@orygn/opa-mcp 0.4.0 → 0.5.0

package/dist/tools/server-management/policies.js

@@ -7,19 +7,46 @@ import { OpaClient } from '../../lib/opa-client.js';
 import { ok } from '../../lib/errors.js';
 import { withToolEnvelope } from '../../lib/tool-helpers.js';
 import { mapOpaClientError } from './_shared.js';
+/**
+ * Drop the parts of a policy record the caller did not ask for.
+ *
+ * OPA answers the policy endpoints with the parsed AST alongside the source,
+ * and the AST is far larger than the text it came from: a 477-byte policy comes
+ * back as a 19 KB response once the envelope is indented. Returning it by
+ * default pushed a list of any real size past the response cap, and the cap's
+ * advice to narrow the scope was unfollowable because the list tool takes no
+ * arguments.
+ */
+function trimPolicy(record, opts) {
+    const trimmed = { id: record.id };
+    if (opts.source && record.raw !== undefined)
+        trimmed.raw = record.raw;
+    if (opts.ast && record.ast !== undefined)
+        trimmed.ast = record.ast;
+    return trimmed;
+}
 export function registerPolicyTools(server, config) {
     const opa = new OpaClient(config);
     server.registerTool('opa_list_policies', {
         title: 'List OPA policies',
-        description: 'List policies registered on the running OPA server. Returns an array of `{ id, raw, ast }` records.',
-        inputSchema: {},
+        description: 'List policies registered on the running OPA server. Returns the policy IDs and a count. Set `includeSource` for the Rego text of every policy, or `includeAst` for the parsed AST of every policy; both are off by default because either one pushes a list of any real size past the response cap.',
+        inputSchema: {
+            includeSource: z
+                .boolean()
+                .optional()
+                .describe("Include each policy's Rego source. Off by default: fetch one policy with `opa_get_policy` rather than every policy at once."),
+            includeAst: z
+                .boolean()
+                .optional()
+                .describe("Include each policy's parsed AST. Off by default; it is roughly forty times the size of the source and will exceed the response cap on all but the smallest servers."),
+        },
         annotations: {
             readOnlyHint: true,
             destructiveHint: false,
             idempotentHint: true,
             openWorldHint: true,
         },
-    }, async (_input, { signal }) => {
+    }, async ({ includeSource, includeAst }, { signal }) => {
         return withToolEnvelope(config, async () => {
             try {
                 const data = await opa.request({
@@ -27,7 +54,11 @@ export function registerPolicyTools(server, config) {
                     path: '/v1/policies',
                     signal,
                 });
-                return ok({ policies: data.result ?? [] });
+                const records = data.result ?? [];
+                return ok({
+                    policies: records.map((r) => trimPolicy(r, { source: includeSource === true, ast: includeAst === true })),
+                    count: records.length,
+                });
             }
             catch (e) {
                 return mapOpaClientError(e);
@@ -36,9 +67,13 @@ export function registerPolicyTools(server, config) {
     });
     server.registerTool('opa_get_policy', {
         title: 'Get OPA policy by ID',
-        description: 'Fetch a single policy by ID from the running OPA server.',
+        description: "Fetch a single policy by ID from the running OPA server. Returns the Rego source; the parsed AST is omitted unless asked for, since it is roughly forty times the size of the source it came from. Use `rego_parse_ast` on the source when an AST is what's wanted.",
         inputSchema: {
             id: z.string().min(1).describe('Policy ID, e.g. "rbac" or "policies/auth/main".'),
+            includeAst: z
+                .boolean()
+                .optional()
+                .describe("Include OPA's parsed AST alongside the source. Off by default."),
         },
         annotations: {
             readOnlyHint: true,
@@ -46,7 +81,7 @@ export function registerPolicyTools(server, config) {
             idempotentHint: true,
             openWorldHint: true,
         },
-    }, async ({ id }, { signal }) => {
+    }, async ({ id, includeAst }, { signal }) => {
         return withToolEnvelope(config, async () => {
             try {
                 const data = await opa.request({
@@ -54,7 +89,9 @@ export function registerPolicyTools(server, config) {
                     path: `/v1/policies/${encodeURIComponent(id)}`,
                     signal,
                 });
-                return ok({ policy: data.result });
+                return ok({
+                    policy: trimPolicy(data.result, { source: true, ast: includeAst === true }),
+                });
             }
             catch (e) {
                 return mapOpaClientError(e, 'POLICY_NOT_FOUND');

package/dist/tools/server-management/policies.js.map

@@ -1 +1 @@
