@nimbus-dev/connectors 0.1.0

package/connectors/databricks/src/server.ts

@@ -0,0 +1,81 @@
+import { z } from "zod";
+import { searchToolInputSchema } from "../../../shared/mcp-search-tool.ts";
+import { mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
+import { runReadOnlyMcpConnector } from "../../../shared/run-read-only-mcp-connector.ts";
+import { filterDatabricksJobs } from "./search-filter.ts";
+
+function trimTrailingSlash(s: string): string {
+  return s.endsWith("/") ? s.slice(0, -1) : s;
+}
+
+function apiBase(): string {
+  const v = process.env["DATABRICKS_HOST"]?.trim();
+  if (v === undefined || v === "") {
+    throw new Error("DATABRICKS_HOST is not set");
+  }
+  return trimTrailingSlash(v);
+}
+
+function authHeader(): Record<string, string> {
+  const k = process.env["DATABRICKS_TOKEN"]?.trim();
+  if (k === undefined || k === "") {
+    throw new Error("DATABRICKS_TOKEN is not set");
+  }
+  return { Authorization: `Bearer ${k}`, Accept: "application/json" };
+}
+
+async function dbGet(path: string): Promise<unknown> {
+  const res = await fetch(`${apiBase()}${path}`, { headers: authHeader() });
+  const text = await res.text();
+  if (!res.ok) {
+    throw new Error(`Databricks ${String(res.status)}: ${text.slice(0, 400)}`);
+  }
+  return JSON.parse(text) as unknown;
+}
+
+function jobsFrom(root: unknown): unknown[] {
+  const jobs = (root as { jobs?: unknown } | null)?.jobs;
+  return Array.isArray(jobs) ? jobs : [];
+}
+
+await runReadOnlyMcpConnector("nimbus-databricks", (reg) => {
+  reg(
+    "databricks_list",
+    "List Databricks jobs (`GET /api/2.1/jobs/list`). Returns a single page; `limit` (1..100, default 25) caps the page size. Returns the raw `{ jobs, has_more, next_page_token }` envelope.",
+    z.object({
+      limit: z.number().int().min(1).max(100).optional(),
+    }),
+    async (p) => {
+      const limit = p.limit ?? 25;
+      const params = new URLSearchParams({ limit: String(limit) });
+      return jsonResult(await dbGet(`/api/2.1/jobs/list?${params.toString()}`));
+    },
+  );
+
+  reg(
+    "databricks_get",
+    "Fetch one Databricks job by numeric `jobId` (`GET /api/2.1/jobs/get?job_id={jobId}`). Throws when no job with that id exists.",
+    z.object({
+      jobId: z.number().int(),
+    }),
+    async (p) => {
+      const params = new URLSearchParams({ job_id: String(p.jobId) });
+      return jsonResult(await dbGet(`/api/2.1/jobs/get?${params.toString()}`));
+    },
+  );
+
+  reg(
+    "databricks_search",
+    "Substring search across Databricks jobs. Matches the query (case-insensitive) against the job's `settings.name`, `creator_user_name`, and `job_id`. Returns a `{ matches: [...] }` envelope.",
+    searchToolInputSchema(100),
+    async (p) => {
+      const params = new URLSearchParams({ limit: "100" });
+      const root = await dbGet(`/api/2.1/jobs/list?${params.toString()}`);
+      const matches = filterDatabricksJobs(jobsFrom(root), {
+        query: p.query,
+        limit: p.limit,
+      });
+      return jsonResult({ matches });
+    },
+  );
+});

package/connectors/datadog/nimbus.extension.json

@@ -0,0 +1,15 @@
+{
+  "id": "com.nimbus.datadog",
+  "displayName": "Datadog",
+  "version": "0.1.0",
+  "description": "Datadog API v1/v2 connector (monitors, incidents). Non-us1 regional sites (DD_SITE = eu1/us3/us5/ap1/gov) are a known Task 14 follow-up. Read-focused.",
+  "author": "Nimbus",
+  "entrypoint": "dist/server.js",
+  "runtime": "bun",
+  "permissions": {
+    "network": ["api.datadoghq.com"]
+  },
+  "hitlRequired": [],
+  "syncInterval": 300,
+  "minNimbusVersion": "0.2.0"
+}

