ms-tau-sdk 2.0.13.dev54__tar.gz → 2.0.14.dev57__tar.gz

{ms_tau_sdk-2.0.13.dev54 → ms_tau_sdk-2.0.14.dev57}/CHANGELOG.md

@@ -2,6 +2,24 @@
 
 ## Unreleased
 
+- **An Agent reads the skills and resources its declared applications publish
+  ([#98](https://github.com/mainsequence-sdk/ms-tau-sdk/issues/98), ADR 0023).** An application
+  that published skills through the MCP Skills extension, as the mainsequence SDK's skills
+  publisher does, reached its Agent only through `<name>__list_tools` and `<name>__call_tool`: the
+  Agent could not discover or read the skills. Each declared application now also gets
+  `<name>__list_resources`, which lists its skills, each with its files, and its other resources,
+  and `<name>__read_resource`, which reads one of them by URI. `<name>__list_tools` says when the
+  application publishes them. An application's session first asks MCP's `server/discover` on
+  protocol `2026-07-28`, where the extension is declared, and opens an application that does not
+  answer it with `initialize`, as before; the platform's own MCP is unchanged. Only what the
+  application lists is read, and a skill file is returned only when its bytes match the size and
+  SHA-256 digest of the skill's list. Every read names the application. Published skills never
+  become the project's skills and grant nothing; with the coding tools, a model that follows one
+  can run commands, which the [Security and access guide](docs/reference/security-model.md#calling-other-applications)
+  now states.
+
+## 2.0.13 — 2026-10-12
+
 - **ms-tau-sdk installs the MCP Python SDK 2.x.** The `mcp` dependency moves from `mcp>=1.27,<2`
   to `mcp>=2.3,<3`, which brings `httpx2`, the HTTP client MCP 2.x uses. A repository that runs a
   Harness Agent and also serves an application MCP with `mainsequence[mcp]`, which requires MCP 2.x

{ms_tau_sdk-2.0.13.dev54 → ms_tau_sdk-2.0.14.dev57}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ms-tau-sdk
-Version: 2.0.13.dev54
+Version: 2.0.14.dev57
 Summary: Workspace-bound Tau application primitives for Main Sequence projects
 Project-URL: Changelog, https://github.com/mainsequence-sdk/ms-tau-sdk/blob/development/CHANGELOG.md
 Project-URL: Documentation, https://github.com/mainsequence-sdk/ms-tau-sdk/tree/development/docs

{ms_tau_sdk-2.0.13.dev54 → ms_tau_sdk-2.0.14.dev57}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "ms-tau-sdk"
-version = "2.0.13.dev54"
+version = "2.0.14.dev57"
 description = "Workspace-bound Tau application primitives for Main Sequence projects"
 readme = "README.md"
 requires-python = ">=3.13"

{ms_tau_sdk-2.0.13.dev54 → ms_tau_sdk-2.0.14.dev57}/src/ms_tau_sdk/agent_skills/tau_project_customization/SKILL.md

@@ -96,6 +96,16 @@ retry guidance for up to `TAU_MCP_APPLICATION_READY_TIMEOUT_SECONDS` (default `1
 turn time. This startup budget is separate from the tool's execution limit; an expired readiness
 wait reports `readiness_timeout`. Cancellation, ended delegation and terminal refusals stop the wait.
 
+## Skills that applications publish
+
+A declared application can publish Agent Skills through the MCP Skills extension, as the
+mainsequence SDK's skills publisher does. The Agent lists them with `<name>__list_resources` and
+reads one file with `<name>__read_resource`; a skill file is returned only when its bytes match the
+size and SHA-256 digest the skill lists. Published skills stay the application's: they are not
+project skills under `.tau/skills/`, and fields such as `allowed-tools` grant nothing. With the
+coding tools, a model that follows a published skill can run commands; set
+`TAU_EXCLUDE_BASE_TOOLS=true` when that must not happen.
+
 ## Invariants extensions must not replace
 
 Extensions may change effective agent capabilities, but they must not replace or bypass:

{ms_tau_sdk-2.0.13.dev54 → ms_tau_sdk-2.0.14.dev57}/src/ms_tau_sdk/backend/mcp.py

