@tickernelz/paperclip-pro-shared 2026.1011.3 → 2026.1012.0

package/dist/ai-provider-routing.js

@@ -0,0 +1,125 @@
+import { z } from "zod";
+/** Value-free routing stored on the connection, never supplied by an agent binding. */
+export const aiProviderRoutingSchema = z
+    .object({
+    kind: z.enum(["openrouter", "bedrock", "gateway", "local"]),
+    protocol: z.enum(["responses", "messages", "chat", "bedrock"]),
+    baseUrl: z.string().trim().max(2048).optional(),
+    auth: z
+        .enum(["bearer", "api_key", "none"])
+        .default("bearer"),
+    region: z
+        .string()
+        .regex(/^[a-z]{2}(?:-[a-z]+)+-\d$/)
+        .optional(),
+    models: z
+        .array(z
+        .object({
+        id: z.string().trim().min(1).max(256),
+        label: z.string().trim().max(160).optional(),
+    })
+        .strict())
+        .max(200)
+        .default([]),
+})
+    .strict()
+    .superRefine((route, ctx) => {
+    const invalid = (message) => ctx.addIssue({ code: "custom", message });
+    if (route.kind === "bedrock") {
+        if (route.protocol !== "bedrock" ||
+            !route.region ||
+            route.auth !== "bearer" ||
+            route.baseUrl)
+            invalid("Bedrock requires a region and a Bedrock API key.");
+    }
+    else if (route.protocol === "bedrock" ||
+        route.region)
+        invalid("AWS settings require Bedrock.");
+    if (route.kind === "openrouter" &&
+        (route.baseUrl || route.auth !== "bearer"))
+        invalid("OpenRouter uses its official endpoint and an API key.");
+    if (route.auth === "api_key" && route.protocol !== "messages")
+        invalid("API-key header authentication requires Anthropic Messages.");
+    if (route.kind === "gateway" || route.kind === "local") {
+        try {
+            const url = new URL(route.baseUrl ?? "");
+            const loopback = ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+            if (url.username ||
+                url.password ||
+                url.search ||
+                url.hash ||
+                (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)))
+                throw new Error();
+            if (route.kind === "local" && !loopback)
+                invalid("A local endpoint must use localhost or a loopback address.");
+        }
+        catch {
+            invalid("Enter an HTTPS base URL without credentials, query parameters, or a fragment. Local endpoints may use HTTP.");
+        }
+    }
+});
+export function aiRoutingHarness(adapter, provider, acpxAgent) {
+    if (adapter !== "paperclip_runner")
+        return adapter;
+    const runner = provider === "acpx" && (acpxAgent === "claude" || acpxAgent === "grok")
+        ? acpxAgent
+        : provider;
+    return ({
+        claude: "claude_local",
+        codex: "codex_local",
+        opencode: "opencode_local",
+        grok: "grok_local",
+    }[String(runner)] ?? "unsupported");
+}
+export function isAiRoutingCompatible(route, harness) {
+    if (route.kind === "bedrock")
+        return harness === "claude_local";
+    if (route.kind === "openrouter")
+        return [
+            "claude_local",
+            "codex_local",
+            "opencode_local",
+            "hermes_local",
+        ].includes(harness);
+    if (route.protocol === "responses")
+        return harness === "codex_local";
+    if (route.protocol === "messages")
+        return harness === "claude_local";
+    return ["opencode_local", "hermes_local"].includes(harness);
+}
+export function aiRoutingBaseUrl(route, harness) {
+    return route.kind === "openrouter"
+        ? `https://openrouter.ai/api${harness === "claude_local" ? "" : "/v1"}`
+        : (route.baseUrl ?? "").replace(/\/+$/, "");
+}
+/** OpenCode names models with a provider prefix; other harnesses use the raw ID. */
+export function aiRoutingModel(route, harness, model) {
+    if (!model || harness !== "opencode_local")
+        return model;
+    const prefix = route.kind === "openrouter" ? "openrouter" : "paperclip";
+    return model.startsWith(`${prefix}/`) ? model : `${prefix}/${model}`;
+}
+/** Catalog identity is derived from routing, including accounts saved before these rows existed. */
+export function aiConnectionCatalogSlug(provider, routing) {
+    if (routing?.kind === "gateway") {
+        return routing.protocol === "messages" ? "messages-api"
+            : routing.protocol === "chat" ? "chat-completions-api" : "responses-api";
+    }
+    return routing?.kind ?? provider;
+}
+/** Direct catalog setup presets; legacy gateway links still open their existing setup. */
+export function aiProviderSetupPreset(source) {
+    switch (source) {
+        case "responses-api": return { provider: "gateway", protocol: "responses", label: "Responses API" };
+        case "messages-api": return { provider: "gateway", protocol: "messages", label: "Messages API" };
+        case "chat-completions-api": return { provider: "gateway", protocol: "chat", label: "Chat Completions API" };
+        case "google-ai": return { provider: "google" };
+        case "google":
+        case "openrouter":
+        case "bedrock":
+        case "gateway":
+        case "local": return { provider: source };
+        default: return undefined;
+    }
+}
+//# sourceMappingURL=ai-provider-routing.js.map

