@centrali-io/centrali-mcp 4.4.6 → 4.4.7

package/README.md

@@ -4,7 +4,7 @@ MCP (Model Context Protocol) server for the Centrali platform. Lets AI assistant
 
 > **Full documentation:** [docs.centrali.io](https://docs.centrali.io) — SDK guide, API reference, compute functions, orchestrations, and more.
 
-Built on `@centrali-io/centrali-sdk` v4.4.6. Authenticates via service account client credentials.
+Built on `@centrali-io/centrali-sdk` v4.4.7. Authenticates via service account client credentials.
 
 ## Setup
 
@@ -110,6 +110,7 @@ After connecting, call `describe_centrali` first — it returns the full capabil
 | `get_compute_job_status` | Check async job status by job ID (poll after invoke_trigger) |
 | `list_allowed_domains` | List allowed domains for outbound HTTP |
 | `add_allowed_domain` | Add a domain to the allowlist |
+| `invoke_endpoint` | Call a sync compute endpoint by path (returns response inline) |
 | `remove_allowed_domain` | Remove a domain from the allowlist |
 
 ### Smart Queries

package/dist/tools/auth-providers.js

@@ -37,10 +37,10 @@ function ensureToken(sdk) {
  */
 function createIamClient(sdk, centraliUrl, workspaceId) {
     const url = new URL(centraliUrl);
-    const hostname = url.hostname.startsWith("api.")
+    const hostname = url.hostname.startsWith("auth.")
         ? url.hostname
-        : `api.${url.hostname}`;
-    const baseURL = `${url.protocol}//${hostname}/iam/workspace/${workspaceId}/api/v1/external-auth-providers`;
+        : `auth.${url.hostname.replace(/^api\./, '')}`;
+    const baseURL = `${url.protocol}//${hostname}/workspace/${workspaceId}/api/v1/external-auth-providers`;
     const client = axios_1.default.create({ baseURL });
     client.interceptors.request.use((config) => __awaiter(this, void 0, void 0, function* () {
         const token = yield ensureToken(sdk);

