@chkp/policy-insights-mcp 0.2.0 → 0.3.4

package/README.md

@@ -29,6 +29,9 @@ Together they give you the full picture: combine actual rule content with insigh
 - Get when new insights are planned to be generated
 - Retrieve detailed information when you can't see insights
 
+## Management API Version
+
+This server supports **Management API v2.1 (R82.10+)**. It is generally compatible with earlier versions; some parameters may not be available on older management servers.
 
 ## Example Use Cases
 
@@ -248,6 +251,40 @@ Add the configuration as Claude Desktop App.
   
 ---
 
+## HTTP Transport
+
+By default, this server uses **stdio** transport, which is the standard mode for MCP clients like Claude Desktop and Cursor. For hosted or multi-user deployments, an **HTTP transport** (MCP Streamable HTTP) is also available.
+
+> **Security notice before you continue:** The HTTP server has no built-in authentication and no TLS. Any client that can reach the port can establish a session, and credentials travel in cleartext. Only use HTTP transport behind an authenticated reverse proxy (nginx, Caddy, a cloud load balancer) that terminates TLS and enforces authentication. If you are running the server on the same machine as your MCP client, use the default stdio transport — it has none of these concerns.
+
+### Starting the server in HTTP mode
+
+```bash
+MCP_TRANSPORT_TYPE=http MCP_TRANSPORT_PORT=3000 npx @chkp/policy-insights-mcp
+# or
+npx @chkp/policy-insights-mcp --transport http --transport-port 3000
+```
+
+The server exposes:
+- `POST/GET/DELETE /mcp` — MCP protocol endpoint
+- `GET /health` — server status (active session count, version)
+
+### Connecting an MCP client
+
+Point your MCP client at `http://<host>:3000/mcp`. Example for Claude Desktop (`claude_desktop_config.json`):
+
+```json
+{
+  "mcpServers": {
+    "policy-insights": {
+      "url": "http://localhost:3000/mcp"
+    }
+  }
+}
+```
+
+---
+
 ## Development
 
