@upstash/mcp-server 0.2.2-rc.1 → 0.2.3-rc.2

package/dist/index.js

@@ -9,7 +9,22 @@ import { createServer } from "http";
 // src/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 
+// src/config.ts
+var config = {
+  apiKey: "",
+  email: "",
+  boxApiKey: "",
+  disableTelemetry: false,
+  readonly: false
+};
+
 // src/log.ts
+import { appendFileSync } from "fs";
+import path from "path";
+var debugLogPath = null;
+function initDebugLog(projectRoot) {
+  debugLogPath = path.resolve(projectRoot, "upstash-debug.log");
+}
 function log(...args) {
   const msg = `[DEBUG ${(/* @__PURE__ */ new Date()).toISOString()}] ${args.map((arg) => typeof arg === "string" ? arg : JSON.stringify(arg)).join(" ")}
 `;
@@ -17,13 +32,28 @@ function log(...args) {
     logs.push(msg);
   }
   process.stderr.write(msg);
+  if (debugLogPath) {
+    try {
+      appendFileSync(debugLogPath, msg);
+    } catch {
+    }
+  }
 }
 var logsStore = /* @__PURE__ */ new Map();
 
 // src/tools/utils.ts
 import { z } from "zod";
+
+// src/tools/helpers.ts
+var json = (value) => typeof value === "string" ? value : JSON.stringify(value, null, 2);
+function tool(t) {
+  return t;
+}
+
+// src/tools/utils.ts
 var utilTools = {
   util_timestamps_to_date: tool({
+    readonly: true,
     description: `Use this tool to convert a timestamp to a human-readable date`,
     inputSchema: z.object({
       timestamps: z.array(z.number()).describe("Array of timestamps to convert")
@@ -33,6 +63,7 @@ var utilTools = {
     }
   }),
   util_dates_to_timestamps: tool({
+    readonly: true,
     description: `Use this tool to convert an array of ISO 8601 dates to an array of timestamps`,
     inputSchema: z.object({
       dates: z.array(z.string()).describe("Array of dates to convert")
@@ -46,12 +77,6 @@ var utilTools = {
 // src/tools/redis/backup.ts
 import { z as z2 } from "zod";
 
-// src/config.ts
-var config = {
-  apiKey: "",
-  email: ""
-};
-
 // src/middlewares.ts
 var formatTimestamps = (obj) => {
   if (!obj || typeof obj !== "object") {
@@ -91,27 +116,56 @@ var applyMiddlewares = async (req, func) => {
   return next();
 };
 
+// src/version.ts
+var VERSION = "0.2.3-rc.2";
+
+// src/telemetry.ts
+function getRuntime() {
+  var _a, _b, _c;
+  if (globalThis.Bun !== void 0) {
+    return `bun@${globalThis.Bun.version}`;
+  }
+  if (globalThis.Deno !== void 0) {
+    const denoVersion = (_b = (_a = globalThis.Deno) == null ? void 0 : _a.version) == null ? void 0 : _b.deno;
+    return denoVersion ? `deno@${denoVersion}` : "deno";
+  }
+  if (typeof process !== "undefined" && ((_c = process.versions) == null ? void 0 : _c.node)) {
+    return `node@${process.versions.node}`;
+  }
+  return "unknown";
+}
+function getPlatform() {
+  if (typeof process !== "undefined" && process.platform) {
+    return process.platform;
+  }
+  return "unknown";
+}
+var telemetry = {
+  runtime: getRuntime(),
+  platform: getPlatform(),
+  sdk: `@upstash/mcp-server@${VERSION}`
+};
+
 // src/http.ts
-import fetch from "node-fetch";
 var HttpClient = class {
   constructor(config2) {
     this.baseUrl = config2.baseUrl.replace(/\/$/, "");
     this.qstashToken = config2.qstashToken;
   }
-  async get(path, query) {
-    return this.requestWithMiddleware({ method: "GET", path, query });
+  async get(path2, query) {
+    return this.requestWithMiddleware({ method: "GET", path: path2, query });
   }
-  async post(path, body, headers) {
-    return this.requestWithMiddleware({ method: "POST", path, body, headers });
+  async post(path2, body, headers) {
+    return this.requestWithMiddleware({ method: "POST", path: path2, body, headers });
   }
-  async put(path, body, headers) {
-    return this.requestWithMiddleware({ method: "PUT", path, body, headers });
+  async put(path2, body, headers) {
+    return this.requestWithMiddleware({ method: "PUT", path: path2, body, headers });
   }
-  async patch(path, body) {
-    return this.requestWithMiddleware({ method: "PATCH", path, body });
+  async patch(path2, body) {
+    return this.requestWithMiddleware({ method: "PATCH", path: path2, body });
   }
-  async delete(path, body) {
-    return this.requestWithMiddleware({ method: "DELETE", path, body });
+  async delete(path2, body) {
+    return this.requestWithMiddleware({ method: "DELETE", path: path2, body });
   }
   async requestWithMiddleware(req) {
     const res = await applyMiddlewares(req, async (req2) => {
@@ -145,11 +199,17 @@ var HttpClient = class {
       const token = [config.email, config.apiKey].join(":");
       authHeader = `Basic ${Buffer.from(token).toString("base64")}`;
     }
+    const telemetryHeaders = config.disableTelemetry ? {} : {
+      "Upstash-Telemetry-Runtime": telemetry.runtime,
+      "Upstash-Telemetry-Platform": telemetry.platform,
+      "Upstash-Telemetry-Sdk": telemetry.sdk
+    };
     const init = {
       method: req.method,
       headers: {
         "Content-Type": "application/json",
         Authorization: authHeader,
+        ...telemetryHeaders,
         ...req.headers
       }
     };
@@ -240,6 +300,7 @@ var redisBackupTools = {
     }
   }),
   redis_database_list_backups: tool({
+    readonly: true,
     // TODO: Add explanation for fields
     // TODO: Is this in bytes?
     description: `List all backups of a specific Upstash redis database.`,
@@ -269,9 +330,9 @@ var redisBackupTools = {
 
 // src/tools/redis/command.ts
 import { z as z3 } from "zod";
-import fetch2 from "node-fetch";
 var redisCommandTools = {
   redis_database_run_redis_commands: tool({
+    readonly: true,
     description: `Run one or more Redis commands on a specific Upstash redis database. Either provide database_id OR both database_rest_url and database_rest_token.
 NOTE: For discovery, use SCAN over KEYS. Use TYPE to get the type of a key.
