@chkp/policy-insights-mcp 0.1.0

package/dist/index.js

@@ -0,0 +1,3192 @@
+#!/usr/bin/env node
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// ../mcp-utils/dist/ui-dialog.js
+var ui_dialog_exports = {};
+__export(ui_dialog_exports, {
+  showDialog: () => showDialog,
+  showLoginDialog: () => showLoginDialog
+});
+import { createServer } from "http";
+import { URL as URL2 } from "url";
+import { exec } from "child_process";
+import { promisify } from "util";
+import * as fs2 from "fs";
+import * as path from "path";
+async function showDialog(config) {
+  const dialog = new UIDialog();
+  return dialog.showDialog(config);
+}
+async function showLoginDialog(title, message) {
+  return showDialog({
+    title: title || "Login Information",
+    message,
+    fields: [
+      {
+        name: "address",
+        label: "Address",
+        type: "text",
+        placeholder: "Enter server address...",
+        required: true
+      },
+      {
+        name: "user",
+        label: "Username",
+        type: "text",
+        placeholder: "Enter username...",
+        required: true
+      },
+      {
+        name: "password",
+        label: "Password",
+        type: "password",
+        placeholder: "Enter password...",
+        required: true
+      }
+    ]
+  });
+}
+var execAsync, UIDialog;
+var init_ui_dialog = __esm({
+  "../mcp-utils/dist/ui-dialog.js"() {
+    "use strict";
+    execAsync = promisify(exec);
+    UIDialog = class {
+      constructor() {
+        this.server = null;
+        this.port = 0;
+        this.resolve = null;
+      }
+      async showDialog(config) {
+        return new Promise((resolve, reject) => {
+          this.resolve = resolve;
+          this.server = createServer((req, res) => {
+            this.handleRequest(req, res, config);
+          });
+          this.server.listen(0, "localhost", () => {
+            const address = this.server.address();
+            if (address && typeof address === "object") {
+              this.port = address.port;
+              this.openBrowser(`http://localhost:${this.port}`);
+            } else {
+              reject(new Error("Failed to start server"));
+            }
+          });
+          setTimeout(() => {
+            this.cleanup();
+            resolve({ cancelled: true, data: {} });
+          }, 5 * 60 * 1e3);
+        });
+      }
+      handleRequest(req, res, config) {
+        const url = new URL2(req.url, `http://localhost:${this.port}`);
+        if (req.method === "GET" && url.pathname === "/") {
+          res.writeHead(200, { "Content-Type": "text/html" });
+          res.end(this.generateHTML(config));
+        } else if (req.method === "POST" && url.pathname === "/submit") {
+          let body = "";
+          req.on("data", (chunk) => {
+            body += chunk.toString();
+          });
+          req.on("end", () => {
+            const formData = new URLSearchParams(body);
+            const result = {};
+            for (const field of config.fields) {
+              result[field.name] = formData.get(field.name) || "";
+            }
+            res.writeHead(200, { "Content-Type": "text/html" });
+            res.end(`
+          <html>
+            <head><title>Success</title></head>
+            <body style="font-family: Arial, sans-serif; text-align: center; padding: 50px;">
+              <h2>Form submitted successfully!</h2>
+              <p>You can close this window now.</p>
+              <script>setTimeout(() => window.close(), 2000);</script>
+            </body>
+          </html>
+        `);
+            this.cleanup();
+            if (this.resolve) {
+              this.resolve({ cancelled: false, data: result });
+            }
+          });
+        } else if (req.method === "POST" && url.pathname === "/cancel") {
+          res.writeHead(200, { "Content-Type": "text/html" });
+          res.end(`
+        <html>
+          <head><title>Cancelled</title></head>
+          <body style="font-family: Arial, sans-serif; text-align: center; padding: 50px;">
+            <h2>Form cancelled</h2>
+            <p>You can close this window now.</p>
+            <script>setTimeout(() => window.close(), 2000);</script>
+          </body>
+        </html>
+      `);
+          this.cleanup();
+          if (this.resolve) {
+            this.resolve({ cancelled: true, data: {} });
+          }
+        } else {
+          res.writeHead(404);
+          res.end("Not found");
+        }
+      }
+      generateHTML(config) {
+        const fieldsHTML = config.fields.map((field) => {
+          let fieldHTML = "";
+          const fieldType = field.type || "text";
+          switch (fieldType) {
+            case "textarea":
+              fieldHTML = `
+            <textarea 
+              name="${field.name}" 
+              placeholder="${field.placeholder || ""}"
+              ${field.required ? "required" : ""}
+              style="width: 100%; box-sizing: border-box; min-height: 80px; padding: 8px; border: 1px solid #ddd; border-radius: 4px; font-family: Arial, sans-serif; font-size: 14px; resize: vertical;"
+            >${field.defaultValue || ""}</textarea>
+          `;
+              break;
+            case "select":
+              fieldHTML = `
+            <select 
+              name="${field.name}" 
+              ${field.required ? "required" : ""}
+              style="width: 100%; box-sizing: border-box; padding: 8px; border: 1px solid #ddd; border-radius: 4px; font-family: Arial, sans-serif; font-size: 14px;"
+            >
+              <option value="">Select an option...</option>
+              ${(field.options || []).map((option) => `<option value="${option}" ${option === field.defaultValue ? "selected" : ""}>${option}</option>`).join("")}
+            </select>
+          `;
+              break;
+            default:
+              fieldHTML = `
+            <input 
+              type="${fieldType}" 
+              name="${field.name}" 
+              placeholder="${field.placeholder || ""}"
+              value="${field.defaultValue || ""}"
+              ${field.required ? "required" : ""}
+              style="width: 100%; box-sizing: border-box; padding: 8px; border: 1px solid #ddd; border-radius: 4px; font-family: Arial, sans-serif; font-size: 14px;"
+            />
+          `;
+          }
+          return `
+        <div style="margin-bottom: 15px;">
+          <label style="display: block; margin-bottom: 5px; font-weight: bold; color: #333;">
+            ${field.label}${field.required ? " *" : ""}
+          </label>
+          ${fieldHTML}
+        </div>
+      `;
+        }).join("");
+        return `
+      <!DOCTYPE html>
+      <html>
+        <head>
+          <title>${config.title}</title>
+          <meta charset="UTF-8">
+          <meta name="viewport" content="width=device-width, initial-scale=1">
+          <style>
+            * {
+              box-sizing: border-box;
+            }
+            body {
+              font-family: Arial, sans-serif;
+              max-width: 500px;
+              margin: 50px auto;
+              padding: 20px;
+              background-color: #f5f5f5;
+              line-height: 1.4;
+            }
+            .dialog {
+              background: white;
+              padding: 30px;
+              border-radius: 8px;
+              box-shadow: 0 4px 6px rgba(0, 0, 0, 0.1);
+            }
+            .buttons {
+              margin-top: 20px;
+              text-align: right;
+            }
+            button {
+              padding: 10px 20px;
+              margin-left: 10px;
+              border: none;
+              border-radius: 4px;
+              cursor: pointer;
+              font-size: 14px;
+              font-family: Arial, sans-serif;
+            }
+            .submit-btn {
+              background-color: #007cba;
+              color: white;
+            }
+            .submit-btn:hover {
+              background-color: #005a87;
+            }
+            .cancel-btn {
+              background-color: #6c757d;
+              color: white;
+            }
+            .cancel-btn:hover {
+              background-color: #545b62;
+            }
+            input:focus, textarea:focus, select:focus {
+              outline: none;
+              border-color: #007cba;
+              box-shadow: 0 0 0 2px rgba(0, 124, 186, 0.2);
+            }
+          </style>
+        </head>
+        <body>
+          <div class="dialog">
+            <h2 style="margin-top: 0; color: #333;">${config.title}</h2>
+            ${config.message ? `<p style="color: #666; margin-bottom: 20px;">${config.message}</p>` : ""}
+            
+            <form id="dialogForm" method="POST" action="/submit">
+              ${fieldsHTML}
+              
+              <div class="buttons">
+                <button type="button" class="cancel-btn" onclick="cancel()">
+                  ${config.cancelButtonText || "Cancel"}
+                </button>
+                <button type="submit" class="submit-btn">
+                  ${config.submitButtonText || "Submit"}
+                </button>
+              </div>
+            </form>
+          </div>
+
+          <script>
+            function cancel() {
+              fetch('/cancel', { method: 'POST' })
+                .then(() => {
+                  document.body.innerHTML = '<div style="text-align: center; padding: 50px; font-family: Arial, sans-serif;"><h2>Cancelled</h2><p>You can close this window now.</p></div>';
+                  setTimeout(() => window.close(), 2000);
+                });
+            }
+
+            // Auto-focus first input
+            document.addEventListener('DOMContentLoaded', () => {
+              const firstInput = document.querySelector('input, textarea, select');
+              if (firstInput) {
+                firstInput.focus();
+                // If it's a text input, place cursor at end
+                if (firstInput.type === 'text' || firstInput.tagName === 'TEXTAREA') {
+                  const val = firstInput.value;
+                  firstInput.value = '';
+                  firstInput.value = val;
+                }
+              }
+            });
+
+            // Prevent form submission if required fields are empty
+            document.getElementById('dialogForm').addEventListener('submit', function(e) {
+              const requiredFields = document.querySelectorAll('[required]');
+              for (let field of requiredFields) {
+                if (!field.value.trim()) {
+                  e.preventDefault();
+                  field.focus();
+                  alert('Please fill in all required fields.');
+                  return false;
+                }
+              }
+            });
+          </script>
+        </body>
+      </html>
+    `;
+      }
+      async openBrowser(urlString) {
+        try {
+          let url;
+          try {
+            url = new URL2(urlString);
+            if (!["http:", "https:"].includes(url.protocol) || url.hostname !== "localhost" && url.hostname !== "127.0.0.1") {
+              throw new Error("Invalid URL protocol or non-localhost hostname");
+            }
+          } catch (e) {
+            console.error("Invalid URL:", e);
+            return;
+          }
+          switch (process.platform) {
+            case "darwin": {
+              const scriptPath = path.join(process.env.TMPDIR || "/tmp", `open-browser-${Date.now()}.applescript`);
+              const script = `open location "${urlString}"`;
+              fs2.writeFileSync(scriptPath, script);
+              await execAsync(`osascript "${scriptPath}"`);
+              try {
+                fs2.unlinkSync(scriptPath);
+              } catch (e) {
+              }
+              break;
+            }
+            case "win32": {
+              await execAsync(`rundll32 url.dll,FileProtocolHandler "${urlString}"`);
+              break;
+            }
+            default: {
+              const browsers = ["xdg-open", "google-chrome", "firefox", "chromium-browser"];
+              for (const browser of browsers) {
+                try {
+                  await execAsync(`which ${browser}`);
+                  await execAsync(`${browser} "${urlString}"`);
+                  break;
+                } catch {
+                  continue;
+                }
+              }
+            }
+          }
+        } catch (error) {
+          console.error("Failed to open browser:", error);
+        }
+      }
+      cleanup() {
+        if (this.server) {
+          this.server.close();
+          this.server = null;
+        }
+      }
+    };
+  }
+});
+
+// src/index.ts
+import { z as z2 } from "zod";
+
+// src/toolDefinitionMap.ts
+var toolDefinitionMap = [
+  {
+    "name": "ShowCardInfo",
+    "description": "Provide information for the Infinity Cloud Services display card",
+    "inputSchema": {
+      "type": "object",
+      "properties": {}
+    },
+    "method": "post",
+    "pathTemplate": "/insights/v3.0/show-card-info",
+    "parameters": [],
+    "executionParameters": [],
+    "securityRequirements": [],
+    "operationId": "ShowCardInfo",
+    "baseUrl": ""
+  },
+  {
+    "name": "ShowConfig",
+    "description": "Get user configuration and settings for Policy Insights product",
+    "inputSchema": {
+      "type": "object",
+      "properties": {}
+    },
+    "method": "post",
+    "pathTemplate": "/insights/v3.0/show-config",
+    "parameters": [],
+    "executionParameters": [],
+    "securityRequirements": [],
+    "operationId": "ShowConfig",
+    "baseUrl": ""
+  },
+  {
+    "name": "ShowRulesUidsWithSuggestions",
+    "description": "Retrieve rule UIDs that have suggestions for a specific suggestion type using the required layer UID\nEnhanced to show both direct suggestions and inline layer suggestions",
+    "inputSchema": {
+      "type": "object",
+      "properties": {
+        "requestBody": {
+          "properties": {
+            "layer": {
+              "type": "string",
+              "format": "uuid",
+              "description": "Access layer identifier in UUID format",
+              "pattern": "^[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$"
+            },
+            "filters": {
+              "properties": {
+                "states": {
+                  "items": {
+                    "description": "State of a suggestion - either ACCEPTED or REJECTED",
+                    "enum": [
+                      "ACCEPTED",
+                      "REJECTED"
+                    ],
+                    "type": "string",
+                    "x-enum-varnames": [
+                      "ACCEPTED",
+                      "REJECTED"
+                    ]
+                  },
+                  "type": "array",
+                  "description": "Array of insight state values"
+                },
+                "user-interaction": {
+                  "properties": {
+                    "operator": {
+                      "description": "Operator for filtering by user-interaction-types",
+                      "enum": [
+                        "NOT-IN",
+                        "IN"
+                      ],
+                      "type": "string",
+                      "x-enum-varnames": [
+                        "NOT_IN",
+                        "IN"
+                      ]
+                    },
+                    "types": {
+                      "items": {
+                        "description": "Type of user interaction with an insight",
+                        "enum": [
+                          "DECIDE_LATER"
+                        ],
+                        "type": "string",
+                        "x-enum-varnames": [
+                          "DECIDE_LATER"
+                        ]
+                      },
+                      "type": "array",
+                      "description": "Array of user interaction type values"
+                    }
+                  },
+                  "required": [
+                    "types"
+                  ],
+                  "type": "object"
+                },
+                "security-impact": {
+                  "enum": [
+                    "HIGH",
+                    "MEDIUM_AND_ABOVE",
+                    "LOW_AND_ABOVE"
+                  ],
+                  "type": "string",
+                  "x-enum-varnames": [
+                    "HIGH",
+                    "MEDIUM_AND_ABOVE",
+                    "LOW_AND_ABOVE"
+                  ],
+                  "description": "Minimum security impact threshold to include"
+                },
+                "confidence-level": {
+                  "enum": [
+                    "HIGH",
+                    "MEDIUM_AND_ABOVE",
+                    "LOW_AND_ABOVE"
+                  ],
+                  "type": "string",
+                  "x-enum-varnames": [
+                    "HIGH",
+                    "MEDIUM_AND_ABOVE",
+                    "LOW_AND_ABOVE"
+                  ],
+                  "description": "Minimum confidence threshold to include"
+                },
+                "default-filter": {
+                  "enum": [
+                    "NONE"
+                  ],
+                  "type": "string",
+                  "x-enum-varnames": [
+                    "NONE"
+                  ],
+                  "description": "Ignore default filtering of the system"
+                },
+                "suggestions-type": {
+                  "description": "Type of insight",
+                  "enum": [
+                    "unused-objects",
+                    "tighten-rule",
+                    "delete-disabled-rule",
+                    "zero-hits-rule"
+                  ],
+                  "type": "string",
+                  "x-enum-varnames": [
+                    "UnusedObjects",
+                    "TightenRule",
+                    "DeleteDisabledRule",
+                    "ZeroHitsRule"
+                  ]
+                }
+              },
+              "required": [
+                "suggestions-type"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "layer",
+            "filters"
+          ],
+          "type": "object",
+          "description": "Parameters for showing rules UIDs with their suggestions"
+        }
+      },
+      "required": [
+        "requestBody"
+      ]
+    },
+    "method": "post",
+    "pathTemplate": "/insights/v3.0/show-rules-uids-with-suggestions",
+    "parameters": [],
+    "executionParameters": [],
+    "requestBodyContentType": "application/json",
+    "securityRequirements": [],
+    "operationId": "ShowRulesUidsWithSuggestions",
+    "baseUrl": ""
+  },
+  {
+    "name": "ShowState",
+    "description": "Shows Policy Insights enabled/disabled status\nAllows the Infinity Cloud Services page to determine current state",
+    "inputSchema": {
+      "type": "object",
+      "properties": {}
+    },
+    "method": "post",
+    "pathTemplate": "/insights/v3.0/show-state",
+    "parameters": [],
+    "executionParameters": [],
+    "securityRequirements": [],
+    "operationId": "ShowState",
+    "baseUrl": ""
+  },
+  {
+    "name": "ShowSuggestionEngineMetadata",
+    "description": "Retrieve next suggestions engine run schedule for each suggestion type",
+    "inputSchema": {
+      "type": "object",
+      "properties": {
+        "requestBody": {
+          "properties": {
+            "filters": {
+              "properties": {
+                "suggestion-type": {
+                  "description": "Type of insight",
+                  "enum": [
+                    "unused-objects",
+                    "tighten-rule",
+                    "delete-disabled-rule",
+                    "zero-hits-rule"
+                  ],
+                  "type": "string",
+                  "x-enum-varnames": [
+                    "UnusedObjects",
+                    "TightenRule",
+                    "DeleteDisabledRule",
+                    "ZeroHitsRule"
+                  ]
+                }
+              },
+              "type": "object"
+            }
+          },
+          "type": "object",
+          "description": "The JSON request body."
