@ziggs-ai/ziggs-mcp 0.9.2 → 0.9.4

package/dist/capabilityAdapter.js

@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import { READ_ONLY, WRITE, DESTRUCTIVE } from './toolAnnotations.js';
+import { registerStrictTool } from './strictParams.js';
 import { toolError } from './toolError.js';
 /** One JSON text-content result shape for every MCP tool (was copied 3×). */
 export function textResult(data) {
@@ -58,7 +59,7 @@ export function registerCapability(server, cap, creds, opts = {}) {
         : cap.annotation === 'destructive'
             ? DESTRUCTIVE
             : WRITE;
-    server.tool(cap.names.mcp, opts.description ?? cap.descriptions.mcp, toZodShape(cap.params), annotations, async (args) => {
+    registerStrictTool(server, cap.names.mcp, opts.description ?? cap.descriptions.mcp, toZodShape(cap.params), annotations, async (args) => {
         try {
             const env = { creds, webUrl: opts.webUrl, surface: 'mcp' };
             const result = await cap.handler(args, env);

package/dist/config.js

@@ -1,5 +1,6 @@
 import 'dotenv/config';
 import { z } from 'zod';
+import { configureApiClient } from '@ziggs-ai/api-client';
 import { MINT_KEY_HELP, resolveDelegateAgentId } from './operatorKey.js';
 const envSchema = z.object({
     ZIGGS_API_URL: z.string().optional(),
@@ -51,8 +52,12 @@ export function loadConfig() {
     catch (e) {
         throw e instanceof Error ? e : new Error(String(e));
     }
-    if (parsed.data.ZIGGS_API_URL && !process.env.HTTP_URL) {
-        process.env.HTTP_URL = parsed.data.ZIGGS_API_URL;
+    // api-client reads injected config, not the environment (ZIG-652). This
+    // server owns its process, so it hands over whichever base URL it resolved.
+    const httpUrl = process.env.HTTP_URL || parsed.data.ZIGGS_API_URL;
+    if (httpUrl) {
+        process.env.HTTP_URL = httpUrl;
+        configureApiClient({ httpUrl });
     }
     return {
         ...parsed.data,

package/dist/connectionCreds.d.ts

@@ -1,4 +1,4 @@
-import type { Creds } from '@ziggs-ai/api-client';
+import { type Creds } from '@ziggs-ai/api-client';
 import type { ZiggsMcpConfig } from './config.js';
 export declare function parseBearerAuthorization(header: string | string[] | undefined): string;
 /** Per-connection credentials from HTTP Authorization (ZIG-431 / ZIG-466). */

package/dist/connectionCreds.js

@@ -1,3 +1,4 @@
+import { configureApiClient } from '@ziggs-ai/api-client';
 import { resolveDelegateAgentId, MINT_KEY_HELP } from './operatorKey.js';
 export function parseBearerAuthorization(header) {
     const raw = Array.isArray(header) ? header[0] : header;
@@ -15,6 +16,9 @@ export function connectionFromBearer(bearer, httpBaseUrl, ownerUserId) {
     const resolvedAgentId = resolveDelegateAgentId(bearer, undefined);
     if (httpBaseUrl) {
         process.env.HTTP_URL = httpBaseUrl;
+        // Same global reach as the env write it replaces (ZIG-652): api-client
+        // holds one base URL per process, so the last connection wins here too.
+        configureApiClient({ httpUrl: httpBaseUrl });
     }
     const cfg = {
         ZIGGS_OPERATOR_KEY: bearer,

package/dist/inboxToolResult.js

@@ -125,10 +125,11 @@ export function buildReadPlan(inbox, grantsByScope, self = { agentId: '' }) {
                 break;
             case 'task-state':
             case 'agreement':
-                // Deliberately no read call. These arrive as standing state elsewhere on
-                // the envelope — `tasksAwaitingMe` and `proposalsAwaitingMe` — and both
-                // already contribute their own plan entries above. A read here would be
-                // a duplicate of a call the agent has been handed.
+            case 'quest':
+                // Deliberately no read call. Tasks/proposals arrive as standing state
+                // elsewhere on the envelope; quests (ZIG-1185) ride `questsAwaitingMe`
+                // and are host-triaged with a plain string compare — never an LLM read
+                // plan entry (that would recreate the per-quest token drain).
                 break;
             default:
                 // Compile-time exhaustiveness: a kind added to the vocabulary no longer

