lael-labs/executor

.changeset/mcp-projections.md+9−0

@@ -0,0 +1,9 @@
	1	---
	2	"executor": minor
	3	"@executor-js/sdk": minor
	4	"@executor-js/plugin-toolkits": minor
	5	---
	6
	7	Serve every MCP endpoint as a projection of one executor. A toolkit endpoint (`/mcp/toolkits/<slug>`) now narrows the same executor the default `/mcp` endpoint uses instead of building a separate one, so workspace `require_approval` and `block` policies apply on toolkit endpoints too. Two new scoped endpoints share the same path: `/mcp/integrations/<slug>[,<slug>…]` exposes every tool of the named integrations, and `/mcp/tools/<tool id>` exposes one tool.
	8
	9	For plugin authors, `toolPolicyProvider` is replaced by `toolProjections`, and `executor.project(name)` returns a narrowed view over the same database.

apps/cloud/executor.config.ts+2−3

    *  bypass the real WorkOS API. Production leaves this undefined and
    *  falls back to the credential-driven default. */
   readonly workosVaultClient?: WorkOSVaultClient;
-  readonly activeToolkitSlug?: string;
 }
 export default defineExecutorConfig({
-  plugins: ({ workosCredentials, workosVaultClient, activeToolkitSlug }: CloudPluginDeps = {}) =>
+  plugins: ({ workosCredentials, workosVaultClient }: CloudPluginDeps = {}) =>
     [
       openApiHttpPlugin({
         presets: [...googleCatalog, ...microsoftCatalog],
         dangerouslyAllowStdioMCP: false,
       }),
       graphqlHttpPlugin(),
-      toolkitsPlugin({ activeToolkitSlug }),
+      toolkitsPlugin(),
       workosVaultPlugin({
         credentials: workosCredentials ?? { apiKey: "", clientId: "" },
         ...(workosVaultClient ? { client: workosVaultClient } : {}),

apps/cloud/src/engine/execution-stack.ts+1−4

     readonly clientId: string;
     readonly apiUrl?: string;
   };
-  readonly activeToolkitSlug?: string;
 }) => readonly AnyPlugin[];
 // Fresh plugin instances per request, carrying the Worker env's WorkOS Vault
 // credentials. Matches the old `createScopedExecutor`'s `orgPlugins()`.
 export const CloudPluginsProvider: Layer.Layer<PluginsProvider> = Layer.succeed(PluginsProvider)({
-  plugins: (context) =>
+  plugins: () =>
     cloudPluginFactory({
       workosCredentials: {
         apiKey: env.WORKOS_API_KEY,
         clientId: env.WORKOS_CLIENT_ID,
         apiUrl: env.WORKOS_API_URL,
       },
-      activeToolkitSlug:
-        context?.mcpResource?.kind === "toolkit" ? context.mcpResource.slug : undefined,
     }),
 });

apps/cloud/src/mcp/agent-handler.ts+14−17

   McpAuthProvider,
   jsonRpcErrorBody,
   defaultMcpResource,
+  mcpResourceFromPathname,
   orgWriteAccessForPrincipal,
   withOrgWriteAccess,
   UNAVAILABLE_RETRY_AFTER_SECONDS,
   );
 };
-// The MCP resource the request targets. `server.ts` routes both the bare `/mcp`
+// The MCP resource the request targets. `server.ts` routes the bare `/mcp` and
-// and `/mcp/toolkits/<slug>` to this handler (`prepareMcpOrgScope` strips the org
+// every scoped sub-resource to this handler (`prepareMcpOrgScope` strips the
-// selector but keeps the toolkit segment), so a session minted on a toolkit path
+// org selector but keeps the resource segments), so a session minted on a
-// scopes its tool catalog to that toolkit.
+// scoped path serves that projection of the catalog. The grammar is the shared
-const resourceFromPath = (request: Request): McpResource => {
+// one from host-mcp; a path `classifyMcpPath` accepted always parses here.
-  const segments = new URL(request.url).pathname.split("/").filter((s) => s.length > 0);
+const resourceFromPath = (request: Request): McpResource =>
-  if (segments.length === 3 && segments[0] === "mcp" && segments[1] === "toolkits" && segments[2]) {
+  mcpResourceFromPathname(new URL(request.url).pathname) ?? defaultMcpResource;
-    return { kind: "toolkit", slug: segments[2] };
-  }
-  return defaultMcpResource;
-};
 const propsForPrincipal = (
   request: Request,
   // The agents SDK builds an exact-match `URLPattern` from the path handed to
   // `serve` (see `createStreamingHttpHandler` in `agents/dist/mcp/index.js`) —
   // a single `/mcp` handler never matches `/mcp/toolkits/<slug>` and falls
-  // through to its own internal 404. A second `serve` mounted on the
+  // through to its own internal 404. A second `serve` mounted on a two-segment
-  // parameterized path picks it up (`URLPattern` supports `:slug` segments);
+  // wildcard picks up every scoped sub-resource (`URLPattern` supports `:kind`
-  // the auth/ownership/props logic above is unchanged and shared, only the
+  // segments); the auth/ownership/props logic above is unchanged and shared,
-  // final dispatch target differs.
+  // only the final dispatch target differs.
   const serve = McpSessionDOSqlite.serve("/mcp", serveOptions);
-  const serveToolkit = McpSessionDOSqlite.serve("/mcp/toolkits/:slug", serveOptions);
+  const serveScoped = McpSessionDOSqlite.serve("/mcp/:kind/:value", serveOptions);
   const ALLOWED_METHODS = new Set(["GET", "POST", "DELETE", "OPTIONS"]);
       ),
       orgWriteAccessForPrincipal(outcome.principal),
     );
-    const target = resource.kind === "toolkit" ? serveToolkit : serve;
+    const target = resource.kind === "default" ? serve : serveScoped;
     let response: Response;
     // oxlint-disable-next-line executor/no-try-catch-or-throw -- adapter boundary: the agents SDK aborts the isolate (throws) instead of returning a response for a condemned session
     try {

apps/cloud/src/mcp/auth-provider.ts+24−26

 import {
   bearerChallengeFor,
   mcpOrganizationFromRequest,
+  mcpResourceFromRequest,
   protectedResourceMetadataUrlFor,
   PROTECTED_RESOURCE_METADATA_PATH,
-  toolkitSlugFromRequest,
   McpAuth,
   McpAuthLive,
   McpOrganizationAuth,
 } from "./oauth-metadata";
 const AUTHORIZATION_SERVER_METADATA_PATH = "/.well-known/oauth-authorization-server";
-const TOOLKIT_PROTECTED_RESOURCE_METADATA_PATH = `${PROTECTED_RESOURCE_METADATA_PATH}/toolkits/:toolkitSlug`;
+// One metadata doc per MCP sub-resource kind; the doc's `resource` mirrors the
+// path the client dialed (RFC 9728 same-origin check).
+const SCOPED_PROTECTED_RESOURCE_METADATA_PATHS = [
+  `${PROTECTED_RESOURCE_METADATA_PATH}/toolkits/:slug`,
+  `${PROTECTED_RESOURCE_METADATA_PATH}/integrations/:slugs`,
+  `${PROTECTED_RESOURCE_METADATA_PATH}/tools/:toolId`,
+] as const;
 const NO_ORGANIZATION_MESSAGE = "No organization in session — log in via the web app first";
     const auth = yield* McpAuth;
     const orgAuth = yield* McpOrganizationAuth;
+    // The bare paths are the only ones mounted; `prepareMcpOrgScope` rewrites an
+    // org-scoped discovery doc onto them and pins the org in the header we read.
+    const protectedResourceMetadata = (request: Request) =>
+      Effect.succeed(
+        protectedResourceMetadataResponse(
+          mcpOrganizationFromRequest(request),
+          mcpResourceFromRequest(request),
+        ),
+      );
     const discoveryRoutes: ReadonlyArray<McpDiscoveryRoute> = [
-      {
+      { path: PROTECTED_RESOURCE_METADATA_PATH, handler: protectedResourceMetadata },
-        path: PROTECTED_RESOURCE_METADATA_PATH,
+      ...SCOPED_PROTECTED_RESOURCE_METADATA_PATHS.map((path) => ({
-        // The bare path is the only one mounted; `prepareMcpOrgScope` rewrites an
+        path,
-        // org-scoped discovery doc onto it and pins the org in the header we read.
+        handler: protectedResourceMetadata,
-        handler: (request) =>
+      })),
-          Effect.succeed(
-            protectedResourceMetadataResponse(
-              mcpOrganizationFromRequest(request),
-              toolkitSlugFromRequest(request),
-            ),
-          ),
-      },
-      {
-        path: TOOLKIT_PROTECTED_RESOURCE_METADATA_PATH,
-        handler: (request) =>
-          Effect.succeed(
-            protectedResourceMetadataResponse(
-              mcpOrganizationFromRequest(request),
-              toolkitSlugFromRequest(request),
-            ),
-          ),
-      },
       {
         path: AUTHORIZATION_SERVER_METADATA_PATH,
         handler: () => authorizationServerMetadataResponse,
     const resourceMetadataUrl = (request: Request): string =>
       protectedResourceMetadataUrlFor(
         mcpOrganizationFromRequest(request),
-        toolkitSlugFromRequest(request),
+        mcpResourceFromRequest(request),
       );
     /**
             bearerChallengeFor(
               result,
               mcpOrganizationFromRequest(request),
-              toolkitSlugFromRequest(request),
+              mcpResourceFromRequest(request),
             ),
           ),
         ),

apps/cloud/src/mcp/auth.ts+27−21

 import { env } from "cloudflare:workers";
 import { Context, Effect, Layer, Predicate } from "effect";
+import {
+  defaultMcpResource,
+  mcpResourceFromPathname,
+  mcpResourcePath,
+  type McpResource,
+} from "@executor-js/host-mcp";
 import { createCachedRemoteJWKSet } from "../auth/jwks-cache";
 import { ApiKeyService } from "../auth/api-keys";
 import { BEARER_PREFIX } from "../auth/bearer";
 export const PROTECTED_RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource/mcp";
 export const PROTECTED_RESOURCE_METADATA_URL = `${RESOURCE_ORIGIN}${PROTECTED_RESOURCE_METADATA_PATH}`;
 export const RESOURCE_URL = `${RESOURCE_ORIGIN}${MCP_PATH}`;
-const TOOLKIT_SEGMENT = "/toolkits/";
 // ---------------------------------------------------------------------------
 // Org-scoped MCP (the URL pins an org: `/org_xxx/mcp`)
 export const mcpOrganizationFromRequest = (request: Request): string | null =>
   request.headers.get(MCP_ORGANIZATION_HEADER);
-/** The toolkit slug selected by `/mcp/toolkits/:slug` or its metadata doc. */
+/**
-export const toolkitSlugFromRequest = (request: Request): string | null => {
+ * The MCP resource a request names, read off its (already org-stripped) path.
+ * Both the transport path (`/mcp/toolkits/<slug>`) and its metadata doc
+ * (`/.well-known/oauth-protected-resource/mcp/toolkits/<slug>`) resolve to the
+ * same resource. Defaults to the whole catalog for anything else.
+ */
+export const mcpResourceFromRequest = (request: Request): McpResource => {
   const pathname = new URL(request.url).pathname;
-  const index = pathname.indexOf(TOOLKIT_SEGMENT);
+  const bare = pathname.startsWith(PRM_PREFIX) ? pathname.slice(PRM_PREFIX.length) : pathname;
-  if (index < 0) return null;
+  return mcpResourceFromPathname(bare) ?? defaultMcpResource;
-  const slug = pathname.slice(index + TOOLKIT_SEGMENT.length).split("/", 1)[0];
-  return slug && slug.length > 0 ? slug : null;
 };
-const toolkitMcpPath = (toolkitSlug: string | null): string =>
+const PRM_PREFIX = "/.well-known/oauth-protected-resource";
-  toolkitSlug ? `${MCP_PATH}/toolkits/${toolkitSlug}` : MCP_PATH;
 /** The MCP resource URL for an org selector (`…/acme/mcp` slug or legacy
  *  `…/org_xxx/mcp` id — echoed verbatim so it matches the URL the client
  *  used), or the bare resource. */
 export const resourceUrlFor = (
   organizationSelector: string | null,
-  toolkitSlug: string | null = null,
+  resource: McpResource = defaultMcpResource,
 ): string =>
   organizationSelector
-    ? `${RESOURCE_ORIGIN}/${organizationSelector}${toolkitMcpPath(toolkitSlug)}`
+    ? `${RESOURCE_ORIGIN}/${organizationSelector}${mcpResourcePath(resource)}`
-    : `${RESOURCE_ORIGIN}${toolkitMcpPath(toolkitSlug)}`;
+    : `${RESOURCE_ORIGIN}${mcpResourcePath(resource)}`;
 /** The protected-resource-metadata URL for an org selector, or the bare one. */
 export const protectedResourceMetadataUrlFor = (
   organizationSelector: string | null,
-  toolkitSlug: string | null = null,
+  resource: McpResource = defaultMcpResource,
-): string => {
+): string =>
-  const toolkitSuffix = toolkitSlug ? `/toolkits/${toolkitSlug}` : "";
+  organizationSelector
-  return organizationSelector
+    ? `${RESOURCE_ORIGIN}${PRM_PREFIX}/${organizationSelector}${mcpResourcePath(resource)}`
-    ? `${RESOURCE_ORIGIN}/.well-known/oauth-protected-resource/${organizationSelector}/mcp${toolkitSuffix}`
+    : `${RESOURCE_ORIGIN}${PRM_PREFIX}${mcpResourcePath(resource)}`;
-    : `${PROTECTED_RESOURCE_METADATA_URL}${toolkitSuffix}`;
-};
 type McpUnauthorizedReason = "missing_bearer" | "invalid_token";
 export const bearerChallengeFor = (
   result: McpUnauthorizedResult,
   organizationId: string | null = null,
-  toolkitSlug: string | null = null,
+  resource: McpResource = defaultMcpResource,
 ): string =>
   bearerChallenge(
     { reason: result.reason, description: result.description },
-    protectedResourceMetadataUrlFor(organizationId, toolkitSlug),
+    protectedResourceMetadataUrlFor(organizationId, resource),
   );
 // ---------------------------------------------------------------------------

apps/cloud/src/mcp/mount.test.ts+46−13

 import { describe, expect, it } from "@effect/vitest";
-import { protectedResourceMetadataUrlFor, resourceUrlFor, toolkitSlugFromRequest } from "./auth";
+import { mcpResourceFromRequest, protectedResourceMetadataUrlFor, resourceUrlFor } from "./auth";
 import { classifyMcpPath, prepareMcpOrgScope } from "./mount";
-describe("cloud MCP toolkit route normalization", () => {
+describe("cloud MCP scoped route normalization", () => {
-  it("classifies toolkit MCP and protected-resource metadata paths", () => {
+  it("classifies scoped MCP and protected-resource metadata paths", () => {
+    expect(classifyMcpPath("/mcp")).toEqual({
+      kind: "mcp",
+      organizationId: null,
+      resource: { kind: "default" },
+    });
     expect(classifyMcpPath("/mcp/toolkits/deploy")).toEqual({
       kind: "mcp",
       organizationId: null,
-      toolkitSlug: "deploy",
+      resource: { kind: "toolkit", slug: "deploy" },
     });
     expect(classifyMcpPath("/acme/mcp/toolkits/deploy")).toEqual({
       kind: "mcp",
       organizationId: "acme",
-      toolkitSlug: "deploy",
+      resource: { kind: "toolkit", slug: "deploy" },
+    });
+    expect(classifyMcpPath("/acme/mcp/integrations/github,linear")).toEqual({
+      kind: "mcp",
+      organizationId: "acme",
+      resource: { kind: "integrations", slugs: ["github", "linear"] },
+    });
+    expect(classifyMcpPath("/mcp/tools/github.repos.list")).toEqual({
+      kind: "mcp",
+      organizationId: null,
+      resource: { kind: "tool", toolId: "github.repos.list" },
     });
     expect(classifyMcpPath("/.well-known/oauth-protected-resource/mcp/toolkits/deploy")).toEqual({
       kind: "oauth-protected-resource",
       organizationId: null,
-      toolkitSlug: "deploy",
+      resource: { kind: "toolkit", slug: "deploy" },
     });
     expect(
       classifyMcpPath("/.well-known/oauth-protected-resource/acme/mcp/toolkits/deploy"),
     ).toEqual({
       kind: "oauth-protected-resource",
       organizationId: "acme",
-      toolkitSlug: "deploy",
+      resource: { kind: "toolkit", slug: "deploy" },
     });
+    expect(classifyMcpPath("/mcp/unknown/x")).toBeNull();
+    expect(classifyMcpPath("/mcp/toolkits")).toBeNull();
   });
   it("rewrites org-scoped toolkit metadata to the mounted toolkit metadata route", () => {
     expect(url.pathname).toBe("/.well-known/oauth-protected-resource/mcp/toolkits/deploy");
     expect(url.search).toBe("?x=1");
     expect(rewritten.headers.get("x-executor-mcp-organization")).toBe("acme");
-    expect(toolkitSlugFromRequest(rewritten)).toBe("deploy");
+    expect(mcpResourceFromRequest(rewritten)).toEqual({ kind: "toolkit", slug: "deploy" });
   });
-  it("builds toolkit-specific resource and metadata URLs", () => {
+  it("rewrites an org-scoped integrations endpoint to the bare scoped path", () => {
-    expect(resourceUrlFor(null, "deploy")).toBe("https://executor.sh/mcp/toolkits/deploy");
+    const rewritten = prepareMcpOrgScope(
-    expect(resourceUrlFor("acme", "deploy")).toBe("https://executor.sh/acme/mcp/toolkits/deploy");
+      new Request("https://executor.sh/acme/mcp/integrations/github,linear"),
-    expect(protectedResourceMetadataUrlFor(null, "deploy")).toBe(
+    );
+    expect(new URL(rewritten.url).pathname).toBe("/mcp/integrations/github,linear");
+    expect(rewritten.headers.get("x-executor-mcp-organization")).toBe("acme");
+    expect(mcpResourceFromRequest(rewritten)).toEqual({
+      kind: "integrations",
+      slugs: ["github", "linear"],
+    });
+  });
+  it("builds scoped resource and metadata URLs", () => {
+    const toolkit = { kind: "toolkit", slug: "deploy" } as const;
+    expect(resourceUrlFor(null, toolkit)).toBe("https://executor.sh/mcp/toolkits/deploy");
+    expect(resourceUrlFor("acme", toolkit)).toBe("https://executor.sh/acme/mcp/toolkits/deploy");
+    expect(protectedResourceMetadataUrlFor(null, toolkit)).toBe(
       "https://executor.sh/.well-known/oauth-protected-resource/mcp/toolkits/deploy",
     );
-    expect(protectedResourceMetadataUrlFor("acme", "deploy")).toBe(
+    expect(protectedResourceMetadataUrlFor("acme", toolkit)).toBe(
       "https://executor.sh/.well-known/oauth-protected-resource/acme/mcp/toolkits/deploy",
     );
+    expect(resourceUrlFor("acme", { kind: "tool", toolId: "github.repos.list" })).toBe(
+      "https://executor.sh/acme/mcp/tools/github.repos.list",
+    );
   });
 });

