@canonry/canonry 7.32.0 → 7.43.2

package/dist/chunk-HGMYEDAQ.js

@@ -0,0 +1,79 @@
+// src/support-links.ts
+var CANONRY_DISCORD_URL = "https://discord.gg/jnJ2H2z5Xh";
+var CANONRY_ISSUES_URL = "https://github.com/Canonry/canonry/issues";
+
+// src/cli-error.ts
+function isMachineFormat(format) {
+  return format === "json" || format === "jsonl";
+}
+var EXIT_USER_ERROR = 1;
+var EXIT_SYSTEM_ERROR = 2;
+var CliError = class extends Error {
+  code;
+  displayMessage;
+  details;
+  exitCode;
+  constructor(options) {
+    super(options.message);
+    this.name = "CliError";
+    this.code = options.code;
+    this.displayMessage = options.displayMessage;
+    this.details = options.details;
+    this.exitCode = options.exitCode ?? EXIT_USER_ERROR;
+  }
+};
+function usageError(displayMessage, options) {
+  const firstLine = displayMessage.split("\n", 1)[0] ?? "Error: invalid command usage";
+  return new CliError({
+    code: "CLI_USAGE_ERROR",
+    message: options?.message ?? firstLine.replace(/^Error:\s*/, ""),
+    displayMessage,
+    details: options?.details
+  });
+}
+function isEndpointMissing(err) {
+  if (!(err instanceof CliError)) return false;
+  const status = err.details?.httpStatus;
+  return status === 404 || status === 405;
+}
+function systemError(message, options) {
+  return new CliError({
+    code: "CLI_SYSTEM_ERROR",
+    message,
+    displayMessage: options?.displayMessage,
+    details: options?.details,
+    exitCode: EXIT_SYSTEM_ERROR
+  });
+}
+function printCliError(err, format) {
+  if (isMachineFormat(format)) {
+    const envelope = err instanceof CliError ? { error: { code: err.code, message: err.message, ...err.details ? { details: err.details } : {} } } : { error: { code: "CLI_ERROR", message: err instanceof Error ? err.message : "An unexpected error occurred" } };
+    console.error(JSON.stringify(envelope, null, format === "jsonl" ? 0 : 2));
+    return;
+  }
+  if (err instanceof CliError && err.displayMessage) {
+    console.error(err.displayMessage);
+  } else if (err instanceof Error) {
+    console.error(`Error: ${err.message}`);
+  } else {
+    console.error("An unexpected error occurred");
+  }
+  const unexpected = !(err instanceof CliError) || err.exitCode === EXIT_SYSTEM_ERROR;
+  if (unexpected && process.stderr.isTTY) {
+    console.error(`
+Need help? Run 'canonry support' or ask in the Canonry Discord: ${CANONRY_DISCORD_URL}`);
+  }
+}
+
+export {
+  CANONRY_DISCORD_URL,
+  CANONRY_ISSUES_URL,
+  isMachineFormat,
+  EXIT_USER_ERROR,
+  EXIT_SYSTEM_ERROR,
+  CliError,
+  usageError,
+  isEndpointMissing,
+  systemError,
+  printCliError
+};

package/dist/{chunk-QFXD7GR5.js → chunk-KOIOZ7QW.js}

@@ -1,11 +1,14 @@
+import {
+  PACKAGE_VERSION,
+  canonryMcpTools,
+  toolOperationAccess
+} from "./chunk-LYKDNJXR.js";
 import {
   CliError,
   EXIT_SYSTEM_ERROR,
   EXIT_USER_ERROR,
-  PACKAGE_VERSION,
-  canonryMcpTools,
   isMachineFormat
-} from "./chunk-ZIETXJYU.js";
+} from "./chunk-HGMYEDAQ.js";
 import {
   AGENT_PROVIDER_IDS,
   CANONRY_NPM_PACKAGE_URL,
@@ -13,8 +16,11 @@ import {
   DEFAULT_VIEWER_RESEARCH_DAILY_RUN_LIMIT,
   OPERATIONAL_LOG_FIELDS_HEADER,
   OPERATIONAL_LOG_OPT_IN_CONTEXT_FIELDS,
+  OPERATION_ACCESS_HEADER,
+  OperationAccesses,
   RESEARCH_RUN_SCOPE,
   SKILL_MANIFEST_FILENAME,
+  STORED_ONLY_HEADER,
   SkillsClients,
   USAGE_TELEMETRY_HEADERS,
