@langwatch/mcp-server 1.0.0 → 2.1.0

package/.python-version

@@ -0,0 +1 @@
+3.11

package/CHANGELOG.md

@@ -1,5 +1,115 @@
 # Changelog
 
+## [2.1.0](https://github.com/langwatch/langwatch/compare/mcp-server@v2.0.0...mcp-server@v2.1.0) (2026-09-12)
+
+
+### Features
+
+* **agent-testing:** compare agents in one run ([#7654](https://github.com/langwatch/langwatch/issues/7654)) ([3e73916](https://github.com/langwatch/langwatch/commit/3e7391698f5e9b1cac2f8c5f0d0cacc9dec4d02a))
+* **agent-testing:** suite fields and evaluators on scenario runs ([#7867](https://github.com/langwatch/langwatch/issues/7867)) ([0bcf01e](https://github.com/langwatch/langwatch/commit/0bcf01edb3d8cc36aa62cd48e6ee147a7b01b45b))
+* **agent-testing:** v2 polish round 6 ([#7590](https://github.com/langwatch/langwatch/issues/7590)) ([1f9efad](https://github.com/langwatch/langwatch/commit/1f9efad30ab94e86d00f57ea478bf0685b437f23))
+* **agents:** connected agents, a decorated function is a simulation target ([#7655](https://github.com/langwatch/langwatch/issues/7655)) ([56922c0](https://github.com/langwatch/langwatch/commit/56922c0ee429bd5a38717960c09ede0d1905c0c3))
+
+
+### Bug Fixes
+
+* **agents:** a finished connected-agent run reaches its verdict, and the transcript stays whole ([#7696](https://github.com/langwatch/langwatch/issues/7696)) ([4f7b665](https://github.com/langwatch/langwatch/commit/4f7b665623e1e453e8f505c259f2351bd074ad72))
+* **agents:** a key waits for its grants, and a listing shows who holds each agent ([#7907](https://github.com/langwatch/langwatch/issues/7907)) ([654e82a](https://github.com/langwatch/langwatch/commit/654e82ae9f53c98c0cc710dc9c0c520a87e2c6cb))
+* **mcp:** stop prompt tools dropping fields in both directions ([#7712](https://github.com/langwatch/langwatch/issues/7712)) ([a97c378](https://github.com/langwatch/langwatch/commit/a97c378d8ee9c3613c2235738e0ea4085b45684e))
+* optional legacy answer fields, one vocabulary for test suites and run plans, and named targets for runs from code ([#7638](https://github.com/langwatch/langwatch/issues/7638)) ([6fd37f3](https://github.com/langwatch/langwatch/commit/6fd37f30428c9fc468230fa9e4a79e3dee8cc58f))
+
+
+### Miscellaneous
+
+* **deps-dev:** bump @anthropic-ai/claude-code ([aac07f5](https://github.com/langwatch/langwatch/commit/aac07f53aa0c7fa4cc988cb365865ff521a0922a))
+* **deps-dev:** bump @anthropic-ai/claude-code ([fbc7dcf](https://github.com/langwatch/langwatch/commit/fbc7dcf5f18f9be74ed7d1a390f922d3c9db7ea8))
+* **deps-dev:** bump @anthropic-ai/claude-code from 2.1.202 to 2.1.226 in the anthropic group across 1 directory ([#6546](https://github.com/langwatch/langwatch/issues/6546)) ([fbc7dcf](https://github.com/langwatch/langwatch/commit/fbc7dcf5f18f9be74ed7d1a390f922d3c9db7ea8))
+* **deps-dev:** bump @anthropic-ai/claude-code from 2.1.226 to 2.1.228 in the anthropic group across 1 directory ([#7264](https://github.com/langwatch/langwatch/issues/7264)) ([aac07f5](https://github.com/langwatch/langwatch/commit/aac07f53aa0c7fa4cc988cb365865ff521a0922a))
+* **deps-dev:** bump the types group across 1 directory with 2 updates ([#6789](https://github.com/langwatch/langwatch/issues/6789)) ([7be2d04](https://github.com/langwatch/langwatch/commit/7be2d04c798b46a29b9b5b046dbb28a1e6c369e7))
+* **deps-dev:** update black requirement from >=26.3.1 to >=26.5.1 in /mcp/typescript ([#7232](https://github.com/langwatch/langwatch/issues/7232)) ([1444629](https://github.com/langwatch/langwatch/commit/14446291f6eafddd99463e7ee83288653ba62346))
+* **deps-dev:** update black requirement in /mcp/typescript ([1444629](https://github.com/langwatch/langwatch/commit/14446291f6eafddd99463e7ee83288653ba62346))
+* **deps-dev:** update cloudpickle requirement from >=3.1.1 to >=3.1.2 in /mcp/typescript ([#7209](https://github.com/langwatch/langwatch/issues/7209)) ([bc02a83](https://github.com/langwatch/langwatch/commit/bc02a8309ad0f69ce350557b35c1bc7d9ea1777b))
+* **deps-dev:** update cloudpickle requirement in /mcp/typescript ([bc02a83](https://github.com/langwatch/langwatch/commit/bc02a8309ad0f69ce350557b35c1bc7d9ea1777b))
+* **deps-dev:** update dspy-ai requirement from <4,>=3.0.3 to >=3.3.0,<4 in /mcp/typescript ([#7225](https://github.com/langwatch/langwatch/issues/7225)) ([81f1590](https://github.com/langwatch/langwatch/commit/81f1590cc08af237d6b6b4fbb81e814ebddbb893))
+* **deps-dev:** update dspy-ai requirement in /mcp/typescript ([81f1590](https://github.com/langwatch/langwatch/commit/81f1590cc08af237d6b6b4fbb81e814ebddbb893))