 NOTE: SCAN cursor [MATCH pattern] [COUNT count] [TYPE type]
@@ -300,7 +361,7 @@ NOTE: Multiple commands will be executed as a pipeline for better performance.`,
         log("Fetching database details for database_id:", database_id);
         const db = await http.get(["v2/redis/database", database_id]);
         restUrl = "https://" + db.endpoint;
-        restToken = db.rest_token;
+        restToken = config.readonly ? db.read_only_rest_token : db.rest_token;
       }
       if (!restUrl || !restToken) {
         throw new Error("Could not determine REST URL and token for the database");
@@ -308,7 +369,7 @@ NOTE: Multiple commands will be executed as a pipeline for better performance.`,
       const isSingleCommand = commands.length === 1;
       const url = isSingleCommand ? restUrl : restUrl + "/pipeline";
       const body = isSingleCommand ? JSON.stringify(commands[0]) : JSON.stringify(commands);
-      const req = await fetch2(url, {
+      const req = await fetch(url, {
         method: "POST",
         body,
         headers: {
@@ -393,6 +454,7 @@ NOTE: Ask user for the region and name of the database.${GENERIC_DATABASE_NOTES}
     }
   }),
   redis_database_list_databases: tool({
+    readonly: true,
     description: `List all Upstash redis databases. Only their names and ids.${GENERIC_DATABASE_NOTES}`,
     handler: async () => {
       const dbs = await http.get("v2/redis/databases");
@@ -419,6 +481,7 @@ NOTE: Ask user for the region and name of the database.${GENERIC_DATABASE_NOTES}
     }
   }),
   redis_database_get_details: tool({
+    readonly: true,
     description: `Get further details of a specific Upstash redis database. Includes all details of the database including usage statistics.
 db_disk_threshold: Total disk usage limit.
 db_memory_threshold: Maximum memory usage.
@@ -461,6 +524,7 @@ ${GENERIC_DATABASE_NOTES}
     }
   }),
   redis_database_get_statistics: tool({
+    readonly: true,
     description: `Get comprehensive usage statistics of an Upstash redis database. Returns both:
 1. PRECISE 5-day usage: Exact command count and bandwidth usage over the last 5 days
 2. SAMPLED period stats: Sampled statistics over a specified period (1h, 3h, 12h, 1d, 3d, 7d) for performance monitoring
@@ -525,6 +589,7 @@ var parseUsageData = (data) => {
   if (!Array.isArray(data)) return "INVALID DATA";
   if (data.length === 0 || data.length === 1) return "NO DATA";
   const filteredData = data.filter((d) => d.x && d.y);
+  if (filteredData.length === 0) return "NO DATA";
   return {
     start: filteredData[0].x,
     // last one can be null, so use the second last
@@ -543,57 +608,81 @@ var redisTools = {
 };
 
 // src/tools/qstash/qstash.ts
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 
 // src/tools/qstash/utils.ts
-var cachedToken = null;
-var tokenExpiry = 0;
-async function getQStashToken() {
+var LOCAL_QSTASH_TOKEN = "eyJVc2VySUQiOiJkZWZhdWx0VXNlciIsIlBhc3N3b3JkIjoiZGVmYXVsdFBhc3N3b3JkIn0=";
+var REGION_URLS = {
+  eu: "https://qstash-eu-central-1.upstash.io",
+  us: "https://qstash-us-east-1.upstash.io"
+};
+var REGION_API_NAMES = {
+  eu: "eu-central-1",
+  us: "us-east-1"
+};
+var cachedUsers = null;
+var cacheExpiry = 0;
+async function getQStashCredentials(region) {
   const now = Date.now();
-  if (cachedToken && now < tokenExpiry) {
-    return cachedToken;
+  if (!cachedUsers || now >= cacheExpiry) {
+    try {
+      cachedUsers = await http.get("v2/qstash/users");
+      cacheExpiry = now + 60 * 1e3;
+    } catch (error) {
+      throw new Error(
+        `Failed to get QStash credentials: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
   }
-  try {
-    const user = await http.get("qstash/user");
-    cachedToken = user.token;
-    tokenExpiry = now + 60 * 60 * 1e3;
-    return user.token;
-  } catch (error) {
+  const apiRegion = REGION_API_NAMES[region] ?? REGION_API_NAMES["eu"];
+  const match = cachedUsers.find((u) => u.region === apiRegion);
+  if (!match) {
+    throw new Error(`No QStash user found for region '${region}' (${apiRegion})`);
+  }
+  return { token: match.token };
+}
+async function createQStashClientWithToken(options) {
+  if (config.readonly) {
     throw new Error(
-      `Failed to get QStash token: ${error instanceof Error ? error.message : String(error)}`
+      "QStash is not available in readonly mode yet. This feature will be implemented in the near future."
     );
   }
-}
-async function createQStashClientWithToken(creds = {}) {
-  if (!(creds == null ? void 0 : creds.token)) {
-    creds.token = await getQStashToken();
+  const { qstash_creds, region, local_mode_port } = options;
+  if (qstash_creds) {
+    return createQStashClient({ url: qstash_creds.url, token: qstash_creds.token });
   }
-  return createQStashClient({
-    url: creds == null ? void 0 : creds.url,
-    token: creds == null ? void 0 : creds.token
-  });
+  if (region === "local") {
+    return createQStashClient({
+      url: `http://localhost:${local_mode_port}`,
+      token: LOCAL_QSTASH_TOKEN
+    });
+  }
+  const effectiveRegion = region && REGION_URLS[region] ? region : "eu";
+  const fetched = await getQStashCredentials(effectiveRegion);
+  return createQStashClient({ url: REGION_URLS[effectiveRegion], token: fetched.token });
 }
 
-// src/tools/qstash/qstash.ts
-var qstashCreds = {
-  qstash_creds: z5.undefined()
-  // qstash_creds: z
-  //   .object({
-  //     url: z.string(),
-  //     token: z.string(),
-  //   })
-  //   .optional()
-  //   .describe(
-  //     "Optional qstash credentials. Use for local qstash connections and external qstash deployments"
-  //   ),
+// src/tools/qstash/common.ts
+import { z as z5 } from "zod";
+var qstashCommon = {
+  region: z5.enum(["eu", "us", "local"]).default("eu").describe("QStash region to use. To use local mode, pick `local`"),
+  local_mode_port: z5.number().default(8080).describe(
+    "Only provide when using local mode and if default does not work, the port is usually in the .env file"
+  ),
+  qstash_creds: z5.object({
+    url: z5.string(),
+    token: z5.string()
+  }).optional().describe("Custom qstash credentials, overrides `region`")
 };
+
+// src/tools/qstash/qstash.ts
 var qstashTools = {
   qstash_get_user_token: tool({
     description: `Get the QSTASH_TOKEN and QSTASH_URL of the current user. This
     is not needed for the mcp tools since the token is automatically fetched from
     the Upstash API for them.`,
     handler: async () => {
-      const user = await http.get("qstash/user");
+      const user = await http.get("v2/qstash/user");
       return [json(user)];
     }
   }),
@@ -601,42 +690,42 @@ var qstashTools = {
     description: `Publish a message to a destination URL using QStash. This
     sends an HTTP request to the specified destination via QStash's message
     queue. This can also be used to trigger a upstash workflow run.`,
-    inputSchema: z5.object({
-      destination: z5.string().describe("The destination URL to send the message to (e.g., 'https://example.com')"),
-      body: z5.string().optional().describe("Request body (JSON string or plain text)"),
-      method: z5.enum(["GET", "POST", "PUT", "DELETE", "PATCH"]).optional().describe("HTTP method (optional, defaults to POST)").default("POST"),
-      delay: z5.string().optional().describe("Delay before message delivery (e.g., '10s', '5m', '1h')"),
-      retries: z5.number().optional().describe("Number of retries on failure, default is 3"),
-      callback: z5.string().optional().describe("Callback URL that will be called when the message is successfully delivered"),
-      failureCallback: z5.string().optional().describe("Callback URL that will be called when the message is failed to deliver"),
