@chainpatrol/mcp 1.10.0

package/dist/chunk-AHMNJBKL.js

@@ -0,0 +1,4468 @@
+// src/prompts.ts
+var ORG_ARGUMENT = {
+  name: "org",
+  description: "Organization slug to run against, e.g. `morpho`.",
+  required: true
+};
+var PROMPTS = [
+  {
+    name: "org_healthcheck",
+    title: "Organization healthcheck",
+    description: "Audit one organization across the whole pipeline \u2014 detection, reviewing, blocklisting, takedowns \u2014 and report what needs attention.",
+    arguments: [ORG_ARGUMENT],
+    tools: [
+      "healthchecks_list",
+      "detection_configs_list",
+      "operations_queues_snapshot",
+      "organization_reports_list",
+      "metrics_breakdown"
+    ],
+    template: `Run a full healthcheck on the ChainPatrol organization \`{{org}}\`, covering the pipeline end to end: detection -> reviewing -> blocklisting -> takedowns.
+
+**How to run it**
+
+1. Call \`healthchecks_list\` first. It returns every check the platform exposes, which are implemented, and each one's default thresholds. Run every implemented check \u2014 they are independent, so fire them concurrently. The list describes the platform, not this session: if a check has no matching tool available to you, skip it and say so in the summary rather than reporting it as a failure.
+2. Alongside those, gather the qualitative signals the automated checks do not cover:
+   - \`detection_configs_list\` \u2014 what is enabled, disabled, or not configured at all.
+   - \`operations_queues_snapshot\` \u2014 the raw review and takedown queue counts.
+   - \`organization_reports_list\` with \`reportedByCustomer: true\` \u2014 threats the customer found that detection missed. Each one is a detection gap worth naming.
+   - \`metrics_breakdown\` by day \u2014 volume shifts that no single threshold catches.
+
+**How to report it**
+
+Narrate as you go; do not batch everything to the end. Before each check, one short sentence saying what you are checking. As soon as it returns, one line starting with a status word and ending in the number that matters:
+
+- \`DONE\` \u2014 ran cleanly, nothing to flag
+- \`WARN\` \u2014 a soft signal worth a human's eye
+- \`FAIL\` \u2014 a concrete failure to act on
+
+Then close with a Summary: one line per check, followed by a "Top issues" list in priority order, each with its concrete next action.`
+  },
+  {
+    name: "trend_search",
+    title: "Trend search",
+    description: "Compare a recent window against a baseline for one organization to surface spikes \u2014 new attack channels, campaigns, or targeting \u2014 before they become healthcheck failures.",
+    arguments: [
+      ORG_ARGUMENT,
+      {
+        name: "days",
+        description: "Length of the current window in days. Defaults to 7.",
+        required: false
+      }
+    ],
+    tools: ["metrics_breakdown", "metrics_found", "organization_brands_list"],
+    template: `Search for trends in the ChainPatrol organization \`{{org}}\` over the last {{days}} days.
+
+Trend search asks what has *changed*, so it compares rates rather than grading absolute counts against thresholds. A trend is worth reporting even when the pipeline is keeping up with it.
+
+**Windows**
+
+Use two non-overlapping windows: a current window of {{days}} days, and a baseline of the prior 90 days ending the day before the current window starts. For every bucket:
+
+    current_per_day  = current_count  / current_window_days
+    baseline_per_day  = baseline_count / baseline_window_days
+    ratio             = current_per_day / max(baseline_per_day, epsilon)
+
+Flag a bucket when \`ratio >= 2\` **and** \`current_count >= 5\`. The floor keeps a single new report on a quiet organization from reading as a spike.
+
+**Run these three concurrently**
+
+1. **By asset type** \u2014 \`metrics_breakdown\` for both windows, broken out by asset type. Catches a new attack channel.
+2. **Overall volume** \u2014 \`metrics_found\` daily for roughly six weeks, so the baseline and the spike are visible in one series.
+3. **By sub-brand** \u2014 \`metrics_breakdown\` for both windows by brand, and \`organization_brands_list\` to name them. Employee brands spiking usually means targeted impersonation.
+
+**Report**
+
+For each flagged bucket: the bucket, current vs. baseline per-day rate, the ratio, and the absolute count. Then say what it most likely means and what to do about it. If nothing clears both thresholds, say so plainly and give the largest ratio you saw.`
+  },
+  {
+    name: "cs_weekly_health",
+    title: "Weekly customer-success sweep",
+    description: "The packaged weekly customer health review: threats found, summary metrics, and whether the detectors are actually producing.",
+    arguments: [ORG_ARGUMENT],
+    tools: ["metrics_summary", "metrics_found", "detection_configs_validate"],
+    template: `Produce the weekly customer-success health package for \`{{org}}\`, covering the current week to date.
+
+Gather concurrently:
+
+1. \`metrics_summary\` for the week \u2014 the headline numbers.
+2. \`metrics_found\` for the week \u2014 what was discovered, and through which channel.
+3. \`detection_configs_validate\` over a 168-hour lookback with a minimum of 1 result \u2014 which detectors produced nothing and are therefore silently broken.
+
+Report the headline metrics first, then any detector that failed validation, and finish with the one thing most worth a human's attention this week. If every detector passed and the metrics look ordinary, say that in a sentence rather than padding the report.`
+  }
+];
+function renderPrompt(prompt, args) {
+  const defaults = { days: "7" };
+  return prompt.template.replace(/\{\{(\w+)\}\}/g, (_match, name) => {
+    const provided = args[name];
+    if (typeof provided === "string" && provided !== "") return provided;
+    if (typeof provided === "number" || typeof provided === "boolean") {
+      return provided.toString();
+    }
+    const fallback = defaults[name];
+    if (fallback !== void 0) return fallback;
+    const argument = prompt.arguments.find((item) => item.name === name);
+    if (argument?.required) {
+      throw new Error(`Prompt "${prompt.name}" requires the "${name}" argument.`);
+    }
+    return "";
+  });
+}
+function selectPrompts(prompts, available) {
+  const exposed = new Set(available);
+  return prompts.filter((prompt) => prompt.tools.every((tool) => exposed.has(tool)));
+}
+
+// src/resources.ts
+function buildResources(manifest2, tools = manifest2.tools) {
+  const exposed = new Set(tools.map((tool) => tool.name));
+  const resources = [];
+  for (const definition of manifest2.enums) {
+    const usedBy = definition.usedBy.filter((site) => exposed.has(toolNameOf(site)));
+    if (usedBy.length === 0) continue;
+    resources.push({
+      uri: `chainpatrol://enums/${definition.name}`,
+      name: definition.name,
+      title: `Accepted values: ${definition.name}`,
+      description: `Every value accepted for ${definition.name} (${definition.values.length} total). Referenced by ${usedBy.join(", ")}.`,
+      mimeType: "text/plain",
+      text: definition.values.join("\n")
+    });
+  }
+  for (const glossary of manifest2.glossaries) {
+    if (!exposed.has(toolNameOf(glossary.title))) continue;
+    const name = glossary.uri.split("/").pop() ?? glossary.uri;
+    resources.push({
+      uri: glossary.uri,
+      name,
+      title: `Guide: ${name.replace(/-/g, " ")}`,
+      description: `What each value means, for ${glossary.title}.`,
+      mimeType: "text/markdown",
+      text: glossary.text
+    });
+  }
+  resources.sort((a, b) => a.uri.localeCompare(b.uri));
+  return resources;
+}
+function toolNameOf(site) {
+  const dot = site.indexOf(".");
+  return dot === -1 ? site : site.slice(0, dot);
+}
+
+// src/invoker.ts
+var ToolInvocationError = class extends Error {
+  status;
+  details;
+  constructor(message, options) {
+    super(message, options?.cause === void 0 ? void 0 : { cause: options.cause });
+    this.name = "ToolInvocationError";
+    this.status = options?.status;
+    this.details = options?.details;
+  }
+};
+
+// src/server.ts
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import {
+  CallToolRequestSchema,
+  GetPromptRequestSchema,
+  ListPromptsRequestSchema,
+  ListResourcesRequestSchema,
+  ListToolsRequestSchema,
+  ReadResourceRequestSchema
+} from "@modelcontextprotocol/sdk/types.js";
+
+// src/generated/tools.json
+var tools_default = {
+  manifestVersion: 1,
+  tools: [
+    {
+      name: "asset_changelog",
+      procedure: "assetChangelog",
+      method: "POST",
+      path: "/asset/changelog",
+      pathParams: [],
+      title: "Asset changelog",
+      description: "Asset changelog. Assets can be changed for various reasons, such as false positives, false negatives or normal reviews.",
+      tags: [
+        "asset"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          type: {
+            type: "string",
+            description: "Asset type One of 92 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
+          },
+          content: {
+            type: "string",
+            description: "Asset content"
+          },
+          fromStatus: {
+            type: "string",
+            enum: [
+              "UNKNOWN",
+              "ALLOWED",
+              "BLOCKED"
+            ],
+            description: "Status of the changed assets to retrieve"
+          },
+          toStatus: {
+            type: "string",
+            enum: [
+              "UNKNOWN",
+              "ALLOWED",
+              "BLOCKED"
+            ],
+            description: "Status of the changed assets to retrieve"
+          },
+          startDate: {
+            allOf: [
+              {
+                type: "string",
+                pattern: "^\\d{4}-\\d{2}-\\d{2}$"
+              },
+              {
+                type: "string",
+                format: "date-time"
+              }
+            ],
+            description: "The start date to list items from. This should be in the format `YYYY-MM-DD` and is inclusive."
+          },
+          endDate: {
+            allOf: [
+              {
+                type: "string",
+                pattern: "^\\d{4}-\\d{2}-\\d{2}$"
+              },
+              {
+                type: "string",
+                format: "date-time"
+              }
+            ],
+            description: "The end date to list items from. This should be in the format `YYYY-MM-DD` and is inclusive."
+          }
+        },
+        description: "List asset request body\n\nDefaults to getting all the updates in the last 1 day.\n\nYou can also choose a `startDate` and `endDate` for the range of asset updates, most \ntimestamp formats should work, we use [Luxon](https://moment.github.io/luxon/#/parsing) \nfor parsing the dates."
+      }
+    },
+    {
+      name: "asset_check",
+      procedure: "assetCheck",
+      method: "POST",
+      path: "/asset/check",
+      pathParams: [],
+      title: "Check asset",
+      description: "Answers 'is this asset known to be malicious?'. Takes one piece of content \u2014 a URL, domain, social handle, app listing, or wallet address \u2014 and returns its status (`BLOCKED`, `ALLOWED`, or `UNKNOWN`), the source that decided it, the reason, and the per-source breakdown. Use it when you have a specific asset in hand. To search the blocklist by pattern instead, use `/asset/search`; to find whether a report already exists for an asset, use `/reports/search`.",
+      tags: [
+        "asset"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          content: {
+            type: "string",
+            description: "Asset content. Could be a domain, URL, or crypto address."
+          }
+        },
+        required: [
+          "content"
+        ],
+        description: "Check asset request body"
+      }
+    },
+    {
+      name: "asset_details",
+      procedure: "assetDetails",
+      method: "POST",
+      path: "/asset/details",
+      pathParams: [],
+      title: "Get Asset Details",
+      description: "Deprecated \u2014 prefer `/asset/check`, which returns the same status plus the deciding source and per-source breakdown. Answers 'what is this asset's status, and which report set it?'. Returns the status, the reason (`report` for a ChainPatrol report, `eth-phishing-detect` for that list), and the id and link of the report behind the latest status change.",
+      tags: [
+        "asset"
+      ],
+      readOnly: true,
+      deprecated: true,
+      inputSchema: {
+        type: "object",
+        properties: {
+          content: {
+            type: "string",
+            description: "Asset content"
+          }
+        },
+        required: [
+          "content"
+        ],
+        description: "Get asset details request body"
+      }
+    },
+    {
+      name: "asset_list",
+      procedure: "assetList",
+      method: "POST",
+      path: "/asset/list",
+      pathParams: [],
+      title: "List assets",
+      description: "Answers 'which assets of this type does ChainPatrol hold at this status?'. Returns a paginated list for one asset type, defaulting to `BLOCKED`, optionally narrowed to a date range. Built for bulk export and sync \u2014 pass `next_page` from the previous response to continue. To check one specific asset, use `/asset/check` instead; for an organization's own monitored assets, use `/organization/assets`.",
+      tags: [
+        "asset"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          type: {
+            type: "string",
+            description: "Asset type One of 92 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
+          },
+          status: {
+            type: "string",
+            enum: [
+              "UNKNOWN",
+              "ALLOWED",
+              "BLOCKED"
+            ],
+            default: "BLOCKED",
+            description: "Status of the assets to retrieve"
+          },
+          startDate: {
+            type: "string",
+            description: "The start date to list assets from. This should be in the format `YYYY-MM-DD` and is inclusive."
+          },
+          endDate: {
+            type: "string",
+            description: "The end date to list assets from. This should be in the format `YYYY-MM-DD` and is inclusive."
+          },
+          per_page: {
+            type: "integer",
+            minimum: 1,
+            maximum: 1e4,
+            default: 100,
+            description: "The number of assets to return per page"
+          },
+          next_page: {
+            anyOf: [
+              {
+                anyOf: [
+                  {
+                    not: {}
+                  },
+                  {
+                    type: "string"
+                  }
+                ]
+              },
+              {
+                type: "null"
+              }
+            ],
+            description: "Cursor for fetching the next page of results"
+          }
+        },
+        required: [
+          "type"
+        ],
+        description: "List asset request body\n\nDefaults to getting all the updates in the last 1 day.\n\nYou can also choose a `startDate` and `endDate` for the range of asset updates, most \ntimestamp formats should work, we use [Luxon](https://moment.github.io/luxon/#/parsing) \nfor parsing the dates."
+      }
+    },
+    {
+      name: "asset_parse",
+      procedure: "assetParse",
+      method: "POST",
+      path: "/asset/parse",
+      pathParams: [],
+      title: "Parse Asset",
+      description: "Parse and normalize asset content to extract structured information",
+      tags: [
+        "asset"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          content: {
+            type: "string",
+            minLength: 1,
+            description: "The asset content to parse (URL, address, etc.)"
+          }
+        },
+        required: [
+          "content"
+        ],
+        description: "Parse asset request body"
+      }
+    },
+    {
+      name: "asset_scan_live",
+      procedure: "assetScanLive",
+      method: "POST",
+      path: "/asset/scan",
+      pathParams: [],
+      title: "Start an asset scan with optional webhook callback",
+      description: "Initiate an asset scan. Optionally provide an organization slug for brand impersonation detection and a callback URL to receive results when the scan completes.",
+      tags: [
+        "asset"
+      ],
+      readOnly: false,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          asset: {
+            type: "string",
+            description: "The asset URL or content to scan"
+          },
+          organizationSlug: {
+            type: "string",
+            description: "Optional: Org slug for brand impersonation & visual similarity rules"
+          },
+          mode: {
+            type: "string",
+            enum: [
+              "fast",
+              "full"
+            ],
+            default: "full",
+            description: "Scan mode"
+          },
+          callbackUrl: {
+            type: "string",
+            format: "uri",
+            description: "HTTPS URL to receive scan results when complete"
+          }
+        },
+        required: [
+          "asset"
+        ]
+      }
+    },
+    {
+      name: "asset_search",
+      procedure: "assetSearch",
+      method: "POST",
+      path: "/asset/search",
+      pathParams: [],
+      title: "Search asset",
+      description: "Search for an asset by content or ID and get its status, associated reports, and takedown details",
+      tags: [
+        "asset"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          content: {
+            type: "string",
+            description: "Asset content to search for (URL, domain, address, etc.)"
