@gaffer-sh/mcp 0.6.1 → 0.7.0

package/dist/index.js

@@ -10,7 +10,6 @@ const REQUEST_TIMEOUT_MS = 3e4;
 const MAX_RETRIES = 3;
 const INITIAL_RETRY_DELAY_MS = 1e3;
 const RETRYABLE_STATUS_CODES = [
-	401,
 	429,
 	500,
 	502,
@@ -26,23 +25,28 @@ function sleep(ms) {
 /**
 * Detect token type from prefix
 * - gaf_ = user API Key (read-only, cross-project)
-* - gfr_ = Project Upload Token (legacy, single project)
+* - gfr_ = Project Token (single project)
 */
 function detectTokenType(token) {
 	if (token.startsWith("gaf_")) return "user";
-	return "project";
+	if (token.startsWith("gfr_")) return "project";
+	throw new Error(`Unrecognized API key format. Expected a user API key (gaf_...) or project token (gfr_...). Got: "${token.substring(0, 4)}...". Check your GAFFER_API_KEY environment variable.`);
 }
 /**
 * Gaffer API v1 client for MCP server
 *
 * Supports two authentication modes:
 * 1. User API Keys (gaf_) - Read-only access to all user's projects
-* 2. Project Upload Tokens (gfr_) - Legacy, single project access
+* 2. Project Tokens (gfr_) - Single project access, auto-resolves projectId
+*
+* All methods use the unified /user/projects/:id/ route tree.
+* Project tokens auto-resolve their projectId via /project on first use.
 */
 var GafferApiClient = class GafferApiClient {
 	apiKey;
 	baseUrl;
 	tokenType;
+	resolveProjectIdPromise = null;
 	constructor(config) {
 		this.apiKey = config.apiKey;
 		this.baseUrl = config.baseUrl.replace(/\/$/, "");
@@ -52,7 +56,7 @@ var GafferApiClient = class GafferApiClient {
 	* Create client from environment variables
 	*
 	* Supports:
-	* - GAFFER_API_KEY (for user API Keys gaf_)
+	* - GAFFER_API_KEY (for user API Keys gaf_ or project tokens gfr_)
 	*/
 	static fromEnv() {
 		const apiKey = process.env.GAFFER_API_KEY;
@@ -69,6 +73,24 @@ var GafferApiClient = class GafferApiClient {
 		return this.tokenType === "user";
 	}
 	/**
+	* Resolve the project ID for the current token.
+	* For project tokens, fetches from /project on first call and caches the Promise
+	* to deduplicate concurrent calls.
+	* For user tokens, requires explicit projectId.
+	*/
+	async resolveProjectId(projectId) {
+		if (projectId) return projectId;
+		if (this.isUserToken()) throw new Error("projectId is required when using a user API Key");
+		if (!this.resolveProjectIdPromise) this.resolveProjectIdPromise = this.request("/project").then((response) => {
+			if (!response?.project?.id) throw new Error("Failed to resolve project ID from token: unexpected response from /project endpoint. Ensure your project token (gfr_) is valid and the project still exists.");
+			return response.project.id;
+		}).catch((error) => {
+			this.resolveProjectIdPromise = null;
+			throw error;
+		});
+		return this.resolveProjectIdPromise;
+	}
+	/**
 	* Make authenticated request to Gaffer API with retry logic
 	*/
 	async request(endpoint, params) {
@@ -129,13 +151,8 @@ var GafferApiClient = class GafferApiClient {
 		throw lastError || /* @__PURE__ */ new Error("Request failed after retries");
 	}
 	/**
-	* List all projects the user has access to
-	* Requires user API Key (gaf_)
-	*
-	* @param options - Query options
-	* @param options.organizationId - Filter by organization ID
-	* @param options.limit - Maximum number of results
-	* @param options.offset - Offset for pagination
+	* List all projects the user has access to.
+	* Requires user API Key (gaf_). Not available with project tokens.
 	*/
 	async listProjects(options = {}) {
 		if (!this.isUserToken()) throw new Error("list_projects is not available with project tokens (gfr_). Your token is already scoped to a single project — call tools directly without passing projectId.");
@@ -147,40 +164,20 @@ var GafferApiClient = class GafferApiClient {
 	}
 	/**
 	* Get project health analytics
-	*
-	* @param options - Query options
-	* @param options.projectId - Required for user tokens, ignored for project tokens
-	* @param options.days - Analysis period in days (default: 30)
 	*/
 	async getProjectHealth(options = {}) {
-		if (this.isUserToken()) {
-			if (!options.projectId) throw new Error("projectId is required when using a user API Key");
-			return this.request(`/user/projects/${options.projectId}/health`, { days: options.days || 30 });
-		}
-		return this.request("/project/analytics", { days: options.days || 30 });
+		const projectId = await this.resolveProjectId(options.projectId);
+		return this.request(`/user/projects/${projectId}/health`, { days: options.days || 30 });
 	}
 	/**
 	* Get test history for a specific test
-	*
-	* @param options - Query options
-	* @param options.projectId - Required for user tokens, ignored for project tokens
-	* @param options.testName - Test name to search for
-	* @param options.filePath - File path to search for
-	* @param options.limit - Maximum number of results
 	*/
 	async getTestHistory(options) {
 		const testName = options.testName?.trim();
 		const filePath = options.filePath?.trim();
 		if (!testName && !filePath) throw new Error("Either testName or filePath is required (and must not be empty)");
-		if (this.isUserToken()) {
-			if (!options.projectId) throw new Error("projectId is required when using a user API Key");
-			return this.request(`/user/projects/${options.projectId}/test-history`, {
-				...testName && { testName },
-				...filePath && { filePath },
-				...options.limit && { limit: options.limit }
-			});
-		}
-		return this.request("/project/test-history", {
+		const projectId = await this.resolveProjectId(options.projectId);
+		return this.request(`/user/projects/${projectId}/test-history`, {
 			...testName && { testName },
 			...filePath && { filePath },
 			...options.limit && { limit: options.limit }
@@ -188,23 +185,10 @@ var GafferApiClient = class GafferApiClient {
 	}
 	/**
 	* Get flaky tests for the project
-	*
-	* @param options - Query options
-	* @param options.projectId - Required for user tokens, ignored for project tokens
-	* @param options.threshold - Minimum flip rate to be considered flaky (0-1)
-	* @param options.limit - Maximum number of results
-	* @param options.days - Analysis period in days
 	*/
 	async getFlakyTests(options = {}) {
-		if (this.isUserToken()) {
-			if (!options.projectId) throw new Error("projectId is required when using a user API Key");
-			return this.request(`/user/projects/${options.projectId}/flaky-tests`, {
-				...options.threshold && { threshold: options.threshold },
-				...options.limit && { limit: options.limit },
-				...options.days && { days: options.days }
-			});
-		}
-		return this.request("/project/flaky-tests", {
+		const projectId = await this.resolveProjectId(options.projectId);
+		return this.request(`/user/projects/${projectId}/flaky-tests`, {
 			...options.threshold && { threshold: options.threshold },
 			...options.limit && { limit: options.limit },
 			...options.days && { days: options.days }
@@ -212,25 +196,10 @@ var GafferApiClient = class GafferApiClient {
 	}
 	/**
 	* List test runs for the project
-	*
-	* @param options - Query options
-	* @param options.projectId - Required for user tokens, ignored for project tokens
-	* @param options.commitSha - Filter by commit SHA
-	* @param options.branch - Filter by branch name
-	* @param options.status - Filter by status ('passed' or 'failed')
-	* @param options.limit - Maximum number of results
 	*/
 	async getTestRuns(options = {}) {
-		if (this.isUserToken()) {
-			if (!options.projectId) throw new Error("projectId is required when using a user API Key");
-			return this.request(`/user/projects/${options.projectId}/test-runs`, {
-				...options.commitSha && { commitSha: options.commitSha },
-				...options.branch && { branch: options.branch },
-				...options.status && { status: options.status },
-				...options.limit && { limit: options.limit }
-			});
-		}
-		return this.request("/project/test-runs", {
+		const projectId = await this.resolveProjectId(options.projectId);
+		return this.request(`/user/projects/${projectId}/test-runs`, {
 			...options.commitSha && { commitSha: options.commitSha },
 			...options.branch && { branch: options.branch },
 			...options.status && { status: options.status },
@@ -238,31 +207,21 @@ var GafferApiClient = class GafferApiClient {
 		});
 	}
 	/**
-	* Get report files for a test run
-	*
-	* @param testRunId - The test run ID
-	* @returns Report metadata with download URLs for each file
+	* Get report files for a test run.
+	* User-only: the /user/test-runs/:id/report route has no project-scoped equivalent,
+	* so project tokens cannot access raw report downloads.
 	*/
 	async getReport(testRunId) {
-		if (!this.isUserToken()) throw new Error("getReport requires a user API Key (gaf_). Upload Tokens (gfr_) cannot access reports via API.");
+		if (!this.isUserToken()) throw new Error("getReport requires a user API Key (gaf_). Project tokens (gfr_) cannot access reports via API.");
 		if (!testRunId) throw new Error("testRunId is required");
 		return this.request(`/user/test-runs/${testRunId}/report`);
 	}
 	/**
 	* Get slowest tests for a project
-	*
-	* @param options - Query options
-	* @param options.projectId - The project ID (required)
-	* @param options.days - Analysis period in days (default: 30)
-	* @param options.limit - Maximum number of results (default: 20)
-	* @param options.framework - Filter by test framework
-	* @param options.branch - Filter by git branch name
-	* @returns Slowest tests sorted by P95 duration
 	*/
 	async getSlowestTests(options) {
-		if (!this.isUserToken()) throw new Error("getSlowestTests requires a user API Key (gaf_).");
-		if (!options.projectId) throw new Error("projectId is required");
-		return this.request(`/user/projects/${options.projectId}/slowest-tests`, {
+		const projectId = await this.resolveProjectId(options.projectId);
+		return this.request(`/user/projects/${projectId}/slowest-tests`, {
 			...options.days && { days: options.days },
 			...options.limit && { limit: options.limit },
 			...options.framework && { framework: options.framework },