package/dist/ai-provider-routing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-provider-routing.js","sourceRoot":"","sources":["../src/ai-provider-routing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,uFAAuF;AACvF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC3D,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IAC9D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC/C,IAAI,EAAE,CAAC;SACJ,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;SACnC,OAAO,CAAC,QAAQ,CAAC;IACpB,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,KAAK,CAAC,2BAA2B,CAAC;SAClC,QAAQ,EAAE;IACb,MAAM,EAAE,CAAC;SACN,KAAK,CACJ,CAAC;SACE,MAAM,CAAC;QACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QACrC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;KAC7C,CAAC;SACD,MAAM,EAAE,CACZ;SACA,GAAG,CAAC,GAAG,CAAC;SACR,OAAO,CAAC,EAAE,CAAC;CACf,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,EAAE,CAClC,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5C,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,IACE,KAAK,CAAC,QAAQ,KAAK,SAAS;YAC5B,CAAC,KAAK,CAAC,MAAM;YACb,KAAK,CAAC,IAAI,KAAK,QAAQ;YACvB,KAAK,CAAC,OAAO;YAEb,OAAO,CACL,kDAAkD,CACnD,CAAC;IACN,CAAC;SAAM,IACL,KAAK,CAAC,QAAQ,KAAK,SAAS;QAC5B,KAAK,CAAC,MAAM;QAEZ,OAAO,CAAC,+BAA+B,CAAC,CAAC;IAC3C,IACE,KAAK,CAAC,IAAI,KAAK,YAAY;QAC3B,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;QAE1C,OAAO,CAAC,uDAAuD,CAAC,CAAC;IACnE,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU;QAC3D,OAAO,CAAC,4DAA4D,CAAC,CAAC;IACxE,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YACzC,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAC3D,GAAG,CAAC,QAAQ,CACb,CAAC;YACF,IACE,GAAG,CAAC,QAAQ;gBACZ,GAAG,CAAC,QAAQ;gBACZ,GAAG,CAAC,MAAM;gBACV,GAAG,CAAC,IAAI;gBACR,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,CAAC;gBAEtE,MAAM,IAAI,KAAK,EAAE,CAAC;YACpB,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,QAAQ;gBACrC,OAAO,CAAC,4DAA4D,CAAC,CAAC;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CACL,6GAA6G,CAC9G,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,UAAU,gBAAgB,CAC9B,OAAe,EACf,QAAkB,EAClB,SAAmB;IAEnB,IAAI,OAAO,KAAK,kBAAkB;QAAE,OAAO,OAAO,CAAC;IACnD,MAAM,MAAM,GACV,QAAQ,KAAK,MAAM,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,MAAM,CAAC;QACrE,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,QAAQ,CAAC;IACf,OAAO,CAEH;QACE,MAAM,EAAE,cAAc;QACtB,KAAK,EAAE,aAAa;QACpB,QAAQ,EAAE,gBAAgB;QAC1B,IAAI,EAAE,YAAY;KAErB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,aAAa,CACnC,CAAC;AACJ,CAAC;AACD,MAAM,UAAU,qBAAqB,CACnC,KAAwB,EACxB,OAAe;IAEf,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,KAAK,cAAc,CAAC;IAChE,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;QAC7B,OAAO;YACL,cAAc;YACd,aAAa;YACb,gBAAgB;YAChB,cAAc;SACf,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACtB,IAAI,KAAK,CAAC,QAAQ,KAAK,WAAW;QAAE,OAAO,OAAO,KAAK,aAAa,CAAC;IACrE,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU;QAAE,OAAO,OAAO,KAAK,cAAc,CAAC;IACrE,OAAO,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC9D,CAAC;AACD,MAAM,UAAU,gBAAgB,CAC9B,KAAwB,EACxB,OAAe;IAEf,OAAO,KAAK,CAAC,IAAI,KAAK,YAAY;QAChC,CAAC,CAAC,4BAA4B,OAAO,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE;QACvE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,cAAc,CAC5B,KAAwB,EACxB,OAAe,EACf,KAAa;IAEb,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,gBAAgB;QAAE,OAAO,KAAK,CAAC;IACzD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;IACxE,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC;AACvE,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,uBAAuB,CAAC,QAAgB,EAAE,OAAsD;IAC9G,IAAI,OAAO,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,OAAO,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,cAAc;YACrD,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,eAAe,CAAC;IAC7E,CAAC;IACD,OAAO,OAAO,EAAE,IAAI,IAAI,QAAQ,CAAC;AACnC,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,qBAAqB,CAAC,MAAqB;IAKzD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,eAAe,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;QACpG,KAAK,cAAc,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;QACjG,KAAK,sBAAsB,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;QAC7G,KAAK,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QAChD,KAAK,QAAQ,CAAC;QAAC,KAAK,YAAY,CAAC;QAAC,KAAK,SAAS,CAAC;QAAC,KAAK,SAAS,CAAC;QAAC,KAAK,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QAC5G,SAAS,OAAO,SAAS,CAAC;IAC5B,CAAC;AACH,CAAC"}

