@buildinternet/uploads 0.42.0 → 0.42.2

package/dist/hooks-install.d.ts

@@ -2,12 +2,20 @@
  * Install thin user-global hook manifests for Grok and Cursor.
  *
  * Claude and Codex ship the same PreToolUse hook via their plugins
- * (`hooks/hooks.json` → `uploads hook pre-pr-screenshot`). Do not also write
+ * (`hooks/hooks.json` → HOOK_COMMAND). Do not also write
  * ~/.codex/hooks.json here, or the reminder would fire twice.
  *
  * Idempotent: skip when our command string is already present.
+ * An older bare `uploads hook …` entry is upgraded in place.
  */
-export declare const HOOK_COMMAND = "uploads hook pre-pr-screenshot";
+/** What the harness actually runs once `uploads` is on PATH. */
+export declare const HOOK_INVOCATION = "uploads hook pre-pr-screenshot";
+/**
+ * Fail-open shell used in every harness manifest.
+ * A missing `uploads` binary is a silent no-op (exit 0, no stderr) so plugin
+ * users without the CLI do not get a hook-failure annotation on every shell tool.
+ */
+export declare const HOOK_COMMAND = "if command -v uploads >/dev/null 2>&1; then uploads hook pre-pr-screenshot; fi";
 export type HookWriteResult = {
     path: string;
     action: "wrote" | "merged" | "skipped" | "would-write" | "would-merge";

package/dist/hooks-install.js

@@ -2,15 +2,23 @@
  * Install thin user-global hook manifests for Grok and Cursor.
  *
  * Claude and Codex ship the same PreToolUse hook via their plugins
- * (`hooks/hooks.json` → `uploads hook pre-pr-screenshot`). Do not also write
+ * (`hooks/hooks.json` → HOOK_COMMAND). Do not also write
  * ~/.codex/hooks.json here, or the reminder would fire twice.
  *
  * Idempotent: skip when our command string is already present.
+ * An older bare `uploads hook …` entry is upgraded in place.
  */
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-export const HOOK_COMMAND = "uploads hook pre-pr-screenshot";
+/** What the harness actually runs once `uploads` is on PATH. */
+export const HOOK_INVOCATION = "uploads hook pre-pr-screenshot";
+/**
+ * Fail-open shell used in every harness manifest.
+ * A missing `uploads` binary is a silent no-op (exit 0, no stderr) so plugin
+ * users without the CLI do not get a hook-failure annotation on every shell tool.
+ */
+export const HOOK_COMMAND = `if command -v uploads >/dev/null 2>&1; then ${HOOK_INVOCATION}; fi`;
 const TIMEOUT_SEC = 15;
 const GROK_PAYLOAD = {
     description: "Advisory reminder to stage screenshots on uploads.sh before opening a PR that touches UI files.",
@@ -38,6 +46,16 @@ function containsCommand(filePath) {
         return false;
     }
 }
+function hookCommandOf(entry) {
+    if (!entry || typeof entry !== "object")
+        return undefined;
+    const command = entry.command;
+    return typeof command === "string" ? command : undefined;
+}
+function isOurHookEntry(entry) {
+    const command = hookCommandOf(entry);
+    return Boolean(command?.includes(HOOK_INVOCATION));
+}
 function writeJson(filePath, value) {
     fs.mkdirSync(path.dirname(filePath), { recursive: true });
     fs.writeFileSync(filePath, `${JSON.stringify(value, null, 2)}\n`, "utf8");
@@ -79,7 +97,17 @@ function mergeCursor(home, dryRun) {
         ? { ...existing.hooks }
         : {};
     const list = Array.isArray(hooks.beforeShellExecution) ? [...hooks.beforeShellExecution] : [];
-    list.push({ command: HOOK_COMMAND, timeout: TIMEOUT_SEC });
+    const ours = list.findIndex(isOurHookEntry);
+    const nextEntry = { command: HOOK_COMMAND, timeout: TIMEOUT_SEC };
+    if (ours >= 0) {
+        if (hookCommandOf(list[ours]) === HOOK_COMMAND) {
+            return { path: filePath, action: "skipped" };
+        }
+        list[ours] = { ...list[ours], ...nextEntry };
+    }
+    else {
+        list.push(nextEntry);
+    }
     hooks.beforeShellExecution = list;
     existing.hooks = hooks;
     if (existing.version === undefined)

