@chkp/documentation-mcp 1.4.10 → 1.4.13

package/dist/index.js

@@ -368,6 +368,84 @@ var init_ui_dialog = __esm({
 // src/index.ts
 import { z } from "zod";
 
+// ../mcp-utils/dist/cli-options.js
+function booleanOptionDefault(envValue, optionDefault) {
+  return envValue === "true" || optionDefault === "true";
+}
+function resolveTransportType(transportOption, env = process.env) {
+  return (transportOption || env.MCP_TRANSPORT_TYPE || "stdio").toLowerCase() === "http" ? "http" : "stdio";
+}
+function optionKey(flag) {
+  const long = flag.split(/[,\s]+/).find((part) => part.startsWith("--"));
+  if (!long)
+    return void 0;
+  const negated = long.startsWith("--no-");
+  return {
+    key: long.replace(/^--(no-)?/, "").replace(/-([a-z])/g, (_match, char) => char.toUpperCase()),
+    negated
+  };
+}
+function operatorValues(options, parsed, env = process.env) {
+  const values = { ...env };
+  for (const option of options) {
+    const derived = option.env ? optionKey(option.flag) : void 0;
+    if (!derived || derived.negated)
+      continue;
+    const value = parsed[derived.key];
+    if (value !== void 0)
+      values[option.env] = value;
+  }
+  return values;
+}
+
+// ../mcp-utils/dist/debug-view.js
+import { createHash } from "node:crypto";
+var BUILTIN_LOGGABLE_KEYS = [
+  "accept",
+  "accept-encoding",
+  "accept-language",
+  "connection",
+  "content-length",
+  "content-type",
+  "host",
+  "mcp-protocol-version",
+  "traceparent",
+  "user-agent",
+  "x-correlation-id",
+  "x-gw-auth-method",
+  "x-request-id",
+  // Launcher options
+  "debug",
+  "telemetry",
+  "telemetry-url",
+  "transport",
+  "transport-port"
+];
+function normalizeDebugKey(key) {
+  const split = /[-_]/.test(key) ? key : key.replace(/([a-z][0-9]*)([A-Z])/g, "$1-$2");
+  return split.replace(/_/g, "-").toLowerCase();
+}
+function debugLoggableKeys(extra = []) {
+  return new Set([...BUILTIN_LOGGABLE_KEYS, ...extra].map(normalizeDebugKey));
+}
+function describe(key, value, loggable) {
+  if (value === void 0 || value === null || value === "")
+    return "(unset)";
+  if (loggable.has(normalizeDebugKey(key))) {
+    return typeof value === "string" ? value : JSON.stringify(value);
+  }
+  const text = typeof value === "string" ? value : Array.isArray(value) ? value.join(", ") : void 0;
+  return text === void 0 ? "(hidden)" : `(hidden, ${text.length} chars)`;
+}
+function debugView(record, loggable = debugLoggableKeys()) {
+  return Object.fromEntries(Object.entries(record ?? {}).map(([key, value]) => [key, describe(key, value, loggable)]));
+}
+function sessionLogLabel(sessionId) {
+  if (!sessionId || sessionId === "default")
+    return "default";
+  return `session#${createHash("sha256").update(sessionId).digest("hex").slice(0, 8)}`;
+}
+
 // ../mcp-utils/dist/launcher.js
 import { Command } from "commander";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
@@ -376,6 +454,89 @@ import fs from "fs";
 import http from "http";
 import { randomUUID } from "crypto";
 
+// ../mcp-utils/dist/connection-source.js
+function hasValue(value) {
+  return value !== void 0 && value !== null && value !== "" && !(Array.isArray(value) && value.length === 0);
+}
+function headersRead(fromHeaders, headers) {
+  const read = /* @__PURE__ */ new Set();
+  const recording = new Proxy(headers, {
+    get(target, prop, receiver) {
+      const value = Reflect.get(target, prop, receiver);
+      if (typeof prop === "string" && hasValue(value))
+        read.add(prop);
+      return value;
+    }
+  });
+  try {
+    fromHeaders(recording);
+  } catch {
+  }
+  return read;
+}
+function keySet(keys = []) {
+  return new Set(keys.map(normalizeDebugKey));
+}
+function chooseConnectionSource(read, basicKeys) {
+  for (const key of read) {
+    if (!basicKeys.has(normalizeDebugKey(key)))
+      return "caller";
+  }
+  return "operator";
+}
+function basicOnly(headers, basicKeys) {
