@ferrlabs/mcp 6.4.1 → 6.5.4

package/dist/index.js

@@ -1,19 +1,23 @@
 #!/usr/bin/env node
-import { runMcp } from '@ferrlabs/mcp-core';
+import { runMcp, readPackageVersion } from '@ferrlabs/mcp-core';
 import { registerStatsTools } from './tools/stats.js';
 import { registerTokenTools } from './tools/tokens.js';
 import { registerOrgsTools } from './tools/orgs.js';
+import { registerOrgAdminTools } from './tools/org-admin.js';
+import { registerMeTools } from './tools/me.js';
 import { registerVaultsTools } from './tools/vaults.js';
 import { registerIssuesTools } from './tools/issues.js';
 import { registerSubscriptionsTools } from './tools/subscriptions.js';
 import { registerDocsTools } from './tools/docs.js';
 runMcp({
     name: 'ferrlabs',
-    version: '5.2.5',
+    version: readPackageVersion(import.meta.url),
     register: (server) => {
         registerStatsTools(server);
         registerTokenTools(server);
         registerOrgsTools(server);
+        registerOrgAdminTools(server);
+        registerMeTools(server);
         registerVaultsTools(server);
         registerIssuesTools(server);
         registerSubscriptionsTools(server);

package/dist/tools/__tests__/docs.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=docs.test.d.ts.map

package/dist/tools/__tests__/docs.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docs.test.d.ts","sourceRoot":"","sources":["../../../src/tools/__tests__/docs.test.ts"],"names":[],"mappings":""}

package/dist/tools/__tests__/docs.test.js

@@ -0,0 +1,41 @@
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { buildDocUrl, fetchDoc } from '../docs.js';
+afterEach(() => {
+    vi.unstubAllGlobals();
+});
+describe('buildDocUrl', () => {
+    it('maps a product and slug to the allowlisted host', () => {
+        expect(buildDocUrl('ferrflow', 'docs/getting-started')).toBe('https://ferrflow.com/docs/getting-started');
+        expect(buildDocUrl('ferrlabs')).toBe('https://ferrlabs.com/');
+    });
+    it('rejects slugs containing a scheme, traversal, or a leading //', () => {
+        expect(() => buildDocUrl('ferrflow', 'https://evil.test')).toThrow(/invalid slug/);
+        expect(() => buildDocUrl('ferrflow', '../../etc/passwd')).toThrow(/invalid slug/);
+        expect(() => buildDocUrl('ferrflow', '//evil.test/x')).toThrow(/invalid slug/);
+    });
+    it('rejects an unknown product', () => {
+        expect(() => buildDocUrl('notaproduct')).toThrow(/unknown product/);
+    });
+});
+describe('fetchDoc', () => {
+    function makeResponse(status, body = '') {
+        return {
+            ok: status >= 200 && status < 300,
+            status,
+            text: () => Promise.resolve(body),
+        };
+    }
+    it('does not follow a redirect off the allowlisted host', async () => {
+        const fetchMock = vi.fn().mockResolvedValue(makeResponse(302));
+        vi.stubGlobal('fetch', fetchMock);
+        await expect(fetchDoc('ferrgrowth', 'r')).rejects.toThrow(/refused to follow redirect/);
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+        expect(fetchMock.mock.calls[0][1]).toMatchObject({ redirect: 'manual' });
+    });
+    it('returns stripped text on a 200', async () => {
+        vi.stubGlobal('fetch', vi.fn().mockResolvedValue(makeResponse(200, '<main><p>hello world</p></main>')));
+        const out = await fetchDoc('ferrflow', 'pricing');
+        expect(out).toContain('# https://ferrflow.com/pricing');
+        expect(out).toContain('hello world');
+    });
+});

package/dist/tools/docs.d.ts

@@ -1,3 +1,5 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function buildDocUrl(product: string, slug?: string): string;
+export declare function fetchDoc(product: string, slug?: string): Promise<string>;
 export declare function registerDocsTools(server: McpServer): void;
 //# sourceMappingURL=docs.d.ts.map

