@adrata/adrata-mcp 1.0.2 → 1.0.6

package/access/tiers.js

@@ -218,22 +218,39 @@ export const TOOL_TIERS = {
   // the tool — only exists on an OAuth token.
   list_my_work_items: TIERS.ENTERPRISE,
   list_work_boards: TIERS.ENTERPRISE,
+  list_source_control_connections: TIERS.ENTERPRISE,
+  get_source_control_connection_events: TIERS.ENTERPRISE,
   get_work_item_delivery_evidence: TIERS.ENTERPRISE,
   audit_work_hub: TIERS.ENTERPRISE,
   list_work_item_acceptance_criteria: TIERS.ENTERPRISE,
+  list_work_item_qa_evidence: TIERS.ENTERPRISE,
   get_work_board: TIERS.ENTERPRISE,
   get_work_item: TIERS.ENTERPRISE,
+  get_work_item_worker_lease: TIERS.ENTERPRISE,
+  get_work_item_worker_activity: TIERS.ENTERPRISE,
+  claim_work_item_qa_pass: TIERS.ENTERPRISE,
+  claim_next_work_item_qa_pass: TIERS.ENTERPRISE,
+  heartbeat_work_item_qa_pass: TIERS.ENTERPRISE,
+  release_work_item_qa_pass: TIERS.ENTERPRISE,
+  record_work_item_qa_failure_and_release: TIERS.ENTERPRISE,
+  requeue_work_item_qa_after_fix: TIERS.ENTERPRISE,
   get_work_item_history: TIERS.ENTERPRISE,
   get_work_item_comments: TIERS.ENTERPRISE,
   get_work_board_rollup: TIERS.ENTERPRISE,
   list_work_board_rollups: TIERS.ENTERPRISE,
   set_work_board_archived: TIERS.ENTERPRISE,
   set_work_board_column_wip_limit: TIERS.ENTERPRISE,
+  attach_work_item_qa_evidence: TIERS.ENTERPRISE,
+  verify_work_item_qa_evidence_playback: TIERS.ENTERPRISE,
   move_work_item: TIERS.ENTERPRISE,
+  transfer_work_item_between_boards: TIERS.ENTERPRISE,
   set_work_item_tag: TIERS.ENTERPRISE,
   set_work_item_kind: TIERS.ENTERPRISE,
   create_work_item: TIERS.ENTERPRISE,
   add_work_item_acceptance_criterion: TIERS.ENTERPRISE,
+  satisfy_work_item_acceptance_criterion: TIERS.ENTERPRISE,
+  record_work_item_criterion_engineering_proof: TIERS.ENTERPRISE,
+  unsatisfy_work_item_acceptance_criterion: TIERS.ENTERPRISE,
   comment_on_work_item: TIERS.ENTERPRISE,
   flag_work_item: TIERS.ENTERPRISE,
   // The containers above the cards, and the "add this to the roadmap" verb.

package/analytics.js

@@ -119,7 +119,6 @@ function ensureDir() {
 }
 
 function readLocalAnalytics() {
-  ensureDir();
   if (!existsSync(ANALYTICS_FILE)) {
     return { events: [], sessions: [] };
   }
@@ -278,6 +277,69 @@ export function trackConversion(apiFn, auth, fromTier, toTier, trigger) {
 /** @type {{ startTime: number, toolsUsed: Set<string>, invocationCount: number } | null} */
 let currentSession = null;
 