-{"version":3,"file":"policies.js","sourceRoot":"","sources":["../../../src/tools/server-management/policies.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAQjD,MAAM,UAAU,mBAAmB,CAAC,MAAiB,EAAE,MAAc;IACnE,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;IAElC,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;QACE,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,qGAAqG;QACvG,WAAW,EAAE,EAAE;QACf,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC3B,OAAO,gBAAgB,CAAkC,MAAM,EAAE,KAAK,IAAI,EAAE;YAC1E,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAgC;oBAC5D,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,cAAc;oBACpB,MAAM;iBACP,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EAAE,0DAA0D;QACvE,WAAW,EAAE;YACX,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,iDAAiD,CAAC;SAClF;QACD,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC3B,OAAO,gBAAgB,CAA8B,MAAM,EAAE,KAAK,IAAI,EAAE;YACtE,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAA8B;oBAC1D,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,EAAE;oBAC9C,MAAM;iBACP,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,iBAAiB,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;YAClD,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,KAAK,EAAE,8BAA8B;QACrC,WAAW,EACT,mKAAmK;QACrK,WAAW,EAAE;YACX,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,iCAAiC,CAAC;YACjE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;SACnD;QACD,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QACnC,OAAO,gBAAgB,CAAoC,MAAM,EAAE,KAAK,IAAI,EAAE;YAC5E,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,OAAO,CAAC;oBAChB,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,EAAE;oBAC9C,OAAO,EAAE,MAAM;oBACf,cAAc,EAAE,YAAY;oBAC5B,MAAM;iBACP,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YACpC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;QACE,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EAAE,oDAAoD;QACjE,WAAW,EAAE;YACX,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC;SACvD;QACD,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE,KAAK;YACrB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC3B,OAAO,gBAAgB,CAAmC,MAAM,EAAE,KAAK,IAAI,EAAE;YAC3E,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,OAAO,CAAC;oBAChB,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,EAAE;oBAC9C,MAAM;iBACP,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACnC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,iBAAiB,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;YAClD,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"policies.js","sourceRoot":"","sources":["../../../src/tools/server-management/policies.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAQjD;;;;;;;;;GASG;AACH,SAAS,UAAU,CACjB,MAAuB,EACvB,IAAuC;IAEvC,MAAM,OAAO,GAAoB,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;IACnD,IAAI,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACtE,IAAI,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACnE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAiB,EAAE,MAAc;IACnE,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;IAElC,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;QACE,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,qSAAqS;QACvS,WAAW,EAAE;YACX,aAAa,EAAE,CAAC;iBACb,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,QAAQ,CACP,6HAA6H,CAC9H;YACH,UAAU,EAAE,CAAC;iBACV,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,QAAQ,CACP,sKAAsK,CACvK;SACJ;QACD,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAClD,OAAO,gBAAgB,CAAiD,MAAM,EAAE,KAAK,IAAI,EAAE;YACzF,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAgC;oBAC5D,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,cAAc;oBACpB,MAAM;iBACP,CAAC,CAAC;gBACH,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;gBAClC,OAAO,EAAE,CAAC;oBACR,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC1B,UAAU,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,aAAa,KAAK,IAAI,EAAE,GAAG,EAAE,UAAU,KAAK,IAAI,EAAE,CAAC,CAC5E;oBACD,KAAK,EAAE,OAAO,CAAC,MAAM;iBACtB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EACT,qQAAqQ;QACvQ,WAAW,EAAE;YACX,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,iDAAiD,CAAC;YACjF,UAAU,EAAE,CAAC;iBACV,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,QAAQ,CAAC,gEAAgE,CAAC;SAC9E;QACD,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QACvC,OAAO,gBAAgB,CAA8B,MAAM,EAAE,KAAK,IAAI,EAAE;YACtE,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAA8B;oBAC1D,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,EAAE;oBAC9C,MAAM;iBACP,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC;oBACR,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,KAAK,IAAI,EAAE,CAAC;iBAC5E,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,iBAAiB,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;YAClD,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,KAAK,EAAE,8BAA8B;QACrC,WAAW,EACT,mKAAmK;QACrK,WAAW,EAAE;YACX,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,iCAAiC,CAAC;YACjE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;SACnD;QACD,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QACnC,OAAO,gBAAgB,CAAoC,MAAM,EAAE,KAAK,IAAI,EAAE;YAC5E,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,OAAO,CAAC;oBAChB,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,EAAE;oBAC9C,OAAO,EAAE,MAAM;oBACf,cAAc,EAAE,YAAY;oBAC5B,MAAM;iBACP,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YACpC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;QACE,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EAAE,oDAAoD;QACjE,WAAW,EAAE;YACX,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC;SACvD;QACD,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE,KAAK;YACrB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC3B,OAAO,gBAAgB,CAAmC,MAAM,EAAE,KAAK,IAAI,EAAE;YAC3E,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,OAAO,CAAC;oBAChB,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,EAAE;oBAC9C,MAAM;iBACP,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACnC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,iBAAiB,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;YAClD,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/server-management/status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../../src/tools/server-management/status.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAM9C,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CA6G3E"}
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../../src/tools/server-management/status.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAuE9C,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAkH3E"}

package/dist/tools/server-management/status.js

@@ -2,15 +2,77 @@
  * Server-status tools: opa_health, opa_status, opa_config.