package/dist/tools/docs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../../src/tools/docs.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAiCpE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,QA4ClD"}
+{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../../src/tools/docs.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAkCpE,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAclE;AAED,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA0B9E;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,QAyBlD"}

package/dist/tools/docs.js

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { fetchWithTimeout } from '@ferrlabs/mcp-core';
 const PRODUCT_HOSTS = {
     ferrlabs: 'https://ferrlabs.com',
     ferrflow: 'https://ferrflow.com',
@@ -26,6 +27,40 @@ function stripHtml(html) {
         .replace(/\n{3,}/g, '\n\n')
         .trim();
 }
+export function buildDocUrl(product, slug) {
+    const host = PRODUCT_HOSTS[product];
+    if (!host) {
+        throw new Error(`fetch_docs: unknown product '${product}'`);
+    }
+    if (slug !== undefined) {
+        if (slug.includes('://') || slug.includes('..') || slug.startsWith('//')) {
+            throw new Error(`fetch_docs: invalid slug '${slug}' — must be a relative path without '://', '..', or a leading '//'`);
+        }
+    }
+    const path = slug ? `/${slug.replace(/^\//, '')}` : '/';
+    return `${host}${path}`;
+}
+export async function fetchDoc(product, slug) {
+    const url = buildDocUrl(product, slug);
+    const res = await fetchWithTimeout(url, {
+        redirect: 'manual',
+        headers: {
+            'User-Agent': 'ferrlabs-mcp',
+            Accept: 'text/html,text/markdown,text/plain',
+        },
+    });
+    if (res.status >= 300 && res.status < 400) {
+        throw new Error(`fetch_docs ${url}: refused to follow redirect (HTTP ${res.status}) off the allowlisted host`);
+    }
+    if (!res.ok) {
+        throw new Error(`fetch_docs ${url}: HTTP ${res.status}`);
+    }
+    const raw = await res.text();
+    const text = stripHtml(raw);
+    const truncated = text.length > MAX_BYTES;
+    const out = truncated ? `${text.slice(0, MAX_BYTES)}\n\n[truncated]` : text;
+    return `# ${url}\n\n${out}`;
+}
 export function registerDocsTools(server) {
     server.tool('fetch_docs', 'Fetch documentation or marketing copy from a FerrLabs product website (ferrflow, ferrvault, ferrtrack, ferrgrowth, ferrfleet, ferrlens, or ferrlabs holding). Returns the page text content, HTML stripped.', {
         product: productEnum.describe('FerrLabs product whose docs to fetch'),
@@ -34,27 +69,12 @@ export function registerDocsTools(server) {
             .optional()
             .describe("Path on the product site, e.g. 'docs/getting-started' or 'pricing'. Omit for the homepage."),
     }, async ({ product, slug }) => {
-        const host = PRODUCT_HOSTS[product];
-        const path = slug ? `/${slug.replace(/^\//, '')}` : '/';
-        const url = `${host}${path}`;
-        const res = await fetch(url, {
-            headers: {
-                'User-Agent': 'ferrlabs-mcp/4.0.0',
-                Accept: 'text/html,text/markdown,text/plain',
-            },
-        });
-        if (!res.ok) {
-            throw new Error(`fetch_docs ${url}: HTTP ${res.status}`);
-        }
-        const raw = await res.text();
-        const text = stripHtml(raw);
-        const truncated = text.length > MAX_BYTES;
-        const out = truncated ? `${text.slice(0, MAX_BYTES)}\n\n[truncated]` : text;
+        const text = await fetchDoc(product, slug);
         return {
             content: [
                 {
                     type: 'text',
-                    text: `# ${url}\n\n${out}`,
+                    text,
                 },
             ],
         };

package/dist/tools/me.d.ts

@@ -0,0 +1,3 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function registerMeTools(server: McpServer): void;
+//# sourceMappingURL=me.d.ts.map

package/dist/tools/me.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"me.d.ts","sourceRoot":"","sources":["../../src/tools/me.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AA4BpE,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,QAkEhD"}

