@denisixnpm/planka-mcp 2.2.0

package/dist/server.js

@@ -0,0 +1,567 @@
+#!/usr/bin/env node
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
+import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
+import { createServer } from "node:http";
+import { createHash, timingSafeEqual } from "node:crypto";
+// Import tool definitions
+import { getEnabledTools, toolCounts } from "./tools/index.js";
+import { condenseResult } from "./condense.js";
+// ----- Configuration -----
+const PLANKA_BASE_URL = process.env.PLANKA_BASE_URL || "http://localhost:3000";
+const PLANKA_USERNAME = process.env.PLANKA_USERNAME;
+const PLANKA_PASSWORD = process.env.PLANKA_PASSWORD;
+const PLANKA_API_KEY = process.env.PLANKA_API_KEY?.trim();
+const MCP_PORT = parseInt(process.env.MCP_PORT || "3001", 10);
+const MCP_TRANSPORT = process.env.MCP_TRANSPORT || "stdio"; // "stdio" or "sse"
+const MCP_HOST = process.env.MCP_HOST || "127.0.0.1";
+const MCP_AUTH_TOKEN = process.env.MCP_AUTH_TOKEN?.trim();
+const MCP_CORS_ORIGIN = process.env.MCP_CORS_ORIGIN?.trim();
+const MAX_HTTP_RETRIES = parseInt(process.env.PLANKA_HTTP_MAX_RETRIES || "2", 10);
+const RETRY_BASE_DELAY_MS = parseInt(process.env.PLANKA_HTTP_RETRY_BASE_DELAY_MS || "250", 10);
+const PLANKA_HTTP_TIMEOUT_MS = parseInt(process.env.PLANKA_HTTP_TIMEOUT_MS || "30000", 10);
+/** Condensed tool output for AI agents; set to "false" for raw Planka payloads. */
+const PLANKA_CONDENSED_OUTPUT = process.env.PLANKA_CONDENSED_OUTPUT !== "false";
+// Tool category configuration
+const ENABLE_ALL_TOOLS = process.env.ENABLE_ALL_TOOLS === "true";
+const ENABLE_ADMIN_TOOLS = process.env.ENABLE_ADMIN_TOOLS === "true";
+const ENABLE_OPTIONAL_TOOLS = process.env.ENABLE_OPTIONAL_TOOLS === "true";
+// ----- Token management -----
+let cachedToken = null;
+let tokenExpiry = 0;
+let inflightLogin = null;
+async function getAccessToken() {
+    // Return cached token if still valid (with 5 min buffer)
+    if (cachedToken && Date.now() < tokenExpiry - 5 * 60 * 1000) {
+        return cachedToken;
+    }
+    // Single-flight: concurrent callers with an expired token share one login request
+    inflightLogin ??= login().finally(() => {
+        inflightLogin = null;
+    });
+    return inflightLogin;
+}
+async function login() {
+    if (!PLANKA_USERNAME || !PLANKA_PASSWORD) {
+        throw new Error("Authentication is not configured. Set PLANKA_API_KEY or PLANKA_USERNAME and PLANKA_PASSWORD.");
+    }
+    const loginUrl = `${PLANKA_BASE_URL}/api/access-tokens`;
+    const res = await fetch(loginUrl, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+            "Accept": "application/json",
+        },
+        body: JSON.stringify({
+            emailOrUsername: PLANKA_USERNAME,
+            password: PLANKA_PASSWORD,
+        }),
+        signal: AbortSignal.timeout(PLANKA_HTTP_TIMEOUT_MS),
+    });
+    const text = await res.text();
+    if (!res.ok) {
+        throw new Error(`Authentication failed: ${res.status} - ${text}`);
+    }
+    const data = JSON.parse(text);
+    if (typeof data.item !== "string" || data.item.length === 0) {
+        throw new Error(`Authentication failed: unexpected login response - ${truncate(text, 200)}`);
+    }
+    const token = data.item;
+    cachedToken = token;
+    // Set expiry to 24 hours from now (Planka tokens typically last longer, but this is safe)
