@visualsentinel/mcp-server 0.1.0 → 0.2.2

package/dist/index.js

@@ -5,7 +5,13 @@ import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import {
   CallToolRequestSchema,
-  ListToolsRequestSchema
+  GetPromptRequestSchema,
+  ListPromptsRequestSchema,
+  ListResourcesRequestSchema,
+  ListToolsRequestSchema,
+  McpError,
+  ErrorCode,
+  ReadResourceRequestSchema
 } from "@modelcontextprotocol/sdk/types.js";
 
 // src/api-client.ts
@@ -39,7 +45,7 @@ var ApiClient = class {
     const auth = options.auth ?? true;
     if (auth && !this.hasApiKey()) {
       throw new VsApiError(
-        "Visual Sentinel API key required. Set VS_API_KEY (https://visualsentinel.com/settings/api-keys).",
+        "This tool needs a Visual Sentinel API key, which is available on the Business and Agency plans. Create one at https://visualsentinel.com/settings/api-keys and set it as VS_API_KEY. The DNS, SSL, speed, website-check and health tools work without a key.",
         401,
         null
       );
@@ -103,6 +109,14 @@ var TOOLS = [
   // -------------------------------------------------------------------------
   {
     name: "vs_health",
+    title: "Check Visual Sentinel service health",
+    annotations: {
+      title: "Check Visual Sentinel service health",
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: true
+    },
     description: "Check whether Visual Sentinel itself is up. Returns the service health status. No authentication required.",
     inputSchema: {
       type: "object",
@@ -114,6 +128,14 @@ var TOOLS = [
   },
   {
     name: "vs_dns_check",
+    title: "Look up DNS records",
+    annotations: {
+      title: "Look up DNS records",
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: true
+    },
     description: "Resolve DNS records (A, AAAA, MX, NS, TXT, CNAME) for a domain using Visual Sentinel's public DNS lookup tool. No authentication required.",
     inputSchema: {
       type: "object",
@@ -132,31 +154,48 @@ var TOOLS = [
       auth: false,
       query: {
         domain: requireString(args, "domain"),
-        recordType: pickString(args, "recordType")
+        // The API reads ?type= (not recordType).
+        type: pickString(args, "recordType")
       }
     })
   },
   {
     name: "vs_ssl_check",
+    title: "Inspect an SSL certificate",
+    annotations: {
+      title: "Inspect an SSL certificate",
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: true
+    },
     description: "Inspect a TLS/SSL certificate for a hostname: issuer, subject, validity dates, SAN list, key algorithm, and certificate chain. No authentication required.",
     inputSchema: {
       type: "object",
       properties: {
-        host: { ...STR, description: "Hostname to inspect, e.g. example.com (without protocol)." },
-        port: { ...INT, description: "TCP port. Default 443." }
+        domain: { ...STR, description: "Hostname to inspect, e.g. example.com (without protocol)." }
       },
-      required: ["host"],
+      required: ["domain"],
       additionalProperties: false
     },
     requiresAuth: false,
     handler: async (args, client) => client.request("GET", "/api/tools/ssl-check", {
       auth: false,
-      query: { host: requireString(args, "host"), port: pickNumber(args, "port") }
+      // The API reads ?domain=. `host` stays as an input alias for 0.1.x callers.