+          },
+          assetId: {
+            type: "integer",
+            description: "Asset ID to search for"
+          },
+          assetIds: {
+            type: "array",
+            items: {
+              type: "integer"
+            },
+            description: "Multiple asset IDs to search for in bulk"
+          }
+        },
+        description: "Asset search request body"
+      }
+    },
+    {
+      name: "asset_submit",
+      procedure: "assetSubmit",
+      method: "POST",
+      path: "/asset/submit",
+      pathParams: [],
+      title: "Submit assets to process and assign to organization(s)",
+      description: "Submit a list of assets such as domains, social profiles, or blockchain addresses. Automation will classify and assign them to appropriate organization(s).",
+      tags: [
+        "asset"
+      ],
+      readOnly: false,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          assets: {
+            type: "array",
+            items: {
+              type: "string"
+            },
+            maxItems: 100,
+            description: "List of assets to classify, such as domains, social profiles, or blockchain addresses."
+          },
+          organizationSlug: {
+            type: "string",
+            description: "Organization slug to classify assets for. If not provided, the classification will be done for all organizations."
+          }
+        },
+        required: [
+          "assets"
+        ]
+      }
+    },
+    {
+      name: "asset_unblock",
+      procedure: "assetUnblock",
+      method: "POST",
+      path: "/asset/unblock",
+      pathParams: [],
+      title: "Unblock an asset",
+      description: "Unblock an asset if it belongs to your organization, or create a dispute if it doesn't. Requires API key.",
+      tags: [
+        "asset"
+      ],
+      readOnly: false,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          content: {
+            type: "string",
+            minLength: 1
+          },
+          reason: {
+            type: "string"
+          }
+        },
+        required: [
+          "content"
+        ]
+      }
+    },
+    {
+      name: "blocklist_confirm",
+      procedure: "blocklistConfirm",
+      method: "POST",
+      path: "/asset/blocklist/confirm",
+      pathParams: [],
+      title: "Confirm blocklist prefix matches",
+      description: "Given a list of 4-byte (8-hex-char) hash prefixes and the algorithm version, returns the full SHA-256 hashes of blocked expressions whose prefixes match, grouped by prefix. Used by the browser extension to resolve true positives after a local prefix hit.",
+      tags: [
+        "asset"
+      ],
+      readOnly: false,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          algoVersion: {
+            type: "integer",
+            exclusiveMinimum: 0
+          },
+          prefixes: {
+            type: "array",
+            items: {
+              type: "string",
+              pattern: "^[0-9a-f]{8}$"
+            },
+            minItems: 1,
+            maxItems: 200
+          }
+        },
+        required: [
+          "algoVersion",
+          "prefixes"
+        ],
+        description: "Blocklist confirm request"
+      }
+    },
+    {
+      name: "blocklist_version",
+      procedure: "blocklistVersion",
+      method: "GET",
+      path: "/asset/blocklist/version",
+      pathParams: [],
+      title: "Get blocklist version",
+      description: "Returns the current blocklist snapshot and recent-additions feed metadata (tokens, counts, absolute CDN URLs) and the canonicalization algorithm version. Used by the browser extension to discover and cache blocklist artifacts.",
+      tags: [
+        "asset"
+      ],
+      readOnly: true,
+      deprecated: false,
+      acceptsNoInput: true,
+      inputSchema: {
+        type: "object",
+        properties: {}
+      }
+    },
+    {
+      name: "detection_configs_create",
+      procedure: "detectionConfigsCreate",
+      method: "POST",
+      path: "/detection/configs/create",
+      pathParams: [],
+      title: "Create threat detection config",
+      description: "Create a config that makes a detection source run for an organization. Sources that are disabled by default have no config, so they cannot be enabled through /detection/configs/update until one is created. A source can have several configs, each with its own query, schedule or brand.",
+      tags: [
+        "detection"
+      ],
+      readOnly: false,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          slug: {
+            type: "string",
+            minLength: 1,
+            description: "Organization slug. Defaults to the organization your API key is scoped to, so you only need this when authenticating with a key that spans organizations."
+          },
+          source: {
+            type: "string",
+            description: "Detection source key, from `GET /detection/sources`. The source must support the `organization` scope; global-only sources cannot be configured per organization. One of 55 values, e.g. meta_ads_search, telegram_channels_search, telegram_user_search, telegram_channels_search_vetric, telegram_user_search_vetric, facebook_page_search_vetric, facebook_user_search_vetric, instagram_account_search_vetric. Full list: resource chainpatrol://enums/source"
+          },
+          status: {
+            type: "string",
+            enum: [
+              "ENABLED",
+              "DEPRECATED_EVALUATE",
+              "DISABLED"
+            ],
+            default: "ENABLED",
+            description: "Status to create the config with. Defaults to `ENABLED`."
+          },
+          title: {
+            type: "string",
+            description: "Optional label for this config"
+          },
+          description: {
+            anyOf: [
+              {
+                type: "string"
+              },
+              {
+                type: "null"
+              }
+            ],
+            description: "Optional human-readable description of what the config does"
+          },
+          cron: {
+            anyOf: [
+              {
+                type: "string"
+              },
+              {
+                type: "null"
+              }
+            ],
+            description: "Optional custom CRON schedule. Only accepted for sources that run on a schedule; the source's default schedule is used when omitted."
+          },
+          config: {
+            type: "object",
+            additionalProperties: {},
+            description: "Source-specific configuration, validated against that source's `configSchema` from `GET /detection/sources`. When omitted the source's schema defaults are applied."
+          },
+          brandId: {
+            anyOf: [
+              {
+                type: "integer",
+                exclusiveMinimum: 0
+              },
+              {
+                type: "null"
+              }
+            ],
+            description: "Optional brand to scope this config to. The brand must belong to the same organization. Omit for an organization-wide config."
+          }
+        },
+        required: [
+          "source"
+        ],
+        description: "Create a threat detection config\n\nCreates the config row that makes a detection source run for your organization. Sources that are disabled by default have no config row, so they cannot be enabled through `/detection/configs/update` until one exists.\n\nA source can have several configs, each scanning with its own query, schedule or brand. Use `title` to tell them apart."
+      }
+    },
+    {
+      name: "detection_configs_delete",
+      procedure: "detectionConfigsDelete",
+      method: "POST",
+      path: "/detection/configs/delete",
+      pathParams: [],
+      title: "Delete threat detection config",
+      description: "Delete one detection config so it stops scanning. Other configs sharing the same source keep running. Deleting the last config for a source that is enabled by default is not permanent, since automation re-creates it; disable it through /detection/configs/update instead.",
+      tags: [
+        "detection"
+      ],
+      readOnly: false,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          slug: {
+            type: "string",
+            minLength: 1,
+            description: "Organization slug. Defaults to the organization your API key is scoped to, so you only need this when authenticating with a key that spans organizations."
+          },
+          configId: {
+            type: "integer",
+            exclusiveMinimum: 0,
+            description: "ID of the config to delete, from `/detection/configs/list`"
+          }
+        },
+        required: [
+          "configId"
+        ],
+        description: "Delete a threat detection config\n\nDeletes one detection config so it stops scanning. Deleting a config that shares a source with others leaves the others running.\n\nDeleting the *last* config for a source that is enabled by default for your organization is not permanent: automation re-creates a default config for that source on its next run. To stop such a source durably, set `status` to `DISABLED` through `/detection/configs/update` instead, which automation will not override."
+      }
+    },
+    {
+      name: "detection_configs_list",
+      procedure: "detectionConfigsList",
+      method: "POST",
+      path: "/detection/configs/list",
+      pathParams: [],
+      title: "List threat detection configs for organization",
+      description: "List all threat detection sources for an organization. Each source includes its individual configurations with details like schedule, status, and source-specific settings.",
+      tags: [
+        "detection"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          slug: {
+            type: "string",
+            description: "Organization slug"
+          }
+        },
+        required: [
+          "slug"
+        ]
+      }
+    },
+    {
+      name: "detection_configs_run",
+      procedure: "detectionConfigsRun",
+      method: "POST",
+      path: "/detection/configs/run",
+      pathParams: [],
+      title: "Run detection configs on demand",
+      description: "Run one or many organization detection configs and return run status per config.",
+      tags: [
+        "detection"
+      ],
+      readOnly: false,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          slug: {
+            type: "string",
+            minLength: 1
+          },
+          configId: {
+            type: "integer",
+            exclusiveMinimum: 0
+          },
+          source: {
+            type: "string",
+            minLength: 1
+          },
+          includeDisabled: {
+            type: "boolean",
+            default: false
+          }
+        },
+        required: [
+          "slug"
+        ]
+      }
+    },
+    {
+      name: "detection_configs_update",
+      procedure: "detectionConfigsUpdate",
+      method: "POST",
+      path: "/detection/configs/update",
+      pathParams: [],
+      title: "Update threat detection config",
+      description: "Update an organization threat detection config status, schedule, and config fields.",
+      tags: [
+        "detection"
+      ],
+      readOnly: false,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          slug: {
+            type: "string",
+            minLength: 1
+          },
+          configId: {
+            type: "integer",
+            exclusiveMinimum: 0
+          },
+          status: {
+            type: "string",
+            enum: [
+              "ENABLED",
+              "DEPRECATED_EVALUATE",
+              "DISABLED"
+            ]
+          },
+          title: {
+            type: "string"
+          },
+          description: {
+            anyOf: [
+              {
+                type: "string"
+              },
+              {
+                type: "null"
+              }
+            ]
+          },
+          cron: {
+            anyOf: [
+              {
+                type: "string"
+              },
+              {
+                type: "null"
+              }
+            ]
+          },
+          config: {
+            type: "object",
+            additionalProperties: {}
+          },
+          mergeConfig: {
+            type: "boolean",
+            default: false
+          },
+          brandId: {
+            anyOf: [
+              {
+                type: "integer",
+                exclusiveMinimum: 0
+              },
+              {
+                type: "null"
+              }
+            ],
+            description: "Optional brand connection for this detection config. Pass null to clear the link. Only valid for org-scoped configs; the brand must belong to the same organization."
+          }
+        },
+        required: [
+          "slug",
+          "configId"
+        ]
+      }
+    },
+    {
+      name: "detection_configs_validate",
+      procedure: "detectionConfigsValidate",
+      method: "POST",
+      path: "/detection/configs/validate",
+      pathParams: [],
+      title: "Validate detection config health",
+      description: "Validate detection configs by checking recent detection results, optionally running each config first.",
+      tags: [
+        "detection"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          slug: {
+            type: "string",
+            minLength: 1
+          },
+          source: {
+            type: "string"
+          },
+          minResults: {
+            type: "integer",
+            minimum: 0,
+            default: 1
+          },
+          lookbackHours: {
+            type: "integer",
+            minimum: 1,
+            default: 168
+          },
+          runBeforeValidate: {
+            type: "boolean",
+            default: false
+          },
+          includeDisabled: {
+            type: "boolean",
+            default: false
+          }
+        },
+        required: [
+          "slug"
+        ]
+      }
+    },
+    {
+      name: "detection_drift",
+      procedure: "detectionDrift",
+      method: "POST",
+      path: "/detection/drift",
+      pathParams: [],
+      title: "Get detection drift signals",
+      description: "Analyze organization detection configs and surface zero-result, noisy-source, and stale-query drift signals.",
+      tags: [
+        "detection"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          slug: {
+            type: "string",
+            minLength: 1
+          },
+          lookbackHours: {
+            type: "integer",
+            exclusiveMinimum: 0,
+            default: 168
+          },
+          startDate: {
+            type: "string",
+            format: "date-time"
+          },
+          endDate: {
+            type: "string",
+            format: "date-time"
+          },
+          source: {
+            type: "string",
+            minLength: 1
+          },
+          configIds: {
+            type: "array",
+            items: {
+              type: "integer",
+              exclusiveMinimum: 0
+            }
+          },
+          includeDisabled: {
+            type: "boolean",
+            default: false
+          },
+          thresholds: {
+            type: "object",
+            properties: {
+              zeroResultsMaxHours: {
+                type: "integer",
+                exclusiveMinimum: 0,
+                default: 72
+              },
+              noisyResultsPerDay: {
+                type: "number",
+                exclusiveMinimum: 0,
+                default: 100
+              },
+              noisyAllowedRatioThreshold: {
+                type: "number",
+                minimum: 0,
+                maximum: 1,
+                default: 0.6
+              },
+              staleConfigDays: {
+                type: "integer",
+                exclusiveMinimum: 0,
+                default: 30
+              }
+            }
+          }
+        },
+        required: [
+          "slug"
+        ]
+      }
+    },
+    {
+      name: "detection_list",
+      procedure: "detectionList",
+      method: "POST",
+      path: "/detection/list",
+      pathParams: [],
+      title: "List threat detection results for organization",
+      description: "List threat detection results for an organization using API key authentication. Returns human-readable confidence levels (none, low, medium, high) and report status. Supports filtering by source, confidence level, asset status, and asset type. Includes pagination and search capabilities.",
+      tags: [
+        "detection"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          slug: {
+            type: "string",
+            description: "Organization slug"
+          },
+          cursor: {
+            type: "number",
+            description: "Cursor for pagination"
+          },
+          limit: {
+            type: "number",
+            minimum: 1,
+            maximum: 100,
+            default: 50,
+            description: "Number of results to return"
+          },
+          filters: {
+            type: "array",
+            description: "Filters to apply to the results. Each clause filters on one property. Accepted values per property \u2014 `source`: One of 55 values, e.g. meta_ads_search, telegram_channels_search, telegram_user_search, telegram_channels_search_vetric, telegram_user_search_vetric, facebook_page_search_vetric, facebook_user_search_vetric, instagram_account_search_vetric. Full list: resource chainpatrol://enums/source; `confidence`: none, low, medium, high; `liveness`: UNKNOWN, ALIVE, DEAD; `watchlist`: ENABLED, DISABLED; `assetStatus`: UNKNOWN, ALLOWED, BLOCKED; `reported`: reported, not_reported; `assetType`: One of 92 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type; `brand`: number values; `deleted`: string values; `countryCode`: string values.",
+            items: {
+              type: "object",
+              properties: {
+                property: {
+                  type: "string",
+                  enum: [
+                    "source",
+                    "confidence",
+                    "liveness",
+                    "watchlist",
+                    "assetStatus",
+                    "reported",
+                    "assetType",
+                    "brand",
+                    "deleted",
+                    "countryCode"
+                  ]
+                },
+                operator: {
+                  type: "string",
+                  enum: [
+                    "in",
+                    "notIn"
+                  ]
+                },
+                value: {
+                  type: "array",
+                  items: {
+                    anyOf: [
+                      {
+                        type: "number"
+                      },
+                      {
+                        type: "string"
+                      }
+                    ]
+                  }
+                }
+              },
+              required: [
+                "property",
+                "operator",
+                "value"
+              ]
+            }
+          },
+          query: {
+            type: "string",
+            default: "",
+            description: "Search query for threat content"
+          },
+          startDate: {
+            type: "string",
+            format: "date-time",
+            description: "Start date for filtering results"
+          },
+          endDate: {
+            type: "string",
+            format: "date-time",
+            description: "End date for filtering results"
+          }
+        },
+        required: [
+          "slug"
+        ]
+      }
+    },
+    {
+      name: "detection_sources_list",
+      procedure: "detectionSourcesList",
+      method: "GET",
+      path: "/detection/sources",
+      pathParams: [],
+      title: "List available threat detection sources",
+      description: "List the catalog of threat detection sources ChainPatrol can run, including the scopes each source supports and the JSON Schema its config object must satisfy. Sources that do not apply to the organization's industry are omitted.",
+      tags: [
+        "detection"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          slug: {
+            type: "string",
+            minLength: 1,
+            description: "Organization slug. Defaults to the organization your API key is scoped to, so you only need this when authenticating with a key that spans organizations. Sources that do not apply to the organization's industry are omitted."
+          }
+        },
+        description: "List available threat detection sources\n\nReturns the catalog of detection sources ChainPatrol can run, including the scopes each source supports and the JSON Schema its `config` object must satisfy. Use this to discover valid `source` keys before creating or updating a detection config."
