@thehammer/danx-dashboard-mcp 0.1.1

package/README.md

@@ -0,0 +1,43 @@
+# @thehammer/danx-dashboard-mcp
+
+Stdio MCP server wrapping danxbot's dashboard `/api/v2/issues/*` normalized DB-backed HTTP routes. Replaces the legacy "agents Edit/Write `.yml` files directly" pattern from before DX-704 / DX-811.
+
+Each tool is a thin envelope over one HTTP route — Zod-validated at the MCP boundary, fetch under the hood, server response passed back to the agent verbatim. Refusal envelopes (`{error, ...extra}` with `failed_gate`, `non_terminal_phases`, `offending_keys`, etc.) come through as `{ok: false, status, body}` so the agent can pick the right next action without guessing. 5xx and network failures throw.
+
+## Env vars (required, fail-loud at boot)
+
+| Var | Purpose |
+|---|---|
+| `DANXBOT_DASHBOARD_URL` | Dashboard base, e.g. `http://danxbot-dashboard:5555` (inside compose) or `http://localhost:5555` (host) |
+| `DANXBOT_DISPATCH_TOKEN` | Per-dispatch bearer — server validates via `requireUser`/dispatch-token checks |
+| `DANX_REPO_NAME` | Repo scope appended as `?repo=<name>` to every URL |
+
+## Tool surface
+
+All exposed as `mcp__danx_dashboard__<name>` once wired through the workspace `.mcp.json`.
+
+| Tool | HTTP | Notes |
+|---|---|---|
+| `issue_list` | `GET /api/v2/issues` | filters: `type`, `parent_id` (null → root-only), `dispatchable_derived`, `assigned_agent`, `include_closed`, `limit`, `offset` |
+| `issue_get` | `GET /api/v2/issues/:id` | Returns hydrated card + ancestor chain |
+| `issue_create` | `POST /api/v2/issues` | Epic REQUIRES non-empty `phase_children[]` (atomic insert) |
+| `issue_edit` | `PATCH /api/v2/issues/:id/edit` | Prose-only — semantic keys refused with 400 + pointer to dedicated handler |
+| `issue_transition` | `POST /api/v2/issues/:id/transition` | Actions: ready, pickup, rollback_pickup, complete, cancel, block, unblock, archive, reopen |
+| `issue_triage` | `POST /api/v2/issues/:id/triage` | Verdicts: approve, cancel, keep, defer (with optional ICE + ttl_seconds) |
+| `issue_comment` | `POST/PATCH/DELETE /api/v2/issues/:id/comments[/:cid]` | Author server-stamped, soft-delete preserved |
+| `issue_dependency` | `POST/DELETE /api/v2/issues/:id/dependencies[/:did]` | `depends_on` cycle-checked; remove hardcodes `reason: "recorded_in_error"` |
+| `issue_requires_human` | `POST/DELETE /api/v2/issues/:id/requires-human` | Set replaces step rows atomically; clear soft-deletes them |
+| `issue_retro` | `PUT /api/v2/issues/:id/retro` | Requires terminal card; replace semantics |
+
+## Build + test
+
+```bash
+cd packages/danx-dashboard-mcp
+npm install
+npm test
+npm run build   # → dist/index.js (executable)
+```
+
+## Publishing
+
+Out of scope for this package's own code — the `make publish-danx-dashboard-mcp` target in the danxbot root Makefile owns version bump + `npm publish` + propagation wait. Standing operator authorization per `~/.claude/skills/thehammer-publish/`.

package/dist/handlers.js

@@ -0,0 +1,177 @@
+export async function issueList(client, args) {
+    // status_derived is display-only on the server but the route accepts
+    // it as a projection filter — passthrough verbatim. parent_id=null is
+    // the legitimate "root cards only" filter; the server reader treats
+    // the literal string "null" identically.
+    const query = {};
+    if (args.type !== undefined)
+        query.type = args.type;
+    if (args.parent_id !== undefined) {
+        query.parent_id = args.parent_id === null ? "null" : args.parent_id;
+    }
+    if (args.dispatchable_derived !== undefined) {
+        query.dispatchable_derived = args.dispatchable_derived;
+    }
+    if (args.assigned_agent !== undefined)
+        query.assigned_agent = args.assigned_agent;
+    if (args.include_closed !== undefined)
+        query.include_closed = args.include_closed;
+    if (args.status_derived !== undefined)
+        query.status_derived = args.status_derived;
+    if (args.limit !== undefined)
+        query.limit = args.limit;
+    if (args.offset !== undefined)
+        query.offset = args.offset;
+    return client.request({ method: "GET", path: "", query });
+}
+// ---------------- issue_get ----------------
+export async function issueGet(client, args) {
+    return client.request({ method: "GET", path: `/${encodeURIComponent(args.id)}` });
+}
+export async function issueCreate(client, args, repo) {
+    // `repo` lives in BOTH the query string (via http-client) AND the
+    // body (server requires it inside the JSON envelope per
+    // `write/create.ts::validate`). Sending only one fails-loud — the
+    // duplication is intentional.
