@borgresearch/odin-mcp 0.2.0 → 0.3.1

package/dist/index.js

@@ -1,737 +1,23 @@
 #!/usr/bin/env node
+import {
+  PACKAGE_VERSION,
+  createOdinMcpServer
+} from "./chunk-MHMO7K4D.js";
+import "./chunk-4LCKW236.js";
+import "./chunk-D5FYYTYV.js";
+import {
+  DEFAULT_ODIN_BASE_URL,
+  OdinClient
+} from "./chunk-XHJYVUHG.js";
 
 // src/index.ts
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-
-// src/client.ts
-var OdinApiError = class extends Error {
-  status;
-  path;
-  method;
-  retryAfterSeconds;
-  body;
-  constructor(params) {
-    super(params.message);
-    this.name = "OdinApiError";
-    this.status = params.status;
-    this.path = params.path;
-    this.method = params.method;
-    this.retryAfterSeconds = params.retryAfterSeconds;
-    this.body = params.body;
-  }
-};
-var DEFAULT_ODIN_BASE_URL = "https://odin.borghq.io";
-var WRITE_METHODS = /* @__PURE__ */ new Set(["PATCH", "POST", "PUT", "DELETE"]);
-var OdinClient = class {
-  baseUrl;
-  apiKey;
-  fetchImpl;
-  vercelProtectionBypassSecret;
-  constructor(options) {
-    if (!options.apiKey) {
-      throw new Error("OdinClient requires an apiKey");
-    }
-    this.apiKey = options.apiKey;
-    this.baseUrl = (options.baseUrl ?? DEFAULT_ODIN_BASE_URL).replace(
-      /\/+$/,
-      ""
-    );
-    this.fetchImpl = options.fetchImpl ?? fetch;
-    this.vercelProtectionBypassSecret = options.vercelProtectionBypassSecret?.trim() || void 0;
-  }
-  async get(path, searchParams) {
-    const url = this.buildUrl(path, searchParams);
-    return this.request("GET", url, path);
-  }
-  async patch(path, body) {
-    const url = this.buildUrl(path);
-    return this.request("PATCH", url, path, body);
-  }
-  // Public HTTP method API — kept alongside get/patch even when unused internally
-  // fallow-ignore-next-line unused-class-member
-  async post(path, body) {
-    const url = this.buildUrl(path);
-    return this.request("POST", url, path, body);
-  }
-  buildUrl(path, searchParams) {
-    const url = new URL(path.startsWith("/") ? path : `/${path}`, this.baseUrl);
-    if (searchParams) {
-      for (const [key, value] of Object.entries(searchParams)) {
-        if (value === void 0 || value === "") continue;
-        url.searchParams.set(key, String(value));
-      }
-    }
-    return url.toString();
-  }
-  async request(method, url, path, body) {
-    const headers = {
-      Authorization: `Bearer ${this.apiKey}`,
-      "Content-Type": "application/json",
-      Accept: "application/json"
-    };
-    if (this.vercelProtectionBypassSecret) {
-      headers["x-vercel-protection-bypass"] = this.vercelProtectionBypassSecret;
-    }
-    const response = await this.fetchImpl(url, {
-      method,
-      headers,
-      body: body === void 0 ? void 0 : JSON.stringify(body)
-    });
-    const rawText = await response.text();
-    const parsed = rawText ? safeJsonParse(rawText) : null;
-    if (!response.ok) {
-      const retryAfterSeconds = parseRetryAfter(
-        response.headers.get("Retry-After")
-      );
-      throw new OdinApiError({
-        status: response.status,
-        path,
-        method,
-        retryAfterSeconds,
-        body: parsed ?? rawText,
-        message: formatErrorMessage({
-          status: response.status,
-          method,
-          path,
-          retryAfterSeconds,
-          parsed,
-          rawText
-        })
-      });
-    }
-    return parsed;
-  }
-};
-function safeJsonParse(text) {
-  try {
-    return JSON.parse(text);
-  } catch {
-    return text;
-  }
-}
-function parseRetryAfter(header) {
-  if (!header) return null;