+      }
+    },
+    {
+      name: "dispute_create",
+      procedure: "disputeCreate",
+      method: "POST",
+      path: "/dispute/create",
+      pathParams: [],
+      title: "Create a dispute",
+      description: "Create a new dispute for an asset via the external API. Requires API key.",
+      tags: [
+        "dispute"
+      ],
+      readOnly: false,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          content: {
+            type: "string",
+            minLength: 1
+          },
+          email: {
+            type: "string",
+            format: "email"
+          },
+          description: {
+            type: "string"
+          }
+        },
+        required: [
+          "content"
+        ]
+      }
+    },
+    {
+      name: "get_organization_reports",
+      procedure: "getOrganizationReports",
+      method: "POST",
+      path: "/public/getOrganizationReports",
+      pathParams: [],
+      title: "Get reports for an organization",
+      description: "Get reports for an organization based on organization slug and filters",
+      tags: [
+        "public"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          slug: {
+            type: "string"
+          },
+          limit: {
+            type: "number",
+            minimum: 1,
+            maximum: 20
+          },
+          cursor: {
+            anyOf: [
+              {
+                type: "number"
+              },
+              {
+                type: "null"
+              }
+            ]
+          },
+          status: {
+            type: "string",
+            enum: [
+              "TODO",
+              "IN_PROGRESS",
+              "CLOSED"
+            ]
+          },
+          searchQuery: {
+            type: "string"
+          },
+          reporterQuery: {
+            type: "string"
+          },
+          excludeAutomation: {
+            type: "boolean",
+            default: false
+          },
+          reporterKind: {
+            type: "string",
+            enum: [
+              "human",
+              "automation"
+            ]
+          },
+          reviewerKind: {
+            type: "string",
+            enum: [
+              "human",
+              "automation"
+            ]
+          },
+          onlyRejected: {
+            type: "boolean",
+            default: false
+          },
+          onlyFavorited: {
+            type: "boolean",
+            default: false
+          },
+          reviewStatuses: {
+            type: "array",
+            items: {
+              type: "string",
+              enum: [
+                "APPROVE",
+                "REJECT",
+                "SKIP",
+                "ESCALATE"
+              ]
+            }
+          },
+          assetTypes: {
+            type: "array",
+            items: {
+              type: "string",
+              description: "One of 92 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
+            }
+          },
+          reviewedByUserId: {
+            anyOf: [
+              {
+                type: "number"
+              },
+              {
+                type: "null"
+              }
+            ]
+          },
+          startDate: {
+            type: "string",
+            format: "date-time"
+          },
+          endDate: {
+            type: "string",
+            format: "date-time"
+          },
+          updatedAtStartDate: {
+            type: "string",
+            format: "date-time"
+          },
+          updatedAtEndDate: {
+            type: "string",
+            format: "date-time"
+          },
+          brandIds: {
+            type: "array",
+            items: {
+              type: "number"
+            }
+          },
+          threatActorIds: {
+            type: "array",
+            items: {
+              type: "number"
+            }
+          },
+          reportedByCustomer: {
+            type: "boolean"
+          },
+          countryCodes: {
+            type: "array",
+            items: {
+              type: "string",
+              minLength: 2,
+              maxLength: 2
+            }
+          },
+          registrars: {
+            type: "array",
+            items: {
+              type: "string"
+            }
+          },
+          hasMxRecords: {
+            type: "boolean"
+          },
+          sources: {
+            type: "array",
+            items: {
+              type: "string",
+              enum: [
+                "APP",
+                "API",
+                "CANARY_TOKEN",
+                "AUTO_DETECTION",
+                "ASSET_MANAGEMENT"
+              ]
+            }
+          },
+          needsCustomerReview: {
+            type: "boolean",
+            description: "Filter to reports waiting on the organization's own approval \u2014 the same queue the Review page shows a customer admin. `true` returns only reports with at least one pending proposal that is the customer's to action; `false` returns only reports that are not. A pending proposal counts when ChainPatrol staff escalated it to the customer and the customer has not answered yet, or when the organization submitted the report itself. Obligatory Organization Admin Approval does not widen this: an untriaged proposal is still waiting on ChainPatrol review, and reaches the customer only once staff escalate it."
+          }
+        },
+        required: [
+          "slug",
+          "limit"
+        ]
+      }
+    },
+    {
+      name: "get_public_organization_metrics",
+      procedure: "getPublicOrganizationMetrics",
+      method: "POST",
+      path: "/public/getOrganizationMetrics",
+      pathParams: [],
+      title: "Get public metrics for organizations",
+      description: "Get public metrics for one or more organizations",
+      tags: [
+        "public"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          organizationSlug: {
+            type: "string"
+          },
+          brandSlug: {
+            type: "string"
+          },
+          startDate: {
+            type: "string",
+            format: "date-time"
+          },
+          endDate: {
+            type: "string",
+            format: "date-time"
+          }
+        },
+        required: [
+          "organizationSlug"
+        ]
+      }
+    },
+    {
+      name: "healthchecks_assets_dead_asset_spike",
+      procedure: "healthchecksAssetsDeadAssetSpike",
+      method: "POST",
+      path: "/healthchecks/assets/dead-asset-spike",
+      pathParams: [],
+      title: "Healthcheck: spike in recently dead assets",
+      description: "Compares the count of `DETECTED_AS_DEAD` LivenessStatusEvent rows in the current window against the baseline rate from the prior `baselineDays`. Severity fires only when the current count clears `minSpikeCount` (suppresses noise when the org has near-zero baseline activity) and exceeds the configured multiplier. Useful for catching liveness-checker regressions after platform changes (captcha rollouts, anti-bot updates) which falsely mark live assets as dead.",
+      tags: [
+        "healthchecks"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          slug: {
+            type: "string",
+            minLength: 1
+          },
+          windowHours: {
+            type: "integer",
+            exclusiveMinimum: 0,
+            default: 24
+          },
+          baselineDays: {
+            type: "integer",
+            exclusiveMinimum: 0,
+            default: 7
+          },
+          warnMultiplier: {
+            type: "number",
+            exclusiveMinimum: 0,
+            default: 2
+          },
+          failMultiplier: {
+            type: "number",
+            exclusiveMinimum: 0,
+            default: 4
+          },
+          minSpikeCount: {
+            type: "integer",
+            minimum: 1,
+            default: 10
+          }
+        },
+        required: [
+          "slug"
+        ]
+      }
+    },
+    {
+      name: "healthchecks_detections_silent_configs",
+      procedure: "healthchecksDetectionsSilentConfigs",
+      method: "POST",
+      path: "/healthchecks/detections/silent-configs",
+      pathParams: [],
+      title: "Healthcheck: detection configs producing recent results",
+      description: "Validates that each enabled detection config has produced at least the configured minimum number of results within the lookback window. Returns the uniform healthcheck result shape.",
+      tags: [
+        "healthchecks"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          slug: {
+            type: "string",
+            minLength: 1
+          },
+          source: {
+            type: "string"
+          },
+          minResults: {
+            type: "integer",
+            minimum: 0,
+            default: 1
+          },
+          lookbackHours: {
+            type: "integer",
+            minimum: 1,
+            default: 168
+          },
+          runBeforeValidate: {
+            type: "boolean",
+            default: false
+          },
+          includeDisabled: {
+            type: "boolean",
+            default: false
+          }
+        },
+        required: [
+          "slug"
+        ]
+      }
+    },
+    {
+      name: "healthchecks_list",
+      procedure: "healthchecksList",
+      method: "POST",
+      path: "/healthchecks/list",
+      pathParams: [],
+      title: "List available healthchecks",
+      description: "Return the registry of healthchecks ChainPatrol exposes today, including planned checks that are not yet implemented on the backend. Clients should iterate this list and only call endpoints where `implemented` is true.",
+      tags: [
+        "healthchecks"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {}
+      }
+    },
+    {
+      name: "healthchecks_missing_contact_url",
+      procedure: "healthchecksMissingContactUrl",
+      method: "POST",
+      path: "/healthchecks/organization/missing-contact-url",
+      pathParams: [],
+      title: "Healthcheck: missing main contact URL / communication channel",
+      description: "Flags organizations that have no contactUrl configured. The contact URL is the main communication channel (typically Slack or Telegram) used to reach the customer.",
+      tags: [
+        "healthchecks"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          slug: {
+            type: "string",
+            minLength: 1
+          }
+        },
+        required: [
+          "slug"
+        ]
+      }
+    },
+    {
+      name: "healthchecks_reviewing_backlog",
+      procedure: "healthchecksReviewingBacklog",
+      method: "POST",
+      path: "/healthchecks/reviewing/backlog",
+      pathParams: [],
+      title: "Healthcheck: pile-up of unreviewed proposals",
+      description: "Counts proposals in PENDING review state for the org and grades severity (ok/warn/fail) against the configurable thresholds.",
+      tags: [
+        "healthchecks"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          slug: {
+            type: "string",
+            minLength: 1
+          },
+          warnThreshold: {
+            type: "integer",
+            minimum: 0,
+            default: 50
+          },
+          failThreshold: {
+            type: "integer",
+            minimum: 0,
+            default: 100
+          }
+        },
+        required: [
+          "slug"
+        ]
+      }
+    },
+    {
+      name: "healthchecks_reviewing_old_proposals",
+      procedure: "healthchecksReviewingOldProposals",
+      method: "POST",
+      path: "/healthchecks/reviewing/old-proposals",
+      pathParams: [],
+      title: "Healthcheck: proposals waiting too long in review",
+      description: "Counts PENDING proposals older than the warn / fail age thresholds (default 7 / 14 days) and lists the oldest offenders.",
+      tags: [
+        "healthchecks"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          slug: {
+            type: "string",
+            minLength: 1
+          },
+          warnAgeHours: {
+            type: "integer",
+            exclusiveMinimum: 0,
+            default: 168
+          },
+          failAgeHours: {
+            type: "integer",
+            exclusiveMinimum: 0,
+            default: 336
+          }
+        },
+        required: [
+          "slug"
+        ]
+      }
+    },
+    {
+      name: "healthchecks_takedowns_automation_off",
+      procedure: "healthchecksTakedownsAutomationOff",
+      method: "POST",
+      path: "/healthchecks/takedowns/automation-off",
+      pathParams: [],
+      title: "Healthcheck: automated takedowns disabled for too long",
+      description: "Flags orgs where takedown service is enabled but `isAutomatedTakedownsActive` has been off for longer than the configured age threshold (default warn 30 days, fail 60 days). Age is derived from the most recent SERVICES_AUTOMATED_TAKEDOWNS_UPDATED entry in OrganizationEvent, falling back to Organization.updatedAt. Orgs without takedown service enabled at all are excluded.",
+      tags: [
+        "healthchecks"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          slug: {
+            type: "string",
+            minLength: 1
+          },
+          warnAgeHours: {
+            type: "integer",
+            minimum: 0,
+            default: 720
+          },
+          failAgeHours: {
+            type: "integer",
+            minimum: 0,
+            default: 1440
+          }
+        },
+        required: [
+          "slug"
+        ]
+      }
+    },
+    {
+      name: "healthchecks_takedowns_cancelled_count",
+      procedure: "healthchecksTakedownsCancelledCount",
+      method: "POST",
+      path: "/healthchecks/takedowns/cancelled-count",
+      pathParams: [],
+      title: "Healthcheck: excess CANCELLED takedowns over a rolling window",
+      description: "Counts transitions into the CANCELLED status from the TakedownEvent log within the configured lookback window. Cancellations should be rare (typically 0-2 per week); a higher count usually signals a quality problem in the proposal funnel or a misuse of the CANCELLED status.",
+      tags: [
+        "healthchecks"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          slug: {
+            type: "string",
+            minLength: 1
+          },
+          lookbackHours: {
+            type: "integer",
+            exclusiveMinimum: 0,
+            default: 168
+          },
+          warnThreshold: {
+            type: "integer",
+            minimum: 0,
+            default: 3
+          },
+          failThreshold: {
+            type: "integer",
+            minimum: 0,
+            default: 10
+          }
+        },
+        required: [
+          "slug"
+        ]
+      }
+    },
+    {
+      name: "healthchecks_takedowns_in_progress_volume",
+      procedure: "healthchecksTakedownsInProgressVolume",
+      method: "POST",
+      path: "/healthchecks/takedowns/in-progress-volume",
+      pathParams: [],
+      title: "Healthcheck: pile-up of IN_PROGRESS takedowns",
+      description: "Counts takedowns currently IN_PROGRESS for the org regardless of age. Complements `takedowns.stale-in-progress` (which only flags items past a staleness threshold) \u2014 a high overall pile-up signals submission-format or vendor-side issues even when individual items are not yet stale.",
+      tags: [
+        "healthchecks"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          slug: {
+            type: "string",
+            minLength: 1
+          },
+          warnThreshold: {
+            type: "integer",
+            minimum: 0,
+            default: 30
+          },
+          failThreshold: {
+            type: "integer",
+            minimum: 0,
+            default: 75
+          }
+        },
+        required: [
+          "slug"
+        ]
+      }
+    },
+    {
+      name: "healthchecks_takedowns_stale_in_progress",
+      procedure: "healthchecksTakedownsStaleInProgress",
+      method: "POST",
+      path: "/healthchecks/takedowns/stale-in-progress",
+      pathParams: [],
+      title: "Healthcheck: stuck IN_PROGRESS takedowns",
+      description: "Counts takedowns that have sat in IN_PROGRESS past the staleness threshold (default 7 days) and lists the oldest offenders.",
+      tags: [
+        "healthchecks"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          slug: {
+            type: "string",
+            minLength: 1
+          },
+          staleThresholdHours: {
+            type: "integer",
+            exclusiveMinimum: 0,
+            default: 168
+          },
+          warnThreshold: {
+            type: "integer",
+            minimum: 0,
+            default: 1
+          },
+          failThreshold: {
+            type: "integer",
+            minimum: 0,
+            default: 5
+          }
+        },
+        required: [
+          "slug"
+        ]
+      }
+    },
+    {
+      name: "healthchecks_takedowns_todo_volume",
+      procedure: "healthchecksTakedownsTodoVolume",
+      method: "POST",
+      path: "/healthchecks/takedowns/todo-volume",
+      pathParams: [],
+      title: "Healthcheck: pile-up of TODO takedowns",
+      description: "Counts takedowns sitting in TODO status for the org. A backlog typically signals either an automation gap on a new threat surface, or manual-filing capacity issues on the takedown team.",
+      tags: [
+        "healthchecks"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          slug: {
+            type: "string",
+            minLength: 1
+          },
+          warnThreshold: {
+            type: "integer",
+            minimum: 0,
+            default: 50
+          },
+          failThreshold: {
+            type: "integer",
+            minimum: 0,
+            default: 100
+          }
+        },
+        required: [
+          "slug"
+        ]
+      }
+    },
+    {
+      name: "metrics_breakdown",
+      procedure: "metricsBreakdown",
+      method: "POST",
+      path: "/metrics/breakdown",
+      pathParams: [],
+      title: "Get organization metrics breakdown",
+      description: "Get blocked threat counts grouped by day, asset type, or brand.",
+      tags: [
+        "metrics"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          slug: {
+            type: "string",
+            minLength: 1
+          },
+          by: {
+            type: "string",
+            enum: [
+              "day",
+              "type",
+              "brand"
+            ]
+          },
+          startDate: {
+            type: "string",
+            format: "date-time"
+          },
+          endDate: {
+            type: "string",
+            format: "date-time"
+          },
+          brandIds: {
+            type: "array",
+            items: {
+              type: "integer",
+              exclusiveMinimum: 0
+            }
+          }
+        },
+        required: [
+          "slug",
+          "by"
+        ]
+      }
+    },
+    {
+      name: "metrics_found",
+      procedure: "metricsFound",
+      method: "POST",
+      path: "/metrics/found",
+      pathParams: [],
+      title: "Get found threats count",
+      description: "Return the default 'found' metric for an organization, defined as customer-facing new threats.",
+      tags: [
+        "metrics"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          slug: {
+            type: "string",
+            minLength: 1
+          },
+          startDate: {
+            type: "string",
+            format: "date-time"
+          },
+          endDate: {
+            type: "string",