@@ -9,11 +9,12 @@ from collections.abc import AsyncGenerator, AsyncIterator
 from contextlib import asynccontextmanager
 from dataclasses import dataclass
 from types import TracebackType
-from typing import Any, Literal, Self, cast
+from typing import Annotated, Any, Literal, Self, cast
 
 import anyio
 import httpx2
 from mcp import ClientSession, types
+from mcp.client._probe import negotiate_auto
 from mcp.client.streamable_http import RequestContext, StreamableHTTPTransport
 from mcp.shared._context_streams import (
     ContextReceiveStream,
@@ -21,6 +22,7 @@ from mcp.shared._context_streams import (
     create_context_streams,
 )
 from mcp.shared.message import SessionMessage
+from pydantic import BaseModel, Field, model_validator
 from structlog.contextvars import bound_contextvars, get_contextvars
 
 from ms_tau_sdk.settings import TauSDKSettings
@@ -218,6 +220,73 @@ def _validate_response_timeout(seconds: float) -> None:
         raise ValueError("MCP response timeout must be finite and greater than zero")
 
 
+SKILLS_EXTENSION = "io.modelcontextprotocol/skills"
+"""The MCP Skills extension (SEP-2640). A server declares it only on protocol 2026-07-28."""
+
+
+class SkillFile(BaseModel):
+    """One file of a published skill: its URI, and the size and SHA-256 digest of its bytes."""
+
+    uri: str
+    digest: Annotated[str, Field(pattern=r"^sha256:[0-9a-f]{64}$")]
+    size: Annotated[int, Field(ge=0)]
+
+
+class Skill(BaseModel):
+    """One skill a server publishes: the URI of its ``SKILL.md``, its frontmatter and its files.
+
+    ``resources`` lists every file of the skill, or is ``"dynamic"`` when the server generates the
+    skill's content and publishes no digests.
+    """
+
+    uri: Annotated[str, Field(pattern=r"/SKILL\.md$")]
+    frontmatter: dict[str, Any]
+    resources: list[SkillFile] | Literal["dynamic"]
+
+    @model_validator(mode="after")
+    def _named_and_described(self) -> Self:
+        for field in ("name", "description"):
+            if not isinstance(self.frontmatter.get(field), str):
+                raise ValueError(f"the frontmatter of skill {self.uri} has no {field}")
+        return self
+
+
+class _ListSkillsRequest(types.PaginatedRequest[Literal["skills/list"]]):
+    method: Literal["skills/list"] = "skills/list"
+
+
+class _ListSkillsResult(types.PaginatedResult, types.CacheableResult):
+    skills: list[Skill]
+
+
+async def _list_skills(session: ClientSession) -> tuple[Skill, ...]:
+    """Read every page of ``skills/list``; a skill listed twice counts once."""
+
+    skills: dict[str, Skill] = {}
+    cursor: str | None = None
+    cursors: set[str] = set()
+    while True:
+        page = await session.send_request(
+            _ListSkillsRequest(
+                params=types.PaginatedRequestParams(cursor=cursor) if cursor is not None else None
+            ),
+            _ListSkillsResult,
+        )
+        for skill in page.skills:
+            skills.setdefault(skill.uri, skill)
+        cursor = page.next_cursor
+        if cursor is None:
+            return tuple(skills.values())
+        if cursor in cursors:
+            raise ValueError("the server repeated a skills/list cursor")
+        cursors.add(cursor)
+
+
+def _sends(request: httpx2.Request, method: str) -> bool:
+    message = types.jsonrpc_message_adapter.validate_json(request.content)
+    return isinstance(message, types.JSONRPCRequest) and message.method == method
+
+
 @dataclass(frozen=True)
 class _CallToolCommand:
     name: str
@@ -235,12 +304,18 @@ class _ReadResourceCommand:
     result: asyncio.Future[types.ReadResourceResult]
 
 
+@dataclass(frozen=True)
+class _ListSkillsCommand:
+    log_context: dict[str, object]
+    result: asyncio.Future[tuple[Skill, ...]]
+
+
 @dataclass(frozen=True)
 class _CloseCommand:
     reason: Literal["client_close"] = "client_close"
 