 ### Prerequisites

package/dist/index.js

@@ -986,13 +986,15 @@ var ClientResponse = class {
   }
 };
 var APIClientBase = class {
-  constructor(authToken = "", tokenType = TokenType.API_KEY) {
+  constructor(authToken = "", tokenType = TokenType.API_KEY, cloudConnected = false) {
     this.authToken = authToken;
     this.tokenType = tokenType;
+    this.cloudConnected = cloudConnected;
     this.sid = null;
     this.sessionTimeout = null;
     this.sessionStart = null;
     this.isMDS = false;
+    this._externalSid = false;
   }
   /**
   * Create an API client instance - generic method for creating clients
@@ -1011,6 +1013,10 @@ var APIClientBase = class {
     if (this.sid) {
       headers["X-chkp-sid"] = this.sid;
     }
+    if (this.cloudConnected && this.tokenType === TokenType.CI_TOKEN) {
+      headers["Authorization"] = `Bearer ${this.authToken}`;
+      headers["CLOUD-INFRA-TOKEN"] = this.authToken;
+    }
     return headers;
   }
   /**
@@ -1026,9 +1032,22 @@ var APIClientBase = class {
     this._debug = value;
   }
   /**
-    * Check if this client needs to perform login before making API calls
+    * Set a pre-authenticated session ID provided externally (e.g. via X-chkp-sid header).
+    * When set, the client will skip login and use this SID directly for all requests.
     */
+  setExternalSid(sid) {
+    this.sid = sid;
+    this._externalSid = true;
+    this.sessionStart = Date.now();
+    this.sessionTimeout = Number.MAX_SAFE_INTEGER / 1e3;
+  }
+  /**
+   * Check if this client needs to perform login before making API calls
+   */
   needsLogin() {
+    if (this._externalSid) {
+      return false;
+    }
     return true;
   }
   /**
@@ -1087,6 +1106,9 @@ var APIClientBase = class {
       return await this.makeRequest(this.getHost(), method, uri, data, this.getHeaders(), params, httpsAgent);
     } catch (error) {
       if ((error.message?.includes("401") || error.response?.status === 401) && error.message?.toLowerCase().includes("session")) {
+        if (this._externalSid) {
+          throw new Error("Pre-authenticated session (X-chkp-sid) has expired. Provide a new session ID.");
+        }
         console.error("Session expired (401), resetting session and retrying...");
         this.sid = null;
         this.sessionStart = null;
@@ -1114,12 +1136,20 @@ var APIClientBase = class {
     const now = Date.now();
     return now > this.sessionStart + (this.sessionTimeout - 5) * 1e3;
   }
+  getHeadersForLogin() {
+    return { "Content-Type": "application/json" };
+  }
   /**
    * Login to the API using the API key
    */
   async login() {
+    if (this._externalSid) {
+      if (!this.sid)
+        throw new Error("External SID has expired");
+      return this.sid;
+    }
     const apiTokenHeader = this.tokenType === TokenType.API_KEY ? "api-key" : "ci-token";
-    const loginResp = await this.makeRequest(this.getHost(), "POST", "login", { [apiTokenHeader]: this.authToken }, { "Content-Type": "application/json" });
+    const loginResp = await this.makeRequest(this.getHost(), "POST", "login", { [apiTokenHeader]: this.authToken }, this.getHeadersForLogin());
     if (loginResp.status !== 200 || !loginResp.response || !loginResp.response.sid) {
       throw loginResp;
     }
@@ -1193,19 +1223,27 @@ var APIClientBase = class {
   }
 };
 var SmartOneCloudAPIClient = class extends APIClientBase {
-  constructor(authToken, tokenType, s1cUrl) {
-    super(authToken, tokenType);
+  constructor(authToken, tokenType, s1cUrl, cloudConnected = false) {
+    super(authToken, tokenType, cloudConnected);
     this.s1cUrl = s1cUrl;
   }
   getHost() {
     return this.s1cUrl;
   }
+  getHeadersForLogin() {
+    const headers = { "Content-Type": "application/json" };
+    if (this.cloudConnected && this.tokenType === TokenType.CI_TOKEN) {
+      headers["Authorization"] = `Bearer ${this.authToken}`;
+    }
+    return headers;
+  }
 };
 var OnPremAPIClient = class extends APIClientBase {
-  constructor(apiKey, managementHost, managementPort = "443", username, password) {
+  constructor(apiKey, managementHost, managementPort = "443", username, password, domain) {
     super(apiKey || "");
     this.managementHost = managementHost;
     this.managementPort = managementPort;
+    this.domain = domain;
     this.username = username;
     this.password = password;
   }
@@ -1219,6 +1257,11 @@ var OnPremAPIClient = class extends APIClientBase {
   * and allow self-signed certificates