+* **deps-dev:** update faiss-cpu requirement from <2.0.0,>=1.8.0 to >=1.15.0,<2.0.0 in /mcp/typescript ([#7227](https://github.com/langwatch/langwatch/issues/7227)) ([80b6ae4](https://github.com/langwatch/langwatch/commit/80b6ae45742964508f0a5b44015b433c4887ee19))
+* **deps-dev:** update faiss-cpu requirement in /mcp/typescript ([80b6ae4](https://github.com/langwatch/langwatch/commit/80b6ae45742964508f0a5b44015b433c4887ee19))
+* **deps-dev:** update fastapi requirement from >=0.115.12 to >=0.141.1 in /mcp/typescript ([#7226](https://github.com/langwatch/langwatch/issues/7226)) ([62b3bbf](https://github.com/langwatch/langwatch/commit/62b3bbf4bee00c51316c1e06b3c67788013d8bdb))
+* **deps-dev:** update fastapi requirement in /mcp/typescript ([62b3bbf](https://github.com/langwatch/langwatch/commit/62b3bbf4bee00c51316c1e06b3c67788013d8bdb))
+* **deps-dev:** update fonttools requirement from >=4.62.0 to >=4.63.0 in /mcp/typescript ([#7235](https://github.com/langwatch/langwatch/issues/7235)) ([573fc99](https://github.com/langwatch/langwatch/commit/573fc997c07fbbfbe1dc71acb78635c2c329497c))
+* **deps-dev:** update fonttools requirement in /mcp/typescript ([573fc99](https://github.com/langwatch/langwatch/commit/573fc997c07fbbfbe1dc71acb78635c2c329497c))
+* **deps-dev:** update haystack-ai requirement from <4.0.0,>=2.13.2 to >=3.0.0,<4.0.0 in /mcp/typescript ([#7248](https://github.com/langwatch/langwatch/issues/7248)) ([72df892](https://github.com/langwatch/langwatch/commit/72df892f20134b0a335f3783ef9caa26141888f7))
+* **deps-dev:** update haystack-ai requirement in /mcp/typescript ([72df892](https://github.com/langwatch/langwatch/commit/72df892f20134b0a335f3783ef9caa26141888f7))
+* **deps-dev:** update json-repair requirement from >=0.42.0 to >=0.63.0 in /mcp/typescript ([#7247](https://github.com/langwatch/langwatch/issues/7247)) ([6376930](https://github.com/langwatch/langwatch/commit/6376930151c7d995264c6e1480c08091ecd5830d))
+* **deps-dev:** update json-repair requirement in /mcp/typescript ([6376930](https://github.com/langwatch/langwatch/commit/6376930151c7d995264c6e1480c08091ecd5830d))
+* **deps-dev:** update jupyter requirement from <2.0.0,>=1.0.0 to >=1.1.1,<2.0.0 in /mcp/typescript ([#7243](https://github.com/langwatch/langwatch/issues/7243)) ([7f39887](https://github.com/langwatch/langwatch/commit/7f3988779cc72824bbe3dc5b30c4f0ffbb5bab1c))
+* **deps-dev:** update jupyter requirement in /mcp/typescript ([7f39887](https://github.com/langwatch/langwatch/commit/7f3988779cc72824bbe3dc5b30c4f0ffbb5bab1c))
+* **deps-dev:** update jupyterlab requirement from >=4.5.6 to >=4.6.3 in /mcp/typescript ([#7242](https://github.com/langwatch/langwatch/issues/7242)) ([d714c43](https://github.com/langwatch/langwatch/commit/d714c436982dbda46ce714a4664fa6eb10e47122))
+* **deps-dev:** update jupyterlab requirement in /mcp/typescript ([d714c43](https://github.com/langwatch/langwatch/commit/d714c436982dbda46ce714a4664fa6eb10e47122))
+* **deps-dev:** update langchain-community requirement ([d63a5a8](https://github.com/langwatch/langwatch/commit/d63a5a85e6124030729111f98a4de516f10162bf))
+* **deps-dev:** update langchain-community requirement from <1.0.0,>=0.3.0 to >=0.4.2,<1.0.0 in /mcp/typescript ([#7222](https://github.com/langwatch/langwatch/issues/7222)) ([d63a5a8](https://github.com/langwatch/langwatch/commit/d63a5a85e6124030729111f98a4de516f10162bf))
+* **deps-dev:** update langchain-openai requirement from <2.0.0,>=1.1.14 to >=1.4.3,<2.0.0 in /mcp/typescript ([#7218](https://github.com/langwatch/langwatch/issues/7218)) ([d62efb1](https://github.com/langwatch/langwatch/commit/d62efb14d5cdaf9345a213f86f21804d00890833))
+* **deps-dev:** update langchain-openai requirement in /mcp/typescript ([d62efb1](https://github.com/langwatch/langwatch/commit/d62efb14d5cdaf9345a213f86f21804d00890833))
+* **deps-dev:** update langsmith requirement from >=0.8.0 to >=0.10.18 in /mcp/typescript ([#7230](https://github.com/langwatch/langwatch/issues/7230)) ([f0e1d71](https://github.com/langwatch/langwatch/commit/f0e1d717a416e45f916bd2f777abb5c26598a4d4))
+* **deps-dev:** update langsmith requirement in /mcp/typescript ([f0e1d71](https://github.com/langwatch/langwatch/commit/f0e1d717a416e45f916bd2f777abb5c26598a4d4))
+* **deps-dev:** update nltk requirement from >=3.9.4 to >=3.10.2 in /mcp/typescript ([#7215](https://github.com/langwatch/langwatch/issues/7215)) ([61e9f51](https://github.com/langwatch/langwatch/commit/61e9f515d026cc71f48bffe56f0debff5621f741))
