From 1530e1f0434514592bb89b3e2de6811bede62b3a Mon Sep 17 00:00:00 2001
From: Kevin van Zonneveld <kevin@vanzonneveld.net>
Date: Wed, 30 Sep 2026 21:45:35 +0200
Subject: [PATCH 01/27] Add task note for MCP OAuth discovery and plugin
 surface

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 .../prompts/2026-09-30-mcp-oauth-discovery.md | 80 +++++++++++++++++++
 1 file changed, 80 insertions(+)
 create mode 100644 docs/prompts/2026-09-30-mcp-oauth-discovery.md

diff --git a/docs/prompts/2026-09-30-mcp-oauth-discovery.md b/docs/prompts/2026-09-30-mcp-oauth-discovery.md
new file mode 100644
index 00000000..1cebd3db
--- /dev/null
+++ b/docs/prompts/2026-09-30-mcp-oauth-discovery.md
@@ -0,0 +1,80 @@
+# MCP server: OAuth discovery, tool annotations, file params and result widget
+
+Part of the ChatGPT plugin plan in Content: `repodocs/prompts/2026-09-30-chatgpt-plugin-plan.md`
+(branch `chatgpt-plugin-plan`). This note is the node-sdk half. Sibling branches: api2
+`agent/mcp-oauth-authcode` (authorization-code grant, DCR, CIMD, protected-resource metadata) and
+Content `mcp-oauth-consent` (consent page at `/c/oauth/authorize`, QA scenario).
+
+## Objective
+
+The hosted `https://api2.transloadit.com/mcp` endpoint must let MCP clients discover API2 as its
+authorization server and must satisfy the ChatGPT plugin and Anthropic connector directory review
+requirements. The same package also gains the ChatGPT-specific pieces from Phase 1 of the plan:
+OpenAI file params on `transloadit_create_assembly` and an MCP Apps result widget.
+
+## Existing pieces
+
+- `packages/mcp-server/src/http.ts`, `http-request-handler.ts`, `http-helpers.ts`: Streamable HTTP
+  transport, static `TRANSLOADIT_MCP_TOKEN` check for self-hosted deployments, CORS.
+- `packages/mcp-server/src/server.ts`: tool registrations (`registerTool`), per-request bearer
+  extraction (`extractBearerToken`) forwarded to API2.
+- `packages/mcp-server/src/server-card.ts`: `/.well-known/mcp/server-card.json` content used by
+  API2.
+- `packages/node/src/cli/deviceLogin.ts`: `transloadit auth login` (device flow, already shipped).
+- `@modelcontextprotocol/sdk` ≥ 1.29 ships `server/auth` helpers (`requireBearerAuth`,
+  protected-resource metadata router). Prefer them over hand-rolled headers where they fit the
+  existing transport code.
+
+## Checklist
+
+### Discovery and auth (Phase 0)
+
+- [ ] Hosted mode: unauthenticated `/mcp` requests return `401` with
+      `WWW-Authenticate: Bearer resource_metadata="https://api2.transloadit.com/.well-known/oauth-protected-resource/mcp"`.
+      Keep the friendly JSON on bare `GET` without `Accept: text/event-stream` for directory
+      health probes. Self-hosted mode keeps `TRANSLOADIT_MCP_TOKEN` behavior.
+- [ ] Per-tool `securitySchemes`: `noauth` for `transloadit_list_robots`,
+      `transloadit_get_robot_help`, `transloadit_lint_assembly_instructions`; `oauth2` with the
+      scopes each tool needs for `create_assembly`, `get_assembly_status`, `wait_for_assembly`,
+      `list_templates`. Mirror them in `_meta["securitySchemes"]` for clients that only read
+      `_meta`.
+- [ ] Tool results that fail on auth carry `_meta["mcp/www_authenticate"]` with `error` and
+      `error_description` so ChatGPT shows the account-linking UI.
+- [ ] Origin validation on the hosted endpoint (allow `chatgpt.com`, `claude.ai`, `claude.com`,
+      Transloadit origins and loopback; reject others).
+- [ ] Every tool gets a `title` and accurate `readOnlyHint`, `destructiveHint`, `openWorldHint`
+      (`true` for URL imports).
+- [ ] Optional profile tool marked `_meta["openai/profile"]: true` returning a stable opaque
+      workspace id, so multi-account works in ChatGPT.
+- [ ] Server card advertises the OAuth-by-URL path; README puts "connect by URL" first and moves
+      minted bearer tokens to the CI/headless section; drop the device-login TODO.
+
+### ChatGPT plugin surface (Phase 1)
+
+- [ ] `_meta["openai/fileParams"]: ["files"]` on `transloadit_create_assembly` with the required
+      file object schema (`download_url`, `file_id` required; `mime_type`, `file_name` optional,
+      nothing else required). Map each entry onto the existing URL-import path.
+- [ ] MCP Apps result widget (`_meta.ui.resourceUri`, `ui://transloadit/assembly-result`): per-Step
+      preview (image, video, audio, document thumbnail), before/after for image Steps, download
+      links, "Save as Template" when authenticated. Set `_meta.ui.csp.connectDomains` and
+      `resourceDomains` to Transloadit result origins and `_meta.ui.domain` to a dedicated origin.
+- [ ] `_meta["openai/toolInvocation/invoking"]` / `invoked` status strings (≤ 64 chars).
+- [ ] `plugin.json` with `extensions.com.openai` (presentation, registered MCP server, hooks) and
+      `.codex-plugin/plugin.json` fallback; bundle the `transloadit/skills` catalog within OpenAI's
+      limits (5 skills, 100 files each, 256 KiB `SKILL.md`).
+- [ ] Tests: unit tests for the 401/metadata behavior, security schemes, file-param mapping and
+      widget resource; e2e against devdock once the api2 branch serves the metadata.
+
+## Getting a local build into devdock
+
+API2's container bind-mounts the api2 worktree at `/srv/current` and runs the `mcp-server` service
+from the worktree's `node_modules/@transloadit/mcp-server`. To test this branch:
+
+```bash
+cd ~/code/node-sdk && corepack yarn build
+rm -rf ~/code/api2-clone-1/node_modules/@transloadit/mcp-server/dist
+cp -r packages/mcp-server/dist ~/code/api2-clone-1/node_modules/@transloadit/mcp-server/dist
+cd ~/code/api2-clone-1 && core/bin/devdock.ts --app api2 restart
+```
+
+Bump the dependency in API2 once the package is published from this branch.

From e3f4d6b629dfede7b842b840ccf551bc56633b60 Mon Sep 17 00:00:00 2001
From: Kevin van Zonneveld <kevin@vanzonneveld.net>
Date: Wed, 30 Sep 2026 21:47:19 +0200
Subject: [PATCH 02/27] Link the sibling MCP OAuth pull requests

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 docs/prompts/2026-09-30-mcp-oauth-discovery.md | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/docs/prompts/2026-09-30-mcp-oauth-discovery.md b/docs/prompts/2026-09-30-mcp-oauth-discovery.md
index 1cebd3db..6bbba7bc 100644
--- a/docs/prompts/2026-09-30-mcp-oauth-discovery.md
+++ b/docs/prompts/2026-09-30-mcp-oauth-discovery.md
@@ -3,9 +3,11 @@
 Part of the ChatGPT plugin plan in Content: `repodocs/prompts/2026-09-30-chatgpt-plugin-plan.md`
 (branch `chatgpt-plugin-plan`). This note is the node-sdk half. Sibling branches: api2
 `agent/mcp-oauth-authcode` (authorization-code grant, DCR, CIMD, protected-resource metadata) and
-Content `mcp-oauth-consent` (consent page at `/c/oauth/authorize`, QA scenario).
+Content `chatgpt-plugin-plan` (consent page at `/c/oauth/authorize`, QA scenario).
 
-## Objective
+Pull requests: api2 [#9320](https://github.com/transloadit/api2/pull/9320), Content
+[#6207](https://github.com/transloadit/content/pull/6207), node-sdk
+[#529](https://github.com/transloadit/node-sdk/pull/529).
 
 The hosted `https://api2.transloadit.com/mcp` endpoint must let MCP clients discover API2 as its
 authorization server and must satisfy the ChatGPT plugin and Anthropic connector directory review

From 958e8c99cdef35f413587a921a7e23ffd4f1cce0 Mon Sep 17 00:00:00 2001
From: Kevin van Zonneveld <kevin@vanzonneveld.net>
Date: Wed, 30 Sep 2026 22:19:28 +0200
Subject: [PATCH 03/27] Add OAuth discovery, tool annotations, file params and
 result widget to the MCP server
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Hosted mode (`TRANSLOADIT_MCP_RESOURCE_METADATA_URL`) answers unauthenticated MCP requests with
`401` and `WWW-Authenticate: Bearer resource_metadata="…"`, keeps the bare-GET health probe, and
limits browser Origins to ChatGPT, Claude, Transloadit and loopback unless `allowedOrigins` is
set. Self-hosted `TRANSLOADIT_MCP_TOKEN` behavior is unchanged.

Every tool now carries a title, annotations and per-tool `securitySchemes` (top-level via a
`tools/list` override, mirrored in `_meta`). Auth failures return `isError` results with
`_meta["mcp/www_authenticate"]`. New `transloadit_get_profile` tool for multi-account hosts,
`attachments` on `transloadit_create_assembly` for `_meta["openai/fileParams"]`, and the MCP Apps
widget `ui://transloadit/assembly-result` linked from the Assembly tools.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 packages/mcp-server/src/cli.ts                |  16 +-
 packages/mcp-server/src/express.ts            |  23 +-
 packages/mcp-server/src/http-helpers.ts       | 128 +++++-
 .../mcp-server/src/http-request-handler.ts    |  22 +-
 packages/mcp-server/src/http.ts               |  22 +-
 packages/mcp-server/src/server-card.ts        |  87 +++-
 packages/mcp-server/src/server.ts             | 432 ++++++++++++++----
 packages/mcp-server/src/tool-list.ts          |  64 +++
 packages/mcp-server/src/tool-metadata.ts      | 151 ++++++
 .../src/ui/assembly-result-widget.ts          | 356 +++++++++++++++
 .../mcp-server/test/e2e/server-card.test.ts   |   4 +-
 .../mcp-server/test/unit/auth-errors.test.ts  | 195 ++++++++
 .../mcp-server/test/unit/file-inputs.test.ts  |  86 ++++
 .../mcp-server/test/unit/hosted-auth.test.ts  | 215 +++++++++
 .../mcp-server/test/unit/tool-surface.test.ts | 213 +++++++++
 15 files changed, 1877 insertions(+), 137 deletions(-)
 create mode 100644 packages/mcp-server/src/tool-list.ts
 create mode 100644 packages/mcp-server/src/tool-metadata.ts
 create mode 100644 packages/mcp-server/src/ui/assembly-result-widget.ts
 create mode 100644 packages/mcp-server/test/unit/auth-errors.test.ts
 create mode 100644 packages/mcp-server/test/unit/hosted-auth.test.ts
 create mode 100644 packages/mcp-server/test/unit/tool-surface.test.ts

diff --git a/packages/mcp-server/src/cli.ts b/packages/mcp-server/src/cli.ts
index 2352ac0e..0a6e2e11 100644
--- a/packages/mcp-server/src/cli.ts
+++ b/packages/mcp-server/src/cli.ts
@@ -19,6 +19,8 @@ Environment:
   TRANSLOADIT_KEY
   TRANSLOADIT_SECRET
   TRANSLOADIT_MCP_TOKEN
+  TRANSLOADIT_MCP_RESOURCE_METADATA_URL
+  TRANSLOADIT_MCP_CONSOLE_URL
   TRANSLOADIT_ENDPOINT
   TRANSLOADIT_MCP_METRICS_PATH
   TRANSLOADIT_MCP_METRICS_USER
@@ -128,10 +130,18 @@ const main = async (): Promise<void> => {
     const mcpToken = (fileConfig.mcpToken ?? process.env.TRANSLOADIT_MCP_TOKEN) as
       | string
       | undefined
+    const resourceMetadataUrl = (fileConfig.resourceMetadataUrl ??
+      process.env.TRANSLOADIT_MCP_RESOURCE_METADATA_URL) as string | undefined
+    const consoleUrl = (fileConfig.consoleUrl ?? process.env.TRANSLOADIT_MCP_CONSOLE_URL) as
+      | string
+      | undefined
     const clientSuffix = process.env.TRANSLOADIT_CLIENT_SUFFIX as string | undefined
 
-    if (!isLocalHost(host) && !mcpToken) {
-      throw new Error('TRANSLOADIT_MCP_TOKEN is required when binding to non-localhost host.')
+    // Hosted mode delegates token checks to API2, so it may bind publicly without a static token.
+    if (!isLocalHost(host) && !mcpToken && !resourceMetadataUrl) {
+      throw new Error(
+        'TRANSLOADIT_MCP_TOKEN or TRANSLOADIT_MCP_RESOURCE_METADATA_URL is required when binding to a non-localhost host.',
+      )
     }
 
     const handler = await createTransloaditMcpHttpHandler({
@@ -140,6 +150,8 @@ const main = async (): Promise<void> => {
       endpoint,
       clientSuffix,
       mcpToken,
+      resourceMetadataUrl,
+      consoleUrl,
       allowedOrigins: fileConfig.allowedOrigins as string[] | undefined,
       allowedHosts: fileConfig.allowedHosts as string[] | undefined,
       enableDnsRebindingProtection: fileConfig.enableDnsRebindingProtection as boolean | undefined,
diff --git a/packages/mcp-server/src/express.ts b/packages/mcp-server/src/express.ts
index b53d90af..c9eb5efd 100644
--- a/packages/mcp-server/src/express.ts
+++ b/packages/mcp-server/src/express.ts
@@ -3,7 +3,12 @@ import type { TransloaditMcpHttpOptions } from './http.ts'
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js'
 import express from 'express'
 
-import { isBasicAuthorized } from './http-helpers.ts'
+import {
+  applyCorsHeaders,
+  isBasicAuthorized,
+  rejectMissingBearerToken,
+  resolveAllowedOrigins,
+} from './http-helpers.ts'
 import { getMetrics, getMetricsContentType } from './metrics.ts'
 import { createTransloaditMcpServer } from './server.ts'
 import { buildServerCard, serverCardPath } from './server-card.ts'
@@ -18,9 +23,15 @@ export function createTransloaditMcpExpressRouter(options: TransloaditMcpExpress
   const metricsPath =
     options.metricsPath === false ? undefined : (options.metricsPath ?? '/metrics')
   const metricsAuth = options.metricsAuth
+  // Only hosted mode adds an Origin policy here; embedders keep owning CORS otherwise.
+  const hostedOrigins = options.resourceMetadataUrl ? resolveAllowedOrigins(options) : undefined
 
   const serverCardJson = JSON.stringify(
-    buildServerCard(routePath, { authKey: options.authKey, authSecret: options.authSecret }),
+    buildServerCard(routePath, {
+      authKey: options.authKey,
+      authSecret: options.authSecret,
+      resourceMetadataUrl: options.resourceMetadataUrl,
+    }),
   )
 
   const sendServerCard = (res: express.Response, includeBody: boolean) => {
@@ -59,6 +70,10 @@ export function createTransloaditMcpExpressRouter(options: TransloaditMcpExpress
   })
 
   router.all(routePath, async (req: express.Request, res: express.Response) => {
+    if (hostedOrigins && !applyCorsHeaders(req, res, hostedOrigins)) {
+      return
+    }
+
     if (req.method !== 'POST') {
       res.status(405).json({
         jsonrpc: '2.0',
@@ -68,6 +83,10 @@ export function createTransloaditMcpExpressRouter(options: TransloaditMcpExpress
       return
     }
 
+    if (rejectMissingBearerToken(req, res, options.resourceMetadataUrl)) {
+      return
+    }
+
     const transport = new StreamableHTTPServerTransport({
       sessionIdGenerator: undefined,
       allowedOrigins: options.allowedOrigins,
diff --git a/packages/mcp-server/src/http-helpers.ts b/packages/mcp-server/src/http-helpers.ts
index 6c3f62dc..9ca4814c 100644
--- a/packages/mcp-server/src/http-helpers.ts
+++ b/packages/mcp-server/src/http-helpers.ts
@@ -65,6 +65,69 @@ export const isBasicAuthorized = (
   )
 }
 
+/**
+ * Browser origins the hosted endpoint accepts when no explicit `allowedOrigins` are configured:
+ * the ChatGPT and Claude web apps, Transloadit sites, devdock and loopback. Requests without an
+ * `Origin` header (CLIs, servers) are never subject to this list.
+ */
+export const hostedAllowedOrigins = [
+  'https://chatgpt.com',
+  'https://chat.openai.com',
+  'https://claude.ai',
+  'https://claude.com',
+  'https://transloadit.com',
+  'https://*.transloadit.com',
+  'https://transloadit.dev:*',
+  'https://*.transloadit.dev:*',
+  'http://localhost:*',
+  'https://localhost:*',
+  'http://127.0.0.1:*',
+  'https://127.0.0.1:*',
+  'http://[::1]:*',
+  'https://[::1]:*',
+]
+
+const originPatternRegex =
+  /^(?<protocol>https?):\/\/(?<host>\*\.)?(?<hostname>\[[^\]]+\]|[^:/]+)(?::(?<port>\*|\d+))?$/
+
+/**
+ * Matches an `Origin` header against an allowlist entry. Entries are exact origins or patterns
+ * with a `*.` subdomain wildcard and/or a `:*` any-port suffix.
+ */
+export const matchesOriginPattern = (origin: string, pattern: string): boolean => {
+  if (origin === pattern) return true
+  const match = originPatternRegex.exec(pattern)
+  if (!match?.groups) return false
+  let url: URL
+  try {
+    url = new URL(origin)
+  } catch {
+    return false
+  }
+  const { protocol, host, hostname, port } = match.groups
+  if (url.protocol !== `${protocol}:`) return false
+  const originHost = url.hostname.replaceAll(/^\[|\]$/g, '')
+  const patternHost = (hostname ?? '').replaceAll(/^\[|\]$/g, '')
+  const hostMatches = host
+    ? originHost.endsWith(`.${patternHost}`) && originHost.length > patternHost.length + 1
+    : originHost === patternHost
+  if (!hostMatches) return false
+  if (port === '*') return true
+  return url.port === (port ?? '')
+}
+
+export const isOriginAllowed = (origin: string, allowedOrigins: string[]): boolean =>
+  allowedOrigins.some((pattern) => matchesOriginPattern(origin, pattern))
+
+/** Explicit `allowedOrigins` win; hosted mode falls back to the ChatGPT/Claude/Transloadit list. */
+export const resolveAllowedOrigins = (options: {
+  allowedOrigins?: string[]
+  resourceMetadataUrl?: string
+}): string[] | undefined => {
+  if (options.allowedOrigins && options.allowedOrigins.length > 0) return options.allowedOrigins
+  return options.resourceMetadataUrl ? hostedAllowedOrigins : undefined
+}
+
 export const applyCorsHeaders = (
   req: IncomingMessage,
   res: ServerResponse,
@@ -76,7 +139,7 @@ export const applyCorsHeaders = (
   }
 
   if (allowedOrigins && allowedOrigins.length > 0) {
-    if (!allowedOrigins.includes(origin)) {
+    if (!isOriginAllowed(origin, allowedOrigins)) {
       res.statusCode = 403
       res.end('Forbidden')
       return false
@@ -92,7 +155,68 @@ export const applyCorsHeaders = (
     'Access-Control-Allow-Headers',
     'Authorization,Content-Type,Mcp-Session-Id,Last-Event-ID',
   )
-  res.setHeader('Access-Control-Expose-Headers', 'Mcp-Session-Id')
+  res.setHeader('Access-Control-Expose-Headers', 'Mcp-Session-Id,WWW-Authenticate')
 
   return true
 }
+
+/**
+ * `WWW-Authenticate` value (RFC 6750) that points OAuth clients at the protected-resource
+ * metadata and, for rejected requests, names the error so hosts show their linking UI.
+ */
+export const buildBearerChallenge = (options: {
+  resourceMetadataUrl?: string
+  error?: { code: string; description: string }
+}): string => {
+  const parts: string[] = []
+  if (options.resourceMetadataUrl) {
+    parts.push(`resource_metadata="${options.resourceMetadataUrl}"`)
+  }
+  if (options.error) {
+    parts.push(
+      `error="${options.error.code}"`,
+      `error_description="${options.error.description.replaceAll('"', "'")}"`,
+    )
+  }
+  return parts.length > 0 ? `Bearer ${parts.join(', ')}` : 'Bearer'
+}
+
+/**
+ * Self-hosted policy: the request must carry the static `TRANSLOADIT_MCP_TOKEN`. Returns `true`
+ * when the 401 was already sent.
+ */
+export const rejectMissingMcpToken = (
+  req: IncomingMessage,
+  res: ServerResponse,
+  mcpToken: string | undefined,
+): boolean => {
+  if (!mcpToken || isAuthorized(req, mcpToken)) return false
+  res.statusCode = 401
+  res.setHeader('WWW-Authenticate', 'Bearer')
+  res.end('Unauthorized')
+  return true
+}
+
+/**
+ * Hosted policy: a bearer token only has to be present, because API2 verifies it on every
+ * forwarded call. Without one, the 401 points OAuth clients at the protected-resource metadata.
+ * Returns `true` when the 401 was already sent.
+ */
+export const rejectMissingBearerToken = (
+  req: IncomingMessage,
+  res: ServerResponse,
+  resourceMetadataUrl: string | undefined,
+): boolean => {
+  if (!resourceMetadataUrl || extractBearerToken(req.headers.authorization)) return false
+  res.statusCode = 401
+  res.setHeader('WWW-Authenticate', buildBearerChallenge({ resourceMetadataUrl }))
+  res.setHeader('Content-Type', 'application/json')
+  res.end(
+    JSON.stringify({
+      error: 'unauthorized',
+      error_description:
+        'This endpoint requires an OAuth bearer token. Discover the authorization server through the resource_metadata URL in the WWW-Authenticate header.',
+    }),
+  )
+  return true
+}
diff --git a/packages/mcp-server/src/http-request-handler.ts b/packages/mcp-server/src/http-request-handler.ts
index 793d28f6..eda66f51 100644
--- a/packages/mcp-server/src/http-request-handler.ts
+++ b/packages/mcp-server/src/http-request-handler.ts
@@ -3,7 +3,14 @@ import type { IncomingMessage, ServerResponse } from 'node:http'
 import type { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js'
 import type { SevLogger } from '@transloadit/sev-logger'
 
-import { applyCorsHeaders, isAuthorized, normalizePath, parsePathname } from './http-helpers.ts'
+import {
+  applyCorsHeaders,
+  normalizePath,
+  parsePathname,
+  rejectMissingBearerToken,
+  rejectMissingMcpToken,
+  resolveAllowedOrigins,
+} from './http-helpers.ts'
 import { buildRedactor, getLogger } from './logger.ts'
 
 type PathPolicy = {
@@ -14,6 +21,7 @@ type PathPolicy = {
 type RequestHandlerOptions = {
   allowedOrigins?: string[]
   mcpToken?: string
+  resourceMetadataUrl?: string
   path: PathPolicy
   logger?: SevLogger
   redactSecrets?: Array<string | undefined>
@@ -27,6 +35,7 @@ export const createMcpRequestHandler = (
   const allowRoot = options.path.allowRoot ?? false
   const logger = options.logger ?? getLogger().nest('http')
   const redact = buildRedactor(options.redactSecrets ?? [])
+  const allowedOrigins = resolveAllowedOrigins(options)
 
   return async (req: IncomingMessage, res: ServerResponse) => {
     const pathname = normalizePath(parsePathname(req.url, expectedPath))
@@ -36,7 +45,7 @@ export const createMcpRequestHandler = (
       return
     }
 
-    if (!applyCorsHeaders(req, res, options.allowedOrigins)) {
+    if (!applyCorsHeaders(req, res, allowedOrigins)) {
       return
     }
 
@@ -46,10 +55,7 @@ export const createMcpRequestHandler = (
       return
     }
 
-    if (options.mcpToken && !isAuthorized(req, options.mcpToken)) {
-      res.statusCode = 401
-      res.setHeader('WWW-Authenticate', 'Bearer')
-      res.end('Unauthorized')
+    if (rejectMissingMcpToken(req, res, options.mcpToken)) {
       return
     }
 
@@ -71,6 +77,10 @@ export const createMcpRequestHandler = (
       return
     }
 
+    if (rejectMissingBearerToken(req, res, options.resourceMetadataUrl)) {
+      return
+    }
+
     try {
       const parsedBody = (req as { body?: unknown }).body
       await transport.handleRequest(req, res, parsedBody)
diff --git a/packages/mcp-server/src/http.ts b/packages/mcp-server/src/http.ts
index e3f551bd..9ceb26cc 100644
--- a/packages/mcp-server/src/http.ts
+++ b/packages/mcp-server/src/http.ts
@@ -8,10 +8,12 @@ import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/
 
 import {
   applyCorsHeaders,
-  isAuthorized,
   isBasicAuthorized,
   normalizePath,
   parsePathname,
+  rejectMissingBearerToken,
+  rejectMissingMcpToken,
+  resolveAllowedOrigins,
 } from './http-helpers.ts'
 import { getMetrics, getMetricsContentType } from './metrics.ts'
 import { createTransloaditMcpServer } from './server.ts'
@@ -71,9 +73,14 @@ export function createTransloaditMcpHttpHandler(
   const metricsPath =
     options.metricsPath === false ? undefined : normalizePath(options.metricsPath ?? '/metrics')
   const metricsAuth = options.metricsAuth
+  const allowedOrigins = resolveAllowedOrigins(options)
 
   const serverCardJson = JSON.stringify(
-    buildServerCard(expectedPath, { authKey: options.authKey, authSecret: options.authSecret }),
+    buildServerCard(expectedPath, {
+      authKey: options.authKey,
+      authSecret: options.authSecret,
+      resourceMetadataUrl: options.resourceMetadataUrl,
+    }),
   )
 
   const handler = (async (req, res) => {
@@ -131,7 +138,7 @@ export function createTransloaditMcpHttpHandler(
       return
     }
 
-    if (!applyCorsHeaders(req, res, options.allowedOrigins)) {
+    if (!applyCorsHeaders(req, res, allowedOrigins)) {
       return
     }
 
@@ -141,10 +148,7 @@ export function createTransloaditMcpHttpHandler(
       return
     }
 
-    if (options.mcpToken && !isAuthorized(req, options.mcpToken)) {
-      res.statusCode = 401
-      res.setHeader('WWW-Authenticate', 'Bearer')
-      res.end('Unauthorized')
+    if (rejectMissingMcpToken(req, res, options.mcpToken)) {
       return
     }
 
@@ -165,6 +169,10 @@ export function createTransloaditMcpHttpHandler(
       return
     }
 
+    if (rejectMissingBearerToken(req, res, options.resourceMetadataUrl)) {
+      return
+    }
+
     if (req.method !== 'POST') {
       res.statusCode = 405
       res.setHeader('Content-Type', 'application/json')
diff --git a/packages/mcp-server/src/server-card.ts b/packages/mcp-server/src/server-card.ts
index 56b846d1..fc3ce221 100644
--- a/packages/mcp-server/src/server-card.ts
+++ b/packages/mcp-server/src/server-card.ts
@@ -1,16 +1,33 @@
+import type { ToolAnnotations } from '@modelcontextprotocol/sdk/types.js'
+
+import type { ToolName, ToolSecurityScheme } from './tool-metadata.ts'
+
 import { LATEST_PROTOCOL_VERSION } from '@modelcontextprotocol/sdk/types.js'
 
 import packageJson from '../package.json' with { type: 'json' }
+import { toolMetadata } from './tool-metadata.ts'
 
 export const serverCardPath = '/.well-known/mcp/server-card.json'
 
 type JsonSchemaObject = Record<string, unknown>
 
-type ServerCardToolDefinition = {
-  name: string
+type ServerCardToolInput = {
+  name: ToolName
+  inputSchema: JsonSchemaObject
+}
+
+type ServerCardToolDefinition = ServerCardToolInput & {
   title: string
   description: string
-  inputSchema: JsonSchemaObject
+  annotations: ToolAnnotations
+  securitySchemes: ToolSecurityScheme[]
+}
+
+type ServerCardAuthentication = {
+  required: boolean
+  schemes: string[]
+  /** RFC 9728 protected-resource metadata that names the OAuth authorization server. */
+  resourceMetadataUrl?: string
 }
 
 type ServerCard = {
@@ -22,17 +39,14 @@ type ServerCard = {
   documentationUrl: string
   iconUrl: string
   transport: { type: string; endpoint: string }
-  authentication?: { required: boolean; schemes: string[] }
-  capabilities: { tools: { listChanged: boolean } }
+  authentication?: ServerCardAuthentication
+  capabilities: { tools: { listChanged: boolean }; resources: { listChanged: boolean } }
   tools: ['dynamic'] | ServerCardToolDefinition[]
 }
 
-const tools: ServerCardToolDefinition[] = [
+const toolInputs: ServerCardToolInput[] = [
   {
     name: 'transloadit_lint_assembly_instructions',
-    title: 'Lint Assembly Instructions',
-    description:
-      'Lint Assembly Instructions without creating an Assembly. Returns structured issues.',
     inputSchema: {
       type: 'object',
       additionalProperties: false,
@@ -46,9 +60,6 @@ const tools: ServerCardToolDefinition[] = [
   },
   {
     name: 'transloadit_create_assembly',
-    title: 'Create or resume an Assembly',
-    description:
-      'Create or resume an Assembly, optionally uploading files and waiting for completion.',
     inputSchema: {
       type: 'object',
       additionalProperties: false,
@@ -58,6 +69,20 @@ const tools: ServerCardToolDefinition[] = [
           type: 'array',
           items: { type: 'object' },
         },
+        attachments: {
+          type: 'array',
+          items: {
+            type: 'object',
+            additionalProperties: false,
+            required: ['download_url', 'file_id'],
+            properties: {
+              download_url: { type: 'string' },
+              file_id: { type: 'string' },
+              mime_type: { type: 'string' },
+              file_name: { type: 'string' },
+            },
+          },
+        },
         fields: { type: 'object' },
         wait_for_completion: { type: 'boolean' },
         wait_timeout_ms: { type: 'number' },
@@ -71,8 +96,6 @@ const tools: ServerCardToolDefinition[] = [
   },
   {
     name: 'transloadit_get_assembly_status',
-    title: 'Get Assembly Status',
-    description: 'Fetch the latest Assembly status by URL or ID.',
     inputSchema: {
       type: 'object',
       additionalProperties: false,
@@ -84,8 +107,6 @@ const tools: ServerCardToolDefinition[] = [
   },
   {
     name: 'transloadit_wait_for_assembly',
-    title: 'Wait For Assembly Completion',
-    description: 'Polls until the Assembly completes or timeout is reached.',
     inputSchema: {
       type: 'object',
       additionalProperties: false,
@@ -99,8 +120,6 @@ const tools: ServerCardToolDefinition[] = [
   },
   {
     name: 'transloadit_list_robots',
-    title: 'List Robots',
-    description: 'Returns a filtered list of robots with short summaries.',
     inputSchema: {
       type: 'object',
       additionalProperties: false,
@@ -114,8 +133,6 @@ const tools: ServerCardToolDefinition[] = [
   },
   {
     name: 'transloadit_get_robot_help',
-    title: 'Get Robot Help',
-    description: 'Returns a robot summary and parameter details.',
     inputSchema: {
       type: 'object',
       additionalProperties: false,
@@ -127,9 +144,6 @@ const tools: ServerCardToolDefinition[] = [
   },
   {
     name: 'transloadit_list_templates',
-    title: 'List Templates',
-    description:
-      'List Assembly Templates (owned and/or builtin). Tip: pass include_builtin: "exclusively-latest" to list builtins only.',
     inputSchema: {
       type: 'object',
       additionalProperties: false,
@@ -147,13 +161,34 @@ const tools: ServerCardToolDefinition[] = [
       },
     },
   },
+  {
+    name: 'transloadit_get_profile',
+    inputSchema: {
+      type: 'object',
+      additionalProperties: false,
+      properties: {},
+    },
+  },
 ]
 
+const tools: ServerCardToolDefinition[] = toolInputs.map((tool) => {
+  const metadata = toolMetadata[tool.name]
+  return {
+    ...tool,
+    title: metadata.title,
+    description: metadata.description,
+    annotations: metadata.annotations,
+    securitySchemes: metadata.securitySchemes,
+  }
+})
+
 export const buildServerCard = (
   endpoint: string,
-  options: { authKey?: string; authSecret?: string } = {},
+  options: { authKey?: string; authSecret?: string; resourceMetadataUrl?: string } = {},
 ): ServerCard => {
   const hasCredentials = Boolean(options.authKey && options.authSecret)
+  // Hosted deployments hand out tokens through OAuth; self-hosted ones accept a static bearer.
+  const schemes = options.resourceMetadataUrl ? ['oauth2', 'bearer'] : ['bearer']
 
   return {
     $schema: 'https://static.modelcontextprotocol.io/schemas/mcp-server-card/v1.json',
@@ -174,10 +209,12 @@ export const buildServerCard = (
     },
     authentication: {
       required: !hasCredentials,
-      schemes: ['bearer'],
+      schemes,
+      ...(options.resourceMetadataUrl ? { resourceMetadataUrl: options.resourceMetadataUrl } : {}),
     },
     capabilities: {
       tools: { listChanged: false },
+      resources: { listChanged: false },
     },
     tools,
   }
diff --git a/packages/mcp-server/src/server.ts b/packages/mcp-server/src/server.ts
index f2d168e6..6cb3f970 100644
--- a/packages/mcp-server/src/server.ts
+++ b/packages/mcp-server/src/server.ts
@@ -1,9 +1,17 @@
+import type { ToolCallback } from '@modelcontextprotocol/sdk/server/mcp.js'
 import type { CallToolResult, TextContent } from '@modelcontextprotocol/sdk/types.js'
 import type {
   AssemblyInstructionsInput,
+  AssemblyStatus,
   CreateAssemblyParams,
+  InputFile,
   LintAssemblyInstructionsResult,
 } from '@transloadit/node'
+import type { ZodObject } from 'zod'
+
+import type { ListedTool } from './tool-list.ts'
+import type { ToolName } from './tool-metadata.ts'
+import type { WidgetContext } from './ui/assembly-result-widget.ts'
 
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'
 import {
@@ -19,12 +27,22 @@ import {
 import { z } from 'zod'
 
 import packageJson from '../package.json' with { type: 'json' }
-import { extractBearerToken } from './http-helpers.ts'
+import { buildBearerChallenge, extractBearerToken } from './http-helpers.ts'
+import { installToolListHandler } from './tool-list.ts'
+import { buildToolMeta, toolMetadata } from './tool-metadata.ts'
+import { registerAssemblyResultWidget, widgetContextMetaKey } from './ui/assembly-result-widget.ts'
 
 export type TransloaditMcpServerOptions = {
   authKey?: string
   authSecret?: string
   mcpToken?: string
+  /**
+   * Protected-resource metadata URL of the hosted deployment. When set, auth failures carry an
+   * RFC 6750 challenge that points OAuth clients at API2 (`TRANSLOADIT_MCP_RESOURCE_METADATA_URL`).
+   */
+  resourceMetadataUrl?: string
+  /** Console origin used for widget deep links; defaults to the public website. */
+  consoleUrl?: string
   endpoint?: string
   serverName?: string
   serverVersion?: string
@@ -32,6 +50,8 @@ export type TransloaditMcpServerOptions = {
   clientSuffix?: string
 }
 
+const defaultConsoleUrl = 'https://transloadit.com'
+
 type LintIssueOutput = {
   path: string
   message: string
@@ -149,9 +169,23 @@ const inputFileSchema = z.discriminatedUnion('kind', [
   }),
 ])
 
+// Exactly the file object ChatGPT hydrates for `_meta["openai/fileParams"]`: the two ids are
+// required, the descriptive fields optional, and nothing else is allowed.
+const hostFileSchema = z
+  .object({
+    download_url: z.string(),
+    file_id: z.string(),
+    mime_type: z.string().optional(),
+    file_name: z.string().optional(),
+  })
+  .strict()
+
+type HostFile = z.infer<typeof hostFileSchema>
+
 const createAssemblyInputSchema = z.object({
   instructions: z.unknown().optional(),
   files: z.array(inputFileSchema).optional(),
+  attachments: z.array(hostFileSchema).optional(),
   fields: z.record(z.string(), z.unknown()).optional(),
   wait_for_completion: z.boolean().optional(),
   wait_timeout_ms: z.number().int().positive().optional(),
@@ -245,6 +279,19 @@ const lintAssemblyOutputSchema = z.object({
   normalized_instructions: z.unknown().optional(),
 })
 
+const getProfileInputSchema = z.object({}).strict()
+
+// Shape ChatGPT expects from a profile tool: an opaque stable id plus optional display fields.
+const getProfileOutputSchema = z
+  .object({
+    id: z.string().min(1).regex(/\S/),
+    name: z.string().optional(),
+    nickname: z.string().optional(),
+  })
+  .strict()
+
+type WorkspaceProfile = z.infer<typeof getProfileOutputSchema>
+
 const toLintIssues = (issues: LintAssemblyInstructionsResult['issues']): LintIssueOutput[] =>
   issues.map((issue) => ({
     path: issue.stepName ? `steps.${issue.stepName}` : 'instructions',
@@ -261,7 +308,16 @@ const safeJsonParse = (value: string): unknown => {
   }
 }
 
-const buildToolResponse = (payload: Record<string, unknown>): CallToolResult => {
+type ToolResponseExtras = {
+  /** Result `_meta`, delivered to widgets and hosts but hidden from the model. */
+  meta?: Record<string, unknown>
+  isError?: boolean
+}
+
+const buildToolResponse = (
+  payload: Record<string, unknown>,
+  extras: ToolResponseExtras = {},
+): CallToolResult => {
   const content: TextContent = {
     type: 'text',
     text: JSON.stringify(payload),
@@ -270,9 +326,54 @@ const buildToolResponse = (payload: Record<string, unknown>): CallToolResult =>
   return {
     content: [content],
     structuredContent: payload,
+    ...(extras.isError ? { isError: true } : {}),
+    ...(extras.meta ? { _meta: extras.meta } : {}),
   }
 }
 
+type AuthErrorInput = {
+  code: 'mcp_missing_auth' | 'mcp_auth_rejected' | 'mcp_insufficient_scope'
+  oauthError: 'invalid_token' | 'insufficient_scope'
+  message: string
+  hint?: string
+}
+
+/**
+ * Tool-level auth failure. `_meta["mcp/www_authenticate"]` mirrors the HTTP challenge so ChatGPT
+ * and Claude open their account-linking UI; the text content keeps the reason readable.
+ */
+const buildAuthError = (
+  options: TransloaditMcpServerOptions,
+  input: AuthErrorInput,
+): CallToolResult =>
+  buildToolResponse(
+    {
+      status: 'error',
+      errors: [{ code: input.code, message: input.message, hint: input.hint }],
+    },
+    {
+      isError: true,
+      meta: {
+        'mcp/www_authenticate': [
+          buildBearerChallenge({
+            resourceMetadataUrl: options.resourceMetadataUrl,
+            error: { code: input.oauthError, description: input.message },
+          }),
+        ],
+      },
+    },
+  )
+
+const buildMissingAuthError = (options: TransloaditMcpServerOptions): CallToolResult =>
+  buildAuthError(options, {
+    code: 'mcp_missing_auth',
+    oauthError: 'insufficient_scope',
+    message: 'Sign in to Transloadit to use this tool.',
+    hint: options.resourceMetadataUrl
+      ? 'Connect your Transloadit account through OAuth, then retry.'
+      : 'Set TRANSLOADIT_KEY/TRANSLOADIT_SECRET or send an Authorization: Bearer token.',
+  })
+
 const buildToolError = (
   code: string,
   message: string,
@@ -344,12 +445,7 @@ const createLiveClient = (
   }
 
   if (!options.authKey || !options.authSecret) {
-    return {
-      error: buildToolError(
-        'mcp_missing_auth',
-        'Missing TRANSLOADIT_KEY/TRANSLOADIT_SECRET or Authorization: Bearer token for live API calls.',
-      ),
-    }
+    return { error: buildMissingAuthError(options) }
   }
 
   return {
@@ -397,6 +493,63 @@ const getHttpStatusCode = (error: unknown): number | undefined => {
 const isErrnoException = (value: unknown): value is NodeJS.ErrnoException =>
   isRecord(value) && typeof value.code === 'string'
 
+/**
+ * Maps API2 rejections of the forwarded credentials to a tool auth error. Other failures are
+ * left to the caller so they keep surfacing as ordinary tool errors.
+ */
+const toAuthRejection = (
+  options: TransloaditMcpServerOptions,
+  error: unknown,
+): CallToolResult | undefined => {
+  const status = getHttpStatusCode(error)
+  if (status === 401) {
+    return buildAuthError(options, {
+      code: 'mcp_auth_rejected',
+      oauthError: 'invalid_token',
+      message: 'Transloadit rejected the credentials; the token may have expired.',
+      hint: 'Reconnect your Transloadit account and retry.',
+    })
+  }
+  const scopeRejected =
+    status === 403 && error instanceof ApiError && /SCOPE|BEARER_TOKEN/.test(error.code ?? '')
+  if (scopeRejected) {
+    return buildAuthError(options, {
+      code: 'mcp_insufficient_scope',
+      oauthError: 'insufficient_scope',
+      message: 'The connected credentials lack the scope this tool needs.',
+      hint: 'Reconnect your Transloadit account and grant the requested access.',
+    })
+  }
+  return undefined
+}
+
+const trimTrailingSlash = (value: string): string => value.replace(/\/$/, '')
+
+/** Widget-only context: whether the caller is signed in and where the Console deep links go. */
+const buildWidgetContext = (
+  options: TransloaditMcpServerOptions,
+  assembly: AssemblyStatus,
+): WidgetContext => {
+  const consoleUrl = trimTrailingSlash(options.consoleUrl || defaultConsoleUrl)
+  const slug = isNonEmptyString(assembly.account_slug) ? assembly.account_slug : undefined
+  const assemblyId = isNonEmptyString(assembly.assembly_id) ? assembly.assembly_id : undefined
+  const templateId = isNonEmptyString(assembly.template_id) ? assembly.template_id : undefined
+  if (!slug) return { authenticated: true }
+
+  const workspaceUrl = `${consoleUrl}/c/${encodeURIComponent(slug)}`
+  const newTemplateUrl = new URL(`${workspaceUrl}/templates/new`)
+  if (templateId && !isBuiltinTemplateId(templateId)) {
+    newTemplateUrl.searchParams.set('duplicateFrom', templateId)
+  }
+  return {
+    authenticated: true,
+    assembly_console_url: assemblyId
+      ? `${workspaceUrl}/assemblies/${encodeURIComponent(assemblyId)}`
+      : undefined,
+    new_template_url: newTemplateUrl.toString(),
+  }
+}
+
 const isHttpImportStep = (value: unknown): value is Record<string, unknown> =>
   isRecord(value) && value.robot === '/http/import'
 
@@ -571,6 +724,7 @@ const apiTemplateSchema = z
     description: z.string().optional(),
     builtin_version: z.string().optional(),
     content: z.unknown().optional(),
+    account_id: z.string().nullable().optional(),
   })
   .passthrough()
 
@@ -614,6 +768,47 @@ const loadTemplateSteps = async (
   return extractTemplateSteps(full.content)
 }
 
+/**
+ * API2 has no userinfo endpoint yet, so the Workspace behind the credentials is read from the
+ * caller's own Assemblies (id, name and slug) or, failing that, from an owned Template (id only).
+ */
+const resolveWorkspaceProfile = async (
+  client: Transloadit,
+): Promise<WorkspaceProfile | undefined> => {
+  const assemblies = await client.listAssemblies({ pagesize: 1 })
+  const latest = assemblies.items[0]
+  if (latest?.id) {
+    const status = await client.getAssembly(latest.id)
+    const id = isNonEmptyString(status.account_id) ? status.account_id : latest.account_id
+    if (isNonEmptyString(id)) {
+      return {
+        id,
+        name: isNonEmptyString(status.account_name) ? status.account_name : undefined,
+        nickname: isNonEmptyString(status.account_slug) ? status.account_slug : undefined,
+      }
+    }
+  }
+
+  const templates = listTemplatesResponseSchema.safeParse(
+    await client.listTemplates({ pagesize: 1 }),
+  )
+  const template = templates.success ? templates.data.items?.[0] : undefined
+  if (template && isNonEmptyString(template.account_id)) {
+    return { id: template.account_id }
+  }
+  return undefined
+}
+
+/** Host-attached files become URL inputs; `file_id` is opaque, so the field name is positional. */
+const toAttachmentInputs = (attachments: HostFile[]): InputFile[] =>
+  attachments.map((attachment, index) => ({
+    kind: 'url',
+    field: `attachment_${index + 1}`,
+    url: attachment.download_url,
+    filename: attachment.file_name,
+    contentType: attachment.mime_type,
+  }))
+
 const looksLikeAssemblyParams = (input: Record<string, unknown>): boolean => {
   return (
     'steps' in input ||
@@ -656,16 +851,40 @@ export const createTransloaditMcpServer = (
     version: options.serverVersion ?? packageJson.version,
   })
 
+  const listedTools: ListedTool[] = []
+  const register = <Input extends ZodObject, Output extends ZodObject>(
+    name: ToolName,
+    inputSchema: Input,
+    outputSchema: Output,
+    callback: ToolCallback<Input>,
+  ): void => {
+    const metadata = toolMetadata[name]
+    const registered = server.registerTool(
+      name,
+      {
+        title: metadata.title,
+        description: metadata.description,
+        inputSchema,
+        outputSchema,
+        annotations: metadata.annotations,
+        _meta: buildToolMeta(metadata),
+      },
+      callback,
+    )
+    listedTools.push({
+      name,
+      inputSchema,
+      outputSchema,
+      securitySchemes: metadata.securitySchemes,
+      registered,
+    })
+  }
+
   // Builtin templates supersede the old golden template tool; no legacy alias by design.
-  server.registerTool(
+  register(
     'transloadit_lint_assembly_instructions',
-    {
-      title: 'Lint Assembly Instructions',
-      description:
-        'Lint Assembly Instructions without creating an Assembly. Returns structured issues.',
-      inputSchema: lintAssemblyInputSchema,
-      outputSchema: lintAssemblyOutputSchema,
-    },
+    lintAssemblyInputSchema,
+    lintAssemblyOutputSchema,
     async ({ instructions, strict, return_fixed }) => {
       const client = createLintClient(options)
       const assemblyInstructions =
@@ -689,19 +908,15 @@ export const createTransloaditMcpServer = (
     },
   )
 
-  server.registerTool(
+  register(
     'transloadit_create_assembly',
-    {
-      title: 'Create or resume an Assembly',
-      description:
-        'Create or resume an Assembly, optionally uploading files and waiting for completion.',
-      inputSchema: createAssemblyInputSchema,
-      outputSchema: createAssemblyOutputSchema,
-    },
+    createAssemblyInputSchema,
+    createAssemblyOutputSchema,
     async (
       {
         instructions,
         files,
+        attachments,
         fields,
         wait_for_completion,
         wait_timeout_ms,
@@ -724,7 +939,7 @@ export const createTransloaditMcpServer = (
       let templatePathHint: string | undefined
 
       try {
-        const fileInputs = files ?? []
+        const fileInputs: InputFile[] = [...(files ?? []), ...toAttachmentInputs(attachments ?? [])]
         const urlInputs = fileInputs.filter((file) => file.kind === 'url')
         const hasUrlInputs = urlInputs.length > 0
         let inputFilesForPrep = fileInputs
@@ -940,32 +1155,42 @@ export const createTransloaditMcpServer = (
           ? []
           : ['transloadit_wait_for_assembly', 'transloadit_get_assembly_status']
 
-        return buildToolResponse({
-          status: 'ok',
-          assembly,
-          upload: uploadSummary,
-          next_steps: nextSteps,
-          warnings: warnings.length > 0 ? warnings : undefined,
-        })
+        return buildToolResponse(
+          {
+            status: 'ok',
+            assembly,
+            upload: uploadSummary,
+            next_steps: nextSteps,
+            warnings: warnings.length > 0 ? warnings : undefined,
+          },
+          { meta: { [widgetContextMetaKey]: buildWidgetContext(options, assembly) } },
+        )
+      } catch (error) {
+        const rejection = toAuthRejection(options, error)
+        if (rejection) return rejection
+        throw error
       } finally {
         await Promise.all(tempCleanups.map((cleanup) => cleanup()))
       }
     },
   )
 
-  server.registerTool(
+  register(
     'transloadit_get_assembly_status',
-    {
-      title: 'Get Assembly status',
-      description: 'Fetch the latest Assembly status by URL or ID.',
-      inputSchema: getAssemblyStatusInputSchema,
-      outputSchema: getAssemblyStatusOutputSchema,
-    },
+    getAssemblyStatusInputSchema,
+    getAssemblyStatusOutputSchema,
     async ({ assembly_url, assembly_id }, extra) => {
       const access = resolveAssemblyAccess(options, extra, { assembly_url, assembly_id })
       if ('error' in access) return access.error
 
-      const assembly = await access.client.getAssembly(access.assemblyId)
+      let assembly: AssemblyStatus
+      try {
+        assembly = await access.client.getAssembly(access.assemblyId)
+      } catch (error) {
+        const rejection = toAuthRejection(options, error)
+        if (rejection) return rejection
+        throw error
+      }
 
       return buildToolResponse({
         status: 'ok',
@@ -974,42 +1199,44 @@ export const createTransloaditMcpServer = (
     },
   )
 
-  server.registerTool(
+  register(
     'transloadit_wait_for_assembly',
-    {
-      title: 'Wait for Assembly completion',
-      description: 'Polls until the Assembly completes or timeout is reached.',
-      inputSchema: waitForAssemblyInputSchema,
-      outputSchema: waitForAssemblyOutputSchema,
-    },
+    waitForAssemblyInputSchema,
+    waitForAssemblyOutputSchema,
     async ({ assembly_url, assembly_id, timeout_ms, poll_interval_ms }, extra) => {
       const access = resolveAssemblyAccess(options, extra, { assembly_url, assembly_id })
       if ('error' in access) return access.error
 
       const start = Date.now()
-      const assembly = await access.client.awaitAssemblyCompletion(access.assemblyId, {
-        timeout: timeout_ms,
-        interval: poll_interval_ms,
-        assemblyUrl: access.assemblyUrl,
-      })
+      let assembly: AssemblyStatus
+      try {
+        assembly = await access.client.awaitAssemblyCompletion(access.assemblyId, {
+          timeout: timeout_ms,
+          interval: poll_interval_ms,
+          assemblyUrl: access.assemblyUrl,
+        })
+      } catch (error) {
+        const rejection = toAuthRejection(options, error)
+        if (rejection) return rejection
+        throw error
+      }
       const waited_ms = Date.now() - start
 
-      return buildToolResponse({
-        status: 'ok',
-        assembly,
-        waited_ms,
-      })
+      return buildToolResponse(
+        {
+          status: 'ok',
+          assembly,
+          waited_ms,
+        },
+        { meta: { [widgetContextMetaKey]: buildWidgetContext(options, assembly) } },
+      )
     },
   )
 
-  server.registerTool(
+  register(
     'transloadit_list_robots',
-    {
-      title: 'List Transloadit robots',
-      description: 'Returns a filtered list of robots with short summaries.',
-      inputSchema: listRobotsInputSchema,
-      outputSchema: listRobotsOutputSchema,
-    },
+    listRobotsInputSchema,
+    listRobotsOutputSchema,
     ({ category, search, limit, cursor }) => {
       const result = listRobots({ category, search, limit, cursor })
 
@@ -1021,14 +1248,10 @@ export const createTransloaditMcpServer = (
     },
   )
 
-  server.registerTool(
+  register(
     'transloadit_get_robot_help',
-    {
-      title: 'Get robot parameter help',
-      description: 'Returns a robot summary and parameter details.',
-      inputSchema: getRobotHelpInputSchema,
-      outputSchema: getRobotHelpOutputSchema,
-    },
+    getRobotHelpInputSchema,
+    getRobotHelpOutputSchema,
     ({ robot_name, robot_names }) => {
       const splitComma = (value: string): string[] =>
         value
@@ -1094,30 +1317,13 @@ export const createTransloaditMcpServer = (
     },
   )
 
-  server.registerTool(
+  register(
     'transloadit_list_templates',
-    {
-      title: 'List templates',
-      description:
-        'List Assembly Templates (owned and/or builtin). Tip: pass include_builtin: "exclusively-latest" to list builtins only.',
-      inputSchema: listTemplatesInputSchema,
-      outputSchema: listTemplatesOutputSchema,
-    },
+    listTemplatesInputSchema,
+    listTemplatesOutputSchema,
     async ({ page, page_size, sort, order, keywords, include_builtin, include_content }, extra) => {
       const liveClient = createLiveClient(options, extra)
-      if ('error' in liveClient) {
-        return buildToolResponse({
-          status: 'error',
-          templates: [],
-          errors: [
-            {
-              code: 'mcp_missing_auth',
-              message:
-                'Missing TRANSLOADIT_KEY/TRANSLOADIT_SECRET or Authorization: Bearer token for live API calls.',
-            },
-          ],
-        })
-      }
+      if ('error' in liveClient) return liveClient.error
 
       try {
         const response = await liveClient.client.listTemplates({
@@ -1153,6 +1359,8 @@ export const createTransloaditMcpServer = (
           total: parsed.data.count ?? items.length,
         })
       } catch (error) {
+        const rejection = toAuthRejection(options, error)
+        if (rejection) return rejection
         const message = error instanceof Error ? error.message : 'Failed to list templates.'
         return buildToolResponse({
           status: 'error',
@@ -1168,5 +1376,45 @@ export const createTransloaditMcpServer = (
     },
   )
 
+  register(
+    'transloadit_get_profile',
+    getProfileInputSchema,
+    getProfileOutputSchema,
+    async (_args, extra) => {
+      const liveClient = createLiveClient(options, extra)
+      if ('error' in liveClient) return liveClient.error
+
+      let profile: WorkspaceProfile | undefined
+      try {
+        profile = await resolveWorkspaceProfile(liveClient.client)
+      } catch (error) {
+        const rejection = toAuthRejection(options, error)
+        if (rejection) return rejection
+        throw error
+      }
+
+      if (!profile) {
+        // The strict profile output schema has no error shape, so this must be an error result.
+        return buildToolResponse(
+          {
+            status: 'error',
+            errors: [
+              {
+                code: 'mcp_profile_unavailable',
+                message: 'Could not determine the Workspace behind these credentials yet.',
+                hint: 'Create an Assembly or a Template first, then call this tool again.',
+              },
+            ],
+          },
+          { isError: true },
+        )
+      }
+      return buildToolResponse(profile)
+    },
+  )
+
+  registerAssemblyResultWidget(server)
+  installToolListHandler(server, listedTools)
+
   return server
 }
diff --git a/packages/mcp-server/src/tool-list.ts b/packages/mcp-server/src/tool-list.ts
new file mode 100644
index 00000000..67538c31
--- /dev/null
+++ b/packages/mcp-server/src/tool-list.ts
@@ -0,0 +1,64 @@
+import type { McpServer, RegisteredTool } from '@modelcontextprotocol/sdk/server/mcp.js'
+import type { Tool } from '@modelcontextprotocol/sdk/types.js'
+import type { ZodObject } from 'zod'
+
+import type { ToolSecurityScheme } from './tool-metadata.ts'
+
+import { ListToolsRequestSchema } from '@modelcontextprotocol/sdk/types.js'
+import { z } from 'zod'
+
+export type ListedTool = {
+  name: string
+  inputSchema: ZodObject
+  outputSchema: ZodObject
+  securitySchemes: ToolSecurityScheme[]
+  registered: RegisteredTool
+}
+
+type ListedToolDefinition = Tool & { securitySchemes: ToolSecurityScheme[] }
+
+// Same options the SDK passes to Zod for v4 schemas, so the advertised schemas stay identical.
+const jsonSchemaTarget = 'draft-7'
+
+const toObjectJsonSchema = (schema: ZodObject, io: 'input' | 'output'): Tool['inputSchema'] => {
+  const jsonSchema = z.toJSONSchema(schema, { target: jsonSchemaTarget, io })
+  // Zod types the payload loosely (any schema kind, boolean sub-schemas); a ZodObject always
+  // serializes to an object schema with object properties, so this only narrows the type.
+  if (jsonSchema.type !== 'object') {
+    throw new Error(`Expected an object JSON schema, received ${String(jsonSchema.type)}`)
+  }
+  const properties: Record<string, object> = {}
+  for (const [key, value] of Object.entries(jsonSchema.properties ?? {})) {
+    if (typeof value === 'object') properties[key] = value
+  }
+  return { ...jsonSchema, type: 'object', properties }
+}
+
+const toToolDefinition = ({
+  name,
+  inputSchema,
+  outputSchema,
+  securitySchemes,
+  registered,
+}: ListedTool): ListedToolDefinition => ({
+  name,
+  title: registered.title,
+  description: registered.description,
+  inputSchema: toObjectJsonSchema(inputSchema, 'input'),
+  outputSchema: toObjectJsonSchema(outputSchema, 'output'),
+  annotations: registered.annotations,
+  execution: registered.execution,
+  _meta: registered._meta,
+  securitySchemes,
+})
+
+/**
+ * Replaces the SDK's `tools/list` handler so every tool also carries the top-level
+ * `securitySchemes` field, which `registerTool()` has no way to emit. The definitions are built
+ * the same way the SDK builds them; only the extra field differs.
+ */
+export const installToolListHandler = (server: McpServer, tools: ListedTool[]): void => {
+  server.server.setRequestHandler(ListToolsRequestSchema, () => ({
+    tools: tools.filter((tool) => tool.registered.enabled).map(toToolDefinition),
+  }))
+}
diff --git a/packages/mcp-server/src/tool-metadata.ts b/packages/mcp-server/src/tool-metadata.ts
new file mode 100644
index 00000000..ef59a497
--- /dev/null
+++ b/packages/mcp-server/src/tool-metadata.ts
@@ -0,0 +1,151 @@
+import type { ToolAnnotations } from '@modelcontextprotocol/sdk/types.js'
+
+import { assemblyResultWidgetUri } from './ui/assembly-result-widget.ts'
+
+/** Auth Key scopes the hosted tools need; mirrors API2's `safeMcpScopes` allowlist. */
+export const mcpScopes = {
+  assembliesRead: 'assemblies:read',
+  assembliesWrite: 'assemblies:write',
+  templatesRead: 'templates:read',
+} as const
+
+/** Per-tool security scheme as read by ChatGPT and Claude (MCP draft `securitySchemes`). */
+export type ToolSecurityScheme = { type: 'noauth' } | { type: 'oauth2'; scopes: string[] }
+
+export const toolNames = [
+  'transloadit_lint_assembly_instructions',
+  'transloadit_create_assembly',
+  'transloadit_get_assembly_status',
+  'transloadit_wait_for_assembly',
+  'transloadit_list_robots',
+  'transloadit_get_robot_help',
+  'transloadit_list_templates',
+  'transloadit_get_profile',
+] as const
+
+export type ToolName = (typeof toolNames)[number]
+
+export type ToolMetadata = {
+  title: string
+  description: string
+  annotations: ToolAnnotations
+  securitySchemes: ToolSecurityScheme[]
+  /** Host-specific `_meta` keys (OpenAI, MCP Apps). `securitySchemes` is mirrored in automatically. */
+  meta?: Record<string, unknown>
+}
+
+const noAuth: ToolSecurityScheme = { type: 'noauth' }
+
+const oauth2 = (...scopes: string[]): ToolSecurityScheme => ({ type: 'oauth2', scopes })
+
+const readOnly: ToolAnnotations = {
+  readOnlyHint: true,
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: false,
+}
+
+const widgetMeta = {
+  ui: { resourceUri: assemblyResultWidgetUri },
+  'openai/outputTemplate': assemblyResultWidgetUri,
+}
+
+/** Names of the hosted tools whose results render in the Assembly result widget. */
+export const widgetToolNames: readonly ToolName[] = [
+  'transloadit_create_assembly',
+  'transloadit_wait_for_assembly',
+]
+
+/**
+ * Titles, descriptions, annotations and security schemes for every tool, shared by the live
+ * server and the static server card so the two never drift.
+ */
+export const toolMetadata: Record<ToolName, ToolMetadata> = {
+  transloadit_lint_assembly_instructions: {
+    title: 'Lint Assembly Instructions',
+    description:
+      'Lint Assembly Instructions without creating an Assembly. Returns structured issues.',
+    annotations: readOnly,
+    securitySchemes: [noAuth],
+  },
+  transloadit_create_assembly: {
+    title: 'Create or resume an Assembly',
+    description:
+      'Create or resume an Assembly, optionally uploading files and waiting for completion. Files attached in the chat arrive under attachments; public URLs and small base64 payloads go under files.',
+    annotations: {
+      readOnlyHint: false,
+      // Creating an Assembly is billable but never deletes or overwrites customer data.
+      destructiveHint: false,
+      idempotentHint: false,
+      // URL inputs and /http/import Steps fetch caller-supplied locations.
+      openWorldHint: true,
+    },
+    securitySchemes: [oauth2(mcpScopes.assembliesWrite)],
+    meta: {
+      ...widgetMeta,
+      'openai/fileParams': ['attachments'],
+      'openai/toolInvocation/invoking': 'Processing files with Transloadit…',
+      'openai/toolInvocation/invoked': 'Transloadit processed the files',
+    },
+  },
+  transloadit_get_assembly_status: {
+    title: 'Get Assembly status',
+    description: 'Fetch the latest Assembly status by URL or ID.',
+    annotations: readOnly,
+    securitySchemes: [oauth2(mcpScopes.assembliesRead)],
+    meta: {
+      'openai/toolInvocation/invoking': 'Checking the Assembly status…',
+      'openai/toolInvocation/invoked': 'Fetched the Assembly status',
+    },
+  },
+  transloadit_wait_for_assembly: {
+    title: 'Wait for Assembly completion',
+    description: 'Polls until the Assembly completes or timeout is reached.',
+    annotations: readOnly,
+    securitySchemes: [oauth2(mcpScopes.assembliesRead)],
+    meta: {
+      ...widgetMeta,
+      'openai/toolInvocation/invoking': 'Waiting for the Assembly to finish…',
+      'openai/toolInvocation/invoked': 'The Assembly finished',
+    },
+  },
+  transloadit_list_robots: {
+    title: 'List Transloadit Robots',
+    description: 'Returns a filtered list of Robots with short summaries.',
+    annotations: readOnly,
+    securitySchemes: [noAuth],
+  },
+  transloadit_get_robot_help: {
+    title: 'Get Robot parameter help',
+    description: 'Returns a Robot summary and parameter details.',
+    annotations: readOnly,
+    securitySchemes: [noAuth],
+  },
+  transloadit_list_templates: {
+    title: 'List Templates',
+    description:
+      'List Assembly Templates (owned and/or builtin). Tip: pass include_builtin: "exclusively-latest" to list builtins only.',
+    annotations: readOnly,
+    securitySchemes: [oauth2(mcpScopes.templatesRead)],
+    meta: {
+      'openai/toolInvocation/invoking': 'Listing Templates…',
+      'openai/toolInvocation/invoked': 'Listed Templates',
+    },
+  },
+  transloadit_get_profile: {
+    title: 'Get connected Workspace',
+    description:
+      'Returns a stable identifier and name for the Transloadit Workspace behind the current credentials, so hosts can tell connected accounts apart.',
+    annotations: readOnly,
+    securitySchemes: [oauth2()],
+    meta: {
+      'openai/profile': true,
+    },
+  },
+}
+
+/** `_meta` for `tools/list`: mirrors `securitySchemes` for hosts that only read `_meta`. */
+export const buildToolMeta = (metadata: ToolMetadata): Record<string, unknown> => ({
+  securitySchemes: metadata.securitySchemes,
+  ...metadata.meta,
+})
diff --git a/packages/mcp-server/src/ui/assembly-result-widget.ts b/packages/mcp-server/src/ui/assembly-result-widget.ts
new file mode 100644
index 00000000..9d4df7b2
--- /dev/null
+++ b/packages/mcp-server/src/ui/assembly-result-widget.ts
@@ -0,0 +1,356 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'
+
+import packageJson from '../../package.json' with { type: 'json' }
+
+/** MCP Apps resource that renders `transloadit_create_assembly` and `transloadit_wait_for_assembly` results. */
+export const assemblyResultWidgetUri = 'ui://transloadit/assembly-result'
+
+/** Mime type the MCP Apps spec requires for UI resources. */
+export const assemblyResultWidgetMimeType = 'text/html;profile=mcp-app'
+
+/** Origins that serve Assembly result files (temporary result buckets, demos, Console). */
+export const assemblyResultOrigins = ['https://*.transloadit.com', 'https://*.transloadit.net']
+
+/** Result `_meta` key that carries widget-only context (never read by the model). */
+export const widgetContextMetaKey = 'transloadit/widget'
+
+export type WidgetContext = {
+  authenticated: boolean
+  assembly_console_url?: string
+  new_template_url?: string
+}
+
+const widgetDescription =
+  'Shows each Assembly Step with image, video and audio previews, download links for every result file, and a Save as Template shortcut when the caller is signed in.'
+
+/** Resource `_meta` in both the MCP Apps form and the legacy ChatGPT aliases. */
+export const assemblyResultWidgetMeta = {
+  ui: {
+    csp: {
+      connectDomains: assemblyResultOrigins,
+      resourceDomains: assemblyResultOrigins,
+    },
+    prefersBorder: true,
+  },
+  'openai/widgetDescription': widgetDescription,
+  'openai/widgetCSP': {
+    connect_domains: assemblyResultOrigins,
+    resource_domains: assemblyResultOrigins,
+  },
+  'openai/widgetPrefersBorder': true,
+}
+
+/**
+ * The widget document. Everything is inline (no external scripts) so it runs under the
+ * restrictive default MCP Apps sandbox CSP; the host only needs to allow result origins.
+ */
+export const assemblyResultWidgetHtml = `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Transloadit Assembly result</title>
+<style>
+  :root {
+    color-scheme: light dark;
+    --fg: #1a1d21; --muted: #5f6672; --bg: #ffffff; --card: #f5f7fa; --border: #e1e5eb; --accent: #1b61a7; --ok: #1f8a4c; --err: #c0392b;
+  }
+  :root[data-theme="dark"] {
+    --fg: #f1f3f5; --muted: #a2a8b3; --bg: #121417; --card: #1b1e23; --border: #2c313a; --accent: #7db8f2; --ok: #5ccf8a; --err: #f28b7d;
+  }
+  @media (prefers-color-scheme: dark) {
+    :root:not([data-theme="light"]) {
+      --fg: #f1f3f5; --muted: #a2a8b3; --bg: #121417; --card: #1b1e23; --border: #2c313a; --accent: #7db8f2; --ok: #5ccf8a; --err: #f28b7d;
+    }
+  }
+  * { box-sizing: border-box; }
+  body { margin: 0; padding: 12px; font: 14px/1.45 system-ui, -apple-system, "Segoe UI", Roboto, sans-serif; color: var(--fg); background: var(--bg); }
+  a { color: var(--accent); }
+  header { display: flex; flex-wrap: wrap; align-items: center; gap: 8px 12px; margin-bottom: 12px; }
+  header h1 { font-size: 15px; margin: 0; }
+  .badge { font-size: 12px; padding: 2px 8px; border-radius: 999px; border: 1px solid var(--border); }
+  .badge.ok { color: var(--ok); border-color: var(--ok); }
+  .badge.err { color: var(--err); border-color: var(--err); }
+  .actions { margin-left: auto; display: flex; gap: 8px; }
+  .button { display: inline-block; padding: 6px 12px; border-radius: 6px; border: 1px solid var(--accent); background: var(--accent); color: #fff; text-decoration: none; font-size: 13px; cursor: pointer; }
+  .button.secondary { background: transparent; color: var(--accent); }
+  section.step { border: 1px solid var(--border); border-radius: 8px; padding: 10px 12px; margin-bottom: 10px; background: var(--card); }
+  section.step h2 { font-size: 13px; margin: 0 0 8px; font-weight: 600; }
+  section.step h2 code { font-weight: 600; }
+  .files { display: grid; grid-template-columns: repeat(auto-fill, minmax(180px, 1fr)); gap: 10px; }
+  figure { margin: 0; border: 1px solid var(--border); border-radius: 6px; background: var(--bg); overflow: hidden; }
+  figure .preview { display: flex; align-items: center; justify-content: center; min-height: 72px; max-height: 220px; background: #0000000d; }
+  figure img, figure video { display: block; max-width: 100%; max-height: 220px; }
+  figure audio { width: 100%; }
+  figure .file { padding: 12px; font-size: 24px; color: var(--muted); }
+  figcaption { padding: 6px 8px; font-size: 12px; }
+  figcaption .name { display: block; font-weight: 600; word-break: break-all; }
+  .muted { color: var(--muted); }
+  .error { color: var(--err); }
+  details { margin-top: 10px; font-size: 12px; }
+  pre { white-space: pre-wrap; word-break: break-word; font-size: 11px; background: var(--card); padding: 8px; border-radius: 6px; }
+</style>
+</head>
+<body>
+<main id="app"><p class="muted">Waiting for the Assembly result…</p></main>
+<script>
+(() => {
+  const app = document.getElementById('app')
+  const widgetVersion = ${JSON.stringify(packageJson.version)}
+  const contextKey = ${JSON.stringify(widgetContextMetaKey)}
+  const hostCapabilities = { openLinks: false }
+
+  const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value)
+  const text = (value) => (typeof value === 'string' ? value : '')
+
+  const safeUrl = (value) => {
+    if (typeof value !== 'string') return null
+    try {
+      const url = new URL(value)
+      return url.protocol === 'https:' || url.protocol === 'http:' ? url.href : null
+    } catch {
+      return null
+    }
+  }
+
+  const el = (tag, props, children) => {
+    const node = document.createElement(tag)
+    for (const [key, value] of Object.entries(props || {})) {
+      if (value === undefined || value === null) continue
+      if (key === 'className') node.className = value
+      else if (key === 'text') node.textContent = value
+      else node.setAttribute(key, value)
+    }
+    for (const child of children || []) {
+      if (child) node.append(child)
+    }
+    return node
+  }
+
+  const post = (message) => {
+    if (window.parent === window) return
+    window.parent.postMessage(message, '*')
+  }
+
+  const pending = new Map()
+  let nextId = 1
+  const request = (method, params) =>
+    new Promise((resolve, reject) => {
+      const id = nextId++
+      pending.set(id, { resolve, reject })
+      post({ jsonrpc: '2.0', id, method, params })
+    })
+  const notify = (method, params) => post({ jsonrpc: '2.0', method, params })
+
+  const applyHostContext = (context) => {
+    if (!isRecord(context)) return
+    if (context.theme === 'dark' || context.theme === 'light') {
+      document.documentElement.dataset.theme = context.theme
+    }
+  }
+
+  const openLink = async (url) => {
+    const openai = window.openai
+    if (openai && typeof openai.openExternal === 'function') {
+      await openai.openExternal({ href: url })
+      return true
+    }
+    if (hostCapabilities.openLinks) {
+      await request('ui/open-link', { url })
+      return true
+    }
+    return false
+  }
+
+  const linkButton = (label, url, secondary) => {
+    const anchor = el('a', {
+      className: secondary ? 'button secondary' : 'button',
+      href: url,
+      target: '_blank',
+      rel: 'noopener noreferrer',
+      text: label,
+    })
+    anchor.addEventListener('click', (event) => {
+      openLink(url).then((handled) => {
+        if (handled) event.preventDefault()
+      })
+    })
+    return anchor
+  }
+
+  const preview = (file) => {
+    const url = safeUrl(file.ssl_url) || safeUrl(file.url)
+    const mime = text(file.mime)
+    const name = text(file.name) || text(file.basename) || 'file'
+    const box = el('div', { className: 'preview' })
+    if (url && mime.startsWith('image/')) {
+      box.append(el('img', { src: url, alt: name, loading: 'lazy' }))
+    } else if (url && mime.startsWith('video/')) {
+      box.append(el('video', { src: url, controls: '', preload: 'metadata', playsinline: '' }))
+    } else if (url && mime.startsWith('audio/')) {
+      box.append(el('audio', { src: url, controls: '', preload: 'metadata' }))
+    } else {
+      box.append(el('span', { className: 'file', 'aria-hidden': 'true', text: '📄' }))
+    }
+    return box
+  }
+
+  const fileCard = (file) => {
+    const url = safeUrl(file.ssl_url) || safeUrl(file.url)
+    const name = text(file.name) || text(file.basename) || 'file'
+    const details = []
+    if (typeof file.width === 'number' && typeof file.height === 'number') {
+      details.push(file.width + '×' + file.height)
+    }
+    if (text(file.size_human)) details.push(text(file.size_human))
+    if (text(file.mime)) details.push(text(file.mime))
+    const caption = el('figcaption', {}, [
+      el('span', { className: 'name', text: name }),
+      el('span', { className: 'muted', text: details.join(' · ') }),
+      url ? el('div', {}, [el('a', { href: url, target: '_blank', rel: 'noopener noreferrer', download: '', text: 'Download' })]) : null,
+    ])
+    return el('figure', {}, [preview(isRecord(file) ? file : {}), caption])
+  }
+
+  const render = (result) => {
+    if (!isRecord(result)) return
+    app.replaceChildren()
+    const payload = isRecord(result.structuredContent) ? result.structuredContent : {}
+    const meta = isRecord(result._meta) && isRecord(result._meta[contextKey]) ? result._meta[contextKey] : {}
+    const assembly = isRecord(payload.assembly) ? payload.assembly : null
+
+    if (!assembly) {
+      const errors = Array.isArray(payload.errors) ? payload.errors : []
+      const message = errors.map((error) => (isRecord(error) ? text(error.message) : '')).filter(Boolean).join(' ')
+      app.append(el('p', { className: 'error', text: message || 'No Assembly result was returned.' }))
+      return
+    }
+
+    const ok = text(assembly.ok)
+    const failed = Boolean(assembly.error)
+    const status = failed ? text(assembly.error) : ok || 'ASSEMBLY_EXECUTING'
+    const header = el('header', {}, [
+      el('h1', { text: 'Assembly ' + (text(assembly.assembly_id) || '') }),
+      el('span', { className: 'badge ' + (failed ? 'err' : ok === 'ASSEMBLY_COMPLETED' ? 'ok' : ''), text: status }),
+    ])
+    const actions = el('div', { className: 'actions' })
+    const consoleUrl = safeUrl(meta.assembly_console_url)
+    if (consoleUrl) actions.append(linkButton('Open in Console', consoleUrl, true))
+    const templateUrl = safeUrl(meta.new_template_url)
+    if (meta.authenticated === true && templateUrl) actions.append(linkButton('Save as Template', templateUrl, false))
+    if (actions.childElementCount > 0) header.append(actions)
+    app.append(header)
+
+    if (failed && text(assembly.message)) {
+      app.append(el('p', { className: 'error', text: text(assembly.message) }))
+    }
+
+    const results = isRecord(assembly.results) ? assembly.results : {}
+    const uploads = Array.isArray(assembly.uploads) ? assembly.uploads : []
+    const steps = Object.entries(results).filter(([, files]) => Array.isArray(files) && files.length > 0)
+    if (uploads.length > 0) steps.unshift([':original', uploads])
+
+    if (steps.length === 0) {
+      app.append(el('p', { className: 'muted', text: 'No result files yet.' }))
+    }
+    for (const [stepName, files] of steps) {
+      const section = el('section', { className: 'step' }, [
+        el('h2', {}, [el('code', { text: stepName }), el('span', { className: 'muted', text: ' · ' + files.length + (files.length === 1 ? ' file' : ' files') })]),
+        el('div', { className: 'files' }, files.filter(isRecord).map(fileCard)),
+      ])
+      app.append(section)
+    }
+
+    const warnings = Array.isArray(payload.warnings) ? payload.warnings : []
+    for (const warning of warnings) {
+      if (isRecord(warning) && text(warning.message)) {
+        app.append(el('p', { className: 'muted', text: warning.message }))
+      }
+    }
+  }
+
+  window.addEventListener('message', (event) => {
+    if (event.source !== window.parent) return
+    const message = event.data
+    if (!isRecord(message) || message.jsonrpc !== '2.0') return
+    if ('id' in message && !('method' in message)) {
+      const entry = pending.get(message.id)
+      if (!entry) return
+      pending.delete(message.id)
+      if (message.error) entry.reject(message.error)
+      else entry.resolve(message.result)
+      return
+    }
+    if (message.method === 'ui/notifications/tool-result') {
+      render(message.params)
+    } else if (message.method === 'ui/notifications/host-context-changed') {
+      applyHostContext(message.params)
+    } else if (message.method === 'ui/resource-teardown' && 'id' in message) {
+      post({ jsonrpc: '2.0', id: message.id, result: {} })
+    }
+  })
+
+  const renderFromOpenAi = () => {
+    const openai = window.openai
+    if (!openai) return
+    applyHostContext({ theme: openai.theme })
+    if (isRecord(openai.toolOutput)) {
+      render({ structuredContent: openai.toolOutput, _meta: openai.toolResponseMetadata })
+    }
+  }
+  window.addEventListener('openai:set_globals', renderFromOpenAi)
+  renderFromOpenAi()
+
+  if (window.parent !== window) {
+    request('ui/initialize', {
+      protocolVersion: '2026-01-26',
+      appCapabilities: {},
+      clientInfo: { name: 'transloadit-assembly-result', version: widgetVersion },
+    })
+      .then((result) => {
+        if (isRecord(result) && isRecord(result.hostCapabilities)) {
+          hostCapabilities.openLinks = Boolean(result.hostCapabilities.openLinks)
+        }
+        if (isRecord(result)) applyHostContext(result.hostContext)
+        notify('ui/notifications/initialized', {})
+      })
+      .catch(() => {})
+
+    if (typeof ResizeObserver === 'function') {
+      new ResizeObserver(() => {
+        notify('ui/notifications/size-changed', {
+          width: document.documentElement.scrollWidth,
+          height: document.documentElement.scrollHeight,
+        })
+      }).observe(document.body)
+    }
+  }
+})()
+</script>
+</body>
+</html>
+`
+
+/** Registers the widget so hosts can `resources/read` it through `_meta.ui.resourceUri`. */
+export const registerAssemblyResultWidget = (server: McpServer): void => {
+  server.registerResource(
+    'assembly-result',
+    assemblyResultWidgetUri,
+    {
+      title: 'Assembly result',
+      description: widgetDescription,
+      mimeType: assemblyResultWidgetMimeType,
+      _meta: assemblyResultWidgetMeta,
+    },
+    () => ({
+      contents: [
+        {
+          uri: assemblyResultWidgetUri,
+          mimeType: assemblyResultWidgetMimeType,
+          text: assemblyResultWidgetHtml,
+          _meta: assemblyResultWidgetMeta,
+        },
+      ],
+    }),
+  )
+}
diff --git a/packages/mcp-server/test/e2e/server-card.test.ts b/packages/mcp-server/test/e2e/server-card.test.ts
index 5294260e..22daa575 100644
--- a/packages/mcp-server/test/e2e/server-card.test.ts
+++ b/packages/mcp-server/test/e2e/server-card.test.ts
@@ -32,12 +32,14 @@ describe('server card', () => {
       })
 