apps/cloud/src/mcp/mount.ts+50−50

 // PRODUCTION serves /mcp through `server.ts`'s hibernatable Agent bridge.
 // Discovery docs flow through `app.ts`'s unified `ExecutorApp.make` handler
 // (the `auth` seam's discovery routes). This module exposes:
-//   - `classifyMcpPath`   — the "is this an MCP path?" predicate (`/mcp` + the
+//   - `classifyMcpPath`   — the "is this an MCP path?" predicate (`/mcp` and
-//     two discovery docs, plus their org-scoped variants).
+//     its scoped sub-resources, the two discovery docs, plus their org-scoped
+//     variants).
 //   - `prepareMcpOrgScope` — rewrite an org-scoped MCP request to the bare path
 //     the handler routes, carrying the URL-pinned org in an internal header.
+//
+// The resource grammar itself (`/mcp/toolkits/<slug>`, `/mcp/integrations/…`,
+// `/mcp/tools/…`) is NOT defined here: it comes from `@executor-js/host-mcp`
+// so every host and the envelope parse the same paths the same way. Cloud adds
+// only the optional leading org selector.
 // ---------------------------------------------------------------------------
 import { isValidOrgSlug } from "@executor-js/api";
+import { mcpResourceFromSegments, mcpResourcePath, type McpResource } from "@executor-js/host-mcp";
 import { MCP_ORGANIZATION_HEADER, PROTECTED_RESOURCE_METADATA_PATH } from "./auth";
-const MCP_PATH = "/mcp";
 const AUTHORIZATION_SERVER_METADATA_PATH = "/.well-known/oauth-authorization-server";
+const PRM_PREFIX = "/.well-known/oauth-protected-resource";
 type McpRouteKind = "mcp" | "oauth-protected-resource" | "oauth-authorization-server";
-type McpRoute = {
+export type McpRoute = {
   readonly kind: McpRouteKind;
   /** Org selector pinned in the URL (`/acme/mcp` slug or legacy `/org_xxx/mcp`
    *  id), or `null` for the bare path. Resolved to an org id — and re-checked
    *  against live membership — in the auth provider. */
   readonly organizationId: string | null;
-  readonly toolkitSlug?: string;
+  /** The MCP resource the path names (default for the authorization-server
+   *  doc, which is resource-independent). */
+  readonly resource: McpResource;
 } | null;
 // A path segment counts as an org selector when it's the org's URL slug (the
 const orgSelectorSegment = (segment: string | undefined): string | null =>
   segment && (segment.startsWith("org_") || isValidOrgSlug(segment)) ? segment : null;
-type MatchedMcpSuffix = {
+type MatchedMcp = {
   readonly organizationId: string | null;
-  readonly toolkitSlug?: string;
+  readonly resource: McpResource;
 };
-// Matches a trailing MCP endpoint: `mcp`, `mcp/toolkits/<slug>`, or either with
+// Matches `<mcp resource path>` or `<org>/<mcp resource path>`. The resource
-// a leading org selector. Returns undefined when the segments are not MCP.
+// grammar is the shared one; only the leading org selector is cloud's.
-const matchMcpSuffix = (segments: readonly string[]): MatchedMcpSuffix | undefined => {
+const matchMcp = (segments: readonly string[]): MatchedMcp | undefined => {
-  if (segments.length === 1 && segments[0] === "mcp") return { organizationId: null };
+  const bare = mcpResourceFromSegments(segments);
-  if (segments.length === 3 && segments[0] === "mcp" && segments[1] === "toolkits") {
+  if (bare) return { organizationId: null, resource: bare };
-    const toolkitSlug = segments[2];
+  const organizationId = orgSelectorSegment(segments[0]);
-    return toolkitSlug ? { organizationId: null, toolkitSlug } : undefined;
+  if (!organizationId) return undefined;
-  }
+  const scoped = mcpResourceFromSegments(segments.slice(1));
-  if (segments.length === 2 && segments[1] === "mcp") {
+  return scoped ? { organizationId, resource: scoped } : undefined;
-    const organizationId = orgSelectorSegment(segments[0]);
-    return organizationId ? { organizationId } : undefined;
-  }
-  if (segments.length === 4 && segments[1] === "mcp" && segments[2] === "toolkits") {
-    const organizationId = orgSelectorSegment(segments[0]);
-    const toolkitSlug = segments[3];
-    return organizationId && toolkitSlug ? { organizationId, toolkitSlug } : undefined;
-  }
-  return undefined;
 };
 /**
- * Returns the MCP route (kind + optional URL-pinned org) for a pathname, or
+ * Returns the MCP route (kind + optional URL-pinned org + resource) for a
- * `null` if the path isn't owned by the MCP handler.
+ * pathname, or `null` if the path isn't owned by the MCP handler.
  *
  * Exported so the test worker and start.ts's middleware share the exact same
  * "is this an MCP path?" predicate — under the envelope `HttpRouter.toWebHandler`
  * 404s unknown paths rather than returning `null`, so this gate decides whether
  * to even invoke the envelope handler (null -> fall through to Start routing).
- * Recognizes the bare `/mcp` + the two discovery docs AND their org-scoped
+ * Recognizes the bare `/mcp` (and its sub-resources) + the two discovery docs
- * variants (`/org_xxx/mcp`, `/.well-known/oauth-protected-resource/org_xxx/mcp`);
+ * AND their org-scoped variants (`/org_xxx/mcp`,
- * only `org_…`-shaped segments are claimed. `prepareMcpOrgScope` then rewrites an
+ * `/.well-known/oauth-protected-resource/org_xxx/mcp`). `prepareMcpOrgScope`
- * org-scoped path to the bare path the shared envelope actually routes.
+ * then rewrites an org-scoped path to the bare path the handler routes.
  */
 export const classifyMcpPath = (pathname: string): McpRoute => {
   if (pathname === AUTHORIZATION_SERVER_METADATA_PATH) {
-    return { kind: "oauth-authorization-server", organizationId: null };
+    return {
+      kind: "oauth-authorization-server",
+      organizationId: null,
+      resource: { kind: "default" },
+    };
   }
   const segments = pathname.split("/").filter((segment) => segment.length > 0);
-  // Protected-resource metadata: `${prefix}/mcp` or `${prefix}/<org>/mcp`. The
+  // Protected-resource metadata: `${prefix}/mcp…` or `${prefix}/<org>/mcp…`.
-  // org sits after the well-known prefix (RFC 9728), not at the path root.
+  // The org sits after the well-known prefix (RFC 9728), not at the path root.
-  const prmPrefix = "/.well-known/oauth-protected-resource";
+  if (pathname.startsWith(`${PRM_PREFIX}/`)) {
-  if (pathname.startsWith(`${prmPrefix}/`)) {
+    const matched = matchMcp(segments.slice(2));
-    const matched = matchMcpSuffix(segments.slice(2));
     return matched === undefined ? null : { kind: "oauth-protected-resource", ...matched };
   }
-  // MCP transport: `/mcp` or `/<org>/mcp`.
+  const matched = matchMcp(segments);
-  const matched = matchMcpSuffix(segments);
   return matched === undefined ? null : { kind: "mcp", ...matched };
 };
-const bareMcpPath = (route: Exclude<McpRoute, null>): string =>
+const bareMcpPath = (route: Exclude<McpRoute, null>): string => {
-  route.kind === "mcp"
+  if (route.kind === "oauth-authorization-server") return AUTHORIZATION_SERVER_METADATA_PATH;
-    ? route.toolkitSlug
+  const resourcePath = mcpResourcePath(route.resource);
-      ? `${MCP_PATH}/toolkits/${route.toolkitSlug}`
+  if (route.kind === "mcp") return resourcePath;
-      : MCP_PATH
+  // PROTECTED_RESOURCE_METADATA_PATH already ends in `/mcp`; append only the
-    : route.kind === "oauth-protected-resource"
+  // sub-resource suffix so the doc path mirrors the resource path.
-      ? route.toolkitSlug
+  return `${PROTECTED_RESOURCE_METADATA_PATH}${resourcePath.slice("/mcp".length)}`;
-        ? `${PROTECTED_RESOURCE_METADATA_PATH}/toolkits/${route.toolkitSlug}`
+};
-        : PROTECTED_RESOURCE_METADATA_PATH
-      : AUTHORIZATION_SERVER_METADATA_PATH;
 /**
  * Normalize an org-scoped MCP request for the shared envelope, which routes ONLY
- * the bare `/mcp` + bare discovery paths. Rewrites `/org_xxx/mcp` (and the
+ * the bare `/mcp…` + bare discovery paths. Rewrites `/org_xxx/mcp…` (and the
  * org-scoped discovery doc) to its bare path and carries the URL-pinned org in
  * the internal `MCP_ORGANIZATION_HEADER` the cloud provider reads. A bare path is
  * left untouched, except any client-supplied org header is stripped — the org may

apps/cloud/src/mcp/oauth-metadata.ts+4−2

 import { Effect } from "effect";
+import { defaultMcpResource, type McpResource } from "@executor-js/host-mcp";
 import { AUTHKIT_DOMAIN, resourceUrlFor } from "./auth";
 import { CORS_ALLOW_ORIGIN } from "./responses";
 // matching org-scoped resource id; the bare path yields the bare resource.
 export const protectedResourceMetadataResponse = (
   organizationId: string | null = null,
-  toolkitSlug: string | null = null,
+  resource: McpResource = defaultMcpResource,
 ): Response =>
   jsonWebResponse({
-    resource: resourceUrlFor(organizationId, toolkitSlug),
+    resource: resourceUrlFor(organizationId, resource),
     authorization_servers: [AUTHKIT_DOMAIN],
     bearer_methods_supported: ["header"],
     // Spec-faithful clients (OpenCode, mcporter) request exactly what is

apps/docs/mcp-proxy.mdx+17−0

@@ -56,3 +56,20 @@ Executor: · 55 unmodified lines
56		56
57	Once a client is connected, every integration you add to Executor appears in that	57	Once a client is connected, every integration you add to Executor appears in that
58	agent automatically.	58	agent automatically.
		59
		60	## Scoped endpoints
		61
		62	Every endpoint is the same executor seen through a narrower lens. The default
		63	`/mcp` endpoint serves the whole catalog. Append a scope to serve a subset:
		64
		65	\| Endpoint \| Exposes \|
		66	\| -------------------------------------- \| ------------------------------------ \|
		67	\| `/mcp` \| Every tool \|
		68	\| `/mcp/toolkits/<slug>` \| A saved toolkit \|
		69	\| `/mcp/integrations/<slug>[,<slug>...]` \| Every tool of the named integrations \|
		70	\| `/mcp/tools/<tool id>` \| One tool, addressed by its full id \|
		71
		72	A scope can only narrow what the workspace already allows. Workspace
		73	[policies](/concepts/policies) apply on every endpoint, and a toolkit's own rules
		74	layer on top of them: a toolkit can require approval for a tool the workspace
		75	allows, but it cannot approve a tool the workspace blocks or gates.

apps/host-cloudflare/executor.config.ts+2−2

@@ -23,7 +23,7 @@ import { toolkitsPlugin } from "@executor-js/plugin-toolkits/server"; · 22 unmodified lines
23	// ---------------------------------------------------------------------------	23	// ---------------------------------------------------------------------------
24		24
25	export default defineExecutorConfig({	25	export default defineExecutorConfig({
26	plugins: ({ activeToolkitSlug }: { readonly activeToolkitSlug?: string } = {}) =>	26	plugins: () =>
27	[	27	[
28	openApiHttpPlugin({	28	openApiHttpPlugin({
29	presets: [...googleCatalog, ...microsoftCatalog],	29	presets: [...googleCatalog, ...microsoftCatalog],
@@ -31,7 +31,7 @@ export default defineExecutorConfig({ · 1 unmodified line
31	}),	31	}),
32	mcpHttpPlugin({ dangerouslyAllowStdioMCP: false }),	32	mcpHttpPlugin({ dangerouslyAllowStdioMCP: false }),
33	graphqlHttpPlugin(),	33	graphqlHttpPlugin(),
34	toolkitsPlugin({ activeToolkitSlug }),	34	toolkitsPlugin(),
35	encryptedSecretsPlugin({ key: process.env.EXECUTOR_SECRET_KEY ?? "build-time-placeholder" }),	35	encryptedSecretsPlugin({ key: process.env.EXECUTOR_SECRET_KEY ?? "build-time-placeholder" }),
36	] as const,	36	] as const,
37	});	37	});

apps/host-cloudflare/src/execution.ts+2−6

   config: CloudflareConfig,
 ): Layer.Layer<PluginsProvider> =>
   Layer.succeed(PluginsProvider)({
-    plugins: (context) =>
+    plugins: () =>
-      makeCloudflarePlugins(config.secretKey, {
+      makeCloudflarePlugins(config.secretKey, { allowLocalNetwork: config.allowLocalNetwork }),
-        activeToolkitSlug:
-          context?.mcpResource?.kind === "toolkit" ? context.mcpResource.slug : undefined,
-        allowLocalNetwork: config.allowLocalNetwork,
-      }),
   });
 export const makeCloudflareHostConfig = (config: CloudflareConfig): Layer.Layer<HostConfig> =>

apps/host-cloudflare/src/mcp/agent-handler.ts+22−9

   McpAuthProvider,
   jsonRpcErrorBody,
   defaultMcpResource,
+  mcpResourceFromPathname,
   orgWriteAccessForPrincipal,
   withOrgWriteAccess,
   type AuthOutcome,
+  type McpResource,
   type Principal,
 } from "@executor-js/host-mcp";
 import {
     return { auth, outcome };
   }).pipe(Effect.provide(cloudflareAccessMcpAuth(config)));
+// The MCP resource the request targets (`worker.ts` routes every path the
+// shared grammar recognizes here), so a session minted on a scoped path serves
+// that projection of the catalog.
+const resourceFromPath = (request: Request): McpResource =>
+  mcpResourceFromPathname(new URL(request.url).pathname) ?? defaultMcpResource;
 const propsForPrincipal = (
   request: Request,
   principal: Principal,
+  resource: McpResource,
 ): Effect.Effect<McpSessionProps> =>
   Effect.gen(function* () {
     const propagation = yield* currentPropagationHeaders(request);
         elicitationMode: readElicitationMode(request),
         artifactsEnabled: readArtifactsEnabled(request),
         searchToolsEnabled: readSearchToolsEnabled(request),
-        // host-cloudflare only routes the bare `/mcp` endpoint to the Agent
+        resource,
-        // bridge (see worker.ts), so the session always serves the default
-        // resource.
-        resource: defaultMcpResource,
         webOrigin: new URL(request.url).origin,
       },
       propagation,
   });
 export const makeCloudflareMcpAgentHandler = (config: CloudflareConfig) => {
-  const serve = McpSessionDO.serve("/mcp", {
+  const serveOptions = {
     binding: "MCP_SESSION",
     transport: "streamable-http",
-  });
+  } as const;
+  // The agents SDK builds an exact-match `URLPattern` from the `serve` path, so
+  // the bare endpoint and the scoped sub-resources need two mounts; auth,
+  // ownership, and props are shared above.
+  const serve = McpSessionDO.serve("/mcp", serveOptions);
+  const serveScoped = McpSessionDO.serve("/mcp/:kind/:value", serveOptions);
   return async (request: Request, env: CloudflareEnv, ctx: ExecutionContext): Promise<Response> => {
     if (request.method === "OPTIONS") return corsPreflightResponse();
       }
     }
-    const props = await Effect.runPromise(propsForPrincipal(request, outcome.principal));
+    const resource = resourceFromPath(request);
+    const props = await Effect.runPromise(propsForPrincipal(request, outcome.principal, resource));
     (ctx as ExecutionContext & { props?: McpSessionProps }).props = props;
     const forwarded = withOrgWriteAccess(
       withVerifiedIdentityHeaders(
           accountId: outcome.principal.accountId,
           organizationId: outcome.principal.organizationId,
         },
-        defaultMcpResource,
+        resource,
       ),
       orgWriteAccessForPrincipal(outcome.principal),
     );
-    return serve.fetch(forwarded, env, ctx);
+    const target = resource.kind === "default" ? serve : serveScoped;
+    return target.fetch(forwarded, env, ctx);
   };
 };

apps/host-cloudflare/src/mcp/auth.ts+25−29

 import {
   authenticated,
+  defaultMcpResource,
   McpAuthProvider,
+  mcpResourceFromPathname,
+  mcpResourcePath,
   unauthorized,
   type McpDiscoveryRoute,
+  type McpResource,
 } from "@executor-js/host-mcp";
 import { makeAccessVerifier } from "../auth/cloudflare-access";
 const PROTECTED_RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource";
 const MCP_PROTECTED_RESOURCE_METADATA_PATH = `${PROTECTED_RESOURCE_METADATA_PATH}/mcp`;
-const TOOLKIT_PROTECTED_RESOURCE_METADATA_PATH = `${MCP_PROTECTED_RESOURCE_METADATA_PATH}/toolkits/:toolkitSlug`;
+const SCOPED_PROTECTED_RESOURCE_METADATA_PATHS = [
+  `${MCP_PROTECTED_RESOURCE_METADATA_PATH}/toolkits/:slug`,
+  `${MCP_PROTECTED_RESOURCE_METADATA_PATH}/integrations/:slugs`,
+  `${MCP_PROTECTED_RESOURCE_METADATA_PATH}/tools/:toolId`,
+] as const;
-const toolkitSlugFromPath = (pathname: string): string | undefined => {
+// The resource a request names, whether it dialed the transport path or its
-  const mcpPrefix = "/mcp/toolkits/";
+// metadata doc. The grammar is the shared one from host-mcp.
-  if (pathname.startsWith(mcpPrefix)) {
+const resourceForRequest = (request: Request): McpResource => {
-    const slug = pathname.slice(mcpPrefix.length).split("/", 1)[0];
+  const pathname = new URL(request.url).pathname;
-    return slug ? decodeURIComponent(slug) : undefined;
+  const bare = pathname.startsWith(PROTECTED_RESOURCE_METADATA_PATH)
-  }
+    ? pathname.slice(PROTECTED_RESOURCE_METADATA_PATH.length)
-  const metadataPrefix = `${MCP_PROTECTED_RESOURCE_METADATA_PATH}/toolkits/`;
+    : pathname;
-  if (pathname.startsWith(metadataPrefix)) {
+  return mcpResourceFromPathname(bare) ?? defaultMcpResource;
-    const slug = pathname.slice(metadataPrefix.length).split("/", 1)[0];
-    return slug ? decodeURIComponent(slug) : undefined;
-  }
-  return undefined;
 };
-const toolkitPath = (slug: string): string => `/mcp/toolkits/${encodeURIComponent(slug)}`;
+const resourcePathForRequest = (request: Request): string =>
+  mcpResourcePath(resourceForRequest(request));
-const resourcePathForRequest = (request: Request): string => {
+const metadataPathForRequest = (request: Request): string =>
-  const slug = toolkitSlugFromPath(new URL(request.url).pathname);
+  `${PROTECTED_RESOURCE_METADATA_PATH}${resourcePathForRequest(request)}`;
-  return slug ? toolkitPath(slug) : "/mcp";
-};
-const metadataPathForRequest = (request: Request): string => {
-  const slug = toolkitSlugFromPath(new URL(request.url).pathname);
-  return slug
-    ? `${MCP_PROTECTED_RESOURCE_METADATA_PATH}/toolkits/${encodeURIComponent(slug)}`
-    : MCP_PROTECTED_RESOURCE_METADATA_PATH;
-};
 const protectedResourceMetadataResponse = (request: Request): Response => {
   const url = new URL(request.url);
       path: MCP_PROTECTED_RESOURCE_METADATA_PATH,
       handler: (request) => Effect.succeed(protectedResourceMetadataResponse(request)),
     },
-    {
+    ...SCOPED_PROTECTED_RESOURCE_METADATA_PATHS.map((path) => ({
-      path: TOOLKIT_PROTECTED_RESOURCE_METADATA_PATH,
+      path,
-      handler: (request) => Effect.succeed(protectedResourceMetadataResponse(request)),
+      handler: (request: Request) => Effect.succeed(protectedResourceMetadataResponse(request)),
-    },
+    })),
   ];
   return Layer.succeed(McpAuthProvider)({
     discoveryRoutes,