+// ---------------------------------------------------------------------------
+// Analytics wrapper coverage
+// ---------------------------------------------------------------------------
+// The analytics counter is a monkey-patch on `server.tool`, so it can only see
+// tools registered AFTER it is installed. That makes its own coverage a fact
+// worth reporting: a zero from an instrumented surface and a zero from an
+// uninstrumented one are different answers, and until 2026-08-29 they were
+// rendered identically. `countedToolNames` is what the wrapper actually
+// wrapped; `get_mcp_analytics` compares it against what the server registered.
+
+/**
+ * Wrapper state belongs to one McpServer instance. Hosted HTTP creates a fresh
+ * server for every protocol session, so a module-global installed flag would
+ * wrap the first client and silently skip every client after it.
+ *
+ * @type {WeakMap<object, { countedToolNames: Set<string> }>}
+ */
+let analyticsWrapperStates = new WeakMap();
+
+/**
+ * How much of the registered tool surface the invocation counter can see.
+ *
+ * @param {object} [server] - McpServer instance, for the registered-tool total
+ * @returns {{installed: boolean, tools_counted: number, tools_registered: number|null, complete: boolean|null, uncounted_note: string|undefined}}
+ */
+export function getAnalyticsCoverage(server) {
+  const registered = registeredToolCount(server);
+  const wrapperState = server && typeof server === 'object'
+    ? analyticsWrapperStates.get(server)
+    : undefined;
+  const counted = wrapperState?.countedToolNames.size ?? 0;
+  const complete = registered === null ? null : counted >= registered;
+  return {
+    installed: wrapperState !== undefined,
+    tools_counted: counted,
+    tools_registered: registered,
+    complete,
+    uncounted_note:
+      complete === false
+        ? `${registered - counted} of ${registered} registered tools were registered before the `
+          + 'analytics wrapper was installed, so their invocations are NOT counted. '
+          + 'Treat tool_invocations as a lower bound, not a measurement.'
+        : undefined,
+  };
+}
+
+/** Best-effort read of the SDK's registered-tool map. Returns null if unavailable. */
+function registeredToolCount(server) {
+  try {
+    const registry = server?._registeredTools;
+    if (registry && typeof registry === 'object') return Object.keys(registry).length;
+  } catch {
+    // The SDK internal is not a contract. An unknown total is reported as
+    // null, never as a number we did not measure.
+  }
+  return null;
+}
+
+/** Test-only: forget that the wrapper was installed. */
+export function __resetAnalyticsWrapperForTests() {
+  analyticsWrapperStates = new WeakMap();
+}
+
 /**
  * Start a new analytics session.
  *
@@ -388,24 +450,43 @@ const SEARCH_TOOLS = {
  * invocation. This builds on top of the existing event logging in memory.js
  * by adding richer analytics (search classification, tier gates, sessions).
  *
- * Must be applied AFTER the event logging wrapper from memory.js.
+ * Must be applied AFTER the event logging wrapper from memory.js, and BEFORE
+ * the first `server.tool(...)` call. Monkey-patching `server.tool` can only
+ * ever reach FUTURE registrations, so installing it late does not degrade the
+ * count — it silently zeroes it. Measured 2026-08-29: installed from
+ * `registerAnalytics` ~1975 lines after the first registration, it covered 27
+ * of 254 tools and `get_mcp_analytics` reported `tool_invocations.total: 0`
+ * with no indication that 89% of the surface was never instrumented.
+ *
+ * Idempotent: calling it twice installs one wrapper, so `registerAnalytics`
+ * remains safe to call after server.js has already installed it early.
+ *
+ * `auth` may be an AUTH object or a zero-argument getter. Prefer the getter:
+ * server.js reassigns AUTH on `connect_workspace`, and an object captured at
+ * install time would report the pre-connection tier forever.
  *
  * @param {object} server - McpServer instance
  * @param {Function} apiFn - The api() helper
- * @param {object} auth - AUTH context
+ * @param {object|Function} auth - AUTH context, or a getter returning it
  * @param {Function} checkToolAccessFn - checkToolAccess from auth.js
  */
 export function wrapWithAnalytics(server, apiFn, auth, checkToolAccessFn) {
   if (!TELEMETRY_ENABLED) return;
+  if (analyticsWrapperStates.has(server)) return;
+  const wrapperState = { countedToolNames: new Set() };
+  analyticsWrapperStates.set(server, wrapperState);
 
