@nimbus-dev/connectors 0.2.1 → 0.2.3

package/connectors/google-photos/src/server.ts

@@ -1,139 +1,9 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { z } from "zod";
-
-import {
-  fetchBearerAuthorizedJson,
-  resolveUrlWithBase,
-} from "../../../shared/fetch-bearer-json.ts";
-import { createRegisterSimpleTool, createZodToolRegistrar } from "../../../shared/mcp-tool-kit.ts";
-import { makeRestToolRegistrar } from "../../../shared/rest-tool-kit.ts";
-
-const PHOTOS_BASE = "https://photoslibrary.googleapis.com/v1";
-
-async function photosFetch(
-  token: string,
-  path: string,
-  init?: RequestInit,
-): Promise<{ ok: boolean; status: number; json: unknown; text: string }> {
-  const url = resolveUrlWithBase(PHOTOS_BASE, path);
-  return fetchBearerAuthorizedJson(url, token, init, { "Content-Type": "application/json" });
-}
+import { registerGooglePhotosTools } from "./tools.ts";
 
 const server = new McpServer({ name: "nimbus-google-photos", version: "0.1.0" });
 
-const registerSimpleTool = createRegisterSimpleTool(server);
-const reg = createZodToolRegistrar(registerSimpleTool);
-
-/** Standard Photos tool: token → photosFetch(buildPath[, buildInit]) → mcpJsonResultIfOk("Google Photos API"). */
-const registerPhotosTool = makeRestToolRegistrar({
-  registrar: reg,
-  tokenEnv: "GOOGLE_OAUTH_ACCESS_TOKEN",
-  serviceLabel: "Google Photos API",
-  fetch: photosFetch,
-});
-
-const gphotosAlbumListArgs = z.object({
-  pageSize: z.number().int().min(1).max(50).optional(),
-  pageToken: z.string().optional(),
-});
-
-registerPhotosTool(
-  "gphotos_album_list",
-  "List Google Photos albums (metadata). Pagination via pageToken.",
-  gphotosAlbumListArgs,
-  (parsed) => {
-    const u = new URL(`${PHOTOS_BASE}/albums`);
-    u.searchParams.set("pageSize", String(parsed.pageSize ?? 25));
-    if (parsed.pageToken !== undefined && parsed.pageToken !== "") {
-      u.searchParams.set("pageToken", parsed.pageToken);
-    }
-    return `${u.pathname}${u.search}`;
-  },
-);
-
-const gphotosAlbumGetArgs = z.object({
-  albumId: z.string().min(1),
-});
-
-registerPhotosTool(
-  "gphotos_album_get",
-  "Get a single album by id (title, mediaItemsCount, coverPhotoBaseUrl).",
-  gphotosAlbumGetArgs,
-  (parsed) => `/albums/${encodeURIComponent(parsed.albumId)}`,
-);
-
-const gphotosMediaListArgs = z.object({
-  albumId: z.string().min(1).optional(),
-  pageSize: z.number().int().min(1).max(100).optional(),
-  pageToken: z.string().optional(),
-});
-
-registerPhotosTool(
-  "gphotos_media_list",
-  "List media items (metadata + baseUrl/productUrl only). Optional albumId scopes to one album.",
-  gphotosMediaListArgs,
-  () => "/mediaItems:search",
-  (parsed) => {
-    const body: Record<string, unknown> = {
-      pageSize: parsed.pageSize ?? 50,
-    };
-    if (parsed.pageToken !== undefined && parsed.pageToken !== "") {
-      body["pageToken"] = parsed.pageToken;
-    }
-    if (parsed.albumId !== undefined && parsed.albumId !== "") {
-      body["albumId"] = parsed.albumId;
-    }
-    return { method: "POST", body: JSON.stringify(body) };
-  },
-);
-
-const gphotosMediaGetArgs = z.object({
-  mediaItemId: z.string().min(1),
-});
-
-registerPhotosTool(
-  "gphotos_media_get",
-  "Get a single media item metadata by id.",
-  gphotosMediaGetArgs,
-  (parsed) => `/mediaItems/${encodeURIComponent(parsed.mediaItemId)}`,
-);
-
-const gphotosMediaSearchArgs = z.object({
-  albumId: z.string().min(1).optional(),
-  pageSize: z.number().int().min(1).max(100).optional(),
-  pageToken: z.string().optional(),
-  includeArchivedMedia: z.boolean().optional(),
-  excludeNonAppCreatedData: z.boolean().optional(),
-});
-
-registerPhotosTool(
-  "gphotos_media_search",
-  "Search media items (metadata only). Optional album filter; supports pagination.",
-  gphotosMediaSearchArgs,
-  () => "/mediaItems:search",
-  (parsed) => {
-    const body: Record<string, unknown> = {
-      pageSize: parsed.pageSize ?? 50,
-    };
-    if (parsed.pageToken !== undefined && parsed.pageToken !== "") {
-      body["pageToken"] = parsed.pageToken;
-    }
-    if (parsed.albumId !== undefined && parsed.albumId !== "") {
-      body["albumId"] = parsed.albumId;
-    }
-    const filters: Record<string, unknown> = {};
-    if (parsed.includeArchivedMedia === true) {
-      filters["includeArchivedMedia"] = true;
-    }
-    if (parsed.excludeNonAppCreatedData === true) {
-      filters["excludeNonAppCreatedData"] = true;
-    }
-    if (Object.keys(filters).length > 0) {
-      body["filters"] = filters;
-    }
-    return { method: "POST", body: JSON.stringify(body) };
-  },
-);
+registerGooglePhotosTools(server);
 
