From eeb106e4b18a766e7278e221e842bbbc0ba1ad5e Mon Sep 17 00:00:00 2001
From: Paul Lizer <paullizer@microsoft.com>
Date: Wed, 7 Oct 2026 09:57:35 -0400
Subject: [PATCH 1/2] Overhaul action configuration panes

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 application/single_app/config.py              |   2 +-
 .../single_app/functions_global_actions.py    |   2 +
 .../single_app/functions_group_actions.py     |   2 +
 .../single_app/functions_mcp_operations.py    |  17 +
 .../single_app/functions_mcp_tool_pinning.py  | 334 +++++++++++++
 .../single_app/functions_notifications.py     |   4 +
 .../single_app/functions_personal_actions.py  |   2 +
 .../functions_workspace_authoring.py          |   3 +
 .../single_app/route_backend_plugins.py       | 123 +++--
 .../document_search_plugin.py                 | 233 ++++++++-
 .../semantic_kernel_plugins/mcp_plugin.py     |  22 +-
 .../mcp_plugin_factory.py                     |  86 ++++
 .../semantic_kernel_plugins/openapi_plugin.py |  69 ++-
 .../openapi_plugin_factory.py                 |  17 +-
 ...rch_plugin.additional_settings.schema.json |  31 ++
 ...mcp_plugin.additional_settings.schema.json |  38 ++
 ...api_plugin.additional_settings.schema.json |  35 ++
 .../workspaceActions/ActionAdvancedFields.tsx |  19 +-
 .../workspaceActions/ActionAuthentication.tsx |  33 ++
 .../ActionConfigurationFields.tsx             |  96 ++--
 .../ActionConnectionCheck.tsx                 | 155 ++++++
 .../workspaceActions/ActionSchemaFields.tsx   |  54 +--
 .../DocumentSearchActionConfiguration.tsx     | 448 ++++++++++++++++++
 .../McpActionConfiguration.tsx                | 172 ++++---
 .../OpenApiActionConfiguration.tsx            | 277 ++++++-----
 .../src/lib/workspaceActionConnectors.ts      | 121 ++++-
 .../v2_ui/src/lib/workspaceActionLogic.ts     |  35 +-
 .../v2_ui/src/lib/workspaceActionRegistry.ts  |  25 +
 .../v2_ui/src/lib/workspaceAuthoring.ts       |  10 +
 .../src/pages/workspace/ActionEditorPage.tsx  |  11 +-
 .../src/pages/workspace/ActionsSection.tsx    |   3 +
 .../src/pages/workspace/AgentsSection.tsx     |  16 +-
 .../ACTION_CONFIGURATION_PANE_CLEANUP.md      |  74 +++
 docs/explanation/release_notes.md             |  22 +
 .../actions/azure-maps-openlayers.md          |   7 +-
 docs/reference/actions/blob-storage.md        |   5 +-
 docs/reference/actions/databricks-table.md    |   5 +-
 docs/reference/actions/databricks.md          |  10 +-
 docs/reference/actions/document-search.md     |  19 +-
 docs/reference/actions/embedding-model.md     |   8 +-
 docs/reference/actions/index.md               |   4 +-
 docs/reference/actions/log-analytics.md       |   5 +-
 docs/reference/actions/m365-calendar.md       |   9 +
 docs/reference/actions/m365-email.md          |   9 +
 docs/reference/actions/m365-onedrive.md       |   9 +
 docs/reference/actions/m365-sharepoint.md     |   9 +
 docs/reference/actions/mcp.md                 |  26 +-
 docs/reference/actions/openapi.md             |  22 +-
 docs/reference/actions/queue-storage.md       |   5 +-
 docs/reference/actions/sql-query.md           |  20 +-
 docs/reference/actions/sql-schema.md          |  15 +-
 docs/reference/actions/yamcs.md               |   9 +-
 ...st_action_catalogue_dedupe_hidden_types.py |  72 +++
 ...ion_editor_configuration_cleanup_static.py |  65 +++
 ...ocument_search_action_scope_enforcement.py | 207 ++++++++
 .../test_mcp_tool_fingerprint_pinning.py      | 147 ++++++
 .../test_openapi_allowed_operations_filter.py | 147 ++++++
 57 files changed, 3010 insertions(+), 415 deletions(-)
 create mode 100644 application/single_app/functions_mcp_tool_pinning.py
 create mode 100644 application/single_app/static/json/schemas/openapi_plugin.additional_settings.schema.json
 create mode 100644 application/v2_ui/src/components/workspaceActions/ActionConnectionCheck.tsx
 create mode 100644 application/v2_ui/src/components/workspaceActions/DocumentSearchActionConfiguration.tsx
 create mode 100644 docs/explanation/features/ACTION_CONFIGURATION_PANE_CLEANUP.md
 create mode 100644 functional_tests/test_action_catalogue_dedupe_hidden_types.py
 create mode 100644 functional_tests/test_action_editor_configuration_cleanup_static.py
 create mode 100644 functional_tests/test_document_search_action_scope_enforcement.py
 create mode 100644 functional_tests/test_mcp_tool_fingerprint_pinning.py
 create mode 100644 functional_tests/test_openapi_allowed_operations_filter.py

diff --git a/application/single_app/config.py b/application/single_app/config.py
index 877179baf..e4efb1724 100644
--- a/application/single_app/config.py
+++ b/application/single_app/config.py
@@ -101,7 +101,7 @@
 EXECUTOR_TYPE = 'thread'
 EXECUTOR_MAX_WORKERS = 30
 SESSION_TYPE = 'filesystem'
-VERSION = "0.261.275"
+VERSION = "0.261.276"
 IS_DEVELOPMENT = is_development_env_enabled()
 
 # Opt-out for deployments where App Service Easy Auth is active but the platform
diff --git a/application/single_app/functions_global_actions.py b/application/single_app/functions_global_actions.py
index 9d3956100..33c2cc831 100644
--- a/application/single_app/functions_global_actions.py
+++ b/application/single_app/functions_global_actions.py
@@ -31,6 +31,7 @@
     validate_scoped_mcp_action,
 )
 from functions_settings import get_settings
+from functions_mcp_tool_pinning import validate_mcp_tool_pinning_for_save
 
 
 def _clean_action(action, return_type, action_id=None):
@@ -165,6 +166,7 @@ def save_global_action(action_data, user_id=None):
             existing_action = None
 
         validate_legacy_action_update(submitted_action, existing_action)
+        validate_mcp_tool_pinning_for_save(action_data, existing_action)
         legacy_type = is_legacy_msgraph_type(action_data.get('type'))
         if legacy_type:
             action_data['type'] = 'msgraph'
diff --git a/application/single_app/functions_group_actions.py b/application/single_app/functions_group_actions.py
index 3c3b267ca..2960c64e2 100644
--- a/application/single_app/functions_group_actions.py
+++ b/application/single_app/functions_group_actions.py
@@ -36,6 +36,7 @@
 )
 from functions_settings import get_settings
 from functions_agent_delegation import validate_agent_action_for_scope
+from functions_mcp_tool_pinning import validate_mcp_tool_pinning_for_save
 
 
 _NAME_PATTERN = re.compile(r"^[A-Za-z0-9_-]+$")
@@ -154,6 +155,7 @@ def save_group_action(group_id: str, action_data: Dict[str, Any], user_id: Optio
     except exceptions.CosmosResourceNotFoundError:
         pass
     validate_legacy_action_update(submitted_action, existing_action, 'group_id', group_id)
+    validate_mcp_tool_pinning_for_save(payload, existing_action)
     legacy_type = is_legacy_msgraph_type(payload.get('type'))
     if legacy_type:
         payload['type'] = 'msgraph'
diff --git a/application/single_app/functions_mcp_operations.py b/application/single_app/functions_mcp_operations.py
index 6c00cee87..992fe8548 100644
--- a/application/single_app/functions_mcp_operations.py
+++ b/application/single_app/functions_mcp_operations.py
@@ -8,6 +8,13 @@
 from jsonschema.exceptions import SchemaError
 
 from functions_action_manifest import McpConfigurationError, McpStdioRemovedError
+from functions_mcp_tool_pinning import (
+    MCP_PROMPTS_FIELD,
+    MCP_TOOL_DRIFT_FIELD,
+    MCP_TOOL_FINGERPRINTS_FIELD,
+    normalize_mcp_prompt_metadata,
+    normalize_mcp_tool_fingerprints,
+)
 
 
 MCP_PLUGIN_TYPE = "mcp"
@@ -601,6 +608,16 @@ def normalize_mcp_additional_fields(additional_fields):
         normalized_fields.get("allowed_tool_names")
     )
     normalized_fields["mcp_tools"] = normalize_mcp_tool_metadata(normalized_fields.get("mcp_tools"))
+    normalized_fields[MCP_PROMPTS_FIELD] = normalize_mcp_prompt_metadata(
+        normalized_fields.get(MCP_PROMPTS_FIELD)
+    )
+    fingerprints = normalize_mcp_tool_fingerprints(normalized_fields.get(MCP_TOOL_FINGERPRINTS_FIELD))
+    if fingerprints:
+        normalized_fields[MCP_TOOL_FINGERPRINTS_FIELD] = fingerprints
+    elif MCP_TOOL_FINGERPRINTS_FIELD in normalized_fields:
+        normalized_fields.pop(MCP_TOOL_FINGERPRINTS_FIELD, None)
+    if normalized_fields.get(MCP_TOOL_DRIFT_FIELD) is None:
+        normalized_fields.pop(MCP_TOOL_DRIFT_FIELD, None)
 
     for retired_field in ("command", "args", "env"):
         normalized_fields.pop(retired_field, None)
diff --git a/application/single_app/functions_mcp_tool_pinning.py b/application/single_app/functions_mcp_tool_pinning.py
new file mode 100644
index 000000000..b8828498c
--- /dev/null
+++ b/application/single_app/functions_mcp_tool_pinning.py
@@ -0,0 +1,334 @@
+# functions_mcp_tool_pinning.py
+"""MCP tool and prompt fingerprint helpers."""
+
+import hashlib
+import json
+import logging
+from datetime import datetime, timezone
+from typing import Any, Dict, Iterable, List, Optional, Tuple
+
+from functions_action_manifest import get_action_origin, resolve_action_type
+from functions_appinsights import log_event
+
+
+MCP_TOOL_FINGERPRINTS_FIELD = "mcp_tool_fingerprints"
+MCP_TOOL_DRIFT_FIELD = "mcp_tool_drift"
+MCP_PROMPTS_FIELD = "mcp_prompts"
+MCP_DRIFT_NOTIFICATION_TYPE = "mcp_tool_drift_detected"
+MCP_PLUGIN_TYPE = "mcp"
+
+
+def _canonical_hash(value: Any) -> str:
+    """Return the SHA-256 hash for stable canonical JSON."""
+    encoded = json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
+    return hashlib.sha256(encoded).hexdigest()
+
+
+def _tool_payload(tool: Dict[str, Any]) -> Dict[str, Any]:
+    return {
+        "name": str(tool.get("original_name") or tool.get("name") or "").strip(),
+        "description": str(tool.get("description") or "").strip(),
+        "inputSchema": tool.get("inputSchema") if isinstance(tool.get("inputSchema"), dict) else tool.get("input_schema") if isinstance(tool.get("input_schema"), dict) else {},
+        "outputSchema": tool.get("outputSchema") if isinstance(tool.get("outputSchema"), dict) else tool.get("output_schema") if isinstance(tool.get("output_schema"), dict) else {},
+        "annotations": tool.get("annotations") if isinstance(tool.get("annotations"), dict) else {},
+    }
+
+
+def normalize_mcp_prompt_metadata(value: Any) -> List[Dict[str, Any]]:
+    """Return normalized MCP prompt metadata entries."""
+    if not isinstance(value, list):
+        return []
+
+    prompts = []
+    seen_names = set()
+    for prompt in value:
+        if not isinstance(prompt, dict):
+            continue
+        name = str(prompt.get("name") or "").strip()
+        if not name or name in seen_names:
+            continue
+        seen_names.add(name)
+        arguments = prompt.get("arguments")
+        if not isinstance(arguments, list):
+            arguments = []
+        prompts.append({
+            "name": name,
+            "description": str(prompt.get("description") or "").strip(),
+            "arguments": [
+                argument for argument in arguments
+                if isinstance(argument, dict) and str(argument.get("name") or "").strip()
+            ],
+        })
+    return prompts
+
+
+def _normalize_mcp_tool_metadata(value: Any) -> List[Dict[str, Any]]:
+    from functions_mcp_operations import normalize_mcp_tool_metadata
+
+    return normalize_mcp_tool_metadata(value)
+
+
+def _prompt_payload(prompt: Dict[str, Any]) -> Dict[str, Any]:
+    return {
+        "name": str(prompt.get("name") or "").strip(),
+        "description": str(prompt.get("description") or "").strip(),
+        "arguments": prompt.get("arguments") if isinstance(prompt.get("arguments"), list) else [],
+    }
+
+
+def compute_mcp_tool_hash(tool: Dict[str, Any]) -> str:
+    """Compute a stable fingerprint for one MCP tool."""
+    return _canonical_hash(_tool_payload(tool))
+
+
+def compute_mcp_prompt_hash(prompt: Dict[str, Any]) -> str:
+    """Compute a stable fingerprint for one MCP prompt."""
+    return _canonical_hash(_prompt_payload(prompt))
+
+
+def build_mcp_tool_fingerprints(
+    tools: Iterable[Dict[str, Any]],
+    prompts: Optional[Iterable[Dict[str, Any]]] = None,
+    *,
+    discovered_at: Optional[str] = None,
+) -> Dict[str, Any]:
+    """Build the approved fingerprint manifest for discovered MCP tools and prompts."""
+    normalized_tools = _normalize_mcp_tool_metadata(list(tools or []))
+    normalized_prompts = normalize_mcp_prompt_metadata(list(prompts or []))
+    tool_hashes = {
+        tool["original_name"]: compute_mcp_tool_hash(tool)
+        for tool in normalized_tools
+        if tool.get("original_name")
+    }
+    prompt_hashes = {
+        prompt["name"]: compute_mcp_prompt_hash(prompt)
+        for prompt in normalized_prompts
+        if prompt.get("name")
+    }
+    manifest_hash = _canonical_hash({
+        "tools": tool_hashes,
+        "prompts": prompt_hashes,
+    })
+    return {
+        "manifest_hash": manifest_hash,
+        "tools": tool_hashes,
+        "prompts": prompt_hashes,
+        "discovered_at": discovered_at or datetime.now(timezone.utc).isoformat(),
+    }
+
+
+def normalize_mcp_tool_fingerprints(value: Any) -> Dict[str, Any]:
+    """Return a normalized approved fingerprint object, or an empty dict."""
+    if not isinstance(value, dict):
+        return {}
+    manifest_hash = str(value.get("manifest_hash") or "").strip()
+    tools = value.get("tools") if isinstance(value.get("tools"), dict) else {}
+    prompts = value.get("prompts") if isinstance(value.get("prompts"), dict) else {}
+    normalized = {
+        "manifest_hash": manifest_hash,
+        "tools": {
+            str(name): str(fingerprint)
+            for name, fingerprint in tools.items()
+            if str(name).strip() and str(fingerprint).strip()
+        },
+        "prompts": {
+            str(name): str(fingerprint)
+            for name, fingerprint in prompts.items()
+            if str(name).strip() and str(fingerprint).strip()
+        },
+        "discovered_at": str(value.get("discovered_at") or "").strip(),
+    }
+    return normalized if normalized["manifest_hash"] and normalized["discovered_at"] else {}
+
+
+def compare_mcp_fingerprints(
+    approved: Dict[str, Any],
+    current: Dict[str, Any],
+) -> Dict[str, Any]:
+    """Compare approved and current fingerprint manifests."""
+    approved = normalize_mcp_tool_fingerprints(approved)
+    current = normalize_mcp_tool_fingerprints(current)
+    approved_tools = approved.get("tools", {})
+    current_tools = current.get("tools", {})
+    approved_prompts = approved.get("prompts", {})
+    current_prompts = current.get("prompts", {})
+
+    def diff(before: Dict[str, str], after: Dict[str, str]) -> Dict[str, List[str]]:
+        before_names = set(before.keys())
+        after_names = set(after.keys())
+        return {
+            "new": sorted(after_names - before_names),
+            "changed": sorted(name for name in before_names & after_names if before[name] != after[name]),
+            "removed": sorted(before_names - after_names),
+        }
+
+    tool_diff = diff(approved_tools, current_tools)
+    prompt_diff = diff(approved_prompts, current_prompts)
+    return {
+        "manifest_hash": current.get("manifest_hash", ""),
+        "new": tool_diff["new"],
+        "changed": tool_diff["changed"],
+        "removed": tool_diff["removed"],
+        "prompts_new": prompt_diff["new"],
+        "prompts_changed": prompt_diff["changed"],
+        "prompts_removed": prompt_diff["removed"],
+        "has_drift": approved.get("manifest_hash") != current.get("manifest_hash"),
+    }
+
+
+def filter_pinned_mcp_tools(
+    tools: Iterable[Dict[str, Any]],
+    fingerprints: Dict[str, Any],
+) -> Tuple[List[Dict[str, Any]], Dict[str, Any]]:
+    """Return only tools matching approved fingerprints, plus drift metadata."""
+    normalized_tools = _normalize_mcp_tool_metadata(list(tools or []))
+    approved = normalize_mcp_tool_fingerprints(fingerprints)
+    approved_tools = approved.get("tools", {})
+    if not approved_tools:
+        return normalized_tools, {"has_drift": False, "new": [], "changed": [], "removed": []}
+    allowed = []
+    current_hashes = {}
+    for tool in normalized_tools:
+        name = tool.get("original_name")
+        if not name:
+            continue
+        current_hash = compute_mcp_tool_hash(tool)
+        current_hashes[name] = current_hash
+        if approved_tools.get(name) == current_hash:
+            allowed.append(tool)
+    current = build_mcp_tool_fingerprints(normalized_tools, [])
+    current["tools"] = current_hashes
+    current["manifest_hash"] = _canonical_hash({"tools": current_hashes, "prompts": approved.get("prompts", {})})
+    return allowed, compare_mcp_fingerprints(approved, current)
+
+
+def validate_mcp_tool_pinning_for_save(action: Dict[str, Any], existing_action: Optional[Dict[str, Any]] = None) -> None:
+    """Enforce MCP fingerprint approval for new or connection-changing saves."""
+    if not isinstance(action, dict) or resolve_action_type(action) != MCP_PLUGIN_TYPE:
+        return
+    fields = action.get("additionalFields") if isinstance(action.get("additionalFields"), dict) else {}
+    existing_fields = existing_action.get("additionalFields") if isinstance(existing_action, dict) and isinstance(existing_action.get("additionalFields"), dict) else {}
+    fingerprints = normalize_mcp_tool_fingerprints(fields.get(MCP_TOOL_FINGERPRINTS_FIELD))
+    existing_fingerprints = normalize_mcp_tool_fingerprints(existing_fields.get(MCP_TOOL_FINGERPRINTS_FIELD))
+    relevant_keys = (
+        "endpoint",
+        "identity_id",
+        "auth",
+        "server_profile",
+        "preconfiguration_id",
+        "transport",
+        "auth_method",
+        "api_key_header_name",
+        "custom_headers",
+        "load_tools",
+        "load_prompts",
+        "mcp_tools",
+        MCP_PROMPTS_FIELD,
+        "allowed_tool_names",
+    )
+
+    def relevant(source: Dict[str, Any], additional: Dict[str, Any]) -> Dict[str, Any]:
+        return {
+            "endpoint": source.get("endpoint"),
+            "identity_id": source.get("identity_id"),
+            "auth": source.get("auth"),
+            **{key: additional.get(key) for key in relevant_keys if key not in {"endpoint", "identity_id", "auth"}},
+        }
+
+    # Lazy import: functions_mcp_operations imports this module.
+    from functions_mcp_operations import normalize_mcp_additional_fields
+
+    changed = existing_action is None or (
+        relevant(action, normalize_mcp_additional_fields(fields))
+        != relevant(existing_action, normalize_mcp_additional_fields(existing_fields))
+    )
+    if existing_action is not None and not existing_fingerprints and not changed:
+        return
+    if not fingerprints and (existing_action is None or changed or existing_fingerprints):
+        raise ValueError("Discover and approve MCP tools before saving this action.")
+
+    current = build_mcp_tool_fingerprints(
+        _normalize_mcp_tool_metadata(fields.get("mcp_tools")),
+        normalize_mcp_prompt_metadata(fields.get(MCP_PROMPTS_FIELD)),
+        discovered_at=fingerprints.get("discovered_at"),
+    )
+    if fingerprints.get("tools") != current.get("tools") or fingerprints.get("prompts") != current.get("prompts"):
+        raise ValueError("MCP tool fingerprints do not match the approved discovery metadata.")
+    if fields.get(MCP_TOOL_DRIFT_FIELD) is None:
+        fields.pop(MCP_TOOL_DRIFT_FIELD, None)
+
+
+def persist_mcp_tool_drift(action: Dict[str, Any], drift: Dict[str, Any]) -> None:
+    """Persist MCP drift metadata and notify the owner when possible."""
+    if not isinstance(action, dict) or not drift.get("has_drift"):
+        return
+    origin = get_action_origin(action)
+    if origin is None:
+        return
+    manifest_hash = str(drift.get("manifest_hash") or "").strip()
+    if not manifest_hash:
+        return
+    detected_at = datetime.now(timezone.utc).isoformat()
+    drift_doc = {
+        "detected_at": detected_at,
+        "manifest_hash": manifest_hash,
+        "new": drift.get("new", []),
+        "changed": drift.get("changed", []),
+        "removed": drift.get("removed", []),
+        "prompts_new": drift.get("prompts_new", []),
+        "prompts_changed": drift.get("prompts_changed", []),
+        "prompts_removed": drift.get("prompts_removed", []),
+    }
+    try:
+        fields = action.setdefault("additionalFields", {})
+        fields[MCP_TOOL_DRIFT_FIELD] = drift_doc
+        if origin.scope_type == "personal":
+            from config import cosmos_personal_actions_container
+            stored = cosmos_personal_actions_container.read_item(item=origin.action_id, partition_key=origin.scope_id)
+            stored.setdefault("additionalFields", {})[MCP_TOOL_DRIFT_FIELD] = drift_doc
+            cosmos_personal_actions_container.replace_item(item=origin.action_id, body=stored)
+        elif origin.scope_type == "group":
+            from config import cosmos_group_actions_container
+            stored = cosmos_group_actions_container.read_item(item=origin.action_id, partition_key=origin.scope_id)
+            stored.setdefault("additionalFields", {})[MCP_TOOL_DRIFT_FIELD] = drift_doc
+            cosmos_group_actions_container.replace_item(item=origin.action_id, body=stored)
+        elif origin.scope_type == "global":
+            from config import cosmos_global_actions_container
+            stored = cosmos_global_actions_container.read_item(item=origin.action_id, partition_key=origin.action_id)
+            stored.setdefault("additionalFields", {})[MCP_TOOL_DRIFT_FIELD] = drift_doc
+            cosmos_global_actions_container.replace_item(item=origin.action_id, body=stored)
+    except Exception as exc:
+        log_event(
+            "[MCP_PINNING] Failed to persist MCP tool drift",
+            level=logging.WARNING,
+            extra={"scope_type": origin.scope_type, "action_id": origin.action_id, "error_type": type(exc).__name__},
+        )
+
+    try:
+        from functions_notifications import create_notification
+
+        notification_kwargs = {
+            "notification_type": MCP_DRIFT_NOTIFICATION_TYPE,
+            "title": "MCP tools changed — review required",
+            "message": "An MCP server changed its tool or prompt manifest. Review and re-approve the action before new or changed tools can run.",
+            "metadata": {
+                "action_id": origin.action_id,
+                "scope_type": origin.scope_type,
+                "scope_id": origin.scope_id,
+                "manifest_hash": manifest_hash,
+            },
+            "idempotency_key": f"mcp-tool-drift:{origin.scope_type}:{origin.scope_id}:{origin.action_id}:{manifest_hash}",
+        }
+        if origin.scope_type == "personal":
+            notification_kwargs["user_id"] = origin.scope_id
+        elif origin.scope_type == "group":
+            notification_kwargs["group_id"] = origin.scope_id
+        else:
+            notification_kwargs["assignment"] = {"roles": ["Admin", "ControlCenterAdmin"]}
+        create_notification(**notification_kwargs)
+    except Exception as exc:
+        log_event(
+            "[MCP_PINNING] Failed to deliver MCP tool drift notification",
+            level=logging.WARNING,
+            extra={"scope_type": origin.scope_type, "action_id": origin.action_id, "error_type": type(exc).__name__},
+        )
diff --git a/application/single_app/functions_notifications.py b/application/single_app/functions_notifications.py
index b01bf4ecb..cd13df387 100644
--- a/application/single_app/functions_notifications.py
+++ b/application/single_app/functions_notifications.py
@@ -234,6 +234,10 @@
         'icon': 'bi-trash',
         'color': 'secondary'
     },
+    'mcp_tool_drift_detected': {
+        'icon': 'bi-shield-exclamation',
+        'color': 'warning'
+    },
     'generated_file_approval_pending': {
         'icon': 'bi-file-earmark-lock',
         'color': 'warning'
diff --git a/application/single_app/functions_personal_actions.py b/application/single_app/functions_personal_actions.py
index 283eec1c5..8397d8f2f 100644
--- a/application/single_app/functions_personal_actions.py
+++ b/application/single_app/functions_personal_actions.py
@@ -48,6 +48,7 @@
     validate_action_configuration,
     validate_scoped_mcp_action,
 )
+from functions_mcp_tool_pinning import validate_mcp_tool_pinning_for_save
 from functions_workspace_identities import (
     WORKSPACE_IDENTITY_SCOPE_PERSONAL,
     hydrate_action_identity_reference,
@@ -250,6 +251,7 @@ def _save_personal_action(user_id, action_data, enforce_governance=True, migrati
         if action_data.get('id'):
             existing_action = _read_personal_action_record(user_id, action_data['id'])
         validate_legacy_action_update(submitted_action, existing_action, 'user_id', user_id)
+        validate_mcp_tool_pinning_for_save(action_data, existing_action)
         if legacy_type:
             action_data['type'] = 'msgraph'
         elif not action_data.get('id') and action_data.get('name'):
diff --git a/application/single_app/functions_workspace_authoring.py b/application/single_app/functions_workspace_authoring.py
index 62db0aa74..c9dd19a91 100644
--- a/application/single_app/functions_workspace_authoring.py
+++ b/application/single_app/functions_workspace_authoring.py
@@ -1892,6 +1892,9 @@ def build_action_editor_types(discovered_types):
             ),
             "allowed_auth_types": sorted(validation.get_allowed_auth_types_for_plugin_type(action_type)),
         }
+        for optional_field in ("hidden", "legacy", "capabilities", "defaults", "graph_endpoint"):
+            if optional_field in definition:
+                record[optional_field] = definition[optional_field]
         for field, suffix in (
             ("additional_fields_schema", "additional_settings"), ("metadata_schema", "metadata"),
         ):
diff --git a/application/single_app/route_backend_plugins.py b/application/single_app/route_backend_plugins.py
index c2681bf6d..4bf37615d 100644
--- a/application/single_app/route_backend_plugins.py
+++ b/application/single_app/route_backend_plugins.py
@@ -149,6 +149,10 @@
     get_mcp_error_http_status,
     normalize_mcp_additional_fields,
 )
+from functions_mcp_tool_pinning import (
+    build_mcp_tool_fingerprints,
+    validate_mcp_tool_pinning_for_save,
+)
 from functions_mcp_destinations import (
     McpDestinationPolicyError,
     assert_mcp_destination_allowed,
@@ -406,7 +410,7 @@ def discover_plugin_types(include_legacy=False):
                     isinstance(obj, type)
                     and issubclass(obj, BasePlugin)
                     and obj is not BasePlugin
-                    and (module_name.replace('_plugin', '') not in M365_PLUGIN_TYPES or obj.__module__ == module.__name__)
+                    and obj.__module__ == module.__name__
                     and not getattr(obj, 'internal_only', False)
                 ):
                     # Use the type string as in the manifest (e.g., 'blob_storage')
@@ -425,10 +429,37 @@ def discover_plugin_types(include_legacy=False):
                         types.add(module_name.replace('_plugin', ''))
     return types if include_legacy else {plugin_type for plugin_type in types if not is_legacy_msgraph_type(plugin_type)}
 
+HIDDEN_NEW_ACTION_PLUGIN_TYPES = {
+    DATABRICKS_LEGACY_TABLE_PLUGIN_TYPE,
+    'embedding_model',
+    'queue_storage',
+    'ui_test',
+    'sql_schema',
+}
+
+
+def _catalog_graph_endpoint():
+    return get_graph_base_url().removesuffix('/v1.0')
+
+
+def _catalog_entry(plugin_type, class_name, display, description, **extra):
+    entry = {
+        'type': plugin_type,
+        'class': class_name,
+        'display': display,
+        'description': description,
+    }
+    if plugin_type in HIDDEN_NEW_ACTION_PLUGIN_TYPES:
+        entry['hidden'] = True
+        entry['legacy'] = True
+    entry.update(extra)
+    return entry
+
+
 def get_plugin_types(allowed_type_filter=None):
     # Path to the plugin types directory (semantic_kernel_plugins)
     plugintypes_dir = os.path.join(current_app.root_path, 'semantic_kernel_plugins')
-    types = []
+    type_entries = {}
     debug_log = []
     for fname in os.listdir(plugintypes_dir):
         if fname.endswith('_plugin.py') and fname != 'base_plugin.py' and not fname.startswith('_'):
@@ -454,32 +485,36 @@ def get_plugin_types(allowed_type_filter=None):
                     isinstance(obj, type)
                     and issubclass(obj, BasePlugin)
                     and obj is not BasePlugin
-                    and (module_type not in M365_PLUGIN_TYPES or obj.__module__ == module.__name__)
+                    and obj.__module__ == module.__name__
                     and not getattr(obj, 'internal_only', False)
                 ):
                     found = True
+                    if module_type in type_entries:
+                        debug_log.append(f"Skipping duplicate plugin type entry: {module_type}")
+                        continue
                     if module_type in M365_PLUGIN_TYPES:
                         definition = get_m365_action_definition(module_type)
-                        types.append({
-                            'type': module_type,
-                            'class': definition['class_name'],
-                            'display': definition['display_name'],
-                            'description': definition['description'],
-                            'source': definition['source'],
-                            'capabilities': definition['capabilities'],
-                            'defaults': get_m365_default_config(module_type)['additionalFields'],
-                        })
+                        type_entries[module_type] = _catalog_entry(
+                            module_type,
+                            definition['class_name'],
+                            definition['display_name'],
+                            definition['description'],
+                            source=definition['source'],
+                            capabilities=definition['capabilities'],
+                            defaults=get_m365_default_config(module_type)['additionalFields'],
+                            graph_endpoint=_catalog_graph_endpoint(),
+                        )
                         continue
                     # Special handling for OpenAPI plugin that requires spec path
                     if 'openapi' in module_name.lower():
                         display_name = "OpenAPI"
                         description = "Connect to an API using OpenAPI JSON/YAML content and configurable authentication. Download hosted specifications before uploading them."
-                        types.append({
-                            'type': module_type,
-                            'class': attr,
-                            'display': display_name,
-                            'description': description
-                        })
+                        type_entries[module_type] = _catalog_entry(
+                            module_type,
+                            attr,
+                            display_name,
+                            description,
+                        )
                         continue
                     
                     # Try to get display name from plugin instance
@@ -688,15 +723,27 @@ def get_plugin_types(allowed_type_filter=None):
                         description = f"Plugin for {display_name.lower()} functionality"
                         debug_log.append(f"Complete failure to instantiate {attr}: {e}. Using final fallback.")
                     
-                    types.append({
-                        'type': module_type,
-                        'class': attr,
-                        'display': display_name,
-                        'description': description
-                    })
+                    if module_type == 'sql_query':
+                        display_name = 'SQL Database'
+                        description = (
+                            'Query a SQL database with governed read controls. '
+                            'Schema discovery is included automatically for agents that need table context.'
+                        )
+                    elif module_type == DATABRICKS_PLUGIN_TYPE:
+                        description = (
+                            'Run governed read-only SQL Warehouse queries against Azure Databricks, '
+                            'including catalog and schema defaults for agent context.'
+                        )
+                    elif module_type == DATABRICKS_LEGACY_TABLE_PLUGIN_TYPE:
+                        description = (
+                            'Legacy Databricks table action retained for existing configurations. '
+                            'Create new Databricks actions with the Databricks SQL Warehouse connector.'
+                        )
+                    type_entries[module_type] = _catalog_entry(module_type, attr, display_name, description)
             if not found:
                 debug_log.append(f"No valid plugin class found in {fname}")
     # Log the debug output to the server log
+    types = list(type_entries.values())
     if callable(allowed_type_filter):
         types = [plugin_type for plugin_type in types if allowed_type_filter(plugin_type.get('type'))]
 
@@ -1348,10 +1395,10 @@ def get_user_plugins():
 
 def _prepare_personal_action_for_editor(user_id, plugin, settings, existing):
     validate_legacy_action_update(plugin, existing, 'user_id', user_id)
-    return _prepare_personal_action_payload(user_id, plugin, editor=True)
+    return _prepare_personal_action_payload(user_id, plugin, editor=True, existing=existing)
 
 
-def _prepare_personal_action_payload(user_id, plugin, *, editor=False):
+def _prepare_personal_action_payload(user_id, plugin, *, editor=False, existing=None):
     """Clean, default and validate a single personal action.
 
