@githits/mcp 0.4.15 → 0.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md CHANGED
@@ -11,9 +11,10 @@ This package exposes transport-neutral helpers for servers that want the GitHits
11
11
  - `getMcpToolDescriptors()` returns static tool metadata without requiring concrete services.
12
12
  - `buildMcpInstructions(options?)` builds the GitHits MCP instruction block.
13
13
  - `@githits/mcp/client` exports concrete GitHits service implementations, static token providers, URL/config helpers, request-header helpers, telemetry helpers, and registry helpers for remote MCP servers.
14
+ - `@githits/mcp/smoke-test` exports reusable smoke assertions and `runMcpSmoke()` for remote MCP server validation.
14
15
 
15
- The package expects callers to provide service implementations through `McpToolServices` or a request-scoped `McpToolServicesProvider`.
16
+ The package expects callers to provide service implementations through `McpToolServices` or a request-scoped `McpToolServicesProvider`. Servers can pass `traceTool` to `createMcpServer()` or `registerMcpTools()` to wrap public tool execution for instrumentation without receiving arguments or auth data.
16
17
 
17
- Only imports from `@githits/mcp`, `@githits/mcp/client`, and `@githits/mcp/package.json` are public. The workspace alias `@githits/mcp/internal` is not exported, is not supported for external consumers, and must not be used by remote MCP server implementations.
18
+ Only imports from `@githits/mcp`, `@githits/mcp/client`, `@githits/mcp/smoke-test`, and `@githits/mcp/package.json` are public. The workspace alias `@githits/mcp/internal` is not exported, is not supported for external consumers, and must not be used by remote MCP server implementations.
18
19
 
19
20
  Remote MCP servers should provide request-scoped services through `createMcpServer()` and keep transport, auth/session handling, deployment config, and observability outside this package.
package/dist/client.d.ts CHANGED
@@ -543,6 +543,8 @@ declare class GitHitsServiceImpl implements GitHitsService {
543
543
  interface PackageSummaryParams {
544
544
  registry: PkgseerRegistry;
545
545
  packageName: string;
546
+ /** Include verbose/json-only fields such as recent advisories and changes. */
547
+ includeVerboseFields?: boolean;
546
548
  }
547
549
  interface PackageIdentity {
548
550
  name: string;
@@ -645,6 +647,10 @@ interface PackageDependenciesParams {
645
647
  version?: string;
646
648
  /** Optional. Backend returns a full transitive graph when true. */
647
649
  includeTransitive?: boolean;
650
+ /** Include transitive aggregate/detail fields beyond the dependency graph. */
651
+ includeTransitiveDetails?: boolean;
652
+ /** Include dependency group metadata. */
653
+ includeGroups?: boolean;
648
654
  /**
649
655
  * Optional transitive-traversal depth (1–10). Omit for the backend
650
656
  * default (full graph) — note the CLI applies a 3-deep guardrail but
@@ -669,19 +675,158 @@ interface PackageUpgradeDependencyProbeParams {
669
675
  includeDependencyChanges?: boolean;
670
676
  includeGroups?: boolean;
671
677
  }
678
+ interface PackageUpgradeReviewPackageParams {
679
+ registry: PkgseerRegistry;
680
+ name: string;
681
+ currentVersion: string;
682
+ targetVersion: string;
683
+ }
684
+ interface PackageUpgradeReviewParams {
685
+ packages: PackageUpgradeReviewPackageParams[];
686
+ includeTransitiveSecurity: boolean;
687
+ includeDependencyIssues: boolean;
688
