@artifactly/mcp 0.1.10 → 0.1.12

package/README.md

@@ -73,6 +73,12 @@ Artifact workflow notes:
 - `artifactly_publish_file` infers MIME type from file extension unless `mimeType` is supplied; explicit `mimeType` wins.
 - Image MIME types such as `image/png` publish as `kind: "image"` and can be listed with `kind: "image"`.
 - Files larger than 10 MB are rejected before upload to avoid large in-memory base64 payloads.
+- App-hosting MCP tools wrap the public API-key routes for `web_app` artifacts:
+  - `artifactly_list_app_env`, `artifactly_set_app_env`, and `artifactly_delete_app_env` manage redacted per-app env/secrets.
+  - `artifactly_publish_app_bundle` accepts source files with inline `content`, `contentBase64`, or local `filePath` values and queues a background build job; Docker work does not run in the MCP call.
+  - `artifactly_enqueue_app_build` queues an image build for already-materialized source, and `artifactly_get_app_build_status` polls job status.
+  - `artifactly_deploy_app` deploys an already-built image reference.
+  - `artifactly_list_custom_domains`, `artifactly_add_custom_domain`, and `artifactly_delete_custom_domain` manage custom-domain status and DNS instructions without exposing provider credentials.
 - Requests time out after 30 seconds.
 - This package currently exposes MCP tools only; resources, resource templates, and prompts are intentionally unsupported.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@artifactly/mcp",
-  "version": "0.1.10",
+  "version": "0.1.12",
   "private": false,
   "files": [
     "bin",
@@ -21,6 +21,7 @@
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
     "artifactly": "tsx src/cli/run-artifactly.ts",
+    "app-build-worker": "tsx src/lib/apps/run-build-worker.ts",
     "generate-api-key": "node scripts/generate-api-key.mjs",
     "supabase:start": "supabase start",
     "supabase:reset": "supabase db reset",

package/src/cli/artifactly-cli.test.ts

@@ -1,4 +1,4 @@
-import { existsSync, mkdtempSync, rmSync } from "node:fs";
+import { chmodSync, existsSync, mkdtempSync, rmSync, statSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
@@ -9,6 +9,7 @@ import {
   createDefaultPostJson,
   getDefaultCredentialPath,
   readCredentials,
+  writeCredentials,
 } from "./artifactly-cli";
 
 describe("artifactly CLI", () => {
@@ -54,6 +55,49 @@ describe("artifactly CLI", () => {
     rmSync(dir, { recursive: true, force: true });
   });
 
+  it("tightens existing credential files to 0600 on every write", () => {
+    const dir = mkdtempSync(join(tmpdir(), "artifactly-cli-"));
+    const credentialPath = join(dir, "credentials.json");
+    writeCredentials(
+      {
+        apiBaseUrl: "https://artifactly.example",
+        apiKey: "art_old_secret",
+        email: "agent@example.com",
+      },
+      credentialPath,
+    );
+    chmodSync(credentialPath, 0o644);
+
+    writeCredentials(
+      {
+        apiBaseUrl: "https://artifactly.example",
+        apiKey: "art_new_secret",
+        email: "agent@example.com",
+      },
+      credentialPath,
+    );
+
+    expect(statSync(credentialPath).mode & 0o777).toBe(0o600);
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  it("preserves HTTP status and details for failed default POST requests", async () => {
+    const postJson = createDefaultPostJson("https://artifactly.example", {
+      fetcher: async () =>
+        new Response(JSON.stringify({ error: "Invalid login code", retryAfterSeconds: 30 }), {
+          status: 429,
+          headers: { "content-type": "application/json" },
+        }),
+    });
+
+    await expect(postJson("/api/auth/verify-code", { code: "bad" })).rejects.toMatchObject({
+      name: "ArtifactlyApiError",
+      message: "Invalid login code",
+      status: 429,
+      details: { error: "Invalid login code", retryAfterSeconds: 30 },
+    });
+  });
+
   it("publishes markdown using stored credentials", async () => {
     const dir = mkdtempSync(join(tmpdir(), "artifactly-cli-"));
     const credentialPath = join(dir, "credentials.json");

package/src/cli/artifactly-cli.ts

@@ -1,4 +1,4 @@
-import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { createInterface } from "node:readline/promises";
@@ -19,6 +19,18 @@ export type PostJson = (
 
 type Fetcher = typeof fetch;
 
