@launchdarkly/mcp-server 0.6.1 → 0.7.0

package/dist/esm/sdk/auditlog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auditlog.js","sourceRoot":"","sources":["../../../src/sdk/auditlog.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,SAAS,EAAkB,MAAM,gBAAgB,CAAC;AAG3D,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,MAAM,OAAO,QAAS,SAAQ,SAAS;IACrC;;;;;;;OAOG;IACH,KAAK,CAAC,WAAW,CACf,OAA6C,EAC7C,OAAwB;QAExB,OAAO,WAAW,CAAC,mBAAmB,CACpC,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/esm/sdk/sdk.d.ts

@@ -1,9 +1,12 @@
 import { ClientSDK } from "../lib/sdks.js";
 import { AiConfigs } from "./aiconfigs.js";
+import { AuditLog } from "./auditlog.js";
 import { CodeReferences } from "./codereferences.js";
 import { Environments } from "./environments.js";
 import { FeatureFlags } from "./featureflags.js";
 export declare class LaunchDarkly extends ClientSDK {
+    private _auditLog?;
+    get auditLog(): AuditLog;
     private _codeReferences?;
     get codeReferences(): CodeReferences;
     private _featureFlags?;

package/dist/esm/sdk/sdk.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sdk.d.ts","sourceRoot":"","sources":["../../../src/sdk/sdk.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,qBAAa,YAAa,SAAQ,SAAS;IACzC,OAAO,CAAC,eAAe,CAAC,CAAiB;IACzC,IAAI,cAAc,IAAI,cAAc,CAEnC;IAED,OAAO,CAAC,aAAa,CAAC,CAAe;IACrC,IAAI,YAAY,IAAI,YAAY,CAE/B;IAED,OAAO,CAAC,aAAa,CAAC,CAAe;IACrC,IAAI,YAAY,IAAI,YAAY,CAE/B;IAED,OAAO,CAAC,UAAU,CAAC,CAAY;IAC/B,IAAI,SAAS,IAAI,SAAS,CAEzB;CACF"}
+{"version":3,"file":"sdk.d.ts","sourceRoot":"","sources":["../../../src/sdk/sdk.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,qBAAa,YAAa,SAAQ,SAAS;IACzC,OAAO,CAAC,SAAS,CAAC,CAAW;IAC7B,IAAI,QAAQ,IAAI,QAAQ,CAEvB;IAED,OAAO,CAAC,eAAe,CAAC,CAAiB;IACzC,IAAI,cAAc,IAAI,cAAc,CAEnC;IAED,OAAO,CAAC,aAAa,CAAC,CAAe;IACrC,IAAI,YAAY,IAAI,YAAY,CAE/B;IAED,OAAO,CAAC,aAAa,CAAC,CAAe;IACrC,IAAI,YAAY,IAAI,YAAY,CAE/B;IAED,OAAO,CAAC,UAAU,CAAC,CAAY;IAC/B,IAAI,SAAS,IAAI,SAAS,CAEzB;CACF"}

package/dist/esm/sdk/sdk.js

@@ -3,10 +3,14 @@
  */
 import { ClientSDK } from "../lib/sdks.js";
 import { AiConfigs } from "./aiconfigs.js";
+import { AuditLog } from "./auditlog.js";
 import { CodeReferences } from "./codereferences.js";
 import { Environments } from "./environments.js";
 import { FeatureFlags } from "./featureflags.js";
 export class LaunchDarkly extends ClientSDK {
+    get auditLog() {
+        return (this._auditLog ?? (this._auditLog = new AuditLog(this._options)));
+    }
     get codeReferences() {
         return (this._codeReferences ?? (this._codeReferences = new CodeReferences(this._options)));
     }