+  return Object.fromEntries(Object.entries(headers).filter(([key]) => basicKeys.has(normalizeDebugKey(key))));
+}
+function mergeHeaders(base, overrides) {
+  const merged = {};
+  const index = /* @__PURE__ */ new Map();
+  for (const [key, value] of [...Object.entries(base), ...Object.entries(overrides)]) {
+    const id = normalizeDebugKey(key);
+    const previous = index.get(id);
+    if (previous !== void 0)
+      delete merged[previous];
+    index.set(id, key);
+    merged[key] = value;
+  }
+  return merged;
+}
+function operatorHeaders(values) {
+  const headers = {};
+  for (const [name, value] of Object.entries(values)) {
+    if (!hasValue(value))
+      continue;
+    headers[name.replace(/_/g, "-")] = Array.isArray(value) ? value.map(String) : String(value);
+  }
+  return headers;
+}
+function canonicalizeAliases(headers, aliases) {
+  if (aliases.size === 0)
+    return headers;
+  const canonical = new Set([...aliases.values()].map(normalizeDebugKey));
+  const present = new Set(Object.keys(headers).map(normalizeDebugKey).filter((key) => canonical.has(key)));
+  const result = {};
+  for (const [key, value] of Object.entries(headers)) {
+    const target = aliases.get(normalizeDebugKey(key));
+    if (target === void 0) {
+      result[key] = value;
+    } else if (!present.has(normalizeDebugKey(target))) {
+      result[target] = value;
+      present.add(normalizeDebugKey(target));
+    }
+  }
+  return result;
+}
+function aliasMap(aliases = {}) {
+  return new Map(Object.entries(aliases).map(([alias, target]) => [normalizeDebugKey(alias), target]));
+}
+function sessionHeaders(source, callerHeaders, operator, basicKeys, operatorSettingsOverHttp) {
+  if (source === "caller") {
+    return mergeHeaders(basicOnly(operator, basicKeys), callerHeaders);
+  }
+  const base = operatorSettingsOverHttp ? operator : basicOnly(operator, basicKeys);
+  return mergeHeaders(base, basicOnly(callerHeaders, basicKeys));
+}
+
 // ../mcp-utils/dist/settings-manager.js
 var SettingsManager = class _SettingsManager {
   /**
@@ -385,7 +546,13 @@ var SettingsManager = class _SettingsManager {
   constructor(settingsClass) {
     this.settingsMap = /* @__PURE__ */ new Map();
     this.defaultSessionId = "default";
+    this.operatorValues = {};
+    this.sessionSources = /* @__PURE__ */ new Map();
     this.settingsClass = settingsClass;
+    this.loggableKeys = debugLoggableKeys(settingsClass?.debugLoggableKeys ?? []);
+    this.basicKeys = keySet(settingsClass?.basicKeys ?? []);
+    this.headerAliases = aliasMap(settingsClass?.headerAliases);
+    this.operatorSettingsOverHttp = settingsClass?.operatorSettingsOverHttp !== false;
   }
   /**
    * Get settings for a specific session
@@ -412,12 +579,15 @@ var SettingsManager = class _SettingsManager {
    * Injects debug settings from source into settings object
    * @param settings The settings object to update
    * @param source Source object containing debug information
+   * @param scope 'process' when the operator set debug (CLI/env), which also
+   *   updates the process-wide state; 'session' when a caller set it through a
+   *   header, which affects only that session's settings
    * @private
    */
-  injectDebug(settings, source) {
+  injectDebug(settings, source, scope) {
     const debug = source?.debug ?? _SettingsManager.globalDebugState ?? process.env.DEBUG;
     if (typeof debug !== "undefined") {
-      if (source?.debug !== void 0) {
+      if (scope === "process" && source?.debug !== void 0) {
         _SettingsManager.globalDebugState = source.debug;
       }
       if (typeof settings.set === "function") {
@@ -426,8 +596,8 @@ var SettingsManager = class _SettingsManager {
         settings.debug = debug;
       }
       if (debug) {
-        console.error("Debug enabled. Source object contents:");
-        console.error(JSON.stringify(source, null, 2));
+        console.error("Debug enabled. Source:");
