@sota-io/mcp 1.3.0 → 1.4.0

package/dist/http.js

@@ -0,0 +1,259 @@
+#!/usr/bin/env node
+/**
+ * sota.io MCP Server — HTTP Transport (remote)
+ *
+ * Streamable HTTP variant of the existing stdio MCP server. Same 13 tools,
+ * exposed via mcp.sota.io/mcp for one-click installation from Claude Desktop
+ * and Claude.ai.
+ *
+ * Phase 57-01 (this file): scaffold + transport + RFC 9728 metadata.
+ *   Auth is currently a pass-through Bearer API key — clients send their
+ *   existing sota_xxx key as `Authorization: Bearer <key>` and it gets
+ *   forwarded to sota-api. No OAuth validation yet.
+ *
+ * Phase 57-02 (next): OAuth 2.1 + JWT validation against Supabase JWKS,
+ *   token-to-API-key bridge with `source=claude` audit tagging.
+ *
+ * Phase 57-03 (next): `create_account` tool for net-new user signup from
+ *   inside Claude + plan-based capability gating.
+ */
+import crypto from 'node:crypto';
+import express from 'express';
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { SotaClient } from '@sota-io/sdk';
+import { registerProjectTools } from './tools/projects.js';
+import { registerDeployTool } from './tools/deploy.js';
+import { registerLogsTool } from './tools/logs.js';
+import { registerEnvTools } from './tools/env.js';
+import { registerRollbackTool } from './tools/rollback.js';
+import { registerStatusTool } from './tools/status.js';
+import { registerDomainTools } from './tools/domains.js';
+import { verifyJwt, JwtVerificationError } from './auth/verify-jwt.js';
+import { getOrProvisionApiKey } from './auth/token-bridge.js';
+import { registerCreateAccountTool } from './tools/create-account.js';
+// Tools that may be invoked WITHOUT authentication. Currently only
+// create_account — net-new users obviously don't have an API key yet.
+// Discovery requests (initialize, tools/list) are also allowed
+// unauthenticated so Claude can fetch capabilities before OAuth.
+const UNAUTHENTICATED_TOOLS = new Set(['create_account']);
+const UNAUTHENTICATED_METHODS = new Set(['initialize', 'notifications/initialized', 'tools/list']);
+function isUnauthenticatedAllowed(body) {
+    if (!body || typeof body !== 'object')
+        return false;
+    const b = body;
+    const method = typeof b.method === 'string' ? b.method : '';
+    if (UNAUTHENTICATED_METHODS.has(method))
+        return true;
+    if (method === 'tools/call') {
+        const params = (b.params ?? {});
+        const name = typeof params.name === 'string' ? params.name : '';
+        return UNAUTHENTICATED_TOOLS.has(name);
+    }
+    return false;
+}
+const PORT = Number(process.env.PORT ?? 8080);
+const SOTA_API_URL = process.env.SOTA_API_URL ?? 'https://api.sota.io';
+const PUBLIC_ORIGIN = process.env.PUBLIC_ORIGIN ?? 'https://mcp.sota.io';
+const AUTH_SERVER = process.env.AUTH_SERVER ?? 'https://auth.sota.io/auth/v1';
+const VERSION = process.env.MCP_SERVER_VERSION ?? '1.4.0-pre';
+const app = express();
+app.use(express.json({ limit: '4mb' }));
+// ───────────────────────────────────────────────────────────────────────────
+// /health — Traefik / Docker healthcheck target
+// ───────────────────────────────────────────────────────────────────────────
+app.get('/health', (_req, res) => {
+    res.json({
+        ok: true,
+        service: 'sota-mcp',
+        version: VERSION,
+        transport: 'streamable-http',
+        ts: new Date().toISOString(),
+    });
+});
+// ───────────────────────────────────────────────────────────────────────────
+// RFC 9728 Protected Resource Metadata
+// ───────────────────────────────────────────────────────────────────────────
+// MCP clients fetch this BEFORE attempting auth. It points them at the
+// Authorization Server (Supabase) and declares the audience binding.
+// Spec: https://datatracker.ietf.org/doc/html/rfc9728
+// MCP requirement: https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization
+app.get('/.well-known/oauth-protected-resource', (_req, res) => {
+    res.json({
+        resource: PUBLIC_ORIGIN,
+        authorization_servers: [AUTH_SERVER],
+        bearer_methods_supported: ['header'],
+        resource_documentation: 'https://sota.io/docs/integrations/claude',
+        scopes_supported: ['openid', 'profile', 'email'],
+        resource_signing_alg_values_supported: ['RS256', 'ES256'],
+    });
+});
+// ───────────────────────────────────────────────────────────────────────────
+// /mcp — Streamable HTTP transport endpoint
+// ───────────────────────────────────────────────────────────────────────────
+// Stateless mode: every request gets a fresh McpServer + transport instance.
+// Adequate for low-traffic; revisit if we see > 100 RPS sustained.
+function unauthorized(res, reason, detail) {
+    res
+        .status(401)
+        .header('WWW-Authenticate', `Bearer realm="${PUBLIC_ORIGIN}", error="${reason}", resource_metadata="${PUBLIC_ORIGIN}/.well-known/oauth-protected-resource"`)
+        .json({ error: 'unauthorized', reason, detail });
+}
+async function handleMcpRequest(req, res) {
+    // ── 57-02 Auth: OAuth JWT validation + token-to-key bridge ──
+    // Accept Bearer <jwt> (Claude/MCP path) OR Bearer <sota_xxx> (testing/CLI path).
+    // sota_-prefixed tokens skip JWT validation and pass through directly.
+    const authHeader = req.headers.authorization ?? '';
+    const rawToken = authHeader.startsWith('Bearer ')
+        ? authHeader.slice('Bearer '.length).trim()
+        : '';
+    const startedAt = Date.now();
+    const auditMeta = {
+        request_id: crypto.randomUUID(),
+        started_at: new Date(startedAt).toISOString(),
+    };
+    // Anonymous path for discovery + create_account. The MCP server is still
+    // constructed, but with a "phantom" apiKey that never reaches sota-api
+    // (only the create_account tool is registered and it doesn't use SotaClient).
+    let apiKey = '';
