@openephemeris/mcp-server 3.13.10 → 3.15.0

package/dist/tools/apps/transit-timeline-app.js

@@ -17,6 +17,7 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { registerTool, validateRequired, SERVER_VERSION } from "../index.js";
 import { getActiveClient } from "../../backend/client.js";
+import { OUTPUT_SCHEMA_JSON } from "../output-schemas.js";
 // ── Constants ─────────────────────────────────────────────────────────────────
 export const TRANSIT_TIMELINE_RESOURCE_URI = "ui://openephemeris/transit-timeline";
 export const TRANSIT_TIMELINE_MIME_TYPE = "text/html;profile=mcp-app";
@@ -129,6 +130,7 @@ registerTool({
         required: ["natal_datetime", "natal_latitude", "natal_longitude", "start_date", "end_date"],
         additionalProperties: false,
     },
+    outputSchema: OUTPUT_SCHEMA_JSON,
     annotations: {
         title: "Interactive Transit Timeline Explorer",
         readOnlyHint: true,
@@ -145,6 +147,19 @@ registerTool({
     handler: async (args) => {
         validateRequired(args, ["natal_datetime", "natal_latitude", "natal_longitude", "start_date", "end_date"]);
         const client = getActiveClient();
+        // Guard: reject excessively wide date ranges before hitting the backend.
+        // The Go backend clamps Explorer tier to 1 year, but larger tiers can still
+        // trigger compute-bound 45-second timeouts on very wide windows.
+        const startMs = new Date(args.start_date).getTime();
+        const endMs = new Date(args.end_date).getTime();
+        if (!isNaN(startMs) && !isNaN(endMs)) {
+            const spanDays = (endMs - startMs) / (1000 * 60 * 60 * 24);
+            if (spanDays > 5 * 365) {
+                throw new Error(`Date range too wide (${Math.round(spanDays / 365)} years). ` +
+                    `The transit timeline works best with windows under 2 years — try narrowing ` +
+                    `start_date and end_date to a 1–2 year window and re-run.`);
+            }
+        }
         // Step 1: Compute natal chart to extract planetary longitudes
         const natalBody = {
             subject: {
@@ -161,32 +176,57 @@ registerTool({
         const natalPositionMap = {};
         const planets = natalResult?.planets || natalResult?.data?.planets || [];
         const planetArray = Array.isArray(planets) ? planets : Object.values(planets);
+        // ── Core natal points to target (conjunction search) ─────────────────────
+        // When no natal_points filter is given, we limit to 7 core bodies to keep
+        // target_degrees count manageable. 4 outer planets × 10+ targets creates a
+        // combinatoric explosion (40+ serial SearchTransit calls on the backend).
+        const CORE_BODIES_DEFAULT = new Set([
+            "sun", "moon", "mercury", "venus", "mars", "jupiter", "saturn",
+        ]);
         const wantedPoints = args.natal_points
             ? new Set(args.natal_points.map((p) => p.toLowerCase()))
-            : null;
+            : CORE_BODIES_DEFAULT;
         for (const planet of planetArray) {
             const name = (planet.name || planet.id || "").toLowerCase();
             const lon = planet.longitude ?? planet.ecliptic_longitude ?? planet.lon;
             if (typeof lon !== "number" || !isFinite(lon))
                 continue;
-            if (wantedPoints && !wantedPoints.has(name))
+            if (!wantedPoints.has(name))
                 continue;
             targetDegrees.push(Math.round(lon * 100) / 100);
             natalPositionMap[name] = lon;
         }
-        // Extract angles (ASC, MC)
-        const angles = natalResult?.angles || natalResult?.data?.angles;
-        if (angles) {
-            const angleEntries = Array.isArray(angles) ? angles : Object.entries(angles).map(([k, v]) => ({ name: k, ...(typeof v === 'object' ? v : { longitude: v }) }));
-            for (const angle of angleEntries) {
-                const name = (angle.name || angle.id || "").toLowerCase();
-                const lon = angle.longitude ?? angle.ecliptic_longitude ?? angle.lon;
