@zackbart/connecta 0.21.0 → 0.21.2

package/dist/connectors/remote-mcp.js

@@ -1,5 +1,5 @@
 import { Client, isInputRequiredResult, specTypeSchemas, StreamableHTTPClientTransport, UnauthorizedError, } from "@modelcontextprotocol/client";
-import { KvOAuthProvider } from "../auth/downstream-oauth.js";
+import { KvOAuthProvider, OAuthRefreshCoordinator, } from "../auth/downstream-oauth.js";
 import { MAX_CATALOG_TOOLS } from "../catalog-limits.js";
 import { ConnectorCallError, msg } from "../errors.js";
 import { CONNECTA_VERSION } from "../version.js";
@@ -328,6 +328,9 @@ export function remoteMcp(id, opts) {
     // must not recreate an ownerless connection under the ended scope.
     const closedScopes = new WeakSet();
     const isOauth = opts.auth?.type === "oauth";
+    // Long-lived enough for distinct request scopes in this connector runtime to
+    // join one token redemption. It owns no client, transport, or request state.
+    const refreshCoordinator = new OAuthRefreshCoordinator();
     const logger = opts.logger ?? console;
     const credentialAuth = opts.auth?.type === "credential" ? opts.auth : undefined;
     if (credentialAuth?.credential?.fields?.length) {
@@ -497,7 +500,7 @@ export function remoteMcp(id, opts) {
     const newProvider = (ctx, state) => {
         if (state?.provider)
             return state.provider;
-        const provider = new KvOAuthProvider(id, ctx.storage, `${ctx.baseUrl}/oauth/callback/${id}`);
+        const provider = new KvOAuthProvider(id, ctx.storage, `${ctx.baseUrl}/oauth/callback/${id}`, refreshCoordinator);
         if (state)
             state.provider = provider;
         return provider;
@@ -514,9 +517,10 @@ export function remoteMcp(id, opts) {
         const url = new URL(opts.url);
         const guardedFetch = redirectSafeFetch(id, opts.redirects);
         if (opts.auth?.type === "oauth") {
+            const oauthProvider = provider ?? newProvider(ctx);
             return new StreamableHTTPClientTransport(url, {
-                authProvider: provider ?? newProvider(ctx),
-                fetch: guardedFetch,
+                authProvider: oauthProvider,
+                fetch: refreshCoordinator.coordinatedFetch(oauthProvider, guardedFetch, ctx.signal),
             });
         }
         const headers = opts.auth?.type === "headers"

package/dist/executors/quickjs.js

@@ -278,6 +278,10 @@ class QuickJsChildPool {
                 "@zackbart/connecta/quickjs) when bundling the server.");
         }
         const child = fork(childPath, [], {
+            // The child needs only its entry path, exec arguments, and IPC channel.
+            // Do not copy deployment credentials or Node startup configuration into
+            // the process that contains the guest runtime.
+            env: {},
             execArgv: sourceMode ? ["--import", "tsx"] : [],
             stdio: ["ignore", "ignore", "pipe", "ipc"],
         });

package/dist/providers/cloudflare.js

@@ -375,6 +375,15 @@ function projectZone(value) {
         modifiedOn: zone["modified_on"],
     });
 }
+function projectZoneSetting(value) {
+    const setting = asRecord(value);
+    return compact({
+        id: setting["id"],
+        value: setting["value"],
+        editable: setting["editable"],
+        modifiedOn: setting["modified_on"],
+    });
+}
 function projectDnsRecord(value) {
     const record = asRecord(value);
     const comment = record["comment"] ? record["comment"] : undefined;
@@ -404,12 +413,38 @@ function projectWorkerScript(value) {
         usageModel: script["usage_model"],
     });
 }
+function projectWorkerSettings(value) {
+    const settings = asRecord(value);
+    return compact({
+        compatibilityDate: settings["compatibility_date"],
+        compatibilityFlags: settings["compatibility_flags"],
+        bindings: settings["bindings"],
+        limits: settings["limits"],
+        observability: settings["observability"],
+        placement: settings["placement"],
+        usageModel: settings["usage_model"],
+        tailConsumers: settings["tail_consumers"],
+        logpush: settings["logpush"],
+    });
+}
 function projectKvNamespace(value) {
     const namespace = asRecord(value);
     return compact({
         id: namespace["id"],
         title: namespace["title"],
         supportsUrlEncoding: namespace["supports_url_encoding"],
+        jurisdiction: namespace["jurisdiction"],
+    });
+}
+function projectKvBulkValues(value) {
+    const result = asRecord(value);
+    return compact({ values: result["values"] });
