@selfhost.dev/mcp-server 0.1.0

package/dist/client.js

@@ -0,0 +1,84 @@
+import { config } from "./config.js";
+import { getValidToken } from "./auth.js";
+import { rateLimiter } from "./rate-limiter.js";
+import { session } from "./session.js";
+import { stripSensitiveFields } from "./utils/formatters.js";
+export async function apiRequest(path, options = {}) {
+    const { method = "GET", toolName, skipOrgInjection } = options;
+    let { body, query } = options;
+    // Auto-inject organization_id from session if active org is set
+    const orgId = session.getActiveOrgId();
+    if (orgId && !skipOrgInjection) {
+        if (method === "GET") {
+            if (!query?.organization_id) {
+                query = { ...query, organization_id: orgId };
+            }
+        }
+        else {
+            if (!body?.organization_id) {
+                body = { ...body, organization_id: orgId };
+            }
+        }
+    }
+    // Rate limiting
+    if (toolName) {
+        rateLimiter.acquire(toolName);
+    }
+    try {
+        const token = await getValidToken();
+        // Build URL with query params
+        let url = `${config.apiUrl}${path}`;
+        if (query) {
+            const params = new URLSearchParams();
+            for (const [key, value] of Object.entries(query)) {
+                if (value !== undefined)
+                    params.set(key, value);
+            }
+            const qs = params.toString();
+            if (qs)
+                url += `?${qs}`;
+        }
+        const headers = {
+            Authorization: `Bearer ${token}`,
+            "Content-Type": "application/json",
+            Accept: "application/json",
+        };
+        const fetchOptions = { method, headers };
+        if (body && method !== "GET") {
+            fetchOptions.body = JSON.stringify(body);
+        }
+        const res = await fetch(url, fetchOptions);
+        // 204 No Content
+        if (res.status === 204) {
+            return { success: true, data: null, message: "Success", statusCode: 204 };
+        }
+        const json = await res.json();
+        // Rails standard response format: { status, data, message, status_code }
+        const isSuccess = json.status === "success" || (res.ok && json.status !== "error");
+        return {
+            success: isSuccess,
+            data: isSuccess ? stripSensitiveFields(json.data) : null,
+            message: json.message || res.statusText,
+            statusCode: json.status_code || res.status,
+        };
+    }
+    catch (error) {
+        // Rate limit errors are thrown before fetch — re-throw as-is
+        if (error instanceof Error && error.message.includes("Rate limit")) {
+            throw error;
+        }
+        const message = error instanceof Error ? error.message : "Unknown error";
+        return {
+            success: false,
+            data: null,
+            message,
+            statusCode: 0,
+        };
+    }
+    finally {
+        if (toolName) {
+            rateLimiter.release();
+        }
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAW7D,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAY,EACZ,UAA0B,EAAE;IAE5B,MAAM,EAAE,MAAM,GAAG,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC;IAC/D,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAE9B,gEAAgE;IAChE,MAAM,KAAK,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IACvC,IAAI,KAAK,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC/B,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACrB,IAAI,CAAC,KAAK,EAAE,eAAe,EAAE,CAAC;gBAC5B,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;YAC/C,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,CAAC;gBAC3B,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;YAC7C,CAAC;QACH,CAAC;IACH,CAAC;IAED,gBAAgB;IAChB,IAAI,QAAQ,EAAE,CAAC;QACb,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,aAAa,EAAE,CAAC;QAEpC,8BAA8B;QAC9B,IAAI,GAAG,GAAG,GAAG,MAAM,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;QACpC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;YACrC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjD,IAAI,KAAK,KAAK,SAAS;oBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAClD,CAAC;YACD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC7B,IAAI,EAAE;gBAAE,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;QAC1B,CAAC;QAED,MAAM,OAAO,GAA2B;YACtC,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,kBAAkB;SAC3B,CAAC;QAEF,MAAM,YAAY,GAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACtD,IAAI,IAAI,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YAC7B,YAAY,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAE3C,iBAAiB;QACjB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;QAC5E,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAE9B,yEAAyE;QACzE,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC;QAEnF,OAAO;YACL,OAAO,EAAE,SAAS;YAClB,IAAI,EAAE,SAAS,CAAC,CAAC,CAAE,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAO,CAAC,CAAC,CAAC,IAAI;YAC/D,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,UAAU;YACvC,UAAU,EAAE,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC,MAAM;SAC3C,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,6DAA6D;QAC7D,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACnE,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QACzE,OAAO;YACL,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,IAAI;YACV,OAAO;YACP,UAAU,EAAE,CAAC;SACd,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,IAAI,QAAQ,EAAE,CAAC;YACb,WAAW,CAAC,OAAO,EAAE,CAAC;QACxB,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,13 @@
+import "dotenv/config";
+import type { TierName } from "./types/tiers.js";
+declare function log(message: string): void;
+export declare const config: {
+    apiUrl: string;
+    consoleUrl: string;
+    tierOverride: TierName | undefined;
+    firebaseApiKey: string | undefined;
+    firebaseRefreshToken: string | undefined;
+    credentialsPath: string;
+    log: typeof log;
+};
+export {};