 
-type _MCPCommand = _CallToolCommand | _ReadResourceCommand | _CloseCommand
+type _MCPCommand = _CallToolCommand | _ReadResourceCommand | _ListSkillsCommand | _CloseCommand
 
 ENVIRONMENT_SCOPED_AGENT_TOOLS = frozenset({"agent.list", "agent.search"})
 ENVIRONMENT_UID_ARGUMENT = "organization_environment_uid"
@@ -258,7 +333,9 @@ class MCPConnectionClient:
     """One remote MCP server over Streamable HTTP.
 
     Each client owns its own MCP session, tool catalog and resources; nothing is shared between
-    connections.
+    connections. With ``mode="legacy"`` the session opens with the ``initialize`` handshake. With
+    ``mode="auto"``, MCP's own default, it first asks protocol 2026-07-28's ``server/discover``,
+    where a server declares its extensions, and opens an older server with ``initialize``.
     """
 
     def __init__(
@@ -271,6 +348,7 @@ class MCPConnectionClient:
         timeout: httpx2.Timeout,
         read_timeout_seconds: float,
         read_concurrency: int,
+        mode: Literal["legacy", "auto"] = "legacy",
     ) -> None:
         _validate_response_timeout(read_timeout_seconds)
         self.name = name
@@ -280,6 +358,7 @@ class MCPConnectionClient:
         self._http_timeout = timeout
         self._read_timeout_seconds = read_timeout_seconds
         self._read_concurrency = read_concurrency
+        self._mode = mode
         self._commands: asyncio.Queue[_MCPCommand] | None = None
         self._owner_task: asyncio.Task[None] | None = None
         self._ready: asyncio.Future[None] | None = None
@@ -290,6 +369,7 @@ class MCPConnectionClient:
         self._http_calls: dict[types.RequestId, _ToolCall] = {}
         self.tools: tuple[types.Tool, ...] = ()
         self.resources: tuple[types.Resource, ...] = ()
+        self.extensions: dict[str, dict[str, Any]] = {}
         self._parallel_tool_names: frozenset[str] = frozenset()
         self._closed = False
 
@@ -346,8 +426,7 @@ class MCPConnectionClient:
                         read_timeout_seconds=self._read_timeout_seconds,
                     ) as session:
                         with bound_contextvars(**initial_log_context):
-                            initialized = await session.initialize()
-                            await self._read_server_catalog(session, initialized)
+                            await self._read_server_catalog(session, await self._negotiate(session))
                             self._parallel_tool_names = frozenset(
                                 tool.name
                                 for tool in self.tools
@@ -391,16 +470,27 @@ class MCPConnectionClient:
         # MCP 2.x answers an HTTP error on a message POST with a JSON-RPC error that drops the
         # status. Raise it, as MCP 1.x did, so a failure still says refused, server error or
         # timeout. 401 is left to the credential's renewal, and 404 to MCP, as 1.x did.
-        if response.request.method == "POST" and response.status_code not in {401, 404}:
-            response.raise_for_status()
+        if response.request.method != "POST" or response.status_code in {401, 404}:
+            return
+        # An older server can refuse the `server/discover` probe with a client error. MCP then
+        # opens the session with `initialize` instead.
+        if response.is_client_error and _sends(response.request, "server/discover"):
+            return
+        response.raise_for_status()
+
+    async def _negotiate(self, session: ClientSession) -> types.ServerCapabilities | None:
+        if self._mode == "auto":
+            await negotiate_auto(session)
+            return session.server_capabilities
+        initialized = await session.initialize()
+        return initialized.capabilities if initialized is not None else None
 
     async def _read_server_catalog(
         self,
         session: ClientSession,
-        initialized: types.InitializeResult | None,
+        capabilities: types.ServerCapabilities | None,
     ) -> None:
         # Read only what the server offers; a server without resources answers "not found".
-        capabilities = initialized.capabilities if initialized is not None else None
         offers_tools = capabilities is None or capabilities.tools is not None
         offers_resources = capabilities is None or capabilities.resources is not None
         tools_result, resources_result = await asyncio.gather(
@@ -409,6 +499,7 @@ class MCPConnectionClient:
         )
         self.tools = tuple(tools_result.tools)
         self.resources = tuple(resources_result.resources)
+        self.extensions = dict(capabilities.extensions or {}) if capabilities is not None else {}
 