+* **deps-dev:** update nltk requirement in /mcp/typescript ([61e9f51](https://github.com/langwatch/langwatch/commit/61e9f515d026cc71f48bffe56f0debff5621f741))
+* **deps-dev:** update openinference-instrumentation-dspy requirement ([2926e6e](https://github.com/langwatch/langwatch/commit/2926e6efc2aa44faf231c8ed87d26f9f4e588523))
+* **deps-dev:** update openinference-instrumentation-dspy requirement from <0.2.0,>=0.1.23 to >=0.1.39,<0.2.0 in /mcp/typescript ([#7224](https://github.com/langwatch/langwatch/issues/7224)) ([2926e6e](https://github.com/langwatch/langwatch/commit/2926e6efc2aa44faf231c8ed87d26f9f4e588523))
+* **deps-dev:** update openinference-instrumentation-litellm requirement ([8e55d60](https://github.com/langwatch/langwatch/commit/8e55d60f32982070202c61ef53886fb22a74f931))
+* **deps-dev:** update openinference-instrumentation-litellm requirement from >=0.1.19 to >=0.1.36 in /mcp/typescript ([#7250](https://github.com/langwatch/langwatch/issues/7250)) ([8e55d60](https://github.com/langwatch/langwatch/commit/8e55d60f32982070202c61ef53886fb22a74f931))
+* **deps-dev:** update opentelemetry-instrumentation-fastapi requirement ([7a17c8e](https://github.com/langwatch/langwatch/commit/7a17c8edc72629b1500f2f5ee02e398d874d0cb0))
+* **deps-dev:** update opentelemetry-instrumentation-fastapi requirement from >=0.53b1 to >=0.65b0 in /mcp/typescript ([#7228](https://github.com/langwatch/langwatch/issues/7228)) ([7a17c8e](https://github.com/langwatch/langwatch/commit/7a17c8edc72629b1500f2f5ee02e398d874d0cb0))
+* **deps-dev:** update opentelemetry-instrumentation-langchain requirement ([d779795](https://github.com/langwatch/langwatch/commit/d7797954d2099355c3f342cc7a2d580e81926ab0))
+* **deps-dev:** update opentelemetry-instrumentation-langchain requirement from >=0.40.4 to >=0.62.3 in /mcp/typescript ([#7241](https://github.com/langwatch/langwatch/issues/7241)) ([d779795](https://github.com/langwatch/langwatch/commit/d7797954d2099355c3f342cc7a2d580e81926ab0))
+* **deps-dev:** update pypdf requirement from >=6.8.0 to >=6.15.0 in /mcp/typescript ([#7213](https://github.com/langwatch/langwatch/issues/7213)) ([f5160d6](https://github.com/langwatch/langwatch/commit/f5160d686e0d488afc4e6da02e58fc7e973272c2))
+* **deps-dev:** update pypdf requirement in /mcp/typescript ([f5160d6](https://github.com/langwatch/langwatch/commit/f5160d686e0d488afc4e6da02e58fc7e973272c2))
+* **deps-dev:** update pytest requirement from <10.0.0,>=7.4.2 to >=9.1.1,<10.0.0 in /mcp/typescript ([#7211](https://github.com/langwatch/langwatch/issues/7211)) ([d30d016](https://github.com/langwatch/langwatch/commit/d30d0165f77dbd035e25c3fe2ae93ac23d438378))
+* **deps-dev:** update pytest requirement in /mcp/typescript ([d30d016](https://github.com/langwatch/langwatch/commit/d30d0165f77dbd035e25c3fe2ae93ac23d438378))
+* **deps-dev:** update pytest-asyncio requirement from <1.5.0,>=0.21.1 to >=1.4.0,<1.5.0 in /mcp/typescript ([#7231](https://github.com/langwatch/langwatch/issues/7231)) ([752f2f9](https://github.com/langwatch/langwatch/commit/752f2f9e638b5ea98bf6d2d7a4cfc58a67dde7d1))
+* **deps-dev:** update pytest-asyncio requirement in /mcp/typescript ([752f2f9](https://github.com/langwatch/langwatch/commit/752f2f9e638b5ea98bf6d2d7a4cfc58a67dde7d1))
+* **deps-dev:** update strands-agents[otel] requirement ([fd972d9](https://github.com/langwatch/langwatch/commit/fd972d99251385b4dcd16e72a8a444cd4483944b))
+* **deps-dev:** update strands-agents[otel] requirement from <2.0.0,>=1.14.0 to >=1.51.0,<2.0.0 in /mcp/typescript ([#7246](https://github.com/langwatch/langwatch/issues/7246)) ([fd972d9](https://github.com/langwatch/langwatch/commit/fd972d99251385b4dcd16e72a8a444cd4483944b))
+* **deps-dev:** update streamlit requirement from <2.0.0,>=1.37.1 to >=1.61.1,<2.0.0 in /mcp/typescript ([#7233](https://github.com/langwatch/langwatch/issues/7233)) ([042aa3a](https://github.com/langwatch/langwatch/commit/042aa3aa875389929d85cd0896d04ae57490ca43))
+* **deps-dev:** update streamlit requirement in /mcp/typescript ([042aa3a](https://github.com/langwatch/langwatch/commit/042aa3aa875389929d85cd0896d04ae57490ca43))
+* **deps:** bump aiohttp from 3.14.1 to 3.14.3 in /mcp/typescript ([#7216](https://github.com/langwatch/langwatch/issues/7216)) ([590fa78](https://github.com/langwatch/langwatch/commit/590fa78069af737cddfe527f9665fd392355b07f))
+* **deps:** bump attrs from 25.3.0 to 26.1.0 in /mcp/typescript ([#7234](https://github.com/langwatch/langwatch/issues/7234)) ([040afbd](https://github.com/langwatch/langwatch/commit/040afbd9d4292d6ae0ef1da958137e7a32873fc3))
