@fruggr/zendesk-mcp-server 2.22.3 → 2.24.0

package/README.md

@@ -83,7 +83,7 @@ differently.
 - Two deployment shapes, same auth story. Run it on your laptop as a stdio MCP
   server, or deploy it as a private remote MCP server reached over HTTP, with one
   Zendesk session per request and each client carrying its own user's token.
-- A lean stack: the official `@modelcontextprotocol/sdk` plus `zod`, speaking to
+- A lean stack: the official MCP TypeScript SDK (`@modelcontextprotocol/server`) plus `zod`, speaking to
   the Zendesk Support and Help Center (Guide) APIs.
 
 Look elsewhere when:
@@ -139,7 +139,7 @@ Signing in needs a Zendesk OAuth client, so register one first (next section).
 2. Create a **public** client:
    - **Identifier**: `<your-subdomain>_zendesk` (or set `ZENDESK_OAUTH_CLIENT_ID`)
    - **Redirect URL**: `http://localhost:27439/callback` (change the port to match
-     `ZENDESK_OAUTH_CALLBACK_PORT` / `--callback-port` if you override it; Zendesk
+     `OAUTH_CALLBACK_PORT` / `--callback-port` if you override it; Zendesk
      accepts several redirect URLs, one per line)
 
 If the client restricts its **allowed scopes**, it needs `read` — plus `write`
@@ -151,7 +151,7 @@ window and returns the authorize URL in a tool message. The call does not block
 waiting for sign-in, so authenticate in the browser and then retry the request.
 The token is persisted to an owner-only file and reused across restarts, so you
 don't authenticate again every time your MCP client respawns the server (path
-and overrides: [`ZENDESK_TOKEN_FILE`](docs/configuration.md#zendesk_token_file)).
+and overrides: [`OAUTH_TOKEN_FILE`](docs/configuration.md#oauth_token_file)).
 Several instances can run side by side — a read-write one and a `--read-only`
 one, say — without trading credentials.
 
@@ -326,7 +326,7 @@ to turn each piece off: **[docs/help-center-context.md](docs/help-center-context
 
 The complete reference for the CLI flags (`--mode`, `--namespace`,
 `--read-only`, `--transport`, `--public-url`, and so on) and the environment
-variables (`ZENDESK_SUBDOMAIN`, `ZENDESK_TOKEN_FILE`, `PUBLIC_URL`, the
+variables (`ZENDESK_SUBDOMAIN`, `OAUTH_TOKEN_FILE`, `PUBLIC_URL`, the
 attachment-vision caps) lives in
 **[docs/configuration.md](docs/configuration.md)**. Every variable has its own
 anchor, so you can deep-link a specific setting.

package/dist/index.js

@@ -9,7 +9,7 @@ import { dirname, join } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { parseArgs } from "node:util";
 import * as z from "zod/v4";
-import { McpServer, ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { McpServer, ResourceTemplate } from "@modelcontextprotocol/server";
 import * as cheerio from "cheerio";
 import { toHtml } from "hast-util-to-html";
 import rehypeParse from "rehype-parse";
@@ -21,8 +21,8 @@ import remarkParse from "remark-parse";
 import remarkRehype from "remark-rehype";
 import remarkStringify from "remark-stringify";
 import { unified } from "unified";
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/server/stdio";
+import { NodeStreamableHTTPServerTransport } from "@modelcontextprotocol/node";
 //#region src/utils/logger.ts
 const SEVERITY = {
 	debug: 0,
@@ -68,7 +68,7 @@ const sanitise = (fields) => {
 };
 const renderValue = (value) => {
 	if (typeof value === "string") return value;
-	if (typeof value === "number" || typeof value === "boolean" || value === null) return String(value);
+	if (typeof value === "number") return String(value);
 	try {
 		return JSON.stringify(value);
 	} catch {
@@ -118,25 +118,74 @@ const createLogger = (level) => {
 	};
 };
 //#endregion
+//#region src/utils/env.ts
+const LEGACY_NAMES = /* @__PURE__ */ new Map([
+	["OAUTH_TOKEN_FILE", "ZENDESK_TOKEN_FILE"],
+	["OAUTH_CALLBACK_PORT", "ZENDESK_OAUTH_CALLBACK_PORT"],
+	["LISTEN_HOST", "HOST"],
+	["RESPONSE_CHARACTER_LIMIT", "ZENDESK_CHARACTER_LIMIT"],
+	["RESPONSE_MAX_BYTES", "ZENDESK_MAX_RESPONSE_BYTES"],
+	["ATTACHMENT_MAX_BYTES", "ZENDESK_MAX_ATTACHMENT_BYTES"],
+	["EMBEDDED_IMAGES_MAX", "ZENDESK_MAX_EMBEDDED_IMAGES"],
+	["COMMENT_MAX_PAGES", "ZENDESK_MAX_COMMENT_PAGES"],
+	["TICKET_FIELD_SCAN_MAX_PAGES", "ZENDESK_TICKET_FIELD_SCAN_MAX_PAGES"],
+	["ARTICLE_RESOURCES_SCAN_MAX_PAGES", "ZENDESK_ARTICLE_RESOURCES_SCAN_MAX_PAGES"],
+	["REORDER_CONFIRM_THRESHOLD", "ZENDESK_REORDER_CONFIRM_THRESHOLD"]
+]);
+const warned = /* @__PURE__ */ new Set();
+const warnDeprecated = (legacy, current) => {
+	if (warned.has(legacy)) return;
+	warned.add(legacy);
+	try {
+		console.error(`[zendesk-mcp] [warn] deprecated_env_var name=${legacy} replacement=${current} removal=3.0.0`);
+	} catch {}
+};
+/**
+* Reads `name`, falling back to the legacy name it replaced. `name` in the result
+* is the variable the value came from, so an error about it names what the
+* operator actually set.
