@chkp/documentation-mcp 1.0.1 → 1.3.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @chkp/documentation-mcp
 
+## 1.3.0
+
+### Minor Changes
+
+- 56cf1d2: Updated implementation and features, Modified 3 file(s) (synced from internal repository)
+
+## 1.1.0
+
+### Minor Changes
+
+- 3870c17: Updated implementation and features, Updated configuration, Modified 3 file(s) (synced from internal repository)
+
 ## 1.0.1
 
 ### Patch Changes

package/README.md

@@ -40,6 +40,8 @@ This server accesses Check Point documentation resources and may have rate limit
 
 ## Configuration Options
 
+> **📊 Anonymous Usage Statistics:** Check Point collects anonymous usage statistics to help improve this MCP server.  To opt out, set `TELEMETRY_DISABLED=true` or use `--no-telemetry` flag.
+
 This server supports configuration via command-line arguments or environment variables:
 
 ### API Configuration
@@ -61,7 +63,8 @@ Set the following environment variables:
 
 - `CLIENT_ID`: Client ID for authentication with Check Point Documentation Tool (required)
 - `SECRET_KEY`: Secret Key for authentication with Check Point Documentation Tool (required)
-- `REGION`: Documentation Tool region - EU, US, STG, or Local (default: EU)
+- `AUTH_URL`: Authentication URL copied from the API key creation dialog (e.g. `https://cloudinfra-gw.portal.checkpoint.com/auth/external`). Recommended — the path suffix is stripped automatically so you can paste it directly. When set, `REGION` is inferred and does not need to be set separately.
+- `REGION`: Short region code — `EU`, `US`, `STG`, or `LOCAL` (default: `EU`). Use this instead of `AUTH_URL` for backwards-compatible configurations.
   
 ---
 
@@ -73,7 +76,7 @@ Set the following environment variables:
 
 - `CLIENT_ID`: Your client ID for Documentation Tool authentication
 - `SECRET_KEY`: Your secret key for Documentation Tool authentication
-- `REGION`: Set to "Local" for on-premises deployment
+- `REGION`: Set to `LOCAL` for on-premises deployment
   
 ---
 
@@ -105,13 +108,15 @@ It is expected to work with any MCP client that supports the Model Context Proto
       "env": {
         "CLIENT_ID": "YOUR_CLIENT_ID",
         "SECRET_KEY": "YOUR_SECRET_KEY",
-        "REGION": "EU"
+        "AUTH_URL": "YOUR_AUTH_URL"
       }
     }
   }
 }
 ```
 
+> **Tip:** Copy `AUTH_URL` directly from the Authentication URL shown in the API key creation dialog. The path suffix is stripped automatically — no manual editing needed.
+
 ### Configuring the Claude Desktop App
 
 #### For macOS:
@@ -141,7 +146,7 @@ Add the server configuration:
       "env": {
         "CLIENT_ID": "YOUR_CLIENT_ID",
         "SECRET_KEY": "YOUR_SECRET_KEY",
-        "REGION": "EU"
+        "AUTH_URL": "YOUR_AUTH_URL"
       }
     }
   }
@@ -168,7 +173,7 @@ Add this configuration:
         "env": {
           "CLIENT_ID": "YOUR_CLIENT_ID",
           "SECRET_KEY": "YOUR_SECRET_KEY",
-          "REGION": "EU"
+          "AUTH_URL": "YOUR_AUTH_URL"
         }
       }
     }
@@ -217,7 +222,17 @@ npm run build
 You can run the server locally for development using [MCP Inspector](https://modelcontextprotocol.io/docs/tools/inspector) or any compatible MCP client.
 
 ```bash
-node FULL_PATH_TO_SERVER/packages/copilot/dist/index.js --client-id "YOUR_CLIENT_ID" --secret-key "YOUR_SECRET_KEY" --region "EU"
+# Option A: use the Authentication URL from the API key creation dialog
+node FULL_PATH_TO_SERVER/packages/documentation-tool/dist/index.js \
+  --client-id "YOUR_CLIENT_ID" \
+  --secret-key "YOUR_SECRET_KEY" \
+  --auth-url "YOUR_AUTH_URL"
+
+# Option B: use a region code (EU / US / STG / LOCAL)
+node FULL_PATH_TO_SERVER/packages/documentation-tool/dist/index.js \
+  --client-id "YOUR_CLIENT_ID" \
+  --secret-key "YOUR_SECRET_KEY" \
+  --region "EU"
 ```
 
 ---
@@ -226,4 +241,10 @@ node FULL_PATH_TO_SERVER/packages/copilot/dist/index.js --client-id "YOUR_CLIENT
 
 1. **Authentication keys and credentials are never shared with the model.** They are used only by the MCP server to authenticate with your Check Point management system.  
 2. **Only use client implementations you trust.** Malicious or untrusted clients could misuse your credentials or access data improperly.  
-3. **Management data is exposed to the model.** Ensure that you only use models and providers that comply with your organization’s policies for handling sensitive data and PII.
+3. **Management data is exposed to the model.** Ensure that you only use models and providers that comply with your organization's policies for handling sensitive data and PII.
+
+## 📊 Telemetry and Privacy
+
+**Anonymous Usage Statistics:** Check Point collects anonymous usage statistics to improve this MCP server. Only tool usage patterns and anonymous identifiers are collected—no credentials, policies, or sensitive data.
+
+**Opt-Out:** Set `TELEMETRY_DISABLED=true` environment variable or use the `--no-telemetry` flag to disable telemetry collection.

