@burdenoff/mcp-libs 2026.523.1 → 2026.529.1

package/dist/modules/vibecontrols/index.js

@@ -1,4 +1,4 @@
-import { LIST_AGENTS, GET_AGENT, CREATE_AGENT, UPDATE_AGENT, DELETE_AGENT, PROBE_AGENT_CONNECTION, AGENT_HEALTH_PROBES, AGENT_PLUGINS, INSTALL_AGENT_PLUGIN, REMOVE_AGENT_PLUGIN, LIST_VIBES, GET_VIBE, CREATE_VIBE, UPDATE_VIBE, DELETE_VIBE, UPDATE_VIBE_STATUS, ARCHIVE_VIBE, RESTORE_VIBE, VIBE_HIERARCHY, SEARCH_VIBES, MOVE_VIBE, UPDATE_VIBE_GIT, LIST_SESSIONS, GET_SESSION, CREATE_SESSION, START_SESSION, STOP_SESSION, RESTART_SESSION, TERMINATE_SESSION, SEND_SESSION_INPUT, START_SESSION_TERMINAL, SESSION_OUTPUT, ACTIVE_SESSIONS, CHECK_SESSION_HEALTH, BULK_RESTART_SESSIONS, BULK_STOP_SESSIONS, BULK_TERMINATE_SESSIONS, UPDATE_SESSION, UPDATE_SESSION_STATUS, DELETE_SESSION, KILL_SESSION, LIST_NOTES, GET_NOTE, CREATE_NOTE, UPDATE_NOTE, DELETE_NOTE, SEARCH_NOTES, PIN_NOTE, UNPIN_NOTE, LIST_CONFIGURATIONS, GET_CONFIGURATION, SET_CONFIGURATION, DELETE_CONFIGURATION, CONFIGURATIONS_BY_SCOPE, LIST_WEBHOOKS, GET_WEBHOOK, CREATE_WEBHOOK, UPDATE_WEBHOOK, DELETE_WEBHOOK, TEST_WEBHOOK, TRIGGER_WEBHOOK, LIST_TUNNELS, CREATE_TUNNEL, STOP_TUNNEL, DELETE_TUNNEL, GET_UI_SESSION, SAVE_UI_SESSION, CLEAR_UI_SESSION, LIST_AI_TOOL_EVENTS, CREATE_AI_TOOL_EVENT, RECENT_AI_TOOL_EVENTS, LIST_TARGETS, GET_TARGET, CREATE_TARGET, UPDATE_TARGET, DELETE_TARGET, TEST_TARGET, IMPORT_TARGETS_FROM_CONFIG, SCAN_SSH_CONFIG, INSTALL_AGENT_ON_TARGET, LIST_VIBEDECKS, GET_VIBEDECK, CREATE_VIBEDECK, UPDATE_VIBEDECK, DELETE_VIBEDECK, DUPLICATE_VIBEDECK, SET_DEFAULT_VIBEDECK, LIST_VIBEDECK_BUTTONS, CREATE_VIBEDECK_BUTTON, UPDATE_VIBEDECK_BUTTON, DELETE_VIBEDECK_BUTTON, EXECUTE_VIBEDECK_BUTTON, LIST_DOCS_SITES, GET_DOCS_SITE, CREATE_DOCS_SITE, UPDATE_DOCS_SITE, DELETE_DOCS_SITE, LIST_DOCS_PAGES, GET_DOCS_PAGE, CREATE_DOCS_PAGE, UPDATE_DOCS_PAGE, DELETE_DOCS_PAGE, COMPILE_DOCS_SITE, PUBLISH_DOCS_REVISION, ROLLBACK_DOCS_REVISION, SHARE_SESSION, CREATE_SESSION_SHARE_LINK, REVOKE_SESSION_SHARE, REVOKE_SESSION_SHARE_LINK, SESSION_SHARES, SESSION_SHARE_LINKS, SESSION_COLLABORATORS, SESSIONS_SHARED_WITH_ME, LIST_AUDIT_LOGS, GET_AUDIT_LOG, AUDIT_LOG_STATS, EXPORT_AUDIT_LOGS, DELETE_AUDIT_LOG, LIST_ACTIONS, GET_ACTION, CREATE_ACTION, UPDATE_ACTION, DELETE_ACTION, EXECUTE_ACTION, LIST_ACTION_EXECUTIONS, DUPLICATE_ACTION, INSTALL_ACTION_FROM_STORE, CANCEL_ACTION_EXECUTION, CREATE_SCHEDULED_JOB, DELETE_SCHEDULED_JOB, LIST_SCHEDULED_JOBS, VIBECONTROLS_ANALYTICS, PINNED_NOTES } from '../../chunk-N2CZNPYC.js';
+import { LIST_AGENTS, GET_AGENT, CREATE_AGENT, UPDATE_AGENT, DELETE_AGENT, PROBE_AGENT_CONNECTION, AGENT_HEALTH_PROBES, AGENT_PLUGINS, INSTALL_AGENT_PLUGIN, REMOVE_AGENT_PLUGIN, LIST_VIBES, GET_VIBE, CREATE_VIBE, UPDATE_VIBE, DELETE_VIBE, UPDATE_VIBE_STATUS, ARCHIVE_VIBE, RESTORE_VIBE, VIBE_HIERARCHY, SEARCH_VIBES, MOVE_VIBE, UPDATE_VIBE_GIT, LIST_SESSIONS, GET_SESSION, CREATE_SESSION, START_SESSION, STOP_SESSION, RESTART_SESSION, TERMINATE_SESSION, SEND_SESSION_INPUT, START_SESSION_TERMINAL, SESSION_OUTPUT, ACTIVE_SESSIONS, CHECK_SESSION_HEALTH, BULK_RESTART_SESSIONS, BULK_STOP_SESSIONS, BULK_TERMINATE_SESSIONS, UPDATE_SESSION, UPDATE_SESSION_STATUS, DELETE_SESSION, KILL_SESSION, STOP_SESSION_TERMINAL, RESTART_SESSION_TERMINAL, START_TARGET_TERMINAL, STOP_TARGET_TERMINAL, EXPORT_SESSIONS, LIST_NOTES, GET_NOTE, CREATE_NOTE, UPDATE_NOTE, DELETE_NOTE, SEARCH_NOTES, PIN_NOTE, UNPIN_NOTE, LIST_CONFIGURATIONS, GET_CONFIGURATION, SET_CONFIGURATION, DELETE_CONFIGURATION, CONFIGURATIONS_BY_SCOPE, SECURITY_PROVIDERS_Q, SET_SECURITY_PROVIDER_M, MY_SECURITY_SCANS_Q, ALL_SECURITY_SCANS_Q, SECURITY_SCAN_Q, RUN_SECURITY_SCAN_M, CANCEL_SECURITY_SCAN_M, SECURITY_FINDINGS_Q, UPDATE_SECURITY_FINDING_STATUS_M, SECURITY_POLICY_DECISION_Q, SECURITY_STATUS_Q, REPOSITORY_SECURITY_CONFIG_Q, UPDATE_REPOSITORY_SECURITY_CONFIG_M, CREATE_SECURITY_EXCEPTION_M, REVOKE_SECURITY_EXCEPTION_M, PRESIGN_SECURITY_EVIDENCE_M, PUSH_SECURITY_SCAN_RUN_M, GET_CI_STATUS_Q, REFRESH_CI_STATUS_M, GET_CI_PIPELINE_RUNS_Q, GET_CI_PIPELINE_DETAILS_Q, GET_REPO_STATS_Q, REFRESH_REPO_STATS_M, LIST_GITOPS_PROVIDERS_Q, GET_GITOPS_PROVIDER_Q, CREATE_GITOPS_PROVIDER_M, UPDATE_GITOPS_PROVIDER_M, DELETE_GITOPS_PROVIDER_M, MY_SETTINGS_Q, MY_SETTINGS_BY_CATEGORY_Q, RESET_SETTINGS_M, UPDATE_PREFERENCES_M, UPDATE_NOTIFICATION_PREFERENCES_M, UPDATE_WORKSPACE_DEFAULTS_M, LIST_SETTINGS_SECRETS_Q, SET_SETTINGS_SECRET_M, DELETE_SETTINGS_SECRET_M, RESOLVE_INTEGRATION_TOKEN_M, LIST_WEBHOOKS, GET_WEBHOOK, CREATE_WEBHOOK, UPDATE_WEBHOOK, DELETE_WEBHOOK, TEST_WEBHOOK, TRIGGER_WEBHOOK, GET_UI_SESSION, SAVE_UI_SESSION, CLEAR_UI_SESSION, LIST_AI_TOOL_EVENTS, CREATE_AI_TOOL_EVENT, RECENT_AI_TOOL_EVENTS, LIST_TARGETS, GET_TARGET, CREATE_TARGET, UPDATE_TARGET, DELETE_TARGET, TEST_TARGET, IMPORT_TARGETS_FROM_CONFIG, SCAN_SSH_CONFIG, INSTALL_AGENT_ON_TARGET, LIST_VIBEDECKS, GET_VIBEDECK, CREATE_VIBEDECK, UPDATE_VIBEDECK, DELETE_VIBEDECK, DUPLICATE_VIBEDECK, SET_DEFAULT_VIBEDECK, LIST_VIBEDECK_BUTTONS, CREATE_VIBEDECK_BUTTON, UPDATE_VIBEDECK_BUTTON, DELETE_VIBEDECK_BUTTON, EXECUTE_VIBEDECK_BUTTON, LIST_DOCS_SITES, GET_DOCS_SITE, CREATE_DOCS_SITE, UPDATE_DOCS_SITE, DELETE_DOCS_SITE, LIST_DOCS_PAGES, GET_DOCS_PAGE, CREATE_DOCS_PAGE, UPDATE_DOCS_PAGE, DELETE_DOCS_PAGE, COMPILE_DOCS_SITE, PUBLISH_DOCS_REVISION, ROLLBACK_DOCS_REVISION, SHARE_SESSION, CREATE_SESSION_SHARE_LINK, REVOKE_SESSION_SHARE, REVOKE_SESSION_SHARE_LINK, SESSION_SHARES, SESSION_SHARE_LINKS, SESSION_COLLABORATORS, SESSIONS_SHARED_WITH_ME, UPDATE_SESSION_SHARE, JOIN_SHARED_SESSION, LEAVE_SHARED_SESSION, REQUEST_SESSION_CONTROL, RELEASE_SESSION_CONTROL, TRANSFER_SESSION_CONTROL, LIST_AUDIT_LOGS, GET_AUDIT_LOG, AUDIT_LOG_STATS, EXPORT_AUDIT_LOGS, DELETE_AUDIT_LOG, LIST_ACTIONS, GET_ACTION, CREATE_ACTION, UPDATE_ACTION, DELETE_ACTION, EXECUTE_ACTION, LIST_ACTION_EXECUTIONS, DUPLICATE_ACTION, INSTALL_ACTION_FROM_STORE, CANCEL_ACTION_EXECUTION, CREATE_SCHEDULED_JOB, DELETE_SCHEDULED_JOB, LIST_SCHEDULED_JOBS, LIST_AI_PROMPTS, GET_AI_PROMPT, CREATE_AI_PROMPT, UPDATE_AI_PROMPT, DELETE_AI_PROMPT, DUPLICATE_AI_PROMPT, RENDER_AI_PROMPT, RECORD_AI_PROMPT_USAGE, LIST_VIBE_DECK_SHARE_LINKS, CREATE_VIBE_DECK_SHARE_LINK, UPDATE_VIBE_DECK_SHARE_LINK, REVOKE_VIBE_DECK_SHARE_LINK, VALIDATE_VIBE_DECK_SHARE_LINK, SHARED_VIBE_DECK, EXECUTE_SHARED_VIBE_DECK_BUTTON, VIBECONTROLS_ANALYTICS, LIST_CATALOGS, GET_CATALOG, GET_CATALOG_DEPENDENCY_GRAPH, GET_CATALOG_SBOM, CREATE_CATALOG, UPDATE_CATALOG, DELETE_CATALOG, ADD_COMPONENT_TO_CATALOG, REMOVE_COMPONENT_FROM_CATALOG, ADD_VIBE_TO_CATALOG, REMOVE_VIBE_FROM_CATALOG, LIST_COMPONENTS, GET_COMPONENT, CREATE_COMPONENT, UPDATE_COMPONENT, DELETE_COMPONENT, FORK_GITHUB_REPO, PUBLISH_COMPONENT_AS_TEMPLATE, LIST_TEMPLATES, GET_TEMPLATE, UPDATE_TEMPLATE, DELETE_TEMPLATE, INSTANTIATE_TEMPLATE, GET_SCORECARD, UPSERT_SCORECARD, ADD_SCORECARD_METRIC, UPDATE_SCORECARD_METRIC, REMOVE_SCORECARD_METRIC, LIST_TUNNELS, PINNED_NOTES, GET_TUNNEL, GET_TUNNEL_BY_SLUG, CREATE_TUNNEL, UPDATE_TUNNEL, DELETE_TUNNEL, START_TUNNEL, STOP_TUNNEL, ROTATE_TUNNEL_CREDENTIALS, ISSUE_TUNNEL_SESSION, REVOKE_TUNNEL_SESSION, LIST_TUNNEL_SESSIONS, LIST_TUNNEL_PROVIDERS, GET_TUNNEL_PROVIDER, LIST_TUNNEL_SHARDS, TUNNEL_USAGE, TUNNEL_AUDIT, LIST_TUNNEL_DOMAINS, GET_TUNNEL_DOMAIN, RESERVE_TUNNEL_SUBDOMAIN, REGISTER_CUSTOM_TUNNEL_DOMAIN, VERIFY_TUNNEL_DOMAIN, ATTACH_TUNNEL_DOMAIN, DETACH_TUNNEL_DOMAIN, DELETE_TUNNEL_DOMAIN, PROBE_AGENT_TUNNEL, ADD_AGENT_FROM_TUNNEL } from '../../chunk-HRWIDQJE.js';
 import { getAuth } from '../../chunk-WWFVD7BO.js';
 import { mcpToolName, jsonResult, errorResult } from '../../chunk-H2OYWLOA.js';
 import { z } from 'zod';
@@ -765,513 +765,2923 @@ function registerAgentTools(server, ctx, track) {
     }
   );
 }
-function registerAiEventTools(server, ctx, track) {
+function registerAiPromptTools(server, ctx, track) {
   server.registerTool(
-    track(mcpToolName(ctx.productName, "ai_events_list")),
+    track(mcpToolName(ctx.productName, "ai_prompts_list")),
     {
-      title: "List AI Tool Events",
-      description: "List AI tool events with optional filters and pagination.",
+      title: "List AI Prompts",
+      description: "List AI prompt templates with optional filters.",
       inputSchema: {
-        source: z.string().optional().describe("Filter by event source"),
-        eventType: z.string().optional().describe("Filter by event type"),
-        agentId: z.string().optional().describe("Filter by agent ID"),
-        limit: z.number().optional().describe("Max results"),
-        offset: z.number().optional().describe("Offset for pagination")
+        category: z.string().optional().describe("Filter by category"),
+        status: z.string().optional().describe("Filter by status (ACTIVE, ARCHIVED, DRAFT)"),
+        isShared: z.boolean().optional().describe("Only shared prompts"),
+        search: z.string().optional().describe("Search text"),
+        limit: z.number().optional(),
+        offset: z.number().optional()
       }
     },
-    async ({ source, eventType, agentId, limit, offset }) => {
+    async ({ category, status, isShared, search, limit, offset }) => {
       try {
         const filter = {};
-        if (source !== void 0) filter.source = source;
-        if (eventType !== void 0) filter.eventType = eventType;
-        if (agentId !== void 0) filter.agentId = agentId;
+        if (category !== void 0) filter.category = category;
+        if (status !== void 0) filter.status = status;
+        if (isShared !== void 0) filter.isShared = isShared;
+        if (search !== void 0) filter.search = search;
         const pagination = {};
         if (limit !== void 0) pagination.limit = limit;
         if (offset !== void 0) pagination.offset = offset;
-        const data = await ctx.gql.workspace.request(
-          LIST_AI_TOOL_EVENTS,
-          {
-            filter: Object.keys(filter).length > 0 ? filter : void 0,
-            pagination: Object.keys(pagination).length > 0 ? pagination : void 0
-          }
+        const data = await ctx.gql.workspace.request(LIST_AI_PROMPTS, {
+          filter: Object.keys(filter).length ? filter : void 0,
+          pagination: Object.keys(pagination).length ? pagination : void 0
+        });
+        return jsonResult(data.aiPrompts);
+      } catch (error) {
+        ctx.logger.error("vibecontrols_actions_ai_prompts_list failed", { error });
+        return errorResult(
+          `Failed to list AI prompts: ${error instanceof Error ? error.message : String(error)}`
         );
-        return jsonResult(data.aiToolEvents);
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "ai_prompts_get")),
+    {
+      title: "Get AI Prompt",
+      description: "Fetch a single AI prompt by ID.",
+      inputSchema: { id: z.string().describe("Prompt ID") }
+    },
+    async ({ id }) => {
+      try {
+        const data = await ctx.gql.workspace.request(GET_AI_PROMPT, { id });
+        return jsonResult(data.aiPrompt);
       } catch (error) {
-        ctx.logger.error("vibecontrols_ai_events_list failed", { error });
+        ctx.logger.error("vibecontrols_actions_ai_prompts_get failed", { error });
         return errorResult(
-          `Failed to list AI events: ${error instanceof Error ? error.message : String(error)}`
+          `Failed to get AI prompt: ${error instanceof Error ? error.message : String(error)}`
         );
       }
     }
   );
   server.registerTool(
-    track(mcpToolName(ctx.productName, "ai_events_create")),
+    track(mcpToolName(ctx.productName, "ai_prompts_create")),
     {
-      title: "Create AI Tool Event",
-      description: "Record a new AI tool event.",
+      title: "Create AI Prompt",
+      description: "Create a new AI prompt template.",
       inputSchema: {
-        source: z.string().describe("Event source (e.g., mcp, cli, sdk)"),
-        eventType: z.string().describe("Event type (e.g., tool_call, completion)"),
-        payload: z.string().describe("Event payload as JSON string"),
-        agentId: z.string().optional().describe("Associated agent ID")
+        name: z.string().describe("Prompt name"),
+        content: z.string().describe("Prompt content/template"),
+        description: z.string().optional(),
+        category: z.string().optional(),
+        status: z.string().optional(),
+        isShared: z.boolean().optional(),
+        tags: z.array(z.string()).optional(),
+        variables: z.unknown().optional(),
+        metadata: z.unknown().optional()
       }
     },
-    async ({ source, eventType, payload, agentId }) => {
+    async (input) => {
       try {
-        const input = { source, eventType };
-        input.payload = JSON.parse(payload);
-        if (agentId !== void 0) input.agentId = agentId;
         const data = await ctx.gql.workspace.request(
-          CREATE_AI_TOOL_EVENT,
-          {
-            input
-          }
+          CREATE_AI_PROMPT,
+          { input }
         );
-        return jsonResult(data.createAiToolEvent);
+        return jsonResult(data.createAIPrompt);
       } catch (error) {
-        ctx.logger.error("vibecontrols_ai_events_create failed", { error });
+        ctx.logger.error("vibecontrols_actions_ai_prompts_create failed", { error });
         return errorResult(
-          `Failed to create AI event: ${error instanceof Error ? error.message : String(error)}`
+          `Failed to create AI prompt: ${error instanceof Error ? error.message : String(error)}`
         );
       }
     }
   );
   server.registerTool(
-    track(mcpToolName(ctx.productName, "ai_events_recent")),
+    track(mcpToolName(ctx.productName, "ai_prompts_update")),
     {
-      title: "Recent AI Tool Events",
-      description: "Get recent AI tool events for a specific agent.",
+      title: "Update AI Prompt",
+      description: "Update an existing AI prompt.",
       inputSchema: {
-        agentId: z.string().describe("Agent ID"),
-        limit: z.number().optional().describe("Maximum events to return")
+        id: z.string().describe("Prompt ID"),
+        name: z.string().optional(),
+        content: z.string().optional(),
+        description: z.string().optional(),
+        category: z.string().optional(),
+        status: z.string().optional(),
+        isShared: z.boolean().optional(),
+        tags: z.array(z.string()).optional(),
+        variables: z.unknown().optional(),
+        metadata: z.unknown().optional()
       }
     },
-    async ({ agentId, limit }) => {
+    async ({ id, ...rest }) => {
       try {
+        const input = {};
+        for (const [k, v] of Object.entries(rest)) {
+          if (v !== void 0) input[k] = v;
+        }
         const data = await ctx.gql.workspace.request(
-          RECENT_AI_TOOL_EVENTS,
-          { agentId, limit }
+          UPDATE_AI_PROMPT,
+          { id, input }
         );
-        return jsonResult(data.recentAiToolEvents);
+        return jsonResult(data.updateAIPrompt);
       } catch (error) {
-        ctx.logger.error("vibecontrols_ai_events_recent failed", { error });
+        ctx.logger.error("vibecontrols_actions_ai_prompts_update failed", { error });
         return errorResult(
-          `Failed to get recent AI events: ${error instanceof Error ? error.message : String(error)}`
+          `Failed to update AI prompt: ${error instanceof Error ? error.message : String(error)}`
         );
       }
     }
   );
-}
-function registerAnalyticsTools(server, ctx, track) {
   server.registerTool(
-    track(mcpToolName(ctx.productName, "analytics_overview")),
+    track(mcpToolName(ctx.productName, "ai_prompts_delete")),
     {
-      title: "VibeControls Analytics Overview",
-      description: "Get consolidated analytics overview with KPIs, time series, and breakdowns for all VibeControls entities (agents, sessions, vibes, actions, webhooks, AI events, vibe decks, audit, docs, notes, config).",
-      inputSchema: {
-        startDate: z.string().optional().describe("Start date (ISO format). Defaults to 7 days ago."),
-        endDate: z.string().optional().describe("End date (ISO format). Defaults to now."),
-        granularity: z.enum(["HOUR", "DAY", "WEEK", "MONTH"]).optional().default("DAY").describe("Time series granularity"),
-        entityTypes: z.array(
-          z.enum([
-            "AGENT",
-            "TARGET",
-            "SESSION",
-            "VIBE",
-            "ACTION",
-            "WEBHOOK",
-            "AI_EVENT",
-            "VIBE_DECK",
-            "AUDIT",
-            "DOCS",
-            "NOTE",
-            "CONFIGURATION"
-          ])
-        ).optional().describe("Filter to specific entity types (null = all)"),
-        agentId: z.string().optional().describe("Filter analytics by agent ID"),
-        vibeId: z.string().optional().describe("Filter analytics by vibe ID")
-      }
+      title: "Delete AI Prompt",
+      description: "Delete an AI prompt.",
+      inputSchema: { id: z.string().describe("Prompt ID") }
     },
-    async ({ startDate, endDate, granularity, entityTypes, agentId, vibeId }) => {
+    async ({ id }) => {
       try {
-        const input = {
-          startDate: startDate || new Date(Date.now() - 7 * 24 * 60 * 60 * 1e3).toISOString(),
-          endDate: endDate || (/* @__PURE__ */ new Date()).toISOString(),
-          granularity: granularity || "DAY"
-        };
-        if (entityTypes && entityTypes.length > 0) input.entityTypes = entityTypes;
-        if (agentId) input.agentId = agentId;
-        if (vibeId) input.vibeId = vibeId;
         const data = await ctx.gql.workspace.request(
-          VIBECONTROLS_ANALYTICS,
-          { input }
+          DELETE_AI_PROMPT,
+          { id }
         );
-        return jsonResult(data.vibecontrolsAnalytics);
+        return jsonResult({ deleted: data.deleteAIPrompt, id });
       } catch (error) {
-        ctx.logger.error("vibecontrols_analytics_overview failed", { error });
+        ctx.logger.error("vibecontrols_actions_ai_prompts_delete failed", { error });
         return errorResult(
-          `Failed to get analytics: ${error instanceof Error ? error.message : String(error)}`
+          `Failed to delete AI prompt: ${error instanceof Error ? error.message : String(error)}`
         );
       }
     }
   );
   server.registerTool(
-    track(mcpToolName(ctx.productName, "analytics_summary")),
+    track(mcpToolName(ctx.productName, "ai_prompts_duplicate")),
     {
-      title: "VibeControls Analytics Summary",
-      description: "Get a quick KPI summary of all VibeControls entity counts (agents, sessions, vibes, actions, etc.). Lighter-weight than the full overview.",
