@kaminari-ad/mcp 0.14.0 → 0.16.0

package/CHANGELOG.md

@@ -7,6 +7,110 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.16.0] - 2026-08-26
+
+### Added
+
+- **`unpublish_policy_set` — publication is no longer a one-way door
+  (KAMIAD-167).** `request_policy_set_approval` had no inverse, so an
+  agent could put a set into the shared catalog but never take it out;
+  the only escape was asking a human to reject it, and that worked only
+  while the request was still pending. The new tool returns a set to
+  private from either state — approved or awaiting review — and is
+  idempotent on a set that is already private. It is annotated
+  `destructiveHint: true` because other organizations lose access to a
+  set they may be browsing. Campaigns already bound to the set keep
+  running against it; going private blocks new attachments instead.
+
+  Needs the API side deployed first: it wraps
+  `POST /api/v1/policy-sets/{id}/unpublish`, added in `adverif/api!378`.
+
+### Changed
+
+- **`get_campaign_alert_overrides` validates `mode` strictly — this
+  actually shipped in 0.15.0, undocumented.** That release's regen
+  narrowed `CampaignOverridesResponse.mode` from a bare `string` to the
+  generated `CampaignOverrideMode` enum (`inherit | override |
+  silence`), and the response parser enforces it, so a fourth value
+  from the API now surfaces as an `upstream` error instead of passing
+  through. That is the intent — the api types the field, so drift
+  should fail loudly — but it is a behaviour change and 0.15.0 recorded
+  only "regenerated openapi.ts / zod-schemas.ts".
+- `set_campaign_alert_overrides` now takes its `mode` input from that
+  same generated enum instead of a hand-written `z.enum` with identical
+  values. Behaviour is unchanged; the point is that `check-tool-enum-drift`
+  can finally catch future value changes on this field, so its
+  exemption is gone.
+
+### Removed
+
+- The two `/api/forms/*` entries in `check-api-coverage`'s
+  `EXEMPT_OPERATIONS`. Those routes are `include_in_schema=False` and
+  dropped out of the spec in the 0.15.0 regen, so the exemptions had
+  become dead config — exactly as their own comment predicted.
+
+## [0.15.0] - 2026-08-24
+
+### Added
+
+- **`get_proxy_targeting` — the accepted proxy values, instead of
+  guesswork.** A scan's `proxy` block takes a region, city, and ISP whose
+  valid values come from our upstream network provider's catalogue, so
+  they cannot be an enum in the schema: they differ per country and per
+  connection type. Until now an agent had to guess, and a wrong guess
+  came back as a 422 with a prose message. The new tool wraps
+  `GET /api/v1/proxy/targeting` and returns the accepted regions,
+  cities, and ISPs for a country, ordered by pool size so the agent can
+  prefer values likely to yield an exit node. Anything it lists is
+  accepted by `create_scan`.
+
+  Two things the tool's description makes explicit, because both are
+  easy to get wrong: pass `proxy_type: "mobile"` when the scan is mobile
+  (the two networks are separate pools — in the US that is 1500+ ISPs
+  against roughly a dozen carriers), and take a city from the same
+  response that produced the region, since a region and a city that do
+  not belong together leave the provider nothing to route through.
+
+- **The write tools now point at it.** A tool nobody is told about is a
+  tool nobody calls, and an agent starts from `create_scan`, not from the
+  catalogue. The `proxy` fields on `create_scan` / `create_bulk_scans`
+  and the `proxy_*` fields on `create_campaign` / `update_campaign` now
+  name `get_proxy_targeting` and carry the same two warnings. The
+  campaign `proxy_region` description previously said "free-text", which
+  told the agent to invent a value — precisely the behaviour that
+  produces the 422 this release exists to remove.
+
+### Changed
+
+- **Regenerated `openapi.ts` / `zod-schemas.ts`** against the API
+  release that adds `/api/v1/proxy/targeting`.
