@rekey.dev/mcp 1.1.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ReliPay
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,110 @@
+# `@rekey.dev/mcp`
+
+A [Model Context Protocol](https://modelcontextprotocol.io) server for [Rekey](https://relipay.dev). Lets Claude Desktop, Cursor, and Claude Code introspect a deployment — and mint API keys — directly, without screenshots or copy-paste from the panel.
+
+> **For AI agents connected through this server:** see [AGENTS.md](./AGENTS.md) for what's safe to call and the write-tool safety model.
+
+```bash
+# Run on demand (no global install needed):
+npx -y @rekey.dev/mcp
+```
+
+It's a stdio MCP server — you don't run it by hand. Wire it into your MCP client's config (below) and the client launches it.
+
+## Setup
+
+The server reads three env vars (set them in your MCP client config, not your shell):
+
+| Env var | Required | What it's for | Where to get it |
+| --- | --- | --- | --- |
+| `RELIPAY_URL` | yes | Base URL of the deployment, e.g. `https://api.relipay.dev`. | Your Rekey deployment |
+| `SUPER_ADMIN_KEY` | for **read** tools | Authenticates the global read/introspection tools. | Deployment admin |
+| `RELIPAY_OPERATOR_TOKEN` | for `mint_api_key` | A scoped operator **personal-access-token** (`rp_op_…`). | Panel → operator API tokens (or `POST /api/v1/tenant/auth/api-tokens`), scoped to `keys:mint` |
+
+`RELIPAY_URL` plus **at least one** credential is required. Set `SUPER_ADMIN_KEY` for the read tools, `RELIPAY_OPERATOR_TOKEN` for the `keys:mint` write tool, or both. An agent that should only mint keys can run with the operator token alone (no master key) — the read tools then fail closed with `READ_REQUIRES_ADMIN_KEY`. The server exits with a clear stderr message if `RELIPAY_URL` or every credential is missing.
+
+> The `mint_api_key` write tool does **not** use the all-powerful
+> `SUPER_ADMIN_KEY`. It authenticates as a **scoped operator** via
+> `RELIPAY_OPERATOR_TOKEN`, which must carry the `keys:mint` scope and belong to
+> the workspace that owns the target Application — default-deny, so an agent
+> can't mutate production unless you explicitly grant it.
+
+## Quickstart
+
+### Claude Desktop
+
+`~/Library/Application Support/Claude/claude_desktop_config.json` (macOS), or the equivalent on your platform:
+
+```json
+{
+  "mcpServers": {
+    "rekey": {
+      "command": "npx",
+      "args": ["-y", "@rekey.dev/mcp"],
+      "env": {
+        "RELIPAY_URL": "https://api.relipay.dev",
+        "SUPER_ADMIN_KEY": "your-admin-key",
+        "RELIPAY_OPERATOR_TOKEN": "rp_op_…"
+      }
+    }
+  }
+}
+```
+
+Restart Claude Desktop. Tools appear as `mcp__relipay__list_applications`, etc.
+
+### Cursor
+
+Settings → MCP → Add Server. Same `command` / `args` / `env` shape.
+
+### Claude Code
+
+`.claude/mcp.json` in your repo (same shape). Omit `RELIPAY_OPERATOR_TOKEN` if you only need read tools, or omit `SUPER_ADMIN_KEY` if the agent only needs the `mint_api_key` write tool.
+
+## Tools
+
+**Read tools** (authenticated with `SUPER_ADMIN_KEY`):
+
+| Tool | What it does |
+| --- | --- |
+| `list_tenants` | All Tenants in the deployment. |
+| `list_applications` | Applications, optionally filtered by `tenantId`. |
+| `get_application` | One Application by id (with authConfig + billingConfig — no secrets). |
+| `list_plans` | Plans for an Application; `includeInactive` for archived ones. |
+| `list_coupons` | Coupons for an Application; `includeInactive` for deactivated ones. |
+| `list_api_keys` | Active API keys for an Application — metadata only; the hash is never returned. |
+| `list_payments` | Recent payments (newest first), filterable by `applicationId` / `status` (`PENDING`/`SUCCEEDED`/`FAILED`/`REFUNDED`), exact-match `q` (payment id / provider payment id / end-user id), `sort` (`createdAt`/`amount`), `order`, `limit` (≤200). Amounts are integers in the smallest currency unit. |
+| `get_payment_stats_by_app` | Per-application payment health over the last 30 days — succeeded/failed/pending/refunded counts, success rate, SUCCEEDED volume (`volumeCents`). The panel's richer per-app Billing Overview (`MRR`, 12-month series) lives at the **panel-session-only** endpoint `/api/v1/tenant/applications/:id/billing/stats` and is not reachable with this server's credentials. |
+
+**Write tools** (authenticated with the scoped `RELIPAY_OPERATOR_TOKEN`):
+
+| Tool | What it does |
+| --- | --- |
+| `mint_api_key` | Mint a new secret key (`rp_live_…` / `rp_test_…`) for an Application. Args: `applicationId`, `name`, `mode?` (`live`/`test`), `scopes?`. The raw key is returned **exactly once** — surface it immediately and warn it's unrecoverable. |
+
+### `mint_api_key` failure modes (default-deny)
+
+| Condition | Error |
+| --- | --- |
+| No `RELIPAY_OPERATOR_TOKEN` configured | `OPERATOR_TOKEN_MISSING` — never falls back to the admin key. |
+| PAT lacks the `keys:mint` scope | `OPERATOR_SCOPE_INSUFFICIENT` (403). |
+| PAT bound to a different workspace than the Application | `APPLICATION_NOT_FOUND` (404) — no cross-tenant oracle. |
+| PAT revoked / expired | `OPERATOR_TOKEN_INVALID` (401). |
+
+## Errors
+
+Every tool error is a JSON object — `error: { code, message, fix?, statusCode? }` — in the response content (with `isError: true`). Read `fix` first. Common codes: `TOOL_NOT_FOUND`, `TOOL_ARGS_INVALID`, `APPLICATION_NOT_FOUND`, `ADMIN_AUTH_INVALID`.
+
+## Gotchas
+
+- **Money is integers in the smallest currency unit** (cents/paise/sen). Render `999 USD/MONTH` as `$9.99/month` — never assume a `.00` decimal (`¥100` is a hundred whole yen).
+- **Only call `mint_api_key` when the user explicitly asks** to create/mint a key. For other mutations (create plan, refund, deactivate coupon — not yet exposed), use the read tools to figure out what to do, then the `rekey` CLI or the Panel.
+- **Coupon discounts**: PERCENT uses basis-points × 10 (`1500` = 15%); AMOUNT uses the smallest currency unit.
+
+## Links
+
+- Docs: [/docs](https://relipay.dev/docs) · [SDK guide](https://relipay.dev/docs/sdk) · [API reference](https://relipay.dev/docs/api) · [agent prompt](https://relipay.dev/docs/prompt)
+
+## License
+
+MIT