@@ -271,20 +230,11 @@ var GafferApiClient = class GafferApiClient {
 	}
 	/**
 	* Get parsed test results for a specific test run
-	*
-	* @param options - Query options
-	* @param options.projectId - The project ID (required)
-	* @param options.testRunId - The test run ID (required)
-	* @param options.status - Filter by test status ('passed', 'failed', 'skipped')
-	* @param options.limit - Maximum number of results (default: 100)
-	* @param options.offset - Pagination offset (default: 0)
-	* @returns Parsed test cases with pagination
 	*/
 	async getTestRunDetails(options) {
-		if (!this.isUserToken()) throw new Error("getTestRunDetails requires a user API Key (gaf_).");
-		if (!options.projectId) throw new Error("projectId is required");
 		if (!options.testRunId) throw new Error("testRunId is required");
-		return this.request(`/user/projects/${options.projectId}/test-runs/${options.testRunId}/details`, {
+		const projectId = await this.resolveProjectId(options.projectId);
+		return this.request(`/user/projects/${projectId}/test-runs/${options.testRunId}/details`, {
 			...options.status && { status: options.status },
 			...options.limit && { limit: options.limit },
 			...options.offset && { offset: options.offset }
@@ -292,21 +242,11 @@ var GafferApiClient = class GafferApiClient {
 	}
 	/**
 	* Compare test metrics between two commits or test runs
-	*
-	* @param options - Query options
-	* @param options.projectId - The project ID (required)
-	* @param options.testName - The test name to compare (required)
-	* @param options.beforeCommit - Commit SHA for before (use with afterCommit)
-	* @param options.afterCommit - Commit SHA for after (use with beforeCommit)
-	* @param options.beforeRunId - Test run ID for before (use with afterRunId)
-	* @param options.afterRunId - Test run ID for after (use with beforeRunId)
-	* @returns Comparison of test metrics
 	*/
 	async compareTestMetrics(options) {
-		if (!this.isUserToken()) throw new Error("compareTestMetrics requires a user API Key (gaf_).");
-		if (!options.projectId) throw new Error("projectId is required");
 		if (!options.testName) throw new Error("testName is required");
-		return this.request(`/user/projects/${options.projectId}/compare-test`, {
+		const projectId = await this.resolveProjectId(options.projectId);
+		return this.request(`/user/projects/${projectId}/compare-test`, {
 			testName: options.testName,
 			...options.beforeCommit && { beforeCommit: options.beforeCommit },
 			...options.afterCommit && { afterCommit: options.afterCommit },
@@ -316,35 +256,17 @@ var GafferApiClient = class GafferApiClient {
 	}
 	/**
 	* Get coverage summary for a project
-	*
-	* @param options - Query options
-	* @param options.projectId - The project ID (required)
-	* @param options.days - Analysis period in days (default: 30)
-	* @returns Coverage summary with trends and lowest coverage files
 	*/
 	async getCoverageSummary(options) {
-		if (!this.isUserToken()) throw new Error("getCoverageSummary requires a user API Key (gaf_).");
-		if (!options.projectId) throw new Error("projectId is required");
-		return this.request(`/user/projects/${options.projectId}/coverage-summary`, { ...options.days && { days: options.days } });
+		const projectId = await this.resolveProjectId(options.projectId);
+		return this.request(`/user/projects/${projectId}/coverage-summary`, { ...options.days && { days: options.days } });
 	}
 	/**
 	* Get coverage files for a project with filtering
-	*
-	* @param options - Query options
-	* @param options.projectId - The project ID (required)
-	* @param options.filePath - Filter to specific file path
-	* @param options.minCoverage - Minimum coverage percentage
-	* @param options.maxCoverage - Maximum coverage percentage
-	* @param options.limit - Maximum number of results
-	* @param options.offset - Pagination offset
-	* @param options.sortBy - Sort by 'path' or 'coverage'
-	* @param options.sortOrder - Sort order 'asc' or 'desc'
-	* @returns List of files with coverage data
 	*/
 	async getCoverageFiles(options) {
-		if (!this.isUserToken()) throw new Error("getCoverageFiles requires a user API Key (gaf_).");
-		if (!options.projectId) throw new Error("projectId is required");
-		return this.request(`/user/projects/${options.projectId}/coverage/files`, {
+		const projectId = await this.resolveProjectId(options.projectId);
+		return this.request(`/user/projects/${projectId}/coverage/files`, {
 			...options.filePath && { filePath: options.filePath },
 			...options.minCoverage !== void 0 && { minCoverage: options.minCoverage },
 			...options.maxCoverage !== void 0 && { maxCoverage: options.maxCoverage },
@@ -356,65 +278,36 @@ var GafferApiClient = class GafferApiClient {
 	}
 	/**
 	* Get risk areas (files with low coverage AND test failures)
-	*
-	* @param options - Query options
-	* @param options.projectId - The project ID (required)
-	* @param options.days - Analysis period in days (default: 30)
-	* @param options.coverageThreshold - Include files below this coverage (default: 80)
-	* @returns List of risk areas sorted by risk score
 	*/
 	async getCoverageRiskAreas(options) {
-		if (!this.isUserToken()) throw new Error("getCoverageRiskAreas requires a user API Key (gaf_).");
-		if (!options.projectId) throw new Error("projectId is required");
-		return this.request(`/user/projects/${options.projectId}/coverage/risk-areas`, {
+		const projectId = await this.resolveProjectId(options.projectId);
+		return this.request(`/user/projects/${projectId}/coverage/risk-areas`, {
 			...options.days && { days: options.days },
 			...options.coverageThreshold !== void 0 && { coverageThreshold: options.coverageThreshold }
 		});
 	}
 	/**
 	* Get a browser-navigable URL for viewing a test report
-	*
-	* @param options - Query options
-	* @param options.projectId - The project ID (required)
-	* @param options.testRunId - The test run ID (required)
-	* @param options.filename - Specific file to open (default: index.html)
-	* @returns URL with signed token for browser access
 	*/
 	async getReportBrowserUrl(options) {
-		if (!this.isUserToken()) throw new Error("getReportBrowserUrl requires a user API Key (gaf_).");
-		if (!options.projectId) throw new Error("projectId is required");
 		if (!options.testRunId) throw new Error("testRunId is required");
-		return this.request(`/user/projects/${options.projectId}/reports/${options.testRunId}/browser-url`, { ...options.filename && { filename: options.filename } });
+		const projectId = await this.resolveProjectId(options.projectId);
+		return this.request(`/user/projects/${projectId}/reports/${options.testRunId}/browser-url`, { ...options.filename && { filename: options.filename } });
 	}
 	/**
 	* Get failure clusters for a test run
-	*
-	* @param options - Query options
-	* @param options.projectId - The project ID (required)
-	* @param options.testRunId - The test run ID (required)
-	* @returns Failure clusters grouped by error similarity
 	*/
 	async getFailureClusters(options) {
-		if (!this.isUserToken()) throw new Error("getFailureClusters requires a user API Key (gaf_).");
-		if (!options.projectId) throw new Error("projectId is required");
 		if (!options.testRunId) throw new Error("testRunId is required");
-		return this.request(`/user/projects/${options.projectId}/test-runs/${options.testRunId}/failure-clusters`);
+		const projectId = await this.resolveProjectId(options.projectId);
+		return this.request(`/user/projects/${projectId}/test-runs/${options.testRunId}/failure-clusters`);
 	}
 	/**
 	* List upload sessions for a project
-	*
-	* @param options - Query options
-	* @param options.projectId - The project ID (required)
-	* @param options.commitSha - Filter by commit SHA
-	* @param options.branch - Filter by branch name
-	* @param options.limit - Maximum number of results (default: 10)
-	* @param options.offset - Pagination offset (default: 0)
-	* @returns Paginated list of upload sessions
 	*/
 	async listUploadSessions(options) {
-		if (!this.isUserToken()) throw new Error("listUploadSessions requires a user API Key (gaf_).");
-		if (!options.projectId) throw new Error("projectId is required");
-		return this.request(`/user/projects/${options.projectId}/upload-sessions`, {
+		const projectId = await this.resolveProjectId(options.projectId);
+		return this.request(`/user/projects/${projectId}/upload-sessions`, {
 			...options.commitSha && { commitSha: options.commitSha },
 			...options.branch && { branch: options.branch },
 			...options.limit && { limit: options.limit },
@@ -423,27 +316,133 @@ var GafferApiClient = class GafferApiClient {
 	}
 	/**
 	* Get upload session detail with linked results
-	*
-	* @param options - Query options
-	* @param options.projectId - The project ID (required)
-	* @param options.sessionId - The upload session ID (required)
-	* @returns Upload session details with linked test runs and coverage reports
 	*/
 	async getUploadSessionDetail(options) {
-		if (!this.isUserToken()) throw new Error("getUploadSessionDetail requires a user API Key (gaf_).");
-		if (!options.projectId) throw new Error("projectId is required");
 		if (!options.sessionId) throw new Error("sessionId is required");
-		return this.request(`/user/projects/${options.projectId}/upload-sessions/${options.sessionId}`);
+		const projectId = await this.resolveProjectId(options.projectId);
+		return this.request(`/user/projects/${projectId}/upload-sessions/${options.sessionId}`);
+	}
+	/**
+	* Search across test failures by error message, stack trace, or test name
+	*/
+	async searchFailures(options) {
+		if (!options.query) throw new Error("query is required");
+		const projectId = await this.resolveProjectId(options.projectId);
+		return this.request(`/user/projects/${projectId}/search-failures`, {
+			query: options.query,
+			...options.searchIn && { searchIn: options.searchIn },
+			...options.days && { days: options.days },
+			...options.branch && { branch: options.branch },
+			...options.limit && { limit: options.limit }
+		});
 	}
 };
 
