feat(otel): instrument tool dispatch, plugins, storage, schema, transport

Closes the holistic OTEL coverage gap so every executor request can be attributed to a named subsystem in Axiom. Verified end-to-end against a deployed Vercel API call: the previously-unspanned 817ms host-side gap now resolves into named child spans (tool.resolve, resolve_annotations, storage.find_one × N by table, plugin.openapi.secret.resolve, etc). Spans added across five subsystems: - Tool dispatch (sdk/executor.ts, execution/engine.ts, tool-invoker.ts): executor.tool.{invoke,resolve,resolve_annotations,enforce_approval, handler,schema,schema.load_defs}, executor.tools.{list,list.annotations}, plus dispatch-path / source / plugin attributes. Built-in search / describe / list-sources branches now also produce mcp.tool.dispatch envelopes for trace-shape parity with plugin tool calls. - Plugin invocation (plugins/{openapi,graphql,mcp}/sdk): plugin.openapi.{invoke,secret.resolve}, plugin.graphql.{invoke,secret.resolve}, plugin.mcp.{invoke,connection.acquire,connection.handshake,client.call_tool, invoke.retry}. Existing OpenApi.* / GraphQL.* spans retained; new plugin.* spans wrap them so secret-hydration vs HTTP time is visible. - Storage layer (storage-core/factory.ts, storage-drizzle/adapter.ts): Two-layer instrumentation. executor.storage.* on the factory abstraction and executor.storage.backend.* on the drizzle implementation. Gap between them surfaces transform overhead vs SQL/driver cost. Per-op attributes carry table, row count, and transaction strategy. - Schema generation (execution/description.ts, sdk/schema-types.ts): Renamed buildExecuteDescription span to schema.describe.execute. Added schema.compile.{description,preview} so cold-startup and describe-tool latency split into source-listing vs DB-fetch vs TS-rendering. - MCP transport / host (cloud/mcp-session.ts, hosts/mcp/server.ts, plugins/mcp/sdk/plugin.ts): mcp.session.{load_meta,save_meta, cleanup,resolve_and_store_meta,request_scoped_runtime,...}, mcp.host.{create_executor_server,create_server,register_tool, sync_tool_availability,tool.execute,tool.resume}, mcp.plugin.{invoke_tool,load_binding,load_source_config, resolve_connector,discover_tools,probe_endpoint,probe_oauth, add_source,remove_source,refresh_source,update_source,...}. Also rich attributes (method, content-type, content-length, response status) added to the existing transport.handleRequest span. Naming convention: subsystem-prefixed dot-namespaced spans — mcp.* / executor.* / executor.tool.* / executor.sources.* / executor.storage.* / plugin.{openapi,graphql,mcp}.* / vault.* / schema.*. No behavior changes; instrumentation only.

Rhys Sullivan committed 6 months ago

Commit e6a65371 parent db5367714 files · +764 −237Browse files

Unified · Split

14 files

apps/cloud/src/mcp-session.ts +56 −11
packages/core/execution/src/description.ts +13 −2
packages/core/execution/src/engine.ts +19 −3
packages/core/execution/src/tool-invoker.ts +14 −2
packages/core/sdk/src/executor.ts +91 −31
packages/core/sdk/src/schema-types.ts +8 −5
packages/core/storage-core/src/factory.ts +82 −14
packages/core/storage-drizzle/src/adapter.ts +70 −10
packages/hosts/mcp/src/server.ts +81 −40
packages/plugins/graphql/src/sdk/invoke.ts +38 −4
packages/plugins/mcp/src/sdk/connection.ts +5 −1
packages/plugins/mcp/src/sdk/invoke.ts +40 −6
packages/plugins/mcp/src/sdk/plugin.ts +210 −103
packages/plugins/openapi/src/sdk/invoke.ts +37 −5

apps/cloud/src/mcp-session.ts+56−11

     return this.sessionMeta;
   }
+  private loadSessionMetaEffect(): Effect.Effect<SessionMeta | null> {
+    return Effect.promise(() => this.loadSessionMeta()).pipe(
+      Effect.withSpan("mcp.session.load_meta"),
+    );
+  }
   private async saveSessionMeta(sessionMeta: SessionMeta): Promise<void> {
     this.sessionMeta = sessionMeta;
     await this.ctx.storage.put(SESSION_META_KEY, sessionMeta);
     ]);
   }
+  private clearSessionStateEffect(): Effect.Effect<void> {
+    return Effect.promise(() => this.clearSessionState()).pipe(
+      Effect.withSpan("mcp.session.clear_state"),
+    );
+  }
   private createConnectedRuntimeEffect(
     sessionMeta: SessionMeta,
     options: { readonly dbHandle: DbHandle; readonly enableJsonResponse?: boolean },
         const sessionMeta = yield* resolveSessionMeta(token.organizationId).pipe(
           Effect.provide(makeResolveOrganizationServices(dbHandle)),
         );
-        yield* Effect.promise(() => self.saveSessionMeta(sessionMeta));
+        yield* Effect.promise(() => self.saveSessionMeta(sessionMeta)).pipe(
+          Effect.withSpan("mcp.session.save_meta"),
+        );
         return sessionMeta;
       } finally {
         yield* Effect.promise(() => dbHandle.end());
       }
-    });
+    }).pipe(Effect.withSpan("mcp.session.resolve_and_store_meta"));
   }
   async init(token: McpSessionInit, incoming?: IncomingTraceHeaders): Promise<void> {
   private handleRequestWithRequestScopedRuntimeEffect(request: Request) {
     const self = this;
     return Effect.gen(function* () {
-      const sessionMeta = yield* Effect.promise(() => self.loadSessionMeta());
+      const sessionMeta = yield* self.loadSessionMetaEffect();
       if (!sessionMeta) {
         return jsonRpcError(404, -32001, "Session timed out due to inactivity — please reconnect");
       }
       self.lastActivityMs = Date.now();
       const dbHandle = makeRequestScopedDb();
-      const cleanupDb = Effect.promise(() => dbHandle.end());
+      const cleanupDb = Effect.promise(() => dbHandle.end()).pipe(
+        Effect.withSpan("mcp.session.db.close"),
+      );
       return yield* Effect.acquireUseRelease(
         self.createConnectedRuntimeEffect(sessionMeta, {
           dbHandle,
         ({ transport }) =>
           Effect.gen(function* () {
             const response = yield* Effect.promise(() => transport.handleRequest(request)).pipe(
-              Effect.withSpan("McpSessionDO.transport.handleRequest"),
+              Effect.withSpan("McpSessionDO.transport.handleRequest", {
+                attributes: {
+                  "mcp.request.method": request.method,
+                  "mcp.request.content_type":
+                    request.headers.get("content-type") ?? "",
+                  "mcp.request.content_length":
+                    request.headers.get("content-length") ?? "",
+                },
+              }),
             );
+            yield* Effect.annotateCurrentSpan({
+              "mcp.response.status_code": response.status,
+            });
             if (request.method === "DELETE") {
-              yield* Effect.promise(() => self.clearSessionState());
+              yield* self.clearSessionStateEffect();
             }
             return response;
           }),
         ({ mcpServer, transport }) =>
           Effect.gen(function* () {
-            yield* Effect.promise(() => transport.close().catch(() => undefined));
+            yield* Effect.promise(() => transport.close().catch(() => undefined)).pipe(
-            yield* Effect.promise(() => mcpServer.close().catch(() => undefined));
+              Effect.withSpan("mcp.session.transport.close"),
+            );
+            yield* Effect.promise(() => mcpServer.close().catch(() => undefined)).pipe(
+              Effect.withSpan("mcp.session.server.close"),
+            );
             yield* cleanupDb;
-          }),
+          }).pipe(Effect.withSpan("mcp.session.runtime.release")),
       );
     }).pipe(
+      Effect.withSpan("mcp.session.request_scoped_runtime"),
       Effect.catchAllCause((cause) =>
         Effect.sync(() => {
           console.error("[mcp-session] request-scoped handleRequest error:", cause);
     const self = this;
     return Effect.gen(function* () {
       const response = yield* Effect.promise(() => transport.handleRequest(request)).pipe(
-        Effect.withSpan("McpSessionDO.transport.handleRequest"),
+        Effect.withSpan("McpSessionDO.transport.handleRequest", {
+          attributes: {
+            "mcp.request.method": request.method,
+            "mcp.request.content_type":
+              request.headers.get("content-type") ?? "",
+            "mcp.request.content_length":
+              request.headers.get("content-length") ?? "",
+          },
+        }),
       );
+      yield* Effect.annotateCurrentSpan({
+        "mcp.response.status_code": response.status,
+      });
       if (request.method === "DELETE") {
-        yield* Effect.promise(() => self.cleanup());
+        yield* Effect.promise(() => self.cleanup()).pipe(
+          Effect.withSpan("mcp.session.cleanup"),
+        );
       }
       return response;
     }).pipe(