+*/
+const readEnv = (name) => {
+	const value = process.env[name];
+	const legacy = LEGACY_NAMES.get(name);
+	if (legacy === void 0) return {
+		name,
+		value
+	};
+	const legacyValue = process.env[legacy];
+	if (legacyValue === void 0) return {
+		name,
+		value
+	};
+	warnDeprecated(legacy, name);
+	return value === void 0 ? {
+		name: legacy,
+		value: legacyValue
+	} : {
+		name,
+		value
+	};
+};
+//#endregion
 //#region src/constants.ts
 const positiveIntEnv = (name, fallback) => {
-	const raw = process.env[name];
+	const raw = readEnv(name).value;
 	if (raw === void 0 || raw.trim() === "") return fallback;
 	const parsed = Number(raw);
 	return Number.isSafeInteger(parsed) && parsed > 0 ? parsed : fallback;
 };
-const CHARACTER_LIMIT = positiveIntEnv("ZENDESK_CHARACTER_LIMIT", 25e3);
-const ARTICLE_RESOURCES_SCAN_MAX_PAGES = positiveIntEnv("ZENDESK_ARTICLE_RESOURCES_SCAN_MAX_PAGES", 20);
-const MAX_ATTACHMENT_BYTES = positiveIntEnv("ZENDESK_MAX_ATTACHMENT_BYTES", 5242880);
-const MAX_EMBEDDED_IMAGE_COUNT = positiveIntEnv("ZENDESK_MAX_EMBEDDED_IMAGES", 10);
+const CHARACTER_LIMIT = positiveIntEnv("RESPONSE_CHARACTER_LIMIT", 25e3);
+const ARTICLE_RESOURCES_SCAN_MAX_PAGES = positiveIntEnv("ARTICLE_RESOURCES_SCAN_MAX_PAGES", 20);
+const MAX_ATTACHMENT_BYTES = positiveIntEnv("ATTACHMENT_MAX_BYTES", 5242880);
+const MAX_EMBEDDED_IMAGE_COUNT = positiveIntEnv("EMBEDDED_IMAGES_MAX", 10);
 const STDIO_MAX_MESSAGE_BYTES = 10485760;
 const MESSAGE_CONTENT_BUDGET_BYTES = 10420224;
-const MAX_RESPONSE_BYTES = Math.min(positiveIntEnv("ZENDESK_MAX_RESPONSE_BYTES", MESSAGE_CONTENT_BUDGET_BYTES), MESSAGE_CONTENT_BUDGET_BYTES);
+const MAX_RESPONSE_BYTES = Math.min(positiveIntEnv("RESPONSE_MAX_BYTES", MESSAGE_CONTENT_BUDGET_BYTES), MESSAGE_CONTENT_BUDGET_BYTES);
 const MAX_BASE64_INPUT_CHARS = MESSAGE_CONTENT_BUDGET_BYTES;
 const MAX_BASE64_INPUT_MB = Number.parseFloat((MAX_BASE64_INPUT_CHARS / 4 * 3 / 1048576).toFixed(2));
-const MAX_COMMENT_PAGES = positiveIntEnv("ZENDESK_MAX_COMMENT_PAGES", 10);
-const TICKET_FIELD_SCAN_MAX_PAGES = positiveIntEnv("ZENDESK_TICKET_FIELD_SCAN_MAX_PAGES", 10);
-const REORDER_CONFIRM_THRESHOLD = positiveIntEnv("ZENDESK_REORDER_CONFIRM_THRESHOLD", 20);
+const MAX_COMMENT_PAGES = positiveIntEnv("COMMENT_MAX_PAGES", 10);
+const TICKET_FIELD_SCAN_MAX_PAGES = positiveIntEnv("TICKET_FIELD_SCAN_MAX_PAGES", 10);
+const REORDER_CONFIRM_THRESHOLD = positiveIntEnv("REORDER_CONFIRM_THRESHOLD", 20);
 const getBaseUrl = (subdomain) => `https://${subdomain}.zendesk.com/api/v2`;
 const getHelpCenterBaseUrl = (subdomain) => `https://${subdomain}.zendesk.com/api/v2/help_center`;
 const getOAuthUrls = (subdomain) => ({
@@ -178,7 +227,7 @@ const supportedScopes = (readOnly) => scopeTokens(requestedScope(readOnly));
 * Whether a grant still covers what this process needs: a flat subset test.
 * Coverage, not equality, so a token Zendesk granted wider than requested stays
 * usable. A non-string `granted` is a pre-#283 record, i.e. `read write` — only
-* reachable now through a `ZENDESK_TOKEN_FILE` aimed at one by hand, since the
+* reachable now through a `OAUTH_TOKEN_FILE` aimed at one by hand, since the
 * default layout no longer names those files. No scope hierarchy: granular
 * scopes (#284) replace this.