-      timeout: z5.string().optional().describe("Request timeout (e.g., '30s', '1h')"),
-      queueName: z5.string().optional().describe(
+    inputSchema: z6.object({
+      destination: z6.string().describe("The destination URL to send the message to (e.g., 'https://example.com')"),
+      body: z6.string().optional().describe("Request body (JSON string or plain text)"),
+      method: z6.enum(["GET", "POST", "PUT", "DELETE", "PATCH"]).optional().describe("HTTP method (optional, defaults to POST)").default("POST"),
+      delay: z6.string().optional().describe("Delay before message delivery (e.g., '10s', '5m', '1h')"),
+      retries: z6.number().optional().describe("Number of retries on failure, default is 3"),
+      callback: z6.string().optional().describe("Callback URL that will be called when the message is successfully delivered"),
+      failureCallback: z6.string().optional().describe("Callback URL that will be called when the message is failed to deliver"),
+      timeout: z6.string().optional().describe("Request timeout (e.g., '30s', '1h')"),
+      queueName: z6.string().optional().describe(
         "Queue name to use, you have to first create the queue in upstash. Prefer the flow control key instead"
       ),
-      flow_control: z5.object({
-        key: z5.string().describe("Unique identifier for grouping messages under same flow control rules"),
-        parallelism: z5.number().optional().describe("Max concurrent active calls (default: unlimited)"),
-        rate: z5.number().optional().describe("Max calls per period (default: unlimited)"),
-        period: z5.string().optional().describe("Time window for rate limit (e.g., '1s', '1m', '1h', default: '1s')")
+      flow_control: z6.object({
+        key: z6.string().describe("Unique identifier for grouping messages under same flow control rules"),
+        parallelism: z6.number().optional().describe("Max concurrent active calls (default: unlimited)"),
+        rate: z6.number().optional().describe("Max calls per period (default: unlimited)"),
+        period: z6.string().optional().describe("Time window for rate limit (e.g., '1s', '1m', '1h', default: '1s')")
       }).optional().describe("Flow control for rate limiting and parallelism management"),
-      extraHeaders: z5.record(z5.string()).optional().describe("Extra headers to add to the request"),
-      ...qstashCreds
+      extraHeaders: z6.record(z6.string()).optional().describe("Extra headers to add to the request"),
+      ...qstashCommon
     }),
-    handler: async ({
-      destination,
-      body,
-      method,
-      extraHeaders,
-      delay,
-      retries,
-      callback,
-      failureCallback,
-      timeout,
-      queueName,
-      flow_control,
-      qstash_creds
-    }) => {
-      const client = await createQStashClientWithToken(qstash_creds);
+    handler: async (params) => {
+      const {
+        destination,
+        body,
+        method,
+        extraHeaders,
+        delay,
+        retries,
+        callback,
+        failureCallback,
+        timeout,
+        queueName,
+        flow_control
+      } = params;
+      const client = await createQStashClientWithToken(params);
       const requestHeaders = {};
       if (method) {
         requestHeaders["Upstash-Method"] = method;
@@ -687,10 +776,10 @@ var qstashTools = {
   }),
   qstash_logs_list: tool({
     description: `List QStash logs with optional filtering. Returns a paginated list of message logs without their bodies.`,
-    inputSchema: z5.object({
-      cursor: z5.string().optional().describe("Cursor for pagination"),
-      messageId: z5.string().optional().describe("Filter logs by message ID"),
-      state: z5.enum([
+    inputSchema: z6.object({
+      cursor: z6.string().optional().describe("Cursor for pagination"),
+      messageId: z6.string().optional().describe("Filter logs by message ID"),
+      state: z6.enum([
         "CREATED",
         "ACTIVE",
         "RETRY",
@@ -701,21 +790,27 @@ var qstashTools = {
         "CANCEL_REQUESTED",
         "CANCELLED"
       ]).optional().describe("Filter logs by state"),
-      url: z5.string().optional().describe("Filter logs by URL"),
-      topicName: z5.string().optional().describe("Filter logs by topic name"),
-      scheduleId: z5.string().optional().describe("Filter logs by schedule ID"),
-      queueName: z5.string().optional().describe("Filter logs by queue name"),
-      fromDate: z5.number().optional().describe("Filter logs from date (Unix timestamp in milliseconds)"),
-      toDate: z5.number().optional().describe("Filter logs to date (Unix timestamp in milliseconds)"),
-      count: z5.number().max(1e3).optional().describe("Number of logs to return (max 1000)"),
-      ...qstashCreds
+      url: z6.string().optional().describe("Filter logs by URL"),
+      topicName: z6.string().optional().describe("Filter logs by topic name"),
+      scheduleId: z6.string().optional().describe("Filter logs by schedule ID"),
+      queueName: z6.string().optional().describe("Filter logs by queue name"),
+      fromDate: z6.number().optional().describe("Filter logs from date (Unix timestamp in milliseconds)"),
+      toDate: z6.number().optional().describe("Filter logs to date (Unix timestamp in milliseconds)"),
+      count: z6.number().max(1e3).optional().describe("Number of logs to return (max 1000)"),
+      ...qstashCommon
     }),
     handler: async (params) => {
-      const client = await createQStashClientWithToken(params.qstash_creds);
+      const {
+        region: _region,
+        local_mode_port: _local_mode_port,
+        qstash_creds: _qstash_creds,
+        ...query
+      } = params;
+      const client = await createQStashClientWithToken(params);
       const response = await client.get("v2/logs", {
         trimBody: 0,
         groupBy: "messageId",
-        ...params
+        ...query
       });
       const firstMessageFields = Object.fromEntries(
         Object.entries(response.messages[0] ?? {}).filter(
@@ -738,12 +833,13 @@ var qstashTools = {
   }),
   qstash_logs_get: tool({
     description: `Get details of a single QStash log item by message ID without trimming the body.`,
-    inputSchema: z5.object({
-      messageId: z5.string().describe("The message ID to get details for"),
-      ...qstashCreds
+    inputSchema: z6.object({
+      messageId: z6.string().describe("The message ID to get details for"),
+      ...qstashCommon
     }),
-    handler: async ({ messageId, qstash_creds }) => {
-      const client = await createQStashClientWithToken(qstash_creds);
+    handler: async (params) => {
+      const { messageId } = params;
+      const client = await createQStashClientWithToken(params);
       const response = await client.get("v2/logs", { messageId });
       if (response.messages.length === 0) {
         return "No log entry found for the specified message ID";
@@ -754,25 +850,31 @@ var qstashTools = {
   }),
   qstash_dlq_list: tool({
     description: `List messages in the QStash Dead Letter Queue (DLQ) with optional filtering.`,
-    inputSchema: z5.object({
-      cursor: z5.string().optional().describe("Cursor for pagination"),
-      messageId: z5.string().optional().describe("Filter DLQ messages by message ID"),
-      url: z5.string().optional().describe("Filter DLQ messages by URL"),
-      topicName: z5.string().optional().describe("Filter DLQ messages by topic name"),
-      scheduleId: z5.string().optional().describe("Filter DLQ messages by schedule ID"),
-      queueName: z5.string().optional().describe("Filter DLQ messages by queue name"),
-      fromDate: z5.number().optional().describe("Filter from date (Unix timestamp in milliseconds)"),