+    const allowAnonymous = !rawToken && isUnauthenticatedAllowed(req.body);
+    if (!rawToken && !allowAnonymous) {
+        unauthorized(res, 'missing_token', 'Pass Authorization: Bearer <jwt>');
+        return;
+    }
+    if (allowAnonymous) {
+        auditMeta.auth_path = 'anonymous';
+        apiKey = 'anonymous';
+    }
+    else if (rawToken.startsWith('sota_')) {
+        // Direct API-key path — legacy testing + CLI use, no OAuth involved.
+        apiKey = rawToken;
+        auditMeta.auth_path = 'direct_api_key';
+        auditMeta.key_prefix = rawToken.slice(0, 13);
+    }
+    else {
+        // JWT path — Claude OAuth
+        try {
+            const claims = await verifyJwt(rawToken);
+            auditMeta.auth_path = 'jwt';
+            auditMeta.user_id = claims.sub;
+            auditMeta.email = claims.email;
+            auditMeta.iss = claims.iss;
+            const bridge = await getOrProvisionApiKey(claims.sub);
+            apiKey = bridge.apiKey;
+            auditMeta.key_provisioned = bridge.created;
+            auditMeta.key_rotated = bridge.rotated;
+        }
+        catch (err) {
+            if (err instanceof JwtVerificationError) {
+                // eslint-disable-next-line no-console
+                console.log(JSON.stringify({
+                    ...auditMeta,
+                    event: 'auth_failed',
+                    error_code: err.code,
+                    error_message: err.message,
+                }));
+                unauthorized(res, err.code, err.message);
+                return;
+            }
+            // Database / network problem during bridge — surface as 503, not 401
+            // eslint-disable-next-line no-console
+            console.error(JSON.stringify({
+                ...auditMeta,
+                event: 'bridge_error',
+                error_message: err instanceof Error ? err.message : String(err),
+            }));
+            res.status(503).json({
+                error: 'bridge_unavailable',
+                message: 'Could not provision an API key for this Claude session — try again in a moment.',
+            });
+            return;
+        }
+    }
+    // Build a fresh MCP server per request (stateless mode).
+    const server = new McpServer({
+        name: 'sota',
+        version: VERSION,
+        title: 'sota.io',
+    });
+    // create_account is registered ALWAYS — it's the wedge tool that lets
+    // brand-new users sign up from inside Claude before they have an API key.
+    registerCreateAccountTool(server);
+    // The sota-api-backed tools are only registered when the request carries
+    // valid auth. For anonymous requests (initialize / tools/list / tools/call
+    // create_account), the user just sees create_account in the catalog.
+    if (!allowAnonymous) {
+        const client = new SotaClient({ apiKey, baseUrl: SOTA_API_URL });
+        registerProjectTools(server, client);
+        registerDeployTool(server, client);
+        registerLogsTool(server, client);
+        registerEnvTools(server, client);
+        registerRollbackTool(server, client);
+        registerStatusTool(server, client);
+        registerDomainTools(server, client);
+    }
+    // Stateless transport — no session header required.
+    const transport = new StreamableHTTPServerTransport({
+        sessionIdGenerator: undefined,
+    });
+    res.on('close', () => {
+        transport.close().catch(() => { });
+        server.close().catch(() => { });
+    });
+    try {
+        await server.connect(transport);
+        await transport.handleRequest(req, res, req.body);
+        // Structured audit log per request (Claude path only — direct API key calls don't audit here)
+        // eslint-disable-next-line no-console
+        console.log(JSON.stringify({
+            ...auditMeta,
+            event: 'mcp_request',
+            method: req.body?.method,
+            duration_ms: Date.now() - startedAt,
+        }));
+    }
+    catch (err) {
+        // eslint-disable-next-line no-console
+        console.error(JSON.stringify({
+            ...auditMeta,
+            event: 'mcp_error',
+            error_message: err instanceof Error ? err.message : String(err),
+            duration_ms: Date.now() - startedAt,
+        }));
+        if (!res.headersSent) {
+            res.status(500).json({
+                jsonrpc: '2.0',
+                error: { code: -32603, message: err instanceof Error ? err.message : String(err) },
+                id: null,
+            });
+        }
+    }
+}
+app.post('/mcp', handleMcpRequest);
+app.get('/mcp', (_req, res) => {
+    // GET on /mcp without an active session = 405 Method Not Allowed.
+    // (Stateful mode would use GET for the SSE response stream; we're stateless.)
+    res.status(405).json({ error: 'method_not_allowed', allowed: 'POST' });
+});
+// ───────────────────────────────────────────────────────────────────────────
+// Root index for humans hitting mcp.sota.io directly
+// ───────────────────────────────────────────────────────────────────────────
+app.get('/', (_req, res) => {
+    res.json({
+        service: 'sota-mcp',
+        version: VERSION,
+        description: 'MCP server for sota.io — EU-native PaaS. Use the Streamable HTTP transport at /mcp.',
+        docs: 'https://sota.io/docs/integrations/claude',
+        endpoints: {
+            health: `${PUBLIC_ORIGIN}/health`,
+            mcp: `${PUBLIC_ORIGIN}/mcp`,
+            protected_resource_metadata: `${PUBLIC_ORIGIN}/.well-known/oauth-protected-resource`,
+        },
+    });
+});
+// ───────────────────────────────────────────────────────────────────────────
+app.listen(PORT, '0.0.0.0', () => {
+    // eslint-disable-next-line no-console
+    console.log(`sota-mcp listening on http://0.0.0.0:${PORT} (public: ${PUBLIC_ORIGIN})`);
+});
+//# sourceMappingURL=http.js.map