package/dist/strictParams.d.ts

@@ -0,0 +1,24 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { ToolAnnotations } from '@modelcontextprotocol/sdk/types.js';
+import { z, type ZodRawShape, type ZodObject } from 'zod';
+/**
+ * ZIG-1215 — registering a tool with a plain `ZodRawShape` lets the MCP SDK
+ * wrap it in a default `z.object()`, which *strips* unknown keys instead of
+ * rejecting them. A misspelled param (`nweChat` for `newChat`) was therefore
+ * dropped and the call ran anyway, reporting success for the opposite of what
+ * the caller asked for.
+ *
+ * A human typing that into a form gets a red field; an agent got silence, and
+ * silence reads as confirmation — there was no feedback loop to self-correct
+ * against. So every tool schema is built strict, and the rejection names both
+ * the offending key and the params the tool actually accepts.
+ */
+export type StrictShape<S extends ZodRawShape> = ZodObject<S, 'strict', z.ZodTypeAny>;
+export declare function strictParams<S extends ZodRawShape>(toolName: string, shape: S): StrictShape<S>;
+/**
+ * `server.tool(name, description, shape, annotations, cb)` with the shape made
+ * strict. The positional `tool()` overloads only accept a raw shape (a built
+ * ZodObject is parsed as annotations there), so the strict schema has to go
+ * through `registerTool`'s config object.
+ */
+export declare function registerStrictTool<S extends ZodRawShape>(server: McpServer, name: string, description: string, shape: S, annotations: ToolAnnotations, cb: Parameters<typeof server.registerTool<never, StrictShape<S>>>[2]): void;

package/dist/strictParams.js

@@ -0,0 +1,32 @@
+import { z } from 'zod';
+export function strictParams(toolName, shape) {
+    const accepted = Object.keys(shape);
+    return z
+        .object(shape, {
+        // zod's default is "Unrecognized key(s) in object: 'nweChat'" — true but
+        // it leaves the caller to guess what the right key was. The issue carries
+        // `keys`, so the message can name the typo and the menu next to it.
+        errorMap: (issue, ctx) => {
+            if (issue.code === z.ZodIssueCode.unrecognized_keys) {
+                const offenders = issue.keys.map((k) => `"${k}"`).join(', ');
+                const menu = accepted.length ? accepted.join(', ') : '(none)';
+                return {
+                    message: `Unknown parameter(s) ${offenders} — ${toolName} did not run. ` +
+                        `Accepted params: ${menu}. Check for a typo and call again; ` +
+                        `nothing was changed.`,
+                };
+            }
+            return { message: ctx.defaultError };
+        },
+    })
+        .strict();
+}
+/**
+ * `server.tool(name, description, shape, annotations, cb)` with the shape made
+ * strict. The positional `tool()` overloads only accept a raw shape (a built
+ * ZodObject is parsed as annotations there), so the strict schema has to go
+ * through `registerTool`'s config object.
+ */
+export function registerStrictTool(server, name, description, shape, annotations, cb) {
+    server.registerTool(name, { description, inputSchema: strictParams(name, shape), annotations }, cb);
+}