 */
@@ -207,7 +256,7 @@ const detectWsl = () => {
 * (`docs/decisions/token-file-keying.md`). The `(EADDRINUSE)` marker and `code`
 * are kept for diagnostics/tests.
 */
-const callbackPortInUseError = (port, cause) => Object.assign(/* @__PURE__ */ new Error(`Cannot start the Zendesk OAuth sign-in: local callback port ${port} is already in use. Another instance of this server is most likely signing in right now: finish that browser window, then retry. If an unrelated program holds the port, set ZENDESK_OAUTH_CALLBACK_PORT (or --callback-port) to a free port, then register http://localhost:<port>/callback as a redirect URL in your Zendesk OAuth client. (EADDRINUSE)`), {
+const callbackPortInUseError = (port, cause) => Object.assign(/* @__PURE__ */ new Error(`Cannot start the Zendesk OAuth sign-in: local callback port ${port} is already in use. Another instance of this server is most likely signing in right now: finish that browser window, then retry. If an unrelated program holds the port, set OAUTH_CALLBACK_PORT (or --callback-port) to a free port, then register http://localhost:<port>/callback as a redirect URL in your Zendesk OAuth client. (EADDRINUSE)`), {
 	code: "EADDRINUSE",
 	cause
 });
@@ -500,11 +549,12 @@ const keyDigest = (key) => createHash("sha256").update(JSON.stringify([
 * their own record instead of clobbering a shared file. Why that triple, and
 * why no migration from the old subdomain-only layout:
 * `docs/decisions/token-file-keying.md`.
-* `ZENDESK_TOKEN_FILE` overrides with an explicit path — the way to separate
+* `OAUTH_TOKEN_FILE` overrides with an explicit path — the way to separate
 * two Zendesk accounts that share a subdomain, client and scope.
 */
 const resolveTokenPath = (key) => {
-	const override = process.env["ZENDESK_TOKEN_FILE"];
+	const { name, value: override } = readEnv("OAUTH_TOKEN_FILE");
+	if (override === "") throw new Error(`Empty ${name}. Set it to a value, or unset it entirely.`);
 	if (override) return override;
 	const readable = [
 		key.subdomain,
@@ -791,11 +841,7 @@ const ConfigSchema = z.object({
 		abort: true
 	}).refine((scheme) => {
 		const uri = `${scheme}://topology`;
-		try {
-			return new URL(uri).toString() === uri;
-		} catch {
-			return false;
-		}
+		return new URL(uri).toString() === uri;
 	}, { message: "Invalid HC_RESOURCE_SCHEME / --hc-resource-scheme value. WHATWG-special schemes (http, https, ws, wss, ftp, file) do not survive URL normalization and would make the resource unreadable; pick a custom scheme such as \"wiki\"." }).default("zendesk-hc"),
 	/**
 	* Dev-only (stdio): expose the `reload_tools` tool, which re-imports the tool
@@ -832,11 +878,15 @@ const parsePort = (raw, label) => {
 	if (!DIGITS_ONLY.test(raw)) throw new Error(`Invalid ${label} value. Expected an integer 0-65535.`);
 	return Number(raw);
 };
-const parsePortEnv = (raw, label) => raw === void 0 ? void 0 : parsePort(raw, label);
-const requireNonEmptyEnv = (name) => {
-	const raw = process.env[name];
-	if (raw === "") throw new Error(`Empty ${name}. Set it to a value, or unset it entirely.`);
-	return raw;
+const readNonEmptyEnv = (name) => {
+	const env = readEnv(name);
+	if (env.value === "") throw new Error(`Empty ${env.name}. Set it to a value, or unset it entirely.`);
+	return env;
+};
+const requireNonEmptyEnv = (name) => readNonEmptyEnv(name).value;
+const portEnv = (name) => {
+	const env = readNonEmptyEnv(name);
+	return env.value === void 0 ? void 0 : parsePort(env.value, env.name);
 };
 const CLI_OPTIONS = {
 	mode: { type: "string" },
@@ -910,8 +960,8 @@ const resolveTransportSettings = (cli) => {
 	const corsFromEnv = (process.env["CORS_ORIGIN"] ?? "").split(",").map((s) => s.trim()).filter((s) => s.length > 0);
 	return {
 		transport: cli.transport ?? requireNonEmptyEnv("TRANSPORT") ?? "stdio",
-		host: cli.host ?? requireNonEmptyEnv("HOST") ?? "0.0.0.0",
-		port: cli.port ?? parsePortEnv(requireNonEmptyEnv("PORT"), "PORT") ?? 3e3,
+		host: cli.host ?? requireNonEmptyEnv("LISTEN_HOST") ?? "0.0.0.0",
+		port: cli.port ?? portEnv("PORT") ?? 3e3,
 		publicUrl: cli.publicUrl ?? requireNonEmptyEnv("PUBLIC_URL"),
 		corsOrigins: [...cli.corsOrigins ?? [], ...corsFromEnv]
 	};
@@ -922,7 +972,7 @@ const loadConfig = (argv = process.argv.slice(2)) => {
 	const oauthClientId = requireNonEmptyEnv("ZENDESK_OAUTH_CLIENT_ID") ?? `${subdomain}_zendesk`;
 	const mode = cli.tools?.length ? "all" : cli.mode ?? "namespace";
 	const namespaces = cli.namespaces ?? (cli.tools?.length ? [...Namespace.options] : void 0);
-	const callbackPort = cli.callbackPort ?? parsePortEnv(requireNonEmptyEnv("ZENDESK_OAUTH_CALLBACK_PORT"), "ZENDESK_OAUTH_CALLBACK_PORT");