package/connectors/datadog/src/server.ts

@@ -0,0 +1,56 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+
+import {
+  createRegisterSimpleTool,
+  createZodToolRegistrar,
+  mcpJsonResult as jsonResult,
+} from "../../../shared/mcp-tool-kit.ts";
+
+function siteHost(): string {
+  const s = process.env["DD_SITE"]?.trim() || "datadoghq.com";
+  return `api.${s}`;
+}
+
+function headers(): Record<string, string> {
+  const ak = process.env["DD_API_KEY"]?.trim();
+  const app = process.env["DD_APP_KEY"]?.trim();
+  if (ak === undefined || ak === "" || app === undefined || app === "") {
+    throw new Error("DD_API_KEY and DD_APP_KEY must be set");
+  }
+  return {
+    "DD-API-KEY": ak,
+    "DD-APPLICATION-KEY": app,
+    Accept: "application/json",
+  };
+}
+
+async function ddGet(path: string): Promise<unknown> {
+  const res = await fetch(`https://${siteHost()}${path}`, { headers: headers() });
+  const text = await res.text();
+  if (!res.ok) {
+    throw new Error(`Datadog ${String(res.status)}: ${text.slice(0, 400)}`);
+  }
+  return JSON.parse(text) as unknown;
+}
+
+const mcp = new McpServer({ name: "nimbus-datadog", version: "0.1.0" });
+const reg = createZodToolRegistrar(createRegisterSimpleTool(mcp));
+
+reg("datadog_monitor_list", "List monitors.", z.object({}), async () =>
+  jsonResult(await ddGet("/api/v1/monitor")),
+);
+
+reg(
+  "datadog_incident_list",
+  "List incidents (v2).",
+  z.object({ limit: z.number().int().min(1).max(50).optional() }),
+  async (p) => {
+    const lim = p.limit ?? 10;
+    return jsonResult(await ddGet(`/api/v2/incidents?page[size]=${String(lim)}`));
+  },
+);
+
+const transport = new StdioServerTransport();
+await mcp.connect(transport);

package/connectors/dataprofile/nimbus.extension.json

@@ -0,0 +1,16 @@
+{
+  "id": "com.nimbus.dataprofile",
+  "displayName": "Local Data Profiling",
+  "version": "0.1.0",
+  "description": "Local data profiling connector (Tier-5 local, no-row-data class). Profiles local data files — `.parquet`, `.csv`, `.jsonl`/`.ndjson`, `.json` — under a configured directory into `dataprofile:data_model` items carrying the SCHEMA only: column names, column types, column count, a row-count ESTIMATE, and file size. It NEVER indexes cell values, row samples, first-N-row previews, or header-row data values. Parquet schema + row count come from the file FOOTER metadata (read via hyparquet — no row data crosses the wire); CSV column names come from the header line; JSONL/JSON field names + JS types come from the top-level structure (keys/types only). It is a pure, bounded, path-traversal-guarded filesystem read: NO database, NO network, NO row-fetch or row-sample tool (a contract test asserts the surface has none). The user points the connector at the directory holding their data files via the non-secret path `dataprofile.dir`; read tools are `dataprofile_list`, `dataprofile_get`, `dataprofile_search`. The configured directory arrives as the scoped environment variable DATAPROFILE_DIR and is added to the sandbox filesystem.read allow-list at spawn time. No network access. (ORC is deferred — no maintained pure-JS ORC schema reader exists.)",
+  "author": "Nimbus",
+  "entrypoint": "dist/server.js",
+  "runtime": "bun",
+  "permissions": {
+    "network": [],
+    "filesystem": { "read": [], "write": [] }
+  },
+  "hitlRequired": [],
+  "syncInterval": 600,
+  "minNimbusVersion": "0.2.0"
+}