+      query: { domain: pickString(args, "domain") ?? requireString(args, "host") }
     })
   },
   {
     name: "vs_speed_test",
-    description: "Run a one-shot performance check against a URL: TTFB, total load time, transfer size, status code, and redirect chain. No authentication required.",
+    title: "Run a one-shot speed test",
+    annotations: {
+      title: "Run a one-shot speed test",
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: true
+    },
+    description: "Run a one-shot Lighthouse lab test on a URL. Returns the performance score (0 to 100) plus Largest Contentful Paint, First Contentful Paint, Cumulative Layout Shift, Time to First Byte, Total Blocking Time and Speed Index (times in milliseconds). No account needed.",
     inputSchema: {
       type: "object",
       properties: {
@@ -173,6 +212,14 @@ var TOOLS = [
   },
   {
     name: "vs_website_check",
+    title: "Check a website",
+    annotations: {
+      title: "Check a website",
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: true
+    },
     description: "Quick health check for a URL: HTTP status, response time, server header, content snippet, and basic SSL state. No authentication required.",
     inputSchema: {
       type: "object",
@@ -193,6 +240,14 @@ var TOOLS = [
   // -------------------------------------------------------------------------
   {
     name: "vs_monitors_list",
+    title: "List monitors",
+    annotations: {
+      title: "List monitors",
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: false
+    },
     description: "List monitors in the authenticated organization. Optional filters narrow by status, type, or paginate.",
     inputSchema: {
       type: "object",
@@ -219,6 +274,14 @@ var TOOLS = [
   },
   {
     name: "vs_monitors_get",
+    title: "Get a monitor",
+    annotations: {
+      title: "Get a monitor",
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: false
+    },
     description: "Fetch a single monitor by id, including its current status, last check, and configuration.",
     inputSchema: {
       type: "object",
@@ -233,6 +296,14 @@ var TOOLS = [
   },
   {
     name: "vs_monitors_create",
+    title: "Create a monitor",
+    annotations: {
+      title: "Create a monitor",
+      readOnlyHint: false,
+      destructiveHint: false,
+      idempotentHint: false,
+      openWorldHint: false
+    },
     description: "Create a new monitor. Provide at least name, url, and type. Returns the created monitor including its assigned id.",
     inputSchema: {
       type: "object",
@@ -268,6 +339,14 @@ var TOOLS = [
   },
   {
     name: "vs_monitors_check_now",
+    title: "Run a monitor check now",
+    annotations: {
+      title: "Run a monitor check now",
+      readOnlyHint: false,
+      destructiveHint: false,
+      idempotentHint: false,
+      openWorldHint: false
+    },
     description: "Trigger an immediate check for a monitor (in addition to its scheduled cadence). Returns the freshly-collected check result.",
     inputSchema: {
       type: "object",
@@ -282,26 +361,127 @@ var TOOLS = [
   },
   {
     name: "vs_monitors_uptime",
-    description: "Fetch the uptime percentage and outage breakdown for a monitor over a window (default last 30 days).",
+    title: "Get monitor uptime",
+    annotations: {
+      title: "Get monitor uptime",
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: false
+    },
+    description: "Fetch the uptime percentage and time-series breakdown for a monitor. Use `window` for a preset window (24h, 7d, 30d, 90d, 365d; default 30d), supply both `from` and `to` (ISO 8601) for a custom date range, or set `all: true` for the full available history.",
     inputSchema: {
       type: "object",
       properties: {
         id: { ...STR, description: "Monitor id." },
         window: {
           ...STR,
-          description: "Window: 24h, 7d, 30d, 90d, 365d. Default 30d."
+          description: "Preset window: 1h, 6h, 24h, 7d, 30d, 90d, 365d. Default 30d. Ignored when from+to or all are supplied."
+        },
+        from: {
+          ...STR,
+          description: "ISO 8601 start of a custom range (e.g. 2026-01-01T00:00:00Z). Must be supplied with `to`."
+        },
+        to: {
+          ...STR,
+          description: "ISO 8601 end of a custom range. Must be supplied with `from`."
+        },
+        all: {
+          type: "boolean",
+          description: "Return the full available history from the earliest stored data. Takes precedence over from/to and window."
         }
       },
       required: ["id"],
       additionalProperties: false
     },
     requiresAuth: true,
-    handler: async (args, client) => client.request("GET", `/api/monitors/${encodeURIComponent(requireString(args, "id"))}/uptime`, {
-      query: { window: pickString(args, "window") }
-    })
+    handler: async (args, client) => {
+      const from = pickString(args, "from");
+      const to = pickString(args, "to");
+      const query = args["all"] === true ? { all: true } : from && to ? { from, to } : { period: pickString(args, "window") ?? "30d" };
+      return client.request(
+        "GET",
+        `/api/monitors/${encodeURIComponent(requireString(args, "id"))}/uptime`,
+        { query }
+      );
+    }
+  },
+  {
+    name: "vs_monitors_metrics_bulk",
+    title: "Get bulk monitor metrics",
+    annotations: {
+      title: "Get bulk monitor metrics",
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: false
+    },
+    description: "Fetch uptime or response-time metrics for up to 100 monitors in a single request. Use `window` for a preset window (1h, 6h, 24h, 7d, 30d, 90d, 365d; default 30d), supply both `from` and `to` (ISO 8601) for a custom date range, or set `all: true` for the full available history. Returns a `monitors` object keyed by monitor id.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        monitorIds: {
+          type: "array",
+          items: { type: "string" },
+          description: "List of monitor IDs to fetch metrics for (max 100)."
