@inkeep/agents-core 0.43.0 → 0.45.0

package/dist/data-access/manage/subAgentExternalAgentRelations.d.ts

@@ -11,11 +11,11 @@ declare const getSubAgentExternalAgentRelationById: (db: AgentsManageDatabaseCli
   id: string;
   createdAt: string;
   updatedAt: string;
-  tenantId: string;
+  headers: Record<string, string> | null;
   agentId: string;
   projectId: string;
+  tenantId: string;
   subAgentId: string;
-  headers: Record<string, string> | null;
   externalAgentId: string;
 } | undefined>;
 declare const listSubAgentExternalAgentRelations: (db: AgentsManageDatabaseClient) => (params: {
@@ -46,11 +46,11 @@ declare const getSubAgentExternalAgentRelations: (db: AgentsManageDatabaseClient
   id: string;
   createdAt: string;
   updatedAt: string;
-  tenantId: string;
+  headers: Record<string, string> | null;
   agentId: string;
   projectId: string;
+  tenantId: string;
   subAgentId: string;
-  headers: Record<string, string> | null;
   externalAgentId: string;
 }[]>;
 declare const getSubAgentExternalAgentRelationsByAgent: (db: AgentsManageDatabaseClient) => (params: {
@@ -59,11 +59,11 @@ declare const getSubAgentExternalAgentRelationsByAgent: (db: AgentsManageDatabas
   id: string;
   createdAt: string;
   updatedAt: string;
-  tenantId: string;
+  headers: Record<string, string> | null;
   agentId: string;
   projectId: string;
+  tenantId: string;
   subAgentId: string;
-  headers: Record<string, string> | null;
   externalAgentId: string;
 }[]>;
 declare const getSubAgentExternalAgentRelationsByExternalAgent: (db: AgentsManageDatabaseClient) => (params: {
@@ -182,11 +182,11 @@ declare const createSubAgentExternalAgentRelation: (db: AgentsManageDatabaseClie
   id: string;
   createdAt: string;
   updatedAt: string;
-  tenantId: string;
+  headers: Record<string, string> | null;
   agentId: string;
   projectId: string;
+  tenantId: string;
   subAgentId: string;
-  headers: Record<string, string> | null;
   externalAgentId: string;
 }>;
 /**
@@ -199,11 +199,11 @@ declare const getSubAgentExternalAgentRelationByParams: (db: AgentsManageDatabas
   id: string;
   createdAt: string;
   updatedAt: string;
-  tenantId: string;
+  headers: Record<string, string> | null;
   agentId: string;
   projectId: string;
+  tenantId: string;
   subAgentId: string;
-  headers: Record<string, string> | null;
   externalAgentId: string;
 } | undefined>;
 /**
@@ -220,11 +220,11 @@ declare const upsertSubAgentExternalAgentRelation: (db: AgentsManageDatabaseClie
   id: string;
   createdAt: string;
   updatedAt: string;
-  tenantId: string;
+  headers: Record<string, string> | null;
   agentId: string;
   projectId: string;
+  tenantId: string;
   subAgentId: string;
-  headers: Record<string, string> | null;
   externalAgentId: string;
 }>;
 declare const updateSubAgentExternalAgentRelation: (db: AgentsManageDatabaseClient) => (params: {