packages/core/execution/src/description.ts+13−2

@@ -14,8 +14,19 @@ export const buildExecuteDescription = (executor: Executor): Effect.Effect<strin · 13 unmodified lines
14	.list()	14	.list()
15	.pipe(Effect.orDie, Effect.withSpan("executor.sources.list"));	15	.pipe(Effect.orDie, Effect.withSpan("executor.sources.list"));
16		16
17	return formatDescription(sources);	17	const description = yield* Effect.sync(() => formatDescription(sources)).pipe(
18	}).pipe(Effect.withSpan("buildExecuteDescription"));	18	Effect.withSpan("schema.compile.description", {
		19	attributes: { "executor.source_count": sources.length },
		20	}),
		21	);
		22
		23	yield* Effect.annotateCurrentSpan({
		24	"executor.source_count": sources.length,
		25	"schema.kind": "execute",
		26	});
		27
		28	return description;
		29	}).pipe(Effect.withSpan("schema.describe.execute"));
19		30
20	const formatDescription = (sources: readonly Source[]): string => {	31	const formatDescription = (sources: readonly Source[]): string => {
21	const lines: string[] = [	32	const lines: string[] = [

packages/core/execution/src/engine.ts+19−3

         return searchTools(executor, args.query ?? "", limit, {
           namespace: args.namespace,
-        });
+        }).pipe(
+          Effect.withSpan("mcp.tool.dispatch", {
+            attributes: { "mcp.tool.name": path, "executor.tool.builtin": true },
+          }),
+        );
       }
       if (path === "executor.sources.list") {
         if (args !== undefined && !isRecord(args)) {
         return listExecutorSources(executor, {
           query: isRecord(args) && typeof args.query === "string" ? args.query : undefined,
           limit,
-        });
+        }).pipe(
+          Effect.withSpan("mcp.tool.dispatch", {
+            attributes: { "mcp.tool.name": path, "executor.tool.builtin": true },
+          }),
+        );
       }
       if (path === "describe.tool") {
         if (!isRecord(args)) {
           );
         }
-        return describeTool(executor, args.path);
+        return describeTool(executor, args.path).pipe(
+          Effect.withSpan("mcp.tool.dispatch", {
+            attributes: {
+              "mcp.tool.name": path,
+              "executor.tool.builtin": true,
+              "executor.tool.target_path": args.path,
+            },
+          }),
+        );
       }
       return base.invoke({ path, args });
     },

packages/core/execution/src/tool-invoker.ts+14−2

   }
   const all = yield* executor.tools.list().pipe(Effect.orDie);
-  return all
+  const results = all
     .filter((tool: Tool) => matchesNamespace(tool, options?.namespace))
     .map((tool: Tool) => scoreToolMatch(tool, query))
     .filter((tool): tool is ToolDiscoveryResult => tool !== null)
     .sort((left, right) => right.score - left.score || left.path.localeCompare(right.path))
     .slice(0, limit);
+  yield* Effect.annotateCurrentSpan({
+    "executor.search.candidate_count": all.length,
+    "executor.search.result_count": results.length,
+  });
+  return results;
 });
 /** What `tools.executor.sources.list()` calls inside the sandbox. */
       }) satisfies ExecutorSourceListItem,
   );
-  return withCounts
+  const results = withCounts
     .sort((left, right) => left.name.localeCompare(right.name) || left.id.localeCompare(right.id))
     .slice(0, limit);
+  yield* Effect.annotateCurrentSpan({
+    "executor.sources.candidate_count": sources.length,
+    "executor.sources.result_count": results.length,
+  });
+  return results;
 });
 /** What `tools.describe.tool()` calls inside the sandbox. */

packages/core/sdk/src/executor.ts+91−31

         for (const { source, pluginId } of staticSources.values()) {
           staticList.push(staticDeclToSource(source, pluginId));
         }
-        return [...staticList, ...dynamic.map(rowToSource)];
+        const merged = [...staticList, ...dynamic.map(rowToSource)];
-      });
+        yield* Effect.annotateCurrentSpan({
+          "executor.sources.static_count": staticList.length,
+          "executor.sources.dynamic_count": dynamic.length,
+        });
+        return merged;
+      }).pipe(Effect.withSpan("executor.sources.list"));
     // Bulk-resolve annotations across a set of dynamic tool rows by
     // grouping them under their owning plugin's resolveAnnotations
     const listTools = (filter?: ToolListFilter) =>
       Effect.gen(function* () {
         const dynamic = yield* core.findMany({ model: "tool" });
-        const annotations = yield* resolveAnnotationsFor(dynamic);
+        const annotations = yield* resolveAnnotationsFor(dynamic).pipe(
+          Effect.withSpan("executor.tools.list.annotations"),
+        );
         const out: Tool[] = [];
         // Static tools — annotations from the declaration, not a resolver.
         for (const row of dynamic) {
           out.push(rowToTool(row, annotations.get(row.id)));
         }
-        if (!filter) return out;
+        const result = filter ? out.filter((t) => toolMatchesFilter(t, filter)) : out;
-        return out.filter((t) => toolMatchesFilter(t, filter));
+        yield* Effect.annotateCurrentSpan({
-      });
+          "executor.tools.static_count": staticTools.size,
+          "executor.tools.dynamic_count": dynamic.length,
+          "executor.tools.result_count": result.length,
+        });
+        return result;
+      }).pipe(Effect.withSpan("executor.tools.list"));
     // Load all definitions for a single source as a plain map.
     const loadDefinitionsForSource = (sourceId: string) =>
     }) =>
       Effect.gen(function* () {
         const defs: Record<string, unknown> = opts.sourceId
-          ? yield* loadDefinitionsForSource(opts.sourceId)
+          ? yield* loadDefinitionsForSource(opts.sourceId).pipe(
+              Effect.withSpan("executor.tool.schema.load_defs"),
+            )
           : {};
         const attachDefs = (schema: unknown): unknown => {
         const outputSchema = attachDefs(opts.rawOutput);
         const defsMap = new Map<string, unknown>(Object.entries(defs));
-        const preview = buildToolTypeScriptPreview({
+        const preview = yield* Effect.sync(() =>
-          inputSchema,
+          buildToolTypeScriptPreview({ inputSchema, outputSchema, defs: defsMap }),
-          outputSchema,
+        ).pipe(
-          defs: defsMap,
+          Effect.withSpan("schema.compile.preview", {
-        });
+            attributes: {
+              "schema.kind": "tool.preview",
+              "schema.has_input": inputSchema !== undefined,
+              "schema.has_output": outputSchema !== undefined,
+              "schema.def_count": defsMap.size,
+            },
+          }),
+        );
         return new ToolSchema({
           id: ToolId.make(opts.toolId),
         // no `$defs` attach; just wrap the declared schemas.
         const staticEntry = staticTools.get(toolId);
         if (staticEntry) {
+          yield* Effect.annotateCurrentSpan({
+            "executor.tool.dispatch_path": "static",
+            "executor.source_id": staticEntry.source.id,
+            "executor.source_kind": staticEntry.source.kind,
+          });
           return yield* buildToolSchemaView({
             toolId,
             name: staticEntry.tool.name,
             rawOutput: staticEntry.tool.outputSchema,
           });
         }
-        const row = yield* core.findOne({
+        const row = yield* core
-          model: "tool",
+          .findOne({
-          where: [{ field: "id", value: toolId }],
+            model: "tool",
-        });
+            where: [{ field: "id", value: toolId }],
+          })
+          .pipe(Effect.withSpan("executor.tool.resolve"));
         if (!row) return null;
+        yield* Effect.annotateCurrentSpan({
+          "executor.tool.dispatch_path": "dynamic",
+          "executor.source_id": row.source_id,
+          "executor.plugin_id": row.plugin_id,
+        });
         return yield* buildToolSchemaView({
           toolId,
           name: row.name,
           rawInput: decodeJsonColumn(row.input_schema),
           rawOutput: decodeJsonColumn(row.output_schema),
         });
-      });
+      }).pipe(
+        Effect.withSpan("executor.tool.schema", {
+          attributes: { "mcp.tool.name": toolId },
+        }),
+      );
     // Bulk definitions accessor — every source's $defs, grouped by
     // source id. One query against the definition table, plus an
         // Static path — O(1) map lookup, no DB hit.
         const staticEntry = staticTools.get(toolId);
         if (staticEntry) {
+          yield* Effect.annotateCurrentSpan({
+            "executor.tool.dispatch_path": "static",
+            "executor.source_id": staticEntry.source.id,
+            "executor.source_kind": staticEntry.source.kind,
+            "executor.plugin_id": staticEntry.pluginId,
+          });
           yield* enforceApproval(
             staticEntry.tool.annotations,
             toolId,
             args,
             options,
-          );
+          ).pipe(Effect.withSpan("executor.tool.enforce_approval"));
           return yield* wrapInvocationError(
             staticEntry.tool.handler({
               ctx: staticEntry.ctx,
               args,
               elicit: buildElicit(toolId, args, options),
             }),
-          );
+          ).pipe(Effect.withSpan("executor.tool.handler"));
         }
         // Dynamic path — DB lookup + delegate to owning plugin.
-        const row = yield* core.findOne({
+        const row = yield* core
-          model: "tool",
+          .findOne({
-          where: [{ field: "id", value: toolId }],
+            model: "tool",
-        });
+            where: [{ field: "id", value: toolId }],
+          })
+          .pipe(Effect.withSpan("executor.tool.resolve"));
         if (!row) {
           return yield* new ToolNotFoundError({
             toolId: ToolId.make(toolId),
           });
         }
+        yield* Effect.annotateCurrentSpan({
+          "executor.tool.dispatch_path": "dynamic",
+          "executor.source_id": row.source_id,
+          "executor.plugin_id": row.plugin_id,
+        });
         const runtime = runtimes.get(row.plugin_id);
         if (!runtime) {
           return yield* new PluginNotLoadedError({
         // around a single storage read.
         let annotations: ToolAnnotations | undefined;
         if (runtime.plugin.resolveAnnotations) {
-          const map = yield* runtime.plugin.resolveAnnotations({
+          const map = yield* runtime.plugin
-            ctx: runtime.ctx,
+            .resolveAnnotations({
-            sourceId: row.source_id,
+              ctx: runtime.ctx,
-            toolRows: [row],
+              sourceId: row.source_id,
-          });
+              toolRows: [row],
+            })
+            .pipe(Effect.withSpan("executor.tool.resolve_annotations"));
           annotations = map[toolId];
         }
-        yield* enforceApproval(annotations, toolId, args, options);
+        yield* enforceApproval(annotations, toolId, args, options).pipe(
+          Effect.withSpan("executor.tool.enforce_approval"),
+        );
         return yield* wrapInvocationError(
           runtime.plugin.invokeTool({
             args,
             elicit: buildElicit(toolId, args, options),
           }),
-        );
+        ).pipe(Effect.withSpan("executor.tool.handler"));
-      });
+      }).pipe(
+        Effect.withSpan("executor.tool.invoke", {
+          attributes: {
+            "mcp.tool.name": toolId,
+          },
+        }),
+      );
     const removeSource = (sourceId: string) =>
       Effect.gen(function* () {