       expect(Array.isArray(body.tools)).toBe(true)
-      expect(body.tools.length).toBe(7)
+      expect(body.tools.length).toBe(8)
       for (const tool of body.tools as Array<Record<string, unknown>>) {
         expect(typeof tool.name).toBe('string')
         expect(typeof tool.title).toBe('string')
         expect(typeof tool.description).toBe('string')
         expect(typeof tool.inputSchema).toBe('object')
+        expect(tool.annotations).toMatchObject({ destructiveHint: false })
+        expect(Array.isArray(tool.securitySchemes)).toBe(true)
       }
     } finally {
       await close()
diff --git a/packages/mcp-server/test/unit/auth-errors.test.ts b/packages/mcp-server/test/unit/auth-errors.test.ts
new file mode 100644
index 00000000..5a928ca3
--- /dev/null
+++ b/packages/mcp-server/test/unit/auth-errors.test.ts
@@ -0,0 +1,195 @@
+import type { AddressInfo } from 'node:net'
+
+import type { TransloaditMcpHttpOptions } from '../../src/http.ts'
+
+import { createServer } from 'node:http'
+
+import { Client } from '@modelcontextprotocol/sdk/client/index.js'
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js'
+import { Transloadit } from '@transloadit/node'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+import { createTransloaditMcpHttpHandler } from '../../src/http.ts'
+
+const resourceMetadataUrl = 'https://api2.transloadit.com/.well-known/oauth-protected-resource/mcp'
+
+const isRecord = (value: unknown): value is Record<string, unknown> =>
+  typeof value === 'object' && value !== null && !Array.isArray(value)
+
+const wwwAuthenticate = (result: { _meta?: Record<string, unknown> }): string => {
+  const values = result._meta?.['mcp/www_authenticate']
+  if (!Array.isArray(values) || typeof values[0] !== 'string') {
+    throw new Error('Expected _meta["mcp/www_authenticate"] to be a list of header values')
+  }
+  return values[0]
+}
+
+const apiRejection = (statusCode: number): Error =>
+  Object.assign(new Error('Rejected'), { response: { statusCode } })
+
+describe('tool auth errors', () => {
+  const serverOptions: TransloaditMcpHttpOptions = { metricsPath: false }
+  const handler = createTransloaditMcpHttpHandler(serverOptions)
+  const httpServer = createServer((req, res) => {
+    void handler(req, res)
+  })
+  let url: URL
+  let client: Client
+
+  const connect = async (headers: Record<string, string> = {}): Promise<void> => {
+    client = new Client({ name: 'auth-errors', version: '1.0.0' })
+    await client.connect(new StreamableHTTPClientTransport(url, { requestInit: { headers } }))
+  }
+
+  beforeEach(async () => {
+    delete serverOptions.authKey
+    delete serverOptions.authSecret
+    delete serverOptions.resourceMetadataUrl
+    await new Promise<void>((resolve) => httpServer.listen(0, '127.0.0.1', resolve))
+    const { port } = httpServer.address() as AddressInfo
+    url = new URL(`http://127.0.0.1:${port}/mcp`)
+  })
+
+  afterEach(async () => {
+    await client?.close()
+    await handler.close()
+    await new Promise<void>((resolve, reject) =>
+      httpServer.close((error) => (error ? reject(error) : resolve())),
+    )
+    vi.restoreAllMocks()
+  })
+
+  it.each([
+    'transloadit_create_assembly',
+    'transloadit_get_assembly_status',
+    'transloadit_wait_for_assembly',
+    'transloadit_list_templates',
+    'transloadit_get_profile',
+  ])('%s asks the host to link an account when no credentials exist', async (name) => {
+    await connect()
+    const result = await client.callTool({
+      name,
+      arguments:
+        name.endsWith('assembly_status') || name.endsWith('for_assembly')
+          ? { assembly_id: '0123456789abcdef0123456789abcdef' }
+          : {},
+    })
+    expect(result.isError).toBe(true)
+    expect(result.structuredContent).toMatchObject({
+      status: 'error',
+      errors: [{ code: 'mcp_missing_auth' }],
+    })
+    expect(wwwAuthenticate(result)).toMatch(
+      /^Bearer error="insufficient_scope", error_description="[^"]+"$/,
+    )
+  })
+
+  it('includes the resource metadata URL in the challenge when hosted', async () => {
+    serverOptions.resourceMetadataUrl = resourceMetadataUrl
+    vi.spyOn(Transloadit.prototype, 'listTemplates').mockRejectedValue(apiRejection(401))
+    await connect({ Authorization: 'Bearer expired-token' })
+
+    const result = await client.callTool({ name: 'transloadit_list_templates', arguments: {} })
+    expect(result.isError).toBe(true)
+    expect(result.structuredContent).toMatchObject({
+      status: 'error',
+      errors: [{ code: 'mcp_auth_rejected' }],
+    })
+    expect(wwwAuthenticate(result)).toBe(
+      `Bearer resource_metadata="${resourceMetadataUrl}", error="invalid_token", error_description="Transloadit rejected the credentials; the token may have expired."`,
+    )
+  })
+
+  it('reports rejected tokens on Assembly tools without leaking the API response', async () => {
+    vi.spyOn(Transloadit.prototype, 'getAssembly').mockRejectedValue(apiRejection(401))
+    await connect({ Authorization: 'Bearer expired-token' })
+
+    const result = await client.callTool({
+      name: 'transloadit_get_assembly_status',
+      arguments: { assembly_id: '0123456789abcdef0123456789abcdef' },
+    })
+    expect(result.isError).toBe(true)
+    expect(wwwAuthenticate(result)).toContain('error="invalid_token"')
+    const content = Array.isArray(result.content) ? result.content[0] : undefined
+    expect(isRecord(content) ? content.text : undefined).not.toContain('Rejected')
+  })
+
+  it('leaves other API failures as ordinary tool errors', async () => {
+    vi.spyOn(Transloadit.prototype, 'getAssembly').mockRejectedValue(apiRejection(500))
+    await connect({ Authorization: 'Bearer token' })
+
+    const result = await client.callTool({
+      name: 'transloadit_get_assembly_status',
+      arguments: { assembly_id: '0123456789abcdef0123456789abcdef' },
+    })
+    expect(result.isError).toBe(true)
+    expect(result._meta?.['mcp/www_authenticate']).toBeUndefined()
+  })
+})
+
+describe('profile tool', () => {
+  const handler = createTransloaditMcpHttpHandler({ metricsPath: false })
+  const httpServer = createServer((req, res) => {
+    void handler(req, res)
+  })
+  let client: Client
+
+  beforeEach(async () => {
+    await new Promise<void>((resolve) => httpServer.listen(0, '127.0.0.1', resolve))
+    const { port } = httpServer.address() as AddressInfo
+    client = new Client({ name: 'profile', version: '1.0.0' })
+    await client.connect(
+      new StreamableHTTPClientTransport(new URL(`http://127.0.0.1:${port}/mcp`), {
+        requestInit: { headers: { Authorization: 'Bearer token' } },
+      }),
+    )
+  })
+
+  afterEach(async () => {
+    await client?.close()
+    await handler.close()
+    await new Promise<void>((resolve, reject) =>
+      httpServer.close((error) => (error ? reject(error) : resolve())),
+    )
+    vi.restoreAllMocks()
+  })
+
+  it('returns the Workspace behind the latest Assembly', async () => {
+    vi.spyOn(Transloadit.prototype, 'listAssemblies').mockResolvedValue({
+      items: [{ id: 'abcdef', account_id: 'ws_1' }],
+      count: 1,
+    })
+    vi.spyOn(Transloadit.prototype, 'getAssembly').mockResolvedValue({
+      ok: 'ASSEMBLY_COMPLETED',
+      account_id: 'ws_1',
+      account_name: 'Acme Media',
+      account_slug: 'acme',
+    })
+
+    const result = await client.callTool({ name: 'transloadit_get_profile', arguments: {} })
+    expect(result.isError).toBeFalsy()
+    expect(result.structuredContent).toEqual({ id: 'ws_1', name: 'Acme Media', nickname: 'acme' })
+  })
+
+  it('falls back to an owned Template when no Assembly exists', async () => {
+    vi.spyOn(Transloadit.prototype, 'listAssemblies').mockResolvedValue({ items: [], count: 0 })
+    vi.spyOn(Transloadit.prototype, 'listTemplates').mockResolvedValue({
+      items: [{ id: 'tpl_1', name: 'resize', content: {}, account_id: 'ws_2' }],
+      count: 1,
+    })
+
+    const result = await client.callTool({ name: 'transloadit_get_profile', arguments: {} })
+    expect(result.structuredContent).toEqual({ id: 'ws_2' })
+  })
+
+  it('explains when the Workspace cannot be resolved yet', async () => {
+    vi.spyOn(Transloadit.prototype, 'listAssemblies').mockResolvedValue({ items: [], count: 0 })
+    vi.spyOn(Transloadit.prototype, 'listTemplates').mockResolvedValue({ items: [], count: 0 })
+
+    const result = await client.callTool({ name: 'transloadit_get_profile', arguments: {} })
+    expect(result.structuredContent).toMatchObject({
+      status: 'error',
+      errors: [{ code: 'mcp_profile_unavailable' }],
+    })
+  })
+})
diff --git a/packages/mcp-server/test/unit/file-inputs.test.ts b/packages/mcp-server/test/unit/file-inputs.test.ts
index 4aefd686..dbd6f91a 100644
--- a/packages/mcp-server/test/unit/file-inputs.test.ts
+++ b/packages/mcp-server/test/unit/file-inputs.test.ts
@@ -602,4 +602,90 @@ describe('MCP file inputs', () => {
       }),
     )
   })
+
+  it('maps host-attached files onto the URL import path', async () => {
+    const result = await client.callTool({
+      name: 'transloadit_create_assembly',
+      arguments: {
+        instructions: { steps: { source: { robot: '/http/import' } } },
+        attachments: [
+          {
+            download_url: 'https://example.com/attached.jpg',
+            file_id: 'file_123',
+            mime_type: 'image/jpeg',
+            file_name: 'attached.jpg',
+          },
+        ],
+      },
+    })
+    expect(result.structuredContent).toMatchObject({ status: 'ok' })
+    expect(Transloadit.prototype.createAssembly).toHaveBeenCalledWith(
+      expect.objectContaining({
+        params: expect.objectContaining({
+          steps: { source: { robot: '/http/import', url: 'https://example.com/attached.jpg' } },
+        }),
+      }),
+    )
+  })
+
+  it('downloads host-attached files for upload templates alongside legacy inputs', async () => {
+    const download = nock('https://example.com').get('/attached.txt').reply(200, fixtureContent)
+    const result = await client.callTool({
+      name: 'transloadit_create_assembly',
+      arguments: {
+        instructions: { steps: { ':original': { robot: '/upload/handle' } } },
+        files: [{ kind: 'base64', field: 'inline', base64: 'aGk=', filename: 'inline.txt' }],
+        attachments: [{ download_url: 'https://example.com/attached.txt', file_id: 'file_1' }],
+        wait_for_completion: true,
+      },
+    })
+    expect(result.structuredContent).toMatchObject({
+      status: 'ok',
+      upload: { status: 'complete', total_files: 2 },
+    })
+    expect(download.isDone()).toBe(true)
+    expect(Transloadit.prototype.createAssembly).toHaveBeenCalledWith(
+      expect.objectContaining({
+        files: { inline: expect.any(String), attachment_1: expect.any(String) },
+      }),
+    )
+  })
+
+  it('rejects host file objects with unknown properties before any API call', async () => {
+    const result = await client.callTool({
+      name: 'transloadit_create_assembly',
+      arguments: {
+        instructions: { steps: { source: { robot: '/http/import' } } },
+        attachments: [
+          { download_url: 'https://example.com/a.jpg', file_id: 'file_1', kind: 'url' },
+        ],
+      },
+    })
+    expect(result.isError).toBe(true)
+    expect(Transloadit.prototype.createAssembly).not.toHaveBeenCalled()
+  })
+
+  it('hands the widget Console deep links for the Assembly and a new Template', async () => {
+    vi.mocked(Transloadit.prototype.createAssembly).mockResolvedValue({
+      ok: 'ASSEMBLY_COMPLETED',
+      assembly_id: assemblyId,
+      account_slug: 'acme',
+      template_id: 'tpl_1',
+    })
+    const result = await client.callTool({
+      name: 'transloadit_create_assembly',
+      arguments: {
+        instructions: { steps: { resized: { robot: '/image/resize', width: 1 } } },
+        wait_for_completion: true,
+      },
+    })
+    expect(result.structuredContent).toMatchObject({ status: 'ok' })
+    expect(result._meta).toEqual({
+      'transloadit/widget': {
+        authenticated: true,
+        assembly_console_url: `https://transloadit.com/c/acme/assemblies/${assemblyId}`,
+        new_template_url: 'https://transloadit.com/c/acme/templates/new?duplicateFrom=tpl_1',
+      },
+    })
+  })
 })
diff --git a/packages/mcp-server/test/unit/hosted-auth.test.ts b/packages/mcp-server/test/unit/hosted-auth.test.ts
new file mode 100644
index 00000000..53cd392e
--- /dev/null
+++ b/packages/mcp-server/test/unit/hosted-auth.test.ts
@@ -0,0 +1,215 @@
+import type { AddressInfo } from 'node:net'
+
+import { createServer } from 'node:http'
+
+import { afterEach, describe, expect, it } from 'vitest'
+
+import { createTransloaditMcpHttpHandler } from '../../src/http.ts'
+import { matchesOriginPattern } from '../../src/http-helpers.ts'
+
+type RunningServer = { url: URL; close: () => Promise<void> }
+
+const resourceMetadataUrl = 'https://api2.transloadit.com/.well-known/oauth-protected-resource/mcp'
+
+const initializeBody = JSON.stringify({
+  jsonrpc: '2.0',
+  id: 1,
+  method: 'initialize',
+  params: {
+    protocolVersion: '2025-06-18',
+    capabilities: {},
+    clientInfo: { name: 'hosted-auth-test', version: '0.0.0' },
+  },
+})
+
+const start = async (
+  options: Parameters<typeof createTransloaditMcpHttpHandler>[0] = {},
+): Promise<RunningServer> => {
+  const handler = createTransloaditMcpHttpHandler({ metricsPath: false, ...options })
+  const server = createServer((req, res) => {
+    void handler(req, res)
+  })
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve))
+  const { port } = server.address() as AddressInfo
+  return {
+    url: new URL(`http://127.0.0.1:${port}/mcp`),
+    close: async () => {
+      await handler.close()
+      await new Promise<void>((resolve, reject) =>
+        server.close((error) => (error ? reject(error) : resolve())),
+      )
+    },
+  }
+}
+
+const post = (url: URL, headers: Record<string, string> = {}): Promise<Response> =>
+  fetch(url, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      Accept: 'application/json, text/event-stream',
+      ...headers,
+    },
+    body: initializeBody,
+  })
+
+describe('hosted MCP endpoint auth', () => {
+  let running: RunningServer | undefined
+
+  afterEach(async () => {
+    await running?.close()
+    running = undefined
+  })
+
+  it('challenges unauthenticated requests with the protected-resource metadata URL', async () => {
+    running = await start({ resourceMetadataUrl })
+
+    const response = await post(running.url)
+    expect(response.status).toBe(401)
+    expect(response.headers.get('www-authenticate')).toBe(
+      `Bearer resource_metadata="${resourceMetadataUrl}"`,
+    )
+    expect(response.headers.get('content-type')).toContain('application/json')
+    await expect(response.json()).resolves.toMatchObject({
+      error: 'unauthorized',
+      error_description: expect.stringContaining('OAuth'),
+    })
+  })
+
+  it('challenges SSE GETs without a bearer token but keeps the bare GET health probe', async () => {
+    running = await start({ resourceMetadataUrl })
+
+    const stream = await fetch(running.url, { headers: { Accept: 'text/event-stream' } })
+    expect(stream.status).toBe(401)
+    expect(stream.headers.get('www-authenticate')).toContain('resource_metadata=')
+
+    const probe = await fetch(running.url)
+    expect(probe.status).toBe(200)
+    await expect(probe.json()).resolves.toMatchObject({ status: 'ok' })
+  })
+
+  it('forwards requests that carry any bearer token to the MCP transport', async () => {
+    running = await start({ resourceMetadataUrl })
+
+    const response = await post(running.url, { Authorization: 'Bearer oauth-access-token' })
+    expect(response.status).toBe(200)
+    expect(await response.text()).toContain('protocolVersion')
+  })
+
+  it('keeps the self-hosted static token behavior', async () => {
+    running = await start({ mcpToken: 'static-secret' })
+
+    const rejected = await post(running.url, { Authorization: 'Bearer wrong' })
+    expect(rejected.status).toBe(401)
+    expect(rejected.headers.get('www-authenticate')).toBe('Bearer')
+
+    const accepted = await post(running.url, { Authorization: 'Bearer static-secret' })
+    expect(accepted.status).toBe(200)
+  })
+
+  it('does not challenge when neither mode is configured', async () => {
+    running = await start()
+
+    const response = await post(running.url)
+    expect(response.status).toBe(200)
+  })
+
+  it('advertises OAuth in the server card when hosted', async () => {
+    running = await start({ resourceMetadataUrl })
+
+    const card = await fetch(new URL('/.well-known/mcp/server-card.json', running.url))
+    expect(card.status).toBe(200)
+    await expect(card.json()).resolves.toMatchObject({
+      authentication: { required: true, schemes: ['oauth2', 'bearer'], resourceMetadataUrl },
+    })
+  })
+})
+
+describe('hosted MCP endpoint origins', () => {
+  let running: RunningServer | undefined
+
+  afterEach(async () => {
+    await running?.close()
+    running = undefined
+  })
+
+  it.each([
+    'https://chatgpt.com',
+    'https://chat.openai.com',
+    'https://claude.ai',
+    'https://claude.com',
+    'https://transloadit.com',
+    'https://mcp.transloadit.com',
+    'https://transloadit.dev:3001',
+    'http://localhost:6274',
+    'http://127.0.0.1:5173',
+  ])('allows %s in hosted mode', async (origin) => {
+    running = await start({ resourceMetadataUrl })
+
+    const response = await post(running.url, { Origin: origin, Authorization: 'Bearer token' })
+    expect(response.status).toBe(200)
+    expect(response.headers.get('access-control-allow-origin')).toBe(origin)
+    expect(response.headers.get('access-control-expose-headers')).toContain('WWW-Authenticate')
+  })
+
+  it.each([
+    'https://evil.example',
+    'https://transloadit.com.evil.example',
+    'null',
+  ])('rejects %s in hosted mode', async (origin) => {
+    running = await start({ resourceMetadataUrl })
+
+    const response = await post(running.url, { Origin: origin, Authorization: 'Bearer token' })
+    expect(response.status).toBe(403)
+  })
+
+  it('passes requests without an Origin header in hosted mode', async () => {
+    running = await start({ resourceMetadataUrl })
+
+    const response = await post(running.url, { Authorization: 'Bearer token' })
+    expect(response.status).toBe(200)
+  })
+
+  it('lets explicit allowedOrigins replace the hosted defaults', async () => {
+    running = await start({ resourceMetadataUrl, allowedOrigins: ['https://allowed.example'] })
+
+    const allowed = await post(running.url, {
+      Origin: 'https://allowed.example',
+      Authorization: 'Bearer token',
+    })
+    expect(allowed.status).toBe(200)
+
+    const chatgpt = await post(running.url, {
+      Origin: 'https://chatgpt.com',
+      Authorization: 'Bearer token',
+    })
+    expect(chatgpt.status).toBe(403)
+  })
+
+  it('keeps the open CORS policy outside hosted mode', async () => {
+    running = await start()
+
+    const response = await post(running.url, { Origin: 'https://anything.example' })
+    expect(response.status).toBe(200)
+    expect(response.headers.get('access-control-allow-origin')).toBe('*')
+  })
+})
+
+describe('matchesOriginPattern', () => {
+  it.each([
+    ['https://chatgpt.com', 'https://chatgpt.com', true],
+    ['https://chatgpt.com', 'https://chat.openai.com', false],
+    ['https://api2.transloadit.com', 'https://*.transloadit.com', true],
+    ['https://transloadit.com', 'https://*.transloadit.com', false],
+    ['https://transloadit.com.evil.example', 'https://*.transloadit.com', false],
+    ['https://transloadit.dev:3001', 'https://transloadit.dev:*', true],
+    ['https://transloadit.dev', 'https://transloadit.dev:*', true],
+    ['http://transloadit.dev:3001', 'https://transloadit.dev:*', false],
+    ['http://localhost:6274', 'http://localhost:*', true],
+    ['http://[::1]:6274', 'http://[::1]:*', true],
+    ['https://chatgpt.com:8443', 'https://chatgpt.com', false],
+    ['not a url', 'https://chatgpt.com', false],
+  ])('%s against %s is %s', (origin, pattern, expected) => {
+    expect(matchesOriginPattern(origin, pattern)).toBe(expected)
+  })
+})
diff --git a/packages/mcp-server/test/unit/tool-surface.test.ts b/packages/mcp-server/test/unit/tool-surface.test.ts
new file mode 100644
index 00000000..bfd90002
--- /dev/null
+++ b/packages/mcp-server/test/unit/tool-surface.test.ts
@@ -0,0 +1,213 @@
+import type { AddressInfo } from 'node:net'
+
+import { createServer } from 'node:http'
+
+import { afterAll, beforeAll, describe, expect, it } from 'vitest'
+
+import { createTransloaditMcpHttpHandler } from '../../src/http.ts'
+import { toolNames } from '../../src/tool-metadata.ts'
+import {
+  assemblyResultOrigins,
+  assemblyResultWidgetMimeType,
+  assemblyResultWidgetUri,
+} from '../../src/ui/assembly-result-widget.ts'
+
+type JsonRecord = Record<string, unknown>
+
+const isRecord = (value: unknown): value is JsonRecord =>
+  typeof value === 'object' && value !== null && !Array.isArray(value)
+
+const resourceMetadataUrl = 'https://api2.transloadit.com/.well-known/oauth-protected-resource/mcp'
+
+// The SDK client strips unknown Tool fields such as `securitySchemes`, so tools/list is read raw.
+const parseJsonRpcResult = async (response: Response): Promise<JsonRecord> => {
+  const text = await response.text()
+  const payload = response.headers.get('content-type')?.includes('text/event-stream')
+    ? text
+        .split('\n')
+        .filter((line) => line.startsWith('data: '))
+        .map((line) => line.slice('data: '.length))
+        .at(-1)
+    : text
+  if (!payload) throw new Error(`Empty JSON-RPC response: ${text}`)
+  const parsed: unknown = JSON.parse(payload)
+  if (!isRecord(parsed) || !isRecord(parsed.result)) {
+    throw new Error(`Unexpected JSON-RPC response: ${payload}`)
+  }
+  return parsed.result
+}
+
+describe('tool surface', () => {
+  const handler = createTransloaditMcpHttpHandler({ metricsPath: false, resourceMetadataUrl })
+  const httpServer = createServer((req, res) => {
+    void handler(req, res)
+  })
+  let url: URL
+
+  const call = async (method: string, params: JsonRecord = {}): Promise<JsonRecord> => {
+    const response = await fetch(url, {
+      method: 'POST',
+      headers: {
+        Authorization: 'Bearer test-token',
+        'Content-Type': 'application/json',
+        Accept: 'application/json, text/event-stream',
+      },
+      body: JSON.stringify({ jsonrpc: '2.0', id: 1, method, params }),
+    })
+    expect(response.status).toBe(200)
+    return parseJsonRpcResult(response)
+  }
+
+  const listTools = async (): Promise<JsonRecord[]> => {
+    const result = await call('tools/list')
+    expect(Array.isArray(result.tools)).toBe(true)
+    return (result.tools as unknown[]).filter(isRecord)
+  }
+
+  const findTool = (tools: JsonRecord[], name: string): JsonRecord => {
+    const tool = tools.find((entry) => entry.name === name)
+    if (!tool) throw new Error(`Tool ${name} is not listed`)
+    return tool
+  }
+
+  beforeAll(async () => {
+    await new Promise<void>((resolve) => httpServer.listen(0, '127.0.0.1', resolve))
+    const { port } = httpServer.address() as AddressInfo
+    url = new URL(`http://127.0.0.1:${port}/mcp`)
+  })
+
+  afterAll(async () => {
+    await handler.close()
+    await new Promise<void>((resolve, reject) =>
+      httpServer.close((error) => (error ? reject(error) : resolve())),
+    )
+  })
+
+  it('lists every tool with a title, annotations and security schemes in both places', async () => {
+    const tools = await listTools()
+    expect(tools.map((tool) => tool.name).sort()).toEqual([...toolNames].sort())
+
+    for (const tool of tools) {
+      expect(typeof tool.title, String(tool.name)).toBe('string')
+      expect(tool.annotations).toMatchObject({
+        readOnlyHint: expect.any(Boolean),
+        destructiveHint: false,
+        openWorldHint: expect.any(Boolean),
+      })
+      expect(Array.isArray(tool.securitySchemes), String(tool.name)).toBe(true)
+      expect(isRecord(tool._meta) ? tool._meta.securitySchemes : undefined).toEqual(
+        tool.securitySchemes,
+      )
+    }
+  })
+
+  it.each([
+    ['transloadit_list_robots', [{ type: 'noauth' }]],
+    ['transloadit_get_robot_help', [{ type: 'noauth' }]],
+    ['transloadit_lint_assembly_instructions', [{ type: 'noauth' }]],
+    ['transloadit_create_assembly', [{ type: 'oauth2', scopes: ['assemblies:write'] }]],
+    ['transloadit_get_assembly_status', [{ type: 'oauth2', scopes: ['assemblies:read'] }]],
+    ['transloadit_wait_for_assembly', [{ type: 'oauth2', scopes: ['assemblies:read'] }]],
+    ['transloadit_list_templates', [{ type: 'oauth2', scopes: ['templates:read'] }]],
+    ['transloadit_get_profile', [{ type: 'oauth2', scopes: [] }]],
+  ])('%s declares %j', async (name, securitySchemes) => {
+    const tool = findTool(await listTools(), name)
+    expect(tool.securitySchemes).toEqual(securitySchemes)
+  })
+
+  it('marks only the Assembly creation as open-world and nothing as destructive', async () => {
+    const tools = await listTools()
+    const openWorld = tools.filter(
+      (tool) => isRecord(tool.annotations) && tool.annotations.openWorldHint === true,
+    )
+    expect(openWorld.map((tool) => tool.name)).toEqual(['transloadit_create_assembly'])
+    const readOnly = tools.filter(
+      (tool) => isRecord(tool.annotations) && tool.annotations.readOnlyHint === true,
+    )
+    expect(readOnly).toHaveLength(tools.length - 1)
+  })
+
+  it('declares ChatGPT file params with exactly the OpenAI file object schema', async () => {
+    const tool = findTool(await listTools(), 'transloadit_create_assembly')
+    expect(isRecord(tool._meta) ? tool._meta['openai/fileParams'] : undefined).toEqual([
+      'attachments',
+    ])
+
+    const inputSchema = isRecord(tool.inputSchema) ? tool.inputSchema : {}
+    const properties = isRecord(inputSchema.properties) ? inputSchema.properties : {}
+    const attachments = isRecord(properties.attachments) ? properties.attachments : {}
+    expect(attachments.type).toBe('array')
+    expect(attachments.items).toEqual({
+      type: 'object',
+      properties: {
+        download_url: { type: 'string' },
+        file_id: { type: 'string' },
+        mime_type: { type: 'string' },
+        file_name: { type: 'string' },
+      },
+      required: ['download_url', 'file_id'],
+      additionalProperties: false,
+    })
+    expect(JSON.stringify(properties.files)).toContain('base64')
+  })
+
+  it('links the Assembly tools to the result widget with short status strings', async () => {
+    const tools = await listTools()
+    for (const name of ['transloadit_create_assembly', 'transloadit_wait_for_assembly']) {
+      const meta = findTool(tools, name)._meta
+      expect(isRecord(meta) ? meta.ui : undefined).toEqual({ resourceUri: assemblyResultWidgetUri })
+      expect(isRecord(meta) ? meta['openai/outputTemplate'] : undefined).toBe(
+        assemblyResultWidgetUri,
+      )
+    }
+    for (const tool of tools) {
+      if (!isRecord(tool._meta)) continue
+      for (const key of ['openai/toolInvocation/invoking', 'openai/toolInvocation/invoked']) {
+        const value = tool._meta[key]
+        if (value === undefined) continue
+        expect(typeof value).toBe('string')
+        expect(String(value).length).toBeLessThanOrEqual(64)
+      }
+    }
+  })
+
+  it('marks the profile tool for multi-account hosts', async () => {
+    const tool = findTool(await listTools(), 'transloadit_get_profile')
+    expect(isRecord(tool._meta) ? tool._meta['openai/profile'] : undefined).toBe(true)
+    expect(tool.annotations).toMatchObject({ readOnlyHint: true, openWorldHint: false })
+    expect(tool.inputSchema).toMatchObject({ type: 'object', additionalProperties: false })
+    expect(tool.outputSchema).toMatchObject({ required: ['id'] })
+  })
+
+  it('lists and serves the Assembly result widget with a CSP for result origins', async () => {
+    const listed = await call('resources/list')
+    const resources = (listed.resources as unknown[]).filter(isRecord)
+    const widget = resources.find((resource) => resource.uri === assemblyResultWidgetUri)
+    expect(widget).toMatchObject({
+      mimeType: assemblyResultWidgetMimeType,
+      _meta: {
+        ui: {
+          csp: { connectDomains: assemblyResultOrigins, resourceDomains: assemblyResultOrigins },
+        },
+        'openai/widgetDescription': expect.any(String),
+        'openai/widgetCSP': {
+          connect_domains: assemblyResultOrigins,
+          resource_domains: assemblyResultOrigins,
+        },
+      },
+    })
+
+    const read = await call('resources/read', { uri: assemblyResultWidgetUri })
+    const contents = (read.contents as unknown[]).filter(isRecord)
+    expect(contents).toHaveLength(1)
+    const html = String(contents[0]?.text)
+    expect(contents[0]).toMatchObject({
+      uri: assemblyResultWidgetUri,
+      mimeType: assemblyResultWidgetMimeType,
+    })
+    expect(html).toContain('<!doctype html>')
+    expect(html).toContain('ui/notifications/tool-result')
+    expect(html).toContain('Save as Template')
+    expect(html).not.toMatch(/<script[^>]+src=/)
+  })
+})

From d85cb647f88d8ee5d2bdbd6cab3f141567f9a050 Mon Sep 17 00:00:00 2001
From: Kevin van Zonneveld <kevin@vanzonneveld.net>
Date: Wed, 30 Sep 2026 22:19:28 +0200
Subject: [PATCH 04/27] Document connect-by-URL, add the plugin manifests and
 changeset

README leads with the hosted endpoint and OAuth clients, moves minted bearer tokens to the CI
section and drops the roadmap TODO. `plugin.json`, `mcp.json` and `.codex-plugin/plugin.json`
describe the ChatGPT and Codex plugin and reference the skills catalog by URL. The task note
checklist and devdock paths are updated.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 .changeset/mcp-oauth-discovery.md             |  22 ++
 .../prompts/2026-09-30-mcp-oauth-discovery.md |  35 +--
 packages/mcp-server/.codex-plugin/plugin.json |  48 ++++
 packages/mcp-server/README.md                 | 254 ++++++++++++------
 packages/mcp-server/mcp.json                  |   9 +
 packages/mcp-server/plugin.json               |  53 ++++
 packages/mcp-server/server.json               |   2 +-
 7 files changed, 329 insertions(+), 94 deletions(-)
 create mode 100644 .changeset/mcp-oauth-discovery.md
 create mode 100644 packages/mcp-server/.codex-plugin/plugin.json
 create mode 100644 packages/mcp-server/mcp.json
 create mode 100644 packages/mcp-server/plugin.json

diff --git a/.changeset/mcp-oauth-discovery.md b/.changeset/mcp-oauth-discovery.md
new file mode 100644
index 00000000..25dda9c3
--- /dev/null
+++ b/.changeset/mcp-oauth-discovery.md
@@ -0,0 +1,22 @@
+---
+"@transloadit/mcp-server": minor
+---
+
+Let MCP clients connect to the hosted server by URL and satisfy the ChatGPT plugin and Claude
+connector requirements.
+
+- Hosted mode (`TRANSLOADIT_MCP_RESOURCE_METADATA_URL`): unauthenticated requests get a `401` with
+  `WWW-Authenticate: Bearer resource_metadata="…"`, browser Origins are limited to ChatGPT, Claude,
+  Transloadit and loopback (overridable with `allowedOrigins`), and the server card advertises
+  OAuth. Self-hosted `TRANSLOADIT_MCP_TOKEN` behavior is unchanged.
+- Every tool carries a title, `readOnlyHint`/`destructiveHint`/`openWorldHint`/`idempotentHint`
+  annotations and per-tool `securitySchemes` (`noauth` for Robots and linting, `oauth2` with scopes
+  elsewhere), mirrored in `_meta.securitySchemes`. Auth failures return `isError` results with
+  `_meta["mcp/www_authenticate"]` so hosts show their account-linking UI.
+- New `transloadit_get_profile` tool (`_meta["openai/profile"]`) returns the Workspace behind the
+  credentials for multi-account hosts.
+- `transloadit_create_assembly` accepts ChatGPT-attached files through `attachments`
+  (`_meta["openai/fileParams"]`), mapped onto the existing URL-input path.
+- MCP Apps result widget `ui://transloadit/assembly-result` with previews, download links and a
+  Save as Template shortcut, linked from the Assembly tools with `_meta.ui.resourceUri`.
+- `plugin.json`, `mcp.json` and `.codex-plugin/plugin.json` describe the ChatGPT and Codex plugin.
diff --git a/docs/prompts/2026-09-30-mcp-oauth-discovery.md b/docs/prompts/2026-09-30-mcp-oauth-discovery.md
index 6bbba7bc..be8b17a6 100644
--- a/docs/prompts/2026-09-30-mcp-oauth-discovery.md
+++ b/docs/prompts/2026-09-30-mcp-oauth-discovery.md
@@ -31,52 +31,53 @@ OpenAI file params on `transloadit_create_assembly` and an MCP Apps result widge
 
 ### Discovery and auth (Phase 0)
 
-- [ ] Hosted mode: unauthenticated `/mcp` requests return `401` with
+- [x] Hosted mode: unauthenticated `/mcp` requests return `401` with
       `WWW-Authenticate: Bearer resource_metadata="https://api2.transloadit.com/.well-known/oauth-protected-resource/mcp"`.
       Keep the friendly JSON on bare `GET` without `Accept: text/event-stream` for directory
       health probes. Self-hosted mode keeps `TRANSLOADIT_MCP_TOKEN` behavior.
-- [ ] Per-tool `securitySchemes`: `noauth` for `transloadit_list_robots`,
+- [x] Per-tool `securitySchemes`: `noauth` for `transloadit_list_robots`,
       `transloadit_get_robot_help`, `transloadit_lint_assembly_instructions`; `oauth2` with the
       scopes each tool needs for `create_assembly`, `get_assembly_status`, `wait_for_assembly`,
       `list_templates`. Mirror them in `_meta["securitySchemes"]` for clients that only read
       `_meta`.
-- [ ] Tool results that fail on auth carry `_meta["mcp/www_authenticate"]` with `error` and
+- [x] Tool results that fail on auth carry `_meta["mcp/www_authenticate"]` with `error` and
       `error_description` so ChatGPT shows the account-linking UI.
-- [ ] Origin validation on the hosted endpoint (allow `chatgpt.com`, `claude.ai`, `claude.com`,
+- [x] Origin validation on the hosted endpoint (allow `chatgpt.com`, `claude.ai`, `claude.com`,
       Transloadit origins and loopback; reject others).
-- [ ] Every tool gets a `title` and accurate `readOnlyHint`, `destructiveHint`, `openWorldHint`
+- [x] Every tool gets a `title` and accurate `readOnlyHint`, `destructiveHint`, `openWorldHint`
       (`true` for URL imports).
-- [ ] Optional profile tool marked `_meta["openai/profile"]: true` returning a stable opaque
+- [x] Optional profile tool marked `_meta["openai/profile"]: true` returning a stable opaque
       workspace id, so multi-account works in ChatGPT.
-- [ ] Server card advertises the OAuth-by-URL path; README puts "connect by URL" first and moves
+- [x] Server card advertises the OAuth-by-URL path; README puts "connect by URL" first and moves
       minted bearer tokens to the CI/headless section; drop the device-login TODO.
 
 ### ChatGPT plugin surface (Phase 1)
 
-- [ ] `_meta["openai/fileParams"]: ["files"]` on `transloadit_create_assembly` with the required
+- [x] `_meta["openai/fileParams"]: ["files"]` on `transloadit_create_assembly` with the required
       file object schema (`download_url`, `file_id` required; `mime_type`, `file_name` optional,
       nothing else required). Map each entry onto the existing URL-import path.
-- [ ] MCP Apps result widget (`_meta.ui.resourceUri`, `ui://transloadit/assembly-result`): per-Step
+- [x] MCP Apps result widget (`_meta.ui.resourceUri`, `ui://transloadit/assembly-result`): per-Step
       preview (image, video, audio, document thumbnail), before/after for image Steps, download
       links, "Save as Template" when authenticated. Set `_meta.ui.csp.connectDomains` and
       `resourceDomains` to Transloadit result origins and `_meta.ui.domain` to a dedicated origin.
-- [ ] `_meta["openai/toolInvocation/invoking"]` / `invoked` status strings (≤ 64 chars).
-- [ ] `plugin.json` with `extensions.com.openai` (presentation, registered MCP server, hooks) and
+- [x] `_meta["openai/toolInvocation/invoking"]` / `invoked` status strings (≤ 64 chars).
+- [x] `plugin.json` with `extensions.com.openai` (presentation, registered MCP server, hooks) and
       `.codex-plugin/plugin.json` fallback; bundle the `transloadit/skills` catalog within OpenAI's
       limits (5 skills, 100 files each, 256 KiB `SKILL.md`).
-- [ ] Tests: unit tests for the 401/metadata behavior, security schemes, file-param mapping and
-      widget resource; e2e against devdock once the api2 branch serves the metadata.
+- [x] Tests: unit tests for the 401/metadata behavior, security schemes, file-param mapping and
+      widget resource.
+- [ ] E2e against devdock once the api2 branch serves the metadata.
 
 ## Getting a local build into devdock
 
 API2's container bind-mounts the api2 worktree at `/srv/current` and runs the `mcp-server` service
-from the worktree's `node_modules/@transloadit/mcp-server`. To test this branch:
+from the worktree's `api2/node_modules/@transloadit/mcp-server`. To test this branch:
 
 ```bash
 cd ~/code/node-sdk && corepack yarn build
-rm -rf ~/code/api2-clone-1/node_modules/@transloadit/mcp-server/dist
-cp -r packages/mcp-server/dist ~/code/api2-clone-1/node_modules/@transloadit/mcp-server/dist
-cd ~/code/api2-clone-1 && core/bin/devdock.ts --app api2 restart
+rm -rf ~/code/api2-clone-1/api2/node_modules/@transloadit/mcp-server/dist
+cp -r packages/mcp-server/dist ~/code/api2-clone-1/api2/node_modules/@transloadit/mcp-server/dist
+cd ~/code/api2-clone-1 && core/bin/devdock.ts --app api2 restart -s mcp-server
 ```
 
 Bump the dependency in API2 once the package is published from this branch.
diff --git a/packages/mcp-server/.codex-plugin/plugin.json b/packages/mcp-server/.codex-plugin/plugin.json
new file mode 100644
index 00000000..a10565dd
--- /dev/null
+++ b/packages/mcp-server/.codex-plugin/plugin.json
@@ -0,0 +1,48 @@
+{
+  "name": "transloadit",
+  "version": "0.5.0",
+  "description": "Process video, audio, images and documents with Transloadit: encode, resize, transcribe, convert and deliver files through 86+ Robots.",
+  "author": {
+    "name": "Transloadit",
+    "email": "support@transloadit.com",
+    "url": "https://transloadit.com"
+  },
+  "homepage": "https://transloadit.com/docs/sdks/mcp-server/",
+  "repository": "https://github.com/transloadit/node-sdk",
+  "license": "MIT",
+  "keywords": [
+    "media",
+    "video",
+    "image",
+    "audio",
+    "document-processing",
+    "file-processing",
+    "transcoding",
+    "uploads"
+  ],
+  "mcpServers": {
+    "transloadit": {
+      "type": "http",
+      "url": "https://api2.transloadit.com/mcp"
+    }
+  },
+  "interface": {
+    "displayName": "Transloadit",
+    "shortDescription": "Encode, resize, transcribe and convert files in the chat.",
+    "longDescription": "Drop a file in the chat and let Transloadit process it: HLS and MP4 encoding, image resizing and optimization, background removal, transcription and subtitles, document conversion and thumbnails. Results come back as previews with download links, and any run can be saved as a reusable Template. Browsing Robots and linting Assembly Instructions works without an account; processing connects to your Transloadit Workspace through OAuth. Agent Skills for these workflows are published at https://transloadit.com/.well-known/skills/index.json (source: https://github.com/transloadit/skills).",
+    "developerName": "Transloadit",
+    "category": "Productivity",
+    "capabilities": ["Read", "Write"],
+    "websiteURL": "https://transloadit.com",
+    "privacyPolicyURL": "https://transloadit.com/legal/privacy/",
+    "termsOfServiceURL": "https://transloadit.com/legal/terms/",
+    "defaultPrompt": [
+      "Turn this video into HLS with 720p and 1080p renditions",
+      "Transcribe this recording and give me an SRT subtitle file"
+    ],
+    "brandColor": "#1B61A7",
+    "composerIcon": "./assets/icon.png",
+    "logo": "./assets/logo.png",
+    "screenshots": []
+  }
+}
diff --git a/packages/mcp-server/README.md b/packages/mcp-server/README.md
index 83b12691..f81b3e82 100644
--- a/packages/mcp-server/README.md
+++ b/packages/mcp-server/README.md
@@ -2,18 +2,122 @@
 
 Transloadit MCP Server (Streamable HTTP + stdio), built on top of `@transloadit/node`.
 
-## Install
+## Connect by URL (recommended)
+
+The hosted server lives at:
+
+```text
+https://api2.transloadit.com/mcp
+```
+
+Add it to your MCP client by URL. The client discovers API2 as the OAuth authorization server,
+opens a browser consent page in the Transloadit Console, and keeps a short-lived token plus refresh
+token for you. No API keys leave your Workspace.
+
+Browsing Robots (`transloadit_list_robots`, `transloadit_get_robot_help`) and linting Assembly
+Instructions work before you sign in; creating Assemblies and listing Templates ask you to connect
+your Workspace first.
+
+### Claude Code
 
 ```bash
-npm install @transloadit/mcp-server
+claude mcp add --transport http transloadit https://api2.transloadit.com/mcp
+claude mcp login transloadit
+```
+
+For non-interactive runs (for example `claude -p`), explicitly allow MCP tools:
+
+```bash
+claude -p "List templates" \
+  --allowedTools mcp__transloadit__* \
+  --output-format json
+```
+
+### Claude.ai and Claude Desktop
+
+Settings → Connectors → Add custom connector → enter `https://api2.transloadit.com/mcp`. Claude
+registers itself with API2 and opens the consent page.
+
+### ChatGPT
+
+Settings → Apps & Connectors → Advanced → Developer mode → Create, then enter the URL above with
+authentication set to OAuth. Files you attach in the chat are handed to
+`transloadit_create_assembly` as `attachments`; results render in the Assembly result widget.
+
+The plugin manifest for the ChatGPT and Codex catalog (`plugin.json`, `mcp.json` and the
+`.codex-plugin/plugin.json` fallback) lives in this package directory. It points at the hosted
+server and at the Agent Skills catalog at `https://transloadit.com/.well-known/skills/index.json`
+instead of bundling skill files.
+
+### Codex
+
+```bash
+codex mcp add transloadit --url https://api2.transloadit.com/mcp
+codex mcp login transloadit
+```
+
+Or in `~/.codex/config.toml`:
+
+```toml
+[mcp_servers.transloadit]
+url = "https://api2.transloadit.com/mcp"
 ```
 
-## Quick start (self-hosted, recommended)
+### Cursor
+
+`~/.cursor/mcp.json`:
+
+```json
+{
+  "mcpServers": {
+    "transloadit": {
+      "url": "https://api2.transloadit.com/mcp"
+    }
+  }
+}
+```
+
+### MCP Inspector
+
+```bash
+npx @modelcontextprotocol/inspector --cli https://api2.transloadit.com/mcp
+```
 
-For most teams, self-hosted MCP is the simplest happy path: run the server where your agent runs,
-set `TRANSLOADIT_KEY` and `TRANSLOADIT_SECRET`, and the server handles API auth automatically.
+## CI and headless agents
 
-### Stdio (recommended)
+Where no browser is available, mint a bearer token from an Auth Key and pass it as
+`Authorization: Bearer <token>`:
+
+```bash
+npx -y @transloadit/node auth token --aud mcp
+```
+
+Generate this token in a trusted environment (backend, CI, or local shell), then hand it to the
+agent runtime. You can mint it via:
+
+- CLI: `npx -y @transloadit/node auth token --aud mcp`
+- API: `POST https://api2.transloadit.com/token` (HTTP Basic Auth with key/secret)
+- Node SDK: instantiate `Transloadit` with `authKey` + `authSecret`, then call
+  `client.mintBearerToken({ aud: 'mcp' })`
+
+Interactive CLI sessions can also run `npx -y @transloadit/node auth login` (device flow) and reuse
+the stored credentials.
+
+Bearer tokens satisfy signature auth on API2 requests; signature checks apply to key/secret
+requests.
+
+## Self-hosted
+
+Run the server where your agent runs, set `TRANSLOADIT_KEY` and `TRANSLOADIT_SECRET`, and the server
+handles API auth automatically.
+
+### Install
+
+```bash
+npm install @transloadit/mcp-server
+```
+
+### Stdio
 
 ```bash
 TRANSLOADIT_KEY=MY_AUTH_KEY TRANSLOADIT_SECRET=MY_SECRET_KEY npx -y @transloadit/mcp-server stdio
@@ -26,7 +130,8 @@ TRANSLOADIT_KEY=MY_AUTH_KEY TRANSLOADIT_SECRET=MY_SECRET_KEY \
 npx -y @transloadit/mcp-server http --host 127.0.0.1 --port 5723
 ```
 
-When binding HTTP mode to non-localhost hosts, `TRANSLOADIT_MCP_TOKEN` is required.
+When binding HTTP mode to non-localhost hosts, `TRANSLOADIT_MCP_TOKEN` (or the hosted-mode
+`TRANSLOADIT_MCP_RESOURCE_METADATA_URL`) is required.
 
 ### Docker
 
@@ -65,36 +170,11 @@ export TRANSLOADIT_MCP_TOKEN="$(openssl rand -hex 32)"
 npx -y @transloadit/mcp-server http --host 0.0.0.0 --port 5723
 ```
 
-## Hosted endpoint
-
-If you cannot run `npx` where the agent runs, use the hosted endpoint:
-
-```text
-https://api2.transloadit.com/mcp
-```
-
-Use `Authorization: Bearer <token>`. Mint a token with:
-
-```bash
-npx -y @transloadit/node auth token --aud mcp
-```
-
-Generate this token in a trusted environment (backend, CI, or local shell), then hand it to the
-agent runtime. You can mint it via:
-
-- CLI: `npx -y @transloadit/node auth token --aud mcp`
-- API: `POST https://api2.transloadit.com/token` (HTTP Basic Auth with key/secret)
-- Node SDK: instantiate `Transloadit` with `authKey` + `authSecret`, then call
-  `client.mintBearerToken({ aud: 'mcp' })`
-
-Bearer tokens satisfy signature auth on API2 requests; signature checks apply to key/secret
-requests.
-
-## Agent client setup
+### Self-hosted client setup
 
-Most users add the server to their MCP client and let the client start it automatically via stdio.
+Most self-hosted users add the server to their MCP client and let the client start it via stdio.
 
-### Claude Code
+#### Claude Code
 
 ```bash
 claude mcp add --transport stdio transloadit \
@@ -103,15 +183,7 @@ claude mcp add --transport stdio transloadit \
   -- npx -y @transloadit/mcp-server stdio
 ```
 
-For non-interactive runs (for example `claude -p`), explicitly allow MCP tools:
-
-```bash
-claude -p "List templates" \
-  --allowedTools mcp__transloadit__* \
-  --output-format json
-```
-
-### Codex CLI
+#### Codex CLI
 
 ```bash
 codex mcp add transloadit \
@@ -129,7 +201,7 @@ args = ["-y", "@transloadit/mcp-server", "stdio"]
 enabled_tools = ["transloadit_list_templates"]
 ```
 
-### Gemini CLI
+#### Gemini CLI
 
 ```bash
 gemini mcp add --scope user transloadit npx -y @transloadit/mcp-server stdio \
@@ -155,7 +227,7 @@ Allowlist tools in `~/.gemini/settings.json`:
 }
 ```
 
-### Cursor
+#### Cursor
 
 `~/.cursor/mcp.json`:
 
@@ -174,7 +246,7 @@ Allowlist tools in `~/.gemini/settings.json`:
 }
 ```
 
-### OpenCode
+#### OpenCode
 
 `~/.config/opencode/opencode.json`:
 
@@ -193,27 +265,21 @@ Allowlist tools in `~/.gemini/settings.json`:
 }
 ```
 
-## Run the server manually
-
-HTTP:
-
-```bash
-npx -y @transloadit/mcp-server http --host 127.0.0.1 --port 5723
-```
-
-Stdio:
-
-```bash
-npx -y @transloadit/mcp-server stdio
-```
-
 ## Auth model
 
 ### Hosted (`https://api2.transloadit.com/mcp`)
 
-- Mint token via `POST https://api2.transloadit.com/token`.
-- Send `Authorization: Bearer <access_token>`.
-- Bearer auth satisfies signature auth; signature checks apply to key/secret requests.
+- Requests without a bearer token get `401` with
+  `WWW-Authenticate: Bearer resource_metadata="https://api2.transloadit.com/.well-known/oauth-protected-resource/mcp"`.
+  MCP clients follow that document to API2's authorization server (authorization code + PKCE,
+  Dynamic Client Registration or Client ID Metadata Documents).
+- Bearer tokens (OAuth or minted with `--aud mcp`) are forwarded to API2, which verifies them on
+  every call. A rejected or expired token yields a tool result with `isError` and
+  `_meta["mcp/www_authenticate"]`, so ChatGPT and Claude prompt you to reconnect.
+- Each tool declares `securitySchemes`: `noauth` for Robot docs and linting, `oauth2` with the
+  scopes it needs (`assemblies:write`, `assemblies:read`, `templates:read`) otherwise.
+- Browser requests must come from ChatGPT, Claude, Transloadit or loopback origins; requests without
+  an `Origin` header (CLIs, servers) are not restricted. Set `allowedOrigins` to change the list.
 
 ### Self-hosted
 
@@ -230,6 +296,10 @@ npx -y @transloadit/mcp-server stdio
 - `TRANSLOADIT_KEY`
 - `TRANSLOADIT_SECRET`
 - `TRANSLOADIT_MCP_TOKEN`
+- `TRANSLOADIT_MCP_RESOURCE_METADATA_URL` (hosted mode: protected-resource metadata URL to
+  advertise in `401` challenges)
+- `TRANSLOADIT_MCP_CONSOLE_URL` (optional, default `https://transloadit.com`; Console origin for
+  widget deep links)
 - `TRANSLOADIT_ENDPOINT` (optional, default `https://api2.transloadit.com`)
 - `TRANSLOADIT_MCP_METRICS_PATH` (optional, default `/metrics`)
 - `TRANSLOADIT_MCP_METRICS_USER` (optional)
@@ -241,21 +311,41 @@ npx -y @transloadit/mcp-server stdio
 - `npx -y @transloadit/mcp-server http --endpoint https://api2.transloadit.com`
 - `npx -y @transloadit/mcp-server http --config path/to/config.json`
 
+The JSON config accepts the same keys as `createTransloaditMcpHttpHandler()`, including
+`allowedOrigins`, `resourceMetadataUrl` and `consoleUrl`.
+
 ## Tool surface
 
-- `transloadit_lint_assembly_instructions`
-- `transloadit_create_assembly`
-- `transloadit_get_assembly_status`
-- `transloadit_wait_for_assembly`
-- `transloadit_list_robots`
-- `transloadit_get_robot_help`
-- `transloadit_list_templates`
+| Tool                                    | Auth                        | Notes                                    |
+| --------------------------------------- | --------------------------- | ---------------------------------------- |
+| `transloadit_lint_assembly_instructions` | none                        | read-only                                |
+| `transloadit_list_robots`               | none                        | read-only                                |
+| `transloadit_get_robot_help`            | none                        | read-only                                |
+| `transloadit_create_assembly`           | `oauth2` `assemblies:write` | open-world (URL imports), result widget  |
+| `transloadit_get_assembly_status`       | `oauth2` `assemblies:read`  | read-only                                |
+| `transloadit_wait_for_assembly`         | `oauth2` `assemblies:read`  | read-only, result widget                 |
+| `transloadit_list_templates`            | `oauth2` `templates:read`   | read-only                                |
+| `transloadit_get_profile`               | `oauth2`                    | read-only, `_meta["openai/profile"]`     |
+
+Every tool carries `title`, `readOnlyHint`, `destructiveHint` (always `false`), `idempotentHint`
+and `openWorldHint` annotations.
 
 `transloadit_list_templates` supports:
 
 - `include_builtin`: `all`, `latest`, `exclusively-all`, `exclusively-latest`
 - `include_content`: include parsed `steps` in each template item
 
+`transloadit_get_profile` returns `{ id, name?, nickname? }` for the Workspace behind the current
+credentials, derived from the Workspace's own Assemblies or Templates.
+
+### Result widget
+
+`transloadit_create_assembly` and `transloadit_wait_for_assembly` link the MCP Apps resource
+`ui://transloadit/assembly-result` (`_meta.ui.resourceUri`, also `_meta["openai/outputTemplate"]`).
+Hosts that support MCP Apps render each Step's results with image, video and audio previews,
+download links, an "Open in Console" link and a "Save as Template" shortcut. The widget only needs
+`https://*.transloadit.com` and `https://*.transloadit.net` in its CSP.
+
 ## Input files
 
 ```ts
@@ -276,6 +366,21 @@ export type InputFile =
     }
 ```
 
+Hosts that attach chat files (ChatGPT) pass them under `attachments` instead, as declared by
+`_meta["openai/fileParams"]`:
+
+```ts
+type Attachment = {
+  download_url: string
+  file_id: string
+  mime_type?: string
+  file_name?: string
+}
+```
+
+Each attachment becomes a URL input (`attachment_1`, `attachment_2`, …) and follows the URL rules
+below.
+
 ## Limits
 
 These limits apply to inline JSON/base64 payloads. For larger files, use a public URL or upload from
@@ -329,7 +434,8 @@ but this does not enable private-network URL file downloads.
 - Disable via `metricsPath: false`.
 - Optional metrics basic auth via `TRANSLOADIT_MCP_METRICS_USER` +
   `TRANSLOADIT_MCP_METRICS_PASSWORD` or `metricsAuth`.
-- Public discovery endpoint at `/.well-known/mcp/server-card.json`.
+- Public discovery endpoint at `/.well-known/mcp/server-card.json`, listing every tool with its
+  annotations and security schemes and, in hosted mode, the OAuth resource metadata URL.
 
 ## MCP vs skills/CLI
 
@@ -388,7 +494,3 @@ corepack yarn --cwd packages/mcp-server test:e2e
 - Add or update tests with behavior changes.
 - Keep README and website docs aligned for user-facing behavior.
 - Open a PR in `transloadit/node-sdk`.
-
-### Roadmap
-
-- Next.js Claude Web flow to mint and hand off bearer tokens for MCP.
diff --git a/packages/mcp-server/mcp.json b/packages/mcp-server/mcp.json
new file mode 100644
index 00000000..2c121eac
--- /dev/null
+++ b/packages/mcp-server/mcp.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "https://agent-plugins.org/schemas/1.0.0/mcp.schema.json",
+  "mcpServers": {
+    "transloadit": {
+      "type": "streamable-http",
+      "url": "https://api2.transloadit.com/mcp"
+    }
+  }
+}
diff --git a/packages/mcp-server/plugin.json b/packages/mcp-server/plugin.json
new file mode 100644
index 00000000..fb7d81cd
--- /dev/null
+++ b/packages/mcp-server/plugin.json
@@ -0,0 +1,53 @@
+{
+  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
+  "name": "transloadit",
+  "version": "0.5.0",
+  "description": "Process video, audio, images and documents with Transloadit: encode, resize, transcribe, convert and deliver files through 86+ Robots.",
+  "author": {
+    "name": "Transloadit",
+    "email": "support@transloadit.com",
+    "url": "https://transloadit.com"
+  },
+  "homepage": "https://transloadit.com/docs/sdks/mcp-server/",
+  "repository": "https://github.com/transloadit/node-sdk",
+  "license": "MIT",
+  "keywords": [
+    "media",
+    "video",
+    "image",
+    "audio",
+    "document-processing",
+    "file-processing",
+    "transcoding",
+    "uploads"
+  ],
+  "extensions": {
+    "com.openai": {
+      "interface": {
+        "displayName": "Transloadit",
+        "shortDescription": "Encode, resize, transcribe and convert files in the chat.",
+        "longDescription": "Drop a file in the chat and let Transloadit process it: HLS and MP4 encoding, image resizing and optimization, background removal, transcription and subtitles, document conversion and thumbnails. Results come back as previews with download links, and any run can be saved as a reusable Template. Browsing Robots and linting Assembly Instructions works without an account; processing connects to your Transloadit Workspace through OAuth. Agent Skills for these workflows are published at https://transloadit.com/.well-known/skills/index.json (source: https://github.com/transloadit/skills).",
+        "developerName": "Transloadit",
+        "category": "Productivity",
+        "capabilities": ["Read", "Write"],
+        "websiteURL": "https://transloadit.com",
+        "privacyPolicyURL": "https://transloadit.com/legal/privacy/",
+        "termsOfServiceURL": "https://transloadit.com/legal/terms/",
+        "defaultPrompt": [
+          "Turn this video into HLS with 720p and 1080p renditions",
+          "Transcribe this recording and give me an SRT subtitle file"
+        ],
+        "brandColor": "#1B61A7",
+        "composerIcon": "./assets/icon.png",
+        "logo": "./assets/logo.png",
+        "screenshots": []
+      }
+    },
+    "com.transloadit": {
+      "skillsCatalog": "https://transloadit.com/.well-known/skills/index.json",
+      "skillsRepository": "https://github.com/transloadit/skills",
+      "mcpServer": "https://api2.transloadit.com/mcp",
+      "authentication": "oauth"
+    }
+  }
+}
diff --git a/packages/mcp-server/server.json b/packages/mcp-server/server.json
index affac95c..c5889114 100644
--- a/packages/mcp-server/server.json
+++ b/packages/mcp-server/server.json
@@ -49,7 +49,7 @@
       "headers": [
         {
           "name": "Authorization",
-          "description": "Bearer token obtained via the authenticate tool, or set TRANSLOADIT_KEY and TRANSLOADIT_SECRET env vars with the self-hosted package instead",
+          "description": "Optional. Clients that support OAuth discover the authorization server from the endpoint's 401 challenge; headless runs pass a token minted with `npx -y @transloadit/node auth token --aud mcp`",
           "isRequired": false,
           "isSecret": true
         }

From da8fc66dc737da609beebb7d42a8f298deb704df Mon Sep 17 00:00:00 2001
From: Kevin van Zonneveld <kevin@vanzonneveld.net>
Date: Wed, 30 Sep 2026 22:20:58 +0200
Subject: [PATCH 05/27] Record the devdock verification of the hosted MCP build

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 docs/prompts/2026-09-30-mcp-oauth-discovery.md | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/docs/prompts/2026-09-30-mcp-oauth-discovery.md b/docs/prompts/2026-09-30-mcp-oauth-discovery.md
index be8b17a6..e0b376e9 100644
--- a/docs/prompts/2026-09-30-mcp-oauth-discovery.md
+++ b/docs/prompts/2026-09-30-mcp-oauth-discovery.md
@@ -80,4 +80,13 @@ cp -r packages/mcp-server/dist ~/code/api2-clone-1/api2/node_modules/@transloadi
 cd ~/code/api2-clone-1 && core/bin/devdock.ts --app api2 restart -s mcp-server
 ```
 
+Verified on devdock (2026-09-30) with this branch's `dist` and the api2 branch's service environment:
+`POST /mcp` without a token returns `401` with
+`WWW-Authenticate: Bearer resource_metadata="https://api2-devdock.transloadit.dev/.well-known/oauth-protected-resource/mcp"`,
+the bare `GET` health probe stays `200`, `tools/list` shows `securitySchemes`, `openai/fileParams`
+and the widget link, and `resources/read` serves `ui://transloadit/assembly-result`. The server card
+at `/.well-known/mcp/server-card.json` is rendered by the API2 process from its own import of the
+package, so it only picks up the new tools and OAuth schemes after API2 restarts with the bumped
+dependency and passes `resourceMetadataUrl` to `buildServerCard()`.
+
 Bump the dependency in API2 once the package is published from this branch.

From ed0cc57c0b905360d7321f882590751bba5ade66 Mon Sep 17 00:00:00 2001
From: Kevin van Zonneveld <kevin@vanzonneveld.net>
Date: Wed, 30 Sep 2026 23:19:58 +0200
Subject: [PATCH 06/27] Identify the hosted MCP service to API2 with an
 upstream secret header

API2 only accepts relayed `aud=mcp` bearer tokens on ordinary endpoints when the request comes
from the Transloadit-hosted MCP service. `TRANSLOADIT_MCP_UPSTREAM_SECRET` (option and JSON
config key `upstreamSecret`) is sent as `Transloadit-Mcp-Upstream` next to a forwarded bearer
token, never in key/secret mode, and is redacted from logs. `@transloadit/node` gains an
`extraHeaders` client option to carry the fixed header.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 .changeset/mcp-upstream-header.md             |   7 +
 packages/mcp-server/README.md                 |   4 +
 packages/mcp-server/src/cli.ts                |   5 +
 packages/mcp-server/src/logger.ts             |   8 +-
 packages/mcp-server/src/server.ts             |  12 ++
 .../test/unit/upstream-secret.test.ts         | 125 ++++++++++++++++++
 packages/node/src/Transloadit.ts              |   9 ++
 .../test/unit/test-transloadit-client.test.ts |  23 ++++
 8 files changed, 192 insertions(+), 1 deletion(-)
 create mode 100644 .changeset/mcp-upstream-header.md
 create mode 100644 packages/mcp-server/test/unit/upstream-secret.test.ts

diff --git a/.changeset/mcp-upstream-header.md b/.changeset/mcp-upstream-header.md
new file mode 100644
index 00000000..1e604a28
--- /dev/null
+++ b/.changeset/mcp-upstream-header.md
@@ -0,0 +1,7 @@
+---
+"@transloadit/node": patch
+"transloadit": patch
+---
+
+Add an `extraHeaders` client option so trusted relays such as the hosted MCP service can send a
+fixed header (`Transloadit-Mcp-Upstream`) with every API request next to a forwarded bearer token.
diff --git a/packages/mcp-server/README.md b/packages/mcp-server/README.md
index f81b3e82..9ed22d0b 100644
--- a/packages/mcp-server/README.md
+++ b/packages/mcp-server/README.md
@@ -280,6 +280,8 @@ Allowlist tools in `~/.gemini/settings.json`:
   scopes it needs (`assemblies:write`, `assemblies:read`, `templates:read`) otherwise.
 - Browser requests must come from ChatGPT, Claude, Transloadit or loopback origins; requests without
   an `Origin` header (CLIs, servers) are not restricted. Set `allowedOrigins` to change the list.
+- `TRANSLOADIT_MCP_UPSTREAM_SECRET` is set by Transloadit's own deployment so API2 can tell that a
+  relayed `aud=mcp` token arrives from the hosted service; it is not needed for self-hosting.
 
 ### Self-hosted
 
@@ -298,6 +300,8 @@ Allowlist tools in `~/.gemini/settings.json`:
 - `TRANSLOADIT_MCP_TOKEN`
 - `TRANSLOADIT_MCP_RESOURCE_METADATA_URL` (hosted mode: protected-resource metadata URL to
   advertise in `401` challenges)
+- `TRANSLOADIT_MCP_UPSTREAM_SECRET` (hosted mode only, set by Transloadit's deployment; sent to
+  API2 as `Transloadit-Mcp-Upstream` next to forwarded bearer tokens)
 - `TRANSLOADIT_MCP_CONSOLE_URL` (optional, default `https://transloadit.com`; Console origin for
   widget deep links)
 - `TRANSLOADIT_ENDPOINT` (optional, default `https://api2.transloadit.com`)
diff --git a/packages/mcp-server/src/cli.ts b/packages/mcp-server/src/cli.ts
index 0a6e2e11..381d8ad9 100644
--- a/packages/mcp-server/src/cli.ts
+++ b/packages/mcp-server/src/cli.ts
@@ -20,6 +20,7 @@ Environment:
   TRANSLOADIT_SECRET
   TRANSLOADIT_MCP_TOKEN
   TRANSLOADIT_MCP_RESOURCE_METADATA_URL
+  TRANSLOADIT_MCP_UPSTREAM_SECRET
   TRANSLOADIT_MCP_CONSOLE_URL
   TRANSLOADIT_ENDPOINT
   TRANSLOADIT_MCP_METRICS_PATH
@@ -132,6 +133,8 @@ const main = async (): Promise<void> => {
       | undefined
     const resourceMetadataUrl = (fileConfig.resourceMetadataUrl ??
       process.env.TRANSLOADIT_MCP_RESOURCE_METADATA_URL) as string | undefined
+    const upstreamSecret = (fileConfig.upstreamSecret ??
+      process.env.TRANSLOADIT_MCP_UPSTREAM_SECRET) as string | undefined
     const consoleUrl = (fileConfig.consoleUrl ?? process.env.TRANSLOADIT_MCP_CONSOLE_URL) as
       | string
       | undefined
@@ -151,6 +154,7 @@ const main = async (): Promise<void> => {
       clientSuffix,
       mcpToken,
       resourceMetadataUrl,
+      upstreamSecret,
       consoleUrl,
       allowedOrigins: fileConfig.allowedOrigins as string[] | undefined,
       allowedHosts: fileConfig.allowedHosts as string[] | undefined,
@@ -198,6 +202,7 @@ main().catch((err) => {
     process.env.TRANSLOADIT_KEY,
     process.env.TRANSLOADIT_SECRET,
     process.env.TRANSLOADIT_MCP_TOKEN,
+    process.env.TRANSLOADIT_MCP_UPSTREAM_SECRET,
   ])
   logger.err('MCP server failed: %s', redact(err))
   process.exit(1)
diff --git a/packages/mcp-server/src/logger.ts b/packages/mcp-server/src/logger.ts
index 0f37f86a..264ca5fc 100644
--- a/packages/mcp-server/src/logger.ts
+++ b/packages/mcp-server/src/logger.ts
@@ -3,7 +3,13 @@ import { SevLogger } from '@transloadit/sev-logger'
 const baseLogger = new SevLogger({ breadcrumbs: ['mcp-server'] })
 
 const redactString = (value: string, secrets: string[]): string => {
-  let output = value.replace(/Bearer\s+[^\s]+/gi, 'Bearer [redacted]')
+  let output = value
+    .replace(/Bearer\s+[^\s]+/gi, 'Bearer [redacted]')
+    // The hosted upstream secret travels as a header; scrub it even when it was not listed.
+    .replace(
+      /Transloadit-Mcp-Upstream(["']?\s*[:=]\s*["']?)[^\s"',}]+/gi,
+      'Transloadit-Mcp-Upstream$1[redacted]',
+    )
   for (const secret of secrets) {
     if (!secret) continue
     output = output.split(secret).join('[redacted]')
diff --git a/packages/mcp-server/src/server.ts b/packages/mcp-server/src/server.ts
index 6cb3f970..541bae4f 100644
--- a/packages/mcp-server/src/server.ts
+++ b/packages/mcp-server/src/server.ts
@@ -41,6 +41,12 @@ export type TransloaditMcpServerOptions = {
    * RFC 6750 challenge that points OAuth clients at API2 (`TRANSLOADIT_MCP_RESOURCE_METADATA_URL`).
    */
   resourceMetadataUrl?: string
+  /**
+   * Shared secret that identifies the Transloadit-hosted MCP service to API2, which only accepts
+   * relayed `aud=mcp` bearer tokens from that service (`TRANSLOADIT_MCP_UPSTREAM_SECRET`). It is
+   * sent as `Transloadit-Mcp-Upstream` next to a forwarded bearer token and never with key/secret.
+   */
+  upstreamSecret?: string
   /** Console origin used for widget deep links; defaults to the public website. */
   consoleUrl?: string
   endpoint?: string
@@ -52,6 +58,9 @@ export type TransloaditMcpServerOptions = {
 
 const defaultConsoleUrl = 'https://transloadit.com'
 
+/** Header that carries `upstreamSecret` on API2 calls made with a forwarded bearer token. */
+export const upstreamSecretHeader = 'Transloadit-Mcp-Upstream'
+
 type LintIssueOutput = {
   path: string
   message: string
@@ -440,6 +449,9 @@ const createLiveClient = (
         endpoint: options.endpoint,
         clientName: getClientName(options),
         followRedirects: false,
+        extraHeaders: options.upstreamSecret
+          ? { [upstreamSecretHeader]: options.upstreamSecret }
+          : undefined,
       }),
     }
   }
diff --git a/packages/mcp-server/test/unit/upstream-secret.test.ts b/packages/mcp-server/test/unit/upstream-secret.test.ts
new file mode 100644
index 00000000..f36977ee
--- /dev/null
+++ b/packages/mcp-server/test/unit/upstream-secret.test.ts
@@ -0,0 +1,125 @@
+import type { AddressInfo } from 'node:net'
+
+import type { TransloaditMcpHttpOptions } from '../../src/http.ts'
+
+import { createServer } from 'node:http'
+
+import { Client } from '@modelcontextprotocol/sdk/client/index.js'
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js'
+import nock from 'nock'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+
+import { createTransloaditMcpHttpHandler } from '../../src/http.ts'
+import { redactForLog } from '../../src/logger.ts'
+import { upstreamSecretHeader } from '../../src/server.ts'
+
+const upstreamSecret = 'upstream-s3cr3t'
+const endpoint = 'https://api2.transloadit.com'
+
+describe('upstream secret header', () => {
+  const serverOptions: TransloaditMcpHttpOptions = { metricsPath: false }
+  const handler = createTransloaditMcpHttpHandler(serverOptions)
+  const httpServer = createServer((req, res) => {
+    void handler(req, res)
+  })
+  let url: URL
+  let client: Client
+
+  const connect = async (headers: Record<string, string> = {}): Promise<void> => {
+    client = new Client({ name: 'upstream-secret', version: '1.0.0' })
+    await client.connect(new StreamableHTTPClientTransport(url, { requestInit: { headers } }))
+  }
+
+  const listTemplates = async (): Promise<unknown> => {
+    const result = await client.callTool({ name: 'transloadit_list_templates', arguments: {} })
+    return result.structuredContent
+  }
+
+  beforeEach(async () => {
+    delete serverOptions.authKey
+    delete serverOptions.authSecret
+    delete serverOptions.upstreamSecret
+    await new Promise<void>((resolve) => httpServer.listen(0, '127.0.0.1', resolve))
+    const { port } = httpServer.address() as AddressInfo
+    url = new URL(`http://127.0.0.1:${port}/mcp`)
+  })
+
+  afterEach(async () => {
+    await client?.close()
+    await handler.close()
+    await new Promise<void>((resolve, reject) =>
+      httpServer.close((error) => (error ? reject(error) : resolve())),
+    )
+    nock.cleanAll()
+  })
+
+  it('sends the header with a forwarded bearer token in hosted mode', async () => {
+    serverOptions.upstreamSecret = upstreamSecret
+    const api = nock(endpoint, {
+      reqheaders: {
+        authorization: 'Bearer forwarded-oauth-token',
+        [upstreamSecretHeader.toLowerCase()]: upstreamSecret,
+      },
+    })
+      .get('/templates')
+      .query(true)
+      .reply(200, { items: [], count: 0 })
+    await connect({ Authorization: 'Bearer forwarded-oauth-token' })
+
+    await expect(listTemplates()).resolves.toMatchObject({ status: 'ok', templates: [] })
+    expect(api.isDone()).toBe(true)
+  })
+
+  it('omits the header when no secret is configured', async () => {
+    const api = nock(endpoint, { badheaders: [upstreamSecretHeader.toLowerCase()] })
+      .get('/templates')
+      .query(true)
+      .reply(200, { items: [], count: 0 })
+    await connect({ Authorization: 'Bearer forwarded-oauth-token' })
+
+    await expect(listTemplates()).resolves.toMatchObject({ status: 'ok' })
+    expect(api.isDone()).toBe(true)
+  })
+
+  it('omits the header for self-hosted key/secret calls even when configured', async () => {
+    serverOptions.upstreamSecret = upstreamSecret
+    serverOptions.authKey = 'key'
+    serverOptions.authSecret = 'secret'
+    const api = nock(endpoint, { badheaders: [upstreamSecretHeader.toLowerCase()] })
+      .get('/templates')
+      .query(true)
+      .reply(200, { items: [], count: 0 })
+    await connect()
+
+    await expect(listTemplates()).resolves.toMatchObject({ status: 'ok' })
+    expect(api.isDone()).toBe(true)
+  })
+
+  it('keeps the secret out of tool errors and the server card', async () => {
+    serverOptions.upstreamSecret = upstreamSecret
+    nock(endpoint).get('/templates').query(true).reply(500, { error: 'SERVER_ERROR' })
+    await connect({ Authorization: 'Bearer forwarded-oauth-token' })
+
+    const result = await client.callTool({ name: 'transloadit_list_templates', arguments: {} })
+    expect(JSON.stringify(result)).not.toContain(upstreamSecret)
+
+    const card = await fetch(new URL('/.well-known/mcp/server-card.json', url))
+    expect(await card.text()).not.toContain(upstreamSecret)
+  })
+})
+
+describe('redactForLog', () => {
+  it('scrubs the upstream secret header even when the value was not listed', () => {
+    const line = `request failed headers={"Transloadit-Mcp-Upstream":"${upstreamSecret}","Authorization":"Bearer abc"}`
+    const redacted = redactForLog(line, [])
+    expect(redacted).not.toContain(upstreamSecret)
+    expect(redacted).toContain('Transloadit-Mcp-Upstream')
+    expect(redacted).toContain('Bearer [redacted]')
+  })
+
+  it('scrubs listed secrets anywhere in the message', () => {
+    expect(redactForLog(`boom ${upstreamSecret} boom`, [upstreamSecret])).toBe(
+      'boom [redacted] boom',
+    )
+  })
+})
diff --git a/packages/node/src/Transloadit.ts b/packages/node/src/Transloadit.ts
index c1516cc0..328f280c 100644
--- a/packages/node/src/Transloadit.ts
+++ b/packages/node/src/Transloadit.ts
@@ -459,6 +459,11 @@ type BaseOptions = {
   followRedirects?: boolean
   validateResponses?: boolean
   clientName?: string
+  /**
+   * Fixed headers sent with every API request, for trusted relays such as the Transloadit-hosted
+   * MCP service that must identify itself to API2 next to a forwarded bearer token.
+   */
+  extraHeaders?: Record<string, string>
 }
 
 export type Options = BaseOptions & (AuthKeySecret | AuthToken)
@@ -482,6 +487,8 @@ export class Transloadit {
 
   private _clientName: string
 
+  #extraHeaders: Record<string, string>
+
   private _lastUsedAssemblyUrl = ''
 
   private _validateResponses = false
@@ -514,6 +521,7 @@ export class Transloadit {
     this._maxRetries = opts.maxRetries != null ? opts.maxRetries : 5
     this._defaultTimeout = opts.timeout != null ? opts.timeout : 60000
     this._clientName = opts.clientName?.trim() || `node-sdk:${version}`
+    this.#extraHeaders = { ...opts.extraHeaders }
 
     // Passed on to got https://github.com/sindresorhus/got/blob/main/documentation/7-retry.md
     this._gotRetry = opts.gotRetry != null ? opts.gotRetry : { limit: 0 }
@@ -1665,6 +1673,7 @@ export class Transloadit {
           'Transloadit-Client': this._clientName,
           'User-Agent': undefined, // Remove got's user-agent
           ...(this._authToken ? { Authorization: `Bearer ${this._authToken}` } : {}),
+          ...this.#extraHeaders,
           ...headers,
         },
         responseType: 'json',
diff --git a/packages/node/test/unit/test-transloadit-client.test.ts b/packages/node/test/unit/test-transloadit-client.test.ts
index b38aac3a..0fb1a85c 100644
--- a/packages/node/test/unit/test-transloadit-client.test.ts
+++ b/packages/node/test/unit/test-transloadit-client.test.ts
@@ -409,6 +409,29 @@ describe('Transloadit', () => {
         expect.objectContaining({ headers: { 'Transloadit-Client': 'mcp-server:1.2.3' } }),
       )
     })
+
+    it('should send extraHeaders next to the bearer token on every request', async () => {
+      const client = new Transloadit({
+        authToken: 'forwarded-token',
+        extraHeaders: { 'Transloadit-Mcp-Upstream': 'shared-secret' },
+      })
+
+      const get = mockGot('get')
+
+      const url = '/some-url'
+      // @ts-expect-error This tests private internals
+      await client._remoteJson({ url, method: 'get', isTrustedUrl: true })
+
+      expect(get).toHaveBeenCalledWith(
+        expect.any(String),
+        expect.objectContaining({
+          headers: expect.objectContaining({
+            Authorization: 'Bearer forwarded-token',
+            'Transloadit-Mcp-Upstream': 'shared-secret',
+          }),
+        }),
+      )
+    })
   })
 
   describe('getSignedSmartCDNUrl', () => {

From 824cc35a111bf4f56560e2059175c3851fd75e8c Mon Sep 17 00:00:00 2001
From: Kevin van Zonneveld <kevin@vanzonneveld.net>
Date: Wed, 30 Sep 2026 23:35:01 +0200
Subject: [PATCH 07/27] Document the node dist copy and paired dependency bump
 for devdock