package/dist/data-access/manage/subAgentRelations.d.ts

@@ -11,12 +11,12 @@ declare const getAgentRelationById: (db: AgentsManageDatabaseClient) => (params:
   id: string;
   createdAt: string;
   updatedAt: string;
-  tenantId: string;
   agentId: string;
   projectId: string;
-  relationType: string | null;
+  tenantId: string;
   sourceSubAgentId: string;
   targetSubAgentId: string | null;
+  relationType: string | null;
 } | undefined>;
 declare const listAgentRelations: (db: AgentsManageDatabaseClient) => (params: {
   scopes: AgentScopeConfig;
@@ -46,12 +46,12 @@ declare const getAgentRelations: (db: AgentsManageDatabaseClient) => (params: {
   id: string;
   createdAt: string;
   updatedAt: string;
-  tenantId: string;
   agentId: string;
   projectId: string;
-  relationType: string | null;
+  tenantId: string;
   sourceSubAgentId: string;
   targetSubAgentId: string | null;
+  relationType: string | null;
 }[]>;
 declare const getAgentRelationsByAgent: (db: AgentsManageDatabaseClient) => (params: {
   scopes: AgentScopeConfig;
@@ -59,12 +59,12 @@ declare const getAgentRelationsByAgent: (db: AgentsManageDatabaseClient) => (par
   id: string;
   createdAt: string;
   updatedAt: string;
-  tenantId: string;
   agentId: string;
   projectId: string;
-  relationType: string | null;
+  tenantId: string;
   sourceSubAgentId: string;
   targetSubAgentId: string | null;
+  relationType: string | null;
 }[]>;
 declare const getAgentRelationsBySource: (db: AgentsManageDatabaseClient) => (params: {
   scopes: AgentScopeConfig;
@@ -128,12 +128,12 @@ declare const createSubAgentRelation: (db: AgentsManageDatabaseClient) => (param
   id: string;
   createdAt: string;
   updatedAt: string;
-  tenantId: string;
   agentId: string;
   projectId: string;
-  relationType: string | null;
+  tenantId: string;
   sourceSubAgentId: string;
   targetSubAgentId: string | null;
+  relationType: string | null;
 }>;
 /**
  * Check if sub-agent relation exists by agent, source, target, and relation type
@@ -147,12 +147,12 @@ declare const getAgentRelationByParams: (db: AgentsManageDatabaseClient) => (par
   id: string;
   createdAt: string;
   updatedAt: string;
-  tenantId: string;
   agentId: string;
   projectId: string;
-  relationType: string | null;
+  tenantId: string;
   sourceSubAgentId: string;
   targetSubAgentId: string | null;
+  relationType: string | null;
 } | undefined>;
 /**
  * Upsert agent relation (create if it doesn't exist, no-op if it does)
@@ -161,12 +161,12 @@ declare const upsertSubAgentRelation: (db: AgentsManageDatabaseClient) => (param
   id: string;
   createdAt: string;
   updatedAt: string;
-  tenantId: string;
   agentId: string;
   projectId: string;
-  relationType: string | null;
+  tenantId: string;
   sourceSubAgentId: string;
   targetSubAgentId: string | null;
+  relationType: string | null;
 }>;
 declare const updateAgentRelation: (db: AgentsManageDatabaseClient) => (params: {
   scopes: AgentScopeConfig;
@@ -206,12 +206,12 @@ declare const createAgentToolRelation: (db: AgentsManageDatabaseClient) => (para
   id: string;
   createdAt: string;
   updatedAt: string;
-  tenantId: string;
+  headers: Record<string, string> | null;
   agentId: string;
   projectId: string;
-  subAgentId: string;
-  headers: Record<string, string> | null;
+  tenantId: string;
   toolId: string;
+  subAgentId: string;
   selectedTools: string[] | null;
   toolPolicies: Record<string, {
     needsApproval?: boolean;
@@ -250,12 +250,12 @@ declare const getAgentToolRelationById: (db: AgentsManageDatabaseClient) => (par
   id: string;
   createdAt: string;
   updatedAt: string;
-  tenantId: string;
+  headers: Record<string, string> | null;
   agentId: string;
   projectId: string;
-  subAgentId: string;
-  headers: Record<string, string> | null;
+  tenantId: string;
   toolId: string;
+  subAgentId: string;
   selectedTools: string[] | null;
   toolPolicies: Record<string, {
     needsApproval?: boolean;

