@unraid-toolkit/mcp 0.2.0

package/dist/config.js

@@ -0,0 +1,88 @@
+/**
+ * Runtime configuration for the MCP server — the wrapper-level concerns that
+ * are NOT the SDK's job: which transport to expose, network/auth settings, and
+ * the safety floor for (future) control tools.
+ *
+ * The Unraid *connection* (URL/key/TLS) is resolved separately via the SDK's
+ * `resolveConnectionConfig`.
+ */
+import { z } from 'zod';
+import { LOG_LEVELS } from './log.js';
+const DEFAULT_HTTP_PORT = 3000;
+const DEFAULT_MAX_BATCH = 10;
+const TRANSPORTS = ['stdio', 'http', 'both'];
+const TRUTHY = new Set(['true', '1', 'yes', 'on']);
+const FALSY = new Set(['false', '0', 'no', 'off', '']);
+function boolFromEnv(def) {
+    return z.preprocess((value) => {
+        if (value === undefined)
+            return def;
+        if (typeof value !== 'string')
+            return value;
+        const normalized = value.trim().toLowerCase();
+        if (normalized === '')
+            return def;
+        if (TRUTHY.has(normalized))
+            return true;
+        if (FALSY.has(normalized))
+            return false;
+        return value;
+    }, z.boolean());
+}
+function intFromEnv(def, min, max) {
+    return z.preprocess((value) => {
+        if (value === undefined || value === '')
+            return def;
+        const n = Number(value);
+        return Number.isInteger(n) ? n : value;
+    }, z.number().int().min(min).max(max));
+}
+const optionalEnvString = z.preprocess((value) => (value === '' || value === undefined ? undefined : value), z.string().min(1).optional());
+const csvList = z.preprocess((value) => {
+    if (typeof value !== 'string' || value === '')
+        return [];
+    return [
+        ...new Set(value
+            .split(',')
+            .map((s) => s.trim())
+            .filter((s) => s.length > 0)),
+    ];
+}, z.array(z.string()));
+const mcpConfigSchema = z.object({
+    transport: z.enum(TRANSPORTS).default('stdio'),
+    httpPort: intFromEnv(DEFAULT_HTTP_PORT, 1, 65535),
+    httpAuthToken: optionalEnvString,
+    readOnly: boolFromEnv(false),
+    maxBatch: intFromEnv(DEFAULT_MAX_BATCH, 1, 10_000),
+    denyTools: csvList,
+    logLevel: z.enum(LOG_LEVELS).default('info'),
+    auditLogPath: optionalEnvString,
+});
+function readEnv(env) {
+    return {
+        transport: env['MCP_TRANSPORT'],
+        httpPort: env['MCP_HTTP_PORT'],
+        httpAuthToken: env['MCP_AUTH_TOKEN'],
+        readOnly: env['MCP_READ_ONLY'],
+        maxBatch: env['MCP_MAX_BATCH'],
+        denyTools: env['MCP_DENY_TOOLS'],
+        logLevel: env['LOG_LEVEL'],
+        auditLogPath: env['MCP_AUDIT_LOG'],
+    };
+}
+/**
+ * Validate and normalize MCP runtime configuration from the environment.
+ *
+ * @throws Error with a readable, multi-line summary if validation fails.
+ */
+export function loadMcpConfig(env = process.env) {
+    const result = mcpConfigSchema.safeParse(readEnv(env));
+    if (!result.success) {
+        const issues = result.error.issues
+            .map((issue) => `  - ${issue.path.join('.') || '(root)'}: ${issue.message}`)
+            .join('\n');
+        throw new Error(`Invalid Unraid MCP configuration:\n${issues}`);
+    }
+    return result.data;
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAEtC,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAC/B,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B,MAAM,UAAU,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAU,CAAC;AAEtD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;AACnD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;AAEvD,SAAS,WAAW,CAAC,GAAY;IAC/B,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE;QAC5B,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,GAAG,CAAC;QACpC,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5C,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC9C,IAAI,UAAU,KAAK,EAAE;YAAE,OAAO,GAAG,CAAC;QAClC,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,GAAW,EAAE,GAAW;IACvD,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE;QAC5B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;YAAE,OAAO,GAAG,CAAC;QACpD,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACzC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,iBAAiB,GAAG,CAAC,CAAC,UAAU,CACpC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,EACpE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAC7B,CAAC;AAEF,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IACzD,OAAO;QACL,GAAG,IAAI,GAAG,CACR,KAAK;aACF,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAC/B;KACF,CAAC;AACJ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AAExB,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9C,QAAQ,EAAE,UAAU,CAAC,iBAAiB,EAAE,CAAC,EAAE,KAAK,CAAC;IACjD,aAAa,EAAE,iBAAiB;IAChC,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC;IAC5B,QAAQ,EAAE,UAAU,CAAC,iBAAiB,EAAE,CAAC,EAAE,MAAM,CAAC;IAClD,SAAS,EAAE,OAAO;IAClB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC5C,YAAY,EAAE,iBAAiB;CAChC,CAAC,CAAC;AAKH,SAAS,OAAO,CAAC,GAAsB;IACrC,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,eAAe,CAAC;QAC/B,QAAQ,EAAE,GAAG,CAAC,eAAe,CAAC;QAC9B,aAAa,EAAE,GAAG,CAAC,gBAAgB,CAAC;QACpC,QAAQ,EAAE,GAAG,CAAC,eAAe,CAAC;QAC9B,QAAQ,EAAE,GAAG,CAAC,eAAe,CAAC;QAC9B,SAAS,EAAE,GAAG,CAAC,gBAAgB,CAAC;QAChC,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC;QAC1B,YAAY,EAAE,GAAG,CAAC,eAAe,CAAC;KACnC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,MAAyB,OAAO,CAAC,GAAG;IAChE,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;aAC/B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;aAC3E,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,sCAAsC,MAAM,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC"}