 await server.connect(new StdioServerTransport());

package/connectors/google-photos/src/tools.ts

@@ -0,0 +1,138 @@
+import { z } from "zod";
+import {
+  fetchBearerAuthorizedJson,
+  resolveUrlWithBase,
+} from "../../../shared/fetch-bearer-json.ts";
+import { createRegisterSimpleTool, createZodToolRegistrar } from "../../../shared/mcp-tool-kit.ts";
+import { makeRestToolRegistrar } from "../../../shared/rest-tool-kit.ts";
+
+const PHOTOS_BASE = "https://photoslibrary.googleapis.com/v1";
+
+async function photosFetch(
+  token: string,
+  path: string,
+  init?: RequestInit,
+): Promise<{ ok: boolean; status: number; json: unknown; text: string }> {
+  const url = resolveUrlWithBase(PHOTOS_BASE, path);
+  return fetchBearerAuthorizedJson(url, token, init, { "Content-Type": "application/json" });
+}
+
+/**
+ * The `mediaItems:search` body both media tools start from: the page size (default 50), then the
+ * page token and the album scope, each only when non-empty.
+ */
+function mediaSearchBody(parsed: {
+  readonly pageSize?: number | undefined;
+  readonly pageToken?: string | undefined;
+  readonly albumId?: string | undefined;
+}): Record<string, unknown> {
+  const body: Record<string, unknown> = {
+    pageSize: parsed.pageSize ?? 50,
+  };
+  if (parsed.pageToken !== undefined && parsed.pageToken !== "") {
+    body["pageToken"] = parsed.pageToken;
+  }
+  if (parsed.albumId !== undefined && parsed.albumId !== "") {
+    body["albumId"] = parsed.albumId;
+  }
+  return body;
+}
+
+export function registerGooglePhotosTools(server: { tool: (...args: never) => unknown }): void {
+  const registerSimpleTool = createRegisterSimpleTool(server);
+  const reg = createZodToolRegistrar(registerSimpleTool);
+
+  /** Standard Photos tool: token → photosFetch(buildPath[, buildInit]) → mcpJsonResultIfOk("Google Photos API"). */
+  const registerPhotosTool = makeRestToolRegistrar({
+    registrar: reg,
+    tokenEnv: "GOOGLE_OAUTH_ACCESS_TOKEN",
+    serviceLabel: "Google Photos API",
+    fetch: photosFetch,
+  });
+
+  const gphotosAlbumListArgs = z.object({
+    pageSize: z.number().int().min(1).max(50).optional(),
+    pageToken: z.string().optional(),
+  });
+
+  registerPhotosTool(
+    "gphotos_album_list",
+    "List Google Photos albums (metadata). Pagination via pageToken.",
+    gphotosAlbumListArgs,
+    (parsed) => {
+      const u = new URL(`${PHOTOS_BASE}/albums`);
+      u.searchParams.set("pageSize", String(parsed.pageSize ?? 25));
+      if (parsed.pageToken !== undefined && parsed.pageToken !== "") {
+        u.searchParams.set("pageToken", parsed.pageToken);
+      }
+      // Relative to PHOTOS_BASE, like every other tool here: the fetcher prefixes the base, which
+      // already ends in /v1, so returning `u.pathname` requested /v1/v1/albums.
+      return `/albums${u.search}`;
+    },
+  );
+
+  const gphotosAlbumGetArgs = z.object({
+    albumId: z.string().min(1),
+  });
+
+  registerPhotosTool(
+    "gphotos_album_get",
+    "Get a single album by id (title, mediaItemsCount, coverPhotoBaseUrl).",
+    gphotosAlbumGetArgs,
+    (parsed) => `/albums/${encodeURIComponent(parsed.albumId)}`,
+  );
+
+  const gphotosMediaListArgs = z.object({
+    albumId: z.string().min(1).optional(),
+    pageSize: z.number().int().min(1).max(100).optional(),
+    pageToken: z.string().optional(),
+  });
+
+  registerPhotosTool(
+    "gphotos_media_list",
+    "List media items (metadata + baseUrl/productUrl only). Optional albumId scopes to one album.",
+    gphotosMediaListArgs,
+    () => "/mediaItems:search",
+    (parsed) => ({ method: "POST", body: JSON.stringify(mediaSearchBody(parsed)) }),
+  );
+
+  const gphotosMediaGetArgs = z.object({
+    mediaItemId: z.string().min(1),
+  });
+
+  registerPhotosTool(
+    "gphotos_media_get",
+    "Get a single media item metadata by id.",
+    gphotosMediaGetArgs,
+    (parsed) => `/mediaItems/${encodeURIComponent(parsed.mediaItemId)}`,
+  );
+
+  const gphotosMediaSearchArgs = z.object({
+    albumId: z.string().min(1).optional(),
+    pageSize: z.number().int().min(1).max(100).optional(),
+    pageToken: z.string().optional(),
+    includeArchivedMedia: z.boolean().optional(),
+    excludeNonAppCreatedData: z.boolean().optional(),
+  });
+
+  registerPhotosTool(
+    "gphotos_media_search",
+    "Search media items (metadata only). Optional album filter; supports pagination.",
+    gphotosMediaSearchArgs,
+    () => "/mediaItems:search",
+    (parsed) => {
+      const body = mediaSearchBody(parsed);
+      const filters: Record<string, unknown> = {};
+      if (parsed.includeArchivedMedia === true) {
+        filters["includeArchivedMedia"] = true;
+      }
+      if (parsed.excludeNonAppCreatedData === true) {
+        filters["excludeNonAppCreatedData"] = true;
+      }
+      if (Object.keys(filters).length > 0) {
+        body["filters"] = filters;
+      }
+      return { method: "POST", body: JSON.stringify(body) };
+    },
+  );
+}