+
+- **A rejected field value now arrives as a `detail` array.** The API
+  changed 422 responses for values checked against a runtime vocabulary
+  (`proxy.region`, `proxy.city`, `proxy.isp`, `country_code`,
+  `emulator_id`) from a prose string to the `HTTPValidationError`
+  array its OpenAPI schema always declared. No change was needed here —
+  `toApiError` has handled both shapes since the parser-drift work — and
+  the agent-visible message is now `body.proxy.region: Unsupported proxy
+  region …` instead of an undifferentiated sentence.
+
+## [0.14.1] - 2026-08-24
+
+### Changed
+
+- **Three tag tools described archived tags as still reachable
+  (KAMIAD-120).** The API now retires an archived tag everywhere: it is
+  no longer assigned to scans, no longer raises alerts, and an archived
+  platform tag is gone from the catalogue entirely. `list_tags` told the
+  agent the opposite — to pass `include_archived` "when resolving a slug
+  seen on an older scan", which now returns nothing for exactly those
+  slugs. `get_tag_definition` now documents the 404, and
+  `list_scan_tags` that a scan can report fewer tags than when it ran.
+  Descriptions only; no schema or shape change, so
+  `src/shared/api/{openapi,zod-schemas}.ts` are unaffected — the two
+  stale JSDoc lines about `include_archived` are regenerated from the
+  live spec once the API side is deployed.
+
 ## [0.14.0] - 2026-08-23
 
 Resyncs the tool surface with `/api/v1` (KAMIAD-158). The generated
@@ -1128,7 +1232,10 @@ Initial public release. The first version that ships to npm under
   need them.
 - Invoice PDF fetcher — same reason.
 
-[Unreleased]: https://github.com/kaminari-ad/mcp/compare/v0.13.0...HEAD
+[Unreleased]: https://github.com/kaminari-ad/mcp/compare/v0.15.0...HEAD
+[0.15.0]: https://github.com/kaminari-ad/mcp/compare/v0.14.1...v0.15.0
+[0.14.1]: https://github.com/kaminari-ad/mcp/compare/v0.14.0...v0.14.1
+[0.14.0]: https://github.com/kaminari-ad/mcp/compare/v0.13.0...v0.14.0
 [0.13.0]: https://github.com/kaminari-ad/mcp/compare/v0.12.0...v0.13.0
 [0.12.0]: https://github.com/kaminari-ad/mcp/compare/v0.11.0...v0.12.0
 [0.11.0]: https://github.com/kaminari-ad/mcp/compare/v0.10.0...v0.11.0

package/README.md

@@ -63,7 +63,7 @@ Add to your MCP client config (Cursor: `~/.cursor/mcp.json`; Claude Desktop: `~/
 }
 ```
 
-Restart your client. You should see `kaminari-ad` in the MCP servers list with 105 tools exposed.
+Restart your client. You should see `kaminari-ad` in the MCP servers list with 107 tools exposed.
 
 ### 2b. Hosted HTTP transport (no install)
 
@@ -113,7 +113,7 @@ which decides which credential type minted it.
 
 ## Tools
 
-105 tools covering the public `/api/v1` surface of Kaminari Ad. Every tool carries MCP behaviour annotations (`title`, `readOnlyHint`, `destructiveHint`, `idempotentHint`, `openWorldHint`) so MCP clients can warn before destructive actions. The complete list, by domain:
+107 tools covering the public `/api/v1` surface of Kaminari Ad. Every tool carries MCP behaviour annotations (`title`, `readOnlyHint`, `destructiveHint`, `idempotentHint`, `openWorldHint`) so MCP clients can warn before destructive actions. The complete list, by domain:
 
 - **Account** (14) — `get_account`, `update_org`, `list_org_users`, `invite_user`, `update_user_role`, `remove_user`, `transfer_ownership`, `list_org_roles`, `create_custom_role`, `list_account_labels`, `update_account_labels`, `list_api_keys`, `create_api_key`, `revoke_api_key`
 - **Scans** (13) — `list_scans`, `get_scan`, `list_scan_children`, `create_scan`, `create_bulk_scans`, `recheck_scans`, `cancel_scan`, `get_scan_screenshot`, `get_scan_creative_screenshot`, `get_scan_landing_screenshot`, `get_scan_creative_html`, `get_scan_creative_video`, `get_scan_vast_xml`
@@ -123,13 +123,13 @@ which decides which credential type minted it.
