@launchdarkly/mcp-server 0.7.0 → 0.7.2

package/src/funcs/metricsPatch.ts

@@ -0,0 +1,199 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import { LaunchDarklyCore } from "../core.js";
+import { encodeJSON, encodeSimple } from "../lib/encodings.js";
+import * as M from "../lib/matchers.js";
+import { compactMap } from "../lib/primitives.js";
+import { safeParse } from "../lib/schemas.js";
+import { RequestOptions } from "../lib/sdks.js";
+import { extractSecurity, resolveGlobalSecurity } from "../lib/security.js";
+import { pathToFunc } from "../lib/url.js";
+import * as components from "../models/components/index.js";
+import {
+  ConnectionError,
+  InvalidRequestError,
+  RequestAbortedError,
+  RequestTimeoutError,
+  UnexpectedClientError,
+} from "../models/errors/httpclienterrors.js";
+import * as errors from "../models/errors/index.js";
+import { LaunchDarklyError } from "../models/errors/launchdarklyerror.js";
+import { ResponseValidationError } from "../models/errors/responsevalidationerror.js";
+import { SDKValidationError } from "../models/errors/sdkvalidationerror.js";
+import * as operations from "../models/operations/index.js";
+import { APICall, APIPromise } from "../types/async.js";
+import { Result } from "../types/fp.js";
+
+/**
+ * Update metric
+ *
+ * @remarks
+ * Patch a metric by key. Updating a metric uses a [JSON patch](https://datatracker.ietf.org/doc/html/rfc6902) representation of the desired changes. To learn more, read [Updates](https://launchdarkly.com/docs/api#updates).
+ */
+export function metricsPatch(
+  client: LaunchDarklyCore,
+  request: operations.PatchMetricRequest,
+  options?: RequestOptions,
+): APIPromise<
+  Result<
+    components.MetricRep,
+    | errors.InvalidRequestErrorRep
+    | errors.UnauthorizedErrorRep
+    | errors.NotFoundErrorRep
+    | errors.StatusConflictErrorRep
+    | errors.RateLimitedErrorRep
+    | LaunchDarklyError
+    | ResponseValidationError
+    | ConnectionError
+    | RequestAbortedError
+    | RequestTimeoutError
+    | InvalidRequestError
+    | UnexpectedClientError
+    | SDKValidationError
+  >
+> {
+  return new APIPromise($do(
+    client,
+    request,
+    options,
+  ));
+}
+
+async function $do(
+  client: LaunchDarklyCore,
+  request: operations.PatchMetricRequest,
+  options?: RequestOptions,
+): Promise<
+  [
+    Result<
+      components.MetricRep,
+      | errors.InvalidRequestErrorRep
+      | errors.UnauthorizedErrorRep
+      | errors.NotFoundErrorRep
+      | errors.StatusConflictErrorRep
+      | errors.RateLimitedErrorRep
+      | LaunchDarklyError
+      | ResponseValidationError
+      | ConnectionError
+      | RequestAbortedError
+      | RequestTimeoutError
+      | InvalidRequestError
+      | UnexpectedClientError
+      | SDKValidationError
+    >,
+    APICall,
+  ]
+> {
+  const parsed = safeParse(
+    request,
+    (value) => operations.PatchMetricRequest$outboundSchema.parse(value),
+    "Input validation failed",
+  );
+  if (!parsed.ok) {
+    return [parsed, { status: "invalid" }];
+  }
+  const payload = parsed.value;
+  const body = encodeJSON("body", payload.RequestBody, { explode: true });
+
+  const pathParams = {
+    metricKey: encodeSimple("metricKey", payload.metricKey, {
+      explode: false,
+      charEncoding: "percent",
+    }),
+    projectKey: encodeSimple("projectKey", payload.projectKey, {
+      explode: false,
+      charEncoding: "percent",
+    }),
+  };
+
+  const path = pathToFunc("/api/v2/metrics/{projectKey}/{metricKey}")(
+    pathParams,
+  );
+
+  const headers = new Headers(compactMap({
+    "Content-Type": "application/json",
+    Accept: "application/json",
+  }));
+
+  const secConfig = await extractSecurity(client._options.apiKey);
+  const securityInput = secConfig == null ? {} : { apiKey: secConfig };
+  const requestSecurity = resolveGlobalSecurity(securityInput);
+
+  const context = {
+    options: client._options,
+    baseURL: options?.serverURL ?? client._baseURL ?? "",
+    operationID: "patchMetric",
+    oAuth2Scopes: null,
+
+    resolvedSecurity: requestSecurity,
+
+    securitySource: client._options.apiKey,
+    retryConfig: options?.retries
+      || client._options.retryConfig
+      || { strategy: "none" },
+    retryCodes: options?.retryCodes || ["429", "500", "502", "503", "504"],
+  };
+
+  const requestRes = client._createRequest(context, {
+    security: requestSecurity,
+    method: "PATCH",
+    baseURL: options?.serverURL,
+    path: path,
+    headers: headers,
+    body: body,
+    userAgent: client._options.userAgent,
+    timeoutMs: options?.timeoutMs || client._options.timeoutMs || -1,
+  }, options);
+  if (!requestRes.ok) {
+    return [requestRes, { status: "invalid" }];
+  }
+  const req = requestRes.value;
+
+  const doResult = await client._do(req, {
+    context,
+    errorCodes: ["400", "401", "404", "409", "429", "4XX", "5XX"],
+    retryConfig: context.retryConfig,
+    retryCodes: context.retryCodes,
+  });
+  if (!doResult.ok) {
+    return [doResult, { status: "request-error", request: req }];
+  }
+  const response = doResult.value;
+
+  const responseFields = {
+    HttpMeta: { Response: response, Request: req },
+  };
+
+  const [result] = await M.match<
+    components.MetricRep,
+    | errors.InvalidRequestErrorRep
+    | errors.UnauthorizedErrorRep
+    | errors.NotFoundErrorRep
+    | errors.StatusConflictErrorRep
+    | errors.RateLimitedErrorRep
+    | LaunchDarklyError
+    | ResponseValidationError
+    | ConnectionError
+    | RequestAbortedError
+    | RequestTimeoutError
+    | InvalidRequestError
+    | UnexpectedClientError
+    | SDKValidationError
+  >(
+    M.json(200, components.MetricRep$inboundSchema),
+    M.jsonErr(400, errors.InvalidRequestErrorRep$inboundSchema),
+    M.jsonErr(401, errors.UnauthorizedErrorRep$inboundSchema),
+    M.jsonErr(404, errors.NotFoundErrorRep$inboundSchema),
+    M.jsonErr(409, errors.StatusConflictErrorRep$inboundSchema),
+    M.jsonErr(429, errors.RateLimitedErrorRep$inboundSchema),
+    M.fail("4XX"),
+    M.fail("5XX"),
+  )(response, req, { extraFields: responseFields });
+  if (!result.ok) {
+    return [result, { status: "complete", request: req, response }];
+  }
+
+  return [result, { status: "complete", request: req, response }];
+}

