@cursor/july 0.1.88 → 0.1.90

package/src/bin/agent-serve.ts

@@ -61,6 +61,7 @@ import {
 import { cmdManifest } from "../internal/cli-manifest.js";
 import {
   CLI_COMMAND_NAME as CLI,
+  formatCliVersion,
   PACKAGE_NAME,
   packageVersion,
 } from "../internal/distribution.js";
@@ -135,7 +136,7 @@ Usage:
   ${CLI} logout
   ${CLI} whoami      [--json]
   ${CLI} update
-  ${CLI} version
+  ${CLI} version     [--json]
   ${CLI} deploy      [--dir <path>] [--slug <slug> | --all] [--team <id>] [--json]
                           [--no-wait] [--repo <url>] [--ref <ref>]
                           [--path <agentPath>] [--cursor-events-repo <owner/name>]...
@@ -192,7 +193,7 @@ Commands:
               (also: npx @cursor/july docs). No agent project required.
               --print skips opening a browser. Ctrl-C stops the server.
   run         One-shot create→test loop: ephemeral server + JSON trajectory.
-              Writes a single events.ndjson trace (visualize in the playground).
+              Writes a single events.ndjson trace (summarize with trajectory).
               Streams tool calls and reply text to stderr when stderr is a TTY.
               Pass --prod to hit the hosted deployment instead of a local server.
   trajectory  Summarize an events.ndjson file into a trajectory.
@@ -205,7 +206,7 @@ Commands:
               prompt. --json is machine-readable and never blocks on
               login. No directory: print the setup guide.
   convert-automation
-              Export a Cursor Automation into an agentkit project. <url> is
+              Export a Cursor Automation into an agentsdk project. <url> is
               the dashboard URL (…/automations/<uuid> or
               …/custom-agents/<uuid>) or a bare uuid. Fetches the definition
               with your Cursor credentials, writes the converted files into
@@ -258,7 +259,9 @@ Commands:
   whoami      Show which Cursor account powers this host (and why).
   update      Upgrade this install to the latest published version (detects
               global npm/pnpm/yarn/bun installs and project dependencies).
-  version     Print the installed ${CLI} version and exit (also --version / -V).
+  version     Print the ${PACKAGE_NAME} version this CLI will use and exit
+              (also --version / -V). Text is the version number; --json
+              prints { name, version, cli }.
   deploy      Deploy onto Cursor's managed agent-serve hosting, then wait for
               the engine to come up. --repo/--ref/--path stay available;
               inside an agent git checkout they are inferred when omitted
@@ -292,7 +295,7 @@ Agent loop:
   ${CLI} dev .
 
 Options:
-  --version, -V      Print the installed version and exit.
+  --version, -V      Print the version number and exit.
   --dir             Project root (defaults to the current directory).
   --port             Port to listen on (default 3000). When the default is
                      taken, serve tries the next free port and prints a notice.
@@ -400,7 +403,7 @@ Options:
   --skip-report      eval: ignore reporters from evals.config.ts / eval files.
   --no-stream        run/eval: silence live progress on stderr (JSON still prints).
   --json             JSON output (init/convert-automation/install-skills/
-                     info/chat/eval/logs/
+                     info/chat/eval/logs/version/
                      sessions/session/github; run defaults to JSON). logs:
                      NDJSON progress/log events. session: trajectory JSON
                      (not raw events).
@@ -474,7 +477,7 @@ async function main(argv: string[]): Promise<number> {
     return command === undefined ? 1 : 0;
   }
   if (command === "version" || command === "--version" || command === "-V") {
-    await writeStdout(`${CLI} ${packageVersion()}\n`);
+    await writeStdout(formatCliVersion({ json: restIn.includes("--json") }));
     return 0;
   }
 
@@ -574,9 +577,14 @@ async function main(argv: string[]): Promise<number> {
       "no-artifacts": { type: "boolean", default: false },
       "skip-report": { type: "boolean", default: false },
       "max-concurrency": { type: "string" },
+      version: { type: "boolean", short: "V", default: false },
     },
   });
   const dir = values.dir ?? ".";
+  if (values.version === true) {
+    await writeStdout(formatCliVersion({ json: values.json === true }));
+    return 0;
+  }
 