     This is the per-action half of the bulk save, factored out so the per-item create and
@@ -1406,6 +1453,10 @@ def _prepare_personal_action_payload(user_id, plugin, *, editor=False):
     is_valid, validation_errors = PluginHealthChecker.validate_plugin_manifest(plugin_to_save, plugin_type)
     if not is_valid:
         return None, (jsonify({'error': f'Plugin validation failed: {"; ".join(validation_errors)}'}), 400)
+    try:
+        validate_mcp_tool_pinning_for_save(plugin_to_save, existing)
+    except ValueError:
+        return None, (jsonify({'error': 'Discover and approve MCP tools before saving this action.'}), 400)
 
     try:
         ensure_action_type_access('governance_user_actions', user_id, plugin_type, 'personal')
@@ -1477,6 +1528,10 @@ def _prepare_group_action_payload(user_id, group_id, plugin, settings, existing)
     is_valid, validation_errors = PluginHealthChecker.validate_plugin_manifest(plugin_to_save, plugin_type)
     if not is_valid:
         return None, (jsonify({'error': f'Plugin validation failed: {"; ".join(validation_errors)}'}), 400)
+    try:
+        validate_mcp_tool_pinning_for_save(plugin_to_save, existing)
+    except ValueError:
+        return None, (jsonify({'error': 'Discover and approve MCP tools before saving this action.'}), 400)
 
     try:
         ensure_action_type_access('governance_group_actions', user_id, plugin_type, 'group')
@@ -1554,6 +1609,10 @@ def _prepare_global_action_payload(user_id, plugin, settings, existing):
     is_valid, validation_errors = PluginHealthChecker.validate_plugin_manifest(plugin_to_save, plugin_type)
     if not is_valid:
         return None, (jsonify({'error': f'Plugin validation failed: {"; ".join(validation_errors)}'}), 400)
+    try:
+        validate_mcp_tool_pinning_for_save(plugin_to_save, existing)
+    except ValueError:
+        return None, (jsonify({'error': 'Discover and approve MCP tools before saving this action.'}), 400)
 
     try:
         _enforce_mcp_destination_policy(
@@ -1689,7 +1748,7 @@ def update_user_plugin(action_id):
     # body; that keeps a rename from orphaning the existing record.
     merged['id'] = existing.get('id')
 
-    plugin_to_save, error = _prepare_personal_action_payload(user_id, merged)
+    plugin_to_save, error = _prepare_personal_action_payload(user_id, merged, existing=existing)
     if error:
         return error
 
@@ -1805,7 +1864,8 @@ def set_user_plugins():
             and legacy_action is None
         ):
             continue  # Skip global plugins
-        plugin_to_save, error = _prepare_personal_action_payload(user_id, plugin)
+        existing_action = current_actions_by_id.get(submitted_id) if submitted_id else None
+        plugin_to_save, error = _prepare_personal_action_payload(user_id, plugin, existing=existing_action)
         if error:
             return error
 
@@ -2880,6 +2940,10 @@ def discover_mcp_tools():
 
         probe_result = asyncio.run(McpPluginFactory.probe_server_from_config(discovery_manifest, origin=origin))
         tools = probe_result.get('tools', []) if isinstance(probe_result, dict) else []
+        prompts = probe_result.get('prompts', []) if isinstance(probe_result, dict) else []
+        fingerprints = probe_result.get('fingerprints') if isinstance(probe_result, dict) else None
+        if not fingerprints:
+            fingerprints = build_mcp_tool_fingerprints(tools, prompts)
         log_event(
             "[MCP_DISCOVERY] Completed",
             extra=_build_mcp_discovery_log_context(
@@ -2903,6 +2967,9 @@ def discover_mcp_tools():
             'mcp_operation_id': mcp_operation_id,
             'tool_count': len(tools),
             'tools': tools,
+            'prompt_count': len(prompts),
+            'prompts': prompts,
+            'fingerprints': fingerprints,
             'capabilities': probe_result.get('capabilities', {}) if isinstance(probe_result, dict) else {},
             'warnings': probe_result.get('warnings', []) if isinstance(probe_result, dict) else [],
             'transport': probe_result.get('transport') if isinstance(probe_result, dict) else None,
diff --git a/application/single_app/semantic_kernel_plugins/document_search_plugin.py b/application/single_app/semantic_kernel_plugins/document_search_plugin.py
index cbdc5647a..f37012d80 100644
--- a/application/single_app/semantic_kernel_plugins/document_search_plugin.py
+++ b/application/single_app/semantic_kernel_plugins/document_search_plugin.py
@@ -1,13 +1,19 @@
 # document_search_plugin.py
 
-from typing import Annotated, Any, Dict
+from typing import Annotated, Any, Dict, List, Optional, Union
 
 from semantic_kernel.functions import kernel_function
 
 from content_screening.contracts import ScreeningError
 from functions_authentication import get_current_user_id
 from functions_agent_document_citations import annotate_document_search_payload
-from functions_search import SEARCH_DEFAULT_TOP_N, SEARCH_MAX_TOP_N, normalize_search_scope, normalize_search_top_n
+from functions_search import (
+    SEARCH_DEFAULT_TOP_N,
+    SEARCH_MAX_TOP_N,
+    normalize_search_id_list,
+    normalize_search_scope,
+    normalize_search_top_n,
+)
 from functions_search_service import (
     SUMMARY_DEFAULT_FINAL_TARGET,
     SUMMARY_DEFAULT_WINDOW_SUMMARY_TARGET,
@@ -20,6 +26,87 @@
 from semantic_kernel_plugins.plugin_invocation_logger import plugin_function_logger
 
 
+DOCUMENT_SEARCH_SCOPES = ("personal", "group", "public")
+WINDOW_TARGET_LENGTH_LIMITS = (1, 10)
+FINAL_TARGET_LENGTH_LIMITS = (1, 20)
+
+
+class DocumentSearchScopeError(ValueError):
+    """Raised when an action configuration disallows the requested document scope."""
+
+
+def normalize_allowed_search_scopes(additional_fields: Optional[Dict[str, Any]]) -> List[str]:
+    if not isinstance(additional_fields, dict) or "allowed_scopes" not in additional_fields:
+        return list(DOCUMENT_SEARCH_SCOPES)
+
+    raw_scopes = additional_fields.get("allowed_scopes")
+    if not isinstance(raw_scopes, list):
+        return list(DOCUMENT_SEARCH_SCOPES)
+
+    allowed_scopes = []
+    for raw_scope in raw_scopes:
+        scope = str(raw_scope or "").strip().lower()
+        if scope in DOCUMENT_SEARCH_SCOPES and scope not in allowed_scopes:
+            allowed_scopes.append(scope)
+    return allowed_scopes
+
+
+def resolve_allowed_scope_requests(requested_scope: str, allowed_scopes: List[str]) -> List[str]:
+    normalized_scope = normalize_search_scope(requested_scope)
+    allowed_scope_set = set(allowed_scopes)
+    if normalized_scope != "all":
+        return [normalized_scope] if normalized_scope in allowed_scope_set else []
+
+    if all(scope in allowed_scope_set for scope in DOCUMENT_SEARCH_SCOPES):
+        return ["all"]
+
+    return [scope for scope in DOCUMENT_SEARCH_SCOPES if scope in allowed_scope_set]
+
+
+def intersect_allowed_search_ids(runtime_ids: Any, allowed_ids: Any) -> Union[List[str], str]:
+    normalized_allowed_ids = normalize_search_id_list(allowed_ids)
+    if not normalized_allowed_ids:
+        return runtime_ids
+
+    normalized_runtime_ids = normalize_search_id_list(runtime_ids)
+    if not normalized_runtime_ids:
+        return normalized_allowed_ids
+
+    allowed_id_set = set(normalized_allowed_ids)
+    return [scope_id for scope_id in normalized_runtime_ids if scope_id in allowed_id_set]
+
+
+def parse_page_target_length(value: Any, min_pages: int, max_pages: int) -> Optional[int]:
+    text_value = str(value or "").strip().lower()
+    if not text_value:
+        return None
+
+    if text_value.endswith("page"):
+        text_value = text_value[:-4].strip()
+    elif text_value.endswith("pages"):
+        text_value = text_value[:-5].strip()
+
+    try:
+        pages = int(text_value)
+    except (TypeError, ValueError):
+        return None
+
+    if pages < min_pages:
+        return min_pages
+    return min(pages, max_pages)
+
+
+def normalize_summary_target_length(value: Any, fallback_value: str, min_pages: int, max_pages: int) -> str:
+    text_value = str(value or "").strip()
+    if not text_value:
+        text_value = fallback_value
+
+    parsed_pages = parse_page_target_length(text_value, min_pages, max_pages)
+    if parsed_pages is None:
+        return text_value
+    return f"{parsed_pages} pages"
+
+
 class DocumentSearchPlugin(BasePlugin):
     def __init__(self, manifest: Dict[str, Any] = None):
         super().__init__(manifest)
@@ -95,6 +182,14 @@ def _resolve_doc_scope(self, requested_scope: str) -> str:
 
         return normalize_search_scope(self._get_additional_fields().get('default_doc_scope', 'all'))
 
+    def _resolve_doc_scope_requests(self, requested_scope: str) -> List[str]:
+        scope = self._resolve_doc_scope(requested_scope)
+        allowed_scopes = normalize_allowed_search_scopes(self._get_additional_fields())
+        scope_requests = resolve_allowed_scope_requests(scope, allowed_scopes)
+        if not scope_requests:
+            raise DocumentSearchScopeError("Document search scope is not allowed for this action.")
+        return scope_requests
+
     def _resolve_top_n(self, requested_top_n: int) -> int:
         top_n_value = self._coerce_positive_int(requested_top_n)
         if top_n_value:
@@ -127,9 +222,107 @@ def _resolve_focus_instructions(self, requested_focus_instructions: str) -> str:
 
     def _resolve_target_length(self, requested_value: str, manifest_key: str, fallback_value: str) -> str:
         if str(requested_value or '').strip():
-            return requested_value
+            raw_value = requested_value
+        else:
+            raw_value = self._get_additional_fields().get(manifest_key, fallback_value)
+
+        if manifest_key == 'default_window_target_length':
+            return normalize_summary_target_length(
+                raw_value,
+                fallback_value,
+                WINDOW_TARGET_LENGTH_LIMITS[0],
+                WINDOW_TARGET_LENGTH_LIMITS[1],
+            )
+        if manifest_key == 'default_final_target_length':
+            return normalize_summary_target_length(
+                raw_value,
+                fallback_value,
+                FINAL_TARGET_LENGTH_LIMITS[0],
+                FINAL_TARGET_LENGTH_LIMITS[1],
+            )
+        return str(raw_value or fallback_value)
+
+    def _resolve_allowed_group_ids(self, active_group_ids: Any) -> Union[List[str], str]:
+        return intersect_allowed_search_ids(
+            active_group_ids,
+            self._get_additional_fields().get('allowed_group_ids'),
+        )
+
+    def _resolve_allowed_public_workspace_ids(self, active_public_workspace_id: Any) -> Union[List[str], str]:
+        return intersect_allowed_search_ids(
+            active_public_workspace_id,
+            self._get_additional_fields().get('allowed_public_workspace_ids'),
+        )
+
+    def _run_scope_limited_search(
+        self,
+        query,
+        user_id,
+        top_n,
+        scope_requests,
+        document_ids,
+        tags_filter,
+        active_group_ids,
+        active_public_workspace_id,
+    ):
+        if len(scope_requests) == 1:
+            return run_document_search(
+                query=query,
+                user_id=user_id,
+                top_n=top_n,
+                doc_scope=scope_requests[0],
+                document_ids=document_ids,
+                tags_filter=tags_filter,
+                active_group_ids=active_group_ids,
+                active_public_workspace_id=active_public_workspace_id,
+                include_all_public_workspaces=scope_requests[0] == "public",
+            )
+
+        merged_results = []
+        for scope in scope_requests:
+            scoped_payload = run_document_search(
+                query=query,
+                user_id=user_id,
+                top_n=top_n,
+                doc_scope=scope,
+                document_ids=document_ids,
+                tags_filter=tags_filter,
+                active_group_ids=active_group_ids,
+                active_public_workspace_id=active_public_workspace_id,
+                include_all_public_workspaces=scope == "public",
+            )
+            merged_results.extend(scoped_payload.get("results", []))
+
+        merged_results = merged_results[:top_n]
+        unique_document_ids = {
+            result.get("document_id")
+            for result in merged_results
+            if result.get("document_id")
+        }
+        return {
+            "query": query,
+            "scope": "all",
+            "allowed_scopes": scope_requests,
+            "top_n": top_n,
+            "document_ids": normalize_search_id_list(document_ids),
+            "tags_filter": normalize_search_id_list(tags_filter),
+            "group_ids": normalize_search_id_list(active_group_ids),
+            "active_public_workspace_id": active_public_workspace_id,
+            "result_count": len(merged_results),
+            "document_count": len(unique_document_ids),
+            "results": merged_results,
+        }
 
-        return self._get_additional_fields().get(manifest_key, fallback_value)
+    def _call_scope_limited_document_operation(self, operation, scope_requests, **kwargs):
+        last_lookup_error = None
+        for scope in scope_requests:
+            try:
+                return operation(doc_scope=scope, **kwargs)
+            except LookupError as error:
+                last_lookup_error = error
+        if last_lookup_error:
+            raise last_lookup_error
+        raise DocumentSearchScopeError("Document search scope is not allowed for this action.")
 
     # bac-check: ignore - run_document_search resolves requested workspace ids through current-user scope resolvers.
     @plugin_function_logger('DocumentSearchPlugin')
@@ -152,20 +345,22 @@ def search_documents(
     ) -> Annotated[dict, 'Search results and request metadata.']:
         try:
             return annotate_document_search_payload(
-                run_document_search(
+                self._run_scope_limited_search(
                     query=query,
                     user_id=self._get_user_id(),
                     top_n=self._resolve_top_n(top_n),
-                    doc_scope=self._resolve_doc_scope(doc_scope),
+                    scope_requests=self._resolve_doc_scope_requests(doc_scope),
                     document_ids=document_ids,
                     tags_filter=tags_filter,
-                    active_group_ids=active_group_ids,
-                    active_public_workspace_id=active_public_workspace_id,
+                    active_group_ids=self._resolve_allowed_group_ids(active_group_ids),
+                    active_public_workspace_id=self._resolve_allowed_public_workspace_ids(active_public_workspace_id),
                 ),
                 'search_documents',
             )
         except ScreeningError as error:
             return {"error": error.public_message, "error_code": error.code, "status_code": error.status_code}
+        except DocumentSearchScopeError as error:
+            return {'error': str(error)}
         except Exception as e:
             return {'error': str(e)}
 
@@ -191,12 +386,13 @@ def retrieve_document_chunks(
     ) -> Annotated[dict, 'Ordered chunks and window metadata for one document.']:
         try:
             return annotate_document_search_payload(
-                get_document_chunks_payload(
+                self._call_scope_limited_document_operation(
+                    get_document_chunks_payload,
+                    self._resolve_doc_scope_requests(doc_scope),
                     document_id=document_id,
                     user_id=self._get_user_id(),
-                    doc_scope=self._resolve_doc_scope(doc_scope),
-                    active_group_ids=active_group_ids,
-                    active_public_workspace_id=active_public_workspace_id,
+                    active_group_ids=self._resolve_allowed_group_ids(active_group_ids),
+                    active_public_workspace_id=self._resolve_allowed_public_workspace_ids(active_public_workspace_id),
                     window_unit=self._resolve_window_unit(window_unit),
                     window_size=self._resolve_optional_window_value(window_size, 'default_window_size'),
                     window_percent=self._resolve_optional_window_value(window_percent, 'default_window_percent'),
@@ -206,6 +402,8 @@ def retrieve_document_chunks(
             )
         except ScreeningError as error:
             return {"error": error.public_message, "error_code": error.code, "status_code": error.status_code}
+        except DocumentSearchScopeError as error:
+            return {'error': str(error)}
         except Exception as e:
             return {'error': str(e)}
 
@@ -233,12 +431,13 @@ def summarize_document(
     ) -> Annotated[dict, 'Final summary text plus stage and window metadata.']:
         try:
             return annotate_document_search_payload(
-                summarize_document_content(
+                self._call_scope_limited_document_operation(
+                    summarize_document_content,
+                    self._resolve_doc_scope_requests(doc_scope),
                     document_id=document_id,
                     user_id=self._get_user_id(),
-                    doc_scope=self._resolve_doc_scope(doc_scope),
-                    active_group_ids=active_group_ids,
-                    active_public_workspace_id=active_public_workspace_id,
+                    active_group_ids=self._resolve_allowed_group_ids(active_group_ids),
+                    active_public_workspace_id=self._resolve_allowed_public_workspace_ids(active_public_workspace_id),
                     focus_instructions=self._resolve_focus_instructions(focus_instructions),
                     final_target_length=self._resolve_target_length(final_target_length, 'default_final_target_length', SUMMARY_DEFAULT_FINAL_TARGET),
                     window_target_length=self._resolve_target_length(window_target_length, 'default_window_target_length', SUMMARY_DEFAULT_WINDOW_SUMMARY_TARGET),
@@ -250,5 +449,7 @@ def summarize_document(
             )
         except ScreeningError as error:
             return {"error": error.public_message, "error_code": error.code, "status_code": error.status_code}
+        except DocumentSearchScopeError as error:
+            return {'error': str(error)}
         except Exception as e:
             return {'error': str(e)}
\ No newline at end of file
diff --git a/application/single_app/semantic_kernel_plugins/mcp_plugin.py b/application/single_app/semantic_kernel_plugins/mcp_plugin.py
index be6143e8c..cff6a3860 100644
--- a/application/single_app/semantic_kernel_plugins/mcp_plugin.py
+++ b/application/single_app/semantic_kernel_plugins/mcp_plugin.py
@@ -25,6 +25,11 @@
     normalize_mcp_tool_call_arguments,
     validate_mcp_tool_arguments,
 )
+from functions_mcp_tool_pinning import (
+    MCP_TOOL_FINGERPRINTS_FIELD,
+    filter_pinned_mcp_tools,
+    normalize_mcp_tool_fingerprints,
+)
 from semantic_kernel_plugins.base_plugin import BasePlugin
 from semantic_kernel_plugins.plugin_invocation_logger import plugin_function_logger
 
@@ -43,9 +48,12 @@ def __init__(
         self.manifest["type"] = MCP_PLUGIN_TYPE
         self.manifest["additionalFields"] = self._additional_fields
         self._allowed_tool_names = set(self._additional_fields.get("allowed_tool_names") or [])
-        self._tools = self._filter_tools(
-            normalize_mcp_tool_metadata(self._additional_fields.get("mcp_tools", []))
+        self._fingerprints = normalize_mcp_tool_fingerprints(
+            self._additional_fields.get(MCP_TOOL_FINGERPRINTS_FIELD)
         )
+        self._tools = self._filter_tools(self._approved_tools(
+            normalize_mcp_tool_metadata(self._additional_fields.get("mcp_tools", []))
+        ))
 
     def _validate_manifest(self):
         if not isinstance(self.manifest, dict) or resolve_action_type(self.manifest) != MCP_PLUGIN_TYPE:
@@ -66,6 +74,15 @@ def _filter_tools(self, tools: List[Dict[str, Any]]) -> List[Dict[str, Any]]:
             or tool.get("function_name") in self._allowed_tool_names
         ]
 
+    def _approved_tools(self, tools: List[Dict[str, Any]]) -> List[Dict[str, Any]]:
+        approved_tools, drift = filter_pinned_mcp_tools(tools, self._fingerprints)
+        if drift.get("has_drift"):
+            debug_print(
+                "[MCP_PLUGIN] Cached MCP tool metadata does not match approved fingerprints; "
+                f"changed={drift.get('changed')} new={drift.get('new')} removed={drift.get('removed')}"
+            )
+        return approved_tools
+
     @property
     def display_name(self) -> str:
         return "Model Context Protocol"
@@ -150,6 +167,7 @@ def list_configured_tools(self) -> dict:
             "success": True,
             "transport": self._additional_fields.get("transport"),
             "allowed_tool_names": sorted(self._allowed_tool_names),
+            "fingerprint_manifest_hash": self._fingerprints.get("manifest_hash"),
             "tool_count": len(self._tools),
             "tools": self._tools,
         }
diff --git a/application/single_app/semantic_kernel_plugins/mcp_plugin_factory.py b/application/single_app/semantic_kernel_plugins/mcp_plugin_factory.py
index eb826a114..9b6c526af 100644
--- a/application/single_app/semantic_kernel_plugins/mcp_plugin_factory.py
+++ b/application/single_app/semantic_kernel_plugins/mcp_plugin_factory.py
@@ -37,6 +37,14 @@
     normalize_mcp_tool_metadata,
     validate_mcp_endpoint_for_transport,
 )
+from functions_mcp_tool_pinning import (
+    MCP_TOOL_FINGERPRINTS_FIELD,
+    build_mcp_tool_fingerprints,
+    compare_mcp_fingerprints,
+    normalize_mcp_prompt_metadata,
+    normalize_mcp_tool_fingerprints,
+    persist_mcp_tool_drift,
+)
 from functions_mcp_destinations import (
     McpDestinationPolicyError,
     build_mcp_destination_log_context,
@@ -172,19 +180,27 @@ async def _probe_server_once(cls, config: Dict[str, Any], *, origin=None) -> Dic
                 raise ValueError("MCP server did not create a session.")
 
             tools = await cls._list_tools_from_session(connector.session)
+            prompts, prompt_warning = await cls._list_prompts_from_session(connector.session)
             capabilities = {
                 "tools": bool(tools),
+                "prompts": bool(prompts),
                 "prompts_requested": bool(additional_fields.get("load_prompts")),
                 "resources": False,
                 "connector_type": connector.__class__.__name__,
                 "session_type": connector.session.__class__.__name__,
             }
             warnings = build_mcp_tool_metadata_warnings(tools, additional_fields)
+            if prompt_warning:
+                warnings.append(prompt_warning)
+            fingerprints = build_mcp_tool_fingerprints(tools, prompts)
             result = {
                 "transport": additional_fields.get("transport"),
                 "auth_method": additional_fields.get("auth_method"),
                 "tool_count": len(tools),
                 "tools": tools,
+                "prompt_count": len(prompts),
+                "prompts": prompts,
+                "fingerprints": fingerprints,
                 "capabilities": capabilities,
                 "warnings": warnings,
             }
@@ -279,6 +295,34 @@ async def _list_tools_from_session(cls, session) -> List[Dict[str, Any]]:
             })
         return normalize_mcp_tool_metadata(raw_tools)
 
+    @classmethod
+    async def _list_prompts_from_session(cls, session) -> tuple[List[Dict[str, Any]], str]:
+        list_prompts = getattr(session, "list_prompts", None)
+        if not callable(list_prompts):
+            return [], "This MCP client does not support prompt discovery; prompt fingerprints are empty."
+        try:
+            prompt_list = await list_prompts()
+        except AttributeError:
+            return [], "This MCP client does not support prompt discovery; prompt fingerprints are empty."
+        except NotImplementedError:
+            return [], "This MCP client does not support prompt discovery; prompt fingerprints are empty."
+        prompts = []
+        for prompt in getattr(prompt_list, "prompts", []) if prompt_list else []:
+            raw_arguments = getattr(prompt, "arguments", None) or []
+            arguments = []
+            for argument in raw_arguments:
+                arguments.append({
+                    "name": getattr(argument, "name", ""),
+                    "description": getattr(argument, "description", "") or "",
+                    "required": bool(getattr(argument, "required", False)),
+                })
+            prompts.append({
+                "name": getattr(prompt, "name", ""),
+                "description": getattr(prompt, "description", "") or "",
+                "arguments": arguments,
+            })
+        return normalize_mcp_prompt_metadata(prompts), ""
+
     @classmethod
     async def call_tool_from_config(
         cls,
@@ -291,6 +335,7 @@ async def call_tool_from_config(
         """Connect to an MCP server, invoke one tool, and normalize the result."""
         manifest = cls._normalize_manifest(config)
         configured_tool = cls._find_configured_tool(manifest, tool_name)
+        await cls._enforce_pinned_manifest(manifest, origin=origin)
         normalized_arguments = (
             normalize_mcp_tool_call_arguments(configured_tool, arguments)
             if configured_tool
@@ -302,6 +347,47 @@ async def call_tool_from_config(
             lambda: cls._call_tool_once(manifest, tool_name, normalized_arguments, origin=origin),
         )
 
+    @classmethod
+    async def _enforce_pinned_manifest(
+        cls, config: Dict[str, Any], *, origin: Optional[McpActionOrigin] = None
+    ) -> None:
+        manifest = cls._normalize_manifest(config)
+        additional_fields = manifest.get("additionalFields", {})
+        approved = normalize_mcp_tool_fingerprints(additional_fields.get(MCP_TOOL_FINGERPRINTS_FIELD))
+        if not approved:
+            return
+        connector = cls.create_connector(manifest, origin=origin)
+        try:
+            await connector.connect()
+            if not connector.session:
+                raise ValueError("MCP server did not create a session.")
+            tools = await cls._list_tools_from_session(connector.session)
+            prompts, _ = await cls._list_prompts_from_session(connector.session)
+            current = build_mcp_tool_fingerprints(tools, prompts)
+            drift = compare_mcp_fingerprints(approved, current)
+            if drift.get("has_drift"):
+                persist_mcp_tool_drift(manifest, drift)
+                log_event(
+                    "[MCP_PINNING] MCP tool manifest drift detected",
+                    level=logging.WARNING,
+                    extra={
+                        **cls._build_operation_log_context(manifest, "pinning_check"),
+                        "manifest_hash": current.get("manifest_hash"),
+                        "new_count": len(drift.get("new", [])),
+                        "changed_count": len(drift.get("changed", [])),
+                        "removed_count": len(drift.get("removed", [])),
+                        "prompt_changed_count": len(drift.get("prompts_changed", [])),
+                    },
+                )
+                raise McpRuntimeError(
+                    "MCP tools changed after approval. Review and re-approve the action.",
+                    category="tool_pinning",
+                    operation="pinning_check",
+                    retryable=False,
+                )
+        finally:
+            await connector.close()
+
     @classmethod
     def _find_configured_tool(cls, config: Dict[str, Any], tool_name: str) -> Optional[Dict[str, Any]]:
         """Return cached MCP tool metadata for a factory invocation."""
diff --git a/application/single_app/semantic_kernel_plugins/openapi_plugin.py b/application/single_app/semantic_kernel_plugins/openapi_plugin.py
index 30c0e8de7..401e55d16 100644
--- a/application/single_app/semantic_kernel_plugins/openapi_plugin.py
+++ b/application/single_app/semantic_kernel_plugins/openapi_plugin.py
@@ -165,7 +165,8 @@ def __init__(self,
                  auth: Optional[Dict[str, Any]] = None,
                  manifest: Optional[Dict[str, Any]] = None,
                  openapi_spec_path: Optional[str] = None,
-                 openapi_spec_content: Optional[Dict[str, Any]] = None):
+                 openapi_spec_content: Optional[Dict[str, Any]] = None,
+                 allowed_operations: Optional[List[str]] = None):
         """
         Initialize the OpenAPI plugin with user-provided configuration.
         
@@ -175,6 +176,8 @@ def __init__(self,
             manifest: Additional manifest configuration
             openapi_spec_path: Path to the OpenAPI specification file (YAML or JSON) - DEPRECATED
             openapi_spec_content: OpenAPI specification content as parsed dict (preferred)
+            allowed_operations: Optional list of operation IDs/function names to expose.
+                Missing or empty lists allow every operation for backward compatibility.
         """
         import logging
         logging.info(f"[OPEN_API_PLUGIN] Initializing plugin with base_url: {base_url}")
@@ -189,6 +192,11 @@ def __init__(self,
         self.base_url = base_url.rstrip('/')  # Remove trailing slash
         self.auth = auth or {}
         self.manifest = manifest or {}
+        self.allowed_operations = {
+            str(operation).strip()
+            for operation in (allowed_operations or [])
+            if str(operation).strip()
+        }
         
         # Track function calls for citations
         self.function_calls = []
@@ -209,6 +217,22 @@ def __init__(self,
             import traceback
             logging.error(f"[OPEN_API_PLUGIN] Traceback: {traceback.format_exc()}")
             raise
+
+    def _operation_function_name(self, method: str, path: str, operation: Dict[str, Any]) -> str:
+        """Return the function name used for an OpenAPI operation."""
+        operation_id = operation.get("operationId")
+        if operation_id:
+            return operation_id
+        return f"{method}_{path.replace('/', '_').replace('{', '').replace('}', '')}"
+
+    def _is_operation_allowed(self, operation_id: str) -> bool:
+        """Return whether an operation is enabled for this plugin."""
+        return not self.allowed_operations or operation_id in self.allowed_operations
+
+    def _reject_disallowed_operation(self, operation_id: str) -> None:
+        """Raise a stable error when an operation is present but disabled."""
+        if not self._is_operation_allowed(operation_id):
+            raise PermissionError(f"OpenAPI operation '{operation_id}' is not enabled for this action.")
     
     def _load_openapi_spec(self) -> Dict[str, Any]:
         """Load OpenAPI specification from content or file."""
@@ -298,7 +322,11 @@ def _generate_metadata(self) -> Dict[str, Any]:
         methods = []
         for path, ops in paths.items():
             for method, op in ops.items():
-                op_id = op.get("operationId", f"{method}_{path.replace('/', '_')}")
+                if not isinstance(op, dict):
+                    continue
+                op_id = self._operation_function_name(method, path, op)
+                if not self._is_operation_allowed(op_id):
+                    continue
                 description = op.get("description", "")
                 parameters = []
                 # Path/query parameters - resolve $ref references first
@@ -435,10 +463,10 @@ def _create_operation_functions(self):
                 if not isinstance(operation, dict):
                     continue
                     
-                operation_id = operation.get("operationId")
-                if not operation_id:
-                    # Generate operation ID if not provided
-                    operation_id = f"{method}_{path.replace('/', '_').replace('{', '').replace('}', '')}"
+                operation_id = self._operation_function_name(method, path, operation)
+                if not self._is_operation_allowed(operation_id):
+                    logging.info(f"[OPEN_API_PLUGIN] Skipping disabled operation: {operation_id}")
+                    continue
                 
                 logging.info(f"[OPEN_API_PLUGIN] Creating function: {operation_id} for {method.upper()} {path}")
                 
@@ -805,6 +833,8 @@ def _call_api_operation(self, operation_id: str, path: str, method: str, operati
         import logging
         import datetime
         import time
+
+        self._reject_disallowed_operation(operation_id)
         
         # Log the function call
         logging.info(f"[OPEN_API_PLUGIN] Calling operation: {operation_id} ({method.upper()} {path})")
@@ -1292,19 +1322,28 @@ def call_operation(self, operation_id: str, **kwargs) -> Any:
         # Try exact match first
         for path, ops in self.openapi.get("paths", {}).items():
             for method, op in ops.items():
-                if op.get("operationId") == operation_id:
+                if not isinstance(op, dict):
+                    continue
+                candidate_operation_id = self._operation_function_name(method, path, op)
+                if candidate_operation_id == operation_id:
+                    self._reject_disallowed_operation(candidate_operation_id)
                     operation_found = True
                     operation_data = op
                     operation_path = path
                     operation_method = method
+                    operation_id = candidate_operation_id
                     break
             if operation_found:
                 break
         
         # If not found, try common operation name variations
         if not operation_found:
-            available_ops = [op.get("operationId") for path_ops in self.openapi.get("paths", {}).values() 
-                           for op in path_ops.values() if op.get("operationId")]
+            available_ops = [
+                self._operation_function_name(method, path, op)
+                for path, path_ops in self.openapi.get("paths", {}).items()
+                for method, op in path_ops.items()
+                if isinstance(op, dict) and self._is_operation_allowed(self._operation_function_name(method, path, op))
+            ]
             
             # Try removing common prefixes/suffixes
             variations = [
@@ -1328,7 +1367,9 @@ def call_operation(self, operation_id: str, **kwargs) -> Any:
                         # Find the matched operation
                         for path, ops in self.openapi.get("paths", {}).items():
                             for method, op in ops.items():
-                                if op.get("operationId") == available_op:
+                                if not isinstance(op, dict):
+                                    continue
+                                if self._operation_function_name(method, path, op) == available_op:
                                     operation_found = True
                                     operation_data = op
                                     operation_path = path
@@ -1343,8 +1384,12 @@ def call_operation(self, operation_id: str, **kwargs) -> Any:
         if not operation_found:
             error_msg = f"Operation '{operation_id}' not found in OpenAPI specification"
             logging.error(f"[OPEN_API_PLUGIN] {error_msg}")
-            available_ops = [op.get("operationId") for path_ops in self.openapi.get("paths", {}).values() 
-                           for op in path_ops.values() if op.get("operationId")]
+            available_ops = [
+                self._operation_function_name(method, path, op)
+                for path, path_ops in self.openapi.get("paths", {}).items()
+                for method, op in path_ops.items()
+                if isinstance(op, dict) and self._is_operation_allowed(self._operation_function_name(method, path, op))
+            ]
             logging.error(f"[OPEN_API_PLUGIN] Available operations: {available_ops}")
             raise ValueError(error_msg)
         
diff --git a/application/single_app/semantic_kernel_plugins/openapi_plugin_factory.py b/application/single_app/semantic_kernel_plugins/openapi_plugin_factory.py
index 28ddce8b8..089a17e3a 100644
--- a/application/single_app/semantic_kernel_plugins/openapi_plugin_factory.py
+++ b/application/single_app/semantic_kernel_plugins/openapi_plugin_factory.py
@@ -45,14 +45,24 @@ def create_from_config(cls, config: Dict[str, Any]) -> OpenApiPlugin:
         openapi_spec_content = config.get('openapi_spec_content')
         
         # Also check in additionalFields for compatibility
+        additional_fields = config.get('additionalFields', {})
         if not openapi_spec_content and 'additionalFields' in config:
-            openapi_spec_content = config['additionalFields'].get('openapi_spec_content')
+            openapi_spec_content = additional_fields.get('openapi_spec_content')
+
+        allowed_operations = config.get('allowed_operations')
+        if allowed_operations is None:
+            allowed_operations = additional_fields.get('allowed_operations')
+        if allowed_operations is None:
+            allowed_operations = []
+        elif not isinstance(allowed_operations, list):
+            raise ValueError("allowed_operations must be a list of operation IDs")
         
         if openapi_spec_content:
             return OpenApiPlugin(
                 base_url=base_url,
                 auth=auth,
-                openapi_spec_content=openapi_spec_content
+                openapi_spec_content=openapi_spec_content,
+                allowed_operations=allowed_operations,
             )
         
         # Fall back to legacy file-based approach for backward compatibility
@@ -71,7 +81,8 @@ def create_from_config(cls, config: Dict[str, Any]) -> OpenApiPlugin:
         return OpenApiPlugin(
             base_url=base_url,
             auth=auth,
-            openapi_spec_path=openapi_spec_path
+            openapi_spec_path=openapi_spec_path,
+            allowed_operations=allowed_operations,
         )
     
     @classmethod
diff --git a/application/single_app/static/json/schemas/document_search_plugin.additional_settings.schema.json b/application/single_app/static/json/schemas/document_search_plugin.additional_settings.schema.json
index a8c8a3384..8b8431878 100644
--- a/application/single_app/static/json/schemas/document_search_plugin.additional_settings.schema.json
+++ b/application/single_app/static/json/schemas/document_search_plugin.additional_settings.schema.json
@@ -13,6 +13,37 @@
       ],
       "default": "all"
     },
+    "allowed_scopes": {
+      "type": "array",
+      "items": {
+        "type": "string",
+        "enum": [
+          "personal",
+          "group",
+          "public"
+        ]
+      },
+      "uniqueItems": true,
+      "default": [
+        "personal",
+        "group",
+        "public"
+      ]
+    },
+    "allowed_group_ids": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      },
+      "default": []
+    },
+    "allowed_public_workspace_ids": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      },
+      "default": []
+    },
     "default_top_n": {
       "type": "integer",
       "minimum": 1,
diff --git a/application/single_app/static/json/schemas/mcp_plugin.additional_settings.schema.json b/application/single_app/static/json/schemas/mcp_plugin.additional_settings.schema.json
index f6b244d39..2cf84996c 100644
--- a/application/single_app/static/json/schemas/mcp_plugin.additional_settings.schema.json
+++ b/application/single_app/static/json/schemas/mcp_plugin.additional_settings.schema.json
@@ -140,6 +140,44 @@
         "additionalProperties": true
       },
       "description": "Cached MCP tool metadata from discovery."
+    },
+    "mcp_prompts": {
+      "type": "array",
+      "default": [],
+      "items": {
+        "type": "object",
+        "properties": {
+          "name": {"type": "string"},
+          "description": {"type": "string"},
+          "arguments": {"type": "array"}
+        },
+        "required": ["name"],
+        "additionalProperties": true
+      },
+      "description": "Cached MCP prompt metadata from discovery."
+    },
+    "mcp_tool_fingerprints": {
+      "type": "object",
+      "properties": {
+        "manifest_hash": {"type": "string"},
+        "tools": {
+          "type": "object",
+          "additionalProperties": {"type": "string"}
+        },
+        "prompts": {
+          "type": "object",
+          "additionalProperties": {"type": "string"}
+        },
+        "discovered_at": {"type": "string"}
+      },
+      "required": ["manifest_hash", "tools", "prompts", "discovered_at"],
+      "additionalProperties": true,
+      "description": "Approved MCP tool and prompt fingerprints captured at discovery time."
+    },
+    "mcp_tool_drift": {
+      "type": ["object", "null"],
+      "additionalProperties": true,
+      "description": "Server-recorded MCP tool or prompt drift metadata that requires review."
     }
   },
   "required": ["server_profile", "transport", "auth_method"],
diff --git a/application/single_app/static/json/schemas/openapi_plugin.additional_settings.schema.json b/application/single_app/static/json/schemas/openapi_plugin.additional_settings.schema.json
new file mode 100644
index 000000000..dea957a96
--- /dev/null
+++ b/application/single_app/static/json/schemas/openapi_plugin.additional_settings.schema.json
@@ -0,0 +1,35 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "OpenAPI plugin additional settings",
+  "description": "Settings that control OpenAPI specification import, base URL overrides, and operation exposure.",
+  "type": "object",
+  "additionalProperties": true,
+  "properties": {
+    "base_url": {
+      "type": "string",
+      "description": "Resolved API base URL used by the connector."
+    },
+    "base_url_override": {
+      "type": "boolean",
+      "description": "Whether the action uses a manually overridden base URL instead of the specification server."
+    },
+    "allowed_operations": {
+      "type": "array",
+      "description": "Optional list of operation IDs or generated operation keys exposed to agents. Missing or empty means all operations are available.",
+      "items": {
+        "type": "string",
+        "minLength": 1
+      },
+      "uniqueItems": true
+    },
+    "openapi_spec_content": {
+      "type": "object",
+      "description": "Validated OpenAPI specification content."
+    },
+    "openapi_source_type": {
+      "type": "string",
+      "description": "How the specification content is stored.",
+      "enum": ["content", "file", "path"]
+    }
+  }
+}
diff --git a/application/v2_ui/src/components/workspaceActions/ActionAdvancedFields.tsx b/application/v2_ui/src/components/workspaceActions/ActionAdvancedFields.tsx
index a81757e0a..66623d8a0 100644
--- a/application/v2_ui/src/components/workspaceActions/ActionAdvancedFields.tsx
+++ b/application/v2_ui/src/components/workspaceActions/ActionAdvancedFields.tsx
@@ -1,10 +1,10 @@
 // ActionAdvancedFields.tsx
 