-      toDate: z5.number().optional().describe("Filter to date (Unix timestamp in milliseconds)"),
-      responseStatus: z5.number().optional().describe("Filter by HTTP response status code"),
-      callerIp: z5.string().optional().describe("Filter by IP address of the publisher"),
-      count: z5.number().max(100).optional().describe("Number of messages to return (max 100)"),
-      ...qstashCreds
+    inputSchema: z6.object({
+      cursor: z6.string().optional().describe("Cursor for pagination"),
+      messageId: z6.string().optional().describe("Filter DLQ messages by message ID"),
+      url: z6.string().optional().describe("Filter DLQ messages by URL"),
+      topicName: z6.string().optional().describe("Filter DLQ messages by topic name"),
+      scheduleId: z6.string().optional().describe("Filter DLQ messages by schedule ID"),
+      queueName: z6.string().optional().describe("Filter DLQ messages by queue name"),
+      fromDate: z6.number().optional().describe("Filter from date (Unix timestamp in milliseconds)"),
+      toDate: z6.number().optional().describe("Filter to date (Unix timestamp in milliseconds)"),
+      responseStatus: z6.number().optional().describe("Filter by HTTP response status code"),
+      callerIp: z6.string().optional().describe("Filter by IP address of the publisher"),
+      count: z6.number().max(100).optional().describe("Number of messages to return (max 100)"),
+      ...qstashCommon
     }),
     handler: async (params) => {
-      const client = await createQStashClientWithToken(params.qstash_creds);
+      const {
+        region: _region,
+        local_mode_port: _local_mode_port,
+        qstash_creds: _qstash_creds,
+        ...query
+      } = params;
+      const client = await createQStashClientWithToken(params);
       const response = await client.get("v2/dlq", {
         trimBody: 0,
-        ...params
+        ...query
       });
       return [
         `Found ${response.messages.length} DLQ messages`,
@@ -783,59 +885,63 @@ var qstashTools = {
   }),
   qstash_dlq_get: tool({
     description: `Get details of a single DLQ message by DLQ ID.`,
-    inputSchema: z5.object({
-      dlqId: z5.string().describe("The DLQ ID of the message to retrieve"),
-      ...qstashCreds
+    inputSchema: z6.object({
+      dlqId: z6.string().describe("The DLQ ID of the message to retrieve"),
+      ...qstashCommon
     }),
-    handler: async ({ dlqId, qstash_creds }) => {
-      const client = await createQStashClientWithToken(qstash_creds);
+    handler: async (params) => {
+      const { dlqId } = params;
+      const client = await createQStashClientWithToken(params);
       const message = await client.get(`v2/dlq/${dlqId}`);
       return [`DLQ message details for ID: ${dlqId}`, json(message)];
     }
   }),
   qstash_schedules_list: tool({
     description: `List all QStash schedules.`,
-    handler: async ({ qstash_creds }) => {
-      const client = await createQStashClientWithToken(qstash_creds);
+    inputSchema: z6.object({
+      ...qstashCommon
+    }),
+    handler: async (params) => {
+      const client = await createQStashClientWithToken(params);
       const schedules = await client.get("v2/schedules");
       return [`Found ${schedules.length} schedules`, json(schedules)];
     }
   }),
   qstash_schedules_manage: tool({
     description: `Create, update, or manage QStash schedules. This tool handles create, update (by providing scheduleId), pause, resume, and delete operations in one unified interface.`,
-    inputSchema: z5.object({
-      operation: z5.enum(["create", "update", "pause", "resume", "delete"]).describe("The operation to perform"),
-      scheduleId: z5.string().optional().describe("Schedule ID (required for update, pause, resume, delete operations)"),
-      destination: z5.string().optional().describe("Destination URL or topic name (required for create/update)"),
-      cron: z5.string().optional().describe("Cron expression (required for create/update)"),
-      method: z5.enum(["GET", "POST", "PUT", "DELETE", "PATCH"]).optional().describe("HTTP method (optional, defaults to POST)"),
-      headers: z5.record(z5.string()).optional().describe("Request headers as key-value pairs"),
-      body: z5.string().optional().describe("Request body"),
-      delay: z5.string().optional().describe("Delay before message delivery (e.g., '10s', '5m', '1h')"),
-      retries: z5.number().optional().describe("Number of retries on failure"),
-      callback: z5.string().optional().describe("Callback URL for successful delivery"),
-      failureCallback: z5.string().optional().describe("Callback URL for failed delivery"),
-      timeout: z5.string().optional().describe("Request timeout (e.g., '30s')"),
-      queueName: z5.string().optional().describe("Queue name to use"),
-      ...qstashCreds
+    inputSchema: z6.object({
+      operation: z6.enum(["create", "update", "pause", "resume", "delete"]).describe("The operation to perform"),
+      scheduleId: z6.string().optional().describe("Schedule ID (required for update, pause, resume, delete operations)"),
+      destination: z6.string().optional().describe("Destination URL or topic name (required for create/update)"),
+      cron: z6.string().optional().describe("Cron expression (required for create/update)"),
+      method: z6.enum(["GET", "POST", "PUT", "DELETE", "PATCH"]).optional().describe("HTTP method (optional, defaults to POST)"),
+      headers: z6.record(z6.string()).optional().describe("Request headers as key-value pairs"),
+      body: z6.string().optional().describe("Request body"),
+      delay: z6.string().optional().describe("Delay before message delivery (e.g., '10s', '5m', '1h')"),
+      retries: z6.number().optional().describe("Number of retries on failure"),
+      callback: z6.string().optional().describe("Callback URL for successful delivery"),
+      failureCallback: z6.string().optional().describe("Callback URL for failed delivery"),
+      timeout: z6.string().optional().describe("Request timeout (e.g., '30s')"),
+      queueName: z6.string().optional().describe("Queue name to use"),
+      ...qstashCommon
     }),
-    handler: async ({
-      operation,
-      scheduleId,
-      destination,
-      cron,
-      method = "POST",
-      headers,
-      body,
-      delay,
-      retries,
-      callback,
-      failureCallback,
-      timeout,
-      queueName,
-      qstash_creds
-    }) => {
-      const client = await createQStashClientWithToken(qstash_creds);
+    handler: async (params) => {
+      const {
+        operation,
+        scheduleId,
+        destination,
+        cron,
+        method = "POST",
+        headers,
+        body,
+        delay,
+        retries,
+        callback,
+        failureCallback,
+        timeout,
+        queueName
+      } = params;
+      const client = await createQStashClientWithToken(params);
       switch (operation) {
         case "create":
         case "update": {
@@ -915,25 +1021,31 @@ var qstashTools = {
 };
 
 // src/tools/qstash/workflow.ts
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 var workflowTools = {
   workflow_logs_list: tool({
     description: `List Upstash Workflow logs with optional filtering. Returns grouped workflow runs with their execution details.`,
-    inputSchema: z6.object({
-      cursor: z6.string().optional().describe("Cursor for pagination"),
-      workflowRunId: z6.string().optional().describe("Filter by specific workflow run ID"),
-      count: z6.number().optional().describe("Number of workflow runs to return"),
-      state: z6.enum(["RUN_STARTED", "RUN_SUCCESS", "RUN_FAILED", "RUN_CANCELED"]).optional().describe("Filter by workflow state"),
