docs(mcp): forward-port mcp-* reference docs to develop

src/.vuepress/sidebar/en.ts

@@ -124,6 +124,34 @@ export const enSidebar = sidebar({
           collapsible: true,
           children: "structure",
         },
+        {
+          text: "MCP-Kafka",
+          icon: "fa-solid fa-robot",
+          prefix: "mcp-kafka",
+          collapsible: true,
+          children: "structure",
+        },
+        {
+          text: "MCP-Kafka-Connect",
+          icon: "fa-solid fa-robot",
+          prefix: "mcp-kafka-connect",
+          collapsible: true,
+          children: "structure",
+        },
+        {
+          text: "MCP-OpenAPI",
+          icon: "fa-solid fa-robot",
+          prefix: "mcp-openapi",
+          collapsible: true,
+          children: "structure",
+        },
+        {
+          text: "MCP-Schema-Registry",
+          icon: "fa-solid fa-robot",
+          prefix: "mcp-schema-registry",
+          collapsible: true,
+          children: "structure",
+        },
         {
           text: "MQTT",
           icon: "fa-solid fa-wifi",

src/reference/config/bindings/mcp-http/.partials/options.md

@@ -2,7 +2,7 @@
 
 > `object`
 
-The `mcp_http` specific options.
+The `mcp-http` specific options.
 
 ```yaml
 options:
@@ -40,23 +40,13 @@ options:
             my_catalog:
               - subject: order_result
                 version: latest
-  prompts:
-    summarize:
-      description: Summarize a document about a topic
-      arguments:
-        - name: topic
-          description: The topic to summarize
-          required: true
-      messages:
-        - role: user
-          text: "Please summarize the document about ${args.topic}."
 ```
 
 #### options.authorization
 
 > `object` as map of named `object`
 
-Guard credentials to inject into the upstream `http` request. The named key references a [guard](../../../guards/README.md) defined elsewhere in the configuration. At most one guard may be referenced.
+Guard credentials to inject into the upstream `http` request. The named key references a [`guard`](../../../../config/overview.md#guards) defined elsewhere in the configuration. At most one guard may be referenced.
 
 #### authorization.credentials
 
@@ -137,19 +127,19 @@ Converter validating and projecting the upstream `http` response, surfaced as th
 
 > `object` as map of named `object`
 
-MCP resources terminated by this binding and expanded into `http` requests. The named key is the resource name surfaced to MCP clients by `resources/list` and matched by `resources/read`.
+MCP resources terminated by this binding and expanded into `http` requests. The named key is the resource name surfaced to MCP clients by `resources/list` or `resources/templates/list`, and matched by `resources/read`.
 
 #### resources.uri\*
 
 > `string`
 
-Resource URI template surfaced by `resources/list`, with optional embedded capture names, such as `order://{orderId}`. Captured values are referenced from a route as `${params.x}`.
+Resource URI, with optional embedded capture names, such as `order://{orderId}`. A URI with no captures is a concrete resource surfaced by `resources/list`; a URI with one or more captures is a resource template surfaced by `resources/templates/list` instead. Captured values are referenced from a route as `${params.x}`.
 
 #### resources.description
 
 > `string`
 
-Resource description surfaced to MCP clients by `resources/list`.
+Resource description surfaced to MCP clients by `resources/list` or `resources/templates/list`.
 
 #### resources.mimeType
 
@@ -170,57 +160,3 @@ JSON schema converter for the resource.
 
 Converter validating and projecting the upstream `http` response, surfaced as the resource `contents`. Uses the same shape as [`schemas.input`](#schemas-input).
 <!-- markdownlint-enable MD024 -->
-
-#### options.prompts
-
-> `object` as map of named `object`
-
-MCP prompts served locally by this binding. The named key is the prompt name surfaced to MCP clients by `prompts/list` and matched by `prompts/get`. A `prompts/get` request renders the messages locally with no upstream `http` request.
-
-#### prompts.description
-
-> `string`
-
-Prompt description surfaced to MCP clients by `prompts/list`.
-
-#### prompts.arguments
-
-> `array` of `object`
-
-Arguments accepted by the prompt, surfaced to MCP clients by `prompts/list` and supplied on `prompts/get`.
-
-#### arguments[].name\*
-
-> `string`
-
-Argument name, referenced from a message template as `${args.name}`.
-
-#### arguments[].description
-
-> `string`
-
-Argument description surfaced to MCP clients.
-
-#### arguments[].required
-
-> `boolean` | Default: `false`
-
-Whether the argument must be supplied on `prompts/get`.
-
-#### prompts.messages\*
-
-> `array` of `object`
-
-Message templates rendered and returned by `prompts/get`.
-
-#### messages[].role\*
-
-> `enum` [ `user`, `assistant` ]
-
-Role of the rendered message.
-
-#### messages[].text\*
-
-> `string`
-
-Message text template. Supports `${args.x}` interpolation, where `x` references a prompt argument supplied on `prompts/get`.