+}
+function projectKvBulkResult(value) {
+    const result = asRecord(value);
+    return compact({
+        successfulKeyCount: result["successful_key_count"],
+        unsuccessfulKeys: result["unsuccessful_keys"],
     });
 }
 function projectR2Bucket(value) {
@@ -434,6 +469,10 @@ function projectR2Object(value) {
         customMetadata: object["custom_metadata"],
     });
 }
+function projectR2Cors(value) {
+    const cors = asRecord(value);
+    return compact({ rules: cors["rules"] });
+}
 function projectKvKey(value) {
     const key = asRecord(value);
     return compact({
@@ -825,10 +864,137 @@ function uploadBody(args) {
         },
     };
 }
-const OPEN_OBJECT_OUTPUT_SCHEMA = {
+const ZONE_SETTING_SCHEMA = {
+    type: "object",
+    properties: {
+        id: { type: "string" },
+        value: {
+            type: ["string", "number", "boolean", "array", "object", "null"],
+            items: {},
+            additionalProperties: true,
+        },
+        editable: { type: "boolean" },
+        modifiedOn: { type: "string" },
+    },
+    required: ["id", "value"],
+};
+const RULESET_SCHEMA = {
+    type: "object",
+    properties: {
+        id: { type: "string" },
+        name: { type: "string" },
+        kind: { type: "string" },
+        phase: { type: "string" },
+        description: { type: "string" },
+        version: { type: "string" },
+        lastUpdated: { type: "string" },
+        rules: {
+            type: "array",
+            items: { type: "object", additionalProperties: true },
+        },
+    },
+    required: ["id", "name"],
+};
+const WORKER_SETTINGS_SCHEMA = {
+    type: "object",
+    properties: {
+        compatibilityDate: { type: "string" },
+        compatibilityFlags: { type: "array", items: { type: "string" } },
+        bindings: { type: "array", items: { type: "object", additionalProperties: true } },
+        limits: { type: "object", additionalProperties: true },
+        observability: { type: "object", additionalProperties: true },
+        placement: { type: "object", additionalProperties: true },
+        usageModel: { type: "string" },
+        tailConsumers: { type: "array", items: { type: "object", additionalProperties: true } },
+        logpush: { type: "boolean" },
+    },
+};
+const WORKER_DEPLOYMENT_SCHEMA = {
+    type: "object",
+    properties: {
+        id: { type: "string" },
+        createdOn: { type: "string" },
+        source: { type: "string" },
+        strategy: { type: "string" },
+        versions: { type: "array", items: { type: "object", additionalProperties: true } },
+    },
+    required: ["id"],
+};
+const KV_NAMESPACE_SCHEMA = {
+    type: "object",
+    properties: {
+        id: { type: "string" },
+        title: { type: "string" },
+        supportsUrlEncoding: { type: "boolean" },
+        jurisdiction: { type: "string", enum: ["eu", "fedramp", "us"] },
+        renamed: { type: "boolean" },
+        namespaceId: { type: "string" },
+    },
+};
+const KV_BULK_VALUES_SCHEMA = {
+    type: "object",
+    properties: {
+        values: {
+            type: "object",
+            additionalProperties: true,
+        },
+    },
+    required: ["values"],
+};
+const KV_BULK_RESULT_SCHEMA = {
+    type: "object",
+    properties: {
+        successfulKeyCount: { type: "number" },
+        unsuccessfulKeys: { type: "array", items: { type: "string" } },
+    },
+};
+const R2_CORS_SCHEMA = {
+    type: "object",
+    properties: {
+        rules: {
+            type: "array",
+            items: { type: "object", additionalProperties: true },
+        },
+    },
+    required: ["rules"],
+};
+const PAGES_DEPLOYMENT_SCHEMA = {
+    type: "object",
+    properties: {
+        id: { type: "string" },
+        projectName: { type: "string" },
+        environment: { type: "string" },
+        url: { type: "string" },
+        aliases: { type: "array", items: { type: "string" } },
+        stage: { type: "object", additionalProperties: true },
+        latestStage: { type: "object", additionalProperties: true },
+        createdOn: { type: "string" },
+        modifiedOn: { type: "string" },
+    },
+    required: ["id"],
+};
+const PAGES_DOMAIN_SCHEMA = {
+    type: "object",
+    properties: {
+        id: { type: "string" },
+        name: { type: "string" },
+        status: { type: "string" },
+        verificationData: { type: "object", additionalProperties: true },
+        createdOn: { type: "string" },
+    },
+    required: ["name"],
+};