+  const resolveAuth = () => (typeof auth === 'function' ? auth() : auth);
   const _analyticsWrappedTool = server.tool.bind(server);
 
   server.tool = function analyticsTool(name, ...rest) {
     const handler = rest[rest.length - 1];
+    wrapperState.countedToolNames.add(name);
     rest[rest.length - 1] = async function analyticsHandler(...handlerArgs) {
       const start = Date.now();
       let success = true;
       let errorMsg = null;
+      const auth = resolveAuth();
 
       // Track tier gate if access was denied (check without modifying flow)
       const access = checkToolAccessFn(name, auth);
@@ -574,16 +655,18 @@ function parsePeriod(period) {
  * @param {object} opts - { z, api, auth, ok, checkToolAccess }
  */
 export function registerAnalytics(server, { z, api, auth, ok, checkToolAccess }) {
+  const resolveAuth = () => (typeof auth === 'function' ? auth() : auth);
+
   // Wire up the analytics wrapper on all future tool registrations
   wrapWithAnalytics(server, api, auth, checkToolAccess);
 
   // Start a session
-  startSession(api, auth);
+  startSession(api, resolveAuth());
 
   // Graceful shutdown: end session on process exit
-  process.on('beforeExit', () => endSession(api, auth));
-  process.on('SIGINT', () => { endSession(api, auth); process.exit(0); });
-  process.on('SIGTERM', () => { endSession(api, auth); process.exit(0); });
+  process.on('beforeExit', () => endSession(api, resolveAuth()));
+  process.on('SIGINT', () => { endSession(api, resolveAuth()); process.exit(0); });
+  process.on('SIGTERM', () => { endSession(api, resolveAuth()); process.exit(0); });
 
   // ----- get_mcp_analytics -----
   server.tool('get_mcp_analytics',
@@ -594,27 +677,65 @@ export function registerAnalytics(server, { z, api, auth, ok, checkToolAccess })
     async (args) => {
       const period = args.period || '7d';
 
-      if (auth.authenticated) {
-        // The MCP surface exposes no dedicated analytics route. The
-        // subscription endpoint carries the server-side usage rollup
-        // (usage.tool_invocations_30d) alongside plan/trial state.
+      // Coverage travels with every answer. `tool_invocations.total: 0` from a
+      // fully instrumented surface means nobody called anything; the same zero
+      // from a surface the wrapper never reached means nothing was measured.
+      // Reporting the second as the first is how this counter read 0 for 227
+      // of 254 tools without anyone noticing.
+      const coverage = getAnalyticsCoverage(server);
+
+      if (resolveAuth().authenticated) {
+        // Authenticated hosted sessions persist invocation rows in the API,
+        // not ~/.adrata. Reading the local dashboard here used to both report
+        // zero and attempt to mkdir /home/adrata/.adrata in the read-only ECS
+        // image. The profile endpoint is the canonical named-tool rollup.
         try {
-          const data = await api('GET', '/api/v1/mcp/subscription');
-          const payload = data?.data || data || {};
+          const profileData = await api('GET', '/api/v1/mcp/profile');
+          const profile = profileData?.data || profileData || {};
+          const stats = profile.stats || {};
+          const topTools = Array.isArray(stats.top_tools)
+            ? stats.top_tools.map((entry) => ({
+                name: entry.name || entry.tool,
+                count: entry.count,
+              }))
+            : [];
+
+          let usage = null;
+          try {
+            const subscriptionData = await api('GET', '/api/v1/mcp/subscription');
+            const subscription = subscriptionData?.data || subscriptionData || {};
+            usage = subscription.usage || null;
+          } catch {
+            // Named invocation analytics remain valid when billing is absent.
+          }
+
           return ok({
             period,
-            server: payload,
-            usage: payload.usage || null,
-            local: getLocalDashboard(period),
+            coverage,
+            source: 'server',
+            server_scope: 'all_time',
+            period_note: 'The server profile currently reports all-time named invocation totals; period applies only to the local fallback.',
+            tool_invocations: {
+              total: Number(stats.total_queries || 0),
+              success: null,
+              errors: null,
+              avg_latency_ms: null,
+              top_tools: topTools,
+            },
+            server: profile,
+            usage,
+            server_events_30d: usage ? usage.tool_invocations_30d : null,
           });
         } catch {
-          // Fallback to local if server endpoint not available
-          return ok(getLocalDashboard(period));
+          // Offline-compatible fallback. readLocalAnalytics does not create a
+          // directory merely to answer an empty read, so this cannot break a
+          // read-only hosted container either.
+          return ok({ ...getLocalDashboard(period), coverage, source: 'local_fallback' });
         }
       }
 