package/dist/data-access/manage/subAgentTeamAgentRelations.d.ts

@@ -11,11 +11,11 @@ declare const getSubAgentTeamAgentRelationById: (db: AgentsManageDatabaseClient)
   id: string;
   createdAt: string;
   updatedAt: string;
-  tenantId: string;
+  headers: Record<string, string> | null;
   agentId: string;
   projectId: string;
+  tenantId: string;
   subAgentId: string;
-  headers: Record<string, string> | null;
   targetAgentId: string;
 } | undefined>;
 declare const listSubAgentTeamAgentRelations: (db: AgentsManageDatabaseClient) => (params: {
@@ -46,11 +46,11 @@ declare const getSubAgentTeamAgentRelations: (db: AgentsManageDatabaseClient) =>
   id: string;
   createdAt: string;
   updatedAt: string;
-  tenantId: string;
+  headers: Record<string, string> | null;
   agentId: string;
   projectId: string;
+  tenantId: string;
   subAgentId: string;
-  headers: Record<string, string> | null;
   targetAgentId: string;
 }[]>;
 declare const getSubAgentTeamAgentRelationsByAgent: (db: AgentsManageDatabaseClient) => (params: {
@@ -59,11 +59,11 @@ declare const getSubAgentTeamAgentRelationsByAgent: (db: AgentsManageDatabaseCli
   id: string;
   createdAt: string;
   updatedAt: string;
-  tenantId: string;
+  headers: Record<string, string> | null;
   agentId: string;
   projectId: string;
+  tenantId: string;
   subAgentId: string;
-  headers: Record<string, string> | null;
   targetAgentId: string;
 }[]>;
 declare const getSubAgentTeamAgentRelationsByTeamAgent: (db: AgentsManageDatabaseClient) => (params: {
@@ -212,11 +212,11 @@ declare const createSubAgentTeamAgentRelation: (db: AgentsManageDatabaseClient)
   id: string;
   createdAt: string;
   updatedAt: string;
-  tenantId: string;
+  headers: Record<string, string> | null;
   agentId: string;
   projectId: string;
+  tenantId: string;
   subAgentId: string;
-  headers: Record<string, string> | null;
   targetAgentId: string;
 }>;
 /**
@@ -229,11 +229,11 @@ declare const getSubAgentTeamAgentRelationByParams: (db: AgentsManageDatabaseCli
   id: string;
   createdAt: string;
   updatedAt: string;
-  tenantId: string;
+  headers: Record<string, string> | null;
   agentId: string;
   projectId: string;
+  tenantId: string;
   subAgentId: string;
-  headers: Record<string, string> | null;
   targetAgentId: string;
 } | undefined>;
 /**
@@ -250,11 +250,11 @@ declare const upsertSubAgentTeamAgentRelation: (db: AgentsManageDatabaseClient)
   id: string;
   createdAt: string;
   updatedAt: string;
-  tenantId: string;
+  headers: Record<string, string> | null;
   agentId: string;
   projectId: string;
+  tenantId: string;
   subAgentId: string;
-  headers: Record<string, string> | null;
   targetAgentId: string;
 }>;
 declare const updateSubAgentTeamAgentRelation: (db: AgentsManageDatabaseClient) => (params: {

package/dist/data-access/manage/subAgents.d.ts

@@ -13,9 +13,9 @@ declare const getSubAgentById: (db: AgentsManageDatabaseClient) => (params: {
   createdAt: string;
   updatedAt: string;
   description: string | null;
-  tenantId: string;
   agentId: string;
   projectId: string;
+  tenantId: string;
   models: {
     base?: {
       model?: string | undefined;
@@ -44,9 +44,9 @@ declare const listSubAgents: (db: AgentsManageDatabaseClient) => (params: {
   createdAt: string;
   updatedAt: string;
   description: string | null;
-  tenantId: string;
   agentId: string;
   projectId: string;
+  tenantId: string;
   models: {
     base?: {
       model?: string | undefined;
@@ -113,9 +113,9 @@ declare const createSubAgent: (db: AgentsManageDatabaseClient) => (params: SubAg
   createdAt: string;
   updatedAt: string;
   description: string | null;
-  tenantId: string;
   agentId: string;
   projectId: string;
+  tenantId: string;
   models: {
     base?: {
       model?: string | undefined;