package/dist/client.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Admin-API client used by every MCP tool. Mirrors `packages/cli/src/lib/api.ts`
+ * but is decoupled (the MCP server doesn't depend on the CLI).
+ */
+export interface AdminClientConfig {
+    apiUrl: string;
+    /**
+     * Global super-admin key. Authenticates the (global-scope) READ tools.
+     * Optional: when unset, the server can still run for the scoped write tool —
+     * read tools then fail closed with `READ_REQUIRES_ADMIN_KEY` rather than
+     * silently using a lesser credential.
+     */
+    adminKey?: string;
+    /**
+     * Operator personal-access-token (`rp_op_…`), if configured. Used ONLY by
+     * write tools, which authenticate as a scoped operator rather than with the
+     * all-powerful `adminKey`. Read tools never touch this. Optional: when unset,
+     * write tools refuse to run with a clear `OPERATOR_TOKEN_MISSING` error.
+     */
+    operatorToken?: string;
+}
+export declare class AdminApiError extends Error {
+    readonly code: string;
+    readonly fix: string | undefined;
+    readonly statusCode: number;
+    constructor(args: {
+        code: string;
+        message: string;
+        fix?: string;
+        statusCode: number;
+    });
+}
+export declare class AdminClient {
+    private readonly cfg;
+    constructor(cfg: AdminClientConfig);
+    /** Read-path request — authenticated with the admin key. */
+    request<T>(method: string, path: string, body?: unknown): Promise<T>;
+    /**
+     * Write-path request — authenticated with the configured operator PAT
+     * (`rp_op_…`). Used by write tools so an agent acts as a SCOPED operator, not
+     * as the global super-admin. Throws `OPERATOR_TOKEN_MISSING` if no PAT was
+     * configured — write tools must fail closed, never silently fall back to the
+     * admin key.
+     */
+    requestAsOperator<T>(method: string, path: string, body?: unknown): Promise<T>;
+    private send;
+}
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qBAAa,aAAc,SAAQ,KAAK;IACtC,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,SAAgB,UAAU,EAAE,MAAM,CAAC;gBACvB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE;CAOtF;AAED,qBAAa,WAAW;IACV,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,iBAAiB;IAInD,4DAA4D;IACtD,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAY1E;;;;;;OAMG;IACG,iBAAiB,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;YAYtE,IAAI;CA0BnB"}