-  const trimmed = header.trim();
-  if (/^\d+$/.test(trimmed)) return Number.parseInt(trimmed, 10);
-  const dateMs = Date.parse(trimmed);
-  if (Number.isNaN(dateMs)) return null;
-  const seconds = Math.ceil((dateMs - Date.now()) / 1e3);
-  return seconds > 0 ? seconds : null;
-}
-function formatErrorMessage(input) {
-  const serverMessage = extractServerMessage(input.parsed);
-  const actionable = actionableMessage(input);
-  if (actionable) {
-    return serverMessage ? `${actionable} (server: ${serverMessage})` : actionable;
-  }
-  const suffix = serverMessage ? ` \u2014 ${serverMessage}` : input.rawText ? ` \u2014 ${input.rawText.slice(0, 200)}` : "";
-  return `Odin API ${input.status} on ${input.path}${suffix}.`;
-}
-function actionableMessage(input) {
-  switch (input.status) {
-    case 401:
-      return "ODIN_API_KEY is not set or invalid. Create one at Management > API Keys in the Odin dashboard.";
-    case 403:
-      if (WRITE_METHODS.has(input.method)) {
-        return "API key does not have write permission. Create a new key with 'Read & Write' permissions.";
-      }
-      return null;
-    case 404:
-      if (isFindingDetailPath(input.path)) {
-        return "Finding not found. Check the finding ID is correct.";
-      }
-      return null;
-    case 429: {
-      const n = input.retryAfterSeconds;
-      return n ? `Rate limit exceeded. Try again in ${n} seconds.` : "Rate limit exceeded. Try again shortly.";
-    }
-    default:
-      return null;
-  }
-}
-function isFindingDetailPath(path) {
-  return /^\/api\/findings\/[^/]+(\/.*)?$/.test(path);
-}
-function extractServerMessage(parsed) {
-  if (parsed && typeof parsed === "object" && "error" in parsed) {
-    const err = parsed.error;
-    if (typeof err === "string") return err;
-  }
-  return null;
-}
-
-// src/tools/get-asset.ts
-import { z } from "zod";
-
-// src/formatters/markdown.ts
-var STATUS_LABELS = {
-  REPORTED: "Reported",
-  ACKNOWLEDGED: "Acknowledged",
-  MITIGATING: "Mitigating",
-  OPEN_FOR_RETEST: "Open for Retest",
-  NEEDS_REVISION: "Needs Revision",
-  FIXED_AND_RETESTED: "Fixed & Retested"
-};
-var RETEST_STATUS_LABELS = {
-  QUEUED: "Queued",
-  RUNNING: "Running",
-  COMPLETED: "Completed",
-  FAILED: "Failed",
-  SKIPPED: "Skipped"
-};
-function formatFindingsList(data) {
-  const { findings, stats, pagination } = data;
-  if (findings.length === 0) {
-    return "No findings match the supplied filters.";
-  }
-  const rows = findings.map((f) => {
-    const severity = `${f.severity.label} (CVSS ${f.severity.cvss.toFixed(1)})`;
-    return `| ${f.identifier ?? "\u2014"} | ${f.findingId} | ${escapePipes(f.title)} | ${severity} | ${formatStatus(f.status)} | ${formatDate(f.createdAt)} |`;
-  });
-  return [
-    `Showing ${findings.length} of ${stats.total} finding(s). Offset ${pagination.offset}, limit ${pagination.limit}. hasMore=${pagination.hasMore}.`,
-    "",
-    "| Identifier | Internal ID | Title | Severity | Status | Created |",
-    "| --- | --- | --- | --- | --- | --- |",
-    ...rows
-  ].join("\n");
-}
-function formatFindingDetail(data) {
-  const { finding, revision } = data;
-  const context = data.remediationContext;
-  const identifier = context?.identifier ?? finding.identifier ?? null;
-  const displayIdentifier = identifier ?? finding.findingId;
-  const severity = `${finding.severity.label} (CVSS ${finding.severity.cvss.toFixed(1)})`;
-  const header = [
-    `# ${escapePipes(displayIdentifier)} \u2014 ${escapePipes(finding.title)}`,
-    "",
-    `- **Finding:** ${displayIdentifier}`,
-    `- **Internal ID:** ${finding.findingId}`,