     async def _serve(self, session: ClientSession) -> None:
         commands = self._commands
@@ -417,7 +508,9 @@ class MCPConnectionClient:
         active_reads: set[asyncio.Task[None]] = set()
         read_slots = asyncio.Semaphore(self._read_concurrency)
 
-        async def execute(command: _CallToolCommand | _ReadResourceCommand) -> None:
+        async def execute(
+            command: _CallToolCommand | _ReadResourceCommand | _ListSkillsCommand,
+        ) -> None:
             if command.result.cancelled():
                 return
             self._in_flight.add(command.result)
@@ -450,10 +543,14 @@ class MCPConnectionClient:
                                 command.result.remove_done_callback(call.cancel_if_abandoned)
                                 _tool_call.reset(token)
                                 call.finish()
-                    else:
+                    elif isinstance(command, _ReadResourceCommand):
                         resource_result = await session.read_resource(command.uri)
                         if not command.result.done():
                             command.result.set_result(resource_result)
+                    else:
+                        skills = await _list_skills(session)
+                        if not command.result.done():
+                            command.result.set_result(skills)
             except Exception as error:
                 if not command.result.done():
                     command.result.set_exception(error)
@@ -464,7 +561,7 @@ class MCPConnectionClient:
                     self._in_flight.discard(command.result)
 
         async def execute_read(
-            command: _CallToolCommand | _ReadResourceCommand,
+            command: _CallToolCommand | _ReadResourceCommand | _ListSkillsCommand,
         ) -> None:
             async with read_slots:
                 await execute(command)
@@ -479,7 +576,9 @@ class MCPConnectionClient:
                 if isinstance(command, _CloseCommand):
                     await drain_reads()
                     return
-                is_parallel_read = isinstance(command, _ReadResourceCommand) or (
+                is_parallel_read = isinstance(
+                    command, _ReadResourceCommand | _ListSkillsCommand
+                ) or (
                     isinstance(command, _CallToolCommand)
                     and command.name in self._parallel_tool_names
                 )
@@ -563,6 +662,19 @@ class MCPConnectionClient:
         )
         return await result
 
+    async def list_skills(self) -> tuple[Skill, ...]:
+        """Every skill the server publishes; none when it does not declare ``SKILLS_EXTENSION``.
+
+        Only a server that declares the extension is asked, as the extension requires.
+        """
+
+        if SKILLS_EXTENSION not in self.extensions:
+            return ()
+        commands = self._require_commands()
+        result: asyncio.Future[tuple[Skill, ...]] = asyncio.get_running_loop().create_future()
+        commands.put_nowait(_ListSkillsCommand(log_context=dict(get_contextvars()), result=result))
+        return await result
+
     async def aclose(self) -> None:
         if self._closed:
             return

{ms_tau_sdk-2.0.13.dev54 → ms_tau_sdk-2.0.14.dev57}/src/ms_tau_sdk/tools/mcp_applications.py

@@ -1,21 +1,29 @@
-"""MCP endpoints of the applications an Agent declares (ADR 0021, section 4).
+"""MCP endpoints of the applications an Agent declares (ADR 0021, section 4; ADR 0023).
 
 Declaring an application registers its MCP; it grants no access. The platform resolves each
 declared application in the Agent's Environment and hands the runtime its name and release at
-startup. Each application gets two tools, ``<name>__list_tools`` and ``<name>__call_tool``. Both run
-inside the turn: the SDK obtains the application's address and a short-lived token, opens an MCP
-session for the call, and closes it afterwards. The token carries the delegation of the person the
-turn serves, when it serves one, and is the Agent's own otherwise; the application decides what the
-call may do. No session, token or catalog is shared between turns or people, and nothing is read
-when the session loads, because no turn is running then.
+startup. Each application gets four tools: ``<name>__list_tools`` and ``<name>__call_tool`` for its
+tools, and ``<name>__list_resources`` and ``<name>__read_resource`` for the skills and resources it
+publishes. They run inside the turn: the SDK obtains the application's address and a short-lived
+token, opens an MCP session for the call, and closes it afterwards. The token carries the
+delegation of the person the turn serves, when it serves one, and is the Agent's own otherwise; the
+application decides what the call may do. No session, token or catalog is shared between turns or
+people, and nothing is read when the session loads, because no turn is running then.
 