package/dist/tools.js

@@ -17,6 +17,7 @@ function buildRelayCoordinatorTaskBody(opts) {
     };
 }
 import { READ_ONLY, WRITE, DESTRUCTIVE } from './toolAnnotations.js';
+import { registerStrictTool } from './strictParams.js';
 import { toolError } from './toolError.js';
 import { registerCapability, registerCapabilities, textResult, } from './capabilityAdapter.js';
 // ZIG-557: the protocol sentences (loop / ack / humanAttention) are sourced
@@ -132,7 +133,7 @@ async function loadSessionActionsPayload(creds, cfg, opts) {
 // browse view and the relay-provisioning composite.
 function registerMarketplaceTools(server, creds) {
     registerCapability(server, marketplaceViewCapability, creds);
-    server.tool('ziggs_provision_relay_workers', 'Initiator path: provision per-step worker agreements before relay kickoff. Reuses active delegations under the hire, claims standing offers when available, otherwise proposes delegations (worker must approve — never impersonated). Returns relay:v1 payload and POST /tasks body when all steps are active.', {
+    registerStrictTool(server, 'ziggs_provision_relay_workers', 'Initiator path: provision per-step worker agreements before relay kickoff. Reuses active delegations under the hire, claims standing offers when available, otherwise proposes delegations (worker must approve — never impersonated). Returns relay:v1 payload and POST /tasks body when all steps are active.', {
         hireAgreementId: z.string(),
         chatId: z
             .string()
@@ -188,7 +189,7 @@ function registerMarketplaceTools(server, creds) {
 }
 function registerConnectionTools(server, creds) {
     registerCapability(server, connectionProxyCapability, creds);
-    server.tool('ziggs_connection_list', 'Discover the third-party connections (credentials like GitHub/Jira, NOT agent-to-agent Links — see ziggs_link_list for that) you hold grants for (e.g. "is GitHub connected?") without the owner sharing connectionId/grantId out of band. ' +
+    registerStrictTool(server, 'ziggs_connection_list', 'Discover the third-party connections (credentials like GitHub/Jira, NOT agent-to-agent Links — see ziggs_link_list for that) you hold grants for (e.g. "is GitHub connected?") without the owner sharing connectionId/grantId out of band. ' +
         'Returns, per connection: connectionId, provider, and the grant(s) you hold — each as the canonical grant shape (grantId, scope, caveats, and grant health active/expired/revoked). ' +
         'Read-only — never returns credential material. Feed the connectionId + a grantId with health "active" into ziggs_connection_proxy to actually use it.', {}, READ_ONLY, async () => {
         try {
@@ -202,7 +203,7 @@ function registerConnectionTools(server, creds) {
     registerCapability(server, requestConnectionCapability, creds);
 }
 export function registerZiggsTools(server, creds, cfg) {
-    server.tool('ziggs_auth_status', 'Verify MCP OAuth binding: delegate agent id, owner user id, and org scope. Call after connect before inbox/chats. Includes pendingDecisions summary when approve/reject is waiting. ("Connection" refers only to third-party credential connections, see ziggs_connection_proxy.)', {}, READ_ONLY, async () => {
+    registerStrictTool(server, 'ziggs_auth_status', 'Verify MCP OAuth binding: delegate agent id, owner user id, and org scope. Call after connect before inbox/chats. Includes pendingDecisions summary when approve/reject is waiting. ("Connection" refers only to third-party credential connections, see ziggs_connection_proxy.)', {}, READ_ONLY, async () => {
         const claims = decodeOperatorKeyClaims(creds.operatorKey);
         const webOrigin = resolveWebAppOrigin(cfg.ZIGGS_WEB_URL);
         // ZIG-1120 #4 — delegate access and session actions are independent.
@@ -276,7 +277,7 @@ export function registerZiggsTools(server, creds, cfg) {
                 : 'Next: ziggs_inbox or ziggs_pending_decisions at session start.',
         });
     });
-    server.tool('ziggs_org_list', 'List every org you (the operator) belong to — { orgId, name, kind, role }. Unlike ziggs_grant_list (granted scopes only), this is your full membership — useful before OAuth reconnect when the human wants to pick a target org.', {}, READ_ONLY, async () => {
+    registerStrictTool(server, 'ziggs_org_list', 'List every org you (the operator) belong to — { orgId, name, kind, role }. Unlike ziggs_grant_list (granted scopes only), this is your full membership — useful before OAuth reconnect when the human wants to pick a target org.', {}, READ_ONLY, async () => {
         try {
             const orgs = await fetchMyOrgs(creds);
             return textResult({ count: orgs.length, orgs });
@@ -285,7 +286,7 @@ export function registerZiggsTools(server, creds, cfg) {
             return toolError(e);
         }
     });
-    server.tool('ziggs_pending_decisions', ZIGGS_PENDING_DECISIONS_DESCRIPTION, {}, READ_ONLY, async () => {
+    registerStrictTool(server, 'ziggs_pending_decisions', ZIGGS_PENDING_DECISIONS_DESCRIPTION, {}, READ_ONLY, async () => {
         try {
             const payload = await loadSessionActionsPayload(creds, cfg);
             const decisions = (payload.decisions ?? []);
@@ -303,7 +304,7 @@ export function registerZiggsTools(server, creds, cfg) {
         }
     });
     if (cfg.debugTools) {