package/dist/config.js

@@ -0,0 +1,20 @@
+import "dotenv/config";
+function log(message) {
+    process.stderr.write(`[selfhost-mcp] ${message}\n`);
+}
+const API_URL = process.env.API_URL || "https://api.selfhost.dev";
+const CONSOLE_URL = process.env.CONSOLE_URL || "https://console.selfhost.dev";
+const TIER_OVERRIDE = process.env.TIER;
+// Headless/CI fallback — skip browser login if these are set
+const FIREBASE_API_KEY = process.env.FIREBASE_API_KEY;
+const FIREBASE_REFRESH_TOKEN = process.env.FIREBASE_REFRESH_TOKEN;
+export const config = {
+    apiUrl: API_URL,
+    consoleUrl: CONSOLE_URL,
+    tierOverride: TIER_OVERRIDE,
+    firebaseApiKey: FIREBASE_API_KEY,
+    firebaseRefreshToken: FIREBASE_REFRESH_TOKEN,
+    credentialsPath: `${process.env.HOME}/.selfhost/credentials.json`,
+    log,
+};
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,eAAe,CAAC;AAGvB,SAAS,GAAG,CAAC,OAAe;IAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,OAAO,IAAI,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,0BAA0B,CAAC;AAClE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,8BAA8B,CAAC;AAC9E,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,IAA4B,CAAC;AAE/D,6DAA6D;AAC7D,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;AACtD,MAAM,sBAAsB,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;AAElE,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,MAAM,EAAE,OAAO;IACf,UAAU,EAAE,WAAW;IACvB,YAAY,EAAE,aAAa;IAC3B,cAAc,EAAE,gBAAgB;IAChC,oBAAoB,EAAE,sBAAsB;IAC5C,eAAe,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,6BAA6B;IACjE,GAAG;CACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/index.js

