@kaminari-ad/mcp 0.11.0 → 0.12.0

package/CHANGELOG.md

@@ -7,6 +7,48 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.12.0] - 2026-08-07
+
+### Security
+
+- **Bump `undici` 8.5.0 to 8.10.0** to clear the npm-audit gate after the
+  upstream disclosure of one high-severity advisory
+  (GHSA-4cwx-7wf7-3272 — a malformed `private` Cache-Control directive
+  makes a shared cache store a per-user response and serve it to other
+  users) and four medium ones (GHSA-jr45-8vmc-qm54,
+  GHSA-m8rv-5g2x-5cg5, GHSA-8xcm-r25x-g524, GHSA-v3r7-h72x-cjcm). All
+  five are fixed in 8.9.0. `undici` is a direct dependency.
+
+### Changed
+
+- **Requires api >= v1.33.0 for the webhook tools.** The regenerated zod
+  schemas make `failing_since` and `paused_until` required on
+  `EndpointHealthResponse`, and the webhook parser picks the whole nested
+  `health` object, so against an older API every webhook tool
+  (`list_webhooks`, `get_webhook`, `create_webhook`, `update_webhook`,
+  `rotate_webhook_secret`) fails with
+  `upstream: malformed webhook: health.failing_since: Invalid input`.
+- **README tool list matches the registry again.** It documented 83 tools
+  and had drifted 15 behind: the custom-taxonomy domain, the three
+  screenshot fetchers, `get_invoice_pdf`, `list_scan_children`,
+  `create_custom_role`, and the two account-label tools were all
+  registered but undocumented — and the screenshot fetchers and invoice
+  PDF were still listed as deliberately not exposed.
+- **`get_alert_stats` counts all time.** The API used to count only the last
+  30 days when no dates were given, while `list_alerts` listed all time, so
+  the four buckets never summed to the list's `total`. The API now defaults
+  both to all time; the tool description says so, so a model comparing the
+  two no longer has to guess which window it got. Requires the API deploy
+  that ships the new default — against an older API the counts still cover
+  30 days.
+- **Regenerated `/api/v1` types and zod schemas.** Picks up the new alert
+  filters (`policy_set_id`, `tag`, `country_code`, `date_from`, `date_to`,
+  `timezone` on list + stats, and the matching `filter_*` fields on
+  bulk-status), `policy_set_name` on `AlertResponse`, plus drift that had
+  accumulated since the last regen: `last_run_at` on campaign groups,
+  campaign/group date filters, and `failing_since` / `paused_until` on
+  webhook endpoint health.
+
 ## [0.11.0] - 2026-07-28
 
 ### Added
@@ -983,7 +1025,16 @@ Initial public release. The first version that ships to npm under
   need them.
 - Invoice PDF fetcher — same reason.
 
-[Unreleased]: https://github.com/kaminari-ad/mcp/compare/v0.2.1...HEAD
+[Unreleased]: https://github.com/kaminari-ad/mcp/compare/v0.12.0...HEAD
+[0.12.0]: https://github.com/kaminari-ad/mcp/compare/v0.11.0...v0.12.0
+[0.11.0]: https://github.com/kaminari-ad/mcp/compare/v0.10.0...v0.11.0
+[0.10.0]: https://github.com/kaminari-ad/mcp/compare/v0.8.0...v0.10.0
+[0.8.0]: https://github.com/kaminari-ad/mcp/compare/v0.6.0...v0.8.0
+[0.6.0]: https://github.com/kaminari-ad/mcp/compare/v0.5.2...v0.6.0
+[0.5.2]: https://github.com/kaminari-ad/mcp/compare/v0.5.0...v0.5.2
+[0.5.0]: https://github.com/kaminari-ad/mcp/compare/v0.3.0...v0.5.0
+[0.3.0]: https://github.com/kaminari-ad/mcp/compare/v0.2.2...v0.3.0
+[0.2.2]: https://github.com/kaminari-ad/mcp/compare/v0.2.1...v0.2.2
 [0.2.1]: https://github.com/kaminari-ad/mcp/compare/v0.2.0...v0.2.1
 [0.2.0]: https://github.com/kaminari-ad/mcp/compare/v0.1.5...v0.2.0
 [0.1.5]: https://github.com/kaminari-ad/mcp/compare/v0.1.0...v0.1.5