package/dist/format.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The seam between the SDK and MCP: adapt the SDK's `UnraidResult<T>` envelope
+ * into the MCP `CallToolResult` shape. This is the only place that conversion
+ * happens — tools never build `CallToolResult` by hand.
+ *
+ * The full `{ success, data, error }` envelope is preserved in the text content
+ * (the same shape the CLI emits in JSON mode, so clients handle results
+ * uniformly), and failures additionally set the protocol-native `isError` flag.
+ */
+import type { CallToolResult } from '@modelcontextprotocol/sdk/types.js';
+import type { UnraidResult } from '@unraid-toolkit/sdk';
+/** Convert an SDK result envelope into an MCP tool result. */
+export declare function formatResult<T>(result: UnraidResult<T>): CallToolResult;
+//# sourceMappingURL=format.d.ts.map

package/dist/format.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"format.d.ts","sourceRoot":"","sources":["../src/format.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,8DAA8D;AAC9D,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,cAAc,CAGvE"}

package/dist/format.js

@@ -0,0 +1,15 @@
+/**
+ * The seam between the SDK and MCP: adapt the SDK's `UnraidResult<T>` envelope
+ * into the MCP `CallToolResult` shape. This is the only place that conversion
+ * happens — tools never build `CallToolResult` by hand.
+ *
+ * The full `{ success, data, error }` envelope is preserved in the text content
+ * (the same shape the CLI emits in JSON mode, so clients handle results
+ * uniformly), and failures additionally set the protocol-native `isError` flag.
+ */
+/** Convert an SDK result envelope into an MCP tool result. */
+export function formatResult(result) {
+    const content = [{ type: 'text', text: JSON.stringify(result, null, 2) }];
+    return result.success ? { content } : { content, isError: true };
+}
+//# sourceMappingURL=format.js.map

package/dist/format.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"format.js","sourceRoot":"","sources":["../src/format.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,8DAA8D;AAC9D,MAAM,UAAU,YAAY,CAAI,MAAuB;IACrD,MAAM,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACnF,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACnE,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+/**
+ * `@unraid-toolkit/mcp` — MCP server for the Unraid GraphQL API.
+ *
+ * Running this file as a binary starts the server. Importing it as a library
+ * exposes {@link buildServer} and config helpers without side effects.
+ */
+export { buildServer, type ServerContext, SERVER_NAME, SERVER_VERSION } from './server.js';
+export { loadMcpConfig, type McpConfig } from './config.js';
+/** Boot the server with the configured transport(s). */
+export declare function main(): Promise<void>;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;GAKG;AAaH,OAAO,EAAE,WAAW,EAAE,KAAK,aAAa,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC3F,OAAO,EAAE,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAW5D,wDAAwD;AACxD,wBAAsB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAqC1C"}