-                if (typeof lon !== "number" || !isFinite(lon))
-                    continue;
-                if (wantedPoints && !wantedPoints.has(name))
-                    continue;
-                targetDegrees.push(Math.round(lon * 100) / 100);
-                natalPositionMap[name] = lon;
+        // Extract angles (ASC, MC) — only if explicitly requested via natal_points
+        if (args.natal_points) {
+            const angles = natalResult?.angles || natalResult?.data?.angles;
+            if (angles) {
+                const angleEntries = Array.isArray(angles)
+                    ? angles
+                    : Object.entries(angles).map(([k, v]) => ({ name: k, ...(typeof v === "object" ? v : { longitude: v }) }));
+                for (const angle of angleEntries) {
+                    const name = (angle.name || angle.id || "").toLowerCase();
+                    const lon = angle.longitude ?? angle.ecliptic_longitude ?? angle.lon;
+                    if (typeof lon !== "number" || !isFinite(lon))
+                        continue;
+                    if (!wantedPoints.has(name))
+                        continue;
+                    targetDegrees.push(Math.round(lon * 100) / 100);
+                    natalPositionMap[name] = lon;
+                }
+            }
+        }
+        // Safety cap: never send more than 12 target degrees to the backend
+        // (prevents combinatoric timeouts when many planets + many targets overlap).
+        const MAX_TARGETS = 12;
+        if (targetDegrees.length > MAX_TARGETS) {
+            targetDegrees.splice(MAX_TARGETS);
+            // Prune natalPositionMap to match
+            const keepNames = new Set(Object.entries(natalPositionMap)
+                .filter(([, v]) => targetDegrees.includes(Math.round(v * 100) / 100))
+                .map(([k]) => k));
+            for (const k of Object.keys(natalPositionMap)) {
+                if (!keepNames.has(k))
+                    delete natalPositionMap[k];
             }
         }
         if (targetDegrees.length === 0) {
@@ -199,31 +239,43 @@ registerTool({
         let endStr = args.end_date;
         if (/^\d{4}-\d{2}-\d{2}$/.test(endStr))
             endStr += "T23:59:59Z";
+        const aspectAngle = typeof args.aspect_angle === "number" ? args.aspect_angle : 0;
+        let effectiveTargets = targetDegrees;
+        if (aspectAngle !== 0) {
+            effectiveTargets = targetDegrees.map((deg) => ((deg + aspectAngle) % 360 + 360) % 360);
+        }
         const transitBody = {
             start_date: startStr,
             end_date: endStr,
-            target_degrees: targetDegrees,
+            target_degrees: effectiveTargets,
         };
         if (args.transiting_planets)
             transitBody.planet_names = args.transiting_planets;
-        let effectiveTargets = targetDegrees;
-        const aspectAngle = typeof args.aspect_angle === "number" ? args.aspect_angle : 0;
         if (aspectAngle !== 0) {
-            effectiveTargets = targetDegrees.map((deg) => ((deg + aspectAngle) % 360 + 360) % 360);
-            transitBody.target_degrees = effectiveTargets;
             transitBody.search_criteria = { aspect_angle: aspectAngle };
         }
-        const transitResult = await client.request("POST", "/predictive/transits/search", { data: transitBody });
+        // Give the backend a 90s window — explorer tier allows 30s Go compute
+        // timeout, but the node-to-Fly round-trip including queuing can extend this.
+        const transitResult = await client.request("POST", "/predictive/transits/search", { data: transitBody, timeoutMs: 90_000 });
+        // Normalize the API response into a flat array so the iframe UI always
+        // receives an iterable — some backend response shapes wrap events in a
+        // container object rather than returning a bare array.
+        const transitArray = Array.isArray(transitResult)
+            ? transitResult
+            : (transitResult?.events ??
+                transitResult?.transits ??
+                transitResult?.results ??