package/dist/mcp/output-schemas.d.ts

@@ -0,0 +1,37 @@
+/**
+ * JSON Schema for MCP tool `structuredContent`. The SDK validates successful
+ * results against the advertised `outputSchema`, so every property a handler
+ * actually returns must be listed. Roots are always `type: object` — a
+ * oneOf/anyOf root is treated as non-object by the 2025-era codec and wraps
+ * the result as `{ result: … }`.
+ */
+export type JsonSchema = Record<string, unknown>;
+/** Hosted + stdio `comment` / `put.comment` — all PostCommentResult variants. */
+export declare const commentResultSchema: JsonSchema;
+/** Single-file put (flat) or multi-file `{ uploads, failures }`, plus optional comment/promote extras. */
+export declare const putResultSchema: JsonSchema;
+export declare const listResultSchema: JsonSchema;
+export declare const deleteResultSchema: JsonSchema;
+export declare const metadataResultSchema: JsonSchema;
+export declare const findFilesResultSchema: JsonSchema;
+/** `meta keys` or `meta values <key>`. */
+export declare const metadataFacetsResultSchema: JsonSchema;
+export declare const repoLinkStatusResultSchema: JsonSchema;
+export declare const usageResultSchema: JsonSchema;
+export declare const reconcileResultSchema: JsonSchema;
+export declare const purgeExpiredResultSchema: JsonSchema;
+export declare const healthResultSchema: JsonSchema;
+export declare const promoteToolResultSchema: JsonSchema;
+export declare const galleryResultSchema: JsonSchema;
+export declare const galleryFindResultSchema: JsonSchema;
+/** Hosted catalog — every tool must have an entry. */
+export declare const hostedOutputSchemas: Record<string, JsonSchema>;
+/** Shared-shape stdio tools. Hosted-only tools (`promote`, `repo_link_status`) omitted. */
+export declare const stdioOutputSchemas: Record<string, JsonSchema>;
+export declare function withOutputSchemas<T extends {
+    name: string;
+}>(tools: T[], schemas: Record<string, JsonSchema>, opts: {
+    required: boolean;
+}): Array<T & {
+    outputSchema?: JsonSchema;
+}>;