+    const body = {
+        repo,
+        type: args.type,
+        title: args.title,
+        description: args.description,
+    };
+    if (args.parent_id !== undefined)
+        body.parent_id = args.parent_id;
+    if (args.ac !== undefined)
+        body.ac = args.ac;
+    if (args.effort_level !== undefined)
+        body.effort_level = args.effort_level;
+    if (args.phase_children !== undefined)
+        body.phase_children = args.phase_children;
+    return client.request({ method: "POST", path: "", body });
+}
+export async function issueEdit(client, args) {
+    const { id, ...rest } = args;
+    // Strip undefined so we don't send `{title: undefined}` — JSON.stringify
+    // drops them anyway but explicit is clearer.
+    const body = {};
+    for (const [k, v] of Object.entries(rest)) {
+        if (v !== undefined)
+            body[k] = v;
+    }
+    return client.request({
+        method: "PATCH",
+        path: `/${encodeURIComponent(id)}/edit`,
+        body,
+    });
+}
+export async function issueTransition(client, args) {
+    const { id, ...body } = args;
+    return client.request({
+        method: "POST",
+        path: `/${encodeURIComponent(id)}/transition`,
+        body,
+    });
+}
+export async function issueTriage(client, args) {
+    const { id, ...body } = args;
+    return client.request({
+        method: "POST",
+        path: `/${encodeURIComponent(id)}/triage`,
+        body,
+    });
+}
+export async function issueComment(client, args) {
+    const idEnc = encodeURIComponent(args.id);
+    if (args.action === "add") {
+        if (typeof args.text !== "string") {
+            throw new Error("issue_comment action=add requires text");
+        }
+        return client.request({
+            method: "POST",
+            path: `/${idEnc}/comments`,
+            body: { text: args.text },
+        });
+    }
+    if (args.action === "edit") {
+        if (args.comment_id === undefined) {
+            throw new Error("issue_comment action=edit requires comment_id");
+        }
+        if (typeof args.text !== "string") {
+            throw new Error("issue_comment action=edit requires text");
+        }
+        return client.request({
+            method: "PATCH",
+            path: `/${idEnc}/comments/${args.comment_id}`,
+            body: { text: args.text },
+        });
+    }
+    // delete
+    if (args.comment_id === undefined) {
+        throw new Error("issue_comment action=delete requires comment_id");
+    }
+    return client.request({
+        method: "DELETE",
+        path: `/${idEnc}/comments/${args.comment_id}`,
+    });
+}
+export async function issueDependency(client, args) {
+    const idEnc = encodeURIComponent(args.id);
+    if (args.action === "add") {
+        if (args.kind === undefined) {
+            throw new Error("issue_dependency action=add requires kind");
+        }
+        if (args.target_id === undefined) {
+            throw new Error("issue_dependency action=add requires target_id");
+        }
+        return client.request({
+            method: "POST",
+            path: `/${idEnc}/dependencies`,
+            body: {
+                kind: args.kind,
+                target_id: args.target_id,
+                reason: args.reason ?? "",
+            },
+        });
+    }
+    // remove
+    if (args.dependency_id === undefined) {
+        throw new Error("issue_dependency action=remove requires dependency_id");
+    }
+    return client.request({
+        method: "DELETE",
+        path: `/${idEnc}/dependencies/${args.dependency_id}`,
+        // Server demands literal "recorded_in_error" — any other value is
+        // a 400. The MCP boundary hardcodes it to remove a footgun: an
+        // agent that types the wrong reason gets a refusal here at MCP
+        // arg-validation, not a confusing 400 envelope.
