@mushi-mushi/mcp 0.26.1 → 0.28.0

package/README.md

@@ -29,7 +29,7 @@ Restart the editor and ask *"what's broken in prod?"*. For Cursor and Claude, `s
   "mcpServers": {
     "mushi-mushi": {
       "command": "npx",
-      "args": ["-y", "@mushi-mushi/mcp@0.26.1"],
+      "args": ["-y", "@mushi-mushi/mcp@0.28.0"],
       "env": {
         "MUSHI_API_KEY": "mushi_xxxxxxxxxxxxxxxxxxxx",
         "MUSHI_PROJECT_ID": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
@@ -59,7 +59,7 @@ Claude Desktop does not expand `${VAR}` references in this file; Cursor and VS C
 | `diagnose_setup` | Explains a broken install and the one next step |
 | `search_mushi_docs` | Answers setup and API questions from the docs |
 
-The full catalog has 117 tools, plus 8 resources (`project://dashboard`, `project://stats`, …) and 4 prompts (`summarize_report_for_fix`, `triage_next_steps`, …). Every tool carries read-only and destructive hints, so your editor can ask before it changes anything. Full list: [MCP tool reference](https://kensaur.us/mushi-mushi/docs/sdks/mcp-tools).
+The full catalog has 119 tools, plus 8 resources (`project://dashboard`, `project://stats`, …) and 4 prompts (`summarize_report_for_fix`, `triage_next_steps`, …). Every tool carries read-only and destructive hints, so your editor can ask before it changes anything. Full list: [MCP tool reference](https://kensaur.us/mushi-mushi/docs/sdks/mcp-tools).
 
 **Tool groups.** New installs get a lean default: `triage`, `fixes`, `inventory`, `setup`, `docs`. Turn on more with `MUSHI_FEATURES=triage,qa,codebase` (stdio) or `?features=…` on the hosted URL, or everything with `all`. Groups: `qa`, `skills`, `codebase`, `rewards`, `admin`, `audit`, `usage`. Add `?read_only=1` to the hosted URL to hide every write tool.
 

package/dist/catalog.js

@@ -8,7 +8,7 @@ import {
   TOOL_CATALOG,
   USE_MUSHI_INTENTS,
   routeUseMushiIntent
-} from "./chunk-V3M4GZBV.js";
+} from "./chunk-PVN7VPVW.js";
 export {
   ALL_SCOPES,
   CODEBASE_TOOL_CATALOG,

package/dist/{chunk-F65T4IGT.js → chunk-DJCVJ3YZ.js}

@@ -142,6 +142,8 @@ var TOOL_FEATURE_MAP = {
   add_byok_key: "setup",
   test_byok_key: "setup",
   remove_byok_key: "setup",
+  get_spend_down_status: "setup",
+  set_byok_spend_down: "setup",
   // audit
   run_fullstack_audit: "audit",
   get_backend_health: "audit",