+        }
+      },
+      "required": [
+        "requestBody"
+      ]
+    },
+    "method": "post",
+    "pathTemplate": "/insights/v3.0/show-suggestion-engine-metadata",
+    "parameters": [],
+    "executionParameters": [],
+    "requestBodyContentType": "application/json",
+    "securityRequirements": [],
+    "operationId": "ShowSuggestionEngineMetadata",
+    "baseUrl": ""
+  },
+  {
+    "name": "ShowSuggestions",
+    "description": 'Retrieve all suggestions with advanced filtering capabilities.\nIncludes suggestions from all inline layers.\nExcludes rejected/accepted suggestions by default.\n\nRequired Parameters:\n- Must provide either "layer" OR "filters.rules-uids" OR "filters.uids"\n- Cannot retrieve suggestions without specifying at least one of these targeting parameters',
+    "inputSchema": {
+      "type": "object",
+      "properties": {
+        "requestBody": {
+          "properties": {
+            "layer": {
+              "type": "string",
+              "format": "uuid",
+              "description": "Access layer identifier in UUID format",
+              "pattern": "^[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$"
+            },
+            "options": {
+              "properties": {
+                "include-inline-layers": {
+                  "type": "boolean",
+                  "description": "Whether to include insights on inline layers"
+                }
+              },
+              "type": "object"
+            },
+            "limit": {
+              "type": "number",
+              "format": "int32",
+              "description": "Maximum number of items to return"
+            },
+            "offset": {
+              "type": "number",
+              "format": "int32",
+              "description": "Number of items to skip for pagination"
+            },
+            "filters": {
+              "properties": {
+                "states": {
+                  "items": {
+                    "description": "State of a suggestion - either ACCEPTED or REJECTED",
+                    "enum": [
+                      "ACCEPTED",
+                      "REJECTED"
+                    ],
+                    "type": "string",
+                    "x-enum-varnames": [
+                      "ACCEPTED",
+                      "REJECTED"
+                    ]
+                  },
+                  "type": "array",
+                  "description": "Array of insight state values"
+                },
+                "user-interaction": {
+                  "properties": {
+                    "operator": {
+                      "description": "Operator for filtering by user-interaction-types",
+                      "enum": [
+                        "NOT-IN",
+                        "IN"
+                      ],
+                      "type": "string",
+                      "x-enum-varnames": [
+                        "NOT_IN",
+                        "IN"
+                      ]
+                    },
+                    "types": {
+                      "items": {
+                        "description": "Type of user interaction with an insight",
+                        "enum": [
+                          "DECIDE_LATER"
+                        ],
+                        "type": "string",
+                        "x-enum-varnames": [
+                          "DECIDE_LATER"
+                        ]
+                      },
+                      "type": "array",
+                      "description": "Array of user interaction type values"
+                    }
+                  },
+                  "required": [
+                    "types"
+                  ],
+                  "type": "object"
+                },
+                "security-impact": {
+                  "enum": [
+                    "HIGH",
+                    "MEDIUM_AND_ABOVE",
+                    "LOW_AND_ABOVE"
+                  ],
+                  "type": "string",
+                  "x-enum-varnames": [
+                    "HIGH",
+                    "MEDIUM_AND_ABOVE",
+                    "LOW_AND_ABOVE"
+                  ],
+                  "description": "Minimum security impact threshold to include"
+                },
+                "confidence-level": {
+                  "enum": [
+                    "HIGH",
+                    "MEDIUM_AND_ABOVE",
+                    "LOW_AND_ABOVE"
+                  ],
+                  "type": "string",
+                  "x-enum-varnames": [
+                    "HIGH",
+                    "MEDIUM_AND_ABOVE",
+                    "LOW_AND_ABOVE"
+                  ],
+                  "description": "Minimum confidence threshold to include"
+                },
+                "default-filter": {
+                  "enum": [
+                    "NONE"
+                  ],
+                  "type": "string",
+                  "x-enum-varnames": [
+                    "NONE"
+                  ],
+                  "description": "Ignore default filtering of the system"
+                },
+                "uids": {
+                  "items": {
+                    "type": "string",
+                    "format": "uuid",
+                    "description": "Stringified UUID.",
+                    "pattern": "^[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$"
+                  },
+                  "type": "array",
+                  "description": "Array of insight unique identifiers"
+                },
+                "rules-uids": {
+                  "items": {
+                    "type": "string",
+                    "format": "uuid",
+                    "description": "Stringified UUID.",
+                    "pattern": "^[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$"
+                  },
+                  "type": "array",
+                  "description": "Array of rule unique identifiers"
+                },
+                "types": {
+                  "items": {
+                    "description": "Type of insight",
+                    "enum": [
+                      "unused-objects",
+                      "tighten-rule",
+                      "delete-disabled-rule",
+                      "zero-hits-rule"
+                    ],
+                    "type": "string",
+                    "x-enum-varnames": [
+                      "UnusedObjects",
+                      "TightenRule",
+                      "DeleteDisabledRule",
+                      "ZeroHitsRule"
+                    ]
+                  },
+                  "type": "array",
+                  "description": "Type of insight"
+                }
+              },
+              "type": "object"
+            }
+          },
+          "type": "object",
+          "description": "Parameters for showing suggestions with enhanced v3.0 capabilities"
+        }
+      },
+      "required": [
+        "requestBody"
+      ]
+    },
+    "method": "post",
+    "pathTemplate": "/insights/v3.0/show-suggestions",
+    "parameters": [],
+    "executionParameters": [],
+    "requestBodyContentType": "application/json",
+    "securityRequirements": [],
+    "operationId": "ShowSuggestions",
+    "baseUrl": ""
+  },
+  {
+    "name": "ShowSuggestionsInfo",
+    "description": "Retrieve detailed information such as last engine run, next run schedule and suggestions status, can be specified by suggestion type.\nProvides onboarding guidance for cases where the system has not yet completed its first analysis and generated its first set of insights,\nor if insights were generated but can't see the suggestions.",
+    "inputSchema": {
+      "type": "object",
+      "properties": {
+        "requestBody": {
+          "properties": {
+            "layer": {
+              "type": "string",
+              "format": "uuid",
+              "description": "Access layer identifier in UUID format",
+              "pattern": "^[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$"
+            }
+          },
+          "required": [
+            "layer"
+          ],
+          "type": "object",
+          "description": "The JSON request body."
+        }
+      },
+      "required": [
+        "requestBody"
+      ]
+    },
+    "method": "post",
+    "pathTemplate": "/insights/v3.0/show-suggestions-info",
+    "parameters": [],
+    "executionParameters": [],
+    "requestBodyContentType": "application/json",
+    "securityRequirements": [],
+    "operationId": "ShowSuggestionsInfo",
+    "baseUrl": ""
+  },
+  {
+    "name": "ShowSuggestionsSummary",
+    "description": "Retrieve number of rule suggestions grouped by their type.\nProvides generation batch metadata about the current suggestions we see: how many days of traffic logs were analyzed, on which publish timestamp the suggestions are based on.",
+    "inputSchema": {
+      "type": "object",
+      "properties": {
+        "requestBody": {
+          "properties": {
+            "layer": {
+              "type": "string",
+              "format": "uuid",
+              "description": "Access layer identifier in UUID format",
+              "pattern": "^[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$"
+            },
+            "filters": {
+              "properties": {
+                "states": {
+                  "items": {
+                    "description": "State of a suggestion - either ACCEPTED or REJECTED",
+                    "enum": [
+                      "ACCEPTED",
+                      "REJECTED"
+                    ],
+                    "type": "string",
+                    "x-enum-varnames": [
+                      "ACCEPTED",
+                      "REJECTED"
+                    ]
+                  },
+                  "type": "array",
+                  "description": "Array of insight state values"
+                },
+                "user-interaction": {
+                  "properties": {
+                    "operator": {
+                      "description": "Operator for filtering by user-interaction-types",
+                      "enum": [
+                        "NOT-IN",
+                        "IN"
+                      ],
+                      "type": "string",
+                      "x-enum-varnames": [
+                        "NOT_IN",
+                        "IN"
+                      ]
+                    },
+                    "types": {
+                      "items": {
+                        "description": "Type of user interaction with an insight",
+                        "enum": [
+                          "DECIDE_LATER"
+                        ],
+                        "type": "string",
+                        "x-enum-varnames": [
+                          "DECIDE_LATER"
+                        ]
+                      },
+                      "type": "array",
+                      "description": "Array of user interaction type values"
+                    }
+                  },
+                  "required": [
+                    "types"
+                  ],
+                  "type": "object"
+                },
+                "security-impact": {
+                  "enum": [
+                    "HIGH",
+                    "MEDIUM_AND_ABOVE",
+                    "LOW_AND_ABOVE"
+                  ],
+                  "type": "string",
+                  "x-enum-varnames": [
+                    "HIGH",
+                    "MEDIUM_AND_ABOVE",
+                    "LOW_AND_ABOVE"
+                  ],
+                  "description": "Minimum security impact threshold to include"
+                },
+                "confidence-level": {
+                  "enum": [
+                    "HIGH",
+                    "MEDIUM_AND_ABOVE",
+                    "LOW_AND_ABOVE"
+                  ],
+                  "type": "string",
+                  "x-enum-varnames": [
+                    "HIGH",
+                    "MEDIUM_AND_ABOVE",
+                    "LOW_AND_ABOVE"
+                  ],
+                  "description": "Minimum confidence threshold to include"
+                },
+                "default-filter": {
+                  "enum": [
+                    "NONE"
+                  ],
+                  "type": "string",
+                  "x-enum-varnames": [
+                    "NONE"
+                  ],
+                  "description": "Ignore default filtering of the system"
+                }
+              },
+              "type": "object"
+            }
+          },
+          "type": "object",
+          "description": "Parameters for showing suggestions summary"
+        }
+      },
+      "required": [
+        "requestBody"
+      ]
+    },
+    "method": "post",
+    "pathTemplate": "/insights/v3.0/show-suggestions-summary",
+    "parameters": [],
+    "executionParameters": [],
+    "requestBodyContentType": "application/json",
+    "securityRequirements": [],
+    "operationId": "ShowSuggestionsSummary",
+    "baseUrl": ""
+  },
+  {
+    "name": "ShowPolicyInsightsStatus",
+    "description": "Shows Policy Insights status, reflecting the overall status of the product including supported API versions.\nReturns both Insights API versions and Threat Prevention Insights API versions when Threat Prevention is enabled.\nMay also include license status information if available.\nA license is required to activate the product, and the status provides details about the validity and expiration of the product license.",
+    "inputSchema": {
+      "type": "object",
+      "properties": {}
+    },
+    "method": "post",
+    "pathTemplate": "/show-policy-insights-status",
+    "parameters": [],
+    "executionParameters": [],
+    "securityRequirements": [],
+    "operationId": "ShowPolicyInsightsStatus",
+    "baseUrl": ""
+  }
+];
+
+// ../infra/dist/api-client.js
+import axios from "axios";
+import https from "https";
+var TokenType;
+(function(TokenType2) {
+  TokenType2["API_KEY"] = "API_KEY";
+  TokenType2["CI_TOKEN"] = "CI_TOKEN";
+})(TokenType || (TokenType = {}));
+function getMainPackageUserAgent() {
+  if (process.env.CP_MCP_MAIN_PKG) {
+    if (process.env.CP_MCP_MAIN_PKG.includes("quantum-management-mcp")) {
+      return "mgmt-mcp";
+    }
+  }
+  return "Check Point MCP API Client";
+}
+var ClientResponse = class {
+  constructor(status, response) {
+    this.status = status;
+    this.response = response;
+  }
+};
+var APIClientBase = class {
+  constructor(authToken = "", tokenType = TokenType.API_KEY) {
