@secondlayer/mcp 3.8.0 → 3.10.0

package/dist/bin.js

@@ -15,21 +15,49 @@ import { TRAIT_STANDARDS } from "@secondlayer/stacks/clarity";
 import { TYPE_MAP } from "@secondlayer/subgraphs/schema";
 
 // src/lib/client.ts
-import { SecondLayer } from "@secondlayer/sdk";
+import { SecondLayer, readX402Receipt, withX402 } from "@secondlayer/sdk";
+import { privateKeyToAccount } from "@secondlayer/stacks/accounts";
 var instance = null;
 function readApiKey() {
   return process.env.SL_API_KEY;
 }
+function buildFetchImpl() {
+  const key = process.env.X402_PRIVATE_KEY;
+  if (!key)
+    return;
+  const account = privateKeyToAccount(key);
+  const topUpUsd = Number(process.env.X402_TOPUP_USD ?? "");
+  const paid = withX402(fetch, {
+    account,
+    ...Number.isFinite(topUpUsd) && topUpUsd > 0 ? {
+      topUp: {
+        usd: topUpUsd,
+        whenBelow: Number(process.env.X402_TOPUP_WHEN_BELOW ?? "0.5")
+      }
+    } : {}
+  });
+  const wrapped = async (input, init) => {
+    const res = await paid(input, init);
+    const receipt = readX402Receipt(res);
+    if (receipt) {
+      console.error(`[x402] paid call settled tier=${receipt.state ?? "confirmed"} txid=${receipt.txid}`);
+    }
+    return res;
+  };
+  return wrapped;
+}
 function getClient() {
   if (!instance) {
     const apiKey = readApiKey();
     const baseUrl = process.env.SECONDLAYER_API_URL;
     const dumpsBaseUrl = process.env.SL_STREAMS_DUMPS_URL;
+    const fetchImpl = buildFetchImpl();
     instance = new SecondLayer({
       ...apiKey ? { apiKey } : {},
       origin: "mcp",
       ...baseUrl ? { baseUrl } : {},
-      ...dumpsBaseUrl ? { dumpsBaseUrl } : {}
+      ...dumpsBaseUrl ? { dumpsBaseUrl } : {},
+      ...fetchImpl ? { fetchImpl } : {}
     });
   }
   return instance;
@@ -58,11 +86,14 @@ async function apiRequest(method, path, body) {
 
 // src/lib/format.ts
 function formatSubgraphSummary(s) {
+  const apiUrl = process.env.SECONDLAYER_API_URL || "https://api.secondlayer.tools";
   return {
     name: s.name,
     status: s.status,
     tables: Array.isArray(s.tables) ? s.tables : Object.keys(s.tables),
-    lastProcessedBlock: s.lastProcessedBlock
+    lastProcessedBlock: s.lastProcessedBlock,
+    ...s.visibility ? { visibility: s.visibility } : {},
+    ...s.visibility === "public" ? { publicUrl: `${apiUrl}/v1/subgraphs/${s.name}` } : {}
   };
 }
 function withCap(items, cap) {
@@ -167,7 +198,6 @@ var COLUMN_TYPES = [
   }
 ];
 var PRODUCT_BLURBS = {
-  datasets: "public foundation datasets",
   index: "decoded L2 events, contract calls, blocks, transactions, stacking, mempool",
   streams: "raw canonical chain event firehose",
   contracts: "trait-based contract discovery",
@@ -178,7 +208,6 @@ var PRODUCT_BLURBS = {
   scaffold: "generate typed contract clients from a deployment or ABI"
 };
 var PRODUCT_ORDER = [
-  "datasets",
   "index",
   "streams",
   "contracts",
@@ -207,21 +236,30 @@ function buildCapabilities() {
   });
   return {
     products,
-    discoverFirst: "Call datasets_list / index_discover / contracts_find to learn what exists (and which filters each surface accepts) before querying."
+    discoverFirst: "Call index_discover / contracts_find to learn what exists (and which filters each surface accepts) before querying."
   };
 }
+var X402_CAPABILITY = {
+  what: "Index and Streams reads (/v1/index/*, /v1/streams/*) accept x402 v2 pay-per-call (network stacks:1, sponsored transfers — the payer holds sBTC/STX/USDCx, never gas). Index grants 1,000 free reads/day/IP before any 402; a paid Streams call opens a 500-call/1h PAYMENT-SESSION.",
+  paidWrites: "POST /v1/subgraphs (x402 $2) deploys a subgraph owned by the paying wallet — live from deploy, 7-day TTL, renewable via POST /v1/subgraphs/{name}/renew ($0.50/wk); claiming the account clears the expiry.",
+  prepaid: "POST /v1/x402/deposit?usd=N loads a prepaid tab (PAYMENT-BALANCE token, $0.25 min) — calls debit it instantly, no per-call on-chain settle. GET /v1/x402/balance reads it.",
+  discovery: "GET /v1/x402/supported on the API host for scheme, assets, prices, quotas, sessions, and prepaid metadata.",
+  autopay: "Set X402_PRIVATE_KEY (a Stacks private key holding an accepted token) and this MCP server pays 402 challenges automatically (sessions replayed). Add X402_TOPUP_USD (and optionally X402_TOPUP_WHEN_BELOW) for an autonomous prepaid tab that refills itself. Receipts are logged per paid call."
+};
 var READ_AUTH_TIERS = {
-  datasets: "open — no API key required",
   index: "anonymous reads allowed; free-tier API keys are rejected (Build+ required)",
   streams: "API key required (SL_API_KEY) — keyless calls return 401",
-  subgraphs: "reads public during open beta; writes require an API key"
+  subgraphs: "public subgraphs anon-readable at /v1/subgraphs/<name>/<table> ({ rows, next_cursor, tip } cursor envelope); private subgraphs need the owning account's API key (anon → 404); writes require an API key"
 };
 async function buildContext(deps = { clientProvider: getClient }) {
   const unavailable = "unavailable: set SL_API_KEY";
   const orNull = (v) => v == null ? unavailable : v;
   const snap = await deps.clientProvider().context().catch(() => null);
   return {
-    authState: { apiKeySet: Boolean(process.env.SL_API_KEY) },
+    authState: {
+      apiKeySet: Boolean(process.env.SL_API_KEY),
+      x402WalletSet: Boolean(process.env.X402_PRIVATE_KEY)
+    },
     whatExists: {
       account: orNull(snap?.account),
       streamsTip: orNull(snap?.streamsTip),
@@ -233,7 +271,8 @@ async function buildContext(deps = { clientProvider: getClient }) {
       activeOperations: orNull(snap?.activeOperations)
     },
     whatYouCanDo: buildCapabilities(),
-    readAuthTiers: READ_AUTH_TIERS
+    readAuthTiers: READ_AUTH_TIERS,
+    payPerCall: X402_CAPABILITY
   };
 }
 function registerResources(server) {
@@ -421,43 +460,20 @@ function registerContractTools(server, clientProvider = getClient) {
   });
 }
 
-// src/tools/datasets.ts
-import { z as z3 } from "zod/v4";
-function registerDatasetTools(server, clientProvider = getClient) {
-  defineTool(server, "datasets_list", "List the Foundation Datasets catalog with freshness — the discovery endpoint for what dataset slugs exist and how current each is. Reads are public.", {}, async () => {
-    const catalog = await clientProvider().datasets.listDatasets();
-    return jsonResponse(catalog);
-  });
-  defineTool(server, "datasets_query", 'Query ANY Foundation Dataset by slug — every family returned by datasets_list is queryable, including bespoke ones (bns/resolve with {"fqn":"alice.btc"}, bns/names, bns/namespaces, network-health/summary) and any dataset added later. Accepts family ("sbtc-events") or path ("sbtc/events") slug forms. Filters are passed through as documented query params (e.g. {"sender": "SP...", "from_block": "150000"}). Returns { rows, next_cursor, tip }; single-record datasets like bns/resolve return 0-or-1 rows (empty = not found). Call datasets_list first to discover slugs and their filters.', {
-    slug: z3.string().describe("Dataset slug from datasets_list (e.g. stx-transfers)"),
-    filters: z3.record(z3.string(), z3.string()).optional().describe("Documented per-dataset query params (snake_case values)"),
-    limit: z3.number().optional().describe("Max rows for this page"),
-    cursor: z3.string().optional().describe("Opaque cursor from a prior response's next_cursor")
-  }, async ({ slug, filters, limit, cursor }) => {
-    const params = { ...filters ?? {} };
-    if (limit !== undefined)
-      params.limit = limit;
-    if (cursor !== undefined)
-      params.cursor = cursor;
-    const result = await clientProvider().datasets.get(slug, params);
-    return jsonResponse(result);
-  });
-}
-
 // src/tools/index.ts
 import { DECODED_EVENT_TYPES as DECODED_EVENT_TYPES2 } from "@secondlayer/shared";
 import {
   INDEX_CODEGEN_TABLES,
   generateIndexSchema
 } from "@secondlayer/subgraphs";
-import { z as z4 } from "zod/v4";
+import { z as z3 } from "zod/v4";
 var INDEX_EVENT_TYPES = DECODED_EVENT_TYPES2;
 var rangeFilters = {
-  contractId: z4.string().optional().describe("Filter by contract id"),
-  fromHeight: z4.number().optional().describe("Start block height (inclusive)"),
-  toHeight: z4.number().optional().describe("End block height (inclusive)"),
-  cursor: z4.string().optional().describe("Opaque cursor from a prior response's next_cursor"),
-  limit: z4.number().optional().describe("Max rows for this page")
+  contractId: z3.string().optional().describe("Filter by contract id"),
+  fromHeight: z3.number().optional().describe("Start block height (inclusive)"),
+  toHeight: z3.number().optional().describe("End block height (inclusive)"),
+  cursor: z3.string().optional().describe("Opaque cursor from a prior response's next_cursor"),
