wolfpack-mcp 1.0.105 → 1.0.106

package/dist/agentBuilderTools.js

@@ -1,6 +1,12 @@
 /**
  * Agent builder MCP tool definitions and handlers.
  * Registered only when the API key has the `agent_builder` capability.
+ *
+ * Each entry declares the scope its route already checks, so a key granted the
+ * capability on `mcp:agents:read` is offered the reads and not the writes it
+ * would be refused (#2493). `list_organisations` is the one `permission: null`
+ * here: `GET /mcp/organisations` checks no scope, being the discovery call the
+ * rest of the family needs to name an organisation at all.
  */
 import { z } from 'zod';
 import { config } from './config.js';
@@ -34,12 +40,18 @@ export const AGENT_BUILDER_TOOLS = [
     // ─── Group 0: Organisations ─────────────────────────────────────────────
     {
         name: 'list_organisations',
+        permission: null,
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'List organisations you belong to. Use org_slug parameter in other agent builder tools when you belong to multiple organisations.',
         inputSchema: { type: 'object', properties: {} },
     },
     // ─── Group 1: Agent CRUD ─────────────────────────────────────────────────
     {
         name: 'list_agents',
+        permission: 'mcp:agents:read',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'List agents. Returns name, status, template, and assigned projects. ' +
             'scope "org" (the default) lists the organisation\'s agents; scope "personal" lists your own ' +
             'My Agents from My Space, which belong to no organisation. Call it twice to see both.',
@@ -57,6 +69,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'get_agent',
+        permission: 'mcp:agents:read',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Get full details for an agent including config, instructions, LLM model, and linked skills. ' +
             'Takes an organisation agent or one of your own personal agents.',
         inputSchema: {
@@ -70,6 +85,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'create_agent',
+        permission: 'mcp:agents:create',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Create a new agent from a container image. Use list_container_images to see available images. ' +
             'With personal=true, creates one of your own My Agents instead of an organisation agent: ' +
             'it needs a handle, and only an image opened to personal use (list_container_images with ' +
@@ -98,6 +116,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'update_agent',
+        permission: 'mcp:agents:update',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: "Update an agent's config, instructions, or LLM model. Omit fields to leave them unchanged.",
         inputSchema: {
             type: 'object',
@@ -144,6 +165,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'list_agent_aliases',
+        permission: 'mcp:agents:read',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'List the aliases of an agent. Aliases share the source agent definition but have their own identity and queue.',
         inputSchema: {
             type: 'object',
@@ -156,6 +180,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'create_agent_alias',
+        permission: 'mcp:agents:create',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Create an alias of an agent, so the same definition can run work in parallel. ' +
             'An agent runs one session at a time, so N concurrent workers means N aliases. ' +
             'The alias live-tracks the source for container image, prompts, instructions, LLM, tools, skills and tasks — edit those once on the source. ' +
@@ -173,6 +200,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'get_agent_mcp_selections',
+        permission: 'mcp:agents:read',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: "List the template MCP servers this agent has opted out of. Returns { disabled: string[] } where each string is the MCP server key from the agent's template.",
         inputSchema: {
             type: 'object',
@@ -185,6 +215,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'update_agent_mcp_selections',
+        permission: 'mcp:agents:update',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Replace the list of template MCP servers this agent has opted out of. ' +
             'Pass an empty array to re-enable every template server. Template servers ' +
             'not in the list stay enabled; those in the list are disabled for this agent.',
@@ -205,6 +238,9 @@ export const AGENT_BUILDER_TOOLS = [
     // ─── Group 2: Project Assignment ─────────────────────────────────────────
     {
         name: 'list_agent_projects',
+        permission: 'mcp:agents:read',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'List projects assigned to an agent.',
         inputSchema: {
             type: 'object',
@@ -217,6 +253,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'assign_agent_to_project',
+        permission: 'mcp:agents:update',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Assign an agent to a project by slug.',
         inputSchema: {
             type: 'object',
@@ -230,6 +269,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'remove_agent_from_project',