-import { useId } from 'react';
+import { useId, useState } from 'react';
 import { EditorDependents, EditorPanelFieldset, EditorRow, EditorSwitch } from '../workspace/EditorLayout';
 import { ActionField, ActionJsonInput, ACTION_INPUT_CLASS } from './ActionFields';
 import { ActionSchemaFields } from './ActionSchemaFields';
-import { isRecord, type ActionTypeDefinition } from '../../lib/workspaceAuthoring';
+import { editorName, isRecord, type ActionTypeDefinition } from '../../lib/workspaceAuthoring';
 import { actionFieldError, actionHasStoredArraySecrets, actionText, actionValueAt, changeActionField } from '../../lib/workspaceActionLogic';
 import type { ActionEditorHints } from '../../lib/workspaceActionServices';
 import type { ActionConnectorProps } from '../../lib/workspaceActionTypes';
@@ -18,6 +18,7 @@ export function ActionAdvancedFields(props: ActionConnectorProps & {
 }) {
     const { draft, onChange, readOnly, definition, hints, hintsError } = props;
     const id = useId();
+    const [editMachineName, setEditMachineName] = useState(false);
     const rawReminder = actionValueAt(draft, reminderPath);
     const reminder = isRecord(rawReminder) ? rawReminder : {};
     const enabled = reminder.enabled === true;
@@ -28,11 +29,17 @@ export function ActionAdvancedFields(props: ActionConnectorProps & {
         <div className="min-w-0 space-y-6">
             <div className="min-w-0">
                 <ActionField id={`${id}-machine-name`} label="Machine name" required width="standard"
-                    help="Letters, numbers, underscores, and dashes only. Renaming does not change the action ID."
+                    help="Internal identifier the model sees for this tool or plugin. Agents reference the action by ID. Letters, numbers, underscores, and dashes only."
                     error={actionFieldError(props.errors, '/name')}>
-                    <input id={`${id}-machine-name`} className={ACTION_INPUT_CLASS} value={draft.name} required
-                        pattern="[A-Za-z0-9_\-]+" disabled={readOnly}
-                        onChange={(event) => onChange((current) => ({ ...current, name: event.target.value }))} />
+                    <div className="flex flex-wrap items-center gap-2">
+                        <input id={`${id}-machine-name`} className={ACTION_INPUT_CLASS} value={draft.name || editorName(draft.displayName || '', 'action')} required
+                            pattern="[A-Za-z0-9_\-]+" disabled={readOnly || !editMachineName}
+                            onChange={(event) => onChange((current) => ({ ...current, name: event.target.value }))} />
+                        {!readOnly ? <button type="button" className="text-xs font-medium text-accent hover:underline"
+                            onClick={() => setEditMachineName((value) => !value)}>
+                            {editMachineName ? 'Done' : 'Edit'}
+                        </button> : null}
+                    </div>
                 </ActionField>
                 <EditorRow heading="Action ID" help="The ID, not the display name, identifies this action in agent assignments.">
                     <p className="break-all font-mono text-xs text-text-2">{draft.id || 'Assigned when the action is saved.'}</p>
diff --git a/application/v2_ui/src/components/workspaceActions/ActionAuthentication.tsx b/application/v2_ui/src/components/workspaceActions/ActionAuthentication.tsx
index 5296ddc2e..0809e5b22 100644
--- a/application/v2_ui/src/components/workspaceActions/ActionAuthentication.tsx
+++ b/application/v2_ui/src/components/workspaceActions/ActionAuthentication.tsx
@@ -1,6 +1,8 @@
 // ActionAuthentication.tsx
 
 import { useId } from 'react';
+import { EditorDependents, EditorPanelFieldset, EditorSwitch } from '../workspace/EditorLayout';
+import { ActionConnectionCheck } from './ActionConnectionCheck';
 import { ActionField, ActionSecretInput, ACTION_INPUT_CLASS } from './ActionFields';
 import {
     actionAuthMethod, actionAuthModes, actionFieldError, actionText, actionValueAt,
@@ -20,6 +22,8 @@ export function ActionAuthentication(props: ActionConnectorProps & { definition:
     const identityTypes = native.identityTypes ?? ['api_key', 'bearer_token', 'client_secret', 'connection_string', 'managed_identity', 'username_password'];
     const identities = props.identities.filter((identity) => identityTypes.includes(identity.auth_type));
     const identity = identities.find((candidate) => candidate.id === draft.identity_id);
+    const proxyIdentities = props.identities.filter((candidate) => candidate.auth_type === 'username_password');
+    const proxyIdentityId = actionText(actionValueAt(draft, '/additionalFields/basic_auth_identity_id'));
     const identityMissing = Boolean(draft.identity_id && !identity);
     const groupScoped = Boolean(props.groupScope);
     // A group member cannot list identities (403): the list is unresolvable, so a bound identity is
@@ -41,6 +45,33 @@ export function ActionAuthentication(props: ActionConnectorProps & { definition:
             disabled={readOnly} error={actionFieldError(props.errors, path)}
             onChange={(value) => onChange((current) => changeActionField(current, path, value))} />
     );
+    const yamcsProxyAuth = draft.type === 'yamcs' ? (
+        <EditorPanelFieldset legend="Reverse proxy authentication"
+            description="Use this only when an HTTP Basic reverse proxy sits in front of Yamcs. It is separate from the primary Yamcs authentication method above.">
+            <EditorSwitch lead checked={actionValueAt(draft, '/additionalFields/enable_basic_auth') === true}
+                disabled={readOnly} label="Send Basic auth to a reverse proxy"
+                description="Stores the same Yamcs basic-auth keys the backend expects; it does not change the Yamcs API auth method."
+                onChange={(value) => onChange((current) => changeActionField(current, '/additionalFields/enable_basic_auth', value))} />
+            {actionValueAt(draft, '/additionalFields/enable_basic_auth') === true ? <EditorDependents>
+                {textField('/additionalFields/basic_auth_username', 'Proxy username', 'Username sent to the reverse proxy. A selected reusable identity can supply this value at runtime.', !proxyIdentityId)}
+                <ActionField id={`${id}-proxy-identity`} label="Proxy reusable identity" width="standard"
+                    help="Optional username/password identity for the reverse proxy credential."
+                    error={actionFieldError(props.errors, '/additionalFields/basic_auth_identity_id')}>
+                    <select id={`${id}-proxy-identity`} className={ACTION_INPUT_CLASS} value={proxyIdentityId}
+                        disabled={readOnly || props.identitiesLoading}
+                        onChange={(event) => onChange((current) => changeActionField(current, '/additionalFields/basic_auth_identity_id', event.target.value || undefined))}>
+                        <option value="">Use the proxy password below</option>
+                        {proxyIdentityId && !proxyIdentities.some((candidate) => candidate.id === proxyIdentityId)
+                            ? <option value={proxyIdentityId} disabled>Unavailable identity — {proxyIdentityId}</option> : null}
+                        {proxyIdentities.map((candidate) => <option key={candidate.id} value={candidate.id}>
+                            {candidate.name} · {candidate.scope_type || 'personal'} · {candidate.id}
+                        </option>)}
+                    </select>
+                </ActionField>
+                {!proxyIdentityId ? secretField('/additionalFields/basic_auth_password', 'Proxy password', 'Password sent to the reverse proxy. Stored in Key Vault.') : null}
+            </EditorDependents> : null}
+        </EditorPanelFieldset>
+    ) : null;
 
     if (native.internal) return (
         <p className="text-sm text-text-2">
@@ -151,10 +182,12 @@ export function ActionAuthentication(props: ActionConnectorProps & { definition:
                 ? textField('/additionalFields/pat_name', 'Personal access token name', 'The reusable identity contains the PAT secret; its token name is configured on this action.', true) : null}
             {draft.identity_id && draft.type === 'snowflake' && method === 'key_pair'
                 ? secretField('/additionalFields/private_key_passphrase', 'Private key passphrase', 'Only needed for an encrypted private key.') : null}
+            {yamcsProxyAuth}
             <p className="border-t border-edge pt-3 text-xs leading-relaxed text-text-3">
                 Stored secrets are never returned to this form. Keep their masked state, enter a replacement, or choose Clear.
                 Changing another field does not replace credentials or erase hidden configuration.
             </p>
+            <ActionConnectionCheck props={props} definition={definition} />
         </div>
     );
 }
diff --git a/application/v2_ui/src/components/workspaceActions/ActionConfigurationFields.tsx b/application/v2_ui/src/components/workspaceActions/ActionConfigurationFields.tsx
index f1681145c..0d28f4bbb 100644
--- a/application/v2_ui/src/components/workspaceActions/ActionConfigurationFields.tsx
+++ b/application/v2_ui/src/components/workspaceActions/ActionConfigurationFields.tsx
@@ -1,22 +1,19 @@
 // ActionConfigurationFields.tsx
 
 import { useId, useState } from 'react';
-import { FlaskConical } from 'lucide-react';
-import { GlassButton } from '../ui/primitives';
 import { ConfirmDialog } from '../ui/ConfirmDialog';
-import { EditorFieldset, EditorPanel, EditorSwitch, type EditorFieldWidth } from '../workspace/EditorLayout';
+import { EditorFieldset, EditorSwitch, type EditorFieldWidth } from '../workspace/EditorLayout';
 import { ActionField, ActionJsonInput, ActionLinesInput, ActionSecretInput, ACTION_INPUT_CLASS } from './ActionFields';
 import { ActionSchemaFields } from './ActionSchemaFields';
 import { CallAgentActionConfiguration } from './CallAgentActionConfiguration';
-import { ConnectorFeedbackPanel, useConnectorRequest } from './OpenApiActionConfiguration';
+import { DocumentSearchActionConfiguration } from './DocumentSearchActionConfiguration';
 import {
     actionFieldError, actionHasStoredArraySecrets, actionText, actionValueAt, changeActionField,
     changeSqlConnectionMethod, deriveBlobEndpoint, displayedActionValue,
 } from '../../lib/workspaceActionLogic';
 import { nativeActionDefinition, sqlConnectionMethod, usesDirectBlobConnectionString } from '../../lib/workspaceActionRegistry';
-import { EDITOR_SECRET_MASK, isRecord, type ActionTypeDefinition } from '../../lib/workspaceAuthoring';
-import { testWorkspaceAction } from '../../lib/workspaceActionServices';
-import { connectorTestScope, type ActionConnectorProps, type ActionFieldDescriptor } from '../../lib/workspaceActionTypes';
+import { EDITOR_SECRET_MASK, isRecord, pointerPart, type ActionTypeDefinition } from '../../lib/workspaceAuthoring';
+import type { ActionCapability, ActionConnectorProps, ActionFieldDescriptor } from '../../lib/workspaceActionTypes';
 
 export function ActionDescriptorField({ props, descriptor }: { props: ActionConnectorProps; descriptor: ActionFieldDescriptor }) {
     const id = useId();
@@ -64,30 +61,73 @@ export function ActionDescriptorField({ props, descriptor }: { props: ActionConn
     );
 }
 
+function capabilityDefinition(definition: ActionTypeDefinition, native = nativeActionDefinition(definition.type)) {
+    if (native.capabilities) return native.capabilities;
+    if (!definition.capabilities?.length) return undefined;
+    const defaults = isRecord(definition.defaults) ? definition.defaults : {};
+    const savedDefaults = isRecord(defaults.m365_capabilities) ? defaults.m365_capabilities : {};
+    const options: ActionCapability[] = definition.capabilities.map((capability) => ({
+        key: capability.key,
+        label: capability.label,
+        description: capability.description,
+        defaultEnabled: typeof savedDefaults[capability.key] === 'boolean' ? savedDefaults[capability.key] === true : capability.default !== false,
+    }));
+    return { path: '/additionalFields/m365_capabilities', options };
+}
+
+function configurationCoveredPaths(definition: ActionTypeDefinition) {
+    const native = nativeActionDefinition(definition.type);
+    const sql = ['sql_query', 'sql_schema'].includes(definition.type);
+    const capabilities = capabilityDefinition(definition, native);
+    return [
+        ...native.fields.map(({ path }) => path),
+        '/additionalFields/identity_auth_type',
+        ...(sql ? ['/additionalFields/auth_type', '/additionalFields/username', '/additionalFields/password', '/additionalFields/identity_uses_connection_string'] : []),
+        ...(['databricks', 'databricks_table', 'snowflake', 'tableau', 'yamcs'].includes(definition.type) ? ['/additionalFields/auth_method'] : []),
+        ...(['databricks', 'databricks_table'].includes(definition.type) ? ['/additionalFields/workspace_url'] : []),
+        ...(['tableau', 'yamcs'].includes(definition.type) ? ['/additionalFields/server_url'] : []),
+        ...(definition.type === 'tableau' ? ['/additionalFields/pat_name'] : []),
+        ...(definition.type === 'snowflake' ? ['/additionalFields/private_key_passphrase'] : []),
+        ...(definition.type === 'rocksdb' ? ['/additionalFields/auth_scheme', '/additionalFields/api_key_header', '/additionalFields/base_url'] : []),
+        ...(definition.type === 'log_analytics' ? ['/additionalFields/query_history'] : []),
+        ...(definition.type === 'yamcs' ? [
+            '/additionalFields/enable_basic_auth', '/additionalFields/basic_auth_username',
+            '/additionalFields/basic_auth_password', '/additionalFields/basic_auth_identity_id',
+        ] : []),
+        ...(capabilities ? [capabilities.path] : []),
+    ];
+}
+
+function schemaHasVisibleProperties(definition: ActionTypeDefinition) {
+    const coveredPaths = configurationCoveredPaths(definition);
+    const properties = definition.additional_fields_schema.properties ?? {};
+    return Object.keys(properties).some((key) => {
+        const pointer = `/additionalFields/${pointerPart(key)}`;
+        return !coveredPaths.some((known) =>
+            pointer === known || pointer.startsWith(`${known}/`) || known.startsWith(`${pointer}/`));
+    });
+}
+
+export function hasActionConfigurationFields(definition: ActionTypeDefinition) {
+    if (definition.type === 'agent' || definition.type === 'document_search' || definition.type === 'search' ||
+        definition.type === 'openapi' || definition.type === 'mcp') return true;
+    const native = nativeActionDefinition(definition.type);
+    return native.fields.length > 0 || Boolean(capabilityDefinition(definition, native)) || schemaHasVisibleProperties(definition);
+}
+
 export function ActionConfigurationFields(props: ActionConnectorProps & { definition: ActionTypeDefinition }) {
     const { draft, onChange, readOnly, definition } = props;
     const id = useId();
     const [confirmParameters, setConfirmParameters] = useState(false);
     const native = nativeActionDefinition(draft.type);
-    const request = useConnectorRequest(props);
     if (draft.type === 'agent') return <CallAgentActionConfiguration {...props} />;
+    if (draft.type === 'document_search' || draft.type === 'search') return <DocumentSearchActionConfiguration {...props} />;
     const sql = ['sql_query', 'sql_schema'].includes(draft.type);
-    const capabilities = native.capabilities;
+    const capabilities = capabilityDefinition(definition, native);
     const rawCapabilities = capabilities ? actionValueAt(draft, capabilities.path) : undefined;
     const capabilityValues = isRecord(rawCapabilities) ? rawCapabilities : {};
     const derivedEndpoint = draft.type === 'blob_storage' ? deriveBlobEndpoint(actionText(draft.auth.key)) : '';
-    const coveredPaths = [
-        ...native.fields.map(({ path }) => path),
-        '/additionalFields/identity_auth_type',
-        ...(sql ? ['/additionalFields/auth_type', '/additionalFields/username', '/additionalFields/password', '/additionalFields/identity_uses_connection_string'] : []),
-        ...(['databricks', 'databricks_table', 'snowflake', 'tableau', 'yamcs'].includes(draft.type) ? ['/additionalFields/auth_method'] : []),
-        ...(['databricks', 'databricks_table'].includes(draft.type) ? ['/additionalFields/workspace_url'] : []),
-        ...(['tableau', 'yamcs'].includes(draft.type) ? ['/additionalFields/server_url'] : []),
-        ...(draft.type === 'tableau' ? ['/additionalFields/pat_name'] : []),
-        ...(draft.type === 'snowflake' ? ['/additionalFields/private_key_passphrase'] : []),
-        ...(draft.type === 'rocksdb' ? ['/additionalFields/auth_scheme', '/additionalFields/api_key_header', '/additionalFields/base_url'] : []),
-        ...(capabilities ? [capabilities.path] : []),
-    ];
+    const coveredPaths = configurationCoveredPaths(definition);
 
     return (
         <div className="min-w-0 space-y-5" data-testid="action-configuration" data-action-type={draft.type}>
@@ -105,6 +145,10 @@ export function ActionConfigurationFields(props: ActionConnectorProps & { defini
                 </select>
             </ActionField> : null}
             {native.fields.map((descriptor) => <ActionDescriptorField key={descriptor.path} props={props} descriptor={descriptor} />)}
+            {draft.type.startsWith('m365_') && definition.graph_endpoint ? <ActionField id={`${id}-graph-endpoint`} label="Microsoft Graph endpoint"
+                help="Derived from this deployment’s Azure cloud. Agents cannot change it.">
+                <input id={`${id}-graph-endpoint`} className={ACTION_INPUT_CLASS} value={definition.graph_endpoint} readOnly />
+            </ActionField> : null}
             {usesDirectBlobConnectionString(draft) ? (
                 <div className="space-y-2 rounded-lg border border-edge bg-surface-1 px-3 py-2 text-xs text-text-3">
                     <p>The blob service endpoint is derived automatically when saving or testing. A stored connection string keeps the saved endpoint.</p>
@@ -129,16 +173,6 @@ export function ActionConfigurationFields(props: ActionConnectorProps & { defini
             </EditorFieldset> : null}
             <ActionSchemaFields props={props} schema={definition.additional_fields_schema} coveredPaths={coveredPaths}
                 allowCustom={definition.additional_fields_schema.additionalProperties !== false} />
-            {native.testPath ? <EditorPanel title="Connection check"
-                description="Test connection makes a small request using this draft. An edited action uses its owned stored credentials when their masked values are unchanged. Saving does not run this test.">
-                <div>
-                    <GlassButton type="button" size="sm" variant="subtle" disabled={readOnly || Boolean(request.busy)}
-                        onClick={() => void request.run('Testing connection…', (signal) => testWorkspaceAction(draft, props.original, definition, signal, connectorTestScope(props)))}>
-                        <FlaskConical size={15} />{request.busy || 'Test connection'}
-                    </GlassButton>
-                </div>
-                <ConnectorFeedbackPanel feedback={request.feedback} stale={request.stale} />
-            </EditorPanel> : null}
             {confirmParameters ? <ConfirmDialog title="Use individual connection parameters?" tone="primary"
                 description="The saved connection string will be explicitly cleared when you save. Server, database, and authentication fields are kept for you to review."
                 confirmLabel="Use parameters" onClose={() => setConfirmParameters(false)}
diff --git a/application/v2_ui/src/components/workspaceActions/ActionConnectionCheck.tsx b/application/v2_ui/src/components/workspaceActions/ActionConnectionCheck.tsx
new file mode 100644
index 000000000..c495b18b5
--- /dev/null
+++ b/application/v2_ui/src/components/workspaceActions/ActionConnectionCheck.tsx
@@ -0,0 +1,155 @@
+// ActionConnectionCheck.tsx
+
+import { useEffect, useRef, useState } from 'react';
+import { FlaskConical } from 'lucide-react';
+import { GlassButton } from '../ui/primitives';
+import { EditorPanel } from '../workspace/EditorLayout';
+import { nativeActionDefinition } from '../../lib/workspaceActionRegistry';
+import { testWorkspaceAction } from '../../lib/workspaceActionServices';
+import { connectorFeedback, testApiConnector, validateApiConnector, type ConnectorFeedback } from '../../lib/workspaceActionConnectors';
+import type { ActionConfiguration, ActionTypeDefinition } from '../../lib/workspaceAuthoring';
+import { connectorTestScope, type ActionConnectorProps } from '../../lib/workspaceActionTypes';
+
+export function useConnectorRequest(props: ActionConnectorProps) {
+    const latest = useRef(props);
+    latest.current = props;
+    const activeRequest = useRef<{
+        controller: AbortController;
+        draft: ActionConfiguration;
+        original: ActionConnectorProps['original'];
+    } | null>(null);
+    const [busy, setBusy] = useState<string | null>(null);
+    const [feedback, setFeedback] = useState<{ value: ConnectorFeedback; draft: ActionConfiguration } | null>(null);
+
+    useEffect(() => {
+        const active = activeRequest.current;
+        if (active && (active.draft !== props.draft || active.original !== props.original || props.readOnly || props.original?.read_only)) {
+            active.controller.abort();
+            activeRequest.current = null;
+            setBusy(null);
+        }
+    }, [props.draft, props.original, props.readOnly]);
+    useEffect(() => () => {
+        activeRequest.current?.controller.abort();
+        activeRequest.current = null;
+    }, []);
+
+    async function run<T>(
+        label: string,
+        operation: (signal: AbortSignal) => Promise<T>,
+        apply?: (draft: ActionConfiguration, result: T) => ActionConfiguration,
+        describe?: (result: T) => ConnectorFeedback,
+    ): Promise<T | undefined> {
+        const snapshot = latest.current;
+        if (snapshot.readOnly || snapshot.original?.read_only) return undefined;
+        activeRequest.current?.controller.abort();
+        const request = new AbortController();
+        activeRequest.current = { controller: request, draft: snapshot.draft, original: snapshot.original };
+        setBusy(label);
+        try {
+            const response = await operation(request.signal);
+            if (request.signal.aborted || latest.current.draft !== snapshot.draft ||
+                latest.current.original !== snapshot.original || latest.current.readOnly) return undefined;
+            const value = describe ? describe(response) : connectorFeedback(response);
+            let resultDraft = snapshot.draft;
+            if (value.success && apply) {
+                resultDraft = apply(snapshot.draft, response);
+                snapshot.onChange((current) => current === snapshot.draft ? resultDraft : current);
+            }
+            setFeedback({ value, draft: resultDraft });
+            return value.success ? response : undefined;
+        } catch (error) {
+            if (!request.signal.aborted && latest.current.draft === snapshot.draft &&
+                latest.current.original === snapshot.original) {
+                setFeedback({ value: connectorFeedback(error), draft: snapshot.draft });
+            }
+            return undefined;
+        } finally {
+            if (activeRequest.current?.controller === request) {
+                activeRequest.current = null;
+                setBusy(null);
+            }
+        }
+    }
+    return { busy, feedback: feedback?.value ?? null, stale: Boolean(feedback && feedback.draft !== props.draft), run };
+}
+
+export function ConnectorFeedbackPanel({ feedback, stale }: { feedback: ConnectorFeedback | null; stale?: boolean }) {
+    if (!feedback) return null;
+    const details = Object.entries(feedback.details).filter(([, value]) => ['string', 'number', 'boolean'].includes(typeof value));
+    return (
+        <div role={feedback.success ? 'status' : 'alert'} aria-live="polite"
+            className={`alert rounded-xl border p-3 text-sm ${feedback.success
+                ? 'alert-success border-edge bg-surface-2 text-text-1'
+                : 'alert-danger border-danger/30 bg-danger-soft text-danger'}`}>
+            <p className="break-words">{feedback.message}</p>
+            {stale ? <p className="mt-1 text-xs text-text-3">This result describes an earlier draft. Run the command again to check your current configuration.</p> : null}
+            {feedback.errors.length ? <ul className="mt-2 list-disc space-y-1 pl-5">
+                {feedback.errors.map((message, index) => <li key={index} className="break-words">{message}</li>)}
+            </ul> : null}
+            {feedback.warnings.length ? <div className="alert alert-warning mt-2 rounded-lg bg-warn-soft p-2 text-warn">
+                <p className="font-medium">Warnings</p>
+                <ul className="list-disc space-y-1 pl-5">
+                    {feedback.warnings.map((message, index) => <li key={index} className="break-words">{message}</li>)}
+                </ul>
+            </div> : null}
+            {details.length ? <dl className="mt-2 grid gap-1 text-xs text-text-2">
+                {details.map(([name, value]) => <div key={name} className="flex flex-wrap gap-x-2">
+                    <dt className="font-medium">{name.replaceAll('_', ' ')}:</dt><dd className="break-all">{String(value)}</dd>
+                </div>)}
+            </dl> : null}
+        </div>
+    );
+}
+
+export function ActionConnectionCheck({
+    props, definition, kind = 'native', disabled = false, configurationError = false,
+}: {
+    props: ActionConnectorProps;
+    definition?: ActionTypeDefinition;
+    kind?: 'native' | 'openapi' | 'mcp';
+    disabled?: boolean;
+    configurationError?: boolean;
+}) {
+    const { draft, original } = props;
+    const readOnly = props.readOnly || Boolean(original?.read_only);
+    const request = useConnectorRequest(props);
+    if (kind === 'native') {
+        const native = nativeActionDefinition(draft.type);
+        if (!native.testPath || !definition) return null;
+        return (
+            <EditorPanel title="Connection check"
+                description="Test connection makes a small request using this draft. An edited action uses its owned stored credentials when their masked values are unchanged. Saving does not run this test.">
+                <div>
+                    <GlassButton type="button" size="sm" variant="subtle" disabled={readOnly || Boolean(request.busy)}
+                        onClick={() => void request.run('Testing connection…', (signal) => testWorkspaceAction(draft, original, definition, signal, connectorTestScope(props)))}>
+                        <FlaskConical size={15} />{request.busy || 'Test connection'}
+                    </GlassButton>
+                </div>
+                <ConnectorFeedbackPanel feedback={request.feedback} stale={request.stale} />
+            </EditorPanel>
+        );
+    }
+    const label = kind === 'mcp' ? 'MCP' : 'OpenAPI';
+    return (
+        <EditorPanel title="Validate and test"
+            description={kind === 'mcp'
+                ? 'The connection test initializes a server session and lists its tools. It does not invoke tools or save discovered metadata.'
+                : 'Validation checks the manifest without running it. Connection testing parses the specification and probes the authenticated base URL; it does not invoke an individual API operation.'}>
+            <div className="flex flex-wrap items-center gap-2">
+                <GlassButton type="button" variant="subtle" disabled={readOnly || Boolean(request.busy) || disabled || configurationError}
+                    onClick={() => void request.run(`Validating ${label} configuration…`, (signal) => validateApiConnector(draft, original, kind, signal, connectorTestScope(props)))}>
+                    Validate {label} configuration
+                </GlassButton>
+                <GlassButton type="button" variant="subtle" disabled={readOnly || Boolean(request.busy) || disabled || configurationError}
+                    onClick={() => void request.run(`Testing ${label} connection…`, (signal) => testApiConnector(draft, original, kind, signal, connectorTestScope(props)))}>
+                    Test {label} connection
+                </GlassButton>
+                {request.busy ? <p role="status" className="text-sm text-text-3">{request.busy}</p> : null}
+            </div>
+            {readOnly ? <p className="text-xs text-text-3">Provided actions are read-only. Validation and connection testing are disabled.</p> : null}
+            {!readOnly && configurationError ? <p className="text-xs text-text-3">Resolve the highlighted configuration errors before validating or connecting.</p> : null}
+            <ConnectorFeedbackPanel feedback={request.feedback} stale={request.stale} />
+        </EditorPanel>
+    );
+}
diff --git a/application/v2_ui/src/components/workspaceActions/ActionSchemaFields.tsx b/application/v2_ui/src/components/workspaceActions/ActionSchemaFields.tsx
index caaa1952e..06509463c 100644
--- a/application/v2_ui/src/components/workspaceActions/ActionSchemaFields.tsx
+++ b/application/v2_ui/src/components/workspaceActions/ActionSchemaFields.tsx
@@ -1,10 +1,10 @@
 // ActionSchemaFields.tsx
 