+  limit: z3.number().optional().describe("Max rows for this page")
 };
 var heightFilters = {
   fromHeight: rangeFilters.fromHeight,
@@ -469,89 +485,95 @@ var notFound = (message) => jsonResponse({ error: { type: "not_found", status: 4
 function registerIndexTools(server, clientProvider = getClient) {
   defineTool(server, "index_ft_transfers", "List decoded SIP-010 fungible-token transfers from the Index (L2 decoded layer). Anonymous reads allowed (free-tier API keys are rejected — Build+ required).", {
     ...rangeFilters,
-    sender: z4.string().optional().describe("Filter by sender principal"),
-    recipient: z4.string().optional().describe("Filter by recipient principal")
+    sender: z3.string().optional().describe("Filter by sender principal"),
+    recipient: z3.string().optional().describe("Filter by recipient principal")
   }, async (params) => jsonResponse(await clientProvider().index.ftTransfers.list(params)));
   defineTool(server, "index_nft_transfers", "List decoded SIP-009 non-fungible-token transfers from the Index. Anonymous reads allowed (free-tier keys rejected).", {
     ...rangeFilters,
-    sender: z4.string().optional().describe("Filter by sender principal"),
-    recipient: z4.string().optional().describe("Filter by recipient principal"),
-    assetIdentifier: z4.string().optional().describe("Filter by asset identifier (contract::asset)")
+    sender: z3.string().optional().describe("Filter by sender principal"),
+    recipient: z3.string().optional().describe("Filter by recipient principal"),
+    assetIdentifier: z3.string().optional().describe("Filter by asset identifier (contract::asset)")
   }, async (params) => jsonResponse(await clientProvider().index.nftTransfers.list(params)));
   defineTool(server, "index_events", "List decoded chain events from the Index by event type. Use this for event types without a dedicated tool (stx_*, ft_mint/burn, nft_mint/burn, print), and for trait-scoped queries: set `trait` (e.g. sip-010) to match all contracts conforming to a standard — pair with contracts_find to discover traits. For ft/nft transfers without a trait prefer index_ft_transfers / index_nft_transfers.", {
-    eventType: z4.enum(INDEX_EVENT_TYPES).describe("Required. Decoded event type to list."),
+    eventType: z3.enum(INDEX_EVENT_TYPES).describe("Required. Decoded event type to list."),
     ...rangeFilters,
-    sender: z4.string().optional().describe("Filter by sender principal"),
-    recipient: z4.string().optional().describe("Filter by recipient principal"),
-    assetIdentifier: z4.string().optional().describe("Filter by asset identifier where applicable"),
-    trait: z4.string().optional().describe("Match contracts conforming to a trait/standard (e.g. sip-010). Mutually exclusive with contractId; contract-keyed event types only.")
+    sender: z3.string().optional().describe("Filter by sender principal"),
+    recipient: z3.string().optional().describe("Filter by recipient principal"),
+    assetIdentifier: z3.string().optional().describe("Filter by asset identifier where applicable"),
+    trait: z3.string().optional().describe("Match contracts conforming to a trait/standard (e.g. sip-010). Mutually exclusive with contractId; contract-keyed event types only.")
   }, async (params) => jsonResponse(await clientProvider().index.events.list(params)));
   defineTool(server, "index_contract_calls", "List decoded contract calls from the Index (function name, args, result). Set `trait` (e.g. sip-010) to match calls to all contracts conforming to a standard. Note: contract-call cursors are a SEPARATE keyspace from event cursors — they are not interchangeable.", {
     ...rangeFilters,
-    functionName: z4.string().optional().describe("Filter by called function name"),
-    sender: z4.string().optional().describe("Filter by caller principal"),
-    trait: z4.string().optional().describe("Match contracts conforming to a trait/standard (e.g. sip-010). Mutually exclusive with contractId.")
+    functionName: z3.string().optional().describe("Filter by called function name"),
+    sender: z3.string().optional().describe("Filter by caller principal"),
+    trait: z3.string().optional().describe("Match contracts conforming to a trait/standard (e.g. sip-010). Mutually exclusive with contractId.")
   }, async (params) => jsonResponse(await clientProvider().index.contractCalls.list(params)));
   defineTool(server, "index_canonical", "List the canonical Stacks block sequence from the Index (height + hash). Anonymous reads allowed (free-tier keys rejected).", { ...heightFilters }, async (params) => jsonResponse(await clientProvider().index.canonical.list(params)));
   defineTool(server, "index_blocks", "List decoded blocks from the Index. Anonymous reads allowed (free-tier keys rejected).", { ...heightFilters }, async (params) => jsonResponse(await clientProvider().index.blocks.list(params)));
   defineTool(server, "index_block", "Get a single block from the Index by height or block hash. Returns not_found if unknown.", {
-    ref: z4.string().describe("Block height (digits) or block hash (0x… string)")
+    ref: z3.string().describe("Block height (digits) or block hash (0x… string)")
   }, async ({ ref }) => {
     const block = await clientProvider().index.blocks.get(/^\d+$/.test(ref) ? Number(ref) : ref);
     return block ? jsonResponse(block) : notFound(`No block for ref ${ref}`);
   });
   defineTool(server, "index_transactions", "List decoded transactions from the Index. Filter by type, sender, or contract. Anonymous reads allowed (free-tier keys rejected).", {
     ...rangeFilters,
-    type: z4.string().optional().describe("Filter by transaction type"),
-    sender: z4.string().optional().describe("Filter by sender principal")
+    type: z3.string().optional().describe("Filter by transaction type"),
+    sender: z3.string().optional().describe("Filter by sender principal")
   }, async (params) => jsonResponse(await clientProvider().index.transactions.list(params)));
-  defineTool(server, "index_transaction", "Get a single transaction from the Index by tx_id. Returns not_found if unknown.", { txId: z4.string().describe("Transaction id (0x… hash)") }, async ({ txId }) => {
+  defineTool(server, "index_transaction", "Get a single transaction from the Index by tx_id. Returns not_found if unknown.", { txId: z3.string().describe("Transaction id (0x… hash)") }, async ({ txId }) => {
     const tx = await clientProvider().index.transactions.get(txId);
     return tx ? jsonResponse(tx) : notFound(`No transaction for ${txId}`);
   });
-  defineTool(server, "index_transaction_proof", "Fetch a transaction's inclusion proof (raw tx + signed Nakamoto block header + merkle path) so it can be verified trustlessly client-side with the SDK's verifyTransactionProof. Returns not_found if the tx/block is unknown; a 503 means the proof can't be assembled on this deployment right now (PROOF_TX_SET_INCOMPLETE, or PROOF_NODE_UNAVAILABLE when the stacks-node header source isn't configured).", { txId: z4.string().describe("Transaction id (0x… hash)") }, async ({ txId }) => {
+  defineTool(server, "index_transaction_proof", "Fetch a transaction's inclusion proof (raw tx + signed Nakamoto block header + merkle path) so it can be verified trustlessly client-side with the SDK's verifyTransactionProof. Returns not_found if the tx/block is unknown; a 503 means the proof can't be assembled on this deployment right now (PROOF_TX_SET_INCOMPLETE, or PROOF_NODE_UNAVAILABLE when the stacks-node header source isn't configured).", { txId: z3.string().describe("Transaction id (0x… hash)") }, async ({ txId }) => {
     const proof = await clientProvider().index.transactions.getProof(txId);
     return proof ? jsonResponse(proof) : notFound(`No proof available for ${txId}`);
   });
   defineTool(server, "index_stacking", "List decoded PoX-4 stacking actions from the Index (stack-stx, delegate-stx, etc.). Anonymous reads allowed (free-tier keys rejected).", {
     ...heightFilters,
-    functionName: z4.string().optional().describe("Filter by PoX function name"),
-    stacker: z4.string().optional().describe("Filter by stacker principal"),
-    caller: z4.string().optional().describe("Filter by caller principal")
+    functionName: z3.string().optional().describe("Filter by PoX function name"),
+    stacker: z3.string().optional().describe("Filter by stacker principal"),
+    caller: z3.string().optional().describe("Filter by caller principal")
   }, async (params) => jsonResponse(await clientProvider().index.stacking.list(params)));
   defineTool(server, "index_mempool", "List pending (unconfirmed) transactions from the Index mempool. Sequence-cursor paginated (no height range). Anonymous reads allowed (free-tier keys rejected).", {