+      title: "Duplicate AI Prompt",
+      description: "Duplicate an AI prompt with a new name.",
       inputSchema: {
-        startDate: z.string().optional().describe("Start date (ISO format). Defaults to 7 days ago."),
-        endDate: z.string().optional().describe("End date (ISO format). Defaults to now.")
+        id: z.string().describe("Source prompt ID"),
+        name: z.string().describe("Name for the duplicate")
       }
     },
-    async ({ startDate, endDate }) => {
+    async ({ id, name }) => {
       try {
-        const input = {
-          startDate: startDate || new Date(Date.now() - 7 * 24 * 60 * 60 * 1e3).toISOString(),
-          endDate: endDate || (/* @__PURE__ */ new Date()).toISOString(),
-          granularity: "DAY"
-        };
-        const data = await ctx.gql.workspace.request(VIBECONTROLS_ANALYTICS, { input });
-        const a = data.vibecontrolsAnalytics;
-        const summary = {
-          agents: { total: a.agents?.total, active: a.agents?.active },
-          targets: { total: a.targets?.total },
-          sessions: { total: a.sessions?.total, active: a.sessions?.active },
-          vibes: { total: a.vibes?.total },
-          actions: {
-            total: a.actions?.total,
-            executions: a.actions?.totalExecutions,
-            successRate: a.actions?.successRate
-          },
-          webhooks: { total: a.webhooks?.total, active: a.webhooks?.active },
-          aiEvents: { total: a.aiEvents?.total },
-          vibeDecks: {
-            totalDecks: a.vibeDecks?.totalDecks,
-            totalButtons: a.vibeDecks?.totalButtons
-          },
-          audit: { total: a.audit?.total },
-          docs: { sites: a.docs?.totalSites, pages: a.docs?.totalPages },
-          notes: { total: a.notes?.total, pinned: a.notes?.pinned },
-          configurations: { total: a.configurations?.total },
-          executionTimeMs: a.executionTimeMs
-        };
-        return jsonResult(summary);
+        const data = await ctx.gql.workspace.request(
+          DUPLICATE_AI_PROMPT,
+          { id, name }
+        );
+        return jsonResult(data.duplicateAIPrompt);
       } catch (error) {
-        ctx.logger.error("vibecontrols_analytics_summary failed", { error });
+        ctx.logger.error("vibecontrols_actions_ai_prompts_duplicate failed", { error });
         return errorResult(
-          `Failed to get analytics summary: ${error instanceof Error ? error.message : String(error)}`
+          `Failed to duplicate AI prompt: ${error instanceof Error ? error.message : String(error)}`
         );
       }
     }
   );
-}
-function registerAuditTools(server, ctx, track) {
   server.registerTool(
-    track(mcpToolName(ctx.productName, "audit_list")),
+    track(mcpToolName(ctx.productName, "ai_prompts_render")),
     {
-      title: "List Audit Logs",
-      description: "List audit logs with optional filters and pagination.",
+      title: "Render AI Prompt",
+      description: "Render an AI prompt template with variables substituted.",
       inputSchema: {
-        action: z.string().optional().describe("Filter by action type"),
-        resourceType: z.string().optional().describe("Filter by resource type"),
-        resourceId: z.string().optional().describe("Filter by resource ID"),
-        actorId: z.string().optional().describe("Filter by actor ID"),
-        status: z.string().optional().describe("Filter by status"),
-        limit: z.number().optional().describe("Max results"),
-        offset: z.number().optional().describe("Offset for pagination")
+        id: z.string().describe("Prompt ID"),
+        variables: z.unknown().optional().describe("Variables as JSON")
       }
     },
-    async ({ action, resourceType, resourceId, actorId, status, limit, offset }) => {
+    async ({ id, variables }) => {
       try {
-        const filter = {};
-        if (action !== void 0) filter.action = action;
-        if (resourceType !== void 0) filter.resourceType = resourceType;
-        if (resourceId !== void 0) filter.resourceId = resourceId;
-        if (actorId !== void 0) filter.actorId = actorId;
-        if (status !== void 0) filter.status = status;
-        const pagination = {};
-        if (limit !== void 0) pagination.limit = limit;
-        if (offset !== void 0) pagination.offset = offset;
-        const data = await ctx.gql.workspace.request(LIST_AUDIT_LOGS, {
-          filter: Object.keys(filter).length > 0 ? filter : void 0,
-          pagination: Object.keys(pagination).length > 0 ? pagination : void 0
-        });
-        return jsonResult(data.vibeAuditLogs);
+        const data = await ctx.gql.workspace.request(RENDER_AI_PROMPT, { id, variables });
+        return jsonResult(data.renderAIPrompt);
       } catch (error) {
-        ctx.logger.error("vibecontrols_audit_list failed", { error });
+        ctx.logger.error("vibecontrols_actions_ai_prompts_render failed", { error });
         return errorResult(
-          `Failed to list audit logs: ${error instanceof Error ? error.message : String(error)}`
+          `Failed to render AI prompt: ${error instanceof Error ? error.message : String(error)}`
         );
       }
     }
   );
   server.registerTool(
-    track(mcpToolName(ctx.productName, "audit_get")),
+    track(mcpToolName(ctx.productName, "ai_prompts_record_usage")),
     {
-      title: "Get Audit Log",
-      description: "Get an audit log entry by its ID.",
-      inputSchema: { id: z.string().describe("Audit log ID") }
+      title: "Record AI Prompt Usage",
+      description: "Increment the usage counter on an AI prompt.",
+      inputSchema: { id: z.string().describe("Prompt ID") }
     },
     async ({ id }) => {
       try {
-        const data = await ctx.gql.workspace.request(GET_AUDIT_LOG, {
-          id
-        });
-        return jsonResult(data.vibeAuditLog);
+        const data = await ctx.gql.workspace.request(
+          RECORD_AI_PROMPT_USAGE,
+          { id }
+        );
+        return jsonResult(data.recordAIPromptUsage);
       } catch (error) {
-        ctx.logger.error("vibecontrols_audit_get failed", { error });
+        ctx.logger.error("vibecontrols_actions_ai_prompts_record_usage failed", { error });
         return errorResult(
-          `Failed to get audit log: ${error instanceof Error ? error.message : String(error)}`
+          `Failed to record AI prompt usage: ${error instanceof Error ? error.message : String(error)}`
         );
       }
     }
   );
+}
+function registerVibeDeckShareLinkTools(server, ctx, track) {
   server.registerTool(
-    track(mcpToolName(ctx.productName, "audit_stats")),
+    track(mcpToolName(ctx.productName, "vibe_deck_share_links_list")),
     {
-      title: "Audit Log Stats",
-      description: "Get aggregated statistics for audit logs.",
-      inputSchema: {
-        action: z.string().optional().describe("Filter stats by action type"),
-        resourceType: z.string().optional().describe("Filter stats by resource type"),
-        status: z.string().optional().describe("Filter stats by status")
-      }
+      title: "List VibeDeck Share-Links",
+      description: "List share-links for a VibeDeck.",
+      inputSchema: { vibeDeckId: z.string().describe("VibeDeck ID") }
     },
-    async ({ action, resourceType, status }) => {
+    async ({ vibeDeckId }) => {
       try {
-        const filter = {};
-        if (action !== void 0) filter.action = action;
-        if (resourceType !== void 0) filter.resourceType = resourceType;
-        if (status !== void 0) filter.status = status;
         const data = await ctx.gql.workspace.request(
-          AUDIT_LOG_STATS,
-          {
-            filter: Object.keys(filter).length > 0 ? filter : void 0
-          }
+          LIST_VIBE_DECK_SHARE_LINKS,
+          { vibeDeckId }
         );
-        return jsonResult(data.vibeAuditLogStats);
+        return jsonResult(data.vibeDeckShareLinks);
       } catch (error) {
-        ctx.logger.error("vibecontrols_audit_stats failed", { error });
+        ctx.logger.error("vibecontrols_vibedecks_share_links_list failed", { error });
         return errorResult(
-          `Failed to get audit log stats: ${error instanceof Error ? error.message : String(error)}`
+          `Failed to list VibeDeck share-links: ${error instanceof Error ? error.message : String(error)}`
         );
       }
     }
   );
   server.registerTool(
-    track(mcpToolName(ctx.productName, "audit_export")),
+    track(mcpToolName(ctx.productName, "vibe_deck_share_links_create")),
     {
-      title: "Export Audit Logs",
-      description: "Export audit logs in a specified format.",
+      title: "Create VibeDeck Share-Link",
+      description: "Create a new share-link for a VibeDeck.",
       inputSchema: {
-        action: z.string().optional().describe("Filter by action type"),
-        resourceType: z.string().optional().describe("Filter by resource type"),
-        status: z.string().optional().describe("Filter by status"),
-        format: z.string().optional().describe("Export format: json or csv")
+        vibeDeckId: z.string().describe("VibeDeck ID"),
+        permission: z.string().optional().describe("EXECUTE or VIEW"),
+        visibility: z.string().optional().describe("PUBLIC | RESTRICTED | SIGNED_LINK"),
+        name: z.string().optional(),
+        password: z.string().optional(),
+        maxUses: z.number().optional(),
+        expiresInHours: z.number().optional(),
+        allowIframe: z.boolean().optional()
       }
     },
-    async ({ action, resourceType, status, format }) => {
+    async (input) => {
       try {
-        const filter = {};
-        if (action !== void 0) filter.action = action;
-        if (resourceType !== void 0) filter.resourceType = resourceType;
-        if (status !== void 0) filter.status = status;
-        const variables = {
-          filter: Object.keys(filter).length > 0 ? filter : void 0
-        };
-        if (format !== void 0) variables.format = format;
         const data = await ctx.gql.workspace.request(
-          EXPORT_AUDIT_LOGS,
-          variables
+          CREATE_VIBE_DECK_SHARE_LINK,
+          { input }
         );
-        return jsonResult(data.exportVibeAuditLogs);
+        return jsonResult(data.createVibeDeckShareLink);
       } catch (error) {
-        ctx.logger.error("vibecontrols_audit_export failed", { error });
+        ctx.logger.error("vibecontrols_vibedecks_share_links_create failed", { error });
         return errorResult(
-          `Failed to export audit logs: ${error instanceof Error ? error.message : String(error)}`
+          `Failed to create VibeDeck share-link: ${error instanceof Error ? error.message : String(error)}`
         );
       }
     }
   );
   server.registerTool(
-    track(mcpToolName(ctx.productName, "audit_delete")),
+    track(mcpToolName(ctx.productName, "vibe_deck_share_links_update")),
     {
-      title: "Delete Audit Log",
-      description: "Delete an audit log entry.",
+      title: "Update VibeDeck Share-Link",
+      description: "Update an existing VibeDeck share-link.",
       inputSchema: {
-        id: z.string().describe("Audit log ID to delete"),
-        reason: z.string().optional().describe("Reason for deletion")
+        id: z.string().describe("Share-link ID"),
+        permission: z.string().optional(),
+        visibility: z.string().optional(),
+        name: z.string().optional(),
+        password: z.string().optional(),
+        maxUses: z.number().optional(),
+        expiresAt: z.string().optional(),
+        allowIframe: z.boolean().optional()
       }
     },
-    async ({ id, reason }) => {
+    async ({ id, ...rest }) => {
       try {
-        const variables = { id };
-        if (reason !== void 0) variables.reason = reason;
+        const input = {};
+        for (const [k, v] of Object.entries(rest)) {
+          if (v !== void 0) input[k] = v;
+        }
         const data = await ctx.gql.workspace.request(
-          DELETE_AUDIT_LOG,
-          variables
+          UPDATE_VIBE_DECK_SHARE_LINK,
+          { id, input }
         );
-        return jsonResult(data.deleteVibeAuditLog);
+        return jsonResult(data.updateVibeDeckShareLink);
       } catch (error) {
-        ctx.logger.error("vibecontrols_audit_delete failed", { error });
+        ctx.logger.error("vibecontrols_vibedecks_share_links_update failed", { error });
         return errorResult(
-          `Failed to delete audit log: ${error instanceof Error ? error.message : String(error)}`
+          `Failed to update VibeDeck share-link: ${error instanceof Error ? error.message : String(error)}`
         );
       }
     }
   );
-}
-var ConfigScopeEnum = z.enum(["WORKSPACE", "VIBE", "SESSION", "AGENT", "USER", "GLOBAL"]);
-function registerConfigurationTools(server, ctx, track) {
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "vibe_deck_share_links_revoke")),
+    {
+      title: "Revoke VibeDeck Share-Link",
+      description: "Revoke a VibeDeck share-link.",
+      inputSchema: { id: z.string().describe("Share-link ID") }
+    },
+    async ({ id }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          REVOKE_VIBE_DECK_SHARE_LINK,
+          { id }
+        );
+        return jsonResult(data.revokeVibeDeckShareLink);
+      } catch (error) {
+        ctx.logger.error("vibecontrols_vibedecks_share_links_revoke failed", { error });
+        return errorResult(
+          `Failed to revoke VibeDeck share-link: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "vibe_deck_share_links_validate")),
+    {
+      title: "Validate VibeDeck Share-Link",
+      description: "Validate a share-link token (public). Returns access metadata.",
+      inputSchema: { token: z.string().describe("Share-link token") }
+    },
+    async ({ token }) => {
+      try {
+        const data = await ctx.gql.workspace.request(VALIDATE_VIBE_DECK_SHARE_LINK, { token });
+        return jsonResult(data.validateVibeDeckShareLink);
+      } catch (error) {
+        ctx.logger.error("vibecontrols_vibedecks_share_links_validate failed", { error });
+        return errorResult(
+          `Failed to validate VibeDeck share-link: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "vibe_deck_share_links_get_shared")),
+    {
+      title: "Get Shared VibeDeck",
+      description: "Fetch a publicly shared VibeDeck via its token.",
+      inputSchema: {
+        token: z.string().describe("Share-link token"),
+        password: z.string().optional().describe("Password if required")
+      }
+    },
+    async ({ token, password }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          SHARED_VIBE_DECK,
+          {
+            token,
+            password
+          }
+        );
+        return jsonResult(data.sharedVibeDeck);
+      } catch (error) {
+        ctx.logger.error("vibecontrols_vibedecks_shared_get failed", { error });
+        return errorResult(
+          `Failed to fetch shared VibeDeck: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "vibe_deck_share_links_execute_shared_button")),
+    {
+      title: "Execute Shared VibeDeck Button",
+      description: "Execute a button on a publicly shared VibeDeck.",
+      inputSchema: {
+        token: z.string().describe("Share-link token"),
+        buttonId: z.string().describe("Button ID"),
+        password: z.string().optional().describe("Password if required")
+      }
+    },
+    async ({ token, buttonId, password }) => {
+      try {
+        const data = await ctx.gql.workspace.request(EXECUTE_SHARED_VIBE_DECK_BUTTON, { token, buttonId, password });
+        return jsonResult(data.executeSharedVibeDeckButton);
+      } catch (error) {
+        ctx.logger.error("vibecontrols_vibedecks_shared_execute_button failed", { error });
+        return errorResult(
+          `Failed to execute shared VibeDeck button: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+}
+var VisibilityEnum = z.enum(["INTERNAL", "PRIVATE", "PUBLIC"]);
+function registerCatalogTools(server, ctx, track) {
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "catalogs_list")),
+    {
+      title: "List Catalogs",
+      description: "List service catalogs with optional filters. Returns { items, total, hasMore }.",
+      inputSchema: {
+        search: z.string().optional().describe("Full-text search on name/description"),
+        tags: z.array(z.string()).optional().describe("Filter by tags (has-some)"),
+        visibility: VisibilityEnum.optional().describe("Filter by visibility"),
+        limit: z.number().optional().describe("Max results"),
+        offset: z.number().optional().describe("Pagination offset")
+      }
+    },
+    async ({ search, tags, visibility, limit, offset }) => {
+      try {
+        const filter = {};
+        if (search !== void 0) filter.search = search;
+        if (tags !== void 0) filter.tags = tags;
+        if (visibility !== void 0) filter.visibility = visibility;
+        const pagination = {};
+        if (limit !== void 0) pagination.limit = limit;
+        if (offset !== void 0) pagination.offset = offset;
+        const data = await ctx.gql.workspace.request(
+          LIST_CATALOGS,
+          {
+            filter: Object.keys(filter).length ? filter : void 0,
+            pagination: Object.keys(pagination).length ? pagination : void 0
+          }
+        );
+        return jsonResult(data.vibecontrolsCatalogs);
+      } catch (error) {
+        ctx.logger.error("catalogs_list failed", { error });
+        return errorResult(
+          `Failed to list catalogs: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "catalogs_get")),
+    {
+      title: "Get Catalog",
+      description: "Get a catalog by ID. Returns the catalog object or null.",
+      inputSchema: { id: z.string().describe("Catalog ID") }
+    },
+    async ({ id }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          GET_CATALOG,
+          { id }
+        );
+        return jsonResult(data.vibecontrolsCatalog);
+      } catch (error) {
+        ctx.logger.error("catalogs_get failed", { error });
+        return errorResult(
+          `Failed to get catalog: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "catalogs_dependency_graph")),
+    {
+      title: "Catalog Dependency Graph",
+      description: "Get the dependency graph for a catalog. Returns { nodes, edges }.",
+      inputSchema: { catalogId: z.string().describe("Catalog ID") }
