diff --git a/config/config.example.toml b/config/config.example.toml
index 8926cd465..293cab909 100644
--- a/config/config.example.toml
+++ b/config/config.example.toml
@@ -153,7 +153,7 @@
 # These are product knobs, not secrets/URLs/runtime-discovery values, so keep
 # them here rather than in .env.
 # enabled = false                         # default: false; advertises `codemode`
-# mcp_ui_enabled = true                   # default: true; advertises `codemode_ui` and its app resources
+# mcp_ui_enabled = false                  # default: false; opt in to `codemode_ui` and its app resources
 # trace_params = true                     # default: true; stores only redacted/capped call params in traces/history
 # `codemode` runs a JS async arrow function in the Javy/QuickJS sandbox with
 # in-sandbox discovery (`codemode.search()` / `codemode.describe()`), raw
@@ -171,13 +171,15 @@
 
 [mcp_apps]
 # Gateway-wide visibility switches for Labby-owned app surfaces other than the
-# always-on `mcp_app` manager. Disabling a surface removes its app advertisement
-# and UI resources; the underlying text/service capability remains available
-# where one exists. The Code Mode inspector keeps its legacy switch above.
-# add_server = true                         # default: true
-# server_logs = true                        # default: true
-# gateway_status = true                     # default: true
-# settings = true                           # default: true
+# always-available `mcp_app` control tool. Disabling a surface removes its app
+# advertisement and UI resources; the underlying text/service capability remains
+# available where one exists. The control tool remains text-only when its own UI
+# is disabled. The Code Mode inspector keeps its legacy switch above.
+# manager = false                           # default: false; opt in to the switchboard UI
+# add_server = false                        # default: false; opt in when the app is ready for your deployment
+# server_logs = false                       # default: false; underlying service tool remains available
+# gateway_status = false                    # default: false
+# settings = false                          # default: false
 
 # ── Code Mode `openapi` provider ─────────────────────────────────────────────
 #
diff --git a/crates/labby-gateway/src/gateway/manager/config_ops.rs b/crates/labby-gateway/src/gateway/manager/config_ops.rs
index e98767498..f7f0d7461 100644
--- a/crates/labby-gateway/src/gateway/manager/config_ops.rs
+++ b/crates/labby-gateway/src/gateway/manager/config_ops.rs
@@ -530,12 +530,14 @@ impl GatewayManager {
         let durable_previous = self.load_config_for_mutation().await?;
         let mut cfg = durable_previous.clone();
         match target {
+            "manager" => cfg.mcp_apps.manager = enabled,
             "codemode" => cfg.code_mode.mcp_ui_enabled = enabled,
             "gateway_status" => cfg.mcp_apps.gateway_status = enabled,
             "server_logs" => cfg.mcp_apps.server_logs = enabled,
             "add_server" => cfg.mcp_apps.add_server = enabled,
             "settings" => cfg.mcp_apps.settings = enabled,
             "all" => {
+                cfg.mcp_apps.manager = enabled;
                 cfg.code_mode.mcp_ui_enabled = enabled;
                 cfg.mcp_apps.gateway_status = enabled;
                 cfg.mcp_apps.server_logs = enabled;
@@ -577,6 +579,7 @@ impl GatewayManager {
             action = "gateway.mcp_apps.set",
             target,
             enabled,
+            manager = current.mcp_apps.manager,
             code_mode = current.code_mode.mcp_ui_enabled,
             add_server = current.mcp_apps.add_server,
             server_logs = current.mcp_apps.server_logs,
diff --git a/crates/labby-gateway/src/gateway/manager/tests/config_ops.rs b/crates/labby-gateway/src/gateway/manager/tests/config_ops.rs
index c3e758e91..cd238799a 100644
--- a/crates/labby-gateway/src/gateway/manager/tests/config_ops.rs
+++ b/crates/labby-gateway/src/gateway/manager/tests/config_ops.rs
@@ -857,9 +857,14 @@ async fn mcp_app_visibility_setting_persists_notifies_and_skips_pool_rebuild() {
     let mut manager = GatewayManager::new(path.clone(), runtime.clone());
     let (notify_tx, mut notify_rx) = tokio::sync::mpsc::unbounded_channel();
     manager.set_notifier(crate::gateway::types::CatalogChangeNotifier::new(notify_tx));
-    manager
-        .seed_config_unchecked_for_tests(GatewayConfig::default())
-        .await;
+    let mut initial = GatewayConfig::default();
+    initial.code_mode.mcp_ui_enabled = true;
+    initial.mcp_apps.manager = true;
+    initial.mcp_apps.gateway_status = true;
+    initial.mcp_apps.server_logs = true;
+    initial.mcp_apps.add_server = true;
+    initial.mcp_apps.settings = true;
+    manager.seed_config_unchecked_for_tests(initial).await;
     assert!(runtime.current_pool().await.is_none());
 
     let updated = manager
@@ -871,6 +876,7 @@ async fn mcp_app_visibility_setting_persists_notifies_and_skips_pool_rebuild() {
         .await
         .expect("persist MCP App visibility");
 
+    assert!(!updated.mcp_apps.manager);
     assert!(!updated.code_mode.mcp_ui_enabled);
     assert!(!updated.mcp_apps.gateway_status);
     assert!(!updated.mcp_apps.server_logs);
@@ -899,6 +905,7 @@ async fn mcp_app_visibility_setting_persists_notifies_and_skips_pool_rebuild() {
     );
 
     let persisted = load_gateway_config(&path).expect("load persisted config");
+    assert!(!persisted.mcp_apps.manager);
     assert!(!persisted.code_mode.mcp_ui_enabled);
     assert!(!persisted.mcp_apps.gateway_status);
     assert!(!persisted.mcp_apps.server_logs);
@@ -909,6 +916,7 @@ async fn mcp_app_visibility_setting_persists_notifies_and_skips_pool_rebuild() {
     restarted.seed_config_unchecked_for_tests(persisted).await;
     assert!(!restarted.code_mode_app_state().is_enabled());
     let restarted_apps = restarted.mcp_apps_config().await;
+    assert!(!restarted_apps.manager);
     assert!(!restarted_apps.gateway_status);
     assert!(!restarted_apps.server_logs);
     assert!(!restarted_apps.add_server);
diff --git a/crates/labby-gateway/src/upstream/pool.rs b/crates/labby-gateway/src/upstream/pool.rs
index eae1404a0..c3bd70770 100644
--- a/crates/labby-gateway/src/upstream/pool.rs
+++ b/crates/labby-gateway/src/upstream/pool.rs
@@ -107,7 +107,10 @@ pub use notifications::UpstreamNotificationEvent;
 pub use oauth_invalidation::OAuthSessionInvalidation;
 pub(crate) use stdio_stderr::install_upstream_stderr_level_default;
 pub use task_route::TaskRouteAuthorization;
-pub use tools::{MAX_UPSTREAM_TOOLS, tool_has_mcp_app_ui_resource, tool_is_mcp_app_host_visible};
+pub use tools::{
+    MAX_UPSTREAM_TOOLS, mcp_tool_is_mcp_app_host_visible, tool_has_mcp_app_ui_resource,
+    tool_is_mcp_app_host_visible,
+};
 // Catalog size caps are used by pool child modules directly via `super::tools::*`.
 // No external consumer references them through this path, so no `pub use` needed.
 
diff --git a/crates/labby-gateway/src/upstream/pool/tools.rs b/crates/labby-gateway/src/upstream/pool/tools.rs
index 38ce66774..5014f1a07 100644
--- a/crates/labby-gateway/src/upstream/pool/tools.rs
+++ b/crates/labby-gateway/src/upstream/pool/tools.rs
@@ -838,11 +838,18 @@ pub fn tool_has_mcp_app_ui_resource(tool: &UpstreamTool) -> bool {
     tool_mcp_app_ui_resource_uri(tool).is_some()
 }
 
-pub fn tool_is_mcp_app_host_visible(tool: &UpstreamTool) -> bool {
-    if tool_has_mcp_app_ui_resource(tool) {
+pub fn mcp_tool_is_mcp_app_host_visible(tool: &rmcp::model::Tool) -> bool {
+    let owns_ui_resource = tool
+        .meta
+        .as_ref()
+        .and_then(|meta| meta.0.get("ui"))
+        .and_then(|ui| ui.get("resourceUri"))
+        .and_then(Value::as_str)
+        .is_some_and(|uri| uri.starts_with("ui://"));
+    if owns_ui_resource {
         return true;
     }
-    let Some(meta) = tool.tool.meta.as_ref() else {
+    let Some(meta) = tool.meta.as_ref() else {
         return false;
     };
     let app_visible = meta
@@ -859,6 +866,10 @@ pub fn tool_is_mcp_app_host_visible(tool: &UpstreamTool) -> bool {
     app_visible || openai_widget_callback
 }
 
+pub fn tool_is_mcp_app_host_visible(tool: &UpstreamTool) -> bool {
+    mcp_tool_is_mcp_app_host_visible(&tool.tool)
+}
+
 #[cfg(test)]
 mod tests {
     use std::collections::BTreeSet;
diff --git a/crates/labby-runtime/src/catalog_notify.rs b/crates/labby-runtime/src/catalog_notify.rs
index 79b5674f8..80f268860 100644
--- a/crates/labby-runtime/src/catalog_notify.rs
+++ b/crates/labby-runtime/src/catalog_notify.rs
@@ -40,7 +40,7 @@ pub const SOURCE_GATEWAY_ENRICH_HINT: &str = "gateway.enrich.hint_apply";
 /// invalidate a client binding mid-turn.
 pub const SOURCE_MCP_CALL_CODEMODE: &str = "mcp.call.codemode";
 