package/dist/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAEtE,mEAAmE;AACnE,sEAAsE;AACtE,+DAA+D;AAC/D,iEAAiE;AACjE,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;AAC1D,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,2BAA2B,EAAE,YAAY,CAAC,CAAC,CAAC;AAEnG,SAAS,wBAAwB,CAAC,IAAa;IAC7C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACpD,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,IAAI,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAA4B,CAAC;QAC3D,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,OAAO,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;AAC9C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,qBAAqB,CAAC;AACvE,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,qBAAqB,CAAC;AACzE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,8BAA8B,CAAC;AAC9E,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,WAAW,CAAC;AAE9D,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;AACtB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AAExC,8EAA8E;AAC9E,gDAAgD;AAChD,8EAA8E;AAC9E,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;IAClD,GAAG,CAAC,IAAI,CAAC;QACP,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,UAAU;QACnB,OAAO,EAAE,OAAO;QAChB,SAAS,EAAE,iBAAiB;QAC5B,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAC7B,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,uCAAuC;AACvC,8EAA8E;AAC9E,uEAAuE;AACvE,qEAAqE;AACrE,sDAAsD;AACtD,gGAAgG;AAChG,GAAG,CAAC,GAAG,CAAC,uCAAuC,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;IAChF,GAAG,CAAC,IAAI,CAAC;QACP,QAAQ,EAAE,aAAa;QACvB,qBAAqB,EAAE,CAAC,WAAW,CAAC;QACpC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;QACpC,sBAAsB,EAAE,0CAA0C;QAClE,gBAAgB,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;QAChD,qCAAqC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;KAC1D,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,4CAA4C;AAC5C,8EAA8E;AAC9E,6EAA6E;AAC7E,mEAAmE;AACnE,SAAS,YAAY,CAAC,GAAa,EAAE,MAAc,EAAE,MAAe;IAClE,GAAG;SACA,MAAM,CAAC,GAAG,CAAC;SACX,MAAM,CACL,kBAAkB,EAClB,iBAAiB,aAAa,aAAa,MAAM,yBAAyB,aAAa,wCAAwC,CAChI;SACA,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,GAAY,EAAE,GAAa;IACzD,+DAA+D;IAC/D,iFAAiF;IACjF,uEAAuE;IACvE,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IACnD,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;QAC/C,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE;QAC3C,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,SAAS,GAA4B;QACzC,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE;QAC/B,UAAU,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;KAC9C,CAAC;IAEF,yEAAyE;IACzE,uEAAuE;IACvE,8EAA8E;IAC9E,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,cAAc,GAAG,CAAC,QAAQ,IAAI,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAEvE,IAAI,CAAC,QAAQ,IAAI,CAAC,cAAc,EAAE,CAAC;QACjC,YAAY,CAAC,GAAG,EAAE,eAAe,EAAE,kCAAkC,CAAC,CAAC;QACvE,OAAO;IACT,CAAC;IAED,IAAI,cAAc,EAAE,CAAC;QACnB,SAAS,CAAC,SAAS,GAAG,WAAW,CAAC;QAClC,MAAM,GAAG,WAAW,CAAC;IACvB,CAAC;SAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,qEAAqE;QACrE,MAAM,GAAG,QAAQ,CAAC;QAClB,SAAS,CAAC,SAAS,GAAG,gBAAgB,CAAC;QACvC,SAAS,CAAC,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,0BAA0B;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC;YACzC,SAAS,CAAC,SAAS,GAAG,KAAK,CAAC;YAC5B,SAAS,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC;YAC/B,SAAS,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAC/B,SAAS,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;YAE3B,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtD,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YACvB,SAAS,CAAC,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC;YAC3C,SAAS,CAAC,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;gBACxC,sCAAsC;gBACtC,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC;oBACb,GAAG,SAAS;oBACZ,KAAK,EAAE,aAAa;oBACpB,UAAU,EAAE,GAAG,CAAC,IAAI;oBACpB,aAAa,EAAE,GAAG,CAAC,OAAO;iBAC3B,CAAC,CACH,CAAC;gBACF,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;gBACzC,OAAO;YACT,CAAC;YACD,qEAAqE;YACrE,sCAAsC;YACtC,OAAO,CAAC,KAAK,CACX,IAAI,CAAC,SAAS,CAAC;gBACb,GAAG,SAAS;gBACZ,KAAK,EAAE,cAAc;gBACrB,aAAa,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aAChE,CAAC,CACH,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,oBAAoB;gBAC3B,OAAO,EAAE,iFAAiF;aAC3F,CAAC,CAAC;YACH,OAAO;QACT,CAAC;IACH,CAAC;IAED,yDAAyD;IACzD,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,SAAS;KACjB,CAAC,CAAC;IAEH,sEAAsE;IACtE,0EAA0E;IAC1E,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAElC,yEAAyE;IACzE,2EAA2E;IAC3E,qEAAqE;IACrE,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QACjE,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACrC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACrC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnC,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAED,oDAAoD;IACpD,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;QAClD,kBAAkB,EAAE,SAAS;KAC9B,CAAC,CAAC;IAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACnB,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAClC,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAA+D,EAAE,GAA+D,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1K,8FAA8F;QAC9F,sCAAsC;QACtC,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC;YACb,GAAG,SAAS;YACZ,KAAK,EAAE,aAAa;YACpB,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM;YACxB,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACpC,CAAC,CACH,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,sCAAsC;QACtC,OAAO,CAAC,KAAK,CACX,IAAI,CAAC,SAAS,CAAC;YACb,GAAG,SAAS;YACZ,KAAK,EAAE,WAAW;YAClB,aAAa,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YAC/D,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACpC,CAAC,CACH,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;gBAClF,EAAE,EAAE,IAAI;aACT,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;AACnC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;IAC/C,kEAAkE;IAClE,8EAA8E;IAC9E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;AACzE,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,qDAAqD;AACrD,8EAA8E;AAC9E,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;IAC5C,GAAG,CAAC,IAAI,CAAC;QACP,OAAO,EAAE,UAAU;QACnB,OAAO,EAAE,OAAO;QAChB,WAAW,EAAE,qFAAqF;QAClG,IAAI,EAAE,0CAA0C;QAChD,SAAS,EAAE;YACT,MAAM,EAAE,GAAG,aAAa,SAAS;YACjC,GAAG,EAAE,GAAG,aAAa,MAAM;YAC3B,2BAA2B,EAAE,GAAG,aAAa,uCAAuC;SACrF;KACF,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE;IAC/B,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,wCAAwC,IAAI,aAAa,aAAa,GAAG,CAAC,CAAC;AACzF,CAAC,CAAC,CAAC"}