+    },
+    async ({ catalogId }) => {
+      try {
+        const data = await ctx.gql.workspace.request(GET_CATALOG_DEPENDENCY_GRAPH, { catalogId });
+        return jsonResult(data.vibecontrolsCatalogDependencyGraph);
+      } catch (error) {
+        ctx.logger.error("catalogs_dependency_graph failed", { error });
+        return errorResult(
+          `Failed to get dependency graph: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "catalogs_sbom")),
+    {
+      title: "Catalog SBOM",
+      description: "Get the SBOM (software bill of materials) for a catalog. Returns { format, generatedAt, totalCount, components }.",
+      inputSchema: { catalogId: z.string().describe("Catalog ID") }
+    },
+    async ({ catalogId }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          GET_CATALOG_SBOM,
+          { catalogId }
+        );
+        return jsonResult(data.vibecontrolsCatalogSBOM);
+      } catch (error) {
+        ctx.logger.error("catalogs_sbom failed", { error });
+        return errorResult(
+          `Failed to get SBOM: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "catalogs_create")),
+    {
+      title: "Create Catalog",
+      description: "Create a new catalog. Returns the created catalog.",
+      inputSchema: {
+        name: z.string().describe("Catalog name"),
+        description: z.string().optional().describe("Catalog description"),
+        visibility: VisibilityEnum.optional().describe("Visibility level"),
+        ownerId: z.string().optional().describe("Owner actor ID"),
+        ownerName: z.string().optional().describe("Owner display name"),
+        tags: z.array(z.string()).optional().describe("Tags")
+      }
+    },
+    async ({ name, description, visibility, ownerId, ownerName, tags }) => {
+      try {
+        const input = { name };
+        if (description !== void 0) input.description = description;
+        if (visibility !== void 0) input.visibility = visibility;
+        if (ownerId !== void 0) input.ownerId = ownerId;
+        if (ownerName !== void 0) input.ownerName = ownerName;
+        if (tags !== void 0) input.tags = tags;
+        const data = await ctx.gql.workspace.request(
+          CREATE_CATALOG,
+          { input }
+        );
+        return jsonResult(data.createVibecontrolsCatalog);
+      } catch (error) {
+        ctx.logger.error("catalogs_create failed", { error });
+        return errorResult(
+          `Failed to create catalog: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "catalogs_update")),
+    {
+      title: "Update Catalog",
+      description: "Update an existing catalog. Returns the updated catalog.",
+      inputSchema: {
+        id: z.string().describe("Catalog ID"),
+        name: z.string().optional().describe("Name"),
+        description: z.string().optional().describe("Description"),
+        visibility: VisibilityEnum.optional().describe("Visibility"),
+        tags: z.array(z.string()).optional().describe("Tags")
+      }
+    },
+    async ({ id, name, description, visibility, tags }) => {
+      try {
+        const input = {};
+        if (name !== void 0) input.name = name;
+        if (description !== void 0) input.description = description;
+        if (visibility !== void 0) input.visibility = visibility;
+        if (tags !== void 0) input.tags = tags;
+        const data = await ctx.gql.workspace.request(
+          UPDATE_CATALOG,
+          { id, input }
+        );
+        return jsonResult(data.updateVibecontrolsCatalog);
+      } catch (error) {
+        ctx.logger.error("catalogs_update failed", { error });
+        return errorResult(
+          `Failed to update catalog: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "catalogs_delete")),
+    {
+      title: "Delete Catalog",
+      description: "Soft-delete a catalog. Returns { deleted: boolean, catalogId: string }.",
+      inputSchema: { id: z.string().describe("Catalog ID") }
+    },
+    async ({ id }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          DELETE_CATALOG,
+          { id }
+        );
+        return jsonResult({ deleted: data.deleteVibecontrolsCatalog, catalogId: id });
+      } catch (error) {
+        ctx.logger.error("catalogs_delete failed", { error });
+        return errorResult(
+          `Failed to delete catalog: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "catalogs_add_component")),
+    {
+      title: "Add Component To Catalog",
+      description: "Add a component to a catalog. Returns the membership { id, catalogId, componentId, ... }.",
+      inputSchema: {
+        catalogId: z.string().describe("Catalog ID"),
+        componentId: z.string().describe("Component ID")
+      }
+    },
+    async ({ catalogId, componentId }) => {
+      try {
+        const data = await ctx.gql.workspace.request(ADD_COMPONENT_TO_CATALOG, { catalogId, componentId });
+        return jsonResult(data.addComponentToVibecontrolsCatalog);
+      } catch (error) {
+        ctx.logger.error("catalogs_add_component failed", { error });
+        return errorResult(
+          `Failed to add component: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "catalogs_remove_component")),
+    {
+      title: "Remove Component From Catalog",
+      description: "Remove a component from a catalog. Returns { removed: boolean }.",
+      inputSchema: {
+        catalogId: z.string().describe("Catalog ID"),
+        componentId: z.string().describe("Component ID")
+      }
+    },
+    async ({ catalogId, componentId }) => {
+      try {
+        const data = await ctx.gql.workspace.request(REMOVE_COMPONENT_FROM_CATALOG, { catalogId, componentId });
+        return jsonResult({ removed: data.removeComponentFromVibecontrolsCatalog });
+      } catch (error) {
+        ctx.logger.error("catalogs_remove_component failed", { error });
+        return errorResult(
+          `Failed to remove component: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "catalogs_add_vibe")),
+    {
+      title: "Add Vibe To Catalog",
+      description: "Add a vibe to a catalog. Returns the membership object.",
+      inputSchema: {
+        catalogId: z.string().describe("Catalog ID"),
+        vibeId: z.string().describe("Vibe ID")
+      }
+    },
+    async ({ catalogId, vibeId }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          ADD_VIBE_TO_CATALOG,
+          { catalogId, vibeId }
+        );
+        return jsonResult(data.addVibeToVibecontrolsCatalog);
+      } catch (error) {
+        ctx.logger.error("catalogs_add_vibe failed", { error });
+        return errorResult(
+          `Failed to add vibe: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "catalogs_remove_vibe")),
+    {
+      title: "Remove Vibe From Catalog",
+      description: "Remove a vibe from a catalog. Returns { removed: boolean }.",
+      inputSchema: {
+        catalogId: z.string().describe("Catalog ID"),
+        vibeId: z.string().describe("Vibe ID")
+      }
+    },
+    async ({ catalogId, vibeId }) => {
+      try {
+        const data = await ctx.gql.workspace.request(REMOVE_VIBE_FROM_CATALOG, { catalogId, vibeId });
+        return jsonResult({ removed: data.removeVibeFromVibecontrolsCatalog });
+      } catch (error) {
+        ctx.logger.error("catalogs_remove_vibe failed", { error });
+        return errorResult(
+          `Failed to remove vibe: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+}
+var ComponentTypeEnum = z.enum([
+  "API",
+  "CUSTOM",
+  "DATABASE",
+  "DEPENDENCY",
+  "DOCUMENTATION",
+  "FRONTEND",
+  "INFRASTRUCTURE",
+  "JOB",
+  "LIBRARY",
+  "PACKAGE",
+  "SERVICE",
+  "TOOL",
+  "WORKFLOW"
+]);
+var LifecycleEnum = z.enum(["ACTIVE", "DEPRECATED", "END_OF_LIFE", "EXPERIMENTAL"]);
+var TemplateCategoryEnum = z.enum([
+  "BACKEND",
+  "CUSTOM",
+  "FRONTEND",
+  "FULLSTACK",
+  "INFRASTRUCTURE",
+  "LIBRARY",
+  "MICROSERVICE",
+  "STARTER"
+]);
+var ScopeEnum = z.enum(["ORG", "USER"]);
+function registerComponentTools(server, ctx, track) {
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "components_list")),
+    {
+      title: "List Components",
+      description: "List software components. Returns { items, total, hasMore }.",
+      inputSchema: {
+        search: z.string().optional().describe("Search by name/description"),
+        type: ComponentTypeEnum.optional().describe("Filter by component type"),
+        lifecycle: LifecycleEnum.optional().describe("Filter by lifecycle stage"),
+        teamId: z.string().optional().describe("Filter by team ID"),
+        tags: z.array(z.string()).optional().describe("Filter by tags (any)"),
+        limit: z.number().optional().describe("Max results"),
+        offset: z.number().optional().describe("Pagination offset")
+      }
+    },
+    async ({ search, type, lifecycle, teamId, tags, limit, offset }) => {
+      try {
+        const filter = {};
+        if (search !== void 0) filter.search = search;
+        if (type !== void 0) filter.type = type;
+        if (lifecycle !== void 0) filter.lifecycle = lifecycle;
+        if (teamId !== void 0) filter.teamId = teamId;
+        if (tags !== void 0) filter.tags = tags;
+        const pagination = {};
+        if (limit !== void 0) pagination.limit = limit;
+        if (offset !== void 0) pagination.offset = offset;
+        const data = await ctx.gql.workspace.request(
+          LIST_COMPONENTS,
+          {
+            filter: Object.keys(filter).length ? filter : void 0,
+            pagination: Object.keys(pagination).length ? pagination : void 0
+          }
+        );
+        return jsonResult(data.vibecontrolsComponents);
+      } catch (error) {
+        ctx.logger.error("components_list failed", { error });
+        return errorResult(
+          `Failed to list components: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "components_get")),
+    {
+      title: "Get Component",
+      description: "Get a component by ID. Returns the component object or null.",
+      inputSchema: { id: z.string().describe("Component ID") }
+    },
+    async ({ id }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          GET_COMPONENT,
+          { id }
+        );
+        return jsonResult(data.vibecontrolsComponent);
+      } catch (error) {
+        ctx.logger.error("components_get failed", { error });
+        return errorResult(
+          `Failed to get component: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "components_create")),
+    {
+      title: "Create Component",
+      description: "Create a new component. Returns the created component.",
+      inputSchema: {
+        name: z.string().describe("Component name"),
+        description: z.string().optional().describe("Description"),
+        type: ComponentTypeEnum.optional().describe("Component type"),
+        lifecycle: LifecycleEnum.optional().describe("Lifecycle stage"),
+        version: z.string().optional().describe("Semantic version"),
+        language: z.string().optional().describe("Primary language"),
+        framework: z.string().optional().describe("Primary framework"),
+        repositoryUrl: z.string().optional().describe("Source repository URL"),
+        documentationUrl: z.string().optional().describe("Documentation URL"),
+        ownerId: z.string().optional().describe("Owner actor ID"),
+        ownerName: z.string().optional().describe("Owner display name"),
+        teamId: z.string().optional().describe("Team ID"),
+        teamName: z.string().optional().describe("Team display name"),
+        tags: z.array(z.string()).optional().describe("Tags")
+      }
+    },
+    async (args) => {
+      try {
+        const input = { name: args.name };
+        for (const k of [
+          "description",
+          "type",
+          "lifecycle",
+          "version",
+          "language",
+          "framework",
+          "repositoryUrl",
+          "documentationUrl",
+          "ownerId",
+          "ownerName",
+          "teamId",
+          "teamName",
+          "tags"
+        ]) {
+          const v = args[k];
+          if (v !== void 0) input[k] = v;
+        }
+        const data = await ctx.gql.workspace.request(
+          CREATE_COMPONENT,
+          { input }
+        );
+        return jsonResult(data.createVibecontrolsComponent);
+      } catch (error) {
+        ctx.logger.error("components_create failed", { error });
+        return errorResult(
+          `Failed to create component: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "components_update")),
+    {
+      title: "Update Component",
+      description: "Update an existing component. Returns the updated component.",
+      inputSchema: {
+        id: z.string().describe("Component ID"),
+        name: z.string().optional().describe("Name"),
+        description: z.string().optional().describe("Description"),
+        lifecycle: LifecycleEnum.optional().describe("Lifecycle"),
+        version: z.string().optional().describe("Version"),
+        repositoryUrl: z.string().optional().describe("Repository URL"),
+        documentationUrl: z.string().optional().describe("Documentation URL"),
+        tags: z.array(z.string()).optional().describe("Tags")
+      }
+    },
+    async ({
+      id,
+      name,
+      description,
+      lifecycle,
+      version,
+      repositoryUrl,
+      documentationUrl,
+      tags
+    }) => {
+      try {
+        const input = {};
+        if (name !== void 0) input.name = name;
+        if (description !== void 0) input.description = description;
+        if (lifecycle !== void 0) input.lifecycle = lifecycle;
+        if (version !== void 0) input.version = version;
+        if (repositoryUrl !== void 0) input.repositoryUrl = repositoryUrl;
+        if (documentationUrl !== void 0) input.documentationUrl = documentationUrl;
+        if (tags !== void 0) input.tags = tags;
+        const data = await ctx.gql.workspace.request(
+          UPDATE_COMPONENT,
+          { id, input }
+        );
+        return jsonResult(data.updateVibecontrolsComponent);
+      } catch (error) {
+        ctx.logger.error("components_update failed", { error });
+        return errorResult(
+          `Failed to update component: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "components_delete")),
+    {
+      title: "Delete Component",
+      description: "Soft-delete a component. Returns { deleted, componentId }.",
+      inputSchema: { id: z.string().describe("Component ID") }
+    },
+    async ({ id }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          DELETE_COMPONENT,
+          { id }
+        );
+        return jsonResult({ deleted: data.deleteVibecontrolsComponent, componentId: id });
+      } catch (error) {
+        ctx.logger.error("components_delete failed", { error });
+        return errorResult(
+          `Failed to delete component: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "components_fork_git_hub_repo")),
+    {
+      title: "Fork GitHub Repo",
+      description: "Fork or create a GitHub repo for component setup. Returns { isForked, repoFullName, repoUrl }.",
+      inputSchema: {
+        repoName: z.string().describe("Name of the new repository"),
+        scope: ScopeEnum.describe("USER or ORG"),
+        orgName: z.string().optional().describe("Org name (required when scope=ORG)"),
+        sourceRepoUrl: z.string().optional().describe("Source repo URL to fork"),
+        description: z.string().optional().describe("Repository description"),
+        connectionId: z.string().optional().describe("OAuth connection ID"),
+        token: z.string().optional().describe("Personal access token (if no connection)")
+      }
+    },
+    async (args) => {
+      try {
+        const input = { repoName: args.repoName, scope: args.scope };
+        for (const k of [
+          "orgName",
+          "sourceRepoUrl",
+          "description",
+          "connectionId",
+          "token"
+        ]) {
+          const v = args[k];
+          if (v !== void 0) input[k] = v;
+        }
+        const data = await ctx.gql.workspace.request(
+          FORK_GITHUB_REPO,
+          { input }
+        );
+        return jsonResult(data.forkVibecontrolsGitHubRepo);
+      } catch (error) {
+        ctx.logger.error("components_fork_github_repo failed", { error });
+        return errorResult(
+          `Failed to fork repo: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "components_publish_as_template")),
+    {
+      title: "Publish Component As Template",
+      description: "Publish a component as a reusable template (snapshots the component). Returns the created template.",
+      inputSchema: {
+        componentId: z.string().describe("Source component ID"),
+        name: z.string().describe("Template name"),
+        description: z.string().optional().describe("Description"),
+        category: TemplateCategoryEnum.optional().describe("Category"),
+        version: z.string().optional().describe("Version"),
+        setupInstructions: z.string().optional().describe("Markdown setup instructions"),
+        sourceRepositoryUrl: z.string().optional().describe("Source repository URL"),
+        tags: z.array(z.string()).optional().describe("Tags")
+      }
+    },
+    async ({
+      componentId,
+      name,
+      description,
+      category,
+      version,
+      setupInstructions,
+      sourceRepositoryUrl,
+      tags
+    }) => {
+      try {
+        const input = { name };
+        if (description !== void 0) input.description = description;
+        if (category !== void 0) input.category = category;
+        if (version !== void 0) input.version = version;
+        if (setupInstructions !== void 0) input.setupInstructions = setupInstructions;
+        if (sourceRepositoryUrl !== void 0) input.sourceRepositoryUrl = sourceRepositoryUrl;
+        if (tags !== void 0) input.tags = tags;
+        const data = await ctx.gql.workspace.request(PUBLISH_COMPONENT_AS_TEMPLATE, { componentId, input });
+        return jsonResult(data.publishVibecontrolsComponentAsTemplate);
+      } catch (error) {
+        ctx.logger.error("components_publish_as_template failed", { error });
+        return errorResult(
+          `Failed to publish template: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+}
+var OwnerTypeEnum = z.enum(["CATALOG", "COMPONENT", "VIBE"]);
+var MetricStatusEnum = z.enum(["FAILING", "PASSING", "UNKNOWN", "WARNING"]);
+var MetricTypeEnum = z.enum([
+  "CICD_HEALTH",
+  "CUSTOM",
+  "DEPENDENCY_FRESHNESS",
