@@ -0,0 +1,18 @@
+---
+'@objectstack/runtime': patch
+---
+
+fix(runtime)!: MCP list_actions summarises each action against the object as the caller is served it (ADR-0106)
+
+Clause-②: no (narrowing) — `list_actions` over `/api/v1/mcp` now answers a caller only the actions, and the param details, that the `/meta` object door's projection serves that caller, which ADR-0106 D1 ("a field the caller cannot read does not exist for that caller, on any plane") and the MCP security model (field-level security applies to the agent exactly as to a person) already promise, so no stated contract is narrowed; what narrows is the answer to a caller with a `readable: false` field. Nothing is widened: no export, answer member, error code or status is added.
+Metadata-protocol: none
+Skills-docs: no move — `skills/**` teaches no param summary for `list_actions`; `content/docs/ai/connect-mcp.mdx` states the projection.
+
+<!-- adr-0087: not-required (no-migration-prescription) No key of any schema, no export and no stored shape changes: list_actions answers a field-restricted caller the actions and param details the metadata object door already serves them. There is nothing for a migration to rewrite and no tombstone. -->
+
+**BREAKING** for a field-restricted caller of MCP `list_actions` over HTTP (`/api/v1/mcp`).
+
+- **Now.** Each action `list_actions` would list is projected through the `/meta` object door's ADR-0106 posture and projection for this caller, as its object's only action (`servedToCaller`, the projection `describe_object` uses). An action that projection withholds — a param whose `field` the caller cannot read, a param under `objectOverride` whose field the caller cannot read on the object it names, or any other position of the action that reads such a field — is not listed, as `GET /api/v1/meta/object/:name` does not serve it. A listed action's params are summarised against the projected object, so no label, help text, type or select options of a field the caller cannot read reach its summary.
+- **Refusal.** Where the caller's field visibility on a listed action's object cannot be evaluated, or the projection would leave that object with no field, `list_actions` is refused as `list_objects` is: `FIELD_VISIBILITY_UNRESOLVED` / 503.
+- **`run_action` naming a `sys_*` object.** That call's pre-screen admits only an action `list_actions` lists, so an action withheld above is refused there too, with the system-object sentence. No other `run_action` call consults the listing.
+- **Unchanged.** A caller who may read every field, a D4-exempt caller and a deployment with no `security` service are answered byte for byte as before; so is every action whose params bind only readable fields, or none. The action collection and the run gates (`run_action`, `resume_run`) still read the declarations whole. The stdio server carries no `list_actions`.
@@ -364,7 +364,11 @@ drive this MCP server. Same word, different layer.
   the Console. Schema discovery is included: `describe_object`,
   `list_objects`' `fieldCount` and the fields `validate_expression` puts in
   scope name only the fields the caller can read, the same field set
-  `GET /api/v1/meta/object/:name` serves that caller. Sparse results or denied
+  `GET /api/v1/meta/object/:name` serves that caller. `list_actions` follows
+  the same projection: an action that object door withholds from the caller
+  (one whose param binds a field the caller cannot read) is not listed, and a
+  listed action's params carry no label, help text or options of such a
+  field. Sparse results or denied
   writes usually mean governance is *working*, not that the connection is
   broken.
 - **OAuth scopes narrow the toolset.** Tokens carry `data:read`,
@@ -489,7 +493,7 @@ skill and a guided `/objectstack:connect` command.
 | stdio won't start / boot fails closed | `OS_MCP_STDIO_ENABLED=true` but `OS_MCP_STDIO_API_KEY` is missing, unknown, revoked, or expired — fail-closed by design (ADR-0101). Set a valid `osk_` key; there is no unscoped or `system` fallback |
 | `401` on every call | Anonymous or invalid credentials. Interactive clients: complete the browser login (the `WWW-Authenticate` header advertises the OAuth metadata). Headless: check the `osk_` key and header spelling |
 | `403 insufficient_scope` | The OAuth token lacks the scope for that tool family (e.g. writes without `data:write`) — reconnect and grant the scope |
-| An action is missing from `list_actions` | `ai.exposed` is not `true`, `ai.description` is shorter than 40 characters, the type isn't headless-callable here (`script` with a body/handler, `flow` with an automation service, and `api` with a same-origin `target` are — `url`, `modal`, `form`, and an `api` action whose `target` is on another origin never appear), it targets `sys_metadata` / `sys_metadata_history` (refused even when flagged — use the metadata API), or the caller fails its `requiredPermissions` |