+    this.authToken = authToken;
+    this.tokenType = tokenType;
+    this.sid = null;
+    this.sessionTimeout = null;
+    this.sessionStart = null;
+    this.isMDS = false;
+  }
+  /**
+  * Create an API client instance - generic method for creating clients
+  */
+  static create(...args) {
+    return new this(...args);
+  }
+  /**
+   * Get headers for the API requests
+   */
+  getHeaders() {
+    const headers = {
+      "Content-Type": "application/json",
+      "User-Agent": getMainPackageUserAgent()
+    };
+    if (this.sid) {
+      headers["X-chkp-sid"] = this.sid;
+    }
+    return headers;
+  }
+  /**
+   * Get debug mode
+   */
+  get debug() {
+    return !!this._debug;
+  }
+  /**
+   * Set debug mode
+   */
+  set debug(value) {
+    this._debug = value;
+  }
+  /**
+    * Check if this client needs to perform login before making API calls
+    */
+  needsLogin() {
+    return true;
+  }
+  /**
+   * Check if this client is in an MDS environment
+   */
+  async isMDSEnvironment() {
+    if (!this.hasValidSession()) {
+      await this.login();
+    }
+    return this.isMDS;
+  }
+  /**
+   * Check if the client has a valid session
+   */
+  hasValidSession() {
+    return !!this.sid && !this.isSessionExpired();
+  }
+  /**
+   * Get the current session ID (for debugging/logging purposes)
+   */
+  getSessionId() {
+    return this.sid;
+  }
+  /**
+   * Create a new API client instance with a specific session ID
+   * Used for domain-specific clients in MDS environments
+   */
+  static createWithSid(originalClient, sid) {
+    const newClient = Object.create(Object.getPrototypeOf(originalClient));
+    Object.assign(newClient, originalClient);
+    newClient.sid = sid;
+    newClient.sessionStart = Date.now();
+    return newClient;
+  }
+  /**
+   * Call an API endpoint
+   */
+  async callApi(method, uri, data, params) {
+    if (this.needsLogin() && (!this.sid || this.isSessionExpired())) {
+      try {
+        await this.login();
+      } catch (error) {
+        if (error instanceof ClientResponse) {
+          console.error(`Login failed with status ${error.status}:`, error.response);
+          return error;
+        }
+        console.error("Login failed with unexpected error:", error);
+        return new ClientResponse(500, { error: "Authentication failed", message: error.message });
+      }
+    }
+    let httpsAgent;
+    if (this instanceof OnPremAPIClient) {
+      httpsAgent = new https.Agent({ rejectUnauthorized: false });
+    }
+    try {
+      return await this.makeRequest(this.getHost(), method, uri, data, this.getHeaders(), params, httpsAgent);
+    } catch (error) {
+      if ((error.message?.includes("401") || error.response?.status === 401) && error.message?.toLowerCase().includes("session")) {
+        console.error("Session expired (401), resetting session and retrying...");
+        this.sid = null;
+        this.sessionStart = null;
+        try {
+          await this.login();
+        } catch (loginError) {
+          if (loginError instanceof ClientResponse) {
+            console.error(`Login retry failed with status ${loginError.status}:`, loginError.response);
+            return loginError;
+          }
+          console.error("Login retry failed with unexpected error:", loginError);
+          throw loginError;
+        }
+        return await this.makeRequest(this.getHost(), method, uri, data, this.getHeaders(), params, httpsAgent);
+      }
+      throw error;
+    }
+  }
+  /**
+   * Check if the session is expired based on sessionTimeout and sessionStart
+   */
+  isSessionExpired() {
+    if (!this.sid || !this.sessionTimeout || !this.sessionStart)
+      return true;
+    const now = Date.now();
+    return now > this.sessionStart + (this.sessionTimeout - 5) * 1e3;
+  }
+  /**
+   * Login to the API using the API key
+   */
+  async login() {
+    const apiTokenHeader = this.tokenType === TokenType.API_KEY ? "api-key" : "ci-token";
+    const loginResp = await this.makeRequest(this.getHost(), "POST", "login", { [apiTokenHeader]: this.authToken }, { "Content-Type": "application/json" });
+    if (loginResp.status !== 200 || !loginResp.response || !loginResp.response.sid) {
+      throw loginResp;
+    }
+    this.sid = loginResp.response.sid;
+    this.sessionTimeout = loginResp.response["session-timeout"] || null;
+    this.sessionStart = Date.now();
+    if (loginResp.response.uid) {
+      await this.detectMDS(loginResp.response.uid);
+    }
+    return loginResp.response.sid;
+  }
+  /**
+   * Detect if this is an MDS environment by checking the session details
+   */
+  async detectMDS(sessionUid, handleSelfSigned = false) {
+    try {
+      let httpsAgent;
+      if (handleSelfSigned) {
+        httpsAgent = new https.Agent({ rejectUnauthorized: false });
+      }
+      const sessionResp = await this.makeRequest(this.getHost(), "POST", "show-session", { uid: sessionUid }, this.getHeaders(), null, httpsAgent);
+      if (sessionResp.status === 200 && sessionResp.response?.domain?.["domain-type"] === "mds") {
+        this.isMDS = true;
+      }
+    } catch (error) {
+      console.warn("Could not determine MDS status:", error);
+      this.isMDS = false;
+    }
+  }
+  /**
+   * Make a request to a Check Point API
+   */
+  async makeRequest(host, method, uri, data, headers = {}, params = null, httpsAgent) {
+    uri = uri.replace(/^\//, "");
+    const url = `${host}/${uri}`;
+    const config = {
+      method: method.toUpperCase(),
+      url,
+      headers,
+      params: params || void 0
+    };
+    if (httpsAgent) {
+      config.httpsAgent = httpsAgent;
+    }
+    if (method.toUpperCase() !== "GET" && data !== void 0) {
+      config.data = data;
+    }
+    console.error(`API Request: ${method} ${url}`);
+    try {
+      const response = await axios(config);
+      return new ClientResponse(response.status, response.data);
+    } catch (error) {
+      if (error.response) {
+        console.error(`\u274C API Error (${error.response.status}):`);
+        console.error("Headers:", error.response.headers);
+        console.error("Data:", error.response.data);
+        if (this.debug) {
+          console.error("Debug mode: Printing request details:");
+          console.error("Request Method:", method);
+          console.error("Request URL:", url);
+          console.error("Request Headers:", config.headers);
+          console.error("Request Data:", config.data);
+          console.error("Request Params:", config.params);
+        }
+      }
+      if (error.response) {
+        throw new Error(`API request failed: ${error.response.status} - ${JSON.stringify(error.response.data)}`);
+      }
+      throw error;
+    }
+  }
+};
+var SmartOneCloudAPIClient = class extends APIClientBase {
+  constructor(authToken, tokenType, s1cUrl) {
+    super(authToken, tokenType);
+    this.s1cUrl = s1cUrl;
+  }
+  getHost() {
+    return this.s1cUrl;
+  }
+};
+var OnPremAPIClient = class extends APIClientBase {
+  constructor(apiKey, managementHost, managementPort = "443", username, password) {
+    super(apiKey || "");
+    this.managementHost = managementHost;
+    this.managementPort = managementPort;
+    this.username = username;
+    this.password = password;
+  }
+  getHost() {
+    const managementHost = this.managementHost;
+    const port = this.managementPort;
+    return `https://${managementHost}:${port}/web_api`;
+  }
+  /**
+  * Override login() to support both api-key and username/password authentication
+  * and allow self-signed certificates
+  */
+  async login() {
+    const isUsingApiKey = !!this.authToken;
+    const isUsingCredentials = !!(this.username && this.password);
+    if (!isUsingApiKey && !isUsingCredentials) {
+      throw new ClientResponse(401, { message: "Authentication failed: No API key or username/password provided" });
+    }
+    const httpsAgent = new https.Agent({ rejectUnauthorized: false });
+    const loginPayload = isUsingApiKey ? { "api-key": this.authToken } : { "user": this.username, "password": this.password };
+    const loginResp = await this.makeRequest(this.getHost(), "POST", "login", loginPayload, { "Content-Type": "application/json" }, null, httpsAgent);
+    if (loginResp.status !== 200 || !loginResp.response || !loginResp.response.sid) {
+      throw loginResp;
+    }
+    this.sid = loginResp.response.sid;
+    this.sessionTimeout = loginResp.response["session-timeout"] || null;
+    this.sessionStart = Date.now();
+    if (loginResp.response.uid) {
+      await this.detectMDS(loginResp.response.uid, true);
+    }
+    return loginResp.response.sid;
+  }
+};
+
+// ../infra/dist/string-utils.js
+function nullOrEmpty(val) {
+  return val === void 0 || val === null || typeof val === "string" && (val.trim() === "" || val === "undefined" || val === "null");
+}
+function sanitizeData(kwargs) {
+  const data = {};
+  for (const [key, value] of Object.entries(kwargs)) {
+    if (value === null || value === void 0 || value === "" || Array.isArray(value) && value.length === 0) {
+      continue;
+    }
+    const safeKey = key.replace(/_/g, "-");
+    data[safeKey] = value;
+  }
+  return data;
+}
+
+// ../mcp-utils/dist/launcher.js
+import { Command } from "commander";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import fs from "fs";
+import http from "http";
+import { randomUUID } from "crypto";
+
+// ../mcp-utils/dist/settings-manager.js
+var SettingsManager = class _SettingsManager {
+  /**
+   * Creates a new SettingsManager
+   * @param settingsClass The Settings class to use for creating settings instances
+   */
+  constructor(settingsClass) {
+    this.settingsMap = /* @__PURE__ */ new Map();
+    this.defaultSessionId = "default";
+    this.settingsClass = settingsClass;
+  }
+  /**
+   * Get settings for a specific session
+   * @param sessionId The session ID (defaults to 'default' for stdio mode)
+   * @returns Settings instance for the session
+   */
+  getSettings(sessionId) {
+    const sid = sessionId || this.defaultSessionId;
+    if (!this.settingsMap.has(sid)) {
+      this.settingsMap.set(sid, new this.settingsClass());
+    }
+    return this.settingsMap.get(sid);
+  }
+  /**
+   * Set settings for a specific session
+   * @param settings The settings object to set
+   * @param sessionId The session ID (defaults to 'default' for stdio mode)
+   */
+  setSettings(settings, sessionId) {
+    const sid = sessionId || this.defaultSessionId;
+    this.settingsMap.set(sid, settings);
+  }
+  /**
+   * Injects debug settings from source into settings object
+   * @param settings The settings object to update
+   * @param source Source object containing debug information
+   * @private
+   */
+  injectDebug(settings, source) {
+    const debug = source?.debug ?? _SettingsManager.globalDebugState ?? process.env.DEBUG;
+    if (typeof debug !== "undefined") {
+      if (source?.debug !== void 0) {
+        _SettingsManager.globalDebugState = source.debug;
+      }
+      if (typeof settings.set === "function") {
+        settings.set("debug", debug);
+      } else {
+        settings.debug = debug;
+      }
+      if (debug) {
+        console.error("Debug enabled. Source object contents:");
+        console.error(JSON.stringify(source, null, 2));
+      }
+    }
+  }
+  /**
+   * Print settings object for debugging by dynamically discovering its properties
+   * @param settings The settings object to print
+   * @private
+   */
+  printSettingsDebug(settings) {
+    if (typeof settings.get === "function") {
+      console.error("Settings (using get method):");
+      if (settings.data && typeof settings.data === "object") {
+        Object.entries(settings.data).forEach(([key, value]) => {
+          console.error(`  ${key}: ${JSON.stringify(value)}`);
+        });
+      } else {
+        console.error("  Unable to enumerate settings properties - no accessible data structure");
+      }
+    } else {
+      console.error("Settings (plain object):");
+      Object.entries(settings).forEach(([key, value]) => {
+        console.error(`  ${key}: ${JSON.stringify(value)}`);
+      });
+    }
+  }
+  /**
+   * Create settings from command-line arguments
+   * @param args Command line arguments
+   * @param sessionId Optional session ID
+   * @returns Settings instance
+   */
+  createFromArgs(args, sessionId) {
+    const settings = this.settingsClass.fromArgs(args);
+    this.injectDebug(settings, args);
+    this.setSettings(settings, sessionId);
+    return settings;
+  }
+  /**
+   * Create settings from HTTP headers
+   * @param headers HTTP headers
+   * @param sessionId Optional session ID
+   * @returns Settings instance
+   */
+  createFromHeaders(headers, sessionId) {
+    const verbose = _SettingsManager.globalDebugState;
+    if (verbose) {
+      console.error("[SettingsManager.createFromHeaders] Verbose: Starting with sessionId:", sessionId || "(default)");
+      console.error("[SettingsManager.createFromHeaders] Verbose: Incoming headers count:", Object.keys(headers).length);
+    }
+    if (_SettingsManager.globalDebugState) {
+      console.error("=== createFromHeaders Debug Info ===");
+      console.error("Incoming headers:");
+      console.error(JSON.stringify(headers, null, 2));
+    }
+    if (verbose && (!headers || Object.keys(headers).length === 0)) {
+      console.error("[SettingsManager.createFromHeaders] Verbose: WARNING - Headers object is empty or undefined");
+    }
+    const normalizedHeaders = {};
+    for (const [key, value] of Object.entries(headers)) {
+      const normalizedKey = key.includes("_") ? key.replace(/_/g, "-") : key;
+      normalizedHeaders[normalizedKey] = value;
+      if (verbose) {
+        console.error(`[SettingsManager.createFromHeaders] Verbose: Header normalized: "${key}" -> "${normalizedKey}"`);
+      }
+    }
+    if (verbose) {
+      console.error("[SettingsManager.createFromHeaders] Verbose: Normalized headers count:", Object.keys(normalizedHeaders).length);
+    }
+    if (_SettingsManager.globalDebugState) {
+      console.error("Normalized headers:");
+      console.error(JSON.stringify(normalizedHeaders, null, 2));
+    }
+    const debugHeader = normalizedHeaders["debug"] || normalizedHeaders["Debug"] || normalizedHeaders["DEBUG"];
+    const debugSource = { debug: debugHeader !== void 0 ? debugHeader : _SettingsManager.globalDebugState };
+    if (verbose) {
+      console.error("[SettingsManager.createFromHeaders] Verbose: Calling settingsClass.fromHeaders");
+    }
