@taiga-ai/mcp-server 0.2.3-dev.255 → 0.2.3-dev.256

package/dist/index.js

@@ -1,67 +1,723 @@
 #!/usr/bin/env node
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import { TaigaClient } from './client.js';
-import { registerAllTools } from './tools/index.js';
-const DEFAULT_API_URL = 'https://api.taiga.app';
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+//#region ../../packages/feature-flags/dist/index.js
+/**
+* Feature flags shared across web, api, mcp-server, and the documentation site.
+*
+* {@link featureFlagDefinitions} is the single source of truth for WHICH flags
+* exist, HOW each one resolves per environment, and what it is for; the
+* {@link FeatureFlags} type is derived from it. Every app calls
+* {@link resolveFeatureFlags} with its own environment identifier so a feature
+* is shown or hidden consistently everywhere from one rule set:
+*   - web: `resolveFeatureFlags(config.VITE_APP_ENV)` (baked at build time)
+*   - api: a fail-safe wrapper (`apps/api/src/shared/config/feature-flags.ts`)
+*     that resolves `ENVIRONMENT` and defaults to `prod` for any unrecognized
+*     value when deployed, so a WIP feature is never leaked
+*   - docs: `apps/docs/src/content.config.ts` resolves flags for the
+*     environment being built and DROPS pages carrying `flag: <name>` where
+*     that flag is off, so docs.tai.ga never describes a feature customers
+*     cannot see (PRO-1033)
+*
+* Flags are boot-time constants — no remote source. Changing a rule here
+* re-derives the flag everywhere.
+*
+* ## Adding a flag
+*
+* One entry in {@link featureFlagDefinitions}: its `availability`, a one-line
+* `description` for the web dev panel, and the full account of what it gates
+* and why as the JSDoc above the entry. If the flag is OFF in prod, two more
+* things follow, and the first will stop you:
+*
+* 1. **`make docs-check-claims` fails until the flag is registered** in
+*    `FLAG_PHRASES` (`apps/docs/scripts/check-claims.py`). That is deliberate:
+*    the check used to iterate its own dict, so an unregistered flag was never
+*    examined and a page could describe an invisible feature. Register the
+*    words a page would use for the feature, or `[]` if it has a page of its
+*    own that declares the flag.
+* 2. **A page for the feature can be written now**, carrying `flag: <name>` in
+*    its frontmatter. It is published on dev and staging and excluded from
+*    prod, and it publishes by itself when the flag graduates — no docs change.
+*    See the `flag:` section in `apps/docs/AGENTS.md`, which also covers the
+*    one constraint: nothing published may link to a flagged page.
+*/
+/**
+* THE registry: one entry per flag. Adding a flag is adding an entry here;
+* {@link FeatureFlags} and {@link resolveFeatureFlags} derive from it.
+*/
+const featureFlagDefinitions = Object.freeze({
+	/**
+	* Skills feature. When `false` the feature is fully dormant:
+	*   - web: nav groups, dashboard governance row, and skills routes are hidden
+	*   - api: the `/v1/agent-skills*` endpoints are not registered
+	*   - mcp: the skill tools, their instruction mentions, and the
+	*     `getProjectContext` skills summary are omitted
+	*   - agent runtime: no skills are injected into agent prompts
+	*   - seeding: no default skills are created for new tenants/teams/projects
+	*
+	* Hidden for now (not needed in the product yet; may return later).
+	*/
+	skills: {
+		description: "Agent skills: the skills routes and pages, the MCP skill tools, and skills injected into agent prompts. Hidden in every environment for now.",
+		availability: "nowhere"
+	},
+	/**
+	* Insights surface (Learn loop) — production feedback and customer signals
+	* feeding the next iteration.
+	*
+	* Release toggle: ON in local/dev/staging, OFF in prod. Surfaces the
+	* scaffold page in lower environments only while the feature is designed.
+	* **Remove this flag (and its gates) at GA.**
+	*/
+	insights: {
+		description: "Insights section of the Learn loop: production feedback and customer signals feeding the next iteration.",
+		availability: "non-prod"
+	},
+	/**
+	* UI Sparring (PRO-630) — AI-generated UI concepts for the CUSTOMER's app,
+	* rendered client-side in a sandboxed iframe styled with the tenant's
+	* design_standards tokens. When `false` the feature is fully dormant:
+	*   - web: the concept gallery, the Studio and the `/dev/ui-artifact-test`
+	*     route are not registered
+	*   - api: the `/v1/projects/:projectId/ui-artifacts/*` endpoints are not
+	*     registered
+	*
+	* The flow surface moved out from under this flag in PRO-1029 — see
+	* {@link FeatureFlags.flowStudio}.