+            format: "date-time"
+          },
+          brandIds: {
+            type: "array",
+            items: {
+              type: "integer",
+              exclusiveMinimum: 0
+            }
+          }
+        },
+        required: [
+          "slug",
+          "startDate",
+          "endDate"
+        ]
+      }
+    },
+    {
+      name: "metrics_found_by_source",
+      procedure: "metricsFoundBySource",
+      method: "POST",
+      path: "/metrics/found-by-source",
+      pathParams: [],
+      title: "Get currently blocked threats by first-report source",
+      description: "Count distinct currently blocked assets whose earliest report for the organization falls in the date range, split into customer vs ChainPatrol (staff + automation). Blocked is current status or pending BLOCKED, not blockedAt. This does not equal /metrics/found.",
+      tags: [
+        "metrics"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          slug: {
+            type: "string",
+            minLength: 1,
+            description: "Organization slug"
+          },
+          startDate: {
+            type: "string",
+            format: "date-time",
+            description: "Only include assets whose earliest report was created on or after this date. A date-only value (YYYY-MM-DD) starts at midnight UTC"
+          },
+          endDate: {
+            type: "string",
+            format: "date-time",
+            description: "Only include assets whose earliest report was created on or before this date. A date-only value (YYYY-MM-DD) covers the whole day in UTC; pass a full timestamp for a precise cut-off"
+          },
+          brandIds: {
+            type: "array",
+            items: {
+              type: "integer",
+              exclusiveMinimum: 0
+            },
+            description: "Only include assets belonging to these brands"
+          }
+        },
+        required: [
+          "slug",
+          "startDate",
+          "endDate"
+        ]
+      }
+    },
+    {
+      name: "metrics_summary",
+      procedure: "metricsSummary",
+      method: "POST",
+      path: "/metrics/summary",
+      pathParams: [],
+      title: "Get organization metrics summary",
+      description: "Get customer-facing organization metrics and blocked threat breakdowns for a date range.",
+      tags: [
+        "metrics"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          slug: {
+            type: "string",
+            minLength: 1
+          },
+          startDate: {
+            type: "string",
+            format: "date-time"
+          },
+          endDate: {
+            type: "string",
+            format: "date-time"
+          },
+          brandIds: {
+            type: "array",
+            items: {
+              type: "integer",
+              exclusiveMinimum: 0
+            }
+          }
+        },
+        required: [
+          "slug"
+        ]
+      }
+    },
+    {
+      name: "metrics_takedown_success_rate",
+      procedure: "metricsTakedownSuccessRate",
+      method: "POST",
+      path: "/metrics/takedown-success-rate",
+      pathParams: [],
+      title: "Get organization takedown success rate by asset type",
+      description: "Get the share of takedowns that ended in a removal, broken down by asset type, for a date range. The range bounds when a takedown was first submitted to a provider, so takedowns opened but never filed are excluded; outcomes are read as of now, and takedowns still being worked count against the rate.",
+      tags: [
+        "metrics"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          slug: {
+            type: "string",
+            minLength: 1,
+            description: "Organization slug"
+          },
+          startDate: {
+            type: "string",
+            format: "date-time",
+            description: "Only include takedowns first submitted to a provider on or after this date. A date-only value (YYYY-MM-DD) starts at midnight UTC"
+          },
+          endDate: {
+            type: "string",
+            format: "date-time",
+            description: "Only include takedowns first submitted to a provider on or before this date. A date-only value (YYYY-MM-DD) covers the whole day in UTC; pass a full timestamp for a precise cut-off"
+          },
+          blockLabel: {
+            type: "string",
+            description: 'Only include assets blocked with this review label, e.g. "Brand Impersonation", "Employee Impersonation" or "Targeting Org Users"'
+          },
+          brandType: {
+            type: "string",
+            enum: [
+              "INDIVIDUAL",
+              "ORGANIZATION",
+              "PRODUCT"
+            ],
+            description: "Only include assets belonging to brands of this type"
+          },
+          countryCodes: {
+            type: "array",
+            items: {
+              type: "string",
+              minLength: 2,
+              maxLength: 2
+            },
+            description: "Only include assets scanned from these ISO 3166-1 alpha-2 countries"
+          },
+          brandIds: {
+            type: "array",
+            items: {
+              type: "integer",
+              exclusiveMinimum: 0
+            },
+            description: "Only include assets belonging to these brands"
+          }
+        },
+        required: [
+          "slug"
+        ]
+      }
+    },
+    {
+      name: "metrics_takedown_time",
+      procedure: "metricsTakedownTime",
+      method: "POST",
+      path: "/metrics/takedown-time",
+      pathParams: [],
+      title: "Get organization time-to-takedown metrics",
+      description: "Get the median time from takedown start to completion, broken down by asset type, for a date range.",
+      tags: [
+        "metrics"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          slug: {
+            type: "string",
+            minLength: 1,
+            description: "Organization slug"
+          },
+          startDate: {
+            type: "string",
+            format: "date-time",
+            description: "Only include takedowns completed on or after this date. A date-only value (YYYY-MM-DD) starts at midnight UTC"
+          },
+          endDate: {
+            type: "string",
+            format: "date-time",
+            description: "Only include takedowns completed on or before this date. A date-only value (YYYY-MM-DD) covers the whole day in UTC; pass a full timestamp for a precise cut-off"
+          },
+          blockLabel: {
+            type: "string",
+            description: 'Only include assets blocked with this review label, e.g. "Brand Impersonation", "Employee Impersonation" or "Targeting Org Users"'
+          },
+          brandType: {
+            type: "string",
+            enum: [
+              "INDIVIDUAL",
+              "ORGANIZATION",
+              "PRODUCT"
+            ],
+            description: "Only include assets belonging to brands of this type"
+          },
+          countryCodes: {
+            type: "array",
+            items: {
+              type: "string",
+              minLength: 2,
+              maxLength: 2
+            },
+            description: "Only include assets scanned from these ISO 3166-1 alpha-2 countries"
+          },
+          brandIds: {
+            type: "array",
+            items: {
+              type: "integer",
+              exclusiveMinimum: 0
+            },
+            description: "Only include assets belonging to these brands"
+          }
+        },
+        required: [
+          "slug"
+        ]
+      }
+    },
+    {
+      name: "metrics_takedown_time_by_provider",
+      procedure: "metricsTakedownTimeByProvider",
+      method: "POST",
+      path: "/metrics/takedown-time/by-provider",
+      pathParams: [],
+      title: "Get organization time-to-takedown metrics by provider",
+      description: "Get the median time from takedown start to completion, broken down by the provider a takedown was filed against, for a date range. Each takedown is counted once per provider role it carries (hosting provider, domain registrar, TLD registrar).",
+      tags: [
+        "metrics"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          slug: {
+            type: "string",
+            minLength: 1,
+            description: "Organization slug"
+          },
+          startDate: {
+            type: "string",
+            format: "date-time",
+            description: "Only include takedowns completed on or after this date. A date-only value (YYYY-MM-DD) starts at midnight UTC"
+          },
+          endDate: {
+            type: "string",
+            format: "date-time",
+            description: "Only include takedowns completed on or before this date. A date-only value (YYYY-MM-DD) covers the whole day in UTC; pass a full timestamp for a precise cut-off"
+          },
+          roles: {
+            type: "array",
+            items: {
+              type: "string",
+              enum: [
+                "HOSTING_PROVIDER",
+                "DOMAIN_REGISTRAR",
+                "TLD_REGISTRAR"
+              ]
+            },
+            description: "Only break down these provider roles. Omit for every role. A takedown filed against both a host and a registrar is counted once under each"
+          },
+          blockLabel: {
+            type: "string",
+            description: 'Only include assets blocked with this review label, e.g. "Brand Impersonation", "Employee Impersonation" or "Targeting Org Users"'
+          },
+          brandType: {
+            type: "string",
+            enum: [
+              "INDIVIDUAL",
+              "ORGANIZATION",
+              "PRODUCT"
+            ],
+            description: "Only include assets belonging to brands of this type"
+          },
+          countryCodes: {
+            type: "array",
+            items: {
+              type: "string",
+              minLength: 2,
+              maxLength: 2
+            },
+            description: "Only include assets scanned from these ISO 3166-1 alpha-2 countries"
+          },
+          brandIds: {
+            type: "array",
+            items: {
+              type: "integer",
+              exclusiveMinimum: 0
+            },
+            description: "Only include assets belonging to these brands"
+          }
+        },
+        required: [
+          "slug"
+        ]
+      }
+    },
+    {
+      name: "metrics_takedown_time_trend",
+      procedure: "metricsTakedownTimeTrend",
+      method: "POST",
+      path: "/metrics/takedown-time/trend",
+      pathParams: [],
+      title: "Get organization time-to-takedown trends",
+      description: "Get the median time from takedown start to completion bucketed by the month a takedown completed, over a trailing window of whole months, together with the month-over-month change. Returns one series per requested asset type, or a single pooled series.",
+      tags: [
+        "metrics"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          slug: {
+            type: "string",
+            minLength: 1,
+            description: "Organization slug"
+          },
+          months: {
+            type: "integer",
+            minimum: 2,
+            maximum: 36,
+            default: 12,
+            description: "Size of the trailing window in whole months, including the current month"
+          },
+          assetTypes: {
+            type: "array",
+            items: {
+              type: "string",
+              description: "One of 92 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
+            },
+            maxItems: 5,
+            description: "Break the trend down by these asset types, one series each. Omit for a single series pooled across every asset type"
+          },
+          blockLabel: {
+            type: "string",
+            description: 'Only include assets blocked with this review label, e.g. "Brand Impersonation", "Employee Impersonation" or "Targeting Org Users"'
+          },
+          brandType: {
+            type: "string",
+            enum: [
+              "INDIVIDUAL",
+              "ORGANIZATION",
+              "PRODUCT"
+            ],
+            description: "Only include assets belonging to brands of this type"
+          },
+          countryCodes: {
+            type: "array",
+            items: {
+              type: "string",
+              minLength: 2,
+              maxLength: 2
+            },
+            description: "Only include assets scanned from these ISO 3166-1 alpha-2 countries"
+          },
+          brandIds: {
+            type: "array",
+            items: {
+              type: "integer",
+              exclusiveMinimum: 0
+            },
+            description: "Only include assets belonging to these brands"
+          }
+        },
+        required: [
+          "slug"
+        ]
+      }
+    },
+    {
+      name: "operations_queues_snapshot",
+      procedure: "operationsQueuesSnapshot",
+      method: "POST",
+      path: "/operations/queues/snapshot",
+      pathParams: [],
+      title: "Get operations queue snapshot",
+      description: "Return pending review and takedown queue state with SLA and age buckets for operational monitoring.",
+      tags: [
+        "operations"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          slug: {
+            type: "string",
+            minLength: 1
+          },
+          all: {
+            type: "boolean",
+            default: false
+          },
+          windowHours: {
+            type: "integer",
+            exclusiveMinimum: 0,
+            default: 168
+          }
+        }
+      }
+    },
+    {
+      name: "organization_asset_groups_create",
+      procedure: "organizationAssetGroupsCreate",
+      method: "POST",
+      path: "/organization/asset-groups",
+      pathParams: [],
+      title: "Create asset group",
+      description: "Create a new asset group for organizing your organization's assets.",
+      tags: [
+        "organization"
+      ],
+      readOnly: false,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          name: {
+            type: "string",
+            minLength: 1,
+            maxLength: 255,
+            description: "Name for the new group"
+          }
+        },
+        required: [
+          "name"
+        ],
+        description: "Create a new asset group\n\nCreates a new asset group for organizing your organization's assets."
+      }
+    },
+    {
+      name: "organization_asset_groups_delete",
+      procedure: "organizationAssetGroupsDelete",
+      method: "DELETE",
+      path: "/organization/asset-groups/{groupId}",
+      pathParams: [
+        "groupId"
+      ],
+      title: "Delete asset group",
+      description: "Delete an asset group. Assets in this group will become ungrouped.",
+      tags: [
+        "organization"
+      ],
+      readOnly: false,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          groupId: {
+            type: "integer",
+            exclusiveMinimum: 0,
+            description: "ID of the group to delete"
+          }
+        },
+        required: [
+          "groupId"
+        ],
+        description: "Delete an asset group\n\nDeletes an asset group. Assets in this group will become ungrouped."
+      }
+    },
+    {
+      name: "organization_asset_groups_list",
+      procedure: "organizationAssetGroupsList",
+      method: "GET",
+      path: "/organization/asset-groups",
+      pathParams: [],
+      title: "List organization asset groups",
+      description: "List all asset groups belonging to your organization with asset counts.",
+      tags: [
+        "organization"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {},
+        description: "List organization asset groups\n\nReturns all asset groups belonging to the organization associated with your API key."
+      }
+    },
+    {
+      name: "organization_asset_groups_update",
+      procedure: "organizationAssetGroupsUpdate",
+      method: "PATCH",
+      path: "/organization/asset-groups/{groupId}",
+      pathParams: [
+        "groupId"
+      ],
+      title: "Update asset group",
+      description: "Rename an existing asset group.",
+      tags: [
+        "organization"
+      ],
+      readOnly: false,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          groupId: {
+            type: "integer",
+            exclusiveMinimum: 0,
+            description: "ID of the group to update"
+          },
+          name: {
+            type: "string",
+            minLength: 1,
+            maxLength: 255,
+            description: "New name for the group"
+          }
+        },
+        required: [
+          "groupId",
+          "name"
+        ],
+        description: "Update an asset group\n\nRename an existing asset group."
+      }
+    },
+    {
+      name: "organization_assets_add",
+      procedure: "organizationAssetsAdd",
+      method: "POST",
+      path: "/organization/assets",
+      pathParams: [],
+      title: "Add assets to organization allowlist",
+      description: "Batch add multiple assets to your organization's allowlist. Each asset will be automatically parsed, classified, and approved as ALLOWED status. Supports optional group assignment.",
+      tags: [
+        "organization"
+      ],
+      readOnly: false,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          assets: {
+            type: "array",
+            items: {
+              type: "object",
+              properties: {
+                content: {
+                  type: "string",
+                  description: "Asset content (URL, address, handle, etc.)"
+                },
+                name: {
+                  type: "string",
+                  description: "Optional display name for the asset"
+                },
+                description: {
+                  type: "string",
+                  description: "Optional description for the asset"
+                },
+                groupId: {
+                  type: "integer",
+                  exclusiveMinimum: 0,
+                  description: "Optional group ID to assign the asset to"
+                }
+              },
+              required: [
+                "content"
+              ]
+            },
+            minItems: 1,
+            maxItems: 1e3,
+            description: "Array of assets to add (max 1000 per request)"
+          }
+        },
+        required: [
+          "assets"
+        ],
+        description: "Add assets to organization allowlist\n\nBatch add multiple assets to your organization's allowlist. \nEach asset will be automatically parsed and classified.\nAssets will be auto-approved as ALLOWED status."
+      }
+    },
+    {
+      name: "organization_assets_delete",
+      procedure: "organizationAssetsDelete",
+      method: "DELETE",
+      path: "/organization/assets/{assetId}",
+      pathParams: [
+        "assetId"
+      ],
+      title: "Remove asset from organization",
+      description: "Remove an asset from your organization's allowlist. This performs a soft delete.",
+      tags: [
+        "organization"
+      ],
+      readOnly: false,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          assetId: {
+            type: "integer",
+            exclusiveMinimum: 0,
+            description: "ID of the asset to remove"
+          }
+        },
+        required: [
+          "assetId"
+        ],
+        description: "Remove an asset from the organization\n\nThis removes the asset from the organization's allowlist."