+                []);
         // Build payload
         const payload = {
             natal_positions: natalPositionMap,
             target_degrees_used: effectiveTargets,
             aspect_angle: aspectAngle,
-            transit_results: transitResult,
+            transit_results: transitArray,
             search_window: { start_date: args.start_date, end_date: args.end_date },
             server_version: SERVER_VERSION,
         };
-        const summary = buildTransitSummary(natalPositionMap, transitResult, aspectAngle, args.start_date, args.end_date);
+        const summary = buildTransitSummary(natalPositionMap, transitArray, aspectAngle, args.start_date, args.end_date);
         const bundleAvailable = Boolean(getTransitTimelineBundle());
         if (bundleAvailable) {
             return {

package/dist/tools/apps/vedic-chart-app.js

@@ -14,6 +14,7 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { registerTool, SERVER_VERSION } from "../index.js";
 import { getActiveClient } from "../../backend/client.js";
+import { OUTPUT_SCHEMA_JSON } from "../output-schemas.js";
 // ── Constants ─────────────────────────────────────────────────────────────────
 export const VEDIC_CHART_RESOURCE_URI = "ui://openephemeris/vedic-chart";
 export const VEDIC_CHART_MIME_TYPE = "text/html;profile=mcp-app";
@@ -149,6 +150,7 @@ registerTool({
         required: ["datetime", "latitude", "longitude"],
         additionalProperties: false,
     },
+    outputSchema: OUTPUT_SCHEMA_JSON,
     annotations: {
         title: "Interactive Vedic Jyotish Chart",
         readOnlyHint: true,

package/dist/tools/auth.js

@@ -1,6 +1,7 @@
 import { registerTool } from "./index.js";
 import { CredentialManager } from "../auth/credentials.js";
 import { DeviceAuthFlow } from "../auth/device-auth.js";
+import { OUTPUT_SCHEMA_AUTH } from "./output-schemas.js";
 const credentialManager = new CredentialManager();
 // ────────────────────────────────────────────────────────
 // auth.login — Start the device authorization flow
@@ -17,6 +18,7 @@ registerTool({
         properties: {},
         additionalProperties: false,
     },
+    outputSchema: OUTPUT_SCHEMA_AUTH,
     annotations: {
         title: "Connect Account",
         readOnlyHint: false,
@@ -95,6 +97,7 @@ registerTool({
         properties: {},
         additionalProperties: false,
     },
+    outputSchema: OUTPUT_SCHEMA_AUTH,
     annotations: {
         title: "Auth Status",
         readOnlyHint: true,
@@ -179,6 +182,7 @@ registerTool({
         properties: {},
         additionalProperties: false,
     },
+    outputSchema: OUTPUT_SCHEMA_AUTH,
     annotations: {
         title: "Disconnect Account",
         readOnlyHint: false,

package/dist/tools/dev.js

@@ -1,5 +1,6 @@
 import { registerTool, validateRequired } from "./index.js";
 import { getActiveClient } from "../backend/client.js";
+import { OUTPUT_SCHEMA_JSON } from "./output-schemas.js";
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -31,66 +32,72 @@ function isDeniedByPrefix(pathname, prefixes) {
 function isAllowedOperation(method, pathname, allow) {
     return allow.some((e) => e.method === method && e.path === pathname);
 }
-registerTool({
-    name: "dev_call",
-    description: "Call any allowlisted Open Ephemeris API endpoint directly. This is the power-user escape hatch " +
-        "— use the typed tools (ephemeris_natal_chart, ephemeris_transits, etc.) first for common operations. " +
-        "Call dev_list_allowed to see all currently available endpoint paths.\n\n" +
-        "AUTH: Set OPENEPHEMERIS_API_KEY in your environment. See openephemeris.com/dashboard for active plan limits.\n\n" +
-        "CREDIT COSTS:\n" +
-        "  • Standard chart math (natal, progressed, bazi, vedic, iching): 1 credit\n" +
-        "  • Human Design: 2 credits\n" +
-        "  • Visualization rendering (chart-wheel, bi-wheel, charts/*): 2 credits\n" +
-        "  • Comparative math (synastry, composite, overlay): 3 credits\n" +
-        "  • Predictive ops (transits/search, returns): 5 credits\n" +
-        "  • Predictive transit-chart: 1 credit\n" +