+        this.printDebugView(source);
       }
     }
   }
@@ -440,19 +610,21 @@ var SettingsManager = class _SettingsManager {
     if (typeof settings.get === "function") {
       console.error("Settings (using get method):");
       if (settings.data && typeof settings.data === "object") {
-        Object.entries(settings.data).forEach(([key, value]) => {
-          console.error(`  ${key}: ${JSON.stringify(value)}`);
-        });
+        this.printDebugView(settings.data);
       } else {
         console.error("  Unable to enumerate settings properties - no accessible data structure");
       }
     } else {
       console.error("Settings (plain object):");
-      Object.entries(settings).forEach(([key, value]) => {
-        console.error(`  ${key}: ${JSON.stringify(value)}`);
-      });
+      this.printDebugView(settings);
     }
   }
+  /** Print allowlisted values; everything else as "(hidden, N chars)". */
+  printDebugView(record) {
+    Object.entries(debugView(record, this.loggableKeys)).forEach(([key, value]) => {
+      console.error(`  ${key}: ${value}`);
+    });
+  }
   /**
    * Create settings from command-line arguments
    * @param args Command line arguments
@@ -461,10 +633,19 @@ var SettingsManager = class _SettingsManager {
    */
   createFromArgs(args, sessionId) {
     const settings = this.settingsClass.fromArgs(args);
-    this.injectDebug(settings, args);
+    this.injectDebug(settings, args, "process");
     this.setSettings(settings, sessionId);
     return settings;
   }
+  /**
+   * Record the operator's values (environment variables and parsed CLI
+   * options, keyed by environment-variable name). HTTP sessions take basic
+   * keys from them when the caller doesn't send its own, and their whole
+   * connection set when the caller sends none of it.
+   */
+  setOperatorValues(values) {
+    this.operatorValues = canonicalizeAliases(operatorHeaders(values), this.headerAliases);
+  }
   /**
    * Create settings from HTTP headers
    * @param headers HTTP headers
@@ -474,13 +655,13 @@ var SettingsManager = class _SettingsManager {
   createFromHeaders(headers, sessionId) {
     const verbose = _SettingsManager.globalDebugState;
     if (verbose) {
-      console.error("[SettingsManager.createFromHeaders] Verbose: Starting with sessionId:", sessionId || "(default)");
+      console.error("[SettingsManager.createFromHeaders] Verbose: Starting with session:", sessionLogLabel(sessionId));
       console.error("[SettingsManager.createFromHeaders] Verbose: Incoming headers count:", Object.keys(headers).length);
     }
     if (_SettingsManager.globalDebugState) {
       console.error("=== createFromHeaders Debug Info ===");
       console.error("Incoming headers:");
-      console.error(JSON.stringify(headers, null, 2));
+      this.printDebugView(headers);
     }
     if (verbose && (!headers || Object.keys(headers).length === 0)) {
       console.error("[SettingsManager.createFromHeaders] Verbose: WARNING - Headers object is empty or undefined");
@@ -497,26 +678,32 @@ var SettingsManager = class _SettingsManager {
       console.error("[SettingsManager.createFromHeaders] Verbose: Normalized headers count:", Object.keys(normalizedHeaders).length);
     }
     if (_SettingsManager.globalDebugState) {
-      console.error("Normalized headers:");
-      console.error(JSON.stringify(normalizedHeaders, null, 2));
+      console.error("Normalized header names:", Object.keys(normalizedHeaders));
     }
     const debugHeader = normalizedHeaders["debug"] || normalizedHeaders["Debug"] || normalizedHeaders["DEBUG"];
-    const debugSource = { debug: debugHeader !== void 0 ? debugHeader : _SettingsManager.globalDebugState };
+    const requestedDebug = Array.isArray(debugHeader) ? debugHeader[0] : debugHeader;
+    const debugSource = {
+      debug: requestedDebug !== void 0 ? requestedDebug.toLowerCase() === "true" : _SettingsManager.globalDebugState