+    tokenExpiry = Date.now() + 24 * 60 * 60 * 1000;
+    return token;
+}
+// ----- Helper functions -----
+function truncate(s, n) {
+    return s.length > n ? s.slice(0, n) + "…" : s;
+}
+function sleep(ms) {
+    const { promise, resolve } = Promise.withResolvers();
+    setTimeout(resolve, ms);
+    return promise;
+}
+function shouldRetryStatus(statusCode) {
+    return statusCode === 408 || statusCode === 429 || statusCode >= 500;
+}
+function formatAttempt(attempt) {
+    return `${attempt + 1}/${MAX_HTTP_RETRIES + 1}`;
+}
+/** Exponential backoff delay for retry attempt N (0-based). */
+function retryDelayMs(attempt) {
+    return RETRY_BASE_DELAY_MS * Math.pow(2, attempt);
+}
+/** Send a JSON HTTP response (single writer for every SSE endpoint). */
+function sendJson(res, status, payload) {
+    res.writeHead(status, { "Content-Type": "application/json" });
+    res.end(JSON.stringify(payload));
+}
+function buildTools() {
+    const enabledTools = getEnabledTools({
+        enableAllTools: ENABLE_ALL_TOOLS,
+        enableAdminTools: ENABLE_ADMIN_TOOLS,
+        enableOptionalTools: ENABLE_OPTIONAL_TOOLS,
+    });
+    return enabledTools.map((def) => ({
+        tool: {
+            name: def.name,
+            description: def.description,
+            inputSchema: def.inputSchema,
+        },
+        groupedDef: def,
+    }));
+}
+// ----- Execute API call for grouped tools -----
+/**
+ * Planka <= 1.26.x routes that v2 renamed, verified against a live 1.26.2
+ * instance. When the v2 route answers 404, the call is retried once with the
+ * legacy route so a single server build serves both API generations.
+ */
+const LEGACY_PATH_FALLBACKS = {
+    "/boards/{boardId}/board-memberships": "/boards/{boardId}/memberships",
+    "/projects/{projectId}/project-managers": "/projects/{projectId}/managers",
+    "/cards/{cardId}/card-labels": "/cards/{cardId}/labels",
+    "/cards/{cardId}/card-labels/labelId:{labelId}": "/cards/{cardId}/labels/{labelId}",
+    "/cards/{cardId}/card-memberships": "/cards/{cardId}/memberships",
+    "/cards/{cardId}/card-memberships/userId:{userId}": "/cards/{cardId}/memberships?userId={userId}",
+    "/cards/{cardId}/custom-field-values/customFieldGroupId:{customFieldGroupId}:customFieldId:{customFieldId}": "/cards/{cardId}/custom-field-values/customFieldGroupId:{customFieldGroupId}:customFieldId:${customFieldId}",
+};
+async function executeGroupedApiCall(groupedDef, input, overridePath, retryAttempt = 0, unauthorizedRetried = false, allowLegacyPathFallback = true, scope) {
+    try {
+        const action = input?.action;
+        if (!action) {
+            return { success: false, error: "Missing required 'action' parameter" };
+        }
+        const operation = groupedDef.operations[action];
+        if (!operation) {
+            const validActions = Object.keys(groupedDef.operations).join(", ");
+            return { success: false, error: `Invalid action '${action}'. Valid actions: ${validActions}` };
+        }
+        // Construct URL with path parameters
+        const canonicalPath = overridePath ?? operation.path;
+        let actualPath = canonicalPath;
+        // Replace path parameters: an explicit value in `data` always wins over
+        // the generic `id` fallback (e.g. data.customFieldId must not become the
+        // card id when both are present in a composite path).
