@flexprice/mcp-server 2.0.6 → 2.0.8

package/src/funcs/subscriptionsUpdateSubscription.ts

@@ -0,0 +1,153 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import { FlexpriceCore } from "../core.js";
+import { encodeJSON, encodeSimple } from "../lib/encodings.js";
+import { compactMap } from "../lib/primitives.js";
+import { safeParse } from "../lib/schemas.js";
+import { RequestOptions } from "../lib/sdks.js";
+import { extractSecurity, resolveGlobalSecurity } from "../lib/security.js";
+import { pathToFunc } from "../lib/url.js";
+import { APIError } from "../models/errors/apierror.js";
+import {
+  ConnectionError,
+  InvalidRequestError,
+  RequestAbortedError,
+  RequestTimeoutError,
+  UnexpectedClientError,
+} from "../models/errors/httpclienterrors.js";
+import { SDKValidationError } from "../models/errors/sdkvalidationerror.js";
+import {
+  UpdateSubscriptionRequest,
+  UpdateSubscriptionRequest$zodSchema,
+} from "../models/updatesubscriptionop.js";
+import { APICall, APIPromise } from "../types/async.js";
+import { Result } from "../types/fp.js";
+
+/**
+ * Update subscription
+ *
+ * @remarks
+ * Use when changing subscription details (e.g. quantity, billing anchor, or parent). Supports partial update; send "" to clear parent_subscription_id.
+ */
+export function subscriptionsUpdateSubscription(
+  client$: FlexpriceCore,
+  request: UpdateSubscriptionRequest,
+  options?: RequestOptions,
+): APIPromise<
+  Result<
+    Response,
+    | APIError
+    | SDKValidationError
+    | UnexpectedClientError
+    | InvalidRequestError
+    | RequestAbortedError
+    | RequestTimeoutError
+    | ConnectionError
+  >
+> {
+  return new APIPromise($do(
+    client$,
+    request,
+    options,
+  ));
+}
+
+async function $do(
+  client$: FlexpriceCore,
+  request: UpdateSubscriptionRequest,
+  options?: RequestOptions,
+): Promise<
+  [
+    Result<
+      Response,
+      | APIError
+      | SDKValidationError
+      | UnexpectedClientError
+      | InvalidRequestError
+      | RequestAbortedError
+      | RequestTimeoutError
+      | ConnectionError
+    >,
+    APICall,
+  ]
+> {
+  const parsed$ = safeParse(
+    request,
+    (value$) => UpdateSubscriptionRequest$zodSchema.parse(value$),
+    "Input validation failed",
+  );
+  if (!parsed$.ok) {
+    return [parsed$, { status: "invalid" }];
+  }
+  const payload$ = parsed$.value;
+  const body$ = encodeJSON("body", payload$.body, { explode: true });
+
+  const pathParams$ = {
+    id: encodeSimple("id", payload$.id, {
+      explode: false,
+      charEncoding: "percent",
+    }),
+  };
+  const path$ = pathToFunc("/subscriptions/{id}")(
+    pathParams$,
+  );
+
+  const headers$ = new Headers(compactMap({
+    "Content-Type": "application/json",
+    Accept: "application/json",
+  }));
+  const securityInput = await extractSecurity(client$._options.security);
+  const requestSecurity = resolveGlobalSecurity(securityInput);
+
+  const context = {
+    options: client$._options,
+    baseURL: options?.serverURL ?? client$._baseURL ?? "",
+    operationID: "updateSubscription",
+    oAuth2Scopes: null,
+    resolvedSecurity: requestSecurity,
+    securitySource: client$._options.security,
+    retryConfig: options?.retries
+      || client$._options.retryConfig
+      || { strategy: "none" },
+    retryCodes: options?.retryCodes || [
+      "429",
+      "500",
+      "502",
+      "503",
+      "504",
+    ],
+  };
+
+  const requestRes = client$._createRequest(context, {
+    security: requestSecurity,
+    method: "PUT",
+    baseURL: options?.serverURL,
+    path: path$,
+    headers: headers$,
+    body: body$,
+    userAgent: client$._options.userAgent,
+    timeoutMs: options?.timeoutMs || client$._options.timeoutMs
+      || -1,
+  }, options);
+  if (!requestRes.ok) {
+    return [requestRes, { status: "invalid" }];
+  }
+  const req$ = requestRes.value;
+
+  const doResult = await client$._do(req$, {
+    context,
+    errorCodes: [],
+    retryConfig: context.retryConfig,
+    retryCodes: context.retryCodes,
+  });
+  if (!doResult.ok) {
+    return [doResult, { status: "request-error", request: req$ }];
+  }
+  return [doResult, {
+    status: "complete",
+    "request": req$,
+    response: doResult.value,
+  }];
+}