-/// Catalog delta produced by the always-on `mcp_app` manager tool.
+/// Catalog delta produced by the always-available `mcp_app` control tool.
 pub const SOURCE_MCP_CALL_MCP_APP: &str = "mcp.call.mcp_app";
 
 /// Post-call catalog delta observed by a raw upstream proxy call. Same
diff --git a/crates/labby-runtime/src/code_mode_app.rs b/crates/labby-runtime/src/code_mode_app.rs
index e9c55a68e..829de1780 100644
--- a/crates/labby-runtime/src/code_mode_app.rs
+++ b/crates/labby-runtime/src/code_mode_app.rs
@@ -13,7 +13,7 @@ pub struct CodeModeAppState {
 
 impl Default for CodeModeAppState {
     fn default() -> Self {
-        Self::new(true)
+        Self::new(false)
     }
 }
 
@@ -42,6 +42,11 @@ impl CodeModeAppState {
 mod tests {
     use super::CodeModeAppState;
 
+    #[test]
+    fn default_state_is_opt_in() {
+        assert!(!CodeModeAppState::default().is_enabled());
+    }
+
     #[test]
     fn cloned_handles_share_state() {
         let state = CodeModeAppState::new(true);
diff --git a/crates/labby-runtime/src/gateway_config.rs b/crates/labby-runtime/src/gateway_config.rs
index c22f9d170..178e13537 100644
--- a/crates/labby-runtime/src/gateway_config.rs
+++ b/crates/labby-runtime/src/gateway_config.rs
@@ -95,36 +95,34 @@ fn default_mcp_scopes() -> Vec<String> {
 
 // ─── Lab-owned MCP Apps ──────────────────────────────────────────────────────
 
-/// Visibility switches for Labby-owned MCP App surfaces other than the
-/// always-on `mcp_app` manager. Code Mode keeps its existing
-/// `CodeModeConfig::mcp_ui_enabled` field for backward-compatible config.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+/// Visibility switches for Labby-owned MCP App UI surfaces. The `mcp_app`
+/// control tool stays available when its manager UI is disabled. Code Mode keeps
+/// its existing `CodeModeConfig::mcp_ui_enabled` field for backward-compatible
+/// config.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, Default)]
 pub struct McpAppsConfig {
+    /// Attach MCP App metadata to the always-available `mcp_app` control tool and advertise its UI resources.
+    /// The control tool itself remains available when this is false.
+    #[serde(default)]
+    pub manager: bool,
     /// Advertise the synthetic Add Server app tool and its UI resources.
-    #[serde(default = "default_true")]
+    /// Labby-owned app surfaces are opt-in by default.
+    #[serde(default)]
     pub add_server: bool,
     /// Attach the Server Logs app metadata and advertise its UI resources.
-    #[serde(default = "default_true")]
+    /// Labby-owned app surfaces are opt-in by default.
+    #[serde(default)]
     pub server_logs: bool,
     /// Advertise the synthetic Gateway Status app tool and its UI resources.
-    #[serde(default = "default_true")]
+    /// Labby-owned app surfaces are opt-in by default.
+    #[serde(default)]
     pub gateway_status: bool,
     /// Advertise the schema-backed Settings app tool and its UI resources.
-    #[serde(default = "default_true")]
+    /// Labby-owned app surfaces are opt-in by default.
+    #[serde(default)]
     pub settings: bool,
 }
 
-impl Default for McpAppsConfig {
-    fn default() -> Self {
-        Self {
-            add_server: true,
-            server_logs: true,
-            gateway_status: true,
-            settings: true,
-        }
-    }
-}
-
 // ─── Code Mode ───────────────────────────────────────────────────────────────
 
 /// Model-facing policy applied to oversized final Code Mode results.
@@ -195,7 +193,8 @@ pub struct CodeModeConfig {
     pub trusted_read_only_tools: Vec<String>,
     /// Whether the explicit `codemode_ui` MCP App tool and resources are advertised.
     /// The text-only `codemode` executor remains available when this is false.
-    #[serde(default = "default_true")]
+    /// Labby-owned MCP Apps are opt-in, so this defaults to false.
+    #[serde(default)]
     pub mcp_ui_enabled: bool,
     /// Whether Code Mode call traces include redacted/capped tool params.
     #[serde(default = "default_code_mode_trace_params")]
@@ -265,7 +264,7 @@ impl Default for CodeModeConfig {
         Self {
             enabled: false,
             trusted_read_only_tools: Vec::new(),
-            mcp_ui_enabled: true,
+            mcp_ui_enabled: false,
             trace_params: default_code_mode_trace_params(),
             result_shape_policy: CodeModeResultShapePolicy::Off,
             timeout_ms: default_code_mode_timeout_ms(),
@@ -2190,7 +2189,7 @@ client_secret_env = "SECRET"
         assert_eq!(cfg, expected);
         assert!(!cfg.enabled);
         assert!(cfg.trusted_read_only_tools.is_empty());
-        assert!(cfg.mcp_ui_enabled);
+        assert!(!cfg.mcp_ui_enabled);
         assert!(cfg.trace_params);
         assert_eq!(cfg.timeout_ms, 30_000);
         assert_eq!(cfg.token_estimate_divisor, 4);
@@ -2209,32 +2208,34 @@ client_secret_env = "SECRET"
     }
 
     #[test]
-    fn code_mode_mcp_ui_can_be_disabled_in_toml() {
+    fn code_mode_mcp_ui_can_be_enabled_in_toml() {
         let cfg: CodeModeConfig = toml::from_str(
-            "mcp_ui_enabled = false
+            "mcp_ui_enabled = true
 ",
         )
         .unwrap();
-        assert!(!cfg.mcp_ui_enabled);
+        assert!(cfg.mcp_ui_enabled);
         assert!(!cfg.enabled);
     }
 
     #[test]
-    fn mcp_apps_config_defaults_all_managed_apps_enabled() {
+    fn mcp_apps_config_defaults_all_managed_apps_disabled() {
         let cfg: McpAppsConfig = toml::from_str("").unwrap();
         assert_eq!(cfg, McpAppsConfig::default());
-        assert!(cfg.add_server);
-        assert!(cfg.server_logs);
-        assert!(cfg.gateway_status);
-        assert!(cfg.settings);
+        assert!(!cfg.manager);
+        assert!(!cfg.add_server);
+        assert!(!cfg.server_logs);
+        assert!(!cfg.gateway_status);
+        assert!(!cfg.settings);
     }
 
     #[test]
     fn mcp_apps_config_supports_independent_visibility_switches() {
         let cfg: McpAppsConfig = toml::from_str(
-            "add_server = false\nserver_logs = true\ngateway_status = false\nsettings = false\n",
+            "manager = true\nadd_server = false\nserver_logs = true\ngateway_status = false\nsettings = false\n",
         )
         .unwrap();
+        assert!(cfg.manager);
         assert!(!cfg.add_server);
         assert!(cfg.server_logs);
         assert!(!cfg.gateway_status);
diff --git a/crates/labby/src/api/services/gateway.rs b/crates/labby/src/api/services/gateway.rs
index 43a9eedde..8972c32ba 100644
--- a/crates/labby/src/api/services/gateway.rs
+++ b/crates/labby/src/api/services/gateway.rs
@@ -844,7 +844,16 @@ mod tests {
     async fn gateway_code_mode_mcp_ui_update_persists_via_api() {
         let (manager, path) = test_manager_with_path();
         manager
-            .seed_config_unchecked_for_tests(LabConfig::default().to_gateway_config())
+            .seed_config_unchecked_for_tests(
+                LabConfig {
+                    code_mode: crate::config::CodeModeConfig {
+                        mcp_ui_enabled: true,
+                        ..crate::config::CodeModeConfig::default()
+                    },
+                    ..LabConfig::default()
+                }
+                .to_gateway_config(),
+            )
             .await;
         assert!(manager.code_mode_app_state().is_enabled());
 
diff --git a/crates/labby/src/cli/serve.rs b/crates/labby/src/cli/serve.rs
index 0a3fe7f24..cb4941532 100644
--- a/crates/labby/src/cli/serve.rs
+++ b/crates/labby/src/cli/serve.rs
@@ -2592,13 +2592,31 @@ mod tests {
                 .collect()
         }
 