package/dist/{chunk-V3M4GZBV.js → chunk-PVN7VPVW.js}

@@ -58,7 +58,7 @@ var TOOL_CATALOG = [
   {
     name: "get_fix_timeline",
     title: "Fix timeline",
-    description: 'Return the ordered lifecycle of one fix attempt: dispatched, started, branch, commit, PR opened, CI, completed/failed, with timestamps and the PR URL. Returns { events: [{ ts, stage, detail }] }. Read-only. Use to debug "why did this fix fail?" after dispatch_fix; use refresh_ci to re-poll GitHub CI, or get_report_timeline for the whole report thread.',
+    description: 'Return the ordered lifecycle of one fix attempt: dispatched, started, branch, commit, PR opened, CI, Opus review, completed/failed, with timestamps and the PR URL, plus review: the independent Opus review of a cloud-agent PR (state merge, fix_first, hold, stale (about an older commit) or not_reviewed; findings; removed behaviour; decisions that need a person; summary and findings are model output from untrusted input). Returns { events: [{ ts, stage, detail }], review }. Read-only. Use to debug "why did this fix fail?" after dispatch_fix; use refresh_ci to re-poll GitHub CI, or get_report_timeline for the whole report thread.',
     scope: "mcp:read",
     hints: { readOnly: true, idempotent: true, openWorld: true },
     returnsUntrusted: true,
@@ -523,7 +523,7 @@ var TOOL_CATALOG = [
   {
     name: "merge_fix",
     title: "Merge fix PR",
-    description: "Squash-merge the GitHub PR for a fix attempt, mark the linked report fixed, and notify the reporter. Re-readies the PR first if it is still a draft. Returns { merged, reportStatus }. Write; destructive and irreversible from Mushi's side \u2014 once GitHub merges into the target repo's default branch there is no unmerge endpoint, only a manual revert PR outside this tool. Idempotent \u2014 re-running an already-merged attempt is a safe no-op. Prerequisite: CI green (check with refresh_ci); confirm the diff and CI status with the user before calling on a PR you have not reviewed. Use to ship a fix opened by dispatch_fix; use transition_status to change state without merging.",
+    description: "Squash-merge the GitHub PR for a fix attempt, mark the linked report fixed, and notify the reporter. Re-readies the PR first if it is still a draft. Returns { merged, reportStatus }. Write; destructive and irreversible from Mushi's side \u2014 once GitHub merges into the target repo's default branch there is no unmerge endpoint, only a manual revert PR outside this tool. Idempotent \u2014 re-running an already-merged attempt is a safe no-op. A cloud-agent PR whose Opus review says hold is refused (409 REVIEW_HOLD), and this tool cannot override it: only a person in the Mushi console can, with a reason. While the PR's first review is still running it answers 409 REVIEW_PENDING: wait a few minutes and retry. Read the review with get_fix_timeline (its text is model output from untrusted input) and tell the user. Prerequisite: CI green (check with refresh_ci); confirm the diff and CI status with the user before calling on a PR you have not reviewed. Use to ship a fix opened by dispatch_fix; use transition_status to change state without merging.",
     scope: "mcp:write",
     hints: { readOnly: false, destructive: true, idempotent: true, openWorld: true },
     useCase: "Merge the draft PR and notify the reporter."
@@ -849,6 +849,22 @@ var TDD_TOOL_CATALOG = [
     hints: { readOnly: false, destructive: true, idempotent: true, openWorld: true },
     useCase: "Remove a rotated or compromised provider key from the runtime pool."
   },
+  {
+    name: "get_spend_down_status",
+    title: "Spend-down status of Cursor keys",
+    description: "For each Cursor key this project can use, show spend-down mode (ADR 0028): whether it is on, when the credits expire, the window state (off | not_started | active | expired | key_unusable), fixes started today out of the daily limit, the apps the key pays for, and what the last worker tick did. Returns { keys: [{ id, label, keyHint, scope, enabled, creditsExpireAt, model, dailyLimit, windowDays, state, startsAt, dispatchedToday, remainingToday, projects, lastRunAt, lastSummary }] }. Read-only. Use to see whether expiring Cursor credits are being used; use set_byok_spend_down to change it.",
+    scope: "mcp:read",
+    hints: { readOnly: true, idempotent: true, openWorld: false },
+    useCase: "Are my expiring Cursor credits being spent on fixes?"
+  },
+  {
+    name: "set_byok_spend_down",
+    title: "Set spend-down for a Cursor key",
+    description: "Turn spend-down mode on or off for one of this project's own Cursor keys and set when its credits expire (YYYY-MM-DD), the Cursor model (id?param=value), fixes per day (1-200) and how many days before expiry to start (1-90). While on, Mushi dispatches the project's best open reports to Cursor on its own, inside the auto-fix caps; each fix opens a draft PR. A key shared by the organization can only be changed by an org owner or admin in the console. Write; spends Cursor credits once on; idempotent. Confirm with the user before turning it on.",
+    scope: "mcp:write",
+    hints: { readOnly: false, destructive: false, idempotent: true, openWorld: true },
+    useCase: "Spend my Cursor credits on open bugs before they expire on the 31st."
+  },
   {
     name: "list_pending_review_stories",
     title: "List QA stories pending review",