+        body: { reason: "recorded_in_error" },
+    });
+}
+export async function issueRequiresHuman(client, args) {
+    const idEnc = encodeURIComponent(args.id);
+    if (args.set) {
+        if (typeof args.reason !== "string") {
+            throw new Error("issue_requires_human set=true requires reason");
+        }
+        if (!Array.isArray(args.steps)) {
+            throw new Error("issue_requires_human set=true requires steps[]");
+        }
+        return client.request({
+            method: "POST",
+            path: `/${idEnc}/requires-human`,
+            body: { reason: args.reason, steps: args.steps },
+        });
+    }
+    return client.request({
+        method: "DELETE",
+        path: `/${idEnc}/requires-human`,
+    });
+}
+export async function issueRetro(client, args) {
+    const { id, ...body } = args;
+    return client.request({
+        method: "PUT",
+        path: `/${encodeURIComponent(id)}/retro`,
+        body,
+    });
+}

package/dist/http-client.js

@@ -0,0 +1,71 @@
+export class DashboardHttpClient {
+    config;
+    fetchImpl;
+    constructor(config, fetchImpl = fetch) {
+        this.config = config;
+        this.fetchImpl = fetchImpl;
+    }
+    async request(args) {
+        const url = this.buildUrl(args.path, args.query);
+        const headers = {
+            Authorization: `Bearer ${this.config.token}`,
+            Accept: "application/json",
+        };
+        let bodyString;
+        if (args.body !== undefined) {
+            headers["Content-Type"] = "application/json";
+            bodyString = JSON.stringify(args.body);
+        }
+        let res;
+        try {
+            res = await this.fetchImpl(url, {
+                method: args.method,
+                headers,
+                body: bodyString,
+            });
+        }
+        catch (err) {
+            throw new Error(`[danx-dashboard-mcp] network failure on ${args.method} ${url}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        const text = await res.text();
+        let parsed = null;
+        if (text !== "") {
+            try {
+                parsed = JSON.parse(text);
+            }
+            catch {
+                // Non-JSON response from a v2 route is a server-side fault —
+                // throw rather than fabricate an envelope.
+                throw new Error(`[danx-dashboard-mcp] non-JSON response (status ${res.status}) from ${args.method} ${url}: ${text.slice(0, 200)}`);
+            }
+        }
+        if (res.status >= 500) {
+            throw new Error(`[danx-dashboard-mcp] server error ${res.status} on ${args.method} ${url}: ${text.slice(0, 500)}`);
+        }
+        if (res.status >= 200 && res.status < 300) {
+            return { ok: true, status: res.status, body: parsed };
+        }
+        return { ok: false, status: res.status, body: parsed };
+    }
+    buildUrl(path, extraQuery) {
+        const base = this.config.baseUrl.replace(/\/+$/, "");
+        const [rawPath, existingQs] = path.split("?", 2);
+        let cleanPath;
+        if (rawPath === "" || rawPath === "/") {
+            cleanPath = "";
+        }
+        else {
+            cleanPath = rawPath.startsWith("/") ? rawPath : `/${rawPath}`;
+        }
+        const params = new URLSearchParams(existingQs ?? "");
+        params.set("repo", this.config.repo);
+        if (extraQuery) {
+            for (const [k, v] of Object.entries(extraQuery)) {
+                if (v === undefined || v === null)
+                    continue;
+                params.set(k, String(v));
+            }
+        }
+        return `${base}/api/v2/issues${cleanPath}?${params.toString()}`;
+    }
+}

package/dist/index.js

@@ -0,0 +1,203 @@
+#!/usr/bin/env node
+/**
+ * @thehammer/danx-dashboard-mcp
+ *
+ * Stdio MCP server wrapping danxbot's dashboard `/api/v2/issues/*`
+ * normalized DB-backed HTTP routes (DX-704 Phase 2 / DX-811). Replaces
+ * the legacy "agents Edit/Write YAML files directly" pattern: every
+ * tool here POSTs/GETs against the dashboard, which atomically applies
+ * the change via the v2 transactional layer and publishes SSE.
