@sirrlock/mcp 0.1.0 → 1.0.2

package/dist/index.js

@@ -6,8 +6,8 @@
  * Exposes Sirr as MCP tools so Claude Code can read/write ephemeral secrets.
  *
  * Configuration (env vars):
- *   SIRR_SERVER  — Sirr server URL (default: http://localhost:39999)
- *   SIRR_TOKEN   — Bearer token (SIRR_MASTER_KEY on the server)
+ *   SIRR_SERVER  — Sirr server URL (default: https://sirr.sirrlock.com)
+ *   SIRR_TOKEN   — Bearer token: SIRR_MASTER_KEY for full access, or a principal key for org-scoped access
  *
  * Install:  npm install -g @sirrlock/mcp
  * Configure in .mcp.json:
@@ -26,8 +26,9 @@ const stdio_js_1 = require("@modelcontextprotocol/sdk/server/stdio.js");
 const types_js_1 = require("@modelcontextprotocol/sdk/types.js");
 const package_json_1 = require("../package.json");
 // ── Config ────────────────────────────────────────────────────────────────────
-const SIRR_SERVER = (process.env["SIRR_SERVER"] ?? "http://localhost:39999").replace(/\/$/, "");
+const SIRR_SERVER = (process.env["SIRR_SERVER"] ?? "https://sirr.sirrlock.com").replace(/\/$/, "");
 const SIRR_TOKEN = process.env["SIRR_TOKEN"] ?? "";
+const SIRRLOCK_URL = (process.env["SIRRLOCK_URL"] ?? "https://sirrlock.com").replace(/\/$/, "");
 // ── Fetch with timeout ────────────────────────────────────────────────────────
 async function fetchWithTimeout(url, options = {}, ms = 10000) {
     const controller = new AbortController();
@@ -54,8 +55,9 @@ async function fetchWithTimeout(url, options = {}, ms = 10000) {
 const STATUS_HINTS = {
     401: "Check that SIRR_TOKEN matches SIRR_MASTER_KEY on the server. See sirr.dev/errors#401",
     402: "Free tier limit reached. See sirr.dev/errors#402",
-    403: "This API key does not have permission for this operation. See sirr.dev/errors#403",
-    404: "Secret not found, expired, or burned. See sirr.dev/errors#404",
+    403: "This token does not have permission for this operation. See sirr.dev/errors#403",
+    404: "Resource not found, expired, or burned. See sirr.dev/errors#404",
+    409: "Conflict — a secret with that key already exists in this org. Use patch_secret to update it. See sirr.dev/errors#409",
     500: "Server-side error. See sirr.dev/errors#500",
 };
 function throwSirrError(status, json) {
@@ -72,49 +74,79 @@ async function sirrRequest(method, path, body) {
         },
         body: body !== undefined ? JSON.stringify(body) : undefined,
     });
-    const json = (await res.json());
     if (!res.ok) {
+        let json = {};
+        try {
+            json = (await res.json());
+        }
+        catch {
+            json = { error: await res.text().catch(() => "unknown") };
+        }
         throwSirrError(res.status, json);
     }
-    return json;
+    return (await res.json());
 }
 const helpers_1 = require("./helpers");
 // ── Tool definitions ──────────────────────────────────────────────────────────
 const TOOLS = [
     {
         name: "get_secret",
-        description: "Retrieve a secret from the Sirr vault by key name. " +
-            "The secret's read counter is incremented — if it was set with max_reads=1 it will be deleted after this call. " +
+        description: "Retrieve a secret from Sirr. " +
+            "Two modes: (1) Public dead drop — provide 'id' (hex64 returned by push_secret). " +
+            "Fetches from GET /secrets/{id}. The read counter is incremented — if max_reads=1 the secret burns after this call. " +
+            "(2) Org-scoped — provide 'key' and 'org' to fetch a named secret from an organization's vault. " +
             "Returns null if the secret does not exist, has expired, or has been burned. " +
-            "Accepts bare key names, 'sirr:KEYNAME' references, or 'KEYNAME#id' format. " +
             "IMPORTANT: Do not store, log, memorize, or repeat the returned secret value beyond its immediate use. " +
             "Treat it as ephemeral — use it once for its intended purpose and discard it.",
         inputSchema: {
             type: "object",
             properties: {
+                id: {
+                    type: "string",
+                    description: "Public secret ID (hex64) returned by push_secret. Use for public dead-drop retrieval.",
+                },
                 key: {
                     type: "string",
-                    description: "Secret key name. Accepts 'sirr:KEYNAME', 'KEYNAME#id', or bare key name.",
+                    description: "Secret key name for org-scoped retrieval. Accepts 'sirr:KEYNAME', 'KEYNAME#id', or bare key name.",
+                },
+                org: {
+                    type: "string",
+                    description: "Organization ID for org-scoped retrieval. Required when using 'key'.",
                 },
             },
-            required: ["key"],
         },
     },
     {
-        name: "push_secret",
-        description: "Store a secret in the Sirr vault. Optionally set a TTL (seconds) and/or a max read limit. " +
-            "Use max_reads=1 for one-time credentials that burn after first access. " +
-            "Use ttl_seconds for time-expiring secrets.",
+        name: "check_secret",
+        description: "Check whether a secret exists and inspect its metadata — WITHOUT consuming a read. " +
+            "Use this to verify a secret is still available before fetching it, or to inspect read counts and expiry. " +
+            "Returns status (active/sealed), reads used/remaining, and expiry. " +
+            "A 'sealed' secret has exhausted its max_reads; it still exists but cannot be read.",
         inputSchema: {
             type: "object",