package/src/funcs/subscriptionsUpdateSubscriptionLineItem.ts

@@ -0,0 +1,153 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import { FlexpriceCore } from "../core.js";
+import { encodeJSON, encodeSimple } from "../lib/encodings.js";
+import { compactMap } from "../lib/primitives.js";
+import { safeParse } from "../lib/schemas.js";
+import { RequestOptions } from "../lib/sdks.js";
+import { extractSecurity, resolveGlobalSecurity } from "../lib/security.js";
+import { pathToFunc } from "../lib/url.js";
+import { APIError } from "../models/errors/apierror.js";
+import {
+  ConnectionError,
+  InvalidRequestError,
+  RequestAbortedError,
+  RequestTimeoutError,
+  UnexpectedClientError,
+} from "../models/errors/httpclienterrors.js";
+import { SDKValidationError } from "../models/errors/sdkvalidationerror.js";
+import {
+  UpdateSubscriptionLineItemRequest,
+  UpdateSubscriptionLineItemRequest$zodSchema,
+} from "../models/updatesubscriptionlineitemop.js";
+import { APICall, APIPromise } from "../types/async.js";
+import { Result } from "../types/fp.js";
+
+/**
+ * Update subscription line item
+ *
+ * @remarks
+ * Use when changing a subscription line item (e.g. quantity or price). Implemented by ending the current line and creating a new one for clean billing.
+ */
+export function subscriptionsUpdateSubscriptionLineItem(
+  client$: FlexpriceCore,
+  request: UpdateSubscriptionLineItemRequest,
+  options?: RequestOptions,
+): APIPromise<
+  Result<
+    Response,
+    | APIError
+    | SDKValidationError
+    | UnexpectedClientError
+    | InvalidRequestError
+    | RequestAbortedError
+    | RequestTimeoutError
+    | ConnectionError
+  >
+> {
+  return new APIPromise($do(
+    client$,
+    request,
+    options,
+  ));
+}
+
+async function $do(
+  client$: FlexpriceCore,
+  request: UpdateSubscriptionLineItemRequest,
+  options?: RequestOptions,
+): Promise<
+  [
+    Result<
+      Response,
+      | APIError
+      | SDKValidationError
+      | UnexpectedClientError
+      | InvalidRequestError
+      | RequestAbortedError
+      | RequestTimeoutError
+      | ConnectionError
+    >,
+    APICall,
+  ]
+> {
+  const parsed$ = safeParse(
+    request,
+    (value$) => UpdateSubscriptionLineItemRequest$zodSchema.parse(value$),
+    "Input validation failed",
+  );
+  if (!parsed$.ok) {
+    return [parsed$, { status: "invalid" }];
+  }
+  const payload$ = parsed$.value;
+  const body$ = encodeJSON("body", payload$.body, { explode: true });
+
+  const pathParams$ = {
+    id: encodeSimple("id", payload$.id, {
+      explode: false,
+      charEncoding: "percent",
+    }),
+  };
+  const path$ = pathToFunc("/subscriptions/lineitems/{id}")(
+    pathParams$,
+  );
+
+  const headers$ = new Headers(compactMap({
+    "Content-Type": "application/json",
+    Accept: "application/json",
+  }));
+  const securityInput = await extractSecurity(client$._options.security);
+  const requestSecurity = resolveGlobalSecurity(securityInput);
+
+  const context = {
+    options: client$._options,
+    baseURL: options?.serverURL ?? client$._baseURL ?? "",
+    operationID: "updateSubscriptionLineItem",
+    oAuth2Scopes: null,
+    resolvedSecurity: requestSecurity,
+    securitySource: client$._options.security,
+    retryConfig: options?.retries
+      || client$._options.retryConfig
+      || { strategy: "none" },
+    retryCodes: options?.retryCodes || [
+      "429",
+      "500",
+      "502",
+      "503",
+      "504",
+    ],
+  };
+
+  const requestRes = client$._createRequest(context, {
+    security: requestSecurity,
+    method: "PUT",
+    baseURL: options?.serverURL,
+    path: path$,
+    headers: headers$,
+    body: body$,
+    userAgent: client$._options.userAgent,
+    timeoutMs: options?.timeoutMs || client$._options.timeoutMs
+      || -1,
+  }, options);
+  if (!requestRes.ok) {
+    return [requestRes, { status: "invalid" }];
+  }
+  const req$ = requestRes.value;
+
+  const doResult = await client$._do(req$, {
+    context,
+    errorCodes: [],
+    retryConfig: context.retryConfig,
+    retryCodes: context.retryCodes,
+  });
+  if (!doResult.ok) {
+    return [doResult, { status: "request-error", request: req$ }];
+  }
+  return [doResult, {
+    status: "complete",
+    "request": req$,
+    response: doResult.value,
+  }];
+}

