diff --git a/deploy/check-shared-libs.sh b/deploy/check-shared-libs.sh
index f294d44..aa8c084 100755
--- a/deploy/check-shared-libs.sh
+++ b/deploy/check-shared-libs.sh
@@ -27,9 +27,12 @@ PEERS=(plugins/dsh-mail-bridge plugins/pi-mail-bridge plugins/zcode-mail-bridge)
 ALL_LIBS="relay-dedup relay-policy relay-key permission-mode bounded inbox-format session-snapshot workspace model-scope catchup addressing discovery rename-proposal permission-grants adopt sse-client user-question attachment-ids"
 ALL_TESTS="relay-policy relay-key permission-mode bounded inbox-format session-snapshot workspace model-scope catchup addressing discovery rename-proposal permission-grants adopt sse-client user-question attachment-ids"
 
-# MCP 工具服务器用到的协议无关子集（实现与测试都同步）。
-MCP_LIBS="addressing inbox-format bounded discovery attachment-ids"
-MCP_TESTS="addressing inbox-format bounded discovery attachment-ids"
+# MCP 工具服务器 + 授权钩子用到的子集（实现与测试都同步）。
+# 钩子这一层额外需要 permission-mode / relay-key / permission-grants / sse-client ——
+# 档位语义、relay_key 截断、决策判定与 SSE 帧解析都必须与三桥同源，
+# 否则「同意」的含义会在 ZCode 上悄悄变得不一样。
+MCP_LIBS="addressing inbox-format bounded discovery attachment-ids permission-mode relay-key permission-grants sse-client"
+MCP_TESTS="addressing inbox-format bounded discovery attachment-ids permission-mode relay-key permission-grants sse-client"
 
 # ── 判据：用 cmp，不用 diff ─────────────────────────────────────────
 #