+//#endregion
+//#region src/codemode/executor.ts
+/**
+* Patterns blocked from user code as a basic guard.
+* This is NOT a sandbox — determined users can bypass these checks via
+* string concatenation, bracket notation, or constructor access.
+* The real security boundary is the API layer (read-only, user's own token).
+*/
+const BLOCKED_PATTERNS = [
+	"globalThis",
+	"process",
+	"require(",
+	"import ",
+	"import(",
+	"eval(",
+	"new Function",
+	"Function(",
+	"Buffer",
+	"__dirname",
+	"__filename",
+	".constructor",
+	"Reflect"
+];
+/** Maximum API calls per execution */
+const MAX_API_CALLS = 20;
+/** Execution timeout in milliseconds */
+const EXECUTION_TIMEOUT_MS = 3e4;
+/**
+* Validate code doesn't contain blocked patterns.
+* Returns the first blocked pattern found, or null if safe.
+*/
+function validateCode(code) {
+	for (const pattern of BLOCKED_PATTERNS) if (code.includes(pattern)) return pattern;
+	return null;
+}
+/**
+* Execute user-provided JavaScript code with access to the codemode namespace.
+*
+* Uses AsyncFunction constructor to run code in an async context.
+* The namespace object is injected as `codemode` — all API calls go through it.
+*
+* Security notes:
+* - Not a true sandbox (no vm2/isolated-vm) — same pattern as Cloudflare code mode
+* - Blocked patterns prevent obvious escape hatches
+* - API call counting prevents resource exhaustion
+* - Timeout prevents infinite loops
+* - The real security boundary is the API itself (read-only, user's own token)
+*/
+async function executeCode(code, namespace) {
+	const blocked = validateCode(code);
+	if (blocked) throw new Error(`Blocked pattern detected: "${blocked}". Code must not use ${blocked}.`);
+	const logs = [];
+	const start = Date.now();
+	const serialize = (a) => {
+		if (typeof a !== "object" || a === null) return String(a);
+		try {
+			return JSON.stringify(a);
+		} catch {
+			return String(a);
+		}
+	};
+	const safeConsole = {
+		log: (...args) => logs.push(args.map(serialize).join(" ")),
+		warn: (...args) => logs.push(`[warn] ${args.map(serialize).join(" ")}`),
+		error: (...args) => logs.push(`[error] ${args.map(serialize).join(" ")}`)
+	};
+	let callCount = 0;
+	const countedNamespace = {};
+	for (const [name, fn] of Object.entries(namespace)) countedNamespace[name] = async (...args) => {
+		callCount++;
+		if (callCount > MAX_API_CALLS) throw new Error(`API call limit exceeded (max ${MAX_API_CALLS} calls per execution)`);
+		return fn(...args);
+	};
+	const AsyncFunction = Object.getPrototypeOf(async () => {}).constructor;
+	const fn = new AsyncFunction("codemode", "console", code);
+	let timeoutId;
+	const resultPromise = fn(countedNamespace, safeConsole);
+	const timeoutPromise = new Promise((_, reject) => {
+		timeoutId = setTimeout(() => reject(/* @__PURE__ */ new Error(`Execution timed out after ${EXECUTION_TIMEOUT_MS}ms`)), EXECUTION_TIMEOUT_MS);
+	});
+	try {
+		return {
+			result: await Promise.race([resultPromise, timeoutPromise]),
+			logs,
+			durationMs: Date.now() - start
+		};
+	} catch (error) {
+		const durationMs = Date.now() - start;
+		const message = error instanceof Error ? error.message : String(error);
+		const enrichedError = new Error(message, { cause: error });
+		enrichedError.logs = logs;
+		enrichedError.durationMs = durationMs;
+		throw enrichedError;
+	} finally {
+		clearTimeout(timeoutId);
+	}
+}
+
 //#endregion
 //#region src/tools/compare-test-metrics.ts
 /**
 * Input schema for compare_test_metrics tool
 */
 const compareTestMetricsInputSchema = {
-	projectId: z.string().describe("Project ID. Use list_projects to find project IDs."),
+	projectId: z.string().optional().describe("Project ID. Required for user API keys (gaf_). Not needed for project tokens — omit and it resolves automatically."),
 	testName: z.string().describe("The test name to compare. Can be the short name or full name including describe blocks."),
 	beforeCommit: z.string().optional().describe("Commit SHA for the \"before\" measurement. Use with afterCommit."),
 	afterCommit: z.string().optional().describe("Commit SHA for the \"after\" measurement. Use with beforeCommit."),
@@ -518,7 +517,7 @@ const compareTestMetricsMetadata = {
 Useful for measuring the impact of code changes on test performance or reliability.
 