 Each tool declares how long it may run in its ``_meta`` (ADR 0022); a tool that declares nothing
 gets ``TAU_MCP_TOOL_TIMEOUT_SECONDS``. A failure reaches the model in plain words, and
 opening the session is tried once more when it fails before the tool call is sent.
+
+A file of a skill the application lists (MCP Skills extension) reaches the model only when its
+bytes match the size and SHA-256 digest the listing gives. Published skills are the application's
+content: the SDK never adds them to the project's skills and grants nothing they ask for.
 """
 
 from __future__ import annotations
 
+import base64
+import binascii
+import hashlib
 import json
 import re
 from collections.abc import AsyncGenerator, Mapping, Sequence
@@ -34,7 +42,13 @@ from tau_agent.tools import (
 )
 from tau_agent.types import JSONValue
 
-from ms_tau_sdk.backend.mcp import MCPConnectionClient, raise_for_renewed_401
+from ms_tau_sdk.backend.mcp import (
+    SKILLS_EXTENSION,
+    MCPConnectionClient,
+    Skill,
+    SkillFile,
+    raise_for_renewed_401,
+)
 from ms_tau_sdk.backend.models import MCPApplication
 from ms_tau_sdk.errors import (
     ApplicationReadinessTimeoutError,
@@ -109,6 +123,8 @@ def application_connector(settings: TauSDKSettings) -> ApplicationConnector:
             ),
             read_timeout_seconds=settings.backend_read_timeout_seconds,
             read_concurrency=settings.mcp_read_concurrency,
+            # An application declares the Skills extension only on the newer protocol revision.
+            mode="auto",
         ).open()
 
     return connect
@@ -222,6 +238,71 @@ def _tool_entry(tool: types.Tool) -> dict[str, JSONValue]:
     return entry
 