package/README.md

@@ -63,7 +63,7 @@ Add to your MCP client config (Cursor: `~/.cursor/mcp.json`; Claude Desktop: `~/
 }
 ```
 
-Restart your client. You should see `kaminari-ad` in the MCP servers list with 83 tools exposed.
+Restart your client. You should see `kaminari-ad` in the MCP servers list with 98 tools exposed.
 
 ### 2b. Hosted HTTP transport (no install)
 
@@ -113,24 +113,27 @@ which decides which credential type minted it.
 
 ## Tools
 
-83 tools mirroring most of the public `/api/v1` surface of Kaminari Ad. Every tool carries MCP behaviour annotations (`title`, `readOnlyHint`, `destructiveHint`, `idempotentHint`, `openWorldHint`) so MCP clients can warn before destructive actions. Highlights:
+98 tools mirroring most of the public `/api/v1` surface of Kaminari Ad. Every tool carries MCP behaviour annotations (`title`, `readOnlyHint`, `destructiveHint`, `idempotentHint`, `openWorldHint`) so MCP clients can warn before destructive actions. The complete list, by domain:
 
-- **Account** (11) — `get_account`, `update_org`, `list_org_users`, `invite_user`, `update_user_role`, `remove_user`, `transfer_ownership`, `list_org_roles`, `list_api_keys`, `create_api_key`, `revoke_api_key`
-- **Scans** (6) — `list_scans`, `get_scan`, `create_scan`, `create_bulk_scans`, `recheck_scans`, `cancel_scan`
+- **Account** (14) — `get_account`, `update_org`, `list_org_users`, `invite_user`, `update_user_role`, `remove_user`, `transfer_ownership`, `list_org_roles`, `create_custom_role`, `list_account_labels`, `update_account_labels`, `list_api_keys`, `create_api_key`, `revoke_api_key`
+- **Scans** (10) — `list_scans`, `get_scan`, `list_scan_children`, `create_scan`, `create_bulk_scans`, `recheck_scans`, `cancel_scan`, `get_scan_screenshot`, `get_scan_creative_screenshot`, `get_scan_landing_screenshot`
 - **Campaigns** (10) — `list_campaigns`, `list_campaigns_picker`, `get_campaign`, `create_campaign`, `update_campaign`, `archive_campaign`, `unarchive_campaign`, `cancel_campaign`, `run_campaign`, `list_campaign_runs`
 - **Campaign groups** (10) — list/get/create/update/run/cancel/archive/unarchive + `pause_campaign_group_schedule`, `resume_campaign_group_schedule`
 - **Runs** (3) — `get_run`, `list_run_scans`, `cancel_run` (use `list_campaign_runs` to enumerate runs of a campaign — the API has no standalone `/runs` index)
 - **Tags** (5) — `list_tags`, `get_tag_definition`, `update_tag_definition`, `delete_tag_definition`, `list_scan_tags`
 - **Custom rules** (6) — `list_custom_rules`, `get_custom_rule`, `create_custom_rule`, `update_custom_rule`, `delete_custom_rule`, `test_custom_rule`
+- **Custom taxonomies** (7) — `list_custom_taxonomies`, `get_custom_taxonomy`, `create_custom_taxonomy`, `update_custom_taxonomy`, `delete_custom_taxonomy`, `restore_custom_taxonomy`, `parse_custom_taxonomy_text`
 - **Policy sets** (6) — `list_policy_sets`, `get_policy_set`, `create_policy_set`, `update_policy_set`, `delete_policy_set`, `request_policy_set_approval`
 - **Alerts** (3) — `list_alerts`, `update_alert_status`, `get_alert_stats`
 - **Webhooks** (11) — `list_webhooks`, `get_webhook`, `create_webhook`, `update_webhook`, `delete_webhook`, `list_webhook_event_types`, `list_webhook_deliveries`, `test_webhook`, `rotate_webhook_secret`, `replay_webhook_delivery`, `bulk_replay_webhook`
 - **Billing** (4) — `get_billing_summary`, `list_usage`, `get_usage_summary`, `list_balance_history`
-- **Invoicing** (1) — `list_invoices`
+- **Invoicing** (2) — `list_invoices`, `get_invoice_pdf`
 - **Alert notifications** (5) — `list_alert_destinations`, `delete_alert_destination`, `set_alert_destination_version`, `get_campaign_alert_overrides`, `set_campaign_alert_overrides`
 - **Reference data** (2) — `list_geos`, `list_emulators`
 
-Not exposed (intentionally): binary scan-screenshot fetchers, invoice PDF, and the public marketing forms (`/contact`, `/demo-inquiries`). Open an issue if you need one of those.
+Screenshots (`get_scan_screenshot`, `get_scan_creative_screenshot`, `get_scan_landing_screenshot`) come back as inline MCP `image` blocks and `get_invoice_pdf` as an inline resource block — no second fetch, no presigned URL.
+
+Not exposed (intentionally): the raw creative artifacts (`creative-html`, `creative-video`, `vast-xml`) and the public marketing forms (`/contact`, `/demo-inquiries`). Open an issue if you need one of those.
 