package/dist/client.js

@@ -0,0 +1,73 @@
+/**
+ * Admin-API client used by every MCP tool. Mirrors `packages/cli/src/lib/api.ts`
+ * but is decoupled (the MCP server doesn't depend on the CLI).
+ */
+export class AdminApiError extends Error {
+    code;
+    fix;
+    statusCode;
+    constructor(args) {
+        super(args.message);
+        this.name = 'AdminApiError';
+        this.code = args.code;
+        this.fix = args.fix;
+        this.statusCode = args.statusCode;
+    }
+}
+export class AdminClient {
+    cfg;
+    constructor(cfg) {
+        this.cfg = cfg;
+        if (!cfg.apiUrl)
+            throw new Error('AdminClient: apiUrl is required.');
+    }
+    /** Read-path request — authenticated with the admin key. */
+    async request(method, path, body) {
+        if (!this.cfg.adminKey) {
+            throw new AdminApiError({
+                code: 'READ_REQUIRES_ADMIN_KEY',
+                message: 'This read/introspection tool requires the global SUPER_ADMIN_KEY.',
+                fix: 'Set SUPER_ADMIN_KEY in the MCP server env to enable read tools. (The keys:mint write tool only needs RELIPAY_OPERATOR_TOKEN.)',
+                statusCode: 400,
+            });
+        }
+        return this.send(method, path, this.cfg.adminKey, body);
+    }
+    /**
+     * Write-path request — authenticated with the configured operator PAT
+     * (`rp_op_…`). Used by write tools so an agent acts as a SCOPED operator, not
+     * as the global super-admin. Throws `OPERATOR_TOKEN_MISSING` if no PAT was
+     * configured — write tools must fail closed, never silently fall back to the
+     * admin key.
+     */
+    async requestAsOperator(method, path, body) {
+        if (!this.cfg.operatorToken) {
+            throw new AdminApiError({
+                code: 'OPERATOR_TOKEN_MISSING',
+                message: 'This write tool requires an operator personal-access-token.',
+                fix: 'Set RELIPAY_OPERATOR_TOKEN (an rp_op_… token minted in the Panel, scoped to keys:mint) in the MCP server env.',
+                statusCode: 400,
+            });
+        }
+        return this.send(method, path, this.cfg.operatorToken, body);
+    }
+    async send(method, path, bearer, body) {
+        const res = await fetch(`${this.cfg.apiUrl.replace(/\/$/, '')}${path}`, {
+            method,
+            headers: {
+                Authorization: `Bearer ${bearer}`,
+                ...(body !== undefined ? { 'Content-Type': 'application/json' } : {}),
+            },
+            ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
+        });
+        const json = (await res.json().catch(() => ({})));
+        if (!res.ok || ('success' in json && json.success === false)) {
+            const err = 'error' in json
+                ? json.error
+                : { code: 'UNKNOWN_ERROR', message: `HTTP ${res.status}` };
+            throw new AdminApiError({ ...err, statusCode: res.status });
+        }
+        return json.data;
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAyBH,MAAM,OAAO,aAAc,SAAQ,KAAK;IACtB,IAAI,CAAS;IACb,GAAG,CAAqB;IACxB,UAAU,CAAS;IACnC,YAAY,IAAyE;QACnF,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACpB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,WAAW;IACO;IAA7B,YAA6B,GAAsB;QAAtB,QAAG,GAAH,GAAG,CAAmB;QACjD,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACvE,CAAC;IAED,4DAA4D;IAC5D,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QAC3D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YACvB,MAAM,IAAI,aAAa,CAAC;gBACtB,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,mEAAmE;gBAC5E,GAAG,EAAE,+HAA+H;gBACpI,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,iBAAiB,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACrE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;YAC5B,MAAM,IAAI,aAAa,CAAC;gBACtB,IAAI,EAAE,wBAAwB;gBAC9B,OAAO,EAAE,6DAA6D;gBACtE,GAAG,EAAE,+GAA+G;gBACpH,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IAClE,CAAC;IAEO,KAAK,CAAC,IAAI,CAChB,MAAc,EACd,IAAY,EACZ,MAAc,EACd,IAAc;QAEd,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE;YACtE,MAAM;YACN,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,MAAM,EAAE;gBACjC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtE;YACD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAE/B,CAAC;QAClB,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,EAAE,CAAC;YAC7D,MAAM,GAAG,GACP,OAAO,IAAI,IAAI;gBACb,CAAC,CAAC,IAAI,CAAC,KAAK;gBACZ,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/D,MAAM,IAAI,aAAa,CAAC,EAAE,GAAG,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,OAAQ,IAAmC,CAAC,IAAI,CAAC;IACnD,CAAC;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+/**
+ * @rekey.dev/mcp — Model Context Protocol server.
+ *
+ * Speaks MCP over stdio, exposing introspection tools for Rekey
+ * (Applications, Plans, Coupons, API keys, Tenants) plus a single guarded
+ * WRITE tool (`mint_api_key`). Designed to be wired into Claude Desktop,
+ * Cursor, and Claude Code so an AI agent can answer "what plans does this app
+ * have?" or mint a fresh API key without screenshots.
+ *
+ * Read tools use `SUPER_ADMIN_KEY` (global scope). The write tool uses a SCOPED
+ * operator personal-access-token (`RELIPAY_OPERATOR_TOKEN`, an `rp_op_…` token)
+ * and is rejected server-side unless that PAT carries the `keys:mint` scope —
+ * default-deny, so an agent can't mutate production unless explicitly granted.
+ *
+ * At least ONE credential is required. An agent that should only mint keys can
+ * run with `RELIPAY_OPERATOR_TOKEN` alone (no master key) — read tools then fail
+ * closed with `READ_REQUIRES_ADMIN_KEY`. Configure `SUPER_ADMIN_KEY` too to
+ * enable the global read/introspection tools.
+ */
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;GAkBG"}