 Parameters:
-- projectId (required): Project ID
+- projectId (optional): Project ID — required for user API keys, auto-resolved for project tokens
 - testName (required): The test name to compare (short name or full name)
 - Option 1 - Compare by commit:
   - beforeCommit: Commit SHA for "before" measurement
@@ -553,7 +552,7 @@ Tip: Use get_test_history first to find the commit SHAs or test run IDs you want
 * Input schema for find_uncovered_failure_areas tool
 */
 const findUncoveredFailureAreasInputSchema = {
-	projectId: z.string().describe("Project ID. Use list_projects to find project IDs."),
+	projectId: z.string().optional().describe("Project ID. Required for user API keys (gaf_). Not needed for project tokens — omit and it resolves automatically."),
 	days: z.number().int().min(1).max(365).optional().describe("Number of days to analyze for test failures (default: 30)"),
 	coverageThreshold: z.number().min(0).max(100).optional().describe("Include files with coverage below this percentage (default: 80)")
 };
@@ -601,7 +600,7 @@ areas in your codebase that need attention. Files are ranked by a "risk score"
 calculated as: (100 - coverage%) × failureCount.
 
 Parameters:
-- projectId: The project to analyze (required)
+- projectId (optional): Project ID — required for user API keys, auto-resolved for project tokens
 - days: Analysis period for test failures (default: 30)
 - coverageThreshold: Include files below this coverage % (default: 80)
 
@@ -618,7 +617,7 @@ Use this to prioritize which parts of your codebase need better test coverage.`
 * Input schema for get_coverage_for_file tool
 */
 const getCoverageForFileInputSchema = {
-	projectId: z.string().describe("Project ID. Use list_projects to find project IDs."),
+	projectId: z.string().optional().describe("Project ID. Required for user API keys (gaf_). Not needed for project tokens — omit and it resolves automatically."),
 	filePath: z.string().describe("File path to get coverage for. Can be exact path or partial match.")
 };
 /**
@@ -675,7 +674,7 @@ const getCoverageForFileMetadata = {
 	description: `Get coverage metrics for a specific file or files matching a path pattern.
 
 Parameters:
-- projectId: The project to query (required)
+- projectId (optional): Project ID — required for user API keys, auto-resolved for project tokens
 - filePath: File path to search for (exact or partial match)
 
 Returns:
@@ -701,7 +700,7 @@ Prioritize: high utilization + low coverage = highest impact.`
 * Input schema for get_coverage_summary tool
 */
 const getCoverageSummaryInputSchema = {
-	projectId: z.string().describe("Project ID. Use list_projects to find project IDs."),
+	projectId: z.string().optional().describe("Project ID. Required for user API keys (gaf_). Not needed for project tokens — omit and it resolves automatically."),
 	days: z.number().int().min(1).max(365).optional().describe("Number of days to analyze for trends (default: 30)")
 };
 /**
@@ -776,7 +775,7 @@ high-value targets in critical code paths rather than just the files with lowest
 * Input schema for get_failure_clusters tool
 */
 const getFailureClustersInputSchema = {
-	projectId: z.string().describe("Project ID. Use list_projects to find project IDs."),
+	projectId: z.string().optional().describe("Project ID. Required for user API keys (gaf_). Not needed for project tokens — omit and it resolves automatically."),
 	testRunId: z.string().describe("Test run ID. Use list_test_runs to find test run IDs.")
 };
 /**
@@ -814,7 +813,7 @@ const getFailureClustersMetadata = {
 	description: `Group failed tests by root cause using error message similarity.
 
 Parameters:
-- projectId (required): The project ID
+- projectId (optional): Project ID — required for user API keys, auto-resolved for project tokens
 - testRunId (required): The test run ID to analyze
 
 Returns:
@@ -979,7 +978,7 @@ Use this to understand the current state of your test suite.`
 * Input schema for get_report_browser_url tool
 */
 const getReportBrowserUrlInputSchema = {
-	projectId: z.string().describe("Project ID. Use list_projects to find project IDs."),
+	projectId: z.string().optional().describe("Project ID. Required for user API keys (gaf_). Not needed for project tokens — omit and it resolves automatically."),
 	testRunId: z.string().describe("The test run ID to get the report URL for. Use list_test_runs to find test run IDs."),
 	filename: z.string().optional().describe("Specific file to open (default: index.html or first HTML file)")
 };
@@ -1022,7 +1021,7 @@ Returns a signed URL that can be opened directly in a browser without requiring
 the user to log in. The URL expires after 30 minutes for security.
 
 Parameters:
-- projectId: The project the test run belongs to (required)
+- projectId (optional): Project ID — required for user API keys, auto-resolved for project tokens
 - testRunId: The test run to view (required)
 - filename: Specific file to open (optional, defaults to index.html)
 
@@ -1125,7 +1124,7 @@ Use cases:
 * Input schema for get_slowest_tests tool
 */
 const getSlowestTestsInputSchema = {
-	projectId: z.string().describe("Project ID. Use list_projects to find project IDs."),
+	projectId: z.string().optional().describe("Project ID. Required for user API keys (gaf_). Not needed for project tokens — omit and it resolves automatically."),
 	days: z.number().int().min(1).max(365).optional().describe("Analysis period in days (default: 30)"),
 	limit: z.number().int().min(1).max(100).optional().describe("Maximum number of tests to return (default: 20)"),
 	framework: z.string().optional().describe("Filter by test framework (e.g., \"playwright\", \"vitest\", \"jest\")"),
@@ -1184,7 +1183,7 @@ const getSlowestTestsMetadata = {
 	description: `Get the slowest tests in a project, sorted by P95 duration.
 
 Parameters:
-- projectId (required): Project ID to analyze
+- projectId (optional): Project ID — required for user API keys, auto-resolved for project tokens
 - days (optional): Analysis period in days (default: 30, max: 365)
 - limit (optional): Max tests to return (default: 20, max: 100)
 - framework (optional): Filter by framework (e.g., "playwright", "vitest")
@@ -1302,7 +1301,7 @@ Use this to investigate flaky tests or understand test stability.`
 */
 const getTestRunDetailsInputSchema = {
 	testRunId: z.string().describe("The test run ID to get details for. Use list_test_runs to find test run IDs."),
-	projectId: z.string().describe("Project ID. Use list_projects to find project IDs."),
+	projectId: z.string().optional().describe("Project ID. Required for user API keys (gaf_). Not needed for project tokens — omit and it resolves automatically."),
 	status: z.enum([
 		"passed",
 		"failed",
@@ -1378,7 +1377,7 @@ const getTestRunDetailsMetadata = {
 
 Parameters:
 - testRunId (required): The test run ID to get details for
-- projectId (required): Project ID the test run belongs to
+- projectId (optional): Project ID — required for user API keys, auto-resolved for project tokens
 - status (optional): Filter by test status: "passed", "failed", or "skipped"
 - limit (optional): Max tests to return (default: 100, max: 500)
 - offset (optional): Pagination offset (default: 0)
@@ -1416,7 +1415,7 @@ use get_test_history, get_flaky_tests, or get_slowest_tests instead.`
 * Input schema for get_untested_files tool
 */
 const getUntestedFilesInputSchema = {
-	projectId: z.string().describe("Project ID. Use list_projects to find project IDs."),
+	projectId: z.string().optional().describe("Project ID. Required for user API keys (gaf_). Not needed for project tokens — omit and it resolves automatically."),
 	maxCoverage: z.number().min(0).max(100).optional().describe("Maximum coverage percentage to include (default: 10 for \"untested\")"),
 	limit: z.number().int().min(1).max(100).optional().describe("Maximum number of files to return (default: 20)")
 };
@@ -1483,7 +1482,7 @@ Returns files sorted by coverage percentage (lowest first), filtered
 to only include files below a coverage threshold.
 
 Parameters:
-- projectId: The project to analyze (required)
+- projectId (optional): Project ID — required for user API keys, auto-resolved for project tokens
 - maxCoverage: Include files with coverage at or below this % (default: 10)
 - limit: Maximum number of files to return (default: 20, max: 100)
 
@@ -1507,7 +1506,7 @@ for those specific paths.`
 * Input schema for get_upload_status tool
 */
 const getUploadStatusInputSchema = {
-	projectId: z.string().describe("Project ID. Use list_projects to find project IDs."),
+	projectId: z.string().optional().describe("Project ID. Required for user API keys (gaf_). Not needed for project tokens — omit and it resolves automatically."),
 	sessionId: z.string().optional().describe("Specific upload session ID. If provided, returns detailed status for that session. Otherwise, lists recent sessions."),
 	commitSha: z.string().optional().describe("Filter sessions by commit SHA. Useful for checking if results for a specific commit are ready."),
 	branch: z.string().optional().describe("Filter sessions by branch name.")
@@ -1581,7 +1580,7 @@ const getUploadStatusMetadata = {
 Use this tool to answer "are my test results ready?" after pushing code.
 