+      }
+    },
+    {
+      name: "organization_assets_list",
+      procedure: "organizationAssetsList",
+      method: "GET",
+      path: "/organization/assets",
+      pathParams: [],
+      title: "List organization assets",
+      description: "List all assets belonging to your organization with optional filtering by type, group, and search query. Supports pagination.",
+      tags: [
+        "organization"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          slug: {
+            type: "string",
+            description: "Organization slug. Optional for organization-scoped API keys, which resolve the organization from the key itself. Required when your credentials can reach more than one organization."
+          },
+          type: {
+            type: "string",
+            description: "Filter by asset type (URL, ADDRESS, etc.) One of 92 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
+          },
+          groupId: {
+            type: "integer",
+            description: "Filter by group ID. Use -1 for ungrouped assets only. Omit for all assets."
+          },
+          query: {
+            type: "string",
+            description: "Search query to filter assets by content"
+          },
+          per_page: {
+            type: "integer",
+            minimum: 1,
+            maximum: 1e3,
+            default: 100,
+            description: "The number of assets to return per page (max 1000)"
+          },
+          next_page: {
+            anyOf: [
+              {
+                anyOf: [
+                  {
+                    not: {}
+                  },
+                  {
+                    type: "string"
+                  }
+                ]
+              },
+              {
+                type: "null"
+              }
+            ],
+            description: "Cursor for fetching the next page of results"
+          }
+        },
+        description: "List organization assets request body\n\nReturns all assets belonging to the organization identified by `slug`, or \u2014\nwhen `slug` is omitted \u2014 the organization associated with your API key.\nSupports filtering by type, group, and search query."
+      }
+    },
+    {
+      name: "organization_assets_update",
+      procedure: "organizationAssetsUpdate",
+      method: "PATCH",
+      path: "/organization/assets/{assetId}",
+      pathParams: [
+        "assetId"
+      ],
+      title: "Update organization asset",
+      description: "Update an asset's name, description, or group assignment. The asset must belong to your organization.",
+      tags: [
+        "organization"
+      ],
+      readOnly: false,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          assetId: {
+            type: "integer",
+            exclusiveMinimum: 0,
+            description: "ID of the asset to update"
+          },
+          name: {
+            type: "string",
+            description: "New display name for the asset"
+          },
+          description: {
+            description: "New description for the asset",
+            anyOf: [
+              {
+                type: "string"
+              },
+              {
+                type: "null"
+              }
+            ]
+          },
+          groupId: {
+            anyOf: [
+              {
+                type: "integer",
+                exclusiveMinimum: 0
+              },
+              {
+                type: "null"
+              }
+            ],
+            description: "New group ID (null to ungroup)"
+          }
+        },
+        required: [
+          "assetId"
+        ],
+        description: "Update an organization asset\n\nUpdate the name, description, or group assignment of an asset."
+      }
+    },
+    {
+      name: "organization_brands_list",
+      procedure: "organizationBrandsList",
+      method: "GET",
+      path: "/organization/brands",
+      pathParams: [],
+      title: "List organization brands",
+      description: "List every brand belonging to the organization associated with your API key. Returns parent brands (`type: ORGANIZATION`), individual / employee brands (`type: INDIVIDUAL`), and product brands (`type: PRODUCT`) in one call, including configuration fields: `brandColors` (HEX strings), `includedTerms`, `excludedTerms`, `tickers`, `avatarUrl`, `websiteUrl`, and `twitterHandle`. Each brand also reports `useOrganizationDocs` (when true, the brand inherits its LOA/POA from the org), a `legalDocuments` block with the brand-level Letter of Authorization and Power of Attorney attachments (each `{ present, fileName, fileUrl }`), and `trademarkRegistrations` \u2014 every brand-level trademark on file with its issuing office, registration number, and (when uploaded) a `certificateFileUrl` link to the certificate PDF. Soft-deleted brands are excluded. Brand counts per organization are typically <500, so the endpoint returns the full set in one response (no pagination).",
+      tags: [
+        "organization"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {},
+        description: "List organization brands\n\nReturns all brands belonging to the organization associated with your API key,\nincluding sub-brands (`ORGANIZATION`), individual / employee brands\n(`INDIVIDUAL`), and product brands (`PRODUCT`). Soft-deleted brands are\nexcluded."
+      }
+    },
+    {
+      name: "organization_create",
+      procedure: "organizationCreate",
+      method: "POST",
+      path: "/organization/immunefi-create",
+      pathParams: [],
+      title: "Create a new baseline organization (Immunefi only)",
+      description: "Create a new organization with baseline configuration and return an API key for accessing ChainPatrol services. This endpoint requires authentication with a valid Immunefi API key. Organization slugs will be automatically prefixed with 'immunefi-' (or 'immunefi-test-' when using a test API key) to prevent name clashes. The endpoint validates that the requested slug doesn't conflict with any existing organizations (checking bare slug, 'immunefi-{slug}', and 'immunefi-test-{slug}' variations). The organization will be created with standard monitoring and detection features enabled. Returns the organization details, API key, owner information, and direct dashboard URL.",
+      tags: [
+        "organization",
+        "immunefi"
+      ],
+      readOnly: false,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          name: {
+            type: "string",
+            minLength: 1,
+            maxLength: 255
+          },
+          slug: {
+            type: "string",
+            minLength: 1,
+            maxLength: 100,
+            pattern: "^[a-z0-9]+(?:-[a-z0-9]+)*$"
+          },
+          websiteUrl: {
+            type: "string",
+            format: "uri"
+          },
+          description: {
+            type: "string",
+            maxLength: 1e3
+          },
+          ownerEmail: {
+            type: "string",
+            format: "email"
+          },
+          ownerFullName: {
+            type: "string",
+            minLength: 1,
+            maxLength: 255
+          }
+        },
+        required: [
+          "name",
+          "slug",
+          "ownerEmail",
+          "ownerFullName"
+        ]
+      }
+    },
+    {
+      name: "organization_metrics_get",
+      procedure: "organizationMetricsGet",
+      method: "GET",
+      path: "/organization/metrics",
+      pathParams: [],
+      title: "Get organization metrics",
+      description: "Get metrics for your organization with optional date range and brand filtering. Organization is determined from your API key.",
+      tags: [
+        "organization"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          organizationSlug: {
+            type: "string",
+            description: "Organization slug. Required when authenticating with a user session (Bearer token) and `slugs`/`allMyOrgs` are not supplied; ignored when using an org-scoped API key (org is derived from the key). Mutually exclusive with `slugs` and `allMyOrgs`."
+          },
+          slugs: {
+            type: "array",
+            items: {
+              type: "string"
+            },
+            maxItems: 500,
+            description: "Multi-org form. Each slug is auth-checked individually (org-scoped API keys may only pass their own org; sessions and user API keys must have membership or staff role per slug). When supplied with more than one slug, the response includes a `perOrg` breakdown plus `metrics` rolled up across all of them. Capped at 500 slugs per call. Mutually exclusive with `organizationSlug` and `allMyOrgs`."
+          },
+          allMyOrgs: {
+            type: "boolean",
+            description: "Shortcut for 'every org the caller is authorized to read'. Reuses the same filter logic as `/user/orgs`: org-scoped API keys are rejected (they're pinned to one org \u2014 use the default form); user API keys / Bearer sessions resolve to the user's memberships (or every active org for staff). Combine with `subscriptionStatus` and `services` to narrow (e.g. only paying customers with takedowns enabled). The resolved org set is still capped at 500 and a 413 is returned if exceeded. Mutually exclusive with `organizationSlug`, `slugs`, and `brandSlug`."
+          },
+          subscriptionStatus: {
+            type: "array",
+            items: {
+              type: "string",
+              enum: [
+                "PROSPECT",
+                "POC",
+                "ACTIVE",
+                "INTEGRATION",
+                "INACTIVE"
+              ]
+            },
+            minItems: 1,
+            description: "Only meaningful with `allMyOrgs: true`. Defaults to the same set `/user/orgs` uses (ACTIVE/POC/PROSPECT/INTEGRATION); pass INACTIVE explicitly to include churned organizations."
+          },
+          services: {
+            type: "object",
+            properties: {
+              reporting: {
+                type: "object",
+                properties: {
+                  active: {
+                    type: "boolean"
+                  }
+                }
+              },
+              reviewing: {
+                type: "object",
+                properties: {
+                  active: {
+                    type: "boolean"
+                  }
+                }
+              },
+              protection: {
+                type: "object",
+                properties: {
+                  active: {
+                    type: "boolean"
+                  }
+                }
+              },
+              takedowns: {
+                type: "object",
+                properties: {
+                  active: {
+                    type: "boolean"
+                  },
+                  automated: {
+                    type: "boolean"
+                  }
+                }
+              },
+              detection: {
+                type: "object",
+                properties: {
+                  active: {
+                    type: "boolean"
+                  }
+                }
+              },
+              darkWebMonitoring: {
+                type: "object",
+                properties: {
+                  active: {
+                    type: "boolean"
+                  }
+                }
+              }
+            },
+            description: "Only meaningful with `allMyOrgs: true`. Same shape as `/user/orgs`'s `services` filter \u2014 every service accepts `{ active }`, and **only `takedowns` additionally accepts `automated`** (the one service where manual-vs-automated changes real platform behavior). E.g. `{ takedowns: { active: true, automated: false } }` for 'orgs with takedowns enabled but automation off'."
+          },
+          brandSlug: {
+            type: "string"
+          },
+          startDate: {
+            type: "string",
+            format: "date-time"
+          },
+          endDate: {
+            type: "string",
+            format: "date-time"
+          },
+          include: {
+            type: "array",
+            items: {
+              type: "string",
+              enum: [
+                "reports",
+                "newThreats",
+                "threatsWatchlisted",
+                "takedownsFiled",
+                "takedownsInProgress",
+                "takedownsCompleted",
+                "takedownsCancelled",
+                "domainThreats",
+                "twitterThreats",
+                "telegramThreats",
+                "otherThreats",
+                "blockedByType",
+                "blockedByDay"
+              ]
+            },
+            description: "Subset of metrics to compute. When omitted or empty, every metric is computed (legacy behavior). Each value in `include` costs roughly one aggregate query, so narrow the list when an agent only needs a couple of numbers \u2014 this is the main lever for keeping big-org calls inside the 30s function cap. Fields not in `include` come back as `null`. `takedownsInProgress` and `takedownsCancelled` count takedowns currently in that status whose `updatedAt` falls in the window (same windowing as `takedownsFiled`), so they reconcile with the takedowns list filtered by status over the same date range."
+          }
+        }
+      }
+    },
+    {
+      name: "organization_proposals_review",
+      procedure: "organizationProposalsReview",
+      method: "POST",
+      path: "/organization/proposals/{proposalId}/review",
+      pathParams: [
+        "proposalId"
+      ],
+      title: "Review an organization proposal",
+      description: "Records your organization's decision on a proposal that is waiting on you \u2014 one ChainPatrol escalated to you, or one on a report you submitted yourself. These are exactly the proposals your Review page shows and the ones `GET /organization/reports?needsCustomerReview=true` counts; find their IDs in `proposals[].id` on that endpoint. `APPROVE` blocks the asset and takes a `label` (plus a `brandId` for labels that name a specific brand). `REJECT` takes a `rejectReason`. `WATCHLIST` rejects the proposal and parks the asset so it is re-evaluated if it comes back alive.\n\nPass `assetId` alongside `proposalId`; it must match the proposal's current asset or the request returns `409`, which keeps a caller from actioning a proposal it never read.\n\nApprovals are held to the same safety checks as the Review page, with no override: an asset that any enabled legitimacy rule marks as legitimate cannot be approved here, and an allowlisted asset cannot be blocked here. Both return `403` and must be handled on the Review page by a person.\n\nRate limited to 10 reviews per organization per day, since a review is not undoable and looping over a queue is easy to do by accident. Exceeding it returns `429`. The limit is shared across all of the organization's API credentials and does not apply to reviews made from the Review page.",
+      tags: [
+        "organization"
+      ],
+      readOnly: false,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          proposalId: {
+            type: "integer",
+            exclusiveMinimum: 0,
+            description: "ID of the proposal to review. Read it from `proposals[].id` on `GET /organization/reports`."
+          },
+          assetId: {
+            type: "integer",
+            exclusiveMinimum: 0,
+            description: "ID of the asset this proposal is for, from `proposals[].asset.id` on `GET /organization/reports`. Required, and must match the proposal's current asset \u2014 a mismatch returns 409. This proves the request was built from a proposal you actually read, rather than from a guessed or stale ID."
+          },
+          slug: {
+            type: "string",
+            description: "Organization slug. Optional for organization-scoped API keys, which resolve the organization from the key itself. Required when your credentials can reach more than one organization."
+          },
+          decision: {
+            type: "string",
+            enum: [
+              "APPROVE",
+              "REJECT",
+              "WATCHLIST"
+            ],
+            description: "What to do with the proposal. `APPROVE` blocks the asset, `REJECT` declines it, and `WATCHLIST` declines it but parks the asset so it is re-evaluated if it comes back alive. `WATCHLIST` is recorded as a rejection with the asset watchlisted \u2014 the same write the Review page performs."
+          },
+          label: {
+            type: "string",
+            enum: [
+              "Brand Impersonation",
+              "Employee Impersonation",
+              "Fake Employee",
+              "Targeting Org Users",
+              "General Phishing",
+              "C2 Server",
+              "False Positive",
+              "Organization Member Impersonation",
+              "Targeting Organization"
+            ],
+            description: "Why the asset is being blocked. Full guidance: resource chainpatrol://glossary/proposal-labels"
+          },
+          brandId: {
+            type: "integer",
+            exclusiveMinimum: 0,
+            description: "Brand the asset impersonates. Optional for most labels, but required for `Brand Impersonation` and `Employee Impersonation`, which name a specific impersonation target. List your brands with `GET /organization/brands`."
+          },
+          rejectReason: {
+            type: "string",
+            enum: [
+              "irrelevant",
+              "no_malicious_activity",
+              "insufficient_evidence",
+              "not_targeting_org",
+              "decayed"
+            ],
+            description: "Why the proposal is being rejected. Full guidance: resource chainpatrol://glossary/proposal-reject-reasons"
+          },
+          watchlistReason: {
+            type: "string",
+            enum: [
+              "DEAD",
+              "PARKING",
+              "NOT_ENOUGH_EVIDENCE",
+              "OTHER"
+            ],
+            description: "Why the asset is being parked. Full guidance: resource chainpatrol://glossary/proposal-watchlist-reasons"
+          },
+          note: {
+            type: "string",
+            maxLength: 1e3,
+            description: "Free-text detail recorded on the review, alongside the structured reason. Required when `watchlistReason` is `OTHER`."
+          }
+        },
+        required: [
+          "proposalId",
+          "assetId",
+          "decision"
+        ],
+        description: "Review a proposal on your organization's behalf\n\nRecords your organization's decision on a proposal ChainPatrol escalated to you\nand you have not answered yet. These are exactly the proposals your Review page\nshows, and the ones counted by\n`GET /organization/reports?needsCustomerReview=true`.\n\nProposals on reports your organization sourced itself are not reviewable here:\nChainPatrol triages those and staff approval blocks the asset on its own, so\nthere is no decision for you to record. They return `403`."
