MCP

resolveReviewedDeployment and createSecureCheckoutHandoff above are consumer integration callbacks, not package exports. Return a CommerceContext based on trusted server configuration, never the tool arguments or a claimed client name. Unknown channels and missing/expired reviews fail closed. A deployment review cannot override the bundled ChatGPT digital-sales, Claude interactive-purchase, or Cursor marketplace paid-access restrictions. Ambiguous profiles intersect.

Reviews must bind the profile, actions, product categories, source URLs and validity window. Capabilities such as external links are checked independently. Classify every possible cart category server-side; never trust a model-supplied product category. meta.commerceDecision records the result for onCall.

This gate is host eligibility only: preserve ownership checks, Agency action authorization, exact purchase confirmation and provider reconciliation. It does not inspect arbitrary text, prompts, resources or untagged tools for sales links. Consumers must use the same evaluator for those surfaces until shared renderers are implemented. An informational-link classification must never redirect users to a transaction. No live sales path is enabled by installing this package.

Nothing here depends on a model. The tool shape is structurally compatible with @absolutejs/ai's AIToolMap, so an AI tool registry serves over MCP without conversion — but any typed tool registry works.

Peer dependency: elysia.

The trade-off, stated plainly. Elicitation is the one MCP feature a stateless server cannot do: the question goes out on the SSE stream of an in-flight tools/call, and the client answers on a _separate_ HTTP POST. Two requests have to meet, so the endpoint becomes session-stateful (Mcp-Session-Id). Leave elicitation off — the default — and nothing changes: the server stays stateless, tools/call keeps answering with a plain JSON body, and only tools marked mayElicit ever stream.

Running more than one instance. Behind one server the defaults handle it. Behind several, two different things break, and each has a seam:

Supply neither and run a single instance (or pin sessions). Supply both and elicitation is safe behind a load balancer with no sticky routing — there is a test for exactly that: instance A asks, the answer lands on B, the bus carries it back, and A's call finishes.

AbsoluteJS already ships both production transports. PostgreSQL is the default; Redis is an optional at-most-once fan-out optimization:

The channel is only coordination: durable jobs and side effects belong in @absolutejs/queue / @absolutejs/execution, not Redis pub/sub or NOTIFY.

Consuming a server that elicits? Pass onElicit to createMcpClient — that is what declares the capability, and what the package uses to answer. Omit it and servers are told you cannot ask anyone.

Read the tool outcome under result; the outer status describes credit work, not action approval or delivery. Saved JSON is decoded once; plain text remains a string, and serialized MCP results remain nested without discarding content. The formatter never retries work. A missing saved result carries a same-ID polling instruction. Bind account identity and authorization before retrieving the saved work; this helper does not authorize access or filter the tool's saved payload.

Tool audit records

onCall receives normalized result, outcome (completed, failed, or rejected), durationMs, JSON-RPC requestId, unique traceId, and sessionId, alongside the existing caller, arguments, name, success flag, and shared metadata. The trace ID is available in meta.traceId before admission. Rejected guards, unknown tools, malformed calls, and dispatch failures are recorded too. Streaming and deferred task calls produce one final record when their execution finishes. An audit-hook exception is logged without replacing the executed tool result. Hosts must redact credentials and choose payload size and retention limits before persisting records. These records do not include the client's surrounding chat.

Per-account instructions

instructions accepts a string or async ({ caller }) => string | undefined. The callback runs for the authenticated caller at initialization, without a shared caller cache. Refresh policy in tool results when settings can change during an existing session.

Durable audit admission and usage correlation

onCallStart runs before tool dispatch. Persist a start receipt there; throwing prevents execution. onCall runs once at completion, including streamed/deferred execution. Its failure never replaces an executed result: use a durable local outbox or equivalent reconciliation mechanism, not a retry of the effect. A start without completion means incomplete evidence, not success.

For Bun/Node servers, import withMcpCall and currentMcpCall from @absolutejs/mcp/call-context, and set withCallContext: withMcpCall on the server config. The main entry remains browser-compatible; other runtimes can supply their own context adapter. currentMcpCall() exposes server-generated trace identity, request/session identity, tool, server version and the per-call metadata object across asynchronous execution. Use it to correlate downstream metering. Bind domain identifiers only after authorization; incoming arguments and external conversation identifiers are not authority. withMcpCall is available for trusted host adapters. Concurrent calls have isolated contexts. External host conversations, host-side retries and subscription costs are not visible to this server.

Local stdio servers

@absolutejs/mcp/stdio exports serveMcpStdio({ config, caller, scopes, input, write }). Supply an async byte stream (for example Bun.stdin.stream()) and a protocol-only writer. It reuses the HTTP registry and dispatcher with bounded, newline-delimited UTF-8 framing. The launching OS user is the local identity; each tool remains responsible for authorizing remote actions. This initial adapter processes calls sequentially and does not advertise elicitation, Apps, or background tasks. Keep tools bounded; return a job reference for longer work. Never send credentials or private delivery payloads through tool results, stdout, stderr, prompts, or resources. Use a separate trusted local sink for such values.