package/dist/index.js

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+/**
+ * `@unraid-toolkit/mcp` — MCP server for the Unraid GraphQL API.
+ *
+ * Running this file as a binary starts the server. Importing it as a library
+ * exposes {@link buildServer} and config helpers without side effects.
+ */
+import { resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { createClient, resolveConnectionConfig } from '@unraid-toolkit/sdk';
+import { loadMcpConfig } from './config.js';
+import { createLogger } from './log.js';
+import { createAuditLog } from './audit.js';
+import { TokenStore } from './approval.js';
+import { buildServer } from './server.js';
+import { startStdio } from './transports/stdio.js';
+import { startHttp } from './transports/http.js';
+export { buildServer, SERVER_NAME, SERVER_VERSION } from './server.js';
+export { loadMcpConfig } from './config.js';
+function loadConfigOrExit() {
+    try {
+        return { runtime: loadMcpConfig(), connection: resolveConnectionConfig() };
+    }
+    catch (error) {
+        process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+        process.exit(1);
+    }
+}
+/** Boot the server with the configured transport(s). */
+export async function main() {
+    const { runtime, connection } = loadConfigOrExit();
+    const logger = createLogger(runtime.logLevel);
+    const client = createClient(connection);
+    const audit = createAuditLog(runtime.auditLogPath, logger);
+    const ctx = { client, config: runtime, logger, audit, tokens: new TokenStore() };
+    logger.info('Starting Unraid MCP server', {
+        transport: runtime.transport,
+        endpoint: client.endpoint,
+        readOnly: runtime.readOnly,
+    });
+    const shutdownHandlers = [];
+    if (runtime.transport === 'http' || runtime.transport === 'both') {
+        const closeHttp = await startHttp(() => buildServer(ctx), runtime, logger);
+        shutdownHandlers.push(closeHttp);
+    }
+    if (runtime.transport === 'stdio' || runtime.transport === 'both') {
+        await startStdio(buildServer(ctx), logger);
+    }
+    const shutdown = (signal) => {
+        logger.info(`Received ${signal}, shutting down`);
+        void Promise.allSettled(shutdownHandlers.map((h) => h())).finally(() => {
+            process.exit(0);
+        });
+    };
+    process.on('SIGINT', () => {
+        shutdown('SIGINT');
+    });
+    process.on('SIGTERM', () => {
+        shutdown('SIGTERM');
+    });
+}
+const entryPath = process.argv[1];
+// Resolve to an absolute path first so the comparison holds when the script is
+// launched via a relative path (e.g. `node packages/mcp/dist/index.js`).
+const isMainModule = entryPath !== undefined && import.meta.url === pathToFileURL(resolve(entryPath)).href;
+if (isMainModule) {
+    main().catch((error) => {
+        process.stderr.write(`Fatal: ${error instanceof Error ? error.message : String(error)}\n`);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAyB,MAAM,qBAAqB,CAAC;AACnG,OAAO,EAAE,aAAa,EAAkB,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAsB,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,EAAE,WAAW,EAAsB,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC3F,OAAO,EAAE,aAAa,EAAkB,MAAM,aAAa,CAAC;AAE5D,SAAS,gBAAgB;IACvB,IAAI,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE,EAAE,CAAC;IAC7E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,wDAAwD;AACxD,MAAM,CAAC,KAAK,UAAU,IAAI;IACxB,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,gBAAgB,EAAE,CAAC;IAEnD,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAkB,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,UAAU,EAAE,EAAE,CAAC;IAEhG,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE;QACxC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IAEH,MAAM,gBAAgB,GAA4B,EAAE,CAAC;IAErD,IAAI,OAAO,CAAC,SAAS,KAAK,MAAM,IAAI,OAAO,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QACjE,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3E,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,OAAO,CAAC,SAAS,KAAK,OAAO,IAAI,OAAO,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAClE,MAAM,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAQ,EAAE;QACxC,MAAM,CAAC,IAAI,CAAC,YAAY,MAAM,iBAAiB,CAAC,CAAC;QACjD,KAAK,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;QACxB,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;QACzB,QAAQ,CAAC,SAAS,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClC,+EAA+E;AAC/E,yEAAyE;AACzE,MAAM,YAAY,GAChB,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AACxF,IAAI,YAAY,EAAE,CAAC;IACjB,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/log.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Minimal leveled logger that writes exclusively to **stderr**.
+ *
+ * Critical for the stdio transport: stdout carries the MCP JSON-RPC stream, so
+ * all diagnostic logging must go to stderr to avoid corrupting it.
+ */
+export declare const LOG_LEVELS: readonly ["debug", "info", "warn", "error"];
+export type LogLevel = (typeof LOG_LEVELS)[number];
+export interface Logger {
+    debug(message: string, meta?: Record<string, unknown>): void;
+    info(message: string, meta?: Record<string, unknown>): void;
+    warn(message: string, meta?: Record<string, unknown>): void;
+    error(message: string, meta?: Record<string, unknown>): void;
+}
+/** Create a logger that emits messages at or above `minLevel` to stderr. */
+export declare function createLogger(minLevel?: LogLevel): Logger;
+//# sourceMappingURL=log.d.ts.map

package/dist/log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.d.ts","sourceRoot":"","sources":["../src/log.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,eAAO,MAAM,UAAU,6CAA8C,CAAC;AACtE,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAInD,MAAM,WAAW,MAAM;IACrB,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC7D,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5D,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5D,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC9D;AAOD,4EAA4E;AAC5E,wBAAgB,YAAY,CAAC,QAAQ,GAAE,QAAiB,GAAG,MAAM,CAoBhE"}

package/dist/log.js

@@ -0,0 +1,36 @@
+/**
+ * Minimal leveled logger that writes exclusively to **stderr**.
+ *
+ * Critical for the stdio transport: stdout carries the MCP JSON-RPC stream, so
+ * all diagnostic logging must go to stderr to avoid corrupting it.
+ */
+export const LOG_LEVELS = ['debug', 'info', 'warn', 'error'];
+const LEVEL_RANK = { debug: 10, info: 20, warn: 30, error: 40 };
+function formatLine(level, message, meta) {
+    const base = `[unraid-mcp] ${level.toUpperCase()} ${message}`;
+    return meta && Object.keys(meta).length > 0 ? `${base} ${JSON.stringify(meta)}` : base;
+}
+/** Create a logger that emits messages at or above `minLevel` to stderr. */
+export function createLogger(minLevel = 'info') {
+    const threshold = LEVEL_RANK[minLevel];
+    function emit(level, message, meta) {
+        if (LEVEL_RANK[level] < threshold)
+            return;
+        process.stderr.write(`${formatLine(level, message, meta)}\n`);
+    }
+    return {
+        debug: (message, meta) => {
+            emit('debug', message, meta);
+        },
+        info: (message, meta) => {
+            emit('info', message, meta);
+        },
+        warn: (message, meta) => {
+            emit('warn', message, meta);
+        },
+        error: (message, meta) => {
+            emit('error', message, meta);
+        },
+    };
+}
+//# sourceMappingURL=log.js.map