package/dist/index.js

@@ -16,7 +16,7 @@ __export(ui_dialog_exports, {
   showLoginDialog: () => showLoginDialog
 });
 import { createServer } from "http";
-import { URL } from "url";
+import { URL as URL2 } from "url";
 import { exec } from "child_process";
 import { promisify } from "util";
 import * as fs2 from "fs";
@@ -87,7 +87,7 @@ var init_ui_dialog = __esm({
         });
       }
       handleRequest(req, res, config) {
-        const url = new URL(req.url, `http://localhost:${this.port}`);
+        const url = new URL2(req.url, `http://localhost:${this.port}`);
         if (req.method === "GET" && url.pathname === "/") {
           res.writeHead(200, { "Content-Type": "text/html" });
           res.end(this.generateHTML(config));
@@ -309,7 +309,7 @@ var init_ui_dialog = __esm({
         try {
           let url;
           try {
-            url = new URL(urlString);
+            url = new URL2(urlString);
             if (!["http:", "https:"].includes(url.protocol) || url.hostname !== "localhost" && url.hostname !== "127.0.0.1") {
               throw new Error("Invalid URL protocol or non-localhost hostname");
             }
@@ -362,7 +362,6 @@ var init_ui_dialog = __esm({
 
 // src/index.ts
 import { z } from "zod";
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 
 // ../mcp-utils/dist/launcher.js
 import { Command } from "commander";
@@ -371,6 +370,165 @@ import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/
 import fs from "fs";
 import http from "http";
 import { randomUUID } from "crypto";
+
+// ../mcp-utils/dist/settings-manager.js
+var SettingsManager = class _SettingsManager {
+  /**
+   * Creates a new SettingsManager
+   * @param settingsClass The Settings class to use for creating settings instances
+   */
+  constructor(settingsClass) {
+    this.settingsMap = /* @__PURE__ */ new Map();
+    this.defaultSessionId = "default";
+    this.settingsClass = settingsClass;
+  }
+  /**
+   * Get settings for a specific session
+   * @param sessionId The session ID (defaults to 'default' for stdio mode)
+   * @returns Settings instance for the session
+   */
+  getSettings(sessionId) {
+    const sid = sessionId || this.defaultSessionId;
+    if (!this.settingsMap.has(sid)) {
+      this.settingsMap.set(sid, new this.settingsClass());
+    }
+    return this.settingsMap.get(sid);
+  }
+  /**
+   * Set settings for a specific session
+   * @param settings The settings object to set
+   * @param sessionId The session ID (defaults to 'default' for stdio mode)
+   */
+  setSettings(settings, sessionId) {
+    const sid = sessionId || this.defaultSessionId;
+    this.settingsMap.set(sid, settings);
+  }
+  /**
+   * Injects debug settings from source into settings object
+   * @param settings The settings object to update
+   * @param source Source object containing debug information
+   * @private
+   */
+  injectDebug(settings, source) {
+    const debug = source?.debug ?? _SettingsManager.globalDebugState ?? process.env.DEBUG;
+    if (typeof debug !== "undefined") {
+      if (source?.debug !== void 0) {
+        _SettingsManager.globalDebugState = source.debug;
+      }
+      if (typeof settings.set === "function") {
+        settings.set("debug", debug);
+      } else {
+        settings.debug = debug;
+      }
+      if (debug) {
+        console.error("Debug enabled. Source object contents:");
+        console.error(JSON.stringify(source, null, 2));
+      }
+    }
+  }
+  /**
+   * Print settings object for debugging by dynamically discovering its properties
+   * @param settings The settings object to print
+   * @private
+   */
+  printSettingsDebug(settings) {
+    if (typeof settings.get === "function") {
+      console.error("Settings (using get method):");
+      if (settings.data && typeof settings.data === "object") {
+        Object.entries(settings.data).forEach(([key, value]) => {
+          console.error(`  ${key}: ${JSON.stringify(value)}`);
+        });
+      } else {
+        console.error("  Unable to enumerate settings properties - no accessible data structure");
+      }
+    } else {
+      console.error("Settings (plain object):");
+      Object.entries(settings).forEach(([key, value]) => {
+        console.error(`  ${key}: ${JSON.stringify(value)}`);
+      });
+    }
+  }
+  /**
+   * Create settings from command-line arguments
+   * @param args Command line arguments
+   * @param sessionId Optional session ID
+   * @returns Settings instance
+   */
+  createFromArgs(args, sessionId) {
+    const settings = this.settingsClass.fromArgs(args);
+    this.injectDebug(settings, args);
+    this.setSettings(settings, sessionId);
+    return settings;
+  }
+  /**
+   * Create settings from HTTP headers
+   * @param headers HTTP headers
+   * @param sessionId Optional session ID
+   * @returns Settings instance
+   */
+  createFromHeaders(headers, sessionId) {
+    const verbose = _SettingsManager.globalDebugState;
+    if (verbose) {
+      console.error("[SettingsManager.createFromHeaders] Verbose: Starting with sessionId:", sessionId || "(default)");
+      console.error("[SettingsManager.createFromHeaders] Verbose: Incoming headers count:", Object.keys(headers).length);
+    }
+    if (_SettingsManager.globalDebugState) {
+      console.error("=== createFromHeaders Debug Info ===");
+      console.error("Incoming headers:");
+      console.error(JSON.stringify(headers, null, 2));
+    }
+    if (verbose && (!headers || Object.keys(headers).length === 0)) {
+      console.error("[SettingsManager.createFromHeaders] Verbose: WARNING - Headers object is empty or undefined");
+    }
+    const normalizedHeaders = {};
+    for (const [key, value] of Object.entries(headers)) {
+      const normalizedKey = key.includes("_") ? key.replace(/_/g, "-") : key;
+      normalizedHeaders[normalizedKey] = value;
+      if (verbose) {
+        console.error(`[SettingsManager.createFromHeaders] Verbose: Header normalized: "${key}" -> "${normalizedKey}"`);
+      }
+    }
+    if (verbose) {
+      console.error("[SettingsManager.createFromHeaders] Verbose: Normalized headers count:", Object.keys(normalizedHeaders).length);
+    }
+    if (_SettingsManager.globalDebugState) {
+      console.error("Normalized headers:");
+      console.error(JSON.stringify(normalizedHeaders, null, 2));
+    }
+    const debugHeader = normalizedHeaders["debug"] || normalizedHeaders["Debug"] || normalizedHeaders["DEBUG"];
+    const debugSource = { debug: debugHeader !== void 0 ? debugHeader : _SettingsManager.globalDebugState };
+    if (verbose) {
+      console.error("[SettingsManager.createFromHeaders] Verbose: Calling settingsClass.fromHeaders");
+    }
+    const settings = this.settingsClass.fromHeaders(normalizedHeaders);
+    if (verbose) {
+      console.error("[SettingsManager.createFromHeaders] Verbose: Settings object created");
+    }
+    this.injectDebug(settings, debugSource);
+    if (_SettingsManager.globalDebugState) {
+      console.error("Final settings object for session:", sessionId || "(default)");
+      this.printSettingsDebug(settings);
+      console.error("=== End createFromHeaders Debug Info ===");
+    }
+    if (verbose) {
+      console.error("[SettingsManager.createFromHeaders] Verbose: Storing settings for session:", sessionId || "(default)");
+    }
+    this.setSettings(settings, sessionId);
+    return settings;
+  }
+  /**
+   * Clear settings for a session
+   * @param sessionId The session ID to clear
+   */
+  clearSession(sessionId) {
+    if (sessionId !== this.defaultSessionId) {
+      this.settingsMap.delete(sessionId);
+    }
+  }
+};
+SettingsManager.globalDebugState = void 0;
+
+// ../mcp-utils/dist/launcher.js
 async function launchMCPServer(configPath, serverModule2) {
   const config = JSON.parse(fs.readFileSync(configPath, "utf8"));