   agentPluginClientLabel,
@@ -31,8 +37,10 @@ import {
   isRetiredAgentProviderId,
   isSensitiveDiagnosticQueryKey,
   isStrictSemver,
+  matchOperationTemplate,
   normalizeAgentSlug,
   normalizeTelemetryStatus,
+  operationAccess,
   operationalLogListReadSchema,
   providerBatchConfigSchema,
   providerPricingSchema,
@@ -49,7 +57,7 @@ import {
   skillsClientSchema,
   upgradeCaveatFor,
   upgradeCommandFor
-} from "./chunk-42XUY243.js";
+} from "./chunk-E43JM3QV.js";
 
 // src/config.ts
 import fs from "fs";
@@ -1505,6 +1513,22 @@ var getApiV1ProjectsByName = (options) => {
     ...options
   });
 };
+var patchApiV1ProjectsByName = (options) => {
+  return (options.client ?? client).patch({
+    security: [
+      {
+        scheme: "bearer",
+        type: "http"
+      }
+    ],
+    url: "/api/v1/projects/{name}",
+    ...options,
+    headers: {
+      "Content-Type": "application/json",
+      ...options.headers
+    }
+  });
+};
 var putApiV1ProjectsByName = (options) => {
   return (options.client ?? client).put({
     security: [
@@ -2949,6 +2973,34 @@ var getApiV1ProjectsByNameAnalyticsCompetitors = (options) => {
     ...options
   });
 };
+var getApiV1ProjectsByNameCompetitorSuggestions = (options) => {
+  return (options.client ?? client).get({
+    security: [
+      {
+        scheme: "bearer",
+        type: "http"
+      }
+    ],
+    url: "/api/v1/projects/{name}/competitor-suggestions",
+    ...options
+  });
+};
+var postApiV1ProjectsByNameCompetitorChangesPreview = (options) => {
+  return (options.client ?? client).post({
+    security: [
+      {
+        scheme: "bearer",
+        type: "http"
+      }
+    ],
+    url: "/api/v1/projects/{name}/competitor-changes/preview",
+    ...options,
+    headers: {
+      "Content-Type": "application/json",
+      ...options.headers
+    }
+  });
+};
 var getApiV1ProjectsByNameRuns = (options) => {
   return (options.client ?? client).get({
     security: [
@@ -3057,6 +3109,22 @@ var postApiV1Apply = (options) => {
     }
   });
 };
+var postApiV1ApplyPreview = (options) => {
+  return (options.client ?? client).post({
+    security: [
+      {
+        scheme: "bearer",
+        type: "http"
+      }
+    ],
+    url: "/api/v1/apply/preview",
+    ...options,
+    headers: {
+      "Content-Type": "application/json",
+      ...options.headers
+    }
+  });
+};
 var getApiV1ProjectsByNameHistory = (options) => {
   return (options.client ?? client).get({
     security: [
@@ -5245,6 +5313,18 @@ var getApiV1ProjectsByNameGaProperties = (options) => {
     ...options
   });
 };
+var getApiV1ProjectsByNameGaAcquisition = (options) => {
+  return (options.client ?? client).get({
+    security: [
+      {
+        scheme: "bearer",
+        type: "http"
+      }
+    ],
+    url: "/api/v1/projects/{name}/ga/acquisition",
+    ...options
+  });
+};
 var getApiV1ProjectsByNameGaMeasurementAnalysis = (options) => {
   return (options.client ?? client).get({
     security: [
@@ -5629,6 +5709,18 @@ var getApiV1Doctor = (options) => {
     ...options
   });
 };
+var getApiV1Status = (options) => {
+  return (options?.client ?? client).get({
+    security: [
+      {
+        scheme: "bearer",
+        type: "http"
+      }
+    ],
+    url: "/api/v1/status",
+    ...options
+  });
+};
 var getApiV1ProjectsByNameDoctor = (options) => {