+    const settings = this.settingsClass.fromHeaders(normalizedHeaders);
+    if (verbose) {
+      console.error("[SettingsManager.createFromHeaders] Verbose: Settings object created");
+    }
+    this.injectDebug(settings, debugSource);
+    if (_SettingsManager.globalDebugState) {
+      console.error("Final settings object for session:", sessionId || "(default)");
+      this.printSettingsDebug(settings);
+      console.error("=== End createFromHeaders Debug Info ===");
+    }
+    if (verbose) {
+      console.error("[SettingsManager.createFromHeaders] Verbose: Storing settings for session:", sessionId || "(default)");
+    }
+    this.setSettings(settings, sessionId);
+    return settings;
+  }
+  /**
+   * Clear settings for a session
+   * @param sessionId The session ID to clear
+   */
+  clearSession(sessionId) {
+    if (sessionId !== this.defaultSessionId) {
+      this.settingsMap.delete(sessionId);
+    }
+  }
+};
+SettingsManager.globalDebugState = void 0;
+
+// ../mcp-utils/dist/launcher.js
+async function launchMCPServer(configPath, serverModule2) {
+  const config = JSON.parse(fs.readFileSync(configPath, "utf8"));
+  const program = new Command();
+  if (config.description) {
+    program.description(config.description);
+  }
+  config.options.forEach((option) => {
+    const envValue = option.env ? process.env[option.env] : void 0;
+    const defaultValue = envValue || option.default;
+    if (option.type === "boolean") {
+      const boolDefault = envValue === "true" || option.default === "true";
+      program.option(option.flag, option.description, boolDefault);
+    } else {
+      program.option(option.flag, option.description, defaultValue);
+    }
+  });
+  const transportTypeDefault = process.env.MCP_TRANSPORT_TYPE || "stdio";
+  program.option("--transport <type>", "Transport type (stdio or http)", transportTypeDefault);
+  const transportPortDefault = process.env.MCP_TRANSPORT_PORT || "3000";
+  program.option("--transport-port <number>", "Port for network transports (e.g., HTTP)", transportPortDefault);
+  const debugDefault = process.env.DEBUG === "true" || false;
+  program.option("--debug", "Enable debug mode", debugDefault);
+  const telemetryEnabledDefault = process.env.TELEMETRY_DISABLED === "true" ? false : true;
+  program.option("--no-telemetry", "Disable anonymous usage telemetry", telemetryEnabledDefault);
+  const telemetryUrlDefault = process.env.TELEMETRY_URL || "https://metrics.security.ai.checkpoint.com/api/v1/metrics/collect";
+  program.option("--telemetry-url <url>", "URL for telemetry server", telemetryUrlDefault);
+  program.parse(process.argv);
+  const options = program.opts();
+  if (options.telemetry === false) {
+    process.env.TELEMETRY_DISABLED = "true";
+  }
+  if (options.telemetryUrl) {
+    process.env.TELEMETRY_URL = options.telemetryUrl;
+  }
+  if (!serverModule2.settingsManager) {
+    throw new Error("ServerModule must have a settingsManager. Create it with createServerModule.");
+  }
+  const settings = serverModule2.settingsManager.createFromArgs(options);
+  if (typeof serverModule2.server.applyToolPolicy === "function") {
+    console.error("[launchMCPServer] Applying tool policy before connecting");
+    serverModule2.server.applyToolPolicy();
+  }
+  const transportType = (options.transport || process.env.MCP_TRANSPORT_TYPE || "stdio").toLowerCase() === "http" ? "http" : "stdio";
+  const transportPort = options.transportPort ? parseInt(options.transportPort, 10) : process.env.MCP_TRANSPORT_PORT ? parseInt(process.env.MCP_TRANSPORT_PORT, 10) : 3e3;
+  if (transportType === "http") {
+    await launchHTTPServer(config, serverModule2, transportPort);
+  } else {
+    const transport = new StdioServerTransport();
+    const defaultSessionId = "default";
+    const sessionMetadata = {
+      type: "stdio",
+      startedAt: /* @__PURE__ */ new Date()
+    };
+    serverModule2.sessionManager.createSession(defaultSessionId, sessionMetadata);
+    transport.extraContext = () => {
+      return {
+        sessionId: defaultSessionId,
+        transport
+      };
+    };
+    await serverModule2.server.connect(transport);
+    console.error(`${config.name} running on stdio transport. Version: ${serverModule2.pkg.version}`);
+    console.error(`Transport type: stdio`);
+  }
+}
+async function launchHTTPServer(config, serverModule2, port) {
+  const transports = {};
+  const serverInstances = {};
+  const server2 = http.createServer(async (req, res) => {
+    if (req.url === "/" || req.url === "/mcp") {
+      const sessionId = req.headers["mcp-session-id"];
+      if (req.method === "POST") {
+        const chunks = [];
+        try {
+          for await (const chunk of req) {
+            chunks.push(Buffer.from(chunk));
+          }
+          const bodyBuffer = Buffer.concat(chunks);
+          let body;
+          try {
+            const bodyText = bodyBuffer.toString("utf8");
+            if (bodyText) {
+              body = JSON.parse(bodyText);
+            }
+          } catch (err) {
+            console.error("Error parsing request body:", err);
+          }
+          let transport;
+          if (sessionId && transports[sessionId]) {
+            const verbose = SettingsManager.globalDebugState;
+            if (verbose) {
+              console.error("[launchHTTPServer] Verbose: Reusing existing transport for session:", sessionId);
+            }
+            transport = transports[sessionId];
+            if (!serverModule2.settingsManager) {
+              throw new Error("ServerModule must have a settingsManager. Create it with createServerModule.");
+            }
+            if (verbose) {
+              console.error("[launchHTTPServer] Verbose: Converting headers for existing session");
+            }
+            const envHeaders = headersToEnvVars(req.headers, config);
+            if (verbose) {
+              console.error("[launchHTTPServer] Verbose: Creating settings from headers for existing session");
+            }
+            serverModule2.settingsManager.createFromHeaders(envHeaders, sessionId);
+          } else if (!sessionId && body && body.method === "initialize") {
+            transport = new StreamableHTTPServerTransport({
+              sessionIdGenerator: () => randomUUID(),
+              onsessioninitialized: (sid) => {
+                const verbose = SettingsManager.globalDebugState;
+                if (verbose) {
+                  console.error("[launchHTTPServer] Verbose: New session initialized:", sid);
+                }
+                transports[sid] = transport;
+                if (verbose) {
+                  console.error("[launchHTTPServer] Verbose: Converting headers for new session");
+                  console.error("[launchHTTPServer] Verbose: Raw request headers:", Object.keys(req.headers));
+                }
+                const headers = headersToEnvVars(req.headers, config);
+                if (verbose) {
+                  console.error("[launchHTTPServer] Verbose: Converted headers count:", Object.keys(headers).length);
+                }
+                const metadata = {
+                  userAgent: req.headers["user-agent"],
+                  origin: req.headers.origin || req.headers.referer,
+                  remoteAddress: req.socket.remoteAddress,
+                  initialPath: req.url
+                };
+                if (verbose) {
+                  console.error("[launchHTTPServer] Verbose: Creating session in session manager");
+                }
+                serverModule2.sessionManager.createSession(sid, metadata);
+                if (verbose) {
+                  console.error("[launchHTTPServer] Verbose: Creating settings from headers for new session");
+                }
+                serverModule2.settingsManager.createFromHeaders(headers, sid);
+                if (verbose) {
+                  console.error("[launchHTTPServer] Verbose: Session initialization complete");
+                }
+              }
+            });
+            transport.onclose = () => {
+              const sid = transport.sessionId;
+              if (sid) {
+                delete transports[sid];
+                if (serverInstances[sid]) {
+                  delete serverInstances[sid];
+                }
+                serverModule2.settingsManager.clearSession(sid);
+                serverModule2.apiManagerFactory.clearSession(sid);
+                serverModule2.sessionManager.removeSession(sid);
+              }
+            };
+            if (!serverModule2.settingsManager) {
+              throw new Error("ServerModule must have a settingsManager. Create it with createServerModule.");
+            }
+            transport.extraContext = (msg) => {
+              const sessionId2 = transport.sessionId;
+              return {
+                sessionId: sessionId2,
+                transport
+              };
+            };
+            let serverToConnect;
+            if (serverModule2.createServerInstance) {
+              const sessionServer = serverModule2.createServerInstance();
+              serverToConnect = sessionServer;
+              const originalOnSessionInit = transport.onsessioninitialized;
+              transport.onsessioninitialized = (sid) => {
+                serverInstances[sid] = sessionServer;
+                if (originalOnSessionInit) {
+                  originalOnSessionInit(sid);
+                }
+              };
+            } else {
+              serverToConnect = serverModule2.server;
+              console.error("Warning: Using shared server instance. Consider providing createServerInstance for better multi-user support.");
+            }
+            await serverToConnect.connect(transport).catch((error) => {
+              console.error("Error connecting to HTTP transport:", error);
+            });
+          } else {
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({
+              jsonrpc: "2.0",
+              error: {
+                code: -32e3,
+                message: "Bad Request: No valid session ID provided"
+              },
+              id: null
+            }));
+            return;
+          }
+          await transport.handleRequest(req, res, body);
+        } catch (error) {
+          console.error("Error handling POST request:", error);
+          res.writeHead(500, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({
+            jsonrpc: "2.0",
+            error: {
+              code: -32e3,
+              message: "Internal server error: " + error.message
+            },
+            id: null
+          }));
+        }
+      } else if (req.method === "GET") {
+        if (!sessionId || !transports[sessionId]) {
+          res.writeHead(400, { "Content-Type": "text/plain" });
+          res.end("Invalid or missing session ID");
+          return;
+        }
+        const transport = transports[sessionId];
+        await transport.handleRequest(req, res);
+      } else if (req.method === "DELETE") {
+        if (!sessionId || !transports[sessionId]) {
+          res.writeHead(400, { "Content-Type": "text/plain" });
+          res.end("Invalid or missing session ID");
+          return;
+        }
+        const transport = transports[sessionId];
+        await transport.handleRequest(req, res);
+      } else {
+        res.writeHead(405, { "Content-Type": "text/plain", "Allow": "GET, POST, DELETE" });
+        res.end("Method not allowed");
+      }
+    } else if (req.url === "/health" || req.url === "/status") {
+      res.writeHead(200, { "Content-Type": "application/json" });
+      const sessionCount = serverModule2.sessionManager.getSessionCount();
+      const sessions = serverModule2.sessionManager.getAllSessions().map((session) => ({
+        id: session.sessionId,
+        createdAt: session.createdAt,
+        lastActive: session.lastActive
+        // Don't include potentially sensitive metadata
+      }));
+      res.end(JSON.stringify({
+        status: "ok",
+        server: config.name,
+        version: serverModule2.pkg.version,
+        activeSessions: sessionCount,
+        sessions
+      }));
+    } else {
+      res.writeHead(404, { "Content-Type": "text/plain" });
+      res.end("Not found");
+    }
+  });
+  server2.listen(port, () => {
+    console.error(`${config.name} running on HTTP transport at http://localhost:${port}. Version: ${serverModule2.pkg.version}`);
+    console.error(`Transport type: HTTP, Transport-port: ${port}`);
+  });
+  server2.on("error", (err) => {
+    console.error(`Server error: ${err.message}`);
+  });
+}
+function headersToEnvVars(headers, config) {
+  const verbose = SettingsManager.globalDebugState;
+  if (verbose) {
+    console.error("[headersToEnvVars] Verbose: Converting headers to env vars");
+    console.error("[headersToEnvVars] Verbose: Input headers count:", Object.keys(headers).length);
+    console.error("[headersToEnvVars] Verbose: Input header keys:", Object.keys(headers));
+    if (!headers || Object.keys(headers).length === 0) {
+      console.error("[headersToEnvVars] Verbose: WARNING - Headers object is empty");
+    }
+  }
+  if (!headers || Object.keys(headers).length === 0) {
+    return {};
+  }
+  const result = {};
+  for (const [name, value] of Object.entries(headers)) {
+    if (value !== void 0) {
+      const envName = name.toUpperCase().replace(/-/g, "_");
+      result[envName] = value;
+      if (verbose) {
+        console.error(`[headersToEnvVars] Verbose: Basic mapping: "${name}" -> "${envName}"`);
+      }
+    }
+  }
+  if (verbose) {
+    console.error("[headersToEnvVars] Verbose: After basic mapping, result keys:", Object.keys(result));
+  }
+  if (config && config.options) {
+    if (verbose) {
+      console.error("[headersToEnvVars] Verbose: Config provided, building header-to-env mapping");
+    }
+    const headerToEnvMap = {};
+    for (const option of config.options) {
+      if (option.env) {
+        const flagName = option.flag.split(" ")[0].replace(/^--?/, "").replace(/-/g, "_");
+        headerToEnvMap[flagName.toLowerCase()] = option.env;
+        if (verbose) {
+          console.error(`[headersToEnvVars] Verbose: Mapping: "${flagName.toLowerCase()}" -> "${option.env}"`);
+        }
+        headerToEnvMap[option.env.toLowerCase()] = option.env;
+      }
+    }
+    if (verbose) {
+      console.error("[headersToEnvVars] Verbose: headerToEnvMap:", headerToEnvMap);
+    }
+    let mappedCount = 0;
+    for (const [headerName, headerValue] of Object.entries(headers)) {