+* **deps:** bump chalk from 5.6.2 to 6.0.0 ([#6803](https://github.com/langwatch/langwatch/issues/6803)) ([82c62ea](https://github.com/langwatch/langwatch/commit/82c62eacb15d9a9ae33e5f4a14da82feaf1de033))
+* **deps:** bump coolname from 2.2.0 to 5.0.0 in /mcp/typescript ([#7240](https://github.com/langwatch/langwatch/issues/7240)) ([0b7d6fa](https://github.com/langwatch/langwatch/commit/0b7d6fa30305ee1ca4d02b0a483593f0792a16dd))
+* **deps:** bump cryptography from 48.0.1 to 50.0.0 in /mcp/typescript ([#7217](https://github.com/langwatch/langwatch/issues/7217)) ([dda8dad](https://github.com/langwatch/langwatch/commit/dda8dad79090bffbed3ed01870e24ee94990dde8))
+* **deps:** bump ipykernel from 6.30.1 to 7.3.0 in /mcp/typescript ([#7221](https://github.com/langwatch/langwatch/issues/7221)) ([8d8442b](https://github.com/langwatch/langwatch/commit/8d8442bb5072ef8b684c17403440efc99bf00470))
+* **deps:** bump mcp from 1.23.0 to 1.28.1 in /mcp/typescript ([#7219](https://github.com/langwatch/langwatch/issues/7219)) ([c243b25](https://github.com/langwatch/langwatch/commit/c243b259905caa263adc530a7a804c7eb9268321))
+* **deps:** bump the minor-and-patch group ([8976b2f](https://github.com/langwatch/langwatch/commit/8976b2f420dc9b9eefd5584465b611b9064bf79e))
+* **deps:** bump the minor-and-patch group in /mcp/typescript with 2 updates ([#7208](https://github.com/langwatch/langwatch/issues/7208)) ([8976b2f](https://github.com/langwatch/langwatch/commit/8976b2f420dc9b9eefd5584465b611b9064bf79e))
+* **deps:** bump the opentelemetry group across 1 directory with 25 updates ([#7296](https://github.com/langwatch/langwatch/issues/7296)) ([12615f1](https://github.com/langwatch/langwatch/commit/12615f1fc27dfc26063d4135f3f322f7c71c7f01))
+* **deps:** update langchain-core requirement from <2.0.0,>=0.3.0 to >=1.5.4,<2.0.0 in /mcp/typescript ([#7239](https://github.com/langwatch/langwatch/issues/7239)) ([ed9ba32](https://github.com/langwatch/langwatch/commit/ed9ba32c4851339a45c3914eb28da8a2ffaf040a))
+* **deps:** update langchain-core requirement in /mcp/typescript ([ed9ba32](https://github.com/langwatch/langwatch/commit/ed9ba32c4851339a45c3914eb28da8a2ffaf040a))
+* **deps:** update mcp[cli] requirement from >=1.13.1 to >=2.0.0 in /mcp/typescript ([#7212](https://github.com/langwatch/langwatch/issues/7212)) ([32859df](https://github.com/langwatch/langwatch/commit/32859dfc457260f098274d0f7df070b2cd9b489e))
+* **deps:** update mcp[cli] requirement in /mcp/typescript ([32859df](https://github.com/langwatch/langwatch/commit/32859dfc457260f098274d0f7df070b2cd9b489e))
+* **deps:** update ruff requirement from >=0.11.1 to >=0.16.2 in /mcp/typescript ([#7244](https://github.com/langwatch/langwatch/issues/7244)) ([5e33035](https://github.com/langwatch/langwatch/commit/5e33035b20bceb14c7c541d784c79d3817f35540))
+* **deps:** update ruff requirement in /mcp/typescript ([5e33035](https://github.com/langwatch/langwatch/commit/5e33035b20bceb14c7c541d784c79d3817f35540))
+
+## [2.0.0](https://github.com/langwatch/langwatch/compare/mcp-server@v1.0.0...mcp-server@v2.0.0) (2026-08-07)
+
+
+### ⚠ BREAKING CHANGES
+
+* **mcp-server:** three behaviors change for callers of the HTTP server. A client that authenticated once at initialize and then sent only the session id must now send Authorization: Bearer <key> on every request. GET /sse?apiKey=<key> no longer authenticates; use the Authorization header. A deployment relying on the implicit 0.0.0.0 bind must pass --host 0.0.0.0, which the published container image already does.
+
+### Features
+
+* **api-docs:** publish the REST API the SDKs actually call, and gate route coverage ([#6605](https://github.com/langwatch/langwatch/issues/6605)) ([25884bf](https://github.com/langwatch/langwatch/commit/25884bf3992eb99c00c3c7bafb09b979b02f0013))
+
+
+### Bug Fixes
+
+* **mcp-server:** authorize every request to the standalone HTTP server ([#6641](https://github.com/langwatch/langwatch/issues/6641)) ([af324de](https://github.com/langwatch/langwatch/commit/af324deeb3700f2745783a46e6fd5e8625ef868e))
+
+
+### Code Refactoring
+
+* **build:** single pnpm workspace + restructure into sdks/ platform/ services/ mcp/ infra/ (ADR-076) ([#6405](https://github.com/langwatch/langwatch/issues/6405)) ([2bbeb7d](https://github.com/langwatch/langwatch/commit/2bbeb7dd2e0747e81478f22c3165adb9163c9f99))
+
 ## [1.0.0](https://github.com/langwatch/langwatch/compare/mcp-server@v0.10.1...mcp-server@v1.0.0) (2026-07-24)
 