+        permission: 'mcp:agents:update',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Remove an agent from a project.',
         inputSchema: {
             type: 'object',
@@ -244,6 +286,9 @@ export const AGENT_BUILDER_TOOLS = [
     // ─── Group 3: Sessions ────────────────────────────────────────────────────
     {
         name: 'list_agent_sessions',
+        permission: 'mcp:agents:read',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'List sessions for an agent. Filter by status: running, stopped, failed.',
         inputSchema: {
             type: 'object',
@@ -263,6 +308,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'get_agent_session',
+        permission: 'mcp:agents:read',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Get session metadata and recent events (last 20). Does NOT include full conversation — use get_agent_session_conversation for that.',
         inputSchema: {
             type: 'object',
@@ -276,6 +324,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'get_agent_session_conversation',
+        permission: 'mcp:agents:read',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Get the full conversation history for a session (paginated). Can be large for long-running sessions.',
         inputSchema: {
             type: 'object',
@@ -291,6 +342,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'run_agent',
+        permission: 'mcp:agents:create',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Queue an ad-hoc session with an inline prompt. This is async — it returns a queue entry ID immediately. ' +
             'Use list_agent_queue or list_agent_sessions to track progress.',
         inputSchema: {
@@ -314,6 +368,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'stop_agent_session',
+        permission: 'mcp:agents:update',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Stop a running agent session.',
         inputSchema: {
             type: 'object',
@@ -327,6 +384,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'resume_agent_session',
+        permission: 'mcp:agents:create',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Resume a completed session with a follow-up prompt. The agent continues with full prior context.',
         inputSchema: {
             type: 'object',
@@ -342,6 +402,9 @@ export const AGENT_BUILDER_TOOLS = [
     // ─── Group 4: Tasks & Queue ───────────────────────────────────────────────
     {
         name: 'list_agent_tasks',
+        permission: 'mcp:agents:read',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'List defined tasks for an agent.',
         inputSchema: {
             type: 'object',
@@ -354,6 +417,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'get_agent_task',
+        permission: 'mcp:agents:read',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Get details of a specific agent task.',
         inputSchema: {
             type: 'object',
@@ -367,6 +433,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'create_agent_task',
+        permission: 'mcp:agents:create',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Create a new task for an agent.',
         inputSchema: {
             type: 'object',
@@ -404,6 +473,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'update_agent_task',
+        permission: 'mcp:agents:update',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: "Update a task's prompt, sort order, model pin, or disabled tools/MCP servers.",
         inputSchema: {
             type: 'object',
@@ -440,6 +512,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'run_agent_task',
+        permission: 'mcp:agents:create',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Queue a saved task for immediate execution. Async — returns a queue entry ID. ' +
             'Use list_agent_queue to track progress.',
         inputSchema: {
@@ -469,6 +544,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'list_agent_queue',
+        permission: 'mcp:agents:read',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'List queue entries for an agent. Use this to track progress after run_agent or run_agent_task.',
         inputSchema: {
             type: 'object',
@@ -486,6 +564,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'cancel_queue_entry',
+        permission: 'mcp:agents:update',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Cancel a queued (not yet running) queue entry.',
         inputSchema: {
             type: 'object',
@@ -500,6 +581,9 @@ export const AGENT_BUILDER_TOOLS = [
     // ─── Group 4b: Schedules ─────────────────────────────────────────────────
     {
         name: 'list_agent_schedules',
+        permission: 'mcp:agents:read',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'List all schedules for an agent. Each schedule defines when and how often the agent wakes up, ' +
             'and which tasks to run.',
         inputSchema: {
@@ -513,6 +597,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'create_agent_schedule',
+        permission: 'mcp:agents:create',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Create a new schedule for an agent. A schedule defines frequency, working hours, timezone, ' +
             'and which tasks to run. Schedules are created disabled by default.',
