@ferrlabs/mcp 7.0.1 → 8.2.1

package/dist/index.js

@@ -9,6 +9,7 @@ import { registerVaultsTools } from './tools/vaults.js';
 import { registerIssuesTools } from './tools/issues.js';
 import { registerSubscriptionsTools } from './tools/subscriptions.js';
 import { registerDocsTools } from './tools/docs.js';
+import { registerOrgResources } from './resources/orgs.js';
 runMcp({
     name: 'ferrlabs',
     version: readPackageVersion(import.meta.url),
@@ -22,6 +23,7 @@ runMcp({
         registerIssuesTools(server);
         registerSubscriptionsTools(server);
         registerDocsTools(server);
+        registerOrgResources(server);
     },
 }).catch((err) => {
     console.error('ferrlabs-mcp fatal:', err instanceof Error ? err.message : err);

package/dist/resources/orgs.d.ts

@@ -0,0 +1,3 @@
+import { type McpServer } from '@ferrlabs/mcp-core';
+export declare function registerOrgResources(server: McpServer): void;
+//# sourceMappingURL=orgs.d.ts.map

package/dist/resources/orgs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orgs.d.ts","sourceRoot":"","sources":["../../src/resources/orgs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgC,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAelF,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,QAsCrD"}

package/dist/resources/orgs.js

@@ -0,0 +1,39 @@
+import { ResourceTemplate, toToolText } from '@ferrlabs/mcp-core';
+import { fetchOrgOverview, fetchOrgUsage } from '../tools/org-admin.js';
+import { listOrgSlugs } from '../tools/orgs.js';
+async function listOrgResources(scheme, suffix) {
+    const slugs = await listOrgSlugs();
+    return {
+        resources: slugs.map((slug) => ({
+            uri: `${scheme}://org/${slug}/${suffix}`,
+            name: `${slug} ${suffix}`,
+            mimeType: 'application/json',
+        })),
+    };
+}
+export function registerOrgResources(server) {
+    server.registerResource('org-overview', new ResourceTemplate('ferrlabs://org/{slug}/overview', {
+        list: () => listOrgResources('ferrlabs', 'overview'),
+    }), {
+        title: 'Organization overview',
+        description: 'Member count, active subscriptions per product, pending invites and recent activity volume for one organization.',
+        mimeType: 'application/json',
+    }, async (uri, { slug }) => {
+        const overview = await fetchOrgOverview(String(slug));
+        return {
+            contents: [{ uri: uri.href, mimeType: 'application/json', text: toToolText(overview) }],
+        };
+    });
+    server.registerResource('org-usage', new ResourceTemplate('ferrlabs://org/{slug}/usage', {
+        list: () => listOrgResources('ferrlabs', 'usage'),
+    }), {
+        title: 'Organization usage',
+        description: 'Current-period metered usage across every product for one organization, with the limit for its tier.',
+        mimeType: 'application/json',
+    }, async (uri, { slug }) => {
+        const usage = await fetchOrgUsage(String(slug));
+        return {
+            contents: [{ uri: uri.href, mimeType: 'application/json', text: toToolText(usage) }],
+        };
+    });
+}

package/dist/tools/__tests__/tokens.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=tokens.test.d.ts.map

package/dist/tools/__tests__/tokens.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.test.d.ts","sourceRoot":"","sources":["../../../src/tools/__tests__/tokens.test.ts"],"names":[],"mappings":""}