+ changelogLimit: number;
689
+ minSeverity?: number;
690
+ }
691
+ interface PackageUpgradeAdvisorySummary {
692
+ id?: string;
693
+ aliases: string[];
694
+ summary?: string;
695
+ severity?: number;
696
+ severityLabel?: string;
697
+ fixedIn: string[];
698
+ isMalicious?: boolean;
699
+ }
700
+ interface PackageUpgradeVersionVulnerabilitySummary {
701
+ version: string;
702
+ publishedAt?: string;
703
+ deprecated?: boolean;
704
+ deprecationReason?: string;
705
+ affectedCount: number;
706
+ nonAffectingCount: number;
707
+ allCount: number;
708
+ lastModifiedAt?: string;
709
+ advisories: PackageUpgradeAdvisorySummary[];
710
+ }
711
+ interface PackageUpgradeTransitiveVulnerablePackage {
712
+ id: string;
713
+ registry: string;
714
+ name: string;
715
+ versions: string[];
716
+ affectedCount: number;
717
+ maxSeverityScore?: number;
718
+ maxSeverityLabel?: string;
719
+ advisoryIds: string[];
720
+ }
721
+ interface PackageUpgradeTransitivePackagePage {
722
+ entries: PackageUpgradeTransitiveVulnerablePackage[];
723
+ totalCount: number;
724
+ truncated: boolean;
725
+ }
726
+ interface PackageUpgradeTransitiveSecurity {
727
+ currentAffected: number;
728
+ targetAffected: number;
729
+ introducedPackages: string[];
730
+ fixedPackages: string[];
731
+ introducedPackageDetails: PackageUpgradeTransitivePackagePage;
732
+ fixedPackageDetails: PackageUpgradeTransitivePackagePage;
733
+ stillAffectedPackageDetails: PackageUpgradeTransitivePackagePage;
734
+ }
735
+ interface PackageUpgradeSecurity {
736
+ current?: PackageUpgradeVersionVulnerabilitySummary;
737
+ target?: PackageUpgradeVersionVulnerabilitySummary;
738
+ added: PackageUpgradeAdvisorySummary[];
739
+ removed: PackageUpgradeAdvisorySummary[];
740
+ notAddressed: PackageUpgradeAdvisorySummary[];
741
+ fixed: PackageUpgradeAdvisorySummary[];
742
+ introduced: PackageUpgradeAdvisorySummary[];
743
+ unchanged: PackageUpgradeAdvisorySummary[];
744
+ transitive?: PackageUpgradeTransitiveSecurity;
745
+ }
746
+ interface PackageUpgradeChangelogEntry {
747
+ version?: string;
748
+ publishedAt?: string;
749
+ htmlUrl?: string;
750
+ body?: string;
751
+ bodyPreview?: string;
752
+ headline?: string;
753
+ signals: string[];
754
+ }
755
+ interface PackageUpgradeChangelog {
756
+ source?: string;
757
+ fallback?: string;
758
+ entries: PackageUpgradeChangelogEntry[];
759
+ sampledEntries: PackageUpgradeChangelogEntry[];
760
+ keywordEntries: PackageUpgradeChangelogEntry[];
761
+ totalKeywordEntries: number;
762
+ totalEntries: number;
763
+ totalEntriesWithBodies: number;
764
+ truncated: boolean;
765
+ hasReleaseNoteBodies: boolean;
766
+ breakingSignals: string[];
767
+ migrationSignals: string[];
768
+ }
769
+ interface PackageUpgradeCompatibility {
770
+ peerDependencyChanges: string[];
771
+ notes: string[];
772
+ }
773
+ interface PackageUpgradeDependencyChangeItem {
774
+ name: string;
775
+ registry?: string;
776
+ version?: string;
777
+ fromVersions: string[];
778
+ toVersions: string[];
779
+ constraint?: string;
780
+ type?: string;
781
+ }
782
+ interface PackageUpgradeDependencyChangeGroup {
783
+ added: PackageUpgradeDependencyChangeItem[];
784
+ removed: PackageUpgradeDependencyChangeItem[];
785
+ changed: PackageUpgradeDependencyChangeItem[];
786
+ }
787
+ interface PackageUpgradeDependencyChanges {
788
+ direct: PackageUpgradeDependencyChangeGroup;
789
+ transitive: PackageUpgradeDependencyChangeGroup;
790
+ }
791