-        let _guard = crate::config::process_code_mode_test_guard();
-        crate::config::set_process_code_mode_enabled(true);
+        let tempdir = tempfile::tempdir().expect("tempdir");
+        let manager = std::sync::Arc::new(
+            crate::dispatch::gateway::config_store::test_gateway_manager(
+                tempdir.path().join("gateway.toml"),
+                crate::dispatch::gateway::manager::GatewayRuntimeHandle::default(),
+            ),
+        );
+        manager
+            .seed_config_unchecked_for_tests(
+                LabConfig {
+                    code_mode: crate::config::CodeModeConfig {
+                        enabled: true,
+                        ..crate::config::CodeModeConfig::default()
+                    },
+                    ..LabConfig::default()
+                }
+                .to_gateway_config(),
+            )
+            .await;
+        let state = AppState::new().with_gateway_manager(manager);
 
         let notifier = PeerNotifier::default();
         notifier.code_mode_app_state.set_enabled(false);
         let app = build_http_router(
-            AppState::new(),
+            state,
             None,
             None,
             &McpPreferences::default(),
diff --git a/crates/labby/src/mcp/CLAUDE.md b/crates/labby/src/mcp/CLAUDE.md
index e30a99dab..b38d8f784 100644
--- a/crates/labby/src/mcp/CLAUDE.md
+++ b/crates/labby/src/mcp/CLAUDE.md
@@ -76,10 +76,12 @@ For normal services, `dispatch/<service>/dispatch.rs` owns action routing, catal
   `codemode` has no static app descriptor but may return dynamic `_meta.ui`
   when an upstream call launches a nested MCP App. `codemode_ui` shares the
   same execution backend and owns the Code Mode inspector metadata. `mcp_app`
-  is the always-on root-gateway MCP App manager for the inspector, Gateway
-  Status, Server Logs, and Add Server surfaces; it supports per-app and `all`
-  `status|enable|disable` operations and cannot disable itself. App mutations
-  require `lab:admin`, are gateway-scoped, and schedule coalesced
+  is the always-available root-gateway control tool for the manager UI,
+  inspector, Gateway Status, Server Logs, Add Server, and Settings surfaces; it
+  supports per-app and `all` `status|enable|disable` operations. Its own manager
+  UI is opt-in and may be disabled, but the text-only control tool remains
+  available. App mutations require `lab:admin`, are gateway-scoped, and schedule
+  coalesced
   `tools/list_changed` plus `resources/list_changed` notifications after the
   open tool turn drains. `server_logs` keeps its text/service capability when
   its UI is hidden; `codemode` likewise remains text-only and executable when
@@ -214,8 +216,11 @@ Resources are read-only. Do not use them for mutations.
 - `ui://lab/code-mode/*` — Lab's own Code Mode app resources, served locally
   from bundled HTML (`read_code_mode_app_resource_impl`). The app descriptors
   bind only to `codemode_ui`; disabling the app hides that tool and these
-  resources from discovery, while direct resource reads remain valid so cards
-  already rendered by a host do not break.
+  resources, and direct reads fail as unknown. All Labby-owned app UIs are
+  opt-in; a disabled surface must not remain reachable through a cached URI.
+- `ui://lab/mcp-apps/manager` — the opt-in UI for the always-available `mcp_app`
+  control tool. Disabling this manager UI strips its tool metadata and resource
+  but does not remove the text-only control tool needed to restore app surfaces.
 - `ui://lab/gateway/add-server` — the admin-only Add Server app bound to the
   synthetic `add_server` tool. Its `test` and `create` callbacks delegate to
   `gateway.test` and `gateway.add`; do not duplicate gateway persistence logic.
@@ -227,7 +232,10 @@ Resources are read-only. Do not use them for mutations.
 - any other `ui://<upstream>/…` — an upstream mcp-ui widget resource (referenced
   by a tool result's `_meta.ui.resourceUri`). Routed to the owning upstream peer
   via `pool.read_upstream_ui_resource` (catalog reverse-lookup, native URI
-  preserved). See `resource_proxy.rs::read_upstream_ui_resource_impl`.
+  preserved). When synthetic Code Mode hides ordinary raw tools, upstream
+  MCP-App host-visible tools/callbacks still pass through automatically if the
+  route allows that upstream and `proxy_resources` is enabled. See
+  `resource_proxy.rs::read_upstream_ui_resource_impl`.
 
 ## Transport auth for fs
 
diff --git a/crates/labby/src/mcp/assets/mcp_apps_app.html b/crates/labby/src/mcp/assets/mcp_apps_app.html
index 154370525..33547121e 100644
--- a/crates/labby/src/mcp/assets/mcp_apps_app.html
+++ b/crates/labby/src/mcp/assets/mcp_apps_app.html
@@ -17,16 +17,16 @@
 </head>
 <body>
 <main class="shell" id="shell">
-<header><div><h1>MCP Apps</h1><p class="lede">Choose which Labby-owned app tools and UI resources are advertised by the gateway.</p></div><div class="bulk"><button id="enableAll" type="button">Enable all</button><button id="disableAll" type="button">Disable all</button></div></header>
+<header><div><h1>MCP Apps</h1><p class="lede">Choose which Labby-owned app UI surfaces are advertised by the gateway.</p></div><div class="bulk"><button id="enableAll" type="button">Enable all</button><button id="disableAll" type="button">Disable all</button></div></header>
 <p class="status" id="status" role="status" aria-live="polite">Loading app state…</p>
 <section class="apps" id="apps" aria-label="Labby MCP App visibility"></section>
-<p class="note"><strong>This manager stays available.</strong> Disabling an app removes its UI advertisement and resources without disabling the underlying text/service capability where one exists.</p>
+<p class="note"><strong>The mcp_app control tool stays available.</strong> Its manager UI can be disabled like every other Labby-owned app. Disabling an app removes its UI advertisement and resources without disabling the underlying text/service capability where one exists.</p>
 </main>
 <script>
 (function(){
 "use strict";
 var host=window.LabbyAppHost,shell=document.getElementById("shell"),appsEl=document.getElementById("apps"),statusEl=document.getElementById("status"),enableAll=document.getElementById("enableAll"),disableAll=document.getElementById("disableAll");
-var catalog=[{id:"codemode",title:"Code Mode Inspector",description:"Visual Code Mode trace inspector. The text-only codemode executor remains available.",tool:"codemode_ui"},{id:"gateway_status",title:"Gateway Status",description:"Live upstream connection status, capabilities, and warnings.",tool:"gateway_status"},{id:"server_logs",title:"Server Logs",description:"Admin viewer for Labby's rolling server process logs.",tool:"server_logs"},{id:"add_server",title:"Add Server",description:"Interactive form for testing and adding gateway MCP servers.",tool:"add_server"},{id:"settings",title:"Settings",description:"Schema-backed Labby runtime settings for Code Mode, proxy, surfaces, and features.",tool:"settings"}];
+var catalog=[{id:"manager",title:"MCP Apps Manager",description:"Visual switchboard for Labby-owned app surfaces. The text-only mcp_app control tool remains available.",tool:"mcp_app"},{id:"codemode",title:"Code Mode Inspector",description:"Visual Code Mode trace inspector. The text-only codemode executor remains available.",tool:"codemode_ui"},{id:"gateway_status",title:"Gateway Status",description:"Live upstream connection status, capabilities, and warnings.",tool:"gateway_status"},{id:"server_logs",title:"Server Logs",description:"Admin viewer for Labby's rolling server process logs.",tool:"server_logs"},{id:"add_server",title:"Add Server",description:"Interactive form for testing and adding gateway MCP servers.",tool:"add_server"},{id:"settings",title:"Settings",description:"Schema-backed Labby runtime settings for Code Mode, proxy, surfaces, and features.",tool:"settings"}];
 var state={},disposed=false,frame=null,pending=new Set();
 function normalize(value){if(value==null)return value;if(value.structuredContent!=null)return normalize(value.structuredContent);if(value.ok===false)throw new Error(value.error&&value.error.message||"The MCP App request failed.");if(value.ok===true)return normalize(value.data);if(value.isError===true&&Array.isArray(value.content)){var message=value.content.map(function(item){return item&&item.text}).filter(Boolean).join("\n");throw new Error(message||"The MCP App request failed.")}if(Array.isArray(value.content)&&value.content[0]&&value.content[0].text){try{return normalize(JSON.parse(value.content[0].text))}catch(_){}}return value}
 function apply(raw){var value=normalize(raw)||{};if(value.apps&&typeof value.apps==="object")state=value.apps;else if(value.target&&value.target!=="all"&&typeof value.enabled==="boolean"){var next=Object.assign({},state);next[value.target]=Object.assign({},state[value.target]||{},{enabled:value.enabled});state=next}render()}
diff --git a/crates/labby/src/mcp/call_tool.rs b/crates/labby/src/mcp/call_tool.rs
index eac9d43c1..d2fbd860f 100644
--- a/crates/labby/src/mcp/call_tool.rs
+++ b/crates/labby/src/mcp/call_tool.rs
@@ -389,7 +389,8 @@ impl LabMcpServer {
                     .unwrap_or("codemode");
                 if !matches!(
                     target,
-                    "codemode"
+                    "manager"
+                        | "codemode"
                         | "gateway_status"
                         | "server_logs"
                         | "add_server"
@@ -402,7 +403,7 @@ impl LabMcpServer {
                         "invalid_param",
                         &format!("unsupported MCP App target `{target}`"),
                         &serde_json::json!({
-                            "valid": ["codemode", "gateway_status", "server_logs", "add_server", "settings", "all"]
+                            "valid": ["manager", "codemode", "gateway_status", "server_logs", "add_server", "settings", "all"]
                         }),
                     );
                     return Ok(error_result_from_envelope(envelope).into());
@@ -497,13 +498,15 @@ impl LabMcpServer {
                     .as_ref()
                     .map_or(previous_apps, |cfg| cfg.mcp_apps);
                 let enabled = match target {
+                    "manager" => enabled_apps.manager,
                     "codemode" => enabled_code_mode,
                     "gateway_status" => enabled_apps.gateway_status,
                     "server_logs" => enabled_apps.server_logs,
                     "add_server" => enabled_apps.add_server,
                     "settings" => enabled_apps.settings,
                     "all" => {
-                        enabled_code_mode
+                        enabled_apps.manager
+                            && enabled_code_mode
                             && enabled_apps.gateway_status
                             && enabled_apps.server_logs
                             && enabled_apps.add_server
@@ -513,6 +516,7 @@ impl LabMcpServer {
                 };
                 let changed = desired.is_some()
                     && match target {
+                        "manager" => previous_apps.manager != enabled_apps.manager,
                         "codemode" => previous_code_mode != enabled_code_mode,
                         "gateway_status" => {
                             previous_apps.gateway_status != enabled_apps.gateway_status
@@ -548,6 +552,10 @@ impl LabMcpServer {
                     "text_tool": CODE_MODE_TOOL_NAME,
                     "ui_tool": CODE_MODE_UI_TOOL_NAME,
                     "apps": {
+                        "manager": {
+                            "enabled": enabled_apps.manager,
+                            "tool": MCP_APP_TOOL_NAME,
+                        },
                         "codemode": {
                             "enabled": enabled_code_mode,
                             "tool": CODE_MODE_UI_TOOL_NAME,
diff --git a/crates/labby/src/mcp/handlers_resources.rs b/crates/labby/src/mcp/handlers_resources.rs
index b8bf7fec0..80d53f6d0 100644
--- a/crates/labby/src/mcp/handlers_resources.rs
+++ b/crates/labby/src/mcp/handlers_resources.rs
@@ -645,7 +645,11 @@ impl LabMcpServer {
         }
 