package/connectors/grafana/src/server.ts

@@ -1,61 +1,10 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { z } from "zod";
-
-import {
-  createRegisterSimpleTool,
-  createZodToolRegistrar,
-  mcpJsonResult as jsonResult,
-} from "../../../shared/mcp-tool-kit.ts";
-
-function baseUrl(): string {
-  const u = process.env["GRAFANA_URL"]?.trim();
-  if (u === undefined || u === "") {
-    throw new Error("GRAFANA_URL is not set");
-  }
-  return u.replace(/\/$/, "");
-}
-
-function authHeaders(): Record<string, string> {
-  const tok = process.env["GRAFANA_API_TOKEN"]?.trim();
-  if (tok === undefined || tok === "") {
-    throw new Error("GRAFANA_API_TOKEN is not set");
-  }
-  return { Authorization: `Bearer ${tok}`, Accept: "application/json" };
-}
-
-async function grafanaGet(path: string): Promise<unknown> {
-  const pathPart = path.startsWith("/") ? path : `/${path}`;
-  const res = await fetch(`${baseUrl()}${pathPart}`, {
-    headers: authHeaders(),
-  });
-  const text = await res.text();
-  if (!res.ok) {
-    throw new Error(`Grafana ${String(res.status)}: ${text.slice(0, 400)}`);
-  }
-  try {
-    return JSON.parse(text) as unknown;
-  } catch {
-    return { raw: text };
-  }
-}
+import { registerGrafanaTools } from "./tools.ts";
 
 const mcp = new McpServer({ name: "nimbus-grafana", version: "0.1.0" });
-const reg = createZodToolRegistrar(createRegisterSimpleTool(mcp));
-
-reg("grafana_alert_list", "List alert rules (Ruler API).", z.object({}), async () =>
-  jsonResult(await grafanaGet("/api/ruler/grafana/api/v1/rules")),
-);
 