package/dist/tools/__tests__/tokens.test.js

@@ -0,0 +1,65 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+process.env.FERRLABS_API_TOKEN = 'test-token';
+const handlers = new Map();
+const mockServer = {
+    tool: vi.fn((name, _desc, _schema, handler) => {
+        handlers.set(name, handler);
+    }),
+};
+const mockFetch = vi.fn();
+vi.stubGlobal('fetch', mockFetch);
+function makeResponse(body, status = 200) {
+    return {
+        ok: status >= 200 && status < 300,
+        status,
+        text: () => Promise.resolve(JSON.stringify(body)),
+        json: () => Promise.resolve(body),
+    };
+}
+const SECRET = 'fl_live_plaintext_secret_value';
+describe('create_token', () => {
+    beforeEach(async () => {
+        vi.clearAllMocks();
+        handlers.clear();
+        delete process.env.FERRLABS_MCP_ALLOW_TOKEN_REVEAL;
+        const { registerTokenTools } = await import('../tokens.js');
+        registerTokenTools(mockServer);
+    });
+    afterEach(() => {
+        delete process.env.FERRLABS_MCP_ALLOW_TOKEN_REVEAL;
+    });
+    it('refuses without ever calling the API, so no credential is minted', async () => {
+        const result = await handlers.get('create_token')({ name: 'ci', scopes: ['*'] });
+        expect(result.isError).toBe(true);
+        expect(mockFetch).not.toHaveBeenCalled();
+    });
+    it('names the environment variable and the dashboard in the refusal', async () => {
+        const result = await handlers.get('create_token')({ name: 'ci', scopes: ['*'] });
+        const text = result.content[0].text ?? '';
+        expect(text).toMatch(/FERRLABS_MCP_ALLOW_TOKEN_REVEAL=1/);
+        expect(text).toMatch(/app\.ferrlabs\.com/);
+    });
+    it('returns the secret once the operator has opted in', async () => {
+        process.env.FERRLABS_MCP_ALLOW_TOKEN_REVEAL = '1';
+        mockFetch.mockResolvedValue(makeResponse({
+            id: 't1',
+            name: 'ci',
+            token_prefix: 'fl_live',
+            scopes: ['*'],
+            expires_at: null,
+            last_used_at: null,
+            created_at: '2026-09-07T00:00:00Z',
+            plaintext: SECRET,
+        }));
+        const result = await handlers.get('create_token')({ name: 'ci', scopes: ['*'] });
+        const text = result.content[0].text ?? '';
+        expect(mockFetch).toHaveBeenCalledOnce();
+        expect(text).toContain(SECRET);
+        expect(text).toMatch(/now in this transcript/);
+    });
+    it('leaks nothing on the default path', async () => {
+        mockFetch.mockResolvedValue(makeResponse({ plaintext: SECRET }));
+        const result = await handlers.get('create_token')({ name: 'ci', scopes: ['*'] });
+        expect(JSON.stringify(result)).not.toContain(SECRET);
+    });
+});

package/dist/tools/issues.js

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { apiRequest } from '@ferrlabs/mcp-core';
+import { apiRequest, toToolText } from '@ferrlabs/mcp-core';
 import { getToken } from '@ferrlabs/mcp-core';
 export function registerIssuesTools(server) {
     server.tool('list_issues', 'List FerrTrack issues for a project (FerrTrack — issue tracker)', {
@@ -23,7 +23,7 @@ export function registerIssuesTools(server) {
         const qs = params.toString();
         const issues = await apiRequest(`/orgs/${encodeURIComponent(org_slug)}/projects/${encodeURIComponent(project_slug)}/issues${qs ? `?${qs}` : ''}`, { token });
         return {
-            content: [{ type: 'text', text: JSON.stringify(issues, null, 2) }],
+            content: [{ type: 'text', text: toToolText(issues) }],
         };
     });
 }

package/dist/tools/me.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"me.d.ts","sourceRoot":"","sources":["../../src/tools/me.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AA4BpE,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,QAkEhD"}
+{"version":3,"file":"me.d.ts","sourceRoot":"","sources":["../../src/tools/me.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AA4BpE,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,QA2EhD"}

