@veertu/anka-mcp 0.1.0

package/dist/tools/define-tool.js

@@ -0,0 +1,51 @@
+import { config } from "../config.js";
+import { limitActorFromContext, logLimitReached, logToolCall, logToolError } from "../log.js";
+/**
+ * Declare an MCP tool in one place. Add the returned object to the `tools`
+ * array in `tools/index.ts` and it is wired up automatically.
+ */
+export function defineTool(spec) {
+    return {
+        ...spec,
+        register(server) {
+            const handler = this.handler;
+            const name = this.name;
+            server.registerTool(this.name, this.config, (async (args, extra) => {
+                try {
+                    const result = await handler(args, extra);
+                    logToolCall(name, args, result);
+                    return result;
+                }
+                catch (error) {
+                    logToolError(name, args, error);
+                    throw error;
+                }
+            }));
+        }
+    };
+}
+/** Serialize a value into a CallToolResult with a single JSON text block. */
+export function jsonResult(value, isError = false) {
+    let text = JSON.stringify(value, null, 2);
+    const originalLength = text.length;
+    if (text.length > config.maxResponseChars) {
+        logLimitReached({
+            limit: "MCP_MAX_RESPONSE_CHARS",
+            configured: String(config.maxResponseChars),
+            actor: limitActorFromContext(),
+            detail: `response_chars=${originalLength}`
+        });
+        text = JSON.stringify({
+            truncated: true,
+            preview: text.slice(0, Math.max(0, config.maxResponseChars - 64))
+        }, null, 2);
+        if (text.length > config.maxResponseChars) {
+            text = `${text.slice(0, config.maxResponseChars - 1)}…`;
+        }
+    }
+    return {
+        content: [{ type: "text", text }],
+        isError
+    };
+}
+//# sourceMappingURL=define-tool.js.map

package/dist/tools/define-tool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"define-tool.js","sourceRoot":"","sources":["../../src/tools/define-tool.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAuB9F;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAgC,IAIzD;IACC,OAAO;QACL,GAAG,IAAI;QACP,QAAQ,CAAC,MAAiB;YACxB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;YAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YACvB,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;gBACjE,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;oBAC1C,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;oBAChC,OAAO,MAAM,CAAC;gBAChB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;oBAChC,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC,CAA4B,CAAC,CAAC;QACjC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,UAAU,CAAC,KAAc,EAAE,OAAO,GAAG,KAAK;IACxD,IAAI,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1C,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC;IACnC,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC1C,eAAe,CAAC;YACd,KAAK,EAAE,wBAAwB;YAC/B,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC;YAC3C,KAAK,EAAE,qBAAqB,EAAE;YAC9B,MAAM,EAAE,kBAAkB,cAAc,EAAE;SAC3C,CAAC,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,SAAS,CACnB;YACE,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,gBAAgB,GAAG,EAAE,CAAC,CAAC;SAClE,EACD,IAAI,EACJ,CAAC,CACF,CAAC;QACF,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC1C,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,gBAAgB,GAAG,CAAC,CAAC,GAAG,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACjC,OAAO;KACR,CAAC;AACJ,CAAC"}

package/dist/tools/index.d.ts

@@ -0,0 +1,8 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { ToolDefinition } from "./define-tool.js";
+export { defineTool, jsonResult } from "./define-tool.js";
+export type { ToolDefinition } from "./define-tool.js";
+/** Build the list of tools to expose, based on which backends are enabled. */
+export declare function enabledTools(): ToolDefinition<any>[];
+/** Register every enabled tool on the given server. */
+export declare function registerTools(server: McpServer): void;

package/dist/tools/index.js

@@ -0,0 +1,20 @@
+import { config } from "../config.js";
+import { controllerTools } from "./controller/index.js";
+import { localTools } from "./local/index.js";
+export { defineTool, jsonResult } from "./define-tool.js";
+/** Build the list of tools to expose, based on which backends are enabled. */
+export function enabledTools() {
+    const tools = [];
+    if (config.controllerEnabled)
+        tools.push(...controllerTools);
+    if (config.localEnabled)
+        tools.push(...localTools);
+    return tools;
+}
+/** Register every enabled tool on the given server. */
+export function registerTools(server) {
+    for (const tool of enabledTools()) {
+        tool.register(server);
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/tools/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAG1D,8EAA8E;AAC9E,MAAM,UAAU,YAAY;IAC1B,MAAM,KAAK,GAA0B,EAAE,CAAC;IACxC,IAAI,MAAM,CAAC,iBAAiB;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,CAAC;IAC7D,IAAI,MAAM,CAAC,YAAY;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC;IACnD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,aAAa,CAAC,MAAiB;IAC7C,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;AACH,CAAC"}