package/dist/data-access/manage/tools.d.ts

@@ -23,9 +23,9 @@ declare const getToolById: (db: AgentsManageDatabaseClient) => (params: {
   createdAt: string;
   updatedAt: string;
   description: string | null;
-  tenantId: string;
-  projectId: string;
   headers: Record<string, string> | null;
+  projectId: string;
+  tenantId: string;
   config: {
     type: "mcp";
     mcp: ToolMcpConfig;
@@ -35,6 +35,7 @@ declare const getToolById: (db: AgentsManageDatabaseClient) => (params: {
   imageUrl: string | null;
   capabilities: ToolServerCapabilities | null;
   lastError: string | null;
+  isWorkApp: boolean;
 } | null>;
 declare const getMcpToolById: (db: AgentsManageDatabaseClient) => (params: {
   scopes: ProjectScopeConfig;
@@ -62,6 +63,7 @@ declare const listTools: (db: AgentsManageDatabaseClient) => (params: {
     imageUrl: string | null;
     capabilities: ToolServerCapabilities | null;
     lastError: string | null;
+    isWorkApp: boolean;
     projectId: string;
     tenantId: string;
     id: string;
@@ -79,9 +81,9 @@ declare const createTool: (db: AgentsManageDatabaseClient) => (params: ToolInser
   createdAt: string;
   updatedAt: string;
   description: string | null;
-  tenantId: string;
-  projectId: string;
   headers: Record<string, string> | null;
+  projectId: string;
+  tenantId: string;
   config: {
     type: "mcp";
     mcp: ToolMcpConfig;
@@ -91,6 +93,7 @@ declare const createTool: (db: AgentsManageDatabaseClient) => (params: ToolInser
   imageUrl: string | null;
   capabilities: ToolServerCapabilities | null;
   lastError: string | null;
+  isWorkApp: boolean;
 }>;
 declare const updateTool: (db: AgentsManageDatabaseClient) => (params: {
   scopes: ProjectScopeConfig;
@@ -111,6 +114,7 @@ declare const updateTool: (db: AgentsManageDatabaseClient) => (params: {
   imageUrl: string | null;
   capabilities: ToolServerCapabilities | null;
   lastError: string | null;
+  isWorkApp: boolean;
   projectId: string;
   tenantId: string;
   id: string;
@@ -132,12 +136,12 @@ declare const addToolToAgent: (db: AgentsManageDatabaseClient) => (params: {
   id: string;
   createdAt: string;
   updatedAt: string;
-  tenantId: string;
+  headers: Record<string, string> | null;
   agentId: string;
   projectId: string;
-  subAgentId: string;
-  headers: Record<string, string> | null;
+  tenantId: string;
   toolId: string;
+  subAgentId: string;
   selectedTools: string[] | null;
   toolPolicies: Record<string, {
     needsApproval?: boolean;
@@ -151,12 +155,12 @@ declare const removeToolFromAgent: (db: AgentsManageDatabaseClient) => (params:
   id: string;
   createdAt: string;
   updatedAt: string;
-  tenantId: string;
+  headers: Record<string, string> | null;
   agentId: string;
   projectId: string;
-  subAgentId: string;
-  headers: Record<string, string> | null;
+  tenantId: string;
   toolId: string;
+  subAgentId: string;
   selectedTools: string[] | null;
   toolPolicies: Record<string, {
     needsApproval?: boolean;
@@ -179,12 +183,12 @@ declare const upsertSubAgentToolRelation: (db: AgentsManageDatabaseClient) => (p
   id: string;
   createdAt: string;
   updatedAt: string;
-  tenantId: string;
+  headers: Record<string, string> | null;
   agentId: string;
   projectId: string;
-  subAgentId: string;
-  headers: Record<string, string> | null;
+  tenantId: string;
   toolId: string;
+  subAgentId: string;
   selectedTools: string[] | null;
   toolPolicies: Record<string, {
     needsApproval?: boolean;
@@ -201,9 +205,9 @@ declare const upsertTool: (db: AgentsManageDatabaseClient) => (params: {
   createdAt: string;
   updatedAt: string;
   description: string | null;
-  tenantId: string;
-  projectId: string;
   headers: Record<string, string> | null;
+  projectId: string;
+  tenantId: string;
   config: {
     type: "mcp";
     mcp: ToolMcpConfig;
@@ -213,6 +217,7 @@ declare const upsertTool: (db: AgentsManageDatabaseClient) => (params: {
   imageUrl: string | null;
   capabilities: ToolServerCapabilities | null;
   lastError: string | null;
+  isWorkApp: boolean;
 }>;
 //#endregion
 export { addToolToAgent, createTool, dbResultToMcpTool, dbResultToMcpToolSkeleton, deleteTool, getMcpToolById, getToolById, listTools, removeToolFromAgent, updateTool, upsertSubAgentToolRelation, upsertTool };

