@barivia/barsom-mcp 0.10.2 → 0.10.5

package/README.md

@@ -27,6 +27,8 @@ MCP clients typically run it with **`npx`** (downloads on first use):
 
 **Verify:** `npm view @barivia/barsom-mcp version`
 
+**Audit logging (0.10.3+):** Each tool invocation emits a structured **`mcp_tool_call`** line on stderr for support correlation — not sent to the Barivia API. Fields: `tool`, `action`, `duration_ms`, `outcome`, **`rid`** (matches API `X-Request-ID`), **`job_id`** / **`dataset_id`** when the action returns or accepts them, scale hints **`grid_x`** / **`grid_y`** on training submits, and **`timeout_hit`** / **`output_truncated`** when proxy fetch/output limits apply. No API keys or file paths. Grep client stderr alongside API/worker logs by `rid`; see `docs/OPERATIONS_MANUAL.md` §5b.
+
 **Also available:** hosted HTTP MCP at **`https://mcp.barivia.se/mcp`** (same API key; no npm) for clients that support remote MCP.
 
 **Cursor / multi-account note:** Cursor's tool dispatcher resolves tools under a `serverIdentifier` (e.g. `user-barivia-bbb-maps`), which can differ from the key you wrote in `mcp.json` (e.g. `barivia-bbb-maps`). If a tool call fails with **"server does not exist"** or similar, list the resolved identifier with your client's tool inspector (`mcp.list-tools` or equivalent) and use that identifier — not the `mcp.json` key.
@@ -98,7 +100,7 @@ Call at the **start of mapping work** (or when the user asks what the MCP can do
 | Action | Use when |
 |--------|----------|
 | `train_map` | Submitting a new map training job — full control: model type, grid, epochs, cyclic/temporal features, transforms. Returns `job_id`; poll with `jobs(action=status, job_id=...)`. Complete-case data only (no NaNs in training columns). |
-| `train_impute` | Sparse training data: accelerated missSOM / SIOM missSOM — trains a map and imputes missing cells in one job. Defaults: `model=auto`, `cv_folds=5`. Returns map artifacts + `imputed.csv`, `imputation_mask.csv`, optional `quality.csv` / `imputation_uncertainty.csv`. Plain numeric columns only. Valid parent for `inference(impute_column)`. |
+| `train_impute` | Sparse training data: accelerated missSOM / SIOM missSOM — trains a map and imputes missing cells in one job. Defaults: `model=auto`, `cv_folds=5`. Returns map artifacts + `imputed.csv`, `imputation_mask.csv`, optional `quality.csv` / `imputation_uncertainty.csv`. `quality.csv` reports two labeled numbers per column: `kfold_holdout_pool` (honest held-out) and `resubstitution_optimistic` (in-sample, optimistic — not validation). Plain numeric columns only. Valid parent for `inference(impute_column)`. |
 | `train_siom_map` | Submitting a self-interacting map training job — same grid-map workflow plus SIOM controls such as `gamma`, `siom_decay`, and penalty selection. |
 | `train_floop_siom` | Submitting a FLooP-SIOM job — growing node-budget manifold; default `topology=free` (CHL); optional `topology=chain` for strict 1D linked list. |
 | `train_floop_chain` | Deprecated alias for `train_floop_siom` — same behavior. |
@@ -200,7 +202,7 @@ MCP Client (Cursor/Claude) ←stdio→ @barivia/barsom-mcp ←HTTPS→ api.bariv
 
 | Symptom | What to check |
 |--------|----------------|
-| `401` / invalid key | `BARIVIA_API_KEY` in MCP config; regenerate or verify at [barivia.se](https://barivia.se). Error text includes a **request id** for support. |
+| `401` / invalid key | `BARIVIA_API_KEY` in MCP config; check your email or manage your key in the [account dashboard](https://barivia.se/dashboard). Error text includes a **request id** for support. |
 | Request timed out | Raise `BARIVIA_FETCH_TIMEOUT_MS` (e.g. `120000`). Large uploads already use an extended timeout. |
 | `Path must be within the workspace` / upload can’t find file | Set `BARIVIA_WORKSPACE_ROOT` to your project directory, or use an absolute path / `file:///...` URI. |
 | Job stuck “running” | Poll `jobs(action=status)` every 10–15s; large grids or FLooP-SIOM can take several minutes—not an MCP error. |