package/dist/tools/me.js

@@ -0,0 +1,47 @@
+import { z } from 'zod';
+import { apiRequest, getToken } from '@ferrlabs/mcp-core';
+export function registerMeTools(server) {
+    server.tool('update_me', "Patch the authenticated user's own profile — display name, timezone, locale, avatar URL. Email + password rotate via dedicated flows in the UI, not here.", {
+        display_name: z.string().min(1).max(100).optional(),
+        timezone: z.string().min(1).max(64).optional().describe("IANA tz, e.g. 'Europe/Paris'."),
+        locale: z
+            .string()
+            .regex(/^[a-z]{2}(-[A-Z]{2})?$/)
+            .optional()
+            .describe("BCP 47, e.g. 'en' or 'fr-FR'."),
+        avatar_url: z.string().url().nullable().optional(),
+    }, async (patch) => {
+        const token = await getToken();
+        const body = {};
+        for (const [k, v] of Object.entries(patch)) {
+            if (v !== undefined)
+                body[k] = v;
+        }
+        const me = await apiRequest('/v1/auth/me', {
+            token,
+            method: 'PATCH',
+            body,
+        });
+        return { content: [{ type: 'text', text: JSON.stringify(me, null, 2) }] };
+    });
+    server.tool('list_my_sessions', 'List your active sessions across devices/browsers. The session you used to obtain the current token is flagged `current: true`.', {}, async () => {
+        const token = await getToken();
+        const sessions = await apiRequest('/v1/me/sessions', { token });
+        return { content: [{ type: 'text', text: JSON.stringify(sessions, null, 2) }] };
+    });
+    server.tool('revoke_my_session', 'Revoke one of your active sessions by id (sign out that device). Refusing to revoke the current session is left up to the API.', {
+        session_id: z.string().min(1).describe('Session id (from list_my_sessions)'),
+    }, async ({ session_id }) => {
+        const token = await getToken();
+        await apiRequest(`/v1/me/sessions/${encodeURIComponent(session_id)}`, {
+            token,
+            method: 'DELETE',
+        });
+        return { content: [{ type: 'text', text: `Session ${session_id} revoked.` }] };
+    });
+    server.tool('export_my_account', "Trigger an export of the authenticated user's data (GDPR Article 15). Returns the export bundle, which can be large; consider redirecting the LLM context to a summary.", {}, async () => {
+        const token = await getToken();
+        const dump = await apiRequest('/v1/auth/me/export', { token });
+        return { content: [{ type: 'text', text: JSON.stringify(dump, null, 2) }] };
+    });
+}

package/dist/tools/org-admin.d.ts

@@ -0,0 +1,3 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function registerOrgAdminTools(server: McpServer): void;
+//# sourceMappingURL=org-admin.d.ts.map

package/dist/tools/org-admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-admin.d.ts","sourceRoot":"","sources":["../../src/tools/org-admin.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AA+DpE,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,SAAS,QAwRtD"}