package/dist/log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.js","sourceRoot":"","sources":["../src/log.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAU,CAAC;AAGtE,MAAM,UAAU,GAA6B,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AAS1F,SAAS,UAAU,CAAC,KAAe,EAAE,OAAe,EAAE,IAA8B;IAClF,MAAM,IAAI,GAAG,gBAAgB,KAAK,CAAC,WAAW,EAAE,IAAI,OAAO,EAAE,CAAC;IAC9D,OAAO,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACzF,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,YAAY,CAAC,WAAqB,MAAM;IACtD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACvC,SAAS,IAAI,CAAC,KAAe,EAAE,OAAe,EAAE,IAA8B;QAC5E,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,SAAS;YAAE,OAAO;QAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC;IACD,OAAO;QACL,KAAK,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE;YACvB,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE;YACtB,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;QACD,IAAI,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE;YACtB,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE;YACvB,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC/B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/server.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Assembles the Unraid {@link McpServer} and registers every tool group.
+ * Transports connect to the server this builds.
+ */
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { UnraidClient } from '@unraid-toolkit/sdk';
+import type { McpConfig } from './config.js';
+import type { Logger } from './log.js';
+import type { AuditLog } from './audit.js';
+import { TokenStore } from './approval.js';
+/** Shared dependencies passed to every tool group. */
+export interface ServerContext {
+    client: UnraidClient;
+    config: McpConfig;
+    logger: Logger;
+    /** Layer-1 audit sink for mutations. */
+    audit: AuditLog;
+    /** Layer-2 confirmation-token store (token-gate fallback). */
+    tokens: TokenStore;
+}
+export declare const SERVER_NAME = "unraid-mcp";
+export declare const SERVER_VERSION = "0.1.0";
+/** Build and configure the MCP server with all tool groups registered. */
+export declare function buildServer(ctx: ServerContext): McpServer;
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAG3C,sDAAsD;AACtD,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,wCAAwC;IACxC,KAAK,EAAE,QAAQ,CAAC;IAChB,8DAA8D;IAC9D,MAAM,EAAE,UAAU,CAAC;CACpB;AAED,eAAO,MAAM,WAAW,eAAe,CAAC;AACxC,eAAO,MAAM,cAAc,UAAU,CAAC;AAEtC,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,GAAG,EAAE,aAAa,GAAG,SAAS,CAIzD"}

package/dist/server.js

@@ -0,0 +1,16 @@
+/**
+ * Assembles the Unraid {@link McpServer} and registers every tool group.
+ * Transports connect to the server this builds.
+ */
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { TokenStore } from './approval.js';
+import { registerAllTools } from './tools/index.js';
+export const SERVER_NAME = 'unraid-mcp';
+export const SERVER_VERSION = '0.1.0';
+/** Build and configure the MCP server with all tool groups registered. */
+export function buildServer(ctx) {
+    const server = new McpServer({ name: SERVER_NAME, version: SERVER_VERSION });
+    registerAllTools(server, ctx);
+    return server;
+}
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAKpE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAapD,MAAM,CAAC,MAAM,WAAW,GAAG,YAAY,CAAC;AACxC,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AAEtC,0EAA0E;AAC1E,MAAM,UAAU,WAAW,CAAC,GAAkB;IAC5C,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;IAC7E,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC9B,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/tools/annotations.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Shared MCP tool annotations.
+ *
+ * Every Phase 1 tool is a read-only observation: it never mutates server state,
+ * is safe to retry, and reaches an external system (the Unraid API).
+ */
+/** Annotations for a read-only, idempotent tool that calls the Unraid API. */
+export declare const READ_ONLY_ANNOTATIONS: {
+    readonly readOnlyHint: true;
+    readonly destructiveHint: false;
+    readonly idempotentHint: true;
+    readonly openWorldHint: true;
+};
+/**
+ * Annotations for a Phase 2 "safe" control tool — a state-changing write that is
+ * reversible and low-risk (start/stop/pause/update). Not read-only, not
+ * idempotent, and (per MCP semantics) not flagged destructive — destructive,
+ * gated operations are Phase 3 and carry `destructiveHint: true`.
+ */
+export declare const SAFE_WRITE_ANNOTATIONS: {
+    readonly readOnlyHint: false;
+    readonly destructiveHint: false;
+    readonly idempotentHint: false;
+    readonly openWorldHint: true;
+};
+/**
+ * Annotations for a Phase 3 destructive control tool — an irreversible or
+ * high-risk write (array stop, disk remove, container remove, force-stop/reset).
+ * Carries `destructiveHint: true`; the runtime additionally gates these behind
+ * the Layer-1 policy floor and Layer-2 human approval.
+ */
+export declare const DESTRUCTIVE_ANNOTATIONS: {
+    readonly readOnlyHint: false;
+    readonly destructiveHint: true;
+    readonly idempotentHint: false;
+    readonly openWorldHint: true;
+};
+//# sourceMappingURL=annotations.d.ts.map