-    sender: z4.string().optional().describe("Filter by sender principal"),
-    type: z4.string().optional().describe("Filter by transaction type"),
-    contractId: z4.string().optional().describe("Filter to pending calls to a single contract"),
-    cursor: z4.string().optional().describe("Opaque cursor from a prior response's next_cursor"),
-    limit: z4.number().optional().describe("Max rows for this page")
+    sender: z3.string().optional().describe("Filter by sender principal"),
+    type: z3.string().optional().describe("Filter by transaction type"),
+    contractId: z3.string().optional().describe("Filter to pending calls to a single contract"),
+    cursor: z3.string().optional().describe("Opaque cursor from a prior response's next_cursor"),
+    limit: z3.number().optional().describe("Max rows for this page")
   }, async (params) => jsonResponse(await clientProvider().index.mempool.list(params)));
-  defineTool(server, "index_mempool_tx", "Get a single pending transaction from the Index mempool by tx_id. Returns not_found once it is mined or dropped.", { txId: z4.string().describe("Transaction id (0x… hash)") }, async ({ txId }) => {
+  defineTool(server, "index_mempool_tx", "Get a single pending transaction from the Index mempool by tx_id. Returns not_found once it is mined or dropped.", { txId: z3.string().describe("Transaction id (0x… hash)") }, async ({ txId }) => {
     const tx = await clientProvider().index.mempool.get(txId);
     return tx ? jsonResponse(tx) : notFound(`No pending tx for ${txId}`);
   });
   defineTool(server, "index_discover", "Discover the Index vocabulary: every event type and its columns, allowed/equality filters, and required-non-null fields (and which types accept `trait`). Read this before building Index queries instead of guessing filters. Anonymous read.", {}, async () => jsonResponse(await clientProvider().index.discover()));
   defineTool(server, "index_usage", "Your own Index consumption (decoded events today + this month) and tier limits. Requires a Build+ API key (anonymous reads can't report usage).", {}, async () => jsonResponse(await clientProvider().index.usage()));
   defineTool(server, "index_codegen", `Generate a typed schema (Prisma, Kysely, Drizzle, or JSON-Schema) for the public Index domain tables so they can be mirrored into a BYO database with full types. Returns the schema as text. Tables: ${INDEX_CODEGEN_TABLES.join(", ")}.`, {
-    target: z4.enum(["prisma", "kysely", "drizzle", "json-schema"]).optional().describe("Output target (default kysely)"),
-    tables: z4.array(z4.string()).optional().describe("Subset of Index tables (default: all)"),
-    schemaName: z4.string().optional().describe("Postgres schema to qualify table names with")
+    target: z3.enum(["prisma", "kysely", "drizzle", "json-schema"]).optional().describe("Output target (default kysely)"),
+    tables: z3.array(z3.string()).optional().describe("Subset of Index tables (default: all)"),
+    schemaName: z3.string().optional().describe("Postgres schema to qualify table names with")
   }, async ({ target = "kysely", tables, schemaName }) => {
     const out = generateIndexSchema(target, { tables, schemaName });
     return { content: [{ type: "text", text: out }] };
   });
+  defineTool(server, "batch_query", "Run up to 10 public /v1 reads in one round trip (POST /v1/batch). Each item keeps its own auth/quota/pay-per-call semantics; results return in order with per-item status. Paths must start with /v1/index, /v1/subgraphs, /v1/streams, or /v1/contracts.", {
+    requests: z3.array(z3.object({
+      path: z3.string().describe("Public /v1 read path"),
+      params: z3.record(z3.string(), z3.string()).optional()
+    })).min(1).max(10).describe("Read descriptors, executed concurrently")
+  }, async (params) => jsonResponse(await clientProvider().batch(params.requests)));
 }
 
 // src/tools/projects.ts
-import { z as z5 } from "zod/v4";
+import { z as z4 } from "zod/v4";
 function registerProjectTools(server, clientProvider = getClient) {
   defineTool(server, "project_list", "List the account's projects. Requires an account-level (owner) API key.", {}, async () => jsonResponse(await clientProvider().projects.list()));
-  defineTool(server, "project_get", "Get a single project by slug.", { slug: z5.string().describe("Project slug") }, async ({ slug }) => jsonResponse(await clientProvider().projects.get(slug)));
+  defineTool(server, "project_get", "Get a single project by slug.", { slug: z4.string().describe("Project slug") }, async ({ slug }) => jsonResponse(await clientProvider().projects.get(slug)));
   defineTool(server, "project_create", "Create a project. The slug is derived from the name when omitted. Requires an account-level (owner) API key.", {
-    name: z5.string().describe("Project name"),
-    slug: z5.string().optional().describe("URL slug (auto-derived from name if omitted)"),
-    network: z5.string().optional().describe("Network (e.g. mainnet, testnet)"),
-    nodeRpc: z5.string().optional().describe("Custom node RPC URL")
+    name: z4.string().describe("Project name"),
+    slug: z4.string().optional().describe("URL slug (auto-derived from name if omitted)"),
+    network: z4.string().optional().describe("Network (e.g. mainnet, testnet)"),
+    nodeRpc: z4.string().optional().describe("Custom node RPC URL")
   }, async ({ name, slug, network, nodeRpc }) => jsonResponse(await clientProvider().projects.create({
     name,
     slug,
@@ -559,12 +581,12 @@ function registerProjectTools(server, clientProvider = getClient) {
     nodeRpc
   })));
   defineTool(server, "project_update", "Update a project. `slug` selects the project; `newSlug` renames it. Requires an account-level (owner) API key.", {
-    slug: z5.string().describe("Slug of the project to update"),
-    newSlug: z5.string().optional().describe("New slug (renames the project)"),
-    name: z5.string().optional().describe("New display name"),
-    network: z5.string().optional().describe("Network (e.g. mainnet, testnet)"),
-    nodeRpc: z5.string().optional().describe("Custom node RPC URL"),
-    settings: z5.record(z5.string(), z5.unknown()).optional().describe("Arbitrary project settings to merge")
+    slug: z4.string().describe("Slug of the project to update"),
+    newSlug: z4.string().optional().describe("New slug (renames the project)"),
+    name: z4.string().optional().describe("New display name"),
+    network: z4.string().optional().describe("Network (e.g. mainnet, testnet)"),
+    nodeRpc: z4.string().optional().describe("Custom node RPC URL"),
+    settings: z4.record(z4.string(), z4.unknown()).optional().describe("Arbitrary project settings to merge")
   }, async ({ slug, newSlug, name, network, nodeRpc, settings }) => jsonResponse(await clientProvider().projects.update(slug, {
     ...newSlug !== undefined ? { slug: newSlug } : {},
     ...name !== undefined ? { name } : {},
@@ -572,8 +594,8 @@ function registerProjectTools(server, clientProvider = getClient) {
     ...nodeRpc !== undefined ? { nodeRpc } : {},
     ...settings !== undefined ? { settings } : {}
   })));
-  defineTool(server, "project_delete", "Delete a project permanently. The account's last remaining project cannot be deleted.", { slug: z5.string().describe("Project slug") }, async ({ slug }) => jsonResponse(await clientProvider().projects.delete(slug)));
-  defineTool(server, "project_team_list", "List a project's team members and pending invitations.", { slug: z5.string().describe("Project slug") }, async ({ slug }) => jsonResponse(await clientProvider().projects.team(slug)));
+  defineTool(server, "project_delete", "Delete a project permanently. The account's last remaining project cannot be deleted.", { slug: z4.string().describe("Project slug") }, async ({ slug }) => jsonResponse(await clientProvider().projects.delete(slug)));
+  defineTool(server, "project_team_list", "List a project's team members and pending invitations.", { slug: z4.string().describe("Project slug") }, async ({ slug }) => jsonResponse(await clientProvider().projects.team(slug)));
 }
 
 // src/tools/scaffold.ts
@@ -582,7 +604,7 @@ import {
   generateTraitSubgraph
 } from "@secondlayer/scaffold";
 import { TRAIT_STANDARDS as TRAIT_STANDARDS2 } from "@secondlayer/stacks/clarity";
-import { z as z6 } from "zod/v4";
+import { z as z5 } from "zod/v4";
 async function fetchAbi(contractId) {
   const contract = await getClient().contracts.get(contractId, {
     includeAbi: true
@@ -597,24 +619,24 @@ async function fetchAbi(contractId) {
 }
 function registerScaffoldTools(server) {
   defineTool(server, "scaffold_from_trait", "Generate a deploy-ready subgraph scaffold that indexes EVERY contract conforming to a SIP trait (no specific contract needed) — sip-009 → an nft_transfer source, sip-010/sip-013 → ft_transfer. Use scaffold_from_contract/abi instead when targeting one contract. See the secondlayer://traits resource for valid trait ids.", {