 - **Tags** (5) — `list_tags`, `get_tag_definition`, `update_tag_definition`, `delete_tag_definition`, `list_scan_tags`
 - **Custom rules** (6) — `list_custom_rules`, `get_custom_rule`, `create_custom_rule`, `update_custom_rule`, `delete_custom_rule`, `test_custom_rule`
 - **Custom taxonomies** (7) — `list_custom_taxonomies`, `get_custom_taxonomy`, `create_custom_taxonomy`, `update_custom_taxonomy`, `delete_custom_taxonomy`, `restore_custom_taxonomy`, `parse_custom_taxonomy_text`
-- **Policy sets** (9) — `list_policy_sets`, `get_policy_set`, `create_policy_set`, `update_policy_set`, `delete_policy_set`, `request_policy_set_approval`, `list_policy_set_campaigns`, `attach_policy_set_campaigns`, `detach_policy_set_campaigns`
+- **Policy sets** (10) — `list_policy_sets`, `get_policy_set`, `create_policy_set`, `update_policy_set`, `delete_policy_set`, `request_policy_set_approval`, `unpublish_policy_set`, `list_policy_set_campaigns`, `attach_policy_set_campaigns`, `detach_policy_set_campaigns`
 - **Alerts** (4) — `list_alerts`, `update_alert_status`, `bulk_update_alert_status`, `get_alert_stats`
 - **Webhooks** (11) — `list_webhooks`, `get_webhook`, `create_webhook`, `update_webhook`, `delete_webhook`, `list_webhook_event_types`, `list_webhook_deliveries`, `test_webhook`, `rotate_webhook_secret`, `replay_webhook_delivery`, `bulk_replay_webhook`
 - **Billing** (4) — `get_billing_summary`, `list_usage`, `get_usage_summary`, `list_balance_history`
 - **Invoicing** (2) — `list_invoices`, `get_invoice_pdf`
 - **Alert notifications** (5) — `list_alert_destinations`, `delete_alert_destination`, `set_alert_destination_version`, `get_campaign_alert_overrides`, `set_campaign_alert_overrides`
-- **Reference data** (2) — `list_geos`, `list_emulators`
+- **Reference data** (3) — `list_geos`, `list_emulators`, `get_proxy_targeting`
 
 Screenshots (`get_scan_screenshot`, `get_scan_creative_screenshot`, `get_scan_landing_screenshot`) come back as inline MCP `image` blocks; `get_invoice_pdf` and `get_scan_creative_video` as inline resource blocks — no second fetch, no presigned URL. The two text artifacts (`get_scan_creative_html`, `get_scan_vast_xml`) come back as strings the model can read directly. Every artifact download is size-capped in the gateway — 256 KiB for the text artifacts, 8 MiB for the binary ones — and refused while reading rather than buffered and then rejected.