packages/core/sdk/src/schema-types.ts+8−5

   };
 };
+export type ToolTypeScriptPreview = {
+  inputTypeScript?: string;
+  outputTypeScript?: string;
+  typeScriptDefinitions?: Record<string, string>;
+};
 export const buildToolTypeScriptPreview = (input: {
   inputSchema?: unknown;
   outputSchema?: unknown;
   defs: ReadonlyMap<string, unknown>;
   options?: TypeScriptRenderOptions;
-}): {
+}): ToolTypeScriptPreview => {
-  inputTypeScript?: string;
-  outputTypeScript?: string;
-  typeScriptDefinitions?: Record<string, string>;
-} => {
   const inputPreview =
     input.inputSchema !== undefined
       ? schemaToTypeScriptPreviewWithDefs(input.inputSchema, input.defs, input.options)
       : {}),
   };
 };

packages/core/storage-core/src/factory.ts+82−14

           data.select,
         );
         return out as unknown as R;
-      }),
+      }).pipe(
+        Effect.withSpan("executor.storage.create", {
+          attributes: {
+            "executor.storage.adapter_id": config.adapterId,
+            "executor.storage.table": data.model,
+          },
+        }),
+      ),
     createMany: <T extends Record<string, unknown>, R = T>(data: {
       model: string;
           );
         }
         return out as unknown as readonly R[];
-      }),
+      }).pipe(
+        Effect.withSpan("executor.storage.create_many", {
+          attributes: {
+            "executor.storage.adapter_id": config.adapterId,
+            "executor.storage.table": data.model,
+            "executor.storage.row_count": data.data.length,
+          },
+        }),
+      ),
     findOne: <T>(data: {
       model: string;
         const out = yield* maybeTransformOutput(data.model, res, data.select);
         const merged = yield* attachJoinedRows(out, res, data.join);
         return merged as unknown as T | null;
-      }),
+      }).pipe(
+        Effect.withSpan("executor.storage.find_one", {
+          attributes: {
+            "executor.storage.adapter_id": config.adapterId,
+            "executor.storage.table": data.model,
+          },
+        }),
+      ),
     findMany: <T>(data: {
       model: string;
           out.push(merged);
         }
         return out as readonly T[];
-      }),
+      }).pipe(
+        Effect.withSpan("executor.storage.find_many", {
+          attributes: {
+            "executor.storage.adapter_id": config.adapterId,
+            "executor.storage.table": data.model,
+          },
+        }),
+      ),
     count: (data: { model: string; where?: Where[] | undefined }) =>
       Effect.gen(function* () {
           model: getModelName(data.model),
           where,
         });
-      }),
+      }).pipe(
+        Effect.withSpan("executor.storage.count", {
+          attributes: {
+            "executor.storage.adapter_id": config.adapterId,
+            "executor.storage.table": data.model,
+          },
+        }),
+      ),
     update: <T>(data: {
       model: string;
         });
         const out = yield* maybeTransformOutput(data.model, res);
         return out as unknown as T | null;
-      }),
+      }).pipe(
+        Effect.withSpan("executor.storage.update", {
+          attributes: {
+            "executor.storage.adapter_id": config.adapterId,
+            "executor.storage.table": data.model,
+          },
+        }),
+      ),
     updateMany: (data: {
       model: string;
           where,
           update,
         });
-      }),
+      }).pipe(
+        Effect.withSpan("executor.storage.update_many", {
+          attributes: {
+            "executor.storage.adapter_id": config.adapterId,
+            "executor.storage.table": data.model,
+          },
+        }),
+      ),
     delete: (data: { model: string; where: Where[] }) =>
       Effect.gen(function* () {
           model: getModelName(data.model),
           where,
         });
-      }),
+      }).pipe(
+        Effect.withSpan("executor.storage.delete", {
+          attributes: {
+            "executor.storage.adapter_id": config.adapterId,
+            "executor.storage.table": data.model,
+          },
+        }),
+      ),
     deleteMany: (data: { model: string; where: Where[] }) =>
       Effect.gen(function* () {
           model: getModelName(data.model),
           where,
         });
-      }),
+      }).pipe(
+        Effect.withSpan("executor.storage.delete_many", {
+          attributes: {
+            "executor.storage.adapter_id": config.adapterId,
+            "executor.storage.table": data.model,
+          },
+        }),
+      ),
     transaction: <R, E>(
       callback: (trx: DBTransactionAdapter) => Effect.Effect<R, E>,
     ) => {
       const txFn = config.transaction;
-      if (!txFn) {
+      const ran = !txFn ? callback(self) : txFn(callback);
-        // No real transaction support — just run the callback against self.
+      return ran.pipe(
-        return callback(self);
+        Effect.withSpan("executor.storage.transaction", {
-      }
+          attributes: {
-      return txFn(callback);
+            "executor.storage.adapter_id": config.adapterId,
+            "executor.storage.transaction.native": txFn !== undefined,
+          },
+        }),
+      );
     },
     // Forward the backend's createSchema verbatim. Upstream better-auth