-    trait: z6.enum(TRAIT_STANDARDS2).describe("SIP standard to index (sip-009 | sip-010 | sip-013)"),
-    subgraphName: z6.string().optional().describe("Override the subgraph name (defaults to <trait>-transfers)")
+    trait: z5.enum(TRAIT_STANDARDS2).describe("SIP standard to index (sip-009 | sip-010 | sip-013)"),
+    subgraphName: z5.string().optional().describe("Override the subgraph name (defaults to <trait>-transfers)")
   }, async ({ trait, subgraphName }) => {
     const code = generateTraitSubgraph({ trait, name: subgraphName });
     return { content: [{ type: "text", text: code }] };
   });
   defineTool(server, "scaffold_from_contract", "Generate a subgraph scaffold from a deployed Stacks contract. Fetches the ABI automatically.", {
-    contractId: z6.string().describe("Fully qualified contract ID (e.g. SP102V8P0F7JX67ARQ77WEA3D3CFB5XW39REDT0AM.amm-pool-v2-01)"),
-    subgraphName: z6.string().optional().describe("Override the subgraph name (defaults to contract name)")
+    contractId: z5.string().describe("Fully qualified contract ID (e.g. SP102V8P0F7JX67ARQ77WEA3D3CFB5XW39REDT0AM.amm-pool-v2-01)"),
+    subgraphName: z5.string().optional().describe("Override the subgraph name (defaults to contract name)")
   }, async ({ contractId, subgraphName }) => {
     const { functions, maps } = await fetchAbi(contractId);
     const code = generateSubgraphCode(contractId, functions, subgraphName, maps);
     return { content: [{ type: "text", text: code }] };
   });
   defineTool(server, "scaffold_from_abi", "Generate a subgraph scaffold from a provided ABI JSON. Use when you already have the ABI.", {
-    abi: z6.string().describe("ABI JSON string (the full contract ABI object)"),
-    contractId: z6.string().describe("Fully qualified contract ID"),
-    subgraphName: z6.string().optional().describe("Override the subgraph name")
+    abi: z5.string().describe("ABI JSON string (the full contract ABI object)"),
+    contractId: z5.string().describe("Fully qualified contract ID"),
+    subgraphName: z5.string().optional().describe("Override the subgraph name")
   }, async ({ abi, contractId, subgraphName }) => {
     let parsed;
     try {
@@ -633,7 +655,7 @@ function registerScaffoldTools(server) {
 // src/tools/streams.ts
 import { AuthError } from "@secondlayer/sdk";
 import { DECODED_EVENT_TYPES as DECODED_EVENT_TYPES3 } from "@secondlayer/shared";
-import { z as z7 } from "zod/v4";
+import { z as z6 } from "zod/v4";
 var STREAMS_EVENT_TYPES = DECODED_EVENT_TYPES3;
 async function withStreamsAuthHint(fn) {
   try {
@@ -648,28 +670,28 @@ async function withStreamsAuthHint(fn) {
 function registerStreamsTools(server, clientProvider = getClient) {
   defineTool(server, "streams_tip", "Get the current Streams chain tip (latest processed block + lag). Streams requires an API key (SL_API_KEY).", {}, async () => withStreamsAuthHint(async () => jsonResponse(await clientProvider().streams.tip())));
   defineTool(server, "streams_events", "List raw chain events from the Streams firehose. Streams requires an API key (SL_API_KEY). Filter by event types, principals, contract, asset, or block range; page with cursor.", {
-    types: z7.array(z7.enum(STREAMS_EVENT_TYPES)).optional().describe("Event types to include"),
-    notTypes: z7.array(z7.enum(STREAMS_EVENT_TYPES)).optional().describe("Event types to exclude (applied after types)"),
-    contractId: z7.string().optional().describe("Filter by contract id"),
-    sender: z7.string().optional().describe("Filter by sender principal"),
-    recipient: z7.string().optional().describe("Filter by recipient principal"),
-    assetIdentifier: z7.string().optional().describe("Filter by asset identifier"),
-    fromHeight: z7.number().optional().describe("Start block height (inclusive)"),
-    toHeight: z7.number().optional().describe("End block height (inclusive)"),
-    cursor: z7.string().optional().describe("Opaque cursor from a prior response"),
-    limit: z7.number().optional().describe("Max events for this page")
+    types: z6.array(z6.enum(STREAMS_EVENT_TYPES)).optional().describe("Event types to include"),
+    notTypes: z6.array(z6.enum(STREAMS_EVENT_TYPES)).optional().describe("Event types to exclude (applied after types)"),
+    contractId: z6.string().optional().describe("Filter by contract id"),
+    sender: z6.string().optional().describe("Filter by sender principal"),
+    recipient: z6.string().optional().describe("Filter by recipient principal"),
+    assetIdentifier: z6.string().optional().describe("Filter by asset identifier"),
+    fromHeight: z6.number().optional().describe("Start block height (inclusive)"),
+    toHeight: z6.number().optional().describe("End block height (inclusive)"),
+    cursor: z6.string().optional().describe("Opaque cursor from a prior response"),
+    limit: z6.number().optional().describe("Max events for this page")
   }, async (params) => withStreamsAuthHint(async () => jsonResponse(await clientProvider().streams.events.list(params))));
   defineTool(server, "streams_consume", "Consume a bounded, reorg-aware run of Streams events from a cursor. Walks up to maxPages pages and returns the events, any reorgs observed, and a resume `cursor` to pass back as fromCursor next call — the agent-native consume/resume primitive. Streams requires an API key (SL_API_KEY).", {
-    fromCursor: z7.string().optional().describe("Resume cursor from a prior consume (omit to start at genesis)"),
-    types: z7.array(z7.enum(STREAMS_EVENT_TYPES)).optional().describe("Event types to include"),
-    notTypes: z7.array(z7.enum(STREAMS_EVENT_TYPES)).optional().describe("Event types to exclude"),
-    contractId: z7.string().optional().describe("Filter by contract id"),
-    sender: z7.string().optional().describe("Filter by sender principal"),
-    recipient: z7.string().optional().describe("Filter by recipient principal"),
-    assetIdentifier: z7.string().optional().describe("Filter by asset identifier"),
-    batchSize: z7.number().optional().describe("Events per page (1–1000, default 100)"),
-    maxPages: z7.number().optional().describe("Max pages to walk this call (1–20, default 5)"),
-    finalizedOnly: z7.boolean().optional().describe("Only emit finalized events; skip reorg handling")
+    fromCursor: z6.string().optional().describe("Resume cursor from a prior consume (omit to start at genesis)"),
+    types: z6.array(z6.enum(STREAMS_EVENT_TYPES)).optional().describe("Event types to include"),
+    notTypes: z6.array(z6.enum(STREAMS_EVENT_TYPES)).optional().describe("Event types to exclude"),
+    contractId: z6.string().optional().describe("Filter by contract id"),
+    sender: z6.string().optional().describe("Filter by sender principal"),
+    recipient: z6.string().optional().describe("Filter by recipient principal"),
+    assetIdentifier: z6.string().optional().describe("Filter by asset identifier"),
+    batchSize: z6.number().optional().describe("Events per page (1–1000, default 100)"),
+    maxPages: z6.number().optional().describe("Max pages to walk this call (1–20, default 5)"),
+    finalizedOnly: z6.boolean().optional().describe("Only emit finalized events; skip reorg handling")
   }, async (params) => withStreamsAuthHint(async () => {
     const maxPages = Math.min(Math.max(params.maxPages ?? 5, 1), 20);
     const batchSize = Math.min(Math.max(params.batchSize ?? 100, 1), 1000);
@@ -701,15 +723,15 @@ function registerStreamsTools(server, clientProvider = getClient) {
       pages: result.pages
     });
   }));
-  defineTool(server, "streams_event_by_txid", "List all Streams events emitted by a single transaction. Streams requires an API key (SL_API_KEY).", { txId: z7.string().describe("Transaction id (0x… hash)") }, async ({ txId }) => withStreamsAuthHint(async () => jsonResponse(await clientProvider().streams.events.byTxId(txId))));
+  defineTool(server, "streams_event_by_txid", "List all Streams events emitted by a single transaction. Streams requires an API key (SL_API_KEY).", { txId: z6.string().describe("Transaction id (0x… hash)") }, async ({ txId }) => withStreamsAuthHint(async () => jsonResponse(await clientProvider().streams.events.byTxId(txId))));
   defineTool(server, "streams_block_events", "List all Streams events in a single block, by height or block hash. Streams requires an API key (SL_API_KEY).", {
-    heightOrHash: z7.string().describe("Block height (digits) or block hash (0x… string)")
+    heightOrHash: z6.string().describe("Block height (digits) or block hash (0x… string)")
   }, async ({ heightOrHash }) => withStreamsAuthHint(async () => jsonResponse(await clientProvider().streams.blocks.events(/^\d+$/.test(heightOrHash) ? Number(heightOrHash) : heightOrHash))));