package/dist/mcp/output-schemas.js

@@ -0,0 +1,338 @@
+function objectSchema(properties, required = []) {
+    return {
+        type: "object",
+        properties,
+        ...(required.length > 0 ? { required } : {}),
+        additionalProperties: false,
+    };
+}
+const stringMap = {
+    type: "object",
+    additionalProperties: { type: "string" },
+};
+const nullableString = { type: ["string", "null"] };
+const nullableNumber = { type: ["number", "null"] };
+/** Hosted + stdio `comment` / `put.comment` — all PostCommentResult variants. */
+export const commentResultSchema = objectSchema({
+    posted: { type: "boolean" },
+    reason: {
+        type: "string",
+        enum: [
+            "app_unconfigured",
+            "not_installed",
+            "not_authorized",
+            "actor_not_authorized",
+            "unavailable",
+            "forbidden",
+        ],
+    },
+    message: { type: "string" },
+    fixUrl: { type: "string" },
+    required: { type: "array", items: { type: "string" } },
+    action: { type: "string", enum: ["skipped", "created", "updated"] },
+    count: { type: "number" },
+    commentUrl: { type: "string" },
+}, ["posted"]);
+const promoteResultSchema = objectSchema({
+    promoted: { type: "array", items: { type: "string" } },
+    skipped: {
+        type: "array",
+        items: objectSchema({ key: { type: "string" }, reason: { type: "string" } }, [
+            "key",
+            "reason",
+        ]),
+    },
+}, ["promoted", "skipped"]);
+const putObjectFields = {
+    key: { type: "string" },
+    url: nullableString,
+    embedUrl: nullableString,
+    size: { type: "number" },
+    contentType: { type: "string" },
+    replaced: { type: "boolean" },
+    markdown: { type: "string" },
+    provenance: stringMap,
+    metadata: stringMap,
+    visibility: { type: "string" },
+};
+/** Hosted `PostCommentResult` or stdio `AttachmentsCommentResult` (`via`/`action`). */
+const putCommentSchema = objectSchema({
+    posted: { type: "boolean" },
+    reason: {
+        type: "string",
+        enum: [
+            "app_unconfigured",
+            "not_installed",
+            "not_authorized",
+            "actor_not_authorized",
+            "unavailable",
+            "forbidden",
+        ],
+    },
+    message: { type: "string" },
+    fixUrl: { type: "string" },
+    required: { type: "array", items: { type: "string" } },
+    action: { type: "string", enum: ["skipped", "created", "updated"] },
+    count: { type: "number" },
+    commentUrl: { type: "string" },
+    via: { type: "string", enum: ["bot", "gh"] },
+});
+const putExtras = {
+    comment: putCommentSchema,
+    commentError: { type: "string" },
+    promotion: promoteResultSchema,
+    promoteError: { type: "string" },
+};
+const putFailure = objectSchema({
+    file: { type: "string" },
+    error: objectSchema({
+        message: { type: "string" },
+        code: { type: "string" },
+        status: { type: "number" },
+    }, ["message"]),
+}, ["file", "error"]);
+/** Single-file put (flat) or multi-file `{ uploads, failures }`, plus optional comment/promote extras. */
+export const putResultSchema = objectSchema({
+    workspace: { type: "string" },
+    ...putObjectFields,
+    file: { type: "string" },
+    uploads: {
+        type: "array",
+        items: {
+            type: "object",
+            properties: { file: { type: "string" }, ...putObjectFields },
+            additionalProperties: true,
+        },
+    },
+    failures: { type: "array", items: putFailure },
+    ...putExtras,
+    // stdio put adds client-side optimize/frame provenance and dry-run flags.
+    optimize: { type: "object", additionalProperties: true },
+    frame: { type: "object", additionalProperties: true },
+    dryRun: { type: "boolean" },
+    hint: { type: "string" },
+});
+export const listResultSchema = objectSchema({
+    items: {
+        type: "array",
+        items: objectSchema({
+            key: { type: "string" },
+            url: nullableString,
+            embedUrl: nullableString,
+            size: { type: "number" },
+            contentType: { type: "string" },
+            uploaded: { type: "string" },
+            visibility: { type: "string" },
+            pageUrl: { type: "string" },
+        }),
+    },
+    cursor: nullableString,
+    prefixes: { type: "array", items: { type: "string" } },
+});
+export const deleteResultSchema = objectSchema({
+    key: { type: "string" },
+    deleted: { type: "boolean" },
+    dryRun: { type: "boolean" },
+}, ["key"]);
+export const metadataResultSchema = objectSchema({ metadata: stringMap }, ["metadata"]);
+export const findFilesResultSchema = objectSchema({
+    items: {
+        type: "array",
+        items: objectSchema({
+            key: { type: "string" },
+            url: nullableString,
+            metadata: stringMap,
+        }, ["key"]),
+    },
+    cursor: nullableString,
+    truncated: { type: "boolean" },
+}, ["items"]);
+/** `meta keys` or `meta values <key>`. */
+export const metadataFacetsResultSchema = objectSchema({
+    keys: {
+        type: "array",
+        items: objectSchema({
+            key: { type: "string" },
+            count: { type: "number" },
+            distinctValues: { type: "number" },
+        }, ["key", "count", "distinctValues"]),
+    },
+    truncated: { type: "boolean" },
+    key: { type: "string" },
+    values: {
+        type: "array",
+        items: objectSchema({ value: { type: "string" }, count: { type: "number" } }, [
+            "value",
+            "count",
+        ]),
+    },
+});
+export const repoLinkStatusResultSchema = objectSchema({ binding: { type: "string", enum: ["self", "other", "none"] } }, ["binding"]);
+export const usageResultSchema = objectSchema({
+    workspace: { type: "string" },
+    bytes: { type: "number" },
+    objects: { type: "number" },
+    uploadsInPeriod: { type: "number" },