package/dist/tools/compute.js

@@ -82,9 +82,9 @@ function registerComputeTools(server, sdk, centraliUrl, workspaceId) {
             };
         }
     }));
-    server.tool("list_triggers", "List function triggers in the workspace. Triggers define how and when compute functions are executed (on-demand, event-driven, scheduled, http-trigger).", {
+    server.tool("list_triggers", "List function triggers in the workspace. Triggers define how and when compute functions are executed (on-demand, event-driven, scheduled, http-trigger, endpoint).", {
         executionType: zod_1.z
-            .enum(["on-demand", "event-driven", "scheduled", "http-trigger"])
+            .enum(["on-demand", "event-driven", "scheduled", "http-trigger", "endpoint"])
             .optional()
             .describe("Filter by trigger execution type"),
         page: zod_1.z.number().optional().describe("Page number"),
@@ -394,13 +394,13 @@ function registerComputeTools(server, sdk, centraliUrl, workspaceId) {
         name: zod_1.z.string().describe("Display name for the trigger"),
         functionId: zod_1.z.string().describe("The compute function ID (UUID) to execute"),
         executionType: zod_1.z
-            .enum(["on-demand", "event-driven", "scheduled", "http-trigger"])
-            .describe("How the trigger fires: on-demand (manual), event-driven (data events), scheduled (cron), or http-trigger (external HTTP POST)"),
+            .enum(["on-demand", "event-driven", "scheduled", "http-trigger", "endpoint"])
+            .describe("How the trigger fires: on-demand (manual), event-driven (data events), scheduled (cron), http-trigger (external HTTP POST), or endpoint (synchronous HTTP API — returns response inline)"),
         description: zod_1.z.string().optional().describe("Optional description"),
         triggerMetadata: zod_1.z
             .record(zod_1.z.string(), zod_1.z.any())
             .optional()
-            .describe("Type-specific configuration. For event-driven: { eventType, recordSlug } where eventType is record_created | record_updated | record_deleted. For scheduled: { scheduleType, cronExpression, timezone }. For http-trigger: auto-generated URL."),
+            .describe("Type-specific configuration. For event-driven: { eventType, recordSlug }. For scheduled: { scheduleType, cronExpression, timezone }. For http-trigger: auto-generated URL. For endpoint: { path, allowedMethods?, timeoutMs?, auth? } where path is URL-safe (e.g., 'create-order'), allowedMethods defaults to ['POST'], timeoutMs 1000-30000 (default 30000), auth is { mode: 'bearer'|'public'|'apiKey'|'hmac' }."),
         enabled: zod_1.z.boolean().optional().describe("Whether the trigger is enabled (default: true)"),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ name, functionId, executionType, description, triggerMetadata, enabled }) {
         try {
@@ -616,6 +616,54 @@ function registerComputeTools(server, sdk, centraliUrl, workspaceId) {
             };
         }
     }));
+    // ── Endpoint Trigger (Sync Execution) ─────────────────────────────
+    server.tool("invoke_endpoint", "Invoke a compute endpoint trigger by path. The function executes synchronously — Centrali waits for the function to complete and returns its output directly in the response. No polling needed. Max execution time: 30 seconds (configurable via triggerMetadata.timeoutMs, range 1–30s). If the function exceeds the timeout, returns 504. Endpoint triggers must be created first with executionType='endpoint'. Use this for real-time API responses; use invoke_trigger for long-running background work that doesn't need an immediate response.", {
+        path: zod_1.z.string().describe("The endpoint path (e.g., 'create-order', 'webhook/shipments'). This is set in the trigger's triggerMetadata.path."),
+        method: zod_1.z.enum(["GET", "POST", "PUT", "DELETE", "PATCH"]).optional().describe("HTTP method (default: POST). Must be in the trigger's allowedMethods."),
+        payload: zod_1.z.record(zod_1.z.string(), zod_1.z.any()).optional().describe("Request body payload (sent as JSON)"),
+        headers: zod_1.z.record(zod_1.z.string(), zod_1.z.string()).optional().describe("Additional headers (e.g., X-API-Key for apiKey auth)"),
+    }, (_a) => __awaiter(this, [_a], void 0, function* ({ path, method, payload, headers: extraHeaders }) {
+        try {
+            const token = yield ensureToken(sdk);
+            const url = new URL(centraliUrl);
+            const hostname = url.hostname.startsWith("api.")
+                ? url.hostname
+                : `api.${url.hostname}`;
+            const apiUrl = `${url.protocol}//${hostname}/data/workspace/${workspaceId}/api/v1/endpoints/${path}`;
+            const reqHeaders = {};
+            if (token)
+                reqHeaders.Authorization = `Bearer ${token}`;
+            if (extraHeaders)
+                Object.assign(reqHeaders, extraHeaders);
+            const httpMethod = (method || "POST").toLowerCase();
+            const result = yield (0, axios_1.default)({
+                method: httpMethod,
+                url: apiUrl,
+                data: ["get", "delete"].includes(httpMethod) ? undefined : (payload || {}),
+                headers: reqHeaders,
+                validateStatus: () => true, // Don't throw on non-2xx — return the function's response as-is
+            });
+            return {
+                content: [{
+                        type: "text",
+                        text: JSON.stringify({
+                            status: result.status,
+                            headers: {
+                                "content-type": result.headers["content-type"],
+                                "x-execution-id": result.headers["x-execution-id"],
+                            },
+                            body: result.data,
+                        }, null, 2),
+                    }],
+            };
+        }
+        catch (error) {
+            return {
+                content: [{ type: "text", text: formatError(error, `invoking endpoint '${path}'`) }],
+                isError: true,
+            };
+        }
+    }));
     // ── Allowed Domains tools ──────────────────────────────────────────
     server.tool("list_allowed_domains", "List all allowed domains for compute function HTTP requests. Functions can only call external APIs on domains in this allowlist.", {}, () => __awaiter(this, void 0, void 0, function* () {
         try {

