wolfpack-mcp 1.0.104 → 1.0.106

package/README.md

@@ -309,6 +309,49 @@ Update an existing journal entry.
 - `entry_id` (required): The entry UUID
 - `title`, `content` (optional)
 
+### Ideas (the Idea Factory)
+
+Offered to a key holding `mcp:ideas:read` on a project where the `idea-factory` feature is
+switched on. There is no archive tool: archiving is the Idea Factory's delete, and MCP does not
+surface deletes.
+
+#### `list_ideas`
+
+List the live ideas in a project. Each carries a stage and a boost count, and the response says
+whether your own boost for today in that project is already spent.
+
+- `sort` (optional): `popular` (default), `updated` or `newest`
+- `limit`, `offset` (optional): Pagination
+
+#### `get_idea`
+
+Get a single idea, with its tags and the reference numbers of any work items being built from it.
+
+- `idea_id` (required): The idea refId (number)
+
+#### `create_idea`
+
+Raise a new idea. It starts at the `spark` stage with no boosts.
+
+- `title` (required): Idea title
+- `content` (required): Markdown content
+
+#### `update_idea`
+
+Update an idea, or move it to another stage.
+
+- `idea_id` (required): The idea refId (number)
+- `title`, `content` (optional)
+- `stage` (optional): `spark`, `exploring`, `building`, `shipped` or `parked`
+
+#### `boost_idea`
+
+Vote for an idea by spending your boost. One boost per project per day, whichever idea you spend
+it on — spending it again the same day is refused rather than counted. Takes `mcp:ideas:boost`,
+which is separate from `mcp:ideas:update`: voting is participation, not editing.
+
+- `idea_id` (required): The idea refId (number)
+
 ### Comments
 