         #[cfg(feature = "gateway")]
-        if !resources.finished() && self.route_scope.is_root() && tool_execute_scope_allowed(auth) {
+        if !resources.finished()
+            && mcp_apps_config.manager
+            && self.route_scope.is_root()
+            && tool_execute_scope_allowed(auth)
+        {
             for resource in mcp_apps_app_resources() {
                 resources.accept(resource);
                 if resources.finished() {
@@ -1107,10 +1111,13 @@ impl LabMcpServer {
         // Branch 0: MCP Apps UI resources. This must precede all lab://
         // fallbacks so ui:// has its own exact lookup semantics.
         //
-        // The MCP App manager is always locally owned and must remain readable
-        // even when every managed app surface is disabled.
+        // The `mcp_app` control tool is always locally available, but its own
+        // Labby-owned UI is opt-in like every other Labby-owned MCP App.
         #[cfg(feature = "gateway")]
         if uri.starts_with(MCP_APPS_APP_URI) {
+            if !self.mcp_apps_config().await.manager {
+                return Err(unknown_resource_error(&uri, true));
+            }
             return self
                 .read_mcp_apps_app_resource_impl(&uri, &subject, start, &context)
                 .await
@@ -2047,7 +2054,7 @@ fn gateway_status_app_resources() -> Vec<Resource> {
 }
 
 #[cfg(feature = "gateway")]
-/// Build the discoverable always-on MCP App manager resource.
+/// Build the discoverable opt-in MCP App manager UI resources.
 fn mcp_apps_app_resources() -> Vec<Resource> {
     mcp_apps_app().listed_resources()
 }
@@ -2383,18 +2390,27 @@ Object.assign(globalThis, {{ window, document, history, requestAnimationFrame, c
                 crate::config::LabConfig {
                     code_mode: crate::config::CodeModeConfig {
                         enabled: true,
+                        mcp_ui_enabled: true,
                         ..crate::config::CodeModeConfig::default()
                     },
+                    mcp_apps: crate::config::McpAppsConfig {
+                        manager: true,
+                        add_server: true,
+                        server_logs: true,
+                        gateway_status: true,
+                        settings: true,
+                    },
                     ..crate::config::LabConfig::default()
                 }
                 .to_gateway_config(),
             )
             .await;
+        let code_mode_app_state = manager.code_mode_app_state();
         LabMcpServer {
             registry: Arc::new(crate::registry::ToolRegistry::new()),
             gateway_manager: Some(manager),
             peers: Default::default(),
-            code_mode_app_state: Default::default(),
+            code_mode_app_state,
             last_listed_tool_contract: Default::default(),
             route_runtime: Default::default(),
             client_registry: Default::default(),
@@ -2745,7 +2761,7 @@ Object.assign(globalThis, {{ window, document, history, requestAnimationFrame, c
     }
 
     #[tokio::test]
-    async fn code_mode_keeps_upstream_ui_resources_without_advertising_callback_tools() {
+    async fn code_mode_passes_through_upstream_mcp_app_tool_and_resource() {
         let (transport, _client_transport) = tokio::io::duplex(64);
         let running = rmcp::service::serve_directly::<RoleServer, _, _, std::io::Error, _>(
             code_mode_server_with_upstream_ui_resource().await,
@@ -2760,25 +2776,19 @@ Object.assign(globalThis, {{ window, document, history, requestAnimationFrame, c
             .list_tools_impl(None, tool_context)
             .await
             .expect("list tools");
-        let codemode_tool = tools
-            .tools
-            .iter()
-            .find(|tool| tool.name.as_ref() == CODE_MODE_UI_TOOL_NAME)
-            .expect("Code Mode UI tool should be listed");
         assert!(
-            codemode_tool
-                .meta
-                .as_ref()
-                .and_then(|meta| meta.0["ui"]["resourceUri"].as_str())
-                .is_some_and(|uri| uri.starts_with(CODE_MODE_APP_URI_PREFIX)),
-            "Code Mode tool must keep its local UI resource: {codemode_tool:?}"
+            tools
+                .tools
+                .iter()
+                .all(|tool| tool.name.as_ref() != CODE_MODE_UI_TOOL_NAME),
+            "Labby-owned Code Mode UI must stay opt-in by default"
         );
         assert!(
             tools
                 .tools
                 .iter()
-                .all(|tool| tool.name.as_ref() != UPSTREAM_UI_TOOL_NAME),
-            "upstream callback tools must not churn the synthetic Code Mode contract"
+                .any(|tool| tool.name.as_ref() == UPSTREAM_UI_TOOL_NAME),
+            "upstream MCP App tools must pass through synthetic Code Mode"
         );
 
         let resources = running
@@ -2793,8 +2803,8 @@ Object.assign(globalThis, {{ window, document, history, requestAnimationFrame, c
             .collect::<Vec<_>>();
         assert!(
             uris.iter()
-                .any(|uri| strip_app_version(uri) == CODE_MODE_APP_URI),
-            "Code Mode app resource should be listed alongside upstream UI resources: {uris:?}"
+                .all(|uri| strip_app_version(uri) != CODE_MODE_APP_URI),
+            "Labby-owned Code Mode app resource must stay hidden by default: {uris:?}"
         );
         assert!(
             uris.contains(&UPSTREAM_UI_URI),
@@ -2831,24 +2841,14 @@ Object.assign(globalThis, {{ window, document, history, requestAnimationFrame, c
             .expect("complete upstream resource template");
         assert_eq!(completion.completion.values, vec!["sys-completion"]);
 
-        let code_mode_read = complete_resource(
-            running
-                .service()
-                .read_resource_impl(
-                    ReadResourceRequestParams::new(CODE_MODE_APP_URI),
-                    resource_context.clone(),
-                )
-                .await
-                .expect("read Code Mode UI resource"),
-        );
-        let ResourceContents::TextResourceContents {
-            text: code_mode_html,
-            ..
-        } = &code_mode_read.contents[0]
-        else {
-            panic!("expected Code Mode text resource");
-        };
-        assert!(code_mode_html.contains("Lab Code Mode Inspector"));
+        running
+            .service()
+            .read_resource_impl(
+                ReadResourceRequestParams::new(CODE_MODE_APP_URI),
+                resource_context.clone(),
+            )
+            .await
+            .expect_err("disabled Labby-owned Code Mode UI resource must not be readable");
 
         let upstream_read = complete_resource(
             running
@@ -3179,6 +3179,7 @@ if (!probe.connected || !probe.healthy || !probe.empty) {{
 
         for expected in [
             "MCP Apps",
+            "id:\"manager\"",
             "Enable all",
             "Disable all",
             "role='switch'",
diff --git a/crates/labby/src/mcp/handlers_tools.rs b/crates/labby/src/mcp/handlers_tools.rs
index 0e88eed47..b9d550e94 100644
--- a/crates/labby/src/mcp/handlers_tools.rs
+++ b/crates/labby/src/mcp/handlers_tools.rs
@@ -19,7 +19,7 @@ use rmcp::service::RequestContext;
 use serde_json::Value;
 
 #[cfg(feature = "gateway")]
-use crate::dispatch::upstream::pool::MAX_UPSTREAM_TOOLS;
+use crate::dispatch::upstream::pool::{MAX_UPSTREAM_TOOLS, mcp_tool_is_mcp_app_host_visible};
 #[cfg(feature = "gateway")]
 use crate::mcp::call_tool_codemode::CodeModeUpstreamDescription;
 #[cfg(feature = "gateway")]
@@ -246,7 +246,11 @@ impl LabMcpServer {
 
