@mokoconsulting/mcp-mokosuite 1.0.0

package/.mokogit/workflows/gitleaks.yml

@@ -0,0 +1,94 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: MokoGIT.Workflow
+# INGROUP: MokoCLI.Security
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# PATH: /.mokogit/workflows/gitleaks.yml
+# VERSION: 01.00.00
+# BRIEF: Secret scanning — detect leaked credentials, API keys, and tokens
+#
+# +========================================================================+
+# |                        SECRET SCANNING                                 |
+# +========================================================================+
+# |                                                                        |
+# |  Scans commits for leaked secrets using Gitleaks.                      |
+# |                                                                        |
+# |  - PR scan: only new commits in the PR                                 |
+# |  - Scheduled: full repo scan weekly                                    |
+# |  - Alerts via ntfy on findings                                         |
+# |                                                                        |
+# +========================================================================+
+
+name: "Universal: Secret Scanning"
+
+on:
+  schedule:
+    - cron: '0 5 * * 1'  # Weekly Monday 05:00 UTC
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  NTFY_URL: ${{ vars.NTFY_URL || 'https://ntfy.mokoconsulting.tech' }}
+  NTFY_TOPIC: ${{ vars.NTFY_TOPIC || 'mokogit-security' }}
+  NTFY_TOKEN: ${{ secrets.NTFY_TOKEN }}
+
+jobs:
+  gitleaks:
+    name: Gitleaks Secret Scan
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Install Gitleaks
+        run: |
+          GITLEAKS_VERSION="8.21.2"
+          curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
+            | tar -xz -C /usr/local/bin gitleaks
+          gitleaks version
+
+      - name: Scan for secrets
+        id: scan
+        run: |
+          echo "### Secret Scanning" >> $GITHUB_STEP_SUMMARY
+          ARGS="--source . --verbose --report-format json --report-path /tmp/gitleaks-report.json"
+
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            # Scan only PR commits
+            ARGS="$ARGS --log-opts=${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}"
+            echo "Scanning PR commits only" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "Full repository scan" >> $GITHUB_STEP_SUMMARY
+          fi
+
+          if gitleaks detect $ARGS 2>&1; then
+            echo "result=clean" >> "$GITHUB_OUTPUT"
+            echo "**No secrets detected.**" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "result=found" >> "$GITHUB_OUTPUT"
+            FINDINGS=$(jq length /tmp/gitleaks-report.json 2>/dev/null || echo "unknown")
+            echo "**${FINDINGS} potential secret(s) detected.**" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "Review the findings and rotate any exposed credentials immediately." >> $GITHUB_STEP_SUMMARY
+            exit 1
+          fi
+
+      - name: Notify on findings
+        if: failure() && steps.scan.outputs.result == 'found'
+        run: |
+          REPO="${{ github.event.repository.name }}"
+          curl -sS \
+            -H "Title: ${REPO} — secrets detected in code" \
+            -H "Tags: rotating_light,key" \
+            -H "Priority: urgent" \
+            -d "Gitleaks found potential secrets. Review and rotate credentials immediately." \
+            -H "Authorization: Bearer ${NTFY_TOKEN}" \
+            "${NTFY_URL}/${NTFY_TOPIC}" || true