-reg(
-  "grafana_dashboard_list",
-  "Search dashboards.",
-  z.object({ query: z.string().optional() }),
-  async (p) => {
-    const q = p.query ?? "";
-    return jsonResult(await grafanaGet(`/api/search?type=dash-db&query=${encodeURIComponent(q)}`));
-  },
-);
+registerGrafanaTools(mcp);
 
 const transport = new StdioServerTransport();
 await mcp.connect(transport);

package/connectors/grafana/src/tools.ts

@@ -0,0 +1,53 @@
+import { z } from "zod";
+import { envAuthHeaders, requiredEnv } from "../../../shared/env-json-api.ts";
+import {
+  createRegisterSimpleTool,
+  createZodToolRegistrar,
+  mcpJsonResult as jsonResult,
+} from "../../../shared/mcp-tool-kit.ts";
+
+/** Only ONE trailing slash is dropped here — not `requiredBaseUrl`'s strip-them-all. */
+function baseUrl(): string {
+  return requiredEnv("GRAFANA_URL").replace(/\/$/, "");
+}
+
+const authHeaders = envAuthHeaders({ env: "GRAFANA_API_TOKEN" });
+
+async function grafanaGet(path: string): Promise<unknown> {
+  const pathPart = path.startsWith("/") ? path : `/${path}`;
+  const res = await fetch(`${baseUrl()}${pathPart}`, {
+    headers: authHeaders(),
+  });
+  const text = await res.text();
+  if (!res.ok) {
+    throw new Error(`Grafana ${String(res.status)}: ${text.slice(0, 400)}`);
+  }
+  try {
+    return JSON.parse(text) as unknown;
+  } catch {
+    return { raw: text };
+  }
+}
+
+/** Tool names exposed by this connector — for contract/introspection tests. */
+export const GRAFANA_TOOL_NAMES = ["grafana_alert_list", "grafana_dashboard_list"] as const;
+
+export function registerGrafanaTools(server: { tool: (...args: never) => unknown }): void {
+  const reg = createZodToolRegistrar(createRegisterSimpleTool(server));
+
+  reg("grafana_alert_list", "List alert rules (Ruler API).", z.object({}), async () =>
+    jsonResult(await grafanaGet("/api/ruler/grafana/api/v1/rules")),
+  );
+
+  reg(
+    "grafana_dashboard_list",
+    "Search dashboards.",
+    z.object({ query: z.string().optional() }),
+    async (p) => {
+      const q = p.query ?? "";
+      return jsonResult(
+        await grafanaGet(`/api/search?type=dash-db&query=${encodeURIComponent(q)}`),
+      );
+    },
+  );
+}

package/connectors/great-expectations/src/gx-parse.ts

@@ -1,5 +1,8 @@
-import { readdir, readFile } from "node:fs/promises";
-import { isAbsolute, join, relative, resolve, sep } from "node:path";
+import { readFile } from "node:fs/promises";
+import { relative, resolve } from "node:path";
+import { isRecord } from "../../../shared/cli-json-kit.ts";
+import { requiredEnv } from "../../../shared/env-json-api.ts";
+import { assertWithinDir, byExtension, walkFiles } from "../../../shared/walk-files.ts";
 
 /**
  * Tier-3 no-row-data reader for Great Expectations validation-result JSON
@@ -53,10 +56,6 @@ export interface GxExpectationMeta {
   readonly sourceFile: string;
 }
 
-function isRecord(v: unknown): v is Record<string, unknown> {
-  return v !== null && typeof v === "object" && !Array.isArray(v);
-}
-
 function strField(r: Record<string, unknown>, key: string): string | null {
   const v = r[key];
   return typeof v === "string" && v !== "" ? v : null;
@@ -206,11 +205,7 @@ export function parseValidationResult(parsed: unknown, sourceFile: string): GxEx
  * so the MCP tools surface a clear error rather than reading an empty path.
  */
 export function resultsDir(): string {
-  const dir = process.env["GREAT_EXPECTATIONS_RESULTS_DIR"]?.trim();
-  if (dir === undefined || dir === "") {
-    throw new Error("GREAT_EXPECTATIONS_RESULTS_DIR is not set");
-  }
-  return resolve(dir);
+  return resolve(requiredEnv("GREAT_EXPECTATIONS_RESULTS_DIR"));
 }
 