package/src/lib/config.ts

@@ -69,8 +69,8 @@ export function serverURLFromOptions(options: SDKOptions): URL | null {
 export const SDK_METADATA = {
   language: "typescript",
   openapiDocVersion: "2.0",
-  sdkVersion: "0.7.0",
+  sdkVersion: "0.7.2",
   genVersion: "2.845.15",
   userAgent:
-    "speakeasy-sdk/typescript 0.7.0 2.845.15 2.0 @launchdarkly/mcp-server",
+    "speakeasy-sdk/typescript 0.7.2 2.845.15 2.0 @launchdarkly/mcp-server",
 } as const;

package/src/mcp-server/cli/start/impl.ts

@@ -19,6 +19,10 @@ import {
   isLoopbackHost,
   requireBearerToken,
 } from "./sse-security.js";
+import {
+  installTlsBlocklist,
+  unpatchedRuntimeWarning,
+} from "./tls-blocklist.js";
 
 interface StartCommandFlags {
   readonly transport: "stdio" | "sse";
@@ -35,6 +39,13 @@ interface StartCommandFlags {
 }
 
 export async function main(this: LocalContext, flags: StartCommandFlags) {
+  // INC-289: block the compromised eMudhra intermediates before any request.
+  installTlsBlocklist();
+  const runtimeWarning = unpatchedRuntimeWarning();
+  if (runtimeWarning) {
+    process.stderr.write(runtimeWarning);
+  }
+
   flags.env?.forEach(([key, value]) => {
     process.env[key] = value;
   });