apps/host-cloudflare/src/plugins.ts+2−2

@@ -25,7 +25,7 @@ import { toolkitsPlugin } from "@executor-js/plugin-toolkits/server"; · 24 unmodified lines
25		25
26	export const makeCloudflarePlugins = (	26	export const makeCloudflarePlugins = (
27	secretKey: string,	27	secretKey: string,
28	options: { readonly activeToolkitSlug?: string; readonly allowLocalNetwork?: boolean } = {},	28	_options: { readonly allowLocalNetwork?: boolean } = {},
29	) =>	29	) =>
30	[	30	[
31	openApiHttpPlugin({	31	openApiHttpPlugin({
@@ -34,7 +34,7 @@ export const makeCloudflarePlugins = ( · 2 unmodified lines
34	}),	34	}),
35	mcpHttpPlugin({ dangerouslyAllowStdioMCP: false }),	35	mcpHttpPlugin({ dangerouslyAllowStdioMCP: false }),
36	graphqlHttpPlugin(),	36	graphqlHttpPlugin(),
37	toolkitsPlugin({ activeToolkitSlug: options.activeToolkitSlug }),	37	toolkitsPlugin(),
38	encryptedSecretsPlugin({ key: secretKey }),	38	encryptedSecretsPlugin({ key: secretKey }),
39	] as const;	39	] as const;
40		40

apps/host-cloudflare/src/worker.ts+6−4

+import { mcpResourceFromPathname } from "@executor-js/host-mcp";
 import { makeCloudflareApp } from "./app";
 import {
   cloudflareAccessConfigErrorMessage,
 // ---------------------------------------------------------------------------
 // The Worker fetch entry. Most requests go to `ExecutorApp.make`'s Effect web
-// handler. `/mcp` stays at this edge boundary because `McpAgent.serve()` needs
+// handler. `/mcp` and its scoped sub-resources stay at this edge boundary
-// the Cloudflare `ExecutionContext` to pass authenticated session props into the
+// because `McpAgent.serve()` needs the Cloudflare `ExecutionContext` to pass
-// hibernatable Durable Object bridge.
+// authenticated session props into the hibernatable Durable Object bridge.
 // ---------------------------------------------------------------------------
 let handlerPromise: Promise<{
     }
     const serve = await resolveHandler(env);
-    if (new URL(request.url).pathname === "/mcp") {
+    if (mcpResourceFromPathname(new URL(request.url).pathname) !== null) {
       return serve.mcp(request, env, ctx);
     }
     return serve.app(request);

apps/host-selfhost/executor.config.ts+2−3

 // ---------------------------------------------------------------------------
 interface SelfHostPluginDeps {
-  readonly activeToolkitSlug?: string;
   /** Accepted for test-harness parity; the Microsoft Graph URL override moved
    *  into the OpenAPI provider presets, so the factory no longer reads it. */
   readonly allowLocalNetwork?: boolean;
 }
 export default defineExecutorConfig({
-  plugins: ({ activeToolkitSlug }: SelfHostPluginDeps = {}) =>
+  plugins: (_deps: SelfHostPluginDeps = {}) =>
     [
       openApiHttpPlugin({
         presets: [...googleCatalog, ...microsoftCatalog],
         dangerouslyAllowStdioMCP: process.env.EXECUTOR_ALLOW_STDIO_MCP === "true",
       }),
       graphqlHttpPlugin(),
-      toolkitsPlugin({ activeToolkitSlug }),
+      toolkitsPlugin(),
       // First writable secret provider -> the default for `secrets.set`.
       encryptedSecretsPlugin({ key: resolveSecretKey() }),
     ] as const,

apps/host-selfhost/src/execution.ts+1−7

 export { makeExecutionStack } from "@executor-js/api/server";
 export const SelfHostPluginsProvider: Layer.Layer<PluginsProvider> = Layer.succeed(PluginsProvider)(
-  {
+  { plugins: () => executorConfig.plugins() },
-    plugins: (context) =>
-      executorConfig.plugins({
-        activeToolkitSlug:
-          context?.mcpResource?.kind === "toolkit" ? context.mcpResource.slug : undefined,
-      }),
-  },
 );
 export const SelfHostHostConfig: Layer.Layer<HostConfig> = Layer.sync(HostConfig, () => {

apps/host-selfhost/src/mcp/auth.ts+41−40

@@ -5,9 +5,12 @@ import { IdentityProvider, isPlatformPrincipal } from "@executor-js/api/server"; · 4 unmodified lines
5	import {	5	import {
6	authenticated,	6	authenticated,
7	McpAuthProvider,	7	McpAuthProvider,
		8	mcpResourceFromPathname,
		9	mcpResourcePath,
8	unauthorized,	10	unauthorized,
9	type AuthOutcome,	11	type AuthOutcome,
10	type McpDiscoveryRoute,	12	type McpDiscoveryRoute,
		13	type McpResource,
11	type Principal,	14	type Principal,
12	} from "@executor-js/host-mcp";	15	} from "@executor-js/host-mcp";
13		16
@@ -55,9 +58,14 @@ import { MCP_ORIGINAL_PATH_HEADER, mcpResourcePathFromOriginalPath } from "./org · 41 unmodified lines
55	// ---------------------------------------------------------------------------	58	// ---------------------------------------------------------------------------
56		59
57	const PROTECTED_RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource";	60	const PROTECTED_RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource";
58	const TOOLKIT_PROTECTED_RESOURCE_METADATA_PATH = `${PROTECTED_RESOURCE_METADATA_PATH}/mcp/toolkits/:toolkitSlug`;	61	// One metadata doc per scoped MCP sub-resource kind (the default doc is the
		62	// bare well-known path itself, Better Auth's convention).
		63	const SCOPED_PROTECTED_RESOURCE_METADATA_PATHS = [
		64	`${PROTECTED_RESOURCE_METADATA_PATH}/mcp/toolkits/:slug`,
		65	`${PROTECTED_RESOURCE_METADATA_PATH}/mcp/integrations/:slugs`,
		66	`${PROTECTED_RESOURCE_METADATA_PATH}/mcp/tools/:toolId`,
		67	] as const;
59	const AUTHORIZATION_SERVER_METADATA_PATH = "/.well-known/oauth-authorization-server";	68	const AUTHORIZATION_SERVER_METADATA_PATH = "/.well-known/oauth-authorization-server";
60	const TOOLKIT_MCP_SEGMENT = "/mcp/toolkits/";
61		69
62	const parseRoles = (role: string \| null \| undefined): ReadonlyArray<string> =>	70	const parseRoles = (role: string \| null \| undefined): ReadonlyArray<string> =>
63	(role ?? "user")	71	(role ?? "user")
@@ -91,25 +99,25 @@ const originalOrgScopedPathFor = (request: Request): string \| null => { · 27 unmodified lines
91	return header ? mcpResourcePathFromOriginalPath(header) : null;	99	return header ? mcpResourcePathFromOriginalPath(header) : null;
92	};	100	};
93		101
94	/** The pathname to derive the toolkit slug / resource path from: the	102	/**
95	* org-scoped original when the client dialed org-scoped, else the request's	103	* The scoped MCP resource a bare request names, read off its own path (the
96	* own (already-bare) path. */	104	* transport path or its metadata doc), or `null` for the default endpoint.
97	const effectivePathnameFor = (request: Request): string =>	105	* The grammar is the shared one from host-mcp.
98	originalOrgScopedPathFor(request) ?? new URL(request.url).pathname;	106	*/
99		107	const scopedResourceFor = (request: Request): McpResource \| null => {
100	const toolkitSlugFromRequest = (request: Request): string \| null => {	108	const pathname = new URL(request.url).pathname;
101	const pathname = effectivePathnameFor(request);	109	const bare = pathname.startsWith(PROTECTED_RESOURCE_METADATA_PATH)
102	const index = pathname.indexOf(TOOLKIT_MCP_SEGMENT);	110	? pathname.slice(PROTECTED_RESOURCE_METADATA_PATH.length)
103	if (index < 0) return null;	111	: pathname;
104	const slug = pathname.slice(index + TOOLKIT_MCP_SEGMENT.length).split("/", 1)[0];	112	const resource = mcpResourceFromPathname(bare);
105	return slug && slug.length > 0 ? slug : null;	113	return resource === null \|\| resource.kind === "default" ? null : resource;
106	};	114	};
107		115
108	const mcpResourcePathFor = (request: Request): string => {	116	const mcpResourcePathFor = (request: Request): string => {
109	const orgScoped = originalOrgScopedPathFor(request);	117	const orgScoped = originalOrgScopedPathFor(request);
110	if (orgScoped) return orgScoped;	118	if (orgScoped) return orgScoped;
111	const toolkitSlug = toolkitSlugFromRequest(request);	119	const scoped = scopedResourceFor(request);
112	return toolkitSlug ? `/mcp/toolkits/${toolkitSlug}` : "/mcp";	120	return scoped ? mcpResourcePath(scoped) : "/mcp";
113	};	121	};
114		122
115	/**	123	/**
@@ -123,9 +131,9 @@ const resourceMetadataUrlFor = (baseURL: string \| undefined, request: Request): · 7 unmodified lines
123	const origin = baseURL && baseURL.length > 0 ? baseURL : new URL(request.url).origin;	131	const origin = baseURL && baseURL.length > 0 ? baseURL : new URL(request.url).origin;
124	const orgScoped = originalOrgScopedPathFor(request);	132	const orgScoped = originalOrgScopedPathFor(request);
125	if (orgScoped) return `${origin}${PROTECTED_RESOURCE_METADATA_PATH}${orgScoped}`;	133	if (orgScoped) return `${origin}${PROTECTED_RESOURCE_METADATA_PATH}${orgScoped}`;
126	const toolkitSlug = toolkitSlugFromRequest(request);	134	const scoped = scopedResourceFor(request);
127	return toolkitSlug	135	return scoped
128	? `${origin}${PROTECTED_RESOURCE_METADATA_PATH}/mcp/toolkits/${toolkitSlug}`	136	? `${origin}${PROTECTED_RESOURCE_METADATA_PATH}${mcpResourcePath(scoped)}`
129	: `${origin}${PROTECTED_RESOURCE_METADATA_PATH}`;	137	: `${origin}${PROTECTED_RESOURCE_METADATA_PATH}`;
130	};	138	};
131		139
@@ -134,13 +142,15 @@ const resourceUrlFor = (baseURL: string \| undefined, request: Request): string = · 2 unmodified lines
134	return `${origin}${mcpResourcePathFor(request)}`;	142	return `${origin}${mcpResourcePathFor(request)}`;
135	};	143	};
136		144
137	const toolkitProtectedResourceMetadata = (	145	// Better Auth's metadata plugin always advertises the bare `/mcp` resource;
		146	// a scoped endpoint must advertise ITS OWN path or the client's RFC 9728
		147	// same-origin check rejects the doc.
		148	const scopedProtectedResourceMetadata = (
138	request: Request,	149	request: Request,
139	response: Response,	150	response: Response,
140	baseURL: string \| undefined,	151	baseURL: string \| undefined,
141	): Effect.Effect<Response> => {	152	): Effect.Effect<Response> => {
142	const toolkitSlug = toolkitSlugFromRequest(request);	153	if (scopedResourceFor(request) === null) return Effect.succeed(response);
143	if (!toolkitSlug) return Effect.succeed(response);
144	return Effect.promise(async () => {	154	return Effect.promise(async () => {
145	const body = (await response.json()) as Record<string, unknown>;	155	const body = (await response.json()) as Record<string, unknown>;
146	const headers = new Headers(response.headers);	156	const headers = new Headers(response.headers);
@@ -173,25 +183,16 @@ export const selfHostMcpAuth: Layer.Layer<McpAuthProvider, never, BetterAuth \| I · 26 unmodified lines
173	const challengeFor = (request: Request): string =>	183	const challengeFor = (request: Request): string =>
174	`Bearer resource_metadata="${resourceMetadataUrl(request)}"`;	184	`Bearer resource_metadata="${resourceMetadataUrl(request)}"`;
175		185
		186	const protectedResourceMetadata = (request: Request) =>
		187	Effect.promise(() => prMetadata(request)).pipe(
		188	Effect.flatMap((response) => scopedProtectedResourceMetadata(request, response, baseURL)),
		189	);
176	const discoveryRoutes: ReadonlyArray<McpDiscoveryRoute> = [	190	const discoveryRoutes: ReadonlyArray<McpDiscoveryRoute> = [
177	{	191	{ path: PROTECTED_RESOURCE_METADATA_PATH, handler: protectedResourceMetadata },
178	path: PROTECTED_RESOURCE_METADATA_PATH,	192	...SCOPED_PROTECTED_RESOURCE_METADATA_PATHS.map((path) => ({
179	handler: (request) =>	193	path,
180	Effect.promise(() => prMetadata(request)).pipe(	194	handler: protectedResourceMetadata,
181	Effect.flatMap((response) =>	195	})),
182	toolkitProtectedResourceMetadata(request, response, baseURL),
183	),
184	),
185	},
186	{
187	path: TOOLKIT_PROTECTED_RESOURCE_METADATA_PATH,
188	handler: (request) =>
189	Effect.promise(() => prMetadata(request)).pipe(
190	Effect.flatMap((response) =>
191	toolkitProtectedResourceMetadata(request, response, baseURL),
192	),
193	),
194	},
195	{	196	{
196	path: AUTHORIZATION_SERVER_METADATA_PATH,	197	path: AUTHORIZATION_SERVER_METADATA_PATH,
197	handler: (request) => Effect.promise(() => asMetadata(request)),	198	handler: (request) => Effect.promise(() => asMetadata(request)),

apps/host-selfhost/src/mcp/org-path.ts+21−18

 // so the protected-resource metadata (./auth.ts) can echo the org-scoped form
 // back to a client that dialed org-scoped (RFC 9728 same-origin check).
 //
+// The MCP resource grammar (`/mcp`, `/mcp/toolkits/<slug>`, …) is the shared
+// one from `@executor-js/host-mcp`; this module only adds the org segment.
+//
 // Pure + Effect-free on purpose: the vite config imports it too.
+import { mcpResourceFromSegments, mcpResourcePath } from "@executor-js/host-mcp";
 const PRM_PREFIX = "/.well-known/oauth-protected-resource";
+const segmentsOf = (pathname: string): readonly string[] =>
+  pathname.split("/").filter((segment) => segment.length > 0);
+// `<seg>/<mcp resource path>` -> the bare resource path, or null.
+const stripOneSegment = (segments: readonly string[]): string | null => {
+  if (segments.length < 2) return null;
+  const resource = mcpResourceFromSegments(segments.slice(1));
+  return resource ? mcpResourcePath(resource) : null;
+};
 /**
  * Given a request pathname, return the bare MCP pathname it should route to
  * when it carries a single leading org segment, or `null` when no rewrite
  */
 export const stripMcpOrgSegment = (pathname: string): string | null => {
   if (pathname.startsWith(`${PRM_PREFIX}/`)) {
-    const rest = pathname
+    const bare = stripOneSegment(segmentsOf(pathname.slice(PRM_PREFIX.length)));
-      .slice(PRM_PREFIX.length + 1)
+    if (bare === null) return null;
-      .split("/")
+    // The default doc lives at the bare prefix; scoped docs mirror their path.
-      .filter((segment) => segment.length > 0);
+    return bare === "/mcp" ? PRM_PREFIX : `${PRM_PREFIX}${bare}`;
-    if (rest.length === 2 && rest[1] === "mcp") return PRM_PREFIX;
-    if (rest.length === 4 && rest[1] === "mcp" && rest[2] === "toolkits") {
-      return `${PRM_PREFIX}/mcp/toolkits/${rest[3]}`;
-    }
-    return null;
-  }
-  const segments = pathname.split("/").filter((segment) => segment.length > 0);
-  if (segments.length === 2 && segments[1] === "mcp") return "/mcp";
-  if (segments.length === 4 && segments[1] === "mcp" && segments[2] === "toolkits") {
-    return `/mcp/toolkits/${segments[3]}`;
   }
-  return null;
+  return stripOneSegment(segmentsOf(pathname));
 };
 /**
  */
 export const isMcpServingPath = (pathname: string): boolean => {
   const routed = stripMcpOrgSegment(pathname) ?? pathname;
-  if (routed === "/mcp" || routed === "/mcp/") return true;
+  return mcpResourceFromSegments(segmentsOf(routed)) !== null;
-  const segments = routed.split("/").filter((segment) => segment.length > 0);
-  return segments.length === 3 && segments[0] === "mcp" && segments[1] === "toolkits";
 };
 /**

apps/host-selfhost/src/testing/test-app.ts+1−5

   const sessionStore = makeSelfHostMcpSessionStore(dbHandle);
   const pluginsProvider = options.pluginDeps
     ? Layer.succeed(PluginsProvider)({
-        plugins: (context) =>
+        plugins: () =>
           executorConfig.plugins({
             ...options.pluginDeps,
-            activeToolkitSlug:
-              context?.mcpResource?.kind === "toolkit"
-                ? context.mcpResource.slug
-                : options.pluginDeps?.activeToolkitSlug,
             allowLocalNetwork:
               options.pluginDeps?.allowLocalNetwork ??
               process.env.EXECUTOR_ALLOW_LOCAL_NETWORK === "true",

apps/local/executor.config.ts+2−6

 // First-party and third-party plugins use the same import-and-call flow.
 // ---------------------------------------------------------------------------
-interface LocalPluginDeps {
-  readonly activeToolkitSlug?: string;
-}
 export default defineExecutorConfig({
-  plugins: ({ activeToolkitSlug }: LocalPluginDeps = {}) =>
+  plugins: () =>
     [
       openApiHttpPlugin({
         presets: [...googleCatalog, ...microsoftCatalog],
       }),
       mcpHttpPlugin({ dangerouslyAllowStdioMCP: true }),
       graphqlHttpPlugin(),
-      toolkitsPlugin({ activeToolkitSlug }),
+      toolkitsPlugin(),
       // The durable file store must register before keychain: the first
       // writable provider becomes the default for minted OAuth tokens, and on
       // sandbox/headless hosts the keychain is an in-memory keyring that a