@@ -0,0 +1,71 @@
+#!/usr/bin/env node
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { config } from "./config.js";
+import { forceReauth, getValidToken, hasCredentials, wasAuthPrompted, markAuthPrompted } from "./auth.js";
+import { session } from "./session.js";
+import { registerAuthTools } from "./tools/auth.js";
+import { registerOrganizationTools } from "./tools/organizations.js";
+import { registerCredentialTools } from "./tools/credentials.js";
+import { registerNetworkingTools } from "./tools/networking.js";
+import { registerInstanceTools } from "./tools/instances.js";
+import { registerPgConfigTools } from "./tools/pg-config.js";
+import { registerBackupTools } from "./tools/backups.js";
+import { registerAlertTools } from "./tools/alerts.js";
+const server = new McpServer({
+    name: "selfhost",
+    version: "0.1.0",
+});
+// Module 1: Auth & Users
+registerAuthTools(server);
+// Module 2: Organizations & Members
+registerOrganizationTools(server);
+// Module 3: Cloud Credentials
+registerCredentialTools(server);
+// Module 4: Networking (VPCs, Subnets, Security Groups)
+registerNetworkingTools(server);
+// Module 5: Instance Lifecycle
+registerInstanceTools(server);
+// Module 6: PostgreSQL Config
+registerPgConfigTools(server);
+// Module 7: Backups & Snapshots
+registerBackupTools(server);
+// Module 8: Alerts & Notifications
+registerAlertTools(server);
+// Server utility tools
+server.tool("reauthenticate", "Clear stored credentials and sign in again (use to switch accounts or fix auth issues)", {}, async () => {
+    try {
+        session.clear();
+        await forceReauth();
+        return {
+            content: [{
+                    type: "text",
+                    text: "Re-authentication successful. Session cleared.\nNext: call `get_my_memberships` to see your organizations, then `select_organization` to pick one.",
+                }],
+        };
+    }
+    catch (err) {
+        return { content: [{ type: "text", text: `Re-authentication failed: ${err instanceof Error ? err.message : err}` }] };
+    }
+});
+async function main() {
+    config.log("Starting SelfHost MCP server...");
+    config.log(`API URL: ${config.apiUrl}`);
+    if (config.tierOverride) {
+        config.log(`Tier override: ${config.tierOverride}`);
+    }
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    // First-time setup: if no credentials exist AND we haven't prompted before, trigger browser auth
+    if (!(await hasCredentials()) && !(await wasAuthPrompted())) {
+        markAuthPrompted().catch(() => { });
+        getValidToken().catch(() => {
+            // Timeout or error — user can retry via any tool call
+        });
+    }
+}
+main().catch((err) => {
+    config.log(`Fatal error: ${err}`);
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC1G,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;IAC3B,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,OAAO;CACjB,CAAC,CAAC;AAEH,yBAAyB;AACzB,iBAAiB,CAAC,MAAM,CAAC,CAAC;AAE1B,oCAAoC;AACpC,yBAAyB,CAAC,MAAM,CAAC,CAAC;AAElC,8BAA8B;AAC9B,uBAAuB,CAAC,MAAM,CAAC,CAAC;AAEhC,wDAAwD;AACxD,uBAAuB,CAAC,MAAM,CAAC,CAAC;AAEhC,+BAA+B;AAC/B,qBAAqB,CAAC,MAAM,CAAC,CAAC;AAE9B,8BAA8B;AAC9B,qBAAqB,CAAC,MAAM,CAAC,CAAC;AAE9B,gCAAgC;AAChC,mBAAmB,CAAC,MAAM,CAAC,CAAC;AAE5B,mCAAmC;AACnC,kBAAkB,CAAC,MAAM,CAAC,CAAC;AAE3B,uBAAuB;AACvB,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,wFAAwF,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE;IACrI,IAAI,CAAC;QACH,OAAO,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,WAAW,EAAE,CAAC;QACpB,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,oJAAoJ;iBAC3J,CAAC;SACH,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC;IACxH,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,IAAI;IACjB,MAAM,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;IAC9C,MAAM,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAExC,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,iGAAiG;IACjG,IAAI,CAAC,CAAC,MAAM,cAAc,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,eAAe,EAAE,CAAC,EAAE,CAAC;QAC5D,gBAAgB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnC,aAAa,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;YACzB,sDAAsD;QACxD,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,MAAM,CAAC,GAAG,CAAC,gBAAgB,GAAG,EAAE,CAAC,CAAC;IAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/rate-limiter.d.ts

@@ -0,0 +1,22 @@
+import { type TierName } from "./types/tiers.js";
+declare class RateLimiter {
+    private tier;
+    private isAdmin;
+    private readBucket;
+    private writeBucket;
+    private maxConcurrent;
+    private activeRequests;
+    private bootstrapRemaining;
+    constructor();
+    setTier(tier: TierName): void;
+    getTier(): TierName;
+    /**
+     * Acquire permission to make a request.
+     * Throws with a descriptive message if rate limited.
+     */
+    acquire(toolName: string): void;
+    release(): void;
+    getWelcomeMessage(orgName: string): string;
+}
+export declare const rateLimiter: RateLimiter;
+export {};