  */
 import { z } from 'zod';
-import { OpaClient, OpaUnreachableError } from '../../lib/opa-client.js';
-import { err, ok } from '../../lib/errors.js';
+import { OpaClient, OpaHttpError } from '../../lib/opa-client.js';
+import { ok } from '../../lib/errors.js';
 import { withToolEnvelope } from '../../lib/tool-helpers.js';
 import { mapOpaClientError } from './_shared.js';
+/** Stands in for a header value so the header is still visible as configured. */
+const REDACTED = '<redacted by opa-mcp>';
+/** OPA answers an unhealthy check with `{"error": "..."}`; surface that text. */
+function healthReason(e) {
+    const body = e.body;
+    if (typeof body === 'string' && body.trim().length > 0) {
+        try {
+            const parsed = JSON.parse(body);
+            if (typeof parsed.error === 'string')
+                return parsed.error;
+        }
+        catch {
+            return body.trim();
+        }
+        return body.trim();
+    }
+    if (typeof body === 'object' && body !== null) {
+        const parsed = body;
+        if (typeof parsed.error === 'string')
+            return parsed.error;
+    }
+    return undefined;
+}
+/**
+ * Redact the values of `services.*.headers` in an OPA configuration document.
+ *
+ * OPA drops the `credentials` block from `GET /v1/config` but returns `headers`
+ * verbatim, and a header is the ordinary way to put an API key or a bearer token
+ * in an OPA config. Handing those to an agent, which is what these two tools do
+ * with the document, puts a live credential into a transcript. The header names
+ * survive, so the document still answers what the server is configured to send.
+ */
+function redactServiceHeaders(document) {
+    if (typeof document !== 'object' || document === null || Array.isArray(document)) {
+        return document;
+    }
+    const doc = document;
+    const services = doc['services'];
+    if (typeof services !== 'object' || services === null || Array.isArray(services)) {
+        return document;
+    }
+    let touched = false;
+    const redactedServices = {};
+    for (const [name, service] of Object.entries(services)) {
+        if (typeof service !== 'object' || service === null || Array.isArray(service)) {
+            redactedServices[name] = service;
+            continue;
+        }
+        const entry = service;
+        const headers = entry['headers'];
+        if (typeof headers !== 'object' || headers === null || Array.isArray(headers)) {
+            redactedServices[name] = service;
+            continue;
+        }
+        touched = true;
+        redactedServices[name] = {
+            ...entry,
+            headers: Object.fromEntries(Object.keys(headers).map((k) => [k, REDACTED])),
+        };
+    }
+    return touched ? { ...doc, services: redactedServices } : document;
+}
 export function registerStatusTools(server, config) {
     const opa = new OpaClient(config);
     server.registerTool('opa_health', {
         title: 'OPA health check',
-        description: 'Hit the OPA `/health` endpoint. Returns `{ healthy: true }` on 200. Supports `bundles` and `plugins` query flags to require those subsystems to also be healthy.',
+        description: "Hit the OPA `/health` endpoint. A server that answers reports `{ healthy: true }` on 200 and `{ healthy: false }` with OPA's own reason otherwise, so an unactivated bundle is a health result rather than a tool error. `OPA_UNREACHABLE` means the server could not be reached at all. Supports `bundles` and `plugins` query flags to require those subsystems to also be healthy.",
         inputSchema: {
             bundles: z.boolean().optional().describe('Require bundle plugin to be healthy as well.'),
             plugins: z.boolean().optional().describe('Require all plugins to be healthy.'),
@@ -38,13 +100,16 @@ export function registerStatusTools(server, config) {
                 return ok({ healthy: true });
             }
             catch (e) {
-                if (e instanceof OpaUnreachableError) {
-                    return mapOpaClientError(e);
+                // A server that answered is reachable. Reporting an unactivated
+                // bundle as OPA_UNREACHABLE told the caller to go start a server that
+                // was already running, and buried OPA's own reason in a stringified
+                // error. Authentication is its own failure, not a health result, and
+                // so is a server that could not be reached or a cancelled request.
