diff --git a/‎CHANGELOG.adoc‎
Lines changed: 10 additions & 0 deletions b/‎CHANGELOG.adoc‎
Lines changed: 10 additions & 0 deletions
diff --git a/‎mcp-bridge/lib/dispatcher.js‎
Lines changed: 22 additions & 13 deletions b/‎mcp-bridge/lib/dispatcher.js‎
Lines changed: 22 additions & 13 deletions
diff --git a/‎mcp-bridge/lib/tools.js‎
Lines changed: 12 additions & 0 deletions b/‎mcp-bridge/lib/tools.js‎
Lines changed: 12 additions & 0 deletions
diff --git a/‎mcp-bridge/tests/declared_args_test.js‎
Lines changed: 95 additions & 0 deletions b/‎mcp-bridge/tests/declared_args_test.js‎
Lines changed: 95 additions & 0 deletions
diff --git a/‎mcp-bridge/tests/routing_args_test.js‎
Lines changed: 2 additions & 3 deletions b/‎mcp-bridge/tests/routing_args_test.js‎
Lines changed: 2 additions & 3 deletions
diff --git a/‎package.json‎
Lines changed: 1 addition & 1 deletion b/‎package.json‎
Lines changed: 1 addition & 1 deletion
@@ -28,6 +28,16 @@ Returns / Errors / Usage text on every tool and the per-parameter
 
 === [Unreleased]
 
+==== Changed
+
+* *MCP bridge refuses undeclared tool arguments.* Every tool already
+declares `+additionalProperties: false+`; the bridge now enforces it for
+all tools, not only the routed browser/cloud/comms/ml ones. A call that
+passes an argument its `+inputSchema+` does not list fails with JSON-RPC
+`+-32602+` before dispatch. `+coord_send+`/`+coord_send_gated+` now
+declare `+sender_role+`, and `+coord_register+` declares `+role+` and
+`+capabilities+`, matching the local-coord-mcp manifest.
+
 ==== Added
 
 * *`+k8s/networkpolicy.yaml+`* — defence-in-depth `+NetworkPolicy+`
 
@@ -55,20 +55,25 @@ function rpcError(id, code, message) {
 
 // Tools that share one cartridge and are told apart by a routing key
 // derived from the tool name. The bridge sets the key, never the caller:
-// dispatch writes it last, and the gate refuses any argument the tool's
-// inputSchema does not declare.
+// dispatch writes it last, and the gate refuses it as an argument.
 const ROUTED_TOOLS = new Map([
   ...["verpex", "cloudflare", "vercel"].map((p) => [`boj_cloud_${p}`, { cartridge: "cloud-mcp", key: "provider", value: p }]),
   ...["gmail", "calendar"].map((p) => [`boj_comms_${p}`, { cartridge: "comms-mcp", key: "provider", value: p }]),
   ["boj_ml_huggingface", { cartridge: "ml-mcp", key: "provider", value: "huggingface" }],
   ...["navigate", "click", "type", "read_page", "screenshot", "tabs", "execute_js"].map((a) => [`boj_browser_${a}`, { cartridge: "browser-mcp", key: "action", value: a }]),
 ]);
 
+// Deprecated tool names still dispatched for one release. They take the
+// arguments of the tool they alias.
+const TOOL_ALIASES = new Map([
+  ["coord_promote_to_supervisor", "coord_promote_to_master"],
+]);
+
 let declaredArgsCache = null;
 
 /**
  * Return the argument names a tool's inputSchema declares, or null when
- * the tool is not in the full tool list.
+ * the tool is not in the full tool list. Aliases resolve to their target.
  *
  * @param {string} toolName
  * @returns {Set<string>|null}
@@ -79,24 +84,25 @@ function declaredArgs(toolName) {
       buildToolList("full").map((t) => [t.name, new Set(Object.keys(t.inputSchema?.properties ?? {}))]),
     );
   }
-  return declaredArgsCache.get(toolName) ?? null;
+  return declaredArgsCache.get(TOOL_ALIASES.get(toolName) ?? toolName) ?? null;
 }
 