 

package/dist/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { NAME, VERSION, err, ok } from './chunk-FQTVDC5D.js';
+import { NAME, VERSION, err, ok } from './chunk-LTUO4SP6.js';
 import process from 'process';
 import { z } from 'zod';
 
@@ -160,10 +160,10 @@ async function main() {
   }
   const config = configResult.value;
   if (config.transport === "stdio") {
-    const { bootstrapStdio } = await import('./stdio-bootstrap-XZIU2X6Z.js');
+    const { bootstrapStdio } = await import('./stdio-bootstrap-LLCHIZ4X.js');
     return bootstrapStdio(config);
   }
-  const { bootstrapHttp } = await import('./http-bootstrap-AYQ47NTT.js');
+  const { bootstrapHttp } = await import('./http-bootstrap-PDCTS4IS.js');
   return bootstrapHttp(config);
 }
 main().then(

package/dist/{chunk-FQTVDC5D.js → chunk-LTUO4SP6.js}

@@ -3,8 +3,8 @@ export { err, ok } from 'neverthrow';
 
 // src/shared/version.ts
 var NAME = "@kaminari-ad/mcp";
-var VERSION = "0.14.0";
+var VERSION = "0.16.0";
 
 export { NAME, VERSION };
-//# sourceMappingURL=chunk-FQTVDC5D.js.map
-//# sourceMappingURL=chunk-FQTVDC5D.js.map
+//# sourceMappingURL=chunk-LTUO4SP6.js.map
+//# sourceMappingURL=chunk-LTUO4SP6.js.map

package/dist/{chunk-FQTVDC5D.js.map → chunk-LTUO4SP6.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/shared/version.ts"],"names":[],"mappings":";;;;AASO,IAAM,IAAA,GAAO;AACb,IAAM,OAAA,GAAU","file":"chunk-FQTVDC5D.js","sourcesContent":["/**\n * Package version and name. Hard-coded as constants here, asserted to\n * match `package.json` by a unit test.\n *\n * Why not import `package.json`: it would force JSON-module support at\n * runtime and tsup-bundling would inline the entire manifest. Two\n * constants + one assertion test is simpler and gives the same safety.\n */\n\nexport const NAME = \"@kaminari-ad/mcp\";\nexport const VERSION = \"0.14.0\";\n"]}
+{"version":3,"sources":["../src/shared/version.ts"],"names":[],"mappings":";;;;AASO,IAAM,IAAA,GAAO;AACb,IAAM,OAAA,GAAU","file":"chunk-LTUO4SP6.js","sourcesContent":["/**\n * Package version and name. Hard-coded as constants here, asserted to\n * match `package.json` by a unit test.\n *\n * Why not import `package.json`: it would force JSON-module support at\n * runtime and tsup-bundling would inline the entire manifest. Two\n * constants + one assertion test is simpler and gives the same safety.\n */\n\nexport const NAME = \"@kaminari-ad/mcp\";\nexport const VERSION = \"0.16.0\";\n"]}

package/dist/{chunk-CUJWJSNJ.js → chunk-YYS2HD6K.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { err, ok } from './chunk-FQTVDC5D.js';
+import { err, ok } from './chunk-LTUO4SP6.js';
 import { createHash, randomUUID } from 'crypto';
 import createClient from 'openapi-fetch';
 import { fetch } from 'undici';
@@ -471,6 +471,15 @@ var GeoResponse = z.object({
   region: z.string(),
   tier: z.string()
 }).passthrough();
+var ProxyTargetingResponse = z.object({
+  country_code: z.string(),
+  proxy_type: z.string(),
+  regions: z.array(z.string()),
+  cities: z.array(z.string()),
+  isps: z.array(z.string()),
+  refreshed_at: z.union([z.string(), z.null()]),
+  ttl_seconds: z.number().int()
+}).passthrough();
 var EmulatorResponse = z.object({
   id: z.string(),
   display_name: z.string(),
@@ -1093,13 +1102,14 @@ var AlertNotificationDestinationResponse = z.object({
   updated_at: z.string().datetime({ offset: true })
 }).passthrough();
 z.object({ version: AlertNotificationVersion }).passthrough();
+var CampaignOverrideMode = z.enum(["inherit", "override", "silence"]);
 var CampaignOverridesResponse = z.object({
   campaign_id: z.string().uuid(),
-  mode: z.string(),
+  mode: CampaignOverrideMode,
   destination_ids: z.array(z.string().uuid())
 }).passthrough();
 z.object({