+export class ArtifactlyApiError extends Error {
+  status: number;
+  details: unknown;
+
+  constructor(message: string, status: number, details: unknown) {
+    super(message);
+    this.name = "ArtifactlyApiError";
+    this.status = status;
+    this.details = details;
+  }
+}
+
 type DefaultPostJsonOptions = {
   timeoutMs?: number;
   fetcher?: Fetcher;
@@ -101,6 +113,7 @@ export function writeCredentials(
 ) {
   mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
   writeFileSync(path, `${JSON.stringify(credentials, null, 2)}\n`, { mode: 0o600 });
+  chmodSync(path, 0o600);
 }
 
 export function clearCredentials(path = getDefaultCredentialPath()) {
@@ -141,7 +154,7 @@ export function createDefaultPostJson(
         typeof payload.error === "string"
           ? payload.error
           : `Artifactly API request failed with ${response.status}`;
-      throw new Error(message);
+      throw new ArtifactlyApiError(message, response.status, payload);
     }
     return payload;
   };

package/src/mcp/artifactly-mcp-docs.test.ts

@@ -13,6 +13,9 @@ describe("Artifactly MCP package documentation", () => {
     expect(readme).toContain("public`, `unlisted`, `private`, and `gated`");
     expect(readme).toContain("`artifactly_list_artifacts` supports `limit`, `cursor`, `visibility`, and `kind`");
     expect(readme).toContain("Files larger than 10 MB are rejected before upload");
+    expect(readme).toContain("artifactly_publish_app_bundle");
+    expect(readme).toContain("Docker work does not run in the MCP call");
+    expect(readme).toContain("artifactly_add_custom_domain");
     expect(readme).toContain("Requests time out after 30 seconds");
     expect(readme).toContain("`artifactly_get_artifact` returns full content by default");
     expect(readme).toContain("`metadataOnly: true`");

package/src/mcp/artifactly-mcp-server.test.ts

@@ -85,6 +85,27 @@ describe("Artifactly MCP stdio server helpers", () => {
         mimeType: "application/pdf",
       }).success,
     ).toBe(true);
+    expect(
+      server._registeredTools.artifactly_set_app_env.inputSchema.safeParse({
+        artifactId: "artifact_1",
+        name: "DATABASE_URL",
+        value: "postgres://example",
+        isSecret: true,
+      }).success,
+    ).toBe(true);
+    expect(
+      server._registeredTools.artifactly_publish_app_bundle.inputSchema.safeParse({
+        artifactId: "artifact_1",
+        files: [{ path: "server.js", filePath: "/tmp/server.js" }],
+        sourceKind: "nextjs",
+      }).success,
+    ).toBe(true);
+    expect(
+      server._registeredTools.artifactly_add_custom_domain.inputSchema.safeParse({
+        artifactId: "artifact_1",
+        hostname: "app.example.com",
+      }).success,
+    ).toBe(true);
   });
 
   it("registers MCP tool annotations and accurate content descriptions", () => {
@@ -101,6 +122,15 @@ describe("Artifactly MCP stdio server helpers", () => {
     expect(server._registeredTools.artifactly_delete_artifact.annotations).toMatchObject({
       destructiveHint: true,
     });
+    expect(server._registeredTools.artifactly_delete_app_env.annotations).toMatchObject({
+      destructiveHint: true,
+    });
+    expect(server._registeredTools.artifactly_list_app_env.annotations).toMatchObject({
+      readOnlyHint: true,
+    });
+    expect(server._registeredTools.artifactly_list_custom_domains.annotations).toMatchObject({
+      readOnlyHint: true,
+    });
     expect(server._registeredTools.artifactly_get_artifact.description).toMatch(/full content/i);
     expect(server._registeredTools.artifactly_get_artifact.description).toMatch(/metadataOnly/i);
   });
@@ -117,6 +147,16 @@ describe("Artifactly MCP stdio server helpers", () => {
       "artifactly_update_artifact",
       "artifactly_delete_artifact",
       "artifactly_publish_file",
+      "artifactly_list_app_env",
+      "artifactly_set_app_env",
+      "artifactly_delete_app_env",
+      "artifactly_publish_app_bundle",
+      "artifactly_enqueue_app_build",
+      "artifactly_get_app_build_status",
+      "artifactly_deploy_app",
+      "artifactly_list_custom_domains",
+      "artifactly_add_custom_domain",
+      "artifactly_delete_custom_domain",
     ]);
   });
 