 /**
@@ -219,42 +214,16 @@ export function resultsDir(): string {
  * is the filesystem analog of the argv flag-smuggling guard.
  */
 export function assertWithinResultsDir(candidate: string, root: string): void {
-  const rel = relative(root, candidate);
-  if (rel === "") {
-    return; // the dir itself
-  }
-  if (rel.startsWith("..") || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
-    throw new Error("path escapes the configured Great Expectations results dir");
-  }
+  assertWithinDir(candidate, root, "the configured Great Expectations results dir");
 }
 
 /** Recursively collect `*.json` artefact paths under `root` (bounded). */
-async function collectJsonFiles(root: string): Promise<string[]> {
-  const found: string[] = [];
-  async function walk(dir: string, depth: number): Promise<void> {
-    if (depth > MAX_WALK_DEPTH || found.length >= MAX_FILES) {
-      return;
-    }
-    let entries: import("node:fs").Dirent[];
-    try {
-      entries = await readdir(dir, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    for (const entry of entries) {
-      if (found.length >= MAX_FILES) {
-        return;
-      }
-      const full = join(dir, entry.name);
-      if (entry.isDirectory()) {
-        await walk(full, depth + 1);
-      } else if (entry.isFile() && entry.name.toLowerCase().endsWith(".json")) {
-        found.push(full);
-      }
-    }
-  }
-  await walk(root, 0);
-  return found;
+function collectJsonFiles(root: string): Promise<string[]> {
+  return walkFiles(root, {
+    maxFiles: MAX_FILES,
+    maxDepth: MAX_WALK_DEPTH,
+    select: byExtension(".json"),
+  });
 }
 
 async function readArtefact(path: string): Promise<unknown> {
@@ -282,7 +251,7 @@ export async function listAllExpectations(): Promise<GxExpectationMeta[]> {
   const out: GxExpectationMeta[] = [];
   for (const file of files) {
     assertWithinResultsDir(file, root);
-    const parsed = await readArtefact(file);
+    const parsed = await readArtefact(file); // NOSONAR S9382: one artefact at a time on purpose — up to MAX_FILES (1000) files, each read whole before the 4 MiB cap is checked, so a fan-out would open a thousand descriptors and buffer every artefact at once.
     if (parsed === null) {
       continue;
     }

package/connectors/greenhouse/src/server.ts

@@ -1,67 +1,6 @@
-import { z } from "zod";
-import { matchesResult, searchToolInputSchema } from "../../../shared/mcp-search-tool.ts";
-import {
-  encodeBasicAuthHeader,
-  mcpJsonResult as jsonResult,
-} from "../../../shared/mcp-tool-kit.ts";
 import { runReadOnlyMcpConnector } from "../../../shared/run-read-only-mcp-connector.ts";
-import { filterGreenhouseJobs } from "./search-filter.ts";
-
-const BASE = "https://harvest.greenhouse.io";
-
-function apiKey(): string {
-  const t = process.env["GREENHOUSE_API_KEY"]?.trim();
-  if (t === undefined || t === "") {
-    throw new Error("GREENHOUSE_API_KEY is not set");
-  }
-  return t;
-}
-
-function authHeader(): Record<string, string> {
-  return { Authorization: encodeBasicAuthHeader(apiKey(), ""), Accept: "application/json" };
-}
-
-async function greenhouseGet(path: string): Promise<unknown> {
-  const res = await fetch(`${BASE}${path}`, { headers: authHeader() });
-  const text = await res.text();
-  if (!res.ok) {
-    throw new Error(`Greenhouse ${String(res.status)}: ${text.slice(0, 400)}`);
-  }
-  return JSON.parse(text) as unknown;
-}
+import { registerGreenhouseTools } from "./tools.ts";
 
