@atollhq/mcp-server 0.1.0

package/dist/index.js

@@ -0,0 +1,1216 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+
+// src/http.ts
+import { createServer } from "http";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+
+// src/tools.ts
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { z } from "zod";
+
+// src/api.ts
+var DEFAULT_BASE_URL = "https://atollhq.com";
+var DEFAULT_TIMEOUT_MS = 3e4;
+var AtollApiClient = class {
+  baseUrl;
+  apiKey;
+  timeoutMs;
+  fetchImpl;
+  constructor(options) {
+    this.apiKey = options.apiKey;
+    this.baseUrl = options.baseUrl ?? process.env.ATOLL_BASE_URL ?? DEFAULT_BASE_URL;
+    this.timeoutMs = options.timeoutMs ?? resolveTimeoutMs();
+    this.fetchImpl = options.fetch ?? fetch;
+  }
+  async request(method, path, body) {
+    if (!path.startsWith("/")) {
+      throw new Error('Atoll API paths must start with "/". Example: /api/orgs');
+    }
+    if (!path.startsWith("/api/")) {
+      throw new Error("Atoll API paths must stay under /api/. Example: /api/orgs");
+    }
+    const headers = {
+      Authorization: `Bearer ${this.apiKey}`,
+      "Content-Type": "application/json",
+      "User-Agent": "atoll-mcp-server",
+      "X-Atoll-Client": "mcp-server"
+    };
+    let response;
+    try {
+      response = await this.fetchImpl(`${this.baseUrl}${path}`, {
+        method,
+        headers,
+        body: body === void 0 ? void 0 : JSON.stringify(body),
+        signal: AbortSignal.timeout(this.timeoutMs)
+      });
+    } catch (error) {
+      if (error.name === "TimeoutError" || error.name === "AbortError") {
+        throw new Error(`Atoll API request timed out after ${this.timeoutMs}ms: ${method} ${path}`);
+      }
+      throw error;
+    }
+    const text = await response.text();
+    const parsed = parseResponseBody(text);
+    if (!response.ok) {
+      const details = typeof parsed === "string" ? parsed : JSON.stringify(parsed);
+      throw new Error(`Atoll API ${response.status} for ${method} ${path}: ${details}`);
+    }
+    return parsed;
+  }
+  get(path) {
+    return this.request("GET", path);
+  }
+  post(path, body) {
+    return this.request("POST", path, body);
+  }
+  put(path, body) {
+    return this.request("PUT", path, body);
+  }
+  patch(path, body) {
+    return this.request("PATCH", path, body);
+  }
+  delete(path) {
+    return this.request("DELETE", path);
+  }
+};
+function resolveAuthToken(authorizationHeader) {
+  const requestToken = parseBearerToken(authorizationHeader);
+  const token = requestToken ?? process.env.ATOLL_API_KEY;
+  if (!token) {
+    throw new Error(
+      "No Atoll API key available. Pass Authorization: Bearer <ATOLL_API_KEY> to the remote MCP server or set ATOLL_API_KEY for single-tenant deployments."
+    );
+  }
+  return token;
+}
+async function resolveOrgId(client, explicitOrgId) {
+  if (explicitOrgId) return explicitOrgId;
+  if (process.env.ATOLL_ORG_ID) return process.env.ATOLL_ORG_ID;
+  const data = await client.get("/api/orgs");
+  const orgs = data.orgs ?? [];
+  if (orgs.length === 1 && orgs[0]?.id) return orgs[0].id;
+  if (orgs.length === 0) {
+    throw new Error("No Atoll orgs are accessible for this API key. Create or join an org, then retry.");
+  }
+  const choices = orgs.map((org) => `${org.name ?? org.id} (${org.id})`).join(", ");
+  throw new Error(`Multiple Atoll orgs are accessible. Pass org_id to choose one. Available orgs: ${choices}`);
+}
+function parseBearerToken(header) {
+  if (!header) return void 0;
+  const match = /^Bearer\s+(.+)$/i.exec(header.trim());
+  if (!match) return void 0;
+  return match[1];
+}
+function resolveTimeoutMs() {
+  const raw = process.env.ATOLL_TIMEOUT_MS;
+  if (!raw) return DEFAULT_TIMEOUT_MS;
+  const parsed = Number.parseInt(raw, 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_TIMEOUT_MS;
+}
+function parseResponseBody(text) {
+  if (!text) return void 0;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+
+// src/tools.ts
+var VERSION = "0.1.0";
+var SUPPORTED_API_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
+var ATOLL_MCP_INSTRUCTIONS = `Atoll connects strategy to execution: goals -> KPIs -> initiatives -> milestones and issues.
+KPIs measure business outcomes; initiative targets measure initiative commitments. Use progress targets for output tracking and gate targets for launch prerequisites where KPI pacing would be misleading.
+
+Use atoll_get_heartbeat first to orient an agent, then inspect and update the highest-leverage work.
+Remote clients should pass Authorization: Bearer <ATOLL_API_KEY>. If org_id is omitted, the server uses ATOLL_ORG_ID or the only accessible org.`;
+var ATOLL_TOOL_NAMES = [
+  "atoll_get_auth_context",
+  "atoll_list_orgs",
+  "atoll_get_heartbeat",
+  "atoll_list_issues",
+  "atoll_get_issue",
+  "atoll_create_issue",
+  "atoll_update_issue",
+  "atoll_archive_issue",
+  "atoll_unarchive_issue",
+  "atoll_list_comments",
+  "atoll_add_comment",
+  "atoll_list_projects",
+  "atoll_get_project",
+  "atoll_create_project",
+  "atoll_list_goals",
+  "atoll_get_goal",
+  "atoll_create_goal",
+  "atoll_update_goal",
+  "atoll_list_kpis",
+  "atoll_get_kpi",
+  "atoll_create_kpi",
+  "atoll_update_kpi",
+  "atoll_list_kpi_snapshots",
+  "atoll_record_kpi_snapshot",
+  "atoll_create_kpi_http_sync_draft",
+  "atoll_validate_kpi_http_sync_config",
+  "atoll_list_initiatives",
+  "atoll_get_initiative",
+  "atoll_create_initiative",
+  "atoll_update_initiative",
+  "atoll_link_initiative_issue",
+  "atoll_link_initiative_milestone",
+  "atoll_link_initiative_kpi",
+  "atoll_list_initiative_targets",
+  "atoll_get_initiative_target",
+  "atoll_create_initiative_target",
+  "atoll_update_initiative_target",
+  "atoll_delete_initiative_target",
+  "atoll_link_initiative_target_issue",
+  "atoll_unlink_initiative_target_issue",
+  "atoll_link_initiative_target_milestone",
+  "atoll_unlink_initiative_target_milestone",
+  "atoll_list_milestones",
+  "atoll_create_milestone",
+  "atoll_upsert_milestone",
+  "atoll_list_dependencies",
+  "atoll_add_dependency",
+  "atoll_remove_dependency",
+  "atoll_list_webhooks",
+  "atoll_create_webhook",
+  "atoll_delete_webhook",
+  "atoll_send_feedback",
+  "atoll_api_request"
+];
+var orgId = z.string().min(1).optional().describe("Atoll org UUID. Optional when ATOLL_ORG_ID is configured or the API key has one accessible org.");
+var issueId = z.string().min(1).describe("Issue UUID or API-accepted issue identifier.");