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 docs/prompts/2026-09-30-mcp-oauth-discovery.md | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/docs/prompts/2026-09-30-mcp-oauth-discovery.md b/docs/prompts/2026-09-30-mcp-oauth-discovery.md
index e0b376e9..f9b95bc1 100644
--- a/docs/prompts/2026-09-30-mcp-oauth-discovery.md
+++ b/docs/prompts/2026-09-30-mcp-oauth-discovery.md
@@ -77,9 +77,18 @@ from the worktree's `api2/node_modules/@transloadit/mcp-server`. To test this br
 cd ~/code/node-sdk && corepack yarn build
 rm -rf ~/code/api2-clone-1/api2/node_modules/@transloadit/mcp-server/dist
 cp -r packages/mcp-server/dist ~/code/api2-clone-1/api2/node_modules/@transloadit/mcp-server/dist
+# The MCP server relies on the `extraHeaders` client option that only exists in this branch's
+# @transloadit/node; the published 4.14.0 in API2's node_modules silently drops the
+# `Transloadit-Mcp-Upstream` header, so copy that dist too.
+rm -rf ~/code/api2-clone-1/api2/node_modules/@transloadit/node/dist
+cp -r packages/node/dist ~/code/api2-clone-1/api2/node_modules/@transloadit/node/dist
 cd ~/code/api2-clone-1 && core/bin/devdock.ts --app api2 restart -s mcp-server
 ```
 
+The service also needs `TRANSLOADIT_MCP_RESOURCE_METADATA_URL`, `TRANSLOADIT_MCP_UPSTREAM_SECRET`
+(matching API2's expected value) and `TRANSLOADIT_ENDPOINT` in its environment; api2's service
+config on `agent/mcp-oauth-authcode` sets them.
+
 Verified on devdock (2026-09-30) with this branch's `dist` and the api2 branch's service environment:
 `POST /mcp` without a token returns `401` with
 `WWW-Authenticate: Bearer resource_metadata="https://api2-devdock.transloadit.dev/.well-known/oauth-protected-resource/mcp"`,
@@ -89,4 +98,6 @@ at `/.well-known/mcp/server-card.json` is rendered by the API2 process from its
 package, so it only picks up the new tools and OAuth schemes after API2 restarts with the bumped
 dependency and passes `resourceMetadataUrl` to `buildServerCard()`.
 
-Bump the dependency in API2 once the package is published from this branch.
+Once published from this branch, API2 must bump `@transloadit/node` (patch, brings `extraHeaders`)
+and `@transloadit/mcp-server` (minor) together; bumping only the MCP server leaves the upstream
+header unsent.

From b6cde6c69d9442115c0d0495708d92077d43d64b Mon Sep 17 00:00:00 2001
From: Kevin van Zonneveld <kevin@vanzonneveld.net>
Date: Thu, 1 Oct 2026 22:31:30 +0200
Subject: [PATCH 08/27] Fix Codex discovery, MCP Apps handshake, CORS, result
 CSP and key signing

QA (session 2fe9f3b7) found five MCP server gaps:

- Hosted mode answered a bare `GET /mcp` with the friendly 200, so Codex never saw the OAuth
  challenge. Every unauthenticated hosted request now gets the 401 challenge; the body keeps
  `name`/`status`/`docs`. Self-hosted and unauthenticated deployments keep the 200.
- The widget sent `clientInfo` in `ui/initialize`; MCP Apps 2026-01-26 hosts require `appInfo`
  and rejected the handshake. The widget now matches the ext-apps wire format, answers `ping` and
  `ui/resource-teardown`, shows tool-input progress, cancellations and failed tool calls, and
  stops waiting when initialization is rejected. Link clicks no longer call `preventDefault()`
  after an await.
- CORS preflights now allow `Mcp-Protocol-Version` (and expose `WWW-Authenticate`), so browser
  hosts such as the ext-apps basic host can connect.
- The widget CSP adds `https://*.r2.dev` result buckets; `TRANSLOADIT_MCP_RESULT_DOMAINS` /
  `resultDomains` override it.
- `TRANSLOADIT_SIGNATURE_ALGORITHM` / `signatureAlgorithm` (sha1, sha256, sha384) is passed to
  the SDK, so Console keys pinned to sha256 work; `INVALID_SIGNATURE` maps to an actionable hint.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .changeset/mcp-oauth-discovery.md             |   7 +
 packages/mcp-server/README.md                 |  21 +-
 packages/mcp-server/package.json              |   1 +
 packages/mcp-server/src/cli.ts                |  36 ++++
 packages/mcp-server/src/express.ts            |  25 ++-
 packages/mcp-server/src/http-helpers.ts       |  45 ++++-
 .../mcp-server/src/http-request-handler.ts    |  19 +-
 packages/mcp-server/src/http.ts               |  18 +-
 packages/mcp-server/src/server.ts             |  46 ++++-
 .../src/ui/assembly-result-widget.ts          | 147 ++++++++++----
 .../mcp-server/test/unit/cli-config.test.ts   |  57 ++++++
 .../mcp-server/test/unit/hosted-auth.test.ts  |  67 ++++++-
 .../test/unit/signature-algorithm.test.ts     |  81 ++++++++
 .../mcp-server/test/unit/tool-surface.test.ts |  38 +++-
 .../test/unit/widget-handshake.test.ts        | 186 ++++++++++++++++++
 .../test/unit/test-transloadit-client.test.ts |  18 ++
 yarn.lock                                     |   1 +
 17 files changed, 710 insertions(+), 103 deletions(-)
 create mode 100644 packages/mcp-server/test/unit/cli-config.test.ts
 create mode 100644 packages/mcp-server/test/unit/signature-algorithm.test.ts
 create mode 100644 packages/mcp-server/test/unit/widget-handshake.test.ts

diff --git a/.changeset/mcp-oauth-discovery.md b/.changeset/mcp-oauth-discovery.md
index 25dda9c3..bbef200a 100644
--- a/.changeset/mcp-oauth-discovery.md
+++ b/.changeset/mcp-oauth-discovery.md
@@ -20,3 +20,10 @@ connector requirements.
 - MCP Apps result widget `ui://transloadit/assembly-result` with previews, download links and a
   Save as Template shortcut, linked from the Assembly tools with `_meta.ui.resourceUri`.
 - `plugin.json`, `mcp.json` and `.codex-plugin/plugin.json` describe the ChatGPT and Codex plugin.
+- Hosted mode also challenges bare `GET /mcp` probes (Codex discovers OAuth from them); CORS now
+  allows `Mcp-Protocol-Version` so browser hosts can connect.
+- Self-hosted servers sign with `TRANSLOADIT_SIGNATURE_ALGORITHM` (`sha1`, `sha256` or `sha384`),
+  so Console keys that require `sha256` work; mismatches return an actionable
+  `mcp_invalid_signature` hint.
+- The widget speaks the MCP Apps `2026-01-26` handshake (`appInfo`), shows failed tool calls, and
+  allows `https://*.r2.dev` result URLs; `TRANSLOADIT_MCP_RESULT_DOMAINS` overrides its CSP.
diff --git a/packages/mcp-server/README.md b/packages/mcp-server/README.md
index 9ed22d0b..541d4785 100644
--- a/packages/mcp-server/README.md
+++ b/packages/mcp-server/README.md
@@ -123,6 +123,11 @@ npm install @transloadit/mcp-server
 TRANSLOADIT_KEY=MY_AUTH_KEY TRANSLOADIT_SECRET=MY_SECRET_KEY npx -y @transloadit/mcp-server stdio
 ```
 