+	const callbackPort = cli.callbackPort ?? portEnv("OAUTH_CALLBACK_PORT");
 	const hcResourceScheme = cli.hcResourceScheme ?? requireNonEmptyEnv("HC_RESOURCE_SCHEME");
 	return ConfigSchema.parse({
 		subdomain,
@@ -1331,8 +1381,7 @@ const htmlToMdProcessor = unified().use(rehypeParse, { fragment: true }).use(reh
 	pre: keepAsHtml
 } }).use(remarkGfm).use(remarkStringify, {
 	bullet: "-",
-	emphasis: "_",
-	fences: true
+	emphasis: "_"
 });
 const mdToHtmlProcessor = unified().use(remarkParse).use(remarkGfm).use(remarkRehype, { allowDangerousHtml: true }).use(rehypeRaw).use(rehypeStringify);
 const htmlToMarkdown = (html) => {
@@ -1450,6 +1499,12 @@ const withName = (id, names) => {
 	const name = names.get(n);
 	return name ? `${name} (${id})` : String(id);
 };
+const formatSubscribersBlock = (ticket, names) => {
+	const line = (label, ids) => `- **${label}**: ${ids.length > 0 ? ids.map((id) => withName(id, names)).join(", ") : "none"}`;
+	const rows = [Array.isArray(ticket.follower_ids) ? line("Followers", ticket.follower_ids) : "", Array.isArray(ticket.email_cc_ids) ? line("Email CCs", ticket.email_cc_ids) : ""].filter(Boolean);
+	if (rows.length === 0) return "";
+	return `\n\n${["### Subscribers", ...rows].join("\n")}`;
+};
 const formatComment = (comment, authors) => {
 	const lines = [`### ${comment.public ? "Public comment" : "Internal note"} (id ${comment.id}) by ${withName(comment.author_id, authors ?? /* @__PURE__ */ new Map())}`, `*${comment.created_at}*`];
 	if (comment.attachments?.length) {
@@ -2042,9 +2097,9 @@ const NAMESPACE_LABELS = {
 //#endregion
 //#region src/utils/article-order.ts
 const hasPositionInversion = (order) => {
-	for (let i = 0; i < order.length - 1; i += 1) {
-		const here = order[i];
-		const next = order[i + 1];
+	for (let i = 1; i < order.length; i += 1) {
+		const here = order[i - 1];
+		const next = order[i];
 		if (here && next && here.position > next.position) return true;
 	}
 	return false;
@@ -2296,7 +2351,7 @@ const localePrefix = (locale) => locale ? `/${locale}` : "";
 const articleListPath = (sectionId, locale) => `${localePrefix(locale)}${sectionId ? `/sections/${sectionId}` : ""}/articles`;
 const sectionListPath = (categoryId, locale) => `${localePrefix(locale)}${categoryId ? `/categories/${categoryId}` : ""}/sections`;
 const scanCostNote = (truncated, pagesScanned, cost) => {
-	if (truncated) return `\n\n_Note: the scan hit its ${ARTICLE_RESOURCES_SCAN_MAX_PAGES}-page cap (${cost}), so promoted articles deeper in the catalog may be missing. This call is costly on this Help Center — avoid repeating it; raise ZENDESK_ARTICLE_RESOURCES_SCAN_MAX_PAGES to widen coverage._`;
+	if (truncated) return `\n\n_Note: the scan hit its ${ARTICLE_RESOURCES_SCAN_MAX_PAGES}-page cap (${cost}), so promoted articles deeper in the catalog may be missing. This call is costly on this Help Center — avoid repeating it; raise ARTICLE_RESOURCES_SCAN_MAX_PAGES to widen coverage._`;
 	if (pagesScanned > 1) return `\n\n_Note: this scan cost ${cost}; this tool performs a fresh scan every call (no caching), so avoid calling it again right away._`;
 	return "";
 };
@@ -2521,7 +2576,7 @@ const createHelpCenterTools = (ctx) => {
 			namespace: "help_center",
 			readOnly: true,
 			title: "List Promoted Help Center Articles",
-			description: "List the promoted (\"featured\") Help Center articles — the small, editorially-curated set surfaced at the top of their sections. Returns metadata only (no body); use get_article for full content. COST: the Help Center API has no server-side promoted filter, so this scans article pages (one Zendesk API request per page, up to ZENDESK_ARTICLE_RESOURCES_SCAN_MAX_PAGES, default 20) and filters client-side — potentially costly on a large Help Center. Each call performs a fresh, uncached scan, so avoid calling it repeatedly. On a very large Help Center some promoted articles may be omitted, and both the omission and the number of pages scanned are flagged in the output. Lists the default locale. To promote or unpromote an article, use update_article with `promoted` (requires Help Center admin / Guide admin rights).",
+			description: "List the promoted (\"featured\") Help Center articles — the small, editorially-curated set surfaced at the top of their sections. Returns metadata only (no body); use get_article for full content. COST: the Help Center API has no server-side promoted filter, so this scans article pages (one Zendesk API request per page, up to ARTICLE_RESOURCES_SCAN_MAX_PAGES, default 20) and filters client-side — potentially costly on a large Help Center. Each call performs a fresh, uncached scan, so avoid calling it repeatedly. On a very large Help Center some promoted articles may be omitted, and both the omission and the number of pages scanned are flagged in the output. Lists the default locale. To promote or unpromote an article, use update_article with `promoted` (requires Help Center admin / Guide admin rights).",