+ *
+ * Tool surface (all exposed as `mcp__danx_dashboard__<name>` once wired
+ * through the workspace `.mcp.json`):
+ *
+ *   - issue_list             GET    /api/v2/issues
+ *   - issue_get              GET    /api/v2/issues/:id
+ *   - issue_create           POST   /api/v2/issues
+ *   - issue_edit             PATCH  /api/v2/issues/:id/edit
+ *   - issue_transition       POST   /api/v2/issues/:id/transition
+ *   - issue_triage           POST   /api/v2/issues/:id/triage
+ *   - issue_comment          POST/PATCH/DELETE /api/v2/issues/:id/comments[/:cid]
+ *   - issue_dependency       POST/DELETE /api/v2/issues/:id/dependencies[/:did]
+ *   - issue_requires_human   POST/DELETE /api/v2/issues/:id/requires-human
+ *   - issue_retro            PUT    /api/v2/issues/:id/retro
+ *
+ * Env at boot (validated fail-loud — missing → process.exit(1)):
+ *   DANXBOT_DASHBOARD_URL   dashboard base (e.g. http://danxbot-dashboard:5555)
+ *   DANXBOT_DISPATCH_TOKEN  per-dispatch bearer
+ *   DANX_REPO_NAME          repo scope, appended as ?repo=<name> on every call
+ *
+ * Envelope contract: every tool returns the dashboard's response body
+ * verbatim wrapped as `{ok, status, body}`. Refusals (4xx with the v2
+ * `{error, ...extra}` shape) come through as `{ok: false, ...}`; the
+ * agent reads `body.error` + structured fields to decide next action.
+ * 5xx and network failures throw — never silently swallowed.
+ */
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+import { DashboardHttpClient } from "./http-client.js";
+import { issueComment, issueCreate, issueDependency, issueEdit, issueGet, issueList, issueRequiresHuman, issueRetro, issueTransition, issueTriage, } from "./handlers.js";
+function readEnvOrDie(name) {
+    const v = process.env[name];
+    if (typeof v !== "string" || v === "") {
+        console.error(`[danx-dashboard-mcp] required env var ${name} is missing or empty`);
+        process.exit(1);
+    }
+    return v;
+}
+const config = {
+    baseUrl: readEnvOrDie("DANXBOT_DASHBOARD_URL"),
+    token: readEnvOrDie("DANXBOT_DISPATCH_TOKEN"),
+    repo: readEnvOrDie("DANX_REPO_NAME"),
+};
+const client = new DashboardHttpClient(config);
+const server = new McpServer({
+    name: "danx-dashboard-mcp",
+    version: "0.1.0",
+});
+function jsonResult(value) {
+    return {
+        content: [{ type: "text", text: JSON.stringify(value, null, 2) }],
+    };
+}
+// Effort + verdict + action tuples kept in lockstep with the v2 write
+// handlers. Drift surfaces at runtime as a server 400 — not silently
+// wrong data — but pinning them here gets the failure caught at the
+// MCP boundary before the round-trip.
+const EFFORT_VALUES = [
+    "min",
+    "very_low",
+    "low",
+    "medium",
+    "high",
+    "very_high",
+    "max",
+];
+const ISSUE_TYPES = ["Epic", "Bug", "Feature", "Chore"];
+const NON_EPIC_TYPES = ["Bug", "Feature", "Chore"];
+const TRANSITION_ACTIONS = [
+    "ready",
+    "pickup",
+    "rollback_pickup",
+    "complete",
+    "cancel",
+    "block",
+    "unblock",
+    "archive",
+    "reopen",
+];
+const TRIAGE_VERDICTS = ["approve", "cancel", "keep", "defer"];
+// ---------------- issue_list ----------------
+server.tool("issue_list", "List issues for the current repo via GET /api/v2/issues. Filters: type, parent_id (string id, null for root-only), dispatchable_derived (boolean — server-computed pickup-ready gate), assigned_agent, include_closed (default false — excludes completed_at/cancelled_at). Response body shape: {issues: IssueV2[]}. Server-side numeric-suffix ordering so DX-10 follows DX-9. Use this instead of grepping .danxbot/issues/ — the DB-backed route is the source of truth post-DX-704.", {
+    status_derived: z.string().optional(),
+    type: z.enum(ISSUE_TYPES).optional(),
+    parent_id: z.string().nullable().optional(),
+    dispatchable_derived: z.boolean().optional(),
+    assigned_agent: z.string().optional(),
+    include_closed: z.boolean().optional(),
+    limit: z.number().int().positive().max(1000).optional(),
+    offset: z.number().int().nonnegative().optional(),
+}, async (args) => jsonResult(await issueList(client, args)));
+// ---------------- issue_get ----------------
+server.tool("issue_get", "Fetch a single hydrated issue via GET /api/v2/issues/:id. Returns the full card (every joined child collection: ac, comments, dependencies, requires_human steps, retro action items + commits, triage history) plus the ancestor chain walked via parent_id. 404 envelope on unknown id.", {