 

package/CONTRIBUTING.md

@@ -15,7 +15,7 @@ Thank you for your interest in contributing to the LangWatch MCP Server! This gu
 1. **Clone the repository and navigate to the MCP server directory:**
    ```bash
    git clone https://github.com/langwatch/langwatch.git
-   cd langwatch/mcp-server
+   cd langwatch/mcp/typescript
    ```
 
 2. **Install dependencies and build the MCP server:**

package/README.md

@@ -16,7 +16,7 @@ For Claude Code (manual) or other MCP clients (Cursor, Copilot, etc.), add an en
 - `args`: `-y`, then the package name `@langwatch/mcp-server` on a separate token
 - `env.LANGWATCH_API_KEY`: your LangWatch API key
 
-The API key is required for observability and prompt tools. Documentation tools work without it.
+In stdio mode the API key is required for observability and prompt tools, and documentation tools work without it. In HTTP mode every MCP request needs a valid key, including documentation-tool requests, because the server authenticates the request before it reaches any tool.
 
 > The config is described in prose rather than as a JSON snippet because some CLI agents (notably Gemini CLI 0.36.0 and earlier) parse `@`-prefixed runs as file paths and can crash with `ENAMETOOLONG` when a multi-line JSON snippet wraps the scoped package name in double quotes. See [#3104](https://github.com/langwatch/langwatch/issues/3104). The bash form above is safe — the package name is followed by a whitespace terminator.
 
@@ -26,6 +26,60 @@ The API key is required for observability and prompt tools. Documentation tools
 |---------|---------|-------------|
 | `LANGWATCH_API_KEY` | `--apiKey` | API key for authentication |
 | `LANGWATCH_ENDPOINT` | `--endpoint` | API endpoint (default: `https://app.langwatch.ai`) |
+| | `--http` | Serve over HTTP and SSE instead of stdio |
+| | `--port` | HTTP port (default: `3000`) |
+| `LANGWATCH_MCP_HTTP_HOST` | `--host` | HTTP listen address (default: `127.0.0.1`) |
+| `LANGWATCH_MCP_ALLOWED_ORIGINS` | `--allowedOrigin` | Browser origins allowed to call the HTTP server |
+| `LANGWATCH_MCP_TRUST_PROXY` | | Use `X-Forwarded-For` as the rate limit key (default: off) |
+
+### HTTP mode
+
+In HTTP mode each client brings its own API key in an `Authorization: Bearer <key>`
+header, on every MCP request rather than only at session start. That covers
+`/mcp`, `/sse`, and `/messages`. The key is checked against the LangWatch API
+before a session is created and re-checked on each request, so a session id by
+itself grants no access and revoking a key stops its sessions being served
+within a minute. The API key is never read from a query parameter.
+
+Because authentication happens before routing, this applies to the documentation
+tools too: unlike stdio mode, they are not reachable without a valid key.
+
+Three routes do not take the bearer. `/health` reports liveness only.
+`/.well-known/oauth-authorization-server` is the discovery document clients read
+before they hold a token. `/oauth/token` exchanges an API key, sent as
+`client_secret` in the form body, for a short-lived access token; it verifies
+that key against the LangWatch API before issuing anything, and the token it
+returns is what later MCP requests carry.
+
+The server listens on `127.0.0.1` by default, per the MCP transport guidance for
+local servers. Pass `--host 0.0.0.0` to accept connections from other machines,
+and only behind a network boundary you trust.
+
+Requests carrying a browser `Origin` header are checked against an allowlist.
+Loopback origins are always allowed; anything else has to be listed:
+
+```bash
+npx @langwatch/mcp-server --http --port 3000 \
+  --allowedOrigin https://your-app.example.com
+```
+
+#### Running behind a proxy
+
+Forwarded proxy headers resolve the external scheme that the OAuth metadata
+document advertises, so they are read by default.
+
+They do not decide the rate limit. Failed authentication is limited per client
+address, and that address comes from the socket rather than from
+`X-Forwarded-For`, so a client reaching the port directly cannot rotate a header
+to reset its own counter. Behind a real proxy every request shares the proxy's
+socket address, which means the whole proxy is limited as one client. Set
+`LANGWATCH_MCP_TRUST_PROXY=true` there to limit per real client instead, and
+only when the proxy overwrites `X-Forwarded-For` on the way in.
+
+This is defense in depth, not the security boundary. API keys are verified
+against the LangWatch API before a session is created and re-checked on every
+request; the rate limit exists to make guessing expensive, not to decide who
+gets in. A spoofable rate limit does not let anyone authenticate.
 