       // Free tier: local analytics only
-      return ok(getLocalDashboard(period));
+      return ok({ ...getLocalDashboard(period), coverage });
     }
   );
 
@@ -627,7 +748,7 @@ export function registerAnalytics(server, { z, api, auth, ok, checkToolAccess })
       trigger: z.string().optional().describe('What triggered the conversion'),
     },
     async (args) => {
-      trackConversion(api, auth, args.from_tier, args.to_tier, args.trigger || 'manual');
+      trackConversion(api, resolveAuth(), args.from_tier, args.to_tier, args.trigger || 'manual');
       return ok({ tracked: true, from: args.from_tier, to: args.to_tier });
     }
   );

package/api-bridge.js

@@ -171,6 +171,14 @@ const ALLOWED_PREFIXES = [
   '/api/v1/retention',
   '/api/v1/revenue',
   '/api/v1/revenue-cloud',
+  // Source control connections and their repository bindings. The board
+  // cannot learn that a pull request merged unless something can create the
+  // connection and register the callback, and until this row existed the
+  // bridge refused every /scm path — so the receiver at /webhooks/scm sat
+  // mounted and reachable with no connection ever pointing at it.
+  // The unauthenticated receiver itself is NOT here: it is mounted below the
+  // auth layer and is not an agent-callable path.
+  '/api/v1/scm',
   '/api/v1/scoring',
   '/api/v1/security',
   '/api/v1/self-service',
@@ -279,6 +287,14 @@ const PATH_WRITE_SCOPES = [
   // All three are listed separately because `matchesPathPrefix` is
   // segment-boundary matched: `/work-boards` does not annex
   // `/work-board-rollups`.
+  // Authorising a source-control account is the same act as connecting a CRM —
+  // an external system permitted to write into the workspace — so scope_guard
+  // maps it onto the integrations family rather than a new one. Deliberately
+  // not an `admin:` scope: those refuse first-party bypass and a human session
+  // JWT carries an empty permission list, which would 403 every person opening
+  // the Connections screen. Mirrors `family_matches(path, "/scm")` in
+  // code/api/crates/middleware/src/scope_guard/mod.rs.
+  ['/api/v1/scm', 'write:integrations'],
   ['/api/v1/work-boards', 'write:tasks'],
   ['/api/v1/work-items', 'write:tasks'],
   ['/api/v1/work-board-rollups', 'write:tasks'],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adrata/adrata-mcp",
-  "version": "1.0.2",
+  "version": "1.0.6",
   "description": "Adrata MCP Server \u2014 connect Claude Code, Codex, Gemini, Cursor, and other AI tools to your CRM. 80+ tools for companies, people, deals, actions, buyer groups, warm intros, webhooks, intelligence, and more.",
   "type": "module",
   "main": "server.js",
@@ -9,7 +9,7 @@
   },
   "scripts": {
     "start": "node server.js",
-    "test": "node --test server.test.js api-bridge.test.js audit-flush.test.js buyer-group-writes.test.js note-writes.test.js mcp-spec.test.js packaging.test.js product-profile.test.js security.test.js tool-annotations.test.js toolsets.test.js access/auth.test.js access/oauth-callback.test.js access/oauth-session.test.js access/oauth-capabilities.test.js scripts/local-dev-server.test.js tools/email-tools.test.js tools/scheduling.test.js tools/work-board-tools.test.js tools/work-hub/audit.test.js tools/roadmap-tools.test.js governance/money.test.js"
+    "test": "node --test analytics.test.js server.test.js api-bridge.test.js audit-flush.test.js buyer-group-writes.test.js note-writes.test.js mcp-spec.test.js packaging.test.js product-profile.test.js security.test.js tool-annotations.test.js toolsets.test.js access/auth.test.js access/oauth-callback.test.js access/oauth-session.test.js access/oauth-capabilities.test.js scripts/local-dev-server.test.js tools/competitive-coverage.test.js tools/email-tools.test.js tools/scheduling.test.js tools/work-board-tools.test.js tools/work-hub/audit.test.js tools/roadmap-tools.test.js tools/source-control/connection-tools.test.js governance/money.test.js"
   },
   "keywords": [
     "mcp",