package/src/lib/config.ts

@@ -69,8 +69,8 @@ export function serverURLFromOptions(options: SDKOptions): URL | null {
 export const SDK_METADATA = {
   language: "typescript",
   openapiDocVersion: "1.0",
-  sdkVersion: "2.0.6",
-  genVersion: "2.862.0",
+  sdkVersion: "2.0.8",
+  genVersion: "2.866.2",
   userAgent:
-    "speakeasy-sdk/mcp-typescript 2.0.6 2.862.0 1.0 @flexprice/mcp-server",
+    "speakeasy-sdk/mcp-typescript 2.0.8 2.866.2 1.0 @flexprice/mcp-server",
 } as const;

package/src/lib/files.ts

@@ -80,3 +80,25 @@ export function getContentTypeFromFileName(fileName: string): string | null {
 
   return mimeTypes[ext] || null;
 }
+
+/**
+ * Creates a Blob from file content with the given MIME type.
+ *
+ * Node.js Buffers are Uint8Array subclasses that may share a pooled
+ * ArrayBuffer (byteOffset > 0, byteLength < buffer.byteLength). Passing
+ * such a Buffer directly to `new Blob([buf])` can include the entire
+ * underlying pool on some runtimes, producing a Blob with extra bytes
+ * that corrupts multipart uploads.
+ *
+ * Copying into a standalone Uint8Array ensures the Blob receives only the
+ * intended bytes regardless of runtime behaviour.
+ */
+export function bytesToBlob(
+  content: Uint8Array<ArrayBufferLike> | ArrayBuffer | Blob | string,
+  contentType: string,
+): Blob {
+  if (content instanceof Uint8Array) {
+    return new Blob([new Uint8Array(content)], { type: contentType });
+  }
+  return new Blob([content as BlobPart], { type: contentType });
+}