package/dist/app-definitions/airtable.json

@@ -20,6 +20,7 @@
             "key": "mcp-oauth",
             "transport": "mcp_remote",
             "auth": "oauth",
+            "oauthClientRegistration": "dcr",
             "ownershipModes": [
                 "dcr"
             ],
@@ -45,6 +46,44 @@
             "warnings": [
                 "An Airtable account; enterprise administrators may need to allowlist the client."
             ]
+        },
+        {
+            "key": "mcp-pat",
+            "transport": "mcp_remote",
+            "auth": "api_key",
+            "ownershipModes": [
+                "customer"
+            ],
+            "whenToUse": "Use a personal access token when browser sign-in is not suitable.",
+            "defaults": {
+                "serverUrl": "https://mcp.airtable.com/mcp"
+            },
+            "guidanceMd": "Create an Airtable personal access token with the scopes and base resources required for the actions you intend to allow. MCP calls inherit your Airtable role and base permissions; organization allowlisting may still apply.",
+            "riskTier": "S3",
+            "label": "Use a personal access token",
+            "credentialFields": [
+                {
+                    "key": "authorization",
+                    "label": "Airtable personal access token",
+                    "type": "password",
+                    "required": true,
+                    "placeholder": "pat...",
+                    "secret": true,
+                    "helperMd": "Choose provider scopes and resource bases for intended actions; token and user/base role permissions both restrict access."
+                }
+            ],
+            "keyPlacement": {
+                "location": "header",
+                "name": "Authorization",
+                "prefix": "Bearer "
+            },
+            "consoleLinks": {
+                "docs": "https://support.airtable.com/articles/9897799762-using-the-airtable-mcp-server",
+                "keys": "https://airtable.com/create/tokens"
+            },
+            "warnings": [
+                "Use a disposable or development base for initial write qualification. Enterprise admins may need to allowlist MCP access."
+            ]
         }
     ]
 }

package/dist/app-definitions/anthropic.json

@@ -71,5 +71,8 @@
                 "name": "ANTHROPIC_API_KEY"
             }
         }
+    ],
+    "tags": [
+        "model-provider"
     ]
 }