-      workflowUrl: z6.string().optional().describe("Filter by workflow URL (exact match)"),
-      workflowCreatedAt: z6.number().optional().describe("Filter by workflow creation timestamp (Unix timestamp)"),
-      ...qstashCreds
+    inputSchema: z7.object({
+      cursor: z7.string().optional().describe("Cursor for pagination"),
+      workflowRunId: z7.string().optional().describe("Filter by specific workflow run ID"),
+      count: z7.number().optional().describe("Number of workflow runs to return"),
+      state: z7.enum(["RUN_STARTED", "RUN_SUCCESS", "RUN_FAILED", "RUN_CANCELED"]).optional().describe("Filter by workflow state"),
+      workflowUrl: z7.string().optional().describe("Filter by workflow URL (exact match)"),
+      workflowCreatedAt: z7.number().optional().describe("Filter by workflow creation timestamp (Unix timestamp)"),
+      ...qstashCommon
     }),
     handler: async (params) => {
-      const client = await createQStashClientWithToken(params.qstash_creds);
+      const {
+        region: _region,
+        local_mode_port: _local_mode_port,
+        qstash_creds: _qstash_creds,
+        ...query
+      } = params;
+      const client = await createQStashClientWithToken(params);
       const response = await client.get("v2/workflows/events", {
         trimBody: 0,
         groupBy: "workflowRunId",
-        ...params
+        ...query
       });
       const cleaned = response.runs.map(
         (run) => Object.fromEntries(Object.entries(run).filter(([key, _value]) => key !== "steps"))
@@ -952,16 +1064,20 @@ var workflowTools = {
     description: `Get details of a single workflow run by workflow run ID. There
     could be multiple workflow runs with the same workflow run ID, so you can
     use the workflowCreatedAt to get the details of the specific workflow run.`,
-    inputSchema: z6.object({
-      workflowRunId: z6.string().describe("The workflow run ID to get details for"),
-      workflowCreatedAt: z6.number().optional().describe("The workflow creation timestamp (Unix timestamp)"),
-      ...qstashCreds
+    inputSchema: z7.object({
+      workflowRunId: z7.string().describe("The workflow run ID to get details for"),
+      workflowCreatedAt: z7.number().optional().describe("The workflow creation timestamp (Unix timestamp)"),
+      ...qstashCommon
     }),
     handler: async (params) => {
-      const client = await createQStashClientWithToken(params.qstash_creds);
-      const response = await client.get("v2/workflows/logs", {
-        ...params
-      });
+      const {
+        region: _region,
+        local_mode_port: _local_mode_port,
+        qstash_creds: _qstash_creds,
+        ...query
+      } = params;
+      const client = await createQStashClientWithToken(params);
+      const response = await client.get("v2/workflows/logs", query);
       if (response.runs.length === 0) {
         return "No workflow run found";
       }
@@ -974,22 +1090,28 @@ var workflowTools = {
   }),
   workflow_dlq_list: tool({
     description: `List failed workflow runs in the Dead Letter Queue (DLQ) with optional filtering.`,
-    inputSchema: z6.object({
-      cursor: z6.string().optional().describe("Cursor for pagination"),
-      workflowRunId: z6.string().optional().describe("Filter by workflow run ID"),
-      workflowUrl: z6.string().optional().describe("Filter by workflow URL"),
-      fromDate: z6.number().optional().describe("Filter from date (Unix timestamp in milliseconds)"),
-      toDate: z6.number().optional().describe("Filter to date (Unix timestamp in milliseconds)"),
-      responseStatus: z6.number().optional().describe("Filter by HTTP response status code"),
-      callerIP: z6.string().optional().describe("Filter by IP address of the caller"),
-      failureCallbackState: z6.string().optional().describe("Filter by failure callback state"),
-      count: z6.number().optional().describe("Number of DLQ messages to return"),
-      ...qstashCreds
+    inputSchema: z7.object({
+      cursor: z7.string().optional().describe("Cursor for pagination"),
+      workflowRunId: z7.string().optional().describe("Filter by workflow run ID"),
+      workflowUrl: z7.string().optional().describe("Filter by workflow URL"),
+      fromDate: z7.number().optional().describe("Filter from date (Unix timestamp in milliseconds)"),
+      toDate: z7.number().optional().describe("Filter to date (Unix timestamp in milliseconds)"),
+      responseStatus: z7.number().optional().describe("Filter by HTTP response status code"),
+      callerIP: z7.string().optional().describe("Filter by IP address of the caller"),
+      failureCallbackState: z7.string().optional().describe("Filter by failure callback state"),
+      count: z7.number().optional().describe("Number of DLQ messages to return"),
+      ...qstashCommon
     }),
     handler: async (params) => {
-      const client = await createQStashClientWithToken(params.qstash_creds);
+      const {
+        region: _region,
+        local_mode_port: _local_mode_port,
+        qstash_creds: _qstash_creds,
+        ...query
+      } = params;
+      const client = await createQStashClientWithToken(params);
       const response = await client.get("v2/workflows/dlq", {
-        ...params,
+        ...query,
         trimBody: 0
       });
       const cleaned = response.messages.map(
@@ -1007,27 +1129,28 @@ var workflowTools = {
   }),
   workflow_dlq_get: tool({
     description: `Get details of a single failed workflow run from the DLQ by DLQ ID.`,
-    inputSchema: z6.object({
-      dlqId: z6.string().describe("The DLQ ID of the failed workflow run to retrieve"),
-      ...qstashCreds
+    inputSchema: z7.object({
+      dlqId: z7.string().describe("The DLQ ID of the failed workflow run to retrieve"),
+      ...qstashCommon
     }),
     handler: async (params) => {
-      const client = await createQStashClientWithToken(params.qstash_creds);
+      const client = await createQStashClientWithToken(params);
       const message = await client.get(`v2/workflows/dlq/${params.dlqId}`);
       return [`Failed workflow run details for DLQ ID: ${params.dlqId}`, json(message)];
     }
   }),
   workflow_dlq_manage: tool({
     description: `Delete, restart, and resume failed workflow runs in the DLQ using only the DLQ ID.`,
-    inputSchema: z6.object({
-      dlqId: z6.string().describe("The DLQ ID of the failed workflow run"),
-      action: z6.enum(["delete", "restart", "resume"]).describe(
+    inputSchema: z7.object({
+      dlqId: z7.string().describe("The DLQ ID of the failed workflow run"),
+      action: z7.enum(["delete", "restart", "resume"]).describe(
         "The action to perform: delete (remove from DLQ), restart (from beginning), or resume (from the failed step)"
       ),
-      ...qstashCreds
+      ...qstashCommon
     }),
-    handler: async ({ dlqId, action, qstash_creds }) => {
-      const client = await createQStashClientWithToken(qstash_creds);
+    handler: async (params) => {
+      const { dlqId, action } = params;
+      const client = await createQStashClientWithToken(params);
       switch (action) {
         case "delete": {
           await client.delete(`v2/workflows/dlq/delete/${dlqId}`);
@@ -1060,15 +1183,425 @@ var qstashAllTools = {
   ...workflowTools
 };
 
+// src/tools/box/manage.ts
+import { z as z9 } from "zod";
+
+// src/tools/box/common.ts
+import { z as z8 } from "zod";
+var BOX_BASE_URL = "https://us-east-1.box.upstash.com";
+function buildBoxCommon() {
+  const hasConfigKey = Boolean(config.boxApiKey);
+  return {
+    box_api_key: hasConfigKey ? z8.string().optional().describe(
+      "NOTE: The api key is already pre-configured at server startup; only pass this to override the configured key."
