@nimbus-dev/connectors 0.9.0 → 0.10.0

package/connectors/bitrise/nimbus.extension.json

@@ -2,14 +2,14 @@
   "id": "com.nimbus.bitrise",
   "displayName": "Bitrise",
   "version": "0.1.0",
-  "description": "Bitrise REST connector (mobile CI builds + apps). Read-only; surfaces build status, workflow id, branch and commit so the local index can correlate mobile CI runs back to PRs and incidents.",
+  "description": "Bitrise REST connector (mobile CI builds + apps). Surfaces build status, workflow id, branch and commit so the local index can correlate mobile CI runs back to PRs and incidents. Write tool (needs owner approval): `bitrise.build.trigger`.",
   "author": "Nimbus",
   "entrypoint": "dist/server.js",
   "runtime": "bun",
   "permissions": {
     "network": ["api.bitrise.io"]
   },
-  "hitlRequired": [],
+  "hitlRequired": ["write"],
   "syncInterval": 600,
   "minNimbusVersion": "0.2.0"
 }

package/connectors/bitrise/src/server.ts

@@ -1,6 +1,14 @@
-import { runReadOnlyMcpConnector } from "../../../shared/run-read-only-mcp-connector.ts";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { registerBitriseTools } from "./tools.ts";
 
-await runReadOnlyMcpConnector("nimbus-bitrise", (reg) => {
-  registerBitriseTools(reg);
-});
+const server = new McpServer(
+  { name: "nimbus-bitrise", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
+
+registerBitriseTools(server);
+
+const transport = new StdioServerTransport();
+await server.connect(transport);

package/connectors/bitrise/src/tools.ts

@@ -1,22 +1,80 @@
 import { z } from "zod";
-import { createJsonGetter, envAuthHeaders } from "../../../shared/env-json-api.ts";
+import { capText } from "../../../shared/cap-text.ts";
+import { type ConsentServer, createWriteToolRegistrar } from "../../../shared/consent-kit.ts";
+import {
+  createJsonGetter,
+  createJsonSender,
+  envAuthHeaders,
+  type JsonApiConfig,
+} from "../../../shared/env-json-api.ts";
+import { isSafeGitRef } from "../../../shared/github-rest.ts";
 import { matchesResult } from "../../../shared/mcp-search-tool.ts";
-import { mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
-import type { ZodToolRegistrar } from "../../../shared/run-read-only-mcp-connector.ts";
+import {
+  createRegisterSimpleTool,
+  createZodToolRegistrar,
+  mcpJsonResult as jsonResult,
+} from "../../../shared/mcp-tool-kit.ts";
 import { filterBitriseBuilds } from "./search-filter.ts";
 
 const BITRISE_API = "https://api.bitrise.io";
 
-const bitriseGet = createJsonGetter({
+const api: JsonApiConfig = {
   base: BITRISE_API,
   label: "Bitrise",
   headers: envAuthHeaders({ env: "BITRISE_TOKEN", scheme: "" }),
-});
+};
+
+const bitriseGet = createJsonGetter(api);
+// A mutation's 3xx is refused (never followed), so the token is not replayed anywhere.
+const bitriseSend = createJsonSender(api);
 
 /** Tool names exposed by this connector — for contract/introspection tests. */
-export const BITRISE_TOOL_NAMES = ["bitrise_get", "bitrise_list", "bitrise_search"] as const;
+export const BITRISE_TOOL_NAMES = [
+  "bitrise_list",
+  "bitrise_get",
+  "bitrise_search",
+  "bitrise_build_latest",
+  "bitrise_build_trigger",
+] as const;
+
+/** An app slug: never `.` or `..` (a URL parser collapses them out of the path). */
+const appSlugArg = z
+  .string()
+  .regex(/^(?!\.{1,2}$)[A-Za-z0-9._-]{1,128}$/, "letters, digits, '.', '_' and '-' only");
+
+const workflowArg = z
+  .string()
+  .regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/, "letters, digits, '.', '_' and '-' only");
+
+type Obj = Record<string, unknown>;
+
+function asObj(v: unknown): Obj {
+  return typeof v === "object" && v !== null && !Array.isArray(v) ? (v as Obj) : {};
+}
+
+function str(v: unknown): string | undefined {
+  return typeof v === "string" && v !== "" ? v : undefined;
+}
+
+/**
+ * The slug of the build a trigger started. The reply's `build_slug` is deprecated beside `slug`;
+ * read the root `build_slug`, then `slug`, then `results[0].build_slug`. Never `build_url`.
+ */
+function builtSlug(reply: Obj): string | null {
+  const first = Array.isArray(reply["results"]) ? asObj(reply["results"][0]) : {};
+  return str(reply["build_slug"]) ?? str(reply["slug"]) ?? str(first["build_slug"]) ?? null;
+}
+
+export function registerBitriseTools(
+  server: ConsentServer & { tool: (...args: never) => unknown },
+): void {
+  const reg = createZodToolRegistrar(createRegisterSimpleTool(server));
+  const registerWriteTool = createWriteToolRegistrar(server, {
+    connector: "bitrise",
+    scopeEnv: "NIMBUS_MCP_BITRISE_WRITE_SCOPE",
+    scopeKinds: ["app"],
+  });
 