         inputSchema: {
@@ -580,6 +667,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'update_agent_schedule',
+        permission: 'mcp:agents:update',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: "Update a schedule's configuration or task assignments.",
         inputSchema: {
             type: 'object',
@@ -641,6 +731,9 @@ export const AGENT_BUILDER_TOOLS = [
     // ─── Group 5: Skills (authoring) ─────────────────────────────────────────
     {
         name: 'create_skill',
+        permission: 'mcp:skills:create',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Create a skill. By default creates an org-level skill. ' +
             'Pass agent_id to create an agent-private skill scoped to that agent only.',
         inputSchema: {
@@ -669,6 +762,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'update_skill',
+        permission: 'mcp:skills:update',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: "Update a skill's instructions or description.",
         inputSchema: {
             type: 'object',
@@ -684,6 +780,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'create_skill_resource',
+        permission: 'mcp:skills:update',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Add a text resource to a skill (script, reference, or asset).',
         inputSchema: {
             type: 'object',
@@ -704,6 +803,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'update_skill_resource',
+        permission: 'mcp:skills:update',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: "Update a skill resource's content.",
         inputSchema: {
             type: 'object',
@@ -720,6 +822,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'set_agent_skills',
+        permission: 'mcp:agents:update',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Replace the full set of skills assigned to an agent. ' +
             'Use list_org_skills to find skill IDs, then pass all desired skill IDs here.',
         inputSchema: {
@@ -739,6 +844,9 @@ export const AGENT_BUILDER_TOOLS = [
     // ─── Group 5b: Skills (reading) ─────────────────────────────────────────
     {
         name: 'list_agent_skills',
+        permission: 'mcp:skills:read',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'List all skills for a specific agent: agent-private skills + linked org skills + built-in skills. ' +
             'Returns full skill objects with IDs. Agent-scoped skills have agentProfileId set. ' +
             'Use this to see what skills an agent has and get IDs for update_skill.',
@@ -752,6 +860,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'get_skill_detail',
+        permission: 'mcp:skills:read',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Get the full content of a skill by name. ' +
             'Returns instructions, metadata, and a list of attached resources. ' +
             'With agent_id: resolves agent-private → org → system (use after list_agent_skills). ' +
@@ -774,6 +885,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'list_org_skills',
+        permission: 'mcp:skills:read',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'List all skills in the org skill library (org-level + system-level). ' +
             'Returns ID, name, description, and whether the skill is built-in. ' +
             'Use skill IDs with set_agent_skills to assign skills to an agent.',
@@ -782,6 +896,9 @@ export const AGENT_BUILDER_TOOLS = [
     // ─── Group 6: Secrets ─────────────────────────────────────────────────────
     {
         name: 'list_agent_secrets',
+        permission: 'mcp:agents:read',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'List secret names for an agent, with the note recording where each value came from. ' +
             'Values are never returned.',
         inputSchema: {
@@ -795,6 +912,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'set_agent_secret',
+        permission: 'mcp:agents:create',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'Create or update a secret for an agent. ' +
             'Name must be uppercase letters, digits, and underscores (e.g. MY_API_KEY). ' +
             'Omit value to change only shared_with_aliases or comment on an existing secret.',
@@ -822,6 +942,9 @@ export const AGENT_BUILDER_TOOLS = [
     // ─── Group 7: Discovery ───────────────────────────────────────────────────
     {
         name: 'list_container_images',
+        permission: 'mcp:agents:read',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'List agent-capable container images assigned to the organisation. Use image IDs when calling create_agent. ' +
             'With personal=true, lists the images a personal agent may run instead — the bring-your-own-token ' +
             'images opened to personal use, which are not an organisation catalogue.',
@@ -838,6 +961,9 @@ export const AGENT_BUILDER_TOOLS = [
     },
     {
         name: 'list_llm_models',
+        permission: 'mcp:agents:read',
+        capability: 'agent_builder',
+        stdioOnly: true,
         description: 'List LLM providers and models available to the organisation. ' +
             'Use provider, model and family IDs when calling create_agent, update_agent, ' +
             'create_agent_task or update_agent_task.',