package/dist/app-definitions/bedrock.json

@@ -0,0 +1,53 @@
+{
+    "schemaVersion": 1,
+    "slug": "bedrock",
+    "name": "Amazon Bedrock",
+    "description": "Use Claude through Amazon Bedrock with a Bedrock API key and AWS region.",
+    "categories": [
+        "ai"
+    ],
+    "branding": {
+        "logoUrl": "/brands/apps/bedrock.svg"
+    },
+    "urlPatterns": [],
+    "methods": [
+        {
+            "key": "ai-api_key",
+            "label": "Amazon Bedrock API key",
+            "purpose": "ai",
+            "transport": "runtime_auth",
+            "auth": "api_key",
+            "ai": {
+                "provider": "anthropic",
+                "method": "api_key"
+            },
+            "grantKinds": [
+                "user",
+                "organization"
+            ],
+            "ownershipModes": [
+                "customer"
+            ],
+            "whenToUse": "Use Claude through Amazon Bedrock with a Bedrock API key and AWS region.",
+            "guidanceMd": "Use your personal account or an explicitly shared company account.",
+            "riskTier": "S3",
+            "credentialFields": [
+                {
+                    "key": "apiKey",
+                    "label": "API key",
+                    "type": "password",
+                    "required": true,
+                    "placeholder": "Enter API key",
+                    "secret": true
+                }
+            ],
+            "keyPlacement": {
+                "location": "env",
+                "name": "AWS_BEARER_TOKEN_BEDROCK"
+            }
+        }
+    ],
+    "tags": [
+        "model-provider"
+    ]
+}

package/dist/app-definitions/bitly.json

@@ -25,16 +25,20 @@
             ],
             "whenToUse": "Use browser sign-in for the provider-hosted MCP server.",
             "defaults": {
-                "serverUrl": "https://api-ssl.bitly.com/v4/mcp"
+                "serverUrl": "https://api-ssl.bitly.com/v4/mcp",
+                "scopesHint": [
+                    "mcp.all"
+                ]
             },
-            "guidanceMd": "Connect Bitly in the browser. A Bitly account with either browser authorization or an API token.",
-            "riskTier": "S2",
+            "guidanceMd": "Connect Bitly in the browser. Choose only the intended workspace. Review the discovered actions and keep writes and destructive operations disabled until explicitly needed.",
+            "riskTier": "S4",
             "label": "Sign in with Bitly",
             "consoleLinks": {
-                "docs": "https://dev.bitly.com/bitly-mcp/overview/quickstart/"
+                "docs": "https://dev.bitly.com/bitly-mcp/using-the-bitly-mcp-server/configuration-details/"
             },
             "warnings": [
-                "A Bitly account with either browser authorization or an API token."
+                "The mcp.all scope covers Bitly's broad MCP catalog, including link and QR management, analytics, groups, custom domains, and Bitly Sites.",
+                "The catalog includes publishing and deletion operations, including permanent short-link deletion, site deletion, and custom-domain changes. Review the full catalog and keep write and destructive actions Off during read-only qualification."
             ]
         },
         {
@@ -44,12 +48,12 @@
             "ownershipModes": [
                 "customer"
             ],
-            "whenToUse": "Use a restricted customer-owned key when browser sign-in is not suitable.",
+            "whenToUse": "Use a customer-created Bitly API token when browser sign-in is not suitable.",
             "defaults": {
                 "serverUrl": "https://api-ssl.bitly.com/v4/mcp"
             },
-            "guidanceMd": "Use a customer-created Bitly key. A Bitly account with either browser authorization or an API token.",
-            "riskTier": "S2",
+            "guidanceMd": "Generate a Bitly API token under Settings → API. The token may authorize the MCP's full catalog under your Bitly account; Paperclip cannot narrow the token. Review discovered actions and keep writes and destructive operations disabled until explicitly needed.",
+            "riskTier": "S4",
             "label": "Use an API key",
             "credentialFields": [
                 {
@@ -59,7 +63,7 @@
                     "required": true,
                     "placeholder": "Paste your Bitly API token",
                     "secret": true,
-                    "helperMd": "Create/manage links in authorized groups. Create a key with read and write permissions for these actions; Paperclip cannot increase an existing key’s permissions."
+                    "helperMd": "A Bitly API token from Settings → API is documented for MCP bearer auth, but no restriction scope is documented; treat it as capable of the full MCP catalog under that account. Paperclip cannot narrow the token."
                 }
             ],
             "keyPlacement": {
@@ -68,11 +72,12 @@
                 "prefix": "Bearer "
             },
             "consoleLinks": {
-                "keys": "https://dev.bitly.com/bitly-mcp/overview/quickstart/",
-                "docs": "https://dev.bitly.com/bitly-mcp/overview/quickstart/"
+                "keys": "https://bitly.com/settings/api",
+                "docs": "https://dev.bitly.com/bitly-mcp/using-the-bitly-mcp-server/configuration-details/"
             },
             "warnings": [
-                "A Bitly account with either browser authorization or an API token."
+                "This API token is not documented as a restricted MCP token. It may authorize Bitly's broad MCP catalog, including link creation/update/deletion, QR codes, Sites publishing/deletion, and custom-domain operations.",
+                "Review the discovered catalog and keep write and destructive actions Off during read-only qualification."
             ]
         }
     ]