packages/core/storage-drizzle/src/adapter.ts+70−10

     return t;
   };
+  const backendAttrs = (model: string) => ({
+    "executor.storage.backend": "drizzle" as const,
+    "executor.storage.drizzle.provider": provider,
+    "executor.storage.table": model,
+  });
   const custom: CustomAdapter = {
     create: ({ model, data }) =>
       Effect.gen(function* () {
           model,
         );
         return row as never;
-      }),
+      }).pipe(
+        Effect.withSpan("executor.storage.backend.create", {
+          attributes: backendAttrs(model),
+        }),
+      ),
     // Real multi-row INSERT in fixed-size chunks. One statement per
     // chunk, not one per row — per-row loops blow the Hyperdrive
           for (const row of rows) all.push(row);
         }
         return all as never;
-      }),
+      }).pipe(
+        Effect.withSpan("executor.storage.backend.create_many", {
+          attributes: {
+            ...backendAttrs(model),
+            "executor.storage.row_count": data.length,
+          },
+        }),
+      ),
     findOne: ({ model, where, join }) =>
       Effect.gen(function* () {
           model,
         )) as Record<string, unknown>[];
         return (rows[0] ?? null) as never;
-      }),
+      }).pipe(
+        Effect.withSpan("executor.storage.backend.find_one", {
+          attributes: backendAttrs(model),
+        }),
+      ),
     findMany: ({ model, where, limit, sortBy, offset, join }) =>
       Effect.gen(function* () {
           model,
         )) as Record<string, unknown>[];
         return rows as never[];
-      }),
+      }).pipe(
+        Effect.withSpan("executor.storage.backend.find_many", {
+          attributes: backendAttrs(model),
+        }),
+      ),
     count: ({ model, where }) =>
       Effect.gen(function* () {
         )) as { c: number | string | bigint }[];
         const raw = rows[0]?.c ?? 0;
         return typeof raw === "number" ? raw : Number(raw);
-      }),
+      }).pipe(
+        Effect.withSpan("executor.storage.backend.count", {
+          attributes: backendAttrs(model),
+        }),
+      ),
     update: ({ model, where, update }) =>
       Effect.gen(function* () {
           model,
         )) as Record<string, unknown>[];
         return (reread[0] ?? null) as never;
-      }),
+      }).pipe(
+        Effect.withSpan("executor.storage.backend.update", {
+          attributes: backendAttrs(model),
+        }),
+      ),
     updateMany: ({ model, where, update }) =>
       Effect.gen(function* () {
           model,
         );
         return n;
-      }),
+      }).pipe(
+        Effect.withSpan("executor.storage.backend.update_many", {
+          attributes: backendAttrs(model),
+        }),
+      ),
     delete: ({ model, where }) =>
       Effect.gen(function* () {
           () => Promise.resolve(db.delete(table).where(eq(table.id, first.id))),
           model,
         );
-      }),
+      }).pipe(
+        Effect.withSpan("executor.storage.backend.delete", {
+          attributes: backendAttrs(model),
+        }),
+      ),
     deleteMany: ({ model, where }) =>
       Effect.gen(function* () {
           model,
         );
         return n;
-      }),
+      }).pipe(
+        Effect.withSpan("executor.storage.backend.delete_many", {
+          attributes: backendAttrs(model),
+        }),
+      ),
   };
   // Transaction strategy differs by dialect:
               if (e instanceof TxFailure) return e.inner;
               return classifyError("pg transaction", undefined, e);
             }),
+            Effect.withSpan("executor.storage.backend.transaction", {
+              attributes: {
+                "executor.storage.backend": "drizzle",
+                "executor.storage.drizzle.provider": provider,
+                "executor.storage.transaction.strategy": "drizzle_native",
+              },
+            }),
           ) as Effect.Effect<R, E | StorageFailure>;
         }
             });
           }
           return result;
-        });
+        }).pipe(
+          Effect.withSpan("executor.storage.backend.transaction", {
+            attributes: {
+              "executor.storage.backend": "drizzle",
+              "executor.storage.drizzle.provider": provider,
+              "executor.storage.transaction.strategy": "raw_begin_commit",
+            },
+          }),
+        );
       }
     : undefined;

packages/hosts/mcp/src/server.ts+81−40

 ): Effect.Effect<McpServer> =>
   Effect.gen(function* () {
     const engine = "engine" in config ? config.engine : createExecutionEngine(config);
-    const description = config.description ?? (yield* engine.getDescription);
+    const description =
+      config.description ??
+      (yield* engine.getDescription.pipe(
+        Effect.withSpan("mcp.host.get_description"),
+      ));
     // Captured at construction time. SDK callbacks fire later (often
     // deferred past the outer Effect's await), so we use the runtime to
       return parent ? Effect.withParentSpan(effect, parent) : effect;
     };
-    const server = new McpServer(
+    const server = yield* Effect.sync(
-      { name: "executor", version: "1.0.0" },
+      () =>
-      { capabilities: { tools: {} }, jsonSchemaValidator: new CfWorkerJsonSchemaValidator() },
+        new McpServer(
-    );
+          { name: "executor", version: "1.0.0" },
+          {
+            capabilities: { tools: {} },
+            jsonSchemaValidator: new CfWorkerJsonSchemaValidator(),
+          },
+        ),
+    ).pipe(Effect.withSpan("mcp.host.create_server"));
     const executeCode = (code: string): Effect.Effect<McpToolResult, E> =>
       Effect.gen(function* () {
         return outcome.status === "completed"
           ? toMcpResult(formatExecuteResult(outcome.result))
           : toMcpPausedResult(formatPausedExecution(outcome.execution));
-      });
+      }).pipe(
+        Effect.withSpan("mcp.host.tool.execute", {
+          attributes: {
+            "mcp.tool.name": "execute",
+            "mcp.execute.code_length": code.length,
+          },
+        }),
+      );
     const resumeExecution = (
       executionId: string,
         const outcome = yield* engine.resume(executionId, { action, content });
         if (!outcome) {
           return {
-            content: [{ type: "text", text: `No paused execution: ${executionId}` }],
+            content: [
+              { type: "text" as const, text: `No paused execution: ${executionId}` },
+            ],
             isError: true,
-          };
+          } satisfies McpToolResult;
         }
         return outcome.status === "completed"
           ? toMcpResult(formatExecuteResult(outcome.result))
           : toMcpPausedResult(formatPausedExecution(outcome.execution));
-      });
+      }).pipe(
+        Effect.withSpan("mcp.host.tool.resume", {
+          attributes: {
+            "mcp.tool.name": "resume",
+            "mcp.execute.resume.action": action,
+            "mcp.execute.execution_id": executionId,
+          },
+        }),
+      );
     // --- tools ---
-    const executeTool = server.registerTool(
+    const executeTool = yield* Effect.sync(() =>
-      "execute",
+      server.registerTool(
-      {
+        "execute",
-        description,
+        {
-        inputSchema: { code: z.string().trim().min(1) },
+          description,
-      },
+          inputSchema: { code: z.string().trim().min(1) },
-      ({ code }) => Runtime.runPromise(runtime)(anchor(executeCode(code))),
+        },
+        ({ code }) => Runtime.runPromise(runtime)(anchor(executeCode(code))),
+      ),
+    ).pipe(
+      Effect.withSpan("mcp.host.register_tool", {
+        attributes: { "mcp.tool.name": "execute" },
+      }),
     );
-    const resumeTool = server.registerTool(
+    const resumeTool = yield* Effect.sync(() =>
-      "resume",
+      server.registerTool(
-      {
+        "resume",
-        description: [
+        {
-          "Resume a paused execution using the executionId returned by execute.",
+          description: [
-          "Never call this without user approval unless they explicitly state otherwise.",
+            "Resume a paused execution using the executionId returned by execute.",
-        ].join("\n"),
+            "Never call this without user approval unless they explicitly state otherwise.",
-        inputSchema: {
+          ].join("\n"),
-          executionId: z.string().describe("The execution ID from the paused result"),
+          inputSchema: {
-          action: z
+            executionId: z.string().describe("The execution ID from the paused result"),
-            .enum(["accept", "decline", "cancel"])
+            action: z
-            .describe("How to respond to the interaction"),
+              .enum(["accept", "decline", "cancel"])
-          content: z
+              .describe("How to respond to the interaction"),
-            .string()
+            content: z
-            .describe("Optional JSON-encoded response content for form elicitations")
+              .string()
-            .default("{}"),
+              .describe("Optional JSON-encoded response content for form elicitations")
+              .default("{}"),
+          },
         },
-      },
+        ({ executionId, action, content: rawContent }) =>
-      ({ executionId, action, content: rawContent }) =>
+          Runtime.runPromise(runtime)(
-        Runtime.runPromise(runtime)(
+            anchor(resumeExecution(executionId, action, parseJsonContent(rawContent))),
-          anchor(resumeExecution(executionId, action, parseJsonContent(rawContent))),
+          ),
-        ),
+      ),
+    ).pipe(
+      Effect.withSpan("mcp.host.register_tool", {
+        attributes: { "mcp.tool.name": "resume" },
+      }),
     );
     // --- capability-based tool visibility ---
       }
     };
-    syncToolAvailability();
+    yield* Effect.sync(() => {
-    server.server.oninitialized = syncToolAvailability;
+      syncToolAvailability();
+      server.server.oninitialized = syncToolAvailability;
+    }).pipe(Effect.withSpan("mcp.host.sync_tool_availability"));
     return server;
-  });
+  }).pipe(Effect.withSpan("mcp.host.create_executor_server"));