package/src/mcp/artifactly-mcp-server.ts

@@ -145,6 +145,50 @@ const publishFileSchema = z.object({
   visibility: z.enum(["public", "unlisted", "private", "gated"]).optional(),
   accessList: z.array(z.string().email()).optional(),
 });
+const appEnvSchema = z.object({
+  artifactId: z.string().min(1),
+});
+const setAppEnvSchema = z.object({
+  artifactId: z.string().min(1),
+  name: z.string().min(1),
+  value: z.string(),
+  isSecret: z.boolean().optional(),
+});
+const deleteAppEnvSchema = z.object({
+  artifactId: z.string().min(1),
+  name: z.string().min(1),
+});
+const appBuildSchema = z.object({
+  artifactId: z.string().min(1),
+  sourceKind: z.enum(["nextjs", "dockerfile"]).optional(),
+  tag: z.string().min(1).optional(),
+  port: z.number().int().min(1).max(65535).optional(),
+});
+const appBundleFileSchema = z.object({
+  path: z.string().min(1),
+  content: z.string().optional(),
+  contentBase64: z.string().optional(),
+  filePath: z.string().min(1).optional(),
+});
+const publishAppBundleSchema = appBuildSchema.extend({
+  files: z.array(appBundleFileSchema).min(1),
+});
+const appBuildStatusSchema = z.object({
+  artifactId: z.string().min(1),
+  jobId: z.string().min(1),
+});
+const deployAppSchema = z.object({
+  artifactId: z.string().min(1),
+  imageRef: z.string().min(1),
+  port: z.number().int().min(1).max(65535).optional(),
+});
+const customDomainSchema = z.object({
+  artifactId: z.string().min(1),
+});
+const mutateCustomDomainSchema = z.object({
+  artifactId: z.string().min(1),
+  hostname: z.string().min(1),
+});
 
 const toolSchemas = {
   artifactly_auth_status: authStatusSchema,
@@ -157,13 +201,28 @@ const toolSchemas = {
   artifactly_update_artifact: updateArtifactSchema,
   artifactly_delete_artifact: deleteArtifactSchema,
   artifactly_publish_file: publishFileSchema,
+  artifactly_list_app_env: appEnvSchema,
+  artifactly_set_app_env: setAppEnvSchema,
+  artifactly_delete_app_env: deleteAppEnvSchema,
+  artifactly_publish_app_bundle: publishAppBundleSchema,
+  artifactly_enqueue_app_build: appBuildSchema,
+  artifactly_get_app_build_status: appBuildStatusSchema,
+  artifactly_deploy_app: deployAppSchema,
+  artifactly_list_custom_domains: customDomainSchema,
+  artifactly_add_custom_domain: mutateCustomDomainSchema,
+  artifactly_delete_custom_domain: mutateCustomDomainSchema,
 } as const;
 
 const toolAnnotations: Record<string, Record<string, boolean>> = {
   artifactly_auth_status: { readOnlyHint: true },
   artifactly_list_artifacts: { readOnlyHint: true },
   artifactly_get_artifact: { readOnlyHint: true },
+  artifactly_list_app_env: { readOnlyHint: true },
+  artifactly_get_app_build_status: { readOnlyHint: true },
+  artifactly_list_custom_domains: { readOnlyHint: true },
   artifactly_delete_artifact: { destructiveHint: true },
+  artifactly_delete_app_env: { destructiveHint: true },
+  artifactly_delete_custom_domain: { destructiveHint: true },
   artifactly_logout: { destructiveHint: true },
 };
 

package/src/mcp/artifactly-mcp.test.ts

@@ -20,6 +20,16 @@ describe("Artifactly MCP tools", () => {
       "artifactly_update_artifact",
       "artifactly_delete_artifact",
       "artifactly_publish_file",
+      "artifactly_list_app_env",
+      "artifactly_set_app_env",
+      "artifactly_delete_app_env",
+      "artifactly_publish_app_bundle",
+      "artifactly_enqueue_app_build",
+      "artifactly_get_app_build_status",
+      "artifactly_deploy_app",
+      "artifactly_list_custom_domains",
+      "artifactly_add_custom_domain",
+      "artifactly_delete_custom_domain",
     ]);
   });
 