-    `- **Severity:** ${severity}`,
-    `- **Status:** ${formatStatus(finding.status)}`,
-    `- **Repository:** ${context?.repository ?? finding.repository ?? "Not recorded"}`,
-    `- **Pentest:** ${finding.context?.pentestId ?? "standalone"}`,
-    `- **Created:** ${formatDate(finding.createdAt)}`,
-    `- **Updated:** ${formatDate(finding.updatedAt)}`
-  ];
-  const content = context ? {
-    revisionNumber: context.revision.revisionNumber,
-    summary: context.revision.summary,
-    description: context.revision.description,
-    impact: context.revision.impact,
-    details: context.revision.details,
-    remediation: context.revision.remediation,
-    affectedAssets: context.revision.affectedAssets,
-    codeReference: context.revision.codeReference
-  } : revision ? {
-    revisionNumber: revision.revisionNumber,
-    summary: revision.content.summaryMd,
-    description: revision.content.descriptionMd,
-    impact: revision.content.businessImpactMd,
-    details: revision.content.detailsMd,
-    remediation: revision.content.remediationMd,
-    affectedAssets: revision.content.affectedAssets ?? [],
-    codeReference: null
-  } : null;
-  const sections = [];
-  if (!content) {
-    sections.push("_No revision content available._");
-  } else {
-    sections.push(`_Revision ${content.revisionNumber ?? "unknown"}_`);
-    if (content.summary) sections.push("## Summary", content.summary);
-    if (content.description)
-      sections.push("## Description", content.description);
-    if (content.impact) sections.push("## Business Impact", content.impact);
-    if (content.details) sections.push("## Details", content.details);
-    if (content.remediation)
-      sections.push("## Remediation", content.remediation);
-    if (content.codeReference) {
-      sections.push(
-        "## Code reference",
-        `- ${content.codeReference.file}:${content.codeReference.line}`
-      );
-      if (content.codeReference.snippet) {
-        sections.push("```", content.codeReference.snippet, "```");
-      }
-    }
-    if (content.affectedAssets?.length) {
-      sections.push(
-        "## Affected Assets",
-        content.affectedAssets.map((asset) => `- ${asset.display} (${asset.assetId})`).join("\n")
-      );
-    }
-  }
-  if (context) {
-    sections.push(
-      "## Remediation workflow",
-      `- **Suggested branch:** ${context.suggestedBranch ?? "Not available"}`,
-      `- **Ready for a user-created PR:** ${yesNo(context.workflow.readyForUserCreatedPullRequest)}`,
-      `- **GitHub connected:** ${yesNo(context.workflow.githubConnected)}`,
-      `- **Automatic retests:** ${context.workflow.automaticRetestsReady ? "Ready after merge" : "Not ready"}`
-    );
-    if (context.workflow.blockers.length) {
-      sections.push(
-        "### Blockers",
-        context.workflow.blockers.map((blocker) => `- ${blocker}`).join("\n")
-      );
-    }
-    if (context.workflow.nextSteps.length) {
-      sections.push(
-        "### Next steps",
-        context.workflow.nextSteps.map((step) => `- ${step}`).join("\n")
-      );
-    }
-    if (context.linkedPullRequests.length) {
-      sections.push(
-        "## Linked GitHub pull requests",
-        context.linkedPullRequests.map(
-          (pullRequest) => `- [#${pullRequest.number}](${pullRequest.url}) ${escapePipes(pullRequest.title)} \u2014 ${pullRequest.state}, linked via ${pullRequest.linkedVia}`
-        ).join("\n")
-      );
-    } else {
-      sections.push("## Linked GitHub pull requests", "_None linked._");
-    }
-    sections.push("## Latest retest");
-    if (context.latestRetest.state === "unavailable") {