packages/plugins/graphql/src/sdk/invoke.ts+38−4

@@ -15,9 +15,13 @@ import { · 14 unmodified lines
15	export const resolveHeaders = (	15	export const resolveHeaders = (
16	headers: Record<string, HeaderValue>,	16	headers: Record<string, HeaderValue>,
17	secrets: { readonly get: (id: string) => Effect.Effect<string \| null, unknown> },	17	secrets: { readonly get: (id: string) => Effect.Effect<string \| null, unknown> },
18	): Effect.Effect<Record<string, string>> =>	18	): Effect.Effect<Record<string, string>> => {
19	Effect.gen(function* () {	19	const entries = Object.entries(headers);
20	const entries = Object.entries(headers);	20	const secretCount = entries.reduce(
		21	(acc, [, value]) => (typeof value === "string" ? acc : acc + 1),
		22	0,
		23	);
		24	return Effect.gen(function* () {
21	// Resolve secret-backed headers in parallel. Missing / failing	25	// Resolve secret-backed headers in parallel. Missing / failing
22	// lookups drop the header rather than fail the invocation, same	26	// lookups drop the header rather than fail the invocation, same
23	// as the serial version.	27	// as the serial version.
@@ -48,7 +52,15 @@ export const resolveHeaders = ( · 24 unmodified lines
48	if (value !== null) resolved[name] = value;	52	if (value !== null) resolved[name] = value;
49	}	53	}
50	return resolved;	54	return resolved;
51	});	55	}).pipe(
		56	Effect.withSpan("plugin.graphql.secret.resolve", {
		57	attributes: {
		58	"plugin.graphql.headers.total": entries.length,
		59	"plugin.graphql.headers.secret_count": secretCount,
		60	},
		61	}),
		62	);
		63	};
52		64
53	// ---------------------------------------------------------------------------	65	// ---------------------------------------------------------------------------
54	// Response helpers	66	// Response helpers
@@ -74,6 +86,15 @@ export const invoke = Effect.fn("GraphQL.invoke")(function* ( · 19 unmodified lines
74	) {	86	) {
75	const client = yield* HttpClient.HttpClient;	87	const client = yield* HttpClient.HttpClient;
76		88
		89	yield* Effect.annotateCurrentSpan({
		90	"http.method": "POST",
		91	"http.url": endpoint,
		92	"plugin.graphql.endpoint": endpoint,
		93	"plugin.graphql.operation_kind": operation.kind,
		94	"plugin.graphql.field_name": operation.fieldName,
		95	"plugin.graphql.headers.resolved_count": Object.keys(resolvedHeaders).length,
		96	});
		97
77	// Build the GraphQL request body	98	// Build the GraphQL request body
78	const variables: Record<string, unknown> = {};	99	const variables: Record<string, unknown> = {};
79	for (const varName of operation.variableNames) {	100	for (const varName of operation.variableNames) {
@@ -121,6 +142,12 @@ export const invoke = Effect.fn("GraphQL.invoke")(function* ( · 41 unmodified lines
121	const gqlBody = body as { data?: unknown; errors?: unknown[] } \| null;	142	const gqlBody = body as { data?: unknown; errors?: unknown[] } \| null;
122	const hasErrors = Array.isArray(gqlBody?.errors) && gqlBody.errors.length > 0;	143	const hasErrors = Array.isArray(gqlBody?.errors) && gqlBody.errors.length > 0;
123		144
		145	yield* Effect.annotateCurrentSpan({
		146	"http.status_code": status,
		147	"plugin.graphql.has_errors": hasErrors,
		148	"plugin.graphql.error_count": hasErrors ? gqlBody!.errors!.length : 0,
		149	});
		150
124	return new InvocationResult({	151	return new InvocationResult({
125	status,	152	status,
126	data: gqlBody?.data ?? null,	153	data: gqlBody?.data ?? null,
@@ -150,4 +177,11 @@ export const invokeWithLayer = ( · 23 unmodified lines
150	cause: err,	177	cause: err,
151	}),	178	}),
152	),	179	),
		180	Effect.withSpan("plugin.graphql.invoke", {
		181	attributes: {
		182	"plugin.graphql.endpoint": endpoint,
		183	"plugin.graphql.operation_kind": operation.kind,
		184	"plugin.graphql.field_name": operation.fieldName,
		185	},
		186	}),
153	);	187	);

packages/plugins/mcp/src/sdk/connection.ts+5−1

             cause instanceof Error ? cause.message : String(cause)
           }`,
         }),
-    });
+    }).pipe(
+      Effect.withSpan("plugin.mcp.connection.handshake", {
+        attributes: { "plugin.mcp.transport": input.transport },
+      }),
+    );
     return connectionFromClient(client);
   });

packages/plugins/mcp/src/sdk/invoke.ts+40−6

@@ -136,7 +136,11 @@ const useConnection = ( · 135 unmodified lines
136	cause instanceof Error ? cause.message : String(cause)	136	cause instanceof Error ? cause.message : String(cause)
137	}`,	137	}`,
138	}),	138	}),
139	});	139	}).pipe(
		140	Effect.withSpan("plugin.mcp.client.call_tool", {
		141	attributes: { "mcp.tool.name": toolName },
		142	}),
		143	);
140	});	144	});
141		145
142	// ---------------------------------------------------------------------------	146	// ---------------------------------------------------------------------------
@@ -163,8 +167,12 @@ export interface InvokeMcpToolInput { · 20 unmodified lines
163		167
164	export const invokeMcpTool = (	168	export const invokeMcpTool = (
165	input: InvokeMcpToolInput,	169	input: InvokeMcpToolInput,
166	): Effect.Effect<unknown, McpConnectionError \| McpInvocationError> =>	170	): Effect.Effect<unknown, McpConnectionError \| McpInvocationError> => {
167	Effect.gen(function* () {	171	const transport: string =
		172	input.sourceData.transport === "stdio"
		173	? "stdio"
		174	: (input.sourceData.remoteTransport ?? "auto");
		175	return Effect.gen(function* () {
168	const cacheKey = connectionCacheKey(input.sourceData);	176	const cacheKey = connectionCacheKey(input.sourceData);
169	const args = asRecord(input.args);	177	const args = asRecord(input.args);
170		178
@@ -173,7 +181,15 @@ export const invokeMcpTool = ( · 2 unmodified lines
173	const connector = input.resolveConnector();	181	const connector = input.resolveConnector();
174	input.pendingConnectors.set(cacheKey, connector);	182	input.pendingConnectors.set(cacheKey, connector);
175		183
176	const firstConnection = yield* input.connectionCache.get(cacheKey);	184	const firstConnection = yield* input.connectionCache.get(cacheKey).pipe(
		185	Effect.withSpan("plugin.mcp.connection.acquire", {
		186	attributes: {
		187	"plugin.mcp.transport": transport,
		188	"plugin.mcp.cache_key": cacheKey,
		189	"plugin.mcp.attempt": 1,
		190	},
		191	}),
		192	);
177		193
178	return yield* useConnection(	194	return yield* useConnection(
179	firstConnection,	195	firstConnection,
@@ -194,7 +210,25 @@ export const invokeMcpTool = ( · 14 unmodified lines
194	args,	210	args,
195	input.elicit,	211	input.elicit,
196	);	212	);
197	}),	213	}).pipe(
		214	Effect.withSpan("plugin.mcp.invoke.retry", {
		215	attributes: {
		216	"plugin.mcp.transport": transport,
		217	"plugin.mcp.cache_key": cacheKey,
		218	"mcp.tool.name": input.toolName,
		219	},
		220	}),
		221	),
198	),	222	),
199	);	223	);
200	}).pipe(Effect.scoped);	224	}).pipe(
		225	Effect.scoped,
		226	Effect.withSpan("plugin.mcp.invoke", {
		227	attributes: {
		228	"mcp.tool.name": input.toolName,
		229	"plugin.mcp.tool_id": input.toolId,
		230	"plugin.mcp.transport": transport,
		231	},
		232	}),
		233	);
		234	};