package/dist/esm/sdk/sdk.js.map

@@ -1 +1 @@
-{"version":3,"file":"sdk.js","sourceRoot":"","sources":["../../../src/sdk/sdk.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,OAAO,YAAa,SAAQ,SAAS;IAEzC,IAAI,cAAc;QAChB,OAAO,CAAC,IAAI,CAAC,eAAe,KAApB,IAAI,CAAC,eAAe,GAAK,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAC,CAAC;IACtE,CAAC;IAGD,IAAI,YAAY;QACd,OAAO,CAAC,IAAI,CAAC,aAAa,KAAlB,IAAI,CAAC,aAAa,GAAK,IAAI,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAC,CAAC;IAClE,CAAC;IAGD,IAAI,YAAY;QACd,OAAO,CAAC,IAAI,CAAC,aAAa,KAAlB,IAAI,CAAC,aAAa,GAAK,IAAI,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAC,CAAC;IAClE,CAAC;IAGD,IAAI,SAAS;QACX,OAAO,CAAC,IAAI,CAAC,UAAU,KAAf,IAAI,CAAC,UAAU,GAAK,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAC,CAAC;IAC5D,CAAC;CACF"}
+{"version":3,"file":"sdk.js","sourceRoot":"","sources":["../../../src/sdk/sdk.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,OAAO,YAAa,SAAQ,SAAS;IAEzC,IAAI,QAAQ;QACV,OAAO,CAAC,IAAI,CAAC,SAAS,KAAd,IAAI,CAAC,SAAS,GAAK,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAC,CAAC;IAC1D,CAAC;IAGD,IAAI,cAAc;QAChB,OAAO,CAAC,IAAI,CAAC,eAAe,KAApB,IAAI,CAAC,eAAe,GAAK,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAC,CAAC;IACtE,CAAC;IAGD,IAAI,YAAY;QACd,OAAO,CAAC,IAAI,CAAC,aAAa,KAAlB,IAAI,CAAC,aAAa,GAAK,IAAI,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAC,CAAC;IAClE,CAAC;IAGD,IAAI,YAAY;QACd,OAAO,CAAC,IAAI,CAAC,aAAa,KAAlB,IAAI,CAAC,aAAa,GAAK,IAAI,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAC,CAAC;IAClE,CAAC;IAGD,IAAI,SAAS;QACX,OAAO,CAAC,IAAI,CAAC,UAAU,KAAf,IAAI,CAAC,UAAU,GAAK,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAC,CAAC;IAC5D,CAAC;CACF"}

package/examples/{codeReferencesListRepositories.example.ts → auditLogListEntries.example.ts}

@@ -8,7 +8,7 @@ dotenv.config();
  * Example usage of the @launchdarkly/mcp-server SDK
  *
  * To run this example from the examples directory:
- * npm run build && npx tsx codeReferencesListRepositories.example.ts
+ * npm run build && npx tsx auditLogListEntries.example.ts
  */
 
 import { LaunchDarkly } from "@launchdarkly/mcp-server";
@@ -18,7 +18,7 @@ const launchDarkly = new LaunchDarkly({
 });
 
 async function main() {
-  const result = await launchDarkly.codeReferences.listRepositories({});
+  const result = await launchDarkly.auditLog.listEntries({});
 
   console.log(result);
 }

package/jsr.json

@@ -2,7 +2,7 @@
 
 {
   "name": "@launchdarkly/mcp-server",
-  "version": "0.6.1",
+  "version": "0.7.0",
   "exports": {
     ".": "./src/index.ts",    
     "./models/errors": "./src/models/errors/index.ts",    

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@launchdarkly/mcp-server",
-  "version": "0.6.1",
+  "version": "0.7.0",
   "author": "LaunchDarkly",
   "keywords": [
     "feature-flags",
@@ -38,6 +38,7 @@
     "lint": "eslint --cache --max-warnings=0 src",
     "build:mcp": "bun src/mcp-server/build.mts",
     "build": "npm run build:mcp && tshy",
+    "test:sse-security": "node --test --test-force-exit test/sse-security.test.mjs",
     "prepublishOnly": "npm run build"
   },
   "peerDependencies": {},

