diff --git a/src/ClaudeDo.Worker/Runner/TaskRunMcpContext.cs b/src/ClaudeDo.Worker/Runner/TaskRunMcpContext.cs
new file mode 100644
index 0000000..e048ea9
--- /dev/null
+++ b/src/ClaudeDo.Worker/Runner/TaskRunMcpContext.cs
@@ -0,0 +1,20 @@
+using Microsoft.AspNetCore.Http;
+
+namespace ClaudeDo.Worker.Runner;
+
+// Per-request caller identity for the task-run MCP surface, populated by the auth
+// middleware from the run's token (mirrors PlanningMcpContext).
+public sealed class TaskRunMcpContext
+{
+    public required string CallerTaskId { get; init; }
+}
+
+public sealed class TaskRunMcpContextAccessor
+{
+    private readonly IHttpContextAccessor _http;
+    public TaskRunMcpContextAccessor(IHttpContextAccessor http) => _http = http;
+
+    public TaskRunMcpContext Current =>
+        (_http.HttpContext?.Items["TaskRunContext"] as TaskRunMcpContext)
+        ?? throw new InvalidOperationException("No task-run context on request.");
+}