package/src/mcp-server/build.mts

@@ -1,7 +1,7 @@
 /// <reference types="bun-types" />
 
 import { build } from "bun";
-import { chmod, readFile, writeFile } from "node:fs/promises";
+import { chmod, cp, mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
 import { packExtension } from "@anthropic-ai/mcpb";
 import { join } from "node:path";
 import { createMCPServer } from "./server.ts";
@@ -45,10 +45,10 @@ export const toolNames: Array<{ name: string; description: string }>= ${JSON.str
   await build({
     entrypoints: [entrypoint],
     outdir: destinationDir,
-    sourcemap: "linked",
+    sourcemap: shouldPack ? "none" : "linked",
     target: "node",
     format: "esm",
-    minify: false,
+    minify: shouldPack,
     throw: true,
     banner: "#!/usr/bin/env node",
   });
@@ -59,11 +59,32 @@ export const toolNames: Array<{ name: string; description: string }>= ${JSON.str
 
   // Build the MCP bundle file
   if (shouldPack) {
+    // Stage only the files needed for distribution to avoid bloated bundles.
+    // Without this, packExtension would include node_modules and source files.
+    const stageDir = ".mcpb-stage";
+    await mkdir(join(stageDir, "bin"), { recursive: true });
+    await cp(
+      join(destinationDir, "mcp-server.js"),
+      join(stageDir, "bin", "mcp-server.js"),
+    );
+    await cp("manifest.json", join(stageDir, "manifest.json"));
+
+    // Copy icon and screenshot assets if they exist
+    const assetExts = [".png", ".jpg", ".jpeg", ".gif", ".webp"];
+    for (const file of await readdir(".")) {
+      if (assetExts.some((ext) => file.toLowerCase().endsWith(ext))) {
+        await cp(file, join(stageDir, file));
+      }
+    }
+
     await packExtension({
-      extensionPath: ".",
+      extensionPath: stageDir,
       outputPath: "./mcp-server.mcpb",
       silent: false,
     });
+
+    // Clean up staging directory
+    await rm(stageDir, { recursive: true, force: true });
   }
 }
 

package/src/mcp-server/cli/serve/command.ts

@@ -6,6 +6,7 @@ import { buildCommand } from "@stricli/core";
 import { numberParser } from "@stricli/core";
 import * as z from "zod";
 import { consoleLoggerLevels } from "../../console-logger.js";
+import { mcpScopes } from "../../scopes.js";
 
 export const serveCommand = buildCommand({
   loader: async () => {
@@ -43,6 +44,13 @@ export const serveCommand = buildCommand({
         values: ["dynamic"],
         optional: true,
       },
+      scope: {
+        kind: "enum",
+        brief: "Mount tools/resources that match given scope (repeatable flag)",
+        values: mcpScopes,
+        variadic: true,
+        optional: true,
+      },
       "api-key-auth": {
         kind: "parsed",
         brief: "Sets the ApiKeyAuth auth field for the API",

package/src/mcp-server/cli/serve/impl.ts

@@ -65,6 +65,7 @@ async function startStreamableHTTP(cliFlags: ServeCommandFlags) {
       logger,
       allowedTools: cliFlags.tool,
       dynamic: cliFlags.mode === "dynamic",
+      scopes: cliFlags.scope,
       serverURL: cliFlags["server-url"],
       getSDK: () =>
         buildSDK(headers, cliFlags, cliFlags["disable-static-auth"], logger),

package/src/mcp-server/cli/start/command.ts

@@ -6,6 +6,7 @@ import { buildCommand } from "@stricli/core";
 import { numberParser } from "@stricli/core";
 import * as z from "zod";
 import { consoleLoggerLevels } from "../../console-logger.js";
+import { mcpScopes } from "../../scopes.js";
 
 export const startCommand = buildCommand({
   loader: async () => {
@@ -43,6 +44,13 @@ export const startCommand = buildCommand({
         values: ["dynamic"],
         optional: true,
       },
+      scope: {
+        kind: "enum",
+        brief: "Mount tools/resources that match given scope (repeatable flag)",
+        values: mcpScopes,
+        variadic: true,
+        optional: true,
+      },
       "api-key-auth": {
         kind: "parsed",
         brief: "Sets the ApiKeyAuth auth field for the API",