package/dist/tools/annotations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"annotations.d.ts","sourceRoot":"","sources":["../../src/tools/annotations.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,8EAA8E;AAC9E,eAAO,MAAM,qBAAqB;;;;;CAKxB,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB;;;;;CAKzB,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB;;;;;CAK1B,CAAC"}

package/dist/tools/annotations.js

@@ -0,0 +1,38 @@
+/**
+ * Shared MCP tool annotations.
+ *
+ * Every Phase 1 tool is a read-only observation: it never mutates server state,
+ * is safe to retry, and reaches an external system (the Unraid API).
+ */
+/** Annotations for a read-only, idempotent tool that calls the Unraid API. */
+export const READ_ONLY_ANNOTATIONS = {
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: true,
+};
+/**
+ * Annotations for a Phase 2 "safe" control tool — a state-changing write that is
+ * reversible and low-risk (start/stop/pause/update). Not read-only, not
+ * idempotent, and (per MCP semantics) not flagged destructive — destructive,
+ * gated operations are Phase 3 and carry `destructiveHint: true`.
+ */
+export const SAFE_WRITE_ANNOTATIONS = {
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: false,
+    openWorldHint: true,
+};
+/**
+ * Annotations for a Phase 3 destructive control tool — an irreversible or
+ * high-risk write (array stop, disk remove, container remove, force-stop/reset).
+ * Carries `destructiveHint: true`; the runtime additionally gates these behind
+ * the Layer-1 policy floor and Layer-2 human approval.
+ */
+export const DESTRUCTIVE_ANNOTATIONS = {
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: false,
+    openWorldHint: true,
+};
+//# sourceMappingURL=annotations.js.map

package/dist/tools/annotations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"annotations.js","sourceRoot":"","sources":["../../src/tools/annotations.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,YAAY,EAAE,IAAI;IAClB,eAAe,EAAE,KAAK;IACtB,cAAc,EAAE,IAAI;IACpB,aAAa,EAAE,IAAI;CACX,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,YAAY,EAAE,KAAK;IACnB,eAAe,EAAE,KAAK;IACtB,cAAc,EAAE,KAAK;IACrB,aAAa,EAAE,IAAI;CACX,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,YAAY,EAAE,KAAK;IACnB,eAAe,EAAE,IAAI;IACrB,cAAc,EAAE,KAAK;IACrB,aAAa,EAAE,IAAI;CACX,CAAC"}

package/dist/tools/array.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Array & parity tools. Read adapters plus the Phase 3 destructive controls
+ * (array state/disk membership, mount/unmount, parity-check lifecycle), each
+ * routed through the Layer-1 floor + Layer-2 approval via {@link runDestructive}.
+ */
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { ServerContext } from '../server.js';
+/** Register array/parity tools on the given server. */
+export declare function registerArrayTools(server: McpServer, ctx: ServerContext): void;
+//# sourceMappingURL=array.d.ts.map

package/dist/tools/array.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"array.d.ts","sourceRoot":"","sources":["../../src/tools/array.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAwBzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD,uDAAuD;AACvD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,aAAa,GAAG,IAAI,CAiM9E"}