+      }
+    },
+    {
+      name: "organization_reports_list",
+      procedure: "organizationReportsList",
+      method: "GET",
+      path: "/organization/reports",
+      pathParams: [],
+      title: "List organization reports",
+      description: "Answers 'which of my organization's reports match these filters?'. Returns full report records \u2014 proposals, assets, scans, reporter, SLA \u2014 with filtering and pagination, newest first. The organization comes from your API key, or pass `slug` when your credentials can reach more than one. To check whether a report already exists for specific assets before filing a new one, use `POST /reports/search`, which looks reports up by asset content in a single batched call.",
+      tags: [
+        "organization"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          limit: {
+            type: "number",
+            minimum: 1,
+            maximum: 20
+          },
+          cursor: {
+            anyOf: [
+              {
+                type: "number"
+              },
+              {
+                type: "null"
+              }
+            ]
+          },
+          status: {
+            type: "string",
+            enum: [
+              "TODO",
+              "IN_PROGRESS",
+              "CLOSED"
+            ]
+          },
+          searchQuery: {
+            type: "string"
+          },
+          reporterQuery: {
+            type: "string"
+          },
+          reporterKind: {
+            type: "string",
+            enum: [
+              "human",
+              "automation"
+            ]
+          },
+          reviewerKind: {
+            type: "string",
+            enum: [
+              "human",
+              "automation"
+            ]
+          },
+          reviewedByUserId: {
+            anyOf: [
+              {
+                type: "number"
+              },
+              {
+                type: "null"
+              }
+            ]
+          },
+          startDate: {
+            type: "string",
+            format: "date-time"
+          },
+          endDate: {
+            type: "string",
+            format: "date-time"
+          },
+          updatedAtStartDate: {
+            type: "string",
+            format: "date-time"
+          },
+          updatedAtEndDate: {
+            type: "string",
+            format: "date-time"
+          },
+          registrars: {
+            type: "array",
+            items: {
+              type: "string"
+            }
+          },
+          hasMxRecords: {
+            type: "boolean"
+          },
+          slug: {
+            type: "string",
+            description: "Organization slug. Optional for organization-scoped API keys, which resolve the organization from the key itself. Required when your credentials can reach more than one organization."
+          },
+          excludeAutomation: {
+            type: "boolean",
+            default: false
+          },
+          onlyRejected: {
+            type: "boolean",
+            default: false
+          },
+          onlyFavorited: {
+            type: "boolean",
+            default: false
+          },
+          reportedByCustomer: {
+            type: "boolean"
+          },
+          needsCustomerReview: {
+            type: "boolean",
+            description: "Filter to reports waiting on your organization's own approval \u2014 the same queue your Review page shows. `true` returns only reports with at least one pending proposal that is yours to action; `false` returns only reports that are not. A pending proposal counts when ChainPatrol staff escalated it to you and you have not answered yet. Answering means approving, rejecting, or escalating it back to ChainPatrol. Two things do not put a report here: reports your organization sourced itself (ChainPatrol triages those and staff approval blocks the asset without you, though you still see them in the unfiltered list), and Obligatory Organization Admin Approval (a proposal ChainPatrol has not triaged yet is still waiting on our review, and reaches you only once staff escalate it)."
+          },
+          reviewStatuses: {
+            type: "array",
+            items: {
+              type: "string",
+              enum: [
+                "APPROVE",
+                "REJECT",
+                "SKIP",
+                "ESCALATE"
+              ]
+            }
+          },
+          assetTypes: {
+            type: "array",
+            items: {
+              type: "string",
+              description: "One of 92 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
+            }
+          },
+          brandIds: {
+            type: "array",
+            items: {
+              type: "number"
+            }
+          },
+          countryCodes: {
+            type: "array",
+            items: {
+              type: "string",
+              minLength: 2,
+              maxLength: 2
+            }
+          },
+          sources: {
+            type: "array",
+            items: {
+              type: "string",
+              enum: [
+                "APP",
+                "API",
+                "CANARY_TOKEN",
+                "AUTO_DETECTION",
+                "ASSET_MANAGEMENT"
+              ]
+            }
+          },
+          threatActorIds: {
+            type: "array",
+            items: {
+              type: "number"
+            }
+          }
+        },
+        required: [
+          "limit"
+        ]
+      }
+    },
+    {
+      name: "report_create",
+      procedure: "reportCreate",
+      method: "POST",
+      path: "/report/create",
+      pathParams: [],
+      title: "Create a report",
+      description: "Create a new report on ChainPatrol for a particular organization",
+      tags: [
+        "report"
+      ],
+      readOnly: false,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          organizationSlug: {
+            type: "string",
+            description: "Organization slug used to identify the organization on ChainPatrol"
+          },
+          discordGuildId: {
+            type: "string",
+            description: "Discord Guild (Server) ID linked to the organization on ChainPatrol"
+          },
+          telegramGroupId: {
+            type: "string",
+            description: "Telegram Group ID linked to the organization on ChainPatrol"
+          },
+          title: {
+            type: "string",
+            minLength: 3,
+            description: "Title of the report"
+          },
+          description: {
+            type: "string",
+            description: "Description of the report. Supports markdown"
+          },
+          contactInfo: {
+            type: "string",
+            description: "Optional reporter contact info. If this value is a phone number, include a country code in E.164 format (e.g. +14155552671)."
+          },
+          attachmentUrls: {
+            type: "array",
+            items: {
+              type: "string",
+              format: "uri"
+            },
+            description: "URLs of images to attach to the report"
+          },
+          externalSubmissionLink: {
+            type: "string",
+            format: "uri",
+            description: "Link to the external submission (e.g. Telegram message link)"
+          },
+          userAgent: {
+            type: "string",
+            description: "User agent string from the reporter's browser"
+          },
+          referrer: {
+            type: "string",
+            description: "Referrer URL from the reporter's browser"
+          },
+          assets: {
+            type: "array",
+            items: {
+              type: "object",
+              properties: {
+                content: {
+                  type: "string",
+                  description: "Asset content. If providing a phone number, include a country code in E.164 format (e.g. +14155552671)."
+                },
+                status: {
+                  type: "string",
+                  enum: [
+                    "UNKNOWN",
+                    "ALLOWED",
+                    "BLOCKED"
+                  ],
+                  default: "BLOCKED",
+                  description: "Proposed asset status (defaults to BLOCKED if not provided)"
+                },
+                reporterConfidence: {
+                  type: "string",
+                  enum: [
+                    "HIGH",
+                    "LOW"
+                  ],
+                  description: "Reporter confidence level (applies special handling for trusted reporters and superusers only)"
+                },
+                brandSlug: {
+                  type: "string",
+                  minLength: 1,
+                  description: "Optional suggested brand slug for this proposed blocked asset"
+                },
+                enrichments: {
+                  type: "array",
+                  items: {
+                    type: "object",
+                    properties: {
+                      type: {
+                        type: "string",
+                        description: "Enrichment type One of 39 values, e.g. content_and_metadata, browser_capture, ownership_and_registration, geolocation_and_ip, dns, tls, tcp, post. Full list: resource chainpatrol://enums/asset_scan_enrichment_type"
+                      },
+                      source: {
+                        type: "string",
+                        minLength: 1,
+                        description: "Enrichment source (e.g., extension)"
+                      },
+                      output: {
+                        type: "object",
+                        additionalProperties: {},
+                        description: "Enrichment output data"
+                      }
+                    },
+                    required: [
+                      "type",
+                      "source"
+                    ]
+                  },
+                  description: "Enrichments to attach to this asset"
+                }
+              },
+              required: [
+                "content"
+              ]
+            }
+          },
+          rawAssetsInput: {
+            type: "string"
+          },
+          externalReporter: {
+            type: "object",
+            properties: {
+              avatarUrl: {
+                type: "string",
+                format: "uri",
+                description: "URL of the external avatar"
+              },
+              platformIdentifier: {
+                type: "string",
+                description: "Unique identifier on the external platform"
+              },
+              platform: {
+                type: "string",
+                description: "External platform's name"
+              },
+              displayName: {
+                type: "string",
+                description: "User's public (mutable) display name"
+              }
+            },
+            required: [
+              "platformIdentifier",
+              "platform",
+              "displayName"
+            ]
+          }
+        },
+        required: [
+          "assets"
+        ]
+      }
+    },
+    {
+      name: "report_search_external",
+      procedure: "reportSearchExternal",
+      method: "POST",
+      path: "/reports/search",
+      pathParams: [],
+      title: "Look up reports by asset content",
+      description: "Answers 'do reports already exist for these specific assets?'. Takes a batch of asset contents, normalizes each one the way ChainPatrol normalizes assets, and returns the reports covering them along with which of your assets each report matched. Use it to avoid filing a duplicate before calling `POST /report/create`. To browse or filter an organization's reports instead \u2014 by status, asset type, brand, date, review state \u2014 use `GET /organization/reports`, which returns the full report records with pagination.",
+      tags: [
+        "reports"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          assetContents: {
+            type: "array",
+            items: {
+              type: "string"
+            },
+            description: "Asset contents to look up \u2014 URLs, handles, addresses. Each is normalized the way ChainPatrol normalizes assets, so `https://Bad.Site/` matches a report holding the canonical form."
+          },
+          slug: {
+            type: "string",
+            description: "Organization slug. Optional for organization-scoped API keys, which resolve the organization from the key itself. Required when your credentials can reach more than one organization."
+          },
+          reportedByCustomer: {
+            type: "boolean"
+          },
+          limit: {
+            type: "integer",
+            minimum: 1,
+            maximum: 100,
+            default: 50,
+            description: "Maximum number of reports to return, newest first. Defaults to 50, maximum 100. Compare with `totalCount` to tell whether the results were truncated."
+          }
+        },
+        required: [
+          "assetContents"
+        ]
+      }
+    },
+    {
+      name: "scan_results",
+      procedure: "scanResults",
+      method: "POST",
+      path: "/scan/result",
+      pathParams: [],
+      title: "Get scan results by scan ID",
+      description: "Get detailed scan results including enrichments, rules/checks results, and labels for a specific asset scan.",
+      tags: [
+        "scan"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          scanId: {
+            type: "number",
+            description: "The ID of the asset scan to retrieve results for"
+          },
+          workflowId: {
+            type: "string",
+            description: "Optional Temporal workflow ID to check if scan is still processing"
+          }
+        },
+        required: [
+          "scanId"
+        ]
+      }
+    },
+    {
+      name: "takedowns_list",
+      procedure: "takedownsList",
+      method: "POST",
+      path: "/takedowns/list",
+      pathParams: [],
+      title: "List takedowns",
+      description: "List takedowns for an organization. Authenticate with an API key (the org is derived from the key) or with a user session (pass `organizationSlug` in the request body).",
+      tags: [
+        "takedowns"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          organizationSlug: {
+            type: "string",
+            description: "Organization slug. Required when authenticating with a user session (Bearer token); ignored when using an API key (org is derived from the key)."
+          },
+          query: {
+            type: "string",
+            description: "Search query to filter takedowns by asset content"
+          },
+          startDate: {
+            type: "string",
+            description: "The start date to list takedowns from. This should be in the format `YYYY-MM-DD` and is inclusive."
+          },
+          endDate: {
+            type: "string",
+            description: "The end date to list takedowns to. This should be in the format `YYYY-MM-DD` and is inclusive."
+          },
+          assetType: {
+            type: "array",
+            items: {
+              type: "string",
+              description: "One of 92 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
+            },
+            description: "Filter by asset types"
+          },
+          takedownStatus: {
+            type: "array",
+            items: {
+              type: "string",
+              enum: [
+                "TODO",
+                "IN_PROGRESS",
+                "COMPLETED",
+                "CANCELLED",
+                "PENDING_RETRACTION",
+                "RETRACTION_SENT",
+                "RETRACTED",
+                "PENDING_INPUT",
+                "PENDING_EVIDENCE"
+              ]
+            },
+            description: "Filter by takedown status"
+          },
+          livenessStatus: {
+            type: "array",
+            items: {
+              type: "string",
+              enum: [
+                "UNKNOWN",
+                "ALIVE",
+                "DEAD"
+              ]
+            },
+            description: "Filter by liveness status"
+          },
+          brandIds: {
+            type: "array",
+            items: {
+              type: "integer",
+              exclusiveMinimum: 0
+            },
+            description: "Filter by brand IDs"
+          },
+          assigneeIds: {
+            type: "array",
+            items: {
+              type: "integer",
+              exclusiveMinimum: 0
+            },
+            description: "Filter by takedown assignee user IDs"
+          },
+          startedAtStartDate: {
+            type: "string",
+            description: "Inclusive start of the `takedown started at` date range, in YYYY-MM-DD or ISO 8601. A takedown's started-at is the earliest IN_PROGRESS status-change event."
+          },
+          startedAtEndDate: {
+            type: "string",
+            description: "Inclusive end of the `takedown started at` date range. Defaults to the current time when `startedAtStartDate` is provided alone."
+          },
+          hideAutomatedTakedowns: {
+            type: "boolean",
+            description: "Hide takedowns whose target asset type (or content) is handled by the automated platform-takedown pipeline (e.g. Telegram, Medium, *.webflow.io)."
+          },
+          hideAutomatedLivenessChecks: {
+            type: "boolean",
+            description: "Hide takedowns whose asset type (or content) is checked for liveness automatically (e.g. Twitter, Bluesky, *.gitbook.io)."
+          },
+          sorting: {
+            type: "array",
+            items: {
+              type: "object",
+              properties: {
+                key: {
+                  type: "string",
+                  enum: [
+                    "updatedAt",
+                    "createdAt",
+                    "takedownStatus",
+                    "takedownUpdatedAt",
+                    "assigneeId",
+                    "brandId"
+                  ],
+                  description: "Field to sort by"
+                },
+                direction: {
+                  type: "string",
+                  enum: [
+                    "asc",
+                    "desc"
+                  ],
+                  description: "Sort direction"
+                }
+              },
+              required: [
+                "key",
+                "direction"
+              ]
+            },
+            description: "Sorting configuration"
+          },
+          per_page: {
+            type: "integer",
+            minimum: 1,
+            maximum: 100,
+            default: 10,
+            description: "The number of takedowns to return per page"
+          },
+          next_page: {
+            anyOf: [
+              {
+                anyOf: [
+                  {
+                    not: {}
+                  },
+                  {
+                    type: "string"
+                  }
+                ]
+              },
+              {
+                type: "null"
+              }
+            ],
+            description: "Cursor for fetching the next page of results"
+          }
+        },
+        description: "List takedowns request body\n\nDefaults to getting all takedowns in the last 30 days.\n\nYou can also choose a `startDate` and `endDate` for the range of takedown updates, most \ntimestamp formats should work, we use [Luxon](https://moment.github.io/luxon/#/parsing) \nfor parsing the dates."
+      }
+    },
+    {
+      name: "threats_list",
+      procedure: "threatsList",
+      method: "POST",
+      path: "/threats/list",
+      pathParams: [],
+      title: "List threats",
+      description: "List threats for an organization using API key authentication",
+      tags: [
+        "threats"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          query: {
+            type: "string",
+            description: "Search query to filter threats by content"
+          },
+          startDate: {
+            type: "string",
+            description: "The start date to list threats from. This should be in the format `YYYY-MM-DD` and is inclusive."
+          },
+          endDate: {
+            type: "string",
+            description: "The end date to list threats to. This should be in the format `YYYY-MM-DD` and is inclusive."
+          },
+          assetType: {
+            type: "array",
+            items: {
+              type: "string",
+              description: "One of 92 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
+            },
+            description: "Filter by asset types"
+          },
+          sorting: {
+            type: "array",
+            items: {
+              type: "object",
+              properties: {
+                key: {
+                  type: "string",
+                  description: "Field to sort by"
+                },
+                direction: {
+                  type: "string",
+                  enum: [
+                    "asc",
+                    "desc"
+                  ],
+                  description: "Sort direction"
+                }
+              },
+              required: [
+                "key",
+                "direction"
+              ]
+            },
+            description: "Sorting configuration"
+          },
+          per_page: {
+            type: "integer",
+            minimum: 1,
+            maximum: 100,
+            default: 10,
+            description: "The number of threats to return per page"
+          },
+          next_page: {
+            anyOf: [
+              {
+                anyOf: [
+                  {
+                    not: {}
+                  },
+                  {
+                    type: "string"
+                  }
+                ]
+              },
+              {
+                type: "null"
+              }
+            ],
+            description: "Cursor for fetching the next page of results"
+          }
+        },
+        description: "List threats request body\n\nDefaults to getting all threats in the last 1 day.\n\nYou can also choose a `startDate` and `endDate` for the range of threat updates, most \ntimestamp formats should work, we use [Luxon](https://moment.github.io/luxon/#/parsing) \nfor parsing the dates."