   defineTool(server, "streams_reorgs", "List chain reorgs observed by Streams since a cursor. Streams requires an API key (SL_API_KEY).", {
-    since: z7.string().describe("Cursor to list reorgs since (block:index or ISO timestamp)"),
-    limit: z7.number().optional().describe("Max reorgs to return")
+    since: z6.string().describe("Cursor to list reorgs since (block:index or ISO timestamp)"),
+    limit: z6.number().optional().describe("Max reorgs to return")
   }, async (params) => withStreamsAuthHint(async () => jsonResponse(await clientProvider().streams.reorgs.list(params))));
-  defineTool(server, "streams_canonical", "Get the canonical block at a given height from Streams (height + hashes + is_canonical). Streams requires an API key (SL_API_KEY).", { height: z7.number().describe("Block height") }, async ({ height }) => withStreamsAuthHint(async () => jsonResponse(await clientProvider().streams.canonical(height))));
+  defineTool(server, "streams_canonical", "Get the canonical block at a given height from Streams (height + hashes + is_canonical). Streams requires an API key (SL_API_KEY).", { height: z6.number().describe("Block height") }, async ({ height }) => withStreamsAuthHint(async () => jsonResponse(await clientProvider().streams.canonical(height))));
   defineTool(server, "streams_usage", "Your own Streams consumption (events today + this month) and tier limits (rate limit, retention). Streams requires an API key (SL_API_KEY).", {}, async () => withStreamsAuthHint(async () => jsonResponse(await clientProvider().streams.usage())));
   defineTool(server, "streams_dumps", "List the Streams bulk parquet dumps manifest — coverage range, latest_finalized_cursor, and per-file metadata (block range, row count, size, sha256, signed URL). This is the cold backfill path for downloading all raw data; fetch the file URLs directly (e.g. with DuckDB). Requires the dumps base URL to be configured (SL_STREAMS_DUMPS_URL).", {}, async () => jsonResponse(await clientProvider().streams.dumps.list()));
 }
@@ -722,9 +744,9 @@ import {
   generateKyselySchema,
   generatePrismaSchema
 } from "@secondlayer/subgraphs";
-import { z as z8 } from "zod/v4";
+import { z as z7 } from "zod/v4";
 function registerSubgraphTools(server, clientProvider = getClient) {
-  defineTool(server, "subgraphs_list", "List all deployed subgraphs. Returns summary fields only.", {}, async () => {
+  defineTool(server, "subgraphs_list", "List all deployed subgraphs. Returns summary fields only, including visibility — public subgraphs are anon-readable at /v1/subgraphs/<name>.", {}, async () => {
     const { data } = await clientProvider().subgraphs.list();
     return {
       content: [
@@ -735,16 +757,16 @@ function registerSubgraphTools(server, clientProvider = getClient) {
       ]
     };
   });
-  defineTool(server, "subgraphs_get", "Get full details of a subgraph including schema, health, and table columns.", { name: z8.string().describe("Subgraph name") }, async ({ name }) => {
+  defineTool(server, "subgraphs_get", "Get full details of a subgraph including schema, health, and table columns.", { name: z7.string().describe("Subgraph name") }, async ({ name }) => {
     const detail = await clientProvider().subgraphs.get(name);
     return {
       content: [{ type: "text", text: JSON.stringify(detail, null, 2) }]
     };
   });
   defineTool(server, "subgraphs_spec", "Get generated API documentation for a subgraph. Defaults to compact agent schema; supports OpenAPI JSON and Markdown.", {
-    name: z8.string().describe("Subgraph name"),
-    format: z8.enum(["agent", "openapi", "markdown"]).optional().describe("Spec format to return. Defaults to agent."),
-    serverUrl: z8.string().optional().describe("Override the server URL embedded in generated docs.")
+    name: z7.string().describe("Subgraph name"),
+    format: z7.enum(["agent", "openapi", "markdown"]).optional().describe("Spec format to return. Defaults to agent."),
+    serverUrl: z7.string().optional().describe("Override the server URL embedded in generated docs.")
   }, async ({ name, format = "agent", serverUrl }) => {
     const options = serverUrl ? { serverUrl } : undefined;
     const spec = format === "openapi" ? await clientProvider().subgraphs.openapi(name, options) : format === "markdown" ? await clientProvider().subgraphs.markdown(name, options) : await clientProvider().subgraphs.schema(name, options);
@@ -757,16 +779,16 @@ function registerSubgraphTools(server, clientProvider = getClient) {
       ]
     };
   });
-  defineTool(server, "subgraphs_query", 'Query rows from a subgraph table (max 200 rows). Filters support operators: "amount.gte": "1000", "sender.neq": "SP...", "name.like": "%token%". Available operators: eq, neq, gt, gte, lt, lte, like. To TAIL new rows (no streaming over MCP): sort=_id, order=desc for the latest, then poll forward with the filter {"_id.gt": "<last _id seen>"}, order=asc. Fetch one row by id with {"_id": "<id>"}.', {
-    name: z8.string().describe("Subgraph name"),
-    table: z8.string().describe("Table name"),
-    filters: z8.record(z8.string(), z8.string()).optional().describe('Column filters — plain values or with operators (e.g. {"amount.gte": "1000", "sender": "SP..."})'),
-    sort: z8.string().optional().describe("Column to sort by"),
-    order: z8.enum(["asc", "desc"]).optional().describe("Sort order"),
-    limit: z8.number().max(200).optional().describe("Max rows (default 50, max 200)"),
-    offset: z8.number().optional().describe("Offset for pagination"),
-    fields: z8.string().optional().describe('Comma-separated column list to return (e.g. "sender,amount")'),
-    count: z8.boolean().optional().describe("If true, return row count instead of rows")
+  defineTool(server, "subgraphs_query", 'Query rows from a subgraph table (max 200 rows). Filters support operators: "amount.gte": "1000", "sender.neq": "SP...", "name.like": "%token%". Available operators: eq, neq, gt, gte, lt, lte, like. To TAIL new rows (no streaming over MCP): sort=_id, order=desc for the latest, then poll forward with the filter {"_id.gt": "<last _id seen>"}, order=asc. Fetch one row by id with {"_id": "<id>"}. Public subgraphs are also keyless over HTTP at GET /v1/subgraphs/<name>/<table> — { rows, next_cursor, tip } envelope, resume with ?cursor=<next_cursor> + _order=asc|desc (no _offset/_sort on /v1); hand that URL to third parties.', {
+    name: z7.string().describe("Subgraph name"),
+    table: z7.string().describe("Table name"),
+    filters: z7.record(z7.string(), z7.string()).optional().describe('Column filters — plain values or with operators (e.g. {"amount.gte": "1000", "sender": "SP..."})'),
+    sort: z7.string().optional().describe("Column to sort by"),
+    order: z7.enum(["asc", "desc"]).optional().describe("Sort order"),
+    limit: z7.number().max(200).optional().describe("Max rows (default 50, max 200)"),
+    offset: z7.number().optional().describe("Offset for pagination"),
+    fields: z7.string().optional().describe('Comma-separated column list to return (e.g. "sender,amount")'),
+    count: z7.boolean().optional().describe("If true, return row count instead of rows")
   }, async ({
     name,
     table,
@@ -799,14 +821,14 @@ function registerSubgraphTools(server, clientProvider = getClient) {
     };
   });
   defineTool(server, "subgraphs_aggregate", `Compute scalar aggregates over a subgraph table's filtered rows. Supports count, countDistinct, and sum/min/max (numeric columns only — uint/int plus the system _block_height). Filters use the same grammar as subgraphs_query (e.g. {"amount.gte": "1000"}). sum/min/max come back as lossless strings; counts as numbers. With no aggregate requested, returns the row count.`, {
-    name: z8.string().describe("Subgraph name"),
-    table: z8.string().describe("Table name"),
-    filters: z8.record(z8.string(), z8.string()).optional().describe('Column filters — plain values or with operators (e.g. {"amount.gte": "1000", "sender": "SP..."})'),
-    count: z8.boolean().optional().describe("Include COUNT(*) of matching rows"),
-    countDistinct: z8.array(z8.string()).optional().describe("Columns to count distinct values of"),
-    sum: z8.array(z8.string()).optional().describe("Numeric columns to sum (lossless string result)"),
-    min: z8.array(z8.string()).optional().describe("Numeric columns to take the minimum of"),
-    max: z8.array(z8.string()).optional().describe("Numeric columns to take the maximum of")
+    name: z7.string().describe("Subgraph name"),
+    table: z7.string().describe("Table name"),
+    filters: z7.record(z7.string(), z7.string()).optional().describe('Column filters — plain values or with operators (e.g. {"amount.gte": "1000", "sender": "SP..."})'),