package/src/funcs/auditLogListEntries.ts

@@ -0,0 +1,192 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import { LaunchDarklyCore } from "../core.js";
+import { encodeFormQuery } from "../lib/encodings.js";
+import * as M from "../lib/matchers.js";
+import { compactMap } from "../lib/primitives.js";
+import { safeParse } from "../lib/schemas.js";
+import { RequestOptions } from "../lib/sdks.js";
+import { extractSecurity, resolveGlobalSecurity } from "../lib/security.js";
+import { pathToFunc } from "../lib/url.js";
+import * as components from "../models/components/index.js";
+import {
+  ConnectionError,
+  InvalidRequestError,
+  RequestAbortedError,
+  RequestTimeoutError,
+  UnexpectedClientError,
+} from "../models/errors/httpclienterrors.js";
+import * as errors from "../models/errors/index.js";
+import { LaunchDarklyError } from "../models/errors/launchdarklyerror.js";
+import { ResponseValidationError } from "../models/errors/responsevalidationerror.js";
+import { SDKValidationError } from "../models/errors/sdkvalidationerror.js";
+import * as operations from "../models/operations/index.js";
+import { APICall, APIPromise } from "../types/async.js";
+import { Result } from "../types/fp.js";
+
+/**
+ * List audit log entries
+ *
+ * @remarks
+ * Get a list of all audit log entries. The query parameters let you restrict the results that return by date ranges, resource specifiers, or a full-text search query.
+ *
+ * LaunchDarkly uses a resource specifier syntax to name resources or collections of resources. To learn more, read [About the resource specifier syntax](https://launchdarkly.com/docs/home/account/role-resources#about-the-resource-specifier-syntax).
+ */
+export function auditLogListEntries(
+  client: LaunchDarklyCore,
+  request: operations.GetAuditLogEntriesRequest,
+  options?: RequestOptions,
+): APIPromise<
+  Result<
+    components.AuditLogEntryListingRepCollection,
+    | errors.InvalidRequestErrorRep
+    | errors.UnauthorizedErrorRep
+    | errors.ForbiddenErrorRep
+    | errors.RateLimitedErrorRep
+    | LaunchDarklyError
+    | ResponseValidationError
+    | ConnectionError
+    | RequestAbortedError
+    | RequestTimeoutError
+    | InvalidRequestError
+    | UnexpectedClientError
+    | SDKValidationError
+  >
+> {
+  return new APIPromise($do(
+    client,
+    request,
+    options,
+  ));
+}
+
+async function $do(
+  client: LaunchDarklyCore,
+  request: operations.GetAuditLogEntriesRequest,
+  options?: RequestOptions,
+): Promise<
+  [
+    Result<
+      components.AuditLogEntryListingRepCollection,
+      | errors.InvalidRequestErrorRep
+      | errors.UnauthorizedErrorRep
+      | errors.ForbiddenErrorRep
+      | errors.RateLimitedErrorRep
+      | LaunchDarklyError
+      | ResponseValidationError
+      | ConnectionError
+      | RequestAbortedError
+      | RequestTimeoutError
+      | InvalidRequestError
+      | UnexpectedClientError
+      | SDKValidationError
+    >,
+    APICall,
+  ]
+> {
+  const parsed = safeParse(
+    request,
+    (value) => operations.GetAuditLogEntriesRequest$outboundSchema.parse(value),
+    "Input validation failed",
+  );
+  if (!parsed.ok) {
+    return [parsed, { status: "invalid" }];
+  }
+  const payload = parsed.value;
+  const body = null;
+
+  const path = pathToFunc("/api/v2/auditlog")();
+
+  const query = encodeFormQuery({
+    "after": payload.after,
+    "before": payload.before,
+    "limit": payload.limit,
+    "q": payload.q,
+    "spec": payload.spec,
+  });
+
+  const headers = new Headers(compactMap({
+    Accept: "application/json",
+  }));
+
+  const secConfig = await extractSecurity(client._options.apiKey);
+  const securityInput = secConfig == null ? {} : { apiKey: secConfig };
+  const requestSecurity = resolveGlobalSecurity(securityInput);
+
+  const context = {
+    options: client._options,
+    baseURL: options?.serverURL ?? client._baseURL ?? "",
+    operationID: "getAuditLogEntries",
+    oAuth2Scopes: null,
+
+    resolvedSecurity: requestSecurity,
+
+    securitySource: client._options.apiKey,
+    retryConfig: options?.retries
+      || client._options.retryConfig
+      || { strategy: "none" },
+    retryCodes: options?.retryCodes || ["429", "500", "502", "503", "504"],
+  };
+
+  const requestRes = client._createRequest(context, {
+    security: requestSecurity,
+    method: "GET",
+    baseURL: options?.serverURL,
+    path: path,
+    headers: headers,
+    query: query,
+    body: body,
+    userAgent: client._options.userAgent,
+    timeoutMs: options?.timeoutMs || client._options.timeoutMs || -1,
+  }, options);
+  if (!requestRes.ok) {
+    return [requestRes, { status: "invalid" }];
+  }
+  const req = requestRes.value;
+
+  const doResult = await client._do(req, {
+    context,
+    errorCodes: ["400", "401", "403", "429", "4XX", "5XX"],
+    retryConfig: context.retryConfig,
+    retryCodes: context.retryCodes,
+  });
+  if (!doResult.ok) {
+    return [doResult, { status: "request-error", request: req }];
+  }
+  const response = doResult.value;
+
+  const responseFields = {
+    HttpMeta: { Response: response, Request: req },
+  };
+
+  const [result] = await M.match<
+    components.AuditLogEntryListingRepCollection,
+    | errors.InvalidRequestErrorRep
+    | errors.UnauthorizedErrorRep
+    | errors.ForbiddenErrorRep
+    | errors.RateLimitedErrorRep
+    | LaunchDarklyError
+    | ResponseValidationError
+    | ConnectionError
+    | RequestAbortedError
+    | RequestTimeoutError
+    | InvalidRequestError
+    | UnexpectedClientError
+    | SDKValidationError
+  >(
+    M.json(200, components.AuditLogEntryListingRepCollection$inboundSchema),
+    M.jsonErr(400, errors.InvalidRequestErrorRep$inboundSchema),
+    M.jsonErr(401, errors.UnauthorizedErrorRep$inboundSchema),
+    M.jsonErr(403, errors.ForbiddenErrorRep$inboundSchema),
+    M.jsonErr(429, errors.RateLimitedErrorRep$inboundSchema),
+    M.fail("4XX"),
+    M.fail("5XX"),
+  )(response, req, { extraFields: responseFields });
+  if (!result.ok) {
+    return [result, { status: "complete", request: req, response }];
+  }
+
+  return [result, { status: "complete", request: req, response }];
+}