   return (options.client ?? client).get({
     security: [
@@ -5977,6 +6069,18 @@ var getApiV1ProjectsByNameTrafficReferralAssessment = (options) => {
     ...options
   });
 };
+var getApiV1ProjectsByNameTrafficSamples = (options) => {
+  return (options.client ?? client).get({
+    security: [
+      {
+        scheme: "bearer",
+        type: "http"
+      }
+    ],
+    url: "/api/v1/projects/{name}/traffic/samples",
+    ...options
+  });
+};
 var getApiV1ProjectsByNameTrafficEvents = (options) => {
   return (options.client ?? client).get({
     security: [
@@ -6477,6 +6581,30 @@ function runWithUsageTags(client2, tags, fn) {
   if (!(client2 instanceof ApiClient)) return fn();
   return usageTagStore.run(tags, fn);
 }
+function classifyStoredOnlyRequest(method, url) {
+  const operation = matchOperationTemplate(method, url);
+  const separator = operation.indexOf(" ");
+  return {
+    operation,
+    access: operationAccess(operation.slice(0, separator), operation.slice(separator + 1), OperationAccesses.live)
+  };
+}
+function storedOnlyRequestHeaders(method, url) {
+  if (!["1", "true"].includes((process.env.CANONRY_STORED_ONLY ?? "").toLowerCase())) return {};
+  const { operation, access } = classifyStoredOnlyRequest(method, url);
+  if (access !== OperationAccesses.stored) {
+    throw new CliError({
+      code: "STORED_ONLY_REFUSED",
+      message: `Stored-only mode refuses ${access} operation ${operation}`,
+      details: { operation, access },
+      exitCode: EXIT_USER_ERROR
+    });
+  }
+  return { [STORED_ONLY_HEADER]: "1" };
+}
+function storedOnlyProbeHeaders() {
+  return ["1", "true"].includes((process.env.CANONRY_STORED_ONLY ?? "").toLowerCase()) ? { [STORED_ONLY_HEADER]: "1" } : {};
+}
 var SAFE_CLIENT_NAME = /^\w[\w./-]{0,127}$/;
 var SAFE_ACTOR_SESSION = /^\w[\w.:-]{0,127}$/;
 function safeClientName(value) {
@@ -6548,6 +6676,7 @@ var ApiClient = class {
     };
     this.heyClient = createClient2({ baseUrl: this.originUrl, apiKey: this.apiKey, headers: this.requestHeaders });
     this.heyClient.interceptors.request.use((request) => {
+      for (const [key, value] of Object.entries(storedOnlyRequestHeaders(request.method, request.url.toString()))) request.headers.set(key, value);
       const tags = usageTagStore.getStore();
       if (tags?.mcpTool) request.headers.set(USAGE_TELEMETRY_HEADERS.mcpTool, tags.mcpTool);
       if (tags?.mcpCall) request.headers.set(USAGE_TELEMETRY_HEADERS.mcpCall, tags.mcpCall);
@@ -6569,6 +6698,7 @@ var ApiClient = class {
         try {
           const origin = new URL(this.originUrl).origin;
           const res = await fetch(`${origin}/health`, {
+            headers: storedOnlyProbeHeaders(),
             signal: AbortSignal.timeout(2e3)
           });
           if (res.ok) {
@@ -6626,7 +6756,7 @@ var ApiClient = class {
     if (traceEnabled) {
       const durMs = Date.now() - traceStart;
       process.stderr.write(
-        `[trace] ${result.request.method} ${redactRequestTarget(result.request.url)} \u2192 ${result.response.status} (${durMs}ms)
+        `[trace] ${result.request.method} ${redactRequestTarget(result.request.url)} \u2192 ${result.response.status} (${durMs}ms) access=${result.response.headers.get(OPERATION_ACCESS_HEADER) ?? "unknown"}
 `
       );
     }
@@ -6729,10 +6859,13 @@ var ApiClient = class {
    * and releases the response when done.