   // Best-effort, cached, and silent on failure. `update` does its own fresh
   // lookup, --json runs stay quiet for machine consumers, and `mcp` skips it
@@ -1301,8 +1309,14 @@ async function main(argv: string[]): Promise<number> {
         loadLocalEnv();
         // Model turns need a Cursor credential. Prompt login before listen
         // so the first playground turn does not fail with a late auth error.
+        // `--allow-anonymous` is the hosted trust boundary (alias token /
+        // freeze bake): skip the login gate so health can bind without a
+        // key. v1 hosted injects CURSOR_API_KEY at exec; freeze bind drops
+        // CURSOR_API_KEY / CURSOR_API_KEY_FILE onto the listening process.
+        // Self-hosted omit the flag and still fail-fast unsigned on a TTY-less host.
         const loginExit = await ensureCursorLogin({
           apiKey: values["api-key"],
+          allowAnonymous: values["allow-anonymous"] === true,
         });
         if (loginExit !== 0) {
           return { kind: "login-failed", exitCode: loginExit };

package/src/channels.ts

@@ -9,7 +9,7 @@
  * and are mounted under `/v1/channels/<name>`:
  *
  * ```ts
- * import { defineChannel, POST } from "@anysphere/agent-serve/channels";
+ * import { defineChannel, POST } from "@cursor/july/channels";
  * import { z } from "zod";
  *
  * export default defineChannel({

package/src/connections.ts

@@ -8,7 +8,7 @@
  * `hostOnly: true` to keep it off the model (still on `host.mcp`).
  *
  * ```ts
- * import { defineConnection } from "@anysphere/agent-serve/connections";
+ * import { defineConnection } from "@cursor/july/connections";
  *
  * export default defineConnection({
  *   url: "https://mcp.linear.app/mcp",

package/src/evals.ts

@@ -7,7 +7,7 @@
  * `t.messageIncludes(...)`, or `t.check(value, includes(...))`.
  *
  * ```ts
- * import { defineEval, includes } from "@anysphere/agent-serve/evals";
+ * import { defineEval, includes } from "@cursor/july/evals";
  *
  * // One datapoint — id is the file path (evals/weather/nyc.eval.ts → weather/nyc)
  * export default defineEval({

package/src/hooks.ts

@@ -6,7 +6,7 @@
  * transcripts to your own database). Handlers are observe-only.
  *
  * ```ts
- * import { defineHook } from "@anysphere/agent-serve/hooks";
+ * import { defineHook } from "@cursor/july/hooks";
  *
  * export default defineHook({
  *   events: {