+  "DOCUMENTATION_COVERAGE",
+  "INCIDENT_COUNT",
+  "SECURITY_SCORE",
+  "SLO_COMPLIANCE",
+  "TEST_COVERAGE"
+]);
+function registerScorecardTools(server, ctx, track) {
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "scorecards_get")),
+    {
+      title: "Get Scorecard",
+      description: "Get the scorecard for an owner entity (catalog/component/vibe). Returns the scorecard with metrics or null.",
+      inputSchema: {
+        ownerId: z.string().describe("Owner entity ID"),
+        ownerType: OwnerTypeEnum.describe("Owner entity type")
+      }
+    },
+    async ({ ownerId, ownerType }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          GET_SCORECARD,
+          { ownerId, ownerType }
+        );
+        return jsonResult(data.vibecontrolsScorecard);
+      } catch (error) {
+        ctx.logger.error("scorecards_get failed", { error });
+        return errorResult(
+          `Failed to get scorecard: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "scorecards_upsert")),
+    {
+      title: "Upsert Scorecard",
+      description: "Create or update a scorecard for an owner. Returns the scorecard.",
+      inputSchema: {
+        ownerId: z.string().describe("Owner entity ID"),
+        ownerType: OwnerTypeEnum.describe("Owner entity type")
+      }
+    },
+    async ({ ownerId, ownerType }) => {
+      try {
+        const data = await ctx.gql.workspace.request(UPSERT_SCORECARD, { input: { ownerId, ownerType } });
+        return jsonResult(data.upsertVibecontrolsScorecard);
+      } catch (error) {
+        ctx.logger.error("scorecards_upsert failed", { error });
+        return errorResult(
+          `Failed to upsert scorecard: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "scorecards_add_metric")),
+    {
+      title: "Add Scorecard Metric",
+      description: "Add a new metric to a scorecard. Returns the created metric.",
+      inputSchema: {
+        scorecardId: z.string().describe("Scorecard ID"),
+        name: z.string().describe("Metric display name (unique within scorecard)"),
+        description: z.string().optional().describe("Human-readable description"),
+        type: MetricTypeEnum.optional().describe("Metric classification"),
+        status: MetricStatusEnum.optional().describe("Current status"),
+        value: z.number().optional().describe("Current metric value"),
+        threshold: z.number().optional().describe("Target threshold"),
+        unit: z.string().optional().describe("Unit of measurement (%, count, ms, ...)"),
+        iframeUrl: z.string().optional().describe("Optional iframe embed URL"),
+        iframeHeight: z.number().optional().describe("Iframe height in pixels")
+      }
+    },
+    async (args) => {
+      try {
+        const input = { name: args.name };
+        for (const k of [
+          "description",
+          "type",
+          "status",
+          "value",
+          "threshold",
+          "unit",
+          "iframeUrl",
+          "iframeHeight"
+        ]) {
+          const v = args[k];
+          if (v !== void 0) input[k] = v;
+        }
+        const data = await ctx.gql.workspace.request(ADD_SCORECARD_METRIC, { scorecardId: args.scorecardId, input });
+        return jsonResult(data.addVibecontrolsScorecardMetric);
+      } catch (error) {
+        ctx.logger.error("scorecards_add_metric failed", { error });
+        return errorResult(
+          `Failed to add metric: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "scorecards_update_metric")),
+    {
+      title: "Update Scorecard Metric",
+      description: "Update an existing scorecard metric. Returns the updated metric.",
+      inputSchema: {
+        id: z.string().describe("Metric ID"),
+        name: z.string().optional().describe("Name"),
+        description: z.string().optional().describe("Description"),
+        type: MetricTypeEnum.optional().describe("Type"),
+        status: MetricStatusEnum.optional().describe("Status"),
+        value: z.number().optional().describe("Current value"),
+        threshold: z.number().optional().describe("Threshold"),
+        unit: z.string().optional().describe("Unit"),
+        iframeUrl: z.string().optional().describe("Iframe URL"),
+        iframeHeight: z.number().optional().describe("Iframe height")
+      }
+    },
+    async (args) => {
+      try {
+        const input = {};
+        for (const k of [
+          "name",
+          "description",
+          "type",
+          "status",
+          "value",
+          "threshold",
+          "unit",
+          "iframeUrl",
+          "iframeHeight"
+        ]) {
+          const v = args[k];
+          if (v !== void 0) input[k] = v;
+        }
+        const data = await ctx.gql.workspace.request(UPDATE_SCORECARD_METRIC, { id: args.id, input });
+        return jsonResult(data.updateVibecontrolsScorecardMetric);
+      } catch (error) {
+        ctx.logger.error("scorecards_update_metric failed", { error });
+        return errorResult(
+          `Failed to update metric: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "scorecards_remove_metric")),
+    {
+      title: "Remove Scorecard Metric",
+      description: "Soft-delete a scorecard metric. Returns { removed: boolean, metricId }.",
+      inputSchema: { id: z.string().describe("Metric ID") }
+    },
+    async ({ id }) => {
+      try {
+        const data = await ctx.gql.workspace.request(REMOVE_SCORECARD_METRIC, { id });
+        return jsonResult({
+          removed: data.removeVibecontrolsScorecardMetric,
+          metricId: id
+        });
+      } catch (error) {
+        ctx.logger.error("scorecards_remove_metric failed", { error });
+        return errorResult(
+          `Failed to remove metric: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+}
+var TemplateCategoryEnum2 = z.enum([
+  "BACKEND",
+  "CUSTOM",
+  "FRONTEND",
+  "FULLSTACK",
+  "INFRASTRUCTURE",
+  "LIBRARY",
+  "MICROSERVICE",
+  "STARTER"
+]);
+var TemplateStatusEnum = z.enum(["ARCHIVED", "DRAFT", "PUBLISHED"]);
+function registerTemplateTools(server, ctx, track) {
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "templates_list")),
+    {
+      title: "List Templates",
+      description: "List reusable component templates. Returns { items, total, hasMore }.",
+      inputSchema: {
+        search: z.string().optional().describe("Search by name/description"),
+        category: TemplateCategoryEnum2.optional().describe("Filter by category"),
+        status: TemplateStatusEnum.optional().describe("Filter by status"),
+        tags: z.array(z.string()).optional().describe("Filter by tags"),
+        limit: z.number().optional().describe("Max results"),
+        offset: z.number().optional().describe("Pagination offset")
+      }
+    },
+    async ({ search, category, status, tags, limit, offset }) => {
+      try {
+        const filter = {};
+        if (search !== void 0) filter.search = search;
+        if (category !== void 0) filter.category = category;
+        if (status !== void 0) filter.status = status;
+        if (tags !== void 0) filter.tags = tags;
+        const pagination = {};
+        if (limit !== void 0) pagination.limit = limit;
+        if (offset !== void 0) pagination.offset = offset;
+        const data = await ctx.gql.workspace.request(
+          LIST_TEMPLATES,
+          {
+            filter: Object.keys(filter).length ? filter : void 0,
+            pagination: Object.keys(pagination).length ? pagination : void 0
+          }
+        );
+        return jsonResult(data.vibecontrolsTemplates);
+      } catch (error) {
+        ctx.logger.error("templates_list failed", { error });
+        return errorResult(
+          `Failed to list templates: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "templates_get")),
+    {
+      title: "Get Template",
+      description: "Get a template by ID. Returns the template object or null.",
+      inputSchema: { id: z.string().describe("Template ID") }
+    },
+    async ({ id }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          GET_TEMPLATE,
+          { id }
+        );
+        return jsonResult(data.vibecontrolsTemplate);
+      } catch (error) {
+        ctx.logger.error("templates_get failed", { error });
+        return errorResult(
+          `Failed to get template: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "templates_update")),
+    {
+      title: "Update Template",
+      description: "Update an existing template. Returns the updated template.",
+      inputSchema: {
+        id: z.string().describe("Template ID"),
+        name: z.string().optional().describe("Name"),
+        description: z.string().optional().describe("Description"),
+        category: TemplateCategoryEnum2.optional().describe("Category"),
+        status: TemplateStatusEnum.optional().describe("Status"),
+        version: z.string().optional().describe("Version"),
+        setupInstructions: z.string().optional().describe("Markdown setup instructions"),
+        sourceRepositoryUrl: z.string().optional().describe("Source repository URL"),
+        tags: z.array(z.string()).optional().describe("Tags")
+      }
+    },
+    async ({
+      id,
+      name,
+      description,
+      category,
+      status,
+      version,
+      setupInstructions,
+      sourceRepositoryUrl,
+      tags
+    }) => {
+      try {
+        const input = {};
+        if (name !== void 0) input.name = name;
+        if (description !== void 0) input.description = description;
+        if (category !== void 0) input.category = category;
+        if (status !== void 0) input.status = status;
+        if (version !== void 0) input.version = version;
+        if (setupInstructions !== void 0) input.setupInstructions = setupInstructions;
+        if (sourceRepositoryUrl !== void 0) input.sourceRepositoryUrl = sourceRepositoryUrl;
+        if (tags !== void 0) input.tags = tags;
+        const data = await ctx.gql.workspace.request(
+          UPDATE_TEMPLATE,
+          { id, input }
+        );
+        return jsonResult(data.updateVibecontrolsTemplate);
+      } catch (error) {
+        ctx.logger.error("templates_update failed", { error });
+        return errorResult(
+          `Failed to update template: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "templates_delete")),
+    {
+      title: "Delete Template",
+      description: "Soft-delete a template. Returns { deleted, templateId }.",
+      inputSchema: { id: z.string().describe("Template ID") }
+    },
+    async ({ id }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          DELETE_TEMPLATE,
+          { id }
+        );
+        return jsonResult({ deleted: data.deleteVibecontrolsTemplate, templateId: id });
+      } catch (error) {
+        ctx.logger.error("templates_delete failed", { error });
+        return errorResult(
+          `Failed to delete template: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "templates_instantiate")),
+    {
+      title: "Instantiate Template",
+      description: "Create a new component from a template. Returns the new component.",
+      inputSchema: {
+        templateId: z.string().describe("Template ID"),
+        name: z.string().describe("Name for the new component"),
+        description: z.string().optional().describe("Description for the new component"),
+        workspaceId: z.string().optional().describe("Target workspace (defaults to current)"),
+        variableValues: z.record(z.unknown()).optional().describe("Variable value overrides as a JSON object")
+      }
+    },
+    async ({ templateId, name, description, workspaceId, variableValues }) => {
+      try {
+        const input = { name };
+        if (description !== void 0) input.description = description;
+        if (workspaceId !== void 0) input.workspaceId = workspaceId;
+        if (variableValues !== void 0) input.variableValues = variableValues;
+        const data = await ctx.gql.workspace.request(INSTANTIATE_TEMPLATE, { templateId, input });
+        return jsonResult(data.instantiateVibecontrolsTemplate);
+      } catch (error) {
+        ctx.logger.error("templates_instantiate failed", { error });
+        return errorResult(
+          `Failed to instantiate template: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+}
+function registerAiEventTools(server, ctx, track) {
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "ai_events_list")),
+    {
+      title: "List AI Tool Events",
+      description: "List AI tool events with optional filters and pagination.",
+      inputSchema: {
+        source: z.string().optional().describe("Filter by event source"),
+        eventType: z.string().optional().describe("Filter by event type"),
+        agentId: z.string().optional().describe("Filter by agent ID"),
+        limit: z.number().optional().describe("Max results"),
+        offset: z.number().optional().describe("Offset for pagination")
+      }
+    },
+    async ({ source, eventType, agentId, limit, offset }) => {
+      try {
+        const filter = {};
+        if (source !== void 0) filter.source = source;
+        if (eventType !== void 0) filter.eventType = eventType;
+        if (agentId !== void 0) filter.agentId = agentId;
+        const pagination = {};
+        if (limit !== void 0) pagination.limit = limit;
+        if (offset !== void 0) pagination.offset = offset;
+        const data = await ctx.gql.workspace.request(
+          LIST_AI_TOOL_EVENTS,
+          {
+            filter: Object.keys(filter).length > 0 ? filter : void 0,
+            pagination: Object.keys(pagination).length > 0 ? pagination : void 0
+          }
+        );
+        return jsonResult(data.aiToolEvents);
+      } catch (error) {
+        ctx.logger.error("vibecontrols_ai_events_list failed", { error });
+        return errorResult(
+          `Failed to list AI events: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "ai_events_create")),
+    {
+      title: "Create AI Tool Event",
+      description: "Record a new AI tool event.",
+      inputSchema: {
+        source: z.string().describe("Event source (e.g., mcp, cli, sdk)"),
+        eventType: z.string().describe("Event type (e.g., tool_call, completion)"),
+        payload: z.string().describe("Event payload as JSON string"),
+        agentId: z.string().optional().describe("Associated agent ID")
+      }
+    },
+    async ({ source, eventType, payload, agentId }) => {
+      try {
+        const input = { source, eventType };
+        input.payload = JSON.parse(payload);
+        if (agentId !== void 0) input.agentId = agentId;
+        const data = await ctx.gql.workspace.request(
+          CREATE_AI_TOOL_EVENT,
+          {
+            input
+          }
+        );
+        return jsonResult(data.createAiToolEvent);
+      } catch (error) {
+        ctx.logger.error("vibecontrols_ai_events_create failed", { error });
+        return errorResult(
+          `Failed to create AI event: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "ai_events_recent")),
+    {
+      title: "Recent AI Tool Events",
+      description: "Get recent AI tool events for a specific agent.",
+      inputSchema: {
+        agentId: z.string().describe("Agent ID"),
+        limit: z.number().optional().describe("Maximum events to return")
+      }
+    },
+    async ({ agentId, limit }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          RECENT_AI_TOOL_EVENTS,
+          { agentId, limit }
+        );
+        return jsonResult(data.recentAiToolEvents);
+      } catch (error) {
+        ctx.logger.error("vibecontrols_ai_events_recent failed", { error });
+        return errorResult(
+          `Failed to get recent AI events: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+}
+function registerAnalyticsTools(server, ctx, track) {
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "analytics_overview")),
+    {
+      title: "VibeControls Analytics Overview",
+      description: "Get consolidated analytics overview with KPIs, time series, and breakdowns for all VibeControls entities (agents, sessions, vibes, actions, webhooks, AI events, vibe decks, audit, docs, notes, config).",
+      inputSchema: {
+        startDate: z.string().optional().describe("Start date (ISO format). Defaults to 7 days ago."),
+        endDate: z.string().optional().describe("End date (ISO format). Defaults to now."),
+        granularity: z.enum(["HOUR", "DAY", "WEEK", "MONTH"]).optional().default("DAY").describe("Time series granularity"),
+        entityTypes: z.array(
+          z.enum([
+            "AGENT",
+            "TARGET",
+            "SESSION",
+            "VIBE",
+            "ACTION",
+            "WEBHOOK",
+            "AI_EVENT",
+            "VIBE_DECK",
+            "AUDIT",
+            "DOCS",
+            "NOTE",
+            "CONFIGURATION"
+          ])
+        ).optional().describe("Filter to specific entity types (null = all)"),
+        agentId: z.string().optional().describe("Filter analytics by agent ID"),
+        vibeId: z.string().optional().describe("Filter analytics by vibe ID")
+      }
+    },
+    async ({ startDate, endDate, granularity, entityTypes, agentId, vibeId }) => {
+      try {
+        const input = {
+          startDate: startDate || new Date(Date.now() - 7 * 24 * 60 * 60 * 1e3).toISOString(),
+          endDate: endDate || (/* @__PURE__ */ new Date()).toISOString(),
+          granularity: granularity || "DAY"
+        };
+        if (entityTypes && entityTypes.length > 0) input.entityTypes = entityTypes;
+        if (agentId) input.agentId = agentId;
+        if (vibeId) input.vibeId = vibeId;
+        const data = await ctx.gql.workspace.request(
+          VIBECONTROLS_ANALYTICS,
+          { input }
+        );
+        return jsonResult(data.vibecontrolsAnalytics);
+      } catch (error) {
+        ctx.logger.error("vibecontrols_analytics_overview failed", { error });
+        return errorResult(
+          `Failed to get analytics: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "analytics_summary")),
+    {
+      title: "VibeControls Analytics Summary",
+      description: "Get a quick KPI summary of all VibeControls entity counts (agents, sessions, vibes, actions, etc.). Lighter-weight than the full overview.",
+      inputSchema: {
+        startDate: z.string().optional().describe("Start date (ISO format). Defaults to 7 days ago."),
+        endDate: z.string().optional().describe("End date (ISO format). Defaults to now.")