package/src/mcp-server/cli/start/impl.ts

@@ -52,6 +52,7 @@ async function startStdio(flags: StartCommandFlags) {
     logger,
     allowedTools: flags.tool,
     dynamic: flags.mode === "dynamic",
+    scopes: flags.scope,
     security: { ApiKeyAuth: flags["api-key-auth"] ?? "" },
     serverURL: flags["server-url"],
     serverIdx: flags["server-index"],
@@ -102,6 +103,7 @@ async function startSSE(cliFlags: StartCommandFlags) {
       logger,
       allowedTools: flags.tool,
       dynamic: flags.mode === "dynamic",
+      scopes: flags.scope,
       security: { ApiKeyAuth: flags["api-key-auth"] ?? "" },
       serverURL: flags["server-url"],
       serverIdx: flags["server-index"],

package/src/mcp-server/flags.ts

@@ -3,6 +3,7 @@
  */
 
 import { SDKOptions } from "../lib/config.js";
+import { MCPScope } from "./scopes.js";
 
 /**
  * Base flags interface for MCP server configuration.
@@ -11,6 +12,7 @@ import { SDKOptions } from "../lib/config.js";
 export interface MCPServerFlags {
   readonly tool?: string[];
   readonly mode?: "dynamic" | undefined;
+  readonly scope?: MCPScope[];
   readonly "api-key-auth"?: string | undefined;
   readonly "server-url"?: string | undefined;
   readonly "server-index"?: SDKOptions["serverIdx"];

package/src/mcp-server/mcp-server.ts

@@ -21,7 +21,7 @@ const routes = buildRouteMap({
 export const app = buildApplication(routes, {
   name: "mcp",
   versionInfo: {
-    currentVersion: "2.0.6",
+    currentVersion: "2.0.8",
   },
 });
 

package/src/mcp-server/scopes.ts

@@ -2,6 +2,10 @@
  * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
  */
 
-export const mcpScopes = [] as const;
+export const mcpScopes = [
+  "delete",
+  "read",
+  "write",
+] as const;
 
 export type MCPScope = (typeof mcpScopes)[number];