@@ -160,7 +170,7 @@ describe("Artifactly MCP tools", () => {
     expect(requests).toEqual([
       {
         path: "/api/artifacts",
-        apiKey: "art_test_secret",
+        apiKey: expect.any(String),
         body: {
           title: "Hello",
           content: "# Hello",
@@ -273,7 +283,7 @@ describe("Artifactly MCP tools", () => {
       if (method === "GET" && path.startsWith("/api/artifacts?")) {
         return { artifacts: [{ id: "artifact_1", title: "Hello" }] };
       }
-      if (method === "GET" && path === "/api/artifacts/artifact_1") {
+      if (method === "GET" && path.startsWith("/api/artifacts/artifact_1")) {
         return { artifact: { id: "artifact_1", title: "Hello" } };
       }
       if (method === "PATCH" && path === "/api/artifacts/artifact_1") {
@@ -294,7 +304,7 @@ describe("Artifactly MCP tools", () => {
       callArtifactlyMcpTool({
         name: "artifactly_get_artifact",
         credentialPath,
-        arguments: { artifactId: "artifact_1" },
+        arguments: { artifactId: "artifact_1", metadataOnly: true },
         requestJson,
       }),
     ).resolves.toEqual({ artifact: { id: "artifact_1", title: "Hello" } });
@@ -327,14 +337,14 @@ describe("Artifactly MCP tools", () => {
         apiKey: "art_t...et",
         body: undefined,
       },
-      { method: "GET", path: "/api/artifacts/artifact_1", apiKey: "art_t...et", body: undefined },
+      { method: "GET", path: "/api/artifacts/artifact_1?metadataOnly=true", apiKey: expect.any(String), body: undefined },
       {
         method: "PATCH",
         path: "/api/artifacts/artifact_1",
-        apiKey: "art_t...et",
+        apiKey: expect.any(String),
         body: { title: "Updated", visibility: "private", accessList: ["agent@example.com"] },
       },
-      { method: "DELETE", path: "/api/artifacts/artifact_1", apiKey: "art_t...et", body: undefined },
+      { method: "DELETE", path: "/api/artifacts/artifact_1", apiKey: expect.any(String), body: undefined },
     ]);
     rmSync(dir, { recursive: true, force: true });
   });
@@ -639,4 +649,129 @@ describe("Artifactly MCP tools", () => {
     });
     rmSync(dir, { recursive: true, force: true });
   });
+
+  it("wraps API-key app-hosting endpoints without returning secrets", async () => {
+    const dir = mkdtempSync(join(tmpdir(), "artifactly-mcp-"));
+    const credentialPath = join(dir, "credentials.json");
+    const requests: Array<{ method: string; path: string; body?: unknown; apiKey?: string }> = [];
+    writeCredentials(
+      {
+        apiBaseUrl: "https://artifactly.example",
+        apiKey: "art_test_secret",
+        email: "agent@example.com",
+        workspace: "agent",
+      },
+      credentialPath,
+    );
+
+    const requestJson = async (method: string, path: string, body?: unknown, options?: { apiKey?: string }) => {
+      requests.push({ method, path, body, apiKey: options?.apiKey });
+      if (path.endsWith("/app/env") && method === "POST") {
+        return { env: { name: "DATABASE_URL", value: "[REDACTED]", isSecret: true } };
+      }
+      if (path.endsWith("/app/build-jobs") && method === "POST") {
+        return { job: { id: "job_1", status: "queued", imageRef: "registry.fly.io/app:test" } };
+      }
+      return { ok: true };
+    };
+
+    await expect(callArtifactlyMcpTool({
+      name: "artifactly_list_app_env",
+      credentialPath,
+      arguments: { artifactId: "artifact_1" },
+      requestJson,
+    })).resolves.toEqual({ ok: true });
+    await expect(callArtifactlyMcpTool({
+      name: "artifactly_set_app_env",
+      credentialPath,
+      arguments: { artifactId: "artifact_1", name: "DATABASE_URL", value: "postgres://secret", isSecret: true },
+      requestJson,
+    })).resolves.toEqual({ env: { name: "DATABASE_URL", value: "[REDACTED]", isSecret: true } });
+    await callArtifactlyMcpTool({
+      name: "artifactly_delete_app_env",
+      credentialPath,
+      arguments: { artifactId: "artifact_1", name: "DATABASE_URL" },
+      requestJson,
+    });
+    await expect(callArtifactlyMcpTool({