+    periodStart: { type: "string" },
+    updatedAt: { type: "string" },
+    maxStorageBytes: { type: "number" },
+    storageRemainingBytes: { type: "number" },
+    maxUploadsPerPeriod: { type: "number" },
+    uploadsRemaining: { type: "number" },
+});
+export const reconcileResultSchema = objectSchema({
+    workspace: { type: "string" },
+    bytes: { type: "number" },
+    objects: { type: "number" },
+    previous: objectSchema({ bytes: { type: "number" }, objects: { type: "number" } }, [
+        "bytes",
+        "objects",
+    ]),
+    changed: { type: "boolean" },
+    usage: usageResultSchema,
+    unprefixedBucket: { type: "boolean" },
+});
+export const purgeExpiredResultSchema = objectSchema({
+    skipped: { type: "boolean" },
+    reason: { type: "string" },
+    workspace: { type: "string" },
+    retentionDays: { type: "number" },
+    cutoff: { type: "string" },
+    deleted: { type: "number" },
+    freedBytes: { type: "number" },
+    keys: { type: "array", items: { type: "string" } },
+    keysTruncated: { type: "boolean" },
+    reconcile: reconcileResultSchema,
+});
+export const healthResultSchema = objectSchema({
+    ok: { type: "boolean" },
+    apiUrl: { type: "string" },
+});
+export const promoteToolResultSchema = objectSchema({
+    promotion: promoteResultSchema,
+    comment: commentResultSchema,
+    commentError: { type: "string" },
+}, ["promotion"]);
+const galleryItemSchema = objectSchema({
+    id: { type: "string" },
+    objectKey: { type: "string" },
+    filename: { type: "string" },
+    position: { type: "number" },
+    caption: nullableString,
+    altText: nullableString,
+    createdAt: { type: "string" },
+    status: { type: "string", enum: ["available", "missing", "withheld"] },
+    url: nullableString,
+    embedUrl: nullableString,
+    pageUrl: { type: "string" },
+    contentType: nullableString,
+    size: nullableNumber,
+    uploaded: nullableString,
+    modified: nullableString,
+    posterUrl: { type: "string" },
+    videoDimensions: {
+        type: "object",
+        additionalProperties: true,
+    },
+});
+const galleryReferenceSchema = objectSchema({
+    id: { type: "string" },
+    provider: { type: "string" },
+    resourceType: { type: "string" },
+    coordinate: { type: "string" },
+    canonicalUrl: nullableString,
+    createdAt: { type: "string" },
+    title: { type: "string" },
+    kind: { type: "string", enum: ["pull", "issue"] },
+});
+export const galleryResultSchema = objectSchema({
+    id: { type: "string" },
+    url: { type: "string" },
+    workspace: { type: "string" },
+    title: { type: "string" },
+    description: nullableString,
+    visibility: { type: "string" },
+    coverItemId: nullableString,
+    version: { type: "number" },
+    createdAt: { type: "string" },
+    updatedAt: { type: "string" },
+    items: { type: "array", items: galleryItemSchema },
+    itemCount: { type: "number" },
+    references: { type: "array", items: galleryReferenceSchema },
+});
+export const galleryFindResultSchema = objectSchema({
+    galleries: { type: "array", items: galleryResultSchema },
+    nextCursor: nullableString,
+});
+/** Hosted catalog — every tool must have an entry. */
+export const hostedOutputSchemas = {
+    gallery_create: galleryResultSchema,
+    gallery_get: galleryResultSchema,
+    gallery_add: galleryItemSchema,
+    gallery_link: galleryReferenceSchema,
+    gallery_find_by_reference: galleryFindResultSchema,
+    put: putResultSchema,
+    list: listResultSchema,
+    delete: deleteResultSchema,
+    comment: commentResultSchema,
+    promote: promoteToolResultSchema,
+    get_metadata: metadataResultSchema,
+    set_metadata: metadataResultSchema,
+    find_files: findFilesResultSchema,
+    list_metadata_keys: metadataFacetsResultSchema,
+    repo_link_status: repoLinkStatusResultSchema,
+    usage: usageResultSchema,
+    reconcile: reconcileResultSchema,
+    purge_expired: purgeExpiredResultSchema,
+    health: healthResultSchema,
+};
+/** Shared-shape stdio tools. Hosted-only tools (`promote`, `repo_link_status`) omitted. */
+export const stdioOutputSchemas = {
+    gallery_create: galleryResultSchema,
+    gallery_get: galleryResultSchema,
+    gallery_add: galleryItemSchema,
+    gallery_link: galleryReferenceSchema,
+    gallery_find_by_reference: galleryFindResultSchema,
+    put: putResultSchema,
+    list: listResultSchema,
+    delete: deleteResultSchema,
+    comment: objectSchema({
+        posted: { type: "boolean" },
+        reason: { type: "string" },
+        message: { type: "string" },
+        fixUrl: { type: "string" },
+        required: { type: "array", items: { type: "string" } },
+        action: { type: "string", enum: ["skipped", "created", "updated"] },
+        count: { type: "number" },
+        commentUrl: { type: "string" },
+        repo: { type: "string" },
+        kind: { type: "string" },
+        num: { type: "number" },
+        via: { type: "string", enum: ["bot", "gh"] },
+    }),
+    get_metadata: metadataResultSchema,
+    set_metadata: metadataResultSchema,
+    find_files: findFilesResultSchema,
+    list_metadata_keys: metadataFacetsResultSchema,
+    usage: usageResultSchema,
+    reconcile: reconcileResultSchema,
+    purge_expired: purgeExpiredResultSchema,
+    health: healthResultSchema,
+    report: objectSchema({
+        ok: { type: "boolean" },
+        id: { type: "string" },
+        hasAttachment: { type: "boolean" },
+    }, ["ok"]),
+};
+export function withOutputSchemas(tools, schemas, opts) {
+    return tools.map((tool) => {
+        const outputSchema = schemas[tool.name];
+        if (!outputSchema) {
+            if (opts.required) {
+                throw new Error(`missing output schema for MCP tool ${tool.name}`);
+            }
+            return tool;
+        }
+        return { ...tool, outputSchema };
+    });
+}