+var projectId = z.string().min(1).describe("Project UUID.");
+var goalId = z.string().min(1).describe("Goal UUID.");
+var kpiId = z.string().min(1).describe("KPI UUID.");
+var initiativeId = z.string().min(1).describe("Initiative UUID.");
+var initiativeTargetId = z.string().min(1).describe("Initiative target UUID.");
+var milestoneId = z.string().min(1).describe("Milestone UUID.");
+var limit = z.number().int().min(1).max(100).default(25).describe("Maximum records to return, 1-100.");
+var offset = z.number().int().min(0).default(0).describe("Pagination offset.");
+var priority = z.number().int().min(0).max(3).optional().describe("Priority: 0 urgent, 1 high, 2 medium, 3 low.");
+var kpiHttpSyncName = z.string().min(1).describe("Human-readable draft name.");
+var kpiHttpSyncSchedule = z.enum(["hourly", "daily"]).describe("Polling schedule.");
+var kpiHttpSyncRequestConfig = z.record(z.string(), z.unknown()).describe("Safe request_config: GET, HTTPS JSON URL, no request body, no inline query strings, and only secretRef placeholders for Authorization Bearer or X-API-Key.");
+var kpiHttpSyncExtractionConfig = z.record(z.string(), z.unknown()).describe('JSON Pointer extraction config, e.g. { contentType: "json", pointer: "/results/0/value", numeric: { mode: "number" } }.');
+var kpiHttpSyncFreshnessConfig = z.record(z.string(), z.unknown()).optional().describe("Optional freshness_config. Use {} for v1 unless a documented field is needed.");
+function listAtollToolNames() {
+  return [...ATOLL_TOOL_NAMES];
+}
+function createAtollMcpServer() {
+  const server = new McpServer(
+    {
+      name: "atoll-mcp-server",
+      version: VERSION,
+      websiteUrl: "https://atollhq.com"
+    },
+    {
+      instructions: ATOLL_MCP_INSTRUCTIONS,
+      capabilities: {
+        resources: {},
+        tools: {}
+      }
+    }
+  );
+  registerAtollTools(server);
+  registerAtollResources(server);
+  return { server, instructions: ATOLL_MCP_INSTRUCTIONS, toolNames: listAtollToolNames() };
+}
+function registerAtollResources(server) {
+  server.registerResource(
+    "atoll_skill_packaging_guidance",
+    "atoll://skills/packaging",
+    {
+      title: "Atoll Skill Packaging Guidance",
+      description: "Explains why Atoll skills remain separate packages from the MCP server.",
+      mimeType: "text/markdown"
+    },
+    async (uri) => ({
+      contents: [
+        {
+          uri: uri.href,
+          mimeType: "text/markdown",
+          text: `# Atoll skills and MCP packaging
+
+Keep Atoll agent skills as separate installable packages. The MCP server is a remote tool surface and should stay runtime-focused: auth, transport, validation, API calls, and structured responses.
+
+Skills remain better as client-side guidance because different agent environments install and invoke skills differently. The MCP server can expose this resource and Atoll docs links so clients know which skill package to install, without coupling server deployment to local skill files.`
+        }
+      ]
+    })
+  );
+}
+function registerAtollTools(server) {
+  registerTool(server, "atoll_get_auth_context", {
+    title: "Get Atoll Auth Context",
+    description: "Validate the active Atoll API key and return its auth context. Mirrors `atoll auth status --json` for remote clients.",
+    inputSchema: {},
+    readOnly: true,
+    handler: async (_args, extra) => clientFromExtra(extra).get("/api/auth/me")
+  });
+  registerTool(server, "atoll_list_orgs", {
+    title: "List Atoll Orgs",
+    description: "List organizations accessible to the Atoll API key. Use this when org_id is unknown.",
+    inputSchema: {},
+    readOnly: true,
+    handler: async (_args, extra) => clientFromExtra(extra).get("/api/orgs")
+  });
+  registerTool(server, "atoll_get_heartbeat", {
+    title: "Get Atoll Heartbeat",
+    description: "Get the agent heartbeat briefing: goal/KPI pace, assigned work, stalled initiatives, and prioritized signals. Mirrors `atoll heartbeat --json`.",
+    inputSchema: {
+      org_id: orgId,
+      severity: z.enum(["critical", "warning", "info"]).optional().describe("Optional signal severity filter."),
+      signals_only: z.boolean().default(false).describe("Return only filtered heartbeat signals.")
+    },
+    readOnly: true,
+    handler: async (args, extra) => {
+      const client = clientFromExtra(extra);
+      const resolvedOrgId = await resolveOrgId(client, stringArg(args.org_id));
+      const data = await client.get(`/api/orgs/${encodeURIComponent(resolvedOrgId)}/heartbeat`);
+      const severity = stringArg(args.severity);
+      const signals = Array.isArray(data.signals) ? data.signals.filter((signal) => !severity || signal.severity === severity) : [];
+      return buildHeartbeatToolPayload(data, signals, Boolean(args.signals_only));
+    }
+  });
+  registerIssueTools(server);
+  registerProjectTools(server);
+  registerGoalTools(server);
+  registerKpiTools(server);
+  registerInitiativeTools(server);
+  registerMilestoneTools(server);
+  registerDependencyTools(server);
+  registerWebhookTools(server);
+  registerFeedbackTools(server);
+  registerGenericApiTool(server);
+}
+function registerIssueTools(server) {
+  registerTool(server, "atoll_list_issues", {
+    title: "List Atoll Issues",
+    description: "List Atoll tasks/issues with CLI-compatible pagination. Mirrors `atoll issue list --json`.",
+    inputSchema: {
+      org_id: orgId,
+      status: z.string().optional(),
+      priority,
+      project_id: z.string().optional(),
+      assignee_id: z.string().optional(),
+      team_id: z.string().optional(),
+      milestone_id: z.string().optional(),
+      q: z.string().optional().describe("Search query for title/description."),
+      include_archived: z.boolean().optional(),
+      order_by: z.enum(["created_at", "updated_at", "priority", "due_date", "title", "status"]).optional(),
+      order_dir: z.enum(["asc", "desc"]).optional(),
+      limit,
+      offset
+    },
+    readOnly: true,
+    handler: async (args, extra) => orgGet(extra, args, "/issues", issueListParams(args))
+  });
+  registerTool(server, "atoll_get_issue", {
+    title: "Get Atoll Issue",
+    description: "Get one Atoll task/issue with enriched detail. Mirrors `atoll issue get --json`.",
+    inputSchema: { org_id: orgId, issue_id: issueId },
+    readOnly: true,
+    handler: async (args, extra) => orgGet(extra, args, `/issues/${encodeURIComponent(requiredString(args.issue_id, "issue_id"))}`)
+  });