apps/local/src/executor.test.ts+19−32

 import { describe, expect, it } from "@effect/vitest";
 import { Effect } from "effect";
-import {
+import { disposeExecutor, getExecutor, getExecutorBundle, reloadExecutor } from "./executor";
-  createExecutorHandle,
-  disposeExecutor,
-  getExecutor,
-  getExecutorBundle,
-  reloadExecutor,
-} from "./executor";
 const withIsolatedExecutorDataDir = async (body: () => Promise<void>): Promise<void> => {
   const previousDataDir = process.env.EXECUTOR_DATA_DIR;
   });
 });
-describe("toolkit-scoped executors", () => {
+describe("projected executors", () => {
-  it("derives a toolkit-scoped executor while the shared bundle holds the data dir", async () => {
+  it("projects the shared executor while the bundle holds the data dir", async () => {
     await withIsolatedExecutorDataDir(async () => {
       const bundle = await getExecutorBundle();
       // The bundle holds the data dir's ownership lock (a `BEGIN EXCLUSIVE` on
       // `data.db.owner-lock`, per-connection, `busy_timeout = 0`) for its whole
-      // lifetime. Building this executor without `borrowedDb` opens a second
+      // lifetime. A projected view rides the SAME open handle; opening a
-      // owned database, which hits SQLITE_BUSY against that lock and rejects —
+      // second owned database would hit SQLITE_BUSY against that lock — that
-      // that is what made every `/mcp/toolkits/<slug>` request 500.
+      // is what made every `/mcp/toolkits/<slug>` request 500.
-      const scoped = await createExecutorHandle({
+      const projected = await Effect.runPromise(bundle.executor.project("scoped-slug"));
-        activeToolkitSlug: "scoped-slug",
-        borrowedDb: bundle.db,
-      });
-      expect(scoped.executor).toBeDefined();
+      // An unknown toolkit exposes nothing rather than everything.
-      await scoped.dispose();
+      const tools = await Effect.runPromise(projected.tools.list());
+      expect(tools).toEqual([]);
+      await Effect.runPromise(projected.close());
     });
   });
-  it("leaves the shared database open when a scoped executor is disposed", async () => {
+  it("leaves the shared database open when a projected executor is closed", async () => {
     await withIsolatedExecutorDataDir(async () => {
       const bundle = await getExecutorBundle();
-      const scoped = await createExecutorHandle({
+      const projected = await Effect.runPromise(bundle.executor.project("scoped-slug"));
-        activeToolkitSlug: "scoped-slug",
-        borrowedDb: bundle.db,
-      });
-      await scoped.dispose();
+      await Effect.runPromise(projected.close());
-      // A scoped executor borrows the bundle's open handle, so disposing one
+      // A projected view borrows the bundle's open handle, so closing one must
-      // must close its own plugins and nothing else. `createExecutor` closes the
+      // close its own plugins and nothing else. `createExecutor` closes the
-      // database only when it was handed the owning `{ db, close }` wrapper, so
+      // database only when handed the owning `{ db, close }` wrapper, and the
-      // the layer passes the inner handle (`sqlite.db`) instead. Hand it the
+      // projection is built over the bare handle. This read is what catches a
-      // wrapper and the daemon loses `/mcp` and `/api` the moment any toolkit
+      // regression there.
-      // session ends — the type system does not catch the swap, because
-      // `SqliteFumaDb` structurally satisfies `ExecutorDb`. This read is what
-      // catches it.
       const integrations = await Effect.runPromise(bundle.executor.integrations.list());
       expect(Array.isArray(integrations)).toBe(true);
     });

apps/local/src/executor.ts+10−15

 type LocalPlugins = readonly AnyPlugin[];
 export interface LocalExecutorOptions {
-  readonly activeToolkitSlug?: string;
   /**
    * Reuse an already-open owned database instead of opening (and locking) the
-   * data dir again. A toolkit-scoped MCP session differs from the default one
+   * data dir again. `openOwnedLocalDatabase` takes an EXCLUSIVE lock, so a
-   * only in its plugin set, so it must ride the running server's DB handle:
+   * second open from inside the same process contends with the lock this
-   * `openOwnedLocalDatabase` takes an EXCLUSIVE lock, and a second open from
+   * process already holds. The borrowed handle is NOT closed when the derived
-   * inside the same process contends with the lock this process already holds.
+   * executor disposes — whoever opened it still owns its lifetime.
-   * The borrowed handle is NOT closed when the derived executor disposes —
-   * whoever opened it still owns its lifetime.
    */
   readonly borrowedDb?: OwnedLocalDatabase;
 }
-const loadLocalPlugins = (options: LocalExecutorOptions = {}) =>
+const loadLocalPlugins = () =>
   Effect.gen(function* () {
     const cwd = process.env.EXECUTOR_SCOPE_DIR || process.cwd();
-    const staticPlugins = executorConfig.plugins({
+    const staticPlugins = executorConfig.plugins();
-      activeToolkitSlug: options.activeToolkitSlug,
-    });
     const dynamicPlugins =
       (yield* Effect.promise(() => loadPluginsFromJsonc({ path: resolvePluginConfigPath(cwd) }))) ??
       [];
 interface LocalExecutorBundle {
   readonly executor: Executor<LocalPlugins>;
   readonly plugins: LocalPlugins;
-  /** The owned DB this bundle opened (or borrowed). Surfaced so a
+  /** The owned DB this bundle opened (or borrowed). Surfaced so a derived
-   *  toolkit-scoped executor can ride the SAME handle instead of contending
+   *  executor can ride the SAME handle instead of contending with this
-   *  with this process's own exclusive data-dir lock. */
+   *  process's own exclusive data-dir lock. */
   readonly db: OwnedLocalDatabase;
   /** Where this daemon's web UI is reachable, resolved once at boot. Surfaced
    *  so callers building user-facing links (MCP artifact deep links) use the
   return Layer.effect(LocalExecutorTag)(
     Effect.gen(function* () {
-      const { cwd, plugins } = yield* loadLocalPlugins(options);
+      const { cwd, plugins } = yield* loadLocalPlugins();
       const tenantId = makeTenantId(cwd);
       const tables = collectTables();

apps/local/src/main.ts+19−20

 import { Context, Data, Effect, Layer, ManagedRuntime } from "effect";
 import { withExecutionAnalytics } from "@executor-js/analytics";
+import { projectionForMcpResource } from "@executor-js/api/server";
 import { createExecutionEngine } from "@executor-js/execution";
 import { artifactUrlFor } from "@executor-js/host-mcp/create-artifact";
 import { loadMcpAppsShellHtml } from "@executor-js/mcp-apps-shell";
 import { makeQuickJsExecutor } from "@executor-js/runtime-quickjs";
 import { localAnalytics } from "./analytics";
 import { makeLocalApiHandler } from "./app";
-import { createExecutorHandle, disposeExecutor, getExecutorBundle } from "./executor";
+import { disposeExecutor, getExecutorBundle } from "./executor";
 import { createMcpRequestHandler, type McpRequestHandler } from "./mcp";
 // ---------------------------------------------------------------------------
     // byte-identical to the one the API serves.
     const { executor, webBaseUrl } = await getExecutorBundle();
     // Both engines below serve MCP endpoints, so the wrap binds the "mcp"
-    // plane structurally; the toolkit-scoped engine additionally marks
+    // plane structurally; a projected engine additionally marks `toolkit`
-    // `toolkit` (the slug itself is a user label and never recorded).
+    // (the resource's own label is user data and never recorded).
     const engine = withExecutionAnalytics(
       createExecutionEngine({
         executor,
       { plane: "mcp", toolkit: false },
     );
     // The generative-UI surface, shared by every resource this daemon serves.
-    // Each toolkit gets its own executor, so `artifacts` is bound per resource
+    // A scoped resource is a projection of the boot executor, so `artifacts`
-    // below rather than hoisted with the rest.
+    // is bound per resource below rather than hoisted with the rest.
     //
     // Including the create-time smoke render, on the same terms as every other
     // host. This daemon is a dependency of `apps/cli`, whose build does not
         ...appsConfig,
       },
       createConfigForResource: async (resource) => {
-        if (resource.kind === "default") {
+        const projection = projectionForMcpResource(resource);
+        if (projection === undefined) {
           return {
             config: {
               engine,
             },
           };
         }
-        // Borrow the running server's DB handle: this process already holds the
+        // A scoped resource is the boot executor seen through a projection:
-        // data dir's exclusive ownership lock, so opening it a second time here
+        // same database handle (this process holds the data dir's exclusive
-        // fails against ourselves. The toolkit executor differs only in its
+        // lock, so a second open would contend with ourselves), same plugins,
-        // plugin set, and the borrowed handle stays open when it disposes.
+        // same workspace policies, narrowed to what the resource exposes.
-        const handle = await createExecutorHandle({
+        const projected = await Effect.runPromise(executor.project(projection));
-          activeToolkitSlug: resource.slug,
+        const projectedEngine = withExecutionAnalytics(
-          borrowedDb: (await getExecutorBundle()).db,
-        });
-        const toolkitEngine = withExecutionAnalytics(
           createExecutionEngine({
-            executor: handle.executor,
+            executor: projected,
             codeExecutor: makeQuickJsExecutor(),
           }),
           localAnalytics,
         );
         return {
           config: {
-            engine: toolkitEngine,
+            engine: projectedEngine,
-            artifacts: handle.executor.artifacts,
+            artifacts: projected.artifacts,
-            connections: handle.executor.connections,
+            connections: projected.connections,
             ...appsConfig,
           },
-          close: handle.dispose,
+          close: () => Effect.runPromise(Effect.ignore(projected.close())),
         };
       },
     });

apps/local/src/mcp.ts+5−10

@@ -4,8 +4,8 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js" · 3 unmodified lines
4	import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";	4	import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
5		5
6	import {	6	import {
7	defaultMcpResource,
8	jsonRpcErrorBody,	7	jsonRpcErrorBody,
		8	mcpResourceFromPathname,
9	mcpResourceKey,	9	mcpResourceKey,
10	preInitializeMethodNotFound,	10	preInitializeMethodNotFound,
11	type McpResource,	11	type McpResource,
@@ -105,15 +105,10 @@ const resumeApprovalResult = (executionId: string, response: ResumeResponse) => · 93 unmodified lines
105	isError: false,	105	isError: false,
106	});	106	});
107		107
108	const toolkitPathPattern = /^\/mcp\/toolkits\/([^/?#]+)\/?$/;	108	// The MCP resource grammar is the shared one from host-mcp; a path it does not
109		109	// recognize is not an MCP resource here either.
110	const resourceFromRequest = (request: Request): McpResource \| null => {	110	const resourceFromRequest = (request: Request): McpResource \| null =>
111	const pathname = new URL(request.url).pathname;	111	mcpResourceFromPathname(new URL(request.url).pathname);
112	if (pathname === "/mcp" \|\| pathname === "/mcp/") return defaultMcpResource;
113	const match = toolkitPathPattern.exec(pathname);
114	if (!match) return null;
115	return { kind: "toolkit", slug: decodeURIComponent(match[1]) };
116	};
117		112
118	const engineFromConfig = (config: ExecutorMcpServerConfig): AnyExecutionEngine \| null =>	113	const engineFromConfig = (config: ExecutorMcpServerConfig): AnyExecutionEngine \| null =>
119	"engine" in config ? config.engine : null;	114	"engine" in config ? config.engine : null;

e2e/scenarios/toolkits-mcp.test.ts+266−0

@@ -91,6 +91,12 @@ const servePingApi = Effect.acquireRelease( · 90 unmodified lines
91	const toolkitUrl = (baseUrl: string, slug: string): string =>	91	const toolkitUrl = (baseUrl: string, slug: string): string =>
92	new URL(`/mcp/toolkits/${slug}`, baseUrl).toString();	92	new URL(`/mcp/toolkits/${slug}`, baseUrl).toString();
93		93
		94	const integrationsUrl = (baseUrl: string, slugs: readonly string[]): string =>
		95	new URL(`/mcp/integrations/${slugs.join(",")}`, baseUrl).toString();
		96
		97	const toolUrl = (baseUrl: string, toolId: string): string =>
		98	new URL(`/mcp/tools/${toolId}`, baseUrl).toString();
		99
94	const connectionPattern = (integration: string, owner: "org" \| "user", name: string): string =>	100	const connectionPattern = (integration: string, owner: "org" \| "user", name: string): string =>
95	`${integration}.${owner}.${name}.*`;	101	`${integration}.${owner}.${name}.*`;
96		102
@@ -584,6 +590,266 @@ scenario( · 487 unmodified lines
584	}),	590	}),
585	);	591	);
586		592
		593	scenario(
		594	"Toolkits · a workspace approval policy still gates a toolkit endpoint",
		595	{ timeout: 240_000 },
		596	Effect.gen(function* () {
		597	const target = yield* Target;
		598	const mcp = yield* Mcp;
		599	const { client: makeClient } = yield* Api;
		600	const identity = yield* target.newIdentity();
		601	const client = yield* makeClient(api, identity);
		602
		603	const toolkitName = unique("gated-kit");
		604	const createdPattern = `${unique("workspace-gated-policy")}.*`;
		605	const gatedTool = "executor.coreTools.policies.create";
		606
		607	yield* Effect.gen(function* () {
		608	// The toolkit grants the core tools and explicitly APPROVES the policy
		609	// tool. The workspace, one level up, requires approval for the same
		610	// tool. The toolkit must not be able to undo the workspace's gate.
		611	const toolkit = yield* client.toolkits.create({
		612	payload: { owner: "org", name: toolkitName },
		613	});
		614	yield* client.toolkits.createConnection({
		615	params: { toolkitId: toolkit.id },
		616	payload: { pattern: "executor.coreTools.*" },
		617	});
		618	yield* client.toolkits.createPolicy({
		619	params: { toolkitId: toolkit.id },
		620	payload: { pattern: gatedTool, action: "approve" },
		621	});
		622	yield* client.policies.create({
		623	payload: { owner: "org", pattern: gatedTool, action: "require_approval" },
		624	});
		625
		626	const session = mcp.session(identity, {
		627	url: toolkitUrl(target.baseUrl, toolkit.slug),
		628	});
		629	const paused = yield* session.call("execute", {
		630	code: createPolicyCode({ pattern: createdPattern, action: "block" }),
		631	});
		632	expect(paused.text, "the workspace gate pauses the toolkit call").toContain(
		633	"Execution paused",
		634	);
		635	expect(paused.text, "the paused result carries an execution id").toContain("executionId:");
		636
		637	const beforeApproval = yield* client.policies.list();
		638	expect(
		639	beforeApproval.some((policy) => policy.pattern === createdPattern),
		640	"no side effect lands while the approval is pending",
		641	).toBe(false);
		642
		643	const resumed = yield* session.approvePaused(paused.text);
		644	expect(resumed.ok, `the approved call completes: ${resumed.text}`).toBe(true);
		645	const afterApproval = yield* client.policies.list();
		646	expect(
		647	afterApproval.some((policy) => policy.pattern === createdPattern),
		648	"the side effect lands only after approval",
		649	).toBe(true);
		650	}).pipe(
		651	Effect.ensuring(
		652	Effect.gen(function* () {
		653	const listed = yield* client.toolkits.list();
		654	yield* Effect.forEach(
		655	listed.toolkits.filter((toolkit) => toolkit.name === toolkitName),
		656	(toolkit) => client.toolkits.remove({ params: { toolkitId: toolkit.id } }),
		657	{ discard: true },
		658	);
		659	const policies = yield* client.policies.list();
		660	yield* Effect.forEach(
		661	policies.filter(
		662	(policy) => policy.pattern === createdPattern \|\| policy.pattern === gatedTool,
		663	),
		664	(policy) =>
		665	client.policies.remove({
		666	params: { policyId: policy.id },
		667	payload: { owner: policy.owner },
		668	}),
		669	{ discard: true },
		670	);
		671	}).pipe(Effect.ignore),
		672	),
		673	);
		674	}),
		675	);
		676
		677	scenario(
		678	"Toolkits · a workspace block policy is enforced on a toolkit endpoint",
		679	{ timeout: 240_000 },
		680	Effect.gen(function* () {
		681	const target = yield* Target;
		682	const mcp = yield* Mcp;
		683	const { client: makeClient } = yield* Api;
		684	const identity = yield* target.newIdentity();
		685	const client = yield* makeClient(api, identity);
		686
		687	const toolkitName = unique("blocked-kit");
		688	const createdPattern = `${unique("workspace-blocked-policy")}.*`;
		689	const gatedTool = "executor.coreTools.policies.create";
		690
		691	yield* Effect.gen(function* () {
		692	const toolkit = yield* client.toolkits.create({
		693	payload: { owner: "org", name: toolkitName },
		694	});
		695	yield* client.toolkits.createConnection({
		696	params: { toolkitId: toolkit.id },
		697	payload: { pattern: "executor.coreTools.*" },
		698	});
		699	yield* client.toolkits.createPolicy({
		700	params: { toolkitId: toolkit.id },
		701	payload: { pattern: gatedTool, action: "approve" },
		702	});
		703	yield* client.policies.create({
		704	payload: { owner: "org", pattern: gatedTool, action: "block" },
		705	});
		706
		707	const session = mcp.session(identity, {
		708	url: toolkitUrl(target.baseUrl, toolkit.slug),
		709	});
		710	const blocked = yield* session.call("execute", {
		711	code: createPolicyCode({ pattern: createdPattern, action: "block" }),
		712	});
		713	expect(blocked.text, "a blocked tool never pauses").not.toContain("Execution paused");
		714	const policies = yield* client.policies.list();
		715	expect(
		716	policies.some((policy) => policy.pattern === createdPattern),
		717	"the workspace block prevents the side effect through the toolkit",
		718	).toBe(false);
		719	}).pipe(
		720	Effect.ensuring(
		721	Effect.gen(function* () {
		722	const listed = yield* client.toolkits.list();
		723	yield* Effect.forEach(
		724	listed.toolkits.filter((toolkit) => toolkit.name === toolkitName),
		725	(toolkit) => client.toolkits.remove({ params: { toolkitId: toolkit.id } }),
		726	{ discard: true },
		727	);
		728	const policies = yield* client.policies.list();
		729	yield* Effect.forEach(
		730	policies.filter(
		731	(policy) => policy.pattern === createdPattern \|\| policy.pattern === gatedTool,
		732	),
		733	(policy) =>
		734	client.policies.remove({
		735	params: { policyId: policy.id },
		736	payload: { owner: policy.owner },
		737	}),
		738	{ discard: true },
		739	);
		740	}).pipe(Effect.ignore),
		741	),
		742	);
		743	}),
		744	);
		745
		746	scenario(
		747	"Scoped MCP · integration and single-tool endpoints project the same catalog",
		748	{ timeout: 240_000 },
		749	Effect.scoped(
		750	Effect.gen(function* () {
		751	const target = yield* Target;
		752	const mcp = yield* Mcp;
		753	const { client: makeClient } = yield* Api;
		754	const upstream = yield* servePingApi;
		755	const identity = yield* target.newIdentity();
		756	const client = yield* makeClient(api, identity);
		757
		758	const granted = unique("scoped_ping");
		759	const other = unique("other_ping");
		760	const connection = "main";
		761
		762	yield* Effect.gen(function* () {
		763	for (const slug of [granted, other]) {
		764	yield* client.openapi.addSpec({
		765	payload: {
		766	spec: { kind: "blob", value: pingSpec(upstream.url) },
		767	slug: IntegrationSlug.make(slug),
		768	baseUrl: upstream.url,
		769	authenticationTemplate: [
		770	{
		771	slug: "apiKey",
		772	type: "apiKey",
		773	headers: { "x-e2e-token": [{ type: "variable", name: "token" }] },
		774	},
		775	],
		776	},
		777	});
		778	yield* client.connections.create({
		779	payload: {
		780	owner: "org",
		781	name: ConnectionName.make(connection),
		782	integration: IntegrationSlug.make(slug),
		783	template: AuthTemplateSlug.make("apiKey"),
		784	value: "unused-token",
		785	},
		786	});
		787	}
		788
		789	// /mcp/integrations/<slug>: every tool of that integration, nothing else.
		790	const integrationSession = mcp.session(identity, {
		791	url: integrationsUrl(target.baseUrl, [granted]),
		792	});
		793	const grantedPaths = yield* executeJson(
		794	integrationSession,
		795	visibleConnectionPathsCode(granted),
		796	);
		797	expect(
		798	grantedPaths.paths as string[],
		799	"the integration endpoint exposes its tools",
		800	).toEqual([`${granted}.org.${connection}.ping.getPing`]);
		801	const otherPaths = yield* executeJson(
		802	integrationSession,
		803	visibleConnectionPathsCode(other),
		804	);
		805	expect(otherPaths.paths as string[], "other integrations stay hidden").toEqual([]);
		806	const call = yield* executeJson(
		807	integrationSession,
		808	callPingCode({ integration: granted, owner: "org", connection, id: "by-integration" }),
		809	);
		810	assertCallOk(call, "the integration endpoint can call its tool");
		811	const otherCall = yield* executeJson(
		812	integrationSession,
		813	callPingCode({ integration: other, owner: "org", connection, id: "by-integration" }),
		814	);
		815	assertCallMissing(otherCall, "the integration endpoint blocks other integrations");
		816
		817	// /mcp/tools/<tool id>: exactly one tool, addressed across connections.
		818	const toolSession = mcp.session(identity, {
		819	url: toolUrl(target.baseUrl, `${granted}.org.${connection}.ping.getPing`),
		820	});
		821	const singlePaths = yield* executeJson(toolSession, visibleConnectionPathsCode(granted));
		822	expect(singlePaths.paths as string[], "the tool endpoint exposes one tool").toEqual([
		823	`${granted}.org.${connection}.ping.getPing`,
		824	]);
		825	const singleCall = yield* executeJson(
		826	toolSession,
		827	callPingCode({ integration: granted, owner: "org", connection, id: "by-tool" }),
		828	);
		829	assertCallOk(singleCall, "the tool endpoint can call its one tool");
		830
		831	// Both are projections of the same catalog: the default endpoint still
		832	// sees everything.
		833	const everything = yield* executeJson(
		834	mcp.session(identity),
		835	visibleConnectionPathsCode(other),
		836	);
		837	expect(everything.paths as string[], "the default endpoint is unchanged").toEqual([
		838	`${other}.org.${connection}.ping.getPing`,
		839	]);
		840	}).pipe(
		841	Effect.ensuring(
		842	Effect.forEach(
		843	[granted, other],
		844	(slug) => client.openapi.removeSpec({ params: { slug } }).pipe(Effect.ignore),
		845	{ discard: true },
		846	),
		847	),
		848	);
		849	}),
		850	),
		851	);
		852
587	scenario(	853	scenario(
588	"Toolkits · a broad approve policy applies over a narrower connection grant",	854	"Toolkits · a broad approve policy applies over a narrower connection grant",
589	{ timeout: 240_000 },	855	{ timeout: 240_000 },