+                if (e instanceof OpaHttpError && e.status !== 401) {
+                    const reason = healthReason(e);
+                    return ok({ healthy: false, ...(reason !== undefined ? { reason } : {}) });
                 }
-                // Any non-2xx counts as unhealthy without raising.
-                return err('OPA_UNREACHABLE', 'OPA reported unhealthy.', {
-                    details: { error: e instanceof Error ? e.message : String(e) },
-                });
+                return mapOpaClientError(e);
             }
         });
     });
@@ -54,7 +119,9 @@ export function registerStatusTools(server, config) {
             'Returns the same underlying document as `opa_config` but presented under a `status` ' +
             'key as a convenience for agents that want to check "what is running" rather than ' +
             '"what was the server configured with". The response includes bundle settings, ' +
-            'decision-log settings, and plugin configuration as OPA reported them at startup.',
+            'decision-log settings, and plugin configuration as OPA reported them at startup. ' +
+            'Service header values are redacted, since OPA returns them verbatim and a header is ' +
+            'the ordinary place to put an API key.',
         inputSchema: {},
         annotations: {
             readOnlyHint: true,
@@ -70,7 +137,7 @@ export function registerStatusTools(server, config) {
                     path: '/v1/config',
                     signal,
                 });
-                return ok({ status: data.result ?? data });
+                return ok({ status: redactServiceHeaders(data.result ?? data) });
             }
             catch (e) {
                 return mapOpaClientError(e);
@@ -79,7 +146,7 @@ export function registerStatusTools(server, config) {
     });
     server.registerTool('opa_config', {
         title: 'OPA configuration',
-        description: 'Return the running OPA server configuration (sanitized -- secrets are not included).',
+        description: 'Return the running OPA server configuration from `GET /v1/config`. OPA drops the `credentials` block but returns `services.*.headers` verbatim, which is the ordinary place to put an API key or a bearer token, so those values are redacted here and the header names kept.',
         inputSchema: {},
         annotations: {
             readOnlyHint: true,
@@ -95,7 +162,7 @@ export function registerStatusTools(server, config) {
                     path: '/v1/config',
                     signal,
                 });
-                return ok({ config: data.result ?? data });
+                return ok({ config: redactServiceHeaders(data.result ?? data) });
             }
             catch (e) {
                 return mapOpaClientError(e);

package/dist/tools/server-management/status.js.map

@@ -1 +1 @@
-{"version":3,"file":"status.js","sourceRoot":"","sources":["../../../src/tools/server-management/status.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,MAAM,UAAU,mBAAmB,CAAC,MAAiB,EAAE,MAAc;IACnE,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;IAElC,MAAM,CAAC,YAAY,CACjB,YAAY,EACZ;QACE,KAAK,EAAE,kBAAkB;QACzB,WAAW,EACT,kKAAkK;QACpK,WAAW,EAAE;YACX,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;YACxF,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;SAC/E;QACD,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QACzC,OAAO,gBAAgB,CAAuB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC/D,IAAI,CAAC;gBACH,MAAM,KAAK,GAA4B,EAAE,CAAC;gBAC1C,IAAI,OAAO;oBAAE,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;gBACrC,IAAI,OAAO;oBAAE,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;gBACrC,MAAM,GAAG,CAAC,OAAO,CAAC;oBAChB,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,SAAS;oBACf,KAAK;oBACL,MAAM;iBACP,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,mBAAmB,EAAE,CAAC;oBACrC,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC;gBAC9B,CAAC;gBACD,mDAAmD;gBACnD,OAAO,GAAG,CAAC,iBAAiB,EAAE,yBAAyB,EAAE;oBACvD,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;iBAC/D,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,YAAY,EACZ;QACE,KAAK,EAAE,YAAY;QACnB,WAAW,EACT,oEAAoE;YACpE,sFAAsF;YACtF,mFAAmF;YACnF,gFAAgF;YAChF,kFAAkF;QACpF,WAAW,EAAE,EAAE;QACf,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC3B,OAAO,gBAAgB,CAAsB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC9D,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAuB;oBACnD,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,YAAY;oBAClB,MAAM;iBACP,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,YAAY,EACZ;QACE,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,sFAAsF;QACxF,WAAW,EAAE,EAAE;QACf,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC3B,OAAO,gBAAgB,CAAsB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC9D,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAsB;oBAClD,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,YAAY;oBAClB,MAAM;iBACP,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../../src/tools/server-management/status.