 Parameters:
-- projectId (required): The project ID
+- projectId (optional): Project ID — required for user API keys, auto-resolved for project tokens
 - sessionId (optional): Specific upload session ID for detailed status
 - commitSha (optional): Filter by commit SHA to find uploads for a specific commit
 - branch (optional): Filter by branch name
@@ -1612,63 +1611,6 @@ Returns (detail mode):
 - coverageReports: Linked coverage report summaries (id, format)`
 };
 
-//#endregion
-//#region src/tools/list-projects.ts
-/**
-* Input schema for list_projects tool
-*/
-const listProjectsInputSchema = {
-	organizationId: z.string().optional().describe("Filter by organization ID (optional)"),
-	limit: z.number().int().min(1).max(100).optional().describe("Maximum number of projects to return (default: 50)")
-};
-/**
-* Output schema for list_projects tool
-*/
-const listProjectsOutputSchema = {
-	projects: z.array(z.object({
-		id: z.string(),
-		name: z.string(),
-		description: z.string().nullable().optional(),
-		organization: z.object({
-			id: z.string(),
-			name: z.string(),
-			slug: z.string()
-		})
-	})),
-	total: z.number()
-};
-/**
-* Execute list_projects tool
-*/
-async function executeListProjects(client, input) {
-	const response = await client.listProjects({
-		organizationId: input.organizationId,
-		limit: input.limit
-	});
-	return {
-		projects: response.projects.map((p) => ({
-			id: p.id,
-			name: p.name,
-			description: p.description,
-			organization: p.organization
-		})),
-		total: response.pagination.total
-	};
-}
-/**
-* Tool metadata
-*/
-const listProjectsMetadata = {
-	name: "list_projects",
-	title: "List Projects",
-	description: `List all projects you have access to.
-
-Returns a list of projects with their IDs, names, and organization info.
-Use this to find project IDs for other tools like get_project_health.
-
-Requires a user API Key (gaf_). Get one from Account Settings in the Gaffer dashboard.`
-};
-
 //#endregion
 //#region src/tools/list-test-runs.ts
 /**
@@ -1756,6 +1698,508 @@ Use cases:
 - "What's the status of tests on my feature branch?"`
 };
 