+    };
+    const callerHeaders = canonicalizeAliases(normalizedHeaders, this.headerAliases);
+    const source = this.connectionSource(callerHeaders, sessionId);
+    const inputHeaders = sessionHeaders(source, callerHeaders, this.operatorValues, this.basicKeys, this.operatorSettingsOverHttp);
     if (verbose) {
+      console.error("[SettingsManager.createFromHeaders] Verbose: Connection settings source:", source);
       console.error("[SettingsManager.createFromHeaders] Verbose: Calling settingsClass.fromHeaders");
     }
-    const settings = this.settingsClass.fromHeaders(normalizedHeaders);
+    const settings = this.settingsClass.fromHeaders(inputHeaders);
     if (verbose) {
       console.error("[SettingsManager.createFromHeaders] Verbose: Settings object created");
     }
-    this.injectDebug(settings, debugSource);
+    this.injectDebug(settings, debugSource, "session");
     if (_SettingsManager.globalDebugState) {
-      console.error("Final settings object for session:", sessionId || "(default)");
+      console.error("Final settings object for session:", sessionLogLabel(sessionId));
       this.printSettingsDebug(settings);
       console.error("=== End createFromHeaders Debug Info ===");
     }
     if (verbose) {
-      console.error("[SettingsManager.createFromHeaders] Verbose: Storing settings for session:", sessionId || "(default)");
+      console.error("[SettingsManager.createFromHeaders] Verbose: Storing settings for session:", sessionLogLabel(sessionId));
     }
     this.setSettings(settings, sessionId);
     return settings;
@@ -528,14 +715,28 @@ var SettingsManager = class _SettingsManager {
   clearSession(sessionId) {
     if (sessionId !== this.defaultSessionId) {
       this.settingsMap.delete(sessionId);
+      this.sessionSources.delete(sessionId);
     }
   }
+  /**
+   * The session's connection source: decided by the request that creates the
+   * session and kept for its lifetime, so a later request cannot switch it.
+   */
+  connectionSource(headers, sessionId) {
+    const known = sessionId ? this.sessionSources.get(sessionId) : void 0;
+    if (known)
+      return known;
+    const source = chooseConnectionSource(headersRead((h) => this.settingsClass.fromHeaders(h), headers), this.basicKeys);
+    if (sessionId)
+      this.sessionSources.set(sessionId, source);
+    return source;
+  }
 };
 SettingsManager.globalDebugState = void 0;
 
 // ../mcp-utils/dist/telemetry.js
 import machineIdPkg from "node-machine-id";
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 var { machineIdSync } = machineIdPkg;
 var machineId = null;
 var hashedMachineId = null;
@@ -550,7 +751,7 @@ function getTelemetryUrl() {
   return process.env.TELEMETRY_URL || "https://metrics.security.ai.checkpoint.com/api/v1/metrics/collect";
 }
 function hashString(input) {
-  return createHash("sha256").update(input).digest("hex");
+  return createHash2("sha256").update(input).digest("hex");
 }
 function getMachineId() {
   if (!machineId) {
@@ -598,6 +799,21 @@ async function trackToolCall(mcpName, toolName, clientVersion, extra) {
 }
 
 // ../mcp-utils/dist/launcher.js
+function mirrorBooleanFlagsToEnv(config, options) {
+  for (const option of config.options) {
+    if (option.type !== "boolean" || !option.env)
+      continue;
+    const derived = optionKey(option.flag);
+    if (!derived)
+      continue;
+    if (derived.negated) {
+      throw new Error(`Option '${option.flag}' in the configuration for '${config.name}' is a negatable flag paired with env var '${option.env}', which cannot be mirrored automatically: commander keys it as '${derived.key}' and inverts its meaning, so whether the flag being present should set '${option.env}' to 'true' or 'false' depends on how that variable is named. Mirror it explicitly in launchMCPServer instead, the way --no-telemetry does for TELEMETRY_DISABLED.`);
+    }