+  registerTool(server, "atoll_create_issue", {
+    title: "Create Atoll Issue",
+    description: "Create an Atoll task/issue. Mirrors `atoll issue create --json`.",
+    inputSchema: {
+      org_id: orgId,
+      title: z.string().min(1),
+      description: z.string().optional(),
+      status: z.string().optional(),
+      priority,
+      project_id: z.string().optional(),
+      milestone_id: z.string().optional(),
+      team_id: z.string().optional(),
+      assignee_id: z.string().optional(),
+      assignee_ids: z.array(z.string()).optional(),
+      start_date: z.string().optional(),
+      due_date: z.string().optional(),
+      label_ids: z.array(z.string()).optional()
+    },
+    readOnly: false,
+    handler: async (args, extra) => orgPost(extra, args, "/issues", buildIssueBody(args))
+  });
+  registerTool(server, "atoll_update_issue", {
+    title: "Update Atoll Issue",
+    description: "Update title, description, status, priority, project, milestone, team, assignees, dates, labels, or comment_body on an Atoll task.",
+    inputSchema: {
+      org_id: orgId,
+      issue_id: issueId,
+      title: z.string().optional(),
+      description: z.string().nullable().optional(),
+      comment_body: z.string().optional().describe("Optional Markdown comment body to create with this update. Use this to preserve strategy evidence when changing status."),
+      commentBody: z.string().optional().describe("CamelCase alias for comment_body."),
+      status: z.string().optional(),
+      priority,
+      project_id: z.string().nullable().optional(),
+      milestone_id: z.string().nullable().optional(),
+      team_id: z.string().nullable().optional(),
+      assignee_id: z.string().nullable().optional(),
+      assignee_ids: z.array(z.string()).optional(),
+      start_date: z.string().nullable().optional(),
+      due_date: z.string().nullable().optional(),
+      label_ids: z.array(z.string()).optional()
+    },
+    readOnly: false,
+    handler: async (args, extra) => orgPatch(extra, args, `/issues/${encodeURIComponent(requiredString(args.issue_id, "issue_id"))}`, nonEmptyBody(buildIssueBody(args)))
+  });
+  registerTool(server, "atoll_archive_issue", {
+    title: "Archive Atoll Issue",
+    description: "Soft-delete/archive an issue without requiring owner/admin permanent delete permissions. Mirrors `atoll issue archive`.",
+    inputSchema: { org_id: orgId, issue_id: issueId },
+    readOnly: false,
+    handler: async (args, extra) => orgPost(extra, args, `/issues/${encodeURIComponent(requiredString(args.issue_id, "issue_id"))}/archive`, void 0)
+  });
+  registerTool(server, "atoll_unarchive_issue", {
+    title: "Unarchive Atoll Issue",
+    description: "Restore an archived issue. Mirrors `atoll issue unarchive`.",
+    inputSchema: { org_id: orgId, issue_id: issueId },
+    readOnly: false,
+    handler: async (args, extra) => orgDelete(extra, args, `/issues/${encodeURIComponent(requiredString(args.issue_id, "issue_id"))}/archive`)
+  });
+  registerTool(server, "atoll_list_comments", {
+    title: "List Atoll Issue Comments",
+    description: "List comments for an Atoll issue.",
+    inputSchema: { org_id: orgId, issue_id: issueId },
+    readOnly: true,
+    handler: async (args, extra) => orgGet(extra, args, `/issues/${encodeURIComponent(requiredString(args.issue_id, "issue_id"))}/comments`)
+  });
+  registerTool(server, "atoll_add_comment", {
+    title: "Add Atoll Issue Comment",
+    description: "Add a Markdown comment to an Atoll issue. Mirrors `atoll comment add`.",
+    inputSchema: {
+      org_id: orgId,
+      issue_id: issueId,
+      body: z.string().min(1).describe("Markdown comment body.")
+    },
+    readOnly: false,
+    handler: async (args, extra) => orgPost(extra, args, `/issues/${encodeURIComponent(requiredString(args.issue_id, "issue_id"))}/comments`, {
+      body: requiredString(args.body, "body")
+    })
+  });
+}
+function registerProjectTools(server) {
+  registerTool(server, "atoll_list_projects", {
+    title: "List Atoll Projects",
+    description: "List projects visible to the API key. Mirrors `atoll project list --json`.",
+    inputSchema: { org_id: orgId, limit },
+    readOnly: true,
+    handler: async (args, extra) => buildProjectListPayload(await orgGet(extra, args, "/projects"), numberArg(args.limit, 25))
+  });
+  registerTool(server, "atoll_get_project", {
+    title: "Get Atoll Project",
+    description: "Get project detail and issues. Mirrors `atoll project get --json`.",
+    inputSchema: { org_id: orgId, project_id: projectId },
+    readOnly: true,
+    handler: async (args, extra) => orgGet(extra, args, `/projects/${encodeURIComponent(requiredString(args.project_id, "project_id"))}`)
+  });
+  registerTool(server, "atoll_create_project", {
+    title: "Create Atoll Project",
+    description: "Create a project. Mirrors `atoll project create --json`.",
+    inputSchema: {
+      org_id: orgId,
+      name: z.string().min(1),
+      description: z.string().optional(),
+      visibility: z.string().optional(),
+      color: z.string().optional(),
+      icon: z.string().optional(),
+      github_repo: z.string().optional()
+    },
+    readOnly: false,
+    handler: async (args, extra) => orgPost(extra, args, "/projects", pickDefined(args, ["name", "description", "visibility", "color", "icon", "github_repo"]))
+  });
+}
+function registerGoalTools(server) {
+  registerCrudTools(server, "goal", "/goals", goalId, ["title", "description", "owner_id", "status", "target_date"], {
+    listFilters: { status: z.string().optional(), limit },
+    createRequired: { title: z.string().min(1) }
+  });
+}
+function registerKpiTools(server) {
+  registerCrudTools(server, "kpi", "/kpis", kpiId, [
+    "name",
+    "goal_id",
+    "unit",
+    "unit_label",
+    "target_value",
+    "target_direction",
+    "current_value",
+    "stale_after_hours"
+  ], {
+    listFilters: { goal_id: z.string().optional(), limit },
+    createRequired: { name: z.string().min(1) }
+  });
+  registerTool(server, "atoll_list_kpi_snapshots", {
+    title: "List Atoll KPI Snapshots",
+    description: "List snapshots for a KPI. Mirrors `atoll kpi snapshot list --json`.",
+    inputSchema: { org_id: orgId, kpi_id: kpiId, limit },
+    readOnly: true,
+    handler: async (args, extra) => orgGet(extra, args, `/kpis/${encodeURIComponent(requiredString(args.kpi_id, "kpi_id"))}/snapshots`, {
+      limit: args.limit
+    })
+  });
+  registerTool(server, "atoll_record_kpi_snapshot", {