+        },
+        metric: {
+          ...STR,
+          description: 'Metric to return: "uptime" or "response-time".'
+        },
+        window: {
+          ...STR,
+          description: "Preset window: 1h, 6h, 24h, 7d, 30d, 90d, 365d. Default 30d. Ignored when from+to or all are supplied."
+        },
+        from: {
+          ...STR,
+          description: "ISO 8601 start of a custom range (e.g. 2026-01-01T00:00:00Z). Must be supplied with `to`."
+        },
+        to: {
+          ...STR,
+          description: "ISO 8601 end of a custom range. Must be supplied with `from`."
+        },
+        all: {
+          type: "boolean",
+          description: "Return the full available history from the earliest stored data. Takes precedence over from/to and window."
+        }
+      },
+      required: ["monitorIds", "metric"],
+      additionalProperties: false
+    },
+    requiresAuth: true,
+    handler: async (args, client) => {
+      const monitorIds = args["monitorIds"];
+      if (!Array.isArray(monitorIds) || monitorIds.length === 0) {
+        throw new Error('Argument "monitorIds" must be a non-empty array.');
+      }
+      const from = pickString(args, "from");
+      const to = pickString(args, "to");
+      const body = {
+        monitorIds,
+        metric: requireString(args, "metric")
+      };
+      if (args["all"] === true) {
+        body["all"] = true;
+      } else if (from && to) {
+        body["from"] = from;
+        body["to"] = to;
+      } else {
+        body["period"] = pickString(args, "window") ?? "30d";
+      }
+      return client.request("POST", "/api/monitors/metrics", { body });
+    }
   },
   {
     name: "vs_incidents_list",
+    title: "List incidents",
+    annotations: {
+      title: "List incidents",
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: false
+    },
     description: "List incidents for the authenticated organization. Filter by status (OPEN/RESOLVED), monitor id, or paginate.",
     inputSchema: {
       type: "object",
@@ -325,6 +505,14 @@ var TOOLS = [
   },
   {
     name: "vs_incidents_get",
+    title: "Get an incident",
+    annotations: {
+      title: "Get an incident",
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: false
+    },
     description: "Fetch a single incident with its full check history and root-cause hints.",
     inputSchema: {
       type: "object",
@@ -339,6 +527,14 @@ var TOOLS = [
   },
   {
     name: "vs_alerts_list",
+    title: "List alerts",
+    annotations: {
+      title: "List alerts",
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: false
+    },
     description: "List alerts for the authenticated organization. Filter by status (UNACKNOWLEDGED/ACKNOWLEDGED/RESOLVED) or paginate.",
     inputSchema: {
       type: "object",
@@ -360,7 +556,15 @@ var TOOLS = [
   },
   {
     name: "vs_alerts_acknowledge",
-    description: "Acknowledge an alert by id. Acknowledgement is recorded with the calling API key's user.",
+    title: "Acknowledge an alert",
+    annotations: {
+      title: "Acknowledge an alert",
+      readOnlyHint: false,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: false
+    },
+    description: "Acknowledge an alert by id. The acknowledgement is recorded against the account that authorised this connection.",
     inputSchema: {
       type: "object",
       properties: {
@@ -377,6 +581,14 @@ var TOOLS = [
   },
   {
     name: "vs_status_pages_list",
+    title: "List status pages",
+    annotations: {
+      title: "List status pages",
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: false
+    },
     description: "List public-facing status pages owned by the authenticated organization.",
     inputSchema: {
       type: "object",
@@ -388,6 +600,14 @@ var TOOLS = [
   },
   {
     name: "vs_servers_list",
+    title: "List servers",
+    annotations: {
+      title: "List servers",
