@meetkai/mka1 0.54.99 → 0.54.100

package/src/funcs/guardrailsResetClusterDefaultGuardrails.ts

@@ -0,0 +1,156 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import { SDKCore } from "../core.js";
+import { matchStatusCode } from "../lib/http.js";
+import * as M from "../lib/matchers.js";
+import { compactMap } from "../lib/primitives.js";
+import { RequestOptions } from "../lib/sdks.js";
+import { extractSecurity, resolveGlobalSecurity } from "../lib/security.js";
+import { pathToFunc } from "../lib/url.js";
+import * as components from "../models/components/index.js";
+import {
+  ConnectionError,
+  InvalidRequestError,
+  RequestAbortedError,
+  RequestTimeoutError,
+  UnexpectedClientError,
+} from "../models/errors/httpclienterrors.js";
+import { ResponseValidationError } from "../models/errors/responsevalidationerror.js";
+import { SDKError } from "../models/errors/sdkerror.js";
+import { SDKValidationError } from "../models/errors/sdkvalidationerror.js";
+import { APICall, APIPromise } from "../types/async.js";
+import { Result } from "../types/fp.js";
+
+/**
+ * Reset the cluster default guardrails
+ *
+ * @remarks
+ * Delete the saved cluster default so the built-in default applies again: switched on, with prompt injection and leakage detection. To stop enforcing a cluster default, update it with enabled set to false instead.
+ *
+ * If set, this operation will use {@link Security.bearerAuth} from the global security.
+ */
+export function guardrailsResetClusterDefaultGuardrails(
+  client: SDKCore,
+  options?: RequestOptions,
+): APIPromise<
+  Result<
+    components.ClusterDefaultGuardrailsResponse,
+    | SDKError
+    | ResponseValidationError
+    | ConnectionError
+    | RequestAbortedError
+    | RequestTimeoutError
+    | InvalidRequestError
+    | UnexpectedClientError
+    | SDKValidationError
+  >
+> {
+  return new APIPromise($do(
+    client,
+    options,
+  ));
+}
+
+async function $do(
+  client: SDKCore,
+  options?: RequestOptions,
+): Promise<
+  [
+    Result<
+      components.ClusterDefaultGuardrailsResponse,
+      | SDKError
+      | ResponseValidationError
+      | ConnectionError
+      | RequestAbortedError
+      | RequestTimeoutError
+      | InvalidRequestError
+      | UnexpectedClientError
+      | SDKValidationError
+    >,
+    APICall,
+  ]
+> {
+  const path = pathToFunc("/api/v1/llm/guardrails/cluster-default")();
+
+  const headers = new Headers(compactMap({
+    Accept: "application/json",
+  }));
+
+  const secConfig = await extractSecurity(client._options.bearerAuth);
+  const securityInput = secConfig == null ? {} : { bearerAuth: secConfig };
+  const requestSecurity = resolveGlobalSecurity(securityInput, [0]);
+
+  const context = {
+    options: client._options,
+    baseURL: options?.serverURL ?? client._baseURL ?? "",
+    operationID: "resetClusterDefaultGuardrails",
+    oAuth2Scopes: null,
+
+    resolvedSecurity: requestSecurity,
+
+    securitySource: client._options.bearerAuth,
+    retryConfig: options?.retries
+      || client._options.retryConfig
+      || {
+        strategy: "backoff",
+        backoff: {
+          initialInterval: 500,
+          maxInterval: 5000,
+          exponent: 1.5,
+          maxElapsedTime: 15000,
+        },
+        retryConnectionErrors: true,
+      }
+      || { strategy: "none" },
+    retryCodes: options?.retryCodes || ["429", "500", "502", "503", "504"],
+  };
+
+  const requestRes = client._createRequest(context, {
+    security: requestSecurity,
+    method: "DELETE",
+    baseURL: options?.serverURL,
+    path: path,
+    headers: headers,
+    userAgent: client._options.userAgent,
+    timeoutMs: options?.timeoutMs || client._options.timeoutMs || -1,
+  }, options);
+  if (!requestRes.ok) {
+    return [requestRes, { status: "invalid" }];
+  }
+  const req = requestRes.value;
+
+  const doResult = await client._do(req, {
+    context,
+    isErrorStatusCode: (statusCode: number) =>
+      matchStatusCode({ status: statusCode } as Response, ["4XX", "5XX"]),
+    retryConfig: context.retryConfig,
+    retryCodes: context.retryCodes,
+  });
+  if (!doResult.ok) {
+    return [doResult, { status: "request-error", request: req }];
+  }
+  const response = doResult.value;
+
+  const [result] = await M.match<
+    components.ClusterDefaultGuardrailsResponse,
+    | SDKError
+    | ResponseValidationError
+    | ConnectionError
+    | RequestAbortedError
+    | RequestTimeoutError
+    | InvalidRequestError
+    | UnexpectedClientError
+    | SDKValidationError
+  >(
+    M.json(200, components.ClusterDefaultGuardrailsResponse$inboundSchema),
+    M.fail("4XX"),
+    M.fail("5XX"),
+  )(response, req);
+  if (!result.ok) {
+    return [result, { status: "complete", request: req, response }];
+  }
+
+  return [result, { status: "complete", request: req, response }];
+}