   const program = new Command();
@@ -379,7 +537,7 @@ async function launchMCPServer(configPath, serverModule2) {
   }
   config.options.forEach((option) => {
     const envValue = option.env ? process.env[option.env] : void 0;
-    const defaultValue = option.default || envValue;
+    const defaultValue = envValue || option.default;
     if (option.type === "boolean") {
       const boolDefault = envValue === "true" || option.default === "true";
       program.option(option.flag, option.description, boolDefault);
@@ -393,12 +551,26 @@ async function launchMCPServer(configPath, serverModule2) {
   program.option("--transport-port <number>", "Port for network transports (e.g., HTTP)", transportPortDefault);
   const debugDefault = process.env.DEBUG === "true" || false;
   program.option("--debug", "Enable debug mode", debugDefault);
+  const telemetryEnabledDefault = process.env.TELEMETRY_DISABLED === "true" ? false : true;
+  program.option("--no-telemetry", "Disable anonymous usage telemetry", telemetryEnabledDefault);
+  const telemetryUrlDefault = process.env.TELEMETRY_URL || "https://metrics.security.ai.checkpoint.com/api/v1/metrics/collect";
+  program.option("--telemetry-url <url>", "URL for telemetry server", telemetryUrlDefault);
   program.parse(process.argv);
   const options = program.opts();
+  if (options.telemetry === false) {
+    process.env.TELEMETRY_DISABLED = "true";
+  }
+  if (options.telemetryUrl) {
+    process.env.TELEMETRY_URL = options.telemetryUrl;
+  }
   if (!serverModule2.settingsManager) {
     throw new Error("ServerModule must have a settingsManager. Create it with createServerModule.");
   }
   const settings = serverModule2.settingsManager.createFromArgs(options);
+  if (typeof serverModule2.server.applyToolPolicy === "function") {
+    console.error("[launchMCPServer] Applying tool policy before connecting");
+    serverModule2.server.applyToolPolicy();
+  }
   const transportType = (options.transport || process.env.MCP_TRANSPORT_TYPE || "stdio").toLowerCase() === "http" ? "http" : "stdio";
   const transportPort = options.transportPort ? parseInt(options.transportPort, 10) : process.env.MCP_TRANSPORT_PORT ? parseInt(process.env.MCP_TRANSPORT_PORT, 10) : 3e3;
   if (transportType === "http") {
@@ -424,6 +596,7 @@ async function launchMCPServer(configPath, serverModule2) {
 }
 async function launchHTTPServer(config, serverModule2, port) {
   const transports = {};
+  const serverInstances = {};
   const server2 = http.createServer(async (req, res) => {
     if (req.url === "/" || req.url === "/mcp") {
       const sessionId = req.headers["mcp-session-id"];
@@ -445,31 +618,65 @@ async function launchHTTPServer(config, serverModule2, port) {
           }
           let transport;
           if (sessionId && transports[sessionId]) {
+            const verbose = SettingsManager.globalDebugState;
+            if (verbose) {
+              console.error("[launchHTTPServer] Verbose: Reusing existing transport for session:", sessionId);
+            }
             transport = transports[sessionId];
             if (!serverModule2.settingsManager) {
               throw new Error("ServerModule must have a settingsManager. Create it with createServerModule.");
             }
-            serverModule2.settingsManager.createFromHeaders(headersToEnvVars(req.headers, config), sessionId);
+            if (verbose) {
+              console.error("[launchHTTPServer] Verbose: Converting headers for existing session");
+            }
+            const envHeaders = headersToEnvVars(req.headers, config);
+            if (verbose) {
+              console.error("[launchHTTPServer] Verbose: Creating settings from headers for existing session");
+            }
+            serverModule2.settingsManager.createFromHeaders(envHeaders, sessionId);
           } else if (!sessionId && body && body.method === "initialize") {
             transport = new StreamableHTTPServerTransport({
               sessionIdGenerator: () => randomUUID(),
               onsessioninitialized: (sid) => {
+                const verbose = SettingsManager.globalDebugState;
+                if (verbose) {
+                  console.error("[launchHTTPServer] Verbose: New session initialized:", sid);
+                }
                 transports[sid] = transport;
+                if (verbose) {
+                  console.error("[launchHTTPServer] Verbose: Converting headers for new session");
+                  console.error("[launchHTTPServer] Verbose: Raw request headers:", Object.keys(req.headers));
+                }
                 const headers = headersToEnvVars(req.headers, config);
+                if (verbose) {
+                  console.error("[launchHTTPServer] Verbose: Converted headers count:", Object.keys(headers).length);
+                }
                 const metadata = {
                   userAgent: req.headers["user-agent"],
                   origin: req.headers.origin || req.headers.referer,
                   remoteAddress: req.socket.remoteAddress,
                   initialPath: req.url
                 };
+                if (verbose) {
+                  console.error("[launchHTTPServer] Verbose: Creating session in session manager");
+                }
                 serverModule2.sessionManager.createSession(sid, metadata);
+                if (verbose) {
+                  console.error("[launchHTTPServer] Verbose: Creating settings from headers for new session");
+                }
                 serverModule2.settingsManager.createFromHeaders(headers, sid);
+                if (verbose) {
+                  console.error("[launchHTTPServer] Verbose: Session initialization complete");
+                }
               }
             });
             transport.onclose = () => {
               const sid = transport.sessionId;
               if (sid) {
                 delete transports[sid];
+                if (serverInstances[sid]) {
+                  delete serverInstances[sid];
+                }
                 serverModule2.settingsManager.clearSession(sid);
                 serverModule2.apiManagerFactory.clearSession(sid);
                 serverModule2.sessionManager.removeSession(sid);
@@ -485,7 +692,22 @@ async function launchHTTPServer(config, serverModule2, port) {
                 transport
               };
             };
-            await serverModule2.server.connect(transport).catch((error) => {
+            let serverToConnect;
+            if (serverModule2.createServerInstance) {
+              const sessionServer = serverModule2.createServerInstance();
+              serverToConnect = sessionServer;
+              const originalOnSessionInit = transport.onsessioninitialized;
+              transport.onsessioninitialized = (sid) => {
+                serverInstances[sid] = sessionServer;
+                if (originalOnSessionInit) {
+                  originalOnSessionInit(sid);
+                }
+              };
+            } else {
+              serverToConnect = serverModule2.server;
+              console.error("Warning: Using shared server instance. Consider providing createServerInstance for better multi-user support.");
+            }
+            await serverToConnect.connect(transport).catch((error) => {
               console.error("Error connecting to HTTP transport:", error);
             });
           } else {
@@ -563,168 +785,75 @@ async function launchHTTPServer(config, serverModule2, port) {
   });
 }
 function headersToEnvVars(headers, config) {
+  const verbose = SettingsManager.globalDebugState;
+  if (verbose) {
+    console.error("[headersToEnvVars] Verbose: Converting headers to env vars");
+    console.error("[headersToEnvVars] Verbose: Input headers count:", Object.keys(headers).length);