-        "  • ACG / astrocartography: 10 credits (acg/hits: 15 credits)\n" +
-        "  • Calendar endpoints: 10 credits\n" +
-        "  • Catalog / metadata / health endpoints: 0 credits\n" +
-        "  • Compute surcharge: requests > 30s add 1 credit per 30s (predictive, acg, calendar, electional)\n" +
-        "  • format=llm (token-optimized output): available on all tiers\n\n" +
-        "COMMON CALLS:\n" +
-        "  POST /ephemeris/natal-chart            — Full natal chart (body: {subject: {name: 'Name', birth_datetime: {iso: '1990-04-15T14:30:00-05:00'}, birth_location: {latitude: {decimal: 40.0}, longitude: {decimal: -70.0}, timezone: {}}}})\n" +
-        "  POST /ephemeris/natal/batch            — Up to 50 natal charts in one request\n" +
-        "  POST /ephemeris/relocation             — Relocated chart (same natal, new location)\n" +
-        "  POST /predictive/transits/search       — Transit event search over a date range\n" +
-        "  POST /predictive/returns/solar         — Solar return chart\n" +
-        "  POST /predictive/returns/lunar         — Lunar return chart\n" +
-        "  POST /comparative/synastry             — Two-person synastry chart\n" +
-        "  POST /comparative/composite            — Composite (midpoint) chart\n" +
-        "  POST /human-design/chart               — Full HD chart (body: {birth_datetime_utc: '1990-04-15T19:30:00Z'}) — lat/lon optional\n" +
-        "  POST /time/julian-day                  — Convert date to JD (body: {year: 1987, month: 7, day: 15, hour: 14, minute: 1})\n" +
-        "  GET  /ephemeris/moon/phase             — Current/queried moon phase\n" +
-        "  GET  /ephemeris/moon/void-of-course    — Next void-of-course period\n" +
-        "  GET  /ephemeris/agro/daily             — Biodynamic farming day quality\n" +
-        "  GET  /ephemeris/agro/calendar          — Multi-day biodynamic calendar\n" +
-        "  GET  /ephemeris/agro/void-of-course    — Biodynamic VoC periods\n" +
-        "  GET  /eclipse/next-visible             — Next eclipse visible from a location (query: lat, lon, type=solar|lunar)\n" +
-        "  GET  /eclipse/solar/global             — Next global solar eclipse (query: date=YYYY-MM-DD)\n" +
-        "  GET  /eclipse/solar/local              — Local solar eclipse (query: lat, lon)\n" +
-        "  GET  /tidal/forcing                    — Gravitational tidal forcing index\n" +
-        "  POST /acg/power-lines                 — Astrocartography power lines (lat/lon GeoJSON)\n" +
-        "  POST /acg/hits                         — ACG power at a specific location\n" +
-        "  GET  /calendar/astrology/moon-phases   — Moon phase calendar for a date range\n" +
-        "  GET  /location/autocomplete            — Geocode a place name (query: q=City Name)\n" +
-        "  POST /timezone/lookup                  — Resolve timezone + UTC offset for a location\n" +
-        "  POST /chinese/bazi                     — Chinese Ba Zi (Four Pillars) chart (body: {year, month, day, hour})\n" +
-        "  GET  /chinese/zodiac                   — Chinese zodiac year element/animal\n" +
-        "  POST /vedic/chart                      — Vedic (Jyotish) natal chart (body: {datetime_utc, latitude, longitude})\n" +
-        "  GET  /catalogs/bodies                  — List all supported celestial bodies\n\n" +
-        "BINARY RESPONSES:\n" +
-        "  • Binary/image endpoints return {content_type, content_length, encoding, data_base64}\n" +
-        "    so callers can decode bytes deterministically.\n\n" +
-        "ECLIPSE NOTE: Eclipse endpoints accept format=llm via the query param like other endpoints.\n\n" +
-        "format=llm NOTE: Add query: {format: 'llm'} to natal/synastry/composite/HD endpoints for " +
-        "compact columnar output optimized for LLM token budgets (availability depends on your current plan).",
-    inputSchema: {
+// Shared reference block appended to both read/write proxy tools. Names the
+// target API (Open Ephemeris) explicitly — required by the directory for
+// freeform-path tools — plus credit costs and common calls.