package/dist/tools/me.js

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { apiRequest, getToken } from '@ferrlabs/mcp-core';
+import { apiRequest, getToken, toToolText } from '@ferrlabs/mcp-core';
 export function registerMeTools(server) {
     server.tool('update_me', "Patch the authenticated user's own profile — display name, timezone, locale, avatar URL. Email + password rotate via dedicated flows in the UI, not here.", {
         display_name: z.string().min(1).max(100).optional(),
@@ -22,12 +22,12 @@ export function registerMeTools(server) {
             method: 'PATCH',
             body,
         });
-        return { content: [{ type: 'text', text: JSON.stringify(me, null, 2) }] };
+        return { content: [{ type: 'text', text: toToolText(me) }] };
     });
     server.tool('list_my_sessions', 'List your active sessions across devices/browsers. The session you used to obtain the current token is flagged `current: true`.', {}, async () => {
         const token = await getToken();
         const sessions = await apiRequest('/me/sessions', { token });
-        return { content: [{ type: 'text', text: JSON.stringify(sessions, null, 2) }] };
+        return { content: [{ type: 'text', text: toToolText(sessions) }] };
     });
     server.tool('revoke_my_session', 'Revoke one of your active sessions by id (sign out that device). Refusing to revoke the current session is left up to the API.', {
         session_id: z.string().min(1).describe('Session id (from list_my_sessions)'),
@@ -42,6 +42,15 @@ export function registerMeTools(server) {
     server.tool('export_my_account', "Trigger an export of the authenticated user's data (GDPR Article 15). Returns the export bundle, which can be large; consider redirecting the LLM context to a summary.", {}, async () => {
         const token = await getToken();
         const dump = await apiRequest('/auth/me/export', { token });
-        return { content: [{ type: 'text', text: JSON.stringify(dump, null, 2) }] };
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: toToolText(dump, {
+                        narrowWith: 'Export the account from app.ferrlabs.com to get the bundle whole.',
+                    }),
+                },
+            ],
+        };
     });
 }

package/dist/tools/org-admin.d.ts

@@ -1,3 +1,39 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+interface Org {
+    id: string;
+    slug: string;
+    name: string;
+    plan: string;
+    member_count: number;
+    created_at: string;
+    updated_at: string;
+}
+export interface OrgOverview {
+    org: Org;
+    member_count: number;
+    active_subscriptions: Array<{
+        product: string;
+        tier: string;
+        status: string;
+    }>;
+    pending_invites: number;
+    recent_activity_count: number;
+}
+export interface OrgUsage {
+    org_slug: string;
+    period: {
+        from: string;
+        to: string;
+    };
+    per_product: Array<{
+        product: string;
+        metric: string;
+        used: number;
+        limit: number | null;
+    }>;
+}
+export declare function fetchOrgOverview(orgSlug: string): Promise<OrgOverview>;
+export declare function fetchOrgUsage(orgSlug: string): Promise<OrgUsage>;
 export declare function registerOrgAdminTools(server: McpServer): void;
+export {};
 //# sourceMappingURL=org-admin.d.ts.map

package/dist/tools/org-admin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"org-admin.d.ts","sourceRoot":"","sources":["../../src/tools/org-admin.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AA+DpE,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,SAAS,QAwRtD"}
+{"version":3,"file":"org-admin.d.ts","sourceRoot":"","sources":["../../src/tools/org-admin.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGpE,UAAU,GAAG;IACX,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,GAAG,CAAC;IACT,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/E,eAAe,EAAE,MAAM,CAAC;IACxB,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACrC,WAAW,EAAE,KAAK,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;KACtB,CAAC,CAAC;CACJ;AAiCD,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAG5E;AAED,wBAAsB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAGtE;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,SAAS,QA6RtD"}