+    console.error("[headersToEnvVars] Verbose: Input header keys:", Object.keys(headers));
+    if (!headers || Object.keys(headers).length === 0) {
+      console.error("[headersToEnvVars] Verbose: WARNING - Headers object is empty");
+    }
+  }
+  if (!headers || Object.keys(headers).length === 0) {
+    return {};
+  }
   const result = {};
   for (const [name, value] of Object.entries(headers)) {
     if (value !== void 0) {
       const envName = name.toUpperCase().replace(/-/g, "_");
       result[envName] = value;
+      if (verbose) {
+        console.error(`[headersToEnvVars] Verbose: Basic mapping: "${name}" -> "${envName}"`);
+      }
     }
   }
+  if (verbose) {
+    console.error("[headersToEnvVars] Verbose: After basic mapping, result keys:", Object.keys(result));
+  }
   if (config && config.options) {
+    if (verbose) {
+      console.error("[headersToEnvVars] Verbose: Config provided, building header-to-env mapping");
+    }
     const headerToEnvMap = {};
     for (const option of config.options) {
       if (option.env) {
         const flagName = option.flag.split(" ")[0].replace(/^--?/, "").replace(/-/g, "_");
         headerToEnvMap[flagName.toLowerCase()] = option.env;
+        if (verbose) {
+          console.error(`[headersToEnvVars] Verbose: Mapping: "${flagName.toLowerCase()}" -> "${option.env}"`);
+        }
         headerToEnvMap[option.env.toLowerCase()] = option.env;
       }
     }
+    if (verbose) {
+      console.error("[headersToEnvVars] Verbose: headerToEnvMap:", headerToEnvMap);
+    }
+    let mappedCount = 0;
     for (const [headerName, headerValue] of Object.entries(headers)) {
       if (headerValue !== void 0) {
         const normalizedHeaderName = headerName.toLowerCase().replace(/-/g, "_");
         const envVarName = headerToEnvMap[normalizedHeaderName];
         if (envVarName) {
           result[envVarName] = headerValue;
+          mappedCount++;
+          if (verbose) {
+            console.error(`[headersToEnvVars] Verbose: Config mapping: "${headerName}" -> "${envVarName}"`);
+          }
         }
       }
     }
-  }
-  return result;
-}
-
-// ../mcp-utils/dist/settings-manager.js
-var SettingsManager = class _SettingsManager {
-  /**
-   * Creates a new SettingsManager
-   * @param settingsClass The Settings class to use for creating settings instances
-   */
-  constructor(settingsClass) {
-    this.settingsMap = /* @__PURE__ */ new Map();
-    this.defaultSessionId = "default";
-    this.settingsClass = settingsClass;
-  }
-  /**
-   * Get settings for a specific session
-   * @param sessionId The session ID (defaults to 'default' for stdio mode)
-   * @returns Settings instance for the session
-   */
-  getSettings(sessionId) {
-    const sid = sessionId || this.defaultSessionId;
-    if (!this.settingsMap.has(sid)) {
-      this.settingsMap.set(sid, new this.settingsClass());
+    if (verbose) {
+      console.error(`[headersToEnvVars] Verbose: Mapped ${mappedCount} headers using config`);
     }
-    return this.settingsMap.get(sid);
+  } else if (verbose) {
+    console.error("[headersToEnvVars] Verbose: No config provided, skipping config-based mapping");
   }
-  /**
-   * Set settings for a specific session
-   * @param settings The settings object to set
-   * @param sessionId The session ID (defaults to 'default' for stdio mode)
-   */
-  setSettings(settings, sessionId) {
-    const sid = sessionId || this.defaultSessionId;
-    this.settingsMap.set(sid, settings);
+  if (verbose) {
+    console.error("[headersToEnvVars] Verbose: Final result keys:", Object.keys(result));
+    console.error("[headersToEnvVars] Verbose: Final result (sanitized):", Object.fromEntries(Object.entries(result).map(([k, v]) => [k, k.toLowerCase().includes("key") || k.toLowerCase().includes("token") || k.toLowerCase().includes("password") ? "***" : v])));
   }
-  /**
-   * Injects debug settings from source into settings object
-   * @param settings The settings object to update
-   * @param source Source object containing debug information
-   * @private
-   */
-  injectDebug(settings, source) {
-    const debug = source?.debug ?? _SettingsManager.globalDebugState ?? process.env.DEBUG;
-    if (typeof debug !== "undefined") {
-      if (source?.debug !== void 0) {
-        _SettingsManager.globalDebugState = source.debug;
-      }
-      if (typeof settings.set === "function") {
-        settings.set("debug", debug);
-      } else {
-        settings.debug = debug;
-      }
-      if (debug) {
-        console.error("Debug enabled. Source object contents:");
-        console.error(JSON.stringify(source, null, 2));
-      }
-    }
-  }
-  /**
-   * Print settings object for debugging by dynamically discovering its properties
-   * @param settings The settings object to print
-   * @private
-   */
-  printSettingsDebug(settings) {
-    if (typeof settings.get === "function") {
-      console.error("Settings (using get method):");
-      if (settings.data && typeof settings.data === "object") {
-        Object.entries(settings.data).forEach(([key, value]) => {
-          console.error(`  ${key}: ${JSON.stringify(value)}`);
-        });
-      } else {
-        console.error("  Unable to enumerate settings properties - no accessible data structure");
-      }
-    } else {
-      console.error("Settings (plain object):");
-      Object.entries(settings).forEach(([key, value]) => {
-        console.error(`  ${key}: ${JSON.stringify(value)}`);
-      });
-    }
-  }
-  /**
-   * Create settings from command-line arguments
-   * @param args Command line arguments
-   * @param sessionId Optional session ID
-   * @returns Settings instance
-   */
-  createFromArgs(args, sessionId) {
-    const settings = this.settingsClass.fromArgs(args);
-    this.injectDebug(settings, args);
-    this.setSettings(settings, sessionId);
-    return settings;
-  }
-  /**
-   * Create settings from HTTP headers
-   * @param headers HTTP headers
-   * @param sessionId Optional session ID
-   * @returns Settings instance
-   */
-  createFromHeaders(headers, sessionId) {
-    if (_SettingsManager.globalDebugState) {
-      console.error("=== createFromHeaders Debug Info ===");
-      console.error("Incoming headers:");
-      console.error(JSON.stringify(headers, null, 2));
-    }
-    const normalizedHeaders = {};
-    for (const [key, value] of Object.entries(headers)) {
-      const normalizedKey = key.includes("_") ? key.replace(/_/g, "-") : key;
-      normalizedHeaders[normalizedKey] = value;
-    }
-    if (_SettingsManager.globalDebugState) {
-      console.error("Normalized headers:");
-      console.error(JSON.stringify(normalizedHeaders, null, 2));
-    }
-    const debugHeader = normalizedHeaders["debug"] || normalizedHeaders["Debug"] || normalizedHeaders["DEBUG"];
-    const debugSource = { debug: debugHeader !== void 0 ? debugHeader : _SettingsManager.globalDebugState };
-    const settings = this.settingsClass.fromHeaders(normalizedHeaders);
-    this.injectDebug(settings, debugSource);
-    if (_SettingsManager.globalDebugState) {
-      console.error("Final settings object:");
-      this.printSettingsDebug(settings);
-      console.error("=== End createFromHeaders Debug Info ===");
-    }
-    this.setSettings(settings, sessionId);
-    return settings;
-  }
-  /**
-   * Clear settings for a session
-   * @param sessionId The session ID to clear
-   */
-  clearSession(sessionId) {
-    if (sessionId !== this.defaultSessionId) {
-      this.settingsMap.delete(sessionId);
-    }
-  }
-};
-SettingsManager.globalDebugState = void 0;
+  return result;
+}
 
 // ../mcp-utils/dist/api-manager-factory.js
 var APIManagerFactory = class {
@@ -745,11 +874,27 @@ var APIManagerFactory = class {