package/src/index.ts

@@ -1,12 +1,12 @@
 /**
- * @anysphere/agent-serve
+ * @cursor/july
  *
  * Filesystem-first framework for Cursor agents: define an agent as markdown
  * and TypeScript files under an `agent/` directory, and serve it over
  * channels with the Cursor SDK as the execution harness.
  *
  * ```ts
- * import { serve } from "@anysphere/agent-serve";
+ * import { serve } from "@cursor/july";
  *
  * const handle = await serve(".", { port: 3000 });
  * console.log(`agent listening on ${handle.url}`);

package/src/internal/advertise-tools.ts

@@ -246,6 +246,7 @@ function toDiscoveredTool(
     ...(info.annotations === undefined
       ? {}
       : { annotations: info.annotations }),
+    advertised: true,
     definition,
   };
 }

package/src/internal/cli-ax.ts

@@ -685,7 +685,7 @@ export async function cmdRun(options: AxCliOptions): Promise<number> {
                 : playgroundUrl !== null
                   ? `Open ${playgroundUrl}`
                   : eventsPath !== undefined
-                    ? `Start the playground (${CLI_COMMAND_NAME} serve --dir ${options.dir}), then Open trace → ${eventsPath}`
+                    ? `${CLI_COMMAND_NAME} trajectory --events ${eventsPath}`
                     : null,
             trajectory: result.trajectory,
           },

package/src/internal/cli-convert-automation.ts

@@ -1,6 +1,6 @@
 /**
  * `agent-serve convert-automation <url>` — export a Cursor Automation into
- * an agentkit project.
+ * an agentsdk project.
  *
  * Fetches the automation's workflow from the backend export endpoint
  * (Bearer user API key, same credential chain as deploy), runs the pure

package/src/internal/cli-cursor.ts

@@ -148,10 +148,12 @@ export async function cmdLogin(options: CursorCliOptions): Promise<number> {
 /**
  * Gate for commands that need a Cursor credential before they can do useful
  * work (`serve`, `dev`, interactive `init`). Already-signed-in hosts
- * (`--api-key` / `CURSOR_API_KEY` / stored login) return immediately.
- * Otherwise an interactive host runs {@link cmdLogin}; a non-interactive
- * one (CI, Docker) fails fast with {@link SIGN_IN_HINT} instead of polling
- * a browser that will never open.
+ * (`--api-key` / `CURSOR_API_KEY` / `CURSOR_API_KEY_FILE` / stored login) return immediately.
+ * Hosted `--allow-anonymous` (v1 alias-token engines and v2 freeze bake)
+ * skips this gate so health/manifest can bind without a Cursor key.
+ * Self-hosted omit the flag: an interactive host runs {@link cmdLogin};
+ * a non-interactive one (CI, Docker) fails fast with {@link SIGN_IN_HINT}
+ * instead of polling a browser that will never open.
  */
 export async function ensureCursorLogin(
   options: {
@@ -161,6 +163,12 @@ export async function ensureCursorLogin(
      * TTY.
      */
     interactive?: boolean;
+    /**
+     * `serve --allow-anonymous`: listen without a Cursor credential.
+     * Model turns still fail later if a key is required; freeze only
+     * needs `/v1/health` and `/v1/manifest`.
+     */
+    allowAnonymous?: boolean;
     /** Test seam. */
     login?: (options: CursorCliOptions) => Promise<number>;
   } = {}
@@ -169,6 +177,9 @@ export async function ensureCursorLogin(
   if (resolved !== undefined) {
     return 0;
   }
+  if (options.allowAnonymous === true) {
+    return 0;
+  }
   const interactive = options.interactive ?? process.stderr.isTTY === true;
   if (!interactive) {
     process.stderr.write(`Not signed in to Cursor. ${SIGN_IN_HINT}\n`);
@@ -243,12 +254,14 @@ function formatIdentity(identity: CursorIdentity): string {
   return name === "" ? `${email}${team}` : `${name} <${email}>${team}`;
 }
 
-function describeSource(source: "option" | "env" | "login"): string {
+function describeSource(source: "option" | "env" | "file" | "login"): string {
   switch (source) {
     case "option":
       return "explicit --api-key / serve({ apiKey })";
     case "env":
       return "CURSOR_API_KEY environment variable";
+    case "file":
+      return "CURSOR_API_KEY_FILE (task bind)";
     case "login":
       return `stored login (${credentialsFilePath()})`;
   }

package/src/internal/cli-deploy.ts

@@ -5,13 +5,15 @@
  *
  * All intelligence is server-side (backend/server/src/agentServe/); these
  * handlers resolve parameters (credentials, team, slug, the project's
- * `hosting` manifest block), call the management API through
- * `deploy-client.ts`, poll status, and render.
+ * `hosting` / `architecture` manifest block), call the v1 agent-serve or