package/dist/tools/describe.js

@@ -85,6 +85,7 @@ function registerDescribeTools(server) {
                                     "get_function_run",
                                     "list_function_runs",
                                     "get_compute_job_status",
+                                    "invoke_endpoint",
                                 ],
                             },
                             smart_queries: {
@@ -220,6 +221,16 @@ function registerDescribeTools(server) {
                                 ],
                             },
                         },
+                        naming_guide: {
+                            description: "Different tools use different parameter names for the same concept (collection identifier). This is a historical naming drift — all of these refer to the same thing.",
+                            aliases: {
+                                recordSlug: "Used by record tools (query_records, create_record, etc.). This is the collection's URL-safe slug, e.g., 'orders'.",
+                                structureSlug: "Used by validation and insights tools. Same value as recordSlug.",
+                                collections: "Used by search_records. Same value as recordSlug. Accepts a string or array of strings.",
+                                structureIds: "Used by generate_starter_pages. This is the collection UUID (not the slug). Get it from list_collections → id field.",
+                            },
+                            rule: "When a tool asks for recordSlug, structureSlug, or collections — use the collection's slug (e.g., 'orders'). When a tool asks for structureIds — use the collection's UUID.",
+                        },
                         workflow: "Typical workflow: 1) Define collections → 2) Create records → 3) Write compute functions → 4) Wire orchestrations → 5) Build pages to surface data → 6) Publish pages for end users. When building an app, also: 7) Create a service account → 8) Grant least-privilege permissions via remediation → 9) Create publishable keys for the frontend.",
                         app_credential_setup: {
                             description: "When building an app that uses Centrali, you need credentials. The flow depends on whether the code runs server-side or client-side.",
@@ -522,13 +533,29 @@ function registerDescribeTools(server) {
                                 description: "Triggered by an external HTTP POST to a generated webhook URL.",
                                 config: "Each http-trigger gets a unique URL to share with external services",
                             },
+                            "endpoint": {
+                                description: "Turns a compute function into a custom API endpoint. Unlike all other trigger types (which are async and return a job ID you must poll), endpoint triggers WAIT for the function to complete and return its output directly in the HTTP response. Max execution time: 30 seconds.",
+                                when_to_use: "Use endpoint triggers when the caller needs the function's output immediately (REST APIs, form handlers, webhook responders, data calculations). Use on-demand/invoke_trigger for long-running work (>30s) or fire-and-forget background jobs.",
+                                config: {
+                                    path: "string — URL-safe path (e.g., 'create-order', 'webhook/shipments'). Must be unique per workspace.",
+                                    allowedMethods: "string[] — HTTP methods to accept (default: ['POST']). Options: GET, POST, PUT, DELETE, PATCH.",
+                                    timeoutMs: "number — execution timeout 1000-30000ms (default: 30000). Function MUST complete within this window or the request returns 504 Gateway Timeout.",
+                                    auth: "{ mode: 'bearer'|'public'|'apiKey'|'hmac' } — authentication mode. bearer=IAM token, public=no auth, apiKey=X-API-Key header (auto-generated), hmac=X-Signature header (auto-generated signing secret).",
+                                },
+                                invocation: "Call invoke_endpoint with the path. Response comes back inline — no polling needed.",
+                                example_use_cases: [
+                                    "Build a REST API endpoint backed by a compute function",
+                                    "Create a webhook receiver that processes and responds synchronously",
+                                    "Expose a function as an HTTP service for external integrations",
+                                ],
+                            },
                         },
                         trigger_shape: {
                             id: "UUID",
                             name: "string",