+	*
+	* Release toggle: ON in local/dev/staging, OFF in prod while the feature is
+	* built out (foundation slice → workshop → binding).
+	* **Remove this flag (and its gates) at GA.**
+	*/
+	uiSparring: {
+		description: "UI Sparring: AI-generated UI concepts for the customer's application, the concept gallery and the UI Studio, with their API endpoints.",
+		availability: "non-prod"
+	},
+	/**
+	* User Flow Studio (PRO-1029) — the conversational surface for the
+	* `user_flow` document: talk the flows into shape, the ux-planning agent
+	* drafts and revises them, every agreed change lands in the document.
+	*
+	* Split out of {@link FeatureFlags.uiSparring} because working out user flows
+	* is Discovery work that stands on its own: it happens before anyone asks
+	* what a screen looks like, and it is useful to a customer who never opens
+	* the UI Studio. Sharing one flag meant flows could not ship without shipping
+	* concept generation and the sparring chat with them.
+	*
+	* Gates the web surface only — the route and the Edit control on the user
+	* flows document. The streaming endpoint (`POST
+	* /v1/conversations/:id/workshop-stream`) is deliberately NOT gated: it
+	* carries a conversation, the same as the spec-chat route beside it, and
+	* hiding a page is not a reason to make an authenticated, capability-checked
+	* endpoint conditional.
+	*
+	* Release toggle: ON in local/dev/staging, OFF in prod until the surface has
+	* proven itself there. **Remove this flag (and its gates) at GA.**
+	*/
+	flowStudio: {
+		description: "User Flow Studio: the conversational surface where the ux-planning agent drafts and revises the user flows document.",
+		availability: "non-prod"
+	},
+	/**
+	* Customer-definable check-and-stamp checklists (PRO-946..948, design
+	* PRO-933). When `false` the feature is fully dormant:
+	*   - api: the `/v1/checklist-*` endpoints are not registered
+	*   - api: no checklist instances are created on project creation (PR 2/3)
+	*   - web: no discovery-pipeline checklist step, no org-settings editor
+	*
+	* Release toggle: ON in local/dev/staging, OFF in prod while the three
+	* slices (schema/API → gate + project surface → template editor) land.
+	* **Remove this flag (and its gates) at GA.**
+	*/
+	checklists: {
+		description: "Customer-defined check-and-stamp checklists: the discovery pipeline step, the organization settings editor and their API endpoints.",
+		availability: "non-prod"
+	},
+	/**
+	* Factory v2 engineer pod (PRO-1313..1315, PRO-1331). Two roles:
+	*   - the admin-only `/v1/engineer/*` endpoints that trigger the EC2-backed
+	*     Runtime Instances probe runtime (when `false` the routes are not
+	*     registered, so nothing in the product can reach that runtime);
+	*   - the environment kill-switch for agent-runtime routing (PRO-1331): with
+	*     it on, a tenant holding a live `engineer_runtime` entitlement has its
+	*     initiative planning jobs and build runs routed to the engineer runtime
+	*     (fail-closed until the run contract lands, PRO-1333); with it off,
+	*     every tenant stays on the legacy agents whatever the entitlement rows
+	*     say.
+	* OFF in prod until the real engineer pod ships behind its own, separate
+	* rollout decision.
+	*/
+	engineerPod: {
+		description: "Factory v2 engineer pod: the admin-only /v1/engineer probe endpoints, and the kill-switch for routing engineer_runtime-entitled tenants to the engineer runtime (dev/staging only).",
+		availability: "non-prod"
+	},
+	/**
+	* Questionnaire filling (PRO-932) — a customer uploads their own requirement
+	* spreadsheet, Taiga answers what the project's evidence supports with
+	* `document@version` citations, a human attests, and the answers are written
+	* back into that same workbook. ASTORI's THL Liite 4 is the first named
+	* preset, not a modelled regulation.
+	*
+	* When `false` the feature is fully dormant:
+	*   - api: the `/v1/questionnaires*` and `/v1/projects/:id/questionnaires`
+	*     endpoints are not registered
+	*
+	* Release toggle: ON in local/dev/staging, OFF in prod while the slices
+	* (import → fill → attest + export) land.
+	* **Remove this flag (and its gates) at GA.**
+	*/
+	questionnaires: {
+		description: "Questionnaire filling: answer an uploaded requirement spreadsheet from project evidence with citations, attest, and write the answers back.",
+		availability: "non-prod"
+	},
+	/**
+	* UI Studio Wizard (PRO-1030) — the guided three-choice route through the UI
+	* decisions, for the person finishing Discovery who does not want a
+	* workbench. When `false` the feature is fully dormant:
+	*   - web: the `/ui-wizard` route is not registered, and Discovery's UI
+	*     Studio card offers only the studio itself
+	*
+	* Split out of {@link FeatureFlags.uiSparring} rather than riding it, for the
+	* reason {@link FeatureFlags.flowStudio} was: the wizard and the studio are
+	* two front doors onto the same concepts, and they will not graduate on the
+	* same day. Everything the wizard reaches is gated on `uiSparring` server-side
+	* (the concept job's own assembler throws without it), so every gate on this
+	* flag ANDs the two — a wizard released alone would offer a button that 500s.