+    ) : z8.string().describe(
+      "Box API key (starts with 'box_'). Check the project's .env file for BOX_API_KEY, or ask the user for it."
+    )
+  };
+}
+
+// src/tools/box/utils.ts
+function getBoxClient(params) {
+  const apiKey = params.box_api_key || config.boxApiKey;
+  if (!apiKey) {
+    throw new Error(
+      "No Box API key available. Pass box_api_key as a tool argument, or configure the server with --box-api-key / UPSTASH_BOX_API_KEY env var."
+    );
+  }
+  return new HttpClient({
+    baseUrl: BOX_BASE_URL,
+    qstashToken: apiKey
+  });
+}
+
+// src/tools/box/manage.ts
+var boxManageTool = {
+  box_manage: tool({
+    description: `Manage Upstash Box containers. Supports creating, listing, getting, deleting, pausing, resuming, and forking boxes. Boxes are secure cloud containers with built-in AI agent capabilities.`,
+    get inputSchema() {
+      return z9.object({
+        action: z9.enum(["create", "list", "get", "delete", "pause", "resume", "fork"]).describe("The action to perform"),
+        box_id: z9.string().optional().describe("Box ID (required for get, delete, pause, resume, fork)"),
+        // Create-specific fields
+        name: z9.string().optional().describe("Display name for the box"),
+        model: z9.string().optional().describe(
+          "LLM model to use (e.g. 'claude/sonnet_4_6', 'openai/o4-mini'). Required for create"
+        ),
+        agent: z9.enum(["claude-code", "codex", "opencode"]).optional().default("claude-code").describe("Agent type (default: claude-code)"),
+        runtime: z9.string().optional().default("node").describe("Runtime environment (e.g. 'node', 'python')"),
+        agent_api_key: z9.string().optional().describe("API key for the AI agent provider. Empty uses managed key"),
+        env_vars: z9.record(z9.string()).optional().describe("Environment variables to set in the box"),
+        clone_repo: z9.string().optional().describe("Git repository URL to clone into the box"),
+        clone_token: z9.string().optional().describe("Token for cloning private repositories"),
+        ephemeral: z9.boolean().optional().describe("If true, box auto-deletes after TTL expires"),
+        ttl: z9.number().optional().describe("Time-to-live in seconds for ephemeral boxes (max 259200 = 3 days)"),
+        // List-specific fields
+        status: z9.enum(["active", "deleted"]).optional().describe("Filter for list action: 'active' (default) or 'deleted'"),
+        ...buildBoxCommon()
+      });
+    },
+    handler: async (params) => {
+      const { action, box_id } = params;
+      const client = getBoxClient(params);
+      switch (action) {
+        case "create": {
+          if (!params.model) {
+            throw new Error("model is required for create action");
+          }
+          const body = {
+            model: params.model
+          };
+          if (params.name) body.name = params.name;
+          if (params.agent) body.agent = params.agent;
+          if (params.runtime) body.runtime = params.runtime;
+          if (params.agent_api_key) body.agent_api_key = params.agent_api_key;
+          if (params.env_vars) body.env_vars = params.env_vars;
+          if (params.clone_repo) body.clone_repo = params.clone_repo;
+          if (params.clone_token) body.clone_token = params.clone_token;
+          if (params.ephemeral !== void 0) body.ephemeral = params.ephemeral;
+          if (params.ttl !== void 0) body.ttl = params.ttl;
+          const box = await client.post("v2/box", body);
+          return [
+            `Box created successfully (status: ${box.status})`,
+            `Box ID: ${box.id}`,
+            json(box)
+          ];
+        }
+        case "list": {
+          const query = {};
+          if (params.status === "deleted") query.status = "deleted";
+          const boxes = await client.get("v2/box", query);
+          return [`Found ${boxes.length} boxes`, json(boxes)];
+        }
+        case "get": {
+          if (!box_id) throw new Error("box_id is required for get action");
+          const box = await client.get(`v2/box/${box_id}`);
+          return [`Box ${box_id} (status: ${box.status})`, json(box)];
+        }
+        case "delete": {
+          if (!box_id) throw new Error("box_id is required for delete action");
+          await client.delete(`v2/box/${box_id}`);
+          return `Box ${box_id} deleted successfully`;
+        }
+        case "pause": {
+          if (!box_id) throw new Error("box_id is required for pause action");
+          await client.post(`v2/box/${box_id}/pause`);
+          return `Box ${box_id} paused successfully`;
+        }
+        case "resume": {
+          if (!box_id) throw new Error("box_id is required for resume action");
+          await client.post(`v2/box/${box_id}/resume`);
+          return `Box ${box_id} resumed successfully`;
+        }
+        case "fork": {
+          if (!box_id) throw new Error("box_id is required for fork action");
+          const forked = await client.post(`v2/box/${box_id}/fork`);
+          return [`Box forked successfully`, `New Box ID: ${forked.id}`, json(forked)];
+        }
+        default: {
+          throw new Error(`Unknown action: ${action}`);
+        }
+      }
+    }
+  })
+};
+
+// src/tools/box/exec.ts
+import { z as z10 } from "zod";
+var boxExecTool = {
+  box_exec: tool({
+    description: `Execute a shell command inside an Upstash Box container. Use this for file operations, git commands, package installs, or any shell operation inside the box.`,
+    get inputSchema() {
+      return z10.object({
+        box_id: z10.string().describe("The box ID to execute the command in"),
+        command: z10.array(z10.string()).describe("Command and arguments as an array (e.g. ['bash', '-c', 'ls -la'])"),
+        folder: z10.string().optional().describe("Working directory inside the box"),
+        async: z10.boolean().optional().describe("If true, return immediately without waiting for completion"),
+        ...buildBoxCommon()
+      });
+    },
+    handler: async (params) => {
+      const { box_id, command, folder, async: isAsync } = params;
+      const client = getBoxClient(params);
+      const body = { command };
+      if (folder) body.folder = folder;
+      if (isAsync) body.async = isAsync;
+      const response = await client.post(`v2/box/${box_id}/exec`, body);
+      if (response.exit_code !== 0) {
+        return [
+          `Command failed with exit code ${response.exit_code}`,
+          response.output ? `stdout: ${response.output}` : "",
+          response.error ? `stderr: ${response.error}` : ""
+        ].filter(Boolean);
+      }
+      return [
+        `Command executed successfully (exit code: ${response.exit_code})`,
+        response.output || "(no output)"
+      ];
+    }
+  })
+};
+
+// src/tools/box/agent-run.ts
+import { z as z11 } from "zod";
+var boxAgentRunTool = {
+  box_agent_run: tool({
+    description: `Run an AI agent prompt inside an Upstash Box. The agent has access to shell, filesystem, and git inside the box. It reasons, executes commands, and iterates until the task is complete. This is a synchronous call that may take a while depending on the complexity of the prompt.`,