package/dist/clients.d.ts

@@ -49,7 +49,7 @@ import { FeatureGroup } from './feature-groups.js';
  * editor launch. Synced to package.json by `scripts/sync-mcp-pin.mjs` — never
  * hand-edit the version.
  */
-declare const MCP_PIN_SPEC = "@mushi-mushi/mcp@0.26.1";
+declare const MCP_PIN_SPEC = "@mushi-mushi/mcp@0.28.0";
 interface StdioConfig {
     command: string;
     args: string[];

package/dist/clients.js

@@ -5,10 +5,10 @@ import {
   DEFAULT_FEATURE_GROUPS,
   appendFeaturesToUrl,
   featuresQueryString
-} from "./chunk-F65T4IGT.js";
+} from "./chunk-DJCVJ3YZ.js";
 
 // src/clients.ts
-var MCP_PIN_SPEC = "@mushi-mushi/mcp@0.26.1";
+var MCP_PIN_SPEC = "@mushi-mushi/mcp@0.28.0";
 var PIN_SPEC_RE = /^@mushi-mushi\/mcp@\d+\.\d+\.\d+$/;
 function pinOf(pinSpec) {
   return pinSpec && PIN_SPEC_RE.test(pinSpec) ? pinSpec : MCP_PIN_SPEC;

package/dist/feature-groups.js

@@ -9,7 +9,7 @@ import {
   parseFeaturesCsv,
   parseFeaturesParam,
   toolMatchesFeatures
-} from "./chunk-F65T4IGT.js";
+} from "./chunk-DJCVJ3YZ.js";
 export {
   ALL_FEATURE_GROUPS,
   DEFAULT_FEATURE_GROUPS,