+	*
+	* Release toggle: ON in local/dev/staging, OFF in prod.
+	* **Remove this flag (and its gates) at GA.**
+	*/
+	uiStudioWizard: {
+		description: "UI Studio Wizard: the guided three-choice route through the UI decisions. Only works when uiSparring is also on, including on the API.",
+		availability: "non-prod"
+	},
+	/**
+	* Design-system emitter (PRO-887): materialise an organisation's INTERNAL
+	* Design Standards into `src/styles/design-tokens.css` + `DESIGN.md` in the
+	* generated application at build bootstrap. Never active for a tenant with a
+	* linked design-system repository (that repo is the source of truth).
+	*
+	* Release toggle: ON in local/dev/staging, OFF in prod until the first
+	* internal-DS build has been verified end to end.
+	*/
+	designEmitter: {
+		description: "Design-system emitter: writes an organization's internal design standards into design-tokens.css and DESIGN.md in the generated application at build bootstrap.",
+		availability: "non-prod"
+	}
+});
+/** Every flag name, in registry order. */
+const featureFlagNames = Object.keys(featureFlagDefinitions);
+/**
+* Resolve the full flag set for an environment from the registry. Frozen so a
+* resolved set cannot be mutated at runtime — changing a flag is a source edit
+* in {@link featureFlagDefinitions}, not an assignment in an app.
+*/
+function resolveFeatureFlags(env) {
+	const isOn = (availability) => availability === "everywhere" || availability === "non-prod" && env !== "prod";
+	const resolved = {};
+	for (const name of featureFlagNames) resolved[name] = isOn(featureFlagDefinitions[name].availability);
+	return Object.freeze(resolved);
+}
+/**
+* Safe-default snapshot, resolved as `prod`: every still-gated release toggle
+* is off. Prefer
+* {@link resolveFeatureFlags} with the app's real environment. Retained for
+* consumers that have no environment of their own — notably the published MCP
+* server — so an unconfigured runtime never leaks a work-in-progress feature.
+*/
+const featureFlags = resolveFeatureFlags("prod");
+//#endregion
+//#region src/client.ts
+/**
+* HTTP client for the Taiga API.
+* Used by the MCP server to proxy tool calls to the backend.
+*/
+var TaigaClient = class {
+	baseUrl;
+	apiKey;
+	introspection = null;
+	constructor(opts) {
+		this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
+		this.apiKey = opts.apiKey;
+	}
+	async request(method, path, body) {
+		const url = `${this.baseUrl}/v1${path}`;
+		const headers = {
+			Authorization: `Bearer ${this.apiKey}`,
+			"Content-Type": "application/json",
+			"User-Agent": "taiga-ai-mcp-server/0.0.1"
+		};
+		const response = await fetch(url, {
+			method,
+			headers,
+			body: body ? JSON.stringify(body) : void 0
+		});
+		if (!response.ok) {
+			const text = await response.text().catch(() => "");
+			throw new Error(`Taiga API ${method} ${path} failed (${response.status}): ${text}`);
+		}
+		return response.json();
+	}
+	async introspect() {
+		const result = await this.request("GET", "/auth/introspect");
+		this.introspection = result.data;
+		return result.data;
+	}
+	getIntrospection() {
+		return this.introspection;
+	}
+	hasCapability(capability) {
+		if (!this.introspection) return false;
+		return this.introspection.capabilities.includes(capability);
+	}
+	async listProjects(opts) {
+		const params = new URLSearchParams();
+		if (opts?.teamId) params.set("teamId", opts.teamId);
+		if (opts?.status) params.set("status", opts.status);
+		if (opts?.limit) params.set("limit", String(opts.limit));
+		const qs = params.toString();
+		return this.request("GET", `/projects${qs ? `?${qs}` : ""}`);
+	}
+	async getProject(id) {
+		return this.request("GET", `/projects/${id}`);
+	}
+	async listTenantDocuments(opts) {
+		const params = new URLSearchParams();
+		if (opts?.limit) params.set("limit", String(opts.limit));
+		const qs = params.toString();
+		return this.request("GET", `/tenants/current/documents${qs ? `?${qs}` : ""}`);
+	}
+	async getTenantDocument(type) {
+		return this.request("GET", `/tenants/current/documents/${type}`);
+	}
+	async saveTenantDocumentDraft(type, body) {
+		return this.request("PUT", `/tenants/current/documents/${type}/draft`, body);
+	}
+	async listTeamDocuments(teamId, opts) {
+		const params = new URLSearchParams();
+		if (opts?.limit) params.set("limit", String(opts.limit));
+		const qs = params.toString();
+		return this.request("GET", `/teams/${teamId}/documents${qs ? `?${qs}` : ""}`);
+	}
+	async getTeamDocument(teamId, type) {