package/server.js

@@ -50,13 +50,15 @@ import { connectWorkspace, disconnectWorkspace, getConnectionStatus, getValidTok
 import { registerEnterpriseTools } from './tools/enterprise-tools.js';
 import { registerEmailTools } from './tools/email-tools.js';
 import { registerWorkBoardTools } from './tools/work-board-tools.js';
+import { registerSourceControlTools } from './tools/source-control/connection-tools.js';
 import { registerRoadmapTools } from './tools/roadmap-tools.js';
 import { registerPaperTools } from './tools/paper-tools.js';
 import { register as registerAlwaysLoadedTools } from './toolsets/revenue/always-loaded.js';
 import { register as registerExtensibilityTools } from './toolsets/extensibility.js';
 import { registerSpaceTools } from './toolsets/spaces.js';
+import { composeCompetitorIntel, composeCustomerSignals } from './toolsets/revenue/competitive-coverage.js';
 import { getDemoAvailability, scheduleDemo, scheduleMeeting } from './tools/scheduling.js';
-import { registerAnalytics } from './analytics.js';
+import { registerAnalytics, wrapWithAnalytics } from './analytics.js';
 import {
   apiBridgeCatalog,
   buildMutationHeaders,
@@ -131,7 +133,7 @@ async function api(method, path, { params, body, headers: extraHeaders } = {}) {
   const auth = currentAuth();
   assertOAuthIssuerMatchesTarget(auth, API_BASE);
   let currentToken = auth.token;
-  if (auth.source === 'stored') {
+  if (auth.source === 'stored' || auth.source === 'stored_pool') {
     let freshToken;
     try {
       freshToken = await getValidToken(API_BASE);
@@ -177,7 +179,7 @@ async function api(method, path, { params, body, headers: extraHeaders } = {}) {
   };
 
   let res = await request(currentToken);
-  if (res.status === 401 && auth.source === 'stored') {
+  if (res.status === 401 && (auth.source === 'stored' || auth.source === 'stored_pool')) {
     let refreshedToken;
     try {
       refreshedToken = await getValidToken(API_BASE, { forceRefresh: true });
@@ -298,6 +300,7 @@ const moneyWrite = {
  */
 const SERVER_NAME = process.env.ADRATA_MCP_SERVER_NAME?.trim() || '@adrata/adrata-mcp';
 
+function createMcpServer() {
 const server = new McpServer({ name: SERVER_NAME, version: '1.0.0' });
 
 // ---------------------------------------------------------------------------
@@ -367,6 +370,26 @@ wrapWithEventLogging(server, api, AUTH);
 // Must be applied AFTER tier-gating and event logging wrappers above.
 applySecurityLayer(server, currentAuth, api);
 