-export function registerBitriseTools(reg: ZodToolRegistrar): void {
   reg(
     "bitrise_list",
     "List Bitrise resources. When `appSlug` is omitted, returns the user's accessible apps via `/v0.1/me/apps`. When `appSlug` is provided, returns the app's recent builds via `/v0.1/apps/<slug>/builds` (status filter and limit optional).",
@@ -73,4 +131,77 @@ export function registerBitriseTools(reg: ZodToolRegistrar): void {
       return matchesResult(data, filterBitriseBuilds, p);
     },
   );
+
+  reg(
+    "bitrise_build_latest",
+    "Read an app's most recent Bitrise build (`GET /v0.1/apps/{appSlug}/builds?limit=1`), optionally of one `branch` and/or `workflow`, projected to `{ build: { slug, status, status_text, branch, triggered_workflow, triggered_at, finished_at } | null }`. `bitrise_list` has no branch or workflow filter.",
+    z.object({
+      appSlug: appSlugArg,
+      branch: z.string().min(1).max(255).optional(),
+      workflow: workflowArg.optional(),
+    }),
+    async (p) => {
+      const search = new URLSearchParams({ limit: "1" });
+      if (p.branch !== undefined) {
+        search.set("branch", p.branch);
+      }
+      if (p.workflow !== undefined) {
+        search.set("workflow", p.workflow);
+      }
+      const root = asObj(
+        await bitriseGet(`/v0.1/apps/${encodeURIComponent(p.appSlug)}/builds?${search.toString()}`),
+      );
+      const first = Array.isArray(root["data"]) ? asObj(root["data"][0]) : {};
+      const slug = str(first["slug"]);
+      return jsonResult({
+        build:
+          slug === undefined
+            ? null
+            : {
+                slug,
+                status: first["status"],
+                status_text: capText(first["status_text"]),
+                branch: capText(first["branch"]),
+                triggered_workflow: capText(first["triggered_workflow"]),
+                triggered_at: capText(first["triggered_at"]),
+                finished_at: capText(first["finished_at"]),
+              },
+      });
+    },
+  );
+
+  registerWriteTool(
+    "bitrise_build_trigger",
+    {
+      mutates: "bitrise.build.trigger",
+      // A build can be aborted in Bitrise; it deletes nothing.
+      recoverable: true,
+      scopeTargetOf: (p: { appSlug: string }) => ({ kind: "app", value: p.appSlug }),
+    },
+    'Start a Bitrise build of one workflow on one branch (`POST /v0.1/apps/{appSlug}/builds`, body `{ hook_info: { type: "bitrise" }, build_params: { branch, workflow_id } }`). The reply is `accepted` with the new build\'s slug (read from `build_slug`, else `slug`, else `results[0].build_slug`): Bitrise runs it afterwards, so poll `bitrise_get` with that slug.',
+    z.object({
+      appSlug: appSlugArg,
+      branch: z.string().min(1).max(255),
+      workflow: workflowArg,
+    }),
+    async (p) => {
+      if (!isSafeGitRef(p.branch)) {
+        throw new Error("branch is not a safe git ref; nothing was sent");
+      }
+      const reply = asObj(
+        await bitriseSend("POST", `/v0.1/apps/${encodeURIComponent(p.appSlug)}/builds`, {
+          hook_info: { type: "bitrise" },
+          build_params: { branch: p.branch, workflow_id: p.workflow },
+        }),
+      );
+      return jsonResult({
+        ok: true,
+        status: "accepted",
+        appSlug: p.appSlug,
+        branch: p.branch,
+        workflow: p.workflow,
+        buildSlug: builtSlug(reply),
+      });
+    },
+  );
 }