-  mode: z.string().min(1).max(16),
+  mode: CampaignOverrideMode,
   destination_ids: z.array(z.string().uuid()).optional().default([])
 }).passthrough();
 var InvoiceType = z.enum(["proforma", "final"]);
@@ -1135,32 +1145,6 @@ z.object({
   limit: z.number().int(),
   pages: z.number().int()
 }).passthrough();
-z.object({
-  name: z.string().min(2).max(100),
-  email: z.string().email(),
-  message: z.string().min(10).max(2e3),
-  source: z.string().max(512).optional().default("")
-}).passthrough();
-z.object({
-  id: z.string().uuid(),
-  received_at: z.string().datetime({ offset: true })
-}).passthrough();
-var PreferredContactChannel = z.enum(["telegram", "whatsapp", "email"]);
-z.object({
-  first_name: z.string().min(2).max(60),
-  last_name: z.string().min(2).max(60),
-  company_email: z.string().email(),
-  company_name: z.string().min(2).max(120),
-  preferred_channel: PreferredContactChannel,
-  contact_handle: z.string().max(120).optional().default(""),
-  comment: z.string().max(2e3).optional().default(""),
-  privacy_accepted: z.boolean(),
-  source: z.string().max(512).optional().default("")
-}).passthrough();
-z.object({
-  id: z.string().uuid(),
-  received_at: z.string().datetime({ offset: true })
-}).passthrough();
 var CustomTaxonomyListItem = z.object({
   id: z.string().uuid(),
   name: z.string(),
@@ -1230,6 +1214,7 @@ var schemas = {
   ScanResponse,
   ScanBriefResponse,
   GeoResponse,
+  ProxyTargetingResponse,
   EmulatorResponse,
   CampaignGroupResponse,
   GroupActionResponse,
@@ -1261,6 +1246,7 @@ var schemas = {
   DeliveryAttemptResponse,
   BulkReplayResponse,
   AlertNotificationDestinationResponse,
+  CampaignOverrideMode,
   CampaignOverridesResponse,
   InvoiceResponse,
   CustomTaxonomyListItem,
@@ -1779,6 +1765,18 @@ var PolicySetListItemSchema = schemas.PolicySetListItem.pick({
 }).strip();
 var parsePolicySetPage = (raw) => parsePagedWithItemSchema(PolicySetListItemSchema, raw, "policy-sets");
 
+// src/infrastructure/api/parsers/parse-proxy-targeting.ts
+var ProxyTargetingSchema = schemas.ProxyTargetingResponse.pick({
+  country_code: true,
+  proxy_type: true,
+  regions: true,
+  cities: true,
+  isps: true,
+  refreshed_at: true,
+  ttl_seconds: true
+}).strip();
+var parseProxyTargeting = (raw) => parseWithSchema(ProxyTargetingSchema, raw, "proxy targeting");
+
 // src/infrastructure/api/parsers/parse-run.ts
 var RunSchema = schemas.RunResponse.pick({
   id: true,
@@ -2254,6 +2252,9 @@ function createHttpApiGateway(config) {
     async listEmulators() {
       return call("GET", "/api/v1/emulators", {}, parseEmulatorList);
     },
+    async getProxyTargeting(query) {
+      return call("GET", "/api/v1/proxy/targeting", { params: { query } }, parseProxyTargeting);
+    },
     // ── Campaigns ─────────────────────────────────────────────────
     async listCampaigns(filters) {
       return call("GET", "/api/v1/campaigns", { params: { query: filters } }, parseCampaignPage);
@@ -2556,6 +2557,14 @@ function createHttpApiGateway(config) {
         parseEmpty
       );
     },
+    async unpublishPolicySet(id) {
+      return call(
+        "POST",
+        "/api/v1/policy-sets/{policy_set_id}/unpublish",
+        { params: { path: { policy_set_id: id } } },
+        parseEmpty
+      );
+    },
     // ── Custom taxonomies ─────────────────────────────────────────
     async listCustomTaxonomies(filters) {
       return call(
@@ -3288,12 +3297,7 @@ var setAlertDestinationVersionTool = {
 };
 var SetCampaignAlertOverridesInputShape = {
   campaign_id: z.string().uuid().describe("Campaign UUID."),
-  // enum-drift: allow — the API validates these three values but types
-  // the field as a plain string, so no generated schema constrains it.