+// ---------------------------------------------------------------------------
+// Analytics wrapper
+// ---------------------------------------------------------------------------
+// MUST be installed here — after the wrappers above, and BEFORE the first
+// server.tool(...) call below. It monkey-patches `server.tool`, so it can only
+// instrument FUTURE registrations. It used to be installed from
+// registerAnalytics() ~1975 lines further down, which put 227 of the 254 tools
+// this server exposes ahead of it: trackToolInvocation and recordSessionTool
+// could not fire for 89% of the surface, and get_mcp_analytics reported
+// tool_invocations.total: 0 as though it were a measurement.
+//
+// The cost is deliberate and worth naming: every counted invocation now also
+// fire-and-forget POSTs a `tool_invocation` event, roughly doubling the writes
+// on /api/v1/mcp/events (the event-logging wrapper above already posts one per
+// call for the whole surface). ADRATA_TELEMETRY=off disables both.
+//
+// registerAnalytics() still calls this; the wrapper is idempotent, so the later
+// call is a no-op rather than a second layer.
+wrapWithAnalytics(server, api, currentAuth, checkToolAccess);
+
 // ===== WORKSPACE CONNECTION: OAuth 2.0 (available at all tiers) =====
 
 server.tool('connect_workspace',
@@ -381,7 +404,18 @@ server.tool('connect_workspace',
       AUTH = reauthenticate();
       return ok(result);
     } catch (err) {
-      return ok({ error: true, message: err.message, hint: 'Make sure your browser is accessible and try again.' });
+      // `invalid_scope` is not a browser problem, and saying it is costs real
+      // time: it means the authorization server rejected one of the scopes we
+      // asked for, which in practice means the deployed API is running behind
+      // this client. The whole request is refused, so read-only will still
+      // connect — that asymmetry is the tell.
+      const hint = /invalid_scope/.test(err.message ?? '')
+        ? 'The API rejected a requested scope, so it granted nothing — this is NOT a browser problem. '
+          + 'The deployed API is probably behind this client. Compare them: '
+          + 'curl -s ' + API_BASE + '/health | jq -r .build_sha  '
+          + 'Read-only connect_workspace() should still work; use it to keep going.'
+        : 'Make sure your browser is accessible and try again.';
+      return ok({ error: true, message: err.message, hint });
     }
   });
 
@@ -412,7 +446,7 @@ server.tool('workspace_status',
     // answer from a diagnostic: it sends someone to reconnect a connection that
     // was never the problem, and it is the tool a connect flow tells you to run
     // to confirm the setup worked.
-    const usingStoredSession = AUTH.source === 'stored';
+    const usingStoredSession = AUTH.source === 'stored' || AUTH.source === 'stored_pool';
     const stored = await getConnectionStatus(API_BASE);
 