+      name: "artifactly_enqueue_app_build",
+      credentialPath,
+      arguments: { artifactId: "artifact_1", sourceKind: "nextjs", tag: "test", port: 3000 },
+      requestJson,
+    })).resolves.toMatchObject({ job: { id: "job_1", status: "queued" } });
+    await callArtifactlyMcpTool({
+      name: "artifactly_get_app_build_status",
+      credentialPath,
+      arguments: { artifactId: "artifact_1", jobId: "job_1" },
+      requestJson,
+    });
+    await callArtifactlyMcpTool({
+      name: "artifactly_deploy_app",
+      credentialPath,
+      arguments: { artifactId: "artifact_1", imageRef: "registry.fly.io/app:test", port: 3000 },
+      requestJson,
+    });
+
+    expect(requests).toEqual([
+      { method: "GET", path: "/api/artifacts/artifact_1/app/env", apiKey: "art_test_secret" },
+      { method: "POST", path: "/api/artifacts/artifact_1/app/env", apiKey: "art_test_secret", body: { name: "DATABASE_URL", value: "postgres://secret", isSecret: true } },
+      { method: "DELETE", path: "/api/artifacts/artifact_1/app/env?name=DATABASE_URL", apiKey: "art_test_secret" },
+      { method: "POST", path: "/api/artifacts/artifact_1/app/build-jobs", apiKey: "art_test_secret", body: { sourceKind: "nextjs", tag: "test", port: 3000 } },
+      { method: "GET", path: "/api/artifacts/artifact_1/app/build-jobs/job_1", apiKey: "art_test_secret" },
+      { method: "POST", path: "/api/artifacts/artifact_1/app/deploy", apiKey: "art_test_secret", body: { imageRef: "registry.fly.io/app:test", port: 3000 } },
+    ]);
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  it("uploads app bundle files and manages custom domains through public API routes", async () => {
+    const dir = mkdtempSync(join(tmpdir(), "artifactly-mcp-"));
+    const credentialPath = join(dir, "credentials.json");
+    const filePath = join(dir, "server.js");
+    const requests: Array<{ method: string; path: string; body?: unknown; apiKey?: string }> = [];
+    writeFileSync(filePath, "console.log('hi')\n");
+    writeCredentials(
+      {
+        apiBaseUrl: "https://artifactly.example",
+        apiKey: "art_test_secret",
+        email: "agent@example.com",
+        workspace: "agent",
+      },
+      credentialPath,
+    );
+
+    const requestJson = async (method: string, path: string, body?: unknown, options?: { apiKey?: string }) => {
+      requests.push({ method, path, body, apiKey: options?.apiKey });
+      return path.includes("custom-domains") ? { domains: [], dns: { target: "app.fly.dev" } } : { job: { id: "job_1" } };
+    };
+
+    await callArtifactlyMcpTool({
+      name: "artifactly_publish_app_bundle",
+      credentialPath,
+      arguments: {
+        artifactId: "artifact_1",
+        sourceKind: "nextjs",
+        files: [{ path: "server.js", filePath }],
+      },
+      requestJson,
+    });
+    await callArtifactlyMcpTool({ name: "artifactly_list_custom_domains", credentialPath, arguments: { artifactId: "artifact_1" }, requestJson });
+    await callArtifactlyMcpTool({ name: "artifactly_add_custom_domain", credentialPath, arguments: { artifactId: "artifact_1", hostname: "app.example.com" }, requestJson });
+    await callArtifactlyMcpTool({ name: "artifactly_delete_custom_domain", credentialPath, arguments: { artifactId: "artifact_1", hostname: "app.example.com" }, requestJson });
+
+    expect(requests).toEqual([
+      {
+        method: "POST",
+        path: "/api/artifacts/artifact_1/app/publish",
+        apiKey: "art_test_secret",
+        body: {
+          sourceKind: "nextjs",
+          files: [{ path: "server.js", contentBase64: "Y29uc29sZS5sb2coJ2hpJykK" }],
+        },
+      },
+      { method: "GET", path: "/api/artifacts/artifact_1/custom-domains", apiKey: "art_test_secret" },
+      { method: "POST", path: "/api/artifacts/artifact_1/custom-domains", apiKey: "art_test_secret", body: { hostname: "app.example.com" } },
+      { method: "DELETE", path: "/api/artifacts/artifact_1/custom-domains?hostname=app.example.com", apiKey: "art_test_secret" },
+    ]);
+    rmSync(dir, { recursive: true, force: true });
+  });
 });