package/src/mcp-server/server.ts

@@ -58,6 +58,31 @@ import { tool$pricesGetPrice } from "./tools/pricesGetPrice.js";
 import { tool$pricesGetPriceByLookupKey } from "./tools/pricesGetPriceByLookupKey.js";
 import { tool$pricesQueryPrice } from "./tools/pricesQueryPrice.js";
 import { tool$pricesUpdatePrice } from "./tools/pricesUpdatePrice.js";
+import { tool$subscriptionsActivateSubscription } from "./tools/subscriptionsActivateSubscription.js";
+import { tool$subscriptionsAddSubscriptionAddon } from "./tools/subscriptionsAddSubscriptionAddon.js";
+import { tool$subscriptionsCancelSubscription } from "./tools/subscriptionsCancelSubscription.js";
+import { tool$subscriptionsCancelSubscriptionSchedule } from "./tools/subscriptionsCancelSubscriptionSchedule.js";
+import { tool$subscriptionsCreateSubscription } from "./tools/subscriptionsCreateSubscription.js";
+import { tool$subscriptionsCreateSubscriptionLineItem } from "./tools/subscriptionsCreateSubscriptionLineItem.js";
+import { tool$subscriptionsDeleteSubscriptionLineItem } from "./tools/subscriptionsDeleteSubscriptionLineItem.js";
+import { tool$subscriptionsExecuteSubscriptionChange } from "./tools/subscriptionsExecuteSubscriptionChange.js";
+import { tool$subscriptionsGetSubscription } from "./tools/subscriptionsGetSubscription.js";
+import { tool$subscriptionsGetSubscriptionAddonAssociations } from "./tools/subscriptionsGetSubscriptionAddonAssociations.js";
+import { tool$subscriptionsGetSubscriptionEntitlements } from "./tools/subscriptionsGetSubscriptionEntitlements.js";
+import { tool$subscriptionsGetSubscriptionSchedule } from "./tools/subscriptionsGetSubscriptionSchedule.js";
+import { tool$subscriptionsGetSubscriptionUpcomingGrants } from "./tools/subscriptionsGetSubscriptionUpcomingGrants.js";
+import { tool$subscriptionsGetSubscriptionUsage } from "./tools/subscriptionsGetSubscriptionUsage.js";
+import { tool$subscriptionsGetSubscriptionV2 } from "./tools/subscriptionsGetSubscriptionV2.js";
+import { tool$subscriptionsListAllSubscriptionSchedules } from "./tools/subscriptionsListAllSubscriptionSchedules.js";
+import { tool$subscriptionsListSubscriptionPauses } from "./tools/subscriptionsListSubscriptionPauses.js";
+import { tool$subscriptionsListSubscriptionSchedules } from "./tools/subscriptionsListSubscriptionSchedules.js";
+import { tool$subscriptionsPauseSubscription } from "./tools/subscriptionsPauseSubscription.js";
+import { tool$subscriptionsPreviewSubscriptionChange } from "./tools/subscriptionsPreviewSubscriptionChange.js";
+import { tool$subscriptionsQuerySubscription } from "./tools/subscriptionsQuerySubscription.js";
+import { tool$subscriptionsRemoveSubscriptionAddon } from "./tools/subscriptionsRemoveSubscriptionAddon.js";
+import { tool$subscriptionsResumeSubscription } from "./tools/subscriptionsResumeSubscription.js";
+import { tool$subscriptionsUpdateSubscription } from "./tools/subscriptionsUpdateSubscription.js";
+import { tool$subscriptionsUpdateSubscriptionLineItem } from "./tools/subscriptionsUpdateSubscriptionLineItem.js";
 
 export function createMCPServer(deps: {
   logger: ConsoleLogger;
@@ -71,7 +96,7 @@ export function createMCPServer(deps: {
 }) {
   const server = new McpServer({
     name: "Flexprice",
-    version: "2.0.6",
+    version: "2.0.8",
   });
 
   const getClient = deps.getSDK || (() =>
@@ -160,6 +185,31 @@ export function createMCPServer(deps: {
   tool(tool$pricesGetPrice);
   tool(tool$pricesUpdatePrice);
   tool(tool$pricesDeletePrice);
+  tool(tool$subscriptionsCreateSubscription);
+  tool(tool$subscriptionsAddSubscriptionAddon);
+  tool(tool$subscriptionsRemoveSubscriptionAddon);
+  tool(tool$subscriptionsUpdateSubscriptionLineItem);
+  tool(tool$subscriptionsDeleteSubscriptionLineItem);
+  tool(tool$subscriptionsQuerySubscription);
+  tool(tool$subscriptionsGetSubscriptionUsage);
+  tool(tool$subscriptionsGetSubscription);
+  tool(tool$subscriptionsUpdateSubscription);
+  tool(tool$subscriptionsActivateSubscription);
+  tool(tool$subscriptionsGetSubscriptionAddonAssociations);
+  tool(tool$subscriptionsCancelSubscription);
+  tool(tool$subscriptionsExecuteSubscriptionChange);
+  tool(tool$subscriptionsPreviewSubscriptionChange);
+  tool(tool$subscriptionsGetSubscriptionEntitlements);
+  tool(tool$subscriptionsGetSubscriptionUpcomingGrants);
+  tool(tool$subscriptionsCreateSubscriptionLineItem);
+  tool(tool$subscriptionsPauseSubscription);
+  tool(tool$subscriptionsListSubscriptionPauses);
+  tool(tool$subscriptionsResumeSubscription);
+  tool(tool$subscriptionsGetSubscriptionV2);
+  tool(tool$subscriptionsListAllSubscriptionSchedules);
+  tool(tool$subscriptionsGetSubscriptionSchedule);
+  tool(tool$subscriptionsCancelSubscriptionSchedule);
+  tool(tool$subscriptionsListSubscriptionSchedules);
 
