@webhooks-cc/mcp 1.19.0 → 1.21.0

package/dist/bin/mcp.js

@@ -456,7 +456,7 @@ var import_zod3 = require("zod");
 var import_sdk2 = require("@webhooks-cc/sdk");
 
 // src/version.ts
-var VERSION = true ? "1.19.0" : "0.0.0-dev";
+var VERSION = true ? "1.21.0" : "0.0.0-dev";
 var MCP_USER_AGENT = `webhooks-cc-mcp/${VERSION}`;
 
 // src/tools.ts
@@ -698,6 +698,13 @@ function payloadSchemaResult(requests, args2) {
   }
   return jsonContent(output);
 }
+function keyText(key) {
+  return [
+    `Approved. The API key ${key.name ? `"${key.name}" ` : ""}is: ${key.key ?? "(not returned)"}`,
+    `It is shown only this once: store it now (for example as a CI secret), never in code.`,
+    key.expiresAt ? `It works until ${key.expiresAt}.` : ""
+  ].filter(Boolean).join("\n");
+}
 function textContent(text) {
   return { content: [{ type: "text", text }] };
 }
@@ -1797,6 +1804,15 @@ function registerTools(target, client, options = {}) {
       );
     })
   );
+  server.tool(
+    "get_billing",
+    "What the account pays for: the plan and its subscription (status, monthly or annual, when it renews, a pending change, whether it cancels at the period's end), the add-ons (extra requests, parsed pages, domains), and every team's subscription and add-ons. Read only: changing a plan, seats or add-ons takes the person in a browser.",
+    {},
+    withErrorHandling(async () => {
+      const billing = await client.billing.get();
+      return jsonContent(fitArrayField(billing, "teams"));
+    })
+  );
   server.tool(
     "get_usage",
     "Check current request usage, remaining quota, plan, and period end; parsed pages, preview data (whk share) and AI assists, each with when it resets; and the pooled quota of every subscribed team you belong to.",
@@ -2258,6 +2274,76 @@ function registerTools(target, client, options = {}) {
       return jsonContent(withShareHints(await client.shares.list(state ? { state } : {}), remote));
     })
   );
+  server.tool(
+    "list_api_keys",
+    "List the account's API keys: id, name, prefix, when they were made, when they expire and when they were last used. The keys themselves are never listed.",
+    {},
+    withErrorHandling(async () => jsonContent(await client.apiKeys.list()))
+  );
+  server.tool(
+    "create_api_key",
+    "Ask for a new API key for the account, for CI or another tool. The account's owner must approve it: this returns at once with a link and a code. Show the person the link and tell them to check that the page shows the same code, then call wait_for_approval with the approval id to get the key (shown once).",
+    {
+      name: import_zod2.z.string().min(1).max(64).describe('A name that says where the key is used, such as "GitHub Actions"'),
+      expiresInDays: import_zod2.z.number().int().min(1).max(365).optional().describe("How many days the key works, 1 to 365 (default 90)")
+    },
+    withErrorHandling(async ({ name, expiresInDays }) => {
+      const pending = await client.apiKeys.create({ name, expiresInDays });
+      if (!pending.id) {
+        const key = await pending.wait();
+        return textContent(keyText(key));
+      }
+      return textContent(
+        [
+          `Asked for approval: ${pending.summary}`,
+          `Show the person this link: ${pending.url}`,
+          `The page shows the code ${pending.code}; ask them to approve only if it matches.`,
+          `Then call wait_for_approval with id ${pending.id}. The request expires at ${pending.expiresAt}.`
+        ].join("\n")
+      );
+    })
+  );
+  server.tool(
+    "wait_for_approval",
+    "Wait for the account's owner to answer an approval (from create_api_key) and collect what it grants, such as the new API key. If they have not answered yet, call it again.",
+    {
+      id: import_zod2.z.string().describe("The approval id"),
+      timeout: durationOrTimestampSchema.default("45s").describe('How long to wait for the person, for example "45s"')
+    },
+    withErrorHandling(async ({ id, timeout }) => {
+      const ms = durationMs(timeout) ?? 45e3;
+      try {
+        const result = await client.approvals.wait(id, { timeout: ms });
+        return textContent(keyText(result));
+      } catch (error) {
+        if (error instanceof import_sdk.ApprovalDeniedError) {
+          return textContent(
+            "The person refused it on the approval page. Do not ask again unless they tell you to."
+          );
+        }
+        if (error instanceof import_sdk.ApprovalExpiredError) {
+          return textContent("The approval expired. Ask again if the person still wants it.");
+        }
+        if (error instanceof import_sdk.TimeoutError) {
+          return textContent(
+            `Not answered yet. Remind the person of the link if needed, and call wait_for_approval with id ${id} again.`
+          );
+        }
+        throw error;
+      }
+    })
+  );
+  server.tool(
+    "revoke_api_key",
+    "Revoke one of the account's API keys by its id (from list_api_keys). Anything using it stops working at once.",
+    {
+      id: import_zod2.z.string().describe("The key's id, from list_api_keys")
+    },
+    withErrorHandling(async ({ id }) => {
+      await client.apiKeys.revoke(id);
+      return textContent(`Revoked the API key ${id}, if the account had it.`);
+    })
+  );
   server.tool(
     "stop_share",
     "Stop a public preview or live tunnel by its id (from list_shares). The CLI running it is told why and exits.",