-import { useId, useState } from 'react';
+import { useId } from 'react';
 import { Plus, Trash2 } from 'lucide-react';
 import { GlassButton } from '../ui/primitives';
 import { ActionField, ActionJsonInput, ActionSecretInput, ACTION_INPUT_CLASS } from './ActionFields';
-import { EditorPanel, EditorPanelFieldset, EditorRow } from '../workspace/EditorLayout';
+import { EditorPanelFieldset, EditorRow } from '../workspace/EditorLayout';
 import { EDITOR_SECRET_MASK, isRecord, pointerPart, type EditorSchema } from '../../lib/workspaceAuthoring';
 import {
     actionArrayRemovalError, actionFieldError, actionHasStoredArraySecrets, actionSchemaDefaults,
@@ -157,59 +157,17 @@ export function ActionSchemaFields({
     const resolved = resolveActionSchema(schema, root);
     const value = actionValueAt(props.draft, path);
     const record = isRecord(value) ? value : {};
-    const covered = (pointer: string) => coveredPaths.some((known) => pointer === known || pointer.startsWith(`${known}/`));
+    const covered = (pointer: string) => coveredPaths.some((known) =>
+        pointer === known || pointer.startsWith(`${known}/`) || known.startsWith(`${pointer}/`));
     const properties = Object.entries(resolved.properties ?? {}).filter(([key]) => !covered(`${path}/${pointerPart(key)}`));
-    const unknown = Object.keys(record).filter((key) => !Object.hasOwn(resolved.properties ?? {}, key) && !covered(`${path}/${pointerPart(key)}`));
+    void record;
+    void allowCustom;
     return (
         <div className="min-w-0 space-y-4">
             {properties.map(([key, definition]) => (
                 <ActionSchemaValue key={key} props={props} path={`${path}/${pointerPart(key)}`} schema={definition} root={root}
                     label={definition.title || humanLabel(key)} required={resolved.required?.includes(key)} depth={depth} />
             ))}
-            {unknown.map((key) => <div key={key} className="min-w-0 space-y-1">
-                <ActionSchemaValue props={props} path={`${path}/${pointerPart(key)}`} root={root}
-                    schema={isRecord(resolved.additionalProperties) ? resolved.additionalProperties : {}}
-                    label={humanLabel(key)} depth={depth} />
-                {!props.readOnly ? <GlassButton type="button" size="sm" aria-label={`Remove ${key}`}
-                    onClick={() => props.onChange((draft) => withActionValue(draft, `${path}/${pointerPart(key)}`, undefined))}>
-                    <Trash2 size={12} /> Remove field
-                </GlassButton> : null}
-            </div>)}
-            {allowCustom && !props.readOnly ? <ActionAddCustomField props={props} path={path} existing={Object.keys(record)} /> : null}
         </div>
     );
 }
-
-function ActionAddCustomField({ props, path, existing }: { props: ActionConnectorProps; path: string; existing: string[] }) {
-    const id = useId();
-    const [name, setName] = useState('');
-    const [type, setType] = useState('text');
-    const [error, setError] = useState('');
-    return (
-        <EditorPanel title="Add a custom field"
-            description="Add an installed connector’s custom property. Names ending in __Secret are treated as credentials.">
-            <div className="min-w-0">
-                <ActionField id={`${id}-name`} label="Custom field name" error={error} width="standard">
-                    <input id={`${id}-name`} value={name} className={ACTION_INPUT_CLASS}
-                        onChange={(event) => { setName(event.target.value); setError(''); }} />
-                </ActionField>
-                <ActionField id={`${id}-type`} label="Value type" width="compact">
-                    <select id={`${id}-type`} value={type} className={ACTION_INPUT_CLASS} onChange={(event) => setType(event.target.value)}>
-                        <option value="text">Text</option><option value="number">Number</option><option value="boolean">Boolean</option>
-                        <option value="object">Object</option><option value="array">List</option><option value="secret">Secret</option>
-                    </select>
-                </ActionField>
-            </div>
-            <div className="flex justify-end">
-                <GlassButton type="button" size="sm" variant="subtle" onClick={() => {
-                    const raw = name.trim();
-                    const key = type === 'secret' && !raw.endsWith('__Secret') ? `${raw}__Secret` : raw;
-                    if (!raw || existing.includes(key)) { setError(raw ? 'That property already exists.' : 'Enter a property name.'); return; }
-                    const initial = type === 'number' ? 0 : type === 'boolean' ? false : type === 'object' ? {} : type === 'array' ? [] : '';
-                    props.onChange((draft) => withActionValue(draft, `${path}/${pointerPart(key)}`, initial));
-                    setName(''); setError('');
-                }}><Plus size={14} /> Add field</GlassButton>
-            </div>
-        </EditorPanel>
-    );
-}
diff --git a/application/v2_ui/src/components/workspaceActions/DocumentSearchActionConfiguration.tsx b/application/v2_ui/src/components/workspaceActions/DocumentSearchActionConfiguration.tsx
new file mode 100644
index 000000000..7327377de
--- /dev/null
+++ b/application/v2_ui/src/components/workspaceActions/DocumentSearchActionConfiguration.tsx
@@ -0,0 +1,448 @@
+// DocumentSearchActionConfiguration.tsx
+
+import { useMemo } from 'react';
+import { RotateCcw } from 'lucide-react';
+import { useBootstrapStore } from '../../stores/bootstrapStore';
+import { changeActionField } from '../../lib/workspaceActionLogic';
+import type { ActionConnectorProps } from '../../lib/workspaceActionTypes';
+import type { WorkspaceRef } from '../../lib/types';
+import { EditorDependents, EditorFieldRow, EditorFieldset, EditorSwitch } from '../workspace/EditorLayout';
+
+const INPUT_CLASS = 'form-control w-full rounded-lg border border-edge bg-surface-1 px-3 py-2 text-sm text-text-1 focus:border-accent focus:outline-none';
+const SELECT_CLASS = 'form-select w-full rounded-lg border border-edge bg-surface-1 px-3 py-2 text-sm text-text-1 focus:border-accent focus:outline-none';
+const RANGE_CLASS = 'form-range w-full accent-[var(--accent)] disabled:cursor-not-allowed disabled:opacity-50';
+const VALID_SCOPES = ['personal', 'group', 'public'] as const;
+
+type DocumentSearchScope = typeof VALID_SCOPES[number];
+type WindowSizingMode = 'automatic' | 'fixed' | 'percent';
+
+function numberValue(value: unknown, fallback: number, min: number, max: number): number {
+    const numeric = typeof value === 'number' ? value : Number(value);
+    if (!Number.isFinite(numeric)) return fallback;
+    return Math.min(max, Math.max(min, Math.round(numeric)));
+}
+
+function stringArrayValue(value: unknown): string[] {
+    if (!Array.isArray(value)) return [];
+    const seen = new Set<string>();
+    return value.reduce<string[]>((items, item) => {
+        const normalized = String(item || '').trim();
+        if (normalized && !seen.has(normalized)) {
+            seen.add(normalized);
+            items.push(normalized);
+        }
+        return items;
+    }, []);
+}
+
+function scopeArrayValue(value: unknown): DocumentSearchScope[] {
+    const values = stringArrayValue(value).filter((item): item is DocumentSearchScope =>
+        VALID_SCOPES.includes(item as DocumentSearchScope));
+    return values.length ? values : [...VALID_SCOPES];
+}
+
+function parsePageTargetLength(value: unknown, min: number, max: number): { pages: number; custom: '' } | { pages: null; custom: string } {
+    if (typeof value === 'number' && Number.isFinite(value)) {
+        return { pages: numberValue(value, min, min, max), custom: '' };
+    }
+    const text = String(value ?? '').trim();
+    if (!text) return { pages: min, custom: '' };
+    const match = text.match(/^(\d+)(?:\s*pages?)?$/i);
+    if (!match) return { pages: null, custom: text };
+    return { pages: numberValue(Number(match[1]), min, min, max), custom: '' };
+}
+
+function joinNames(ids: string[], options: WorkspaceRef[]): string {
+    const names = ids.map((id) => options.find((option) => option.id === id)?.name || id);
+    return names.length ? names.join(', ') : 'All I can access';
+}
+
+function updateArrayValue(current: string[], value: string, enabled: boolean): string[] {
+    if (!enabled) return current.filter((item) => item !== value);
+    return current.includes(value) ? current : [...current, value];
+}
+
+function WorkspaceMultiSelect({
+    label,
+    description,
+    options,
+    selectedIds,
+    disabled,
+    onChange,
+}: {
+    label: string;
+    description: string;
+    options: WorkspaceRef[];
+    selectedIds: string[];
+    disabled: boolean;
+    onChange: (ids: string[]) => void;
+}) {
+    const selected = useMemo(() => new Set(selectedIds), [selectedIds]);
+    return (
+        <div className="space-y-2 rounded-xl border border-edge bg-surface-1 p-3">
+            <div>
+                <p className="text-sm font-semibold text-text-1">{label}</p>
+                <p className="text-xs leading-relaxed text-text-3">{description}</p>
+            </div>
+            {options.length ? (
+                <div className="max-h-56 space-y-1 overflow-y-auto pe-1">
+                    {options.map((option) => (
+                        <label key={option.id} className="form-check flex items-start gap-2 rounded-lg px-2 py-1.5 text-sm text-text-2 hover:bg-surface-2">
+                            <input
+                                type="checkbox"
+                                className="form-check-input mt-1"
+                                checked={selected.has(option.id)}
+                                disabled={disabled}
+                                onChange={(event) => onChange(updateArrayValue(selectedIds, option.id, event.target.checked))}
+                            />
+                            <span className="min-w-0">
+                                <span className="block break-words text-text-1">{option.name || option.id}</span>
+                                <span className="block break-all text-xs text-text-3">{option.id}</span>
+                            </span>
+                        </label>
+                    ))}
+                </div>
+            ) : (
+                <p className="text-xs text-text-3">No workspaces are available from the current bootstrap data.</p>
+            )}
+        </div>
+    );
+}
+
+function TargetLengthControl({
+    id,
+    label,
+    help,
+    value,
+    min,
+    max,
+    disabled,
+    onChange,
+}: {
+    id: string;
+    label: string;
+    help: string;
+    value: unknown;
+    min: number;
+    max: number;
+    disabled: boolean;
+    onChange: (value: string) => void;
+}) {
+    const parsed = parsePageTargetLength(value, min, max);
+    return (
+        <EditorFieldRow
+            htmlFor={id}
+            label={label}
+            help={help}
+            width="standard"
+            trailing={parsed.pages === null ? undefined : <span className="text-xs font-semibold tabular-nums text-text-2">{parsed.pages} pages</span>}
+        >
+            {parsed.pages === null ? (
+                <div className="space-y-2 rounded-lg border border-warn/40 bg-warn-soft p-3 text-sm text-text-2">
+                    <p>Current custom value: <span className="font-semibold">{parsed.custom}</span></p>
+                    <p className="text-xs text-text-3">Use reset to switch this action to page-based target lengths.</p>
+                    <button
+                        type="button"
+                        className="btn btn-sm inline-flex items-center gap-1 rounded-lg border border-edge px-2 py-1 text-xs text-text-1 hover:bg-surface-2"
+                        disabled={disabled}
+                        onClick={() => onChange(`${min} pages`)}
+                    >
+                        <RotateCcw size={13} /> Reset to {min} pages
+                    </button>
+                </div>
+            ) : (
+                <div className="space-y-2">
+                    <input
+                        id={id}
+                        type="range"
+                        className={RANGE_CLASS}
+                        min={min}
+                        max={max}
+                        step={1}
+                        value={parsed.pages}
+                        disabled={disabled}
+                        onChange={(event) => onChange(`${Number(event.target.value)} pages`)}
+                    />
+                    <div className="flex items-center gap-3">
+                        <input
+                            type="number"
+                            className={`${INPUT_CLASS} max-w-28`}
+                            min={min}
+                            max={max}
+                            step={1}
+                            value={parsed.pages}
+                            disabled={disabled}
+                            aria-label={`${label} pages`}
+                            onChange={(event) => onChange(`${numberValue(event.target.valueAsNumber, min, min, max)} pages`)}
+                        />
+                        <span className="text-sm text-text-3">pages</span>
+                    </div>
+                    <div className="flex justify-between text-xs text-text-3">
+                        <span>{min} page</span>
+                        <span>{max} pages</span>
+                    </div>
+                </div>
+            )}
+        </EditorFieldRow>
+    );
+}
+
+export function DocumentSearchActionConfiguration({ draft, onChange, readOnly }: ActionConnectorProps) {
+    const groups = useBootstrapStore((state) => state.data?.scope?.groups ?? []);
+    const publicWorkspaces = useBootstrapStore((state) => state.data?.scope?.public_workspaces ?? []);
+    const fields = draft.additionalFields;
+    const scopes = scopeArrayValue(fields.allowed_scopes);
+    const groupIds = stringArrayValue(fields.allowed_group_ids);
+    const publicWorkspaceIds = stringArrayValue(fields.allowed_public_workspace_ids);
+    const topN = numberValue(fields.default_top_n, draft.type === 'search' ? 12 : 50, 1, 500);
+    const sliderTopN = Math.min(100, Math.max(5, topN));
+    const windowSize = numberValue(fields.default_window_size, 10, 1, 100);
+    const windowPercent = numberValue(fields.default_window_percent, 25, 1, 100);
+    const sizingMode: WindowSizingMode = fields.default_window_percent !== undefined
+        ? 'percent'
+        : fields.default_window_size !== undefined ? 'fixed' : 'automatic';
+    const updateField = (path: string, value: unknown) => onChange((current) => changeActionField(current, path, value));
+    const updateWindowSizing = (mode: WindowSizingMode) => onChange((current) => {
+        let next = changeActionField(current, '/additionalFields/default_window_size', undefined);
+        next = changeActionField(next, '/additionalFields/default_window_percent', undefined);
+        if (mode === 'fixed') next = changeActionField(next, '/additionalFields/default_window_size', windowSize);
+        if (mode === 'percent') next = changeActionField(next, '/additionalFields/default_window_percent', windowPercent);
+        return next;
+    });
+    const toggleScope = (scope: DocumentSearchScope, enabled: boolean) => {
+        updateField('/additionalFields/allowed_scopes', updateArrayValue(scopes, scope, enabled));
+    };
+
+    return (
+        <div className="min-w-0 space-y-5" data-testid="document-search-configuration">
+            <p className="text-[0.8125rem] leading-relaxed text-text-2">
+                Search and summarize documents the current user is allowed to read. These settings can narrow
+                the action, but they never grant access beyond the user’s workspace permissions.
+            </p>
+            <EditorFieldset
+                legend="Allowed document scopes"
+                help="Choose which document areas this action may search. Turning a scope off makes the backend skip it even when a tool call asks for all documents."
+            >
+                <EditorSwitch
+                    label="My workspace"
+                    description="Allow documents from the signed-in user’s personal workspace."
+                    checked={scopes.includes('personal')}
+                    disabled={readOnly}
+                    onChange={(enabled) => toggleScope('personal', enabled)}
+                />
+                <EditorSwitch
+                    label="Group workspaces"
+                    description={`Allow group workspace documents. Current selection: ${joinNames(groupIds, groups)}.`}
+                    checked={scopes.includes('group')}
+                    disabled={readOnly}
+                    onChange={(enabled) => toggleScope('group', enabled)}
+                />
+                {scopes.includes('group') ? (
+                    <EditorDependents>
+                        <EditorFieldRow
+                            htmlFor="document-search-groups-mode"
+                            label="Group workspace access"
+                            help="Choose all authorized groups, or restrict the action to selected groups. An empty selected list is treated as all."
+                            width="standard"
+                        >
+                            <select
+                                id="document-search-groups-mode"
+                                className={SELECT_CLASS}
+                                value={groupIds.length ? 'restricted' : 'all'}
+                                disabled={readOnly}
+                                onChange={(event) => {
+                                    if (event.target.value === 'all') updateField('/additionalFields/allowed_group_ids', []);
+                                    else updateField('/additionalFields/allowed_group_ids', groups[0]?.id ? [groups[0].id] : []);
+                                }}
+                            >
+                                <option value="all">All I can access</option>
+                                <option value="restricted">Only these…</option>
+                            </select>
+                        </EditorFieldRow>
+                        {groupIds.length ? (
+                            <WorkspaceMultiSelect
+                                label="Allowed groups"
+                                description="The backend intersects this list with the user’s current group memberships."
+                                options={groups}
+                                selectedIds={groupIds}
+                                disabled={readOnly}
+                                onChange={(ids) => updateField('/additionalFields/allowed_group_ids', ids)}
+                            />
+                        ) : null}
+                    </EditorDependents>
+                ) : null}
+                <EditorSwitch
+                    label="Public workspaces"
+                    description={`Allow public workspace documents. Current selection: ${joinNames(publicWorkspaceIds, publicWorkspaces)}.`}
+                    checked={scopes.includes('public')}
+                    disabled={readOnly}
+                    onChange={(enabled) => toggleScope('public', enabled)}
+                />
+                {scopes.includes('public') ? (
+                    <EditorDependents>
+                        <EditorFieldRow
+                            htmlFor="document-search-public-mode"
+                            label="Public workspace access"
+                            help="Choose all visible public workspaces, or restrict the action to selected workspaces. An empty selected list is treated as all."
+                            width="standard"
+                        >
+                            <select
+                                id="document-search-public-mode"
+                                className={SELECT_CLASS}
+                                value={publicWorkspaceIds.length ? 'restricted' : 'all'}
+                                disabled={readOnly}
+                                onChange={(event) => {
+                                    if (event.target.value === 'all') updateField('/additionalFields/allowed_public_workspace_ids', []);
+                                    else updateField('/additionalFields/allowed_public_workspace_ids', publicWorkspaces[0]?.id ? [publicWorkspaces[0].id] : []);
+                                }}
+                            >
+                                <option value="all">All I can access</option>
+                                <option value="restricted">Only these…</option>
+                            </select>
+                        </EditorFieldRow>
+                        {publicWorkspaceIds.length ? (
+                            <WorkspaceMultiSelect
+                                label="Allowed public workspaces"
+                                description="The backend intersects this list with the public workspaces visible to the user."
+                                options={publicWorkspaces}
+                                selectedIds={publicWorkspaceIds}
+                                disabled={readOnly}
+                                onChange={(ids) => updateField('/additionalFields/allowed_public_workspace_ids', ids)}
+                            />
+                        ) : null}
+                    </EditorDependents>
+                ) : null}
+            </EditorFieldset>
+            <EditorFieldRow
+                htmlFor="document-search-top-n"
+                label="Default search result limit"
+                help="The slider covers the common 5–100 range. The number box can raise the limit up to the backend maximum of 500."
+                width="standard"
+                trailing={<span className="text-xs font-semibold tabular-nums text-text-2">{topN}</span>}
+            >
+                <input
+                    id="document-search-top-n"
+                    type="range"
+                    className={RANGE_CLASS}
+                    min={5}
+                    max={100}
+                    step={1}
+                    value={sliderTopN}
+                    disabled={readOnly}
+                    onChange={(event) => updateField('/additionalFields/default_top_n', Number(event.target.value))}
+                />
+                <input
+                    type="number"
+                    className={`${INPUT_CLASS} max-w-32`}
+                    min={1}
+                    max={500}
+                    step={1}
+                    value={topN}
+                    disabled={readOnly}
+                    aria-label="Default search result limit"
+                    onChange={(event) => updateField('/additionalFields/default_top_n', numberValue(event.target.valueAsNumber, topN, 1, 500))}
+                />
+            </EditorFieldRow>
+            <EditorFieldRow
+                htmlFor="document-search-window-unit"
+                label="Preferred window unit"
+                help="Window units control how document content is divided into summarization passes. Pages keep page ranges together when page numbers are available; chunks use indexed text chunks when pages are unavailable or preferred."
+                width="standard"
+            >
+                <select
+                    id="document-search-window-unit"
+                    className={SELECT_CLASS}
+                    value={String(fields.default_window_unit || 'pages')}
+                    disabled={readOnly}
+                    onChange={(event) => updateField('/additionalFields/default_window_unit', event.target.value)}
+                >
+                    <option value="pages">Pages</option>
+                    <option value="chunks">Chunks</option>
+                </select>
+            </EditorFieldRow>
+            <EditorFieldset
+                legend="Window sizing"
+                help="Automatic uses the service default. Fixed size sends exactly N pages or chunks per pass. Percent of document sizes each first-pass window as a percentage of the available source."
+            >
+                <EditorFieldRow htmlFor="document-search-window-sizing" label="Sizing mode" width="standard">
+                    <select
+                        id="document-search-window-sizing"
+                        className={SELECT_CLASS}
+                        value={sizingMode}
+                        disabled={readOnly}
+                        onChange={(event) => updateWindowSizing(event.target.value as WindowSizingMode)}
+                    >
+                        <option value="automatic">Automatic</option>
+                        <option value="fixed">Fixed size (N units)</option>
+                        <option value="percent">Percent of document (N%)</option>
+                    </select>
+                </EditorFieldRow>
+                {sizingMode === 'fixed' ? (
+                    <EditorFieldRow htmlFor="document-search-window-size" label="Fixed window size" help="Number of preferred units per summarization pass." width="standard">
+                        <input
+                            id="document-search-window-size"
+                            type="number"
+                            className={INPUT_CLASS}
+                            min={1}
+                            max={100}
+                            step={1}
+                            value={windowSize}
+                            disabled={readOnly}
+                            onChange={(event) => updateField('/additionalFields/default_window_size', numberValue(event.target.valueAsNumber, windowSize, 1, 100))}
+                        />
+                    </EditorFieldRow>
+                ) : null}
+                {sizingMode === 'percent' ? (
+                    <EditorFieldRow htmlFor="document-search-window-percent" label="Window percent" help="Percentage of the document to include in each first-pass summary window." width="standard">
+                        <input
+                            id="document-search-window-percent"
+                            type="number"
+                            className={INPUT_CLASS}
+                            min={1}
+                            max={100}
+                            step={1}
+                            value={windowPercent}
+                            disabled={readOnly}
+                            onChange={(event) => updateField('/additionalFields/default_window_percent', numberValue(event.target.valueAsNumber, windowPercent, 1, 100))}
+                        />
+                    </EditorFieldRow>
+                ) : null}
+            </EditorFieldset>
+            <EditorFieldRow
+                htmlFor="document-search-focus"
+                label="Default focus instructions"
+                help="Optional guidance for summaries. Examples: “emphasize security risks,” “extract open decisions,” or “focus on deadlines and owners.”"
+                width="wide"
+            >
+                <textarea
+                    id="document-search-focus"
+                    className={INPUT_CLASS}
+                    rows={3}
+                    value={String(fields.default_focus_instructions || '')}
+                    disabled={readOnly}
+                    onChange={(event) => updateField('/additionalFields/default_focus_instructions', event.target.value)}
+                />
+            </EditorFieldRow>
+            <TargetLengthControl
+                id="document-search-window-target"
+                label="Window summary target length"
+                help="Target length for each first-pass window summary. Stored as “N pages” for the backend summarization prompt."
+                min={1}
+                max={10}
+                value={fields.default_window_target_length || '2 pages'}
+                disabled={readOnly}
+                onChange={(value) => updateField('/additionalFields/default_window_target_length', value)}
+            />
+            <TargetLengthControl
+                id="document-search-final-target"
+                label="Final summary target length"
+                help="Target length for the final synthesized summary after all windows are reduced. Stored as “N pages”."
+                min={1}
+                max={20}
+                value={fields.default_final_target_length || '2 pages'}
+                disabled={readOnly}
+                onChange={(value) => updateField('/additionalFields/default_final_target_length', value)}
+            />
+        </div>
+    );
+}
diff --git a/application/v2_ui/src/components/workspaceActions/McpActionConfiguration.tsx b/application/v2_ui/src/components/workspaceActions/McpActionConfiguration.tsx
index bdf8a29f6..b3630ed69 100644
--- a/application/v2_ui/src/components/workspaceActions/McpActionConfiguration.tsx
+++ b/application/v2_ui/src/components/workspaceActions/McpActionConfiguration.tsx
@@ -3,10 +3,11 @@
 import { useEffect, useRef, useState } from 'react';
 import { GlassButton } from '../ui/primitives';
 import { EditorFieldset, EditorGroup, EditorPanel, EditorSwitch } from '../workspace/EditorLayout';
+import { ActionConnectionCheck } from './ActionConnectionCheck';
 import { ACTION_INPUT_CLASS, ActionField, ActionJsonInput, ActionSecretInput } from './ActionFields';
 import { ActionSchemaValue } from './ActionSchemaFields';
 import {
-    ConnectorFeedbackPanel, ConnectorIdentitySelect, useConnectorRequest, useConnectorValidity,
+    ConnectorIdentitySelect, useConnectorRequest, useConnectorValidity,
 } from './OpenApiActionConfiguration';
 import { EDITOR_SECRET_MASK, pointerPart } from '../../lib/workspaceAuthoring';
 import { actionHasStoredArraySecrets } from '../../lib/workspaceActionLogic';
@@ -15,9 +16,10 @@ import {
     allowedMcpAuthMethods, allowedMcpTransports, applyMcpPreconfiguration, applyMcpPreset,
     changeConnectorAuthMethod, connectorAuthMethod, connectorFeedback, connectorLines, connectorObject,
     connectorStrings, connectorText, discoverMcpAction, fetchMcpPreconfigurations, fetchMcpPresets,
-    MCP_AUTH_OPTIONS, MCP_GENERIC_PRESET, MCP_NUMBER_FIELDS, mcpHeaderNameError,
-    mcpImplementationFields, mcpToolChoices, mergeMcpTools, parseMcpTools, setMcpToolSelection,
-    testApiConnector, updateConnectorFields, validateApiConnector, validateConnectorAuthentication,
+    MCP_AUTH_OPTIONS, MCP_GENERIC_PRESET, MCP_NUMBER_FIELDS, mcpDiscoverySignature, mcpFingerprintChangeSummary,
+    mcpFingerprints, mcpHeaderNameError, mcpImplementationFields, mcpToolChoices, mergeMcpTools, parseMcpTools,
+    setMcpToolSelection,
+    updateConnectorFields, validateConnectorAuthentication,
     validateConnectorConfiguration, type McpCatalogEntry, type McpDiscoveryResult,
 } from '../../lib/workspaceActionConnectors';
 
@@ -195,28 +197,47 @@ export function McpActionConfiguration(props: ActionConnectorProps) {
     const [applyError, setApplyError] = useState<string | null>(null);
     const [toolSearch, setToolSearch] = useState('');
     const [toolLimit, setToolLimit] = useState(30);
-    const [discovery, setDiscovery] = useState<{ result: McpDiscoveryResult; endpoint: string; transport: string } | null>(null);
-    const { busy, feedback, stale, run } = useConnectorRequest(props);
+    const [discovery, setDiscovery] = useState<{
+        result: McpDiscoveryResult; endpoint: string; transport: string; signature: string; approvedBefore: unknown;
+    } | null>(null);
+    const { busy, run } = useConnectorRequest(props);
     useEffect(() => setPresetChoice(profile), [profile]);
     useEffect(() => setPreconfigurationChoice(preconfigurationId), [preconfigurationId]);
+    const serverTemplateChoice = preconfigurationChoice ? `pre:${preconfigurationChoice}` : presetChoice === 'generic' ? 'custom' : `preset:${presetChoice}`;
     const chosenPreset = catalogue.presets.find(({ id }) => id === presetChoice);
     const chosenPreconfiguration = catalogue.preconfigurations.find(({ id }) => id === preconfigurationChoice);
     const localErrors = validateConnectorConfiguration(draft, 'mcp', preset);
-    useConnectorValidity(props, 'mcp-configuration', Object.values(localErrors).join(' ') || null);
+    const currentDiscoverySignature = mcpDiscoverySignature(draft);
+    const originalDiscoverySignature = original ? mcpDiscoverySignature(original.record) : '';
+    const approvedFingerprints = mcpFingerprints(fields.mcp_tool_fingerprints);
+    const pinningError = readOnly || (original && currentDiscoverySignature === originalDiscoverySignature)
+        ? null
+        : discovery?.signature === currentDiscoverySignature && mcpFingerprints(discovery.result.fingerprints)
+            ? null
+            : 'Discover and approve MCP tools after changing the endpoint, transport, template, or authentication.';
+    useConnectorValidity(props, 'mcp-configuration', [...Object.values(localErrors), pinningError].filter(Boolean).join(' ') || null);
     const fieldError = (key: string) => errors[`additionalFields.${key}`] || localErrors[`additionalFields.${key}`];
     const updateField = (key: string, value: unknown) => onChange((current) => updateConnectorFields(current, { [key]: value }));
     const availableTransports = allowedMcpTransports(preset);
     const selectedTools = connectorStrings(fields.allowed_tool_names);
-    const lastDiscoveryMatches = discovery?.endpoint === draft.endpoint && discovery?.transport === transport;
+    const lastDiscoveryMatches = discovery?.signature === currentDiscoverySignature;
+    const discoveredChanges = discovery?.result.fingerprints
+        ? mcpFingerprintChangeSummary(discovery.approvedBefore, discovery.result.fingerprints)
+        : null;
+    const drift = connectorObject(fields.mcp_tool_drift);
     const choices = mcpToolChoices(fields.mcp_tools, selectedTools,
         lastDiscoveryMatches ? parseMcpTools(discovery?.result.tools).map(({ original_name }) => original_name) : undefined);
     const filteredTools = choices.filter(({ name, tool }) =>
         `${name} ${tool?.function_name || ''} ${tool?.description || ''}`.toLowerCase().includes(toolSearch.toLowerCase()));
     const blockedExecution = readOnly || Boolean(busy) || Object.keys(localErrors).length > 0;
     const doDiscovery = async () => {
+        const approvedBefore = fields.mcp_tool_fingerprints;
         const result = await run('Discovering MCP tools…', (signal) => discoverMcpAction(draft, original, signal, connectorTestScope(props)),
             (current, response) => updateConnectorFields(current, {
                 mcp_tools: mergeMcpTools(current.additionalFields.mcp_tools, response.tools, connectorStrings(current.additionalFields.allowed_tool_names)),
+                mcp_prompts: Array.isArray(response.prompts) ? response.prompts : [],
+                ...(response.fingerprints ? { mcp_tool_fingerprints: response.fingerprints } : {}),
+                mcp_tool_drift: null,
             }),
             (response) => ({
                 ...connectorFeedback(response),
@@ -226,79 +247,80 @@ export function McpActionConfiguration(props: ActionConnectorProps) {
                     ...(response.mcp_operation_id ? { operation_id: response.mcp_operation_id } : {}),
                 },
             }));
-        if (result) setDiscovery({ result, endpoint: draft.endpoint, transport });
+        if (result) setDiscovery({ result, endpoint: draft.endpoint, transport, signature: currentDiscoverySignature, approvedBefore });
     };
 
     return (
         <div className="min-w-0 space-y-6" data-testid="mcp-configuration">
-            <p className="text-[0.8125rem] leading-relaxed text-text-2">Connect to a Model Context Protocol server and expose its tools or prompts to agents. Server discovery and connection testing are explicit commands; selecting a template or saving an action never runs either.</p>
-            <EditorPanel title="Server starting points"
-                description="Choose a preconfiguration or compatibility preset, review it, then apply its defaults. Existing custom fields, secret state, identity references, and selected tools are retained.">
+            <p className="text-[0.8125rem] leading-relaxed text-text-2">Connect to one Model Context Protocol server. Choose either a ready-to-use server with a fixed endpoint, a vendor compatibility profile where you provide the endpoint, or a fully custom server.</p>
+            <EditorPanel title="Server template"
+                description="Server templates apply defaults only. Discovery, connection testing, and saving remain explicit steps. Existing secret state, identity references, and selected tools are retained.">
                 {catalogue.loading ? <p role="status" className="text-xs text-text-3">Loading MCP catalogues…</p> : null}
                 {catalogue.presetsError || catalogue.preconfigurationsError ? <div role="alert" className="alert alert-warning space-y-2 rounded-xl bg-warn-soft p-3 text-sm text-warn">
-                    {catalogue.presetsError ? <p>{catalogue.presetsError} The built-in generic preset remains available.</p> : null}
-                    {catalogue.preconfigurationsError ? <p>{catalogue.preconfigurationsError} This is not an empty catalogue; your saved selection is retained.</p> : null}
+                    {catalogue.presetsError ? <p>{catalogue.presetsError} The built-in custom-server profile remains available.</p> : null}
+                    {catalogue.preconfigurationsError ? <p>{catalogue.preconfigurationsError} Saved selections are retained.</p> : null}
                     <GlassButton type="button" size="sm" disabled={catalogue.loading} onClick={catalogue.retry}>Retry catalogues</GlassButton>
                 </div> : null}
-                {groupScoped ? (
-                    <p className="rounded-lg bg-panel-2 p-3 text-xs text-text-3">
-                        Saved MCP preconfigurations aren’t available for group actions yet. Choose a compatibility preset below or configure the server manually.
-                    </p>
-                ) : (<>
-                <ActionField id="mcp-preconfiguration" label="Preconfigured server">
-                    <select id="mcp-preconfiguration" className={ACTION_INPUT_CLASS} value={preconfigurationChoice} disabled={readOnly || catalogue.loading}
-                        onChange={(event) => setPreconfigurationChoice(event.target.value)}>
-                        <option value="">Custom configuration</option>
-                        {preconfigurationChoice && !chosenPreconfiguration ? <option value={preconfigurationChoice} disabled>Unavailable — {preconfigurationChoice}</option> : null}
-                        {catalogue.preconfigurations.map((entry) => <option key={entry.id} value={entry.id}>{entry.displayName}</option>)}
+                {groupScoped ? <p className="rounded-lg bg-panel-2 p-3 text-xs text-text-3">
+                    Ready-to-use server templates aren’t available for group actions yet. Choose a vendor profile or configure the server manually.
+                </p> : null}
+                <ActionField id="mcp-server-template" label="Server template">
+                    <select id="mcp-server-template" className={ACTION_INPUT_CLASS} value={serverTemplateChoice} disabled={readOnly || catalogue.loading}
+                        onChange={(event) => {
+                            const value = event.target.value;
+                            if (value === 'custom') {
+                                setPreconfigurationChoice('');
+                                setPresetChoice('generic');
+                            } else if (value.startsWith('pre:')) {
+                                setPreconfigurationChoice(value.slice(4));
+                            } else if (value.startsWith('preset:')) {
+                                setPreconfigurationChoice('');
+                                setPresetChoice(value.slice(7));
+                            }
+                        }}>
+                        <option value="custom">Custom server</option>
+                        {!groupScoped ? <optgroup label="Ready-to-use servers">
+                            {preconfigurationChoice && !chosenPreconfiguration ? <option value={`pre:${preconfigurationChoice}`} disabled>Unavailable — {preconfigurationChoice}</option> : null}
+                            {catalogue.preconfigurations.map((entry) => <option key={entry.id} value={`pre:${entry.id}`}>{entry.displayName}</option>)}
+                        </optgroup> : null}
+                        <optgroup label="Vendor compatibility profiles">
+                            {catalogue.presets.filter(({ id }) => id !== 'generic').map((entry) => <option key={entry.id} value={`preset:${entry.id}`}>{entry.displayName}</option>)}
+                        </optgroup>
                     </select>
                 </ActionField>
-                <McpCatalogueDetails entry={chosenPreconfiguration} />
-                {chosenPreconfiguration ? <p className="break-all text-xs text-text-3">Endpoint to apply: {chosenPreconfiguration.endpoint || 'No endpoint default'}</p> : null}
-                {preconfigurationId && !catalogue.preconfigurations.some(({ id }) => id === preconfigurationId) ? <p className="text-xs text-warn">Saved preconfiguration {preconfigurationId} is unavailable. Its implementation settings remain intact.</p> : null}
+                {chosenPreconfiguration ? <>
+                    <McpCatalogueDetails entry={chosenPreconfiguration} />
+                    <p className="break-all text-xs text-text-3">This ready-to-use server sets the endpoint to {chosenPreconfiguration.endpoint || 'its catalogue default'} and applies the {chosenPreconfiguration.presetId || 'generic'} compatibility profile.</p>
+                </> : <McpCatalogueDetails entry={presetChoice === 'generic' ? undefined : chosenPreset} />}
+                {preconfigurationId && !catalogue.preconfigurations.some(({ id }) => id === preconfigurationId) ? <p className="text-xs text-warn">Saved ready-to-use server {preconfigurationId} is unavailable. Its implementation settings remain intact.</p> : null}
+                {!preset && !chosenPreconfiguration ? <p className="text-xs text-warn">Saved vendor profile {profile} is unavailable. It has not been replaced.</p> : null}
                 <div><GlassButton type="button" variant="subtle"
-                    disabled={readOnly || Boolean(busy) || catalogue.loading || Boolean(preconfigurationChoice && !chosenPreconfiguration)}
+                    disabled={readOnly || Boolean(busy) || catalogue.loading || Boolean(chosenPreconfiguration && !catalogue.presets.some(({ id }) => id === (chosenPreconfiguration.presetId || 'generic'))) || Boolean(!chosenPreconfiguration && presetChoice !== 'generic' && !chosenPreset)}
                     onClick={() => {
-                        if (!chosenPreconfiguration) {
+                        if (serverTemplateChoice === 'custom') {
                             updateField('preconfiguration_id', '');
+                            updateField('server_profile', 'generic');
                             setApplyError(null);
                             return;
                         }
-                        const basePreset = catalogue.presets.find(({ id }) => id === (chosenPreconfiguration.presetId || 'generic'));
-                        if (!basePreset) { setApplyError('Load the preconfiguration’s compatibility preset before applying it.'); return; }
                         try {
-                            applyMcpPreconfiguration(draft, chosenPreconfiguration, basePreset);
-                            onChange((current) => applyMcpPreconfiguration(current, chosenPreconfiguration, basePreset));
+                            if (chosenPreconfiguration) {
+                                const basePreset = catalogue.presets.find(({ id }) => id === (chosenPreconfiguration.presetId || 'generic'));
+                                if (!basePreset) { setApplyError('Load the ready-to-use server’s compatibility profile before applying it.'); return; }
+                                onChange((current) => applyMcpPreconfiguration(current, chosenPreconfiguration, basePreset));
+                            } else if (chosenPreset) {
+                                onChange((current) => {
+                                    const next = applyMcpPreset(current, chosenPreset);
+                                    return { ...next, additionalFields: { ...next.additionalFields, preconfiguration_id: '' } };
+                                });
+                            }
                             setApplyError(null);
                         } catch (error) {
-                            setApplyError(error instanceof Error ? error.message : 'Could not apply the preconfiguration.');
+                            setApplyError(error instanceof Error ? error.message : 'Could not apply the server template.');
                         }
                     }}>
-                    {preconfigurationChoice ? 'Apply server preconfiguration' : 'Use custom configuration'}
+                    {serverTemplateChoice === 'custom' ? 'Use custom server' : 'Apply server template'}
                 </GlassButton></div>
-                </>)}
-                <div className="space-y-3 border-t border-edge pt-3">
-                    <ActionField id="mcp-preset" label="Compatibility preset">
-                        <select id="mcp-preset" className={ACTION_INPUT_CLASS} value={presetChoice} disabled={readOnly || catalogue.loading}
-                            onChange={(event) => setPresetChoice(event.target.value)}>
-                            {!chosenPreset ? <option value={presetChoice} disabled>Unavailable — {presetChoice}</option> : null}
-                            {catalogue.presets.map((entry) => <option key={entry.id} value={entry.id}>{entry.displayName}</option>)}
-                        </select>
-                    </ActionField>
-                    <McpCatalogueDetails entry={chosenPreset} />
-                    {!preset ? <p className="text-xs text-warn">Saved preset {profile} is unavailable. It has not been replaced.</p> : null}
-                    <div><GlassButton type="button" variant="subtle" disabled={readOnly || Boolean(busy) || !chosenPreset || catalogue.loading}
-                        onClick={() => {
-                            if (!chosenPreset) return;
-                            try {
-                                applyMcpPreset(draft, chosenPreset);
-                                onChange((current) => applyMcpPreset(current, chosenPreset));
-                                setApplyError(null);
-                            } catch (error) {
-                                setApplyError(error instanceof Error ? error.message : 'Could not apply the preset.');
-                            }
-                        }}>Apply preset defaults</GlassButton></div>
-                </div>
                 {applyError ? <p role="alert" className="text-sm text-danger">{applyError}</p> : null}
             </EditorPanel>
             <div className="min-w-0">
@@ -359,10 +381,25 @@ export function McpActionConfiguration(props: ActionConnectorProps) {
                 {!selectedTools.length ? <p className="alert alert-warning rounded-lg bg-warn-soft p-2 text-xs text-warn">No tool allowlist is configured. All server tools may be exposed when Load tools is enabled.</p> : null}
                 <div className="flex flex-wrap items-center gap-2">
                     <GlassButton type="button" variant="subtle" disabled={blockedExecution} onClick={() => void doDiscovery()}>Discover MCP tools</GlassButton>
-                    <p className="text-xs text-text-3">Discovery connects and lists tools; it does not invoke them.</p>
+                    <p className="text-xs text-text-3">Discovery connects, lists tools and prompts, and records approved fingerprints. It does not invoke tools.</p>
                 </div>
+                {pinningError ? <p role="alert" className="alert alert-warning rounded-lg bg-warn-soft p-2 text-xs text-warn">{pinningError}</p> : null}
+                {approvedFingerprints ? <p className="text-xs text-text-3">Approved manifest: <span className="font-mono">{approvedFingerprints.manifest_hash.slice(0, 12)}</span> · discovered {approvedFingerprints.discovered_at}</p> : null}
+                {Object.keys(drift).length ? <div className="alert alert-warning space-y-1 rounded-lg bg-warn-soft p-2 text-xs text-warn">
+                    <p className="font-medium">Tools changed — review required.</p>
+                    {['new', 'changed', 'removed', 'prompts_new', 'prompts_changed', 'prompts_removed'].map((key) => connectorStrings(drift[key]).length ? <p key={key}>{key.replaceAll('_', ' ')}: {connectorStrings(drift[key]).join(', ')}</p> : null)}
+                </div> : null}
                 {discovery ? <EditorPanel title="Last discovery capabilities">
                     {!lastDiscoveryMatches ? <p className="text-xs text-warn">The endpoint or transport changed after this discovery. Run discovery again to verify the current server.</p> : null}
+                    {discoveredChanges?.hasChanges ? <div className="alert alert-warning space-y-1 rounded-lg bg-warn-soft p-2 text-xs text-warn">
+                        <p className="font-medium">Discovery differs from the previously approved manifest. Saving will approve this new manifest.</p>
+                        {discoveredChanges.new.length ? <p>New tools: {discoveredChanges.new.join(', ')}</p> : null}
+                        {discoveredChanges.changed.length ? <p>Changed tools: {discoveredChanges.changed.join(', ')}</p> : null}
+                        {discoveredChanges.removed.length ? <p>Removed tools: {discoveredChanges.removed.join(', ')}</p> : null}
+                        {discoveredChanges.promptsNew.length ? <p>New prompts: {discoveredChanges.promptsNew.join(', ')}</p> : null}
+                        {discoveredChanges.promptsChanged.length ? <p>Changed prompts: {discoveredChanges.promptsChanged.join(', ')}</p> : null}
+                        {discoveredChanges.promptsRemoved.length ? <p>Removed prompts: {discoveredChanges.promptsRemoved.join(', ')}</p> : null}
+                    </div> : null}
                     <dl className="grid gap-2 text-xs text-text-2 sm:grid-cols-2">
                         {Object.entries(connectorObject(discovery.result.capabilities)).map(([key, value]) =>
                             ['string', 'boolean', 'number'].includes(typeof value) ? <div key={key}>
@@ -441,19 +478,6 @@ export function McpActionConfiguration(props: ActionConnectorProps) {
                     </ActionField>)}
                 </div>
             </EditorPanel>
-            <EditorPanel title="Validate and test"
-                description="The connection test initializes a server session and lists its tools. It does not invoke tools or save discovered metadata. Authentication is configured in the Authentication section.">
-                <div className="flex flex-wrap items-center gap-2">
-                    <GlassButton type="button" variant="subtle" disabled={blockedExecution}
-                        onClick={() => void run('Validating MCP configuration…', (signal) => validateApiConnector(draft, original, 'mcp', signal, connectorTestScope(props)))}>Validate MCP configuration</GlassButton>
-                    <GlassButton type="button" variant="subtle" disabled={blockedExecution}
-                        onClick={() => void run('Testing MCP connection…', (signal) => testApiConnector(draft, original, 'mcp', signal, connectorTestScope(props)))}>Test MCP connection</GlassButton>
-                    {busy ? <p role="status" className="text-sm text-text-3">{busy}</p> : null}
-                </div>
-                {readOnly ? <p className="text-xs text-text-3">Provided actions are read-only. Discovery and connection testing are disabled.</p> : null}
-                {!readOnly && Object.keys(localErrors).length ? <p className="text-xs text-text-3">Resolve the highlighted configuration errors before validating or connecting.</p> : null}
-                <ConnectorFeedbackPanel feedback={feedback} stale={stale} />
-            </EditorPanel>
         </div>
     );
 }
@@ -555,6 +579,8 @@ export function McpActionAuthentication(props: ActionConnectorProps) {
                     <p className="text-xs text-text-3">{Object.keys(headers).length}/20 headers. Values may contain up to 4096 characters and must not contain line breaks.</p>
                 </div> : null}
             </EditorPanel>
+            <ActionConnectionCheck props={props} kind="mcp"
+                configurationError={Object.keys(validateConnectorConfiguration(draft, 'mcp', preset)).length > 0} />
         </div>
     );
 }
diff --git a/application/v2_ui/src/components/workspaceActions/OpenApiActionConfiguration.tsx b/application/v2_ui/src/components/workspaceActions/OpenApiActionConfiguration.tsx
index 0eea2934e..6deabec08 100644
--- a/application/v2_ui/src/components/workspaceActions/OpenApiActionConfiguration.tsx
+++ b/application/v2_ui/src/components/workspaceActions/OpenApiActionConfiguration.tsx
@@ -3,20 +3,25 @@
 import { useEffect, useMemo, useRef, useState } from 'react';
 import { GlassButton } from '../ui/primitives';
 import { EditorGroup, EditorPanel, EditorRow } from '../workspace/EditorLayout';
+import { ActionConnectionCheck, useConnectorRequest } from './ActionConnectionCheck';
 import { ActionField, ActionSecretInput, ACTION_INPUT_CLASS } from './ActionFields';
-import { connectorTestScope, type ActionConnectorProps } from '../../lib/workspaceActionTypes';
+import type { ActionConnectorProps } from '../../lib/workspaceActionTypes';
 import { EDITOR_SECRET_MASK, type ActionConfiguration } from '../../lib/workspaceAuthoring';
 import {
     applyOpenApiSpecification, changeConnectorAuthMethod, changeOpenApiBasicCredential,
-    connectorAuthMethod, connectorFeedback, connectorIdentityOptions, connectorObject,
-    connectorSecretField, connectorText, connectorUrlError, OPENAPI_AUTH_OPTIONS,
-    OPENAPI_SOURCE_OPTIONS, openApiBasicCredentials, openApiInformation, openApiSourceDraft, processOpenApiText,
-    selectConnectorIdentity, testApiConnector, updateConnectorFields, updateOpenApiSourceDraft,
-    uploadOpenApiSpecification, validateApiConnector, validateConnectorAuthentication,
+    connectorAuthMethod, connectorIdentityOptions, connectorObject,
+    connectorSecretField, connectorStrings, connectorText, connectorUrlError, OPENAPI_AUTH_OPTIONS,
+    OPENAPI_SOURCE_OPTIONS, openApiBaseUrlOverrideEnabled, openApiBasicCredentials, openApiInformation, openApiOperationKey,
+    openApiSourceDraft, openApiSpecificationBaseUrl, processOpenApiText,
+    selectConnectorIdentity, updateConnectorFields, updateOpenApiSourceDraft,
+    uploadOpenApiSpecification, validateConnectorAuthentication,
     validateConnectorConfiguration,
     type ApiConnector, type ConnectorFeedback, type OpenApiUploadResult,
 } from '../../lib/workspaceActionConnectors';
 