    * @returns API Manager instance for the session
    */
   getAPIManager(sessionId) {
+    const verbose = SettingsManager.globalDebugState;
     const sid = sessionId || this.defaultSessionId;
+    if (verbose) {
+      console.error("[APIManagerFactory.getAPIManager] Verbose: Getting API manager for session:", sid);
+    }
     if (!this.apiManagerMap.has(sid)) {
+      if (verbose) {
+        console.error("[APIManagerFactory.getAPIManager] Verbose: API manager not in cache, creating new one");
+      }
       const settings2 = this.settingsManager.getSettings(sid);
+      if (verbose) {
+        console.error("[APIManagerFactory.getAPIManager] Verbose: Retrieved settings from settings manager");
+        console.error("[APIManagerFactory.getAPIManager] Verbose: Creating API manager from settings");
+      }
       const apiManager2 = this.createAPIManagerFromSettings(settings2);
+      if (verbose) {
+        console.error("[APIManagerFactory.getAPIManager] Verbose: API manager created successfully");
+      }
       this.apiManagerMap.set(sid, apiManager2);
+    } else if (verbose) {
+      console.error("[APIManagerFactory.getAPIManager] Verbose: Using cached API manager");
     }
     const apiManager = this.apiManagerMap.get(sid);
     const settings = this.settingsManager.getSettings(sid);
@@ -764,7 +909,17 @@ var APIManagerFactory = class {
    * @returns API Manager instance
    */
   createAPIManagerFromSettings(settings) {
-    return this.apiManagerClass.create(settings);
+    const verbose = SettingsManager.globalDebugState;
+    if (verbose) {
+      console.error("[APIManagerFactory.createAPIManagerFromSettings] Verbose: Creating API manager from settings");
+      console.error("[APIManagerFactory.createAPIManagerFromSettings] Verbose: Settings type:", typeof settings);
+      console.error("[APIManagerFactory.createAPIManagerFromSettings] Verbose: Settings keys:", settings ? Object.keys(settings) : "null");
+    }
+    const apiManager = this.apiManagerClass.create(settings);
+    if (verbose) {
+      console.error("[APIManagerFactory.createAPIManagerFromSettings] Verbose: API manager created");
+    }
+    return apiManager;
   }
   /**
    * Clear API manager for a session
@@ -1117,7 +1272,8 @@ var SessionManager = class {
 
 // ../mcp-utils/dist/server-utils.js
 function getHeaderValue(headers, key) {
-  const value = headers[key] || headers[key.toUpperCase()] || headers[key.toLowerCase()];
+  const normalizedKey = key.replace(/_/g, "-");
+  const value = headers[normalizedKey] || headers[normalizedKey.toUpperCase()] || headers[normalizedKey.toLowerCase()];
   return typeof value === "string" ? value : Array.isArray(value) ? value[0] : void 0;
 }
 function createApiRunner(serverModule2) {
@@ -1126,27 +1282,238 @@ function createApiRunner(serverModule2) {
     return await apiManager.callApi(method, uri, data, domain);
   };
 }
-function createServerModule(server2, Settings2, pkg2, apiManagerClass) {
+function wrapServerWithTracking(server2, createServerFn) {
+  const registrations = [];
+  const originalTool = server2.tool?.bind(server2);
+  const originalPrompt = server2.prompt?.bind(server2);
+  const originalResource = server2.resource?.bind(server2);
+  if (originalTool) {
+    server2.tool = function(...args) {
+      registrations.push({ type: "tool", method: "tool", args: [...args] });
+      return originalTool(...args);
+    };
+  }
+  if (originalPrompt) {
+    server2.prompt = function(...args) {
+      registrations.push({ type: "prompt", method: "prompt", args: [...args] });
+      return originalPrompt(...args);
+    };
+  }
+  if (originalResource) {
+    server2.resource = function(...args) {
+      registrations.push({ type: "resource", method: "resource", args: [...args] });
+      return originalResource(...args);
+    };
+  }
+  const createInstance = () => {
+    const newServer = createServerFn();
+    for (const reg of registrations) {
+      if (newServer[reg.method]) {
+        newServer[reg.method](...reg.args);
+      }
+    }
+    if (typeof server2.setToolPolicy === "function" && typeof newServer.setToolPolicy === "function") {
+      const toolPolicy = server2._toolPolicyCallback;
+      if (toolPolicy) {
+        newServer.setToolPolicy(toolPolicy);
+      }
+    }
+    return newServer;
+  };
+  return { wrappedServer: server2, createInstance };
+}
+function createServerModule(server2, Settings2, pkg2, apiManagerClass, toolPolicyCallback, createServerFn) {
   const settingsManager = new SettingsManager(Settings2);
   const apiManagerFactory = new APIManagerFactory(apiManagerClass, settingsManager);
   const sessionManager = new SessionManager();
+  if (toolPolicyCallback && typeof server2.setToolPolicy === "function") {
+    console.error("[createServerModule] Setting tool policy callback on server");
+    server2.setToolPolicy(toolPolicyCallback);
+  }
+  const serverFactory = createServerFn || server2._createServerFn;
+  let createServerInstance;
+  if (serverFactory) {
+    const { wrappedServer, createInstance } = wrapServerWithTracking(server2, serverFactory);
+    createServerInstance = createInstance;
+    console.error("[createServerModule] Server factory enabled - HTTP multi-user support active");
+  } else {
+    console.error("[createServerModule] Warning: No server factory provided - HTTP multi-user may have issues");
+  }
   return {
     server: server2,
     Settings: Settings2,
     settingsManager,
     apiManagerFactory,
     sessionManager,
-    pkg: pkg2
+    pkg: pkg2,
+    toolPolicyCallback,
+    createServerInstance
   };
 }
 
 // ../mcp-utils/dist/index.js
 init_ui_dialog();
 
-// src/index.ts
+// ../mcp-utils/dist/telemetry.js
+import machineIdPkg from "node-machine-id";
+import { createHash } from "crypto";
+var { machineIdSync } = machineIdPkg;
+var machineId = null;
+var hashedMachineId = null;
+function isTelemetryDisabled() {
+  return process.env.TELEMETRY_DISABLED === "true" || process.env.TELEMETRY_DISABLED === "1";
+}
+function getTelemetryUrl() {
+  return process.env.TELEMETRY_URL || "https://metrics.security.ai.checkpoint.com/api/v1/metrics/collect";
+}
+function hashString(input) {
+  return createHash("sha256").update(input).digest("hex");
+}
+function getMachineId() {
+  if (!machineId) {
+    try {
+      machineId = machineIdSync();
+    } catch (error) {
+      console.warn("Failed to get machine ID for telemetry:", error);
+      machineId = "unknown";
+    }
+  }
+  return machineId;
+}
+function getHashedMachineId() {
+  if (!hashedMachineId) {
+    hashedMachineId = hashString(getMachineId());
+  }
+  return hashedMachineId;
+}
+function calculateChecksum(mcpName, toolName, machineId2, clientVersion) {
+  const data = mcpName + machineId2.slice(0, 16) + toolName + clientVersion;
+  return hashString(data);
+}
+async function trackToolCall(mcpName, toolName, clientVersion, extra) {
+  if (isTelemetryDisabled()) {
+    return;
+  }
+  try {
+    const machineId2 = getHashedMachineId();
+    const checksum = calculateChecksum(mcpName, toolName, machineId2, clientVersion);
+    fetch(getTelemetryUrl(), {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        mcp_name: mcpName,
+        tool_name: toolName,
+        machine_id: machineId2,
+        client_version: clientVersion,
+        checksum
+      })
+    }).catch(() => {
+    });
+  } catch (error) {
+  }
+}
+
+// ../mcp-utils/dist/mcp-server.js
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+var CPMcpServer = class extends McpServer {
+  constructor(serverInfo, options) {
+    super(serverInfo, options);
+    this.mcpName = serverInfo.name;
+    this.mcpVersion = serverInfo.version || "0.0.0";
+  }
+  /**
+   * Set a tool policy callback to filter which tools are available
+   * This should be called after all tools are registered but before connecting