+		return this.request("GET", `/teams/${teamId}/documents/${type}`);
+	}
+	async saveTeamDocumentDraft(teamId, type, body) {
+		return this.request("PUT", `/teams/${teamId}/documents/${type}/draft`, body);
+	}
+	async listProjectDocuments(projectId, opts) {
+		const params = new URLSearchParams();
+		if (opts?.limit) params.set("limit", String(opts.limit));
+		const qs = params.toString();
+		return this.request("GET", `/projects/${projectId}/documents${qs ? `?${qs}` : ""}`);
+	}
+	async getProjectDocument(projectId, type) {
+		return this.request("GET", `/projects/${projectId}/documents/${type}`);
+	}
+	async listSkills(opts) {
+		const params = new URLSearchParams();
+		if (opts?.scope) params.set("scope", opts.scope);
+		if (opts?.scopeId) params.set("scopeId", opts.scopeId);
+		if (opts?.limit) params.set("limit", String(opts.limit));
+		const qs = params.toString();
+		return this.request("GET", `/agent-skills${qs ? `?${qs}` : ""}`);
+	}
+	async getSkill(id) {
+		return this.request("GET", `/agent-skills/${id}`);
+	}
+	async updateSkill(id, body) {
+		return this.request("PATCH", `/agent-skills/${id}`, body);
+	}
+	/**
+	* Fetch the full context for a project in parallel: project metadata,
+	* team documents, project documents, and team skills.
+	* Returns a structured bundle optimized for coding agent consumption.
+	*/
+	async getProjectContext(projectId) {
+		const project = await this.request("GET", `/projects/${projectId}`);
+		const teamId = project.data.teamId;
+		const [projectDocs, teamDocs, skills] = await Promise.all([
+			this.listProjectDocuments(projectId, { limit: 20 }).catch(() => ({ data: [] })),
+			teamId ? this.listTeamDocuments(teamId, { limit: 20 }).catch(() => ({ data: [] })) : Promise.resolve({ data: [] }),
+			featureFlags.skills ? this.listSkills({ limit: 100 }).catch(() => ({ data: [] })) : Promise.resolve({ data: [] })
+		]);
+		const keyProjectDocTypes = [
+			"specification",
+			"architecture",
+			"technology_decisions"
+		];
+		const keyTeamDocTypes = [
+			"domain_context",
+			"tech_preferences",
+			"architecture_constraints"
+		];
+		const docFetches = [];
+		for (const docType of keyProjectDocTypes) if (projectDocs.data.some((d) => d.type === docType && !d.isDraft)) docFetches.push(this.getProjectDocument(projectId, docType).then((r) => ({
+			type: docType,
+			scope: "project",
+			data: r.data
+		})).catch(() => ({
+			type: docType,
+			scope: "project",
+			data: null
+		})));
+		if (teamId) {
+			for (const docType of keyTeamDocTypes) if (teamDocs.data.some((d) => d.type === docType && !d.isDraft)) docFetches.push(this.getTeamDocument(teamId, docType).then((r) => ({
+				type: docType,
+				scope: "team",
+				data: r.data
+			})).catch(() => ({
+				type: docType,
+				scope: "team",
+				data: null
+			})));
+		}
+		const fetchedDocs = await Promise.all(docFetches);
+		const context = {
+			project: project.data,
+			documents: {
+				project: Object.fromEntries(fetchedDocs.filter((d) => d.scope === "project" && d.data).map((d) => [d.type, d.data])),
+				team: Object.fromEntries(fetchedDocs.filter((d) => d.scope === "team" && d.data).map((d) => [d.type, d.data]))
+			},
+			available_documents: {
+				project: projectDocs.data.map((d) => ({
+					type: d.type,
+					name: d.name,
+					version: d.version,
+					isDraft: d.isDraft
+				})),
+				team: teamDocs.data.map((d) => ({
+					type: d.type,
+					name: d.name,
+					version: d.version,
+					isDraft: d.isDraft
+				}))
+			}
+		};
+		if (featureFlags.skills) context.skills_summary = skills.data.filter((s) => !s.teamId || s.teamId === teamId).map((s) => ({
+			id: s.id,
+			name: s.name,
+			slug: s.slug,
+			description: s.description
+		}));
+		return context;
+	}
+	async listBacklogItems(projectId, opts) {
+		const params = new URLSearchParams();
+		if (opts?.limit) params.set("limit", String(opts.limit));
+		const qs = params.toString();
+		return this.request("GET", `/projects/${projectId}/backlog${qs ? `?${qs}` : ""}`);
+	}
+	async getBacklogItem(itemId) {
+		return this.request("GET", `/backlog/${itemId}`);
+	}
+	async listEnvironments(projectId) {
+		return this.request("GET", `/projects/${projectId}/environments`);
+	}
+	async listTeams(opts) {
+		const params = new URLSearchParams();
+		if (opts?.limit) params.set("limit", String(opts.limit));
+		const qs = params.toString();
+		return this.request("GET", `/teams${qs ? `?${qs}` : ""}`);
+	}
+};
+//#endregion
+//#region src/tools/summarize.ts
+/**
+* Strip heavy content from list responses to avoid context window bloat.