package/dist/tools/local/delete-vm.d.ts

@@ -0,0 +1,3 @@
+export declare const localDeleteVmTool: import("../define-tool.js").ToolDefinition<{
+    name: import("zod").ZodString;
+}>;

package/dist/tools/local/delete-vm.js

@@ -0,0 +1,20 @@
+import { runAnka } from "../../anka.js";
+import { defineTool } from "../define-tool.js";
+import { localResult, vmNameSchema } from "./vms.js";
+export const localDeleteVmTool = defineTool({
+    name: "local_delete_vm",
+    config: {
+        title: "Delete a local VM",
+        description: "Delete a single local VM by name or uuid. A name is always required; this tool " +
+            "can only delete one specific VM and can never delete all VMs.",
+        inputSchema: {
+            name: vmNameSchema.describe("Name or uuid of the VM to delete.")
+        },
+        annotations: { title: "Delete a local VM", destructiveHint: true }
+    },
+    handler: async ({ name }) => {
+        const result = await runAnka(["delete", "--yes", name]);
+        return localResult(result, { name, deleted: true });
+    }
+});
+//# sourceMappingURL=delete-vm.js.map

package/dist/tools/local/delete-vm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete-vm.js","sourceRoot":"","sources":["../../../src/tools/local/delete-vm.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAErD,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC;IAC1C,IAAI,EAAE,iBAAiB;IACvB,MAAM,EAAE;QACN,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,iFAAiF;YACjF,+DAA+D;QACjE,WAAW,EAAE;YACX,IAAI,EAAE,YAAY,CAAC,QAAQ,CAAC,mCAAmC,CAAC;SACjE;QACD,WAAW,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,eAAe,EAAE,IAAI,EAAE;KACnE;IACD,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;QAC1B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QACxD,OAAO,WAAW,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;CACF,CAAC,CAAC"}

package/dist/tools/local/index.d.ts

@@ -0,0 +1,3 @@
+import type { ToolDefinition } from "../define-tool.js";
+/** Tools exposed when the local anka CLI backend is enabled. */
+export declare const localTools: ToolDefinition<any>[];

package/dist/tools/local/index.js

@@ -0,0 +1,14 @@
+import { localListTemplatesTool } from "./list-templates.js";
+import { localStartVmTool } from "./start-vm.js";
+import { localShowVmTool } from "./show-vm.js";
+import { localDeleteVmTool } from "./delete-vm.js";
+import { localSshAccessTool } from "./ssh-access.js";
+/** Tools exposed when the local anka CLI backend is enabled. */
+export const localTools = [
+    localListTemplatesTool,
+    localStartVmTool,
+    localShowVmTool,
+    localDeleteVmTool,
+    localSshAccessTool
+];
+//# sourceMappingURL=index.js.map

package/dist/tools/local/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/tools/local/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD,gEAAgE;AAChE,MAAM,CAAC,MAAM,UAAU,GAA0B;IAC/C,sBAAsB;IACtB,gBAAgB;IAChB,eAAe;IACf,iBAAiB;IACjB,kBAAkB;CACnB,CAAC"}

package/dist/tools/local/list-templates.d.ts

@@ -0,0 +1 @@
+export declare const localListTemplatesTool: import("../define-tool.js").ToolDefinition<{}>;

package/dist/tools/local/list-templates.js

@@ -0,0 +1,17 @@
+import { defineTool, jsonResult } from "../define-tool.js";
+import { listVms } from "./vms.js";
+export const localListTemplatesTool = defineTool({
+    name: "local_list_templates",
+    config: {
+        title: "List local VMs and templates",
+        description: "List the local Anka VM library (templates and clones) with their name, uuid, " +
+            "and status. Use this to find the template to clone from.",
+        inputSchema: {},
+        annotations: { title: "List local VMs and templates", readOnlyHint: true }
+    },
+    handler: async () => {
+        const vms = await listVms();
+        return jsonResult({ vms: vms.map((vm) => ({ name: vm.name, uuid: vm.uuid })) });
+    }
+});
+//# sourceMappingURL=list-templates.js.map

