@@ -0,0 +1,18 @@
+---
+'@objectstack/mcp': minor
+---
+
+fix(mcp)!: the MCP stdio transport serves a stored metadata body only as its type's read projection, and refuses to evaluate it
+
+Clause-②: no (narrowing)
+
+<!-- adr-0087: not-required (no-migration-prescription) the MCP stdio transport's engine-only reader (its query, get and aggregate verbs and its record resource) now serves a stored metadata body through the stored-metadata-body family's one projection, and refuses a group, filter, sort or aggregate member on the stored body column — the posture the generic data door already takes. No authorable key, spelling, export or stored shape moves, and no stored row is read differently by any metadata consumer. The other categories are closed on facts: the package publishes (not `unpublished`); no ADR-0087 id covers a served body projection or a refused query shape on this door (not `registered` / `already-registered`); and the change is runtime behaviour, not a declaration (not `runtime-interface-only` / `type-surface-only`). -->
+
+**BREAKING**: this narrows what one door serves and accepts for the two stored-metadata tables (the stored row and its version history). On the MCP stdio transport, a read now carries the stored body as its type's read projection instead of the stored bytes, and a call that would evaluate the stored body is refused. It ships as `minor` under the launch-window convention for accept-set narrowings. No export or published type changes.
+
+**What changes.**
+
+- **Reads.** The stdio bridge's query and get verbs, and the record resource, serve the stored body through the same projection the generic data door and every metadata read serve: stored credential material is withheld, a body that cannot be judged is omitted, and a credential-free body is served unchanged.
+- **Evaluate shapes.** A group, filter, sort or aggregate member on the stored body column is refused with `400 INVALID_FIELD` before the engine runs — the data door's code and envelope.
+
+**What stays answerable.** Every scalar column of the two tables is still served, filtered, sorted, grouped and counted; only the stored body column is affected, and every other object is unchanged. A member's read of these tables is refused as before.
@@ -25,7 +25,12 @@ import type { IAIService, IDataEngine, IMetadataService } from '@objectstack/spe
 import { MCPServerRuntime } from './mcp-server-runtime.js';
 import type { MCPServerRuntimeConfig, McpMergedMetadataRead } from './mcp-server-runtime.js';
 import type { ToolRegistry } from './types.js';
-import { createStdioDataBridge, enforceApiExposure, GATED_ACTIONS } from './stdio-data-bridge.js';
+import {
+  createStdioDataBridge,
+  enforceApiExposure,
+  GATED_ACTIONS,
+  serveStoredMetadataRow,
+} from './stdio-data-bridge.js';
 import type { McpDataBridge } from './mcp-http-tools.js';
 import { CONNECT_AGENT_UI_BUNDLE } from './connect-ui.js';
 
@@ -601,7 +606,12 @@ export class MCPServerPlugin implements Plugin {
         })) as unknown;
         const rows = res && (res as { value?: unknown }).value ? (res as { value: unknown }).value : res;
         const row = Array.isArray(rows) ? rows[0] : rows;
-        return (row ?? null) as Record<string, unknown> | null;
+        // [#21207] The stored-metadata-body family's one projection, applied by
+        // the same helper `bridge.get` serves through: a `sys_metadata` /
+        // `sys_metadata_history` row's body reaches this resource as its type's
+        // read projection, never as the stored bytes — so the tool and the
+        // resource cannot disagree about what a stored credential is.
+        return serveStoredMetadataRow(objectName, (row ?? null) as Record<string, unknown> | null);
       };
       ctx.logger.info(
         `[MCP] stdio transport principal-bound to OS_MCP_STDIO_API_KEY identity ${initial.userId} (RLS/FLS/tenant applied)`,