package/dist/tools/org-admin.js

@@ -0,0 +1,184 @@
+import { z } from 'zod';
+import { apiRequest, getToken } from '@ferrlabs/mcp-core';
+function orgBase(slug) {
+    return `/v1/orgs/${encodeURIComponent(slug)}`;
+}
+export function registerOrgAdminTools(server) {
+    server.tool('get_org', 'Get a single FerrLabs organization by slug.', {
+        org_slug: z.string().min(1).describe('Organization slug'),
+    }, async ({ org_slug }) => {
+        const token = await getToken();
+        const org = await apiRequest(orgBase(org_slug), { token });
+        return { content: [{ type: 'text', text: JSON.stringify(org, null, 2) }] };
+    });
+    server.tool('update_org', 'Patch an organization — rename it or change its slug. Slug changes propagate everywhere; double-check before doing it on a live org.', {
+        org_slug: z.string().min(1).describe('Current organization slug'),
+        name: z.string().min(1).max(100).optional(),
+        new_slug: z
+            .string()
+            .min(2)
+            .max(40)
+            .regex(/^[a-z0-9-]+$/)
+            .optional()
+            .describe('New slug (lowercase alphanumeric + hyphens).'),
+    }, async ({ org_slug, name, new_slug }) => {
+        const token = await getToken();
+        const body = {};
+        if (name !== undefined)
+            body.name = name;
+        if (new_slug !== undefined)
+            body.slug = new_slug;
+        const org = await apiRequest(orgBase(org_slug), {
+            token,
+            method: 'PATCH',
+            body,
+        });
+        return { content: [{ type: 'text', text: JSON.stringify(org, null, 2) }] };
+    });
+    server.tool('get_org_overview', 'High-level dashboard view of an organization — member count, active subscriptions per product, pending invites, recent activity volume.', {
+        org_slug: z.string().min(1).describe('Organization slug'),
+    }, async ({ org_slug }) => {
+        const token = await getToken();
+        const overview = await apiRequest(`${orgBase(org_slug)}/overview`, { token });
+        return { content: [{ type: 'text', text: JSON.stringify(overview, null, 2) }] };
+    });
+    server.tool('get_org_usage', 'Current-period metered usage across all products for an org (FerrGrowth visits/bandwidth, FerrFleet runs, etc.) with limits per tier.', {
+        org_slug: z.string().min(1).describe('Organization slug'),
+    }, async ({ org_slug }) => {
+        const token = await getToken();
+        const usage = await apiRequest(`${orgBase(org_slug)}/usage`, { token });
+        return { content: [{ type: 'text', text: JSON.stringify(usage, null, 2) }] };
+    });
+    server.tool('list_org_audit', 'Recent audit log for an organization — member changes, subscription updates, sensitive admin actions.', {
+        org_slug: z.string().min(1).describe('Organization slug'),
+        limit: z
+            .number()
+            .int()
+            .min(1)
+            .max(200)
+            .optional()
+            .describe('Max entries to return (default 50).'),
+    }, async ({ org_slug, limit }) => {
+        const token = await getToken();
+        const qs = limit !== undefined ? `?limit=${limit}` : '';
+        const entries = await apiRequest(`${orgBase(org_slug)}/audit${qs}`, { token });
+        return { content: [{ type: 'text', text: JSON.stringify(entries, null, 2) }] };
+    });
+    // --------------------------------------------------------------------------
+    // Members
+    // --------------------------------------------------------------------------
+    server.tool('list_org_members', 'Members of an organization with their roles. Useful to look up a user_id before assigning issues or granting team membership.', {
+        org_slug: z.string().min(1).describe('Organization slug'),
+    }, async ({ org_slug }) => {
+        const token = await getToken();
+        const members = await apiRequest(`${orgBase(org_slug)}/members`, { token });
+        return { content: [{ type: 'text', text: JSON.stringify(members, null, 2) }] };
+    });
+    server.tool('invite_org_member', 'Invite a user (by email) to join an organization with a specific role. The user receives an invitation email; they appear in list_org_members once they accept.', {
+        org_slug: z.string().min(1).describe('Organization slug'),
+        email: z.string().email().describe('Invitee email address'),
+        role: z
+            .enum(['admin', 'member', 'viewer'])
+            .default('member')
+            .describe('Org-level role (default member). Owners can only be promoted from existing admins.'),
+    }, async ({ org_slug, email, role }) => {
+        const token = await getToken();
+        const member = await apiRequest(`${orgBase(org_slug)}/members`, {
+            token,
+            method: 'POST',
+            body: { email, role },
+        });
+        return { content: [{ type: 'text', text: JSON.stringify(member, null, 2) }] };
+    });
+    server.tool('update_org_member_role', "Change a member's role inside an organization. Promoting to owner requires the caller to be an owner.", {
+        org_slug: z.string().min(1).describe('Organization slug'),