package/dist/{chunk-GREHE3PB.mjs → chunk-BAGCOSXG.mjs}

@@ -12,6 +12,8 @@ import {
   MAX_CONDITION_NAME_LEN,
   MAX_CONDITION_PATH_LEN,
   MAX_RULE_NAME_LEN,
+  ApprovalDeniedError,
+  ApprovalExpiredError,
   NotFoundError,
   RateLimitError,
   TEMPLATE_METADATA,
@@ -476,6 +478,13 @@ function payloadSchemaResult(requests, args) {
   }
   return jsonContent(output);
 }
+function keyText(key) {
+  return [
+    `Approved. The API key ${key.name ? `"${key.name}" ` : ""}is: ${key.key ?? "(not returned)"}`,
+    `It is shown only this once: store it now (for example as a CI secret), never in code.`,
+    key.expiresAt ? `It works until ${key.expiresAt}.` : ""
+  ].filter(Boolean).join("\n");
+}
 function textContent(text) {
   return { content: [{ type: "text", text }] };
 }
@@ -1575,6 +1584,15 @@ function registerTools(target, client, options = {}) {
       );
     })
   );
+  server.tool(
+    "get_billing",
+    "What the account pays for: the plan and its subscription (status, monthly or annual, when it renews, a pending change, whether it cancels at the period's end), the add-ons (extra requests, parsed pages, domains), and every team's subscription and add-ons. Read only: changing a plan, seats or add-ons takes the person in a browser.",
+    {},
+    withErrorHandling(async () => {
+      const billing = await client.billing.get();
+      return jsonContent(fitArrayField(billing, "teams"));
+    })
+  );
   server.tool(
     "get_usage",
     "Check current request usage, remaining quota, plan, and period end; parsed pages, preview data (whk share) and AI assists, each with when it resets; and the pooled quota of every subscribed team you belong to.",
@@ -2036,6 +2054,76 @@ function registerTools(target, client, options = {}) {
       return jsonContent(withShareHints(await client.shares.list(state ? { state } : {}), remote));
     })
   );
+  server.tool(
+    "list_api_keys",
+    "List the account's API keys: id, name, prefix, when they were made, when they expire and when they were last used. The keys themselves are never listed.",
+    {},
+    withErrorHandling(async () => jsonContent(await client.apiKeys.list()))
+  );
+  server.tool(
+    "create_api_key",
+    "Ask for a new API key for the account, for CI or another tool. The account's owner must approve it: this returns at once with a link and a code. Show the person the link and tell them to check that the page shows the same code, then call wait_for_approval with the approval id to get the key (shown once).",
+    {
+      name: z.string().min(1).max(64).describe('A name that says where the key is used, such as "GitHub Actions"'),
+      expiresInDays: z.number().int().min(1).max(365).optional().describe("How many days the key works, 1 to 365 (default 90)")
+    },
+    withErrorHandling(async ({ name, expiresInDays }) => {
+      const pending = await client.apiKeys.create({ name, expiresInDays });