   */
   async login() {
+    if (this._externalSid) {
+      if (!this.sid)
+        throw new Error("External SID has expired");
+      return this.sid;
+    }
     const isUsingApiKey = !!this.authToken;
     const isUsingCredentials = !!(this.username && this.password);
     if (!isUsingApiKey && !isUsingCredentials) {
@@ -1226,6 +1269,9 @@ var OnPremAPIClient = class extends APIClientBase {
     }
     const httpsAgent = new https.Agent({ rejectUnauthorized: false });
     const loginPayload = isUsingApiKey ? { "api-key": this.authToken } : { "user": this.username, "password": this.password };
+    if (this.domain) {
+      loginPayload["domain"] = this.domain;
+    }
     const loginResp = await this.makeRequest(this.getHost(), "POST", "login", loginPayload, { "Content-Type": "application/json" }, null, httpsAgent);
     if (loginResp.status !== 200 || !loginResp.response || !loginResp.response.sid) {
       throw loginResp;
@@ -2407,6 +2453,7 @@ var APIManagerBase = class {
     this.domainClients = /* @__PURE__ */ new Map();
     this.gatewayDomainMap = /* @__PURE__ */ new Map();
     this.domains = null;
+    this.mdsServers = null;
   }
   /**
    * Set debug mode for the API client
@@ -2430,7 +2477,7 @@ var APIManagerBase = class {
    */
   async callApi(method, uri, data, domain) {
     const sanitizedData = sanitizeData(data);
-    const apiClient = domain ? await this.getDomainApiClientByDomain(domain) : this.client;
+    const apiClient = domain && !data["domains-to-process"] ? await this.getDomainApiClientByDomain(domain) : this.client;
     const clientResponse = await apiClient.callApi(method, uri, sanitizedData, void 0);
     return clientResponse.response;
   }
@@ -2471,23 +2518,35 @@ var APIManagerBase = class {
     if (this.domains !== null) {
       return this.domains;
     }
-    const response = await this.callApi("post", "show-domains", {
-      "details-level": "full"
-    });
-    const domains = [];
-    if (response.objects) {
-      for (const obj of response.objects) {
-        if (obj.name && obj.type) {
-          domains.push({
-            name: obj.name,
-            type: obj.type,
-            servers: obj.servers || []
-          });
+    const allDomains = [];
+    const limit = 50;
+    let offset = 0;
+    let total = Infinity;
+    while (offset < total) {
+      const response = await this.callApi("post", "show-domains", {
+        "details-level": "full",
+        "limit": limit,
+        "offset": offset
+      });
+      if (response.objects) {
+        for (const obj of response.objects) {
+          if (obj.name && obj.type) {
+            allDomains.push({
+              name: obj.name,
+              type: obj.type,
+              servers: obj.servers || []
+            });
+          }
         }
       }
+      total = typeof response.total === "number" ? response.total : allDomains.length;
+      offset += limit;
+      if (!response.objects || response.objects.length === 0) {
+        break;
+      }
     }
-    this.domains = domains;
-    return domains;
+    this.domains = allDomains;
+    return this.domains;
   }
   /**
    * Create an API manager instance
@@ -2531,9 +2590,18 @@ var APIManagerBase = class {
     return domainClient;
   }
   /**
-   * Get the appropriate API client for a specific domain, handling MDS domain routing
-   * This method handles multi-MDS environments where domains may be distributed across
-   * different MDS servers with active/standby configurations.
+   * Get the appropriate API client for a specific domain, handling MDS domain routing.
+   * Uses login -d (credential-based domain login) as the primary path.
+   *
+   * Flow:
+   *  1. login -d on current MDS root (works for both local and standby domains)
+   *  2. Cross-MDS: find target MDS root IP via show-mdss, then login -d there
+   *  3. Last resort: login directly to the active DMS virtual IP
+   *
+   * NOTE: This server currently exposes read-only APIs only. For reads, landing on a
+   * standby DMS is acceptable — the data is replicated. If write operations are added
+   * in the future, step 1 must be changed to enforce routing to the ACTIVE DMS server
+   * (use getMDSServerForDomain which selects the active server from show-domains).
    */
   async getDomainApiClientByDomain(domainName) {
     const isMDS = await this.client.isMDSEnvironment();
@@ -2544,35 +2612,40 @@ var APIManagerBase = class {
     if (existingDomainClient && existingDomainClient.hasValidSession()) {