+export { ConnectorFeedbackPanel, useConnectorRequest } from './ActionConnectionCheck';
+export { testWorkspaceAction } from '../../lib/workspaceActionServices';
+
 export function useConnectorValidity(props: ActionConnectorProps, key: string, message: string | null) {
     const callback = useRef(props.onValidityChange);
     callback.current = props.onValidityChange;
@@ -27,98 +32,6 @@ export function useConnectorValidity(props: ActionConnectorProps, key: string, m
     }, [key, message, readOnly]);
 }
 
-export function useConnectorRequest(props: ActionConnectorProps) {
-    const latest = useRef(props);
-    latest.current = props;
-    const activeRequest = useRef<{
-        controller: AbortController;
-        draft: ActionConfiguration;
-        original: ActionConnectorProps['original'];
-    } | null>(null);
-    const [busy, setBusy] = useState<string | null>(null);
-    const [feedback, setFeedback] = useState<{ value: ConnectorFeedback; draft: ActionConfiguration } | null>(null);
-
-    useEffect(() => {
-        const active = activeRequest.current;
-        if (active && (active.draft !== props.draft || active.original !== props.original || props.readOnly || props.original?.read_only)) {
-            active.controller.abort();
-            activeRequest.current = null;
-            setBusy(null);
-        }
-    }, [props.draft, props.original, props.readOnly]);
-    useEffect(() => () => {
-        activeRequest.current?.controller.abort();
-        activeRequest.current = null;
-    }, []);
-
-    async function run<T>(
-        label: string,
-        operation: (signal: AbortSignal) => Promise<T>,
-        apply?: (draft: ActionConfiguration, result: T) => ActionConfiguration,
-        describe?: (result: T) => ConnectorFeedback,
-    ): Promise<T | undefined> {
-        const snapshot = latest.current;
-        if (snapshot.readOnly || snapshot.original?.read_only) return;
-        activeRequest.current?.controller.abort();
-        const request = new AbortController();
-        activeRequest.current = { controller: request, draft: snapshot.draft, original: snapshot.original };
-        setBusy(label);
-        try {
-            const response = await operation(request.signal);
-            if (request.signal.aborted || latest.current.draft !== snapshot.draft ||
-                latest.current.original !== snapshot.original || latest.current.readOnly) return;
-            const value = describe ? describe(response) : connectorFeedback(response);
-            let resultDraft = snapshot.draft;
-            if (value.success && apply) {
-                resultDraft = apply(snapshot.draft, response);
-                snapshot.onChange((current) => current === snapshot.draft ? resultDraft : current);
-            }
-            setFeedback({ value, draft: resultDraft });
-            return value.success ? response : undefined;
-        } catch (error) {
-            if (!request.signal.aborted && latest.current.draft === snapshot.draft &&
-                latest.current.original === snapshot.original) {
-                setFeedback({ value: connectorFeedback(error), draft: snapshot.draft });
-            }
-            return undefined;
-        } finally {
-            if (activeRequest.current?.controller === request) {
-                activeRequest.current = null;
-                setBusy(null);
-            }
-        }
-    }
-    return { busy, feedback: feedback?.value ?? null, stale: Boolean(feedback && feedback.draft !== props.draft), run };
-}
-
-export function ConnectorFeedbackPanel({ feedback, stale }: { feedback: ConnectorFeedback | null; stale?: boolean }) {
-    if (!feedback) return null;
-    const details = Object.entries(feedback.details).filter(([, value]) => ['string', 'number', 'boolean'].includes(typeof value));
-    return (
-        <div role={feedback.success ? 'status' : 'alert'} aria-live="polite"
-            className={`alert rounded-xl border p-3 text-sm ${feedback.success
-                ? 'alert-success border-edge bg-surface-2 text-text-1'
-                : 'alert-danger border-danger/30 bg-danger-soft text-danger'}`}>
-            <p className="break-words">{feedback.message}</p>
-            {stale ? <p className="mt-1 text-xs text-text-3">This result describes an earlier draft. Run the command again to check your current configuration.</p> : null}
-            {feedback.errors.length ? <ul className="mt-2 list-disc space-y-1 pl-5">
-                {feedback.errors.map((message, index) => <li key={index} className="break-words">{message}</li>)}
-            </ul> : null}
-            {feedback.warnings.length ? <div className="alert alert-warning mt-2 rounded-lg bg-warn-soft p-2 text-warn">
-                <p className="font-medium">Warnings</p>
-                <ul className="list-disc space-y-1 pl-5">
-                    {feedback.warnings.map((message, index) => <li key={index} className="break-words">{message}</li>)}
-                </ul>
-            </div> : null}
-            {details.length ? <dl className="mt-2 grid gap-1 text-xs text-text-2">
-                {details.map(([name, value]) => <div key={name} className="flex flex-wrap gap-x-2">
-                    <dt className="font-medium">{name.replaceAll('_', ' ')}:</dt><dd className="break-all">{String(value)}</dd>
-                </div>)}
-            </dl> : null}
-        </div>
-    );
-}
-
 export function ConnectorIdentitySelect({ kind, ...props }: ActionConnectorProps & { kind: ApiConnector }) {
     const selectedId = props.draft.identity_id || '';
     const { identities, unavailable } = connectorIdentityOptions(props.identities, kind, selectedId);
@@ -163,6 +76,40 @@ export function ConnectorIdentitySelect({ kind, ...props }: ActionConnectorProps
     );
 }
 
+function updateOpenApiAllowedOperations(draft: ActionConfiguration, selectedKeys: string[], allKeys: string[]): ActionConfiguration {
+    const additionalFields = { ...draft.additionalFields };
+    const uniqueKeys = [...new Set(selectedKeys)].filter((key) => allKeys.includes(key));
+    if (uniqueKeys.length === allKeys.length) {
+        delete additionalFields.allowed_operations;
+        delete additionalFields.openapi_operations_disabled_all;
+    } else if (!uniqueKeys.length) {
+        additionalFields.allowed_operations = [];
+        additionalFields.openapi_operations_disabled_all = true;
+    } else {
+        additionalFields.allowed_operations = uniqueKeys;
+        delete additionalFields.openapi_operations_disabled_all;
+    }
+    return { ...draft, additionalFields };
+}
+
+function clearOpenApiSpecification(draft: ActionConfiguration): ActionConfiguration {
+    const additionalFields = { ...draft.additionalFields };
+    const keepOverride = openApiBaseUrlOverrideEnabled(draft);
+    delete additionalFields.openapi_spec_content;
+    delete additionalFields.openapi_source_type;
+    delete additionalFields.allowed_operations;
+    delete additionalFields.openapi_operations_disabled_all;
+    if (!keepOverride) {
+        additionalFields.base_url = '';
+        additionalFields.base_url_override = false;
+    }
+    return updateOpenApiSourceDraft({
+        ...draft,
+        endpoint: keepOverride ? draft.endpoint : '',
+        additionalFields,
+    }, { filename: '', text: '{}', pending: false });
+}
+
 export function OpenApiActionConfiguration(props: ActionConnectorProps) {
     const { draft, original, onChange, errors } = props;
     const readOnly = props.readOnly || Boolean(original?.read_only);
@@ -170,11 +117,31 @@ export function OpenApiActionConfiguration(props: ActionConnectorProps) {
     const source = useMemo(() => openApiSourceDraft(draft), [draft._openApiSourceDraft, specContent]);
     const information = useMemo(() => openApiInformation(specContent), [specContent]);
     const specJson = useMemo(() => JSON.stringify(specContent, null, 2), [specContent]);
+    const specBaseUrl = useMemo(() => openApiSpecificationBaseUrl(specContent), [specContent]);
+    const baseUrlOverride = openApiBaseUrlOverrideEnabled(draft, specContent);
+    const fileInputRef = useRef<HTMLInputElement | null>(null);
     const localErrors = validateConnectorConfiguration(draft, 'openapi');
-    const { busy, feedback, stale, run } = useConnectorRequest(props);
+    const { busy, run } = useConnectorRequest(props);
     const [operationSearch, setOperationSearch] = useState('');
     const [operationLimit, setOperationLimit] = useState(30);
     useConnectorValidity(props, 'openapi-configuration', Object.values(localErrors).join(' ') || null);
+    const operationKeys = useMemo(() => information.operations.map(openApiOperationKey), [information.operations]);
+    const storedAllowedOperations = connectorStrings(draft.additionalFields.allowed_operations);
+    const operationsDisabledAll = draft.additionalFields.openapi_operations_disabled_all === true;
+    const enabledOperationKeys = useMemo(() => {
+        if (operationsDisabledAll) return new Set<string>();
+        if (storedAllowedOperations.length) return new Set(storedAllowedOperations);
+        return new Set(operationKeys);
+    }, [operationKeys, operationsDisabledAll, storedAllowedOperations]);
+    const enabledOperationCount = operationKeys.filter((key) => enabledOperationKeys.has(key)).length;
+    const baseUrlValue = connectorText(draft.endpoint || draft.additionalFields.base_url) || specBaseUrl;
+
+    useEffect(() => {
+        if (readOnly || typeof draft.additionalFields.base_url_override === 'boolean' || !baseUrlOverride) return;
+        onChange((current) => current === draft
+            ? { ...current, additionalFields: { ...current.additionalFields, base_url_override: true } }
+            : current);
+    }, [baseUrlOverride, draft, onChange, readOnly]);
 
     const filteredOperations = information.operations.filter((operation) =>
         `${operation.method} ${operation.path} ${operation.id} ${operation.summary} ${operation.tags.join(' ')}`
@@ -205,14 +172,26 @@ export function OpenApiActionConfiguration(props: ActionConnectorProps) {
                 <ActionField id="openapi-file" label="OpenAPI specification file"
                     help="JSON, YAML, or YML, up to 5 MB. Validation uses the same server-side scanner as the classic editor. A failed import leaves the current specification unchanged."
                     error={errors['additionalFields.openapi_spec_content'] || (!draft.additionalFields.openapi_spec_content ? localErrors['additionalFields.openapi_spec_content'] : undefined)}>
-                    <input id="openapi-file" type="file" accept=".json,.yaml,.yml" className={ACTION_INPUT_CLASS}
+                    <input ref={fileInputRef} id="openapi-file" type="file" accept=".json,.yaml,.yml" className="visually-hidden"
                         disabled={readOnly || Boolean(busy)} aria-describedby="openapi-file-help"
                         onChange={(event) => {
                             const file = event.target.files?.[0];
                             event.target.value = '';
                             if (file) void run('Validating specification…', (signal) => uploadOpenApiSpecification(file, file.name, signal), applyUpload, uploadFeedback);
                         }} />
-                    {source.filename ? <p className="mt-2 break-words text-xs text-text-3">Last imported: {source.filename}</p> : null}
+                    <div className="flex flex-wrap items-center gap-2">
+                        <GlassButton type="button" variant="subtle" disabled={readOnly || Boolean(busy)}
+                            onClick={() => fileInputRef.current?.click()}>
+                            {source.filename ? 'Replace file' : 'Choose OpenAPI file'}
+                        </GlassButton>
+                        {source.filename ? <GlassButton type="button" variant="ghost" disabled={readOnly || Boolean(busy)}
+                            onClick={() => onChange((current) => clearOpenApiSpecification(current))}>
+                            Remove file
+                        </GlassButton> : null}
+                    </div>
+                    {source.filename ? <p className="mt-2 break-words text-sm text-text-2">
+                        Selected specification: <span className="font-medium text-text-1">{source.filename}</span>
+                    </p> : <p className="mt-2 text-sm text-text-3">No OpenAPI file selected.</p>}
                     <p className="mt-2 text-xs text-text-3">
                         For a specification hosted at a URL, download the JSON or YAML file, then upload it here.
                         SimpleChat does not fetch remote specifications.
@@ -253,15 +232,40 @@ export function OpenApiActionConfiguration(props: ActionConnectorProps) {
                 </div>
             )}
             <ActionField id="openapi-base-url" label="API base URL" required
-                help="The URL against which the imported operations run. Changing it does not fetch or replace the specification."
+                help="By default this comes from the imported specification's servers entry. Turn on Override base URL only when the deployed API is hosted somewhere else."
                 error={errors.endpoint || localErrors.endpoint}>
-                <input id="openapi-base-url" type="url" value={draft.endpoint || connectorText(draft.additionalFields.base_url)}
-                    disabled={readOnly} className={ACTION_INPUT_CLASS} placeholder="https://api.example.com"
+                <div className="space-y-3">
+                    <label className="flex items-center gap-2 text-sm text-text-2">
+                        <input type="checkbox" className="form-check-input" checked={baseUrlOverride} disabled={readOnly}
+                            onChange={(event) => {
+                                const enabled = event.target.checked;
+                                onChange((current) => {
+                                    const currentSpecBaseUrl = openApiSpecificationBaseUrl(current.additionalFields.openapi_spec_content);
+                                    const currentBaseUrl = connectorText(current.endpoint || current.additionalFields.base_url);
+                                    const baseUrl = enabled ? currentBaseUrl : currentSpecBaseUrl;
+                                    return {
+                                        ...current,
+                                        endpoint: baseUrl,
+                                        additionalFields: { ...current.additionalFields, base_url: baseUrl, base_url_override: enabled },
+                                    };
+                                });
+                            }} />
+                        <span>Override base URL</span>
+                    </label>
+                    <input id="openapi-base-url" type="url" value={baseUrlValue}
+                    readOnly={!baseUrlOverride} disabled={readOnly} className={ACTION_INPUT_CLASS} placeholder="https://api.example.com"
                     aria-invalid={Boolean(errors.endpoint || localErrors.endpoint)} aria-describedby="openapi-base-url-help openapi-base-url-error"
                     onChange={(event) => {
                         const endpoint = event.target.value;
-                        onChange((current) => ({ ...current, endpoint, additionalFields: { ...current.additionalFields, base_url: endpoint } }));
+                        onChange((current) => ({
+                            ...current,
+                            endpoint,
+                            additionalFields: { ...current.additionalFields, base_url: endpoint, base_url_override: true },
+                        }));
                     }} />
+                    {!baseUrlOverride && specBaseUrl ? <p className="text-xs text-text-3">Using the specification server: <span className="break-all font-mono">{specBaseUrl}</span></p> : null}
+                    {!baseUrlOverride && !specBaseUrl ? <p className="text-xs text-warn">The specification does not declare a usable server URL. Turn on Override base URL to enter one before saving.</p> : null}
+                </div>
             </ActionField>
             {information.servers.length ? <EditorRow heading="Servers declared in the specification">
                 <ul className="space-y-2">
@@ -272,7 +276,7 @@ export function OpenApiActionConfiguration(props: ActionConnectorProps) {
                         </div>
                         {!readOnly ? <GlassButton type="button" size="sm" variant="subtle" disabled={Boolean(connectorUrlError(server.url))}
                             onClick={() => onChange((current) => ({
-                                ...current, endpoint: server.url, additionalFields: { ...current.additionalFields, base_url: server.url },
+                                ...current, endpoint: server.url, additionalFields: { ...current.additionalFields, base_url: server.url, base_url_override: false },
                             }))}>Use this base URL</GlassButton> : null}
                     </li>)}
                 </ul>
@@ -286,17 +290,43 @@ export function OpenApiActionConfiguration(props: ActionConnectorProps) {
                             setOperationSearch(event.target.value); setOperationLimit(30);
                         }} />
                 </ActionField>
-                <p className="text-xs text-text-3">{filteredOperations.length} matching operations. This is a read-only description, not an operation runner.</p>
+                <div className="flex flex-wrap items-center gap-2">
+                    <GlassButton type="button" size="sm" variant="subtle" disabled={readOnly || !operationKeys.length}
+                        onClick={() => onChange((current) => updateOpenApiAllowedOperations(current, operationKeys, operationKeys))}>
+                        Enable all
+                    </GlassButton>
+                    <GlassButton type="button" size="sm" variant="ghost" disabled={readOnly || !operationKeys.length}
+                        onClick={() => onChange((current) => updateOpenApiAllowedOperations(current, [], operationKeys))}>
+                        Disable all
+                    </GlassButton>
+                    <p className="text-xs text-text-3">
+                        {enabledOperationCount} of {operationKeys.length} operations enabled. Empty saved allow-lists mean all operations for backward compatibility, so saving is blocked if you disable every operation.
+                    </p>
+                </div>
+                {localErrors['additionalFields.allowed_operations'] ? <p role="alert" className="text-sm text-danger">{localErrors['additionalFields.allowed_operations']}</p> : null}
+                <p className="text-xs text-text-3">{filteredOperations.length} matching operations. Enable switches control which functions agents can see and call.</p>
                 <div className="space-y-2">
-                    {filteredOperations.slice(0, operationLimit).map((operation) => <details key={`${operation.method}:${operation.path}`} className="rounded-lg border border-edge bg-surface-1 p-3">
+                    {filteredOperations.slice(0, operationLimit).map((operation) => <details key={operation.key} className="rounded-lg border border-edge bg-surface-1 p-3">
                         <summary className="cursor-pointer break-words text-sm text-text-1">
-                            <span className="mr-2 font-mono font-semibold">{operation.method}</span>
-                            <span className="break-all font-mono text-xs">{operation.path}</span>
-                            {operation.summary ? <span className="ml-2">{operation.summary}</span> : null}
-                            {operation.deprecated ? <span className="ml-2 text-xs text-warn">Deprecated</span> : null}
+                            <span className="inline-flex min-w-0 flex-wrap items-center gap-2">
+                                <span className="font-mono font-semibold">{operation.method}</span>
+                                <span className="break-all font-mono text-xs">{operation.path}</span>
+                                {operation.summary ? <span>{operation.summary}</span> : null}
+                                {operation.deprecated ? <span className="text-xs text-warn">Deprecated</span> : null}
+                            </span>
                         </summary>
                         <div className="mt-3 space-y-3 text-xs text-text-2">
-                            <p>Operation ID: <span className="break-all font-mono">{operation.id || 'Generated by the connector'}</span></p>
+                            <label className="flex items-center gap-2 text-sm text-text-1">
+                                <input type="checkbox" className="form-check-input" checked={enabledOperationKeys.has(operation.key)} disabled={readOnly}
+                                    onChange={(event) => {
+                                        const selected = new Set(operationKeys.filter((key) => enabledOperationKeys.has(key)));
+                                        if (event.target.checked) selected.add(operation.key);
+                                        else selected.delete(operation.key);
+                                        onChange((current) => updateOpenApiAllowedOperations(current, [...selected], operationKeys));
+                                    }} />
+                                <span>{enabledOperationKeys.has(operation.key) ? 'Enabled' : 'Disabled'}</span>
+                            </label>
+                            <p>Operation key: <span className="break-all font-mono">{operation.key}</span>{operation.id ? null : ' (generated by the connector)'}</p>
                             {operation.description ? <p className="whitespace-pre-wrap break-words">{operation.description}</p> : null}
                             {operation.tags.length ? <p>Tags: {operation.tags.join(', ')}</p> : null}
                             {operation.parameters.length ? <ul className="space-y-2">
@@ -317,22 +347,6 @@ export function OpenApiActionConfiguration(props: ActionConnectorProps) {
                     <pre className="max-h-96 overflow-auto whitespace-pre-wrap break-all rounded-lg bg-surface-1 p-3 text-xs text-text-3">{specJson}</pre>
                 </EditorGroup>
             </EditorPanel> : null}
-            <EditorPanel title="Validate and test"
-                description="Validation checks the manifest without running it. Connection testing parses the specification and probes the authenticated base URL; it does not invoke an individual API operation.">
-                <div className="flex flex-wrap items-center gap-2">
-                    <GlassButton type="button" variant="subtle" disabled={readOnly || Boolean(busy) || source.pending}
-                        onClick={() => void run('Validating configuration…', (signal) => validateApiConnector(draft, original, 'openapi', signal, connectorTestScope(props)))}>
-                        Validate OpenAPI configuration
-                    </GlassButton>
-                    <GlassButton type="button" variant="subtle" disabled={readOnly || Boolean(busy) || source.pending}
-                        onClick={() => void run('Testing OpenAPI connection…', (signal) => testApiConnector(draft, original, 'openapi', signal, connectorTestScope(props)))}>
-                        Test OpenAPI connection
-                    </GlassButton>
-                    {busy ? <p role="status" className="text-sm text-text-3">{busy}</p> : null}
-                </div>
-                {readOnly ? <p className="text-xs text-text-3">Provided actions are read-only. Import, validation, and connection testing are disabled.</p> : null}
-                <ConnectorFeedbackPanel feedback={feedback} stale={stale} />
-            </EditorPanel>
         </div>
     );
 }
@@ -346,7 +360,9 @@ export function OpenApiActionAuthentication(props: ActionConnectorProps) {
     const basic = openApiBasicCredentials(draft);
     const specContent = draft.additionalFields.openapi_spec_content;
     const information = useMemo(() => openApiInformation(specContent), [specContent]);
+    const source = useMemo(() => openApiSourceDraft(draft), [draft._openApiSourceDraft, specContent]);
     const localErrors = validateConnectorAuthentication(draft, 'openapi', original);
+    const configurationErrors = validateConnectorConfiguration(draft, 'openapi');
     useConnectorValidity(props, 'openapi-authentication', Object.values(localErrors).join(' ') || null);
     const location = connectorText(draft.additionalFields.api_key_location ?? draft.auth.location ?? 'header');
     const usernameMasked = draft.auth.username === EDITOR_SECRET_MASK || draft.auth.identity === EDITOR_SECRET_MASK;
@@ -431,6 +447,9 @@ export function OpenApiActionAuthentication(props: ActionConnectorProps) {
                 </div>)}
             </EditorPanel> : null}
             {Object.keys(connectorObject(draft.additionalFields.openapi_authentication)).length ? <p className="text-xs text-text-3">Legacy authentication analysis is retained in additional fields.</p> : null}
+            {Object.values(configurationErrors).length ? <p className="text-xs text-warn">{Object.values(configurationErrors).join(' ')}</p> : null}
+            <ActionConnectionCheck props={props} kind="openapi" disabled={source.pending}
+                configurationError={Object.values(configurationErrors).length > 0} />
         </div>
     );
 }
diff --git a/application/v2_ui/src/lib/workspaceActionConnectors.ts b/application/v2_ui/src/lib/workspaceActionConnectors.ts
index 928d36812..b155a4e9c 100644
--- a/application/v2_ui/src/lib/workspaceActionConnectors.ts
+++ b/application/v2_ui/src/lib/workspaceActionConnectors.ts
@@ -216,6 +216,7 @@ export function connectorUrlError(value: unknown, websocket = false): string | n
 }
 
 export interface OpenApiOperation {
+    key: string;
     id: string;
     method: string;
     path: string;
@@ -251,6 +252,16 @@ export interface OpenApiInformation {
     securitySchemes: OpenApiSecurityScheme[];
 }
 
+export function openApiOperationKeyFromParts(method: string, path: string, operationId?: unknown): string {
+    const explicit = connectorText(operationId).trim();
+    if (explicit) return explicit;
+    return `${method.toLowerCase()}_${path.replaceAll('/', '_').replaceAll('{', '').replaceAll('}', '')}`;
+}
+
+export function openApiOperationKey(operation: Pick<OpenApiOperation, 'id' | 'method' | 'path'>): string {
+    return openApiOperationKeyFromParts(operation.method, operation.path, operation.id);
+}
+
 function resolveSpecObject(spec: Record<string, unknown>, value: unknown): Record<string, unknown> {
     let current = connectorObject(value);
     const visited = new Set<string>();
@@ -298,8 +309,10 @@ export function openApiInformation(value: unknown): OpenApiInformation {
             }
             const body = resolveSpecObject(spec, operation.requestBody);
             const security = operation.security ?? spec.security;
+            const operationId = connectorText(operation.operationId);
             operations.push({
-                id: connectorText(operation.operationId), method: method.toUpperCase(), path,
+                key: openApiOperationKeyFromParts(method, path, operationId),
+                id: operationId, method: method.toUpperCase(), path,
                 summary: connectorText(operation.summary), description: connectorText(operation.description),
                 deprecated: operation.deprecated === true, tags: connectorStrings(operation.tags),
                 parameters: [...parameterMap.values()], bodyRequired: body.required === true,
@@ -308,6 +321,7 @@ export function openApiInformation(value: unknown): OpenApiInformation {
                 security: Array.isArray(security) ? security.flatMap((entry) => Object.keys(connectorObject(entry))) : [],
             });
         }
+
     }
     const securitySchemes = Object.entries(
         connectorObject(connectorObject(spec.components).securitySchemes ?? spec.securityDefinitions),
@@ -343,6 +357,20 @@ export function openApiInformation(value: unknown): OpenApiInformation {
     };
 }
 
+export function openApiSpecificationBaseUrl(value: unknown): string {
+    return openApiInformation(value).servers.find(({ url }) => !connectorUrlError(url))?.url || '';
+}
+
+export function openApiBaseUrlOverrideEnabled(
+    draft: ActionConfiguration,
+    specContent: unknown = draft.additionalFields.openapi_spec_content,
+): boolean {
+    if (typeof draft.additionalFields.base_url_override === 'boolean') return draft.additionalFields.base_url_override;
+    const specBaseUrl = openApiSpecificationBaseUrl(specContent);
+    const configuredBaseUrl = connectorText(draft.endpoint || draft.additionalFields.base_url);
+    return Boolean(specBaseUrl && configuredBaseUrl && configuredBaseUrl !== specBaseUrl);
+}
+
 export interface OpenApiUploadResult {
     success: boolean;
     file_id?: string;
@@ -403,15 +431,17 @@ export function processOpenApiText(text: string, format: 'json' | 'yaml', signal
 
 export function applyOpenApiSpecification(draft: ActionConfiguration, result: OpenApiUploadResult): ActionConfiguration {
     if (!result.success || !isRecord(result.spec_content)) throw new Error('A validated specification is required.');
-    const information = openApiInformation(result.spec_content);
     const source = openApiSourceDraft(draft);
-    const endpoint = draft.endpoint || connectorText(draft.additionalFields.base_url) ||
-        information.servers.find(({ url }) => !connectorUrlError(url))?.url || '';
+    const overrideEnabled = openApiBaseUrlOverrideEnabled(draft, result.spec_content);
+    const currentEndpoint = connectorText(draft.endpoint || draft.additionalFields.base_url);
+    const specEndpoint = openApiSpecificationBaseUrl(result.spec_content);
+    const endpoint = overrideEnabled ? currentEndpoint : specEndpoint || currentEndpoint;
     return {
         ...draft, endpoint,
         additionalFields: {
             ...draft.additionalFields,
-            openapi_spec_content: result.spec_content, openapi_source_type: 'content', base_url: endpoint,
+            openapi_spec_content: result.spec_content, openapi_source_type: 'content',
+            base_url: endpoint, base_url_override: overrideEnabled,
         },
         _openApiSourceDraft: {
             ...source, pending: false,
@@ -657,6 +687,13 @@ export interface McpTool extends Record<string, unknown> {
     annotations?: Record<string, unknown>;
 }
 
+export interface McpToolFingerprints {
+    manifest_hash: string;
+    tools: Record<string, string>;
+    prompts: Record<string, string>;
+    discovered_at: string;
+}
+
 export function parseMcpTools(value: unknown): McpTool[] {
     if (!Array.isArray(value)) return [];
     return value.filter(isRecord).flatMap((tool) => {
@@ -703,6 +740,68 @@ export function setMcpToolSelection(draft: ActionConfiguration, name: string, se
     });
 }
 
+export function mcpFingerprints(value: unknown): McpToolFingerprints | null {
+    if (!isRecord(value) || typeof value.manifest_hash !== 'string' || typeof value.discovered_at !== 'string'
+        || !isRecord(value.tools) || !isRecord(value.prompts)) {
+        return null;
+    }
+    const tools = Object.fromEntries(Object.entries(value.tools).filter((entry): entry is [string, string] =>
+        typeof entry[0] === 'string' && typeof entry[1] === 'string'));
+    const prompts = Object.fromEntries(Object.entries(value.prompts).filter((entry): entry is [string, string] =>
+        typeof entry[0] === 'string' && typeof entry[1] === 'string'));
+    return { manifest_hash: value.manifest_hash, discovered_at: value.discovered_at, tools, prompts };
+}
+
+export function mcpFingerprintChangeSummary(approved: unknown, current: unknown): {
+    hasChanges: boolean; new: string[]; changed: string[]; removed: string[];
+    promptsNew: string[]; promptsChanged: string[]; promptsRemoved: string[];
+} {
+    const before = mcpFingerprints(approved);
+    const after = mcpFingerprints(current);
+    const diff = (left: Record<string, string>, right: Record<string, string>) => {
+        const leftNames = new Set(Object.keys(left));
+        const rightNames = new Set(Object.keys(right));
+        return {
+            newItems: [...rightNames].filter((name) => !leftNames.has(name)).sort(),
+            changedItems: [...rightNames].filter((name) => leftNames.has(name) && left[name] !== right[name]).sort(),
+            removedItems: [...leftNames].filter((name) => !rightNames.has(name)).sort(),
+        };
+    };
+    if (!before || !after) {
+        return { hasChanges: Boolean(after), new: [], changed: [], removed: [], promptsNew: [], promptsChanged: [], promptsRemoved: [] };
+    }
+    const tools = diff(before.tools, after.tools);
+    const prompts = diff(before.prompts, after.prompts);
+    return {
+        hasChanges: before.manifest_hash !== after.manifest_hash,
+        new: tools.newItems,
+        changed: tools.changedItems,
+        removed: tools.removedItems,
+        promptsNew: prompts.newItems,
+        promptsChanged: prompts.changedItems,
+        promptsRemoved: prompts.removedItems,
+    };
+}
+
+export function mcpDiscoverySignature(draft: ActionConfiguration): string {
+    const fields = draft.additionalFields;
+    const headers = connectorObject(fields.custom_headers);
+    return JSON.stringify({
+        endpoint: draft.endpoint || '',
+        transport: connectorText(fields.transport) || 'streamable_http',
+        server_profile: connectorText(fields.server_profile) || 'generic',
+        preconfiguration_id: connectorText(fields.preconfiguration_id),
+        auth_method: connectorAuthMethod(draft, 'mcp'),
+        identity_id: draft.identity_id || '',
+        identity_auth_type: connectorText(fields.identity_auth_type),
+        api_key_header_name: connectorText(fields.api_key_header_name ?? 'X-API-Key'),
+        auth_type: draft.auth.type,
+        auth_identity: connectorText(draft.auth.identity),
+        auth_key: connectorText(draft.auth.key),
+        custom_headers: Object.fromEntries(Object.keys(headers).sort().map((name) => [name, connectorText(headers[name])])),
+    });
+}
+
 function pointerValue(value: unknown, pointer: string): unknown {
     let current = value;
     for (const part of pointer.slice(1).split('/')) {
@@ -788,6 +887,13 @@ export function validateConnectorConfiguration(
             errors['additionalFields.openapi_spec_content'] = 'Upload or process an OpenAPI JSON/YAML specification.';
         }
         if (connectorObject(draft._openApiSourceDraft).pending === true) errors['openapi-source'] = 'Process the edited specification before saving or testing.';
+        if (fields.allowed_operations !== undefined &&
+            (!Array.isArray(fields.allowed_operations) || connectorStrings(fields.allowed_operations).length !== fields.allowed_operations.length)) {
+            errors['additionalFields.allowed_operations'] = 'Allowed OpenAPI operations must be an array of operation IDs.';
+        }
+        if (fields.openapi_operations_disabled_all === true) {
+            errors['additionalFields.allowed_operations'] = 'Enable at least one OpenAPI operation before saving. An empty allowed list is reserved for backward-compatible "all operations" behavior.';
+        }
         return errors;
     }
     if (!allowedMcpTransports(preset).some(({ value }) => value === transport)) {
@@ -961,6 +1067,8 @@ export function validateApiConnector(draft: ActionConfiguration, original: Conne
 export interface McpDiscoveryResult {
     success?: boolean;
     tools?: unknown[];
+    prompts?: unknown[];
+    fingerprints?: McpToolFingerprints;
     capabilities?: Record<string, unknown>;
     warnings?: string[];
     error?: string;
@@ -973,11 +1081,12 @@ export interface McpDiscoveryResult {
 export async function discoverMcpAction(draft: ActionConfiguration, original: ConnectorResource, signal?: AbortSignal, testScope?: ActionTestScope): Promise<McpDiscoveryResult> {
     const result = await api.post<McpDiscoveryResult>('/api/plugins/mcp/discover', buildConnectorSupportPayload(draft, original, 'mcp', 'discover', testScope), signal);
     if (!result || (result.success === true && (!Array.isArray(result.tools) ||
-        parseMcpTools(result.tools).length !== result.tools.length))) {
+        parseMcpTools(result.tools).length !== result.tools.length || !mcpFingerprints(result.fingerprints)))) {
         throw new Error('The server returned an invalid MCP tool catalogue.');
     }
     return {
         ...result, warnings: connectorStrings(result.warnings), capabilities: connectorObject(result.capabilities),
         ...(Array.isArray(result.tools) ? { tools: parseMcpTools(result.tools) } : {}),
+        ...(mcpFingerprints(result.fingerprints) ? { fingerprints: mcpFingerprints(result.fingerprints) ?? undefined } : {}),
     };
 }
diff --git a/application/v2_ui/src/lib/workspaceActionLogic.ts b/application/v2_ui/src/lib/workspaceActionLogic.ts
index 6ea46ce97..07418769a 100644
--- a/application/v2_ui/src/lib/workspaceActionLogic.ts
+++ b/application/v2_ui/src/lib/workspaceActionLogic.ts
@@ -300,34 +300,31 @@ function configurationForType(definition: ActionTypeDefinition): Partial<ActionC
     if (definition.allowed_auth_types.length && !definition.allowed_auth_types.includes(auth.type)) {
         auth.type = definition.allowed_auth_types[0];
     }
+    const catalogDefaults = isRecord(definition.defaults) ? definition.defaults : {};
     const capabilities = native.capabilities
         ? Object.fromEntries(native.capabilities.options.map(({ key, defaultEnabled }) => [key, defaultEnabled !== false]))
+        : definition.capabilities?.length
+            ? Object.fromEntries(definition.capabilities.map(({ key, default: defaultEnabled }) => [key, defaultEnabled !== false]))
         : undefined;
     let initial = {
         ...structuredClone(native.defaults ?? {}),
         auth,
-        additionalFields: { ...structuredClone(native.defaults?.additionalFields ?? {}), ...(isRecord(fields) ? fields : {}) },
+        additionalFields: {
+            ...structuredClone(native.defaults?.additionalFields ?? {}),
+            ...structuredClone(catalogDefaults),
+            ...(isRecord(fields) ? fields : {}),
+        },
         metadata: { ...structuredClone(native.defaults?.metadata ?? {}), ...(isRecord(metadata) ? metadata : {}) },
     };
     if (native.capabilities && capabilities) initial = withActionValue(initial, native.capabilities.path, capabilities);
+    else if (definition.capabilities?.length && capabilities) initial = withActionValue(initial, '/additionalFields/m365_capabilities', capabilities);
     return initial;
 }
 
 export function changeActionType(draft: ActionConfiguration, definition: ActionTypeDefinition): ActionConfiguration {
     if (draft.type === definition.type) return draft;
-    const previous = isRecord(draft._actionTypeConfigurations) ? draft._actionTypeConfigurations : {};
-    const configurations = {
-        ...previous,
-        ...(draft.type ? { [draft.type]: {
-            endpoint: draft.endpoint, auth: draft.auth, identity_id: draft.identity_id ?? '',
-            additionalFields: draft.additionalFields,
-            ...(draft._openApiSourceDraft ? { _openApiSourceDraft: draft._openApiSourceDraft } : {}),
-            ...(draft._sqlConnectionMethod ? { _sqlConnectionMethod: draft._sqlConnectionMethod } : {}),
-        } } : {}),
-    };
-    const existing = Object.hasOwn(configurations, definition.type) ? configurations[definition.type] : undefined;
     const initial = configurationForType(definition);
-    const configuration = isRecord(existing) ? existing : initial;
+    const configuration = initial;
     return {
         ...draft,
         ...configuration,
@@ -339,7 +336,6 @@ export function changeActionType(draft: ActionConfiguration, definition: ActionT
         metadata: { ...(initial.metadata ?? {}), ...draft.metadata },
         _openApiSourceDraft: configuration._openApiSourceDraft,
         _sqlConnectionMethod: configuration._sqlConnectionMethod,
-        _actionTypeConfigurations: configurations,
     };
 }
 