package/dist/tools/org-admin.js

@@ -1,15 +1,23 @@
 import { z } from 'zod';
-import { apiRequest, getToken } from '@ferrlabs/mcp-core';
+import { apiRequest, getToken, toToolText } from '@ferrlabs/mcp-core';
 function orgBase(slug) {
     return `/orgs/${encodeURIComponent(slug)}`;
 }
+export async function fetchOrgOverview(orgSlug) {
+    const token = await getToken();
+    return apiRequest(`${orgBase(orgSlug)}/overview`, { token });
+}
+export async function fetchOrgUsage(orgSlug) {
+    const token = await getToken();
+    return apiRequest(`${orgBase(orgSlug)}/usage`, { token });
+}
 export function registerOrgAdminTools(server) {
     server.tool('get_org', 'Get a single FerrLabs organization by slug.', {
         org_slug: z.string().min(1).describe('Organization slug'),
     }, async ({ org_slug }) => {
         const token = await getToken();
         const org = await apiRequest(orgBase(org_slug), { token });
-        return { content: [{ type: 'text', text: JSON.stringify(org, null, 2) }] };
+        return { content: [{ type: 'text', text: toToolText(org) }] };
     });
     server.tool('update_org', 'Patch an organization — rename it or change its slug. Slug changes propagate everywhere; double-check before doing it on a live org.', {
         org_slug: z.string().min(1).describe('Current organization slug'),
@@ -33,21 +41,19 @@ export function registerOrgAdminTools(server) {
             method: 'PATCH',
             body,
         });
-        return { content: [{ type: 'text', text: JSON.stringify(org, null, 2) }] };
+        return { content: [{ type: 'text', text: toToolText(org) }] };
     });
     server.tool('get_org_overview', 'High-level dashboard view of an organization — member count, active subscriptions per product, pending invites, recent activity volume.', {
         org_slug: z.string().min(1).describe('Organization slug'),
     }, async ({ org_slug }) => {
-        const token = await getToken();
-        const overview = await apiRequest(`${orgBase(org_slug)}/overview`, { token });
-        return { content: [{ type: 'text', text: JSON.stringify(overview, null, 2) }] };
+        const overview = await fetchOrgOverview(org_slug);
+        return { content: [{ type: 'text', text: toToolText(overview) }] };
     });
     server.tool('get_org_usage', 'Current-period metered usage across all products for an org (FerrGrowth visits/bandwidth, FerrFleet runs, etc.) with limits per tier.', {
         org_slug: z.string().min(1).describe('Organization slug'),
     }, async ({ org_slug }) => {
-        const token = await getToken();
-        const usage = await apiRequest(`${orgBase(org_slug)}/usage`, { token });
-        return { content: [{ type: 'text', text: JSON.stringify(usage, null, 2) }] };
+        const usage = await fetchOrgUsage(org_slug);
+        return { content: [{ type: 'text', text: toToolText(usage) }] };
     });
     server.tool('list_org_audit', 'Recent audit log for an organization — member changes, subscription updates, sensitive admin actions.', {
         org_slug: z.string().min(1).describe('Organization slug'),
@@ -62,7 +68,14 @@ export function registerOrgAdminTools(server) {
         const token = await getToken();
         const qs = limit !== undefined ? `?limit=${limit}` : '';
         const entries = await apiRequest(`${orgBase(org_slug)}/audit${qs}`, { token });
-        return { content: [{ type: 'text', text: JSON.stringify(entries, null, 2) }] };
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: toToolText(entries, { narrowWith: 'Pass a smaller limit.' }),
+                },
+            ],
+        };
     });
     // --------------------------------------------------------------------------
     // Members
@@ -72,7 +85,7 @@ export function registerOrgAdminTools(server) {
     }, async ({ org_slug }) => {
         const token = await getToken();
         const members = await apiRequest(`${orgBase(org_slug)}/members`, { token });
-        return { content: [{ type: 'text', text: JSON.stringify(members, null, 2) }] };
+        return { content: [{ type: 'text', text: toToolText(members) }] };
     });
     server.tool('invite_org_member', 'Invite a user (by email) to join an organization with a specific role. The user receives an invitation email; they appear in list_org_members once they accept.', {
         org_slug: z.string().min(1).describe('Organization slug'),
@@ -88,7 +101,7 @@ export function registerOrgAdminTools(server) {
             method: 'POST',
             body: { email, role },
         });
-        return { content: [{ type: 'text', text: JSON.stringify(member, null, 2) }] };
+        return { content: [{ type: 'text', text: toToolText(member) }] };
     });
     server.tool('update_org_member_role', "Change a member's role inside an organization. Promoting to owner requires the caller to be an owner.", {
         org_slug: z.string().min(1).describe('Organization slug'),
@@ -97,7 +110,7 @@ export function registerOrgAdminTools(server) {
     }, async ({ org_slug, user_id, role }) => {
         const token = await getToken();
         const member = await apiRequest(`${orgBase(org_slug)}/members/${encodeURIComponent(user_id)}`, { token, method: 'PATCH', body: { role } });
-        return { content: [{ type: 'text', text: JSON.stringify(member, null, 2) }] };
+        return { content: [{ type: 'text', text: toToolText(member) }] };
     });
     server.tool('remove_org_member', 'Remove a user from an organization. Irreversible; the user can be re-invited.', {
         org_slug: z.string().min(1).describe('Organization slug'),
@@ -120,7 +133,7 @@ export function registerOrgAdminTools(server) {
     }, async ({ org_slug }) => {
         const token = await getToken();
         const teams = await apiRequest(`${orgBase(org_slug)}/teams`, { token });
-        return { content: [{ type: 'text', text: JSON.stringify(teams, null, 2) }] };
+        return { content: [{ type: 'text', text: toToolText(teams) }] };
     });
     server.tool('create_team', 'Create a new team inside an organization. Teams start empty — add members with add_team_member.', {
         org_slug: z.string().min(1).describe('Organization slug'),
@@ -133,7 +146,7 @@ export function registerOrgAdminTools(server) {
             method: 'POST',
             body: { name, description: description ?? null },
         });
-        return { content: [{ type: 'text', text: JSON.stringify(team, null, 2) }] };
+        return { content: [{ type: 'text', text: toToolText(team) }] };
     });
     server.tool('update_team', 'Patch a team — rename or change description.', {
         org_slug: z.string().min(1).describe('Organization slug'),
@@ -148,7 +161,7 @@ export function registerOrgAdminTools(server) {
                 body[k] = v;
         }
         const team = await apiRequest(`${orgBase(org_slug)}/teams/${encodeURIComponent(team_id)}`, { token, method: 'PATCH', body });
-        return { content: [{ type: 'text', text: JSON.stringify(team, null, 2) }] };
+        return { content: [{ type: 'text', text: toToolText(team) }] };
     });
     server.tool('delete_team', 'Delete a team. Members of the team are NOT removed from the org; they just lose team-scoped permissions.', {
         org_slug: z.string().min(1).describe('Organization slug'),
@@ -168,7 +181,7 @@ export function registerOrgAdminTools(server) {
     }, async ({ org_slug, team_id, user_id }) => {
         const token = await getToken();
         const result = await apiRequest(`${orgBase(org_slug)}/teams/${encodeURIComponent(team_id)}/members`, { token, method: 'POST', body: { user_id } });
-        return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+        return { content: [{ type: 'text', text: toToolText(result) }] };
     });
     server.tool('remove_team_member', 'Remove a user from a team. The user remains an org member.', {
         org_slug: z.string().min(1).describe('Organization slug'),