package/src/mcp-server/cli/start/tls-blocklist.ts

@@ -0,0 +1,252 @@
+import { createHash, X509Certificate } from "node:crypto";
+import tls from "node:tls";
+
+/*
+ * INC-289: rejects TLS chains that go through the compromised eMudhra
+ * intermediates (https://emudhra.we-have-a-problem.com/). Go 1.26.10, Node.js
+ * 22.23.4 / 24.22.1 / 26.12.1 and Bun (unreleased, oven-sh/bun#46300) block
+ * the same keys natively. This check covers runtimes that predate those fixes.
+ * It is installed only by the `mcp start` CLI, never for library consumers.
+ */
+
+/**
+ * SHA-256 of the DER SubjectPublicKeyInfo of each compromised intermediate.
+ * Identical to Node.js's kBlockedSPKIs (nodejs/node#66871) and Go's fix
+ * (CVE-2026-111943). Each key was issued twice, under emSign Root TLS/CS CA -
+ * G3 and under Sectigo's AAA Certificate Services, so hashing the key rather
+ * than the certificate covers both.
+ */
+export const BLOCKED_SPKI_SHA256: ReadonlySet<string> = new Set([
+  "43bffa19d6ef651451f6841e019931e96f6f2eaeff28ab4b6f1ce4576de2717b",
+  "49dd353dc2b919a3770645117d0e60c16115e7d1bc259eefe734b00ea434fe5f",
+  "5c0660a2b164910d8ff589c18e14552e9e0ec237dcefe2cb736d41a4811f81a0",
+  "63ecefee431d49523bc1136c4e72d0206a477086caf606cd5cf025686c109cf8",
+  "92c063d67e8f14db71d288e11266ffdaf69cbf115f7bab14f3bc2f68d25e0e30",
+  "e0254c7fcdc265e2f0f8a428dabb75ab4ae039b4872d62f5ee57f0877d5a8a41",
+  "ebed6475c2c2d80fcb199f3fe8dd6e6b3ce60b77eb15d4e42c3dec0c6f5b5105",
+  "ec4ffa1ad0ac88081314b7aaffef6a91f97cd57291bb5ba686c5415f5eb4f6b6",
+]);
+
+/**
+ * Common names of the compromised intermediates. Every one of them has
+ * pathlen:0, so any leaf signed with one of their keys must name the
+ * intermediate as its issuer. Bun's fetch only exposes the leaf to
+ * checkServerIdentity, so the issuer name is what blocks these chains there.
+ */
+const BLOCKED_ISSUER_CN = /^em (dv|ov|ev) (tls|cs) ca - g3[bc]$/;
+
+/**
+ * Node.js releases that block these keys natively, by major version. Lines
+ * newer than the highest entry are treated as patched; any other line is
+ * treated as unpatched.
+ */
+const FIXED_NODE_VERSIONS: Readonly<
+  Record<number, readonly [number, number, number]>
+> = {
+  22: [22, 23, 4],
+  24: [24, 22, 1],
+  26: [26, 12, 1],
+};
+
+/**
+ * First Bun release that blocks these keys natively. Set this once one ships
+ * (the fix is oven-sh/bun#46300). While it is undefined, every Bun version
+ * gets the warning.
+ */
+const FIXED_BUN_VERSION: string | undefined = undefined;
+
+export const BLOCKED_CERT_ERROR_CODE = "ERR_TLS_CERT_BLOCKED";
+
+/** The subset of tls.PeerCertificate this check reads. */
+export interface PeerCertificateLike {
+  raw?: Uint8Array | undefined;
+  fingerprint256?: string | undefined;
+  issuer?: { CN?: string | string[] | undefined } | undefined;
+  issuerCertificate?: PeerCertificateLike | undefined;
+}
+
+type CheckServerIdentity = (
+  hostname: string,
+  cert: tls.PeerCertificate,
+) => Error | undefined;
+
+// Captured before installTlsBlocklist() replaces tls.checkServerIdentity.
+const defaultCheckServerIdentity: CheckServerIdentity = tls.checkServerIdentity;
+
+function normalizeName(value: string): string {
+  return value.normalize("NFKC").toLowerCase().replace(/\s+/g, " ").trim();
+}
+
+export function isBlockedIssuerName(
+  cn: string | string[] | undefined,
+): boolean {
+  const names = Array.isArray(cn) ? cn : cn === undefined ? [] : [cn];
+  return names.some((name) => BLOCKED_ISSUER_CN.test(normalizeName(name)));
+}
+
+export function spkiSha256(raw: Uint8Array): string {
+  const spki = new X509Certificate(raw).publicKey.export({
+    type: "spki",
+    format: "der",
+  });
+  return createHash("sha256").update(spki).digest("hex");
+}
+
+/**
+ * Walks the peer chain (the full chain on Node.js, the leaf only on Bun) and
+ * returns a description of the first blocked certificate, if any.
+ */
+export function findBlockedCertificate(
+  cert: PeerCertificateLike,
+): string | undefined {
+  const seen = new Set<PeerCertificateLike>();
+  for (
+    let current: PeerCertificateLike | undefined = cert;
+    current && !seen.has(current);
+    current = current.issuerCertificate
+  ) {
+    seen.add(current);
+    if (isBlockedIssuerName(current.issuer?.CN)) {
+      return `certificate issued by "${String(current.issuer?.CN)}"`;
+    }
+    if (current.raw && current.raw.length > 0) {
+      const hash = spkiSha256(current.raw);
+      if (BLOCKED_SPKI_SHA256.has(hash)) {
+        return `certificate with blocked public key sha256/${hash}`;
+      }
+    }