package/.mokogit/workflows/issue-branch.yml

@@ -0,0 +1,81 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: MokoGIT.Workflow
+# INGROUP: MokoCLI.Automation
+# VERSION: 01.00.00
+# BRIEF: Auto-create feature branch when an issue is opened
+
+name: "Universal: Issue Branch"
+
+on:
+  issues:
+    types: [opened]
+
+permissions:
+  contents: write
+  issues: write
+
+env:
+  MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
+
+jobs:
+  create-branch:
+    name: Create feature branch
+    runs-on: ubuntu-latest
+    steps:
+      - name: Create branch and comment
+        # SECURITY: never interpolate github.event.* into a run: script — the
+        # Actions engine splices the raw value into the shell source (command
+        # injection via a crafted issue title). Pass everything through env so
+        # the values arrive as ordinary shell variables that are not re-parsed.
+        env:
+          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
+          REPO: ${{ github.repository }}
+          ISSUE_NUM: ${{ github.event.issue.number }}
+          ISSUE_TITLE: ${{ github.event.issue.title }}
+        run: |
+          TOKEN="${MOKOGIT_TOKEN}"
+          API="${MOKOGIT_URL}/api/v1/repos/${REPO}"
+
+          # Build slug from title: lowercase, replace non-alnum with dash, trim.
+          # printf (not echo) so a title beginning with "-" is not read as flags.
+          SLUG=$(printf '%s' "${ISSUE_TITLE}" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9]/-/g' | sed 's/--*/-/g' | sed 's/^-//;s/-$//' | cut -c1-40)
+          BRANCH="feature/${ISSUE_NUM}-${SLUG}"
+
+          # Check dev branch exists
+          DEV_EXISTS=$(curl -sf -o /dev/null -w '%{http_code}' \
+            -H "Authorization: token ${TOKEN}" \
+            "${API}/branches/dev" 2>/dev/null || echo "000")
+
+          if [ "${DEV_EXISTS}" != "200" ]; then
+            echo "No dev branch -- skipping"
+            exit 0
+          fi
+
+          # Create branch from dev
+          HTTP=$(curl -sf -o /dev/null -w '%{http_code}' -X POST \
+            -H "Authorization: token ${TOKEN}" \
+            -H "Content-Type: application/json" \
+            "${API}/branches" \
+            -d "{\"new_branch_name\":\"${BRANCH}\",\"old_branch_name\":\"dev\"}" 2>/dev/null || echo "000")
+
+          if [ "${HTTP}" = "201" ]; then
+            echo "Created branch: ${BRANCH}"
+
+            # Comment on issue with branch link
+            REPO_URL="${MOKOGIT_URL}/${REPO}"
+            BODY="Branch created: [\`${BRANCH}\`](${REPO_URL}/src/branch/${BRANCH})\n\n\`\`\`bash\ngit fetch origin\ngit checkout ${BRANCH}\n\`\`\`"
+
+            curl -sf -X POST \
+              -H "Authorization: token ${TOKEN}" \
+              -H "Content-Type: application/json" \
+              "${API}/issues/${ISSUE_NUM}/comments" \
+              -d "{\"body\":\"${BODY}\"}" > /dev/null 2>&1
+
+            echo "Commented on issue #${ISSUE_NUM}"
+          else
+            echo "Failed to create branch (HTTP ${HTTP}) -- may already exist"
+          fi