package/dist/mcp/server.d.ts

@@ -22,11 +22,63 @@ export { appProp, canonicalMetaFromArgs, METADATA_DESCRIPTION, metadataArgWithCa
 export { ToolBatchError, batchFailureMessage } from "./batch-error.js";
 export { mapBounded } from "../async.js";
 export { McpServer, type jsonSchemaValidator };
+export { commentResultSchema, deleteResultSchema, findFilesResultSchema, galleryFindResultSchema, galleryResultSchema, healthResultSchema, hostedOutputSchemas, listResultSchema, metadataFacetsResultSchema, metadataResultSchema, promoteToolResultSchema, purgeExpiredResultSchema, putResultSchema, reconcileResultSchema, repoLinkStatusResultSchema, stdioOutputSchemas, usageResultSchema, withOutputSchemas, } from "./output-schemas.js";
+/** MCP tool safety hints. Required so tools/list advertises them for review. */
+export interface McpToolAnnotations {
+    readOnlyHint: boolean;
+    destructiveHint: boolean;
+    openWorldHint: boolean;
+}
+/** Lookup / list / health. Does not change workspace or public state. */
+export declare const mcpRead: McpToolAnnotations;
+/** Creates or updates a public object, gallery, or comment without deleting. */
+export declare const mcpWritePublic: McpToolAnnotations;
+/** Deletes or overwrites a public object or a public GitHub comment. */
+export declare const mcpDestroyPublic: McpToolAnnotations;
+/** Mutates first-party / internal state only (ledger, reports). */
+export declare const mcpWriteInternal: McpToolAnnotations;
+/**
+ * Per-tool auth policy for ChatGPT / Codex plugin review. Advertised on
+ * tools/list as `_meta.securitySchemes` (the SDK has no first-class field).
+ */
+export type McpSecurityScheme = {
+    type: "noauth";
+} | {
+    type: "oauth2";
+    scopes: string[];
+};
+export declare const mcpOAuthRead: McpSecurityScheme[];
+export declare const mcpOAuthWrite: McpSecurityScheme[];
+export declare const mcpOAuthDelete: McpSecurityScheme[];
+/** Authenticated, no particular file scope (hosted `health`). */
+export declare const mcpOAuthAny: McpSecurityScheme[];
+/** Callable without a token (stdio `health`). */
+export declare const mcpNoAuth: McpSecurityScheme[];
+/**
+ * Thrown when a presented token is missing a required scope. wrapHandler
+ * turns this into a tool error that carries `_meta["mcp/www_authenticate"]`
+ * so ChatGPT can prompt a re-consent.
+ */
+export declare class McpAuthError extends Error {
+    readonly challenge: string;
+    constructor(message: string, challenge: string);
+}
+/** Build an insufficient_scope challenge pointing at this resource's metadata. */
+export declare function insufficientScopeError(resourceMetadataUrl: string, scope: string): McpAuthError;
 export interface McpTool {
     name: string;
     description: string;
+    /** Short label for tools/list. Falls back to `name` when omitted. */
+    title?: string;
+    annotations: McpToolAnnotations;
+    securitySchemes: McpSecurityScheme[];
     /** Hand-written JSON Schema for the tool's arguments. */
     inputSchema: Record<string, unknown>;
+    /**
+     * Hand-written JSON Schema for successful `structuredContent`. Required
+     * whenever the handler returns structured data (OpenAI Scan Tools).
+     */
+    outputSchema?: Record<string, unknown>;
     handler: (args: Record<string, unknown>) => Promise<unknown>;
 }
 export declare function createMcpServer(opts: {