package/dist/data-access/manage/tools.js

@@ -1,17 +1,22 @@
 import { CredentialStoreType, MCPServerType, MCPTransportType } from "../../types/utility.js";
 import { subAgentToolRelations, tools } from "../../db/manage/manage-schema.js";
 import { detectAuthenticationRequired } from "../../utils/auth-detection.js";
+import { env } from "../../env.js";
 import { getLogger } from "../../utils/logger.js";
 import { getCredentialStoreLookupKeyFromRetrievalParams } from "../../utils/credential-store-utils.js";
 import { CredentialStuffer } from "../../credential-stuffer/CredentialStuffer.js";
 import "../../credential-stuffer/index.js";
+import { createAgentsRunDatabaseClient } from "../../db/runtime/runtime-client.js";
 import { generateId } from "../../utils/conversations.js";
+import { getActiveBranch } from "../../dolt/schema-sync.js";
 import { updateAgentToolRelation } from "./subAgentRelations.js";
 import { toISODateString } from "../../utils/date.js";
 import { McpClient } from "../../utils/mcp-client.js";
 import { buildComposioMCPUrl } from "../../utils/third-party-mcp-servers/composio-client.js";
 import { isThirdPartyMCPServerAuthenticated } from "../../utils/third-party-mcp-servers/third-party-check.js";
 import "../../utils/index.js";
+import { cascadeDeleteByTool } from "../runtime/cascade-delete.js";
+import { isGithubWorkAppTool } from "../runtime/github-work-app-installations.js";
 import { getCredentialReference, getUserScopedCredentialReference } from "./credentialReferences.js";
 import { and, count, desc, eq } from "drizzle-orm";
 import { ErrorCode, McpError } from "@modelcontextprotocol/sdk/types.js";
@@ -114,6 +119,11 @@ const discoverToolsFromServer = async (tool, credentialReference, credentialStor
 			sessionId: tool.config.mcp.transport?.sessionId
 		};
 		if (serverConfig.url) serverConfig.url = buildComposioMCPUrl(serverConfig.url.toString(), tool.tenantId, tool.projectId, tool.credentialScope === "user" ? "user" : "project", userId);
+		if (isGithubWorkAppTool(tool)) serverConfig.headers = {
+			...serverConfig.headers,
+			"x-inkeep-tool-id": tool.id,
+			Authorization: `Bearer ${env.GITHUB_MCP_API_KEY}`
+		};
 		const client = new McpClient({
 			name: tool.name,
 			server: serverConfig
@@ -307,7 +317,16 @@ const updateTool = (db) => async (params) => {
 };
 const deleteTool = (db) => async (params) => {
 	const [deleted] = await db.delete(tools).where(and(eq(tools.tenantId, params.scopes.tenantId), eq(tools.projectId, params.scopes.projectId), eq(tools.id, params.toolId))).returning();
-	return !!deleted;
+	if (!deleted) return false;
+	if (deleted.isWorkApp && deleted.config.mcp.server.url.includes("/github/mcp")) try {
+		if (await getActiveBranch(db)() === `${params.scopes.tenantId}_${params.scopes.projectId}_main`) await cascadeDeleteByTool(createAgentsRunDatabaseClient())({ toolId: params.toolId });
+	} catch (error) {
+		logger.debug({
+			error,
+			toolId: params.toolId
+		}, "Skipping cascade delete - active_branch() not available");
+	}
+	return true;
 };
 const addToolToAgent = (db) => async (params) => {
 	const id = generateId();

package/dist/data-access/runtime/apiKeys.d.ts

@@ -12,9 +12,9 @@ declare const getApiKeyById: (db: AgentsRunDatabaseClient) => (params: {
   createdAt: string;
   updatedAt: string;
   expiresAt: string | null;
-  tenantId: string;
   agentId: string;
   projectId: string;
+  tenantId: string;
   publicId: string;
   keyHash: string;
   keyPrefix: string;
@@ -26,9 +26,9 @@ declare const getApiKeyByPublicId: (db: AgentsRunDatabaseClient) => (publicId: s
   createdAt: string;
   updatedAt: string;
   expiresAt: string | null;
-  tenantId: string;
   agentId: string;
   projectId: string;
+  tenantId: string;
   publicId: string;
   keyHash: string;
   keyPrefix: string;
@@ -43,9 +43,9 @@ declare const listApiKeys: (db: AgentsRunDatabaseClient) => (params: {
   createdAt: string;
   updatedAt: string;
   expiresAt: string | null;
-  tenantId: string;
   agentId: string;
   projectId: string;
+  tenantId: string;
   publicId: string;
   keyHash: string;
   keyPrefix: string;
@@ -70,9 +70,9 @@ declare const createApiKey: (db: AgentsRunDatabaseClient) => (params: ApiKeyInse
   createdAt: string;
   updatedAt: string;
   expiresAt: string | null;
-  tenantId: string;
   agentId: string;
   projectId: string;
+  tenantId: string;
   publicId: string;
   keyHash: string;
   keyPrefix: string;