package/dist/tools/orgs.d.ts

@@ -1,3 +1,13 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+interface OrgWithMemberCount {
+    id: string;
+    slug: string;
+    name: string;
+    member_count: number;
+    created_at: string;
+}
+export declare function fetchOrgs(): Promise<OrgWithMemberCount[]>;
+export declare function listOrgSlugs(): Promise<string[]>;
 export declare function registerOrgsTools(server: McpServer): void;
+export {};
 //# sourceMappingURL=orgs.d.ts.map

package/dist/tools/orgs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"orgs.d.ts","sourceRoot":"","sources":["../../src/tools/orgs.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAqBpE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,QA+BlD"}
+{"version":3,"file":"orgs.d.ts","sourceRoot":"","sources":["../../src/tools/orgs.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAIpE,UAAU,kBAAkB;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AAWD,wBAAsB,SAAS,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAG/D;AAED,wBAAsB,YAAY,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAGtD;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,QA8BlD"}

package/dist/tools/orgs.js

@@ -1,12 +1,19 @@
 import { z } from 'zod';
-import { apiRequest } from '@ferrlabs/mcp-core';
+import { apiRequest, toToolText } from '@ferrlabs/mcp-core';
 import { getToken } from '@ferrlabs/mcp-core';
+export async function fetchOrgs() {
+    const token = await getToken();
+    return apiRequest('/orgs', { token });
+}
+export async function listOrgSlugs() {
+    const orgs = await fetchOrgs();
+    return orgs.map((org) => org.slug);
+}
 export function registerOrgsTools(server) {
     server.tool('list_orgs', 'List FerrLabs organizations the authenticated user belongs to', {}, async () => {
-        const token = await getToken();
-        const orgs = await apiRequest('/orgs', { token });
+        const orgs = await fetchOrgs();
         return {
-            content: [{ type: 'text', text: JSON.stringify(orgs, null, 2) }],
+            content: [{ type: 'text', text: toToolText(orgs) }],
         };
     });
     server.tool('list_projects', 'List projects inside a FerrLabs organization', {
@@ -15,7 +22,7 @@ export function registerOrgsTools(server) {
         const token = await getToken();
         const projects = await apiRequest(`/orgs/${encodeURIComponent(org_slug)}/projects`, { token });
         return {
-            content: [{ type: 'text', text: JSON.stringify(projects, null, 2) }],
+            content: [{ type: 'text', text: toToolText(projects) }],
         };
     });
 }

