@canonry/canonry 7.72.2 → 7.74.0

package/dist/{chunk-JO73L677.js → chunk-6ATKY252.js}

@@ -1,6 +1,6 @@
 import {
   parseJsonColumn
-} from "./chunk-O7WOCTBD.js";
+} from "./chunk-PAIYFNNY.js";
 import {
   AI_ENGINE_DOMAINS,
   AI_ENGINE_SELF_DOMAINS,
@@ -26,7 +26,7 @@ import {
   retryAfterDelayMs,
   usageCount,
   withRetry
-} from "./chunk-YXAKL5HM.js";
+} from "./chunk-SF5JLMLG.js";
 
 // ../provider-openai/src/normalize.ts
 import OpenAI from "openai";

package/dist/{chunk-XR6ZVMYK.js → chunk-6W5AR4IW.js}

@@ -28,7 +28,7 @@ import {
   unknownUsageObservation,
   usdToMicros,
   withRetry
-} from "./chunk-YXAKL5HM.js";
+} from "./chunk-SF5JLMLG.js";
 
 // ../provider-answer-services/src/core/http.ts
 var MAX_RESPONSE_BYTES = 8 * 1024 * 1024;

package/dist/{chunk-IZMT4WLZ.js → chunk-6YW24AUN.js}

@@ -5,7 +5,7 @@ import {
   siteCrawlGraphNodes,
   siteCrawlPages,
   siteCrawlSnapshots
-} from "./chunk-O7WOCTBD.js";
+} from "./chunk-PAIYFNNY.js";
 import {
   SITE_CRAWL_GRAPH_MAX_EDGES,
   SITE_CRAWL_GRAPH_MAX_NODES,
@@ -15,7 +15,7 @@ import {
   factorStatusFromDistribution,
   factorStatusFromScore,
   roundPreservingTotal
-} from "./chunk-YXAKL5HM.js";
+} from "./chunk-SF5JLMLG.js";
 
 // src/site-audit-factors.ts
 function recordedSharePct(factor) {

package/dist/{chunk-QKDKVPMR.js → chunk-AJMDETJA.js}

@@ -1,10 +1,10 @@
 import {
   registeredProviderNames
-} from "./chunk-6MYHGP46.js";
+} from "./chunk-DLVGMRM5.js";
 import {
   configExists,
   loadConfigRaw
-} from "./chunk-JE5QURTR.js";
+} from "./chunk-NXFNXXYM.js";
 
 // src/setup-state.ts
 import fs from "fs";
@@ -28,7 +28,7 @@ async function buildSetupState() {
   }
   if (dbPath && fs.existsSync(dbPath)) {
     try {
-      const { createClient, projects, queries: queriesTable } = await import("./src-BXXGJOQB.js");
+      const { createClient, projects, queries: queriesTable } = await import("./src-52USCS7O.js");
       const db = createClient(dbPath);
       project_count = db.select({ id: projects.id }).from(projects).all().length;
       const firstQuery = db.select({ id: queriesTable.id }).from(queriesTable).limit(1).all();
@@ -47,7 +47,7 @@ function queueServeHandoff() {
 async function runPendingServeHandoff(format) {
   if (!pendingServeHandoff) return;
   pendingServeHandoff = false;
-  const { serveCommand } = await import("./serve-SJTQQQQE.js");
+  const { serveCommand } = await import("./serve-BPM2P3GY.js");
   await serveCommand(format);
 }
 

package/dist/{chunk-HZSE3WSG.js → chunk-AZQNJX3T.js}

@@ -1,11 +1,11 @@
 import {
   getRequestContext
-} from "./chunk-BADJCT6U.js";
+} from "./chunk-GWDMWKM6.js";
 import {
   diagnosticIdentity,
   redactLogString,
   redactLogValue
-} from "./chunk-YXAKL5HM.js";
+} from "./chunk-SF5JLMLG.js";
 