package/connectors/codemagic/nimbus.extension.json

@@ -2,14 +2,14 @@
   "id": "com.nimbus.codemagic",
   "displayName": "Codemagic",
   "version": "0.1.0",
-  "description": "Codemagic REST connector (mobile CI/CD builds + apps). Read-only; surfaces build status, workflow id, branch and commit so the local index can correlate mobile CI runs back to PRs and incidents.",
+  "description": "Codemagic REST connector (mobile CI/CD builds + apps). Surfaces build status, workflow id, branch and commit so the local index can correlate mobile CI runs back to PRs and incidents. Write tool (needs owner approval): `codemagic.build.trigger`.",
   "author": "Nimbus",
   "entrypoint": "dist/server.js",
   "runtime": "bun",
   "permissions": {
     "network": ["api.codemagic.io"]
   },
-  "hitlRequired": [],
+  "hitlRequired": ["write"],
   "syncInterval": 600,
   "minNimbusVersion": "0.2.0"
 }

package/connectors/codemagic/src/server.ts

@@ -1,6 +1,14 @@
-import { runReadOnlyMcpConnector } from "../../../shared/run-read-only-mcp-connector.ts";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { registerCodemagicTools } from "./tools.ts";
 
-await runReadOnlyMcpConnector("nimbus-codemagic", (reg) => {
-  registerCodemagicTools(reg);
-});
+const server = new McpServer(
+  { name: "nimbus-codemagic", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
+
+registerCodemagicTools(server);
+
+const transport = new StdioServerTransport();
+await server.connect(transport);

package/connectors/codemagic/src/tools.ts

@@ -1,26 +1,87 @@
 import { z } from "zod";
-import { createJsonGetter, envAuthHeaders } from "../../../shared/env-json-api.ts";
+import { capText } from "../../../shared/cap-text.ts";
+import { type ConsentServer, createWriteToolRegistrar } from "../../../shared/consent-kit.ts";
+import {
+  createJsonGetter,
+  createJsonSender,
+  envAuthHeaders,
+  type JsonApiConfig,
+} from "../../../shared/env-json-api.ts";
+import { isSafeGitRef } from "../../../shared/github-rest.ts";
 import { matchesResult } from "../../../shared/mcp-search-tool.ts";
-import { mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
-import type { ZodToolRegistrar } from "../../../shared/run-read-only-mcp-connector.ts";
+import {
+  createRegisterSimpleTool,
+  createZodToolRegistrar,
+  mcpJsonResult as jsonResult,
+} from "../../../shared/mcp-tool-kit.ts";
 import { filterCodemagicBuilds } from "./search-filter.ts";
 
 const CODEMAGIC_API = "https://api.codemagic.io";
 
-const codemagicGet = createJsonGetter({
+const api: JsonApiConfig = {
   base: CODEMAGIC_API,
   label: "Codemagic",
   headers: envAuthHeaders({ env: "CODEMAGIC_TOKEN", scheme: "", header: "x-auth-token" }),
-});
+};
+
+const codemagicGet = createJsonGetter(api);
+// A mutation's 3xx is refused (never followed), so the token is not replayed anywhere.
+const codemagicSend = createJsonSender(api);
 
 /** Tool names exposed by this connector — for contract/introspection tests. */
 export const CODEMAGIC_TOOL_NAMES = [
   "codemagic_list",
   "codemagic_get",
   "codemagic_search",
+  "codemagic_build_latest",
+  "codemagic_build_trigger",
 ] as const;
 
