@@ -0,0 +1,21 @@
+---
+'@objectstack/mcp': patch
+'@objectstack/runtime': patch
+'@objectstack/spec': patch
+---
+
+fix(mcp, runtime)!: MCP describe_object answers the same field-masked object schema the /meta door answers (ADR-0106)
+
+Clause-②: no (narrowing) — the MCP object-schema reads now serve a caller only the fields the `/meta` object door serves that caller, which ADR-0106 D1 ("a field the caller cannot read does not exist for that caller, on any plane") and the MCP security model ("field-level security applies to the agent exactly as it does to a person") already promise, so no stated contract is narrowed; what narrows is the answer to a caller with a `readable: false` field. Nothing is widened: no export, answer member, error code or status is added.
+Metadata-protocol: none
+Skills-docs: no move — `skills/**` teaches no field set for `describe_object`; `content/docs/ai/connect-mcp.mdx` states that schema discovery is covered by field-level security.
+
+<!-- adr-0087: not-required (no-migration-prescription) No key of any schema, no export and no stored shape changes: the MCP tools answer a field-restricted caller the field set the metadata door already serves them, with a code and status already on the wire. There is nothing for a migration to rewrite and no tombstone. -->
+
+**BREAKING** for a field-restricted caller of the MCP object-schema reads, on both transports (`/api/v1/mcp` and the stdio server).
+
+- **Now.** `describe_object`, `list_objects`' `fieldCount`, the fields `validate_expression` puts in scope (and its `label()` option-field check) and, on the stdio server, the `objectstack://objects` resources serve each object through the ADR-0106 posture and projection the `/meta` doors run (`resolveObjectSchemaMaskPosture` → `relateObjectSchemaMaskPosture` → `applyObjectSchemaMask`, `@objectstack/metadata-core`), for the same caller: a field the caller cannot read is not listed, and the D4 exemptions, the D6 tiers and the D8 switch (`OS_ALLOW_UNMASKED_OBJECT_METADATA`) are the shared posture's. The HTTP bridge asks the `/meta` door's own masker (`resolveObjectMasker` / `maskObjectSchema`, `@objectstack/runtime`); the stdio bridge asks the host's `security` service about its API-key principal.
+- **Refusal.** Where the caller's field visibility cannot be evaluated, or the projection would leave the object with no field, the read is refused as the `/meta` door refuses it: `FIELD_VISIBILITY_UNRESOLVED` / 503, rendered as the tools' coded error (`{ error: { code, message, status } }`) and, on a stdio object resource, as `{ error, code, status }`. One object that cannot be projected refuses `list_objects`, as the `/meta` object list does.
+- **Unchanged.** A caller who may read every field, a D4-exempt caller and a deployment with no `security` service are answered byte for byte as before. The data verbs, their gates and `list_actions` / `run_action` are untouched. The stdio object reads now resolve the API-key principal on each call, as the data verbs already do, so a revoked key is refused there too.
+- **`@objectstack/mcp`** now depends on `@objectstack/metadata-core` at runtime (it was a dev dependency).
+- **`@objectstack/spec`**: the error-code ledger lists `FIELD_VISIBILITY_UNRESOLVED` under `@objectstack/runtime` and `@objectstack/mcp` as well, its two new emitters. The code itself was already registered.
@@ -361,8 +361,12 @@ drive this MCP server. Same word, different layer.
 - **Every call runs as the caller.** The MCP bridge resolves the same
   `ExecutionContext` as a REST request, so RBAC, row-level security, and
   field-level security apply to the agent exactly as they do to a person in
-  the Console. Sparse results or denied writes usually mean governance is
-  *working*, not that the connection is broken.
+  the Console. Schema discovery is included: `describe_object`,
+  `list_objects`' `fieldCount` and the fields `validate_expression` puts in
+  scope name only the fields the caller can read, the same field set
+  `GET /api/v1/meta/object/:name` serves that caller. Sparse results or denied
+  writes usually mean governance is *working*, not that the connection is
+  broken.
 - **OAuth scopes narrow the toolset.** Tokens carry `data:read`,
   `data:write`, and `actions:execute` scopes — tools outside the granted
   scopes are not even registered for that session. API-key and session
 
@@ -30,13 +30,13 @@
     "@modelcontextprotocol/sdk": "^1.30.1",
     "@objectstack/core": "workspace:*",
     "@objectstack/formula": "workspace:*",
+    "@objectstack/metadata-core": "workspace:*",
     "@objectstack/spec": "workspace:*",
     "@objectstack/types": "workspace:*",
     "zod": "^4.6.6"
   },
   "devDependencies": {
     "@objectstack/lint": "workspace:*",
-    "@objectstack/metadata-core": "workspace:*",
     "@types/node": "^26.6.5",
     "typescript": "^6.0.3",
     "vitest": "^4.1.11"
 
@@ -877,6 +877,23 @@ export function setRuntimeObjectView(runtime: MCPServerRuntime, objects: McpObje
   runtimeObjectViews.set(runtime, objects);
 }
 
+/**
+ * [ADR-0106] A coded refusal an object view raised (a schema whose field
+ * visibility could not be evaluated, refused by the stdio host's caller view),
+ * in the `{ error, code, status }` vocabulary the object resources answer a
+ * miss and an outage with; `undefined` for a throw with no code. `details` is
+ * withheld, as on the data tools.
+ */
+function objectResourceRefusal(err: unknown): { error: string; code: string; status?: number } | undefined {
+  const envelope = thrownRefusalEnvelope(err);
+  if (!envelope) return undefined;
+  return {
+    error: envelope.message,
+    code: envelope.code,
+    ...(envelope.status !== undefined ? { status: envelope.status } : {}),
+  };
+}
+
 /**
  * [#6055] Resolve the `objectstack://objects/{objectName}` answer for one call.
  *
@@ -906,7 +923,18 @@ export async function buildObjectSchemaResource(
 