       return existingDomainClient;
     }
-    const isOnCurrentMDS = await this.isDomainOnCurrentMDS(domainName);
-    if (isOnCurrentMDS) {
-      const domainSid2 = await this.loginToDomain(domainName);
-      const domainClient2 = this.createClientWithSid(domainSid2);
-      this.domainClients.set(domainName, domainClient2);
-      return domainClient2;
-    }
-    const targetMDSIP = await this.getMDSServerForDomain(domainName);
-    if (!targetMDSIP) {
-      throw new Error(`Domain '${domainName}' not found or has no available MDS servers. Make sure the domain exists and you have access to it.`);
-    }
     const currentHost = this.client.getHost();
     const portMatch = currentHost.match(/:(\d+)/);
     const port = portMatch ? portMatch[1] : "443";
-    const newMDSClient = this.createClientForMDS(targetMDSIP, port);
-    if ("debug" in newMDSClient) {
-      newMDSClient.debug = this._debug;
+    try {
+      const domainClient = this.createClientForMDS(this.client.managementHost, port, domainName);
+      if ("debug" in domainClient)
+        domainClient.debug = this._debug;
+      await domainClient.login();
+      this.domainClients.set(domainName, domainClient);
+      return domainClient;
+    } catch {
     }
-    await newMDSClient.login();
-    const loginResponse = await newMDSClient.callApi("post", "login-to-domain", {
-      "domain": domainName
-    }, void 0);
-    if (!loginResponse.response.sid) {
-      throw new Error(`Failed to login to domain '${domainName}' on MDS server ${targetMDSIP}`);
+    const targetMDSIP = await this.getMDSRootForDomain(domainName);
+    if (targetMDSIP) {
+      try {
+        const crossMDSClient = this.createClientForMDS(targetMDSIP, port, domainName);
+        if ("debug" in crossMDSClient)
+          crossMDSClient.debug = this._debug;
+        await crossMDSClient.login();
+        this.domainClients.set(domainName, crossMDSClient);
+        return crossMDSClient;
+      } catch {
+      }
     }
-    const domainSid = loginResponse.response.sid;
-    const domainClient = this.createClientWithSid(domainSid);
-    this.domainClients.set(domainName, domainClient);
-    return domainClient;
+    const dmsIP = await this.getMDSServerForDomain(domainName);
+    if (!dmsIP) {
+      throw new Error(`Domain '${domainName}' not found or has no available servers. Make sure the domain exists and you have access to it.`);
+    }
+    const targetClient = this.createClientForMDS(dmsIP, port);
+    if ("debug" in targetClient)
+      targetClient.debug = this._debug;
+    await targetClient.login();
+    this.domainClients.set(domainName, targetClient);
+    return targetClient;
   }
   /**
    * Get gateway information from show-gateways-and-servers
@@ -2611,20 +2684,53 @@ var APIManagerBase = class {
     }
   }
   /**
-   * Check if a domain exists on the current MDS server (either active or standby)
+   * Get MDS server list from show-mdss with caching
+   */
+  async getMDSServers() {
+    if (this.mdsServers !== null) {
+      return this.mdsServers;
+    }
+    try {
+      const response = await this.callApi("post", "show-mdss", {
+        "details-level": "full",
+        "limit": 500
+      });
+      const servers = [];
+      if (response.objects) {
+        for (const obj of response.objects) {
+          if (obj.name) {
+            servers.push({
+              name: obj.name,
+              "ipv4-address": obj["ipv4-address"],
+              "ipv6-address": obj["ipv6-address"]
+            });
+          }
+        }
+      }
+      this.mdsServers = servers;
+    } catch {
+      this.mdsServers = [];
+    }
+    return this.mdsServers;
+  }
+  /**
+   * Return the MDS root IP for the domain's active server.
+   * Maps the domain's `multi-domain-server` name (from show-domains) to an MDS
+   * root IP (from show-mdss). Returns null if the domain is not found or the MDS
+   * root IP cannot be determined.
    */
-  async isDomainOnCurrentMDS(domainName) {
+  async getMDSRootForDomain(domainName) {
     const domains = await this.getDomains();
     const domain = domains.find((d) => d.name === domainName);
-    if (!domain?.servers || domain.servers.length === 0) {
-      return false;
-    }
-    const currentHost = this.client.getHost();
-    return domain.servers.some((server2) => {
-      const ipv4 = server2["ipv4-address"];
-      const ipv6 = server2["ipv6-address"];