@@ -484,7 +480,16 @@ export function deriveBlobEndpoint(connectionString: string): string {
 }
 
 export function actionForSave(draft: ActionConfiguration): ActionConfiguration {
-    let next = { ...draft, displayName: actionText(draft.displayName ?? draft.name).trim(), name: actionText(draft.name).trim() };
+    const {
+        _actionTypeConfigurations: _discardedActionTypeConfigurations,
+        _openApiSourceDraft: _discardedOpenApiSourceDraft,
+        _sqlConnectionMethod: _discardedSqlConnectionMethod,
+        ...persistable
+    } = draft as ActionConfiguration & Record<string, unknown>;
+    void _discardedActionTypeConfigurations;
+    void _discardedOpenApiSourceDraft;
+    void _discardedSqlConnectionMethod;
+    let next = { ...persistable, displayName: actionText(draft.displayName ?? draft.name).trim(), name: actionText(draft.name).trim() } as ActionConfiguration;
     if (!next.endpoint) next.endpoint = actionText(displayedActionValue(draft, '/endpoint'));
     if (draft.type === 'agent') next = { ...next, endpoint: 'internal://agent', auth: { type: 'user' } };
     if (draft.type === 'snowflake' && !draft.identity_id && !draft.auth.identity && draft.additionalFields.user) {
diff --git a/application/v2_ui/src/lib/workspaceActionRegistry.ts b/application/v2_ui/src/lib/workspaceActionRegistry.ts
index 0cd7f9ec3..44ee77fbc 100644
--- a/application/v2_ui/src/lib/workspaceActionRegistry.ts
+++ b/application/v2_ui/src/lib/workspaceActionRegistry.ts
@@ -127,6 +127,7 @@ const documentSearchFields: ActionFieldDescriptor[] = [
 ];
 const searchDefaults = {
     default_doc_scope: 'all', default_top_n: 50, default_window_unit: 'pages',
+    allowed_scopes: ['personal', 'group', 'public'], allowed_group_ids: [], allowed_public_workspace_ids: [],
     default_window_target_length: '2 pages', default_final_target_length: '2 pages',
 };
 const internalUtility = (type: string, help: string): ActionNativeDefinition => ({
@@ -372,6 +373,30 @@ export const NATIVE_ACTION_TYPES: Record<string, ActionNativeDefinition> = {
         capabilities: { path: '/additionalFields/msgraph_capabilities', options: MSGRAPH_ACTION_CAPABILITIES },
         help: 'Use Microsoft 365 as the signed-in user. Mail and calendar delivery policies determine when changes are sent.',
     },
+    m365_calendar: {
+        fields: [],
+        internal: true,
+        defaults: { auth: { type: 'user' } },
+        help: 'Use Microsoft 365 Calendar with delegated user permissions. Capability switches are bounded by the governed catalogue.',
+    },
+    m365_email: {
+        fields: [],
+        internal: true,
+        defaults: { auth: { type: 'user' } },
+        help: 'Use Microsoft 365 Email with delegated user permissions. Capability switches are bounded by the governed catalogue.',
+    },
+    m365_onedrive: {
+        fields: [],
+        internal: true,
+        defaults: { auth: { type: 'user' } },
+        help: 'Use Microsoft 365 OneDrive with delegated user permissions. Capability switches are bounded by the governed catalogue.',
+    },
+    m365_sharepoint: {
+        fields: [],
+        internal: true,
+        defaults: { auth: { type: 'user' } },
+        help: 'Use Microsoft 365 SharePoint Online with delegated user permissions. Capability switches are bounded by the governed catalogue.',
+    },
     chart: {
         fields: [], internal: true, defaults: { endpoint: 'chart://internal', auth: { type: 'user' } },
         capabilities: { path: '/additionalFields/chart_capabilities', options: CHART_ACTION_CAPABILITIES },
diff --git a/application/v2_ui/src/lib/workspaceAuthoring.ts b/application/v2_ui/src/lib/workspaceAuthoring.ts
index 99acb0bc8..93c106c34 100644
--- a/application/v2_ui/src/lib/workspaceAuthoring.ts
+++ b/application/v2_ui/src/lib/workspaceAuthoring.ts
@@ -97,6 +97,16 @@ export interface ActionTypeDefinition {
     allowed_auth_types: string[];
     additional_fields_schema: EditorSchema;
     metadata_schema: EditorSchema;
+    capabilities?: {
+        key: string;
+        label: string;
+        description: string;
+        default?: boolean;
+    }[];
+    defaults?: Record<string, unknown>;
+    graph_endpoint?: string;
+    hidden?: boolean;
+    legacy?: boolean;
 }
 
 export interface AgentEditorOptions {
diff --git a/application/v2_ui/src/pages/workspace/ActionEditorPage.tsx b/application/v2_ui/src/pages/workspace/ActionEditorPage.tsx
index 01deae7b9..d53b25e69 100644
--- a/application/v2_ui/src/pages/workspace/ActionEditorPage.tsx
+++ b/application/v2_ui/src/pages/workspace/ActionEditorPage.tsx
@@ -9,7 +9,7 @@ import { WorkspaceEditorFrame } from '../../components/workspace/WorkspaceEditor
 import { errorMessage } from '../../components/workspace/useSectionResource';
 import { ActionField, ACTION_INPUT_CLASS } from '../../components/workspaceActions/ActionFields';
 import { ActionAuthentication } from '../../components/workspaceActions/ActionAuthentication';
-import { ActionConfigurationFields } from '../../components/workspaceActions/ActionConfigurationFields';
+import { ActionConfigurationFields, hasActionConfigurationFields } from '../../components/workspaceActions/ActionConfigurationFields';
 import { ActionAdvancedFields } from '../../components/workspaceActions/ActionAdvancedFields';
 import {
     ConnectorFeedbackPanel, OpenApiActionAuthentication, OpenApiActionConfiguration,
@@ -168,7 +168,7 @@ function ActionEditor({ resourceId, scope, returnTo, adapter }: { resourceId: st
         : (hintsError || ACTION_AUTHORING_UNAVAILABLE);
     const definition = catalogue.find((type) => type.type === draft.type);
     const visibleTypes = useMemo(() => catalogue.filter((type) => type.type === draft.type ||
-        `${type.display} ${type.type} ${type.description}`.toLowerCase().includes(typeSearch.trim().toLowerCase()))
+        (!type.hidden && !type.legacy && `${type.display} ${type.type} ${type.description}`.toLowerCase().includes(typeSearch.trim().toLowerCase())))
         .sort((left, right) => left.display.localeCompare(right.display)), [catalogue, draft.type, typeSearch]);
     const fallbackDefinition: ActionTypeDefinition = {
         type: draft.type, display: actionTypeLabel(draft.type), description: '',
@@ -324,6 +324,7 @@ function ActionEditor({ resourceId, scope, returnTo, adapter }: { resourceId: st
     const configuration = draft.type === 'openapi' ? <OpenApiActionConfiguration {...connectorProps} /> :
         draft.type === 'mcp' ? <McpActionConfiguration {...connectorProps} /> :
             <ActionConfigurationFields {...connectorProps} definition={displayDefinition} />;
+    const showConfiguration = Boolean(draft.type && hasActionConfigurationFields(displayDefinition));
     const authentication = draft.type === 'openapi' ? <OpenApiActionAuthentication {...connectorProps} /> :
         draft.type === 'mcp' ? <McpActionAuthentication {...connectorProps} /> :
             <ActionAuthentication {...connectorProps} definition={displayDefinition} />;
@@ -331,8 +332,8 @@ function ActionEditor({ resourceId, scope, returnTo, adapter }: { resourceId: st
         { id: 'identity', label: 'Identity and type', icon: IdCard,
             description: 'The kind of connector, the name agents see, and what the action does.', content: identitySection },
         ...(draft.type ? [
-            { id: 'configuration', label: 'Configuration', icon: Settings2,
-                description: 'Where the action connects, and what it is allowed to do there.', content: configuration },
+            ...(showConfiguration ? [{ id: 'configuration', label: 'Configuration', icon: Settings2,
+                description: 'Where the action connects, and what it is allowed to do there.', content: configuration }] : []),
             { id: 'authentication', label: 'Authentication', icon: KeyRound,
                 description: 'How the action signs in to the service it calls.', content: authentication },
             { id: 'advanced', label: 'Advanced', icon: SlidersHorizontal,
@@ -365,7 +366,7 @@ function ActionEditor({ resourceId, scope, returnTo, adapter }: { resourceId: st
                         onClick={() => void validate()}><CheckCircle2 size={14} />{validating ? 'Validating…' : 'Validate configuration'}</GlassButton>
                 </> : undefined} />
             {pendingType ? <ConfirmDialog title="Change action type?" tone="primary" confirmLabel="Change type"
-                description="Configuration and authentication will switch to the selected connector. The previous type’s draft stays in this tab if you switch back; it is not sent as configuration for the new type."
+                description="Configuration and authentication will switch to the selected connector, and the current settings for this action type will be cleared."
                 onClose={() => setPendingType(null)} onConfirm={() => applyType(pendingType)}>
                 <p className="text-sm text-text-2">The name, description, ID, and metadata are kept. Review configuration before saving.</p>
             </ConfirmDialog> : null}
diff --git a/application/v2_ui/src/pages/workspace/ActionsSection.tsx b/application/v2_ui/src/pages/workspace/ActionsSection.tsx
index a8f29f647..7039008dd 100644
--- a/application/v2_ui/src/pages/workspace/ActionsSection.tsx
+++ b/application/v2_ui/src/pages/workspace/ActionsSection.tsx
@@ -94,6 +94,8 @@ export function ActionsSection({ agentsEnabled, adapter = PERSONAL_ACTION_WORKBE
     }, [loading, error, items.length]);
 
     const labels = useMemo(() => new Map(catalogue.map((type) => [type.type, type.display])), [catalogue]);
+    const hasMcpToolDrift = (action: ActionConfiguration) =>
+        action.type === 'mcp' && action.additionalFields && typeof action.additionalFields.mcp_tool_drift === 'object' && action.additionalFields.mcp_tool_drift !== null;
     const types = useMemo(() => [...new Set([...catalogue.map(({ type }) => type), ...items.map(({ type }) => type)])]
         .sort((left, right) => (labels.get(left) || actionTypeLabel(left)).localeCompare(labels.get(right) || actionTypeLabel(right))),
     [catalogue, items, labels]);
@@ -201,6 +203,7 @@ export function ActionsSection({ agentsEnabled, adapter = PERSONAL_ACTION_WORKBE
                                         <div className="flex flex-wrap items-center gap-2">
                                             <Pill>{labels.get(action.type) || actionTypeLabel(action.type)}</Pill>
                                             <Pill tone={provided ? 'accent' : 'neutral'}>{provided ? <span className="inline-flex items-center gap-1"><Shield size={11} />Provided · Read only</span> : isGroup ? 'Group' : 'Personal'}</Pill>
+                                            {hasMcpToolDrift(action) ? <Pill tone="warn">Tools changed — review</Pill> : null}
                                             {!provided && !editable ? <Pill>Read only</Pill> : null}
                                         </div>
                                         <div className="flex items-center justify-end gap-2">
diff --git a/application/v2_ui/src/pages/workspace/AgentsSection.tsx b/application/v2_ui/src/pages/workspace/AgentsSection.tsx
index 044986fff..0ae8c0bc1 100644
--- a/application/v2_ui/src/pages/workspace/AgentsSection.tsx
+++ b/application/v2_ui/src/pages/workspace/AgentsSection.tsx
@@ -9,7 +9,7 @@ import { errorMessage, useSectionResource } from '../../components/workspace/use
 import { AgentIcon } from '../../components/workspaceAgents/AgentIdentityFields';
 import { AgentNotice } from '../../components/workspaceAgents/AgentFields';
 import { chatHrefForAgent } from '../../lib/conversationUrl';
-import type { AgentConfiguration } from '../../lib/workspaceAuthoring';
+import type { ActionConfiguration, AgentConfiguration } from '../../lib/workspaceAuthoring';
 import { PERSONAL_AGENT_WORKBENCH, type AgentWorkbenchAdapter } from '../../lib/agentWorkbench';
 import { AGENT_INPUT_CLASS, AGENT_TYPE_LABELS, agentText } from '../../lib/workspaceAgentAuthoring';
 import { readAgentKnowledge } from '../../lib/workspaceAgentKnowledge';
@@ -31,6 +31,7 @@ export function AgentsSection({ actionsEnabled, adapter = PERSONAL_AGENT_WORKBEN
         if (collectionState.owner !== owner) collectionState = { owner, query: '', type: '', scope: '', view: 'list', scrollTop: 0 };
         return { ...collectionState };
     });
+    const [actions, setActions] = useState<ActionConfiguration[]>([]);
     const [busyId, setBusyId] = useState<string | null>(null);
     useEffect(() => {
         if (filters.owner !== owner) {
@@ -46,6 +47,17 @@ export function AgentsSection({ actionsEnabled, adapter = PERSONAL_AGENT_WORKBEN
             scrollRestored.current = true;
         }
     }, [loading, error, items.length]);
+    useEffect(() => {
+        const controller = new AbortController();
+        void adapter.fetchActions(controller.signal).then(setActions).catch(() => {
+            if (!controller.signal.aborted) setActions([]);
+        });
+        return () => controller.abort();
+    }, [adapter]);
+    const driftActionIds = useMemo(() => new Set(actions.filter((action) =>
+        action.type === 'mcp' && action.additionalFields && typeof action.additionalFields.mcp_tool_drift === 'object' &&
+        action.additionalFields.mcp_tool_drift !== null).flatMap((action) => [action.id, action.name].filter((value): value is string => typeof value === 'string' && Boolean(value)))),
+    [actions]);
     const visible = useMemo(() => items.filter((agent) => {
         const label = AGENT_TYPE_LABELS[agent.agent_type] ?? agent.agent_type;
         return `${agent.display_name} ${agent.name} ${agent.description} ${agent.agent_type} ${label}`.toLowerCase().includes(filters.query.trim().toLowerCase()) &&
@@ -112,6 +124,7 @@ export function AgentsSection({ actionsEnabled, adapter = PERSONAL_AGENT_WORKBEN
                         const label = agent.display_name || agent.name || 'Untitled agent';
                         const path = `${adapter.basePath}/${encodeURIComponent(agent.id)}${provided ? '?scope=global' : ''}`;
                         const knowledge = readAgentKnowledge(agent);
+                        const hasToolDrift = agent.actions_to_load?.some((reference) => driftActionIds.has(reference)) === true;
                         return (
                             <li key={`${provided ? 'global' : 'personal'}:${agent.id}`} className="min-w-0">
                                 <GlassPanel elevation="flat" className={`h-full p-4 ${filters.view === 'cards' ? 'space-y-3' : 'flex flex-wrap items-start gap-3'}`}>
@@ -125,6 +138,7 @@ export function AgentsSection({ actionsEnabled, adapter = PERSONAL_AGENT_WORKBEN
                                             <div className="mt-2 flex flex-wrap items-center gap-2">
                                                 <Pill>{AGENT_TYPE_LABELS[agent.agent_type] || agent.agent_type}</Pill>
                                                 <Pill tone={provided ? 'accent' : 'neutral'}>{provided ? 'Provided · read only' : isGroup ? 'Group' : 'Personal'}</Pill>
+                                                {hasToolDrift ? <Pill tone="warn">Tools changed — review</Pill> : null}
                                                 {agent.is_enabled === false ? <Pill tone="warn">Disabled</Pill> : null}
                                             </div>
                                             <p className="mt-2 break-words text-xs text-text-3">
diff --git a/docs/explanation/features/ACTION_CONFIGURATION_PANE_CLEANUP.md b/docs/explanation/features/ACTION_CONFIGURATION_PANE_CLEANUP.md
new file mode 100644
index 000000000..035e25f2f
--- /dev/null
+++ b/docs/explanation/features/ACTION_CONFIGURATION_PANE_CLEANUP.md
@@ -0,0 +1,74 @@
+# Action Configuration Pane Cleanup
+
+## Overview
+
+Version implemented: **0.261.276**
+
+The V2 action editor now presents action settings by purpose instead of showing every stored key as a generic configuration field. Owners see identity, supported configuration controls, authentication, validation, and advanced JSON in clearer places, which reduces accidental edits to internal state and makes security-sensitive checks happen after credentials are entered.
+
+## Dependencies
+
+- V2 workspace action editor and action catalogue APIs.
+- Existing action governance for personal, group, and global actions.
+- Microsoft 365 cloud metadata for the read-only Graph endpoint.
+- MCP discovery and notification infrastructure.
+- OpenAPI parsing and operation registration.
+
+## Technical specifications
+
+### Catalogue and picker cleanup
+
+The plugin catalogue de-duplicates entries by action type before it reaches the V2 picker. Legacy or internal-only types (`databricks_table`, `embedding_model`, `queue_storage`, `ui_test`, and `sql_schema`) are hidden from new-action creation while existing records continue to load through their current editor paths.
+
+`sql_query` now displays as **SQL Database**. The stored type remains unchanged for compatibility, and schema discovery is included automatically when agents need table context.
+
+### Editor layout
+
+Custom field creation was removed from the V2 action editor. Unknown values are preserved in the draft and remain reviewable in **Advanced → JSON**, but schema-covered parent paths are not rendered again as removable fields. Empty Configuration sections are hidden, so types such as Azure Maps show only the sections they actually need.
+
+Connection checks for native actions, MCP, and OpenAPI now live in **Authentication**. Type switching starts from the selected type's defaults and warns that current settings for the action type will be cleared.
+
+### Per-action changes
+
+- Azure Maps keeps the subscription key and connection check in Authentication.
+- Blob Storage shows Markdown read/upload file types as ordinary switches.
+- Document Search stores allowed scopes and optional group/public workspace allow-lists, enforces them at runtime, and normalizes page-based summary targets while preserving legacy custom values.
+- Microsoft 365 Calendar, Email, OneDrive, and SharePoint use native V2 definitions with capability switches and a read-only Graph endpoint derived from the deployment cloud.
+- Log Analytics hides the internal query-history cache from Configuration.
+- MCP combines preconfigured servers and compatibility presets into one server template picker, stores approved tool and prompt fingerprints, filters unapproved drift at runtime, and surfaces drift badges and notifications.
+- OpenAPI shows the selected spec filename, supports a read-only spec-derived base URL with an override switch, and stores per-operation enablement in `additionalFields.allowed_operations`.
+- Yamcs reverse proxy Basic authentication moved into Authentication under its own switch.
+
+## Usage instructions
+
+Create or edit an action from My Workspace, a group workspace, or Admin Settings global actions. Configure only the fields shown for the selected type. Use **Authentication** for credentials and connection testing, and use **Advanced → JSON** for inspection of preserved legacy values rather than adding new custom fields.
+
+For MCP actions, run **Discover Tools** after endpoint, transport, auth, prompt loading, or allowed tool selections change. Save only after reviewing the approved tool list. If a **Tools changed — review** badge appears later, open the action, review drift, and rediscover to approve the current server manifest.
+
+For OpenAPI actions, upload or replace the spec, review the spec-derived base URL, enable only the operations the agent should call, and test from Authentication.
+
+## Testing and validation
+
+Functional coverage added in version **0.261.276**:
+
+- `functional_tests/test_action_catalogue_dedupe_hidden_types.py`
+- `functional_tests/test_action_editor_configuration_cleanup_static.py`
+- `functional_tests/test_document_search_action_scope_enforcement.py`
+- `functional_tests/test_mcp_tool_fingerprint_pinning.py`
+- `functional_tests/test_openapi_allowed_operations_filter.py`
+
+Documentation validation uses:
+
+- `python .\scripts\build_docs_inventory.py`
+- `python .\functional_tests\test_docs_app_surface_coverage.py`
+- `python .\functional_tests\test_docs_site_quality.py`
+
+## Known limitations
+
+MCP drift persistence is best effort. Runtime drift metadata and owner notifications are written when the action origin can be resolved and backing storage is available; failures are logged and the unsafe changed tools remain blocked. Existing MCP actions without approved fingerprints run as unpinned legacy actions until they are saved with a connection-affecting change, when discovery and approval become mandatory.
+
+The `ui_test` action type is hidden from new-action creation but has no standalone reference page because it is not a user-facing action. Existing records are still preserved by the editor path.
+
+OpenAPI `allowed_operations` is backward compatible: a missing or empty list means every operation from the spec remains enabled.
+
+Document Search still cannot broaden a user's personal, group, or public workspace permissions. Action scope settings only narrow what the current user can already access.
diff --git a/docs/explanation/release_notes.md b/docs/explanation/release_notes.md
index 0237f408e..db1063411 100644
--- a/docs/explanation/release_notes.md
+++ b/docs/explanation/release_notes.md
@@ -2,6 +2,28 @@
 
 For feature-focused and fix-focused drill-downs by version, see [Features by Version](https://github.com/microsoft/simplechat/tree/main/docs/explanation/features) and [Fixes by Version](https://github.com/microsoft/simplechat/tree/main/docs/explanation/fixes).
 
+### **(v0.261.276)**
+
+#### New Features
+
+*   **Action Configuration Pane Cleanup**
+    *   The V2 action editor now hides empty configuration sections, removes ad hoc custom fields, keeps unknown legacy values in Advanced JSON, and moves connection checks into Authentication where credentials are visible.
+    *   Action-specific configuration now reflects the actual supported settings: Document Search scopes and summary targets, Microsoft 365 capability switches and read-only Graph endpoint, OpenAPI spec-derived base URL and operation switches, MCP server templates and tool fingerprint approval, and Yamcs reverse proxy authentication.
+    *   (Ref: `ActionEditorPage.tsx`, `ActionConfigurationFields.tsx`, `ActionAuthentication.tsx`, `DocumentSearchActionConfiguration.tsx`, `McpActionConfiguration.tsx`, `OpenApiActionConfiguration.tsx`, [Action Configuration Pane Cleanup](features/ACTION_CONFIGURATION_PANE_CLEANUP.md))
+
+#### Bug Fixes
+
+*   **Action Catalogue Deduplication and Legacy Type Hiding**
+    *   Databricks no longer appears multiple times in the new-action picker, SQL actions display as SQL Database with schema discovery included, and legacy/internal-only types are hidden from new-action creation while existing actions remain editable.
+    *   (Ref: `route_backend_plugins.py`, `functions_workspace_authoring.py`, action reference docs)
+
+#### User Interface Enhancements
+
+*   **Safer Action Validation and Review Badges**
+    *   MCP actions now require discovery approval before saving new or changed server manifests, runtime calls block changed tools, and Actions/Agents lists flag drift with a "Tools changed — review" badge.
+    *   OpenAPI actions show the chosen spec file name, offer explicit operation enablement, and reject disabled operations before an HTTP request is sent.
+    *   (Ref: `functions_mcp_tool_pinning.py`, `mcp_plugin_factory.py`, `openapi_plugin.py`, `ActionsSection.tsx`, `AgentsSection.tsx`)
+
 ### **(v0.261.275)**
 
 #### New Features
diff --git a/docs/reference/actions/azure-maps-openlayers.md b/docs/reference/actions/azure-maps-openlayers.md
index 08ca86958..0fe8e39ec 100644
--- a/docs/reference/actions/azure-maps-openlayers.md
+++ b/docs/reference/actions/azure-maps-openlayers.md
@@ -23,12 +23,17 @@ Use it when an agent needs to turn known locations, areas, or paths into a map i
 - Azure Maps subscription key; key auth; agents enabled with `enable_semantic_kernel`.
 - Users also need access to the action through workspace or governance policy where applicable.
 
+
 ## Configuration overview
 
-Use common setup, then provide **Subscription Key** and test the Azure Maps connection.
+Azure Maps now has no separate Configuration section in the V2 action editor because the action only needs credentials. Enter the subscription key in **Authentication**, then run the connection check from the same section after the credential is present.
 
 Shared wizard steps: [Common action setup steps](../#common-action-setup-steps).
 
+## V2 editor cleanup
+
+The V2 editor no longer offers ad hoc custom fields for this action. Use **Advanced → JSON** only when reviewing preserved legacy values that are not part of the supported Azure Maps setup.
+
 ## What people see in chat
 
 The map appears under the agent's reply, in personal conversations and in group conversations
diff --git a/docs/reference/actions/blob-storage.md b/docs/reference/actions/blob-storage.md
index 4927aa7d9..922874038 100644
--- a/docs/reference/actions/blob-storage.md
+++ b/docs/reference/actions/blob-storage.md
@@ -25,6 +25,7 @@ Use it when an agent should work with a controlled container path without broad
 - Agents enabled with `enable_semantic_kernel`.
 - Users also need access to the action through workspace or governance policy where applicable.
 
+
 ## Configuration overview
 
 Choose **Authentication Type**:
@@ -33,7 +34,9 @@ Choose **Authentication Type**:
 - **Managed Identity** uses the application's Azure identity with the **Blob Service Endpoint**. Choose it when you want to avoid stored secrets and can grant the app identity the required Storage Blob data role ahead of time.
 - **Account Key** uses the **Blob Service Endpoint** plus a primary or secondary storage account key. Choose it when a full connection string is not desired but key-based access is still required.
 
-Then set **Container Name**, optional **Blob Prefix**, default capabilities, and supported read/upload file types. The endpoint must be an Azure Blob service hostname such as `https://account.blob.core.windows.net`; SimpleChat validates the endpoint before saving and again before building the action client.
+Then set **Container Name**, optional **Blob Prefix**, default capabilities, and the supported Markdown read/upload file type switches. Those file-type groups are schema-defined settings, so V2 shows them as ordinary switches instead of removable unknown fields. The endpoint must be an Azure Blob service hostname such as `https://account.blob.core.windows.net`; SimpleChat validates the endpoint before saving and again before building the action client.
+
+Connection testing appears in **Authentication**, after the credential choice. The V2 editor no longer offers ad hoc custom fields; preserved legacy values remain available in **Advanced → JSON** for review.
 
 Shared wizard steps: [Common action setup steps](../#common-action-setup-steps).
 
diff --git a/docs/reference/actions/databricks-table.md b/docs/reference/actions/databricks-table.md
index 1998a4722..eb6fd614f 100644
--- a/docs/reference/actions/databricks-table.md
+++ b/docs/reference/actions/databricks-table.md
@@ -23,9 +23,12 @@ Use only to keep older manifests working. For new work, use Databricks.
 - Existing legacy manifest with key auth; the create-action UI hides `databricks_table`.
 - Users also need access to the action through workspace or governance policy where applicable.
 
+
 ## Configuration overview
 
-No new-action panel; migrate to [Databricks]({{ '/reference/actions/databricks/' | relative_url }}) for new actions.
+`databricks_table` is hidden from new-action creation. Existing actions continue to load so owners can review, edit, or migrate them, but new governed Databricks work should use [Databricks]({{ '/reference/actions/databricks/' | relative_url }}).
+
+Connection testing, when available for an editable migrated configuration, appears in **Authentication**. The V2 editor no longer offers ad hoc custom fields; preserved legacy values remain available in **Advanced → JSON**.
 
 Shared wizard steps: [Common action setup steps](../#common-action-setup-steps).
 
diff --git a/docs/reference/actions/databricks.md b/docs/reference/actions/databricks.md
index 030d2eaa9..35f7b2fd3 100644
--- a/docs/reference/actions/databricks.md
+++ b/docs/reference/actions/databricks.md
@@ -35,7 +35,7 @@ Use Databricks when governed analytics data lives in Databricks and users should
 5. Choose **Authentication Method**: **Personal Access Token**, bearer token, **Service Principal**, or **Managed Identity**.
 6. Fill **Token** or **Client ID**, **Client Secret**, and **Tenant ID** when those auth modes are selected, or choose **Reusable Identity**.
 7. Set **Max Rows**, **Timeout (seconds)**, and **Wait Timeout (seconds)**.
-8. Use **Test Connection**.
+8. Use the connection check in **Authentication**.
 
 ## Example prompts
 
@@ -51,9 +51,15 @@ Use Databricks when governed analytics data lives in Databricks and users should
 | Authentication fails | Token, service principal, or managed identity lacks workspace/warehouse access. | Grant Databricks SQL permissions and retest. |
 | Long queries fail | Timeout or wait timeout is too low. | Tune the SQL or raise **Timeout** and **Wait Timeout** within limits. |
 
+
+## V2 catalogue behavior
+
+The action catalogue now de-duplicates Databricks entries by action type, so new actions show one Databricks SQL Warehouse connector. The legacy `databricks_table` type is hidden from new-action creation but existing actions of that type remain editable for review and migration.
+
+Connection testing appears in **Authentication**, after the selected Databricks credential. The V2 editor no longer offers ad hoc custom fields; preserved legacy values remain available in **Advanced → JSON**.
+
 ## Related
 
 - [SQL Query](../sql-query/)
 - [Snowflake](../snowflake/)
 - [Actions reference index]({{ '/reference/actions/' | relative_url }})
-
diff --git a/docs/reference/actions/document-search.md b/docs/reference/actions/document-search.md
index d7a4324e2..1303a43aa 100644
--- a/docs/reference/actions/document-search.md
+++ b/docs/reference/actions/document-search.md
@@ -23,9 +23,26 @@ Use it when an agent should reason over workspace documents as a tool. Use the n
 - Accessible personal, group, or public workspace content; no external credentials.
 - Users also need access to the action through workspace or governance policy where applicable.
 
+
 ## Configuration overview
 
-Configure default scope, result limit, preferred windowing, and summary defaults.
+Document Search can be narrowed without granting the agent any access the user does not already have. Choose the allowed scopes:
+
+- **My workspace** for the signed-in user's personal documents.
+- **Group workspaces** for groups the signed-in user can access. Choose all accessible groups or restrict the action to selected group IDs.
+- **Public workspaces** for public workspaces the signed-in user can access. Choose all accessible public workspaces or restrict the action to selected public workspace IDs.
+
+At runtime, SimpleChat intersects those action settings with the current user's group and public workspace access. A disabled scope is rejected even if the user asks for it explicitly.
+
+Set the default result limit with the slider or number input. The UI slider covers 5–100 results for normal setup, and the number input accepts values up to the existing backend maximum of 500 for specialized actions.
+
+## Summary and windowing controls
+
+The window unit controls how much source material goes into each summarization pass. Use **Automatic** when SimpleChat should choose the amount, **Fixed size** when a predictable number of pages or chunks is needed, or **Percent of document** when long documents should be sampled proportionally. Only the selected sizing value is stored; unused values are cleared to avoid conflicting instructions.
+
+Focus instructions tell the summarizer what to prioritize, such as contract dates, safety incidents, or implementation steps. Window summary and final summary target lengths are stored as page targets from the V2 sliders. Legacy free-text values, such as word counts, are preserved as custom values and can be reset to page-based targets.
+
+The V2 editor no longer offers ad hoc custom fields. Use **Advanced → JSON** only to review preserved legacy values.
 
 Shared wizard steps: [Common action setup steps](../#common-action-setup-steps).
 
diff --git a/docs/reference/actions/embedding-model.md b/docs/reference/actions/embedding-model.md
index e4ee79038..71d5915be 100644
--- a/docs/reference/actions/embedding-model.md
+++ b/docs/reference/actions/embedding-model.md
@@ -28,12 +28,12 @@ Use it for workflows that need vector representations, not for conversational an
   does not require storing an API key.
 - Users also need access to the action through workspace or governance policy where applicable.
 
+
 ## Configuration overview
 
-Configure existing/default embedding action settings through Agents controls.
-The default action follows the administrator's global selection. Explicitly
-configured action manifests retain their own endpoint contract; they are not
-silently redirected to the application's document-search model.
+`embedding_model` is hidden from new-action creation because the default embedding action is managed through the global AI Connections embedding selection and governance. Existing explicit manifests remain editable for compatibility.
+
+The V2 editor no longer offers ad hoc custom fields; preserved legacy values remain available in **Advanced → JSON**.
 
 Shared wizard steps: [Common action setup steps](../#common-action-setup-steps).
 
diff --git a/docs/reference/actions/index.md b/docs/reference/actions/index.md
index 1c1030e1b..0944916b5 100644
--- a/docs/reference/actions/index.md
+++ b/docs/reference/actions/index.md
@@ -16,7 +16,7 @@ Actions are approved tools that agents can call. They may query data, search doc
 2. Fill **Display Name**, review generated **Name**, and add a useful **Description**.
 3. Complete action-specific **Configuration** fields described on each action page.
 4. In **Advanced**, optionally add **Metadata (JSON)**, **Additional Fields (JSON)**, or Key Vault expiration reminder metadata when secret tracking is enabled.
-5. Review **Action Summary**, use **Test Connection** where provided, then save the action.
+5. Review **Action Summary**, use the connection check in **Authentication** where provided, then save the action.
 
 If an action type does not appear, check Agents settings, workspace action permissions, and Governance policy.
 