-  // Swap to `schemas.CampaignOverrideMode` after the api enum change
-  // (`fix/type-override-mode-and-unlist-forms`) reaches prod and the
-  // next `make gen-api-types` picks it up.
-  mode: z.enum(["inherit", "override", "silence"]).describe(
+  mode: schemas.CampaignOverrideMode.describe(
     "Routing mode: `inherit` (fall back to the org-wide destinations), `override` (route ONLY to `destination_ids`), `silence` (send nothing for this campaign)."
   ),
   destination_ids: z.array(z.string().uuid()).max(50).default([]).describe(
@@ -3920,10 +3924,18 @@ var campaignConfigFields = {
   emulator_mode: z.enum(["random", "all"]).optional().describe(
     "How selected categories expand per run: 'random' = one random device per category (the UI's 'Random (1 per group)'), 'all' = every device in each category ('All checked'). Does not affect emulator_specific_ids. Default: random."
   ),
-  proxy_type: z.enum(["residential", "mobile"]).optional().describe("Proxy network type. Default: residential."),
-  proxy_region: z.string().optional().describe("Proxy region/state targeting (free-text; only honoured for a single country)."),
-  proxy_city: z.string().optional().describe("Proxy city targeting."),
-  proxy_isp: z.string().optional().describe("Proxy ISP targeting."),
+  proxy_type: z.enum(["residential", "mobile"]).optional().describe(
+    "Proxy network type. Default: residential. Residential and mobile are separate pools with separate catalogues, so pass the same value to `get_proxy_targeting` that you send here."
+  ),
+  proxy_region: z.string().optional().describe(
+    "Proxy region/state; use a value from `get_proxy_targeting` for one of this campaign's countries. Only honoured when the campaign targets a single country."
+  ),
+  proxy_city: z.string().optional().describe(
+    "Proxy city from `get_proxy_targeting`. If you also set `proxy_region`, take the city from a call made with that same region \u2014 a city from a different region passes validation but leaves the provider no exit node."
+  ),
+  proxy_isp: z.string().optional().describe(
+    "Proxy ISP, or mobile carrier when `proxy_type` is mobile. Use a value from `get_proxy_targeting`."
+  ),
   ...repeatRetryFields,
   schedule_type: z.enum(["weekly", "interval"]).optional().describe(
     "Scheduling mode: 'weekly' (run on a weekday/hour grid via schedule_weekly) or 'interval' (run every schedule_interval_seconds). Omit for a manual (run-on-demand) campaign."
@@ -5055,6 +5067,26 @@ var requestPolicySetApprovalTool = {
     return ok({ requested: true });
   }
 };
+var UnpublishPolicySetInputShape = {
+  policy_set_id: z.string().uuid().describe("Policy set UUID.")
+};
+var unpublishPolicySetTool = {
+  name: "unpublish_policy_set",
+  description: "Return one of your organization's policy sets to PRIVATE. Inverse of request_policy_set_approval: removes an approved set from the shared catalog other organizations browse, or withdraws a publication request that is still awaiting review. The set stays fully usable inside your own organization. Campaigns in other organizations that already reference the set keep their binding \u2014 going private blocks new attachments rather than breaking existing ones. Safe to call on a set that is already private.",
+  annotations: {
+    title: "Unpublish Policy Set",
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(UnpublishPolicySetInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.unpublishPolicySet(input.policy_set_id);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok({ unpublished: true });
+  }
+};
 var UpdatePolicySetInputShape = {
   policy_set_id: z.string().uuid().describe("Policy set UUID."),
   name: z.string().min(1).max(200).describe("New name (always required by the API on update)."),
@@ -5084,6 +5116,38 @@ var updatePolicySetTool = {
     return ok(result.value);
   }
 };
+var GetProxyTargetingInputShape = {
+  country_code: z.string().length(2).describe("ISO 3166-1 alpha-2 country code, e.g. 'US'. Case-insensitive."),
+  proxy_type: z.enum(["residential", "mobile"]).optional().describe(
+    "Which network to describe. Defaults to residential. Pass 'mobile' when the scan will use mobile: the two are separate pools with different catalogues, so a residential ISP is normally rejected for a mobile scan."