package/dist/agentObserveTools.js

@@ -4,8 +4,11 @@
  * Registered only when the API key has the `agent_observer` capability, and
  * stdio only — like the agent-self, agent-memory and agent-builder families,
  * these are tools an agent uses about the fleet it runs in, not tools an
- * integration calls over the remote transport, so they have no catalogue entry
- * and no generated remote copy to drift from.
+ * integration calls over the remote transport, so they are `stdioOnly` and have
+ * no generated remote copy to drift from. They are still catalogue entries
+ * (#2493): declaring the scope is what lets the stdio tool list tell the two
+ * observation tiers apart, and a tier a key cannot call is a tier it is not told
+ * it has.
  *
  * The backend decides what comes back: a session is visible to an observer only
  * where the observer is a member of a project the run was scoped to. Nothing in
@@ -22,6 +25,9 @@ const PROJECT_BOUND = 'You see a session only if it ran in a project you are a m
 export const AGENT_OBSERVE_TOOLS = [
     {
         name: 'list_observed_sessions',
+        permission: 'mcp:agents:observe',
+        capability: 'agent_observer',
+        stdioOnly: true,
         description: "List other agents' sessions across the projects you are a member of, newest first. " +
             'Returns status, trigger, timings, error text, token use and the projects each run was ' +
             'scoped to — no transcripts, no container logs, no system prompts. ' +
@@ -50,6 +56,9 @@ export const AGENT_OBSERVE_TOOLS = [
     },
     {
         name: 'get_observed_session',
+        permission: 'mcp:agents:observe',
+        capability: 'agent_observer',
+        stdioOnly: true,
         description: 'Read one observed session by id. Same fields as the listing. ' +
             'Not found if the session ran in no project of yours.',
         inputSchema: {
@@ -62,6 +71,9 @@ export const AGENT_OBSERVE_TOOLS = [
     },
     {
         name: 'get_observed_session_events',
+        permission: 'mcp:agents:observe',
+        capability: 'agent_observer',
+        stdioOnly: true,
         description: "Read an observed session's activity log: which tools ran, in order, with the one-line " +
             'summary each hook wrote. This is how a run looks from outside — the same tool repeating, ' +
             'or nothing at all for a long time, is what "stuck" looks like. ' +
@@ -78,6 +90,9 @@ export const AGENT_OBSERVE_TOOLS = [
     },
     {
         name: 'get_observed_session_conversation',
+        permission: 'mcp:agents:observe_transcripts',
+        capability: 'agent_observer',
+        stdioOnly: true,
         description: "Read an observed session's conversation. Requires the separate " +
             'mcp:agents:observe_transcripts permission, which most observers do not have and do not ' +
             'need: a transcript carries repository contents, shell output and the agent’s system ' +

package/dist/agentSelfTools.js

@@ -3,9 +3,22 @@ function text(data) {
     return JSON.stringify(data, null, 2);
 }
 // ─── Tool definitions ──────────────────────────────────────────────────────────
+/**
+ * An agent reading and recording its own context, stdio only.
+ *
+ * `permission: null` throughout, and it is a decision rather than a gap (#2493):
+ * `McpSelfController` calls no `checkMcpPermission` at all, because the gate is
+ * being an agent — every route resolves an `AgentProfile` from the caller and
+ * refuses anyone else — and no `MCP_PERMISSIONS` member names that. The
+ * capability is what withholds these, and for memory it is withheld from an agent
+ * whose memory is off (#1776).
+ */
 export const AGENT_SELF_TOOLS = [
     {
         name: 'get_self',
+        permission: null,
+        capability: 'agent_self',
+        stdioOnly: true,
         description: 'Get your own agent profile with full composed context: system prompt, instructions, skills, LLM model, and assigned projects. ' +
             'Use this to understand how you are configured and what capabilities you have. ' +
             'Essential for self-reflection and improvement proposals.',
@@ -13,6 +26,9 @@ export const AGENT_SELF_TOOLS = [
     },
     {
         name: 'get_own_sessions',
+        permission: null,
+        capability: 'agent_self',
+        stdioOnly: true,
         description: 'List your own recent sessions. Returns session metadata including status, trigger type, and timestamps. ' +
             'Use this to review your recent activity for retrospective analysis.',
         inputSchema: {
@@ -31,6 +47,9 @@ export const AGENT_SELF_TOOLS = [
 export const AGENT_MEMORY_TOOLS = [
     {
         name: 'list_memories',
+        permission: null,
+        capability: 'agent_memory',
+        stdioOnly: true,
         description: 'List the persistent memory entries this session can see: your global ones, plus those scoped to the projects this session runs in. ' +
             'Memory persists across sessions and is scoped to you. ' +
             'Use this to recall observations, patterns, and notes from previous work.',
@@ -38,6 +57,9 @@ export const AGENT_MEMORY_TOOLS = [
     },
     {
         name: 'get_memory',
+        permission: null,
+        capability: 'agent_memory',
+        stdioOnly: true,
         description: 'Get a specific memory entry by key. Returns the content and metadata for a single memory entry.',
         inputSchema: {
             type: 'object',
@@ -49,6 +71,9 @@ export const AGENT_MEMORY_TOOLS = [
     },
     {
         name: 'save_memory',
+        permission: null,
+        capability: 'agent_memory',
+        stdioOnly: true,
         description: 'Save a persistent memory entry by key. Creates the entry if it does not exist, or updates it if it does. ' +
             'Use this to persist observations, learnings, and notes across sessions. ' +
             'To clear a memory entry, save it with empty content. ' +