packages/core/api/src/server.ts+1−0

@@ -82,6 +82,7 @@ export { · 81 unmodified lines
82	makePlatformExecutor,	82	makePlatformExecutor,
83	HostConfig,	83	HostConfig,
84	PluginsProvider,	84	PluginsProvider,
		85	projectionForMcpResource,
85	RequestWebOrigin,	86	RequestWebOrigin,
86	RequestOrgSlug,	87	RequestOrgSlug,
87	type HostConfigShape,	88	type HostConfigShape,

packages/core/api/src/server/execution-stack.ts+1−1

@@ -129,7 +129,7 @@ export const makeExecutionStack = < · 128 unmodified lines
129	organizationId,	129	organizationId,
130	organizationName,	130	organizationName,
131	{	131	{
132	plugins: { mcpResource: options?.mcpResource },	132	mcpResource: options?.mcpResource,
133	...(options?.orgWrites === undefined ? {} : { orgWrites: options.orgWrites }),	133	...(options?.orgWrites === undefined ? {} : { orgWrites: options.orgWrites }),
134	},	134	},
135	).pipe(Effect.withSpan("executor.stack.scoped_executor"));	135	).pipe(Effect.withSpan("executor.stack.scoped_executor"));

packages/core/api/src/server/scoped-executor.ts+35−10

   type ExecutorConfig,
   type FirstPartyOAuthClientConfig,
   type StorageFailure,
+  type ToolProjection,
 } from "@executor-js/sdk";
 import {
   makeHostedFetch,
 // ---------------------------------------------------------------------------
 // PluginsProvider seam — the per-host (and possibly per-request) plugin array.
 //
-// Returns an Effect so a host that needs request-scoped credentials (cloud reads
+// A host that needs request-scoped credentials (cloud reads WorkOS creds from
-// WorkOS creds from the Worker env) can build fresh plugin instances each call,
+// the Worker env) builds fresh plugin instances each call, while a host with
-// while a host with static plugins (self-host) just returns a constant array.
+// static plugins (self-host) just returns a constant array. The plugin set is
+// the SAME for every MCP resource: a scoped endpoint is a projection over one
+// executor (see `projectionForMcpResource`), not a different plugin set.
 // ---------------------------------------------------------------------------
-export interface PluginsProviderContext {
-  readonly mcpResource?: McpResource;
-}
 export interface PluginsProviderShape {
-  readonly plugins: (context?: PluginsProviderContext) => readonly AnyPlugin[];
+  readonly plugins: () => readonly AnyPlugin[];
 }
 export class PluginsProvider extends Context.Service<PluginsProvider, PluginsProviderShape>()(
   "@executor-js/sdk/PluginsProvider",
 ) {}
+// ---------------------------------------------------------------------------
+// MCP resource -> projection. ONE place turns "which endpoint was dialed" into
+// "which slice of the catalog this executor serves":
+//   default            -> no projection (the whole catalog, workspace policy)
+//   toolkit <slug>     -> the named projection the toolkits plugin resolves
+//   integrations <a,b> -> every tool of those integrations, no overlay
+//   tool <id>          -> that one tool id, no overlay
+// The default endpoint is `undefined`, not the full projection, so the
+// unprojected executor is byte-identical to what it was before projections.
+// ---------------------------------------------------------------------------
+export const projectionForMcpResource = (
+  resource: McpResource | undefined,
+): string | ToolProjection | undefined => {
+  if (resource === undefined || resource.kind === "default") return undefined;
+  if (resource.kind === "toolkit") return resource.slug;
+  if (resource.kind === "integrations") {
+    return { visible: resource.slugs.map((slug) => `${slug}.*`), rules: [] };
+  }
+  return { visible: [resource.toolId], rules: [] };
+};
 // ---------------------------------------------------------------------------
 // makeScopedExecutor — the shared per-(user, org) executor body.
 //
   // v2 executor binding, which is `{ tenant, subject }` only.
   _organizationName: string,
   options?: {
-    readonly plugins?: PluginsProviderContext;
+    /** The MCP resource this executor serves; resolved to a projection via
+     *  `projectionForMcpResource`. Absent on the HTTP plane. */
+    readonly mcpResource?: McpResource;
     /** Workspace-settings permission for this binding (see
      *  `ExecutorConfig.orgWrites`). Hosts derive it from the acting member's
      *  role; omitted -> allowed (hosts with no role model). */
       oauthCallbackPath: config.oauthCallbackPath,
     });
-    const plugins = yield* Effect.sync(() => pluginsFactory(options?.plugins));
+    const plugins = yield* Effect.sync(() => pluginsFactory());
+    const projection = projectionForMcpResource(options?.mcpResource);
     const hostedHttpOptions = {
       allowLocalNetwork: config.allowLocalNetwork,
     };
         orgSlug,
         includeProviders: config.exposeCredentialProviders ?? true,
       },
+      ...(projection === undefined ? {} : { projection }),
     });
     // Record the sighting. THIS is the seam every HTTP request and MCP session
     // on every host passes through, so it is where the `subject` table gets

packages/core/sdk/src/executor.ts+95−109

 import {
   comparePolicyRow,
   isValidPattern,
-  matchPattern,
   positionForNewPattern,
   resolveEffectivePolicy,
   rowToToolPolicy,
   StaticIntegrationDecl,
   StaticToolDecl,
   StorageDeps,
-  ToolPolicyProvider,
-  ToolPolicyProviderRule,
   ToolInvocationCredential,
+  ToolProjectionSource,
 } from "./plugin";
 import {
   pluginStorageId,
 import { annotateToolResultOutcome, isToolResult } from "./tool-result";
 import { makeShapeMemory, observedShapeToJsonSchema, SHAPE_MEMORY_PLUGIN_ID } from "./shape-memory";
 import { isUnauthorizedToolFailure } from "./auth-tool-failure";
+import { resolveProjectedPolicy, type ToolProjection } from "./tool-projection";
 const PLUGIN_STORAGE_DELETE_KEY_BATCH_SIZE = 90;
 const MAX_APPROVAL_ARGUMENT_PREVIEW_CHARS = 4_000;
     options?: InvokeOptions,
   ) => Effect.Effect<unknown, ExecuteError>;
+  /**
+   * A narrowed view of this executor: the same tenant, subject, database,
+   * plugins, and workspace policies, serving only the tools the named
+   * projection exposes (a toolkit slug today). An unknown name yields a view
+   * that exposes nothing. Closing the view releases its plugins but never the
+   * shared database; close the parent for that.
+   */
+  readonly project: (
+    projection: string | ToolProjection,
+  ) => Effect.Effect<Executor<TPlugins>, StorageFailure>;
   readonly close: () => Effect.Effect<void, StorageFailure>;
 } & PluginExtensions<TPlugins>;
    * every subject's connection rows, credential item ids included.
    */
   readonly platformView?: boolean;
+  /**
+   * Serve a narrowed view of the catalog (see `./tool-projection`). Applied on
+   * top of the workspace's tool policies on every read and invoke surface.
+   * Hosts do not set this directly; they call `executor.project(name)`, which
+   * resolves the name through the loaded projection source and rebuilds the
+   * view over the same database.
+   */
+  readonly projection?: string | ToolProjection;
   /**
    * Whether this binding may CONFIGURE workspace-level state: `owner: "org"`
    * rows (shared connections, org tool policies, org OAuth clients) and the
     });
     const rootDbUntyped = "db" in dbInput ? dbInput.db : dbInput;
     const closeDb = "db" in dbInput ? dbInput.close : undefined;
+    // A projected view rebuilds this executor over the SAME open handle: same
+    // plugin factories, same tenant/subject, one extra `projection` binding.
+    // The view is handed the bare `db` (never the `{ db, close }` wrapper) so
+    // closing it cannot close the parent's database.
+    const project = (
+      projection: string | ToolProjection,
+    ): Effect.Effect<Executor<TPlugins>, StorageFailure> =>
+      createExecutor<TPlugins>({ ...config, db: rootDbUntyped, projection });
     // Shared with every other execution stack built over this same handle —
     // see the gate's definition for what that does and does not cover.
     const refreshInFlight = refreshGateFor(rootDbUntyped);
     // Populated once, never mutated after startup.
     const staticTools = new Map<string, StaticTools>();
     const runtimes = new Map<string, PluginRuntime>();
-    let activeToolPolicyProvider: ToolPolicyProvider | null = null;
+    // The plugin-registered source of named projections, when one loaded.
+    let toolProjectionSource: ToolProjectionSource | null = null;
+    // Whether THIS executor view serves a projection. `undefined` is the full
+    // catalog (workspace policy only). A projected view shares every closure
+    // below and differs only in this one binding. A NAMED projection is
+    // re-read from its source on every operation, so an open session follows
+    // edits to the toolkit it serves; an inline projection is constant.
+    const projectionSelector = config.projection;
+    const emptyProjection: ToolProjection = { visible: [], rules: [] };
+    const resolveActiveProjection = (): Effect.Effect<ToolProjection | null, StorageFailure> => {
+      if (projectionSelector === undefined) return Effect.succeed(null);
+      if (typeof projectionSelector !== "string") return Effect.succeed(projectionSelector);
+      // An unknown name exposes nothing rather than everything: the URL named
+      // a capability set, and "no such set" must never widen to the catalog.
+      if (!toolProjectionSource) return Effect.succeed(emptyProjection);
+      return toolProjectionSource
+        .resolve(projectionSelector)
+        .pipe(Effect.map((projection) => projection ?? emptyProjection));
+    };
     // Credential providers keyed by `provider.key`, in registration order.
     const credentialProviders = new Map<string, CredentialProvider>();
     const credentialProviderOrder: string[] = [];
             ),
           ),
         );
-        // A scoped toolkit must not advertise providers it grants no tools from
+        // A projection must not advertise providers it grants no tools from
         // (mirrors `connectionsList`). Static integrations are system namespaces, not
         // user providers, so they stay; DB-backed integrations are filtered to
-        // those that contribute at least one visible tool under the active policy.
+        // those that contribute at least one visible tool under the projection.
-        if (!activeToolPolicyProvider) return [...staticIntegrationList, ...dbIntegrations];
+        if (projectionSelector === undefined) return [...staticIntegrationList, ...dbIntegrations];
         const visibleTools = yield* toolsList({ includeAnnotations: false });
         const visibleIntegrationSlugs = new Set(
           visibleTools.filter((tool) => !tool.static).map((tool) => String(tool.integration)),
             ),
         });
         const connections = rows.map(rowToConnection);
-        if (!activeToolPolicyProvider) return connections;
+        if (projectionSelector === undefined) return connections;
         const visibleTools = yield* toolsList({ includeAnnotations: false });
         const visibleConnectionKeys = new Set(
       });
     // ------------------------------------------------------------------
-    // Active policy source.
+    // Active policy rule set.
+    //
+    // One snapshot per operation (a single tools/list, tools/call, or
+    // execute): the workspace's `tool_policy` rows, read ONCE, plus the
+    // projection this view serves. Every tool in the operation resolves
+    // against that snapshot, so the list surface never pays a per-tool read.
+    // The projection is applied on top of the workspace answer, never
+    // instead of it — see `./tool-projection`.
     // ------------------------------------------------------------------
-    type ActivePolicyRuleSet =
+    interface ActivePolicyRuleSet {
-      | { readonly kind: "global"; readonly rows: readonly ToolPolicyRow[] }
+      readonly rows: readonly ToolPolicyRow[];
-      | {
+      readonly projection: ToolProjection | null;
-          readonly kind: "provider";
+    }
-          readonly provider: ToolPolicyProvider;
-          readonly rules: readonly ToolPolicyProviderRule[] | null;
-        }
-      | {
-          readonly kind: "prepared";
-          readonly resolve: (input: {
-            readonly toolId: string;
-            readonly defaultRequiresApproval?: boolean;
-          }) => EffectivePolicy;
-        };
-    const compareProviderPolicyRule = (
-      a: ToolPolicyProviderRule,
-      b: ToolPolicyProviderRule,
-    ): number => {
-      if (a.position < b.position) return -1;
-      if (a.position > b.position) return 1;
-      return a.id < b.id ? -1 : a.id > b.id ? 1 : 0;
-    };
-    const resolveProviderPolicyFromRules = (
-      toolId: string,
-      rules: readonly ToolPolicyProviderRule[],
-    ): EffectivePolicy => {
-      for (const rule of [...rules].sort(compareProviderPolicyRule)) {
-        if (!matchPattern(rule.pattern, toolId)) continue;
-        return {
-          action: rule.action,
-          source: "user",
-          pattern: rule.pattern,
-          policyId: rule.id,
-        };
-      }
-      // Toolkit-style providers are capability allowlists. No matching rule
-      // means the tool is outside the capability boundary.
-      return {
-        action: "block",
-        source: "user",
-        pattern: "*",
-      };
-    };
     const listActivePolicyRuleSet = (): Effect.Effect<ActivePolicyRuleSet, StorageFailure> =>
-      activeToolPolicyProvider
+      Effect.all(
-        ? // Batched per-operation resolver: fetch all policy + connection state
+        {
-          // once, then resolve every tool in this operation against that
+          rows: core.findMany("tool_policy", {}),
-          // snapshot. Avoids the per-tool resolve N+1 on the list surface.
+          projection: resolveActiveProjection(),
-          activeToolPolicyProvider.prepare
+        },
-          ? activeToolPolicyProvider.prepare().pipe(
+        { concurrency: 2 },
-              Effect.map((resolve) => ({
+      );
-                kind: "prepared" as const,
-                resolve,
-              })),
-            )
-          : activeToolPolicyProvider.resolve
-            ? Effect.succeed({
-                kind: "provider" as const,
-                provider: activeToolPolicyProvider,
-                rules: null,
-              })
-            : activeToolPolicyProvider.list().pipe(
-                Effect.map((rules) => ({
-                  kind: "provider" as const,
-                  provider: activeToolPolicyProvider!,
-                  rules,
-                })),
-              )
-        : core
-            .findMany("tool_policy", {})
-            .pipe(Effect.map((rows) => ({ kind: "global" as const, rows })));
     const resolvePolicyFromRuleSet = (
       toolId: string,
       ruleSet: ActivePolicyRuleSet,
       defaultRequiresApproval?: boolean,
-    ): Effect.Effect<EffectivePolicy, StorageFailure> =>
+    ): Effect.Effect<EffectivePolicy, StorageFailure> => {
-      ruleSet.kind === "prepared"
+      const workspace = resolveEffectivePolicy(
-        ? Effect.succeed(ruleSet.resolve({ toolId, defaultRequiresApproval }))
+        toolId,
-        : ruleSet.kind === "provider"
+        ruleSet.rows,
-          ? ruleSet.provider.resolve
+        ownerRankForRow,
-            ? ruleSet.provider.resolve({ toolId, defaultRequiresApproval })
+        defaultRequiresApproval,
-            : Effect.succeed(resolveProviderPolicyFromRules(toolId, ruleSet.rules ?? []))
+      );
-          : Effect.succeed(
+      return Effect.succeed(
-              resolveEffectivePolicy(
+        ruleSet.projection
-                toolId,
+          ? resolveProjectedPolicy(ruleSet.projection, toolId, workspace, defaultRequiresApproval)
-                ruleSet.rows,
+          : workspace,
-                ownerRankForRow,
+      );
-                defaultRequiresApproval,
+    };
-              ),
-            );
     // ------------------------------------------------------------------
     // Tools (read surface)
     ): Effect.Effect<EffectivePolicy, StorageFailure> =>
       Effect.gen(function* () {
         const parsed = parseToolAddress(String(address));
-        const policyRows = yield* core.findMany("tool_policy", {});
+        const policyRules = yield* listActivePolicyRuleSet();
         const toolId = parsed
           ? `${parsed.integration}.${parsed.owner}.${parsed.connection}.${parsed.tool}`
           : String(address);
             requiresApproval = annotations?.requiresApproval;
           }
         }
-        return resolveEffectivePolicy(toolId, policyRows, ownerRankForRow, requiresApproval);
+        return yield* resolvePolicyFromRuleSet(toolId, policyRules, requiresApproval);
       });
     // ------------------------------------------------------------------
         afterCommit: (effect: Effect.Effect<void>) => afterCommit(effect),
       };
-      if (plugin.toolPolicyProvider) {
+      if (plugin.toolProjections) {
-        const rawProvider = plugin.toolPolicyProvider(ctx);
+        if (toolProjectionSource) {
-        const provider = Effect.isEffect(rawProvider) ? yield* rawProvider : rawProvider;
+          return yield* new StorageError({
-        if (provider) {
+            message: "Only one plugin can provide tool projections.",
-          if (activeToolPolicyProvider) {
+            cause: undefined,
-            return yield* new StorageError({
+          });
-              message: "Only one plugin can provide the active tool policy source.",
-              cause: undefined,
-            });
-          }
-          activeToolPolicyProvider = provider;
         }
+        toolProjectionSource = plugin.toolProjections(ctx);
       }
       // Build extension FIRST so it's available as `self` for staticIntegrations.
       },
       pendingApprovals,
       execute,
+      project,
       close,
     };