package/dist/index.js

@@ -0,0 +1,127 @@
+#!/usr/bin/env node
+/**
+ * @rekey.dev/mcp — Model Context Protocol server.
+ *
+ * Speaks MCP over stdio, exposing introspection tools for Rekey
+ * (Applications, Plans, Coupons, API keys, Tenants) plus a single guarded
+ * WRITE tool (`mint_api_key`). Designed to be wired into Claude Desktop,
+ * Cursor, and Claude Code so an AI agent can answer "what plans does this app
+ * have?" or mint a fresh API key without screenshots.
+ *
+ * Read tools use `SUPER_ADMIN_KEY` (global scope). The write tool uses a SCOPED
+ * operator personal-access-token (`RELIPAY_OPERATOR_TOKEN`, an `rp_op_…` token)
+ * and is rejected server-side unless that PAT carries the `keys:mint` scope —
+ * default-deny, so an agent can't mutate production unless explicitly granted.
+ *
+ * At least ONE credential is required. An agent that should only mint keys can
+ * run with `RELIPAY_OPERATOR_TOKEN` alone (no master key) — read tools then fail
+ * closed with `READ_REQUIRES_ADMIN_KEY`. Configure `SUPER_ADMIN_KEY` too to
+ * enable the global read/introspection tools.
+ */
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { CallToolRequestSchema, ListToolsRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
+import { zodToJsonSchema } from './lib/zod-to-json-schema.js';
+import { AdminClient, AdminApiError } from './client.js';
+import { tools } from './tools.js';
+const apiUrl = process.env.RELIPAY_URL ?? '';
+const adminKey = process.env.SUPER_ADMIN_KEY ?? '';
+// Optional: only required by the `mint_api_key` write tool. Read tools work
+// without it. When absent, the write tool fails closed with a clear error.
+const operatorToken = process.env.RELIPAY_OPERATOR_TOKEN ?? '';
+if (!apiUrl || (!adminKey && !operatorToken)) {
+    process.stderr.write(`[rekey-mcp] missing required env: RELIPAY_URL plus at least one credential ` +
+        `(SUPER_ADMIN_KEY for read tools and/or RELIPAY_OPERATOR_TOKEN for the keys:mint write tool).\n` +
+        `[rekey-mcp] fix: configure these in the MCP client (Claude Desktop config, Cursor MCP settings, …)\n`);
+    process.exit(1);
+}
+const client = new AdminClient({
+    apiUrl,
+    ...(adminKey ? { adminKey } : {}),
+    ...(operatorToken ? { operatorToken } : {}),
+});
+const server = new Server({ name: 'rekey-mcp', version: '0.0.0' }, { capabilities: { tools: {} } });
+server.setRequestHandler(ListToolsRequestSchema, () => ({
+    tools: tools.map((t) => ({
+        name: t.name,
+        description: t.description,
+        inputSchema: zodToJsonSchema(t.inputSchema),
+    })),
+}));
+server.setRequestHandler(CallToolRequestSchema, async (req) => {
+    const tool = tools.find((t) => t.name === req.params.name);
+    if (!tool) {
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: JSON.stringify({
+                        error: {
+                            code: 'TOOL_NOT_FOUND',
+                            message: `Unknown tool: ${req.params.name}`,
+                            fix: 'Call list_tools to see what is available.',
+                        },
+                    }, null, 2),
+                },
+            ],
+            isError: true,
+        };
+    }
+    const parsed = tool.inputSchema.safeParse(req.params.arguments ?? {});
+    if (!parsed.success) {
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: JSON.stringify({
+                        error: {
+                            code: 'TOOL_ARGS_INVALID',
+                            message: 'Tool arguments failed validation.',
+                            fix: 'Re-call with arguments matching inputSchema. Issues: ' +
+                                parsed.error.issues.map((i) => `${i.path.join('.')}: ${i.message}`).join('; '),
+                        },
+                    }, null, 2),
+                },
+            ],
+            isError: true,
+        };
+    }
+    try {
+        const result = await tool.execute(client, parsed.data);
+        return {
+            content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],
+        };
+    }
+    catch (err) {
+        if (err instanceof AdminApiError) {
+            return {
+                content: [
+                    {
+                        type: 'text',
+                        text: JSON.stringify({
+                            error: { code: err.code, message: err.message, fix: err.fix, statusCode: err.statusCode },
+                        }, null, 2),
+                    },
+                ],
+                isError: true,
+            };
+        }
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: JSON.stringify({
+                        error: {
+                            code: 'TOOL_EXECUTION_FAILED',
+                            message: err instanceof Error ? err.message : String(err),
+                        },
+                    }, null, 2),
+                },
+            ],
+            isError: true,
+        };
+    }
+});
+const transport = new StdioServerTransport();
+void server.connect(transport);
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEnC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;AAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC;AACnD,4EAA4E;AAC5E,2EAA2E;AAC3E,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC;AAE/D,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;IAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,6EAA6E;QAC3E,gGAAgG;QAChG,sGAAsG,CACzG,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC;IAC7B,MAAM;IACN,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACjC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CAC5C,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,EACvC,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;AAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC;IACtD,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC;KAC5C,CAAC,CAAC;CACJ,CAAC,CAAC,CAAC;AAEJ,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;IAC5D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3D,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAClB;wBACE,KAAK,EAAE;4BACL,IAAI,EAAE,gBAAgB;4BACtB,OAAO,EAAE,iBAAiB,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE;4BAC3C,GAAG,EAAE,2CAA2C;yBACjD;qBACF,EACD,IAAI,EACJ,CAAC,CACF;iBACF;aACF;YACD,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IACtE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAClB;wBACE,KAAK,EAAE;4BACL,IAAI,EAAE,mBAAmB;4BACzB,OAAO,EAAE,mCAAmC;4BAC5C,GAAG,EAAE,uDAAuD;gCAC1D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;yBACjF;qBACF,EACD,IAAI,EACJ,CAAC,CACF;iBACF;aACF;YACD,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACvD,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAClB;4BACE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE;yBAC1F,EACD,IAAI,EACJ,CAAC,CACF;qBACF;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAClB;wBACE,KAAK,EAAE;4BACL,IAAI,EAAE,uBAAuB;4BAC7B,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;yBAC1D;qBACF,EACD,IAAI,EACJ,CAAC,CACF;iBACF;aACF;YACD,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;AAC7C,KAAK,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC"}