@@ -28,7 +28,7 @@ If an action type does not appear, check Agents settings, workspace action permi
 | [Databricks Table](./databricks-table/) | Compatibility wrapper for legacy `databricks_table` manifests. | Use only to keep older manifests working. For new work, use Databricks. | overview |
 | [Document Search](./document-search/) | Searches accessible SimpleChat documents, retrieves chunks, and summarizes documents using current user access. | Use it when an agent should reason over workspace documents as a tool. Use the normal grounded-search panel for one-off user searches. | overview |
 | [Log Analytics](./log-analytics/) | Discovers Azure Log Analytics table schemas and runs read-only KQL queries against one workspace. | Use it for operational telemetry and App Insights-style investigation. Use SQL/Snowflake/Databricks for business data. | overview |
-| [SQL Query](./sql-query/) | Executes SQL queries and scalar queries against configured SQL Server, Azure SQL, PostgreSQL, MySQL, or SQLite databases. | Exact relational data questions with joins, filters, counts, or current rows. | full guide |
+| [SQL Database](./sql-query/) | Executes SQL queries and scalar queries against configured SQL Server, Azure SQL, PostgreSQL, MySQL, or SQLite databases. | Exact relational data questions with joins, filters, counts, or current rows. | full guide |
 | [SQL Schema](./sql-schema/) | Discovers tables, table schemas, and relationships for configured SQL databases. | Schema discovery before an agent writes SQL. | full guide |
 | [Databricks]({{ '/reference/actions/databricks/' | relative_url }}) | Runs read-only SQL and discovers catalogs, schemas, tables, and table details through Databricks SQL Statement Execution. | Governed analytics queries in Azure Commercial Databricks. | full guide |
 | [Snowflake](./snowflake/) | Runs read-only Snowflake SQL and discovers databases, schemas, tables, and table details. | Governed analytics queries in Snowflake. | full guide |
diff --git a/docs/reference/actions/log-analytics.md b/docs/reference/actions/log-analytics.md
index de850e269..e0d2d394a 100644
--- a/docs/reference/actions/log-analytics.md
+++ b/docs/reference/actions/log-analytics.md
@@ -23,9 +23,12 @@ Use it for operational telemetry and App Insights-style investigation. Use SQL/S
 - Workspace ID plus identity, user, service principal, or key access.
 - Users also need access to the action through workspace or governance policy where applicable.
 
+
 ## Configuration overview
 
-Set Workspace ID, Cloud, optional endpoints, Authentication Method, and test the connection.
+Set Workspace ID, Cloud, optional endpoints, and Authentication Method. The internal `query_history` cache is not shown as a configurable field because it is runtime state, not an owner-controlled setting.
+
+Connection testing appears in **Authentication**, after credentials. The V2 editor no longer offers ad hoc custom fields; preserved legacy values remain available in **Advanced → JSON**.
 
 Shared wizard steps: [Common action setup steps](../#common-action-setup-steps).
 
diff --git a/docs/reference/actions/m365-calendar.md b/docs/reference/actions/m365-calendar.md
index a83ec783c..c505e4c04 100644
--- a/docs/reference/actions/m365-calendar.md
+++ b/docs/reference/actions/m365-calendar.md
@@ -127,6 +127,15 @@ Automatic invitation mode retains its immediate behavior, without a second
 Send button. Older unbound pending invitations remain visible and cancellable,
 but need to be prepared again for safe confirmation.
 
+
+## V2 action configuration
+
+The V2 editor registers this as a native Microsoft 365 action instead of relying on the legacy Microsoft Graph action. Capability switches come from the action catalogue and are stored under `additionalFields.m365_capabilities`, so owners can expose only the calendar, email, file, or site operations this action needs.
+
+The Microsoft Graph endpoint is read-only and derived from the deployment cloud: commercial deployments use `graph.microsoft.com`, and US Government deployments use `graph.microsoft.us`. Custom cloud endpoint behavior follows the deployment's configured Microsoft 365 runtime instead of being edited per action.
+
+Connection testing appears in **Authentication**, after the delegated or workflow identity choice. The V2 editor no longer offers ad hoc custom fields; preserved legacy values remain available in **Advanced → JSON**.
+
 ## Related
 
 - [Microsoft 365 data and approvals]({{ '/guides/microsoft-365-conversation-data/' | relative_url }})
diff --git a/docs/reference/actions/m365-email.md b/docs/reference/actions/m365-email.md
index 8cd9c80d9..6e81cda74 100644
--- a/docs/reference/actions/m365-email.md
+++ b/docs/reference/actions/m365-email.md
@@ -129,6 +129,15 @@ Automatic send mode and **Mark message as read** keep their immediate behavior
 and do not create an extra confirmation. A legacy pending action without enough
 stored authorization context must be cancelled and prepared again.
 
+
+## V2 action configuration
+
+The V2 editor registers this as a native Microsoft 365 action instead of relying on the legacy Microsoft Graph action. Capability switches come from the action catalogue and are stored under `additionalFields.m365_capabilities`, so owners can expose only the calendar, email, file, or site operations this action needs.
+
+The Microsoft Graph endpoint is read-only and derived from the deployment cloud: commercial deployments use `graph.microsoft.com`, and US Government deployments use `graph.microsoft.us`. Custom cloud endpoint behavior follows the deployment's configured Microsoft 365 runtime instead of being edited per action.
+
+Connection testing appears in **Authentication**, after the delegated or workflow identity choice. The V2 editor no longer offers ad hoc custom fields; preserved legacy values remain available in **Advanced → JSON**.
+
 ## Related
 
 - [Microsoft 365 data and approvals]({{ '/guides/microsoft-365-conversation-data/' | relative_url }})
diff --git a/docs/reference/actions/m365-onedrive.md b/docs/reference/actions/m365-onedrive.md
index 6f3074332..4fc1b195e 100644
--- a/docs/reference/actions/m365-onedrive.md
+++ b/docs/reference/actions/m365-onedrive.md
@@ -44,6 +44,15 @@ still require the requesting user's delegated access.
 Evidence is labeled with source and capture information and follows conversation
 retention. Disconnecting Microsoft 365 does not retract an already-published copy.
 
+
+## V2 action configuration
+
+The V2 editor registers this as a native Microsoft 365 action instead of relying on the legacy Microsoft Graph action. Capability switches come from the action catalogue and are stored under `additionalFields.m365_capabilities`, so owners can expose only the calendar, email, file, or site operations this action needs.
+
+The Microsoft Graph endpoint is read-only and derived from the deployment cloud: commercial deployments use `graph.microsoft.com`, and US Government deployments use `graph.microsoft.us`. Custom cloud endpoint behavior follows the deployment's configured Microsoft 365 runtime instead of being edited per action.
+
+Connection testing appears in **Authentication**, after the delegated or workflow identity choice. The V2 editor no longer offers ad hoc custom fields; preserved legacy values remain available in **Advanced → JSON**.
+
 ## Related
 
 - [Microsoft 365 data and approvals]({{ '/guides/microsoft-365-conversation-data/' | relative_url }})
diff --git a/docs/reference/actions/m365-sharepoint.md b/docs/reference/actions/m365-sharepoint.md
index 25ecf82a0..24c5e6a5c 100644
--- a/docs/reference/actions/m365-sharepoint.md
+++ b/docs/reference/actions/m365-sharepoint.md
@@ -52,6 +52,15 @@ SharePoint permission. Revoking source access stops new reads but does not
 delete those published copies. Sharing a previously private conversation also
 requires acknowledgement of this disclosure.
 
+
+## V2 action configuration
+
+The V2 editor registers this as a native Microsoft 365 action instead of relying on the legacy Microsoft Graph action. Capability switches come from the action catalogue and are stored under `additionalFields.m365_capabilities`, so owners can expose only the calendar, email, file, or site operations this action needs.
+
+The Microsoft Graph endpoint is read-only and derived from the deployment cloud: commercial deployments use `graph.microsoft.com`, and US Government deployments use `graph.microsoft.us`. Custom cloud endpoint behavior follows the deployment's configured Microsoft 365 runtime instead of being edited per action.
+
+Connection testing appears in **Authentication**, after the delegated or workflow identity choice. The V2 editor no longer offers ad hoc custom fields; preserved legacy values remain available in **Advanced → JSON**.
+
 ## Related
 
 - [Microsoft 365 data and approvals]({{ '/guides/microsoft-365-conversation-data/' | relative_url }})
diff --git a/docs/reference/actions/mcp.md b/docs/reference/actions/mcp.md
index 83edfe083..5f1ecf6cd 100644
--- a/docs/reference/actions/mcp.md
+++ b/docs/reference/actions/mcp.md
@@ -28,16 +28,30 @@ Use MCP when a provider already exposes an MCP server and agents should use thos
 - Tool exposure policy: load tools, optional prompts, allowed tool names, and large-result handling.
 - Agents/actions enabled with [`enable_semantic_kernel`]({{ '/admin/agents-actions/' | relative_url }}).
 
+
 ## Configure the action
 
 1. Choose **MCP**.
-2. Optionally select **Preconfigured MCP Server** and **Server Preset**.
-3. Choose **Transport** and fill **Endpoint** with the remote server URL.
+2. Select a **Server template** if one fits. Ready-to-use servers, such as Microsoft Learn, supply the endpoint and imply the compatibility profile. Vendor compatibility profiles, such as Splunk, apply transport and compatibility defaults while you provide the endpoint.
+3. Choose **Transport** and fill **Endpoint** when the selected template does not fix it.
 4. Choose **Authentication Method** and fill the shown auth fields or **Custom Headers (JSON)**.
 5. Set **Load tools**, **Load prompts**, **Validate tool arguments**, and **Large Result Policy**.
-6. Fill **Allowed Tool Names** to expose only approved tools, or leave blank to expose all discovered tools.
-7. Use **Discover Tools** to populate **Discovered Tool Metadata (JSON)**.
-8. Set **Request Timeout**, **Connect Timeout**, **SSE Read Timeout**, **Retry Count**, and **Retry Backoff**, then use **Test Connection**.
+6. Use **Discover Tools** against the current endpoint, transport, and auth before saving. Discovery records tool metadata, prompt metadata, and SHA-256 fingerprints for approval.
+7. Review the discovered tools, then choose which approved tools to expose. Re-run discovery after endpoint, transport, authentication, prompt loading, or allowed tool names change.
+8. Set **Request Timeout**, **Connect Timeout**, **SSE Read Timeout**, **Retry Count**, and **Retry Backoff**.
+9. Use **Validate and test** in **Authentication**.
+
+The V2 editor no longer offers ad hoc custom fields. Use **Advanced → JSON** only to review preserved legacy values.
+
+## Tool fingerprint pinning
+
+Saving a new or materially changed MCP action is blocked until discovery has approved the current server manifest. SimpleChat computes a stable SHA-256 fingerprint from each tool's original name, description, input schema, output schema, and annotations, and from each prompt's name, description, and arguments. The approved manifest is stored in `additionalFields.mcp_tool_fingerprints` with the approved tool list.
+
+At runtime, pinned actions compare the live server manifest with the approved fingerprints before tools are registered. Tools whose hashes still match can run. New, changed, or removed tools and prompts are treated as drift; new or changed tools are not registered until an owner reviews the diff and rediscovers the server.
+
+The Actions and Agents lists show a **Tools changed — review** badge when stored drift metadata exists. The editor summarizes new, changed, removed, and prompt drift so owners can decide whether to re-approve by rediscovery.
+
+Existing MCP actions that have no approved fingerprints are treated as unpinned legacy actions. They can continue to run until they are saved with a connection-affecting change, at which point discovery and approval are required.
 
 ## Retired stdio actions
 
@@ -64,6 +78,8 @@ Environment-enforced destination restrictions are a minimum that Admin Settings
 | Symptom | Likely cause | Fix |
 | --- | --- | --- |
 | Discovery finds too many tools | **Allowed Tool Names** is blank. | Add one approved tool name per line. |
+| Saving is blocked | Discovery has not approved the current endpoint, transport, auth, tools, and prompts. | Run **Discover Tools**, review the metadata, then save. |
+| Tools changed badge appears | The live server manifest no longer matches the approved fingerprints. | Open the action, review drift, rediscover tools, and save if the changes are trusted. |
 | Tool calls fail on arguments | Arguments do not match the discovered schema. | Enable **Validate tool arguments** and rediscover tools. |
 | SSE connections time out | Read timeout is too low or a proxy interrupts the stream. | Increase **SSE Read Timeout** and verify the network path. |
 | An existing action is marked unsupported | It uses the retired stdio transport. | Explicitly configure a supported remote transport and endpoint, or delete the action. Admin/global scope does not restore stdio support. |
diff --git a/docs/reference/actions/openapi.md b/docs/reference/actions/openapi.md
index 866974d86..1e813ff74 100644
--- a/docs/reference/actions/openapi.md
+++ b/docs/reference/actions/openapi.md
@@ -18,23 +18,30 @@ OpenAPI turns a YAML or JSON OpenAPI specification into callable operations. The
 
 Use OpenAPI when an HTTP API has a maintained OpenAPI spec and users need agents to call multiple documented operations. Do not use it for arbitrary web pages or PDFs; use Smart HTTP. Do not use it for MCP servers; use MCP. Tool-call quality depends on clear operation IDs and parameter schemas.
 
+
 ## Before you start
 
 - An OpenAPI specification file in YAML or JSON, max 5 MB according to the modal help.
-- API **Base URL**, auto-populated from the spec when available but editable.
+- A server URL in the spec's `servers` list. V2 populates the API base URL from that spec value and keeps it read-only unless **Override base URL** is enabled.
 - Authentication details: no auth, API key, bearer token, basic auth, OAuth2 access token, or compatible reusable identity.
+- A decision about which operations to expose. An empty allow-list keeps the backward-compatible behavior where all operations are enabled.
 - Agents/actions enabled with [`enable_semantic_kernel`]({{ '/admin/agents-actions/' | relative_url }}).
 
 ## Configure the action
 
 1. Choose **OpenAPI**.
-2. Upload **OpenAPI Specification File**.
-3. Review or edit **Base URL**.
+2. Upload **OpenAPI Specification File**. The V2 picker shows the selected or imported file name and a **Replace file** button instead of the browser's native empty file text.
+3. Review **API base URL** from the spec. Turn on **Override base URL** only when the deployed API is hosted somewhere else.
 4. Read the **API Information** panel after parsing.
-5. Choose **Authentication Type**: **No Authentication**, **API Key**, bearer token, **Basic Auth**, or **OAuth2**.
-6. For API key auth, choose **Location**, fill **Key Name**, and fill **API Key**.
-7. For bearer, basic, or OAuth2 auth, fill the shown token, username/password, or access token fields.
-8. Use **Test Connection**.
+5. Enable only the operations the agent should call, or use **Enable all** and **Disable all** to manage the list quickly. Selections are stored in `additionalFields.allowed_operations`; an empty list means every operation is enabled for compatibility.
+6. Choose **Authentication Type**: **No Authentication**, **API Key**, bearer token, **Basic Auth**, or **OAuth2**.
+7. For API key auth, choose **Location**, fill **Key Name**, and fill **API Key**.
+8. For bearer, basic, or OAuth2 auth, fill the shown token, username/password, or access token fields.
+9. Use **Validate and test** in **Authentication**.
+
+OpenAPI runtime registration and direct calls both enforce `allowed_operations`, so a disabled operation is rejected before an HTTP request is sent.
+
+The V2 editor no longer offers ad hoc custom fields. Use **Advanced → JSON** only to review preserved legacy values.
 
 ## Example prompts
 
@@ -48,6 +55,7 @@ Use OpenAPI when an HTTP API has a maintained OpenAPI spec and users need agents
 | --- | --- | --- |
 | Operation names are hard for the agent to choose | The spec has missing or ambiguous operation IDs. | Improve operation IDs and summaries, then re-upload. |
 | Authentication fails | Wrong auth type, header name, token, or query parameter is configured. | Match modal auth fields to the API security scheme. |
+| A needed operation is missing | The operation switch is off or **Disable all** was used. | Re-enable the operation and save. |
 | Spec upload fails | File is invalid JSON/YAML or too large. | Validate the spec and keep it under the documented upload limit. |
 
 ## Related
diff --git a/docs/reference/actions/queue-storage.md b/docs/reference/actions/queue-storage.md
index 089658607..08a4508a3 100644
--- a/docs/reference/actions/queue-storage.md
+++ b/docs/reference/actions/queue-storage.md
@@ -23,9 +23,12 @@ Use it when an agent should enqueue work for another system. Do not use it for l
 - Queue endpoint and identity or key auth; the create-action UI hides `queue_storage`.
 - Users also need access to the action through workspace or governance policy where applicable.
 
+
 ## Configuration overview
 
-Use legacy/existing queue manifest fields where exposed.
+`queue_storage` is hidden from new-action creation because it is a legacy/internal integration. Existing queue manifests continue to load for review or migration where governance permits.
+
+The V2 editor no longer offers ad hoc custom fields; preserved legacy values remain available in **Advanced → JSON**.
 
 Shared wizard steps: [Common action setup steps](../#common-action-setup-steps).
 
diff --git a/docs/reference/actions/sql-query.md b/docs/reference/actions/sql-query.md
index 8877388c4..efac50e58 100644
--- a/docs/reference/actions/sql-query.md
+++ b/docs/reference/actions/sql-query.md
@@ -1,7 +1,7 @@
 ---
 layout: page
-title: "SQL Query"
-description: "Full guide for the SQL Query SimpleChat action."
+title: "SQL Database"
+description: "Full guide for the SQL Database SimpleChat action."
 section: "Reference"
 audience: user
 ---
@@ -12,11 +12,11 @@ audience: user
 
 ## What this action does
 
-SQL Query executes SQL against configured SQL Server, Azure SQL, PostgreSQL, MySQL, or SQLite databases. It can validate a query, run row-returning queries, run scalar queries, and answer database questions with supplied SQL. **Max Rows** and **Timeout (seconds)** limit result size and execution time.
+SQL Database executes SQL against configured SQL Server, Azure SQL, PostgreSQL, MySQL, or SQLite databases. It can validate a query, run row-returning queries, run scalar queries, and answer database questions with supplied SQL. **Max Rows** and **Timeout (seconds)** limit result size and execution time.
 
 ## Why and when to use it
 
-Use SQL Query when the answer depends on exact relational data: joins, filters, counts, current rows, or scalar values. Pair it with SQL Schema when the agent needs table and column discovery before writing SQL. Do not use it for Snowflake or Databricks warehouses; those have dedicated actions. Do not use it for spreadsheets; use Tabular Processing. Keep **Read Only Mode** set to **Yes (Recommended)** unless writes have been separately reviewed.
+Use SQL Database when the answer depends on exact relational data: joins, filters, counts, current rows, or scalar values. Schema discovery is included automatically for agents that need table context before writing SQL. Do not use it for Snowflake or Databricks warehouses; those have dedicated actions. Do not use it for spreadsheets; use Tabular Processing. Keep **Read Only Mode** set to **Yes (Recommended)** unless writes have been separately reviewed.
 
 ## Before you start
 
@@ -27,14 +27,14 @@ Use SQL Query when the answer depends on exact relational data: joins, filters,
 
 ## Configure the action
 
-1. Choose **SQL Query**. If the combined SQL panel opens, select **Plugin Type** > **Query Plugin**.
+1. Choose **SQL Database**. Existing manifests still use the `sql_query` type internally, and the combined SQL panel selects **Query Plugin** for row-returning queries.
 2. Choose **Database Type**: **SQL Server**, **Azure SQL**, **PostgreSQL**, **MySQL**, or **SQLite**.
 3. Choose **Connection Method**: **Connection String** or **Individual Parameters**.
 4. Fill **Connection String**, or fill **Server**, **Database**, optional **Port**, and **ODBC Driver** when shown.
 5. Choose **Authentication Type** and fill the shown credential fields, or choose **Reusable Identity** when available.
 6. Under **Query Plugin Settings**, leave **Read Only Mode** at **Yes (Recommended)** unless writes are approved.
 7. Set **Max Rows** and **Timeout (seconds)**.
-8. Use **Test Connection**, then save.
+8. Use the connection check in **Authentication**, then save.
 
 ## Example prompts
 
@@ -50,9 +50,15 @@ Use SQL Query when the answer depends on exact relational data: joins, filters,
 | The agent writes invalid SQL | It does not know the schema. | Pair the agent with SQL Schema or provide table and column names in instructions. |
 | Results are truncated | **Max Rows** is lower than the result size. | Ask for a grouped or filtered result, or raise **Max Rows** within governance limits. |
 
+
+## V2 naming and schema discovery
+
+The V2 action picker labels this action **SQL Database** so owners can distinguish it from warehouse-specific actions. The stored type remains `sql_query` for compatibility. Schema discovery is included automatically for agents that need table context, so the separate `sql_schema` creation card is hidden while existing `sql_schema` actions remain editable.
+
+Connection testing appears in **Authentication**, after credentials. The V2 editor no longer offers ad hoc custom fields; preserved legacy values remain available in **Advanced → JSON**.
+
 ## Related
 
 - [SQL Schema](../sql-schema/)
 - [Actions reference index]({{ '/reference/actions/' | relative_url }})
 - [Agents administration]({{ '/admin/agents-actions/' | relative_url }})
-
diff --git a/docs/reference/actions/sql-schema.md b/docs/reference/actions/sql-schema.md
index 7620a3811..e09c82ce4 100644
--- a/docs/reference/actions/sql-schema.md
+++ b/docs/reference/actions/sql-schema.md
@@ -25,15 +25,22 @@ Use SQL Schema when an agent must understand table names, column names, types, a
 - A decision about **Include System Tables**; the recommended default is **No**.
 - Agents/actions enabled with [`enable_semantic_kernel`]({{ '/admin/agents-actions/' | relative_url }}).
 
+
 ## Configure the action
 
-1. Choose the SQL action flow and select **Plugin Type** > **Schema Plugin**.
+`sql_schema` is hidden from new-action creation because the SQL Database action now includes schema discovery for agents that need table context. Existing SQL Schema actions continue to load and can be edited for compatibility, but new actions should use [SQL Database]({{ '/reference/actions/sql-query/' | relative_url }}).
+
+For existing actions:
+
+1. Open the existing SQL Schema action.
 2. Choose **Database Type** and **Connection Method**.
 3. Fill **Connection String** or individual **Server**, **Database**, **Port**, and **ODBC Driver** fields.
 4. Choose **Authentication Type** and provide credentials or a **Reusable Identity**.
-5. Under **Schema Plugin Settings**, keep **Include System Tables** set to **No (Recommended)** unless system metadata is required.
+5. Keep **Include System Tables** set to **No (Recommended)** unless system metadata is required.
 6. Use **Table Filter** to narrow discovery, for example `user_*` or `*_log`.
-7. Use **Test Connection** before saving.
+7. Use the connection check in **Authentication** before saving.
+
+The V2 editor no longer offers ad hoc custom fields; preserved legacy values remain available in **Advanced → JSON**.
 
 ## Example prompts
 
@@ -47,7 +54,7 @@ Use SQL Schema when an agent must understand table names, column names, types, a
 | --- | --- | --- |
 | Schema output includes too much noise | System tables or broad schemas are included. | Turn off **Include System Tables** and add a **Table Filter**. |
 | The agent cannot see relationships | Metadata permissions are missing or relationships are not defined as foreign keys. | Grant metadata visibility or document the relationship in agent instructions. |
-| The action type is not visible as a separate card | `sql_schema` is hidden from the create-action UI. | Use the combined SQL configuration panel and choose **Schema Plugin**. |
+| The action type is not visible as a separate card | `sql_schema` is hidden from the create-action UI. | Use SQL Database for new actions; existing records still open for compatibility. |
 
 ## Related
 
diff --git a/docs/reference/actions/yamcs.md b/docs/reference/actions/yamcs.md
index b243423b3..6601534a5 100644
--- a/docs/reference/actions/yamcs.md
+++ b/docs/reference/actions/yamcs.md
@@ -24,9 +24,14 @@ Use it for mission-control visibility. Do not use it for commanding; the plugin
 - If the server sits behind a reverse proxy that challenges callers, the username and password that proxy expects.
 - Users also need access to the action through workspace or governance policy where applicable.
 
+
 ## Configuration overview
 
-Set Server URL, Instance, Processor, Authentication Method, credentials, Max Rows, Timeout, Verify TLS, and optional read-only archive SQL.
+Set Server URL, Instance, Processor, primary Yamcs Authentication Method, credentials, Max Rows, Timeout, Verify TLS, and optional read-only archive SQL.
+
+Reverse proxy credentials now live in **Authentication** under **Reverse proxy authentication**, not in Configuration. Turn that switch on only when a proxy in front of Yamcs challenges SimpleChat before the request reaches Yamcs. The proxy username, password, or reusable identity fields appear there when needed.
+
+Connection testing appears in **Authentication**, after both Yamcs and optional proxy credentials. The V2 editor no longer offers ad hoc custom fields; preserved legacy values remain available in **Advanced → JSON**.
 
 Shared wizard steps: [Common action setup steps](../#common-action-setup-steps).
 
@@ -57,7 +62,7 @@ unsupported:
 | Access Token | No | The bearer token also needs `Authorization`. |
 
 Choosing a blocked combination is reported when you save the action and when you use
-**Test Yamcs Connection**, so the conflict surfaces before an agent depends on it.
+the Authentication connection check, so the conflict surfaces before an agent depends on it.
 