package/dist/audit.js

@@ -0,0 +1,169 @@
+/**
+ * MCP tool audit wrapper — tool name, action, latency, outcome; no secrets.
+ */
+import { logAudit } from "./logger.js";
+/** Keys safe to include in audit param summaries (no paths, keys, or bodies). */
+const AUDIT_PARAM_KEYS = new Set([
+    "action",
+    "job_type",
+    "model",
+    "preset",
+    "backend",
+    "output_format",
+    "figures",
+    "job_id",
+    "dataset_id",
+    "compare",
+    "topology",
+    "viz_mode",
+    "grid_x",
+    "grid_y",
+]);
+function scrubParams(args) {
+    const out = {};
+    for (const [k, v] of Object.entries(args)) {
+        if (!AUDIT_PARAM_KEYS.has(k))
+            continue;
+        if (v === undefined || v === null)
+            continue;
+        if (typeof v === "string" || typeof v === "number" || typeof v === "boolean") {
+            out[k] = v;
+        }
+    }
+    const grid = args.grid;
+    if (Array.isArray(grid) && grid.length >= 2) {
+        if (out.grid_x === undefined && typeof grid[0] === "number")
+            out.grid_x = grid[0];
+        if (out.grid_y === undefined && typeof grid[1] === "number")
+            out.grid_y = grid[1];
+    }
+    return out;
+}
+function extractIds(result) {
+    const ids = {};
+    if (result === null || typeof result !== "object")
+        return ids;
+    const r = result;
+    if (typeof r.job_id === "string")
+        ids.job_id = r.job_id;
+    if (typeof r.id === "string" && !ids.job_id)
+        ids.job_id = r.id;
+    if (typeof r.dataset_id === "string")
+        ids.dataset_id = r.dataset_id;
+    const sc = r.structuredContent;
+    if (sc && typeof sc === "object") {
+        const s = sc;
+        if (typeof s.jobId === "string")
+            ids.job_id = s.jobId;
+        if (typeof s.datasetId === "string")
+            ids.dataset_id = s.datasetId;
+    }
+    try {
+        const text = JSON.stringify(result);
+        const jobMatch = text.match(/"job_id"\s*:\s*"([a-f0-9-]{36})"/i);
+        if (jobMatch && !ids.job_id)
+            ids.job_id = jobMatch[1];
+        const dsMatch = text.match(/"dataset_id"\s*:\s*"([a-f0-9-]{36})"/i);
+        if (dsMatch && !ids.dataset_id)
+            ids.dataset_id = dsMatch[1];
+    }
+    catch {
+        /* ignore */
+    }
+    return ids;
+}
+function extractAuditExtras(result) {
+    const extras = {};
+    if (result === null || typeof result !== "object")
+        return extras;
+    const r = result;
+    const audit = r._audit;
+    if (audit && typeof audit === "object") {
+        const a = audit;
+        if (a.timeout_hit === true)
+            extras.timeout_hit = true;
+        if (a.output_truncated === true)
+            extras.output_truncated = true;
+    }
+    try {
+        const text = JSON.stringify(result);
+        if (/Poll with jobs\(action=status/i.test(text))
+            extras.timeout_hit = true;
+        if (/_truncated\s*:\s*true/i.test(text))
+            extras.output_truncated = true;
+    }
+    catch {
+        /* ignore */
+    }
+    return extras;
+}
+function stripAuditMeta(result) {
+    if (result === null || typeof result !== "object" || Array.isArray(result))
+        return result;
+    if (!("_audit" in result))
+        return result;
+    const copy = { ...result };
+    delete copy._audit;
+    return copy;
+}
+function errorCodeFrom(err) {
+    if (err && typeof err === "object") {
+        const e = err;
+        if (e.httpStatus !== undefined)
+            return `http_${e.httpStatus}`;
+        const m = e.message ?? "";
+        const codeMatch = m.match(/error_code:\s*(\w+)/);
+        if (codeMatch)
+            return codeMatch[1];
+    }
+    return undefined;
+}
+/**
+ * Run a tool handler with structured audit logging.
+ */
+export async function runMcpToolAudit(tool, action, args, handler) {
+    const t0 = Date.now();
+    const params = scrubParams(args);
+    try {
+        const raw = await handler();
+        const result = stripAuditMeta(raw);
+        const ids = extractIds(result);
+        const extras = extractAuditExtras(raw);
+        logAudit({
+            tool,
+            action,
+            duration_ms: Date.now() - t0,
+            outcome: "ok",
+            ...ids,
+            ...(extras.timeout_hit ? { timeout_hit: true } : {}),
+            ...(extras.output_truncated ? { output_truncated: true } : {}),
+            ...(Object.keys(params).length > 0 ? { params } : {}),
+        });
+        return result;
+    }
+    catch (err) {
+        logAudit({
+            tool,
+            action,
+            duration_ms: Date.now() - t0,
+            outcome: "error",
+            error_code: errorCodeFrom(err),
+            ...(Object.keys(params).length > 0 ? { params } : {}),
+        });
+        throw err;
+    }
+}
+/**
+ * Register an MCP tool with structured audit logging on each invocation.
+ */
+export function registerAuditedTool(server, name, description, schema, handler) {
+    server.tool(name, description, schema, (async (args) => {
+        const rec = args;
+        const action = typeof rec.action === "string" && rec.action.length > 0 ? rec.action : "default";
+        return runMcpToolAudit(name, action, rec, () => handler(args));
+    }));
+}
+/** Attach audit flags to a tool result (stripped before returning to MCP client). */
+export function withAuditFlags(result, flags) {
+    return { ...result, _audit: flags };
+}