+        user_id: z.string().min(1).describe('User id of the member to update'),
+        role: z.enum(['owner', 'admin', 'member', 'viewer']),
+    }, async ({ org_slug, user_id, role }) => {
+        const token = await getToken();
+        const member = await apiRequest(`${orgBase(org_slug)}/members/${encodeURIComponent(user_id)}`, { token, method: 'PATCH', body: { role } });
+        return { content: [{ type: 'text', text: JSON.stringify(member, null, 2) }] };
+    });
+    server.tool('remove_org_member', 'Remove a user from an organization. Irreversible; the user can be re-invited.', {
+        org_slug: z.string().min(1).describe('Organization slug'),
+        user_id: z.string().min(1).describe('User id of the member to remove'),
+    }, async ({ org_slug, user_id }) => {
+        const token = await getToken();
+        await apiRequest(`${orgBase(org_slug)}/members/${encodeURIComponent(user_id)}`, {
+            token,
+            method: 'DELETE',
+        });
+        return {
+            content: [{ type: 'text', text: `User ${user_id} removed from ${org_slug}.` }],
+        };
+    });
+    // --------------------------------------------------------------------------
+    // Teams
+    // --------------------------------------------------------------------------
+    server.tool('list_teams', 'List teams (sub-groups) inside an organization. Teams are used for fine-grained permissions and assignee groups.', {
+        org_slug: z.string().min(1).describe('Organization slug'),
+    }, async ({ org_slug }) => {
+        const token = await getToken();
+        const teams = await apiRequest(`${orgBase(org_slug)}/teams`, { token });
+        return { content: [{ type: 'text', text: JSON.stringify(teams, null, 2) }] };
+    });
+    server.tool('create_team', 'Create a new team inside an organization. Teams start empty — add members with add_team_member.', {
+        org_slug: z.string().min(1).describe('Organization slug'),
+        name: z.string().min(1).max(100),
+        description: z.string().max(500).optional(),
+    }, async ({ org_slug, name, description }) => {
+        const token = await getToken();
+        const team = await apiRequest(`${orgBase(org_slug)}/teams`, {
+            token,
+            method: 'POST',
+            body: { name, description: description ?? null },
+        });
+        return { content: [{ type: 'text', text: JSON.stringify(team, null, 2) }] };
+    });
+    server.tool('update_team', 'Patch a team — rename or change description.', {
+        org_slug: z.string().min(1).describe('Organization slug'),
+        team_id: z.string().min(1).describe('Team id'),
+        name: z.string().min(1).max(100).optional(),
+        description: z.string().max(500).nullable().optional(),
+    }, async ({ org_slug, team_id, ...patch }) => {
+        const token = await getToken();
+        const body = {};
+        for (const [k, v] of Object.entries(patch)) {
+            if (v !== undefined)
+                body[k] = v;
+        }
+        const team = await apiRequest(`${orgBase(org_slug)}/teams/${encodeURIComponent(team_id)}`, { token, method: 'PATCH', body });
+        return { content: [{ type: 'text', text: JSON.stringify(team, null, 2) }] };
+    });
+    server.tool('delete_team', 'Delete a team. Members of the team are NOT removed from the org; they just lose team-scoped permissions.', {
+        org_slug: z.string().min(1).describe('Organization slug'),
+        team_id: z.string().min(1).describe('Team id'),
+    }, async ({ org_slug, team_id }) => {
+        const token = await getToken();
+        await apiRequest(`${orgBase(org_slug)}/teams/${encodeURIComponent(team_id)}`, {
+            token,
+            method: 'DELETE',
+        });
+        return { content: [{ type: 'text', text: `Team ${team_id} deleted.` }] };
+    });
+    server.tool('add_team_member', 'Add a user (already an org member) to a team.', {
+        org_slug: z.string().min(1).describe('Organization slug'),
+        team_id: z.string().min(1).describe('Team id'),
+        user_id: z.string().min(1).describe('User id to add'),
+    }, async ({ org_slug, team_id, user_id }) => {
+        const token = await getToken();
+        const result = await apiRequest(`${orgBase(org_slug)}/teams/${encodeURIComponent(team_id)}/members`, { token, method: 'POST', body: { user_id } });
+        return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+    });
+    server.tool('remove_team_member', 'Remove a user from a team. The user remains an org member.', {
+        org_slug: z.string().min(1).describe('Organization slug'),
+        team_id: z.string().min(1).describe('Team id'),
+        user_id: z.string().min(1).describe('User id to remove'),
+    }, async ({ org_slug, team_id, user_id }) => {
+        const token = await getToken();
+        await apiRequest(`${orgBase(org_slug)}/teams/${encodeURIComponent(team_id)}/members/${encodeURIComponent(user_id)}`, { token, method: 'DELETE' });
+        return {
+            content: [{ type: 'text', text: `User ${user_id} removed from team ${team_id}.` }],
+        };
+    });
+}