package/dist/tools/create-account.d.ts

@@ -0,0 +1,23 @@
+/**
+ * `create_account` MCP tool — net-new sota.io signup from inside Claude.
+ *
+ * Two-step flow:
+ *   1. create_account({ email })             → triggers Supabase OTP send
+ *   2. create_account({ email, code })       → verifies, provisions plan + key
+ *
+ * The tool is INTENTIONALLY callable without prior authentication. The HTTP
+ * server's middleware whitelists this specific tool/call combination so
+ * net-new users (who don't have a Supabase JWT yet) can sign up entirely
+ * via Claude tool calls.
+ *
+ * Why this is OK from a security perspective:
+ *  - Disposable-email blocking (Phase pre-62) filters obvious abuse
+ *  - Supabase has its own per-email OTP rate limits (default 30/h)
+ *  - The tool ONLY hits Supabase's public OTP endpoints + our own DB
+ *    via the bridge — no sota-api access without authentication
+ *  - The returned `sota_xxx` key is delivered in the tool RESPONSE, not
+ *    stored in Claude — the user must save it themselves
+ */
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export declare function registerCreateAccountTool(server: McpServer): void;
+//# sourceMappingURL=create-account.d.ts.map

package/dist/tools/create-account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-account.d.ts","sourceRoot":"","sources":["../../src/tools/create-account.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAcpE,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,SAAS,QA+K1D"}

package/dist/tools/create-account.js

@@ -0,0 +1,171 @@
+import { z } from "zod";
+import { isDisposableEmailDomain } from "../auth/disposable-check.js";
+import { provisionPlanAndKey } from "../auth/token-bridge.js";
+const SUPABASE_URL = process.env.SUPABASE_URL ?? "https://auth.sota.io/auth/v1";
+const SUPABASE_ANON_KEY = process.env.SUPABASE_ANON_KEY ?? "";
+const SUPABASE_SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY ?? "";
+export function registerCreateAccountTool(server) {
+    server.registerTool("create_account", {
+        description: `Sign up for a brand-new sota.io account from inside Claude — no browser, no copy-paste. Two-step flow:
+
+STEP 1: Call with just \`email\`. We send a 6-digit confirmation code to that email.
+STEP 2: Call again with \`email\` + \`code\`. We verify, create the account on the Free tier (3 projects, EU-hosted, no credit card), generate a sota.io API key, and return it to you.
+
+After Step 2 you'll get back a key like \`sota_…\`. **Save it in a safe place** — you'll need it for any subsequent sota.io tool call in Claude (or you can use it with the sota CLI). It is shown ONCE and never recoverable.
+
+sota.io is an EU-native PaaS hosted in Germany — GDPR-compliant by default, no CLOUD Act exposure. Disposable / throwaway email addresses are not accepted; use a real address.`,
+        inputSchema: {
+            email: z
+                .string()
+                .email()
+                .describe("A real email address. We send the confirmation code here. Throwaway / disposable email services are blocked."),
+            code: z
+                .string()
+                .optional()
+                .describe("The 6-digit code from the confirmation email. Provide on the second call to complete signup. Omit on the first call."),
+        },
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: false,
+            openWorldHint: false,
+        },
+    }, async ({ email, code }) => {
+        const normalizedEmail = email.trim().toLowerCase();
+        // Hard gate: reject disposable-email domains at the tool layer too
+        // (the web /api/auth/check-email runs at sign-up; this one catches
+        // direct-MCP-callers that bypass the web form).
+        if (await isDisposableEmailDomain(normalizedEmail)) {
+            return {
+                isError: true,
+                content: [
+                    {
+                        type: "text",
+                        text: "❌ This email address can't be used. Throwaway / disposable email services are not supported by sota.io. Please retry with a permanent address.",
+                    },
+                ],
+            };
+        }
+        if (!SUPABASE_ANON_KEY || !SUPABASE_SERVICE_ROLE_KEY) {
+            return {
+                isError: true,
+                content: [
+                    {
+                        type: "text",
+                        text: "Server misconfigured: SUPABASE keys are missing. Contact info@sota.io.",
+                    },
+                ],
+            };
+        }
+        // ── Step 1: no code → request OTP ──
+        if (!code) {
+            try {
+                const r = await fetch(`${SUPABASE_URL}/otp`, {
+                    method: "POST",
+                    headers: {
+                        "Content-Type": "application/json",
+                        apikey: SUPABASE_ANON_KEY,
+                        Authorization: `Bearer ${SUPABASE_ANON_KEY}`,
+                    },
+                    body: JSON.stringify({
+                        email: normalizedEmail,
+                        create_user: true,
+                        data: { source: "claude-mcp" },
+                    }),
+                });
+                if (!r.ok) {
+                    const detail = await r.text();
+                    return {
+                        isError: true,
+                        content: [
+                            {
+                                type: "text",
+                                text: `Could not send confirmation code: HTTP ${r.status}. Detail: ${detail.slice(0, 200)}`,
+                            },
+                        ],
+                    };
+                }
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: `✉️ Confirmation code sent to ${normalizedEmail}.\n\nCheck your inbox (and spam folder — subject: "Your sota.io login code") for a 6-digit code. Then call \`create_account\` again with both \`email\` and \`code\` to complete signup.\n\nThe code expires in 10 minutes. If you don't get it, call this tool again with the same email to resend.`,
+                        },
+                    ],
+                };
+            }
+            catch (err) {
+                return {
+                    isError: true,
+                    content: [
+                        {
+                            type: "text",
+                            text: `Network error reaching Supabase: ${err instanceof Error ? err.message : String(err)}`,
+                        },
+                    ],
+                };
+            }
+        }
+        // ── Step 2: code provided → verify + provision ──
+        try {
+            const verifyRes = await fetch(`${SUPABASE_URL}/verify`, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json",
+                    apikey: SUPABASE_ANON_KEY,
+                },
+                body: JSON.stringify({
+                    type: "email",
+                    email: normalizedEmail,
+                    token: code.trim(),
+                }),
+            });
+            if (!verifyRes.ok) {
+                const detail = await verifyRes.text();
+                return {
+                    isError: true,
+                    content: [
+                        {
+                            type: "text",
+                            text: `❌ Code verification failed (HTTP ${verifyRes.status}). The code may have expired, been mistyped, or already been used. Call \`create_account\` again with just the email to get a fresh code.\n\nDetail: ${detail.slice(0, 200)}`,
+                        },
+                    ],
+                };
+            }
+            const session = (await verifyRes.json());
+            if (!session.user?.id || !session.user?.email) {
+                return {
+                    isError: true,
+                    content: [
+                        {
+                            type: "text",
+                            text: "Verification succeeded but Supabase returned no user record. Contact info@sota.io.",
+                        },
+                    ],
+                };
+            }
+            // Provision: user_plans (Free tier) + sota_xxx key tagged source=claude
+            const result = await provisionPlanAndKey(session.user.id);
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: `✅ Account created — welcome to sota.io!\n\n**Your API key (save this — shown once):**\n\`${result.apiKey}\`\n\nYour account:\n- Email: ${session.user.email}\n- User ID: ${session.user.id}\n- Plan: Free (3 projects, EU-hosted, no credit card)\n- Region: Germany (Hetzner Cloud)\n\nNext steps:\n1. **Save the API key** above somewhere safe — it's shown ONCE and never recoverable.\n2. To use sota.io tools in this Claude session, you need to re-install the connector OR pass this key directly. Easiest: log out / log back in to the sota.io connector in Claude (the OAuth flow will now work with your fresh account).\n3. Or use the key with the \`sota\` CLI: \`export SOTA_API_KEY=${result.apiKey}\` then \`sota deploy\`.\n\nDocs: https://sota.io/docs/integrations/claude`,
+                    },
+                ],
+            };
+        }
+        catch (err) {
+            return {
+                isError: true,
+                content: [
+                    {
+                        type: "text",
+                        text: `Provisioning error: ${err instanceof Error ? err.message : String(err)}. Contact info@sota.io with this message.`,
+                    },
+                ],
+            };
+        }
+    });
+}
+//# sourceMappingURL=create-account.js.map