+    count: z7.boolean().optional().describe("Include COUNT(*) of matching rows"),
+    countDistinct: z7.array(z7.string()).optional().describe("Columns to count distinct values of"),
+    sum: z7.array(z7.string()).optional().describe("Numeric columns to sum (lossless string result)"),
+    min: z7.array(z7.string()).optional().describe("Numeric columns to take the minimum of"),
+    max: z7.array(z7.string()).optional().describe("Numeric columns to take the maximum of")
   }, async ({ name, table, filters, count, countDistinct, sum, min, max }) => {
     const result = await clientProvider().subgraphs.queryTableAggregate(name, table, { filters, count, countDistinct, sum, min, max });
     return {
@@ -814,9 +836,9 @@ function registerSubgraphTools(server, clientProvider = getClient) {
     };
   });
   defineTool(server, "subgraphs_reindex", "Reindex a subgraph from a specific block range. Returns an operationId — poll subgraphs_operation to track progress to completion.", {
-    name: z8.string().describe("Subgraph name"),
-    fromBlock: z8.number().optional().describe("Start block (defaults to beginning)"),
-    toBlock: z8.number().optional().describe("End block (defaults to latest)")
+    name: z7.string().describe("Subgraph name"),
+    fromBlock: z7.number().optional().describe("Start block (defaults to beginning)"),
+    toBlock: z7.number().optional().describe("End block (defaults to latest)")
   }, async ({ name, fromBlock, toBlock }) => {
     const result = await clientProvider().subgraphs.reindex(name, {
       fromBlock,
@@ -827,8 +849,8 @@ function registerSubgraphTools(server, clientProvider = getClient) {
     };
   });
   defineTool(server, "subgraphs_operation", "Check reindex/backfill progress. With operationId, returns that operation's status (poll until status is completed/failed/cancelled); without it, lists recent operations for the subgraph.", {
-    name: z8.string().describe("Subgraph name"),
-    operationId: z8.string().optional().describe("Operation id from reindex/backfill/stop; omit to list recent operations")
+    name: z7.string().describe("Subgraph name"),
+    operationId: z7.string().optional().describe("Operation id from reindex/backfill/stop; omit to list recent operations")
   }, async ({ name, operationId }) => {
     const result = operationId ? await clientProvider().subgraphs.getOperation(name, operationId) : await clientProvider().subgraphs.operations(name);
     return {
@@ -836,9 +858,9 @@ function registerSubgraphTools(server, clientProvider = getClient) {
     };
   });
   defineTool(server, "subgraphs_backfill", "Backfill a subgraph over a block range. Non-destructive forward fill (does not drop existing data) — unlike subgraphs_reindex, and the only data-fill path for BYO subgraphs (reindex is blocked there). Both blocks required. Returns an operationId — poll subgraphs_operation to track progress.", {
-    name: z8.string().describe("Subgraph name"),
-    fromBlock: z8.number().int().nonnegative().describe("Start block (inclusive)"),
-    toBlock: z8.number().int().nonnegative().describe("End block (inclusive)")
+    name: z7.string().describe("Subgraph name"),
+    fromBlock: z7.number().int().nonnegative().describe("Start block (inclusive)"),
+    toBlock: z7.number().int().nonnegative().describe("End block (inclusive)")
   }, async ({ name, fromBlock, toBlock }) => {
     const result = await clientProvider().subgraphs.backfill(name, {
       fromBlock,
@@ -848,17 +870,17 @@ function registerSubgraphTools(server, clientProvider = getClient) {
       content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
     };
   });
-  defineTool(server, "subgraphs_stop", "Cancel an in-flight reindex or backfill operation for a subgraph. Returns the stop request status; poll subgraphs_operation to confirm it reaches a terminal state.", { name: z8.string().describe("Subgraph name") }, async ({ name }) => {
+  defineTool(server, "subgraphs_stop", "Cancel an in-flight reindex or backfill operation for a subgraph. Returns the stop request status; poll subgraphs_operation to confirm it reaches a terminal state.", { name: z7.string().describe("Subgraph name") }, async ({ name }) => {
     const result = await clientProvider().subgraphs.stop(name);
     return {
       content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
     };
   });
   defineTool(server, "subgraphs_gaps", "List indexing gaps (missing block ranges) for a subgraph. Each gap reports start/end/size, reason, and detected/resolved timestamps. Feed an unresolved gap's range into subgraphs_backfill to fill it. Defaults to unresolved gaps.", {
-    name: z8.string().describe("Subgraph name"),
-    limit: z8.number().int().positive().optional().describe("Max gaps to return"),
-    offset: z8.number().int().nonnegative().optional().describe("Pagination offset"),
-    resolved: z8.boolean().optional().describe("Filter by resolved state (omit for unresolved only)")
+    name: z7.string().describe("Subgraph name"),
+    limit: z7.number().int().positive().optional().describe("Max gaps to return"),
+    offset: z7.number().int().nonnegative().optional().describe("Pagination offset"),
+    resolved: z7.boolean().optional().describe("Filter by resolved state (omit for unresolved only)")
   }, async ({ name, limit, offset, resolved }) => {
     const result = await clientProvider().subgraphs.gaps(name, {
       limit,
@@ -869,16 +891,17 @@ function registerSubgraphTools(server, clientProvider = getClient) {
       content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
     };
   });
-  defineTool(server, "subgraphs_delete", "Delete a subgraph permanently.", { name: z8.string().describe("Subgraph name") }, async ({ name }) => {
+  defineTool(server, "subgraphs_delete", "Delete a subgraph permanently.", { name: z7.string().describe("Subgraph name") }, async ({ name }) => {
     const result = await clientProvider().subgraphs.delete(name);
     return { content: [{ type: "text", text: result.message }] };
   });
-  defineTool(server, "subgraphs_deploy", "Deploy a subgraph from TypeScript code. Pass the full defineSubgraph() source — it will be bundled, validated, and deployed. Optional startBlock overrides the source definition for this deploy. Set dryRun to validate and preview the schema/DDL without writing anything. Set databaseUrl to deploy to your own Postgres (BYO data plane) — the server verifies the connection first; with dryRun it returns the DDL + grant script. A breaking BYO schema change is refused and returns a migration plan (drop + rebuild DDL) instead of deploying. Call `subgraphs_reindex` separately if you need a forced reindex.", {
-    code: z8.string().describe("TypeScript source code containing a defineSubgraph() call"),
-    startBlock: z8.number().int().nonnegative().optional().describe("Override the definition startBlock for this deploy"),
-    databaseUrl: z8.string().optional().describe("BYO data plane: Postgres connection string to host the subgraph's schema and rows in your own database"),
-    dryRun: z8.boolean().optional().describe("Validate and preview the deploy (schema/DDL, BYO connection) without writing changes")
-  }, async ({ code, startBlock, databaseUrl, dryRun }) => {
+  defineTool(server, "subgraphs_deploy", "Deploy a subgraph from TypeScript code. Pass the full defineSubgraph() source — it will be bundled, validated, and deployed. Optional startBlock overrides the source definition for this deploy. Set dryRun to validate and preview the schema/DDL without writing anything. Set databaseUrl to deploy to your own Postgres (BYO data plane) — the server verifies the connection first; with dryRun it returns the DDL + grant script. A breaking BYO schema change is refused and returns a migration plan (drop + rebuild DDL) instead of deploying. Visibility defaults: managed deploys are public (anon-readable at /v1/subgraphs/<name>, name claimed in the global public namespace), BYO deploys are private. Call `subgraphs_reindex` separately if you need a forced reindex.", {
+    code: z7.string().describe("TypeScript source code containing a defineSubgraph() call"),
+    startBlock: z7.number().int().nonnegative().optional().describe("Override the definition startBlock for this deploy"),
+    databaseUrl: z7.string().optional().describe("BYO data plane: Postgres connection string to host the subgraph's schema and rows in your own database"),
+    dryRun: z7.boolean().optional().describe("Validate and preview the deploy (schema/DDL, BYO connection) without writing changes"),
+    visibility: z7.enum(["public", "private"]).optional().describe("Read visibility: public = anon /v1 reads + global name claim; private = owning account's key only. Defaults: managed → public, BYO → private.")