-      return ipv4 && currentHost.includes(ipv4) || ipv6 && currentHost.includes(ipv6);
-    });
+    if (!domain?.servers?.length)
+      return null;
+    const activeServer = domain.servers.find((s) => s.active === true) ?? domain.servers[0];
+    const targetMDSName = activeServer?.["multi-domain-server"];
+    if (!targetMDSName)
+      return null;
+    const mdsServers = await this.getMDSServers();
+    const mdsServer = mdsServers.find((m) => m.name === targetMDSName);
+    return mdsServer?.["ipv4-address"] ?? mdsServer?.["ipv6-address"] ?? null;
   }
   /**
    * Get the appropriate MDS server IP for a domain
@@ -2654,15 +2760,16 @@ var APIManagerBase = class {
     return ipv6Server?.["ipv6-address"] || null;
   }
   /**
-   * Create a new API client for a different MDS server
-   * Handles both IPv4 and IPv6 addresses
-   * Only supports OnPremAPIClient for multi-MDS scenarios
+   * Create a new API client targeting a specific host (MDS root or DMS IP).
+   * When `domain` is provided it is included in the login payload, causing the
+   * server to return a domain-scoped session (equivalent to login -d).
+   * Handles both IPv4 and IPv6 addresses.
    */
-  createClientForMDS(mdsIP, port = "443") {
+  createClientForMDS(mdsIP, port = "443", domain) {
     if (this.client instanceof OnPremAPIClient) {
       const currentClient = this.client;
       const formattedHost = mdsIP.includes(":") && !mdsIP.startsWith("[") ? `[${mdsIP}]` : mdsIP;
-      return new OnPremAPIClient(currentClient.authToken || void 0, formattedHost, port, currentClient.username, currentClient.password);
+      return new OnPremAPIClient(currentClient.authToken || void 0, formattedHost, port, currentClient.username, currentClient.password, domain);
     } else if (this.client instanceof SmartOneCloudAPIClient) {
       throw new Error("Multi-MDS routing is not supported for SmartOneCloud environments");
     } else {
@@ -2729,10 +2836,11 @@ var APIManagerForAPIKey = class extends APIManagerBase {
         managementHost: args.managementHost,
         managementPort: args.managementPort,
         s1cUrl: args.s1cUrl,
-        cloudInfraToken: args.cloudInfraToken ? "***" : void 0
+        cloudInfraToken: args.cloudInfraToken ? "***" : void 0,
+        sid: args.sid ? "***" : void 0
       });
     }
-    const hasAnyValue = args.apiKey || args.username || args.password || args.s1cUrl || args.managementHost || args.cloudInfraToken;
+    const hasAnyValue = args.apiKey || args.username || args.password || args.s1cUrl || args.managementHost || args.cloudInfraToken || args.sid;
     if (!hasAnyValue) {
       if (verbose) {
         console.error("[APIManagerForAPIKey.create] Verbose: ERROR - Args object is effectively empty, no values provided");
@@ -2745,6 +2853,12 @@ var APIManagerForAPIKey = class extends APIManagerBase {
         console.error("[APIManagerForAPIKey.create] Verbose: Using on-prem management with host:", args.managementHost);
       }
       const onPremClient = new OnPremAPIClient(args.apiKey, args.managementHost, args.managementPort || "443", args.username, args.password);
+      if (args.sid) {
+        if (verbose) {
+          console.error("[APIManagerForAPIKey.create] Verbose: Setting external SID on on-prem client (skipping login)");
+        }
+        onPremClient.setExternalSid(args.sid);
+      }
       return new this(onPremClient);
     }
     if (verbose) {
@@ -2773,13 +2887,26 @@ var APIManagerForAPIKey = class extends APIManagerBase {
       }
       keyType = TokenType.API_KEY;
       key = args.apiKey;
+    } else if (args.sid) {
+      if (verbose) {
+        console.error("[APIManagerForAPIKey.create] Verbose: Using external SID with S1C (no auth token needed)");
+      }
+      keyType = TokenType.API_KEY;
+      key = "";
     } else {
       if (verbose) {
         console.error("[APIManagerForAPIKey.create] Verbose: ERROR - No API key or cloud infra token provided");
       }
       throw new Error("API key or cloud infrastructure token is required");
     }
-    return new this(SmartOneCloudAPIClient.create(key, keyType, args.s1cUrl));
+    const s1cClient = SmartOneCloudAPIClient.create(key, keyType, args.s1cUrl, !!args.cloudConnected);
+    if (args.sid) {
+      if (verbose) {
+        console.error("[APIManagerForAPIKey.create] Verbose: Setting external SID on S1C client (skipping login)");
+      }
+      s1cClient.setExternalSid(args.sid);
+    }
+    return new this(s1cClient);
   }
 };
 