package/dist/lib/zod-to-json-schema.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Tiny Zod → JSON Schema shim sufficient for MCP tool input descriptors.
+ *
+ * The MCP `tools/list` response wants each tool's `inputSchema` as a JSON
+ * Schema object. We only use a small Zod subset (objects of strings /
+ * booleans / optionals with descriptions), so reaching for `zod-to-json-schema`
+ * as a full dependency is overkill — this 30-line implementation covers it
+ * and stays auditable. If the tool surface grows, swap in the npm package.
+ */
+import { z } from 'zod';
+interface JsonSchema {
+    type: string;
+    properties?: Record<string, JsonSchema>;
+    required?: string[];
+    description?: string;
+    items?: JsonSchema;
+    enum?: string[];
+}
+export declare function zodToJsonSchema(schema: z.ZodTypeAny): JsonSchema;
+export {};
+//# sourceMappingURL=zod-to-json-schema.d.ts.map

package/dist/lib/zod-to-json-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zod-to-json-schema.d.ts","sourceRoot":"","sources":["../../src/lib/zod-to-json-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,UAAU,UAAU;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACxC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,GAAG,UAAU,CA2BhE"}

package/dist/lib/zod-to-json-schema.js

@@ -0,0 +1,62 @@
+/**
+ * Tiny Zod → JSON Schema shim sufficient for MCP tool input descriptors.
+ *
+ * The MCP `tools/list` response wants each tool's `inputSchema` as a JSON
+ * Schema object. We only use a small Zod subset (objects of strings /
+ * booleans / optionals with descriptions), so reaching for `zod-to-json-schema`
+ * as a full dependency is overkill — this 30-line implementation covers it
+ * and stays auditable. If the tool surface grows, swap in the npm package.
+ */
+import { z } from 'zod';
+export function zodToJsonSchema(schema) {
+    // Object — the common top-level case for tool args.
+    if (schema instanceof z.ZodObject) {
+        const shape = schema.shape;
+        const properties = {};
+        const required = [];
+        for (const [key, value] of Object.entries(shape)) {
+            const inner = unwrap(value);
+            properties[key] = zodToJsonSchema(inner.schema);
+            if (inner.description)
+                properties[key].description = inner.description;
+            if (!inner.optional)
+                required.push(key);
+        }
+        return {
+            type: 'object',
+            properties,
+            ...(required.length > 0 && { required }),
+        };
+    }
+    if (schema instanceof z.ZodString)
+        return { type: 'string' };
+    if (schema instanceof z.ZodEnum)
+        return { type: 'string', enum: [...schema.options] };
+    if (schema instanceof z.ZodNumber)
+        return { type: 'number' };
+    if (schema instanceof z.ZodBoolean)
+        return { type: 'boolean' };
+    if (schema instanceof z.ZodArray) {
+        return { type: 'array', items: zodToJsonSchema(schema.element) };
+    }
+    // Fallback — let MCP receive an open object.
+    return { type: 'object' };
+}
+function unwrap(s) {
+    let optional = false;
+    let description;
+    let cur = s;
+    // Unwrap z.optional() and pick up .describe() metadata.
+    while (true) {
+        description = description ?? cur.description;
+        if (cur instanceof z.ZodOptional) {
+            optional = true;
+            cur = cur.unwrap();
+        }
+        else {
+            break;
+        }
+    }
+    return { schema: cur, optional, description };
+}
+//# sourceMappingURL=zod-to-json-schema.js.map

package/dist/lib/zod-to-json-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zod-to-json-schema.js","sourceRoot":"","sources":["../../src/lib/zod-to-json-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAWxB,MAAM,UAAU,eAAe,CAAC,MAAoB;IAClD,oDAAoD;IACpD,IAAI,MAAM,YAAY,CAAC,CAAC,SAAS,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAqC,CAAC;QAC3D,MAAM,UAAU,GAA+B,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,UAAU,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAChD,IAAI,KAAK,CAAC,WAAW;gBAAE,UAAU,CAAC,GAAG,CAAC,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;YACvE,IAAI,CAAC,KAAK,CAAC,QAAQ;gBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,UAAU;YACV,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC;SACzC,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,YAAY,CAAC,CAAC,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC7D,IAAI,MAAM,YAAY,CAAC,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAI,MAAM,CAAC,OAAoB,CAAC,EAAE,CAAC;IACpG,IAAI,MAAM,YAAY,CAAC,CAAC,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC7D,IAAI,MAAM,YAAY,CAAC,CAAC,UAAU;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC/D,IAAI,MAAM,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;IACnE,CAAC;IACD,6CAA6C;IAC7C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,MAAM,CAAC,CAAe;IAK7B,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,WAA+B,CAAC;IACpC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,wDAAwD;IACxD,OAAO,IAAI,EAAE,CAAC;QACZ,WAAW,GAAG,WAAW,IAAI,GAAG,CAAC,WAAW,CAAC;QAC7C,IAAI,GAAG,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;YACjC,QAAQ,GAAG,IAAI,CAAC;YAChB,GAAG,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,MAAM;QACR,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;AAChD,CAAC"}