+const PAGES_PROJECT_SCHEMA = {
     type: "object",
-    description: "Cloudflare's result object. Its fields depend on the endpoint.",
-    additionalProperties: true,
+    properties: {
+        name: { type: "string" },
+        subdomain: { type: "string" },
+        domains: { type: "array", items: { type: "string" } },
+        productionBranch: { type: "string" },
+        createdOn: { type: "string" },
+        latestDeployment: PAGES_DEPLOYMENT_SCHEMA,
+    },
+    required: ["name"],
 };
 const QUERY_INPUT_PROPERTY = {
     type: "array",
@@ -859,8 +1025,13 @@ const HEADERS_INPUT_PROPERTY = {
 };
 const R2_JURISDICTION_PROPERTY = {
     type: "string",
-    enum: ["default", "eu", "fedramp"],
-    description: "Bucket jurisdiction. Omit for ordinary buckets; set eu or fedramp for jurisdictional buckets.",
+    enum: ["default", "eu", "us", "fedramp"],
+    description: "Bucket jurisdiction. Omit for ordinary buckets; set eu, us, or fedramp for jurisdictional buckets.",
+};
+const KV_JURISDICTION_PROPERTY = {
+    type: "string",
+    enum: ["eu", "fedramp", "us"],
+    description: "Creation-only namespace jurisdiction. Omit for an ordinary namespace; it cannot be changed by rename_kv_namespace.",
 };
 const R2_BUCKET_NAME_PROPERTY = {
     type: "string",
@@ -921,7 +1092,7 @@ const DELETE_PROJECT_NAME_PROPERTY = {
 const SETTING_ID_PROPERTY = {
     type: "string",
     minLength: 1,
-    description: "Cloudflare zone setting id, such as ssl, brotli, http3, or min_tls_version.",
+    description: "Cloudflare zone setting id, such as ssl, brotli, webmcp_enabled, or webmcp_packs.",
 };
 const RECORD_ID_PROPERTY = {
     type: "string",
@@ -933,7 +1104,7 @@ const R2_BUCKET_SCHEMA = {
         name: { type: "string" },
         location: { type: "string" },
         storageClass: { type: "string" },
-        jurisdiction: { type: "string" },
+        jurisdiction: { type: "string", enum: ["default", "eu", "us", "fedramp"] },
         creationDate: { type: "string" },
     },
     required: ["name"],
@@ -1251,11 +1422,12 @@ function buildTools(scope, authentication) {
         }, [], ZONE_SCHEMA, getResult(send, (args) => ({ method: "GET", path: `/zones/${encodeURIComponent(zoneArg(args))}` }), (result, args) => args["raw"] === true ? result : projectZone(result))),
         // Removed tools: documentation/cloudflare.md#what-the-named-surface-deliberately-leaves-out.
         cfTool("get_zone_setting", "Get one zone setting by its Cloudflare setting id, such as ssl, always_use_https, min_tls_version, brotli, or development_mode.", readOnly, "zoneId", scope.zoneId, {
-            settingId: SETTING_ID_PROPERTY
-        }, ["settingId"], OPEN_OBJECT_OUTPUT_SCHEMA, getResult(send, (args) => ({
+            settingId: SETTING_ID_PROPERTY,
+            raw: RAW_INPUT_PROPERTY
+        }, ["settingId"], ZONE_SETTING_SCHEMA, getResult(send, (args) => ({
             method: "GET",
             path: `/zones/${encodeURIComponent(zoneArg(args))}/settings/${encodeURIComponent(requireString(args, "settingId"))}`,
-        }))),
+        }), (result, args) => args["raw"] === true ? result : projectZoneSetting(result))),
         cfTool("update_zone_setting", "Set one editable zone setting. Read it first: allowed value types and plan restrictions differ by setting.", { readOnlyHint: false, destructiveHint: true }, "zoneId", scope.zoneId, {
             settingId: SETTING_ID_PROPERTY,
             value: {
@@ -1263,13 +1435,13 @@ function buildTools(scope, authentication) {
                 description: "New setting value in the type returned by get_zone_setting. Arrays must contain strings.",
                 items: { type: "string" },
             }
-        }, ["settingId", "value"], OPEN_OBJECT_OUTPUT_SCHEMA, async (args, ctx) => {
+        }, ["settingId", "value"], ZONE_SETTING_SCHEMA, async (args, ctx) => {
             const { result } = await callCloudflare(send, {
                 method: "PATCH",
                 path: `/zones/${encodeURIComponent(zoneArg(args))}/settings/${encodeURIComponent(requireString(args, "settingId"))}`,
                 body: { value: args["value"] },
             }, ctx);
-            return result;
+            return projectZoneSetting(result);
         }),
         cfTool("list_zone_rulesets", "List zone rulesets for WAF, redirects, transforms, cache rules, configuration rules, and other Ruleset Engine phases.", readOnly, "zoneId", scope.zoneId, {
             perPage: {
@@ -1282,7 +1454,7 @@ function buildTools(scope, authentication) {
         }, [], {