 #### `list_work_item_comments`

package/dist/agentBuilderTools.js

@@ -1,6 +1,12 @@
 /**
  * Agent builder MCP tool definitions and handlers.
  * Registered only when the API key has the `agent_builder` capability.
+ *
+ * Each entry declares the scope its route already checks, so a key granted the
+ * capability on `mcp:agents:read` is offered the reads and not the writes it
+ * would be refused (#2493). `list_organisations` is the one `permission: null`
+ * here: `GET /mcp/organisations` checks no scope, being the discovery call the
+ * rest of the family needs to name an organisation at all.
  */
 import { z } from 'zod';
 import { config } from './config.js';
@@ -34,12 +40,18 @@ export const AGENT_BUILDER_TOOLS = [
     // ─── Group 0: Organisations ─────────────────────────────────────────────
     {
         name: 'list_organisations',
+        permission: null,
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'List organisations you belong to. Use org_slug parameter in other agent builder tools when you belong to multiple organisations.',
         inputSchema: { type: 'object', properties: {} },
     },
     // ─── Group 1: Agent CRUD ─────────────────────────────────────────────────
     {
         name: 'list_agents',
+        permission: 'mcp:agents:read',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'List agents. Returns name, status, template, and assigned projects. ' +
             'scope "org" (the default) lists the organisation\'s agents; scope "personal" lists your own ' +
             'My Agents from My Space, which belong to no organisation. Call it twice to see both.',
@@ -57,6 +69,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'get_agent',
+        permission: 'mcp:agents:read',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Get full details for an agent including config, instructions, LLM model, and linked skills. ' +
             'Takes an organisation agent or one of your own personal agents.',
         inputSchema: {
@@ -70,6 +85,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'create_agent',
+        permission: 'mcp:agents:create',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Create a new agent from a container image. Use list_container_images to see available images. ' +
             'With personal=true, creates one of your own My Agents instead of an organisation agent: ' +
             'it needs a handle, and only an image opened to personal use (list_container_images with ' +
@@ -98,6 +116,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'update_agent',
+        permission: 'mcp:agents:update',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: "Update an agent's config, instructions, or LLM model. Omit fields to leave them unchanged.",
         inputSchema: {
             type: 'object',
@@ -144,6 +165,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'list_agent_aliases',
+        permission: 'mcp:agents:read',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'List the aliases of an agent. Aliases share the source agent definition but have their own identity and queue.',
         inputSchema: {
             type: 'object',
@@ -156,6 +180,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'create_agent_alias',
+        permission: 'mcp:agents:create',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Create an alias of an agent, so the same definition can run work in parallel. ' +
             'An agent runs one session at a time, so N concurrent workers means N aliases. ' +
             'The alias live-tracks the source for container image, prompts, instructions, LLM, tools, skills and tasks — edit those once on the source. ' +
@@ -173,6 +200,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'get_agent_mcp_selections',
+        permission: 'mcp:agents:read',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: "List the template MCP servers this agent has opted out of. Returns { disabled: string[] } where each string is the MCP server key from the agent's template.",
         inputSchema: {
             type: 'object',
@@ -185,6 +215,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'update_agent_mcp_selections',
+        permission: 'mcp:agents:update',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Replace the list of template MCP servers this agent has opted out of. ' +
             'Pass an empty array to re-enable every template server. Template servers ' +
             'not in the list stay enabled; those in the list are disabled for this agent.',
@@ -205,6 +238,9 @@ export const AGENT_BUILDER_TOOLS = [
     // ─── Group 2: Project Assignment ─────────────────────────────────────────
     {
         name: 'list_agent_projects',
+        permission: 'mcp:agents:read',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'List projects assigned to an agent.',
         inputSchema: {
             type: 'object',
@@ -217,6 +253,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'assign_agent_to_project',
+        permission: 'mcp:agents:update',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Assign an agent to a project by slug.',
         inputSchema: {
             type: 'object',
@@ -230,6 +269,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'remove_agent_from_project',
+        permission: 'mcp:agents:update',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Remove an agent from a project.',
         inputSchema: {
             type: 'object',
@@ -244,6 +286,9 @@ export const AGENT_BUILDER_TOOLS = [
     // ─── Group 3: Sessions ────────────────────────────────────────────────────
     {
         name: 'list_agent_sessions',
+        permission: 'mcp:agents:read',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'List sessions for an agent. Filter by status: running, stopped, failed.',
         inputSchema: {
             type: 'object',
@@ -263,6 +308,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'get_agent_session',
+        permission: 'mcp:agents:read',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Get session metadata and recent events (last 20). Does NOT include full conversation — use get_agent_session_conversation for that.',
         inputSchema: {
             type: 'object',
@@ -276,6 +324,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'get_agent_session_conversation',
+        permission: 'mcp:agents:read',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Get the full conversation history for a session (paginated). Can be large for long-running sessions.',
         inputSchema: {
             type: 'object',
@@ -291,6 +342,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'run_agent',
+        permission: 'mcp:agents:create',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Queue an ad-hoc session with an inline prompt. This is async — it returns a queue entry ID immediately. ' +
             'Use list_agent_queue or list_agent_sessions to track progress.',
         inputSchema: {
@@ -314,6 +368,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'stop_agent_session',
+        permission: 'mcp:agents:update',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Stop a running agent session.',
         inputSchema: {
             type: 'object',
@@ -327,6 +384,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'resume_agent_session',
+        permission: 'mcp:agents:create',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Resume a completed session with a follow-up prompt. The agent continues with full prior context.',
         inputSchema: {
             type: 'object',
@@ -342,6 +402,9 @@ export const AGENT_BUILDER_TOOLS = [
     // ─── Group 4: Tasks & Queue ───────────────────────────────────────────────
     {
         name: 'list_agent_tasks',
+        permission: 'mcp:agents:read',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'List defined tasks for an agent.',
         inputSchema: {
             type: 'object',
@@ -354,6 +417,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'get_agent_task',
+        permission: 'mcp:agents:read',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Get details of a specific agent task.',
         inputSchema: {
             type: 'object',
@@ -367,6 +433,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'create_agent_task',
+        permission: 'mcp:agents:create',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Create a new task for an agent.',
         inputSchema: {
             type: 'object',
@@ -404,6 +473,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'update_agent_task',
+        permission: 'mcp:agents:update',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: "Update a task's prompt, sort order, model pin, or disabled tools/MCP servers.",
         inputSchema: {
             type: 'object',
@@ -440,6 +512,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'run_agent_task',
+        permission: 'mcp:agents:create',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Queue a saved task for immediate execution. Async — returns a queue entry ID. ' +
             'Use list_agent_queue to track progress.',
         inputSchema: {
@@ -469,6 +544,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'list_agent_queue',
+        permission: 'mcp:agents:read',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'List queue entries for an agent. Use this to track progress after run_agent or run_agent_task.',
         inputSchema: {
             type: 'object',
@@ -486,6 +564,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'cancel_queue_entry',
+        permission: 'mcp:agents:update',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Cancel a queued (not yet running) queue entry.',
         inputSchema: {
             type: 'object',
@@ -500,6 +581,9 @@ export const AGENT_BUILDER_TOOLS = [
     // ─── Group 4b: Schedules ─────────────────────────────────────────────────
     {
         name: 'list_agent_schedules',
+        permission: 'mcp:agents:read',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'List all schedules for an agent. Each schedule defines when and how often the agent wakes up, ' +
             'and which tasks to run.',
         inputSchema: {
@@ -513,6 +597,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'create_agent_schedule',
+        permission: 'mcp:agents:create',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Create a new schedule for an agent. A schedule defines frequency, working hours, timezone, ' +
             'and which tasks to run. Schedules are created disabled by default.',
         inputSchema: {
@@ -580,6 +667,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'update_agent_schedule',
+        permission: 'mcp:agents:update',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: "Update a schedule's configuration or task assignments.",
         inputSchema: {
             type: 'object',
@@ -641,6 +731,9 @@ export const AGENT_BUILDER_TOOLS = [
     // ─── Group 5: Skills (authoring) ─────────────────────────────────────────
     {
         name: 'create_skill',
+        permission: 'mcp:skills:create',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Create a skill. By default creates an org-level skill. ' +
             'Pass agent_id to create an agent-private skill scoped to that agent only.',
         inputSchema: {
@@ -669,6 +762,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'update_skill',
+        permission: 'mcp:skills:update',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: "Update a skill's instructions or description.",
         inputSchema: {
             type: 'object',
@@ -684,6 +780,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'create_skill_resource',
+        permission: 'mcp:skills:update',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Add a text resource to a skill (script, reference, or asset).',
         inputSchema: {
             type: 'object',
@@ -704,6 +803,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'update_skill_resource',
+        permission: 'mcp:skills:update',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: "Update a skill resource's content.",
         inputSchema: {
             type: 'object',
@@ -720,6 +822,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'set_agent_skills',
+        permission: 'mcp:agents:update',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Replace the full set of skills assigned to an agent. ' +
             'Use list_org_skills to find skill IDs, then pass all desired skill IDs here.',
         inputSchema: {
@@ -739,6 +844,9 @@ export const AGENT_BUILDER_TOOLS = [
     // ─── Group 5b: Skills (reading) ─────────────────────────────────────────
     {
         name: 'list_agent_skills',
+        permission: 'mcp:skills:read',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'List all skills for a specific agent: agent-private skills + linked org skills + built-in skills. ' +
             'Returns full skill objects with IDs. Agent-scoped skills have agentProfileId set. ' +
             'Use this to see what skills an agent has and get IDs for update_skill.',
@@ -752,6 +860,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'get_skill_detail',
+        permission: 'mcp:skills:read',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Get the full content of a skill by name. ' +
             'Returns instructions, metadata, and a list of attached resources. ' +
             'With agent_id: resolves agent-private → org → system (use after list_agent_skills). ' +
@@ -774,6 +885,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'list_org_skills',
+        permission: 'mcp:skills:read',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'List all skills in the org skill library (org-level + system-level). ' +
             'Returns ID, name, description, and whether the skill is built-in. ' +
             'Use skill IDs with set_agent_skills to assign skills to an agent.',
@@ -782,6 +896,9 @@ export const AGENT_BUILDER_TOOLS = [
     // ─── Group 6: Secrets ─────────────────────────────────────────────────────
     {
         name: 'list_agent_secrets',
+        permission: 'mcp:agents:read',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'List secret names for an agent, with the note recording where each value came from. ' +
             'Values are never returned.',
         inputSchema: {
@@ -795,6 +912,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'set_agent_secret',
+        permission: 'mcp:agents:create',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Create or update a secret for an agent. ' +
             'Name must be uppercase letters, digits, and underscores (e.g. MY_API_KEY). ' +
             'Omit value to change only shared_with_aliases or comment on an existing secret.',
@@ -822,6 +942,9 @@ export const AGENT_BUILDER_TOOLS = [
     // ─── Group 7: Discovery ───────────────────────────────────────────────────
     {
         name: 'list_container_images',
+        permission: 'mcp:agents:read',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'List agent-capable container images assigned to the organisation. Use image IDs when calling create_agent. ' +
             'With personal=true, lists the images a personal agent may run instead — the bring-your-own-token ' +
             'images opened to personal use, which are not an organisation catalogue.',
@@ -838,6 +961,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'list_llm_models',
+        permission: 'mcp:agents:read',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'List LLM providers and models available to the organisation. ' +
             'Use provider, model and family IDs when calling create_agent, update_agent, ' +
             'create_agent_task or update_agent_task.',