+*
+* List endpoints return summaries (id, name, description, metadata).
+* Get endpoints return the full content.
+*
+* This keeps list calls cheap (~100 tokens per item) and lets the AI
+* selectively load full content only for the items it needs.
+*/
+/** Fields to strip from list responses -- these contain the bulk content. */
+const HEAVY_FIELDS = [
+	"content",
+	"data",
+	"sections"
+];
+/**
+* Remove heavy content fields from each item in an array.
+* Preserves all metadata (id, name, description, type, dates, etc).
+*/
+function summarizeList(items) {
+	return items.map((item) => {
+		const summary = { ...item };
+		for (const field of HEAVY_FIELDS) if (field in summary) delete summary[field];
+		return summary;
+	});
+}
+//#endregion
+//#region src/tools/projects.ts
+function registerProjectTools(server, client) {
+	if (client.hasCapability("teams:read")) server.tool("taiga_list_teams", "List all teams in the organization. Use this to find team IDs for reading team documents, skills, and understanding team structure. Teams own domain context, tech preferences, and architecture constraints.", { limit: z.number().min(1).max(100).optional().describe("Max results (default 25)") }, {
+		readOnlyHint: true,
+		openWorldHint: false
+	}, async (params) => {
+		const result = await client.listTeams(params);
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result.data, null, 2)
+		}] };
+	});
+	if (client.hasCapability("projects:read")) {
+		server.tool("taiga_list_projects", "List projects in the organization. Use this to find the project you are working on so you can read its specification, architecture, and threat model. Can filter by team; a status filter also exists but no longer distinguishes anything (see its description).", {
+			teamId: z.string().uuid().optional().describe("Filter by team ID -- get team IDs from taiga_list_teams"),
+			status: z.enum([
+				"draft",
+				"active",
+				"archived"
+			]).optional().describe("Filter by status. Taiga no longer surfaces project status in its UI (PRO-543), so every project is currently \"draft\" and filtering by \"active\" or \"archived\" returns nothing. Omit this unless you are working with data set through the API directly."),
+			limit: z.number().min(1).max(100).optional().describe("Max results (default 25)")
+		}, {
+			readOnlyHint: true,
+			openWorldHint: false
+		}, async (params) => {
+			const result = await client.listProjects(params);
+			return { content: [{
+				type: "text",
+				text: JSON.stringify(result.data, null, 2)
+			}] };
+		});
+		server.tool("taiga_list_project_documents", "List documents for a specific project (names and types only). Project documents are generated during intake: specification (requirements), architecture (system design), technology decisions, data flow, privacy assessment, threat model (security risks), risk register, and user flow. Use taiga_get_project_document to read the full content.", {
+			projectId: z.string().uuid().describe("Project ID -- get from taiga_list_projects"),
+			limit: z.number().min(1).max(100).optional().describe("Max results (default 25)")
+		}, {
+			readOnlyHint: true,
+			openWorldHint: false
+		}, async (params) => {
+			const summaries = summarizeList((await client.listProjectDocuments(params.projectId, { limit: params.limit })).data);
+			return { content: [{
+				type: "text",
+				text: JSON.stringify(summaries, null, 2)
+			}] };
+		});
+		server.tool("taiga_get_project_document", "Get the full content of a specific project document. Use this when you need to understand what to build (specification), how the system is designed (architecture), what security risks exist (threat model), or what technology choices were made (technology_decisions). Types: specification, architecture, technology_decisions, data_flow, privacy_assessment, threat_model, risk_register, user_flow.", {
+			projectId: z.string().uuid().describe("Project ID -- get from taiga_list_projects"),
+			type: z.string().describe("Document type -- get available types from taiga_list_project_documents. Common: specification, architecture, threat_model, technology_decisions")
+		}, {
+			readOnlyHint: true,
+			openWorldHint: false
+		}, async (params) => {
+			const result = await client.getProjectDocument(params.projectId, params.type);
+			return { content: [{
+				type: "text",
+				text: JSON.stringify(result.data, null, 2)
+			}] };
+		});
+	}
+}
+//#endregion
+//#region src/tools/documents.ts
+function registerDocumentTools(server, client) {
+	if (client.hasCapability("tenant:documents:read")) {
+		server.tool("taiga_list_documents", "List company-level policy documents (names and types only). Policies define security, data privacy, SDLC, operations, architecture, and compliance rules that apply across all teams and projects. Use taiga_get_document with the document type to read the full policy content.", { limit: z.number().min(1).max(100).optional().describe("Max results (default 25)") }, {