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: false
+    },
     description: "List servers (origins) registered in the authenticated organization.",
     inputSchema: {
       type: "object",
@@ -407,13 +627,198 @@ function findTool(name) {
   return TOOLS.find((t) => t.name === name);
 }
 
+// src/prompts.ts
+function need(args, key) {
+  const v = args[key]?.trim();
+  if (!v) throw new Error(`Argument "${key}" is required.`);
+  return v;
+}
+function hostOf(value) {
+  return value.replace(/^https?:\/\//i, "").replace(/\/.*$/, "");
+}
+var PROMPTS = [
+  {
+    name: "check_website_health",
+    title: "Check a website's health",
+    description: "Run uptime, SSL, DNS and speed checks on one site and summarise what needs attention. No account or API key needed.",
+    arguments: [
+      { name: "url", description: "Site to check, e.g. https://example.com", required: true }
+    ],
+    build: (args) => {
+      const url = need(args, "url");
+      const host = hostOf(url);
+      return [
+        `Check the health of ${url} with the Visual Sentinel tools and report back in plain language.`,
+        "",
+        `1. vs_website_check with url "${url}": HTTP status, response time, server header.`,
+        `2. vs_ssl_check with domain "${host}": certificate validity, expiry date and chain.`,
+        `3. vs_dns_check with domain "${host}": A, AAAA, MX, NS and TXT records.`,
+        `4. vs_speed_test with url "${url}": time to first byte, total load time, transfer size, redirects.`,
+        "",
+        "Then give: a one-line verdict, a short list of anything that looks wrong (non-200 status, certificate close to expiry, missing or odd DNS records, slow response, long redirect chain), and the one fix to do first. Say which checks succeeded and which returned an error. Do not guess at anything a tool did not return."
+      ].join("\n");
+    }
+  },
+  {
+    name: "investigate_broken_site",
+    title: "Investigate why my site looks broken",
+    description: "Work out why a site is down, slow or looking wrong by checking each layer in order. With an API key it also reads open incidents and recent alerts.",
+    arguments: [
+      { name: "url", description: "The affected page, e.g. https://example.com/pricing", required: true },
+      { name: "symptom", description: 'What you see, e.g. "blank page", "images missing", "very slow"', required: false }
+    ],
+    build: (args) => {
+      const url = need(args, "url");
+      const host = hostOf(url);
+      const symptom = args.symptom?.trim();
+      return [
+        `${symptom ? `The page ${url} shows this problem: ${symptom}.` : `Something looks wrong on ${url}.`} Find the most likely layer at fault, using the Visual Sentinel tools in this order and stopping to report as soon as you find a clear cause:`,
+        "",
+        `1. DNS: vs_dns_check for "${host}". Do the records resolve, and do they point where they should?`,
+        `2. TLS: vs_ssl_check for "${host}". Is the certificate valid, unexpired and issued for this hostname?`,
+        `3. Server response: vs_website_check for "${url}". Status code, response time, content snippet.`,
+        `4. Speed: vs_speed_test for "${url}". Is time to first byte or load time unusually high, and is there a redirect chain?`,
+        "5. If a Visual Sentinel API key is configured: vs_monitors_list to find a monitor for this site, then vs_incidents_list and vs_alerts_list for it, and vs_monitors_uptime for the last 24 hours. If no key is set, say that account data was not checked.",
+        "",
+        "A page can return HTTP 200 and still look broken (missing styles, empty content, a failed script). If every check above is healthy, say so and suggest comparing the page against an earlier screenshot, which is what Visual Sentinel visual monitoring does.",
+        "Report: the evidence from each step, the most likely cause, and the next action."