+   * @param callback Function that returns true if a tool should be enabled
+   */
+  setToolPolicy(callback) {
+    console.error("[CPMcpServer] Setting tool policy callback");
+    this.toolPolicyCallback = callback;
+  }
+  /**
+   * Apply the tool policy by checking all registered tools
+   * This should be called after all tools are registered but before connecting
+   */
+  applyToolPolicy() {
+    if (!this.toolPolicyCallback) {
+      console.error("[CPMcpServer] No tool policy callback set, allowing all tools");
+      return;
+    }
+    console.error("[CPMcpServer] Applying tool policy");
+    const registeredTools = this._registeredTools;
+    if (!registeredTools || typeof registeredTools !== "object") {
+      console.error("[CPMcpServer] No tools registered yet");
+      return;
+    }
+    const toolNames = Object.keys(registeredTools);
+    console.error(`[CPMcpServer] Found ${toolNames.length} registered tools:`, toolNames);
+    let enabledCount = 0;
+    let disabledCount = 0;
+    for (const [toolName, tool] of Object.entries(registeredTools)) {
+      const isAllowed = this.toolPolicyCallback(toolName);
+      if (!isAllowed) {
+        console.error(`[CPMcpServer] Tool '${toolName}' is NOT allowed by policy - disabling`);
+        if (typeof tool.disable === "function") {
+          tool.disable();
+          disabledCount++;
+        }
+      } else {
+        console.error(`[CPMcpServer] Tool '${toolName}' is allowed by policy`);
+        enabledCount++;
+      }
+    }
+    console.error(`[CPMcpServer] Policy applied: ${enabledCount}/${toolNames.length} tools enabled, ${disabledCount} disabled`);
+  }
+  // Override the tool method to wrap callbacks with telemetry
+  tool(...args) {
+    const callback = args[args.length - 1];
+    if (typeof callback === "function") {
+      const toolName = args[0];
+      const wrappedCallback = async (...callbackArgs) => {
+        let extra = callbackArgs[1];
+        if (!extra && callbackArgs[0]?.sessionId) {
+          extra = callbackArgs[0];
+        }
+        trackToolCall(this.mcpName, toolName, this.mcpVersion, extra).catch(() => {
+        });
+        if (callbackArgs.length === 1 && callbackArgs[0]?.sessionId) {
+          return callback({}, callbackArgs[0]);
+        }
+        return callback(...callbackArgs);
+      };
+      args[args.length - 1] = wrappedCallback;
+    }
+    return super.tool(...args);
+  }
+};
+
+// ../mcp-utils/dist/package-utils.js
 import { readFileSync } from "fs";
 import { join as join2, dirname } from "path";
 import { fileURLToPath } from "url";
+function readPackageJson(importMetaUrl) {
+  const pkg2 = JSON.parse(readFileSync(join2(dirname(fileURLToPath(importMetaUrl)), "../package.json"), "utf-8"));
+  process.env.CP_MCP_MAIN_PKG = `${pkg2.name} v${pkg2.version}`;
+  return pkg2;
+}
+function createMcpServer(importMetaUrl, serverInfo, options) {
+  const pkg2 = readPackageJson(importMetaUrl);
+  const fullServerInfo = {
+    ...serverInfo,
+    name: serverInfo.name || pkg2.name,
+    version: serverInfo.version || pkg2.version
+  };
+  const createServerFn = () => {
+    return new CPMcpServer(fullServerInfo, options);
+  };
+  const server2 = new CPMcpServer(fullServerInfo, options);
+  server2._createServerFn = createServerFn;
+  return { server: server2, pkg: pkg2 };
+}
+
+// src/index.ts
+import { join as join3, dirname as dirname2 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/documentation-api-manager.ts
 import axios3 from "axios";
@@ -1167,9 +1534,59 @@ function nullOrEmpty(val) {
 
 // ../infra/dist/settings.js
 var Settings = class _Settings {
-  constructor({ apiKey = process.env.API_KEY, username = process.env.USERNAME, password = process.env.PASSWORD, s1cUrl = process.env.S1C_URL, managementHost = process.env.MANAGEMENT_HOST, managementPort = process.env.MANAGEMENT_PORT || "443", cloudInfraToken = process.env.CLOUD_INFRA_TOKEN, clientId = process.env.CLIENT_ID, secretKey = process.env.SECRET_KEY, region = process.env.REGION || "EU", devPort = process.env.DEV_PORT || "8006" } = {}) {
+  normalizeRegion(region) {
+    if (!region) {
+      return void 0;
+    }
+    const normalized = region.trim().toUpperCase();
+    return this.isValidRegion(normalized) ? normalized : void 0;
+  }
+  /**
+   * Extract the base gateway URL (scheme + host) from a full URL.
+   * Allows users to copy-paste any URL from the API key creation dialog
+   * without having to strip the path manually.
+   * Falls back to the original string if URL parsing fails.
+   */
+  static stripGatewayPath(url) {
+    try {
+      const parsed = new URL(url);
+      return `${parsed.protocol}//${parsed.host}`;
+    } catch {
+      return url;
+    }
+  }
+  /**
+   * Detect the region from a gateway base URL
+   */
+  static detectRegionFromUrl(url) {
+    if (url.includes("cloudinfra-gw-us.portal.checkpoint.com"))
+      return "US";
+    if (url.includes("cloudinfra-gw.portal.checkpoint.com"))
+      return "EU";
+    if (url.includes("dev-cloudinfra-gw"))
+      return "STG";
+    return void 0;
+  }
+  constructor({ apiKey = process.env.API_KEY, username = process.env.USERNAME, password = process.env.PASSWORD, s1cUrl = process.env.S1C_URL, managementHost = process.env.MANAGEMENT_HOST, managementPort = process.env.MANAGEMENT_PORT || "443", cloudInfraToken = process.env.CLOUD_INFRA_TOKEN, clientId = process.env.CLIENT_ID, secretKey = process.env.SECRET_KEY, region = process.env.REGION || "EU", devPort = process.env.DEV_PORT || "8006", gatewayUrl } = {}) {
     this.region = "EU";
     this.devPort = "8006";
+    this.gatewayUrl = "";
+    const verbose = SettingsManager.globalDebugState;
+    if (verbose) {
+      console.error("[Settings] Verbose: Constructor called with params:", {
+        apiKey: apiKey ? "***" : void 0,
+        username: username ? "***" : void 0,
+        password: password ? "***" : void 0,
+        s1cUrl,
+        managementHost,
+        managementPort,
+        cloudInfraToken: cloudInfraToken ? "***" : void 0,
+        clientId,
+        secretKey: secretKey ? "***" : void 0,
+        region,
+        devPort
+      });
+    }
     this.apiKey = apiKey;
     this.username = username;
     this.password = password;
@@ -1179,8 +1596,21 @@ var Settings = class _Settings {
     this.cloudInfraToken = cloudInfraToken;
     this.clientId = clientId;
     this.secretKey = secretKey;
-    this.region = this.isValidRegion(region) ? region : "EU";
+    this.region = this.normalizeRegion(region) || "EU";
     this.devPort = devPort;
+    this.gatewayUrl = this.resolveGatewayUrl(this.region, gatewayUrl);
+    if (verbose) {
+      console.error("[Settings] Verbose: After assignment:", {
+        apiKey: this.apiKey ? "***" : void 0,
+        username: this.username ? "***" : void 0,
+        password: this.password ? "***" : void 0,
+        s1cUrl: this.s1cUrl,
+        managementHost: this.managementHost,
+        managementPort: this.managementPort,
+        cloudInfraToken: this.cloudInfraToken ? "***" : void 0,
+        region: this.region
+      });
+    }
     this.validate();
   }
   /**
@@ -1190,10 +1620,10 @@ var Settings = class _Settings {
     return ["EU", "US", "STG", "LOCAL"].includes(region.toUpperCase());
   }
   /**
-   * Get Cloud Infra Gateway based on region
+   * Get the base gateway URL for a given region
    */
-  getCloudInfraGateway() {
-    switch (this.region) {
+  getRegionGatewayUrl(region) {
+    switch (region) {
       case "EU":
         return "https://cloudinfra-gw.portal.checkpoint.com";
       case "US":
@@ -1205,23 +1635,88 @@ var Settings = class _Settings {
         return "";
     }
   }
+  /**
+   * Resolve the base gateway URL from either a provided URL or the configured region.