package/dist/app-definitions/calendly.json

@@ -0,0 +1,46 @@
+{
+    "schemaVersion": 1,
+    "slug": "calendly",
+    "name": "Calendly",
+    "description": "Review Calendly event types and availability, and use supported scheduling actions.",
+    "categories": [
+        "productivity"
+    ],
+    "featured": false,
+    "branding": {
+        "logoUrl": "/brands/apps/calendly.png"
+    },
+    "urlPatterns": [
+        "https://mcp.calendly.com/*"
+    ],
+    "docsUrl": "https://developer.calendly.com/docs/mcp/calendly-mcp-server",
+    "redirectConstraints": "https-or-loopback-http",
+    "methods": [
+        {
+            "key": "mcp-oauth",
+            "label": "Sign in with Calendly",
+            "transport": "mcp_remote",
+            "auth": "oauth",
+            "ownershipModes": [
+                "dcr"
+            ],
+            "whenToUse": "Connect the provider-hosted Calendly MCP server with browser sign-in.",
+            "defaults": {
+                "serverUrl": "https://mcp.calendly.com",
+                "scopesHint": [
+                    "mcp:scheduling:read",
+                    "mcp:scheduling:write"
+                ]
+            },
+            "guidanceMd": "Check the connected account, event type, timezone, availability, and attendee details before using a scheduling write. Use a test scheduling artifact only when the discovered tool explicitly supports it.",
+            "warnings": [
+                "Calendly MCP requires DCR and OAuth 2.1 authorization-code with PKCE S256. It does not support personal access tokens or manually provisioned static OAuth clients.",
+                "The provider advertises both scheduling read and write scopes for full access; verify the live tool catalog before enabling booking or link creation."
+            ],
+            "consoleLinks": {
+                "docs": "https://developer.calendly.com/docs/mcp/calendly-mcp-server"
+            },
+            "riskTier": "S3"
+        }
+    ]
+}

package/dist/app-definitions/chat-completions-api.json

@@ -0,0 +1,53 @@
+{
+    "schemaVersion": 1,
+    "slug": "chat-completions-api",
+    "name": "Chat Completions API",
+    "description": "Connect any compatible harness to a Chat Completions-compatible provider or gateway.",
+    "categories": [
+        "ai"
+    ],
+    "branding": {
+        "logoUrl": "/brands/apps/api-key-generic.svg"
+    },
+    "urlPatterns": [],
+    "methods": [
+        {
+            "key": "ai-api_key",
+            "label": "Chat Completions API API key",
+            "purpose": "ai",
+            "transport": "runtime_auth",
+            "auth": "api_key",
+            "ai": {
+                "provider": "openai",
+                "method": "api_key"
+            },
+            "grantKinds": [
+                "user",
+                "organization"
+            ],
+            "ownershipModes": [
+                "customer"
+            ],
+            "whenToUse": "Connect any compatible harness to a Chat Completions-compatible provider or gateway.",
+            "guidanceMd": "Use your personal account or an explicitly shared company account.",
+            "riskTier": "S3",
+            "credentialFields": [
+                {
+                    "key": "apiKey",
+                    "label": "API key",
+                    "type": "password",
+                    "required": true,
+                    "placeholder": "Enter API key",
+                    "secret": true
+                }
+            ],
+            "keyPlacement": {
+                "location": "env",
+                "name": "OPENAI_API_KEY"
+            }
+        }
+    ],
+    "tags": [
+        "model-provider"
+    ]
+}