+      if (headerValue !== void 0) {
+        const normalizedHeaderName = headerName.toLowerCase().replace(/-/g, "_");
+        const envVarName = headerToEnvMap[normalizedHeaderName];
+        if (envVarName) {
+          result[envVarName] = headerValue;
+          mappedCount++;
+          if (verbose) {
+            console.error(`[headersToEnvVars] Verbose: Config mapping: "${headerName}" -> "${envVarName}"`);
+          }
+        }
+      }
+    }
+    if (verbose) {
+      console.error(`[headersToEnvVars] Verbose: Mapped ${mappedCount} headers using config`);
+    }
+  } else if (verbose) {
+    console.error("[headersToEnvVars] Verbose: No config provided, skipping config-based mapping");
+  }
+  if (verbose) {
+    console.error("[headersToEnvVars] Verbose: Final result keys:", Object.keys(result));
+    console.error("[headersToEnvVars] Verbose: Final result (sanitized):", Object.fromEntries(Object.entries(result).map(([k, v]) => [k, k.toLowerCase().includes("key") || k.toLowerCase().includes("token") || k.toLowerCase().includes("password") ? "***" : v])));
+  }
+  return result;
+}
+
+// ../mcp-utils/dist/api-manager-factory.js
+var APIManagerFactory = class {
+  /**
+   * Creates a new APIManagerFactory
+   * @param apiManagerClass The API Manager class to use for creating instances
+   * @param settingsManager The settings manager to get settings from
+   */
+  constructor(apiManagerClass, settingsManager) {
+    this.apiManagerMap = /* @__PURE__ */ new Map();
+    this.defaultSessionId = "default";
+    this.apiManagerClass = apiManagerClass;
+    this.settingsManager = settingsManager;
+  }
+  /**
+   * Get or create an API manager for a specific session
+   * @param sessionId The session ID (defaults to 'default' for stdio mode)
+   * @returns API Manager instance for the session
+   */
+  getAPIManager(sessionId) {
+    const verbose = SettingsManager.globalDebugState;
+    const sid = sessionId || this.defaultSessionId;
+    if (verbose) {
+      console.error("[APIManagerFactory.getAPIManager] Verbose: Getting API manager for session:", sid);
+    }
+    if (!this.apiManagerMap.has(sid)) {
+      if (verbose) {
+        console.error("[APIManagerFactory.getAPIManager] Verbose: API manager not in cache, creating new one");
+      }
+      const settings2 = this.settingsManager.getSettings(sid);
+      if (verbose) {
+        console.error("[APIManagerFactory.getAPIManager] Verbose: Retrieved settings from settings manager");
+        console.error("[APIManagerFactory.getAPIManager] Verbose: Creating API manager from settings");
+      }
+      const apiManager2 = this.createAPIManagerFromSettings(settings2);
+      if (verbose) {
+        console.error("[APIManagerFactory.getAPIManager] Verbose: API manager created successfully");
+      }
+      this.apiManagerMap.set(sid, apiManager2);
+    } else if (verbose) {
+      console.error("[APIManagerFactory.getAPIManager] Verbose: Using cached API manager");
+    }
+    const apiManager = this.apiManagerMap.get(sid);
+    const settings = this.settingsManager.getSettings(sid);
+    if (settings && typeof settings.debug !== "undefined") {
+      apiManager.debug = !!settings.debug;
+    }
+    return apiManager;
+  }
+  /**
+   * Create an API manager from settings
+   * @param settings Settings instance
+   * @returns API Manager instance
+   */
+  createAPIManagerFromSettings(settings) {
+    const verbose = SettingsManager.globalDebugState;
+    if (verbose) {
+      console.error("[APIManagerFactory.createAPIManagerFromSettings] Verbose: Creating API manager from settings");
+      console.error("[APIManagerFactory.createAPIManagerFromSettings] Verbose: Settings type:", typeof settings);
+      console.error("[APIManagerFactory.createAPIManagerFromSettings] Verbose: Settings keys:", settings ? Object.keys(settings) : "null");
+    }
+    const apiManager = this.apiManagerClass.create(settings);
+    if (verbose) {
+      console.error("[APIManagerFactory.createAPIManagerFromSettings] Verbose: API manager created");
+    }
+    return apiManager;
+  }
+  /**
+   * Clear API manager for a session
+   * @param sessionId The session ID to clear
+   */
+  clearSession(sessionId) {
+    if (sessionId !== this.defaultSessionId) {
+      this.apiManagerMap.delete(sessionId);
+    }
+  }
+};
+
+// ../mcp-utils/dist/session-context.js
+var _a;
+var SessionContext = class {
+  /**
+   * Start automatic cleanup timer
+   */
+  static startCleanupTimer() {
+    if (this.cleanupTimer)
+      return;
+    this.cleanupTimer = setInterval(() => {
+      this.cleanupExpiredSessions();
+    }, this.CLEANUP_INTERVAL_MS);
+    if (this.cleanupTimer.unref) {
+      this.cleanupTimer.unref();
+    }
+  }
+  /**
+   * Clean up expired sessions
+   */
+  static cleanupExpiredSessions() {
+    const now = Date.now();
+    const expiredSessions = [];
+    for (const [sessionId, sessionInfo] of this.sessionData.entries()) {
+      if (sessionId === this.DEFAULT_SESSION_ID)
+        continue;
+      if (now - sessionInfo.lastAccessed > this.SESSION_TIMEOUT_MS) {
+        expiredSessions.push(sessionId);
+      }
+    }
+    expiredSessions.forEach((sessionId) => {
+      this.sessionData.delete(sessionId);
+    });
+    if (this.sessionData.size > this.MAX_SESSIONS) {
+      const sessions = Array.from(this.sessionData.entries()).filter(([sessionId]) => sessionId !== this.DEFAULT_SESSION_ID).sort(([, a], [, b]) => a.lastAccessed - b.lastAccessed);
+      const toRemove = sessions.slice(0, sessions.length - this.MAX_SESSIONS + 1);
+      toRemove.forEach(([sessionId]) => {
+        this.sessionData.delete(sessionId);
+      });
+    }
+  }
+  /**
+   * Get the current session ID from the MCP extra context
+   * @param extra Extra context passed to MCP tool callbacks
+   * @returns The session ID or DEFAULT_SESSION_ID if not available
+   */
+  static getSessionId(extra) {
+    if (!extra)
+      return this.DEFAULT_SESSION_ID;
+    if (extra.transport && extra.transport.sessionId) {
+      return extra.transport.sessionId;
+    }
+    if (extra.sessionId) {
+      return extra.sessionId;
+    }
+    return this.DEFAULT_SESSION_ID;
+  }
+  /**
+   * Get settings for the current session
+   * @param serverModule ServerModule with settingsManager
+   * @param extra Extra context passed to MCP tool callbacks
+   * @returns Settings for the current session
+   */
+  static getSettings(serverModule2, extra) {
+    const sessionId = this.getSessionId(extra);
+    if (!serverModule2.settingsManager) {
+      throw new Error("ServerModule does not have a settingsManager. Create it with createServerModule.");
+    }
+    return serverModule2.settingsManager.getSettings(sessionId);
+  }
+  /**
+   * Get API manager for the current session
+   * @param serverModule ServerModule with apiManagerFactory
+   * @param extra Extra context passed to MCP tool callbacks
+   * @returns API manager for the current session
+   */
+  static getAPIManager(serverModule2, extra) {
+    const sessionId = this.getSessionId(extra);
+    if (!serverModule2.apiManagerFactory) {
+      throw new Error("ServerModule does not have an apiManagerFactory. Create it with createServerModule.");
+    }
+    return serverModule2.apiManagerFactory.getAPIManager(sessionId);
+  }
+  /**
+   * Set session data for the current session
+   * @param key The key to store the data under
+   * @param value The value to store
+   * @param extra Extra context with session information
+   */
+  static setData(key, value, extra) {
+    const sessionId = this.getSessionId(extra);
+    const now = Date.now();
+    if (!this.sessionData.has(sessionId)) {
+      this.sessionData.set(sessionId, {
+        data: /* @__PURE__ */ new Map(),
+        lastAccessed: now,
+        createdAt: now
+      });
+    }
+    const sessionInfo = this.sessionData.get(sessionId);
+    sessionInfo.lastAccessed = now;
+    sessionInfo.data.set(key, value);
+  }
+  /**
+   * Get session data for the current session
+   * @param key The key to retrieve data for
+   * @param extra Extra context with session information
+   * @returns The stored data or undefined if not found
+   */
+  static getData(key, extra) {
+    const sessionId = this.getSessionId(extra);
+    if (!this.sessionData.has(sessionId)) {
+      return void 0;
+    }
+    const sessionInfo = this.sessionData.get(sessionId);
+    sessionInfo.lastAccessed = Date.now();
+    return sessionInfo.data.get(key);
+  }
+  /**
+   * Clear session data for a specific session
+   * @param sessionId The session ID to clear
+   */
+  static clearSessionData(sessionId) {
+    this.sessionData.delete(sessionId);
+  }
+  /**
+   * Get session statistics (for monitoring)
+   */
+  static getSessionStats() {
+    const now = Date.now();
+    let oldestAccess = null;
+    for (const [, sessionInfo] of this.sessionData.entries()) {
+      if (oldestAccess === null || sessionInfo.lastAccessed < oldestAccess) {
+        oldestAccess = sessionInfo.lastAccessed;
+      }
+    }
+    return {
+      totalSessions: this.sessionData.size,
+      memoryUsage: this.sessionData.size * 1e3,
+      // Rough estimate
+      oldestSession: oldestAccess ? now - oldestAccess : null
+    };
+  }
+  /**
+   * Get or prompt for user interactive data with automatic caching and expiration
+   * @param options Configuration for the interactive data request
+   * @param extra Extra context with session information
+   * @returns Promise that resolves to the user data (either from cache or fresh prompt)
+   */
+  static async getOrPromptUserData(options, extra) {
+    const sessionId = this.getSessionId(extra);
+    const now = Date.now();
+    const expirationMs = (options.expirationMinutes || 30) * 60 * 1e3;
+    const cachedData = this.getData(options.cacheKey, extra);
+    if (cachedData && cachedData.expiresAt && now < cachedData.expiresAt) {
+      const refreshedData = {
+        ...cachedData,
+        expiresAt: now + expirationMs,
+        lastUsed: now
+      };
+      this.setData(options.cacheKey, refreshedData, extra);
+      let dataToReturn2 = cachedData.data;
+      if (options.fieldsToShow) {
+        dataToReturn2 = {};
+        for (const field of options.fieldsToShow) {
+          if (cachedData.data[field] !== void 0) {
+            dataToReturn2[field] = cachedData.data[field];
+          }
+        }
+      }
+      console.error(`Using cached user data for session: ${sessionId}, key: ${options.cacheKey}`);
+      return { cancelled: false, data: dataToReturn2 };
+    }
+    console.error(`Prompting user for data for session: ${sessionId}, key: ${options.cacheKey}`);
+    let result;
+    if (options.showLoginDialog) {
+      const { showLoginDialog: showLoginDialog2 } = await Promise.resolve().then(() => (init_ui_dialog(), ui_dialog_exports));
+      result = await showLoginDialog2(options.dialogTitle, options.dialogMessage);
+    } else {
+      const { showDialog: showDialog2 } = await Promise.resolve().then(() => (init_ui_dialog(), ui_dialog_exports));
+      const defaultFields = [
+        {
+          name: "message",
+          label: "Message",
+          type: "text",
+          placeholder: "Enter your message here...",
+          required: true
+        }
+      ];
+      result = await showDialog2({
+        title: options.dialogTitle || "Input Required",
+        message: options.dialogMessage,
+        fields: options.customFields || defaultFields
+      });
+    }
+    if (result.cancelled) {
+      return result;
+    }
+    const cachedEntry = {
+      data: result.data,
+      expiresAt: now + expirationMs,
+      createdAt: now,
+      lastUsed: now
+    };
+    this.setData(options.cacheKey, cachedEntry, extra);
+    let dataToReturn = result.data;
+    if (options.fieldsToShow) {
+      dataToReturn = {};
+      for (const field of options.fieldsToShow) {
+        if (result.data[field] !== void 0) {
+          dataToReturn[field] = result.data[field];
+        }
+      }
+    }
+    return { cancelled: false, data: dataToReturn };
+  }
+  /**
+   * Clear cached user data for a specific key
+   * @param cacheKey The cache key to clear
+   * @param extra Extra context with session information
+   */
+  static clearUserData(cacheKey, extra) {
+    const sessionId = this.getSessionId(extra);
+    if (this.sessionData.has(sessionId)) {
+      const sessionInfo = this.sessionData.get(sessionId);
+      sessionInfo.data.delete(cacheKey);
+      sessionInfo.lastAccessed = Date.now();
+    }
+  }
+  /**
+   * Check if user data exists and is not expired
+   * @param cacheKey The cache key to check
+   * @param extra Extra context with session information
+   * @returns true if valid cached data exists, false otherwise
+   */
+  static hasValidUserData(cacheKey, extra) {
+    const cachedData = this.getData(cacheKey, extra);
+    if (!cachedData || !cachedData.expiresAt) {
+      return false;
+    }
+    return Date.now() < cachedData.expiresAt;
+  }
+};
+_a = SessionContext;
+SessionContext.DEFAULT_SESSION_ID = "default";
+SessionContext.sessionData = /* @__PURE__ */ new Map();
+SessionContext.SESSION_TIMEOUT_MS = 24 * 60 * 60 * 1e3;
+SessionContext.CLEANUP_INTERVAL_MS = 60 * 60 * 1e3;
+SessionContext.MAX_SESSIONS = 1e3;
+SessionContext.cleanupTimer = null;
+(() => {
+  _a.startCleanupTimer();
+})();
+
+// ../mcp-utils/dist/session-manager.js
+var DEFAULT_SESSION_TIMEOUT_MS = 15 * 60 * 1e3;
+var SessionManager = class {
+  constructor() {
+    this.sessions = /* @__PURE__ */ new Map();
+  }
+  /**
+   * Create a new session
+   * @param sessionId The session ID
+   * @param metadata Optional metadata to store with the session
+   * @returns Session info
+   */
+  createSession(sessionId, metadata = {}) {
+    const now = /* @__PURE__ */ new Date();
+    const sessionInfo = {
+      sessionId,
+      createdAt: now,
+      lastActive: now,
+      ...metadata
+    };
+    this.sessions.set(sessionId, sessionInfo);
+    return sessionInfo;
+  }
+  /**
+   * Get info for a session
+   * @param sessionId The session ID
+   * @returns Session info or undefined if not found
+   */
+  getSession(sessionId) {
+    if (this.sessions.has(sessionId)) {
+      this.touchSession(sessionId);
+    }
+    return this.sessions.get(sessionId);
+  }
+  /**
+   * Update session activity timestamp
+   * @param sessionId The session ID
+   */
+  touchSession(sessionId) {
+    const session = this.sessions.get(sessionId);
+    if (session) {
+      session.lastActive = /* @__PURE__ */ new Date();