+const DEV_API_REFERENCE = "Target API: Open Ephemeris REST API (https://api.openephemeris.com). " +
+    "Call dev_list_allowed to see all currently available endpoint paths.\n\n" +
+    "AUTH: Set OPENEPHEMERIS_API_KEY in your environment. See openephemeris.com/dashboard for active plan limits.\n\n" +
+    "CREDIT COSTS:\n" +
+    "  • Standard chart math (natal, progressed, bazi, vedic, iching): 1 credit\n" +
+    "  • Human Design: 2 credits\n" +
+    "  • Visualization rendering (chart-wheel, bi-wheel, charts/*): 2 credits\n" +
+    "  • Comparative math (synastry, composite, overlay): 3 credits\n" +
+    "  • Predictive ops (transits/search, returns): 5 credits\n" +
+    "  • Predictive transit-chart: 1 credit\n" +
+    "  • ACG / astrocartography: 10 credits (acg/hits: 15 credits)\n" +
+    "  • Calendar endpoints: 10 credits\n" +
+    "  • Catalog / metadata / health endpoints: 0 credits\n" +
+    "  • Compute surcharge: requests > 30s add 1 credit per 30s (predictive, acg, calendar, electional)\n" +
+    "  • format=llm (token-optimized output): available on all tiers\n\n" +
+    "COMMON CALLS:\n" +
+    "  POST /ephemeris/natal-chart            — Full natal chart (body: {subject: {name: 'Name', birth_datetime: {iso: '1990-04-15T14:30:00-05:00'}, birth_location: {latitude: {decimal: 40.0}, longitude: {decimal: -70.0}, timezone: {}}}})\n" +
+    "  POST /ephemeris/natal/batch            — Up to 50 natal charts in one request\n" +
+    "  POST /ephemeris/relocation             — Relocated chart (same natal, new location)\n" +
+    "  POST /predictive/transits/search       — Transit event search over a date range\n" +
+    "  POST /predictive/returns/solar         — Solar return chart\n" +
+    "  POST /predictive/returns/lunar         — Lunar return chart\n" +
+    "  POST /comparative/synastry             — Two-person synastry chart\n" +
+    "  POST /comparative/composite            — Composite (midpoint) chart\n" +
+    "  POST /human-design/chart               — Full HD chart (body: {birth_datetime_utc: '1990-04-15T19:30:00Z'}) — lat/lon optional\n" +
+    "  POST /time/julian-day                  — Convert date to JD (body: {year: 1987, month: 7, day: 15, hour: 14, minute: 1})\n" +
+    "  GET  /ephemeris/moon/phase             — Current/queried moon phase\n" +
+    "  GET  /ephemeris/moon/void-of-course    — Next void-of-course period\n" +
+    "  GET  /ephemeris/agro/daily             — Biodynamic farming day quality\n" +
+    "  GET  /ephemeris/agro/calendar          — Multi-day biodynamic calendar\n" +
+    "  GET  /ephemeris/agro/void-of-course    — Biodynamic VoC periods\n" +
+    "  GET  /eclipse/next-visible             — Next eclipse visible from a location (query: lat, lon, type=solar|lunar)\n" +
+    "  GET  /eclipse/solar/global             — Next global solar eclipse (query: date=YYYY-MM-DD)\n" +
+    "  GET  /eclipse/solar/local              — Local solar eclipse (query: lat, lon)\n" +
+    "  GET  /tidal/forcing                    — Gravitational tidal forcing index\n" +
+    "  POST /acg/power-lines                 — Astrocartography power lines (lat/lon GeoJSON)\n" +
+    "  POST /acg/hits                         — ACG power at a specific location\n" +
+    "  GET  /calendar/astrology/moon-phases   — Moon phase calendar for a date range\n" +
+    "  GET  /location/autocomplete            — Geocode a place name (query: q=City Name)\n" +
+    "  POST /timezone/lookup                  — Resolve timezone + UTC offset for a location\n" +
+    "  POST /chinese/bazi                     — Chinese Ba Zi (Four Pillars) chart (body: {year, month, day, hour})\n" +
+    "  GET  /chinese/zodiac                   — Chinese zodiac year element/animal\n" +