package/dist/app-definitions/clickup.json

@@ -0,0 +1,53 @@
+{
+    "schemaVersion": 1,
+    "slug": "clickup",
+    "name": "ClickUp",
+    "description": "Search ClickUp workspaces and manage tasks, docs, and conversations through the official MCP server.",
+    "categories": [
+        "productivity"
+    ],
+    "featured": false,
+    "branding": {
+        "logoUrl": "/brands/apps/clickup.png"
+    },
+    "urlPatterns": [
+        "https://mcp.clickup.com/*"
+    ],
+    "docsUrl": "https://developer.clickup.com/docs/connect-an-ai-assistant-to-clickups-mcp-server",
+    "redirectConstraints": "https-or-loopback-http",
+    "methods": [
+        {
+            "key": "mcp-oauth",
+            "label": "Sign in with ClickUp",
+            "transport": "mcp_remote",
+            "auth": "oauth",
+            "ownershipModes": [
+                "dcr"
+            ],
+            "grantKinds": [
+                "user"
+            ],
+            "whenToUse": "Connect the provider-hosted ClickUp MCP server with browser sign-in.",
+            "defaults": {
+                "serverUrl": "https://mcp.clickup.com/mcp",
+                "scopesHint": [
+                    "read",
+                    "write"
+                ]
+            },
+            "guidanceMd": "Choose only the ClickUp workspace needed. Confirm the target list and task before changing content, starting a timer, posting a chat message, or deleting anything.",
+            "warnings": [
+                "ClickUp's MCP may expose task, document, and chat writes, time tracking, and task deletion under the signed-in user's permissions. Review the catalog and keep write and destructive actions disabled until explicitly needed.",
+                "Workspace usage may be subject to plan-based rolling daily MCP limits."
+            ],
+            "consoleLinks": {
+                "docs": "https://developer.clickup.com/docs/connect-an-ai-assistant-to-clickups-mcp-server"
+            },
+            "riskTier": "S4",
+            "requiredResourceFilters": [
+                "workspace",
+                "list"
+            ]
+        }
+    ]
+}

package/dist/app-definitions/context7.json

@@ -2,7 +2,7 @@
     "schemaVersion": 1,
     "slug": "context7",
     "name": "Context7",
-    "description": "Look up current documentation for software libraries.",
+    "description": "Search public library documentation and retrieve current code examples.",
     "categories": [
         "developer"
     ],
@@ -22,12 +22,20 @@
             "ownershipModes": [
                 "customer"
             ],
-            "whenToUse": "Use the provider-hosted connection for the quickest setup.",
+            "whenToUse": "Use the public hosted MCP server for read-only library documentation lookups.",
             "defaults": {
                 "serverUrl": "https://mcp.context7.com/mcp"
             },
-            "guidanceMd": "Connect Context7 to give agents current library documentation.",
-            "riskTier": "S1"
+            "guidanceMd": "Connect Context7 to resolve public library IDs and retrieve current documentation. Anonymous access is supported with low rate limits; this method does not configure an API key. Keep queries limited to public documentation questions and do not include credentials, personal data, or proprietary code.",
+            "riskTier": "S1",
+            "consoleLinks": {
+                "docs": "https://context7.com/docs/api-guide"
+            },
+            "warnings": [
+                "Context7 processes the query text. Do not include secrets, personal information, or proprietary code.",
+                "Anonymous requests have low rate limits. Provider documentation says an API key raises limits and supports private repositories; this public method does not configure a key."
+            ]
         }
-    ]
+    ],
+    "docsUrl": "https://context7.com/docs/api-guide"
 }