+  }
+  return undefined;
+}
+
+/**
+ * A tls checkServerIdentity replacement: rejects blocked chains, then runs
+ * the runtime's normal hostname verification.
+ */
+export function checkServerIdentity(
+  hostname: string,
+  cert: PeerCertificateLike,
+): Error | undefined {
+  let blocked: string | undefined;
+  try {
+    blocked = findBlockedCertificate(cert);
+  } catch (err) {
+    blocked = `certificate that could not be parsed (${String(err)})`;
+  }
+  if (blocked) {
+    return Object.assign(
+      new Error(
+        `Refusing TLS connection to ${hostname}: the chain contains a ${blocked}, ` +
+          "which belongs to a compromised eMudhra intermediate CA.",
+      ),
+      { code: BLOCKED_CERT_ERROR_CODE },
+    );
+  }
+  return defaultCheckServerIdentity(
+    hostname,
+    cert as unknown as tls.PeerCertificate,
+  );
+}
+
+let installed = false;
+
+/**
+ * Installs the blocklist for this process. On Node.js, global fetch (undici)
+ * and node:https read tls.checkServerIdentity when they connect. Bun's fetch
+ * ignores it, so on Bun global fetch is wrapped to pass the check through
+ * Bun's `tls` fetch option.
+ */
+export function installTlsBlocklist(): void {
+  if (installed) return;
+  installed = true;
+
+  if (isBun()) {
+    const originalFetch = globalThis.fetch;
+    const wrapped = (
+      input: Parameters<typeof fetch>[0],
+      init?: Parameters<typeof fetch>[1],
+    ): ReturnType<typeof fetch> => {
+      const tlsOptions = (
+        init as
+          { tls?: { checkServerIdentity?: CheckServerIdentity } } | undefined
+      )?.tls;
+      const callerCheck = tlsOptions?.checkServerIdentity;
+      const combined: CheckServerIdentity = callerCheck
+        ? (hostname, cert) =>
+            checkServerIdentity(hostname, cert) ?? callerCheck(hostname, cert)
+        : (checkServerIdentity as unknown as CheckServerIdentity);
+      return originalFetch(input, {
+        ...init,
+        tls: { ...tlsOptions, checkServerIdentity: combined },
+      } as RequestInit);
+    };
+    globalThis.fetch = Object.assign(wrapped, originalFetch);
+  } else {
+    tls.checkServerIdentity =
+      checkServerIdentity as unknown as CheckServerIdentity;
+  }
+}
+
+function isBun(): boolean {
+  return typeof (globalThis as { Bun?: unknown }).Bun !== "undefined";
+}
+
+function parseVersion(version: string): [number, number, number] | undefined {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)/.exec(version);
+  if (!match) return undefined;
+  return [Number(match[1]), Number(match[2]), Number(match[3])];
+}
+
+function compareVersions(
+  a: readonly [number, number, number],
+  b: readonly [number, number, number],
+): number {
+  return a[0] - b[0] || a[1] - b[1] || a[2] - b[2];
+}
+
+export function isNodeVersionPatched(version: string): boolean {
+  const parsed = parseVersion(version);
+  if (!parsed) return false;
+  const fixed = FIXED_NODE_VERSIONS[parsed[0]];
+  if (fixed) return compareVersions(parsed, fixed) >= 0;
+  const newestLine = Math.max(...Object.keys(FIXED_NODE_VERSIONS).map(Number));
+  return parsed[0] > newestLine;
+}
+
+export function isBunVersionPatched(version: string): boolean {
+  if (FIXED_BUN_VERSION === undefined) return false;
+  const parsed = parseVersion(version);
+  const fixed = parseVersion(FIXED_BUN_VERSION);
+  return !!parsed && !!fixed && compareVersions(parsed, fixed) >= 0;
+}
+
+/**
+ * Returns a warning when the current runtime does not block the compromised
+ * eMudhra intermediates natively, or undefined when it does.
+ */
+export function unpatchedRuntimeWarning(
+  versions: {
+    node?: string | undefined;
+    bun?: string | undefined;
+  } = process.versions,
+): string | undefined {
+  let runtime: string;
+  let upgrade: string;
+  if (versions.bun !== undefined) {
+    if (isBunVersionPatched(versions.bun)) return undefined;
+    runtime = `Bun ${versions.bun}`;
+    upgrade =
+      "run the server with Node.js 22.23.4, 24.22.1, 26.12.1 or later, or use the Docker image";
+  } else if (versions.node !== undefined) {
+    if (isNodeVersionPatched(versions.node)) return undefined;
+    runtime = `Node.js ${versions.node}`;
+    upgrade = "upgrade to Node.js 22.23.4, 24.22.1, 26.12.1 or later";
+  } else {
+    return undefined;
+  }
+  return (
+    `WARNING: ${runtime} does not block the compromised eMudhra intermediate CAs. ` +
+    "The LaunchDarkly MCP server rejects them for its own requests, but the runtime does not; " +
+    `${upgrade}. See https://github.com/launchdarkly/mcp-server#runtime-requirements\n`
+  );
+}