package/dist/tools.d.ts

@@ -0,0 +1,20 @@
+/**
+ * MCP tool registry. Each tool is a `(client, args) → result` function with
+ * a Zod-described input schema. The server (index.ts) wires them up.
+ *
+ * Read tools authenticate with the admin key. The one WRITE tool
+ * (`mint_api_key`) authenticates instead with a SCOPED operator
+ * personal-access-token (`RELIPAY_OPERATOR_TOKEN`) and is rejected server-side
+ * unless that PAT carries the `keys:mint` scope — default-deny, so an agent
+ * can't mint production keys unless explicitly granted. See AGENTS.md.
+ */
+import { z } from 'zod';
+import type { AdminClient } from './client.js';
+export interface ToolDefinition<TArgs extends z.ZodRawShape> {
+    name: string;
+    description: string;
+    inputSchema: z.ZodObject<TArgs>;
+    execute: (client: AdminClient, args: z.infer<z.ZodObject<TArgs>>) => Promise<unknown>;
+}
+export declare const tools: Array<ToolDefinition<z.ZodRawShape>>;
+//# sourceMappingURL=tools.d.ts.map

package/dist/tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,MAAM,WAAW,cAAc,CAAC,KAAK,SAAS,CAAC,CAAC,WAAW;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAChC,OAAO,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACvF;AA4DD,eAAO,MAAM,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,CAAC,CAuHtD,CAAC"}