+      ].join("\n");
+    }
+  },
+  {
+    name: "pre_launch_checklist",
+    title: "Pre-launch checklist for a site",
+    description: "Check a new or migrated site before it goes live: DNS, certificate, response and speed, then a short list of fixes. No API key needed.",
+    arguments: [
+      { name: "domain", description: "The domain being launched, e.g. example.com", required: true }
+    ],
+    build: (args) => {
+      const domain = hostOf(need(args, "domain"));
+      return [
+        `Run a pre-launch check on ${domain} with the Visual Sentinel tools and return a checklist with Pass, Warn or Fail for each line.`,
+        "",
+        `- DNS: vs_dns_check for "${domain}" and for "www.${domain}". Both resolve, and the records point to the intended host. Check MX and TXT (SPF) records if the domain sends email.`,
+        `- Certificate: vs_ssl_check for "${domain}" and for "www.${domain}". Valid, issued for the hostname, and more than 30 days from expiry.`,
+        `- Response: vs_website_check for "https://${domain}" and "https://www.${domain}". Both return 200 or one cleanly redirects to the other.`,
+        `- Speed: vs_speed_test for "https://${domain}". Report time to first byte, total load time and redirect count.`,
+        "",
+        "Finish with the Fail items first, each with a concrete fix, then the Warn items. Add one line suggesting monitors to create after launch (uptime on the home page, certificate expiry, DNS records), and say that creating them needs a Visual Sentinel account with an API key. Do not create anything unless asked."
+      ].join("\n");
+    }
+  },
+  {
+    name: "triage_open_incidents",
+    title: "Triage open incidents",
+    description: "Review open incidents and unacknowledged alerts on your account and rank what to look at first. Needs a Visual Sentinel API key (Business and Agency plans).",
+    arguments: [],
+    build: () => [
+      "Review my Visual Sentinel account and tell me what needs attention first.",
+      "",
+      "1. vs_incidents_list with status OPEN, then vs_incidents_get for each one (up to 5, most recent first).",
+      "2. vs_alerts_list with status UNACKNOWLEDGED.",
+      "3. For each affected monitor, vs_monitors_get and vs_monitors_uptime for the last 24 hours.",
+      "",
+      'Rank the incidents by customer impact (production sites and checkout pages before staging), group alerts that belong to the same incident, and give one suggested next step for each. If the tools return an "API key required" error, tell me that account tools need an API key from the Business or Agency plan, and stop. Ask before acknowledging any alert.'
+    ].join("\n")
+  }
+];
+function findPrompt(name) {
+  return PROMPTS.find((p) => p.name === name);
+}
+
+// src/version.ts
+var SERVER_VERSION = "0.2.2";
+
+// src/resources.ts
+var PLANS_AS_OF = "2026-10-16";
+var PLANS = `# Visual Sentinel plans and limits (as of ${PLANS_AS_OF})
+
+Prices and the current list are always at https://visualsentinel.com/pricing. There is no free plan for new accounts: a new workspace gets a first check of its site, then a 7-day trial (card required) or a paid plan.
+
+| Plan | Monitors | Fastest uptime check | Visual pages | Status pages | API keys and MCP account tools |
+|---|---|---|---|---|---|
+| Solo | 10 | every 5 minutes | 1 site, every 30 minutes | 1 | no |
+| Starter | 15 | every 5 minutes | 5, every 15 minutes | 1 | no |
+| Business | 60 | every 1 minute | 60, every 15 minutes | 5 | yes |
+| Agency | 300 | every 1 minute | 300, every 15 minutes | 50 | yes |
+
+- The five public tools (vs_health, vs_dns_check, vs_ssl_check, vs_speed_test, vs_website_check) need no account.
+- The twelve account tools need an API key, which is available on the Business and Agency plans. Create one at https://visualsentinel.com/settings/api-keys.
+- Checks run from Europe and the US. Alert channels on every plan: email, Slack, Discord, Microsoft Teams, Telegram, PagerDuty, Opsgenie, webhooks, WhatsApp, Prometheus, and push notifications in the mobile app.
+`;
+var HELP = `# Using the Visual Sentinel MCP server
+
+Visual Sentinel catches pages that look broken even when the site is up. It watches uptime, performance, SSL certificates, DNS, visual changes and content changes.
+
+## Start without an account
+Ask for a DNS lookup, an SSL certificate check, a speed test or a website check on any public site. These five tools need no account or key.
+
+## Connect your account
+1. Get an API key (Business and Agency plans): https://visualsentinel.com/settings/api-keys
+2. Set it as VS_API_KEY (or VISUALSENTINEL_API_KEY) in your MCP client's environment for this server.
+3. Restart the client. Monitor, uptime, incident, alert, status-page and server tools now work.
+
+## Ready-made prompts
+check_website_health, investigate_broken_site, pre_launch_checklist and triage_open_incidents.
