feat(057): /mcp/p/<slug> profile routing + 4-surface filter + tests (T008-T022)

- profileMiddleware in server.go: resolves slug from config snapshot, builds
  ProfileScope, injects into context, 404s on missing/unknown profile
- /mcp/p/ and /mcp/p routes registered after mcpAuthMiddleware (auth->profile)
- retrieve_tools filter (T010): profile.Allows() independent of enforceAgentScope
- call_tool_* filter (T011): profile error before token-scope check, names profile
- upstream_servers list filter (T011a): excludes out-of-profile servers
- code_execution filter (T011b): profile servers intersected into AllowedServers
  so empty caller list at a profile URL does not mean 'allow all'
- ProfileScope.AllowedServerNames() helper for T011b intersection
- withProfileMeta() injects metadata["profile"] at activity emit sites (T019)
- Integration tests: 404-no-profiles, 404-unknown-slug, retrieve_tools isolation,
  full /mcp union unchanged, call_tool_* out-of-profile rejection, upstream_servers
  list filtering, policy intersection, per-server disabled_tools guard, activity
  metadata smoke-test, backward-compat endpoint reachability (T012-T018/T020)
- docs/features/profiles.md

Related #55

Author: Dumbris

docs/features/profiles.md

@@ -0,0 +1,62 @@
+# In-Proxy Profiles (Spec 057)
+
+Profiles are named, stateless subsets of upstream servers addressable as permanent URLs at `/mcp/p/<slug>`.
+
+## Quick start
+
+```json
+{
+  "profiles": [
+    { "name": "research", "servers": ["arxiv", "wikipedia"] },
+    { "name": "deploy",   "servers": ["k8s", "github"] }
+  ]
+}
+```
+
+Each profile gets a permanent MCP endpoint:
+
+| URL | Effective servers |
+|-----|------------------|
+| `/mcp` | All configured servers (unchanged) |
+| `/mcp/p/research` | `arxiv`, `wikipedia` only |
+| `/mcp/p/deploy` | `k8s`, `github` only |
+
+## Rules
+
+- **Slug format**: `^[a-z0-9][a-z0-9_-]{0,62}$` (max 63 chars, lowercase)
+- **Reserved slugs**: `all`, `code`, `call`, `p` — cannot be used as profile names
+- **Duplicate names**: rejected at load time (fatal validation error)
+- **Unknown server references**: warn-and-skip (non-fatal); the server is excluded from the effective set
+- **Empty server list**: legal "deny everything" profile (no tools exposed)
+
+## Behaviour
+
+- `retrieve_tools` returns only tools from the profile's servers
+- `call_tool_read/write/destructive` into an out-of-profile server is rejected with:
+  `server '<name>' is not in profile '<slug>'`
+- `upstream_servers list` at a profile URL excludes out-of-profile servers
+- `code_execution` at a profile URL runs with the profile-intersected server set
+- Per-server `enabled_tools`/`disabled_tools` continue to apply inside a profile (no profile-level tool overrides)
+
+## Scope composition
+
+Profile filtering is independent of agent-token scope. An unauthenticated connection at `/mcp/p/<slug>` is still profile-filtered. When both a profile and an agent token are present, the effective server set is their intersection.
+
+Error attribution:
+- Out-of-profile server → `server '<s>' is not in profile '<slug>'`
+- Out-of-token server   → `Server '<s>' is not in scope for this agent token`
+
+## Activity logging
+
+Tool-call activity records from profile URLs carry `metadata["profile"] = "<slug>"`. Records from `/mcp` omit this field.
+
+## Hot reload
+
+Profile changes take effect for new connections on the next config reload. In-flight sessions keep their snapshot.
+
+## 404 responses
+
+| Condition | Body |
+|-----------|------|
+| No profiles configured | `{"error":"no profiles configured"}` |
+| Unknown slug | `{"error":"unknown profile '<slug>'","available":["research","deploy"]}` |

internal/profile/context.go

@@ -51,6 +51,20 @@ func (p *ProfileScope) Allows(serverName string) bool {
 	return ok
 }
 
