pi silently ignores unknown names, so
+ *      the warning is the only signal.
  *      When the plan carries overlay disabled tool entries, the active set
  *      is the base expansion — the profile references, or the whole live
  *      registry when the profile declares none — minus the entries' live
@@ -31,7 +30,7 @@
  * established.
  */
 
-import { writeFile } from "node:fs/promises";
+import { readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
 
 import { isRecord, readJsonFile } from "../json-file.ts";
@@ -49,12 +48,13 @@ export interface LaunchPlanFile {
 	 *  from the base expansion at session start. */
 	disabledTools?: string[];
 	mcps?: string[];
+	mcpTools?: Record<string, string[]>;
 	switchedFrom?: string;
 	persistSelection?: boolean;
 	clearOverlay?: boolean;
 	resolved?: {
 		skills: Array<{ name: string; filePath: string }>;
-		extensions: Array<{ id: string; entry: string }>;
+		extensions: Array<{ id: string; entry: string; origin?: "package" | "local" | "path" }>;
 	};
 	/** Glob references that matched nothing at resolution (ADR-0009). */
 	unmatched?: string[];
@@ -68,7 +68,10 @@ export interface LaunchPlanFile {
 
 /** The narrow slice of ExtensionAPI/Context the application needs. */
 export interface PlanApplicationSurface {
-	getAllTools(): Array<{ name: string }>;
+	getAllTools(): Array<{
+		name: string;
+		sourceInfo?: { path?: string; source?: string };
+	}>;
 	setActiveTools(names: string[]): void;
 	notify?(message: string, level: "info" | "warning" | "error"): void;
 }
@@ -87,6 +90,70 @@ export async function readLaunchPlanFile(runtimeDir: string): Promise<LaunchPlan
 	return result.value as unknown as LaunchPlanFile;
 }
 
+interface AdapterAttribution {
+	/** Exact adapter entry paths (loose adapter files). */
+	exactEntries: string[];
+	/** Verified pi-mcp-adapter npm package roots. */
+	packageRoots: string[];
+}
+
+async function resolveAdapterPackageRoot(entryPath: string): Promise<string | undefined> {
+	let current = path.resolve(entryPath);
+	while (true) {
+		const parent = path.dirname(current);
+		if (parent === current) return undefined;
+		current = parent;
+		try {
+			const manifest: unknown = JSON.parse(await readFile(path.join(current, "package.json"), "utf8"));
+			if (isRecord(manifest) && manifest.name === "pi-mcp-adapter") {
+				return current;
+			}
+		} catch {
+			// Continue walking toward the filesystem root.
+		}
+	}
+}
+
+async function getAdapterAttribution(plan: LaunchPlanFile): Promise<AdapterAttribution> {
+	const exactEntries: string[] = [];
+	const packageRoots: string[] = [];
+	for (const ext of plan.resolved?.extensions ?? []) {
+		if (ext.origin === "package") {
+			const packageName = ext.id.split(":", 1)[0]!;
+			if (packageName === "pi-mcp-adapter") {
+				const root = await resolveAdapterPackageRoot(ext.entry);
+				if (root !== undefined) {
+					packageRoots.push(root);
+				}
+			}
+		} else if (ext.id === "pi-mcp-adapter") {
+			// Loose adapter files (and plan entries without an origin marker)
+			// own only their exact entry; siblings such as
+			// "pi-mcp-adapter/linter" do not become adapter-owned.
+			exactEntries.push(ext.entry);
+		}
+	}
+	return { exactEntries, packageRoots };
+}
+
+export function isMcpOwnedTool(
+	tool: { name: string; sourceInfo?: { path?: string; source?: string } },
+	attribution?: AdapterAttribution,
+): boolean {
+	const info = tool.sourceInfo;
+	if (!info) return false;
+	if (info.source === "pi-mcp-adapter" || info.source === "mcp") return true;
+	if (typeof info.path !== "string" || attribution === undefined) return false;
+	if (attribution.exactEntries.includes(info.path)) return true;
+	for (const root of attribution.packageRoots) {
+		const rel = path.relative(root, info.path);
+		if (rel !== "" && !rel.startsWith("..") && !path.isAbsolute(rel)) {
+			return true;
+		}
+	}
+	return false;
+}
+
 /** Applies the plan carried by the runtime dir's pi-profile.json. */
 export async function applyLaunchPlan(input: {
 	runtimeDir: string;
@@ -103,25 +170,53 @@ export async function applyLaunchPlan(input: {
 	const warnings: string[] = [];
 