+      }
+    },
+    async ({ startDate, endDate }) => {
+      try {
+        const input = {
+          startDate: startDate || new Date(Date.now() - 7 * 24 * 60 * 60 * 1e3).toISOString(),
+          endDate: endDate || (/* @__PURE__ */ new Date()).toISOString(),
+          granularity: "DAY"
+        };
+        const data = await ctx.gql.workspace.request(VIBECONTROLS_ANALYTICS, { input });
+        const a = data.vibecontrolsAnalytics;
+        const summary = {
+          agents: { total: a.agents?.total, active: a.agents?.active },
+          targets: { total: a.targets?.total },
+          sessions: { total: a.sessions?.total, active: a.sessions?.active },
+          vibes: { total: a.vibes?.total },
+          actions: {
+            total: a.actions?.total,
+            executions: a.actions?.totalExecutions,
+            successRate: a.actions?.successRate
+          },
+          webhooks: { total: a.webhooks?.total, active: a.webhooks?.active },
+          aiEvents: { total: a.aiEvents?.total },
+          vibeDecks: {
+            totalDecks: a.vibeDecks?.totalDecks,
+            totalButtons: a.vibeDecks?.totalButtons
+          },
+          audit: { total: a.audit?.total },
+          docs: { sites: a.docs?.totalSites, pages: a.docs?.totalPages },
+          notes: { total: a.notes?.total, pinned: a.notes?.pinned },
+          configurations: { total: a.configurations?.total },
+          executionTimeMs: a.executionTimeMs
+        };
+        return jsonResult(summary);
+      } catch (error) {
+        ctx.logger.error("vibecontrols_analytics_summary failed", { error });
+        return errorResult(
+          `Failed to get analytics summary: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+}
+function registerAuditTools(server, ctx, track) {
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "audit_list")),
+    {
+      title: "List Audit Logs",
+      description: "List audit logs with optional filters and pagination.",
+      inputSchema: {
+        action: z.string().optional().describe("Filter by action type"),
+        resourceType: z.string().optional().describe("Filter by resource type"),
+        resourceId: z.string().optional().describe("Filter by resource ID"),
+        actorId: z.string().optional().describe("Filter by actor ID"),
+        status: z.string().optional().describe("Filter by status"),
+        limit: z.number().optional().describe("Max results"),
+        offset: z.number().optional().describe("Offset for pagination")
+      }
+    },
+    async ({ action, resourceType, resourceId, actorId, status, limit, offset }) => {
+      try {
+        const filter = {};
+        if (action !== void 0) filter.action = action;
+        if (resourceType !== void 0) filter.resourceType = resourceType;
+        if (resourceId !== void 0) filter.resourceId = resourceId;
+        if (actorId !== void 0) filter.actorId = actorId;
+        if (status !== void 0) filter.status = status;
+        const pagination = {};
+        if (limit !== void 0) pagination.limit = limit;
+        if (offset !== void 0) pagination.offset = offset;
+        const data = await ctx.gql.workspace.request(LIST_AUDIT_LOGS, {
+          filter: Object.keys(filter).length > 0 ? filter : void 0,
+          pagination: Object.keys(pagination).length > 0 ? pagination : void 0
+        });
+        return jsonResult(data.vibeAuditLogs);
+      } catch (error) {
+        ctx.logger.error("vibecontrols_audit_list failed", { error });
+        return errorResult(
+          `Failed to list audit logs: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "audit_get")),
+    {
+      title: "Get Audit Log",
+      description: "Get an audit log entry by its ID.",
+      inputSchema: { id: z.string().describe("Audit log ID") }
+    },
+    async ({ id }) => {
+      try {
+        const data = await ctx.gql.workspace.request(GET_AUDIT_LOG, {
+          id
+        });
+        return jsonResult(data.vibeAuditLog);
+      } catch (error) {
+        ctx.logger.error("vibecontrols_audit_get failed", { error });
+        return errorResult(
+          `Failed to get audit log: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "audit_stats")),
+    {
+      title: "Audit Log Stats",
+      description: "Get aggregated statistics for audit logs.",
+      inputSchema: {
+        action: z.string().optional().describe("Filter stats by action type"),
+        resourceType: z.string().optional().describe("Filter stats by resource type"),
+        status: z.string().optional().describe("Filter stats by status")
+      }
+    },
+    async ({ action, resourceType, status }) => {
+      try {
+        const filter = {};
+        if (action !== void 0) filter.action = action;
+        if (resourceType !== void 0) filter.resourceType = resourceType;
+        if (status !== void 0) filter.status = status;
+        const data = await ctx.gql.workspace.request(
+          AUDIT_LOG_STATS,
+          {
+            filter: Object.keys(filter).length > 0 ? filter : void 0
+          }
+        );
+        return jsonResult(data.vibeAuditLogStats);
+      } catch (error) {
+        ctx.logger.error("vibecontrols_audit_stats failed", { error });
+        return errorResult(
+          `Failed to get audit log stats: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "audit_export")),
+    {
+      title: "Export Audit Logs",
+      description: "Export audit logs in a specified format.",
+      inputSchema: {
+        action: z.string().optional().describe("Filter by action type"),
+        resourceType: z.string().optional().describe("Filter by resource type"),
+        status: z.string().optional().describe("Filter by status"),
+        format: z.string().optional().describe("Export format: json or csv")
+      }
+    },
+    async ({ action, resourceType, status, format }) => {
+      try {
+        const filter = {};
+        if (action !== void 0) filter.action = action;
+        if (resourceType !== void 0) filter.resourceType = resourceType;
+        if (status !== void 0) filter.status = status;
+        const variables = {
+          filter: Object.keys(filter).length > 0 ? filter : void 0
+        };
+        if (format !== void 0) variables.format = format;
+        const data = await ctx.gql.workspace.request(
+          EXPORT_AUDIT_LOGS,
+          variables
+        );
+        return jsonResult(data.exportVibeAuditLogs);
+      } catch (error) {
+        ctx.logger.error("vibecontrols_audit_export failed", { error });
+        return errorResult(
+          `Failed to export audit logs: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "audit_delete")),
+    {
+      title: "Delete Audit Log",
+      description: "Delete an audit log entry.",
+      inputSchema: {
+        id: z.string().describe("Audit log ID to delete"),
+        reason: z.string().optional().describe("Reason for deletion")
+      }
+    },
+    async ({ id, reason }) => {
+      try {
+        const variables = { id };
+        if (reason !== void 0) variables.reason = reason;
+        const data = await ctx.gql.workspace.request(
+          DELETE_AUDIT_LOG,
+          variables
+        );
+        return jsonResult(data.deleteVibeAuditLog);
+      } catch (error) {
+        ctx.logger.error("vibecontrols_audit_delete failed", { error });
+        return errorResult(
+          `Failed to delete audit log: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+}
+var ConfigScopeEnum = z.enum(["WORKSPACE", "VIBE", "SESSION", "AGENT", "USER", "GLOBAL"]);
+function registerConfigurationTools(server, ctx, track) {
   server.registerTool(
     track(mcpToolName(ctx.productName, "config_list")),
     {
-      title: "List Configurations",
-      description: "List configuration key-value pairs with required filter.",
+      title: "List Configurations",
+      description: "List configuration key-value pairs with required filter.",
+      inputSchema: {
+        key: z.string().optional().describe("Filter by key pattern"),
+        scope: ConfigScopeEnum.describe("Configuration scope"),
+        scopeId: z.string().optional().describe("Filter by scope entity ID"),
+        isSecret: z.boolean().optional().describe("Filter by secret status"),
+        limit: z.number().optional().describe("Max results"),
+        offset: z.number().optional().describe("Offset for pagination")
+      }
+    },
+    async ({ key, scope, scopeId, isSecret, limit, offset }) => {
+      try {
+        const filter = { scope };
+        if (key !== void 0) filter.key = key;
+        if (scopeId !== void 0) filter.scopeId = scopeId;
+        if (isSecret !== void 0) filter.isSecret = isSecret;
+        const pagination = {};
+        if (limit !== void 0) pagination.limit = limit;
+        if (offset !== void 0) pagination.offset = offset;
+        const data = await ctx.gql.workspace.request(
+          LIST_CONFIGURATIONS,
+          {
+            filter,
+            pagination: Object.keys(pagination).length > 0 ? pagination : void 0
+          }
+        );
+        return jsonResult(data.configurations);
+      } catch (error) {
+        ctx.logger.error("vibecontrols_config_list failed", { error });
+        return errorResult(
+          `Failed to list configurations: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "config_get")),
+    {
+      title: "Get Configuration",
+      description: "Get a configuration value by key and scope.",
+      inputSchema: {
+        key: z.string().describe("Configuration key"),
+        scope: ConfigScopeEnum.describe("Configuration scope"),
+        scopeId: z.string().optional().describe("Scope entity ID")
+      }
+    },
+    async ({ key, scope, scopeId }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          GET_CONFIGURATION,
+          {
+            key,
+            scope,
+            scopeId
+          }
+        );
+        return jsonResult(data.configuration);
+      } catch (error) {
+        ctx.logger.error("vibecontrols_config_get failed", { error });
+        return errorResult(
+          `Failed to get configuration: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "config_set")),
+    {
+      title: "Set Configuration",
+      description: "Set (create or update) a configuration value.",
+      inputSchema: {
+        key: z.string().describe("Configuration key"),
+        scope: ConfigScopeEnum.describe("Configuration scope"),
+        scopeId: z.string().optional().describe("Scope entity ID"),
+        value: z.string().describe("Configuration value as a JSON string"),
+        isSecret: z.boolean().optional().describe("Mark as secret (value will be masked in reads)")
+      }
+    },
+    async ({ key, scope, scopeId, value, isSecret }) => {
+      try {
+        const parsedValue = JSON.parse(value);
+        const variables = { key, scope, value: parsedValue };
+        if (scopeId !== void 0) variables.scopeId = scopeId;
+        if (isSecret !== void 0) variables.isSecret = isSecret;
+        const data = await ctx.gql.workspace.request(
+          SET_CONFIGURATION,
+          variables
+        );
+        return jsonResult(data.setConfiguration);
+      } catch (error) {
+        ctx.logger.error("vibecontrols_config_set failed", { error });
+        return errorResult(
+          `Failed to set configuration: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "config_delete")),
+    {
+      title: "Delete Configuration",
+      description: "Delete a configuration by key and scope.",
+      inputSchema: {
+        key: z.string().describe("Configuration key to delete"),
+        scope: ConfigScopeEnum.describe("Configuration scope"),
+        scopeId: z.string().optional().describe("Scope entity ID")
+      }
+    },
+    async ({ key, scope, scopeId }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          DELETE_CONFIGURATION,
+          { key, scope, scopeId }
+        );
+        return jsonResult({ deleted: data.deleteConfiguration, key, scope });
+      } catch (error) {
+        ctx.logger.error("vibecontrols_config_delete failed", { error });
+        return errorResult(
+          `Failed to delete configuration: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "config_by_scope")),
+    {
+      title: "Configurations by Scope",
+      description: "Get all configuration values for a given scope.",
+      inputSchema: {
+        scope: ConfigScopeEnum.describe("Configuration scope"),
+        scopeId: z.string().optional().describe("Scope entity ID")
+      }
+    },
+    async ({ scope, scopeId }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          CONFIGURATIONS_BY_SCOPE,
+          { scope, scopeId }
+        );
+        return jsonResult(data.configurationsByScope);
+      } catch (error) {
+        ctx.logger.error("vibecontrols_config_by_scope failed", { error });
+        return errorResult(
+          `Failed to get configurations by scope: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+}
+var StageEnum = z.enum([
+  "ARCHIVE_OFFBOARD",
+  "BUILD",
+  "DEPLOY_ALPHA",
+  "DEPLOY_PREVIEW",
+  "DEVELOPER_LOCAL",
+  "INCIDENT_RESPONSE",
+  "MAIN_MERGE",
+  "PACKAGE_PUBLISH",
+  "PROMOTE_PROD",
+  "PULL_REQUEST_DEEP",
+  "PULL_REQUEST_FAST",
+  "REPO_ONBOARD",
+  "RUNTIME_CONTINUOUS",
+  "SCHEDULED_RESCAN"
+]);
+var SeverityEnum = z.enum(["CRITICAL", "HIGH", "MEDIUM", "LOW", "INFO"]);
+var ScanStatusEnum = z.enum(["CANCELLED", "ERRORED", "FAILED", "QUEUED", "RUNNING", "SUCCEEDED"]);
+var ScanConclusionEnum = z.enum(["FAIL", "PASS", "SKIPPED", "WARN"]);
+var FindingCategoryEnum = z.enum([
+  "CONFIG",
+  "LICENSE",
+  "POLICY",
+  "SAST",
+  "SECRET",
+  "SUPPLYCHAIN",
+  "VULN"
+]);
+var FindingStatusEnum = z.enum(["ACCEPTED", "FALSE_POSITIVE", "FIXED", "OPEN", "SUPPRESSED"]);
+var EvidenceTypeEnum = z.enum([
+  "COSIGN_BUNDLE",
+  "GRYPE_JSON",
+  "OPA_DECISION",
+  "PROVENANCE",
+  "SARIF",
+  "SBOM_CYCLONEDX",
+  "SBOM_SPDX"
+]);
+var PolicyLevelEnum = z.enum(["ADVISORY", "BLOCK", "WARN"]);
+function strip(obj) {
+  const out = {};
+  for (const [k, v] of Object.entries(obj)) {
+    if (v !== void 0) out[k] = v;
+  }
+  return out;
+}
+function registerConfigSecurityTools(server, ctx, track) {
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "configuration_security_providers")),
+    {
+      title: "List Security Providers",
+      description: "List configured security scanner providers in the current workspace.",
+      inputSchema: {}
+    },
+    async () => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          SECURITY_PROVIDERS_Q
+        );
+        return jsonResult(data.securityProviders);
+      } catch (error) {
+        ctx.logger.error("config_security_providers_list failed", { error });
+        return errorResult(
+          `Failed to list security providers: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "configuration_security_set_provider")),
+    {
+      title: "Set Security Provider",
+      description: "Configure (or update) a security provider for a vibe and stage.",
+      inputSchema: {
+        vibeId: z.string().describe("Vibe ID this provider applies to"),
+        stage: StageEnum.describe("Security stage this provider runs at"),
+        providerKey: z.string().describe("Provider plugin key (e.g. trivy, gitleaks, semgrep)"),
+        config: z.string().optional().describe("Optional provider-specific config as a JSON string")
+      }
+    },
+    async ({ vibeId, stage, providerKey, config }) => {
+      try {
+        const input = { vibeId, stage, providerKey };
+        if (config !== void 0) input.config = JSON.parse(config);
+        const data = await ctx.gql.workspace.request(
+          SET_SECURITY_PROVIDER_M,
+          { input }
+        );
+        return jsonResult(data.setSecurityProvider);
+      } catch (error) {
+        ctx.logger.error("config_security_provider_set failed", { error });
+        return errorResult(
+          `Failed to set security provider: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  const scansListSchema = {
+    vibeId: z.string().optional().describe("Filter by vibe ID"),
+    status: ScanStatusEnum.optional(),
+    stage: StageEnum.optional(),
+    conclusion: ScanConclusionEnum.optional(),
+    limit: z.number().optional(),
+    offset: z.number().optional()
+  };
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "configuration_security_my_security_scans")),
+    {
+      title: "My Security Scans",
+      description: "List security scan runs created by the current user.",
+      inputSchema: scansListSchema
+    },
+    async ({ vibeId, status, stage, conclusion, limit, offset }) => {
+      try {
+        const filter = strip({ vibeId, status, stage, conclusion });
+        const pagination = strip({ limit, offset });
+        const data = await ctx.gql.workspace.request(
+          MY_SECURITY_SCANS_Q,
+          {
+            filter: Object.keys(filter).length > 0 ? filter : void 0,
+            pagination: Object.keys(pagination).length > 0 ? pagination : void 0
+          }
+        );
+        return jsonResult(data.mySecurityScans);
+      } catch (error) {
+        ctx.logger.error("configuration_security_my_security_scans failed", { error });
+        return errorResult(
+          `Failed to list my scans: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "configuration_security_all_security_scans")),
+    {
+      title: "All Security Scans",
+      description: "List all security scan runs in the workspace (requires elevated permissions).",
+      inputSchema: scansListSchema
+    },
+    async ({ vibeId, status, stage, conclusion, limit, offset }) => {
+      try {
+        const filter = strip({ vibeId, status, stage, conclusion });
+        const pagination = strip({ limit, offset });
+        const data = await ctx.gql.workspace.request(
+          ALL_SECURITY_SCANS_Q,
+          {
+            filter: Object.keys(filter).length > 0 ? filter : void 0,
+            pagination: Object.keys(pagination).length > 0 ? pagination : void 0
+          }
+        );
+        return jsonResult(data.allSecurityScans);
+      } catch (error) {
+        ctx.logger.error("configuration_security_all_security_scans failed", { error });
+        return errorResult(
+          `Failed to list all scans: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "configuration_security_scan")),
+    {
+      title: "Get Security Scan",
+      description: "Get a single security scan run including findings and evidence.",
+      inputSchema: { id: z.string().describe("Scan run ID") }
+    },
+    async ({ id }) => {
+      try {
+        const data = await ctx.gql.workspace.request(SECURITY_SCAN_Q, {
+          id
+        });
+        return jsonResult(data.securityScan);
+      } catch (error) {
+        ctx.logger.error("config_security_scan_get failed", { error });
+        return errorResult(
+          `Failed to get security scan: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "configuration_security_run_scan")),
+    {
+      title: "Run Security Scan",
+      description: "Trigger a security scan for a vibe at a specific stage.",
+      inputSchema: { vibeId: z.string(), stage: StageEnum }
+    },
+    async ({ vibeId, stage }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          RUN_SECURITY_SCAN_M,
+          { vibeId, stage }
+        );
+        return jsonResult(data.runSecurityScan);
+      } catch (error) {
+        ctx.logger.error("config_security_scan_run failed", { error });
+        return errorResult(
+          `Failed to run security scan: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "configuration_security_cancel_scan")),
+    {
+      title: "Cancel Security Scan",
+      description: "Cancel an in-flight security scan run.",
+      inputSchema: { id: z.string().describe("Scan run ID") }
+    },
+    async ({ id }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          CANCEL_SECURITY_SCAN_M,
+          { id }
+        );
+        return jsonResult(data.cancelSecurityScan);
+      } catch (error) {
+        ctx.logger.error("config_security_scan_cancel failed", { error });
+        return errorResult(
+          `Failed to cancel security scan: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "configuration_security_findings")),
+    {
+      title: "List Security Findings",
+      description: "List security findings with optional filters (vibe, severity, category, status).",