package/src/mcp-server/mcp-server.ts

@@ -19,7 +19,7 @@ const routes = buildRouteMap({
 export const app = buildApplication(routes, {
   name: "mcp",
   versionInfo: {
-    currentVersion: "0.7.0",
+    currentVersion: "0.7.2",
   },
 });
 

package/src/mcp-server/server.ts

@@ -27,12 +27,22 @@ import { tool$aiConfigsUpdateVariation } from "./tools/aiConfigsUpdateVariation.
 import { tool$auditLogListEntries } from "./tools/auditLogListEntries.js";
 import { tool$codeReferencesListRepositories } from "./tools/codeReferencesListRepositories.js";
 import { tool$environmentsListByProject } from "./tools/environmentsListByProject.js";
+import { tool$experimentsCreate } from "./tools/experimentsCreate.js";
+import { tool$experimentsCreateIteration } from "./tools/experimentsCreateIteration.js";
+import { tool$experimentsGet } from "./tools/experimentsGet.js";
+import { tool$experimentsGetExperimentsAnyEnv } from "./tools/experimentsGetExperimentsAnyEnv.js";
+import { tool$experimentsList } from "./tools/experimentsList.js";
+import { tool$experimentsPatch } from "./tools/experimentsPatch.js";
 import { tool$featureFlagsCreate } from "./tools/featureFlagsCreate.js";
 import { tool$featureFlagsDelete } from "./tools/featureFlagsDelete.js";
 import { tool$featureFlagsGet } from "./tools/featureFlagsGet.js";
 import { tool$featureFlagsGetStatus } from "./tools/featureFlagsGetStatus.js";
 import { tool$featureFlagsList } from "./tools/featureFlagsList.js";
 import { tool$featureFlagsPatch } from "./tools/featureFlagsPatch.js";
+import { tool$metricsCreate } from "./tools/metricsCreate.js";
+import { tool$metricsGet } from "./tools/metricsGet.js";
+import { tool$metricsList } from "./tools/metricsList.js";
+import { tool$metricsPatch } from "./tools/metricsPatch.js";
 
 export function createMCPServer(deps: {
   logger: ConsoleLogger;
@@ -44,7 +54,7 @@ export function createMCPServer(deps: {
 }) {
   const server = new McpServer({
     name: "LaunchDarkly",
-    version: "0.7.0",
+    version: "0.7.2",
   });
 