+    title: "Record Atoll KPI Snapshot",
+    description: "Record a KPI measurement. Mirrors `atoll kpi snapshot add --json`.",
+    inputSchema: {
+      org_id: orgId,
+      kpi_id: kpiId,
+      value: z.number(),
+      recorded_at: z.string().optional(),
+      attribution_note: z.string().optional(),
+      attributed_to_initiative_id: z.string().optional(),
+      attributed_to_issue_id: z.string().optional()
+    },
+    readOnly: false,
+    handler: async (args, extra) => orgPost(extra, args, `/kpis/${encodeURIComponent(requiredString(args.kpi_id, "kpi_id"))}/snapshots`, {
+      source: "manual",
+      ...pickDefined(args, ["value", "recorded_at", "attribution_note", "attributed_to_initiative_id", "attributed_to_issue_id"])
+    })
+  });
+  registerTool(server, "atoll_create_kpi_http_sync_draft", {
+    title: "Create Atoll KPI HTTP Sync Draft",
+    description: "Create a draft-only generic HTTPS JSON KPI sync for human admin review. Do not include secret values. Human admins must add secrets, dry-run, and publish in Atoll.",
+    inputSchema: {
+      org_id: orgId,
+      kpi_id: kpiId,
+      name: kpiHttpSyncName,
+      schedule: kpiHttpSyncSchedule,
+      request_config: kpiHttpSyncRequestConfig,
+      extraction_config: kpiHttpSyncExtractionConfig,
+      freshness_config: kpiHttpSyncFreshnessConfig
+    },
+    readOnly: false,
+    handler: async (args, extra) => orgPost(extra, args, `/kpis/${encodeURIComponent(requiredString(args.kpi_id, "kpi_id"))}/http-syncs`, safeKpiHttpSyncAgentBody({
+      name: args.name,
+      schedule: args.schedule,
+      request_config: args.request_config,
+      extraction_config: args.extraction_config,
+      freshness_config: args.freshness_config ?? {}
+    }))
+  });
+  registerTool(server, "atoll_validate_kpi_http_sync_config", {
+    title: "Validate Atoll KPI HTTP Sync Config",
+    description: "Validate a proposed KPI HTTP sync config without storing it, running network requests, adding secrets, publishing, or writing snapshots.",
+    inputSchema: {
+      org_id: orgId,
+      kpi_id: kpiId,
+      name: kpiHttpSyncName,
+      schedule: kpiHttpSyncSchedule,
+      request_config: kpiHttpSyncRequestConfig,
+      extraction_config: kpiHttpSyncExtractionConfig,
+      freshness_config: kpiHttpSyncFreshnessConfig
+    },
+    readOnly: true,
+    handler: async (args, extra) => orgPut(extra, args, `/kpis/${encodeURIComponent(requiredString(args.kpi_id, "kpi_id"))}/http-syncs`, safeKpiHttpSyncAgentBody({
+      name: args.name,
+      schedule: args.schedule,
+      request_config: args.request_config,
+      extraction_config: args.extraction_config,
+      freshness_config: args.freshness_config ?? {}
+    }))
+  });
+}
+function registerInitiativeTools(server) {
+  registerCrudTools(server, "initiative", "/initiatives", initiativeId, ["title", "name", "description", "goal_id", "owner_id", "status", "target_date"], {
+    listFilters: { goal_id: z.string().optional(), status: z.string().optional(), owner_id: z.string().optional(), limit },
+    createRequired: { title: z.string().min(1) }
+  });
+  registerLinkTool(server, "atoll_link_initiative_issue", "issue", "issues", "issue_id", issueId);
+  registerLinkTool(server, "atoll_link_initiative_milestone", "milestone", "milestones", "milestone_id", milestoneId);
+  registerLinkTool(server, "atoll_link_initiative_kpi", "KPI impact", "kpi-impacts", "kpi_id", kpiId, {
+    expected_impact: z.string().optional()
+  });
+  registerInitiativeTargetTools(server);
+}
+function registerInitiativeTargetTools(server) {
+  const targetBodySchema = {
+    title: z.string().min(1).optional(),
+    description: z.string().nullable().optional(),
+    mode: z.enum(["progress", "gate"]).optional(),
+    unit: z.enum(["count", "percentage", "currency", "duration", "ratio", "custom"]).optional(),
+    unit_label: z.string().nullable().optional(),
+    current_value: z.number().nullable().optional(),
+    target_value: z.number().nullable().optional(),
+    target_direction: z.enum(["increase", "decrease", "maintain"]).optional(),
+    target_date: z.string().nullable().optional(),
+    due_soon_days: z.number().int().min(0).nullable().optional()
+  };
+  registerTool(server, "atoll_list_initiative_targets", {
+    title: "List Atoll Initiative Targets",
+    description: "List progress and gate targets under an initiative. Gate targets represent launch prerequisites and should not be interpreted as KPI pace.",
+    inputSchema: { org_id: orgId, initiative_id: initiativeId },
+    readOnly: true,
+    handler: async (args, extra) => orgGet(extra, args, `/initiatives/${encodeURIComponent(requiredString(args.initiative_id, "initiative_id"))}/targets`)
+  });
+  registerTool(server, "atoll_get_initiative_target", {
+    title: "Get Atoll Initiative Target",
+    description: "Get one progress or gate target under an initiative.",
+    inputSchema: { org_id: orgId, initiative_id: initiativeId, target_id: initiativeTargetId },
+    readOnly: true,
+    handler: async (args, extra) => orgGet(extra, args, `/initiatives/${encodeURIComponent(requiredString(args.initiative_id, "initiative_id"))}/targets/${encodeURIComponent(requiredString(args.target_id, "target_id"))}`)
+  });
+  registerTool(server, "atoll_create_initiative_target", {
+    title: "Create Atoll Initiative Target",
+    description: "Create an initiative target. Use mode=progress for output tracking and mode=gate for hard launch prerequisites.",
+    inputSchema: { org_id: orgId, initiative_id: initiativeId, ...targetBodySchema, title: z.string().min(1) },
+    readOnly: false,
+    handler: async (args, extra) => orgPost(extra, args, `/initiatives/${encodeURIComponent(requiredString(args.initiative_id, "initiative_id"))}/targets`, nonEmptyBody(pickDefined(args, Object.keys(targetBodySchema))))
+  });
+  registerTool(server, "atoll_update_initiative_target", {
+    title: "Update Atoll Initiative Target",
+    description: "Update an initiative target current value, target value, mode, date, or descriptive fields.",
+    inputSchema: { org_id: orgId, initiative_id: initiativeId, target_id: initiativeTargetId, ...targetBodySchema },
+    readOnly: false,
+    handler: async (args, extra) => orgPatch(
+      extra,
+      args,
+      `/initiatives/${encodeURIComponent(requiredString(args.initiative_id, "initiative_id"))}/targets/${encodeURIComponent(requiredString(args.target_id, "target_id"))}`,