@@ -2818,7 +2945,7 @@ var Settings = class _Settings {
       return "STG";
     return void 0;
   }
-  constructor({ apiKey = process.env.API_KEY, username = process.env.USERNAME, password = process.env.PASSWORD, s1cUrl = process.env.S1C_URL, managementHost = process.env.MANAGEMENT_HOST, managementPort = process.env.MANAGEMENT_PORT || "443", cloudInfraToken = process.env.CLOUD_INFRA_TOKEN, clientId = process.env.CLIENT_ID, secretKey = process.env.SECRET_KEY, region = process.env.REGION || "EU", devPort = process.env.DEV_PORT || "8006", gatewayUrl } = {}) {
+  constructor({ apiKey = process.env.API_KEY, username = process.env.USERNAME, password = process.env.PASSWORD, s1cUrl = process.env.S1C_URL, managementHost = process.env.MANAGEMENT_HOST, managementPort = process.env.MANAGEMENT_PORT || "443", cloudInfraToken = process.env.CLOUD_INFRA_TOKEN, cloudConnected = process.env.CLOUD_CONNECTED === "true", sid, clientId = process.env.CLIENT_ID, secretKey = process.env.SECRET_KEY, region = process.env.REGION || "EU", devPort = process.env.DEV_PORT || "8006", gatewayUrl } = {}) {
     this.region = "EU";
     this.devPort = "8006";
     this.gatewayUrl = "";
@@ -2845,6 +2972,8 @@ var Settings = class _Settings {
     this.managementHost = managementHost;
     this.managementPort = managementPort;
     this.cloudInfraToken = cloudInfraToken;
+    this.cloudConnected = cloudConnected;
+    this.sid = sid;
     this.clientId = clientId;
     this.secretKey = secretKey;
     this.region = this.normalizeRegion(region) || "EU";
@@ -2868,7 +2997,7 @@ var Settings = class _Settings {
    * Check if the provided string is a valid region
    */
   isValidRegion(region) {
-    return ["EU", "US", "STG", "LOCAL"].includes(region.toUpperCase());
+    return ["EU", "US", "STG", "DEV", "LOCAL"].includes(region.toUpperCase());
   }
   /**
    * Get the base gateway URL for a given region
@@ -2880,6 +3009,7 @@ var Settings = class _Settings {
       case "US":
         return "https://cloudinfra-gw-us.portal.checkpoint.com";
       case "STG":
+      case "DEV":
       case "LOCAL":
         return "https://dev-cloudinfra-gw.kube1.iaas.checkpoint.com";
       default:
@@ -2917,6 +3047,7 @@ var Settings = class _Settings {
     const verbose = SettingsManager.globalDebugState;
     if (verbose) {
       console.error("[Settings] Verbose: Validating settings...");
+      console.error("[Settings] Verbose: sid:", this.sid ? "***" : "(empty)");
       console.error("[Settings] Verbose: s1cUrl:", this.s1cUrl || "(empty)");
       console.error("[Settings] Verbose: managementHost:", this.managementHost || "(empty)");
       console.error("[Settings] Verbose: apiKey:", this.apiKey ? "***" : "(empty)");
@@ -2924,17 +3055,35 @@ var Settings = class _Settings {
       console.error("[Settings] Verbose: username:", this.username ? "***" : "(empty)");
       console.error("[Settings] Verbose: password:", this.password ? "***" : "(empty)");
     }
-    if (!nullOrEmpty(this.s1cUrl) && nullOrEmpty(this.apiKey) && nullOrEmpty(this.cloudInfraToken)) {
+    if (!nullOrEmpty(this.sid)) {
       if (verbose) {
-        console.error("[Settings] Verbose: Validation FAILED - S1C URL provided but no API key or CI token");
+        console.error("[Settings] Verbose: Pre-authenticated SID provided, skipping credential validation");
+      }
+      return;
+    }
+    if (!nullOrEmpty(this.s1cUrl) && nullOrEmpty(this.apiKey) && nullOrEmpty(this.cloudInfraToken)) {
+      if (process.env.MCP_TRANSPORT_TYPE?.toLowerCase() === "http") {
+        if (verbose) {
+          console.error("[Settings] Verbose: S1C URL provided without credentials, but HTTP transport mode allows per-request auth via headers");
+        }
+      } else {
+        if (verbose) {
+          console.error("[Settings] Verbose: Validation FAILED - S1C URL provided but no API key or CI token");
+        }
+        throw new Error("API key or CI Token is required for S1C (via --api-key or API_KEY env var)");
       }
-      throw new Error("API key or CI Token is required for S1C (via --api-key or API_KEY env var)");
     }
     if (!nullOrEmpty(this.managementHost) && nullOrEmpty(this.apiKey) && (nullOrEmpty(this.username) || nullOrEmpty(this.password))) {
-      if (verbose) {
-        console.error("[Settings] Verbose: Validation FAILED - Management host provided but no API key or credentials");
+      if (process.env.MCP_TRANSPORT_TYPE?.toLowerCase() === "http") {
+        if (verbose) {
+          console.error("[Settings] Verbose: Management host provided without credentials, but HTTP transport mode allows per-request auth via headers");
+        }
+      } else {
+        if (verbose) {
+          console.error("[Settings] Verbose: Validation FAILED - Management host provided but no API key or credentials");
+        }
+        throw new Error("Either API key or username/password are required for on-prem management (via CLI args or env vars)");
       }
-      throw new Error("Either API key or username/password are required for on-prem management (via CLI args or env vars)");
     }
     if (nullOrEmpty(this.s1cUrl) && nullOrEmpty(this.managementHost)) {
       if (verbose) {
@@ -2976,6 +3125,7 @@ var Settings = class _Settings {
       managementHost: args.managementHost,
       managementPort: args.managementPort,
       cloudInfraToken: args.cloudInfraToken,
+      cloudConnected: args.cloudConnected,
       clientId: args.clientId,
       secretKey: args.secretKey,
       region: typeof args.region === "string" ? args.region.trim().toUpperCase() : void 0,
@@ -3001,6 +3151,8 @@ var Settings = class _Settings {
       managementHost: getHeaderValue(headers, "MANAGEMENT-HOST"),
       managementPort: getHeaderValue(headers, "MANAGEMENT-PORT"),
       cloudInfraToken: getHeaderValue(headers, "CLOUD-INFRA-TOKEN"),
+      cloudConnected: getHeaderValue(headers, "CLOUD-CONNECTED"),
+      sid: getHeaderValue(headers, "X-chkp-sid"),
       clientId: getHeaderValue(headers, "CLIENT-ID"),
       secretKey: getHeaderValue(headers, "SECRET-KEY"),
       region: getHeaderValue(headers, "REGION"),
@@ -3033,6 +3185,8 @@ var Settings = class _Settings {
       managementHost: extractedValues.managementHost,
       managementPort: extractedValues.managementPort,
       cloudInfraToken: extractedValues.cloudInfraToken,
+      cloudConnected: extractedValues.cloudConnected === "true",
+      sid: extractedValues.sid,
       clientId: extractedValues.clientId,
       secretKey: extractedValues.secretKey,
       region: extractedValues.region?.toUpperCase(),
@@ -3150,7 +3304,8 @@ async function executeApiTool(toolName, definition, validatedArgs, extra) {
     }
     const requestBody = validatedArgs?.["requestBody"] || {};
     if (validatedArgs.domains_to_process) {
-      requestBody["domains-to-process"] = typeof validatedArgs.domain === "string" && validatedArgs.domain.trim() !== "" ? validatedArgs.domain : void 0;
+      requestBody["domains-to-process"] = [validatedArgs.domains_to_process];
+      requestBody["ignore-warnings"] = true;
     }
     const resp = await runApi("POST", urlPath, requestBody, extra, domain);
     console.error(`=== DEBUG: Response received ===`);

