IronClaw proposes caller-scoped tool catalogs for hosted MCP

IronClaw's September 8 hosted-MCP work asks a more specific question than whether a server can expose tools: whose tools does a particular caller get to see? The open catalog proposal replaces a shared extension slot with a scoped overlay, while related caller-attribution work would let opted-in servers distinguish conversations and invocations. This is a boundary design for multi-user tool services, not an announcement that every IronClaw deployment has acquired a marketplace.

The facts

- The catalog proposal keys discovered packages by tenant, user and thread, with a TTL, bounded size and negative entries for rejected credentials. - Discovery uses the current caller's scope and credential at turn start rather than a shared credential. - Tool surface, grants, trust, dispatch and egress are intended to read one overlaid view with global fallback. - A discovered capability matching a reviewed declaration retains its effects and default permission instead of being downgraded by discovery metadata. - The caller-attribution proposal adds optional sep414 metadata to tools/list and tools/call, but not initialize; non-opted providers receive no attribution block. - The separate agent-market package proposal 8089 was closed without merge and disclosed missing in-repository provider-double execution coverage.

Why it matters

Tool discovery is often treated as harmless metadata. In a credential-dependent service, it can reveal another user's catalog or erase the tools a current user expects. The proposed overlay treats discovery as scoped runtime state, while retaining reviewed permission semantics when a server describes an existing capability differently. Caller attribution is related but distinct: knowing a conversation on the wire can support provider state or deduplication, but an identifier alone does not make a remote action safe to repeat.

Current

Inspected on 2026-09-09. The IronClaw stable-release baseline is ironclaw-v1.4.0 published 2026-08-28T11:19:24Z. The main source was open (not merged) when captured. Release metadata is a version boundary; an open proposal, a merged mainline change and a packaged release remain different states.

Evidence

The primary evidence is nearai/ironclaw PR #8090 (https://github.com/nearai/ironclaw/pull/8090). Supporting context comes from nearai/ironclaw PR #8084 (https://github.com/nearai/ironclaw/pull/8084); nearai/ironclaw PR #8089 (https://github.com/nearai/ironclaw/pull/8089). These pages were inspected directly. Related project records explain the source cluster; they are not independent replications of contributor test claims.

Operator take

Review this as a multi-principal contract. Exercise two callers with different catalogs, a missing credential, a temporary provider failure and a tool that attempts to downgrade its declared effect. Verify that every downstream authorization path reads the same scoped view. The overlay is process-local, so a fleet may rediscover independently rather than share a cache. Do not infer a marketplace launch from the closed package branch: its opt-in deployment URL and financial tool classification illustrate the intended boundary, while its missing execution harness remains a real qualification limit.

Caveat

The catalog and attribution changes were open at capture, and attribution opts in no provider by itself. The package branch is closed, not merged. Deployment snippets and tests are contributor-reported evidence; illmethinks did not execute financial tools, install a hosted provider or reproduce the multi-user behavior.