+  }, async ({ code, startBlock, databaseUrl, dryRun, visibility }) => {
     const bundled = await bundleSubgraphCode(code);
     try {
       const result = await clientProvider().subgraphs.deploy({
@@ -891,7 +914,8 @@ function registerSubgraphTools(server, clientProvider = getClient) {
         sourceCode: code,
         ...startBlock !== undefined ? { startBlock } : {},
         ...databaseUrl !== undefined ? { databaseUrl } : {},
-        ...dryRun !== undefined ? { dryRun } : {}
+        ...dryRun !== undefined ? { dryRun } : {},
+        ...visibility !== undefined ? { visibility } : {}
       });
       return {
         content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
@@ -910,17 +934,29 @@ function registerSubgraphTools(server, clientProvider = getClient) {
       throw err;
     }
   });
-  defineTool(server, "subgraphs_read_source", "Fetch the deployed TypeScript source of a subgraph (plus its stored version). Returns a readOnly payload for subgraphs deployed before source capture — in that case the caller should redeploy via CLI before editing.", { name: z8.string().describe("Subgraph name") }, async ({ name }) => {
+  defineTool(server, "subgraphs_publish", "Make a subgraph publicly readable at /v1/subgraphs/<name> — anyone (or any agent) can read it without a key. Claims the name in the global public namespace; fails with PUBLIC_NAME_TAKEN if another account holds it.", { name: z7.string().describe("Subgraph name") }, async ({ name }) => {
+    const result = await clientProvider().subgraphs.publish(name);
+    return {
+      content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+    };
+  });
+  defineTool(server, "subgraphs_unpublish", "Make a subgraph private again — /v1 reads then require the owning account's bearer key, and the global public name claim is released.", { name: z7.string().describe("Subgraph name") }, async ({ name }) => {
+    const result = await clientProvider().subgraphs.unpublish(name);
+    return {
+      content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+    };
+  });
+  defineTool(server, "subgraphs_read_source", "Fetch the deployed TypeScript source of a subgraph (plus its stored version). Returns a readOnly payload for subgraphs deployed before source capture — in that case the caller should redeploy via CLI before editing.", { name: z7.string().describe("Subgraph name") }, async ({ name }) => {
     const source = await clientProvider().subgraphs.getSource(name);
     return {
       content: [{ type: "text", text: JSON.stringify(source, null, 2) }]
     };
   });
   defineTool(server, "subgraphs_codegen", "Generate a typed ORM schema (Prisma, Drizzle, or Kysely) for a subgraph's tables so they can be queried from a BYO database. Pass either `code` (defineSubgraph source) or `name` (a deployed subgraph — its captured source is used). Returns the schema as text.", {
-    code: z8.string().optional().describe("defineSubgraph() source (mutually exclusive with name)"),
-    name: z8.string().optional().describe("Deployed subgraph name (mutually exclusive with code)"),
-    target: z8.enum(["prisma", "drizzle", "kysely"]).optional().describe("ORM target (default prisma)"),
-    schemaName: z8.string().optional().describe("Postgres schema name (defaults to subgraph_<name>)")
+    code: z7.string().optional().describe("defineSubgraph() source (mutually exclusive with name)"),
+    name: z7.string().optional().describe("Deployed subgraph name (mutually exclusive with code)"),
+    target: z7.enum(["prisma", "drizzle", "kysely"]).optional().describe("ORM target (default prisma)"),
+    schemaName: z7.string().optional().describe("Postgres schema name (defaults to subgraph_<name>)")
   }, async ({ code, name, target = "prisma", schemaName }) => {
     if (code && name || !code && !name) {
       throw new Error("Provide exactly one of `code` or `name`.");
@@ -949,7 +985,7 @@ function registerSubgraphTools(server, clientProvider = getClient) {
 
 // src/tools/subscriptions.ts
 import { CHAIN_TRIGGER_TYPES } from "@secondlayer/shared";
-import { z as z9 } from "zod/v4";
+import { z as z8 } from "zod/v4";
 function registerSubscriptionTools(server, clientProvider = getClient) {
   defineTool(server, "subscriptions_list", "List all subscriptions for the current account. Returns summary fields (no secrets).", {}, async () => {
     const { data } = await clientProvider().subscriptions.list();
@@ -957,34 +993,34 @@ function registerSubscriptionTools(server, clientProvider = getClient) {
       content: [{ type: "text", text: JSON.stringify(data, null, 2) }]
     };
   });
-  defineTool(server, "subscriptions_get", "Get full detail for a subscription (filter, auth, retry config, circuit state).", { id: z9.string().describe("Subscription id") }, async ({ id }) => {
+  defineTool(server, "subscriptions_get", "Get full detail for a subscription (filter, auth, retry config, circuit state).", { id: z8.string().describe("Subscription id") }, async ({ id }) => {
     const detail = await clientProvider().subscriptions.get(id);
     return {
       content: [{ type: "text", text: JSON.stringify(detail, null, 2) }]
     };
   });
   defineTool(server, "subscriptions_create", "Create a subscription. Two kinds (mutually exclusive): a SUBGRAPH subscription fires on a subgraph table's rows (set subgraphName + tableName + optional filter); a CHAIN subscription fires on raw chain events with no subgraph (set triggers). Returns `signingSecret` ONCE — forward it to the user so they can wire it into their receiver.", {
-    name: z9.string().describe("Human-readable name, unique per account"),
-    subgraphName: z9.string().optional().describe("Subgraph to subscribe to (subgraph subscription)"),
-    tableName: z9.string().optional().describe("Table within the subgraph (subgraph subscription)"),
-    triggers: z9.array(z9.object({
-      type: z9.enum(CHAIN_TRIGGER_TYPES),
-      contractId: z9.string().optional(),
-      functionName: z9.string().optional(),
-      caller: z9.string().optional(),
-      sender: z9.string().optional(),
-      recipient: z9.string().optional(),
-      assetIdentifier: z9.string().optional(),
-      deployer: z9.string().optional(),
-      contractName: z9.string().optional(),
-      topic: z9.string().optional(),
-      lockedAddress: z9.string().optional(),
-      trait: z9.string().optional(),
-      minAmount: z9.union([z9.string(), z9.number()]).optional(),
-      maxAmount: z9.union([z9.string(), z9.number()]).optional()
+    name: z8.string().describe("Human-readable name, unique per account"),
+    subgraphName: z8.string().optional().describe("Subgraph to subscribe to (subgraph subscription)"),
+    tableName: z8.string().optional().describe("Table within the subgraph (subgraph subscription)"),
+    triggers: z8.array(z8.object({
+      type: z8.enum(CHAIN_TRIGGER_TYPES),
+      contractId: z8.string().optional(),
+      functionName: z8.string().optional(),
+      caller: z8.string().optional(),
+      sender: z8.string().optional(),
+      recipient: z8.string().optional(),
+      assetIdentifier: z8.string().optional(),
+      deployer: z8.string().optional(),
+      contractName: z8.string().optional(),
+      topic: z8.string().optional(),
+      lockedAddress: z8.string().optional(),
+      trait: z8.string().optional(),
+      minAmount: z8.union([z8.string(), z8.number()]).optional(),
+      maxAmount: z8.union([z8.string(), z8.number()]).optional()
     })).optional().describe("Chain triggers (chain subscription) — provide INSTEAD of subgraphName/tableName. Each targets a raw chain event/tx; string fields accept `*` wildcards, `trait` scopes to a SIP/trait. Per-type accepted fields: see the secondlayer://chain-triggers resource. Forward-looking: starts at chain tip, no backfill."),
-    url: z9.string().describe("Webhook URL"),
-    format: z9.enum([
+    url: z8.string().describe("Webhook URL"),
+    format: z8.enum([
       "standard-webhooks",
       "inngest",
       "trigger",
@@ -992,9 +1028,9 @@ function registerSubscriptionTools(server, clientProvider = getClient) {
       "cloudevents",
       "raw"
     ]).optional().describe("Wire format (default standard-webhooks)"),
-    runtime: z9.enum(["inngest", "trigger", "cloudflare", "node"]).optional().describe("Receiver runtime label (display only)"),