package/dist/browserTools.js

@@ -14,6 +14,9 @@ function text(data) {
 export const BROWSER_TOOLS = [
     {
         name: 'browser_request_control',
+        permission: 'mcp:browser:control',
+        capability: 'browser_control',
+        stdioOnly: true,
         description: 'Ask the person you are chatting with for permission to drive their browser. ' +
             'They see your reason in the conversation with Allow and Deny buttons, and this call waits for their answer. ' +
             'You MUST call this and be granted control before any other browser tool will work — there is no way around it, ' +
@@ -32,6 +35,9 @@ export const BROWSER_TOOLS = [
     },
     {
         name: 'browser_snapshot',
+        permission: 'mcp:browser:control',
+        capability: 'browser_control',
+        stdioOnly: true,
         description: 'See the page: its URL, title, visible text, and the interactive elements you can act on. ' +
             'Each element comes back with a "ref" — pass that ref to browser_click or browser_type. ' +
             'Refs are only valid until the page changes, so take a fresh snapshot after every action.',
@@ -39,6 +45,9 @@ export const BROWSER_TOOLS = [
     },
     {
         name: 'browser_click',
+        permission: 'mcp:browser:control',
+        capability: 'browser_control',
+        stdioOnly: true,
         description: 'Click an element on the page. The visitor sees the pointer travel to it before it is clicked.',
         inputSchema: {
             type: 'object',
@@ -50,6 +59,9 @@ export const BROWSER_TOOLS = [
     },
     {
         name: 'browser_type',
+        permission: 'mcp:browser:control',
+        capability: 'browser_control',
+        stdioOnly: true,
         description: 'Type text into an input, textarea or select on the page, replacing whatever it holds.',
         inputSchema: {
             type: 'object',
@@ -62,6 +74,9 @@ export const BROWSER_TOOLS = [
     },
     {
         name: 'browser_scroll',
+        permission: 'mcp:browser:control',
+        capability: 'browser_control',
+        stdioOnly: true,
         description: 'Scroll the page vertically to bring more of it into view.',
         inputSchema: {
             type: 'object',
@@ -76,6 +91,9 @@ export const BROWSER_TOOLS = [
     },
     {
         name: 'browser_release_control',
+        permission: 'mcp:browser:control',
+        capability: 'browser_control',
+        stdioOnly: true,
         description: 'Hand the browser back when you are done, so the visitor stops seeing the "agent in control" frame on their screen. ' +
             'Always do this once the task is finished. They can also stop you themselves at any time.',
         inputSchema: { type: 'object', properties: {} },