   // [#25245] The object from `objects` ({@link McpObjectView}); the verdict
   // on a miss is still the metadata service's.
-  const objectDef = await objects.getObject(objectName);
+  // [ADR-0106] A coded refusal from the view (the stdio host's caller view
+  // refuses a schema whose field visibility it could not evaluate) answers
+  // in this resource's `{ error, code, status }` vocabulary
+  // ({@link objectResourceRefusal}); an uncoded throw travels, as before.
+  let objectDef: unknown;
+  try {
+    objectDef = await objects.getObject(objectName);
+  } catch (err) {
+    const refusal = objectResourceRefusal(err);
+    if (refusal) return body(refusal);
+    throw err;
+  }
 
   if (!objectDef) {
     const { degraded, errors } = await diagnoseEmptyRead(metadataService, 'object', objectName);
@@ -997,7 +1025,17 @@ export async function buildObjectListResource(
 ): Promise<ObjectSchemaResourceResult> {
   // [#25245] The items from `view` ({@link McpObjectView}); the verdict below
   // is still the metadata service's.
-  const objects = await view.listObjects();
+  // [ADR-0106] …and a coded refusal from it answers as on the schema resource.
+  let objects: unknown[];
+  try {
+    objects = await view.listObjects();
+  } catch (err) {
+    const refusal = objectResourceRefusal(err);
+    if (!refusal) throw err;
+    return {
+      contents: [{ uri: 'objectstack://objects', mimeType: 'application/json', text: JSON.stringify(refusal) }],
+    };
+  }
   const summary = ((objects ?? []) as ObjectDef[]).map(o => ({
     name: o.name,
     label: o.label ?? o.name,
 
@@ -36,7 +36,9 @@ import { MCPServerRuntime, setRuntimeObjectView } from './mcp-server-runtime.js'
 import { PACKAGE_VERSION, DEFAULT_SERVER_VERSION } from './package-version.js';
 import type { MCPServerRuntimeConfig, McpMergedMetadataRead } from './mcp-server-runtime.js';
 import type { ToolRegistry } from './types.js';
+import type { ObjectSchemaMaskSecuritySurface } from '@objectstack/metadata-core';
 import {
+  callerObjectView,
   createStdioDataBridge,
   enforceApiExposure,
   GATED_ACTIONS,
@@ -458,6 +460,21 @@ export class MCPServerPlugin implements Plugin {
         return undefined;
       }
     };
+    // [ADR-0106] The `security` service the object-schema mask asks for the
+    // stdio principal's readable fields — resolved at each use, as the
+    // protocol is, and `undefined` on a host that registers none (no
+    // field-level posture there, so the schema is served as declared).
+    const securityReads = (): ObjectSchemaMaskSecuritySurface | undefined => {
+      try {
+        return ctx.getService<ObjectSchemaMaskSecuritySurface>('security') ?? undefined;
+      } catch {
+        return undefined;
+      }
+    };
+    // [ADR-0106 D1/D5] The stdio principal, once this transport has one: the
+    // object resources below serve their schemas to it through the same mask
+    // `list_objects` / `describe_object` do.
+    let schemaPrincipal: (() => Promise<ExecutionContext>) | undefined;
 
     // ── stdio auto-start decision (opt-in, its OWN switch) ──
     // Deliberately stricter than the HTTP-surface default (`isMcpServerEnabled`,
@@ -729,6 +746,7 @@ export class MCPServerPlugin implements Plugin {
           metadataService,
           protocol: protocolReads,
           resolvePrincipal,
+          security: securityReads,
           keyedDigest: storedHashDigest,
         });
       } else {
@@ -791,6 +809,7 @@ export class MCPServerPlugin implements Plugin {
           storedHashDigest(),
         );
       };
+      schemaPrincipal = resolvePrincipal;
       ctx.logger.info(
         `[MCP] stdio transport principal-bound to OS_MCP_STDIO_API_KEY identity ${initial.userId} (RLS/FLS/tenant applied)`,
       );
@@ -801,7 +820,17 @@ export class MCPServerPlugin implements Plugin {
       // `describe_object` answer from (`stdioObjectView`), never the metadata
       // service alone: on a kernel with an `environmentId` that service holds
       // no copy of an object a package registered during the boot.
-      setRuntimeObjectView(this.runtime, stdioObjectView({ metadataService, protocol: protocolReads }));
+      // [ADR-0106 D1/D5] …served to the stdio principal through the
+      // object-schema mask (`callerObjectView`), the view the tools read, so
+      // a resource never names a field the tools withhold. With no principal
+      // (this process starts no stdio transport) the view is the bare one.
+      const objectView = stdioObjectView({ metadataService, protocol: protocolReads });
+      setRuntimeObjectView(
+        this.runtime,
+        schemaPrincipal
+          ? callerObjectView(objectView, { resolvePrincipal: schemaPrincipal, security: securityReads })
+          : objectView,
+      );
       this.runtime.bridgeResources(metadataService, getRecord);
       // Awaited: the prompt bridge reads `skill` metadata to project each
       // skill's instructions onto an MCP prompt (#3905), so the surface must be