+//#endregion
+//#region src/tools/search-failures.ts
+/**
+* Input schema for search_failures tool
+*/
+const searchFailuresInputSchema = {
+	projectId: z.string().optional().describe("Project ID. Required for user API keys (gaf_). Not needed for project tokens — omit and it resolves automatically."),
+	query: z.string().min(1).describe("Search query to match against failure messages, error stacks, or test names."),
+	searchIn: z.enum([
+		"errors",
+		"names",
+		"all"
+	]).optional().describe("Where to search: \"errors\" (error messages and stacks), \"names\" (test names), or \"all\" (default: \"all\")."),
+	days: z.number().int().min(1).max(365).optional().describe("Number of days to search back (default: 30)"),
+	branch: z.string().optional().describe("Filter to a specific branch"),
+	limit: z.number().int().min(1).max(100).optional().describe("Maximum number of matches to return (default: 20)")
+};
+/**
+* Output schema for search_failures tool
+*/
+const searchFailuresOutputSchema = {
+	matches: z.array(z.object({
+		testName: z.string(),
+		testRunId: z.string(),
+		branch: z.string().nullable(),
+		commitSha: z.string().nullable(),
+		errorMessage: z.string().nullable(),
+		errorStack: z.string().nullable(),
+		createdAt: z.string()
+	})),
+	total: z.number(),
+	query: z.string()
+};
+/**
+* Execute search_failures tool
+*/
+async function executeSearchFailures(client, input) {
+	return client.searchFailures(input);
+}
+/**
+* Tool metadata
+*/
+const searchFailuresMetadata = {
+	name: "search_failures",
+	title: "Search Failures",
+	description: `Search across test failures by error message, stack trace, or test name.
+
+Use this to find specific failures across test runs — like grep for your test history.
+
+Examples:
+- "TypeError: Cannot read properties of undefined" → find all occurrences of this error
+- "timeout" → find timeout-related failures
+- "auth" with searchIn="names" → find failing auth tests
+
+Returns matching failures with test run context (branch, commit, timestamp) for investigation.`
+};
+
+//#endregion
+//#region src/codemode/register-tools.ts
+const TOOLS = [
+	{
+		metadata: getProjectHealthMetadata,
+		inputSchema: getProjectHealthInputSchema,
+		execute: executeGetProjectHealth,
+		category: "health",
+		keywords: [
+			"health",
+			"score",
+			"pass rate",
+			"trend",
+			"overview"
+		]
+	},
+	{
+		metadata: getTestHistoryMetadata,
+		inputSchema: getTestHistoryInputSchema,
+		execute: executeGetTestHistory,
+		category: "testing",
+		keywords: [
+			"history",
+			"pass",
+			"fail",
+			"stability",
+			"regression"
+		]
+	},
+	{
+		metadata: getFlakyTestsMetadata,
+		inputSchema: getFlakyTestsInputSchema,
+		execute: executeGetFlakyTests,
+		category: "testing",
+		keywords: [
+			"flaky",
+			"flip",
+			"inconsistent",
+			"non-deterministic"
+		]
+	},
+	{
+		metadata: listTestRunsMetadata,
+		inputSchema: listTestRunsInputSchema,
+		execute: executeListTestRuns,
+		category: "testing",
+		keywords: [
+			"runs",
+			"list",
+			"commit",
+			"branch",
+			"recent"
+		]
+	},
+	{
+		metadata: getReportMetadata,
+		inputSchema: getReportInputSchema,
+		execute: executeGetReport,
+		category: "reports",
+		keywords: [
+			"report",
+			"files",
+			"download",
+			"artifacts"
+		]
+	},
+	{
+		metadata: getSlowestTestsMetadata,
+		inputSchema: getSlowestTestsInputSchema,
+		execute: executeGetSlowestTests,
+		category: "testing",
+		keywords: [
+			"slow",
+			"performance",
+			"duration",
+			"p95",
+			"bottleneck"
+		]
+	},
+	{
+		metadata: getTestRunDetailsMetadata,
+		inputSchema: getTestRunDetailsInputSchema,
+		execute: executeGetTestRunDetails,
+		category: "testing",
+		keywords: [
+			"details",
+			"results",
+			"errors",
+			"stack traces",
+			"test cases"
+		]
+	},
+	{
+		metadata: getFailureClustersMetadata,
+		inputSchema: getFailureClustersInputSchema,
+		execute: executeGetFailureClusters,
+		category: "testing",
+		keywords: [
+			"failure",
+			"clusters",
+			"root cause",
+			"error grouping"
+		]
+	},
+	{
+		metadata: compareTestMetricsMetadata,
+		inputSchema: compareTestMetricsInputSchema,
+		execute: executeCompareTestMetrics,
+		category: "testing",
+		keywords: [
+			"compare",
+			"before",
+			"after",
+			"regression",
+			"delta"
+		]
+	},
+	{
+		metadata: getCoverageSummaryMetadata,
+		inputSchema: getCoverageSummaryInputSchema,
+		execute: executeGetCoverageSummary,
+		category: "coverage",
+		keywords: [
+			"coverage",
+			"summary",
+			"lines",
+			"branches",
+			"functions"
+		]
+	},
+	{
+		metadata: getCoverageForFileMetadata,
+		inputSchema: getCoverageForFileInputSchema,
+		execute: executeGetCoverageForFile,
+		category: "coverage",
+		keywords: [
+			"coverage",
+			"file",
+			"path",
+			"lines",
+			"branches"
+		]
+	},
+	{
+		metadata: findUncoveredFailureAreasMetadata,
+		inputSchema: findUncoveredFailureAreasInputSchema,
+		execute: executeFindUncoveredFailureAreas,
+		category: "coverage",
+		keywords: [
+			"risk",
+			"uncovered",
+			"failures",
+			"low coverage"
+		]
+	},
+	{
+		metadata: getUntestedFilesMetadata,
+		inputSchema: getUntestedFilesInputSchema,
+		execute: executeGetUntestedFiles,
+		category: "coverage",
+		keywords: [
+			"untested",
+			"zero coverage",
+			"missing tests"
+		]
+	},
+	{
+		metadata: getReportBrowserUrlMetadata,
+		inputSchema: getReportBrowserUrlInputSchema,
+		execute: executeGetReportBrowserUrl,
+		category: "reports",
+		keywords: [
+			"browser",
+			"url",
+			"view",
+			"report",
+			"signed"
+		]
+	},
+	{
+		metadata: getUploadStatusMetadata,
+		inputSchema: getUploadStatusInputSchema,
+		execute: executeGetUploadStatus,
+		category: "uploads",
+		keywords: [
+			"upload",
+			"status",
+			"processing",
+			"CI",
+			"ready"
+		]
+	},
+	{
+		metadata: searchFailuresMetadata,
+		inputSchema: searchFailuresInputSchema,
+		execute: executeSearchFailures,
+		category: "testing",
+		keywords: [
+			"search",
+			"failure",
+			"error message",
+			"grep",
+			"find"
+		]
+	}
+];
+/**
+* Register all tool functions in the codemode registry.
+*/
+function registerAllTools(registry) {
+	for (const tool of TOOLS) registry.register({
+		name: tool.metadata.name,
+		description: tool.metadata.description,
+		category: tool.category,
+		keywords: tool.keywords,
+		inputSchema: tool.inputSchema,
+		execute: tool.execute
+	});
+}
+
+//#endregion
+//#region src/codemode/type-gen.ts
+/**
+* Convert a Zod schema to a TypeScript type string.
+* Handles the subset of Zod types used in our tool schemas.
+*/
+function zodToTs(schema) {
+	if (schema instanceof z.ZodEffects) return zodToTs(schema.innerType());
+	if (schema instanceof z.ZodOptional) return `${zodToTs(schema.unwrap())} | undefined`;
+	if (schema instanceof z.ZodNullable) return `${zodToTs(schema.unwrap())} | null`;
+	if (schema instanceof z.ZodDefault) return zodToTs(schema.removeDefault());
+	if (schema instanceof z.ZodString) return "string";
+	if (schema instanceof z.ZodNumber) return "number";
+	if (schema instanceof z.ZodBoolean) return "boolean";
+	if (schema instanceof z.ZodEnum) return schema.options.map((v) => `'${v}'`).join(" | ");
+	if (schema instanceof z.ZodLiteral) {
+		const val = schema.value;
+		return typeof val === "string" ? `'${val}'` : String(val);
+	}
+	if (schema instanceof z.ZodArray) {
+		const inner = zodToTs(schema.element);
+		if (inner.includes("|")) return `(${inner})[]`;
+		return `${inner}[]`;
+	}
+	if (schema instanceof z.ZodObject) {
+		const shape = schema.shape;
+		const entries = Object.entries(shape);
+		if (entries.length === 0) return "{}";
+		return `{ ${entries.map(([key, fieldSchema]) => formatField(key, fieldSchema)).join("; ")} }`;
+	}
+	if (schema instanceof z.ZodRecord) return `Record<string, ${zodToTs(schema.valueSchema)}>`;
+	if (schema instanceof z.ZodUnion) return schema.options.map((o) => zodToTs(o)).join(" | ");
+	console.error(`[gaffer-mcp] zodToTs: unhandled Zod type "${schema.constructor.name}", falling back to "unknown"`);
+	return "unknown";
+}
+/**
+* Format a single field as "name?: type" (with ? for optionals, unwrapping the inner type).
+*/
+function formatField(key, schema) {
+	const isOptional = schema instanceof z.ZodOptional;
+	return `${key}${isOptional ? "?" : ""}: ${isOptional ? zodToTs(schema.unwrap()) : zodToTs(schema)}`;
+}
+/**
+* Generate a TypeScript function declaration from a function name,
+* description, and Zod input schema (object shape).
+*/
+function generateDeclaration(name, description, inputSchema) {
+	const entries = Object.entries(inputSchema);
+	if (entries.length === 0) return `/** ${description} */\n${name}(): Promise<any>`;
+	return `/** ${description} */\n${name}(input: { ${entries.map(([key, schema]) => formatField(key, schema)).join("; ")} }): Promise<any>`;
+}
+
+//#endregion
+//#region src/codemode/registry.ts
+/**
+* Registry of codemode functions.
+* Wraps existing tool execute functions with metadata for discovery and namespace building.
+*/
+var FunctionRegistry = class {
+	entries = /* @__PURE__ */ new Map();
+	/**
+	* Register a function in the registry
+	*/
+	register(entry) {
+		this.entries.set(entry.name, entry);
+	}
+	/**
+	* Get all registered function entries
+	*/
+	getAll() {
+		return Array.from(this.entries.values());
+	}
+	/**
+	* Get a single entry by name
+	*/
+	get(name) {
+		return this.entries.get(name);
+	}
+	/**
+	* Build the namespace object that gets injected into the executor.
+	* Each function validates input via Zod then calls the tool's execute function.
+	*/
+	buildNamespace(client) {
+		const namespace = {};
+		for (const entry of this.entries.values()) namespace[entry.name] = async (input = {}) => {
+			const result = z.object(entry.inputSchema).safeParse(input);
+			if (!result.success) {
+				const issues = result.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join(", ");
+				throw new Error(`Invalid input for ${entry.name}: ${issues}`);
+			}
+			try {
+				return await entry.execute(client, result.data);
+			} catch (error) {
+				const message = error instanceof Error ? error.message : String(error);
+				throw new Error(`${entry.name} failed: ${message}`, { cause: error });
+			}
+		};
+		return namespace;
+	}
+	/**
+	* Generate TypeScript declarations for all registered functions.
+	* Used in the execute_code tool description so the LLM knows available functions.
+	*/
+	generateAllDeclarations() {
+		return this.getAll().map((entry) => generateDeclaration(entry.name, entry.description, entry.inputSchema)).join("\n\n");
+	}
+	/**
+	* Generate a declaration for a single function
+	*/
+	generateDeclaration(name) {
+		const entry = this.entries.get(name);
+		if (!entry) return null;
+		return generateDeclaration(entry.name, entry.description, entry.inputSchema);
+	}
+	/**
+	* Search for functions matching a query.
+	* Scores: name match (10) > category match (5) > keyword match (3) > description match (1)
+	*/
+	search(query) {
+		if (!query.trim()) return this.listAll();
+		const terms = query.toLowerCase().split(/\s+/);
+		const scored = [];
+		for (const entry of this.entries.values()) {
+			let score = 0;
+			const nameLower = entry.name.toLowerCase();
+			const categoryLower = entry.category.toLowerCase();
+			const descLower = entry.description.toLowerCase();
+			const keywordsLower = entry.keywords.map((k) => k.toLowerCase());
+			for (const term of terms) {
+				if (nameLower.includes(term)) score += 10;
+				if (categoryLower.includes(term)) score += 5;
+				if (keywordsLower.some((k) => k.includes(term))) score += 3;
+				if (descLower.includes(term)) score += 1;
+			}
+			if (score > 0) scored.push({
+				entry,
+				score
+			});
+		}
+		scored.sort((a, b) => b.score - a.score);
+		return scored.map(({ entry }) => this.toSearchResult(entry));
+	}
+	/**
+	* List all functions (used when search query is empty)
+	*/
+	listAll() {
+		return Array.from(this.entries.values()).map((entry) => this.toSearchResult(entry));
+	}
+	toSearchResult(entry) {
+		return {
+			name: entry.name,
+			description: entry.description,
+			category: entry.category,
+			declaration: generateDeclaration(entry.name, entry.description, entry.inputSchema)
+		};
+	}
+};
+
+//#endregion
+//#region src/codemode/search.ts
+const searchToolsInputSchema = { query: z.string().optional().describe("Search query to find relevant functions. Leave empty to list all available functions.") };
+/**
+* Execute search_tools: find functions by keyword matching
+*/
+function executeSearchTools(registry, input) {
+	return { functions: input.query ? registry.search(input.query) : registry.listAll() };
+}
+
+//#endregion
+//#region src/tools/list-projects.ts
+/**
+* Input schema for list_projects tool
+*/
+const listProjectsInputSchema = {
+	organizationId: z.string().optional().describe("Filter by organization ID (optional)"),
+	limit: z.number().int().min(1).max(100).optional().describe("Maximum number of projects to return (default: 50)")
+};
+/**
+* Output schema for list_projects tool
+*/
+const listProjectsOutputSchema = {
+	projects: z.array(z.object({
+		id: z.string(),
+		name: z.string(),
+		description: z.string().nullable().optional(),
+		organization: z.object({
+			id: z.string(),
+			name: z.string(),
+			slug: z.string()
+		})
+	})),
+	total: z.number()
+};
+/**
+* Execute list_projects tool
+*/
+async function executeListProjects(client, input) {
+	const response = await client.listProjects({
+		organizationId: input.organizationId,
+		limit: input.limit
+	});
+	return {
+		projects: response.projects.map((p) => ({
+			id: p.id,
+			name: p.name,
+			description: p.description,
+			organization: p.organization
+		})),
+		total: response.pagination.total
+	};
+}
+/**
+* Tool metadata
+*/
+const listProjectsMetadata = {
+	name: "list_projects",
+	title: "List Projects",
+	description: `List all projects you have access to.
+
+Returns a list of projects with their IDs, names, and organization info.
+Use this to find project IDs for other tools like get_project_health.
+
+Requires a user API Key (gaf_). Get one from Account Settings in the Gaffer dashboard.`
+};
+
 //#endregion
 //#region src/index.ts
 /**
@@ -1774,48 +2218,29 @@ function logError(toolName, error) {
 */
 function handleToolError(toolName, error) {
 	logError(toolName, error);
+	const message = error instanceof Error ? error.message : "Unknown error";
+	const logs = Array.isArray(error?.logs) ? error.logs : void 0;
+	const durationMs = typeof error?.durationMs === "number" ? error.durationMs : void 0;
+	let text = `Error: ${message}`;
+	if (logs?.length) text += `\n\nCaptured logs:\n${logs.join("\n")}`;
+	if (durationMs !== void 0) text += `\n\nDuration: ${durationMs}ms`;
 	return {
 		content: [{
 			type: "text",
-			text: `Error: ${error instanceof Error ? error.message : "Unknown error"}`
+			text
 		}],
 		isError: true
 	};
 }
 /**
-* Register a tool with the MCP server using a consistent pattern.
-* Reduces boilerplate by handling error wrapping and response formatting.
-*/
-function registerTool(server, client, tool) {
-	server.registerTool(tool.metadata.name, {
-		title: tool.metadata.title,
-		description: tool.metadata.description,
-		inputSchema: tool.inputSchema,
-		outputSchema: tool.outputSchema
-	}, async (input) => {
-		try {
-			const output = await tool.execute(client, input);
-			return {
-				content: [{
-					type: "text",
-					text: JSON.stringify(output, null, 2)
-				}],
-				structuredContent: output
-			};
-		} catch (error) {
-			return handleToolError(tool.metadata.name, error);
-		}
-	});
-}
-/**
-* Gaffer MCP Server
+* Gaffer MCP Server — Code Mode
 *
-* Provides AI assistants with access to test history and health metrics.
+* Instead of individual tools, exposes 3 tools:
+* - execute_code: Run JavaScript that calls Gaffer API functions
+* - search_tools: Find available functions by keyword
+* - list_projects: List projects (user tokens only)
 *
-* Supports two authentication modes:
-* 1. User API Keys (gaf_) - Read-only access to all user's projects
-*    Set via GAFFER_API_KEY environment variable
-* 2. Project Upload Tokens (gfr_) - Legacy, single project access
+* This follows Cloudflare's "code mode" pattern for MCP servers.
 */
 async function main() {
 	if (!process.env.GAFFER_API_KEY) {
@@ -1832,169 +2257,153 @@ async function main() {
 		process.exit(1);
 	}
 	const client = GafferApiClient.fromEnv();
+	const registry = new FunctionRegistry();
+	registerAllTools(registry);
+	const namespace = registry.buildNamespace(client);
+	const declarations = registry.generateAllDeclarations();
 	const server = new McpServer({
 		name: "gaffer",
-		version: "0.1.0"
-	}, { instructions: `Gaffer provides test analytics and coverage data for your projects.
+		version: "0.7.0"
+	}, { instructions: `Gaffer provides test analytics and coverage data. This server uses **code mode** — instead of individual tools, write JavaScript that calls functions on the \`codemode\` namespace.
 