    */
   async streamPost(path3, body, signal) {
+    const candidateUrl = `${this.originUrl}/api/v1${path3}`;
+    const storedOnlyHeaders = storedOnlyRequestHeaders("POST", candidateUrl);
     await this.probeBasePath();
     const url = `${this.originUrl}/api/v1${path3}`;
     const headers = {
       ...this.requestHeaders,
+      ...storedOnlyHeaders,
       "Content-Type": "application/json",
       Accept: "text/event-stream"
     };
@@ -6772,6 +6905,11 @@ var ApiClient = class {
       () => putApiV1ProjectsByName({ client: this.heyClient, path: { name }, body })
     );
   }
+  async patchProject(name, body) {
+    return this.invoke(
+      () => patchApiV1ProjectsByName({ client: this.heyClient, path: { name }, body })
+    );
+  }
   async listProjects() {
     return this.invoke(() => getApiV1Projects({ client: this.heyClient }));
   }
@@ -6786,19 +6924,26 @@ var ApiClient = class {
       () => getApiV1ProjectsByNameDeletePreview({ client: this.heyClient, path: { name } })
     );
   }
-  async getStatus(project) {
+  async getStatus(opts) {
     return this.invoke(
-      () => getApiV1ProjectsByName({ client: this.heyClient, path: { name: project } })
+      () => getApiV1Status({ client: this.heyClient, query: { project: opts?.project, problems: opts?.problems } })
     );
   }
-  async getExport(project) {
+  async getExport(project, opts) {
     return this.invoke(
-      () => getApiV1ProjectsByNameExport({ client: this.heyClient, path: { name: project } })
+      () => getApiV1ProjectsByNameExport({
+        client: this.heyClient,
+        path: { name: project },
+        query: { includeSecrets: opts?.includeSecrets }
+      })
     );
   }
   async apply(config) {
     return this.invoke(() => postApiV1Apply({ client: this.heyClient, body: config }));
   }
+  async previewApply(config) {
+    return this.invoke(() => postApiV1ApplyPreview({ client: this.heyClient, body: config }));
+  }
   async getProjectOverview(project, opts) {
     return this.invoke(
       () => getApiV1ProjectsByNameOverview({
@@ -6834,10 +6979,11 @@ var ApiClient = class {
     if (opts.until) params.set("until", opts.until);
     if (opts.includeProbes) params.set("includeProbes", "true");
     const url = `${this.originUrl}/api/v1/projects/${encodeURIComponent(project)}/results/export?${params.toString()}`;
+    const storedOnlyHeaders = storedOnlyRequestHeaders("GET", url);
     let res;
     try {
       res = await fetch(url, {
-        headers: { ...this.requestHeaders }
+        headers: { ...this.requestHeaders, ...storedOnlyHeaders }
       });
     } catch (err) {
       const message = describeError(err);
@@ -6941,13 +7087,27 @@ var ApiClient = class {
       () => getApiV1ProjectsByNameCompetitors({ client: this.heyClient, path: { name: project } })
     );
   }
+  async suggestCompetitors(project, query = {}) {
+    return this.invoke(
+      () => getApiV1ProjectsByNameCompetitorSuggestions({
+        client: this.heyClient,
+        path: { name: project },
+        query
+      })
+    );
+  }
+  async previewCompetitorChange(project, request) {
+    return this.invoke(
+      () => postApiV1ProjectsByNameCompetitorChangesPreview({ client: this.heyClient, path: { name: project }, body: request })
+    );
+  }
   /** Each entry is a domain or `{ domain, aliases }`; stated aliases are added to that competitor's list. */
-  async appendCompetitors(project, competitors) {
+  async appendCompetitors(project, competitors, options) {
     return this.invoke(
       () => postApiV1ProjectsByNameCompetitors({
         client: this.heyClient,
         path: { name: project },
-        body: { competitors }
+        body: { competitors, ...options?.acknowledgeBulkAdd !== void 0 ? { acknowledgeBulkAdd: options.acknowledgeBulkAdd } : {} }
       })
     );
   }
@@ -7519,13 +7679,13 @@ var ApiClient = class {
       })
     );
   }
-  async listRuns(project, limit, kind, status, excludeKind, excludeKinds) {
+  async listRuns(project, limit, kind, status, excludeKind, excludeKinds, since) {
     return this.invoke(
       () => getApiV1ProjectsByNameRuns({
         client: this.heyClient,
         path: { name: project },
         // Filters arrive as free CLI strings; the server validates them against the enums.
-        query: { limit, kind, status, excludeKind, excludeKinds }
+        query: { limit, kind, status, excludeKind, excludeKinds, since }
       })
     );
   }
@@ -7641,6 +7801,7 @@ var ApiClient = class {
    * never run the CLI about a newer release.