+ interface PackageUpgradeDependencyIssues {
792
+ currentTotal: number;
793
+ targetTotal: number;
794
+ introducedDeprecated: string[];
795
+ introducedDuplicates: string[];
796
+ introducedConflicts: string[];
797
+ introducedOutdated: string[];
798
+ }
799
+ interface PackageUpgradeReview {
800
+ registry: string;
801
+ name: string;
802
+ currentVersion: string;
803
+ targetVersion: string;
804
+ latestVersion?: string;
805
+ versionDelta: string;
806
+ security: PackageUpgradeSecurity;
807
+ changelog: PackageUpgradeChangelog;
808
+ compatibility?: PackageUpgradeCompatibility;
809
+ dependencyChanges?: PackageUpgradeDependencyChanges;
810
+ dependencyIssues?: PackageUpgradeDependencyIssues;
811
+ unknowns: string[];
812
+ }
813
+ interface PackageUpgradeReviewResponse {
814
+ summary: {
815
+ total: number;
816
+ withUnknowns: number;
817
+ withAddedAdvisories: number;
818
+ withBreakingSignals: number;
819
+ withDirectDependencyChanges: number;
820
+ withTransitiveVulnerabilityAdditions: number;
821
+ };
822
+ reviews: PackageUpgradeReview[];
823
+ }
672
824
  interface DirectDependency {
673
825
  name: string;
674
826
  versionConstraint?: string;
675
827
  type?: string;
676
828
  }
677
829
  /**
678
- * Opaque GenericJSON passthrough. The `package_dependencies` tool
679
- * migrated to typed fields (`dependencyGraph`, `dependencyConflicts`,
680
- * `circularDependencyCycles`, `environmentMarkers`); this type is
681
- * retained for the one remaining passthrough — `ChangelogEntryDetail.metadata`.
682
- */
683
- type UntypedGenericJSON = unknown;
684
- /**
685
830
  * Node in a typed dependency graph. Mirrors `DependencyGraphNode`.
686
831
  * `registry` is a lowercase string: `"npm"`, `"pypi"`, …, or
687
832
  * `"synthetic"` for manifest / project root nodes. `version` is null
@@ -912,6 +1057,8 @@ interface PackageChangelogParams {
912
1057
  toVersion?: string;
913
1058
  /** Latest-mode cap (1–50). Rejected client-side when `fromVersion` is set. */
914
1059
  limit?: number;
1060
+ /** Include raw markdown bodies in entries. Defaults to true. */
1061
+ includeBodies?: boolean;
915
1062
  }
916
1063
  /**
917
1064
  * Package-info echo from the changelog response. Mirrors
@@ -926,20 +1073,13 @@ interface ChangelogPackageInfo {
926
1073
  toVersion?: string;
927
1074
  limit?: number;
928
1075
  }
929
- /**
930
- * Full changelog entry as observed on the wire. The envelope builder
931
- * projects this into the lean response shape; `metadata` is dropped
932
- * from the envelope because its source-specific opaque structure
933
- * isn't worth the token cost today. Revisit via agent feedback.
934
- */
1076
+ /** Full changelog entry as observed on the wire. */
935
1077
  interface ChangelogEntryDetail {
936
1078
  version?: string;
937
1079
  normalizedVersion?: string;
938
1080
  body?: string;
939
1081
  htmlUrl?: string;
940
1082
  publishedAt?: string;
941
- /** TODO(backend): surface when shape is documented. */
942
- metadata?: UntypedGenericJSON;
943
1083
  }
944
1084
  interface ChangelogReport {
945
1085
  /** Echo of addressing + filter as the backend saw it. */
@@ -1019,6 +1159,7 @@ interface PackageIntelligenceService {
1019
1159
  packageVulnerabilities(params: PackageVulnerabilitiesParams): Promise<VulnerabilityReport>;
1020
1160
  packageDependencies(params: PackageDependenciesParams): Promise<DependencyReport>;
1021
1161
  packageUpgradeDependencyProbe(params: PackageUpgradeDependencyProbeParams): Promise<DependencyReport>;