             type: "object",
             properties: {
-                rulesets: { type: "array", items: OPEN_OBJECT_OUTPUT_SCHEMA },
+                rulesets: { type: "array", items: RULESET_SCHEMA },
                 nextCursor: NEXT_CURSOR_OUTPUT_PROPERTY,
             },
             required: ["rulesets"],
@@ -1307,7 +1479,7 @@ function buildTools(scope, authentication) {
                 minLength: 1,
                 description: "Ruleset id from list_zone_rulesets.",
             }
-        }, ["rulesetId"], OPEN_OBJECT_OUTPUT_SCHEMA, getResult(send, (args) => ({
+        }, ["rulesetId"], RULESET_SCHEMA, getResult(send, (args) => ({
             method: "GET",
             path: `/zones/${encodeURIComponent(zoneArg(args))}/rulesets/${encodeURIComponent(requireString(args, "rulesetId"))}`,
         }), projectRuleset)),
@@ -1385,14 +1557,15 @@ function buildTools(scope, authentication) {
             return pagedList("scripts", projectWorkerScript)(result, resultInfo, args["raw"] === true);
         }),
         cfTool("get_worker_settings", "Get a Worker's compatibility date and flags, bindings, limits, observability, placement, usage model, and other script settings.", readOnly, "accountId", scope.accountId, {
-            scriptName: SCRIPT_NAME_PROPERTY
-        }, ["scriptName"], OPEN_OBJECT_OUTPUT_SCHEMA, getResult(send, (args) => ({
+            scriptName: SCRIPT_NAME_PROPERTY,
+            raw: RAW_INPUT_PROPERTY
+        }, ["scriptName"], WORKER_SETTINGS_SCHEMA, getResult(send, (args) => ({
             method: "GET",
             path: `/accounts/${encodeURIComponent(accountArg(args))}/workers/scripts/${encodeURIComponent(requireString(args, "scriptName"))}/settings`,
-        }))),
+        }), (result, args) => args["raw"] === true ? result : projectWorkerSettings(result))),
         cfTool("list_worker_deployments", "List deployments of a Worker script, including version traffic allocations and deployment strategy.", readOnly, "accountId", scope.accountId, {
             scriptName: SCRIPT_NAME_PROPERTY
-        }, ["scriptName"], listOutputSchema("deployments", OPEN_OBJECT_OUTPUT_SCHEMA), async (args, ctx) => {
+        }, ["scriptName"], listOutputSchema("deployments", WORKER_DEPLOYMENT_SCHEMA), async (args, ctx) => {
             const { result } = await callCloudflare(send, {
                 method: "GET",
                 path: `/accounts/${encodeURIComponent(accountArg(args))}/workers/scripts/${encodeURIComponent(requireString(args, "scriptName"))}/deployments`,
@@ -1406,7 +1579,7 @@ function buildTools(scope, authentication) {
         cfTool("get_worker_deployment", "Get one Worker deployment and its version traffic allocations.", readOnly, "accountId", scope.accountId, {
             scriptName: SCRIPT_NAME_PROPERTY,
             deploymentId: WORKER_DEPLOYMENT_ID_PROPERTY
-        }, ["scriptName", "deploymentId"], OPEN_OBJECT_OUTPUT_SCHEMA, getResult(send, (args) => ({
+        }, ["scriptName", "deploymentId"], WORKER_DEPLOYMENT_SCHEMA, getResult(send, (args) => ({
             method: "GET",
             path: `/accounts/${encodeURIComponent(accountArg(args))}/workers/scripts/${encodeURIComponent(requireString(args, "scriptName"))}/deployments/${encodeURIComponent(requireString(args, "deploymentId"))}`,
         }), projectWorkerDeployment)),
@@ -1437,6 +1610,7 @@ function buildTools(scope, authentication) {
                 id: { type: "string" },
                 title: { type: "string" },
                 supportsUrlEncoding: { type: "boolean" },
+                jurisdiction: { type: "string", enum: ["eu", "fedramp", "us"] },
             },
             required: ["id", "title"],
         }), async (args, ctx) => {
@@ -1452,7 +1626,7 @@ function buildTools(scope, authentication) {
         }),
         cfTool("get_kv_namespace", "Get one Workers KV namespace by id.", readOnly, "accountId", scope.accountId, {
             namespaceId: NAMESPACE_ID_PROPERTY
-        }, ["namespaceId"], OPEN_OBJECT_OUTPUT_SCHEMA, getResult(send, (args) => ({
+        }, ["namespaceId"], KV_NAMESPACE_SCHEMA, getResult(send, (args) => ({
             method: "GET",
             path: `/accounts/${encodeURIComponent(accountArg(args))}/storage/kv/namespaces/${encodeURIComponent(requireString(args, "namespaceId"))}`,
         }), projectKvNamespace)),
@@ -1462,12 +1636,16 @@ function buildTools(scope, authentication) {
                 minLength: 1,
                 maxLength: 512,
                 description: "Human-readable namespace title.",