-      sections.push(`_${context.latestRetest.reason}_`);
-    } else if (context.latestRetest.state === "none") {
-      sections.push("_No retest history is available yet._");
-    } else {
-      sections.push(formatRetestSummary(context.latestRetest.retest));
-    }
-  }
-  return [...header, "", ...sections].join("\n");
-}
-function formatFindingStatusUpdate(finding) {
-  const identifier = finding.identifier ?? finding.findingId;
-  return [
-    `Updated finding **${identifier}** (internal ID ${finding.findingId}) status to **${formatStatus(finding.status)}**.`,
-    `Title: ${finding.title}`
-  ].join("\n");
-}
-function formatFindingPullRequestLink(data) {
-  const identifier = data.finding.identifier ?? data.finding.findingId;
-  const pullRequest = data.pullRequest;
-  const readiness = data.workflow.automaticRetestsReady ? "Automatic retesting is ready after this PR merges." : "Automatic retesting is not currently ready; review the blockers below.";
-  const blockers = data.workflow.blockers.length ? `
-${data.workflow.blockers.map((blocker) => `- ${blocker}`).join("\n")}` : "";
-  return [
-    `Linked existing GitHub pull request [#${pullRequest.number}](${pullRequest.url}) to **${identifier}**.`,
-    `Repository: ${pullRequest.repo}; state: ${pullRequest.state}; finding status: ${formatStatus(data.finding.status)}.`,
-    "Odin did not create, modify, merge, or push this pull request.",
-    readiness,
-    blockers ? `Workflow blockers:${blockers}` : ""
-  ].filter(Boolean).join("\n");
-}
-function formatFindingRetests(data) {
-  if (data.state === "none" || data.retests.length === 0) {
-    return "No retest history is available for this finding.";
-  }
-  return [
-    `Retest history (${data.retests.length}):`,
-    "",
-    "| Retest | Status | Trigger | Verdict | Created | Completed |",
-    "| --- | --- | --- | --- | --- | --- |",
-    ...data.retests.map(
-      (retest) => `| ${retest.retestId} | ${RETEST_STATUS_LABELS[retest.status]} | ${retest.trigger} | ${retest.combinedVerdict ?? "\u2014"} | ${formatDate(retest.createdAt)} | ${formatDate(retest.completedAt ?? 0)} |`
-    ),
-    "",
-    "Queued and running entries are still in progress; completed, skipped, and failed entries are final for that run."
-  ].join("\n");
-}
-function formatPentestsList(data) {
-  if (data.pentests.length === 0) return "No pentests found.";
-  const rows = data.pentests.map(formatPentestRow);
-  return [
-    "| Pentest ID | Name | Status | Start | End | Scope |",
-    "| --- | --- | --- | --- | --- | --- |",
-    ...rows
-  ].join("\n");
-}
-function formatPentestDetail(data) {
-  const p = data.pentest;
-  const end = p.endAt ? formatDate(p.endAt) : "open";
-  const scope = p.scope.length ? p.scope.map((s) => `- ${s}`).join("\n") : "_No scope defined._";
-  return [
-    `# ${p.name}`,
-    "",
-    `- **ID:** ${p.pentestId}`,
-    `- **Status:** ${p.status}`,
-    `- **Start:** ${formatDate(p.startAt)}`,
-    `- **End:** ${end}`,
-    `- **Created:** ${formatDate(p.createdAt)}`,
-    "",
-    "## Scope",
-    "",
-    scope
-  ].join("\n");
-}
-function formatFindingsForAsset(findings) {
-  if (findings.length === 0) return "_No findings reference this asset._";
-  return [
-    `## Findings (${findings.length})`,
-    "",
-    "| Identifier | Internal ID | Title | Severity | Status | Created |",
-    "| --- | --- | --- | --- | --- | --- |",
-    ...findings.map(formatFindingRow)
-  ].join("\n");
-}
-function formatAssetsList(data) {
-  const { assets, stats, pagination } = data;
-  if (assets.length === 0) return "No assets match the supplied filters.";