1162
+ packageUpgradeReview(params: PackageUpgradeReviewParams): Promise<PackageUpgradeReviewResponse>;
1022
1163
  packageChangelog(params: PackageChangelogParams): Promise<ChangelogReport>;
1023
1164
  listPackageDocs(params: ListPackageDocsParams): Promise<PackageDocsList>;
1024
1165
  readPackageDoc(params: ReadPackageDocParams): Promise<PackageDocResult>;
@@ -1045,6 +1186,8 @@ declare class PackageIntelligenceServiceImpl implements PackageIntelligenceServi
1045
1186
  private normaliseVulnerabilityReport;
1046
1187
  packageDependencies(params: PackageDependenciesParams): Promise<DependencyReport>;
1047
1188
  packageUpgradeDependencyProbe(params: PackageUpgradeDependencyProbeParams): Promise<DependencyReport>;
1189
+ packageUpgradeReview(params: PackageUpgradeReviewParams): Promise<PackageUpgradeReviewResponse>;
1190
+ private executePackageUpgradeReview;
1048
1191
  private executePackageUpgradeDependencyProbe;
1049
1192
  private executePackageDependencies;
1050
1193
  private normaliseDependencyReport;
package/dist/client.js CHANGED
@@ -1 +1 @@
1
- import{CodeNavigationServiceImpl,DEFAULT_API_URL,DEFAULT_CODE_NAV_URL,DEFAULT_MCP_URL,GitHitsServiceImpl,PKGSEER_REGISTRY_LIST,PackageIntelligenceServiceImpl,RefreshingGitHitsService,createClientHeaderBuilder,createStaticTokenProvider,endTelemetrySpan,flushTelemetry,getApiUrl,getCodeNavigationUrl,getEnvApiToken,getMcpUrl,startTelemetrySpan,toPkgseerRegistry,toPkgseerRegistryLowercase,withTelemetrySpan}from"./shared/chunk-95wchh8v.js";export{withTelemetrySpan,toPkgseerRegistryLowercase,toPkgseerRegistry,startTelemetrySpan,getMcpUrl,getEnvApiToken,getCodeNavigationUrl,getApiUrl,flushTelemetry,endTelemetrySpan,createStaticTokenProvider,createClientHeaderBuilder,RefreshingGitHitsService,PackageIntelligenceServiceImpl,PKGSEER_REGISTRY_LIST,GitHitsServiceImpl,DEFAULT_MCP_URL,DEFAULT_CODE_NAV_URL,DEFAULT_API_URL,CodeNavigationServiceImpl};
1
+ import{CodeNavigationServiceImpl,DEFAULT_API_URL,DEFAULT_CODE_NAV_URL,DEFAULT_MCP_URL,GitHitsServiceImpl,PKGSEER_REGISTRY_LIST,PackageIntelligenceServiceImpl,RefreshingGitHitsService,createClientHeaderBuilder,createStaticTokenProvider,endTelemetrySpan,flushTelemetry,getApiUrl,getCodeNavigationUrl,getEnvApiToken,getMcpUrl,startTelemetrySpan,toPkgseerRegistry,toPkgseerRegistryLowercase,withTelemetrySpan}from"./shared/chunk-gay5esxj.js";export{withTelemetrySpan,toPkgseerRegistryLowercase,toPkgseerRegistry,startTelemetrySpan,getMcpUrl,getEnvApiToken,getCodeNavigationUrl,getApiUrl,flushTelemetry,endTelemetrySpan,createStaticTokenProvider,createClientHeaderBuilder,RefreshingGitHitsService,PackageIntelligenceServiceImpl,PKGSEER_REGISTRY_LIST,GitHitsServiceImpl,DEFAULT_MCP_URL,DEFAULT_CODE_NAV_URL,DEFAULT_API_URL,CodeNavigationServiceImpl};
package/dist/index.d.ts CHANGED
@@ -428,6 +428,8 @@ interface GitHitsService {
428
428
  interface PackageSummaryParams {
429
429
  registry: PkgseerRegistry;
430
430
  packageName: string;
431
+ /** Include verbose/json-only fields such as recent advisories and changes. */
432
+ includeVerboseFields?: boolean;
431
433
  }
432
434
  interface PackageIdentity {
433
435
  name: string;
@@ -530,6 +532,10 @@ interface PackageDependenciesParams {
530
532
  version?: string;
531
533
  /** Optional. Backend returns a full transitive graph when true. */
532
534
  includeTransitive?: boolean;
535
+ /** Include transitive aggregate/detail fields beyond the dependency graph. */