package/dist/tools/array.js

@@ -0,0 +1,145 @@
+/**
+ * Array & parity tools. Read adapters plus the Phase 3 destructive controls
+ * (array state/disk membership, mount/unmount, parity-check lifecycle), each
+ * routed through the Layer-1 floor + Layer-2 approval via {@link runDestructive}.
+ */
+import { z } from 'zod';
+import { getArrayStatus, getParityHistory, setArrayState, addDiskToArray, removeDiskFromArray, mountArrayDisk, unmountArrayDisk, startParityCheck, pauseParityCheck, resumeParityCheck, cancelParityCheck, } from '@unraid-toolkit/sdk';
+import { formatResult } from '../format.js';
+import { READ_ONLY_ANNOTATIONS, SAFE_WRITE_ANNOTATIONS, DESTRUCTIVE_ANNOTATIONS, } from './annotations.js';
+import { PAGINATION_INPUT } from './pagination.js';
+import { CONFIRM_TOKEN_INPUT } from './confirm.js';
+import { readOnlyBlock } from './policy.js';
+import { runDestructive } from './destructive.js';
+/** Register array/parity tools on the given server. */
+export function registerArrayTools(server, ctx) {
+    server.registerTool('unraid_array_status', {
+        title: 'Get Unraid Array Status',
+        description: `Get the storage array's current state (STARTED/STOPPED/...), total/used/free capacity, parity-check status, and every member disk (parity, data, cache, boot) with size, filesystem usage, temperature, and health color.`,
+        inputSchema: {},
+        annotations: READ_ONLY_ANNOTATIONS,
+    }, async () => formatResult(await getArrayStatus(ctx.client)));
+    server.registerTool('unraid_parity_history', {
+        title: 'Get Unraid Parity-Check History',
+        description: `List past parity checks (date, duration, speed, error count, status). Newest entries first as returned by the server. Use limit/offset to page through a long history.`,
+        inputSchema: { ...PAGINATION_INPUT },
+        annotations: READ_ONLY_ANNOTATIONS,
+    }, async ({ limit, offset }) => formatResult(await getParityHistory(ctx.client, { limit, offset })));
+    // --- Phase 3: destructive array control ---
+    server.registerTool('unraid_array_set_state', {
+        title: 'Start/Stop Unraid Array',
+        description: `Start or stop the storage array. Stopping the array takes all shares and Docker/VM services offline. Destructive — requires human approval.`,
+        inputSchema: {
+            desiredState: z.enum(['START', 'STOP']).describe('Target array state'),
+            ...CONFIRM_TOKEN_INPUT,
+        },
+        annotations: DESTRUCTIVE_ANNOTATIONS,
+    }, async ({ desiredState, confirm_token }) => runDestructive(server, ctx, {
+        tool: 'unraid_array_set_state',
+        summary: `${desiredState === 'STOP' ? 'Stop' : 'Start'} the array`,
+        targets: ['array'],
+        token: confirm_token,
+        run: () => setArrayState(ctx.client, desiredState),
+    }));
+    server.registerTool('unraid_array_add_disk', {
+        title: 'Add Disk to Unraid Array',
+        description: `Add a disk to the array at an optional slot. Destructive — requires human approval.`,
+        inputSchema: {
+            id: z.string().describe('The disk id (PrefixedID)'),
+            slot: z.number().int().optional().describe('Target array slot'),
+            ...CONFIRM_TOKEN_INPUT,
+        },
+        annotations: DESTRUCTIVE_ANNOTATIONS,
+    }, async ({ id, slot, confirm_token }) => runDestructive(server, ctx, {
+        tool: 'unraid_array_add_disk',
+        summary: `Add disk ${id} to the array`,
+        targets: [id],
+        token: confirm_token,
+        run: () => addDiskToArray(ctx.client, id, slot),
+    }));
+    server.registerTool('unraid_array_remove_disk', {
+        title: 'Remove Disk from Unraid Array',
+        description: `Remove a disk from the array. The array must be stopped first. Destructive — requires human approval.`,
+        inputSchema: {
+            id: z.string().describe('The disk id (PrefixedID)'),
+            slot: z.number().int().optional().describe('The disk slot'),
+            ...CONFIRM_TOKEN_INPUT,
+        },
+        annotations: DESTRUCTIVE_ANNOTATIONS,