+			readOnlyHint: true,
+			openWorldHint: false
+		}, async (params) => {
+			const summaries = summarizeList((await client.listTenantDocuments(params)).data);
+			return { content: [{
+				type: "text",
+				text: JSON.stringify(summaries, null, 2)
+			}] };
+		});
+		server.tool("taiga_get_document", "Get the full content of a company policy document. Use this when you need to understand security requirements, data handling rules, architecture standards, or compliance controls that apply to your code. Types: policy_security, policy_data, policy_sdlc, policy_ops, policy_tic, policy_risk, policy_architecture, policy_supply_chain, policy_cloud_governance, policy_acceptable_use, policy_ip.", { type: z.string().describe("Document type -- get available types from taiga_list_documents. Common: policy_security, policy_data, policy_sdlc, policy_architecture") }, {
+			readOnlyHint: true,
+			openWorldHint: false
+		}, async (params) => {
+			const result = await client.getTenantDocument(params.type);
+			return { content: [{
+				type: "text",
+				text: JSON.stringify(result.data, null, 2)
+			}] };
+		});
+	}
+	if (client.hasCapability("tenant:documents:write")) server.tool("taiga_update_document", "Update the draft content of a company policy document. Only updates the draft -- does not publish. Use this when you notice a policy is outdated or needs corrections while reviewing code.", {
+		type: z.string().describe("Document type (e.g. policy_security, policy_sdlc)"),
+		data: z.record(z.string(), z.unknown()).describe("Document content to save as JSON")
+	}, {
+		readOnlyHint: false,
+		destructiveHint: false,
+		idempotentHint: true,
+		openWorldHint: false
+	}, async (params) => {
+		const { type, ...body } = params;
+		const result = await client.saveTenantDocumentDraft(type, body);
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result.data, null, 2)
+		}] };
+	});
+	if (client.hasCapability("teams:read")) {
+		server.tool("taiga_list_team_documents", "List documents for a specific team (names and types only). Team documents define how the team works: domain context (entities, ubiquitous language), tech preferences (approved stack), architecture constraints, SLO targets, definition of done, and team charter. Use taiga_get_team_document to read the full content.", {
+			teamId: z.string().uuid().describe("Team ID -- get from taiga_list_teams"),
+			limit: z.number().min(1).max(100).optional().describe("Max results (default 25)")
+		}, {
+			readOnlyHint: true,
+			openWorldHint: false
+		}, async (params) => {
+			const summaries = summarizeList((await client.listTeamDocuments(params.teamId, { limit: params.limit })).data);
+			return { content: [{
+				type: "text",
+				text: JSON.stringify(summaries, null, 2)
+			}] };
+		});
+		server.tool("taiga_get_team_document", "Get the full content of a specific team document. Use this when you need the team domain context (ubiquitous language, entities, business rules), tech preferences (approved stack, patterns), or architecture constraints. Types: team_charter, definition_of_done, tech_preferences, architecture_constraints, slo_targets, domain_context.", {
+			teamId: z.string().uuid().describe("Team ID -- get from taiga_list_teams"),
+			type: z.string().describe("Document type -- get available types from taiga_list_team_documents. Most useful: domain_context (entities, language), tech_preferences (stack, patterns)")
+		}, {
+			readOnlyHint: true,
+			openWorldHint: false
+		}, async (params) => {
+			const result = await client.getTeamDocument(params.teamId, params.type);
+			return { content: [{
+				type: "text",
+				text: JSON.stringify(result.data, null, 2)
+			}] };
+		});
+	}
+	if (client.hasCapability("teams:read") && client.hasCapability("tenant:documents:write")) server.tool("taiga_update_team_document", "Update the draft content of a team document. Only updates the draft -- does not publish. Use this when you notice team conventions, domain context, or tech preferences need updating while working on the codebase.", {
+		teamId: z.string().uuid().describe("Team ID -- get from taiga_list_teams"),
+		type: z.string().describe("Document type (e.g. domain_context, tech_preferences)"),
+		data: z.record(z.string(), z.unknown()).describe("Document content to save as JSON")
+	}, {
+		readOnlyHint: false,
+		destructiveHint: false,
+		idempotentHint: true,
+		openWorldHint: false
+	}, async (params) => {
+		const { teamId, type, ...body } = params;
+		const result = await client.saveTeamDocumentDraft(teamId, type, body);
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result.data, null, 2)
+		}] };
+	});
+}
+//#endregion
+//#region src/tools/skills.ts
+function registerSkillTools(server, client) {
+	if (client.hasCapability("tenant:documents:read")) {