+Auth Keys sign with one HMAC algorithm. Keys created in the Console with "Allow signing Smart CDN
+URLs" (the default) require `sha256`, so add `TRANSLOADIT_SIGNATURE_ALGORITHM=sha256`, as the
+Console's snippet for the key shows. Other keys use the default `sha384`. A mismatch fails with
+`mcp_invalid_signature`, and its hint names the algorithm the key requires.
+
 ### HTTP
 
 ```bash
@@ -273,6 +278,10 @@ Allowlist tools in `~/.gemini/settings.json`:
   `WWW-Authenticate: Bearer resource_metadata="https://api2.transloadit.com/.well-known/oauth-protected-resource/mcp"`.
   MCP clients follow that document to API2's authorization server (authorization code + PKCE,
   Dynamic Client Registration or Client ID Metadata Documents).
+- This includes a bare `GET /mcp`, because some clients (Codex) discover the authorization server
+  from that probe. Directory health checks therefore see `401` instead of `200`; the JSON body
+  still carries `name`, `status` and `docs`. Self-hosted and unauthenticated deployments keep
+  answering the bare `GET` with `200`.
 - Bearer tokens (OAuth or minted with `--aud mcp`) are forwarded to API2, which verifies them on
   every call. A rejected or expired token yields a tool result with `isError` and
   `_meta["mcp/www_authenticate"]`, so ChatGPT and Claude prompt you to reconnect.
@@ -297,11 +306,15 @@ Allowlist tools in `~/.gemini/settings.json`:
 
 - `TRANSLOADIT_KEY`
 - `TRANSLOADIT_SECRET`
+- `TRANSLOADIT_SIGNATURE_ALGORITHM` (optional, `sha1`, `sha256` or `sha384`, default `sha384`;
+  must match the Auth Key)
 - `TRANSLOADIT_MCP_TOKEN`
 - `TRANSLOADIT_MCP_RESOURCE_METADATA_URL` (hosted mode: protected-resource metadata URL to
   advertise in `401` challenges)
 - `TRANSLOADIT_MCP_UPSTREAM_SECRET` (hosted mode only, set by Transloadit's deployment; sent to
   API2 as `Transloadit-Mcp-Upstream` next to forwarded bearer tokens)
+- `TRANSLOADIT_MCP_RESULT_DOMAINS` (optional, comma-separated origins the result widget may load
+  previews from; default `https://*.transloadit.com,https://*.transloadit.net,https://*.r2.dev`)
 - `TRANSLOADIT_MCP_CONSOLE_URL` (optional, default `https://transloadit.com`; Console origin for
   widget deep links)
 - `TRANSLOADIT_ENDPOINT` (optional, default `https://api2.transloadit.com`)
@@ -316,7 +329,7 @@ Allowlist tools in `~/.gemini/settings.json`:
 - `npx -y @transloadit/mcp-server http --config path/to/config.json`
 
 The JSON config accepts the same keys as `createTransloaditMcpHttpHandler()`, including
-`allowedOrigins`, `resourceMetadataUrl` and `consoleUrl`.
+`allowedOrigins`, `resourceMetadataUrl`, `signatureAlgorithm`, `resultDomains` and `consoleUrl`.
 
 ## Tool surface
 
@@ -347,8 +360,10 @@ credentials, derived from the Workspace's own Assemblies or Templates.
 `transloadit_create_assembly` and `transloadit_wait_for_assembly` link the MCP Apps resource
 `ui://transloadit/assembly-result` (`_meta.ui.resourceUri`, also `_meta["openai/outputTemplate"]`).
 Hosts that support MCP Apps render each Step's results with image, video and audio previews,
-download links, an "Open in Console" link and a "Save as Template" shortcut. The widget only needs
-`https://*.transloadit.com` and `https://*.transloadit.net` in its CSP.
+download links, an "Open in Console" link and a "Save as Template" shortcut. It speaks the MCP Apps
+`2026-01-26` protocol (`ui/initialize` with `appInfo`) and also reads ChatGPT's `window.openai`.
+Its CSP allows `https://*.transloadit.com`, `https://*.transloadit.net` and `https://*.r2.dev`
+(result buckets); override the list with `TRANSLOADIT_MCP_RESULT_DOMAINS` or `resultDomains`.
 
 ## Input files
 
diff --git a/packages/mcp-server/package.json b/packages/mcp-server/package.json
index c664623f..6cb4b3f9 100644
--- a/packages/mcp-server/package.json
+++ b/packages/mcp-server/package.json
@@ -71,6 +71,7 @@
   "devDependencies": {
     "@types/express": "^5.0.6",
     "@types/node": "^25.8.0",
+    "happy-dom": "^20.9.0",
     "nock": "^14.0.15"
   },
   "mcpName": "io.github.transloadit/mcp-server"
diff --git a/packages/mcp-server/src/cli.ts b/packages/mcp-server/src/cli.ts
index 381d8ad9..4cc81854 100644
--- a/packages/mcp-server/src/cli.ts
+++ b/packages/mcp-server/src/cli.ts
@@ -1,5 +1,7 @@
 #!/usr/bin/env node
 
+import type { McpSignatureAlgorithm } from './server.ts'
+
 import { readFile } from 'node:fs/promises'
 import { createServer } from 'node:http'
 
@@ -7,6 +9,7 @@ import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'
 
 import { createTransloaditMcpHttpHandler, createTransloaditMcpServer } from './index.ts'
 import { buildRedactor, getLogger } from './logger.ts'
+import { signatureAlgorithmSchema } from './server.ts'
 
 const printHelp = (): void => {
   process.stdout.write(`transloadit-mcp
@@ -18,9 +21,11 @@ Usage:
 Environment:
   TRANSLOADIT_KEY
   TRANSLOADIT_SECRET
+  TRANSLOADIT_SIGNATURE_ALGORITHM (sha1, sha256 or sha384; must match the Auth Key)
   TRANSLOADIT_MCP_TOKEN
   TRANSLOADIT_MCP_RESOURCE_METADATA_URL
   TRANSLOADIT_MCP_UPSTREAM_SECRET
+  TRANSLOADIT_MCP_RESULT_DOMAINS (comma-separated origins for result previews)
   TRANSLOADIT_MCP_CONSOLE_URL
   TRANSLOADIT_ENDPOINT
   TRANSLOADIT_MCP_METRICS_PATH
@@ -84,6 +89,26 @@ const parseArgs = (args: string[]): { command: string; config: CliConfig } => {
   return { command, config }
 }
 
+/** Reads the key/secret signature algorithm; an unknown value would only fail later per call. */
+const parseSignatureAlgorithm = (value: unknown): McpSignatureAlgorithm | undefined => {
+  if (value === undefined || value === '') return undefined
+  const parsed = signatureAlgorithmSchema.safeParse(value)
+  if (!parsed.success) {
+    throw new Error('TRANSLOADIT_SIGNATURE_ALGORITHM must be one of sha1, sha256 or sha384.')
+  }
+  return parsed.data
+}
+
+/** Accepts a JSON array (config file) or a comma-separated string (environment). */
+const parseResultDomains = (value: unknown): string[] | undefined => {
+  const entries = Array.isArray(value) ? value : typeof value === 'string' ? value.split(',') : []
+  const domains = entries
+    .filter((entry): entry is string => typeof entry === 'string')
+    .map((entry) => entry.trim())
+    .filter(Boolean)
+  return domains.length > 0 ? domains : undefined
+}
+
 const isLocalHost = (host: string | undefined): boolean =>
   host === '127.0.0.1' || host === 'localhost' || host === '::1'
 
@@ -138,6 +163,12 @@ const main = async (): Promise<void> => {
     const consoleUrl = (fileConfig.consoleUrl ?? process.env.TRANSLOADIT_MCP_CONSOLE_URL) as
       | string
       | undefined
+    const signatureAlgorithm = parseSignatureAlgorithm(
+      fileConfig.signatureAlgorithm ?? process.env.TRANSLOADIT_SIGNATURE_ALGORITHM,
+    )
+    const resultDomains = parseResultDomains(
+      fileConfig.resultDomains ?? process.env.TRANSLOADIT_MCP_RESULT_DOMAINS,
+    )
     const clientSuffix = process.env.TRANSLOADIT_CLIENT_SUFFIX as string | undefined
 
     // Hosted mode delegates token checks to API2, so it may bind publicly without a static token.
@@ -155,6 +186,8 @@ const main = async (): Promise<void> => {
       mcpToken,
       resourceMetadataUrl,
       upstreamSecret,
+      signatureAlgorithm,
+      resultDomains,
       consoleUrl,
       allowedOrigins: fileConfig.allowedOrigins as string[] | undefined,
       allowedHosts: fileConfig.allowedHosts as string[] | undefined,
@@ -189,7 +222,10 @@ const main = async (): Promise<void> => {
   const server = createTransloaditMcpServer({
     authKey: process.env.TRANSLOADIT_KEY,
     authSecret: process.env.TRANSLOADIT_SECRET,
+    signatureAlgorithm: parseSignatureAlgorithm(process.env.TRANSLOADIT_SIGNATURE_ALGORITHM),
+    resultDomains: parseResultDomains(process.env.TRANSLOADIT_MCP_RESULT_DOMAINS),
     endpoint: process.env.TRANSLOADIT_ENDPOINT,
+    consoleUrl: process.env.TRANSLOADIT_MCP_CONSOLE_URL,
     clientSuffix: process.env.TRANSLOADIT_CLIENT_SUFFIX,
   })
   const transport = new StdioServerTransport()
diff --git a/packages/mcp-server/src/express.ts b/packages/mcp-server/src/express.ts
index c9eb5efd..0f4d9946 100644
--- a/packages/mcp-server/src/express.ts
+++ b/packages/mcp-server/src/express.ts
@@ -5,6 +5,7 @@ import express from 'express'
 
 import {
   applyCorsHeaders,
+  corsAllowHeaders,
   isBasicAuthorized,
   rejectMissingBearerToken,
   resolveAllowedOrigins,
@@ -37,10 +38,7 @@ export function createTransloaditMcpExpressRouter(options: TransloaditMcpExpress
   const sendServerCard = (res: express.Response, includeBody: boolean) => {
     res.setHeader('Access-Control-Allow-Origin', '*')
     res.setHeader('Access-Control-Allow-Methods', 'GET,HEAD,OPTIONS')
-    res.setHeader(
-      'Access-Control-Allow-Headers',
-      'Authorization,Content-Type,Mcp-Session-Id,Last-Event-ID',
-    )
+    res.setHeader('Access-Control-Allow-Headers', corsAllowHeaders)
     res.setHeader('Content-Type', 'application/json; charset=utf-8')
     res.setHeader('Cache-Control', 'public, max-age=3600')
     res.setHeader('X-Content-Type-Options', 'nosniff')
@@ -54,10 +52,7 @@ export function createTransloaditMcpExpressRouter(options: TransloaditMcpExpress
   router.options(serverCardPath, (_req, res) => {
     res.setHeader('Access-Control-Allow-Origin', '*')
     res.setHeader('Access-Control-Allow-Methods', 'GET,HEAD,OPTIONS')
-    res.setHeader(
-      'Access-Control-Allow-Headers',
-      'Authorization,Content-Type,Mcp-Session-Id,Last-Event-ID',
-    )
+    res.setHeader('Access-Control-Allow-Headers', corsAllowHeaders)
     res.status(204).end()
   })
 
@@ -70,8 +65,14 @@ export function createTransloaditMcpExpressRouter(options: TransloaditMcpExpress
   })
 
   router.all(routePath, async (req: express.Request, res: express.Response) => {
-    if (hostedOrigins && !applyCorsHeaders(req, res, hostedOrigins)) {
-      return
+    if (hostedOrigins) {
+      if (!applyCorsHeaders(req, res, hostedOrigins)) return
+      if (req.method === 'OPTIONS') {
+        res.status(204).end()
+        return
+      }
+      // Any unauthenticated method gets the OAuth challenge, so GET-probing clients find API2.
+      if (rejectMissingBearerToken(req, res, options.resourceMetadataUrl)) return
     }
 
     if (req.method !== 'POST') {
@@ -83,10 +84,6 @@ export function createTransloaditMcpExpressRouter(options: TransloaditMcpExpress
       return
     }
 
-    if (rejectMissingBearerToken(req, res, options.resourceMetadataUrl)) {
-      return
-    }
-
     const transport = new StreamableHTTPServerTransport({
       sessionIdGenerator: undefined,
       allowedOrigins: options.allowedOrigins,
diff --git a/packages/mcp-server/src/http-helpers.ts b/packages/mcp-server/src/http-helpers.ts
index 9ca4814c..f51ae675 100644
--- a/packages/mcp-server/src/http-helpers.ts
+++ b/packages/mcp-server/src/http-helpers.ts
@@ -151,12 +151,40 @@ export const applyCorsHeaders = (
   }
 
   res.setHeader('Access-Control-Allow-Methods', 'GET,POST,DELETE,OPTIONS')
-  res.setHeader(
-    'Access-Control-Allow-Headers',
-    'Authorization,Content-Type,Mcp-Session-Id,Last-Event-ID',
-  )
-  res.setHeader('Access-Control-Expose-Headers', 'Mcp-Session-Id,WWW-Authenticate')
+  res.setHeader('Access-Control-Allow-Headers', corsAllowHeaders)
+  res.setHeader('Access-Control-Expose-Headers', corsExposeHeaders)
+
+  return true
+}
+
+/**
+ * Request headers browser MCP clients send (Streamable HTTP adds `Mcp-Protocol-Version` after
+ * initialization); preflights that omit one block the client entirely.
+ */
+export const corsAllowHeaders =
+  'Authorization,Content-Type,Mcp-Protocol-Version,Mcp-Session-Id,Last-Event-ID'
 
+/** Response headers browser clients must read: the session id and the OAuth challenge. */
+export const corsExposeHeaders = 'Mcp-Session-Id,WWW-Authenticate'
+
+/** Human-readable status served on bare GETs and kept in the hosted 401 body. */
+export const serverInfo = {
+  name: 'Transloadit MCP Server',
+  status: 'ok',
+  docs: 'https://transloadit.com/docs/sdks/mcp-server/',
+}
+
+/**
+ * Bare GETs without the SSE Accept header are not valid MCP requests (Streamable HTTP requires
+ * `Accept: text/event-stream` for GET). Answer with a friendly status so directory health probes
+ * (Glama, uptime monitors) see a 200 instead of the SDK's opaque 406. Returns `true` when sent.
+ */
+export const sendServerInfoForBareGet = (req: IncomingMessage, res: ServerResponse): boolean => {
+  const accept = req.headers.accept ?? ''
+  if (req.method !== 'GET' || accept.includes('text/event-stream')) return false
+  res.statusCode = 200
+  res.setHeader('Content-Type', 'application/json')
+  res.end(JSON.stringify(serverInfo))
   return true
 }
 
@@ -199,8 +227,10 @@ export const rejectMissingMcpToken = (
 
 /**
  * Hosted policy: a bearer token only has to be present, because API2 verifies it on every
- * forwarded call. Without one, the 401 points OAuth clients at the protected-resource metadata.
- * Returns `true` when the 401 was already sent.
+ * forwarded call. Without one, any request (bare GET probes included, since clients such as Codex
+ * discover the authorization server from an unauthenticated GET) gets a 401 that points OAuth
+ * clients at the protected-resource metadata. The body keeps the friendly server status for
+ * humans. Returns `true` when the 401 was already sent.
  */
 export const rejectMissingBearerToken = (
   req: IncomingMessage,
@@ -213,6 +243,7 @@ export const rejectMissingBearerToken = (
   res.setHeader('Content-Type', 'application/json')
   res.end(
     JSON.stringify({
+      ...serverInfo,
       error: 'unauthorized',
       error_description:
         'This endpoint requires an OAuth bearer token. Discover the authorization server through the resource_metadata URL in the WWW-Authenticate header.',
diff --git a/packages/mcp-server/src/http-request-handler.ts b/packages/mcp-server/src/http-request-handler.ts
index eda66f51..ff2fb4aa 100644
--- a/packages/mcp-server/src/http-request-handler.ts
+++ b/packages/mcp-server/src/http-request-handler.ts
@@ -10,6 +10,7 @@ import {
   rejectMissingBearerToken,
   rejectMissingMcpToken,
   resolveAllowedOrigins,
+  sendServerInfoForBareGet,
 } from './http-helpers.ts'
 import { buildRedactor, getLogger } from './logger.ts'
 
@@ -59,25 +60,11 @@ export const createMcpRequestHandler = (
       return
     }
 
-    // Bare GETs without the SSE Accept header are not valid MCP requests (the
-    // Streamable HTTP spec requires Accept: text/event-stream for GET).  Return
-    // a friendly JSON status so directory health-probes (Glama, uptime monitors)
-    // see a 200 instead of the SDK's opaque 406.
-    const accept = req.headers.accept ?? ''
-    if (req.method === 'GET' && !accept.includes('text/event-stream')) {
-      res.statusCode = 200
-      res.setHeader('Content-Type', 'application/json')
-      res.end(
-        JSON.stringify({
-          name: 'Transloadit MCP Server',
-          status: 'ok',
-          docs: 'https://transloadit.com/docs/sdks/mcp-server/',
-        }),
-      )
+    if (rejectMissingBearerToken(req, res, options.resourceMetadataUrl)) {
       return
     }
 
-    if (rejectMissingBearerToken(req, res, options.resourceMetadataUrl)) {
+    if (sendServerInfoForBareGet(req, res)) {
       return
     }
 
diff --git a/packages/mcp-server/src/http.ts b/packages/mcp-server/src/http.ts
index 9ceb26cc..e2bfb301 100644
--- a/packages/mcp-server/src/http.ts
+++ b/packages/mcp-server/src/http.ts
@@ -14,6 +14,7 @@ import {
   rejectMissingBearerToken,
   rejectMissingMcpToken,
   resolveAllowedOrigins,
+  sendServerInfoForBareGet,
 } from './http-helpers.ts'
 import { getMetrics, getMetricsContentType } from './metrics.ts'
 import { createTransloaditMcpServer } from './server.ts'
@@ -152,24 +153,11 @@ export function createTransloaditMcpHttpHandler(
       return
     }
 
-    // Bare GETs without the SSE Accept header are not valid MCP requests (the
-    // Streamable HTTP spec requires Accept: text/event-stream for GET).  Return
-    // a friendly JSON status so directory health-probes see a 200 instead of 406.
-    const accept = req.headers.accept ?? ''
-    if (req.method === 'GET' && !accept.includes('text/event-stream')) {
-      res.statusCode = 200
-      res.setHeader('Content-Type', 'application/json')
-      res.end(
-        JSON.stringify({
-          name: 'Transloadit MCP Server',
-          status: 'ok',
-          docs: 'https://transloadit.com/docs/sdks/mcp-server/',
-        }),
-      )
+    if (rejectMissingBearerToken(req, res, options.resourceMetadataUrl)) {
       return
     }
 
-    if (rejectMissingBearerToken(req, res, options.resourceMetadataUrl)) {
+    if (sendServerInfoForBareGet(req, res)) {
       return
     }
 
diff --git a/packages/mcp-server/src/server.ts b/packages/mcp-server/src/server.ts
index 541bae4f..49af0975 100644
--- a/packages/mcp-server/src/server.ts
+++ b/packages/mcp-server/src/server.ts
@@ -47,6 +47,14 @@ export type TransloaditMcpServerOptions = {
    * sent as `Transloadit-Mcp-Upstream` next to a forwarded bearer token and never with key/secret.
    */
   upstreamSecret?: string
+  /**
+   * HMAC algorithm for key/secret signatures (`TRANSLOADIT_SIGNATURE_ALGORITHM`). Must match the
+   * Auth Key's `signature_algo`; Console keys that may sign Smart CDN URLs require `sha256`.
+   * Defaults to the SDK's `sha384`, which ordinary API keys use.
+   */
+  signatureAlgorithm?: McpSignatureAlgorithm
+  /** Origins the result widget may load previews from (`TRANSLOADIT_MCP_RESULT_DOMAINS`). */
+  resultDomains?: string[]
   /** Console origin used for widget deep links; defaults to the public website. */
   consoleUrl?: string
   endpoint?: string
@@ -58,6 +66,11 @@ export type TransloaditMcpServerOptions = {
 
 const defaultConsoleUrl = 'https://transloadit.com'
 
+/** Signature algorithms API2 accepts for Auth Key signatures. */
+export const signatureAlgorithmSchema = z.enum(['sha1', 'sha256', 'sha384'])
+
+export type McpSignatureAlgorithm = z.infer<typeof signatureAlgorithmSchema>
+
 /** Header that carries `upstreamSecret` on API2 calls made with a forwarded bearer token. */
 export const upstreamSecretHeader = 'Transloadit-Mcp-Upstream'
 
@@ -448,6 +461,7 @@ const createLiveClient = (
         authSecret: options.authSecret,
         endpoint: options.endpoint,
         clientName: getClientName(options),
+        signatureAlgorithm: options.signatureAlgorithm,
         followRedirects: false,
         extraHeaders: options.upstreamSecret
           ? { [upstreamSecretHeader]: options.upstreamSecret }
@@ -466,6 +480,7 @@ const createLiveClient = (
       authSecret: options.authSecret,
       endpoint: options.endpoint,
       clientName: getClientName(options),
+      signatureAlgorithm: options.signatureAlgorithm,
       followRedirects: false,
     }),
   }
@@ -532,9 +547,38 @@ const toAuthRejection = (
       hint: 'Reconnect your Transloadit account and grant the requested access.',
     })
   }
+  if (error instanceof ApiError && error.code === 'INVALID_SIGNATURE') {
+    return buildSignatureError(error)
+  }
   return undefined
 }
 
+/**
+ * Key/secret signatures fail when the configured algorithm differs from the Auth Key's
+ * `signature_algo`; API2 names the required one, so the hint can say exactly what to set.
+ */
+const buildSignatureError = (error: ApiError): CallToolResult => {
+  const required = signatureAlgorithmSchema.safeParse(
+    /requires (sha\d+)/.exec(error.rawMessage ?? '')?.[1],
+  )
+  // An error result, so tools with stricter output schemas (list_templates) can still return it.
+  return buildToolResponse(
+    {
+      status: 'error',
+      errors: [
+        {
+          code: 'mcp_invalid_signature',
+          message: 'Transloadit rejected the request signature for this Auth Key.',
+          hint: required.success
+            ? `This Auth Key signs with ${required.data}: set TRANSLOADIT_SIGNATURE_ALGORITHM=${required.data} (or the signatureAlgorithm option) and restart the MCP server.`
+            : 'Check that TRANSLOADIT_SECRET and TRANSLOADIT_SIGNATURE_ALGORITHM match the Auth Key.',
+        },
+      ],
+    },
+    { isError: true },
+  )
+}
+
 const trimTrailingSlash = (value: string): string => value.replace(/\/$/, '')
 
 /** Widget-only context: whether the caller is signed in and where the Console deep links go. */
@@ -1425,7 +1469,7 @@ export const createTransloaditMcpServer = (
     },
   )
 
-  registerAssemblyResultWidget(server)
+  registerAssemblyResultWidget(server, { resultDomains: options.resultDomains })
   installToolListHandler(server, listedTools)
 
   return server
diff --git a/packages/mcp-server/src/ui/assembly-result-widget.ts b/packages/mcp-server/src/ui/assembly-result-widget.ts
index 9d4df7b2..d4ac7250 100644
--- a/packages/mcp-server/src/ui/assembly-result-widget.ts
+++ b/packages/mcp-server/src/ui/assembly-result-widget.ts
@@ -8,8 +8,21 @@ export const assemblyResultWidgetUri = 'ui://transloadit/assembly-result'
 /** Mime type the MCP Apps spec requires for UI resources. */
 export const assemblyResultWidgetMimeType = 'text/html;profile=mcp-app'
 
-/** Origins that serve Assembly result files (temporary result buckets, demos, Console). */
-export const assemblyResultOrigins = ['https://*.transloadit.com', 'https://*.transloadit.net']
+/**
+ * Origins that serve Assembly result and upload files: Transloadit result buckets and Cloudflare
+ * R2 public buckets (API2's `CLOUDFLARE_R2_PUB_URL_HOST_*`). Override with `resultDomains`.
+ */
+export const defaultResultDomains = [
+  'https://*.transloadit.com',
+  'https://*.transloadit.net',
+  'https://*.r2.dev',
+]
+
+/** MCP Apps protocol revision the widget speaks (ext-apps `LATEST_PROTOCOL_VERSION`). */
+export const widgetProtocolVersion = '2026-01-26'
+
+/** `appInfo` the widget announces in `ui/initialize`. */
+export const widgetAppInfo = { name: 'transloadit-assembly-result', version: packageJson.version }
 
 /** Result `_meta` key that carries widget-only context (never read by the model). */
 export const widgetContextMetaKey = 'transloadit/widget'
@@ -24,21 +37,23 @@ const widgetDescription =
   'Shows each Assembly Step with image, video and audio previews, download links for every result file, and a Save as Template shortcut when the caller is signed in.'
 
 /** Resource `_meta` in both the MCP Apps form and the legacy ChatGPT aliases. */
-export const assemblyResultWidgetMeta = {
+export const buildAssemblyResultWidgetMeta = (
+  resultDomains: string[] = defaultResultDomains,
+): Record<string, unknown> => ({
   ui: {
     csp: {
-      connectDomains: assemblyResultOrigins,
-      resourceDomains: assemblyResultOrigins,
+      connectDomains: resultDomains,
+      resourceDomains: resultDomains,
     },
     prefersBorder: true,
   },
   'openai/widgetDescription': widgetDescription,
   'openai/widgetCSP': {
-    connect_domains: assemblyResultOrigins,
-    resource_domains: assemblyResultOrigins,
+    connect_domains: resultDomains,
+    resource_domains: resultDomains,
   },
   'openai/widgetPrefersBorder': true,
-}
+})
 
 /**
  * The widget document. Everything is inline (no external scripts) so it runs under the
@@ -96,9 +111,11 @@ export const assemblyResultWidgetHtml = `<!doctype html>
 <script>
 (() => {
   const app = document.getElementById('app')
-  const widgetVersion = ${JSON.stringify(packageJson.version)}
+  const appInfo = ${JSON.stringify(widgetAppInfo)}
+  const protocolVersion = ${JSON.stringify(widgetProtocolVersion)}
   const contextKey = ${JSON.stringify(widgetContextMetaKey)}
   const hostCapabilities = { openLinks: false }
+  let hasResult = false
 
   const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value)
   const text = (value) => (typeof value === 'string' ? value : '')
@@ -127,6 +144,11 @@ export const assemblyResultWidgetHtml = `<!doctype html>
     return node
   }
 
+  const showStatus = (message, className) => {
+    app.replaceChildren(el('p', { className: className || 'muted', role: 'status', text: message }))
+  }
+
+  // MCP Apps transport: JSON-RPC 2.0 over postMessage with the host (or its sandbox proxy).
   const post = (message) => {
     if (window.parent === window) return
     window.parent.postMessage(message, '*')
@@ -140,7 +162,10 @@ export const assemblyResultWidgetHtml = `<!doctype html>
       pending.set(id, { resolve, reject })
       post({ jsonrpc: '2.0', id, method, params })
     })
-  const notify = (method, params) => post({ jsonrpc: '2.0', method, params })
+  const notify = (method, params) =>
+    post(params === undefined ? { jsonrpc: '2.0', method } : { jsonrpc: '2.0', method, params })
+  const respond = (id, result) => post({ jsonrpc: '2.0', id, result })
+  const respondError = (id, code, message) => post({ jsonrpc: '2.0', id, error: { code, message } })
 
   const applyHostContext = (context) => {
     if (!isRecord(context)) return
@@ -149,14 +174,15 @@ export const assemblyResultWidgetHtml = `<!doctype html>
     }
   }
 
-  const openLink = async (url) => {
+  // Decided synchronously: preventDefault() after an await would be too late to stop navigation.
+  const openWithHost = (url) => {
     const openai = window.openai
     if (openai && typeof openai.openExternal === 'function') {
-      await openai.openExternal({ href: url })
+      Promise.resolve(openai.openExternal({ href: url })).catch(() => {})
       return true
     }
     if (hostCapabilities.openLinks) {
-      await request('ui/open-link', { url })
+      request('ui/open-link', { url }).catch(() => {})
       return true
     }
     return false
@@ -171,9 +197,7 @@ export const assemblyResultWidgetHtml = `<!doctype html>
       text: label,
     })
     anchor.addEventListener('click', (event) => {
-      openLink(url).then((handled) => {
-        if (handled) event.preventDefault()
-      })
+      if (openWithHost(url)) event.preventDefault()
     })
     return anchor
   }
@@ -207,22 +231,32 @@ export const assemblyResultWidgetHtml = `<!doctype html>
     const caption = el('figcaption', {}, [
       el('span', { className: 'name', text: name }),
       el('span', { className: 'muted', text: details.join(' · ') }),
-      url ? el('div', {}, [el('a', { href: url, target: '_blank', rel: 'noopener noreferrer', download: '', text: 'Download' })]) : null,
+      url ? el('div', {}, [el('a', { href: url, target: '_blank', rel: 'noopener noreferrer', download: '', text: 'Download ' + name })]) : null,
     ])
     return el('figure', {}, [preview(isRecord(file) ? file : {}), caption])
   }
 
+  const errorText = (result, payload) => {
+    const errors = Array.isArray(payload.errors) ? payload.errors : []
+    const fromPayload = errors.map((error) => (isRecord(error) ? text(error.message) : '')).filter(Boolean)
+    if (fromPayload.length > 0) return fromPayload.join(' ')
+    const content = Array.isArray(result.content) ? result.content : []
+    return content
+      .map((block) => (isRecord(block) && block.type === 'text' ? text(block.text) : ''))
+      .filter(Boolean)
+      .join(' ')
+  }
+
   const render = (result) => {
     if (!isRecord(result)) return
+    hasResult = true
     app.replaceChildren()
     const payload = isRecord(result.structuredContent) ? result.structuredContent : {}
     const meta = isRecord(result._meta) && isRecord(result._meta[contextKey]) ? result._meta[contextKey] : {}
     const assembly = isRecord(payload.assembly) ? payload.assembly : null
 
     if (!assembly) {
-      const errors = Array.isArray(payload.errors) ? payload.errors : []
-      const message = errors.map((error) => (isRecord(error) ? text(error.message) : '')).filter(Boolean).join(' ')
-      app.append(el('p', { className: 'error', text: message || 'No Assembly result was returned.' }))
+      app.append(el('p', { className: 'error', role: 'alert', text: errorText(result, payload) || 'No Assembly result was returned.' }))
       return
     }
 
@@ -242,7 +276,7 @@ export const assemblyResultWidgetHtml = `<!doctype html>
     app.append(header)
 
     if (failed && text(assembly.message)) {
-      app.append(el('p', { className: 'error', text: text(assembly.message) }))
+      app.append(el('p', { className: 'error', role: 'alert', text: text(assembly.message) }))
     }
 
     const results = isRecord(assembly.results) ? assembly.results : {}
@@ -269,27 +303,43 @@ export const assemblyResultWidgetHtml = `<!doctype html>
     }
   }
 
-  window.addEventListener('message', (event) => {
-    if (event.source !== window.parent) return
-    const message = event.data
-    if (!isRecord(message) || message.jsonrpc !== '2.0') return
-    if ('id' in message && !('method' in message)) {
-      const entry = pending.get(message.id)
-      if (!entry) return
-      pending.delete(message.id)
-      if (message.error) entry.reject(message.error)
-      else entry.resolve(message.result)
+  const handleHostRequest = (message) => {
+    if (message.method === 'ping' || message.method === 'ui/resource-teardown') {
+      respond(message.id, {})
       return
     }
-    if (message.method === 'ui/notifications/tool-result') {
+    respondError(message.id, -32601, 'Method not found: ' + text(message.method))
+  }
+
+  const handleHostNotification = (message) => {
+    if (message.method === 'ui/notifications/tool-input') {
+      if (!hasResult) showStatus('Running the Assembly…')
+    } else if (message.method === 'ui/notifications/tool-result') {
       render(message.params)
+    } else if (message.method === 'ui/notifications/tool-cancelled') {
+      if (!hasResult) showStatus('The tool call was cancelled.')
     } else if (message.method === 'ui/notifications/host-context-changed') {
       applyHostContext(message.params)
-    } else if (message.method === 'ui/resource-teardown' && 'id' in message) {
-      post({ jsonrpc: '2.0', id: message.id, result: {} })
     }
+  }
+
+  window.addEventListener('message', (event) => {
+    if (event.source !== window.parent) return
+    const message = event.data
+    if (!isRecord(message) || message.jsonrpc !== '2.0') return
+    if (typeof message.method === 'string') {
+      if ('id' in message) handleHostRequest(message)
+      else handleHostNotification(message)
+      return
+    }
+    const entry = pending.get(message.id)
+    if (!entry) return
+    pending.delete(message.id)
+    if (message.error) entry.reject(message.error)
+    else entry.resolve(message.result)
   })
 
+  // ChatGPT also exposes the result through window.openai; render from there when present.
   const renderFromOpenAi = () => {
     const openai = window.openai
     if (!openai) return
@@ -303,18 +353,20 @@ export const assemblyResultWidgetHtml = `<!doctype html>
 
   if (window.parent !== window) {
     request('ui/initialize', {
-      protocolVersion: '2026-01-26',
       appCapabilities: {},
-      clientInfo: { name: 'transloadit-assembly-result', version: widgetVersion },
+      appInfo,
+      protocolVersion,
     })
       .then((result) => {
         if (isRecord(result) && isRecord(result.hostCapabilities)) {
           hostCapabilities.openLinks = Boolean(result.hostCapabilities.openLinks)
         }
         if (isRecord(result)) applyHostContext(result.hostContext)
-        notify('ui/notifications/initialized', {})
+        notify('ui/notifications/initialized')
+      })
+      .catch(() => {
+        if (!hasResult) showStatus('This host could not start the Assembly result view.', 'error')
       })
-      .catch(() => {})
 
     if (typeof ResizeObserver === 'function') {
       new ResizeObserver(() => {
@@ -331,8 +383,21 @@ export const assemblyResultWidgetHtml = `<!doctype html>
 </html>
 `
 
+export type AssemblyResultWidgetOptions = {
+  /** Origins allowed for previews and downloads; defaults to `defaultResultDomains`. */
+  resultDomains?: string[]
+}
+
 /** Registers the widget so hosts can `resources/read` it through `_meta.ui.resourceUri`. */
-export const registerAssemblyResultWidget = (server: McpServer): void => {
+export const registerAssemblyResultWidget = (
+  server: McpServer,
+  options: AssemblyResultWidgetOptions = {},
+): void => {
+  const meta = buildAssemblyResultWidgetMeta(
+    options.resultDomains && options.resultDomains.length > 0
+      ? options.resultDomains
+      : defaultResultDomains,
+  )
   server.registerResource(
     'assembly-result',
     assemblyResultWidgetUri,
@@ -340,7 +405,7 @@ export const registerAssemblyResultWidget = (server: McpServer): void => {
       title: 'Assembly result',
       description: widgetDescription,
       mimeType: assemblyResultWidgetMimeType,
-      _meta: assemblyResultWidgetMeta,
+      _meta: meta,
     },
     () => ({
       contents: [
@@ -348,7 +413,7 @@ export const registerAssemblyResultWidget = (server: McpServer): void => {
           uri: assemblyResultWidgetUri,
           mimeType: assemblyResultWidgetMimeType,
           text: assemblyResultWidgetHtml,
-          _meta: assemblyResultWidgetMeta,
+          _meta: meta,
         },
       ],
     }),
diff --git a/packages/mcp-server/test/unit/cli-config.test.ts b/packages/mcp-server/test/unit/cli-config.test.ts
new file mode 100644
index 00000000..d46632dc
--- /dev/null
+++ b/packages/mcp-server/test/unit/cli-config.test.ts
@@ -0,0 +1,57 @@
+import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+
+import { Client } from '@modelcontextprotocol/sdk/client/index.js'
+import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js'
+import { afterEach, describe, expect, it } from 'vitest'
+
+import { assemblyResultWidgetUri } from '../../src/ui/assembly-result-widget.ts'
+
+const cliPath = fileURLToPath(new URL('../../src/cli.ts', import.meta.url))
+
+describe('transloadit-mcp CLI configuration', { timeout: 20000 }, () => {
+  let client: Client | undefined
+
+  afterEach(async () => {
+    await client?.close()
+    client = undefined
+  })
+
+  it('reads TRANSLOADIT_MCP_RESULT_DOMAINS into the widget CSP', async () => {
+    client = new Client({ name: 'cli-config', version: '1.0.0' })
+    await client.connect(
+      new StdioClientTransport({
+        command: process.execPath,
+        args: [cliPath, 'stdio'],
+        env: {
+          ...process.env,
+          TRANSLOADIT_MCP_RESULT_DOMAINS: 'https://cdn.example.com, https://*.example.net',
+        },
+      }),
+    )
+
+    const { contents } = await client.readResource({ uri: assemblyResultWidgetUri })
+    expect(contents[0]?._meta).toMatchObject({
+      ui: {
+        csp: {
+          connectDomains: ['https://cdn.example.com', 'https://*.example.net'],
+          resourceDomains: ['https://cdn.example.com', 'https://*.example.net'],
+        },
+      },
+    })
+  })
+
+  it('refuses to start with an unsupported TRANSLOADIT_SIGNATURE_ALGORITHM', () => {
+    const result = spawnSync(process.execPath, [cliPath, 'stdio'], {
+      env: { ...process.env, TRANSLOADIT_SIGNATURE_ALGORITHM: 'md5' },
+      encoding: 'utf8',
+      input: '',
+    })
+
+    expect(result.status).toBe(1)
+    // The CLI logger writes to stdout; the message may land on either stream.
+    expect(`${result.stdout}${result.stderr}`).toContain(
+      'TRANSLOADIT_SIGNATURE_ALGORITHM must be one of sha1, sha256 or sha384.',
+    )
+  })
+})
diff --git a/packages/mcp-server/test/unit/hosted-auth.test.ts b/packages/mcp-server/test/unit/hosted-auth.test.ts
index 53cd392e..1091218b 100644
--- a/packages/mcp-server/test/unit/hosted-auth.test.ts
+++ b/packages/mcp-server/test/unit/hosted-auth.test.ts
@@ -71,17 +71,56 @@ describe('hosted MCP endpoint auth', () => {
     )
     expect(response.headers.get('content-type')).toContain('application/json')
     await expect(response.json()).resolves.toMatchObject({
+      name: 'Transloadit MCP Server',
+      status: 'ok',
+      docs: expect.stringContaining('transloadit.com'),
       error: 'unauthorized',
       error_description: expect.stringContaining('OAuth'),
     })
   })
 
-  it('challenges SSE GETs without a bearer token but keeps the bare GET health probe', async () => {
+  it('challenges SSE GETs without a bearer token', async () => {
     running = await start({ resourceMetadataUrl })
 
     const stream = await fetch(running.url, { headers: { Accept: 'text/event-stream' } })
     expect(stream.status).toBe(401)
-    expect(stream.headers.get('www-authenticate')).toContain('resource_metadata=')
+    expect(stream.headers.get('www-authenticate')).toBe(
+      `Bearer resource_metadata="${resourceMetadataUrl}"`,
+    )
+  })
+
+  it('challenges a bare GET discovery probe and keeps the status fields in the body', async () => {
+    running = await start({ resourceMetadataUrl })
+
+    // Codex probes exactly like this before it looks for protected-resource metadata.
+    const probe = await fetch(running.url, {
+      headers: { Accept: '*/*', 'Mcp-Protocol-Version': '2024-11-05' },
+    })
+    expect(probe.status).toBe(401)
+    expect(probe.headers.get('www-authenticate')).toBe(
+      `Bearer resource_metadata="${resourceMetadataUrl}"`,
+    )
+    await expect(probe.json()).resolves.toMatchObject({
+      name: 'Transloadit MCP Server',
+      status: 'ok',
+      error: 'unauthorized',
+    })
+  })
+
+  it('serves the bare GET status to authenticated hosted callers', async () => {
+    running = await start({ resourceMetadataUrl })
+
+    const probe = await fetch(running.url, { headers: { Authorization: 'Bearer token' } })
+    expect(probe.status).toBe(200)
+    await expect(probe.json()).resolves.toEqual({
+      name: 'Transloadit MCP Server',
+      status: 'ok',
+      docs: 'https://transloadit.com/docs/sdks/mcp-server/',
+    })
+  })
+
+  it('keeps the bare GET health probe at 200 outside hosted mode', async () => {
+    running = await start()
 
     const probe = await fetch(running.url)
     expect(probe.status).toBe(200)
@@ -193,6 +232,30 @@ describe('hosted MCP endpoint origins', () => {
     expect(response.status).toBe(200)
     expect(response.headers.get('access-control-allow-origin')).toBe('*')
   })
+
+  it.each([
+    ['self-hosted', {}],
+    ['hosted', { resourceMetadataUrl }],
+  ])('answers %s preflights for every Streamable HTTP request header', async (_mode, options) => {
+    running = await start(options)
+
+    const preflight = await fetch(running.url, {
+      method: 'OPTIONS',
+      headers: {
+        Origin: 'http://localhost:8080',
+        'Access-Control-Request-Method': 'POST',
+        'Access-Control-Request-Headers':
+          'authorization,content-type,mcp-protocol-version,mcp-session-id,last-event-id',
+      },
+    })
+    expect(preflight.status).toBe(204)
+    expect(preflight.headers.get('access-control-allow-headers')).toBe(
+      'Authorization,Content-Type,Mcp-Protocol-Version,Mcp-Session-Id,Last-Event-ID',
+    )
+    expect(preflight.headers.get('access-control-expose-headers')).toBe(
+      'Mcp-Session-Id,WWW-Authenticate',
+    )
+  })
 })
 
 describe('matchesOriginPattern', () => {
diff --git a/packages/mcp-server/test/unit/signature-algorithm.test.ts b/packages/mcp-server/test/unit/signature-algorithm.test.ts
new file mode 100644
index 00000000..0a40354e
--- /dev/null
+++ b/packages/mcp-server/test/unit/signature-algorithm.test.ts
@@ -0,0 +1,81 @@
+import type { TransloaditMcpServerOptions } from '../../src/server.ts'
+
+import { Client } from '@modelcontextprotocol/sdk/client/index.js'
+import { InMemoryTransport } from '@modelcontextprotocol/sdk/inMemory.js'
+import nock from 'nock'
+import { afterEach, describe, expect, it } from 'vitest'
+
+import { createTransloaditMcpServer } from '../../src/server.ts'
+
+const endpoint = 'https://api2.transloadit.com'
+
+const connect = async (options: TransloaditMcpServerOptions): Promise<Client> => {
+  const server = createTransloaditMcpServer({ authKey: 'key', authSecret: 'secret', ...options })
+  const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair()
+  const client = new Client({ name: 'signature-algorithm', version: '1.0.0' })
+  await Promise.all([server.connect(serverTransport), client.connect(clientTransport)])
+  return client
+}
+
+/** Captures the `signature` query parameter API2 receives for `GET /templates`. */
+const captureTemplatesSignature = (): { signature: () => string | undefined } => {
+  let signature: string | undefined
+  nock(endpoint)
+    .get('/templates')
+    .query((query) => {
+      signature = typeof query.signature === 'string' ? query.signature : undefined
+      return true
+    })
+    .reply(200, { items: [], count: 0 })
+  return { signature: () => signature }
+}
+
+describe('key/secret signature algorithm', () => {
+  let client: Client | undefined
+
+  afterEach(async () => {
+    await client?.close()
+    client = undefined
+    nock.cleanAll()
+  })
+
+  it.each([
+    ['sha1'],
+    ['sha256'],
+    ['sha384'],
+  ] as const)('signs with %s when configured', async (signatureAlgorithm) => {
+    const captured = captureTemplatesSignature()
+    client = await connect({ signatureAlgorithm })
+
+    const result = await client.callTool({ name: 'transloadit_list_templates', arguments: {} })
+    expect(result.structuredContent).toMatchObject({ status: 'ok' })
+    expect(captured.signature()).toMatch(new RegExp(`^${signatureAlgorithm}:[0-9a-f]+$`))
+  })
+
+  it('keeps the SDK default of sha384 when nothing is configured', async () => {
+    const captured = captureTemplatesSignature()
+    client = await connect({})
+
+    await client.callTool({ name: 'transloadit_list_templates', arguments: {} })
+    expect(captured.signature()).toMatch(/^sha384:/)
+  })
+
+  it('tells the caller which algorithm the Auth Key requires', async () => {
+    nock(endpoint).get('/templates').query(true).reply(400, {
+      error: 'INVALID_SIGNATURE',
+      message: 'The given signature does not match ours. This Auth Key requires sha256.',
+    })
+    client = await connect({})
+
+    const result = await client.callTool({ name: 'transloadit_list_templates', arguments: {} })
+    expect(result.structuredContent).toMatchObject({
+      status: 'error',
+      errors: [
+        {
+          code: 'mcp_invalid_signature',
+          hint: expect.stringContaining('TRANSLOADIT_SIGNATURE_ALGORITHM=sha256'),
+        },
+      ],
+    })
+  })
+})
diff --git a/packages/mcp-server/test/unit/tool-surface.test.ts b/packages/mcp-server/test/unit/tool-surface.test.ts
index bfd90002..3dc5859d 100644
--- a/packages/mcp-server/test/unit/tool-surface.test.ts
+++ b/packages/mcp-server/test/unit/tool-surface.test.ts
@@ -2,12 +2,14 @@ import type { AddressInfo } from 'node:net'
 
 import { createServer } from 'node:http'
 
+import { Client } from '@modelcontextprotocol/sdk/client/index.js'
+import { InMemoryTransport } from '@modelcontextprotocol/sdk/inMemory.js'
 import { afterAll, beforeAll, describe, expect, it } from 'vitest'
 
 import { createTransloaditMcpHttpHandler } from '../../src/http.ts'
+import { createTransloaditMcpServer } from '../../src/server.ts'
 import { toolNames } from '../../src/tool-metadata.ts'
 import {
-  assemblyResultOrigins,
   assemblyResultWidgetMimeType,
   assemblyResultWidgetUri,
 } from '../../src/ui/assembly-result-widget.ts'
@@ -19,6 +21,9 @@ const isRecord = (value: unknown): value is JsonRecord =>
 
 const resourceMetadataUrl = 'https://api2.transloadit.com/.well-known/oauth-protected-resource/mcp'
 
+// Transloadit result buckets plus Cloudflare R2 public buckets, where API2 also stores results.
+const resultDomains = ['https://*.transloadit.com', 'https://*.transloadit.net', 'https://*.r2.dev']
+
 // The SDK client strips unknown Tool fields such as `securitySchemes`, so tools/list is read raw.
 const parseJsonRpcResult = async (response: Response): Promise<JsonRecord> => {
   const text = await response.text()
@@ -187,12 +192,12 @@ describe('tool surface', () => {
       mimeType: assemblyResultWidgetMimeType,
       _meta: {
         ui: {
-          csp: { connectDomains: assemblyResultOrigins, resourceDomains: assemblyResultOrigins },
+          csp: { connectDomains: resultDomains, resourceDomains: resultDomains },
         },
         'openai/widgetDescription': expect.any(String),
         'openai/widgetCSP': {
-          connect_domains: assemblyResultOrigins,
-          resource_domains: assemblyResultOrigins,
+          connect_domains: resultDomains,
+          resource_domains: resultDomains,
         },
       },
     })
@@ -211,3 +216,28 @@ describe('tool surface', () => {
     expect(html).not.toMatch(/<script[^>]+src=/)
   })
 })
+
+describe('result widget domains', () => {
+  it('uses configured result domains for the widget CSP', async () => {
+    const server = createTransloaditMcpServer({ resultDomains: ['https://cdn.example.com'] })
+    const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair()
+    const client = new Client({ name: 'result-domains', version: '1.0.0' })
+    await Promise.all([server.connect(serverTransport), client.connect(clientTransport)])
+
+    const { contents } = await client.readResource({ uri: assemblyResultWidgetUri })
+    expect(contents[0]?._meta).toMatchObject({
+      ui: {
+        csp: {
+          connectDomains: ['https://cdn.example.com'],
+          resourceDomains: ['https://cdn.example.com'],
+        },
+      },
+      'openai/widgetCSP': {
+        connect_domains: ['https://cdn.example.com'],
+        resource_domains: ['https://cdn.example.com'],
+      },
+    })
+    await client.close()
+    await server.close()
+  })
+})
diff --git a/packages/mcp-server/test/unit/widget-handshake.test.ts b/packages/mcp-server/test/unit/widget-handshake.test.ts
new file mode 100644
index 00000000..74c11f40
--- /dev/null
+++ b/packages/mcp-server/test/unit/widget-handshake.test.ts
@@ -0,0 +1,186 @@
+import { Window } from 'happy-dom'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+
+import packageJson from '../../package.json' with { type: 'json' }
+import {
+  assemblyResultWidgetHtml,
+  widgetContextMetaKey,
+} from '../../src/ui/assembly-result-widget.ts'
+
+type JsonRpcMessage = Record<string, unknown>
+
+const hostInfo = { name: 'TestHost', version: '9.9.9' }
+
+/**
+ * Loads the real widget document in a DOM whose `window.parent` is a fake MCP Apps host, so the
+ * test sees exactly the JSON-RPC messages the inline script posts.
+ */
+const mountWidget = (): {
+  window: Window
+  sent: JsonRpcMessage[]
+  fromHost: (message: JsonRpcMessage) => Promise<void>
+  appText: () => string
+} => {
+  const window = new Window({
+    url: 'https://sandbox.example/',
+    // The script under test is our own widget, so evaluating it in the VM is intended.
+    settings: {
+      enableJavaScriptEvaluation: true,
+      suppressInsecureJavaScriptEnvironmentWarning: true,
+    },
+  })
+  const sent: JsonRpcMessage[] = []
+  const host = { postMessage: (message: JsonRpcMessage) => sent.push(message) }
+  Object.defineProperty(window, 'parent', { value: host, configurable: true })
+  window.document.write(assemblyResultWidgetHtml)
+
+  const fromHost = async (message: JsonRpcMessage): Promise<void> => {
+    window.dispatchEvent(new window.MessageEvent('message', { data: message, source: host }))
+    await new Promise((resolve) => setTimeout(resolve, 0))
+  }
+  const appText = (): string => window.document.getElementById('app')?.textContent ?? ''
+  return { window, sent, fromHost, appText }
+}
+
+const withoutSizeChanges = (messages: JsonRpcMessage[]): JsonRpcMessage[] =>
+  messages.filter((message) => message.method !== 'ui/notifications/size-changed')
+
+describe('assembly result widget handshake (MCP Apps 2026-01-26)', () => {
+  let widget: ReturnType<typeof mountWidget>
+
+  beforeEach(() => {
+    widget = mountWidget()
+  })
+
+  afterEach(async () => {
+    await widget.window.happyDOM.close()
+  })
+
+  const initialize = async (): Promise<void> => {
+    await widget.fromHost({
+      jsonrpc: '2.0',
+      id: 1,
+      result: {
+        protocolVersion: '2026-01-26',
+        hostInfo,
+        hostCapabilities: { openLinks: {} },
+        hostContext: { theme: 'dark', displayMode: 'inline' },
+      },
+    })
+  }
+
+  it('opens with ui/initialize carrying appInfo, appCapabilities and protocolVersion', () => {
+    expect(withoutSizeChanges(widget.sent)).toEqual([
+      {
+        jsonrpc: '2.0',
+        id: 1,
+        method: 'ui/initialize',
+        params: {
+          appCapabilities: {},
+          appInfo: { name: 'transloadit-assembly-result', version: packageJson.version },
+          protocolVersion: '2026-01-26',
+        },
+      },
+    ])
+  })
+
+  it('confirms with a param-less ui/notifications/initialized and applies the host theme', async () => {
+    await initialize()
+
+    expect(withoutSizeChanges(widget.sent).at(-1)).toEqual({
+      jsonrpc: '2.0',
+      method: 'ui/notifications/initialized',
+    })
+    expect(widget.window.document.documentElement.dataset.theme).toBe('dark')
+  })
+
+  it('renders tool-input progress, then the tool-result previews and actions', async () => {
+    await initialize()
+    await widget.fromHost({
+      jsonrpc: '2.0',
+      method: 'ui/notifications/tool-input',
+      params: { arguments: { instructions: { steps: {} } } },
+    })
+    expect(widget.appText()).toBe('Running the Assembly…')
+
+    await widget.fromHost({
+      jsonrpc: '2.0',
+      method: 'ui/notifications/tool-result',
+      params: {
+        content: [{ type: 'text', text: '{}' }],
+        structuredContent: {
+          status: 'ok',
+          assembly: {
+            ok: 'ASSEMBLY_COMPLETED',
+            assembly_id: 'abc123',
+            results: {
+              resized: [
+                {
+                  name: 'pixel.png',
+                  mime: 'image/png',
+                  ssl_url: 'https://pub-123.r2.dev/pixel.png',
+                  width: 1,
+                  height: 1,
+                },
+              ],
+            },
+          },
+        },
+        _meta: {
+          [widgetContextMetaKey]: {
+            authenticated: true,
+            assembly_console_url: 'https://transloadit.com/c/acme/assemblies/abc123',
+            new_template_url: 'https://transloadit.com/c/acme/templates/new',
+          },
+        },
+      },
+    })
+
+    const document = widget.window.document
+    expect(widget.appText()).toContain('Assembly abc123')
+    expect(widget.appText()).toContain('ASSEMBLY_COMPLETED')
+    expect(document.querySelector('img')?.getAttribute('src')).toBe(
+      'https://pub-123.r2.dev/pixel.png',
+    )
+    expect(widget.appText()).toContain('Download pixel.png')
+    expect(widget.appText()).toContain('Save as Template')
+    expect(widget.appText()).toContain('Open in Console')
+  })
+
+  it('shows the error text of a failed tool call instead of waiting forever', async () => {
+    await initialize()
+    await widget.fromHost({
+      jsonrpc: '2.0',
+      method: 'ui/notifications/tool-result',
+      params: {
+        isError: true,
+        content: [{ type: 'text', text: 'API error (HTTP 400) INVALID_SIGNATURE' }],
+      },
+    })
+
+    expect(widget.appText()).toBe('API error (HTTP 400) INVALID_SIGNATURE')
+  })
+
+  it('answers ping and ui/resource-teardown, and rejects unknown host requests', async () => {
+    await initialize()
+    await widget.fromHost({ jsonrpc: '2.0', id: 7, method: 'ping' })
+    await widget.fromHost({ jsonrpc: '2.0', id: 8, method: 'ui/resource-teardown', params: {} })
+    await widget.fromHost({ jsonrpc: '2.0', id: 9, method: 'ui/unknown', params: {} })
+
+    expect(withoutSizeChanges(widget.sent).slice(-3)).toEqual([
+      { jsonrpc: '2.0', id: 7, result: {} },
+      { jsonrpc: '2.0', id: 8, result: {} },
+      { jsonrpc: '2.0', id: 9, error: { code: -32601, message: 'Method not found: ui/unknown' } },
+    ])
+  })
+
+  it('reports a rejected ui/initialize instead of staying on the waiting message', async () => {
+    await widget.fromHost({
+      jsonrpc: '2.0',
+      id: 1,
+      error: { code: -32602, message: 'Invalid params for ui/initialize' },
+    })
+
+    expect(widget.appText()).toBe('This host could not start the Assembly result view.')
+  })
+})
diff --git a/packages/node/test/unit/test-transloadit-client.test.ts b/packages/node/test/unit/test-transloadit-client.test.ts
index 0fb1a85c..6fabd4a8 100644
--- a/packages/node/test/unit/test-transloadit-client.test.ts
+++ b/packages/node/test/unit/test-transloadit-client.test.ts
@@ -1,5 +1,6 @@
 import type { Readable } from 'node:stream'
 
+import { createHmac } from 'node:crypto'
 import { PassThrough } from 'node:stream'
 
 import FormData from 'form-data'
@@ -410,6 +411,23 @@ describe('Transloadit', () => {
       )
     })
 
+    it.each([
+      ['sha1'],
+      ['sha256'],
+      ['sha384'],
+    ] as const)('should sign params with the configured %s algorithm', (signatureAlgorithm) => {
+      const client = new Transloadit({
+        authKey: 'foo_key',
+        authSecret: 'foo_secret',
+        signatureAlgorithm,
+      })
+
+      const { signature, params } = client.calcSignature({ steps: {} })
+
+      const expected = createHmac(signatureAlgorithm, 'foo_secret').update(params).digest('hex')
+      expect(signature).toBe(`${signatureAlgorithm}:${expected}`)
+    })
+
     it('should send extraHeaders next to the bearer token on every request', async () => {
       const client = new Transloadit({
         authToken: 'forwarded-token',
diff --git a/yarn.lock b/yarn.lock
index b986e125..a01f8317 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1612,6 +1612,7 @@ __metadata:
     "@types/express": "npm:^5.0.6"
     "@types/node": "npm:^25.8.0"
     express: "npm:^5.2.1"
+    happy-dom: "npm:^20.9.0"
     nock: "npm:^14.0.15"
     prom-client: "npm:^15.1.3"
     zod: "npm:^4.4.3"

From d1389e1c0b240fc9e152e04cef313be1672c2722 Mon Sep 17 00:00:00 2001
From: Kevin van Zonneveld <kevin@vanzonneveld.net>
Date: Thu, 1 Oct 2026 22:38:01 +0200
Subject: [PATCH 09/27] Retry widget previews that are not readable on the
 result bucket yet

The ext-apps basic host showed the resized preview blank: the file reached the R2 public bucket
a moment after the Assembly reported completion, and a failed <img> never retries. Previews now
retry after 1, 3 and 6 seconds, then say the preview is not available yet while keeping the
download link.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .../src/ui/assembly-result-widget.ts          | 26 ++++++++--
 .../test/unit/widget-handshake.test.ts        | 48 ++++++++++++++++++-
 2 files changed, 70 insertions(+), 4 deletions(-)

diff --git a/packages/mcp-server/src/ui/assembly-result-widget.ts b/packages/mcp-server/src/ui/assembly-result-widget.ts
index d4ac7250..bb4dd026 100644
--- a/packages/mcp-server/src/ui/assembly-result-widget.ts
+++ b/packages/mcp-server/src/ui/assembly-result-widget.ts
@@ -202,17 +202,37 @@ export const assemblyResultWidgetHtml = `<!doctype html>
     return anchor
   }
 
+  // Result files can land on the public bucket a moment after the Assembly reports completion,
+  // and a failed <img>/<video> never retries by itself.
+  const previewRetryDelays = [1000, 3000, 6000]
+  const retryPreview = (media, url) => {
+    let attempt = 0
+    media.addEventListener('error', () => {
+      if (attempt >= previewRetryDelays.length) {
+        media.replaceWith(el('span', { className: 'muted', role: 'status', text: 'Preview not available yet' }))
+        return
+      }
+      setTimeout(() => {
+        media.removeAttribute('src')
+        media.setAttribute('src', url)
+        if (typeof media.load === 'function') media.load()
+      }, previewRetryDelays[attempt])
+      attempt += 1
+    })
+    return media
+  }
+
   const preview = (file) => {
     const url = safeUrl(file.ssl_url) || safeUrl(file.url)
     const mime = text(file.mime)
     const name = text(file.name) || text(file.basename) || 'file'
     const box = el('div', { className: 'preview' })
     if (url && mime.startsWith('image/')) {
-      box.append(el('img', { src: url, alt: name, loading: 'lazy' }))
+      box.append(retryPreview(el('img', { src: url, alt: name, loading: 'lazy' }), url))
     } else if (url && mime.startsWith('video/')) {
-      box.append(el('video', { src: url, controls: '', preload: 'metadata', playsinline: '' }))
+      box.append(retryPreview(el('video', { src: url, controls: '', preload: 'metadata', playsinline: '' }), url))
     } else if (url && mime.startsWith('audio/')) {
-      box.append(el('audio', { src: url, controls: '', preload: 'metadata' }))
+      box.append(retryPreview(el('audio', { src: url, controls: '', preload: 'metadata' }), url))
     } else {
       box.append(el('span', { className: 'file', 'aria-hidden': 'true', text: '📄' }))
     }
diff --git a/packages/mcp-server/test/unit/widget-handshake.test.ts b/packages/mcp-server/test/unit/widget-handshake.test.ts
index 74c11f40..29382e2e 100644
--- a/packages/mcp-server/test/unit/widget-handshake.test.ts
+++ b/packages/mcp-server/test/unit/widget-handshake.test.ts
@@ -15,7 +15,9 @@ const hostInfo = { name: 'TestHost', version: '9.9.9' }
  * Loads the real widget document in a DOM whose `window.parent` is a fake MCP Apps host, so the
  * test sees exactly the JSON-RPC messages the inline script posts.
  */
-const mountWidget = (): {
+const mountWidget = (
+  options: { maxTimeout?: number } = {},
+): {
   window: Window
   sent: JsonRpcMessage[]
   fromHost: (message: JsonRpcMessage) => Promise<void>
@@ -27,6 +29,7 @@ const mountWidget = (): {
     settings: {
       enableJavaScriptEvaluation: true,
       suppressInsecureJavaScriptEnvironmentWarning: true,
+      ...(options.maxTimeout === undefined ? {} : { timer: { maxTimeout: options.maxTimeout } }),
     },
   })
   const sent: JsonRpcMessage[] = []
@@ -184,3 +187,46 @@ describe('assembly result widget handshake (MCP Apps 2026-01-26)', () => {
     expect(widget.appText()).toBe('This host could not start the Assembly result view.')
   })
 })
+
+describe('assembly result widget previews', () => {
+  it('retries a preview that is not readable yet, then says so', async () => {
+    // Collapse the widget's 1 s / 3 s / 6 s retry delays.
+    const widget = mountWidget({ maxTimeout: 0 })
+    const resultUrl = 'https://pub-123.r2.dev/resized.jpg'
+    await widget.fromHost({
+      jsonrpc: '2.0',
+      id: 1,
+      result: { protocolVersion: '2026-01-26', hostInfo, hostCapabilities: {}, hostContext: {} },
+    })
+    await widget.fromHost({
+      jsonrpc: '2.0',
+      method: 'ui/notifications/tool-result',
+      params: {
+        structuredContent: {
+          status: 'ok',
+          assembly: {
+            ok: 'ASSEMBLY_COMPLETED',
+            assembly_id: 'abc123',
+            results: { resized: [{ name: 'resized.jpg', mime: 'image/jpeg', ssl_url: resultUrl }] },
+          },
+        },
+      },
+    })
+
+    const settle = (): Promise<void> => new Promise((resolve) => setTimeout(resolve, 5))
+    const image = widget.window.document.querySelector('img')
+    image?.dispatchEvent(new widget.window.Event('error'))
+    await settle()
+    expect(image?.getAttribute('src')).toBe(resultUrl)
+    image?.dispatchEvent(new widget.window.Event('error'))
+    await settle()
+    image?.dispatchEvent(new widget.window.Event('error'))
+    await settle()
+    image?.dispatchEvent(new widget.window.Event('error'))
+    await settle()
+
+    expect(widget.appText()).toContain('Preview not available yet')
+    expect(widget.appText()).toContain('Download resized.jpg')
+    await widget.window.happyDOM.close()
+  })
+})

From 188d585c9afdaea9f67dd8d3a880e7e2f251979b Mon Sep 17 00:00:00 2001
From: Kevin van Zonneveld <kevin@vanzonneveld.net>
Date: Thu, 1 Oct 2026 22:38:32 +0200
Subject: [PATCH 10/27] Record the QA follow-up fixes and their devdock
 verification

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .../prompts/2026-09-30-mcp-oauth-discovery.md | 22 +++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/docs/prompts/2026-09-30-mcp-oauth-discovery.md b/docs/prompts/2026-09-30-mcp-oauth-discovery.md
index f9b95bc1..72219d0b 100644
--- a/docs/prompts/2026-09-30-mcp-oauth-discovery.md
+++ b/docs/prompts/2026-09-30-mcp-oauth-discovery.md
@@ -68,6 +68,28 @@ OpenAI file params on `transloadit_create_assembly` and an MCP Apps result widge
       widget resource.
 - [ ] E2e against devdock once the api2 branch serves the metadata.
 
+## QA follow-up (2026-10-01, session 2fe9f3b7)
+
+- [x] Hosted mode answers every unauthenticated request to `/mcp`, including a bare `GET` (Codex
+      probes with `Accept: */*`), with the `401` challenge; the body keeps `name`/`status`/`docs`.
+      Self-hosted and unauthenticated deployments keep the bare-`GET` `200`.
+- [x] Widget handshake matches MCP Apps `2026-01-26` as implemented by ext-apps `82221c0c`
+      (`ui/initialize` with `appInfo`, param-less `ui/notifications/initialized`, `ping` and
+      `ui/resource-teardown` replies, tool-input/cancelled states, failed results shown). The
+      spec prose still shows `clientInfo`; the reference App and AppBridge use `appInfo`.
+- [x] CORS allows `Mcp-Protocol-Version` and exposes `Mcp-Session-Id` and `WWW-Authenticate`.
+- [x] Widget CSP adds `https://*.r2.dev`; `TRANSLOADIT_MCP_RESULT_DOMAINS` / `resultDomains`
+      override it. Previews retry briefly because R2 can lag the Assembly's completion.
+- [x] `TRANSLOADIT_SIGNATURE_ALGORITHM` / `signatureAlgorithm` (`sha1`, `sha256`, `sha384`) reach
+      the SDK; Console keys with Smart CDN signing require `sha256`. `INVALID_SIGNATURE` returns
+      `mcp_invalid_signature` with a hint naming the required algorithm.
+- Verified: devdock bare `GET /mcp` → `401` with the challenge; a self-hosted server with the QA
+  Console key lists templates once `TRANSLOADIT_SIGNATURE_ALGORITHM=sha256` is set; the widget
+  renders both previews in the ext-apps basic host
+  (`/tmp/mcp-oauth/runs/node-sdk-fixes/basic-host-widget.png`). The basic host build bakes its
+  sandbox port, so Content's `mcp-oauth-apps-host.ts --sandbox-port` has no effect with
+  `--skip-build`; use the default ports.
+
 ## Getting a local build into devdock
 
 API2's container bind-mounts the api2 worktree at `/srv/current` and runs the `mcp-server` service

From 00ad4c593899b4a2341700dfe84442a2e77a0f28 Mon Sep 17 00:00:00 2001
From: Kevin van Zonneveld <kevin@vanzonneveld.net>
Date: Fri, 2 Oct 2026 14:26:39 +0200
Subject: [PATCH 11/27] Address council review: honest tool hints, mode-aware
 schemes and scopes

Council review of PR #529 (run 1), each finding covered by a test that failed first:

- `transloadit_create_assembly` is `destructiveHint: true`: export Robots can overwrite files.
- `securitySchemes` follow the deployment. Hosted mode challenges every unauthenticated request,
  so every tool declares `oauth2` there (documentation tools with no scopes); a server holding an
  Auth Key declares `noauth`; otherwise only account tools declare `oauth2`. The server card uses
  the same rules.
- Scopes cover every code path: create needs `templates:read` for `template_id`, the profile tool
  `assemblies:read` and `templates:read`.
- `mcpToken` together with `resourceMetadataUrl` is refused at startup, since the static-token
  check would reject every OAuth token before the hosted challenge.
- `tools/list` wraps the SDK's own handler and mirrors `_meta.securitySchemes` to the top level,
  so tools registered later stay discoverable.
- Save as Template links pass `fromAssembly=<assembly_id>` (Console support is a Content
  follow-up) and keep `duplicateFrom` for Template-based Assemblies.
- Key/secret rejections report `mcp_credentials_rejected` with key-specific advice and no OAuth
  challenge; forwarded tokens keep the account-linking challenge.
- `extraHeaders` is new public API, so `@transloadit/node` and `transloadit` are minor bumps.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .changeset/mcp-oauth-discovery.md             |   5 +-
 .changeset/mcp-upstream-header.md             |   4 +-
 packages/mcp-server/README.md                 |  40 ++++---
 packages/mcp-server/src/express.ts            |   2 +
 packages/mcp-server/src/http-helpers.ts       |  15 +++
 .../mcp-server/src/http-request-handler.ts    |   2 +
 packages/mcp-server/src/http.ts               |   2 +
 packages/mcp-server/src/server-card.ts        |  27 +++--
 packages/mcp-server/src/server.ts             | 111 +++++++++++-------
 packages/mcp-server/src/tool-list.ts          |  97 +++++++--------
 packages/mcp-server/src/tool-metadata.ts      |  77 +++++++++---
 .../mcp-server/test/e2e/server-card.test.ts   |   2 +-
 .../mcp-server/test/unit/auth-errors.test.ts  |  23 ++++
 .../mcp-server/test/unit/file-inputs.test.ts  |  17 ++-
 .../mcp-server/test/unit/hosted-auth.test.ts  |  29 ++++-
 .../mcp-server/test/unit/tool-surface.test.ts | 106 +++++++++++++++--
 16 files changed, 403 insertions(+), 156 deletions(-)

diff --git a/.changeset/mcp-oauth-discovery.md b/.changeset/mcp-oauth-discovery.md
index bbef200a..6b6aa83e 100644
--- a/.changeset/mcp-oauth-discovery.md
+++ b/.changeset/mcp-oauth-discovery.md
@@ -10,8 +10,9 @@ connector requirements.
   Transloadit and loopback (overridable with `allowedOrigins`), and the server card advertises
   OAuth. Self-hosted `TRANSLOADIT_MCP_TOKEN` behavior is unchanged.
 - Every tool carries a title, `readOnlyHint`/`destructiveHint`/`openWorldHint`/`idempotentHint`
-  annotations and per-tool `securitySchemes` (`noauth` for Robots and linting, `oauth2` with scopes
-  elsewhere), mirrored in `_meta.securitySchemes`. Auth failures return `isError` results with
+  annotations (only Assembly creation is destructive) and per-tool `securitySchemes`, also in
+  `_meta.securitySchemes`, that match the deployment: `oauth2` with each tool's full scopes when
+  hosted, `noauth` where the server holds an Auth Key or a tool needs no account. Auth failures return `isError` results with
   `_meta["mcp/www_authenticate"]` so hosts show their account-linking UI.
 - New `transloadit_get_profile` tool (`_meta["openai/profile"]`) returns the Workspace behind the
   credentials for multi-account hosts.
diff --git a/.changeset/mcp-upstream-header.md b/.changeset/mcp-upstream-header.md
index 1e604a28..e3708621 100644
--- a/.changeset/mcp-upstream-header.md
+++ b/.changeset/mcp-upstream-header.md
@@ -1,6 +1,6 @@
 ---
-"@transloadit/node": patch
-"transloadit": patch
+"@transloadit/node": minor
+"transloadit": minor
 ---
 
 Add an `extraHeaders` client option so trusted relays such as the hosted MCP service can send a
diff --git a/packages/mcp-server/README.md b/packages/mcp-server/README.md
index 541d4785..08b768ca 100644
--- a/packages/mcp-server/README.md
+++ b/packages/mcp-server/README.md
@@ -285,8 +285,11 @@ Allowlist tools in `~/.gemini/settings.json`:
 - Bearer tokens (OAuth or minted with `--aud mcp`) are forwarded to API2, which verifies them on
   every call. A rejected or expired token yields a tool result with `isError` and
   `_meta["mcp/www_authenticate"]`, so ChatGPT and Claude prompt you to reconnect.
-- Each tool declares `securitySchemes`: `noauth` for Robot docs and linting, `oauth2` with the
-  scopes it needs (`assemblies:write`, `assemblies:read`, `templates:read`) otherwise.
+- Each tool declares `securitySchemes` (top level and in `_meta`). Because the hosted endpoint
+  challenges every unauthenticated request, all tools declare `oauth2` there; the Robot docs and
+  linting tools ask for no scopes.
+- A rejected or expired key/secret on a self-hosted server is reported as
+  `mcp_credentials_rejected` without an OAuth challenge, since only an operator can fix it.
 - Browser requests must come from ChatGPT, Claude, Transloadit or loopback origins; requests without
   an `Origin` header (CLIs, servers) are not restricted. Set `allowedOrigins` to change the list.
 - `TRANSLOADIT_MCP_UPSTREAM_SECRET` is set by Transloadit's own deployment so API2 can tell that a
@@ -333,19 +336,26 @@ The JSON config accepts the same keys as `createTransloaditMcpHttpHandler()`, in
 
 ## Tool surface
 
-| Tool                                    | Auth                        | Notes                                    |
-| --------------------------------------- | --------------------------- | ---------------------------------------- |
-| `transloadit_lint_assembly_instructions` | none                        | read-only                                |
-| `transloadit_list_robots`               | none                        | read-only                                |
-| `transloadit_get_robot_help`            | none                        | read-only                                |
-| `transloadit_create_assembly`           | `oauth2` `assemblies:write` | open-world (URL imports), result widget  |
-| `transloadit_get_assembly_status`       | `oauth2` `assemblies:read`  | read-only                                |
-| `transloadit_wait_for_assembly`         | `oauth2` `assemblies:read`  | read-only, result widget                 |
-| `transloadit_list_templates`            | `oauth2` `templates:read`   | read-only                                |
-| `transloadit_get_profile`               | `oauth2`                    | read-only, `_meta["openai/profile"]`     |
-
-Every tool carries `title`, `readOnlyHint`, `destructiveHint` (always `false`), `idempotentHint`
-and `openWorldHint` annotations.
+| Tool                                     | Account | OAuth scopes                         | Notes                                           |
+| ---------------------------------------- | ------- | ------------------------------------ | ----------------------------------------------- |
+| `transloadit_lint_assembly_instructions` | no      | none                                 | read-only                                       |
+| `transloadit_list_robots`                | no      | none                                 | read-only                                       |
+| `transloadit_get_robot_help`             | no      | none                                 | read-only                                       |
+| `transloadit_create_assembly`            | yes     | `assemblies:write`, `templates:read` | destructive, open-world (URL imports), widget   |
+| `transloadit_get_assembly_status`        | yes     | `assemblies:read`                    | read-only                                       |
+| `transloadit_wait_for_assembly`          | yes     | `assemblies:read`                    | read-only, result widget                        |
+| `transloadit_list_templates`             | yes     | `templates:read`                     | read-only                                       |
+| `transloadit_get_profile`                | yes     | `assemblies:read`, `templates:read`  | read-only, `_meta["openai/profile"]`            |
+
+Every tool carries `title`, `readOnlyHint`, `destructiveHint`, `idempotentHint` and
+`openWorldHint` annotations. `transloadit_create_assembly` is the only destructive one: export
+Robots such as `/s3/store` can overwrite files at their destination, so hosts should confirm it.
+
+`securitySchemes` depend on how the server runs: hosted (`TRANSLOADIT_MCP_RESOURCE_METADATA_URL`)
+declares `oauth2` with the scopes above for every tool; a server holding `TRANSLOADIT_KEY` and
+`TRANSLOADIT_SECRET` declares `noauth` everywhere; otherwise the account tools declare `oauth2` and
+the others `noauth`. `TRANSLOADIT_MCP_TOKEN` and `TRANSLOADIT_MCP_RESOURCE_METADATA_URL` cannot be
+combined.
 
 `transloadit_list_templates` supports:
 
diff --git a/packages/mcp-server/src/express.ts b/packages/mcp-server/src/express.ts
index 0f4d9946..0f352cd7 100644
--- a/packages/mcp-server/src/express.ts
+++ b/packages/mcp-server/src/express.ts
@@ -5,6 +5,7 @@ import express from 'express'
 
 import {
   applyCorsHeaders,
+  assertSingleAuthMode,
   corsAllowHeaders,
   isBasicAuthorized,
   rejectMissingBearerToken,
@@ -19,6 +20,7 @@ export type TransloaditMcpExpressOptions = TransloaditMcpHttpOptions & {
 }
 
 export function createTransloaditMcpExpressRouter(options: TransloaditMcpExpressOptions = {}) {
+  assertSingleAuthMode(options)
   const router = express.Router()
   const routePath = options.path ?? '/mcp'
   const metricsPath =
diff --git a/packages/mcp-server/src/http-helpers.ts b/packages/mcp-server/src/http-helpers.ts
index f51ae675..80a89d92 100644
--- a/packages/mcp-server/src/http-helpers.ts
+++ b/packages/mcp-server/src/http-helpers.ts
@@ -209,6 +209,21 @@ export const buildBearerChallenge = (options: {
   return parts.length > 0 ? `Bearer ${parts.join(', ')}` : 'Bearer'
 }
 
+/**
+ * The static-token check runs first and would reject every OAuth token with a bare `Bearer`
+ * challenge, so hosted OAuth could never start. Refuse the combination up front.
+ */
+export const assertSingleAuthMode = (options: {
+  mcpToken?: string
+  resourceMetadataUrl?: string
+}): void => {
+  if (options.mcpToken && options.resourceMetadataUrl) {
+    throw new Error(
+      'Configure either TRANSLOADIT_MCP_TOKEN (self-hosted) or TRANSLOADIT_MCP_RESOURCE_METADATA_URL (hosted OAuth), not both.',
+    )
+  }
+}
+
 /**
  * Self-hosted policy: the request must carry the static `TRANSLOADIT_MCP_TOKEN`. Returns `true`
  * when the 401 was already sent.
diff --git a/packages/mcp-server/src/http-request-handler.ts b/packages/mcp-server/src/http-request-handler.ts
index ff2fb4aa..b1ead7a5 100644
--- a/packages/mcp-server/src/http-request-handler.ts
+++ b/packages/mcp-server/src/http-request-handler.ts
@@ -5,6 +5,7 @@ import type { SevLogger } from '@transloadit/sev-logger'
 
 import {
   applyCorsHeaders,
+  assertSingleAuthMode,
   normalizePath,
   parsePathname,
   rejectMissingBearerToken,
@@ -32,6 +33,7 @@ export const createMcpRequestHandler = (
   transport: StreamableHTTPServerTransport,
   options: RequestHandlerOptions,
 ) => {
+  assertSingleAuthMode(options)
   const expectedPath = normalizePath(options.path.expectedPath)
   const allowRoot = options.path.allowRoot ?? false
   const logger = options.logger ?? getLogger().nest('http')
diff --git a/packages/mcp-server/src/http.ts b/packages/mcp-server/src/http.ts
index e2bfb301..6f5ebc16 100644
--- a/packages/mcp-server/src/http.ts
+++ b/packages/mcp-server/src/http.ts
@@ -8,6 +8,7 @@ import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/
 
 import {
   applyCorsHeaders,
+  assertSingleAuthMode,
   isBasicAuthorized,
   normalizePath,
   parsePathname,
@@ -70,6 +71,7 @@ export function createTransloaditMcpHttpHandler(
     transport: StreamableHTTPServerTransport
     server: Awaited<ReturnType<typeof createTransloaditMcpServer>>
   }>()
+  assertSingleAuthMode(options)
   const expectedPath = options.path ?? defaultPath
   const metricsPath =
     options.metricsPath === false ? undefined : normalizePath(options.metricsPath ?? '/metrics')
diff --git a/packages/mcp-server/src/server-card.ts b/packages/mcp-server/src/server-card.ts
index fc3ce221..23345274 100644
--- a/packages/mcp-server/src/server-card.ts
+++ b/packages/mcp-server/src/server-card.ts
@@ -1,11 +1,11 @@
 import type { ToolAnnotations } from '@modelcontextprotocol/sdk/types.js'
 
-import type { ToolName, ToolSecurityScheme } from './tool-metadata.ts'
+import type { ToolAuthMode, ToolName, ToolSecurityScheme } from './tool-metadata.ts'
 
 import { LATEST_PROTOCOL_VERSION } from '@modelcontextprotocol/sdk/types.js'
 
 import packageJson from '../package.json' with { type: 'json' }
-import { toolMetadata } from './tool-metadata.ts'
+import { resolveSecuritySchemes, resolveToolAuthMode, toolMetadata } from './tool-metadata.ts'
 
 export const serverCardPath = '/.well-known/mcp/server-card.json'
 
@@ -171,22 +171,25 @@ const toolInputs: ServerCardToolInput[] = [
   },
 ]
 
-const tools: ServerCardToolDefinition[] = toolInputs.map((tool) => {
-  const metadata = toolMetadata[tool.name]
-  return {
-    ...tool,
-    title: metadata.title,
-    description: metadata.description,
-    annotations: metadata.annotations,
-    securitySchemes: metadata.securitySchemes,
-  }
-})
+/** Tool definitions with the security schemes this deployment mode can honor. */
+const buildTools = (mode: ToolAuthMode): ServerCardToolDefinition[] =>
+  toolInputs.map((tool) => {
+    const metadata = toolMetadata[tool.name]
+    return {
+      ...tool,
+      title: metadata.title,
+      description: metadata.description,
+      annotations: metadata.annotations,
+      securitySchemes: resolveSecuritySchemes(metadata, mode),
+    }
+  })
 
 export const buildServerCard = (
   endpoint: string,
   options: { authKey?: string; authSecret?: string; resourceMetadataUrl?: string } = {},
 ): ServerCard => {
   const hasCredentials = Boolean(options.authKey && options.authSecret)
+  const tools = buildTools(resolveToolAuthMode(options))
   // Hosted deployments hand out tokens through OAuth; self-hosted ones accept a static bearer.
   const schemes = options.resourceMetadataUrl ? ['oauth2', 'bearer'] : ['bearer']
 
diff --git a/packages/mcp-server/src/server.ts b/packages/mcp-server/src/server.ts
index 49af0975..98f4a4c4 100644
--- a/packages/mcp-server/src/server.ts
+++ b/packages/mcp-server/src/server.ts
@@ -9,7 +9,6 @@ import type {
 } from '@transloadit/node'
 import type { ZodObject } from 'zod'
 
-import type { ListedTool } from './tool-list.ts'
 import type { ToolName } from './tool-metadata.ts'
 import type { WidgetContext } from './ui/assembly-result-widget.ts'
 
@@ -28,8 +27,13 @@ import { z } from 'zod'
 
 import packageJson from '../package.json' with { type: 'json' }
 import { buildBearerChallenge, extractBearerToken } from './http-helpers.ts'
-import { installToolListHandler } from './tool-list.ts'
-import { buildToolMeta, toolMetadata } from './tool-metadata.ts'
+import { mirrorSecuritySchemes } from './tool-list.ts'
+import {
+  buildToolMeta,
+  resolveSecuritySchemes,
+  resolveToolAuthMode,
+  toolMetadata,
+} from './tool-metadata.ts'
 import { registerAssemblyResultWidget, widgetContextMetaKey } from './ui/assembly-result-widget.ts'
 
 export type TransloaditMcpServerOptions = {
@@ -444,7 +448,12 @@ const getHeaderValue = (headers: HeaderMap | undefined, name: string): string |
 const getBearerToken = (headers: HeaderMap | undefined): string | undefined =>
   extractBearerToken(getHeaderValue(headers, 'authorization'))
 
-type LiveClientResult = { client: Transloadit } | { error: ReturnType<typeof buildToolError> }
+/** Which credentials a live client signs with; recovery advice differs per kind. */
+type CredentialKind = 'bearer' | 'auth-key'
+
+type LiveClientResult =
+  | { client: Transloadit; credentials: CredentialKind }
+  | { error: ReturnType<typeof buildToolError> }
 
 const createLiveClient = (
   options: TransloaditMcpServerOptions,
@@ -455,6 +464,7 @@ const createLiveClient = (
 
   if (authToken) {
     return {
+      credentials: 'bearer',
       client: new Transloadit({
         authToken,
         authKey: options.authKey,
@@ -475,6 +485,7 @@ const createLiveClient = (
   }
 
   return {
+    credentials: 'auth-key',
     client: new Transloadit({
       authKey: options.authKey,
       authSecret: options.authSecret,
@@ -527,19 +538,36 @@ const isErrnoException = (value: unknown): value is NodeJS.ErrnoException =>
 const toAuthRejection = (
   options: TransloaditMcpServerOptions,
   error: unknown,
+  credentials: CredentialKind,
 ): CallToolResult | undefined => {
   const status = getHttpStatusCode(error)
-  if (status === 401) {
+  const scopeRejected =
+    status === 403 && error instanceof ApiError && /SCOPE|BEARER_TOKEN/.test(error.code ?? '')
+  // Only forwarded tokens can be renewed by the host's account linking; an Auth Key configured
+  // on the server needs an operator, so it gets no OAuth challenge.
+  if (credentials === 'auth-key') {
+    if (status === 401) {
+      return buildCredentialError({
+        code: 'mcp_credentials_rejected',
+        message: 'Transloadit rejected the Auth Key this server is configured with.',
+        hint: 'Check that TRANSLOADIT_KEY and TRANSLOADIT_SECRET belong to an active Auth Key.',
+      })
+    }
+    if (scopeRejected) {
+      return buildCredentialError({
+        code: 'mcp_insufficient_scope',
+        message: 'The configured Auth Key lacks the scope this tool needs.',
+        hint: 'Grant the Auth Key the scopes this tool declares, or configure another key.',
+      })
+    }
+  } else if (status === 401) {
     return buildAuthError(options, {
       code: 'mcp_auth_rejected',
       oauthError: 'invalid_token',
       message: 'Transloadit rejected the credentials; the token may have expired.',
       hint: 'Reconnect your Transloadit account and retry.',
     })
-  }
-  const scopeRejected =
-    status === 403 && error instanceof ApiError && /SCOPE|BEARER_TOKEN/.test(error.code ?? '')
-  if (scopeRejected) {
+  } else if (scopeRejected) {
     return buildAuthError(options, {
       code: 'mcp_insufficient_scope',
       oauthError: 'insufficient_scope',
@@ -553,6 +581,13 @@ const toAuthRejection = (
   return undefined
 }
 
+/** A failed call caused by server-side credentials; an error result so strict outputs still pass. */
+const buildCredentialError = (error: {
+  code: string
+  message: string
+  hint: string
+}): CallToolResult => buildToolResponse({ status: 'error', errors: [error] }, { isError: true })
+
 /**
  * Key/secret signatures fail when the configured algorithm differs from the Auth Key's
  * `signature_algo`; API2 names the required one, so the hint can say exactly what to set.
@@ -561,22 +596,13 @@ const buildSignatureError = (error: ApiError): CallToolResult => {
   const required = signatureAlgorithmSchema.safeParse(
     /requires (sha\d+)/.exec(error.rawMessage ?? '')?.[1],
   )
-  // An error result, so tools with stricter output schemas (list_templates) can still return it.
-  return buildToolResponse(
-    {
-      status: 'error',
-      errors: [
-        {
-          code: 'mcp_invalid_signature',
-          message: 'Transloadit rejected the request signature for this Auth Key.',
-          hint: required.success
-            ? `This Auth Key signs with ${required.data}: set TRANSLOADIT_SIGNATURE_ALGORITHM=${required.data} (or the signatureAlgorithm option) and restart the MCP server.`
-            : 'Check that TRANSLOADIT_SECRET and TRANSLOADIT_SIGNATURE_ALGORITHM match the Auth Key.',
-        },
-      ],
-    },
-    { isError: true },
-  )
+  return buildCredentialError({
+    code: 'mcp_invalid_signature',
+    message: 'Transloadit rejected the request signature for this Auth Key.',
+    hint: required.success
+      ? `This Auth Key signs with ${required.data}: set TRANSLOADIT_SIGNATURE_ALGORITHM=${required.data} (or the signatureAlgorithm option) and restart the MCP server.`
+      : 'Check that TRANSLOADIT_SECRET and TRANSLOADIT_SIGNATURE_ALGORITHM match the Auth Key.',
+  })
 }
 
 const trimTrailingSlash = (value: string): string => value.replace(/\/$/, '')
@@ -594,6 +620,12 @@ const buildWidgetContext = (
 
   const workspaceUrl = `${consoleUrl}/c/${encodeURIComponent(slug)}`
   const newTemplateUrl = new URL(`${workspaceUrl}/templates/new`)
+  // `fromAssembly` lets the Console seed the editor with the Assembly's effective instructions,
+  // overrides included; Content's new-Template page still has to learn that parameter.
+  // `duplicateFrom` is what that page resolves today, so Template-based runs keep a useful seed.
+  if (assemblyId) {
+    newTemplateUrl.searchParams.set('fromAssembly', assemblyId)
+  }
   if (templateId && !isBuiltinTemplateId(templateId)) {
     newTemplateUrl.searchParams.set('duplicateFrom', templateId)
   }
@@ -751,6 +783,7 @@ const resolveAssemblyReference = (
 type AssemblyAccessResult =
   | {
       client: Transloadit
+      credentials: CredentialKind
       assemblyId: string
       assemblyUrl?: string
     }
@@ -769,6 +802,7 @@ const resolveAssemblyAccess = (
 
   return {
     client: liveClient.client,
+    credentials: liveClient.credentials,
     ...reference,
   }
 }
@@ -907,7 +941,7 @@ export const createTransloaditMcpServer = (
     version: options.serverVersion ?? packageJson.version,
   })
 
-  const listedTools: ListedTool[] = []
+  const authMode = resolveToolAuthMode(options)
   const register = <Input extends ZodObject, Output extends ZodObject>(
     name: ToolName,
     inputSchema: Input,
@@ -915,7 +949,7 @@ export const createTransloaditMcpServer = (
     callback: ToolCallback<Input>,
   ): void => {
     const metadata = toolMetadata[name]
-    const registered = server.registerTool(
+    server.registerTool(
       name,
       {
         title: metadata.title,
@@ -923,17 +957,10 @@ export const createTransloaditMcpServer = (
         inputSchema,
         outputSchema,
         annotations: metadata.annotations,
-        _meta: buildToolMeta(metadata),
+        _meta: buildToolMeta(metadata, resolveSecuritySchemes(metadata, authMode)),
       },
       callback,
     )
-    listedTools.push({
-      name,
-      inputSchema,
-      outputSchema,
-      securitySchemes: metadata.securitySchemes,
-      registered,
-    })
   }
 
   // Builtin templates supersede the old golden template tool; no legacy alias by design.
@@ -986,7 +1013,7 @@ export const createTransloaditMcpServer = (
     ) => {
       const liveClient = createLiveClient(options, extra)
       if ('error' in liveClient) return liveClient.error
-      const { client } = liveClient
+      const { client, credentials } = liveClient
       const reference =
         assembly_url === undefined ? undefined : resolveAssemblyReference(options, { assembly_url })
       if (reference && 'error' in reference) return reference.error
@@ -1222,7 +1249,7 @@ export const createTransloaditMcpServer = (
           { meta: { [widgetContextMetaKey]: buildWidgetContext(options, assembly) } },
         )
       } catch (error) {
-        const rejection = toAuthRejection(options, error)
+        const rejection = toAuthRejection(options, error, credentials)
         if (rejection) return rejection
         throw error
       } finally {
@@ -1243,7 +1270,7 @@ export const createTransloaditMcpServer = (
       try {
         assembly = await access.client.getAssembly(access.assemblyId)
       } catch (error) {
-        const rejection = toAuthRejection(options, error)
+        const rejection = toAuthRejection(options, error, access.credentials)
         if (rejection) return rejection
         throw error
       }
@@ -1272,7 +1299,7 @@ export const createTransloaditMcpServer = (
           assemblyUrl: access.assemblyUrl,
         })
       } catch (error) {
-        const rejection = toAuthRejection(options, error)
+        const rejection = toAuthRejection(options, error, access.credentials)
         if (rejection) return rejection
         throw error
       }
@@ -1415,7 +1442,7 @@ export const createTransloaditMcpServer = (
           total: parsed.data.count ?? items.length,
         })
       } catch (error) {
-        const rejection = toAuthRejection(options, error)
+        const rejection = toAuthRejection(options, error, liveClient.credentials)
         if (rejection) return rejection
         const message = error instanceof Error ? error.message : 'Failed to list templates.'
         return buildToolResponse({
@@ -1444,7 +1471,7 @@ export const createTransloaditMcpServer = (
       try {
         profile = await resolveWorkspaceProfile(liveClient.client)
       } catch (error) {
-        const rejection = toAuthRejection(options, error)
+        const rejection = toAuthRejection(options, error, liveClient.credentials)
         if (rejection) return rejection
         throw error
       }
@@ -1470,7 +1497,7 @@ export const createTransloaditMcpServer = (
   )
 
   registerAssemblyResultWidget(server, { resultDomains: options.resultDomains })
-  installToolListHandler(server, listedTools)
+  mirrorSecuritySchemes(server)
 
   return server
 }
diff --git a/packages/mcp-server/src/tool-list.ts b/packages/mcp-server/src/tool-list.ts
index 67538c31..c176c5f7 100644
--- a/packages/mcp-server/src/tool-list.ts
+++ b/packages/mcp-server/src/tool-list.ts
@@ -1,64 +1,55 @@
-import type { McpServer, RegisteredTool } from '@modelcontextprotocol/sdk/server/mcp.js'
-import type { Tool } from '@modelcontextprotocol/sdk/types.js'
-import type { ZodObject } from 'zod'
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'
 
-import type { ToolSecurityScheme } from './tool-metadata.ts'
+type RequestHandler = (request: unknown, extra: unknown) => Promise<unknown>
 
-import { ListToolsRequestSchema } from '@modelcontextprotocol/sdk/types.js'
-import { z } from 'zod'
+const isRecord = (value: unknown): value is Record<string, unknown> =>
+  typeof value === 'object' && value !== null && !Array.isArray(value)
 
-export type ListedTool = {
-  name: string
-  inputSchema: ZodObject
-  outputSchema: ZodObject
-  securitySchemes: ToolSecurityScheme[]
-  registered: RegisteredTool
-}
-
-type ListedToolDefinition = Tool & { securitySchemes: ToolSecurityScheme[] }
-
-// Same options the SDK passes to Zod for v4 schemas, so the advertised schemas stay identical.
-const jsonSchemaTarget = 'draft-7'
+const isRequestHandler = (value: unknown): value is RequestHandler => typeof value === 'function'
 
-const toObjectJsonSchema = (schema: ZodObject, io: 'input' | 'output'): Tool['inputSchema'] => {
-  const jsonSchema = z.toJSONSchema(schema, { target: jsonSchemaTarget, io })
-  // Zod types the payload loosely (any schema kind, boolean sub-schemas); a ZodObject always
-  // serializes to an object schema with object properties, so this only narrows the type.
-  if (jsonSchema.type !== 'object') {
-    throw new Error(`Expected an object JSON schema, received ${String(jsonSchema.type)}`)
-  }
-  const properties: Record<string, object> = {}
-  for (const [key, value] of Object.entries(jsonSchema.properties ?? {})) {
-    if (typeof value === 'object') properties[key] = value
+/**
+ * `@modelcontextprotocol/sdk` keeps request handlers in the private `Protocol._requestHandlers`
+ * map and offers no getter. Reading it is the only way to wrap the SDK's own `tools/list` handler
+ * rather than re-implementing it; a failing read throws so an SDK upgrade cannot silently drop the
+ * field.
+ */
+const readRequestHandlers = (server: McpServer): Map<unknown, unknown> => {
+  const handlers: unknown = Object.getOwnPropertyDescriptor(
+    server.server,
+    '_requestHandlers',
+  )?.value
+  if (!(handlers instanceof Map)) {
+    throw new Error('@modelcontextprotocol/sdk no longer keeps _requestHandlers in a Map.')
   }
-  return { ...jsonSchema, type: 'object', properties }
+  return handlers
 }
 
-const toToolDefinition = ({
-  name,
-  inputSchema,
-  outputSchema,
-  securitySchemes,
-  registered,
-}: ListedTool): ListedToolDefinition => ({
-  name,
-  title: registered.title,
-  description: registered.description,
-  inputSchema: toObjectJsonSchema(inputSchema, 'input'),
-  outputSchema: toObjectJsonSchema(outputSchema, 'output'),
-  annotations: registered.annotations,
-  execution: registered.execution,
-  _meta: registered._meta,
-  securitySchemes,
-})
+const withTopLevelSecuritySchemes = (result: unknown): unknown => {
+  if (!isRecord(result) || !Array.isArray(result.tools)) return result
+  return {
+    ...result,
+    tools: result.tools.map((tool) => {
+      if (!isRecord(tool) || !isRecord(tool._meta) || !Array.isArray(tool._meta.securitySchemes)) {
+        return tool
+      }
+      return { ...tool, securitySchemes: tool._meta.securitySchemes }
+    }),
+  }
+}
 
 /**
- * Replaces the SDK's `tools/list` handler so every tool also carries the top-level
- * `securitySchemes` field, which `registerTool()` has no way to emit. The definitions are built
- * the same way the SDK builds them; only the extra field differs.
+ * ChatGPT and Claude read `securitySchemes` as a top-level Tool field, which `registerTool()`
+ * cannot emit. Wrapping the SDK's `tools/list` handler keeps its live registry (tools registered
+ * later, enable/disable, schema conversion) and copies each tool's `_meta.securitySchemes` up.
+ * Call it after the first `registerTool()`, which installs the handler.
  */
-export const installToolListHandler = (server: McpServer, tools: ListedTool[]): void => {
-  server.server.setRequestHandler(ListToolsRequestSchema, () => ({
-    tools: tools.filter((tool) => tool.registered.enabled).map(toToolDefinition),
-  }))
+export const mirrorSecuritySchemes = (server: McpServer): void => {
+  const handlers = readRequestHandlers(server)
+  const listTools = handlers.get('tools/list')
+  if (!isRequestHandler(listTools)) {
+    throw new Error('Register a tool before mirroring securitySchemes into tools/list.')
+  }
+  const wrapped: RequestHandler = async (request, extra) =>
+    withTopLevelSecuritySchemes(await listTools(request, extra))
+  handlers.set('tools/list', wrapped)
 }
diff --git a/packages/mcp-server/src/tool-metadata.ts b/packages/mcp-server/src/tool-metadata.ts
index ef59a497..133aa3e1 100644
--- a/packages/mcp-server/src/tool-metadata.ts
+++ b/packages/mcp-server/src/tool-metadata.ts
@@ -29,14 +29,43 @@ export type ToolMetadata = {
   title: string
   description: string
   annotations: ToolAnnotations
-  securitySchemes: ToolSecurityScheme[]
+  /** `public` tools need no Transloadit account; `account` tools call API2 for the caller. */
+  access: 'public' | 'account'
+  /** Every Auth Key scope any code path of the tool may need. */
+  scopes: string[]
   /** Host-specific `_meta` keys (OpenAI, MCP Apps). `securitySchemes` is mirrored in automatically. */
   meta?: Record<string, unknown>
 }
 
-const noAuth: ToolSecurityScheme = { type: 'noauth' }
+/**
+ * How callers authenticate with this deployment, which decides what each tool may honestly
+ * declare:
+ * - `hosted`: every unauthenticated request gets the OAuth challenge (Claude Code and Codex only
+ *   start OAuth on a 401), so even the public tools need an OAuth token.
+ * - `server-credentials`: the server signs with its own Auth Key, so no tool needs caller auth.
+ * - `caller-credentials`: public tools work anonymously; account tools need a forwarded token.
+ */
+export type ToolAuthMode = 'hosted' | 'server-credentials' | 'caller-credentials'
 
-const oauth2 = (...scopes: string[]): ToolSecurityScheme => ({ type: 'oauth2', scopes })
+export const resolveToolAuthMode = (options: {
+  resourceMetadataUrl?: string
+  authKey?: string
+  authSecret?: string
+}): ToolAuthMode => {
+  if (options.resourceMetadataUrl) return 'hosted'
+  if (options.authKey && options.authSecret) return 'server-credentials'
+  return 'caller-credentials'
+}
+
+/** The `securitySchemes` a tool declares in the given deployment mode. */
+export const resolveSecuritySchemes = (
+  metadata: ToolMetadata,
+  mode: ToolAuthMode,
+): ToolSecurityScheme[] => {
+  if (mode === 'server-credentials') return [{ type: 'noauth' }]
+  if (mode === 'caller-credentials' && metadata.access === 'public') return [{ type: 'noauth' }]
+  return [{ type: 'oauth2', scopes: metadata.scopes }]
+}
 
 const readOnly: ToolAnnotations = {
   readOnlyHint: true,
@@ -57,7 +86,7 @@ export const widgetToolNames: readonly ToolName[] = [
 ]
 
 /**
- * Titles, descriptions, annotations and security schemes for every tool, shared by the live
+ * Titles, descriptions, annotations, access and scopes for every tool, shared by the live
  * server and the static server card so the two never drift.
  */
 export const toolMetadata: Record<ToolName, ToolMetadata> = {
@@ -66,7 +95,8 @@ export const toolMetadata: Record<ToolName, ToolMetadata> = {
     description:
       'Lint Assembly Instructions without creating an Assembly. Returns structured issues.',
     annotations: readOnly,
-    securitySchemes: [noAuth],
+    access: 'public',
+    scopes: [],
   },
   transloadit_create_assembly: {
     title: 'Create or resume an Assembly',
@@ -74,13 +104,16 @@ export const toolMetadata: Record<ToolName, ToolMetadata> = {
       'Create or resume an Assembly, optionally uploading files and waiting for completion. Files attached in the chat arrive under attachments; public URLs and small base64 payloads go under files.',
     annotations: {
       readOnlyHint: false,
-      // Creating an Assembly is billable but never deletes or overwrites customer data.
-      destructiveHint: false,
+      // Export Robots (/s3/store, /google/store, …) can overwrite files at the destination, so
+      // hosts should confirm before running caller-supplied instructions.
+      destructiveHint: true,
       idempotentHint: false,
       // URL inputs and /http/import Steps fetch caller-supplied locations.
       openWorldHint: true,
     },
-    securitySchemes: [oauth2(mcpScopes.assembliesWrite)],
+    access: 'account',
+    // Reading `template_id` instructions needs templates:read; status polling is public in API2.
+    scopes: [mcpScopes.assembliesWrite, mcpScopes.templatesRead],
     meta: {
       ...widgetMeta,
       'openai/fileParams': ['attachments'],
@@ -92,7 +125,8 @@ export const toolMetadata: Record<ToolName, ToolMetadata> = {
     title: 'Get Assembly status',
     description: 'Fetch the latest Assembly status by URL or ID.',
     annotations: readOnly,
-    securitySchemes: [oauth2(mcpScopes.assembliesRead)],
+    access: 'account',
+    scopes: [mcpScopes.assembliesRead],
     meta: {
       'openai/toolInvocation/invoking': 'Checking the Assembly status…',
       'openai/toolInvocation/invoked': 'Fetched the Assembly status',
@@ -102,7 +136,8 @@ export const toolMetadata: Record<ToolName, ToolMetadata> = {
     title: 'Wait for Assembly completion',
     description: 'Polls until the Assembly completes or timeout is reached.',
     annotations: readOnly,
-    securitySchemes: [oauth2(mcpScopes.assembliesRead)],
+    access: 'account',
+    scopes: [mcpScopes.assembliesRead],
     meta: {
       ...widgetMeta,
       'openai/toolInvocation/invoking': 'Waiting for the Assembly to finish…',
@@ -113,20 +148,23 @@ export const toolMetadata: Record<ToolName, ToolMetadata> = {
     title: 'List Transloadit Robots',
     description: 'Returns a filtered list of Robots with short summaries.',
     annotations: readOnly,
-    securitySchemes: [noAuth],
+    access: 'public',
+    scopes: [],
   },
   transloadit_get_robot_help: {
     title: 'Get Robot parameter help',
     description: 'Returns a Robot summary and parameter details.',
     annotations: readOnly,
-    securitySchemes: [noAuth],
+    access: 'public',
+    scopes: [],
   },
   transloadit_list_templates: {
     title: 'List Templates',
     description:
       'List Assembly Templates (owned and/or builtin). Tip: pass include_builtin: "exclusively-latest" to list builtins only.',
     annotations: readOnly,
-    securitySchemes: [oauth2(mcpScopes.templatesRead)],
+    access: 'account',
+    scopes: [mcpScopes.templatesRead],
     meta: {
       'openai/toolInvocation/invoking': 'Listing Templates…',
       'openai/toolInvocation/invoked': 'Listed Templates',
@@ -137,15 +175,20 @@ export const toolMetadata: Record<ToolName, ToolMetadata> = {
     description:
       'Returns a stable identifier and name for the Transloadit Workspace behind the current credentials, so hosts can tell connected accounts apart.',
     annotations: readOnly,
-    securitySchemes: [oauth2()],
+    access: 'account',
+    // The Workspace is read from the latest Assembly, falling back to an owned Template.
+    scopes: [mcpScopes.assembliesRead, mcpScopes.templatesRead],
     meta: {
       'openai/profile': true,