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import { CallToolRequestSchema, ListToolsRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
+import { CallToolRequestSchema, ListToolsRequestSchema } from '@modelcontextprotocol/sdk/types.js';
 import { z } from 'zod';
 import { createRequire } from 'module';
 import { readFile, stat } from 'fs/promises';
@@ -10,12 +10,12 @@ import { WolfpackClient } from './client.js';
 import { productName } from './brand.js';
 import { allTasksChecked, getWorkItemReminders } from './workItemReminders.js';
 import { validateConfig, config } from './config.js';
-import { AGENT_BUILDER_TOOLS, handleAgentBuilderTool } from './agentBuilderTools.js';
+import { handleAgentBuilderTool } from './agentBuilderTools.js';
 import { handleProcedureTool } from './procedureTools.js';
 import { stdioTools, toolNamesFor, withProductName } from './toolCatalogue.js';
-import { AGENT_SELF_TOOLS, AGENT_MEMORY_TOOLS, handleAgentSelfTool } from './agentSelfTools.js';
-import { AGENT_OBSERVE_TOOLS, handleAgentObserveTool } from './agentObserveTools.js';
-import { BROWSER_TOOLS, handleBrowserTool } from './browserTools.js';
+import { handleAgentSelfTool } from './agentSelfTools.js';
+import { handleAgentObserveTool } from './agentObserveTools.js';
+import { handleBrowserTool } from './browserTools.js';
 import { resolveRadarItemId } from './resolveRadarItemId.js';
 import { SERVER_INSTRUCTIONS } from './serverInstructions.js';
 import { fetch as proxyFetch } from './proxyFetch.js';
@@ -864,16 +864,11 @@ class WolfpackMCPServer {
                 await this.fetchCapabilities();
             }
             return {
-                // The catalogue carries a token where the product's name belongs (#2466); it is
-                // filled in here, as the tools are advertised.
-                tools: withProductName([
-                    ...stdioTools(this.capabilities, this.permissions),
-                    ...(this.capabilities.includes('agent_self') ? AGENT_SELF_TOOLS : []),
-                    ...(this.capabilities.includes('agent_memory') ? AGENT_MEMORY_TOOLS : []),
-                    ...(this.capabilities.includes('agent_observer') ? AGENT_OBSERVE_TOOLS : []),
-                    ...(this.capabilities.includes('agent_builder') ? AGENT_BUILDER_TOOLS : []),
-                    ...(this.capabilities.includes('browser_control') ? BROWSER_TOOLS : []),
-                ], productName),
+                // Every family is a catalogue entry, so one call covers them all — gated on
+                // the capability and on the key's own scopes (#2493). The catalogue carries a
+                // token where the product's name belongs (#2466); it is filled in here, as the
+                // tools are advertised.
+                tools: withProductName(stdioTools(this.capabilities, this.permissions), productName),
             };
         });
         this.server.setRequestHandler(CallToolRequestSchema, async (request) => {
@@ -2037,14 +2032,14 @@ class WolfpackMCPServer {
                         }
                         // Check agent self tools
                         if (this.capabilities.includes('agent_self')) {
-                            const selfToolNames = AGENT_SELF_TOOLS.map((t) => t.name);
+                            const selfToolNames = toolNamesFor('agent_self');
                             if (selfToolNames.includes(name)) {
                                 return handleAgentSelfTool(name, args, this.client);
                             }
                         }
                         // Check memory tools (separately gated — #1776)
                         if (this.capabilities.includes('agent_memory')) {
-                            const memoryToolNames = AGENT_MEMORY_TOOLS.map((t) => t.name);
+                            const memoryToolNames = toolNamesFor('agent_memory');
                             if (memoryToolNames.includes(name)) {
                                 return handleAgentSelfTool(name, args, this.client);
                             }
@@ -2052,14 +2047,14 @@ class WolfpackMCPServer {
                         // Check observation tools (#2388 — other agents' runs, in the
                         // observer's own projects)
                         if (this.capabilities.includes('agent_observer')) {
-                            const observeToolNames = AGENT_OBSERVE_TOOLS.map((t) => t.name);
+                            const observeToolNames = toolNamesFor('agent_observer');
                             if (observeToolNames.includes(name)) {
                                 return handleAgentObserveTool(name, args, this.client);
                             }
                         }
                         // Check browser control tools (#2288 — chat sessions only)
                         if (this.capabilities.includes('browser_control')) {
-                            const browserToolNames = BROWSER_TOOLS.map((t) => t.name);
+                            const browserToolNames = toolNamesFor('browser_control');
                             if (browserToolNames.includes(name)) {
                                 return handleBrowserTool(name, args, this.client);
                             }

package/dist/stdioToolPermissions.test.js

@@ -67,6 +67,30 @@ describe('the tool list served over stdio', () => {
         expect(names).not.toContain('update_work_item');
         expect(names).not.toContain('create_work_item_comment');
     }, 60_000);
+    it('offers an observer key the tiers of observation its scopes reach', async () => {
+        // #2493 — the observe family was appended after `stdioTools` and filtered on
+        // the capability alone, so a coach holding `observe` was advertised the
+        // transcript tool and refused on every call. The two scopes are one
+        // capability by design (#2388), which is exactly why the tool list has to
+        // tell them apart.
+        const names = await toolNamesFrom(await stubBackend({
+            capabilities: ['agent_observer'],
+            permissions: ['mcp:agents:observe'],
+        }));
+        expect(names).toContain('list_observed_sessions');
+        expect(names).toContain('get_observed_session_events');
+        expect(names).not.toContain('get_observed_session_conversation');
+    }, 60_000);
+    it('offers a read-only builder key its reads and none of its writes', async () => {
+        // #2493, the same gap on the largest family: `agent_builder` is granted on
+        // `mcp:agents:read` alone, so every write in it was advertised to a key that
+        // cannot call one.
+        const names = await toolNamesFrom(await stubBackend({ capabilities: ['agent_builder'], permissions: ['mcp:agents:read'] }));
+        expect(names).toContain('list_agents');
+        expect(names).toContain('list_organisations');
+        expect(names).not.toContain('create_agent');
+        expect(names).not.toContain('update_agent');
+    }, 60_000);
     it('is not stripped when the capabilities round trip fails', async () => {
         // #1488 the other way up: a gateway outage means the key's scopes are
         // unknown, not that the key holds none. Stripping the list on a 503 would