+    id: z.string().min(1),
+}, async ({ id }) => jsonResult(await issueGet(client, { id })));
+// ---------------- issue_create ----------------
+server.tool("issue_create", "Create a fresh card via POST /api/v2/issues. INVARIANT: type=Epic REQUIRES non-empty phase_children[] (epic-with-phases atomicity per DX-575) and the route atomically inserts the epic + every phase in ONE transaction. Non-Epic types REFUSE phase_children[] with 400. Status defaults to Review (no lifecycle timestamps stamped on create). parent_id optional. ac items take {title}; phase children inherit the new epic's id as parent_id.", {
+    type: z.enum(ISSUE_TYPES),
+    title: z.string().min(1),
+    description: z.string(),
+    parent_id: z.string().nullable().optional(),
+    ac: z.array(z.object({ title: z.string().min(1) })).optional(),
+    effort_level: z.enum(EFFORT_VALUES).nullable().optional(),
+    phase_children: z
+        .array(z.object({
+        type: z.enum(NON_EPIC_TYPES),
+        title: z.string().min(1),
+        description: z.string(),
+        ac: z.array(z.object({ title: z.string().min(1) })).optional(),
+        effort_level: z.enum(EFFORT_VALUES).nullable().optional(),
+    }))
+        .optional(),
+}, async (args) => jsonResult(await issueCreate(client, args, config.repo)));
+// ---------------- issue_edit ----------------
+server.tool("issue_edit", "Patch prose fields only via PATCH /api/v2/issues/:id/edit. ALLOWED keys: title, description, ac, effort_level, parent_id. ANY OTHER KEY (lifecycle timestamps, triage state, dependencies, retro, requires_human, blocked/dispatch gates) returns 400 with offending_keys[] and a pointer to the dedicated semantic handler — use issue_transition / issue_triage / issue_comment / issue_dependency / issue_requires_human / issue_retro instead. AC replacement is wholesale soft-delete + reinsert with fresh ordinals; check_item_id linkage survives via title match.", {
+    id: z.string().min(1),
+    title: z.string().min(1).optional(),
+    description: z.string().optional(),
+    ac: z
+        .array(z.object({
+        title: z.string(),
+        checked: z.boolean().optional(),
+    }))
+        .optional(),
+    effort_level: z.enum(EFFORT_VALUES).nullable().optional(),
+    parent_id: z.string().nullable().optional(),
+}, async (args) => jsonResult(await issueEdit(client, args)));
+// ---------------- issue_transition ----------------
+server.tool("issue_transition", "Stamp a lifecycle transition via POST /api/v2/issues/:id/transition. Actions: ready (Review→ToDo), pickup (ToDo→In Progress — server checks every dispatch gate: ready_at, blocked_at, requires_human_reason, depends_on partners terminal, conflict_on partners idle; refuses 409 with failed_gate naming the cause), rollback_pickup, complete (REFUSES 409 on Epic if any phase child non-terminal — see non_terminal_phases[]), cancel, block (requires non-empty reason — sets blocked_at + clears dispatch), unblock, archive (parks to Backlog, clears ready_at), reopen (terminal→active, clears completed_at/cancelled_at/archived_at). Terminal cards refuse every action except reopen. Ladder timestamps preserved — forward stamps never clear earlier ones (CLAUDE.md Core Principle 2).", {
+    id: z.string().min(1),
+    action: z.enum(TRANSITION_ACTIONS),
+    reason: z.string().optional(),
+    summary: z.string().optional(),
+    dispatch_id: z.string().min(1).optional(),
+}, async (args) => jsonResult(await issueTransition(client, args)));
+// ---------------- issue_triage ----------------
+server.tool("issue_triage", "Record a triage verdict via POST /api/v2/issues/:id/triage. Verdicts: approve (stamps ready_at — moves to ToDo, clears triage TTL), cancel (stamps cancelled_at — terminal), keep (refreshes triage_expires_at by ttl_seconds — defaults 7 days, card stays at Review), defer (stamps archived_at, clears ready_at — parks to Backlog). ICE components optional but recorded when present (total = i+c+e). Reason is REQUIRED non-empty. REFUSES 409 on terminal cards.", {
+    id: z.string().min(1),
+    verdict: z.enum(TRIAGE_VERDICTS),
+    reason: z.string().min(1),
+    ice: z
+        .object({
+        i: z.number().finite(),
+        c: z.number().finite(),
+        e: z.number().finite(),
+    })
+        .optional(),
+    ttl_seconds: z.number().positive().optional(),
+}, async (args) => jsonResult(await issueTriage(client, args)));