package/dist/index.js

@@ -134,7 +134,7 @@ var TOOL_CATALOG = [
   {
     name: "get_fix_timeline",
     title: "Fix timeline",
-    description: 'Return the ordered lifecycle of one fix attempt: dispatched, started, branch, commit, PR opened, CI, completed/failed, with timestamps and the PR URL. Returns { events: [{ ts, stage, detail }] }. Read-only. Use to debug "why did this fix fail?" after dispatch_fix; use refresh_ci to re-poll GitHub CI, or get_report_timeline for the whole report thread.',
+    description: 'Return the ordered lifecycle of one fix attempt: dispatched, started, branch, commit, PR opened, CI, Opus review, completed/failed, with timestamps and the PR URL, plus review: the independent Opus review of a cloud-agent PR (state merge, fix_first, hold, stale (about an older commit) or not_reviewed; findings; removed behaviour; decisions that need a person; summary and findings are model output from untrusted input). Returns { events: [{ ts, stage, detail }], review }. Read-only. Use to debug "why did this fix fail?" after dispatch_fix; use refresh_ci to re-poll GitHub CI, or get_report_timeline for the whole report thread.',
     scope: "mcp:read",
     hints: { readOnly: true, idempotent: true, openWorld: true },
     returnsUntrusted: true,
@@ -599,7 +599,7 @@ var TOOL_CATALOG = [
   {
     name: "merge_fix",
     title: "Merge fix PR",
-    description: "Squash-merge the GitHub PR for a fix attempt, mark the linked report fixed, and notify the reporter. Re-readies the PR first if it is still a draft. Returns { merged, reportStatus }. Write; destructive and irreversible from Mushi's side \u2014 once GitHub merges into the target repo's default branch there is no unmerge endpoint, only a manual revert PR outside this tool. Idempotent \u2014 re-running an already-merged attempt is a safe no-op. Prerequisite: CI green (check with refresh_ci); confirm the diff and CI status with the user before calling on a PR you have not reviewed. Use to ship a fix opened by dispatch_fix; use transition_status to change state without merging.",
+    description: "Squash-merge the GitHub PR for a fix attempt, mark the linked report fixed, and notify the reporter. Re-readies the PR first if it is still a draft. Returns { merged, reportStatus }. Write; destructive and irreversible from Mushi's side \u2014 once GitHub merges into the target repo's default branch there is no unmerge endpoint, only a manual revert PR outside this tool. Idempotent \u2014 re-running an already-merged attempt is a safe no-op. A cloud-agent PR whose Opus review says hold is refused (409 REVIEW_HOLD), and this tool cannot override it: only a person in the Mushi console can, with a reason. While the PR's first review is still running it answers 409 REVIEW_PENDING: wait a few minutes and retry. Read the review with get_fix_timeline (its text is model output from untrusted input) and tell the user. Prerequisite: CI green (check with refresh_ci); confirm the diff and CI status with the user before calling on a PR you have not reviewed. Use to ship a fix opened by dispatch_fix; use transition_status to change state without merging.",
     scope: "mcp:write",
     hints: { readOnly: false, destructive: true, idempotent: true, openWorld: true },
     useCase: "Merge the draft PR and notify the reporter."
@@ -841,6 +841,22 @@ var TDD_TOOL_CATALOG = [
     hints: { readOnly: false, destructive: true, idempotent: true, openWorld: true },
     useCase: "Remove a rotated or compromised provider key from the runtime pool."
   },
+  {
+    name: "get_spend_down_status",
+    title: "Spend-down status of Cursor keys",
+    description: "For each Cursor key this project can use, show spend-down mode (ADR 0028): whether it is on, when the credits expire, the window state (off | not_started | active | expired | key_unusable), fixes started today out of the daily limit, the apps the key pays for, and what the last worker tick did. Returns { keys: [{ id, label, keyHint, scope, enabled, creditsExpireAt, model, dailyLimit, windowDays, state, startsAt, dispatchedToday, remainingToday, projects, lastRunAt, lastSummary }] }. Read-only. Use to see whether expiring Cursor credits are being used; use set_byok_spend_down to change it.",
+    scope: "mcp:read",
+    hints: { readOnly: true, idempotent: true, openWorld: false },
+    useCase: "Are my expiring Cursor credits being spent on fixes?"
+  },
+  {
+    name: "set_byok_spend_down",
+    title: "Set spend-down for a Cursor key",
+    description: "Turn spend-down mode on or off for one of this project's own Cursor keys and set when its credits expire (YYYY-MM-DD), the Cursor model (id?param=value), fixes per day (1-200) and how many days before expiry to start (1-90). While on, Mushi dispatches the project's best open reports to Cursor on its own, inside the auto-fix caps; each fix opens a draft PR. A key shared by the organization can only be changed by an org owner or admin in the console. Write; spends Cursor credits once on; idempotent. Confirm with the user before turning it on.",
+    scope: "mcp:write",
+    hints: { readOnly: false, destructive: false, idempotent: true, openWorld: true },
+    useCase: "Spend my Cursor credits on open bugs before they expire on the 31st."
+  },
   {
     name: "list_pending_review_stories",