-  const rows = assets.map(formatAssetRow);
-  return [
-    `Showing ${assets.length} of ${stats.total} asset(s). Offset ${pagination.offset}, limit ${pagination.limit}. hasMore=${pagination.hasMore}.`,
-    "",
-    "| Asset ID | Type | Value | Source | Status | Last seen |",
-    "| --- | --- | --- | --- | --- | --- |",
-    ...rows
-  ].join("\n");
-}
-function formatAssetDetail(data) {
-  const { asset, findings } = data;
-  const header = [
-    `# ${asset.value}`,
-    "",
-    `- **ID:** ${asset.assetId}`,
-    `- **Type:** ${asset.type}`,
-    `- **Source:** ${asset.source}`,
-    `- **Status:** ${asset.status}`,
-    `- **Last seen:** ${formatDate(asset.lastSeenAt)}`,
-    `- **Created:** ${formatDate(asset.createdAt)}`
-  ];
-  return [...header, "", formatFindingsForAsset(findings)].join("\n");
-}
-function formatFindingRow(finding) {
-  const severity = `${finding.severity.label} (CVSS ${finding.severity.cvss.toFixed(1)})`;
-  return `| ${finding.identifier ?? "\u2014"} | ${finding.findingId} | ${escapePipes(finding.title)} | ${severity} | ${formatStatus(finding.status)} | ${formatDate(finding.createdAt)} |`;
-}
-function formatPentestRow(p) {
-  const end = p.endAt ? formatDate(p.endAt) : "open";
-  const scope = p.scope.slice(0, 3).join(", ") + (p.scope.length > 3 ? ", \u2026" : "");
-  return `| ${p.pentestId} | ${escapePipes(p.name)} | ${p.status} | ${formatDate(p.startAt)} | ${end} | ${escapePipes(scope)} |`;
-}
-function formatAssetRow(a) {
-  return `| ${a.assetId} | ${a.type} | ${escapePipes(a.value)} | ${a.source} | ${a.status} | ${formatDate(a.lastSeenAt)} |`;
-}
-function formatRetestSummary(retest) {
-  return [
-    `- **Status:** ${RETEST_STATUS_LABELS[retest.status]}`,
-    `- **Trigger:** ${retest.trigger}`,
-    `- **Verdict:** ${retest.combinedVerdict ?? "Not available yet"}`,
-    `- **Finding action:** ${retest.statusAction ?? "None"}`,
-    `- **Created:** ${formatDate(retest.createdAt)}`,
-    `- **Completed:** ${formatDate(retest.completedAt ?? 0)}`
-  ].join("\n");
-}
-function formatStatus(status) {
-  return STATUS_LABELS[status] ?? status;
-}
-function yesNo(value) {
-  return value ? "Yes" : "No";
-}
-function escapePipes(value) {
-  return value.replace(/\|/g, "\\|");
-}
-function formatDate(epoch) {
-  if (!epoch) return "\u2014";
-  const ms = epoch < 1e12 ? epoch * 1e3 : epoch;
-  return new Date(ms).toISOString().slice(0, 10);
-}
-
-// src/tools/get-asset.ts
-var getAssetInput = z.object({
-  assetId: z.string().min(1)
-});
-var getAssetTool = {
-  name: "get_asset",
-  title: "Get asset",
-  description: "Fetch a single attack-surface asset by ID, including the findings that reference it in their latest revision.",
-  inputSchema: getAssetInput,
-  handler: (client) => async (params) => {
-    const data = await client.get(
-      `/api/assets/${encodeURIComponent(params.assetId)}`
-    );
-    return {
-      markdown: formatAssetDetail(data),
-      structured: { asset: data.asset, findings: data.findings }
-    };
-  }
-};
-
-// src/tools/finding-reference.ts
-import { z as z2 } from "zod";
-var findingReferenceFields = {
-  identifier: z2.string().trim().min(1).optional().describe(
-    'Human-readable finding identifier such as "ODI-12". Preferred input.'
-  ),
-  findingId: z2.string().trim().min(1).optional().describe(
-    "Raw internal finding ID, useful when chaining from another tool."
-  )
-};
-var findingReferenceInput = z2.object(findingReferenceFields).refine((value) => Boolean(value.identifier || value.findingId), {
-  message: "Provide either identifier or findingId."