 
+def _owner(skills: Sequence[Skill], uri: str) -> Skill | None:
+    """The listed skill whose directory holds ``uri``; the innermost one when skills nest."""
+
+    owners = [skill for skill in skills if uri.startswith(skill.uri.removesuffix("SKILL.md"))]
+    return max(owners, key=lambda skill: len(skill.uri), default=None)
+
+
+def _listed_by_skill(skills: Sequence[Skill], uri: str) -> bool:
+    """Whether ``uri`` is read as a file of a listed skill rather than as a plain resource.
+
+    A skill with a file list owns its whole directory. A generated (``"dynamic"``) skill lists no
+    files, so only its ``SKILL.md`` is its own.
+    """
+
+    owner = _owner(skills, uri)
+    return owner is not None and (owner.resources != "dynamic" or uri == owner.uri)
+
+
+def _skill_entry(skill: Skill) -> dict[str, JSONValue]:
+    entry: dict[str, JSONValue] = {
+        "uri": skill.uri,
+        "name": skill.frontmatter["name"],
+        "description": skill.frontmatter["description"],
+    }
+    if skill.resources != "dynamic":
+        entry["files"] = [{"uri": file.uri, "size": file.size} for file in skill.resources]
+    return entry
+
+
+def _resource_entry(resource: types.Resource) -> dict[str, JSONValue]:
+    entry: dict[str, JSONValue] = {"uri": str(resource.uri), "name": resource.name}
+    if resource.description:
+        entry["description"] = resource.description
+    if resource.mime_type:
+        entry["mimeType"] = resource.mime_type
+    return entry
+
+
+def _matches(
+    contents: Sequence[types.TextResourceContents | types.BlobResourceContents],
+    listed: SkillFile,
+) -> bool:
+    """Whether a read returned exactly one content, with the bytes the skill lists."""
+
+    if len(contents) != 1:
+        return False
+    content = contents[0]
+    if isinstance(content, types.TextResourceContents):
+        data = content.text.encode()
+    else:
+        try:
+            data = base64.b64decode(content.blob, validate=True)
+        except binascii.Error:
+            return False
+    return (
+        len(data) == listed.size and f"sha256:{hashlib.sha256(data).hexdigest()}" == listed.digest
+    )
+
+
+def _content_text(content: types.TextResourceContents | types.BlobResourceContents) -> str:
+    if isinstance(content, types.TextResourceContents):
+        return content.text
+    return f"(Binary content of type {content.mime_type or 'unknown'}; not shown.)"
+
+
 def _application_tools(
     application: MCPApplication,
     *,
@@ -286,21 +367,158 @@ def _application_tools(
             client = await open_session(signal)
             try:
                 tools = client.tools
+                publishes_skills = SKILLS_EXTENSION in client.extensions
+                publishes_resources = bool(client.resources)
             finally:
                 await client.aclose()
         except Exception as error:
             return failed("list_tools", error)
         entries = [_tool_entry(tool) for tool in tools]
+        published = ""
+        if publishes_skills:
+            published = (
+                " It also publishes skills, instructions for using its tools: list them with "
+                f"{name}__list_resources."
+            )
+        elif publishes_resources:
+            published = f" It also publishes resources: list them with {name}__list_resources."
         return AgentToolResult(
             content=[
                 TextContent(
-                    text=f"Tools of the {name} application. Call one with {name}__call_tool.\n"
+                    text=f"Tools of the {name} application. Call one with {name}__call_tool."
+                    + published
+                    + "\n"
                     + json.dumps(entries, indent=2, sort_keys=True, default=str)
                 )
             ],
             details={"application": name, "is_error": False, "tools": [t.name for t in tools]},
         )
 