-export function registerCodemagicTools(reg: ZodToolRegistrar): void {
+/** Codemagic app and workflow ids: letters, digits, `.`, `_`, `-`; never a dot segment. */
+const idArg = z
+  .string()
+  .regex(/^(?!\.{1,2}$)[A-Za-z0-9._-]{1,128}$/, "letters, digits, '.', '_' and '-' only");
+
+type Obj = Record<string, unknown>;
+
+function asObj(v: unknown): Obj {
+  return typeof v === "object" && v !== null && !Array.isArray(v) ? (v as Obj) : {};
+}
+
+function str(v: unknown): string | undefined {
+  return typeof v === "string" && v !== "" ? v : undefined;
+}
+
+/**
+ * A build reduced to a fixed field set. Everything else Codemagic returns (artefacts, config,
+ * commit and workflow settings) is dropped, and so is any unknown field. The field names are
+ * Codemagic's and are not verified against a live account.
+ */
+function projectBuild(b: Obj): Obj {
+  const scalar = (v: unknown): string | number | undefined =>
+    typeof v === "number" ? v : capText(v);
+  return {
+    id: capText(b["_id"]) ?? capText(b["id"]),
+    status: capText(b["status"]),
+    branch: capText(b["branch"]),
+    workflowId: capText(b["workflowId"]),
+    index: scalar(b["index"]),
+    createdAt: scalar(b["createdAt"]),
+    startedAt: scalar(b["startedAt"]),
+    finishedAt: scalar(b["finishedAt"]),
+  };
+}
+
+export function registerCodemagicTools(
+  server: ConsentServer & { tool: (...args: never) => unknown },
+): void {
+  const reg = createZodToolRegistrar(createRegisterSimpleTool(server));
+  const registerWriteTool = createWriteToolRegistrar(server, {
+    connector: "codemagic",
+    scopeEnv: "NIMBUS_MCP_CODEMAGIC_WRITE_SCOPE",
+    scopeKinds: ["app"],
+  });
+
   reg(
     "codemagic_list",
     "List Codemagic resources. When `appId` is omitted, returns the user's accessible apps via `/apps`. When `appId` is provided, returns the app's recent builds via `/builds?appId=<id>` (limit optional).",
@@ -68,4 +129,67 @@ export function registerCodemagicTools(reg: ZodToolRegistrar): void {
       return matchesResult(builds, filterCodemagicBuilds, p);
     },
   );
+
+  reg(
+    "codemagic_build_latest",
+    "Read an app's most recent Codemagic build, optionally of one `workflowId` and/or `branch`: the app's last 50 builds (`GET /builds?appId=<id>&limit=50`) filtered here, newest first. Returns `{ build: { id, status, branch, workflowId, index, createdAt, startedAt, finishedAt } | null, scanned }`; every other field is dropped. The field names are Codemagic's own and unverified.",
+    z.object({
+      appId: idArg,
+      workflowId: idArg.optional(),
+      branch: z.string().min(1).max(255).optional(),
+    }),
+    async (p) => {
+      const root = asObj(
+        await codemagicGet(`/builds?appId=${encodeURIComponent(p.appId)}&limit=50`),
+      );
+      const builds = Array.isArray(root["builds"]) ? root["builds"] : [];
+      const match = builds.find((raw) => {
+        const b = asObj(raw);
+        return (
+          (p.workflowId === undefined || b["workflowId"] === p.workflowId) &&
+          (p.branch === undefined || b["branch"] === p.branch)
+        );
+      });
+      return jsonResult({
+        build: match === undefined ? null : projectBuild(asObj(match)),
+        scanned: builds.length,
+      });
+    },
+  );
+
+  registerWriteTool(
+    "codemagic_build_trigger",
+    {
+      mutates: "codemagic.build.trigger",
+      // A build can be cancelled in Codemagic; it deletes nothing.
+      recoverable: true,
+      scopeTargetOf: (p: { appId: string }) => ({ kind: "app", value: p.appId }),
+    },
+    "Start a Codemagic build of one workflow on one branch (`POST /builds`, body `{ appId, workflowId, branch }`). Triggers and branch settings in codemagic.yaml are not applied to an API build. The reply is `accepted` with the build id: Codemagic runs it afterwards, so poll `codemagic_get` with that id.",
+    z.object({
+      appId: idArg,
+      workflowId: idArg,
+      branch: z.string().min(1).max(255),
+    }),
+    async (p) => {
+      if (!isSafeGitRef(p.branch)) {
+        throw new Error("branch is not a safe git ref; nothing was sent");
+      }
+      const reply = asObj(
+        await codemagicSend("POST", "/builds", {
+          appId: p.appId,
+          workflowId: p.workflowId,
+          branch: p.branch,
+        }),
+      );
+      return jsonResult({
+        ok: true,
+        status: "accepted",
+        appId: p.appId,
+        workflowId: p.workflowId,
+        branch: p.branch,
+        buildId: str(reply["buildId"]) ?? null,
+      });
+    },
+  );
 }