+        const pathParams = actualPath.match(/\{(\w+)\}/g) || [];
+        for (const param of pathParams) {
+            const paramName = param.slice(1, -1); // Remove { and }
+            const explicit = input.data?.[paramName];
+            let value;
+            if (explicit !== undefined && explicit !== null && explicit !== "") {
+                value = explicit;
+            }
+            else if (input.id && ["id", "projectId", "boardId", "listId", "cardId", "userId", "taskListId", "baseCustomFieldGroupId", "customFieldGroupId", "customFieldId"].includes(paramName)) {
+                value = input.id;
+            }
+            else if (scope) {
+                // Working scope selected via the `context` tool: the scoped id
+                // fills parameters the call did not provide.
+                value = scope[paramName];
+            }
+            if (value) {
+                actualPath = actualPath.replace(param, encodeURIComponent(String(value)));
+            }
+        }
+        // Check if there are still unresolved parameters
+        const unresolvedParams = actualPath.match(/\{(\w+)\}/g);
+        if (unresolvedParams) {
+            return {
+                success: false,
+                error: `Missing required path parameters: ${unresolvedParams.join(", ")}. Provide them via 'id', 'data', or the 'context' tool.`
+            };
+        }
+        const url = new URL(`${PLANKA_BASE_URL}/api${actualPath}`);
+        // Add query parameters
+        if (input?.query) {
+            for (const [k, v] of Object.entries(input.query)) {
+                if (Array.isArray(v)) {
+                    v.forEach(val => url.searchParams.append(k, String(val)));
+                }
+                else if (v !== undefined && v !== null) {
+                    url.searchParams.set(k, String(v));
+                }
+            }
+        }
+        const methodUpper = operation.method;
+        const headers = {
+            "Accept": "application/json",
+        };
+        // Add authentication header if required (default to true)
+        const requiresAuth = operation.requiresAuth !== false;
+        if (requiresAuth) {
+            if (PLANKA_API_KEY) {
+                headers["X-Api-Key"] = PLANKA_API_KEY;
+            }
+            else {
+                const token = await getAccessToken();
+                headers["Authorization"] = `Bearer ${token}`;
+            }
+        }
+        // Handle request body
+        let body = undefined;
+        if (["POST", "PUT", "PATCH"].includes(methodUpper) && input?.data !== undefined) {
+            headers["Content-Type"] = "application/json";
+            body = JSON.stringify(input.data);
+        }
+        let res;
+        try {
+            res = await fetch(url, { method: methodUpper, headers, body, signal: AbortSignal.timeout(PLANKA_HTTP_TIMEOUT_MS) });
+        }
+        catch (requestError) {
+            if (retryAttempt < MAX_HTTP_RETRIES) {
+                const delayMs = retryDelayMs(retryAttempt);
+                console.error(`[retry] network error for ${groupedDef.name}.${action} (${methodUpper} ${actualPath}), attempt ${formatAttempt(retryAttempt)} failed, retrying in ${delayMs}ms: ${requestError instanceof Error ? requestError.message : String(requestError)}`);
+                await sleep(delayMs);
+                return executeGroupedApiCall(groupedDef, input, overridePath, retryAttempt + 1, unauthorizedRetried, allowLegacyPathFallback, scope);
+            }
+            throw requestError;
+        }
+        const contentType = res.headers.get("content-type") ?? "";
+        const text = await res.text();
+        let data = text;
+        if (contentType.includes("application/json") && text) {
+            try {
+                data = JSON.parse(text);
+            }
+            catch {
+                // Keep as text if JSON parsing fails
+            }
+        }
+        if (res.ok) {
+            return { success: true, data };
+        }
+        else {
+            // If we get 401 with bearer auth, clear the cached token and retry once.
+            // API key auth cannot be refreshed in-process.
+            if (res.status === 401 && requiresAuth && !PLANKA_API_KEY && cachedToken && !unauthorizedRetried) {
+                cachedToken = null;
+                tokenExpiry = 0;
+                console.error(`[auth] received 401 for ${groupedDef.name}.${action} (${methodUpper} ${actualPath}); clearing cached token and retrying once`);
+                return executeGroupedApiCall(groupedDef, input, overridePath, retryAttempt, true, allowLegacyPathFallback, scope);
+            }
+            // Legacy-version fallback: when a v2 route 404s, retry once with the
+            // older Planka (<= 1.26.x) route it replaced. All variants below are
+            // verified against a live Planka 1.26.2 instance.