+      nonEmptyBody(pickDefined(args, Object.keys(targetBodySchema)))
+    )
+  });
+  registerTool(server, "atoll_delete_initiative_target", {
+    title: "Delete Atoll Initiative Target",
+    description: "Delete an initiative target and its target-specific work links.",
+    inputSchema: { org_id: orgId, initiative_id: initiativeId, target_id: initiativeTargetId },
+    readOnly: false,
+    destructive: true,
+    handler: async (args, extra) => orgDelete(extra, args, `/initiatives/${encodeURIComponent(requiredString(args.initiative_id, "initiative_id"))}/targets/${encodeURIComponent(requiredString(args.target_id, "target_id"))}`)
+  });
+  registerInitiativeTargetLinkTool(server, "atoll_link_initiative_target_issue", "issue", "issues", "issue_id", issueId, false);
+  registerInitiativeTargetLinkTool(server, "atoll_unlink_initiative_target_issue", "issue", "issues", "issue_id", issueId, true);
+  registerInitiativeTargetLinkTool(server, "atoll_link_initiative_target_milestone", "milestone", "milestones", "milestone_id", milestoneId, false);
+  registerInitiativeTargetLinkTool(server, "atoll_unlink_initiative_target_milestone", "milestone", "milestones", "milestone_id", milestoneId, true);
+}
+function registerMilestoneTools(server) {
+  registerTool(server, "atoll_list_milestones", {
+    title: "List Atoll Milestones",
+    description: "List milestones for a project. Mirrors `atoll milestone list --json`.",
+    inputSchema: { org_id: orgId, project_id: projectId },
+    readOnly: true,
+    handler: async (args, extra) => orgGet(extra, args, `/projects/${encodeURIComponent(requiredString(args.project_id, "project_id"))}/milestones`)
+  });
+  registerTool(server, "atoll_create_milestone", {
+    title: "Create Atoll Milestone",
+    description: "Create a milestone in a project. Mirrors `atoll milestone create --json`.",
+    inputSchema: {
+      org_id: orgId,
+      project_id: projectId,
+      name: z.string().min(1),
+      description: z.string().optional(),
+      status: z.string().optional(),
+      target_date: z.string().optional(),
+      due_date: z.string().optional()
+    },
+    readOnly: false,
+    handler: async (args, extra) => orgPost(extra, args, `/projects/${encodeURIComponent(requiredString(args.project_id, "project_id"))}/milestones`, pickDefined(args, ["name", "description", "status", "target_date", "due_date"]))
+  });
+  registerTool(server, "atoll_upsert_milestone", {
+    title: "Upsert Atoll Milestone",
+    description: "Retry-safe milestone sync by name within a project. If the API lacks direct upsert support, this tool performs list-then-create/update.",
+    inputSchema: {
+      org_id: orgId,
+      project_id: projectId,
+      name: z.string().min(1),
+      description: z.string().optional(),
+      status: z.string().optional(),
+      target_date: z.string().optional(),
+      due_date: z.string().optional()
+    },
+    readOnly: false,
+    handler: async (args, extra) => {
+      const client = clientFromExtra(extra);
+      const resolvedOrgId = await resolveOrgId(client, stringArg(args.org_id));
+      const path = `/api/orgs/${encodeURIComponent(resolvedOrgId)}/projects/${encodeURIComponent(requiredString(args.project_id, "project_id"))}/milestones`;
+      const data = await client.get(path);
+      const existing = (data.milestones ?? []).find((milestone) => milestone.name === args.name);
+      const body = pickDefined(args, ["name", "description", "status", "target_date", "due_date"]);
+      if (!existing) {
+        return { action: "created", ...await client.post(path, body) };
+      }
+      return {
+        action: "updated",
+        ...await client.patch(`/api/orgs/${encodeURIComponent(resolvedOrgId)}/milestones/${encodeURIComponent(existing.id)}`, body)
+      };
+    }
+  });
+}
+function registerDependencyTools(server) {
+  registerTool(server, "atoll_list_dependencies", {
+    title: "List Atoll Issue Dependencies",
+    description: "List tasks this issue blocks and tasks blocking it. Mirrors `atoll dependency list --json`.",
+    inputSchema: { org_id: orgId, issue_id: issueId },
+    readOnly: true,
+    handler: async (args, extra) => orgGet(extra, args, `/issues/${encodeURIComponent(requiredString(args.issue_id, "issue_id"))}/dependencies`)
+  });
+  registerTool(server, "atoll_add_dependency", {
+    title: "Add Atoll Issue Dependency",
+    description: "Add a blocking relationship. Provide exactly one of blocked_by_issue_id or blocking_issue_id.",
+    inputSchema: {
+      org_id: orgId,
+      issue_id: issueId,
+      blocked_by_issue_id: z.string().optional(),
+      blocking_issue_id: z.string().optional()
+    },
+    readOnly: false,
+    handler: async (args, extra) => {
+      const hasBlockedBy = typeof args.blocked_by_issue_id === "string";
+      const hasBlocking = typeof args.blocking_issue_id === "string";
+      if (hasBlockedBy === hasBlocking) throw new Error("Provide exactly one of blocked_by_issue_id or blocking_issue_id.");
+      return orgPost(extra, args, `/issues/${encodeURIComponent(requiredString(args.issue_id, "issue_id"))}/dependencies`, {
+        ...hasBlockedBy ? { blockedByIssueId: args.blocked_by_issue_id } : {},
+        ...hasBlocking ? { blockingIssueId: args.blocking_issue_id } : {}
+      });
+    }
+  });
+  registerTool(server, "atoll_remove_dependency", {
+    title: "Remove Atoll Issue Dependency",
+    description: "Remove a dependency edge from an issue.",
+    inputSchema: { org_id: orgId, issue_id: issueId, dependency_id: z.string().min(1) },
+    readOnly: false,
+    handler: async (args, extra) => orgDelete(extra, args, `/issues/${encodeURIComponent(requiredString(args.issue_id, "issue_id"))}/dependencies/${encodeURIComponent(requiredString(args.dependency_id, "dependency_id"))}`)
+  });
+}
+function registerWebhookTools(server) {
+  registerTool(server, "atoll_list_webhooks", {
+    title: "List Atoll Webhooks",
+    description: "List org webhooks. Mirrors `atoll webhook list --json`.",
+    inputSchema: { org_id: orgId },
+    readOnly: true,
+    handler: async (args, extra) => {
+      const client = clientFromExtra(extra);
+      const resolvedOrgId = await resolveOrgId(client, stringArg(args.org_id));
+      return client.get(`/api/webhooks?${new URLSearchParams({ orgId: resolvedOrgId }).toString()}`);
+    }
+  });
+  registerTool(server, "atoll_create_webhook", {
+    title: "Create Atoll Webhook",
+    description: "Create an outbound webhook. The returned secret is shown once by the API.",