 /**
- * Check a routed tool's arguments against its inputSchema. Other tools
- * are not checked here.
+ * Check a tool's top-level argument names against its inputSchema: any
+ * argument the schema does not declare is refused, and so is a routed
+ * tool's routing key. Types, required fields and enums are not checked
+ * here.
  *
  * @param {string} toolName
  * @param {Record<string, unknown>} args
  * @returns {string|null} error message, or null when every argument is declared
  */
-function validateRoutedArgs(toolName, args) {
-  const route = ROUTED_TOOLS.get(toolName);
-  if (!route) return null;
+export function validateDeclaredArgs(toolName, args) {
   const allowed = declaredArgs(toolName);
   if (!allowed) return "Unknown tool";
+  const routingKey = ROUTED_TOOLS.get(toolName)?.key;
   for (const name of Object.keys(args)) {
-    if (name === route.key || !allowed.has(name)) {
+    if (name === routingKey || !allowed.has(name)) {
       return `Unexpected argument '${name}' for ${toolName}`;
     }
   }
@@ -133,9 +139,12 @@ function hardeningGate(toolName, args) {
   if (args === null || typeof args !== "object" || Array.isArray(args)) {
     return { code: -32602, message: "Tool arguments must be an object" };
   }
-  const routedError = validateRoutedArgs(toolName, args);
-  if (routedError) {
-    return { code: -32602, message: routedError };
+  if (!declaredArgs(toolName)) {
+    return { code: -32601, message: "Unknown tool" };
+  }
+  const argError = validateDeclaredArgs(toolName, args);
+  if (argError) {
+    return { code: -32602, message: argError };
   }
 
   let validationError = null;
 
@@ -593,6 +593,16 @@ function buildToolList(scope) {
         context: { type: "string", description: "Optional disambiguator, e.g. current repo name. Alphanumeric + hyphen/underscore, max 32 bytes. Absent = plain `<kind>-<4hex>` form.", maxLength: 32, pattern: "^[A-Za-z0-9_-]*$" },
         declared_affinities: { type: "array", items: { type: "string", maxLength: 64 }, description: "Optional self-reported strength tags (e.g. ['proof-analysis', 'supervision']). Max 256 bytes as CSV; feeds reassignment-engine comparisons (DD-28)." },
         variant: { type: "string", description: "Optional free-form model/variant label set at register time (Task #33). Alphanumeric + `.`/`-`/`_`, max 32 bytes. e.g. `opus-4.7`, `flash-2.5`, `leanstral`. Equivalent to a follow-up `coord_set_variant` call.", maxLength: 32, pattern: "^[A-Za-z0-9._-]*$" },
+        role: { type: "string", enum: ["journeyman", "apprentice", "executor", "supervised"], description: "Optional requested role (DD-32). `master` is always refused here; promote via `coord_promote_to_master`. Default: claude → journeyman, others → apprentice. `executor`/`supervised` are legacy aliases." },
+        capabilities: {
+          type: "object",
+          description: "Optional capability advertisement for cold-start routing. Each key is optional; equivalent to a follow-up `coord_set_capabilities` call.",
+          properties: {
+            class: { type: "array", items: { type: "string" }, description: "Capability classes (e.g. 'reasoning', 'coding', 'proof'). Max 128 bytes as CSV." },
+            tier: { type: "integer", minimum: 0, maximum: 5, description: "Advertised capability tier 1..5 (0 = unset)." },
+            prover_strengths: { type: "array", items: { type: "string" }, description: "Prover names this peer claims strength in (e.g. 'coq', 'lean'). Max 256 bytes as CSV." },
+          },
+        },
       },
       required: ["client_kind"],
       additionalProperties: false,
@@ -642,6 +652,7 @@ function buildToolList(scope) {
         token: { type: "string", description: "Session token from `coord_register`." },
         target: { type: "string", description: "Peer ID to send to (e.g. `claude-a1b2@repo`), or `*` for broadcast to all active peers." },
         message: { type: "string", description: "Message payload — free-form text, typically a JSON A2ML envelope.", maxLength: 65536 },
+        sender_role: { type: "string", enum: ["master", "journeyman", "apprentice", "executor", "supervised"], description: "Optional sender role for envelope contract validation, used when the envelope's own `_meta.sender_role` is absent." },
       },
       required: ["token", "target", "message"],
       additionalProperties: false,
@@ -790,6 +801,7 @@ function buildToolList(scope) {
         target: { type: "string", description: "Peer ID to send to, or `*` for broadcast." },
         message: { type: "string", description: "Message payload — typically a JSON A2ML envelope. Validated against `coord-messages.ncl` when strict mode is enabled.", maxLength: 65536 },
         risk_tier: { type: "integer", minimum: 0, maximum: 4, description: "Self-declared risk tier 0..4. 0=observational, 1=routine-read, 2=small-write, 3=major-write, 4=destructive/irreversible." },
+        sender_role: { type: "string", enum: ["master", "journeyman", "apprentice", "executor", "supervised"], description: "Optional sender role for envelope contract validation, used when the envelope's own `_meta.sender_role` is absent." },
       },
       required: ["token", "target", "message", "risk_tier"],
       additionalProperties: false,
 