+    }
+  }
+  /**
+   * Remove a session
+   * @param sessionId The session ID
+   */
+  removeSession(sessionId) {
+    this.sessions.delete(sessionId);
+    SessionContext.clearSessionData(sessionId);
+  }
+  /**
+   * Get all active sessions
+   * @returns Array of session info objects
+   */
+  getAllSessions() {
+    return Array.from(this.sessions.values());
+  }
+  /**
+   * Get count of active sessions
+   * @returns Number of active sessions
+   */
+  getSessionCount() {
+    return this.sessions.size;
+  }
+  /**
+   * Clean up inactive sessions older than the specified timeout
+   * @param timeoutMs Timeout in milliseconds (default: 30 minutes)
+   * @returns Number of sessions removed
+   */
+  cleanupInactiveSessions(timeoutMs = DEFAULT_SESSION_TIMEOUT_MS) {
+    const now = /* @__PURE__ */ new Date();
+    let removedCount = 0;
+    for (const [sessionId, session] of this.sessions.entries()) {
+      const inactiveTime = now.getTime() - session.lastActive.getTime();
+      if (inactiveTime > timeoutMs) {
+        this.removeSession(sessionId);
+        removedCount++;
+      }
+    }
+    return removedCount;
+  }
+};
+
+// ../mcp-utils/dist/server-utils.js
+function getHeaderValue(headers, key) {
+  const normalizedKey = key.replace(/_/g, "-");
+  const value = headers[normalizedKey] || headers[normalizedKey.toUpperCase()] || headers[normalizedKey.toLowerCase()];
+  return typeof value === "string" ? value : Array.isArray(value) ? value[0] : void 0;
+}
+function createApiRunner(serverModule2) {
+  return async (method, uri, data, extra, domain) => {
+    const apiManager = SessionContext.getAPIManager(serverModule2, extra);
+    return await apiManager.callApi(method, uri, data, domain);
+  };
+}
+function wrapServerWithTracking(server2, createServerFn) {
+  const registrations = [];
+  const originalTool = server2.tool?.bind(server2);
+  const originalPrompt = server2.prompt?.bind(server2);
+  const originalResource = server2.resource?.bind(server2);
+  if (originalTool) {
+    server2.tool = function(...args) {
+      registrations.push({ type: "tool", method: "tool", args: [...args] });
+      return originalTool(...args);
+    };
+  }
+  if (originalPrompt) {
+    server2.prompt = function(...args) {
+      registrations.push({ type: "prompt", method: "prompt", args: [...args] });
+      return originalPrompt(...args);
+    };
+  }
+  if (originalResource) {
+    server2.resource = function(...args) {
+      registrations.push({ type: "resource", method: "resource", args: [...args] });
+      return originalResource(...args);
+    };
+  }
+  const createInstance = () => {
+    const newServer = createServerFn();
+    for (const reg of registrations) {
+      if (newServer[reg.method]) {
+        newServer[reg.method](...reg.args);
+      }
+    }
+    if (typeof server2.setToolPolicy === "function" && typeof newServer.setToolPolicy === "function") {
+      const toolPolicy = server2._toolPolicyCallback;
+      if (toolPolicy) {
+        newServer.setToolPolicy(toolPolicy);
+      }
+    }
+    return newServer;
+  };
+  return { wrappedServer: server2, createInstance };
+}
+function createServerModule(server2, Settings2, pkg2, apiManagerClass, toolPolicyCallback, createServerFn) {
+  const settingsManager = new SettingsManager(Settings2);
+  const apiManagerFactory = new APIManagerFactory(apiManagerClass, settingsManager);
+  const sessionManager = new SessionManager();
+  if (toolPolicyCallback && typeof server2.setToolPolicy === "function") {
+    console.error("[createServerModule] Setting tool policy callback on server");
+    server2.setToolPolicy(toolPolicyCallback);
+  }
+  const serverFactory = createServerFn || server2._createServerFn;
+  let createServerInstance;
+  if (serverFactory) {
+    const { wrappedServer, createInstance } = wrapServerWithTracking(server2, serverFactory);
+    createServerInstance = createInstance;
+    console.error("[createServerModule] Server factory enabled - HTTP multi-user support active");
+  } else {
+    console.error("[createServerModule] Warning: No server factory provided - HTTP multi-user may have issues");
+  }
+  return {
+    server: server2,
+    Settings: Settings2,
+    settingsManager,
+    apiManagerFactory,
+    sessionManager,
+    pkg: pkg2,
+    toolPolicyCallback,
+    createServerInstance
+  };
+}
+
+// ../mcp-utils/dist/index.js
+init_ui_dialog();
+
+// ../mcp-utils/dist/telemetry.js
+import machineIdPkg from "node-machine-id";
+import { createHash } from "crypto";
+var { machineIdSync } = machineIdPkg;
+var machineId = null;
+var hashedMachineId = null;
+function isTelemetryDisabled() {
+  return process.env.TELEMETRY_DISABLED === "true" || process.env.TELEMETRY_DISABLED === "1";
+}
+function getTelemetryUrl() {
+  return process.env.TELEMETRY_URL || "https://metrics.security.ai.checkpoint.com/api/v1/metrics/collect";
+}
+function hashString(input) {
+  return createHash("sha256").update(input).digest("hex");
+}
+function getMachineId() {
+  if (!machineId) {
+    try {
+      machineId = machineIdSync();
+    } catch (error) {
+      console.warn("Failed to get machine ID for telemetry:", error);
+      machineId = "unknown";
+    }
+  }
+  return machineId;
+}
+function getHashedMachineId() {
+  if (!hashedMachineId) {
+    hashedMachineId = hashString(getMachineId());
+  }
+  return hashedMachineId;
+}
+function calculateChecksum(mcpName, toolName, machineId2, clientVersion) {
+  const data = mcpName + machineId2.slice(0, 16) + toolName + clientVersion;
+  return hashString(data);
+}
+async function trackToolCall(mcpName, toolName, clientVersion, extra) {
+  if (isTelemetryDisabled()) {
+    return;
+  }
+  try {
+    const machineId2 = getHashedMachineId();
+    const checksum = calculateChecksum(mcpName, toolName, machineId2, clientVersion);
+    fetch(getTelemetryUrl(), {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        mcp_name: mcpName,
+        tool_name: toolName,
+        machine_id: machineId2,
+        client_version: clientVersion,
+        checksum
+      })
+    }).catch(() => {
+    });
+  } catch (error) {
+  }
+}
+
+// ../mcp-utils/dist/mcp-server.js
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+var CPMcpServer = class extends McpServer {
+  constructor(serverInfo, options) {
+    super(serverInfo, options);
+    this.mcpName = serverInfo.name;
+    this.mcpVersion = serverInfo.version || "0.0.0";
+  }
+  /**
+   * Set a tool policy callback to filter which tools are available
+   * This should be called after all tools are registered but before connecting
+   * @param callback Function that returns true if a tool should be enabled
+   */
+  setToolPolicy(callback) {
+    console.error("[CPMcpServer] Setting tool policy callback");
+    this.toolPolicyCallback = callback;
+  }
+  /**
+   * Apply the tool policy by checking all registered tools
+   * This should be called after all tools are registered but before connecting
+   */
+  applyToolPolicy() {
+    if (!this.toolPolicyCallback) {
+      console.error("[CPMcpServer] No tool policy callback set, allowing all tools");
+      return;
+    }
+    console.error("[CPMcpServer] Applying tool policy");
+    const registeredTools = this._registeredTools;
+    if (!registeredTools || typeof registeredTools !== "object") {
+      console.error("[CPMcpServer] No tools registered yet");
+      return;
+    }
+    const toolNames = Object.keys(registeredTools);
+    console.error(`[CPMcpServer] Found ${toolNames.length} registered tools:`, toolNames);
+    let enabledCount = 0;
+    let disabledCount = 0;
+    for (const [toolName, tool] of Object.entries(registeredTools)) {
+      const isAllowed = this.toolPolicyCallback(toolName);
+      if (!isAllowed) {
+        console.error(`[CPMcpServer] Tool '${toolName}' is NOT allowed by policy - disabling`);
+        if (typeof tool.disable === "function") {
+          tool.disable();
+          disabledCount++;
+        }
+      } else {
+        console.error(`[CPMcpServer] Tool '${toolName}' is allowed by policy`);
+        enabledCount++;
+      }
+    }
+    console.error(`[CPMcpServer] Policy applied: ${enabledCount}/${toolNames.length} tools enabled, ${disabledCount} disabled`);
+  }
+  // Override the tool method to wrap callbacks with telemetry
+  tool(...args) {
+    const callback = args[args.length - 1];
+    if (typeof callback === "function") {
+      const toolName = args[0];
+      const wrappedCallback = async (...callbackArgs) => {
+        let extra = callbackArgs[1];
+        if (!extra && callbackArgs[0]?.sessionId) {
+          extra = callbackArgs[0];
+        }
+        trackToolCall(this.mcpName, toolName, this.mcpVersion, extra).catch(() => {
+        });
+        if (callbackArgs.length === 1 && callbackArgs[0]?.sessionId) {
+          return callback({}, callbackArgs[0]);
+        }
+        return callback(...callbackArgs);
+      };
+      args[args.length - 1] = wrappedCallback;
+    }
+    return super.tool(...args);
+  }
+};
+
+// ../mcp-utils/dist/package-utils.js
+import { readFileSync } from "fs";
+import { join as join2, dirname } from "path";
+import { fileURLToPath } from "url";
+function readPackageJson(importMetaUrl) {
+  const pkg2 = JSON.parse(readFileSync(join2(dirname(fileURLToPath(importMetaUrl)), "../package.json"), "utf-8"));
+  process.env.CP_MCP_MAIN_PKG = `${pkg2.name} v${pkg2.version}`;
+  return pkg2;
+}
+function createMcpServer(importMetaUrl, serverInfo, options) {
+  const pkg2 = readPackageJson(importMetaUrl);
+  const fullServerInfo = {
+    ...serverInfo,
+    name: serverInfo.name || pkg2.name,
+    version: serverInfo.version || pkg2.version
+  };
+  const createServerFn = () => {
+    return new CPMcpServer(fullServerInfo, options);
+  };
+  const server2 = new CPMcpServer(fullServerInfo, options);
+  server2._createServerFn = createServerFn;
+  return { server: server2, pkg: pkg2 };
+}
+
+// ../infra/dist/api-manager.js
+var APIManagerBase = class {
+  constructor(client) {
+    this.client = client;
+    this.requestInfo = null;
+    this.detailsLevel = "full";
+    this._debug = false;
+    this.domainClients = /* @__PURE__ */ new Map();
+    this.gatewayDomainMap = /* @__PURE__ */ new Map();
+    this.domains = null;
+  }
+  /**
+   * Set debug mode for the API client
+   */
+  set debug(value) {
+    this._debug = value;
+    if (this.client) {
+      if ("debug" in this.client) {
+        this.client.debug = value;
+      }
+    }
+  }
+  /**
+   * Get debug mode
+   */
+  get debug() {
+    return this._debug;
+  }
+  /**
+   * Call an API endpoint
+   */
+  async callApi(method, uri, data, domain) {
+    const sanitizedData = sanitizeData(data);
+    const apiClient = domain ? await this.getDomainApiClientByDomain(domain) : this.client;
+    const clientResponse = await apiClient.callApi(method, uri, sanitizedData, void 0);
+    return clientResponse.response;
+  }
+  /**
+   * Get the result of a management API task (similar to getTaskResult but for management tasks)
+   */
+  async getManagementTaskResult(taskId, domain, maxRetries = 5) {
+    let retries = 0;
+    const timeouts = [500, 500, 1e3, 2e3, 5e3];
+    while (retries < maxRetries) {
+      const taskParams2 = { "task-id": taskId };
+      const taskResp2 = await this.callApi("POST", "show-task", taskParams2, domain);
+      const tasks = taskResp2?.tasks || [];
+      if (tasks.length > 0) {
+        const taskStatus = tasks[0].status;
+        if (taskStatus === "succeeded" || taskStatus === "failed") {
+          return { response: taskResp2 };
+        }
+      }
+      const timeout = timeouts[Math.min(retries, timeouts.length - 1)];
+      await new Promise((resolve) => setTimeout(resolve, timeout));
+      retries++;
+    }
+    const taskParams = { "task-id": taskId };
+    const taskResp = await this.callApi("POST", "show-task", taskParams, domain);
+    return { response: taskResp };
+  }
+  /**
+   * Check if the current environment is MDS
+   */
+  async isMds() {
+    return await this.client.isMDSEnvironment();
+  }
+  /**
+   * Get domains from show-domains API with full details including server information
+   */
+  async getDomains() {
+    if (this.domains !== null) {
+      return this.domains;
+    }
+    const response = await this.callApi("post", "show-domains", {
+      "details-level": "full"
+    });
+    const domains = [];
+    if (response.objects) {
+      for (const obj of response.objects) {
+        if (obj.name && obj.type) {
+          domains.push({
+            name: obj.name,
+            type: obj.type,
+            servers: obj.servers || []
+          });
+        }
+      }
+    }
+    this.domains = domains;
+    return domains;
+  }
+  /**
+   * Create an API manager instance
+   */
+  static create(args) {
+    throw new Error("Method must be implemented by subclass");
+  }
+  /**
+   * Get the appropriate API client for a specific gateway, handling MDS domain routing
+   */
+  async getDomainApiClient(gatewayName) {
+    const isMDS = await this.client.isMDSEnvironment();
+    if (!isMDS) {
+      return this.client;
+    }
+    const existingDomain = this.gatewayDomainMap.get(gatewayName);
+    if (existingDomain) {
+      const existingClient = this.domainClients.get(existingDomain);
+      if (existingClient && existingClient.hasValidSession()) {
+        return existingClient;
+      }
+    }
+    const gatewayInfo = await this.getGatewayInfo(gatewayName);
+    if (!gatewayInfo) {
+      throw new Error(`Gateway '${gatewayName}' not found`);
+    }
+    const gatewayDomain = gatewayInfo.domain;
+    if (!gatewayDomain) {
+      return this.client;
+    }
+    const gatewayDomainName = gatewayDomain.name;
+    const existingDomainClient = this.domainClients.get(gatewayDomainName);
+    if (existingDomainClient && existingDomainClient.hasValidSession()) {
+      this.gatewayDomainMap.set(gatewayName, gatewayDomainName);
+      return existingDomainClient;
+    }
+    const domainSid = await this.loginToDomain(gatewayDomainName);
+    const domainClient = this.createClientWithSid(domainSid);
+    this.domainClients.set(gatewayDomainName, domainClient);
+    this.gatewayDomainMap.set(gatewayName, gatewayDomainName);
+    return domainClient;
+  }
+  /**
+   * Get the appropriate API client for a specific domain, handling MDS domain routing
+   * This method handles multi-MDS environments where domains may be distributed across
+   * different MDS servers with active/standby configurations.