+    get inputSchema() {
+      return z11.object({
+        box_id: z11.string().describe("The box ID to run the agent in"),
+        prompt: z11.string().describe("The natural-language prompt for the agent to execute"),
+        model: z11.string().optional().describe("Override the box's default LLM model for this run"),
+        folder: z11.string().optional().describe("Working directory inside the box for the agent"),
+        ...buildBoxCommon()
+      });
+    },
+    handler: async (params) => {
+      const { box_id, prompt, model, folder } = params;
+      const client = getBoxClient(params);
+      const body = { prompt };
+      if (model) body.model = model;
+      if (folder) body.folder = folder;
+      const response = await client.post(`v2/box/${box_id}/run`, body);
+      const result = [`Agent run completed`];
+      if (response.run_id) {
+        result.push(`Run ID: ${response.run_id}`);
+      }
+      result.push(response.output || "(no output)");
+      if (response.metadata) {
+        result.push(
+          `Tokens: ${response.metadata.input_tokens ?? 0} in / ${response.metadata.output_tokens ?? 0} out` + (response.metadata.cost_usd ? ` ($${response.metadata.cost_usd.toFixed(4)})` : "")
+        );
+      }
+      return result;
+    }
+  })
+};
+
+// src/tools/box/logs.ts
+import { z as z12 } from "zod";
+var boxLogsTool = {
+  box_logs: tool({
+    description: `Get logs from an Upstash Box container. Useful for debugging what happened inside the box. Returns timestamped log entries from the system, user, and agent sources.`,
+    get inputSchema() {
+      return z12.object({
+        box_id: z12.string().describe("The box ID to get logs for"),
+        offset: z12.number().optional().default(0).describe("Starting position for log entries (default: 0)"),
+        limit: z12.number().max(1e3).optional().default(100).describe("Maximum number of log entries to return (max 1000, default: 100)"),
+        ...buildBoxCommon()
+      });
+    },
+    handler: async (params) => {
+      const { box_id, offset, limit } = params;
+      const client = getBoxClient(params);
+      const response = await client.get(`v2/box/${box_id}/logs`, {
+        offset,
+        limit
+      });
+      const logs = response.logs ?? [];
+      if (logs.length === 0) {
+        return "No logs found for this box";
+      }
+      return [`Found ${logs.length} log entries`, json(logs)];
+    }
+  })
+};
+
+// src/tools/box/runs.ts
+import { z as z13 } from "zod";
+var boxRunsTool = {
+  box_runs: tool({
+    description: `List, get details, or cancel runs (execution history) for an Upstash Box. Useful for debugging past agent runs and shell executions, checking their status, output, token usage, and costs.`,
+    get inputSchema() {
+      return z13.object({
+        action: z13.enum(["list", "get", "cancel"]).describe("The action to perform"),
+        box_id: z13.string().describe("The box ID"),
+        run_id: z13.string().optional().describe("Run ID (required for get and cancel actions)"),
+        ...buildBoxCommon()
+      });
+    },
+    handler: async (params) => {
+      const { action, box_id, run_id } = params;
+      const client = getBoxClient(params);
+      switch (action) {
+        case "list": {
+          const response = await client.get(`v2/box/${box_id}/runs`);
+          const runs = response.runs ?? [];
+          return [`Found ${runs.length} runs`, json(runs)];
+        }
+        case "get": {
+          if (!run_id) throw new Error("run_id is required for get action");
+          const run = await client.get(`v2/box/${box_id}/runs/${run_id}`);
+          return [`Run ${run_id} (status: ${run.status})`, json(run)];
+        }
+        case "cancel": {
+          if (!run_id) throw new Error("run_id is required for cancel action");
+          await client.post(`v2/box/${box_id}/runs/${run_id}/cancel`);
+          return `Run ${run_id} cancelled successfully`;
+        }
+        default: {
+          throw new Error(`Unknown action: ${action}`);
+        }
+      }
+    }
+  })
+};
+
+// src/tools/box/preview.ts
+import { z as z14 } from "zod";
+var boxPreviewTool = {
+  box_preview: tool({
+    description: `Manage preview URLs for web applications running inside an Upstash Box. Create public URLs to access services running on specific ports, list existing previews, or delete them.`,
+    get inputSchema() {
+      return z14.object({
+        action: z14.enum(["create", "list", "delete"]).describe("The action to perform"),
+        box_id: z14.string().describe("The box ID"),
+        port: z14.number().min(1).max(65535).optional().describe("Port number (required for create and delete)"),
+        basic_auth: z14.boolean().optional().describe("Enable basic auth on the preview URL (create only)"),
+        bearer_token: z14.boolean().optional().describe("Enable bearer token auth on the preview URL (create only)"),
+        ...buildBoxCommon()
+      });
+    },
+    handler: async (params) => {
+      const { action, box_id, port, basic_auth, bearer_token } = params;
+      const client = getBoxClient(params);
+      switch (action) {
+        case "create": {
+          if (!port) throw new Error("port is required for create action");
+          const body = { port };
+          if (basic_auth) body.basic_auth = basic_auth;
+          if (bearer_token) body.bearer_token = bearer_token;
+          const response = await client.post(
+            `v2/box/${box_id}/preview`,
+            body
+          );
+          const result = [
+            `Preview URL created: ${response.url}`,
+            `Port: ${response.port}`
+          ];
+          if (response.username) result.push(`Username: ${response.username}`);
+          if (response.password) result.push(`Password: ${response.password}`);
+          if (response.token) result.push(`Token: ${response.token}`);
+          return result;
+        }
+        case "list": {
+          const response = await client.get(`v2/box/${box_id}/preview`);
+          const previews = response.previews ?? [];
+          return [`Found ${previews.length} preview URLs`, json(previews)];
+        }
+        case "delete": {
+          if (!port) throw new Error("port is required for delete action");
+          await client.delete(`v2/box/${box_id}/preview/${port}`);
+          return `Preview for port ${port} deleted successfully`;
+        }
+        default: {
+          throw new Error(`Unknown action: ${action}`);
+        }
+      }
+    }
+  })
+};
+
+// src/tools/box/snapshots.ts
+import { z as z15 } from "zod";
+var boxSnapshotsTool = {
+  box_snapshots: tool({
+    description: `Manage Upstash Box snapshots. Create full filesystem snapshots of a box, list snapshots, delete them, or restore a box from a snapshot.`,
+    get inputSchema() {
+      return z15.object({
+        action: z15.enum(["create", "list", "list_all", "delete", "restore"]).describe(
+          "The action to perform. 'list' lists snapshots for a specific box, 'list_all' lists all your snapshots"
+        ),
+        box_id: z15.string().optional().describe("Box ID (required for create, list, delete)"),
+        snapshot_id: z15.string().optional().describe("Snapshot ID (required for delete and restore)"),