package/connectors/dataprofile/src/profile.ts

@@ -0,0 +1,298 @@
+import type { FileHandle } from "node:fs/promises";
+import { open, readdir } from "node:fs/promises";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
+import {
+  type DataColumn,
+  firstLineAndRows,
+  type ParquetMetadataLike,
+  parquetColumnsFromMetadata,
+  parseCsvHeader,
+  parseJsonColumns,
+  parseJsonlColumns,
+} from "@nimbus-dev/sdk";
+
+/**
+ * Local data profiling reader (Tier-5, no-row-data). The MCP-server-side
+ * counterpart of the gateway's `mapDataModelToItem` mapper: it profiles local
+ * data files (`.parquet`, `.csv`, `.jsonl`, `.json`) under the configured dir
+ * into SCHEMA-only views — column names/types, column count, a row-count
+ * ESTIMATE, file size.
+ *
+ * HARD SCOPE CONSTRAINT (security): NEVER reads cell values / row samples /
+ * first-N-row previews. Parquet schema comes from the footer; CSV column names
+ * from the header line; JSONL/JSON field names + JS kinds from the top-level
+ * structure (keys/types only). A pure, bounded, path-traversal-guarded read.
+ */
+
+const MAX_FILES = 2000;
+const MAX_WALK_DEPTH = 12;
+const MAX_TEXT_BYTES = 64 * 1024 * 1024;
+const HEADER_PEEK_BYTES = 64 * 1024;
+
+export type DataFileFormat = "parquet" | "csv" | "jsonl" | "json";
+
+const EXT_FORMAT: Record<string, DataFileFormat> = {
+  ".parquet": "parquet",
+  ".csv": "csv",
+  ".jsonl": "jsonl",
+  ".ndjson": "jsonl",
+  ".json": "json",
+};
+
+export { jsKind } from "@nimbus-dev/sdk";
+export type { DataColumn, ParquetMetadataLike };
+export { parquetColumnsFromMetadata, parseCsvHeader, parseJsonColumns, parseJsonlColumns };
+
+export interface DataModel {
+  readonly relativePath: string;
+  readonly format: DataFileFormat;
+  readonly columns: readonly DataColumn[];
+  readonly columnCount: number;
+  readonly rowCountEstimate: number | null;
+  readonly sizeBytes: number;
+}
+
+export function dataDir(): string {
+  const dir = process.env["DATAPROFILE_DIR"]?.trim();
+  if (dir === undefined || dir === "") {
+    throw new Error("DATAPROFILE_DIR is not set");
+  }
+  return resolve(dir);
+}
+
+export function assertWithinDataDir(candidate: string, root: string): void {
+  const rel = relative(root, candidate);
+  if (rel === "") {
+    return;
+  }
+  if (rel.startsWith("..") || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
+    throw new Error("path escapes the configured data-profile dir");
+  }
+}
+
+function extOf(name: string): string {
+  const i = name.lastIndexOf(".");
+  return i < 0 ? "" : name.slice(i).toLowerCase();
+}
+
+/** Reads Parquet footer metadata (schema + row count) WITHOUT reading row data. Injectable for tests. */
+export type ParquetMetadataReader = (path: string) => Promise<ParquetMetadataLike | null>;
+
+async function readParquetMetadata(path: string): Promise<ParquetMetadataLike | null> {
+  const { asyncBufferFromFile, parquetMetadataAsync } = await import("hyparquet");
+  try {
+    const buf = await asyncBufferFromFile(path);
+    return await parquetMetadataAsync(buf);
+  } catch {
+    return null;
+  }
+}
+
+interface FileSlurp {
+  readonly text: string;
+  readonly sizeBytes: number;
+  readonly truncated: boolean;
+}
+
+/**
+ * Open the file ONCE and read its content + size from that single handle
+ * (`fh.stat()` + `fh.readFile()`/`fh.read()`). Operating on one open descriptor
+ * avoids a check-then-use (TOCTOU) race — there is no window where the path is
+ * stat-ed and then re-opened. Whole content for files ≤ cap; a header-only peek
+ * (no row-count estimate) for larger files.
+ */
+async function slurpFile(path: string): Promise<FileSlurp | null> {
+  let fh: FileHandle;
+  try {
+    fh = await open(path, "r");
+  } catch {
+    return null;
+  }
+  try {
+    const st = await fh.stat();
+    const sizeBytes = Number.isFinite(st.size) ? st.size : 0;
+    if (sizeBytes <= MAX_TEXT_BYTES) {
+      const buf = await fh.readFile();
+      return { text: buf.toString("utf8"), sizeBytes, truncated: false };
+    }
+    const { buffer, bytesRead } = await fh.read(
+      Buffer.alloc(HEADER_PEEK_BYTES),
+      0,
+      HEADER_PEEK_BYTES,
+      0,
+    );
+    return { text: buffer.subarray(0, bytesRead).toString("utf8"), sizeBytes, truncated: true };
+  } catch {
+    return null;
+  } finally {
+    await fh.close();
+  }
+}
+
+/** fstat-only via an open handle (race-free) — for parquet, whose content hyparquet reads itself. */
+async function sizeViaHandle(path: string): Promise<number | null> {
+  let fh: FileHandle;
+  try {
+    fh = await open(path, "r");
+  } catch {
+    return null;
+  }
+  try {
+    const st = await fh.stat();