package/dist/tools/local/list-templates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-templates.js","sourceRoot":"","sources":["../../../src/tools/local/list-templates.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAEnC,MAAM,CAAC,MAAM,sBAAsB,GAAG,UAAU,CAAC;IAC/C,IAAI,EAAE,sBAAsB;IAC5B,MAAM,EAAE;QACN,KAAK,EAAE,8BAA8B;QACrC,WAAW,EACT,+EAA+E;YAC/E,0DAA0D;QAC5D,WAAW,EAAE,EAAE;QACf,WAAW,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,YAAY,EAAE,IAAI,EAAE;KAC3E;IACD,OAAO,EAAE,KAAK,IAAI,EAAE;QAClB,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAC;QAC5B,OAAO,UAAU,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;CACF,CAAC,CAAC"}

package/dist/tools/local/show-vm.d.ts

@@ -0,0 +1,3 @@
+export declare const localShowVmTool: import("../define-tool.js").ToolDefinition<{
+    name: import("zod").ZodString;
+}>;

package/dist/tools/local/show-vm.js

@@ -0,0 +1,23 @@
+import { runAnka } from "../../anka.js";
+import { defineTool, jsonResult } from "../define-tool.js";
+import { ankaError, vmNameSchema } from "./vms.js";
+export const localShowVmTool = defineTool({
+    name: "local_show_vm",
+    config: {
+        title: "Show a local VM",
+        description: "Get a local VM's IP address by name or uuid. The IP is only present once the VM is running.",
+        inputSchema: {
+            name: vmNameSchema.describe("Name or uuid of the VM to show.")
+        },
+        annotations: { title: "Show a local VM", readOnlyHint: true }
+    },
+    handler: async ({ name }) => {
+        const result = await runAnka(["show", name]);
+        if (!result.ok) {
+            return jsonResult({ ok: false, error: ankaError(result) }, true);
+        }
+        const body = (result.body ?? {});
+        return jsonResult({ ok: true, ip: body.ip ?? null });
+    }
+});
+//# sourceMappingURL=show-vm.js.map

package/dist/tools/local/show-vm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"show-vm.js","sourceRoot":"","sources":["../../../src/tools/local/show-vm.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAMnD,MAAM,CAAC,MAAM,eAAe,GAAG,UAAU,CAAC;IACxC,IAAI,EAAE,eAAe;IACrB,MAAM,EAAE;QACN,KAAK,EAAE,iBAAiB;QACxB,WAAW,EAAE,6FAA6F;QAC1G,WAAW,EAAE;YACX,IAAI,EAAE,YAAY,CAAC,QAAQ,CAAC,iCAAiC,CAAC;SAC/D;QACD,WAAW,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,IAAI,EAAE;KAC9D;IACD,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;QAC1B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,UAAU,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAiB,CAAC;QACjD,OAAO,UAAU,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;CACF,CAAC,CAAC"}

package/dist/tools/local/ssh-access.d.ts

@@ -0,0 +1,3 @@
+export declare const localSshAccessTool: import("../define-tool.js").ToolDefinition<{
+    name: import("zod").ZodString;
+}>;