   const client = new LaunchDarklyCore({
@@ -82,7 +92,17 @@ export function createMCPServer(deps: {
   tool(tool$featureFlagsGet);
   tool(tool$featureFlagsPatch);
   tool(tool$featureFlagsDelete);
+  tool(tool$metricsList);
+  tool(tool$metricsCreate);
+  tool(tool$metricsGet);
+  tool(tool$metricsPatch);
   tool(tool$environmentsListByProject);
+  tool(tool$experimentsList);
+  tool(tool$experimentsCreate);
+  tool(tool$experimentsGet);
+  tool(tool$experimentsPatch);
+  tool(tool$experimentsCreateIteration);
+  tool(tool$experimentsGetExperimentsAnyEnv);
   tool(tool$aiConfigsGetTargeting);
   tool(tool$aiConfigsUpdateTargeting);
   tool(tool$aiConfigsList);

package/src/mcp-server/tools/experimentsCreate.ts

@@ -0,0 +1,37 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import { experimentsCreate } from "../../funcs/experimentsCreate.js";
+import * as operations from "../../models/operations/index.js";
+import { formatResult, ToolDefinition } from "../tools.js";
+
+const args = {
+  request: operations.CreateExperimentRequest$inboundSchema,
+};
+
+export const tool$experimentsCreate: ToolDefinition<typeof args> = {
+  name: "create-experiment",
+  description:
+    `Creates an experiment in a project environment, with an initial iteration that sets the hypothesis, flag, treatments, and metrics.`,
+  scopes: ["write"],
+  args,
+  tool: async (client, args, ctx) => {
+    const [result, apiCall] = await experimentsCreate(
+      client,
+      args.request,
+      { fetchOptions: { signal: ctx.signal } },
+    ).$inspect();
+
+    if (!result.ok) {
+      return {
+        content: [{ type: "text", text: result.error.message }],
+        isError: true,
+      };
+    }
+
+    const value = result.value;
+
+    return formatResult(value, apiCall);
+  },
+};

package/src/mcp-server/tools/experimentsCreateIteration.ts

@@ -0,0 +1,37 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import { experimentsCreateIteration } from "../../funcs/experimentsCreateIteration.js";
+import * as operations from "../../models/operations/index.js";
+import { formatResult, ToolDefinition } from "../tools.js";
+
+const args = {
+  request: operations.CreateIterationRequest$inboundSchema,
+};
+
+export const tool$experimentsCreateIteration: ToolDefinition<typeof args> = {
+  name: "create-experiment-iteration",
+  description:
+    `Creates a new iteration of an experiment. Start it afterwards with update-experiment.`,
+  scopes: ["write"],
+  args,
+  tool: async (client, args, ctx) => {
+    const [result, apiCall] = await experimentsCreateIteration(
+      client,
+      args.request,
+      { fetchOptions: { signal: ctx.signal } },
+    ).$inspect();
+
+    if (!result.ok) {
+      return {
+        content: [{ type: "text", text: result.error.message }],
+        isError: true,
+      };
+    }
+
+    const value = result.value;
+
+    return formatResult(value, apiCall);
+  },
+};

package/src/mcp-server/tools/experimentsGet.ts

@@ -0,0 +1,37 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import { experimentsGet } from "../../funcs/experimentsGet.js";
+import * as operations from "../../models/operations/index.js";
+import { formatResult, ToolDefinition } from "../tools.js";
+
+const args = {
+  request: operations.GetExperimentRequest$inboundSchema,
+};
+
+export const tool$experimentsGet: ToolDefinition<typeof args> = {
+  name: "get-experiment",
+  description:
+    `Fetches one experiment, including its current and past iterations, treatments, and metrics.`,
+  scopes: ["read"],
+  args,
+  tool: async (client, args, ctx) => {
+    const [result, apiCall] = await experimentsGet(
+      client,
+      args.request,
+      { fetchOptions: { signal: ctx.signal } },
+    ).$inspect();
+
+    if (!result.ok) {
+      return {
+        content: [{ type: "text", text: result.error.message }],
+        isError: true,
+      };
+    }
+
+    const value = result.value;
+
+    return formatResult(value, apiCall);
+  },
+};