package/dist/toolCatalogue.js

@@ -16,11 +16,17 @@
  * `rootDir: ./src`. A generated, never-hand-edited copy is what one source of
  * truth looks like across that boundary.
  *
- * The agent-builder, agent-self, agent-memory and browser-control families are
- * deliberately not here: they exist on the stdio transport only (see
- * `agentBuilderTools.ts`, `agentSelfTools.ts`, `browserTools.ts`), so they have
- * no second declaration to drift from.
+ * The agent-self, agent-memory, agent-observer, agent-builder and browser-control
+ * families stay in the files that hold their handlers, and are appended to the
+ * catalogue from there. They exist on the stdio transport only, which `stdioOnly`
+ * records — but being stdio-only is no reason to declare no scope, and while they
+ * sat outside the catalogue they declared none, so neither the scope filter
+ * (#2428) nor the scope-is-required rule (#2345) reached them (#2493).
  */
+import { AGENT_SELF_TOOLS, AGENT_MEMORY_TOOLS } from './agentSelfTools.js';
+import { AGENT_OBSERVE_TOOLS } from './agentObserveTools.js';
+import { AGENT_BUILDER_TOOLS } from './agentBuilderTools.js';
+import { BROWSER_TOOLS } from './browserTools.js';
 /**
  * The token a description carries where the product's name belongs (#2466).
  *
@@ -74,7 +80,8 @@ const DEFINITION_DESCRIPTION = 'Workflow definition: { nodes: [{id, type, positi
     'setVariable, createPage, createJournalEntry, llmPrompt, jsonata, agentTask, runContainer), data.label, and ' +
     "data.config holding that type's settings — the step body belongs in data.config.description, not data.description. " +
     'Use activityType "task" for a step a person just reads and ticks off.';
-export const TOOL_CATALOGUE = [
+/** The tools both transports serve. */
+const SHARED_TOOLS = [
     // Project tools
     {
         name: 'list_projects',
@@ -2270,6 +2277,14 @@ export const TOOL_CATALOGUE = [
         },
     },
 ];
+export const TOOL_CATALOGUE = [
+    ...SHARED_TOOLS,
+    ...AGENT_SELF_TOOLS,
+    ...AGENT_MEMORY_TOOLS,
+    ...AGENT_OBSERVE_TOOLS,
+    ...AGENT_BUILDER_TOOLS,
+    ...BROWSER_TOOLS,
+];
 const toTool = ({ name, description, inputSchema }) => ({
     name,
     description,
@@ -2299,13 +2314,20 @@ export function toolNamesFor(capability) {
     return TOOL_CATALOGUE.filter((t) => t.capability === capability).map((t) => t.name);
 }
 /**
- * The catalogue as the remote transport advertises it: every tool, taking the
- * `remote` override where one is set. This is what the generated backend copy holds.
+ * The catalogue as the remote transport advertises it: every tool but the
+ * stdio-only ones, taking the `remote` override where one is set. This is what
+ * the generated backend copy holds.
  */
 export function remoteTools() {
-    return TOOL_CATALOGUE.map((t) => ({ ...toTool(t), ...t.remote }));
+    return TOOL_CATALOGUE.filter((t) => !t.stdioOnly).map((t) => ({ ...toTool(t), ...t.remote }));
 }
-/** The scope the remote transport requires per tool, derived from the catalogue. */
-export function remoteToolPermissions() {
+/**
+ * The scope each tool requires, derived from the catalogue. The stdio-only tools
+ * are in here too, though the remote server can never dispatch one: the scope is a
+ * fact about the tool rather than about a transport, and this map is what the
+ * quarterly prompt-injection probe reads to tell an induced tool that is inside
+ * the agent's grant from one that is outside it (#2493).
+ */
+export function toolPermissions() {
     return Object.fromEntries(TOOL_CATALOGUE.map((t) => [t.name, t.permission]));
 }