+    inputSchema: {
+      org_id: orgId,
+      url: z.string().url(),
+      events: z.array(z.string()).min(1),
+      enabled: z.boolean().optional()
+    },
+    readOnly: false,
+    handler: async (args, extra) => {
+      const client = clientFromExtra(extra);
+      const resolvedOrgId = await resolveOrgId(client, stringArg(args.org_id));
+      return client.post(`/api/webhooks?${new URLSearchParams({ orgId: resolvedOrgId }).toString()}`, pickDefined(args, ["url", "events", "enabled"]));
+    }
+  });
+  registerTool(server, "atoll_delete_webhook", {
+    title: "Delete Atoll Webhook",
+    description: "Delete an outbound webhook.",
+    inputSchema: { webhook_id: z.string().min(1) },
+    readOnly: false,
+    destructive: true,
+    handler: async (args, extra) => clientFromExtra(extra).delete(`/api/webhooks/${encodeURIComponent(requiredString(args.webhook_id, "webhook_id"))}`)
+  });
+}
+function registerFeedbackTools(server) {
+  registerTool(server, "atoll_send_feedback", {
+    title: "Send Atoll Platform Feedback",
+    description: "Send bug reports or feature requests to the Atoll platform team, not to the current org.",
+    inputSchema: {
+      type: z.enum(["bug", "feature"]).default("bug"),
+      description: z.string().min(1),
+      userEmail: z.string().email().optional(),
+      userName: z.string().optional(),
+      url: z.string().url().optional()
+    },
+    readOnly: false,
+    handler: async (args) => {
+      const response = await fetch(`${process.env.ATOLL_BASE_URL ?? "https://atollhq.com"}/api/feedback`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", "User-Agent": "atoll-mcp-server" },
+        body: JSON.stringify(pickDefined(args, ["type", "description", "userEmail", "userName", "url"]))
+      });
+      const text = await response.text();
+      const data = text ? JSON.parse(text) : void 0;
+      if (!response.ok) throw new Error(`Atoll feedback API ${response.status}: ${text}`);
+      return data;
+    }
+  });
+}
+function registerGenericApiTool(server) {
+  registerTool(server, "atoll_api_request", {
+    title: "Call Atoll API",
+    description: "Advanced fallback for API operations not yet represented as first-class MCP tools. Path must be relative and under /api/.",
+    inputSchema: {
+      method: z.enum(SUPPORTED_API_METHODS),
+      path: z.string().min(1).describe("Relative Atoll API path, e.g. /api/orgs/{orgId}/issues?limit=10. Full URLs are rejected."),
+      body: z.unknown().optional()
+    },
+    readOnly: false,
+    handler: async (args, extra) => {
+      const path = requiredString(args.path, "path");
+      if (isKpiHttpSyncApiPath(path)) {
+        throw new Error("KPI HTTP sync routes are not available through atoll_api_request. Use atoll_create_kpi_http_sync_draft or atoll_validate_kpi_http_sync_config; human admins must use Atoll UI for secrets, dry-run, publish, and execution.");
+      }
+      return clientFromExtra(extra).request(requiredString(args.method, "method"), path, args.body);
+    }
+  });
+}
+function isKpiHttpSyncApiPath(path) {
+  if (!path.startsWith("/")) return false;
+  let pathname;
+  try {
+    pathname = new URL(path, "https://atoll.local").pathname;
+  } catch {
+    return false;
+  }
+  return /^\/api\/orgs\/[^/]+\/kpis\/[^/]+\/http-syncs(?:\/|$)/.test(pathname);
+}
+function safeKpiHttpSyncAgentBody(body) {
+  const request = body.request_config;
+  if (isObjectRecord(request) && typeof request.url === "string" && new URLSearchParams(request.url.split("?", 2)[1] ?? "").toString()) {
+    throw new Error("KPI HTTP sync URLs must not include inline query strings. Query params are disabled in v1.");
+  }
+  if (isObjectRecord(request) && isObjectRecord(request.headers)) {
+    for (const [name, value] of Object.entries(request.headers)) {
+      const normalizedName = name.trim().toLowerCase();
+      if (normalizedName === "authorization" || normalizedName === "x-api-key") {
+        if (!isObjectRecord(value) || typeof value.secretRef !== "string") {
+          throw new Error(`${name} must use a non-secret secretRef placeholder, not a header value.`);
+        }
+        assertSafeKpiHttpSyncSecretRef(value.secretRef, `${name}.secretRef`);
+      } else if (isObjectRecord(value) && "secretRef" in value) {
+        throw new Error("Secret refs are only supported for Authorization and X-API-Key headers.");
+      }
+    }
+  }
+  const unsafe = findUnsafeKpiHttpSyncString(body, []);
+  if (unsafe) {
+    throw new Error(`Refusing possible secret value at ${unsafe.path}. Use a short placeholder secretRef and enter the secret in Atoll UI.`);
+  }
+  return body;
+}
+function buildProjectListPayload(data, requestedLimit) {
+  const projects = Array.isArray(data.projects) ? data.projects : [];
+  const limitValue = Math.max(1, Math.min(100, requestedLimit));
+  const items = projects.slice(0, limitValue);
+  const truncated = projects.length > items.length;
+  return {
+    resource: "projects",
+    items,
+    total: projects.length,
+    limit: limitValue,
+    offset: 0,
+    nextOffset: truncated ? items.length : null,
+    truncated,
+    hint: truncated ? "Increase limit up to 100 to return more projects." : null
+  };
+}
+function buildHeartbeatToolPayload(data, signals, signalsOnly) {
+  if (signalsOnly) {
+    return {
+      signals,
+      recommended_action: data.recommended_action ?? null
+    };
+  }
+  return { ...data, signals };
+}
+function registerCrudTools(server, resource, basePath, idSchema, bodyFields, options) {
+  const idField = `${resource}_id`;
+  const resourcePlural = resource === "kpi" ? "kpis" : `${resource}s`;
+  const bodySchema = Object.fromEntries(bodyFields.map((field) => [field, z.unknown().optional()]));
+  registerTool(server, `atoll_list_${resourcePlural}`, {
+    title: `List Atoll ${resourcePlural}`,
+    description: `List Atoll ${resourcePlural}. Mirrors \`atoll ${resource} list --json\`.`,
+    inputSchema: { org_id: orgId, ...options.listFilters },
+    readOnly: true,
+    handler: async (args, extra) => orgGet(extra, args, basePath, pickDefined(args, Object.keys(options.listFilters)))
+  });
+  registerTool(server, `atoll_get_${resource}`, {
+    title: `Get Atoll ${resource}`,
+    description: `Get one Atoll ${resource}. Mirrors \`atoll ${resource} get --json\`.`,
+    inputSchema: { org_id: orgId, [idField]: idSchema },
+    readOnly: true,
+    handler: async (args, extra) => orgGet(extra, args, `${basePath}/${encodeURIComponent(requiredString(args[idField], idField))}`)