+      }
+    },
+    {
+      name: "user_me",
+      procedure: "userMe",
+      method: "POST",
+      path: "/user/me",
+      pathParams: [],
+      title: "Get current user",
+      description: "Get details of currently logged in user",
+      tags: [
+        "user"
+      ],
+      readOnly: true,
+      deprecated: false,
+      acceptsNoInput: true,
+      inputSchema: {
+        type: "object",
+        properties: {}
+      }
+    },
+    {
+      name: "user_me_update",
+      procedure: "userMeUpdate",
+      method: "POST",
+      path: "/user/me/update",
+      pathParams: [],
+      title: "Update current user",
+      description: "Update the currently authenticated user's profile and settings",
+      tags: [
+        "user"
+      ],
+      readOnly: false,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          name: {
+            type: "string",
+            minLength: 1
+          },
+          avatarUrl: {
+            anyOf: [
+              {
+                type: "string",
+                format: "uri"
+              },
+              {
+                type: "null"
+              }
+            ]
+          },
+          protectionConfig: {
+            type: "object",
+            properties: {
+              linkMonitoring: {
+                type: "boolean"
+              },
+              socialMediaScanning: {
+                type: "boolean"
+              },
+              historyScanning: {
+                type: "boolean"
+              }
+            }
+          }
+        }
+      }
+    },
+    {
+      name: "user_org_get",
+      procedure: "userOrgGet",
+      method: "GET",
+      path: "/user/orgs/{slug}",
+      pathParams: [
+        "slug"
+      ],
+      title: "Get an organization the caller can access",
+      description: "Fetch a single organization by slug. Returns the same per-organization shape as `/user/orgs` (id, name, slug, avatarUrl, subscriptionStatus, services flags, integration connection status, `obligatoryAdminApproval`, `legalDocuments`, and `trademarkRegistrations`). The `integrations` object shows which third-party integrations are connected: `slack`, `discord`, `vercel`, `intercom`, and `moderation` are booleans; `telegram` is `{ connected, groupCount }`. The `legalDocuments` object reports whether the org's Letter of Authorization and Power of Attorney are on file along with a direct `fileUrl` to view each when present. `trademarkRegistrations` returns every org-level trademark on file with its issuing office, registration number, and (when uploaded) a `certificateFileUrl` link to the certificate PDF \u2014 an empty array means no trademarks are recorded for the org. Access requires the caller to have permission for the org: org-scoped API keys must match the slug; user sessions and user-scoped API keys need an active OrganizationMembership unless the caller is staff. Soft-deleted organizations are excluded.",
+      tags: [
+        "user"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          slug: {
+            type: "string",
+            minLength: 1,
+            description: "Organization slug to fetch (must be one the caller can access)"
+          }
+        },
+        required: [
+          "slug"
+        ],
+        description: "Get a single organization by slug.\n\nReturns the same per-organization shape as `/user/orgs`. Access is gated by\nthe same rules: org-scoped API keys must match the slug; user sessions (and\nuser-scoped API keys) need an active OrganizationMembership unless the user\nhas a staff role."
+      }
+    },
+    {
+      name: "user_orgs",
+      procedure: "userOrgs",
+      method: "POST",
+      path: "/user/orgs",
+      pathParams: [],
+      title: "Get user organizations",
+      description: "List organizations accessible to the current user along with each org's subscription status, which services (reporting, reviewing, protection, takedowns, detection, dark web monitoring) are enabled, integration connection status (Slack, Discord, Telegram, Vercel, Intercom, Moderation API), whether Obligatory Organization Admin Approval is enabled, the org-level Letter of Authorization / Power of Attorney attachments, and every org-level trademark registration on file. Each service exposes an `active` flag; **only `takedowns` additionally exposes `automated`**. The `integrations` object shows which third-party integrations are connected: `slack`, `discord`, `vercel`, `intercom`, and `moderation` are booleans; `telegram` is `{ connected, groupCount }` since an org can have multiple Telegram groups. The `legalDocuments` block has `letterOfAuthorization` and `powerOfAttorney` entries, each with `{ present, fileName, fileUrl }`. `trademarkRegistrations` is the full list of org-level trademarks with their issuing office, registration number, and (when uploaded) a `certificateFileUrl` link \u2014 use it to identify which customers have or have not added trademarks. Optional `subscriptionStatus`, `services`, and `obligatoryAdminApproval` filters narrow the result server-side. `subscriptionStatus` defaults to the live set (PROSPECT/POC/ACTIVE/INTEGRATION); pass INACTIVE explicitly to include churned organizations.",
+      tags: [
+        "user"
+      ],
+      readOnly: true,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          query: {
+            type: "string",
+            default: ""
+          },
+          subscriptionStatus: {
+            type: "array",
+            items: {
+              type: "string",
+              enum: [
+                "PROSPECT",
+                "POC",
+                "ACTIVE",
+                "INTEGRATION",
+                "INACTIVE"
+              ]
+            },
+            minItems: 1,
+            description: "Statuses to include. Defaults to the live set (PROSPECT/POC/ACTIVE/INTEGRATION); pass INACTIVE explicitly to see churned organizations."
+          },
+          services: {
+            type: "object",
+            properties: {
+              reporting: {
+                type: "object",
+                properties: {
+                  active: {
+                    type: "boolean"
+                  }
+                }
+              },
+              reviewing: {
+                type: "object",
+                properties: {
+                  active: {
+                    type: "boolean"
+                  }
+                }
+              },
+              protection: {
+                type: "object",
+                properties: {
+                  active: {
+                    type: "boolean"
+                  }
+                }
+              },
+              takedowns: {
+                type: "object",
+                properties: {
+                  active: {
+                    type: "boolean"
+                  },
+                  automated: {
+                    type: "boolean"
+                  }
+                }
+              },
+              detection: {
+                type: "object",
+                properties: {
+                  active: {
+                    type: "boolean"
+                  }
+                }
+              },
+              darkWebMonitoring: {
+                type: "object",
+                properties: {
+                  active: {
+                    type: "boolean"
+                  }
+                }
+              }
+            }
+          },
+          obligatoryAdminApproval: {
+            type: "object",
+            properties: {
+              active: {
+                type: "boolean"
+              },
+              assetTypes: {
+                type: "array",
+                items: {
+                  type: "string",
+                  description: "One of 92 values, e.g. URL, PAGE, ADDRESS, DISCORD, LINKEDIN, TWITTER, FACEBOOK, YOUTUBE. Full list: resource chainpatrol://enums/asset_type"
+                },
+                minItems: 1
+              }
+            }
+          },
+          pendingServiceApproval: {
+            type: "object",
+            properties: {
+              active: {
+                type: "boolean"
+              },
+              services: {
+                type: "array",
+                items: {
+                  type: "string",
+                  enum: [
+                    "protection",
+                    "takedowns"
+                  ]
+                },
+                minItems: 1
+              }
+            }
+          }
+        }
+      }
+    },
+    {
+      name: "validate",
+      procedure: "validate",
+      method: "GET",
+      path: "/validate",
+      pathParams: [],
+      title: "Validate API key",
+      description: "Validates if the provided API key is valid for Zapier integration",
+      tags: [
+        "auth"
+      ],
+      readOnly: true,
+      deprecated: false,
+      acceptsNoInput: true,
+      inputSchema: {
+        type: "object",
+        properties: {}
+      }
+    },
+    {
+      name: "webhook_config",
+      procedure: "webhookConfig",
+      method: "POST",
+      path: "/webhook/config",
+      pathParams: [],
+      title: "Configure webhook for organization",
+      description: "Create and configure a webhook for an organization to receive real-time notifications for asset status updates and threat detections. Requires a valid API key with access to the specified organization.",
+      tags: [
+        "webhook"
+      ],
+      readOnly: false,
+      deprecated: false,
+      inputSchema: {
+        type: "object",
+        properties: {
+          organizationSlug: {
+            type: "string",
+            description: "Organization slug to configure webhooks for"
+          },
+          subscriberUrl: {
+            type: "string",
+            format: "uri",
+            description: "HTTPS URL where webhook events will be delivered"
+          },
+          description: {
+            type: "string",
+            description: "Optional description for the webhook"
+          },
+          active: {
+            type: "boolean",
+            default: true,
+            description: "Whether the webhook should be active"
+          },
+          triggers: {
+            type: "array",
+            items: {
+              type: "string",
+              enum: [
+                "DEBUG_TEST",
+                "ASSET_STATUS_UPDATED",
+                "ORGANIZATION_THREAT_DETECTION_ADDED",
+                "ASSET_STATUS_ESCALATED"
+              ]
+            },
+            minItems: 1,
+            description: "Array of webhook events to subscribe to"
+          }
+        },
+        required: [
+          "organizationSlug",
+          "subscriberUrl",
+          "triggers"
+        ]
+      }
+    }
+  ],
+  excluded: [
+    {
+      path: "/cloudflare/webhook",
+      method: "POST",
+      reason: "Inbound webhook receiver \u2014 Cloudflare calls this, users never do. Exposing it would let an agent forge takedown-status callbacks."
+    },
+    {
+      path: "/github/webhook",
+      method: "POST",
+      reason: "Inbound webhook receiver \u2014 GitHub calls this, users never do. Exposing it would let an agent forge repository events."
+    },
+    {
+      path: "/internal/asset/list/eth-phishing-detect",
+      method: "GET",
+      reason: "Internal endpoint \u2014 ChainPatrol-owned plumbing (Slack/Telegram bots, CRM sync) rather than public API, and out of scope for the MCP surface by design."
+    },
+    {
+      path: "/internal/getAutoDashboardTelegramGroups",
+      method: "POST",
+      reason: "Internal endpoint \u2014 ChainPatrol-owned plumbing (Slack/Telegram bots, CRM sync) rather than public API, and out of scope for the MCP surface by design."
+    },
+    {
+      path: "/internal/getDiscordConfig",
+      method: "POST",
+      reason: "Internal endpoint \u2014 ChainPatrol-owned plumbing (Slack/Telegram bots, CRM sync) rather than public API, and out of scope for the MCP surface by design."
+    },
+    {
+      path: "/internal/getDiscordGuildStatus",
+      method: "POST",
+      reason: "Internal endpoint \u2014 ChainPatrol-owned plumbing (Slack/Telegram bots, CRM sync) rather than public API, and out of scope for the MCP surface by design."
+    },
+    {
+      path: "/internal/getIntercomOrganization",
+      method: "POST",
+      reason: "Internal endpoint \u2014 ChainPatrol-owned plumbing (Slack/Telegram bots, CRM sync) rather than public API, and out of scope for the MCP surface by design."
+    },
+    {
+      path: "/internal/getOrganizationMetrics",
+      method: "POST",
+      reason: "Internal endpoint \u2014 ChainPatrol-owned plumbing (Slack/Telegram bots, CRM sync) rather than public API, and out of scope for the MCP surface by design."
+    },
+    {
+      path: "/internal/getSlackOrganizations",
+      method: "POST",
+      reason: "Internal endpoint \u2014 ChainPatrol-owned plumbing (Slack/Telegram bots, CRM sync) rather than public API, and out of scope for the MCP surface by design."
+    },
+    {
+      path: "/internal/getTakedown",
+      method: "POST",
+      reason: "Internal endpoint \u2014 ChainPatrol-owned plumbing (Slack/Telegram bots, CRM sync) rather than public API, and out of scope for the MCP surface by design."
+    },
+    {
+      path: "/internal/getTelegramOrganization",
+      method: "POST",
+      reason: "Internal endpoint \u2014 ChainPatrol-owned plumbing (Slack/Telegram bots, CRM sync) rather than public API, and out of scope for the MCP surface by design."
+    },
+    {
+      path: "/internal/notion/create-crm-page",
+      method: "POST",
+      reason: "Internal endpoint \u2014 ChainPatrol-owned plumbing (Slack/Telegram bots, CRM sync) rather than public API, and out of scope for the MCP surface by design."
+    },
+    {
+      path: "/internal/reports/search",
+      method: "POST",
+      reason: "Internal endpoint \u2014 ChainPatrol-owned plumbing (Slack/Telegram bots, CRM sync) rather than public API, and out of scope for the MCP surface by design."
+    },
+    {
+      path: "/internal/subscribeToTakedown",
+      method: "POST",
+      reason: "Internal endpoint \u2014 ChainPatrol-owned plumbing (Slack/Telegram bots, CRM sync) rather than public API, and out of scope for the MCP surface by design."
+    },
+    {
+      path: "/internal/telegram/group",
+      method: "POST",
+      reason: "Internal endpoint \u2014 ChainPatrol-owned plumbing (Slack/Telegram bots, CRM sync) rather than public API, and out of scope for the MCP surface by design."
+    },
+    {
+      path: "/internal/telegram/user",
+      method: "POST",
+      reason: "Internal endpoint \u2014 ChainPatrol-owned plumbing (Slack/Telegram bots, CRM sync) rather than public API, and out of scope for the MCP surface by design."
+    },
+    {
+      path: "/internal/updateDiscordConfig",
+      method: "POST",
+      reason: "Internal endpoint \u2014 ChainPatrol-owned plumbing (Slack/Telegram bots, CRM sync) rather than public API, and out of scope for the MCP surface by design."
+    },
+    {
+      path: "/notion/webhook",
+      method: "POST",
+      reason: "Inbound webhook receiver \u2014 Notion calls this, users never do. Exposing it would let an agent forge CRM automation events."