-            }
-        }, ["title"], OPEN_OBJECT_OUTPUT_SCHEMA, async (args, ctx) => {
+            },
+            jurisdiction: KV_JURISDICTION_PROPERTY
+        }, ["title"], KV_NAMESPACE_SCHEMA, async (args, ctx) => {
             const { result } = await callCloudflare(send, {
                 method: "POST",
                 path: `/accounts/${encodeURIComponent(accountArg(args))}/storage/kv/namespaces`,
-                body: { title: requireString(args, "title") },
+                body: compact({
+                    title: requireString(args, "title"),
+                    jurisdiction: args["jurisdiction"],
+                }),
             }, ctx);
             return projectKvNamespace(result);
         }),
@@ -1479,13 +1657,15 @@ function buildTools(scope, authentication) {
                 maxLength: 512,
                 description: "Replacement namespace title.",
             }
-        }, ["namespaceId", "title"], OPEN_OBJECT_OUTPUT_SCHEMA, async (args, ctx) => {
+        }, ["namespaceId", "title"], KV_NAMESPACE_SCHEMA, async (args, ctx) => {
             const { result } = await callCloudflare(send, {
                 method: "PUT",
                 path: `/accounts/${encodeURIComponent(accountArg(args))}/storage/kv/namespaces/${encodeURIComponent(requireString(args, "namespaceId"))}`,
                 body: { title: requireString(args, "title") },
             }, ctx);
-            return result ?? { renamed: true, namespaceId: args["namespaceId"] };
+            return result
+                ? projectKvNamespace(result)
+                : { renamed: true, namespaceId: args["namespaceId"] };
         }),
         cfTool("delete_kv_namespace", "Permanently delete a Workers KV namespace and every key stored in it.", { readOnlyHint: false, destructiveHint: true }, "accountId", scope.accountId, {
             namespaceId: NAMESPACE_ID_PROPERTY
@@ -1516,7 +1696,18 @@ function buildTools(scope, authentication) {
         }, ["namespaceId"], {
             type: "object",
             properties: {
-                keys: { type: "array", items: OPEN_OBJECT_OUTPUT_SCHEMA },
+                keys: {
+                    type: "array",
+                    items: {
+                        type: "object",
+                        properties: {
+                            name: { type: "string" },
+                            expiration: { type: "number" },
+                            metadata: {},
+                        },
+                        required: ["name"],
+                    },
+                },
                 nextCursor: NEXT_CURSOR_OUTPUT_PROPERTY,
             },
             required: ["keys"],
@@ -1554,7 +1745,7 @@ function buildTools(scope, authentication) {
                 enum: ["text", "json"],
                 description: "Return strings as stored, or parse JSON values before returning them.",
             }
-        }, ["namespaceId", "keys"], OPEN_OBJECT_OUTPUT_SCHEMA, async (args, ctx) => {
+        }, ["namespaceId", "keys"], KV_BULK_VALUES_SCHEMA, async (args, ctx) => {
             const { result } = await callCloudflare(send, {
                 method: "POST",
                 path: `/accounts/${encodeURIComponent(accountArg(args))}/storage/kv/namespaces/${encodeURIComponent(requireString(args, "namespaceId"))}/bulk/get`,
@@ -1564,7 +1755,7 @@ function buildTools(scope, authentication) {
                     type: args["type"],
                 }),
             }, ctx);
-            return asRecord(result);
+            return projectKvBulkValues(result);
         }),
         cfTool("bulk_write_kv_values", "Create or replace multiple Workers KV values, with optional expirations and JSON metadata.", { readOnlyHint: false, destructiveHint: true }, "accountId", scope.accountId, {
             namespaceId: NAMESPACE_ID_PROPERTY,
@@ -1609,13 +1800,13 @@ function buildTools(scope, authentication) {
                     additionalProperties: false,
                 },
             }
-        }, ["namespaceId", "entries"], OPEN_OBJECT_OUTPUT_SCHEMA, async (args, ctx) => {
+        }, ["namespaceId", "entries"], KV_BULK_RESULT_SCHEMA, async (args, ctx) => {
             const { result } = await callCloudflare(send, {
                 method: "PUT",
                 path: `/accounts/${encodeURIComponent(accountArg(args))}/storage/kv/namespaces/${encodeURIComponent(requireString(args, "namespaceId"))}/bulk`,
                 body: args["entries"],
             }, ctx);
-            return asRecord(result);