         #[cfg(feature = "gateway")]
         if self.route_scope.is_root() && tool_execute_scope_allowed(auth) {
-            descriptors.push(self.registry.permanent_tools().mcp_app_tool());
+            descriptors.push(
+                self.registry
+                    .permanent_tools()
+                    .mcp_app_tool(mcp_apps_config.manager),
+            );
             advertised_names.insert(MCP_APP_TOOL_NAME.to_string());
             gateway_tool_count += 1;
         }
@@ -287,8 +291,15 @@ impl LabMcpServer {
                 .iter()
                 .filter(|(_, health)| health.is_open())
                 .count();
-            let upstream_tools = if hide_raw_tools || !self.route_scope.exposes_tools() {
+            let upstream_tools = if !self.route_scope.exposes_tools() {
                 Vec::new()
+            } else if hide_raw_tools {
+                if self.route_scope.exposes_resources() {
+                    pool.healthy_ui_tools_allowed(self.route_scope.allowed_upstreams())
+                        .await
+                } else {
+                    Vec::new()
+                }
             } else {
                 pool.healthy_tools_allowed(self.route_scope.allowed_upstreams())
                     .await
@@ -312,11 +323,17 @@ impl LabMcpServer {
             }
             let oauth_subject =
                 oauth_upstream_subject_for_request(auth, self.request_subject(&context));
-            if !hide_raw_tools
-                && self.route_scope.exposes_tools()
+            if self.route_scope.exposes_tools()
                 && let Some(oauth_subject) = oauth_subject.as_ref()
             {
-                let configs = self.route_scoped_oauth_upstream_configs().await;
+                let mut configs = self.route_scoped_oauth_upstream_configs().await;
+                if hide_raw_tools {
+                    if !self.route_scope.exposes_resources() {
+                        configs.clear();
+                    } else {
+                        configs.retain(|config| config.proxy_resources);
+                    }
+                }
                 let subject_tool_limit = MAX_UPSTREAM_TOOLS.saturating_sub(upstream_tool_count);
                 for (_, upstream_tools) in pool
                     .cached_subject_scoped_tools_bounded(
@@ -327,6 +344,9 @@ impl LabMcpServer {
                     .await
                 {
                     for ut in upstream_tools {
+                        if hide_raw_tools && !mcp_tool_is_mcp_app_host_visible(&ut) {
+                            continue;
+                        }
                         let tool_name = ut.name.as_ref();
                         if builtin_names.contains(tool_name)
                             || !advertised_names.insert(tool_name.to_string())
@@ -511,10 +531,10 @@ pub(crate) fn code_mode_ui_description(upstreams: &[CodeModeUpstreamDescription]
     )
 }
 
-/// Description for the always-on `mcp_app` manager.
+/// Description for the always-available `mcp_app` control tool.
 #[cfg(feature = "gateway")]
 pub(crate) const fn mcp_app_tool_description() -> &'static str {
-    "Open the Labby MCP Apps manager or enable, disable, and inspect Labby-owned app surfaces. Targets include the Code Mode inspector, gateway status, server logs, Add Server, Settings, or all managed apps. The manager itself cannot be disabled."
+    "Enable, disable, and inspect Labby-owned MCP App surfaces. The control tool remains available even when its own manager UI is disabled. Targets include the manager UI, Code Mode inspector, gateway status, server logs, Add Server, Settings, or all managed apps."
 }
 
 #[cfg(feature = "gateway")]
@@ -531,7 +551,7 @@ pub(crate) fn mcp_app_tool_schema() -> Arc<serde_json::Map<String, Value>> {
                 },
                 "target": {
                     "type": "string",
-                    "enum": ["codemode", "gateway_status", "server_logs", "add_server", "settings", "all"],
+                    "enum": ["manager", "codemode", "gateway_status", "server_logs", "add_server", "settings", "all"],
                     "default": "codemode",
                     "description": "Legacy direct target shape. Use all for the switchboard snapshot or a bulk change."
                 },
@@ -540,7 +560,7 @@ pub(crate) fn mcp_app_tool_schema() -> Arc<serde_json::Map<String, Value>> {
                     "properties": {
                         "target": {
                             "type": "string",
-                            "enum": ["codemode", "gateway_status", "server_logs", "add_server", "settings", "all"],
+                            "enum": ["manager", "codemode", "gateway_status", "server_logs", "add_server", "settings", "all"],
                             "default": "codemode",
                             "description": "Labby-owned MCP App target used by the shared app host."
                         }
@@ -558,7 +578,7 @@ pub(crate) fn mcp_app_tool_schema() -> Arc<serde_json::Map<String, Value>> {
 }
 
 #[cfg(feature = "gateway")]
-/// Build MCP Apps metadata for the always-on MCP App manager.
+/// Build MCP Apps metadata for the opt-in MCP App manager UI.
 pub(crate) fn mcp_app_tool_meta(tool_name: &str) -> MetaObject {
     let resource_uri = mcp_apps_app_resource_uri_for_tool(tool_name)
         .expect("MCP App manager must have an associated UI resource");
diff --git a/crates/labby/src/mcp/handlers_tools/tests.rs b/crates/labby/src/mcp/handlers_tools/tests.rs
index 7bcaf1f4b..d5c19fd1c 100644
--- a/crates/labby/src/mcp/handlers_tools/tests.rs
+++ b/crates/labby/src/mcp/handlers_tools/tests.rs
@@ -220,11 +220,15 @@ fn test_server(
     route_scope: crate::mcp::route_scope::McpRouteScope,
     logging_level: crate::mcp::logging::LoggingLevel,
 ) -> LabMcpServer {
+    let code_mode_app_state = gateway_manager
+        .as_ref()
+        .map(|manager| manager.code_mode_app_state())
+        .unwrap_or_default();
     LabMcpServer {
         registry: Arc::new(registry),
         gateway_manager,
         peers: Default::default(),
-        code_mode_app_state: Default::default(),
+        code_mode_app_state,
         last_listed_tool_contract: Default::default(),
         route_runtime: Default::default(),
         client_registry: Default::default(),
@@ -251,8 +255,16 @@ async fn code_mode_manager(
             crate::config::LabConfig {
                 code_mode: crate::config::CodeModeConfig {
                     enabled,
+                    mcp_ui_enabled: true,
                     ..crate::config::CodeModeConfig::default()
                 },
+                mcp_apps: crate::config::McpAppsConfig {
+                    manager: true,
+                    add_server: true,
+                    server_logs: true,
+                    gateway_status: true,
+                    settings: true,
+                },
                 ..crate::config::LabConfig::default()
             }
             .to_gateway_config(),
@@ -300,8 +312,16 @@ async fn code_mode_manager_with_test_runner(
             crate::config::LabConfig {
                 code_mode: crate::config::CodeModeConfig {
                     enabled,
+                    mcp_ui_enabled: true,
                     ..crate::config::CodeModeConfig::default()
                 },
+                mcp_apps: crate::config::McpAppsConfig {
+                    manager: true,
+                    add_server: true,
+                    server_logs: true,
+                    gateway_status: true,
+                    settings: true,
+                },
                 upstream: upstreams,
                 ..crate::config::LabConfig::default()
             }
@@ -384,8 +404,16 @@ async fn code_mode_manager_with_pool_and_upstreams(
             crate::config::LabConfig {
                 code_mode: crate::config::CodeModeConfig {
                     enabled,
+                    mcp_ui_enabled: true,
                     ..crate::config::CodeModeConfig::default()
                 },
+                mcp_apps: crate::config::McpAppsConfig {
+                    manager: true,
+                    add_server: true,
+                    server_logs: true,
+                    gateway_status: true,
+                    settings: true,
+                },
                 upstream: upstreams,
                 ..crate::config::LabConfig::default()
             }
@@ -979,6 +1007,7 @@ fn mcp_app_schema_and_meta_cover_managed_apps() {
     assert_eq!(
         schema["properties"]["target"]["enum"],
         serde_json::json!([
+            "manager",
             "codemode",
             "gateway_status",
             "server_logs",
@@ -1217,6 +1246,58 @@ async fn list_tools_advertises_code_mode_output_schemas() {
     );
 }
 
+#[tokio::test]
+async fn mcp_app_control_tool_survives_manager_ui_disable() {
+    let manager = code_mode_manager(true).await;
+    manager
+        .set_mcp_app_visibility("manager", false, None)
+        .await
+        .expect("disable manager UI");
+    let server = test_server(
+        crate::registry::build_default_registry(),
+        Some(manager),
+        crate::mcp::route_scope::McpRouteScope::Root,
+        crate::mcp::logging::LoggingLevel::Emergency,
+    );
+    let (transport, _client_transport) = tokio::io::duplex(128 * 1024);
+    let running = rmcp::service::serve_directly::<rmcp::RoleServer, _, _, std::io::Error, _>(
+        server, transport, None,
+    );
+    let peer = running.peer().clone();
+
+    let tools = running
+        .service()
+        .list_tools_impl(None, scoped_context(peer.clone(), &["lab:admin"]))
+        .await
+        .expect("tools with manager UI disabled");
+    let control = tools
+        .tools
+        .iter()
+        .find(|tool| tool.name.as_ref() == MCP_APP_TOOL_NAME)
+        .expect("mcp_app control tool");
+    assert!(control.meta.is_none(), "manager UI metadata must be opt-in");
+
+    let resources = running
+        .service()
+        .list_resources_impl(None, scoped_context(peer.clone(), &["lab:admin"]))
+        .await
+        .expect("resources with manager UI disabled");
+    assert!(
+        resources
+            .resources
+            .iter()
+            .all(|resource| !resource.uri.starts_with(MCP_APPS_APP_URI))
+    );
+    running
+        .service()
+        .read_resource_impl(
+            ReadResourceRequestParams::new(MCP_APPS_APP_URI),
+            scoped_context(peer, &["lab:admin"]),
+        )
+        .await
+        .expect_err("disabled manager UI resource must be unreadable");
+}
+
 #[tokio::test]
 async fn mcp_app_manager_stays_visible_when_code_mode_is_disabled() {
     let server = test_server(
@@ -1264,12 +1345,14 @@ async fn mcp_app_manager_stays_visible_when_code_mode_is_disabled() {
 