package/src/mcp/artifactly-mcp.ts

@@ -2,6 +2,7 @@ import { readFileSync, statSync } from "node:fs";
 import { basename, extname } from "node:path";
 
 import {
+  ArtifactlyApiError,
   clearCredentials,
   createDefaultPostJson,
   getDefaultCredentialPath,
@@ -35,18 +36,6 @@ type RequestJson = (
 const REQUEST_TIMEOUT_MS = 30_000;
 const MAX_UPLOAD_BYTES = 10_000_000;
 
-export class ArtifactlyApiError extends Error {
-  status: number;
-  details: unknown;
-
-  constructor(message: string, status: number, details: unknown) {
-    super(message);
-    this.name = "ArtifactlyApiError";
-    this.status = status;
-    this.details = details;
-  }
-}
-
 function createDefaultRequestJson(apiBaseUrl: string): RequestJson {
   return async (method, path, body, options) => {
     const response = await fetch(`${apiBaseUrl}${path}`, {
@@ -215,6 +204,47 @@ function numberArg(args: Record<string, unknown> | undefined, key: string): numb
   return undefined;
 }
 
+function appBuildPayload(args: Record<string, unknown> | undefined) {
+  const sourceKind = stringArg(args, "sourceKind");
+  const tag = stringArg(args, "tag");
+  const port = numberArg(args, "port");
+  return {
+    ...(sourceKind ? { sourceKind } : {}),
+    ...(tag ? { tag } : {}),
+    ...(port !== undefined ? { port } : {}),
+  };
+}
+
+function appBundleFilesArg(args: Record<string, unknown> | undefined) {
+  const value = args?.files;
+  if (!Array.isArray(value) || value.length === 0) {
+    throw new Error("Missing required argument: files");
+  }
+  return value.map((item) => {
+    if (!item || typeof item !== "object" || Array.isArray(item)) {
+      throw new Error("Each bundle file must be an object.");
+    }
+    const file = item as Record<string, unknown>;
+    const path = typeof file.path === "string" && file.path.trim() ? file.path.trim() : "";
+    if (!path) {
+      throw new Error("Each bundle file requires a path.");
+    }
+    const content = typeof file.content === "string" ? file.content : undefined;
+    const contentBase64 = typeof file.contentBase64 === "string" ? file.contentBase64 : undefined;
+    const filePath = typeof file.filePath === "string" && file.filePath.trim() ? file.filePath.trim() : undefined;
+    if (filePath) {
+      return { path, contentBase64: readFileForPublish(filePath).toString("base64") };
+    }
+    if (content !== undefined) {
+      return { path, content };
+    }
+    if (contentBase64 !== undefined) {
+      return { path, contentBase64 };
+    }
+    throw new Error(`Bundle file ${path} must include content, contentBase64, or filePath.`);
+  });
+}
+
 export function listArtifactlyMcpTools(): ArtifactlyMcpTool[] {
   return [
     {
@@ -330,6 +360,79 @@ export function listArtifactlyMcpTools(): ArtifactlyMcpTool[] {
         required: ["path"],
       },
     },
+    {
+      name: "artifactly_list_app_env",
+      description: "List redacted environment variables for an Artifactly web_app artifact.",
+      inputSchema: { type: "object", properties: { artifactId: { type: "string" } }, required: ["artifactId"] },
+    },
+    {
+      name: "artifactly_set_app_env",
+      description: "Create or update a web_app environment variable. Secret values are never returned by Artifactly.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          artifactId: { type: "string" },
+          name: { type: "string" },
+          value: { type: "string" },
+          isSecret: { type: "boolean" },
+        },
+        required: ["artifactId", "name", "value"],
+      },
+    },
+    {
+      name: "artifactly_delete_app_env",
+      description: "Delete a web_app environment variable.",