src/reference/config/bindings/mcp-http/.partials/proxy.yaml

@@ -1,5 +1,5 @@
 mcp_http_proxy:
-  type: mcp_http
+  type: mcp-http
   kind: proxy
   options:
     authorization:
@@ -36,16 +36,6 @@ mcp_http_proxy:
               my_catalog:
                 - subject: order_result
                   version: latest
-    prompts:
-      summarize:
-        description: Summarize a document about a topic
-        arguments:
-          - name: topic
-            description: The topic to summarize
-            required: true
-        messages:
-          - role: user
-            text: "Please summarize the document about ${args.topic}."
   routes:
     - when:
         - tool: create_pr

src/reference/config/bindings/mcp-http/.partials/routes.md

@@ -2,7 +2,7 @@
 
 > `array` of `object`
 
-Conditional `mcp_http` specific routes, resolving the upstream `http` request for a matched `tools/call` or `resources/read`.
+Conditional `mcp-http` specific routes, resolving the upstream `http` request for a matched `tools/call` or `resources/read`.
 
 ```yaml
 routes:
@@ -36,29 +36,44 @@ routes:
 
 > `object` as map of named `array` of `string`
 
-Roles required by the named guard. When a guarded route matches, the MCP session must be authorized for the listed roles, otherwise the stream is rejected.
+Roles required by the named guard. When a route with [`with`](#routes-with) matches, the MCP session must be authorized for the listed roles on every applicable route, otherwise the stream is rejected.
+
+A route may omit both [`when`](#routes-when) and `with` to act as a guard-only layer, applying its `guarded` roles globally across every tool and resource rather than mapping to an upstream request. Combine a global guard-only layer with a route-specific one by giving the guard-only layer a single `when` condition instead of omitting `when`. Roles from every applicable layer — the matched mapping route plus any global or scoped guard-only layers — must all authorize.
 
 ```yaml
 routes:
   - guarded:
+      my_guard:
+        - read
+  - when:
+      - tool: create_pr
+    exit: http_client
+    guarded:
       my_guard:
         - pr:write
+    with:
+      headers:
+        ":method": POST
+        ":scheme": https
+        ":authority": api.github.com
+        ":path": /repos/${args.owner}/${args.repo}/pulls
 ```
 
 #### routes[].when
 
 > `array` of `object`
 
-List of conditions (any match) to match this route.
+At most one condition to match this route. A route with [`with`](#routes-with) requires exactly one `when` condition, mapping one tool or resource to an upstream request; a route without `with` may omit `when` entirely to guard every tool and resource, or give exactly one condition to scope the guard to a single tool or resource.
 Read more: [When a route matches](/concepts/protocol/README.md#route-matches)
 
 ```yaml
 routes:
   - when:
       - tool: create_pr
-      - resource: order
 ```
 
+Each condition specifies exactly one of `tool` or `resource`, never both.
+
 #### when[].tool
 
 > `string`
@@ -98,9 +113,35 @@ with:
 
 HTTP request headers for the upstream request, including the pseudo-headers `:method`, `:scheme`, `:authority`, and `:path`. Values support interpolation.
 
-- `${args.x}` Replaced with property `x` of the `tools/call` arguments.
+- `${args.x}` Replaced with property `x` of the `tools/call` arguments. `x` may be dotted to reference a nested property, such as `${args.repository.owner}`.
 - `${params.x}` Replaced with capture `x` from the matched resource [`uri`](#resources-uri).
 
+Every header other than `:path` is omitted from the upstream request entirely when a referenced property or capture is absent, rather than being sent with an empty value.
+
+The `:path` pseudo-header resolves differently: a referenced property or capture that is absent resolves to an empty string rather than omitting the header, since `:path` is always required. To omit an individual query parameter instead, mark its fragment as optional with `${?args.x=name}` (or `${?params.x=name}`) in place of a literal `name=${args.x}` pair — the whole `name=value` fragment, including its separator, is dropped when `x` is absent.
+
+```yaml
+with:
+  headers:
+    ":method": GET
+    ":scheme": https
+    ":authority": api.github.com
+    ":path": /items?q=${args.q}&${?args.limit=limit}
+```
+
+#### with.cookies
+
+> `object` as map of named `string`
+
+Cookie name/value pairs aggregated into a single `Cookie` header on the upstream request. Values support the same `${args.x}` and `${params.x}` interpolation as [`with.headers`](#with-headers). A cookie whose referenced property or capture is absent is dropped from the aggregate on its own; the `Cookie` header itself is omitted only when every configured cookie is absent.
+
+```yaml
+with:
+  cookies:
+    session: ${args.sessionId}
+    locale: ${params.locale}
+```
+
 #### with.query
 
 > `object`
@@ -129,7 +170,7 @@ with:
 
 > `object` as map of named `string`
 
-Explicit request body, mapping each body property to an interpolated value. Supports `${args.x}` interpolation, where `x` references a property of the `tools/call` arguments. Use a template to rename or restructure arguments before dispatch.
+Explicit request body, mapping each body property to an interpolated value. Supports `${args.x}` interpolation, where `x` references a property of the `tools/call` arguments; `x` may be dotted to reference a nested property, such as `${args.pr.branch}`. Use a template to rename or restructure arguments, including flattening nested arguments, before dispatch.
 
