askell-mcp 0.1.2 → 0.3.0

package/src/client/response-formatter.ts

@@ -59,7 +59,6 @@ function summarizeListItem(item: unknown): unknown {
     'email',
     'first_name',
     'last_name',
-    'description',
     'currency',
     'amount',
     'total_amount',
@@ -91,6 +90,56 @@ function summarizeListItem(item: unknown): unknown {
   return Object.keys(out).length > 0 ? out : obj;
 }
 
+/** Tight projection for analytical list queries (dates, plan name, customer). */
+function indexListItem(item: unknown): unknown {
+  if (item == null || typeof item !== 'object' || Array.isArray(item)) {
+    return item;
+  }
+
+  const obj = item as Record<string, unknown>;
+  const out: Record<string, unknown> = {};
+
+  if ('id' in obj) {
+    out.id = obj.id;
+  }
+
+  if ('start_date' in obj) {
+    out.start_date = obj.start_date;
+  } else if ('created_at' in obj) {
+    out.created_at = obj.created_at;
+  }
+
+  if ('ended_at' in obj && obj.ended_at != null) {
+    out.ended_at = obj.ended_at;
+  }
+
+  const plan = obj.plan;
+  if (typeof plan === 'string' || typeof plan === 'number') {
+    out.plan = plan;
+  } else if (plan && typeof plan === 'object' && 'name' in plan) {
+    out.plan = (plan as { name: unknown }).name;
+  } else if ('name' in obj && typeof obj.name === 'string') {
+    out.name = obj.name;
+  }
+
+  const customerRef =
+    obj.customer_reference ??
+    (obj.customer && typeof obj.customer === 'object'
+      ? ((obj.customer as Record<string, unknown>).customer_reference ??
+        (obj.customer as Record<string, unknown>).reference ??
+        (obj.customer as Record<string, unknown>).id)
+      : undefined);
+  if (customerRef !== undefined) {
+    out.customer_reference = customerRef;
+  }
+
+  if (typeof obj.email === 'string') {
+    out.email = obj.email;
+  }
+
+  return Object.keys(out).length > 0 ? out : summarizeListItem(item);
+}
+
 function serializeListPayload(
   status: number,
   meta: Record<string, unknown>,
@@ -146,6 +195,8 @@ function maxFittingCount(
   return lo;
 }
 
+type CompactedMode = 'none' | 'summary' | 'index';
+
 export function buildBoundedListPayload(input: {
   status: number;
   meta: Record<string, unknown>;
@@ -153,30 +204,42 @@ export function buildBoundedListPayload(input: {
   maxBytes: number;
 }): FormattedResponse {
   const { status, meta, items, maxBytes } = input;
-  const itemCount = items.length;
 
   const attempts: Array<{
     items: unknown[];
     pretty: boolean;
-    compacted: boolean;
+    compactedMode: CompactedMode;
     note?: string;
   }> = [
-    { items, pretty: true, compacted: false },
-    { items, pretty: false, compacted: false },
+    { items, pretty: true, compactedMode: 'none' },
+    { items, pretty: false, compactedMode: 'none' },
     {
       items: items.map(summarizeListItem),
       pretty: false,
-      compacted: true,
+      compactedMode: 'summary',
       note: 'Items summarized to fit responseMaxBytes',
     },
+    {
+      items: items.map(indexListItem),
+      pretty: false,
+      compactedMode: 'index',
+      note: 'Items reduced to an index (id, dates, plan, customer) to fit responseMaxBytes',
+    },
   ];
 
   let fullByteLength = 0;
+  let bestPartial: {
+    text: string;
+    returnedCount: number;
+    compactedMode: CompactedMode;
+    note?: string;
+  } | null = null;
 
   for (const attempt of attempts) {
+    const attemptMeta = compactMeta(meta, attempt.compactedMode, attempt.note);
     const fullText = serializeListPayload(
       status,
-      meta,
+      attemptMeta,
       attempt.items,
       attempt.items.length,
       false,
@@ -195,42 +258,43 @@ export function buildBoundedListPayload(input: {
     const returnedCount = maxFittingCount(
       attempt.items,
       status,
-      {
-        ...meta,
-        ...(attempt.compacted ? { compacted: true, note: attempt.note } : {}),
-      },
+      attemptMeta,
       maxBytes,
       attempt.pretty,
     );
 