+      if (!pending.id) {
+        const key = await pending.wait();
+        return textContent(keyText(key));
+      }
+      return textContent(
+        [
+          `Asked for approval: ${pending.summary}`,
+          `Show the person this link: ${pending.url}`,
+          `The page shows the code ${pending.code}; ask them to approve only if it matches.`,
+          `Then call wait_for_approval with id ${pending.id}. The request expires at ${pending.expiresAt}.`
+        ].join("\n")
+      );
+    })
+  );
+  server.tool(
+    "wait_for_approval",
+    "Wait for the account's owner to answer an approval (from create_api_key) and collect what it grants, such as the new API key. If they have not answered yet, call it again.",
+    {
+      id: z.string().describe("The approval id"),
+      timeout: durationOrTimestampSchema.default("45s").describe('How long to wait for the person, for example "45s"')
+    },
+    withErrorHandling(async ({ id, timeout }) => {
+      const ms = durationMs(timeout) ?? 45e3;
+      try {
+        const result = await client.approvals.wait(id, { timeout: ms });
+        return textContent(keyText(result));
+      } catch (error) {
+        if (error instanceof ApprovalDeniedError) {
+          return textContent(
+            "The person refused it on the approval page. Do not ask again unless they tell you to."
+          );
+        }
+        if (error instanceof ApprovalExpiredError) {
+          return textContent("The approval expired. Ask again if the person still wants it.");
+        }
+        if (error instanceof TimeoutError) {
+          return textContent(
+            `Not answered yet. Remind the person of the link if needed, and call wait_for_approval with id ${id} again.`
+          );
+        }
+        throw error;
+      }
+    })
+  );
+  server.tool(
+    "revoke_api_key",
+    "Revoke one of the account's API keys by its id (from list_api_keys). Anything using it stops working at once.",
+    {
+      id: z.string().describe("The key's id, from list_api_keys")
+    },
+    withErrorHandling(async ({ id }) => {
+      await client.apiKeys.revoke(id);
+      return textContent(`Revoked the API key ${id}, if the account had it.`);
+    })
+  );
   server.tool(
     "stop_share",
     "Stop a public preview or live tunnel by its id (from list_shares). The CLI running it is told why and exits.",
@@ -2141,6 +2229,7 @@ export {
   textContent,
   jsonContent,
   withErrorHandling,
+  LOCAL_ONLY_TOOLS,
   REMOTE_MAX_WAIT_MS,
   REMOTE_MIN_POLL_MS,
   shareHints,

package/dist/index.js

@@ -480,7 +480,7 @@ var import_zod3 = require("zod");
 var import_sdk2 = require("@webhooks-cc/sdk");
 
 // src/version.ts
-var VERSION = true ? "1.19.0" : "0.0.0-dev";
+var VERSION = true ? "1.21.0" : "0.0.0-dev";
 var MCP_USER_AGENT = `webhooks-cc-mcp/${VERSION}`;
 