package/dist/tools/create-account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-account.js","sourceRoot":"","sources":["../../src/tools/create-account.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,8BAA8B,CAAC;AAChF,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC;AAC9D,MAAM,yBAAyB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,EAAE,CAAC;AAO9E,MAAM,UAAU,yBAAyB,CAAC,MAAiB;IACzD,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,WAAW,EAAE;;;;;;;gLAO6J;QAC1K,WAAW,EAAE;YACX,KAAK,EAAE,CAAC;iBACL,MAAM,EAAE;iBACR,KAAK,EAAE;iBACP,QAAQ,CACP,8GAA8G,CAC/G;YACH,IAAI,EAAE,CAAC;iBACJ,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,sHAAsH,CACvH;SACJ;QACD,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,KAAK;YACrB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE;QACxB,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAEnD,mEAAmE;QACnE,mEAAmE;QACnE,gDAAgD;QAChD,IAAI,MAAM,uBAAuB,CAAC,eAAe,CAAC,EAAE,CAAC;YACnD,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,gJAAgJ;qBACvJ;iBACF;aACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,iBAAiB,IAAI,CAAC,yBAAyB,EAAE,CAAC;YACrD,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,wEAAwE;qBAC/E;iBACF;aACF,CAAC;QACJ,CAAC;QAED,sCAAsC;QACtC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG,YAAY,MAAM,EAAE;oBAC3C,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE;wBACP,cAAc,EAAE,kBAAkB;wBAClC,MAAM,EAAE,iBAAiB;wBACzB,aAAa,EAAE,UAAU,iBAAiB,EAAE;qBAC7C;oBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,KAAK,EAAE,eAAe;wBACtB,WAAW,EAAE,IAAI;wBACjB,IAAI,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;qBAC/B,CAAC;iBACH,CAAC,CAAC;gBACH,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;oBACV,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;oBAC9B,OAAO;wBACL,OAAO,EAAE,IAAI;wBACb,OAAO,EAAE;4BACP;gCACE,IAAI,EAAE,MAAe;gCACrB,IAAI,EAAE,0CAA0C,CAAC,CAAC,MAAM,aAAa,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;6BAC5F;yBACF;qBACF,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,gCAAgC,eAAe,sSAAsS;yBAC5V;qBACF;iBACF,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,oCAAoC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;yBAC7F;qBACF;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,mDAAmD;QACnD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,GAAG,YAAY,SAAS,EAAE;gBACtD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,MAAM,EAAE,iBAAiB;iBAC1B;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,eAAe;oBACtB,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE;iBACnB,CAAC;aACH,CAAC,CAAC;YACH,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;gBAClB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;gBACtC,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,oCAAoC,SAAS,CAAC,MAAM,wJAAwJ,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;yBACzO;qBACF;iBACF,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CAA4B,CAAC;YACpE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;gBAC9C,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,oFAAoF;yBAC3F;qBACF;iBACF,CAAC;YACJ,CAAC;YAED,wEAAwE;YACxE,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAE1D,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,4FAA4F,MAAM,CAAC,MAAM,iCAAiC,OAAO,CAAC,IAAI,CAAC,KAAK,gBAAgB,OAAO,CAAC,IAAI,CAAC,EAAE,8eAA8e,MAAM,CAAC,MAAM,4EAA4E;qBACzwB;iBACF;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,uBAAuB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,2CAA2C;qBACzH;iBACF;aACF,CAAC;QACJ,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/tools/deploy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAKpE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,QAmEvE"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/tools/deploy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAKpE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,QAoEvE"}

package/dist/tools/deploy.js

@@ -13,13 +13,14 @@ export function registerDeployTool(server, client) {
 
 IMPORTANT: Your app MUST listen on the PORT environment variable. For auto-detected frameworks (Next.js, Node.js, Python) PORT is 8080. For custom Dockerfiles, the port is auto-detected from the EXPOSE directive (e.g. EXPOSE 3000 sets PORT=3000). If no EXPOSE is found, it defaults to 8080.
 