-    if (returnedCount > 0) {
-      const text = serializeListPayload(
-        status,
-        {
-          ...meta,
-          ...(attempt.compacted ? { compacted: true, note: attempt.note } : {}),
-        },
-        attempt.items,
+    if (returnedCount > (bestPartial?.returnedCount ?? 0)) {
+      bestPartial = {
+        text: serializeListPayload(
+          status,
+          attemptMeta,
+          attempt.items,
+          returnedCount,
+          true,
+          attempt.pretty,
+        ),
         returnedCount,
-        true,
-        attempt.pretty,
-      );
-
-      return {
-        text,
-        truncated: true,
-        byteLength: fullByteLength,
+        compactedMode: attempt.compactedMode,
+        note: attempt.note,
       };
     }
   }
 
+  if (bestPartial && bestPartial.returnedCount > 0) {
+    return {
+      text: bestPartial.text,
+      truncated: true,
+      byteLength: fullByteLength,
+    };
+  }
+
   const text = serializeListPayload(
     status,
-    {
-      ...meta,
-      compacted: true,
-      note: 'Response too large; returning metadata only',
-    },
+    compactMeta(
+      meta,
+      'index',
+      'Response too large; returning metadata only',
+    ),
     [],
     0,
     true,
@@ -244,6 +308,23 @@ export function buildBoundedListPayload(input: {
   };
 }
 
+function compactMeta(
+  meta: Record<string, unknown>,
+  compactedMode: CompactedMode,
+  note?: string,
+): Record<string, unknown> {
+  if (compactedMode === 'none') {
+    return meta;
+  }
+
+  return {
+    ...meta,
+    compacted: true,
+    compactedMode,
+    ...(note ? { note } : {}),
+  };
+}
+
 export function formatApiResponse(
   status: number,
   headers: Headers,

package/src/config.ts

@@ -1,24 +1,46 @@
 import * as z from 'zod';
 
+export const MUTATION_GATES = ['auto', 'elicit', 'off'] as const;
+export type MutationGate = (typeof MUTATION_GATES)[number];
+
+const httpUrl = z
+  .url({ protocol: /^https?$/ })
+  .describe('Askell API base URL (default production host)');
+
+const mutationGateAliases = z
+  .enum(['true', 'false', 'on', 'yes', 'no', '1', '0'])
+  .transform((value): MutationGate => {
+    return value === 'true' || value === 'on' || value === 'yes' || value === '1'
+      ? 'elicit'
+      : 'off';
+  });
+
+export const MutationGateSchema = z
+  .union([
+    z.enum(MUTATION_GATES),
+    z.boolean().transform((value): MutationGate => (value ? 'elicit' : 'off')),
+    mutationGateAliases,
+  ])
+  .default('auto')
+  .describe(
+    'Mutation confirmation: auto (elicit if client declared it), elicit (require form), off (never)',
+  );
+
 export const ConfigSchema = z.object({
-  apiBaseUrl: z
-    .httpUrl()
-    .default('https://askell.is/api')
-    .describe('Askell API base URL (default production host)'),
+  apiBaseUrl: httpUrl.default('https://askell.is/api'),
   secretApiKey: z.string().min(1).describe('Secret (private) API key'),
   publicApiKey: z
     .string()
+    .min(1)
     .optional()
     .describe('Public API key for temporary payment method endpoints'),
-  responseMaxBytes: z
+  responseMaxBytes: z.coerce
+    .number()
     .int()
     .positive()
     .default(64_000)
     .describe('Max response body size returned to the model'),
-  requireMutationApproval: z
-    .boolean()
-    .default(true)
-    .describe('Require operator confirmation before mutating requests'),
+  mutationGate: MutationGateSchema,
 });
 
 export type AppConfig = z.infer<typeof ConfigSchema>;
@@ -45,17 +67,6 @@ Set ASKELL_PRIVATE_API_KEY (or ASKELL_SECRET_API_KEY), optionally ASKELL_PUBLIC_
       }
     }`;
 
-function parseEnvFlag(
-  value: string | undefined,
-  defaultValue: boolean,
-): boolean {
-  if (value === undefined) {
-    return defaultValue;
-  }
-
-  return !['0', 'false', 'no', 'off'].includes(value.toLowerCase());
-}
-
 function loadConfigFromEnv(): unknown {
   const env = Bun.env;
   const secretApiKey = env.ASKELL_PRIVATE_API_KEY ?? env.ASKELL_SECRET_API_KEY;
@@ -66,7 +77,9 @@ function loadConfigFromEnv(): unknown {
 
   const apiBaseUrl = env.ASKELL_API_URL ?? env.ASKELL_API_BASE_URL;
   const responseMaxBytes = env.ASKELL_RESPONSE_MAX_BYTES;
-  const requireMutationApproval = env.ASKELL_REQUIRE_MUTATION_APPROVAL;
+  const mutationGateRaw =
+    env.ASKELL_MUTATION_GATE ?? env.ASKELL_REQUIRE_MUTATION_APPROVAL;
+  const mutationGate = mutationGateRaw?.trim().toLowerCase() || undefined;
 