package/.mokogit/workflows/notify.yml

@@ -0,0 +1,73 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: MokoGIT.Workflow
+# INGROUP: MokoCLI.Notifications
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# PATH: /.mokogit/workflows/notify.yml
+# VERSION: 01.00.00
+# BRIEF: Push notifications via ntfy on release success or workflow failure
+
+name: "Universal: Notifications"
+
+on:
+  workflow_run:
+    workflows:
+      - "Universal: Build & Release"
+      - "Joomla: Extension CI"
+      - "Generic: Project CI"
+    types:
+      - completed
+
+permissions:
+  contents: read
+
+env:
+  NTFY_URL: ${{ vars.NTFY_URL || 'https://ntfy.mokoconsulting.tech' }}
+  NTFY_TOPIC: ${{ vars.NTFY_TOPIC || 'mokogit-releases' }}
+  NTFY_TOKEN: ${{ secrets.NTFY_TOKEN }}
+
+jobs:
+  notify:
+    name: Send Notification
+    runs-on: ubuntu-latest
+    if: >-
+      github.event.workflow_run.conclusion == 'success' ||
+      github.event.workflow_run.conclusion == 'failure'
+
+    steps:
+      - name: Notify on success (releases only)
+        if: >-
+          github.event.workflow_run.conclusion == 'success' &&
+          contains(github.event.workflow_run.name, 'Release')
+        run: |
+          REPO="${{ github.event.repository.name }}"
+          WORKFLOW="${{ github.event.workflow_run.name }}"
+          URL="${{ github.event.workflow_run.html_url }}"
+
+          curl -sS --retry 3 --retry-connrefused --retry-delay 2 --max-time 20 \
+            -H "Title: ${REPO} released" \
+            -H "Tags: white_check_mark,package" \
+            -H "Priority: default" \
+            -H "Click: ${URL}" \
+            -d "${WORKFLOW} completed successfully." \
+            -H "Authorization: Bearer ${NTFY_TOKEN}" \
+            "${NTFY_URL}/${NTFY_TOPIC}" || echo "::warning::ntfy notification could not be delivered (non-fatal)"
+
+      - name: Notify on failure
+        if: github.event.workflow_run.conclusion == 'failure'
+        run: |
+          REPO="${{ github.event.repository.name }}"
+          WORKFLOW="${{ github.event.workflow_run.name }}"
+          URL="${{ github.event.workflow_run.html_url }}"
+
+          curl -sS --retry 3 --retry-connrefused --retry-delay 2 --max-time 20 \
+            -H "Title: ${REPO} workflow failed" \
+            -H "Tags: x,warning" \
+            -H "Priority: high" \
+            -H "Click: ${URL}" \
+            -d "${WORKFLOW} failed. Check the run for details." \
+            -H "Authorization: Bearer ${NTFY_TOKEN}" \
+            "${NTFY_URL}/${NTFY_TOPIC}" || echo "::warning::ntfy notification could not be delivered (non-fatal)"

package/.mokogit/workflows/npm-build-test.yml

@@ -0,0 +1,83 @@
+# MCP Server Build & Validation
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# Builds the MCP server, validates TypeScript compilation, and checks
+# that tools are properly registered with valid Zod schemas.
+
+name: "MCP: Build & Validate"
+
+on:
+  push:
+    branches: [main, dev/**]
+    paths: ['source/**', 'src/**', 'package.json', 'tsconfig.json']
+  pull_request:
+    branches: [main]
+    paths: ['source/**', 'src/**', 'package.json', 'tsconfig.json']
+
+
+permissions:
+  contents: read
+
+env:
+  MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
+  GIT_ORG: ${{ vars.MOKOGIT_ORG || github.repository_owner }}
+  GIT_REPO: ${{ vars.MOKOGIT_REPO || github.event.repository.name }}
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    if: ${{ !startsWith(github.event.repository.name, 'Template-') }}
+    strategy:
+      matrix:
+        node-version: [20, 22]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Resolve source dir
+        id: srcdir
+        uses: ./.mokogit/actions/resolve-source-dir
+        with:
+          mokogit_token: ${{ secrets.MOKOGIT_TOKEN }}
+          strict: 'false'
+
+      - name: Setup Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: TypeScript compile
+        run: npx tsc --noEmit
+
+      - name: Build
+        run: npm run build
+
+      - name: Verify dist output exists
+        run: |
+          test -f dist/index.js || (echo "ERROR: dist/index.js not found" && exit 1)
+          test -f dist/client.js || (echo "ERROR: dist/client.js not found" && exit 1)
+          test -f dist/config.js || (echo "ERROR: dist/config.js not found" && exit 1)
+          test -f dist/types.js || (echo "ERROR: dist/types.js not found" && exit 1)
+          echo "✓ All required dist files present"
+
+      - name: Verify shebang in index.js
+        run: |
+          head -1 dist/index.js | grep -q "#!/usr/bin/env node" || echo "WARNING: Missing shebang in dist/index.js"
+
+      - name: Count registered tools
+        run: |
+          INDEX_FILE="${{ steps.srcdir.outputs.source_dir }}index.ts"
+          if [ ! -f "${INDEX_FILE}" ]; then
+            echo "::warning::resolved entrypoint ${INDEX_FILE} missing; falling back to src/index.ts"
+            INDEX_FILE="src/index.ts"
+          fi
+          TOOL_COUNT=$(grep -c "server\.tool(" "${INDEX_FILE}" || true)
+          echo "Registered tools in ${INDEX_FILE}: ${TOOL_COUNT}"
+          if [ "${TOOL_COUNT}" -eq 0 ]; then
+            echo "ERROR: No tools registered in ${INDEX_FILE}"
+            exit 1
+          fi