package/dist/index.js

@@ -1,2 +1,2 @@
 #!/usr/bin/env node
-import{McpServer as e}from"@modelcontextprotocol/sdk/server/mcp.js";import{StdioServerTransport as t}from"@modelcontextprotocol/sdk/server/stdio.js";import{z as o}from"zod";import{getUiCapability as r,registerAppResource as n,RESOURCE_MIME_TYPE as s}from"@modelcontextprotocol/ext-apps/server";import{startVizServer as a}from"./viz-server.js";import{API_KEY as i,apiCall as l,apiRawCall as p,loadViewHtml as c,setVizPort as m,setClientSupportsMcpApps as d,CLIENT_VERSION as u}from"./shared.js";import{registerDatasetsTool as f}from"./tools/datasets.js";import{registerJobsTool as g,JOBS_DESCRIPTION_BASE as _}from"./tools/jobs.js";import{registerResultsTool as b}from"./tools/results.js";import{registerExploreMapTool as h,RESULTS_EXPLORER_URI as y}from"./tools/explore_map.js";import{registerAccountTool as w}from"./tools/account.js";import{registerInferenceTool as j}from"./tools/inference.js";import{registerGuideBarsomTool as v}from"./tools/guide_barsom.js";import{registerTrainingGuidanceTool as P}from"./tools/training_guidance.js";import{registerFeedbackTool as x}from"./tools/feedback.js";import{registerTrainingPrepTools as I,TRAINING_PREP_URI as k}from"./tools/training_prep.js";import{registerTrainingMonitorTool as M,TRAINING_MONITOR_URI as O}from"./tools/training_monitor.js";import{resolvePrepareTrainingPromptText as S}from"./prepare_training_prompt.js";i||(console.error("Error: BARIVIA_API_KEY not set. Set it in your MCP client config."),process.exit(1));const A=new e({name:"analytics-engine",version:u,instructions:'# Barivia Mapping Analytics Engine\n\nSelf-organizing map (SOM) analytics: project high-dimensional data to a 2D grid for clusters, gradients, and anomalies.\n\n## Workflow (short)\n\nUpload (`datasets(upload)`) → `datasets(preview)` and `datasets(analyze)` before train → submit one of `jobs(train_map)`, `jobs(train_siom_map)`, or `jobs(train_floop_siom)` (only if plan allows FLooP) → poll `jobs(status)` every 10–15s until `completed` → `results(get)` for metrics and figures (there is no separate analyze tool). Then `jobs(compare)`, `results(download/recolor/transition_flow)`, or `inference` as needed.\n\n**Full detail:** Call `guide_barsom_workflow` for plan-scoped tool map, training modes, async rules, optional MCP App UIs, and step-by-step SOP (from the Barivia API when online).\n\n## Tool map (compact)\n\n| Area | Tool | Notes |\n|------|------|--------|\n| Data | `datasets` | upload, preview, analyze, list, subset, add_expression, reduce_spectral (pca/log_sample/uniform_sample/stats for long ordered numeric blocks), delete |\n| Jobs | `jobs` | train_map, train_siom_map, train_floop_siom (entitled), status, list, compare, cancel, delete, batch_predict, run_baseline_study; `train_floop_chain` = deprecated alias for train_floop_siom |\n| Results | `results` | get (figures="none" for metrics-only), export, download, recolor (async), transition_flow (async; time-ordered rows only) |\n| Inference | `inference` | predict (regime-aware; output="compact"|"annotated"), impute_column (neighbor-pool fill for a non-training column), compare, project_columns, report |\n| Account | `account` | status, burst/compute actions, history, add_funds |\n| Bootstrap | `guide_barsom_workflow` | orientation + SOP |\n| Parameters | `training_guidance` | presets and field hints (API-scoped) |\n| Prep | `prepare_training` prompt, `training_prep` + `submit_prepared_training` | checklist / interactive UI |\n| Explore | `results_explorer`, `training_monitor` | optional MCP Apps; `explore_map` = deprecated alias of `results_explorer`; `jobs(status)` and `results(get)` suffice without them |\n| Other | `send_feedback` | only after user agrees |\n\n## Async pattern\n\n- **Manual poll:** Training submits return `job_id` immediately — poll `jobs(status)` every 10–15s. **Running is not failed**; large grids or FLooP-SIOM can take many minutes. `max_nodes` (FLooP) is a total node budget, not grid side length.\n- **Often auto-polled:** `inference` actions, `results(recolor)`, `results(transition_flow)` may wait in-proxy; if you get a `job_id`, poll `jobs(status)` the same way.\n\nCredits: jobs consume compute credits; check `account(status)` before big runs. Slow networks: users can raise `BARIVIA_FETCH_TIMEOUT_MS`.\n\n## Constraints\n\n- Prep ladder: `prepare_training` prompt = narrative checklist; `training_guidance` = structured hints; `training_prep` = UI + guarded submit. Do not guess tiers or FLooP entitlement.\n- `inference(predict)`: prefer `dataset_id` for batch and for SIOM/irregular maps; single-row `rows` uses a fast path that can fail on some topologies — retry with `dataset_id`. FLooP-SIOM: if predict jobs fail while grid SIOM works, capture errors + `job_id`.\n- Column names are case-sensitive — match `datasets(preview)`.\n- Default training path is numeric/cyclic/temporal; use explicit `categorical_features` for baseline categoricals. `predict` must match the model contract.\n- After `recolor`, `transition_flow`, or `project_columns`, use the **new** `job_id` returned for follow-up `results` if applicable.'});n(A,y,y,{mimeType:s},async()=>{const e=await c("results-explorer");return{contents:[{uri:y,mimeType:s,text:e??"<html><body>Results Explorer view not built yet. Run: npm run build:views</body></html>"}]}}),n(A,k,k,{mimeType:s},async()=>{const e=await c("training-prep");return{contents:[{uri:k,mimeType:s,text:e??"<html><body>Training Preparation view not built yet.</body></html>"}]}}),n(A,O,O,{mimeType:s},async()=>{const e=await c("training-monitor");return{contents:[{uri:O,mimeType:s,text:e??"<html><body>Training Monitor view not built yet.</body></html>"}]}}),v(A),h(A),I(A),M(A),f(A),g(A,_),b(A),w(A),j(A),P(A),x(A),A.prompt("info","Short orientation for the Barivia Mapping MCP. For full plan-scoped workflow, tool map, and SOP, the model should call guide_barsom_workflow. Use when the user asks what this MCP can do or how to get started.",{},()=>({messages:[{role:"user",content:{type:"text",text:["Give a concise, scannable answer (headers + bullets):","","**What it is:** MCP client to the Barivia mapping engine (2D SOM / SIOM / FLooP-SIOM when entitled) over HTTPS.","","**First step:** Call `guide_barsom_workflow` for plan-scoped bootstrap (full tool list, async rules, training modes, optional MCP Apps, SOP).","","**Core path:** `datasets(upload)` → `datasets(preview)` + `datasets(analyze)` → choose training action → poll `jobs(status)` every 10–15s until completed → `results(get)` (all main figures/metrics; no separate analyze tool).","",'**Key tools:** `datasets` (data; reduce_spectral for spectra/long blocks), `jobs` (train/poll/compare/…; train_map accepts an optional `label` for readable compare rows), `results` (get/download/export/recolor/transition_flow; figures="none" for metrics-only), `inference` (predict; impute_column for topology-neighbor pool fill; compare; project_columns; report), `account` (status/credits/queue).',"","**Prep help:** `prepare_training` prompt (checklist) · `training_guidance` (presets/JSON hints) · `training_prep` + `submit_prepared_training` (interactive UI).","","**Optional UI:** `results_explorer`, `training_monitor` — nice for browsing; not required if you use `results` + `jobs(status)`.","","**After training:** `jobs(compare)` across runs, `results(recolor)`, `inference(project_columns)` for variables not in training, `transition_flow` only if rows are time-ordered.","","**Rules:** Running ≠ failed. Column names must match `datasets(preview)` exactly. Do not call `_fetch_figure` from chat (host/UI only); use `results(get)` or `results_explorer`.","","Offer `send_feedback` only after asking the user."].join("\n")}}]})),A.prompt("prepare_training","Narrative pre-training checklist (prompt). Use after upload and before train. Content is tier-scoped from the API when online. Prep ladder: this prompt = story checklist; training_guidance tool = JSON presets/parameter hints; training_prep tool = interactive UI + submit_prepared_training.",{dataset_id:o.string().describe("Dataset ID to prepare for training")},async({dataset_id:e})=>({messages:[{role:"user",content:{type:"text",text:await S(e)}}]}));const T=new t;(async function(){try{const e=await a(l,p,c);m(e)}catch(e){process.env.BARIVIA_VIZ_PORT&&console.error("Barivia viz server failed to start:",e)}const e=A.server;e.oninitialized=()=>{const t=e.getClientCapabilities(),o=r(t);d(!!o?.mimeTypes?.includes(s))},await A.connect(T)})().catch(console.error);