     },
   },
 }
 
-/** `_meta` for `tools/list`: mirrors `securitySchemes` for hosts that only read `_meta`. */
-export const buildToolMeta = (metadata: ToolMetadata): Record<string, unknown> => ({
-  securitySchemes: metadata.securitySchemes,
+/** `_meta` for `tools/list`: carries `securitySchemes` for hosts that only read `_meta`. */
+export const buildToolMeta = (
+  metadata: ToolMetadata,
+  securitySchemes: ToolSecurityScheme[],
+): Record<string, unknown> => ({
+  securitySchemes,
   ...metadata.meta,
 })
diff --git a/packages/mcp-server/test/e2e/server-card.test.ts b/packages/mcp-server/test/e2e/server-card.test.ts
index 22daa575..723d5a12 100644
--- a/packages/mcp-server/test/e2e/server-card.test.ts
+++ b/packages/mcp-server/test/e2e/server-card.test.ts
@@ -38,7 +38,7 @@ describe('server card', () => {
         expect(typeof tool.title).toBe('string')
         expect(typeof tool.description).toBe('string')
         expect(typeof tool.inputSchema).toBe('object')
-        expect(tool.annotations).toMatchObject({ destructiveHint: false })
+        expect(tool.annotations).toMatchObject({ destructiveHint: expect.any(Boolean) })
         expect(Array.isArray(tool.securitySchemes)).toBe(true)
       }
     } finally {
diff --git a/packages/mcp-server/test/unit/auth-errors.test.ts b/packages/mcp-server/test/unit/auth-errors.test.ts
index 5a928ca3..01a810eb 100644
--- a/packages/mcp-server/test/unit/auth-errors.test.ts
+++ b/packages/mcp-server/test/unit/auth-errors.test.ts
@@ -114,6 +114,29 @@ describe('tool auth errors', () => {
     expect(isRecord(content) ? content.text : undefined).not.toContain('Rejected')
   })
 
+  it('names the Auth Key, not OAuth, when API2 rejects key/secret credentials', async () => {
+    serverOptions.authKey = 'key'
+    serverOptions.authSecret = 'secret'
+    vi.spyOn(Transloadit.prototype, 'getAssembly').mockRejectedValue(apiRejection(401))
+    await connect()
+
+    const result = await client.callTool({
+      name: 'transloadit_get_assembly_status',
+      arguments: { assembly_id: '0123456789abcdef0123456789abcdef' },
+    })
+    expect(result.isError).toBe(true)
+    expect(result._meta?.['mcp/www_authenticate']).toBeUndefined()
+    expect(result.structuredContent).toMatchObject({
+      status: 'error',
+      errors: [
+        {
+          code: 'mcp_credentials_rejected',
+          hint: expect.stringContaining('TRANSLOADIT_KEY'),
+        },
+      ],
+    })
+  })
+
   it('leaves other API failures as ordinary tool errors', async () => {
     vi.spyOn(Transloadit.prototype, 'getAssembly').mockRejectedValue(apiRejection(500))
     await connect({ Authorization: 'Bearer token' })
diff --git a/packages/mcp-server/test/unit/file-inputs.test.ts b/packages/mcp-server/test/unit/file-inputs.test.ts
index dbd6f91a..a72ca360 100644
--- a/packages/mcp-server/test/unit/file-inputs.test.ts
+++ b/packages/mcp-server/test/unit/file-inputs.test.ts
@@ -665,12 +665,23 @@ describe('MCP file inputs', () => {
     expect(Transloadit.prototype.createAssembly).not.toHaveBeenCalled()
   })
 
-  it('hands the widget Console deep links for the Assembly and a new Template', async () => {
+  it.each([
+    [
+      'an inline Assembly',
+      undefined,
+      `https://transloadit.com/c/acme/templates/new?fromAssembly=${assemblyId}`,
+    ],
+    [
+      'a Template-based Assembly',
+      'tpl_1',
+      `https://transloadit.com/c/acme/templates/new?fromAssembly=${assemblyId}&duplicateFrom=tpl_1`,
+    ],
+  ])('links Save as Template for %s to the Assembly it came from', async (_kind, templateId, newTemplateUrl) => {
     vi.mocked(Transloadit.prototype.createAssembly).mockResolvedValue({
       ok: 'ASSEMBLY_COMPLETED',
       assembly_id: assemblyId,
       account_slug: 'acme',
-      template_id: 'tpl_1',
+      template_id: templateId,
     })
     const result = await client.callTool({
       name: 'transloadit_create_assembly',
@@ -684,7 +695,7 @@ describe('MCP file inputs', () => {
       'transloadit/widget': {
         authenticated: true,
         assembly_console_url: `https://transloadit.com/c/acme/assemblies/${assemblyId}`,
-        new_template_url: 'https://transloadit.com/c/acme/templates/new?duplicateFrom=tpl_1',
+        new_template_url: newTemplateUrl,
       },
     })
   })
diff --git a/packages/mcp-server/test/unit/hosted-auth.test.ts b/packages/mcp-server/test/unit/hosted-auth.test.ts
index 1091218b..72c32615 100644
--- a/packages/mcp-server/test/unit/hosted-auth.test.ts
+++ b/packages/mcp-server/test/unit/hosted-auth.test.ts
@@ -4,6 +4,7 @@ import { createServer } from 'node:http'
 
 import { afterEach, describe, expect, it } from 'vitest'
 
+import { createTransloaditMcpExpressRouter } from '../../src/express.ts'
 import { createTransloaditMcpHttpHandler } from '../../src/http.ts'
 import { matchesOriginPattern } from '../../src/http-helpers.ts'
 
@@ -158,9 +159,35 @@ describe('hosted MCP endpoint auth', () => {
 
     const card = await fetch(new URL('/.well-known/mcp/server-card.json', running.url))
     expect(card.status).toBe(200)
-    await expect(card.json()).resolves.toMatchObject({
+    const body = await card.json()
+    expect(body).toMatchObject({
       authentication: { required: true, schemes: ['oauth2', 'bearer'], resourceMetadataUrl },
     })
+    expect(
+      body.tools.find((tool: { name: string }) => tool.name === 'transloadit_list_robots'),
+    ).toMatchObject({ securitySchemes: [{ type: 'oauth2', scopes: [] }] })
+  })
+
+  it('advertises the documentation tools as noauth in a self-hosted server card', async () => {
+    running = await start()
+
+    const card = await fetch(new URL('/.well-known/mcp/server-card.json', running.url))
+    const body = await card.json()
+    expect(
+      body.tools.find((tool: { name: string }) => tool.name === 'transloadit_list_robots'),
+    ).toMatchObject({ securitySchemes: [{ type: 'noauth' }] })
+  })
+
+  it('refuses a static MCP token together with hosted OAuth', () => {
+    // The static token check would reject every OAuth token before the hosted challenge runs.
+    expect(() =>
+      createTransloaditMcpHttpHandler({ mcpToken: 'static-secret', resourceMetadataUrl }),
+    ).toThrow(
+      'Configure either TRANSLOADIT_MCP_TOKEN (self-hosted) or TRANSLOADIT_MCP_RESOURCE_METADATA_URL (hosted OAuth), not both.',
+    )
+    expect(() =>
+      createTransloaditMcpExpressRouter({ mcpToken: 'static-secret', resourceMetadataUrl }),
+    ).toThrow('not both')
   })
 })
 
diff --git a/packages/mcp-server/test/unit/tool-surface.test.ts b/packages/mcp-server/test/unit/tool-surface.test.ts
index 3dc5859d..11009827 100644
--- a/packages/mcp-server/test/unit/tool-surface.test.ts
+++ b/packages/mcp-server/test/unit/tool-surface.test.ts
@@ -5,6 +5,7 @@ import { createServer } from 'node:http'
 import { Client } from '@modelcontextprotocol/sdk/client/index.js'
 import { InMemoryTransport } from '@modelcontextprotocol/sdk/inMemory.js'
 import { afterAll, beforeAll, describe, expect, it } from 'vitest'
+import { z } from 'zod'
 
 import { createTransloaditMcpHttpHandler } from '../../src/http.ts'
 import { createTransloaditMcpServer } from '../../src/server.ts'
@@ -96,7 +97,7 @@ describe('tool surface', () => {
       expect(typeof tool.title, String(tool.name)).toBe('string')
       expect(tool.annotations).toMatchObject({
         readOnlyHint: expect.any(Boolean),
-        destructiveHint: false,
+        destructiveHint: expect.any(Boolean),
         openWorldHint: expect.any(Boolean),
       })
       expect(Array.isArray(tool.securitySchemes), String(tool.name)).toBe(true)
@@ -106,26 +107,39 @@ describe('tool surface', () => {
     }
   })
 
+  // The hosted endpoint answers every unauthenticated request with the OAuth challenge, so even
+  // the documentation tools are declared oauth2 there, with no scopes.
   it.each([
-    ['transloadit_list_robots', [{ type: 'noauth' }]],
-    ['transloadit_get_robot_help', [{ type: 'noauth' }]],
-    ['transloadit_lint_assembly_instructions', [{ type: 'noauth' }]],
-    ['transloadit_create_assembly', [{ type: 'oauth2', scopes: ['assemblies:write'] }]],
+    ['transloadit_list_robots', [{ type: 'oauth2', scopes: [] }]],
+    ['transloadit_get_robot_help', [{ type: 'oauth2', scopes: [] }]],
+    ['transloadit_lint_assembly_instructions', [{ type: 'oauth2', scopes: [] }]],
+    [
+      'transloadit_create_assembly',
+      [{ type: 'oauth2', scopes: ['assemblies:write', 'templates:read'] }],
+    ],
     ['transloadit_get_assembly_status', [{ type: 'oauth2', scopes: ['assemblies:read'] }]],
     ['transloadit_wait_for_assembly', [{ type: 'oauth2', scopes: ['assemblies:read'] }]],
     ['transloadit_list_templates', [{ type: 'oauth2', scopes: ['templates:read'] }]],
-    ['transloadit_get_profile', [{ type: 'oauth2', scopes: [] }]],
-  ])('%s declares %j', async (name, securitySchemes) => {
+    [
+      'transloadit_get_profile',
+      [{ type: 'oauth2', scopes: ['assemblies:read', 'templates:read'] }],
+    ],
+  ])('hosted %s declares %j', async (name, securitySchemes) => {
     const tool = findTool(await listTools(), name)
     expect(tool.securitySchemes).toEqual(securitySchemes)
   })
 
-  it('marks only the Assembly creation as open-world and nothing as destructive', async () => {
+  it('marks only Assembly creation as open-world and destructive', async () => {
     const tools = await listTools()
     const openWorld = tools.filter(
       (tool) => isRecord(tool.annotations) && tool.annotations.openWorldHint === true,
     )
     expect(openWorld.map((tool) => tool.name)).toEqual(['transloadit_create_assembly'])
+    // Export Robots such as /s3/store can overwrite files at the destination.
+    const destructive = tools.filter(
+      (tool) => isRecord(tool.annotations) && tool.annotations.destructiveHint === true,
+    )
+    expect(destructive.map((tool) => tool.name)).toEqual(['transloadit_create_assembly'])
     const readOnly = tools.filter(
       (tool) => isRecord(tool.annotations) && tool.annotations.readOnlyHint === true,
     )
@@ -241,3 +255,79 @@ describe('result widget domains', () => {
     await server.close()
   })
 })
+
+// The SDK client drops Tool fields it does not know, such as the top-level securitySchemes.
+const rawToolsListSchema = z.object({ tools: z.array(z.record(z.string(), z.unknown())) })
+
+const connectInMemory = async (
+  server: ReturnType<typeof createTransloaditMcpServer>,
+): Promise<Client> => {
+  const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair()
+  const client = new Client({ name: 'tool-surface', version: '1.0.0' })
+  await Promise.all([server.connect(serverTransport), client.connect(clientTransport)])
+  return client
+}
+
+const listRawTools = async (
+  options: Parameters<typeof createTransloaditMcpServer>[0],
+): Promise<JsonRecord[]> => {
+  const server = createTransloaditMcpServer(options)
+  const client = await connectInMemory(server)
+  const { tools } = await client.request({ method: 'tools/list' }, rawToolsListSchema)
+  await client.close()
+  await server.close()
+  return tools
+}
+
+const schemesByName = (tools: JsonRecord[]): Record<string, unknown> =>
+  Object.fromEntries(tools.map((tool) => [tool.name, tool.securitySchemes]))
+
+describe('security schemes outside hosted mode', () => {
+  it('declares the documentation tools noauth and the account tools oauth2 without credentials', async () => {
+    const schemes = schemesByName(await listRawTools({}))
+
+    expect(schemes.transloadit_list_robots).toEqual([{ type: 'noauth' }])
+    expect(schemes.transloadit_get_robot_help).toEqual([{ type: 'noauth' }])
+    expect(schemes.transloadit_lint_assembly_instructions).toEqual([{ type: 'noauth' }])
+    expect(schemes.transloadit_create_assembly).toEqual([
+      { type: 'oauth2', scopes: ['assemblies:write', 'templates:read'] },
+    ])
+    expect(schemes.transloadit_list_templates).toEqual([
+      { type: 'oauth2', scopes: ['templates:read'] },
+    ])
+  })
+
+  it('declares every tool noauth when the server holds Auth Key credentials', async () => {
+    const tools = await listRawTools({ authKey: 'key', authSecret: 'secret' })
+
+    expect(new Set(tools.map((tool) => JSON.stringify(tool.securitySchemes)))).toEqual(
+      new Set([JSON.stringify([{ type: 'noauth' }])]),
+    )
+  })
+})
+
+describe('tools registered after creation', () => {
+  it('stay discoverable, with their own securitySchemes mirrored to the top level', async () => {
+    const server = createTransloaditMcpServer({})
+    server.registerTool(
+      'custom_echo',
+      {
+        description: 'Echo for embedders',
+        inputSchema: z.object({ text: z.string() }),
+        _meta: { securitySchemes: [{ type: 'noauth' }] },
+      },
+      ({ text }) => ({ content: [{ type: 'text', text }] }),
+    )
+    const client = await connectInMemory(server)
+
+    const { tools } = await client.request({ method: 'tools/list' }, rawToolsListSchema)
+    const custom = tools.find((tool) => tool.name === 'custom_echo')
+    expect(custom).toMatchObject({
+      description: 'Echo for embedders',
+      securitySchemes: [{ type: 'noauth' }],
+    })
+    expect(tools).toHaveLength(toolNames.length + 1)
+    await client.close()
+    await server.close()
+  })
+})

From 6b812fa23f27292174a92b258672058c2550b799 Mon Sep 17 00:00:00 2001
From: Kevin van Zonneveld <kevin@vanzonneveld.net>
Date: Fri, 2 Oct 2026 15:09:52 +0200
Subject: [PATCH 12/27] Address council review run 2: HTTP auth status, profile
 fields, widget links

Council review of PR #529 (run 2), each fix preceded by a failing test:

- Hosted requests use the SDK's web-standard transport in JSON mode, so an upstream rejection of
  the forwarded token becomes HTTP 401 (`invalid_token`) or 403 (`insufficient_scope` with the
  tool's scopes). MCP OAuth clients refresh or re-scope only on those statuses.
- The profile fallback requests `account_id`, which API2's default Template list omits;
  `listTemplates()` gains a `fields` parameter for that.
- A malformed `consoleUrl` no longer turns a created Assembly into a failed call.
- Origins are enforced once, by our wildcard-aware check, instead of also by the SDK's literal
  comparison, which rejected wildcard matches under DNS rebinding protection. The Express router
  now applies configured origins itself.
- Widget download links go through the host's `ui/open-link`, like the Console buttons.
- Both plugin manifests ship the icon and logo they reference, and no longer claim that the hosted
  plugin works without an account.
- Save as Template keeps its documented `fromAssembly` link; Console seeding is a Content
  follow-up.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .changeset/mcp-oauth-discovery.md             |   3 +
 .changeset/mcp-upstream-header.md             |   3 +
 packages/mcp-server/.codex-plugin/plugin.json |   2 +-
 packages/mcp-server/README.md                 |   6 +-
 packages/mcp-server/assets/icon.png           | Bin 0 -> 17066 bytes
 packages/mcp-server/assets/logo.png           | Bin 0 -> 20013 bytes
 packages/mcp-server/plugin.json               |   2 +-
 packages/mcp-server/src/express.ts            |  24 ++--
 packages/mcp-server/src/http-helpers.ts       |   5 +
 packages/mcp-server/src/http.ts               |  15 +--
 packages/mcp-server/src/request-transport.ts  | 114 ++++++++++++++++++
 packages/mcp-server/src/server.ts             |  64 ++++++++--
 .../src/ui/assembly-result-widget.ts          |  17 ++-
 .../mcp-server/test/unit/auth-errors.test.ts  |  34 +++---
 .../mcp-server/test/unit/file-inputs.test.ts  |  22 ++++
 .../mcp-server/test/unit/hosted-auth.test.ts  |  40 ++++++
 .../test/unit/plugin-manifest.test.ts         |  48 ++++++++
 .../test/unit/upstream-auth-status.test.ts    | 100 +++++++++++++++
 .../test/unit/widget-handshake.test.ts        |  31 +++++
 packages/node/src/apiTypes.ts                 |   2 +
 20 files changed, 463 insertions(+), 69 deletions(-)
 create mode 100644 packages/mcp-server/assets/icon.png
 create mode 100644 packages/mcp-server/assets/logo.png
 create mode 100644 packages/mcp-server/src/request-transport.ts
 create mode 100644 packages/mcp-server/test/unit/plugin-manifest.test.ts
 create mode 100644 packages/mcp-server/test/unit/upstream-auth-status.test.ts

diff --git a/.changeset/mcp-oauth-discovery.md b/.changeset/mcp-oauth-discovery.md
index 6b6aa83e..e8c205a9 100644
--- a/.changeset/mcp-oauth-discovery.md
+++ b/.changeset/mcp-oauth-discovery.md
@@ -21,6 +21,9 @@ connector requirements.
 - MCP Apps result widget `ui://transloadit/assembly-result` with previews, download links and a
   Save as Template shortcut, linked from the Assembly tools with `_meta.ui.resourceUri`.
 - `plugin.json`, `mcp.json` and `.codex-plugin/plugin.json` describe the ChatGPT and Codex plugin.
+- Hosted mode serves JSON responses and turns an upstream rejection of the forwarded token into
+  HTTP 401 (`invalid_token`) or 403 (`insufficient_scope` with the tool's scopes), so OAuth clients
+  refresh or re-scope instead of retrying a dead token.
 - Hosted mode also challenges bare `GET /mcp` probes (Codex discovers OAuth from them); CORS now
   allows `Mcp-Protocol-Version` so browser hosts can connect.
 - Self-hosted servers sign with `TRANSLOADIT_SIGNATURE_ALGORITHM` (`sha1`, `sha256` or `sha384`),
diff --git a/.changeset/mcp-upstream-header.md b/.changeset/mcp-upstream-header.md
index e3708621..7a182cd7 100644
--- a/.changeset/mcp-upstream-header.md
+++ b/.changeset/mcp-upstream-header.md
@@ -5,3 +5,6 @@
 
 Add an `extraHeaders` client option so trusted relays such as the hosted MCP service can send a
 fixed header (`Transloadit-Mcp-Upstream`) with every API request next to a forwarded bearer token.
+
+`listTemplates()` also accepts `fields`, for API2 columns such as `account_id` that the default
+Template list omits.
diff --git a/packages/mcp-server/.codex-plugin/plugin.json b/packages/mcp-server/.codex-plugin/plugin.json
index a10565dd..0fa40d7d 100644
--- a/packages/mcp-server/.codex-plugin/plugin.json
+++ b/packages/mcp-server/.codex-plugin/plugin.json
@@ -29,7 +29,7 @@
   "interface": {
     "displayName": "Transloadit",
     "shortDescription": "Encode, resize, transcribe and convert files in the chat.",
-    "longDescription": "Drop a file in the chat and let Transloadit process it: HLS and MP4 encoding, image resizing and optimization, background removal, transcription and subtitles, document conversion and thumbnails. Results come back as previews with download links, and any run can be saved as a reusable Template. Browsing Robots and linting Assembly Instructions works without an account; processing connects to your Transloadit Workspace through OAuth. Agent Skills for these workflows are published at https://transloadit.com/.well-known/skills/index.json (source: https://github.com/transloadit/skills).",
+    "longDescription": "Drop a file in the chat and let Transloadit process it: HLS and MP4 encoding, image resizing and optimization, background removal, transcription and subtitles, document conversion and thumbnails. Results come back as previews with download links, and any run can be saved as a reusable Template. Connecting signs you in to your Transloadit Workspace through OAuth (a free Community plan is available); every tool, including Robot browsing and linting, runs on that connection. Agent Skills for these workflows are published at https://transloadit.com/.well-known/skills/index.json (source: https://github.com/transloadit/skills).",
     "developerName": "Transloadit",
     "category": "Productivity",
     "capabilities": ["Read", "Write"],
diff --git a/packages/mcp-server/README.md b/packages/mcp-server/README.md
index 08b768ca..ad05deb4 100644
--- a/packages/mcp-server/README.md
+++ b/packages/mcp-server/README.md
@@ -14,9 +14,9 @@ Add it to your MCP client by URL. The client discovers API2 as the OAuth authori
 opens a browser consent page in the Transloadit Console, and keeps a short-lived token plus refresh
 token for you. No API keys leave your Workspace.
 
-Browsing Robots (`transloadit_list_robots`, `transloadit_get_robot_help`) and linting Assembly
-Instructions work before you sign in; creating Assemblies and listing Templates ask you to connect
-your Workspace first.
+The hosted endpoint asks you to sign in before any tool runs, Robot docs and linting included,
+because MCP clients only start OAuth when the endpoint challenges them. Robot docs and linting ask
+for no scopes. To use them without an account, run the server yourself (see Self-hosted).
 
 ### Claude Code
 
diff --git a/packages/mcp-server/assets/icon.png b/packages/mcp-server/assets/icon.png
new file mode 100644
index 0000000000000000000000000000000000000000..d7f2ae80008f982bf81bf01638bedd85ca434fe9
GIT binary patch
literal 17066
zcmeIaWmHvN*af;N0TDqE5ReiCq#NmwlJ4$qq@_VXL`nptOS-#L5Tv`iySvX_yx;hK
z-v4)u`wh=H9QRp!ueH}+F`qf-bAsh%#nGP<JcS?#{iB44A_T#MkMI!6;~x)#4@Kb5
z6GJI+5eWA9FRdvj3W7+Xk0L_KpOg0IUG-%yVFE`UcD5T$({IW-nT-Np4WnRr9I7b4
zW7kyC%%C6trCM+mJu;Esq_(I2f>!L!x2|7JoBj3VEdrj+{P#GK6^BiSo2wCntz4Vy
z^<0Ce{D*I=U2GUZ{U;Iu450b|Kk!ES5*+ZAM*$y&$-o;*;Qt-`|9gihrlUbizvAO9
zVrBPds%)26_YYRq^i54I4Hy{dX-f(V-6JDo;*u^%H@f$8xAOBX(`k{G5~pUWnuge+
z(!r@IbNR)kGV&)+TuwQon^%Q$RP!2%-CSXjrKP88mX?;+d6<HqP@o}BQ`78G%J3u}
z$8sHV!u)?58#vZ;H<uUlLBpgF7AYiHa<)HjbpCx%Cz&WdiGqjfuop)lmDe%2C?Bef
z^2^Kef2^++)Hi;DB;eUJG}4x|oY%Kro{n%^+rXvQ>@Ah0Sf)tqiz|!<o%wmKiUqmY
zSdTZpYsm3Bqwqevbv!*mo93hU{ng4OKjdc1AZr$3ZFGOYh!s3jY3*{+#leY3H8J=s
z4IL9on<bdmBw45$o{uT;s0>Ox9p+0kKchl07eIuzn2g9X5N0Pm-0JP!aWFVH`FtJ>
zjm^8ZRiLXNS^Xh{MTT1^`4)X*hP5qyJ4;K4^&1=FVx(5WN=Q)68EuQnaYucDfz#tA
z0D@IF>OA*F2A%WqtKxP9EnY~6;X*MrZivs#1zO&iZw)Q{Cv-T7+hT2~xj)hE*mL+-
zzt>mvXUo^Wp*bPQ_aIV&;?zv$#o9=!H*d_KDKeA;+U`;BVmUcB`{9SwEyuaA9JGZF
z8lA#S{shJCd|6nR$X66p$ZS~lp5ncHE4;7=(h5E17BVOkXUd<_HqcvTH`kT8nr8;x
z2|~W%+e6h^LvO!vS6jVxLWSra4;>#n;MF5W*5n+qLrg&sMAZJN0#CKJ4n+?Ea(ukD
zLtQ*LrLTWoI2LM!2UmWjgpHjpg&80J^nZ)se3wj@8v0HE#eD!*e8=z(ryj8=7tWXK
zu^m5096)KD*l1K8cnA&Lk`dNV#Xtt3GhSxVEi6dg7u1RE42uMn9PovLGa+0se*XRC
zlT${SLDovo^}OKy*a{C#eE|hCRIQ5VYRUEC)ZW+@j1$12LHcO$kkerEhaAMln+1O=
zq(*Ki<gwovbn7Bx^{BhDPSL(I=rz3U%7Rk|w>O`mm{)T!#n_cqW4)N8oQGJ)2JQZx
zDBce&hVx~?#$Ihu3+LwHSU&wd&E-bq|5Zgr<<w09I!Hr;xby1kP0txyPCbVYCv4m1
zNzPC~)#J_WIqd^_>-!FP42x5)S8R5%2upCfaDLA#$}4NJs%QH<f_KqOOxK$yeY6#r
ze?jm~UvQzV(w`&c7#p75=QBw--+Q`Q@m3BnZjj-i`hB6ZsK}^|Xf^8h+&(5I<Fyv4
zyq;&#8K(#+C}8v)9^A(%L~Z_xE^iSwv;R0fbX@VqZqe+%51N7CpqnM|HL=&f`8vGz
z6)qAH0aW7mFLs;#h*_DcoG|O3K)BH{YOi?-OpT4Fnr);I5D+MH@>OUiZD#nb{-{k|
zA)OJzLuWx^8FenJ2M_Hz{e99}HRhC&-z<`r*W!=5S#eXiJv1`%R)0%C`(O|9Qc~5m
z=jZ)ht%^U^#5!&i>vh{(uCiOZB?}D+Zy`YUB6fq&-o<kfA+R-JK81rIL25+sF&z`U
z1qlCt`e0d=l}EZ2^qDhntaWB&q^GBCrf1{^_AuJlr_8|08rv%)Bhx1>Q%KhjK1fST
z)Ag-$O#H&#a3H`_%vXLYY9b?Jqv9MUtdOUi*V98gM&qpECMsiNW1->p__6@+qTqwZ
zfB*exq4D4GK(P#id&cLjM0rC<&^HRKkK|grV$~Bed;0{O<yBV3qnY*@Vqw+<)9PAU
zS~KcenpzqOy(V`rji_TZH8h8Ksw)e5ThemVN^47VDHvPQ(sDCPOKa0|-!mTiz#58+
z!{@)inSVfoJ{uYu?yamXZRsEGnIG;={p}uZ4sO!H_Tb^sN))T+c=AM~F-$pMxy}tK
zUZW07h3UF$d<`zHx@(Q;I*n;JaJ)(~YX}Km0~2axv7$wDRWoztG~>h*7Y~9h>?XfX
zm{Qkzs*|8vP*BjzNZr%d;}#j2{3|8?SIYT`04qzmm8Df+@$)lmc*vZE>BoC6HhWiR
z2UkZISLcgQjxLViv-9u!2gHTk;$j9WPM8XDqr{-Jgrt<@M_L*NoO-q)Hx$Sm)3L5^
zwznz1CMY7dp(Zx5BqArVASyCFeaJboAh(u{nTwt59Xs>2sG@_Wu!E+gCAaPyxVI?K
zX9RGUxXlX-y0-nEyk3oSUcB?KiS_~+o-PO#O*D3ONlJbU36XQZp<`y?XXYnEDv3xV
zMu9LtW<6O*IRK}4Cc0PI%s0kI<TMmS4T-{`DbqNMsmgi^J2+X-RcwAdMtwJkt;D2?
zqbmgc=xWnmD3%FPrBA4~J{T>plVc^3YwRNn5LUpy<b6kZq2Xk$?X)*~6<{1AN$;dU
z`U(+xq07Ho11fM7Zvp!XzwQAR>Wg-UbZ^NR8m@IwPzTt&c`gly_({>>1qFgT3`rO-
zpWA3vpIS}-DKY8Al{pT@I8;v04Gj(p2@h*<zFeNaWkw3@5LQE+6Na`h5D<bRV#PPZ
zy@lp^Tn|TvCpsm!z6;i5HFq^SGTxZ1lJb+`JI0-3zzf#k6XI8$S`Ak@-ZDJwbKlm)
z^!5c5qns((>i#Kez&M->X?ELOUaj3kLAdvYhWHH2YO_k@O45q|96E20HHVdzMGoP>
zX`G;i6pPK(Iow~Y@7A20pan7@Z+(Eap2hdkl}h~^()DZdujk@2ROUAi9K(yBw4LK3
zA+~?J;v$2-@p|hOqHnd;Xt_q}(g7&uY(1Iq17}na4=l~%3w1slZB+o9oS=OVU_d57
zgiFf;4+kB8$m8#lyqz3px)ofSV8*Zr-#5M&F2{f4kM@#y(|i4HNTEu!gWEK@73`l8
zK|0)?ch-tMXz5mdoPv-!5*}4huu;%+lBs`amtI5S3K+!uGp=`2+h{Q{D#DZSFn<X1
zr^p-By&VCQyCb-CzAQzA^j^3nRky&Et?pBvi`T(!chXy$f)v6KN>*9&er=?Gw)Crm
zjV~sXzVC<2?0GJU`5acX1Ai-SX@2_(EhXyFE?!q;KiiremH&<&?`OV_^PR{e-1@=F
zPS&=0s0yr{t*Kxjr1oE@smZIQqrnZmVXvw}4iC6LNwr~QDGw+Pe2)V0Uwy7)ytbbB
z0oN4BfG8;SP9?tyS<V}FYT8G(gbnYjrTPn3k3NOfVvnhB8UAz5$<vNYE6)46-89WG
zmAq?xeamf9Cv<nKsk9&Wv)=o-Lqcy}py{CbK4;=!*&!OEr+9y4&=;j$$nuvD5u%co
z4)wYA?miK9G*(Z+_WezH;e!3|S<EX5+j*~VCgNOykbY`x&~Ep=))x<_7xkEs&f7?d
zdSoZ_@!#8ZM<`i}Z=JZ@(HOHeHfG0m$NY-Gw0dmy<~ar`ca;xXHOI<xcwZTrCcXjU
z>w@5><e@-lE7--G9%KI|A}=p^C~%9a5#BH?CadGvtA&Tng3gHya?b*bn37!twn1zF
zg9t`CQftC`2>->&C!G4H5FcBv-BGC!nXp=V5EF(k(L#zXCnIs&7hC9ccUO-E$$RxI
zMKqmnx<Y8aMC4!3I_61yc?QB|>RsAKX?iiCy)FDH4FFiqv=39}0~mxBNg;Jo+z_us
zcT^oD-xRCxRF-NoNPTHd-_C#m@3Fqgv40=7u+GroeUbVT3}^75%_O2keH$DXP;6+d
zSLg9!sp@nWof1~6k7sUtw;_VNTKZ0}tN}XDuc4q~=q-f#r@uo1T;(aa%9SGgQ9C+4
z^k3<ffb(eR3Y-)~&p`&oSsGi}n3~c!;Xop-?YIq?kn}XCEd@Y%nda6(B%J>hu{NW9
zJWyKB#>v5gRsZzf57N&^)r26=7a<)kVb%e~!ak%>oN(exU%88mt6(G0^mmQ$@JmsA
z#C22tkp9yWU+5}8oB<b9*f#kBlmdk?K%r*{NK4qnb?O123>?%-^{hev1-$PIY-}UP
zI_WJM2*q&m6+JXT3cdQ{iwLDG<6r`i7OJkLfdW9GMqv>h0ED3GS7ntV5OgHTz#1iq
z4q7Akc&MBW092^_TZbW<W8IL-7Ahh{u4)bk9X%ItwHAVyzA(OlV083DC#J}tO3xQ?
zS7yO#C3KJ9@I%l;`g%VuIOFOK{1FDdT{XBO03$~j|8uUPh2OF{<k?=J_V~pg5hmyX
zv`q`NE$!XYR)M>@G9)-b5>pCz6nMB+a2c=cY)bVgL|>o(Q1N3^yjWP3(xo8M$i8QA
zt<S;#K|C(hWqdVk1X{x%|15$Gf)_;drAL8oj_46F16~j6f~F0bnVP-<&w_%5gQM*V
zO_dbdipoHONHJNJoDfPOQ0EN*NMBO<AHQL3rzVB`^q&#aVnS!jv?!!6&k!o$K^cN{
zNcfK&32mk@URryf^tsDRd0E?s)6B8VwaUM1mE{hifx-%^y6N)D;}a9#-(rFO3)D6R
zqa-T6zV5x7M?L#F*mIpbTc63QsH(oD$azbdMM;^nzJ>$fCk<`E%kMoWPXi?=es=d6
zn`VQM55Svh4plI5WSV#zd3Da6m!&IPH2k16xzr6fWwpt<Iy^7>6Wg_Y<iQlGrp6q3
zL+Tj!+6JeCt;vi6AAL1gr%Sc=*vEvcfHkW~S8`i1(SMx)8jrmHV8k=aLGR_^bc(UJ
zvsf>x6f7b~aBmJ*3T`u%xKDhryI;U_WiIgOTP|`LSo)-8vy}5vsIqzGq^~_-_K^~6
zvttEj5x$ZBA7-zsjPukL$7o{k7{yai8b05fD(iZawO6dK<LTBDxNTczN>G$nmv0dd
z*$XbF_}@H9-1&Tq(=Mn%_DHfgq1RhZPE;X$@OY|&L<Fi*BR|*^aNyp%!-<jX->&j(
zoD0HuPQ>YuR!~8ngExY3jM{x05wOqqnWd%l+bCLm+^e9Ar%5c{pCfFO{~9vqOs;gr
zF5Xp|+<K=MJffDH=Z80PM;<x>#a|M>w5{~}>`z}@E{~Ku@RwNWlWtGmHVtmbTw1O7
zZaO=E5zF9mqx77&n>9-9JoU5y0V>!hLW#JBx`uviO0k~pN5C{LXI&nz?0zCFkJ;HN
zCLAj$<ZUpVpjYFv#cT{tb!)y25qVRk>3DM&lY&5bMsh9mx5$H6PshrFEdi{Q^%wYj
z`>TvsEuh%%=*m#JX7zFIG}ui)Pkw>b6{9Z)Il0cw_NXRkx^!q*AVazk7#AfidW+e;
zzU;fzLtFDElK_v98JUGA@lr8!$xKNix?ZfX!_o|t%ox2>;@()ly+#tHRkgF8^%_d?
zr`p}w382sRla_H>&5`RR0|T66*w5_8>GBJm+t7tt6Ezw141Qe~oo1H;t<+&D)xx5}
zLacgRIOEMVndGL=ZD&aDEbxUVPXyeq104nQnDxibat5&ii`VCe;PsKftfRMs%QQ2M
zNWAC<(G&QDrqfGEt&+c3vyZmN!*RDGlWw&fA(^Gy;uhpHxJ=c?fU47*I3ND~fJ?t^
za<QZ&KOeXL*G(Ey>r*hFDK+nKcwM*M<zdI0?c@OrYeb48EMju;HO3t?npt26e;=!-
z&bD)32X1ie#3e#8YX;oHkT0tJ@kh`|uu}auh+SOZ3zT=*TWpiBmd!feng~yhkUBd%
zx7f{2+Feyvo=Jl?$%E(Omu^%tUrX*ph92`Hnt;W+XBm4FRNDW)x8{iyogBppZW(mF
zIU7N`Rr<zqMo!ZcnUUT}A#lM0pKGtFD~&!g=VR&g+$3hZ?JsW^tqg9Zc}QBEz>dmq
zbNe*Ax$E`&oAzAfhyaFw?B6RRWuqI1{GYV9gr_o9tv2XyF8-bSY-v-plp7634o7XO
zQqu%7tidt@BlPM~-~^*Y-VEp0u>v5I{vpSFJQs^#%(DNkqk!YCSqWT1K}n0p=3<2p
zSq?=9MQPGb3?2Vc!9W4**mn`teBRq20+i7_zYl5j^68q2*DfJxji|4$xAUGVHSW;V
z!T<5VVX}_XPSwZnd{90VSh@-@2V6$>sMe2gwEyYLsEae9d7rD#ePh>O29FFU4`(lm
zZnino3(`tJgx(kJR&&7rvL2IzPfi-2*G0_RPnFlqd>lLOKo}Y_E+oPr1yeR7r*Hhk
zAn>g4*5-Dj<>GO!TUMENHfFgVbbw~xf@j<*n_M#V<pIJ*ga}Jtv&qaH-S-Z36W%}Y
zhJW?A`CNBfbz-x#y1csmNU<4^#m2`cBqUI)&;<U@uPkg#OWSfYlmt<Sw&#lf7L{bo
z_j7_@C7PT1cAQT7Bol*u$>65tTJ8?cu4%QC=0@7)TD%fX`H2D8*Cj3nNR1^vJ|?S9
zg2KJdNDf4fh7OwGC9G&Ub}z2oh~s&+wH>gH_WWRm+L|P;Y=Z5NGl42XR$hF>W|347
zB3)Xe@C$D1or+Cs*>PrO<^vL}u^h9S%X()^L%Yc%1X|hx0MkC7cP3}#Fo1bgrv9@m
zayW9n#d*Jwb#Y|8<?dniMqrB1Y<8kQ=-JjhSiKWf`_Z2f%vhEb6oA;M-kWvjtgaXI
zv~i7`$z84xOyd?kgeo&1gq{|+3-GvUB$yBz2$Jqjw&&q-nH(R=Kl~dkcdiBqZjpr3
zdaIQmgvykg3I*(w<c9}*o;xB_qSY=0rB=q+_O>mu*32%~GeyHn8)fV(qdg;rZCig<
z#nEjS`a+iT6!naW-xE|@Ei&V-y0u62QibF9Oibs}l*rds?U9X*pFe^3%^o1SA0VEl
z92<u%_;^07*lBR7fOsdhFNFYWE_psoXoR(b6IN$-n?hblCp^iMJL^ZZTjja?bFT3V
zAW+IqCORfMEpKj(_!Bt7=ZU<mVtR~n815<`BG$&7Hq2Pr*--_+?Y|rS^jkbnaoWQf
zcWvYb5l&D^KQ^4|!Va)_V37Usr)1VE=xy)6{udMCf#htGmCp$X*z=A_f#e3K<m)_D
zx_ANC4dac?<!@pc_{<j1Ph*ImWsO9bNo&7%t;aV@OrcfDrw7CP+L`vWS$i>CcbUo+
zwW=Yr$U|I*gqH4oDE#k_mekTPw<1L@u!g@{xJS<#33SX6*L~l$J+DWBRmaV9aBnq#
zAmHudP-*r#Uq#>nmx%D6q>A>`(JjM<D-bZMCkGDhEswPi4j$e_cFEHuvl@-;O9kBq
zAu{uhgJ8B-wa6%gn)_MStM;~+@V=Dk&7O%5Q|+I^#Ke(rqmZi^G~S2Qj7x*^qPp+j
z=jt(1QYqvsqcz{j^57|Vb@ga89LrIfVTN=7c9Y9_31eX)_dVCl;lt`?|E?;_9l_q5
z$Js)=dUgJ9k=!6AuP;zqxBNFoJyX?#LD+RjH@-WvbAz{w9(a1zF=K+b8z)4Glb)yR
zjbAYg-E=@Ke1I@hTiCWz;%&@=(>~F;)3w;*b>E>)N%EY}=qtv1597qd5bS+cbGC%R
z*do;eBox!iN1}4bnEEg2)>~R1(~||4v(g6-n5LPLO}F7kbSm7CO|P?ufkhufmLSKD
z9dymAH(?SK^`83^(;<`QBny8R4*oXN3;BIHH@m4iY5L?TzKh#$o=UcHT%mItUaqc)
zU@>l}&HWTCm1C{Go3y$O_M2nVpJsvvA3m*YIMZe+HupZnK9C9B)|ABd_H7aAYAasc
z4<=622M23rot&;0Sdbj7u6r+Eg#(s??w5$a4tXNzX{YV6@C$s^`!hn=t=uaD0Ky+v
zw7<8pcIVtT{^8j&1a+3vIhrh?Cr!4=7q++KaR=eD4VNU7DKZQguTe9a;0rSR?}z6T
zK^#)5g~bQpT#)PizZNe-_aMC3Xq)-wi20uj!LT5vdw(eHW6$C3zpmL!ixPTPQa1Dc
z?;U#+?edqt&l9~h$RdZXZ$NyxSpAd>=@6$%v%;X4!Tld#q=;uLg0GjTalvA^cW;$k
zlSA0l4hYx5(-b&!I6yF`1#ikOIVV<+@{}4iO!z!(B0qTGEn0w>(<IeL`fw`wHXMiv
zrCJ#1U|*(un=|}=NS<c?bd#He(Y2b^um{Xa*v0vossCexZxbgw6oydyk|yTyoRCt9
z<jdq%OSD^LRt2TdP6ar;#cxf}CN~D%TkPz(E3U09EgxIr&ZlgXd3)7zb~=5B@z;`6
z&NUWYfFZ|q&(3GBxVYG$CdC~DL5~BZb@lcin0>>E$F<8jC2^rgs|o6K3rDMJ(W=QF
zCbtLV>{WDhEJCyWJQ#+=0vY!D0M>2v#r<{Xqa&DWxvcz1Zt*%!Pu_`l@6GOcV^}%}
ziQa+DuhAJ^O>HuXU);=Q*}z};$vL`d6R`_>d6jO3!;3HkDal?2?dCu3eCRbWiC1A6
z(lRm=_odOgo5-onIyZR$c7`Ef5c9OVGu!#&LXI;JqGOtkUe~gzEsCnTLg&=+eb(dU
za&@^u&H&q9Zcm4G`UQobxRzYUCM0OOe{jI-hYfXf`<=V1n^{_xJ8XLrAnQhi_VjF6
z%t|0Wa{dXQ36Y$ZsFSJs2RCJ0%}3(S4d0*KPoi0z<!RS?X5`jJhqy0n?{!#ZnXD^E
zoLo31vU|bfoqsa;1Y0<C&f(>g$rygk=j<2at{bEv*hdDLub91*_cnMD_O{cykUmF_
zxL=g-_3_CkBKAU(@eIqDo+vX0dxb%s;n`q=<;LxLb~oqkHVw9L?k=@n=^B3N{Qxj*
zQa3iozwxkDtHkqpy~*kQ=wR?C3Bx>81-->3D#UOHaQVfe3t8^bi6Ns$Lh0IL?aAT$
znywgIg6Fya><6dkaSm({Qzwd%!M1cfdKX&j7O_L-5I>C^C2p_qEQfb430d*5yxD%2
zAJ+SW@0+)<(RK}3hsQbyCvr&SGVGPtl93D5PPm08R!3MtA3ghw-(|n5`f~iklgq=7
z0}jQ;co8q3KO^NQQ#r@lFO?!tc3{*1j%R#T^!}HH{so?A^wsm1_E9I|A_&}m@nCrU
zZRhn3EldJ@mvRIFpC^RZaYRa8${H5F3npD1bvE&f$mm1c`<up`j66Er5b<Z}cN;sM
z^gZ-y1eHE)MHlT<64)4M1;e#fT-;NmpDhaBQebrt`FZ6McMLXd;ABbSh<d@IhTCr(
z6`l#0zfAr4>rcDBe6R>DF6WrV<5T{8lU8=B_9=pa`(AyF>f1?xui0Q!UGAEV;wVdQ
zv5UU3`BX-MfcW`QT6_dmSRESgUBlLynvT>Gc4lx8uAt)6^}tT}2A8$pSPLM+6L((!
zeb%>^K=3dTAR!@{<t`EAQsiVSKhffJC|suzFK89dEBV)Ot~svlvEluL0Tev~!u7Wg
zn{SnrqMq+-DsYQr3}<F$IVunC{#4YJ=c6bMvCS!$px9XmbU^#Mz?~PpgoF7wK5K2g
z^T!j|zVo$)?OQvWUmVU>+KhhLA>-w>ZvH88ujyTs=%|32I#ZQ?rzVlP;GG3{i@3+`
zn$&9!Ews)r(6L;;Ibr+kQLD&D5r3n^Wz(G(twrd5bhxs;Ea{w}tH`nmqyC@e>SLQd
z2^2=8YH_%psnVFY$RH*8j<NTHmOX0Kcu=My0;k%(PGo~$=ri=Z3xvvV<yimg1&EDy
zXcjF+^nyZ{L4WPyLSgggm2TUxua1uCy!*Mr=}W(Vaw<~i_QSbY8<voq#>{Cazq@x6
zHNk0;p(Bu$x~QFad`jS6X>yT$>$E#X-|}XZkr;>~`DhI*q7%B$(pr+CeP3h<6H`)A
z=~rN81kA-_@BG!SfoP}&#(RwG`6iCu)`dER9#6xk&9IC{_`C!nV{D=VU%)Qk$}no*
zYkr}}3RD$++<$gc!@iXl0R4cUjEgVI;qqJn|CIz-d#H)pw9o{z6qS-4Nv{MXfr8;~
z>f$NP5{CZlAy|wlR%x;88&)w%n?xFh9Tn0aXDX(!s;^^Xc;TjCF+Es`=>oVZ2_xdl
ztVIt^?+}hmXjKf|C1(LCUooHh-t8Tu2kSSHH-L}^L4`SWp@8K1VcRbdg?a_a2I|zF
z3|_BIsN$wKxj!R(DQtws5tDFI6S9lrSoeTW0SCZHabl{&PRa8tPwbPC_Bbj%&kBy6
zKN*ugyW16iK~Okpw{ZPuO+n9_Luz3Oc^NE#S>I=5Dwe6tB<OGx;}hiFD-;yE^<aOc
z0Ofi(X*<(=D^a9)U9w2S@NU*;?d*X(hsXKob~!O{KUcag?O67wScV@K;2oc*lFG~>
zLt$#m(Rg`gkF+m>n9o&b1B|vxavcN|U!N!b{IxLj(Pn+dHRGBpzr-mwoWPKpmdABy
z3j;`xu$y^U>cK+9w!n(NSCAa%U7yo~POdAV{1;jM4X{Mn->+vJAJpdN282j1m|yy>
zj&3qoER~yspz>bK^G8(T;tv6BW$9}>gMs6)jnuW5$n7t2aU7Mqcgr15+%eo>!%<Ic
ze#k3n-5#6i9ddpC?MKC!d9}~N!nWq#D+U12f72mK-n?;Q$>8K(%JuLcopyb~2pN!g
zqD&bIVP$7;39RUkrs01mX-^cTmBt0VQ+N}ZtD2X@=4gPRbP*FMrM74_wKJg{OSyJ)
ztQQchZ{7Mh#pFnUT9r%O*1qNuDUmsB&aYRUO;&T_QwKXbzL*zZxc+C32!#!P=OCDr
zlwCF|s&8>2a>u+6*iisv3qXwz$@4QHJ{Ij5%N9I6iuj`T-wuN1c(-0rRaRbBo#`ZD
zC`o`pxJC@Nm<xtb0lT}?<c4j2Iq7tFO*_ViiPp5Th0Y4Z0kuxxchJ0?<#7MUAMWA(
zW>4|nhce|x@6YULvMwKbkU?7C<ID`Q*wQ5)J78B)8IMTeUCoVCdrr*v;dTmeGe^5M
zJ1|xd<7B#P672pP79)oa=0Y}p|MYp<;!=_J!`rO=kI~^3XV!7VO1l@0(L0pKM|V5~
zx4!@Jy1Db*bPfmxY}F#LoYUCi$<qcPr2*z5TGrguv}g0p6dSy6kPPi$kT?_9o#xv7
zO{`6=ed3AUpO9PSPFm9cF2#fzXo)6BfhGFMv*hE)Uj5p8)%(K_#Yz}Vb{J~>sfZSc
zf|8nI?xq}g9gS^A^h(aoGCQ-JsktgNK$%H*mnELa7Nufxyh5~CNk<a2NEwiN5vice
zvrC=M-L)oTMxDFqDwpE+uXk(mxN-hFuvxGXyv`Za-S{1+wgXcpbopBI(5qXIbv=-h
z=)=syW<A`OXz=kc;D5Vr!_3!5E1x_ML`T>LcwG776j*tAg<p=u@@oc9=;>(cJokzC
z5KGY3yjq+IZfy?)u)r!-BCnae5;m4lQ+)R6Xi6jBY}Jg=_;E_X31VZ&kpPBu|Bjjy
z{yEcDrdJLi44(}y9bF9jiOVJD)T0DQe6#t1(4e@m%6VaNCos8Ykj%I06I&BDLq|_5
zK%%Qx(@%I@fzF}{{r7NFFC+MJ1r`>XNU%ZFBgzZ{ocZzKoe5vqNi}*48$o|64~8ON
zVni%YY80gVyX-@~1jS6fk-%<D<4Skozj1jQuUT8+h6|#M;oZ^XSW|plf1}5C3M}%u
z3rMus&irv9gPE9E4A&WHQJQVd(jJAic<=132V^Sen`Im`4I}}9uz+>lruTw`KRG$-
zpD5p(Na{2CR7(VB^sS@L`2b+50TN8m&NR?d?q{n^73B~<=9a{v!9W}ooXV(&2Xg_;
zd@ix`&729rXdZ$2Rhs<FKOp)xEmmUM>*x?Qxk>xqod4E&hK+EGq{Nq*U46m1!#Voo
zDeA$1@yD?j{vQ^uc6~_RrzDEkd2ms@ADWu_=E95~<OcnR%r<+eVhElQUTu&JxPuT0
z#6ugui6bT0Eav1fI4x(}n^_JsF6rs}^kC=y{|4ATp;q`jQV4v4zPP>;6a;*Q0$~{s
zGj2@5H^O-61|}BA$Dtq3!p~2f2w4r6c3X6H)34lC_1I+JyQ>Sh$H)i%&+>MBu};XE
zG|;qhQl(|asB6^pDpJCjI_BZ1f0ONIF~QxVFNJ^kT#u2q<m%@3oQ(z_)YJYPbq1Jw
zCfZ_8nEoZqXdZlV8wkR-c-F+p^y9A9aG0>B2zHPo!$u4%Dxz~oa?Wyp$rp#*`nbn^
zzC8gV=Jx5Y@X;H3jbqmF<yrKXSabKiNF)l}e@EIp2T254>`VTUcrPTy>PcjTDtvHr
zA2B}O!7C9-;r9tVHxzjjDQ#MPSmJDFtv_xwy-9Mp_u}ZLM8F*jHn|vmyC(W(7)VQ<
zVxEn#7eID;0${$U_jP9kfyioZ<yoJoUXejlTr7X$tx)?c+;bTMlG%poU75k0Wi`78
zA+Mtd35pY|_1W?|j4*_07I$?RC;$7F(K}IE)^Z2+5-_dY-0GA0uYy9NK74p6Rj1Rv
z+wKEQaN~m(SYcQ<=(B1{m#!lHEnbUaeDz}qlKVl)-{Pr66`pxxd^xi4A?Nw)b<3wC
zeR)P0)_Snc*&ABJvd>pbLj?vNGtCywwm>x~MA92h{Cn2PgO~a`fsL4}k}(V+M5@Qs
z>jp=Bw;Cwdj@xU+FFxE%EQ+tMZ@ZXpc6OxpeO^6e(5_BcApLRxM>JDo^Kn(s9TV!q
zkJIGXa)Wy?=^QKLm{7gb?wy*-Eo{7Vd6^8R|3d93Pi`VuYYNrgVg>Wg>txHmUfx(y
z)=`RziMbtgYjdgQApaWhaB}}MUg=-=0^7SvK<n*Q%9%gAe;F)7Y&&43=JoE1&^LR5
zc=mx`TTM;;y!9+}ucs$}iCCvLSJKp!yH>B{$I<~-Fa<4@+;POD?^i{O2-^p=4QZ{*
z_K_OrS9evrnENqVJ~~Zv$p;V|0kJ^XW^P8vYeTEa3*pJMsNcoJs|HQ&KvoX9tAB32
zgc}MQnHsp58{R)CwoBP=|FyG|fQPS9cO5A9^=tU^Frvh%$<Yr5s#e(pnj*J0SDmTN
zDNG41YUt;mVHu)117AmZE*jR+Oq=r5l0*r@D5*FF$Z2!3Ri|qs!@x7Wr)5jx_c7Ti
z6g|_V+P~BMnmQ+1qsV<h%*}4L%;~AC082v`#U3>Jv2Sfd8HO);IMsO925dk>yXH3U
zfoTc!gr5$#%fZ&>%9{M(d<y_xk0iq4eKJvEXf`{`ceF=O*+p4z%kBA)eNXS6{F_J#
z;CKMo25oPoEIz{Q-WB#3>bKnB1&g5Zr-&U2&LG;s@4$g^d`@TC85ww*trge1O_UgY
z^2TXuY)zT}g0e7Gvnamh^LRMl;R4}_%`e834<(l|Xf|4$B+LP_a$tEFF=wm5^Q`i^
zG;opnz3KV+@7BB1Ep}$nHwwU?coWq4&-UZtU)W&U15m`2b&Hp-zk{`|`OX@5zkPIs
z6*)BFfr7!W<7aMuetrtm{pdV$_$dDeU!U1XC%f9$*S6R2Gk*$It@yQW+GoOi%C)dm
zZl9;7u&q|yTn6L?`S}_5_lVvN_R`Z9fGY!cm7tOv(jpuwR&cf)@qE1~>rBw*2F@A&
z&BNmD_M%U`gtROgKF507I$`A?X$-;L**@M(H6#e6sliR3uC-^2CG)%%on|2F1w_;*
zni%(voiImS?+nEzXRa;Ro1=T?q6AKpviv7lYi9C;q>wp{8p_c+D_ET>Et#Wu^qrjn
zOTIXucSkSo_;+Drsf?8mS=M;!A&%KOsniIzXiB--);6FAq$Gzvqk$Tyha3<arnl!5
zFE;vj3TCVA5lquPI8lbEuxsPP`!a(^0|3Pr?HVQI7JQ{nCf@GF+lbrC*WPbJPcF3B
zG6BiYYO)}nN(Z#O_@sZmqx({RwrqzKF$9HrO-TlWB8ojB{2wS8HOhVkA!}txR+-#B
zv^E=&bn+TF5SOXn^<GMC%P1N!&}zk{3VD5TgV^fc^Dt@q$5yu%Kg1S`jHu_Vr_#{8
z1UwC&JJ#awc+M~+al+q~g?E#S)q`;@q1Pjsonm6huC`A06AOp=AEG+J-VTg=tX#oj
zO0I{?t6)Q!no+;L`E1WToCn4%7$DIRxJ2&>vXyD@Q*1h;%j~olgGsC=Yyg(P-PyT;
zJB7@j9@%+pFeO)EX+$O^EI76zsuJV8#p?F`k%r_ba0GO-J8MQ9+!*WWYP;R=dz1A&
zr_myfx~=xh_-c<@RW&uv<MzR+goL%_jYj=}N`>|trFq;l8#V%&slWoONf`cZ^hsNR
z-B@|uV8<$tjC8057omz|OixFR2mR_Z^4B2du%Zpgd?l-TZkYxs?SZ70&<^Yyj&lOm
zM%dM`|Gu>a2MW+b!n72S!&A8IH?a1}-j)!)nsEfGqIGhZ60qSMo|6o&bTR^x|HG3r
zVje?%z-?B_{rnN_el`|(A0(HPWmc{dr)}!;)*2(#kqq{hpR7*mP(fHn#}3HB4bI#0
zz(NFvcC`_NPUyYZeZZBa=nw2aO_N1RKy<v*yzW`3>i;I0B`Yl(R_o08hGnO7|MqQ`
z$=<|h+a%B4P^xf~N%k_3jlcsio?1TURx|rYJkQ-U*)P!Ak{p$B&ja)H78*{zWuCN~
zYr=JlU2rEnXJY!XH+47aJ4EUtC)FL!Cyq;Zt=kHJh5+x|tkTP$e7`ILhn8DVkXU2B
z4n)4XhJdJyrkb3FkSPDGKy8ND_*aB^;|V8EMS+;%?Y#_C>aoga2MNo-ySo`~yJ}8G
zexTig&%SZ*#$FX&Gh#zp*Vp&2cYb!Xf2K!~lGTd~Egg92<duK@ilL&&dP|v8mh!jc
zTgM9E?oyfDQN%ax(ttnFp|X@i0m$U%doMn%9WDkG3FRruT<QPGDu`_R^#_U2s<%SC
zdUzI1=##i?QsQ;DgF9NXWnC7UnGeS$f`OHM-q?bT|MZT*8~m?+Bd(_d2r1&DEdzjo
zY_@O~*S%QUh^o_e(Z78{)byy9g8i^qokeepW{T6ONBz$sAkeo4n#||!HT(?H&ho}B
zF<fIg=(pwiO#&k$m%sf<XO>IJGXJ9}PzZDmN2kFJpoRbmE>f0gruIFLZtd&z;h|L1
zER~JHgp>Vpxk>}d3%Om`x2)!1w#Mghtr9{8$C+hpc-zLn<F*W_9zc`udZbV|(MtoK
zKV|OH<J2_Tb#7d^NQ=X2dDn5HO{FT~K^SdDkPf#*`=<N%HHl^We2cIG*X3zU9~HAN
zN{R2Q@9sy`47#)jbzmp+vA(jM$&3`nYm)%6x}$i_cuQ}bEj}h7oMuZ-T+y>fOo6xg
zu*I9ltdk-g?Yg8LXgd5|-_-$EqK1b>*B8Cy1FR%ufBXQ%(F?9E3W-R{_<AwhbZ)kA
zp|Kj)P;lDX{3o*J5bx#ALZyn?KT5DVY>ieV0&Q@zH_{Hs#KL&LsesmLdHH}%H&9|=
zds1tl)_#G)BjiV8WRyYDeC^qLqjH$!l9mCKc*fM3`{7D^VLah}k9nS;)CaACudkAL
zu^IM$Zn!_8hqA{AWK2v{TKGK=zbZrkBP9?7B%}t%f*IiK<Z9Y|U^zY#KZXK7Nzt%x
z;f#%UOdo5m>FoRX*igqX=$#!iE;2^OTPRQzj3-!-`1qasJo;ON<|_V1ez?_m^saQl
zUJ>G>Z!b33B;qPulAx9kd46~$ndN9EyKpgUDIVl1XETlg9tNR+gS>%4H?YY)D#AM4
zRkJnwlYU<QRq4H#sn1j2H#i<D01clO1;PawJbLU*;lnMePFD-CXvoAf30qP(U6QKK
zx+B3iIL+1EPXbK;XgRZ5j?rcy#GI)}*6Rhfh?!sgfGPoI`cGindrgnoD+27p(HbFD
z``Dw-D3A+9PBy3AMpmHRLYAThpz-~0kT&sNg1N*pedAA0pLkoS1C%Mf0T5>6*5m&9
z>{i<>U>lbg+&yZBO2?2So+xd40Xln@vjp|XuD}N4fzj)Hz9hC}5jcsw{If{aM*%`|
zxiX-YqIZ9B#t8JUUCu*Z&lS3;dsv+L^qkp1=tnRZRt>W}h*UH*&M*D2L4mIBe!NVm
zuFrZUjtr=CGgAYqKi~;gfav?fKxxd9Ph0bYIts)g^NP=SRZb68r-O$gt8uE_W-&5q
z^Se~7CgYx7rlP;@p>r~aMf61|<rv5KIC}#|%2X5Vikz6L*4?c>jD*V^jB3s1DNEqV
zE%_6b!Y>8%VLtFMr?d4`Ly4H>w`dlMK&k`qCj!Q2P`9>o-XR4xZ=^q_Pw$yinEXF3
z!5NPuV-RYK$Cfh1USgnv1>XlOx0R<hgDsvn>#ke3>nQNPCcq{GL^=xtv)0*{xG~zn
zwO)KIG%KbrX|V}_MR*>b`)q3>&rE+4V75Lv2~yz8pxrSLS)1SG%s3DiFn#EeeG^$}
zF-=!m;1f~&FyG+9#=&BkB}@F8*JUF^?iZR);DRtzS^_ZJRkseP3=Dpaosd3&-d0km
zs3@{2D07;+x-7f2)PTt~o1geUx6T|udRDX9fqrnh#}#7fxs7g@20%JH{TmIeLIG=)
zU+Dt$t*zI9mc72cv%0;IU1e7@KvZcN=YY^bMR7^Mt8v8cdj1OD7dyQP9=32(QH=4a
zFt12Prk9$wM4mcdQtv^{IV@cn<e9|wngC0bqhowQMaHidp$P%t7<NMv1*qw%Xx8uY
z{NKXq!(-jX*$#Dmz>8#HU~6Qvy|R|J%eN0^e|md%X7kW*iwl6(T4O#M1r_W0XVXGN
zfSmcz>E(22PzZc~Tzv>jJsJN7pJhJL;UU+9%XO<;Yp?2R080l96M9{5zuO#EWfD|f
z6af5$X1U`D(`e1yFI+xu34im2mQ=6C6LB5leQr5~@!-=Cz*hY))yr$^N+TVO446k8
z!GLaSAoX<xzW5xUyY;eBJg`EO0(YgzT%#J$ZRpedW&0Z7mh}E-b`9t@QaX_t|Dh&*
z00Zf0lD!vD!GR1SgzIY?hdiD)6Z1jcd5mlXVLIfqV2=(bm}t=<oS!Ao%@_t^3i;mM
zc-&O&)4;Z&q0+z-S3t&-KMC4d*~27W+rSA;<`&pEW(5rc#tpT31n#|=deua{&{aJE
zC0(sJZKj(K!%lU0T+b5km;VB4m76(VCp~x0>u7Ca|Ixyr3)7*M3W<^0lzYt@4Qs2M
z9yJR#${85!>H&sKEHdb7V|BfGb5O7G+<eiIQc|*4O#1E$;DU1)Gq4&38+{EYVee|T
zC-;7uLBq{qd-x{`IU@NTZAmUnPWBbw=lg_p?npD<_awy3MhhdrDmD}dtg57sv$;J&
z51nXAd`lQHTQLs+dE)aW1q4{5vL)sipZ+J<(gPWvO(8v3QIQ{*TXIRL0&W{vSyeP<
zKJV=x#j65ID)8J6eHPAkvx#O(#gWP|p)c`V&U@dpQh&_7EnU7$Uc4*y>-1C16RPnI
z|HB6l-*8i7F&(;@vmG09svXkku`RiF`u8P)*$)Yd9E^t-ON+nGXPiU<tU2S-6Pv52
zaw5z80HNdo5mIZS<m8hhZapU4*w|S0(=9c1<+dYUu$F=zciGvRtT$n8QEk?ylU7z!
zi@kYsI=pJe9I*=g6J0$gNljnsiD&8}V@{j~st8^AZ_Wzl8sULM7twdfn5Dul*8Ak)
zYB@6ulh0+R4cW2T_`VVV9vjVTj?;@zE|x36dOw{P45mtOuzmaB4?X$l$oS;Qn5fA3
zC}5R8(`d_}IzIHQkc$y{6WoNeF_g*NkTdQ8rUSVB<v|_f;~8-&i9iNlr>COpz~~dC
zQ(J%huOwk=7FFlD55dDu>QBHvfR_>s#>i1##Sz;}N8c9~7WSC1u*O1eM2>B=`ZVx&
zd3nBS9t}NxL0%CsTMcygmgMEF|1R|zHfOv1O@gsQ*w<cF`S(63!i@fk23WkdgqM6U
zAx*Nooqk)g3^j&(<Gb8H0c=QD+8Z^%0RrganqGE!0%kNKH5HYTYv<i;0avsteD+54
z&fgXxD?iKYQcE5!NI-A`-en8|bdD>^wmPXv1oyDHqg&az`zlO$!G^i|+fwlsd*A@G
z=_;1v?(Z%O9(s$?r?AKaIXIk}F<!afA*VXjv@kOTKttR#F*lbsxA5)}yr1_%i3KQY
ztVXrBun;#UHSGla0672*Q%=tas$pFgz~_CV|MG{b)olHBk4dTv#ulj)*&Z!ziTMGE
zriu!^6It8VQ1Ljx|AEC{ya>WJ#-@9F)r#6jo^!($_*qsZHGTn{Jzu!TLcW`l7NJ#o
zuR&B<nS%XCd~qYc%Eg435Wrxe=pgli#3Oc-i4_4CVtubMx=)Do&^&3RgxIs^_nr?y
zH<jOh2rFFc!j8N1wgKd-AwzJtTdWiVXwqrFGnvGD+TqeW6xg2GQ6L>deNud`%*8gh
z(I#H)z~Vq6i|u#>F|W9oWLhV(JJh|A<JNHW=#6ZP3b2n%6wW&A9((|!kQ)=K7pGx=
z#ho@d7eQHLI}B{;>R^<yU7q5Ad?n0!%mJYC0L}WY<4ZgU)`Tb9ly!9GuaCZ=w;VPS
z;m|wL3zEPK1|eP5BnwzcN_=wVi{o+G)a?WAzyY0l1}Cy4rf5m=XWO^kd+*$j7FtyE
zc)>si-=fBs{$9j{xCcvO4hy%jzdqY4LLQ6(?keDFKb%HWi=l}bsw&NhEIJ47cvD%T
z-7S4afMaoRVh{K~dG=o1gQOGSwcitjwot)F2K@Na@l0(UA2)-XfsqrGF$AKBCj;Ie
zhG3BqzO?o=`}QXnXcPW8Eg<dbdiT&@Tux`nES+KrWJr{}dL<$3aUREEZ!E8G#y91-
z1Cp#Vau}0P8sg%!2%G+51^;dF+67wt*R#W-s>E1!Z55UCVI{okd#|lzt!lq;kTgL>
zC4Os9{v?c$T>^uHaLAlZ0mG0{w+>_}$Vyu$;SPjXGsPmi?7tf0OS3y9mJR2IJ<{PI
z6RYBKsCzYs(Xc}7{wpy4f(!|(%?n^=BA#PZr)0&he~tSRCssG2(c}7NKhgC7jmNL`
z@87AC7(01=!NJyn{d-N2cLI;w{%bF(5kY)#kIxA!gaaEGV-W!$PVs|#j3LK3r$AcL
zmcx{SZu)1Cw!+Q9K*_-X-ucPmM{UHOWhpYs)l?TH-d5QzR6Czm+a&A?mE1~!m=Jgx
zWdn5To!GIgT(E%I85hm*+IJ{z*<aYh>Cl*ZykMU6yHpQI+54$DqNF$qXc^WDM@NU#
z3WpP556w;K8JOq<I|P-uhd8o_oGTs%rx_!LnjD52-|b(?-kw42T9>o2Yb(x!rDi!w
zL@2$Gj{fFsZ$f|~*HvEa{xi=R2grW|$#5ehC%^-nrKq8)s;fqo5Aucz^Fbo(cab+n
zM&wG5KJvK{VOs+WTML6?<W-lQ$mA$sGCeOvQ+s1KUjkfr49Eci5NR@)hX6Jq2zz`*
zbfvPClN{mo`t_NgcLmt&h9go8rF1`|!a=argPpM&*9ee!0+&3q-H&Gb^WDoBPTNHR
zVDtp|Ks^;-Hwg0O{L$U#?sV=`;*rzJ@X##7cdnm@>HwU@mn8hnzyQ~CK6{yAG;Uc$
z$c{FH00$iobxqWR4JDc9rfIUNLXTE2zz<ikfc?>xGGFVssVlv<fBUKt13dtOo&q+<
zX=f-~30VMkVKY-@VPG9PDe~nV4MWo<)1!vTqcDs?%=e%5_013;%A+fa#%6S;M(LIV
zFoe}M^K+x~q8PZTL#9A+jH(R)FyeMN;&8zyIxgvJv$j6S7TjZs?FDQ=a}ve+WPM#w
zVu&ByiEkvJF3nK8nak`kNch5n!#r;26zp(6BGLOnkZfZT=WO4<_L@93VEjwG{tRs5
zzhP;_mQ|E|tUUZ=*VCt&R{_ymQ?&t^FP)a*L56B8wh=iw2y=mT@t}C%pjft9rb(0I
zGIIC)b)|cB^e>Q8B<&G-P50lqm3Z;T!SBHCB|M2_402w7fKI5be_zkd11fra2e0=$
z@42RS`@e{ac4TRA)iI7#=o%Zhfb1`+!AI}h8$L7yXF)=cB1#zFYZCta0;r9z!HbAs
zmeUsGK$w`BS%G&eBNH2&ytf7H$|@>&xUnx^;^N_gSL{n%Tr=a%jdeWJ`$b8SDIugv
ze2~QXGq7&1b7rJxq^(Wc)|LSz_vt-g)b&YIva&`?_OG*mL`f+$$1)LX3xkIpK_FJw
zX+P}1CdS8Oe#Nxhv=CHfH~tpRQ+)SQ1!$Py_Eg5%+1aJ83c$|>h(G==06Y8Jto3yq
z91{~9pfi`Bd_Qpz1u1_9_NcluzOo<w%Y#HX|GyOe|NBjY|Cir$fMFEAe#q`9>p25s
P1^Or|D^e`1|K<My)3MF7

literal 0
HcmV?d00001

diff --git a/packages/mcp-server/assets/logo.png b/packages/mcp-server/assets/logo.png
new file mode 100644
index 0000000000000000000000000000000000000000..927df2b4690b9fe2e17a5b8686a22e1ab0cdaf29
GIT binary patch
literal 20013
zcmeEu^<NZU*fuIC(g;XNC@tMeBhuZ{l1n4qU=Y&M-JL7lpmcYqbnns~&)M(ud4GTZ
zfM<l=l{qszbK;Kcy6y>5Qjo+%BSAw#Lc)}m`ly10^u!Md>5)0=WAK-++*wWF?WvKh
z<VU0j#J`N@{AeU3N+juzqH1m_`->0}Jgp3#f6vJX9v3(<IsJZ(_6GGlxEb1fp+8k-
zWw7Wxy~KFF)c75hCs-v0>y3C(%*Ye!W$c#zv$Ea+>O>QI_=(kYN{S<`-{Ix}!>dds
zDe!$rNWVpc4zLg(MDG0A5Z8uOB1(jUc%PySMO+z@6^_Is@b;A(H5>8YKO}z2i1*K!
zZS;uu-%kzk5$~UV{NLgK*LDB@(?-Jo082z(Sw;K$HRbl;ysPpkd->53F>zvNXQ!!G
zOHIv7&E)wCaZW~A*?g>Ua+qFd7{)A&3Cy$!TrhikTqwTEf5;rUiG_DEPLm6HsHkYm
zY%yRR%!QM3S`PH!HZ<@Z!^jcMZBVn%;+5!|+_#p}d@p>1LSt5UFiCk*giObx{7;g&
zYzN$yLA#7J5u(z3A<2&{I`!AyA{n7)+uL7w%k%_ojz7}S3<y63ZGv8hPDw(VSW0v&
z!-rWRMIRzqZ0RD%xwzOq7kvQx3+Qkp_To8&e9xQ2Yhg>qO=e<Ge(c2$*IJDy9VLNf
zlz}BiR4N%99NeXlvb(p%ntxqgRmI|&dcM6%n}3aH023uDW$o+l@0LqAZkv}ZD>b*Y
zTxxW$j#ibduR$zG=cg}ICkWBw%6_@Nph3;b$uZgYW9aQ=IJQLvdv~Auje4vs_{+va
z^)=;mgdH4c2NMSW?IPA{K|8p*mYntV<!M_blaRj@!UwaB29eC*tRl?*@3Wnk6P`y?
z2z#@Ps;a4}4amu3VxDqyO>lBls;IP{xCsPVjwosR!ncf<D*QhVgQLD)KQ*ihKk+=7
za@>}>-e`0^ArdxoO4k>3cB-3vpvOUd{QWyz(9Nl9?}M^3?qHDw2AS7phjMQNI=GrM
zj5c#JUXzJW>6*};n5y!cYpbnuTXH?AJ`*!jn}-u9r#|7fT0u$4tA7uDePiD>BoW=C
z-<C4k!1R_c!0g4rd}I7Y^s{y87)sQ;Jo$@*S?|+7`p(?keSD0Jj1j4P^2G>?rDOmG
z%~Z2&IYYHX5t^nsls-B(mZf!2SDrnbCLpoJcCAwjkBv9h5(JHZ`m<@rFSgu#tq84-
z-AG&ujE#+@DVnYHU9K+HP<q*af7JeP;2C5ICc{?`6vL_^8ENUeqy#A~>x=W!)9#PH
zHC{&_bV#lGj9PqrRMZfb^$fYqJoW7S?pYrP%(hIh!8Nwb$JBJgxmZ)hb&brK7c|LO
z`ao1#nPqIm&>u?5FB3=m^z`851WPHa5m$B*6ErBO1tV8-=?7g$iHV81K8MlB;uRGY
zHG4SGu|_8+$45sq$})m>N`c^BwcgjiUq`{fJWb}ZWin<g-QPDqMgGr7e*}}S5-lXS
z7oCWNq;DxWGV_tMA{x4>-G4KO+Hdq)R#i;wT!w_pT14w<z8C25ukTQ^o#QmJ1J+R-
zPL56N{D-`hc51@^8+;^i|6`M*G_1dV9ae`9$Ct<U6qxsMcr@S(B98Px2m33k*yvc5
zv^8Gd9z}<iHhD|h|A{Iq3r{2e&wKm~VAF<Z>1e6M)jNbut(>j;dEdXdr}^F#8WtPN
zBoFRLWD(KC8MZE`wYeLnQ@A{yV`~KeCN{D7B@>2Nk`p?J3rtM3=zq!F(+_&5WVuSK
z;d;5r)A!_Dug_?4VKKLu0yNxx;y2o0z5Q9SkAoM!!0$XIJC-!g$&ojhBwG(rH5L@)
zogRwP_;19XwVCUk&zoyY4nsdRD`fR%TkH`32#8RS9nN5SZ#09$&8>dT{RCW`_YW{#
zX6HV+o@{^6DygV&IRD;h#cP{aIUXGWHK<*>LyW2HTLy-~6dr#CVZ;PR4E34@lb&3D
zf)c%e+xn+xgclH2{b0uE=xBbQzSGR?t}$Xf8dRem5k*ofrrc-X(mB8_rbrUj`gnVc
zGo{3&c)|Zt*+=-u$}~J2vJX}YPEM#zm+DJb>VdZZO_i2K{u(w1jOLGVObLpRY*obH
zw-Af}<zTYie3Nn{bB%>*tJlsO@fyU?SL3&tH?uj;#YDCT(C0Cek-<70^YMjWB9>`2
zZkxHc{pr7Z*rLGtVsKtSSL_Kyhs%xy9su@c*aD-;Ix(Tfnj(~$n@cmTQDZyzZ+A?(
z?7zX&`_85vVQyi;Ju(qvg_nfM#rXE^`W!MiaDwKowJQ>lhO%;GTwGdGTwG*gVp>{c
zZ0wyNGc)6jq_&5LnVE)$OO38hdaK*)ZD&6))C*M>(X?Ttq$DJ2ceR<{zLjTY78V92
zCNktjBWxJA->5bd4GlLt1K6%~92`_sWK<lEYjf7&78WHD@@5a0k#}o>b&_YvJlx#e
z7G{=U8ygs?N=!`5^>+{19JK!e?4*dGADcG+;nl{`^XJO!>_I`&LCY=T65_t$Kbe@A
zOd1WwdItLX2Kufq8P>Oa)s&Ulx!Emdv$VkRHZ~<THrCoT=2J~toLGVF8i*kmd4wZj
zRbVGAy^>DVChYtC;h5&uv7<JJy2g{*fPjDioSnw!MgqrY@}VHR-DbYQc~9fqMti>2
zcCv4%>uGjA=q_hqEafAkqOOG~+1M`Ewpeiu(}lOTPG(@ZH^;}v1~;wl2M>9>zUu1g
zHl?N7;LsMmc?AWs`6}Dotna*R;3^IRS~p4x3krUQh4@n7T*AcuG+sP%_Ssi;+1S`v
zF?iF~`cb#VBb5?WUVhNUMw`FNYJRqJHakQIER7m|#58#!Mx<WQ*Vh-3{voaT@Z9$X
zW-MhcE&Y66u&7f;MrP?5atk)9fX6C+V0(Fajf1_*?rgSBL>c+<k^%uZJmEWA5$gN*
z^)2`JP_H|3VQ(<re_dR6DKnLb2*~gV$Q;ja#erqyDb+cHk2m@*FCEO){CxpN<ZBX!
zp;~xUR5Wz4>27`Y<X^;VV3)03^IL#>z<7>{{v31uYMPvrbG)V51B;ZSr?fI8>P5I4
z_|gJ<9En6t5M_YFD)kBVo6iZ+{K1j>vI+|C-8UC{Ik)6O!z3bJ3Awkqoy0NEz!1^w
zEvuh$7pnh<R$e<+y=I?_`}VA?H#Lpz0;UA9PccdG2?;9~aV>Iu6mMJ~GMk@axx&^3
z?rYiG12HUTe!rei1+x+9`;SciS#>qFg$75v<-hHqhi70R=1ECOT@nFLudiuoyF3~i
zbZx-K3^p<{7EM_l*<$6%2gmAada5KP`hnpsf|mpYgotfxa|7`PW(xuMylHA?YHA9}
z&&`D(ULl8W+)h8<>glBttI`f9ayNrjVtoOE_zZn9qSzor=yL;$BWrxo>TTS}>KBeR
z-L|mMG1D{C(=+nt5BMD!83C^|JxV${$+0Z4F>z*QW_b`3@TyKTVb|OH+@RIx?wXmA
zAMCx8Qx!8lA3&JfiP4pcMM8w7M>ACOc=YXWza|tD6J675Tw7avlUe6eQf(C*Z!Mdh
zg@vK5?NWt{O_kQCPec#gM^;8gA3m&3cXaqcgADNSR9o{I?lB9q+x2d4f)mH{=z;&P
zvjBZ4LKG`uXt>hFJg=C}&x(VJKcZ_a*vwOUpffu^5A3dXf{u2=9<NQ&R~G_kRmuL|
zbVtwj_RpUM;FT3OGH5vp|KtsSjqAHQS4AsNev~RiW;2N+L3958jl=P&R=NGru~pkd
z$4q(ikL({m#O8U<&uapnK0UT74q#+p2>Ka%P4t4~1<5%BHP>6(nyjo33N{u6#qhau
z=iQv=4n+vR;^WWuHZd?FT_KsfHm53P){=W-lK)+etMksp-*WF~lFy!adz<Y+Ib~#I
z+uK`_kx`nxA6CRfehJW~DWr0(q%ZQ@_k%c9gdJSgmz}<96j@C+ZjSuI%$3c#Sul~U
zwiLn-$R;Kyhze`;gF+PDC~&s-w%{kb&Sn}fRVT5Cx81KV4Z*_Cdy6ovV7~8o+@4<5
z^^TheOZ855HE2e_nj2glot;OOG$A>5l=x`Ek{>;8nvQ)oZZ;P^g<5sH(7MCOyiFcj
z-^qa4FS3LqVG$G@zBAY8D=i%~!Tqkvir@M$BlCx#PL26r-BuC5Td$?H{9%}o+xEd4
zW4~YUAn6pd9#{I`aA5BKKyf4rkFGWZudz^XZpDMQk`faY(%5VVdR7LLxs98QMal{a
zw(r}!A;Sh<H}^mA6*W~=y{|4s8*6Nc;6&gS)WnE#UDhvq)%SR0PVs4Ia)IBIPZlT#
zHv-Iz!!FSXJ}IFutSz^4i&e(sjT&8k_%Ov{v?>%F`&EP}S4~A_tf<-XJc5F&-|=0_
z>nDPmP+c=S2;+44x18e>cQ9D*y!Jo(v>->G&UHH8U7yAofMZ3LI4Uc^kF&EA$TiA|
zGM=_&koogpkdG*44JnW<HF>N!U%!ho$L!d!glg5__IH1M&zV0?Q6}WxC0o`E*8KaG
zlm3WT!n2u`jk(_Z(`AAObI!l5rVabgg=t8lkWl{g(EDd*gSg}<mnknVui^Y6HiU4X
z^FF5f`@_8J$xCM0+w-uB91utB$NvJ3jxj?M^k+=T{ysZi9x{sW?O7&Rlhds3v$J#b
zEt-@s+USXeS{DY!;v8_BYiiCX(IJa`jr4h%e||13G%2sqJw<-18h6U)?X{ip4Q=}c
z5)xZh=rCN^t*(b!yAxP|i_Yi<j~bWK>^7HYmQ}2{xG~Z(?JFtoeTby1rbZ_x>wS*A
zrkCy*x+R5?kr^mM?|XWs<#NaiO+$*3wCATvXJ9B3-VBAymC}kDR;G4=PZ)NCfTOFg
zcc(^qHCIh=G15B@k&dDl#Q}j^jrGIHza_y{G*sm8zYmA0xw)psIXO9L7?4h1hem;!
zox#Luk^zCI3F40se@-bY8#*5(?N&@w&}R}_DSpg%a=CNj9uoI9<Mj>^G0De3U!z7s
zr3<omUZ*`r(bOobZ$7XmsViD9)tq!4G_I0we0g`3Shz|q=)U>N^bW-TGxcZKz|uxW
z9QXGNdYn<YUw7CWV;|fERuE)7K~L!Epiv4O{rf|JU<B`1G?;SS<|AL5<OITM!K9wR
z0U@B%Q{2nj<FAyviP{-RsM#jlp`mlL+Kd@=lyo2%-(*gTj=zeFp}t}N4NNalqLvny
zteJ^PUp1Ww9vG-Ts0Nt5z%0Ja<D{gEd--x51)MELt(^A<Xf83jVmZ!Kn4ix$orWY2
zPX3}r#ZMUz&ln_OolZ~JJKDZq?|t-YdXpFS80qUiA~`!fV+a9(P9)Q}$KoG|2#PZ@
zC|Oz4n?iHn2Z&n<qB}bFaY!>Tplv@#Lh4bFmbMruz>VqjaN4sp|D5sl9*M?JxtxQe
zkS>*rlT%ehQKSr<lfHi>{Tr|%B|0r`nL*{a(vLteaFERVwnSJ2%TTQ(RBqRO@KQzn
z*~r!FHvk@*cmvXGO;(SfMlEPzq5I|~Zpt4uN6OG(aXR1aJ>$kk?TDd?tN{!F8GW70
zvDwpTVNDAq=KdhQ;ajV=_2nJNhR%GhKZ~>qF`Z-HKS^E+iH((ZL6af~4V`+#$EPcg
z85T9B62*Z=M7&{XrK6)IbLaF;M5F~TF&s-XuC%Ru@Ey_wA8@F2SQM95-8I<XzU>ev
zhMk?hn&&4XC9YUxy#$`Te0v>R?8&YucfnN>k4;icikynbBSWWOkO$GUyIda+TU&ic
zE6=FM*#X$|l~#chXHSqORQUK7TADq}7ttwy%%2*q@Oa-DnoAw!zTph<NO%PdP0m-g
zw;I62#F(Bsl^fXVWwcMeX8p5vbb0Fl#tY$lMTrO)h0`VVMa0E(m9r&+cQATlYhIoW
zv!_dz?;wB-sYi|yoqfaks1$s<EP?IHauAWSs;Vmb{zEqu`D89-5r}0WhmbHe7ZV%(
zJ8C8YI=XnxKmEg7v9U)x0-Aby%!gsDg8>!3x2UKXSg2?+Qc?q38z52usrok&dW%31
z<JQd~wlLDY_k2~3u$fHxJq=-KL##4!It2*{ISxMli<fC2e;n@5fB1eYCmqzj;ow|1
z$EQoiD2oos$5J5U+ul_P-55tiP{0RLvc20s*;-f-&=(c;@oB-ocoY*GTc^tsUtF4>
zZERyRS!gVoA0F=HQ~9Z5?db6j;it$b-5nj9>l;UIC|6fk1O%~BQ`tpDS*4|V&Idd^
zQ$u9@E>2FL59iia@gD#9{^a|2kdhVg^)k}OWRcsHO6am^>ge=?K&9|UcBQH$2+$IC
zb3`bA28Tb#xF;gQzonw16Hf15JIdLERF_yMZc292d3o=g1m}P`)oe1$bbH?X%*SqN
zlvUVa=2zIBhU}s)$SB`x2tmI#eFc+<UGS0n_*9-yPr`A(bTa`lLG#7GmBtH-mxP3}
znm+;>_)LkviG10E-L26nwqm2klo7lD$O;|m_x?$8Zm$^tAejgZym`xK2LIdc3KRTw
zjq*A_Cue=M(-~Hhcz1Iimzy^7`_TItwy@i2PE|>0VauJImR3FF!WMmV2(~#YPJY(E
znmb%9CaHLN*-};#^Uh-|Gb?MXSn}e^(agm;{(cS}9X%rD-G=iD$YiLW-e_!e>{KF)
zCe&K9JCFH+Xo<^wL}a%JI4-PLLM~UkXGt{_C;7id2#Tj8@!7c9BRArke}hfwd(|Bk
zo#bxKuE0VbVaRb!NjR4A54=BR5@94NahbOcD%i0{S5`c?qxDw9Ad>56a8nNo3xRWg
zKCIGm+=%>Gys>qnkoJCSdu#*hd+{9kF@q)j+R3!d+!#1OR<o=Zj)IGd4AsAhNMv*G
z>0t+cA-5p2uFkDDSe?B2da=%1QvqN#KS2fo5?(BF_Ul?{Rnu3iMoMNHQw8?X0b%49
z0P*^-4M51~hSRV~ggkCzcE-eiJ&Q<t_pZ@qv0Rp1x=Ookx&t%0_I-ns`^o{89%lZK
zN42BFqU+%odD$$bMqqwu@zKx=V659;*g3Q%zwCsD8VzkffLNT%>$FZxGD0?fej6PX
z12*gXS?LhKYARvFtji6?(=o)3ef>0z>Uz4m0uK9rPXZ(QSXXZYK`I~7l7<_p{6dhC
zm37&1reJ()2;Kk1u+6Wb_HISbbJCd0gJh#5sv~apa>?ayis`LNpF%DugkZCFpB)^6
zKMwPKx!k^F7$<lMZ^_S%xV2d=tki!YC`*rDrd#Q=(>EzDE)K$)2@2HgED+%<-;0l~
zsL&A=5L9h5ea_Mz(SV}*w-r`yUNyTj!UJBk(1w!;v$HCWE+fMhd_{bIz=i!jtW?dO
zc-`G@Ow&Y;adJq6k|_#T0~9YbS%CR+jjsNDR}<u!m=v68-Nq;JKfBiuAH5_E-K8#*
z-mTU?Kb7o*>bKV4N0g%76e)>Q;xHLhpa0FKJ54{nSi0+0NQ*Ow|Ief`M@SqOtT>*0
z6DpN(ddc=W^d9O+$Rg-|uKNgcP^XHEmsjx-=G|`Sv_BZ+F($8-<4H-ywBBmrRgf;}
z+}~&?`D0V?uRLgcry;}$4pE%>?M})luQ^-gEa}yzsgV>O96sCN$eS7k9B#ixsrr`}
zrEhRhU$W?lI;#BL`q`7(c+t}+tK<ttSwl%gP*h1(RrQhJBb1EFuR($Dvmdf6Dvr~=
zpAn4w0wI;%vagbe*sAqh#SaB098_e_bC{-xZ%6&jzt^c27^YtL_hOO+BNX;cEc)SL
zA&}f15Ne^vm;D}diXDeEJ2*Hngpj@W`95So@%}0@x)T1+kdNkq{2j>oU&HT3?!K|T
zB}vtJt36{<RhCgXY;G?d^w>j%QNZg~js4^Si-JG%tA><UP-qTk_$3HlK(ccT$4bP5
z3@OLe`<(DJ7R$Y5WCWSbu*^7}VmjlRY!me550EDe>(zZ!&dcf8TQ%)Gl}rKstK6cb
zH9PAH7gUn-MF7<VVG75;Oj$7sl(z@!e(hNv&24m*@}rsO{{DS<q$)muOzHZtVhoTj
z+eHl##U4Sg+ZYF$*)x)nVNYy|@-f&TzpIwT1tbO@oexHdSTMF21dP0Do{**bi?53&
z*v{B(1?EmslI;NidO}V`ks~55eTjpg^Hl>Fbp~rKJ`3IgJ6~T^G{o7D+?oouiJ~4q
z{ziFe{Il(vO2NTFM%yFcJL%x?RynueKM1b!=sNoFlgG2ZRJh1T-*yQFq*l=XWem0F
zU1W_)lLupD1JvK(%^Ty@)fS(-xa4?EHC<hO{iOm!F&54FiJ6YRv9_tHuAUJQ!@Ed5
zdwctjCTdRB)<#Au3bwZP_Rm{WmO)dHN^|1j$)Y>*^XvHQ;ii_R28Xb5$lxGHUJD+0
zYV)}hGs=eKhP<57))^HT`I$|<s$+jhw=3*M6^Kp7?UmpJkM<&mgVg~{M6}%`@%@#f
zg%)vd&Fu~`F#|*4x{a2WHj~!7<)JR^2D~(YiKjPy333q2%7{qcKd|l;Bq76-tw)7c
zH!o&gIhHap1K*gt4KY#~E9BIV(Ln<N{Hyg@gW&7j^CMN%jfG`^&uk4OjaImG(kR0v
z96<N2Sgroe?iTiW6LJFpj@O1OwyAm@1Q{up#f63S=1Z@zU3qtCgO1S9nhdVU`5aQb
zbUEo0Ry89Wc%RzX9CV^@HZ(X{($C+u3)jF;&oe!Fl2<Xery*y-rl<Y9Q{&MF5KDeP
z<x!d79Y5vW)G<?h!t^h9Q#JsB{~_$J1oJSrFocbE+VqGFmyzq`Tnea%7BPBk>=B+G
z;cXCTCDfL*yxF<u8_OvyECji*5Jf9$?auS>lt1g-f^li_jI-k-D0+N^h&Pm`LJOlG
zW}8*xXd4<_i8)5bbFCDkV!F2CeQ)ASjBRMjM0C9#yE9g_QUb=t;~dWKe!b6s(M!7<
z*=iJXS5?L4d%vB=L}3N?Vv&saUd|i|LG}B`@VYuxnk`cKT-@BY@{*E@Cgee)O|(7R
zs`(&lxRNd%47@+h^XwS7J5;qB0h5~&g3Ch%ERBtJZ5p2=mNYS-N&G(?6OVyd93)Zz
zSZ310_RZ6*RE)DI$=@0&W1ep=pt3YKF(fOERIVQ+E-fi(vcIu~KKk)WuVH_odCOab
zGWD(&#48Hv{K9~~@C*#+cZC~z!$ybi9mU~7$RqVx0I3Ho5eC^^a<f?Xf$u%dG-H;4
z-*ZQaVkKBDpXnH~ghF4gfUomx7D`2}k)<VvM+aL`+AqBdBYhmKz)F)9fnyGLcN5Rg
z8>*NgLrFsF=d3fpZH8<O(y&IyL${k7=%L<!7qlv<N8gg{?w*(pW^6y-X-txA2wz$n
z(&(brHog2M3es&V1`(e>l7M`<x^N+c&`CtmPcQ-}1J)dXK99|>rxraGZ1wU7lNir#
zGvO9H{10>EeWO<qHvE=tvqS(V-`n1O-A@33rv14SJ4VSZd7WBWVD`OtE%Cdvjfc!*
z1&Tt=A;#@eV(YJ=hV21)d9<NiCRR4`qj+PjgE6ChQvq2%N&D6e`k#(9Lj{UnARCIE
z@r{^>IX4Fj3x9Vo;OV<Sl8+I#ib}&LAc*u8hZIG>!U}9k7tnvyYxJ(~M`WT$yIAvg
zgr)VY*j>$!l%@l#<d?E>{y;)|k4;HdR+jHM+5YyfJ^T@Wzh+PoBguQS-GTR^``mhJ
zYNzmfF)}^D9y<*g$yiHWWU6d+`c@1gqHWGGrAHQG0T|UEaQw>4aorysx3>8E<1b%e
zoF?uRfxC!5o#54fttHIRD!;SG8=0rm%ErM(nNIsr=$;OH!cIHDM?yj(22N8hnsSS&
z$aaw|4o(#Lx;GmvTxtqev>RjuL8Qhd6z0u1p=R1#dQ$0$P40ZK7~xeGi?7m}FQ33?
zJasEhgGMpac=OK?q}g6xcL}BEp4!(r7L{g$1|8OX)LNM;xj9vl4>`mCPYV$9chi!!
z@9u{hQPLtKwT)CmtjHT>1xZ?XP@6u^cS^OG-m;{o^aizYc;D3oCuCbmMP>ENJ8G1k
z8wTu{;&?T+gezj@DX}rUZ(l2-Lz}l4ir=_vs<y0b@U>Fxz6HkNl1nIll8A(u02R4-
z+AfLBIp7wiuUGGqeev}#+PpFd4NA0Y?N=uf9h$TB@1C){iN{2<yfv3|Kq)9cJxh)v
zbh~&h0>WyfOKfm9kRumyvO}txn!Glf{L$W7(C(kaFFkq6_?e6`-9X3~_MNI*v9B?6
z7&o%{8HSnVjfi@Yy)ECeVg^sq^Tx!tU!PBst?PN-dsE;PBn%-neu<)+;F_6}=HhED
z-rcPTP|j4U`!d_N$4lVE1i=1^tr1*+1zDMy(dN@4KmNOag>JW0PnUoFK*jLh{on7%
zP+i;&#psAg<xUTW2N%=a8Pe~4eH`AAEG#TO7q9=o2X$I`;X?j?eJbiUqh&V9AUKYc
zyX^1nJ>dUheql>~0vX=lg|YPS9z&H)=1F^7Y?~E0xJDF%!>AcD%3hB**PVu9Jn+Kx
zZ(5H$PvRn_Z;>!SavnC7qMRrxp$T1f+UeuwqaoefIXf8dZy&6VZPo)Ih@KwVcS>NA
zKzJzG-O+M`a|n`xc&Q5PinkyRYVQv9y+71f#|+h}wxt@R*7g=Zcc}r(`(~J+85`B@
zXl%<7xs;KF$7A6n@Z$8;$#m!ahNZ_so+cX~q)H|yCx@Dv>Gm%0k0#Wh)%zl|B^6Ro
zRK(}iLwTG%?EfLNHUbKM@&Y6P1jpC-&h_N*%fW*5Sffbj{(<^3Jp%*#eFMOopP~4A
zP~iMq+an}-sqo(Q<yU5eDItEUsv64>s^9DrJ=DC96@C!Ulrr6_m~Ie=$HmRfJOB{d
z+E*jc;VJpOb|K&QUi%%@q_sVP&c;S-W~`sQ&f2t&#h<Fwd7WLCN9QwyysvTn)L<^O
zL0~gmCv+>@v64+!w%8=zvL<b<ds}i9Qf6=*wGm9;s{Prdil?Zc;PRHHt$P~k^K|6l
zQ@PV9IJZoHAH8f`OdKF1ya3SwEC2xAS%%2;Qd0H!-ZwhC{H-&?jK5ox{5&FwtW=<f
zBO#v6i9y?Mb6t1oN5iNY9na3gaqD;!m-*xASV<*7EhMq`^;+Ckf+wwdr+*8(pWptA
zG)CWwBx`$JI8%3-+X{WnYHV#%=QzJ<_~Y4VNu@mF4b`)Iy%rM?{95&15WAhPZh%Ph
zC2PhEK??FlI>MIs^~o^dmtOf`Wx$u7jr8iDeFXebt+n>U%^c<n!Qz~p4schyR0!lC
zmH&NXW4(uyz0GtDrVp9r&$hO<KmQa#yncRkhK~LqSO1SJBM-n0VN*Q?Rkb_*A6B9W
zihF9aFZP!&dhVN57OKlDs_Go?`bP2cd90UYDmKmLhZcVb+|-&c>5g5Czd-X3iGNUN
znT~=yv;<z<F?OCJ$)ca|PqR=6JDc6*F;i3N%s<>(9sYU5tW))?>i%sE!tc{V3;q}^
zC+%z@UEhmQp0B)s3=QnmySoE-7zx|)_xB$*@DTRhk;n0ii;L5N5W3b50R|j+;x=f&
zcaZ0xAbWpA@^5%#s8)6C5R4)R?7qWY^}A`iC7*+bfSf<y>nm&RmgvvqAy|Q&u2UE~
zq{&CBc_BJbB^B)khrxio_@*4IRpB!I)}4oQGU;z1VLq6tkd9+a5;RUK4Lbu6IC{r^
zf}XZUjnUb4vL=hvv>!>BJ<LHU-GN_4DFKWDz#)ZNd;lW_7e;>TL$|1HIoP*xFkh`#
zV`(EJQ^a(JkB=_^2E4a&3t99_{TztL0A#hjxngT<)2XDm(hAn>Qp*Ea6I***4_C4u
z1!qwo1Ev|6(G7gZ{+y+w7J%k<!&;@$2GZDVy5r=>)bA@{dW&%VRsr)4BKs$CAX`LO
z%yTin{{H^jyDLKJZ(5vru!ZZu&{7=a(aGli#l84vSQN~#;I!6LAApz_%hEBt%|Ch4
zSv8uJ(bRMc-~)hI2>P5e0fguPHX#ELZP-%j-cF_d157w3?e8D6=BukFkcJ6*9EVb(
zs^YDQracM3BHv!!@3`zZy=I`JySUHpc7+R{p7^Q`ZwZR&`Fn#^ArSg;mkbVFZc07m
zR$j>d@eFIG*|^w=`=PJUII#WZ;WfkIwD66I-NyCcymW8xDmj_Jmp=ylHN8tRvEgK|
zBFNtCoxpt0Wi&Zc+x2><mA^G@tgplFA$C@hTcc}q22BnG(rPbvEiD}(gO|7L{|17x
z7aJQm-5L~Sb}xWmI465I(V5*%3`L*G(0m!GJc=I2RBN+W_hl!Ta7joiOG)!}Xs`q^
zKj`NBf1_)w<Q&}G@2f5-%(`C$U=s@f;f{So%i(!YP*`+%kXUeY7N7zk3dwI^%61gX
zAZ1}F%H@2LP<Zk}R3+Ec^ahLEc5A^MtPBkDM$-%^0x=3&>*7#1EX~f#<1^a+*T`Ge
z<^5dH;omYK%DF5S5(@jMva<+T9~OH{_fl`Lf9L6_ERT<EF>BA&TPZ?A;)!+rAXdhL
zR@Z8^Lo9OYsDDtw%%HdHk*SRl;&{u)q`U7j;tO9G+OU*WX09(yo+2eC`RRGuS4~=>
zMvhBNa8L7LA={xL3-Bu>q{P8skF!PD&mnC5+8r%i{M*rLt6>0yusbwZkJHM7TfQBJ
zrGB&XGH&%t5%S6LT^6d))S2Je*$JoM-#k5{vd7KzSsHe+o}GXy+S%AV^>J^drBz7c
zvDz*u2WX8cv^4GAnscTY<N`e&%2C18JJ;uM9U~1<coi0cih1aJc9A}RU~OXpefd>1
zf%7fN#*{*liVcUyS(m&$c71~r$%rD0FFsH-0ewT0*Q9o2gnpyD=NezIe4f-VYT+wA
zV9dgN3|gE3BJ_r$+2!P%Vo%(F={a9x*VucsM+qATYd7;bg&bw!b|v}Koz<0%$;F<8
znm|t@XF{EslQU5!zXzyk)&%~>iV6-crUm%m{PexuvNtN_`{tl1fYU(lpHM8c7+M$(
zeYV@n0kSgKtfxqq4AX#4Lu0*0^A;v%2bKgt^MT{)wJ@2`xiw3aB^->;`jA8${$R5O
z6Py+HxxH3Wad6P}`aa?NdZr=ks5NZ1d=EZQQer>>)IMQBVU;x%F$Ev^ig(yKiasw#
zMFE8sv)+rz$w~XY{Z-iJ?owxIY%25P0(_7FlFcKyz)ww|^~J?I^M5IU=t95M{RG&{
zD<RuA-ioqd-Hwr_Zvhu|ylu1i<)DkXFxnirf?}6B2l%R)k#&c4H_|#FSh@Px*$7O7
z3>t2|^e?wq-%xOHaBWX!H|7wG<!6=&Ib4op(<uabomM}P?zEW$z7@iLvAy9f4whH8
z1O^_j-Wk{<-Cj`f;*2He9j@A6p4;-U?&yD0O*J(&I$H|ldJ7G8^*|Q_&GEC43RPBC
zw%?uk3l_R*2w_Zo{4-xP5YS8wKMV%``Fx#h+1W{V+xRdtr_Q)OH#t`fV7|csVQP=y
z#Kb}{YJthc;1zuKx<;XN1-%^`omL=?;};dx@q{`3Lwkn}`qpe~dQ)vEIY*DGF45g3
zgP%zxUeK=*Hha}1d`I!sw(V}k*BukRFD51E>OPyOMXIQ%z=b{JwB+RFC$nYafl_Q?
zQFp$^BCK?pKtx@AvU9e#bJk*G45$Zv4!aehcgszuK4-7lejeA;4X5aoJFySp6YR_l
z&I2GNrV|87o)`Noqn(3`rJSnI;*ox%Bf8jmTxH=bBn+?7cCk66IHy{=uTbn6pkN|h
z1#<P3C`bueVXskil>^VQFiE&@+#A^>Ze^LVQtb#6IE$nd4VtKz$8}_7t=8t$vn4U&
zS3f~LdbTF_G<{6+ky%rCC4+NM!EltZr0VMNmFkx>aWUP(eJ_^14}ax&0WRT@sHmPU
zzwDfn_u=IZ=kenjo~dNslD*07<O#_#qzO6DkIHG*e<N?PJ_D@G9=p1xHol5S8f4?z
zIy(LV{twqUy)F6ct1n)32u|dwGw$r>D1x5pn%h;C+J<7&P*cljlcq*0i_%~%sJ^o2
z6e&s-aQF>`7Qs7mWQRhOhs$??QfQ$R{1RQ>sdLpfj`ssW)ug->0uG@$pFUke{FEbs
zJ~B$6D7)R;>4Nr$r`@B8R|%>#BpU%FDsqzj{lkP;@K;#*;wNTNQ?w|K>{~T}j*!;O
ztYZYDr!qkh)FMvPNid3*{lQPU^L491VQ%hZt*fHH^V98QPDc{=N0ED2-za~U$W>_O
zH3mKd*{V9Y=jYFZnUiu+vsZZ}MuF65K#<U0$0sg6Ue@(@U>&37NXDZd&l-OHbEtpw
z&|FcWGDb7w<dZQ|rxVG+!68j<GgikwMK>u&+tsy>!odNey?;k;>&f%HlXh9Zhmh!r
zY{x@rBO*u9*h8|^)J?A$ywILEd#q_#>ox(`ovd-b))ijEX2(!L-TPYXwt|CUD5j_Y
zM=(*eixKTPW+P}RXPpuirGjYbOG*U`mii#j8VW7U6m3=3rplJH7Qy6F|D_Pi0R3#u
zt|cn^$o&zYWapGu3?#I-B5ZrOuOJ-V=nx`_w^2=q|B}6;-B<Kcr<K&PewHqG|G(#7
z1o|$TF0mE+44&mJNg<0KN*O2?4vYGcp#HB(py?%K15BmJdMhD;bd#|Gfl#a0Mv^li
z*Gpgr(U9Q_a)Bm~jS2$Umv;>vMIr+b<iK`|nctcCWacv>r#{~R^sF)=f%DPb{i?{B
zR5A6es3j|Z*kGUE$z(D(moc8@{wx>`y_09+cjmUH&MQ8~F*c4Osdb2JZaxIy%WND-
z>Bp(7CY0_eZ}Qyc=Cs#Q05Aq57r&Y_*JIR<AM^2L*_roX$G<ht%gN)YV23!!pt(Pa
zN`D-tz~SPjj<z!_r7HG=dTZ33N_v(VS3UAfbs?4A|E~e^(-on3^T&@)YImwhxL;hs
zLB#l`Haow{X`={8L+?*+l=SsmoV&|_{^mhjNKjDEL=Y^>U$Afp6}x7~R{TRxZ)8^6
zM)6ddfFo?0ajwR(wue!sAIDo97~7~Wd=IMZ%WdUXWHuG8T;SZ$yCt@<U$qge;)+hY
zZI<3-MXd`<P<s7mN&44KSpZ&9)KHCH4Ui~Y52RGuq(i_KtW5@ygp~Cz;OJw~Z`j{N
zLoxU^*Vlt}FSNo0)-9}*{Wf{+mZf>&d%|G)XB!(yqxIbAWHls_TrHy<TM$s<f^eWf
zQi4X&j+WLaUq!mSer*1NV#uK34Q!OG@&5X(5n87q*XbJisuy4*KYyOSX4~Gs3Rxvz
ztiOR9w0;Sh*O3WkY_qve%9F+mt|kGr%^hH%W$_+=`waiqZnxA-$2wIdt(Q<NS%2QS
zx4Ho!h~60)rNeIFhx@>$P@nNU>Ih5jEYxtI-ibO7KAyWE<68x~WQ*#DqubmIc6QJA
z4|a-4QD=Stks-HR86!B2Ai^p9{rd|ni)LMQH#zEl7nq+YMGGm};ZOHBB*Z5O*8}pj
zp4#fj3kMdgKq}imxqZO%2{}5_?Y;-pQy7PfRQWJ{FM}k-<L|%_N~_K1GEPg8Gq0W4
zEwnV6tTgTVN-HQx-=)!3{LTp^P_L}|jdOvsrm3c_;j%ZhD1Ne~@z8%!b-Hdc%G;S!
z_lD_nk;NQ;6%8v+`eC&(1RIhcK6WQxR8WHY@GA21fYhBGNN|j)#29v=7C@B%gaOp>
z6~Hh(SA|qnR9040{eqoNtWQh;T^qfy0NGsRok{1SXc3R^QAPi>E!PXqpXLxqrAKGQ
z!>uvMkbCx+SXjsfjO3E1N(VqXv^wYi!O-i&hj)`^Cdi`is%RQrBm-U6m!Y;x^;;)%
z!-ZmjPgTeYwbgWA;o!%_(|HiaSRR0HA^c)KzgaCj>-`)=ia>U~R4(R;>HM4)rrFQ>
z&l?prD+MNgWgMGYqd^rV_HPxhrNPa~&J;p7`fnoCB6@Lgy#?E~^atD9BmoJD0~?!8
z!PBv=*c`fgpm5K6d+1wJ;t4yTD$6OYuKp;mSy@|+d+|$6^J7gn`B6U&NXwYPuCNYG
zzsS*~yzFc$(?kxTWdMKFyR^?1{?OgiBm$TOz|y0Bye&dd7`O5<{tZdmjV>m{S>ouy
zdMkjZkoLK7ba3>&lLQeOP*xnrT7Jl6W4d(&uHtygG&4VcUS+`6NuAHd-1lb5`&b4L
zD(OPLf6ZI(`wOW$JzIWcKXE6bL4Cu>e{(dxHQ+3RoR2j@fy-ez+VuVkAEefPb#CQ1
zHX#%FuGq7D>bxsF&E_9=Cr@Aade)TJyx{d)dpJ+ciEd$NZF$K515*Ev*cgu|mO7++
zT^=59D55rlQF)+0r+Vlo0}TF9S~2z~u~F|#&H5j(uytjJkk0E-^0|DWHb9mavVBVi
zbVfs|Da23>6<Ar>diuPc-~z!E@r#)BbZ*1XidtH;;`hR;C>Sjt2oN#6q(tt!Z$a%V
zKX1rhq9P;sv4R>67o%=1UuGPVm-jHSuRTV<)w86gP+K-6MMXu`MKD{G^(=*F{ZZ7!
zzo%(?IN*=$1l}z7vRw?~i5wdG_C;WOqL4F3qc@<m$liO=H+p{_0Rx@e_%M`VZ!8&2
zIAS*kq^iVg2SW*bK}UQvuy(HC3r8Ts(M`#{<ua22I;ho}vEr#pPu?gkNbqQ@on4_O
z|H!oR{ST-T0*icfHl;Au<n-ey7S6>8f`TNI;{dWnU;+w?BZ$sheLuSH-|Of$!Dh3Q
z^VG&8iZIMz!ChgmZy0kygz2^YYxiN1;XW8>NN8;dnO}U8H+TYcS;|?1M#Q}K3wG<p
zHkR=kE-reDv#(wO@d2@*!#mURBeiepXx<)Y)(o4de4W2*D|0zH1nq|8P@Dofj%m;t
z`oFwO*-`z3bx{dXdUe|Q^U>Y)_RbDa`2dznp4?I5`S-*9WldSxQ|(cJdpIZ8j6nN9
zpx4)Nv`Vhmx_Pl{7dEWlM4i~k>2fM{9d>W|@2k)16se4dI1p_~3H{?K(Nk~6{U@8Q
ziA^qutLd=6jeAO38h|3ltpv1$lZ^3|lMTQQl1`Nv6+6G5EqAU=N_sQoiMIn!o!_xm
z163l(T^F31Dk|5G^JZpyIT7tE`*SV+L%&adeM@5+$^%zdYmmO=B%_edr?ndktss4u
zVW4@zf@TgJoAGMhGX4k-f|8EFOF;cTGBHBLFJrCN;BmJJ62|T68pw3G)_DGXKAojy
zkq%E8RNpx*HnsW74w^kT(e~a2d_K@8q;+g!;uV!of!G)$D3YiFs<Q_VaS$2myt7l7
zd;p@X#MaB!V$<RsUK_p)1A}X3jcfu5`(*u<mmpPg8WHKNEzT_S0l{1YFa6lulI?QZ
zV#z{@0l=re`cw(ogkoUU*v)phJ-fa*kcZ4Dl1~9KIj4aAyA;)KEN(lA@?cr=l2RsY
z_)WZ-A*S;gIz*wuf!r@Pw==UDe?E}ie6Y_{rQ|1yG$I=pgs9Cao&YK;>Xp%Z-=pJU
zT&MU7AdkAg+j0?xLu6kL?M>&`0-R}21B&6ZrP-XVN}MhX=%1=n40~>-1b*3b+@FZU
z_t}Jfj~w{;(*WD5JPUA#*5Q-fkWEd!QIK<dU%paj9e_4u!7Z{b8t71s?o+f#RLGX3
zATQV?BnT9xrFSOE#qgx)a@oqH*Scz<24&A>_16t=XV?Ll7Ym#I$On)cE6viGIv4J{
z{DCAP=YUsc7<SsVW`pqlTvC}|;ebbu3)}NGsPVg3#W+1nUua#-i*3I3IAhEYCnH~M
zE-YsJdxZr;^a$9J%AbzGbbws`s!Hbo@#wed!nM#>BPi535(K4S#rFO)7Zv?`IJ!nX
z_oNkogUqDU290j8is?l4{&)@FT$Z(y{Gk*o+gNN-93cELTwiMuKiM>vh|(MV$-YJd
z4g#FwCgxsInK_{HCK18SaDrgEiEJbg2@dCIzoEoRJ;43_HHZLobl}B<=l#HQAeC8P
zj01B032D5g8~5p4@zd68n}LF9)^x1nedyOuo3PF6%casu#yII~lzSjUMM&Wysn&dJ
z%r=e#U2S`e2k)UNseA&SU$(aH(kwXGd5(R~%@2wQ)|1OP+j>Sm-)x2{!k6QWJe)x6
z3-@XU(8>pnwl;h~MFORbu&>*+h=IY9&0Sz=SateEC6H4w)Gd0T+=K?_WtJ)UNQm2)
z$2{x9LoT<tO9Hg?##YFZ46h(n_VAzA@k6O`PUDy9cVKP{c=KFoe9_@4jfP2G8{Cx}
z4&F&dblPC0q(zRpj*Nsr6nl@K3DMEH_6^KJ^`ldxD%{uj3WXb`!|S1Wvm)2A`jpuK
z_z}E0^Ikb{d{|lgn(;4T=H1h0MWo!86QiS<#f>-XL2K*YC9;@?R>s~(`-On12mD==
z_rq&0rqI8YCLobNur2}Uu_DPsGE=$TYF#<ddN(-SZHDQ%erRiBa23t(1zKJBNjH!j
z)Olar-+cY^v!@_97)`>G7WD&AfH^aI5<>EE+XI{&cIll3fo~|*WJ>0>>I$28HMnj<
zL&X^C889h|MivFaH9psUU_{ba!~%Ob!V>x?mnyBgk7+^x(s?!aApiMLGD>eX_j3jm
zJ~3MEI!sO#h>2Uf`r#2Mk?^{U(!7lSsR|itKKI2-KP2GoOAvRVl=L>Uoe#Kex~wVH
zxw?^R&4ve!L*k*@vMNBGW(op*Am{$IN}3-5z&>%=j?`MUTt~Vsx(hqbch38ly_}3w
zB~%Pb&f>C!EWcKN3{MXO`7O;lX?(*wenIaqlDmvR;X=RRP&_})a<;!D-*CNA8amuc
zdGGe=J0;-8iR<CFG#pX40$typTr>Q;9RO+rXiyLUB^Pc5?3ed?3X2POK)GH09MJBS
z{4aC9C;ic6BJdAo)MJbmN`&U>J=Q#ssPFzw9;>JTvBCa6#Z}WS;FWgnS-^pObGjg4
z0kXBOz*FSMqF!y&6L1R@6qKgNX?5GyCgviJ&lRdyS662){lJ%d>HGKyMckswM1rAp
z1`0M!9Zk*YzBb*sJ83Cu8ag1VU*Fo=+SnkJ<|Y~YPlliqSPVdZP>t8-h8^^9#cpb1
zwz+k3d~%Y@k6-l-5QfEr8xHcJVJ5R%dsaqSP>R`~a!}Y}jwhL$fWC<nMnv}-0lo}L
z%i^N0)-qA?Q@{!h{+;Dsv3eu@EdZ0$=YfRE`4kt;-<Vd;{W$c^(A*~-8{NjaN?(H{
z*YT_@V;9(xn0r7VQ136_5LYH&J@;=@UZWNCJc?>c2&<k9;4XfOwJmuP3`&jwR6jh(
zf6)_SUq5%hG;ET1*6MZz2Q&Ity!+Lq(8eq^P#^x6d<2BPT3g$b)TgEXSIQJU0|K-~
z&octohU;N43O=Bca^&kh&y>a+^xK|Z_no`lzO&>dsMpT^lP^097D@fuG{;nQ-OZ5Y
zm>9Lbs2I(d=;)iVt;yIuUNEJz9K{KTQeM5wNasqurx3isM#FeRdPs%(hUHBa%K;yd
zr7Gb8$5`XEv8xJc?&;sZ^PH~g#WS^_;iIjAXJo#A{{~C-WiKdESX!zPuQbywtEq@`
zFjQ97*7gA64>{{sch%gDHFk;oRsmIdc{l`Q<93H^L1jHdLwTkro9dcsYPz>~p4xJ{
zx=wOTcZ_rOXAyuRke)XMiUk0o$<9x$pLCJ%SSQ5M|K&gkG7&Q1kJ**bnP>>B2}U-!
zabA{G3O<ilgVJ<B1F}PGbYYQYJb9dZESrTaIy3jlpz$BK*S;J0PRW3mnk;%u#-Jo~
z^-9*Rj{w7^hKJ+7g3Z>pDTS>1kx#ovZS#R9?XpQA==8cjEGv)93_Vi<<g5;FsX?tr
zZWC$I+~7xc%_`HiYfLNRcT`)qx&1MwCbJ9R(vUg;zf)S>Otx{4NH_BfZ8ydZAyy~*
zD|+4MSQVNy;XwcG&q+tf`pd16e`jWX_U*smCIyOkqbIEf;@url(7KZEhze~=Y=EdR
zFfv}iM#Cy*GL7jfDk@Fw$`TW2E1$V;4JXn>2o~_Wd^x@F;p?dsUgM4~XvlJ}g!HWi
z^S!IN@Vqhsb!ifo^Y>c@F(;~^)M0Uvk8=zmh`j|hIwinjDaA3oeLHu?yV&m43sOS_
zkpT~(!>}dK$!=e)_U=CkbOq&OLu#p~VDEjsO(igz82Y&J#m!bXafA`DYU|POk!S$Z
ztph48({h9ew{DpO$n(hpCQprG<6^a{EhX#IYoemYqHk&esh41>Nr@xieeW=x<}2)j
z7TNGZP;hZ}Jby5iTTC*rU#&Z*tB1hC!eTIi&!YGH6-JtjZr7IU&QkJ_a;|=U1U4Dh
zuR<4~@y;M=qfb2ZwO;hyMm1#zqUeYCVImA^WKkf#tAz`L;;6f!yTDUyH$bWH?!tIn
zCVF1~5Fq6;|MS_`gzk*M-O0YR;Y}VEYiW(qV8a^Su+mFTb{;fz59rtScyRvR*M7<z
zKu2Vg$~XSLW(L%hB3zfTkBPgx`(Zwgf$#%Rif$*&bl6F6Y&>ke5&$VHsD9?xA$8@|
zbmg5+V#Ak#Z81M}X$DUa=tDdgfH62I>?Y|_eu2Q*{$L-r*=OAcby+)Kw5Z%1W2irf
zzzo?Oe+$+bQq%{cTsFJWF#zk2y?yVwnLf|c-zbbM3fL|Dmjv<gC)L$e)m0?Y-gz#A
znU{<n7q36}{A8!@_R_SP%aJz!r_+T!2Q<xJ-=b#Y1B$v9zOJF7@*)4Q3skW(X;H&j
zzJ-2h7se)M=i}v#P*@RcbQwtD5g!r+H4z1^F%Oq(*flpw*`N-vh#q?AdlRl;XdvwS
zoe}`J8w(7-^Z_0L${sg2HpUsOfdl@R-n#o|h7$~Vn17_QrI(NUwEkVoM~N{eVfVH=
zUl(|Z@}3?VI(oY24K*!oVsh>FVs@kMG!F{$(`Vkd1(}(EGz;-}m%ZYq_6IysG-QB*
zo<2i0;m8|QKp_3oM9r@9y2T%}`tzBOF|p`$cl2&zRLnu!ovKjB70#@G?|DY9u3L5v
z0w>z=n?X=|{8t0i*ufWkzud0x4C6isSA(h&=`~*<7SB&2xvAHs$0rwXuwIKh0NM|(
z^a{7XO@PYjuLi{%NMG4xrdxgl@>(xRv^ITfxgY)E>FENettB5l-mQKZQ8pG&W19dv
zgHfu0v%PVhIJKm^wQfd()?`;$i`$NB*Vcpf=dsIWEZ8EI^Id4q{gLrfmMI|e@*iRV
z)eeHv(y~0-R(&wNkiN0Wq$|;<a2O9AcwX!X`?s$kD93pUQmt1c`%BZDKn8lu0cy_x
z{5)4<F<vHb<#_V4OQLI)4@e_9I4WCcXh8KXF3C%B{9A@MZ-Z}{J667cKwC>YLDm<u
z;^^osx$?8Jw#U=E{O#S{%Vw{+fdM%mMBNKwUc8`ZV%irr`Dp&B?&Gk7HT;X)vM>-S
zIP4MxegFPg6<tT#x8oI7_lQV(|AwWxxw(}EFhUy}Cw*790_3cmoYBLq`DLpQb2k@d
z7SVJv*G#hnFJIaM=4GaL{6+I)pmG91yvyGHn^r`Tkq9?I4Zl({m*vFvd9|#!Kww8F
z-H7iLpbW|uJ;KP}djY0Zo`g5f;KE0}YfJXXRE!=!FBc-k6(beSx_jQN3%n=)1x3kx
z-Fup|#*d0>8X7`A>qt?EV#78zUn8Z(sT}(?Kp7__5y_r10SWlVTv&J+Ih{g!ZtGVG
z7jSM+LaO}9aka{3Tsv|Q<tfU=Ht(0?)7dCmWq>5yJ>2?pZi5TOe{QH|1W0o?FL)e2
z9-5<r1Bkljb3N1NFJK|M%GB8CTSFRhVyjO3|7Pl=D~;xYe}*RUc<KYa8AE>Wy^NOD
z)%Le$yza1A$!;*lBCiIBV^sh<x?<cVF5WG5;RGa&fS?H_XV+btk3>WMZrTcc?+t6x
z)xquV8(W2)F`^NrV%}fwz?*L<1l?&DZ?wep?q*i*+Mi+@H5nsL2?{$rKqMwT4!OR(
zme%`GSlAnNbwV3TN;R#w{rtPz&dDy+_Z(EMiI$b#4s^_z!%B!b^AzIta-aKuFlglk
z95ZFVVkStl;)m0B)+ZwWD+5Cmv2ZZ3vKln|jDuLywD2R~Mb>}6j;0HBw1)ptYW)}z
z6xIj|6F01QL1ALFDjpbOAeblS_b`EyFRt@#Cnv@_@ANqXaEw}8?z|WP3*h{=02)#y
z1GU#kL6o5!|K`GULNrU>zI_{2PEKl7Y;P=~n8v1{s2Cp^9z>0Udb`}>dAgn$0pA0a
z=@Pr(ISt#pqq(jTu(Z1y9_yK3k$mDWP?1}F?1nt_+zv0L-RnD&<?gx@l&Q||nq`;T
z#}NJV*f53|Je`7blLZz1fyq-HTqmeoA>$YU7F-AvsmwA`N2WyrI(7%JEcqk93lb8l
zs+^KS?vi;dj0~5?GWF)q59au4Tz{9>L|F-g+Qz%(md1;Jqdz1gh-V#TK)+0%GvoP?
zQhBO_@1sNqwWk1CfA!AGdOp3;l%l*itE6Oq;;;S8FVXfuES`~RNREO7DB1;7bCjw|
zWkqGbOg}*5+y&A^C@01&bASQ-ZTQ57nOPMt+H7!ui<=97BprwyK;AR&3I|;xOvM>p
zXbD_rIQar(sRBin0I`TCa3qL9p`+7Lu=?vvLyW1yl9GiQ`8^<3Xl!U~baGIU!!Zd_
zq7VHUeC&Pjuv^^<1lB<0fuRBDYeeEaw;m)TGc$pKsAdu&GSvsAyr8<a2DUJ`c0>f#
z71LYHjaJok1<owq#b$mY?DJb3RHL<3Q1fBXe1776ke(RZ>4x_T3o`N3kiW)y%x*5`
zs1LE$Em5<NqoSi5;Ug>A-HM<*wXg6wsDA}BzbGgfC`4V%m-Xf4TN>jy=mn|PRHZ&i
zna_Z6_?nTClA?Q6y|KD~+8t00%-;GmqC!&YnW0(>5a8WiO{axumVvT>p2kuTfrEe>
zl$7e|XlvX_o|u_|Np)-+A09d|0DN-7OdS~38SuJIBr)|`85p?V7K=%sZwN+SBF+g!
zEV!$ycr^zL-T>-EX`KUb&dbeBpwZ&wX6NDI;o#=s;Y57o;NgfHC$jXA=(>Pg0McEx
z)mKqLT3-GxEhUMBkRm-ko;6}q>XVL^?Wab|-&;snf!Y7^Kreh10+iX+3u5=v%R=yo
zfnIo*pf@P(Y2X8!t{xe9ra~F`4aWj$2n{0PtOr~>vS>kZp#{$fHELFcijtC&2o7@k
zFe?koYs6zisCijg!4E5|FfUZb$5ub>@zbviKo2VbnL7QO_5|cbvoOR10F*?C)Vatb
zT#x#y!Gxuw%m2L?&nFH@*h+&|5Kh16cmCYS3fhSfw$by0PJ;=1c!6tlrFc98lP!gq
znE%g!i$$NToUCS&d#UB^KA^&e6alx$X~0tqK7ZT$dAi=|iepu_OI9wtxZeN$#>MX6
zUS0GJ-FhuY8K{!M9(Z7drqbd?>tps8{(RN@g~wILc>P}BUf5mbudQ-E900bz3fI^G
z?apmCh}sM+#P@xx{`}x0u=&1czpCoSyK|+M0E6MK&8{!6FINKt6S&Lz_FZ6LGNdW=
zT#Es2i1_*A*WOQGtG`{^4cr+2_T7fXz;PGg>X}#fxAz10-2yx5Ipv@O7$ks)P;dj!
zme}*H{_~~d-<=ZzfHUx>iN95L8W|gx7M2y27rzBg#jor%gcxrLJmeu2IKTuP8gO<x
ze6OD4OZ8{7-^cm4RUcshw%&njtAInz!2EY7CKk9mcH>=;X9EOUF5c2L)3XCk3VWvj
z*SGt)q<jJH_-S-FP_}%<%a<>2-M)3}<}F~$e%q$)#TnPboMY#{^#gf^8+fwA6kyjD
zm`*!ZtT?e^#*dbkCsVFGnKA{qQ%h|3l7;K?va*uW(r(>3bLQN&W7m!yyLaxGL;U=s
zdZ65Ow$UK!JJ3<8s>^{LUv*XB_N8TMDQQoifxuH>qwL9(Q*~|2fr|v@ty?z_i2Hyk
z%@24efN`)eu#pU0aStS)_yOIa&}hKr;^^p@7Z;b8H!na#2bj2YwA45j0XMa6Spz(!
z1$b=F!vYH#zpE#|0<#CNw21=8BFAR7P(~5=1Hd93R04tg(_rcaJR1T8UIBOSf#}i0
zrbZ9i0;PiiJY?*_|E<x-fz>1fL-U`t?HiYCFeNB2W?;xk5n*WP1#X4iFcFwi&5XDh
p4!8jm@r@I}mZY>KD+57Avl*<6iyF@>&))_z+tbz0Wt~$(696J?_oe^<

literal 0
HcmV?d00001

diff --git a/packages/mcp-server/plugin.json b/packages/mcp-server/plugin.json
index fb7d81cd..e6f00193 100644
--- a/packages/mcp-server/plugin.json
+++ b/packages/mcp-server/plugin.json
@@ -26,7 +26,7 @@
       "interface": {
         "displayName": "Transloadit",
         "shortDescription": "Encode, resize, transcribe and convert files in the chat.",
-        "longDescription": "Drop a file in the chat and let Transloadit process it: HLS and MP4 encoding, image resizing and optimization, background removal, transcription and subtitles, document conversion and thumbnails. Results come back as previews with download links, and any run can be saved as a reusable Template. Browsing Robots and linting Assembly Instructions works without an account; processing connects to your Transloadit Workspace through OAuth. Agent Skills for these workflows are published at https://transloadit.com/.well-known/skills/index.json (source: https://github.com/transloadit/skills).",
+        "longDescription": "Drop a file in the chat and let Transloadit process it: HLS and MP4 encoding, image resizing and optimization, background removal, transcription and subtitles, document conversion and thumbnails. Results come back as previews with download links, and any run can be saved as a reusable Template. Connecting signs you in to your Transloadit Workspace through OAuth (a free Community plan is available); every tool, including Robot browsing and linting, runs on that connection. Agent Skills for these workflows are published at https://transloadit.com/.well-known/skills/index.json (source: https://github.com/transloadit/skills).",
         "developerName": "Transloadit",
         "category": "Productivity",
         "capabilities": ["Read", "Write"],
diff --git a/packages/mcp-server/src/express.ts b/packages/mcp-server/src/express.ts
index 0f352cd7..87209266 100644
--- a/packages/mcp-server/src/express.ts
+++ b/packages/mcp-server/src/express.ts
@@ -1,6 +1,5 @@
 import type { TransloaditMcpHttpOptions } from './http.ts'
 
-import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js'
 import express from 'express'
 
 import {
@@ -12,6 +11,7 @@ import {
   resolveAllowedOrigins,
 } from './http-helpers.ts'
 import { getMetrics, getMetricsContentType } from './metrics.ts'
+import { createRequestTransport } from './request-transport.ts'
 import { createTransloaditMcpServer } from './server.ts'
 import { buildServerCard, serverCardPath } from './server-card.ts'
 
@@ -26,8 +26,8 @@ export function createTransloaditMcpExpressRouter(options: TransloaditMcpExpress
   const metricsPath =
     options.metricsPath === false ? undefined : (options.metricsPath ?? '/metrics')
   const metricsAuth = options.metricsAuth
-  // Only hosted mode adds an Origin policy here; embedders keep owning CORS otherwise.
-  const hostedOrigins = options.resourceMetadataUrl ? resolveAllowedOrigins(options) : undefined
+  // Explicit `allowedOrigins` or hosted mode add an Origin policy here; embedders own CORS otherwise.
+  const allowedOrigins = resolveAllowedOrigins(options)
 
   const serverCardJson = JSON.stringify(
     buildServerCard(routePath, {
@@ -67,16 +67,17 @@ export function createTransloaditMcpExpressRouter(options: TransloaditMcpExpress
   })
 
   router.all(routePath, async (req: express.Request, res: express.Response) => {
-    if (hostedOrigins) {
-      if (!applyCorsHeaders(req, res, hostedOrigins)) return
+    if (allowedOrigins) {
+      if (!applyCorsHeaders(req, res, allowedOrigins)) return
       if (req.method === 'OPTIONS') {
         res.status(204).end()
         return
       }
-      // Any unauthenticated method gets the OAuth challenge, so GET-probing clients find API2.
-      if (rejectMissingBearerToken(req, res, options.resourceMetadataUrl)) return
     }
 
+    // Any unauthenticated hosted method gets the OAuth challenge, so GET-probing clients find API2.
+    if (rejectMissingBearerToken(req, res, options.resourceMetadataUrl)) return
+
     if (req.method !== 'POST') {
       res.status(405).json({
         jsonrpc: '2.0',
@@ -86,12 +87,7 @@ export function createTransloaditMcpExpressRouter(options: TransloaditMcpExpress
       return
     }
 
-    const transport = new StreamableHTTPServerTransport({
-      sessionIdGenerator: undefined,
-      allowedOrigins: options.allowedOrigins,
-      allowedHosts: options.allowedHosts,
-      enableDnsRebindingProtection: options.enableDnsRebindingProtection,
-    })
+    const { transport, handle } = createRequestTransport(options)
     const server = createTransloaditMcpServer(options)
     res.on('close', () => {
       void transport.close()
@@ -99,7 +95,7 @@ export function createTransloaditMcpExpressRouter(options: TransloaditMcpExpress
     })
     await server.connect(transport)
 
-    await transport.handleRequest(req, res, req.body)
+    await handle(req, res, req.body)
   })
 
   if (metricsPath) {
diff --git a/packages/mcp-server/src/http-helpers.ts b/packages/mcp-server/src/http-helpers.ts
index 80a89d92..5726fd17 100644
--- a/packages/mcp-server/src/http-helpers.ts
+++ b/packages/mcp-server/src/http-helpers.ts
@@ -195,6 +195,8 @@ export const sendServerInfoForBareGet = (req: IncomingMessage, res: ServerRespon
 export const buildBearerChallenge = (options: {
   resourceMetadataUrl?: string
   error?: { code: string; description: string }
+  /** Scopes the client should request again (RFC 6750 `scope`, used to re-scope on 403). */
+  scopes?: string[]
 }): string => {
   const parts: string[] = []
   if (options.resourceMetadataUrl) {
@@ -206,6 +208,9 @@ export const buildBearerChallenge = (options: {
       `error_description="${options.error.description.replaceAll('"', "'")}"`,
     )
   }
+  if (options.scopes && options.scopes.length > 0) {
+    parts.push(`scope="${options.scopes.join(' ')}"`)
+  }
   return parts.length > 0 ? `Bearer ${parts.join(', ')}` : 'Bearer'
 }
 
diff --git a/packages/mcp-server/src/http.ts b/packages/mcp-server/src/http.ts
index 6f5ebc16..f78e4ca8 100644
--- a/packages/mcp-server/src/http.ts
+++ b/packages/mcp-server/src/http.ts
@@ -2,10 +2,9 @@ import type { IncomingMessage, ServerResponse } from 'node:http'
 
 import type { SevLogger } from '@transloadit/sev-logger'
 
+import type { RequestTransport } from './request-transport.ts'
 import type { TransloaditMcpServerOptions } from './server.ts'
 
-import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js'
-
 import {
   applyCorsHeaders,
   assertSingleAuthMode,
@@ -18,6 +17,7 @@ import {
   sendServerInfoForBareGet,
 } from './http-helpers.ts'
 import { getMetrics, getMetricsContentType } from './metrics.ts'
+import { createRequestTransport } from './request-transport.ts'
 import { createTransloaditMcpServer } from './server.ts'
 import { buildServerCard, serverCardPath } from './server-card.ts'
 
@@ -68,7 +68,7 @@ export function createTransloaditMcpHttpHandler(
   options: TransloaditMcpHttpOptions = {},
 ): TransloaditMcpHttpHandler {
   const activeRequests = new Set<{
-    transport: StreamableHTTPServerTransport
+    transport: RequestTransport['transport']
     server: Awaited<ReturnType<typeof createTransloaditMcpServer>>
   }>()
   assertSingleAuthMode(options)
@@ -177,12 +177,7 @@ export function createTransloaditMcpHttpHandler(
     }
 
     const parsedBody = await readJsonBody(req)
-    const transport = new StreamableHTTPServerTransport({
-      sessionIdGenerator: undefined,
-      allowedOrigins: options.allowedOrigins,
-      allowedHosts: options.allowedHosts,
-      enableDnsRebindingProtection: options.enableDnsRebindingProtection,
-    })
+    const { transport, handle } = createRequestTransport(options)
     const server = createTransloaditMcpServer(options)
     const activeRequest = { transport, server }
     activeRequests.add(activeRequest)
@@ -195,7 +190,7 @@ export function createTransloaditMcpHttpHandler(
     await server.connect(transport)
 
     try {
-      await transport.handleRequest(req, res, parsedBody)
+      await handle(req, res, parsedBody)
     } catch {
       if (!res.headersSent) {
         res.statusCode = 500
diff --git a/packages/mcp-server/src/request-transport.ts b/packages/mcp-server/src/request-transport.ts
new file mode 100644
index 00000000..afe48f79
--- /dev/null
+++ b/packages/mcp-server/src/request-transport.ts
@@ -0,0 +1,114 @@
+import type { IncomingMessage, ServerResponse } from 'node:http'
+
+import type { Transport } from '@modelcontextprotocol/sdk/shared/transport.js'
+
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js'
+import { WebStandardStreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js'
+
+type RequestTransportOptions = {
+  resourceMetadataUrl?: string
+  allowedHosts?: string[]
+  enableDnsRebindingProtection?: boolean
+}
+
+/** A per-request MCP transport plus the function that serves the HTTP request through it. */
+export type RequestTransport = {
+  transport: Transport
+  handle: (req: IncomingMessage, res: ServerResponse, parsedBody: unknown) => Promise<void>
+}
+
+type UpstreamChallenge = { status: 401 | 403; header: string }
+
+const isRecord = (value: unknown): value is Record<string, unknown> =>
+  typeof value === 'object' && value !== null && !Array.isArray(value)
+
+const parseJson = (text: string): unknown => {
+  try {
+    return JSON.parse(text)
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * Finds the challenge a tool attached after API2 rejected the forwarded token. Tool results are
+ * the only place that knows, because API2 checks the token when a tool calls it.
+ */
+const findUpstreamChallenge = (body: string): UpstreamChallenge | undefined => {
+  const parsed = parseJson(body)
+  const messages = Array.isArray(parsed) ? parsed : [parsed]
+  for (const message of messages) {
+    if (!isRecord(message) || !isRecord(message.result)) continue
+    const { result } = message
+    if (result.isError !== true || !isRecord(result._meta)) continue
+    const challenges = result._meta['mcp/www_authenticate']
+    const header = Array.isArray(challenges)
+      ? challenges.find((challenge) => typeof challenge === 'string')
+      : undefined
+    if (typeof header !== 'string') continue
+    if (header.includes('error="invalid_token"')) return { status: 401, header }
+    if (header.includes('error="insufficient_scope"')) return { status: 403, header }
+  }
+  return undefined
+}
+
+const toWebRequest = (req: IncomingMessage): Request => {
+  const headers = new Headers()
+  for (const [name, value] of Object.entries(req.headers)) {
+    if (value === undefined) continue
+    for (const entry of Array.isArray(value) ? value : [value]) headers.append(name, entry)
+  }
+  // The transport reads only headers and the pre-parsed body, so a fixed base URL is enough.
+  return new Request(new URL(req.url ?? '/', 'http://localhost'), { method: req.method, headers })
+}
+
+/**
+ * Serves a hosted request through the SDK's web-standard transport in JSON mode, so the status is
+ * decided after the tool ran: MCP OAuth clients refresh only on HTTP 401 and re-scope only on
+ * HTTP 403 `insufficient_scope`, and a tool result over HTTP 200 would keep them retrying a
+ * rejected token.
+ */
+const relayHostedRequest = async (
+  transport: WebStandardStreamableHTTPServerTransport,
+  req: IncomingMessage,
+  res: ServerResponse,
+  parsedBody: unknown,
+): Promise<void> => {
+  const response = await transport.handleRequest(toWebRequest(req), { parsedBody })
+  const body = await response.text()
+  const challenge = response.headers.get('content-type')?.includes('application/json')
+    ? findUpstreamChallenge(body)
+    : undefined
+  res.statusCode = challenge?.status ?? response.status
+  for (const [name, value] of response.headers) res.setHeader(name, value)
+  if (challenge) res.setHeader('WWW-Authenticate', challenge.header)
+  res.end(body)
+}
+
+/**
+ * Creates the stateless transport for one HTTP request. Origins are checked before this point by
+ * `applyCorsHeaders`, which understands `*.` and `:*` wildcards; the SDK compares origins
+ * literally, so it only receives the Host allowlist.
+ */
+export const createRequestTransport = (options: RequestTransportOptions): RequestTransport => {
+  const shared = {
+    sessionIdGenerator: undefined,
+    allowedHosts: options.allowedHosts,
+    enableDnsRebindingProtection: options.enableDnsRebindingProtection,
+  }
+  if (!options.resourceMetadataUrl) {
+    const transport = new StreamableHTTPServerTransport(shared)
+    return {
+      transport,
+      handle: (req, res, parsedBody) => transport.handleRequest(req, res, parsedBody),
+    }
+  }
+  const transport = new WebStandardStreamableHTTPServerTransport({
+    ...shared,
+    enableJsonResponse: true,
+  })
+  return {
+    transport,
+    handle: (req, res, parsedBody) => relayHostedRequest(transport, req, res, parsedBody),
+  }
+}
diff --git a/packages/mcp-server/src/server.ts b/packages/mcp-server/src/server.ts
index 98f4a4c4..b6ab2a8d 100644
--- a/packages/mcp-server/src/server.ts
+++ b/packages/mcp-server/src/server.ts
@@ -362,6 +362,8 @@ type AuthErrorInput = {
   oauthError: 'invalid_token' | 'insufficient_scope'
   message: string
   hint?: string
+  /** Scopes to request again; only meaningful for `insufficient_scope`. */
+  scopes?: string[]
 }
 
 /**
@@ -384,6 +386,7 @@ const buildAuthError = (
           buildBearerChallenge({
             resourceMetadataUrl: options.resourceMetadataUrl,
             error: { code: input.oauthError, description: input.message },
+            scopes: input.scopes,
           }),
         ],
       },
@@ -539,6 +542,7 @@ const toAuthRejection = (
   options: TransloaditMcpServerOptions,
   error: unknown,
   credentials: CredentialKind,
+  scopes: string[],
 ): CallToolResult | undefined => {
   const status = getHttpStatusCode(error)
   const scopeRejected =
@@ -573,6 +577,7 @@ const toAuthRejection = (
       oauthError: 'insufficient_scope',
       message: 'The connected credentials lack the scope this tool needs.',
       hint: 'Reconnect your Transloadit account and grant the requested access.',
+      scopes,
     })
   }
   if (error instanceof ApiError && error.code === 'INVALID_SIGNATURE') {
@@ -605,24 +610,35 @@ const buildSignatureError = (error: ApiError): CallToolResult => {
   })
 }
 
-const trimTrailingSlash = (value: string): string => value.replace(/\/$/, '')
+/** The Console origin and base path without a trailing slash, or `undefined` when unusable. */
+const parseConsoleUrl = (value: string): string | undefined => {
+  if (!URL.canParse(value)) return undefined
+  const url = new URL(value)
+  if (url.protocol !== 'https:' && url.protocol !== 'http:') return undefined
+  return `${url.origin}${url.pathname}`.replace(/\/$/, '')
+}
 
 /** Widget-only context: whether the caller is signed in and where the Console deep links go. */
 const buildWidgetContext = (
   options: TransloaditMcpServerOptions,
   assembly: AssemblyStatus,
 ): WidgetContext => {
-  const consoleUrl = trimTrailingSlash(options.consoleUrl || defaultConsoleUrl)
+  // Links are a convenience: a malformed consoleUrl must not turn an Assembly that was already
+  // created into a failed call, which would invite a retry that processes the files twice.
+  const consoleUrl = parseConsoleUrl(options.consoleUrl || defaultConsoleUrl)
   const slug = isNonEmptyString(assembly.account_slug) ? assembly.account_slug : undefined
   const assemblyId = isNonEmptyString(assembly.assembly_id) ? assembly.assembly_id : undefined
   const templateId = isNonEmptyString(assembly.template_id) ? assembly.template_id : undefined
-  if (!slug) return { authenticated: true }
+  if (!slug || !consoleUrl) return { authenticated: true }
 
   const workspaceUrl = `${consoleUrl}/c/${encodeURIComponent(slug)}`
   const newTemplateUrl = new URL(`${workspaceUrl}/templates/new`)
   // `fromAssembly` lets the Console seed the editor with the Assembly's effective instructions,
-  // overrides included; Content's new-Template page still has to learn that parameter.
-  // `duplicateFrom` is what that page resolves today, so Template-based runs keep a useful seed.
+  // overrides included. Content's new-Template page does not resolve it yet (Content follow-up to
+  // PR #529, routed 2026-10-02); until then inline runs open an empty editor and Template-based
+  // runs are seeded through `duplicateFrom`, without the run's overrides. The action stays visible
+  // on purpose: it already lands signed-in callers in the right Workspace, and the Console gains
+  // the seeding without another MCP release.
   if (assemblyId) {
     newTemplateUrl.searchParams.set('fromAssembly', assemblyId)
   }
@@ -879,8 +895,9 @@ const resolveWorkspaceProfile = async (
     }
   }
 
+  // API2's default Template list fields omit account_id, so request it explicitly.
   const templates = listTemplatesResponseSchema.safeParse(
-    await client.listTemplates({ pagesize: 1 }),
+    await client.listTemplates({ pagesize: 1, fields: ['id', 'account_id'] }),
   )
   const template = templates.success ? templates.data.items?.[0] : undefined
   if (template && isNonEmptyString(template.account_id)) {
@@ -1249,7 +1266,12 @@ export const createTransloaditMcpServer = (
           { meta: { [widgetContextMetaKey]: buildWidgetContext(options, assembly) } },
         )
       } catch (error) {
-        const rejection = toAuthRejection(options, error, credentials)
+        const rejection = toAuthRejection(
+          options,
+          error,
+          credentials,
+          toolMetadata.transloadit_create_assembly.scopes,
+        )
         if (rejection) return rejection
         throw error
       } finally {
@@ -1270,7 +1292,12 @@ export const createTransloaditMcpServer = (
       try {
         assembly = await access.client.getAssembly(access.assemblyId)
       } catch (error) {
-        const rejection = toAuthRejection(options, error, access.credentials)
+        const rejection = toAuthRejection(
+          options,
+          error,
+          access.credentials,
+          toolMetadata.transloadit_get_assembly_status.scopes,
+        )
         if (rejection) return rejection
         throw error
       }
@@ -1299,7 +1326,12 @@ export const createTransloaditMcpServer = (
           assemblyUrl: access.assemblyUrl,
         })
       } catch (error) {
-        const rejection = toAuthRejection(options, error, access.credentials)
+        const rejection = toAuthRejection(
+          options,
+          error,
+          access.credentials,
+          toolMetadata.transloadit_wait_for_assembly.scopes,
+        )
         if (rejection) return rejection
         throw error
       }
@@ -1442,7 +1474,12 @@ export const createTransloaditMcpServer = (
           total: parsed.data.count ?? items.length,
         })
       } catch (error) {
-        const rejection = toAuthRejection(options, error, liveClient.credentials)
+        const rejection = toAuthRejection(
+          options,
+          error,
+          liveClient.credentials,
+          toolMetadata.transloadit_list_templates.scopes,
+        )
         if (rejection) return rejection
         const message = error instanceof Error ? error.message : 'Failed to list templates.'
         return buildToolResponse({
@@ -1471,7 +1508,12 @@ export const createTransloaditMcpServer = (
       try {
         profile = await resolveWorkspaceProfile(liveClient.client)
       } catch (error) {
-        const rejection = toAuthRejection(options, error, liveClient.credentials)
+        const rejection = toAuthRejection(
+          options,
+          error,
+          liveClient.credentials,
+          toolMetadata.transloadit_get_profile.scopes,
+        )
         if (rejection) return rejection
         throw error
       }
diff --git a/packages/mcp-server/src/ui/assembly-result-widget.ts b/packages/mcp-server/src/ui/assembly-result-widget.ts
index bb4dd026..ecba82bb 100644
--- a/packages/mcp-server/src/ui/assembly-result-widget.ts
+++ b/packages/mcp-server/src/ui/assembly-result-widget.ts
@@ -188,20 +188,19 @@ export const assemblyResultWidgetHtml = `<!doctype html>
     return false
   }
 
-  const linkButton = (label, url, secondary) => {
-    const anchor = el('a', {
-      className: secondary ? 'button secondary' : 'button',
-      href: url,
-      target: '_blank',
-      rel: 'noopener noreferrer',
-      text: label,
-    })
+  // Sandboxed frames often block popups and downloads, so every outgoing link goes through the
+  // host when it offers ui/open-link (or ChatGPT's openExternal).
+  const hostLink = (props, url) => {
+    const anchor = el('a', { href: url, target: '_blank', rel: 'noopener noreferrer', ...props })
     anchor.addEventListener('click', (event) => {
       if (openWithHost(url)) event.preventDefault()
     })
     return anchor
   }
 
+  const linkButton = (label, url, secondary) =>
+    hostLink({ className: secondary ? 'button secondary' : 'button', text: label }, url)
+
   // Result files can land on the public bucket a moment after the Assembly reports completion,
   // and a failed <img>/<video> never retries by itself.
   const previewRetryDelays = [1000, 3000, 6000]
@@ -251,7 +250,7 @@ export const assemblyResultWidgetHtml = `<!doctype html>
     const caption = el('figcaption', {}, [
       el('span', { className: 'name', text: name }),
       el('span', { className: 'muted', text: details.join(' · ') }),
-      url ? el('div', {}, [el('a', { href: url, target: '_blank', rel: 'noopener noreferrer', download: '', text: 'Download ' + name })]) : null,
+      url ? el('div', {}, [hostLink({ download: '', text: 'Download ' + name }, url)]) : null,
     ])
     return el('figure', {}, [preview(isRecord(file) ? file : {}), caption])
   }
diff --git a/packages/mcp-server/test/unit/auth-errors.test.ts b/packages/mcp-server/test/unit/auth-errors.test.ts
index 01a810eb..6ba1ef80 100644
--- a/packages/mcp-server/test/unit/auth-errors.test.ts
+++ b/packages/mcp-server/test/unit/auth-errors.test.ts
@@ -84,22 +84,6 @@ describe('tool auth errors', () => {
     )
   })
 
-  it('includes the resource metadata URL in the challenge when hosted', async () => {
-    serverOptions.resourceMetadataUrl = resourceMetadataUrl
-    vi.spyOn(Transloadit.prototype, 'listTemplates').mockRejectedValue(apiRejection(401))
-    await connect({ Authorization: 'Bearer expired-token' })
-
-    const result = await client.callTool({ name: 'transloadit_list_templates', arguments: {} })
-    expect(result.isError).toBe(true)
-    expect(result.structuredContent).toMatchObject({
-      status: 'error',
-      errors: [{ code: 'mcp_auth_rejected' }],
-    })
-    expect(wwwAuthenticate(result)).toBe(
-      `Bearer resource_metadata="${resourceMetadataUrl}", error="invalid_token", error_description="Transloadit rejected the credentials; the token may have expired."`,
-    )
-  })
-
   it('reports rejected tokens on Assembly tools without leaking the API response', async () => {
     vi.spyOn(Transloadit.prototype, 'getAssembly').mockRejectedValue(apiRejection(401))
     await connect({ Authorization: 'Bearer expired-token' })
@@ -196,10 +180,20 @@ describe('profile tool', () => {
 
   it('falls back to an owned Template when no Assembly exists', async () => {
     vi.spyOn(Transloadit.prototype, 'listAssemblies').mockResolvedValue({ items: [], count: 0 })
-    vi.spyOn(Transloadit.prototype, 'listTemplates').mockResolvedValue({
-      items: [{ id: 'tpl_1', name: 'resize', content: {}, account_id: 'ws_2' }],
-      count: 1,
-    })
+    // API2's default Template list fields omit account_id; it is returned only when requested.
+    vi.spyOn(Transloadit.prototype, 'listTemplates').mockImplementation((params) =>
+      Promise.resolve({
+        items: [
+          {
+            id: 'tpl_1',
+            name: 'resize',
+            content: {},
+            ...(params?.fields?.includes('account_id') ? { account_id: 'ws_2' } : {}),
+          },
+        ],
+        count: 1,
+      }),
+    )
 
     const result = await client.callTool({ name: 'transloadit_get_profile', arguments: {} })
     expect(result.structuredContent).toEqual({ id: 'ws_2' })
diff --git a/packages/mcp-server/test/unit/file-inputs.test.ts b/packages/mcp-server/test/unit/file-inputs.test.ts
index a72ca360..dbe0ddf8 100644
--- a/packages/mcp-server/test/unit/file-inputs.test.ts
+++ b/packages/mcp-server/test/unit/file-inputs.test.ts
@@ -40,6 +40,7 @@ describe('MCP file inputs', () => {
     delete serverOptions.authSecret
     delete serverOptions.endpoint
     delete serverOptions.mcpToken
+    delete serverOptions.consoleUrl
     fixtureDirectory = await mkdtemp(join(tmpdir(), 'mcp-test-'))
     fixturePath = join(fixtureDirectory, 'fixture.txt')
     await writeFile(fixturePath, fixtureContent)
@@ -699,4 +700,25 @@ describe('MCP file inputs', () => {
       },
     })
   })
+
+  it('still returns the Assembly when the Console URL is malformed', async () => {
+    serverOptions.consoleUrl = 'not a url'
+    vi.mocked(Transloadit.prototype.createAssembly).mockResolvedValue({
+      ok: 'ASSEMBLY_COMPLETED',
+      assembly_id: assemblyId,
+      account_slug: 'acme',
+    })
+    const result = await client.callTool({
+      name: 'transloadit_create_assembly',
+      arguments: {
+        instructions: { steps: { resized: { robot: '/image/resize', width: 1 } } },
+        wait_for_completion: true,
+      },
+    })
+    expect(result.structuredContent).toMatchObject({
+      status: 'ok',
+      assembly: { assembly_id: assemblyId },
+    })
+    expect(result._meta).toEqual({ 'transloadit/widget': { authenticated: true } })
+  })
 })
diff --git a/packages/mcp-server/test/unit/hosted-auth.test.ts b/packages/mcp-server/test/unit/hosted-auth.test.ts
index 72c32615..a4d67f5a 100644
--- a/packages/mcp-server/test/unit/hosted-auth.test.ts
+++ b/packages/mcp-server/test/unit/hosted-auth.test.ts
@@ -303,3 +303,43 @@ describe('matchesOriginPattern', () => {
     expect(matchesOriginPattern(origin, pattern)).toBe(expected)
   })
 })
+
+describe('wildcard origins with DNS rebinding protection', () => {
+  it.each([
+    ['self-hosted', {}],
+    ['hosted', { resourceMetadataUrl }],
+  ])('accepts a %s wildcard origin match while still checking the Host', async (_mode, mode) => {
+    const options: Parameters<typeof createTransloaditMcpHttpHandler>[0] = {
+      metricsPath: false,
+      allowedOrigins: ['http://localhost:*'],
+      enableDnsRebindingProtection: true,
+      ...mode,
+    }
+    const handler = createTransloaditMcpHttpHandler(options)
+    const server = createServer((req, res) => {
+      void handler(req, res)
+    })
+    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve))
+    const { port } = server.address() as AddressInfo
+    options.allowedHosts = [`127.0.0.1:${port}`]
+    const url = new URL(`http://127.0.0.1:${port}/mcp`)
+
+    const allowed = await post(url, {
+      Origin: 'http://localhost:6274',
+      Authorization: 'Bearer token',
+    })
+    expect(allowed.status).toBe(200)
+
+    options.allowedHosts = ['api2.transloadit.com']
+    const wrongHost = await post(url, {
+      Origin: 'http://localhost:6274',
+      Authorization: 'Bearer token',
+    })
+    expect(wrongHost.status).toBe(403)
+
+    await handler.close()
+    await new Promise<void>((resolve, reject) =>
+      server.close((error) => (error ? reject(error) : resolve())),
+    )
+  })
+})
diff --git a/packages/mcp-server/test/unit/plugin-manifest.test.ts b/packages/mcp-server/test/unit/plugin-manifest.test.ts
new file mode 100644
index 00000000..358967e5
--- /dev/null
+++ b/packages/mcp-server/test/unit/plugin-manifest.test.ts
@@ -0,0 +1,48 @@
+import { readFile } from 'node:fs/promises'
+import { fileURLToPath } from 'node:url'
+
+import { describe, expect, it } from 'vitest'
+import { z } from 'zod'
+
+const packageRoot = fileURLToPath(new URL('../../', import.meta.url))
+
+const interfaceSchema = z.object({
+  composerIcon: z.string(),
+  logo: z.string(),
+  screenshots: z.array(z.string()),
+})
+
+const readJson = async (path: string): Promise<unknown> =>
+  JSON.parse(await readFile(new URL(path, `file://${packageRoot}`), 'utf8'))
+
+const pngSignature = [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]
+
+/** Plugin submission rejects manifests whose asset paths do not resolve to images. */
+const expectPng = async (assetPath: string): Promise<void> => {
+  const bytes = await readFile(new URL(assetPath, `file://${packageRoot}`))
+  expect([...bytes.subarray(0, 8)], assetPath).toEqual(pngSignature)
+}
+
+describe('plugin manifests', () => {
+  it('ship every image the ChatGPT manifest references', async () => {
+    const manifest = z
+      .object({ extensions: z.object({ 'com.openai': z.object({ interface: interfaceSchema }) }) })
+      .parse(await readJson('plugin.json'))
+    const { composerIcon, logo, screenshots } = manifest.extensions['com.openai'].interface
+
+    await expectPng(composerIcon)
+    await expectPng(logo)
+    await Promise.all(screenshots.map(expectPng))
+  })
+
+  it('ship every image the Codex manifest references', async () => {
+    const manifest = z
+      .object({ interface: interfaceSchema })
+      .parse(await readJson('.codex-plugin/plugin.json'))
+    const { composerIcon, logo, screenshots } = manifest.interface
+
+    await expectPng(composerIcon)
+    await expectPng(logo)
+    await Promise.all(screenshots.map(expectPng))
+  })
+})
diff --git a/packages/mcp-server/test/unit/upstream-auth-status.test.ts b/packages/mcp-server/test/unit/upstream-auth-status.test.ts
new file mode 100644
index 00000000..cfaf4301
--- /dev/null
+++ b/packages/mcp-server/test/unit/upstream-auth-status.test.ts
@@ -0,0 +1,100 @@
+import type { AddressInfo } from 'node:net'
+
+import type { TransloaditMcpHttpOptions } from '../../src/http.ts'
+
+import { createServer } from 'node:http'
+
+import nock from 'nock'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+
+import { createTransloaditMcpHttpHandler } from '../../src/http.ts'
+
+const resourceMetadataUrl = 'https://api2.transloadit.com/.well-known/oauth-protected-resource/mcp'
+const endpoint = 'https://api2.transloadit.com'
+
+const listTemplatesCall = JSON.stringify({
+  jsonrpc: '2.0',
+  id: 1,
+  method: 'tools/call',
+  params: { name: 'transloadit_list_templates', arguments: {} },
+})
+
+/**
+ * MCP OAuth clients refresh a token only on HTTP 401 and re-scope only on HTTP 403 with
+ * `error="insufficient_scope"`, so an upstream rejection of a forwarded token must surface at the
+ * HTTP level, not only inside the tool result.
+ */
+describe('upstream token rejections over HTTP', () => {
+  const serverOptions: TransloaditMcpHttpOptions = { metricsPath: false }
+  const handler = createTransloaditMcpHttpHandler(serverOptions)
+  const httpServer = createServer((req, res) => {
+    void handler(req, res)
+  })
+  let url: URL
+
+  const callListTemplates = (): Promise<Response> =>
+    fetch(url, {
+      method: 'POST',
+      headers: {
+        Authorization: 'Bearer expired-oauth-token',
+        'Content-Type': 'application/json',
+        Accept: 'application/json, text/event-stream',
+        'Mcp-Protocol-Version': '2025-06-18',
+      },
+      body: listTemplatesCall,
+    })
+
+  beforeEach(async () => {
+    delete serverOptions.resourceMetadataUrl
+    await new Promise<void>((resolve) => httpServer.listen(0, '127.0.0.1', resolve))
+    const { port } = httpServer.address() as AddressInfo
+    url = new URL(`http://127.0.0.1:${port}/mcp`)
+  })
+
+  afterEach(async () => {
+    await handler.close()
+    await new Promise<void>((resolve, reject) =>
+      httpServer.close((error) => (error ? reject(error) : resolve())),
+    )
+    nock.cleanAll()
+  })
+
+  it('answers 401 with an invalid_token challenge when API2 rejects a hosted token', async () => {
+    serverOptions.resourceMetadataUrl = resourceMetadataUrl
+    nock(endpoint).get('/templates').query(true).reply(401, { error: 'BEARER_TOKEN_EXPIRED' })
+
+    const response = await callListTemplates()
+    expect(response.status).toBe(401)
+    expect(response.headers.get('www-authenticate')).toBe(
+      `Bearer resource_metadata="${resourceMetadataUrl}", error="invalid_token", error_description="Transloadit rejected the credentials; the token may have expired."`,
+    )
+  })
+
+  it('answers 403 with the tool scopes when API2 rejects a hosted token for scope', async () => {
+    serverOptions.resourceMetadataUrl = resourceMetadataUrl
+    nock(endpoint).get('/templates').query(true).reply(403, { error: 'INSUFFICIENT_AUTH_SCOPE' })
+
+    const response = await callListTemplates()
+    expect(response.status).toBe(403)
+    expect(response.headers.get('www-authenticate')).toBe(
+      `Bearer resource_metadata="${resourceMetadataUrl}", error="insufficient_scope", error_description="The connected credentials lack the scope this tool needs.", scope="templates:read"`,
+    )
+  })
+
+  it('keeps successful hosted calls at 200', async () => {
+    serverOptions.resourceMetadataUrl = resourceMetadataUrl
+    nock(endpoint).get('/templates').query(true).reply(200, { items: [], count: 0 })
+
+    const response = await callListTemplates()
+    expect(response.status).toBe(200)
+    expect(await response.text()).toContain('"status":"ok"')
+  })
+
+  it('keeps self-hosted rejections as tool errors over HTTP 200', async () => {
+    nock(endpoint).get('/templates').query(true).reply(401, { error: 'BEARER_TOKEN_EXPIRED' })
+
+    const response = await callListTemplates()
+    expect(response.status).toBe(200)
+    expect(await response.text()).toContain('mcp_auth_rejected')
+  })
+})
diff --git a/packages/mcp-server/test/unit/widget-handshake.test.ts b/packages/mcp-server/test/unit/widget-handshake.test.ts
index 29382e2e..e6147ddc 100644
--- a/packages/mcp-server/test/unit/widget-handshake.test.ts
+++ b/packages/mcp-server/test/unit/widget-handshake.test.ts
@@ -150,6 +150,37 @@ describe('assembly result widget handshake (MCP Apps 2026-01-26)', () => {
     expect(widget.appText()).toContain('Open in Console')
   })
 
+  it('opens download links through the host so sandboxed frames can still download', async () => {
+    await initialize()
+    await widget.fromHost({
+      jsonrpc: '2.0',
+      method: 'ui/notifications/tool-result',
+      params: {
+        structuredContent: {
+          status: 'ok',
+          assembly: {
+            ok: 'ASSEMBLY_COMPLETED',
+            assembly_id: 'abc123',
+            results: {
+              resized: [
+                { name: 'clip.mp4', mime: 'video/mp4', ssl_url: 'https://pub-123.r2.dev/clip.mp4' },
+              ],
+            },
+          },
+        },
+      },
+    })
+
+    const link = widget.window.document.querySelector('a[download]')
+    const click = new widget.window.MouseEvent('click', { bubbles: true, cancelable: true })
+    link?.dispatchEvent(click)
+
+    expect(click.defaultPrevented).toBe(true)
+    expect(widget.sent.find((message) => message.method === 'ui/open-link')).toMatchObject({
+      params: { url: 'https://pub-123.r2.dev/clip.mp4' },
+    })
+  })
+
   it('shows the error text of a failed tool call instead of waiting forever', async () => {