     // AUTH.workspaceId is only populated when the workspace was pinned via env
@@ -452,8 +486,11 @@ server.tool('workspace_status',
       return ok({
         ...stored,
         tier: stored.connected ? AUTH.tier : TIERS.FREE,
-        credential: 'stored OAuth session (~/.adrata/tokens.json)',
+        credential: AUTH.source === 'stored_pool'
+          ? `dedicated OAuth session for named identity pool ${AUTH.identityPool}`
+          : 'stored OAuth session (~/.adrata/tokens.json)',
         authSource: AUTH.source,
+        identityPool: AUTH.identityPool || null,
         apiBase: API_BASE,
         workspaceId,
         workspaceName,
@@ -1756,7 +1793,7 @@ server.tool('get_intent_signals', 'Get buying intent signals for a company.',
 // are workspace-scoped from the token; filter by subject (a company or person),
 // source, signal type, or minimum score, and page with the returned cursor.
 server.tool('list_customer_signals',
-  'List first-party customer signals (the store live plays fire from) for the workspace, or scope to one company/person via subjectType + subjectId. Distinct from get_intent_signals (third-party intent).',
+  'List first-party customer signals (the store live plays fire from) for the workspace, or scope to one company/person via subjectType + subjectId. Distinct from get_intent_signals (third-party intent). Always relay the returned `coverage`: an empty result is checked against the unfiltered workspace, so a real zero is distinguished from a store nothing has ever written to.',
   {
     subjectType: z.enum(['company', 'person']).optional().describe('Scope to a subject kind; pair with subjectId'),
     subjectId: z.string().optional().describe('Company or person ID to scope signals to'),
@@ -1768,11 +1805,31 @@ server.tool('list_customer_signals',
     limit: z.number().optional().describe('Page size (default 50, max 500)'),
     cursor: z.string().optional().describe('Opaque cursor from a previous page'),
   },
-  async (a) => ok(await api('GET', '/api/v1/customer-signals', { params: {
-    subjectType: a.subjectType, subjectId: a.subjectId, source: a.source,
-    signalType: a.signalType, minScore: a.minScore, since: a.since,
-    until: a.until, limit: a.limit || 50, cursor: a.cursor,
-  } })));
+  async (a) => {
+    const filtersApplied = {
+      subjectType: a.subjectType, subjectId: a.subjectId, source: a.source,
+      signalType: a.signalType, minScore: a.minScore, since: a.since, until: a.until,
+    };
+    const payload = await api('GET', '/api/v1/customer-signals', { params: {
+      ...filtersApplied, limit: a.limit || 50, cursor: a.cursor,
+    } });
+
+    // The probe is spent ONLY on the ambiguous case. Rows returned means the store is
+    // demonstrably written to and the count speaks for itself; an empty array is the reading a
+    // seller cannot interpret, and one extra request is what separates "no signals match these
+    // filters" from "nothing has ever been ingested".
+    const empty = Array.isArray(payload?.items) ? payload.items.length === 0 : undefined;
+    let workspaceProbePayload;
+    if (empty === true) {
+      try {
+        workspaceProbePayload = await api('GET', '/api/v1/customer-signals', { params: { limit: 1 } });
+      } catch {
+        workspaceProbePayload = null;
+      }
+    }
+
+    return ok(composeCustomerSignals({ payload, filtersApplied, workspaceProbePayload }));
+  });
 
 server.tool('get_deal_authority', 'Get authority mapping and stakeholder analysis for a deal.',
   { opportunityId: z.string() },
@@ -1781,9 +1838,39 @@ server.tool('get_deal_authority', 'Get authority mapping and stakeholder analysi
     params: { opportunityId: a.opportunityId },
   })));
 
-server.tool('get_competitor_intel', 'Get competitive intelligence for a company.',
+server.tool('get_competitor_intel',
+  'Competitive intelligence for ONE company: the competitor mentions attributed to that account, plus the workspace-wide competitor definitions they are scored against. Always relay the returned `coverage` — it says which half is company-scoped and which is workspace-wide, and states whether a zero is a real zero or an unconfigured store. `/api/v1/competitors` is a workspace configuration list and takes no company filter; the company-scoped evidence lives at `/api/v1/competitors/mentions?companyId=`.',
   { companyId: z.string() },
-  async (a) => ok(await api('GET', `/api/v1/competitors`, { params: { companyId: a.companyId } })));
+  async (a) => {
+    // The definition list is workspace-scoped by construction. Sending `companyId` to it — as
+    // this tool used to — got the parameter silently discarded and returned the same answer for
+    // every company. The two reads are separate because their SCOPES are separate.
+    const definitionsPayload = await api('GET', '/api/v1/competitors');
+
+    let mentionsPayload;
+    let workspaceMentionsPayload;
+    let mentionsUnavailable = false;
+    try {
+      mentionsPayload = await api('GET', '/api/v1/competitors/mentions', {
+        params: { companyId: a.companyId, limit: 50 },
+      });
+      // The denominator. One extra cheap request buys the difference between "this account is
+      // quiet" and "nothing has ever been scanned".
+      workspaceMentionsPayload = await api('GET', '/api/v1/competitors/mentions', {
+        params: { limit: 1 },
+      });
+    } catch {
+      mentionsUnavailable = true;
+    }
+
+    return ok(composeCompetitorIntel({
+      companyId: a.companyId,
+      definitionsPayload,
+      mentionsPayload,
+      workspaceMentionsPayload,
+      mentionsUnavailable,
+    }));
+  });
 