+| An action is missing from `list_actions` | `ai.exposed` is not `true`, `ai.description` is shorter than 40 characters, the type isn't headless-callable here (`script` with a body/handler, `flow` with an automation service, and `api` with a same-origin `target` are — `url`, `modal`, `form`, and an `api` action whose `target` is on another origin never appear), it targets `sys_metadata` / `sys_metadata_history` (refused even when flagged — use the metadata API), or the caller fails its `requiredPermissions`, or one of its params binds a field the caller cannot read |
 | Reads return few rows / writes denied | Working as designed — the caller's permissions and RLS apply. Verify with the same user in the Console |
 
 ## Related
 
@@ -311,3 +311,203 @@ describe('[ADR-0106] HTTP MCP bridge and the /metadata object door agree — the
         expect({ code: options?.code, status: options?.status }).toEqual(REFUSED);
     });
 });
+
+describe('[ADR-0106] HTTP MCP list_actions summarises an action against the object as the caller is served it', () => {
+    const OBJ = 'mcp_fls_project';
+    const OTHER = 'mcp_fls_vendor';
+    const DENIED = 'budget';
+    const DENIED_OTHER = 'rate';
+    const DENIED_LABEL = 'Approved budget';
+    const DENIED_HELP = 'Spend ceiling the board signed off';
+    let engine: ObjectQL;
+    let services: Record<string, any>;
+
+    const ai = (description: string) => ({ exposed: true, description });
+    /** Binds a field the member cannot read. */
+    const SET_BUDGET = { name: 'set_budget', label: 'Set budget', operation: 'update', params: [{ field: DENIED }], ai: ai('Set the approved budget of this project to a new amount.') };
+    /** Binds a field of ANOTHER object the member cannot read (`objectOverride`, judged there). */
+    const QUOTE_RATE = {
+        name: 'quote_rate', label: 'Quote rate', operation: 'update',
+        params: [{ field: DENIED_OTHER, objectOverride: OTHER }], ai: ai('Quote the day rate of a vendor for this project.'),
+    };
+    /**
+     * Binds the OTHER object's field of the same name as the denied one, which
+     * the member can read: listed, and summarised against no field of this
+     * object (the served one carries no `budget`).
+     */
+    const VENDOR_BUDGET = {
+        name: 'quote_vendor_budget', label: 'Quote vendor budget', operation: 'update',
+        params: [{ field: DENIED, objectOverride: OTHER }], ai: ai('Quote the budget a vendor offered for this project.'),
+    };
+    /** Binds a field the member CAN read: the control. */
+    const RENAME = { name: 'rename_project', label: 'Rename', operation: 'update', params: [{ field: 'title' }], ai: ai('Rename this project to the title the user gives.') };
+    /** Binds no field at all. */
+    const CLOSE = { name: 'close_project', label: 'Close', operation: 'update', patch: { stage: 'closed' }, ai: ai('Close this project once the work on it is finished.') };
+    const ALL_ACTIONS = [CLOSE.name, QUOTE_RATE.name, VENDOR_BUDGET.name, RENAME.name, SET_BUDGET.name];
+    const MEMBER_ACTIONS = [CLOSE.name, VENDOR_BUDGET.name, RENAME.name];
+    const READABLE_ACTIONS = [CLOSE.name, RENAME.name];
+
+    const PERSONAS = {
+        /** Denied `budget` here and `rate` on the other object. */
+        member: { userId: 'usr_member', positions: [] as string[], permissions: ['mcp_act_member'], systemPermissions: [] as string[] },
+        /** Denied nothing: the control. */
+        staff: { userId: 'usr_staff', positions: [] as string[], permissions: ['mcp_act_staff'], systemPermissions: [] as string[] },
+        /** Denied every field of the project object. */
+        walled: { userId: 'usr_walled', positions: [] as string[], permissions: ['mcp_act_walled'], systemPermissions: [] as string[] },
+    } as const;
+
+    beforeAll(async () => {
+        engine = new ObjectQL();
+        const driver = new SqlDriver({ client: 'better-sqlite3', connection: { filename: ':memory:' }, useNullAsDefault: true } as any);
+        const storeObjects = [SysMetadataObject, SysMetadataHistoryObject, SysMetadataAuditObject] as any[];
+        await driver.initObjects(storeObjects);
+        engine.registerDriver(driver as any, true);
+        await engine.init();
+        for (const o of storeObjects) engine.registry.registerObject(o, '@objectstack/platform-objects');
+        engine.registerApp({
+            id: 'com.objectstack.qa.mcp-list-actions-field-mask',
+            name: 'MCP list_actions field mask',
+            version: '1.0.0',
+            type: 'plugin',
+            scope: 'system',
+            objects: [
+                {
+                    name: OBJ,
+                    label: 'Project',
+                    sharingModel: 'public_read_write',
+                    fields: {
+                        title: { name: 'title', type: 'text', label: 'Title', required: true },
+                        stage: {
+                            name: 'stage', type: 'select', label: 'Stage',
+                            options: [{ value: 'open', label: 'Open' }, { value: 'closed', label: 'Closed' }],
+                        },