 			inputSchema: z.object({}),
 			annotations: {
 				readOnlyHint: true,
@@ -2899,7 +2954,7 @@ const createHelpCenterTools = (ctx) => {
 				]).describe("Where to move the article relative to its section siblings: \"top\" (becomes first), \"bottom\" (becomes last), or \"before\"/\"after\" a specific reference article. \"before\" and \"after\" require reference_article_id."),
 				reference_article_id: z.number().int().optional().describe("The sibling article to position next to when target is \"before\" or \"after\" (numeric id from list_articles). Must belong to the same section and differ from article_id; leave it unset for \"top\" or \"bottom\"."),
 				normalize: z.boolean().default(false).describe("When true, also renumber every article in the section to contiguous positions (0, 1, 2, …) so the stored positions stay tidy. Defaults to false, which writes the fewest positions possible and lets gaps remain. Either way the confirmation threshold still applies."),
-				confirm: z.boolean().default(false).describe("Safety guard for large reorders. When the move would rewrite more article positions than the configured threshold (ZENDESK_REORDER_CONFIRM_THRESHOLD, default 20), the tool refuses and reports the count until you pass true here. Has no effect on small reorders.")
+				confirm: z.boolean().default(false).describe("Safety guard for large reorders. When the move would rewrite more article positions than the configured threshold (REORDER_CONFIRM_THRESHOLD, default 20), the tool refuses and reports the count until you pass true here. Has no effect on small reorders.")
 			}),
 			annotations: {
 				readOnlyHint: false,
@@ -3382,7 +3437,7 @@ const END_USER_FORM_PARAMS = {
 * form invisible or a required field unenforced, and the caller then gets a
 * confidently wrong "no such form" or an opaque Zendesk 422.
 */
-const fetchAllPages = async ({ subdomain, token, tool, path, extract, params = {}, maxPages = TICKET_FIELD_SCAN_MAX_PAGES, capEnvVar = "ZENDESK_TICKET_FIELD_SCAN_MAX_PAGES", onPage, forbiddenHint }) => {
+const fetchAllPages = async ({ subdomain, token, tool, path, extract, params = {}, maxPages = TICKET_FIELD_SCAN_MAX_PAGES, capEnvVar = "TICKET_FIELD_SCAN_MAX_PAGES", onPage, forbiddenHint }) => {
 	const items = [];
 	let page = 1;
 	while (true) {
@@ -3439,7 +3494,7 @@ const fetchAllRequestComments = async (subdomain, token, requestId) => {
 			extract: (response) => response.comments,
 			params: { include: "users" },
 			maxPages: MAX_COMMENT_PAGES,
-			capEnvVar: "ZENDESK_MAX_COMMENT_PAGES",
+			capEnvVar: "COMMENT_MAX_PAGES",
 			forbiddenHint: OTHER_USERS_REQUEST_HINT,
 			onPage: (response) => {
 				for (const user of response.users ?? []) authors.set(user.id, user);
@@ -4097,6 +4152,37 @@ const collectAuditIds = (audits) => {
 		groupIds: [...groupIds]
 	};
 };
+const SUBSCRIBER_PARAMS = [{
+	param: "followers",
+	field: "follower_ids"
+}, {
+	param: "email_ccs",
+	field: "email_cc_ids"
+}];
+const toSubscriberActions = (edit) => {
+	if (!edit) return void 0;
+	const removed = new Set(edit.remove);
+	const actions = [...[...new Set(edit.add)].filter((id) => !removed.has(id)).map((id) => ({
+		user_id: id,
+		action: "put"
+	})), ...[...removed].map((id) => ({
+		user_id: id,
+		action: "delete"
+	}))];
+	return actions.length > 0 ? actions : void 0;
+};
+const unappliedActions = (actions, ids) => {
+	const present = Array.isArray(ids) ? new Set(ids) : void 0;
+	return actions.filter(({ user_id, action }) => {
+		if (action === "put") return !present?.has(user_id);
+		return present === void 0 || present.has(user_id);
+	});
+};
+const formatSubscriberOutcome = (sent, after) => {
+	const unconfirmed = SUBSCRIBER_PARAMS.flatMap(({ param, field }) => unappliedActions(sent[param] ?? [], after[field]).map(({ user_id, action }) => `${param} ${action === "put" ? "add" : "remove"} ${user_id}`));
+	if (unconfirmed.length === 0) return "";
+	return `\n\nUnconfirmed: ${unconfirmed.join(", ")}. Zendesk applies followers and email CCs silently: an id it does not know is ignored, and both are ignored entirely when the account's "CCs and followers" setting is off. Check that each id exists with get_user, and the account setting with a Zendesk admin.`;
+};