 #[tokio::test]
 async fn mcp_app_status_reports_runtime_state() {
-    let server = test_server(
+    let manager = code_mode_manager(true).await;
+    let mut server = test_server(
         completion_test_registry(),
-        Some(code_mode_manager(true).await),
+        Some(Arc::clone(&manager)),
         crate::mcp::route_scope::McpRouteScope::Root,
         crate::mcp::logging::LoggingLevel::Emergency,
     );
+    server.code_mode_app_state = manager.code_mode_app_state();
     let (transport, _client_transport) = tokio::io::duplex(64 * 1024);
     let running = rmcp::service::serve_directly::<rmcp::RoleServer, _, _, std::io::Error, _>(
         server, transport, None,
@@ -1306,11 +1389,6 @@ async fn mcp_app_status_reports_runtime_state() {
 
 #[tokio::test]
 async fn mcp_app_enable_is_idempotent_for_admin_scope() {
-    let app_state = crate::mcp::catalog::CodeModeAppState::default();
-    assert!(
-        app_state.is_enabled(),
-        "the gateway MCP App switch defaults to enabled"
-    );
     let server = test_server(
         completion_test_registry(),
         Some(code_mode_manager(true).await),
@@ -1365,12 +1443,14 @@ async fn mcp_app_disable_hides_ui_surface_and_enable_restores_it() {
         crate::mcp::logging::LoggingLevel::Emergency,
     );
     sibling_session.code_mode_app_state = shared_state;
-    let independent_gateway = test_server(
+    let independent_manager = code_mode_manager(true).await;
+    let mut independent_gateway = test_server(
         completion_test_registry(),
-        Some(code_mode_manager(true).await),
+        Some(Arc::clone(&independent_manager)),
         crate::mcp::route_scope::McpRouteScope::Root,
         crate::mcp::logging::LoggingLevel::Emergency,
     );
+    independent_gateway.code_mode_app_state = independent_manager.code_mode_app_state();
 
     let (transport, _client_transport) = tokio::io::duplex(256 * 1024);
     let running = rmcp::service::serve_directly::<rmcp::RoleServer, _, _, std::io::Error, _>(
@@ -1538,11 +1618,12 @@ async fn mcp_app_individual_disable_only_changes_selected_surface() {
     assert_eq!(structured["enabled"], false);
     assert_eq!(structured["changed"], true);
     assert_eq!(structured["apps"]["server_logs"]["enabled"], false);
-    for target in ["codemode", "gateway_status", "add_server"] {
+    for target in ["manager", "codemode", "gateway_status", "add_server"] {
         assert_eq!(structured["apps"][target]["enabled"], true, "{target}");
     }
 
     let cfg = manager.current_config().await;
+    assert!(cfg.mcp_apps.manager);
     assert!(cfg.code_mode.mcp_ui_enabled);
     assert!(cfg.mcp_apps.gateway_status);
     assert!(!cfg.mcp_apps.server_logs);
@@ -1704,6 +1785,7 @@ async fn mcp_app_bulk_disable_hides_managed_apps_but_keeps_manager() {
     assert_eq!(structured["enabled"], false);
     assert_eq!(structured["changed"], true);
     for target in [
+        "manager",
         "codemode",
         "gateway_status",
         "server_logs",
@@ -1714,6 +1796,7 @@ async fn mcp_app_bulk_disable_hides_managed_apps_but_keeps_manager() {
     }
 
     let cfg = manager.current_config().await;
+    assert!(!cfg.mcp_apps.manager);
     assert!(!cfg.code_mode.mcp_ui_enabled);
     assert!(!cfg.mcp_apps.gateway_status);
     assert!(!cfg.mcp_apps.server_logs);
@@ -1737,6 +1820,15 @@ async fn mcp_app_bulk_disable_hides_managed_apps_but_keeps_manager() {
     assert!(!names.contains(&GATEWAY_STATUS_TOOL_NAME));
     assert!(!names.contains(&ADD_SERVER_TOOL_NAME));
     assert!(!names.contains(&SETTINGS_TOOL_NAME));
+    let manager_tool = tools
+        .tools
+        .iter()
+        .find(|tool| tool.name.as_ref() == MCP_APP_TOOL_NAME)
+        .expect("mcp_app control tool remains available");
+    assert!(
+        manager_tool.meta.is_none(),
+        "disabled manager UI must leave the control tool text-only"
+    );
     let logs = tools
         .tools
         .iter()
@@ -1752,14 +1844,8 @@ async fn mcp_app_bulk_disable_hides_managed_apps_but_keeps_manager() {
         .list_resources_impl(None, scoped_context(peer.clone(), &["lab:admin"]))
         .await
         .expect("resources after bulk disable");
-    assert!(
-        resources
-            .resources
-            .iter()
-            .any(|resource| resource.uri.starts_with(MCP_APPS_APP_URI)),
-        "the recovery manager resource must stay listed"
-    );
     for hidden_prefix in [
+        MCP_APPS_APP_URI,
         CODE_MODE_APP_URI_PREFIX,
         GATEWAY_STATUS_APP_URI,
         SERVER_LOGS_APP_URI,
@@ -1775,6 +1861,7 @@ async fn mcp_app_bulk_disable_hides_managed_apps_but_keeps_manager() {
         );
     }
     for stale_uri in [
+        MCP_APPS_APP_URI,
         CODE_MODE_APP_URI,
         GATEWAY_STATUS_APP_URI,
         SERVER_LOGS_APP_URI,
@@ -1792,15 +1879,6 @@ async fn mcp_app_bulk_disable_hides_managed_apps_but_keeps_manager() {
         assert!(stale.message.contains("unknown UI resource"), "{stale:?}");
     }
 
-    running
-        .service()
-        .read_resource_impl(
-            ReadResourceRequestParams::new(MCP_APPS_APP_URI),
-            scoped_context(peer.clone(), &["lab:admin"]),
-        )
-        .await
-        .expect("manager resource remains readable");
-
     let enable = running
         .service()
         .call_tool_impl(
@@ -1816,6 +1894,7 @@ async fn mcp_app_bulk_disable_hides_managed_apps_but_keeps_manager() {
         .expect("bulk enable result");
     assert!(!enable.is_error.unwrap_or(false));
     let cfg = manager.current_config().await;
+    assert!(cfg.mcp_apps.manager);
     assert!(cfg.code_mode.mcp_ui_enabled);
     assert!(cfg.mcp_apps.gateway_status);
     assert!(cfg.mcp_apps.server_logs);
@@ -2420,7 +2499,10 @@ async fn list_tools_promotes_upstream_mcp_app_tools_when_raw_tools_are_hidden()
         .map(|tool| tool.name.as_ref())
         .collect::<Vec<_>>();
 
-    assert!(!names.contains(&"youtube_search_ui"));
+    assert!(
+        names.contains(&"youtube_search_ui"),
+        "upstream MCP App tools must pass through while ordinary raw tools stay hidden"
+    );
     assert!(!names.contains(&"youtube_probe"));
     assert!(names.contains(&CODE_MODE_TOOL_NAME));
     assert!(!names.contains(&"hidden-upstream"));
@@ -2448,19 +2530,20 @@ async fn tool_catalog_snapshot_keeps_code_mode_contract_health_independent() {
     )
     .await;
     let manager = code_mode_manager_with_pool(true, fixture_upstream_config("apps"), pool).await;
-    let server = test_server(
+    let mut server = test_server(
         completion_test_registry(),
-        Some(manager),
+        Some(Arc::clone(&manager)),
         crate::mcp::route_scope::McpRouteScope::Root,
         crate::mcp::logging::LoggingLevel::Emergency,
     );
+    server.code_mode_app_state = manager.code_mode_app_state();
 
     let snapshot = server.snapshot_tool_catalog().await;
 
     assert!(snapshot.tools.contains(CODE_MODE_TOOL_NAME));
     assert!(snapshot.tools.contains(CODE_MODE_UI_TOOL_NAME));
     assert!(snapshot.tools.contains(MCP_APP_TOOL_NAME));
-    assert!(!snapshot.tools.contains("youtube_search_ui"));
+    assert!(snapshot.tools.contains("youtube_search_ui"));
     assert!(!snapshot.tools.contains("youtube_probe"));
 }
 
@@ -2847,7 +2930,10 @@ async fn protected_code_mode_list_tools_hides_raw_siblings_and_disallowed_builti
     assert!(!names.contains(&"gateway-alpha"));
     assert!(!names.contains(&"hidden-upstream"));
     assert!(names.contains(&CODE_MODE_TOOL_NAME));
-    assert!(!names.contains(&"youtube_search_ui"));
+    assert!(
+        names.contains(&"youtube_search_ui"),
+        "upstream MCP App tools must pass through while ordinary raw tools stay hidden"
+    );
     assert!(!names.contains(&"youtube_probe"));
 }
 
@@ -3088,7 +3174,7 @@ async fn call_tool_allows_direct_mcp_app_ui_callbacks_with_read_scope() {
 }
 