+  });
+  registerTool(server, `atoll_create_${resource}`, {
+    title: `Create Atoll ${resource}`,
+    description: `Create an Atoll ${resource}. Mirrors \`atoll ${resource} create --json\`.`,
+    inputSchema: { org_id: orgId, ...bodySchema, ...options.createRequired },
+    readOnly: false,
+    handler: async (args, extra) => orgPost(extra, args, basePath, nonEmptyBody(pickDefined(args, bodyFields)))
+  });
+  registerTool(server, `atoll_update_${resource}`, {
+    title: `Update Atoll ${resource}`,
+    description: `Update an Atoll ${resource}. Mirrors \`atoll ${resource} update --json\`.`,
+    inputSchema: { org_id: orgId, [idField]: idSchema, ...bodySchema },
+    readOnly: false,
+    handler: async (args, extra) => orgPatch(extra, args, `${basePath}/${encodeURIComponent(requiredString(args[idField], idField))}`, nonEmptyBody(pickDefined(args, bodyFields)))
+  });
+}
+function registerLinkTool(server, name, label, linkPath, idField, idFieldSchema, extraSchema = {}) {
+  registerTool(server, name, {
+    title: `Link Atoll Initiative ${label}`,
+    description: `Link an initiative to a ${label}.`,
+    inputSchema: { org_id: orgId, initiative_id: initiativeId, [idField]: idFieldSchema, ...extraSchema },
+    readOnly: false,
+    handler: async (args, extra) => orgPost(extra, args, `/initiatives/${encodeURIComponent(requiredString(args.initiative_id, "initiative_id"))}/${linkPath}`, {
+      [idField]: args[idField],
+      ...pickDefined(args, Object.keys(extraSchema))
+    })
+  });
+}
+function registerInitiativeTargetLinkTool(server, name, label, linkPath, idField, idFieldSchema, unlink) {
+  registerTool(server, name, {
+    title: `${unlink ? "Unlink" : "Link"} Atoll Initiative Target ${label}`,
+    description: `${unlink ? "Unlink" : "Link"} an initiative target to a ${label}.`,
+    inputSchema: {
+      org_id: orgId,
+      initiative_id: initiativeId,
+      target_id: initiativeTargetId,
+      [idField]: idFieldSchema
+    },
+    readOnly: false,
+    handler: async (args, extra) => {
+      const initiative = encodeURIComponent(requiredString(args.initiative_id, "initiative_id"));
+      const target = encodeURIComponent(requiredString(args.target_id, "target_id"));
+      const linkedId = encodeURIComponent(requiredString(args[idField], idField));
+      const path = `/initiatives/${initiative}/targets/${target}/${linkPath}`;
+      if (unlink) return orgDelete(extra, args, `${path}/${linkedId}`);
+      return orgPost(extra, args, path, { [idField]: args[idField] });
+    }
+  });
+}
+function registerTool(server, name, config) {
+  server.registerTool(
+    name,
+    {
+      title: config.title,
+      description: config.description,
+      inputSchema: config.inputSchema,
+      annotations: {
+        readOnlyHint: config.readOnly,
+        destructiveHint: config.destructive ?? false,
+        idempotentHint: config.readOnly,
+        openWorldHint: true
+      }
+    },
+    async (args, extra) => {
+      try {
+        const data = await config.handler(args, extra);
+        return toolResult(data);
+      } catch (error) {
+        return toolError(error);
+      }
+    }
+  );
+}
+function clientFromExtra(extra) {
+  const token = extra.authInfo?.token;
+  return new AtollApiClient({ apiKey: resolveAuthToken(token ? `Bearer ${token}` : void 0) });
+}
+async function orgGet(extra, args, path, params) {
+  const client = clientFromExtra(extra);
+  const resolvedOrgId = await resolveOrgId(client, stringArg(args.org_id));
+  return client.get(`/api/orgs/${encodeURIComponent(resolvedOrgId)}${path}${queryString(params)}`);
+}
+async function orgPost(extra, args, path, body) {
+  const client = clientFromExtra(extra);
+  const resolvedOrgId = await resolveOrgId(client, stringArg(args.org_id));
+  return client.post(`/api/orgs/${encodeURIComponent(resolvedOrgId)}${path}`, body);
+}
+async function orgPut(extra, args, path, body) {
+  const client = clientFromExtra(extra);
+  const resolvedOrgId = await resolveOrgId(client, stringArg(args.org_id));
+  return client.put(`/api/orgs/${encodeURIComponent(resolvedOrgId)}${path}`, body);
+}
+async function orgPatch(extra, args, path, body) {
+  const client = clientFromExtra(extra);
+  const resolvedOrgId = await resolveOrgId(client, stringArg(args.org_id));
+  return client.patch(`/api/orgs/${encodeURIComponent(resolvedOrgId)}${path}`, body);
+}
+async function orgDelete(extra, args, path) {
+  const client = clientFromExtra(extra);
+  const resolvedOrgId = await resolveOrgId(client, stringArg(args.org_id));
+  return client.delete(`/api/orgs/${encodeURIComponent(resolvedOrgId)}${path}`);
+}
+function issueListParams(args) {
+  return {
+    status: args.status,
+    priority: args.priority,
+    projectId: args.project_id,
+    assigneeId: args.assignee_id,
+    teamId: args.team_id,
+    milestoneId: args.milestone_id,
+    q: args.q,
+    includeArchived: args.include_archived,
+    orderBy: args.order_by,
+    orderDir: args.order_dir,
+    limit: args.limit,
+    offset: args.offset,
+    shape: "envelope"
+  };
+}
+function buildIssueBody(args) {
+  return pickDefined(args, [
+    "title",
+    "description",
+    "commentBody",
+    "comment_body",
+    "status",
+    "priority",
+    "project_id",
+    "milestone_id",
+    "team_id",
+    "assignee_id",
+    "assignee_ids",
+    "start_date",
+    "due_date",
+    "label_ids"
+  ], {
+    project_id: "projectId",
+    milestone_id: "milestoneId",
+    team_id: "teamId",
+    assignee_id: "assigneeId",
+    assignee_ids: "assigneeIds",
+    start_date: "startDate",
+    due_date: "dueDate",
+    label_ids: "labelIds",
+    commentBody: "comment_body"
+  });
+}
+function pickDefined(args, fields, aliases = {}) {
+  const body = {};
+  for (const field of fields) {
+    if (args[field] !== void 0) {
+      body[aliases[field] ?? field] = args[field];
+    }
+  }
+  return body;
+}
+function nonEmptyBody(body) {
+  if (Object.keys(body).length === 0) {
+    throw new Error("No fields to send. Provide at least one update/create field.");
+  }
+  return body;
+}
+function queryString(params) {
+  if (!params) return "";
+  const search = new URLSearchParams();
+  for (const [key, value] of Object.entries(params)) {
+    if (value !== void 0 && value !== null && value !== "") search.set(key, String(value));
+  }
+  const qs = search.toString();
+  return qs ? `?${qs}` : "";
+}
+function assertSafeKpiHttpSyncSecretRef(value, label) {