 // src/tools.ts
@@ -722,6 +722,13 @@ function payloadSchemaResult(requests, args) {
   }
   return jsonContent(output);
 }
+function keyText(key) {
+  return [
+    `Approved. The API key ${key.name ? `"${key.name}" ` : ""}is: ${key.key ?? "(not returned)"}`,
+    `It is shown only this once: store it now (for example as a CI secret), never in code.`,
+    key.expiresAt ? `It works until ${key.expiresAt}.` : ""
+  ].filter(Boolean).join("\n");
+}
 function textContent(text) {
   return { content: [{ type: "text", text }] };
 }
@@ -1821,6 +1828,15 @@ function registerTools(target, client, options = {}) {
       );
     })
   );
+  server.tool(
+    "get_billing",
+    "What the account pays for: the plan and its subscription (status, monthly or annual, when it renews, a pending change, whether it cancels at the period's end), the add-ons (extra requests, parsed pages, domains), and every team's subscription and add-ons. Read only: changing a plan, seats or add-ons takes the person in a browser.",
+    {},
+    withErrorHandling(async () => {
+      const billing = await client.billing.get();
+      return jsonContent(fitArrayField(billing, "teams"));
+    })
+  );
   server.tool(
     "get_usage",
     "Check current request usage, remaining quota, plan, and period end; parsed pages, preview data (whk share) and AI assists, each with when it resets; and the pooled quota of every subscribed team you belong to.",
@@ -2282,6 +2298,76 @@ function registerTools(target, client, options = {}) {
       return jsonContent(withShareHints(await client.shares.list(state ? { state } : {}), remote));
     })
   );
+  server.tool(
+    "list_api_keys",
+    "List the account's API keys: id, name, prefix, when they were made, when they expire and when they were last used. The keys themselves are never listed.",
+    {},
+    withErrorHandling(async () => jsonContent(await client.apiKeys.list()))
+  );
+  server.tool(
+    "create_api_key",
+    "Ask for a new API key for the account, for CI or another tool. The account's owner must approve it: this returns at once with a link and a code. Show the person the link and tell them to check that the page shows the same code, then call wait_for_approval with the approval id to get the key (shown once).",
+    {
+      name: import_zod2.z.string().min(1).max(64).describe('A name that says where the key is used, such as "GitHub Actions"'),
+      expiresInDays: import_zod2.z.number().int().min(1).max(365).optional().describe("How many days the key works, 1 to 365 (default 90)")
+    },
+    withErrorHandling(async ({ name, expiresInDays }) => {
+      const pending = await client.apiKeys.create({ name, expiresInDays });
+      if (!pending.id) {
+        const key = await pending.wait();
+        return textContent(keyText(key));
+      }
+      return textContent(
+        [
+          `Asked for approval: ${pending.summary}`,
+          `Show the person this link: ${pending.url}`,
+          `The page shows the code ${pending.code}; ask them to approve only if it matches.`,
+          `Then call wait_for_approval with id ${pending.id}. The request expires at ${pending.expiresAt}.`
+        ].join("\n")
+      );
+    })
+  );
+  server.tool(
+    "wait_for_approval",
+    "Wait for the account's owner to answer an approval (from create_api_key) and collect what it grants, such as the new API key. If they have not answered yet, call it again.",
+    {
+      id: import_zod2.z.string().describe("The approval id"),
+      timeout: durationOrTimestampSchema.default("45s").describe('How long to wait for the person, for example "45s"')
+    },
+    withErrorHandling(async ({ id, timeout }) => {
+      const ms = durationMs(timeout) ?? 45e3;
+      try {
+        const result = await client.approvals.wait(id, { timeout: ms });
+        return textContent(keyText(result));
+      } catch (error) {
+        if (error instanceof import_sdk.ApprovalDeniedError) {
+          return textContent(
+            "The person refused it on the approval page. Do not ask again unless they tell you to."
+          );
+        }
+        if (error instanceof import_sdk.ApprovalExpiredError) {
+          return textContent("The approval expired. Ask again if the person still wants it.");
+        }
+        if (error instanceof import_sdk.TimeoutError) {
+          return textContent(
+            `Not answered yet. Remind the person of the link if needed, and call wait_for_approval with id ${id} again.`
+          );
+        }
+        throw error;
+      }
+    })
+  );
+  server.tool(
+    "revoke_api_key",
+    "Revoke one of the account's API keys by its id (from list_api_keys). Anything using it stops working at once.",
+    {
+      id: import_zod2.z.string().describe("The key's id, from list_api_keys")
+    },
+    withErrorHandling(async ({ id }) => {
+      await client.apiKeys.revoke(id);
+      return textContent(`Revoked the API key ${id}, if the account had it.`);
+    })
+  );
   server.tool(
     "stop_share",
     "Stop a public preview or live tunnel by its id (from list_shares). The CLI running it is told why and exits.",

package/dist/index.mjs

@@ -13,7 +13,7 @@ import {
   registerTools,
   waitForRequestShape,
   withErrorHandling
-} from "./chunk-GREHE3PB.mjs";
+} from "./chunk-BAGCOSXG.mjs";
 