 const resolveEntityNames = async (subdomain, token, path, key, ids) => {
 	const map = /* @__PURE__ */ new Map();
 	for (const batch of chunk(ids, 100)) try {
@@ -4113,13 +4199,14 @@ const resolveAuditNames = async (subdomain, token, userIds, groupIds) => {
 		groups
 	};
 };
-const resolveCommentAuthors = async (subdomain, token, comments, sideloaded = []) => {
-	const authors = new Map(sideloaded.map((user) => [user.id, user.name]));
-	const missing = [...new Set(comments.map((comment) => comment.author_id))].filter((id) => id > 0 && !authors.has(id));
-	if (missing.length === 0) return authors;
-	for (const [id, name] of await resolveUserNames(subdomain, token, missing)) authors.set(id, name);
-	return authors;
+const resolveUserDisplayNames = async (subdomain, token, ids, sideloaded = []) => {
+	const names = new Map(sideloaded.map((user) => [user.id, user.name]));
+	const missing = [...new Set(ids)].filter((id) => id > 0 && !names.has(id));
+	if (missing.length === 0) return names;
+	for (const [id, name] of await resolveUserNames(subdomain, token, missing)) names.set(id, name);
+	return names;
 };
+const collectSubscriberIds = (ticket) => [...ticket.follower_ids ?? [], ...ticket.email_cc_ids ?? []];
 const DIFF_SKIP_KEYS = /* @__PURE__ */ new Set([
 	"comment",
 	"fields",
@@ -4189,13 +4276,17 @@ const formatMacroPreviewDiff = (ticketId, macroId, before, result) => {
 };
 const createTicketTools = (ctx) => {
 	const { subdomain, getToken } = ctx;
+	const subscriberIdList = (description, max) => {
+		const ids = z.array(z.number().int().positive());
+		return (max === void 0 ? ids : ids.max(max)).optional().describe(description);
+	};
 	return [
 		{
 			name: "get_ticket",
 			namespace: "tickets",
 			readOnly: true,
 			title: "Get Zendesk Ticket",
-			description: "Retrieve a Zendesk ticket by ID, including its live SLA state (per-metric stage and breach countdown) when an SLA policy applies, plus its comments if requested. Returns ticket details (subject, status, priority, assignee, tags, description) and optionally all comments/internal notes. The per-ticket Show endpoint exposes no SLA, so the SLA block is resolved via a scoped search and may be absent for a very high-volume requester or a just-updated ticket; SLA targets and policy conditions live in list_sla_policies. This returns the ticket as it stands now; for the history of changes behind that state (who changed what, and when), use get_ticket_history. The comment thread is appended in one block — the first page of comments Zendesk returns, cut past the response character limit — so on a long ticket read it with list_ticket_comments, which pages the comments and returns the newest first.",
+			description: "Retrieve a Zendesk ticket by ID, including its live SLA state (per-metric stage and breach countdown) when an SLA policy applies, plus its comments if requested. Returns ticket details (subject, status, priority, assignee, tags, description) and optionally all comments/internal notes. It also lists the followers and email CCs on the ticket, resolved to names, which is how you tell who a ticket update actually reaches: followers are notified of updates including internal notes, email CCs take part in the public correspondence, and being the requester makes someone neither. Both lists come back empty on an account where the \"CCs and followers\" setting is not enabled in Zendesk. The per-ticket Show endpoint exposes no SLA, so the SLA block is resolved via a scoped search and may be absent for a very high-volume requester or a just-updated ticket; SLA targets and policy conditions live in list_sla_policies. This returns the ticket as it stands now; for the history of changes behind that state (who changed what, and when), use get_ticket_history. The comment thread is appended in one block — the first page of comments Zendesk returns, cut past the response character limit — so on a long ticket read it with list_ticket_comments, which pages the comments and returns the newest first.",
 			inputSchema: z.object({
 				ticket_id: z.number().int().describe("Ticket ID — the numeric id of the ticket to fetch. Obtain it from search_tickets or list_tickets."),
 				include_comments: z.boolean().default(false).describe("When true, appends the full public comment and internal note thread to the response. Defaults to false to keep the payload small; enable it when you need the conversation, not just the ticket fields. On a long thread prefer list_ticket_comments — this flag appends one unpaginated block, so comments past Zendesk's first page are absent and the rest is cut at the response character limit.")