-Every project includes a managed PostgreSQL 17 database. The DATABASE_URL environment variable is auto-injected into your container — no manual database configuration needed. Your app just needs to read DATABASE_URL to connect. If your app needs database migrations, run them on startup.
+Every project includes a managed PostgreSQL 17 database. Six environment variables are auto-injected into your container — no manual database configuration needed: DATABASE_URL (full connection string), PGHOST, PGPORT, PGUSER, PGPASSWORD, and PGDATABASE. Libraries that follow libpq conventions (node-postgres, pgx, psycopg2, Django) pick up the PG* variables automatically with no configuration. If your app needs database migrations, run them on startup.
 
 Deployments use blue-green strategy for zero downtime. The old container keeps running until the new one passes health checks (60s timeout). Use get-logs to monitor build progress. Files matching .gitignore and .sotaignore are excluded from the archive.`,
         inputSchema: {
             project_id: z.string().describe('Project ID (UUID) to deploy to. Use list-projects to find the ID'),
             directory: z.string().optional().describe('Absolute path to the directory to deploy. Defaults to current working directory. Must contain your app source code (package.json, requirements.txt, or Dockerfile)'),
         },
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
     }, async ({ project_id, directory }) => {
         const dir = directory ? resolve(directory) : process.cwd();
         if (!existsSync(dir)) {

package/dist/tools/deploy.js.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.js","sourceRoot":"","sources":["../../src/tools/deploy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAG/B,MAAM,UAAU,kBAAkB,CAAC,MAAiB,EAAE,MAAkB;IACtE,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE;QAC5B,WAAW,EAAE;;;;;;;;;;;8PAW6O;QAC1P,WAAW,EAAE;YACX,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kEAAkE,CAAC;YACnG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oKAAoK,CAAC;SAChN;KACF,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAE3D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,+BAA+B,GAAG,EAAE;qBAC3C;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,mEAAmE;YACnE,MAAM,WAAW,GAAG,oBAAoB,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC;YAC5D,QAAQ,CACN,YAAY,WAAW,wFAAwF,GAAG,IAAI,EACtH,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAC;YAEF,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;YACxD,MAAM,aAAa,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;YAChD,UAAU,CAAC,WAAW,CAAC,CAAC;YAExB,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YAElE,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,8BAA8B,UAAU,CAAC,EAAE,eAAe,UAAU,CAAC,MAAM,YAAY,UAAU,CAAC,GAAG,IAAI,SAAS,2CAA2C;qBACpK;iBACF;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,kBAAkB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;qBACjF;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"deploy.js","sourceRoot":"","sources":["../../src/tools/deploy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAG/B,MAAM,UAAU,kBAAkB,CAAC,MAAiB,EAAE,MAAkB;IACtE,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE;QAC5B,WAAW,EAAE;;;;;;;;;;;8PAW6O;QAC1P,WAAW,EAAE;YACX,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kEAAkE,CAAC;YACnG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oKAAoK,CAAC;SAChN;QACD,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;KACzG,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAE3D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,+BAA+B,GAAG,EAAE;qBAC3C;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,mEAAmE;YACnE,MAAM,WAAW,GAAG,oBAAoB,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC;YAC5D,QAAQ,CACN,YAAY,WAAW,wFAAwF,GAAG,IAAI,EACtH,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAC;YAEF,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;YACxD,MAAM,aAAa,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;YAChD,UAAU,CAAC,WAAW,CAAC,CAAC;YAExB,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YAElE,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,8BAA8B,UAAU,CAAC,EAAE,eAAe,UAAU,CAAC,MAAM,YAAY,UAAU,CAAC,GAAG,IAAI,SAAS,2CAA2C;qBACpK;iBACF;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,kBAAkB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;qBACjF;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/tools/domains.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"domains.d.ts","sourceRoot":"","sources":["../../src/tools/domains.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,QAqHxE"}
+{"version":3,"file":"domains.d.ts","sourceRoot":"","sources":["../../src/tools/domains.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,QAyHxE"}

package/dist/tools/domains.js

@@ -6,6 +6,7 @@ export function registerDomainTools(server, client) {
             project_id: z.string().describe('Project ID (UUID) to add the domain to. Use list-projects to find the ID'),
             domain: z.string().describe('Domain name to add (e.g. "app.example.com" or "example.com")'),
         },
+        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
     }, async ({ project_id, domain }) => {
         try {
             const result = await client.addDomain(project_id, domain);
@@ -32,6 +33,7 @@ export function registerDomainTools(server, client) {
         inputSchema: {
             project_id: z.string().describe('Project ID (UUID) to list domains for. Use list-projects to find the ID'),
         },
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
     }, async ({ project_id }) => {
         try {
             const domains = await client.listDomains(project_id);
@@ -58,6 +60,7 @@ export function registerDomainTools(server, client) {
             project_id: z.string().describe('Project ID (UUID). Use list-projects to find the ID'),
             domain_id: z.string().describe('Domain ID (UUID). Use list-domains to find the ID'),
         },
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
     }, async ({ project_id, domain_id }) => {
         try {
             const result = await client.getDomain(project_id, domain_id);
@@ -90,6 +93,7 @@ export function registerDomainTools(server, client) {
             project_id: z.string().describe('Project ID (UUID). Use list-projects to find the ID'),
             domain_id: z.string().describe('Domain ID (UUID). Use list-domains to find the ID'),
         },
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false },
     }, async ({ project_id, domain_id }) => {
         try {
             await client.removeDomain(project_id, domain_id);