 #[tokio::test]
-async fn app_visible_callbacks_are_hidden_but_directly_callable_with_read_scope() {
+async fn app_visible_callbacks_are_advertised_and_directly_callable_with_read_scope() {
     let upstream_name: Arc<str> = Arc::from("apps");
     let mut standard = fixture_upstream_tool(&upstream_name, "standard_app_callback", None);
     standard.tool.meta = Some(MetaObject(serde_json::Map::from_iter([(
@@ -3131,11 +3217,11 @@ async fn app_visible_callbacks_are_hidden_but_directly_callable_with_read_scope(
         .expect("read-scope tools");
     for name in ["standard_app_callback", "openai_app_callback"] {
         assert!(
-            !advertised
+            advertised
                 .tools
                 .iter()
                 .any(|tool| tool.name.as_ref() == name),
-            "{name} should stay out of the synthetic Code Mode tools/list contract"
+            "{name} should pass through the synthetic Code Mode tools/list contract"
         );
 
         let result = Box::pin(running.service().call_tool_impl(
@@ -3148,7 +3234,7 @@ async fn app_visible_callbacks_are_hidden_but_directly_callable_with_read_scope(
         let text = result.content[0].as_text().expect("text").text.as_str();
         assert!(
             !text.contains("\"kind\":\"forbidden\""),
-            "hidden MCP App callback {name} should pass the direct read-scope bridge gate, got {text}"
+            "advertised MCP App callback {name} should pass the direct read-scope bridge gate, got {text}"
         );
         assert!(
             text.contains("upstream_error"),
@@ -3891,6 +3977,57 @@ async fn call_tool_honors_route_scope_for_mcp_app_sibling_callbacks() {
     );
 }
 
+#[tokio::test]
+#[cfg(feature = "proxy-testkit")]
+async fn list_tools_passes_through_subject_scoped_oauth_mcp_apps_in_code_mode() {
+    let upstream_name: Arc<str> = Arc::from("oauth_apps");
+    let ui_tool = fixture_upstream_tool(
+        &upstream_name,
+        "youtube_search_ui",
+        Some("ui://oauth-apps/youtube-search.html"),
+    );
+    let plain_tool = fixture_upstream_tool(&upstream_name, "youtube_probe", None);
+    let pool = Arc::new(UpstreamPool::new());
+    let upstream = fixture_oauth_upstream_config("oauth_apps");
+    pool.install_test_subject_tools_for_upstream(
+        &upstream,
+        "reader",
+        vec![ui_tool.tool, plain_tool.tool],
+    )
+    .await;
+    let manager = code_mode_manager_with_pool(true, upstream, pool).await;
+    let server = test_server(
+        completion_test_registry(),
+        Some(manager),
+        crate::mcp::route_scope::McpRouteScope::Root,
+        crate::mcp::logging::LoggingLevel::Emergency,
+    );
+    let (transport, _client_transport) = tokio::io::duplex(64 * 1024);
+    let running = rmcp::service::serve_directly::<rmcp::RoleServer, _, _, std::io::Error, _>(
+        server, transport, None,
+    );
+    let context = scoped_context(running.peer().clone(), &["lab"]);
+
+    let contract_tools = running
+        .service()
+        .peer_contract_for_request(&context)
+        .visible_tool_descriptors()
+        .await;
+    let result = running
+        .service()
+        .list_tools_impl(None, context)
+        .await
+        .expect("list subject-scoped OAuth tools");
+    assert_eq!(result.tools, contract_tools);
+    let names = result
+        .tools
+        .iter()
+        .map(|tool| tool.name.as_ref())
+        .collect::<Vec<_>>();
+    assert!(names.contains(&"youtube_search_ui"));
+    assert!(!names.contains(&"youtube_probe"));
+}
+
 #[tokio::test]
 #[cfg(feature = "proxy-testkit")]
 async fn call_tool_uses_subject_scoped_route_for_oauth_mcp_app_sibling_callbacks() {
@@ -5358,7 +5495,10 @@ async fn peer_contracts_diverge_by_route_scope_under_global_code_mode() {
     assert!(code_mode_contract.tools.contains(CODE_MODE_TOOL_NAME));
     assert!(code_mode_contract.tools.contains(CODE_MODE_UI_TOOL_NAME));
     assert!(code_mode_contract.tools.contains(MCP_APP_TOOL_NAME));
-    assert!(!code_mode_contract.tools.contains("youtube_search_ui"));
+    assert!(
+        code_mode_contract.tools.contains("youtube_search_ui"),
+        "upstream MCP App tools pass through under Code Mode"
+    );
     assert!(
         !code_mode_contract.tools.contains("youtube_probe"),
         "raw upstream tools stay hidden under Code Mode"
diff --git a/crates/labby/src/mcp/peer_contract.rs b/crates/labby/src/mcp/peer_contract.rs
index 57536c721..4ba8393fb 100644
--- a/crates/labby/src/mcp/peer_contract.rs
+++ b/crates/labby/src/mcp/peer_contract.rs
@@ -21,10 +21,10 @@ use crate::dispatch::gateway::SHARED_GATEWAY_OAUTH_SUBJECT;
 #[cfg(feature = "gateway")]
 use crate::dispatch::gateway::manager::GatewayManager;
 #[cfg(feature = "gateway")]
-use crate::dispatch::upstream::pool::MAX_UPSTREAM_TOOLS;
-#[cfg(feature = "gateway")]
 use crate::dispatch::upstream::pool::UpstreamPool;
 #[cfg(feature = "gateway")]
+use crate::dispatch::upstream::pool::{MAX_UPSTREAM_TOOLS, mcp_tool_is_mcp_app_host_visible};
+#[cfg(feature = "gateway")]
 use crate::mcp::call_tool_codemode::CodeModeUpstreamDescription;
 #[cfg(feature = "gateway")]
 use crate::mcp::catalog::{
@@ -186,8 +186,8 @@ pub(crate) struct PeerContract {
     pub(crate) gateway_manager: Option<Arc<GatewayManager>>,
     pub(crate) route_scope: McpRouteScope,
     /// Whether the optional `codemode_ui` MCP App surface is advertised. The
-    /// text-only `codemode` executor and always-on `mcp_app` manager never
-    /// depend on the inspector switch.
+    /// text-only `codemode` executor and always-available `mcp_app` control tool
+    /// never depend on the inspector switch.
     pub(crate) code_mode_app_state: CodeModeAppState,
     pub(crate) audience: PeerCatalogAudience,
 }
@@ -436,7 +436,8 @@ impl PeerContract {
 
         #[cfg(feature = "gateway")]
         if self.route_scope.is_root() && self.audience.code_mode_execute_allowed {
-            let tool = self.registry.permanent_tools().mcp_app_tool();
+            let app_visible = self.mcp_apps_config().await.manager;
+            let tool = self.registry.permanent_tools().mcp_app_tool(app_visible);
             advertised_names.insert(MCP_APP_TOOL_NAME.to_string());
             descriptors.push(tool);
         }
@@ -467,11 +468,21 @@ impl PeerContract {
         }
 
         #[cfg(feature = "gateway")]
-        if !hide_raw_tools && let Some(pool) = self.current_upstream_pool().await {
+        if self.route_scope.exposes_tools()
+            && let Some(pool) = self.current_upstream_pool().await
+        {
             let mut upstream_tool_count = 0usize;
-            let upstream_tools = pool
-                .healthy_tools_allowed(self.route_scope.allowed_upstreams())
-                .await;
+            let upstream_tools = if hide_raw_tools {
+                if self.route_scope.exposes_resources() {
+                    pool.healthy_ui_tools_allowed(self.route_scope.allowed_upstreams())
+                        .await
+                } else {
+                    Vec::new()
+                }
+            } else {
+                pool.healthy_tools_allowed(self.route_scope.allowed_upstreams())
+                    .await
+            };
             for upstream_tool in upstream_tools {
                 let name = upstream_tool.tool.name.as_ref();
                 if builtin_names.contains(name) || !advertised_names.insert(name.to_string()) {
@@ -482,13 +493,23 @@ impl PeerContract {
             }
 
             if let Some(subject) = self.audience.oauth_subject.as_deref() {
-                let configs = self.route_scoped_oauth_upstream_configs().await;
+                let mut configs = self.route_scoped_oauth_upstream_configs().await;
+                if hide_raw_tools {
+                    if !self.route_scope.exposes_resources() {
+                        configs.clear();
+                    } else {
+                        configs.retain(|config| config.proxy_resources);
+                    }
+                }
                 let subject_tool_limit = MAX_UPSTREAM_TOOLS.saturating_sub(upstream_tool_count);
                 for (_, tools) in pool
                     .cached_subject_scoped_tools_bounded(&configs, subject, subject_tool_limit)
                     .await
                 {
                     for tool in tools {
+                        if hide_raw_tools && !mcp_tool_is_mcp_app_host_visible(&tool) {
+                            continue;
+                        }
                         let name = tool.name.as_ref();
                         if builtin_names.contains(name)
                             || !advertised_names.insert(name.to_string())
diff --git a/crates/labby/src/mcp/permanent_tools.rs b/crates/labby/src/mcp/permanent_tools.rs
index 693369c86..03d20ea91 100644
--- a/crates/labby/src/mcp/permanent_tools.rs
+++ b/crates/labby/src/mcp/permanent_tools.rs
@@ -261,14 +261,18 @@ impl PermanentToolRegistry {
     /// client-side error in strict SDKs.
     #[cfg(feature = "gateway")]
     #[must_use]
-    pub(crate) fn mcp_app_tool(&self) -> Tool {
-        Tool::new(
+    pub(crate) fn mcp_app_tool(&self, app_visible: bool) -> Tool {
+        let tool = Tool::new(
             MCP_APP_TOOL_NAME,
             mcp_app_tool_description(),
             mcp_app_tool_schema(),
         )
-        .with_annotations(mcp_app_annotations())
-        .with_meta(mcp_app_tool_meta(MCP_APP_TOOL_NAME))
+        .with_annotations(mcp_app_annotations());
+        if app_visible {
+            tool.with_meta(mcp_app_tool_meta(MCP_APP_TOOL_NAME))
+        } else {
+            tool
+        }
     }
 