package/dist/tools/local/ssh-access.js

@@ -0,0 +1,68 @@
+import { randomUUID } from "node:crypto";
+import { runAnka } from "../../anka.js";
+import { config } from "../../config.js";
+import { buildSshCommand, generateSshKeypair } from "../../ssh-key.js";
+import { defineTool, jsonResult } from "../define-tool.js";
+import { ankaError, showVm, vmNameSchema, waitForVmIp } from "./vms.js";
+export const localSshAccessTool = defineTool({
+    name: "local_ssh_access",
+    config: {
+        title: "Prepare SSH access to a local VM",
+        description: "Provision SSH access to a running local VM: generates a temporary SSH key, " +
+            "installs the public key into the VM's authorized_keys (via anka cp + anka run), " +
+            "and returns the private key path plus a ready-to-use ssh command. The VM must be " +
+            "running and have Remote Login (sshd) enabled in its template.",
+        inputSchema: {
+            name: vmNameSchema.describe("Name or uuid of the running VM to access.")
+        },
+        annotations: { title: "Prepare SSH access to a local VM" }
+    },
+    handler: async ({ name }) => {
+        const shown = await showVm(name);
+        if (!shown.ok) {
+            return jsonResult({ ok: false, error: shown.error }, true);
+        }
+        if (shown.info.status !== "running") {
+            return jsonResult({ ok: false, error: `VM "${name}" is not running; start it first.` }, true);
+        }
+        // The VM is up but its IP may still be coming online; wait it out.
+        let ip = shown.info.ip;
+        if (!ip) {
+            const waited = await waitForVmIp(name);
+            if (!waited.found) {
+                return jsonResult({ ok: false, error: waited.error }, true);
+            }
+            ip = waited.ip;
+        }
+        const { privateKeyPath } = await generateSshKeypair();
+        // Copy the public key into the VM, then install it into authorized_keys.
+        const remotePubPath = `/tmp/anka-mcp-${randomUUID()}.pub`;
+        const copyIn = await runAnka(["cp", `${privateKeyPath}.pub`, `${name}:${remotePubPath}`], {
+            machineReadable: false
+        });
+        if (!copyIn.ok) {
+            return jsonResult({ ok: false, error: `anka cp failed: ${ankaError(copyIn)}` }, true);
+        }
+        const installScript = `set -e; mkdir -p ~/.ssh; chmod 700 ~/.ssh; ` +
+            `cat ${remotePubPath} >> ~/.ssh/authorized_keys; chmod 600 ~/.ssh/authorized_keys; ` +
+            `rm -f ${remotePubPath}`;
+        const install = await runAnka(["run", name, "sh", "-c", installScript], {
+            machineReadable: false
+        });
+        if (!install.ok) {
+            return jsonResult({ ok: false, error: `Installing the key failed: ${ankaError(install)}` }, true);
+        }
+        const port = config.vmSshGuestPort;
+        const user = config.vmSshUser;
+        const command = buildSshCommand({ privateKeyPath, host: ip, port, user });
+        return jsonResult({
+            ok: true,
+            ip,
+            port,
+            user,
+            private_key_path: privateKeyPath,
+            command
+        });
+    }
+});
+//# sourceMappingURL=ssh-access.js.map

package/dist/tools/local/ssh-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh-access.js","sourceRoot":"","sources":["../../../src/tools/local/ssh-access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAExE,MAAM,CAAC,MAAM,kBAAkB,GAAG,UAAU,CAAC;IAC3C,IAAI,EAAE,kBAAkB;IACxB,MAAM,EAAE;QACN,KAAK,EAAE,kCAAkC;QACzC,WAAW,EACT,6EAA6E;YAC7E,kFAAkF;YAClF,mFAAmF;YACnF,+DAA+D;QACjE,WAAW,EAAE;YACX,IAAI,EAAE,YAAY,CAAC,QAAQ,CAAC,2CAA2C,CAAC;SACzE;QACD,WAAW,EAAE,EAAE,KAAK,EAAE,kCAAkC,EAAE;KAC3D;IACD,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;QAC1B,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,OAAO,UAAU,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,UAAU,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,IAAI,mCAAmC,EAAE,EAAE,IAAI,CAAC,CAAC;QAChG,CAAC;QAED,mEAAmE;QACnE,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAClB,OAAO,UAAU,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;YAC9D,CAAC;YACD,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC;QACjB,CAAC;QAED,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,kBAAkB,EAAE,CAAC;QAEtD,yEAAyE;QACzE,MAAM,aAAa,GAAG,iBAAiB,UAAU,EAAE,MAAM,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,CAAC,IAAI,EAAE,GAAG,cAAc,MAAM,EAAE,GAAG,IAAI,IAAI,aAAa,EAAE,CAAC,EAAE;YACxF,eAAe,EAAE,KAAK;SACvB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,UAAU,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QACxF,CAAC;QAED,MAAM,aAAa,GACjB,6CAA6C;YAC7C,OAAO,aAAa,gEAAgE;YACpF,SAAS,aAAa,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,EAAE;YACtE,eAAe,EAAE,KAAK;SACvB,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,UAAU,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QACpG,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC;QAC9B,MAAM,OAAO,GAAG,eAAe,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1E,OAAO,UAAU,CAAC;YAChB,EAAE,EAAE,IAAI;YACR,EAAE;YACF,IAAI;YACJ,IAAI;YACJ,gBAAgB,EAAE,cAAc;YAChC,OAAO;SACR,CAAC,CAAC;IACL,CAAC;CACF,CAAC,CAAC"}