package/src/funcs/guardrailsTestGuardrails.ts

@@ -30,7 +30,7 @@ import { Result } from "../types/fp.js";
  * Test content against guardrails
  *
  * @remarks
- * Test a piece of content against the caller's effective guardrails (org-wide policy plus team policy) without generating an answer. Classifier guardrails call their configured model and incur inference usage; API keys additionally require write:responses and must pass the spend budget gate. Useful for debugging and validating guardrail configurations. Returns a report indicating whether the content passed and which guardrail was triggered if any.
+ * Test a piece of content against the caller's effective guardrails (cluster default, org-wide policy and team policy) without generating an answer. Classifier guardrails call their configured model and incur inference usage, so API keys additionally require write:responses and the caller must pass the spend budget gate. Cluster default classifiers are not run here (requests still run them); details.cluster_classifiers_not_tested counts them. When another cluster default rule blocks the content, the result shows only its type and rejection message, with details.cluster_default set. Useful for debugging and validating guardrail configurations. Returns a report indicating whether the content passed and which guardrail was triggered if any.
  *
  * If set, this operation will use {@link Security.bearerAuth} from the global security.
  */

package/src/funcs/guardrailsUpdateClusterDefaultGuardrails.ts

@@ -0,0 +1,177 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import { SDKCore } from "../core.js";
+import { encodeJSON } from "../lib/encodings.js";
+import { matchStatusCode } from "../lib/http.js";
+import * as M from "../lib/matchers.js";
+import { compactMap } from "../lib/primitives.js";
+import { safeParse } from "../lib/schemas.js";
+import { RequestOptions } from "../lib/sdks.js";
+import { extractSecurity, resolveGlobalSecurity } from "../lib/security.js";
+import { pathToFunc } from "../lib/url.js";
+import * as components from "../models/components/index.js";
+import {
+  ConnectionError,
+  InvalidRequestError,
+  RequestAbortedError,
+  RequestTimeoutError,
+  UnexpectedClientError,
+} from "../models/errors/httpclienterrors.js";
+import { ResponseValidationError } from "../models/errors/responsevalidationerror.js";
+import { SDKError } from "../models/errors/sdkerror.js";
+import { SDKValidationError } from "../models/errors/sdkvalidationerror.js";
+import { APICall, APIPromise } from "../types/async.js";
+import { Result } from "../types/fp.js";
+
+/**
+ * Update the cluster default guardrails
+ *
+ * @remarks
+ * Replace the default guardrails enforced on every enrolled organization, and switch them on or off for the whole cluster. Organization admins can add rules on top of the cluster default but cannot weaken or remove it. Classifier models must be active in the cluster organization's registry; their calls run and are metered as the cluster organization, so tenants need no access to the model and their budgets are not charged.
+ *
+ * If set, this operation will use {@link Security.bearerAuth} from the global security.
+ */
+export function guardrailsUpdateClusterDefaultGuardrails(
+  client: SDKCore,
+  request: components.UpdateClusterDefaultGuardrailsRequest,
+  options?: RequestOptions,
+): APIPromise<
+  Result<
+    components.ClusterDefaultGuardrailsResponse,
+    | SDKError
+    | ResponseValidationError
+    | ConnectionError
+    | RequestAbortedError
+    | RequestTimeoutError