package/.mokogit/workflows/npm-publish.yml

@@ -0,0 +1,126 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: MokoGIT.Workflow
+# INGROUP: MokoCLI.Release
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-NPM
+# PATH: /.mokogit/workflows/npm-publish.yml
+# VERSION: 02.00.00
+# BRIEF: Build + publish shim. The shared release engine (pre-release.yml /
+#        auto-release.yml) owns version bump, tag, changelog and release
+#        object; this workflow only builds and publishes the version the
+#        engine has already written to package.json. It never bumps or
+#        writes the version.
+
+name: "Publish to npm"
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+jobs:
+  publish:
+    runs-on: release
+    if: >-
+      !contains(github.event.head_commit.message, '[skip ci]') &&
+      !contains(github.event.head_commit.message, '[skip publish]') &&
+      !startsWith(github.event.repository.name, 'Template-')
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 2
+
+      - name: Resolve source dir
+        id: srcdir
+        uses: ./.mokogit/actions/resolve-source-dir
+        with:
+          mokogit_token: ${{ secrets.MOKOGIT_TOKEN }}
+          strict: 'true'
+
+      - name: Detect publishable changes
+        id: detect
+        run: |
+          set -euo pipefail
+
+          # workflow_dispatch has no diff base — always treat as changed.
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "::notice::workflow_dispatch — forcing changed=true"
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          # Build the source-dir alternative from the resolved dir (escape ERE metachars).
+          # Class lists ] first and [ last to avoid a [. collating-symbol parse; the
+          # \\\\& replacement reaches sed as \\& = literal backslash + matched char.
+          SRC_DIR='${{ steps.srcdir.outputs.source_dir }}'
+          SRC_RE=$(printf '%s' "$SRC_DIR" | sed 's/[].^$*+?(){}|[]/\\\\&/g')
+          PATTERN="^(${SRC_RE}|package\.json$|package-lock\.json$|tsconfig\.json$|README\.md$)"
+          echo "Detect pattern: ${PATTERN}"
+
+          BEFORE="${{ github.event.before }}"
+          if [ -z "${BEFORE}" ] || ! git cat-file -e "${BEFORE}^{commit}" 2>/dev/null; then
+            BEFORE=$(git rev-parse HEAD^ 2>/dev/null || echo "")
+          fi
+          if [ -n "${BEFORE}" ]; then
+            FILES=$(git diff --name-only "${BEFORE}" HEAD)
+          else
+            FILES=$(git show --name-only --pretty=format: HEAD)
+          fi
+
+          if printf '%s\n' "${FILES}" | grep -Eq "${PATTERN}"; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "::notice::No publishable changes under '${SRC_DIR}'. Files: ${FILES}"
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Setup Node.js
+        if: steps.detect.outputs.changed == 'true'
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Install dependencies
+        if: steps.detect.outputs.changed == 'true'
+        run: npm install --no-audit --no-fund
+
+      - name: Build
+        if: steps.detect.outputs.changed == 'true'
+        run: npm run build
+
+      - name: Read version to publish
+        id: version
+        if: steps.detect.outputs.changed == 'true'
+        run: |
+          set -euo pipefail
+          # READ-ONLY. The shared release engine (pre-release.yml / auto-release.yml)
+          # has already bumped and written this version into package.json and created
+          # the tag + release object. This shim only publishes it — it never bumps or
+          # writes the version.
+          VERSION=$(node -p "require('./package.json').version")
+          echo "Publishing version ${VERSION} (set by the shared release engine)."
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+
+      - name: Publish to npmjs.org + git.mokoconsulting.tech
+        if: steps.detect.outputs.changed == 'true'
+        run: |
+          set -uo pipefail
+          {
+            echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}"
+            echo "//git.mokoconsulting.tech/api/packages/MokoConsulting/npm/:_authToken=${MOKOGIT_TOKEN}"
+          } >> .npmrc
+          VER=$(node -p "require('./package.json').version")
+          rc=0
+          echo "Publishing ${VER} -> npmjs.org"
+          npm publish --access public --registry https://registry.npmjs.org/             || { echo "::warning::npmjs.org publish failed (version ${VER} may already exist)"; rc=$((rc+1)); }
+          echo "Publishing ${VER} -> git.mokoconsulting.tech"
+          npm publish --access public --registry https://git.mokoconsulting.tech/api/packages/MokoConsulting/npm/             || { echo "::warning::git.mokoconsulting.tech publish failed (version ${VER} may already exist)"; rc=$((rc+1)); }
+          [ "$rc" -lt 2 ]
+        env:
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}