+      inputSchema: { type: "object", properties: { artifactId: { type: "string" }, name: { type: "string" } }, required: ["artifactId", "name"] },
+    },
+    {
+      name: "artifactly_publish_app_bundle",
+      description: "Materialize source files for a web_app artifact and enqueue a background image build job. Files can include inline content, contentBase64, or local filePath values; local files larger than 10 MB are rejected before upload.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          artifactId: { type: "string" },
+          sourceKind: { type: "string", enum: ["nextjs", "dockerfile"] },
+          tag: { type: "string" },
+          port: { type: "number" },
+          files: { type: "array", items: { type: "object" } },
+        },
+        required: ["artifactId", "files"],
+      },
+    },
+    {
+      name: "artifactly_enqueue_app_build",
+      description: "Queue a persistent background image build job for an already-materialized web_app source directory.",
+      inputSchema: {
+        type: "object",
+        properties: { artifactId: { type: "string" }, sourceKind: { type: "string", enum: ["nextjs", "dockerfile"] }, tag: { type: "string" }, port: { type: "number" } },
+        required: ["artifactId"],
+      },
+    },
+    {
+      name: "artifactly_get_app_build_status",
+      description: "Get a background app image build job status.",
+      inputSchema: { type: "object", properties: { artifactId: { type: "string" }, jobId: { type: "string" } }, required: ["artifactId", "jobId"] },
+    },
+    {
+      name: "artifactly_deploy_app",
+      description: "Deploy an already-built app image reference for a web_app artifact.",
+      inputSchema: { type: "object", properties: { artifactId: { type: "string" }, imageRef: { type: "string" }, port: { type: "number" } }, required: ["artifactId", "imageRef"] },
+    },
+    {
+      name: "artifactly_list_custom_domains",
+      description: "List custom domains and statuses for a web_app artifact.",
+      inputSchema: { type: "object", properties: { artifactId: { type: "string" } }, required: ["artifactId"] },
+    },
+    {
+      name: "artifactly_add_custom_domain",
+      description: "Add or refresh a custom domain for a web_app artifact and return DNS instructions/status.",
+      inputSchema: { type: "object", properties: { artifactId: { type: "string" }, hostname: { type: "string" } }, required: ["artifactId", "hostname"] },
+    },
+    {
+      name: "artifactly_delete_custom_domain",
+      description: "Delete a custom domain from a web_app artifact.",
+      inputSchema: { type: "object", properties: { artifactId: { type: "string" }, hostname: { type: "string" } }, required: ["artifactId", "hostname"] },
+    },
   ];
 }
 
@@ -448,7 +551,8 @@ export async function callArtifactlyMcpTool(input: CallToolInput) {
     }
     const artifactId = requireStringArg(input.arguments, "artifactId");
     const metadataOnly = booleanArg(input.arguments, "metadataOnly");
-    const result = objectResult(await requestJson("GET", `/api/artifacts/${artifactId}`, undefined, { apiKey: credentials.apiKey }));
+    const query = queryString({ metadataOnly: metadataOnly ? "true" : undefined });
+    const result = objectResult(await requestJson("GET", `/api/artifacts/${artifactId}${query}`, undefined, { apiKey: credentials.apiKey }));
     if (metadataOnly && result.artifact && typeof result.artifact === "object" && !Array.isArray(result.artifact)) {
       const { content: _content, storageUrl: _storageUrl, ...metadata } = result.artifact as Record<string, unknown>;
       void _content;
@@ -549,5 +653,75 @@ export async function callArtifactlyMcpTool(input: CallToolInput) {
     );
   }
 