    */
   async getServerUpdateAvailable() {
+    if (storedOnlyProbeHeaders()[STORED_ONLY_HEADER]) return null;
     try {
       await this.probeBasePath();
       const res = await fetch(`${this.originUrl}/health`, { signal: AbortSignal.timeout(2e3) });
@@ -8653,6 +8814,9 @@ var ApiClient = class {
       () => getApiV1ProjectsByNameGaProperties({ client: this.heyClient, path: { name: project } })
     );
   }
+  async gaAcquisition(project, query) {
+    return this.invoke(() => getApiV1ProjectsByNameGaAcquisition({ client: this.heyClient, path: { name: project }, query }));
+  }
   async gaMeasurementAnalysis(project, params) {
     return this.invoke(
       () => getApiV1ProjectsByNameGaMeasurementAnalysis({
@@ -8852,6 +9016,9 @@ var ApiClient = class {
       query
     }));
   }
+  async trafficListSamples(project, query) {
+    return this.invoke(() => getApiV1ProjectsByNameTrafficSamples({ client: this.heyClient, path: { name: project }, query }));
+  }
   async trafficListEvents(project, params) {
     return this.invoke(
       () => getApiV1ProjectsByNameTrafficEvents({
@@ -9884,6 +10051,7 @@ var DynamicToolCatalog = class {
       eager: this.eager,
       loadedToolkits: [...this.loaded].sort(),
       coreTools: this.entries.filter((entry) => entry.tool.tier === "core").map((entry) => entry.tool.name),
+      liveTools: this.entries.filter((entry) => entry.tool.tier === "core" && toolOperationAccess(entry.tool) === OperationAccesses.live).map((entry) => entry.tool.name),
       toolkits: CANONRY_MCP_TOOLKITS.map((toolkit) => this.toolkitEntry(toolkit)).filter((entry) => entry.toolCount > 0),
       usage: this.eager ? "All tools available on this connection are already loaded. Use their listed schemas; tool visibility does not grant server permissions." : "Call canonry_load_toolkit with one of the toolkit names listed in `toolkits[].name` to register its tools for the rest of this session. Wait for its response before calling any newly enabled tool."
     };
@@ -9897,6 +10065,7 @@ var DynamicToolCatalog = class {
       whenToLoad: toolkit.whenToLoad,
       toolCount: tools.length,
       tools,
+      liveTools: this.entries.filter((entry) => entry.tool.tier === toolkit.name && toolOperationAccess(entry.tool) === OperationAccesses.live).map((entry) => entry.tool.name),
       loaded: this.loaded.has(toolkit.name)
     };
   }
@@ -9929,7 +10098,7 @@ var OPERATIONS_GUIDE = {
   "guideVersion": "v1",
   "operationsGuideUrl": "https://github.com/Canonry/canonry/blob/main/docs/agent-operations/v1.md",
   "resourceUri": "canonry://agent-operations/v1",
-  "initialize": 'Canonry tracks how AI answer engines mention brands and cite domains.\nStart with canonry_help({intent:"status"}), or name your intended workflow. It returns a small route of currently available tools and approval boundaries. Follow its stored-evidence reads before proposing action. No skill, resource reader, plugin installation, or local CLI is required for connected MCP clients. A host-native Canonry skill, if installed, is optional additional guidance.\nmentioned = brand in answer TEXT; cited = domain in SOURCE links. Never compute one from the other. A null answerMentioned means not checked, not false. No recorded sweep means no measured figure.\nGet explicit approval for live provider reads, sweeps, probes, research, syncs, and writes, bounded to the target and requested work. A readOnlyHint or GET is not proof of a free operation. Live ads reads include canonry_ads_account, canonry_ads_geo_search, canonry_ads_live_delivery, canonry_ads_conversion_pixels, canonry_ads_conversion_event_settings. Google live reads/syncs include canonry_google_ads_customers, canonry_gtm_accounts, canonry_gtm_containers, canonry_gtm_workspaces, canonry_google_ads_sync, canonry_gtm_sync.\nHelp and skills grant no permissions. The server enforces authority. On missing tools or 403, report the boundary; do not switch credentials or endpoints to bypass it. Hosted catalogs are fixed; only use canonry_load_toolkit when help explicitly offers it.\nIf you uncover a Canonry struggle (failure, confusing output, workaround) or a concrete improvement, tell the user and send it once with canonry_feedback. No secrets or customer data.\n',
+  "initialize": 'Canonry tracks how AI answer engines mention brands and cite domains. Start with canonry_help({intent:"status"}) or a workflow; follow its stored reads and approval boundaries. Connected MCP clients need no skill, resource, plugin, or local CLI. The Canonry skill offers optional additional guidance.\nmentioned = brand in answer TEXT; cited = domain in SOURCE links. Never compute one from the other. A null answerMentioned means not checked, not false. No recorded sweep means no measured figure.\nGet approval for live provider reads, sweeps, probes, research, syncs and writes, scoped to the exact target, action and work. A GET or readOnlyHint does not mean free. canonry_help returns all liveTools for this connection; each needs approval, including read-only tools.\nREST exposes x-canonry-access; CLI help/catalog expose access; MCP help lists liveTools.\nStored-only: CLI --stored-only or CANONRY_STORED_ONLY=1; MCP --stored-only, --scope=stored-only or CANONRY_MCP_SCOPE=stored-only. It refuses live/write work (including doctor) before execution and suppresses housekeeping. CLI refusal is STORED_ONLY_REFUSED. Explicit exports may write files; server accounting remains separate from business mutations.\nHelp and skills grant no permissions; the server enforces authority. Report missing tools or 403; never bypass them with other credentials or endpoints. Hosted catalogs are fixed; use canonry_load_toolkit only when help offers it.\nReport concrete Canonry failures, confusing output, workarounds or improvements to the user and once via canonry_feedback. Exclude secrets and customer data.\n',
   "approvalBoundary": [
     "provider reads",
     "sweeps",
@@ -9962,10 +10131,11 @@ var OPERATIONS_GUIDE = {
         "health"
       ],
       "next": [
+        "canonry_status",
         "canonry_projects_list",
         "canonry_project_overview"
       ],
-      "guidance": "Select an accessible project, then read its stored overview. Report freshness and missing evidence; do not start a sweep to fill a gap."