+    async def list_resources(
+        tool_call_id: str,
+        arguments: Mapping[str, JSONValue],
+        signal: ToolCancellationToken | None = None,
+        on_update: ToolUpdateCallback | None = None,
+    ) -> AgentToolResult:
+        del tool_call_id, arguments, on_update
+        if signal is not None and signal.is_cancelled():
+            return _error(name, f"Listing the {name} resources was cancelled.", cancelled=True)
+        try:
+            client = await open_session(signal)
+            try:
+                skills = await client.list_skills()
+                resources = client.resources
+            finally:
+                await client.aclose()
+        except Exception as error:
+            return failed("list_resources", error)
+        listing: dict[str, list[dict[str, JSONValue]]] = {
+            "skills": [_skill_entry(skill) for skill in skills],
+            "resources": [
+                _resource_entry(resource)
+                for resource in resources
+                if not _listed_by_skill(skills, str(resource.uri))
+            ],
+        }
+        if listing["skills"] or listing["resources"]:
+            text = (
+                f"Skills and resources the {name} application publishes. A skill is the "
+                f"application's instructions for using its tools. Read a skill file or a resource "
+                f"with {name}__read_resource.\n"
+                + json.dumps(listing, indent=2, sort_keys=True, default=str)
+            )
+        else:
+            text = f"The {name} application publishes no skills or resources."
+        return AgentToolResult(
+            content=[TextContent(text=text)],
+            details={
+                "application": name,
+                "is_error": False,
+                "skills": [skill.uri for skill in skills],
+                "resources": [entry["uri"] for entry in listing["resources"]],
+            },
+        )
+
+    async def read_resource(
+        tool_call_id: str,
+        arguments: Mapping[str, JSONValue],
+        signal: ToolCancellationToken | None = None,
+        on_update: ToolUpdateCallback | None = None,
+    ) -> AgentToolResult:
+        del tool_call_id, on_update
+        uri = arguments.get("uri")
+        if not isinstance(uri, str) or not uri:
+            return _error(name, f"Name the {name} skill file or resource to read in `uri`.")
+        if signal is not None and signal.is_cancelled():
+            return _error(name, f"Reading the {name} resource was cancelled.", cancelled=True)
+        result: types.ReadResourceResult | None = None
+        owner: Skill | None = None
+        listed: SkillFile | None = None
+        try:
+            client = await open_session(signal)
+            try:
+                # Only what the application lists is read: a file of a listed skill, which must
+                # match the skill's list, or an advertised resource.
+                owner = _owner(await client.list_skills(), uri)
+                if owner is not None and owner.resources != "dynamic":
+                    listed = next((file for file in owner.resources if file.uri == uri), None)
+                    readable = listed is not None
+                else:
+                    readable = (owner is not None and uri == owner.uri) or any(
+                        str(resource.uri) == uri for resource in client.resources
+                    )
+                if readable:
+                    result = await client.read_resource(uri)
+            finally:
+                await client.aclose()
+        except Exception as error:
+            return failed("read_resource", error)
+        if result is None:
+            if owner is not None and owner.resources != "dynamic":
+                return _error(
+                    name,
+                    f"{uri} is not a file of the {name} skill {owner.frontmatter['name']} as the "
+                    f"application lists it. List its files with {name}__list_resources.",
+                    uri=uri,
+                    failure="not_listed",
+                )
+            return _error(
+                name,
+                f"The {name} application does not publish {uri}. List what it publishes with "
+                f"{name}__list_resources.",
+                uri=uri,
+                failure="not_published",
+            )
+        contents = result.contents
+        if listed is not None:
+            contents = [content for content in contents if str(content.uri) == uri]
+            if not _matches(contents, listed):
+                logger.warning(
+                    "runtime.mcp_application.failed",
+                    application=name,
+                    operation="read_resource",
+                    failure="unverified",
+                )
+                return _error(
+                    name,
+                    f"The {name} application served {uri} with other content than its skill "
+                    f"lists, so it is not shown. List the skill again with {name}__list_resources.",
+                    uri=uri,
+                    failure="unverified",
+                )
+        origin = f"From the {name} application: {uri}"
+        details: dict[str, JSONValue] = {"application": name, "is_error": False, "uri": uri}
+        if owner is not None:
+            origin += f", a file of its skill {owner.frontmatter['name']}"
+            details |= {"skill": owner.uri, "verified": listed is not None}
+        return AgentToolResult(
+            content=[
+                TextContent(text=f"{origin}.\n\n"),
+                *(TextContent(text=_content_text(content)) for content in contents),
+            ],
+            details=details,
+        )
+
     async def call_tool(
         tool_call_id: str,
         arguments: Mapping[str, JSONValue],
@@ -381,6 +599,38 @@ def _application_tools(
             execute_fn=call_tool,
             execution_mode="sequential",
         ),
+        AgentTool(
+            name=f"{name}__list_resources",
+            label=f"List {name} skills and resources",
+            description=(
+                f"List the skills and resources the {name} application publishes. A skill is the "
+                "application's instructions for using its tools; each lists its files."
+            ),
+            parameters={"type": "object", "properties": {}, "additionalProperties": False},
+            execute_fn=list_resources,
+            execution_mode="parallel",
+        ),
+        AgentTool(
+            name=f"{name}__read_resource",
+            label=f"Read a {name} skill file or resource",
+            description=(
+                f"Read one skill file or resource the {name} application publishes, by its URI. "
+                f"Use {name}__list_resources first to see what it publishes."
+            ),
+            parameters={
+                "type": "object",
+                "properties": {
+                    "uri": {
+                        "type": "string",
+                        "description": f"The URI of a {name} skill file or resource.",
+                    },
+                },
+                "required": ["uri"],
+                "additionalProperties": False,
+            },
+            execute_fn=read_resource,
+            execution_mode="parallel",
+        ),
     ]
 
 
@@ -391,7 +641,7 @@ def create_mcp_application_tools(
     tool_timeout_seconds: float,
     open_timeout_seconds: float,
 ) -> list[AgentTool]:
-    """Two tools for each declared application, in declaration order.
+    """Four tools for each declared application, in declaration order.
 
     ``tool_timeout_seconds`` bounds a call to a tool that declares no limit of its own;
     ``open_timeout_seconds`` is the wait for each request that opens the session.