+import{McpServer as e}from"@modelcontextprotocol/sdk/server/mcp.js";import{StdioServerTransport as t}from"@modelcontextprotocol/sdk/server/stdio.js";import{z as o}from"zod";import{getUiCapability as r,registerAppResource as n,RESOURCE_MIME_TYPE as s}from"@modelcontextprotocol/ext-apps/server";import{startVizServer as a}from"./viz-server.js";import{API_KEY as i,apiCall as l,apiRawCall as p,loadViewHtml as c,setVizPort as m,setClientSupportsMcpApps as d,CLIENT_VERSION as u}from"./shared.js";import{registerDatasetsTool as f}from"./tools/datasets.js";import{registerJobsTool as g,JOBS_DESCRIPTION_BASE as _}from"./tools/jobs.js";import{registerResultsTool as b}from"./tools/results.js";import{registerExploreMapTool as h,RESULTS_EXPLORER_URI as y}from"./tools/explore_map.js";import{registerAccountTool as w}from"./tools/account.js";import{registerInferenceTool as j}from"./tools/inference.js";import{registerGuideBarsomTool as v}from"./tools/guide_barsom.js";import{registerTrainingGuidanceTool as P}from"./tools/training_guidance.js";import{registerFeedbackTool as x}from"./tools/feedback.js";import{registerTrainingPrepTools as I,TRAINING_PREP_URI as k}from"./tools/training_prep.js";import{registerTrainingMonitorTool as M,TRAINING_MONITOR_URI as O}from"./tools/training_monitor.js";import{resolvePrepareTrainingPromptText as S}from"./prepare_training_prompt.js";i||(console.error("Error: BARIVIA_API_KEY not set. Set it in your MCP client config."),process.exit(1));const A=new e({name:"analytics-engine",version:u,instructions:'# Barivia Mapping Analytics Engine\n\nSelf-organizing map (SOM) analytics: project high-dimensional data to a 2D grid for clusters, gradients, and anomalies.\n\n## Workflow (short)\n\nUpload (`datasets(upload)`) → `datasets(preview)` and `datasets(analyze)` before train → submit one of `jobs(train_map)`, `jobs(train_siom_map)`, or `jobs(train_floop_siom)` (only if plan allows FLooP) → poll `jobs(status)` every 10–15s until `completed` → `results(get)` for metrics and figures (there is no separate analyze tool). Then `jobs(compare)`, `results(download/recolor/transition_flow)`, or `inference` as needed.\n\n**Full detail:** Call `guide_barsom_workflow` for plan-scoped tool map, training modes, async rules, optional MCP App UIs, and step-by-step SOP (from the Barivia API when online).\n\n## Tool map (compact)\n\n| Area | Tool | Notes |\n|------|------|--------|\n| Data | `datasets` | upload, preview, analyze, list, subset, add_expression, reduce_spectral (pca/log_sample/uniform_sample/stats for long ordered numeric blocks), delete |\n| Jobs | `jobs` | train_map, train_impute (sparse data: map + dense imputed.csv), train_siom_map, train_floop_siom (entitled), status, list, compare, cancel, delete, batch_predict, run_baseline_study; `train_floop_chain` = deprecated alias for train_floop_siom |\n| Results | `results` | get (figures="none" for metrics-only), export, download, recolor (async), transition_flow (async; time-ordered rows only) |\n| Inference | `inference` | predict (regime-aware; output="compact"|"annotated"), impute_column (neighbor-pool fill for a non-training column), compare, project_columns, report |\n| Account | `account` | status, burst/compute actions, history, add_funds |\n| Bootstrap | `guide_barsom_workflow` | orientation + SOP |\n| Parameters | `training_guidance` | presets and field hints (API-scoped) |\n| Prep | `prepare_training` prompt, `training_prep` + `submit_prepared_training` | checklist / interactive UI |\n| Explore | `results_explorer`, `training_monitor` | optional MCP Apps; `explore_map` = deprecated alias of `results_explorer`; `jobs(status)` and `results(get)` suffice without them |\n| Other | `send_feedback` | only after user agrees |\n\n## Async pattern\n\n- **Manual poll:** Training submits return `job_id` immediately — poll `jobs(status)` every 10–15s. **Running is not failed**; large grids or FLooP-SIOM can take many minutes. `max_nodes` (FLooP) is a total node budget, not grid side length.\n- **Often auto-polled:** `inference` actions, `results(recolor)`, `results(transition_flow)` may wait in-proxy; if you get a `job_id`, poll `jobs(status)` the same way.\n\nCredits: jobs consume compute credits; check `account(status)` before big runs. Slow networks: users can raise `BARIVIA_FETCH_TIMEOUT_MS`.\n\n## Constraints\n\n- Prep ladder: `prepare_training` prompt = narrative checklist; `training_guidance` = structured hints; `training_prep` = UI + guarded submit. Do not guess tiers or FLooP entitlement.\n- `inference(predict)`: prefer `dataset_id` for batch and for SIOM/irregular maps; single-row `rows` uses a fast path that can fail on some topologies — retry with `dataset_id`. FLooP-SIOM: if predict jobs fail while grid SIOM works, capture errors + `job_id`.\n- Column names are case-sensitive — match `datasets(preview)`.\n- Default training path is numeric/cyclic/temporal; use explicit `categorical_features` for baseline categoricals. `predict` must match the model contract.\n- After `recolor`, `transition_flow`, or `project_columns`, use the **new** `job_id` returned for follow-up `results` if applicable.'});n(A,y,y,{mimeType:s},async()=>{const e=await c("results-explorer");return{contents:[{uri:y,mimeType:s,text:e??"<html><body>Results Explorer view not built yet. Run: npm run build:views</body></html>"}]}}),n(A,k,k,{mimeType:s},async()=>{const e=await c("training-prep");return{contents:[{uri:k,mimeType:s,text:e??"<html><body>Training Preparation view not built yet.</body></html>"}]}}),n(A,O,O,{mimeType:s},async()=>{const e=await c("training-monitor");return{contents:[{uri:O,mimeType:s,text:e??"<html><body>Training Monitor view not built yet.</body></html>"}]}}),v(A),h(A),I(A),M(A),f(A),g(A,_),b(A),w(A),j(A),P(A),x(A),A.prompt("info","Short orientation for the Barivia Mapping MCP. For full plan-scoped workflow, tool map, and SOP, the model should call guide_barsom_workflow. Use when the user asks what this MCP can do or how to get started.",{},()=>({messages:[{role:"user",content:{type:"text",text:["Give a concise, scannable answer (headers + bullets):","","**What it is:** MCP client to the Barivia mapping engine (2D SOM / SIOM / FLooP-SIOM when entitled) over HTTPS.","","**First step:** Call `guide_barsom_workflow` for plan-scoped bootstrap (full tool list, async rules, training modes, optional MCP Apps, SOP).","","**Core path:** `datasets(upload)` → `datasets(preview)` + `datasets(analyze)` → choose training action → poll `jobs(status)` every 10–15s until completed → `results(get)` (all main figures/metrics; no separate analyze tool).","",'**Key tools:** `datasets` (data; reduce_spectral for spectra/long blocks), `jobs` (train/poll/compare/…; train_map accepts an optional `label` for readable compare rows), `results` (get/download/export/recolor/transition_flow; figures="none" for metrics-only), `inference` (predict; impute_column for topology-neighbor pool fill; compare; project_columns; report), `account` (status/credits/queue).',"","**Prep help:** `prepare_training` prompt (checklist) · `training_guidance` (presets/JSON hints) · `training_prep` + `submit_prepared_training` (interactive UI).","","**Optional UI:** `results_explorer`, `training_monitor` — nice for browsing; not required if you use `results` + `jobs(status)`.","","**After training:** `jobs(compare)` across runs, `results(recolor)`, `inference(project_columns)` for variables not in training, `transition_flow` only if rows are time-ordered.","","**Rules:** Running ≠ failed. Column names must match `datasets(preview)` exactly. Do not call `_fetch_figure` from chat (host/UI only); use `results(get)` or `results_explorer`.","","Offer `send_feedback` only after asking the user."].join("\n")}}]})),A.prompt("prepare_training","Narrative pre-training checklist (prompt). Use after upload and before train. Content is tier-scoped from the API when online. Prep ladder: this prompt = story checklist; training_guidance tool = JSON presets/parameter hints; training_prep tool = interactive UI + submit_prepared_training.",{dataset_id:o.string().describe("Dataset ID to prepare for training")},async({dataset_id:e})=>({messages:[{role:"user",content:{type:"text",text:await S(e)}}]}));const T=new t;(async function(){try{const e=await a(l,p,c);m(e)}catch(e){process.env.BARIVIA_VIZ_PORT&&console.error("Barivia viz server failed to start:",e)}const e=A.server;e.oninitialized=()=>{const t=e.getClientCapabilities(),o=r(t);d(!!o?.mimeTypes?.includes(s))},await A.connect(T)})().catch(console.error);