+    "  POST /vedic/chart                      — Vedic (Jyotish) natal chart (body: {datetime_utc, latitude, longitude})\n" +
+    "  GET  /catalogs/bodies                  — List all supported celestial bodies\n\n" +
+    "BINARY RESPONSES:\n" +
+    "  • Binary/image endpoints return {content_type, content_length, encoding, data_base64}\n" +
+    "    so callers can decode bytes deterministically.\n\n" +
+    "ECLIPSE NOTE: Eclipse endpoints accept format=llm via the query param like other endpoints.\n\n" +
+    "format=llm NOTE: Add query: {format: 'llm'} to natal/synastry/composite/HD endpoints for " +
+    "compact columnar output optimized for LLM token budgets (availability depends on your current plan).";
+// The read and write proxies are kept as separate tools (not one method-switching
+// tool) so that safe GET reads never share a surface with state-changing writes —
+// a hard requirement of the Anthropic connector directory.
+const READ_METHODS = ["GET"];
+const WRITE_METHODS = ["POST", "PUT", "PATCH", "DELETE"];
+function makeProxyInputSchema(methods) {
+    return {
         type: "object",
         properties: {
             method: {
                 type: "string",
-                enum: ["GET", "POST", "PUT", "PATCH", "DELETE"],
-                description: "HTTP method",
+                enum: methods,
+                description: methods.length === 1 ? `HTTP method (always ${methods[0]})` : "HTTP method",
             },
             path: {
                 type: "string",
@@ -99,10 +106,10 @@ registerTool({
             query: {
                 type: "object",
                 additionalProperties: true,
-                description: "Query params for GET requests (optional)",
+                description: "Query params (optional)",
             },
             body: {
-                description: "JSON body for POST/PUT/PATCH (optional)",
+                description: "JSON request body (optional)",
             },
             preset: {
                 type: "string",
@@ -120,14 +127,16 @@ registerTool({
                 description: "Legacy convenience (deprecated): if provided, set query.output_mode and also map to query.preset/query.format when possible.",
             },
         },
-        required: ["method", "path"],
+        required: ["path"],
         additionalProperties: false,
-    },
-    handler: async (args) => {
+    };
+}
+function makeProxyHandler(allowedMethods, defaultMethod) {
+    return async (args) => {
         validateRequired(args, ["path"]);
-        const methodStr = String(args.method || "GET").toUpperCase();
-        if (!["GET", "POST", "PUT", "PATCH", "DELETE"].includes(methodStr)) {
-            throw new Error(`Invalid HTTP method: ${methodStr}`);
+        const methodStr = String(args.method || defaultMethod).toUpperCase();
+        if (!allowedMethods.includes(methodStr)) {
+            throw new Error(`Method ${methodStr} not permitted by this tool. Allowed: ${allowedMethods.join(", ")}.`);
         }
         const method = methodStr;
         const pathname = String(args.path);
@@ -175,20 +184,48 @@ registerTool({
             params: query,
             data: body,
         });
-    },
+    };
+}
+registerTool({
+    name: "dev_read_api",
+    description: "Read from any allowlisted Open Ephemeris API endpoint via HTTP GET. This is the read-only " +
+        "power-user escape hatch — use the typed tools (ephemeris_natal_chart, ephemeris_transits, etc.) " +
+        "first for common operations. For endpoints that compute via POST (natal-chart, synastry, etc.), " +
+        "use dev_write_api.\n\n" +
+        DEV_API_REFERENCE,
+    inputSchema: makeProxyInputSchema(READ_METHODS),
+    outputSchema: OUTPUT_SCHEMA_JSON,
+    // GET-only: never mutates server state.