                             description: "string | null",
                             functionId: "UUID — the compute function to execute",
-                            executionType: "'on-demand' | 'event-driven' | 'scheduled' | 'http-trigger'",
+                            executionType: "'on-demand' | 'event-driven' | 'scheduled' | 'http-trigger' | 'endpoint'",
                             triggerMetadata: "object — type-specific configuration (event, cron, params, etc.)",
                             enabled: "boolean — whether the trigger is active (default: true)",
                             workspaceSlug: "string",
@@ -575,6 +602,7 @@ function registerDescribeTools(server) {
                                 triggerMetadata_examples: {
                                     "event-driven": { eventType: "record_created", recordSlug: "orders" },
                                     scheduled: { scheduleType: "cron", cronExpression: "0 9 * * *", timezone: "America/New_York" },
+                                    endpoint: { path: "create-order", allowedMethods: ["POST"], timeoutMs: 10000, auth: { mode: "bearer" } },
                                 },
                             },
                             update_trigger: {
@@ -969,7 +997,7 @@ function registerDescribeTools(server) {
                             id: "UUID",
                             structureSlug: "string — the collection where the anomaly was detected",
                             type: "string — anomaly type (e.g., 'spike', 'drop', 'outlier', 'pattern_break')",
-                            severity: "'critical' | 'high' | 'medium' | 'low'",
+                            severity: "'info' | 'warning' | 'critical'",
                             status: "'active' | 'acknowledged' | 'dismissed'",
                             title: "string — human-readable summary",
                             description: "string — detailed explanation of the anomaly",
@@ -986,12 +1014,12 @@ function registerDescribeTools(server) {
                             totalActive: "number",
                             totalAcknowledged: "number",
                             totalDismissed: "number",
-                            bySeverity: "{ critical: n, high: n, medium: n, low: n }",
+                            bySeverity: "{ info: n, warning: n, critical: n }",
                         },
                         tips: [
                             "Use trigger_anomaly_analysis to scan a specific collection on-demand",
                             "Use get_insights_summary for a quick overview before diving into individual insights",
-                            "Filter by severity='critical' to focus on the most important issues first",
+                            "Filter by severity='critical' to focus on the most important issues first. Severity levels: info (noteworthy), warning (needs attention), critical (requires action).",
                             "Acknowledged insights are still visible — use dismiss for false positives",
                         ],
                     }, null, 2),
@@ -1108,6 +1136,12 @@ function registerDescribeTools(server) {
                             "4_publish": "publish_page — makes the page accessible at its runtime URL",
                             "5_iterate": "Repeat steps 2-4 to update. Each publish creates a new version.",
                             unpublish: "unpublish_page — removes the page from its runtime URL (keeps the definition)",
+                            important_behavior: {
+                                description: "Publishing does NOT consume or delete the draft. After publishing, the page has BOTH an activePublication (the live version) and a currentDraft (a new working draft for future edits). This is intentional — it allows iterating on changes without affecting the live page.",
+                                example: "After publishing version 1, get_page shows: activePublication.versionNumber=1 (live) and currentDraft.versionNumber=2 (editable). The draft is not stale — it's the starting point for the next publish cycle.",
+                                agent_tip: "Do not treat the draft as an error or leftover. The normal state of a published page is: one active publication + one working draft. Edit the draft, validate, publish again to create version 3, etc.",
+                            },
+                            eventual_consistency_note: "After save_page_draft or set_navigation, there may be a brief delay before the data is visible via get_page_draft or get_navigation. If you get a 'not found' immediately after writing, wait 1-2 seconds and retry.",
                         },
                         access_modes: {
                             public: "Anyone can view — no authentication required",