 ## Authentication
 
-${client.isUserToken() ? "You have access to multiple projects. Use `list_projects` to find project IDs, then pass `projectId` to all tools." : "Your token is scoped to a single project. Do NOT call `list_projects`. Do NOT pass `projectId` — it is resolved automatically. Note: some tools (coverage, failure clusters, slowest tests, etc.) require a user API key and are not available."}
-
-## Coverage Analysis Best Practices
-
-When helping users improve test coverage, combine coverage data with codebase exploration:
-
-1. **Understand code utilization first**: Before targeting files by coverage percentage, explore which code is critical:
-   - Find entry points (route definitions, event handlers, exported functions)
-   - Find heavily-imported files (files imported by many others are high-value targets)
-   - Identify critical business logic (auth, payments, data mutations)
-
-2. **Prioritize by impact**: Low coverage alone doesn't indicate priority. Consider:
-   - High utilization + low coverage = highest priority
-   - Large files with 0% coverage have bigger impact than small files
-   - Use find_uncovered_failure_areas for files with both low coverage AND test failures
-
-3. **Use path-based queries**: The get_untested_files tool may return many files of a certain type (e.g., UI components). For targeted analysis, use get_coverage_for_file with path prefixes to focus on specific areas of the codebase.
-
-4. **Iterate**: Get baseline → identify targets → write tests → re-check coverage after CI uploads new results.
-
-## Finding Invisible Files
-
-Coverage tools can only report on files that were loaded during test execution. Some files have 0% coverage but don't appear in reports at all - these are "invisible" files that were never imported.
-
-To find invisible files:
-1. Use get_coverage_for_file with a path prefix (e.g., "server/") to see what Gaffer tracks
-2. Use the local Glob tool to list all source files in that path
-3. Compare the lists - files in local but NOT in Gaffer are invisible
-4. These files need tests that actually import them
-
-Example: If get_coverage_for_file("server/api") returns user.ts, auth.ts, but Glob finds user.ts, auth.ts, billing.ts - then billing.ts is invisible and needs tests that import it.
+${client.isUserToken() ? "You have a user API key with access to multiple projects. Use `list_projects` to find project IDs, then pass `projectId` to all codemode functions." : "Your token is scoped to a single project. Do NOT pass `projectId` — it resolves automatically."}
 
-## Agentic CI / Test Failure Diagnosis
+## How to Use
 
-When helping diagnose CI failures or fix failing tests:
+1. Use \`search_tools\` to find relevant functions (or check the execute_code description for all declarations)
+2. Use \`execute_code\` to run JavaScript that calls one or more functions
+3. Results are returned as JSON — you can chain multiple calls in a single execution
 
-1. **Check flakiness first**: Use get_flaky_tests to identify non-deterministic tests.
-   Skip flaky tests unless the user specifically wants to stabilize them.
+## Example
 