     await initialize()
     await widget.fromHost({
diff --git a/packages/node/src/apiTypes.ts b/packages/node/src/apiTypes.ts
index 675d6c20..4a20115d 100644
--- a/packages/node/src/apiTypes.ts
+++ b/packages/node/src/apiTypes.ts
@@ -100,6 +100,8 @@ export type ListTemplatesParams = OptionalAuthParams & {
   todate?: string
   keywords?: string[]
   include_builtin?: 'all' | 'latest' | 'exclusively-all' | 'exclusively-latest'
+  /** Template columns to return, such as `['id', 'account_id']`; API2's default omits some. */
+  fields?: string[]
 }
 
 interface TemplateResponseBase {

From ad026fe4aaeecf5b20fc0ea9dcac824443ff9118 Mon Sep 17 00:00:00 2001
From: Kevin van Zonneveld <kevin@vanzonneveld.net>
Date: Fri, 2 Oct 2026 15:36:34 +0200
Subject: [PATCH 13/27] Address council review run 3: no batch replays, exact
 scope errors

Council review of PR #529 (run 3), each fix preceded by a failing test:

- A hosted JSON-RPC batch keeps HTTP 200 even when one item's token is rejected; a 401 would make
  the client replay the whole batch, including calls that succeeded (Assemblies charged twice).
  The failed items still carry their challenge in `_meta`.
- Only `INSUFFICIENT_AUTH_SCOPE` counts as a scope rejection. `BEARER_TOKEN_AUTH_KEY_MISMATCH`
  becomes `mcp_auth_key_mismatch` with advice to drop `auth.key`, since reauthorizing cannot fix it.
- The profile tool treats the latest Assembly's details as optional, so an unreadable Assembly no
  longer hides the Workspace id or skips the Template fallback.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 packages/mcp-server/src/request-transport.ts  | 10 ++-
 packages/mcp-server/src/server.ts             | 16 ++++-
 .../mcp-server/test/unit/auth-errors.test.ts  | 12 ++++
 .../test/unit/upstream-auth-status.test.ts    | 66 +++++++++++++++++++
 4 files changed, 99 insertions(+), 5 deletions(-)

diff --git a/packages/mcp-server/src/request-transport.ts b/packages/mcp-server/src/request-transport.ts
index afe48f79..f936b2ee 100644
--- a/packages/mcp-server/src/request-transport.ts
+++ b/packages/mcp-server/src/request-transport.ts
@@ -76,9 +76,13 @@ const relayHostedRequest = async (
 ): Promise<void> => {
   const response = await transport.handleRequest(toWebRequest(req), { parsedBody })
   const body = await response.text()
-  const challenge = response.headers.get('content-type')?.includes('application/json')
-    ? findUpstreamChallenge(body)
-    : undefined
+  // A client retries the whole HTTP request after re-authorizing, so a batch keeps its 200: the
+  // other calls may have succeeded (an Assembly created twice would be charged twice). Its failed
+  // items still carry the challenge in `_meta["mcp/www_authenticate"]`.
+  const challenge =
+    !Array.isArray(parsedBody) && response.headers.get('content-type')?.includes('application/json')
+      ? findUpstreamChallenge(body)
+      : undefined
   res.statusCode = challenge?.status ?? response.status
   for (const [name, value] of response.headers) res.setHeader(name, value)
   if (challenge) res.setHeader('WWW-Authenticate', challenge.header)
diff --git a/packages/mcp-server/src/server.ts b/packages/mcp-server/src/server.ts
index b6ab2a8d..54c1d4a2 100644
--- a/packages/mcp-server/src/server.ts
+++ b/packages/mcp-server/src/server.ts
@@ -545,8 +545,18 @@ const toAuthRejection = (
   scopes: string[],
 ): CallToolResult | undefined => {
   const status = getHttpStatusCode(error)
+  // The token or key is valid but names a different Auth Key than the instructions'
+  // `auth.key`; reconnecting cannot fix that, so it is reported like any other bad argument.
+  if (error instanceof ApiError && error.code === 'BEARER_TOKEN_AUTH_KEY_MISMATCH') {
+    return buildCredentialError({
+      code: 'mcp_auth_key_mismatch',
+      message: 'The instructions name a different Auth Key than the connected credentials.',
+      hint: 'Remove auth.key from the instructions; the connected credentials supply it.',
+    })
+  }
+  // INSUFFICIENT_AUTH_SCOPE is API2's only scope rejection.
   const scopeRejected =
-    status === 403 && error instanceof ApiError && /SCOPE|BEARER_TOKEN/.test(error.code ?? '')
+    status === 403 && error instanceof ApiError && error.code === 'INSUFFICIENT_AUTH_SCOPE'
   // Only forwarded tokens can be renewed by the host's account linking; an Auth Key configured
   // on the server needs an operator, so it gets no OAuth challenge.
   if (credentials === 'auth-key') {
@@ -884,7 +894,9 @@ const resolveWorkspaceProfile = async (
   const assemblies = await client.listAssemblies({ pagesize: 1 })
   const latest = assemblies.items[0]
   if (latest?.id) {
-    const status = await client.getAssembly(latest.id)
+    // The details only add the Workspace name; an expired or unreadable Assembly must not hide
+    // the id the list already returned, nor skip the Template fallback.
+    const status: Partial<AssemblyStatus> = await client.getAssembly(latest.id).catch(() => ({}))
     const id = isNonEmptyString(status.account_id) ? status.account_id : latest.account_id
     if (isNonEmptyString(id)) {
       return {
diff --git a/packages/mcp-server/test/unit/auth-errors.test.ts b/packages/mcp-server/test/unit/auth-errors.test.ts
index 6ba1ef80..f452e667 100644
--- a/packages/mcp-server/test/unit/auth-errors.test.ts
+++ b/packages/mcp-server/test/unit/auth-errors.test.ts
@@ -178,6 +178,18 @@ describe('profile tool', () => {
     expect(result.structuredContent).toEqual({ id: 'ws_1', name: 'Acme Media', nickname: 'acme' })
   })
 
+  it('keeps the Workspace id when the latest Assembly details are unavailable', async () => {
+    vi.spyOn(Transloadit.prototype, 'listAssemblies').mockResolvedValue({
+      items: [{ id: 'abcdef', account_id: 'ws_1' }],
+      count: 1,
+    })
+    vi.spyOn(Transloadit.prototype, 'getAssembly').mockRejectedValue(apiRejection(404))
+
+    const result = await client.callTool({ name: 'transloadit_get_profile', arguments: {} })
+    expect(result.isError).toBeFalsy()
+    expect(result.structuredContent).toEqual({ id: 'ws_1' })
+  })
+
   it('falls back to an owned Template when no Assembly exists', async () => {
     vi.spyOn(Transloadit.prototype, 'listAssemblies').mockResolvedValue({ items: [], count: 0 })
     // API2's default Template list fields omit account_id; it is returned only when requested.
diff --git a/packages/mcp-server/test/unit/upstream-auth-status.test.ts b/packages/mcp-server/test/unit/upstream-auth-status.test.ts
index cfaf4301..792d8058 100644
--- a/packages/mcp-server/test/unit/upstream-auth-status.test.ts
+++ b/packages/mcp-server/test/unit/upstream-auth-status.test.ts
@@ -90,6 +90,72 @@ describe('upstream token rejections over HTTP', () => {
     expect(await response.text()).toContain('"status":"ok"')
   })
 
+  it('keeps a batch at 200 so a client never replays the calls that already succeeded', async () => {
+    serverOptions.resourceMetadataUrl = resourceMetadataUrl
+    nock(endpoint).get('/templates').query(true).reply(401, { error: 'BEARER_TOKEN_EXPIRED' })
+
+    const response = await fetch(url, {
+      method: 'POST',
+      headers: {
+        Authorization: 'Bearer expired-oauth-token',
+        'Content-Type': 'application/json',
+        Accept: 'application/json, text/event-stream',
+      },
+      body: JSON.stringify([
+        {
+          jsonrpc: '2.0',
+          id: 1,
+          method: 'tools/call',
+          params: { name: 'transloadit_list_robots', arguments: { limit: 1 } },
+        },
+        { ...JSON.parse(listTemplatesCall), id: 2 },
+      ]),
+    })
+    expect(response.status).toBe(200)
+    expect(response.headers.get('www-authenticate')).toBeNull()
+    const body = await response.text()
+    expect(body).toContain('"status":"ok"')
+    expect(body).toContain('mcp_auth_rejected')
+  })
+
+  it('reports an Auth Key mismatch as a tool error, not an OAuth challenge', async () => {
+    serverOptions.resourceMetadataUrl = resourceMetadataUrl
+    nock(endpoint)
+      .post(/\/assemblies/)
+      .reply(403, {
+        error: 'BEARER_TOKEN_AUTH_KEY_MISMATCH',
+        message: 'Bearer token auth key mismatch',
+      })
+
+    const response = await fetch(url, {
+      method: 'POST',
+      headers: {
+        Authorization: 'Bearer expired-oauth-token',
+        'Content-Type': 'application/json',
+        Accept: 'application/json, text/event-stream',
+      },
+      body: JSON.stringify({
+        jsonrpc: '2.0',
+        id: 1,
+        method: 'tools/call',
+        params: {
+          name: 'transloadit_create_assembly',
+          arguments: {
+            instructions: {
+              auth: { key: 'another-auth-key' },
+              steps: { resized: { robot: '/image/resize', width: 1 } },
+            },
+          },
+        },
+      }),
+    })
+    expect(response.status).toBe(200)
+    expect(response.headers.get('www-authenticate')).toBeNull()
+    const body = await response.text()
+    expect(body).toContain('mcp_auth_key_mismatch')
+    expect(body).not.toContain('mcp/www_authenticate')
+  })
+
   it('keeps self-hosted rejections as tool errors over HTTP 200', async () => {
     nock(endpoint).get('/templates').query(true).reply(401, { error: 'BEARER_TOKEN_EXPIRED' })
 

From 6241b13e4a054c5521831bc4968547f9f8fdaa25 Mon Sep 17 00:00:00 2001
From: Kevin van Zonneveld <kevin@vanzonneveld.net>
Date: Fri, 2 Oct 2026 16:01:15 +0200
Subject: [PATCH 14/27] Address council review run 4: no replayed creates, safe
 redirects, raw bodies

Council review of PR #529 (run 4), each fix preceded by a failing test:

- When API2 rejects the token after it accepted the creation request (a token expiring while
  `wait_for_completion` polls), create_assembly returns `mcp_assembly_status_unavailable` with the
  Assembly URL instead of a challenge, so clients do not refresh and create a second Assembly. A
  rejected creation request still challenges.
- `extraHeaders` are dropped when a redirect leaves the API origin, as got already does for
  `Authorization`, so a relay secret cannot leak to another host.
- The hosted relay reads the request body itself when no body parser ran, so Express apps without
  `express.json()` keep working.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .changeset/mcp-upstream-header.md             |  1 +
 packages/mcp-server/src/request-transport.ts  | 28 +++++-
 packages/mcp-server/src/server.ts             | 87 ++++++++++++++-----
 .../test/unit/server-card-express.test.ts     | 44 ++++++++++
 .../test/unit/upstream-auth-status.test.ts    | 63 ++++++++++++++
 packages/node/src/Transloadit.ts              | 27 +++++-
 .../test/unit/extra-headers-redirect.test.ts  | 57 ++++++++++++
 7 files changed, 280 insertions(+), 27 deletions(-)
 create mode 100644 packages/node/test/unit/extra-headers-redirect.test.ts

diff --git a/.changeset/mcp-upstream-header.md b/.changeset/mcp-upstream-header.md
index 7a182cd7..bf663dd2 100644
--- a/.changeset/mcp-upstream-header.md
+++ b/.changeset/mcp-upstream-header.md
@@ -5,6 +5,7 @@
 
 Add an `extraHeaders` client option so trusted relays such as the hosted MCP service can send a
 fixed header (`Transloadit-Mcp-Upstream`) with every API request next to a forwarded bearer token.
+Like `Authorization`, these headers are dropped when a redirect leaves the API origin.
 
 `listTemplates()` also accepts `fields`, for API2 columns such as `account_id` that the default
 Template list omits.
diff --git a/packages/mcp-server/src/request-transport.ts b/packages/mcp-server/src/request-transport.ts
index f936b2ee..44a3324c 100644
--- a/packages/mcp-server/src/request-transport.ts
+++ b/packages/mcp-server/src/request-transport.ts
@@ -52,14 +52,32 @@ const findUpstreamChallenge = (body: string): UpstreamChallenge | undefined => {
   return undefined
 }
 
-const toWebRequest = (req: IncomingMessage): Request => {
+const readRawBody = async (req: IncomingMessage): Promise<string> => {
+  const chunks: Buffer[] = []
+  for await (const chunk of req) {
+    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk))
+  }
+  return Buffer.concat(chunks).toString('utf8')
+}
+
+const toWebRequest = async (req: IncomingMessage, parsedBody: unknown): Promise<Request> => {
   const headers = new Headers()
   for (const [name, value] of Object.entries(req.headers)) {
     if (value === undefined) continue
     for (const entry of Array.isArray(value) ? value : [value]) headers.append(name, entry)
   }
-  // The transport reads only headers and the pre-parsed body, so a fixed base URL is enough.
-  return new Request(new URL(req.url ?? '/', 'http://localhost'), { method: req.method, headers })
+  // Without a body parser (an Express app lacking express.json()), the stream is still unread;
+  // hand it to the transport, which parses JSON itself when no parsed body is given.
+  const body =
+    parsedBody === undefined && req.method === 'POST' && !req.readableEnded
+      ? await readRawBody(req)
+      : undefined
+  // The transport reads only headers and the body, so a fixed base URL is enough.
+  return new Request(new URL(req.url ?? '/', 'http://localhost'), {
+    method: req.method,
+    headers,
+    body,
+  })
 }
 
 /**
@@ -74,7 +92,9 @@ const relayHostedRequest = async (
   res: ServerResponse,
   parsedBody: unknown,
 ): Promise<void> => {
-  const response = await transport.handleRequest(toWebRequest(req), { parsedBody })
+  const response = await transport.handleRequest(await toWebRequest(req, parsedBody), {
+    parsedBody,
+  })
   const body = await response.text()
   // A client retries the whole HTTP request after re-authorizing, so a batch keeps its 200: the
   // other calls may have succeeded (an Assembly created twice would be charged twice). Its failed
diff --git a/packages/mcp-server/src/server.ts b/packages/mcp-server/src/server.ts
index 54c1d4a2..5e5385ed 100644
--- a/packages/mcp-server/src/server.ts
+++ b/packages/mcp-server/src/server.ts
@@ -596,6 +596,34 @@ const toAuthRejection = (
   return undefined
 }
 
+/** True when the error came from the Assembly creation request itself, so nothing was created. */
+const isCreationRequestError = (error: unknown): boolean =>
+  error instanceof ApiError && error.cause?.options.method.toUpperCase() === 'POST'
+
+/** The Assembly exists, but its status could not be read with the caller's credentials. */
+const buildCreatedAssemblyUnavailable = (
+  options: TransloaditMcpServerOptions,
+  assemblyId: string,
+): CallToolResult => {
+  // Matches resolveAssemblyReference: the SDK's default when the endpoint is empty.
+  const assemblyUrl = `${options.endpoint || 'https://api2.transloadit.com'}/assemblies/${assemblyId}`
+  return buildToolResponse(
+    {
+      status: 'error',
+      assembly: { assembly_id: assemblyId, assembly_ssl_url: assemblyUrl },
+      errors: [
+        {
+          code: 'mcp_assembly_status_unavailable',
+          message:
+            'The Assembly was created, but Transloadit rejected the credentials while reading its status.',
+          hint: `Reconnect if needed, then call transloadit_get_assembly_status with assembly_url ${assemblyUrl} instead of creating it again.`,
+        },
+      ],
+    },
+    { isError: true },
+  )
+}
+
 /** A failed call caused by server-side credentials; an error result so strict outputs still pass. */
 const buildCredentialError = (error: {
   code: string
@@ -1211,30 +1239,45 @@ export const createTransloaditMcpServer = (
         const chunkSize = upload_chunk_size
 
         let assembly: Awaited<ReturnType<typeof client.createAssembly>>
+        let createdAssemblyId: string | undefined
         try {
-          assembly = reference
-            ? await client.resumeAssemblyUploads({
-                assemblyUrl: reference.assemblyUrl,
-                files: filesMap,
-                uploads: uploadsMap,
-                waitForCompletion,
-                timeout,
-                uploadConcurrency,
-                chunkSize,
-                uploadBehavior,
-              })
-            : await client.createAssembly({
-                params,
-                files: filesMap,
-                uploads: uploadsMap,
-                waitForCompletion,
-                timeout,
-                uploadConcurrency,
-                chunkSize,
-                uploadBehavior,
-                expectedUploads: expected_uploads,
-              })
+          if (reference) {
+            assembly = await client.resumeAssemblyUploads({
+              assemblyUrl: reference.assemblyUrl,
+              files: filesMap,
+              uploads: uploadsMap,
+              waitForCompletion,
+              timeout,
+              uploadConcurrency,
+              chunkSize,
+              uploadBehavior,
+            })
+          } else {
+            const creation = client.createAssembly({
+              params,
+              files: filesMap,
+              uploads: uploadsMap,
+              waitForCompletion,
+              timeout,
+              uploadConcurrency,
+              chunkSize,
+              uploadBehavior,
+              expectedUploads: expected_uploads,
+            })
+            createdAssemblyId = creation.assemblyId
+            assembly = await creation
+          }
         } catch (error) {
+          // Once API2 accepted the creation request, an auth failure (a token expiring while
+          // uploads or polling run) must not reach the client as a challenge: it would refresh and
+          // replay the call, creating and billing a second Assembly.
+          if (
+            createdAssemblyId &&
+            !isCreationRequestError(error) &&
+            toAuthRejection(options, error, credentials, [])
+          ) {
+            return buildCreatedAssemblyUnavailable(options, createdAssemblyId)
+          }
           if (isErrnoException(error) && error.code === 'ENOENT') {
             return buildToolError(
               'mcp_file_not_found',
diff --git a/packages/mcp-server/test/unit/server-card-express.test.ts b/packages/mcp-server/test/unit/server-card-express.test.ts
index 85be3d42..11cffbf3 100644
--- a/packages/mcp-server/test/unit/server-card-express.test.ts
+++ b/packages/mcp-server/test/unit/server-card-express.test.ts
@@ -62,3 +62,47 @@ describe('server card (express router)', () => {
     expect(getRes.headers.get('access-control-allow-origin')).toBe('*')
   })
 })
+
+describe('hosted Express router', () => {
+  let running: RunningServer | undefined
+
+  afterEach(async () => {
+    if (running) {
+      await running.close()
+      running = undefined
+    }
+  })
+
+  it('reads the request body itself when no JSON body parser is installed', async () => {
+    const app = express()
+    app.use(
+      createTransloaditMcpExpressRouter({
+        path: '/mcp',
+        resourceMetadataUrl:
+          'https://api2.transloadit.com/.well-known/oauth-protected-resource/mcp',
+      }),
+    )
+    const server = createServer(app)
+    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve))
+    const { port } = server.address() as AddressInfo
+    running = {
+      baseUrl: new URL(`http://127.0.0.1:${port}`),
+      close: () =>
+        new Promise<void>((resolve, reject) => {
+          server.close((err) => (err ? reject(err) : resolve()))
+        }),
+    }
+
+    const response = await fetch(new URL('/mcp', running.baseUrl), {
+      method: 'POST',
+      headers: {
+        Authorization: 'Bearer token',
+        'Content-Type': 'application/json',
+        Accept: 'application/json, text/event-stream',
+      },
+      body: JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/list', params: {} }),
+    })
+    expect(response.status).toBe(200)
+    expect(await response.text()).toContain('transloadit_list_robots')
+  })
+})
diff --git a/packages/mcp-server/test/unit/upstream-auth-status.test.ts b/packages/mcp-server/test/unit/upstream-auth-status.test.ts
index 792d8058..6a5603f6 100644
--- a/packages/mcp-server/test/unit/upstream-auth-status.test.ts
+++ b/packages/mcp-server/test/unit/upstream-auth-status.test.ts
@@ -156,6 +156,69 @@ describe('upstream token rejections over HTTP', () => {
     expect(body).not.toContain('mcp/www_authenticate')
   })
 
+  const createAssemblyCall = (): Promise<Response> =>
+    fetch(url, {
+      method: 'POST',
+      headers: {
+        Authorization: 'Bearer expiring-oauth-token',
+        'Content-Type': 'application/json',
+        Accept: 'application/json, text/event-stream',
+      },
+      body: JSON.stringify({
+        jsonrpc: '2.0',
+        id: 1,
+        method: 'tools/call',
+        params: {
+          name: 'transloadit_create_assembly',
+          arguments: {
+            instructions: { steps: { resized: { robot: '/image/resize', width: 1 } } },
+            wait_for_completion: true,
+          },
+        },
+      }),
+    })
+
+  it('does not ask for a replay when the token expires after the Assembly was created', async () => {
+    serverOptions.resourceMetadataUrl = resourceMetadataUrl
+    let createdId: string | undefined
+    nock(endpoint)
+      .post(/\/assemblies\/[a-f\d]{32}$/)
+      .reply((uri) => {
+        createdId = uri.split('/').at(-1)
+        return [
+          200,
+          {
+            ok: 'ASSEMBLY_EXECUTING',
+            assembly_id: createdId,
+            assembly_ssl_url: `${endpoint}/assemblies/${createdId}`,
+          },
+        ]
+      })
+    nock(endpoint)
+      .get(/\/assemblies\/[a-f\d]{32}$/)
+      .query(true)
+      .reply(401, { error: 'BEARER_TOKEN_EXPIRED' })
+
+    const response = await createAssemblyCall()
+    expect(response.status).toBe(200)
+    expect(response.headers.get('www-authenticate')).toBeNull()
+    const body = await response.text()
+    expect(body).toContain('mcp_assembly_status_unavailable')
+    expect(body).toContain(`${endpoint}/assemblies/${createdId}`)
+    expect(body).not.toContain('mcp/www_authenticate')
+  })
+
+  it('still challenges when API2 rejects the token on the creation request itself', async () => {
+    serverOptions.resourceMetadataUrl = resourceMetadataUrl
+    nock(endpoint)
+      .post(/\/assemblies\/[a-f\d]{32}$/)
+      .reply(401, { error: 'BEARER_TOKEN_EXPIRED' })
+
+    const response = await createAssemblyCall()
+    expect(response.status).toBe(401)
+    expect(response.headers.get('www-authenticate')).toContain('error="invalid_token"')
+  })
+
   it('keeps self-hosted rejections as tool errors over HTTP 200', async () => {
     nock(endpoint).get('/templates').query(true).reply(401, { error: 'BEARER_TOKEN_EXPIRED' })
 
diff --git a/packages/node/src/Transloadit.ts b/packages/node/src/Transloadit.ts
index 328f280c..759c6d44 100644
--- a/packages/node/src/Transloadit.ts
+++ b/packages/node/src/Transloadit.ts
@@ -5,7 +5,13 @@ import type {
   CompileAssemblyInstructionsResult,
 } from '@transloadit/utils'
 import type { SignatureAlgorithm } from '@transloadit/utils/node'
-import type { Delays, Headers, OptionsOfJSONResponseBody, RetryOptions } from 'got'
+import type {
+  BeforeRedirectHook,
+  Delays,
+  Headers,
+  OptionsOfJSONResponseBody,
+  RetryOptions,
+} from 'got'
 import type { Input as IntoStreamInput } from 'into-stream'
 
 import type { TransloaditErrorResponseBody } from './ApiError.ts'
@@ -491,6 +497,24 @@ export class Transloadit {
 
   private _lastUsedAssemblyUrl = ''
 
+  /**
+   * got drops `Authorization` and cookies when a redirect changes origin, but not custom headers,
+   * so `extraHeaders` (such as a relay's shared secret) are removed the same way.
+   */
+  #dropExtraHeadersOffOrigin(requestUrl: string): BeforeRedirectHook[] {
+    const names = Object.keys(this.#extraHeaders).map((name) => name.toLowerCase())
+    if (names.length === 0) return []
+    // An unparseable request URL counts as a different origin, which drops the headers.
+    const requestOrigin = URL.canParse(requestUrl) ? new URL(requestUrl).origin : undefined
+    return [
+      (redirectOptions) => {
+        const redirectUrl = redirectOptions.url
+        if (requestOrigin && redirectUrl && new URL(redirectUrl).origin === requestOrigin) return
+        for (const name of names) delete redirectOptions.headers[name]
+      },
+    ]
+  }
+
   private _validateResponses = false
 
   /** Create a client; new combined keys require signatureAlgorithm: 'sha256' explicitly. */
@@ -1676,6 +1700,7 @@ export class Transloadit {
           ...this.#extraHeaders,
           ...headers,
         },
+        hooks: { beforeRedirect: this.#dropExtraHeadersOffOrigin(url) },
         responseType: 'json',
         signal,
       }
diff --git a/packages/node/test/unit/extra-headers-redirect.test.ts b/packages/node/test/unit/extra-headers-redirect.test.ts
new file mode 100644
index 00000000..992f8e0d
--- /dev/null
+++ b/packages/node/test/unit/extra-headers-redirect.test.ts
@@ -0,0 +1,57 @@
+import nock from 'nock'
+import { afterEach, describe, expect, it } from 'vitest'
+
+import { Transloadit } from '../../src/Transloadit.ts'
+
+const upstreamHeader = 'Transloadit-Mcp-Upstream'
+
+const completedAssembly = {
+  ok: 'ASSEMBLY_COMPLETED',
+  assembly_id: 'abc',
+  assembly_url: 'https://api2.transloadit.com/assemblies/abc',
+  assembly_ssl_url: 'https://api2.transloadit.com/assemblies/abc',
+}
+
+describe('extraHeaders on redirects', () => {
+  afterEach(() => {
+    nock.cleanAll()
+  })
+
+  it('drops extraHeaders when a redirect leaves the API origin', async () => {
+    const client = new Transloadit({
+      authToken: 'forwarded-token-0123456789',
+      extraHeaders: { [upstreamHeader]: 'shared-secret' },
+    })
+    nock('https://api2.transloadit.com')
+      .get('/assemblies/abc')
+      .query(true)
+      .reply(302, '', { Location: 'https://elsewhere.example/assemblies/abc' })
+    const elsewhere = nock('https://elsewhere.example', {
+      badheaders: [upstreamHeader.toLowerCase(), 'authorization'],
+    })
+      .get('/assemblies/abc')
+      .reply(200, completedAssembly)
+
+    await client.getAssembly('abc')
+    expect(elsewhere.isDone()).toBe(true)
+  })
+
+  it('keeps extraHeaders on a same-origin redirect', async () => {
+    const client = new Transloadit({
+      authToken: 'forwarded-token-0123456789',
+      extraHeaders: { [upstreamHeader]: 'shared-secret' },
+    })
+    nock('https://api2.transloadit.com')
+      .get('/assemblies/abc')
+      .query(true)
+      .reply(302, '', { Location: 'https://api2.transloadit.com/assemblies/abc2' })
+    const sameOrigin = nock('https://api2.transloadit.com', {
+      reqheaders: { [upstreamHeader.toLowerCase()]: 'shared-secret' },
+    })
+      .get('/assemblies/abc2')
+      .reply(200, completedAssembly)
+
+    await client.getAssembly('abc')
+    expect(sameOrigin.isDone()).toBe(true)
+  })
+})

From dbacd7e446250a6b05d6b5421e90d53d5da0378b Mon Sep 17 00:00:00 2001
From: Kevin van Zonneveld <kevin@vanzonneveld.net>
Date: Fri, 2 Oct 2026 16:19:16 +0200
Subject: [PATCH 15/27] Address council review run 5: raw-body batches, body
 limits, widget errors

Council review of PR #529 (run 5), each fix preceded by a failing test:

- The hosted relay detects batches from the raw body it parses itself (Express without
  `express.json()`), so such a batch also keeps HTTP 200 and is never replayed.
- Request bodies are read up to `maxRequestBodyBytes` (1 MiB hosted, 10 MiB self-hosted, as the
  README documented but nothing enforced); larger bodies get HTTP 413 and are drained, not kept.
- The widget shows tool errors and their hints next to a partial Assembly, so a created-but-
  unreadable Assembly tells the user to fetch its status instead of creating it again.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .changeset/mcp-oauth-discovery.md             |  2 +
 packages/mcp-server/README.md                 |  8 +-
 packages/mcp-server/src/cli.ts                |  1 +
 packages/mcp-server/src/http-helpers.ts       | 51 ++++++++++++
 packages/mcp-server/src/http.ts               | 39 +++++-----
 packages/mcp-server/src/request-transport.ts  | 47 ++++++-----
 .../src/ui/assembly-result-widget.ts          | 16 +++-
 .../mcp-server/test/unit/hosted-auth.test.ts  | 41 ++++++++++
 .../test/unit/server-card-express.test.ts     | 78 +++++++++++++++++++
 .../test/unit/widget-handshake.test.ts        | 33 ++++++++
 10 files changed, 271 insertions(+), 45 deletions(-)

diff --git a/.changeset/mcp-oauth-discovery.md b/.changeset/mcp-oauth-discovery.md
index e8c205a9..a88fb742 100644
--- a/.changeset/mcp-oauth-discovery.md
+++ b/.changeset/mcp-oauth-discovery.md
@@ -24,6 +24,8 @@ connector requirements.
 - Hosted mode serves JSON responses and turns an upstream rejection of the forwarded token into
   HTTP 401 (`invalid_token`) or 403 (`insufficient_scope` with the tool's scopes), so OAuth clients
   refresh or re-scope instead of retrying a dead token.
+- Request bodies are capped (1 MiB hosted, 10 MiB self-hosted, `maxRequestBodyBytes`) and larger
+  ones get HTTP 413 without being buffered.
 - Hosted mode also challenges bare `GET /mcp` probes (Codex discovers OAuth from them); CORS now
   allows `Mcp-Protocol-Version` so browser hosts can connect.
 - Self-hosted servers sign with `TRANSLOADIT_SIGNATURE_ALGORITHM` (`sha1`, `sha256` or `sha384`),
diff --git a/packages/mcp-server/README.md b/packages/mcp-server/README.md
index ad05deb4..24fb2ed9 100644
--- a/packages/mcp-server/README.md
+++ b/packages/mcp-server/README.md
@@ -415,9 +415,13 @@ below.
 These limits apply to inline JSON/base64 payloads. For larger files, use a public URL or upload from
 your own machine with `npx -y @transloadit/node upload`.
 
-- Hosted default request body limit: **1 MB**
+- Hosted default request body limit: **1 MiB**
 - Hosted `maxBase64Bytes`: **512,000** decoded bytes
-- Self-hosted default request body limit: **10 MB** (configurable)
+- Self-hosted default request body limit: **10 MiB**
+
+Set `maxRequestBodyBytes` (handler option or JSON config key) to change the body limit; larger
+requests get HTTP 413 and are not buffered. Express apps that install their own body parser set
+its limit there.
 
 ## URL inputs and template behavior
 
diff --git a/packages/mcp-server/src/cli.ts b/packages/mcp-server/src/cli.ts
index 4cc81854..b9331895 100644
--- a/packages/mcp-server/src/cli.ts
+++ b/packages/mcp-server/src/cli.ts
@@ -186,6 +186,7 @@ const main = async (): Promise<void> => {
       mcpToken,
       resourceMetadataUrl,
       upstreamSecret,
+      maxRequestBodyBytes: fileConfig.maxRequestBodyBytes as number | undefined,
       signatureAlgorithm,
       resultDomains,
       consoleUrl,
diff --git a/packages/mcp-server/src/http-helpers.ts b/packages/mcp-server/src/http-helpers.ts
index 5726fd17..25af71ec 100644
--- a/packages/mcp-server/src/http-helpers.ts
+++ b/packages/mcp-server/src/http-helpers.ts
@@ -214,6 +214,57 @@ export const buildBearerChallenge = (options: {
   return parts.length > 0 ? `Bearer ${parts.join(', ')}` : 'Bearer'
 }
 
+/**
+ * Request body limits the README documents. Hosted requests only carry JSON-RPC and small base64
+ * payloads, and pass the bearer gate before API2 has checked the token, so they get the smaller one.
+ */
+export const resolveMaxRequestBodyBytes = (options: {
+  maxRequestBodyBytes?: number
+  resourceMetadataUrl?: string
+}): number => options.maxRequestBodyBytes ?? (options.resourceMetadataUrl ? 1 : 10) * 1024 * 1024
+
+/**
+ * Reads a request body up to `maxBytes`. Returns `undefined` once it is larger; the rest is drained
+ * without being kept, so an oversized body cannot exhaust memory.
+ */
+export const readBodyWithinLimit = (
+  req: IncomingMessage,
+  maxBytes: number,
+): Promise<string | undefined> =>
+  new Promise((resolve, reject) => {
+    const chunks: Buffer[] = []
+    let size = 0
+    let tooLarge = false
+    req.on('data', (chunk: Buffer) => {
+      if (tooLarge) return
+      size += chunk.length
+      if (size > maxBytes) {
+        tooLarge = true
+        chunks.length = 0
+        resolve(undefined)
+        return
+      }
+      chunks.push(chunk)
+    })
+    req.on('end', () => {
+      if (!tooLarge) resolve(Buffer.concat(chunks).toString('utf8'))
+    })
+    req.on('error', reject)
+  })
+
+export const sendBodyTooLarge = (res: ServerResponse, maxBytes: number): void => {
+  res.statusCode = 413
+  res.setHeader('Connection', 'close')
+  res.setHeader('Content-Type', 'application/json')
+  res.end(
+    JSON.stringify({
+      jsonrpc: '2.0',
+      error: { code: -32000, message: `Request body exceeds ${maxBytes} bytes.` },
+      id: null,
+    }),
+  )
+}
+
 /**
  * The static-token check runs first and would reject every OAuth token with a bare `Bearer`
  * challenge, so hosted OAuth could never start. Refuse the combination up front.
diff --git a/packages/mcp-server/src/http.ts b/packages/mcp-server/src/http.ts
index f78e4ca8..ab6868fc 100644
--- a/packages/mcp-server/src/http.ts
+++ b/packages/mcp-server/src/http.ts
@@ -11,9 +11,12 @@ import {
   isBasicAuthorized,
   normalizePath,
   parsePathname,
+  readBodyWithinLimit,
   rejectMissingBearerToken,
   rejectMissingMcpToken,
   resolveAllowedOrigins,
+  resolveMaxRequestBodyBytes,
+  sendBodyTooLarge,
   sendServerInfoForBareGet,
 } from './http-helpers.ts'
 import { getMetrics, getMetricsContentType } from './metrics.ts'
@@ -29,6 +32,8 @@ export type TransloaditMcpHttpOptions = TransloaditMcpServerOptions & {
   path?: string
   metricsPath?: string | false
   metricsAuth?: { username: string; password: string }
+  /** Largest accepted request body; defaults to 1 MiB hosted and 10 MiB self-hosted. */
+  maxRequestBodyBytes?: number
   // Ignored on purpose: the hosted HTTP server is stateless and does not mint session IDs.
   sessionIdGenerator?: (() => string) | undefined
   logger?: SevLogger
@@ -43,25 +48,13 @@ export type TransloaditMcpHttpHandler = ((
 
 const defaultPath = '/mcp'
 
-/** Read the full request body and JSON-parse it before handing it to the MCP transport. */
-function readJsonBody(req: IncomingMessage): Promise<unknown> {
-  return new Promise((resolve, reject) => {
-    const chunks: Buffer[] = []
-    req.on('data', (chunk: Buffer) => chunks.push(chunk))
-    req.on('end', () => {
-      const raw = Buffer.concat(chunks).toString('utf8')
-      if (!raw) {
-        resolve(undefined)
-        return
-      }
-      try {
-        resolve(JSON.parse(raw))
-      } catch {
-        resolve(undefined)
-      }
-    })
-    req.on('error', reject)
-  })
+const parseJson = (text: string): unknown => {
+  if (!text) return undefined
+  try {
+    return JSON.parse(text)
+  } catch {
+    return undefined
+  }
 }
 
 export function createTransloaditMcpHttpHandler(
@@ -176,7 +169,13 @@ export function createTransloaditMcpHttpHandler(
       return
     }
 
-    const parsedBody = await readJsonBody(req)
+    const maxBytes = resolveMaxRequestBodyBytes(options)
+    const rawBody = await readBodyWithinLimit(req, maxBytes)
+    if (rawBody === undefined) {
+      sendBodyTooLarge(res, maxBytes)
+      return
+    }
+    const parsedBody = parseJson(rawBody)
     const { transport, handle } = createRequestTransport(options)
     const server = createTransloaditMcpServer(options)
     const activeRequest = { transport, server }
diff --git a/packages/mcp-server/src/request-transport.ts b/packages/mcp-server/src/request-transport.ts
index 44a3324c..722b65f7 100644
--- a/packages/mcp-server/src/request-transport.ts
+++ b/packages/mcp-server/src/request-transport.ts
@@ -5,10 +5,17 @@ import type { Transport } from '@modelcontextprotocol/sdk/shared/transport.js'
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js'
 import { WebStandardStreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js'
 
+import {
+  readBodyWithinLimit,
+  resolveMaxRequestBodyBytes,
+  sendBodyTooLarge,
+} from './http-helpers.ts'
+
 type RequestTransportOptions = {
   resourceMetadataUrl?: string
   allowedHosts?: string[]
   enableDnsRebindingProtection?: boolean
+  maxRequestBodyBytes?: number
 }
 
 /** A per-request MCP transport plus the function that serves the HTTP request through it. */
@@ -23,6 +30,7 @@ const isRecord = (value: unknown): value is Record<string, unknown> =>
   typeof value === 'object' && value !== null && !Array.isArray(value)
 
 const parseJson = (text: string): unknown => {
+  if (!text) return undefined
   try {
     return JSON.parse(text)
   } catch {
@@ -52,31 +60,17 @@ const findUpstreamChallenge = (body: string): UpstreamChallenge | undefined => {
   return undefined
 }
 
-const readRawBody = async (req: IncomingMessage): Promise<string> => {
-  const chunks: Buffer[] = []
-  for await (const chunk of req) {
-    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk))
-  }
-  return Buffer.concat(chunks).toString('utf8')
-}
-
-const toWebRequest = async (req: IncomingMessage, parsedBody: unknown): Promise<Request> => {
+const toWebRequest = (req: IncomingMessage, rawBody: string | undefined): Request => {
   const headers = new Headers()
   for (const [name, value] of Object.entries(req.headers)) {
     if (value === undefined) continue
     for (const entry of Array.isArray(value) ? value : [value]) headers.append(name, entry)
   }
-  // Without a body parser (an Express app lacking express.json()), the stream is still unread;
-  // hand it to the transport, which parses JSON itself when no parsed body is given.
-  const body =
-    parsedBody === undefined && req.method === 'POST' && !req.readableEnded
-      ? await readRawBody(req)
-      : undefined
   // The transport reads only headers and the body, so a fixed base URL is enough.
   return new Request(new URL(req.url ?? '/', 'http://localhost'), {
     method: req.method,
     headers,
-    body,
+    body: rawBody,
   })
 }
 
@@ -91,16 +85,28 @@ const relayHostedRequest = async (
   req: IncomingMessage,
   res: ServerResponse,
   parsedBody: unknown,
+  maxBytes: number,
 ): Promise<void> => {
-  const response = await transport.handleRequest(await toWebRequest(req, parsedBody), {
-    parsedBody,
+  // Without a body parser (an Express app lacking express.json()) the stream is still unread.
+  let rawBody: string | undefined
+  if (parsedBody === undefined && req.method === 'POST' && !req.readableEnded) {
+    rawBody = await readBodyWithinLimit(req, maxBytes)
+    if (rawBody === undefined) {
+      sendBodyTooLarge(res, maxBytes)
+      return
+    }
+  }
+  // Invalid JSON stays undefined here, so the transport parses the raw body and reports it.
+  const message = rawBody === undefined ? parsedBody : parseJson(rawBody)
+  const response = await transport.handleRequest(toWebRequest(req, rawBody), {
+    parsedBody: message,
   })
   const body = await response.text()
   // A client retries the whole HTTP request after re-authorizing, so a batch keeps its 200: the
   // other calls may have succeeded (an Assembly created twice would be charged twice). Its failed
   // items still carry the challenge in `_meta["mcp/www_authenticate"]`.
   const challenge =
-    !Array.isArray(parsedBody) && response.headers.get('content-type')?.includes('application/json')
+    !Array.isArray(message) && response.headers.get('content-type')?.includes('application/json')
       ? findUpstreamChallenge(body)
       : undefined
   res.statusCode = challenge?.status ?? response.status
@@ -131,8 +137,9 @@ export const createRequestTransport = (options: RequestTransportOptions): Reques
     ...shared,
     enableJsonResponse: true,
   })
+  const maxBytes = resolveMaxRequestBodyBytes(options)
   return {
     transport,
-    handle: (req, res, parsedBody) => relayHostedRequest(transport, req, res, parsedBody),
+    handle: (req, res, parsedBody) => relayHostedRequest(transport, req, res, parsedBody, maxBytes),
   }
 }
diff --git a/packages/mcp-server/src/ui/assembly-result-widget.ts b/packages/mcp-server/src/ui/assembly-result-widget.ts
index ecba82bb..2c8128d5 100644
--- a/packages/mcp-server/src/ui/assembly-result-widget.ts
+++ b/packages/mcp-server/src/ui/assembly-result-widget.ts
@@ -255,9 +255,14 @@ export const assemblyResultWidgetHtml = `<!doctype html>
     return el('figure', {}, [preview(isRecord(file) ? file : {}), caption])
   }
 
+  // Each tool error as "message hint", so recovery advice is shown next to what failed.
+  const payloadErrors = (payload) =>
+    (Array.isArray(payload.errors) ? payload.errors : [])
+      .map((error) => (isRecord(error) ? [text(error.message), text(error.hint)].filter(Boolean).join(' ') : ''))
+      .filter(Boolean)
+
   const errorText = (result, payload) => {
-    const errors = Array.isArray(payload.errors) ? payload.errors : []
-    const fromPayload = errors.map((error) => (isRecord(error) ? text(error.message) : '')).filter(Boolean)
+    const fromPayload = payloadErrors(payload)
     if (fromPayload.length > 0) return fromPayload.join(' ')
     const content = Array.isArray(result.content) ? result.content : []
     return content
@@ -297,13 +302,18 @@ export const assemblyResultWidgetHtml = `<!doctype html>
     if (failed && text(assembly.message)) {
       app.append(el('p', { className: 'error', role: 'alert', text: text(assembly.message) }))
     }
+    // A tool error can come with a partial Assembly (created, but its status unreadable).
+    const toolErrors = payloadErrors(payload)
+    for (const message of toolErrors) {
+      app.append(el('p', { className: 'error', role: 'alert', text: message }))
+    }
 
     const results = isRecord(assembly.results) ? assembly.results : {}
     const uploads = Array.isArray(assembly.uploads) ? assembly.uploads : []
     const steps = Object.entries(results).filter(([, files]) => Array.isArray(files) && files.length > 0)
     if (uploads.length > 0) steps.unshift([':original', uploads])
 
-    if (steps.length === 0) {
+    if (steps.length === 0 && toolErrors.length === 0) {
       app.append(el('p', { className: 'muted', text: 'No result files yet.' }))
     }
     for (const [stepName, files] of steps) {
diff --git a/packages/mcp-server/test/unit/hosted-auth.test.ts b/packages/mcp-server/test/unit/hosted-auth.test.ts
index a4d67f5a..458f72eb 100644
--- a/packages/mcp-server/test/unit/hosted-auth.test.ts
+++ b/packages/mcp-server/test/unit/hosted-auth.test.ts
@@ -343,3 +343,44 @@ describe('wildcard origins with DNS rebinding protection', () => {
     )
   })
 })
+
+describe('request body limits', () => {
+  let running: RunningServer | undefined
+
+  afterEach(async () => {
+    await running?.close()
+    running = undefined
+  })
+
+  const oversized = JSON.stringify({
+    jsonrpc: '2.0',
+    id: 1,
+    method: 'tools/list',
+    params: { pad: 'x'.repeat(4096) },
+  })
+
+  it.each([
+    ['self-hosted', {}],
+    ['hosted', { resourceMetadataUrl }],
+  ])('answers 413 for %s bodies above the limit without buffering them', async (_mode, mode) => {
+    running = await start({ maxRequestBodyBytes: 1024, ...mode })
+
+    const response = await fetch(running.url, {
+      method: 'POST',
+      headers: {
+        Authorization: 'Bearer token',
+        'Content-Type': 'application/json',
+        Accept: 'application/json, text/event-stream',
+      },
+      body: oversized,
+    })
+    expect(response.status).toBe(413)
+  })
+
+  it('accepts bodies within the limit', async () => {
+    running = await start({ maxRequestBodyBytes: 8192, resourceMetadataUrl })
+
+    const response = await post(running.url, { Authorization: 'Bearer token' })
+    expect(response.status).toBe(200)
+  })
+})
diff --git a/packages/mcp-server/test/unit/server-card-express.test.ts b/packages/mcp-server/test/unit/server-card-express.test.ts
index 11cffbf3..812122d7 100644
--- a/packages/mcp-server/test/unit/server-card-express.test.ts
+++ b/packages/mcp-server/test/unit/server-card-express.test.ts
@@ -3,6 +3,7 @@ import type { AddressInfo } from 'node:net'
 import { createServer } from 'node:http'
 
 import express from 'express'
+import nock from 'nock'
 import { afterEach, describe, expect, it } from 'vitest'
 
 import { createTransloaditMcpExpressRouter } from '../../src/express.ts'
@@ -73,6 +74,83 @@ describe('hosted Express router', () => {
     }
   })
 
+  const startHostedRouter = async (
+    extra: Parameters<typeof createTransloaditMcpExpressRouter>[0] = {},
+  ): Promise<RunningServer> => {
+    const app = express()
+    app.use(
+      createTransloaditMcpExpressRouter({
+        path: '/mcp',
+        resourceMetadataUrl:
+          'https://api2.transloadit.com/.well-known/oauth-protected-resource/mcp',
+        ...extra,
+      }),
+    )
+    const server = createServer(app)
+    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve))
+    const { port } = server.address() as AddressInfo
+    return {
+      baseUrl: new URL(`http://127.0.0.1:${port}`),
+      close: () =>
+        new Promise<void>((resolve, reject) => {
+          server.close((err) => (err ? reject(err) : resolve()))
+        }),
+    }
+  }
+
+  const postMcp = (body: string): Promise<Response> =>
+    fetch(new URL('/mcp', running?.baseUrl), {
+      method: 'POST',
+      headers: {
+        Authorization: 'Bearer expired-oauth-token',
+        'Content-Type': 'application/json',
+        Accept: 'application/json, text/event-stream',
+      },
+      body,
+    })
+
+  it('keeps an unparsed batch at 200 so the client does not replay it', async () => {
+    running = await startHostedRouter()
+    nock('https://api2.transloadit.com')
+      .get('/templates')
+      .query(true)
+      .reply(401, { error: 'BEARER_TOKEN_EXPIRED' })
+
+    const response = await postMcp(
+      JSON.stringify([
+        {
+          jsonrpc: '2.0',
+          id: 1,
+          method: 'tools/call',
+          params: { name: 'transloadit_list_robots', arguments: { limit: 1 } },
+        },
+        {
+          jsonrpc: '2.0',
+          id: 2,
+          method: 'tools/call',
+          params: { name: 'transloadit_list_templates', arguments: {} },
+        },
+      ]),
+    )
+    expect(response.status).toBe(200)
+    expect(await response.text()).toContain('mcp_auth_rejected')
+    nock.cleanAll()
+  })
+
+  it('refuses unparsed bodies above the configured limit', async () => {
+    running = await startHostedRouter({ maxRequestBodyBytes: 1024 })
+
+    const response = await postMcp(
+      JSON.stringify({
+        jsonrpc: '2.0',
+        id: 1,
+        method: 'tools/list',
+        params: { pad: 'x'.repeat(4096) },
+      }),
+    )
+    expect(response.status).toBe(413)
+  })
+
   it('reads the request body itself when no JSON body parser is installed', async () => {
     const app = express()
     app.use(
diff --git a/packages/mcp-server/test/unit/widget-handshake.test.ts b/packages/mcp-server/test/unit/widget-handshake.test.ts
index e6147ddc..0245f044 100644
--- a/packages/mcp-server/test/unit/widget-handshake.test.ts
+++ b/packages/mcp-server/test/unit/widget-handshake.test.ts
@@ -181,6 +181,39 @@ describe('assembly result widget handshake (MCP Apps 2026-01-26)', () => {
     })
   })
 
+  it('shows the recovery advice when a created Assembly could not be read', async () => {
+    await initialize()
+    await widget.fromHost({
+      jsonrpc: '2.0',
+      method: 'ui/notifications/tool-result',
+      params: {
+        isError: true,
+        structuredContent: {
+          status: 'error',
+          assembly: {
+            assembly_id: 'abc123',
+            assembly_ssl_url: 'https://api2.transloadit.com/assemblies/abc123',
+          },
+          errors: [
+            {
+              code: 'mcp_assembly_status_unavailable',
+              message: 'The Assembly was created, but its status could not be read.',
+              hint: 'Call transloadit_get_assembly_status instead of creating it again.',
+            },
+          ],
+        },
+      },
+    })
+
+    expect(widget.appText()).toContain('Assembly abc123')
+    expect(widget.appText()).toContain(
+      'The Assembly was created, but its status could not be read.',
+    )
+    expect(widget.appText()).toContain(
+      'Call transloadit_get_assembly_status instead of creating it again.',
+    )
+  })
+
   it('shows the error text of a failed tool call instead of waiting forever', async () => {
     await initialize()
     await widget.fromHost({

From 375aaac869a1389a9fd14d3b5d3ad24735824016 Mon Sep 17 00:00:00 2001
From: Kevin van Zonneveld <kevin@vanzonneveld.net>
Date: Fri, 2 Oct 2026 16:45:28 +0200
Subject: [PATCH 16/27] Address council review run 6: check tokens before
 downloads, bound them

Council review of PR #529 (run 6), each fix preceded by a failing test:

- A forwarded token is checked with API2 (a Template list, within the declared templates:read)
  before any URL input is downloaded, and downloads are capped at `maxUrlDownloadBytes` (1 GiB)
  and `urlDownloadTimeoutMs` (10 minutes) through new `prepareInputFiles()` options.
- `createAssembly()` reports accepted creation through `onAssemblyCreated`; the MCP server uses it
  instead of the request method, so a creation error delivered with HTTP 200 is reported as itself.
- `maxRequestBodyBytes` and `maxUrlDownloadBytes` must be positive integers; a config value such as
  "1MB" now stops startup instead of disabling the limit.
- Manifest tests resolve asset paths with URLs, and `isRecord`/`parseJson` are shared helpers.
- Save as Template keeps its documented `fromAssembly` link (product decision, Content follow-up).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .changeset/mcp-oauth-discovery.md             |  3 +-
 .changeset/mcp-upstream-header.md             |  4 ++
 packages/mcp-server/README.md                 |  4 ++
 packages/mcp-server/src/cli.ts                |  2 +
 packages/mcp-server/src/express.ts            |  4 +-
 packages/mcp-server/src/http-helpers.ts       | 18 +++++-
 .../mcp-server/src/http-request-handler.ts    |  4 +-
 packages/mcp-server/src/http.ts               | 14 +----
 packages/mcp-server/src/json.ts               | 13 ++++
 packages/mcp-server/src/request-transport.ts  | 13 +---
 packages/mcp-server/src/server.ts             | 41 ++++++++-----
 packages/mcp-server/src/tool-list.ts          |  5 +-
 .../mcp-server/test/unit/cli-config.test.ts   | 22 +++++++
 .../mcp-server/test/unit/file-inputs.test.ts  | 21 +++++++
 .../mcp-server/test/unit/hosted-auth.test.ts  |  6 ++
 .../test/unit/plugin-manifest.test.ts         |  8 +--
 .../test/unit/upstream-auth-status.test.ts    | 44 ++++++++++++++
 packages/node/src/Transloadit.ts              |  7 +++
 packages/node/src/inputFiles.ts               | 39 +++++++++++-
 .../unit/create-assembly-accepted.test.ts     | 59 +++++++++++++++++++
 packages/node/test/unit/input-files.test.ts   | 28 +++++++++
 21 files changed, 305 insertions(+), 54 deletions(-)
 create mode 100644 packages/mcp-server/src/json.ts
 create mode 100644 packages/node/test/unit/create-assembly-accepted.test.ts

diff --git a/.changeset/mcp-oauth-discovery.md b/.changeset/mcp-oauth-discovery.md
index a88fb742..7dd8eed3 100644
--- a/.changeset/mcp-oauth-discovery.md
+++ b/.changeset/mcp-oauth-discovery.md
@@ -25,7 +25,8 @@ connector requirements.
   HTTP 401 (`invalid_token`) or 403 (`insufficient_scope` with the tool's scopes), so OAuth clients
   refresh or re-scope instead of retrying a dead token.
 - Request bodies are capped (1 MiB hosted, 10 MiB self-hosted, `maxRequestBodyBytes`) and larger
-  ones get HTTP 413 without being buffered.
+  ones get HTTP 413 without being buffered. URL inputs the server downloads are capped
+  (`maxUrlDownloadBytes`, `urlDownloadTimeoutMs`), and hosted tokens are checked before downloading.
 - Hosted mode also challenges bare `GET /mcp` probes (Codex discovers OAuth from them); CORS now
   allows `Mcp-Protocol-Version` so browser hosts can connect.
 - Self-hosted servers sign with `TRANSLOADIT_SIGNATURE_ALGORITHM` (`sha1`, `sha256` or `sha384`),
diff --git a/.changeset/mcp-upstream-header.md b/.changeset/mcp-upstream-header.md
index bf663dd2..4998c8e3 100644
--- a/.changeset/mcp-upstream-header.md
+++ b/.changeset/mcp-upstream-header.md
@@ -9,3 +9,7 @@ Like `Authorization`, these headers are dropped when a redirect leaves the API o
 
 `listTemplates()` also accepts `fields`, for API2 columns such as `account_id` that the default
 Template list omits.
+
+`prepareInputFiles()` accepts `maxUrlDownloadBytes` and `urlDownloadTimeoutMs` to bound URL
+downloads, and `createAssembly()` accepts `onAssemblyCreated`, called once API2 accepted the
+creation request.
diff --git a/packages/mcp-server/README.md b/packages/mcp-server/README.md
index 24fb2ed9..c505a6d4 100644
--- a/packages/mcp-server/README.md
+++ b/packages/mcp-server/README.md
@@ -423,6 +423,10 @@ Set `maxRequestBodyBytes` (handler option or JSON config key) to change the body
 requests get HTTP 413 and are not buffered. Express apps that install their own body parser set
 its limit there.
 
+URL inputs that the server downloads (for templates that expect uploads) are capped at 1 GiB and
+10 minutes; set `maxUrlDownloadBytes` and `urlDownloadTimeoutMs` to change that. On the hosted
+endpoint the caller's token is checked with API2 before anything is downloaded.
+
 ## URL inputs and template behavior
 
 For URL inputs, behavior depends on the template/instructions:
diff --git a/packages/mcp-server/src/cli.ts b/packages/mcp-server/src/cli.ts
index b9331895..8872e879 100644
--- a/packages/mcp-server/src/cli.ts
+++ b/packages/mcp-server/src/cli.ts
@@ -186,7 +186,9 @@ const main = async (): Promise<void> => {
       mcpToken,
       resourceMetadataUrl,
       upstreamSecret,
+      // Validated by the handler, which refuses anything but a positive integer byte count.
       maxRequestBodyBytes: fileConfig.maxRequestBodyBytes as number | undefined,
+      maxUrlDownloadBytes: fileConfig.maxUrlDownloadBytes as number | undefined,
       signatureAlgorithm,
       resultDomains,
       consoleUrl,
diff --git a/packages/mcp-server/src/express.ts b/packages/mcp-server/src/express.ts
index 87209266..f749fc43 100644
--- a/packages/mcp-server/src/express.ts
+++ b/packages/mcp-server/src/express.ts
@@ -4,7 +4,7 @@ import express from 'express'
 
 import {
   applyCorsHeaders,
-  assertSingleAuthMode,
+  assertHttpOptions,
   corsAllowHeaders,
   isBasicAuthorized,
   rejectMissingBearerToken,
@@ -20,7 +20,7 @@ export type TransloaditMcpExpressOptions = TransloaditMcpHttpOptions & {
 }
 
 export function createTransloaditMcpExpressRouter(options: TransloaditMcpExpressOptions = {}) {
-  assertSingleAuthMode(options)
+  assertHttpOptions(options)
   const router = express.Router()
   const routePath = options.path ?? '/mcp'
   const metricsPath =
diff --git a/packages/mcp-server/src/http-helpers.ts b/packages/mcp-server/src/http-helpers.ts
index 25af71ec..feffb056 100644
--- a/packages/mcp-server/src/http-helpers.ts
+++ b/packages/mcp-server/src/http-helpers.ts
@@ -265,19 +265,31 @@ export const sendBodyTooLarge = (res: ServerResponse, maxBytes: number): void =>
   )
 }
 
+/** Byte limits arrive from JSON config files too, where `"1MB"` would silently disable a check. */
+const assertByteCount = (value: unknown, name: string): void => {
+  if (value === undefined) return
+  if (typeof value !== 'number' || !Number.isInteger(value) || value <= 0) {
+    throw new Error(`${name} must be a positive integer number of bytes.`)
+  }
+}
+
 /**
- * The static-token check runs first and would reject every OAuth token with a bare `Bearer`
- * challenge, so hosted OAuth could never start. Refuse the combination up front.
+ * Refuses HTTP options that would fail silently later. The static-token check runs first and
+ * would reject every OAuth token with a bare `Bearer` challenge, so hosted OAuth could never start.
  */
-export const assertSingleAuthMode = (options: {
+export const assertHttpOptions = (options: {
   mcpToken?: string
   resourceMetadataUrl?: string
+  maxRequestBodyBytes?: unknown
+  maxUrlDownloadBytes?: unknown
 }): void => {
   if (options.mcpToken && options.resourceMetadataUrl) {
     throw new Error(
       'Configure either TRANSLOADIT_MCP_TOKEN (self-hosted) or TRANSLOADIT_MCP_RESOURCE_METADATA_URL (hosted OAuth), not both.',
     )
   }
+  assertByteCount(options.maxRequestBodyBytes, 'maxRequestBodyBytes')
+  assertByteCount(options.maxUrlDownloadBytes, 'maxUrlDownloadBytes')
 }
 
 /**
diff --git a/packages/mcp-server/src/http-request-handler.ts b/packages/mcp-server/src/http-request-handler.ts
index b1ead7a5..f968e594 100644
--- a/packages/mcp-server/src/http-request-handler.ts
+++ b/packages/mcp-server/src/http-request-handler.ts
@@ -5,7 +5,7 @@ import type { SevLogger } from '@transloadit/sev-logger'
 
 import {
   applyCorsHeaders,
-  assertSingleAuthMode,
+  assertHttpOptions,
   normalizePath,
   parsePathname,
   rejectMissingBearerToken,
@@ -33,7 +33,7 @@ export const createMcpRequestHandler = (
   transport: StreamableHTTPServerTransport,
   options: RequestHandlerOptions,
 ) => {
-  assertSingleAuthMode(options)
+  assertHttpOptions(options)
   const expectedPath = normalizePath(options.path.expectedPath)
   const allowRoot = options.path.allowRoot ?? false
   const logger = options.logger ?? getLogger().nest('http')
diff --git a/packages/mcp-server/src/http.ts b/packages/mcp-server/src/http.ts
index ab6868fc..9059ed79 100644
--- a/packages/mcp-server/src/http.ts
+++ b/packages/mcp-server/src/http.ts
@@ -7,7 +7,7 @@ import type { TransloaditMcpServerOptions } from './server.ts'
 
 import {
   applyCorsHeaders,
-  assertSingleAuthMode,
+  assertHttpOptions,
   isBasicAuthorized,
   normalizePath,
   parsePathname,
@@ -19,6 +19,7 @@ import {
   sendBodyTooLarge,
   sendServerInfoForBareGet,
 } from './http-helpers.ts'
+import { parseJson } from './json.ts'
 import { getMetrics, getMetricsContentType } from './metrics.ts'
 import { createRequestTransport } from './request-transport.ts'
 import { createTransloaditMcpServer } from './server.ts'
@@ -48,15 +49,6 @@ export type TransloaditMcpHttpHandler = ((
 
 const defaultPath = '/mcp'
 
-const parseJson = (text: string): unknown => {
-  if (!text) return undefined
-  try {
-    return JSON.parse(text)
-  } catch {
-    return undefined
-  }
-}
-
 export function createTransloaditMcpHttpHandler(
   options: TransloaditMcpHttpOptions = {},
 ): TransloaditMcpHttpHandler {
@@ -64,7 +56,7 @@ export function createTransloaditMcpHttpHandler(
     transport: RequestTransport['transport']
     server: Awaited<ReturnType<typeof createTransloaditMcpServer>>
   }>()
-  assertSingleAuthMode(options)
+  assertHttpOptions(options)
   const expectedPath = options.path ?? defaultPath
   const metricsPath =
     options.metricsPath === false ? undefined : normalizePath(options.metricsPath ?? '/metrics')
diff --git a/packages/mcp-server/src/json.ts b/packages/mcp-server/src/json.ts
new file mode 100644
index 00000000..3718ec2c
--- /dev/null
+++ b/packages/mcp-server/src/json.ts
@@ -0,0 +1,13 @@
+/** A plain object; arrays are rejected because callers read named fields. */
+export const isRecord = (value: unknown): value is Record<string, unknown> =>
+  typeof value === 'object' && value !== null && !Array.isArray(value)
+
+/** Parses JSON text, returning `undefined` for empty or invalid input instead of throwing. */
+export const parseJson = (text: string): unknown => {
+  if (!text) return undefined
+  try {
+    return JSON.parse(text)
+  } catch {
+    return undefined
+  }
+}
diff --git a/packages/mcp-server/src/request-transport.ts b/packages/mcp-server/src/request-transport.ts
index 722b65f7..2f0a4280 100644
--- a/packages/mcp-server/src/request-transport.ts
+++ b/packages/mcp-server/src/request-transport.ts
@@ -10,6 +10,7 @@ import {
   resolveMaxRequestBodyBytes,
   sendBodyTooLarge,
 } from './http-helpers.ts'
+import { isRecord, parseJson } from './json.ts'
 
 type RequestTransportOptions = {
   resourceMetadataUrl?: string
@@ -26,18 +27,6 @@ export type RequestTransport = {
 
 type UpstreamChallenge = { status: 401 | 403; header: string }
 
-const isRecord = (value: unknown): value is Record<string, unknown> =>
-  typeof value === 'object' && value !== null && !Array.isArray(value)
-
-const parseJson = (text: string): unknown => {
-  if (!text) return undefined
-  try {
-    return JSON.parse(text)
-  } catch {
-    return undefined
-  }
-}
-
 /**
  * Finds the challenge a tool attached after API2 rejected the forwarded token. Tool results are
  * the only place that knows, because API2 checks the token when a tool calls it.
diff --git a/packages/mcp-server/src/server.ts b/packages/mcp-server/src/server.ts
index 5e5385ed..d86d5cb2 100644
--- a/packages/mcp-server/src/server.ts
+++ b/packages/mcp-server/src/server.ts
@@ -59,6 +59,10 @@ export type TransloaditMcpServerOptions = {
   signatureAlgorithm?: McpSignatureAlgorithm
   /** Origins the result widget may load previews from (`TRANSLOADIT_MCP_RESULT_DOMAINS`). */
   resultDomains?: string[]
+  /** Largest URL input downloaded for upload Steps; defaults to 1 GiB. */
+  maxUrlDownloadBytes?: number
+  /** Longest a URL input download may take; defaults to 10 minutes. */
+  urlDownloadTimeoutMs?: number
   /** Console origin used for widget deep links; defaults to the public website. */
   consoleUrl?: string
   endpoint?: string
@@ -102,6 +106,10 @@ type ToolExtra = {
 
 const maxBase64Bytes = 512_000
 
+/** URL inputs larger or slower than this are not downloaded to this server's disk. */
+const defaultMaxUrlDownloadBytes = 1024 * 1024 * 1024
+const defaultUrlDownloadTimeoutMs = 10 * 60 * 1000
+
 type LintAssemblyInstructionsInput = Parameters<Transloadit['lintAssemblyInstructions']>[0]
 
 const lintIssueSchema = z.object({
@@ -596,10 +604,6 @@ const toAuthRejection = (
   return undefined
 }
 
-/** True when the error came from the Assembly creation request itself, so nothing was created. */
-const isCreationRequestError = (error: unknown): boolean =>
-  error instanceof ApiError && error.cause?.options.method.toUpperCase() === 'POST'
-
 /** The Assembly exists, but its status could not be read with the caller's credentials. */
 const buildCreatedAssemblyUnavailable = (
   options: TransloaditMcpServerOptions,
@@ -671,12 +675,12 @@ const buildWidgetContext = (
 
   const workspaceUrl = `${consoleUrl}/c/${encodeURIComponent(slug)}`
   const newTemplateUrl = new URL(`${workspaceUrl}/templates/new`)
+  // Known, accepted gap (product decision on PR #529, routed to Content on 2026-10-02):
   // `fromAssembly` lets the Console seed the editor with the Assembly's effective instructions,
-  // overrides included. Content's new-Template page does not resolve it yet (Content follow-up to
-  // PR #529, routed 2026-10-02); until then inline runs open an empty editor and Template-based
-  // runs are seeded through `duplicateFrom`, without the run's overrides. The action stays visible
-  // on purpose: it already lands signed-in callers in the right Workspace, and the Console gains
-  // the seeding without another MCP release.
+  // overrides included, but Content's new-Template page does not resolve it yet. Until it does,
+  // inline runs open an empty editor and Template-based runs are seeded through `duplicateFrom`
+  // without the run's overrides. The action stays visible on purpose so the Console can start
+  // seeding without another MCP release; hiding or relabeling it is not wanted here.
   if (assemblyId) {
     newTemplateUrl.searchParams.set('fromAssembly', assemblyId)
   }
@@ -1198,6 +1202,11 @@ export const createTransloaditMcpServer = (
             )
           }
         }
+        // The hosted gate only checks that a bearer is present. A URL input may be downloaded to
+        // this server's disk, so let API2 vouch for the token first (templates:read is declared).
+        if (credentials === 'bearer' && inputFilesForPrep.some((file) => file.kind === 'url')) {
+          await client.listTemplates({ pagesize: 1 })
+        }
         const prep = await prepareInputFiles({
           inputFiles: inputFilesForPrep,
           params,
@@ -1206,6 +1215,8 @@ export const createTransloaditMcpServer = (
           urlStrategy: reference ? 'download' : 'import-if-present',
           allowPrivateUrls: false,
           maxBase64Bytes,
+          maxUrlDownloadBytes: options.maxUrlDownloadBytes ?? defaultMaxUrlDownloadBytes,
+          urlDownloadTimeoutMs: options.urlDownloadTimeoutMs ?? defaultUrlDownloadTimeoutMs,
         }).catch((error) => {
           const message = error instanceof Error ? error.message : 'Invalid file input.'
           if (message.startsWith('Duplicate file field')) {
@@ -1239,6 +1250,8 @@ export const createTransloaditMcpServer = (
         const chunkSize = upload_chunk_size
 
         let assembly: Awaited<ReturnType<typeof client.createAssembly>>
+        // Set by the SDK only after API2 accepted the creation request, so a rejected request
+        // (including an error body with HTTP 200) is never mistaken for an existing Assembly.
         let createdAssemblyId: string | undefined
         try {
           if (reference) {
@@ -1263,19 +1276,17 @@ export const createTransloaditMcpServer = (
               chunkSize,
               uploadBehavior,
               expectedUploads: expected_uploads,
+              onAssemblyCreated: (created) => {
+                createdAssemblyId = created.assembly_id ?? creation.assemblyId
+              },
             })
-            createdAssemblyId = creation.assemblyId
             assembly = await creation
           }
         } catch (error) {
           // Once API2 accepted the creation request, an auth failure (a token expiring while
           // uploads or polling run) must not reach the client as a challenge: it would refresh and
           // replay the call, creating and billing a second Assembly.
-          if (
-            createdAssemblyId &&
-            !isCreationRequestError(error) &&
-            toAuthRejection(options, error, credentials, [])
-          ) {
+          if (createdAssemblyId && toAuthRejection(options, error, credentials, [])) {
             return buildCreatedAssemblyUnavailable(options, createdAssemblyId)
           }
           if (isErrnoException(error) && error.code === 'ENOENT') {
diff --git a/packages/mcp-server/src/tool-list.ts b/packages/mcp-server/src/tool-list.ts
index c176c5f7..5c343ccd 100644
--- a/packages/mcp-server/src/tool-list.ts
+++ b/packages/mcp-server/src/tool-list.ts
@@ -1,9 +1,8 @@
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'
 
-type RequestHandler = (request: unknown, extra: unknown) => Promise<unknown>
+import { isRecord } from './json.ts'
 
-const isRecord = (value: unknown): value is Record<string, unknown> =>
-  typeof value === 'object' && value !== null && !Array.isArray(value)
+type RequestHandler = (request: unknown, extra: unknown) => Promise<unknown>
 
 const isRequestHandler = (value: unknown): value is RequestHandler => typeof value === 'function'
 
diff --git a/packages/mcp-server/test/unit/cli-config.test.ts b/packages/mcp-server/test/unit/cli-config.test.ts
index d46632dc..bcb55cd6 100644
--- a/packages/mcp-server/test/unit/cli-config.test.ts
+++ b/packages/mcp-server/test/unit/cli-config.test.ts
@@ -1,4 +1,7 @@
 import { spawnSync } from 'node:child_process'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
 import { Client } from '@modelcontextprotocol/sdk/client/index.js'
@@ -41,6 +44,25 @@ describe('transloadit-mcp CLI configuration', { timeout: 20000 }, () => {
     })
   })
 
+  it('refuses a config file whose maxRequestBodyBytes is not a byte count', async () => {
+    const directory = await mkdtemp(join(tmpdir(), 'mcp-config-'))
+    const configPath = join(directory, 'config.json')
+    await writeFile(configPath, JSON.stringify({ maxRequestBodyBytes: '1MB' }))
+
+    const result = spawnSync(process.execPath, [cliPath, 'http', '--config', configPath], {
+      env: process.env,
+      encoding: 'utf8',
+      input: '',
+      timeout: 15000,
+    })
+    await rm(directory, { recursive: true, force: true })
+
+    expect(result.status).toBe(1)
+    expect(`${result.stdout}${result.stderr}`).toContain(
+      'maxRequestBodyBytes must be a positive integer number of bytes.',
+    )
+  })
+
   it('refuses to start with an unsupported TRANSLOADIT_SIGNATURE_ALGORITHM', () => {
     const result = spawnSync(process.execPath, [cliPath, 'stdio'], {
       env: { ...process.env, TRANSLOADIT_SIGNATURE_ALGORITHM: 'md5' },
diff --git a/packages/mcp-server/test/unit/file-inputs.test.ts b/packages/mcp-server/test/unit/file-inputs.test.ts
index dbe0ddf8..9831c19e 100644
--- a/packages/mcp-server/test/unit/file-inputs.test.ts
+++ b/packages/mcp-server/test/unit/file-inputs.test.ts
@@ -41,6 +41,7 @@ describe('MCP file inputs', () => {
     delete serverOptions.endpoint
     delete serverOptions.mcpToken
     delete serverOptions.consoleUrl
+    delete serverOptions.maxUrlDownloadBytes
     fixtureDirectory = await mkdtemp(join(tmpdir(), 'mcp-test-'))
     fixturePath = join(fixtureDirectory, 'fixture.txt')
     await writeFile(fixturePath, fixtureContent)
@@ -58,6 +59,8 @@ describe('MCP file inputs', () => {
     vi.spyOn(Transloadit.prototype, 'awaitAssemblyCompletion').mockResolvedValue({
       ok: 'ASSEMBLY_COMPLETED',
     })
+    // Forwarded tokens are checked with a Template list before any URL is downloaded.
+    vi.spyOn(Transloadit.prototype, 'listTemplates').mockResolvedValue({ items: [], count: 0 })
     vi.spyOn(Transloadit.prototype, 'getTemplate').mockRejectedValue(
       new Error('Unexpected template lookup'),
     )
@@ -721,4 +724,22 @@ describe('MCP file inputs', () => {
     })
     expect(result._meta).toEqual({ 'transloadit/widget': { authenticated: true } })
   })
+
+  it('stops downloading a URL input above maxUrlDownloadBytes', async () => {
+    serverOptions.maxUrlDownloadBytes = 1024
+    nock('http://198.51.100.10').get('/big.bin').reply(200, 'x'.repeat(4096))
+
+    const result = await client.callTool({
+      name: 'transloadit_create_assembly',
+      arguments: {
+        instructions: { steps: { ':original': { robot: '/upload/handle' } } },
+        files: [{ kind: 'url', field: 'file', url: 'http://198.51.100.10/big.bin' }],
+      },
+    })
+    expect(result.structuredContent).toMatchObject({
+      status: 'error',
+      errors: [{ message: 'URL download exceeds 1024 bytes: http://198.51.100.10/big.bin' }],
+    })
+    expect(Transloadit.prototype.createAssembly).not.toHaveBeenCalled()
+  })
 })
diff --git a/packages/mcp-server/test/unit/hosted-auth.test.ts b/packages/mcp-server/test/unit/hosted-auth.test.ts
index 458f72eb..71fbe093 100644
--- a/packages/mcp-server/test/unit/hosted-auth.test.ts
+++ b/packages/mcp-server/test/unit/hosted-auth.test.ts
@@ -377,6 +377,12 @@ describe('request body limits', () => {
     expect(response.status).toBe(413)
   })
 
+  it.each([0, -1, 1.5, Number.NaN])('refuses maxRequestBodyBytes %s', (maxRequestBodyBytes) => {
+    expect(() => createTransloaditMcpHttpHandler({ maxRequestBodyBytes })).toThrow(
+      'maxRequestBodyBytes must be a positive integer number of bytes.',
+    )
+  })
+
   it('accepts bodies within the limit', async () => {
     running = await start({ maxRequestBodyBytes: 8192, resourceMetadataUrl })
 
diff --git a/packages/mcp-server/test/unit/plugin-manifest.test.ts b/packages/mcp-server/test/unit/plugin-manifest.test.ts
index 358967e5..5ba03b19 100644
--- a/packages/mcp-server/test/unit/plugin-manifest.test.ts
+++ b/packages/mcp-server/test/unit/plugin-manifest.test.ts
@@ -1,10 +1,10 @@
 import { readFile } from 'node:fs/promises'
-import { fileURLToPath } from 'node:url'
 
 import { describe, expect, it } from 'vitest'
 import { z } from 'zod'
 
-const packageRoot = fileURLToPath(new URL('../../', import.meta.url))
+// Kept as a URL so checkout paths with `#` or spaces resolve correctly.
+const packageRoot = new URL('../../', import.meta.url)
 
 const interfaceSchema = z.object({
   composerIcon: z.string(),
@@ -13,13 +13,13 @@ const interfaceSchema = z.object({
 })
 
 const readJson = async (path: string): Promise<unknown> =>
-  JSON.parse(await readFile(new URL(path, `file://${packageRoot}`), 'utf8'))
+  JSON.parse(await readFile(new URL(path, packageRoot), 'utf8'))
 
 const pngSignature = [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]
 
 /** Plugin submission rejects manifests whose asset paths do not resolve to images. */
 const expectPng = async (assetPath: string): Promise<void> => {
-  const bytes = await readFile(new URL(assetPath, `file://${packageRoot}`))
+  const bytes = await readFile(new URL(assetPath, packageRoot))
   expect([...bytes.subarray(0, 8)], assetPath).toEqual(pngSignature)
 }
 
diff --git a/packages/mcp-server/test/unit/upstream-auth-status.test.ts b/packages/mcp-server/test/unit/upstream-auth-status.test.ts
index 6a5603f6..09f88974 100644
--- a/packages/mcp-server/test/unit/upstream-auth-status.test.ts
+++ b/packages/mcp-server/test/unit/upstream-auth-status.test.ts
@@ -219,6 +219,50 @@ describe('upstream token rejections over HTTP', () => {
     expect(response.headers.get('www-authenticate')).toContain('error="invalid_token"')
   })
 
+  it('reports a creation response error itself, not a created-but-unreadable Assembly', async () => {
+    serverOptions.resourceMetadataUrl = resourceMetadataUrl
+    nock(endpoint)
+      .post(/\/assemblies\/[a-f\d]{32}$/)
+      .reply(200, {
+        error: 'INVALID_SIGNATURE',
+        message: 'The given signature does not match ours. This Auth Key requires sha256.',
+      })
+
+    const response = await createAssemblyCall()
+    const body = await response.text()
+    expect(body).toContain('mcp_invalid_signature')
+    expect(body).not.toContain('mcp_assembly_status_unavailable')
+  })
+
+  it('checks a forwarded token before downloading any URL input', async () => {
+    serverOptions.resourceMetadataUrl = resourceMetadataUrl
+    nock(endpoint).get('/templates').query(true).reply(401, { error: 'BEARER_TOKEN_INVALID' })
+    const download = nock('http://198.51.100.10').get('/big.bin').reply(200, 'payload')
+
+    const response = await fetch(url, {
+      method: 'POST',
+      headers: {
+        Authorization: 'Bearer junk-token-that-api2-rejects',
+        'Content-Type': 'application/json',
+        Accept: 'application/json, text/event-stream',
+      },
+      body: JSON.stringify({
+        jsonrpc: '2.0',
+        id: 1,
+        method: 'tools/call',
+        params: {
+          name: 'transloadit_create_assembly',
+          arguments: {
+            instructions: { steps: { ':original': { robot: '/upload/handle' } } },
+            files: [{ kind: 'url', field: 'file', url: 'http://198.51.100.10/big.bin' }],
+          },
+        },
+      }),
+    })
+    expect(response.status).toBe(401)
+    expect(download.isDone()).toBe(false)
+  })
+
   it('keeps self-hosted rejections as tool errors over HTTP 200', async () => {
     nock(endpoint).get('/templates').query(true).reply(401, { error: 'BEARER_TOKEN_EXPIRED' })
 
diff --git a/packages/node/src/Transloadit.ts b/packages/node/src/Transloadit.ts
index 759c6d44..3b9287db 100644
--- a/packages/node/src/Transloadit.ts
+++ b/packages/node/src/Transloadit.ts
@@ -302,6 +302,11 @@ export interface CreateAssemblyOptions extends AssemblyUploadOptions {
    * Expected number of tus uploads when files will be uploaded separately.
    */
   expectedUploads?: number
+  /**
+   * Called once API2 has accepted the creation request, before uploads and polling. Callers that
+   * must not create an Assembly twice use it to tell later failures apart from rejected creation.
+   */
+  onAssemblyCreated?: (assembly: AssemblyStatus) => void
 }
 
 export interface ResumeAssemblyUploadsOptions extends AssemblyUploadOptions {
@@ -699,6 +704,7 @@ export class Transloadit {
       uploads = {},
       assemblyId,
       expectedUploads,
+      onAssemblyCreated,
       signal,
       uploadBehavior = 'await',
     } = opts
@@ -770,6 +776,7 @@ export class Transloadit {
           signal,
         })
         checkResult(result)
+        onAssemblyCreated?.(result)
 
         if (Object.keys(allStreamsMap).length > 0) {
           const { uploadUrls } = await sendTusRequest({
diff --git a/packages/node/src/inputFiles.ts b/packages/node/src/inputFiles.ts
index 14ea9d94..b867dd1a 100644
--- a/packages/node/src/inputFiles.ts
+++ b/packages/node/src/inputFiles.ts
@@ -13,6 +13,7 @@ import { mkdtemp, rm, writeFile } from 'node:fs/promises'
 import { isIP } from 'node:net'
 import { tmpdir } from 'node:os'
 import { basename, join, parse } from 'node:path'
+import { Transform } from 'node:stream'
 import { pipeline } from 'node:stream/promises'
 
 import got from 'got'
@@ -53,6 +54,10 @@ export type PrepareInputFilesOptions = {
   urlStrategy?: UrlStrategy
   maxBase64Bytes?: number
   allowPrivateUrls?: boolean
+  /** Abort a URL download once it exceeds this many bytes (declared or streamed). */
+  maxUrlDownloadBytes?: number
+  /** Abort a URL download that takes longer than this many milliseconds. */
+  urlDownloadTimeoutMs?: number
   tempDir?: string
 }
 
@@ -370,14 +375,33 @@ export function createPinnedDnsLookup(
   return pinnedDnsLookup as PinnedDnsLookup
 }
 
+/** Errors once more than `maxBytes` have streamed through, so the temp file stays bounded. */
+const limitDownloadBytes = (maxBytes: number, url: string): Transform => {
+  let received = 0
+  return new Transform({
+    transform(chunk: Buffer, _encoding, callback) {
+      received += chunk.length
+      if (received > maxBytes) {
+        callback(new Error(`URL download exceeds ${maxBytes} bytes: ${url}`))
+        return
+      }
+      callback(null, chunk)
+    },
+  })
+}
+
 const downloadUrlToFile = async ({
   allowPrivateUrls,
   filePath,
   url,
+  maxBytes,
+  timeoutMs,
 }: {
   allowPrivateUrls: boolean
   filePath: string
   url: string
+  maxBytes?: number
+  timeoutMs?: number
 }): Promise<void> => {
   let currentUrl = url
 
@@ -395,6 +419,7 @@ const downloadUrlToFile = async ({
       followRedirect: false,
       retry: { limit: 0 },
       throwHttpErrors: false,
+      ...(timeoutMs === undefined ? {} : { timeout: { request: timeoutMs } }),
     })
 
     const response = await new Promise<
@@ -427,7 +452,15 @@ const downloadUrlToFile = async ({
       throw new Error(`Failed to download URL: ${currentUrl} (${statusCode})`)
     }
 
-    await pipeline(responseStream, createWriteStream(filePath))
+    if (maxBytes === undefined) {
+      await pipeline(responseStream, createWriteStream(filePath))
+      return
+    }
+    if (Number(response.headers['content-length']) > maxBytes) {
+      responseStream.destroy()
+      throw new Error(`URL download exceeds ${maxBytes} bytes: ${url}`)
+    }
+    await pipeline(responseStream, limitDownloadBytes(maxBytes, url), createWriteStream(filePath))
     return
   }
 
@@ -445,6 +478,8 @@ export const prepareInputFiles = async (
     urlStrategy = 'import',
     maxBase64Bytes,
     allowPrivateUrls = true,
+    maxUrlDownloadBytes,
+    urlDownloadTimeoutMs,
     tempDir,
   } = options
 
@@ -534,6 +569,8 @@ export const prepareInputFiles = async (
           allowPrivateUrls,
           filePath,
           url: file.url,
+          maxBytes: maxUrlDownloadBytes,
+          timeoutMs: urlDownloadTimeoutMs,
         })
         files[file.field] = filePath
       }
diff --git a/packages/node/test/unit/create-assembly-accepted.test.ts b/packages/node/test/unit/create-assembly-accepted.test.ts
new file mode 100644
index 00000000..18ffb117
--- /dev/null
+++ b/packages/node/test/unit/create-assembly-accepted.test.ts
@@ -0,0 +1,59 @@
+import nock from 'nock'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+
+import { Transloadit } from '../../src/Transloadit.ts'
+
+const endpoint = 'https://api2.transloadit.com'
+
+describe('createAssembly onAssemblyCreated', () => {
+  afterEach(() => {
+    nock.cleanAll()
+  })
+
+  it('reports the Assembly once API2 accepted the creation request', async () => {
+    const client = new Transloadit({ authKey: 'key', authSecret: 'secret' })
+    nock(endpoint)
+      .post(/\/assemblies\/[a-f\d]{32}$/)
+      .reply((uri) => {
+        const id = uri.split('/').at(-1)
+        return [
+          200,
+          {
+            ok: 'ASSEMBLY_EXECUTING',
+            assembly_id: id,
+            assembly_url: `${endpoint}/assemblies/${id}`,
+            assembly_ssl_url: `${endpoint}/assemblies/${id}`,
+          },
+        ]
+      })
+    const created = vi.fn()
+
+    const creation = client.createAssembly({
+      params: { steps: { resized: { robot: '/image/resize', width: 1 } } },
+      onAssemblyCreated: created,
+    })
+    await creation
+    expect(created).toHaveBeenCalledWith(
+      expect.objectContaining({ assembly_id: creation.assemblyId }),
+    )
+  })
+
+  it('does not report an Assembly when the creation response carries an error', async () => {
+    const client = new Transloadit({ authKey: 'key', authSecret: 'secret' })
+    nock(endpoint)
+      .post(/\/assemblies\/[a-f\d]{32}$/)
+      .reply(200, {
+        error: 'INVALID_SIGNATURE',
+        message: 'The given signature does not match ours. This Auth Key requires sha256.',
+      })
+    const created = vi.fn()
+
+    await expect(
+      client.createAssembly({
+        params: { steps: { resized: { robot: '/image/resize', width: 1 } } },
+        onAssemblyCreated: created,
+      }),
+    ).rejects.toThrow('INVALID_SIGNATURE')
+    expect(created).not.toHaveBeenCalled()
+  })
+})
diff --git a/packages/node/test/unit/input-files.test.ts b/packages/node/test/unit/input-files.test.ts
index 1a8b5f47..24ab2024 100644
--- a/packages/node/test/unit/input-files.test.ts
+++ b/packages/node/test/unit/input-files.test.ts
@@ -270,6 +270,34 @@ describe('prepareInputFiles', () => {
     expect(lookupMock).not.toHaveBeenCalled()
   })
 
+  it('aborts a URL download larger than maxUrlDownloadBytes', async () => {
+    lookupMock.mockResolvedValue([{ address: '198.51.100.10', family: 4 }])
+    nock('http://rebind.test').get('/big').reply(200, 'x'.repeat(4096))
+
+    await expect(
+      prepareInputFiles({
+        inputFiles: [{ kind: 'url', field: 'remote', url: 'http://rebind.test/big' }],
+        urlStrategy: 'download',
+        allowPrivateUrls: false,
+        maxUrlDownloadBytes: 1024,
+      }),
+    ).rejects.toThrow('URL download exceeds 1024 bytes: http://rebind.test/big')
+  })
+
+  it('aborts a URL download slower than urlDownloadTimeoutMs', async () => {
+    lookupMock.mockResolvedValue([{ address: '198.51.100.10', family: 4 }])
+    nock('http://rebind.test').get('/slow').delay(500).reply(200, 'late')
+
+    await expect(
+      prepareInputFiles({
+        inputFiles: [{ kind: 'url', field: 'remote', url: 'http://rebind.test/slow' }],
+        urlStrategy: 'download',
+        allowPrivateUrls: false,
+        urlDownloadTimeoutMs: 50,
+      }),
+    ).rejects.toThrow(/Timeout/)
+  })
+
   it('pins URL downloads to the validated DNS answer', async () => {
     lookupMock.mockResolvedValue([{ address: '198.51.100.10', family: 4 }])
     const downloadScope = nock('http://rebind.test').get('/public').reply(200, 'public-data')

From aba9092431bad203f9ef5533f4193482518621df Mon Sep 17 00:00:00 2001
From: Kevin van Zonneveld <kevin@vanzonneveld.net>
Date: Fri, 2 Oct 2026 17:08:57 +0200
Subject: [PATCH 17/27] Address council review run 7: bounded raw bodies,
 precise token checks

Council review of PR #529 (run 7), each fix preceded by a failing test:

- Self-hosted Express apps without a body parser now also read the body within
  `maxRequestBodyBytes` (413 above it); both transports share one bounded reader.
- The token check runs through the new `prepareInputFiles({ beforeUrlDownload })` hook, so it only
  happens before a file is actually downloaded, never for `/http/import`, and tokens without
  `templates:read` keep creating Assemblies from URLs.
- The CLI forwards `urlDownloadTimeoutMs`, and download limits are validated on every server
  construction, not only in the HTTP entry points.
- Download errors name a URL's origin and path only, so presigned attachment URLs do not leak into
  tool results.
- The Save as Template comment states that the Console seeds from `fromAssembly` since
  transloadit/content#6207, which ships in the same release.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .changeset/mcp-upstream-header.md             |  5 +-
 packages/mcp-server/src/cli.ts                |  3 +-
 packages/mcp-server/src/http-helpers.ts       | 16 ++--
 packages/mcp-server/src/options.ts            | 24 ++++++
 packages/mcp-server/src/request-transport.ts  | 78 ++++++++++++-------
 packages/mcp-server/src/server.ts             | 26 ++++---
 .../mcp-server/test/unit/cli-config.test.ts   | 17 ++--
 .../mcp-server/test/unit/file-inputs.test.ts  | 12 +++
 .../test/unit/server-card-express.test.ts     | 24 ++++++
 .../mcp-server/test/unit/tool-surface.test.ts | 15 ++++
 packages/node/src/inputFiles.ts               | 35 ++++++---
 packages/node/test/unit/input-files.test.ts   | 26 +++++++
 12 files changed, 218 insertions(+), 63 deletions(-)
 create mode 100644 packages/mcp-server/src/options.ts

diff --git a/.changeset/mcp-upstream-header.md b/.changeset/mcp-upstream-header.md
index 4998c8e3..afe55613 100644
--- a/.changeset/mcp-upstream-header.md
+++ b/.changeset/mcp-upstream-header.md
@@ -11,5 +11,6 @@ Like `Authorization`, these headers are dropped when a redirect leaves the API o
 Template list omits.
 
 `prepareInputFiles()` accepts `maxUrlDownloadBytes` and `urlDownloadTimeoutMs` to bound URL
-downloads, and `createAssembly()` accepts `onAssemblyCreated`, called once API2 accepted the
-creation request.
+downloads and `beforeUrlDownload` to vouch for a requester before a file is fetched locally; its
+download errors name only a URL's origin and path, never presigned query parameters.
+`createAssembly()` accepts `onAssemblyCreated`, called once API2 accepted the creation request.
diff --git a/packages/mcp-server/src/cli.ts b/packages/mcp-server/src/cli.ts
index 8872e879..817f9870 100644
--- a/packages/mcp-server/src/cli.ts
+++ b/packages/mcp-server/src/cli.ts
@@ -186,9 +186,10 @@ const main = async (): Promise<void> => {
       mcpToken,
       resourceMetadataUrl,
       upstreamSecret,
-      // Validated by the handler, which refuses anything but a positive integer byte count.
+      // Validated by the handler, which refuses anything but positive integers.
       maxRequestBodyBytes: fileConfig.maxRequestBodyBytes as number | undefined,
       maxUrlDownloadBytes: fileConfig.maxUrlDownloadBytes as number | undefined,
+      urlDownloadTimeoutMs: fileConfig.urlDownloadTimeoutMs as number | undefined,
       signatureAlgorithm,
       resultDomains,
       consoleUrl,
diff --git a/packages/mcp-server/src/http-helpers.ts b/packages/mcp-server/src/http-helpers.ts
index feffb056..8e5613a5 100644
--- a/packages/mcp-server/src/http-helpers.ts
+++ b/packages/mcp-server/src/http-helpers.ts
@@ -2,6 +2,8 @@ import type { IncomingMessage, ServerResponse } from 'node:http'
 
 import { timingSafeEqual } from 'node:crypto'
 
+import { assertRequestBodyLimit, assertServerLimits } from './options.ts'
+
 export const parsePathname = (url: string | undefined, fallback: string): string => {
   try {
     return new URL(url ?? fallback, 'http://localhost').pathname
@@ -265,14 +267,6 @@ export const sendBodyTooLarge = (res: ServerResponse, maxBytes: number): void =>
   )
 }
 
-/** Byte limits arrive from JSON config files too, where `"1MB"` would silently disable a check. */
-const assertByteCount = (value: unknown, name: string): void => {
-  if (value === undefined) return
-  if (typeof value !== 'number' || !Number.isInteger(value) || value <= 0) {
-    throw new Error(`${name} must be a positive integer number of bytes.`)
-  }
-}
-
 /**
  * Refuses HTTP options that would fail silently later. The static-token check runs first and
  * would reject every OAuth token with a bare `Bearer` challenge, so hosted OAuth could never start.
@@ -282,14 +276,16 @@ export const assertHttpOptions = (options: {
   resourceMetadataUrl?: string
   maxRequestBodyBytes?: unknown
   maxUrlDownloadBytes?: unknown
+  urlDownloadTimeoutMs?: unknown
 }): void => {
   if (options.mcpToken && options.resourceMetadataUrl) {
     throw new Error(
       'Configure either TRANSLOADIT_MCP_TOKEN (self-hosted) or TRANSLOADIT_MCP_RESOURCE_METADATA_URL (hosted OAuth), not both.',
     )
   }
-  assertByteCount(options.maxRequestBodyBytes, 'maxRequestBodyBytes')
-  assertByteCount(options.maxUrlDownloadBytes, 'maxUrlDownloadBytes')
+  assertRequestBodyLimit(options.maxRequestBodyBytes)
+  // Also checked per server instance; repeated here so a bad config fails at startup.
+  assertServerLimits(options)
 }
 
 /**
diff --git a/packages/mcp-server/src/options.ts b/packages/mcp-server/src/options.ts
new file mode 100644
index 00000000..53f53e7d
--- /dev/null
+++ b/packages/mcp-server/src/options.ts
@@ -0,0 +1,24 @@
+/**
+ * Limits also arrive from JSON config files, where a value such as `"1MB"` would silently disable
+ * a numeric comparison, so each one must be a positive integer.
+ */
+const assertPositiveInteger = (value: unknown, name: string, unit: string): void => {
+  if (value === undefined) return
+  if (typeof value !== 'number' || !Number.isInteger(value) || value <= 0) {
+    throw new Error(`${name} must be a positive integer number of ${unit}.`)
+  }
+}
+
+/** Validates the limits every server instance applies, however it is constructed. */
+export const assertServerLimits = (options: {
+  maxUrlDownloadBytes?: unknown
+  urlDownloadTimeoutMs?: unknown
+}): void => {
+  assertPositiveInteger(options.maxUrlDownloadBytes, 'maxUrlDownloadBytes', 'bytes')
+  assertPositiveInteger(options.urlDownloadTimeoutMs, 'urlDownloadTimeoutMs', 'milliseconds')
+}
+
+/** Validates the HTTP request body limit. */
+export const assertRequestBodyLimit = (value: unknown): void => {
+  assertPositiveInteger(value, 'maxRequestBodyBytes', 'bytes')
+}
diff --git a/packages/mcp-server/src/request-transport.ts b/packages/mcp-server/src/request-transport.ts
index 2f0a4280..16a6dcc6 100644
--- a/packages/mcp-server/src/request-transport.ts
+++ b/packages/mcp-server/src/request-transport.ts
@@ -49,18 +49,52 @@ const findUpstreamChallenge = (body: string): UpstreamChallenge | undefined => {
   return undefined
 }
 
-const toWebRequest = (req: IncomingMessage, rawBody: string | undefined): Request => {
+const toWebRequest = (req: IncomingMessage): Request => {
   const headers = new Headers()
   for (const [name, value] of Object.entries(req.headers)) {
     if (value === undefined) continue
     for (const entry of Array.isArray(value) ? value : [value]) headers.append(name, entry)
   }
-  // The transport reads only headers and the body, so a fixed base URL is enough.
-  return new Request(new URL(req.url ?? '/', 'http://localhost'), {
-    method: req.method,
-    headers,
-    body: rawBody,
-  })
+  // The body always arrives pre-parsed, so headers and a fixed base URL are all it needs.
+  return new Request(new URL(req.url ?? '/', 'http://localhost'), { method: req.method, headers })
+}
+
+const sendParseError = (res: ServerResponse): void => {
+  res.statusCode = 400
+  res.setHeader('Content-Type', 'application/json')
+  res.end(
+    JSON.stringify({
+      jsonrpc: '2.0',
+      error: { code: -32700, message: 'Parse error: Invalid JSON' },
+      id: null,
+    }),
+  )
+}
+
+/**
+ * Returns the JSON-RPC message, reading it within the body limit when no parser consumed the
+ * stream yet (an Express app without `express.json()`). `undefined` means a response was sent.
+ */
+const readMessage = async (
+  req: IncomingMessage,
+  res: ServerResponse,
+  parsedBody: unknown,
+  maxBytes: number,
+): Promise<{ message: unknown } | undefined> => {
+  if (parsedBody !== undefined || req.method !== 'POST' || req.readableEnded) {
+    return { message: parsedBody }
+  }
+  const rawBody = await readBodyWithinLimit(req, maxBytes)
+  if (rawBody === undefined) {
+    sendBodyTooLarge(res, maxBytes)
+    return undefined
+  }
+  const message = parseJson(rawBody)
+  if (message === undefined) {
+    sendParseError(res)
+    return undefined
+  }
+  return { message }
 }
 
 /**
@@ -73,23 +107,9 @@ const relayHostedRequest = async (
   transport: WebStandardStreamableHTTPServerTransport,
   req: IncomingMessage,
   res: ServerResponse,
-  parsedBody: unknown,
-  maxBytes: number,
+  message: unknown,
 ): Promise<void> => {
-  // Without a body parser (an Express app lacking express.json()) the stream is still unread.
-  let rawBody: string | undefined
-  if (parsedBody === undefined && req.method === 'POST' && !req.readableEnded) {
-    rawBody = await readBodyWithinLimit(req, maxBytes)
-    if (rawBody === undefined) {
-      sendBodyTooLarge(res, maxBytes)
-      return
-    }
-  }
-  // Invalid JSON stays undefined here, so the transport parses the raw body and reports it.
-  const message = rawBody === undefined ? parsedBody : parseJson(rawBody)
-  const response = await transport.handleRequest(toWebRequest(req, rawBody), {
-    parsedBody: message,
-  })
+  const response = await transport.handleRequest(toWebRequest(req), { parsedBody: message })
   const body = await response.text()
   // A client retries the whole HTTP request after re-authorizing, so a batch keeps its 200: the
   // other calls may have succeeded (an Assembly created twice would be charged twice). Its failed
@@ -115,20 +135,26 @@ export const createRequestTransport = (options: RequestTransportOptions): Reques
     allowedHosts: options.allowedHosts,
     enableDnsRebindingProtection: options.enableDnsRebindingProtection,
   }
+  const maxBytes = resolveMaxRequestBodyBytes(options)
   if (!options.resourceMetadataUrl) {
     const transport = new StreamableHTTPServerTransport(shared)
     return {
       transport,
-      handle: (req, res, parsedBody) => transport.handleRequest(req, res, parsedBody),
+      handle: async (req, res, parsedBody) => {
+        const read = await readMessage(req, res, parsedBody, maxBytes)
+        if (read) await transport.handleRequest(req, res, read.message)
+      },
     }
   }
   const transport = new WebStandardStreamableHTTPServerTransport({
     ...shared,
     enableJsonResponse: true,
   })
-  const maxBytes = resolveMaxRequestBodyBytes(options)
   return {
     transport,
-    handle: (req, res, parsedBody) => relayHostedRequest(transport, req, res, parsedBody, maxBytes),
+    handle: async (req, res, parsedBody) => {
+      const read = await readMessage(req, res, parsedBody, maxBytes)
+      if (read) await relayHostedRequest(transport, req, res, read.message)
+    },
   }
 }
diff --git a/packages/mcp-server/src/server.ts b/packages/mcp-server/src/server.ts
index d86d5cb2..938591bf 100644
--- a/packages/mcp-server/src/server.ts
+++ b/packages/mcp-server/src/server.ts
@@ -27,6 +27,7 @@ import { z } from 'zod'
 
 import packageJson from '../package.json' with { type: 'json' }
 import { buildBearerChallenge, extractBearerToken } from './http-helpers.ts'
+import { assertServerLimits } from './options.ts'
 import { mirrorSecuritySchemes } from './tool-list.ts'
 import {
   buildToolMeta,
@@ -675,12 +676,10 @@ const buildWidgetContext = (
 
   const workspaceUrl = `${consoleUrl}/c/${encodeURIComponent(slug)}`
   const newTemplateUrl = new URL(`${workspaceUrl}/templates/new`)
-  // Known, accepted gap (product decision on PR #529, routed to Content on 2026-10-02):
-  // `fromAssembly` lets the Console seed the editor with the Assembly's effective instructions,
-  // overrides included, but Content's new-Template page does not resolve it yet. Until it does,
-  // inline runs open an empty editor and Template-based runs are seeded through `duplicateFrom`
-  // without the run's overrides. The action stays visible on purpose so the Console can start
-  // seeding without another MCP release; hiding or relabeling it is not wanted here.
+  // The Console seeds the editor from `fromAssembly` since transloadit/content#6207, which ships
+  // together with this release: it loads the Assembly's effective instructions, overrides
+  // included. `duplicateFrom` stays as the seed for Consoles that predate it. Hiding or relabeling
+  // the action was considered and rejected in review of transloadit/node-sdk#529.
   if (assemblyId) {
     newTemplateUrl.searchParams.set('fromAssembly', assemblyId)
   }
@@ -997,6 +996,7 @@ const toAssemblyInstructionsInput = (params: CreateAssemblyParams): AssemblyInst
 export const createTransloaditMcpServer = (
   options: TransloaditMcpServerOptions = {},
 ): McpServer => {
+  assertServerLimits(options)
   const server = new McpServer({
     name: options.serverName ?? 'Transloadit MCP',
     version: options.serverVersion ?? packageJson.version,
@@ -1202,10 +1202,13 @@ export const createTransloaditMcpServer = (
             )
           }
         }
-        // The hosted gate only checks that a bearer is present. A URL input may be downloaded to
-        // this server's disk, so let API2 vouch for the token first (templates:read is declared).
-        if (credentials === 'bearer' && inputFilesForPrep.some((file) => file.kind === 'url')) {
-          await client.listTemplates({ pagesize: 1 })
+        // The hosted gate only checks that a bearer is present. Before a URL input is downloaded
+        // to this server's disk (not for /http/import), API2 vouches for the token once
+        // (templates:read is declared for this tool).
+        let tokenCheck: Promise<unknown> | undefined
+        const verifyTokenBeforeDownload = async (): Promise<void> => {
+          tokenCheck ??= client.listTemplates({ pagesize: 1 })
+          await tokenCheck
         }
         const prep = await prepareInputFiles({
           inputFiles: inputFilesForPrep,
@@ -1217,7 +1220,10 @@ export const createTransloaditMcpServer = (
           maxBase64Bytes,
           maxUrlDownloadBytes: options.maxUrlDownloadBytes ?? defaultMaxUrlDownloadBytes,
           urlDownloadTimeoutMs: options.urlDownloadTimeoutMs ?? defaultUrlDownloadTimeoutMs,
+          beforeUrlDownload: credentials === 'bearer' ? verifyTokenBeforeDownload : undefined,
         }).catch((error) => {
+          // API rejections (the token check) are not input mistakes; the outer handler maps them.
+          if (error instanceof ApiError) throw error
           const message = error instanceof Error ? error.message : 'Invalid file input.'
           if (message.startsWith('Duplicate file field')) {
             return buildToolError('mcp_duplicate_field', message, { path: 'files' })
diff --git a/packages/mcp-server/test/unit/cli-config.test.ts b/packages/mcp-server/test/unit/cli-config.test.ts
index bcb55cd6..f056da2d 100644
--- a/packages/mcp-server/test/unit/cli-config.test.ts
+++ b/packages/mcp-server/test/unit/cli-config.test.ts
@@ -44,10 +44,19 @@ describe('transloadit-mcp CLI configuration', { timeout: 20000 }, () => {
     })
   })
 
-  it('refuses a config file whose maxRequestBodyBytes is not a byte count', async () => {
+  it.each([
+    [
+      { maxRequestBodyBytes: '1MB' },
+      'maxRequestBodyBytes must be a positive integer number of bytes.',
+    ],
+    [
+      { urlDownloadTimeoutMs: '10m' },
+      'urlDownloadTimeoutMs must be a positive integer number of milliseconds.',
+    ],
+  ])('refuses the config file %j', async (config, message) => {
     const directory = await mkdtemp(join(tmpdir(), 'mcp-config-'))
     const configPath = join(directory, 'config.json')