+   * If a URL is provided, its path suffix is stripped so users can paste the full
+   * auth URL from the API key creation dialog (e.g. ending in /auth/external).
+   * When the URL implies a different region, this.region is updated to match.
+   */
+  resolveGatewayUrl(region, providedUrl) {
+    if (!providedUrl) {
+      return this.getRegionGatewayUrl(region);
+    }
+    const base = _Settings.stripGatewayPath(providedUrl);
+    const detectedRegion = _Settings.detectRegionFromUrl(base);
+    if (detectedRegion && detectedRegion !== this.region) {
+      this.region = detectedRegion;
+    }
+    return base;
+  }
+  /**
+   * Get the base Cloud Infra Gateway URL.
+   * Returns the precomputed gatewayUrl (derived from region or a provided URL).
+   */
+  getCloudInfraGateway() {
+    return this.gatewayUrl;
+  }
   /**
    * Validate the settings
    */
   validate() {
+    const verbose = SettingsManager.globalDebugState;
+    if (verbose) {
+      console.error("[Settings] Verbose: Validating settings...");
+      console.error("[Settings] Verbose: s1cUrl:", this.s1cUrl || "(empty)");
+      console.error("[Settings] Verbose: managementHost:", this.managementHost || "(empty)");
+      console.error("[Settings] Verbose: apiKey:", this.apiKey ? "***" : "(empty)");
+      console.error("[Settings] Verbose: cloudInfraToken:", this.cloudInfraToken ? "***" : "(empty)");
+      console.error("[Settings] Verbose: username:", this.username ? "***" : "(empty)");
+      console.error("[Settings] Verbose: password:", this.password ? "***" : "(empty)");
+    }
     if (!nullOrEmpty(this.s1cUrl) && nullOrEmpty(this.apiKey) && nullOrEmpty(this.cloudInfraToken)) {
+      if (verbose) {
+        console.error("[Settings] Verbose: Validation FAILED - S1C URL provided but no API key or CI token");
+      }
       throw new Error("API key or CI Token is required for S1C (via --api-key or API_KEY env var)");
     }
     if (!nullOrEmpty(this.managementHost) && nullOrEmpty(this.apiKey) && (nullOrEmpty(this.username) || nullOrEmpty(this.password))) {
+      if (verbose) {
+        console.error("[Settings] Verbose: Validation FAILED - Management host provided but no API key or credentials");
+      }
       throw new Error("Either API key or username/password are required for on-prem management (via CLI args or env vars)");
     }
     if (nullOrEmpty(this.s1cUrl) && nullOrEmpty(this.managementHost)) {
+      if (verbose) {
+        console.error("[Settings] Verbose: WARNING - Neither s1cUrl nor managementHost provided");
+      }
+    }
+    if (verbose) {
+      console.error("[Settings] Verbose: Validation PASSED");
     }
   }
   /**
    * Create settings from command-line arguments
    */
   static fromArgs(args) {
+    const verbose = SettingsManager.globalDebugState;
+    if (verbose) {
+      console.error("[Settings.fromArgs] Verbose: Creating settings from args");
+      console.error("[Settings.fromArgs] Verbose: Raw args:", {
+        apiKey: args.apiKey ? "***" : void 0,
+        username: args.username ? "***" : void 0,
+        password: args.password ? "***" : void 0,
+        s1cUrl: args.s1cUrl,
+        managementHost: args.managementHost,
+        managementPort: args.managementPort,
+        cloudInfraToken: args.cloudInfraToken ? "***" : void 0,
+        region: args.region,
+        hasOtherKeys: Object.keys(args).length > 10
+      });
+      const hasAnyValue = args.apiKey || args.username || args.password || args.s1cUrl || args.managementHost || args.cloudInfraToken;
+      if (!hasAnyValue) {
+        console.error("[Settings.fromArgs] Verbose: WARNING - Args object appears empty, no authentication values found");
+      }
+    }
     return new _Settings({
       apiKey: args.apiKey,
       username: args.username,
@@ -1232,8 +1727,9 @@ var Settings = class _Settings {
       cloudInfraToken: args.cloudInfraToken,
       clientId: args.clientId,
       secretKey: args.secretKey,
-      region: typeof args.region === "string" ? args.region.toUpperCase() : void 0,
-      devPort: args.devPort
+      region: typeof args.region === "string" ? args.region.trim().toUpperCase() : void 0,
+      devPort: args.devPort,
+      gatewayUrl: args.gatewayUrl
     });
   }
   /**
@@ -1241,7 +1737,12 @@ var Settings = class _Settings {
    * Maps headers to environment variable format based on server config
    */
   static fromHeaders(headers) {
-    return new _Settings({
+    const verbose = SettingsManager.globalDebugState;
+    if (verbose) {
+      console.error("[Settings.fromHeaders] Verbose: Creating settings from headers");
+      console.error("[Settings.fromHeaders] Verbose: Available header keys:", Object.keys(headers));
+    }
+    const extractedValues = {
       apiKey: getHeaderValue(headers, "API-KEY"),
       username: getHeaderValue(headers, "USERNAME"),
       password: getHeaderValue(headers, "PASSWORD"),
@@ -1251,8 +1752,41 @@ var Settings = class _Settings {
       cloudInfraToken: getHeaderValue(headers, "CLOUD-INFRA-TOKEN"),
       clientId: getHeaderValue(headers, "CLIENT-ID"),
       secretKey: getHeaderValue(headers, "SECRET-KEY"),
-      region: getHeaderValue(headers, "REGION")?.toUpperCase(),
-      devPort: getHeaderValue(headers, "DEV-PORT")
+      region: getHeaderValue(headers, "REGION"),
+      devPort: getHeaderValue(headers, "DEV-PORT"),
+      gatewayUrl: getHeaderValue(headers, "GATEWAY-URL")
+    };
+    if (verbose) {
+      console.error("[Settings.fromHeaders] Verbose: Extracted values:", {
+        apiKey: extractedValues.apiKey ? "***" : void 0,
+        username: extractedValues.username ? "***" : void 0,
+        password: extractedValues.password ? "***" : void 0,
+        s1cUrl: extractedValues.s1cUrl,
+        managementHost: extractedValues.managementHost,
+        managementPort: extractedValues.managementPort,
+        cloudInfraToken: extractedValues.cloudInfraToken ? "***" : void 0,
+        region: extractedValues.region,
+        devPort: extractedValues.devPort
+      });
+      const hasAnyValue = extractedValues.apiKey || extractedValues.username || extractedValues.password || extractedValues.s1cUrl || extractedValues.managementHost || extractedValues.cloudInfraToken;
+      if (!hasAnyValue) {