 ### Supplying the proxy credential
 
diff --git a/functional_tests/test_action_catalogue_dedupe_hidden_types.py b/functional_tests/test_action_catalogue_dedupe_hidden_types.py
new file mode 100644
index 000000000..b9abd3cf8
--- /dev/null
+++ b/functional_tests/test_action_catalogue_dedupe_hidden_types.py
@@ -0,0 +1,72 @@
+# test_action_catalogue_dedupe_hidden_types.py
+#!/usr/bin/env python3
+"""
+Functional test for action catalogue dedupe and hidden legacy types.
+Version: 0.261.276
+Implemented in: 0.261.276
+
+This test statically validates that get_plugin_types deduplicates by action type,
+hides legacy/internal-only types from new-action creation, and exposes the
+catalogue metadata used by the V2 action picker.
+"""
+
+import ast
+from pathlib import Path
+
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+ROUTE_BACKEND_PLUGINS_FILE = REPO_ROOT / "application" / "single_app" / "route_backend_plugins.py"
+WORKSPACE_AUTHORING_FILE = REPO_ROOT / "application" / "single_app" / "functions_workspace_authoring.py"
+
+
+def _module_tree(path: Path) -> ast.Module:
+    return ast.parse(path.read_text(encoding="utf-8"), filename=str(path))
+
+
+def _function_source(path: Path, name: str) -> str:
+    source = path.read_text(encoding="utf-8")
+    tree = ast.parse(source, filename=str(path))
+    function_node = next(
+        node for node in tree.body
+        if isinstance(node, ast.FunctionDef) and node.name == name
+    )
+    return ast.get_source_segment(source, function_node) or ""
+
+
+def test_hidden_new_action_types_are_declared():
+    source = ROUTE_BACKEND_PLUGINS_FILE.read_text(encoding="utf-8")
+    assert "DATABRICKS_LEGACY_TABLE_PLUGIN_TYPE" in source
+    for plugin_type in ("embedding_model", "queue_storage", "ui_test", "sql_schema"):
+        assert plugin_type in source, f"{plugin_type} must be marked hidden/legacy for new action creation"
+    assert "entry['hidden'] = True" in source
+    assert "entry['legacy'] = True" in source
+
+
+def test_get_plugin_types_dedupes_by_module_class_and_type_key():
+    function_source = _function_source(ROUTE_BACKEND_PLUGINS_FILE, "get_plugin_types")
+    assert "obj.__module__ == module.__name__" in function_source
+    assert "type_entries = {}" in function_source
+    assert "if module_type in type_entries" in function_source
+    assert "list(type_entries.values())" in function_source
+
+
+def test_catalogue_metadata_for_sql_databricks_and_m365():
+    function_source = _function_source(ROUTE_BACKEND_PLUGINS_FILE, "get_plugin_types")
+    assert "display_name = 'SQL Database'" in function_source
+    assert "Schema discovery is included automatically" in function_source
+    assert "Run governed read-only SQL Warehouse queries against Azure Databricks" in function_source
+    assert "graph_endpoint=_catalog_graph_endpoint()" in function_source
+
+
+def test_editor_types_preserve_catalogue_flags_and_capabilities():
+    function_source = _function_source(WORKSPACE_AUTHORING_FILE, "build_action_editor_types")
+    for field in ("hidden", "legacy", "capabilities", "defaults", "graph_endpoint"):
+        assert field in function_source, f"build_action_editor_types must pass through {field}"
+
+
+if __name__ == "__main__":
+    test_hidden_new_action_types_are_declared()
+    test_get_plugin_types_dedupes_by_module_class_and_type_key()
+    test_catalogue_metadata_for_sql_databricks_and_m365()
+    test_editor_types_preserve_catalogue_flags_and_capabilities()
+    print("Action catalogue cleanup checks passed.")
diff --git a/functional_tests/test_action_editor_configuration_cleanup_static.py b/functional_tests/test_action_editor_configuration_cleanup_static.py
new file mode 100644
index 000000000..4bf224ef6
--- /dev/null
+++ b/functional_tests/test_action_editor_configuration_cleanup_static.py
@@ -0,0 +1,65 @@
+# test_action_editor_configuration_cleanup_static.py
+#!/usr/bin/env python3
+"""
+Functional test for V2 action editor configuration cleanup.
+Version: 0.261.276
+Implemented in: 0.261.276
+
+This test statically validates that unknown schema fields are preserved for
+Advanced JSON instead of rendered as removable custom fields, connection checks
+live in Authentication, and internal Yamcs/Log Analytics settings are covered.
+"""
+
+from pathlib import Path
+
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+ACTION_SCHEMA_FIELDS = REPO_ROOT / "application" / "v2_ui" / "src" / "components" / "workspaceActions" / "ActionSchemaFields.tsx"
+ACTION_CONFIGURATION_FIELDS = REPO_ROOT / "application" / "v2_ui" / "src" / "components" / "workspaceActions" / "ActionConfigurationFields.tsx"
+ACTION_AUTHENTICATION = REPO_ROOT / "application" / "v2_ui" / "src" / "components" / "workspaceActions" / "ActionAuthentication.tsx"
+ACTION_CONNECTION_CHECK = REPO_ROOT / "application" / "v2_ui" / "src" / "components" / "workspaceActions" / "ActionConnectionCheck.tsx"
+ACTION_EDITOR_PAGE = REPO_ROOT / "application" / "v2_ui" / "src" / "pages" / "workspace" / "ActionEditorPage.tsx"
+
+
+def test_custom_schema_fields_are_not_rendered_or_removed():
+    source = ACTION_SCHEMA_FIELDS.read_text(encoding="utf-8")
+    assert "function ActionAddCustomField" not in source
+    assert "Remove field" not in source
+    assert "known.startsWith(`${pointer}/`)" in source
+
+
+def test_connection_check_moved_to_authentication():
+    configuration_source = ACTION_CONFIGURATION_FIELDS.read_text(encoding="utf-8")
+    authentication_source = ACTION_AUTHENTICATION.read_text(encoding="utf-8")
+    connection_source = ACTION_CONNECTION_CHECK.read_text(encoding="utf-8")
+    assert "Connection check" not in configuration_source
+    assert "<ActionConnectionCheck props={props} definition={definition}" in authentication_source
+    assert "title=\"Connection check\"" in connection_source
+    assert "title=\"Validate and test\"" in connection_source
+
+
+def test_internal_configuration_fields_are_covered():
+    configuration_source = ACTION_CONFIGURATION_FIELDS.read_text(encoding="utf-8")
+    for hidden_path in (
+        "/additionalFields/query_history",
+        "/additionalFields/enable_basic_auth",
+        "/additionalFields/basic_auth_username",
+        "/additionalFields/basic_auth_password",
+        "/additionalFields/basic_auth_identity_id",
+    ):
+        assert hidden_path in configuration_source
+
+
+def test_empty_configuration_and_hidden_picker_paths():
+    editor_source = ACTION_EDITOR_PAGE.read_text(encoding="utf-8")
+    assert "hasActionConfigurationFields" in editor_source
+    assert "!type.hidden && !type.legacy" in editor_source
+    assert "current settings for this action type will be cleared" in editor_source
+
+
+if __name__ == "__main__":
+    test_custom_schema_fields_are_not_rendered_or_removed()
+    test_connection_check_moved_to_authentication()
+    test_internal_configuration_fields_are_covered()
+    test_empty_configuration_and_hidden_picker_paths()
+    print("Action editor cleanup checks passed.")
diff --git a/functional_tests/test_document_search_action_scope_enforcement.py b/functional_tests/test_document_search_action_scope_enforcement.py
new file mode 100644
index 000000000..c79088f35
--- /dev/null
+++ b/functional_tests/test_document_search_action_scope_enforcement.py
@@ -0,0 +1,207 @@
+#!/usr/bin/env python3
+# test_document_search_action_scope_enforcement.py
+"""
+Functional test for document search action scope enforcement.
+Version: 0.261.276
+Implemented in: 0.261.276
+
+This test ensures that document-search action settings narrow runtime scopes
+without broadening user access, and that page-based summary target lengths are
+normalized while legacy custom values remain compatible.
+"""
+
+import importlib.util
+import sys
+import types
+from pathlib import Path
+
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+PLUGIN_PATH = REPO_ROOT / "application" / "single_app" / "semantic_kernel_plugins" / "document_search_plugin.py"
+
+
+def normalize_search_scope(doc_scope, default_scope="all"):
+    normalized_scope = str(doc_scope or default_scope).strip().lower()
+    return normalized_scope if normalized_scope in {"all", "personal", "group", "public"} else default_scope
+
+
+def normalize_search_id_list(raw_ids):
+    if raw_ids is None:
+        return []
+    if isinstance(raw_ids, str):
+        values = [value.strip() for value in raw_ids.split(",") if value.strip()]
+    elif isinstance(raw_ids, list):
+        values = [str(value).strip() for value in raw_ids if str(value).strip()]
+    else:
+        values = [str(raw_ids).strip()] if str(raw_ids).strip() else []
+    normalized = []
+    for value in values:
+        if value not in normalized:
+            normalized.append(value)
+    return normalized
+
+
+def install_module_stubs():
+    semantic_kernel = types.ModuleType("semantic_kernel")
+    semantic_kernel_functions = types.ModuleType("semantic_kernel.functions")
+    semantic_kernel_functions.kernel_function = lambda *args, **kwargs: (lambda func: func)
+    sys.modules["semantic_kernel"] = semantic_kernel
+    sys.modules["semantic_kernel.functions"] = semantic_kernel_functions
+
+    contracts = types.ModuleType("content_screening.contracts")
+
+    class ScreeningError(Exception):
+        public_message = "Screened"
+        code = "screened"
+        status_code = 400
+
+    contracts.ScreeningError = ScreeningError
+    sys.modules["content_screening.contracts"] = contracts
+
+    auth = types.ModuleType("functions_authentication")
+    auth.get_current_user_id = lambda: "test-user"
+    sys.modules["functions_authentication"] = auth
+
+    citations = types.ModuleType("functions_agent_document_citations")
+    citations.annotate_document_search_payload = lambda payload, _name: payload
+    sys.modules["functions_agent_document_citations"] = citations
+
+    search = types.ModuleType("functions_search")
+    search.SEARCH_DEFAULT_TOP_N = 12
+    search.SEARCH_MAX_TOP_N = 500
+    search.normalize_search_id_list = normalize_search_id_list
+    search.normalize_search_scope = normalize_search_scope
+    search.normalize_search_top_n = lambda value, default, maximum: min(maximum, int(value)) if int(value) > 0 else default
+    sys.modules["functions_search"] = search
+
+    search_service = types.ModuleType("functions_search_service")
+    search_service.SUMMARY_DEFAULT_FINAL_TARGET = "2 pages"
+    search_service.SUMMARY_DEFAULT_WINDOW_SUMMARY_TARGET = "2 pages"
+    search_service.SUMMARY_DEFAULT_WINDOW_UNIT = "pages"
+    search_service.get_document_chunks_payload = lambda **kwargs: {"operation": "chunks", **kwargs}
+    search_service.search_documents = lambda **kwargs: {"operation": "search", "results": [], **kwargs}
+    search_service.summarize_document_content = lambda **kwargs: {"operation": "summary", **kwargs}
+    sys.modules["functions_search_service"] = search_service
+
+    base_module = types.ModuleType("semantic_kernel_plugins.base_plugin")
+
+    class BasePlugin:
+        def __init__(self, manifest=None):
+            self.manifest = manifest or {}
+
+    base_module.BasePlugin = BasePlugin
+    sys.modules["semantic_kernel_plugins.base_plugin"] = base_module
+
+    logger_module = types.ModuleType("semantic_kernel_plugins.plugin_invocation_logger")
+    logger_module.plugin_function_logger = lambda _name: (lambda func: func)
+    sys.modules["semantic_kernel_plugins.plugin_invocation_logger"] = logger_module
+
+
+def load_plugin_module():
+    install_module_stubs()
+    spec = importlib.util.spec_from_file_location("document_search_plugin_under_test", PLUGIN_PATH)
+    module = importlib.util.module_from_spec(spec)
+    assert spec and spec.loader
+    spec.loader.exec_module(module)
+    return module
+
+
+def test_scope_helper_defaults_and_restrictions():
+    plugin_module = load_plugin_module()
+
+    assert plugin_module.normalize_allowed_search_scopes({}) == ["personal", "group", "public"]
+    assert plugin_module.normalize_allowed_search_scopes({"allowed_scopes": ["group", "bogus", "public", "group"]}) == ["group", "public"]
+    assert plugin_module.normalize_allowed_search_scopes({"allowed_scopes": []}) == []
+    assert plugin_module.resolve_allowed_scope_requests("all", ["group", "public"]) == ["group", "public"]
+    assert plugin_module.resolve_allowed_scope_requests("personal", ["group", "public"]) == []
+    assert plugin_module.intersect_allowed_search_ids("g1,g2", ["g2", "g3"]) == ["g2"]
+    assert plugin_module.intersect_allowed_search_ids("", ["g2", "g3"]) == ["g2", "g3"]
+    assert plugin_module.intersect_allowed_search_ids("g1,g2", []) == "g1,g2"
+
+
+def test_search_documents_skips_disabled_scopes_and_intersects_ids():
+    plugin_module = load_plugin_module()
+    calls = []
+
+    def fake_search_documents(**kwargs):
+        calls.append(kwargs)
+        return {
+            "results": [{"document_id": f"doc-{kwargs['doc_scope']}", "scope": kwargs["doc_scope"]}],
+            "result_count": 1,
+            "document_count": 1,
+            "query": kwargs["query"],
+            "scope": kwargs["doc_scope"],
+            "top_n": kwargs["top_n"],
+        }
+
+    plugin_module.run_document_search = fake_search_documents
+    plugin = plugin_module.DocumentSearchPlugin({
+        "additionalFields": {
+            "allowed_scopes": ["group", "public"],
+            "allowed_group_ids": ["g2", "g3"],
+            "allowed_public_workspace_ids": ["p2"],
+            "default_top_n": 3,
+        },
+    })
+
+    payload = plugin.search_documents(
+        query="policy",
+        doc_scope="all",
+        active_group_ids="g1,g2",
+        active_public_workspace_id="p1,p2",
+    )
+
+    assert [call["doc_scope"] for call in calls] == ["group", "public"]
+    assert calls[0]["active_group_ids"] == ["g2"]
+    assert calls[0]["active_public_workspace_id"] == ["p2"]
+    assert calls[1]["active_group_ids"] == ["g2"]
+    assert calls[1]["active_public_workspace_id"] == ["p2"]
+    assert payload["allowed_scopes"] == ["group", "public"]
+    assert payload["result_count"] == 2
+    assert [result["scope"] for result in payload["results"]] == ["group", "public"]
+
+
+def test_search_documents_rejects_disabled_specific_scope():
+    plugin_module = load_plugin_module()
+    calls = []
+    plugin_module.run_document_search = lambda **kwargs: calls.append(kwargs) or {"results": []}
+    plugin = plugin_module.DocumentSearchPlugin({"additionalFields": {"allowed_scopes": ["group"]}})
+
+    payload = plugin.search_documents(query="policy", doc_scope="personal")
+
+    assert calls == []
+    assert payload == {"error": "Document search scope is not allowed for this action."}
+
+
+def test_target_length_parsing_and_normalization():
+    plugin_module = load_plugin_module()
+
+    assert plugin_module.parse_page_target_length("2 pages", 1, 10) == 2
+    assert plugin_module.parse_page_target_length("1 page", 1, 10) == 1
+    assert plugin_module.parse_page_target_length("15 pages", 1, 10) == 10
+    assert plugin_module.parse_page_target_length("500 words", 1, 10) is None
+    assert plugin_module.normalize_summary_target_length("", "2 pages", 1, 10) == "2 pages"
+    assert plugin_module.normalize_summary_target_length("15 pages", "2 pages", 1, 10) == "10 pages"
+    assert plugin_module.normalize_summary_target_length("500 words", "2 pages", 1, 10) == "500 words"
+
+    plugin = plugin_module.DocumentSearchPlugin({
+        "additionalFields": {
+            "default_window_target_length": "99 pages",
+            "default_final_target_length": "500 words",
+        },
+    })
+    assert plugin._resolve_target_length("", "default_window_target_length", "2 pages") == "10 pages"
+    assert plugin._resolve_target_length("", "default_final_target_length", "2 pages") == "500 words"
+
+
+if __name__ == "__main__":
+    tests = [
+        test_scope_helper_defaults_and_restrictions,
+        test_search_documents_skips_disabled_scopes_and_intersects_ids,
+        test_search_documents_rejects_disabled_specific_scope,
+        test_target_length_parsing_and_normalization,
+    ]
+    for test in tests:
+        print(f"Running {test.__name__}...")
+        test()
+    print("All document search action scope enforcement tests passed.")
diff --git a/functional_tests/test_mcp_tool_fingerprint_pinning.py b/functional_tests/test_mcp_tool_fingerprint_pinning.py
new file mode 100644
index 000000000..97558fc38
--- /dev/null
+++ b/functional_tests/test_mcp_tool_fingerprint_pinning.py
@@ -0,0 +1,147 @@
+#!/usr/bin/env python3
+"""
+Functional test for MCP tool fingerprint pinning.
+Version: 0.261.276
+Implemented in: 0.261.276
+
+This test ensures MCP tool and prompt fingerprints are stable, drift is detected,
+and pinned runtime filtering only exposes approved unchanged tools.
+"""
+
+import os
+import sys
+
+sys.path.append(os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", "application", "single_app"))
+
+from functions_mcp_tool_pinning import (
+    build_mcp_tool_fingerprints,
+    compare_mcp_fingerprints,
+    compute_mcp_tool_hash,
+    filter_pinned_mcp_tools,
+)
+
+
+def _tool(name="search", description="Search docs", extra_schema_order=False):
+    properties = {
+        "query": {"type": "string", "description": "Query"},
+        "limit": {"type": "integer", "default": 5},
+    }
+    if extra_schema_order:
+        properties = {
+            "limit": {"default": 5, "type": "integer"},
+            "query": {"description": "Query", "type": "string"},
+        }
+    return {
+        "original_name": name,
+        "function_name": name,
+        "description": description,
+        "input_schema": {"type": "object", "properties": properties},
+        "output_schema": {"type": "object", "properties": {"items": {"type": "array"}}},
+        "annotations": {"readOnlyHint": True},
+    }
+
+
+def test_tool_hash_is_canonical_and_stable():
+    first = _tool()
+    second = _tool(extra_schema_order=True)
+    assert compute_mcp_tool_hash(first) == compute_mcp_tool_hash(second)
+
+
+def test_manifest_drift_detects_new_changed_and_removed_tools():
+    approved = build_mcp_tool_fingerprints([
+        _tool("search"),
+        _tool("fetch", "Fetch document"),
+    ], [{"name": "summarize", "description": "Summarize", "arguments": [{"name": "topic"}]}])
+    current = build_mcp_tool_fingerprints([
+        _tool("search", "Changed description"),
+        _tool("new_tool", "New tool"),
+    ], [{"name": "summarize", "description": "Changed", "arguments": [{"name": "topic"}]}])
+
+    drift = compare_mcp_fingerprints(approved, current)
+
+    assert drift["has_drift"] is True
+    assert drift["new"] == ["new_tool"]
+    assert drift["changed"] == ["search"]
+    assert drift["removed"] == ["fetch"]
+    assert drift["prompts_changed"] == ["summarize"]
+
+
+def test_runtime_filtering_keeps_only_approved_unchanged_tools():
+    approved_tools = [_tool("search"), _tool("fetch")]
+    approved = build_mcp_tool_fingerprints(approved_tools, [])
+    current_tools = [_tool("search"), _tool("fetch", "Changed"), _tool("extra")]
+
+    filtered, drift = filter_pinned_mcp_tools(current_tools, approved)
+
+    assert [tool["original_name"] for tool in filtered] == ["search"]
+    assert drift["has_drift"] is True
+    assert drift["new"] == ["extra"]
+    assert drift["changed"] == ["fetch"]
+    assert drift["removed"] == []
+
+
+def test_legacy_unpinned_action_is_not_blocked_by_normalized_defaults():
+    from functions_mcp_tool_pinning import validate_mcp_tool_pinning_for_save
+    from functions_mcp_operations import normalize_mcp_additional_fields
+
+    existing = {
+        "id": "legacy-mcp",
+        "type": "mcp",
+        "endpoint": "https://mcp.example.test/mcp",
+        "auth": {"type": "key"},
+        "additionalFields": {"transport": "streamable_http", "allowed_tool_names": []},
+    }
+    edited = dict(existing)
+    edited["additionalFields"] = normalize_mcp_additional_fields(existing["additionalFields"])
+    validate_mcp_tool_pinning_for_save(edited, existing)
+
+    changed = dict(edited)
+    changed["endpoint"] = "https://other.example.test/mcp"
+    try:
+        validate_mcp_tool_pinning_for_save(changed, existing)
+    except ValueError:
+        pass
+    else:
+        raise AssertionError("Changed legacy MCP endpoint saved without discovery.")
+
+
+def test_drift_persistence_and_notification_failures_are_logged_not_raised():
+    import types
+    import functions_mcp_tool_pinning as pinning
+
+    origin = types.SimpleNamespace(scope_type="personal", scope_id="user-1", action_id="action-1")
+    failing_config = types.ModuleType("config")
+    failing_notifications = types.ModuleType("functions_notifications")
+
+    def fail_notification(**_kwargs):
+        raise RuntimeError("notification failure")
+
+    failing_notifications.create_notification = fail_notification
+    saved_modules = {name: sys.modules.get(name) for name in ("config", "functions_notifications")}
+    saved_origin = pinning.get_action_origin
+    logged = []
+    saved_log = pinning.log_event
+    try:
+        sys.modules["config"] = failing_config
+        sys.modules["functions_notifications"] = failing_notifications
+        pinning.get_action_origin = lambda _action: origin
+        pinning.log_event = lambda message, **kwargs: logged.append(message)
+        pinning.persist_mcp_tool_drift({"type": "mcp"}, {"has_drift": True, "manifest_hash": "abc"})
+    finally:
+        pinning.get_action_origin = saved_origin
+        pinning.log_event = saved_log
+        for name, module in saved_modules.items():
+            if module is None:
+                sys.modules.pop(name, None)
+            else:
+                sys.modules[name] = module
+    assert len(logged) == 2
+
+
+if __name__ == "__main__":
+    test_tool_hash_is_canonical_and_stable()
+    test_manifest_drift_detects_new_changed_and_removed_tools()
+    test_runtime_filtering_keeps_only_approved_unchanged_tools()
+    test_legacy_unpinned_action_is_not_blocked_by_normalized_defaults()
+    test_drift_persistence_and_notification_failures_are_logged_not_raised()
+    print("MCP tool fingerprint pinning tests passed.")
diff --git a/functional_tests/test_openapi_allowed_operations_filter.py b/functional_tests/test_openapi_allowed_operations_filter.py
new file mode 100644
index 000000000..785e7a79c
--- /dev/null
+++ b/functional_tests/test_openapi_allowed_operations_filter.py
@@ -0,0 +1,147 @@
+# test_openapi_allowed_operations_filter.py
+#!/usr/bin/env python3
+"""
+Functional test for OpenAPI allowed operation filtering.
+Version: 0.261.276
+Implemented in: 0.261.276
+
+This test ensures OpenAPI actions expose only the configured operation IDs while
+preserving backward-compatible all-operation behavior when no allow-list exists.
+"""
+
+import os
+import sys
+import types
+
+
+REPO_ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+APP_ROOT = os.path.join(REPO_ROOT, "application", "single_app")
+if APP_ROOT not in sys.path:
+    sys.path.insert(0, APP_ROOT)
+
+# Keep this focused unit-style functional test offline: the OpenAPI plugin logger normally
+# imports the web authentication/bootstrap stack, which initializes Azure clients.
+auth_module = types.ModuleType("functions_authentication")
+auth_module.get_current_user_id = lambda: "openapi-test-user"
+sys.modules["functions_authentication"] = auth_module
+
+appinsights_module = types.ModuleType("functions_appinsights")
+appinsights_module.log_event = lambda *args, **kwargs: None
+appinsights_module.get_appinsights_logger = lambda: None
+appinsights_module.debug_print = lambda *args, **kwargs: None
+appinsights_module.is_debug_enabled = lambda: False
+sys.modules["functions_appinsights"] = appinsights_module
+
+from semantic_kernel_plugins.openapi_plugin_factory import OpenApiPluginFactory
+
+
+INLINE_SPEC = {
+    "openapi": "3.0.0",
+    "info": {"title": "Allowed Operations Test API", "version": "1.0.0"},
+    "paths": {
+        "/pets": {
+            "get": {
+                "operationId": "listPets",
+                "summary": "List pets",
+                "responses": {"200": {"description": "OK"}},
+            },
+            "post": {
+                "operationId": "createPet",
+                "summary": "Create a pet",
+                "responses": {"201": {"description": "Created"}},
+            },
+        },
+        "/status": {
+            "get": {
+                "summary": "Get service status",
+                "responses": {"200": {"description": "OK"}},
+            },
+        },
+    },
+}
+
+
+def create_plugin(allowed_operations=None):
+    """Create a plugin with the inline spec and optional allow-list."""
+    additional_fields = {"openapi_spec_content": INLINE_SPEC}
+    if allowed_operations is not None:
+        additional_fields["allowed_operations"] = allowed_operations
+    return OpenApiPluginFactory.create_from_config({
+        "name": "allowed_operations_test",
+        "base_url": "https://api.example.test",
+        "additionalFields": additional_fields,
+    })
+
+
+def create_plugin_with_root_allow_list(allowed_operations):
+    """Create a plugin where allowed_operations is stored at the manifest root."""
+    return OpenApiPluginFactory.create_from_config({
+        "name": "allowed_operations_test",
+        "base_url": "https://api.example.test",
+        "openapi_spec_content": INLINE_SPEC,
+        "allowed_operations": allowed_operations,
+    })
+
+
+def test_allowed_operations_filter_registered_functions():
+    """Only configured operation IDs and generated operation keys are registered."""
+    plugin = create_plugin(["listPets", "get__status"])
+
+    functions = set(plugin.get_functions())
+    assert "listPets" in functions
+    assert "get__status" in functions
+    assert "createPet" not in functions
+    assert "call_operation" in functions
+    assert hasattr(plugin, "listPets")
+    assert hasattr(plugin, "get__status")
+    assert not hasattr(plugin, "createPet")
+    assert plugin.get_operation_details("listPets") is not None
+    assert plugin.get_operation_details("createPet") is None
+
+
+def test_factory_passes_root_allowed_operations_manifest_field():
+    """Root-level manifest allow-lists are passed through for legacy callers."""
+    plugin = create_plugin_with_root_allow_list(["createPet"])
+    functions = set(plugin.get_functions())
+    assert "createPet" in functions
+    assert "listPets" not in functions
+    assert "get__status" not in functions
+
+
+def test_disallowed_operation_rejected_before_http_call():
+    """A disabled operation is rejected at call time without issuing a request."""
+    plugin = create_plugin(["listPets"])
+
+    try:
+        plugin.call_operation(operation_id="createPet")
+    except PermissionError as ex:
+        assert "not enabled" in str(ex)
+    else:
+        raise AssertionError("Disabled OpenAPI operation was not rejected.")
+
+
+def test_empty_or_missing_allow_list_keeps_backward_compatible_all_operations():
+    """Missing or empty allowed_operations continues to expose every operation."""
+    for allowed_operations in (None, []):
+        plugin = create_plugin(allowed_operations)
+        functions = set(plugin.get_functions())
+        assert {"listPets", "createPet", "get__status"}.issubset(functions)
+
+
+def test_malformed_allow_list_fails_closed():
+    """A present non-list allow-list must not silently expose every operation."""
+    try:
+        create_plugin("listPets")
+    except ValueError:
+        pass
+    else:
+        raise AssertionError("Malformed allowed_operations exposed the plugin.")
+
+
+if __name__ == "__main__":
+    test_allowed_operations_filter_registered_functions()
+    test_factory_passes_root_allowed_operations_manifest_field()
+    test_disallowed_operation_rejected_before_http_call()
+    test_empty_or_missing_allow_list_keeps_backward_compatible_all_operations()
+    test_malformed_allow_list_fails_closed()
+    print("OpenAPI allowed operation filtering tests passed.")

From 580113caa409d3d5bf867c62c55fff369b51290d Mon Sep 17 00:00:00 2001
From: Paul Lizer <paullizer@microsoft.com>
Date: Wed, 7 Oct 2026 10:32:00 -0400
Subject: [PATCH 2/2] Break MCP fingerprint import cycles

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 application/single_app/config.py              |   2 +-
 .../functions_mcp_fingerprint_metadata.py     |  61 +++++++
 .../single_app/functions_mcp_operations.py    |   2 +-
 .../single_app/functions_mcp_tool_pinning.py  | 158 +++++++++---------
 docs/explanation/release_notes.md             |   8 +
 .../test_mcp_tool_fingerprint_pinning.py      |  25 +--
 6 files changed, 161 insertions(+), 95 deletions(-)
 create mode 100644 application/single_app/functions_mcp_fingerprint_metadata.py

diff --git a/application/single_app/config.py b/application/single_app/config.py
index 7378b2436..0b2eb9674 100644
--- a/application/single_app/config.py
+++ b/application/single_app/config.py
@@ -101,7 +101,7 @@
 EXECUTOR_TYPE = 'thread'
 EXECUTOR_MAX_WORKERS = 30
 SESSION_TYPE = 'filesystem'
-VERSION = "0.261.278"
+VERSION = "0.261.279"
 IS_DEVELOPMENT = is_development_env_enabled()
 
 # Opt-out for deployments where App Service Easy Auth is active but the platform
diff --git a/application/single_app/functions_mcp_fingerprint_metadata.py b/application/single_app/functions_mcp_fingerprint_metadata.py
new file mode 100644
index 000000000..cead83b14
--- /dev/null
+++ b/application/single_app/functions_mcp_fingerprint_metadata.py
@@ -0,0 +1,61 @@
+# functions_mcp_fingerprint_metadata.py
+"""Shared MCP prompt and tool fingerprint metadata normalization."""
+
+from typing import Any, Dict, List
+
+
+MCP_TOOL_FINGERPRINTS_FIELD = "mcp_tool_fingerprints"
+MCP_TOOL_DRIFT_FIELD = "mcp_tool_drift"
+MCP_PROMPTS_FIELD = "mcp_prompts"
+
+
+def normalize_mcp_prompt_metadata(value: Any) -> List[Dict[str, Any]]:
+    """Return normalized MCP prompt metadata entries."""
+    if not isinstance(value, list):
+        return []
+
+    prompts = []
+    seen_names = set()
+    for prompt in value:
+        if not isinstance(prompt, dict):
+            continue
+        name = str(prompt.get("name") or "").strip()
+        if not name or name in seen_names:
+            continue
+        seen_names.add(name)
+        arguments = prompt.get("arguments")
+        if not isinstance(arguments, list):
+            arguments = []
+        prompts.append({
+            "name": name,
+            "description": str(prompt.get("description") or "").strip(),
+            "arguments": [
+                argument for argument in arguments
+                if isinstance(argument, dict) and str(argument.get("name") or "").strip()
+            ],
+        })
+    return prompts
+
+
+def normalize_mcp_tool_fingerprints(value: Any) -> Dict[str, Any]:
+    """Return a normalized approved fingerprint object, or an empty dict."""
+    if not isinstance(value, dict):
+        return {}
+    manifest_hash = str(value.get("manifest_hash") or "").strip()
+    tools = value.get("tools") if isinstance(value.get("tools"), dict) else {}
+    prompts = value.get("prompts") if isinstance(value.get("prompts"), dict) else {}
+    normalized = {
+        "manifest_hash": manifest_hash,
+        "tools": {
+            str(name): str(fingerprint)
+            for name, fingerprint in tools.items()
+            if str(name).strip() and str(fingerprint).strip()
+        },
+        "prompts": {
+            str(name): str(fingerprint)
+            for name, fingerprint in prompts.items()
+            if str(name).strip() and str(fingerprint).strip()
+        },
+        "discovered_at": str(value.get("discovered_at") or "").strip(),
+    }
+    return normalized if normalized["manifest_hash"] and normalized["discovered_at"] else {}
diff --git a/application/single_app/functions_mcp_operations.py b/application/single_app/functions_mcp_operations.py
index 992fe8548..de0c818fa 100644
--- a/application/single_app/functions_mcp_operations.py
+++ b/application/single_app/functions_mcp_operations.py
@@ -8,7 +8,7 @@
 from jsonschema.exceptions import SchemaError
 
 from functions_action_manifest import McpConfigurationError, McpStdioRemovedError
-from functions_mcp_tool_pinning import (
+from functions_mcp_fingerprint_metadata import (
     MCP_PROMPTS_FIELD,
     MCP_TOOL_DRIFT_FIELD,
     MCP_TOOL_FINGERPRINTS_FIELD,
diff --git a/application/single_app/functions_mcp_tool_pinning.py b/application/single_app/functions_mcp_tool_pinning.py
index b8828498c..1728d50d2 100644
--- a/application/single_app/functions_mcp_tool_pinning.py
+++ b/application/single_app/functions_mcp_tool_pinning.py
@@ -9,12 +9,19 @@
 
 from functions_action_manifest import get_action_origin, resolve_action_type
 from functions_appinsights import log_event
+from functions_mcp_fingerprint_metadata import (
+    MCP_PROMPTS_FIELD,
+    MCP_TOOL_DRIFT_FIELD,
+    MCP_TOOL_FINGERPRINTS_FIELD,
+    normalize_mcp_prompt_metadata,
+    normalize_mcp_tool_fingerprints,
+)
+from functions_mcp_operations import normalize_mcp_additional_fields, normalize_mcp_tool_metadata
 
 
-MCP_TOOL_FINGERPRINTS_FIELD = "mcp_tool_fingerprints"
-MCP_TOOL_DRIFT_FIELD = "mcp_tool_drift"
-MCP_PROMPTS_FIELD = "mcp_prompts"
 MCP_DRIFT_NOTIFICATION_TYPE = "mcp_tool_drift_detected"
+MCP_DRIFT_NOTIFICATION_TTL_SECONDS = 60 * 24 * 60 * 60
+MCP_DRIFT_NOTIFICATION_IDEMPOTENCY_KEY_MAX_LENGTH = 512
 MCP_PLUGIN_TYPE = "mcp"
 
 
@@ -34,40 +41,6 @@ def _tool_payload(tool: Dict[str, Any]) -> Dict[str, Any]:
     }
 
 
-def normalize_mcp_prompt_metadata(value: Any) -> List[Dict[str, Any]]:
-    """Return normalized MCP prompt metadata entries."""
-    if not isinstance(value, list):
-        return []
-
-    prompts = []
-    seen_names = set()
-    for prompt in value:
-        if not isinstance(prompt, dict):
-            continue
-        name = str(prompt.get("name") or "").strip()
-        if not name or name in seen_names:
-            continue
-        seen_names.add(name)
-        arguments = prompt.get("arguments")
-        if not isinstance(arguments, list):
-            arguments = []
-        prompts.append({
-            "name": name,
-            "description": str(prompt.get("description") or "").strip(),
-            "arguments": [
-                argument for argument in arguments
-                if isinstance(argument, dict) and str(argument.get("name") or "").strip()
-            ],
-        })
-    return prompts
-
-
-def _normalize_mcp_tool_metadata(value: Any) -> List[Dict[str, Any]]:
-    from functions_mcp_operations import normalize_mcp_tool_metadata
-
-    return normalize_mcp_tool_metadata(value)
-
-
 def _prompt_payload(prompt: Dict[str, Any]) -> Dict[str, Any]:
     return {
         "name": str(prompt.get("name") or "").strip(),
@@ -93,7 +66,7 @@ def build_mcp_tool_fingerprints(
     discovered_at: Optional[str] = None,
 ) -> Dict[str, Any]:
     """Build the approved fingerprint manifest for discovered MCP tools and prompts."""
-    normalized_tools = _normalize_mcp_tool_metadata(list(tools or []))
+    normalized_tools = normalize_mcp_tool_metadata(list(tools or []))
     normalized_prompts = normalize_mcp_prompt_metadata(list(prompts or []))
     tool_hashes = {
         tool["original_name"]: compute_mcp_tool_hash(tool)
@@ -117,30 +90,6 @@ def build_mcp_tool_fingerprints(
     }
 
 
-def normalize_mcp_tool_fingerprints(value: Any) -> Dict[str, Any]:
-    """Return a normalized approved fingerprint object, or an empty dict."""
-    if not isinstance(value, dict):
-        return {}
-    manifest_hash = str(value.get("manifest_hash") or "").strip()
-    tools = value.get("tools") if isinstance(value.get("tools"), dict) else {}
-    prompts = value.get("prompts") if isinstance(value.get("prompts"), dict) else {}
-    normalized = {
-        "manifest_hash": manifest_hash,
-        "tools": {
-            str(name): str(fingerprint)
-            for name, fingerprint in tools.items()
-            if str(name).strip() and str(fingerprint).strip()
-        },
-        "prompts": {
-            str(name): str(fingerprint)
-            for name, fingerprint in prompts.items()
-            if str(name).strip() and str(fingerprint).strip()
-        },
-        "discovered_at": str(value.get("discovered_at") or "").strip(),
-    }
-    return normalized if normalized["manifest_hash"] and normalized["discovered_at"] else {}
-
-
 def compare_mcp_fingerprints(
     approved: Dict[str, Any],
     current: Dict[str, Any],
@@ -181,7 +130,7 @@ def filter_pinned_mcp_tools(
     fingerprints: Dict[str, Any],
 ) -> Tuple[List[Dict[str, Any]], Dict[str, Any]]:
     """Return only tools matching approved fingerprints, plus drift metadata."""
-    normalized_tools = _normalize_mcp_tool_metadata(list(tools or []))
+    normalized_tools = normalize_mcp_tool_metadata(list(tools or []))
     approved = normalize_mcp_tool_fingerprints(fingerprints)
     approved_tools = approved.get("tools", {})
     if not approved_tools:
@@ -235,9 +184,6 @@ def relevant(source: Dict[str, Any], additional: Dict[str, Any]) -> Dict[str, An
             **{key: additional.get(key) for key in relevant_keys if key not in {"endpoint", "identity_id", "auth"}},
         }
 
-    # Lazy import: functions_mcp_operations imports this module.
-    from functions_mcp_operations import normalize_mcp_additional_fields
-
     changed = existing_action is None or (
         relevant(action, normalize_mcp_additional_fields(fields))
         != relevant(existing_action, normalize_mcp_additional_fields(existing_fields))
@@ -248,7 +194,7 @@ def relevant(source: Dict[str, Any], additional: Dict[str, Any]) -> Dict[str, An
         raise ValueError("Discover and approve MCP tools before saving this action.")
 
     current = build_mcp_tool_fingerprints(
-        _normalize_mcp_tool_metadata(fields.get("mcp_tools")),
+        normalize_mcp_tool_metadata(fields.get("mcp_tools")),
         normalize_mcp_prompt_metadata(fields.get(MCP_PROMPTS_FIELD)),
         discovered_at=fingerprints.get("discovered_at"),
     )
@@ -305,27 +251,85 @@ def persist_mcp_tool_drift(action: Dict[str, Any], drift: Dict[str, Any]) -> Non
         )
 
     try:
-        from functions_notifications import create_notification
+        from config import cosmos_notifications_container
 
-        notification_kwargs = {
+        notification_doc = {
+            "user_id": origin.scope_id if origin.scope_type == "personal" else None,
+            "group_id": origin.scope_id if origin.scope_type == "group" else None,
+            "public_workspace_id": None,
+            "scope": "assignment" if origin.scope_type == "global" else origin.scope_type,
             "notification_type": MCP_DRIFT_NOTIFICATION_TYPE,
             "title": "MCP tools changed — review required",
             "message": "An MCP server changed its tool or prompt manifest. Review and re-approve the action before new or changed tools can run.",
+            "created_at": detected_at,
+            "ttl": MCP_DRIFT_NOTIFICATION_TTL_SECONDS,
+            "read_by": [],
+            "dismissed_by": [],
+            "link_url": "",
+            "link_context": {},
             "metadata": {
                 "action_id": origin.action_id,
                 "scope_type": origin.scope_type,
                 "scope_id": origin.scope_id,
                 "manifest_hash": manifest_hash,
             },
-            "idempotency_key": f"mcp-tool-drift:{origin.scope_type}:{origin.scope_id}:{origin.action_id}:{manifest_hash}",
+            "assignment": {"roles": ["Admin", "ControlCenterAdmin"]}
+            if origin.scope_type == "global"
+            else None,
         }
-        if origin.scope_type == "personal":
-            notification_kwargs["user_id"] = origin.scope_id
-        elif origin.scope_type == "group":
-            notification_kwargs["group_id"] = origin.scope_id
-        else:
-            notification_kwargs["assignment"] = {"roles": ["Admin", "ControlCenterAdmin"]}
-        create_notification(**notification_kwargs)
+        idempotency_key = (
+            f"mcp-tool-drift:{origin.scope_type}:{origin.scope_id}:"
+            f"{origin.action_id}:{manifest_hash}"
+        )
+        if len(idempotency_key) > MCP_DRIFT_NOTIFICATION_IDEMPOTENCY_KEY_MAX_LENGTH:
+            raise ValueError("The MCP drift notification retry key is too long.")
+        retry_identity = {
+            "version": 1,
+            "key": idempotency_key,
+            **{
+                field: notification_doc.get(field)
+                for field in (
+                    "scope",
+                    "user_id",
+                    "group_id",
+                    "public_workspace_id",
+                    "notification_type",
+                    "assignment",
+                )
+            },
+        }
+        encoded_identity = json.dumps(
+            retry_identity,
+            sort_keys=True,
+            ensure_ascii=True,
+            separators=(",", ":"),
+            allow_nan=False,
+        ).encode("utf-8")
+        notification_doc["id"] = (
+            f"notification-{hashlib.sha256(encoded_identity).hexdigest()}"
+        )
+        try:
+            cosmos_notifications_container.create_item(notification_doc)
+        except Exception as exc:
+            if getattr(exc, "status_code", None) != 409:
+                raise
+            existing = cosmos_notifications_container.read_item(
+                item=notification_doc["id"],
+                partition_key=notification_doc.get("user_id"),
+            )
+            if not isinstance(existing, dict) or any(
+                existing.get(field) != notification_doc.get(field)
+                for field in (
+                    "id",
+                    "scope",
+                    "user_id",
+                    "group_id",
+                    "public_workspace_id",
+                    "notification_type",
+                    "assignment",
+                )
+            ):
+                raise ValueError("The stored MCP drift notification does not match its retry identity.")
     except Exception as exc:
         log_event(
             "[MCP_PINNING] Failed to deliver MCP tool drift notification",
diff --git a/docs/explanation/release_notes.md b/docs/explanation/release_notes.md
index 933c12470..96edc6040 100644
--- a/docs/explanation/release_notes.md
+++ b/docs/explanation/release_notes.md
@@ -2,6 +2,14 @@
 
 For feature-focused and fix-focused drill-downs by version, see [Features by Version](https://github.com/microsoft/simplechat/tree/main/docs/explanation/features) and [Fixes by Version](https://github.com/microsoft/simplechat/tree/main/docs/explanation/fixes).
 
+### **(v0.261.279)**
+
+#### Bug Fixes
+
+*   **MCP Fingerprint Import Cycle**
+    *   Shared MCP fingerprint metadata normalization now lives in a dependency-neutral module, avoiding cyclic imports during action loading and notification delivery.
+    *   (Ref: `functions_mcp_fingerprint_metadata.py`, `functions_mcp_operations.py`, `functions_mcp_tool_pinning.py`)
+
 ### **(v0.261.278)**
 
 #### New Features
diff --git a/functional_tests/test_mcp_tool_fingerprint_pinning.py b/functional_tests/test_mcp_tool_fingerprint_pinning.py
index 97558fc38..a0ed97d53 100644
--- a/functional_tests/test_mcp_tool_fingerprint_pinning.py
+++ b/functional_tests/test_mcp_tool_fingerprint_pinning.py
@@ -13,12 +13,7 @@
 
 sys.path.append(os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", "application", "single_app"))
 
-from functions_mcp_tool_pinning import (
-    build_mcp_tool_fingerprints,
-    compare_mcp_fingerprints,
-    compute_mcp_tool_hash,
-    filter_pinned_mcp_tools,
-)
+import functions_mcp_tool_pinning as pinning
 
 
 def _tool(name="search", description="Search docs", extra_schema_order=False):
@@ -44,20 +39,20 @@ def _tool(name="search", description="Search docs", extra_schema_order=False):
 def test_tool_hash_is_canonical_and_stable():
     first = _tool()
     second = _tool(extra_schema_order=True)
-    assert compute_mcp_tool_hash(first) == compute_mcp_tool_hash(second)
+    assert pinning.compute_mcp_tool_hash(first) == pinning.compute_mcp_tool_hash(second)
 
 
 def test_manifest_drift_detects_new_changed_and_removed_tools():
-    approved = build_mcp_tool_fingerprints([
+    approved = pinning.build_mcp_tool_fingerprints([
         _tool("search"),
         _tool("fetch", "Fetch document"),
     ], [{"name": "summarize", "description": "Summarize", "arguments": [{"name": "topic"}]}])
-    current = build_mcp_tool_fingerprints([
+    current = pinning.build_mcp_tool_fingerprints([
         _tool("search", "Changed description"),
         _tool("new_tool", "New tool"),
     ], [{"name": "summarize", "description": "Changed", "arguments": [{"name": "topic"}]}])
 
-    drift = compare_mcp_fingerprints(approved, current)
+    drift = pinning.compare_mcp_fingerprints(approved, current)
 
     assert drift["has_drift"] is True
     assert drift["new"] == ["new_tool"]
@@ -68,10 +63,10 @@ def test_manifest_drift_detects_new_changed_and_removed_tools():
 
 def test_runtime_filtering_keeps_only_approved_unchanged_tools():
     approved_tools = [_tool("search"), _tool("fetch")]
-    approved = build_mcp_tool_fingerprints(approved_tools, [])
+    approved = pinning.build_mcp_tool_fingerprints(approved_tools, [])
     current_tools = [_tool("search"), _tool("fetch", "Changed"), _tool("extra")]
 
-    filtered, drift = filter_pinned_mcp_tools(current_tools, approved)
+    filtered, drift = pinning.filter_pinned_mcp_tools(current_tools, approved)
 
     assert [tool["original_name"] for tool in filtered] == ["search"]
     assert drift["has_drift"] is True
@@ -81,7 +76,6 @@ def test_runtime_filtering_keeps_only_approved_unchanged_tools():
 
 
 def test_legacy_unpinned_action_is_not_blocked_by_normalized_defaults():
-    from functions_mcp_tool_pinning import validate_mcp_tool_pinning_for_save
     from functions_mcp_operations import normalize_mcp_additional_fields
 
     existing = {
@@ -93,12 +87,12 @@ def test_legacy_unpinned_action_is_not_blocked_by_normalized_defaults():
     }
     edited = dict(existing)
     edited["additionalFields"] = normalize_mcp_additional_fields(existing["additionalFields"])
-    validate_mcp_tool_pinning_for_save(edited, existing)
+    pinning.validate_mcp_tool_pinning_for_save(edited, existing)
 
     changed = dict(edited)
     changed["endpoint"] = "https://other.example.test/mcp"
     try:
-        validate_mcp_tool_pinning_for_save(changed, existing)
+        pinning.validate_mcp_tool_pinning_for_save(changed, existing)
     except ValueError:
         pass
     else:
@@ -107,7 +101,6 @@ def test_legacy_unpinned_action_is_not_blocked_by_normalized_defaults():
 
 def test_drift_persistence_and_notification_failures_are_logged_not_raised():
     import types
-    import functions_mcp_tool_pinning as pinning
 
     origin = types.SimpleNamespace(scope_type="personal", scope_id="user-1", action_id="action-1")
     failing_config = types.ModuleType("config")