 ## Tools
 
@@ -71,12 +125,40 @@ The API key is required for observability and prompt tools. Documentation tools
 
 | Tool | Description |
 |------|-------------|
-| `platform_list_scenarios` | List all scenarios |
+| `platform_list_scenarios` | List all scenarios, or only the ones filed in a test suite |
 | `platform_get_scenario` | Get scenario details |
-| `platform_create_scenario` | Create a new scenario |
-| `platform_update_scenario` | Update a scenario |
+| `platform_create_scenario` | Create a new scenario, optionally filed in a test suite |
+| `platform_update_scenario` | Update a scenario, or file it in another test suite |
 | `platform_archive_scenario` | Archive a scenario |
 
+### Test suites and run plans (requires API key)
+
+A test suite is a folder of scenarios. A run plan is what you run, and its
+name identifies it: running a name that exists replaces that plan's
+configuration, running a new name creates the plan. Running a test suite is
+sugar over a run plan, and creates or joins the plan `<suite name> <target name>`.
+
+| Tool | Description |
+|------|-------------|
+| `platform_run_plan` | Run scenarios against targets, by plan name |
+| `platform_list_run_plans` | List the run plans of the project |
+| `platform_get_run_plan` | Get the full configuration of a run plan |
+| `platform_rerun_run_plan` | Run a plan again with the configuration it holds |
+| `platform_archive_run_plan` | Archive a run plan |
+| `platform_list_test_suites` | List the test suites of the project |
+| `platform_create_test_suite` | Create a test suite |
+| `platform_get_test_suite` | Get a test suite and the scenarios filed in it |
+| `platform_rename_test_suite` | Rename a test suite |
+| `platform_archive_test_suite` | Archive a test suite and the scenarios filed in it |
+| `platform_run_test_suite` | Run every scenario of a test suite against targets |
+
+### Simulation runs (requires API key)
+
+| Tool | Description |
+|------|-------------|
+| `platform_list_simulation_runs` | List simulation run results |
+| `platform_get_simulation_run` | Get one run with its conversation and verdict |
+
 ### Evaluators (requires API key)
 
 | Tool | Description |

package/dist/{archive-project-MK3673A7.js → archive-project-W3IKI7UL.js}

@@ -1,9 +1,9 @@
 import {
   archiveProject
-} from "./chunk-XY4STOBE.js";
-import "./chunk-5UWY24RP.js";
-import "./chunk-KOO5733S.js";
-import "./chunk-BJ7B4R26.js";
+} from "./chunk-G4ZAZTZW.js";
+import "./chunk-GELJ2MQR.js";
+import "./chunk-WT4PO4A3.js";
+import "./chunk-SAS5OB7F.js";
 
 // src/tools/archive-project.ts
 async function handleArchiveProject(params) {
@@ -17,4 +17,4 @@ async function handleArchiveProject(params) {
 export {
   handleArchiveProject
 };
-//# sourceMappingURL=archive-project-MK3673A7.js.map
+//# sourceMappingURL=archive-project-W3IKI7UL.js.map

package/dist/archive-run-plan-474OKHHU.js

@@ -0,0 +1,16 @@
+import {
+  archiveRunPlan
+} from "./chunk-56OGTS24.js";
+import "./chunk-GELJ2MQR.js";
+import "./chunk-WT4PO4A3.js";
+import "./chunk-SAS5OB7F.js";
+
+// src/tools/archive-run-plan.ts
+async function handleArchiveRunPlan(params) {
+  const result = await archiveRunPlan(params.id);
+  return `Run plan ${result.id} is archived. Its past runs stay readable, and the name is free for a new plan.`;
+}
+export {
+  handleArchiveRunPlan
+};
+//# sourceMappingURL=archive-run-plan-474OKHHU.js.map

package/dist/{archive-scenario-KATSXRIN.js → archive-scenario-V5UNYK26.js}

@@ -1,9 +1,9 @@
 import {
   archiveScenario
-} from "./chunk-O3LWVN67.js";
-import "./chunk-5UWY24RP.js";
-import "./chunk-KOO5733S.js";
-import "./chunk-BJ7B4R26.js";
+} from "./chunk-RVAE2MEA.js";
+import "./chunk-GELJ2MQR.js";
+import "./chunk-WT4PO4A3.js";
+import "./chunk-SAS5OB7F.js";
 