-});
-function findingReferenceValue(reference) {
-  const value = reference.identifier ?? reference.findingId;
-  if (!value) {
-    throw new Error("A finding identifier or findingId is required.");
-  }
-  return value;
-}
-function findingReferencePath(reference, suffix = "") {
-  return `/api/findings/${encodeURIComponent(findingReferenceValue(reference))}${suffix}`;
-}
-async function resolveFindingId(client, reference) {
-  if (reference.findingId) return reference.findingId;
-  const data = await client.get(
-    findingReferencePath(reference)
-  );
-  return data.remediationContext?.findingId ?? data.finding.findingId;
-}
-
-// src/tools/get-finding.ts
-var getFindingInput = findingReferenceInput;
-var getFindingTool = {
-  name: "get_finding",
-  title: "Get finding remediation context",
-  description: "Fetch a finding by human identifier such as ODI-12 (preferred) or by internal findingId. Returns bounded remediation context, the suggested branch name, linked GitHub pull requests, workflow readiness, and retest state. Odin only provides context and can link an existing PR; it never creates commits, pushes branches, or creates pull requests.",
-  inputSchema: getFindingInput,
-  handler: (client) => async (params) => {
-    const data = await client.get(
-      findingReferencePath(params)
-    );
-    return {
-      markdown: formatFindingDetail(data),
-      structured: {
-        finding: data.remediationContext ?? data.finding,
-        revision: data.remediationContext?.revision ?? data.revision,
-        remediationContext: data.remediationContext ?? null
-      }
-    };
-  }
-};
-
-// src/tools/get-finding-retests.ts
-import { z as z3 } from "zod";
-var getFindingRetestsInput = z3.object(findingReferenceFields).refine((value) => Boolean(value.identifier || value.findingId), {
-  message: "Provide either identifier or findingId."
-});
-var getFindingRetestsTool = {
-  name: "get_finding_retests",
-  title: "Get finding retest history",
-  description: "Read the retest history for a finding by human identifier such as ODI-12 or internal findingId. Distinguishes no history, queued or running, completed, skipped, failed, and gated/unavailable results. This tool never triggers a retest or spends credits.",
-  inputSchema: getFindingRetestsInput,
-  handler: (client) => async (params) => {
-    try {
-      const data = await client.get(
-        findingReferencePath(params, "/retests")
-      );
-      return {
-        markdown: formatFindingRetests(data),
-        structured: {
-          state: data.state,
-          retests: data.retests
-        }
-      };
-    } catch (error) {
-      if (error instanceof OdinApiError && error.status === 404 && isRetestHistoryUnavailable(error.body)) {
-        const reason = "Retest history is gated or unavailable for this organisation.";
-        return {
-          markdown: reason,
-          structured: { state: "unavailable", reason, retests: [] }
-        };
-      }
-      throw error;
-    }
-  }
-};
-function isRetestHistoryUnavailable(body) {
-  return typeof body === "object" && body !== null && "code" in body && body.code === "RETEST_HISTORY_UNAVAILABLE";
-}
-
-// src/tools/get-pentest.ts
-import { z as z4 } from "zod";
-var getPentestInput = z4.object({
-  pentestId: z4.string().min(1)
-});
-var getPentestTool = {
-  name: "get_pentest",
-  title: "Get pentest",
-  description: "Fetch a single pentest by ID, including status, scheduled window, and in-scope targets.",
-  inputSchema: getPentestInput,
-  handler: (client) => async (params) => {
-    const data = await client.get(
-      `/api/pentests/${encodeURIComponent(params.pentestId)}`
-    );
-    return {
-      markdown: formatPentestDetail(data),
-      structured: { pentest: data.pentest }
-    };
-  }
-};
-
-// src/tools/link-finding-pull-request.ts
-import { z as z5 } from "zod";
-var linkFindingPullRequestInput = z5.object({
-  ...findingReferenceFields,
-  url: z5.string().url().describe("Existing GitHub pull request URL to link to the finding.")
-}).refine((value) => Boolean(value.identifier || value.findingId), {
-  message: "Provide either identifier or findingId."