package/dist/agentObserveTools.js

@@ -4,8 +4,11 @@
  * Registered only when the API key has the `agent_observer` capability, and
  * stdio only — like the agent-self, agent-memory and agent-builder families,
  * these are tools an agent uses about the fleet it runs in, not tools an
- * integration calls over the remote transport, so they have no catalogue entry
- * and no generated remote copy to drift from.
+ * integration calls over the remote transport, so they are `stdioOnly` and have
+ * no generated remote copy to drift from. They are still catalogue entries
+ * (#2493): declaring the scope is what lets the stdio tool list tell the two
+ * observation tiers apart, and a tier a key cannot call is a tier it is not told
+ * it has.
  *
  * The backend decides what comes back: a session is visible to an observer only
  * where the observer is a member of a project the run was scoped to. Nothing in
@@ -22,6 +25,9 @@ const PROJECT_BOUND = 'You see a session only if it ran in a project you are a m
 export const AGENT_OBSERVE_TOOLS = [
     {
         name: 'list_observed_sessions',
+        permission: 'mcp:agents:observe',
+        capability: 'agent_observer',
+        stdioOnly: true,
         description: "List other agents' sessions across the projects you are a member of, newest first. " +
             'Returns status, trigger, timings, error text, token use and the projects each run was ' +
             'scoped to — no transcripts, no container logs, no system prompts. ' +
@@ -50,6 +56,9 @@ export const AGENT_OBSERVE_TOOLS = [
     },
     {
         name: 'get_observed_session',
+        permission: 'mcp:agents:observe',
+        capability: 'agent_observer',
+        stdioOnly: true,
         description: 'Read one observed session by id. Same fields as the listing. ' +
             'Not found if the session ran in no project of yours.',
         inputSchema: {
@@ -62,6 +71,9 @@ export const AGENT_OBSERVE_TOOLS = [
     },
     {
         name: 'get_observed_session_events',
+        permission: 'mcp:agents:observe',
+        capability: 'agent_observer',
+        stdioOnly: true,
         description: "Read an observed session's activity log: which tools ran, in order, with the one-line " +
             'summary each hook wrote. This is how a run looks from outside — the same tool repeating, ' +
             'or nothing at all for a long time, is what "stuck" looks like. ' +
@@ -78,6 +90,9 @@ export const AGENT_OBSERVE_TOOLS = [
     },
     {
         name: 'get_observed_session_conversation',
+        permission: 'mcp:agents:observe_transcripts',
+        capability: 'agent_observer',
+        stdioOnly: true,
         description: "Read an observed session's conversation. Requires the separate " +
             'mcp:agents:observe_transcripts permission, which most observers do not have and do not ' +
             'need: a transcript carries repository contents, shell output and the agent’s system ' +

package/dist/agentSelfTools.js

@@ -3,9 +3,22 @@ function text(data) {
     return JSON.stringify(data, null, 2);
 }
 // ─── Tool definitions ──────────────────────────────────────────────────────────
+/**
+ * An agent reading and recording its own context, stdio only.
+ *
+ * `permission: null` throughout, and it is a decision rather than a gap (#2493):
+ * `McpSelfController` calls no `checkMcpPermission` at all, because the gate is
+ * being an agent — every route resolves an `AgentProfile` from the caller and
+ * refuses anyone else — and no `MCP_PERMISSIONS` member names that. The
+ * capability is what withholds these, and for memory it is withheld from an agent
+ * whose memory is off (#1776).
+ */
 export const AGENT_SELF_TOOLS = [
     {
         name: 'get_self',
+        permission: null,
+        capability: 'agent_self',
+        stdioOnly: true,
         description: 'Get your own agent profile with full composed context: system prompt, instructions, skills, LLM model, and assigned projects. ' +
             'Use this to understand how you are configured and what capabilities you have. ' +
             'Essential for self-reflection and improvement proposals.',
@@ -13,6 +26,9 @@ export const AGENT_SELF_TOOLS = [
     },
     {
         name: 'get_own_sessions',
+        permission: null,
+        capability: 'agent_self',
+        stdioOnly: true,
         description: 'List your own recent sessions. Returns session metadata including status, trigger type, and timestamps. ' +
             'Use this to review your recent activity for retrospective analysis.',
         inputSchema: {
@@ -31,6 +47,9 @@ export const AGENT_SELF_TOOLS = [
 export const AGENT_MEMORY_TOOLS = [
     {
         name: 'list_memories',
+        permission: null,
+        capability: 'agent_memory',
+        stdioOnly: true,
         description: 'List the persistent memory entries this session can see: your global ones, plus those scoped to the projects this session runs in. ' +
             'Memory persists across sessions and is scoped to you. ' +
             'Use this to recall observations, patterns, and notes from previous work.',
@@ -38,6 +57,9 @@ export const AGENT_MEMORY_TOOLS = [
     },
     {
         name: 'get_memory',
+        permission: null,
+        capability: 'agent_memory',
+        stdioOnly: true,
         description: 'Get a specific memory entry by key. Returns the content and metadata for a single memory entry.',
         inputSchema: {
             type: 'object',
@@ -49,6 +71,9 @@ export const AGENT_MEMORY_TOOLS = [
     },
     {
         name: 'save_memory',
+        permission: null,
+        capability: 'agent_memory',
+        stdioOnly: true,
         description: 'Save a persistent memory entry by key. Creates the entry if it does not exist, or updates it if it does. ' +
             'Use this to persist observations, learnings, and notes across sessions. ' +
             'To clear a memory entry, save it with empty content. ' +