-    filter: z9.record(z9.string(), z9.unknown()).optional().describe('Scalar filter DSL, e.g. {"amount": {"gte": 100}, "sender": "SP..."}'),
-    authConfig: z9.record(z9.string(), z9.unknown()).optional().describe('Receiver auth sent with each delivery, e.g. {"type": "bearer", "token": "..."}')
+    runtime: z8.enum(["inngest", "trigger", "cloudflare", "node"]).optional().describe("Receiver runtime label (display only)"),
+    filter: z8.record(z8.string(), z8.unknown()).optional().describe('Scalar filter DSL, e.g. {"amount": {"gte": 100}, "sender": "SP..."}'),
+    authConfig: z8.record(z8.string(), z8.unknown()).optional().describe('Receiver auth sent with each delivery, e.g. {"type": "bearer", "token": "..."}')
   }, async (input) => {
     const res = await clientProvider().subscriptions.create(input);
     return {
@@ -1002,12 +1038,12 @@ function registerSubscriptionTools(server, clientProvider = getClient) {
     };
   });
   defineTool(server, "subscriptions_update", "Patch a subscription (name, url, filter, authConfig, format, runtime, retry, timeout, concurrency).", {
-    id: z9.string(),
-    name: z9.string().optional().describe("Rename the subscription"),
-    url: z9.string().optional(),
-    filter: z9.record(z9.string(), z9.unknown()).optional(),
-    authConfig: z9.record(z9.string(), z9.unknown()).optional().describe("Receiver auth sent with each delivery (bearer/etc.)"),
-    format: z9.enum([
+    id: z8.string(),
+    name: z8.string().optional().describe("Rename the subscription"),
+    url: z8.string().optional(),
+    filter: z8.record(z8.string(), z8.unknown()).optional(),
+    authConfig: z8.record(z8.string(), z8.unknown()).optional().describe("Receiver auth sent with each delivery (bearer/etc.)"),
+    format: z8.enum([
       "standard-webhooks",
       "inngest",
       "trigger",
@@ -1015,51 +1051,51 @@ function registerSubscriptionTools(server, clientProvider = getClient) {
       "cloudevents",
       "raw"
     ]).optional(),
-    runtime: z9.enum(["inngest", "trigger", "cloudflare", "node"]).nullable().optional(),
-    maxRetries: z9.number().int().min(0).optional(),
-    timeoutMs: z9.number().int().min(100).optional(),
-    concurrency: z9.number().int().min(1).optional()
+    runtime: z8.enum(["inngest", "trigger", "cloudflare", "node"]).nullable().optional(),
+    maxRetries: z8.number().int().min(0).optional(),
+    timeoutMs: z8.number().int().min(100).optional(),
+    concurrency: z8.number().int().min(1).optional()
   }, async ({ id, ...patch }) => {
     const res = await clientProvider().subscriptions.update(id, patch);
     return {
       content: [{ type: "text", text: JSON.stringify(res, null, 2) }]
     };
   });
-  defineTool(server, "subscriptions_pause", "Pause a subscription. Pending rows remain queued until resumed.", { id: z9.string() }, async ({ id }) => {
+  defineTool(server, "subscriptions_pause", "Pause a subscription. Pending rows remain queued until resumed.", { id: z8.string() }, async ({ id }) => {
     const res = await clientProvider().subscriptions.pause(id);
     return {
       content: [{ type: "text", text: JSON.stringify(res, null, 2) }]
     };
   });
-  defineTool(server, "subscriptions_resume", "Resume a paused or circuit-open subscription and reset circuit failures.", { id: z9.string() }, async ({ id }) => {
+  defineTool(server, "subscriptions_resume", "Resume a paused or circuit-open subscription and reset circuit failures.", { id: z8.string() }, async ({ id }) => {
     const res = await clientProvider().subscriptions.resume(id);
     return {
       content: [{ type: "text", text: JSON.stringify(res, null, 2) }]
     };
   });
-  defineTool(server, "subscriptions_delete", "Delete a subscription. Pending outbox rows are cascade-deleted.", { id: z9.string() }, async ({ id }) => {
+  defineTool(server, "subscriptions_delete", "Delete a subscription. Pending outbox rows are cascade-deleted.", { id: z8.string() }, async ({ id }) => {
     const res = await clientProvider().subscriptions.delete(id);
     return {
       content: [{ type: "text", text: JSON.stringify(res, null, 2) }]
     };
   });
-  defineTool(server, "subscriptions_rotate_secret", "Rotate a subscription signing secret. Returns the new plaintext secret once.", { id: z9.string() }, async ({ id }) => {
+  defineTool(server, "subscriptions_rotate_secret", "Rotate a subscription signing secret. Returns the new plaintext secret once.", { id: z8.string() }, async ({ id }) => {
     const res = await clientProvider().subscriptions.rotateSecret(id);
     return {
       content: [{ type: "text", text: JSON.stringify(res, null, 2) }]
     };
   });
-  defineTool(server, "subscriptions_test", "Send a one-off test webhook to a subscription's URL (built for its format, SSRF-guarded). Logged as a delivery row — check subscriptions_recent_deliveries. Returns {ok, statusCode, error, durationMs, deliveryId}.", { id: z9.string().describe("Subscription id") }, async ({ id }) => {
+  defineTool(server, "subscriptions_test", "Send a one-off test webhook to a subscription's URL (built for its format, SSRF-guarded). Logged as a delivery row — check subscriptions_recent_deliveries. Returns {ok, statusCode, error, durationMs, deliveryId}.", { id: z8.string().describe("Subscription id") }, async ({ id }) => {
     const res = await clientProvider().subscriptions.test(id);
     return {
       content: [{ type: "text", text: JSON.stringify(res, null, 2) }]
     };
   });
   defineTool(server, "subscriptions_replay", "Replay a block range for a subscription. Replays run at 10% of batch capacity — use sparingly. Pass `force` (a short idempotency suffix) to re-run a range that was already replayed.", {
-    id: z9.string(),
-    fromBlock: z9.number().int().nonnegative(),
-    toBlock: z9.number().int().nonnegative(),
-    force: z9.string().optional().describe("Idempotency suffix to force a duplicate replay of the range")
+    id: z8.string(),
+    fromBlock: z8.number().int().nonnegative(),
+    toBlock: z8.number().int().nonnegative(),
+    force: z8.string().optional().describe("Idempotency suffix to force a duplicate replay of the range")
   }, async ({ id, fromBlock, toBlock, force }) => {
     const res = await clientProvider().subscriptions.replay(id, {
       fromBlock,
@@ -1070,22 +1106,22 @@ function registerSubscriptionTools(server, clientProvider = getClient) {
       content: [{ type: "text", text: JSON.stringify(res, null, 2) }]
     };
   });
-  defineTool(server, "subscriptions_dead", "Return the last 100 dead-letter outbox rows for a subscription.", { id: z9.string() }, async ({ id }) => {
+  defineTool(server, "subscriptions_dead", "Return the last 100 dead-letter outbox rows for a subscription.", { id: z8.string() }, async ({ id }) => {
     const { data } = await clientProvider().subscriptions.dead(id);
     return {
       content: [{ type: "text", text: JSON.stringify(data, null, 2) }]
     };
   });
   defineTool(server, "subscriptions_requeue_dead", "Requeue one dead-letter outbox row for delivery retry.", {
-    id: z9.string(),
-    outboxId: z9.string()
+    id: z8.string(),
+    outboxId: z8.string()
   }, async ({ id, outboxId }) => {
     const res = await clientProvider().subscriptions.requeueDead(id, outboxId);
     return {
       content: [{ type: "text", text: JSON.stringify(res, null, 2) }]
     };
   });
-  defineTool(server, "subscriptions_recent_deliveries", "Return the last 100 delivery attempts (attempt #, status code, duration, truncated response).", { id: z9.string() }, async ({ id }) => {
+  defineTool(server, "subscriptions_recent_deliveries", "Return the last 100 delivery attempts (attempt #, status code, duration, truncated response).", { id: z8.string() }, async ({ id }) => {
     const { data } = await clientProvider().subscriptions.recentDeliveries(id);
     return {
       content: [{ type: "text", text: JSON.stringify(data, null, 2) }]
@@ -1106,7 +1142,6 @@ function createServer() {
   registerSubscriptionTools(server);
   registerAccountTools(server);
   registerProjectTools(server);
-  registerDatasetTools(server);
   registerIndexTools(server);
   registerStreamsTools(server);
   registerContractTools(server);
@@ -1119,5 +1154,5 @@ var server = createServer();
 var transport = new StdioServerTransport;
 await server.connect(transport);
 
-//# debugId=184F15FD475E1A2164756E2164756E21
+//# debugId=DF363B254E9A96CE64756E2164756E21
 //# sourceMappingURL=bin.js.map