+      inputSchema: {
+        vibeId: z.string().optional(),
+        status: FindingStatusEnum.optional(),
+        severity: SeverityEnum.optional(),
+        category: FindingCategoryEnum.optional(),
+        search: z.string().optional(),
+        limit: z.number().optional(),
+        offset: z.number().optional()
+      }
+    },
+    async ({ vibeId, status, severity, category, search, limit, offset }) => {
+      try {
+        const filter = strip({ vibeId, status, severity, category, search });
+        const pagination = strip({ limit, offset });
+        const data = await ctx.gql.workspace.request(
+          SECURITY_FINDINGS_Q,
+          {
+            filter: Object.keys(filter).length > 0 ? filter : void 0,
+            pagination: Object.keys(pagination).length > 0 ? pagination : void 0
+          }
+        );
+        return jsonResult(data.securityFindings);
+      } catch (error) {
+        ctx.logger.error("config_security_findings_list failed", { error });
+        return errorResult(
+          `Failed to list security findings: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "configuration_security_update_finding_status")),
+    {
+      title: "Update Security Finding Status",
+      description: "Update the workflow status of a security finding (e.g. OPEN \u2192 SUPPRESSED).",
+      inputSchema: { id: z.string(), status: FindingStatusEnum }
+    },
+    async ({ id, status }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          UPDATE_SECURITY_FINDING_STATUS_M,
+          { id, status }
+        );
+        return jsonResult(data.updateSecurityFindingStatus);
+      } catch (error) {
+        ctx.logger.error("config_security_finding_update_status failed", { error });
+        return errorResult(
+          `Failed to update finding status: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "configuration_security_policy_decision")),
+    {
+      title: "Security Policy Decision",
+      description: "Fetch the OPA policy decision for a security scan run.",
+      inputSchema: { scanRunId: z.string() }
+    },
+    async ({ scanRunId }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          SECURITY_POLICY_DECISION_Q,
+          { scanRunId }
+        );
+        return jsonResult(data.securityPolicyDecision);
+      } catch (error) {
+        ctx.logger.error("config_security_policy_decision failed", { error });
+        return errorResult(
+          `Failed to get policy decision: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "configuration_security_status")),
+    {
+      title: "Security Status",
+      description: "Aggregated security posture for a single vibe.",
+      inputSchema: { vibeId: z.string() }
+    },
+    async ({ vibeId }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          SECURITY_STATUS_Q,
+          { vibeId }
+        );
+        return jsonResult(data.securityStatus);
+      } catch (error) {
+        ctx.logger.error("config_security_status failed", { error });
+        return errorResult(
+          `Failed to get security status: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "configuration_security_repository_config")),
+    {
+      title: "Get Repository Security Config",
+      description: "Get the repository-level security policy config for a vibe.",
+      inputSchema: { vibeId: z.string() }
+    },
+    async ({ vibeId }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          REPOSITORY_SECURITY_CONFIG_Q,
+          { vibeId }
+        );
+        return jsonResult(data.repositorySecurityConfig);
+      } catch (error) {
+        ctx.logger.error("config_security_repo_config_get failed", { error });
+        return errorResult(
+          `Failed to get repo security config: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "configuration_security_update_repository_config")),
+    {
+      title: "Update Repository Security Config",
+      description: "Update the repository-level security policy config for a vibe.",
+      inputSchema: {
+        vibeId: z.string(),
+        policyLevel: PolicyLevelEnum.optional(),
+        enabledStages: z.array(StageEnum).optional(),
+        pluginAssignments: z.string().optional().describe("JSON string"),
+        configYamlEquivalent: z.string().optional().describe("JSON string")
+      }
+    },
+    async ({ vibeId, policyLevel, enabledStages, pluginAssignments, configYamlEquivalent }) => {
+      try {
+        const input = {};
+        if (policyLevel !== void 0) input.policyLevel = policyLevel;
+        if (enabledStages !== void 0) input.enabledStages = enabledStages;
+        if (pluginAssignments !== void 0)
+          input.pluginAssignments = JSON.parse(pluginAssignments);
+        if (configYamlEquivalent !== void 0)
+          input.configYamlEquivalent = JSON.parse(configYamlEquivalent);
+        const data = await ctx.gql.workspace.request(UPDATE_REPOSITORY_SECURITY_CONFIG_M, { vibeId, input });
+        return jsonResult(data.updateRepositorySecurityConfig);
+      } catch (error) {
+        ctx.logger.error("config_security_repo_config_update failed", { error });
+        return errorResult(
+          `Failed to update repo security config: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "configuration_security_create_exception")),
+    {
+      title: "Create Security Exception",
+      description: "Approve a time-bounded exception (waiver) for a security finding.",
+      inputSchema: {
+        vibeId: z.string(),
+        findingFingerprint: z.string(),
+        reason: z.string(),
+        expiresAt: z.string().describe("ISO 8601 timestamp"),
+        compensatingControls: z.string().optional()
+      }
+    },
+    async ({ vibeId, findingFingerprint, reason, expiresAt, compensatingControls }) => {
+      try {
+        const input = strip({
+          vibeId,
+          findingFingerprint,
+          reason,
+          expiresAt,
+          compensatingControls
+        });
+        const data = await ctx.gql.workspace.request(
+          CREATE_SECURITY_EXCEPTION_M,
+          { input }
+        );
+        return jsonResult(data.createSecurityException);
+      } catch (error) {
+        ctx.logger.error("config_security_exception_create failed", { error });
+        return errorResult(
+          `Failed to create exception: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "configuration_security_revoke_exception")),
+    {
+      title: "Revoke Security Exception",
+      description: "Revoke a previously-granted security exception.",
+      inputSchema: { id: z.string() }
+    },
+    async ({ id }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          REVOKE_SECURITY_EXCEPTION_M,
+          { id }
+        );
+        return jsonResult({ revoked: data.revokeSecurityException, id });
+      } catch (error) {
+        ctx.logger.error("config_security_exception_revoke failed", { error });
+        return errorResult(
+          `Failed to revoke exception: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "configuration_security_presign_evidence")),
+    {
+      title: "Presign Security Evidence Upload",
+      description: "Get a presigned URL for uploading a security evidence artifact (SBOM/SARIF/etc).",
+      inputSchema: {
+        scanRunId: z.string(),
+        sha256: z.string().describe("Hex sha256 digest of the artifact"),
+        sizeBytes: z.number().describe("Size of the artifact in bytes"),
+        type: EvidenceTypeEnum
+      }
+    },
+    async ({ scanRunId, sha256, sizeBytes, type }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          PRESIGN_SECURITY_EVIDENCE_M,
+          { scanRunId, sha256, sizeBytes, type }
+        );
+        return jsonResult(data.presignSecurityEvidence);
+      } catch (error) {
+        ctx.logger.error("config_security_evidence_presign failed", { error });
+        return errorResult(
+          `Failed to presign evidence: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "configuration_security_push_scan_run")),
+    {
+      title: "Push Security Scan Run",
+      description: "Push a complete security scan run from an agent (provider report + findings + evidence refs).",
+      inputSchema: { input: z.string().describe("PushSecurityScanRunInput as a JSON string") }
+    },
+    async ({ input }) => {
+      try {
+        const parsed = JSON.parse(input);
+        const data = await ctx.gql.workspace.request(
+          PUSH_SECURITY_SCAN_RUN_M,
+          { input: parsed }
+        );
+        return jsonResult(data.pushSecurityScanRun);
+      } catch (error) {
+        ctx.logger.error("config_security_scan_run_push failed", { error });
+        return errorResult(
+          `Failed to push scan run: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+}
+function registerConfigCITools(server, ctx, track) {
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "configuration_ci_get_status")),
+    {
+      title: "Get CI Status",
+      description: "Get the cached CI/CD pipeline status for a GitOps provider on an agent (recent runs + workflows + aggregate metrics).",
+      inputSchema: {
+        providerId: z.string().describe("GitOps provider ID"),
+        agentId: z.string().describe("Agent ID executing the request"),
+        limit: z.number().optional().describe("Limit recent runs")
+      }
+    },
+    async ({ providerId, agentId, limit }) => {
+      try {
+        const data = await ctx.gql.workspace.request(GET_CI_STATUS_Q, {
+          providerId,
+          agentId,
+          limit
+        });
+        return jsonResult(data.getCIStatus);
+      } catch (error) {
+        ctx.logger.error("config_ci_status_get failed", { error });
+        return errorResult(
+          `Failed to get CI status: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "configuration_ci_refresh_status")),
+    {
+      title: "Refresh CI Status",
+      description: "Force refresh of the cached CI/CD pipeline status snapshot.",
+      inputSchema: { providerId: z.string(), agentId: z.string() }
+    },
+    async ({ providerId, agentId }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          REFRESH_CI_STATUS_M,
+          { providerId, agentId }
+        );
+        return jsonResult(data.refreshCIStatus);
+      } catch (error) {
+        ctx.logger.error("config_ci_status_refresh failed", { error });
+        return errorResult(
+          `Failed to refresh CI status: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "configuration_ci_get_pipeline_runs")),
+    {
+      title: "List CI Pipeline Runs",
+      description: "List recent CI pipeline runs from a GitOps provider, optionally filtered by branch.",
       inputSchema: {
-        key: z.string().optional().describe("Filter by key pattern"),
-        scope: ConfigScopeEnum.describe("Configuration scope"),
-        scopeId: z.string().optional().describe("Filter by scope entity ID"),
-        isSecret: z.boolean().optional().describe("Filter by secret status"),
-        limit: z.number().optional().describe("Max results"),
-        offset: z.number().optional().describe("Offset for pagination")
+        providerId: z.string(),
+        agentId: z.string(),
+        branch: z.string().optional(),
+        limit: z.number().optional()
       }
     },
-    async ({ key, scope, scopeId, isSecret, limit, offset }) => {
+    async ({ providerId, agentId, branch, limit }) => {
       try {
-        const filter = { scope };
-        if (key !== void 0) filter.key = key;
-        if (scopeId !== void 0) filter.scopeId = scopeId;
-        if (isSecret !== void 0) filter.isSecret = isSecret;
+        const data = await ctx.gql.workspace.request(
+          GET_CI_PIPELINE_RUNS_Q,
+          { providerId, agentId, branch, limit }
+        );
+        return jsonResult(data.getCIPipelineRuns);
+      } catch (error) {
+        ctx.logger.error("config_ci_pipeline_runs_list failed", { error });
+        return errorResult(
+          `Failed to list CI runs: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "configuration_ci_get_pipeline_details")),
+    {
+      title: "Get CI Pipeline Details",
+      description: "Get detailed information (commit, jobs) for a single CI pipeline run.",
+      inputSchema: {
+        providerId: z.string(),
+        agentId: z.string(),
+        runId: z.string()
+      }
+    },
+    async ({ providerId, agentId, runId }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          GET_CI_PIPELINE_DETAILS_Q,
+          { providerId, agentId, runId }
+        );
+        return jsonResult(data.getCIPipelineDetails);
+      } catch (error) {
+        ctx.logger.error("config_ci_pipeline_details_get failed", { error });
+        return errorResult(
+          `Failed to get pipeline details: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "configuration_ci_get_repo_stats")),
+    {
+      title: "Get Repository Stats",
+      description: "Get cached repository statistics (stars, forks, languages, PRs, contributors, etc) for a GitOps provider.",
+      inputSchema: { providerId: z.string(), agentId: z.string() }
+    },
+    async ({ providerId, agentId }) => {
+      try {
+        const data = await ctx.gql.workspace.request(GET_REPO_STATS_Q, {
+          providerId,
+          agentId
+        });
+        return jsonResult(data.getRepoStats);
+      } catch (error) {
+        ctx.logger.error("config_ci_repo_stats_get failed", { error });
+        return errorResult(
+          `Failed to get repo stats: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "configuration_ci_refresh_repo_stats")),
+    {
+      title: "Refresh Repository Stats",
+      description: "Force refresh of the cached repository statistics snapshot.",
+      inputSchema: { providerId: z.string(), agentId: z.string() }
+    },
+    async ({ providerId, agentId }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          REFRESH_REPO_STATS_M,
+          { providerId, agentId }
+        );
+        return jsonResult(data.refreshRepoStats);
+      } catch (error) {
+        ctx.logger.error("config_ci_repo_stats_refresh failed", { error });
+        return errorResult(
+          `Failed to refresh repo stats: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+}
+var ProviderTypeEnum = z.enum(["AZURE_DEVOPS", "BITBUCKET", "GITHUB", "GITLAB"]);
+function registerConfigGitopsTools(server, ctx, track) {
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "configuration_gitops_list")),
+    {
+      title: "List GitOps Providers",
+      description: "List GitOps providers (GitHub/GitLab/Bitbucket/Azure DevOps) in the current workspace.",
+      inputSchema: {
+        providerType: ProviderTypeEnum.optional(),
+        isActive: z.boolean().optional(),
+        vibeId: z.string().optional(),
+        limit: z.number().optional(),
+        offset: z.number().optional()
+      }
+    },
+    async ({ providerType, isActive, vibeId, limit, offset }) => {
+      try {
+        const filter = {};
+        if (providerType !== void 0) filter.providerType = providerType;
+        if (isActive !== void 0) filter.isActive = isActive;
+        if (vibeId !== void 0) filter.vibeId = vibeId;
         const pagination = {};
         if (limit !== void 0) pagination.limit = limit;
         if (offset !== void 0) pagination.offset = offset;
         const data = await ctx.gql.workspace.request(
-          LIST_CONFIGURATIONS,
+          LIST_GITOPS_PROVIDERS_Q,
           {
-            filter,
+            filter: Object.keys(filter).length > 0 ? filter : void 0,
             pagination: Object.keys(pagination).length > 0 ? pagination : void 0
           }
         );
-        return jsonResult(data.configurations);
+        return jsonResult(data.listGitopsProviders);
       } catch (error) {
-        ctx.logger.error("vibecontrols_config_list failed", { error });
+        ctx.logger.error("config_gitops_list failed", { error });
         return errorResult(
-          `Failed to list configurations: ${error instanceof Error ? error.message : String(error)}`
+          `Failed to list gitops providers: ${error instanceof Error ? error.message : String(error)}`
         );
       }
     }
   );
   server.registerTool(
-    track(mcpToolName(ctx.productName, "config_get")),
+    track(mcpToolName(ctx.productName, "configuration_gitops_get")),
     {
-      title: "Get Configuration",
-      description: "Get a configuration value by key and scope.",
+      title: "Get GitOps Provider",
+      description: "Get a single GitOps provider by ID.",
+      inputSchema: { id: z.string() }
+    },
+    async ({ id }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          GET_GITOPS_PROVIDER_Q,
+          { id }
+        );
+        return jsonResult(data.getGitopsProvider);
+      } catch (error) {
+        ctx.logger.error("config_gitops_get failed", { error });
+        return errorResult(
+          `Failed to get gitops provider: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "configuration_gitops_create")),
+    {
+      title: "Create GitOps Provider",
+      description: "Create a new GitOps provider connection.",
       inputSchema: {
-        key: z.string().describe("Configuration key"),
-        scope: ConfigScopeEnum.describe("Configuration scope"),
-        scopeId: z.string().optional().describe("Scope entity ID")
+        name: z.string(),
+        providerType: ProviderTypeEnum,
+        repoUrl: z.string(),
+        vibeId: z.string().optional(),
+        isActive: z.boolean().optional(),
+        metadata: z.string().optional().describe("Optional JSON-string metadata blob")
       }
     },
-    async ({ key, scope, scopeId }) => {
+    async ({ name, providerType, repoUrl, vibeId, isActive, metadata }) => {
       try {
+        const input = { name, providerType, repoUrl };
+        if (vibeId !== void 0) input.vibeId = vibeId;
+        if (isActive !== void 0) input.isActive = isActive;
+        if (metadata !== void 0) input.metadata = JSON.parse(metadata);
         const data = await ctx.gql.workspace.request(
-          GET_CONFIGURATION,
-          {
-            key,
-            scope,
-            scopeId
-          }
+          CREATE_GITOPS_PROVIDER_M,
+          { input }
         );
-        return jsonResult(data.configuration);
+        return jsonResult(data.createGitopsProvider);
       } catch (error) {
-        ctx.logger.error("vibecontrols_config_get failed", { error });
+        ctx.logger.error("config_gitops_create failed", { error });
         return errorResult(
-          `Failed to get configuration: ${error instanceof Error ? error.message : String(error)}`
+          `Failed to create gitops provider: ${error instanceof Error ? error.message : String(error)}`
         );
       }
     }
   );
   server.registerTool(
-    track(mcpToolName(ctx.productName, "config_set")),
+    track(mcpToolName(ctx.productName, "configuration_gitops_update")),
     {
-      title: "Set Configuration",
-      description: "Set (create or update) a configuration value.",
+      title: "Update GitOps Provider",
+      description: "Update an existing GitOps provider connection.",
       inputSchema: {
-        key: z.string().describe("Configuration key"),
-        scope: ConfigScopeEnum.describe("Configuration scope"),
-        scopeId: z.string().optional().describe("Scope entity ID"),
-        value: z.string().describe("Configuration value as a JSON string"),
-        isSecret: z.boolean().optional().describe("Mark as secret (value will be masked in reads)")
+        id: z.string(),
+        name: z.string().optional(),
+        repoUrl: z.string().optional(),
+        vibeId: z.string().optional(),
+        isActive: z.boolean().optional(),
+        metadata: z.string().optional().describe("Optional JSON-string metadata blob")
       }
     },
-    async ({ key, scope, scopeId, value, isSecret }) => {
+    async ({ id, name, repoUrl, vibeId, isActive, metadata }) => {
       try {
-        const parsedValue = JSON.parse(value);
-        const variables = { key, scope, value: parsedValue };
-        if (scopeId !== void 0) variables.scopeId = scopeId;
-        if (isSecret !== void 0) variables.isSecret = isSecret;
+        const input = {};
+        if (name !== void 0) input.name = name;
+        if (repoUrl !== void 0) input.repoUrl = repoUrl;