package/.mokogit/workflows/npm-sdk-check.yml

@@ -0,0 +1,110 @@
+# MCP SDK Version Check
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# Weekly check for MCP SDK updates. Creates an issue when a new version
+# of @modelcontextprotocol/sdk is available.
+
+name: "MCP: SDK Version Check"
+
+on:
+  schedule:
+    - cron: '0 9 * * 1'  # Every Monday at 9am UTC
+  workflow_dispatch:
+
+
+permissions:
+  contents: read
+
+jobs:
+  check-sdk:
+    runs-on: ubuntu-latest
+    if: ${{ !startsWith(github.event.repository.name, 'Template-') }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Check for SDK updates
+        id: sdk-check
+        run: |
+          CURRENT=$(node -p "require('./package.json').dependencies['@modelcontextprotocol/sdk']" | sed 's/[\^~]//')
+          LATEST=$(npm view @modelcontextprotocol/sdk version 2>/dev/null || echo "unknown")
+
+          echo "current=${CURRENT}" >> $GITHUB_OUTPUT
+          echo "latest=${LATEST}" >> $GITHUB_OUTPUT
+
+          if [ "${CURRENT}" != "${LATEST}" ] && [ "${LATEST}" != "unknown" ]; then
+            echo "update_available=true" >> $GITHUB_OUTPUT
+            echo "MCP SDK update available: ${CURRENT} → ${LATEST}"
+          else
+            echo "update_available=false" >> $GITHUB_OUTPUT
+            echo "MCP SDK is up to date: ${CURRENT}"
+          fi
+
+      - name: Check for Zod updates
+        id: zod-check
+        run: |
+          CURRENT=$(node -p "require('./package.json').dependencies['zod']" | sed 's/[\^~]//')
+          LATEST=$(npm view zod version 2>/dev/null || echo "unknown")
+
+          echo "current=${CURRENT}" >> $GITHUB_OUTPUT
+          echo "latest=${LATEST}" >> $GITHUB_OUTPUT
+
+          if [ "${CURRENT}" != "${LATEST}" ] && [ "${LATEST}" != "unknown" ]; then
+            echo "update_available=true" >> $GITHUB_OUTPUT
+          else
+            echo "update_available=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Create update issue
+        if: steps.sdk-check.outputs.update_available == 'true'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const title = `chore(deps): update @modelcontextprotocol/sdk ${process.env.CURRENT} → ${process.env.LATEST}`;
+            const body = [
+              '## MCP SDK Update Available',
+              '',
+              `| Package | Current | Latest |`,
+              `|---------|---------|--------|`,
+              `| @modelcontextprotocol/sdk | ${process.env.CURRENT} | ${process.env.LATEST} |`,
+              `| zod | ${process.env.ZOD_CURRENT} | ${process.env.ZOD_LATEST} |`,
+              '',
+              '### Steps',
+              '1. Update package.json',
+              '2. Run `npm install`',
+              '3. Run `npm run build` to verify compilation',
+              '4. Test all tools against target API',
+              '',
+              '### Changelog',
+              `https://github.com/modelcontextprotocol/typescript-sdk/releases`,
+            ].join('\n');
+
+            // Check for existing open issue
+            const existing = await github.rest.issues.listForRepo({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              state: 'open',
+              labels: 'api-change',
+            });
+
+            const alreadyExists = existing.data.some(i => i.title.includes('@modelcontextprotocol/sdk'));
+            if (!alreadyExists) {
+              await github.rest.issues.create({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                title,
+                body,
+                labels: ['api-change', 'chore'],
+              });
+            }
+        env:
+          CURRENT: ${{ steps.sdk-check.outputs.current }}
+          LATEST: ${{ steps.sdk-check.outputs.latest }}
+          ZOD_CURRENT: ${{ steps.zod-check.outputs.current }}
+          ZOD_LATEST: ${{ steps.zod-check.outputs.latest }}