package/dist/logger.js

@@ -0,0 +1,40 @@
+/**
+ * Structured stdout/stderr logging for the MCP proxy (Docker json-file friendly).
+ */
+const SERVICE_NAME = process.env.BARIVIA_SERVICE_NAME ?? process.env.BARSOM_SERVICE_NAME ?? "mcp-proxy";
+const LOG_FORMAT = (process.env.BARIVIA_LOG_FORMAT ?? process.env.BARSOM_LOG_FORMAT ?? "text").toLowerCase();
+function emit(fields) {
+    const level = fields.level ?? "info";
+    const payload = {
+        ts: new Date().toISOString(),
+        level,
+        service: SERVICE_NAME,
+        ...fields,
+    };
+    delete payload.level;
+    if (LOG_FORMAT === "json") {
+        console.error(JSON.stringify(payload));
+        return;
+    }
+    const parts = [`${payload.ts} ${level.toUpperCase().padEnd(5)} ${fields.msg}`];
+    for (const [k, v] of Object.entries(payload)) {
+        if (k === "ts" || k === "msg" || k === "service")
+            continue;
+        if (v !== undefined && v !== null && v !== "") {
+            parts.push(`${k}=${String(v)}`);
+        }
+    }
+    console.error(parts.join(" | "));
+}
+export function logInfo(msg, fields = {}) {
+    emit({ ...fields, level: "info", msg });
+}
+export function logWarn(msg, fields = {}) {
+    emit({ ...fields, level: "warn", msg });
+}
+export function logError(msg, fields = {}) {
+    emit({ ...fields, level: "error", msg });
+}
+export function logAudit(fields) {
+    emit({ ...fields, event: "mcp_tool_call", level: "info", msg: "mcp_tool_call" });
+}

package/dist/shared.js

@@ -4,6 +4,7 @@
 import fs from "node:fs/promises";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { logInfo } from "./logger.js";
 // ---------------------------------------------------------------------------
 // Config
 // ---------------------------------------------------------------------------
@@ -19,9 +20,11 @@ export const RETRYABLE_STATUS = new Set([502, 503, 504]);
  * X-Barsom-Client-Version so the server can annotate tool guidance with the
  * wrapper version each action requires. Keep in sync with package.json on bump.
  */
-export const CLIENT_VERSION = "0.10.2";
+export const CLIENT_VERSION = "0.10.5";
 /** User-facing links; keep aligned with barivia.se / api.barivia.se. */
 export const PUBLIC_SITE_ORIGIN = "https://barivia.se";
+/** Self-serve account dashboard (manage plan, billing, and API keys). */
+export const PUBLIC_DASHBOARD_URL = `${PUBLIC_SITE_ORIGIN}/dashboard`;
 /** Poll window for datasets(add_expression) / derive jobs (server-side work can exceed 30s). */
 export const POLL_DERIVE_MAX_MS = 120_000;
 /** Large CSV uploads may exceed default FETCH_TIMEOUT_MS. */
@@ -219,7 +222,7 @@ export function formatApiErrorMessage(status, bodyText, requestId) {
     const detail = (parsed?.error != null && String(parsed.error)) ||
         (bodyText.trim() ? bodyText.trim() : `HTTP ${status}`);
     const code = parsed?.error_code != null ? ` (error_code: ${parsed.error_code})` : "";
-    const accountHint = ` Regenerate or verify your key via ${PUBLIC_SITE_ORIGIN} if needed.`;
+    const accountHint = ` Check your email or manage your key at ${PUBLIC_DASHBOARD_URL} if needed.`;
     const hint = status === 400
         ? " Check parameter types and required fields."
         : status === 401
@@ -227,7 +230,7 @@ export function formatApiErrorMessage(status, bodyText, requestId) {
             : status === 403
                 ? ` Access denied for this operation (plan or permissions).${accountHint}`
                 : status === 402
-                    ? ` Credits or subscription may be insufficient — see ${PUBLIC_SITE_ORIGIN}.`
+                    ? ` Credits or subscription may be insufficient — upgrade at ${PUBLIC_DASHBOARD_URL}.`
                     : status === 404
                         ? " The resource may not exist or may have been deleted."
                         : status === 409
@@ -277,7 +280,7 @@ export async function apiCall(method, path, body, extraHeaders, requestTimeoutMs
     }
     const effectiveTimeout = requestTimeoutMs ?? FETCH_TIMEOUT_MS;
     const t0 = Date.now();
-    console.error(`${new Date().toISOString()} API -> ${method} ${path} rid=${requestId}`);
+    logInfo("API request", { rid: requestId, method, path });
     let lastError;
     for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
         try {
@@ -292,10 +295,19 @@ export async function apiCall(method, path, body, extraHeaders, requestTimeoutMs
                     await new Promise((r) => setTimeout(r, 1000 * 2 ** attempt));
                     continue;
                 }
-                console.error(`${new Date().toISOString()} API <- ${resp.status} ${Date.now() - t0}ms rid=${requestId}`);
+                logInfo("API response", {
+                    rid: requestId,
+                    outcome: "error",
+                    duration_ms: Date.now() - t0,
+                    error_code: `http_${resp.status}`,
+                });
                 throwApiError(resp.status, text, requestId);
             }
-            console.error(`${new Date().toISOString()} API <- ${resp.status} ${Date.now() - t0}ms rid=${requestId}`);
+            logInfo("API response", {
+                rid: requestId,
+                outcome: "ok",
+                duration_ms: Date.now() - t0,
+            });
             return JSON.parse(text);
         }
         catch (err) {

package/dist/tools/account.js

@@ -1,7 +1,8 @@
 import { z } from "zod";
+import { registerAuditedTool } from "../audit.js";
 import { apiCall } from "../shared.js";
 export function registerAccountTool(server) {
-    server.tool("account", `Manage your Barivia account — check plan/license info, request cloud burst compute, view billing history.
+    registerAuditedTool(server, "account", `Manage your Barivia account — check plan/license info, request cloud burst compute, view billing history.
 