-        server.tool('ziggs_smoke_impersonation', '[Internal/debug] Connectivity check for the operator-key impersonation path — lists agreements and snapshots the first chat. Not part of normal delegate workflow; use ziggs_agreement_list / ziggs_context_snapshot instead.', {}, READ_ONLY, async () => {
+        registerStrictTool(server, 'ziggs_smoke_impersonation', '[Internal/debug] Connectivity check for the operator-key impersonation path — lists agreements and snapshots the first chat. Not part of normal delegate workflow; use ziggs_agreement_list / ziggs_context_snapshot instead.', {}, READ_ONLY, async () => {
             try {
                 const agreements = await getMyAgreements({}, creds);
                 const chats = await listMyChats(creds);
@@ -325,7 +326,7 @@ export function registerZiggsTools(server, creds, cfg) {
             }
         });
     }
-    server.tool('ziggs_context_snapshot', 'One-shot orientation for a chat: history, agreements (with which party is you), and the roster of agents/users — grant-fenced. Use when entering a chat you have not read yet; follow up with ziggs_context_read forward deltas from the returned latestSequence.', {
+    registerStrictTool(server, 'ziggs_context_snapshot', 'One-shot orientation for a chat: history, agreements (with which party is you), and the roster of agents/users — grant-fenced. Use when entering a chat you have not read yet; follow up with ziggs_context_read forward deltas from the returned latestSequence.', {
         chatId: z.string().describe('Chat id to snapshot'),
         maxMessages: z.number().optional().describe('Optional message history cap'),
         contextGrantId: z
@@ -345,7 +346,7 @@ export function registerZiggsTools(server, creds, cfg) {
             return toolError(e);
         }
     });
-    server.tool('ziggs_agreement_list', 'List agreements you are a party to — your hires, proposals, and work (default scope "mine"). Pass scope "reachable" to list every agreement your grant can read in the org, including ones you are not a party to; the isYou flags on each row mark which party (if any) is you.', {
+    registerStrictTool(server, 'ziggs_agreement_list', 'List agreements you are a party to — your hires, proposals, and work (default scope "mine"). Pass scope "reachable" to list every agreement your grant can read in the org, including ones you are not a party to; the isYou flags on each row mark which party (if any) is you.', {
         scope: z
             .enum(['mine', 'reachable'])
             .optional()
@@ -366,7 +367,7 @@ export function registerZiggsTools(server, creds, cfg) {
             return toolError(e);
         }
     });
-    server.tool('ziggs_agreement_get', 'Fetch a single agreement by id.', { agreementId: z.string() }, READ_ONLY, async ({ agreementId }) => {
+    registerStrictTool(server, 'ziggs_agreement_get', 'Fetch a single agreement by id.', { agreementId: z.string() }, READ_ONLY, async ({ agreementId }) => {
         try {
             const agreement = await getAgreement(agreementId, creds);
             if (!agreement)
@@ -377,7 +378,7 @@ export function registerZiggsTools(server, creds, cfg) {
             return toolError(e);
         }
     });
-    server.tool('ziggs_chat_list', 'List chats the delegate agent is a member of (GET /chats/mine).', {}, READ_ONLY, async () => {
+    registerStrictTool(server, 'ziggs_chat_list', 'List chats the delegate agent is a member of (GET /chats/mine).', {}, READ_ONLY, async () => {
         try {
             const chats = await listMyChats(creds);
             return textResult({ count: chats.length, chats });
@@ -387,7 +388,7 @@ export function registerZiggsTools(server, creds, cfg) {
         }
     });
     registerCapability(server, openConversationCapability, creds);
-    server.tool('ziggs_chat_send', ZIGGS_SEND_MESSAGE_DESCRIPTION, {
+    registerStrictTool(server, 'ziggs_chat_send', ZIGGS_SEND_MESSAGE_DESCRIPTION, {
         chatId: z.string(),
         receiverId: z
             .string()
@@ -423,7 +424,7 @@ export function registerZiggsTools(server, creds, cfg) {
             return toolError(e);
         }
     });
-    server.tool('ziggs_agreement_propose', 'Propose an agreement — direct, broadcast, hand-off, or link; there are no separate publish tools. DIRECT: proposedTo = one counterparty id, chatId required. Omit providerId (or set it to proposedTo) to commission the recipient (they work, your side pays); set providerId to your own agent id to offer (you work, proposedTo pays); a third-party providerId brokers (they work, proposedTo pays) and requires that provider to have a matching active offer. BROADCAST: proposedTo "everyone" (fully public) or "org" (your active org only), chatId optional — with no providerId this publishes a QUEST (whoever claims does the work, your side pays); with providerId = your own id it publishes a STANDING OFFER (you work, the claimer pays). HAND-OFF (share an agent you hired): set parentAgreementId = that ACTIVE hire and providerId = its provider; proposedTo may be "everyone"/"org" (claimable) or a specific beneficiary id (they approve directly). The provider stays pinned — whoever claims/approves is the CUSTOMER the work is done for, never the worker, and on a priced hand-off they are also the payer (price omitted/0 = free: nobody