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chkp/policy-insights-mcp",
-  "version": "0.2.0",
+  "version": "0.3.4",
   "bin": {
     "policy-insights-mcp": "dist/index.js"
   },
@@ -20,9 +20,13 @@
     "build:bundle": "node ../../bundle-mcp.js",
     "build:tsc": "npx tsc && npx shx chmod +x ./dist/index.js && npx shx cp src/server-config.json dist/",
     "dev": "tsc --watch",
-    "start": "node dist/index.js"
+    "start": "node dist/index.js",
+    "prepack": "node ../../scripts/strip-bundled-deps.js",
+    "postpack": "node ../../scripts/strip-bundled-deps.js restore"
   },
   "dependencies": {
+    "@chkp/mcp-utils": "*",
+    "@chkp/quantum-infra": "*",
     "@modelcontextprotocol/sdk": "^1.26.0",
     "axios": "^1.13.5",
     "commander": "^13.1.0",
@@ -30,8 +34,6 @@
     "zod": "^3.22.4"
   },
   "devDependencies": {
-    "@chkp/mcp-utils": "*",
-    "@chkp/quantum-infra": "*",
     "@types/node": "^22.15.2",
     "@typescript-eslint/eslint-plugin": "^8.38.0",
     "@typescript-eslint/parser": "^8.38.0",