package/.mokogit/workflows/npm-tool-inventory.yml

@@ -0,0 +1,80 @@
+# MCP Tool Inventory
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# Generates a tool inventory report on each push to main.
+# Extracts tool names, descriptions, and parameter counts from src/index.ts.
+
+name: "MCP: Tool Inventory"
+
+on:
+  push:
+    branches: [main]
+    paths: ['source/index.ts', 'src/index.ts']
+  workflow_dispatch:
+
+
+permissions:
+  contents: read
+
+env:
+  MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
+  GIT_ORG: ${{ vars.MOKOGIT_ORG || github.repository_owner }}
+  GIT_REPO: ${{ vars.MOKOGIT_REPO || github.event.repository.name }}
+
+jobs:
+  inventory:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Resolve source dir
+        id: srcdir
+        uses: ./.mokogit/actions/resolve-source-dir
+        with:
+          mokogit_token: ${{ secrets.MOKOGIT_TOKEN }}
+          strict: 'false'
+
+      - name: Generate tool inventory
+        run: |
+          INDEX_FILE="${{ steps.srcdir.outputs.source_dir }}index.ts"
+          if [ ! -f "${INDEX_FILE}" ]; then
+            echo "::warning::resolved entrypoint ${INDEX_FILE} missing; falling back to src/index.ts"
+            INDEX_FILE="src/index.ts"
+          fi
+          [ -r "${INDEX_FILE}" ] || { echo "::error::entry file ${INDEX_FILE} unreadable"; exit 1; }
+
+          echo "# MCP Tool Inventory" > TOOLS.md
+          echo "" >> TOOLS.md
+          echo "Auto-generated from \`${INDEX_FILE}\` on $(date -u +%Y-%m-%dT%H:%M:%SZ)" >> TOOLS.md
+          echo "" >> TOOLS.md
+
+          # Count tools
+          TOOL_COUNT=$(grep -c "server\.tool(" "${INDEX_FILE}" || true)
+          echo "**Total tools: ${TOOL_COUNT}**" >> TOOLS.md
+          echo "" >> TOOLS.md
+
+          # Extract tool names and descriptions
+          echo "| Tool | Description |" >> TOOLS.md
+          echo "|------|-------------|" >> TOOLS.md
+
+          grep -A1 "server\.tool(" "${INDEX_FILE}" | grep -E "^\s*'" | while read -r line; do
+            TOOL_NAME=$(echo "$line" | sed "s/.*'\([^']*\)'.*/\1/")
+            # Get next line for description
+            DESC=$(grep -A2 "'${TOOL_NAME}'" "${INDEX_FILE}" | grep -E "^\s*'" | tail -1 | sed "s/.*'\([^']*\)'.*/\1/" || echo "")
+            echo "| \`${TOOL_NAME}\` | ${DESC} |" >> TOOLS.md
+          done
+
+          echo "" >> TOOLS.md
+          echo "---" >> TOOLS.md
+          echo "*Generated by MCP Tool Inventory workflow*" >> TOOLS.md
+
+          cat TOOLS.md
+
+      - name: Upload inventory artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: tool-inventory
+          path: TOOLS.md
+          retention-days: 90