package/dist/tools/domains.js.map

@@ -1 +1 @@
-{"version":3,"file":"domains.js","sourceRoot":"","sources":["../../src/tools/domains.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,UAAU,mBAAmB,CAAC,MAAiB,EAAE,MAAkB;IACvE,MAAM,CAAC,YAAY,CAAC,YAAY,EAAE;QAChC,WAAW,EAAE,ifAAif;QAC9f,WAAW,EAAE;YACX,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0EAA0E,CAAC;YAC3G,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8DAA8D,CAAC;SAC5F;KACF,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE;QAClC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAC1D,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;YACxB,MAAM,GAAG,GAAG,MAAM,CAAC,gBAAgB,CAAC;YAEpC,IAAI,IAAI,GAAG,iBAAiB,CAAC,CAAC,MAAM,WAAW,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,MAAM,EAAE,CAAC;YAE7E,IAAI,GAAG,EAAE,CAAC;gBACR,IAAI,IAAI,2CAA2C,GAAG,CAAC,IAAI,aAAa,GAAG,CAAC,IAAI,cAAc,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC1G,IAAI,IAAI,oHAAoH,CAAC;YAC/H,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,CAAC;aAC3C,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,sBAAsB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBAC1H,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,YAAY,CAAC,cAAc,EAAE;QAClC,WAAW,EAAE,uMAAuM;QACpN,WAAW,EAAE;YACX,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yEAAyE,CAAC;SAC3G;KACF,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;QAC1B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;YAErD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,qDAAqD,EAAE,CAAC;iBAClG,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CACvB,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,cAAc,CAAC,CAAC,MAAM,UAAU,CAAC,CAAC,EAAE,EAAE,CACzD,CAAC;YAEF,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,aAAa,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;aAC5E,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,wBAAwB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBAC5H,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,YAAY,CAAC,YAAY,EAAE;QAChC,WAAW,EAAE,mSAAmS;QAChT,WAAW,EAAE;YACX,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qDAAqD,CAAC;YACtF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mDAAmD,CAAC;SACpF;KACF,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE;QACrC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;YAC7D,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;YACxB,MAAM,GAAG,GAAG,MAAM,CAAC,gBAAgB,CAAC;YAEpC,IAAI,IAAI,GAAG,WAAW,CAAC,CAAC,MAAM,WAAW,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,MAAM,aAAa,CAAC,CAAC,QAAQ,gBAAgB,CAAC,CAAC,UAAU,EAAE,CAAC;YAE1H,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;gBAClB,IAAI,IAAI,iBAAiB,CAAC,CAAC,WAAW,EAAE,CAAC;YAC3C,CAAC;YAED,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;gBACpB,IAAI,IAAI,cAAc,CAAC,CAAC,aAAa,EAAE,CAAC;YAC1C,CAAC;YAED,IAAI,GAAG,EAAE,CAAC;gBACR,IAAI,IAAI,yCAAyC,GAAG,CAAC,IAAI,aAAa,GAAG,CAAC,IAAI,cAAc,GAAG,CAAC,KAAK,EAAE,CAAC;YAC1G,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,CAAC;aAC3C,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,sBAAsB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBAC1H,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,YAAY,CAAC,eAAe,EAAE;QACnC,WAAW,EAAE,+OAA+O;QAC5P,WAAW,EAAE;YACX,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qDAAqD,CAAC;YACtF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mDAAmD,CAAC;SACpF;KACF,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE;QACrC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;YACjD,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,SAAS,wBAAwB,EAAE,CAAC;aACxF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,yBAAyB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBAC7H,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"domains.js","sourceRoot":"","sources":["../../src/tools/domains.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,UAAU,mBAAmB,CAAC,MAAiB,EAAE,MAAkB;IACvE,MAAM,CAAC,YAAY,CAAC,YAAY,EAAE;QAChC,WAAW,EAAE,ifAAif;QAC9f,WAAW,EAAE;YACX,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0EAA0E,CAAC;YAC3G,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8DAA8D,CAAC;SAC5F;QACD,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE;KACzG,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE;QAClC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAC1D,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;YACxB,MAAM,GAAG,GAAG,MAAM,CAAC,gBAAgB,CAAC;YAEpC,IAAI,IAAI,GAAG,iBAAiB,CAAC,CAAC,MAAM,WAAW,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,MAAM,EAAE,CAAC;YAE7E,IAAI,GAAG,EAAE,CAAC;gBACR,IAAI,IAAI,2CAA2C,GAAG,CAAC,IAAI,aAAa,GAAG,CAAC,IAAI,cAAc,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC1G,IAAI,IAAI,oHAAoH,CAAC;YAC/H,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,CAAC;aAC3C,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,sBAAsB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBAC1H,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,YAAY,CAAC,cAAc,EAAE;QAClC,WAAW,EAAE,uMAAuM;QACpN,WAAW,EAAE;YACX,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yEAAyE,CAAC;SAC3G;QACD,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE;KACxG,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;QAC1B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;YAErD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,qDAAqD,EAAE,CAAC;iBAClG,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CACvB,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,cAAc,CAAC,CAAC,MAAM,UAAU,CAAC,CAAC,EAAE,EAAE,CACzD,CAAC;YAEF,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,aAAa,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;aAC5E,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,wBAAwB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBAC5H,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,YAAY,CAAC,YAAY,EAAE;QAChC,WAAW,EAAE,mSAAmS;QAChT,WAAW,EAAE;YACX,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qDAAqD,CAAC;YACtF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mDAAmD,CAAC;SACpF;QACD,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE;KACxG,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE;QACrC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;YAC7D,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;YACxB,MAAM,GAAG,GAAG,MAAM,CAAC,gBAAgB,CAAC;YAEpC,IAAI,IAAI,GAAG,WAAW,CAAC,CAAC,MAAM,WAAW,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,MAAM,aAAa,CAAC,CAAC,QAAQ,gBAAgB,CAAC,CAAC,UAAU,EAAE,CAAC;YAE1H,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;gBAClB,IAAI,IAAI,iBAAiB,CAAC,CAAC,WAAW,EAAE,CAAC;YAC3C,CAAC;YAED,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;gBACpB,IAAI,IAAI,cAAc,CAAC,CAAC,aAAa,EAAE,CAAC;YAC1C,CAAC;YAED,IAAI,GAAG,EAAE,CAAC;gBACR,IAAI,IAAI,yCAAyC,GAAG,CAAC,IAAI,aAAa,GAAG,CAAC,IAAI,cAAc,GAAG,CAAC,KAAK,EAAE,CAAC;YAC1G,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,CAAC;aAC3C,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,sBAAsB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBAC1H,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,YAAY,CAAC,eAAe,EAAE;QACnC,WAAW,EAAE,+OAA+O;QAC5P,WAAW,EAAE;YACX,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qDAAqD,CAAC;YACtF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mDAAmD,CAAC;SACpF;QACD,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE;KACxG,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE;QACrC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;YACjD,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,SAAS,wBAAwB,EAAE,CAAC;aACxF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,yBAAyB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBAC7H,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/tools/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/tools/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,QAwErE"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/tools/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,QA0ErE"}