+// AllowedServerNames returns the list of server names in this profile scope.
+// Returns nil for a nil receiver (allow-all — no restriction list).
+// Returns an empty slice for a non-nil scope with no servers (deny-all).
+func (p *ProfileScope) AllowedServerNames() []string {
+	if p == nil {
+		return nil
+	}
+	out := make([]string, 0, len(p.servers))
+	for s := range p.servers {
+		out = append(out, s)
+	}
+	return out
+}
+
 // profileScopeKey is an unexported context key avoiding cross-package collisions.
 type profileScopeKey struct{}
 

internal/server/mcp.go

@@ -23,6 +23,7 @@ import (
 	"github.com/smart-mcp-proxy/mcpproxy-go/internal/logs"
 	"github.com/smart-mcp-proxy/mcpproxy-go/internal/oauth"
 	"github.com/smart-mcp-proxy/mcpproxy-go/internal/outputvalidation"
+	"github.com/smart-mcp-proxy/mcpproxy-go/internal/profile"
 	"github.com/smart-mcp-proxy/mcpproxy-go/internal/registries"
 	"github.com/smart-mcp-proxy/mcpproxy-go/internal/reqcontext"
 	"github.com/smart-mcp-proxy/mcpproxy-go/internal/security"
@@ -443,6 +444,19 @@ func (p *MCPProxyServer) emitActivityInternalToolCall(internalToolName, targetSe
 	}
 }
 
+// withProfileMeta injects metadata["profile"] = slug into m when the context
+// carries an active ProfileScope (Spec 057 FR-011). It returns m (or a new map
+// when m is nil) so callers can use it inline. Records from /mcp omit the field.
+func withProfileMeta(ctx context.Context, m map[string]interface{}) map[string]interface{} {
+	if scope := profile.ProfileScopeFromContext(ctx); scope != nil {
+		if m == nil {
+			m = make(map[string]interface{})
+		}
+		m["profile"] = scope.Name
+	}
+	return m
+}
+
 // buildCallToolVariantTool constructs the mcp.Tool definition for a single
 // call_tool_* variant (read/write/destructive). Factored out so both
 // registerTools and schema tests exercise the same builder.
@@ -1111,6 +1125,8 @@ func (p *MCPProxyServer) handleRetrieveToolsWithMode(ctx context.Context, reques
 	// want to repeat per result.
 	authCtx := auth.AuthContextFromContext(ctx)
 	enforceAgentScope := authCtx != nil && !authCtx.IsAdmin()
+	// Spec 057: profile scope filter — independent of agent-scope (nil = allow all).
+	profileScope := profile.ProfileScopeFromContext(ctx)
 
 	// Spec 049: opt-in discovery of locked tools. When false (default) the
 	// behavior below is byte-for-byte identical to before — disabled tools are
@@ -1142,6 +1158,11 @@ func (p *MCPProxyServer) handleRetrieveToolsWithMode(ctx context.Context, reques
 		if enforceAgentScope && !authCtx.CanAccessServer(serverName) {
 			continue
 		}
+		// Spec 057: profile filter — runs independently of agent-scope so that
+		// unauthenticated /mcp/p/<slug> connections (AdminContext) are still filtered.
+		if !profileScope.Allows(serverName) {
+			continue
+		}
 
 		if !p.isToolCallable(serverName, toolName) {
 			droppedCount++
@@ -1525,6 +1546,14 @@ func (p *MCPProxyServer) handleCallToolVariant(ctx context.Context, request mcp.
 		return mcp.NewToolResultError(fmt.Sprintf("Invalid tool name format: %s", toolName)), nil
 	}
 