package/src/lib/config.ts

@@ -69,8 +69,8 @@ export function serverURLFromOptions(options: SDKOptions): URL | null {
 export const SDK_METADATA = {
   language: "typescript",
   openapiDocVersion: "2.0",
-  sdkVersion: "0.6.1",
+  sdkVersion: "0.7.0",
   genVersion: "2.845.15",
   userAgent:
-    "speakeasy-sdk/typescript 0.6.1 2.845.15 2.0 @launchdarkly/mcp-server",
+    "speakeasy-sdk/typescript 0.7.0 2.845.15 2.0 @launchdarkly/mcp-server",
 } as const;

package/src/mcp-server/cli/start/command.ts

@@ -27,6 +27,20 @@ export const startCommand = buildCommand({
         parse: (val: string) =>
           z.coerce.number().int().gte(0).lt(65536).parse(val),
       },
+      host: {
+        kind: "parsed",
+        brief:
+          "The host to listen on when the SSE transport is enabled. Non-loopback hosts require --auth-token",
+        default: "127.0.0.1",
+        parse: (value) => z.string().nonempty().parse(value),
+      },
+      "auth-token": {
+        kind: "parsed",
+        brief:
+          "Bearer token that SSE clients must send in the Authorization header",
+        optional: true,
+        parse: (value) => z.string().min(16).parse(value),
+      },
       tool: {
         kind: "parsed",
         brief: "Specify tools to mount on the server",

package/src/mcp-server/cli/start/impl.ts

@@ -4,6 +4,7 @@
 
 import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { localhostHostValidation } from "@modelcontextprotocol/sdk/server/middleware/hostHeaderValidation.js";
 import express from "express";
 import { SDKOptions } from "../../../lib/config.js";
 import { LocalContext } from "../../cli.js";
@@ -13,10 +14,17 @@ import {
 } from "../../console-logger.js";
 import { MCPScope } from "../../scopes.js";
 import { createMCPServer } from "../../server.js";
+import {
+  assertSafeSSEBind,
+  isLoopbackHost,
+  requireBearerToken,
+} from "./sse-security.js";
 