is billed for their tasks). Handing off someone else\'s agent leaves that provider\'s approval pending — it must accept once before the hand-off can be claimed. Claiming is ziggs_agreement_claim; browsing is ziggs_marketplace_view. LINK: engagementKind "link" with proposedTo = an agent id proposes bilateral trust (no chat, no money). The server routes parties.proposedTo to that agent\'s owner human (a person decides who their delegate trusts) — the id you pass may differ from parties.proposedTo in the response; when it does, `note` explains the rewrite. Approve via ziggs_agreement_respond. ROLES: proposedTo is the CUSTOMER — the party the work is done for; the payer is only who pays, always derived server-side as the non-providing side — there is no payer input. engagementKind "service" (default) = one deliverable; "hire" = ongoing engagement. Agreements are STANDING by default (lifecycle "open": no expiry, unlimited tasks) — hire once, then keep spawning tasks under the same agreement; set expiresAt (time-bound) or maxExecutions (count-bound) only when the engagement should end on its own. price is recorded on the agreement but does not itself trigger a transfer.', {
+    registerStrictTool(server, 'ziggs_agreement_propose', 'Propose an agreement — direct, broadcast, hand-off, or link; there are no separate publish tools. DIRECT: proposedTo = one counterparty id, chatId required. Omit providerId (or set it to proposedTo) to commission the recipient (they work, your side pays); set providerId to your own agent id to offer (you work, proposedTo pays); a third-party providerId brokers (they work, proposedTo pays) and requires that provider to have a matching active offer. BROADCAST: proposedTo "everyone" (fully public) or "org" (your active org only), chatId optional — with no providerId this publishes a QUEST (whoever claims does the work, your side pays); with providerId = your own id it publishes a STANDING OFFER (you work, the claimer pays). HAND-OFF (share an agent you hired): set parentAgreementId = that ACTIVE hire and providerId = its provider; proposedTo may be "everyone"/"org" (claimable) or a specific beneficiary id (they approve directly). The provider stays pinned — whoever claims/approves is the CUSTOMER the work is done for, never the worker, and on a priced hand-off they are also the payer (price omitted/0 = free: nobody is billed for their tasks). Handing off someone else\'s agent leaves that provider\'s approval pending — it must accept once before the hand-off can be claimed. Claiming is ziggs_agreement_claim; browsing is ziggs_marketplace_view. LINK: engagementKind "link" with proposedTo = an agent id proposes bilateral trust (no chat, no money). The server routes parties.proposedTo to that agent\'s owner human (a person decides who their delegate trusts) — the id you pass may differ from parties.proposedTo in the response; when it does, `note` explains the rewrite. Approve via ziggs_agreement_respond. ROLES: proposedTo is the CUSTOMER — the party the work is done for; the payer is only who pays, always derived server-side as the non-providing side — there is no payer input. engagementKind "service" (default) = one deliverable; "hire" = ongoing engagement. Agreements are STANDING by default (lifecycle "open": no expiry, unlimited tasks) — hire once, then keep spawning tasks under the same agreement; set expiresAt (time-bound) or maxExecutions (count-bound) only when the engagement should end on its own. price is recorded on the agreement but does not itself trigger a transfer.', {
         proposedTo: z
             .string()
             .describe('Counterparty id for a direct proposal, or "everyone"/"org" to broadcast'),
@@ -503,7 +504,7 @@ export function registerZiggsTools(server, creds, cfg) {
         }
     });
     registerCapability(server, agreementClaimCapability, creds);
-    server.tool('ziggs_agreement_subcontract', 'Delegate part of an engagement to another agent under an existing parent agreement (a sub-agreement; the worker must approve — never impersonated). Use when you hold an active agreement and want a third agent to do a slice of it. Requires parentAgreementId and the chat you are coordinating in. Spawn tasks for the worker under the sub-agreement once it is active.', {
+    registerStrictTool(server, 'ziggs_agreement_subcontract', 'Delegate part of an engagement to another agent under an existing parent agreement (a sub-agreement; the worker must approve — never impersonated). Use when you hold an active agreement and want a third agent to do a slice of it. Requires parentAgreementId and the chat you are coordinating in. Spawn tasks for the worker under the sub-agreement once it is active.', {
         parentAgreementId: z.string().describe('The active agreement you are delegating under'),
         executorId: z.string().describe('Agent doing the delegated work'),
         chatId: z.string().describe('Chat the delegation is coordinated in'),
@@ -541,7 +542,7 @@ export function registerZiggsTools(server, creds, cfg) {
     if (!cfg.coreOnly) {
         registerMarketplaceTools(server, creds);
     }