+        if (vibeId !== void 0) input.vibeId = vibeId;
+        if (isActive !== void 0) input.isActive = isActive;
+        if (metadata !== void 0) input.metadata = JSON.parse(metadata);
         const data = await ctx.gql.workspace.request(
-          SET_CONFIGURATION,
-          variables
+          UPDATE_GITOPS_PROVIDER_M,
+          { id, input }
         );
-        return jsonResult(data.setConfiguration);
+        return jsonResult(data.updateGitopsProvider);
       } catch (error) {
-        ctx.logger.error("vibecontrols_config_set failed", { error });
+        ctx.logger.error("config_gitops_update failed", { error });
         return errorResult(
-          `Failed to set configuration: ${error instanceof Error ? error.message : String(error)}`
+          `Failed to update gitops provider: ${error instanceof Error ? error.message : String(error)}`
         );
       }
     }
   );
   server.registerTool(
-    track(mcpToolName(ctx.productName, "config_delete")),
+    track(mcpToolName(ctx.productName, "configuration_gitops_delete")),
     {
-      title: "Delete Configuration",
-      description: "Delete a configuration by key and scope.",
+      title: "Delete GitOps Provider",
+      description: "Delete a GitOps provider connection.",
+      inputSchema: { id: z.string() }
+    },
+    async ({ id }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          DELETE_GITOPS_PROVIDER_M,
+          { id }
+        );
+        return jsonResult({ deleted: data.deleteGitopsProvider, id });
+      } catch (error) {
+        ctx.logger.error("config_gitops_delete failed", { error });
+        return errorResult(
+          `Failed to delete gitops provider: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+}
+var SettingsCategoryEnum = z.enum([
+  "ADVANCED",
+  "NOTIFICATIONS",
+  "PREFERENCES",
+  "PROFILE",
+  "SECURITY",
+  "WORKSPACE_DEFAULTS"
+]);
+function registerConfigSettingsTools(server, ctx, track) {
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "configuration_settings_mine")),
+    {
+      title: "Get My Settings",
+      description: "Get the complete settings bundle for the current user (preferences + notifications + workspace defaults + profile + security).",
+      inputSchema: {}
+    },
+    async () => {
+      try {
+        const data = await ctx.gql.workspace.request(MY_SETTINGS_Q);
+        return jsonResult(data.mySettings);
+      } catch (error) {
+        ctx.logger.error("config_settings_mine failed", { error });
+        return errorResult(
+          `Failed to get settings: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "configuration_settings_mine_by_category")),
+    {
+      title: "Get My Settings by Category",
+      description: "Get a single settings category as a JSON blob.",
+      inputSchema: { category: SettingsCategoryEnum }
+    },
+    async ({ category }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          MY_SETTINGS_BY_CATEGORY_Q,
+          { category }
+        );
+        return jsonResult(data.mySettingsByCategory);
+      } catch (error) {
+        ctx.logger.error("config_settings_mine_by_category failed", { error });
+        return errorResult(
+          `Failed to get settings category: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "configuration_settings_reset")),
+    {
+      title: "Reset Settings Category",
+      description: "Reset a settings category to its workspace defaults.",
+      inputSchema: { category: SettingsCategoryEnum }
+    },
+    async ({ category }) => {
+      try {
+        const data = await ctx.gql.workspace.request(RESET_SETTINGS_M, {
+          category
+        });
+        return jsonResult({ reset: data.resetSettings, category });
+      } catch (error) {
+        ctx.logger.error("config_settings_reset failed", { error });
+        return errorResult(
+          `Failed to reset settings: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "configuration_settings_update_preferences")),
+    {
+      title: "Update Preferences",
+      description: "Update the current user UI preferences (theme, density, IDE, font, tab order, etc).",
       inputSchema: {
-        key: z.string().describe("Configuration key to delete"),
-        scope: ConfigScopeEnum.describe("Configuration scope"),
-        scopeId: z.string().optional().describe("Scope entity ID")
+        theme: z.string().optional(),
+        uiDensity: z.string().optional(),
+        sidebarCollapsed: z.boolean().optional(),
+        codeFont: z.string().optional(),
+        codeFontSize: z.number().optional(),
+        preferredIdeCommand: z.string().nullable().optional(),
+        defaultAgentForVibe: z.string().optional().describe("JSON blob"),
+        vibeIdeOverrides: z.string().optional().describe("JSON blob"),
+        vibeDetailTabOrder: z.string().optional().describe("JSON blob")
+      }
+    },
+    async ({
+      theme,
+      uiDensity,
+      sidebarCollapsed,
+      codeFont,
+      codeFontSize,
+      preferredIdeCommand,
+      defaultAgentForVibe,
+      vibeIdeOverrides,
+      vibeDetailTabOrder
+    }) => {
+      try {
+        const input = {};
+        if (theme !== void 0) input.theme = theme;
+        if (uiDensity !== void 0) input.uiDensity = uiDensity;
+        if (sidebarCollapsed !== void 0) input.sidebarCollapsed = sidebarCollapsed;
+        if (codeFont !== void 0) input.codeFont = codeFont;
+        if (codeFontSize !== void 0) input.codeFontSize = codeFontSize;
+        if (preferredIdeCommand !== void 0) input.preferredIdeCommand = preferredIdeCommand;
+        if (defaultAgentForVibe !== void 0)
+          input.defaultAgentForVibe = JSON.parse(defaultAgentForVibe);
+        if (vibeIdeOverrides !== void 0) input.vibeIdeOverrides = JSON.parse(vibeIdeOverrides);
+        if (vibeDetailTabOrder !== void 0)
+          input.vibeDetailTabOrder = JSON.parse(vibeDetailTabOrder);
+        const data = await ctx.gql.workspace.request(
+          UPDATE_PREFERENCES_M,
+          { input }
+        );
+        return jsonResult(data.updatePreferences);
+      } catch (error) {
+        ctx.logger.error("config_settings_preferences_update failed", { error });
+        return errorResult(
+          `Failed to update preferences: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "configuration_settings_update_notif_prefs")),
+    {
+      title: "Update Notification Preferences",
+      description: "Update notification toggles and digest cadence.",
+      inputSchema: {
+        emailDigest: z.boolean().optional(),
+        digestFrequency: z.string().optional(),
+        agentOffline: z.boolean().optional(),
+        sessionError: z.boolean().optional(),
+        vibeStatusChange: z.boolean().optional()
+      }
+    },
+    async (input) => {
+      try {
+        const cleaned = {};
+        for (const [k, v] of Object.entries(input)) {
+          if (v !== void 0) cleaned[k] = v;
+        }
+        const data = await ctx.gql.workspace.request(
+          UPDATE_NOTIFICATION_PREFERENCES_M,
+          { input: cleaned }
+        );
+        return jsonResult(data.updateNotificationPreferences);
+      } catch (error) {
+        ctx.logger.error("config_settings_notifications_update failed", { error });
+        return errorResult(
+          `Failed to update notifications: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "configuration_settings_update_workspace_defaults")),
+    {
+      title: "Update Workspace Defaults",
+      description: "Update workspace-level default settings for agents, sessions, vibes, telemetry.",
+      inputSchema: {
+        defaultAgent: z.string().optional(),
+        defaultSessionType: z.string().optional(),
+        defaultVibeType: z.string().optional(),
+        defaultEnvironmentVariables: z.string().optional(),
+        autoStartSessions: z.boolean().optional(),
+        autoGitSync: z.boolean().optional(),
+        agentHeartbeatInterval: z.number().optional(),
+        agentMaxSessions: z.number().optional(),
+        agentAutoReconnect: z.boolean().optional(),
+        autoUpdate: z.boolean().optional(),
+        telemetryEnabled: z.boolean().optional(),
+        logLevel: z.string().optional()
+      }
+    },
+    async (input) => {
+      try {
+        const cleaned = {};
+        for (const [k, v] of Object.entries(input)) {
+          if (v !== void 0) cleaned[k] = v;
+        }
+        const data = await ctx.gql.workspace.request(
+          UPDATE_WORKSPACE_DEFAULTS_M,
+          { input: cleaned }
+        );
+        return jsonResult(data.updateWorkspaceDefaults);
+      } catch (error) {
+        ctx.logger.error("config_settings_workspace_defaults_update failed", { error });
+        return errorResult(
+          `Failed to update workspace defaults: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "configuration_settings_list_secrets")),
+    {
+      title: "List Settings Secrets",
+      description: "List stored settings secrets (values are hidden by default).",
+      inputSchema: {}
+    },
+    async () => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          LIST_SETTINGS_SECRETS_Q
+        );
+        return jsonResult(data.listSettingsSecrets);
+      } catch (error) {
+        ctx.logger.error("config_settings_secrets_list failed", { error });
+        return errorResult(
+          `Failed to list secrets: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "configuration_settings_set_secret")),
+    {
+      title: "Set Settings Secret",
+      description: "Create or update a settings secret (value is encrypted at rest).",
+      inputSchema: {
+        key: z.string(),
+        value: z.string()
+      }
+    },
+    async ({ key, value }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          SET_SETTINGS_SECRET_M,
+          { input: { key, value } }
+        );
+        return jsonResult(data.setSettingsSecret);
+      } catch (error) {
+        ctx.logger.error("config_settings_secret_set failed", { error });
+        return errorResult(
+          `Failed to set secret: ${error instanceof Error ? error.message : String(error)}`
+        );
       }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "configuration_settings_delete_secret")),
+    {
+      title: "Delete Settings Secret",
+      description: "Delete a settings secret by key.",
+      inputSchema: { key: z.string() }
     },
-    async ({ key, scope, scopeId }) => {
+    async ({ key }) => {
       try {
         const data = await ctx.gql.workspace.request(
-          DELETE_CONFIGURATION,
-          { key, scope, scopeId }
+          DELETE_SETTINGS_SECRET_M,
+          { key }
         );
-        return jsonResult({ deleted: data.deleteConfiguration, key, scope });
+        return jsonResult({ deleted: data.deleteSettingsSecret, key });
       } catch (error) {
-        ctx.logger.error("vibecontrols_config_delete failed", { error });
+        ctx.logger.error("config_settings_secret_delete failed", { error });
         return errorResult(
-          `Failed to delete configuration: ${error instanceof Error ? error.message : String(error)}`
+          `Failed to delete secret: ${error instanceof Error ? error.message : String(error)}`
         );
       }
     }
   );
   server.registerTool(
-    track(mcpToolName(ctx.productName, "config_by_scope")),
+    track(mcpToolName(ctx.productName, "configuration_settings_resolve_integration_token")),
     {
-      title: "Configurations by Scope",
-      description: "Get all configuration values for a given scope.",
-      inputSchema: {
-        scope: ConfigScopeEnum.describe("Configuration scope"),
-        scopeId: z.string().optional().describe("Scope entity ID")
-      }
+      title: "Resolve Integration Token",
+      description: "Resolve a decrypted integration token for an agent to call third-party APIs (handles OAuth refresh).",
+      inputSchema: { connectionId: z.string() }
     },
-    async ({ scope, scopeId }) => {
+    async ({ connectionId }) => {
       try {
-        const data = await ctx.gql.workspace.request(
-          CONFIGURATIONS_BY_SCOPE,
-          { scope, scopeId }
-        );
-        return jsonResult(data.configurationsByScope);
+        const data = await ctx.gql.workspace.request(RESOLVE_INTEGRATION_TOKEN_M, { connectionId });
+        return jsonResult(data.vibecontrolsResolveIntegrationToken);
       } catch (error) {
-        ctx.logger.error("vibecontrols_config_by_scope failed", { error });
+        ctx.logger.error("config_settings_integration_token_resolve failed", { error });
         return errorResult(
-          `Failed to get configurations by scope: ${error instanceof Error ? error.message : String(error)}`
+          `Failed to resolve token: ${error instanceof Error ? error.message : String(error)}`
         );
       }
     }
@@ -2048,6 +4458,156 @@ function registerSessionSharingTools(server, ctx, track) {
       }
     }
   );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "sessions_share_update")),
+    {
+      title: "Update Session Share",
+      description: "Update an existing session share (permission/expiry).",
+      inputSchema: {
+        id: z.string().describe("Session share ID"),
+        permission: z.string().optional().describe("VIEW or INTERACT"),
+        expiresAt: z.string().optional().describe("Expiration date in ISO format")
+      }
+    },
+    async ({ id, permission, expiresAt }) => {
+      try {
+        const input = {};
+        if (permission !== void 0) input.permission = permission;
+        if (expiresAt !== void 0) input.expiresAt = expiresAt;
+        const data = await ctx.gql.workspace.request(
+          UPDATE_SESSION_SHARE,
+          { id, input }
+        );
+        return jsonResult(data.updateSessionShare);
+      } catch (error) {
+        ctx.logger.error("vibecontrols_sessions_share_update failed", { error });
+        return errorResult(
+          `Failed to update session share: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "sessions_join")),
+    {
+      title: "Join Shared Session",
+      description: "Join a shared session via share id or share-link token.",
+      inputSchema: {
+        shareId: z.string().optional().describe("Direct share ID"),
+        shareToken: z.string().optional().describe("Share link token"),
+        password: z.string().optional().describe("Password if the link is protected")
+      }
+    },
+    async ({ shareId, shareToken, password }) => {
+      try {
+        const input = {};
+        if (shareId !== void 0) input.shareId = shareId;
+        if (shareToken !== void 0) input.shareToken = shareToken;
+        if (password !== void 0) input.password = password;
+        const data = await ctx.gql.workspace.request(
+          JOIN_SHARED_SESSION,
+          { input }
+        );
+        return jsonResult(data.joinSharedSession);
+      } catch (error) {
+        ctx.logger.error("vibecontrols_sessions_join failed", { error });
+        return errorResult(
+          `Failed to join shared session: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "sessions_leave")),
+    {
+      title: "Leave Shared Session",
+      description: "Leave a shared session as a collaborator.",
+      inputSchema: { sessionId: z.string().describe("Session ID") }
+    },
+    async ({ sessionId }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          LEAVE_SHARED_SESSION,
+          { sessionId }
+        );
+        return jsonResult({ left: data.leaveSharedSession });
+      } catch (error) {
+        ctx.logger.error("vibecontrols_sessions_leave failed", { error });
+        return errorResult(
+          `Failed to leave shared session: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "sessions_request_control")),
+    {
+      title: "Request Session Control",
+      description: "Request control of a shared session (INTERACT permission).",
+      inputSchema: { sessionId: z.string().describe("Session ID") }
+    },
+    async ({ sessionId }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          REQUEST_SESSION_CONTROL,
+          { sessionId }
+        );
+        return jsonResult({ requested: data.requestSessionControl });
+      } catch (error) {
+        ctx.logger.error("vibecontrols_sessions_request_control failed", { error });
+        return errorResult(
+          `Failed to request session control: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "sessions_release_control")),
+    {
+      title: "Release Session Control",
+      description: "Release control of a shared session.",
+      inputSchema: { sessionId: z.string().describe("Session ID") }
+    },
+    async ({ sessionId }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          RELEASE_SESSION_CONTROL,
+          { sessionId }
+        );
+        return jsonResult({ released: data.releaseSessionControl });
+      } catch (error) {
+        ctx.logger.error("vibecontrols_sessions_release_control failed", { error });
+        return errorResult(
+          `Failed to release session control: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "sessions_transfer_control")),
+    {
+      title: "Transfer Session Control",
+      description: "Transfer control of a shared session to another collaborator.",
+      inputSchema: {
+        sessionId: z.string().describe("Session ID"),
+        toUserId: z.string().describe("User ID to transfer control to")
+      }
+    },
+    async ({ sessionId, toUserId }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          TRANSFER_SESSION_CONTROL,
+          { sessionId, toUserId }
+        );
+        return jsonResult({ transferred: data.transferSessionControl });
+      } catch (error) {
+        ctx.logger.error("vibecontrols_sessions_transfer_control failed", { error });
+        return errorResult(
+          `Failed to transfer session control: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
 }
 var VibecontrolsSessionStatusEnum = z.enum(["PENDING", "STARTING", "RUNNING", "STOPPED", "ERROR", "TERMINATED"]).describe("Lifecycle status of a vibecontrols session");
 function registerSessionTools(server, ctx, track) {
@@ -2537,6 +5097,130 @@ function registerSessionTools(server, ctx, track) {
       }
     }
   );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "sessions_stop_terminal")),
+    {
+      title: "Stop Session Terminal",
+      description: "Stop the ttyd web terminal for a session.",
+      inputSchema: { id: z.string().describe("Session ID") }
+    },
+    async ({ id }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          STOP_SESSION_TERMINAL,
+          { id }
+        );
+        return jsonResult(data.stopSessionTerminal);
+      } catch (error) {
+        ctx.logger.error("vibecontrols_sessions_stop_terminal failed", { error });
+        return errorResult(
+          `Failed to stop session terminal: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "sessions_restart_terminal")),
+    {
+      title: "Restart Session Terminal",
+      description: "Restart the web terminal for a session.",
+      inputSchema: { id: z.string().describe("Session ID") }
+    },
+    async ({ id }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          RESTART_SESSION_TERMINAL,
+          { id }
+        );
+        return jsonResult(data.restartSessionTerminal);
+      } catch (error) {
+        ctx.logger.error("vibecontrols_sessions_restart_terminal failed", { error });
+        return errorResult(
+          `Failed to restart session terminal: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "sessions_start_target_terminal")),
+    {
+      title: "Start Target Terminal",
+      description: "Open a web terminal against a target host (SSH/RDP/VNC/DIRECT). Returns the connection info incl. ttydUrl.",
+      inputSchema: {
+        targetId: z.string().describe("Target ID"),
+        shell: z.string().optional().describe("Shell binary path")
+      }
+    },
+    async ({ targetId, shell }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          START_TARGET_TERMINAL,
+          { targetId, shell }
+        );
+        return jsonResult(data.startTerminal);
+      } catch (error) {
+        ctx.logger.error("vibecontrols_sessions_start_target_terminal failed", { error });
+        return errorResult(
+          `Failed to start target terminal: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "sessions_stop_target_terminal")),
+    {
