Tool surface
The compiler produces one operation registry for browser controls, MCP tools, generated routes and internal calls. Selected application packages contribute permitted model reads/lists, enabled public CRUD and user scenarios. Dependency packages do not automatically publish every tool. Tool discovery is not permission; each invocation repeats current caller, team, row and field checks.
Authentication and consent identify the connected user and team. Grants are explicit and revocable; a tool call cannot impersonate an administrator or invoke trusted handlers, timers, provider events, queues or deployment actions. Schemas are typed and bounded. Results use the same safe projections and operation envelopes as the browser.
File handoff uses authorized finalized file references and current download permission. Uploaded content is untrusted data, never instructions. MCP descriptions remain in source language; no locale argument is added. See actions and invocations, files, and reviewed AI actions.