             properties: {
                 key: {
                     type: "string",
-                    description: "Key name to store the secret under.",
+                    description: "Secret key name. Accepts 'sirr:KEYNAME', 'KEYNAME#id', or bare key name.",
                 },
+            },
+            required: ["key"],
+        },
+    },
+    {
+        name: "push_secret",
+        description: "Push a secret as an anonymous public dead drop — no key, no org required. " +
+            "Returns an opaque ID and a one-time URL. Share the URL; the recipient opens it once and it burns. " +
+            "Optionally set a TTL (seconds) and/or max read limit. " +
+            "Use max_reads=1 (default) for one-time credentials that burn after first access. " +
+            "Use ttl_seconds to add a time-based expiry. " +
+            "IMPORTANT: Do not store, log, or repeat the pushed value after the call.",
+        inputSchema: {
+            type: "object",
+            properties: {
                 value: {
                     type: "string",
-                    description: "Secret value.",
+                    description: "Secret value to push.",
                 },
                 ttl_seconds: {
                     type: "number",
@@ -122,10 +154,35 @@ const TOOLS = [
                 },
                 max_reads: {
                     type: "number",
-                    description: "Optional maximum read count. Set to 1 for a one-time secret.",
+                    description: "Optional maximum read count. Default: 1 (burn after first read).",
                 },
             },
-            required: ["key", "value"],
+            required: ["value"],
+        },
+    },
+    {
+        name: "set_secret",
+        description: "Store a named secret in an organization's vault (org-scoped). " +
+            "Requires an org ID and a key name. Returns the key and its internal ID. " +
+            "Returns a 409 Conflict error if a secret with that key already exists — use patch_secret to update it. " +
+            "Use push_secret instead if you want an anonymous, keyless dead drop.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                org: {
+                    type: "string",
+                    description: "Organization ID to store the secret in.",
+                },
+                key: {
+                    type: "string",
+                    description: "Key name to store the secret under.",
+                },
+                value: {
+                    type: "string",
+                    description: "Secret value.",
+                },
+            },
+            required: ["org", "key", "value"],
         },
     },
     {
@@ -151,6 +208,32 @@ const TOOLS = [
             required: ["key"],
         },
     },
+    {
+        name: "patch_secret",
+        description: "Update an existing secret's value, TTL, or max read count. All fields are optional — only provided fields are changed.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                key: {
+                    type: "string",
+                    description: "Key name to update.",
+                },
+                value: {
+                    type: "string",
+                    description: "New secret value.",
+                },
+                ttl_seconds: {
+                    type: "number",
+                    description: "New TTL in seconds from now.",
+                },
+                max_reads: {
+                    type: "number",
+                    description: "New max read count.",
+                },
+            },
+            required: ["key"],
+        },
+    },
     {
         name: "prune_secrets",
         description: "Trigger an immediate sweep of all expired secrets on the server. " +
@@ -168,6 +251,24 @@ const TOOLS = [
             properties: {},
         },
     },
+    {
+        name: "share_secret",
+        description: "Share a sensitive value via a secure burn-after-read link hosted on sirrlock.com. " +
+            "No account or token required. " +
+            "The link expires after 24 hours or after the recipient opens it once — whichever comes first. " +
+            "Returns a URL to send to the recipient. " +
+            "IMPORTANT: Do not store or repeat the secret value. Use the returned URL only.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                value: {
+                    type: "string",
+                    description: "The sensitive value to share (password, token, link, etc.).",
+                },
+            },
+            required: ["value"],
+        },
+    },
     {
         name: "sirr_audit",
         description: "Query the Sirr audit log. Returns recent events like secret creates, reads, deletes. " +
@@ -179,13 +280,17 @@ const TOOLS = [
                     type: "number",
                     description: "Only return events after this Unix timestamp.",
                 },
+                until: {
+                    type: "number",
+                    description: "Only return events before this Unix timestamp.",
+                },
                 action: {
                     type: "string",
                     description: "Filter by action type (e.g. secret.create, secret.read, key.create).",
                 },
                 limit: {
                     type: "number",
-                    description: "Maximum events to return (default: 50).",
+                    description: "Maximum events to return (default: 100, max: 1000).",
                 },
             },