 // src/index.ts
 import { McpServer as McpServer2 } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -262,7 +262,7 @@ import {
 } from "@webhooks-cc/sdk";
 
 // src/version.ts
-var VERSION = true ? "1.19.0" : "0.0.0-dev";
+var VERSION = true ? "1.21.0" : "0.0.0-dev";
 var MCP_USER_AGENT = `webhooks-cc-mcp/${VERSION}`;
 
 // src/sandbox-tools.ts

package/dist/tools.d.mts

@@ -135,7 +135,6 @@ type ToolResult = {
     content: TextContent[];
     isError?: boolean;
 };
-/** Create a text content response for MCP tools. */
 declare function textContent(text: string): ToolResult;
 declare function jsonContent(value: unknown): ToolResult;
 /** Wrap a tool handler with error handling that returns structured MCP errors. */
@@ -162,6 +161,11 @@ interface RegisterToolsOptions {
      */
     remote?: boolean;
 }
+/**
+ * Tools that only make sense next to the caller: they post to a URL of the
+ * caller's choosing, or (share_port) run the whk CLI on the caller's machine.
+ */
+declare const LOCAL_ONLY_TOOLS: Set<string>;
 /** Longest wait on the hosted server; Cloudflare ends a request after 100 seconds. */
 declare const REMOTE_MAX_WAIT_MS = 50000;
 /** Shortest poll interval on the hosted server: each poll is an API request. */
@@ -192,5 +196,5 @@ declare function withShareHints(list: TunnelShareList, remote?: boolean): Record
  */
 declare function registerTools(target: ToolServer, client: WebhooksCC, options?: RegisterToolsOptions): RegisteredToolHandle[];
 
-export { REMOTE_MAX_WAIT_MS, REMOTE_MIN_POLL_MS, createEndpointShape, deleteEndpointShape, getEndpointShape, getRequestShape, jsonContent, listEndpointsShape, listRequestsShape, payloadSchemaResult, payloadSchemaShape, registerTools, shareHints, textContent, toolWords, waitForRequestShape, withErrorHandling, withShareHints };
+export { LOCAL_ONLY_TOOLS, REMOTE_MAX_WAIT_MS, REMOTE_MIN_POLL_MS, createEndpointShape, deleteEndpointShape, getEndpointShape, getRequestShape, jsonContent, listEndpointsShape, listRequestsShape, payloadSchemaResult, payloadSchemaShape, registerTools, shareHints, textContent, toolWords, waitForRequestShape, withErrorHandling, withShareHints };
 export type { RegisterToolsOptions, RegisteredToolHandle, ToolResult, ToolServer };

package/dist/tools.d.ts

@@ -135,7 +135,6 @@ type ToolResult = {
     content: TextContent[];
     isError?: boolean;
 };
-/** Create a text content response for MCP tools. */
 declare function textContent(text: string): ToolResult;
 declare function jsonContent(value: unknown): ToolResult;
 /** Wrap a tool handler with error handling that returns structured MCP errors. */
@@ -162,6 +161,11 @@ interface RegisterToolsOptions {
      */
     remote?: boolean;
 }
+/**
+ * Tools that only make sense next to the caller: they post to a URL of the
+ * caller's choosing, or (share_port) run the whk CLI on the caller's machine.
+ */
+declare const LOCAL_ONLY_TOOLS: Set<string>;
 /** Longest wait on the hosted server; Cloudflare ends a request after 100 seconds. */
 declare const REMOTE_MAX_WAIT_MS = 50000;
 /** Shortest poll interval on the hosted server: each poll is an API request. */
@@ -192,5 +196,5 @@ declare function withShareHints(list: TunnelShareList, remote?: boolean): Record
  */
 declare function registerTools(target: ToolServer, client: WebhooksCC, options?: RegisterToolsOptions): RegisteredToolHandle[];
 