 // ../api-routes/src/runtime-logger.ts
 import { format } from "util";

package/dist/{chunk-ATT3ZCSS.js → chunk-BICUWFV4.js}

@@ -1,6 +1,6 @@
 import {
   loadConfig
-} from "./chunk-JE5QURTR.js";
+} from "./chunk-NXFNXXYM.js";
 import {
   PACKAGE_VERSION
 } from "./chunk-AOJU5LKX.js";
@@ -36,7 +36,7 @@ import {
   sentimentSettingsReadSchema,
   sentimentSummaryReadSchema,
   upgradeCommandFor
-} from "./chunk-YXAKL5HM.js";
+} from "./chunk-SF5JLMLG.js";
 
 // ../api-client-generated/src/generated/core/bodySerializer.gen.ts
 var jsonBodySerializer = {
@@ -3035,6 +3035,11 @@ var getApiV1Doctor = (options) => (options?.client ?? client).get({
   url: "/api/v1/doctor",
   ...options
 });
+var getApiV1McpProfile = (options) => (options?.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/api/v1/mcp/profile",
+  ...options
+});
 var getApiV1Status = (options) => (options?.client ?? client).get({
   security: [{ scheme: "bearer", type: "http" }],
   url: "/api/v1/status",
@@ -3522,8 +3527,8 @@ function classifyStoredOnlyRequest(method, url) {
     access: operationAccess(operation.slice(0, separator), operation.slice(separator + 1), OperationAccesses.live)
   };
 }
-function storedOnlyRequestHeaders(method, url) {
-  if (!["1", "true"].includes((process.env.CANONRY_STORED_ONLY ?? "").toLowerCase())) return {};
+function storedOnlyRequestHeaders(method, url, storedOnly = false) {
+  if (!storedOnly && !["1", "true"].includes((process.env.CANONRY_STORED_ONLY ?? "").toLowerCase())) return {};
   const { operation, access } = classifyStoredOnlyRequest(method, url);
   if (access !== OperationAccesses.stored) {
     throw new CliError({
@@ -3535,8 +3540,8 @@ function storedOnlyRequestHeaders(method, url) {
   }
   return { [STORED_ONLY_HEADER]: "1" };
 }
-function storedOnlyProbeHeaders() {
-  return ["1", "true"].includes((process.env.CANONRY_STORED_ONLY ?? "").toLowerCase()) ? { [STORED_ONLY_HEADER]: "1" } : {};
+function storedOnlyProbeHeaders(storedOnly = false) {
+  return storedOnly || ["1", "true"].includes((process.env.CANONRY_STORED_ONLY ?? "").toLowerCase()) ? { [STORED_ONLY_HEADER]: "1" } : {};
 }
 var SAFE_CLIENT_NAME = /^\w[\w./-]{0,127}$/;
 var SAFE_ACTOR_SESSION = /^\w[\w.:-]{0,127}$/;
@@ -3588,6 +3593,8 @@ var ApiClient = class {
   apiKey;
   probePromise = null;
   probeSkipped;
+  storedOnly;
+  signal;
   heyClient;
   requestHeaders;
   /** Tracks the base URL most recently applied to `heyClient` so probe-driven updates only re-configure when something actually changed. */
@@ -3596,6 +3603,8 @@ var ApiClient = class {
     this.originUrl = baseUrl.replace(/\/$/, "");
     this.apiKey = apiKey;
     this.probeSkipped = opts?.skipProbe ?? false;
+    this.storedOnly = opts?.storedOnly === true;
+    this.signal = opts?.signal;
     this.heyClientBaseUrl = this.originUrl;
     const actorSession = safeActorSession(opts?.actorSession);
     const surface = opts?.surface ?? "cli";
@@ -3609,15 +3618,19 @@ var ApiClient = class {
     };
     this.heyClient = createClient2({ baseUrl: this.originUrl, apiKey: this.apiKey, headers: this.requestHeaders });
     this.heyClient.interceptors.request.use((request) => {
-      for (const [key, value] of Object.entries(storedOnlyRequestHeaders(request.method, request.url.toString()))) request.headers.set(key, value);
+      for (const [key, value] of Object.entries(storedOnlyRequestHeaders(request.method, request.url.toString(), this.storedOnly))) request.headers.set(key, value);
       const tags = usageTagStore.getStore();
       if (tags?.mcpTool) request.headers.set(USAGE_TELEMETRY_HEADERS.mcpTool, tags.mcpTool);
       if (tags?.mcpCall) request.headers.set(USAGE_TELEMETRY_HEADERS.mcpCall, tags.mcpCall);
       const mcpClient = normalizeAgentSlug(tags?.mcpClient);