-    server.tool('ziggs_agreement_respond', 'Approve or reject a pending DIRECT agreement proposal addressed to YOU — your own party slot (PUT /approvals/:partyId, which takes a decision only from the party itself). A proposal bound to your PRINCIPAL instead is not yours to answer and this tool refuses it: consent is deliberately withheld from delegates, so no retry and no other tool changes it — the human decides it in the Ziggs app, under Agreements. ziggs_pending_decisions marks which is which with respondableBy (agent | human), so check there before calling. Open broadcasts (quests, standing offers, link invites) have no personal approval slot — claim those with ziggs_agreement_claim instead, or ignore them to pass. ONE exception: a hand-off that pins YOU (or your agent) as provider carries your pending approval even as an open broadcast — approving it consents to serving whoever claims it (the row stays open for claims); rejecting cancels the hand-off.', {
+    registerStrictTool(server, 'ziggs_agreement_respond', 'Approve or reject a pending DIRECT agreement proposal addressed to YOU — your own party slot (PUT /approvals/:partyId, which takes a decision only from the party itself). A proposal bound to your PRINCIPAL instead is not yours to answer and this tool refuses it: consent is deliberately withheld from delegates, so no retry and no other tool changes it — the human decides it in the Ziggs app, under Agreements. ziggs_pending_decisions marks which is which with respondableBy (agent | human), so check there before calling. Open broadcasts (quests, standing offers, link invites) have no personal approval slot — claim those with ziggs_agreement_claim instead, or ignore them to pass. ONE exception: a hand-off that pins YOU (or your agent) as provider carries your pending approval even as an open broadcast — approving it consents to serving whoever claims it (the row stays open for claims); rejecting cancels the hand-off.', {
         agreementId: z.string(),
         action: z.enum(['approve', 'reject']),
     }, WRITE, async ({ agreementId, action }) => {
@@ -559,7 +560,7 @@ export function registerZiggsTools(server, creds, cfg) {
             return toolError(e);
         }
     });
-    server.tool('ziggs_agreement_revoke', 'Revoke any agreement you are a party to — hire, service, quest, standing offer, or link (DELETE /agreements/:id). Either party may revoke; this ends the engagement immediately. Revoking a link ends cross-org reach to that peer; revoking an open broadcast takes it off the marketplace.', {
+    registerStrictTool(server, 'ziggs_agreement_revoke', 'Revoke any agreement you are a party to — hire, service, quest, standing offer, or link (DELETE /agreements/:id). Either party may revoke; this ends the engagement immediately. Revoking a link ends cross-org reach to that peer; revoking an open broadcast takes it off the marketplace.', {
         agreementId: z.string().describe('Agreement to revoke'),
     }, DESTRUCTIVE, async ({ agreementId }) => {
         try {
@@ -578,7 +579,7 @@ export function registerZiggsTools(server, creds, cfg) {
             return toolError(e);
         }
     });
-    server.tool('ziggs_agreement_counter', 'Counter a pending proposal with revised terms instead of approving or rejecting (POST /agreements/:id/counter). Provide only the terms you want to change — price, description, expiry, or lifecycle; omitted fields keep the original proposal\'s value. The counter goes back to the counterparty as a fresh pending proposal for them to approve/reject/counter. Read the current terms first with ziggs_agreement_get.', {
+    registerStrictTool(server, 'ziggs_agreement_counter', 'Counter a pending proposal with revised terms instead of approving or rejecting (POST /agreements/:id/counter). Provide only the terms you want to change — price, description, expiry, or lifecycle; omitted fields keep the original proposal\'s value. The counter goes back to the counterparty as a fresh pending proposal for them to approve/reject/counter. Read the current terms first with ziggs_agreement_get.', {
         agreementId: z.string().describe('The pending agreement to counter'),
         price: z
             .number()
@@ -607,7 +608,7 @@ export function registerZiggsTools(server, creds, cfg) {
             return toolError(e);
         }
     });
-    server.tool('ziggs_agreement_fulfill', 'END an agreement you PROVIDE — permanently (POST /agreements/:id/fulfill). Fulfilling terminates the whole relationship, not one deliverable: every grant the agreement conferred (context, connection, payment) is revoked, its shared space is torn down, and it cannot be reopened — the counterparty would have to re-hire you from scratch. Finished WORK is reported with ziggs_task_set_result, which closes the task and leaves the agreement standing for the next one. Only fulfill a count/time-bound engagement whose full scope is delivered and where nothing more is expected — never a standing hire that just finished a task. Party-gated server-side: only the providing side can fulfill.', {
+    registerStrictTool(server, 'ziggs_agreement_fulfill', 'END an agreement you PROVIDE — permanently (POST /agreements/:id/fulfill). Fulfilling terminates the whole relationship, not one deliverable: every grant the agreement conferred (context, connection, payment) is revoked, its shared space is torn down, and it cannot be reopened — the counterparty would have to re-hire you from scratch. Finished WORK is reported with ziggs_task_set_result, which closes the task and leaves the agreement standing for the next one. Only fulfill a count/time-bound engagement whose full scope is delivered and where nothing more is expected — never a standing hire that just finished a task. Party-gated server-side: only the providing side can fulfill.', {