+    if (options[derived.key] === true) {
+      process.env[option.env] = "true";
+    }
+  }
+}
 async function launchMCPServer(configPath, serverModule2) {
   const config = JSON.parse(fs.readFileSync(configPath, "utf8"));
   const program = new Command();
@@ -608,7 +824,7 @@ async function launchMCPServer(configPath, serverModule2) {
     const envValue = option.env ? process.env[option.env] : void 0;
     const defaultValue = envValue || option.default;
     if (option.type === "boolean") {
-      const boolDefault = envValue === "true" || option.default === "true";
+      const boolDefault = booleanOptionDefault(envValue, option.default);
       program.option(option.flag, option.description, boolDefault);
     } else {
       program.option(option.flag, option.description, defaultValue);
@@ -632,17 +848,24 @@ async function launchMCPServer(configPath, serverModule2) {
   if (options.telemetryUrl) {
     process.env.TELEMETRY_URL = options.telemetryUrl;
   }
+  mirrorBooleanFlagsToEnv(config, options);
+  const transportType2 = resolveTransportType(options.transport);
+  process.env.MCP_TRANSPORT_TYPE = transportType2;
   if (!serverModule2.settingsManager) {
     throw new Error("ServerModule must have a settingsManager. Create it with createServerModule.");
   }
   const settings = serverModule2.settingsManager.createFromArgs(options);
+  serverModule2.settingsManager.setOperatorValues?.(operatorValues(config.options, options));
   if (typeof serverModule2.server.applyToolPolicy === "function") {
     console.error("[launchMCPServer] Applying tool policy before connecting");
     serverModule2.server.applyToolPolicy();
   }
-  const transportType2 = (options.transport || process.env.MCP_TRANSPORT_TYPE || "stdio").toLowerCase() === "http" ? "http" : "stdio";
   const transportPort = options.transportPort ? parseInt(options.transportPort, 10) : process.env.MCP_TRANSPORT_PORT ? parseInt(process.env.MCP_TRANSPORT_PORT, 10) : 3e3;
   if (transportType2 === "http") {
+    const refusal = serverModule2.httpStartupCheck?.();
+    if (refusal) {
+      throw new Error(refusal);
+    }
     setTransportType("http");
     await launchHTTPServer(config, serverModule2, transportPort);
   } else {
@@ -691,7 +914,7 @@ async function launchHTTPServer(config, serverModule2, port) {
           if (sessionId && transports[sessionId]) {
             const verbose = SettingsManager.globalDebugState;
             if (verbose) {
-              console.error("[launchHTTPServer] Verbose: Reusing existing transport for session:", sessionId);
+              console.error("[launchHTTPServer] Verbose: Reusing existing transport for session:", sessionLogLabel(sessionId));
             }
             transport = transports[sessionId];
             if (!serverModule2.settingsManager) {
@@ -711,7 +934,7 @@ async function launchHTTPServer(config, serverModule2, port) {
               onsessioninitialized: (sid) => {
                 const verbose = SettingsManager.globalDebugState;
                 if (verbose) {
-                  console.error("[launchHTTPServer] Verbose: New session initialized:", sid);
+                  console.error("[launchHTTPServer] Verbose: New session initialized:", sessionLogLabel(sid));
                 }
                 transports[sid] = transport;
                 if (verbose) {
@@ -914,7 +1137,6 @@ function headersToEnvVars(headers, config) {
   }
   if (verbose) {
     console.error("[headersToEnvVars] Verbose: Final result keys:", Object.keys(result));
-    console.error("[headersToEnvVars] Verbose: Final result (sanitized):", Object.fromEntries(Object.entries(result).map(([k, v]) => [k, k.toLowerCase().includes("key") || k.toLowerCase().includes("token") || k.toLowerCase().includes("password") ? "***" : v])));
   }
   return result;
 }
@@ -941,7 +1163,7 @@ var APIManagerFactory = class {
     const verbose = SettingsManager.globalDebugState;
     const sid = sessionId || this.defaultSessionId;