@@ -4210,15 +4301,14 @@ const createTicketTools = (ctx) => {
 				const { ticket_id, include_comments } = params;
 				const token = await getToken();
 				const { ticket } = await zendeskGet(subdomain, token, `/tickets/${ticket_id}`);
-				let text = formatTicket(ticket) + formatSlaBlock(await fetchTicketSla(subdomain, token, ticket));
-				if (include_comments) {
-					const { comments, users } = await zendeskGet(subdomain, token, `/tickets/${ticket_id}/comments`, {
-						include: "users",
-						include_inline_images: "true"
-					});
-					const authors = await resolveCommentAuthors(subdomain, token, comments ?? [], users);
-					text += `\n\n---\n# Comments\n\n${(comments ?? []).map((comment) => formatComment(comment, authors)).join("\n\n")}`;
-				}
+				const [sla, thread] = await Promise.all([fetchTicketSla(subdomain, token, ticket), include_comments ? zendeskGet(subdomain, token, `/tickets/${ticket_id}/comments`, {
+					include: "users",
+					include_inline_images: "true"
+				}) : void 0]);
+				const comments = thread?.comments ?? [];
+				const names = await resolveUserDisplayNames(subdomain, token, [...collectSubscriberIds(ticket), ...comments.map((comment) => comment.author_id)], thread?.users);
+				const commentsBlock = thread ? `\n\n---\n# Comments\n\n${comments.map((comment) => formatComment(comment, names)).join("\n\n")}` : "";
+				const text = formatTicket(ticket) + formatSlaBlock(sla) + formatSubscribersBlock(ticket, names) + commentsBlock;
 				const advice = include_comments ? `get_ticket appends the thread as one unpaginated block; read it page by page with list_ticket_comments (ticket_id: ${ticket_id}, sort_order: "desc") to get the newest comments first.` : "get_ticket takes no pagination or filter parameters, so this response cannot be narrowed from the call.";
 				return { content: [{
 					type: "text",
@@ -4305,7 +4395,7 @@ const createTicketTools = (ctx) => {
 					type: "text",
 					text: `${meta.has_more ? `No comments on this page of ticket #${ticket_id}. More available (cursor: ${meta.after_cursor}).` : `No comments to show for ticket #${ticket_id}.`}${offsetNote}`
 				}] };
-				const authors = await resolveCommentAuthors(subdomain, token, comments, response.users);
+				const authors = await resolveUserDisplayNames(subdomain, token, comments.map((comment) => comment.author_id), response.users);
 				const body = comments.map((comment) => formatComment(comment, authors)).join("\n\n");
 				const text = `${[
 					`# Comments on ticket #${ticket_id} (${commentPageOrder(comments, sort_order)})`,
@@ -4435,7 +4525,7 @@ const createTicketTools = (ctx) => {
 			namespace: "tickets",
 			readOnly: false,
 			title: "Update Zendesk Ticket",
-			description: "Update an existing ticket (status, priority, type, assignee, group, subject, tags, custom fields). Only the fields you pass are changed, and the updated ticket is returned. Setting tags here replaces the whole tag set — use manage_tags to add or remove individual tags without overwriting the rest. This tool does not post replies: use add_public_comment or add_private_note for that. Find the ticket id via search_tickets or list_tickets.",
+			description: "Update an existing ticket (status, priority, type, assignee, group, subject, tags, custom fields, followers, email CCs). Only the fields you pass are changed, and the updated ticket is returned. Followers and email CCs are incremental instead of replacing: pass { add, remove } lists of user ids, and the response reports who is subscribed afterwards. Zendesk applies those two silently, so a requested change it did not apply comes back listed as unconfirmed rather than raised as an error. Setting tags here replaces the whole tag set — use manage_tags to add or remove individual tags without overwriting the rest. This tool does not post replies: use add_public_comment or add_private_note for that. Find the ticket id via search_tickets or list_tickets.",
 			inputSchema: z.object({
 				ticket_id: z.number().int().describe("Ticket ID — the numeric id of the ticket to update. Obtain it from search_tickets or list_tickets."),
 				status: z.enum([
@@ -4465,7 +4555,15 @@ const createTicketTools = (ctx) => {
 				custom_fields: z.array(z.object({
 					id: z.number().int(),
 					value: z.unknown()
-				})).optional().describe("Custom field values as { id, value } pairs (field ids come from your Zendesk admin settings). Call list_ticket_fields first to discover the numeric field ids and, for dropdown/multiselect fields, the exact option values Zendesk accepts.")
+				})).optional().describe("Custom field values as { id, value } pairs (field ids come from your Zendesk admin settings). Call list_ticket_fields first to discover the numeric field ids and, for dropdown/multiselect fields, the exact option values Zendesk accepts."),
+				followers: z.object({
+					add: subscriberIdList("User ids to start following the ticket. Omit to only remove."),
+					remove: subscriberIdList("User ids to stop following the ticket. Omit to only add.")
+				}).strict().optional().describe("Agents to add to or remove from the ticket's follower list, as numeric user ids: { add: [123], remove: [456] }. Followers are notified of ticket updates, internal notes included, so this controls who hears about the ticket. Numeric ids only, no email addresses: resolve the person with search_users first and confirm the match before writing, because a name query can return several users and removing the wrong id succeeds silently. Adding someone already following, or removing someone who is not, is a no-op. An id listed in both add and remove is removed. Omit to leave followers untouched."),
+				email_ccs: z.object({
+					add: subscriberIdList("User ids to CC on the ticket, at most 48. Omit to only remove.", 48),
+					remove: subscriberIdList("User ids to drop from the CC list. Omit to only add.")
+				}).strict().optional().describe("End users or agents to add to or remove from the ticket's email CC list, as numeric user ids: { add: [123], remove: [456] }. CCs receive the ticket's public correspondence, subject to your account's triggers. Numeric ids only, no email addresses: resolve the person with search_users first and confirm the match, because a name query can return several users. Zendesk caps a ticket at 48 email CCs and this tool cannot know how many are already set, so going over shows up as an unconfirmed entry in the response rather than a validation error. An id listed in both add and remove is removed. Omit to leave CCs untouched.")