         agreementId: z.string().describe('The agreement you provide, to mark fulfilled'),
     }, WRITE, async ({ agreementId }) => {
         try {
@@ -618,7 +619,7 @@ export function registerZiggsTools(server, creds, cfg) {
             return toolError(e);
         }
     });
-    server.tool('ziggs_inbox', ZIGGS_INBOX_DESCRIPTION, {
+    registerStrictTool(server, 'ziggs_inbox', ZIGGS_INBOX_DESCRIPTION, {
         ack: z
             .string()
             .optional()
@@ -689,7 +690,7 @@ export function registerZiggsTools(server, creds, cfg) {
     // ---------------------------------------------------------------------------
     // Task mutation tools (ZIG-555)
     // ---------------------------------------------------------------------------
-    server.tool('ziggs_task_create', 'Create a task under an agreement. Every task belongs to exactly one agreement (agreementId required). Pass plan to give the task its checklist in the same call — every step needs a non-blank description, since that is the label whoever is watching reads before anything closes. Leave plan off to start without one and post it later with ziggs_task_replace_plan.', {
+    registerStrictTool(server, 'ziggs_task_create', 'Create a task under an agreement. Every task belongs to exactly one agreement (agreementId required). Pass plan to give the task its checklist in the same call — every step needs a non-blank description, since that is the label whoever is watching reads before anything closes. Leave plan off to start without one and post it later with ziggs_task_replace_plan.', {
         agreementId: z.string().describe('Agreement this task belongs to'),
         description: z.string().describe('What the task entails'),
         parentTaskId: z.string().optional().describe('Parent task id for sub-tasks'),
@@ -744,7 +745,7 @@ export function registerZiggsTools(server, creds, cfg) {
             return toolError(e);
         }
     });
-    server.tool('ziggs_task_set_result', 'Transition a task to a terminal state (completed / failed / cancelled) and record the result. Enforces the state machine — only active tasks can be transitioned.', {
+    registerStrictTool(server, 'ziggs_task_set_result', 'Transition a task to a terminal state (completed / failed / cancelled) and record the result. Enforces the state machine — only active tasks can be transitioned.', {
         taskId: z.string(),
         state: z.enum(['completed', 'failed', 'cancelled']),
         result: z
@@ -770,7 +771,7 @@ export function registerZiggsTools(server, creds, cfg) {
             return toolError(e);
         }
     });
-    server.tool('ziggs_task_replace_plan', 'Replace the plan for a task with the full ordered step list you provide — existing steps are replaced wholesale, not appended to. Use this to post progress: resend the whole plan with completed steps marked in their descriptions.', {
+    registerStrictTool(server, 'ziggs_task_replace_plan', 'Replace the plan for a task with the full ordered step list you provide — existing steps are replaced wholesale, not appended to. Use this to post progress: resend the whole plan with completed steps marked in their descriptions.', {
         taskId: z.string(),
         steps: z
             .array(z.object({
@@ -788,7 +789,7 @@ export function registerZiggsTools(server, creds, cfg) {
             return toolError(e);
         }
     });
-    server.tool('ziggs_task_list', 'List tasks reachable by this delegate agent (GET /tasks). Scope is determined by the operator key — same reach as chats and agreements. Supports optional state filter, cursor pagination, and assignee filtering.', {
+    registerStrictTool(server, 'ziggs_task_list', 'List tasks reachable by this delegate agent (GET /tasks). Scope is determined by the operator key — same reach as chats and agreements. Supports optional state filter, cursor pagination, and assignee filtering.', {
         state: z
             .string()
             .optional()
@@ -813,7 +814,7 @@ export function registerZiggsTools(server, creds, cfg) {
             return toolError(e);
         }
     });
-    server.tool('ziggs_task_get', 'Fetch a single task by id (GET /tasks/:id). Use this when a human hands you a taskId directly (e.g. "work on task_…") so you can read the work-order — its description, plan, assignee, state, and result — before acting. Same operator-key scope as ziggs_task_list; pairs with ziggs_task_set_result to close the task.', { taskId: z.string() }, READ_ONLY, async ({ taskId }) => {
+    registerStrictTool(server, 'ziggs_task_get', 'Fetch a single task by id (GET /tasks/:id). Use this when a human hands you a taskId directly (e.g. "work on task_…") so you can read the work-order — its description, plan, assignee, state, and result — before acting. Same operator-key scope as ziggs_task_list; pairs with ziggs_task_set_result to close the task.', { taskId: z.string() }, READ_ONLY, async ({ taskId }) => {
         try {
             const task = await getTask(taskId, creds);
             if (!task)