 // src/tools/archive-scenario.ts
 async function handleArchiveScenario(params) {
@@ -17,4 +17,4 @@ async function handleArchiveScenario(params) {
 export {
   handleArchiveScenario
 };
-//# sourceMappingURL=archive-scenario-KATSXRIN.js.map
+//# sourceMappingURL=archive-scenario-V5UNYK26.js.map

package/dist/archive-test-suite-O7FLDMXK.js

@@ -0,0 +1,16 @@
+import {
+  archiveTestSuite
+} from "./chunk-6DJDEXET.js";
+import "./chunk-GELJ2MQR.js";
+import "./chunk-WT4PO4A3.js";
+import "./chunk-SAS5OB7F.js";
+
+// src/tools/archive-test-suite.ts
+async function handleArchiveTestSuite(params) {
+  const result = await archiveTestSuite(params.id);
+  return `Test suite ${result.id} is archived, and the scenarios filed in it are archived with it.`;
+}
+export {
+  handleArchiveTestSuite
+};
+//# sourceMappingURL=archive-test-suite-O7FLDMXK.js.map

package/dist/{assign-prompt-tag-E3C5W6PI.js → assign-prompt-tag-Q46WRB6P.js}

@@ -1,8 +1,8 @@
 import {
   assignPromptTag
-} from "./chunk-5UWY24RP.js";
-import "./chunk-KOO5733S.js";
-import "./chunk-BJ7B4R26.js";
+} from "./chunk-GELJ2MQR.js";
+import "./chunk-WT4PO4A3.js";
+import "./chunk-SAS5OB7F.js";
 
 // src/tools/assign-prompt-tag.ts
 async function handleAssignPromptTag(params) {
@@ -17,4 +17,4 @@ async function handleAssignPromptTag(params) {
 export {
   handleAssignPromptTag
 };
-//# sourceMappingURL=assign-prompt-tag-E3C5W6PI.js.map
+//# sourceMappingURL=assign-prompt-tag-Q46WRB6P.js.map

package/dist/chunk-56OGTS24.js

@@ -0,0 +1,44 @@
+import {
+  makeRequest
+} from "./chunk-GELJ2MQR.js";
+
+// src/langwatch-api-run-plans.ts
+async function listRunPlans(params) {
+  const query = params?.includeArchived ? "?includeArchived=true" : "";
+  return makeRequest("GET", `/api/v1/run-plans${query}`);
+}
+async function getRunPlan(id) {
+  return makeRequest(
+    "GET",
+    `/api/v1/run-plans/${encodeURIComponent(id)}`
+  );
+}
+async function runRunPlan(data) {
+  return makeRequest(
+    "POST",
+    "/api/v1/run-plans/run",
+    data
+  );
+}
+async function rerunRunPlan(id, data) {
+  return makeRequest(
+    "POST",
+    `/api/v1/run-plans/${encodeURIComponent(id)}/run`,
+    data ?? {}
+  );
+}
+async function archiveRunPlan(id) {
+  return makeRequest(
+    "DELETE",
+    `/api/v1/run-plans/${encodeURIComponent(id)}`
+  );
+}
+
+export {
+  listRunPlans,
+  getRunPlan,
+  runRunPlan,
+  rerunRunPlan,
+  archiveRunPlan
+};
+//# sourceMappingURL=chunk-56OGTS24.js.map

package/dist/chunk-6DJDEXET.js

@@ -0,0 +1,63 @@
+import {
+  makeRequest
+} from "./chunk-GELJ2MQR.js";
+
+// src/langwatch-api-test-suites.ts
+async function listTestSuites() {
+  return makeRequest("GET", "/api/v1/test-suites");
+}
+async function createTestSuite(data) {
+  return makeRequest(
+    "POST",
+    "/api/v1/test-suites",
+    data
+  );
+}
+async function getTestSuite(id) {
+  return makeRequest(
+    "GET",
+    `/api/v1/test-suites/${encodeURIComponent(id)}`
+  );
+}
+async function updateTestSuite(params) {
+  const { id, ...data } = params;
+  return makeRequest(
+    "PATCH",
+    `/api/v1/test-suites/${encodeURIComponent(id)}`,
+    data
+  );
+}
+async function renameTestSuite(params) {
+  return makeRequest(
+    "PATCH",
+    `/api/v1/test-suites/${encodeURIComponent(params.id)}`,
+    { name: params.name }
+  );
+}
+async function archiveTestSuite(id) {
+  return makeRequest(
+    "DELETE",
+    `/api/v1/test-suites/${encodeURIComponent(id)}`
+  );
+}
+async function runTestSuite({
+  id,
+  ...data
+}) {
+  return makeRequest(
+    "POST",
+    `/api/v1/test-suites/${encodeURIComponent(id)}/run`,
+    data
+  );
+}
+
+export {
+  listTestSuites,
+  createTestSuite,
+  getTestSuite,
+  updateTestSuite,
+  renameTestSuite,
+  archiveTestSuite,
+  runTestSuite
+};
+//# sourceMappingURL=chunk-6DJDEXET.js.map

package/dist/chunk-7E4FZIYJ.js

@@ -0,0 +1,15 @@
+// src/tools/format-scenario.ts
+function formatScenarioFields(fields) {
+  if (!fields || Object.keys(fields).length === 0) return [];
+  return [
+    "\n## Fields",
+    ...Object.entries(fields).map(
+      ([identifier, value]) => `- ${identifier}: ${JSON.stringify(value)}`
+    )
+  ];
+}
+
+export {
+  formatScenarioFields
+};
+//# sourceMappingURL=chunk-7E4FZIYJ.js.map

package/dist/{chunk-J45SVWPR.js → chunk-AN4OUA4D.js}

@@ -1,6 +1,6 @@
 import {
   makeRequest
-} from "./chunk-5UWY24RP.js";
+} from "./chunk-GELJ2MQR.js";
 