package/dist/tools/local/start-vm.d.ts

@@ -0,0 +1,7 @@
+import { z } from "zod";
+export declare const localStartVmTool: import("../define-tool.js").ToolDefinition<{
+    template: z.ZodString;
+    name: z.ZodOptional<z.ZodString>;
+    wait: z.ZodOptional<z.ZodBoolean>;
+    timeoutSeconds: z.ZodOptional<z.ZodNumber>;
+}>;

package/dist/tools/local/start-vm.js

@@ -0,0 +1,52 @@
+import { randomUUID } from "node:crypto";
+import { z } from "zod";
+import { runAnka } from "../../anka.js";
+import { timeoutSecondsSchema } from "../../security/schemas.js";
+import { defineTool, jsonResult } from "../define-tool.js";
+import { ankaError, assertRunningCapacity, vmNameSchema, waitForVmIp } from "./vms.js";
+export const localStartVmTool = defineTool({
+    name: "local_start_vm",
+    config: {
+        title: "Start a local VM from a template",
+        description: "Clone the given template into a fresh, disposable VM and start it. The original " +
+            "template is never started or modified. Use local_list_templates to find a template. " +
+            "Refused if the running-VM limit (ANKA_LOCAL_MAX_VMS) is already met. By default this " +
+            "waits for the new VM to boot and obtain an IP, then returns its name and IP so you do " +
+            "not need to poll. Delete the VM with local_delete_vm when finished.",
+        inputSchema: {
+            template: vmNameSchema.describe("Name or uuid of the template to clone from."),
+            name: vmNameSchema
+                .optional()
+                .describe("Optional name for the new VM. Defaults to an auto-generated name."),
+            wait: z
+                .boolean()
+                .optional()
+                .describe("Wait for the VM to obtain an IP before returning. Defaults to true."),
+            timeoutSeconds: timeoutSecondsSchema
+                .optional()
+                .describe("Override how long to wait for the IP, in seconds.")
+        },
+        annotations: { title: "Start a local VM from a template" }
+    },
+    handler: async ({ template, name, wait, timeoutSeconds }) => {
+        await assertRunningCapacity("start a VM");
+        const vmName = name ?? `mcp-${randomUUID().slice(0, 8)}`;
+        const cloned = await runAnka(["clone", template, vmName]);
+        if (!cloned.ok) {
+            return jsonResult({ ok: false, error: `Clone failed: ${ankaError(cloned)}` }, true);
+        }
+        const started = await runAnka(["start", vmName]);
+        if (!started.ok) {
+            return jsonResult({ ok: false, name: vmName, error: ankaError(started) }, true);
+        }
+        if (wait === false) {
+            return jsonResult({ ok: true, name: vmName, source: template });
+        }
+        const waited = await waitForVmIp(vmName, timeoutSeconds ? { timeoutMs: timeoutSeconds * 1000 } : {});
+        if (!waited.found) {
+            return jsonResult({ ok: false, name: vmName, source: template, error: waited.error }, true);
+        }
+        return jsonResult({ ok: true, name: vmName, source: template, ip: waited.ip });
+    }
+});
+//# sourceMappingURL=start-vm.js.map

package/dist/tools/local/start-vm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"start-vm.js","sourceRoot":"","sources":["../../../src/tools/local/start-vm.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAEvF,MAAM,CAAC,MAAM,gBAAgB,GAAG,UAAU,CAAC;IACzC,IAAI,EAAE,gBAAgB;IACtB,MAAM,EAAE;QACN,KAAK,EAAE,kCAAkC;QACzC,WAAW,EACT,kFAAkF;YAClF,sFAAsF;YACtF,uFAAuF;YACvF,wFAAwF;YACxF,qEAAqE;QACvE,WAAW,EAAE;YACX,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC,6CAA6C,CAAC;YAC9E,IAAI,EAAE,YAAY;iBACf,QAAQ,EAAE;iBACV,QAAQ,CAAC,mEAAmE,CAAC;YAChF,IAAI,EAAE,CAAC;iBACJ,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,QAAQ,CAAC,qEAAqE,CAAC;YAClF,cAAc,EAAE,oBAAoB;iBACjC,QAAQ,EAAE;iBACV,QAAQ,CAAC,mDAAmD,CAAC;SACjE;QACD,WAAW,EAAE,EAAE,KAAK,EAAE,kCAAkC,EAAE;KAC3D;IACD,OAAO,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE;QAC1D,MAAM,qBAAqB,CAAC,YAAY,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAG,IAAI,IAAI,OAAO,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAEzD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,UAAU,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,UAAU,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACnB,OAAO,UAAU,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAC9B,MAAM,EACN,cAAc,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,cAAc,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAC3D,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,OAAO,UAAU,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,UAAU,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IACjF,CAAC;CACF,CAAC,CAAC"}