+		server.tool("taiga_list_skills", "List agent skills available in the organization (names and descriptions only). Skills are reusable knowledge modules that guide coding: coding standards, security requirements, architecture patterns, database conventions, etc. Use taiga_get_skill with the skill ID to read the full content.", { limit: z.number().min(1).max(100).optional().describe("Max results (default 25)") }, {
+			readOnlyHint: true,
+			openWorldHint: false
+		}, async (params) => {
+			const summaries = summarizeList((await client.listSkills(params)).data);
+			return { content: [{
+				type: "text",
+				text: JSON.stringify(summaries, null, 2)
+			}] };
+		});
+		server.tool("taiga_get_skill", "Get the full content of a specific agent skill. Use this when you need detailed coding guidelines, patterns, or conventions for a specific topic (e.g., security requirements, API design, testing strategy). Returns the complete markdown content with code examples and best practices.", { id: z.string().uuid().describe("Skill ID -- get from taiga_list_skills") }, {
+			readOnlyHint: true,
+			openWorldHint: false
+		}, async (params) => {
+			const result = await client.getSkill(params.id);
+			return { content: [{
+				type: "text",
+				text: JSON.stringify(result.data, null, 2)
+			}] };
+		});
+	}
+	if (client.hasCapability("tenant:documents:write")) server.tool("taiga_update_skill", "Update an agent skill (coding standards, patterns, conventions). Use this when you notice a skill is outdated, incomplete, or needs corrections while working on the codebase. Changes are saved immediately.", {
+		id: z.string().uuid().describe("Skill ID -- get from taiga_list_skills"),
+		name: z.string().optional().describe("Updated skill name"),
+		description: z.string().optional().describe("Updated skill description"),
+		content: z.string().optional().describe("Updated skill content (markdown)")
+	}, {
+		readOnlyHint: false,
+		destructiveHint: false,
+		idempotentHint: true,
+		openWorldHint: false
+	}, async (params) => {
+		const { id, ...body } = params;
+		const result = await client.updateSkill(id, body);
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result.data, null, 2)
+		}] };
+	});
+}
+//#endregion
+//#region src/tools/index.ts
+/**
+* Register all MCP tools based on the API key's effective capabilities.
+* Only tools matching the key's scopes are registered -- the AI assistant
+* never sees tools it can't use.
+*
+* Beta scope: Knowledge base access (policies, skills, team documents).
+* Post-beta: Projects, backlog items, environments, composite tools.
+*/
+function registerAllTools(server, client) {
+	registerProjectTools(server, client);
+	registerDocumentTools(server, client);
+	if (featureFlags.skills) registerSkillTools(server, client);
+}
+//#endregion
+//#region src/index.ts
+const DEFAULT_API_URL = "https://api.taiga.app";
 async function main() {
-    const apiKey = process.env.TAIGA_API_KEY;
-    if (!apiKey) {
-        console.error('Error: TAIGA_API_KEY environment variable is required.');
-        console.error('Create an API key at https://app.taiga.app/settings/api-keys');
-        process.exit(1);
-    }
-    const apiUrl = process.env.TAIGA_API_URL ?? DEFAULT_API_URL;
-    const client = new TaigaClient({ baseUrl: apiUrl, apiKey });
-    // Introspect the API key to discover available capabilities
-    const introspection = await client.introspect().catch((error) => {
-        const message = error instanceof Error ? error.message : String(error);
-        console.error(`Error: Failed to validate API key: ${message}`);
-        console.error('Check that your TAIGA_API_KEY is valid and not expired.');
-        process.exit(1);
-    });
-    // Create MCP server with dynamic tool registration and instructions
-    const server = new McpServer({
-        name: 'taiga',
-        version: '0.0.1',
-    }, {
-        instructions: [
-            'You have access to Taiga -- a policy-aware software development platform.',
-            "Taiga provides your organization's engineering knowledge base:",
-            '',
-            '**Company policies** (taiga_list_documents / taiga_get_document):',
-            'Security, data privacy, SDLC, architecture, and compliance rules that apply to all code.',
-            'Read the relevant policy BEFORE writing code that touches security, data handling, or infrastructure.',
-            '',
-            '**Team documents** (taiga_list_team_documents / taiga_get_team_document):',
-            'Domain context (ubiquitous language, entities, business rules), tech preferences (approved stack, patterns),',
-            'architecture constraints, and SLO targets. Read these to understand HOW this team builds software.',
-            '',
-            '**Project documents** (taiga_list_project_documents / taiga_get_project_document):',