     if (verbose) {
-      console.error("[APIManagerFactory.getAPIManager] Verbose: Getting API manager for session:", sid);
+      console.error("[APIManagerFactory.getAPIManager] Verbose: Getting API manager for session:", sessionLogLabel(sid));
     }
     if (!this.apiManagerMap.has(sid)) {
       if (verbose) {
@@ -1039,16 +1261,15 @@ var SessionContext = class {
   /**
    * Get the current session ID from the MCP extra context
    * @param extra Extra context passed to MCP tool callbacks
-   * @returns The session ID or DEFAULT_SESSION_ID if not available
+   * @returns The session ID, or DEFAULT_SESSION_ID under stdio
+   * @throws Under HTTP transport when the context carries no session ID
    */
   static getSessionId(extra) {
-    if (!extra)
-      return this.DEFAULT_SESSION_ID;
-    if (extra.transport && extra.transport.sessionId) {
-      return extra.transport.sessionId;
-    }
-    if (extra.sessionId) {
-      return extra.sessionId;
+    const sessionId = extra?.transport?.sessionId || extra?.sessionId;
+    if (sessionId)
+      return sessionId;
+    if (process.env.MCP_TRANSPORT_TYPE === "http") {
+      throw new Error("No MCP session in this request context; HTTP transport requires one");
     }
     return this.DEFAULT_SESSION_ID;
   }
@@ -1165,10 +1386,10 @@ var SessionContext = class {
           }
         }
       }
-      console.error(`Using cached user data for session: ${sessionId}, key: ${options.cacheKey}`);
+      console.error(`Using cached user data for ${sessionLogLabel(sessionId)}, key: ${options.cacheKey}`);
       return { cancelled: false, data: dataToReturn2 };
     }
-    console.error(`Prompting user for data for session: ${sessionId}, key: ${options.cacheKey}`);
+    console.error(`Prompting user for data for ${sessionLogLabel(sessionId)}, key: ${options.cacheKey}`);
     let result;
     if (options.showLoginDialog) {
       const { showLoginDialog: showLoginDialog2 } = await Promise.resolve().then(() => (init_ui_dialog(), ui_dialog_exports));
@@ -1376,10 +1597,11 @@ function wrapServerWithTracking(server2, createServerFn) {
         newServer[reg.method](...reg.args);
       }
     }
-    if (typeof server2.setToolPolicy === "function" && typeof newServer.setToolPolicy === "function") {
-      const toolPolicy = server2._toolPolicyCallback;
-      if (toolPolicy) {
-        newServer.setToolPolicy(toolPolicy);
+    const toolPolicy = typeof server2.getToolPolicy === "function" ? server2.getToolPolicy() : void 0;
+    if (toolPolicy && typeof newServer.setToolPolicy === "function") {
+      newServer.setToolPolicy(toolPolicy);
+      if (typeof newServer.applyToolPolicy === "function") {
+        newServer.applyToolPolicy();
       }
     }
     return newServer;
@@ -1435,35 +1657,61 @@ var CPMcpServer = class extends McpServer {
     console.error("[CPMcpServer] Setting tool policy callback");
     this.toolPolicyCallback = callback;
   }
+  /**
+   * Get the tool policy callback, if one was set.
+   *
+   * Needed so the policy can be carried onto the per-session server instances
+   * created for HTTP transport. A typed accessor keeps that transfer honest:
+   * callers do not have to reach into the private field, where a misspelling
+   * would go unnoticed by the compiler.
+   */
+  getToolPolicy() {
+    return this.toolPolicyCallback;
+  }
   /**
    * Apply the tool policy by checking all registered tools
    * This should be called after all tools are registered but before connecting
+   *
+   * Per-tool tracing is behind the debug flag. This used to run once per process
+   * on the template server, where a line per tool was a cheap startup banner.
+   * It now also runs per session under HTTP transport, so unconditional tracing
+   * would scale stderr with sessions x tools and bury the summary. The summary
+   * line always prints — it is the fact worth having for every session.