+ * v2 agentkit management API through `deploy-client.ts`, poll status, and
+ * render.
  */
 
 import { basename, resolve } from "node:path";
 import { isPublicEndpointPolicy } from "../channels.js";
 import {
+  type AgentArchitecture,
   type AgentHostingOptions,
   isCursorAccountTransport,
 } from "../types.js";
@@ -24,18 +26,21 @@ import {
 import { authorizeCursorAccountConnectors } from "./cursor-account-mcp-auth.js";
 import { readDeployTemplate } from "./cursor-agent-template.js";
 import {
+  type AgentkitDeployAccepted,
+  type AgentkitDeployStatus,
   AgentServeDeployClient,
   type DeleteAccepted,
   type DeployAccepted,
   DeployApiError,
   type Deployment,
   type DeploymentDetail,
-  type DeploymentStatus,
+  type DeploymentProgress,
   type DeploySource,
   deploymentServiceAccountId,
   type SecretInfo,
   type StopAccepted,
   slugFromDirectoryName,
+  TERMINAL_AGENTKIT_DEPLOY_STATUSES,
   TERMINAL_DEPLOY_STATUSES,
   validateDeploymentSlug,
 } from "./deploy-client.js";
@@ -648,6 +653,19 @@ async function deployOne(
     );
   }
 
+  if (manifest?.architecture === "v2") {
+    if (!ctx.json) {
+      ctx.err("  architecture: v2\n");
+    }
+    return deployOneAgentkit(ctx, extras, {
+      slug,
+      gitRepoUrl,
+      gitRef,
+      agentPath,
+      repositories: options.cursorEventsRepos,
+    });
+  }
+
   // Today's only source shape: the control plane builds from a git ref.
   // See DeploySource for the artifact seam.
   const source: DeploySource = {
@@ -702,7 +720,9 @@ async function deployOne(
 
   let detail: DeploymentDetail;
   try {
-    detail = await pollUntil(ctx, slug, TERMINAL_DEPLOY_STATUSES);
+    detail = await pollUntil(ctx, slug, TERMINAL_DEPLOY_STATUSES, () =>
+      ctx.client.getDeployment({ teamId: ctx.teamId, slug })
+    );
   } catch (error) {
     return renderApiError(error, ctx.err);
   }
@@ -756,6 +776,85 @@ async function deployOne(
   return 0;
 }
 
+/**
+ * `architecture: "v2"` deploy: POST `/internal/agentkit/deployments` and
+ * poll the matching GET. The v2 accept path starts freeze bake; it does
+ * not mint an engine alias or alias token.
+ */
+async function deployOneAgentkit(
+  ctx: DeployCliContext,
+  extras: { jsonCollect?: unknown[] } | undefined,
+  args: {
+    slug: string;
+    gitRepoUrl: string;
+    gitRef: string | undefined;
+    agentPath: string | undefined;
+    repositories: string[] | undefined;
+  }
+): Promise<number> {
+  const { slug } = args;
+  let accepted: AgentkitDeployAccepted;
+  try {
+    accepted = await ctx.client.deployAgentkit({
+      teamId: ctx.teamId,
+      slug,
+      gitRepoUrl: args.gitRepoUrl,
+      gitRef: args.gitRef,
+      agentPath: args.agentPath,
+      repositories: args.repositories,
+    });
+  } catch (error) {
+    return renderApiError(error, ctx.err);
+  }
+
+  if (ctx.noWait) {
+    if (extras?.jsonCollect !== undefined) {
+      extras.jsonCollect.push(accepted);
+    } else if (ctx.json) {
+      ctx.out(`${JSON.stringify(accepted, null, 2)}\n`);
+    } else {
+      ctx.out(
+        `Deploy accepted: ${slug} (team ${ctx.teamId}, v2)\n` +
+          `  application: ${accepted.applicationId}\n` +
+          `  release:     ${accepted.releaseId}\n`
+      );
+    }
+    return 0;
+  }
+
+  let detail: AgentkitDeployStatus;
+  try {
+    detail = await pollUntil(ctx, slug, TERMINAL_AGENTKIT_DEPLOY_STATUSES, () =>
+      ctx.client.getAgentkitDeploy({ teamId: ctx.teamId, slug })
+    );
+  } catch (error) {
+    return renderApiError(error, ctx.err);
+  }
+
+  if (extras?.jsonCollect !== undefined) {
+    extras.jsonCollect.push(detail);
+    return detail.status === "running" ? 0 : 1;
+  }
+
+  if (ctx.json) {
+    ctx.out(`${JSON.stringify(detail, null, 2)}\n`);
+    return detail.status === "running" ? 0 : 1;
+  }
+
+  if (detail.status !== "running") {
+    ctx.err(`Deployment ${slug} ended ${detail.status}\n`);
+    return 1;
+  }
+  ctx.out(
+    `Deployed ${slug} (team ${ctx.teamId})\n` +
+      `  status:       running\n` +
+      `  architecture: v2\n` +
+      `  application:  ${detail.applicationId}\n` +
+      `  release:      ${detail.releaseId}\n`
+  );
+  return 0;
+}
+
 /**
  * Post-deploy connector authorization for `cursorAccount` connections: the
  * agent's connectors execute with tokens owned by the deployment's service
@@ -845,6 +944,7 @@ async function runPostDeployConnectorAuth(
 
 interface DeployManifest {
   hosting: AgentHostingOptions | undefined;