+                        [DENIED]: { name: DENIED, type: 'currency', label: DENIED_LABEL, description: DENIED_HELP },
+                    },
+                    actions: [SET_BUDGET, QUOTE_RATE, VENDOR_BUDGET, RENAME, CLOSE],
+                },
+                {
+                    name: OTHER,
+                    label: 'Vendor',
+                    sharingModel: 'public_read_write',
+                    fields: {
+                        name: { name: 'name', type: 'text', label: 'Name' },
+                        [DENIED_OTHER]: { name: DENIED_OTHER, type: 'currency', label: 'Day rate' },
+                        [DENIED]: { name: DENIED, type: 'currency', label: 'Vendor budget' },
+                    },
+                },
+            ],
+        } as never);
+        await engine.syncSchemas();
+        const all = { allowRead: true, allowCreate: true, allowEdit: true, allowDelete: true };
+        const deny = { readable: false, editable: false };
+        const sets = [
+            PermissionSetSchema.parse({
+                name: 'mcp_act_member', label: 'Member', objects: { '*': all },
+                fields: { [`${OBJ}.${DENIED}`]: deny, [`${OTHER}.${DENIED_OTHER}`]: deny },
+            }),
+            PermissionSetSchema.parse({ name: 'mcp_act_staff', label: 'Staff', objects: { '*': all } }),
+            PermissionSetSchema.parse({
+                name: 'mcp_act_walled', label: 'Walled', objects: { '*': all },
+                fields: Object.fromEntries(Object.keys((engine.getSchema(OBJ) as any).fields).map((f) => [`${OBJ}.${f}`, deny])),
+            }),
+        ];
+        const pluginServices: Record<string, unknown> = {
+            manifest: { register: vi.fn() },
+            objectql: engine,
+            metadata: {
+                get: async (_type: string, name: string) => engine.getSchema(name) ?? null,
+                list: async () => sets,
+            },
+        };
+        const ctx = {
+            logger: { info: vi.fn(), warn: vi.fn(), error: vi.fn(), debug: vi.fn() },
+            registerService: vi.fn((name: string, service: unknown) => { pluginServices[name] = service; }),
+            getService: (name: string) => {
+                if (!(name in pluginServices)) throw new Error(`service not registered: ${name}`);
+                return pluginServices[name];
+            },
+        };
+        const plugin = new SecurityPlugin({ fallbackPermissionSet: 'mcp_act_staff' });
+        await plugin.init(ctx as never);
+        await plugin.start(ctx as never);
+        expect(pluginServices.security, 'precondition: the security plugin registered its service').toBeDefined();
+        vi.spyOn((engine as unknown as { logger: { warn: () => void } }).logger, 'warn').mockImplementation(() => undefined);
+        services = {
+            protocol: new ObjectStackProtocolImplementation(engine as any),
+            security: pluginServices.security,
+            objectql: engine,
+        };
+        vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+    }, 60_000);
+
+    afterAll(async () => {
+        vi.restoreAllMocks();
+        try { await engine?.destroy(); } catch { /* noop */ }
+    });
+
+    /** One persona's `list_actions` answer on the HTTP bridge, and the actions the `/metadata` object door serves them. */
+    async function listBoth(persona: Record<string, unknown>, over: Record<string, any> = services) {
+        const { bridge, dispatcher } = await bridgeFor(kernelOver(over), persona);
+        const listed: any[] = await bridge.listActions();
+        const meta = await dispatcher.handleMetadata(`/object/${OBJ}`, {
+            request: {}, environmentId: undefined, executionContext: { ...persona },
+        } as any, 'GET');
+        const metaActions = ((meta.response?.body?.data?.item?.actions ?? []) as any[]).map((a) => a.name).sort();
+        return { listed, metaActions, metaStatus: meta.response?.status };
+    }
+    const namesOf = (listed: any[]) => listed.filter((a) => a.objectName === OBJ).map((a) => a.name).sort();
+    const byName = (listed: any[], name: string) => listed.find((a) => a.objectName === OBJ && a.name === name);
+
+    it('precondition: every fixture action is listed to an unrestricted caller', async () => {
+        const { listed, metaActions } = await listBoth(PERSONAS.staff);
+        expect(namesOf(listed)).toEqual(ALL_ACTIONS);
+        expect(metaActions).toEqual(ALL_ACTIONS);
+    });
+
+    it('a member who cannot read the bound field is not listed the action, nor shown the field — as the /metadata door serves them', async () => {
+        const { listed, metaActions, metaStatus } = await listBoth(PERSONAS.member);
+        expect(metaStatus).toBe(200);
+        expect(metaActions, 'the /metadata object door withholds both').toEqual(MEMBER_ACTIONS);
+        expect(namesOf(listed), 'list_actions lists what the /metadata door serves').toEqual(metaActions);
+        const text = JSON.stringify(listed.filter((a) => a.name !== VENDOR_BUDGET.name));