packages/core/sdk/src/index.ts+12−2

   type PolicySource,
 } from "./policies";
+// Tool projections — a narrowed view over the catalog, layered on policies.
+export {
+  fullToolProjection,
+  isVisibleInProjection,
+  mostRestrictivePolicy,
+  resolveProjectedPolicy,
+  resolveProjectionRule,
+  type ToolProjection,
+  type ToolProjectionRule,
+} from "./tool-projection";
 // Artifacts — saved generative-UI components.
 export {
   rowToArtifact,
   type AnyPlugin,
   type StorageDeps,
   type OwnerBinding,
-  type ToolPolicyProvider,
+  type ToolProjectionSource,
-  type ToolPolicyProviderRule,
   type IntegrationRecord,
   type StaticIntegrationDecl,
   type StaticToolDecl,

packages/core/sdk/src/plugin.ts+18−43

 import type { PluginStorageConfig, PluginStorageFacade } from "./plugin-storage";
 import type {
   CreateToolPolicyInput,
-  EffectivePolicy,
   RemoveToolPolicyInput,
   ToolPolicy,
   UpdateToolPolicyInput,
 } from "./policies";
 import type { Tool, ToolAnnotations, ToolDef } from "./tool";
+import type { ToolProjection } from "./tool-projection";
 // ---------------------------------------------------------------------------
 // OwnerBinding — replaces v1's scope stack. The (tenant, subject?) the executor
 ) => Effect.Effect<ElicitationResponse, ElicitationDeclinedError>;
 // ---------------------------------------------------------------------------
-// Active tool-policy provider.
+// Tool projection sources.
 //
-// Normal executors resolve policies from core's owner-scoped `tool_policy`
+// A projection is a narrowed view over the executor's catalog (see
-// table. A plugin may opt one executor instance into a different rule source
+// `./tool-projection`). Core resolves a projection by name at the start of
-// (for example, a toolkit-specific policy set). Core still owns enforcement;
+// each operation and applies it ON TOP of the workspace's `tool_policy` rows:
-// the plugin owns where those policy-shaped rows are stored.
+// the projection can hide tools and tighten actions, never loosen them. A
+// plugin that stores named projections (the toolkits plugin) registers a
+// source; core owns the enforcement.
 // ---------------------------------------------------------------------------
-export interface ToolPolicyProviderRule {
+export interface ToolProjectionSource {
-  readonly id: string;
-  readonly pattern: string;
-  readonly action: ToolPolicy["action"];
-  readonly position: string;
-}
-export interface ToolPolicyProvider {
-  readonly list: () => Effect.Effect<readonly ToolPolicyProviderRule[], StorageFailure>;
-  readonly resolve?: (input: {
-    readonly toolId: string;
-    readonly defaultRequiresApproval?: boolean;
-  }) => Effect.Effect<EffectivePolicy, StorageFailure>;
   /**
-   * Batched per-operation resolver. When defined, core calls `prepare` once at
+   * Resolve a named projection. `null` means the name is unknown to this
-   * the start of an operation (a single tools/list or tools/call), fetching all
+   * source; core then blocks every tool for that projection (an unknown
-   * the underlying policy + connection state in one pass, and reuses the
+   * toolkit exposes nothing, rather than everything).
-   * returned pure resolver for every tool in that operation. This avoids the
-   * per-tool `resolve` N+1 (2 uncached storage reads per tool) that scales with
-   * the total catalog size on `toolsList`.
-   *
-   * The resolver is intentionally per-operation scoped, not memoized on the
-   * provider: the provider instance is session-scoped (lives across many
-   * requests), so caching on it would serve stale policy state. Each operation
-   * gets a fresh snapshot.
    */
-  readonly prepare?: () => Effect.Effect<
+  readonly resolve: (name: string) => Effect.Effect<ToolProjection | null, StorageFailure>;
-    (input: {
-      readonly toolId: string;
-      readonly defaultRequiresApproval?: boolean;
-    }) => EffectivePolicy,
-    StorageFailure
-  >;
 }
 // ---------------------------------------------------------------------------
   /** Service tag the plugin's `handlers` layer requires. */
   readonly extensionService?: TExtensionService;
-  /** Optional active policy source for this executor instance. At most one
+  /** Optional source of named tool projections (see `./tool-projection`).
-   *  loaded plugin may return a provider. When absent, core uses the normal
+   *  At most one loaded plugin may register a source. Core consults it when
-   *  owner-scoped tool policies. */
+   *  the executor is asked to serve a named projection; the workspace's own
-  readonly toolPolicyProvider?: (
+   *  tool policies always apply underneath. */
-    ctx: PluginCtx<TStore>,
+  readonly toolProjections?: (ctx: PluginCtx<TStore>) => ToolProjectionSource;
-  ) => ToolPolicyProvider | null | Effect.Effect<ToolPolicyProvider | null, StorageFailure>;
   /** Produce a connection's tools (and shared $defs). The v2 successor to
    *  registering per-source tools — called by the executor at connection

packages/core/sdk/src/policies.test.ts+115−16

@@ -618,7 +618,7 @@ describe("blocked tools", () => { · 617 unmodified lines
618	);	618	);
619	});	619	});
620		620
621	describe("active tool-policy provider", () => {	621	describe("tool projections", () => {
622	const staticPlugin = definePlugin(() => ({	622	const staticPlugin = definePlugin(() => ({
623	id: "toolkit-fixture" as const,	623	id: "toolkit-fixture" as const,
624	storage: () => ({}),	624	storage: () => ({}),
@@ -649,27 +649,35 @@ describe("active tool-policy provider", () => { · 24 unmodified lines
649	],	649	],
650	}))();	650	}))();
651		651
652	const policyProviderPlugin = definePlugin(() => ({	652	const projectionSourcePlugin = definePlugin(() => ({
653	id: "toolkit-policy-provider" as const,	653	id: "toolkit-projection-source" as const,
654	storage: () => ({}),	654	storage: () => ({}),
655	toolPolicyProvider: () => ({	655	toolProjections: () => ({
656	list: () =>	656	resolve: (name: string) =>
657	Effect.succeed([	657	Effect.succeed(
658	{	658	name === "allowed-only"
659	id: "allow-static",	659	? {
660	pattern: "toolkit-fixture.ctl.allowed",	660	visible: ["toolkit-fixture.ctl.allowed"],
661	action: "approve" as const,	661	rules: [
662	position: "a0",	662	{
663	},	663	id: "allow-static",
664	]),	664	pattern: "toolkit-fixture.ctl.allowed",
		665	action: "approve" as const,
		666	position: "a0",
		667	},
		668	],
		669	}
		670	: null,
		671	),
665	}),	672	}),
666	}))();	673	}))();
667		674
668	it.effect("uses provider rules as an allowlist for list, schema, and execute", () =>	675	it.effect("a projected view is an allowlist for list, schema, and execute", () =>
669	Effect.gen(function* () {	676	Effect.gen(function* () {
670	const executor = yield* makeTestExecutor({	677	const parent = yield* makeTestExecutor({
671	plugins: [staticPlugin, policyProviderPlugin] as const,	678	plugins: [staticPlugin, projectionSourcePlugin] as const,
672	});	679	});
		680	const executor = yield* parent.project("allowed-only");
673		681
674	const tools = yield* executor.tools.list();	682	const tools = yield* executor.tools.list();
675	expect(tools.map((t) => String(t.address)).sort()).toEqual(["toolkit-fixture.ctl.allowed"]);	683	expect(tools.map((t) => String(t.address)).sort()).toEqual(["toolkit-fixture.ctl.allowed"]);
@@ -693,6 +701,97 @@ describe("active tool-policy provider", () => { · 17 unmodified lines
693	expect(Result.isFailure(blocked)).toBe(true);	701	expect(Result.isFailure(blocked)).toBe(true);
694	if (!Result.isFailure(blocked)) return;	702	if (!Result.isFailure(blocked)) return;
695	expect(Predicate.isTagged("ToolBlockedError")(blocked.failure)).toBe(true);	703	expect(Predicate.isTagged("ToolBlockedError")(blocked.failure)).toBe(true);
		704
		705	// The parent view is untouched.
		706	const parentTools = yield* parent.tools.list();
		707	expect(parentTools.map((t) => String(t.address)).sort()).toEqual([
		708	"toolkit-fixture.ctl.allowed",
		709	"toolkit-fixture.ctl.hidden",
		710	]);
		711	}),
		712	);
		713
		714	it.effect("an unknown projection name exposes nothing", () =>
		715	Effect.gen(function* () {
		716	const parent = yield* makeTestExecutor({
		717	plugins: [staticPlugin, projectionSourcePlugin] as const,
		718	});
		719	const executor = yield* parent.project("no-such-toolkit");
		720	expect(yield* executor.tools.list()).toEqual([]);
		721	const blocked = yield* Effect.result(
		722	executor.execute(ToolAddress.make("toolkit-fixture.ctl.allowed"), {}),
		723	);
		724	expect(Result.isFailure(blocked)).toBe(true);
		725	}),
		726	);
		727
		728	it.effect("a projection cannot loosen a workspace policy", () =>
		729	Effect.gen(function* () {
		730	const parent = yield* makeTestExecutor({
		731	plugins: [staticPlugin, projectionSourcePlugin] as const,
		732	});
		733	// The workspace blocks the tool the projection would approve.
		734	yield* parent.policies.create({
		735	owner: "org",
		736	pattern: "toolkit-fixture.ctl.allowed",
		737	action: "block",
		738	});
		739	const executor = yield* parent.project("allowed-only");
		740	expect(yield* executor.tools.list()).toEqual([]);
		741	const blocked = yield* Effect.result(
		742	executor.execute(ToolAddress.make("toolkit-fixture.ctl.allowed"), {}),
		743	);
		744	expect(Result.isFailure(blocked)).toBe(true);
		745	if (!Result.isFailure(blocked)) return;
		746	expect(Predicate.isTagged("ToolBlockedError")(blocked.failure)).toBe(true);
		747	}),
		748	);
		749
		750	it.effect("a workspace require_approval still gates a projection-approved tool", () =>
		751	Effect.gen(function* () {
		752	const parent = yield* makeTestExecutor({
		753	plugins: [staticPlugin, projectionSourcePlugin] as const,
		754	});
		755	yield* parent.policies.create({
		756	owner: "org",
		757	pattern: "toolkit-fixture.ctl.allowed",
		758	action: "require_approval",
		759	});
		760	const executor = yield* parent.project("allowed-only");
		761	const resolved = yield* executor.policies.resolve(
		762	ToolAddress.make("toolkit-fixture.ctl.allowed"),
		763	);
		764	expect(resolved.action).toBe("require_approval");
		765	const calls = { count: 0 };
		766	yield* executor.execute(
		767	ToolAddress.make("toolkit-fixture.ctl.allowed"),
		768	{},
		769	{ onElicitation: recordingHandler(calls) },
		770	);
		771	expect(calls.count).toBe(1);
		772	}),
		773	);
		774
		775	it.effect("an inline projection narrows to one integration or one tool", () =>
		776	Effect.gen(function* () {
		777	const parent = yield* makeTestExecutor({
		778	plugins: [staticPlugin] as const,
		779	});
		780	const byIntegration = yield* parent.project({
		781	visible: ["toolkit-fixture.ctl.*"],
		782	rules: [],
		783	});
		784	expect((yield* byIntegration.tools.list()).map((t) => String(t.address)).sort()).toEqual([
		785	"toolkit-fixture.ctl.allowed",
		786	"toolkit-fixture.ctl.hidden",
		787	]);
		788	const single = yield* parent.project({
		789	visible: ["toolkit-fixture.ctl.hidden"],
		790	rules: [],
		791	});
		792	expect((yield* single.tools.list()).map((t) => String(t.address))).toEqual([
		793	"toolkit-fixture.ctl.hidden",
		794	]);
696	}),	795	}),
697	);	796	);
698	});	797	});

packages/core/sdk/src/tool-projection.ts+145−0

@@ -0,0 +1,145 @@
	1	// ---------------------------------------------------------------------------
	2	// Tool projections — a narrowed view over one executor's catalog.
	3	//
	4	// The default MCP endpoint serves the whole catalog under the workspace's
	5	// policies. A projection serves a SUBSET of that catalog (a toolkit, a set of
	6	// integrations, one tool) through the SAME executor, the same policies, and
	7	// the same enforcement. It is a filter plus an optional policy overlay, never
	8	// a different rule source: a projection can only narrow what the workspace
	9	// already allows.
	10	//
	11	// Resolution for one tool id:
	12	// 1. If no `visible` pattern matches, the tool is blocked (outside the
	13	// projection's capability boundary).
	14	// 2. Otherwise the projection's own `rules` resolve to an action (or fall
	15	// through to the plugin default), and that action is combined with the
	16	// workspace policy under least privilege: block > require_approval >
	17	// approve.
	18	//
	19	// Pure functions; the executor stitches them into `tools.list`, `tools.schema`,
	20	// `execute`, `connections.list`, and `integrations.list`.
	21	// ---------------------------------------------------------------------------
	22
	23	import { Match } from "effect";
	24
	25	import type { ToolPolicyAction } from "./core-schema";
	26	import { matchPattern, type EffectivePolicy } from "./policies";
	27
	28	/** One ordered rule in a projection overlay. Same grammar as tool policies. */
	29	export interface ToolProjectionRule {
	30	readonly id: string;
	31	readonly pattern: string;
	32	readonly action: ToolPolicyAction;
	33	/** Fractional-indexing key. Lower lex order = higher precedence. */
	34	readonly position: string;
	35	}
	36
	37	/** The resolved shape of a projection, as core consumes it. */
	38	export interface ToolProjection {
	39	/**
	40	* Patterns naming the tools this projection exposes. A tool outside every
	41	* pattern is blocked. An empty list exposes nothing.
	42	*/
	43	readonly visible: readonly string[];
	44	/** Ordered overlay rules resolved on top of the workspace policy. */
	45	readonly rules: readonly ToolProjectionRule[];
	46	/**
	47	* When true, tools owned by the acting member (`<integration>.user.…`) are
	48	* blocked even if a `visible` pattern names them. An org-owned toolkit must
	49	* not leak a member's personal connections to whoever holds its URL.
	50	*/
	51	readonly excludePersonal?: boolean;
	52	}
	53
	54	/** The projection that exposes every tool under the workspace policy alone. */
	55	export const fullToolProjection: ToolProjection = { visible: ["*"], rules: [] };
	56
	57	const isPersonalToolId = (toolId: string): boolean => toolId.split(".")[1] === "user";
	58
	59	const blockedOutsideProjection: EffectivePolicy = {
	60	action: "block",
	61	source: "user",
	62	pattern: "*",
	63	};
	64
	65	const compareRule = (a: ToolProjectionRule, b: ToolProjectionRule): number => {
	66	if (a.position < b.position) return -1;
	67	if (a.position > b.position) return 1;
	68	return a.id < b.id ? -1 : a.id > b.id ? 1 : 0;
	69	};
	70
	71	const actionRank = (action: ToolPolicyAction): number =>
	72	Match.value(action).pipe(
	73	Match.when("block", () => 3),
	74	Match.when("require_approval", () => 2),
	75	Match.when("approve", () => 1),
	76	Match.exhaustive,
	77	);
	78
	79	/**
	80	* Combine the workspace's answer with the projection's under least privilege.
	81	*
	82	* Only user-authored rules are guardrails. When BOTH sides carry one, the more
	83	* restrictive action wins (ties keep the workspace's rule, so the outer
	84	* guardrail stays attributable). When only ONE side carries a rule, that rule
	85	* decides: a plugin's default `requiresApproval` is a default, not a policy,
	86	* so an explicit toolkit "approve" may still lift it, exactly as an explicit
	87	* workspace "approve" does. When neither side has a rule both fall through to
	88	* the same plugin default.
	89	*/
	90	export const mostRestrictivePolicy = (
	91	workspace: EffectivePolicy,
	92	overlay: EffectivePolicy,
	93	): EffectivePolicy => {
	94	const workspaceExplicit = workspace.source === "user";
	95	const overlayExplicit = overlay.source === "user";
	96	if (workspaceExplicit && overlayExplicit) {
	97	return actionRank(overlay.action) > actionRank(workspace.action) ? overlay : workspace;
	98	}
	99	if (overlayExplicit) return overlay;
	100	return workspace;
	101	};
	102
	103	/** Whether `toolId` falls inside the projection's capability boundary. */
	104	export const isVisibleInProjection = (projection: ToolProjection, toolId: string): boolean => {
	105	if (projection.excludePersonal && isPersonalToolId(toolId)) return false;
	106	return projection.visible.some((pattern) => matchPattern(pattern, toolId));
	107	};
	108
	109	/**
	110	* Resolve the projection's OWN answer for a tool: its first matching overlay
	111	* rule, else the plugin default. Does not consult the workspace policy; see
	112	* {@link resolveProjectedPolicy} for the combined answer.
	113	*/
	114	export const resolveProjectionRule = (
	115	projection: ToolProjection,
	116	toolId: string,
	117	defaultRequiresApproval?: boolean,
	118	): EffectivePolicy => {
	119	for (const rule of [...projection.rules].sort(compareRule)) {
	120	if (!matchPattern(rule.pattern, toolId)) continue;
	121	return { action: rule.action, source: "user", pattern: rule.pattern, policyId: rule.id };
	122	}
	123	return defaultRequiresApproval
	124	? { action: "require_approval", source: "plugin-default" }
	125	: { action: "approve", source: "plugin-default" };
	126	};
	127
	128	/**
	129	* The effective policy for `toolId` as seen through `projection`, given the
	130	* workspace's own answer for that tool. Outside the projection the tool is
	131	* blocked; inside it the projection's rule and the workspace's rule combine
	132	* under least privilege.
	133	*/
	134	export const resolveProjectedPolicy = (
	135	projection: ToolProjection,
	136	toolId: string,
	137	workspace: EffectivePolicy,
	138	defaultRequiresApproval?: boolean,
	139	): EffectivePolicy => {
	140	if (!isVisibleInProjection(projection, toolId)) return blockedOutsideProjection;
	141	return mostRestrictivePolicy(
	142	workspace,
	143	resolveProjectionRule(projection, toolId, defaultRequiresApproval),
	144	);
	145	};