+    | InvalidRequestError
+    | UnexpectedClientError
+    | SDKValidationError
+  >
+> {
+  return new APIPromise($do(
+    client,
+    request,
+    options,
+  ));
+}
+
+async function $do(
+  client: SDKCore,
+  request: components.UpdateClusterDefaultGuardrailsRequest,
+  options?: RequestOptions,
+): Promise<
+  [
+    Result<
+      components.ClusterDefaultGuardrailsResponse,
+      | SDKError
+      | ResponseValidationError
+      | ConnectionError
+      | RequestAbortedError
+      | RequestTimeoutError
+      | InvalidRequestError
+      | UnexpectedClientError
+      | SDKValidationError
+    >,
+    APICall,
+  ]
+> {
+  const parsed = safeParse(
+    request,
+    (value) =>
+      components.UpdateClusterDefaultGuardrailsRequest$outboundSchema.parse(
+        value,
+      ),
+    "Input validation failed",
+  );
+  if (!parsed.ok) {
+    return [parsed, { status: "invalid" }];
+  }
+  const payload = parsed.value;
+  const body = encodeJSON("body", payload, { explode: true });
+
+  const path = pathToFunc("/api/v1/llm/guardrails/cluster-default")();
+
+  const headers = new Headers(compactMap({
+    "Content-Type": "application/json",
+    Accept: "application/json",
+  }));
+
+  const secConfig = await extractSecurity(client._options.bearerAuth);
+  const securityInput = secConfig == null ? {} : { bearerAuth: secConfig };
+  const requestSecurity = resolveGlobalSecurity(securityInput, [0]);
+
+  const context = {
+    options: client._options,
+    baseURL: options?.serverURL ?? client._baseURL ?? "",
+    operationID: "updateClusterDefaultGuardrails",
+    oAuth2Scopes: null,
+
+    resolvedSecurity: requestSecurity,
+
+    securitySource: client._options.bearerAuth,
+    retryConfig: options?.retries
+      || client._options.retryConfig
+      || {
+        strategy: "backoff",
+        backoff: {
+          initialInterval: 500,
+          maxInterval: 5000,
+          exponent: 1.5,
+          maxElapsedTime: 15000,
+        },
+        retryConnectionErrors: true,
+      }
+      || { strategy: "none" },
+    retryCodes: options?.retryCodes || ["429", "500", "502", "503", "504"],
+  };
+
+  const requestRes = client._createRequest(context, {
+    security: requestSecurity,
+    method: "PUT",
+    baseURL: options?.serverURL,
+    path: path,
+    headers: headers,
+    body: body,
+    userAgent: client._options.userAgent,
+    timeoutMs: options?.timeoutMs || client._options.timeoutMs || -1,
+  }, options);
+  if (!requestRes.ok) {
+    return [requestRes, { status: "invalid" }];
+  }
+  const req = requestRes.value;
+
+  const doResult = await client._do(req, {
+    context,
+    isErrorStatusCode: (statusCode: number) =>
+      matchStatusCode({ status: statusCode } as Response, ["4XX", "5XX"]),
+    retryConfig: context.retryConfig,
+    retryCodes: context.retryCodes,
+  });
+  if (!doResult.ok) {
+    return [doResult, { status: "request-error", request: req }];
+  }
+  const response = doResult.value;
+
+  const [result] = await M.match<
+    components.ClusterDefaultGuardrailsResponse,
+    | SDKError
+    | ResponseValidationError
+    | ConnectionError
+    | RequestAbortedError
+    | RequestTimeoutError
+    | InvalidRequestError
+    | UnexpectedClientError
+    | SDKValidationError
+  >(
+    M.json(200, components.ClusterDefaultGuardrailsResponse$inboundSchema),
+    M.fail("4XX"),
+    M.fail("5XX"),
+  )(response, req);
+  if (!result.ok) {
+    return [result, { status: "complete", request: req, response }];
+  }
+
+  return [result, { status: "complete", request: req, response }];
+}