+            if (res.status === 404 && allowLegacyPathFallback) {
+                const legacyPath = LEGACY_PATH_FALLBACKS[canonicalPath];
+                if (legacyPath && legacyPath !== canonicalPath) {
+                    console.error(`[compat] 404 for ${groupedDef.name}.${action} (${methodUpper} ${actualPath}); retrying with legacy route ${legacyPath}`);
+                    return executeGroupedApiCall(groupedDef, input, legacyPath, retryAttempt, unauthorizedRetried, false, scope);
+                }
+            }
+            if (shouldRetryStatus(res.status) && retryAttempt < MAX_HTTP_RETRIES) {
+                const delayMs = retryDelayMs(retryAttempt);
+                console.error(`[retry] transient HTTP ${res.status} for ${groupedDef.name}.${action} (${methodUpper} ${actualPath}), attempt ${formatAttempt(retryAttempt)} failed, retrying in ${delayMs}ms`);
+                await sleep(delayMs);
+                return executeGroupedApiCall(groupedDef, input, overridePath, retryAttempt + 1, unauthorizedRetried, allowLegacyPathFallback, scope);
+            }
+            console.error(`[error] API call failed for ${groupedDef.name}.${action} (${methodUpper} ${actualPath}) with HTTP ${res.status}`);
+            return {
+                success: false,
+                error: `HTTP ${res.status}: ${truncate(typeof data === 'string' ? data : JSON.stringify(data), 2000)}`,
+            };
+        }
+    }
+    catch (error) {
+        console.error(`[error] API call crashed for ${groupedDef.name}.${input?.action ?? "unknown"}: ${error instanceof Error ? error.message : String(error)}`);
+        return {
+            success: false,
+            error: error instanceof Error ? error.message : String(error),
+        };
+    }
+}
+/**
+ * Local handler for the `context` tool: maintains the working scope of this
+ * server instance (per SSE session, process-wide for stdio). Enriches `set`
+ * with the immediate contents of the selected level so the agent can pick
+ * the next id without an extra round trip.
+ */
+async function handleContextCall(input, scope) {
+    const action = input?.action;
+    if (action === "get") {
+        return { success: true, data: { scope } };
+    }
+    if (action === "clear") {
+        for (const key of Object.keys(scope))
+            delete scope[key];
+        return { success: true, data: { scope } };
+    }
+    if (action !== "set") {
+        return { success: false, error: "Invalid action. Valid actions: set, get, clear" };
+    }
+    const data = input?.data ?? {};
+    const setting = (key) => typeof data[key] === "string" && data[key] !== "";
+    // Narrowing: a higher level resets the deeper ones.
+    if (setting("projectId")) {
+        delete scope.boardId;
+        delete scope.listId;
+        delete scope.cardId;
+    }
+    if (setting("boardId")) {
+        delete scope.listId;
+        delete scope.cardId;
+    }
+    if (setting("listId")) {
+        delete scope.cardId;
+    }
+    for (const key of ["projectId", "boardId", "listId", "cardId"]) {
+        if (setting(key))
+            scope[key] = data[key];
+    }
+    // One free round trip: opening a level shows its contents (boards of the
+    // project via included.boards; lists/cards of the board via included).