-            "Specification (what to build), architecture (how it's designed), threat model (security risks),",
-            'technology decisions, and data flow. Read these to understand the specific project context.',
-            '',
-            '**Skills** (taiga_list_skills / taiga_get_skill):',
-            'Coding standards, security requirements, API design patterns, testing strategy, database patterns,',
-            'and more. These are detailed engineering guidelines with code examples.',
-            '',
-            "Workflow: Start with taiga_list_teams to find your team, then read the team's domain_context",
-            'and tech_preferences. For project-specific work, use taiga_list_projects to find the project,',
-            'then read its specification and architecture. Use skills for coding patterns.',
-            '',
-            'When you notice a policy, skill, or team document is outdated, use the update tools',
-            '(taiga_update_document, taiga_update_skill, taiga_update_team_document) to fix it.',
-            'This keeps the knowledge base accurate for everyone.',
-        ].join('\n'),
-    });
-    registerAllTools(server, client);
-    const toolCount = introspection.capabilities.length;
-    console.error(`Taiga MCP server started (${toolCount} capabilities, user: ${introspection.email}, role: ${introspection.role})`);
-    // Connect via stdio transport
-    const transport = new StdioServerTransport();
-    await server.connect(transport);
+	const apiKey = process.env.TAIGA_API_KEY;
+	if (!apiKey) {
+		console.error("Error: TAIGA_API_KEY environment variable is required.");
+		console.error("Create an API key at https://app.taiga.app/settings/api-keys");
+		process.exit(1);
+	}
+	const client = new TaigaClient({
+		baseUrl: process.env.TAIGA_API_URL ?? DEFAULT_API_URL,
+		apiKey
+	});
+	const introspection = await client.introspect().catch((error) => {
+		const message = error instanceof Error ? error.message : String(error);
+		console.error(`Error: Failed to validate API key: ${message}`);
+		console.error("Check that your TAIGA_API_KEY is valid and not expired.");
+		process.exit(1);
+	});
+	const server = new McpServer({
+		name: "taiga",
+		version: "0.0.1"
+	}, { instructions: [
+		"You have access to Taiga -- a policy-aware software development platform.",
+		"Taiga provides your organization's engineering knowledge base:",
+		"",
+		"**Company policies** (taiga_list_documents / taiga_get_document):",
+		"Security, data privacy, SDLC, architecture, and compliance rules that apply to all code.",
+		"Read the relevant policy BEFORE writing code that touches security, data handling, or infrastructure.",
+		"",
+		"**Team documents** (taiga_list_team_documents / taiga_get_team_document):",
+		"Domain context (ubiquitous language, entities, business rules), tech preferences (approved stack, patterns),",
+		"architecture constraints, and SLO targets. Read these to understand HOW this team builds software.",
+		"",
+		"**Project documents** (taiga_list_project_documents / taiga_get_project_document):",
+		"Specification (what to build), architecture (how it's designed), threat model (security risks),",
+		"technology decisions, and data flow. Read these to understand the specific project context.",
+		"",
+		...featureFlags.skills ? [
+			"**Skills** (taiga_list_skills / taiga_get_skill):",
+			"Coding standards, security requirements, API design patterns, testing strategy, database patterns,",
+			"and more. These are detailed engineering guidelines with code examples.",
+			""
+		] : [],
+		"Workflow: Start with taiga_list_teams to find your team, then read the team's domain_context",
+		"and tech_preferences. For project-specific work, use taiga_list_projects to find the project,",
+		featureFlags.skills ? "then read its specification and architecture. Use skills for coding patterns." : "then read its specification and architecture.",
+		"",
+		featureFlags.skills ? "When you notice a policy, skill, or team document is outdated, use the update tools" : "When you notice a policy or team document is outdated, use the update tools",
+		featureFlags.skills ? "(taiga_update_document, taiga_update_skill, taiga_update_team_document) to fix it." : "(taiga_update_document, taiga_update_team_document) to fix it.",
+		"This keeps the knowledge base accurate for everyone."
+	].join("\n") });
+	registerAllTools(server, client);
+	const toolCount = introspection.capabilities.length;
+	console.error(`Taiga MCP server started (${toolCount} capabilities, user: ${introspection.email}, role: ${introspection.role})`);
+	const transport = new StdioServerTransport();
+	await server.connect(transport);
 }
 main().catch((error) => {
-    console.error('Fatal error:', error);
-    process.exit(1);
+	console.error("Fatal error:", error);
+	process.exit(1);
 });
+//#endregion
+export {};