-});
-var linkFindingPullRequestTool = {
-  name: "link_finding_pull_request",
-  title: "Link an existing GitHub pull request",
-  description: "Link an existing accessible GitHub pull request to a finding identified by ODI-12 or findingId. This operation is idempotent. It does not create, modify, merge, or push a pull request, commit, or branch, and it requires an API key with Read & Write permission; cookie-authenticated callers also need member role. Ask the user before linking.",
-  inputSchema: linkFindingPullRequestInput,
-  handler: (client) => async (params) => {
-    const data = await client.post(
-      findingReferencePath(params, "/link-pr"),
-      { url: params.url }
-    );
-    return {
-      markdown: formatFindingPullRequestLink(data),
-      structured: {
-        finding: data.finding,
-        pullRequest: data.pullRequest,
-        linkSource: data.linkSource,
-        workflow: data.workflow
-      }
-    };
-  }
-};
-
-// src/tools/list-assets.ts
-import { z as z6 } from "zod";
-var listAssetsInput = z6.object({
-  type: z6.enum(["DOMAIN", "SUBDOMAIN", "IP"]).optional(),
-  source: z6.enum(["MANUAL", "RECON", "IMPORT", "AGENT"]).optional(),
-  status: z6.string().optional().describe(
-    "Dynamic asset status set by recon (e.g. ACTIVE, INACTIVE, TLS_ERROR)."
-  ),
-  search: z6.string().optional(),
-  sortBy: z6.enum(["lastSeenAt", "createdAt", "value"]).optional(),
-  sortOrder: z6.enum(["asc", "desc"]).optional(),
-  limit: z6.number().int().min(1).max(100).optional().default(50),
-  offset: z6.number().int().min(0).optional().default(0)
-});
-var listAssetsTool = {
-  name: "list_assets",
-  title: "List assets",
-  description: "List attack-surface assets for the organisation. Supports filtering by type, source, status, and free-text search.",
-  inputSchema: listAssetsInput,
-  handler: (client) => async (params) => {
-    const data = await client.get("/api/assets", params);
-    return {
-      markdown: formatAssetsList(data),
-      structured: {
-        assets: data.assets,
-        stats: data.stats,
-        pagination: data.pagination
-      }
-    };
-  }
-};
-
-// src/tools/list-findings.ts
-import { z as z7 } from "zod";
-var listFindingsInput = z7.object({
-  pentestId: z7.string().optional().describe("Filter to a single pentest."),
-  assetId: z7.string().optional().describe(
-    "Filter to findings whose latest revision references this asset."
-  ),
-  repository: z7.string().optional().describe("Filter to a source repository such as owner/name."),
-  severity: z7.enum(["CRITICAL", "HIGH", "MEDIUM", "LOW", "INFORMATIONAL"]).optional(),
-  status: z7.enum([
-    "REPORTED",
-    "ACKNOWLEDGED",
-    "MITIGATING",
-    "OPEN_FOR_RETEST",
-    "NEEDS_REVISION",
-    "FIXED_AND_RETESTED"
-  ]).optional(),
-  search: z7.string().optional().describe("Free-text search on finding titles and human identifiers."),
-  sortBy: z7.enum(["severity", "createdAt"]).optional(),
-  sortOrder: z7.enum(["asc", "desc"]).optional(),
-  limit: z7.number().int().min(1).max(200).optional().default(50),
-  offset: z7.number().int().min(0).optional().default(0)
-});
-var listFindingsTool = {
-  name: "list_findings",
-  title: "List findings",
-  description: "List security findings for the organisation. Supports filtering by pentest, asset, repository, severity, current client-visible status, and searching finding titles or human identifiers such as ODI-12.",
-  inputSchema: listFindingsInput,
-  handler: (client) => async (params) => {
-    const data = await client.get(
-      "/api/findings",
-      params
-    );
-    return {
-      markdown: formatFindingsList(data),
-      structured: {
-        findings: data.findings,
-        stats: data.stats,
-        pagination: data.pagination
-      }
-    };
-  }
-};
-
-// src/tools/list-pentests.ts
-import { z as z8 } from "zod";
-var listPentestsInput = z8.object({});
-var listPentestsTool = {
-  name: "list_pentests",
-  title: "List pentests",
-  description: "List all pentests for the organisation, including status, scheduled window, and in-scope targets.",
-  inputSchema: listPentestsInput,
-  handler: (client) => async () => {
-    const data = await client.get("/api/pentests");
-    return {
-      markdown: formatPentestsList(data),
-      structured: { pentests: data.pentests }
-    };
-  }
-};
-
-// src/tools/update-finding-status.ts
-import { z as z9 } from "zod";
-var updateFindingStatusInput = z9.object({
-  ...findingReferenceFields,
-  status: z9.enum(["MITIGATING", "OPEN_FOR_RETEST", "ACKNOWLEDGED"]).describe(
-    "Target status. MITIGATING means work has started, OPEN_FOR_RETEST means the fix is ready for verification, and ACKNOWLEDGED means the organisation accepts the risk for now."