+  architecture: AgentArchitecture | undefined;
   /** `cursorAccount` connections declared by the agent. */
   cursorAccountConnections: Array<{
     name: string;
@@ -872,6 +972,7 @@ async function readDeployManifest(dir: string): Promise<DeployManifest> {
   const project = await loadAgentProject(dir);
   return {
     hosting: project.agent.hosting,
+    architecture: project.agent.architecture,
     cursorAccountConnections: project.agent.connections.flatMap((connection) =>
       isCursorAccountTransport(connection.transport)
         ? [{ name: connection.name, servers: connection.transport.servers }]
@@ -1102,7 +1203,9 @@ export async function cmdStop(
   }
   let detail: DeploymentDetail;
   try {
-    detail = await pollUntil(ctx, slug, new Set(["stopped"]));
+    detail = await pollUntil(ctx, slug, new Set(["stopped"]), () =>
+      ctx.client.getDeployment({ teamId: ctx.teamId, slug })
+    );
   } catch (error) {
     return renderApiError(error, ctx.err);
   }
@@ -1517,17 +1620,24 @@ export function createLineReader(
  * status so create → checkout → start is visible. Throws DeployApiError
  * on request failures or timeout.
  */
-async function pollUntil(
+async function pollUntil<
+  T extends {
+    status: string;
+    progress?: DeploymentProgress;
+    statusMessage?: string | null;
+  },
+>(
   ctx: DeployCliContext,
   slug: string,
-  terminal: ReadonlySet<DeploymentStatus>
-): Promise<DeploymentDetail> {
+  terminal: ReadonlySet<T["status"]>,
+  fetchDetail: () => Promise<T>
+): Promise<T> {
   const startedAt = Date.now();
   const tty = process.stderr.isTTY === true;
   let lastLabel: string | undefined;
   let sawProgress = false;
 
-  const report = (detail: DeploymentDetail): void => {
+  const report = (detail: T): void => {
     if (ctx.json) {
       return;
     }
@@ -1548,12 +1658,10 @@ async function pollUntil(
   };
 
   for (;;) {
-    const detail = await ctx.client
-      .getDeployment({ teamId: ctx.teamId, slug })
-      .catch((error: unknown) => {
-        finishProgressLine();
-        throw error;
-      });
+    const detail = await fetchDetail().catch((error: unknown) => {
+      finishProgressLine();
+      throw error;
+    });
     report(detail);
     if (terminal.has(detail.status)) {
       finishProgressLine();

package/src/internal/convert-automation/convert-workflow.ts

@@ -1,5 +1,5 @@
 /**
- * Pure Workflow → agentkit project converter.
+ * Pure Workflow → agentsdk project converter.
  *
  * Maps an exported Cursor automation (proto3 workflow JSON + enriched MCP
  * server list) to project files, warnings, and setup steps. No I/O, no
@@ -185,7 +185,7 @@ function renderInstructions(
 }
 
 /**
- * Strip Cursor-backend prompt markup that means nothing in agentkit:
+ * Strip Cursor-backend prompt markup that means nothing in agentsdk:
  * `@[label](action:...)` action tokens become their label text, and
  * unresolvable `%%INLINECODE<n>%%` storage placeholders are flagged (their
  * content is not in the export).
@@ -972,7 +972,7 @@ function emitSlackChannel(
         ? "channel-created"
         : "reaction-added";
     out.warnings.push(
-      `Slack ${kind} trigger has no agentkit equivalent — its config is inlined as a comment in ${path}; handle the Slack event yourself on a dedicated Socket Mode app.`
+      `Slack ${kind} trigger has no agentsdk equivalent — its config is inlined as a comment in ${path}; handle the Slack event yourself on a dedicated Socket Mode app.`
     );
   }
   let reactionDropped = false;
@@ -995,7 +995,7 @@ function emitSlackChannel(
   }
   if (reactionDropped) {
     out.warnings.push(
-      "The Slack trigger marked triggering messages with a completion reaction; agentkit has no completion-reaction option, so that signal is lost unless agent/instructions.md tells the agent to add the reaction itself via Slack tools."
+      "The Slack trigger marked triggering messages with a completion reaction; agentsdk has no completion-reaction option, so that signal is lost unless agent/instructions.md tells the agent to add the reaction itself via Slack tools."
     );
   }
   if (socketMode) {
@@ -1042,8 +1042,8 @@ function emitSlackChannel(
     if (blocksUnauthenticated) {
       out.warnings.push(
         includeBotPosts
-          ? "Some Slack watches only fired for authenticated Cursor users while others allowed anyone; agentkit has one bot-post setting per channel, so the export keeps bot posts ENABLED (the open watches depend on them) and the authenticated-only watches lose both their sender gate and their bot exclusion. Split the channels or add an onChannelPost gate."