+// ---------------- issue_comment ----------------
+server.tool("issue_comment", "Comment CRUD via /api/v2/issues/:id/comments[/:cid]. action=add → POST {text} (server stamps author from bearer + auto-incrementing ordinal); action=edit → PATCH /:cid {text}; action=delete → DELETE /:cid (soft-delete, audit trail preserved — comments are NEVER hard-deleted). Client-supplied author is IGNORED (server-stamped to prevent impersonation).", {
+    id: z.string().min(1),
+    action: z.enum(["add", "edit", "delete"]),
+    comment_id: z.number().int().positive().optional(),
+    text: z.string().min(1).optional(),
+}, async (args) => jsonResult(await issueComment(client, args)));
+// ---------------- issue_dependency ----------------
+server.tool("issue_dependency", "Dependency CRUD via /api/v2/issues/:id/dependencies[/:did]. action=add → POST {kind, target_id, reason} where kind ∈ {depends_on, conflict_on}. depends_on adds are CYCLE-CHECKED (BFS from target back to source — 409 if loop). Idempotent: re-adding a live triple returns the existing id. Self-loops refuse 409. action=remove → DELETE /:did. The server REQUIRES the literal reason=\"recorded_in_error\" on removal (encodes \"removal means NOT related, never satisfied\") — this MCP boundary hardcodes it, so callers do not pass reason on remove.", {
+    id: z.string().min(1),
+    action: z.enum(["add", "remove"]),
+    kind: z.enum(["depends_on", "conflict_on"]).optional(),
+    target_id: z.string().min(1).optional(),
+    reason: z.string().optional(),
+    dependency_id: z.number().int().positive().optional(),
+}, async (args) => jsonResult(await issueDependency(client, args)));
+// ---------------- issue_requires_human ----------------
+server.tool("issue_requires_human", "Set or clear the requires_human dispatch gate via /api/v2/issues/:id/requires-human. set=true → POST {reason, steps[]} — sets requires_human_reason (the dispatch gate per DX-704 — poller refuses pickup while non-null), set_by from bearer, set_at NOW(), REPLACES the step rows (prior soft-deleted, fresh ordinals). set=false → DELETE — clears the columns and soft-deletes every live step. Terminal cards refuse 409 on set.", {
+    id: z.string().min(1),
+    set: z.boolean(),
+    reason: z.string().optional(),
+    steps: z.array(z.string().min(1)).optional(),
+}, async (args) => jsonResult(await issueRequiresHuman(client, args)));
+// ---------------- issue_retro ----------------
+server.tool("issue_retro", "Replace the retro block via PUT /api/v2/issues/:id/retro. Body: {good, bad, action_item_ids[], commits[]}. REFUSES 409 unless the card is terminal (completed_at OR cancelled_at) — retro ships when work concludes. Replace semantics: good/bad upsert; action_item_ids[] + commits[] soft-delete prior live rows and insert with fresh ordinals. action_item_ids[] entries MUST match <PREFIX>-N. commits[] entries take {sha, subject?}.", {
+    id: z.string().min(1),
+    good: z.string(),
+    bad: z.string(),
+    action_item_ids: z.array(z.string()),
+    commits: z.array(z.object({
+        sha: z.string().min(1),
+        subject: z.string().optional(),
+    })),
+}, async (args) => jsonResult(await issueRetro(client, args)));
+// ---------------- main ----------------
+async function main() {
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    console.error(`danx-dashboard-mcp running on stdio (dashboard=${config.baseUrl}, repo=${config.repo})`);
+}
+main().catch((err) => {
+    console.error(`[danx-dashboard-mcp] fatal: ${err.message}`);
+    process.exit(1);
+});

package/dist/types.js

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "@thehammer/danx-dashboard-mcp",
+  "version": "0.1.1",
+  "description": "Stdio MCP server wrapping danxbot's dashboard /api/v2/issues/* normalized DB-backed HTTP routes for dispatched agents (DX-704 Phase 2).",
+  "license": "MIT",
+  "type": "module",
+  "main": "dist/index.js",
+  "bin": {
+    "danx-dashboard-mcp": "dist/index.js"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/newms87/danxbot.git",
+    "directory": "packages/danx-dashboard-mcp"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json && node -e \"require('fs').chmodSync('dist/index.js', 0o755)\"",
+    "start": "node dist/index.js",
+    "dev": "tsx src/index.ts",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.12.1",
+    "zod": "^3.25.76"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "tsx": "^4.0.0",
+    "typescript": "^5.7.0",
+    "vitest": "^4.1.5"
+  }
+}