package/connectors/firebase/nimbus.extension.json

@@ -2,14 +2,14 @@
   "id": "com.nimbus.firebase",
   "displayName": "Firebase App Distribution",
   "version": "0.1.0",
-  "description": "Firebase App Distribution connector (read-only). Surfaces each configured app's recent releases (display/build version, release notes, create time, console + testing URIs) so the local index can correlate mobile beta releases back to builds and incidents. Binary download links are stored as metadata but never fetched.",
+  "description": "Firebase App Distribution connector. Surfaces each configured app's recent releases (display/build version, release notes, create time, console + testing URIs) so the local index can correlate mobile beta releases back to builds and incidents. Binary download links are stored as metadata but never fetched. Write tool (needs owner approval): `firebase.release.distribute`, which invites testers by email.",
   "author": "Nimbus",
   "entrypoint": "dist/server.js",
   "runtime": "bun",
   "permissions": {
     "network": ["firebaseappdistribution.googleapis.com", "oauth2.googleapis.com"]
   },
-  "hitlRequired": [],
+  "hitlRequired": ["write"],
   "syncInterval": 600,
   "minNimbusVersion": "0.2.0"
 }

package/connectors/firebase/src/server.ts

@@ -1,6 +1,14 @@
-import { runReadOnlyMcpConnector } from "../../../shared/run-read-only-mcp-connector.ts";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CONSENT_SERVER_CAPABILITIES } from "../../../shared/consent-kit.ts";
 import { registerFirebaseTools } from "./tools.ts";
 
-await runReadOnlyMcpConnector("nimbus-firebase", (reg) => {
-  registerFirebaseTools(reg);
-});
+const server = new McpServer(
+  { name: "nimbus-firebase", version: "0.1.0" },
+  { capabilities: CONSENT_SERVER_CAPABILITIES },
+);
+
+registerFirebaseTools(server);
+
+const transport = new StdioServerTransport();
+await server.connect(transport);

package/connectors/firebase/src/tools.ts

@@ -1,12 +1,18 @@
 import { mintGoogleAccessToken } from "@nimbus-dev/sdk";
 import { z } from "zod";
+import { type ConsentServer, createWriteToolRegistrar } from "../../../shared/consent-kit.ts";
+import { guardedFetch } from "../../../shared/guarded-fetch.ts";
 import { matchesResult } from "../../../shared/mcp-search-tool.ts";
-import { mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
-import type { ZodToolRegistrar } from "../../../shared/run-read-only-mcp-connector.ts";
+import {
+  createRegisterSimpleTool,
+  createZodToolRegistrar,
+  mcpJsonResult as jsonResult,
+} from "../../../shared/mcp-tool-kit.ts";
 import { filterFirebaseReleases } from "./search-filter.ts";
 import { configuredAppIds, projectNumberFromAppId, serviceAccountFromEnv } from "./token.ts";
 
 const APP_DISTRIBUTION_API = "https://firebaseappdistribution.googleapis.com";
+const LABEL = "Firebase App Distribution";
 
 // App Distribution OAuth2 tokens last ~1h; cache and refresh conservatively.
 let cachedToken: { token: string; expiresAt: number } | null = null;
@@ -33,15 +39,43 @@ async function accessToken(): Promise<string> {
   return token;
 }
 
-async function appDistGet(path: string): Promise<unknown> {
-  const res = await fetch(`${APP_DISTRIBUTION_API}${path}`, {
-    headers: { Authorization: `Bearer ${await accessToken()}`, Accept: "application/json" },
+/**
+ * One App Distribution request. It goes through `guardedFetch`, so the bearer token is never sent
+ * to a redirect target: a GET follows only a same-origin Location, and a redirect on a POST is
+ * refused (the write may or may not have been applied) with no second request.
+ */
+async function appDistRequest(
+  method: "GET" | "POST",
+  path: string,
+  body?: unknown,
+): Promise<unknown> {
+  // The credential is read BEFORE the request, so a missing one sends nothing.
+  const token = await accessToken();
+  const res = await guardedFetch(LABEL, `${APP_DISTRIBUTION_API}${path}`, {
+    method,
+    headers: {
+      Authorization: `Bearer ${token}`,
+      Accept: "application/json",
+      ...(body === undefined ? {} : { "Content-Type": "application/json" }),
+    },
+    ...(body === undefined ? {} : { body: JSON.stringify(body) }),
   });
   const text = await res.text();
   if (!res.ok) {
-    throw new Error(`Firebase App Distribution ${String(res.status)}: ${text.slice(0, 400)}`);
+    throw new Error(`${LABEL} ${String(res.status)}: ${text.slice(0, 400)}`);
+  }
+  if (text === "") return {};
+  try {
+    return JSON.parse(text) as unknown;
+  } catch {
+    // A 2xx means the call was applied: an unparseable body must not read as a failure, or the
+    // caller retries and invites every tester twice.
+    return {};
   }
-  return JSON.parse(text) as unknown;
+}
+
+async function appDistGet(path: string): Promise<unknown> {
+  return appDistRequest("GET", path);
 }
 