+   */
+  async getDomainApiClientByDomain(domainName) {
+    const isMDS = await this.client.isMDSEnvironment();
+    if (!isMDS) {
+      return this.client;
+    }
+    const existingDomainClient = this.domainClients.get(domainName);
+    if (existingDomainClient && existingDomainClient.hasValidSession()) {
+      return existingDomainClient;
+    }
+    const isOnCurrentMDS = await this.isDomainOnCurrentMDS(domainName);
+    if (isOnCurrentMDS) {
+      const domainSid2 = await this.loginToDomain(domainName);
+      const domainClient2 = this.createClientWithSid(domainSid2);
+      this.domainClients.set(domainName, domainClient2);
+      return domainClient2;
+    }
+    const targetMDSIP = await this.getMDSServerForDomain(domainName);
+    if (!targetMDSIP) {
+      throw new Error(`Domain '${domainName}' not found or has no available MDS servers. Make sure the domain exists and you have access to it.`);
+    }
+    const currentHost = this.client.getHost();
+    const portMatch = currentHost.match(/:(\d+)/);
+    const port = portMatch ? portMatch[1] : "443";
+    const newMDSClient = this.createClientForMDS(targetMDSIP, port);
+    if ("debug" in newMDSClient) {
+      newMDSClient.debug = this._debug;
+    }
+    await newMDSClient.login();
+    const loginResponse = await newMDSClient.callApi("post", "login-to-domain", {
+      "domain": domainName
+    }, void 0);
+    if (!loginResponse.response.sid) {
+      throw new Error(`Failed to login to domain '${domainName}' on MDS server ${targetMDSIP}`);
+    }
+    const domainSid = loginResponse.response.sid;
+    const domainClient = this.createClientWithSid(domainSid);
+    this.domainClients.set(domainName, domainClient);
+    return domainClient;
+  }
+  /**
+   * Get gateway information from show-gateways-and-servers
+   */
+  async getGatewayInfo(gatewayName) {
+    const response = await this.callApi("post", "show-gateways-and-servers", {
+      "details-level": "full"
+    });
+    if (response.objects) {
+      return response.objects.find((obj) => obj.name === gatewayName);
+    }
+    return null;
+  }
+  /**
+   * Login to a specific domain using the main API client
+   */
+  async loginToDomain(domainName) {
+    const response = await this.callApi("post", "login-to-domain", {
+      "domain": domainName
+    });
+    if (!response.sid) {
+      throw new Error(`Failed to login to domain '${domainName}'`);
+    }
+    return response.sid;
+  }
+  /**
+   * Create a new API client instance with the given session ID
+   */
+  createClientWithSid(sid) {
+    if (this.client instanceof OnPremAPIClient) {
+      return APIClientBase.createWithSid.call(OnPremAPIClient, this.client, sid);
+    } else if (this.client instanceof SmartOneCloudAPIClient) {
+      return APIClientBase.createWithSid.call(SmartOneCloudAPIClient, this.client, sid);
+    } else {
+      throw new Error("Unknown client type");
+    }
+  }
+  /**
+   * Check if a domain exists on the current MDS server (either active or standby)
+   */
+  async isDomainOnCurrentMDS(domainName) {
+    const domains = await this.getDomains();
+    const domain = domains.find((d) => d.name === domainName);
+    if (!domain?.servers || domain.servers.length === 0) {
+      return false;
+    }
+    const currentHost = this.client.getHost();
+    return domain.servers.some((server2) => {
+      const ipv4 = server2["ipv4-address"];
+      const ipv6 = server2["ipv6-address"];
+      return ipv4 && currentHost.includes(ipv4) || ipv6 && currentHost.includes(ipv6);
+    });
+  }
+  /**
+   * Get the appropriate MDS server IP for a domain
+   * Prefers the active server, but returns any available server
+   * Returns IPv4 if available, otherwise IPv6
+   */
+  async getMDSServerForDomain(domainName) {
+    const domains = await this.getDomains();
+    const domain = domains.find((d) => d.name === domainName);
+    if (!domain?.servers || domain.servers.length === 0) {
+      return null;
+    }
+    const activeServer = domain.servers.find((s) => s.active === true);
+    if (activeServer) {
+      if (activeServer["ipv4-address"]) {
+        return activeServer["ipv4-address"];
+      }
+      if (activeServer["ipv6-address"]) {
+        return activeServer["ipv6-address"];
+      }
+    }
+    const ipv4Server = domain.servers.find((s) => s["ipv4-address"]);
+    if (ipv4Server?.["ipv4-address"]) {
+      return ipv4Server["ipv4-address"];
+    }
+    const ipv6Server = domain.servers.find((s) => s["ipv6-address"]);
+    return ipv6Server?.["ipv6-address"] || null;
+  }
+  /**
+   * Create a new API client for a different MDS server
+   * Handles both IPv4 and IPv6 addresses
+   * Only supports OnPremAPIClient for multi-MDS scenarios
+   */
+  createClientForMDS(mdsIP, port = "443") {
+    if (this.client instanceof OnPremAPIClient) {
+      const currentClient = this.client;
+      const formattedHost = mdsIP.includes(":") && !mdsIP.startsWith("[") ? `[${mdsIP}]` : mdsIP;
+      return new OnPremAPIClient(currentClient.authToken || void 0, formattedHost, port, currentClient.username, currentClient.password);
+    } else if (this.client instanceof SmartOneCloudAPIClient) {
+      throw new Error("Multi-MDS routing is not supported for SmartOneCloud environments");
+    } else {
+      throw new Error("Unknown client type for MDS routing");
+    }
+  }
+  /**
+   * Run a script on a target gateway
+   */
+  async runScript(targetGateway, scriptName, script) {
+    const apiClient = await this.getDomainApiClient(targetGateway);
+    const payload = {
+      "script-name": scriptName,
+      "script": script,
+      "targets": [targetGateway]
+    };
+    const clientResponse = await apiClient.callApi("post", "run-script", payload, void 0);
+    const resp = clientResponse.response;
+    if (!resp.tasks) {
+      return [false, { message: "Failed to run the script" }];
+    }
+    return [true, { tasks: resp.tasks.map((task) => task["task-id"]) }];
+  }
+  /**
+   * Get the result of a task
+   */
+  async getTaskResult(gatewayName, taskId, maxRetries = 5) {
+    const client = await this.getDomainApiClient(gatewayName);
+    let retries = 0;
+    const timeouts = [1e3, 1e3, 2e3, 5e3, 5e3];
+    while (retries < maxRetries) {
+      const payload = {
+        "task-id": taskId,
+        "details-level": "full"
+      };
+      const response = await client.callApi("post", "show-task", payload);
+      const taskDetails = response.response.tasks?.[0];
+      if (taskDetails?.status === "succeeded" || taskDetails?.status === "failed") {
+        if (taskDetails["task-details"]?.[0]?.responseMessage) {
+          const responseMessageBase64 = taskDetails["task-details"][0].responseMessage;
+          const decoded = Buffer.from(responseMessageBase64, "base64").toString("utf-8");
+          return [taskDetails.status === "succeeded", decoded];
+        }
+        return [false, "failed to get task result"];
+      } else {
+        const timeout = timeouts[Math.min(retries, timeouts.length - 1)];
+        console.error(`Try #${retries}: Task ${taskId} is still running, waiting for ${timeout}ms...`);
+        retries++;
+        await new Promise((resolve) => setTimeout(resolve, timeout));
+      }
+    }
+    return [false, "Task did not complete in time"];
+  }
+};
+var APIManagerForAPIKey = class extends APIManagerBase {
+  static create(args) {
+    const verbose = SettingsManager.globalDebugState;
+    if (verbose) {
+      console.error("[APIManagerForAPIKey.create] Verbose: Creating API manager");
+      console.error("[APIManagerForAPIKey.create] Verbose: Args received:", {
+        apiKey: args.apiKey ? "***" : void 0,
+        username: args.username ? "***" : void 0,
+        password: args.password ? "***" : void 0,
+        managementHost: args.managementHost,
+        managementPort: args.managementPort,
+        s1cUrl: args.s1cUrl,
+        cloudInfraToken: args.cloudInfraToken ? "***" : void 0
+      });
+    }
+    const hasAnyValue = args.apiKey || args.username || args.password || args.s1cUrl || args.managementHost || args.cloudInfraToken;
+    if (!hasAnyValue) {
+      if (verbose) {
+        console.error("[APIManagerForAPIKey.create] Verbose: ERROR - Args object is effectively empty, no values provided");
+        console.error("[APIManagerForAPIKey.create] Verbose: All args keys:", Object.keys(args));
+      }
+      throw new Error("No authentication or connection parameters provided. Args object is empty or contains only undefined values.");
+    }
+    if (args.managementHost) {
+      if (verbose) {
+        console.error("[APIManagerForAPIKey.create] Verbose: Using on-prem management with host:", args.managementHost);
+      }
+      const onPremClient = new OnPremAPIClient(args.apiKey, args.managementHost, args.managementPort || "443", args.username, args.password);
+      return new this(onPremClient);
+    }
+    if (verbose) {
+      console.error("[APIManagerForAPIKey.create] Verbose: managementHost not provided, checking s1cUrl");
+    }
+    if (!args.s1cUrl) {
+      if (verbose) {
+        console.error("[APIManagerForAPIKey.create] Verbose: ERROR - Neither managementHost nor s1cUrl provided");
+      }
+      throw new Error("Either management host or S1C URL must be provided");
+    }
+    if (verbose) {
+      console.error("[APIManagerForAPIKey.create] Verbose: Using S1C with URL:", args.s1cUrl);
+    }
+    let keyType;
+    let key;
+    if (args.cloudInfraToken) {
+      if (verbose) {
+        console.error("[APIManagerForAPIKey.create] Verbose: Using cloud infra token");
+      }
+      keyType = TokenType.CI_TOKEN;
+      key = args.cloudInfraToken;
+    } else if (args.apiKey) {
+      if (verbose) {
+        console.error("[APIManagerForAPIKey.create] Verbose: Using API key");
+      }
+      keyType = TokenType.API_KEY;
+      key = args.apiKey;
+    } else {
+      if (verbose) {
+        console.error("[APIManagerForAPIKey.create] Verbose: ERROR - No API key or cloud infra token provided");
+      }
+      throw new Error("API key or cloud infrastructure token is required");
+    }
+    return new this(SmartOneCloudAPIClient.create(key, keyType, args.s1cUrl));
+  }
+};
+
+// ../infra/dist/settings.js
+var Settings = class _Settings {
+  normalizeRegion(region) {
+    if (!region) {
+      return void 0;
+    }
+    const normalized = region.trim().toUpperCase();
+    return this.isValidRegion(normalized) ? normalized : void 0;
+  }
+  /**
+   * Extract the base gateway URL (scheme + host) from a full URL.
+   * Allows users to copy-paste any URL from the API key creation dialog
+   * without having to strip the path manually.
+   * Falls back to the original string if URL parsing fails.
+   */
+  static stripGatewayPath(url) {
+    try {
+      const parsed = new URL(url);
+      return `${parsed.protocol}//${parsed.host}`;
+    } catch {
+      return url;
+    }
+  }
+  /**
+   * Detect the region from a gateway base URL
+   */
+  static detectRegionFromUrl(url) {
+    if (url.includes("cloudinfra-gw-us.portal.checkpoint.com"))
+      return "US";
+    if (url.includes("cloudinfra-gw.portal.checkpoint.com"))
+      return "EU";
+    if (url.includes("dev-cloudinfra-gw"))
+      return "STG";
+    return void 0;
+  }
+  constructor({ apiKey = process.env.API_KEY, username = process.env.USERNAME, password = process.env.PASSWORD, s1cUrl = process.env.S1C_URL, managementHost = process.env.MANAGEMENT_HOST, managementPort = process.env.MANAGEMENT_PORT || "443", cloudInfraToken = process.env.CLOUD_INFRA_TOKEN, clientId = process.env.CLIENT_ID, secretKey = process.env.SECRET_KEY, region = process.env.REGION || "EU", devPort = process.env.DEV_PORT || "8006", gatewayUrl } = {}) {
+    this.region = "EU";
+    this.devPort = "8006";
+    this.gatewayUrl = "";
+    const verbose = SettingsManager.globalDebugState;
+    if (verbose) {
+      console.error("[Settings] Verbose: Constructor called with params:", {
+        apiKey: apiKey ? "***" : void 0,
+        username: username ? "***" : void 0,
+        password: password ? "***" : void 0,
+        s1cUrl,
+        managementHost,
+        managementPort,
+        cloudInfraToken: cloudInfraToken ? "***" : void 0,
+        clientId,
+        secretKey: secretKey ? "***" : void 0,
+        region,
+        devPort
+      });
+    }
+    this.apiKey = apiKey;
+    this.username = username;
+    this.password = password;
+    this.s1cUrl = s1cUrl;
+    this.managementHost = managementHost;
+    this.managementPort = managementPort;
+    this.cloudInfraToken = cloudInfraToken;
+    this.clientId = clientId;
+    this.secretKey = secretKey;
+    this.region = this.normalizeRegion(region) || "EU";
+    this.devPort = devPort;
+    this.gatewayUrl = this.resolveGatewayUrl(this.region, gatewayUrl);
+    if (verbose) {
+      console.error("[Settings] Verbose: After assignment:", {
+        apiKey: this.apiKey ? "***" : void 0,
+        username: this.username ? "***" : void 0,
+        password: this.password ? "***" : void 0,
+        s1cUrl: this.s1cUrl,
+        managementHost: this.managementHost,
+        managementPort: this.managementPort,
+        cloudInfraToken: this.cloudInfraToken ? "***" : void 0,
+        region: this.region
+      });
+    }
+    this.validate();
+  }
+  /**
+   * Check if the provided string is a valid region
+   */
+  isValidRegion(region) {
+    return ["EU", "US", "STG", "LOCAL"].includes(region.toUpperCase());
+  }
+  /**
+   * Get the base gateway URL for a given region
+   */
+  getRegionGatewayUrl(region) {
+    switch (region) {
+      case "EU":
+        return "https://cloudinfra-gw.portal.checkpoint.com";
+      case "US":
+        return "https://cloudinfra-gw-us.portal.checkpoint.com";
+      case "STG":
+      case "LOCAL":
+        return "https://dev-cloudinfra-gw.kube1.iaas.checkpoint.com";
+      default:
+        return "";
+    }
+  }
+  /**
+   * Resolve the base gateway URL from either a provided URL or the configured region.
+   * If a URL is provided, its path suffix is stripped so users can paste the full
+   * auth URL from the API key creation dialog (e.g. ending in /auth/external).
+   * When the URL implies a different region, this.region is updated to match.
+   */
+  resolveGatewayUrl(region, providedUrl) {
+    if (!providedUrl) {
+      return this.getRegionGatewayUrl(region);
+    }
+    const base = _Settings.stripGatewayPath(providedUrl);
+    const detectedRegion = _Settings.detectRegionFromUrl(base);
+    if (detectedRegion && detectedRegion !== this.region) {
+      this.region = detectedRegion;
+    }
+    return base;
+  }
+  /**
+   * Get the base Cloud Infra Gateway URL.
+   * Returns the precomputed gatewayUrl (derived from region or a provided URL).