package/dist/tools/subscriptions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subscriptions.d.ts","sourceRoot":"","sources":["../../src/tools/subscriptions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAgBpE,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,SAAS,QAkB3D"}
+{"version":3,"file":"subscriptions.d.ts","sourceRoot":"","sources":["../../src/tools/subscriptions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAgBpE,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,SAAS,QAwF3D"}

package/dist/tools/subscriptions.js

@@ -11,4 +11,44 @@ export function registerSubscriptionsTools(server) {
             content: [{ type: 'text', text: JSON.stringify(subs, null, 2) }],
         };
     });
+    const PRODUCTS = ['ferrvault', 'ferrtrack', 'ferrgrowth', 'ferrfleet', 'ferrlens'];
+    const TIERS = ['free', 'pro', 'team', 'enterprise'];
+    server.tool('activate_subscription', 'Activate a product subscription on an organization. Starts the trial clock when applicable. Caller must be an org owner/admin; the API enforces billing-info presence for paid tiers.', {
+        org_slug: z.string().min(1).describe('Organization slug'),
+        product: z.enum(PRODUCTS),
+        tier: z.enum(TIERS).default('free').describe('Tier (default free).'),
+    }, async ({ org_slug, product, tier }) => {
+        const token = await getToken();
+        const sub = await apiRequest(`/v1/orgs/${encodeURIComponent(org_slug)}/subscriptions`, { token, method: 'POST', body: { product, tier } });
+        return { content: [{ type: 'text', text: JSON.stringify(sub, null, 2) }] };
+    });
+    server.tool('update_subscription', 'Change the tier of an active product subscription (upgrade/downgrade). Stripe proration is applied per the API config.', {
+        org_slug: z.string().min(1).describe('Organization slug'),
+        product: z.enum(PRODUCTS),
+        tier: z.enum(TIERS),
+    }, async ({ org_slug, product, tier }) => {
+        const token = await getToken();
+        const sub = await apiRequest(`/v1/orgs/${encodeURIComponent(org_slug)}/subscriptions/${encodeURIComponent(product)}`, { token, method: 'PATCH', body: { tier } });
+        return { content: [{ type: 'text', text: JSON.stringify(sub, null, 2) }] };
+    });
+    server.tool('cancel_subscription', 'Cancel a product subscription on an organization. By default the cancellation takes effect at the end of the current billing period; pass immediate=true to cut it off now (with proration).', {
+        org_slug: z.string().min(1).describe('Organization slug'),
+        product: z.enum(PRODUCTS),
+        immediate: z
+            .boolean()
+            .optional()
+            .describe('Cut off immediately and refund prorated amount. Default false (cancel at period end).'),
+    }, async ({ org_slug, product, immediate }) => {
+        const token = await getToken();
+        const qs = immediate ? '?immediate=true' : '';
+        await apiRequest(`/v1/orgs/${encodeURIComponent(org_slug)}/subscriptions/${encodeURIComponent(product)}${qs}`, { token, method: 'DELETE' });
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: `Subscription ${product} on ${org_slug} ${immediate ? 'cancelled immediately' : 'set to cancel at period end'}.`,
+                },
+            ],
+        };
+    });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ferrlabs/mcp",
-  "version": "6.4.1",
+  "version": "6.5.4",
   "description": "Model Context Protocol server for the FerrLabs platform (orgs, projects, subscriptions, docs, tokens, public stats)",
   "license": "MPL-2.0",
   "type": "module",
@@ -23,7 +23,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
     "zod": "^4.3.6",
-    "@ferrlabs/mcp-core": "^6.4.1"
+    "@ferrlabs/mcp-core": "^6.5.4"
   },
   "publishConfig": {
     "access": "public"