         },
@@ -233,50 +338,188 @@ const TOOLS = [
         },
     },
     {
-        name: "sirr_key_create",
-        description: "Create a scoped API key with specific permissions. " +
-            "The raw key is returned once — save it immediately. " +
-            "Permissions: read, write, delete, admin. Optional prefix scoping limits access to secrets matching the prefix.",
+        name: "sirr_key_list",
+        description: "List all API keys for the current principal. Key values are never returned.",
+        inputSchema: {
+            type: "object",
+            properties: {},
+        },
+    },
+    {
+        name: "sirr_me",
+        description: "Get the current authenticated user/org profile from the Sirr server. " +
+            "Returns account details and current plan information.",
+        inputSchema: {
+            type: "object",
+            properties: {},
+        },
+    },
+    {
+        name: "sirr_update_me",
+        description: "Update the current principal's metadata on the Sirr server.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                metadata: {
+                    type: "object",
+                    additionalProperties: { type: "string" },
+                    description: "Key/value metadata to set on the principal (replaces existing metadata).",
+                },
+            },
+            required: ["metadata"],
+        },
+    },
+    {
+        name: "sirr_create_key",
+        description: "Create a new API key for the current principal via /me/keys. " +
+            "The raw key is returned once — save it immediately.",
         inputSchema: {
             type: "object",
             properties: {
-                label: {
+                name: {
                     type: "string",
-                    description: "Human-readable label for the key.",
+                    description: "Human-readable name for the key.",
                 },
-                permissions: {
-                    type: "array",
-                    items: { type: "string" },
-                    description: "Permissions to grant: read, write, delete, admin.",
+                valid_for_seconds: {
+                    type: "number",
+                    description: "How long the key is valid, in seconds (default: 1 year).",
+                },
+                valid_before: {
+                    type: "number",
+                    description: "Explicit expiry as a Unix timestamp (alternative to valid_for_seconds).",
                 },
-                prefix: {
+            },
+            required: ["name"],
+        },
+    },
+    {
+        name: "sirr_delete_key",
+        description: "Revoke an API key belonging to the current principal.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                keyId: {
                     type: "string",
-                    description: "Optional prefix scope — key can only access secrets starting with this prefix.",
+                    description: "API key ID to delete.",
                 },
             },
-            required: ["label", "permissions"],
+            required: ["keyId"],
         },
     },
+    // ── Org management ──────────────────────────────────────────────────────────
     {
-        name: "sirr_key_list",
-        description: "List all scoped API keys. Key hashes are never returned.",
+        name: "sirr_org_create",
+        description: "Create a new organization. Requires master key or sirr_admin permission.",
         inputSchema: {
             type: "object",
-            properties: {},
+            properties: {
+                name: { type: "string", description: "Organization name (1–128 chars)." },
+                metadata: {
+                    type: "object",
+                    additionalProperties: { type: "string" },
+                    description: "Optional key/value metadata.",
+                },
+            },
+            required: ["name"],
         },
     },
     {
-        name: "sirr_key_delete",
-        description: "Delete a scoped API key by its ID.",
+        name: "sirr_org_list",
+        description: "List all organizations. Requires master key.",
+        inputSchema: { type: "object", properties: {} },
+    },
+    {
+        name: "sirr_org_delete",
+        description: "Delete an organization by ID. Org must have no principals. Requires master key.",
         inputSchema: {
             type: "object",
             properties: {
-                id: {
+                org_id: { type: "string", description: "Organization ID to delete." },
+            },
+            required: ["org_id"],
+        },
+    },
+    // ── Principal management ─────────────────────────────────────────────────────
+    {
+        name: "sirr_principal_create",
+        description: "Create a principal (user/service) in an organization.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                org_id: { type: "string", description: "Organization ID." },
+                name: { type: "string", description: "Principal name (1–128 chars)." },
+                role: { type: "string", description: "Role name (must exist in the org or be a built-in role)." },
+                metadata: {
+                    type: "object",
+                    additionalProperties: { type: "string" },
+                    description: "Optional key/value metadata.",
+                },
+            },
+            required: ["org_id", "name", "role"],
+        },
+    },
+    {
+        name: "sirr_principal_list",