 // ===== ANALYTICS =====
 
@@ -2266,6 +2353,8 @@ registerWorkBoardTools(server, {
   getGrantedScope: () => loadTokens()?.scope,
 });
 
+registerSourceControlTools(server, { z, api, ok });
+
 // The containers above the cards, and the "add this to the roadmap" verb
 // (company/decisions/2026-08-06-spoq-roadmap-sync.md).
 registerRoadmapTools(server, {
@@ -2323,7 +2412,7 @@ server.tool('schedule_meeting',
 // Tracks tool invocations, search queries, tier gates, conversions, sessions.
 // Builds on top of existing event logging — adds classification and dashboards.
 // ADRATA_TELEMETRY=off disables all tracking. PII is hashed before storage.
-registerAnalytics(server, { z, api, auth: AUTH, ok, checkToolAccess });
+registerAnalytics(server, { z, api, auth: currentAuth, ok, checkToolAccess });
 
 // ===== COMPOSITE TOOLSETS =====
 // 42 composite tools organized into 7 toolsets with dynamic discovery.
@@ -2344,6 +2433,9 @@ registerExtensibilityTools(server, api, AUTH);
 // Service" got nothing, while the app answered it fine.
 registerSpaceTools(server, { z, api, ok });
 
+return server;
+}
+
 // ---------------------------------------------------------------------------
 // Start
 // ---------------------------------------------------------------------------
@@ -2353,11 +2445,12 @@ const TRANSPORT_MODE = (process.env.ADRATA_MCP_TRANSPORT || 'stdio').toLowerCase
 if (TRANSPORT_MODE === 'http' || TRANSPORT_MODE === 'sse') {
   // Streamable HTTP transport — single POST /mcp endpoint that can upgrade to SSE
   const { startHttpTransport } = await import('./transport-http.js');
-  await startHttpTransport(server, {
+  await startHttpTransport(createMcpServer, {
     runWithAuthContext,
   });
 } else {
   // Default: stdio transport (backward compatible)
+  const server = createMcpServer();
   const transport = new StdioServerTransport();
   await server.connect(transport);
 }

package/server.json

@@ -3,7 +3,7 @@
   "name": "com.adrata/adrata-mcp",
   "description": "Adrata revenue-intelligence MCP server: companies, people, opportunities, actions, buyer groups, enrichment, email, and workspace operations for AI agents.",
   "status": "active",
-  "version": "1.0.0",
+  "version": "1.0.6",
   "websiteUrl": "https://adrata.com/developers",
   "repository": {
     "url": "https://github.com/adrata/adrata",
@@ -15,7 +15,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@adrata/adrata-mcp",
-      "version": "1.0.0",
+      "version": "1.0.6",
       "transport": {
         "type": "stdio"
       },
@@ -31,6 +31,18 @@
           "description": "Enterprise OAuth 2.1 access token, audience-bound to the Adrata MCP resource (RFC 8707).",
           "isRequired": false,
           "isSecret": true
+        },
+        {
+          "name": "ADRATA_MCP_IDENTITY_POOL",
+          "description": "Optional named worker identity (for example qa1 or qa2). Named pools fail closed and only use their dedicated stored OAuth session.",
+          "isRequired": false,
+          "isSecret": false
+        },
+        {
+          "name": "ADRATA_MCP_CONFIG_DIR",
+          "description": "OAuth storage directory. Required and non-default when ADRATA_MCP_IDENTITY_POOL is set.",
+          "isRequired": false,
+          "isSecret": false
         }
       ]
     }