536
+ includeTransitiveDetails?: boolean;
537
+ /** Include dependency group metadata. */
538
+ includeGroups?: boolean;
533
539
  /**
534
540
  * Optional transitive-traversal depth (1–10). Omit for the backend
535
541
  * default (full graph) — note the CLI applies a 3-deep guardrail but
@@ -554,19 +560,158 @@ interface PackageUpgradeDependencyProbeParams {
554
560
  includeDependencyChanges?: boolean;
555
561
  includeGroups?: boolean;
556
562
  }
563
+ interface PackageUpgradeReviewPackageParams {
564
+ registry: PkgseerRegistry;
565
+ name: string;
566
+ currentVersion: string;
567
+ targetVersion: string;
568
+ }
569
+ interface PackageUpgradeReviewParams {
570
+ packages: PackageUpgradeReviewPackageParams[];
571
+ includeTransitiveSecurity: boolean;
572
+ includeDependencyIssues: boolean;
573
+ changelogLimit: number;
574
+ minSeverity?: number;
575
+ }
576
+ interface PackageUpgradeAdvisorySummary {
577
+ id?: string;
578
+ aliases: string[];
579
+ summary?: string;
580
+ severity?: number;
581
+ severityLabel?: string;
582
+ fixedIn: string[];
583
+ isMalicious?: boolean;
584
+ }
585
+ interface PackageUpgradeVersionVulnerabilitySummary {
586
+ version: string;
587
+ publishedAt?: string;
588
+ deprecated?: boolean;
589
+ deprecationReason?: string;
590
+ affectedCount: number;
591
+ nonAffectingCount: number;
592
+ allCount: number;
593
+ lastModifiedAt?: string;
594
+ advisories: PackageUpgradeAdvisorySummary[];
595
+ }
596
+ interface PackageUpgradeTransitiveVulnerablePackage {
597
+ id: string;
598
+ registry: string;
599
+ name: string;
600
+ versions: string[];
601
+ affectedCount: number;
602
+ maxSeverityScore?: number;
603
+ maxSeverityLabel?: string;
604
+ advisoryIds: string[];
605
+ }
606
+ interface PackageUpgradeTransitivePackagePage {
607
+ entries: PackageUpgradeTransitiveVulnerablePackage[];
608
+ totalCount: number;
609
+ truncated: boolean;
610
+ }
611
+ interface PackageUpgradeTransitiveSecurity {
612
+ currentAffected: number;
613
+ targetAffected: number;
614
+ introducedPackages: string[];
615
+ fixedPackages: string[];
616
+ introducedPackageDetails: PackageUpgradeTransitivePackagePage;
617
+ fixedPackageDetails: PackageUpgradeTransitivePackagePage;
618
+ stillAffectedPackageDetails: PackageUpgradeTransitivePackagePage;
619
+ }
620
+ interface PackageUpgradeSecurity {
621
+ current?: PackageUpgradeVersionVulnerabilitySummary;
622
+ target?: PackageUpgradeVersionVulnerabilitySummary;
623
+ added: PackageUpgradeAdvisorySummary[];
624
+ removed: PackageUpgradeAdvisorySummary[];
625
+ notAddressed: PackageUpgradeAdvisorySummary[];
626
+ fixed: PackageUpgradeAdvisorySummary[];
627
+ introduced: PackageUpgradeAdvisorySummary[];
628
+ unchanged: PackageUpgradeAdvisorySummary[];
629
+ transitive?: PackageUpgradeTransitiveSecurity;
630
+ }
631
+ interface PackageUpgradeChangelogEntry {
632
+ version?: string;
633
+ publishedAt?: string;
634
+ htmlUrl?: string;
635
+ body?: string;
636
+ bodyPreview?: string;
637
+ headline?: string;
638
+ signals: string[];
639
+ }
640
+ interface PackageUpgradeChangelog {
641
+ source?: string;
642
+ fallback?: string;
643
+ entries: PackageUpgradeChangelogEntry[];
644
+ sampledEntries: PackageUpgradeChangelogEntry[];
645
+ keywordEntries: PackageUpgradeChangelogEntry[];
646
+ totalKeywordEntries: number;
647
+ totalEntries: number;
648
+ totalEntriesWithBodies: number;
649
+ truncated: boolean;
650
+ hasReleaseNoteBodies: boolean;