       if (mcpClient) request.headers.set(USAGE_TELEMETRY_HEADERS.mcpClient, mcpClient);
-      return request;
+      return this.signal || tags?.signal ? new Request(request, { signal: this.requestSignal(request.signal) }) : request;
     });
   }
+  requestSignal(signal) {
+    const signals = [this.signal, usageTagStore.getStore()?.signal, signal].filter((entry) => entry !== void 0);
+    return signals.length > 1 ? AbortSignal.any(signals) : signals[0];
+  }
   /**
    * On first API call, probe /health to auto-discover basePath when the user
    * hasn't configured one locally. This lets `canonry run` in a separate shell
@@ -3631,8 +3644,8 @@ var ApiClient = class {
         try {
           const origin = new URL(this.originUrl).origin;
           const res = await fetch(`${origin}/health`, {
-            headers: storedOnlyProbeHeaders(),
-            signal: AbortSignal.timeout(2e3)
+            headers: storedOnlyProbeHeaders(this.storedOnly),
+            signal: this.requestSignal(AbortSignal.timeout(2e3))
           });
           if (res.ok) {
             const body = await res.json();
@@ -3797,7 +3810,7 @@ var ApiClient = class {
    */
   async streamPost(path, body, signal) {
     const candidateUrl = `${this.originUrl}/api/v1${path}`;
-    const storedOnlyHeaders = storedOnlyRequestHeaders("POST", candidateUrl);
+    const storedOnlyHeaders = storedOnlyRequestHeaders("POST", candidateUrl, this.storedOnly);
     await this.probeBasePath();
     const url = `${this.originUrl}/api/v1${path}`;
     const headers = {
@@ -3808,7 +3821,12 @@ var ApiClient = class {
     };
     let res;
     try {
-      res = await fetch(url, { method: "POST", headers, body: JSON.stringify(body ?? {}), signal });
+      res = await fetch(url, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(body ?? {}),
+        signal: this.requestSignal(signal)
+      });
     } catch (err) {
       if (err instanceof CliError) throw err;
       const msg = describeError(err);
@@ -3861,6 +3879,9 @@ var ApiClient = class {
       () => getApiV1ProjectsByNameDeletePreview({ client: this.heyClient, path: { name } })
     );
   }
+  async getMcpProfile() {
+    return this.invoke(() => getApiV1McpProfile({ client: this.heyClient }));
+  }
   async getStatus(opts) {
     return this.invoke(
       () => getApiV1Status({ client: this.heyClient, query: { project: opts?.project, problems: opts?.problems } })
@@ -3916,11 +3937,12 @@ var ApiClient = class {
     if (opts.until) params.set("until", opts.until);
     if (opts.includeProbes) params.set("includeProbes", "true");
     const url = `${this.originUrl}/api/v1/projects/${encodeURIComponent(project)}/results/export?${params.toString()}`;
-    const storedOnlyHeaders = storedOnlyRequestHeaders("GET", url);
+    const storedOnlyHeaders = storedOnlyRequestHeaders("GET", url, this.storedOnly);
     let res;
     try {
       res = await fetch(url, {
-        headers: { ...this.requestHeaders, ...storedOnlyHeaders }
+        headers: { ...this.requestHeaders, ...storedOnlyHeaders },
+        signal: this.requestSignal()
       });
     } catch (err) {
       const message = describeError(err);
@@ -4758,10 +4780,10 @@ var ApiClient = class {
    * never run the CLI about a newer release.
    */
   async getServerUpdateAvailable() {
-    if (storedOnlyProbeHeaders()[STORED_ONLY_HEADER]) return null;
+    if (storedOnlyProbeHeaders(this.storedOnly)[STORED_ONLY_HEADER]) return null;
     try {
       await this.probeBasePath();
-      const res = await fetch(`${this.originUrl}/health`, { signal: AbortSignal.timeout(2e3) });
+      const res = await fetch(`${this.originUrl}/health`, { signal: this.requestSignal(AbortSignal.timeout(2e3)) });
       if (!res.ok) return null;
       const body = await res.json();
       return parseServerUpdateAvailable(body?.updateAvailable);