+  ),
+  region: z.string().optional().describe(
+    "Narrow the returned cities to one region. Pass a value from this tool's own 'regions' array. Omit it for the country-wide city list."
+  )
+};
+var getProxyTargetingTool = {
+  name: "get_proxy_targeting",
+  description: "List the proxy regions, cities, and ISPs accepted for a country. Call this before setting proxy targeting on create_scan, create_bulk_scans, create_campaign, or update_campaign \u2014 the accepted values come from the upstream network provider and cannot be listed in those tools' schemas, so a guess is a 422. Anything listed here is accepted. Values are ordered by pool size, largest first; prefer values near the front. Two traps: residential and mobile are separate pools, so pass the proxy_type the scan will use; and without a region the cities are the whole country's, so if you target a region, call again with that region and take the city from that narrower list \u2014 a region and a city that do not belong together are accepted but leave the provider no exit node.",
+  annotations: {
+    title: "Get Proxy Targeting",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(GetProxyTargetingInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.getProxyTargeting({
+      country_code: input.country_code,
+      ...input.proxy_type !== void 0 && { proxy_type: input.proxy_type },
+      ...input.region !== void 0 && { region: input.region }
+    });
+    if (result.isErr()) {
+      return err(mapApiError(result.error));
+    }
+    return ok(result.value);
+  }
+};
 var CancelRunInputShape = { run_id: z.string().uuid().describe("Run UUID.") };
 var cancelRunTool = {
   name: "cancel_run",
@@ -5166,11 +5230,21 @@ var cancelScanTool = {
   }
 };
 var scanProxyField = z.object({
-  proxy_type: z.enum(["residential", "mobile"]).optional().describe("Proxy network type. Default: residential."),
-  region: z.string().optional().describe("Proxy region/state targeting."),
-  city: z.string().optional().describe("Proxy city targeting."),
-  isp: z.string().optional().describe("Proxy ISP targeting.")
-}).optional().describe("Optional proxy geo targeting for the crawl. Omit to use the org default.");
+  proxy_type: z.enum(["residential", "mobile"]).optional().describe(
+    "Proxy network type. Default: residential. Residential and mobile are separate pools with separate catalogues, so pass the same value to `get_proxy_targeting` that you send here."
+  ),
+  region: z.string().optional().describe(
+    "Proxy region/state. Use a value from `get_proxy_targeting`; anything else is rejected with 422."
+  ),
+  city: z.string().optional().describe(
+    "Proxy city. Use a value from `get_proxy_targeting`. If you also set `region`, take the city from a `get_proxy_targeting` call made with that same region \u2014 a city from a different region passes validation but leaves the provider no exit node."
+  ),
+  isp: z.string().optional().describe(
+    "Proxy ISP, or mobile carrier when `proxy_type` is mobile. Use a value from `get_proxy_targeting`."
+  )
+}).optional().describe(
+  "Optional proxy geo targeting for the crawl. Omit to use the org default. Call `get_proxy_targeting` for the country first: the accepted values come from the upstream network provider and cannot be listed in this schema."
+);
 var scanReferrerField = z.string().url().regex(/^https?:\/\//i, "Must be an http(s) URL.").max(2048).optional().describe(
   "Optional http(s) page URL the check is performed from. With `ad_tag` or `vast_tag` this is the publisher page the tag is embedded in \u2014 NOT the creative and NOT its landing page; the browser commits the page document on this URL without fetching the publisher, so the creative renders as if embedded there, and its cross-origin subrequests receive the origin only (https://publisher.example/, no path). With a `url` target this is where the visitor came from, sent in full as the Referer of the page request."