package/dist/tools/local/vms.d.ts

@@ -0,0 +1,62 @@
+import type { CallToolResult } from "@modelcontextprotocol/sdk/types.js";
+import { type AnkaResult } from "../../anka.js";
+/**
+ * A VM/template identifier. Rejects empty values and anything starting with
+ * "-" so a name can never be reinterpreted as a CLI flag (e.g. "--all").
+ */
+export declare const vmNameSchema: import("zod").ZodString;
+/** A row from `anka -j list`. */
+export interface AnkaVm {
+    name?: string;
+    uuid?: string;
+    status?: string;
+    version?: string;
+    [key: string]: unknown;
+}
+/** Return the local VM library as parsed by `anka -j list`. */
+export declare function listVms(): Promise<AnkaVm[]>;
+/** Extract a concise error string from a failed anka invocation. */
+export declare function ankaError(result: AnkaResult): string;
+/**
+ * Turn an anka result into a narrow tool result: a clean error on failure, or
+ * the provided success fields on success. Keeps verbose CLI output (stdout,
+ * args, exit codes) out of the agent's context.
+ */
+export declare function localResult(result: AnkaResult, success: Record<string, unknown>): CallToolResult;
+/** The two fields of `anka -j show` the local backend relies on. */
+export interface VmShowInfo {
+    status?: string;
+    ip?: string;
+}
+/** Run `anka -j show <name>` and return its parsed body. */
+export declare function showVm(name: string): Promise<{
+    ok: true;
+    info: VmShowInfo;
+} | {
+    ok: false;
+    error: string;
+}>;
+export type WaitForIpResult = {
+    found: true;
+    ip: string;
+} | {
+    found: false;
+    error: string;
+};
+/**
+ * Poll `anka show` until the VM is running and has an IP, so callers can wait
+ * out VM boot in a single tool call instead of re-checking repeatedly. Fails
+ * fast on a hard CLI error (e.g. unknown VM) and gives up after the timeout.
+ */
+export declare function waitForVmIp(name: string, opts?: {
+    timeoutMs?: number;
+    intervalMs?: number;
+}): Promise<WaitForIpResult>;
+/** Count VMs currently in the "running" state. */
+export declare function countRunningVms(): Promise<number>;
+/**
+ * Throw if starting another VM would exceed the configured running-VM limit.
+ * Anka's local (non-Build) license permits a small number of concurrent VMs,
+ * so this keeps the agent from blowing past it.
+ */
+export declare function assertRunningCapacity(action: string): Promise<void>;