package/src/funcs/guardrailsUpdateClusterDefaultGuardrailsOrg.ts

@@ -0,0 +1,190 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import { SDKCore } from "../core.js";
+import { encodeJSON, encodeSimple } from "../lib/encodings.js";
+import { matchStatusCode } from "../lib/http.js";
+import * as M from "../lib/matchers.js";
+import { compactMap } from "../lib/primitives.js";
+import { safeParse } from "../lib/schemas.js";
+import { RequestOptions } from "../lib/sdks.js";
+import { extractSecurity, resolveGlobalSecurity } from "../lib/security.js";
+import { pathToFunc } from "../lib/url.js";
+import * as components from "../models/components/index.js";
+import {
+  ConnectionError,
+  InvalidRequestError,
+  RequestAbortedError,
+  RequestTimeoutError,
+  UnexpectedClientError,
+} from "../models/errors/httpclienterrors.js";
+import { ResponseValidationError } from "../models/errors/responsevalidationerror.js";
+import { SDKError } from "../models/errors/sdkerror.js";
+import { SDKValidationError } from "../models/errors/sdkvalidationerror.js";
+import * as operations from "../models/operations/index.js";
+import { APICall, APIPromise } from "../types/async.js";
+import { Result } from "../types/fp.js";
+
+/**
+ * Enroll an organization in the cluster default
+ *
+ * @remarks
+ * Enroll an organization in the cluster default guardrails, or remove it. Idempotent. Enrolled organizations are checked against the cluster default whenever the cluster switch is on.
+ *
+ * If set, this operation will use {@link Security.bearerAuth} from the global security.
+ */
+export function guardrailsUpdateClusterDefaultGuardrailsOrg(
+  client: SDKCore,
+  request: operations.UpdateClusterDefaultGuardrailsOrgRequest,
+  options?: RequestOptions,
+): APIPromise<
+  Result<
+    components.ClusterDefaultGuardrailsOrgResponse,
+    | SDKError
+    | ResponseValidationError
+    | ConnectionError
+    | RequestAbortedError
+    | RequestTimeoutError
+    | InvalidRequestError
+    | UnexpectedClientError
+    | SDKValidationError
+  >
+> {
+  return new APIPromise($do(
+    client,
+    request,
+    options,
+  ));
+}
+
+async function $do(
+  client: SDKCore,
+  request: operations.UpdateClusterDefaultGuardrailsOrgRequest,
+  options?: RequestOptions,
+): Promise<
+  [
+    Result<
+      components.ClusterDefaultGuardrailsOrgResponse,
+      | SDKError
+      | ResponseValidationError
+      | ConnectionError
+      | RequestAbortedError
+      | RequestTimeoutError
+      | InvalidRequestError
+      | UnexpectedClientError
+      | SDKValidationError
+    >,
+    APICall,
+  ]
+> {
+  const parsed = safeParse(
+    request,
+    (value) =>
+      operations.UpdateClusterDefaultGuardrailsOrgRequest$outboundSchema.parse(
+        value,
+      ),
+    "Input validation failed",
+  );
+  if (!parsed.ok) {
+    return [parsed, { status: "invalid" }];
+  }
+  const payload = parsed.value;
+  const body = encodeJSON(
+    "body",
+    payload.UpdateClusterDefaultGuardrailsOrgRequest,
+    { explode: true },
+  );
+
+  const pathParams = {
+    org_id: encodeSimple("org_id", payload.org_id, {