package/dist/{chunk-MJYO6UK2.js → chunk-DL3LTSBV.js}

@@ -5,7 +5,7 @@ import {
   loadConfig,
   loadConfigRaw,
   saveConfigPatch
-} from "./chunk-JE5QURTR.js";
+} from "./chunk-NXFNXXYM.js";
 import {
   CANONRY_NPM_PACKAGE_URL,
   compareSemver,
@@ -18,7 +18,7 @@ import {
   updateCheckEnvOptOut,
   upgradeCaveatFor,
   upgradeCommandFor
-} from "./chunk-YXAKL5HM.js";
+} from "./chunk-SF5JLMLG.js";
 
 // src/runtime-context.ts
 function cliRuntimeContext(env = process.env, stdio = process) {

package/dist/{chunk-6MYHGP46.js → chunk-DLVGMRM5.js}

@@ -1,7 +1,7 @@
 import {
   API_PROVIDER_NAMES,
   ProviderNames
-} from "./chunk-YXAKL5HM.js";
+} from "./chunk-SF5JLMLG.js";
 
 // src/provider-registration.ts
 function isApiProviderRegistrable(name, entry) {

package/dist/{chunk-TOX6HAQJ.js → chunk-EXGETCJR.js}

@@ -2,18 +2,18 @@ import {
   configExists,
   loadConfigRaw,
   saveConfigPatch
-} from "./chunk-JE5QURTR.js";
+} from "./chunk-NXFNXXYM.js";
 import {
   BUNDLED_SKILL_NAMES,
   installSkills
-} from "./chunk-PPM6Z7CM.js";
+} from "./chunk-HEL6DKDN.js";
 import {
   PACKAGE_VERSION
 } from "./chunk-AOJU5LKX.js";
 import {
   SKILL_MANIFEST_FILENAME,
   SkillsClients
-} from "./chunk-YXAKL5HM.js";
+} from "./chunk-SF5JLMLG.js";
 
 // src/skills-autosync.ts
 import fs from "fs";

package/dist/{chunk-BADJCT6U.js → chunk-GWDMWKM6.js}

@@ -1,7 +1,7 @@
 import {
   USAGE_TELEMETRY_HEADERS,
   redactLogString
-} from "./chunk-YXAKL5HM.js";
+} from "./chunk-SF5JLMLG.js";
 
 // ../api-routes/src/request-context.ts
 import { AsyncLocalStorage } from "async_hooks";

package/dist/{chunk-PPM6Z7CM.js → chunk-HEL6DKDN.js}

@@ -15,7 +15,7 @@ import {
   formatCanonryPluginUpdateHint,
   formatCanonryPluginVersionMismatch,
   skillsClientSchema
-} from "./chunk-YXAKL5HM.js";
+} from "./chunk-SF5JLMLG.js";
 