 	// --- tools ---
-	if (plan.toolReferences !== undefined || plan.disabledTools !== undefined) {
-		const liveNames = surface.getAllTools().map((tool) => tool.name);
+	const hasOverlayDisables = plan.disabledTools !== undefined && plan.disabledTools.length > 0;
+	if (plan.toolReferences !== undefined || hasOverlayDisables) {
+		const allTools = surface.getAllTools();
+		const attribution = await getAdapterAttribution(plan);
+		const mcpToolNames: string[] = [];
+		const nonMcpToolNames: string[] = [];
+
+		for (const tool of allTools) {
+			if (isMcpOwnedTool(tool, attribution)) {
+				mcpToolNames.push(tool.name);
+			} else {
+				nonMcpToolNames.push(tool.name);
+			}
+		}
+
 		let active: string[];
 		if (plan.toolReferences !== undefined) {
-			const { expanded, droppedLiterals } = expandToolReferences(plan.toolReferences, liveNames);
+			const { expanded, droppedLiterals, legacyMcpReferences } = expandToolReferences(
+				plan.toolReferences,
+				nonMcpToolNames,
+				mcpToolNames,
+			);
 			if (droppedLiterals.length > 0) {
 				warnings.push(
 					`profile "${plan.profile}": tools ${droppedLiterals.map((name) => JSON.stringify(name)).join(", ")} match nothing in Pi's live registry`,
 				);
 			}
-			active = expanded;
+			if (legacyMcpReferences.length > 0) {
+				for (const ref of legacyMcpReferences) {
+					warnings.push(
+						`profile "${plan.profile}": tool reference ${JSON.stringify(ref)} matched only MCP tools; migrate MCP tool configuration to "mcp_tools"`,
+					);
+				}
+			}
+			// Retain MCP-owned tools in the live registry alongside selected Pi tools
+			active = [...expanded, ...mcpToolNames];
 		} else {
 			// No declared tools: the base is the whole live registry.
-			active = [...liveNames];
+			active = allTools.map((tool) => tool.name);
 		}
-		if (plan.disabledTools !== undefined && plan.disabledTools.length > 0) {
+
+		if (hasOverlayDisables) {
+			const allLiveNames = allTools.map((tool) => tool.name);
 			const { expanded: disabled, droppedLiterals: vanishedEntries } = expandToolReferences(
-				plan.disabledTools,
-				liveNames,
+				plan.disabledTools!,
+				allLiveNames,
+				mcpToolNames,
 			);
 			if (vanishedEntries.length > 0) {
 				warnings.push(

package/src/switching/status.ts

@@ -26,6 +26,12 @@ export interface StatusConflict {
 	winnerPath: string;
 }
 
+export interface McpServerToolStatus {
+	server: string;
+	policy: "unrestricted" | "restricted" | "none";
+	tools?: string[];
+}
+
 export interface StatusReport {
 	profile: string;
 	source: string;
@@ -34,6 +40,7 @@ export interface StatusReport {
 	extensions: Array<{ id: string; entry: string; origin?: string }>;
 	tools?: string[];
 	mcp: { enabled: string[]; disabled: string[]; missing: string[] };
+	mcpTools?: McpServerToolStatus[];
 	/** Glob delta versus the previous activation (prefixed names). */
 	delta?: { added: string[]; removed: string[] };
 	/** Glob references that matched nothing at resolution (ADR-0009). */
@@ -48,7 +55,7 @@ interface RegisteredCommand {
 
 interface RegisteredTool {
 	name: string;
-	sourceInfo?: { path: string; source: string };
+	sourceInfo?: { path?: string; source?: string };
 }
 
 function currentNames(plan: LaunchPlanFile): string[] {
@@ -65,18 +72,49 @@ export function buildStatusReport(input: {
 	plan: LaunchPlanFile;
 	overlay?: RuntimeOverlay;
 	discoveredMcpServers: string[];
+	disabledMcpServers: string[];
 	commands: RegisteredCommand[];
 	tools: RegisteredTool[];
 }): StatusReport {
 	const { plan } = input;
 
-	const enabled = plan.mcps ?? [];
 	const discovered = new Set(input.discoveredMcpServers);
-	const mcp = {
-		enabled,
-		disabled: input.discoveredMcpServers.filter((name) => !enabled.includes(name)),
-		missing: enabled.filter((name) => !discovered.has(name)),
-	};
+	let enabled: string[];
+	let disabled: string[];
+	let missing: string[];
+
+	if (plan.mcps === undefined) {
+		const adapterDisabled = new Set(input.disabledMcpServers);
+		enabled = input.discoveredMcpServers.filter((name) => !adapterDisabled.has(name));
+		disabled = input.discoveredMcpServers.filter((name) => adapterDisabled.has(name));
+		missing = [];
+	} else {
+		enabled = plan.mcps;
+		disabled = input.discoveredMcpServers.filter((name) => !enabled.includes(name));
+		missing = enabled.filter((name) => !discovered.has(name));
+	}
+
+	const mcp = { enabled, disabled, missing };
+
+	let mcpTools: McpServerToolStatus[] | undefined;
+	const policyMap = plan.mcpTools;
+	if (policyMap !== undefined || enabled.length > 0) {
+		mcpTools = [];
+		const allServers = Array.from(new Set([...enabled, ...Object.keys(policyMap ?? {})]));
+		for (const server of allServers) {
+			const hasPolicy = policyMap !== undefined && Object.prototype.hasOwnProperty.call(policyMap, server);
+			if (!hasPolicy) {
+				mcpTools.push({ server, policy: "unrestricted" });
+			} else {
+				const declaredTools = policyMap![server] ?? [];
+				if (declaredTools.length === 0) {
+					mcpTools.push({ server, policy: "none", tools: [] });
+				} else {
+					mcpTools.push({ server, policy: "restricted", tools: declaredTools });
+				}
+			}
+		}
+	}
 