packages/hosts/mcp/src/envelope.ts+27−7

   McpAuthProvider,
   McpErrorReporter,
   McpSessionStore,
+  mcpResourceFromPathname,
   type AuthOutcome,
   type McpDispatchResult,
   type McpResource,
 // Routes:
 //   GET <provider-declared discovery paths>  -> McpAuthProvider metadata
 //   *   /mcp                                  -> authenticate -> dispatch(default)
-//   *   /mcp/toolkits/:toolkitSlug            -> authenticate -> dispatch(toolkit)
+//   *   /mcp/toolkits/:slug                   -> authenticate -> dispatch(toolkit)
+//   *   /mcp/integrations/:slugs              -> authenticate -> dispatch(integrations)
+//   *   /mcp/tools/:toolId                    -> authenticate -> dispatch(tool)
+//
+// The sub-resource grammar is owned by `mcpResourceFromPathname` in ./seams;
+// the envelope registers the routes and parses the matched path with it.
 //
 // The provider DECLARES the discovery paths it owns (at least the protected-
 // resource metadata document) via `McpAuthProvider.discoveryRoutes`; the
 // ---------------------------------------------------------------------------
 const MCP_PATH = "/mcp";
-const TOOLKIT_MCP_PATH = "/mcp/toolkits/:toolkitSlug";
+const SCOPED_MCP_PATHS = [
+  "/mcp/toolkits/:slug",
+  "/mcp/integrations/:slugs",
+  "/mcp/tools/:toolId",
+] as const;
 /** The methods the streamable-HTTP transport accepts on `/mcp`. */
 const ALLOWED_MCP_METHODS = new Set(["GET", "POST", "DELETE", "OPTIONS"]);
     ),
   );
-const toolkitMcpRoute = Effect.gen(function* () {
+// A scoped route re-parses the matched pathname through the shared grammar
-  const params = yield* HttpRouter.params;
+// rather than reading route params, so the envelope and every host agree on
-  const slug = params.toolkitSlug;
+// exactly one definition of what `/mcp/<kind>/<value>` means.
-  return yield* mcpRoute(slug ? { kind: "toolkit", slug } : defaultMcpResource);
+const scopedMcpRoute = Effect.gen(function* () {
+  const request = yield* HttpServerRequest.HttpServerRequest;
+  // `request.url` is path-only under some adapters and absolute under others;
+  // the base makes both parse and is otherwise discarded.
+  const resource = mcpResourceFromPathname(new URL(request.url, "http://localhost").pathname);
+  if (resource === null) {
+    return fromWebResponse(jsonRpcResponse(404, -32001, "MCP resource not found"));
+  }
+  return yield* mcpRoute(resource);
 });
 /**
       );
     }
     yield* router.add("*", MCP_PATH, mcpRoute(defaultMcpResource));
-    yield* router.add("*", TOOLKIT_MCP_PATH, toolkitMcpRoute);
+    for (const path of SCOPED_MCP_PATHS) {
+      yield* router.add("*", path, scopedMcpRoute);
+    }
   }),
 );

packages/hosts/mcp/src/index.ts+3−0

   McpErrorReporter,
   McpErrorReporterNoop,
   defaultMcpResource,
+  mcpResourceFromPathname,
+  mcpResourceFromSegments,
   mcpResourceKey,
+  mcpResourcePath,
   principalOwns,
   orgWriteAccessForPrincipal,
   withOrgWriteAccess,

packages/hosts/mcp/src/resource-key.test.ts+79−9

@@ -1,17 +1,24 @@
1	// ---------------------------------------------------------------------------	1	// ---------------------------------------------------------------------------
2	// `mcpResourceKey` must never throw on a missing resource.	2	// The shared MCP resource grammar: one parser and one path builder every host
		3	// routes through, plus the session key that keeps a reused `mcp-session-id`
		4	// from crossing between resources.
3	//	5	//
4	// Sessions persisted before scoped toolkits added the `resource` field	6	// `mcpResourceKey` must never throw on a missing resource. Sessions persisted
5	// deserialize with `resource: undefined`. Owner validation keys the stored	7	// before scoped resources added the `resource` field deserialize with
6	// session's resource against the request's, so an unguarded `resource.kind`	8	// `resource: undefined`; owner validation keys the stored session's resource
7	// read there threw `TypeError: Cannot read properties of undefined (reading	9	// against the request's, so an unguarded `resource.kind` read there threw on
8	// 'kind')` on every reconnect to a legacy session. A missing resource is a	10	// every reconnect to a legacy session. A missing resource is a default `/mcp`
9	// default `/mcp` session, so it must key to "default".	11	// session, so it must key to "default".
10	// ---------------------------------------------------------------------------	12	// ---------------------------------------------------------------------------
11		13
12	import { describe, expect, it } from "@effect/vitest";	14	import { describe, expect, it } from "@effect/vitest";
13		15
14	import { defaultMcpResource, mcpResourceKey } from "./index";	16	import {
		17	defaultMcpResource,
		18	mcpResourceFromPathname,
		19	mcpResourceKey,
		20	mcpResourcePath,
		21	} from "./index";
15		22
16	describe("mcpResourceKey", () => {	23	describe("mcpResourceKey", () => {
17	it('keys the default resource to "default"', () => {	24	it('keys the default resource to "default"', () => {
@@ -19,8 +26,14 @@ describe("mcpResourceKey", () => { · 1 unmodified line
19	expect(mcpResourceKey({ kind: "default" })).toBe("default");	26	expect(mcpResourceKey({ kind: "default" })).toBe("default");
20	});	27	});
21		28
22	it('keys a toolkit resource to "toolkit:<slug>"', () => {	29	it("keys each scoped resource distinctly", () => {
23	expect(mcpResourceKey({ kind: "toolkit", slug: "github" })).toBe("toolkit:github");	30	expect(mcpResourceKey({ kind: "toolkit", slug: "github" })).toBe("toolkit:github");
		31	expect(mcpResourceKey({ kind: "integrations", slugs: ["github", "linear"] })).toBe(
		32	"integrations:github,linear",
		33	);
		34	expect(mcpResourceKey({ kind: "tool", toolId: "github.repos.list" })).toBe(
		35	"tool:github.repos.list",
		36	);
24	});	37	});
25		38
26	it("treats a missing resource (legacy session meta) as the default key", () => {	39	it("treats a missing resource (legacy session meta) as the default key", () => {
@@ -34,3 +47,60 @@ describe("mcpResourceKey", () => { · 7 unmodified lines
34	expect(mcpResourceKey(undefined)).toBe(mcpResourceKey(defaultMcpResource));	47	expect(mcpResourceKey(undefined)).toBe(mcpResourceKey(defaultMcpResource));
35	});	48	});
36	});	49	});
		50
		51	describe("mcpResourceFromPathname", () => {
		52	it("parses the default endpoint, with or without a trailing slash", () => {
		53	expect(mcpResourceFromPathname("/mcp")).toEqual({ kind: "default" });
		54	expect(mcpResourceFromPathname("/mcp/")).toEqual({ kind: "default" });
		55	});
		56
		57	it("parses each scoped sub-resource", () => {
		58	expect(mcpResourceFromPathname("/mcp/toolkits/deploy")).toEqual({
		59	kind: "toolkit",
		60	slug: "deploy",
		61	});
		62	expect(mcpResourceFromPathname("/mcp/integrations/github,linear")).toEqual({
		63	kind: "integrations",
		64	slugs: ["github", "linear"],
		65	});
		66	expect(mcpResourceFromPathname("/mcp/tools/github.org.main.repos.list")).toEqual({
		67	kind: "tool",
		68	toolId: "github.org.main.repos.list",
		69	});
		70	});
		71
		72	it("decodes a percent-encoded value", () => {
		73	expect(mcpResourceFromPathname("/mcp/tools/github.org.main.repos%2Elist")).toEqual({
		74	kind: "tool",
		75	toolId: "github.org.main.repos.list",
		76	});
		77	});
		78
		79	it("rejects anything outside the grammar", () => {
		80	expect(mcpResourceFromPathname("/")).toBeNull();
		81	expect(mcpResourceFromPathname("/mcp-consent")).toBeNull();
		82	expect(mcpResourceFromPathname("/mcp/toolkits")).toBeNull();
		83	expect(mcpResourceFromPathname("/mcp/toolkits/a/b")).toBeNull();
		84	expect(mcpResourceFromPathname("/mcp/unknown/x")).toBeNull();
		85	expect(mcpResourceFromPathname("/mcp/integrations/,")).toBeNull();
		86	expect(mcpResourceFromPathname("/mcp/tools/%E0%A4%A")).toBeNull();
		87	expect(mcpResourceFromPathname("/api/auth/mcp/authorize")).toBeNull();
		88	});
		89	});
		90
		91	describe("mcpResourcePath", () => {
		92	it("is the inverse of the parser", () => {
		93	for (const path of [
		94	"/mcp",
		95	"/mcp/toolkits/deploy",
		96	"/mcp/integrations/github,linear",
		97	"/mcp/tools/github.org.main.repos.list",
		98	]) {
		99	expect(mcpResourcePath(mcpResourceFromPathname(path)!)).toBe(path);
		100	}
		101	});
		102
		103	it("encodes values that are not path-safe", () => {
		104	expect(mcpResourcePath({ kind: "toolkit", slug: "a b" })).toBe("/mcp/toolkits/a%20b");
		105	});
		106	});

packages/hosts/mcp/src/seams.ts+86−11

@@ -94,25 +94,100 @@ export const principalOwns = (owner: Principal, principal: Principal): boolean = · 93 unmodified lines
94	// ---------------------------------------------------------------------------	94	// ---------------------------------------------------------------------------
95	// Shared MCP resource identity.	95	// Shared MCP resource identity.
96	//	96	//
97	// The default `/mcp` endpoint and named sub-resources such as	97	// Every MCP endpoint is ONE executor seen through a projection. The default
98	// `/mcp/toolkits/<slug>` share auth and transport machinery, but a serving	98	// `/mcp` serves the whole catalog; the named sub-resources serve a subset of
99	// session belongs to the exact resource path that minted it. This keeps a	99	// it through the same auth, transport, session store, and policy engine:
100	// leaked/reused `mcp-session-id` from crossing from one exposed capability set	100	//
101	// into another.	101	// /mcp -> default (all tools)
		102	// /mcp/toolkits/<slug> -> toolkit (a saved toolkit)
		103	// /mcp/integrations/<a>[,<b>...] -> integrations (every tool of those
		104	// integrations)
		105	// /mcp/tools/<integration>.<tool> -> tool (one tool id)
		106	//
		107	// A serving session belongs to the exact resource that minted it, so a
		108	// leaked/reused `mcp-session-id` cannot cross from one exposed capability set
		109	// into another. Both the path grammar and the session key live HERE, once,
		110	// so no host re-derives them.
102	// ---------------------------------------------------------------------------	111	// ---------------------------------------------------------------------------
103		112
104	export type McpResource =	113	export type McpResource =
105	\| { readonly kind: "default" }	114	\| { readonly kind: "default" }
106	\| { readonly kind: "toolkit"; readonly slug: string };	115	\| { readonly kind: "toolkit"; readonly slug: string }
		116	\| { readonly kind: "integrations"; readonly slugs: readonly string[] }
		117	\| { readonly kind: "tool"; readonly toolId: string };
107		118
108	export const defaultMcpResource: McpResource = { kind: "default" };	119	export const defaultMcpResource: McpResource = { kind: "default" };
109		120
110	// Tolerates a missing resource (null/undefined): sessions persisted before	121	// Tolerates a missing resource (null/undefined): sessions persisted before
111	// scoped toolkits existed have no `resource` field, and every such session was	122	// scoped resources existed have no `resource` field, and every such session
112	// minted against the default `/mcp` endpoint, so a missing resource keys to	123	// was minted against the default `/mcp` endpoint, so a missing resource keys
113	// "default". Keeping this guard here means no caller can throw on legacy data.	124	// to "default". Keeping this guard here means no caller can throw on legacy
114	export const mcpResourceKey = (resource: McpResource \| null \| undefined): string =>	125	// data. Sessions persisted with `kind: "toolkit"` keep their old key.
115	resource && resource.kind !== "default" ? `toolkit:${resource.slug}` : "default";	126	export const mcpResourceKey = (resource: McpResource \| null \| undefined): string => {
		127	if (!resource \|\| resource.kind === "default") return "default";
		128	if (resource.kind === "toolkit") return `toolkit:${resource.slug}`;
		129	if (resource.kind === "integrations") return `integrations:${resource.slugs.join(",")}`;
		130	return `tool:${resource.toolId}`;
		131	};
		132
		133	const MCP_SEGMENT = "mcp";
		134	const TOOLKITS_SEGMENT = "toolkits";
		135	const INTEGRATIONS_SEGMENT = "integrations";
		136	const TOOLS_SEGMENT = "tools";
		137
		138	const nonEmpty = (segment: string \| undefined): segment is string =>
		139	segment !== undefined && segment.length > 0;
		140
		141	const decodeSegment = (segment: string): string \| null => {
		142	// oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: decodeURIComponent throws on a malformed escape; a bad segment is simply not a resource
		143	try {
		144	return decodeURIComponent(segment);
		145	} catch {
		146	return null;
		147	}
		148	};
		149
		150	/**
		151	* Parse the path segments AFTER any host prefix (org selector, discovery
		152	* prefix) into the resource they name, or `null` when they are not an MCP
		153	* resource path. `["mcp"]` is the default; `["mcp","toolkits","x"]` a toolkit;
		154	* and so on. Trailing empty segments are tolerated (`/mcp/`).
		155	*/
		156	export const mcpResourceFromSegments = (segments: readonly string[]): McpResource \| null => {
		157	const parts = segments.filter(nonEmpty);
		158	if (parts[0] !== MCP_SEGMENT) return null;
		159	if (parts.length === 1) return defaultMcpResource;
		160	if (parts.length !== 3) return null;
		161	const value = decodeSegment(parts[2]!);
		162	if (value === null \|\| value.length === 0) return null;
		163	if (parts[1] === TOOLKITS_SEGMENT) return { kind: "toolkit", slug: value };
		164	if (parts[1] === INTEGRATIONS_SEGMENT) {
		165	const slugs = value.split(",").filter((slug) => slug.length > 0);
		166	return slugs.length > 0 ? { kind: "integrations", slugs } : null;
		167	}
		168	if (parts[1] === TOOLS_SEGMENT) return { kind: "tool", toolId: value };
		169	return null;
		170	};
		171
		172	/** Parse a bare pathname (`/mcp`, `/mcp/toolkits/<slug>`, …). */
		173	export const mcpResourceFromPathname = (pathname: string): McpResource \| null =>
		174	mcpResourceFromSegments(pathname.split("/"));
		175
		176	/**
		177	* The bare pathname that names `resource`: the inverse of
		178	* {@link mcpResourceFromPathname}. Hosts prefix it with their org selector or
		179	* discovery prefix; they never assemble the segments themselves.
		180	*/
		181	export const mcpResourcePath = (resource: McpResource): string => {
		182	if (resource.kind === "default") return `/${MCP_SEGMENT}`;
		183	if (resource.kind === "toolkit") {
		184	return `/${MCP_SEGMENT}/${TOOLKITS_SEGMENT}/${encodeURIComponent(resource.slug)}`;
		185	}
		186	if (resource.kind === "integrations") {
		187	return `/${MCP_SEGMENT}/${INTEGRATIONS_SEGMENT}/${resource.slugs.map(encodeURIComponent).join(",")}`;
		188	}
		189	return `/${MCP_SEGMENT}/${TOOLS_SEGMENT}/${encodeURIComponent(resource.toolId)}`;
		190	};
116		191
117	// ---------------------------------------------------------------------------	192	// ---------------------------------------------------------------------------
118	// AuthOutcome — the result of `McpAuthProvider.authenticate`.	193	// AuthOutcome — the result of `McpAuthProvider.authenticate`.