package/dist/browserTools.js

@@ -14,6 +14,9 @@ function text(data) {
 export const BROWSER_TOOLS = [
     {
         name: 'browser_request_control',
+        permission: 'mcp:browser:control',
+        capability: 'browser_control',
+        stdioOnly: true,
         description: 'Ask the person you are chatting with for permission to drive their browser. ' +
             'They see your reason in the conversation with Allow and Deny buttons, and this call waits for their answer. ' +
             'You MUST call this and be granted control before any other browser tool will work — there is no way around it, ' +
@@ -32,6 +35,9 @@ export const BROWSER_TOOLS = [
     },
     {
         name: 'browser_snapshot',
+        permission: 'mcp:browser:control',
+        capability: 'browser_control',
+        stdioOnly: true,
         description: 'See the page: its URL, title, visible text, and the interactive elements you can act on. ' +
             'Each element comes back with a "ref" — pass that ref to browser_click or browser_type. ' +
             'Refs are only valid until the page changes, so take a fresh snapshot after every action.',
@@ -39,6 +45,9 @@ export const BROWSER_TOOLS = [
     },
     {
         name: 'browser_click',
+        permission: 'mcp:browser:control',
+        capability: 'browser_control',
+        stdioOnly: true,
         description: 'Click an element on the page. The visitor sees the pointer travel to it before it is clicked.',
         inputSchema: {
             type: 'object',
@@ -50,6 +59,9 @@ export const BROWSER_TOOLS = [
     },
     {
         name: 'browser_type',
+        permission: 'mcp:browser:control',
+        capability: 'browser_control',
+        stdioOnly: true,
         description: 'Type text into an input, textarea or select on the page, replacing whatever it holds.',
         inputSchema: {
             type: 'object',
@@ -62,6 +74,9 @@ export const BROWSER_TOOLS = [
     },
     {
         name: 'browser_scroll',
+        permission: 'mcp:browser:control',
+        capability: 'browser_control',
+        stdioOnly: true,
         description: 'Scroll the page vertically to bring more of it into view.',
         inputSchema: {
             type: 'object',
@@ -76,6 +91,9 @@ export const BROWSER_TOOLS = [
     },
     {
         name: 'browser_release_control',
+        permission: 'mcp:browser:control',
+        capability: 'browser_control',
+        stdioOnly: true,
         description: 'Hand the browser back when you are done, so the visitor stops seeing the "agent in control" frame on their screen. ' +
             'Always do this once the task is finished. They can also stop you themselves at any time.',
         inputSchema: { type: 'object', properties: {} },

package/dist/client.js

@@ -489,6 +489,33 @@ export class WolfpackClient {
     async updateJournalEntry(entryId, data, teamSlug) {
         return this.api.patch(this.withTeamSlug(`/journal-entries/${encodeURIComponent(entryId)}`, teamSlug), data);
     }
+    // Idea methods (the Idea Factory)
+    async listIdeas(options) {
+        const params = new URLSearchParams();
+        if (options?.teamSlug)
+            params.append('teamSlug', options.teamSlug);
+        if (options?.sort)
+            params.append('sort', options.sort);
+        if (options?.limit !== undefined)
+            params.append('limit', options.limit.toString());
+        if (options?.offset !== undefined)
+            params.append('offset', options.offset.toString());
+        const query = params.toString();
+        return this.api.get(`/ideas${query ? `?${query}` : ''}`);
+    }
+    async getIdea(ideaId, teamSlug) {
+        return this.api.get(this.withTeamSlug(`/ideas/${encodeURIComponent(ideaId)}`, teamSlug));
+    }
+    async createIdea(data) {
+        const { teamSlug, ...rest } = data;
+        return this.api.post('/ideas', { ...rest, teamSlug });
+    }
+    async updateIdea(ideaId, data, teamSlug) {
+        return this.api.put(this.withTeamSlug(`/ideas/${encodeURIComponent(ideaId)}`, teamSlug), data);
+    }
+    async boostIdea(ideaId, teamSlug) {
+        return this.api.post(this.withTeamSlug(`/ideas/${encodeURIComponent(ideaId)}/boost`, teamSlug), {});
+    }
     // Comment methods
     async listWorkItemComments(workItemId, teamSlug) {
         return this.api.get(this.withTeamSlug(`/work-items/${workItemId}/comments`, teamSlug));