 	let delta: StatusReport["delta"];
 	if (plan.previousResolved !== undefined) {
@@ -117,9 +155,15 @@ export function buildStatusReport(input: {
 		const winner = input.tools.find((entry) => entry.name === toolName);
 		const info = winner?.sourceInfo;
 		if (info === undefined) continue; // unknown names are dropped by pi.setActiveTools
-		const expected = info.source === "builtin" || extensionDirs.some((dir) => info.path.startsWith(dir));
+		const expected =
+			info.source === "builtin" ||
+			(typeof info.path === "string" && extensionDirs.some((dir) => info.path!.startsWith(dir)));
 		if (!expected) {
-			conflicts.push({ name: `tool:${toolName}`, expectedPath: "builtin or selected extension", winnerPath: info.path });
+			conflicts.push({
+				name: `tool:${toolName}`,
+				expectedPath: "builtin or selected extension",
+				winnerPath: info.path ?? "unknown",
+			});
 		}
 	}
 
@@ -131,6 +175,7 @@ export function buildStatusReport(input: {
 		extensions: plan.resolved?.extensions ?? [],
 		...(plan.tools !== undefined ? { tools: plan.tools } : {}),
 		mcp,
+		...(mcpTools !== undefined ? { mcpTools } : {}),
 		...(delta !== undefined ? { delta } : {}),
 		...(plan.unmatched !== undefined && plan.unmatched.length > 0 ? { unmatched: plan.unmatched } : {}),
 		conflicts,
@@ -168,6 +213,18 @@ export function formatStatusMarkdown(report: StatusReport): string {
 	lines.push(
 		`mcp: enabled=[${report.mcp.enabled.join(", ")}] disabled=[${report.mcp.disabled.join(", ")}] missing=[${report.mcp.missing.join(", ")}]`,
 	);
+	if (report.mcpTools !== undefined && report.mcpTools.length > 0) {
+		lines.push("mcp tools:");
+		for (const item of report.mcpTools) {
+			if (item.policy === "unrestricted") {
+				lines.push(`  ${item.server}: unrestricted`);
+			} else if (item.policy === "none") {
+				lines.push(`  ${item.server}: no enabled MCP tools`);
+			} else {
+				lines.push(`  ${item.server}: [${(item.tools ?? []).join(", ")}]`);
+			}
+		}
+	}
 	if (report.delta !== undefined) {
 		lines.push(`delta: +[${report.delta.added.join(", ")}] -[${report.delta.removed.join(", ")}]`);
 	}

package/src/switching/tool-references.ts

@@ -15,26 +15,48 @@ export interface ToolExpansion {
 	expanded: string[];
 	/** Literal references no live tool provides. */
 	droppedLiterals: string[];
+	/** References that matched only MCP-owned tools in the live registry. */
+	legacyMcpReferences: string[];
 }
 
-export function expandToolReferences(references: string[], liveToolNames: string[]): ToolExpansion {
-	const live = new Set(liveToolNames);
+export function expandToolReferences(
+	references: string[],
+	liveToolNames: string[],
+	mcpToolNames: string[] = [],
+): ToolExpansion {
+	const liveNonMcp = new Set(liveToolNames);
+	const liveMcp = new Set(mcpToolNames);
 	const expanded = new Set<string>();
 	const droppedLiterals: string[] = [];
+	const legacyMcpReferences: string[] = [];
+
 	for (const reference of references) {
 		if (reference.includes("*") || reference.includes("?")) {
+			let matchedNonMcp = false;
 			for (const name of liveToolNames) {
 				if (minimatch(name, reference)) {
 					expanded.add(name);
+					matchedNonMcp = true;
+				}
+			}
+			if (!matchedNonMcp && mcpToolNames.length > 0) {
+				for (const name of mcpToolNames) {
+					if (minimatch(name, reference)) {
+						legacyMcpReferences.push(reference);
+						break;
+					}
 				}
 			}
 			continue;
 		}
-		if (live.has(reference)) {
+
+		if (liveNonMcp.has(reference)) {
 			expanded.add(reference);
+		} else if (liveMcp.has(reference)) {
+			legacyMcpReferences.push(reference);
 		} else {
 			droppedLiterals.push(reference);
 		}
 	}
-	return { expanded: [...expanded], droppedLiterals };
+	return { expanded: [...expanded], droppedLiterals, legacyMcpReferences };
 }