+    return Number.isFinite(st.size) ? st.size : 0;
+  } finally {
+    await fh.close();
+  }
+}
+
+/** Profile fields extracted from a file's content (path/format applied by the caller). */
+interface ProfileFields {
+  columns: DataColumn[];
+  rowCountEstimate: number | null;
+  sizeBytes: number;
+}
+
+async function profileParquet(
+  path: string,
+  readParquet: ParquetMetadataReader,
+): Promise<ProfileFields | null> {
+  const meta = await readParquet(path);
+  if (meta === null) {
+    return null;
+  }
+  const { columns, rowCountEstimate } = parquetColumnsFromMetadata(meta);
+  const size = await sizeViaHandle(path);
+  if (size === null) {
+    return null;
+  }
+  return { columns, rowCountEstimate, sizeBytes: size };
+}
+
+async function profileTextFile(
+  path: string,
+  format: Exclude<DataFileFormat, "parquet">,
+): Promise<ProfileFields | null> {
+  const slurp = await slurpFile(path);
+  if (slurp === null) {
+    return null;
+  }
+  if (format === "json") {
+    if (slurp.truncated) {
+      return null;
+    }
+    const { columns, rowCountEstimate } = parseJsonColumns(JSON.parse(slurp.text) as unknown);
+    return { columns, rowCountEstimate, sizeBytes: slurp.sizeBytes };
+  }
+  const { firstLine, rowCountEstimate: rows } = firstLineAndRows(slurp.text, slurp.truncated);
+  const columns = format === "csv" ? parseCsvHeader(firstLine) : parseJsonlColumns(firstLine);
+  const rowCountEstimate = format === "csv" && rows !== null ? Math.max(0, rows - 1) : rows;
+  return { columns, rowCountEstimate, sizeBytes: slurp.sizeBytes };
+}
+
+async function profileFile(
+  path: string,
+  root: string,
+  format: DataFileFormat,
+  readParquet: ParquetMetadataReader,
+): Promise<DataModel | null> {
+  const relativePath = relative(root, path);
+  let fields: ProfileFields | null;
+  try {
+    fields =
+      format === "parquet"
+        ? await profileParquet(path, readParquet)
+        : await profileTextFile(path, format);
+  } catch {
+    return null;
+  }
+  if (fields === null) {
+    return null;
+  }
+  return {
+    relativePath,
+    format,
+    columns: fields.columns,
+    columnCount: fields.columns.length,
+    rowCountEstimate: fields.rowCountEstimate,
+    sizeBytes: fields.sizeBytes,
+  };
+}
+
+async function collectDataFiles(
+  root: string,
+): Promise<Array<{ path: string; format: DataFileFormat }>> {
+  const found: Array<{ path: string; format: DataFileFormat }> = [];
+  async function walk(dir: string, depth: number): Promise<void> {
+    if (depth > MAX_WALK_DEPTH || found.length >= MAX_FILES) {
+      return;
+    }
+    let entries: import("node:fs").Dirent[];
+    try {
+      entries = await readdir(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (found.length >= MAX_FILES) {
+        return;
+      }
+      const full = join(dir, entry.name);
+      if (entry.isDirectory()) {
+        await walk(full, depth + 1);
+      } else if (entry.isFile()) {
+        const format = EXT_FORMAT[extOf(entry.name)];
+        if (format !== undefined) {
+          found.push({ path: full, format });
+        }
+      }
+    }
+  }
+  await walk(root, 0);
+  return found;
+}
+
+/** Profile all data files under the configured dir into schema-only `DataModel` views. */
+export async function listDataModels(
+  readParquet: ParquetMetadataReader = readParquetMetadata,
+): Promise<DataModel[]> {
+  const root = dataDir();
+  const files = await collectDataFiles(root);
+  const out: DataModel[] = [];
+  for (const { path, format } of files) {
+    assertWithinDataDir(path, root);
+    const model = await profileFile(path, root, format, readParquet);
+    if (model !== null) {
+      out.push(model);
+    }
+  }
+  return out;
+}
+
+/** Profile one data file by its relative path (path-guarded). */
+export async function getDataModel(
+  relativePath: string,
+  readParquet: ParquetMetadataReader = readParquetMetadata,
+): Promise<DataModel | null> {
+  const root = dataDir();
+  const candidate = resolve(root, relativePath);
+  assertWithinDataDir(candidate, root);
+  const format = EXT_FORMAT[extOf(candidate)];
+  if (format === undefined) {
+    return null;
+  }
+  return profileFile(candidate, root, format, readParquet);
+}
+
+/** Substring search over data-model relative path / format / column names. */
+export function filterDataModels(models: readonly DataModel[], query: string): DataModel[] {
+  const q = query.trim().toLowerCase();
+  if (q === "") {
+    return [...models];
+  }
+  return models.filter(
+    (m) =>
+      m.relativePath.toLowerCase().includes(q) ||
+      m.format.includes(q) ||
+      m.columns.some((c) => c.name.toLowerCase().includes(q)),
+  );
+}