package/dist/toolCatalogue.test.js

@@ -2,8 +2,11 @@ import { describe, it, expect } from 'vitest';
 import { readFileSync } from 'fs';
 import { join } from 'path';
 import * as catalogue from './toolCatalogue.js';
-import { TOOL_CATALOGUE, remoteTools, stdioTools } from './toolCatalogue.js';
+import { TOOL_CATALOGUE, remoteTools, toolPermissions, stdioTools, toolNamesFor, } from './toolCatalogue.js';
 import { BROWSER_TOOLS } from './browserTools.js';
+import { AGENT_SELF_TOOLS, AGENT_MEMORY_TOOLS } from './agentSelfTools.js';
+import { AGENT_OBSERVE_TOOLS } from './agentObserveTools.js';
+import { AGENT_BUILDER_TOOLS } from './agentBuilderTools.js';
 // @ts-expect-error — a plain .mjs build script, deliberately not part of this program
 import { render, GENERATED_PATH } from '../../../scripts/generate-mcp-catalogue.mjs';
 const repoFile = (path) => readFileSync(join(__dirname, '../../..', path), 'utf8');
@@ -80,11 +83,42 @@ describe('the MCP tool catalogue', () => {
         expect(readOnly).not.toContain('create_issue');
     });
     it('keeps a tool that deliberately requires no scope of its own', () => {
-        // `permission: null` is a decision, not a gap, so an empty key still gets these.
-        const unscoped = TOOL_CATALOGUE.filter((t) => t.permission === null).map((t) => t.name);
+        // `permission: null` is a decision, not a gap, so an empty key still gets these
+        // — the ones no capability gates, which is every family a plain key can reach.
+        const unscoped = TOOL_CATALOGUE.filter((t) => t.permission === null && !t.capability).map((t) => t.name);
         expect(unscoped.length).toBeGreaterThan(0);
         expect(stdioTools([], []).map((t) => t.name)).toEqual(unscoped);
     });
+    it('serves a stdio-only tool over stdio alone, and still declares its scope', () => {
+        // #2493 — the five families used to be appended after `stdioTools`, so they
+        // reached neither the scope filter nor the scope-is-required rule. They are
+        // catalogue entries now, which must not put them in front of a remote client:
+        // the remote server has no dispatch case for one, and advertising it would be
+        // a promise the product cannot keep.
+        const stdioOnly = TOOL_CATALOGUE.filter((t) => t.stdioOnly);
+        expect(stdioOnly.map((t) => t.name)).toContain('get_observed_session_conversation');
+        expect(remoteTools().map((t) => t.name)).not.toContain('get_observed_session_conversation');
+        // The scope still reaches the generated map, which is what the quarterly
+        // prompt-injection probe reads to judge whether an induced tool is in scope.
+        const permissions = toolPermissions();
+        for (const tool of stdioOnly) {
+            expect(permissions[tool.name], tool.name).toBe(tool.permission);
+            expect(tool.capability, tool.name).toBeDefined();
+        }
+    });
+    it.each([
+        ['agent_self', AGENT_SELF_TOOLS],
+        ['agent_memory', AGENT_MEMORY_TOOLS],
+        ['agent_observer', AGENT_OBSERVE_TOOLS],
+        ['agent_builder', AGENT_BUILDER_TOOLS],
+        ['browser_control', BROWSER_TOOLS],
+    ])('names the whole %s family for the stdio dispatch to route on', (capability, family) => {
+        // The stdio server routes a call to a family's handler by asking the catalogue
+        // for that capability's names, rather than by importing the array (#2493). A
+        // tool whose `capability` does not match the file it lives in would then be
+        // advertised and dispatched to the wrong handler — or to none.
+        expect(toolNamesFor(capability)).toEqual(family.map((t) => t.name));
+    });
     it('honours a wildcard the way the server does when it checks the call', () => {
         // Filtering has to read a scope exactly as `checkMcpPermission` does, or a
         // key on `mcp:*` loses tools it is entitled to call.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wolfpack-mcp",
-  "version": "1.0.105",
+  "version": "1.0.106",
   "description": "MCP server for Wolfpack AI-enhanced software delivery tools",
   "main": "dist/index.js",
   "type": "module",
@@ -14,6 +14,7 @@
     "clean": "",
     "build": "tsc",
     "dev": "tsx watch src/index.ts",
+    "generate:catalogue": "tsx ../../scripts/generate-mcp-catalogue.mjs",
     "start": "node dist/index.js",
     "test": "vitest",
     "lint": "eslint . --max-warnings 0",