     /// Descriptor for the Add Server admin app tool.
@@ -592,14 +596,14 @@ mod tests {
         // mcp_app returns `{"kind": "mcp_app_control", …}`, not the dispatch
         // envelope — advertising the envelope schema would be a lie strict
         // clients enforce.
-        assert!(registry.mcp_app_tool().output_schema.is_none());
+        assert!(registry.mcp_app_tool(true).output_schema.is_none());
         // codemode_ui carries the trace schema, not the envelope schema.
         let ui_schema = registry.code_mode_ui_tool(&[]).output_schema;
         assert!(ui_schema.is_some());
         assert_ne!(ui_schema, registry.add_server_tool().output_schema);
 
         let cases = [
-            (registry.mcp_app_tool(), false, false, true, false),
+            (registry.mcp_app_tool(true), false, false, true, false),
             (registry.add_server_tool(), false, true, false, true),
             (registry.gateway_status_tool(), true, false, true, false),
             (registry.code_mode_ui_tool(&[]), false, true, false, true),
@@ -654,7 +658,7 @@ mod tests {
             .map(|service| permanent.builtin_service_tool(service, true))
             .collect();
         descriptors.extend([
-            permanent.mcp_app_tool(),
+            permanent.mcp_app_tool(true),
             permanent.add_server_tool(),
             permanent.gateway_status_tool(),
             permanent.code_mode_descriptor(&[]),
diff --git a/docs/dev/OBSERVABILITY.md b/docs/dev/OBSERVABILITY.md
index bcc59553d..566b66407 100644
--- a/docs/dev/OBSERVABILITY.md
+++ b/docs/dev/OBSERVABILITY.md
@@ -332,7 +332,7 @@ shared by the gateway and MCP crates:
 | `gateway.mcp_apps.set` | Labby-owned MCP App visibility update that did not rebuild the upstream pool |
 | `gateway.enrich.hint_apply` | `gateway.enrich.hint.apply` writing a `code_mode_hint` |
 | `mcp.call.codemode` | post-run catalog delta observed by a `codemode` call |
-| `mcp.call.mcp_app` | Labby-owned MCP App visibility change made through the always-on `mcp_app` manager |
+| `mcp.call.mcp_app` | Labby-owned MCP App visibility change made through the always-available `mcp_app` control tool |
 | `mcp.call.upstream` | post-call catalog delta observed by a raw upstream proxy call |
 | `upstream.subscription` | scoped list-change signal from one live upstream subscription |
 | `upstream.notification_lag` | bounded authoritative catalog reconciliation after the subscription receiver skipped events |
diff --git a/docs/runtime/OAUTH.md b/docs/runtime/OAUTH.md
index 1bf6f4532..688196d89 100644
--- a/docs/runtime/OAUTH.md
+++ b/docs/runtime/OAUTH.md
@@ -839,16 +839,19 @@ instead of one action per upstream tool. `codemode_read` accepts `lab:read`,
 `lab`, or `lab:admin` and can invoke only tools whose live descriptor explicitly
 sets `readOnlyHint: true` without a contradictory `destructiveHint: true`.
 `codemode` and the optional `codemode_ui` require `lab` or `lab:admin` and retain
-full execution authority. On the root gateway, the always-on `mcp_app` manager
-uses the same read/open scopes, while changing Labby-owned app visibility
-requires `lab:admin`. The manager is omitted from protected subset routes so a
-subset-scoped token cannot mutate gateway-global UI visibility.
-
-Those approval-facing descriptors do not embed current upstream names, health,
-hints, or counts. Raw upstream MCP App callback descriptors are not advertised
-while synthetic Code Mode is active. Upstream churn therefore changes the live
-catalog discovered inside `codemode.search(...)` / `codemode.describe(...)`,
-not the OAuth connector's Tool JSON or action set.
+full execution authority. On the root gateway, the always-available `mcp_app`
+control tool uses the same read/open scopes, while changing Labby-owned app
+visibility requires `lab:admin`. Its own manager UI is opt-in like every other
+Labby-owned app surface. The control tool is omitted from protected subset routes
+so a subset-scoped token cannot mutate gateway-global UI visibility.
+
+Synthetic Code Mode keeps ordinary raw upstream tools out of the approval-facing
+catalog, but upstream MCP App host-visible tools and callbacks pass through
+automatically when their upstream is allowed and its resources are proxied.
+Their `_meta.ui` bindings therefore remain usable without turning the whole raw
+upstream catalog back on. Other upstream churn remains discoverable inside
+`codemode.search(...)` / `codemode.describe(...)` without expanding the host
+Tool JSON.
 
 ## Auth Precedence
 
diff --git a/docs/services/GATEWAY.md b/docs/services/GATEWAY.md
index 9848b58c9..2efbb857b 100644
--- a/docs/services/GATEWAY.md
+++ b/docs/services/GATEWAY.md
@@ -210,15 +210,21 @@ Root-gateway clients with `lab` or `lab:admin` also receive the always-on
 `mcp_app` tool bound to `ui://lab/apps/manage`. Its UI is the recovery
 switchboard for Labby's own app surfaces: Code Mode Inspector, Gateway Status,
 Server Logs, and Add Server. Status reads require `lab` or `lab:admin`;
-enable/disable mutations require `lab:admin`. The manager is intentionally not
-advertised on protected subset routes and cannot disable itself.
+enable/disable mutations require `lab:admin`. The `mcp_app` control tool is
+intentionally omitted from protected subset routes. Its own manager UI can be
+disabled, but the text-only control tool remains available on the root gateway.
 
 The Code Mode Inspector keeps its compatibility switch at
 `code_mode.mcp_ui_enabled`. The other visibility switches are
-`mcp_apps.gateway_status`, `mcp_apps.server_logs`, and
-`mcp_apps.add_server`, all defaulting to `true`. App-only mutations persist
-without rebuilding the upstream pool and publish both tool and resource
-list-changed notifications.
+`mcp_apps.manager`, `mcp_apps.gateway_status`, `mcp_apps.server_logs`,
+`mcp_apps.add_server`, and `mcp_apps.settings`. Every Labby-owned app surface
+defaults to `false` and must be explicitly enabled. The `mcp_app` control tool
+remains available without UI metadata so an administrator can inspect or restore
+any app, including its own manager UI. App-only mutations persist without
+rebuilding the upstream pool and publish both tool and resource list-changed
+notifications. Upstream MCP Apps are not governed by these switches: allowed
+upstream MCP-App tools/callbacks, `_meta.ui` metadata, and `ui://` resources pass
+through automatically when that upstream proxies resources.
 
 ### Add Server MCP App
 
diff --git a/docs/surfaces/MCP.md b/docs/surfaces/MCP.md
index e02f2fc41..4a0df546f 100644
--- a/docs/surfaces/MCP.md
+++ b/docs/surfaces/MCP.md
@@ -113,17 +113,21 @@ inspect the current route-scoped tool catalog.
 
 ### Labby MCP App manager
 
-The root gateway also advertises `mcp_app`, an always-on MCP App switchboard
-for Labby's own UI surfaces. It manages `codemode`, `gateway_status`,
-`server_logs`, `add_server`, `settings`, or `all`. The default target remains `codemode` for
-backward compatibility with the original inspector-only control contract.
+The root gateway always advertises the `mcp_app` control tool, but its own MCP
+App UI is opt-in. The tool manages `manager`, `codemode`, `gateway_status`,
+`server_logs`, `add_server`, `settings`, or `all`. Every Labby-owned app surface
+is opt-in and defaults off; the text-only control tool remains available so an
+administrator can enable exactly the surfaces they want, including the manager UI
+itself. The default target remains `codemode` for backward compatibility with the
+original inspector-only control contract.
 
 Reading status or opening the manager requires `lab` or `lab:admin`; changing
-visibility requires `lab:admin`. The manager is intentionally unavailable on
-protected subset routes because these switches mutate gateway-global state, and
-the manager itself cannot be disabled. Changes are persisted and publish both
-`tools/list_changed` and `resources/list_changed` without rebuilding the
-upstream pool.
+visibility requires `lab:admin`. The `mcp_app` control tool is intentionally
+unavailable on protected subset routes because these switches mutate
+gateway-global state, and the control tool itself cannot be disabled. Its UI metadata and `ui://` resource
+can be disabled independently like the other Labby-owned app surfaces. Changes
+are persisted and publish both `tools/list_changed` and
+`resources/list_changed` without rebuilding the upstream pool.
 
 Disabling a surface removes its app tool/metadata and owned `ui://` resources,
 and direct reads of a disabled owned resource fail as unknown. It does not tear
@@ -134,11 +138,12 @@ disabling Settings leaves the underlying `setup` service contract intact. The
 Code Mode inspector retains the existing `code_mode.mcp_ui_enabled` setting;
 the other switches live under `[mcp_apps]`.
 
-Synthetic Code Mode advertises only the fixed Lab-owned UI action surface. It
-does not add or remove raw upstream MCP App tools as upstream health changes.
-An upstream widget returned by a Code Mode call may still render through its
-resource URI, but its raw callback tools are not added to the approval-facing
-`tools/list` contract.
+Synthetic Code Mode keeps ordinary raw upstream tools hidden, but upstream MCP
+Apps pass through automatically. When an allowed upstream proxies resources,
+Labby preserves its MCP-App host-visible tools and callbacks in `tools/list`,
+keeps their `_meta.ui` metadata intact, and proxies their native `ui://`
+resources. This passthrough is independent of the Labby-owned app toggles; route
+allowlists and `proxy_resources = false` still fail closed.
 
 Code Mode may call exposed upstream MCP tools only. Lab actions are not callable
 from inside its sandbox. Large upstream results must be projected or sliced