package/dist/server-config.json

@@ -23,6 +23,13 @@
       "type": "string",
       "hidden": true
     },
+    {
+      "flag": "--cloud-connected",
+      "description": "Enable cloud-connected mode",
+      "env": "CLOUD_CONNECTED",
+      "type": "boolean",
+      "hidden": true
+    },
     {
       "flag": "--username <username>",
       "description": "Username for on-prem authentication",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chkp/policy-insights-mcp",
-  "version": "0.2.0",
+  "version": "0.3.4",
   "bin": {
     "policy-insights-mcp": "dist/index.js"
   },
@@ -20,7 +20,9 @@
     "build:bundle": "node ../../bundle-mcp.js",
     "build:tsc": "npx tsc && npx shx chmod +x ./dist/index.js && npx shx cp src/server-config.json dist/",
     "dev": "tsc --watch",
-    "start": "node dist/index.js"
+    "start": "node dist/index.js",
+    "prepack": "node ../../scripts/strip-bundled-deps.js",
+    "postpack": "node ../../scripts/strip-bundled-deps.js restore"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.26.0",
@@ -30,8 +32,6 @@
     "zod": "^3.24.4"
   },
   "devDependencies": {
-    "@chkp/mcp-utils": "*",
-    "@chkp/quantum-infra": "*",
     "@types/node": "^22.15.2",
     "@typescript-eslint/eslint-plugin": "^8.38.0",
     "@typescript-eslint/parser": "^8.38.0",

package/package.json.bak

@@ -0,0 +1,51 @@
+{
+  "name": "@chkp/policy-insights-mcp",
+  "version": "0.3.4",
+  "bin": {
+    "policy-insights-mcp": "dist/index.js"
+  },
+  "description": "Official MCP server for Check Point Policy Insights",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/CheckPointSW/mcp-servers.git",
+    "directory": "packages/policy-insights"
+  },
+  "license": "MIT",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "scripts": {
+    "clean": "rimraf dist",
+    "build": "npm run build:bundle && npx shx chmod +x ./dist/index.js && npx shx cp src/server-config.json dist/",
+    "build:bundle": "node ../../bundle-mcp.js",
+    "build:tsc": "npx tsc && npx shx chmod +x ./dist/index.js && npx shx cp src/server-config.json dist/",
+    "dev": "tsc --watch",
+    "start": "node dist/index.js",
+    "prepack": "node ../../scripts/strip-bundled-deps.js",
+    "postpack": "node ../../scripts/strip-bundled-deps.js restore"
+  },
+  "dependencies": {
+    "@chkp/mcp-utils": "*",
+    "@chkp/quantum-infra": "*",
+    "@modelcontextprotocol/sdk": "^1.26.0",
+    "commander": "^13.1.0",
+    "axios": "^1.13.5",
+    "node-machine-id": "^1.1.12",
+    "zod": "^3.24.4"
+  },
+  "devDependencies": {
+    "@types/node": "^22.15.2",
+    "@typescript-eslint/eslint-plugin": "^8.38.0",
+    "@typescript-eslint/parser": "^8.38.0",
+    "eslint": "^8.57.0",
+    "eslint-config-prettier": "^9.1.0",
+    "eslint-plugin-prettier": "^5.2.1",
+    "prettier": "^3.6.2",
+    "typescript": "^5.8.3"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "keywords": [],
+  "author": ""
+}