+            return projectKvBulkResult(result);
         }),
         cfTool("bulk_delete_kv_values", "Permanently delete multiple keys from a Workers KV namespace.", { readOnlyHint: false, destructiveHint: true }, "accountId", scope.accountId, {
             namespaceId: NAMESPACE_ID_PROPERTY,
@@ -1626,13 +1817,13 @@ function buildTools(scope, authentication) {
                 items: { type: "string", minLength: 1, maxLength: 512 },
                 description: "Key names to delete, up to Cloudflare's 10,000-key bulk limit.",
             }
-        }, ["namespaceId", "keys"], OPEN_OBJECT_OUTPUT_SCHEMA, async (args, ctx) => {
+        }, ["namespaceId", "keys"], KV_BULK_RESULT_SCHEMA, async (args, ctx) => {
             const { result } = await callCloudflare(send, {
                 method: "POST",
                 path: `/accounts/${encodeURIComponent(accountArg(args))}/storage/kv/namespaces/${encodeURIComponent(requireString(args, "namespaceId"))}/bulk/delete`,
                 body: args["keys"],
             }, ctx);
-            return asRecord(result);
+            return projectKvBulkResult(result);
         }),
         cfTool("list_r2_buckets", "List R2 buckets in an account, with location and storage class.", readOnly, "accountId", scope.accountId, {
             nameContains: {
@@ -1829,34 +2020,15 @@ function buildTools(scope, authentication) {
         cfTool("get_r2_cors", "Get the browser CORS rules configured on an R2 bucket.", readOnly, "accountId", scope.accountId, {
             bucketName: R2_BUCKET_NAME_PROPERTY,
             jurisdiction: R2_JURISDICTION_PROPERTY
-        }, ["bucketName"], OPEN_OBJECT_OUTPUT_SCHEMA, getResult(send, (args) => ({
+        }, ["bucketName"], R2_CORS_SCHEMA, getResult(send, (args) => ({
             method: "GET",
             path: `/accounts/${encodeURIComponent(accountArg(args))}/r2/buckets/${encodeURIComponent(requireString(args, "bucketName"))}/cors`,
             headers: r2Headers(args),
-        }), asRecord)),
+        }), projectR2Cors)),
         cfTool("list_pages_projects", "List Cloudflare Pages projects in an account, with their production branch and latest deployment.", readOnly, "accountId", scope.accountId, {
             ...pagingInputProperties(1, 100, { bounds: "undocumented" }),
             raw: RAW_INPUT_PROPERTY
-        }, [], listOutputSchema("projects", {
-            type: "object",
-            properties: {
-                name: { type: "string" },
-                subdomain: { type: "string" },
-                domains: { type: "array", items: { type: "string" } },
-                productionBranch: { type: "string" },
-                createdOn: { type: "string" },
-                latestDeployment: {
-                    type: "object",
-                    properties: {
-                        id: { type: "string" },
-                        environment: { type: "string" },
-                        url: { type: "string" },
-                        createdOn: { type: "string" },
-                    },
-                },
-            },
-            required: ["name"],
-        }), async (args, ctx) => {
+        }, [], listOutputSchema("projects", PAGES_PROJECT_SCHEMA), async (args, ctx) => {
             const { result, resultInfo } = await callCloudflare(send, {
                 method: "GET",
                 path: `/accounts/${encodeURIComponent(accountArg(args))}/pages/projects`,
@@ -1870,7 +2042,7 @@ function buildTools(scope, authentication) {
         cfTool("get_pages_project", "Get one Pages project, including build configuration, deployment configuration, domains, and latest deployment.", readOnly, "accountId", scope.accountId, {
             projectName: PROJECT_NAME_PROPERTY,
             raw: RAW_INPUT_PROPERTY
-        }, ["projectName"], OPEN_OBJECT_OUTPUT_SCHEMA, getResult(send, (args) => ({
+        }, ["projectName"], PAGES_PROJECT_SCHEMA, getResult(send, (args) => ({
             method: "GET",
             path: `/accounts/${encodeURIComponent(accountArg(args))}/pages/projects/${encodeURIComponent(requireString(args, "projectName"))}`,
         }), (result, args) => args["raw"] === true ? result : projectPagesProject(result))),
@@ -1882,7 +2054,7 @@ function buildTools(scope, authentication) {
                 description: "Optional deployment environment filter.",
             },
             ...pagingInputProperties(1, 100, { bounds: "undocumented" })
-        }, ["projectName"], listOutputSchema("deployments", OPEN_OBJECT_OUTPUT_SCHEMA), async (args, ctx) => {