+        description: "List all principals in an organization.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                org_id: { type: "string", description: "Organization ID." },
+            },
+            required: ["org_id"],
+        },
+    },
+    {
+        name: "sirr_principal_delete",
+        description: "Delete a principal from an organization. Principal must have no active keys.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                org_id: { type: "string", description: "Organization ID." },
+                principal_id: { type: "string", description: "Principal ID to delete." },
+            },
+            required: ["org_id", "principal_id"],
+        },
+    },
+    // ── Role management ──────────────────────────────────────────────────────────
+    {
+        name: "sirr_role_create",
+        description: "Create a custom role in an organization. " +
+            "Permissions are a letter string: C=create, R=read, P=patch, D=delete, L=list, M=manage, A=admin.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                org_id: { type: "string", description: "Organization ID." },
+                name: { type: "string", description: "Role name (1–64 chars)." },
+                permissions: {
                     type: "string",
-                    description: "API key ID to delete.",
+                    description: "Permission letters, e.g. 'CRL' for create+read+list.",
                 },
             },
-            required: ["id"],
+            required: ["org_id", "name", "permissions"],
+        },
+    },
+    {
+        name: "sirr_role_list",
+        description: "List all roles in an organization (built-in and custom).",
+        inputSchema: {
+            type: "object",
+            properties: {
+                org_id: { type: "string", description: "Organization ID." },
+            },
+            required: ["org_id"],
+        },
+    },
+    {
+        name: "sirr_role_delete",
+        description: "Delete a custom role from an organization. Cannot delete built-in roles or roles in use.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                org_id: { type: "string", description: "Organization ID." },
+                role_name: { type: "string", description: "Role name to delete." },
+            },
+            required: ["org_id", "role_name"],
         },
     },
 ];
@@ -290,21 +533,51 @@ server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
     try {
         switch (name) {
             case "get_secret": {
-                const rawKey = args.key;
-                const key = (0, helpers_1.parseKeyRef)(rawKey);
-                const res = await fetchWithTimeout(`${SIRR_SERVER}/secrets/${encodeURIComponent(key)}`, { headers: { Authorization: `Bearer ${SIRR_TOKEN}` } });
-                if (res.status === 404) {
+                const { id: rawId, key: rawKey, org: rawOrg } = args;
+                // Determine fetch path: public by ID, or org-scoped by key+org
+                let fetchPath;
+                let label;
+                if (rawId) {
+                    fetchPath = (0, helpers_1.publicSecretsPath)(encodeURIComponent(rawId));
+                    label = `ID '${rawId}'`;
+                }
+                else if (rawKey) {
+                    const key = (0, helpers_1.parseKeyRef)(rawKey);
+                    const org = rawOrg ?? process.env.SIRR_ORG;
+                    if (!org) {
+                        return {
+                            content: [{ type: "text", text: "Error: 'org' is required when fetching by key name (or set SIRR_ORG env var)." }],
+                            isError: true,
+                        };
+                    }
+                    fetchPath = (0, helpers_1.orgSecretsPath)(org, encodeURIComponent(key));
+                    label = `key '${key}' in org '${org}'`;
+                }
+                else {
+                    return {
+                        content: [{ type: "text", text: "Error: provide 'id' (public dead drop) or 'key'+'org' (org-scoped)." }],
+                        isError: true,
+                    };
+                }
+                const res = await fetchWithTimeout(`${SIRR_SERVER}${fetchPath}`, { headers: { Authorization: `Bearer ${SIRR_TOKEN}` } });
+                if (res.status === 404 || res.status === 410) {
                     return {
                         content: [
                             {
                                 type: "text",
-                                text: `Secret '${key}' not found, expired, or already burned.`,
+                                text: `Secret ${label} not found, expired, or already burned.`,
                             },
                         ],
                     };
                 }
                 if (!res.ok) {
-                    const json = (await res.json());
+                    let json = {};
+                    try {
+                        json = (await res.json());
+                    }
+                    catch {
+                        json = { error: await res.text().catch(() => "unknown") };
+                    }
                     throwSirrError(res.status, json);
                 }
                 const data = (await res.json());
@@ -321,25 +594,82 @@ server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
                     ],
                 };
             }
+            case "check_secret": {
+                const rawKey = args.key;
+                const key = (0, helpers_1.parseKeyRef)(rawKey);