+    annotations: { title: "API Read", readOnlyHint: true, openWorldHint: true },
+    handler: makeProxyHandler(READ_METHODS, "GET"),
+});
+registerTool({
+    name: "dev_write_api",
+    description: "Send a request to any allowlisted Open Ephemeris API endpoint via POST/PUT/PATCH/DELETE. " +
+        "Most chart computations (natal-chart, synastry, composite, transits/search, returns, ACG) are " +
+        "POST endpoints and use this tool. Use the typed tools first for common operations; use dev_read_api " +
+        "for GET endpoints.\n\n" +
+        DEV_API_REFERENCE,
+    inputSchema: makeProxyInputSchema(WRITE_METHODS),
+    outputSchema: OUTPUT_SCHEMA_JSON,
+    // Issues POST/PUT/PATCH/DELETE — must not be advertised as read-only.
+    annotations: { title: "API Write", readOnlyHint: false, openWorldHint: true },
+    handler: makeProxyHandler(WRITE_METHODS, "POST"),
 });
 registerTool({
     name: "dev_list_allowed",
     description: "List all API operations (method + path) that this MCP instance is authorized to call. " +
         "Returns endpoint entries grouped by method, plus the active deny rules. " +
-        "Use this to discover what's available before calling dev_call, or to verify an endpoint path. " +
+        "Use this to discover what's available before calling dev_read_api / dev_write_api, or to verify an endpoint path. " +
         "Typed shortcut tools (ephemeris_natal_chart, ephemeris_transits, etc.) cover the most common operations — " +
-        "check those first before reaching for dev_call.",
+        "check those first before reaching for the generic proxies.",
     inputSchema: {
         type: "object",
         properties: {},
         additionalProperties: false,
     },
+    outputSchema: OUTPUT_SCHEMA_JSON,
+    annotations: { title: "List Allowed API Operations", readOnlyHint: true, openWorldHint: false },
     handler: async () => {
         const allowlist = loadAllowlist();
         return {

package/dist/tools/index.d.ts

@@ -5,6 +5,12 @@ export interface ToolDefinition {
     name: string;
     description: string;
     inputSchema: z.ZodType<any> | Record<string, unknown>;
+    /**
+     * MCP spec 2025-11-25 — JSON Schema describing the structured output of this tool.
+     * Smithery uses this to score "Output schemas" in the quality rubric.
+     * All tools return MCP content block arrays; specialized tools declare richer shapes.
+     */
+    outputSchema?: Record<string, unknown>;
     annotations?: {
         title?: string;
         readOnlyHint?: boolean;
@@ -46,6 +52,16 @@ export declare function initTools(profile?: ToolProfile): Promise<void>;
  * Throws an error if any of the required keys are missing or empty.
  */
 export declare function validateRequired(args: any, requiredKeys: string[]): void;
+/**
+ * Returns `value` only if it is one of `allowed`, otherwise `undefined`.
+ *
+ * Use for any tool argument that gets interpolated into a backend URL/query
+ * string. Even though the inputSchema declares an `enum`, the MCP host does
+ * not guarantee enum enforcement, so a hostile client could smuggle extra
+ * query parameters (e.g. style="dark&admin=1"). Whitelisting here closes that
+ * injection vector at the boundary (DATA-6).
+ */
+export declare function pickEnum<T extends string>(value: unknown, allowed: readonly T[]): T | undefined;
 /**
  * Throws an error if only one of the coordinate pair is provided.
  */

package/dist/tools/index.js

@@ -44,10 +44,14 @@ export async function initTools(profile) {
     const resolvedProfile = (profile || process.env.OPENEPHEMERIS_PROFILE || process.env.ASTROMCP_PROFILE || "dev").toLowerCase();
     // Always register auth tools (available in all profiles).
     await import("./auth.js");
-    // Always register the generic proxy tools (dev.call + dev.list_allowed).
+    // Always register the generic proxy tools (dev_read_api + dev_write_api + dev_list_allowed).
     await import("./dev.js");
     if (resolvedProfile === "dev") {
-        // Register all specialized domain tools.