-          : "The Slack trigger only fired for authenticated Cursor users (linked accounts on the owning team); agentkit has no equivalent sender gate, so the exported watch dispatches for ANY channel member (bot posts stay excluded). Add an onChannelPost gate in the channel if that matters."
+          ? "Some Slack watches only fired for authenticated Cursor users while others allowed anyone; agentsdk has one bot-post setting per channel, so the export keeps bot posts ENABLED (the open watches depend on them) and the authenticated-only watches lose both their sender gate and their bot exclusion. Split the channels or add an onChannelPost gate."
+          : "The Slack trigger only fired for authenticated Cursor users (linked accounts on the owning team); agentsdk has no equivalent sender gate, so the exported watch dispatches for ANY channel member (bot posts stay excluded). Add an onChannelPost gate in the channel if that matters."
       );
     }
     const engagement: string[] = [];
@@ -1309,9 +1309,9 @@ const ACTION_STEPS: Partial<Record<keyof ActionJson, string>> = {
   resolveReviewThreads:
     "Verify: resolve_review_threads — no built-in equivalent; resolve threads via the GitHub GraphQL API in a hook or tool.",
   microsoftTeams:
-    "Verify: microsoft_teams post — agentkit has no Teams channel; wire the Microsoft Teams API yourself.",
+    "Verify: microsoft_teams post — agentsdk has no Teams channel; wire the Microsoft Teams API yourself.",
   readMicrosoftTeams:
-    "Verify: read_microsoft_teams — agentkit has no Teams tools; wire the Microsoft Teams API yourself.",
+    "Verify: read_microsoft_teams — agentsdk has no Teams tools; wire the Microsoft Teams API yourself.",
 };
 
 interface SlackIntegrationState {
@@ -1375,7 +1375,7 @@ function behaviorSteps(
   const disabled = workflow.disabledDefaultTools ?? [];
   if (disabled.length > 0) {
     steps.push(
-      `Verify: disabled_default_tools (${disabled.join(", ")}) — agentkit has no default automation tools; enforce the equivalent restriction in agent/instructions.md.`
+      `Verify: disabled_default_tools (${disabled.join(", ")}) — agentsdk has no default automation tools; enforce the equivalent restriction in agent/instructions.md.`
     );
   }
   return steps;

package/src/internal/convert-automation/types.ts

@@ -1,5 +1,5 @@
 /**
- * Types for `convertWorkflow` — the pure automation → agentkit project
+ * Types for `convertWorkflow` — the pure automation → agentsdk project
  * converter behind `agent-serve convert-automation`.
  *
  * The workflow arrives as generic proto3 JSON (lowerCamelCase field names,

package/src/internal/cursor/account-mcp.ts

@@ -21,7 +21,11 @@ import {
   ListToolsRequestSchema,
 } from "@modelcontextprotocol/sdk/types.js";
 import { bearerAuth } from "../../channels.js";
-import type { AgentProject, AuthPolicy } from "../../types.js";
+import type {
+  AgentProject,
+  AuthPolicy,
+  McpToolAnnotations,
+} from "../../types.js";
 import { isCursorAccountTransport } from "../../types.js";
 import { probeConnectorAuthUrls } from "../cursor-account-mcp-auth.js";
 import { LOG_PREFIX } from "../distribution.js";
@@ -151,6 +155,8 @@ interface CatalogTool {
   inputSchema: Record<string, unknown>;
   /** Present only when the connector's server declares one. */
   outputSchema?: Record<string, unknown>;
+  /** MCP spec annotations, present only when the server declared them. */
+  annotations?: McpToolAnnotations;
 }
 
 interface Catalog {
@@ -335,6 +341,11 @@ export class CursorAccountMcpBridge {
           ...(tool.outputSchema === undefined
             ? {}
             : { outputSchema: tool.outputSchema }),
+          // Already bounded to the MCP-spec fields at the backend-client
+          // parse; absent stays absent so classifiers fail closed.
+          ...(tool.annotations === undefined
+            ? {}
+            : { annotations: tool.annotations }),
         })),
       };
     });
@@ -510,6 +521,9 @@ function buildCatalog(servers: AccountMcpServer[]): Catalog {
         ...(tool.outputSchema === undefined
           ? {}
           : { outputSchema: tool.outputSchema }),
+        ...(tool.annotations === undefined
+          ? {}
+          : { annotations: tool.annotations }),
       };
       tools.push(entry);
       byExposedName.set(entry.exposedName, entry);