+    }, async ({ id, slot, confirm_token }) => runDestructive(server, ctx, {
+        tool: 'unraid_array_remove_disk',
+        summary: `Remove disk ${id} from the array`,
+        targets: [id],
+        token: confirm_token,
+        run: () => removeDiskFromArray(ctx.client, id, slot),
+    }));
+    server.registerTool('unraid_array_mount_disk', {
+        title: 'Mount Unraid Array Disk',
+        description: `Mount a single array disk. Destructive — requires human approval.`,
+        inputSchema: { id: z.string().describe('The disk id (PrefixedID)'), ...CONFIRM_TOKEN_INPUT },
+        annotations: DESTRUCTIVE_ANNOTATIONS,
+    }, async ({ id, confirm_token }) => runDestructive(server, ctx, {
+        tool: 'unraid_array_mount_disk',
+        summary: `Mount array disk ${id}`,
+        targets: [id],
+        token: confirm_token,
+        run: () => mountArrayDisk(ctx.client, id),
+    }));
+    server.registerTool('unraid_array_unmount_disk', {
+        title: 'Unmount Unraid Array Disk',
+        description: `Unmount a single array disk. Destructive — requires human approval.`,
+        inputSchema: { id: z.string().describe('The disk id (PrefixedID)'), ...CONFIRM_TOKEN_INPUT },
+        annotations: DESTRUCTIVE_ANNOTATIONS,
+    }, async ({ id, confirm_token }) => runDestructive(server, ctx, {
+        tool: 'unraid_array_unmount_disk',
+        summary: `Unmount array disk ${id}`,
+        targets: [id],
+        token: confirm_token,
+        run: () => unmountArrayDisk(ctx.client, id),
+    }));
+    // --- Phase 3: destructive parity control ---
+    server.registerTool('unraid_parity_start', {
+        title: 'Start Unraid Parity Check',
+        description: `Start a parity check. With correct=true it writes corrections to parity (a correcting check); correct=false runs a read-only check. Destructive (a correcting check writes to parity) and gated: requires human approval (elicitation or a confirmation token).`,
+        inputSchema: {
+            correct: z
+                .boolean()
+                .describe('Write corrections to parity (true) or read-only check (false)'),
+            ...CONFIRM_TOKEN_INPUT,
+        },
+        annotations: DESTRUCTIVE_ANNOTATIONS,
+    }, async ({ correct, confirm_token }) => runDestructive(server, ctx, {
+        tool: 'unraid_parity_start',
+        summary: `Start a ${correct ? 'correcting' : 'read-only'} parity check`,
+        targets: ['parity'],
+        token: confirm_token,
+        run: () => startParityCheck(ctx.client, correct),
+    }));
+    server.registerTool('unraid_parity_cancel', {
+        title: 'Cancel Unraid Parity Check',
+        description: `Cancel a running parity check (discards its progress). Destructive and gated: requires human approval (elicitation or a confirmation token).`,
+        inputSchema: { ...CONFIRM_TOKEN_INPUT },
+        annotations: DESTRUCTIVE_ANNOTATIONS,
+    }, async ({ confirm_token }) => runDestructive(server, ctx, {
+        tool: 'unraid_parity_cancel',
+        summary: 'Cancel the running parity check',
+        targets: ['parity'],
+        token: confirm_token,
+        run: () => cancelParityCheck(ctx.client),
+    }));
+    // Pause/resume are reversible, low-risk lifecycle toggles — safe writes, not
+    // gated. They still honor the read-only policy floor.
+    server.registerTool('unraid_parity_pause', {
+        title: 'Pause Unraid Parity Check',
+        description: `Pause a running parity check. Reversible — resume it with unraid_parity_resume.`,
+        inputSchema: {},
+        annotations: SAFE_WRITE_ANNOTATIONS,
+    }, async () => readOnlyBlock(ctx) ?? formatResult(await pauseParityCheck(ctx.client)));
+    server.registerTool('unraid_parity_resume', {
+        title: 'Resume Unraid Parity Check',
+        description: `Resume a paused parity check.`,
+        inputSchema: {},
+        annotations: SAFE_WRITE_ANNOTATIONS,
+    }, async () => readOnlyBlock(ctx) ?? formatResult(await resumeParityCheck(ctx.client)));
+}
+//# sourceMappingURL=array.js.map