package/connectors/dataprofile/src/server.ts

@@ -0,0 +1,6 @@
+import { runReadOnlyMcpConnector } from "../../../shared/run-read-only-mcp-connector.ts";
+import { registerDataprofileTools } from "./tools.ts";
+
+await runReadOnlyMcpConnector("nimbus-dataprofile", (reg) => {
+  registerDataprofileTools(reg);
+});

package/connectors/dataprofile/src/tools.ts

@@ -0,0 +1,69 @@
+import { z } from "zod";
+import { mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
+import type { ZodToolRegistrar } from "../../../shared/run-read-only-mcp-connector.ts";
+import { type DataModel, filterDataModels, getDataModel, listDataModels } from "./profile.ts";
+
+/**
+ * Local data profiling MCP tool surface (Tier-5, no-row-data). Profiles local
+ * data files into SCHEMA-only views — column names/types, column count,
+ * row-count estimate, file size. NEVER returns cell values, row samples, or
+ * first-N-row previews; the tool names carry no row-fetch/sample segment (the
+ * `assertNoRowDataTools` contract test enforces this).
+ */
+export const DATAPROFILE_TOOL_NAMES = [
+  "dataprofile_list",
+  "dataprofile_get",
+  "dataprofile_search",
+] as const;
+
+function toEnvelope(m: DataModel): Record<string, unknown> {
+  return {
+    relativePath: m.relativePath,
+    format: m.format,
+    columns: m.columns.map((c) => ({ name: c.name, type: c.type })),
+    columnCount: m.columnCount,
+    rowCountEstimate: m.rowCountEstimate,
+    sizeBytes: m.sizeBytes,
+  };
+}
+
+/**
+ * Register the read-only data-profiling tools onto the given registrar. Shared
+ * between `server.ts` (live) and the contract test (introspection).
+ */
+export function registerDataprofileTools(reg: ZodToolRegistrar): void {
+  reg(
+    "dataprofile_list",
+    "List local data files (.parquet/.csv/.jsonl/.json) profiled under the configured dir. Returns each file's SCHEMA only — relative path, format, column names + types, column count, a row-count estimate, and file size. NEVER returns cell values, row samples, or row previews.",
+    z.object({ limit: z.number().int().min(1).max(2000).optional() }),
+    async (p) => {
+      const all = await listDataModels();
+      const limit = p.limit ?? 200;
+      return jsonResult({ items: all.slice(0, limit).map(toEnvelope) });
+    },
+  );
+
+  reg(
+    "dataprofile_get",
+    "Profile one local data file by its relative path (within the configured dir). Returns the SCHEMA only (columns + types + row-count estimate + size). NEVER returns cell values or row data.",
+    z.object({ relativePath: z.string().min(1).max(1024) }),
+    async (p) => {
+      const m = await getDataModel(p.relativePath);
+      return jsonResult(m === null ? { item: null } : { item: toEnvelope(m) });
+    },
+  );
+
+  reg(
+    "dataprofile_search",
+    "Substring search over profiled data files (matches relative path, format, and column names). Returns the same schema-only view as dataprofile_list.",
+    z.object({
+      query: z.string().min(1).max(500),
+      limit: z.number().int().min(1).max(2000).optional(),
+    }),
+    async (p) => {
+      const all = await listDataModels();
+      const matches = filterDataModels(all, p.query).slice(0, p.limit ?? 200);
+      return jsonResult({ matches: matches.map(toEnvelope) });
+    },
+  );
+}