package/dist/tools.js

@@ -0,0 +1,153 @@
+/**
+ * MCP tool registry. Each tool is a `(client, args) → result` function with
+ * a Zod-described input schema. The server (index.ts) wires them up.
+ *
+ * Read tools authenticate with the admin key. The one WRITE tool
+ * (`mint_api_key`) authenticates instead with a SCOPED operator
+ * personal-access-token (`RELIPAY_OPERATOR_TOKEN`) and is rejected server-side
+ * unless that PAT carries the `keys:mint` scope — default-deny, so an agent
+ * can't mint production keys unless explicitly granted. See AGENTS.md.
+ */
+import { z } from 'zod';
+const ListApplicationsArgs = z.object({
+    tenantId: z.string().optional().describe('Optional Tenant id to filter by.'),
+});
+const GetApplicationArgs = z.object({
+    applicationId: z.string().describe('Application id (cuid).'),
+});
+const ListPlansArgs = z.object({
+    applicationId: z.string().describe('Application id to list plans for.'),
+    includeInactive: z.boolean().optional().describe('If true, include deactivated plans.'),
+});
+const ListCouponsArgs = z.object({
+    applicationId: z.string().describe('Application id to list coupons for.'),
+    includeInactive: z.boolean().optional(),
+});
+const ListApiKeysArgs = z.object({
+    applicationId: z.string().describe('Application id to list active API keys for.'),
+});
+const MintApiKeyArgs = z.object({
+    applicationId: z
+        .string()
+        .describe('Application id to mint a secret key for. Must belong to the operator PAT\'s workspace.'),
+    name: z
+        .string()
+        .describe('Human label for the key, shown in lists (e.g. "ci-deploy", "agent-worker").'),
+    mode: z
+        .enum(['live', 'test'])
+        .optional()
+        .describe('"live" (default) or "test". Test keys hit sandbox billing providers.'),
+    scopes: z
+        .array(z.string())
+        .optional()
+        .describe('Application-key scopes (e.g. ["auth:read"]). Omit for the default ["*"].'),
+});
+const ListTenantsArgs = z.object({});
+const ListPaymentsArgs = z.object({
+    applicationId: z.string().optional().describe('Filter to one Application id.'),
+    status: z
+        .enum(['PENDING', 'SUCCEEDED', 'FAILED', 'REFUNDED'])
+        .optional()
+        .describe('Filter by payment status.'),
+    q: z
+        .string()
+        .optional()
+        .describe('Exact-match search: payment id, provider payment id, or end-user id.'),
+    sort: z.enum(['createdAt', 'amount']).optional().describe('Sort field. Default createdAt.'),
+    order: z.enum(['asc', 'desc']).optional().describe('Sort direction. Default desc.'),
+    limit: z.number().int().min(1).max(200).optional().describe('Page size, 1–200. Default 50.'),
+});
+const PaymentStatsByAppArgs = z.object({});
+export const tools = [
+    {
+        name: 'list_tenants',
+        description: 'List all Tenants. Tenants are the outer multi-tenancy unit (one per Rekey customer). Use this when the user asks "what tenants exist" or to find a tenantId to drill into.',
+        inputSchema: ListTenantsArgs,
+        execute: (c) => c.request('GET', '/api/v1/admin/tenants'),
+    },
+    {
+        name: 'list_applications',
+        description: 'List Applications, optionally filtered by Tenant. An Application is one project under a Tenant; every domain row in Rekey carries an applicationId. Use this to find the applicationId for subsequent calls.',
+        inputSchema: ListApplicationsArgs,
+        execute: (c, args) => {
+            const path = args.tenantId
+                ? `/api/v1/admin/applications?tenantId=${encodeURIComponent(args.tenantId)}`
+                : '/api/v1/admin/applications';
+            return c.request('GET', path);
+        },
+    },
+    {
+        name: 'get_application',
+        description: 'Fetch one Application by id, including its authConfig and billingConfig (no secrets).',
+        inputSchema: GetApplicationArgs,
+        execute: (c, args) => c.request('GET', `/api/v1/admin/applications/${encodeURIComponent(args.applicationId)}`),
+    },
+    {
+        name: 'list_plans',
+        description: 'List Plans for an Application. Amount is always in the smallest currency unit (cents/paise/sen) — never floats.',
+        inputSchema: ListPlansArgs,
+        execute: (c, args) => c.request('GET', `/api/v1/admin/applications/${encodeURIComponent(args.applicationId)}/plans${args.includeInactive ? '?includeInactive=true' : ''}`),
+    },
+    {
+        name: 'list_coupons',
+        description: 'List discount coupons for an Application. PERCENT discounts use basis-points × 10 (1500 = 15%); AMOUNT discounts use the smallest currency unit.',
+        inputSchema: ListCouponsArgs,
+        execute: (c, args) => c.request('GET', `/api/v1/admin/applications/${encodeURIComponent(args.applicationId)}/coupons${args.includeInactive ? '?includeInactive=true' : ''}`),
+    },
+    {
+        name: 'list_api_keys',
+        description: 'List active API keys for an Application. Returns metadata only — the raw key value is unrecoverable after creation, by design.',
+        inputSchema: ListApiKeysArgs,
+        execute: (c, args) => c.request('GET', `/api/v1/admin/applications/${encodeURIComponent(args.applicationId)}/api-keys`),
+    },
+    {
+        name: 'list_payments',
+        description: 'List recent payments (newest first), optionally filtered to one Application and/or status. ' +
+            'Each row carries applicationId, applicationSlug, endUserId, amount, currency, status, createdAt. ' +
+            'Amounts are integers in the smallest currency unit (cents/paise/sen) — never floats.',
+        inputSchema: ListPaymentsArgs,
+        execute: async (c, args) => {
+            const p = new URLSearchParams();
+            if (args.applicationId !== undefined)
+                p.set('applicationId', args.applicationId);
+            if (args.status !== undefined)
+                p.set('status', args.status);
+            if (args.q !== undefined)
+                p.set('q', args.q);
+            if (args.sort !== undefined)
+                p.set('sort', args.sort);
+            if (args.order !== undefined)
+                p.set('order', args.order);
+            if (args.limit !== undefined)
+                p.set('limit', String(args.limit));
+            const qs = p.toString();
+            // /admin/metrics/payments returns a paginated Page<T> envelope
+            // ({ items, total, limit, offset }). This tool's contract is a bare
+            // payments array (bounded by `limit`), so unwrap to `.items`.
+            const page = await c.request('GET', `/api/v1/admin/metrics/payments${qs ? `?${qs}` : ''}`);
+            return page.items;
+        },
+    },
+    {
+        name: 'get_payment_stats_by_app',
+        description: 'Billing/payment health per Application over the last 30 days: succeeded/failed/pending/refunded ' +
+            'counts, success rate, and SUCCEEDED volume (volumeCents, smallest currency unit). Use this for ' +
+            '"which apps are earning / failing payments" questions. (The richer per-app Billing Overview — MRR, ' +
+            "12-month revenue series — lives at the panel-session-only endpoint /api/v1/tenant/applications/:id/billing/stats and isn't reachable with this server's credentials.)",
+        inputSchema: PaymentStatsByAppArgs,
+        execute: (c) => c.request('GET', '/api/v1/admin/metrics/payments-by-app'),
+    },
+    {
+        name: 'mint_api_key',
+        description: 'WRITE: Mint a new secret API key (rp_live_…/rp_test_…) for an Application. The raw key is returned exactly ONCE — surface it to the user immediately and tell them it cannot be recovered. ' +
+            'Authenticates as a SCOPED operator via RELIPAY_OPERATOR_TOKEN (not the admin key); the token must carry the `keys:mint` scope and belong to the workspace that owns the Application, or the call is rejected. ' +
+            'Use this only when the user explicitly asks to create/mint an API key.',
+        inputSchema: MintApiKeyArgs,
+        execute: (c, args) => c.requestAsOperator('POST', `/api/v1/tenant/operator/applications/${encodeURIComponent(args.applicationId)}/api-keys`, {
+            name: args.name,
+            ...(args.mode !== undefined ? { mode: args.mode } : {}),
+            ...(args.scopes !== undefined ? { scopes: args.scopes } : {}),
+        }),
+    },
+];
+//# sourceMappingURL=tools.js.map