+        // Create-specific
+        name: z15.string().optional().describe("Name for the snapshot (auto-generated if empty)"),
+        // Restore-specific
+        model: z15.string().optional().describe("LLM model for the restored box (required for restore)"),
+        runtime: z15.string().optional().describe("Override the snapshot's runtime for the restored box"),
+        env_vars: z15.record(z15.string()).optional().describe("Environment variables for the restored box"),
+        ephemeral: z15.boolean().optional().describe("Create the restored box as ephemeral"),
+        ttl: z15.number().optional().describe("TTL in seconds for the restored ephemeral box (max 259200)"),
+        ...buildBoxCommon()
+      });
+    },
+    handler: async (params) => {
+      const { action, box_id, snapshot_id } = params;
+      const client = getBoxClient(params);
+      switch (action) {
+        case "create": {
+          if (!box_id) throw new Error("box_id is required for create action");
+          const body = {};
+          if (params.name) body.name = params.name;
+          const snapshot = await client.post(`v2/box/${box_id}/snapshots`, body);
+          return [
+            `Snapshot created (status: ${snapshot.status})`,
+            `Snapshot ID: ${snapshot.id}`,
+            json(snapshot)
+          ];
+        }
+        case "list": {
+          if (!box_id) throw new Error("box_id is required for list action");
+          const response = await client.get(
+            `v2/box/${box_id}/snapshots`
+          );
+          const snapshots = response.snapshots ?? [];
+          return [`Found ${snapshots.length} snapshots for box ${box_id}`, json(snapshots)];
+        }
+        case "list_all": {
+          const response = await client.get("v2/box/snapshots");
+          const snapshots = response.snapshots ?? [];
+          return [`Found ${snapshots.length} snapshots total`, json(snapshots)];
+        }
+        case "delete": {
+          if (!box_id) throw new Error("box_id is required for delete action");
+          if (!snapshot_id) throw new Error("snapshot_id is required for delete action");
+          await client.delete(`v2/box/${box_id}/snapshots/${snapshot_id}`);
+          return `Snapshot ${snapshot_id} deleted successfully`;
+        }
+        case "restore": {
+          if (!snapshot_id) throw new Error("snapshot_id is required for restore action");
+          if (!params.model) throw new Error("model is required for restore action");
+          const body = {
+            snapshot_id,
+            model: params.model
+          };
+          if (params.runtime) body.runtime = params.runtime;
+          if (params.env_vars) body.env_vars = params.env_vars;
+          if (params.ephemeral !== void 0) body.ephemeral = params.ephemeral;
+          if (params.ttl !== void 0) body.ttl = params.ttl;
+          const box = await client.post("v2/box/from-snapshot", body);
+          return [
+            `Box restored from snapshot (status: ${box.status})`,
+            `New Box ID: ${box.id}`,
+            json(box)
+          ];
+        }
+        default: {
+          throw new Error(`Unknown action: ${action}`);
+        }
+      }
+    }
+  })
+};
+
+// src/tools/box/index.ts
+var boxTools = {
+  ...boxManageTool,
+  ...boxExecTool,
+  ...boxAgentRunTool,
+  ...boxLogsTool,
+  ...boxRunsTool,
+  ...boxPreviewTool,
+  ...boxSnapshotsTool
+};
+
 // src/tools/index.ts
-var json = (json2) => typeof json2 === "string" ? json2 : JSON.stringify(json2, null, 2);
 var tools = {
   ...redisTools,
-  ...qstashAllTools
+  ...qstashAllTools,
+  ...boxTools
 };
-function tool(tool2) {
-  return tool2;
-}
 
 // src/settings.ts
 var MAX_MESSAGE_LENGTH = 3e4;
@@ -1087,7 +1620,7 @@ function handlerResponseToCallResult(response) {
 }
 
 // src/server.ts
-import z7 from "zod";
+import z16 from "zod";
 function createServerInstance() {
   const server = new McpServer(
     { name: "upstash", version: "0.1.0" },
@@ -1098,7 +1631,8 @@ function createServerInstance() {
       }
     }
   );
-  const toolsList = Object.entries(tools).map(([name, tool2]) => ({
+  const filteredTools = config.readonly ? Object.fromEntries(Object.entries(tools).filter(([_, tool2]) => tool2.readonly)) : tools;
+  const toolsList = Object.entries(filteredTools).map(([name, tool2]) => ({
     name,
     description: tool2.description,
     inputSchema: tool2.inputSchema,
@@ -1111,7 +1645,7 @@ function createServerInstance() {
       toolName,
       {
         description: tool2.description,
-        inputSchema: (tool2.inputSchema ?? z7.object({})).shape
+        inputSchema: (tool2.inputSchema ?? z16.object({})).shape
       },
       // @ts-expect-error - Just ignore the types here
       async (args) => {
@@ -1148,6 +1682,7 @@ Stack trace: ${error instanceof Error ? error.stack : "No stack trace available"
 }
 
 // src/test-connection.ts
+var READONLY_ERROR = "Readonly API key";
 async function testConnection() {
   log("\u{1F9EA} Testing connection to Upstash API");
   let dbs;
@@ -1162,6 +1697,14 @@ async function testConnection() {
   }
   if (!Array.isArray(dbs))
     throw new Error("Invalid response from Upstash API. Check your API key and email.");
+  try {
+    await http.delete("v2/redis/database/readonly-check-nonexistent");
+  } catch (error) {
+    if (error instanceof Error && error.message.includes(READONLY_ERROR)) {
+      config.readonly = true;
+      log("\u{1F512} Readonly API key detected. Write operations will be disabled.");
+    }
+  }
   log("\u2705 Connection to Upstash API is successful");
 }
 
@@ -1171,10 +1714,13 @@ var argv = process.argv.slice(2);
 if (argv.length >= 3 && argv[0] === "run") {
   argv = ["--email", argv[1], "--api-key", argv[2], ...argv.slice(3)];
 }
-var program = new Command().option("--transport <stdio|http>", "transport type", "stdio").option("--port <number>", "port for HTTP transport", "3000").option("--email <email>", "Upstash email").option("--api-key <key>", "Upstash API key").option("--debug", "Enable debug mode").allowUnknownOption();
+var program = new Command().option("--transport <stdio|http>", "transport type", "stdio").option("--port <number>", "port for HTTP transport", "3000").option("--email <email>", "Upstash email").option("--api-key <key>", "Upstash API key").option("--box-api-key <key>", "Upstash Box API key (optional)").option("--debug", "Enable debug mode").option("--disable-telemetry", "Disable telemetry headers sent to Upstash APIs").allowUnknownOption();
 program.parse(argv, { from: "user" });
 var cliOptions = program.opts();
 var DEBUG = cliOptions.debug ?? false;
+if (DEBUG) {
+  initDebugLog(new URL("../", import.meta.url).pathname);
+}
 var allowedTransports = ["stdio", "http"];
 if (!allowedTransports.includes(cliOptions.transport)) {
   console.error(
@@ -1203,6 +1749,8 @@ async function main() {
   }
   config.email = email;
   config.apiKey = apiKey;
+  config.boxApiKey = cliOptions.boxApiKey || process.env.UPSTASH_BOX_API_KEY || "";
+  config.disableTelemetry = cliOptions.disableTelemetry ?? false;
   await testConnection();
   const transportType = TRANSPORT_TYPE;
   if (transportType === "http") {