package/connectors/dbt/nimbus.extension.json

@@ -0,0 +1,16 @@
+{
+  "id": "com.nimbus.dbt",
+  "displayName": "dbt Cloud",
+  "version": "0.1.0",
+  "description": "dbt Cloud connector (read-only). Surfaces dbt Cloud jobs and their latest run status across accounts via the Administrative API v2 (`/api/v2/accounts/ → /api/v2/accounts/{id}/jobs/`, offset-paged) into the local index as `dbt:job` items (external_id `<accountId>:<jobId>`). Each job carries name, account/project/environment ids, dbt version, state (active/deleted), schedule cron, triggers, created/updated timestamps, the most-recent run status when present, and a canonical dbt Cloud job-UI URL. Authenticates with a dbt Cloud service/user API token sent as `Authorization: Token <token>` (the literal word `Token`, a space, then the raw token — not `Bearer`). Default host `https://cloud.getdbt.com`; regional / custom-access-URL instances (e.g. https://emea.dbt.com, https://au.dbt.com) override `dbt.api_base` — those non-default hosts inherit the same Task-14 runtime-merge follow-up as `sentry.url` (only the SaaS default host is in the static sandbox manifest today). Restrict to a single account via the optional `dbt.account_id` vault key; otherwise all accounts are discovered. v1 indexes jobs + run status only — model-level lineage (`data_model` items with upstream/downstream refs) requires the separate dbt Discovery GraphQL API and is a deferred follow-up. The `dbt.job.trigger` write tool is deferred to Phase 6 behind HITL.",
+  "author": "Nimbus",
+  "entrypoint": "dist/server.js",
+  "runtime": "bun",
+  "permissions": {
+    "network": ["cloud.getdbt.com"],
+    "filesystem": { "read": [], "write": [] }
+  },
+  "hitlRequired": [],
+  "syncInterval": 600,
+  "minNimbusVersion": "0.2.0"
+}

package/connectors/dbt/src/search-filter.ts

@@ -0,0 +1,28 @@
+import {
+  asObjectish,
+  makeQueryFilter,
+  type SearchMatchOptions,
+} from "../../../shared/search-filter.ts";
+
+export type DbtSearchMatchOptions = SearchMatchOptions;
+
+function field(row: Record<string, unknown>, key: string): string {
+  const v = row[key];
+  if (typeof v === "string") {
+    return v;
+  }
+  if (typeof v === "number" && Number.isFinite(v)) {
+    return String(v);
+  }
+  return "";
+}
+
+function fieldsOf(item: unknown): readonly string[] | null {
+  const row = asObjectish(item);
+  if (row === undefined) {
+    return null;
+  }
+  return [field(row, "name"), field(row, "dbt_version"), field(row, "id")];
+}
+
+export const filterDbtJobs = makeQueryFilter(fieldsOf);