-2. **Get failure details**: Use get_test_run_details with status='failed'
-   to see error messages and stack traces for failing tests.
-
-3. **Group by root cause**: Use get_failure_clusters to see which failures
-   share the same underlying error — fix the root cause, not individual tests.
-
-4. **Check history**: Use get_test_history to understand if the failure is new
-   (regression) or recurring (existing bug).
-
-5. **Verify fixes**: After code changes, use compare_test_metrics to confirm
-   the specific test now passes.
-
-6. **Prioritize by risk**: Use find_uncovered_failure_areas to identify
-   which failing code has the lowest test coverage — fix those first.
-
-## Checking Upload Status
+\`\`\`javascript
+// Get project health, then check flaky tests if any exist
+const health = await codemode.get_project_health({ projectId: "proj_abc" });
+if (health.flakyTestCount > 0) {
+  const flaky = await codemode.get_flaky_tests({ projectId: "proj_abc" });
+  return { health, flaky };
+}
+return { health };
+\`\`\`
+
+## Tips
+
+- Use \`return\` to send data back — the return value becomes the tool result
+- Use \`console.log()\` for debug output (captured and returned alongside results)
+- You can make up to 20 API calls per execution
+- All functions are async — use \`await\`` });
+	server.registerTool("execute_code", {
+		title: "Execute Code",
+		description: `Execute JavaScript code that calls Gaffer API functions via the \`codemode\` namespace.
+
+Write async JavaScript — all functions are available as \`codemode.<function_name>(input)\`.
+Use \`return\` to send results back. Use \`console.log()\` for debug output.
+
+## Available Functions
+
+\`\`\`typescript
+${declarations}
+\`\`\`
+
+## Examples
+
+\`\`\`javascript
+// Single call
+const health = await codemode.get_project_health({ projectId: "proj_abc" });
+return health;
+\`\`\`
+
+\`\`\`javascript
+// Multi-step: get flaky tests and check history for each
+const flaky = await codemode.get_flaky_tests({ projectId: "proj_abc", limit: 5 });
+const histories = [];
+for (const test of flaky.flakyTests) {
+  const history = await codemode.get_test_history({ projectId: "proj_abc", testName: test.name, limit: 5 });
+  histories.push({ test: test.name, score: test.flakinessScore, history: history.summary });
+}
+return { flaky: flaky.summary, details: histories };
+\`\`\`
+
+\`\`\`javascript
+// Coverage analysis
+const summary = await codemode.get_coverage_summary({ projectId: "proj_abc" });
+const lowFiles = await codemode.get_coverage_for_file({ projectId: "proj_abc", maxCoverage: 50, limit: 10 });
+return { summary, lowCoverageFiles: lowFiles };
+\`\`\`
+
+## Constraints
+
+- Max 20 API calls per execution
+- 30s timeout
+- No access to Node.js globals (process, require, etc.)`,
+		inputSchema: { code: z.string().describe("JavaScript code to execute. Use `codemode.<function>()` to call API functions. Use `return` for results.") }
+	}, async (input) => {
+		try {
+			const result = await executeCode(input.code, namespace);
+			const output = {};
+			if (result.result !== void 0) output.result = result.result;
+			if (result.logs.length > 0) output.logs = result.logs;
+			output.durationMs = result.durationMs;
+			let text;
+			try {
+				text = JSON.stringify(output, null, 2);
+			} catch {
+				text = JSON.stringify({
+					error: "Result could not be serialized to JSON (possible circular reference). Use console.log() to inspect the result, or return a simpler object.",
+					logs: result.logs.length > 0 ? result.logs : void 0,
+					durationMs: result.durationMs
+				});
+			}
+			return { content: [{
+				type: "text",
+				text
+			}] };
+		} catch (error) {
+			return handleToolError("execute_code", error);
+		}
+	});
+	server.registerTool("search_tools", {
+		title: "Search Tools",
+		description: `Search for available Gaffer API functions by keyword.
 
-When an agent needs to know if CI results are ready:
+Returns matching functions with their TypeScript declarations so you can use them with execute_code.
 
-1. Use get_upload_status with commitSha or branch to find upload sessions
-2. Check processingStatus: "completed" means results are ready, "processing" means wait
-3. Once completed, use the linked testRunIds to get test results` });
-	registerTool(server, client, {
-		metadata: getProjectHealthMetadata,
-		inputSchema: getProjectHealthInputSchema,
-		outputSchema: getProjectHealthOutputSchema,
-		execute: executeGetProjectHealth
-	});
-	registerTool(server, client, {
-		metadata: getTestHistoryMetadata,
-		inputSchema: getTestHistoryInputSchema,
-		outputSchema: getTestHistoryOutputSchema,
-		execute: executeGetTestHistory
-	});
-	registerTool(server, client, {
-		metadata: getFlakyTestsMetadata,
-		inputSchema: getFlakyTestsInputSchema,
-		outputSchema: getFlakyTestsOutputSchema,
-		execute: executeGetFlakyTests
-	});
-	registerTool(server, client, {
-		metadata: listTestRunsMetadata,
-		inputSchema: listTestRunsInputSchema,
-		outputSchema: listTestRunsOutputSchema,
-		execute: executeListTestRuns
+Examples:
+- "coverage" → coverage-related functions
+- "flaky" → flaky test detection
+- "" (empty) → list all available functions`,
+		inputSchema: searchToolsInputSchema
+	}, async (input) => {
+		try {
+			const result = executeSearchTools(registry, input);
+			return { content: [{
+				type: "text",
+				text: JSON.stringify(result, null, 2)
+			}] };
+		} catch (error) {
+			return handleToolError("search_tools", error);
+		}
 	});
-	if (client.isUserToken()) registerTool(server, client, {
-		metadata: listProjectsMetadata,
+	if (client.isUserToken()) server.registerTool(listProjectsMetadata.name, {
+		title: listProjectsMetadata.title,
+		description: listProjectsMetadata.description,
 		inputSchema: listProjectsInputSchema,
-		outputSchema: listProjectsOutputSchema,
-		execute: executeListProjects
-	});
-	registerTool(server, client, {
-		metadata: getReportMetadata,
-		inputSchema: getReportInputSchema,
-		outputSchema: getReportOutputSchema,
-		execute: executeGetReport
-	});
-	registerTool(server, client, {
-		metadata: getSlowestTestsMetadata,
-		inputSchema: getSlowestTestsInputSchema,
-		outputSchema: getSlowestTestsOutputSchema,
-		execute: executeGetSlowestTests
-	});
-	registerTool(server, client, {
-		metadata: getTestRunDetailsMetadata,
-		inputSchema: getTestRunDetailsInputSchema,
-		outputSchema: getTestRunDetailsOutputSchema,
-		execute: executeGetTestRunDetails
-	});
-	registerTool(server, client, {
-		metadata: getFailureClustersMetadata,
-		inputSchema: getFailureClustersInputSchema,
-		outputSchema: getFailureClustersOutputSchema,
-		execute: executeGetFailureClusters
-	});
-	registerTool(server, client, {
-		metadata: compareTestMetricsMetadata,
-		inputSchema: compareTestMetricsInputSchema,
-		outputSchema: compareTestMetricsOutputSchema,
-		execute: executeCompareTestMetrics
-	});
-	registerTool(server, client, {
-		metadata: getCoverageSummaryMetadata,
-		inputSchema: getCoverageSummaryInputSchema,
-		outputSchema: getCoverageSummaryOutputSchema,
-		execute: executeGetCoverageSummary
-	});
-	registerTool(server, client, {
-		metadata: getCoverageForFileMetadata,
-		inputSchema: getCoverageForFileInputSchema,
-		outputSchema: getCoverageForFileOutputSchema,
-		execute: executeGetCoverageForFile
-	});
-	registerTool(server, client, {
-		metadata: findUncoveredFailureAreasMetadata,
-		inputSchema: findUncoveredFailureAreasInputSchema,
-		outputSchema: findUncoveredFailureAreasOutputSchema,
-		execute: executeFindUncoveredFailureAreas
-	});
-	registerTool(server, client, {
-		metadata: getUntestedFilesMetadata,
-		inputSchema: getUntestedFilesInputSchema,
-		outputSchema: getUntestedFilesOutputSchema,
-		execute: executeGetUntestedFiles
-	});
-	registerTool(server, client, {
-		metadata: getReportBrowserUrlMetadata,
-		inputSchema: getReportBrowserUrlInputSchema,
-		outputSchema: getReportBrowserUrlOutputSchema,
-		execute: executeGetReportBrowserUrl
-	});
-	registerTool(server, client, {
-		metadata: getUploadStatusMetadata,
-		inputSchema: getUploadStatusInputSchema,
-		outputSchema: getUploadStatusOutputSchema,
-		execute: executeGetUploadStatus
+		outputSchema: listProjectsOutputSchema
+	}, async (input) => {
+		try {
+			const output = await executeListProjects(client, input);
+			return {
+				content: [{
+					type: "text",
+					text: JSON.stringify(output, null, 2)
+				}],
+				structuredContent: output
+			};
+		} catch (error) {
+			return handleToolError(listProjectsMetadata.name, error);
+		}
 	});
 	const transport = new StdioServerTransport();
 	await server.connect(transport);