package/dist/tools/insights.js

@@ -46,7 +46,7 @@ function registerInsightTools(server, sdk) {
             .optional()
             .describe("Filter by insight status"),
         severity: zod_1.z
-            .enum(["critical", "high", "medium", "low"])
+            .enum(["info", "warning", "critical"])
             .optional()
             .describe("Filter by severity level"),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ structureSlug, status, severity }) {

package/dist/tools/service-accounts.js

@@ -37,10 +37,10 @@ function ensureToken(sdk) {
  */
 function createIamClient(sdk, centraliUrl, workspaceId, baseSuffix) {
     const url = new URL(centraliUrl);
-    const hostname = url.hostname.startsWith("api.")
+    const hostname = url.hostname.startsWith("auth.")
         ? url.hostname
-        : `api.${url.hostname}`;
-    const baseURL = `${url.protocol}//${hostname}/iam/workspace/${workspaceId}/api/v1/${baseSuffix}`;
+        : `auth.${url.hostname.replace(/^api\./, '')}`;
+    const baseURL = `${url.protocol}//${hostname}/workspace/${workspaceId}/api/v1/${baseSuffix}`;
     const client = axios_1.default.create({ baseURL });
     client.interceptors.request.use((config) => __awaiter(this, void 0, void 0, function* () {
         const token = yield ensureToken(sdk);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@centrali-io/centrali-mcp",
-  "version": "4.4.6",
+  "version": "4.4.7",
   "description": "Centrali MCP Server - AI assistant integration for Centrali workspaces",
   "main": "dist/index.js",
   "type": "commonjs",
@@ -25,7 +25,7 @@
   "author": "Blueinit",
   "license": "ISC",
   "dependencies": {
-    "@centrali-io/centrali-sdk": "^4.4.6",
+    "@centrali-io/centrali-sdk": "^4.4.7",
     "@modelcontextprotocol/sdk": "^1.12.1"
   },
   "devDependencies": {

package/src/tools/auth-providers.ts

@@ -22,10 +22,10 @@ async function ensureToken(sdk: CentraliSDK): Promise<string | null> {
  */
 function createIamClient(sdk: CentraliSDK, centraliUrl: string, workspaceId: string): AxiosInstance {
   const url = new URL(centraliUrl);
-  const hostname = url.hostname.startsWith("api.")
+  const hostname = url.hostname.startsWith("auth.")
     ? url.hostname
-    : `api.${url.hostname}`;
-  const baseURL = `${url.protocol}//${hostname}/iam/workspace/${workspaceId}/api/v1/external-auth-providers`;
+    : `auth.${url.hostname.replace(/^api\./, '')}`;
+  const baseURL = `${url.protocol}//${hostname}/workspace/${workspaceId}/api/v1/external-auth-providers`;
 
   const client = axios.create({ baseURL });
 

package/src/tools/compute.ts

@@ -74,10 +74,10 @@ export function registerComputeTools(server: McpServer, sdk: CentraliSDK, centra
 
   server.tool(
     "list_triggers",
-    "List function triggers in the workspace. Triggers define how and when compute functions are executed (on-demand, event-driven, scheduled, http-trigger).",
+    "List function triggers in the workspace. Triggers define how and when compute functions are executed (on-demand, event-driven, scheduled, http-trigger, endpoint).",
     {
       executionType: z
-        .enum(["on-demand", "event-driven", "scheduled", "http-trigger"])
+        .enum(["on-demand", "event-driven", "scheduled", "http-trigger", "endpoint"])
         .optional()
         .describe("Filter by trigger execution type"),
       page: z.number().optional().describe("Page number"),
@@ -437,13 +437,13 @@ export function registerComputeTools(server: McpServer, sdk: CentraliSDK, centra
       name: z.string().describe("Display name for the trigger"),
       functionId: z.string().describe("The compute function ID (UUID) to execute"),
       executionType: z
-        .enum(["on-demand", "event-driven", "scheduled", "http-trigger"])
-        .describe("How the trigger fires: on-demand (manual), event-driven (data events), scheduled (cron), or http-trigger (external HTTP POST)"),
+        .enum(["on-demand", "event-driven", "scheduled", "http-trigger", "endpoint"])
+        .describe("How the trigger fires: on-demand (manual), event-driven (data events), scheduled (cron), http-trigger (external HTTP POST), or endpoint (synchronous HTTP API — returns response inline)"),
       description: z.string().optional().describe("Optional description"),
       triggerMetadata: z
         .record(z.string(), z.any())
         .optional()
-        .describe("Type-specific configuration. For event-driven: { eventType, recordSlug } where eventType is record_created | record_updated | record_deleted. For scheduled: { scheduleType, cronExpression, timezone }. For http-trigger: auto-generated URL."),
+        .describe("Type-specific configuration. For event-driven: { eventType, recordSlug }. For scheduled: { scheduleType, cronExpression, timezone }. For http-trigger: auto-generated URL. For endpoint: { path, allowedMethods?, timeoutMs?, auth? } where path is URL-safe (e.g., 'create-order'), allowedMethods defaults to ['POST'], timeoutMs 1000-30000 (default 30000), auth is { mode: 'bearer'|'public'|'apiKey'|'hmac' }."),
       enabled: z.boolean().optional().describe("Whether the trigger is enabled (default: true)"),
     },
     async ({ name, functionId, executionType, description, triggerMetadata, enabled }) => {
@@ -687,6 +687,61 @@ export function registerComputeTools(server: McpServer, sdk: CentraliSDK, centra
     }
   );
 