 // src/commands/skills.ts
 import crypto from "crypto";

package/dist/{chunk-NZZWJCKS.js → chunk-HJHFW455.js}

@@ -3,7 +3,7 @@ import {
   resolveCliAccess,
   resolveCliAccessForInvocation,
   windowOptions
-} from "./chunk-QDN3FL2A.js";
+} from "./chunk-3YIKSZHN.js";
 import {
   emitJsonl
 } from "./chunk-Z7IUAJOF.js";
@@ -14,7 +14,7 @@ import {
 } from "./chunk-HGMYEDAQ.js";
 import {
   OperationAccesses
-} from "./chunk-YXAKL5HM.js";
+} from "./chunk-SF5JLMLG.js";
 
 // src/cli-catalog.ts
 import { createRequire } from "module";
@@ -111,7 +111,7 @@ async function dispatchRegisteredCommand(args, fallbackFormat, specs) {
     const accessValue = accessFilterFromArgs(argsWithoutHelp);
     validateAccessFilter(accessValue);
     if (fallbackFormat !== "text") {
-      const { printCliCatalog: printCliCatalog2 } = await import("./cli-catalog-NEZE5QU5.js");
+      const { printCliCatalog: printCliCatalog2 } = await import("./cli-catalog-BXHG544D.js");
       const group2 = argsWithoutHelp.find((arg) => !arg.startsWith("--"));
       printCliCatalog2(specs, fallbackFormat, group2, accessValue);
       return true;

package/dist/{chunk-DRGCVTYH.js → chunk-JPM3VC6A.js}

@@ -1,6 +1,6 @@
 import {
   hostMatchesDomain
-} from "./chunk-YXAKL5HM.js";
+} from "./chunk-SF5JLMLG.js";
 
 // src/citation-utils.ts
 function pickProjectCitedDomain(citedDomains, projectDomains) {

package/dist/{chunk-H4HNXCDF.js → chunk-KOWOQ3JZ.js}

@@ -1,9 +1,9 @@
 import {
   trackIntegrationConnection
-} from "./chunk-4LTL5RNY.js";
+} from "./chunk-SCRPC2PQ.js";
 import {
   cliRuntimeContext
-} from "./chunk-MJYO6UK2.js";
+} from "./chunk-DL3LTSBV.js";
 
 // src/cli-connection-telemetry.ts
 function trackCliConnection(properties) {

package/dist/{chunk-UWBJWKDQ.js → chunk-L5GIL45X.js}

@@ -1,6 +1,6 @@
 import {
   createApiClient
-} from "./chunk-ATT3ZCSS.js";
+} from "./chunk-BICUWFV4.js";
 import {
   emitJsonl
 } from "./chunk-Z7IUAJOF.js";
@@ -19,7 +19,7 @@ import {
   formatMicros,
   formatRunErrorOneLine,
   resolveProviderInput
-} from "./chunk-YXAKL5HM.js";
+} from "./chunk-SF5JLMLG.js";
 
 // src/commands/run.ts
 function getClient() {

package/dist/{chunk-P3UGNR2Y.js → chunk-LS47ZAX2.js}

@@ -1,16 +1,16 @@
 import {
   runWithUsageTags
-} from "./chunk-ATT3ZCSS.js";
+} from "./chunk-BICUWFV4.js";
 import {
   CanonryMcpToolNames,
   canonryMcpTools
-} from "./chunk-GA2EHZTI.js";
+} from "./chunk-3WPTMLQI.js";
 import {
   CliError
 } from "./chunk-HGMYEDAQ.js";
 import {
   buildOpenApiDocument
-} from "./chunk-7KOAP47B.js";
+} from "./chunk-WLWOGBLJ.js";
 import {
   DEFAULT_COMPETITOR_AUTO_ALIAS_MODE,
   MeasurementPortfolioLists,
@@ -23,7 +23,7 @@ import {
   seoDatasetWithoutVendor,
   seoProviderSchema,
   truncateUtf16
-} from "./chunk-YXAKL5HM.js";
+} from "./chunk-SF5JLMLG.js";
 