-    await writeFile(configPath, JSON.stringify({ maxRequestBodyBytes: '1MB' }))
+    await writeFile(configPath, JSON.stringify(config))
 
     const result = spawnSync(process.execPath, [cliPath, 'http', '--config', configPath], {
       env: process.env,
@@ -58,9 +67,7 @@ describe('transloadit-mcp CLI configuration', { timeout: 20000 }, () => {
     await rm(directory, { recursive: true, force: true })
 
     expect(result.status).toBe(1)
-    expect(`${result.stdout}${result.stderr}`).toContain(
-      'maxRequestBodyBytes must be a positive integer number of bytes.',
-    )
+    expect(`${result.stdout}${result.stderr}`).toContain(message)
   })
 
   it('refuses to start with an unsupported TRANSLOADIT_SIGNATURE_ALGORITHM', () => {
diff --git a/packages/mcp-server/test/unit/file-inputs.test.ts b/packages/mcp-server/test/unit/file-inputs.test.ts
index 9831c19e..642bcca1 100644
--- a/packages/mcp-server/test/unit/file-inputs.test.ts
+++ b/packages/mcp-server/test/unit/file-inputs.test.ts
@@ -725,6 +725,18 @@ describe('MCP file inputs', () => {
     expect(result._meta).toEqual({ 'transloadit/widget': { authenticated: true } })
   })
 
+  it('does not require Template access when /http/import fetches the URL', async () => {
+    const result = await client.callTool({
+      name: 'transloadit_create_assembly',
+      arguments: {
+        instructions: { steps: { source: { robot: '/http/import' } } },
+        files: [{ kind: 'url', field: 'file', url: 'https://example.com/fixture.txt' }],
+      },
+    })
+    expect(result.structuredContent).toMatchObject({ status: 'ok' })
+    expect(Transloadit.prototype.listTemplates).not.toHaveBeenCalled()
+  })
+
   it('stops downloading a URL input above maxUrlDownloadBytes', async () => {
     serverOptions.maxUrlDownloadBytes = 1024
     nock('http://198.51.100.10').get('/big.bin').reply(200, 'x'.repeat(4096))
diff --git a/packages/mcp-server/test/unit/server-card-express.test.ts b/packages/mcp-server/test/unit/server-card-express.test.ts
index 812122d7..614d85a5 100644
--- a/packages/mcp-server/test/unit/server-card-express.test.ts
+++ b/packages/mcp-server/test/unit/server-card-express.test.ts
@@ -151,6 +151,30 @@ describe('hosted Express router', () => {
     expect(response.status).toBe(413)
   })
 
+  it('refuses unparsed self-hosted bodies above the configured limit', async () => {
+    running = await startHostedRouter({ resourceMetadataUrl: undefined, maxRequestBodyBytes: 1024 })
+
+    const response = await postMcp(
+      JSON.stringify({
+        jsonrpc: '2.0',
+        id: 1,
+        method: 'tools/list',
+        params: { pad: 'x'.repeat(4096) },
+      }),
+    )
+    expect(response.status).toBe(413)
+  })
+
+  it('serves unparsed self-hosted bodies within the limit', async () => {
+    running = await startHostedRouter({ resourceMetadataUrl: undefined })
+
+    const response = await postMcp(
+      JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/list', params: {} }),
+    )
+    expect(response.status).toBe(200)
+    expect(await response.text()).toContain('transloadit_list_robots')
+  })
+
   it('reads the request body itself when no JSON body parser is installed', async () => {
     const app = express()
     app.use(
diff --git a/packages/mcp-server/test/unit/tool-surface.test.ts b/packages/mcp-server/test/unit/tool-surface.test.ts
index 11009827..e7b8cd5d 100644
--- a/packages/mcp-server/test/unit/tool-surface.test.ts
+++ b/packages/mcp-server/test/unit/tool-surface.test.ts
@@ -331,3 +331,18 @@ describe('tools registered after creation', () => {
     await server.close()
   })
 })
+
+describe('direct server construction', () => {
+  it.each([
+    [
+      { maxUrlDownloadBytes: Number.NaN },
+      'maxUrlDownloadBytes must be a positive integer number of bytes.',
+    ],
+    [
+      { urlDownloadTimeoutMs: 0 },
+      'urlDownloadTimeoutMs must be a positive integer number of milliseconds.',
+    ],
+  ])('refuses %j', (options, message) => {
+    expect(() => createTransloaditMcpServer(options)).toThrow(message)
+  })
+})
diff --git a/packages/node/src/inputFiles.ts b/packages/node/src/inputFiles.ts
index b867dd1a..f5083835 100644
--- a/packages/node/src/inputFiles.ts
+++ b/packages/node/src/inputFiles.ts
@@ -58,6 +58,11 @@ export type PrepareInputFilesOptions = {
   maxUrlDownloadBytes?: number
   /** Abort a URL download that takes longer than this many milliseconds. */
   urlDownloadTimeoutMs?: number
+  /**
+   * Awaited before each URL input is downloaded locally (not for `/http/import`), so a caller can
+   * vouch for the requester first; rejecting aborts preparation.
+   */
+  beforeUrlDownload?: () => Promise<void>
   tempDir?: string
 }
 
@@ -207,6 +212,16 @@ const isPrivateIp = (address: string): boolean => {
   return false
 }
 
+/**
+ * Names a URL in error messages without its query or fragment: input URLs are often presigned
+ * (ChatGPT attachments, S3), and these messages reach logs and model-visible tool results.
+ */
+const describeUrl = (value: string): string => {
+  if (!URL.canParse(value)) return '[unparseable URL]'
+  const url = new URL(value)
+  return `${url.origin}${url.pathname}`
+}
+
 export const resolvePublicDownloadAddresses = async (
   value: string,
 ): Promise<Array<{ address: string; family: 4 | 6 }>> => {
@@ -216,10 +231,10 @@ export const resolvePublicDownloadAddresses = async (
       ? parsed.hostname.slice(1, -1)
       : parsed.hostname
   if (!['http:', 'https:'].includes(parsed.protocol)) {
-    throw new Error(`URL downloads are limited to http/https: ${value}`)
+    throw new Error(`URL downloads are limited to http/https: ${describeUrl(value)}`)
   }
   if (isPrivateIp(hostname)) {
-    throw new Error(`URL downloads are limited to public hosts: ${value}`)
+    throw new Error(`URL downloads are limited to public hosts: ${describeUrl(value)}`)
   }
 
   const literalFamily = isIP(hostname)
@@ -231,11 +246,11 @@ export const resolvePublicDownloadAddresses = async (
           verbatim: true,
         })
   if (resolvedAddresses.some((address) => isPrivateIp(address.address))) {
-    throw new Error(`URL downloads are limited to public hosts: ${value}`)
+    throw new Error(`URL downloads are limited to public hosts: ${describeUrl(value)}`)
   }
 
   if (resolvedAddresses.length === 0) {
-    throw new Error(`Unable to resolve URL hostname: ${value}`)
+    throw new Error(`Unable to resolve URL hostname: ${describeUrl(value)}`)
   }
 
   return resolvedAddresses.map((address) => ({
@@ -382,7 +397,7 @@ const limitDownloadBytes = (maxBytes: number, url: string): Transform => {
     transform(chunk: Buffer, _encoding, callback) {
       received += chunk.length
       if (received > maxBytes) {
-        callback(new Error(`URL download exceeds ${maxBytes} bytes: ${url}`))
+        callback(new Error(`URL download exceeds ${maxBytes} bytes: ${describeUrl(url)}`))
         return
       }
       callback(null, chunk)
@@ -441,7 +456,7 @@ const downloadUrlToFile = async ({
       responseStream.destroy()
       const location = response.headers.location
       if (location == null) {
-        throw new Error(`Redirect response missing Location header: ${currentUrl}`)
+        throw new Error(`Redirect response missing Location header: ${describeUrl(currentUrl)}`)
       }
       currentUrl = new URL(location, currentUrl).toString()
       continue
@@ -449,7 +464,7 @@ const downloadUrlToFile = async ({
 
     if (statusCode >= 400) {
       responseStream.destroy()
-      throw new Error(`Failed to download URL: ${currentUrl} (${statusCode})`)
+      throw new Error(`Failed to download URL: ${describeUrl(currentUrl)} (${statusCode})`)
     }
 
     if (maxBytes === undefined) {
@@ -458,13 +473,13 @@ const downloadUrlToFile = async ({
     }
     if (Number(response.headers['content-length']) > maxBytes) {
       responseStream.destroy()
-      throw new Error(`URL download exceeds ${maxBytes} bytes: ${url}`)
+      throw new Error(`URL download exceeds ${maxBytes} bytes: ${describeUrl(url)}`)
     }
     await pipeline(responseStream, limitDownloadBytes(maxBytes, url), createWriteStream(filePath))
     return
   }
 
-  throw new Error(`Too many redirects while downloading URL input: ${url}`)
+  throw new Error(`Too many redirects while downloading URL input: ${describeUrl(url)}`)
 }
 
 export const prepareInputFiles = async (
@@ -480,6 +495,7 @@ export const prepareInputFiles = async (
     allowPrivateUrls = true,
     maxUrlDownloadBytes,
     urlDownloadTimeoutMs,
+    beforeUrlDownload,
     tempDir,
   } = options
 
@@ -565,6 +581,7 @@ export const prepareInputFiles = async (
           getFilenameFromUrl(file.url) ??
           `${file.field}.bin`
         const filePath = await ensureUniqueTempFilePath(root, filename, usedTempPaths)
+        await beforeUrlDownload?.()
         await downloadUrlToFile({
           allowPrivateUrls,
           filePath,
diff --git a/packages/node/test/unit/input-files.test.ts b/packages/node/test/unit/input-files.test.ts
index 24ab2024..f8642503 100644
--- a/packages/node/test/unit/input-files.test.ts
+++ b/packages/node/test/unit/input-files.test.ts
@@ -284,6 +284,32 @@ describe('prepareInputFiles', () => {
     ).rejects.toThrow('URL download exceeds 1024 bytes: http://rebind.test/big')
   })
 
+  it('keeps signed query parameters out of download errors', async () => {
+    lookupMock.mockResolvedValue([{ address: '198.51.100.10', family: 4 }])
+    nock('http://rebind.test').get('/big').query(true).reply(200, 'x'.repeat(4096))
+    nock('http://rebind.test').get('/gone').query(true).reply(404, 'missing')
+
+    await expect(
+      prepareInputFiles({
+        inputFiles: [
+          { kind: 'url', field: 'remote', url: 'http://rebind.test/big?X-Amz-Signature=secret' },
+        ],
+        urlStrategy: 'download',
+        allowPrivateUrls: false,
+        maxUrlDownloadBytes: 1024,
+      }),
+    ).rejects.toThrow(/^URL download exceeds 1024 bytes: http:\/\/rebind\.test\/big$/)
+    await expect(
+      prepareInputFiles({
+        inputFiles: [
+          { kind: 'url', field: 'remote', url: 'http://rebind.test/gone?X-Amz-Signature=secret' },
+        ],
+        urlStrategy: 'download',
+        allowPrivateUrls: false,
+      }),
+    ).rejects.toThrow(/^Failed to download URL: http:\/\/rebind\.test\/gone \(404\)$/)
+  })
+
   it('aborts a URL download slower than urlDownloadTimeoutMs', async () => {
     lookupMock.mockResolvedValue([{ address: '198.51.100.10', family: 4 }])
     nock('http://rebind.test').get('/slow').delay(500).reply(200, 'late')

From fe78249c186ffeb9edaeb9de56dad7d723eea6a3 Mon Sep 17 00:00:00 2001
From: Kevin van Zonneveld <kevin@vanzonneveld.net>
Date: Fri, 2 Oct 2026 17:14:55 +0200
Subject: [PATCH 18/27] Address council review run 8: no OAuth challenge
 without a hosted AS

Council review of PR #529 (run 8; Codex reviewer and arbiter failed on a token refresh, so only
Claude's raw review ran):

- A self-hosted server without credentials returned an `insufficient_scope` OAuth challenge,
  although no authorization server exists to link an account with. It now returns a plain
  `mcp_missing_auth` error naming TRANSLOADIT_KEY/TRANSLOADIT_SECRET; hosted servers keep the
  challenge. Test first.
- The changeset now records the changed shape of that self-hosted error.
- P3 notes (token-check network errors, the unused createMcpRequestHandler, attachment field name
  collisions, CLI config casts) are listed as follow-ups on the PR.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .changeset/mcp-oauth-discovery.md             |  3 +++
 packages/mcp-server/src/server.ts             | 21 ++++++++++++-------
 .../mcp-server/test/unit/auth-errors.test.ts  | 21 ++++++++++++++++---
 3 files changed, 34 insertions(+), 11 deletions(-)

diff --git a/.changeset/mcp-oauth-discovery.md b/.changeset/mcp-oauth-discovery.md
index 7dd8eed3..2484ee08 100644
--- a/.changeset/mcp-oauth-discovery.md
+++ b/.changeset/mcp-oauth-discovery.md
@@ -14,6 +14,9 @@ connector requirements.
   `_meta.securitySchemes`, that match the deployment: `oauth2` with each tool's full scopes when
   hosted, `noauth` where the server holds an Auth Key or a tool needs no account. Auth failures return `isError` results with
   `_meta["mcp/www_authenticate"]` so hosts show their account-linking UI.
+- Behavior change for self-hosted servers without credentials: account tools now return an
+  `isError` result with `mcp_missing_auth` and a hint naming `TRANSLOADIT_KEY`/`TRANSLOADIT_SECRET`
+  (`transloadit_list_templates` no longer adds an empty `templates` list to that error).
 - New `transloadit_get_profile` tool (`_meta["openai/profile"]`) returns the Workspace behind the
   credentials for multi-account hosts.
 - `transloadit_create_assembly` accepts ChatGPT-attached files through `attachments`
diff --git a/packages/mcp-server/src/server.ts b/packages/mcp-server/src/server.ts
index 938591bf..ae772334 100644
--- a/packages/mcp-server/src/server.ts
+++ b/packages/mcp-server/src/server.ts
@@ -403,14 +403,19 @@ const buildAuthError = (
   )
 
 const buildMissingAuthError = (options: TransloaditMcpServerOptions): CallToolResult =>
-  buildAuthError(options, {
-    code: 'mcp_missing_auth',
-    oauthError: 'insufficient_scope',
-    message: 'Sign in to Transloadit to use this tool.',
-    hint: options.resourceMetadataUrl
-      ? 'Connect your Transloadit account through OAuth, then retry.'
-      : 'Set TRANSLOADIT_KEY/TRANSLOADIT_SECRET or send an Authorization: Bearer token.',
-  })
+  // Only a hosted server has an authorization server a host could link an account with.
+  options.resourceMetadataUrl
+    ? buildAuthError(options, {
+        code: 'mcp_missing_auth',
+        oauthError: 'insufficient_scope',
+        message: 'Sign in to Transloadit to use this tool.',
+        hint: 'Connect your Transloadit account through OAuth, then retry.',
+      })
+    : buildCredentialError({
+        code: 'mcp_missing_auth',
+        message: 'This server has no Transloadit credentials for this tool.',
+        hint: 'Set TRANSLOADIT_KEY/TRANSLOADIT_SECRET or send an Authorization: Bearer token.',
+      })
 
 const buildToolError = (
   code: string,
diff --git a/packages/mcp-server/test/unit/auth-errors.test.ts b/packages/mcp-server/test/unit/auth-errors.test.ts
index f452e667..4eac660c 100644
--- a/packages/mcp-server/test/unit/auth-errors.test.ts
+++ b/packages/mcp-server/test/unit/auth-errors.test.ts
@@ -6,10 +6,12 @@ import { createServer } from 'node:http'
 
 import { Client } from '@modelcontextprotocol/sdk/client/index.js'
 import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js'
+import { InMemoryTransport } from '@modelcontextprotocol/sdk/inMemory.js'
 import { Transloadit } from '@transloadit/node'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 import { createTransloaditMcpHttpHandler } from '../../src/http.ts'
+import { createTransloaditMcpServer } from '../../src/server.ts'
 
 const resourceMetadataUrl = 'https://api2.transloadit.com/.well-known/oauth-protected-resource/mcp'
 
@@ -65,7 +67,7 @@ describe('tool auth errors', () => {
     'transloadit_wait_for_assembly',
     'transloadit_list_templates',
     'transloadit_get_profile',
-  ])('%s asks the host to link an account when no credentials exist', async (name) => {
+  ])('%s names the missing server credentials when self-hosted', async (name) => {
     await connect()
     const result = await client.callTool({
       name,
@@ -77,11 +79,24 @@ describe('tool auth errors', () => {
     expect(result.isError).toBe(true)
     expect(result.structuredContent).toMatchObject({
       status: 'error',
-      errors: [{ code: 'mcp_missing_auth' }],
+      errors: [{ code: 'mcp_missing_auth', hint: expect.stringContaining('TRANSLOADIT_KEY') }],
     })
+    // There is no authorization server to link an account with, so no OAuth challenge.
+    expect(result._meta?.['mcp/www_authenticate']).toBeUndefined()
+  })
+
+  it('asks the host to link an account when a hosted server gets no token', async () => {
+    const server = createTransloaditMcpServer({ resourceMetadataUrl })
+    const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair()
+    client = new Client({ name: 'auth-errors-hosted', version: '1.0.0' })
+    await Promise.all([server.connect(serverTransport), client.connect(clientTransport)])
+
+    const result = await client.callTool({ name: 'transloadit_list_templates', arguments: {} })
+    expect(result.isError).toBe(true)
     expect(wwwAuthenticate(result)).toMatch(
-      /^Bearer error="insufficient_scope", error_description="[^"]+"$/,
+      /^Bearer resource_metadata="[^"]+", error="insufficient_scope", error_description="[^"]+"$/,
     )
+    await server.close()
   })
 
   it('reports rejected tokens on Assembly tools without leaking the API response', async () => {

From 27baf4099ec2f1d0cf8cb169ae3958eb1ca92a56 Mon Sep 17 00:00:00 2001
From: Kevin van Zonneveld <kevin@vanzonneveld.net>
Date: Fri, 2 Oct 2026 17:31:37 +0200
Subject: [PATCH 19/27] Address council review run 9: readable errors for
 schema-validating clients

The SDK client validates structuredContent against a tool's output schema even on isError
results once it has listed the tools, so a missing-credentials error from
transloadit_list_templates (no `templates`) or an unavailable profile (strict schema) surfaced
as -32602 and hid the hint. Those two tools now return errors as text plus `_meta` only; the
other tools' error payloads already conform to their schemas. Tests first, calling listTools()
before callTool() as real clients do.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 packages/mcp-server/src/server.ts             | 44 ++++++++++++-------
 .../mcp-server/test/unit/auth-errors.test.ts  | 22 +++++++++-
 .../test/unit/signature-algorithm.test.ts     |  5 ++-
 3 files changed, 52 insertions(+), 19 deletions(-)

diff --git a/packages/mcp-server/src/server.ts b/packages/mcp-server/src/server.ts
index ae772334..d54e7629 100644
--- a/packages/mcp-server/src/server.ts
+++ b/packages/mcp-server/src/server.ts
@@ -366,6 +366,16 @@ const buildToolResponse = (
   }
 }
 
+/**
+ * The SDK client validates `structuredContent` against a tool's output schema even on `isError`
+ * results, so tools whose schema cannot describe an error (Template lists, the strict profile)
+ * return errors as text only. The text still carries the code and hint as JSON.
+ */
+const withoutStructuredContent = (result: CallToolResult): CallToolResult => {
+  const { structuredContent: _structuredContent, ...rest } = result
+  return rest
+}
+
 type AuthErrorInput = {
   code: 'mcp_missing_auth' | 'mcp_auth_rejected' | 'mcp_insufficient_scope'
   oauthError: 'invalid_token' | 'insufficient_scope'
@@ -1515,7 +1525,7 @@ export const createTransloaditMcpServer = (
     listTemplatesOutputSchema,
     async ({ page, page_size, sort, order, keywords, include_builtin, include_content }, extra) => {
       const liveClient = createLiveClient(options, extra)
-      if ('error' in liveClient) return liveClient.error
+      if ('error' in liveClient) return withoutStructuredContent(liveClient.error)
 
       try {
         const response = await liveClient.client.listTemplates({
@@ -1557,7 +1567,7 @@ export const createTransloaditMcpServer = (
           liveClient.credentials,
           toolMetadata.transloadit_list_templates.scopes,
         )
-        if (rejection) return rejection
+        if (rejection) return withoutStructuredContent(rejection)
         const message = error instanceof Error ? error.message : 'Failed to list templates.'
         return buildToolResponse({
           status: 'error',
@@ -1579,7 +1589,7 @@ export const createTransloaditMcpServer = (
     getProfileOutputSchema,
     async (_args, extra) => {
       const liveClient = createLiveClient(options, extra)
-      if ('error' in liveClient) return liveClient.error
+      if ('error' in liveClient) return withoutStructuredContent(liveClient.error)
 
       let profile: WorkspaceProfile | undefined
       try {
@@ -1591,24 +1601,26 @@ export const createTransloaditMcpServer = (
           liveClient.credentials,
           toolMetadata.transloadit_get_profile.scopes,
         )
-        if (rejection) return rejection
+        if (rejection) return withoutStructuredContent(rejection)
         throw error
       }
 
       if (!profile) {
         // The strict profile output schema has no error shape, so this must be an error result.
-        return buildToolResponse(
-          {
-            status: 'error',
-            errors: [
-              {
-                code: 'mcp_profile_unavailable',
-                message: 'Could not determine the Workspace behind these credentials yet.',
-                hint: 'Create an Assembly or a Template first, then call this tool again.',
-              },
-            ],
-          },
-          { isError: true },
+        return withoutStructuredContent(
+          buildToolResponse(
+            {
+              status: 'error',
+              errors: [
+                {
+                  code: 'mcp_profile_unavailable',
+                  message: 'Could not determine the Workspace behind these credentials yet.',
+                  hint: 'Create an Assembly or a Template first, then call this tool again.',
+                },
+              ],
+            },
+            { isError: true },
+          ),
         )
       }
       return buildToolResponse(profile)
diff --git a/packages/mcp-server/test/unit/auth-errors.test.ts b/packages/mcp-server/test/unit/auth-errors.test.ts
index 4eac660c..7774f0ca 100644
--- a/packages/mcp-server/test/unit/auth-errors.test.ts
+++ b/packages/mcp-server/test/unit/auth-errors.test.ts
@@ -12,6 +12,7 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 import { createTransloaditMcpHttpHandler } from '../../src/http.ts'
 import { createTransloaditMcpServer } from '../../src/server.ts'
+import { parseToolPayload } from '../e2e/mcp-client.ts'
 
 const resourceMetadataUrl = 'https://api2.transloadit.com/.well-known/oauth-protected-resource/mcp'
 
@@ -77,7 +78,7 @@ describe('tool auth errors', () => {
           : {},
     })
     expect(result.isError).toBe(true)
-    expect(result.structuredContent).toMatchObject({
+    expect(parseToolPayload(result)).toMatchObject({
       status: 'error',
       errors: [{ code: 'mcp_missing_auth', hint: expect.stringContaining('TRANSLOADIT_KEY') }],
     })
@@ -85,6 +86,21 @@ describe('tool auth errors', () => {
     expect(result._meta?.['mcp/www_authenticate']).toBeUndefined()
   })
 
+  // The SDK client validates structuredContent against the output schema even for isError results
+  // once it has listed the tools, so errors from tools whose schema cannot hold them must still
+  // reach the caller.
+  it.each([
+    'transloadit_list_templates',
+    'transloadit_get_profile',
+  ])('%s returns a readable error to a client that listed the tools', async (name) => {
+    await connect()
+    await client.listTools()
+
+    const result = await client.callTool({ name, arguments: {} })
+    expect(result.isError).toBe(true)
+    expect(parseToolPayload(result)).toMatchObject({ errors: [{ code: 'mcp_missing_auth' }] })
+  })
+
   it('asks the host to link an account when a hosted server gets no token', async () => {
     const server = createTransloaditMcpServer({ resourceMetadataUrl })
     const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair()
@@ -230,8 +246,10 @@ describe('profile tool', () => {
     vi.spyOn(Transloadit.prototype, 'listAssemblies').mockResolvedValue({ items: [], count: 0 })
     vi.spyOn(Transloadit.prototype, 'listTemplates').mockResolvedValue({ items: [], count: 0 })
 
+    await client.listTools()
     const result = await client.callTool({ name: 'transloadit_get_profile', arguments: {} })
-    expect(result.structuredContent).toMatchObject({
+    expect(result.isError).toBe(true)
+    expect(parseToolPayload(result)).toMatchObject({
       status: 'error',
       errors: [{ code: 'mcp_profile_unavailable' }],
     })
diff --git a/packages/mcp-server/test/unit/signature-algorithm.test.ts b/packages/mcp-server/test/unit/signature-algorithm.test.ts
index 0a40354e..4de98173 100644
--- a/packages/mcp-server/test/unit/signature-algorithm.test.ts
+++ b/packages/mcp-server/test/unit/signature-algorithm.test.ts
@@ -6,6 +6,7 @@ import nock from 'nock'
 import { afterEach, describe, expect, it } from 'vitest'
 
 import { createTransloaditMcpServer } from '../../src/server.ts'
+import { parseToolPayload } from '../e2e/mcp-client.ts'
 
 const endpoint = 'https://api2.transloadit.com'
 
@@ -67,8 +68,10 @@ describe('key/secret signature algorithm', () => {
     })
     client = await connect({})
 
+    await client.listTools()
     const result = await client.callTool({ name: 'transloadit_list_templates', arguments: {} })
-    expect(result.structuredContent).toMatchObject({
+    expect(result.isError).toBe(true)
+    expect(parseToolPayload(result)).toMatchObject({
       status: 'error',
       errors: [
         {

From 542f6b582e9a91ad19a7aaead0e11b6ce1239949 Mon Sep 17 00:00:00 2001
From: Kevin van Zonneveld <kevin@vanzonneveld.net>
Date: Fri, 2 Oct 2026 17:46:55 +0200
Subject: [PATCH 20/27] Note the Express Origin enforcement change in the
 changeset

Council review run 10 (full run, no P1 or P2) asked for the compatibility note; the server-card
flag for hosted servers that also hold credentials is listed as a PR follow-up.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .changeset/mcp-oauth-discovery.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.changeset/mcp-oauth-discovery.md b/.changeset/mcp-oauth-discovery.md
index 2484ee08..b9171055 100644
--- a/.changeset/mcp-oauth-discovery.md
+++ b/.changeset/mcp-oauth-discovery.md
@@ -17,6 +17,9 @@ connector requirements.
 - Behavior change for self-hosted servers without credentials: account tools now return an
   `isError` result with `mcp_missing_auth` and a hint naming `TRANSLOADIT_KEY`/`TRANSLOADIT_SECRET`
   (`transloadit_list_templates` no longer adds an empty `templates` list to that error).
+- Behavior change for Express mounts: explicit `allowedOrigins` are now enforced by the router
+  (wildcards `*.` and `:*` supported) even without DNS rebinding protection, so other browser
+  Origins get HTTP 403 and allowed ones receive CORS headers.
 - New `transloadit_get_profile` tool (`_meta["openai/profile"]`) returns the Workspace behind the
   credentials for multi-account hosts.
 - `transloadit_create_assembly` accepts ChatGPT-attached files through `attachments`

From b71baf94bb395effcdce25213f6600dab0f40d9c Mon Sep 17 00:00:00 2001
From: Kevin van Zonneveld <kevin@vanzonneveld.net>
Date: Fri, 2 Oct 2026 20:37:18 +0200
Subject: [PATCH 21/27] Let agents upload sandbox-only files through
 upload_instructions

Hosts such as Claude.ai do not hand chat attachments to connector tools, and model-emitted base64
is impractical, so an agent whose file lives only in its sandbox could not use Transloadit.
`transloadit_create_assembly` with `expected_uploads` now returns `upload_instructions`: per file
the tus endpoint, the tus metadata (assembly_url, fieldname) and a ready-to-run `curl` command
using tus creation-with-upload (verified against devdock's tusd, which advertises it). The shell
derives the length and base64 filename from the file, so spaces and unicode work. The commands
carry no credentials; the Assembly URL is the only capability. The call no longer blocks on
`wait_for_completion` while uploads are pending and points to `transloadit_wait_for_assembly`.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .changeset/mcp-oauth-discovery.md             |   3 +
 packages/mcp-server/README.md                 |  19 ++
 packages/mcp-server/src/server.ts             |  31 ++-
 packages/mcp-server/src/tool-metadata.ts      |   2 +-
 .../mcp-server/src/upload-instructions.ts     |  54 +++++
 .../test/unit/upload-instructions.test.ts     | 204 ++++++++++++++++++
 6 files changed, 308 insertions(+), 5 deletions(-)
 create mode 100644 packages/mcp-server/src/upload-instructions.ts
 create mode 100644 packages/mcp-server/test/unit/upload-instructions.test.ts

diff --git a/.changeset/mcp-oauth-discovery.md b/.changeset/mcp-oauth-discovery.md
index b9171055..ea766c45 100644
--- a/.changeset/mcp-oauth-discovery.md
+++ b/.changeset/mcp-oauth-discovery.md
@@ -20,6 +20,9 @@ connector requirements.
 - Behavior change for Express mounts: explicit `allowedOrigins` are now enforced by the router
   (wildcards `*.` and `:*` supported) even without DNS rebinding protection, so other browser
   Origins get HTTP 403 and allowed ones receive CORS headers.
+- `transloadit_create_assembly` with `expected_uploads` returns `upload_instructions`: per file the
+  tus endpoint, metadata and a credential-free `curl` command (tus creation-with-upload), so agents
+  can upload files that exist only in their sandbox, then call `transloadit_wait_for_assembly`.
 - New `transloadit_get_profile` tool (`_meta["openai/profile"]`) returns the Workspace behind the
   credentials for multi-account hosts.
 - `transloadit_create_assembly` accepts ChatGPT-attached files through `attachments`
diff --git a/packages/mcp-server/README.md b/packages/mcp-server/README.md
index c505a6d4..e065cb93 100644
--- a/packages/mcp-server/README.md
+++ b/packages/mcp-server/README.md
@@ -410,6 +410,25 @@ type Attachment = {
 Each attachment becomes a URL input (`attachment_1`, `attachment_2`, …) and follows the URL rules
 below.
 
+### Files that exist only locally or in your sandbox
+
+If the file exists only locally or in your sandbox, call `transloadit_create_assembly` with
+`expected_uploads` and run the returned `upload_instructions`; this needs outbound HTTPS from the
+sandbox to Transloadit (Claude.ai: Settings → code execution network access must allow it). Hosts
+such as Claude.ai do not hand chat attachments to connector tools, and base64 in tool arguments is
+impractical for anything but tiny files, so the agent uploads the file itself:
+
+1. Call `transloadit_create_assembly` with your instructions and `expected_uploads: 1` (one per
+   file). The call returns right away, even with `wait_for_completion: true`, because the Assembly
+   now waits for those uploads.
+2. Each `upload_instructions` entry has the tus endpoint, the tus metadata (`assembly_url`,
+   `fieldname`) and a ready-to-run `curl` command. Set `FILE` to the file's path and run it in a
+   bash shell; it prints `201` once the file is uploaded (tus creation-with-upload, one request).
+3. Call `transloadit_wait_for_assembly` with the Assembly URL.
+
+The commands contain no credentials: the Assembly URL is the only capability, and it lets the holder
+add files to that one Assembly while it waits for uploads.
+
 ## Limits
 
 These limits apply to inline JSON/base64 payloads. For larger files, use a public URL or upload from
diff --git a/packages/mcp-server/src/server.ts b/packages/mcp-server/src/server.ts
index d54e7629..e3a7fa0c 100644
--- a/packages/mcp-server/src/server.ts
+++ b/packages/mcp-server/src/server.ts
@@ -36,6 +36,7 @@ import {
   toolMetadata,
 } from './tool-metadata.ts'
 import { registerAssemblyResultWidget, widgetContextMetaKey } from './ui/assembly-result-widget.ts'
+import { buildUploadInstructions, uploadInstructionSchema } from './upload-instructions.ts'
 
 export type TransloaditMcpServerOptions = {
   authKey?: string
@@ -242,6 +243,7 @@ const createAssemblyOutputSchema = z.object({
       upload_urls: z.record(z.string(), z.string()).optional(),
     })
     .optional(),
+  upload_instructions: z.array(uploadInstructionSchema).optional(),
   next_steps: z.array(z.string()).optional(),
   errors: z.array(toolMessageSchema).optional(),
   warnings: z.array(toolMessageSchema).optional(),
@@ -1265,7 +1267,17 @@ export const createTransloaditMcpServer = (
         }
 
         const timeout = wait_timeout_ms
-        const waitForCompletion = wait_for_completion ?? false
+        // Files the caller uploads itself (from a sandbox) can only start once this call returns,
+        // so waiting here would just run into the timeout.
+        const outOfBandUploads = reference ? 0 : Math.max((expected_uploads ?? 0) - totalFiles, 0)
+        const waitForCompletion = (wait_for_completion ?? false) && outOfBandUploads === 0
+        if (wait_for_completion && outOfBandUploads > 0) {
+          warnings.push({
+            code: 'mcp_wait_skipped_for_uploads',
+            message:
+              'Did not wait for completion because the Assembly waits for the expected uploads. Run upload_instructions, then call transloadit_wait_for_assembly.',
+          })
+        }
         const uploadBehavior = upload_behavior ?? (waitForCompletion ? 'await' : 'background')
         const uploadConcurrency = upload_concurrency
         const chunkSize = upload_chunk_size
@@ -1338,15 +1350,26 @@ export const createTransloaditMcpServer = (
           uploadSummary.upload_urls = assembly.upload_urls as Record<string, string>
         }
 
-        const nextSteps = waitForCompletion
-          ? []
-          : ['transloadit_wait_for_assembly', 'transloadit_get_assembly_status']
+        const uploadInstructions =
+          outOfBandUploads > 0 ? buildUploadInstructions(assembly, outOfBandUploads) : undefined
+        if (outOfBandUploads > 0 && !uploadInstructions) {
+          warnings.push({
+            code: 'mcp_upload_instructions_unavailable',
+            message: 'The Assembly status has no tus_url or assembly_ssl_url to upload to.',
+          })
+        }
+        const nextSteps = uploadInstructions
+          ? ['transloadit_wait_for_assembly']
+          : waitForCompletion
+            ? []
+            : ['transloadit_wait_for_assembly', 'transloadit_get_assembly_status']
 
         return buildToolResponse(
           {
             status: 'ok',
             assembly,
             upload: uploadSummary,
+            upload_instructions: uploadInstructions,
             next_steps: nextSteps,
             warnings: warnings.length > 0 ? warnings : undefined,
           },
diff --git a/packages/mcp-server/src/tool-metadata.ts b/packages/mcp-server/src/tool-metadata.ts
index 133aa3e1..7685ba1d 100644
--- a/packages/mcp-server/src/tool-metadata.ts
+++ b/packages/mcp-server/src/tool-metadata.ts
@@ -101,7 +101,7 @@ export const toolMetadata: Record<ToolName, ToolMetadata> = {
   transloadit_create_assembly: {
     title: 'Create or resume an Assembly',
     description:
-      'Create or resume an Assembly, optionally uploading files and waiting for completion. Files attached in the chat arrive under attachments; public URLs and small base64 payloads go under files.',
+      'Create or resume an Assembly, optionally uploading files and waiting for completion. Files attached in the chat arrive under attachments; public URLs and small base64 payloads go under files. If a file exists only locally or in your sandbox, set expected_uploads, run each upload_instructions curl command there (it needs outbound HTTPS to Transloadit), then call transloadit_wait_for_assembly.',
     annotations: {
       readOnlyHint: false,
       // Export Robots (/s3/store, /google/store, …) can overwrite files at the destination, so
diff --git a/packages/mcp-server/src/upload-instructions.ts b/packages/mcp-server/src/upload-instructions.ts
new file mode 100644
index 00000000..1f90d68b
--- /dev/null
+++ b/packages/mcp-server/src/upload-instructions.ts
@@ -0,0 +1,54 @@
+import { z } from 'zod'
+
+/** One out-of-band tus upload the caller runs where the file lives, such as an agent sandbox. */
+export const uploadInstructionSchema = z.object({
+  fieldname: z.string(),
+  tus_endpoint: z.string(),
+  metadata: z.object({ assembly_url: z.string(), fieldname: z.string() }),
+  curl: z.string(),
+})
+
+export type UploadInstruction = z.infer<typeof uploadInstructionSchema>
+
+const shellQuote = (value: string): string => `'${value.replaceAll("'", `'\\''`)}'`
+
+const toBase64 = (value: string): string => Buffer.from(value, 'utf8').toString('base64')
+
+/**
+ * Builds a single `curl` command per expected upload, using tus creation-with-upload (one POST
+ * with the file as body), which Transloadit's tusd advertises; it prints `201` on success. The
+ * shell derives `Upload-Length` and the base64 filename from the file, so any local name works.
+ *
+ * The Assembly URL in the metadata is the only capability these commands carry: whoever holds it
+ * can add files to this Assembly while it waits for uploads. Credentials (Auth Keys, secrets,
+ * bearer tokens) must never be added here, because the commands are shown to the model and run
+ * in its sandbox.
+ */
+export const buildUploadInstructions = (
+  assembly: { tus_url?: unknown; assembly_ssl_url?: unknown },
+  count: number,
+): UploadInstruction[] | undefined => {
+  const tusEndpoint = assembly.tus_url
+  const assemblyUrl = assembly.assembly_ssl_url
+  if (typeof tusEndpoint !== 'string' || typeof assemblyUrl !== 'string') return undefined
+
+  return Array.from({ length: count }, (_, index) => {
+    const fieldname = `file_${index + 1}`
+    const metadata = `assembly_url ${toBase64(assemblyUrl)},fieldname ${toBase64(fieldname)}`
+    const curl = [
+      `FILE='/path/to/the/file'`,
+      `curl -sS -o /dev/null -w '%{http_code}\\n' -X POST ${shellQuote(tusEndpoint)} \\`,
+      `  -H 'Tus-Resumable: 1.0.0' \\`,
+      `  -H "Upload-Length: $(wc -c < "$FILE" | tr -d ' ')" \\`,
+      `  -H "Upload-Metadata: ${metadata},filename $(basename "$FILE" | tr -d '\\n' | base64 | tr -d '\\n')" \\`,
+      `  -H 'Content-Type: application/offset+octet-stream' \\`,
+      `  --data-binary @"$FILE"`,
+    ].join('\n')
+    return {
+      fieldname,
+      tus_endpoint: tusEndpoint,
+      metadata: { assembly_url: assemblyUrl, fieldname },
+      curl,
+    }
+  })
+}
diff --git a/packages/mcp-server/test/unit/upload-instructions.test.ts b/packages/mcp-server/test/unit/upload-instructions.test.ts
new file mode 100644
index 00000000..256925d7
--- /dev/null
+++ b/packages/mcp-server/test/unit/upload-instructions.test.ts
@@ -0,0 +1,204 @@
+import type { AddressInfo } from 'node:net'
+
+import type { TransloaditMcpHttpOptions } from '../../src/http.ts'
+
+import { execFile, spawnSync } from 'node:child_process'
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { createServer } from 'node:http'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { promisify } from 'node:util'
+
+import { Client } from '@modelcontextprotocol/sdk/client/index.js'
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js'
+import { Transloadit } from '@transloadit/node'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+import { createTransloaditMcpHttpHandler } from '../../src/http.ts'
+import { parseToolPayload } from '../e2e/mcp-client.ts'
+
+const assemblyId = '0123456789abcdef0123456789abcdef'
+const assemblyUrl = `https://api2.transloadit.com/assemblies/${assemblyId}`
+const hasCurl = spawnSync('curl', ['--version']).status === 0
+
+// Async on purpose: the tus stub runs in this process, so a synchronous spawn would deadlock.
+const runBash = promisify(execFile)
+
+type RecordedUpload = { headers: Record<string, string | string[] | undefined>; body: Buffer }
+
+const decodeMetadata = (header: string): Record<string, string> =>
+  Object.fromEntries(
+    header.split(',').map((pair) => {
+      const [key, value = ''] = pair.split(' ')
+      return [key, Buffer.from(value, 'base64').toString('utf8')]
+    }),
+  )
+
+describe('upload_instructions for files that exist only in the caller sandbox', () => {
+  const serverOptions: TransloaditMcpHttpOptions = { metricsPath: false }
+  const handler = createTransloaditMcpHttpHandler(serverOptions)
+  const recorded: RecordedUpload[] = []
+  // One listener serves the MCP endpoint and a tus stub, like a sandbox would reach Transloadit.
+  const httpServer = createServer((req, res) => {
+    if (req.url?.startsWith('/resumable/files/')) {
+      const chunks: Buffer[] = []
+      req.on('data', (chunk: Buffer) => chunks.push(chunk))
+      req.on('end', () => {
+        recorded.push({ headers: req.headers, body: Buffer.concat(chunks) })
+        res.writeHead(201, { 'Upload-Offset': String(Buffer.concat(chunks).length) })
+        res.end()
+      })
+      return
+    }
+    void handler(req, res)
+  })
+  let origin: string
+  let client: Client
+
+  const connect = async (headers: Record<string, string> = {}): Promise<void> => {
+    client = new Client({ name: 'upload-instructions', version: '1.0.0' })
+    await client.connect(
+      new StreamableHTTPClientTransport(new URL(`${origin}/mcp`), { requestInit: { headers } }),
+    )
+  }
+
+  const createWithExpectedUploads = async (args: Record<string, unknown>) =>
+    parseToolPayload(
+      await client.callTool({
+        name: 'transloadit_create_assembly',
+        arguments: {
+          instructions: { steps: { ':original': { robot: '/upload/handle' } } },
+          ...args,
+        },
+      }),
+    )
+
+  beforeEach(async () => {
+    delete serverOptions.authKey
+    delete serverOptions.authSecret
+    delete serverOptions.upstreamSecret
+    recorded.length = 0
+    await new Promise<void>((resolve) => httpServer.listen(0, '127.0.0.1', resolve))
+    const { port } = httpServer.address() as AddressInfo
+    origin = `http://127.0.0.1:${port}`
+    vi.spyOn(Transloadit.prototype, 'createAssembly').mockResolvedValue({
+      ok: 'ASSEMBLY_UPLOADING',
+      assembly_id: assemblyId,
+      assembly_ssl_url: assemblyUrl,
+      tus_url: `${origin}/resumable/files/`,
+    })
+  })
+
+  afterEach(async () => {
+    await client?.close()
+    await handler.close()
+    await new Promise<void>((resolve, reject) =>
+      httpServer.close((error) => (error ? reject(error) : resolve())),
+    )
+    vi.restoreAllMocks()
+  })
+
+  it('returns one tus upload per expected file and does not wait for them', async () => {
+    await connect({ Authorization: 'Bearer forwarded-token' })
+
+    const payload = await createWithExpectedUploads({
+      expected_uploads: 2,
+      wait_for_completion: true,
+    })
+
+    expect(payload.upload_instructions).toEqual([
+      {
+        fieldname: 'file_1',
+        tus_endpoint: `${origin}/resumable/files/`,
+        metadata: { assembly_url: assemblyUrl, fieldname: 'file_1' },
+        curl: expect.stringContaining(`-X POST '${origin}/resumable/files/'`),
+      },
+      {
+        fieldname: 'file_2',
+        tus_endpoint: `${origin}/resumable/files/`,
+        metadata: { assembly_url: assemblyUrl, fieldname: 'file_2' },
+        curl: expect.stringContaining("-H 'Tus-Resumable: 1.0.0'"),
+      },
+    ])
+    expect(payload.next_steps).toEqual(['transloadit_wait_for_assembly'])
+    expect(payload.warnings).toEqual([
+      expect.objectContaining({ code: 'mcp_wait_skipped_for_uploads' }),
+    ])
+    expect(Transloadit.prototype.createAssembly).toHaveBeenCalledWith(
+      expect.objectContaining({ expectedUploads: 2, waitForCompletion: false }),
+    )
+  })
+
+  it('counts files sent in the same call against the expected uploads', async () => {
+    await connect({ Authorization: 'Bearer forwarded-token' })
+
+    const payload = await createWithExpectedUploads({
+      expected_uploads: 2,
+      files: [{ kind: 'base64', field: 'inline', base64: 'aGk=', filename: 'inline.txt' }],
+    })
+
+    expect(payload.upload_instructions).toHaveLength(1)
+  })
+
+  it('returns no upload instructions without expected_uploads', async () => {
+    await connect({ Authorization: 'Bearer forwarded-token' })
+
+    const payload = await createWithExpectedUploads({})
+
+    expect(payload.upload_instructions).toBeUndefined()
+  })
+
+  it.skipIf(!hasCurl)(
+    'gives a curl command that uploads any filename with tus creation-with-upload',
+    async () => {
+      await connect({ Authorization: 'Bearer forwarded-token' })
+      const payload = await createWithExpectedUploads({ expected_uploads: 1 })
+      const [instruction] = payload.upload_instructions as Array<{ curl: string }>
+      const directory = await mkdtemp(join(tmpdir(), 'mcp-sandbox-'))
+      const filePath = join(directory, 'snow flake é.png')
+      await writeFile(filePath, Buffer.from('fake image bytes é'))
+
+      // Agents replace the FILE placeholder with their path, like this.
+      const script = instruction.curl.replace("FILE='/path/to/the/file'", `FILE='${filePath}'`)
+      const run = await runBash('bash', ['-c', script], { timeout: 20000 })
+      const fileBytes = await readFile(filePath)
+      await rm(directory, { recursive: true, force: true })
+
+      expect(run.stdout.trim()).toBe('201')
+      expect(recorded).toHaveLength(1)
+      const [upload] = recorded
+      expect(upload?.headers['tus-resumable']).toBe('1.0.0')
+      expect(upload?.headers['content-type']).toBe('application/offset+octet-stream')
+      expect(upload?.headers['upload-length']).toBe(String(fileBytes.length))
+      expect(decodeMetadata(String(upload?.headers['upload-metadata']))).toEqual({
+        assembly_url: assemblyUrl,
+        fieldname: 'file_1',
+        filename: 'snow flake é.png',
+      })
+      expect(upload?.body.equals(fileBytes)).toBe(true)
+    },
+  )
+
+  it.each([
+    ['a forwarded bearer token', { Authorization: 'Bearer forwarded-secret-token' }],
+    ['server-side Auth Key credentials', {}],
+  ])('never puts credentials into the instructions with %s', async (_kind, headers) => {
+    serverOptions.authKey = 'auth-key-0123'
+    serverOptions.authSecret = 'auth-secret-4567'
+    serverOptions.upstreamSecret = 'upstream-secret-89'
+    await connect(headers)
+
+    const payload = await createWithExpectedUploads({ expected_uploads: 1 })
+    const instructions = JSON.stringify(payload.upload_instructions)
+
+    expect(instructions).toContain('file_1')
+    for (const secret of [
+      'forwarded-secret-token',
+      'auth-key-0123',
+      'auth-secret-4567',
+      'upstream-secret-89',
+    ]) {
+      expect(instructions).not.toContain(secret)
+    }
+  })
+})

From 30ade98455d70bb08c1a3008c7a2ccae32fb6180 Mon Sep 17 00:00:00 2001
From: Kevin van Zonneveld <kevin@vanzonneveld.net>
Date: Fri, 2 Oct 2026 20:57:02 +0200
Subject: [PATCH 22/27] Address council review run 11: bounded, collision-free,
 streamed uploads

Council review of PR #529 (run 11, full run), each fix preceded by a failing test:

- `expected_uploads` is capped at 100, so one request cannot make the server build an unbounded
  list of upload instructions.
- Generated field names skip names already used by files sent in the same call.
- The curl command streams the file with `-T` instead of `--data-binary @file`, which curl reads
  into memory first; `--request-target` keeps curl from appending the local filename to the tus
  path. Verified against devdock's tusd over HTTP/2.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 packages/mcp-server/src/server.ts             | 11 ++++-
 .../mcp-server/src/upload-instructions.ts     | 24 ++++++++---
 .../test/unit/upload-instructions.test.ts     | 42 +++++++++++++++++--
 3 files changed, 67 insertions(+), 10 deletions(-)

diff --git a/packages/mcp-server/src/server.ts b/packages/mcp-server/src/server.ts
index e3a7fa0c..228a0cf7 100644
--- a/packages/mcp-server/src/server.ts
+++ b/packages/mcp-server/src/server.ts
@@ -228,7 +228,8 @@ const createAssemblyInputSchema = z.object({
   upload_concurrency: z.number().int().positive().optional(),
   upload_chunk_size: z.number().int().positive().optional(),
   upload_behavior: z.enum(['await', 'background', 'none']).optional(),
-  expected_uploads: z.number().int().positive().optional(),
+  // Each expected upload becomes an instruction in the response; keep that response bounded.
+  expected_uploads: z.number().int().positive().max(100).optional(),
   assembly_url: z.string().optional(),
 })
 
@@ -1351,7 +1352,13 @@ export const createTransloaditMcpServer = (
         }
 
         const uploadInstructions =
-          outOfBandUploads > 0 ? buildUploadInstructions(assembly, outOfBandUploads) : undefined
+          outOfBandUploads > 0
+            ? buildUploadInstructions(
+                assembly,
+                outOfBandUploads,
+                new Set([...Object.keys(filesMap), ...Object.keys(uploadsMap)]),
+              )
+            : undefined
         if (outOfBandUploads > 0 && !uploadInstructions) {
           warnings.push({
             code: 'mcp_upload_instructions_unavailable',
diff --git a/packages/mcp-server/src/upload-instructions.ts b/packages/mcp-server/src/upload-instructions.ts
index 1f90d68b..45338c47 100644
--- a/packages/mcp-server/src/upload-instructions.ts
+++ b/packages/mcp-server/src/upload-instructions.ts
@@ -18,31 +18,45 @@ const toBase64 = (value: string): string => Buffer.from(value, 'utf8').toString(
  * Builds a single `curl` command per expected upload, using tus creation-with-upload (one POST
  * with the file as body), which Transloadit's tusd advertises; it prints `201` on success. The
  * shell derives `Upload-Length` and the base64 filename from the file, so any local name works.
+ * `-T` streams the file from disk (`--data-binary @file` would read it into memory first), and
+ * `--request-target` keeps curl from appending the local filename to the endpoint path.
  *
  * The Assembly URL in the metadata is the only capability these commands carry: whoever holds it
  * can add files to this Assembly while it waits for uploads. Credentials (Auth Keys, secrets,
  * bearer tokens) must never be added here, because the commands are shown to the model and run
  * in its sandbox.
  */
+/** Field names `file_1`, `file_2`, … that files sent with the same call do not use yet. */
+const pickFieldnames = (count: number, taken: ReadonlySet<string>): string[] => {
+  const fieldnames: string[] = []
+  for (let index = 1; fieldnames.length < count; index += 1) {
+    const fieldname = `file_${index}`
+    if (!taken.has(fieldname)) fieldnames.push(fieldname)
+  }
+  return fieldnames
+}
+
 export const buildUploadInstructions = (
   assembly: { tus_url?: unknown; assembly_ssl_url?: unknown },
   count: number,
+  takenFieldnames: ReadonlySet<string>,
 ): UploadInstruction[] | undefined => {
   const tusEndpoint = assembly.tus_url
   const assemblyUrl = assembly.assembly_ssl_url
   if (typeof tusEndpoint !== 'string' || typeof assemblyUrl !== 'string') return undefined
+  if (!URL.canParse(tusEndpoint)) return undefined
+  const { pathname, search } = new URL(tusEndpoint)
 
-  return Array.from({ length: count }, (_, index) => {
-    const fieldname = `file_${index + 1}`
+  return pickFieldnames(count, takenFieldnames).map((fieldname) => {
     const metadata = `assembly_url ${toBase64(assemblyUrl)},fieldname ${toBase64(fieldname)}`
     const curl = [
       `FILE='/path/to/the/file'`,
-      `curl -sS -o /dev/null -w '%{http_code}\\n' -X POST ${shellQuote(tusEndpoint)} \\`,
+      `curl -sS -o /dev/null -w '%{http_code}\\n' -X POST -T "$FILE" \\`,
+      `  --request-target ${shellQuote(`${pathname}${search}`)} ${shellQuote(tusEndpoint)} \\`,
       `  -H 'Tus-Resumable: 1.0.0' \\`,
       `  -H "Upload-Length: $(wc -c < "$FILE" | tr -d ' ')" \\`,
       `  -H "Upload-Metadata: ${metadata},filename $(basename "$FILE" | tr -d '\\n' | base64 | tr -d '\\n')" \\`,
-      `  -H 'Content-Type: application/offset+octet-stream' \\`,
-      `  --data-binary @"$FILE"`,
+      `  -H 'Content-Type: application/offset+octet-stream'`,
     ].join('\n')
     return {
       fieldname,
diff --git a/packages/mcp-server/test/unit/upload-instructions.test.ts b/packages/mcp-server/test/unit/upload-instructions.test.ts
index 256925d7..a8b3a27f 100644
--- a/packages/mcp-server/test/unit/upload-instructions.test.ts
+++ b/packages/mcp-server/test/unit/upload-instructions.test.ts
@@ -24,7 +24,11 @@ const hasCurl = spawnSync('curl', ['--version']).status === 0
 // Async on purpose: the tus stub runs in this process, so a synchronous spawn would deadlock.
 const runBash = promisify(execFile)
 
-type RecordedUpload = { headers: Record<string, string | string[] | undefined>; body: Buffer }
+type RecordedUpload = {
+  url: string | undefined
+  headers: Record<string, string | string[] | undefined>
+  body: Buffer
+}
 
 const decodeMetadata = (header: string): Record<string, string> =>
   Object.fromEntries(
@@ -44,7 +48,7 @@ describe('upload_instructions for files that exist only in the caller sandbox',
       const chunks: Buffer[] = []
       req.on('data', (chunk: Buffer) => chunks.push(chunk))
       req.on('end', () => {
-        recorded.push({ headers: req.headers, body: Buffer.concat(chunks) })
+        recorded.push({ url: req.url, headers: req.headers, body: Buffer.concat(chunks) })
         res.writeHead(201, { 'Upload-Offset': String(Buffer.concat(chunks).length) })
         res.end()
       })
@@ -111,7 +115,9 @@ describe('upload_instructions for files that exist only in the caller sandbox',
         fieldname: 'file_1',
         tus_endpoint: `${origin}/resumable/files/`,
         metadata: { assembly_url: assemblyUrl, fieldname: 'file_1' },
-        curl: expect.stringContaining(`-X POST '${origin}/resumable/files/'`),
+        curl: expect.stringContaining(
+          `--request-target '/resumable/files/' '${origin}/resumable/files/'`,
+        ),
       },
       {
         fieldname: 'file_2',
@@ -140,6 +146,32 @@ describe('upload_instructions for files that exist only in the caller sandbox',
     expect(payload.upload_instructions).toHaveLength(1)
   })
 
+  it('skips field names already used by files sent in the same call', async () => {
+    await connect({ Authorization: 'Bearer forwarded-token' })
+
+    const payload = await createWithExpectedUploads({
+      expected_uploads: 2,
+      files: [{ kind: 'base64', field: 'file_1', base64: 'aGk=', filename: 'inline.txt' }],
+    })
+
+    expect(payload.upload_instructions).toEqual([expect.objectContaining({ fieldname: 'file_2' })])
+  })
+
+  it('refuses more expected uploads than one call can describe', async () => {
+    await connect({ Authorization: 'Bearer forwarded-token' })
+
+    const result = await client.callTool({
+      name: 'transloadit_create_assembly',
+      arguments: {
+        instructions: { steps: { ':original': { robot: '/upload/handle' } } },
+        expected_uploads: 101,
+      },
+    })
+
+    expect(result.isError).toBe(true)
+    expect(Transloadit.prototype.createAssembly).not.toHaveBeenCalled()
+  })
+
   it('returns no upload instructions without expected_uploads', async () => {
     await connect({ Authorization: 'Bearer forwarded-token' })
 
@@ -165,8 +197,12 @@ describe('upload_instructions for files that exist only in the caller sandbox',
       await rm(directory, { recursive: true, force: true })
 
       expect(run.stdout.trim()).toBe('201')
+      // Streamed from disk (curl buffers --data-binary files in memory), to the exact tus path.
+      expect(instruction.curl).toContain('-T "$FILE"')
+      expect(instruction.curl).not.toContain('--data-binary')
       expect(recorded).toHaveLength(1)
       const [upload] = recorded
+      expect(upload?.url).toBe('/resumable/files/')
       expect(upload?.headers['tus-resumable']).toBe('1.0.0')
       expect(upload?.headers['content-type']).toBe('application/offset+octet-stream')
       expect(upload?.headers['upload-length']).toBe(String(fileBytes.length))

From f69ca6d2943c869ba07be965ba196f619861f21e Mon Sep 17 00:00:00 2001
From: Kevin van Zonneveld <kevin@vanzonneveld.net>
Date: Fri, 2 Oct 2026 21:12:35 +0200
Subject: [PATCH 23/27] Address council review run 12: one download deadline, a
 per-call byte budget

Council review of PR #529 (run 12, full run), each fix preceded by a failing test:

- `urlDownloadTimeoutMs` is one deadline for a download, covering DNS checks and every redirect;
  before, each redirect restarted the timer.
- `maxUrlDownloadBytes` is a budget for all URL downloads of one call, so many URLs can no longer
  each take the full limit. Limiting concurrent downloads across requests is a PR follow-up.
- The buildUploadInstructions JSDoc sits on the exported function again.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .changeset/mcp-upstream-header.md             |  4 +-
 packages/mcp-server/README.md                 |  5 +-
 packages/mcp-server/src/server.ts             |  6 +-
 .../mcp-server/src/upload-instructions.ts     | 20 +++----
 .../mcp-server/test/unit/file-inputs.test.ts  |  2 +-
 packages/node/src/inputFiles.ts               | 55 +++++++++++++------
 packages/node/test/unit/input-files.test.ts   | 40 +++++++++++++-
 7 files changed, 94 insertions(+), 38 deletions(-)

diff --git a/.changeset/mcp-upstream-header.md b/.changeset/mcp-upstream-header.md
index afe55613..c3c2be66 100644
--- a/.changeset/mcp-upstream-header.md
+++ b/.changeset/mcp-upstream-header.md
@@ -10,7 +10,7 @@ Like `Authorization`, these headers are dropped when a redirect leaves the API o
 `listTemplates()` also accepts `fields`, for API2 columns such as `account_id` that the default
 Template list omits.
 
-`prepareInputFiles()` accepts `maxUrlDownloadBytes` and `urlDownloadTimeoutMs` to bound URL
-downloads and `beforeUrlDownload` to vouch for a requester before a file is fetched locally; its
+`prepareInputFiles()` accepts `maxUrlDownloadBytes` (a total for the call) and `urlDownloadTimeoutMs`
+(one deadline per download, redirects included) to bound URL downloads and `beforeUrlDownload` to vouch for a requester before a file is fetched locally; its
 download errors name only a URL's origin and path, never presigned query parameters.
 `createAssembly()` accepts `onAssemblyCreated`, called once API2 accepted the creation request.
diff --git a/packages/mcp-server/README.md b/packages/mcp-server/README.md
index e065cb93..067b9d89 100644
--- a/packages/mcp-server/README.md
+++ b/packages/mcp-server/README.md
@@ -442,8 +442,9 @@ Set `maxRequestBodyBytes` (handler option or JSON config key) to change the body
 requests get HTTP 413 and are not buffered. Express apps that install their own body parser set
 its limit there.
 
-URL inputs that the server downloads (for templates that expect uploads) are capped at 1 GiB and
-10 minutes; set `maxUrlDownloadBytes` and `urlDownloadTimeoutMs` to change that. On the hosted
+URL inputs that the server downloads (for templates that expect uploads) are capped at 1 GiB in
+total per call and 10 minutes per download, redirects included; set `maxUrlDownloadBytes` and
+`urlDownloadTimeoutMs` to change that. On the hosted
 endpoint the caller's token is checked with API2 before anything is downloaded.
 
 ## URL inputs and template behavior
diff --git a/packages/mcp-server/src/server.ts b/packages/mcp-server/src/server.ts
index 228a0cf7..2f93c5dc 100644
--- a/packages/mcp-server/src/server.ts
+++ b/packages/mcp-server/src/server.ts
@@ -61,9 +61,9 @@ export type TransloaditMcpServerOptions = {
   signatureAlgorithm?: McpSignatureAlgorithm
   /** Origins the result widget may load previews from (`TRANSLOADIT_MCP_RESULT_DOMAINS`). */
   resultDomains?: string[]
-  /** Largest URL input downloaded for upload Steps; defaults to 1 GiB. */
+  /** Most bytes the URL inputs of one call may download together; defaults to 1 GiB. */
   maxUrlDownloadBytes?: number
-  /** Longest a URL input download may take; defaults to 10 minutes. */
+  /** Longest one URL input download may take, redirects included; defaults to 10 minutes. */
   urlDownloadTimeoutMs?: number
   /** Console origin used for widget deep links; defaults to the public website. */
   consoleUrl?: string
@@ -108,7 +108,7 @@ type ToolExtra = {
 
 const maxBase64Bytes = 512_000
 
-/** URL inputs larger or slower than this are not downloaded to this server's disk. */
+/** URL inputs beyond these limits are not downloaded to this server's disk (per call). */
 const defaultMaxUrlDownloadBytes = 1024 * 1024 * 1024
 const defaultUrlDownloadTimeoutMs = 10 * 60 * 1000
 
diff --git a/packages/mcp-server/src/upload-instructions.ts b/packages/mcp-server/src/upload-instructions.ts
index 45338c47..4b6e82e7 100644
--- a/packages/mcp-server/src/upload-instructions.ts
+++ b/packages/mcp-server/src/upload-instructions.ts
@@ -14,6 +14,16 @@ const shellQuote = (value: string): string => `'${value.replaceAll("'", `'\\''`)
 
 const toBase64 = (value: string): string => Buffer.from(value, 'utf8').toString('base64')
 
+/** Field names `file_1`, `file_2`, … that files sent with the same call do not use yet. */
+const pickFieldnames = (count: number, taken: ReadonlySet<string>): string[] => {
+  const fieldnames: string[] = []
+  for (let index = 1; fieldnames.length < count; index += 1) {
+    const fieldname = `file_${index}`
+    if (!taken.has(fieldname)) fieldnames.push(fieldname)
+  }
+  return fieldnames
+}
+
 /**
  * Builds a single `curl` command per expected upload, using tus creation-with-upload (one POST
  * with the file as body), which Transloadit's tusd advertises; it prints `201` on success. The
@@ -26,16 +36,6 @@ const toBase64 = (value: string): string => Buffer.from(value, 'utf8').toString(
  * bearer tokens) must never be added here, because the commands are shown to the model and run
  * in its sandbox.
  */
-/** Field names `file_1`, `file_2`, … that files sent with the same call do not use yet. */
-const pickFieldnames = (count: number, taken: ReadonlySet<string>): string[] => {
-  const fieldnames: string[] = []
-  for (let index = 1; fieldnames.length < count; index += 1) {
-    const fieldname = `file_${index}`
-    if (!taken.has(fieldname)) fieldnames.push(fieldname)
-  }
-  return fieldnames
-}
-
 export const buildUploadInstructions = (
   assembly: { tus_url?: unknown; assembly_ssl_url?: unknown },
   count: number,
diff --git a/packages/mcp-server/test/unit/file-inputs.test.ts b/packages/mcp-server/test/unit/file-inputs.test.ts
index 642bcca1..52974f04 100644
--- a/packages/mcp-server/test/unit/file-inputs.test.ts
+++ b/packages/mcp-server/test/unit/file-inputs.test.ts
@@ -750,7 +750,7 @@ describe('MCP file inputs', () => {
     })
     expect(result.structuredContent).toMatchObject({
       status: 'error',
-      errors: [{ message: 'URL download exceeds 1024 bytes: http://198.51.100.10/big.bin' }],
+      errors: [{ message: 'URL downloads exceed 1024 bytes: http://198.51.100.10/big.bin' }],
     })
     expect(Transloadit.prototype.createAssembly).not.toHaveBeenCalled()
   })
diff --git a/packages/node/src/inputFiles.ts b/packages/node/src/inputFiles.ts
index f5083835..5d2a6478 100644
--- a/packages/node/src/inputFiles.ts
+++ b/packages/node/src/inputFiles.ts
@@ -54,9 +54,9 @@ export type PrepareInputFilesOptions = {
   urlStrategy?: UrlStrategy
   maxBase64Bytes?: number
   allowPrivateUrls?: boolean
-  /** Abort a URL download once it exceeds this many bytes (declared or streamed). */
+  /** Abort once all URL downloads of this call exceed this many bytes together. */
   maxUrlDownloadBytes?: number
-  /** Abort a URL download that takes longer than this many milliseconds. */
+  /** Abort a URL download (DNS checks and redirects included) after this many milliseconds. */
   urlDownloadTimeoutMs?: number
   /**
    * Awaited before each URL input is downloaded locally (not for `/http/import`), so a caller can
@@ -390,41 +390,56 @@ export function createPinnedDnsLookup(
   return pinnedDnsLookup as PinnedDnsLookup
 }
 
-/** Errors once more than `maxBytes` have streamed through, so the temp file stays bounded. */
-const limitDownloadBytes = (maxBytes: number, url: string): Transform => {
-  let received = 0
-  return new Transform({
+/** A budget shared by every URL download of one `prepareInputFiles` call. */
+type DownloadBudget = { totalBytes: number; remainingBytes: number }
+
+const budgetExceeded = (budget: DownloadBudget, url: string): Error =>
+  new Error(`URL downloads exceed ${budget.totalBytes} bytes: ${describeUrl(url)}`)
+
+/** Errors once the budget is used up, so temp files stay bounded while they stream in. */
+const limitDownloadBytes = (budget: DownloadBudget, url: string): Transform =>
+  new Transform({
     transform(chunk: Buffer, _encoding, callback) {
-      received += chunk.length
-      if (received > maxBytes) {
-        callback(new Error(`URL download exceeds ${maxBytes} bytes: ${describeUrl(url)}`))
+      budget.remainingBytes -= chunk.length
+      if (budget.remainingBytes < 0) {
+        callback(budgetExceeded(budget, url))
         return
       }
       callback(null, chunk)
     },
   })
-}
 
 const downloadUrlToFile = async ({
   allowPrivateUrls,
   filePath,
   url,
-  maxBytes,
+  budget,
   timeoutMs,
 }: {
   allowPrivateUrls: boolean
   filePath: string
   url: string
-  maxBytes?: number
+  budget?: DownloadBudget
   timeoutMs?: number
 }): Promise<void> => {
   let currentUrl = url
+  // One deadline for the whole download, so DNS checks and redirects cannot each restart it.
+  const deadline = timeoutMs === undefined ? undefined : Date.now() + timeoutMs
+  const remainingMs = (): number | undefined => {
+    if (deadline === undefined) return undefined
+    const remaining = deadline - Date.now()
+    if (remaining <= 0) {
+      throw new Error(`URL download timed out after ${timeoutMs} ms: ${describeUrl(url)}`)
+    }
+    return remaining
+  }
 
   for (let redirectCount = 0; redirectCount <= MAX_URL_REDIRECTS; redirectCount += 1) {
     let validatedAddresses: Array<{ address: string; family: 4 | 6 }> | null = null
     if (!allowPrivateUrls) {
       validatedAddresses = await resolvePublicDownloadAddresses(currentUrl)
     }
+    const requestTimeoutMs = remainingMs()
 
     const dnsLookup: LookupFunction | undefined =
       validatedAddresses == null ? undefined : createPinnedDnsLookup(validatedAddresses)
@@ -434,7 +449,7 @@ const downloadUrlToFile = async ({
       followRedirect: false,
       retry: { limit: 0 },
       throwHttpErrors: false,
-      ...(timeoutMs === undefined ? {} : { timeout: { request: timeoutMs } }),
+      ...(requestTimeoutMs === undefined ? {} : { timeout: { request: requestTimeoutMs } }),
     })
 
     const response = await new Promise<
@@ -467,15 +482,15 @@ const downloadUrlToFile = async ({
       throw new Error(`Failed to download URL: ${describeUrl(currentUrl)} (${statusCode})`)
     }
 
-    if (maxBytes === undefined) {
+    if (budget === undefined) {
       await pipeline(responseStream, createWriteStream(filePath))
       return
     }
-    if (Number(response.headers['content-length']) > maxBytes) {
+    if (Number(response.headers['content-length']) > budget.remainingBytes) {
       responseStream.destroy()
-      throw new Error(`URL download exceeds ${maxBytes} bytes: ${describeUrl(url)}`)
+      throw budgetExceeded(budget, url)
     }
-    await pipeline(responseStream, limitDownloadBytes(maxBytes, url), createWriteStream(filePath))
+    await pipeline(responseStream, limitDownloadBytes(budget, url), createWriteStream(filePath))
     return
   }
 
@@ -503,6 +518,10 @@ export const prepareInputFiles = async (
   const files: Record<string, string> = {}
   const uploads: Record<string, UploadInput> = {}
   const cleanup: Array<() => Promise<void>> = []
+  const downloadBudget: DownloadBudget | undefined =
+    maxUrlDownloadBytes === undefined
+      ? undefined
+      : { totalBytes: maxUrlDownloadBytes, remainingBytes: maxUrlDownloadBytes }
 
   if (fields && Object.keys(fields).length > 0) {
     nextParams = {
@@ -586,7 +605,7 @@ export const prepareInputFiles = async (
           allowPrivateUrls,
           filePath,
           url: file.url,
-          maxBytes: maxUrlDownloadBytes,
+          budget: downloadBudget,
           timeoutMs: urlDownloadTimeoutMs,
         })
         files[file.field] = filePath
diff --git a/packages/node/test/unit/input-files.test.ts b/packages/node/test/unit/input-files.test.ts
index f8642503..ae692f86 100644
--- a/packages/node/test/unit/input-files.test.ts
+++ b/packages/node/test/unit/input-files.test.ts
@@ -281,7 +281,7 @@ describe('prepareInputFiles', () => {
         allowPrivateUrls: false,
         maxUrlDownloadBytes: 1024,
       }),
-    ).rejects.toThrow('URL download exceeds 1024 bytes: http://rebind.test/big')
+    ).rejects.toThrow('URL downloads exceed 1024 bytes: http://rebind.test/big')
   })
 
   it('keeps signed query parameters out of download errors', async () => {
@@ -298,7 +298,7 @@ describe('prepareInputFiles', () => {
         allowPrivateUrls: false,
         maxUrlDownloadBytes: 1024,
       }),
-    ).rejects.toThrow(/^URL download exceeds 1024 bytes: http:\/\/rebind\.test\/big$/)
+    ).rejects.toThrow(/^URL downloads exceed 1024 bytes: http:\/\/rebind\.test\/big$/)
     await expect(
       prepareInputFiles({
         inputFiles: [
@@ -324,6 +324,42 @@ describe('prepareInputFiles', () => {
     ).rejects.toThrow(/Timeout/)
   })
 
+  it('caps the total bytes of all URL downloads in one call', async () => {
+    lookupMock.mockResolvedValue([{ address: '198.51.100.10', family: 4 }])
+    nock('http://rebind.test').get('/one').reply(200, 'x'.repeat(600))
+    nock('http://rebind.test').get('/two').reply(200, 'y'.repeat(600))
+
+    await expect(
+      prepareInputFiles({
+        inputFiles: [
+          { kind: 'url', field: 'one', url: 'http://rebind.test/one' },
+          { kind: 'url', field: 'two', url: 'http://rebind.test/two' },
+        ],
+        urlStrategy: 'download',
+        allowPrivateUrls: false,
+        maxUrlDownloadBytes: 1024,
+      }),
+    ).rejects.toThrow('URL downloads exceed 1024 bytes: http://rebind.test/two')
+  })
+
+  it('applies urlDownloadTimeoutMs to a download across its redirects', async () => {
+    lookupMock.mockResolvedValue([{ address: '198.51.100.10', family: 4 }])
+    nock('http://rebind.test')
+      .get('/first')
+      .delay(150)
+      .reply(302, undefined, { Location: 'http://rebind.test/second' })
+    nock('http://rebind.test').get('/second').delay(150).reply(200, 'late')
+
+    await expect(
+      prepareInputFiles({
+        inputFiles: [{ kind: 'url', field: 'remote', url: 'http://rebind.test/first' }],
+        urlStrategy: 'download',
+        allowPrivateUrls: false,
+        urlDownloadTimeoutMs: 250,
+      }),
+    ).rejects.toThrow(/Timeout|timed out/)
+  })
+
   it('pins URL downloads to the validated DNS answer', async () => {
     lookupMock.mockResolvedValue([{ address: '198.51.100.10', family: 4 }])
     const downloadScope = nock('http://rebind.test').get('/public').reply(200, 'public-data')

From 084a6d5f6fb06679d0a39e6a996a66048e25c92c Mon Sep 17 00:00:00 2001
From: Kevin van Zonneveld <kevin@vanzonneveld.net>
Date: Fri, 2 Oct 2026 21:29:12 +0200
Subject: [PATCH 24/27] Record council review run 13 decisions and document the
 upload cap

Council review of PR #529 (run 13, full run) found no P1. The DNS lookup is left outside the
download deadline because the system resolver bounds it; hosted mode without `upstreamSecret` is
left to API2's service config (both noted in code and as PR follow-ups). The 100-upload cap on
`expected_uploads` is now documented in the README and changeset.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .changeset/mcp-oauth-discovery.md       | 2 ++
 packages/mcp-server/README.md           | 4 ++--
 packages/mcp-server/src/http-helpers.ts | 2 ++
 packages/node/src/inputFiles.ts         | 2 ++
 4 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/.changeset/mcp-oauth-discovery.md b/.changeset/mcp-oauth-discovery.md
index ea766c45..d464628d 100644
--- a/.changeset/mcp-oauth-discovery.md
+++ b/.changeset/mcp-oauth-discovery.md
@@ -23,6 +23,8 @@ connector requirements.
 - `transloadit_create_assembly` with `expected_uploads` returns `upload_instructions`: per file the
   tus endpoint, metadata and a credential-free `curl` command (tus creation-with-upload), so agents
   can upload files that exist only in their sandbox, then call `transloadit_wait_for_assembly`.
+  `expected_uploads` now accepts at most 100; larger values are rejected before an Assembly is
+  created.
 - New `transloadit_get_profile` tool (`_meta["openai/profile"]`) returns the Workspace behind the
   credentials for multi-account hosts.
 - `transloadit_create_assembly` accepts ChatGPT-attached files through `attachments`
diff --git a/packages/mcp-server/README.md b/packages/mcp-server/README.md
index 067b9d89..b853858a 100644
--- a/packages/mcp-server/README.md
+++ b/packages/mcp-server/README.md
@@ -419,8 +419,8 @@ such as Claude.ai do not hand chat attachments to connector tools, and base64 in
 impractical for anything but tiny files, so the agent uploads the file itself:
 
 1. Call `transloadit_create_assembly` with your instructions and `expected_uploads: 1` (one per
-   file). The call returns right away, even with `wait_for_completion: true`, because the Assembly
-   now waits for those uploads.
+   file, at most 100 per call). The call returns right away, even with `wait_for_completion: true`,
+   because the Assembly now waits for those uploads.
 2. Each `upload_instructions` entry has the tus endpoint, the tus metadata (`assembly_url`,
    `fieldname`) and a ready-to-run `curl` command. Set `FILE` to the file's path and run it in a
    bash shell; it prints `201` once the file is uploaded (tus creation-with-upload, one request).
diff --git a/packages/mcp-server/src/http-helpers.ts b/packages/mcp-server/src/http-helpers.ts
index 8e5613a5..21a3197f 100644
--- a/packages/mcp-server/src/http-helpers.ts
+++ b/packages/mcp-server/src/http-helpers.ts
@@ -283,6 +283,8 @@ export const assertHttpOptions = (options: {
       'Configure either TRANSLOADIT_MCP_TOKEN (self-hosted) or TRANSLOADIT_MCP_RESOURCE_METADATA_URL (hosted OAuth), not both.',
     )
   }
+  // Hosted mode without `upstreamSecret` is not refused here: API2 then rejects relayed tokens,
+  // but that deployment is configured (and checked) by API2's service config, which sets both.
   assertRequestBodyLimit(options.maxRequestBodyBytes)
   // Also checked per server instance; repeated here so a bad config fails at startup.
   assertServerLimits(options)
diff --git a/packages/node/src/inputFiles.ts b/packages/node/src/inputFiles.ts
index 5d2a6478..4d9b4ae8 100644
--- a/packages/node/src/inputFiles.ts
+++ b/packages/node/src/inputFiles.ts
@@ -437,6 +437,8 @@ const downloadUrlToFile = async ({
   for (let redirectCount = 0; redirectCount <= MAX_URL_REDIRECTS; redirectCount += 1) {
     let validatedAddresses: Array<{ address: string; family: 4 | 6 }> | null = null
     if (!allowPrivateUrls) {
+      // Not raced against the deadline: the system resolver bounds each lookup with its own
+      // short timeout and no bytes are transferred, so checking the clock right after suffices.
       validatedAddresses = await resolvePublicDownloadAddresses(currentUrl)
     }
     const requestTimeoutMs = remainingMs()

From c555ab4da9ace1453d78e150fe70ebc942015a0a Mon Sep 17 00:00:00 2001
From: Kevin van Zonneveld <kevin@vanzonneveld.net>
Date: Fri, 2 Oct 2026 21:36:11 +0200
Subject: [PATCH 25/27] Refuse to start hosted mode without the upstream secret

API2 only accepts relayed `aud=mcp` tokens from the hosted service, so a hosted server without
TRANSLOADIT_MCP_UPSTREAM_SECRET failed every authenticated call as a user-facing tool error.
Hosted mode (a resource metadata URL) now refuses to start without it, in the HTTP handler, the
Express router and direct server construction, so a missing production secret fails the deploy's
health check instead. Test first; hosted test setups now configure the secret.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .changeset/mcp-oauth-discovery.md             |  3 ++
 packages/mcp-server/README.md                 |  1 +
 packages/mcp-server/src/http-helpers.ts       |  7 ++--
 packages/mcp-server/src/options.ts            | 13 ++++++-
 packages/mcp-server/src/server.ts             |  4 +-
 .../mcp-server/test/unit/auth-errors.test.ts  |  5 ++-
 .../mcp-server/test/unit/hosted-auth.test.ts  | 39 ++++++++++++-------
 .../test/unit/server-card-express.test.ts     |  2 +
 .../mcp-server/test/unit/tool-surface.test.ts |  6 ++-
 .../test/unit/upstream-auth-status.test.ts    |  2 +
 10 files changed, 58 insertions(+), 24 deletions(-)

diff --git a/.changeset/mcp-oauth-discovery.md b/.changeset/mcp-oauth-discovery.md
index d464628d..34ff0958 100644
--- a/.changeset/mcp-oauth-discovery.md
+++ b/.changeset/mcp-oauth-discovery.md
@@ -5,6 +5,9 @@
 Let MCP clients connect to the hosted server by URL and satisfy the ChatGPT plugin and Claude
 connector requirements.
 
+- Hosted mode (`TRANSLOADIT_MCP_RESOURCE_METADATA_URL`) requires `TRANSLOADIT_MCP_UPSTREAM_SECRET`
+  and refuses to start without it, so a missing production secret fails the deploy's health check
+  instead of every authenticated tool call.
 - Hosted mode (`TRANSLOADIT_MCP_RESOURCE_METADATA_URL`): unauthenticated requests get a `401` with
   `WWW-Authenticate: Bearer resource_metadata="…"`, browser Origins are limited to ChatGPT, Claude,
   Transloadit and loopback (overridable with `allowedOrigins`), and the server card advertises
diff --git a/packages/mcp-server/README.md b/packages/mcp-server/README.md
index b853858a..2930f29e 100644
--- a/packages/mcp-server/README.md
+++ b/packages/mcp-server/README.md
@@ -294,6 +294,7 @@ Allowlist tools in `~/.gemini/settings.json`:
   an `Origin` header (CLIs, servers) are not restricted. Set `allowedOrigins` to change the list.
 - `TRANSLOADIT_MCP_UPSTREAM_SECRET` is set by Transloadit's own deployment so API2 can tell that a
   relayed `aud=mcp` token arrives from the hosted service; it is not needed for self-hosting.
+  Hosted mode refuses to start without it, because every authenticated call would fail.
 
 ### Self-hosted
 
diff --git a/packages/mcp-server/src/http-helpers.ts b/packages/mcp-server/src/http-helpers.ts
index 21a3197f..826ca499 100644
--- a/packages/mcp-server/src/http-helpers.ts
+++ b/packages/mcp-server/src/http-helpers.ts
@@ -2,7 +2,7 @@ import type { IncomingMessage, ServerResponse } from 'node:http'
 
 import { timingSafeEqual } from 'node:crypto'
 
-import { assertRequestBodyLimit, assertServerLimits } from './options.ts'
+import { assertRequestBodyLimit, assertServerOptions } from './options.ts'
 
 export const parsePathname = (url: string | undefined, fallback: string): string => {
   try {
@@ -274,6 +274,7 @@ export const sendBodyTooLarge = (res: ServerResponse, maxBytes: number): void =>
 export const assertHttpOptions = (options: {
   mcpToken?: string
   resourceMetadataUrl?: string
+  upstreamSecret?: string
   maxRequestBodyBytes?: unknown
   maxUrlDownloadBytes?: unknown
   urlDownloadTimeoutMs?: unknown
@@ -283,11 +284,9 @@ export const assertHttpOptions = (options: {
       'Configure either TRANSLOADIT_MCP_TOKEN (self-hosted) or TRANSLOADIT_MCP_RESOURCE_METADATA_URL (hosted OAuth), not both.',
     )
   }
-  // Hosted mode without `upstreamSecret` is not refused here: API2 then rejects relayed tokens,
-  // but that deployment is configured (and checked) by API2's service config, which sets both.
   assertRequestBodyLimit(options.maxRequestBodyBytes)
   // Also checked per server instance; repeated here so a bad config fails at startup.
-  assertServerLimits(options)
+  assertServerOptions(options)
 }
 
 /**
diff --git a/packages/mcp-server/src/options.ts b/packages/mcp-server/src/options.ts
index 53f53e7d..a670054f 100644
--- a/packages/mcp-server/src/options.ts
+++ b/packages/mcp-server/src/options.ts
@@ -9,11 +9,20 @@ const assertPositiveInteger = (value: unknown, name: string, unit: string): void
   }
 }
 
-/** Validates the limits every server instance applies, however it is constructed. */
-export const assertServerLimits = (options: {
+/** Validates what every server instance relies on, however it is constructed. */
+export const assertServerOptions = (options: {
+  resourceMetadataUrl?: string
+  upstreamSecret?: string
   maxUrlDownloadBytes?: unknown
   urlDownloadTimeoutMs?: unknown
 }): void => {
+  // API2 only accepts relayed `aud=mcp` tokens from the hosted service, so without the secret
+  // every authenticated call fails; refusing to start surfaces that in the deploy's health check.
+  if (options.resourceMetadataUrl && !options.upstreamSecret) {
+    throw new Error(
+      'TRANSLOADIT_MCP_RESOURCE_METADATA_URL (hosted mode) requires TRANSLOADIT_MCP_UPSTREAM_SECRET: API2 only accepts relayed MCP tokens from the hosted service.',
+    )
+  }
   assertPositiveInteger(options.maxUrlDownloadBytes, 'maxUrlDownloadBytes', 'bytes')
   assertPositiveInteger(options.urlDownloadTimeoutMs, 'urlDownloadTimeoutMs', 'milliseconds')
 }
diff --git a/packages/mcp-server/src/server.ts b/packages/mcp-server/src/server.ts
index 2f93c5dc..e746a891 100644
--- a/packages/mcp-server/src/server.ts
+++ b/packages/mcp-server/src/server.ts
@@ -27,7 +27,7 @@ import { z } from 'zod'
 
 import packageJson from '../package.json' with { type: 'json' }
 import { buildBearerChallenge, extractBearerToken } from './http-helpers.ts'
-import { assertServerLimits } from './options.ts'
+import { assertServerOptions } from './options.ts'
 import { mirrorSecuritySchemes } from './tool-list.ts'
 import {
   buildToolMeta,
@@ -1014,7 +1014,7 @@ const toAssemblyInstructionsInput = (params: CreateAssemblyParams): AssemblyInst
 export const createTransloaditMcpServer = (
   options: TransloaditMcpServerOptions = {},
 ): McpServer => {
-  assertServerLimits(options)
+  assertServerOptions(options)
   const server = new McpServer({
     name: options.serverName ?? 'Transloadit MCP',
     version: options.serverVersion ?? packageJson.version,
diff --git a/packages/mcp-server/test/unit/auth-errors.test.ts b/packages/mcp-server/test/unit/auth-errors.test.ts
index 7774f0ca..f328144f 100644
--- a/packages/mcp-server/test/unit/auth-errors.test.ts
+++ b/packages/mcp-server/test/unit/auth-errors.test.ts
@@ -102,7 +102,10 @@ describe('tool auth errors', () => {
   })
 
   it('asks the host to link an account when a hosted server gets no token', async () => {
-    const server = createTransloaditMcpServer({ resourceMetadataUrl })
+    const server = createTransloaditMcpServer({
+      resourceMetadataUrl,
+      upstreamSecret: 'test-upstream-secret',
+    })
     const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair()
     client = new Client({ name: 'auth-errors-hosted', version: '1.0.0' })
     await Promise.all([server.connect(serverTransport), client.connect(clientTransport)])
diff --git a/packages/mcp-server/test/unit/hosted-auth.test.ts b/packages/mcp-server/test/unit/hosted-auth.test.ts
index 71fbe093..6d72aead 100644
--- a/packages/mcp-server/test/unit/hosted-auth.test.ts
+++ b/packages/mcp-server/test/unit/hosted-auth.test.ts
@@ -7,10 +7,12 @@ import { afterEach, describe, expect, it } from 'vitest'
 import { createTransloaditMcpExpressRouter } from '../../src/express.ts'
 import { createTransloaditMcpHttpHandler } from '../../src/http.ts'
 import { matchesOriginPattern } from '../../src/http-helpers.ts'
+import { createTransloaditMcpServer } from '../../src/server.ts'
 
 type RunningServer = { url: URL; close: () => Promise<void> }
 
 const resourceMetadataUrl = 'https://api2.transloadit.com/.well-known/oauth-protected-resource/mcp'
+const hosted = { resourceMetadataUrl, upstreamSecret: 'test-upstream-secret' }
 
 const initializeBody = JSON.stringify({
   jsonrpc: '2.0',
@@ -63,7 +65,7 @@ describe('hosted MCP endpoint auth', () => {
   })
 
   it('challenges unauthenticated requests with the protected-resource metadata URL', async () => {
-    running = await start({ resourceMetadataUrl })
+    running = await start(hosted)
 
     const response = await post(running.url)
     expect(response.status).toBe(401)
@@ -81,7 +83,7 @@ describe('hosted MCP endpoint auth', () => {
   })
 
   it('challenges SSE GETs without a bearer token', async () => {
-    running = await start({ resourceMetadataUrl })
+    running = await start(hosted)
 
     const stream = await fetch(running.url, { headers: { Accept: 'text/event-stream' } })
     expect(stream.status).toBe(401)
@@ -91,7 +93,7 @@ describe('hosted MCP endpoint auth', () => {
   })
 
   it('challenges a bare GET discovery probe and keeps the status fields in the body', async () => {
-    running = await start({ resourceMetadataUrl })
+    running = await start(hosted)
 
     // Codex probes exactly like this before it looks for protected-resource metadata.
     const probe = await fetch(running.url, {
@@ -109,7 +111,7 @@ describe('hosted MCP endpoint auth', () => {
   })
 
   it('serves the bare GET status to authenticated hosted callers', async () => {
-    running = await start({ resourceMetadataUrl })
+    running = await start(hosted)
 
     const probe = await fetch(running.url, { headers: { Authorization: 'Bearer token' } })
     expect(probe.status).toBe(200)
@@ -129,7 +131,7 @@ describe('hosted MCP endpoint auth', () => {
   })
 
   it('forwards requests that carry any bearer token to the MCP transport', async () => {
-    running = await start({ resourceMetadataUrl })
+    running = await start(hosted)
 
     const response = await post(running.url, { Authorization: 'Bearer oauth-access-token' })
     expect(response.status).toBe(200)
@@ -155,7 +157,7 @@ describe('hosted MCP endpoint auth', () => {
   })
 
   it('advertises OAuth in the server card when hosted', async () => {
-    running = await start({ resourceMetadataUrl })
+    running = await start(hosted)
 
     const card = await fetch(new URL('/.well-known/mcp/server-card.json', running.url))
     expect(card.status).toBe(200)
@@ -178,6 +180,15 @@ describe('hosted MCP endpoint auth', () => {
     ).toMatchObject({ securitySchemes: [{ type: 'noauth' }] })
   })
 
+  it('refuses hosted mode without the upstream secret API2 requires', () => {
+    // Every authenticated hosted call would fail; failing at startup shows up in health checks.
+    const message =
+      'TRANSLOADIT_MCP_RESOURCE_METADATA_URL (hosted mode) requires TRANSLOADIT_MCP_UPSTREAM_SECRET'
+    expect(() => createTransloaditMcpHttpHandler({ resourceMetadataUrl })).toThrow(message)
+    expect(() => createTransloaditMcpExpressRouter({ resourceMetadataUrl })).toThrow(message)
+    expect(() => createTransloaditMcpServer({ resourceMetadataUrl })).toThrow(message)
+  })
+
   it('refuses a static MCP token together with hosted OAuth', () => {
     // The static token check would reject every OAuth token before the hosted challenge runs.
     expect(() =>
@@ -210,7 +221,7 @@ describe('hosted MCP endpoint origins', () => {
     'http://localhost:6274',
     'http://127.0.0.1:5173',
   ])('allows %s in hosted mode', async (origin) => {
-    running = await start({ resourceMetadataUrl })
+    running = await start(hosted)
 
     const response = await post(running.url, { Origin: origin, Authorization: 'Bearer token' })
     expect(response.status).toBe(200)
@@ -223,21 +234,21 @@ describe('hosted MCP endpoint origins', () => {
     'https://transloadit.com.evil.example',
     'null',
   ])('rejects %s in hosted mode', async (origin) => {
-    running = await start({ resourceMetadataUrl })
+    running = await start(hosted)
 
     const response = await post(running.url, { Origin: origin, Authorization: 'Bearer token' })
     expect(response.status).toBe(403)
   })
 
   it('passes requests without an Origin header in hosted mode', async () => {
-    running = await start({ resourceMetadataUrl })
+    running = await start(hosted)
 
     const response = await post(running.url, { Authorization: 'Bearer token' })
     expect(response.status).toBe(200)
   })
 
   it('lets explicit allowedOrigins replace the hosted defaults', async () => {
-    running = await start({ resourceMetadataUrl, allowedOrigins: ['https://allowed.example'] })
+    running = await start({ ...hosted, allowedOrigins: ['https://allowed.example'] })
 
     const allowed = await post(running.url, {
       Origin: 'https://allowed.example',
@@ -262,7 +273,7 @@ describe('hosted MCP endpoint origins', () => {
 
   it.each([
     ['self-hosted', {}],
-    ['hosted', { resourceMetadataUrl }],
+    ['hosted', hosted],
   ])('answers %s preflights for every Streamable HTTP request header', async (_mode, options) => {
     running = await start(options)
 
@@ -307,7 +318,7 @@ describe('matchesOriginPattern', () => {
 describe('wildcard origins with DNS rebinding protection', () => {
   it.each([
     ['self-hosted', {}],
-    ['hosted', { resourceMetadataUrl }],
+    ['hosted', hosted],
   ])('accepts a %s wildcard origin match while still checking the Host', async (_mode, mode) => {
     const options: Parameters<typeof createTransloaditMcpHttpHandler>[0] = {
       metricsPath: false,
@@ -361,7 +372,7 @@ describe('request body limits', () => {
 
   it.each([
     ['self-hosted', {}],
-    ['hosted', { resourceMetadataUrl }],
+    ['hosted', hosted],
   ])('answers 413 for %s bodies above the limit without buffering them', async (_mode, mode) => {
     running = await start({ maxRequestBodyBytes: 1024, ...mode })
 
@@ -384,7 +395,7 @@ describe('request body limits', () => {
   })
 
   it('accepts bodies within the limit', async () => {
-    running = await start({ maxRequestBodyBytes: 8192, resourceMetadataUrl })
+    running = await start({ maxRequestBodyBytes: 8192, ...hosted })
 
     const response = await post(running.url, { Authorization: 'Bearer token' })
     expect(response.status).toBe(200)
diff --git a/packages/mcp-server/test/unit/server-card-express.test.ts b/packages/mcp-server/test/unit/server-card-express.test.ts
index 614d85a5..43245811 100644
--- a/packages/mcp-server/test/unit/server-card-express.test.ts
+++ b/packages/mcp-server/test/unit/server-card-express.test.ts
@@ -83,6 +83,7 @@ describe('hosted Express router', () => {
         path: '/mcp',
         resourceMetadataUrl:
           'https://api2.transloadit.com/.well-known/oauth-protected-resource/mcp',
+        upstreamSecret: 'test-upstream-secret',
         ...extra,
       }),
     )
@@ -182,6 +183,7 @@ describe('hosted Express router', () => {
         path: '/mcp',
         resourceMetadataUrl:
           'https://api2.transloadit.com/.well-known/oauth-protected-resource/mcp',
+        upstreamSecret: 'test-upstream-secret',
       }),
     )
     const server = createServer(app)
diff --git a/packages/mcp-server/test/unit/tool-surface.test.ts b/packages/mcp-server/test/unit/tool-surface.test.ts
index e7b8cd5d..767a8afe 100644
--- a/packages/mcp-server/test/unit/tool-surface.test.ts
+++ b/packages/mcp-server/test/unit/tool-surface.test.ts
@@ -44,7 +44,11 @@ const parseJsonRpcResult = async (response: Response): Promise<JsonRecord> => {
 }
 
 describe('tool surface', () => {
-  const handler = createTransloaditMcpHttpHandler({ metricsPath: false, resourceMetadataUrl })
+  const handler = createTransloaditMcpHttpHandler({
+    metricsPath: false,
+    resourceMetadataUrl,
+    upstreamSecret: 'test-upstream-secret',
+  })
   const httpServer = createServer((req, res) => {
     void handler(req, res)
   })
diff --git a/packages/mcp-server/test/unit/upstream-auth-status.test.ts b/packages/mcp-server/test/unit/upstream-auth-status.test.ts
index 09f88974..358b6a04 100644
--- a/packages/mcp-server/test/unit/upstream-auth-status.test.ts
+++ b/packages/mcp-server/test/unit/upstream-auth-status.test.ts
@@ -46,6 +46,8 @@ describe('upstream token rejections over HTTP', () => {
 
   beforeEach(async () => {
     delete serverOptions.resourceMetadataUrl
+    // Hosted mode requires the upstream secret; it is harmless when a test runs self-hosted.
+    serverOptions.upstreamSecret = 'test-upstream-secret'
     await new Promise<void>((resolve) => httpServer.listen(0, '127.0.0.1', resolve))
     const { port } = httpServer.address() as AddressInfo
     url = new URL(`http://127.0.0.1:${port}/mcp`)

From d10c7ffced06850c85366845058494995c48cebb Mon Sep 17 00:00:00 2001
From: Kevin van Zonneveld <kevin@vanzonneveld.net>
Date: Fri, 2 Oct 2026 22:27:37 +0200
Subject: [PATCH 26/27] Accept public-origin and dev Assembly URLs in the
 Assembly tools

The final tunnel QA run (session bc94fdc2) found that transloadit_wait_for_assembly rejected the
assembly_url transloadit_create_assembly had just returned on the tunnel origin
(https://devdock-kvz.transloadit.dev/assemblies/<id>), while waiting by assembly_id worked.
Assembly URLs are now accepted on Transloadit `.com` and `.dev` hosts, the configured endpoint
and the hosted public origin (taken from the resource metadata URL), with an optional trailing
slash, and a bare Assembly ID in assembly_url. Only the ID is used; status still resolves through
the configured endpoint. Credentials, query strings, other hosts, non-Assembly paths and non-HTTP
schemes stay rejected. Tests first.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 packages/mcp-server/src/server.ts             | 21 ++++++--
 .../mcp-server/test/unit/file-inputs.test.ts  | 52 +++++++++++++++++++
 2 files changed, 70 insertions(+), 3 deletions(-)

diff --git a/packages/mcp-server/src/server.ts b/packages/mcp-server/src/server.ts
index e746a891..2c221ad1 100644
--- a/packages/mcp-server/src/server.ts
+++ b/packages/mcp-server/src/server.ts
@@ -802,6 +802,12 @@ const assemblyUrlSchema = z.url()
 
 type AssemblyReference = { assemblyId: string; assemblyUrl: string }
 
+/** Production (`.com`) and development or tunnel (`.dev`) Transloadit hosts. */
+const isTransloaditHost = (hostname: string): boolean =>
+  ['transloadit.com', 'transloadit.dev'].some(
+    (domain) => hostname === domain || hostname.endsWith(`.${domain}`),
+  )
+
 const resolveAssemblyReference = (
   options: TransloaditMcpServerOptions,
   args: { assembly_url?: string; assembly_id?: string },
@@ -820,20 +826,29 @@ const resolveAssemblyReference = (
   const endpoint = options.endpoint || 'https://api2.transloadit.com'
   let assemblyId = args.assembly_id
 
-  if (args.assembly_url !== undefined) {
+  // The message promises "URL or ID", and models pass a bare ID in either field.
+  if (args.assembly_url !== undefined && assemblyIdSchema.safeParse(args.assembly_url).success) {
+    assemblyId = args.assembly_url
+  } else if (args.assembly_url !== undefined) {
     const parsed = assemblyUrlSchema.safeParse(args.assembly_url)
     if (!parsed.success) return invalidReference
     const url = new URL(parsed.data)
     const apiEndpoint = new URL(endpoint)
     const usesConfiguredOrigin = url.origin === apiEndpoint.origin
-    const usesTransloaditOrigin = url.hostname.endsWith('.transloadit.com') && url.port === ''
+    // A hosted server may answer on a public origin (a tunnel or proxy) other than its API
+    // endpoint; Assembly URLs it hands out carry that origin.
+    const usesPublicOrigin =
+      options.resourceMetadataUrl !== undefined &&
+      URL.canParse(options.resourceMetadataUrl) &&
+      url.origin === new URL(options.resourceMetadataUrl).origin
+    const usesTransloaditOrigin = isTransloaditHost(url.hostname) && url.port === ''
     if (
       (url.protocol !== 'http:' && url.protocol !== 'https:') ||
       url.username ||
       url.password ||
       url.search ||
       url.hash ||
-      (!usesConfiguredOrigin && !usesTransloaditOrigin)
+      (!usesConfiguredOrigin && !usesPublicOrigin && !usesTransloaditOrigin)
     ) {
       return invalidReference
     }
diff --git a/packages/mcp-server/test/unit/file-inputs.test.ts b/packages/mcp-server/test/unit/file-inputs.test.ts
index 52974f04..76e80836 100644
--- a/packages/mcp-server/test/unit/file-inputs.test.ts
+++ b/packages/mcp-server/test/unit/file-inputs.test.ts
@@ -42,6 +42,8 @@ describe('MCP file inputs', () => {
     delete serverOptions.mcpToken
     delete serverOptions.consoleUrl
     delete serverOptions.maxUrlDownloadBytes
+    delete serverOptions.resourceMetadataUrl
+    delete serverOptions.upstreamSecret
     fixtureDirectory = await mkdtemp(join(tmpdir(), 'mcp-test-'))
     fixturePath = join(fixtureDirectory, 'fixture.txt')
     await writeFile(fixturePath, fixtureContent)
@@ -754,4 +756,54 @@ describe('MCP file inputs', () => {
     })
     expect(Transloadit.prototype.createAssembly).not.toHaveBeenCalled()
   })
+
+  it.each([
+    ['the tunnel or devdock host', `https://devdock-kvz.transloadit.dev/assemblies/${assemblyId}`],
+    ['a trailing slash', `https://api2.transloadit.com/assemblies/${assemblyId}/`],
+    ['a bare Assembly ID', assemblyId],
+  ])('waits on an Assembly URL with %s, resolving it through the configured API', async (_kind, url) => {
+    const result = await client.callTool({
+      name: 'transloadit_wait_for_assembly',
+      arguments: { assembly_url: url },
+    })
+    expect(result.structuredContent).toMatchObject({ status: 'ok' })
+    expect(Transloadit.prototype.awaitAssemblyCompletion).toHaveBeenCalledWith(
+      assemblyId,
+      expect.objectContaining({ assemblyUrl }),
+    )
+  })
+
+  it('accepts Assembly URLs on the public origin of the hosted resource metadata', async () => {
+    serverOptions.resourceMetadataUrl =
+      'https://mcp.example.org/.well-known/oauth-protected-resource/mcp'
+    serverOptions.upstreamSecret = 'test-upstream-secret'
+
+    const result = await client.callTool({
+      name: 'transloadit_wait_for_assembly',
+      arguments: { assembly_url: `https://mcp.example.org/assemblies/${assemblyId}` },
+    })
+    expect(result.structuredContent).toMatchObject({ status: 'ok' })
+    expect(Transloadit.prototype.awaitAssemblyCompletion).toHaveBeenCalledWith(
+      assemblyId,
+      expect.objectContaining({ assemblyUrl }),
+    )
+  })
+
+  it.each([
+    ['a foreign host', `https://evil.example/assemblies/${assemblyId}`],
+    ['a look-alike host', `https://transloadit.dev.evil.example/assemblies/${assemblyId}`],
+    ['credentials', `https://user:pass@api2.transloadit.com/assemblies/${assemblyId}`],
+    ['a non-Assembly path', `https://api2.transloadit.com/templates/${assemblyId}`],
+    ['a non-HTTP scheme', `ftp://api2.transloadit.com/assemblies/${assemblyId}`],
+  ])('still rejects an Assembly URL with %s', async (_kind, url) => {
+    const result = await client.callTool({
+      name: 'transloadit_wait_for_assembly',
+      arguments: { assembly_url: url },
+    })
+    expect(result.structuredContent).toMatchObject({
+      status: 'error',
+      errors: [{ code: 'mcp_invalid_args', path: 'assembly_url' }],
+    })
+    expect(Transloadit.prototype.awaitAssemblyCompletion).not.toHaveBeenCalled()
+  })
 })

From c990cb6ee3ae085e19cbe17a03eb29f9b063c1cd Mon Sep 17 00:00:00 2001
From: Kevin van Zonneveld <kevin@vanzonneveld.net>
Date: Sat, 3 Oct 2026 20:34:03 +0200
Subject: [PATCH 27/27] Fix the Codex and Docker HTTP examples in the MCP
 server README
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`codex mcp add --url` already starts the browser login, so following it with `codex mcp login`
authorized a second time and minted a second Auth Key. The Docker HTTP example passed
`transloadit-mcp http …` as arguments to the image's `transloadit-mcp stdio` entrypoint and left
out the transport token that binding to 0.0.0.0 requires. Both now match the website docs.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 packages/mcp-server/README.md | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/packages/mcp-server/README.md b/packages/mcp-server/README.md
index 2930f29e..8fe9cbec 100644
--- a/packages/mcp-server/README.md
+++ b/packages/mcp-server/README.md
@@ -53,9 +53,11 @@ instead of bundling skill files.
 