+        }, ["projectName"], listOutputSchema("deployments", PAGES_DEPLOYMENT_SCHEMA), async (args, ctx) => {
             const { result, resultInfo } = await callCloudflare(send, {
                 method: "GET",
                 path: `/accounts/${encodeURIComponent(accountArg(args))}/pages/projects/${encodeURIComponent(requireString(args, "projectName"))}/deployments`,
@@ -1901,14 +2073,14 @@ function buildTools(scope, authentication) {
             projectName: PROJECT_NAME_PROPERTY,
             deploymentId: DEPLOYMENT_ID_PROPERTY,
             raw: RAW_INPUT_PROPERTY
-        }, ["projectName", "deploymentId"], OPEN_OBJECT_OUTPUT_SCHEMA, getResult(send, (args) => ({
+        }, ["projectName", "deploymentId"], PAGES_DEPLOYMENT_SCHEMA, getResult(send, (args) => ({
             method: "GET",
             path: `/accounts/${encodeURIComponent(accountArg(args))}/pages/projects/${encodeURIComponent(requireString(args, "projectName"))}/deployments/${encodeURIComponent(requireString(args, "deploymentId"))}`,
         }), (result, args) => args["raw"] === true ? result : projectPagesDeployment(result))),
         cfTool("retry_pages_deployment", "Retry a failed or cancelled Pages deployment using its existing source and build configuration.", { readOnlyHint: false }, "accountId", scope.accountId, {
             projectName: PAGES_PROJECT_NAME_PROPERTY,
             deploymentId: RETRY_DEPLOYMENT_ID_PROPERTY
-        }, ["projectName", "deploymentId"], OPEN_OBJECT_OUTPUT_SCHEMA, async (args, ctx) => {
+        }, ["projectName", "deploymentId"], PAGES_DEPLOYMENT_SCHEMA, async (args, ctx) => {
             const { result } = await callCloudflare(send, {
                 method: "POST",
                 path: `/accounts/${encodeURIComponent(accountArg(args))}/pages/projects/${encodeURIComponent(requireString(args, "projectName"))}/deployments/${encodeURIComponent(requireString(args, "deploymentId"))}/retry`,
@@ -1918,7 +2090,7 @@ function buildTools(scope, authentication) {
         cfTool("rollback_pages_deployment", "Promote a previous Pages deployment to production, replacing the currently served production deployment.", { readOnlyHint: false, destructiveHint: true }, "accountId", scope.accountId, {
             projectName: PAGES_PROJECT_NAME_PROPERTY,
             deploymentId: ROLLBACK_DEPLOYMENT_ID_PROPERTY
-        }, ["projectName", "deploymentId"], OPEN_OBJECT_OUTPUT_SCHEMA, async (args, ctx) => {
+        }, ["projectName", "deploymentId"], PAGES_DEPLOYMENT_SCHEMA, async (args, ctx) => {
             const { result } = await callCloudflare(send, {
                 method: "POST",
                 path: `/accounts/${encodeURIComponent(accountArg(args))}/pages/projects/${encodeURIComponent(requireString(args, "projectName"))}/deployments/${encodeURIComponent(requireString(args, "deploymentId"))}/rollback`,
@@ -1934,7 +2106,7 @@ function buildTools(scope, authentication) {
         }))),
         cfTool("list_pages_domains", "List custom domains attached to a Pages project and their validation status.", readOnly, "accountId", scope.accountId, {
             projectName: PAGES_PROJECT_NAME_PROPERTY
-        }, ["projectName"], listOutputSchema("domains", OPEN_OBJECT_OUTPUT_SCHEMA), async (args, ctx) => {
+        }, ["projectName"], listOutputSchema("domains", PAGES_DOMAIN_SCHEMA), async (args, ctx) => {
             const { result } = await callCloudflare(send, {
                 method: "GET",
                 path: `/accounts/${encodeURIComponent(accountArg(args))}/pages/projects/${encodeURIComponent(requireString(args, "projectName"))}/domains`,
@@ -1944,7 +2116,7 @@ function buildTools(scope, authentication) {
         cfTool("add_pages_domain", "Attach a custom domain to a Pages project. DNS ownership and validation still apply.", { readOnlyHint: false }, "accountId", scope.accountId, {
             projectName: PAGES_PROJECT_NAME_PROPERTY,
             domain: { type: "string", minLength: 1, description: "Fully qualified custom domain to attach." }
-        }, ["projectName", "domain"], OPEN_OBJECT_OUTPUT_SCHEMA, async (args, ctx) => {
+        }, ["projectName", "domain"], PAGES_DOMAIN_SCHEMA, async (args, ctx) => {
             const { result } = await callCloudflare(send, {
                 method: "POST",
                 path: `/accounts/${encodeURIComponent(accountArg(args))}/pages/projects/${encodeURIComponent(requireString(args, "projectName"))}/domains`,

package/dist/providers/linear.js

@@ -42,6 +42,10 @@ const READ_ONLY_TOOLS = new Set([