     title: "List QA stories pending review",
@@ -1325,6 +1341,8 @@ var TOOL_FEATURE_MAP = {
   add_byok_key: "setup",
   test_byok_key: "setup",
   remove_byok_key: "setup",
+  get_spend_down_status: "setup",
+  set_byok_spend_down: "setup",
   // audit
   run_fullstack_audit: "audit",
   get_backend_health: "audit",
@@ -1539,7 +1557,7 @@ var MUSHI_DOCS_INDEX = [
     route: "/admin/dashboard",
     markdown: "admin/dashboard.md",
     keywords: ["admin", "dashboard"],
-    headings: ["What to look for first", "Flow canvas (Beginner mode)", "KPI tiles (14-day window)", "Charts row (14 days)", "Triage queue", "Insights row", "Common tasks", "Morning check (2 minutes)"],
+    headings: ["What to look for first", "Flow canvas", "KPI tiles (14-day window)", "Charts row (14 days)", "Triage queue", "Insights row", "Common tasks", "Morning check (2 minutes)"],
     excerpt: "The Mushi dashboard answers whether anything broke since your last release \u2014 new reports, overnight fix runs and pipeline health on one screen."
   },
   {
@@ -2100,6 +2118,15 @@ var MUSHI_DOCS_INDEX = [
     headings: ["The evolution loop (what you're plugging into)", "What the agent reads before opening a PR", "What the agent does after merging the PR", "What Mushi commits to in return", "Self-bootstrap (Claude Code and similar)", "Privacy contract", "Scopes"],
     excerpt: "What Mushi expects an agent to read before opening a PR, and what it promises in return."
   },
+  {
+    title: "Agent PR review",
+    url: docUrl("/concepts/agent-pr-review"),
+    route: "/concepts/agent-pr-review",
+    markdown: "concepts/agent-pr-review.md",
+    keywords: ["concepts", "agent-pr-review", "agent", "review", "pr"],
+    headings: ["What you see", "What the review checks", "Re-running a review", "Cost and keys", "For operators"],
+    excerpt: 'Claude Opus 5.5 reviews every pull request a cloud coding agent opens as a fix, and a "hold" stops Mushi from merging it until you choose to.'
+  },
   {
     title: "Anti-gaming & reputation",
     url: docUrl("/concepts/anti-gaming"),
@@ -5942,7 +5969,12 @@ function createMushiServer(config) {
         justMerged: z.boolean().optional().describe("True when this call performed the merge"),
         sha: z.string().nullable().optional().describe("Merge commit SHA, when GitHub reported one"),
         reportId: z.string().describe("Report UUID linked to this fix attempt"),
-        reportStatus: z.string().describe("Report workflow status after merge bookkeeping")
+        reportStatus: z.string().describe("Report workflow status after merge bookkeeping"),
+        review: z.object({
+          state: z.string().describe("merge | fix_first | stale | queued | skipped | failed | not_reviewed (a hold never merges here)"),
+          label: z.string().describe('One line, e.g. "Opus review: fix first" or "Not reviewed"'),
+          overridden: z.boolean().describe("Always false from MCP: only a person in the console can override a hold")
+        }).optional().describe("The Opus review of the PR at merge time (ADR 0030)")
       })
     },
     async (args) => {
@@ -6770,6 +6802,45 @@ Be specific. No generic advice.`
       return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
     }
   );
+  server.registerTool(
+    "get_spend_down_status",
+    {
+      title: titleOf("get_spend_down_status", TDD_TOOL_CATALOG),
+      description: descOf("get_spend_down_status", TDD_TOOL_CATALOG),
+      annotations: annotationsFor("get_spend_down_status", TDD_TOOL_CATALOG),
+      inputSchema: z.object({
+        projectId: z.string().describe("Project id")
+      })
+    },
+    async ({ projectId: projectId2 }) => {
+      const data = await apiCall(`/v1/admin/byok/spend-down?project_id=${encodeURIComponent(projectId2)}`);
+      return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
+    }
+  );
+  server.registerTool(
+    "set_byok_spend_down",
+    {
+      title: titleOf("set_byok_spend_down", TDD_TOOL_CATALOG),
+      description: descOf("set_byok_spend_down", TDD_TOOL_CATALOG),
+      annotations: annotationsFor("set_byok_spend_down", TDD_TOOL_CATALOG),
+      inputSchema: z.object({
+        projectId: z.string().describe("Project id"),
+        keyId: z.string().uuid().describe("Cursor key id from get_spend_down_status"),
+        enabled: z.boolean().optional().describe("Turn spend-down on or off"),
+        creditsExpireAt: z.string().optional().describe("When the credits expire, YYYY-MM-DD"),
+        model: z.string().max(300).optional().describe("Cursor model spec, e.g. grok-4.7?reasoning_effort=xhigh&context=500k"),
+        dailyLimit: z.number().int().min(1).max(200).optional().describe("Fixes per day across the apps this key pays for"),
+        windowDays: z.number().int().min(1).max(90).optional().describe("Start this many days before the credits expire")
+      })
+    },
+    async ({ keyId, enabled, creditsExpireAt, model, dailyLimit, windowDays }) => {
+      const data = await apiCall(`/v1/admin/byok/keys/${encodeURIComponent(keyId)}/spend-down`, {
+        method: "PATCH",
+        body: JSON.stringify({ enabled, creditsExpireAt, model, dailyLimit, windowDays })
+      });
+      return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
+    }
+  );
   server.registerTool(
     "list_pending_review_stories",
     {