 | Action | Use when |
 |--------|----------|
@@ -37,8 +38,11 @@ NOT FOR: Training itself — use jobs(action=train_map). This tool only manages
             const leaseData = await apiCall("GET", "/v1/compute/lease").catch(() => null);
             const algoNames = {
                 train_som: "SOM",
+                train_impute: "Imputation",
                 train_siom: "SIOM",
                 train_floop_siom: "FLooP-SIOM",
+                cfd_mesh_convergence: "CFD mesh-convergence",
+                cfd_richardson_gci: "CFD Richardson/GCI",
             };
             const algos = Array.isArray(plan.allowed_algorithms) && plan.allowed_algorithms.length > 0
                 ? plan.allowed_algorithms.map((a) => algoNames[a] ?? a).join(", ")

package/dist/tools/datasets.js

@@ -2,9 +2,10 @@ import path from "node:path";
 import fs from "node:fs/promises";
 import { gzipSync } from "node:zlib";
 import { z } from "zod";
+import { registerAuditedTool } from "../audit.js";
 import { apiCall, getWorkspaceRootAsync, resolveFilePathForUpload, textResult, pollUntilComplete, POLL_DERIVE_MAX_MS, UPLOAD_DATASET_TIMEOUT_MS, } from "../shared.js";
 export function registerDatasetsTool(server) {
-    server.tool("datasets", `Manage datasets: upload, preview, list, subset, add_expression, or delete.
+    registerAuditedTool(server, "datasets", `Manage datasets: upload, preview, list, subset, add_expression, or delete.
 
 | Action | Use when |
 |--------|----------|

package/dist/tools/explore_map.js

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { registerAppTool } from "@modelcontextprotocol/ext-apps/server";
+import { registerAuditedTool, runMcpToolAudit } from "../audit.js";
 import { apiCall, apiRawCall, getClientSupportsMcpApps, getVizPort, getCaptionForImage, getResultsImagesToFetch, mimeForFilename, structuredTextResult, tryAttachImage, } from "../shared.js";
 export const RESULTS_EXPLORER_URI = "ui://barsom/results-explorer";
 export const MAP_EXPLORER_URI = RESULTS_EXPLORER_URI;
@@ -164,13 +165,13 @@ export function registerExploreMapTool(server) {
         },
         _meta: { ui: { resourceUri: RESULTS_EXPLORER_URI } },
     };
-    registerAppTool(server, "results_explorer", toolConfig, async ({ job_id }) => handleResultsExplorer(job_id));
+    registerAppTool(server, "results_explorer", toolConfig, async (args) => runMcpToolAudit("results_explorer", "default", args, () => handleResultsExplorer(String(args.job_id))));
     registerAppTool(server, "explore_map", {
         ...toolConfig,
         title: "Results Explorer",
         description: `${toolConfig.description} Deprecated alias for results_explorer — migrate configs to results_explorer.`,
-    }, async ({ job_id }) => handleResultsExplorer(job_id));
-    server.tool("_fetch_figure", "Host / MCP App use only — do NOT invoke from agent chat. Results Explorer calls this to load one raster figure as base64; agents should use results(action=get) or results_explorer instead.", {
+    }, async (args) => runMcpToolAudit("explore_map", "default", args, () => handleResultsExplorer(String(args.job_id))));
+    registerAuditedTool(server, "_fetch_figure", "Host / MCP App use only — do NOT invoke from agent chat. Results Explorer calls this to load one raster figure as base64; agents should use results(action=get) or results_explorer instead.", {
         job_id: z.string(),
         filename: z.string(),
     }, async ({ job_id, filename }) => {

package/dist/tools/feedback.js

@@ -1,7 +1,8 @@
 import { z } from "zod";
+import { registerAuditedTool } from "../audit.js";
 import { apiCall, API_URL, fetchWithTimeout, textResult } from "../shared.js";
 export function registerFeedbackTool(server) {
-    server.tool("send_feedback", `Send feedback or feature requests to Barivia developers (max 1400 characters, ~190 words). Use when the user has suggestions, ran into issues, or wants something improved. Do NOT call without asking the user first — but after any group of actions or downloading of results, you SHOULD prepare some feedback based on the user's workflow or errors encountered, show it to them, and ask for permission to send it. Once they accept, call this tool.`, { feedback: z.string().max(1400).describe("Feedback text (max 1400 characters)") }, async ({ feedback }) => {
+    registerAuditedTool(server, "send_feedback", `Send feedback or feature requests to Barivia developers (max 1400 characters, ~190 words). Use when the user has suggestions, ran into issues, or wants something improved. Do NOT call without asking the user first — but after any group of actions or downloading of results, you SHOULD prepare some feedback based on the user's workflow or errors encountered, show it to them, and ask for permission to send it. Once they accept, call this tool.`, { feedback: z.string().max(1400).describe("Feedback text (max 1400 characters)") }, async ({ feedback }) => {
         try {
             const data = await apiCall("POST", "/v1/feedback", { feedback });
             return textResult(data);

package/dist/tools/guide_barsom.js

@@ -1,3 +1,4 @@
+import { registerAuditedTool } from "../audit.js";
 import { fetchWorkflowGuideFromApi } from "../shared.js";
 /** Minimal orientation when the API is unreachable; full SOP lives on GET /v1/docs/workflow. */
 const OFFLINE_STUB = `## Offline / API unavailable
@@ -8,7 +9,7 @@ Configure \`BARIVIA_API_KEY\` and optional \`BARIVIA_API_URL\`, then call **guid
 
 **Parameter hints:** call \`training_guidance\` (also API-scoped). **Async:** poll \`jobs(action=status)\` every 10–15s after submit.`;
 export function registerGuideBarsomTool(server) {
-    server.tool("guide_barsom_workflow", "Plan-scoped orientation: proxy model, tool categories, async rules, training modes, and step-by-step SOP — loaded from the Barivia API when online. Call at the start of mapping work. Offline: short stub. For field-level parameters, use training_guidance; for a narrative pre-train checklist, use the prepare_training prompt or training_prep.", {}, async () => {
+    registerAuditedTool(server, "guide_barsom_workflow", "Plan-scoped orientation: proxy model, tool categories, async rules, training modes, and step-by-step SOP — loaded from the Barivia API when online. Call at the start of mapping work. Offline: short stub. For field-level parameters, use training_guidance; for a narrative pre-train checklist, use the prepare_training prompt or training_prep.", {}, async () => {
         const md = await fetchWorkflowGuideFromApi();
         if (md) {
             const text = "Plan-scoped workflow (from Barivia API). Text below reflects your API key / plan.\n\n" + md;

package/dist/tools/inference.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { registerAuditedTool } from "../audit.js";
 import { apiCall, pollUntilComplete, tryAttachImage } from "../shared.js";
 const PREDICT_PREVIEW_ROW_CAP = 10;
 /** One line per scored row when worker embedded `predictions_preview` (n_rows ≤ cap). Exported for tests. */
@@ -30,7 +31,7 @@ export function formatPredictPreviewLines(summary) {
     return lines;
 }
 export function registerInferenceTool(server) {
-    server.tool("inference", `Use a trained map as a persistent inference artifact — score data, annotate the source CSV, compare datasets, project columns, or generate a report manifest.
+    registerAuditedTool(server, "inference", `Use a trained map as a persistent inference artifact — score data, annotate the source CSV, compare datasets, project columns, or generate a report manifest.
 