 function appBasePath(appId: string): string {
@@ -60,10 +94,72 @@ function releasePath(appId: string, releaseId: string): string {
   return `${appBasePath(appId)}/releases/${encodeURIComponent(releaseId)}`;
 }
 
+/** Firebase accepts at most 999 testers and groups together in one distribute call. */
+const MAX_RECIPIENTS = 999;
+
+interface DistributeArgs {
+  readonly appId: string;
+  readonly releaseId: string;
+  readonly groupAliases?: readonly string[] | undefined;
+  readonly testerEmails?: readonly string[] | undefined;
+}
+
+/** The recipients as sent: each list de-duplicated (Firebase would mail a repeated tester twice). */
+function distributeRecipients(p: DistributeArgs): {
+  groupAliases: string[];
+  testerEmails: string[];
+} {
+  return {
+    groupAliases: [...new Set(p.groupAliases ?? [])],
+    // Email addresses are case-insensitive here: fold before de-duplicating, send the folded form.
+    testerEmails: [...new Set((p.testerEmails ?? []).map((e) => e.toLowerCase()))],
+  };
+}
+
+/**
+ * Why a distribute call is refused before anything is read or sent, or `undefined`. Shared by
+ * `refuseBefore` (standalone: before scope, consent and the pre-state read) and the handler
+ * (gateway mode registers the raw handler, so it must refuse the same input itself).
+ */
+function distributeProblem(p: DistributeArgs): string | undefined {
+  const { groupAliases, testerEmails } = distributeRecipients(p);
+  if (!configuredAppIds().includes(p.appId)) {
+    return `app ${p.appId} is not in FIREBASE_APP_IDS; nothing was sent`;
+  }
+  if (groupAliases.length + testerEmails.length === 0) {
+    return "give at least one tester email or group alias; nothing was sent";
+  }
+  if (groupAliases.length + testerEmails.length > MAX_RECIPIENTS) {
+    return `at most ${String(MAX_RECIPIENTS)} testers and groups together; nothing was sent`;
+  }
+  return undefined;
+}
+
+const releaseIdArg = z
+  .string()
+  .regex(/^[A-Za-z0-9_-]{1,128}$/, "letters, digits, '_' and '-' only");
+const groupAliasArg = z
+  .string()
+  .regex(/^[A-Za-z0-9_-]{1,128}$/, "letters, digits, '_' and '-' only");
+
 /** Tool names exposed by this connector — for contract/introspection tests. */
-export const FIREBASE_TOOL_NAMES = ["firebase_get", "firebase_list", "firebase_search"] as const;
+export const FIREBASE_TOOL_NAMES = [
+  "firebase_list",
+  "firebase_get",
+  "firebase_search",
+  "firebase_app_distribution_distribute",
+] as const;
+
+export function registerFirebaseTools(
+  server: ConsentServer & { tool: (...args: never) => unknown },
+): void {
+  const reg = createZodToolRegistrar(createRegisterSimpleTool(server));
+  const registerWriteTool = createWriteToolRegistrar(server, {
+    connector: "firebase",
+    scopeEnv: "NIMBUS_MCP_FIREBASE_WRITE_SCOPE",
+    scopeKinds: ["app"],
+  });
 