 interface StartCommandFlags {
   readonly transport: "stdio" | "sse";
   readonly port: number;
+  readonly host: string;
+  readonly "auth-token"?: string | undefined;
   readonly tool?: string[];
   readonly scope?: MCPScope[];
   readonly "api-key"?: string | undefined;
@@ -66,37 +74,78 @@ async function startStdio(flags: StartCommandFlags) {
 
 async function startSSE(flags: StartCommandFlags) {
   const logger = createConsoleLogger(flags["log-level"]);
+  const host = flags.host;
+  const authToken = flags["auth-token"];
+  assertSafeSSEBind(host, authToken);
+
   const app = express();
-  const mcpServer = createMCPServer({
-    logger,
-    allowedTools: flags.tool,
-    scopes: flags.scope,
-    ...{ apiKey: flags["api-key"] ?? "" },
-    serverURL: flags["server-url"],
-    serverIdx: flags["server-index"],
-  });
-  let transport: SSEServerTransport | undefined;
+  if (isLoopbackHost(host)) {
+    app.use(localhostHostValidation());
+  }
+  if (authToken) {
+    app.use(requireBearerToken(authToken));
+  }
+
+  const sessions = new Map<
+    string,
+    { transport: SSEServerTransport; server: ReturnType<typeof createMCPServer> }
+  >();
   const controller = new AbortController();
 
   app.get("/sse", async (_req, res) => {
-    transport = new SSEServerTransport("/message", res);
+    const server = createMCPServer({
+      logger,
+      allowedTools: flags.tool,
+      scopes: flags.scope,
+      ...{ apiKey: flags["api-key"] ?? "" },
+      serverURL: flags["server-url"],
+      serverIdx: flags["server-index"],
+    });
+    const transport = new SSEServerTransport("/message", res);
+    sessions.set(transport.sessionId, { transport, server });
 
-    await mcpServer.connect(transport);
+    res.on("close", () => {
+      sessions.delete(transport.sessionId);
+      void server.close();
+    });
 
-    mcpServer.server.onclose = async () => {
-      res.end();
-    };
+    try {
+      await server.connect(transport);
+    } catch (err) {
+      logger.error("Failed to open SSE session", {
+        error: err instanceof Error ? err.message : String(err),
+      });
+      sessions.delete(transport.sessionId);
+      void server.close();
+      if (!res.headersSent) {
+        res.status(500).send("Internal Server Error");
+      }
+    }
   });
 
   app.post("/message", async (req, res) => {
-    if (!transport) {
-      throw new Error("Server transport not initialized");
+    const sessionId = typeof req.query["sessionId"] === "string"
+      ? req.query["sessionId"]
+      : "";
+    const session = sessions.get(sessionId);
+    if (!session) {
+      res.status(404).send("Unknown session");
+      return;
     }
 
-    await transport.handlePostMessage(req, res);
+    try {
+      await session.transport.handlePostMessage(req, res);
+    } catch (err) {
+      logger.error("Failed to handle SSE message", {
+        error: err instanceof Error ? err.message : String(err),
+      });
+      if (!res.headersSent) {
+        res.status(500).send("Internal Server Error");
+      }
+    }
   });
 
-  const httpServer = app.listen(flags.port, "0.0.0.0", () => {
+  const httpServer = app.listen(flags.port, host, () => {
     const ha = httpServer.address();
     const host = typeof ha === "string" ? ha : `${ha?.address}:${ha?.port}`;
     logger.info("MCP HTTP server started", { host });
@@ -110,9 +159,9 @@ async function startSSE(flags: StartCommandFlags) {
     }
     closing = true;
 
-    logger.info("Shutting down MCP server");
+    logger.info("Shutting down MCP servers");
 