package/dist/rate-limiter.js

@@ -0,0 +1,124 @@
+import { TIER_CONFIGS, categorizeOperation } from "./types/tiers.js";
+import { config } from "./config.js";
+function createBucket(maxTokens, ratePerSecond) {
+    return {
+        tokens: maxTokens,
+        maxTokens,
+        ratePerSecond,
+        lastRefill: Date.now(),
+    };
+}
+function refillBucket(bucket) {
+    const now = Date.now();
+    const elapsed = (now - bucket.lastRefill) / 1000;
+    bucket.tokens = Math.min(bucket.maxTokens, bucket.tokens + elapsed * bucket.ratePerSecond);
+    bucket.lastRefill = now;
+}
+function tryConsume(bucket) {
+    refillBucket(bucket);
+    if (bucket.tokens >= 1) {
+        bucket.tokens -= 1;
+        return { ok: true, retryAfterSeconds: 0 };
+    }
+    // How long until 1 token is available?
+    const deficit = 1 - bucket.tokens;
+    const retryAfterSeconds = Math.ceil(deficit / bucket.ratePerSecond);
+    return { ok: false, retryAfterSeconds };
+}
+class RateLimiter {
+    tier = "FREE";
+    isAdmin = false;
+    readBucket;
+    writeBucket;
+    maxConcurrent;
+    activeRequests = 0;
+    bootstrapRemaining = 5;
+    constructor() {
+        const tierConfig = TIER_CONFIGS.FREE;
+        this.readBucket = createBucket(tierConfig.readBucket.burst, tierConfig.readBucket.ratePerSecond);
+        this.writeBucket = createBucket(tierConfig.writeBucket.burst, tierConfig.writeBucket.ratePerSecond);
+        this.maxConcurrent = tierConfig.maxConcurrent;
+    }
+    setTier(tier) {
+        this.tier = tier;
+        this.isAdmin = tier === "ADMIN";
+        if (this.isAdmin) {
+            config.log("Admin tier set — rate limits disabled.");
+            return;
+        }
+        const tierConfig = TIER_CONFIGS[tier];
+        this.readBucket = createBucket(tierConfig.readBucket.burst, tierConfig.readBucket.ratePerSecond);
+        this.writeBucket = createBucket(tierConfig.writeBucket.burst, tierConfig.writeBucket.ratePerSecond);
+        this.maxConcurrent = tierConfig.maxConcurrent;
+        config.log(`Tier set to ${tier}: ${tierConfig.readBucket.ratePerSecond * 60} reads/min, ${tierConfig.writeBucket.ratePerSecond * 60} writes/min, ${tierConfig.maxConcurrent} concurrent.`);
+    }
+    getTier() {
+        return this.tier;
+    }
+    /**
+     * Acquire permission to make a request.
+     * Throws with a descriptive message if rate limited.
+     */
+    acquire(toolName) {
+        // Admin: no limits
+        if (this.isAdmin) {
+            this.activeRequests++;
+            return;
+        }
+        // Env var override
+        if (config.tierOverride) {
+            this.activeRequests++;
+            return;
+        }
+        const category = categorizeOperation(toolName);
+        // Exempt tools (static data, no DB hit)
+        if (category === "exempt") {
+            return;
+        }
+        // Bootstrap phase: allow first 5 requests before tier is resolved
+        if (this.bootstrapRemaining > 0) {
+            this.bootstrapRemaining--;
+            this.activeRequests++;
+            return;
+        }
+        // Concurrency check
+        if (this.activeRequests >= this.maxConcurrent) {
+            throw new Error(`Too many concurrent requests. Your ${this.tier} plan allows ${this.maxConcurrent} simultaneous requests.\n` +
+                `Please wait for a current request to complete.`);
+        }
+        // Token bucket check
+        const bucket = category === "write" ? this.writeBucket : this.readBucket;
+        const result = tryConsume(bucket);
+        if (!result.ok) {
+            const bucketType = category === "write" ? "write" : "read";
+            const tierConfig = TIER_CONFIGS[this.tier];
+            const readRate = Math.round(tierConfig.readBucket.ratePerSecond * 60);
+            const writeRate = Math.round(tierConfig.writeBucket.ratePerSecond * 60);
+            throw new Error(`Rate limit reached. You've used all available ${bucketType} capacity on the ${this.tier} plan.\n` +
+                `You can retry in ${result.retryAfterSeconds} second(s).\n\n` +
+                `Current plan: ${this.tier} (${readRate} reads/min, ${writeRate} writes/min)\n` +
+                `To increase limits, upgrade at https://console.selfhost.dev/billing`);
+        }
+        this.activeRequests++;
+    }
+    release() {
+        if (this.activeRequests > 0) {
+            this.activeRequests--;
+        }
+    }
+    getWelcomeMessage(orgName) {
+        if (this.isAdmin) {
+            return `Welcome to ${orgName}. You are on the ADMIN plan.\nRate limits: unlimited. No concurrency restrictions.`;
+        }
+        const tierConfig = TIER_CONFIGS[this.tier];
+        const readRate = Math.round(tierConfig.readBucket.ratePerSecond * 60);
+        const writeRate = Math.round(tierConfig.writeBucket.ratePerSecond * 60);
+        const concurrent = tierConfig.maxConcurrent === Infinity ? "unlimited" : String(tierConfig.maxConcurrent);
+        return (`Welcome to ${orgName}. You are on the ${this.tier} plan.\n` +
+            `Rate limits: ${readRate} reads/min, ${writeRate} writes/min (reference data lookups are unlimited).\n` +
+            `Up to ${concurrent} concurrent requests.`);
+    }
+}
+// Singleton
+export const rateLimiter = new RateLimiter();
+//# sourceMappingURL=rate-limiter.js.map