 ## Example agent prompts
 

package/dist/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { NAME, VERSION, err, ok } from './chunk-XSI6SZTX.js';
+import { NAME, VERSION, err, ok } from './chunk-TMUGAKI2.js';
 import process from 'process';
 import { z } from 'zod';
 
@@ -160,10 +160,10 @@ async function main() {
   }
   const config = configResult.value;
   if (config.transport === "stdio") {
-    const { bootstrapStdio } = await import('./stdio-bootstrap-QK4ENRPP.js');
+    const { bootstrapStdio } = await import('./stdio-bootstrap-JW6I4H3U.js');
     return bootstrapStdio(config);
   }
-  const { bootstrapHttp } = await import('./http-bootstrap-XJNTLL2C.js');
+  const { bootstrapHttp } = await import('./http-bootstrap-Y4YKT7KV.js');
   return bootstrapHttp(config);
 }
 main().then(

package/dist/{chunk-XCAKB2QW.js → chunk-T6GEYHLP.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { err, ok } from './chunk-XSI6SZTX.js';
+import { err, ok } from './chunk-TMUGAKI2.js';
 import { createHash, randomUUID } from 'crypto';
 import createClient from 'openapi-fetch';
 import { fetch } from 'undici';
@@ -471,7 +471,8 @@ var CampaignGroupResponse = z.object({
   is_archived: z.boolean(),
   schedule_paused: z.boolean(),
   created_at: z.string().datetime({ offset: true }),
-  campaign_count: z.union([z.number(), z.null()]).optional()
+  campaign_count: z.union([z.number(), z.null()]).optional(),
+  last_run_at: z.union([z.string(), z.null()]).optional()
 }).passthrough();
 z.object({ name: z.union([z.string(), z.null()]) }).partial().passthrough();
 var BulkCampaignFailure = z.object({
@@ -867,6 +868,7 @@ var AlertResponse = z.object({
   scan_url: z.string(),
   offer_url: z.string(),
   tag_display_name: z.string(),
+  policy_set_name: z.union([z.string(), z.null()]).optional(),
   rule_type: z.string().optional().default("tag"),
   matched_value: z.union([z.string(), z.null()]).optional()
 }).passthrough();
@@ -883,7 +885,13 @@ z.object({
   ids: z.union([z.array(z.string().uuid()), z.null()]).optional(),
   all_matching: z.boolean().optional().default(false),
   filter_status: z.union([AlertStatus, z.null()]).optional(),
-  filter_campaign_id: z.union([z.string(), z.null()]).optional()
+  filter_campaign_id: z.union([z.string(), z.null()]).optional(),
+  filter_policy_set_ids: z.union([z.array(z.string().uuid()), z.null()]).optional(),
+  filter_tag_slugs: z.union([z.array(z.string()), z.null()]).optional(),
+  filter_country_codes: z.union([z.array(z.string()), z.null()]).optional(),
+  filter_date_from: z.union([z.string(), z.null()]).optional(),
+  filter_date_to: z.union([z.string(), z.null()]).optional(),
+  filter_timezone: z.union([z.string(), z.null()]).optional()
 }).passthrough();
 z.object({ updated: z.number().int(), skipped: z.number().int() }).passthrough();
 var AlertStatsResponse = z.object({
@@ -974,7 +982,9 @@ var EndpointHealthResponse = z.object({
   consecutive_failures: z.number().int(),
   last_delivery_at: z.union([z.string(), z.null()]),
   last_delivery_status: z.union([z.number(), z.null()]),
-  success_rate_7d: z.number()
+  success_rate_7d: z.number(),
+  failing_since: z.union([z.string(), z.null()]),
+  paused_until: z.union([z.string(), z.null()])
 }).passthrough();
 var WebhookResponse = z.object({
   id: z.string().uuid(),
@@ -3187,7 +3197,7 @@ var setCampaignAlertOverridesTool = {
 var GetAlertStatsInputShape = {};
 var getAlertStatsTool = {
   name: "get_alert_stats",
-  description: "Get alert counts grouped by status: open, escalated, resolved, dismissed (total is implicit in the sum). Status names match the canonical AlertStatus enum used by `list_alerts` and `update_alert_status`.",
+  description: "Get alert counts grouped by status: open, escalated, resolved, dismissed. Counts cover the caller's organization over all time and are not filtered, so the four sum to the `total` an unfiltered `list_alerts` reports. Status names match the canonical AlertStatus enum used by `list_alerts` and `update_alert_status`.",
   annotations: {
     title: "Get Alert Stats",
     readOnlyHint: true,
@@ -5649,5 +5659,5 @@ function formatToolError(error) {
 }
 
 export { BearerToken, SERVER_INSTRUCTIONS, createHttpApiGateway, createPinoLogger, declareEmptyResourcesAndPrompts, newRequestId, wireToolsIntoMcpServer };
-//# sourceMappingURL=chunk-XCAKB2QW.js.map
-//# sourceMappingURL=chunk-XCAKB2QW.js.map
+//# sourceMappingURL=chunk-T6GEYHLP.js.map
+//# sourceMappingURL=chunk-T6GEYHLP.js.map