 await runReadOnlyMcpConnector("nimbus-greenhouse", (reg) => {
-  reg(
-    "greenhouse_list",
-    "List the company's Greenhouse Harvest job openings (`GET /v1/jobs?per_page=100`). Returns a bare JSON array of job objects (NOT an envelope), each carrying the name, status, requisition id, departments, and offices.",
-    z.object({
-      per_page: z.number().int().min(1).max(100).optional(),
-    }),
-    async (p) => {
-      const search = new URLSearchParams({ per_page: String(p.per_page ?? 100), page: "1" });
-      return jsonResult(await greenhouseGet(`/v1/jobs?${search.toString()}`));
-    },
-  );
-
-  reg(
-    "greenhouse_get",
-    "Fetch one Greenhouse job by its id (`GET /v1/jobs/{id}`). Returns the job object directly. Throws when no match is found.",
-    z.object({
-      id: z.string().min(1),
-    }),
-    async (p) => {
-      return jsonResult(await greenhouseGet(`/v1/jobs/${encodeURIComponent(p.id)}`));
-    },
-  );
-
-  reg(
-    "greenhouse_search",
-    "Substring search across the company's Greenhouse job openings (first page only). Matches the query against the job name, status, requisition id, the department names, and the office names + locations (case-insensitive). Returns a `{ matches: [...] }` envelope.",
-    searchToolInputSchema(100),
-    async (p) => {
-      const search = new URLSearchParams({ per_page: "100", page: "1" });
-      const root = await greenhouseGet(`/v1/jobs?${search.toString()}`);
-      return matchesResult(root, filterGreenhouseJobs, p);
-    },
-  );
+  registerGreenhouseTools(reg);
 });

package/connectors/greenhouse/src/tools.ts

@@ -0,0 +1,68 @@
+import { z } from "zod";
+import { createJsonGetter, requiredEnv } from "../../../shared/env-json-api.ts";
+import { matchesResult, searchToolInputSchema } from "../../../shared/mcp-search-tool.ts";
+import {
+  encodeBasicAuthHeader,
+  mcpJsonResult as jsonResult,
+} from "../../../shared/mcp-tool-kit.ts";
+import type { ZodToolRegistrar } from "../../../shared/run-read-only-mcp-connector.ts";
+import { filterGreenhouseJobs } from "./search-filter.ts";
+
+const BASE = "https://harvest.greenhouse.io";
+
+/** HTTP Basic with the API key as the username and an empty password. */
+function authHeader(): Record<string, string> {
+  return {
+    Authorization: encodeBasicAuthHeader(requiredEnv("GREENHOUSE_API_KEY"), ""),
+    Accept: "application/json",
+  };
+}
+
+const greenhouseGet = createJsonGetter({
+  base: BASE,
+  label: "Greenhouse",
+  headers: authHeader,
+});
+
+/** Tool names exposed by this connector — for contract/introspection tests. */
+export const GREENHOUSE_TOOL_NAMES = [
+  "greenhouse_list",
+  "greenhouse_get",
+  "greenhouse_search",
+] as const;
+
+export function registerGreenhouseTools(reg: ZodToolRegistrar): void {
+  reg(
+    "greenhouse_list",
+    "List the company's Greenhouse Harvest job openings (`GET /v1/jobs?per_page=100`). Returns a bare JSON array of job objects (NOT an envelope), each carrying the name, status, requisition id, departments, and offices.",
+    z.object({
+      per_page: z.number().int().min(1).max(100).optional(),
+    }),
+    async (p) => {
+      const search = new URLSearchParams({ per_page: String(p.per_page ?? 100), page: "1" });
+      return jsonResult(await greenhouseGet(`/v1/jobs?${search.toString()}`));
+    },
+  );
+
+  reg(
+    "greenhouse_get",
+    "Fetch one Greenhouse job by its id (`GET /v1/jobs/{id}`). Returns the job object directly. Throws when no match is found.",
+    z.object({
+      id: z.string().min(1),
+    }),
+    async (p) => {
+      return jsonResult(await greenhouseGet(`/v1/jobs/${encodeURIComponent(p.id)}`));
+    },
+  );
+
+  reg(
+    "greenhouse_search",
+    "Substring search across the company's Greenhouse job openings (first page only). Matches the query against the job name, status, requisition id, the department names, and the office names + locations (case-insensitive). Returns a `{ matches: [...] }` envelope.",
+    searchToolInputSchema(100),
+    async (p) => {
+      const search = new URLSearchParams({ per_page: "100", page: "1" });
+      const root = await greenhouseGet(`/v1/jobs?${search.toString()}`);
+      return matchesResult(root, filterGreenhouseJobs, p);
+    },
+  );
+}