package/dist/data-access/runtime/cascade-delete.d.ts

@@ -73,5 +73,52 @@ declare const cascadeDeleteByContextConfig: (db: AgentsRunDatabaseClient) => (pa
 }) => Promise<{
   contextCacheDeleted: number;
 }>;
+/**
+ * Result of a tool cascade delete operation
+ */
+type ToolCascadeDeleteResult = {
+  mcpToolRepositoryAccessDeleted: number;
+  mcpToolAccessModeDeleted: boolean;
+};
+/**
+ * Delete all runtime entities for a specific MCP tool.
+ * Called when an MCP tool is deleted from the manage database.
+ *
+ * Cleans up:
+ * - workAppGitHubMcpToolRepositoryAccess entries
+ * - workAppGitHubMcpToolAccessMode entry
+ *
+ * @param db - Runtime database client
+ * @returns Function that performs the cascade delete
+ */
+declare const cascadeDeleteByTool: (db: AgentsRunDatabaseClient) => (params: {
+  toolId: string;
+}) => Promise<ToolCascadeDeleteResult>;
+/**
+ * Result of a project cascade delete operation (GitHub access only)
+ */
+type ProjectGitHubAccessCascadeDeleteResult = {
+  projectRepositoryAccessDeleted: number;
+  projectAccessModeDeleted: boolean;
+  mcpToolRepositoryAccessDeleted: number;
+  mcpToolAccessModesDeleted: number;
+};
+/**
+ * Delete all GitHub access runtime entities for a specific project.
+ * Called when a project is deleted from the manage database.
+ *
+ * Cleans up:
+ * - workAppGitHubProjectRepositoryAccess entries
+ * - workAppGitHubProjectAccessMode entry
+ * - workAppGitHubMcpToolRepositoryAccess entries (for tools in this project)
+ * - workAppGitHubMcpToolAccessMode entries (for tools in this project)
+ *
+ * @param db - Runtime database client
+ * @returns Function that performs the cascade delete
+ */
+declare const cascadeDeleteGitHubAccessByProject: (db: AgentsRunDatabaseClient) => (params: {
+  tenantId: string;
+  projectId: string;
+}) => Promise<ProjectGitHubAccessCascadeDeleteResult>;
 //#endregion
-export { CascadeDeleteResult, cascadeDeleteByAgent, cascadeDeleteByBranch, cascadeDeleteByContextConfig, cascadeDeleteByProject, cascadeDeleteBySubAgent };
+export { CascadeDeleteResult, ProjectGitHubAccessCascadeDeleteResult, ToolCascadeDeleteResult, cascadeDeleteByAgent, cascadeDeleteByBranch, cascadeDeleteByContextConfig, cascadeDeleteByProject, cascadeDeleteBySubAgent, cascadeDeleteByTool, cascadeDeleteGitHubAccessByProject };

package/dist/data-access/runtime/cascade-delete.js

@@ -1,4 +1,4 @@
-import { apiKeys, contextCache, conversations, tasks } from "../../db/runtime/runtime-schema.js";
+import { apiKeys, contextCache, conversations, tasks, workAppGitHubMcpToolAccessMode, workAppGitHubMcpToolRepositoryAccess, workAppGitHubProjectAccessMode, workAppGitHubProjectRepositoryAccess } from "../../db/runtime/runtime-schema.js";
 import { and, eq, inArray, sql } from "drizzle-orm";
 