+      explode: false,
+      charEncoding: "percent",
+    }),
+  };
+  const path = pathToFunc(
+    "/api/v1/llm/guardrails/cluster-default/orgs/{org_id}",
+  )(pathParams);
+
+  const headers = new Headers(compactMap({
+    "Content-Type": "application/json",
+    Accept: "application/json",
+  }));
+
+  const secConfig = await extractSecurity(client._options.bearerAuth);
+  const securityInput = secConfig == null ? {} : { bearerAuth: secConfig };
+  const requestSecurity = resolveGlobalSecurity(securityInput, [0]);
+
+  const context = {
+    options: client._options,
+    baseURL: options?.serverURL ?? client._baseURL ?? "",
+    operationID: "updateClusterDefaultGuardrailsOrg",
+    oAuth2Scopes: null,
+
+    resolvedSecurity: requestSecurity,
+
+    securitySource: client._options.bearerAuth,
+    retryConfig: options?.retries
+      || client._options.retryConfig
+      || {
+        strategy: "backoff",
+        backoff: {
+          initialInterval: 500,
+          maxInterval: 5000,
+          exponent: 1.5,
+          maxElapsedTime: 15000,
+        },
+        retryConnectionErrors: true,
+      }
+      || { strategy: "none" },
+    retryCodes: options?.retryCodes || ["429", "500", "502", "503", "504"],
+  };
+
+  const requestRes = client._createRequest(context, {
+    security: requestSecurity,
+    method: "PUT",
+    baseURL: options?.serverURL,
+    path: path,
+    headers: headers,
+    body: body,
+    userAgent: client._options.userAgent,
+    timeoutMs: options?.timeoutMs || client._options.timeoutMs || -1,
+  }, options);
+  if (!requestRes.ok) {
+    return [requestRes, { status: "invalid" }];
+  }
+  const req = requestRes.value;
+
+  const doResult = await client._do(req, {
+    context,
+    isErrorStatusCode: (statusCode: number) =>
+      matchStatusCode({ status: statusCode } as Response, ["4XX", "5XX"]),
+    retryConfig: context.retryConfig,
+    retryCodes: context.retryCodes,
+  });
+  if (!doResult.ok) {
+    return [doResult, { status: "request-error", request: req }];
+  }
+  const response = doResult.value;
+
+  const [result] = await M.match<
+    components.ClusterDefaultGuardrailsOrgResponse,
+    | SDKError
+    | ResponseValidationError
+    | ConnectionError
+    | RequestAbortedError
+    | RequestTimeoutError
+    | InvalidRequestError
+    | UnexpectedClientError
+    | SDKValidationError
+  >(
+    M.json(200, components.ClusterDefaultGuardrailsOrgResponse$inboundSchema),
+    M.fail("4XX"),
+    M.fail("5XX"),
+  )(response, req);
+  if (!result.ok) {
+    return [result, { status: "complete", request: req, response }];
+  }
+
+  return [result, { status: "complete", request: req, response }];
+}

package/src/lib/config.ts

@@ -65,7 +65,7 @@ export function serverURLFromOptions(options: SDKOptions): URL | null {
 export const SDK_METADATA = {
   language: "typescript",
   openapiDocVersion: "1.1.0",
-  sdkVersion: "0.54.99",
+  sdkVersion: "0.54.100",
   genVersion: "2.948.4",
-  userAgent: "speakeasy-sdk/typescript 0.54.99 2.948.4 1.1.0 @meetkai/mka1",
+  userAgent: "speakeasy-sdk/typescript 0.54.100 2.948.4 1.1.0 @meetkai/mka1",
 } as const;