package/dist/rate-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.js","sourceRoot":"","sources":["../src/rate-limiter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkC,YAAY,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACrG,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AASrC,SAAS,YAAY,CAAC,SAAiB,EAAE,aAAqB;IAC5D,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,SAAS;QACT,aAAa;QACb,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,MAAmB;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,OAAO,GAAG,CAAC,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;IACjD,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;IAC3F,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC;AAC1B,CAAC;AAED,SAAS,UAAU,CAAC,MAAmB;IACrC,YAAY,CAAC,MAAM,CAAC,CAAC;IAErB,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;QACnB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;IAC5C,CAAC;IAED,uCAAuC;IACvC,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;IAClC,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;IACpE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,WAAW;IACP,IAAI,GAAa,MAAM,CAAC;IACxB,OAAO,GAAG,KAAK,CAAC;IAChB,UAAU,CAAc;IACxB,WAAW,CAAc;IACzB,aAAa,CAAS;IACtB,cAAc,GAAG,CAAC,CAAC;IACnB,kBAAkB,GAAG,CAAC,CAAC;IAE/B;QACE,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC;QACrC,IAAI,CAAC,UAAU,GAAG,YAAY,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QACjG,IAAI,CAAC,WAAW,GAAG,YAAY,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;QACpG,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;IAChD,CAAC;IAED,OAAO,CAAC,IAAc;QACpB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,IAAI,KAAK,OAAO,CAAC;QAEhC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,YAAY,CAAC,IAAkC,CAAC,CAAC;QACpE,IAAI,CAAC,UAAU,GAAG,YAAY,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QACjG,IAAI,CAAC,WAAW,GAAG,YAAY,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;QACpG,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;QAC9C,MAAM,CAAC,GAAG,CAAC,eAAe,IAAI,KAAK,UAAU,CAAC,UAAU,CAAC,aAAa,GAAG,EAAE,eAAe,UAAU,CAAC,WAAW,CAAC,aAAa,GAAG,EAAE,gBAAgB,UAAU,CAAC,aAAa,cAAc,CAAC,CAAC;IAC7L,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,QAAgB;QACtB,mBAAmB;QACnB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,CAAC,cAAc,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,mBAAmB;QACnB,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,IAAI,CAAC,cAAc,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAE/C,wCAAwC;QACxC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,OAAO;QACT,CAAC;QAED,kEAAkE;QAClE,IAAI,IAAI,CAAC,kBAAkB,GAAG,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC1B,IAAI,CAAC,cAAc,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,oBAAoB;QACpB,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,sCAAsC,IAAI,CAAC,IAAI,gBAAgB,IAAI,CAAC,aAAa,2BAA2B;gBAC5G,gDAAgD,CACjD,CAAC;QACJ,CAAC;QAED,qBAAqB;QACrB,MAAM,MAAM,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;QACzE,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QAElC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,UAAU,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;YAC3D,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,IAAkC,CAAC,CAAC;YACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,aAAa,GAAG,EAAE,CAAC,CAAC;YACtE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,aAAa,GAAG,EAAE,CAAC,CAAC;YAExE,MAAM,IAAI,KAAK,CACb,iDAAiD,UAAU,oBAAoB,IAAI,CAAC,IAAI,UAAU;gBAClG,oBAAoB,MAAM,CAAC,iBAAiB,iBAAiB;gBAC7D,iBAAiB,IAAI,CAAC,IAAI,KAAK,QAAQ,eAAe,SAAS,gBAAgB;gBAC/E,qEAAqE,CACtE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,cAAc,EAAE,CAAC;IACxB,CAAC;IAED,OAAO;QACL,IAAI,IAAI,CAAC,cAAc,GAAG,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,CAAC;IACH,CAAC;IAED,iBAAiB,CAAC,OAAe;QAC/B,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,cAAc,OAAO,oFAAoF,CAAC;QACnH,CAAC;QAED,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,IAAkC,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,aAAa,GAAG,EAAE,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,aAAa,GAAG,EAAE,CAAC,CAAC;QACxE,MAAM,UAAU,GAAG,UAAU,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QAE1G,OAAO,CACL,cAAc,OAAO,oBAAoB,IAAI,CAAC,IAAI,UAAU;YAC5D,gBAAgB,QAAQ,eAAe,SAAS,uDAAuD;YACvG,SAAS,UAAU,uBAAuB,CAC3C,CAAC;IACJ,CAAC;CACF;AAED,YAAY;AACZ,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC"}