@@ -0,0 +1,95 @@
+// SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+//
+// BoJ Server — declared-argument tests
+//
+// Every tool's inputSchema sets additionalProperties:false. These tests pin
+// that the bridge enforces it for every tool in the full list (plus the
+// deprecated alias), not only the routed ones: an argument the schema does
+// not declare is refused before dispatch. `fetch` is stubbed so no backend
+// is needed.
+//
+// Run: node --test mcp-bridge/tests/declared_args_test.js
+
+import { after, before, test } from "node:test";
+import assert from "node:assert/strict";
+
+import { dispatchMcpMessage, validateDeclaredArgs } from "../lib/dispatcher.js";
+import { buildToolList } from "../lib/tools.js";
+
+const posted = [];
+const realFetch = globalThis.fetch;
+before(() => {
+  globalThis.fetch = async (url, init) => {
+    posted.push({ url: String(url), body: init?.body ? JSON.parse(init.body) : null });
+    return { ok: true, status: 200, json: async () => ({ ok: true }) };
+  };
+});
+after(() => {
+  globalThis.fetch = realFetch;
+});
+
+let nextId = 1;
+/** Issue one tools/call and return the JSON-RPC response plus what was posted. */
+async function call(name, args) {
+  posted.length = 0;
+  const res = await dispatchMcpMessage({
+    jsonrpc: "2.0",
+    id: nextId++,
+    method: "tools/call",
+    params: { name, arguments: args },
+  });
+  return { res, sent: [...posted] };
+}
+
+const TOOLS = buildToolList("full");
+const NAMES = [...TOOLS.map((t) => t.name), "coord_promote_to_supervisor"];
+
+test("the full tool list is non-empty and every schema is closed", () => {
+  assert.ok(TOOLS.length > 0);
+  for (const t of TOOLS) assert.equal(t.inputSchema?.additionalProperties, false, t.name);
+});
+
+// Checked directly rather than through tools/call, so the per-minute rate
+// limit cannot turn a refusal into a different error.
+for (const name of NAMES) {
+  test(`${name}: an undeclared argument is refused`, () => {
+    assert.equal(validateDeclaredArgs(name, { not_in_schema: 1 }), `Unexpected argument 'not_in_schema' for ${name}`);
+  });
+}
+
+for (const t of TOOLS) {
+  test(`${t.name}: every declared argument is accepted`, () => {
+    const args = Object.fromEntries(Object.keys(t.inputSchema.properties ?? {}).map((k) => [k, "x"]));
+    const routed = t.name.match(/^boj_(browser|cloud|comms|ml)_/);
+    if (routed) {
+      delete args.action;
+      delete args.provider;
+    }
+    assert.equal(validateDeclaredArgs(t.name, args), null);
+  });
+}
+
+test("a tool outside the list is unknown to the argument check", () => {
+  assert.equal(validateDeclaredArgs("boj_not_a_tool", {}), "Unknown tool");
+});
+
+test("tools/call refuses an undeclared argument on a non-routed tool before dispatch", async () => {
+  const { res, sent } = await call("boj_search", { operation: "web", query: "q", not_in_schema: 1 });
+  assert.ok(res.error, "expected the call to be refused");
+  assert.equal(res.error.code, -32602);
+  assert.match(res.error.message, /Unexpected argument 'not_in_schema'/);
+  assert.equal(sent.length, 0);
+});
+
+test("tools/call refuses an undeclared argument on a coord tool before dispatch", async () => {
+  const { res, sent } = await call("coord_list_peers", { token: "t", not_in_schema: 1 });
+  assert.ok(res.error, "expected the call to be refused");
+  assert.equal(res.error.code, -32602);
+  assert.equal(sent.length, 0);
+});
+
+test("tools/call reports an unlisted tool as unknown", async () => {
+  const { res } = await call("boj_not_a_tool", {});
+  assert.equal(res.error?.code, -32601);
+});
@@ -78,8 +78,7 @@ test("routed tools refuse arguments outside their inputSchema", async () => {
   assert.equal(sent.length, 0);
 });
 
-test("non-routed tools keep their existing argument handling", async () => {
-  // coord_send reads `sender_role`, which no inputSchema declares.
-  const { res } = await call("coord_send", { message: "hi", target: "peer", sender_role: "worker" });
+test("coord_send accepts its declared sender_role argument", async () => {
+  const { res } = await call("coord_send", { message: "hi", target: "peer", sender_role: "apprentice" });
   assert.equal(res.error, undefined, JSON.stringify(res.error));
 });
@@ -20,7 +20,7 @@
   },
   "scripts": {
     "start": "deno run -A mcp-bridge/main.js",
-    "test": "node --test mcp-bridge/tests/dispatch_test.js mcp-bridge/tests/routing_args_test.js"
+    "test": "node --test mcp-bridge/tests/dispatch_test.js mcp-bridge/tests/routing_args_test.js mcp-bridge/tests/declared_args_test.js"
   },
   "engines": {
     "node": ">=18.0.0"