+	// Spec 057: profile filter — runs independently of agent-scope so that
+	// unauthenticated /mcp/p/<slug> connections (AdminContext) are still filtered.
+	if profileScope := profile.ProfileScopeFromContext(ctx); profileScope != nil && !profileScope.Allows(serverName) {
+		errMsg := fmt.Sprintf("server '%s' is not in profile '%s'", serverName, profileScope.Name)
+		p.emitActivityPolicyDecision(serverName, actualToolName, getSessionID(), "blocked", errMsg)
+		return mcp.NewToolResultError(errMsg), nil
+	}
+
 	// Spec 028: Enforce agent token scope restrictions
 	if authCtx := auth.AuthContextFromContext(ctx); authCtx != nil && !authCtx.IsAdmin() {
 		// Check server scope
@@ -1888,6 +1917,7 @@ func (p *MCPProxyServer) handleCallToolVariant(ctx context.Context, request mcp.
 	if intent != nil {
 		intentMap = intent.ToMap()
 	}
+	intentMap = withProfileMeta(ctx, intentMap) // Spec 057 FR-011
 	p.emitActivityToolCallCompleted(serverName, actualToolName, sessionID, requestID, activitySource, "success", "", duration.Milliseconds(), activityArgs, response, responseTruncated, toolVariant, intentMap, contentTrust, activityRequestBytes, activityResponseBytes)
 
 	// Spec 024: Emit internal tool call event for success
@@ -2777,6 +2807,18 @@ func (p *MCPProxyServer) handleListUpstreams(ctx context.Context) (*mcp.CallTool
 		servers = filtered
 	}
 
+	// Spec 057 (FR-004): Filter servers to only those visible in the active profile.
+	// Independent of agent-scope so unauthenticated /mcp/p/<slug> connections are filtered.
+	if profileScope := profile.ProfileScopeFromContext(ctx); profileScope != nil {
+		var filtered []*config.ServerConfig
+		for _, s := range servers {
+			if profileScope.Allows(s.Name) {
+				filtered = append(filtered, s)
+			}
+		}
+		servers = filtered
+	}
+
 	// Check Docker availability only if Docker isolation is globally enabled
 	dockerIsolationGlobalEnabled := p.config.DockerIsolation != nil && p.config.DockerIsolation.Enabled
 	var dockerAvailable bool

internal/server/mcp_code_execution.go

@@ -10,6 +10,7 @@ import (
 	"github.com/smart-mcp-proxy/mcpproxy-go/internal/auth"
 	"github.com/smart-mcp-proxy/mcpproxy-go/internal/contracts"
 	"github.com/smart-mcp-proxy/mcpproxy-go/internal/jsruntime"
+	"github.com/smart-mcp-proxy/mcpproxy-go/internal/profile"
 	"github.com/smart-mcp-proxy/mcpproxy-go/internal/storage"
 	"github.com/smart-mcp-proxy/mcpproxy-go/internal/upstream"
 
@@ -190,6 +191,32 @@ func (p *MCPProxyServer) handleCodeExecution(ctx context.Context, request mcp.Ca
 		options.ToolAnnotationFunc = p.lookupToolPermission
 	}
 
+	// Spec 057 (Codex #621 finding 2): Intersect profile scope into code_execution.
+	// The jsruntime treats an empty AllowedServers as "allow all"; at a profile URL
+	// we must restrict to profile servers regardless of what the caller supplied.
+	if profileScope := profile.ProfileScopeFromContext(ctx); profileScope != nil {
+		// Build the effective allowed-servers list: profile servers only.
+		// If the caller also supplied allowed_servers, intersect the two sets.
+		profileServers := profileScope.AllowedServerNames()
+		if len(options.AllowedServers) == 0 {
+			// No caller-supplied restriction: use profile servers as the restriction.
+			options.AllowedServers = profileServers
+		} else {
+			// Intersect caller-supplied list with profile servers.
+			profileSet := make(map[string]struct{}, len(profileServers))
+			for _, s := range profileServers {
+				profileSet[s] = struct{}{}
+			}
+			var intersected []string
+			for _, s := range options.AllowedServers {
+				if _, ok := profileSet[s]; ok {
+					intersected = append(intersected, s)
+				}
+			}
+			options.AllowedServers = intersected
+		}
+	}
+
 	// Execute code
 	p.logger.Info("executing code",
 		zap.String("execution_id", options.ExecutionID),