-export { REMOTE_MAX_WAIT_MS, REMOTE_MIN_POLL_MS, createEndpointShape, deleteEndpointShape, getEndpointShape, getRequestShape, jsonContent, listEndpointsShape, listRequestsShape, payloadSchemaResult, payloadSchemaShape, registerTools, shareHints, textContent, toolWords, waitForRequestShape, withErrorHandling, withShareHints };
+export { LOCAL_ONLY_TOOLS, REMOTE_MAX_WAIT_MS, REMOTE_MIN_POLL_MS, createEndpointShape, deleteEndpointShape, getEndpointShape, getRequestShape, jsonContent, listEndpointsShape, listRequestsShape, payloadSchemaResult, payloadSchemaShape, registerTools, shareHints, textContent, toolWords, waitForRequestShape, withErrorHandling, withShareHints };
 export type { RegisterToolsOptions, RegisteredToolHandle, ToolResult, ToolServer };

package/dist/tools.js

@@ -20,6 +20,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/tools.ts
 var tools_exports = {};
 __export(tools_exports, {
+  LOCAL_ONLY_TOOLS: () => LOCAL_ONLY_TOOLS,
   REMOTE_MAX_WAIT_MS: () => REMOTE_MAX_WAIT_MS,
   REMOTE_MIN_POLL_MS: () => REMOTE_MIN_POLL_MS,
   createEndpointShape: () => createEndpointShape,
@@ -488,6 +489,13 @@ function payloadSchemaResult(requests, args) {
   }
   return jsonContent(output);
 }
+function keyText(key) {
+  return [
+    `Approved. The API key ${key.name ? `"${key.name}" ` : ""}is: ${key.key ?? "(not returned)"}`,
+    `It is shown only this once: store it now (for example as a CI secret), never in code.`,
+    key.expiresAt ? `It works until ${key.expiresAt}.` : ""
+  ].filter(Boolean).join("\n");
+}
 function textContent(text) {
   return { content: [{ type: "text", text }] };
 }
@@ -1587,6 +1595,15 @@ function registerTools(target, client, options = {}) {
       );
     })
   );
+  server.tool(
+    "get_billing",
+    "What the account pays for: the plan and its subscription (status, monthly or annual, when it renews, a pending change, whether it cancels at the period's end), the add-ons (extra requests, parsed pages, domains), and every team's subscription and add-ons. Read only: changing a plan, seats or add-ons takes the person in a browser.",
+    {},
+    withErrorHandling(async () => {
+      const billing = await client.billing.get();
+      return jsonContent(fitArrayField(billing, "teams"));
+    })
+  );
   server.tool(
     "get_usage",
     "Check current request usage, remaining quota, plan, and period end; parsed pages, preview data (whk share) and AI assists, each with when it resets; and the pooled quota of every subscribed team you belong to.",
@@ -2048,6 +2065,76 @@ function registerTools(target, client, options = {}) {
       return jsonContent(withShareHints(await client.shares.list(state ? { state } : {}), remote));
     })
   );
+  server.tool(
+    "list_api_keys",
+    "List the account's API keys: id, name, prefix, when they were made, when they expire and when they were last used. The keys themselves are never listed.",
+    {},
+    withErrorHandling(async () => jsonContent(await client.apiKeys.list()))
+  );
+  server.tool(
+    "create_api_key",
+    "Ask for a new API key for the account, for CI or another tool. The account's owner must approve it: this returns at once with a link and a code. Show the person the link and tell them to check that the page shows the same code, then call wait_for_approval with the approval id to get the key (shown once).",
+    {
+      name: import_zod.z.string().min(1).max(64).describe('A name that says where the key is used, such as "GitHub Actions"'),
+      expiresInDays: import_zod.z.number().int().min(1).max(365).optional().describe("How many days the key works, 1 to 365 (default 90)")
+    },
+    withErrorHandling(async ({ name, expiresInDays }) => {