package/src/mcp-server/mcp-server.ts

@@ -19,7 +19,7 @@ const routes = buildRouteMap({
 export const app = buildApplication(routes, {
   name: "mcp",
   versionInfo: {
-    currentVersion: "0.54.99",
+    currentVersion: "0.54.100",
   },
 });
 

package/src/mcp-server/server.ts

@@ -204,9 +204,14 @@ import { tool$flagsSetEnvironmentState } from "./tools/flagsSetEnvironmentState.
 import { tool$flagsUnarchive } from "./tools/flagsUnarchive.js";
 import { tool$flagsUpdate } from "./tools/flagsUpdate.js";
 import { tool$guardrailsDeleteGuardrails } from "./tools/guardrailsDeleteGuardrails.js";
+import { tool$guardrailsGetClusterDefaultGuardrails } from "./tools/guardrailsGetClusterDefaultGuardrails.js";
+import { tool$guardrailsGetClusterDefaultGuardrailsOrg } from "./tools/guardrailsGetClusterDefaultGuardrailsOrg.js";
 import { tool$guardrailsGetGuardrails } from "./tools/guardrailsGetGuardrails.js";
 import { tool$guardrailsListGuardrailsPolicies } from "./tools/guardrailsListGuardrailsPolicies.js";
+import { tool$guardrailsResetClusterDefaultGuardrails } from "./tools/guardrailsResetClusterDefaultGuardrails.js";
 import { tool$guardrailsTestGuardrails } from "./tools/guardrailsTestGuardrails.js";
+import { tool$guardrailsUpdateClusterDefaultGuardrails } from "./tools/guardrailsUpdateClusterDefaultGuardrails.js";
+import { tool$guardrailsUpdateClusterDefaultGuardrailsOrg } from "./tools/guardrailsUpdateClusterDefaultGuardrailsOrg.js";
 import { tool$guardrailsUpdateGuardrails } from "./tools/guardrailsUpdateGuardrails.js";
 import { tool$llmBatchesCancel } from "./tools/llmBatchesCancel.js";
 import { tool$llmBatchesCreate } from "./tools/llmBatchesCreate.js";
@@ -494,7 +499,7 @@ export function createMCPServer(deps: {
 }) {
   const server = new McpServer({
     name: "SDK",
-    version: "0.54.99",
+    version: "0.54.100",
   });
 
   const client = new SDKCore({
@@ -529,6 +534,11 @@ export function createMCPServer(deps: {
   tool(tool$guardrailsDeleteGuardrails);
   tool(tool$guardrailsListGuardrailsPolicies);
   tool(tool$guardrailsTestGuardrails);
+  tool(tool$guardrailsGetClusterDefaultGuardrails);
+  tool(tool$guardrailsUpdateClusterDefaultGuardrails);
+  tool(tool$guardrailsResetClusterDefaultGuardrails);
+  tool(tool$guardrailsGetClusterDefaultGuardrailsOrg);
+  tool(tool$guardrailsUpdateClusterDefaultGuardrailsOrg);
   tool(tool$sandboxCreate);
   tool(tool$sandboxList);
   tool(tool$sandboxGet);

package/src/mcp-server/tools/guardrailsGetClusterDefaultGuardrails.ts

@@ -0,0 +1,30 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import { guardrailsGetClusterDefaultGuardrails } from "../../funcs/guardrailsGetClusterDefaultGuardrails.js";
+import { formatResult, ToolDefinition } from "../tools.js";
+
+export const tool$guardrailsGetClusterDefaultGuardrails: ToolDefinition = {
+  name: "guardrails-get-cluster-default-guardrails",
+  description: `Get the cluster default guardrails
+
+Cluster operator view of the default guardrails enforced beneath the org-wide and team policies of every enrolled organization. Until an operator saves one, the built-in default applies: switched on, with prompt injection and leakage detection.`,
+  tool: async (client, ctx) => {
+    const [result, apiCall] = await guardrailsGetClusterDefaultGuardrails(
+      client,
+      { fetchOptions: { signal: ctx.signal } },
+    ).$inspect();
+
+    if (!result.ok) {
+      return {
+        content: [{ type: "text", text: result.error.message }],
+        isError: true,
+      };
+    }
+
+    const value = result.value;
+
+    return formatResult(value, apiCall);
+  },
+};