package/dist/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;CAC7E,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC;CAC7D,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;IACvE,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qCAAqC,CAAC;CACxF,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qCAAqC,CAAC;IACzE,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC;CAClF,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,QAAQ,CAAC,wFAAwF,CAAC;IACrG,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,QAAQ,CAAC,6EAA6E,CAAC;IAC1F,IAAI,EAAE,CAAC;SACJ,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SACtB,QAAQ,EAAE;SACV,QAAQ,CAAC,sEAAsE,CAAC;IACnF,MAAM,EAAE,CAAC;SACN,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CAAC,0EAA0E,CAAC;CACxF,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAErC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;IAC9E,MAAM,EAAE,CAAC;SACN,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;SACpD,QAAQ,EAAE;SACV,QAAQ,CAAC,2BAA2B,CAAC;IACxC,CAAC,EAAE,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,sEAAsE,CAAC;IACnF,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;IAC3F,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;IACnF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;CAC7F,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAE3C,MAAM,CAAC,MAAM,KAAK,GAAyC;IACzD;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EACT,4KAA4K;QAC9K,WAAW,EAAE,eAAe;QAC5B,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,uBAAuB,CAAC;KAC1D;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACT,8MAA8M;QAChN,WAAW,EAAE,oBAAoB;QACjC,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE;YACnB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ;gBACxB,CAAC,CAAC,uCAAuC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAC5E,CAAC,CAAC,4BAA4B,CAAC;YACjC,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAChC,CAAC;KACF;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACT,uFAAuF;QACzF,WAAW,EAAE,kBAAkB;QAC/B,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CACnB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,8BAA8B,kBAAkB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;KAC3F;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EACT,iHAAiH;QACnH,WAAW,EAAE,aAAa;QAC1B,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CACnB,CAAC,CAAC,OAAO,CACP,KAAK,EACL,8BAA8B,kBAAkB,CAAC,IAAI,CAAC,aAAa,CAAC,SAClE,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,EACnD,EAAE,CACH;KACJ;IACD;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EACT,kJAAkJ;QACpJ,WAAW,EAAE,eAAe;QAC5B,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CACnB,CAAC,CAAC,OAAO,CACP,KAAK,EACL,8BAA8B,kBAAkB,CAAC,IAAI,CAAC,aAAa,CAAC,WAClE,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,EACnD,EAAE,CACH;KACJ;IACD;QACE,IAAI,EAAE,eAAe;QACrB,WAAW,EACT,gIAAgI;QAClI,WAAW,EAAE,eAAe;QAC5B,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CACnB,CAAC,CAAC,OAAO,CACP,KAAK,EACL,8BAA8B,kBAAkB,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAChF;KACJ;IACD;QACE,IAAI,EAAE,eAAe;QACrB,WAAW,EACT,6FAA6F;YAC7F,mGAAmG;YACnG,sFAAsF;QACxF,WAAW,EAAE,gBAAgB;QAC7B,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YACzB,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;YAChC,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS;gBAAE,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YACjF,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;gBAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAC5D,IAAI,IAAI,CAAC,CAAC,KAAK,SAAS;gBAAE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YAC7C,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;gBAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACtD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;gBAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACzD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;gBAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACjE,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;YACxB,+DAA+D;YAC/D,oEAAoE;YACpE,8DAA8D;YAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,OAAO,CAC1B,KAAK,EACL,iCAAiC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACtD,CAAC;YACF,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;KACF;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,WAAW,EACT,kGAAkG;YAClG,iGAAiG;YACjG,qGAAqG;YACrG,uKAAuK;QACzK,WAAW,EAAE,qBAAqB;QAClC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,uCAAuC,CAAC;KAC1E;IACD;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EACT,6LAA6L;YAC7L,gNAAgN;YAChN,wEAAwE;QAC1E,WAAW,EAAE,cAAc;QAC3B,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CACnB,CAAC,CAAC,iBAAiB,CACjB,MAAM,EACN,wCAAwC,kBAAkB,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,EACzF;YACE,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CACF;KACJ;CACF,CAAC"}

package/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "@rekey.dev/mcp",
+  "version": "1.1.2",
+  "license": "MIT",
+  "description": "Model Context Protocol server for Rekey — lets Claude Desktop / Cursor / Claude Code introspect a deployment.",
+  "type": "module",
+  "bin": {
+    "rekey-mcp": "./dist/index.js"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "AGENTS.md",
+    "README.md"
+  ],
+  "keywords": [
+    "rekey",
+    "mcp",
+    "model-context-protocol",
+    "ai"
+  ],
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.0.4",
+    "zod": "^3.23.8",
+    "@rekey.dev/shared-types": "1.1.2"
+  },
+  "devDependencies": {
+    "@types/node": "^22.9.0",
+    "typescript": "^5.6.3",
+    "vitest": "^2.1.5"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json && chmod +x dist/index.js",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "lint": "echo \"(eslint not yet wired)\"",
+    "test": "vitest run"
+  }
+}