package/dist/tools/local/vms.js

@@ -0,0 +1,91 @@
+import { runAnka } from "../../anka.js";
+import { config } from "../../config.js";
+import { boundedName } from "../../security/schemas.js";
+import { sanitizeCliError } from "../../security/sanitize.js";
+import { jsonResult } from "../define-tool.js";
+/**
+ * A VM/template identifier. Rejects empty values and anything starting with
+ * "-" so a name can never be reinterpreted as a CLI flag (e.g. "--all").
+ */
+export const vmNameSchema = boundedName;
+/** Return the local VM library as parsed by `anka -j list`. */
+export async function listVms() {
+    const result = await runAnka(["list"]);
+    if (!result.ok) {
+        throw new Error(result.message || "Failed to list local VMs");
+    }
+    return Array.isArray(result.body) ? result.body : [];
+}
+/** Extract a concise error string from a failed anka invocation. */
+export function ankaError(result) {
+    if (result.message)
+        return result.message;
+    const stderr = result.stderr.trim();
+    if (stderr)
+        return sanitizeCliError(stderr);
+    return `anka exited with code ${result.exitCode}`;
+}
+/**
+ * Turn an anka result into a narrow tool result: a clean error on failure, or
+ * the provided success fields on success. Keeps verbose CLI output (stdout,
+ * args, exit codes) out of the agent's context.
+ */
+export function localResult(result, success) {
+    if (!result.ok) {
+        return jsonResult({ ok: false, error: ankaError(result) }, true);
+    }
+    return jsonResult({ ok: true, ...success });
+}
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/** Run `anka -j show <name>` and return its parsed body. */
+export async function showVm(name) {
+    const result = await runAnka(["show", name]);
+    if (!result.ok)
+        return { ok: false, error: ankaError(result) };
+    return { ok: true, info: (result.body ?? {}) };
+}
+/**
+ * Poll `anka show` until the VM is running and has an IP, so callers can wait
+ * out VM boot in a single tool call instead of re-checking repeatedly. Fails
+ * fast on a hard CLI error (e.g. unknown VM) and gives up after the timeout.
+ */
+export async function waitForVmIp(name, opts = {}) {
+    const timeoutMs = opts.timeoutMs ?? config.localIpTimeoutMs;
+    const intervalMs = opts.intervalMs ?? config.localPollIntervalMs;
+    const deadline = Date.now() + timeoutMs;
+    let lastStatus;
+    for (;;) {
+        const shown = await showVm(name);
+        if (!shown.ok)
+            return { found: false, error: shown.error };
+        lastStatus = shown.info.status;
+        if (shown.info.status === "running" && shown.info.ip) {
+            return { found: true, ip: shown.info.ip };
+        }
+        if (Date.now() >= deadline) {
+            return {
+                found: false,
+                error: `Timed out after ${Math.round(timeoutMs / 1000)}s waiting for an IP (last status: ${lastStatus ?? "unknown"}).`
+            };
+        }
+        await sleep(intervalMs);
+    }
+}
+/** Count VMs currently in the "running" state. */
+export async function countRunningVms() {
+    const vms = await listVms();
+    return vms.filter((vm) => vm.status === "running").length;
+}
+/**
+ * Throw if starting another VM would exceed the configured running-VM limit.
+ * Anka's local (non-Build) license permits a small number of concurrent VMs,
+ * so this keeps the agent from blowing past it.
+ */
+export async function assertRunningCapacity(action) {
+    const running = await countRunningVms();
+    if (running >= config.localMaxVms) {
+        throw new Error(`Cannot ${action}: ${running} VM(s) already running, which meets the limit of ` +
+            `${config.localMaxVms} (ANKA_LOCAL_MAX_VMS). Stop or delete a VM first.`);
+    }
+}
+//# sourceMappingURL=vms.js.map

package/dist/tools/local/vms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vms.js","sourceRoot":"","sources":["../../../src/tools/local/vms.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAmB,MAAM,eAAe,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,WAAW,CAAC;AAWxC,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,OAAO;IAC3B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,0BAA0B,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,MAAM,CAAC,IAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;AACrE,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,SAAS,CAAC,MAAkB;IAC1C,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,MAAM;QAAE,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC5C,OAAO,yBAAyB,MAAM,CAAC,QAAQ,EAAE,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAAkB,EAAE,OAAgC;IAC9E,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,UAAU,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,UAAU,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAQtF,4DAA4D;AAC5D,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAY;IACvC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;IAC/D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAe,EAAE,CAAC;AAC/D,CAAC;AAID;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAY,EACZ,OAAoD,EAAE;IAEtD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,gBAAgB,CAAC;IAC5D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,mBAAmB,CAAC;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,IAAI,UAA8B,CAAC;IAEnC,SAAS,CAAC;QACR,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QAC3D,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;QAC/B,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACrD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QAC5C,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC3B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,mBAAmB,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,qCAAqC,UAAU,IAAI,SAAS,IAAI;aACvH,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,kDAAkD;AAClD,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAC;IAC5B,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAAc;IACxD,MAAM,OAAO,GAAG,MAAM,eAAe,EAAE,CAAC;IACxC,IAAI,OAAO,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,UAAU,MAAM,KAAK,OAAO,mDAAmD;YAC7E,GAAG,MAAM,CAAC,WAAW,mDAAmD,CAC3E,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/transports/admin.d.ts

@@ -0,0 +1,3 @@
+import express, { type NextFunction, type Request, type Response } from "express";
+/** Register admin routes for client token lifecycle management. */
+export declare function registerAdminRoutes(app: express.Application, rateLimit: (req: Request, res: Response, next: NextFunction) => void): void;