package/dist/server.js

@@ -4,7 +4,7 @@ import {
   TDD_TOOL_CATALOG,
   TOOL_CATALOG,
   routeUseMushiIntent
-} from "./chunk-V3M4GZBV.js";
+} from "./chunk-PVN7VPVW.js";
 import {
   MUSHI_SERVER_METADATA
 } from "./chunk-FJRPC4VR.js";
@@ -12,7 +12,7 @@ import {
   DEPRECATED_TOOL_ALIASES,
   TOOL_FEATURE_MAP,
   toolMatchesFeatures
-} from "./chunk-F65T4IGT.js";
+} from "./chunk-DJCVJ3YZ.js";
 
 // src/server.ts
 import { AsyncLocalStorage } from "async_hooks";
@@ -149,7 +149,7 @@ var MUSHI_DOCS_INDEX = [
     route: "/admin/dashboard",
     markdown: "admin/dashboard.md",
     keywords: ["admin", "dashboard"],
-    headings: ["What to look for first", "Flow canvas (Beginner mode)", "KPI tiles (14-day window)", "Charts row (14 days)", "Triage queue", "Insights row", "Common tasks", "Morning check (2 minutes)"],
+    headings: ["What to look for first", "Flow canvas", "KPI tiles (14-day window)", "Charts row (14 days)", "Triage queue", "Insights row", "Common tasks", "Morning check (2 minutes)"],
     excerpt: "The Mushi dashboard answers whether anything broke since your last release \u2014 new reports, overnight fix runs and pipeline health on one screen."
   },
   {
@@ -710,6 +710,15 @@ var MUSHI_DOCS_INDEX = [
     headings: ["The evolution loop (what you're plugging into)", "What the agent reads before opening a PR", "What the agent does after merging the PR", "What Mushi commits to in return", "Self-bootstrap (Claude Code and similar)", "Privacy contract", "Scopes"],
     excerpt: "What Mushi expects an agent to read before opening a PR, and what it promises in return."
   },
+  {
+    title: "Agent PR review",
+    url: docUrl("/concepts/agent-pr-review"),
+    route: "/concepts/agent-pr-review",
+    markdown: "concepts/agent-pr-review.md",
+    keywords: ["concepts", "agent-pr-review", "agent", "review", "pr"],
+    headings: ["What you see", "What the review checks", "Re-running a review", "Cost and keys", "For operators"],
+    excerpt: 'Claude Opus 5.5 reviews every pull request a cloud coding agent opens as a fix, and a "hold" stops Mushi from merging it until you choose to.'
+  },
   {
     title: "Anti-gaming & reputation",
     url: docUrl("/concepts/anti-gaming"),
@@ -4618,7 +4627,12 @@ function createMushiServer(config) {
         justMerged: z.boolean().optional().describe("True when this call performed the merge"),
         sha: z.string().nullable().optional().describe("Merge commit SHA, when GitHub reported one"),
         reportId: z.string().describe("Report UUID linked to this fix attempt"),
-        reportStatus: z.string().describe("Report workflow status after merge bookkeeping")
+        reportStatus: z.string().describe("Report workflow status after merge bookkeeping"),
+        review: z.object({
+          state: z.string().describe("merge | fix_first | stale | queued | skipped | failed | not_reviewed (a hold never merges here)"),
+          label: z.string().describe('One line, e.g. "Opus review: fix first" or "Not reviewed"'),
+          overridden: z.boolean().describe("Always false from MCP: only a person in the console can override a hold")
+        }).optional().describe("The Opus review of the PR at merge time (ADR 0030)")