 ```yaml
 with:

src/reference/config/bindings/mcp-http/README.md

@@ -9,13 +9,13 @@ tag:
 
 # mcp-http Binding
 
-The `proxy` kind `mcp_http` binding accepts `mcp` streams and produces `http` streams. It terminates `tools/list`, `resources/list`, and `prompts/list` from configuration, expands `tools/call` and `resources/read` into upstream `http` requests, and renders `prompts/get` from configured message templates.
+The `proxy` kind `mcp-http` binding accepts `mcp` streams and produces `http` streams. It terminates `tools/list`, `resources/list`, and `resources/templates/list` from configuration, and expands `tools/call` and `resources/read` into upstream `http` requests.
 
 ## proxy
 
 > [Full config](./proxy.md)
 
-Behave as an `mcp_http` `proxy`.
+Behave as an `mcp-http` `proxy`.
 
 ```yaml {3}
 <!-- @include: ./.partials/proxy.yaml -->

src/reference/config/bindings/mcp-http/proxy.md

@@ -4,7 +4,7 @@ shortTitle: proxy
 
 # mcp-http proxy
 
-The `mcp_http` proxy binding accepts `mcp` streams and produces `http` streams, terminating `tools/list`, `resources/list`, and `prompts/list` from configuration, expanding `tools/call` and `resources/read` into upstream `http` requests, and rendering `prompts/get` from configured message templates.
+The `mcp-http` proxy binding accepts `mcp` streams and produces `http` streams, terminating `tools/list`, `resources/list`, and `resources/templates/list` from configuration, and expanding `tools/call` and `resources/read` into upstream `http` requests.
 
 ```yaml {3}
 <!-- @include: ./.partials/proxy.yaml -->

src/reference/config/bindings/mcp-kafka-connect/.partials/client.yaml

@@ -0,0 +1,22 @@
+mcp_kafka_connect_client:
+  type: mcp-kafka-connect
+  kind: client
+  options:
+    server: http://kafka-connect.examples.dev:8083
+  routes:
+    - when:
+        - tool: create_connector
+        - tool: delete_connector
+        - tool: update_connector_config
+        - tool: restart_connector
+        - tool: pause_connector
+        - tool: resume_connector
+        - tool: stop_connector
+        - tool: restart_connector_task
+        - tool: alter_connector_offsets
+        - tool: reset_connector_offsets
+      guarded:
+        my_guard:
+          - kafka-connect:admin
+    - when:
+        - tool: "*"

src/reference/config/bindings/mcp-kafka-connect/.partials/options.md

@@ -0,0 +1,16 @@
+### options\*
+
+> `object`
+
+The `client` specific options.
+
+```yaml
+options:
+  server: http://kafka-connect.examples.dev:8083
+```
+
+#### options.server\*
+
+> `string`
+
+Base URL of the Kafka Connect REST API this binding proxies to.

src/reference/config/bindings/mcp-kafka-connect/.partials/routes.md

@@ -0,0 +1,50 @@
+### routes\*
+
+> `array` of `object`
+
+Conditional `mcp-kafka-connect` specific routes, matching by tool name or glob pattern. At least one route is required. Routes are evaluated in order; the first matching route wins.
+
+```yaml
+routes:
+  - when:
+      - tool: delete_connector
+    guarded:
+      my_guard:
+        - kafka-connect:admin
+  - when:
+      - tool: "*"
+```
+
+#### routes[].when\*
+
+> `array` of `object`
+
+List of conditions (any match) restricting this route to particular tools. Required.
+
+```yaml
+routes:
+  - when:
+      - tool: create_connector
+      - tool: delete_connector
+```
+
+#### when[].tool\*
+
+> `string` or `array` of `string`
+
+Tool name matched by `tools/call`, or a `*` glob pattern matching many tool names in bulk (such as `list_*`). Required.
+
+#### routes[].guarded
+
+> `object` as map of named `array` of `string`
+
+Roles required by the named guard for a `tools/call` against this route. Roles for the same guard are unioned into one entry; roles naming a different guard add a separate entry that must also authorize.
+
+```yaml
+routes:
+  - when:
+      - tool: delete_connector
+    guarded:
+      my_guard:
+        - kafka-connect:admin
+```