    */
   applyToolPolicy() {
+    const verbose = SettingsManager.globalDebugState === true || SettingsManager.globalDebugState === "true";
     if (!this.toolPolicyCallback) {
-      console.error("[CPMcpServer] No tool policy callback set, allowing all tools");
+      if (verbose) {
+        console.error("[CPMcpServer] No tool policy callback set, allowing all tools");
+      }
       return;
     }
-    console.error("[CPMcpServer] Applying tool policy");
     const registeredTools = this._registeredTools;
     if (!registeredTools || typeof registeredTools !== "object") {
       console.error("[CPMcpServer] No tools registered yet");
       return;
     }
     const toolNames = Object.keys(registeredTools);
-    console.error(`[CPMcpServer] Found ${toolNames.length} registered tools:`, toolNames);
+    if (verbose) {
+      console.error(`[CPMcpServer] Applying tool policy`);
+      console.error(`[CPMcpServer] Found ${toolNames.length} registered tools:`, toolNames);
+    }
     let enabledCount = 0;
     let disabledCount = 0;
     for (const [toolName, tool] of Object.entries(registeredTools)) {
       const isAllowed = this.toolPolicyCallback(toolName);
       if (!isAllowed) {
-        console.error(`[CPMcpServer] Tool '${toolName}' is NOT allowed by policy - disabling`);
+        if (verbose) {
+          console.error(`[CPMcpServer] Tool '${toolName}' is NOT allowed by policy - disabling`);
+        }
         if (typeof tool.disable === "function") {
           tool.disable();
           disabledCount++;
         }
       } else {
-        console.error(`[CPMcpServer] Tool '${toolName}' is allowed by policy`);
+        if (verbose) {
+          console.error(`[CPMcpServer] Tool '${toolName}' is allowed by policy`);
+        }
         enabledCount++;
       }
     }
@@ -1526,6 +1774,23 @@ import axios3 from "axios";
 // ../infra/dist/api-client.js
 import axios from "axios";
 import https from "https";
+var DEBUG_LOGGABLE_REQUEST_KEYS = debugLoggableKeys([
+  "details-level",
+  "domain",
+  "filter",
+  "layer",
+  "limit",
+  "name",
+  "offset",
+  "order",
+  "package",
+  "show-membership",
+  "targets",
+  "task-id",
+  "type",
+  "uid",
+  "use-object-dictionary"
+]);
 var TokenType;
 (function(TokenType2) {
   TokenType2["API_KEY"] = "API_KEY";
@@ -1572,7 +1837,9 @@ var Settings = class _Settings {
       return "STG";
     return void 0;
   }
-  constructor({ apiKey = process.env.API_KEY, username = process.env.USERNAME, password = process.env.PASSWORD, s1cUrl = process.env.S1C_URL, managementHost = process.env.MANAGEMENT_HOST, managementPort = process.env.MANAGEMENT_PORT || "443", cloudInfraToken = process.env.CLOUD_INFRA_TOKEN, cloudConnected = process.env.CLOUD_CONNECTED === "true", sid, clientId = process.env.CLIENT_ID, secretKey = process.env.SECRET_KEY, region = process.env.REGION || "EU", devPort = process.env.DEV_PORT || "8006", gatewayUrl } = {}) {
+  // Takes only what it is given: the environment is read by fromArgs, so
+  // settings built from request headers never pick up the process's values.