651
+ breakingSignals: string[];
652
+ migrationSignals: string[];
653
+ }
654
+ interface PackageUpgradeCompatibility {
655
+ peerDependencyChanges: string[];
656
+ notes: string[];
657
+ }
658
+ interface PackageUpgradeDependencyChangeItem {
659
+ name: string;
660
+ registry?: string;
661
+ version?: string;
662
+ fromVersions: string[];
663
+ toVersions: string[];
664
+ constraint?: string;
665
+ type?: string;
666
+ }
667
+ interface PackageUpgradeDependencyChangeGroup {
668
+ added: PackageUpgradeDependencyChangeItem[];
669
+ removed: PackageUpgradeDependencyChangeItem[];
670
+ changed: PackageUpgradeDependencyChangeItem[];
671
+ }
672
+ interface PackageUpgradeDependencyChanges {
673
+ direct: PackageUpgradeDependencyChangeGroup;
674
+ transitive: PackageUpgradeDependencyChangeGroup;
675
+ }
676
+ interface PackageUpgradeDependencyIssues {
677
+ currentTotal: number;
678
+ targetTotal: number;
679
+ introducedDeprecated: string[];
680
+ introducedDuplicates: string[];
681
+ introducedConflicts: string[];
682
+ introducedOutdated: string[];
683
+ }
684
+ interface PackageUpgradeReview {
685
+ registry: string;
686
+ name: string;
687
+ currentVersion: string;
688
+ targetVersion: string;
689
+ latestVersion?: string;
690
+ versionDelta: string;
691
+ security: PackageUpgradeSecurity;
692
+ changelog: PackageUpgradeChangelog;
693
+ compatibility?: PackageUpgradeCompatibility;
694
+ dependencyChanges?: PackageUpgradeDependencyChanges;
695
+ dependencyIssues?: PackageUpgradeDependencyIssues;
696
+ unknowns: string[];
697
+ }
698
+ interface PackageUpgradeReviewResponse {
699
+ summary: {
700
+ total: number;
701
+ withUnknowns: number;
702
+ withAddedAdvisories: number;
703
+ withBreakingSignals: number;
704
+ withDirectDependencyChanges: number;
705
+ withTransitiveVulnerabilityAdditions: number;
706
+ };
707
+ reviews: PackageUpgradeReview[];
708
+ }
557
709
  interface DirectDependency {
558
710
  name: string;
559
711
  versionConstraint?: string;
560
712
  type?: string;
561
713
  }
562
714
  /**
563
- * Opaque GenericJSON passthrough. The `package_dependencies` tool
564
- * migrated to typed fields (`dependencyGraph`, `dependencyConflicts`,
565
- * `circularDependencyCycles`, `environmentMarkers`); this type is
566
- * retained for the one remaining passthrough — `ChangelogEntryDetail.metadata`.
567
- */
568
- type UntypedGenericJSON = unknown;
569
- /**
570
715
  * Node in a typed dependency graph. Mirrors `DependencyGraphNode`.
571
716
  * `registry` is a lowercase string: `"npm"`, `"pypi"`, …, or
572
717
  * `"synthetic"` for manifest / project root nodes. `version` is null
@@ -797,6 +942,8 @@ interface PackageChangelogParams {
797
942
  toVersion?: string;
798
943
  /** Latest-mode cap (1–50). Rejected client-side when `fromVersion` is set. */
799
944
  limit?: number;
945
+ /** Include raw markdown bodies in entries. Defaults to true. */
946
+ includeBodies?: boolean;
800
947
  }
801
948
  /**
802
949
  * Package-info echo from the changelog response. Mirrors
@@ -811,20 +958,13 @@ interface ChangelogPackageInfo {
811
958
  toVersion?: string;
812
959
  limit?: number;
813
960
  }
814
- /**
815
- * Full changelog entry as observed on the wire. The envelope builder
816
- * projects this into the lean response shape; `metadata` is dropped
817
- * from the envelope because its source-specific opaque structure
818
- * isn't worth the token cost today. Revisit via agent feedback.