package/dist/app-definitions/enterpret.json

@@ -0,0 +1,92 @@
+{
+    "schemaVersion": 1,
+    "slug": "enterpret",
+    "name": "Enterpret",
+    "description": "Ask questions about your customer feedback and pull verbatim quotes with citations.",
+    "categories": [
+        "analytics"
+    ],
+    "featured": false,
+    "branding": {
+        "logoUrl": "/brands/apps/enterpret.png"
+    },
+    "urlPatterns": [
+        "https://wisdom-api.enterpret.com/*"
+    ],
+    "methods": [
+        {
+            "key": "mcp-api-key",
+            "transport": "mcp_remote",
+            "auth": "api_key",
+            "ownershipModes": [
+                "customer"
+            ],
+            "whenToUse": "Recommended. Use an organization auth token from Settings → Enterpret MCP. This is the primary, store-ready connection method.",
+            "defaults": {
+                "serverUrl": "https://wisdom-api.enterpret.com/server/mcp"
+            },
+            "guidanceMd": "Generate an auth token in Enterpret under Settings, Enterpret MCP, then paste it below. One token belongs to one Enterpret organization. This is the recommended connection method.",
+            "riskTier": "S3",
+            "label": "Use an auth token",
+            "grantKinds": [
+                "organization"
+            ],
+            "credentialFields": [
+                {
+                    "key": "authorization",
+                    "label": "Enterpret auth token",
+                    "type": "password",
+                    "required": true,
+                    "placeholder": "Paste the token from Settings, Enterpret MCP",
+                    "secret": true,
+                    "helperMd": "An organization auth token can read that organization's customer feedback. Use a token from Settings > Enterpret MCP and check its displayed expiry there."
+                }
+            ],
+            "keyPlacement": {
+                "location": "header",
+                "name": "Authorization",
+                "prefix": "Bearer "
+            },
+            "consoleLinks": {
+                "docs": "https://enterpret.support.site/article/enterpret-mcp-server"
+            },
+            "warnings": [
+                "Check your auth token's expiry in Enterpret Settings > Enterpret MCP and replace it before it lapses.",
+                "This connection reads customer feedback, including verbatim quotes with speaker attribution.",
+                "run_graph_query starts as Ask first. Cypher is not established as read-only even when Enterpret advertises readOnlyHint."
+            ]
+        },
+        {
+            "key": "mcp-oauth",
+            "transport": "mcp_remote",
+            "auth": "oauth",
+            "ownershipModes": [
+                "dcr"
+            ],
+            "whenToUse": "Use browser sign-in when each person should query feedback under their own Enterpret account.",
+            "defaults": {
+                "serverUrl": "https://wisdom-api.enterpret.com/server/mcp",
+                "scopesHint": [
+                    "mcp:read"
+                ]
+            },
+            "guidanceMd": "Sign in to Enterpret in the browser to query the official read-only MCP. Each person connects with their own Enterpret account, and Enterpret attributes their queries individually.",
+            "riskTier": "S3",
+            "label": "Sign in with Enterpret",
+            "grantKinds": [
+                "user"
+            ],
+            "consoleLinks": {
+                "docs": "https://enterpret.support.site/article/enterpret-mcp-server"
+            },
+            "warnings": [
+                "The official Enterpret MCP is read-only. Enterpret previously reported broader OAuth scopes, including mcp:write and email, than Paperclip requested. Enterpret is correcting this scope reporting; it does not establish access to the separate beta Agent MCP.",
+                "After revocation, Enterpret may cache token validity for up to 24 hours. Disconnect this connection to stop Paperclip access immediately. Enterpret is reducing this delay.",
+                "You need an Enterpret account with access to your organization's feedback.",
+                "This connection reads customer feedback, including verbatim quotes with speaker attribution."
+            ]
+        }
+    ],
+    "docsUrl": "https://enterpret.support.site/article/enterpret-mcp-server",
+    "redirectConstraints": "https-or-loopback-http"
+}

package/dist/app-definitions/exa.json

@@ -0,0 +1,34 @@
+{
+    "schemaVersion": 1,
+    "slug": "exa",
+    "name": "Exa",
+    "description": "Search the public web and read source pages with Exa.",
+    "categories": [
+        "data"
+    ],
+    "featured": false,
+    "branding": {
+        "logoUrl": "/brands/apps/exa.svg"
+    },
+    "urlPatterns": [
+        "https://mcp.exa.ai/*"
+    ],
+    "docsUrl": "https://exa.ai/docs/get-started/exa-mcp",
+    "methods": [
+        {
+            "key": "public-search",
+            "label": "Use public Exa search",
+            "transport": "mcp_remote",
+            "auth": "none",
+            "ownershipModes": [
+                "customer"
+            ],
+            "whenToUse": "Use Exa’s public, keyless search MCP.",
+            "defaults": {
+                "serverUrl": "https://mcp.exa.ai/mcp"
+            },
+            "guidanceMd": "The public MCP route provides web search and page fetching. Keep citations with results. Account-authenticated Agent and advanced tools are not included in this method.",
+            "riskTier": "S2"
+        }
+    ]
+}