packages/plugins/toolkits/src/server.test.ts+89−35

 import { describe, expect, it } from "@effect/vitest";
 import { Effect, Predicate, Result } from "effect";
+import { resolveProjectedPolicy, ToolAddress } from "@executor-js/sdk/core";
 import { makeTestExecutor } from "@executor-js/sdk/testing";
 import { toolkitsPlugin } from "./server";
       yield* executor.toolkits.updatePolicy(toolkit.id, first.id, {
         action: "require_approval",
       });
-      const rules = yield* executor.toolkits.policyRulesForSlug("deploy-kit");
+      const projection = yield* executor.toolkits.projectionForSlug("deploy-kit");
-      expect(rules.find((rule) => rule.id === first.id)?.action).toBe("require_approval");
+      expect(projection?.rules.find((rule) => rule.id === first.id)?.action).toBe(
+        "require_approval",
+      );
       const connections = yield* executor.toolkits.listConnections(toolkit.id);
       expect(connections.map((row) => row.pattern)).toEqual(["github.org.main.*"]);
     }),
   );
-  it.effect("resolves toolkit policies with implicit deny and workspace owner limits", () =>
+  it.effect("projects toolkit policies with implicit deny and workspace owner limits", () =>
     Effect.gen(function* () {
       const executor = yield* makeTestExecutor({
         plugins: [toolkitsPlugin()] as const,
       });
+      // The workspace has no rule for these tools, so its answer is the plugin
+      // default — the same one the projection falls through to.
+      const resolve = (slug: string, toolId: string, defaultRequiresApproval?: boolean) =>
+        executor.toolkits
+          .projectionForSlug(slug)
+          .pipe(
+            Effect.map((projection) =>
+              resolveProjectedPolicy(
+                projection ?? { visible: [], rules: [] },
+                toolId,
+                defaultRequiresApproval
+                  ? { action: "require_approval", source: "plugin-default" }
+                  : { action: "approve", source: "plugin-default" },
+                defaultRequiresApproval,
+              ),
+            ),
+          );
       const workspace = yield* executor.toolkits.create({
         owner: "org",
         pattern: "github.org.main.*",
       });
-      const workspaceTool = yield* executor.toolkits.resolvePolicyForSlug(
+      const workspaceTool = yield* resolve(workspace.slug, "github.org.main.repos.list");
-        workspace.slug,
-        "github.org.main.repos.list",
-      );
       expect(workspaceTool.action).toBe("approve");
       expect(workspaceTool.source).toBe("plugin-default");
-      const defaultApprovalTool = yield* executor.toolkits.resolvePolicyForSlug(
+      const defaultApprovalTool = yield* resolve(
         workspace.slug,
         "github.org.main.repos.delete",
         true,
         pattern: "github.org.main.repos.delete",
         action: "approve",
       });
-      const explicitTool = yield* executor.toolkits.resolvePolicyForSlug(
+      const explicitTool = yield* resolve(workspace.slug, "github.org.main.repos.delete", true);
-        workspace.slug,
-        "github.org.main.repos.delete",
-        true,
-      );
       expect(explicitTool.action).toBe("approve");
       expect(explicitTool.source).toBe("user");
-      const personalTool = yield* executor.toolkits.resolvePolicyForSlug(
+      const personalTool = yield* resolve(workspace.slug, "github.user.main.repos.list");
-        workspace.slug,
-        "github.user.main.repos.list",
-      );
       expect(personalTool.action).toBe("block");
-      const missingTool = yield* executor.toolkits.resolvePolicyForSlug(
+      const missingTool = yield* resolve(workspace.slug, "slack.org.main.chat.post");
-        workspace.slug,
-        "slack.org.main.chat.post",
-      );
       expect(missingTool.action).toBe("block");
+      const unknownToolkit = yield* resolve("no-such-kit", "github.org.main.repos.list");
+      expect(unknownToolkit.action).toBe("block");
       const personal = yield* executor.toolkits.create({
         owner: "user",
         name: "Personal Kit",
       yield* executor.toolkits.createConnection(personal.id, {
         pattern: "github.user.main.*",
       });
-      const personalToolkitTool = yield* executor.toolkits.resolvePolicyForSlug(
+      const personalToolkitTool = yield* resolve(personal.slug, "github.user.main.repos.list");
-        personal.slug,
-        "github.user.main.repos.list",
-      );
       expect(personalToolkitTool.action).toBe("approve");
     }),
   );
+  it.effect("a projected executor keeps the workspace policy underneath the toolkit", () =>
+    Effect.gen(function* () {
+      const executor = yield* makeTestExecutor({
+        plugins: [toolkitsPlugin()] as const,
+        coreTools: { webBaseUrl: "https://executor.test" },
+      });
+      const toolkit = yield* executor.toolkits.create({ owner: "org", name: "Core Kit" });
+      yield* executor.toolkits.createConnection(toolkit.id, {
+        pattern: "executor.coreTools.*",
+      });
+      yield* executor.toolkits.createPolicy(toolkit.id, {
+        pattern: "executor.coreTools.policies.create",
+        action: "approve",
+      });
+      // The workspace gates the same tool. A toolkit "approve" must not undo it.
+      yield* executor.policies.create({
+        owner: "org",
+        pattern: "executor.coreTools.policies.create",
+        action: "require_approval",
+      });
+      const projected = yield* executor.project(toolkit.slug);
+      const gated = yield* projected.policies.resolve(
+        ToolAddress.make("executor.coreTools.policies.create"),
+      );
+      expect(gated.action).toBe("require_approval");
+      // Outside the toolkit's connections the tool is blocked, even though the
+      // workspace itself would allow it.
+      const outside = yield* projected.policies.resolve(
+        ToolAddress.make("executor.coreTools.integrations.list"),
+      );
+      expect(outside.action).toBe("approve");
+      const hidden = yield* projected.tools.list();
+      expect(hidden.every((tool) => String(tool.address).startsWith("executor.coreTools."))).toBe(
+        true,
+      );
+      // The parent view is untouched by the projection.
+      const parent = yield* executor.policies.resolve(
+        ToolAddress.make("executor.coreTools.policies.create"),
+      );
+      expect(parent.action).toBe("require_approval");
+    }),
+  );
   it.effect("treats a persisted connection-root approve as an access policy", () =>
     Effect.gen(function* () {
       const executor = yield* makeTestExecutor({
         action: "approve",
       });
-      const result = yield* executor.toolkits.resolvePolicyForSlug(
+      const projection = yield* executor.toolkits.projectionForSlug(toolkit.slug);
-        toolkit.slug,
+      const result = resolveProjectedPolicy(
+        projection!,
         "executor.coreTools.connections.remove",
+        { action: "approve", source: "plugin-default" },
         true,
       );
       expect(result.action).toBe("approve");
       expect(result.source).toBe("user");
-      const rules = yield* executor.toolkits.policyRulesForSlug(toolkit.slug);
       expect(
-        rules.map((rule) => `${rule.pattern} ${rule.action}`),
+        projection!.rules.map((rule) => `${rule.pattern} ${rule.action}`),
         "policy listing agrees with toolkit enforcement",
       ).toContain("executor.coreTools.* approve");
     }),
         action: "approve",
       });
-      const result = yield* executor.toolkits.resolvePolicyForSlug(
+      const projection = yield* executor.toolkits.projectionForSlug(toolkit.slug);
-        toolkit.slug,
+      const result = resolveProjectedPolicy(
+        projection!,
         "google_docs.org.main.documents.update",
+        { action: "approve", source: "plugin-default" },
         true,
       );
       expect(result.action).toBe("approve");
       expect(result.source).toBe("user");
-      const rules = yield* executor.toolkits.policyRulesForSlug(toolkit.slug);
       expect(
-        rules.map((rule) => `${rule.pattern} ${rule.action}`),
+        projection!.rules.map((rule) => `${rule.pattern} ${rule.action}`),
         "policy listing agrees with toolkit enforcement",
       ).toContain("google_docs.org.* approve");
     }),

packages/plugins/toolkits/src/server.ts+60−141

@@ -7,15 +7,14 @@ import { · 6 unmodified lines
7	isValidPattern,	7	isValidPattern,
8	matchPattern,	8	matchPattern,
9	Schema,	9	Schema,
10	type EffectivePolicy,
11	type Owner,	10	type Owner,
12	type PluginCtx,	11	type PluginCtx,
13	type PluginStorageFacade,	12	type PluginStorageFacade,
14	type PluginStorageCollectionFacade,	13	type PluginStorageCollectionFacade,
15	type StorageFailure,	14	type StorageFailure,
16	type ToolPolicyAction,	15	type ToolPolicyAction,
17	type ToolPolicyProvider,	16	type ToolProjection,
18	type ToolPolicyProviderRule,	17	type ToolProjectionSource,
19	} from "@executor-js/sdk/core";	18	} from "@executor-js/sdk/core";
20	import { addGroup, capture } from "@executor-js/api";	19	import { addGroup, capture } from "@executor-js/api";
21	import { generateKeyBetween } from "fractional-indexing";	20	import { generateKeyBetween } from "fractional-indexing";
@@ -78,11 +77,6 @@ type ToolkitStorage = { · 56 unmodified lines
78	readonly connections: PluginStorageCollectionFacade<typeof toolkitConnectionsCollection>;	77	readonly connections: PluginStorageCollectionFacade<typeof toolkitConnectionsCollection>;
79	};	78	};
80		79
81	export interface ToolkitsPluginOptions {
82	/** When set, this executor instance enforces only the named toolkit's rules. */
83	readonly activeToolkitSlug?: string;
84	}
85
86	const newId = (prefix: string): string =>	80	const newId = (prefix: string): string =>
87	`${prefix}_${Math.random().toString(36).slice(2)}${Date.now().toString(36)}`;	81	`${prefix}_${Math.random().toString(36).slice(2)}${Date.now().toString(36)}`;
88		82
@@ -133,48 +127,40 @@ const comparePositioned = ( · 44 unmodified lines
133	return a.id < b.id ? -1 : a.id > b.id ? 1 : 0;	127	return a.id < b.id ? -1 : a.id > b.id ? 1 : 0;
134	};	128	};
135		129
136	const blockedPolicy = (pattern = "*"): EffectivePolicy => ({
137	action: "block",
138	source: "user",
139	pattern,
140	});
141
142	const pluginDefaultPolicy = (defaultRequiresApproval: boolean \| undefined): EffectivePolicy =>
143	defaultRequiresApproval
144	? { action: "require_approval", source: "plugin-default" }
145	: { action: "approve", source: "plugin-default" };
146
147	const isLegacyConnectionPolicy = (policy: ToolkitPolicyRecord): boolean => {	130	const isLegacyConnectionPolicy = (policy: ToolkitPolicyRecord): boolean => {
148	if (policy.action !== "approve") return false;	131	if (policy.action !== "approve") return false;
149	const parts = policy.pattern.split(".");	132	const parts = policy.pattern.split(".");
150	return parts.at(-1) === "*" && (parts.length === 3 \|\| parts.length === 4);	133	return parts.at(-1) === "*" && (parts.length === 3 \|\| parts.length === 4);
151	};	134	};
152		135
153	const resolveToolkitPolicy = (	136	// A toolkit as core consumes it: the connections (plus any legacy
154	toolId: string,	137	// connection-shaped approve rows) name what is VISIBLE, the remaining policies
		138	// are the overlay core layers on top of the workspace's own rules. An
		139	// org-owned toolkit never exposes a member's personal connections, whoever
		140	// holds its URL.
		141	const toolkitProjection = (
		142	owner: Owner,
155	connections: readonly ToolkitConnectionRecord[],	143	connections: readonly ToolkitConnectionRecord[],
156	policies: readonly ToolkitPolicyRecord[],	144	policies: readonly ToolkitPolicyRecord[],
157	defaultRequiresApproval?: boolean,	145	): ToolProjection => {
158	): EffectivePolicy => {
159	const legacyPolicyIds = legacyConnectionPolicyIds(policies, connections);	146	const legacyPolicyIds = legacyConnectionPolicyIds(policies, connections);
160	const connected =	147	return {
161	connections.some((connection) => matchPattern(connection.pattern, toolId)) \|\|	148	visible: [
162	policies.some(	149	...connections.map((connection) => connection.pattern),
163	(policy) => legacyPolicyIds.has(policy.id) && matchPattern(policy.pattern, toolId),	150	...policies
164	);	151	.filter((policy) => legacyPolicyIds.has(policy.id))
165	if (!connected) return blockedPolicy();	152	.map((policy) => policy.pattern),
166		153	],
167	for (const policy of [...policies].sort(comparePositioned)) {	154	rules: policies
168	if (legacyPolicyIds.has(policy.id)) continue;	155	.filter((policy) => !legacyPolicyIds.has(policy.id))
169	if (!matchPattern(policy.pattern, toolId)) continue;	156	.map((policy) => ({
170	return {	157	id: policy.id,
171	action: policy.action,	158	pattern: policy.pattern,
172	source: "user",	159	action: policy.action,
173	pattern: policy.pattern,	160	position: policy.position,
174	policyId: policy.id,	161	})),
175	};	162	excludePersonal: owner === "org",
176	}	163	};
177	return pluginDefaultPolicy(defaultRequiresApproval);
178	};	164	};
179		165
180	const legacyConnectionPolicyIds = (	166	const legacyConnectionPolicyIds = (
@@ -192,8 +178,6 @@ const legacyConnectionPolicyIds = ( · 11 unmodified lines
192	);	178	);
193	};	179	};
194		180
195	const isPersonalDynamicToolId = (toolId: string): boolean => toolId.split(".")[1] === "user";
196
197	const toolkitToResponse = (entry: { readonly owner: Owner; readonly data: ToolkitRecord }) => ({	181	const toolkitToResponse = (entry: { readonly owner: Owner; readonly data: ToolkitRecord }) => ({
198	id: entry.data.id,	182	id: entry.data.id,
199	owner: entry.owner,	183	owner: entry.owner,
@@ -477,69 +461,19 @@ const makeToolkitsExtension = (ctx: PluginCtx<ToolkitStorage>) => { · 277 unmodified lines
477	yield* storage.connections.remove({ owner: toolkit.owner, key: connectionId });	461	yield* storage.connections.remove({ owner: toolkit.owner, key: connectionId });
478	});	462	});
479		463
480	const policyRulesForSlug = (	464	/**
481	slug: string,	465	* The toolkit named by `slug` as a projection core can serve, or `null` when
482	): Effect.Effect<readonly ToolPolicyProviderRule[], StorageFailure> =>	466	* no such toolkit is visible to this owner binding. Three reads — the
483	Effect.gen(function* () {	467	* toolkit, its policies, its connections — once per operation; core resolves
484	const toolkit = yield* getBySlugEntry(slug);	468	* every tool in that operation against the returned snapshot.
485	if (!toolkit) return [];	469	*/
486	const policies = yield* listPoliciesForRecord(toolkit.data.id);	470	const projectionForSlug = (slug: string): Effect.Effect<ToolProjection \| null, StorageFailure> =>
487	const connections = yield* listConnectionsForRecord(toolkit.data.id);
488	const legacyPolicyIds = legacyConnectionPolicyIds(policies, connections);
489	return policies
490	.filter((policy) => !legacyPolicyIds.has(policy.id))
491	.map((policy) => ({
492	id: policy.id,
493	pattern: policy.pattern,
494	action: policy.action,
495	position: policy.position,
496	}));
497	});
498
499	const resolvePolicyForSlug = (
500	slug: string,
501	toolId: string,
502	defaultRequiresApproval?: boolean,
503	): Effect.Effect<EffectivePolicy, StorageFailure> =>
504	Effect.gen(function* () {	471	Effect.gen(function* () {
505	const toolkit = yield* getBySlugEntry(slug);	472	const toolkit = yield* getBySlugEntry(slug);
506	if (!toolkit) return blockedPolicy();	473	if (!toolkit) return null;
507	if (toolkit.owner === "org" && isPersonalDynamicToolId(toolId)) return blockedPolicy();
508	const policies = yield* listPoliciesForRecord(toolkit.data.id);	474	const policies = yield* listPoliciesForRecord(toolkit.data.id);
509	const connections = yield* listConnectionsForRecord(toolkit.data.id);	475	const connections = yield* listConnectionsForRecord(toolkit.data.id);
510	return resolveToolkitPolicy(toolId, connections, policies, defaultRequiresApproval);	476	return toolkitProjection(toolkit.owner, connections, policies);
511	});
512
513	// Batched form of `resolvePolicyForSlug`: fetch the toolkit, its policies, and
514	// its connections ONCE, then hand back a pure resolver core can run for every
515	// tool in a single tools/list or tools/call. `resolvePolicyForSlug` re-fetches
516	// policies + connections on every tool, which is the per-tool N+1 that scales
517	// with the whole catalog on the list surface. This is byte-for-byte the same
518	// resolution, just hoisted out of the loop.
519	const preparePolicyResolverForSlug = (
520	slug: string,
521	): Effect.Effect<
522	(input: {
523	readonly toolId: string;
524	readonly defaultRequiresApproval?: boolean;
525	}) => EffectivePolicy,
526	StorageFailure
527	> =>
528	Effect.gen(function* () {
529	const toolkit = yield* getBySlugEntry(slug);
530	if (!toolkit) return () => blockedPolicy();
531	const isOrg = toolkit.owner === "org";
532	const policies = yield* listPoliciesForRecord(toolkit.data.id);
533	const connections = yield* listConnectionsForRecord(toolkit.data.id);
534	return (input: { readonly toolId: string; readonly defaultRequiresApproval?: boolean }) => {
535	if (isOrg && isPersonalDynamicToolId(input.toolId)) return blockedPolicy();
536	return resolveToolkitPolicy(
537	input.toolId,
538	connections,
539	policies,
540	input.defaultRequiresApproval,
541	);
542	};
543	});	477	});
544		478
545	return {	479	return {
@@ -558,9 +492,7 @@ const makeToolkitsExtension = (ctx: PluginCtx<ToolkitStorage>) => { · 12 unmodified lines
558	),	492	),
559	createConnection,	493	createConnection,
560	removeConnection,	494	removeConnection,
561	policyRulesForSlug,	495	projectionForSlug,
562	resolvePolicyForSlug,
563	preparePolicyResolverForSlug,
564	};	496	};
565	};	497	};
566		498
@@ -671,43 +603,30 @@ const ToolkitsHandlers = HttpApiBuilder.group(ExecutorApiWithToolkits, "toolkits · 104 unmodified lines
671	),	603	),
672	);	604	);
673		605
674	const makePolicyProvider = (	606	const makeProjectionSource = (
675	extension: Pick<	607	extension: Pick<ToolkitsExtension, "projectionForSlug">,
676	ToolkitsExtension,	608	): ToolProjectionSource => ({
677	"policyRulesForSlug" \| "resolvePolicyForSlug" \| "preparePolicyResolverForSlug"	609	resolve: (name) => extension.projectionForSlug(name),
678	>,
679	slug: string,
680	): ToolPolicyProvider => ({
681	list: () => extension.policyRulesForSlug(slug),
682	resolve: ({ toolId, defaultRequiresApproval }) =>
683	extension.resolvePolicyForSlug(slug, toolId, defaultRequiresApproval),
684	// Preferred path: core calls this once per operation, so the toolkit's
685	// policies + connections are fetched once instead of once per tool.
686	prepare: () => extension.preparePolicyResolverForSlug(slug),
687	});	610	});
688		611
689	export const toolkitsPlugin = definePlugin((options: ToolkitsPluginOptions = {}) => {	612	export const toolkitsPlugin = definePlugin(() => ({
690	const activeToolkitSlug = options.activeToolkitSlug;	613	id: "toolkits" as const,
691	return {	614	packageName: "@executor-js/plugin-toolkits",
692	id: "toolkits" as const,	615	pluginStorage: {
693	packageName: "@executor-js/plugin-toolkits",	616	toolkits: toolkitsCollection,
694	pluginStorage: {	617	toolkitPolicies: toolkitPoliciesCollection,
695	toolkits: toolkitsCollection,	618	toolkitConnections: toolkitConnectionsCollection,
696	toolkitPolicies: toolkitPoliciesCollection,	619	},
697	toolkitConnections: toolkitConnectionsCollection,	620	storage: ({ pluginStorage }) => makeToolkitStorage(pluginStorage),
698	},	621	extension: makeToolkitsExtension,
699	storage: ({ pluginStorage }) => makeToolkitStorage(pluginStorage),	622	routes: () => ToolkitsApi,
700	extension: makeToolkitsExtension,	623	handlers: () => ToolkitsHandlers,
701	routes: () => ToolkitsApi,	624	extensionService: ToolkitsExtensionService,
702	handlers: () => ToolkitsHandlers,	625	// Every executor built with this plugin can serve any toolkit by slug
703	extensionService: ToolkitsExtensionService,	626	// (`executor.project(slug)`); the projection is a read over this plugin's
704	...(activeToolkitSlug	627	// storage, not a different executor.
705	? {	628	toolProjections: (ctx: PluginCtx<ToolkitStorage>) =>
706	toolPolicyProvider: (ctx: PluginCtx<ToolkitStorage>) =>	629	makeProjectionSource(makeToolkitsExtension(ctx)),
707	makePolicyProvider(makeToolkitsExtension(ctx), activeToolkitSlug),	630	}));
708	}
709	: {}),
710	};
711	});
712		631
713	export default toolkitsPlugin;	632	export default toolkitsPlugin;