+      const pending = await client.apiKeys.create({ name, expiresInDays });
+      if (!pending.id) {
+        const key = await pending.wait();
+        return textContent(keyText(key));
+      }
+      return textContent(
+        [
+          `Asked for approval: ${pending.summary}`,
+          `Show the person this link: ${pending.url}`,
+          `The page shows the code ${pending.code}; ask them to approve only if it matches.`,
+          `Then call wait_for_approval with id ${pending.id}. The request expires at ${pending.expiresAt}.`
+        ].join("\n")
+      );
+    })
+  );
+  server.tool(
+    "wait_for_approval",
+    "Wait for the account's owner to answer an approval (from create_api_key) and collect what it grants, such as the new API key. If they have not answered yet, call it again.",
+    {
+      id: import_zod.z.string().describe("The approval id"),
+      timeout: durationOrTimestampSchema.default("45s").describe('How long to wait for the person, for example "45s"')
+    },
+    withErrorHandling(async ({ id, timeout }) => {
+      const ms = durationMs(timeout) ?? 45e3;
+      try {
+        const result = await client.approvals.wait(id, { timeout: ms });
+        return textContent(keyText(result));
+      } catch (error) {
+        if (error instanceof import_sdk.ApprovalDeniedError) {
+          return textContent(
+            "The person refused it on the approval page. Do not ask again unless they tell you to."
+          );
+        }
+        if (error instanceof import_sdk.ApprovalExpiredError) {
+          return textContent("The approval expired. Ask again if the person still wants it.");
+        }
+        if (error instanceof import_sdk.TimeoutError) {
+          return textContent(
+            `Not answered yet. Remind the person of the link if needed, and call wait_for_approval with id ${id} again.`
+          );
+        }
+        throw error;
+      }
+    })
+  );
+  server.tool(
+    "revoke_api_key",
+    "Revoke one of the account's API keys by its id (from list_api_keys). Anything using it stops working at once.",
+    {
+      id: import_zod.z.string().describe("The key's id, from list_api_keys")
+    },
+    withErrorHandling(async ({ id }) => {
+      await client.apiKeys.revoke(id);
+      return textContent(`Revoked the API key ${id}, if the account had it.`);
+    })
+  );
   server.tool(
     "stop_share",
     "Stop a public preview or live tunnel by its id (from list_shares). The CLI running it is told why and exits.",
@@ -2140,6 +2227,7 @@ function registerTools(target, client, options = {}) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  LOCAL_ONLY_TOOLS,
   REMOTE_MAX_WAIT_MS,
   REMOTE_MIN_POLL_MS,
   createEndpointShape,

package/dist/tools.mjs

@@ -1,4 +1,5 @@
 import {
+  LOCAL_ONLY_TOOLS,
   REMOTE_MAX_WAIT_MS,
   REMOTE_MIN_POLL_MS,
   createEndpointShape,
@@ -17,8 +18,9 @@ import {
   waitForRequestShape,
   withErrorHandling,
   withShareHints
-} from "./chunk-GREHE3PB.mjs";
+} from "./chunk-BAGCOSXG.mjs";
 export {
+  LOCAL_ONLY_TOOLS,
   REMOTE_MAX_WAIT_MS,
   REMOTE_MIN_POLL_MS,
   createEndpointShape,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webhooks-cc/mcp",
-  "version": "1.19.0",
+  "version": "1.21.0",
   "mcpName": "io.github.kroqdotdev/webhooks-cc",
   "description": "MCP server for webhooks.cc — AI agent integration for webhook testing",
   "main": "dist/index.js",
@@ -44,7 +44,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.32.2",
     "zod": "^4.6.7",
-    "@webhooks-cc/sdk": "1.23.0"
+    "@webhooks-cc/sdk": "1.25.0"
   },
   "devDependencies": {
     "@types/node": "^26.6.6",