-    await mcpServer.close();
+    await Promise.all([...sessions.values()].map(({ server }) => server.close()));
 
     logger.info("Shutting down HTTP server");
 

package/src/mcp-server/cli/start/sse-security.ts

@@ -0,0 +1,31 @@
+import type { RequestHandler } from "express";
+import { timingSafeEqual } from "node:crypto";
+
+export function isLoopbackHost(host: string): boolean {
+  return host === "127.0.0.1" || host === "localhost" || host === "::1";
+}
+
+export function assertSafeSSEBind(
+  host: string,
+  authToken: string | undefined,
+): void {
+  if (!authToken && !isLoopbackHost(host)) {
+    throw new Error(
+      `--auth-token is required when the SSE transport listens on a non-loopback host (${host})`,
+    );
+  }
+}
+
+export function requireBearerToken(token: string): RequestHandler {
+  const expected = Buffer.from(`Bearer ${token}`);
+  return (req, res, next) => {
+    const actual = Buffer.from(req.headers.authorization ?? "");
+    if (
+      actual.length !== expected.length || !timingSafeEqual(actual, expected)
+    ) {
+      res.status(401).send("Unauthorized");
+      return;
+    }
+    next();
+  };
+}

package/src/mcp-server/mcp-server.ts

@@ -19,7 +19,7 @@ const routes = buildRouteMap({
 export const app = buildApplication(routes, {
   name: "mcp",
   versionInfo: {
-    currentVersion: "0.6.1",
+    currentVersion: "0.7.0",
   },
 });
 

package/src/mcp-server/server.ts

@@ -24,6 +24,7 @@ import { tool$aiConfigsList } from "./tools/aiConfigsList.js";
 import { tool$aiConfigsUpdate } from "./tools/aiConfigsUpdate.js";
 import { tool$aiConfigsUpdateTargeting } from "./tools/aiConfigsUpdateTargeting.js";
 import { tool$aiConfigsUpdateVariation } from "./tools/aiConfigsUpdateVariation.js";
+import { tool$auditLogListEntries } from "./tools/auditLogListEntries.js";
 import { tool$codeReferencesListRepositories } from "./tools/codeReferencesListRepositories.js";
 import { tool$environmentsListByProject } from "./tools/environmentsListByProject.js";
 import { tool$featureFlagsCreate } from "./tools/featureFlagsCreate.js";
@@ -43,7 +44,7 @@ export function createMCPServer(deps: {
 }) {
   const server = new McpServer({
     name: "LaunchDarkly",
-    version: "0.6.1",
+    version: "0.7.0",
   });
 
   const client = new LaunchDarklyCore({
@@ -73,6 +74,7 @@ export function createMCPServer(deps: {
   const register = { tool, resource, resourceTemplate, prompt };
   void register; // suppress unused warnings
 
+  tool(tool$auditLogListEntries);
   tool(tool$codeReferencesListRepositories);
   tool(tool$featureFlagsGetStatus);
   tool(tool$featureFlagsList);

package/src/mcp-server/tools/auditLogListEntries.ts

@@ -0,0 +1,38 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import { auditLogListEntries } from "../../funcs/auditLogListEntries.js";
+import * as operations from "../../models/operations/index.js";
+import { formatResult, ToolDefinition } from "../tools.js";
+
+const args = {
+  request: operations.GetAuditLogEntriesRequest$inboundSchema,
+};
+
+export const tool$auditLogListEntries: ToolDefinition<typeof args> = {
+  name: "get-audit-log-entries",
+  description:
+    `Fetches audit log entries for a LaunchDarkly account. Use the \`spec\` parameter with format \`proj/<projectKey>:env/<envKey>:flag/<flagKey>\` to query a specific flag's change history (use \`env/*\` for all environments). The \`before\` and \`after\` parameters accept Unix epoch timestamps in milliseconds for date-range filtering. Returns at most 20 entries per call, ordered newest-first.
+`,
+  scopes: ["read"],
+  args,
+  tool: async (client, args, ctx) => {
+    const [result, apiCall] = await auditLogListEntries(
+      client,
+      args.request,
+      { fetchOptions: { signal: ctx.signal } },
+    ).$inspect();
+
+    if (!result.ok) {
+      return {
+        content: [{ type: "text", text: result.error.message }],
+        isError: true,
+      };
+    }
+
+    const value = result.value;
+
+    return formatResult(value, apiCall);
+  },
+};