+    const overview = {};
+    if (scope.boardId) {
+        const boardsTool = toolMap.get("boards");
+        const res = boardsTool ? await executeGroupedApiCall(boardsTool.groupedDef, { action: "get", id: scope.boardId }) : null;
+        if (res?.success)
+            overview.board = condenseResult("boards", res.data);
+    }
+    else if (scope.projectId) {
+        const projectsTool = toolMap.get("projects");
+        const res = projectsTool ? await executeGroupedApiCall(projectsTool.groupedDef, { action: "get", id: scope.projectId }) : null;
+        if (res?.success)
+            overview.project = condenseResult("projects", res.data);
+    }
+    return { success: true, data: { scope, overview } };
+}
+// ----- Initialize MCP Server -----
+const toolDefinitions = buildTools();
+const toolMap = new Map(toolDefinitions.map(t => [t.tool.name, t]));
+// Log tool configuration (suppressed in --healthcheck mode to keep probe output clean)
+if (!process.argv.includes("--healthcheck")) {
+    console.error(`Tool configuration (grouped):`);
+    console.error(`  - Core: ${toolCounts.core} tools (${toolCounts.coreOperations} operations)`);
+    console.error(`  - Admin: ${toolCounts.admin} tools (${toolCounts.adminOperations} operations) - ${ENABLE_ADMIN_TOOLS ? "enabled" : "disabled"}`);
+    console.error(`  - Optional: ${toolCounts.optional} tools (${toolCounts.optionalOperations} operations) - ${ENABLE_OPTIONAL_TOOLS ? "enabled" : "disabled"}`);
+    console.error(`  - Total available: ${toolCounts.total} tools (${toolCounts.totalOperations} operations)`);
+    console.error(`  - Currently enabled: ${toolDefinitions.length} tools`);
+}
+function createMcpServer() {
+    const server = new McpServer({
+        name: "planka-mcp",
+        version: "2.2.0",
+    }, {
+        capabilities: {
+            tools: {},
+        },
+    });
+    // Working scope of this server instance: one per SSE session, process-wide for stdio.
+    const scope = {};
+    // Handle list tools request
+    server.server.setRequestHandler(ListToolsRequestSchema, async () => {
+        return {
+            tools: toolDefinitions.map(t => t.tool),
+        };
+    });
+    // Handle tool execution
+    server.server.setRequestHandler(CallToolRequestSchema, async (request) => {
+        const { name, arguments: args } = request.params;
+        const toolDef = toolMap.get(name);
+        if (!toolDef) {
+            return {
+                content: [{ type: "text", text: `Unknown tool: ${name}` }],
+                isError: true,
+            };
+        }
+        const result = toolDef.groupedDef.name === "context"
+            ? await handleContextCall(args, scope)
+            : await executeGroupedApiCall(toolDef.groupedDef, args, undefined, 0, false, true, scope);
+        if (result.success) {
+            const wantsRaw = !PLANKA_CONDENSED_OUTPUT || args?.raw === true;
+            const payload = wantsRaw ? result.data : condenseResult(toolDef.groupedDef.name, result.data);
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: typeof payload === "string" ? payload : JSON.stringify(payload, null, 2),
+                    },
+                ],
+            };
+        }
+        else {
+            return {
+                content: [{ type: "text", text: result.error || "Unknown error" }],
+                isError: true,
+            };
+        }
+    });
+    return server;
+}
+// ----- SSE security -----
+const LOOPBACK_HOSTS = { "127.0.0.1": true, localhost: true, "::1": true };
+/**
+ * Bearer-token check for SSE endpoints. Always enabled when MCP_AUTH_TOKEN is
+ * set; compares SHA-256 digests so timingSafeEqual never sees unequal lengths.
+ */
+function isAuthorized(req) {
+    if (!MCP_AUTH_TOKEN) {
+        return true;
+    }
+    const header = req.headers.authorization || "";
+    const provided = createHash("sha256").update(header).digest();
+    const expected = createHash("sha256").update(`Bearer ${MCP_AUTH_TOKEN}`).digest();
+    return timingSafeEqual(provided, expected);
+}
+// ----- Start the server -----
+async function main() {
+    if (MCP_TRANSPORT === "sse") {
+        // SSE transport - supports multiple clients over HTTP
+        const activeTransports = new Map();
+        const heartbeatIntervals = new Map();
+        // Heartbeat interval in milliseconds (30 seconds to prevent proxy/load
+        // balancer timeouts); configurable for deployments behind aggressive proxies.