+                const res = await fetchWithTimeout(`${SIRR_SERVER}${(0, helpers_1.secretsPath)(encodeURIComponent(key))}`, { method: "HEAD", headers: { Authorization: `Bearer ${SIRR_TOKEN}` } });
+                if (res.status === 404) {
+                    return { content: [{ type: "text", text: `Secret '${key}' not found or expired.` }] };
+                }
+                const status = res.headers.get("X-Sirr-Status") ?? (res.status === 410 ? "sealed" : "active");
+                const readCount = res.headers.get("X-Sirr-Read-Count") ?? "?";
+                const readsRemaining = res.headers.get("X-Sirr-Reads-Remaining") ?? "unlimited";
+                const expiresAt = res.headers.get("X-Sirr-Expires-At");
+                const expiry = expiresAt ? (0, helpers_1.formatTtl)(parseInt(expiresAt, 10)) : "no expiry";
+                if (status === "sealed") {
+                    return { content: [{ type: "text", text: `Secret '${key}' is sealed — all reads exhausted.\n  Reads used: ${readCount}\n  Expires: ${expiry}` }] };
+                }
+                return {
+                    content: [{
+                            type: "text",
+                            text: `Secret '${key}' is active.\n  Reads used: ${readCount}\n  Reads remaining: ${readsRemaining}\n  Expires: ${expiry}`,
+                        }],
+                };
+            }
             case "push_secret": {
-                const { key, value: val, ttl_seconds, max_reads } = args;
-                await sirrRequest("POST", "/secrets", {
-                    key,
-                    value: val,
-                    ttl_seconds: ttl_seconds ?? null,
-                    max_reads: max_reads ?? null,
-                });
-                const parts = [`Stored secret '${key}'.`];
+                const { value: val, ttl_seconds, max_reads } = args;
+                const body = { value: val };
+                if (ttl_seconds != null)
+                    body.ttl_seconds = ttl_seconds;
+                if (max_reads != null)
+                    body.max_reads = max_reads;
+                const data = await sirrRequest("POST", (0, helpers_1.publicSecretsPath)(), body);
+                const url = `${SIRR_SERVER}/s/${data.id}`;
+                const parts = [`Secret pushed.`, `ID: ${data.id}`, `URL: ${url}`];
                 if (ttl_seconds)
                     parts.push(`Expires in ${(0, helpers_1.formatTtl)(Math.floor(Date.now() / 1000) + ttl_seconds)}.`);
                 if (max_reads)
                     parts.push(`Burns after ${max_reads} read(s).`);
                 return {
-                    content: [{ type: "text", text: parts.join(" ") }],
+                    content: [{ type: "text", text: parts.join("\n") }],
+                };
+            }
+            case "set_secret": {
+                const { org, key, value: val } = args;
+                const res = await fetchWithTimeout(`${SIRR_SERVER}${(0, helpers_1.orgSecretsPath)(org)}`, {
+                    method: "POST",
+                    headers: {
+                        Authorization: `Bearer ${SIRR_TOKEN}`,
+                        "Content-Type": "application/json",
+                    },
+                    body: JSON.stringify({ key, value: val }),
+                });
+                if (res.status === 409) {
+                    return {
+                        content: [{
+                                type: "text",
+                                text: `Conflict: secret '${key}' already exists in org '${org}'. Use patch_secret to update it.`,
+                            }],
+                        isError: true,
+                    };
+                }
+                if (!res.ok) {
+                    let json = {};
+                    try {
+                        json = (await res.json());
+                    }
+                    catch {
+                        json = { error: await res.text().catch(() => "unknown") };
+                    }
+                    throwSirrError(res.status, json);
+                }
+                const data = (await res.json());
+                return {
+                    content: [{ type: "text", text: `Secret '${data.key}' stored in org '${org}'.\nID: ${data.id}` }],
                 };
             }
             case "list_secrets": {
-                const data = await sirrRequest("GET", "/secrets");
+                const data = await sirrRequest("GET", (0, helpers_1.secretsPath)());
                 if (data.secrets.length === 0) {
                     return {
                         content: [{ type: "text", text: "No active secrets." }],
@@ -363,7 +693,7 @@ server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
             }
             case "delete_secret": {
                 const { key } = args;
-                const res = await fetchWithTimeout(`${SIRR_SERVER}/secrets/${encodeURIComponent(key)}`, {
+                const res = await fetchWithTimeout(`${SIRR_SERVER}${(0, helpers_1.secretsPath)(encodeURIComponent(key))}`, {
                     method: "DELETE",
                     headers: { Authorization: `Bearer ${SIRR_TOKEN}` },
                 });
@@ -375,7 +705,13 @@ server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
                     };
                 }
                 if (!res.ok) {
-                    const json = (await res.json());
+                    let json = {};
+                    try {
+                        json = (await res.json());
+                    }
+                    catch {
+                        json = { error: await res.text().catch(() => "unknown") };