+  if (!/^[A-Za-z][A-Za-z0-9_-]{0,39}$/.test(value)) {
+    throw new Error(`${label} must be a short placeholder name, such as posthog_api_key, not a secret value.`);
+  }
+  if (looksLikeKpiHttpSyncSecretValue(value)) {
+    throw new Error(`${label} looks like a secret value. Use a placeholder name and enter the secret in Atoll UI.`);
+  }
+}
+function findUnsafeKpiHttpSyncString(value, path) {
+  if (typeof value === "string") {
+    if (path[path.length - 1] === "format" && (value === "Bearer {value}" || value === "{value}")) return null;
+    if (looksLikeKpiHttpSyncSecretValue(value)) return { path: path.join(".") || "<root>" };
+    return null;
+  }
+  if (Array.isArray(value)) {
+    for (let index = 0; index < value.length; index += 1) {
+      const found = findUnsafeKpiHttpSyncString(value[index], [...path, String(index)]);
+      if (found) return found;
+    }
+    return null;
+  }
+  if (isObjectRecord(value)) {
+    for (const [key, nested] of Object.entries(value)) {
+      if (key === "secretRef" && typeof nested === "string") {
+        assertSafeKpiHttpSyncSecretRef(nested, [...path, key].join("."));
+        continue;
+      }
+      const found = findUnsafeKpiHttpSyncString(nested, [...path, key]);
+      if (found) return found;
+    }
+  }
+  return null;
+}
+function looksLikeKpiHttpSyncSecretValue(value) {
+  const trimmed = value.trim();
+  if (!trimmed) return false;
+  if (/^Bearer\s+\S+/i.test(trimmed)) return true;
+  if (/^sk_(?:atoll|live|test|proj)_[A-Za-z0-9_-]{8,}/.test(trimmed)) return true;
+  if (/^(?:ghp|gho|github_pat|xox[baprs]|glpat)-?[A-Za-z0-9_-]{16,}/.test(trimmed)) return true;
+  if (/^eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}$/.test(trimmed)) return true;
+  if (/^(?:api[_-]?key|token|secret|password)\s*[:=]\s*\S{8,}$/i.test(trimmed)) return true;
+  if (/^[A-Za-z0-9+/=_-]{48,}$/.test(trimmed) && /[A-Z]/.test(trimmed) && /[a-z]/.test(trimmed) && /\d/.test(trimmed)) {
+    return true;
+  }
+  return false;
+}
+function isObjectRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function requiredString(value, name) {
+  if (typeof value !== "string" || value.length === 0) throw new Error(`${name} is required.`);
+  return value;
+}
+function stringArg(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function numberArg(value, fallback) {
+  return typeof value === "number" && Number.isFinite(value) ? value : fallback;
+}
+function toolResult(data) {
+  return {
+    content: [{ type: "text", text: JSON.stringify(data, null, 2) }],
+    structuredContent: data
+  };
+}
+function toolError(error) {
+  return {
+    isError: true,
+    content: [
+      {
+        type: "text",
+        text: `Error: ${error.message ?? String(error)}`
+      }
+    ]
+  };
+}
+
+// src/http.ts
+function corsHeaders() {
+  return {
+    "access-control-allow-origin": "*",
+    "access-control-allow-methods": "GET,POST,OPTIONS",
+    "access-control-allow-headers": "authorization,content-type,mcp-session-id,mcp-protocol-version",
+    "access-control-expose-headers": "mcp-session-id"
+  };
+}
+function extractBearerToken(header) {
+  if (!header) return void 0;
+  const match = /^Bearer\s+(.+)$/i.exec(header.trim());
+  if (!match) {
+    throw new Error("Authorization must use Bearer authentication. Example: Authorization: Bearer sk_atoll_...");
+  }
+  return match[1];
+}
+function healthResponse() {
+  return {
+    status: 200,
+    headers: { "content-type": "application/json", ...corsHeaders() },
+    body: JSON.stringify({ ok: true, service: "atoll-mcp-server" })
+  };
+}
+function preflightResponse() {
+  return {
+    status: 204,
+    headers: corsHeaders(),
+    body: ""
+  };
+}
+function writeJson(res, status, payload) {
+  res.writeHead(status, { "content-type": "application/json", ...corsHeaders() });
+  res.end(JSON.stringify(payload));
+}
+async function handleMcpHttpRequest(req, res) {
+  if (req.method === "OPTIONS") {
+    const preflight = preflightResponse();
+    res.writeHead(preflight.status, preflight.headers);
+    res.end(preflight.body);
+    return;
+  }
+  if (req.url === "/health" && req.method === "GET") {
+    const health = healthResponse();
+    res.writeHead(health.status, health.headers);
+    res.end(health.body);
+    return;
+  }
+  if (req.url !== "/mcp") {
+    writeJson(res, 404, { error: "Not found. Use POST /mcp for MCP requests or GET /health." });
+    return;
+  }
+  if (req.method !== "POST") {
+    writeJson(res, 405, {
+      jsonrpc: "2.0",
+      error: { code: -32e3, message: "Method not allowed. Use POST /mcp." },
+      id: null
+    });
+    return;
+  }
+  try {
+    const token = extractBearerToken(req.headers.authorization);
+    if (token) {
+      req.auth = {
+        token,
+        clientId: "atoll-mcp-client",
+        scopes: []
+      };
+    }
+    const { server } = createAtollMcpServer();
+    const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: void 0 });
+    await server.connect(transport);
+    for (const [key, value] of Object.entries(corsHeaders())) {
+      res.setHeader(key, value);
+    }
+    res.on("close", () => {
+      void transport.close();
+      void server.close();
+    });
+    await transport.handleRequest(req, res);
+  } catch (error) {
+    if (!res.headersSent) {
+      writeJson(res, 500, {
+        jsonrpc: "2.0",
+        error: {
+          code: -32603,
+          message: error.message
+        },
+        id: null
+      });
+    }
+  }
+}
+function createAtollHttpServer() {
+  return createServer((req, res) => {
+    void handleMcpHttpRequest(req, res);
+  });
+}
+
+// src/index.ts
+async function main() {
+  const args = new Set(process.argv.slice(2));
+  if (args.has("--stdio")) {
+    const { server: server2 } = createAtollMcpServer();
+    await server2.connect(new StdioServerTransport());
+    return;
+  }
+  const port = Number.parseInt(process.env.PORT ?? "8787", 10);
+  const server = createAtollHttpServer();
+  server.listen(port, () => {
+    console.error(`atoll-mcp-server listening on http://127.0.0.1:${port}/mcp`);
+  });
+}
+if (import.meta.url === `file://${process.argv[1]}`) {
+  main().catch((error) => {
+    console.error(error);
+    process.exit(1);
+  });
+}
+export {
+  AtollApiClient,
+  createAtollHttpServer,
+  createAtollMcpServer,
+  extractBearerToken,
+  handleMcpHttpRequest,
+  healthResponse,
+  listAtollToolNames,
+  resolveAuthToken,
+  resolveOrgId
+};
+//# sourceMappingURL=index.js.map