package/dist/tools/array.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"array.js","sourceRoot":"","sources":["../../src/tools/array.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGlD,uDAAuD;AACvD,MAAM,UAAU,kBAAkB,CAAC,MAAiB,EAAE,GAAkB;IACtE,MAAM,CAAC,YAAY,CACjB,qBAAqB,EACrB;QACE,KAAK,EAAE,yBAAyB;QAChC,WAAW,EAAE,2NAA2N;QACxO,WAAW,EAAE,EAAE;QACf,WAAW,EAAE,qBAAqB;KACnC,EACD,KAAK,IAAI,EAAE,CAAC,YAAY,CAAC,MAAM,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAC3D,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,uBAAuB,EACvB;QACE,KAAK,EAAE,iCAAiC;QACxC,WAAW,EAAE,wKAAwK;QACrL,WAAW,EAAE,EAAE,GAAG,gBAAgB,EAAE;QACpC,WAAW,EAAE,qBAAqB;KACnC,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAC1B,YAAY,CAAC,MAAM,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CACtE,CAAC;IAEF,6CAA6C;IAE7C,MAAM,CAAC,YAAY,CACjB,wBAAwB,EACxB;QACE,KAAK,EAAE,yBAAyB;QAChC,WAAW,EAAE,6IAA6I;QAC1J,WAAW,EAAE;YACX,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC;YACtE,GAAG,mBAAmB;SACvB;QACD,WAAW,EAAE,uBAAuB;KACrC,EACD,KAAK,EAAE,EAAE,YAAY,EAAE,aAAa,EAAE,EAAE,EAAE,CACxC,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE;QAC1B,IAAI,EAAE,wBAAwB;QAC9B,OAAO,EAAE,GAAG,YAAY,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,YAAY;QAClE,OAAO,EAAE,CAAC,OAAO,CAAC;QAClB,KAAK,EAAE,aAAa;QACpB,GAAG,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC;KACnD,CAAC,CACL,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,uBAAuB,EACvB;QACE,KAAK,EAAE,0BAA0B;QACjC,WAAW,EAAE,qFAAqF;QAClG,WAAW,EAAE;YACX,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC;YACnD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YAC/D,GAAG,mBAAmB;SACvB;QACD,WAAW,EAAE,uBAAuB;KACrC,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,CACpC,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE;QAC1B,IAAI,EAAE,uBAAuB;QAC7B,OAAO,EAAE,YAAY,EAAE,eAAe;QACtC,OAAO,EAAE,CAAC,EAAE,CAAC;QACb,KAAK,EAAE,aAAa;QACpB,GAAG,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC;KAChD,CAAC,CACL,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,0BAA0B,EAC1B;QACE,KAAK,EAAE,+BAA+B;QACtC,WAAW,EAAE,uGAAuG;QACpH,WAAW,EAAE;YACX,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC;YACnD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC;YAC3D,GAAG,mBAAmB;SACvB;QACD,WAAW,EAAE,uBAAuB;KACrC,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,CACpC,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE;QAC1B,IAAI,EAAE,0BAA0B;QAChC,OAAO,EAAE,eAAe,EAAE,iBAAiB;QAC3C,OAAO,EAAE,CAAC,EAAE,CAAC;QACb,KAAK,EAAE,aAAa;QACpB,GAAG,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC;KACrD,CAAC,CACL,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,yBAAyB,EACzB;QACE,KAAK,EAAE,yBAAyB;QAChC,WAAW,EAAE,mEAAmE;QAChF,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC,EAAE,GAAG,mBAAmB,EAAE;QAC5F,WAAW,EAAE,uBAAuB;KACrC,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAC9B,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE;QAC1B,IAAI,EAAE,yBAAyB;QAC/B,OAAO,EAAE,oBAAoB,EAAE,EAAE;QACjC,OAAO,EAAE,CAAC,EAAE,CAAC;QACb,KAAK,EAAE,aAAa;QACpB,GAAG,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;KAC1C,CAAC,CACL,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,2BAA2B,EAC3B;QACE,KAAK,EAAE,2BAA2B;QAClC,WAAW,EAAE,qEAAqE;QAClF,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC,EAAE,GAAG,mBAAmB,EAAE;QAC5F,WAAW,EAAE,uBAAuB;KACrC,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAC9B,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE;QAC1B,IAAI,EAAE,2BAA2B;QACjC,OAAO,EAAE,sBAAsB,EAAE,EAAE;QACnC,OAAO,EAAE,CAAC,EAAE,CAAC;QACb,KAAK,EAAE,aAAa;QACpB,GAAG,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;KAC5C,CAAC,CACL,CAAC;IAEF,8CAA8C;IAE9C,MAAM,CAAC,YAAY,CACjB,qBAAqB,EACrB;QACE,KAAK,EAAE,2BAA2B;QAClC,WAAW,EAAE,iQAAiQ;QAC9Q,WAAW,EAAE;YACX,OAAO,EAAE,CAAC;iBACP,OAAO,EAAE;iBACT,QAAQ,CAAC,+DAA+D,CAAC;YAC5E,GAAG,mBAAmB;SACvB;QACD,WAAW,EAAE,uBAAuB;KACrC,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,CACnC,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE;QAC1B,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,WAAW,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,eAAe;QACvE,OAAO,EAAE,CAAC,QAAQ,CAAC;QACnB,KAAK,EAAE,aAAa;QACpB,GAAG,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC;KACjD,CAAC,CACL,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,sBAAsB,EACtB;QACE,KAAK,EAAE,4BAA4B;QACnC,WAAW,EAAE,8IAA8I;QAC3J,WAAW,EAAE,EAAE,GAAG,mBAAmB,EAAE;QACvC,WAAW,EAAE,uBAAuB;KACrC,EACD,KAAK,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAC1B,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE;QAC1B,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,iCAAiC;QAC1C,OAAO,EAAE,CAAC,QAAQ,CAAC;QACnB,KAAK,EAAE,aAAa;QACpB,GAAG,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC;KACzC,CAAC,CACL,CAAC;IAEF,6EAA6E;IAC7E,sDAAsD;IACtD,MAAM,CAAC,YAAY,CACjB,qBAAqB,EACrB;QACE,KAAK,EAAE,2BAA2B;QAClC,WAAW,EAAE,iFAAiF;QAC9F,WAAW,EAAE,EAAE;QACf,WAAW,EAAE,sBAAsB;KACpC,EACD,KAAK,IAAI,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,MAAM,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CACnF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,sBAAsB,EACtB;QACE,KAAK,EAAE,4BAA4B;QACnC,WAAW,EAAE,+BAA+B;QAC5C,WAAW,EAAE,EAAE;QACf,WAAW,EAAE,sBAAsB;KACpC,EACD,KAAK,IAAI,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,MAAM,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CACpF,CAAC;AACJ,CAAC"}

package/dist/tools/confirm.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Shared MCP input fragment for the confirmation-token gate.
+ *
+ * Destructive tools accept an optional `confirm_token`. On a client without
+ * elicitation, the first call returns a token; the caller re-invokes with it to
+ * proceed. Elicitation-capable clients ignore this field (approval happens
+ * interactively).
+ */
+import { z } from 'zod';
+/** Adds the optional `confirm_token` field to a destructive tool's input. */
+export declare const CONFIRM_TOKEN_INPUT: {
+    confirm_token: z.ZodOptional<z.ZodString>;
+};
+//# sourceMappingURL=confirm.d.ts.map

package/dist/tools/confirm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"confirm.d.ts","sourceRoot":"","sources":["../../src/tools/confirm.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,6EAA6E;AAC7E,eAAO,MAAM,mBAAmB;;CAO/B,CAAC"}