packages/plugins/mcp/src/sdk/plugin.ts+210−103

@@ -445,6 +445,7 @@ export const mcpPlugin = definePlugin( · 444 unmodified lines
445	Effect.catchAll(() =>	445	Effect.catchAll(() =>
446	Effect.succeed({ ok: false as const, manifest: null }),	446	Effect.succeed({ ok: false as const, manifest: null }),
447	),	447	),
		448	Effect.withSpan("mcp.plugin.discover_tools"),
448	);	449	);
449		450
450	if (result.ok && result.manifest) {	451	if (result.ok && result.manifest) {
@@ -465,6 +466,7 @@ export const mcpPlugin = definePlugin( · 14 unmodified lines
465	}).pipe(	466	}).pipe(
466	Effect.map(() => true),	467	Effect.map(() => true),
467	Effect.catchAll(() => Effect.succeed(false)),	468	Effect.catchAll(() => Effect.succeed(false)),
		469	Effect.withSpan("mcp.plugin.probe_oauth"),
468	);	470	);
469		471
470	if (hasOAuth) {	472	if (hasOAuth) {
@@ -483,7 +485,11 @@ export const mcpPlugin = definePlugin( · 12 unmodified lines
483	"Could not connect to MCP endpoint and no OAuth was detected",	485	"Could not connect to MCP endpoint and no OAuth was detected",
484	),	486	),
485	);	487	);
486	});	488	}).pipe(
		489	Effect.withSpan("mcp.plugin.probe_endpoint", {
		490	attributes: { "mcp.endpoint": endpoint },
		491	}),
		492	);
487		493
488	const configFile = options?.configFile;	494	const configFile = options?.configFile;
489		495
@@ -493,7 +499,14 @@ export const mcpPlugin = definePlugin( · 3 unmodified lines
493	const sd = toStoredSourceData(config);	499	const sd = toStoredSourceData(config);
494		500
495	// Resolve auth (may fail if stdio gate is off)	501	// Resolve auth (may fail if stdio gate is off)
496	const ci = yield* resolveConnectorInput(sd, ctx, allowStdio);	502	const ci = yield* resolveConnectorInput(sd, ctx, allowStdio).pipe(
		503	Effect.withSpan("mcp.plugin.resolve_connector", {
		504	attributes: {
		505	"mcp.source.namespace": namespace,
		506	"mcp.source.transport": sd.transport,
		507	},
		508	}),
		509	);
497		510
498	const connector = createMcpConnector(ci);	511	const connector = createMcpConnector(ci);
499	// Try discovery. If it fails (auth, network, bad spec), we still	512	// Try discovery. If it fails (auth, network, bad spec), we still
@@ -505,6 +518,9 @@ export const mcpPlugin = definePlugin( · 5 unmodified lines
505	mcpDiscoveryError(`MCP discovery failed: ${err.message}`),	518	mcpDiscoveryError(`MCP discovery failed: ${err.message}`),
506	),	519	),
507	Effect.either,	520	Effect.either,
		521	Effect.withSpan("mcp.plugin.discover_tools", {
		522	attributes: { "mcp.source.namespace": namespace },
		523	}),
508	);	524	);
509	const manifest =	525	const manifest =
510	discovery._tag === "Right"	526	discovery._tag === "Right"
@@ -513,73 +529,101 @@ export const mcpPlugin = definePlugin( · 2 unmodified lines
513		529
514	const sourceName = manifest.server?.name ?? config.name ?? namespace;	530	const sourceName = manifest.server?.name ?? config.name ?? namespace;
515		531
516	yield* ctx.transaction(	532	yield* ctx
517	Effect.gen(function* () {	533	.transaction(
518	// Remove stale rows for this namespace (plugin-owned)	534	Effect.gen(function* () {
519	yield* ctx.storage.removeBindingsByNamespace(namespace);	535	// Remove stale rows for this namespace (plugin-owned)
520	yield* ctx.storage.removeSource(namespace);	536	yield* ctx.storage.removeBindingsByNamespace(namespace);
521		537	yield* ctx.storage.removeSource(namespace);
522	yield* ctx.storage.putSource({	538
523	namespace,	539	yield* ctx.storage.putSource({
524	name: sourceName,	540	namespace,
525	config: sd,	541	name: sourceName,
526	});	542	config: sd,
527		543	});
528	yield* ctx.storage.putBindings(	544
529	namespace,	545	yield* ctx.storage.putBindings(
530	manifest.tools.map((e) => ({	546	namespace,
531	toolId: `${namespace}.${e.toolId}`,	547	manifest.tools.map((e) => ({
532	binding: toBinding(e),	548	toolId: `${namespace}.${e.toolId}`,
533	})),	549	binding: toBinding(e),
534	);	550	})),
535		551	);
536	yield* ctx.core.sources.register({	552
537	id: namespace,	553	yield* ctx.core.sources.register({
538	kind: "mcp",	554	id: namespace,
539	name: sourceName,	555	kind: "mcp",
540	url: sd.transport === "remote" ? sd.endpoint : undefined,	556	name: sourceName,
541	canRemove: true,	557	url: sd.transport === "remote" ? sd.endpoint : undefined,
542	canRefresh: true,	558	canRemove: true,
543	canEdit: sd.transport === "remote",	559	canRefresh: true,
544	tools: manifest.tools.map((e) => ({	560	canEdit: sd.transport === "remote",
545	name: e.toolId,	561	tools: manifest.tools.map((e) => ({
546	description: e.description ?? `MCP tool: ${e.toolName}`,	562	name: e.toolId,
547	inputSchema: e.inputSchema,	563	description: e.description ?? `MCP tool: ${e.toolName}`,
548	outputSchema: e.outputSchema,	564	inputSchema: e.inputSchema,
549	})),	565	outputSchema: e.outputSchema,
550	});	566	})),
551	}),	567	});
552	);	568	}),
		569	)
		570	.pipe(
		571	Effect.withSpan("mcp.plugin.persist_source", {
		572	attributes: {
		573	"mcp.source.namespace": namespace,
		574	"mcp.source.tool_count": manifest.tools.length,
		575	},
		576	}),
		577	);
553		578
554	if (configFile) {	579	if (configFile) {
555	yield* configFile.upsertSource(	580	yield* configFile
556	toMcpConfigEntry(namespace, sourceName, config),	581	.upsertSource(toMcpConfigEntry(namespace, sourceName, config))
557	);	582	.pipe(Effect.withSpan("mcp.plugin.config_file.upsert"));
558	}	583	}
559		584
560	if (discovery._tag === "Left") {	585	if (discovery._tag === "Left") {
561	return yield* Effect.fail(discovery.left);	586	return yield* Effect.fail(discovery.left);
562	}	587	}
563	return { toolCount: manifest.tools.length, namespace };	588	return { toolCount: manifest.tools.length, namespace };
564	});	589	}).pipe(
		590	Effect.withSpan("mcp.plugin.add_source", {
		591	attributes: {
		592	"mcp.source.transport": config.transport,
		593	"mcp.source.name": config.name,
		594	},
		595	}),
		596	);
565		597
566	const removeSource = (namespace: string) =>	598	const removeSource = (namespace: string) =>
567	Effect.gen(function* () {	599	Effect.gen(function* () {
568	yield* ctx.transaction(	600	yield* ctx
569	Effect.gen(function* () {	601	.transaction(
570	yield* ctx.storage.removeBindingsByNamespace(namespace);	602	Effect.gen(function* () {
571	yield* ctx.storage.removeSource(namespace);	603	yield* ctx.storage.removeBindingsByNamespace(namespace);
572	yield* ctx.core.sources.unregister(namespace);	604	yield* ctx.storage.removeSource(namespace);
573	}),	605	yield* ctx.core.sources.unregister(namespace);
574	);	606	}),
		607	)
		608	.pipe(Effect.withSpan("mcp.plugin.persist_remove"));
575	if (configFile) {	609	if (configFile) {
576	yield* configFile.removeSource(namespace);	610	yield* configFile
		611	.removeSource(namespace)
		612	.pipe(Effect.withSpan("mcp.plugin.config_file.remove"));
577	}	613	}
578	});	614	}).pipe(
		615	Effect.withSpan("mcp.plugin.remove_source", {
		616	attributes: { "mcp.source.namespace": namespace },
		617	}),
		618	);
579		619
580	const refreshSource = (namespace: string) =>	620	const refreshSource = (namespace: string) =>
581	Effect.gen(function* () {	621	Effect.gen(function* () {
582	const sd = yield* ctx.storage.getSourceConfig(namespace);	622	const sd = yield* ctx.storage.getSourceConfig(namespace).pipe(
		623	Effect.withSpan("mcp.plugin.load_source_config", {
		624	attributes: { "mcp.source.namespace": namespace },
		625	}),
		626	);
583	if (!sd) {	627	if (!sd) {
584	return yield* Effect.fail(	628	return yield* Effect.fail(
585	remoteConnectionError(	629	remoteConnectionError(
@@ -588,49 +632,72 @@ export const mcpPlugin = definePlugin( · 2 unmodified lines
588	);	632	);
589	}	633	}
590		634
591	const ci = yield* resolveConnectorInput(sd, ctx, allowStdio);	635	const ci = yield* resolveConnectorInput(sd, ctx, allowStdio).pipe(
		636	Effect.withSpan("mcp.plugin.resolve_connector", {
		637	attributes: {
		638	"mcp.source.namespace": namespace,
		639	"mcp.source.transport": sd.transport,
		640	},
		641	}),
		642	);
592	const manifest = yield* discoverTools(createMcpConnector(ci)).pipe(	643	const manifest = yield* discoverTools(createMcpConnector(ci)).pipe(
593	Effect.mapError((err) =>	644	Effect.mapError((err) =>
594	mcpDiscoveryError(`MCP refresh failed: ${err.message}`),	645	mcpDiscoveryError(`MCP refresh failed: ${err.message}`),
595	),	646	),
		647	Effect.withSpan("mcp.plugin.discover_tools", {
		648	attributes: { "mcp.source.namespace": namespace },
		649	}),
596	);	650	);
597		651
598	const existing = yield* ctx.storage.getSource(namespace);	652	const existing = yield* ctx.storage.getSource(namespace);
599	const sourceName =	653	const sourceName =
600	manifest.server?.name ?? existing?.name ?? namespace;	654	manifest.server?.name ?? existing?.name ?? namespace;
601		655
602	yield* ctx.transaction(	656	yield* ctx
603	Effect.gen(function* () {	657	.transaction(
604	yield* ctx.storage.removeBindingsByNamespace(namespace);	658	Effect.gen(function* () {
605	yield* ctx.core.sources.unregister(namespace);	659	yield* ctx.storage.removeBindingsByNamespace(namespace);
606		660	yield* ctx.core.sources.unregister(namespace);
607	yield* ctx.storage.putBindings(	661
608	namespace,	662	yield* ctx.storage.putBindings(