+    }
+  ],
+  enums: [
+    {
+      name: "asset_scan_enrichment_type",
+      values: [
+        "content_and_metadata",
+        "browser_capture",
+        "ownership_and_registration",
+        "geolocation_and_ip",
+        "dns",
+        "tls",
+        "tcp",
+        "post",
+        "profile",
+        "twitter_followers",
+        "cast",
+        "farcaster_profile",
+        "channel",
+        "miniapp",
+        "telegram_profile",
+        "instagram_profile",
+        "facebook_profile",
+        "youtube_video",
+        "youtube_channel",
+        "apple_app_store_listing",
+        "google_play_store_listing",
+        "mozilla_addon",
+        "reddit_subreddit",
+        "email_validation",
+        "phone_lookup",
+        "bilibili_video",
+        "bilibili_profile",
+        "dailymotion_video",
+        "vimeo_video",
+        "vimeo_profile",
+        "stackblitz_page",
+        "leetcode_page",
+        "npm_package",
+        "pypi_package",
+        "rust_package",
+        "linkedin_profile",
+        "meta_ad",
+        "google_ad",
+        "contract_deployer"
+      ],
+      usedBy: [
+        "report_create.type"
+      ]
+    },
+    {
+      name: "asset_type",
+      values: [
+        "URL",
+        "PAGE",
+        "ADDRESS",
+        "DISCORD",
+        "LINKEDIN",
+        "TWITTER",
+        "FACEBOOK",
+        "YOUTUBE",
+        "REDDIT",
+        "TELEGRAM",
+        "GOOGLE_APP_STORE",
+        "APPLE_APP_STORE",
+        "AMAZON_APP_STORE",
+        "MICROSOFT_APP_STORE",
+        "TIKTOK",
+        "INSTAGRAM",
+        "THREADS",
+        "MEDIUM",
+        "CHROME_WEB_STORE",
+        "MOZILLA_ADDONS",
+        "OPERA_ADDONS",
+        "EMAIL",
+        "PATREON",
+        "OPENSEA",
+        "FARCASTER",
+        "IPFS",
+        "GOOGLE_FORM",
+        "WHATSAPP",
+        "DISCORD_USER",
+        "QUORA",
+        "GITHUB",
+        "TEACHABLE",
+        "SUBSTACK",
+        "DEBANK",
+        "TAWK_TO",
+        "JOTFORM",
+        "PRIMAL",
+        "BLUESKY",
+        "SNAPCHAT",
+        "DESO",
+        "PINTEREST",
+        "FLICKR",
+        "GALXE",
+        "VELOG",
+        "NPM",
+        "PYPI",
+        "HEX",
+        "DOCKER_HUB",
+        "VOCAL_MEDIA",
+        "TECKFINE",
+        "TENDERLY",
+        "HACKMD",
+        "ETSY",
+        "ZAZZLE",
+        "BASENAME",
+        "BILIBILI_TV",
+        "VIMEO",
+        "DAILYMOTION",
+        "PHONE_NUMBER",
+        "SLACK",
+        "CALENDLY",
+        "NGROK",
+        "RARIBLE",
+        "RUST_PACKAGE",
+        "FLATHUB",
+        "VIDLII",
+        "VEVIOZ",
+        "ISSUU",
+        "SOUNDCLOUD",
+        "ZAPPER",
+        "REDNOTE",
+        "SAMSUNG_APP_STORE",
+        "HUAWEI_APP_STORE",
+        "XIAOMI_APP_STORE",
+        "TENCENT_APP_STORE",
+        "OPPO_APP_STORE",
+        "VIVO_APP_STORE",
+        "F_DROID",
+        "GOOGLE_AD",
+        "BING_AD",
+        "TWITCH",
+        "BEHANCE",
+        "ZORA",
+        "META_AD",
+        "SIGNAL",
+        "DEVIANTART",
+        "BANDCAMP",
+        "ARCHIVE_ORG",
+        "FIVE_HUNDRED_PX",
+        "LUMA",
+        "SMARTMONEYMATCH",
+        "APK_GOLD"
+      ],
+      usedBy: [
+        "asset_changelog.type",
+        "asset_list.type",
+        "detection_list.value",
+        "get_organization_reports.assetTypes",
+        "metrics_takedown_time_trend.assetTypes",
+        "organization_assets_list.type",
+        "organization_reports_list.assetTypes",
+        "takedowns_list.assetType",
+        "threats_list.assetType",
+        "user_orgs.assetTypes"
+      ]
+    },
+    {
+      name: "source",
+      values: [
+        "meta_ads_search",
+        "telegram_channels_search",
+        "telegram_user_search",
+        "telegram_channels_search_vetric",
+        "telegram_user_search_vetric",
+        "facebook_page_search_vetric",
+        "facebook_user_search_vetric",
+        "instagram_account_search_vetric",
+        "twitter_search_vetric",
+        "linkedin_people_search_vetric",
+        "linkedin_company_search_vetric",
+        "meta_ads_search_vetric",
+        "tik_tok_video_search",
+        "tik_tok_user_search",
+        "tik_tok_user_search_vetric",
+        "tik_tok_video_search_vetric",
+        "blocklist",
+        "apple_app_store",
+        "google_ads_search",
+        "mozilla_addon_search",
+        "reddit_subreddit_search",
+        "asset_check",
+        "twitter_post_search",
+        "medium_tag_rss",
+        "twitter_search",
+        "yahoo_search",
+        "duck_duck_go_search",
+        "bing_search",
+        "guestbook",
+        "certstream",
+        "external",
+        "google_search",
+        "dns_twist",
+        "twitter",
+        "twitter_username_monitor",
+        "urlscan",
+        "urlscan_hostname_search",
+        "youtube_search",
+        "google_play_search",
+        "dexscreener_search",
+        "blocked_ip_scan",
+        "blocked_bilibili_suggested",
+        "grok_post_search",
+        "grok_user_search",
+        "google_lens_image_search",
+        "yandex_search",
+        "yandex_image_search",
+        "linkedin_employee_detection",
+        "linkedin_post_search",
+        "linkedin_company_search",
+        "bing_ads_search",
+        "tik_tok_ads_search",
+        "dnsdb",
+        "daily_motion_search",
+        "watchlist"
+      ],
+      usedBy: [
+        "detection_configs_create.source",
+        "detection_list.value"
+      ]
+    }
+  ],
+  glossaries: [
+    {
+      uri: "chainpatrol://glossary/proposal-labels",
+      title: "organization_proposals_review.label",
+      text: "Why the asset is being blocked. Required when `decision` is `APPROVE`, ignored otherwise. One of: `Brand Impersonation`, `Employee Impersonation`, `Fake Employee`, `Targeting Org Users`, `General Phishing`, `C2 Server`, `False Positive`, `Organization Member Impersonation`, `Targeting Organization`.\n\n- `Brand Impersonation` \u2014 The asset is directly using the Brand's name, logo, or other trademarks\n- `Employee Impersonation` \u2014 The asset is impersonating a specific employee of the organization\n- `Fake Employee` \u2014 The asset claims to work at the company but is not directly impersonating a specific person\n- `Targeting Org Users` \u2014 A scam the org wants taken down that falls outside direct impersonation\n- `General Phishing` \u2014 This asset is trying to steal user funds\n- `C2 Server` \u2014 Command and Control server providing backend infrastructure for phishing operations\n- `False Positive` \u2014 This asset was incorrectly flagged and should be allowed\n- `Organization Member Impersonation` \u2014 The asset is impersonating a member or employee of the organization\n- `Targeting Organization` \u2014 A scam the org wants taken down that falls outside direct impersonation"
+    },
+    {
+      uri: "chainpatrol://glossary/proposal-reject-reasons",
+      title: "organization_proposals_review.rejectReason",
+      text: "Why the proposal is being rejected. Required when `decision` is `REJECT`, ignored otherwise. These are the same reasons the Review page offers, and they feed ChainPatrol's detection-tuning breakdown \u2014 pick the closest one rather than relying on `note`."
+    },
+    {
+      uri: "chainpatrol://glossary/proposal-watchlist-reasons",
+      title: "organization_proposals_review.watchlistReason",
+      text: "Why the asset is being parked. Required when `decision` is `WATCHLIST`, ignored otherwise. Use `OTHER` for anything not covered, in which case `note` becomes required and is treated as the reason. Note that the watchlist only covers asset types that can be re-checked for revival (URL, PAGE, EMAIL, and the social platforms); watchlisting any other type is rejected, so reject the proposal instead."
+    }
+  ]
+};
+
+// src/server.ts
+var manifest = tools_default;
+function selectTools(only) {
+  if (!only || only.length === 0) return manifest.tools;
+  const wanted = new Set(only);
+  const selected = manifest.tools.filter((tool) => wanted.has(tool.name));
+  const unknown = only.filter((name) => !manifest.tools.some((t) => t.name === name));
+  if (unknown.length > 0) {
+    throw new Error(
+      `Unknown MCP tool name(s): ${unknown.join(", ")}. Run with no filter to expose all ${manifest.tools.length} tools.`
+    );
+  }
+  return selected;
+}
+var MAX_RESULT_CHARS = 1e5;
+function toToolResult(value) {
+  const serialized = typeof value === "string" ? value : JSON.stringify(value);
+  const text = serialized.length <= MAX_RESULT_CHARS ? serialized : `${serialized.slice(0, MAX_RESULT_CHARS)}
+
+[Truncated: showing ${MAX_RESULT_CHARS} of ${serialized.length} characters, so this is no longer parseable JSON. Narrow the filters or request a smaller page to see a complete result.]`;
+  return {
+    content: [{ type: "text", text }]
+  };
+}
+function toErrorResult(error) {
+  const message = error instanceof ToolInvocationError || error instanceof Error ? error.message : String(error);
+  return {
+    isError: true,
+    content: [{ type: "text", text: message }]
+  };
+}
+function createChainPatrolMcpServer(options) {
+  const tools = selectTools(options.only);
+  const resources = buildResources(manifest, tools);
+  const prompts = selectPrompts(
+    PROMPTS,
+    tools.map((tool) => tool.name)
+  );
+  const byName = new Map(tools.map((tool) => [tool.name, tool]));
+  const server = new Server(
+    {
+      name: options.serverName ?? "chainpatrol",
+      version: options.version ?? "0.0.0"
+    },
+    {
+      capabilities: { tools: {}, resources: {}, prompts: {} },
+      instructions: "ChainPatrol threat intelligence and brand protection. Every public API capability is available here as a tool: checking and searching assets, reports, proposals, detections, takedowns, metrics, healthchecks and organization management.\n\nMost tools are scoped to one organization. Credentials can reach more than one, and there is no implicit default, so call `user_orgs` first and pass the slug explicitly.\n\nWhere a parameter's description points at a `chainpatrol://` resource, read it before guessing a value."
+    }
+  );
+  server.setRequestHandler(ListToolsRequestSchema, () => ({
+    tools: tools.map((tool) => ({
+      name: tool.name,
+      title: tool.title,
+      description: tool.description,
+      inputSchema: tool.inputSchema,
+      annotations: {
+        title: tool.title,
+        readOnlyHint: tool.readOnly,
+        /*
+         * `destructiveHint` is only meaningful when `readOnlyHint` is false, and
+         * it does not mean "irreversible" — per the MCP spec, `false` asserts
+         * the tool performs *only additive* updates, and the default is `true`.
+         *
+         * The public API's mutations block and unblock assets, delete detection
+         * configs and asset groups, remove allowlist entries, review proposals
+         * and replace webhook configuration. Those modify or remove existing
+         * state, so claiming additive-only would suppress the confirmation
+         * hosts raise for exactly this kind of call. Whether staff can restore
+         * the data afterwards is a different question from what the hint asks.
+         */
+        ...tool.readOnly ? {} : { destructiveHint: true },
+        ...tool.deprecated ? { deprecated: true } : {}
+      }
+    }))
+  }));
+  server.setRequestHandler(CallToolRequestSchema, async (request) => {
+    const tool = byName.get(request.params.name);
+    if (!tool) {
+      return toErrorResult(
+        new Error(
+          `Unknown tool "${request.params.name}". Call tools/list for the current set.`
+        )
+      );
+    }
+    try {
+      const args = request.params.arguments ?? {};
+      return toToolResult(await options.invoker(tool, args));
+    } catch (error) {
+      return toErrorResult(error);
+    }
+  });
+  server.setRequestHandler(ListResourcesRequestSchema, () => ({
+    resources: resources.map(({ uri, name, title, description, mimeType }) => ({
+      uri,
+      name,
+      title,
+      description,
+      mimeType
+    }))
+  }));
+  server.setRequestHandler(ReadResourceRequestSchema, (request) => {
+    const resource = resources.find((item) => item.uri === request.params.uri);
+    if (!resource) {
+      throw new Error(`Unknown resource: ${request.params.uri}`);
+    }
+    return {
+      contents: [{ uri: resource.uri, mimeType: resource.mimeType, text: resource.text }]
+    };
+  });
+  server.setRequestHandler(ListPromptsRequestSchema, () => ({
+    prompts: prompts.map(({ name, title, description, arguments: args }) => ({
+      name,
+      title,
+      description,
+      arguments: args
+    }))
+  }));
+  server.setRequestHandler(GetPromptRequestSchema, (request) => {
+    const prompt = prompts.find((item) => item.name === request.params.name);
+    if (!prompt) {
+      throw new Error(`Unknown prompt: ${request.params.name}`);
+    }
+    return {
+      description: prompt.description,
+      messages: [
+        {
+          role: "user",
+          content: {
+            type: "text",
+            text: renderPrompt(prompt, request.params.arguments ?? {})
+          }
+        }
+      ]
+    };
+  });
+  return server;
+}
+
+// src/http-invoker.ts
+var DEFAULT_BASE_URL = "https://app.chainpatrol.io";
+var DEFAULT_TIMEOUT_MS = 6e4;
+function trimTrailingSlashes(url) {
+  return url.replace(/\/+$/, "");
+}
+function appendQueryValue(search, key, value) {
+  if (value === void 0 || value === null) return;
+  if (Array.isArray(value)) {
+    for (const item of value) appendQueryValue(search, key, item);
+    return;
+  }
+  if (typeof value === "object") {
+    search.append(key, JSON.stringify(value));
+    return;
+  }
+  const serialized = scalarToString(value);
+  if (serialized === void 0 || serialized === "") return;
+  search.append(key, serialized);
+}
+function scalarToString(value) {
+  if (typeof value === "string") return value;
+  if (typeof value === "number" || typeof value === "bigint") {
+    return Number.isNaN(value) ? void 0 : value.toString();
+  }
+  if (typeof value === "boolean") return value ? "true" : "false";
+  return void 0;
+}
+function applyPathParams(tool, args) {
+  const rest = { ...args };
+  let path = tool.path;
+  for (const name of tool.pathParams) {
+    const value = scalarToString(rest[name]);
+    if (value === void 0 || value === "") {
+      throw new ToolInvocationError(
+        `${tool.name}: "${name}" is required and must be a string or number \u2014 it identifies the resource in the request path.`
+      );
+    }
+    path = path.replace(`{${name}}`, encodeURIComponent(value));
+    delete rest[name];
+  }
+  return { path, rest };
+}
+function acceptsBody(method) {
+  return method === "POST" || method === "PATCH" || method === "PUT";
+}
+function createHttpInvoker(options) {
+  const baseUrl = trimTrailingSlashes(options.baseUrl ?? DEFAULT_BASE_URL);
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const doFetch = options.fetchImpl ?? fetch;
+  return async (tool, args) => {
+    const credential = await options.credential();
+    const headers = {
+      accept: "application/json",
+      "user-agent": "chainpatrol-mcp"
+    };
+    if (credential.kind === "api-key") {
+      headers["x-api-key"] = credential.value;
+    } else {
+      headers["authorization"] = `Bearer ${credential.value}`;
+    }
+    const { path, rest } = applyPathParams(tool, args);
+    let url = `${baseUrl}/api/v2${path}`;
+    let body;
+    if (acceptsBody(tool.method)) {
+      headers["content-type"] = "application/json";
+      body = JSON.stringify(rest);
+    } else {
+      const search = new URLSearchParams();
+      for (const [key, value] of Object.entries(rest)) {
+        appendQueryValue(search, key, value);
+      }
+      const queryString = search.toString();
+      if (queryString) url = `${url}?${queryString}`;
+    }
+    let response;
+    try {
+      response = await doFetch(url, {
+        method: tool.method,
+        headers,
+        body,
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+    } catch (error) {
+      if (error instanceof DOMException && error.name === "TimeoutError") {
+        throw new ToolInvocationError(
+          `${tool.name} timed out after ${timeoutMs}ms. Narrow the date range or filters and try again.`
+        );
+      }
+      throw new ToolInvocationError(
+        `Could not reach ChainPatrol at ${baseUrl}. Check network access and the configured API URL.`,
+        { cause: error }
+      );
+    }
+    const text = await response.text();
+    let parsed;
+    try {
+      parsed = text.length > 0 ? JSON.parse(text) : null;
+    } catch {
+      parsed = text;
+    }
+    if (!response.ok) {
+      const message = parsed?.message ?? `${tool.name} failed with HTTP ${response.status}.`;
+      throw new ToolInvocationError(message, {
+        status: response.status,
+        details: parsed
+      });
+    }
+    return parsed;
+  };
+}
+
+// src/tools-filter.ts
+var TOOLS_ENV_VAR = "CHAINPATROL_MCP_TOOLS";
+function toolsFromEnvironment(env = process.env) {
+  const raw = env[TOOLS_ENV_VAR]?.trim();
+  if (!raw) return void 0;
+  const names = raw.split(",").map((name) => name.trim()).filter(Boolean);
+  return names.length > 0 ? names : void 0;
+}
+
+// src/version.ts
+var PACKAGE_VERSION = "1.10.0";
+
+export {
+  PROMPTS,
+  renderPrompt,
+  selectPrompts,
+  buildResources,
+  ToolInvocationError,
+  manifest,
+  MAX_RESULT_CHARS,
+  createChainPatrolMcpServer,
+  createHttpInvoker,
+  TOOLS_ENV_VAR,
+  toolsFromEnvironment,
+  PACKAGE_VERSION
+};
+//# sourceMappingURL=chunk-AHMNJBKL.js.map