+        // ── FULL BUILD: all specialized tools ───────────────────────────
+        // Payload size theory was disproven. The "Failed to call tool" 
+        // bug was caused by Claude Desktop's MCP App iframe handler 
+        // corruption. Iframe tools are purged; all specialized tools are restored.
+        // ────────────────────────────────────────────────────────────────
         await import("./specialized/natal.js");
         await import("./specialized/transits.js");
         await import("./specialized/moon.js");
@@ -70,15 +74,12 @@ export async function initTools(profile) {
         await import("./specialized/ephemeris_extended.js");
         await import("./specialized/venus_star_points.js");
         await import("./specialized/acg.js");
-        // MCP App tools (interactive UI)
+        await import("./apps/location-tools.js");
+        // Re-enable requested MCP apps (iframes)
         await import("./apps/chart-wheel-app.js");
-        await import("./apps/bodygraph-app.js");
         await import("./apps/bi-wheel-app.js");
-        await import("./apps/transit-timeline-app.js");
+        await import("./apps/bodygraph-app.js");
         await import("./apps/moon-phase-app.js");
-        await import("./apps/bazi-app.js");
-        await import("./apps/vedic-chart-app.js");
-        await import("./apps/location-tools.js");
     }
 }
 /**
@@ -92,6 +93,20 @@ export function validateRequired(args, requiredKeys) {
         throw new Error(`Missing required arguments: ${missing.join(", ")}`);
     }
 }
+/**
+ * Returns `value` only if it is one of `allowed`, otherwise `undefined`.
+ *
+ * Use for any tool argument that gets interpolated into a backend URL/query
+ * string. Even though the inputSchema declares an `enum`, the MCP host does
+ * not guarantee enum enforcement, so a hostile client could smuggle extra
+ * query parameters (e.g. style="dark&admin=1"). Whitelisting here closes that
+ * injection vector at the boundary (DATA-6).
+ */
+export function pickEnum(value, allowed) {
+    return typeof value === "string" && allowed.includes(value)
+        ? value
+        : undefined;
+}
 /**
  * Throws an error if only one of the coordinate pair is provided.
  */

package/dist/tools/output-schemas.d.ts

@@ -0,0 +1,37 @@
+/**
+ * output-schemas.ts — Shared JSON Schema output schema definitions for MCP tools.
+ *
+ * MCP spec 2025-11-25 supports `outputSchema` on tool definitions. Smithery
+ * uses this field to score the "Output schemas" quality criterion (10.37pt / 57 tools).
+ *
+ * All tools return an MCP content block response. Most return a single JSON text
+ * block; visual tools return an image block or an image + text block.
+ *
+ * Usage:
+ *   import { OUTPUT_SCHEMA_JSON, OUTPUT_SCHEMA_IMAGE } from "../output-schemas.js";
+ *   registerTool({ ..., outputSchema: OUTPUT_SCHEMA_JSON });
+ */
+/**
+ * Standard tool output schema: a single JSON text block.
+ * Used by all data-returning tools (natal chart, transits, synastry, etc.).
+ */
+export declare const OUTPUT_SCHEMA_JSON: Record<string, unknown>;
+/**
+ * Visual tool output schema: a single SVG or PNG image block.
+ * Used by chart wheel (direct image), BaZi chart, Vedic chart, etc.
+ */
+export declare const OUTPUT_SCHEMA_IMAGE: Record<string, unknown>;
+/**
+ * Dual output schema: an image block followed by a JSON text block.
+ * Used by tools with include_visual=true (natal chart SVG + data, bi-wheel, etc.).
+ */
+export declare const OUTPUT_SCHEMA_IMAGE_AND_JSON: Record<string, unknown>;
+/**
+ * Interactive app tool output schema: a text block containing MCP App metadata.
+ * Used by explore_* tools that return an embedded UI resource reference.
+ */
+export declare const OUTPUT_SCHEMA_APP: Record<string, unknown>;
+/**
+ * Auth tool output schema: a JSON text block confirming auth status or credentials.
+ */
+export declare const OUTPUT_SCHEMA_AUTH: Record<string, unknown>;