+      title: "Stop Target Terminal",
+      description: "Stop a target terminal session.",
+      inputSchema: { sessionId: z.string().describe("Target terminal session ID") }
+    },
+    async ({ sessionId }) => {
+      try {
+        const data = await ctx.gql.workspace.request(
+          STOP_TARGET_TERMINAL,
+          { sessionId }
+        );
+        return jsonResult({ stopped: data.stopTerminal, sessionId });
+      } catch (error) {
+        ctx.logger.error("vibecontrols_sessions_stop_target_terminal failed", { error });
+        return errorResult(
+          `Failed to stop target terminal: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "sessions_export")),
+    {
+      title: "Export Sessions",
+      description: "Export sessions to CSV or JSON.",
+      inputSchema: {
+        format: z.enum(["CSV", "JSON"]).optional().describe("Output format"),
+        status: z.string().optional(),
+        type: z.string().optional(),
+        agentId: z.string().optional(),
+        vibeId: z.string().optional()
+      }
+    },
+    async ({ format, status, type, agentId, vibeId }) => {
+      try {
+        const filter = {};
+        if (status !== void 0) filter.status = status;
+        if (type !== void 0) filter.type = type;
+        if (agentId !== void 0) filter.agentId = agentId;
+        if (vibeId !== void 0) filter.vibeId = vibeId;
+        const input = {};
+        if (Object.keys(filter).length) input.filter = filter;
+        if (format !== void 0) input.format = format;
+        const data = await ctx.gql.workspace.request(EXPORT_SESSIONS, { input });
+        return jsonResult(data.exportSessions);
+      } catch (error) {
+        ctx.logger.error("vibecontrols_sessions_export failed", { error });
+        return errorResult(
+          `Failed to export sessions: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  );
 }
 function registerTargetTools(server, ctx, track) {
   server.registerTool(
@@ -2787,108 +5471,437 @@ function registerTargetTools(server, ctx, track) {
     }
   );
 }
+var tunnelProviderKey = z.enum(["VIBETUNNELS", "CLOUDFLARE"]);
+var tunnelEnvironment = z.enum(["ALPHA", "PROD"]);
+var tunnelProtocol = z.enum(["HTTP", "HTTPS", "TCP", "UDP"]);
 function registerTunnelTools(server, ctx, track) {
-  server.registerTool(
-    track(mcpToolName(ctx.productName, "tunnels_list")),
-    {
-      title: "List Tunnels",
-      description: "List all agent tunnels.",
-      inputSchema: {}
-    },
-    async () => {
-      try {
-        const data = await ctx.gql.workspace.request(
-          LIST_TUNNELS
-        );
-        return jsonResult(data.vibecontrolsAgentTunnels);
-      } catch (error) {
-        ctx.logger.error("vibecontrols_tunnels_list failed", { error });
-        return errorResult(
-          `Failed to list tunnels: ${error instanceof Error ? error.message : String(error)}`
-        );
+  const w = ctx.gql.workspace;
+  const tool = (name, title, description, inputSchema, handler) => {
+    server.registerTool(
+      track(mcpToolName(ctx.productName, name)),
+      { title, description, inputSchema },
+      async (args) => {
+        try {
+          const data = await handler(args);
+          return jsonResult(data);
+        } catch (error) {
+          ctx.logger.error(`vibecontrols_${name} failed`, { error });
+          return errorResult(`Failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
       }
+    );
+  };
+  tool(
+    "tunnels_list",
+    "List Tunnels",
+    "List tunnels in the workspace with optional filters.",
+    {
+      agentId: z.string().optional(),
+      providerKey: tunnelProviderKey.optional(),
+      search: z.string().optional(),
+      status: z.array(z.string()).optional(),
+      limit: z.number().optional(),
+      offset: z.number().optional()
+    },
+    async ({ agentId, providerKey, search, status, limit, offset }) => {
+      const filter = {};
+      if (agentId !== void 0) filter.agentId = agentId;
+      if (providerKey !== void 0) filter.providerKey = providerKey;
+      if (search !== void 0) filter.search = search;
+      if (status !== void 0) filter.status = status;
+      const pagination = {};
+      if (limit !== void 0) pagination.limit = limit;
+      if (offset !== void 0) pagination.offset = offset;
+      const data = await w.request(LIST_TUNNELS, {
+        filter: Object.keys(filter).length ? filter : void 0,
+        pagination: Object.keys(pagination).length ? pagination : void 0
+      });
+      return data.tunnels;
+    }
+  );
+  tool(
+    "tunnels_get",
+    "Get Tunnel",
+    "Get a tunnel by ID.",
+    { id: z.string().describe("Tunnel ID") },
+    async ({ id }) => {
+      const data = await w.request(GET_TUNNEL, { id });
+      return data.tunnel;
+    }
+  );
+  tool(
+    "tunnels_by_slug",
+    "Get Tunnel by Slug",
+    "Get a tunnel by its workspace-unique slug.",
+    { slug: z.string().describe("Tunnel slug") },
+    async ({ slug }) => {
+      const data = await w.request(GET_TUNNEL_BY_SLUG, { slug });
+      return data.tunnelBySlug;
+    }
+  );
+  tool(
+    "tunnels_create",
+    "Create Tunnel",
+    "Create a tunnel in DRAFT status. Call tunnels_start to bring it up.",
+    {
+      agentId: z.string(),
+      name: z.string(),
+      providerKey: tunnelProviderKey,
+      localPort: z.number(),
+      description: z.string().optional(),
+      localHost: z.string().optional(),
+      protocol: tunnelProtocol.optional(),
+      environment: tunnelEnvironment.optional(),
+      managedSubdomain: z.string().optional(),
+      slug: z.string().optional(),
+      tlsMode: z.string().optional(),
+      basicAuthUser: z.string().optional(),
+      basicAuthPassword: z.string().optional()
+    },
+    async (args) => {
+      const data = await w.request(CREATE_TUNNEL, { input: args });
+      return data.createTunnel;
+    }
+  );
+  tool(
+    "tunnels_update",
+    "Update Tunnel",
+    "Update tunnel metadata, target host/port, basic auth, etc.",
+    {
+      id: z.string(),
+      name: z.string().optional(),
+      description: z.string().optional(),
+      localHost: z.string().optional(),
+      localPort: z.number().optional(),
+      tlsMode: z.string().optional(),
+      basicAuthUser: z.string().optional(),
+      basicAuthPassword: z.string().optional()
+    },
+    async ({ id, ...input }) => {
+      const data = await w.request(UPDATE_TUNNEL, { id, input });
+      return data.updateTunnel;
+    }
+  );
+  tool(
+    "tunnels_delete",
+    "Delete Tunnel",
+    "Soft-delete a tunnel (stops it first if active).",
+    { id: z.string() },
+    async ({ id }) => {
+      const data = await w.request(DELETE_TUNNEL, { id });
+      return { deleted: data.deleteTunnel, id };
     }
   );
-  server.registerTool(
-    track(mcpToolName(ctx.productName, "tunnels_create")),
-    {
-      title: "Create Tunnel",
-      description: "Create a new agent tunnel for remote access.",
-      inputSchema: {
-        agentId: z.string().describe("Agent ID to create the tunnel for"),
-        provider: z.string().optional().describe("Tunnel provider (e.g., cloudflare)")
-      }
-    },
-    async ({ agentId, provider }) => {
-      try {
-        const input = { agentId };
-        if (provider !== void 0) input.provider = provider;
-        const data = await ctx.gql.workspace.request(
-          CREATE_TUNNEL,
-          {
-            input
-          }
-        );
-        return jsonResult(data.createAgentTunnel);
-      } catch (error) {
-        ctx.logger.error("vibecontrols_tunnels_create failed", { error });
-        return errorResult(
-          `Failed to create tunnel: ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
+  tool(
+    "tunnels_start",
+    "Start Tunnel",
+    "Transition a tunnel to ACTIVE.",
+    { id: z.string() },
+    async ({ id }) => {
+      const data = await w.request(START_TUNNEL, { id });
+      return data.startTunnel;
     }
   );
-  server.registerTool(
-    track(mcpToolName(ctx.productName, "tunnels_stop")),
-    {
-      title: "Stop Tunnel",
-      description: "Stop a running tunnel.",
-      inputSchema: {
-        agentId: z.string().describe("Agent ID that owns the tunnel"),
-        tunnelId: z.string().describe("Tunnel ID to stop")
-      }
-    },
-    async ({ agentId, tunnelId }) => {
-      try {
-        const data = await ctx.gql.workspace.request(STOP_TUNNEL, {
-          agentId,
-          tunnelId
-        });
-        return jsonResult({ stopped: data.stopAgentTunnel, agentId, tunnelId });
-      } catch (error) {
-        ctx.logger.error("vibecontrols_tunnels_stop failed", { error });
-        return errorResult(
-          `Failed to stop tunnel: ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
+  tool(
+    "tunnels_stop",
+    "Stop Tunnel",
+    "Gracefully stop a running tunnel.",
+    { id: z.string() },
+    async ({ id }) => {
+      const data = await w.request(STOP_TUNNEL, { id });
+      return data.stopTunnel;
     }
   );
-  server.registerTool(
-    track(mcpToolName(ctx.productName, "tunnels_delete")),
-    {
-      title: "Delete Tunnel",
-      description: "Permanently delete a tunnel.",
-      inputSchema: {
-        agentId: z.string().describe("Agent ID that owns the tunnel"),
-        tunnelId: z.string().describe("Tunnel ID to delete")
-      }
-    },
-    async ({ agentId, tunnelId }) => {
-      try {
-        const data = await ctx.gql.workspace.request(
-          DELETE_TUNNEL,
-          {
-            agentId,
-            tunnelId
-          }
-        );
-        return jsonResult({ deleted: data.deleteAgentTunnel, agentId, tunnelId });
-      } catch (error) {
-        ctx.logger.error("vibecontrols_tunnels_delete failed", { error });
-        return errorResult(
-          `Failed to delete tunnel: ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
+  tool(
+    "tunnels_rotate_credentials",
+    "Rotate Tunnel Credentials",
+    "Rotate basic-auth + provider secrets. Active sessions are revoked.",
+    { id: z.string() },
+    async ({ id }) => {
+      const data = await w.request(
+        ROTATE_TUNNEL_CREDENTIALS,
+        { id }
+      );
+      return data.rotateTunnelCredentials;
+    }
+  );
+  tool(
+    "tunnels_issue_session",
+    "Issue Tunnel Session",
+    "Issue a short-lived session token for an agent to connect with. Token is returned exactly once.",
+    {
+      tunnelId: z.string(),
+      ttlSeconds: z.number().optional()
+    },
+    async ({ tunnelId, ttlSeconds }) => {
+      const data = await w.request(ISSUE_TUNNEL_SESSION, {
+        tunnelId,
+        ttlSeconds
+      });
+      return data.issueTunnelSession;
+    }
+  );
+  tool(
+    "tunnels_revoke_session",
+    "Revoke Tunnel Session",
+    "Revoke an active session (kills the live connection).",
+    { sessionId: z.string(), reason: z.string().optional() },
+    async ({ sessionId, reason }) => {
+      const data = await w.request(REVOKE_TUNNEL_SESSION, {
+        sessionId,
+        reason
+      });
+      return { revoked: data.revokeTunnelSession, sessionId };
+    }
+  );
+  tool(
+    "tunnels_list_sessions",
+    "List Tunnel Sessions",
+    "List sessions for a tunnel.",
+    {
+      tunnelId: z.string(),
+      limit: z.number().optional(),
+      offset: z.number().optional()
+    },
+    async ({ tunnelId, limit, offset }) => {
+      const pagination = {};
+      if (limit !== void 0) pagination.limit = limit;
+      if (offset !== void 0) pagination.offset = offset;
+      const data = await w.request(LIST_TUNNEL_SESSIONS, {
+        tunnelId,
+        pagination: Object.keys(pagination).length ? pagination : void 0
+      });
+      return data.tunnelSessions;
+    }
+  );
+  tool("tunnels_providers", "List Tunnel Providers", "List all tunnel providers.", {}, async () => {
+    const data = await w.request(LIST_TUNNEL_PROVIDERS);
+    return data.tunnelProviders;
+  });
+  tool(
+    "tunnels_provider",
+    "Get Tunnel Provider",
+    "Get a single tunnel provider by key.",
+    { key: tunnelProviderKey },
+    async ({ key }) => {
+      const data = await w.request(GET_TUNNEL_PROVIDER, { key });
+      return data.tunnelProvider;
+    }
+  );
+  tool(
+    "tunnels_shards",
+    "List Tunnel Shards",
+    "List tunnel server shards (frps instances), optionally filtered by environment.",
+    { environment: tunnelEnvironment.optional() },
+    async ({ environment }) => {
+      const data = await w.request(LIST_TUNNEL_SHARDS, {
+        environment
+      });
+      return data.tunnelShards;
+    }
+  );
+  tool(
+    "tunnels_usage",
+    "Tunnel Usage",
+    "Hourly usage buckets for a tunnel in a time range.",
+    {
+      tunnelId: z.string(),
+      from: z.string().describe("ISO8601 start"),
+      to: z.string().describe("ISO8601 end")
+    },
+    async ({ tunnelId, from, to }) => {
+      const data = await w.request(TUNNEL_USAGE, {
+        tunnelId,
+        from,
+        to
+      });
+      return data.tunnelUsage;
+    }
+  );
+  tool(
+    "tunnels_audit",
+    "Tunnel Audit",
+    "Audit log entries scoped to a tunnel.",
+    {
+      tunnelId: z.string(),
+      limit: z.number().optional(),
+      offset: z.number().optional()
+    },
+    async ({ tunnelId, limit, offset }) => {
+      const pagination = {};
+      if (limit !== void 0) pagination.limit = limit;
+      if (offset !== void 0) pagination.offset = offset;
+      const data = await w.request(TUNNEL_AUDIT, {
+        tunnelId,
+        pagination: Object.keys(pagination).length ? pagination : void 0
+      });
+      return data.tunnelAudit;
+    }
+  );
+  tool(
+    "tunnels_list_domains",
+    "List Tunnel Domains",
+    "List tunnel domains, optionally scoped to a single tunnel.",
+    {
+      tunnelId: z.string().optional(),
+      type: z.enum(["CUSTOM", "MANAGED_SUBDOMAIN"]).optional(),
+      verificationStatus: z.enum(["EXPIRED", "FAILED", "PENDING", "VERIFIED", "VERIFYING"]).optional(),
+      environment: tunnelEnvironment.optional(),
+      search: z.string().optional(),
+      limit: z.number().optional(),
+      offset: z.number().optional()
+    },
+    async ({ tunnelId, type, verificationStatus, environment, search, limit, offset }) => {
+      const filter = {};
+      if (type !== void 0) filter.type = type;
+      if (verificationStatus !== void 0) filter.verificationStatus = verificationStatus;
+      if (environment !== void 0) filter.environment = environment;
+      if (search !== void 0) filter.search = search;
+      const pagination = {};
+      if (limit !== void 0) pagination.limit = limit;
+      if (offset !== void 0) pagination.offset = offset;
+      const data = await w.request(LIST_TUNNEL_DOMAINS, {
+        tunnelId,
+        filter: Object.keys(filter).length ? filter : void 0,
+        pagination: Object.keys(pagination).length ? pagination : void 0
+      });
+      return data.tunnelDomains;
+    }
+  );
+  tool(
+    "tunnels_get_domain",
+    "Get Tunnel Domain",
+    "Get a tunnel domain by ID.",
+    { id: z.string() },
+    async ({ id }) => {
+      const data = await w.request(GET_TUNNEL_DOMAIN, { id });
+      return data.tunnelDomain;
+    }
+  );
+  tool(
+    "tunnels_reserve_subdomain",
+    "Reserve Tunnel Subdomain",
+    "Reserve a managed subdomain under *.vibetunnels.com.",
+    {
+      label: z.string().describe("Subdomain label (without zone suffix)"),
+      environment: tunnelEnvironment
+    },
+    async ({ label, environment }) => {
+      const data = await w.request(RESERVE_TUNNEL_SUBDOMAIN, {
+        input: { label, environment }
+      });
+      return data.reserveTunnelSubdomain;
+    }
+  );
+  tool(
+    "tunnels_register_custom_domain",
+    "Register Custom Tunnel Domain",
+    "Register a user-owned custom domain. A TXT challenge record will be returned for verification.",
+    { hostname: z.string() },
+    async ({ hostname }) => {
+      const data = await w.request(
+        REGISTER_CUSTOM_TUNNEL_DOMAIN,
+        { input: { hostname } }
+      );
+      return data.registerCustomTunnelDomain;
+    }
+  );
+  tool(
+    "tunnels_verify_domain",
+    "Verify Tunnel Domain",
+    "Force a verification check for a custom domain.",
+    { domainId: z.string() },
+    async ({ domainId }) => {
+      const data = await w.request(VERIFY_TUNNEL_DOMAIN, {
+        domainId
+      });
+      return data.verifyTunnelDomain;
+    }
+  );
+  tool(
+    "tunnels_attach_domain",
+    "Attach Tunnel Domain",
+    "Attach a verified domain to a tunnel.",
+    {
+      tunnelId: z.string(),
+      domainId: z.string(),
+      makePrimary: z.boolean().optional()
+    },
+    async ({ tunnelId, domainId, makePrimary }) => {
+      const data = await w.request(ATTACH_TUNNEL_DOMAIN, {
+        tunnelId,
+        domainId,
+        makePrimary
+      });
+      return data.attachTunnelDomain;
+    }
+  );
+  tool(
+    "tunnels_detach_domain",
+    "Detach Tunnel Domain",
+    "Detach a domain from a tunnel. The domain record remains for re-use.",
+    { tunnelId: z.string(), domainId: z.string() },
+    async ({ tunnelId, domainId }) => {
+      const data = await w.request(DETACH_TUNNEL_DOMAIN, {
+        tunnelId,
+        domainId
+      });
+      return data.detachTunnelDomain;
+    }
+  );
+  tool(
+    "tunnels_delete_domain",
+    "Delete Tunnel Domain",
+    "Permanently delete a tunnel domain record.",
+    { domainId: z.string() },
+    async ({ domainId }) => {
+      const data = await w.request(DELETE_TUNNEL_DOMAIN, {
+        domainId
+      });
+      return { deleted: data.deleteTunnelDomain, domainId };
+    }
+  );
+  tool(
+    "tunnels_probe_agent",
+    "Probe Agent Tunnel",
+    "Probe an agent tunnel URL for health and identity.",
+    { url: z.string(), agentApiKey: z.string().optional() },
+    async ({ url, agentApiKey }) => {
+      const data = await w.request(PROBE_AGENT_TUNNEL, {
+        url,
+        agentApiKey
+      });
+      return data.probeAgentTunnel;
+    }
+  );
+  tool(
+    "tunnels_add_agent_from_tunnel",
+    "Add Agent From Tunnel",
+    "Zero-config agent onboarding: probe a tunnel URL + API key, register + configure the agent in one shot.",
+    {
+      tunnelUrl: z.string(),
+      apiKey: z.string(),
+      name: z.string().optional(),
+      scopes: z.array(z.string()).optional(),
+      targetId: z.string().optional(),
+      skipDevportalApp: z.boolean().optional()
+    },
+    async (args) => {
+      const data = await w.request(
+        ADD_AGENT_FROM_TUNNEL,
+        { input: args }
+      );
+      return data.addVibecontrolsAgentFromTunnel;
+    }
+  );
+  tool(
+    "tunnels_check",
+    "Check Tunnel (poll for updates)",
+    "Poll a tunnel by ID. Use this in place of the GraphQL `tunnelUpdated` subscription which has no MCP equivalent \u2014 call repeatedly with a delay.",
+    { id: z.string() },
+    async ({ id }) => {
+      const data = await w.request(GET_TUNNEL, { id });
+      return { polledAt: (/* @__PURE__ */ new Date()).toISOString(), tunnel: data.tunnel };
     }
   );
 }
@@ -4526,6 +7539,10 @@ var vibecontrolsModule = {
     registerSessionTools(server, ctx, trackTool);
     registerNoteTools(server, ctx, trackTool);
     registerConfigurationTools(server, ctx, trackTool);
+    registerConfigSecurityTools(server, ctx, trackTool);
+    registerConfigCITools(server, ctx, trackTool);
+    registerConfigGitopsTools(server, ctx, trackTool);
+    registerConfigSettingsTools(server, ctx, trackTool);
     registerWebhookTools(server, ctx, trackTool);
     registerTunnelTools(server, ctx, trackTool);
     registerUISessionTools(server, ctx, trackTool);
@@ -4536,7 +7553,13 @@ var vibecontrolsModule = {
     registerSessionSharingTools(server, ctx, trackTool);
     registerAuditTools(server, ctx, trackTool);
     registerActionTools(server, ctx, trackTool);
+    registerAiPromptTools(server, ctx, trackTool);
+    registerVibeDeckShareLinkTools(server, ctx, trackTool);
     registerAnalyticsTools(server, ctx, trackTool);
+    registerCatalogTools(server, ctx, trackTool);
+    registerComponentTools(server, ctx, trackTool);
+    registerTemplateTools(server, ctx, trackTool);
+    registerScorecardTools(server, ctx, trackTool);
     registerVibecontrolsResources(server, ctx, trackResource);
     registerVibecontrolsPrompts(server, ctx, trackPrompt);
     return { tools, resources, prompts };