+        const HEARTBEAT_INTERVAL = parseInt(process.env.MCP_HEARTBEAT_INTERVAL_MS || "30000", 10);
+        const httpServer = createServer(async (req, res) => {
+            // CORS: only enabled when MCP_CORS_ORIGIN is explicitly set — no wildcard by default
+            if (MCP_CORS_ORIGIN) {
+                res.setHeader("Access-Control-Allow-Origin", MCP_CORS_ORIGIN);
+                res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
+                res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
+                if (req.method === "OPTIONS") {
+                    res.writeHead(204);
+                    res.end();
+                    return;
+                }
+            }
+            const url = new URL(req.url || "/", `http://${req.headers.host}`);
+            if (url.pathname === "/sse" && req.method === "GET") {
+                if (!isAuthorized(req)) {
+                    sendJson(res, 401, { error: "Unauthorized" });
+                    return;
+                }
+                // New SSE connection - create a new server instance for this client
+                const mcpServer = createMcpServer();
+                const transport = new SSEServerTransport("/messages", res);
+                const sessionId = transport.sessionId;
+                activeTransports.set(sessionId, transport);
+                console.error(`Client connected: ${sessionId} (${activeTransports.size} active clients)`);
+                // Set up heartbeat to keep connection alive
+                const heartbeat = setInterval(() => {
+                    try {
+                        // Send SSE comment as heartbeat (doesn't affect protocol)
+                        if (!res.writableEnded) {
+                            res.write(": heartbeat\n\n");
+                        }
+                    }
+                    catch (err) {
+                        console.error(`Heartbeat failed for ${sessionId}:`, err);
+                        clearInterval(heartbeat);
+                        heartbeatIntervals.delete(sessionId);
+                    }
+                }, HEARTBEAT_INTERVAL);
+                heartbeatIntervals.set(sessionId, heartbeat);
+                // Handle connection close
+                const cleanup = () => {
+                    const hb = heartbeatIntervals.get(sessionId);
+                    if (hb) {
+                        clearInterval(hb);
+                        heartbeatIntervals.delete(sessionId);
+                    }
+                    activeTransports.delete(sessionId);
+                    console.error(`Client disconnected: ${sessionId} (${activeTransports.size} active clients)`);
+                };
+                transport.onclose = cleanup;
+                // Also handle HTTP connection close events
+                res.on("close", cleanup);
+                res.on("error", (err) => {
+                    console.error(`SSE stream error for ${sessionId}:`, err);
+                    cleanup();
+                });
+                try {
+                    await mcpServer.server.connect(transport);
+                }
+                catch (err) {
+                    console.error(`Failed to connect transport for ${sessionId}:`, err);
+                    cleanup();
+                }
+            }
+            else if (url.pathname === "/messages" && req.method === "POST") {
+                if (!isAuthorized(req)) {
+                    sendJson(res, 401, { error: "Unauthorized" });
+                    return;
+                }
+                // Handle messages for existing SSE connection
+                const sessionId = url.searchParams.get("sessionId");
+                if (!sessionId) {
+                    sendJson(res, 400, { error: "Missing sessionId parameter" });
+                    return;
+                }
+                const transport = activeTransports.get(sessionId);
+                if (!transport) {
+                    sendJson(res, 404, { error: "Session not found" });
+                    return;
+                }
+                try {
+                    await transport.handlePostMessage(req, res);
+                }
+                catch (err) {
+                    console.error(`Error handling message for ${sessionId}:`, err);
+                    sendJson(res, 500, { error: "Internal server error" });
+                }
+            }
+            else if (url.pathname === "/health") {