 | Action | Use when | Timing |
 |--------|----------|--------|
@@ -60,7 +61,7 @@ action=predict: Score rows against the trained map.
   Routing: prefer dataset_id for many rows or whenever the map uses irregular SIOM / GeneralTopology layouts — the async worker path is the supported batch scorer. Single-row rows take a fast stateless path that may return invalid_inference_input on some topologies; if so, retry with dataset_id (a one-row dataset is fine). FLooP-SIOM: use dataset_id predict first.
   When the scored set has at most ${PREDICT_PREVIEW_ROW_CAP} rows, completed responses include a short per-line preview in the tool text for chat agents.
 
-action=impute_column: Map-local imputation as read-only post-processing (the trained map is frozen; not a held-out validity claim). Requires dataset_id + target_column. The dataset must contain all training features (same names and cyclic expansion as predict) plus the target column. target_column must NOT have been in jobs(train_map) columns — train without it, then impute. Pools finite target values from rows whose BMUs lie on this row's BMU and its topology neighbors (BMU + neighbors, often 7 nodes on hex interior; fewer on borders if the parent map is non-periodic; periodic hex wraps), aggregated neighbourhood-distance-weighted by default (weighting="distance" — closer nodes count more; weighting="uniform" for a flat pool). Excludes the current row from its own pool. only_missing (default true): keep observed values. impute_aggregation: mean or median of the pool. Optional cv_folds (2-20) writes quality.csv (held-out MAE/RMSE/R2); target_column_kind handles categorical (mode) / cumulative (warns). Output imputed.csv: row_id, target_original, target_imputed, impute_source (observed | imputed | insufficient_data), bmu_node_index, n_patch_nodes, n_pool_rows, pool_std, pool_p5, pool_p95.
+action=impute_column: Map-local imputation on the frozen trained map (read-only; not a held-out validity claim). Requires dataset_id + target_column; the dataset must contain all training features (same names + cyclic expansion as predict) plus the target column. target_column must NOT have been a training feature. Pools finite target values from rows on this row's BMU and its topology neighbors (BMU + neighbors; ~7 on hex interior, fewer on non-periodic borders), neighbourhood-distance-weighted by default (weighting="uniform" for a flat pool); excludes the current row. only_missing (default true) keeps observed values; impute_aggregation mean|median. Optional cv_folds (2-20) → quality.csv (held-out MAE/RMSE/R2). target_column_kind: categorical (mode) / cumulative (warns). Output imputed.csv columns: row_id, target_original, target_imputed, impute_source (observed|imputed|insufficient_data), bmu_node_index, n_patch_nodes, n_pool_rows, pool_std, pool_p5, pool_p95.
 
 action=compare: dataset_id must refer to a dataset with the same feature set as training (same column names and preprocessing, including cyclic expansion). A = training dataset; B = cohort to compare. Density-diff: positive = B gained vs A; negative = A had more. Returns density-diff heatmap (e.g. density_diff.png).
 action=project_columns: Project one or more columns from a dataset onto the trained map. Pass dataset_id (the dataset containing the columns) and columns (array of column names). Uses cached BMUs when dataset is the training set; supports partial-feature mapping when dataset has only a subset of training features. Returns one component plane image per column. Get files via results(action=download, job_id=<returned_job_id>).

package/dist/tools/jobs.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { registerAuditedTool } from "../audit.js";
 import { apiCall, textResult } from "../shared.js";
 export const JOBS_DESCRIPTION_BASE = `Manage and inspect jobs.
 
@@ -32,7 +33,7 @@ ESCALATION (action=status):
   - NaN error on train_map: use jobs(action=train_impute) for sparse training columns, or clean the CSV for complete-case train_map
 
 action=train_map / train_siom_map: Submits a grid-map training job. Returns job_id — poll with jobs(action=status, job_id=...).
-action=train_impute: Submits missing-tolerant map training (accelerated missSOM / SIOM missSOM). Use when many cells are missing across training columns; use inference(impute_column) when you already have a complete-case map and need to fill one held-out column. Plain numeric columns only (no cyclic/temporal/categorical). Defaults: model=auto (SIOM on som_siom+ plans), cv_folds=5 → quality.csv (header feature). status returns progress_phase (ordering/convergence/cv/artifacts). High-dim auto policy: >40 features caps viz; >100 fast metrics; >200 GPU when entitled. Params: viz_mode, viz_top_components, emit_cell_uncertainty, quality_metrics. Artifacts: imputed.csv, imputation_mask.csv, optional imputation_uncertainty.csv. Completed train_impute job_id is a valid parent for inference(impute_column).
+action=train_impute: Submits missing-tolerant map training (accelerated missSOM / SIOM missSOM). Use when many cells are missing across training columns; use inference(impute_column) when you already have a complete-case map and need to fill one held-out column. Plain numeric columns only (no cyclic/temporal/categorical). Defaults: model=auto (SIOM on som_siom+ plans), cv_folds=5 → quality.csv. quality.csv reports two clearly-labeled numbers per column: kfold_holdout_pool (honest held-out) and resubstitution_optimistic (in-sample, optimistic). status returns progress_phase (e.g. ordering/convergence/cv/upload). High-dimensional datasets automatically adjust visualization density, metric set, and backend (call training_guidance for specifics). Params: viz_mode, viz_top_components, emit_cell_uncertainty, quality_metrics. Artifacts: imputed.csv, imputation_mask.csv, optional imputation_uncertainty.csv. Completed train_impute job_id is a valid parent for inference(impute_column).
   Presets: quick | standard | refined | high_res — use preset=... for grid/epochs/batch defaults; call training_guidance for details.
   Presets refined/high_res may use GPU. On CPU-only hosts pass backend=cpu. API expects strings "cpu" | "gpu" | "gpu_graphs" (no colon). Future backends (e.g. non-CUDA) may be added under the same contract.
   normalize: "auto" (default) = scale only non-cyclic features; "all" = scale every feature. Use "auto" when using cyclic_features.
@@ -224,7 +225,7 @@ export function buildTrainMapParams(args, presets) {
     return { params, paramSummary, effectiveGrid };
 }
 export function registerJobsTool(server, description) {
-    server.tool("jobs", description, {
+    registerAuditedTool(server, "jobs", description, {
         action: z
             .enum(["status", "list", "compare", "cancel", "delete", "train_map", "train_impute", "train_siom_map", "train_floop_siom", "train_floop_chain", "batch_predict", "run_baseline_study"])
             .describe("status: check progress; list: see all jobs; compare: metrics table; cancel: stop job; delete: remove job + files; train_map: submit standard map training; train_siom_map: submit SIOM map training; train_floop_siom: submit FLooP-SIOM (preferred); train_floop_chain: deprecated alias for train_floop_siom; batch_predict: submit multiple predict jobs at once; run_baseline_study: auto-configure and train a baseline SOM"),
@@ -309,7 +310,7 @@ export function registerJobsTool(server, description) {
         colormap: z.string().optional(),
         row_range: z.tuple([z.number().int().min(1), z.number().int().min(1)]).optional(),
         cv_folds: z.number().int().min(0).max(20).optional()
-            .describe("train_impute only: held-out MAE/RMSE/R2 per column (0=off, default 5) → quality.csv"),
+            .describe("train_impute only: per-column imputation quality → quality.csv with two labeled methods (kfold_holdout_pool = held-out; resubstitution_optimistic = in-sample). 0=off, default 5."),
         viz_mode: z.enum(["full", "summary", "summary_plus_top"]).optional()
             .describe("Visualization density; auto-capped when feature count > 40"),
         viz_top_components: z.number().int().min(0).max(64).optional()