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,iFAAiF;AACjF,MAAM,QAAQ,GAAG,uBAAuB,CAAC;AAEzC,iFAAiF;AACjF,SAAS,YAAY,CAAC,CAAe;IACnC,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IACpB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAwB,CAAC;YACvD,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;gBAAE,OAAO,MAAM,CAAC,KAAK,CAAC;QAC5D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;QACrB,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,IAA2B,CAAC;QAC3C,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC;IAC5D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,oBAAoB,CAAC,QAAiB;IAC7C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjF,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,GAAG,QAAmC,CAAC;IAChD,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;IACjC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjF,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,gBAAgB,GAA4B,EAAE,CAAC;IAErD,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAmC,CAAC,EAAE,CAAC;QAClF,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9E,gBAAgB,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;YACjC,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,OAAkC,CAAC;QACjD,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9E,gBAAgB,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;YACjC,SAAS;QACX,CAAC;QACD,OAAO,GAAG,IAAI,CAAC;QACf,gBAAgB,CAAC,IAAI,CAAC,GAAG;YACvB,GAAG,KAAK;YACR,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;SAC5E,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAiB,EAAE,MAAc;IACnE,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;IAElC,MAAM,CAAC,YAAY,CACjB,YAAY,EACZ;QACE,KAAK,EAAE,kBAAkB;QACzB,WAAW,EACT,uXAAuX;QACzX,WAAW,EAAE;YACX,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;YACxF,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;SAC/E;QACD,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QACzC,OAAO,gBAAgB,CAAwC,MAAM,EAAE,KAAK,IAAI,EAAE;YAChF,IAAI,CAAC;gBACH,MAAM,KAAK,GAA4B,EAAE,CAAC;gBAC1C,IAAI,OAAO;oBAAE,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;gBACrC,IAAI,OAAO;oBAAE,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;gBACrC,MAAM,GAAG,CAAC,OAAO,CAAC;oBAChB,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,SAAS;oBACf,KAAK;oBACL,MAAM;iBACP,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,gEAAgE;gBAChE,sEAAsE;gBACtE,oEAAoE;gBACpE,qEAAqE;gBACrE,mEAAmE;gBACnE,IAAI,CAAC,YAAY,YAAY,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAClD,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;oBAC/B,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC7E,CAAC;gBACD,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,YAAY,EACZ;QACE,KAAK,EAAE,YAAY;QACnB,WAAW,EACT,oEAAoE;YACpE,sFAAsF;YACtF,mFAAmF;YACnF,gFAAgF;YAChF,mFAAmF;YACnF,sFAAsF;YACtF,uCAAuC;QACzC,WAAW,EAAE,EAAE;QACf,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC3B,OAAO,gBAAgB,CAAsB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC9D,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAuB;oBACnD,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,YAAY;oBAClB,MAAM;iBACP,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,oBAAoB,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC;YACnE,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,YAAY,EACZ;QACE,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,+QAA+Q;QACjR,WAAW,EAAE,EAAE;QACf,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC3B,OAAO,gBAAgB,CAAsB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC9D,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAsB;oBAClD,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,YAAY;oBAClB,MAAM;iBACP,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,oBAAoB,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC;YACnE,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/types.d.ts

@@ -2,6 +2,15 @@
  * Shared types used across tools, prompts, and resources.
  */
 /** Standard error codes returned by tools. */
+/**
+ * Codes a tool can return.
