@@ -1,5 +1,6 @@
 import { describe, expect, test } from "bun:test";
 
+import { stringTool, type AgentTool } from "@intx/agent";
 import {
   createFleetMailbox,
   createSpawnAgentTool,
@@ -38,6 +39,13 @@ const FULL_MOUNT_PROFILE: AgentProfile = {
   systemPromptRole: "You do anything.",
 };
 
+// BUILD_TOOLS-like envelope: built-ins only, no MCP names.
+const BUILD_LIKE_PROFILE: AgentProfile = {
+  id: "build-worker",
+  systemPromptRole: "You build.",
+  capabilities: { mode: "allow", tools: ["read_file", "run_shell"] },
+};
+
 function makeDeps(
   run: (params: RunSubAgentParams) => Promise<RunSubAgentResult>,
   capturedTelemetry: TelemetryEvent[],
@@ -300,6 +308,156 @@ describe("spawn_agent requires_tools preflight", () => {
     expect(seenTier).toBe("leaf");
   });
 
+  test("mounted mcp__linear__ tool passes dispatch preflight under a built-ins-only allowlist", async () => {
+    const telemetry: TelemetryEvent[] = [];
+    let runCalled = false;
+    let seenRequires: readonly string[] | undefined;
+    const linearTool: AgentTool = stringTool({
+      definition: {
+        name: "mcp__linear__list_teams",
+        description: "Inherited Linear tool",
+        inputSchema: {},
+      },
+      handler: async () => "teams",
+    });
+    const base = makeDeps(async (params) => {
+      runCalled = true;
+      seenRequires = params.requiresTools;
+      return { report: "done" };
+    }, telemetry);
+    const deps: AgentFleetDeps = {
+      ...base,
+      profiles: [BUILD_LIKE_PROFILE],
+      inheritMcpTools: () => [linearTool],
+    };
+    const spawn = createSpawnAgentTool(deps);
+
+    const result = await callSpawn(spawn, {
+      description: "linear job",
+      prompt: "list teams",
+      agent: "build-worker",
+      requires_tools: ["mcp__linear__list_teams"],
+    });
+
+    expect(result.isError).not.toBe(true);
+    expect(runCalled).toBe(true);
+    const body = JSON.parse(result.content) as { agent_id: string };
+    expect(deps.sessions.get(body.agent_id)?.requiresTools).toEqual([
+      "mcp__linear__list_teams",
+    ]);
+    expect(seenRequires).toEqual(["mcp__linear__list_teams"]);
+  });
+
+  test("unmounted mcp__linear__ tool rejects dispatch preflight as unknown_tool with no run", async () => {
+    const telemetry: TelemetryEvent[] = [];
+    let runCalled = false;
+    const base = makeDeps(async () => {
+      runCalled = true;
+      return { report: "done" };
+    }, telemetry);
+    const deps: AgentFleetDeps = {
+      ...base,
+      profiles: [BUILD_LIKE_PROFILE],
+    };
+    const spawn = createSpawnAgentTool(deps);
+
+    const result = await callSpawn(spawn, {
+      description: "linear job",
+      prompt: "list teams",
+      agent: "build-worker",
+      requires_tools: ["mcp__linear__list_teams"],
+    });
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain('unknown tool "mcp__linear__list_teams"');
+    expect(result.content).not.toContain("Did you mean");
+    expect(runCalled).toBe(false);
+    expect(deps.sessions.list()).toEqual([]);
+    expect(telemetry).toEqual([]);
+  });
+
+  test("requires_tools stamps only the requested live tool, never the inherited set", async () => {
+    const telemetry: TelemetryEvent[] = [];
+    let runCalled = false;
+    let seenRequires: readonly string[] | undefined;
+    const mcpTool = (name: string): AgentTool =>
+      stringTool({
+        definition: {
+          name,
+          description: `Inherited ${name}`,
+          inputSchema: {},
+        },
+        handler: async () => name,
+      });
+    const base = makeDeps(async (params) => {
+      runCalled = true;
+      seenRequires = params.requiresTools;
+      return { report: "done" };
+    }, telemetry);
+    const deps: AgentFleetDeps = {
+      ...base,
+      profiles: [BUILD_LIKE_PROFILE],
+      inheritMcpTools: () => [
+        mcpTool("mcp__linear__list_teams"),
+        mcpTool("mcp__linear__create_issue"),
+      ],
+    };
+    const spawn = createSpawnAgentTool(deps);
+
+    const result = await callSpawn(spawn, {
+      description: "linear job",
+      prompt: "list teams",
+      agent: "build-worker",
+      requires_tools: ["mcp__linear__list_teams"],
+    });
+
+    // On-demand: dispatch stamps exactly the requested live tool — the
+    // inherited sibling mounts only under its own stamp (run.ts drops it).
+    expect(result.isError).not.toBe(true);
+    expect(runCalled).toBe(true);
+    expect(seenRequires).toEqual(["mcp__linear__list_teams"]);
+  });
+
+  test("requires_tools naming a live and an unmounted mcp__ tool rejects the unmounted one with no run", async () => {
+    const telemetry: TelemetryEvent[] = [];
+    let runCalled = false;
+    const base = makeDeps(async () => {
+      runCalled = true;
+      return { report: "done" };
+    }, telemetry);
+    const deps: AgentFleetDeps = {
+      ...base,
+      profiles: [BUILD_LIKE_PROFILE],
+      inheritMcpTools: () => [
+        stringTool({
+          definition: {
+            name: "mcp__linear__list_teams",
+            description: "Inherited Linear tool",
+            inputSchema: {},
+          },
+          handler: async () => "teams",
+        }),
+      ],
+    };
+    const spawn = createSpawnAgentTool(deps);
+
+    const result = await callSpawn(spawn, {
+      description: "linear job",
+      prompt: "list teams and file",
+      agent: "build-worker",
+      requires_tools: ["mcp__linear__list_teams", "mcp__linear__create_issue"],
+    });
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain(
+      'unknown tool "mcp__linear__create_issue"',
+    );
+    expect(result.content).not.toContain("Did you mean");
+    expect(runCalled).toBe(false);
+    expect(deps.sessions.list()).toEqual([]);
+    expect(telemetry).toEqual([]);
+  });
+
   test("whitespace-only requires_tools rejects fail-closed with no session, telemetry, or run", async () => {
     for (const requiresTools of [["   "], ["read_file", "  "]]) {
       const telemetry: TelemetryEvent[] = [];
 