package/src/mcp-server/tools/guardrailsGetClusterDefaultGuardrailsOrg.ts

@@ -0,0 +1,39 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import { guardrailsGetClusterDefaultGuardrailsOrg } from "../../funcs/guardrailsGetClusterDefaultGuardrailsOrg.js";
+import * as operations from "../../models/operations/index.js";
+import { formatResult, ToolDefinition } from "../tools.js";
+
+const args = {
+  request: operations.GetClusterDefaultGuardrailsOrgRequest$inboundSchema,
+};
+
+export const tool$guardrailsGetClusterDefaultGuardrailsOrg: ToolDefinition<
+  typeof args
+> = {
+  name: "guardrails-get-cluster-default-guardrails-org",
+  description: `Get an organization's cluster default enrollment
+
+Whether an organization is enrolled in the cluster default guardrails, and whether they are enforced on it now. Organizations created before the cluster default existed are not enrolled until a cluster admin enrolls them.`,
+  args,
+  tool: async (client, args, ctx) => {
+    const [result, apiCall] = await guardrailsGetClusterDefaultGuardrailsOrg(
+      client,
+      args.request,
+      { fetchOptions: { signal: ctx.signal } },
+    ).$inspect();
+
+    if (!result.ok) {
+      return {
+        content: [{ type: "text", text: result.error.message }],
+        isError: true,
+      };
+    }
+
+    const value = result.value;
+
+    return formatResult(value, apiCall);
+  },
+};

package/src/mcp-server/tools/guardrailsGetGuardrails.ts

@@ -14,7 +14,7 @@ export const tool$guardrailsGetGuardrails: ToolDefinition<typeof args> = {
   name: "guardrails-get-guardrails",
   description: `Get effective guardrails
 
-Retrieve the guardrails that apply to the caller's requests: the org-wide policy plus the caller's team policy, combined. Both are enforced when both exist. Policies are managed by org admins via PUT /guardrails.`,
+Retrieve the guardrails that apply to the caller's requests. guardrails holds the org-wide policy followed by the caller's team policy; cluster_default lists the cluster default rules enforced beneath them, without their configuration. All are enforced. Policies are managed by org admins via PUT /guardrails; the cluster default is managed by cluster admins.`,
   args,
   tool: async (client, args, ctx) => {
     const [result, apiCall] = await guardrailsGetGuardrails(

package/src/mcp-server/tools/guardrailsListGuardrailsPolicies.ts

@@ -16,7 +16,7 @@ export const tool$guardrailsListGuardrailsPolicies: ToolDefinition<
   name: "guardrails-list-guardrails-policies",
   description: `List guardrails policies
 
-List the stored guardrails policies visible to the caller: org admins see every policy in their org (the org-wide policy has team_id null, plus each team's additional policy); other callers see the org-wide policy and their own team's policy. Unlike GET /guardrails, rows are returned per scope so a team can see which rules it owns versus which the org mandates.`,
+List the stored guardrails policies visible to the caller: org admins see every policy in their org (the org-wide policy has team_id null, plus each team's additional policy); other callers see the org-wide policy and their own team's policy. Unlike GET /guardrails, rows are returned per scope so a team can see which rules it owns versus which the org mandates. cluster_default lists the cluster default rules enforced beneath them, without their configuration, which only cluster admins can see or change.`,
   args,
   tool: async (client, args, ctx) => {
     const [result, apiCall] = await guardrailsListGuardrailsPolicies(