 );
@@ -5599,7 +5673,7 @@ var GetTagDefinitionInputShape = {
 };
 var getTagDefinitionTool = {
   name: "get_tag_definition",
-  description: "Get full definition of one tag: display name, description, severity, category, source (system vs custom), public-report visibility, usage counts, plus `linked_rules` \u2014 the custom rules currently producing this tag (id, name, active flag). Fetch a specific rule's full config via `get_custom_rule`.",
+  description: "Get full definition of one tag: display name, description, severity, category, source (system vs custom), public-report visibility, usage counts, plus `linked_rules` \u2014 the custom rules currently producing this tag (id, name, active flag). Fetch a specific rule's full config via `get_custom_rule`. Returns 404 for a retired (archived) tag this organization does not own, including every archived system tag.",
   annotations: {
     title: "Get Tag Definition",
     readOnlyHint: true,
@@ -5619,7 +5693,7 @@ var ListScanTagsInputShape = {
 };
 var listScanTagsTool = {
   name: "list_scan_tags",
-  description: "List every tag (system + custom) attached to one scan by the checker pipeline, with display name, category, and severity.",
+  description: "List every tag (system + custom) attached to one scan by the checker pipeline, with display name, category, and severity. Tags whose definition has since been archived are omitted \u2014 the scan can therefore report fewer tags than when it ran.",
   annotations: {
     title: "List Scan Tags",
     readOnlyHint: true,
@@ -5639,12 +5713,12 @@ var ListTagsInputShape = {
     "Filter to tags in one category slug (e.g. 'security', 'malware', 'compliance'). Use the slug exactly as it appears in `category` of an existing tag."
   ),
   include_archived: z.boolean().optional().describe(
-    "Include archived tag definitions, which are excluded by default. Archived tags still appear on the scans that carry them, so pass `true` when resolving a slug seen on an older scan."
+    "Also return the archived tag definitions this organization owns, which are excluded by default. An archived tag is retired: it is no longer assigned to scans and no longer raises alerts, and archived platform (system) tags are never returned at all \u2014 so this flag cannot resolve a slug seen on an older scan."
   )
 };
 var listTagsTool = {
   name: "list_tags",
-  description: "List every tag definition the platform knows (system tags + organization custom tags) with category, severity, visibility, and usage counters (scans + rules per tag). Optionally filter by category, and pass `include_archived` to also see retired definitions.",
+  description: "List every tag definition in service for this organization (system tags + organization custom tags) with category, severity, visibility, and usage counters (scans + rules per tag). Optionally filter by category, and pass `include_archived` to also see the retired definitions this organization owns.",
   annotations: {
     title: "List Tags",
     readOnlyHint: true,
@@ -5980,6 +6054,7 @@ function registerAllTools(register) {
   register(createApiKeyTool);
   register(revokeApiKeyTool);
   register(listGeosTool);
+  register(getProxyTargetingTool);
   register(listEmulatorsTool);
   register(getScanTool);
   register(listScanChildrenTool);
@@ -6041,6 +6116,7 @@ function registerAllTools(register) {
   register(updatePolicySetTool);
   register(deletePolicySetTool);
   register(requestPolicySetApprovalTool);
+  register(unpublishPolicySetTool);
   register(listPolicySetCampaignsTool);
   register(attachPolicySetCampaignsTool);
   register(detachPolicySetCampaignsTool);
@@ -6150,5 +6226,5 @@ function formatToolError(error) {
 }
 
 export { BearerToken, SERVER_INSTRUCTIONS, createHttpApiGateway, createPinoLogger, declareEmptyResourcesAndPrompts, newRequestId, wireToolsIntoMcpServer };
-//# sourceMappingURL=chunk-CUJWJSNJ.js.map
-//# sourceMappingURL=chunk-CUJWJSNJ.js.map
+//# sourceMappingURL=chunk-YYS2HD6K.js.map
+//# sourceMappingURL=chunk-YYS2HD6K.js.map