Scope toolkit tool reads and stop gating reads on TTL-expired catalogs

[RhysSullivan]

Toolkit MCP sessions were slower than default sessions in production: session init p95 was about 3.3 s versus 0.3 s, and search or describe inside a toolkit session paid the same cost. Two structural causes.

1. A toolkit session listed connections by loading every tool row in the workspace and resolving policy for each, then keeping the few the toolkit allowed. ToolPolicyProvider.prepare now returns the dynamic-tool prefixes the allowlist can reach, and core restricts the tool query to those prefixes. The read scales with the toolkit, not the workspace.

2. Every tools read waited up to the 2 s grace budget for re-listing MCP catalogs that were merely older than the freshness TTL. Those rebuilds now run in the background and the read answers from the persisted rows. Stale-marked and config-revised catalogs still gate the read within the grace budget. Visibility-only readers (connections and integrations under a toolkit) no longer wait on the sync at all.

Also digests the toolkit rules once per operation instead of re-sorting and re-classifying them for every tool.

Tests: unit tests for the scope helper, scoped reads under a prepared provider, the toolkit scope derivation, and the split between expired and stale-marked sync. The MCP catalog TTL test now asserts eventual convergence. Ran selfhost e2e toolkits-mcp scenarios.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	2f6c24c	Sep 18 2026, 07:10 PM

[github-actions]

Cloudflare preview

Torn down — the PR is closed.

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@2061

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@2061

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@2061

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@2061

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@2061

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@2061

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@2061

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@2061

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@2061

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@2061

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@2061

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@2061

executor

npm i https://pkg.pr.new/executor@2061

commit: 2f6c24c