tools::begin

Tag 1: the client begins its work on a tool container, once, first, and hands over the arguments and the template id; the server answers Begun, carrying the secrets the container takes, once the container holds them and, for the life of the connection, Active whenever an MCP exchange is in flight where none was and Inactive, carrying the rotating secrets handed back, whenever the last in flight is answered; every channel of the container’s life rides this scope.

The client opens the scope with a request whose payload is the tag byte 1 followed by the request as JSON: the arguments and the id of the template the container is made from. The server answers with exactly one Begun response, carrying the secrets the container’s program takes, once the container holds its arguments; after it sends Active and Inactive as the container’s MCP exchanges begin and end, for as long as the connection lives; and it ends the scope by the response finish when the server ends, or after an error it sends when it cannot collect the rotating secrets. This section states what the server does. It states nothing about the client beyond the order Connection provides.

The request. Request states its form.
The response. Response states the one response and the sequence of the main stream.
The channels. The client opens the channels that Client Channels defines; the server opens the channels that Server Channels defines. Each channel is its own section. Neither party opens a channel on the scope before the Begun response.

The order#

The server reads the request. A request whose payload does not decode is answered by a response finish that no response precedes, as Container Proxy Endpoints provides. A begin on a connection that has begun is answered by exactly one response, the error, and the finish; the first begin continues.
The server hands the arguments and the template id to the container. Both are held for the life of the container. A container that refuses them is answered by exactly one response, the error in the container’s own words, and the finish; the connection has not begun.
The server answers Begun. Exactly once, and before any channel is served, carrying the secrets the container’s program answered its registration with, each by name to its mode. A tool container declares no dependencies: a list its program answers its registration with is not read and not carried.
The server holds delivery until the container is fed. From Begun, and from every Inactive, the server delivers no MCP exchange to a program that declared one or more secrets until the client has opened a secrets channel and the server has answered it Fed; an exchange opened meanwhile is held. A program that declared no secret is delivered to from Begun and from every Inactive.
The server marks the activity. An exchange is one mcp-list-tools, mcp-list-resources, mcp-call-tool or mcp-read-resource channel from its request to its answer; an mcp-notifications channel is no exchange. The server counts the exchanges in flight. It sends Active when the count goes from none to one, before that exchange is delivered, and, when the count goes from one to none, collects from the program the value of every rotating secret it declared and sends Inactive carrying them. A collect the program does not answer with every value asked for is answered by exactly one response, the error naming the secret and carrying no value, and the finish.
The scope ends with the server. The server sends the response finish when it ends, and after the error of step 5, and at no other time.

The rules that hold throughout#

One begin. The server serves exactly one begin scope per connection.
Both directions. The server opens channels on this scope for everything the container asks of the world outside it — its database connections, its daemon connections — and the client opens channels on it for the image’s /DIVERGE.md, the five MCP exchanges into the container’s own MCP server, the feed of the secrets’ values, and its half of each database connection.
No tool call outward. A tool container makes no tool call outward: the server opens no MCP channel on this scope, and answers the container’s program with an error when it calls.
The two words. After Begun, the server sends Active, Inactive, and the one error of step 5, and no other response on the scope.
No value in an error. No error the server sends carries the value of a secret.
No timeout. The server imposes no timeout on any channel or on the scope.

In this section

Request — The payload is the tag byte 1 followed by the request as JSON: the arguments, as the image defines them, and the id of the template the container is made from; no secret rides it.
Response — The server sends Begun once, carrying the secrets the container takes, or an error and the finish; after Begun it sends Active whenever an exchange is in flight where none was and Inactive, carrying the rotating secrets, whenever the last in flight is answered, and the finish when the server ends or after the one error it sends when it cannot collect them.
Client Channels — The channels the client opens on a tool container’s begin scope, by tag: its half of a database connection, the image’s /DIVERGE.md, its half of a daemon connection, the five MCP exchanges into the container’s own MCP server, and the feed of the secrets’ values.
Server Channels — The channels the server opens on a tool container’s begin scope, by tag: everything the container asks of the world outside it — its database connections, its daemon connections — each relayed by the client to its client as a channel of its own; no tool call outward, since a tool container makes none.