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import { CallToolRequestSchema, ListToolsRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
+import { CallToolRequestSchema, ListToolsRequestSchema } from '@modelcontextprotocol/sdk/types.js';
 import { z } from 'zod';
 import { createRequire } from 'module';
 import { readFile, stat } from 'fs/promises';
@@ -10,12 +10,12 @@ import { WolfpackClient } from './client.js';
 import { productName } from './brand.js';
 import { allTasksChecked, getWorkItemReminders } from './workItemReminders.js';
 import { validateConfig, config } from './config.js';
-import { AGENT_BUILDER_TOOLS, handleAgentBuilderTool } from './agentBuilderTools.js';
+import { handleAgentBuilderTool } from './agentBuilderTools.js';
 import { handleProcedureTool } from './procedureTools.js';
 import { stdioTools, toolNamesFor, withProductName } from './toolCatalogue.js';
-import { AGENT_SELF_TOOLS, AGENT_MEMORY_TOOLS, handleAgentSelfTool } from './agentSelfTools.js';
-import { AGENT_OBSERVE_TOOLS, handleAgentObserveTool } from './agentObserveTools.js';
-import { BROWSER_TOOLS, handleBrowserTool } from './browserTools.js';
+import { handleAgentSelfTool } from './agentSelfTools.js';
+import { handleAgentObserveTool } from './agentObserveTools.js';
+import { handleBrowserTool } from './browserTools.js';
 import { resolveRadarItemId } from './resolveRadarItemId.js';
 import { SERVER_INSTRUCTIONS } from './serverInstructions.js';
 import { fetch as proxyFetch } from './proxyFetch.js';
@@ -534,6 +534,37 @@ const UpdateJournalEntrySchema = z.object({
         .optional()
         .describe('Project slug (required for multi-project users, use list_projects to get slugs)'),
 });
+// Idea schemas (the Idea Factory)
+const PROJECT_SLUG_DESCRIPTION = 'Project slug (required for multi-project users, use list_projects to get slugs)';
+const ListIdeasSchema = z.object({
+    sort: z
+        .string()
+        .optional()
+        .describe('Ordering: "popular" (default, most boosted first), "updated", or "newest"'),
+    limit: z.number().optional().describe('Maximum number of ideas to return'),
+    offset: z.number().optional().describe('Number of ideas to skip'),
+    project_slug: z.string().optional().describe(PROJECT_SLUG_DESCRIPTION),
+});
+const GetIdeaSchema = z.object({
+    idea_id: refIdString().describe('The idea refId (number)'),
+    project_slug: z.string().optional().describe(PROJECT_SLUG_DESCRIPTION),
+});
+const CreateIdeaSchema = z.object({
+    title: z.string().describe('Idea title'),
+    content: z.string().describe('Idea content (markdown)'),
+    project_slug: z.string().optional().describe(PROJECT_SLUG_DESCRIPTION),
+});
+const UpdateIdeaSchema = z.object({
+    idea_id: refIdString().describe('The idea refId (number)'),
+    title: z.string().optional().describe('Updated title'),
+    content: z.string().optional().describe('Updated content (markdown)'),
+    stage: z.string().optional().describe('New stage: spark, exploring, building, shipped or parked'),
+    project_slug: z.string().optional().describe(PROJECT_SLUG_DESCRIPTION),
+});
+const BoostIdeaSchema = z.object({
+    idea_id: refIdString().describe('The idea refId (number)'),
+    project_slug: z.string().optional().describe(PROJECT_SLUG_DESCRIPTION),
+});
 // Comment schemas
 const ListWorkItemCommentsSchema = z.object({
     work_item_id: refIdString().describe('The work item refId (number)'),
@@ -833,16 +864,11 @@ class WolfpackMCPServer {
                 await this.fetchCapabilities();
             }
             return {
-                // The catalogue carries a token where the product's name belongs (#2466); it is
-                // filled in here, as the tools are advertised.
-                tools: withProductName([
-                    ...stdioTools(this.capabilities, this.permissions),
-                    ...(this.capabilities.includes('agent_self') ? AGENT_SELF_TOOLS : []),
-                    ...(this.capabilities.includes('agent_memory') ? AGENT_MEMORY_TOOLS : []),
-                    ...(this.capabilities.includes('agent_observer') ? AGENT_OBSERVE_TOOLS : []),
-                    ...(this.capabilities.includes('agent_builder') ? AGENT_BUILDER_TOOLS : []),
-                    ...(this.capabilities.includes('browser_control') ? BROWSER_TOOLS : []),
-                ], productName),
+                // Every family is a catalogue entry, so one call covers them all — gated on
+                // the capability and on the key's own scopes (#2493). The catalogue carries a
+                // token where the product's name belongs (#2466); it is filled in here, as the
+                // tools are advertised.
+                tools: withProductName(stdioTools(this.capabilities, this.permissions), productName),
             };
         });
         this.server.setRequestHandler(CallToolRequestSchema, async (request) => {
@@ -1512,6 +1538,71 @@ class WolfpackMCPServer {
                             ],
                         };
                     }
+                    // Idea handlers (the Idea Factory)
+                    case 'list_ideas': {
+                        const parsed = ListIdeasSchema.parse(args);
+                        const result = await this.client.listIdeas({
+                            teamSlug: parsed.project_slug || this.client.getProjectSlug() || undefined,
+                            sort: parsed.sort,
+                            limit: parsed.limit,
+                            offset: parsed.offset,
+                        });
+                        const spent = result.boostSpentToday
+                            ? 'Your boost for today in this project is already spent.'
+                            : 'Your boost for today in this project is unspent.';
+                        let text = `${spent}\n\n${JSON.stringify(stripUuids(result.items), null, 2)}`;
+                        if (result.total > result.items.length) {
+                            text = `Note: Showing ${result.items.length} of ${result.total} ideas. Use limit/offset for pagination.\n\n${text}`;
+                        }
+                        return { content: [{ type: 'text', text }] };
+                    }
+                    case 'get_idea': {
+                        const parsed = GetIdeaSchema.parse(args);
+                        const idea = await this.client.getIdea(parsed.idea_id, parsed.project_slug || this.client.getProjectSlug() || undefined);
+                        return {
+                            content: [{ type: 'text', text: JSON.stringify(stripUuids(idea), null, 2) }],
+                        };
+                    }
+                    case 'create_idea': {
+                        const parsed = CreateIdeaSchema.parse(args);
+                        const idea = await this.client.createIdea({
+                            title: parsed.title,
+                            content: parsed.content,
+                            teamSlug: parsed.project_slug || this.client.getProjectSlug() || undefined,
+                        });
+                        return {
+                            content: [
+                                {
+                                    type: 'text',
+                                    text: `Created idea #${idea.refId}: ${idea.title}\n\n${JSON.stringify(stripUuids(idea), null, 2)}`,
+                                },
+                            ],
+                        };
+                    }
+                    case 'update_idea': {
+                        const parsed = UpdateIdeaSchema.parse(args);
+                        const idea = await this.client.updateIdea(parsed.idea_id, { title: parsed.title, content: parsed.content, stage: parsed.stage }, parsed.project_slug || this.client.getProjectSlug() || undefined);
+                        return {
+                            content: [
+                                {
+                                    type: 'text',
+                                    text: `Updated idea #${idea.refId}: ${idea.title} (${idea.stage})\n\n${JSON.stringify(stripUuids(idea), null, 2)}`,
+                                },
+                            ],
+                        };
+                    }
+                    case 'boost_idea': {
+                        const parsed = BoostIdeaSchema.parse(args);
+                        const idea = await this.client.boostIdea(parsed.idea_id, parsed.project_slug || this.client.getProjectSlug() || undefined);
+                        return {
+                            content: [
+                                {
+                                    type: 'text',
+                                    text: `Boosted idea #${idea.refId}: ${idea.title} now has ${idea.boostCount} boost(s). That was your boost for today in this project.`,
+                                },
+                            ],
+                        };
+                    }
                     // Comment handlers
                     case 'list_work_item_comments': {
                         const parsed = ListWorkItemCommentsSchema.parse(args);
@@ -1941,14 +2032,14 @@ class WolfpackMCPServer {
                         }
                         // Check agent self tools
                         if (this.capabilities.includes('agent_self')) {
-                            const selfToolNames = AGENT_SELF_TOOLS.map((t) => t.name);
+                            const selfToolNames = toolNamesFor('agent_self');
                             if (selfToolNames.includes(name)) {
                                 return handleAgentSelfTool(name, args, this.client);
                             }
                         }
                         // Check memory tools (separately gated — #1776)
                         if (this.capabilities.includes('agent_memory')) {
-                            const memoryToolNames = AGENT_MEMORY_TOOLS.map((t) => t.name);
+                            const memoryToolNames = toolNamesFor('agent_memory');
                             if (memoryToolNames.includes(name)) {
                                 return handleAgentSelfTool(name, args, this.client);
                             }
@@ -1956,14 +2047,14 @@ class WolfpackMCPServer {
                         // Check observation tools (#2388 — other agents' runs, in the
                         // observer's own projects)
                         if (this.capabilities.includes('agent_observer')) {
-                            const observeToolNames = AGENT_OBSERVE_TOOLS.map((t) => t.name);
+                            const observeToolNames = toolNamesFor('agent_observer');
                             if (observeToolNames.includes(name)) {
                                 return handleAgentObserveTool(name, args, this.client);
                             }
                         }
                         // Check browser control tools (#2288 — chat sessions only)
                         if (this.capabilities.includes('browser_control')) {
-                            const browserToolNames = BROWSER_TOOLS.map((t) => t.name);
+                            const browserToolNames = toolNamesFor('browser_control');
                             if (browserToolNames.includes(name)) {
                                 return handleBrowserTool(name, args, this.client);
                             }