 // src/langwatch-api-datasets.ts
 async function listDatasets(params) {
@@ -83,4 +83,4 @@ export {
   deleteDatasetRecords,
   listDatasetRecords
 };
-//# sourceMappingURL=chunk-J45SVWPR.js.map
+//# sourceMappingURL=chunk-AN4OUA4D.js.map

package/dist/chunk-CKNAH5TG.js

@@ -0,0 +1,74 @@
+// src/schemas/suite-fields.ts
+import { z } from "zod";
+var SUITE_FIELD_TYPES = ["text", "number", "boolean"];
+var suiteFieldSchema = z.object({
+  identifier: z.string().min(1).max(64).regex(
+    /^[a-z][a-z0-9_]*$/,
+    "Lowercase letters, digits and underscores, starting with a letter"
+  ).describe(
+    "The field name, as scenarios and evaluator mappings address it, for example golden_sql. Lowercase letters, digits and underscores, starting with a letter. situation, criteria, name, input and output are reserved."
+  ),
+  type: z.enum(SUITE_FIELD_TYPES).describe("The value type every scenario carries for this field.")
+});
+var suiteFieldsSchema = z.array(suiteFieldSchema).max(30).describe(
+  "The fields the test suite declares, in order. Up to 30. Every scenario filed in the suite carries one value per field, and an evaluator attached to the suite reads them through its mappings."
+);
+var SCENARIO_MAPPING_SOURCE_IDS = [
+  "conversation",
+  "scenario",
+  "trace"
+];
+var scenarioMappingSchema = z.discriminatedUnion("type", [
+  z.object({
+    type: z.literal("source"),
+    sourceId: z.enum(SCENARIO_MAPPING_SOURCE_IDS).describe(
+      "conversation, scenario or trace. See discover_schema({ category: 'scenarios' }) for the paths each one offers."
+    ),
+    path: z.array(z.string().min(1).max(256)).min(1).max(3).describe(
+      "The path inside the source. conversation: [first_user_message] | [last_agent_message] | [transcript] | [messages]. scenario: [situation] | [criteria] | [fields, <identifier>]. trace: [contexts] | [tool_calls, <toolName>, input|output]."
+    )
+  }),
+  z.object({
+    type: z.literal("value"),
+    value: z.string().max(65536).describe("A literal the input reads.")
+  })
+]).describe(
+  "Where one evaluator input reads its value: a path into the conversation, the scenario or the trace, or a literal value."
+);
+var evaluatorAttachmentSchema = z.object({
+  id: z.string().min(1).max(64).optional().describe(
+    "The attachment id, stable across edits. Leave it out on a new attachment and one is generated."
+  ),
+  evaluatorId: z.string().min(1).describe(
+    "The id of the saved evaluator to run. Read it from platform_list_evaluators or platform_get_evaluator."
+  ),
+  required: z.boolean().optional().describe(
+    "Whether a failing result fails the scenario. Defaults to true. A score-only evaluator reports and never gates, whatever this says."
+  ),
+  mappings: z.record(z.string().min(1).max(128), scenarioMappingSchema).describe(
+    "Where each evaluator input reads its value, keyed by input name. Read the inputs from platform_get_evaluator. A required input with no mapping makes the platform refuse the run until it is set."
+  )
+});
+var evaluatorAttachmentsSchema = z.array(evaluatorAttachmentSchema).max(20).describe(
+  "The evaluators that run after every scenario run, with their mappings. Up to 20. A required evaluator that fails fails the scenario; a score-only one reports beside the verdict."
+);
+var scenarioFieldValuesSchema = z.record(z.string(), z.union([z.string(), z.number(), z.boolean()])).describe(
+  "The scenario's value for each field its test suite declares, by identifier, for example { golden_sql: 'SELECT ...' }. A text field takes a string, a number field a number and a boolean field true or false. A field the suite does not declare is refused. On update, an empty object clears the values."
+);
+var newAttachmentId = () => `att_${crypto.randomUUID().replace(/-/g, "").slice(0, 21)}`;
+function toWireAttachments(attachments) {
+  return attachments.map((attachment) => ({
+    id: attachment.id ?? newAttachmentId(),
+    evaluatorId: attachment.evaluatorId,
+    required: attachment.required ?? true,
+    mappings: attachment.mappings
+  }));
+}
+
+export {
+  suiteFieldsSchema,
+  evaluatorAttachmentsSchema,
+  scenarioFieldValuesSchema,
+  toWireAttachments
+};
+//# sourceMappingURL=chunk-CKNAH5TG.js.map