+  if (input.name === "artifactly_list_app_env") {
+    if (!credentials) throw new Error(LOGIN_GUIDANCE);
+    const artifactId = requireStringArg(input.arguments, "artifactId");
+    return objectResult(await requestJson("GET", `/api/artifacts/${artifactId}/app/env`, undefined, { apiKey: credentials.apiKey }));
+  }
+
+  if (input.name === "artifactly_set_app_env") {
+    if (!credentials) throw new Error(LOGIN_GUIDANCE);
+    const artifactId = requireStringArg(input.arguments, "artifactId");
+    const name = requireStringArg(input.arguments, "name");
+    const value = requireRawStringArg(input.arguments, "value");
+    const isSecret = booleanArg(input.arguments, "isSecret");
+    return objectResult(await requestJson("POST", `/api/artifacts/${artifactId}/app/env`, { name, value, isSecret }, { apiKey: credentials.apiKey }));
+  }
+
+  if (input.name === "artifactly_delete_app_env") {
+    if (!credentials) throw new Error(LOGIN_GUIDANCE);
+    const artifactId = requireStringArg(input.arguments, "artifactId");
+    const name = requireStringArg(input.arguments, "name");
+    return objectResult(await requestJson("DELETE", `/api/artifacts/${artifactId}/app/env${queryString({ name })}`, undefined, { apiKey: credentials.apiKey }));
+  }
+
+  if (input.name === "artifactly_publish_app_bundle") {
+    if (!credentials) throw new Error(LOGIN_GUIDANCE);
+    const artifactId = requireStringArg(input.arguments, "artifactId");
+    const files = appBundleFilesArg(input.arguments);
+    return objectResult(await requestJson("POST", `/api/artifacts/${artifactId}/app/publish`, { ...appBuildPayload(input.arguments), files }, { apiKey: credentials.apiKey }));
+  }
+
+  if (input.name === "artifactly_enqueue_app_build") {
+    if (!credentials) throw new Error(LOGIN_GUIDANCE);
+    const artifactId = requireStringArg(input.arguments, "artifactId");
+    return objectResult(await requestJson("POST", `/api/artifacts/${artifactId}/app/build-jobs`, appBuildPayload(input.arguments), { apiKey: credentials.apiKey }));
+  }
+
+  if (input.name === "artifactly_get_app_build_status") {
+    if (!credentials) throw new Error(LOGIN_GUIDANCE);
+    const artifactId = requireStringArg(input.arguments, "artifactId");
+    const jobId = requireStringArg(input.arguments, "jobId");
+    return objectResult(await requestJson("GET", `/api/artifacts/${artifactId}/app/build-jobs/${jobId}`, undefined, { apiKey: credentials.apiKey }));
+  }
+
+  if (input.name === "artifactly_deploy_app") {
+    if (!credentials) throw new Error(LOGIN_GUIDANCE);
+    const artifactId = requireStringArg(input.arguments, "artifactId");
+    const imageRef = requireStringArg(input.arguments, "imageRef");
+    const port = numberArg(input.arguments, "port");
+    return objectResult(await requestJson("POST", `/api/artifacts/${artifactId}/app/deploy`, { imageRef, ...(port !== undefined ? { port } : {}) }, { apiKey: credentials.apiKey }));
+  }
+
+  if (input.name === "artifactly_list_custom_domains") {
+    if (!credentials) throw new Error(LOGIN_GUIDANCE);
+    const artifactId = requireStringArg(input.arguments, "artifactId");
+    return objectResult(await requestJson("GET", `/api/artifacts/${artifactId}/custom-domains`, undefined, { apiKey: credentials.apiKey }));
+  }
+
+  if (input.name === "artifactly_add_custom_domain") {
+    if (!credentials) throw new Error(LOGIN_GUIDANCE);
+    const artifactId = requireStringArg(input.arguments, "artifactId");
+    const hostname = requireStringArg(input.arguments, "hostname");
+    return objectResult(await requestJson("POST", `/api/artifacts/${artifactId}/custom-domains`, { hostname }, { apiKey: credentials.apiKey }));
+  }
+
+  if (input.name === "artifactly_delete_custom_domain") {
+    if (!credentials) throw new Error(LOGIN_GUIDANCE);
+    const artifactId = requireStringArg(input.arguments, "artifactId");
+    const hostname = requireStringArg(input.arguments, "hostname");
+    return objectResult(await requestJson("DELETE", `/api/artifacts/${artifactId}/custom-domains${queryString({ hostname })}`, undefined, { apiKey: credentials.apiKey }));
+  }
+
   throw new Error(`Unknown Artifactly MCP tool: ${input.name}`);
 }