package/dist/stdioToolPermissions.test.js

@@ -67,6 +67,30 @@ describe('the tool list served over stdio', () => {
         expect(names).not.toContain('update_work_item');
         expect(names).not.toContain('create_work_item_comment');
     }, 60_000);
+    it('offers an observer key the tiers of observation its scopes reach', async () => {
+        // #2493 — the observe family was appended after `stdioTools` and filtered on
+        // the capability alone, so a coach holding `observe` was advertised the
+        // transcript tool and refused on every call. The two scopes are one
+        // capability by design (#2388), which is exactly why the tool list has to
+        // tell them apart.
+        const names = await toolNamesFrom(await stubBackend({
+            capabilities: ['agent_observer'],
+            permissions: ['mcp:agents:observe'],
+        }));
+        expect(names).toContain('list_observed_sessions');
+        expect(names).toContain('get_observed_session_events');
+        expect(names).not.toContain('get_observed_session_conversation');
+    }, 60_000);
+    it('offers a read-only builder key its reads and none of its writes', async () => {
+        // #2493, the same gap on the largest family: `agent_builder` is granted on
+        // `mcp:agents:read` alone, so every write in it was advertised to a key that
+        // cannot call one.
+        const names = await toolNamesFrom(await stubBackend({ capabilities: ['agent_builder'], permissions: ['mcp:agents:read'] }));
+        expect(names).toContain('list_agents');
+        expect(names).toContain('list_organisations');
+        expect(names).not.toContain('create_agent');
+        expect(names).not.toContain('update_agent');
+    }, 60_000);
     it('is not stripped when the capabilities round trip fails', async () => {
         // #1488 the other way up: a gateway outage means the key's scopes are
         // unknown, not that the key holds none. Stripping the list on a 503 would