package/dist/trustTools.js

@@ -1,6 +1,7 @@
 import { z } from 'zod';
 import { ContextGrantsClient, addChatMember, contextBounds, resolveOrgScopeId, LINK_CAPABILITIES, DISCOVERY_CAPABILITIES, contextDelegateCapability, } from '@ziggs-ai/api-client';
 import { WRITE, DESTRUCTIVE } from './toolAnnotations.js';
+import { registerStrictTool } from './strictParams.js';
 import { toolError } from './toolError.js';
 import { registerCapabilities, registerCapability, textResult } from './capabilityAdapter.js';
 // ZIG-1037: `artifact` is the narrowest context scope — one specific artifact,
@@ -15,7 +16,7 @@ const DEFAULT_WEB_URL = 'https://ziggsai.com';
 export function registerTrustTools(server, creds, cfg) {
     const webUrl = cfg?.ZIGGS_WEB_URL?.replace(/\/$/, '') ?? DEFAULT_WEB_URL;
     registerCapabilities(server, DISCOVERY_CAPABILITIES, creds);
-    server.tool('ziggs_context_issue_grant', 'Issue bounded context access. ONE scope works for you as a delegate: chat, which admits the agent via POST /chats/:id/members (agent-invite → pending_approval until humans consent). Agreement, org AND artifact scope all mint a NEW root grant, which is a human-authority action — acting for a principal you are denied (AGENT_LACKS_HUMAN_AUTHORITY) on all three alike, before the scope is even read. Your paths instead: ziggs_artifact_share for an artifact YOU authored (no human authority needed), ziggs_context_delegate to hand a peer a narrower slice of a grant you already hold, or ask your human to issue it. Artifact scope is always from-start (the artifact predates any watermark you could set) and refuses from-now. Defaults: from-now, narrow scope.', {
+    registerStrictTool(server, 'ziggs_context_issue_grant', 'Issue bounded context access. ONE scope works for you as a delegate: chat, which admits the agent via POST /chats/:id/members (agent-invite → pending_approval until humans consent). Agreement, org AND artifact scope all mint a NEW root grant, which is a human-authority action — acting for a principal you are denied (AGENT_LACKS_HUMAN_AUTHORITY) on all three alike, before the scope is even read. Your paths instead: ziggs_artifact_share for an artifact YOU authored (no human authority needed), ziggs_context_delegate to hand a peer a narrower slice of a grant you already hold, or ask your human to issue it. Artifact scope is always from-start (the artifact predates any watermark you could set) and refuses from-now. Defaults: from-now, narrow scope.', {
         holderId: z.string().describe('Bare agent id receiving the grant'),
         scopeKind: grantScopeKindSchema,
         scopeId: z.string().describe('chatId, agreementId, orgId, or artifactId'),
@@ -95,7 +96,7 @@ export function registerTrustTools(server, creds, cfg) {
         // layer, including the linkSummary shaping the mutations now share.
         registerCapabilities(server, LINK_CAPABILITIES, creds, { webUrl });
     }
-    server.tool('ziggs_context_revoke_grant', 'Revoke a context grant and its descendants (DELETE /context/grants/:id). You can revoke (narrow) any grant you hold — this needs no special scope. Revoking a grant you do NOT hold (one you issued, or on a scope you own) is a human-authority action: as a delegate you are limited to grants you hold; the human/owner does the rest.', {
+    registerStrictTool(server, 'ziggs_context_revoke_grant', 'Revoke a context grant and its descendants (DELETE /context/grants/:id). You can revoke (narrow) any grant you hold — this needs no special scope. Revoking a grant you do NOT hold (one you issued, or on a scope you own) is a human-authority action: as a delegate you are limited to grants you hold; the human/owner does the rest.', {
         grantId: z.string(),
     }, DESTRUCTIVE, async ({ grantId }) => {
         try {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ziggs-ai/ziggs-mcp",
-  "version": "0.9.2",
-  "description": "MCP server for Claude Code, Cursor, and other MCP hosts \u2014 act as your Ziggs delegate agent",
+  "version": "0.9.4",
+  "description": "MCP server for Claude Code, Cursor, and other MCP hosts — act as your Ziggs delegate agent",
   "type": "module",
   "bin": {
     "ziggs-mcp": "./dist/index.js"
@@ -36,7 +36,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@ziggs-ai/api-client": "^0.9.1",
+    "@ziggs-ai/api-client": "^0.9.3",
     "dotenv": "^16.6.1",
     "zod": "^3.24.2"
   },