 //#region src/data-access/runtime/cascade-delete.ts
@@ -35,6 +35,10 @@ const cascadeDeleteByProject = (db) => async (params) => {
 	const conversationsResult = await db.delete(conversations).where(and(eq(conversations.tenantId, scopes.tenantId), eq(conversations.projectId, scopes.projectId), sql`${conversations.ref}->>'name' = ${fullBranchName}`)).returning();
 	const tasksResult = await db.delete(tasks).where(and(eq(tasks.tenantId, scopes.tenantId), eq(tasks.projectId, scopes.projectId), sql`${tasks.ref}->>'name' = ${fullBranchName}`)).returning();
 	const apiKeysResult = await db.delete(apiKeys).where(and(eq(apiKeys.tenantId, scopes.tenantId), eq(apiKeys.projectId, scopes.projectId))).returning();
+	await cascadeDeleteGitHubAccessByProject(db)({
+		tenantId: scopes.tenantId,
+		projectId: scopes.projectId
+	});
 	return {
 		conversationsDeleted: conversationsResult.length,
 		tasksDeleted: tasksResult.length,
@@ -106,6 +110,52 @@ const cascadeDeleteByContextConfig = (db) => async (params) => {
 	const { scopes, contextConfigId, fullBranchName } = params;
 	return { contextCacheDeleted: (await db.delete(contextCache).where(and(eq(contextCache.tenantId, scopes.tenantId), eq(contextCache.projectId, scopes.projectId), eq(contextCache.contextConfigId, contextConfigId), sql`${contextCache.ref}->>'name' = ${fullBranchName}`)).returning()).length };
 };
+/**
+* Delete all runtime entities for a specific MCP tool.
+* Called when an MCP tool is deleted from the manage database.
+*
+* Cleans up:
+* - workAppGitHubMcpToolRepositoryAccess entries
+* - workAppGitHubMcpToolAccessMode entry
+*
+* @param db - Runtime database client
+* @returns Function that performs the cascade delete
+*/
+const cascadeDeleteByTool = (db) => async (params) => {
+	const { toolId } = params;
+	const repositoryAccessResult = await db.delete(workAppGitHubMcpToolRepositoryAccess).where(eq(workAppGitHubMcpToolRepositoryAccess.toolId, toolId)).returning();
+	const accessModeResult = await db.delete(workAppGitHubMcpToolAccessMode).where(eq(workAppGitHubMcpToolAccessMode.toolId, toolId)).returning();
+	return {
+		mcpToolRepositoryAccessDeleted: repositoryAccessResult.length,
+		mcpToolAccessModeDeleted: accessModeResult.length > 0
+	};
+};
+/**
+* Delete all GitHub access runtime entities for a specific project.
+* Called when a project is deleted from the manage database.
+*
+* Cleans up:
+* - workAppGitHubProjectRepositoryAccess entries
+* - workAppGitHubProjectAccessMode entry
+* - workAppGitHubMcpToolRepositoryAccess entries (for tools in this project)
+* - workAppGitHubMcpToolAccessMode entries (for tools in this project)
+*
+* @param db - Runtime database client
+* @returns Function that performs the cascade delete
+*/
+const cascadeDeleteGitHubAccessByProject = (db) => async (params) => {
+	const { tenantId, projectId } = params;
+	const projectRepoAccessResult = await db.delete(workAppGitHubProjectRepositoryAccess).where(and(eq(workAppGitHubProjectRepositoryAccess.tenantId, tenantId), eq(workAppGitHubProjectRepositoryAccess.projectId, projectId))).returning();
+	const projectAccessModeResult = await db.delete(workAppGitHubProjectAccessMode).where(and(eq(workAppGitHubProjectAccessMode.tenantId, tenantId), eq(workAppGitHubProjectAccessMode.projectId, projectId))).returning();
+	const mcpToolRepoAccessResult = await db.delete(workAppGitHubMcpToolRepositoryAccess).where(and(eq(workAppGitHubMcpToolRepositoryAccess.tenantId, tenantId), eq(workAppGitHubMcpToolRepositoryAccess.projectId, projectId))).returning();
+	const mcpToolAccessModeResult = await db.delete(workAppGitHubMcpToolAccessMode).where(and(eq(workAppGitHubMcpToolAccessMode.tenantId, tenantId), eq(workAppGitHubMcpToolAccessMode.projectId, projectId))).returning();
+	return {
+		projectRepositoryAccessDeleted: projectRepoAccessResult.length,
+		projectAccessModeDeleted: projectAccessModeResult.length > 0,
+		mcpToolRepositoryAccessDeleted: mcpToolRepoAccessResult.length,
+		mcpToolAccessModesDeleted: mcpToolAccessModeResult.length
+	};
+};
 
 //#endregion
-export { cascadeDeleteByAgent, cascadeDeleteByBranch, cascadeDeleteByContextConfig, cascadeDeleteByProject, cascadeDeleteBySubAgent };
+export { cascadeDeleteByAgent, cascadeDeleteByBranch, cascadeDeleteByContextConfig, cascadeDeleteByProject, cascadeDeleteBySubAgent, cascadeDeleteByTool, cascadeDeleteGitHubAccessByProject };