package/dist/toolCatalogue.js

@@ -16,11 +16,17 @@
  * `rootDir: ./src`. A generated, never-hand-edited copy is what one source of
  * truth looks like across that boundary.
  *
- * The agent-builder, agent-self, agent-memory and browser-control families are
- * deliberately not here: they exist on the stdio transport only (see
- * `agentBuilderTools.ts`, `agentSelfTools.ts`, `browserTools.ts`), so they have
- * no second declaration to drift from.
+ * The agent-self, agent-memory, agent-observer, agent-builder and browser-control
+ * families stay in the files that hold their handlers, and are appended to the
+ * catalogue from there. They exist on the stdio transport only, which `stdioOnly`
+ * records — but being stdio-only is no reason to declare no scope, and while they
+ * sat outside the catalogue they declared none, so neither the scope filter
+ * (#2428) nor the scope-is-required rule (#2345) reached them (#2493).
  */
+import { AGENT_SELF_TOOLS, AGENT_MEMORY_TOOLS } from './agentSelfTools.js';
+import { AGENT_OBSERVE_TOOLS } from './agentObserveTools.js';
+import { AGENT_BUILDER_TOOLS } from './agentBuilderTools.js';
+import { BROWSER_TOOLS } from './browserTools.js';
 /**
  * The token a description carries where the product's name belongs (#2466).
  *
@@ -74,7 +80,8 @@ const DEFINITION_DESCRIPTION = 'Workflow definition: { nodes: [{id, type, positi
     'setVariable, createPage, createJournalEntry, llmPrompt, jsonata, agentTask, runContainer), data.label, and ' +
     "data.config holding that type's settings — the step body belongs in data.config.description, not data.description. " +
     'Use activityType "task" for a step a person just reads and ticks off.';
-export const TOOL_CATALOGUE = [
+/** The tools both transports serve. */
+const SHARED_TOOLS = [
     // Project tools
     {
         name: 'list_projects',
@@ -1146,6 +1153,124 @@ export const TOOL_CATALOGUE = [
             required: ['entry_id'],
         },
     },
+    // Idea Factory tools (#2473). Gated on the `ideas` capability, which the backend
+    // grants a key holding mcp:ideas:read once the `idea-factory` flag is on for it.
+    // No archive tool: archiving is the Idea Factory's delete, and MCP does not
+    // surface deletes (packages/mcp/CLAUDE.md).
+    {
+        name: 'list_ideas',
+        permission: 'mcp:ideas:read',
+        capability: 'ideas',
+        description: 'List the live ideas in a project (the Idea Factory). Use when user asks about "ideas", ' +
+            '"the idea factory", "what has been suggested", or "what are we thinking about". ' +
+            'Each idea carries a stage (spark, exploring, building, shipped, parked) and a boostCount — ' +
+            'the number of members who have voted for it. The response also says whether your own boost ' +
+            'for today in this project has already been spent.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                sort: {
+                    type: 'string',
+                    description: 'Ordering: "popular" (default, most boosted first), "updated", or "newest"',
+                },
+                limit: { type: 'number', description: 'Maximum number of ideas to return' },
+                offset: { type: 'number', description: 'Number of ideas to skip' },
+                project_slug: {
+                    type: 'string',
+                    description: 'Project slug (required for multi-project users, use list_projects to get slugs)',
+                },
+            },
+        },
+    },
+    {
+        name: 'get_idea',
+        permission: 'mcp:ideas:read',
+        capability: 'ideas',
+        description: 'Get a single idea by its refId, with its full content, stage, tags, boost count and the ' +
+            'refIds of any work items being built from it.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                idea_id: { type: 'string', description: 'The idea refId (number)' },
+                project_slug: {
+                    type: 'string',
+                    description: 'Project slug (required for multi-project users, use list_projects to get slugs)',
+                },
+            },
+            required: ['idea_id'],
+        },
+    },
+    {
+        name: 'create_idea',
+        permission: 'mcp:ideas:create',
+        capability: 'ideas',
+        description: 'Raise a new idea in the Idea Factory. Use when user wants to "suggest", "raise an idea", ' +
+            '"add to the idea factory", or "capture a thought". A new idea starts at the "spark" stage ' +
+            'with no boosts. Requires mcp:ideas:create permission. ' +
+            CONTENT_LINKING_HELP,
+        inputSchema: {
+            type: 'object',
+            properties: {
+                title: { type: 'string', description: 'Idea title' },
+                content: { type: 'string', description: 'Idea content (markdown)' },
+                // No tag_ids: the service takes tag UUIDs and the MCP surface strips UUIDs
+                // from every response, so an agent never holds one to send back. Tag an
+                // idea in the UI.
+                project_slug: {
+                    type: 'string',
+                    description: 'Project slug (required for multi-project users, use list_projects to get slugs)',
+                },
+            },
+            required: ['title', 'content'],
+        },
+    },
+    {
+        name: 'update_idea',
+        permission: 'mcp:ideas:update',
+        capability: 'ideas',
+        description: 'Update an idea, or move it to another stage. The stages are "spark" (just raised), ' +
+            '"exploring", "building", "shipped" and "parked" — moving an idea along is how the project ' +
+            'sees what became of it. Requires mcp:ideas:update permission. ' +
+            CONTENT_LINKING_HELP,
+        inputSchema: {
+            type: 'object',
+            properties: {
+                idea_id: { type: 'string', description: 'The idea refId (number)' },
+                title: { type: 'string', description: 'Updated title' },
+                content: { type: 'string', description: 'Updated content (markdown)' },
+                stage: {
+                    type: 'string',
+                    description: 'New stage: spark, exploring, building, shipped or parked',
+                },
+                project_slug: {
+                    type: 'string',
+                    description: 'Project slug (required for multi-project users, use list_projects to get slugs)',
+                },
+            },
+            required: ['idea_id'],
+        },
+    },
+    {
+        name: 'boost_idea',
+        permission: 'mcp:ideas:boost',
+        capability: 'ideas',
+        description: 'Vote for an idea by spending your boost. Use when user wants to "vote for", "boost", ' +
+            '"back" or "+1" an idea. You get ONE boost per project per day, whichever idea you spend ' +
+            'it on, so it is a choice between ideas rather than a click — spending it again the same ' +
+            'day is refused rather than counted. Requires mcp:ideas:boost permission, which is separate ' +
+            'from mcp:ideas:update: voting is participation, not editing.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                idea_id: { type: 'string', description: 'The idea refId (number)' },
+                project_slug: {
+                    type: 'string',
+                    description: 'Project slug (required for multi-project users, use list_projects to get slugs)',
+                },
+            },
+            required: ['idea_id'],
+        },
+    },
     // Comment tools
     {
         name: 'list_work_item_comments',
@@ -2152,6 +2277,14 @@ export const TOOL_CATALOGUE = [
         },
     },
 ];
+export const TOOL_CATALOGUE = [
+    ...SHARED_TOOLS,
+    ...AGENT_SELF_TOOLS,
+    ...AGENT_MEMORY_TOOLS,
+    ...AGENT_OBSERVE_TOOLS,
+    ...AGENT_BUILDER_TOOLS,
+    ...BROWSER_TOOLS,
+];
 const toTool = ({ name, description, inputSchema }) => ({
     name,
     description,
@@ -2181,13 +2314,20 @@ export function toolNamesFor(capability) {
     return TOOL_CATALOGUE.filter((t) => t.capability === capability).map((t) => t.name);
 }
 /**
- * The catalogue as the remote transport advertises it: every tool, taking the
- * `remote` override where one is set. This is what the generated backend copy holds.
+ * The catalogue as the remote transport advertises it: every tool but the
+ * stdio-only ones, taking the `remote` override where one is set. This is what
+ * the generated backend copy holds.
  */
 export function remoteTools() {
-    return TOOL_CATALOGUE.map((t) => ({ ...toTool(t), ...t.remote }));
+    return TOOL_CATALOGUE.filter((t) => !t.stdioOnly).map((t) => ({ ...toTool(t), ...t.remote }));
 }
-/** The scope the remote transport requires per tool, derived from the catalogue. */
-export function remoteToolPermissions() {
+/**
+ * The scope each tool requires, derived from the catalogue. The stdio-only tools
+ * are in here too, though the remote server can never dispatch one: the scope is a
+ * fact about the tool rather than about a transport, and this map is what the
+ * quarterly prompt-injection probe reads to tell an induced tool that is inside
+ * the agent's grant from one that is outside it (#2493).
+ */
+export function toolPermissions() {
     return Object.fromEntries(TOOL_CATALOGUE.map((t) => [t.name, t.permission]));
 }