+  constructor({ apiKey, username, password, s1cUrl, managementHost, managementPort = "443", cloudInfraToken, cloudConnected = false, sid, clientId, secretKey, region = "EU", devPort = "8006", gatewayUrl } = {}) {
     this.region = "EU";
     this.devPort = "8006";
     this.gatewayUrl = "";
@@ -1752,19 +2019,20 @@ var Settings = class _Settings {
         console.error("[Settings.fromArgs] Verbose: WARNING - Args object appears empty, no authentication values found");
       }
     }
+    const env = process.env;
     return new _Settings({
-      apiKey: args.apiKey,
-      username: args.username,
-      password: args.password,
-      s1cUrl: args.s1cUrl,
-      managementHost: args.managementHost,
-      managementPort: args.managementPort,
-      cloudInfraToken: args.cloudInfraToken,
-      cloudConnected: args.cloudConnected,
-      clientId: args.clientId,
-      secretKey: args.secretKey,
-      region: typeof args.region === "string" ? args.region.trim().toUpperCase() : void 0,
-      devPort: args.devPort,
+      apiKey: args.apiKey ?? env.API_KEY,
+      username: args.username ?? env.USERNAME,
+      password: args.password ?? env.PASSWORD,
+      s1cUrl: args.s1cUrl ?? env.S1C_URL,
+      managementHost: args.managementHost ?? env.MANAGEMENT_HOST,
+      managementPort: args.managementPort ?? (env.MANAGEMENT_PORT || void 0),
+      cloudInfraToken: args.cloudInfraToken ?? env.CLOUD_INFRA_TOKEN,
+      cloudConnected: args.cloudConnected ?? env.CLOUD_CONNECTED === "true",
+      clientId: args.clientId ?? env.CLIENT_ID,
+      secretKey: args.secretKey ?? env.SECRET_KEY,
+      region: typeof args.region === "string" ? args.region.trim().toUpperCase() : env.REGION || void 0,
+      devPort: args.devPort ?? (env.DEV_PORT || void 0),
       gatewayUrl: args.gatewayUrl
     });
   }
@@ -1809,7 +2077,6 @@ var Settings = class _Settings {
       const hasAnyValue = extractedValues.apiKey || extractedValues.username || extractedValues.password || extractedValues.s1cUrl || extractedValues.managementHost || extractedValues.cloudInfraToken;
       if (!hasAnyValue) {
         console.error("[Settings.fromHeaders] Verbose: WARNING - No authentication values found in headers");
-        console.error("[Settings.fromHeaders] Verbose: Full headers object (sanitized):", Object.fromEntries(Object.entries(headers).map(([k, v]) => [k, k.toLowerCase().includes("key") || k.toLowerCase().includes("token") || k.toLowerCase().includes("password") ? "***" : v])));
       }
     }
     return new _Settings({
@@ -1830,6 +2097,17 @@ var Settings = class _Settings {
     });
   }
 };
+Settings.debugLoggableKeys = [
+  "management-host",
+  "management-port",
+  "s1c-url",
+  "gateway-url",
+  "region",
+  "dev-port",
+  "cloud-connected",
+  "write-mode"
+];
+Settings.basicKeys = ["REGION"];
 
 // ../infra/dist/external-user-token-manager.js
 import axios2 from "axios";
@@ -1989,6 +2267,16 @@ var DocumentationToolAPIManager = class _DocumentationToolAPIManager {
 
 // src/settings.ts
 var DocumentationToolSettings = class _DocumentationToolSettings extends Settings {
+  static {
+    /**
+     * Keys whose values debug output may print (see debugView in mcp-utils).
+     * Anything not listed, including every credential, is shown hidden.
+     */
+    this.debugLoggableKeys = [
+      ...Settings.debugLoggableKeys,
+      "auth-url"
+    ];
+  }
   constructor(args = {}) {
     super({
       ...args,
@@ -2004,8 +2292,12 @@ var DocumentationToolSettings = class _DocumentationToolSettings extends Setting
         "Provide either --auth-url (Authentication URL from the API key creation dialog) or --region (EU, US, STG, or LOCAL)"
       );
     }
+    const env = process.env;
     return new _DocumentationToolSettings({
-      ...args
+      ...args,
+      clientId: args.clientId ?? env.CLIENT_ID,
+      secretKey: args.secretKey ?? env.SECRET_KEY,
+      region: args.region ?? (env.REGION || void 0)
     });
   }
   static fromHeaders(headers) {

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chkp/documentation-mcp",
-  "version": "1.4.10",
+  "version": "1.4.13",
   "description": "Check Point Documentation Tool Service - API integration with Check Point Documentation Tool",
   "type": "module",
   "main": "dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chkp/documentation-mcp",
-  "version": "1.4.10",
+  "version": "1.4.13",
   "description": "Check Point Documentation Tool Service - API integration with Check Point Documentation Tool",
   "type": "module",
   "main": "dist/index.js",

package/package.json.bak

@@ -1,6 +1,6 @@
 {
   "name": "@chkp/documentation-mcp",
-  "version": "1.4.10",
+  "version": "1.4.13",
   "description": "Check Point Documentation Tool Service - API integration with Check Point Documentation Tool",
   "type": "module",
   "main": "dist/index.js",