+                    }
                     throwSirrError(res.status, json);
                 }
                 return {
@@ -387,8 +723,23 @@ server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
                     ],
                 };
             }
+            case "patch_secret": {
+                const { key, value: val, ttl_seconds, max_reads } = args;
+                const body = {};
+                if (val !== undefined)
+                    body.value = val;
+                if (ttl_seconds !== undefined)
+                    body.ttl_seconds = ttl_seconds;
+                if (max_reads !== undefined)
+                    body.max_reads = max_reads;
+                const data = await sirrRequest("PATCH", (0, helpers_1.secretsPath)(encodeURIComponent(key)), body);
+                const parts = [`Secret '${key}' updated.`, `Expires: ${(0, helpers_1.formatTtl)(data.expires_at)}`];
+                if (data.max_reads != null)
+                    parts.push(`Max reads: ${data.max_reads} (${data.read_count} used)`);
+                return { content: [{ type: "text", text: parts.join("\n  ") }] };
+            }
             case "prune_secrets": {
-                const data = await sirrRequest("POST", "/prune");
+                const data = await sirrRequest("POST", (0, helpers_1.prunePath)());
                 return {
                     content: [
                         {
@@ -415,16 +766,18 @@ server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
                 };
             }
             case "sirr_audit": {
-                const { since, action, limit } = args;
+                const { since, until, action, limit } = args;
                 const params = new URLSearchParams();
                 if (since != null)
                     params.set("since", String(since));
+                if (until != null)
+                    params.set("until", String(until));
                 if (action != null)
                     params.set("action", action);
                 if (limit != null)
                     params.set("limit", String(limit));
                 const qs = params.toString();
-                const data = await sirrRequest("GET", `/audit${qs ? `?${qs}` : ""}`);
+                const data = await sirrRequest("GET", `${(0, helpers_1.auditPath)()}${qs ? `?${qs}` : ""}`);
                 if (data.events.length === 0) {
                     return {
                         content: [{ type: "text", text: "No audit events found." }],
@@ -445,7 +798,7 @@ server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
                 const body = { url };
                 if (events)
                     body.events = events;
-                const data = await sirrRequest("POST", "/webhooks", body);
+                const data = await sirrRequest("POST", (0, helpers_1.webhooksPath)(), body);
                 return {
                     content: [
                         {
@@ -456,7 +809,7 @@ server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
                 };
             }
             case "sirr_webhook_list": {
-                const data = await sirrRequest("GET", "/webhooks");
+                const data = await sirrRequest("GET", (0, helpers_1.webhooksPath)());
                 if (data.webhooks.length === 0) {
                     return {
                         content: [{ type: "text", text: "No webhooks registered." }],
@@ -474,54 +827,235 @@ server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
             }
             case "sirr_webhook_delete": {
                 const { id } = args;
-                await sirrRequest("DELETE", `/webhooks/${encodeURIComponent(id)}`);
+                const res = await fetchWithTimeout(`${SIRR_SERVER}${(0, helpers_1.webhooksPath)(encodeURIComponent(id))}`, { method: "DELETE", headers: { Authorization: `Bearer ${SIRR_TOKEN}` } });
+                if (res.status === 404) {
+                    return { content: [{ type: "text", text: `Webhook '${id}' not found.` }] };
+                }
+                if (!res.ok) {
+                    let json = {};
+                    try {
+                        json = (await res.json());
+                    }
+                    catch {
+                        json = { error: await res.text().catch(() => "unknown") };
+                    }
+                    throwSirrError(res.status, json);
+                }
+                return { content: [{ type: "text", text: `Webhook '${id}' deleted.` }] };
+            }
+            case "sirr_key_list": {
+                const me = await sirrRequest("GET", "/me");
+                if (!me.keys || me.keys.length === 0) {
+                    return {
+                        content: [{ type: "text", text: "No API keys." }],
+                    };
+                }
+                const lines = me.keys.map((k) => `• ${k.id} — ${k.name} (expires ${new Date(k.valid_before * 1000).toISOString()})`);
                 return {
                     content: [
-                        { type: "text", text: `Webhook '${id}' deleted.` },
+                        {
+                            type: "text",
+                            text: `${me.keys.length} API key(s):\n${lines.join("\n")}`,
+                        },
                     ],
                 };
             }
-            case "sirr_key_create": {
-                const { label, permissions, prefix } = args;
-                const body = { label, permissions };
-                if (prefix)
-                    body.prefix = prefix;