package/dist/mcp/server.js

@@ -25,6 +25,58 @@ export { appProp, canonicalMetaFromArgs, METADATA_DESCRIPTION, metadataArgWithCa
 export { ToolBatchError, batchFailureMessage } from "./batch-error.js";
 export { mapBounded } from "../async.js";
 export { McpServer };
+export { commentResultSchema, deleteResultSchema, findFilesResultSchema, galleryFindResultSchema, galleryResultSchema, healthResultSchema, hostedOutputSchemas, listResultSchema, metadataFacetsResultSchema, metadataResultSchema, promoteToolResultSchema, purgeExpiredResultSchema, putResultSchema, reconcileResultSchema, repoLinkStatusResultSchema, stdioOutputSchemas, usageResultSchema, withOutputSchemas, } from "./output-schemas.js";
+/** Lookup / list / health. Does not change workspace or public state. */
+export const mcpRead = {
+    readOnlyHint: true,
+    destructiveHint: false,
+    openWorldHint: false,
+};
+/** Creates or updates a public object, gallery, or comment without deleting. */
+export const mcpWritePublic = {
+    readOnlyHint: false,
+    destructiveHint: false,
+    openWorldHint: true,
+};
+/** Deletes or overwrites a public object or a public GitHub comment. */
+export const mcpDestroyPublic = {
+    readOnlyHint: false,
+    destructiveHint: true,
+    openWorldHint: true,
+};
+/** Mutates first-party / internal state only (ledger, reports). */
+export const mcpWriteInternal = {
+    readOnlyHint: false,
+    destructiveHint: false,
+    openWorldHint: false,
+};
+function oauth(scopes) {
+    return [{ type: "oauth2", scopes }];
+}
+export const mcpOAuthRead = oauth(["files:read"]);
+export const mcpOAuthWrite = oauth(["files:write"]);
+export const mcpOAuthDelete = oauth(["files:delete"]);
+/** Authenticated, no particular file scope (hosted `health`). */
+export const mcpOAuthAny = oauth([]);
+/** Callable without a token (stdio `health`). */
+export const mcpNoAuth = [{ type: "noauth" }];
+/**
+ * Thrown when a presented token is missing a required scope. wrapHandler
+ * turns this into a tool error that carries `_meta["mcp/www_authenticate"]`
+ * so ChatGPT can prompt a re-consent.
+ */
+export class McpAuthError extends Error {
+    challenge;
+    constructor(message, challenge) {
+        super(message);
+        this.name = "McpAuthError";
+        this.challenge = challenge;
+    }
+}
+/** Build an insufficient_scope challenge pointing at this resource's metadata. */
+export function insufficientScopeError(resourceMetadataUrl, scope) {
+    return new McpAuthError(`forbidden: requires ${scope} scope`, `Bearer resource_metadata="${resourceMetadataUrl}", error="insufficient_scope", error_description="This tool requires the ${scope} scope"`);
+}
 /**
  * The tool catalog is fixed for the lifetime of a deploy, so a generous
  * freshness hint is honest. `private` rather than `public` because the list is
@@ -75,6 +127,13 @@ function wrapHandler(tool, apiUrl) {
                     isError: true,
                 };
             }
+            if (err instanceof McpAuthError) {
+                return {
+                    content: [{ type: "text", text: err.message }],
+                    isError: true,
+                    _meta: { "mcp/www_authenticate": [err.challenge] },
+                };
+            }
             return { content: [{ type: "text", text: toolErrorText(err) }], isError: true };
         }
     };
@@ -86,8 +145,14 @@ export function createMcpServer(opts) {
     });
     for (const tool of tools) {
         server.registerTool(tool.name, {
+            ...(tool.title ? { title: tool.title } : {}),
             description: tool.description,
             inputSchema: fromJsonSchema(tool.inputSchema, validator),
+            ...(tool.outputSchema
+                ? { outputSchema: fromJsonSchema(tool.outputSchema, validator) }
+                : {}),
+            annotations: tool.annotations,
+            _meta: { securitySchemes: tool.securitySchemes },
         }, wrapHandler(tool, apiUrl));
     }
     return server;