+  // ── Endpoint Trigger (Sync Execution) ─────────────────────────────
+
+  server.tool(
+    "invoke_endpoint",
+    "Invoke a compute endpoint trigger by path. The function executes synchronously — Centrali waits for the function to complete and returns its output directly in the response. No polling needed. Max execution time: 30 seconds (configurable via triggerMetadata.timeoutMs, range 1–30s). If the function exceeds the timeout, returns 504. Endpoint triggers must be created first with executionType='endpoint'. Use this for real-time API responses; use invoke_trigger for long-running background work that doesn't need an immediate response.",
+    {
+      path: z.string().describe("The endpoint path (e.g., 'create-order', 'webhook/shipments'). This is set in the trigger's triggerMetadata.path."),
+      method: z.enum(["GET", "POST", "PUT", "DELETE", "PATCH"]).optional().describe("HTTP method (default: POST). Must be in the trigger's allowedMethods."),
+      payload: z.record(z.string(), z.any()).optional().describe("Request body payload (sent as JSON)"),
+      headers: z.record(z.string(), z.string()).optional().describe("Additional headers (e.g., X-API-Key for apiKey auth)"),
+    },
+    async ({ path, method, payload, headers: extraHeaders }) => {
+      try {
+        const token = await ensureToken(sdk);
+        const url = new URL(centraliUrl);
+        const hostname = url.hostname.startsWith("api.")
+          ? url.hostname
+          : `api.${url.hostname}`;
+        const apiUrl = `${url.protocol}//${hostname}/data/workspace/${workspaceId}/api/v1/endpoints/${path}`;
+
+        const reqHeaders: Record<string, string> = {};
+        if (token) reqHeaders.Authorization = `Bearer ${token}`;
+        if (extraHeaders) Object.assign(reqHeaders, extraHeaders);
+
+        const httpMethod = (method || "POST").toLowerCase();
+        const result = await axios({
+          method: httpMethod as any,
+          url: apiUrl,
+          data: ["get", "delete"].includes(httpMethod) ? undefined : (payload || {}),
+          headers: reqHeaders,
+          validateStatus: () => true, // Don't throw on non-2xx — return the function's response as-is
+        });
+
+        return {
+          content: [{
+            type: "text",
+            text: JSON.stringify({
+              status: result.status,
+              headers: {
+                "content-type": result.headers["content-type"],
+                "x-execution-id": result.headers["x-execution-id"],
+              },
+              body: result.data,
+            }, null, 2),
+          }],
+        };
+      } catch (error: unknown) {
+        return {
+          content: [{ type: "text", text: formatError(error, `invoking endpoint '${path}'`) }],
+          isError: true,
+        };
+      }
+    }
+  );
+
   // ── Allowed Domains tools ──────────────────────────────────────────
 
