[fforres]

What changes for users

Passthrough invoke (the tool Skywardin uses for every integration call) now calls the tool directly in the host. It no longer starts a new Cloudflare Dynamic Worker for each call.

• Same results: same content blocks, same isError, same error texts for blocked tools, invalid arguments, declined approvals and plugin defects.
• Faster calls: no isolate start, no TypeScript strip, no two RPC hops.
• Cheaper: each invoke created one billed Dynamic Worker (executor-<random UUID>). That was about 19% of our billed Dynamic Workers (measured Oct 15-21).

Why it is safe

Policy, approval, credentials and the real upstream call already ran in the host through the tool invoker. The Dynamic Worker only ran a server-generated one-line script (return await tools["x"](args)) with globalOutbound: null that called back into the host. It isolated nothing. Upstream v2 has the same design (a direct call tool).

How

• ExecutionEngine.call(address, args, { onElicitation }): required member, runs makeExecutorToolInvoker in an mcp.execute span (mcp.execute.mode: "direct"), maps ExecutionToolError to the same tool_error result the sandbox returned.
• tool-server.ts: invoke uses engine.call. Visibility check, schema validation, elicitation, toPassthroughResult unchanged. passthroughCallCode removed.
• Decorators forward call (analytics, promise surface, execution-stack middleware, cloud gate/usage/rate limit) and 13 test stub engines.

Behaviour differences

• The in-isolate 60-minute cap no longer applies to invoke.
• tool_blocked details now serialize with address/pattern (structured clone used to drop them). Message text unchanged.
• executor.code.exec spans no longer appear for invoke.

Tests

• engine.call: success + toolPaths, block policy, declined approval, opaque plugin defect, binary result; each with a code executor that dies if called.
• Passthrough invoke on a real createExecutionEngine with a throwing code executor: ToolFile renders the same JSON text and structuredContent.
• Existing passthrough error/image/elicitation/approval/schema tests pass unchanged.
• execution 103/103, mcp 257/257, analytics 11/11, api 16/16, cloudflare 56/56, cloud 17/17.

Verified against production with a before/after benchmark (13 read-only tools, error cases, concurrency stress); results in the Skyward PR.