 // src/agent/tools.ts
 import { Type as Type2 } from "@earendil-works/pi-ai";
@@ -884,7 +884,7 @@ function refuseCompetitorBulkAddAcknowledgement(tool) {
   };
 }
 function buildMcpAgentTools(registry, ctx, opts = {}) {
-  return registry.filter((tool) => !AERO_EXCLUDED_MCP_TOOLS.has(tool.name)).filter((tool) => opts.includeNames ? opts.includeNames.has(tool.name) : true).filter((tool) => opts.readOnly ? tool.access === "read" : true).filter((tool) => opts.managedSweeps ? !AERO_MANAGED_SWEEP_MCP_TOOLS.has(tool.name) : true).map((tool) => {
+  return registry.filter((tool) => !AERO_EXCLUDED_MCP_TOOLS.has(tool.name) && !tool.requiresConnectionProfile).filter((tool) => opts.includeNames ? opts.includeNames.has(tool.name) : true).filter((tool) => opts.readOnly ? tool.access === "read" : true).filter((tool) => opts.managedSweeps ? !AERO_MANAGED_SWEEP_MCP_TOOLS.has(tool.name) : true).map((tool) => {
     const agentTool = mcpToAgentTool(tool, ctx);
     if (COMPETITOR_AUTO_ALIAS_MODE_WRITES.has(tool.name)) return refuseCompetitorAutoAliasModeChange(agentTool, ctx);
     if (tool.name === "canonry_competitors_add") return refuseCompetitorBulkAddAcknowledgement(agentTool);

package/dist/{chunk-IV6VZ63E.js → chunk-MB3IUJ6Z.js}

@@ -6,12 +6,12 @@ import {
 import {
   createApiClient,
   runWithUsageTags
-} from "./chunk-ATT3ZCSS.js";
+} from "./chunk-BICUWFV4.js";
 import {
   canonryMcpTools,
   mcpOutputSchema,
   toolOperationAccess
-} from "./chunk-GA2EHZTI.js";
+} from "./chunk-3WPTMLQI.js";
 import {
   PACKAGE_VERSION
 } from "./chunk-AOJU5LKX.js";
@@ -24,11 +24,11 @@ import {
   isReadOnlyKey,
   restrictedWriteScopes,
   upgradeCaveatFor
-} from "./chunk-YXAKL5HM.js";
+} from "./chunk-SF5JLMLG.js";
 
 // src/mcp/server.ts
 import { randomUUID } from "crypto";
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { CLIENT_INFO_META_KEY, McpServer } from "@modelcontextprotocol/server";
 import { z } from "zod";
 