package/dist/transports/admin.js

@@ -0,0 +1,74 @@
+import { timingSafeEqual } from "node:crypto";
+import express, { Router } from "express";
+import { config } from "../config.js";
+import { clientSourceFromRequest, logAdminEvent, logAuthFailure } from "../log.js";
+import { cleanupCredentialInstances } from "../tokens/cleanup.js";
+import { getTokenStore } from "../tokens/store.js";
+/** Constant-time string comparison that tolerates differing lengths. */
+function safeEqual(a, b) {
+    const bufA = Buffer.from(a);
+    const bufB = Buffer.from(b);
+    if (bufA.length !== bufB.length)
+        return false;
+    return timingSafeEqual(bufA, bufB);
+}
+function bearerToken(req) {
+    const header = req.headers.authorization ?? "";
+    return header.startsWith("Bearer ") ? header.slice("Bearer ".length).trim() : "";
+}
+function adminGuard(req, res, next) {
+    const token = bearerToken(req);
+    if (!token || !safeEqual(token, config.adminToken)) {
+        logAuthFailure(clientSourceFromRequest(req), "/admin");
+        res
+            .status(401)
+            .set("WWW-Authenticate", "Bearer")
+            .json({ ok: false, error: "Unauthorized" });
+        return;
+    }
+    next();
+}
+/** Register admin routes for client token lifecycle management. */
+export function registerAdminRoutes(app, rateLimit) {
+    if (!config.adminToken)
+        return;
+    const router = Router();
+    router.use(express.json({ limit: config.maxBodyBytes }));
+    router.use(rateLimit);
+    router.use(adminGuard);
+    router.post("/tokens", (req, res) => {
+        const label = typeof req.body?.label === "string" ? req.body.label : "";
+        const created = getTokenStore().createToken(label);
+        logAdminEvent("token created", { id: created.id, label: created.label });
+        res.status(201).json({ ok: true, id: created.id, label: created.label, token: created.token });
+    });
+    router.get("/tokens", (_req, res) => {
+        const tokens = getTokenStore().listTokens();
+        res.json({ tokens });
+    });
+    router.delete("/tokens/:id", async (req, res) => {
+        const id = String(req.params.id);
+        const existing = getTokenStore().getTokenById(id);
+        if (!existing) {
+            res.status(404).json({ ok: false, error: `Token not found: ${id}` });
+            return;
+        }
+        if (existing.revoked) {
+            res.status(400).json({ ok: false, error: `Token already revoked: ${id}` });
+            return;
+        }
+        let instanceIds = [];
+        try {
+            ({ instanceIds } = getTokenStore().revokeToken(id));
+        }
+        catch (error) {
+            res.status(400).json({ ok: false, error: String(error) });
+            return;
+        }
+        logAdminEvent("token revoked", { id, label: existing.label });
+        const cleanup = await cleanupCredentialInstances(id, instanceIds);
+        res.json({ ok: true, id, revoked: true, cleanup });
+    });
+    app.use("/admin", router);
+}
+//# sourceMappingURL=admin.js.map

package/dist/transports/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../../src/transports/admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,OAAO,EAAE,EAAkD,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1F,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,uBAAuB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACnF,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,wEAAwE;AACxE,SAAS,SAAS,CAAC,CAAS,EAAE,CAAS;IACrC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IAC/C,OAAO,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACnF,CAAC;AAED,SAAS,UAAU,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IACjE,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QACnD,cAAc,CAAC,uBAAuB,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;QACvD,GAAG;aACA,MAAM,CAAC,GAAG,CAAC;aACX,GAAG,CAAC,kBAAkB,EAAE,QAAQ,CAAC;aACjC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,mBAAmB,CACjC,GAAwB,EACxB,SAAoE;IAEpE,IAAI,CAAC,MAAM,CAAC,UAAU;QAAE,OAAO;IAE/B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IACzD,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtB,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAEvB,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QACrD,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACnD,aAAa,CAAC,eAAe,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACzE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IACjG,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QACrD,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC,UAAU,EAAE,CAAC;QAC5C,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACjE,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,aAAa,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,EAAE,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QACD,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QAED,IAAI,WAAW,GAAa,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,CAAC,EAAE,WAAW,EAAE,GAAG,aAAa,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,aAAa,CAAC,eAAe,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;QAClE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AAC5B,CAAC"}

package/dist/transports/http.d.ts

@@ -0,0 +1,14 @@
+declare module "express-serve-static-core" {
+    interface Request {
+        mcpCredential?: {
+            credentialId: string;
+            credentialLabel?: string;
+        };
+    }
+}
+/**
+ * Run the MCP server over streamable HTTP. Each MCP session gets its own
+ * server + transport pair, keyed by the session id the SDK assigns on
+ * initialize.
+ */
+export declare function startHttp(): Promise<void>;