   if (deps.dynamic) {
     registerDynamicTools(deps.logger, server, getClient, toolMap, scopes);

package/src/mcp-server/tools/customersCreateCustomer.ts

@@ -15,6 +15,7 @@ export const tool$customersCreateCustomer: ToolDefinition<typeof args> = {
   description: `Create customer
 
 Use when onboarding a new billing customer (e.g. sign-up or CRM sync). Ideal for linking via external_customer_id to your app's user id.`,
+  scopes: ["write"],
   annotations: {
     "title": "",
     "destructiveHint": false,

package/src/mcp-server/tools/customersDeleteCustomer.ts

@@ -15,9 +15,10 @@ export const tool$customersDeleteCustomer: ToolDefinition<typeof args> = {
   description: `Delete customer
 
 Use when removing a customer (e.g. GDPR or churn). Returns 204 No Content on success.`,
+  scopes: ["delete"],
   annotations: {
     "title": "",
-    "destructiveHint": false,
+    "destructiveHint": true,
     "idempotentHint": false,
     "openWorldHint": false,
     "readOnlyHint": false,

package/src/mcp-server/tools/customersGetCustomer.ts

@@ -15,12 +15,13 @@ export const tool$customersGetCustomer: ToolDefinition<typeof args> = {
   description: `Get customer
 
 Use when you need to load a single customer (e.g. for a billing portal or to attach a subscription).`,
+  scopes: ["read"],
   annotations: {
     "title": "",
     "destructiveHint": false,
     "idempotentHint": false,
     "openWorldHint": false,
-    "readOnlyHint": false,
+    "readOnlyHint": true,
   },
   args,
   tool: async (client, args, ctx) => {

package/src/mcp-server/tools/customersGetCustomerByExternalId.ts

@@ -17,12 +17,13 @@ export const tool$customersGetCustomerByExternalId: ToolDefinition<
   description: `Get customer by external ID
 
 Use when resolving a customer by your app's id (e.g. from your user table). Ideal for integrations that key by external id.`,
+  scopes: ["read"],
   annotations: {
     "title": "",
     "destructiveHint": false,
     "idempotentHint": false,
     "openWorldHint": false,
-    "readOnlyHint": false,
+    "readOnlyHint": true,
   },
   args,
   tool: async (client, args, ctx) => {

package/src/mcp-server/tools/customersGetCustomerEntitlements.ts

@@ -17,12 +17,13 @@ export const tool$customersGetCustomerEntitlements: ToolDefinition<
   description: `Get customer entitlements
 
 Use when checking what a customer can access (e.g. feature gating or usage limits). Supports optional filters (feature_ids, subscription_ids).`,
+  scopes: ["read"],
   annotations: {
     "title": "",
     "destructiveHint": false,
     "idempotentHint": false,
     "openWorldHint": false,
-    "readOnlyHint": false,
+    "readOnlyHint": true,
   },
   args,
   tool: async (client, args, ctx) => {

package/src/mcp-server/tools/customersGetCustomerUpcomingGrants.ts

@@ -17,12 +17,13 @@ export const tool$customersGetCustomerUpcomingGrants: ToolDefinition<
   description: `Get upcoming credit grant applications
 
 Use when showing upcoming or pending credits for a customer (e.g. in a portal or for forecasting).`,
+  scopes: ["read"],
   annotations: {
     "title": "",
     "destructiveHint": false,
     "idempotentHint": false,
     "openWorldHint": false,
-    "readOnlyHint": false,
+    "readOnlyHint": true,
   },
   args,
   tool: async (client, args, ctx) => {