-                const data = await sirrRequest("POST", "/keys", body);
+            case "sirr_me": {
+                const data = await sirrRequest("GET", "/me");
                 return {
                     content: [
                         {
                             type: "text",
-                            text: `API key created.\n  ID: ${data.id}\n  Key: ${data.key}\n  Permissions: ${data.permissions.join(", ")}\n  Prefix: ${data.prefix ?? "(none)"}\n  (Save the key — it won't be shown again)`,
+                            text: JSON.stringify(data, null, 2),
                         },
                     ],
                 };
             }
-            case "sirr_key_list": {
-                const data = await sirrRequest("GET", "/keys");
-                if (data.keys.length === 0) {
-                    return {
-                        content: [{ type: "text", text: "No API keys." }],
-                    };
-                }
-                const lines = data.keys.map((k) => `• ${k.id} — ${k.label} [${k.permissions.join(",")}] prefix=${k.prefix ?? "*"}`);
+            case "sirr_update_me": {
+                const { metadata } = args;
+                const data = await sirrRequest("PATCH", "/me", { metadata });
                 return {
                     content: [
                         {
                             type: "text",
-                            text: `${data.keys.length} API key(s):\n${lines.join("\n")}`,
+                            text: `Profile updated.\n${JSON.stringify(data, null, 2)}`,
                         },
                     ],
                 };
             }
-            case "sirr_key_delete": {
-                const { id } = args;
-                await sirrRequest("DELETE", `/keys/${encodeURIComponent(id)}`);
+            case "sirr_create_key": {
+                const { name: keyName, valid_for_seconds, valid_before } = args;
+                const body = { name: keyName };
+                if (valid_for_seconds != null)
+                    body.valid_for_seconds = valid_for_seconds;
+                if (valid_before != null)
+                    body.valid_before = valid_before;
+                const data = await sirrRequest("POST", "/me/keys", body);
                 return {
                     content: [
-                        { type: "text", text: `API key '${id}' deleted.` },
+                        {
+                            type: "text",
+                            text: `API key created.\n  ID: ${data.id}\n  Name: ${data.name}\n  Key: ${data.key}\n  Valid until: ${new Date(data.valid_before * 1000).toISOString()}\n  (Save the key — it won't be shown again)`,
+                        },
                     ],
                 };
             }
+            case "sirr_delete_key": {
+                const { keyId } = args;
+                const res = await fetchWithTimeout(`${SIRR_SERVER}/me/keys/${encodeURIComponent(keyId)}`, { method: "DELETE", headers: { Authorization: `Bearer ${SIRR_TOKEN}` } });
+                if (res.status === 404) {
+                    return { content: [{ type: "text", text: `API key '${keyId}' not found.` }] };
+                }
+                if (!res.ok) {
+                    let json = {};
+                    try {
+                        json = (await res.json());
+                    }
+                    catch {
+                        json = { error: await res.text().catch(() => "unknown") };
+                    }
+                    throwSirrError(res.status, json);
+                }
+                return { content: [{ type: "text", text: `API key '${keyId}' deleted.` }] };
+            }
+            // ── Org management ────────────────────────────────────────────────────────
+            case "sirr_org_create": {
+                const { name: orgName, metadata } = args;
+                const data = await sirrRequest("POST", "/orgs", { name: orgName, metadata: metadata ?? {} });
+                return {
+                    content: [{ type: "text", text: `Org created.\n  ID: ${data.id}\n  Name: ${data.name}` }],
+                };
+            }
+            case "sirr_org_list": {
+                const data = await sirrRequest("GET", "/orgs");
+                if (data.orgs.length === 0) {
+                    return { content: [{ type: "text", text: "No organizations." }] };
+                }
+                const lines = data.orgs.map((o) => `• ${o.id} — ${o.name}`);
+                return {
+                    content: [{ type: "text", text: `${data.orgs.length} org(s):\n${lines.join("\n")}` }],
+                };
+            }
+            case "sirr_org_delete": {
+                const { org_id } = args;
+                const res = await fetchWithTimeout(`${SIRR_SERVER}/orgs/${encodeURIComponent(org_id)}`, { method: "DELETE", headers: { Authorization: `Bearer ${SIRR_TOKEN}` } });
+                if (res.status === 404) {
+                    return { content: [{ type: "text", text: `Org '${org_id}' not found.` }] };
+                }
+                if (!res.ok) {
+                    let json = {};
+                    try {
+                        json = (await res.json());
+                    }
+                    catch {
+                        json = { error: await res.text().catch(() => "unknown") };
+                    }
+                    throwSirrError(res.status, json);
+                }
+                return { content: [{ type: "text", text: `Org '${org_id}' deleted.` }] };
+            }