 // src/mcp/results.ts
@@ -452,7 +452,7 @@ ${updateNoticeInstructions(update)}` : SERVER_INSTRUCTIONS
   });
   server.validateToolInput = async (_tool, args) => args;
   const entries = [];
-  for (const registryTool of getCanonryMcpTools(scope, options.tiers, options.credentialScopes, options.operator)) {
+  for (const registryTool of getCanonryMcpTools(scope, options.tiers, options.credentialScopes, options.operator, options.connectionProfile)) {
     const tool = registryTool;
     const handler = tool.handler;
     const registered = server.registerTool(
@@ -464,12 +464,16 @@ ${updateNoticeInstructions(update)}` : SERVER_INSTRUCTIONS
         outputSchema: tool.outputSchema ? mcpOutputSchema(tool.outputSchema) : void 0,
         annotations: tool.annotations
       },
-      async (input) => withToolErrors(async () => {
+      async (input, context) => withToolErrors(async () => {
         const parsed = tool.inputSchema.parse(input ?? {});
+        const envelope = context.mcpReq.envelope;
+        const identity = envelope && CLIENT_INFO_META_KEY in envelope ? envelope[CLIENT_INFO_META_KEY] : void 0;
+        const clientName = typeof identity === "object" && identity !== null && "name" in identity && typeof identity.name === "string" ? identity.name : server.server.getClientVersion()?.name;
         return runWithUsageTags(client, {
           mcpTool: tool.name,
           mcpCall: randomUUID(),
-          mcpClient: server.server.getClientVersion()?.name
+          mcpClient: clientName,
+          signal: context.mcpReq.signal
         }, () => handler(client, parsed));
       })
     );
@@ -500,8 +504,8 @@ function registerMetaTools(server, catalog, opts) {
     {
       title: "Guide a Canonry workflow",
       description: "Start here: route an intent to available stored-evidence tools, separately listed actions requiring approval, and workflow guidance. No provider calls or installation required. Optionally include full toolkit details.",
-      inputSchema: helpInputSchema.shape,
-      annotations: { readOnlyHint: true, idempotentHint: true, openWorldHint: false }
+      inputSchema: helpInputSchema,
+      annotations: { readOnlyHint: true, idempotentHint: true, destructiveHint: false, openWorldHint: false }
     },
     async (input) => {
       try {
@@ -522,9 +526,9 @@ function registerMetaTools(server, catalog, opts) {
     "canonry_load_toolkit",
     {
       title: "Load a Canonry MCP toolkit",
-      description: `Register a toolkit's tools for this session and emit one notifications/tools/list_changed. Idempotent. Loaded toolkits remain loaded for the rest of the session. Wait for this call to return before calling any newly enabled tool \u2014 pipelining the call with a tools/call on the same connection can race the registration and fail with "MCP error -32602: Tool ... disabled".`,
-      inputSchema: loadToolkitInputSchema.shape,
-      annotations: { readOnlyHint: false, idempotentHint: true, destructiveHint: false }
+      description: `Register a toolkit's tools for this session and emit one notifications/tools/list_changed. Idempotent. Loaded toolkits remain loaded for the rest of the session. Wait for this call to return before calling any newly enabled tool \u2014 pipelining the call with a tools/call on the same connection can race the registration and fail with "Tool ... disabled".`,
+      inputSchema: loadToolkitInputSchema,
+      annotations: { readOnlyHint: false, idempotentHint: true, destructiveHint: false, openWorldHint: false }
     },
     async (input) => withToolErrors(async () => {
       const parsed = loadToolkitInputSchema.parse(input ?? {});
@@ -532,10 +536,10 @@ function registerMetaTools(server, catalog, opts) {
     })
   );
 }
-function getCanonryMcpTools(scope = "all", tiers, credentialScopes, operator = false) {
+function getCanonryMcpTools(scope = "all", tiers, credentialScopes, operator = false, connectionProfile = false) {
   const readOnly = scope === "read-only" || credentialScopes !== void 0 && isReadOnlyKey(credentialScopes);
   const restricted = credentialScopes && restrictedWriteScopes(credentialScopes);
-  const authorized = canonryMcpTools.filter((tool) => !tool.requiresOperator || operator);
+  const authorized = canonryMcpTools.filter((tool) => (!tool.requiresOperator || operator) && (!tool.requiresConnectionProfile || connectionProfile));
   const byScope = scope === "stored-only" ? authorized.filter((tool) => toolOperationAccess(tool) === OperationAccesses.stored) : readOnly ? authorized.filter((tool) => tool.access === "read") : authorized.filter((tool) => {
     if (!restricted || tool.access === "read") return true;
     if (tool.requiredScope && restricted.includes(tool.requiredScope)) return true;

package/dist/{chunk-3AG3LPZX.js → chunk-MRSNLKSM.js}

@@ -23,7 +23,7 @@ import {
   measurementDraftUpsertGroupRequestSchema,
   measurementDraftUpsertMarketRequestSchema,
   measurementDraftUpsertTargetRequestSchema
-} from "./chunk-YXAKL5HM.js";
+} from "./chunk-SF5JLMLG.js";
 
 // src/measurement-draft-actions.ts
 import { z } from "zod";