+ *
+ * Four names are reserved and currently unused: REGAL_VERSION_TOO_OLD (no
+ * minimum-version check exists), DEPENDENCY_CONFLICT, VERIFY_INCONCLUSIVE
+ * (rego_verify reports an inconclusive result as a verdict, not an error) and
+ * Z3_INIT_ERROR. They are kept so the union stays stable for consumers, and
+ * are no longer listed in the README as codes a caller can expect.
+ */
 export type ToolErrorCode = 'INVALID_INPUT' | 'OPA_BINARY_NOT_FOUND' | 'REGAL_NOT_FOUND' | 'REGAL_VERSION_TOO_OLD' | 'CONFTEST_NOT_FOUND' | 'INVALID_REGO' | 'INVALID_BUNDLE' | 'EVAL_ERROR' | 'PATH_NOT_ALLOWED' | 'PATH_NOT_FOUND' | 'OPA_UNREACHABLE' | 'OPA_AUTH_FAILED' | 'POLICY_NOT_FOUND' | 'DATA_NOT_FOUND' | 'DEPENDENCY_CONFLICT' | 'NO_TESTS_FOUND' | 'COVERAGE_BELOW_THRESHOLD' | 'OUTPUT_TOO_LARGE' | 'TIMEOUT' | 'CANCELLED' | 'VERIFY_INCONCLUSIVE' | 'Z3_INIT_ERROR' | 'OPA_VERSION_UNSUPPORTED' | 'GITHUB_TOKEN_MISSING' | 'GIST_CREATE_FAILED' | 'UNKNOWN_ERROR';
 /** Structured error payload. */
 export interface ToolError {

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,8CAA8C;AAC9C,MAAM,MAAM,aAAa,GACrB,eAAe,GACf,sBAAsB,GACtB,iBAAiB,GACjB,uBAAuB,GACvB,oBAAoB,GACpB,cAAc,GACd,gBAAgB,GAChB,YAAY,GACZ,kBAAkB,GAClB,gBAAgB,GAChB,iBAAiB,GACjB,iBAAiB,GACjB,kBAAkB,GAClB,gBAAgB,GAChB,qBAAqB,GACrB,gBAAgB,GAChB,0BAA0B,GAC1B,kBAAkB,GAClB,SAAS,GACT,WAAW,GACX,qBAAqB,GACrB,eAAe,GACf,yBAAyB,GACzB,sBAAsB,GACtB,oBAAoB,GACpB,eAAe,CAAC;AAEpB,gCAAgC;AAChC,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,OAAO;IACvC,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,CAAC,EAAE,CAAC,CAAC;IACT,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,8CAA8C;AAC9C;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GACrB,eAAe,GACf,sBAAsB,GACtB,iBAAiB,GACjB,uBAAuB,GACvB,oBAAoB,GACpB,cAAc,GACd,gBAAgB,GAChB,YAAY,GACZ,kBAAkB,GAClB,gBAAgB,GAChB,iBAAiB,GACjB,iBAAiB,GACjB,kBAAkB,GAClB,gBAAgB,GAChB,qBAAqB,GACrB,gBAAgB,GAChB,0BAA0B,GAC1B,kBAAkB,GAClB,SAAS,GACT,WAAW,GACX,qBAAqB,GACrB,eAAe,GACf,yBAAyB,GACzB,sBAAsB,GACtB,oBAAoB,GACpB,eAAe,CAAC;AAEpB,gCAAgC;AAChC,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,OAAO;IACvC,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,CAAC,EAAE,CAAC,CAAC;IACT,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orygn/opa-mcp",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "mcpName": "io.github.OrygnsCode/opa-mcp",
   "description": "Model Context Protocol server for Open Policy Agent (OPA). Author, validate, debug, and explain Rego policies through any MCP-compatible client.",
   "type": "module",
@@ -59,6 +59,7 @@
     "test:watch": "vitest",
     "test:coverage": "vitest run --config vitest.coverage.config.ts --coverage",
     "test:integration": "vitest run --config vitest.integration.config.ts",
+    "verify:fuzz": "node scripts/verify-soundness-fuzz.mjs",
     "prepublishOnly": "npm run lint && npm run typecheck && npm run test && npm run build",
     "clean": "rimraf dist coverage .vitest-cache",
     "bundle:fetch": "node scripts/fetch-opa-binaries.mjs",