+        for (const hidden of [DENIED, DENIED_OTHER, DENIED_LABEL, DENIED_HELP, 'Day rate']) {
+            expect(text.includes(hidden), `'${hidden}' must not reach this caller`).toBe(false);
+        }
+    });
+
+    it('a param bound to another object\'s readable field is summarised against no field of this object the member cannot read', async () => {
+        const { listed } = await listBoth(PERSONAS.member);
+        const entry = byName(listed, VENDOR_BUDGET.name);
+        expect(entry.params).toEqual([{ name: DENIED, type: 'string', required: false }]);
+        expect(JSON.stringify(entry).includes(DENIED_LABEL)).toBe(false);
+        expect(JSON.stringify(entry).includes(DENIED_HELP)).toBe(false);
+    });
+
+    it('a member denied every field of a listed action\'s object is refused, as list_objects refuses them', async () => {
+        const { bridge } = await bridgeFor(kernelOver(services), PERSONAS.walled);
+        const refused = await rejectionOf(() => bridge.listActions());
+        expect({ code: refused?.code, status: refused?.status }).toEqual(REFUSED);
+        const listed = await rejectionOf(() => bridge.listObjects());
+        expect({ code: listed?.code, status: listed?.status }).toEqual(REFUSED);
+    });
+
+    it('CONTROL — an unrestricted member is shown the full summary, byte-identical to a deployment with no security service', async () => {
+        const { listed } = await listBoth(PERSONAS.staff);
+        expect(byName(listed, SET_BUDGET.name).params).toEqual([
+            { name: DENIED, type: 'number', required: false, description: `${DENIED_LABEL} — ${DENIED_HELP}` },
+        ]);
+        expect(byName(listed, QUOTE_RATE.name).params?.map((p: any) => p.name)).toEqual([DENIED_OTHER]);
+        const unsecured = await listBoth(PERSONAS.staff, { ...services, security: undefined });
+        expect(JSON.stringify(listed)).toBe(JSON.stringify(unsecured.listed));
+    });
+
+    it('an action binding a readable field, or none, is summarised to the member exactly as to the control', async () => {
+        const member = await listBoth(PERSONAS.member);
+        const staff = await listBoth(PERSONAS.staff);
+        for (const name of READABLE_ACTIONS) {
+            expect(byName(member.listed, name), name).toEqual(byName(staff.listed, name));
+        }
+        expect(byName(member.listed, RENAME.name).params).toEqual([{ name: 'title', type: 'string', required: false, description: 'Title' }]);
+        expect(byName(member.listed, CLOSE.name)).not.toHaveProperty('params');
+    });
+});
@@ -697,6 +697,24 @@ export function buildMcpBridge(deps: DomainHandlerDeps, context: HttpProtocolCon
         return masked.document;
     };
 
+    /**
+     * [ADR-0106 D1] The object one action is summarised against, as THIS
+     * caller is served it — or `undefined` when the `/meta` object door's
+     * projection withholds the action from this caller. The action is
+     * projected as its object's only `actions` entry ({@link servedToCaller}),
+     * the position where that projection drops an action reading a field the
+     * caller cannot read: a param's `field` (one under `objectOverride` judged
+     * on the object it names), or any other position of the action. So one
+     * rule decides on both doors, and the object handed back is the projected
+     * one, which carries no field the caller cannot read. An action with no
+     * object definition carries no field of one, and is answered as declared.
+     */
+    const servedActionObject = async (action: any, obj: any): Promise<{ obj: any } | undefined> => {
+        if (!obj || typeof obj !== 'object') return { obj };
+        const served = await servedToCaller({ ...obj, actions: [action] });
+        return Array.isArray(served?.actions) && served.actions.length === 1 ? { obj: served } : undefined;
+    };
+
     /** {@link readServedObject}, as this caller is served it ({@link servedToCaller}). */
     const readObjectForCaller = async (name: string): Promise<any> => {
         const def: any = await readServedObject(name);
@@ -964,8 +982,12 @@ export function buildMcpBridge(deps: DomainHandlerDeps, context: HttpProtocolCon
                 // that credential (a `sys_api_key` write under an API key),
                 // marked with that gate's own code and sentence.
                 const refusal = actionExec.apiForwardCredentialRefusal(context, action);
+                // [ADR-0106 D1] Summarised against the object as this caller is
+                // served it, and not listed where `/meta` withholds it.
+                const served = await servedActionObject(action, obj);
+                if (!served) continue;
                 out.push({
-                    ...actionExec.summarizeAction(deps, action, obj, objectName, flow ?? undefined),
+                    ...actionExec.summarizeAction(deps, action, served.obj, objectName, flow ?? undefined),
                     ...(refusal ? { unavailable: { code: refusal.code, reason: refusal.message } } : {}),
                 });
             }