package/dist/session.d.ts

@@ -0,0 +1,25 @@
+interface ActiveOrganization {
+    id: string;
+    name: string;
+    billingPlan: string;
+}
+interface SessionUser {
+    id: string;
+    email: string;
+    displayName: string | null;
+    isAdmin: boolean;
+}
+declare class Session {
+    private _user;
+    private _activeOrg;
+    setUser(user: SessionUser): void;
+    getUser(): SessionUser | null;
+    isAdmin(): boolean;
+    setActiveOrg(org: ActiveOrganization): void;
+    getActiveOrg(): ActiveOrganization | null;
+    getActiveOrgId(): string | null;
+    hasActiveOrg(): boolean;
+    clear(): void;
+}
+export declare const session: Session;
+export {};

package/dist/session.js

@@ -0,0 +1,48 @@
+import { rateLimiter } from "./rate-limiter.js";
+import { config } from "./config.js";
+const BILLING_PLAN_TO_TIER = {
+    free: "FREE",
+    starter: "STARTER",
+    pro: "PRO",
+    enterprise: "ENTERPRISE",
+};
+class Session {
+    _user = null;
+    _activeOrg = null;
+    setUser(user) {
+        this._user = user;
+        if (user.isAdmin) {
+            rateLimiter.setTier("ADMIN");
+        }
+    }
+    getUser() {
+        return this._user;
+    }
+    isAdmin() {
+        return this._user?.isAdmin ?? false;
+    }
+    setActiveOrg(org) {
+        this._activeOrg = org;
+        // Admin tier always takes priority over org billing_plan
+        if (!this.isAdmin()) {
+            const tier = BILLING_PLAN_TO_TIER[org.billingPlan] ?? "FREE";
+            rateLimiter.setTier(tier);
+        }
+        config.log(`Active org: ${org.name} (${org.id}), billing_plan: ${org.billingPlan}`);
+    }
+    getActiveOrg() {
+        return this._activeOrg;
+    }
+    getActiveOrgId() {
+        return this._activeOrg?.id ?? null;
+    }
+    hasActiveOrg() {
+        return this._activeOrg !== null;
+    }
+    clear() {
+        this._user = null;
+        this._activeOrg = null;
+    }
+}
+export const session = new Session();
+//# sourceMappingURL=session.js.map

package/dist/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAgBrC,MAAM,oBAAoB,GAA6B;IACrD,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,SAAS;IAClB,GAAG,EAAE,KAAK;IACV,UAAU,EAAE,YAAY;CACzB,CAAC;AAEF,MAAM,OAAO;IACH,KAAK,GAAuB,IAAI,CAAC;IACjC,UAAU,GAA8B,IAAI,CAAC;IAErD,OAAO,CAAC,IAAiB;QACvB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,KAAK,CAAC;IACtC,CAAC;IAED,YAAY,CAAC,GAAuB;QAClC,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC;QAEtB,yDAAyD;QACzD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,GAAG,oBAAoB,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC;YAC7D,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,eAAe,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,oBAAoB,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,IAAI,CAAC;IACrC,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC;IAClC,CAAC;IAED,KAAK;QACH,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;IACzB,CAAC;CACF;AAED,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC"}

package/dist/tools/alerts.d.ts

@@ -0,0 +1,2 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export declare function registerAlertTools(server: McpServer): void;