 ```bash
 codex mcp add transloadit --url https://api2.transloadit.com/mcp
-codex mcp login transloadit
 ```
 
+Codex opens the consent page right away. To sign in again later, run
+`codex mcp login transloadit`.
+
 Or in `~/.codex/config.toml`:
 
 ```toml
@@ -147,15 +149,19 @@ docker run -i --rm \
   ghcr.io/transloadit/mcp-server:latest
 ```
 
-For HTTP mode via Docker, expose the port:
+For HTTP mode via Docker, override the `stdio` entrypoint, expose the port, and set a transport
+token, which binding to `0.0.0.0` requires:
 
 ```bash
+export TRANSLOADIT_MCP_TOKEN="$(openssl rand -hex 32)"
 docker run --rm \
   -e TRANSLOADIT_KEY=MY_AUTH_KEY \
   -e TRANSLOADIT_SECRET=MY_SECRET_KEY \
+  -e TRANSLOADIT_MCP_TOKEN \
   -p 5723:5723 \
+  --entrypoint transloadit-mcp \
   ghcr.io/transloadit/mcp-server:latest \
-  transloadit-mcp http --host 0.0.0.0 --port 5723
+  http --host 0.0.0.0 --port 5723
 ```
 
 ### `TRANSLOADIT_MCP_TOKEN` explained