package/dist/tools/stats.js

@@ -1,4 +1,4 @@
-import { apiRequest } from '@ferrlabs/mcp-core';
+import { apiRequest, toToolText } from '@ferrlabs/mcp-core';
 export function registerStatsTools(server) {
     server.tool('get_stats', 'Get public FerrLabs usage statistics (releases cut, repos using FerrFlow, commits analyzed)', {}, async () => {
         const stats = await apiRequest('/stats');
@@ -6,7 +6,7 @@ export function registerStatsTools(server) {
             content: [
                 {
                     type: 'text',
-                    text: JSON.stringify(stats, null, 2),
+                    text: toToolText(stats),
                 },
             ],
         };
@@ -17,7 +17,7 @@ export function registerStatsTools(server) {
             content: [
                 {
                     type: 'text',
-                    text: JSON.stringify(health, null, 2),
+                    text: toToolText(health),
                 },
             ],
         };

package/dist/tools/subscriptions.js

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { apiRequest } from '@ferrlabs/mcp-core';
+import { apiRequest, toToolText } from '@ferrlabs/mcp-core';
 import { getToken } from '@ferrlabs/mcp-core';
 export function registerSubscriptionsTools(server) {
     server.tool('list_subscriptions', 'List FerrLabs product subscriptions for an organization (FerrVault, FerrTrack, FerrGrowth, FerrFleet)', {
@@ -8,7 +8,7 @@ export function registerSubscriptionsTools(server) {
         const token = await getToken();
         const subs = await apiRequest(`/orgs/${encodeURIComponent(org_slug)}/subscriptions`, { token });
         return {
-            content: [{ type: 'text', text: JSON.stringify(subs, null, 2) }],
+            content: [{ type: 'text', text: toToolText(subs) }],
         };
     });
     const PRODUCTS = ['ferrvault', 'ferrtrack', 'ferrgrowth', 'ferrfleet', 'ferrlens'];
@@ -20,7 +20,7 @@ export function registerSubscriptionsTools(server) {
     }, async ({ org_slug, product, tier }) => {
         const token = await getToken();
         const sub = await apiRequest(`/orgs/${encodeURIComponent(org_slug)}/subscriptions`, { token, method: 'POST', body: { product, tier } });
-        return { content: [{ type: 'text', text: JSON.stringify(sub, null, 2) }] };
+        return { content: [{ type: 'text', text: toToolText(sub) }] };
     });
     server.tool('update_subscription', 'Change the tier of an active product subscription (upgrade/downgrade). Stripe proration is applied per the API config.', {
         org_slug: z.string().min(1).describe('Organization slug'),
@@ -29,7 +29,7 @@ export function registerSubscriptionsTools(server) {
     }, async ({ org_slug, product, tier }) => {
         const token = await getToken();
         const sub = await apiRequest(`/orgs/${encodeURIComponent(org_slug)}/subscriptions/${encodeURIComponent(product)}`, { token, method: 'PATCH', body: { tier } });
-        return { content: [{ type: 'text', text: JSON.stringify(sub, null, 2) }] };
+        return { content: [{ type: 'text', text: toToolText(sub) }] };
     });
     server.tool('cancel_subscription', 'Cancel a product subscription on an organization. By default the cancellation takes effect at the end of the current billing period; pass immediate=true to cut it off now (with proration).', {
         org_slug: z.string().min(1).describe('Organization slug'),

package/dist/tools/tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/tools/tokens.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AA4BpE,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,QA4EnD"}
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/tools/tokens.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AA4BpE,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,QAmGnD"}

