In-Proxy Profiles (Spec 057)

Profiles are named, stateless subsets of upstream servers addressable as permanent URLs at /mcp/p/<slug>.

Quick start

{
  "profiles": [
    { "name": "research", "servers": ["arxiv", "wikipedia"] },
    { "name": "deploy",   "servers": ["k8s", "github"] }
  ]
}

Each profile gets a permanent MCP endpoint:

Rules

• Slug format: ^[a-z0-9][a-z0-9_-]{0,62}$ (max 63 chars, lowercase)
• Reserved slugs: all, code, call, p — cannot be used as profile names
• Duplicate names: rejected at load time (fatal validation error)
• Unknown server references: warn-and-skip (non-fatal); the server is excluded from the effective set
• Empty server list: legal "deny everything" profile (no tools exposed)

Behaviour

• retrieve_tools returns only tools from the profile's servers
• call_tool_read/write/destructive into an out-of-profile server is rejected with: server '<name>' is not in profile '<slug>'
• upstream_servers list at a profile URL excludes out-of-profile servers
• code_execution at a profile URL runs with the profile-intersected server set
• Per-server enabled_tools/disabled_tools continue to apply inside a profile (no profile-level tool overrides)

Scope composition

Profile filtering is independent of agent-token scope. An unauthenticated connection at /mcp/p/<slug> is still profile-filtered. When both a profile and an agent token are present, the effective server set is their intersection.

Error attribution:

• Out-of-profile server → server '<s>' is not in profile '<slug>'
• Out-of-token server → Server '<s>' is not in scope for this agent token

Activity logging

Tool-call activity records from profile URLs carry metadata["profile"] = "<slug>". Records from /mcp omit this field.

Hot reload

Profile changes take effect for new connections on the next config reload. In-flight sessions keep their snapshot.

404 responses