609	manifest.tools.map((e) => ({	663	namespace,
610	toolId: `${namespace}.${e.toolId}`,	664	manifest.tools.map((e) => ({
611	binding: toBinding(e),	665	toolId: `${namespace}.${e.toolId}`,
612	})),	666	binding: toBinding(e),
613	);	667	})),
614	yield* ctx.core.sources.register({	668	);
615	id: namespace,	669	yield* ctx.core.sources.register({
616	kind: "mcp",	670	id: namespace,
617	name: sourceName,	671	kind: "mcp",
618	url: sd.transport === "remote" ? sd.endpoint : undefined,	672	name: sourceName,
619	canRemove: true,	673	url: sd.transport === "remote" ? sd.endpoint : undefined,
620	canRefresh: true,	674	canRemove: true,
621	canEdit: sd.transport === "remote",	675	canRefresh: true,
622	tools: manifest.tools.map((e) => ({	676	canEdit: sd.transport === "remote",
623	name: e.toolId,	677	tools: manifest.tools.map((e) => ({
624	description: e.description ?? `MCP tool: ${e.toolName}`,	678	name: e.toolId,
625	inputSchema: e.inputSchema,	679	description: e.description ?? `MCP tool: ${e.toolName}`,
626	outputSchema: e.outputSchema,	680	inputSchema: e.inputSchema,
627	})),	681	outputSchema: e.outputSchema,
628	});	682	})),
629	}),	683	});
630	);	684	}),
		685	)
		686	.pipe(
		687	Effect.withSpan("mcp.plugin.persist_source", {
		688	attributes: {
		689	"mcp.source.namespace": namespace,
		690	"mcp.source.tool_count": manifest.tools.length,
		691	},
		692	}),
		693	);
631		694
632	return { toolCount: manifest.tools.length };	695	return { toolCount: manifest.tools.length };
633	});	696	}).pipe(
		697	Effect.withSpan("mcp.plugin.refresh_source", {
		698	attributes: { "mcp.source.namespace": namespace },
		699	}),
		700	);
634		701
635	const startOAuth = (input: McpOAuthStartInput) =>	702	const startOAuth = (input: McpOAuthStartInput) =>
636	Effect.gen(function* () {	703	Effect.gen(function* () {
@@ -659,24 +726,27 @@ export const mcpPlugin = definePlugin( · 22 unmodified lines
659	Effect.mapError((e) =>	726	Effect.mapError((e) =>
660	mcpOAuthError(`OAuth start failed: ${e.message}`),	727	mcpOAuthError(`OAuth start failed: ${e.message}`),
661	),	728	),
		729	Effect.withSpan("mcp.plugin.oauth.start_authorization"),
662	);	730	);
663		731
664	yield* ctx.storage.putOAuthSession(sessionId, {	732	yield* ctx.storage
665	endpoint: fullEndpoint,	733	.putOAuthSession(sessionId, {
666	redirectUrl: input.redirectUrl,	734	endpoint: fullEndpoint,
667	codeVerifier: started.codeVerifier,	735	redirectUrl: input.redirectUrl,
668	resourceMetadataUrl: started.resourceMetadataUrl,	736	codeVerifier: started.codeVerifier,
669	authorizationServerUrl: started.authorizationServerUrl,	737	resourceMetadataUrl: started.resourceMetadataUrl,
670	resourceMetadata: started.resourceMetadata,	738	authorizationServerUrl: started.authorizationServerUrl,
671	authorizationServerMetadata: started.authorizationServerMetadata,	739	resourceMetadata: started.resourceMetadata,
672	clientInformation: started.clientInformation,	740	authorizationServerMetadata: started.authorizationServerMetadata,
673	});	741	clientInformation: started.clientInformation,
		742	})
		743	.pipe(Effect.withSpan("mcp.plugin.oauth.persist_session"));
674		744
675	return {	745	return {
676	sessionId,	746	sessionId,
677	authorizationUrl: started.authorizationUrl,	747	authorizationUrl: started.authorizationUrl,
678	};	748	};
679	});	749	}).pipe(Effect.withSpan("mcp.plugin.start_oauth"));
680		750
681	const completeOAuth = (input: McpOAuthCompleteInput) =>	751	const completeOAuth = (input: McpOAuthCompleteInput) =>
682	Effect.gen(function* () {	752	Effect.gen(function* () {
@@ -705,6 +775,7 @@ export const mcpPlugin = definePlugin( · 22 unmodified lines
705	Effect.mapError((e) =>	775	Effect.mapError((e) =>
706	mcpOAuthError(`OAuth exchange failed: ${e.message}`),	776	mcpOAuthError(`OAuth exchange failed: ${e.message}`),
707	),	777	),
		778	Effect.withSpan("mcp.plugin.oauth.exchange_code"),
708	);	779	);
709		780
710	const accessSecretId = `mcp-oauth-access-${input.state}`;	781	const accessSecretId = `mcp-oauth-access-${input.state}`;
@@ -757,7 +828,7 @@ export const mcpPlugin = definePlugin( · 46 unmodified lines
757	expiresAt,	828	expiresAt,
758	scope: exchanged.tokens.scope ?? null,	829	scope: exchanged.tokens.scope ?? null,
759	};	830	};
760	});	831	}).pipe(Effect.withSpan("mcp.plugin.complete_oauth"));
761		832
762	const updateSource = (	833	const updateSource = (
763	namespace: string,	834	namespace: string,
@@ -783,10 +854,18 @@ export const mcpPlugin = definePlugin( · 19 unmodified lines
783	name: input.name?.trim() \|\| existing.name,	854	name: input.name?.trim() \|\| existing.name,
784	config: updatedConfig,	855	config: updatedConfig,
785	});	856	});
786	});	857	}).pipe(
		858	Effect.withSpan("mcp.plugin.update_source", {
		859	attributes: { "mcp.source.namespace": namespace },
		860	}),
		861	);
787		862
788	const getSource = (namespace: string) =>	863	const getSource = (namespace: string) =>
789	ctx.storage.getSource(namespace);	864	ctx.storage.getSource(namespace).pipe(
		865	Effect.withSpan("mcp.plugin.get_source", {
		866	attributes: { "mcp.source.namespace": namespace },
		867	}),
		868	);
790		869
791	return {	870	return {
792	probeEndpoint,	871	probeEndpoint,
@@ -804,14 +883,22 @@ export const mcpPlugin = definePlugin( · 11 unmodified lines
804	Effect.gen(function* () {	883	Effect.gen(function* () {
805	const runtime = yield* ensureRuntime();	884	const runtime = yield* ensureRuntime();
806		885
807	const entry = yield* ctx.storage.getBinding(toolRow.id);	886	const entry = yield* ctx.storage.getBinding(toolRow.id).pipe(
		887	Effect.withSpan("mcp.plugin.load_binding", {
		888	attributes: { "mcp.tool.name": toolRow.id },
		889	}),
		890	);
808	if (!entry) {	891	if (!entry) {
809	return yield* Effect.fail(	892	return yield* Effect.fail(
810	new Error(`No MCP binding found for tool "${toolRow.id}"`),	893	new Error(`No MCP binding found for tool "${toolRow.id}"`),
811	);	894	);
812	}	895	}
813		896
814	const sd = yield* ctx.storage.getSourceConfig(entry.namespace);	897	const sd = yield* ctx.storage.getSourceConfig(entry.namespace).pipe(
		898	Effect.withSpan("mcp.plugin.load_source_config", {
		899	attributes: { "mcp.source.namespace": entry.namespace },
		900	}),
		901	);
815	if (!sd) {	902	if (!sd) {
816	return yield* Effect.fail(	903	return yield* Effect.fail(
817	new Error(	904	new Error(
@@ -837,12 +924,25 @@ export const mcpPlugin = definePlugin( · 19 unmodified lines
837	err instanceof Error ? err.message : String(err),	924	err instanceof Error ? err.message : String(err),
838	}),	925	}),
839	),	926	),
		927	Effect.withSpan("mcp.plugin.resolve_connector", {
		928	attributes: {
		929	"mcp.source.namespace": entry.namespace,
		930	"mcp.source.transport": sd.transport,
		931	},
		932	}),
840	),	933	),
841	connectionCache: runtime.connectionCache,	934	connectionCache: runtime.connectionCache,
842	pendingConnectors: runtime.pendingConnectors,	935	pendingConnectors: runtime.pendingConnectors,
843	elicit,	936	elicit,
844	});	937	});
845	}),	938	}).pipe(
		939	Effect.withSpan("mcp.plugin.invoke_tool", {
		940	attributes: {
		941	"mcp.tool.name": toolRow.id,
		942	"mcp.tool.source_id": toolRow.source_id,
		943	},
		944	}),
		945	),
846		946
847	detect: ({ url }) =>	947	detect: ({ url }) =>
848	Effect.gen(function* () {	948	Effect.gen(function* () {
@@ -865,6 +965,7 @@ export const mcpPlugin = definePlugin( · 16 unmodified lines
865	const connected = yield* discoverTools(connector).pipe(	965	const connected = yield* discoverTools(connector).pipe(
866	Effect.map(() => true),	966	Effect.map(() => true),
867	Effect.catchAll(() => Effect.succeed(false)),	967	Effect.catchAll(() => Effect.succeed(false)),
		968	Effect.withSpan("mcp.plugin.discover_tools"),
868	);	969	);
869		970
870	if (connected) {	971	if (connected) {
@@ -885,6 +986,7 @@ export const mcpPlugin = definePlugin( · 14 unmodified lines
885	}).pipe(	986	}).pipe(
886	Effect.map(() => true),	987	Effect.map(() => true),
887	Effect.catchAll(() => Effect.succeed(false)),	988	Effect.catchAll(() => Effect.succeed(false)),
		989	Effect.withSpan("mcp.plugin.probe_oauth"),
888	);	990	);
889		991
890	if (hasOAuth) {	992	if (hasOAuth) {
@@ -898,7 +1000,12 @@ export const mcpPlugin = definePlugin( · 7 unmodified lines
898	}	1000	}
899		1001
900	return null;	1002	return null;
901	}).pipe(Effect.catchAll(() => Effect.succeed(null))),	1003	}).pipe(
		1004	Effect.catchAll(() => Effect.succeed(null)),
		1005	Effect.withSpan("mcp.plugin.detect", {
		1006	attributes: { "mcp.endpoint": url },
		1007	}),
		1008	),
902		1009
903	// MCP tools never require approval at the tool level — elicitation is	1010	// MCP tools never require approval at the tool level — elicitation is
904	// handled mid-invocation by the server via the elicit capability.	1011	// handled mid-invocation by the server via the elicit capability.
@@ -928,7 +1035,7 @@ export const mcpPlugin = definePlugin( · 23 unmodified lines
928	yield* Scope.close(runtime.cacheScope, Exit.void);	1035	yield* Scope.close(runtime.cacheScope, Exit.void);
929	runtimeRef.current = null;	1036	runtimeRef.current = null;
930	}	1037	}
931	}),	1038	}).pipe(Effect.withSpan("mcp.plugin.close")),
932	};	1039	};
933	},	1040	},
934	);	1041	);