     "get_team",
     "list_users",
     "get_user",
+    "get_workspace",
+    // Templates
+    "list_templates",
+    "get_template",
     // Status updates
     "get_status_updates",
     // Releases
@@ -103,6 +107,9 @@ const WRITE_TOOLS = new Map([
     ["create_attachment_from_upload", "additive"],
     ["create_attachment", "additive"],
     ["delete_attachment", "destructive"],
+    // Explicit issue access
+    ["share_issue", "destructive"],
+    ["unshare_issue", "destructive"],
     // Customer requests (plan-gated)
     ["save_customer", "destructive"],
     ["delete_customer", "destructive"],

package/dist/providers/mixpanel.js

@@ -74,15 +74,16 @@ const WRITE_TOOLS = new Map([
     ["Update-Experiment", "destructive"],
     ["Create-Feature-Flag", "additive"],
     ["Update-Feature-Flag", "destructive"],
+    ["Fill-Event-Metadata", "destructive"],
 ]);
-/** Live US hosted-MCP schemas reviewed read-only on 2026-08-13 (#395). */
+/** Live US hosted-MCP schemas reviewed read-only on 2026-08-30 (#395, #512). */
 const MIXPANEL_SCHEMA_DIGESTS = {
     "Bulk-Edit-Events": "sha256:94512138df153de95436371f5a313e32b97faffebda3be6c0c69d09d1ff2b340",
     "Bulk-Edit-Properties": "sha256:93481eb896ded45b623c678612e2156439efbaad5b4d660da1f2b087e7409ee3",
     "Create-Cohort": "sha256:ea687f4bc607f8bfb5b1949e060239d6f7d629d3ec80fb0b72eae6cc6156ed03",
     "Create-Custom-Property": "sha256:d22818b812f3fd0e785a5bbbee26cf099eaa911d5b6f383f94cf458a2ed26294",
     "Create-Dashboard": "sha256:bd3b6e5134d27dafb04ccdf04d19e54dd23e6e2dc16989e418006e484268037b",
-    "Create-Experiment": "sha256:3307bd7202f5483adbc28a9ef1d562095d6942eb2c3a15308f458072c93e6888",
+    "Create-Experiment": "sha256:1cfc2edeb2ac2d329a531d2095671a0653ab5b94b9e233b34268ff29a48c5ac5",
     "Create-Feature-Flag": "sha256:3460d11d726727349cac62db5c19915ab589b7f1d8387042f0a3783356b252c4",
     "Create-Lookup-Table": "sha256:c2fefa33a4f19fc65f394fecdc7126cab0ae874f7c97018cf003d8462a049e4c",
     "Create-Metric": "sha256:315766d0c197d87bb44aedd16732f6e69fbfc93661d1fcfc177cadc1751f26ce",
@@ -98,13 +99,14 @@ const MIXPANEL_SCHEMA_DIGESTS = {
     "Edit-Event": "sha256:28c47da0b56f57da0f11eb11435441a39ecd5175600f854442744c66a379ef93",
     "Edit-Property": "sha256:11975587d2a566edc468db7cb24df70167d12068f30c1fe52c84f543cf4e2399",
     "Explain-Experiment-Health-Check": "sha256:a50b1263247012dc78521bf6c1dd18584a7b08d46221a444b1ca49c81d3286e5",
+    "Fill-Event-Metadata": "sha256:53accc988f216bdd5d7a259d731f6df82549e4e6146b191f1815a0d1a72a1abe",
     "Find-Duplicate-Groups": "sha256:8f944cef9a147eab3c51bfcf1b873cef1409e5a6c21565d34e7ed20d23dcebb7",
     "Get-Business-Context": "sha256:309f5ba864c90132061096b4f0ebc1e78544a6486bac3a45bd661d16bcab2b6c",
     "Get-Cohort": "sha256:e18c500459edd9c2b6a614a3f6c97b668786be9abf72929a0a50086bdadb1dae",
     "Get-Custom-Property": "sha256:d1cbce906cee66d422846c8ef1a745bbeac2c058ecad6b1ee8dcdd2120fa86be",
     "Get-Dashboard": "sha256:56659fa3277723b75e24f3b4ca142ac9cd62120fb97e6c9252c221d00cdf8509",
     "Get-Events": "sha256:d206fe30ab47d64bf6090bffdb4d119a80cfc2a35963bbe7fd52d56060090ded",
-    "Get-Experiment": "sha256:f9f04a2bb136809c754ea612963e1cdfb57c2c9ecc34a53ac6e1730f8758798f",
+    "Get-Experiment": "sha256:ab685aa985aa2ec36d9cbeb1b3c1ef298b020e552e8fdce12e75abbeb4706f2b",
     "Get-Experiment-Results-Interpretation-Guidance": "sha256:e517d9759f66f4a7ad15b0b67ffaabfb605e80949afcf41d007dfafd8f3e9574",
     "Get-Experiment-Setup-Guidance": "sha256:e517d9759f66f4a7ad15b0b67ffaabfb605e80949afcf41d007dfafd8f3e9574",
     "Get-Feature-Flag": "sha256:129de58b379ffba272bdbcee2b5759262e586dd415edc2067a69e9844d4d0877",
@@ -136,7 +138,7 @@ const MIXPANEL_SCHEMA_DIGESTS = {
     "Update-Cohort": "sha256:ebe0d5afcc00e23eef55f079cd1816c851c2c647dff9565b7045f1f1615663f2",
     "Update-Custom-Property": "sha256:781aaaab41c1ab5958062dc393d02b1df2ef2a09a28d3c4f21ae3177f4f53c86",
     "Update-Dashboard": "sha256:2cc179ba75eda476ba7488f01503d947f023a4460aa98c4806ef0ab10c3b3ce8",
-    "Update-Experiment": "sha256:52ebf7595e48a40e218ff463ed72942a4818abc3ce93d8da6fafa8d358326437",
+    "Update-Experiment": "sha256:3ea3902555c146f45127fc563b36ffb7ff04b7594765dac9ae98cc09dc432808",
     "Update-Feature-Flag": "sha256:9b34b19164168938d08a75d268c9becf8d189c85a1789a45061ae304041faf7c",
     "Update-Lookup-Table": "sha256:ef28f1ec9c9484a7a53b5e2b6659e70f79a8e71e55bda17025aa4ab3c23b6a63",
     "Update-Metric": "sha256:739bb6abdab19282afd4a6644a96183daabe9098a5322c44a77b840608a5ee9d",