 			}),
 			annotations: {
 				readOnlyHint: false,
@@ -4474,12 +4572,25 @@ const createTicketTools = (ctx) => {
 				openWorldHint: true
 			},
 			handler: async (params) => {
-				const { ticket_id, ...updates } = params;
+				const { ticket_id, followers, email_ccs, ...updates } = params;
 				const token = await getToken();
-				const { ticket } = await zendeskPut(subdomain, token, `/tickets/${ticket_id}`, { ticket: updates });
+				const sent = {};
+				const followerActions = toSubscriberActions(followers);
+				const ccActions = toSubscriberActions(email_ccs);
+				if (followerActions) sent.followers = followerActions;
+				if (ccActions) sent.email_ccs = ccActions;
+				const { ticket } = await zendeskPut(subdomain, token, `/tickets/${ticket_id}`, { ticket: {
+					...updates,
+					...sent
+				} });
+				let text = `Ticket #${ticket.id} updated.\n\n${formatTicket(ticket)}`;
+				if (followerActions || ccActions) {
+					const names = await resolveUserDisplayNames(subdomain, token, collectSubscriberIds(ticket));
+					text += formatSubscribersBlock(ticket, names) + formatSubscriberOutcome(sent, ticket);
+				}
 				return { content: [{
 					type: "text",
-					text: `Ticket #${ticket.id} updated.\n\n${formatTicket(ticket)}`
+					text
 				}] };
 			}
 		},
@@ -4994,7 +5105,7 @@ const createStrictParamsParser = (schema) => {
 	return (params) => {
 		const result = strict.safeParse(params);
 		if (result.success) return result.data;
-		const unknownKeys = result.error.issues.filter((issue) => issue.code === "unrecognized_keys").flatMap((issue) => issue.keys ?? []);
+		const unknownKeys = result.error.issues.flatMap((issue) => issue.code === "unrecognized_keys" ? issue.keys : []);
 		if (unknownKeys.length > 0) throw new Error(`Unknown parameter(s): ${unknownKeys.join(", ")}. Valid parameters: ${validKeys || "(none)"}.`);
 		throw result.error;
 	};
@@ -5059,10 +5170,10 @@ const registerProxyTool = (server, toolName, title, tools, readOnlyMode, onUnaut
 	return server.registerTool(toolName, {
 		title,
 		description: `${prefix}${title}. Specify the operation and its parameters.\n\nAvailable operations:\n${operationList}`,
-		inputSchema: {
+		inputSchema: z.object({
 			operation: z.string().describe(`One of: ${operationNames.join(", ")}`),
 			params: z.record(z.string(), z.unknown()).default({}).describe("Operation parameters")
-		},
+		}),
 		annotations
 	}, async (args) => dispatch(args));
 };
@@ -5681,7 +5792,7 @@ const startHttpTransport = async (config, logger = silentLogger, options = {}) =
 		}
 		const auth = { bearer };
 		const server = createMcpServer(config, () => auth.bearer, logger);
-		const transport = new StreamableHTTPServerTransport({
+		const transport = new NodeStreamableHTTPServerTransport({
 			sessionIdGenerator: () => randomUUID(),
 			onsessioninitialized: (newId) => {
 				sessions.set(newId, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fruggr/zendesk-mcp-server",
-  "version": "2.22.3",
+  "version": "2.24.0",
   "mcpName": "io.github.fruggr/zendesk-mcp-server",
   "description": "Deep Zendesk MCP server for your AI assistant: search, draft, update and translate Help Center articles and manage Support tickets end to end — comments, triage and image attachments.",
   "type": "module",
@@ -70,13 +70,14 @@
   "engines": {
     "node": ">=20"
   },
-  "packageManager": "pnpm@12.4.2+sha512.08adc6613180275c7c9edada39dcf08c9c61ad4e7eaf330a4f3461f102b0f907423454d117f98e72d47fef0616070644d7bffc973a6a57f5090a6d7c368b07c9",
+  "packageManager": "pnpm@12.5.1+sha512.e3f305bc784a2bc89f5ad3b6138889470fae8d2af5f36b61216ec91c2c3d64089775f9de38aac331044ea40f245cb0d5666392dfdf65824e1907ef6a2c62de5f",
   "dependencies": {
-    "@modelcontextprotocol/sdk": "1.30.0",
+    "@modelcontextprotocol/node": "2.0.0",
+    "@modelcontextprotocol/server": "2.0.0",
     "cheerio": "1.2.0",
     "hast-util-to-html": "9.0.5",
     "hast-util-to-mdast": "10.1.2",
-    "open": "11.0.2",
+    "open": "11.0.4",
     "rehype-parse": "9.0.1",
     "rehype-raw": "7.0.0",
     "rehype-remark": "10.0.1",
@@ -86,10 +87,11 @@
     "remark-rehype": "11.1.2",
     "remark-stringify": "11.0.0",
     "unified": "11.0.5",
-    "zod": "4.6.2"
+    "zod": "4.6.5"
   },
   "devDependencies": {
-    "@biomejs/biome": "2.5.12",
+    "@biomejs/biome": "2.5.13",
+    "@modelcontextprotocol/client": "2.0.0",
     "@semantic-release/changelog": "^7.0.0",
     "@semantic-release/exec": "^7.1.0",
     "@semantic-release/git": "^11.0.0",