   server.tool(

package/src/tools/describe.ts

@@ -85,6 +85,7 @@ export function registerDescribeTools(server: McpServer) {
                     "get_function_run",
                     "list_function_runs",
                     "get_compute_job_status",
+                    "invoke_endpoint",
                   ],
                 },
                 smart_queries: {
@@ -227,6 +228,16 @@ export function registerDescribeTools(server: McpServer) {
                   ],
                 },
               },
+              naming_guide: {
+                description: "Different tools use different parameter names for the same concept (collection identifier). This is a historical naming drift — all of these refer to the same thing.",
+                aliases: {
+                  recordSlug: "Used by record tools (query_records, create_record, etc.). This is the collection's URL-safe slug, e.g., 'orders'.",
+                  structureSlug: "Used by validation and insights tools. Same value as recordSlug.",
+                  collections: "Used by search_records. Same value as recordSlug. Accepts a string or array of strings.",
+                  structureIds: "Used by generate_starter_pages. This is the collection UUID (not the slug). Get it from list_collections → id field.",
+                },
+                rule: "When a tool asks for recordSlug, structureSlug, or collections — use the collection's slug (e.g., 'orders'). When a tool asks for structureIds — use the collection's UUID.",
+              },
               workflow:
                 "Typical workflow: 1) Define collections → 2) Create records → 3) Write compute functions → 4) Wire orchestrations → 5) Build pages to surface data → 6) Publish pages for end users. When building an app, also: 7) Create a service account → 8) Grant least-privilege permissions via remediation → 9) Create publishable keys for the frontend.",
               app_credential_setup: {
@@ -594,13 +605,30 @@ export function registerDescribeTools(server: McpServer) {
                     "Triggered by an external HTTP POST to a generated webhook URL.",
                   config: "Each http-trigger gets a unique URL to share with external services",
                 },
+                "endpoint": {
+                  description:
+                    "Turns a compute function into a custom API endpoint. Unlike all other trigger types (which are async and return a job ID you must poll), endpoint triggers WAIT for the function to complete and return its output directly in the HTTP response. Max execution time: 30 seconds.",
+                  when_to_use: "Use endpoint triggers when the caller needs the function's output immediately (REST APIs, form handlers, webhook responders, data calculations). Use on-demand/invoke_trigger for long-running work (>30s) or fire-and-forget background jobs.",
+                  config: {
+                    path: "string — URL-safe path (e.g., 'create-order', 'webhook/shipments'). Must be unique per workspace.",
+                    allowedMethods: "string[] — HTTP methods to accept (default: ['POST']). Options: GET, POST, PUT, DELETE, PATCH.",
+                    timeoutMs: "number — execution timeout 1000-30000ms (default: 30000). Function MUST complete within this window or the request returns 504 Gateway Timeout.",
+                    auth: "{ mode: 'bearer'|'public'|'apiKey'|'hmac' } — authentication mode. bearer=IAM token, public=no auth, apiKey=X-API-Key header (auto-generated), hmac=X-Signature header (auto-generated signing secret).",
+                  },
+                  invocation: "Call invoke_endpoint with the path. Response comes back inline — no polling needed.",
+                  example_use_cases: [
+                    "Build a REST API endpoint backed by a compute function",
+                    "Create a webhook receiver that processes and responds synchronously",
+                    "Expose a function as an HTTP service for external integrations",
+                  ],
+                },
               },
               trigger_shape: {
                 id: "UUID",
                 name: "string",
                 description: "string | null",
                 functionId: "UUID — the compute function to execute",
-                executionType: "'on-demand' | 'event-driven' | 'scheduled' | 'http-trigger'",
+                executionType: "'on-demand' | 'event-driven' | 'scheduled' | 'http-trigger' | 'endpoint'",
                 triggerMetadata: "object — type-specific configuration (event, cron, params, etc.)",
                 enabled: "boolean — whether the trigger is active (default: true)",
                 workspaceSlug: "string",
@@ -647,6 +675,7 @@ export function registerDescribeTools(server: McpServer) {