-  )
-}).refine((value) => Boolean(value.identifier || value.findingId), {
-  message: "Provide either identifier or findingId."
-});
-var updateFindingStatusTool = {
-  name: "update_finding_status",
-  title: "Update finding status",
-  description: "Change a finding's status by human identifier such as ODI-12 or internal findingId. Requires an API key with Read & Write permission; cookie-authenticated callers also need member role. Only use this after the user explicitly asks for the status change; a matching pull request is not permission to mutate a finding.",
-  inputSchema: updateFindingStatusInput,
-  handler: (client) => async (params) => {
-    const findingId = await resolveFindingId(client, params);
-    const data = await client.patch(
-      `/api/findings/${encodeURIComponent(findingId)}/status`,
-      { status: params.status }
-    );
-    return {
-      markdown: formatFindingStatusUpdate(data.finding),
-      structured: { finding: data.finding }
-    };
-  }
-};
-
-// src/index.ts
-var PACKAGE_VERSION = "0.2.0";
 async function main() {
   const apiKey = process.env.ODIN_API_KEY;
   if (!apiKey) {
-    console.error(
-      "ODIN_API_KEY is not set or invalid. Create one at Management > API Keys in the Odin dashboard."
+    throw new Error(
+      "ODIN_API_KEY is required. Create a key under Management > API Keys."
     );
-    process.exit(1);
   }
   const baseUrl = process.env.ODIN_BASE_URL ?? DEFAULT_ODIN_BASE_URL;
   const client = new OdinClient({
@@ -739,62 +25,9 @@ async function main() {
     baseUrl,
     vercelProtectionBypassSecret: process.env.ODIN_VERCEL_PROTECTION_BYPASS_SECRET
   });
-  const server = new McpServer({
-    name: "@borgresearch/odin-mcp",
-    version: PACKAGE_VERSION
-  });
-  const tools = [
-    listFindingsTool,
-    getFindingTool,
-    updateFindingStatusTool,
-    linkFindingPullRequestTool,
-    getFindingRetestsTool,
-    listPentestsTool,
-    getPentestTool,
-    listAssetsTool,
-    getAssetTool
-  ];
-  for (const tool of tools) {
-    const run = tool.handler(client);
-    server.registerTool(
-      tool.name,
-      {
-        title: tool.title,
-        description: tool.description,
-        inputSchema: tool.inputSchema.shape
-      },
-      async (params) => {
-        try {
-          const { markdown, structured } = await run(params);
-          return {
-            content: [{ type: "text", text: markdown }],
-            structuredContent: { markdown, ...toObject(structured) }
-          };
-        } catch (error) {
-          return {
-            isError: true,
-            content: [{ type: "text", text: toErrorMessage(error) }]
-          };
-        }
-      }
-    );
-  }
-  const transport = new StdioServerTransport();
-  await server.connect(transport);
-  console.error(
-    `odin-mcp ${PACKAGE_VERSION} connected (baseUrl=${baseUrl}, tools=${tools.length}).`
-  );
-}
-function toObject(value) {
-  if (value && typeof value === "object" && !Array.isArray(value)) {
-    return value;
-  }
-  return { data: value };
-}
-function toErrorMessage(error) {
-  if (error instanceof OdinApiError) return error.message;
-  if (error instanceof Error) return `Unexpected error: ${error.message}`;
-  return `Unexpected error: ${String(error)}`;
+  const server = createOdinMcpServer(client, { appUrl: baseUrl });
+  await server.connect(new StdioServerTransport());
+  console.error(`odin-mcp ${PACKAGE_VERSION} connected over stdio.`);
 }
 main().catch((error) => {
   console.error("odin-mcp failed to start:", error);