packages/plugins/openapi/src/sdk/invoke.ts+37−5

 ): Effect.Effect<
   Record<string, string>,
   OpenApiInvocationError | StorageFailure
-> =>
+> => {
-  Effect.gen(function* () {
+  const entries = Object.entries(headers);
-    const entries = Object.entries(headers);
+  const secretCount = entries.reduce(
+    (acc, [, value]) => (typeof value === "string" ? acc : acc + 1),
+    0,
+  );
+  return Effect.gen(function* () {
     // Fan out secret lookups: on every invocation, one or two headers
     // typically each hit the secret store. Resolving them in parallel
     // is a free wall-clock win — preserved order is only needed for
     const resolved: Record<string, string> = {};
     for (const { name, value } of values) resolved[name] = value;
     return resolved;
-  });
+  }).pipe(
+    Effect.withSpan("plugin.openapi.secret.resolve", {
+      attributes: {
+        "plugin.openapi.headers.total": entries.length,
+        "plugin.openapi.headers.secret_count": secretCount,
+      },
+    }),
+  );
+};
 const applyHeaders = (
   request: HttpClientRequest.HttpClientRequest,
 ) {
   const client = yield* HttpClient.HttpClient;
+  yield* Effect.annotateCurrentSpan({
+    "http.method": operation.method.toUpperCase(),
+    "http.route": operation.pathTemplate,
+    "plugin.openapi.method": operation.method.toUpperCase(),
+    "plugin.openapi.path_template": operation.pathTemplate,
+    "plugin.openapi.headers.resolved_count": Object.keys(resolvedHeaders).length,
+  });
   const resolvedPath = yield* resolvePath(operation.pathTemplate, args, operation.parameters);
   const path = resolvedPath.startsWith("/") ? resolvedPath : `/${resolvedPath}`;
   );
   const status = response.status;
+  yield* Effect.annotateCurrentSpan({
+    "http.status_code": status,
+  });
   const responseHeaders: Record<string, string> = { ...response.headers };
   const contentType = response.headers["content-type"] ?? null;
       ).pipe(Layer.provide(httpClientLayer))
     : httpClientLayer;
-  return invoke(operation, args, resolvedHeaders).pipe(Effect.provide(clientWithBaseUrl));
+  return invoke(operation, args, resolvedHeaders).pipe(
+    Effect.provide(clientWithBaseUrl),
+    Effect.withSpan("plugin.openapi.invoke", {
+      attributes: {
+        "plugin.openapi.method": operation.method.toUpperCase(),
+        "plugin.openapi.path_template": operation.pathTemplate,
+        "plugin.openapi.base_url": baseUrl,
+      },
+    }),
+  );
 };
 // ---------------------------------------------------------------------------