package/dist/toolCatalogue.test.js

@@ -2,8 +2,11 @@ import { describe, it, expect } from 'vitest';
 import { readFileSync } from 'fs';
 import { join } from 'path';
 import * as catalogue from './toolCatalogue.js';
-import { TOOL_CATALOGUE, remoteTools, stdioTools } from './toolCatalogue.js';
+import { TOOL_CATALOGUE, remoteTools, toolPermissions, stdioTools, toolNamesFor, } from './toolCatalogue.js';
 import { BROWSER_TOOLS } from './browserTools.js';
+import { AGENT_SELF_TOOLS, AGENT_MEMORY_TOOLS } from './agentSelfTools.js';
+import { AGENT_OBSERVE_TOOLS } from './agentObserveTools.js';
+import { AGENT_BUILDER_TOOLS } from './agentBuilderTools.js';
 // @ts-expect-error — a plain .mjs build script, deliberately not part of this program
 import { render, GENERATED_PATH } from '../../../scripts/generate-mcp-catalogue.mjs';
 const repoFile = (path) => readFileSync(join(__dirname, '../../..', path), 'utf8');
@@ -61,13 +64,16 @@ describe('the MCP tool catalogue', () => {
             .map((param) => `${tool.name}.${param}`));
         expect(unforwarded).toEqual([]);
     });
-    it('offers the procedure tools over stdio only to a key with that capability', () => {
-        const withProcedures = stdioTools(['procedures']).map((t) => t.name);
+    // Every capability in the catalogue, not just `procedures`: a family added with
+    // its `capability` left off is offered to every key, and nothing else notices.
+    it.each([...new Set(TOOL_CATALOGUE.map((t) => t.capability).filter(Boolean))])('offers the %s tools over stdio only to a key with that capability', (capability) => {
+        const gated = TOOL_CATALOGUE.filter((t) => t.capability === capability).map((t) => t.name);
+        const withIt = stdioTools([capability]).map((t) => t.name);
         const without = stdioTools([]).map((t) => t.name);
-        expect(withProcedures).toContain('start_case');
-        expect(without).not.toContain('start_case');
+        expect(withIt).toEqual(expect.arrayContaining(gated));
+        gated.forEach((name) => expect(without).not.toContain(name));
         // Gating is the only difference: nothing else drops out.
-        expect(withProcedures.length - without.length).toBe(TOOL_CATALOGUE.filter((t) => t.capability === 'procedures').length);
+        expect(withIt.length - without.length).toBe(gated.length);
     });
     it('offers a tool over stdio only to a key holding its scope', () => {
         // #2428 — the list told an agent it could do things the 403 then refused.
@@ -77,11 +83,42 @@ describe('the MCP tool catalogue', () => {
         expect(readOnly).not.toContain('create_issue');
     });
     it('keeps a tool that deliberately requires no scope of its own', () => {
-        // `permission: null` is a decision, not a gap, so an empty key still gets these.
-        const unscoped = TOOL_CATALOGUE.filter((t) => t.permission === null).map((t) => t.name);
+        // `permission: null` is a decision, not a gap, so an empty key still gets these
+        // — the ones no capability gates, which is every family a plain key can reach.
+        const unscoped = TOOL_CATALOGUE.filter((t) => t.permission === null && !t.capability).map((t) => t.name);
         expect(unscoped.length).toBeGreaterThan(0);
         expect(stdioTools([], []).map((t) => t.name)).toEqual(unscoped);
     });
+    it('serves a stdio-only tool over stdio alone, and still declares its scope', () => {
+        // #2493 — the five families used to be appended after `stdioTools`, so they
+        // reached neither the scope filter nor the scope-is-required rule. They are
+        // catalogue entries now, which must not put them in front of a remote client:
+        // the remote server has no dispatch case for one, and advertising it would be
+        // a promise the product cannot keep.
+        const stdioOnly = TOOL_CATALOGUE.filter((t) => t.stdioOnly);
+        expect(stdioOnly.map((t) => t.name)).toContain('get_observed_session_conversation');
+        expect(remoteTools().map((t) => t.name)).not.toContain('get_observed_session_conversation');
+        // The scope still reaches the generated map, which is what the quarterly
+        // prompt-injection probe reads to judge whether an induced tool is in scope.
+        const permissions = toolPermissions();
+        for (const tool of stdioOnly) {
+            expect(permissions[tool.name], tool.name).toBe(tool.permission);
+            expect(tool.capability, tool.name).toBeDefined();
+        }
+    });
+    it.each([
+        ['agent_self', AGENT_SELF_TOOLS],
+        ['agent_memory', AGENT_MEMORY_TOOLS],
+        ['agent_observer', AGENT_OBSERVE_TOOLS],
+        ['agent_builder', AGENT_BUILDER_TOOLS],
+        ['browser_control', BROWSER_TOOLS],
+    ])('names the whole %s family for the stdio dispatch to route on', (capability, family) => {
+        // The stdio server routes a call to a family's handler by asking the catalogue
+        // for that capability's names, rather than by importing the array (#2493). A
+        // tool whose `capability` does not match the file it lives in would then be
+        // advertised and dispatched to the wrong handler — or to none.
+        expect(toolNamesFor(capability)).toEqual(family.map((t) => t.name));
+    });
     it('honours a wildcard the way the server does when it checks the call', () => {
         // Filtering has to read a scope exactly as `checkMcpPermission` does, or a
         // key on `mcp:*` loses tools it is entitled to call.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wolfpack-mcp",
-  "version": "1.0.104",
+  "version": "1.0.106",
   "description": "MCP server for Wolfpack AI-enhanced software delivery tools",
   "main": "dist/index.js",
   "type": "module",
@@ -14,6 +14,7 @@
     "clean": "",
     "build": "tsc",
     "dev": "tsx watch src/index.ts",
+    "generate:catalogue": "tsx ../../scripts/generate-mcp-catalogue.mjs",
     "start": "node dist/index.js",
     "test": "vitest",
     "lint": "eslint . --max-warnings 0",