package/dist/tools/env.js

@@ -1,12 +1,13 @@
 import { z } from 'zod';
 export function registerEnvTools(server, client) {
     server.registerTool('set-env', {
-        description: 'Set an environment variable for a project. Variables are encrypted at rest (AES-256-GCM) and injected at container runtime. NOTE: DATABASE_URL is auto-injected for the managed PostgreSQL database — you do NOT need to set it manually. The PORT variable is auto-managed: 8080 for auto-detected frameworks (Next.js, Node.js, Python), or auto-detected from the Dockerfile EXPOSE directive for custom Dockerfile builds. IMPORTANT: Changing env vars does NOT auto-redeploy. You must call deploy or use the redeploy API endpoint to apply changes. For Next.js apps, NEXT_PUBLIC_* variables must be set BEFORE deploying since they are embedded at build time.',
+        description: 'Set an environment variable for a project. Variables are encrypted at rest (AES-256-GCM) and injected at container runtime. NOTE: DATABASE_URL, PGHOST, PGPORT, PGUSER, PGPASSWORD, and PGDATABASE are all auto-injected for the managed PostgreSQL database — you do NOT need to set any of them manually. The PORT variable is auto-managed: 8080 for auto-detected frameworks (Next.js, Node.js, Python), or auto-detected from the Dockerfile EXPOSE directive for custom Dockerfile builds. IMPORTANT: Changing env vars does NOT auto-redeploy. You must call deploy or use the redeploy API endpoint to apply changes. For Next.js apps, NEXT_PUBLIC_* variables must be set BEFORE deploying since they are embedded at build time.',
         inputSchema: {
             project_id: z.string().describe('Project ID (UUID)'),
             key: z.string().describe('Environment variable name (e.g., STRIPE_KEY, REDIS_URL, API_SECRET). Do NOT set DATABASE_URL — it is auto-managed'),
             value: z.string().describe('Environment variable value. Will be encrypted at rest'),
         },
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false },
     }, async ({ project_id, key, value }) => {
         try {
             await client.setEnvVar(project_id, { key, value });
@@ -32,10 +33,11 @@ export function registerEnvTools(server, client) {
         }
     });
     server.registerTool('get-env', {
-        description: 'List environment variables for a project. Values are masked for security. Auto-injected variables (DATABASE_URL, PORT) may not appear in this list but are always available in the container at runtime.',
+        description: 'List environment variables for a project. Values are masked for security. Auto-injected variables (DATABASE_URL, PGHOST, PGPORT, PGUSER, PGPASSWORD, PGDATABASE, PORT) may not appear in this list but are always available in the container at runtime.',
         inputSchema: {
             project_id: z.string().describe('Project ID (UUID)'),
         },
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
     }, async ({ project_id }) => {
         try {
             const envVars = await client.listEnvVars(project_id);

package/dist/tools/env.js.map

@@ -1 +1 @@
-{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/tools/env.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,UAAU,gBAAgB,CAAC,MAAiB,EAAE,MAAkB;IACpE,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE;QAC7B,WAAW,EAAE,2oBAA2oB;QACxpB,WAAW,EAAE;YACX,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YACpD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mHAAmH,CAAC;YAC7I,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uDAAuD,CAAC;SACpF;KACF,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE;QACtC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YACnD,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,wBAAwB,GAAG,oBAAoB;qBACtD;iBACF;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,0BAA0B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;qBACzF;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE;QAC7B,WAAW,EAAE,0MAA0M;QACvN,WAAW,EAAE;YACX,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC;SACrD;KACF,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;QAC1B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;YACrD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,+BAA+B;yBACtC;qBACF;iBACF,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,IAAI,MAAM,EAAE,CAAC,CAAC;YACrE,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,2BAA2B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;qBACpD;iBACF;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,4BAA4B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;qBAC3F;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/tools/env.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,UAAU,gBAAgB,CAAC,MAAiB,EAAE,MAAkB;IACpE,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE;QAC7B,WAAW,EAAE,6sBAA6sB;QAC1tB,WAAW,EAAE;YACX,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YACpD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mHAAmH,CAAC;YAC7I,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uDAAuD,CAAC;SACpF;QACD,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE;KACxG,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE;QACtC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YACnD,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,wBAAwB,GAAG,oBAAoB;qBACtD;iBACF;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,0BAA0B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;qBACzF;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE;QAC7B,WAAW,EAAE,0PAA0P;QACvQ,WAAW,EAAE;YACX,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC;SACrD;QACD,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE;KACxG,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;QAC1B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;YACrD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,+BAA+B;yBACtC;qBACF;iBACF,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,IAAI,MAAM,EAAE,CAAC,CAAC;YACrE,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,2BAA2B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;qBACpD;iBACF;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,4BAA4B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;qBAC3F;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/tools/logs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logs.d.ts","sourceRoot":"","sources":["../../src/tools/logs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,QAiDrE"}
+{"version":3,"file":"logs.d.ts","sourceRoot":"","sources":["../../src/tools/logs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,QAkDrE"}