                   triggerMetadata_examples: {
                     "event-driven": { eventType: "record_created", recordSlug: "orders" },
                     scheduled: { scheduleType: "cron", cronExpression: "0 9 * * *", timezone: "America/New_York" },
+                    endpoint: { path: "create-order", allowedMethods: ["POST"], timeoutMs: 10000, auth: { mode: "bearer" } },
                   },
                 },
                 update_trigger: {
@@ -1074,7 +1103,7 @@ export function registerDescribeTools(server: McpServer) {
                 id: "UUID",
                 structureSlug: "string — the collection where the anomaly was detected",
                 type: "string — anomaly type (e.g., 'spike', 'drop', 'outlier', 'pattern_break')",
-                severity: "'critical' | 'high' | 'medium' | 'low'",
+                severity: "'info' | 'warning' | 'critical'",
                 status: "'active' | 'acknowledged' | 'dismissed'",
                 title: "string — human-readable summary",
                 description: "string — detailed explanation of the anomaly",
@@ -1093,12 +1122,12 @@ export function registerDescribeTools(server: McpServer) {
                 totalActive: "number",
                 totalAcknowledged: "number",
                 totalDismissed: "number",
-                bySeverity: "{ critical: n, high: n, medium: n, low: n }",
+                bySeverity: "{ info: n, warning: n, critical: n }",
               },
               tips: [
                 "Use trigger_anomaly_analysis to scan a specific collection on-demand",
                 "Use get_insights_summary for a quick overview before diving into individual insights",
-                "Filter by severity='critical' to focus on the most important issues first",
+                "Filter by severity='critical' to focus on the most important issues first. Severity levels: info (noteworthy), warning (needs attention), critical (requires action).",
                 "Acknowledged insights are still visible — use dismiss for false positives",
               ],
             },
@@ -1255,6 +1284,12 @@ export function registerDescribeTools(server: McpServer) {
                   "Repeat steps 2-4 to update. Each publish creates a new version.",
                 unpublish:
                   "unpublish_page — removes the page from its runtime URL (keeps the definition)",
+                important_behavior: {
+                  description: "Publishing does NOT consume or delete the draft. After publishing, the page has BOTH an activePublication (the live version) and a currentDraft (a new working draft for future edits). This is intentional — it allows iterating on changes without affecting the live page.",
+                  example: "After publishing version 1, get_page shows: activePublication.versionNumber=1 (live) and currentDraft.versionNumber=2 (editable). The draft is not stale — it's the starting point for the next publish cycle.",
+                  agent_tip: "Do not treat the draft as an error or leftover. The normal state of a published page is: one active publication + one working draft. Edit the draft, validate, publish again to create version 3, etc.",
+                },
+                eventual_consistency_note: "After save_page_draft or set_navigation, there may be a brief delay before the data is visible via get_page_draft or get_navigation. If you get a 'not found' immediately after writing, wait 1-2 seconds and retry.",
               },
               access_modes: {
                 public: "Anyone can view — no authentication required",

package/src/tools/insights.ts

@@ -41,7 +41,7 @@ export function registerInsightTools(server: McpServer, sdk: CentraliSDK) {
         .optional()
         .describe("Filter by insight status"),
       severity: z
-        .enum(["critical", "high", "medium", "low"])
+        .enum(["info", "warning", "critical"])
         .optional()
         .describe("Filter by severity level"),
     },

package/src/tools/service-accounts.ts

@@ -22,10 +22,10 @@ async function ensureToken(sdk: CentraliSDK): Promise<string | null> {
  */
 function createIamClient(sdk: CentraliSDK, centraliUrl: string, workspaceId: string, baseSuffix: string): AxiosInstance {
   const url = new URL(centraliUrl);
-  const hostname = url.hostname.startsWith("api.")
+  const hostname = url.hostname.startsWith("auth.")
     ? url.hostname
-    : `api.${url.hostname}`;
-  const baseURL = `${url.protocol}//${hostname}/iam/workspace/${workspaceId}/api/v1/${baseSuffix}`;
+    : `auth.${url.hostname.replace(/^api\./, '')}`;
+  const baseURL = `${url.protocol}//${hostname}/workspace/${workspaceId}/api/v1/${baseSuffix}`;
 
   const client = axios.create({ baseURL });