+        console.error("[Settings.fromHeaders] Verbose: WARNING - No authentication values found in headers");
+        console.error("[Settings.fromHeaders] Verbose: Full headers object (sanitized):", Object.fromEntries(Object.entries(headers).map(([k, v]) => [k, k.toLowerCase().includes("key") || k.toLowerCase().includes("token") || k.toLowerCase().includes("password") ? "***" : v])));
+      }
+    }
+    return new _Settings({
+      apiKey: extractedValues.apiKey,
+      username: extractedValues.username,
+      password: extractedValues.password,
+      s1cUrl: extractedValues.s1cUrl,
+      managementHost: extractedValues.managementHost,
+      managementPort: extractedValues.managementPort,
+      cloudInfraToken: extractedValues.cloudInfraToken,
+      clientId: extractedValues.clientId,
+      secretKey: extractedValues.secretKey,
+      region: extractedValues.region?.toUpperCase(),
+      devPort: extractedValues.devPort,
+      gatewayUrl: extractedValues.gatewayUrl
     });
   }
 };
@@ -1415,30 +1949,38 @@ var DocumentationToolAPIManager = class _DocumentationToolAPIManager {
 // src/settings.ts
 var DocumentationToolSettings = class _DocumentationToolSettings extends Settings {
   constructor(args = {}) {
-    super(args);
+    super({
+      ...args,
+      gatewayUrl: args.authUrl || args.gatewayUrl
+    });
   }
   /**
    * Create DocumentationToolSettings from command-line arguments for Documentation Tool
    */
   static fromArgs(args) {
+    if (!args.authUrl && !args.region) {
+      throw new Error(
+        "Provide either --auth-url (Authentication URL from the API key creation dialog) or --region (EU, US, STG, or LOCAL)"
+      );
+    }
     return new _DocumentationToolSettings({
       ...args
     });
   }
+  static fromHeaders(headers) {
+    return new _DocumentationToolSettings({
+      clientId: getHeaderValue(headers, "CLIENT-ID"),
+      secretKey: getHeaderValue(headers, "SECRET-KEY"),
+      region: getHeaderValue(headers, "REGION"),
+      authUrl: getHeaderValue(headers, "AUTH-URL")
+    });
+  }
 };
 
 // src/index.ts
-var pkg = JSON.parse(
-  readFileSync(
-    join2(dirname(fileURLToPath(import.meta.url)), "../package.json"),
-    "utf-8"
-  )
-);
-process.env.CP_MCP_MAIN_PKG = `${pkg.name} v${pkg.version}`;
-var server = new McpServer({
+var { server, pkg } = createMcpServer(import.meta.url, {
   name: "checkpoint-documentation",
-  description: "Comprehensive Check Point documentation assistant providing instant access to product information, technical specifications, configuration guidance, and feature documentation across the entire Check Point security portfolio.",
-  version: "1.0.0"
+  description: "Comprehensive Check Point documentation assistant providing instant access to product information, technical specifications, configuration guidance, and feature documentation across the entire Check Point security portfolio."
 });
 var serverModule = createServerModule(
   server,
@@ -1544,7 +2086,7 @@ server.tool(
 );
 var main = async () => {
   await launchMCPServer(
-    join2(dirname(fileURLToPath(import.meta.url)), "server-config.json"),
+    join3(dirname2(fileURLToPath2(import.meta.url)), "server-config.json"),
     serverModule
   );
 };

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chkp/documentation-mcp",
-  "version": "1.0.1",
+  "version": "1.3.0",
   "description": "Check Point Documentation Tool Service - API integration with Check Point Documentation Tool",
   "type": "module",
   "main": "dist/index.js",
@@ -26,9 +26,10 @@
     "start": "node dist/index.js"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.11.1",
-    "axios": "^1.12.1",
+    "@modelcontextprotocol/sdk": "^1.26.0",
+    "axios": "^1.13.5",
     "commander": "^13.1.0",
+    "node-machine-id": "^1.1.12",
     "zod": "^3.22.4"
   },
   "devDependencies": {

package/dist/server-config.json

@@ -7,20 +7,33 @@
       "description": "Client ID for authentication with Documentation Tool",
       "env": "CLIENT_ID",
       "required": true,
-      "type": "string"
+      "type": "string",
+      "help": "Client ID for Check Point Documentation Tool authentication. To obtain: log in to the Infinity Portal → API Keys → New → New User API Key → copy the generated Client ID"
     },
     {
       "flag": "--secret-key <secret-key>",
       "description": "Secret Key for authentication with Documentation Tool",
       "env": "SECRET_KEY",
       "required": true,
-      "type": "string"
+      "type": "string",
+      "help": "Secret Key for Check Point Documentation Tool authentication. Generated alongside the Client ID — copy and store it securely at creation time as it will not be shown again"
+    },
+    {
+      "flag": "--auth-url <url>",
+      "description": "Authentication URL from the API key creation dialog",
+      "env": "AUTH_URL",
+      "required": true,
+      "type": "string",
+      "help": "Paste the Authentication URL shown when creating your API key (e.g. https://cloudinfra-gw.portal.checkpoint.com/auth/external). The path suffix is stripped automatically so you can copy it directly from the portal"
     },
     {
       "flag": "--region <region>",
-      "description": "Documentation Tool region: EU, US, STG, or Local",
+      "description": "Documentation Tool region: EU, US, STG, or LOCAL",
       "env": "REGION",
-      "type": "string"
+      "required": false,
+      "hidden": true,
+      "type": "string",
+      "help": "Alternative to --auth-url. Region code for your deployment: EU, US, STG, or LOCAL. Use this if you know your region and prefer not to copy the full authentication URL"
     }
   ]
-}
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chkp/documentation-mcp",
-  "version": "1.0.1",
+  "version": "1.3.0",
   "description": "Check Point Documentation Tool Service - API integration with Check Point Documentation Tool",
   "type": "module",
   "main": "dist/index.js",
@@ -26,9 +26,10 @@
     "start": "node dist/index.js"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.0.4",
+    "@modelcontextprotocol/sdk": "^1.26.0",
     "commander": "^13.1.0",
-    "axios": "^1.12.1",
+    "axios": "^1.13.5",
+    "node-machine-id": "^1.1.12",
     "zod": "^3.24.4"
   },
   "devDependencies": {