package/dist/tools/tokens.js

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { apiRequest } from '@ferrlabs/mcp-core';
+import { apiRequest, toToolText } from '@ferrlabs/mcp-core';
 import { getToken } from '@ferrlabs/mcp-core';
 export function registerTokenTools(server) {
     server.tool('get_me', 'Get the current authenticated FerrLabs user profile', {}, async () => {
@@ -9,7 +9,7 @@ export function registerTokenTools(server) {
             content: [
                 {
                     type: 'text',
-                    text: JSON.stringify(user, null, 2),
+                    text: toToolText(user),
                 },
             ],
         };
@@ -21,16 +21,38 @@ export function registerTokenTools(server) {
             content: [
                 {
                     type: 'text',
-                    text: JSON.stringify(tokens, null, 2),
+                    text: toToolText(tokens),
                 },
             ],
         };
     });
-    server.tool('create_token', 'Create a new FerrLabs API token (requires an interactive session, not a token)', {
+    server.tool('create_token', 'Create a new FerrLabs API token. Disabled unless FERRLABS_MCP_ALLOW_TOKEN_REVEAL=1, because the API shows the secret exactly once and returning it here writes it into the conversation transcript.', {
         name: z.string().min(1).max(100).describe('Token name'),
         scopes: z.array(z.string()).describe('Token scopes (e.g. ["*"] for all)'),
         expires_at: z.string().optional().describe('Expiration date (ISO 8601)'),
     }, async ({ name, scopes, expires_at }) => {
+        // Refuse before minting, not after. The API returns the plaintext once
+        // and never again, so creating the token and then withholding the
+        // secret would leave a live credential nobody can use.
+        if (process.env.FERRLABS_MCP_ALLOW_TOKEN_REVEAL !== '1') {
+            return {
+                isError: true,
+                content: [
+                    {
+                        type: 'text',
+                        text: [
+                            'Refusing to create an API token.',
+                            '',
+                            'The secret is returned exactly once, at creation, so this tool would have to put it in its response — and tool results are written to the conversation transcript, which the client persists to disk and may ship in logs or telemetry. A long-lived credential would end up in places you did not choose.',
+                            '',
+                            'Create the token from app.ferrlabs.com → Settings → API Tokens instead.',
+                            '',
+                            'If you accept the exposure, restart the MCP server with FERRLABS_MCP_ALLOW_TOKEN_REVEAL=1. It is an environment variable rather than an argument on purpose: the decision belongs to whoever runs the server.',
+                        ].join('\n'),
+                    },
+                ],
+            };
+        }
         const token = await getToken();
         const result = await apiRequest('/auth/tokens', {
             method: 'POST',
@@ -42,7 +64,7 @@ export function registerTokenTools(server) {
             content: [
                 {
                     type: 'text',
-                    text: `Token created: ${plaintext}\n\nThis is the only time the full token will be shown. Store it securely.\n\n${JSON.stringify(meta, null, 2)}`,
+                    text: `Token created: ${plaintext}\n\nThis is the only time the secret is shown, and it is now in this transcript. Move it to your secret store, then treat the transcript as sensitive or revoke the token with revoke_token.\n\n${toToolText(meta)}`,
                 },
             ],
         };

package/dist/tools/vaults.js

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { apiRequest } from '@ferrlabs/mcp-core';
+import { apiRequest, toToolText } from '@ferrlabs/mcp-core';
 import { getToken } from '@ferrlabs/mcp-core';
 export function registerVaultsTools(server) {
     server.tool('list_vaults', 'List FerrVault vaults inside a project (FerrVault — secrets management)', {
@@ -9,7 +9,7 @@ export function registerVaultsTools(server) {
         const token = await getToken();
         const vaults = await apiRequest(`/orgs/${encodeURIComponent(org_slug)}/projects/${encodeURIComponent(project_slug)}/vaults`, { token });
         return {
-            content: [{ type: 'text', text: JSON.stringify(vaults, null, 2) }],
+            content: [{ type: 'text', text: toToolText(vaults) }],
         };
     });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ferrlabs/mcp",
-  "version": "7.0.1",
+  "version": "8.2.1",
   "description": "Model Context Protocol server for the FerrLabs platform (orgs, projects, subscriptions, docs, tokens, public stats)",
   "license": "MPL-2.0",
   "type": "module",
@@ -21,9 +21,9 @@
     "ai"
   ],
   "dependencies": {
+    "@ferrlabs/mcp-core": "^8.2.1",
     "@modelcontextprotocol/sdk": "^1.0.0",
-    "zod": "^4.3.6",
-    "@ferrlabs/mcp-core": "^7.0.1"
+    "zod": "^4.3.6"
   },
   "publishConfig": {
     "access": "public"