@@ -127,6 +127,8 @@ import {
   type InterventionSink,
 } from "./intervention-log.js";
 import { takeAndProjectMailboxRecord } from "./fleet-dry-drive.js";
+import { canonicalToolName } from "../agent/canonical-tool-name.js";
+import { isMcpToolName } from "../mcp/tool-name.js";
 
 const log = getLogger([LOG_NAMESPACE_ROOT, "subagent", "agent-fleet"]);
 
@@ -1115,12 +1117,23 @@ export function createSpawnAgentTool(deps: AgentFleetDeps): AgentTool {
       }
       const requiresToolsRaw = rawEntries.map((t) => t.trim());
       if (requiresToolsRaw.length > 0) {
+        // Live inherited-MCP set: the worker mount carries a requested live
+        // tool on demand (run.ts retains only requested inherited MCP
+        // tools), so preflight validates `mcp__*` requirements against this
+        // set instead of the built-in catalog. Gating through the worker
+        // gate keeps the names to what this dispatch may actually mount.
+        const availableMcpTools = (
+          deps.inheritMcpTools?.(deps.permissionGate) ?? []
+        )
+          .map((tool) => canonicalToolName(tool.definition.name))
+          .filter((name) => isMcpToolName(name));
         const preflight = preflightCapabilities({
           required: requiresToolsRaw,
           ...(resolved.capabilities !== undefined
             ? { resolvedFilter: resolved.capabilities }
             : {}),
           knownEngines: DEFAULT_KNOWN_ENGINES,
+          availableMcpTools,
           agentLabel: resolved.agentLabel,
         });
         if (!preflight.ok) {
 