+   */
+  getCloudInfraGateway() {
+    return this.gatewayUrl;
+  }
+  /**
+   * Validate the settings
+   */
+  validate() {
+    const verbose = SettingsManager.globalDebugState;
+    if (verbose) {
+      console.error("[Settings] Verbose: Validating settings...");
+      console.error("[Settings] Verbose: s1cUrl:", this.s1cUrl || "(empty)");
+      console.error("[Settings] Verbose: managementHost:", this.managementHost || "(empty)");
+      console.error("[Settings] Verbose: apiKey:", this.apiKey ? "***" : "(empty)");
+      console.error("[Settings] Verbose: cloudInfraToken:", this.cloudInfraToken ? "***" : "(empty)");
+      console.error("[Settings] Verbose: username:", this.username ? "***" : "(empty)");
+      console.error("[Settings] Verbose: password:", this.password ? "***" : "(empty)");
+    }
+    if (!nullOrEmpty(this.s1cUrl) && nullOrEmpty(this.apiKey) && nullOrEmpty(this.cloudInfraToken)) {
+      if (verbose) {
+        console.error("[Settings] Verbose: Validation FAILED - S1C URL provided but no API key or CI token");
+      }
+      throw new Error("API key or CI Token is required for S1C (via --api-key or API_KEY env var)");
+    }
+    if (!nullOrEmpty(this.managementHost) && nullOrEmpty(this.apiKey) && (nullOrEmpty(this.username) || nullOrEmpty(this.password))) {
+      if (verbose) {
+        console.error("[Settings] Verbose: Validation FAILED - Management host provided but no API key or credentials");
+      }
+      throw new Error("Either API key or username/password are required for on-prem management (via CLI args or env vars)");
+    }
+    if (nullOrEmpty(this.s1cUrl) && nullOrEmpty(this.managementHost)) {
+      if (verbose) {
+        console.error("[Settings] Verbose: WARNING - Neither s1cUrl nor managementHost provided");
+      }
+    }
+    if (verbose) {
+      console.error("[Settings] Verbose: Validation PASSED");
+    }
+  }
+  /**
+   * Create settings from command-line arguments
+   */
+  static fromArgs(args) {
+    const verbose = SettingsManager.globalDebugState;
+    if (verbose) {
+      console.error("[Settings.fromArgs] Verbose: Creating settings from args");
+      console.error("[Settings.fromArgs] Verbose: Raw args:", {
+        apiKey: args.apiKey ? "***" : void 0,
+        username: args.username ? "***" : void 0,
+        password: args.password ? "***" : void 0,
+        s1cUrl: args.s1cUrl,
+        managementHost: args.managementHost,
+        managementPort: args.managementPort,
+        cloudInfraToken: args.cloudInfraToken ? "***" : void 0,
+        region: args.region,
+        hasOtherKeys: Object.keys(args).length > 10
+      });
+      const hasAnyValue = args.apiKey || args.username || args.password || args.s1cUrl || args.managementHost || args.cloudInfraToken;
+      if (!hasAnyValue) {
+        console.error("[Settings.fromArgs] Verbose: WARNING - Args object appears empty, no authentication values found");
+      }
+    }
+    return new _Settings({
+      apiKey: args.apiKey,
+      username: args.username,
+      password: args.password,
+      s1cUrl: args.s1cUrl,
+      managementHost: args.managementHost,
+      managementPort: args.managementPort,
+      cloudInfraToken: args.cloudInfraToken,
+      clientId: args.clientId,
+      secretKey: args.secretKey,
+      region: typeof args.region === "string" ? args.region.trim().toUpperCase() : void 0,
+      devPort: args.devPort,
+      gatewayUrl: args.gatewayUrl
+    });
+  }
+  /**
+   * Create settings from HTTP headers
+   * Maps headers to environment variable format based on server config
+   */
+  static fromHeaders(headers) {
+    const verbose = SettingsManager.globalDebugState;
+    if (verbose) {
+      console.error("[Settings.fromHeaders] Verbose: Creating settings from headers");
+      console.error("[Settings.fromHeaders] Verbose: Available header keys:", Object.keys(headers));
+    }
+    const extractedValues = {
+      apiKey: getHeaderValue(headers, "API-KEY"),
+      username: getHeaderValue(headers, "USERNAME"),
+      password: getHeaderValue(headers, "PASSWORD"),
+      s1cUrl: getHeaderValue(headers, "S1C-URL"),
+      managementHost: getHeaderValue(headers, "MANAGEMENT-HOST"),
+      managementPort: getHeaderValue(headers, "MANAGEMENT-PORT"),
+      cloudInfraToken: getHeaderValue(headers, "CLOUD-INFRA-TOKEN"),
+      clientId: getHeaderValue(headers, "CLIENT-ID"),
+      secretKey: getHeaderValue(headers, "SECRET-KEY"),
+      region: getHeaderValue(headers, "REGION"),
+      devPort: getHeaderValue(headers, "DEV-PORT"),
+      gatewayUrl: getHeaderValue(headers, "GATEWAY-URL")
+    };
+    if (verbose) {
+      console.error("[Settings.fromHeaders] Verbose: Extracted values:", {
+        apiKey: extractedValues.apiKey ? "***" : void 0,
+        username: extractedValues.username ? "***" : void 0,
+        password: extractedValues.password ? "***" : void 0,
+        s1cUrl: extractedValues.s1cUrl,
+        managementHost: extractedValues.managementHost,
+        managementPort: extractedValues.managementPort,
+        cloudInfraToken: extractedValues.cloudInfraToken ? "***" : void 0,
+        region: extractedValues.region,
+        devPort: extractedValues.devPort
+      });
+      const hasAnyValue = extractedValues.apiKey || extractedValues.username || extractedValues.password || extractedValues.s1cUrl || extractedValues.managementHost || extractedValues.cloudInfraToken;
+      if (!hasAnyValue) {
+        console.error("[Settings.fromHeaders] Verbose: WARNING - No authentication values found in headers");
+        console.error("[Settings.fromHeaders] Verbose: Full headers object (sanitized):", Object.fromEntries(Object.entries(headers).map(([k, v]) => [k, k.toLowerCase().includes("key") || k.toLowerCase().includes("token") || k.toLowerCase().includes("password") ? "***" : v])));
+      }
+    }
+    return new _Settings({
+      apiKey: extractedValues.apiKey,
+      username: extractedValues.username,
+      password: extractedValues.password,
+      s1cUrl: extractedValues.s1cUrl,
+      managementHost: extractedValues.managementHost,
+      managementPort: extractedValues.managementPort,
+      cloudInfraToken: extractedValues.cloudInfraToken,
+      clientId: extractedValues.clientId,
+      secretKey: extractedValues.secretKey,
+      region: extractedValues.region?.toUpperCase(),
+      devPort: extractedValues.devPort,
+      gatewayUrl: extractedValues.gatewayUrl
+    });
+  }
+};
+
+// ../infra/dist/external-user-token-manager.js
+import axios2 from "axios";
+
+// src/index.ts
+import { join as join3, dirname as dirname2 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+
+// src/zodSchemas.ts
+import { z } from "zod";
+var zodSchemas = {
+  ShowCardInfo: { domain: z.string().optional(), domains_to_process: z.enum(["ALL_DOMAINS_ON_THIS_SERVER", "CURRENT_DOMAIN"]).optional() },
+  ShowConfig: { domain: z.string().optional(), domains_to_process: z.enum(["ALL_DOMAINS_ON_THIS_SERVER", "CURRENT_DOMAIN"]).optional() },
+  ShowRulesUidsWithSuggestions: { domain: z.string().optional(), domains_to_process: z.enum(["ALL_DOMAINS_ON_THIS_SERVER", "CURRENT_DOMAIN"]).optional(), "requestBody": z.object({ "layer": z.string().uuid().regex(new RegExp("^[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$")).describe("Access layer identifier in UUID format"), "filters": z.object({ "states": z.array(z.enum(["ACCEPTED", "REJECTED"]).describe("State of a suggestion - either ACCEPTED or REJECTED")).describe("Array of insight state values").optional(), "user-interaction": z.object({ "operator": z.enum(["NOT-IN", "IN"]).describe("Operator for filtering by user-interaction-types").optional(), "types": z.array(z.literal("DECIDE_LATER").describe("Type of user interaction with an insight")).describe("Array of user interaction type values") }).optional(), "security-impact": z.enum(["HIGH", "MEDIUM_AND_ABOVE", "LOW_AND_ABOVE"]).describe("Minimum security impact threshold to include").optional(), "confidence-level": z.enum(["HIGH", "MEDIUM_AND_ABOVE", "LOW_AND_ABOVE"]).describe("Minimum confidence threshold to include").optional(), "default-filter": z.literal("NONE").describe("Ignore default filtering of the system").optional(), "suggestions-type": z.enum(["unused-objects", "tighten-rule", "delete-disabled-rule", "zero-hits-rule"]).describe("Type of insight") }) }).describe("Parameters for showing rules UIDs with their suggestions") },
+  ShowState: { domain: z.string().optional(), domains_to_process: z.enum(["ALL_DOMAINS_ON_THIS_SERVER", "CURRENT_DOMAIN"]).optional() },
+  ShowSuggestionEngineMetadata: { domain: z.string().optional(), domains_to_process: z.enum(["ALL_DOMAINS_ON_THIS_SERVER", "CURRENT_DOMAIN"]).optional(), "requestBody": z.object({ "filters": z.object({ "suggestion-type": z.enum(["unused-objects", "tighten-rule", "delete-disabled-rule", "zero-hits-rule"]).describe("Type of insight").optional() }).optional() }).describe("The JSON request body.") },
+  ShowSuggestions: { domain: z.string().optional(), domains_to_process: z.enum(["ALL_DOMAINS_ON_THIS_SERVER", "CURRENT_DOMAIN"]).optional(), "requestBody": z.object({ "layer": z.string().uuid().regex(new RegExp("^[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$")).describe("Access layer identifier in UUID format").optional(), "options": z.object({ "include-inline-layers": z.boolean().describe("Whether to include insights on inline layers").optional() }).optional(), "limit": z.number().describe("Maximum number of items to return").optional(), "offset": z.number().describe("Number of items to skip for pagination").optional(), "filters": z.object({ "states": z.array(z.enum(["ACCEPTED", "REJECTED"]).describe("State of a suggestion - either ACCEPTED or REJECTED")).describe("Array of insight state values").optional(), "user-interaction": z.object({ "operator": z.enum(["NOT-IN", "IN"]).describe("Operator for filtering by user-interaction-types").optional(), "types": z.array(z.literal("DECIDE_LATER").describe("Type of user interaction with an insight")).describe("Array of user interaction type values") }).optional(), "security-impact": z.enum(["HIGH", "MEDIUM_AND_ABOVE", "LOW_AND_ABOVE"]).describe("Minimum security impact threshold to include").optional(), "confidence-level": z.enum(["HIGH", "MEDIUM_AND_ABOVE", "LOW_AND_ABOVE"]).describe("Minimum confidence threshold to include").optional(), "default-filter": z.literal("NONE").describe("Ignore default filtering of the system").optional(), "uids": z.array(z.string().uuid().regex(new RegExp("^[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$")).describe("Stringified UUID.")).describe("Array of insight unique identifiers").optional(), "rules-uids": z.array(z.string().uuid().regex(new RegExp("^[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$")).describe("Stringified UUID.")).describe("Array of rule unique identifiers").optional(), "types": z.array(z.enum(["unused-objects", "tighten-rule", "delete-disabled-rule", "zero-hits-rule"]).describe("Type of insight")).describe("Type of insight").optional() }).optional() }).describe("Parameters for showing suggestions with enhanced v3.0 capabilities") },
+  ShowSuggestionsInfo: { domain: z.string().optional(), domains_to_process: z.enum(["ALL_DOMAINS_ON_THIS_SERVER", "CURRENT_DOMAIN"]).optional(), "requestBody": z.object({ "layer": z.string().uuid().regex(new RegExp("^[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$")).describe("Access layer identifier in UUID format") }).describe("The JSON request body.") },
+  ShowSuggestionsSummary: { domain: z.string().optional(), domains_to_process: z.enum(["ALL_DOMAINS_ON_THIS_SERVER", "CURRENT_DOMAIN"]).optional(), "requestBody": z.object({ "layer": z.string().uuid().regex(new RegExp("^[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$")).describe("Access layer identifier in UUID format").optional(), "filters": z.object({ "states": z.array(z.enum(["ACCEPTED", "REJECTED"]).describe("State of a suggestion - either ACCEPTED or REJECTED")).describe("Array of insight state values").optional(), "user-interaction": z.object({ "operator": z.enum(["NOT-IN", "IN"]).describe("Operator for filtering by user-interaction-types").optional(), "types": z.array(z.literal("DECIDE_LATER").describe("Type of user interaction with an insight")).describe("Array of user interaction type values") }).optional(), "security-impact": z.enum(["HIGH", "MEDIUM_AND_ABOVE", "LOW_AND_ABOVE"]).describe("Minimum security impact threshold to include").optional(), "confidence-level": z.enum(["HIGH", "MEDIUM_AND_ABOVE", "LOW_AND_ABOVE"]).describe("Minimum confidence threshold to include").optional(), "default-filter": z.literal("NONE").describe("Ignore default filtering of the system").optional() }).optional() }).describe("Parameters for showing suggestions summary") },
+  ShowPolicyInsightsStatus: { domain: z.string().optional(), domains_to_process: z.enum(["ALL_DOMAINS_ON_THIS_SERVER", "CURRENT_DOMAIN"]).optional() }
+};
+
+// src/serverInfo.ts
+function getServerInfo() {
+  return {
+    description: '"Policy Insights analyzes Access Control policies and network traffic to identify opportunities for optimization. It examines traffic patterns and policy configurations, and suggests modifications to improve your security posture.\\\\n\\\\n## Key Benefits\\\\n- Reduces attack surface by making rules more restrictive and eliminating unnecessary traffic permissions\\\\n- Simplifies access control policies for easier management and auditing. Policy Insights automatically generates intelligent insights to streamline network security. It helps narrow down allowed traffic, remove unused objects and rules, and reduce potential threats, simplifying policy management."',
+    websiteUrl: "https://support.checkpoint.com/results/sk/sk183313"
+  };
+}
+
+// src/index.ts
+var { server, pkg } = createMcpServer(import.meta.url, getServerInfo());
+var SERVER_PACKAGE_NAME = pkg["name"];
+var serverModule = createServerModule(server, Settings, pkg, APIManagerForAPIKey);
+var runApi = createApiRunner(serverModule);
+server.tool(
+  `${SERVER_PACKAGE_NAME.split("/").pop().replace(/-mcp$/, "")}__init`,
+  "Verify, login and initialize management connection. Use this tool on your first interaction with the server.",
+  z2.object({}).strict(),
+  async (args, extra) => {
+    try {
+      const apiManager = SessionContext.getAPIManager(serverModule, extra);
+      const isMds = await apiManager.isMds();
+      if (!isMds) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `${SERVER_PACKAGE_NAME} server is up and running. The environment is NOT part of Multi Domain system, there is no need to use domain parameters in tool calls.`
+            }
+          ]
+        };
+      } else {
+        const domains = await apiManager.getDomains();
+        const domainList = domains.map((domain) => `${domain.name} (${domain.type})`).join(", ");
+        return {
+          content: [
+            {
+              type: "text",
+              text: `${SERVER_PACKAGE_NAME} server is up and running. The environment is part of Multi Domain system. You need to use the domain parameter for calling APIs, if you are not sure which to use, ask the user. The domains in the system are: ${domainList}`
+            }
+          ]
+        };
+      }
+    } catch (error) {
+      const errorMessage = error instanceof Error ? error.message : String(error);
+      return {
+        content: [
+          {
+            type: "text",
+            text: `Error initializing ${SERVER_PACKAGE_NAME} connection: ${errorMessage}`
+          }
+        ]
+      };
+    }
+  }
+);
+for (const toolDef of toolDefinitionMap) {
+  const toolName = toolDef.name;
+  if (!toolName) {
+    console.error("\u274C Tool definition missing name:", toolDef);
+    continue;
+  }
+  server.tool(
+    toolName,
+    toolDef.description,
+    zodSchemas[toolName],
+    async (args, extra) => {
+      return await executeApiTool(toolName, toolDef, args, extra);
+    }
+  );
+}
+async function executeApiTool(toolName, definition, validatedArgs, extra) {
+  try {
+    const urlPath = definition.pathTemplate;
+    console.error(`=== Executing tool "${toolName}" ===`);
+    console.error(`URL Path: ${urlPath}`);
+    console.error(`Method: ${definition.method}`);
+    console.error(`Raw args:`, JSON.stringify(validatedArgs, null, 2));
+    console.error(`RequestBody:`, JSON.stringify(validatedArgs?.["requestBody"], null, 2));
+    console.error(`Extra context:`, JSON.stringify(extra, null, 2));
+    console.error(`Definition:`, JSON.stringify(definition, null, 2));
+    let domain = void 0;
+    if (validatedArgs.domain) {
+      domain = typeof validatedArgs.domain === "string" && validatedArgs.domain.trim() !== "" ? validatedArgs.domain : void 0;
+      console.error(`Sending request to domain:`, JSON.stringify(domain, null, 2));
+    }
+    const requestBody = validatedArgs?.["requestBody"] || {};
+    if (validatedArgs.domains_to_process) {
+      requestBody["domains-to-process"] = typeof validatedArgs.domain === "string" && validatedArgs.domain.trim() !== "" ? validatedArgs.domain : void 0;
+    }
+    const resp = await runApi("POST", urlPath, requestBody, extra, domain);
+    console.error(`=== DEBUG: Response received ===`);
+    console.error(`Response:`, JSON.stringify(resp, null, 2));
+    return { content: [{ type: "text", text: JSON.stringify(resp, null, 2) }] };
+  } catch (error) {
+    console.error(`=== DEBUG: Error in executeApiTool ===`);
+    console.error(`Error type:`, typeof error);
+    console.error(`Error:`, error);
+    console.error(`Error stack:`, error instanceof Error ? error.stack : "No stack trace");
+    const errorMessage = error instanceof Error ? error.message : String(error);
+    return {
+      content: [{ type: "text", text: `Error executing tool '${toolName}': ${errorMessage}` }]
+    };
+  }
+}
+async function main() {
+  await launchMCPServer(
+    join3(dirname2(fileURLToPath2(import.meta.url)), "server-config.json"),
+    serverModule
+  );
+}
+main().catch((error) => {
+  console.error("Fatal error in main():", error);
+  process.exit(1);
+});
+export {
+  server
+};