+      "guidance": "Read canonry_status first for stored integration health, freshness, and repeated failures across accessible projects, then inspect a project overview for detail. Report missing evidence; do not start a sweep or sync to fill a gap."
     },
     "diagnose": {
       "keywords": [
@@ -10030,12 +10200,13 @@ var OPERATIONS_GUIDE = {
         "gtm"
       ],
       "next": [
+        "canonry_status",
         "canonry_projects_list",
         "canonry_project_get",
         "canonry_ga_status",
         "canonry_google_ads_status"
       ],
-      "guidance": "Inspect stored connection status and snapshot freshness. Use the currently listed specialist tools for stored evidence. Connecting, selecting resources, syncing, and live provider reads require scoped approval; never request credentials in chat."
+      "guidance": "Read canonry_status first for the stored instance or project health view, then use specialist tools for detail. Connecting, selecting resources, syncing, and live provider reads require scoped approval; never request credentials in chat."
     },
     "reports": {
       "keywords": [
@@ -10071,6 +10242,8 @@ function operationsHelp(catalog, mode, intent = "", includeCatalog = false) {
   }
   const wanted = [...reads, ...requestedActions];
   const loadToolkits = mode === "stdio-progressive" ? catalog.toolkits.filter((t) => !t.loaded && t.tools.some((name) => wanted.includes(name))).map((t) => t.name) : [];
+  const liveTools = [...catalog.liveTools];
+  for (const toolkit of catalog.toolkits) liveTools.push(...toolkit.liveTools);
   return {
     guideVersion: OPERATIONS_GUIDE.guideVersion,
     mode,
@@ -10085,7 +10258,8 @@ function operationsHelp(catalog, mode, intent = "", includeCatalog = false) {
     authority: OPERATIONS_GUIDE.authority,
     operationsGuideUrl: OPERATIONS_GUIDE.operationsGuideUrl,
     ...loadToolkits.length ? { loadToolkits } : {},
-    ...includeCatalog ? catalog : {}
+    ...includeCatalog ? catalog : {},
+    liveTools: [...new Set(liveTools)].sort()
   };
 }
 
@@ -10209,7 +10383,7 @@ function getCanonryMcpTools(scope = "all", tiers, credentialScopes, operator = f
   const readOnly = scope === "read-only" || credentialScopes !== void 0 && isReadOnlyKey(credentialScopes);
   const restricted = credentialScopes && restrictedWriteScopes(credentialScopes);
   const authorized = canonryMcpTools.filter((tool) => !tool.requiresOperator || operator);
-  const byScope = readOnly ? authorized.filter((tool) => tool.access === "read") : authorized.filter((tool) => {
+  const byScope = scope === "stored-only" ? authorized.filter((tool) => toolOperationAccess(tool) === OperationAccesses.stored) : readOnly ? authorized.filter((tool) => tool.access === "read") : authorized.filter((tool) => {
     if (!restricted || tool.access === "read") return true;
     if (tool.requiredScope && restricted.includes(tool.requiredScope)) return true;
     return restricted.some((grant) => grant !== RESEARCH_RUN_SCOPE) && tool.tier === "ads";