+
+## Links
+- Docs and install: https://visualsentinel.com/mcp
+- API reference: https://visualsentinel.com/docs
+- Pricing: https://visualsentinel.com/pricing
+- Source: https://github.com/VisualSentinel/mcp-server
+- Support: https://visualsentinel.com/contact
+`;
+function toolsReference() {
+  const rows = TOOLS.map(
+    (t) => `| ${t.name} | ${t.requiresAuth ? "API key (Business and Agency)" : "none"} | ${t.annotations.readOnlyHint ? "read-only" : "changes data"} | ${(t.description.split(". ")[0] ?? "").replace(/\.$/, "")} |`
+  );
+  return [
+    "# Visual Sentinel tools",
+    "",
+    "| Tool | Needs | Type | What it does |",
+    "|---|---|---|---|",
+    ...rows,
+    ""
+  ].join("\n");
+}
+var RESOURCES = [
+  {
+    uri: "visualsentinel://plans",
+    name: "plans",
+    title: "Plans and limits",
+    description: "Monitor counts, check frequencies and which plans include API keys and the MCP account tools.",
+    mimeType: "text/markdown",
+    read: () => PLANS
+  },
+  {
+    uri: "visualsentinel://help",
+    name: "help",
+    title: "Help and setup",
+    description: "How to use the server without an account, how to add an API key, and where the docs are.",
+    mimeType: "text/markdown",
+    read: () => HELP
+  },
+  {
+    uri: "visualsentinel://tools",
+    name: "tools",
+    title: "Tool reference",
+    description: "Every tool, whether it needs an API key, and whether it is read-only.",
+    mimeType: "text/markdown",
+    read: toolsReference
+  }
+];
+function findResource(uri) {
+  return RESOURCES.find((r) => r.uri === uri);
+}
+
 // src/index.ts
 var SERVER_NAME = "visualsentinel";
-var SERVER_VERSION = "0.1.0";
 function toMcpToolDescriptor(tool) {
   return {
     name: tool.name,
+    title: tool.title,
     description: tool.description,
+    annotations: tool.annotations,
     inputSchema: tool.inputSchema
   };
 }
@@ -421,11 +826,47 @@ async function main() {
   const client = new ApiClient();
   const server = new Server(
     { name: SERVER_NAME, version: SERVER_VERSION },
-    { capabilities: { tools: {} } }
+    { capabilities: { tools: {}, prompts: {}, resources: {} } }
   );
   server.setRequestHandler(ListToolsRequestSchema, async () => ({
     tools: TOOLS.map(toMcpToolDescriptor)
   }));
+  server.setRequestHandler(ListPromptsRequestSchema, async () => ({
+    prompts: PROMPTS.map((p) => ({
+      name: p.name,
+      title: p.title,
+      description: p.description,
+      arguments: p.arguments
+    }))
+  }));
+  server.setRequestHandler(GetPromptRequestSchema, async (req) => {
+    const prompt = findPrompt(req.params.name);
+    if (!prompt) throw new McpError(ErrorCode.InvalidParams, `Unknown prompt: ${req.params.name}`);
+    let text;
+    try {
+      text = prompt.build(req.params.arguments ?? {});
+    } catch (err) {
+      throw new McpError(ErrorCode.InvalidParams, err instanceof Error ? err.message : String(err));
+    }
+    return {
+      description: prompt.description,
+      messages: [{ role: "user", content: { type: "text", text } }]
+    };
+  });
+  server.setRequestHandler(ListResourcesRequestSchema, async () => ({
+    resources: RESOURCES.map((r) => ({
+      uri: r.uri,
+      name: r.name,
+      title: r.title,
+      description: r.description,
+      mimeType: r.mimeType
+    }))
+  }));
+  server.setRequestHandler(ReadResourceRequestSchema, async (req) => {
+    const resource = findResource(req.params.uri);
+    if (!resource) throw new McpError(ErrorCode.InvalidParams, `Unknown resource: ${req.params.uri}`);
+    return { contents: [{ uri: resource.uri, mimeType: resource.mimeType, text: resource.read() }] };
+  });
   server.setRequestHandler(CallToolRequestSchema, async (req) => {
     const tool = findTool(req.params.name);
     if (!tool) {