819
- */
961
+ /** Full changelog entry as observed on the wire. */
820
962
  interface ChangelogEntryDetail {
821
963
  version?: string;
822
964
  normalizedVersion?: string;
823
965
  body?: string;
824
966
  htmlUrl?: string;
825
967
  publishedAt?: string;
826
- /** TODO(backend): surface when shape is documented. */
827
- metadata?: UntypedGenericJSON;
828
968
  }
829
969
  interface ChangelogReport {
830
970
  /** Echo of addressing + filter as the backend saw it. */
@@ -904,12 +1044,23 @@ interface PackageIntelligenceService {
904
1044
  packageVulnerabilities(params: PackageVulnerabilitiesParams): Promise<VulnerabilityReport>;
905
1045
  packageDependencies(params: PackageDependenciesParams): Promise<DependencyReport>;
906
1046
  packageUpgradeDependencyProbe(params: PackageUpgradeDependencyProbeParams): Promise<DependencyReport>;
1047
+ packageUpgradeReview(params: PackageUpgradeReviewParams): Promise<PackageUpgradeReviewResponse>;
907
1048
  packageChangelog(params: PackageChangelogParams): Promise<ChangelogReport>;
908
1049
  listPackageDocs(params: ListPackageDocsParams): Promise<PackageDocsList>;
909
1050
  readPackageDoc(params: ReadPackageDocParams): Promise<PackageDocResult>;
910
1051
  }
911
1052
  import { z } from "zod";
912
1053
  /**
1054
+ * Standard result type for all MCP tools
1055
+ */
1056
+ type ToolResult = {
1057
+ content: Array<{
1058
+ type: "text";
1059
+ text: string;
1060
+ }>;
1061
+ isError?: boolean;
1062
+ };
1063
+ /**
913
1064
  * Zod raw shape type (what MCP SDK expects)
914
1065
  */
915
1066
  type ZodRawShape = {
@@ -939,12 +1090,15 @@ interface McpRequestContext<TExtra = unknown> {
939
1090
  extra: TExtra | undefined;
940
1091
  }
941
1092
  type McpToolServicesProvider<TExtra = unknown> = McpToolServices | ((context: McpRequestContext<TExtra>) => McpToolServices | Promise<McpToolServices>);
1093
+ /** Wraps one public MCP tool call without receiving arguments or auth data. */
1094
+ type McpToolExecutionHook = (toolName: string, runHandler: () => Promise<ToolResult>) => ToolResult | Promise<ToolResult>;
942
1095
  interface CreateMcpServerOptions<TExtra = unknown> {
943
1096
  metadata: McpServerMetadata;
944
1097
  services: McpToolServicesProvider<TExtra>;
945
1098
  authAction?: McpAuthAction;
946
1099
  instructions?: string;
947
1100
  instructionOptions?: Parameters<typeof buildMcpInstructions>[0];
1101
+ traceTool?: McpToolExecutionHook;
948
1102
  }
949
1103
  interface McpToolDescriptor<TSchema extends ZodRawShape = ZodRawShape> {
950
1104
  name: string;
@@ -956,9 +1110,10 @@ declare function getMcpToolDescriptors(): McpToolDescriptor[];
956
1110
  declare function registerMcpTools<TExtra = unknown>(server: McpServer, options: {
957
1111
  authAction?: McpAuthAction;
958
1112
  services: McpToolServicesProvider<TExtra>;
1113
+ traceTool?: McpToolExecutionHook;
959
1114
  }): void;
960
1115
  /**
961
1116
  * Creates the transport-neutral MCP server with injected services.
962
1117
  */
963
1118
  declare function createMcpServer<TExtra = unknown>(options: CreateMcpServerOptions<TExtra>): McpServer;
964
- export { registerMcpTools, getMcpToolDescriptors, createMcpServer, buildMcpInstructions, McpToolServicesProvider, McpToolServices, McpToolDescriptor, McpServerMetadata, McpRequestContext, McpAuthActionContext, McpAuthAction, CreateMcpServerOptions, BuildMcpInstructionsOptions };
1119
+ export { registerMcpTools, getMcpToolDescriptors, createMcpServer, buildMcpInstructions, McpToolServicesProvider, McpToolServices, McpToolExecutionHook, McpToolDescriptor, McpServerMetadata, McpRequestContext, McpAuthActionContext, McpAuthAction, CreateMcpServerOptions, BuildMcpInstructionsOptions };