Serve every MCP endpoint as a projection of one executor

[RhysSullivan]

Problem

The default /mcp endpoint and the toolkit endpoint (/mcp/toolkits/<slug>) shared auth and transport but not the executor. A toolkit session built a second executor with a different plugin set, and the toolkits plugin installed a policy provider that replaced the workspace policy table instead of layering on it. Workspace require_approval and block policies were therefore never evaluated on toolkit endpoints (#1752). The /mcp/toolkits/<slug> path grammar was also copied in six places.

Change

Every MCP endpoint is now one executor seen through a projection.

• @executor-js/sdk gains ToolProjection (a visibility filter plus an optional rule overlay) and executor.project(name | projection), which rebuilds the view over the same database, plugins, tenant, and subject. Projection rules combine with workspace policies under least privilege: a projection can narrow what the workspace allows but never loosen it. The toolPolicyProvider plugin hook is replaced by toolProjections.
• @executor-js/plugin-toolkits no longer takes activeToolkitSlug. It registers a projection source that resolves a toolkit slug to its connections and rules; every host executor can serve any toolkit.
• @executor-js/host-mcp owns the resource grammar (mcpResourceFromPathname, mcpResourcePath). Cloud, self-host, host-cloudflare, and local all route through it. Two new scoped endpoints ride the same path: /mcp/integrations/<slug>[,<slug>…] and /mcp/tools/<tool id>.
• The local daemon no longer builds a second executor per toolkit session; it projects the boot executor.
• host-cloudflare now serves scoped endpoints (it previously routed only the bare /mcp).

Verification

• bun run typecheck, lint, format:check green.
• Unit: sdk policies.test.ts (new projection cases: allowlist, unknown name exposes nothing, cannot loosen a workspace block, workspace require_approval still gates, inline integration and single-tool projections), toolkits plugin, host-mcp (new grammar and key tests), cloud mount and auth-provider, self-host MCP, local executor and MCP, host-cloudflare.
• e2e scenarios/toolkits-mcp.test.ts on self-host: 9 of 9 pass, including three new scenarios: a workspace approval policy still gates a toolkit endpoint, a workspace block is enforced on a toolkit endpoint, and the integration and single-tool endpoints project the same catalog.

Pre-existing failures in apps/local (serve.test.ts, v1-v2-migration.test.ts, owned-database.test.ts) reproduce identically on main and are unrelated.

Closes #1752.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	6c82206	Commit Preview URL Branch Preview URL	Sep 03 2026, 08:10 AM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	6c82206	Sep 03 2026, 08:13 AM

[github-actions]

Cloudflare preview

Console	https://executor-preview-pr-1936.executor-e2e.workers.dev
MCP	https://executor-preview-pr-1936.executor-e2e.workers.dev/mcp
Deployed commit	6c82206

Sign-in is Cloudflare Access (one-time PIN to an allowed email). The preview has its own database and encryption key; it is destroyed when this PR closes.

[pkg-pr-new]

Open in StackBlitz

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@1936

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@1936

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@1936

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@1936

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@1936

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@1936

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@1936

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@1936

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@1936

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@1936

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@1936

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@1936

executor

npm i https://pkg.pr.new/executor@1936

commit: 6c82206