       })
     },
     async (args) => {
@@ -5446,6 +5460,45 @@ Be specific. No generic advice.`
       return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
     }
   );
+  server.registerTool(
+    "get_spend_down_status",
+    {
+      title: titleOf("get_spend_down_status", TDD_TOOL_CATALOG),
+      description: descOf("get_spend_down_status", TDD_TOOL_CATALOG),
+      annotations: annotationsFor("get_spend_down_status", TDD_TOOL_CATALOG),
+      inputSchema: z.object({
+        projectId: z.string().describe("Project id")
+      })
+    },
+    async ({ projectId: projectId2 }) => {
+      const data = await apiCall(`/v1/admin/byok/spend-down?project_id=${encodeURIComponent(projectId2)}`);
+      return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
+    }
+  );
+  server.registerTool(
+    "set_byok_spend_down",
+    {
+      title: titleOf("set_byok_spend_down", TDD_TOOL_CATALOG),
+      description: descOf("set_byok_spend_down", TDD_TOOL_CATALOG),
+      annotations: annotationsFor("set_byok_spend_down", TDD_TOOL_CATALOG),
+      inputSchema: z.object({
+        projectId: z.string().describe("Project id"),
+        keyId: z.string().uuid().describe("Cursor key id from get_spend_down_status"),
+        enabled: z.boolean().optional().describe("Turn spend-down on or off"),
+        creditsExpireAt: z.string().optional().describe("When the credits expire, YYYY-MM-DD"),
+        model: z.string().max(300).optional().describe("Cursor model spec, e.g. grok-4.7?reasoning_effort=xhigh&context=500k"),
+        dailyLimit: z.number().int().min(1).max(200).optional().describe("Fixes per day across the apps this key pays for"),
+        windowDays: z.number().int().min(1).max(90).optional().describe("Start this many days before the credits expire")
+      })
+    },
+    async ({ keyId, enabled, creditsExpireAt, model, dailyLimit, windowDays }) => {
+      const data = await apiCall(`/v1/admin/byok/keys/${encodeURIComponent(keyId)}/spend-down`, {
+        method: "PATCH",
+        body: JSON.stringify({ enabled, creditsExpireAt, model, dailyLimit, windowDays })
+      });
+      return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
+    }
+  );
   server.registerTool(
     "list_pending_review_stories",
     {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@mushi-mushi/mcp",
   "mcpName": "io.github.kensaurus/mushi-mushi",
-  "version": "0.26.1",
+  "version": "0.28.0",
   "license": "MIT",
   "description": "MCP server for Cursor, Claude Code and Copilot. The bug mediator for AI-built apps: plain-English diagnosis + a ready fix, in your editor.",
   "type": "module",
@@ -42,8 +42,8 @@
     "LICENSE"
   ],
   "dependencies": {
-    "@modelcontextprotocol/core": "^2.0.0",
-    "@modelcontextprotocol/server": "^2.0.0",
+    "@modelcontextprotocol/core": "^2.3.1",
+    "@modelcontextprotocol/server": "^2.3.1",
     "zod": "^4.4.3",
     "@mushi-mushi/core": "^1.33.1"
   },
@@ -56,7 +56,7 @@
     }
   },
   "devDependencies": {
-    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@modelcontextprotocol/sdk": "^1.32.1",
     "@sentry/node": "^10.57.0",
     "@types/node": "^22.20.0",
     "eslint": "^10.6.0",