@@ -25,15 +25,24 @@ function preflight(
   required: readonly string[],
   resolvedFilter?: CapabilityFilter,
   knownEngines: readonly string[] = DEFAULT_KNOWN_ENGINES,
+  availableMcpTools: readonly string[] = [],
 ) {
   return preflightCapabilities({
     required,
     ...(resolvedFilter !== undefined ? { resolvedFilter } : {}),
     knownEngines,
+    availableMcpTools,
     agentLabel: "test-worker",
   });
 }
 
+// A BUILD_TOOLS-like allowlist: built-ins only, no MCP names — the shape
+// that used to strip inherited Linear tools at both layers.
+const ALLOW_BUILD_NO_MCP: CapabilityFilter = {
+  mode: "allow",
+  tools: ["read_file", "run_shell"],
+};
+
 describe("preflightCapabilities", () => {
   test("allow filter mounting the tool passes and returns canonical names", () => {
     const result = preflight(["run_shell"], ALLOW_SHELL);
@@ -125,6 +134,72 @@ describe("preflightCapabilities", () => {
     expect(alternatives).toEqual([...alternatives].sort());
     expect(alternatives).not.toContain("dispatch");
   });
+
+  test("mounted mcp__linear__ tool passes preflight under a built-ins-only allowlist", () => {
+    const result = preflight(
+      ["mcp__linear__list_teams"],
+      ALLOW_BUILD_NO_MCP,
+      DEFAULT_KNOWN_ENGINES,
+      ["mcp__linear__list_teams"],
+    );
+    expect(result).toEqual({
+      ok: true,
+      canonical: ["mcp__linear__list_teams"],
+    });
+  });
+
+  test("unmounted mcp__linear__ tool rejects unknown_tool when no server is mounted", () => {
+    const result = preflight(["mcp__linear__list_teams"], ALLOW_BUILD_NO_MCP);
+    expect(result.ok).toBe(false);
+    if (result.ok) throw new Error("expected rejection");
+    expect(result.unavailable.code).toBe("unknown_tool");
+    expect(result.unavailable.tool).toBe("mcp__linear__list_teams");
+    expect(result.unavailable.suggestion).toBeUndefined();
+  });
+
+  test("mcp__ tool from an unmounted server rejects even when other servers are mounted", () => {
+    const result = preflight(
+      ["mcp__nope__frobnicate"],
+      ALLOW_BUILD_NO_MCP,
+      DEFAULT_KNOWN_ENGINES,
+      ["mcp__linear__list_teams"],
+    );
+    expect(result.ok).toBe(false);
+    if (result.ok) throw new Error("expected rejection");
+    expect(result.unavailable.code).toBe("unknown_tool");
+    expect(result.unavailable.suggestion).toBeUndefined();
+  });
+
+  test("preflight grants only the named requirement, never sibling live tools", () => {
+    const result = preflight(
+      ["mcp__linear__list_teams"],
+      ALLOW_BUILD_NO_MCP,
+      DEFAULT_KNOWN_ENGINES,
+      ["mcp__linear__list_teams", "mcp__linear__create_issue"],
+    );
+    // On-demand: the stamp covers exactly the requested tool — the live
+    // sibling is not implied and mounts only under its own stamp.
+    expect(result).toEqual({
+      ok: true,
+      canonical: ["mcp__linear__list_teams"],
+    });
+  });
+
+  test("explicit exclude naming a live MCP tool rejects permission_static", () => {
+    const result = preflightCapabilities({
+      required: ["mcp__linear__list_teams"],
+      resolvedFilter: {
+        mode: "exclude",
+        tools: ["mcp__linear__list_teams"],
+      },
+      knownEngines: DEFAULT_KNOWN_ENGINES,
+      availableMcpTools: ["mcp__linear__list_teams"],
+      agentLabel: "test-worker",
+    });
+    expect(result.ok).toBe(false);
+    if (result.ok) throw new Error("expected rejection");
+    expect(result.unavailable.code).toBe("permission_static");
+  });
 });
 
 describe("formatCapabilityUnavailable", () => {