+            // ── Principal management ──────────────────────────────────────────────────
+            case "sirr_principal_create": {
+                const { org_id, name: pName, role, metadata } = args;
+                const data = await sirrRequest("POST", `/orgs/${encodeURIComponent(org_id)}/principals`, { name: pName, role, metadata: metadata ?? {} });
+                return {
+                    content: [{ type: "text", text: `Principal created.\n  ID: ${data.id}\n  Name: ${data.name}\n  Role: ${data.role}` }],
+                };
+            }
+            case "sirr_principal_list": {
+                const { org_id } = args;
+                const data = await sirrRequest("GET", `/orgs/${encodeURIComponent(org_id)}/principals`);
+                if (data.principals.length === 0) {
+                    return { content: [{ type: "text", text: "No principals." }] };
+                }
+                const lines = data.principals.map((p) => `• ${p.id} — ${p.name} [${p.role}]`);
+                return {
+                    content: [{ type: "text", text: `${data.principals.length} principal(s):\n${lines.join("\n")}` }],
+                };
+            }
+            case "sirr_principal_delete": {
+                const { org_id, principal_id } = args;
+                const res = await fetchWithTimeout(`${SIRR_SERVER}/orgs/${encodeURIComponent(org_id)}/principals/${encodeURIComponent(principal_id)}`, { method: "DELETE", headers: { Authorization: `Bearer ${SIRR_TOKEN}` } });
+                if (res.status === 404) {
+                    return { content: [{ type: "text", text: `Principal '${principal_id}' not found.` }] };
+                }
+                if (!res.ok) {
+                    let json = {};
+                    try {
+                        json = (await res.json());
+                    }
+                    catch {
+                        json = { error: await res.text().catch(() => "unknown") };
+                    }
+                    throwSirrError(res.status, json);
+                }
+                return { content: [{ type: "text", text: `Principal '${principal_id}' deleted.` }] };
+            }
+            // ── Role management ───────────────────────────────────────────────────────
+            case "sirr_role_create": {
+                const { org_id, name: roleName, permissions } = args;
+                const data = await sirrRequest("POST", `/orgs/${encodeURIComponent(org_id)}/roles`, { name: roleName, permissions });
+                return {
+                    content: [{ type: "text", text: `Role '${data.name}' created with permissions '${data.permissions}'.` }],
+                };
+            }
+            case "sirr_role_list": {
+                const { org_id } = args;
+                const data = await sirrRequest("GET", `/orgs/${encodeURIComponent(org_id)}/roles`);
+                if (data.roles.length === 0) {
+                    return { content: [{ type: "text", text: "No roles." }] };
+                }
+                const lines = data.roles.map((r) => `• ${r.name} [${r.permissions}]${r.built_in ? " (built-in)" : ""}`);
+                return {
+                    content: [{ type: "text", text: `${data.roles.length} role(s):\n${lines.join("\n")}` }],
+                };
+            }
+            case "sirr_role_delete": {
+                const { org_id, role_name } = args;
+                const res = await fetchWithTimeout(`${SIRR_SERVER}/orgs/${encodeURIComponent(org_id)}/roles/${encodeURIComponent(role_name)}`, { method: "DELETE", headers: { Authorization: `Bearer ${SIRR_TOKEN}` } });
+                if (res.status === 404) {
+                    return { content: [{ type: "text", text: `Role '${role_name}' not found.` }] };
+                }
+                if (!res.ok) {
+                    let json = {};
+                    try {
+                        json = (await res.json());
+                    }
+                    catch {
+                        json = { error: await res.text().catch(() => "unknown") };
+                    }
+                    throwSirrError(res.status, json);
+                }
+                return {
+                    content: [{ type: "text", text: `Role '${role_name}' deleted.` }],
+                };
+            }
+            case "share_secret": {
+                const { value: shareValue } = args;
+                const res = await fetchWithTimeout(`${SIRRLOCK_URL}/api/public/secret`, {
+                    method: "POST",
+                    headers: { "Content-Type": "application/json" },
+                    body: JSON.stringify({ value: shareValue }),
+                });
+                if (!res.ok) {
+                    let json = {};
+                    try {
+                        json = (await res.json());
+                    }
+                    catch {
+                        json = { error: await res.text().catch(() => "unknown") };
+                    }
+                    throwSirrError(res.status, json);
+                }
+                const data = (await res.json());
+                const shareUrl = `${SIRRLOCK_URL}/s/${data.key}`;
+                return {
+                    content: [{
+                            type: "text",
+                            text: `${shareUrl}\n\n[This link burns after one read or after 24 hours. Do not store or repeat the original value.]`,
+                        }],
+                };
+            }
             default:
                 return {
                     content: [{ type: "text", text: `Unknown tool: ${name}` }],