-export function registerFirebaseTools(reg: ZodToolRegistrar): void {
   reg(
     "firebase_list",
     "List Firebase App Distribution resources. When `appId` is omitted, returns the connector's configured app ids. When `appId` is provided, returns that app's most-recent releases via GET /v1/projects/<n>/apps/<appId>/releases (pageSize optional, default 50).",
@@ -103,4 +199,54 @@ export function registerFirebaseTools(reg: ZodToolRegistrar): void {
       return matchesResult(releases, filterFirebaseReleases, p);
     },
   );
+
+  registerWriteTool(
+    "firebase_app_distribution_distribute",
+    {
+      mutates: "firebase.release.distribute",
+      // Invitation and release emails cannot be unsent, and new testers stay created.
+      recoverable: false,
+      capturePreState: async (p: { appId: string; releaseId: string }) => {
+        // The API has no read of a release's current groups or testers, so the release itself is
+        // the before-state.
+        const r = (await appDistGet(releasePath(p.appId, p.releaseId))) as Record<string, unknown>;
+        return {
+          displayVersion: r["displayVersion"],
+          buildVersion: r["buildVersion"],
+          testState: r["testState"],
+        };
+      },
+      scopeTargetOf: (p: { appId: string }) => ({ kind: "app", value: p.appId }),
+      refuseBefore: (p: DistributeArgs) => distributeProblem(p),
+    },
+    "Send an existing Firebase App Distribution release to testers and groups (`POST /v1/projects/<n>/apps/<appId>/releases/<releaseId>:distribute`, body `{ testerEmails, groupAliases }`, empty arrays omitted). WARNING, vendor behaviour: an email that is not yet a tester BECOMES a new tester and is SENT an invitation email, and testers get a release email; none of that can be unsent. At least one of `testerEmails` and `groupAliases` is required, at most 999 together; a missing group makes Firebase answer INVALID_ARGUMENT and the app must be one of the connector's FIREBASE_APP_IDS. The API cannot say who already has the release, so every group and tester sent is listed in the result. The reply is `accepted`.",
+    z.object({
+      appId: z.string().min(1),
+      releaseId: releaseIdArg,
+      groupAliases: z.array(groupAliasArg).max(MAX_RECIPIENTS).optional(),
+      testerEmails: z.array(z.email().max(254)).max(MAX_RECIPIENTS).optional(),
+    }),
+    async (p) => {
+      // Validated here and in `refuseBefore`, not with `.refine` (a refined schema loses `.shape`).
+      const problem = distributeProblem(p);
+      if (problem !== undefined) throw new Error(problem);
+      const { groupAliases, testerEmails } = distributeRecipients(p);
+      const body: Record<string, string[]> = {};
+      if (testerEmails.length > 0) {
+        body["testerEmails"] = testerEmails;
+      }
+      if (groupAliases.length > 0) {
+        body["groupAliases"] = groupAliases;
+      }
+      await appDistRequest("POST", `${releasePath(p.appId, p.releaseId)}:distribute`, body);
+      return jsonResult({
+        ok: true,
+        status: "accepted",
+        appId: p.appId,
+        releaseId: p.releaseId,
+        groupAliases,
+        testerEmails,
+      });
+    },
+  );
 }

package/connectors/netlify/nimbus.extension.json

@@ -2,14 +2,14 @@
   "id": "com.nimbus.netlify",
   "displayName": "Netlify",
   "version": "0.1.0",
-  "description": "Netlify site connector (read-only). Surfaces site id, name, the production URL + SSL URL, the admin dashboard URL, the linked git repo + branch, and the embedded published-deploy status (state / branch / commit ref / commit URL / deploy preview URL) into the local index as `netlify:site` items — useful for answering \"is the latest deploy live?\" and \"which site shipped this commit?\". Bearer-token (PAT) auth. The SaaS host (api.netlify.com) is fixed. Per-deploy history, forms, functions, env vars, and DNS are deferred follow-ups.",
+  "description": "Netlify site connector. Surfaces site id, name, the production URL + SSL URL, the admin dashboard URL, the linked git repo + branch, and the embedded published-deploy status (state / branch / commit ref / commit URL / deploy preview URL) into the local index as `netlify:site` items — useful for answering \"is the latest deploy live?\" and \"which site shipped this commit?\". Bearer-token (PAT) auth. The SaaS host (api.netlify.com) is fixed. Write tool (needs owner approval): `netlify.build.trigger`; a build with no branch is a PRODUCTION deploy. Forms, functions, env vars, and DNS are deferred follow-ups.",
   "author": "Nimbus",
   "entrypoint": "dist/server.js",
   "runtime": "bun",
   "permissions": {
     "network": ["api.netlify.com"]
   },
-  "hitlRequired": [],
+  "hitlRequired": ["write"],
   "syncInterval": 600,
   "minNimbusVersion": "0.2.0"
 }