package/dist/tools/results.js

@@ -1,9 +1,10 @@
 import path from "node:path";
 import fs from "node:fs/promises";
 import { z } from "zod";
+import { registerAuditedTool } from "../audit.js";
 import { apiCall, apiRawCall, getWorkspaceRootAsync, sandboxPath, pollUntilComplete, tryAttachImage, getResultsImagesToFetch, getCaptionForImage, mimeForFilename, } from "../shared.js";
 export function registerResultsTool(server) {
-    server.tool("results", `Retrieve, recolor, download, export, or run temporal flow on a completed map job.
+    registerAuditedTool(server, "results", `Retrieve, recolor, download, export, or run temporal flow on a completed map job.
 
 | Action | Use when | Sync/Async |
 |--------|----------|------------|

package/dist/tools/training_guidance.js

@@ -1,6 +1,7 @@
+import { registerAuditedTool } from "../audit.js";
 import { fetchTrainingGuidanceFromApi } from "../shared.js";
 export function registerTrainingGuidanceTool(server) {
-    server.tool("training_guidance", "Structured parameter guidance for training (presets, grid/epochs/batch, model, periodic, SIOM/FLooP fields where your plan allows, categorical baselines). Served from the API and filtered to allowed_job_types. Prep ladder: prepare_training prompt = narrative checklist; this tool = JSON/hints; training_prep = interactive UI + submit_prepared_training. For full orientation and SOP, call guide_barsom_workflow first. Optional UIs: training_prep, results_explorer—not required; jobs + results suffice.", {}, async () => {
+    registerAuditedTool(server, "training_guidance", "Structured parameter guidance for training (presets, grid/epochs/batch, model, periodic, SIOM/FLooP fields where your plan allows, categorical baselines). Served from the API and filtered to allowed_job_types. Prep ladder: prepare_training prompt = narrative checklist; this tool = JSON/hints; training_prep = interactive UI + submit_prepared_training. For full orientation and SOP, call guide_barsom_workflow first. Optional UIs: training_prep, results_explorer—not required; jobs + results suffice.", {}, async () => {
         const text = await fetchTrainingGuidanceFromApi();
         return { content: [{ type: "text", text }] };
     });

package/dist/tools/training_monitor.js

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { registerAppTool } from "@modelcontextprotocol/ext-apps/server";
+import { runMcpToolAudit } from "../audit.js";
 import { apiCall, getClientSupportsMcpApps, getVizPort, structuredTextResult, } from "../shared.js";
 export const TRAINING_MONITOR_URI = "ui://barsom/training-monitor";
 function buildStructuredContent(job_id, data) {
@@ -20,7 +21,8 @@ export function registerTrainingMonitorTool(server) {
             job_id: z.string().describe("Training job ID to monitor"),
         },
         _meta: { ui: { resourceUri: TRAINING_MONITOR_URI } },
-    }, async ({ job_id }) => {
+    }, async (args) => runMcpToolAudit("training_monitor", "default", args, async () => {
+        const job_id = String(args.job_id);
         const data = (await apiCall("GET", `/v1/jobs/${job_id}`));
         const structuredContent = buildStructuredContent(job_id, data);
         const status = String(data.status ?? "unknown");
@@ -39,5 +41,5 @@ export function registerTrainingMonitorTool(server) {
             });
         }
         return structuredTextResult(structuredContent, text, content);
-    });
+    }));
 }

package/dist/tools/training_prep.js

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { registerAppTool } from "@modelcontextprotocol/ext-apps/server";
+import { registerAuditedTool, runMcpToolAudit } from "../audit.js";
 import { apiCall, fetchTrainingGuidanceFromApi, getClientSupportsMcpApps, getVizPort, structuredTextResult, } from "../shared.js";
 import { buildTrainMapParams, fetchTrainingPresets, } from "./jobs.js";
 import { attachTrainingReviewPayload, consumeTrainingReview, getTrainingReview, storeTrainingReview, } from "./training_review_store.js";
@@ -324,11 +325,11 @@ export function registerTrainingPrepTools(server) {
         description: "Interactive training prep UI + guarded submit (submit_prepared_training). Prep ladder: prepare_training prompt = narrative checklist; training_guidance tool = JSON/presets; this tool = visual review. Opens inline review of variables, transforms, encodings, and hyperparameters.",
         inputSchema: trainPrepSchema,
         _meta: { ui: { resourceUri: TRAINING_PREP_URI } },
-    }, async ({ dataset_id, ...args }) => {
+    }, async ({ dataset_id, ...args }) => runMcpToolAudit("training_prep", "default", { dataset_id, ...args }, async () => {
         const payload = await buildTrainingPrepPayload(dataset_id, args);
         return structuredTextResult(payload, undefined, buildTrainingPrepContent(payload));
-    });
-    server.tool("submit_prepared_training", "Submit a previously reviewed training-prep configuration. Requires an unexpired review token and explicit confirmation.", {
+    }));
+    registerAuditedTool(server, "submit_prepared_training", "Submit a previously reviewed training-prep configuration. Requires an unexpired review token and explicit confirmation.", {
         review_token: z.string().describe("Review token returned inside training_prep structured content."),
         explicit_confirm: z.boolean().describe("Must be true to submit the reviewed training job."),
     }, async ({ review_token, explicit_confirm }) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@barivia/barsom-mcp",
-  "version": "0.10.2",
+  "version": "0.10.5",
   "description": "barSOM MCP proxy — connect any MCP client to the barSOM cloud API for Self-Organizing Map analytics",
   "keywords": [
     "mcp",