package/connectors/dbt/src/server.ts

@@ -0,0 +1,96 @@
+import { z } from "zod";
+import { mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
+import { runReadOnlyMcpConnector } from "../../../shared/run-read-only-mcp-connector.ts";
+import { filterDbtJobs } from "./search-filter.ts";
+
+const DEFAULT_API_BASE = "https://cloud.getdbt.com";
+
+function trimTrailingSlash(s: string): string {
+  return s.endsWith("/") ? s.slice(0, -1) : s;
+}
+
+function apiBase(): string {
+  const v = process.env["DBT_API_BASE"]?.trim();
+  return v === undefined || v === "" ? DEFAULT_API_BASE : trimTrailingSlash(v);
+}
+
+function authHeader(): Record<string, string> {
+  const t = process.env["DBT_TOKEN"]?.trim();
+  if (t === undefined || t === "") {
+    throw new Error("DBT_TOKEN is not set");
+  }
+  return { Authorization: `Token ${t}`, Accept: "application/json" };
+}
+
+async function dbtGet(path: string): Promise<unknown> {
+  const res = await fetch(`${apiBase()}/api/v2${path}`, { headers: authHeader() });
+  const text = await res.text();
+  if (!res.ok) {
+    throw new Error(`dbt Cloud ${String(res.status)}: ${text.slice(0, 400)}`);
+  }
+  return JSON.parse(text) as unknown;
+}
+
+function dataFrom(root: unknown): unknown[] {
+  if (Array.isArray(root)) {
+    return root;
+  }
+  const data = (root as { data?: unknown } | null)?.data;
+  return Array.isArray(data) ? data : [];
+}
+
+await runReadOnlyMcpConnector("nimbus-dbt", (reg) => {
+  reg(
+    "dbt_list",
+    "List dbt Cloud accounts, or jobs for an account. Without `accountId`, returns the account's accounts (`/accounts/`). With `accountId`, returns that account's jobs (`/accounts/{accountId}/jobs/`), capped at `limit` (default 100). Returns the raw dbt Cloud envelope (`{ data: [...] }`).",
+    z.object({
+      accountId: z.number().int().optional(),
+      limit: z.number().int().min(1).max(500).optional(),
+    }),
+    async (p) => {
+      if (p.accountId === undefined) {
+        return jsonResult(await dbtGet("/accounts/"));
+      }
+      const search = new URLSearchParams({ limit: String(p.limit ?? 100) });
+      return jsonResult(
+        await dbtGet(
+          `/accounts/${encodeURIComponent(String(p.accountId))}/jobs/?${search.toString()}`,
+        ),
+      );
+    },
+  );
+
+  reg(
+    "dbt_get",
+    "Fetch one dbt Cloud job by `accountId` + `jobId` (`/accounts/{accountId}/jobs/{jobId}/`). Returns the raw dbt Cloud envelope. Throws when no such job exists.",
+    z.object({
+      accountId: z.number().int(),
+      jobId: z.number().int(),
+    }),
+    async (p) => {
+      return jsonResult(
+        await dbtGet(
+          `/accounts/${encodeURIComponent(String(p.accountId))}/jobs/${encodeURIComponent(String(p.jobId))}/`,
+        ),
+      );
+    },
+  );
+
+  reg(
+    "dbt_search",
+    "Substring search across an account's dbt Cloud jobs. Matches the query against job name, dbt version, and id (case-insensitive). Returns a `{ matches: [...] }` envelope.",
+    z.object({
+      accountId: z.number().int(),
+      query: z.string().min(1),
+      limit: z.number().int().min(1).max(200).optional(),
+    }),
+    async (p) => {
+      const search = new URLSearchParams({ limit: "500" });
+      const root = await dbtGet(
+        `/accounts/${encodeURIComponent(String(p.accountId))}/jobs/?${search.toString()}`,
+      );
+      const matches = filterDbtJobs(dataFrom(root), { query: p.query, limit: p.limit });
+      return jsonResult({ matches });
+    },
+  );
+});