+                // Health check endpoint
+                sendJson(res, 200, {
+                    status: "ok",
+                    activeClients: activeTransports.size,
+                    toolsAvailable: toolDefinitions.length,
+                    toolCounts: {
+                        core: { tools: toolCounts.core, operations: toolCounts.coreOperations },
+                        admin: ENABLE_ADMIN_TOOLS ? { tools: toolCounts.admin, operations: toolCounts.adminOperations } : { tools: 0, operations: 0 },
+                        optional: ENABLE_OPTIONAL_TOOLS ? { tools: toolCounts.optional, operations: toolCounts.optionalOperations } : { tools: 0, operations: 0 },
+                    },
+                });
+            }
+            else {
+                sendJson(res, 404, { error: "Not found" });
+            }
+        });
+        // Set keep-alive timeout to prevent premature connection closure
+        httpServer.keepAliveTimeout = 120000; // 2 minutes
+        httpServer.headersTimeout = 125000; // Slightly higher than keepAliveTimeout
+        if (!LOOPBACK_HOSTS[MCP_HOST] && !MCP_AUTH_TOKEN) {
+            console.error(`[security] SSE server bound to ${MCP_HOST} without MCP_AUTH_TOKEN - anyone who can reach this port has full tool access`);
+        }
+        httpServer.listen(MCP_PORT, MCP_HOST, () => {
+            console.error(`Planka MCP server (SSE) listening on http://${MCP_HOST}:${MCP_PORT}`);
+            console.error(`  - SSE endpoint: http://${MCP_HOST}:${MCP_PORT}/sse`);
+            console.error(`  - Messages endpoint: http://${MCP_HOST}:${MCP_PORT}/messages`);
+            console.error(`  - Health check: http://${MCP_HOST}:${MCP_PORT}/health`);
+            console.error(`  - ${toolDefinitions.length} tools available`);
+            console.error(`  - Heartbeat interval: ${HEARTBEAT_INTERVAL / 1000}s`);
+            if (MCP_AUTH_TOKEN) {
+                console.error("  - Auth: bearer token required (MCP_AUTH_TOKEN)");
+            }
+        });
+    }
+    else {
+        // Stdio transport - single client mode
+        const mcpServer = createMcpServer();
+        const transport = new StdioServerTransport();
+        await mcpServer.server.connect(transport);
+        console.error(`Planka MCP server started (stdio mode, ${toolDefinitions.length} tools available)`);
+    }
+}
+/**
+ * Standalone health probe for container healthchecks: exits 0 when the SSE
+ * server answers /health, 1 otherwise. Usable from scratch/distroless images
+ * that have no shell or wget.
+ */
+async function runHealthcheck() {
+    const host = LOOPBACK_HOSTS[MCP_HOST] ? MCP_HOST : "127.0.0.1";
+    try {
+        const res = await fetch(`http://${host}:${MCP_PORT}/health`, { signal: AbortSignal.timeout(3000) });
+        process.exit(res.ok ? 0 : 1);
+    }
+    catch {
+        process.exit(1);
+    }
+}
+const entry = process.argv.includes("--healthcheck") ? runHealthcheck() : main();
+entry.catch((error) => {
+    console.error("Fatal error:", error);
+    process.exit(1);
+});

package/dist/tools/admin/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Admin tools - Require admin privileges
+ */
+import { GroupedToolDefinition } from "../types.js";
+import { configTool, usersTool, webhooksTool, projectManagersTool } from "./tools.js";
+export { configTool, usersTool, webhooksTool, projectManagersTool, };
+/**
+ * All admin tools combined
+ */
+export declare const adminTools: GroupedToolDefinition[];

package/dist/tools/admin/index.js

@@ -0,0 +1,11 @@
+import { configTool, usersTool, webhooksTool, projectManagersTool, } from "./tools.js";
+export { configTool, usersTool, webhooksTool, projectManagersTool, };
+/**
+ * All admin tools combined
+ */
+export const adminTools = [
+    configTool,
+    usersTool,
+    webhooksTool,
+    projectManagersTool,
+];

package/dist/tools/admin/tools.d.ts

@@ -0,0 +1,17 @@
+import { GroupedToolDefinition } from "../types.js";
+/**
+ * Config tool - manages application configuration (admin only)
+ */
+export declare const configTool: GroupedToolDefinition;
+/**
+ * Users tool - manages user accounts (admin only)
+ */
+export declare const usersTool: GroupedToolDefinition;
+/**
+ * Webhooks tool - manages webhooks (admin only)
+ */
+export declare const webhooksTool: GroupedToolDefinition;
+/**
+ * Project Managers tool - manages project manager assignments
+ */
+export declare const projectManagersTool: GroupedToolDefinition;