   return {
     ...(apiBaseUrl ? { apiBaseUrl } : {}),
@@ -74,12 +87,8 @@ function loadConfigFromEnv(): unknown {
     ...(env.ASKELL_PUBLIC_API_KEY
       ? { publicApiKey: env.ASKELL_PUBLIC_API_KEY }
       : {}),
-    ...(responseMaxBytes ? { responseMaxBytes: Number(responseMaxBytes) } : {}),
-    ...(requireMutationApproval !== undefined
-      ? {
-          requireMutationApproval: parseEnvFlag(requireMutationApproval, true),
-        }
-      : {}),
+    ...(responseMaxBytes ? { responseMaxBytes } : {}),
+    ...(mutationGate !== undefined ? { mutationGate } : {}),
   };
 }
 

package/src/openapi/registry.ts

@@ -69,20 +69,30 @@ function resolveParameters(
   }
 
   return parameters.map((parameter) => {
+    let source: OpenApiParameter = parameter;
+
     if ('$ref' in parameter && typeof parameter.$ref === 'string') {
       const resolved = resolveRef(doc, parameter.$ref);
       if (resolved && typeof resolved === 'object') {
-        const param = resolved as OpenApiParameter;
-        return {
-          ...param,
-          schema: resolveSchema(doc, param.schema),
-        };
+        source = resolved as OpenApiParameter;
       }
     }
 
+    // Pick known fields only — OpenAPI params often include style/explode/example,
+    // which MCP outputSchema rejects (additionalProperties: false).
     return {
-      ...parameter,
-      schema: resolveSchema(doc, parameter.schema),
+      ...(source.name !== undefined ? { name: source.name } : {}),
+      ...(source.in !== undefined ? { in: source.in } : {}),
+      ...(source.required !== undefined ? { required: source.required } : {}),
+      ...(source.description !== undefined
+        ? { description: source.description }
+        : {}),
+      ...(source.schema !== undefined
+        ? { schema: resolveSchema(doc, source.schema) }
+        : {}),
+      ...(source.$ref !== undefined && source.name === undefined
+        ? { $ref: source.$ref }
+        : {}),
     };
   });
 }

package/src/resources/register.ts

@@ -4,34 +4,60 @@ import { getBundledSpec } from '../openapi/registry.ts';
 
 const WEBHOOK_EVENTS_DOC = `# Askell webhook events (reference)
 
-Askell sends signed webhook calls to your configured endpoints.
+Askell POSTs signed JSON to each URL you register. Verify \`Hook-HMAC\` before parsing.
 
 Headers:
-- Hook-HMAC: base64 HMAC-SHA512 of the raw body
-- Hook-Event: event type identifier
-- Hook-API-Version: v1 for legacy plan/subscription webhooks, v2 for subscription contract webhooks
-
-Event families:
-- subscription.* (legacy v1): subscription.created, subscription.changed, subscription.renewed
-- subscription_contract.* (v2): subscription_contract.created, subscription_contract.changed,
-  subscription_contract.renewed, subscription_contract.migrated (legacy subscription migrated to a
-  V2 contract; payload includes legacy_subscription_ids and migration_effective_at)
-- billing_run.* (v2): billing_run.created, billing_run.changed, billing_run.succeeded,
-  billing_run.failed, billing_run.retry
-- customer.*: customer.created, customer.changed
-- payment.*: payment.created, payment.changed, payment.retry
-- checkout.*: checkout.created, checkout.changed
-
-Notes:
-- During migration to V2, legacy subscription.* aliases are NOT sent for the new contract (event data
-  is based on SubscriptionContract, not Subscription), and subscription.canceled is not sent solely
-  because billing moved to a V2 contract.
-
-Webhook management is available via v1 API:
-- GET/POST /webhooks/
-- GET/PATCH/DELETE /webhooks/{id}/
-
-This MCP server exposes webhook management through askell_call and askell_list_webhooks.
+- Hook-HMAC: base64 HMAC-SHA512 of the **raw body** (secret = \`hmac_secret\` from webhook create)
+- Hook-Event: event type (\`subscription.renewed\`, \`payment.changed\`, or a family wildcard \`subscription.*\`)
+- Hook-API-Version: \`v1\` for plan/subscription/customer/payment/checkout, \`v2\` for subscription_contract / billing_run
+
+## Body shape (OpenAPI is wrong here)
+
+JSON body **is the event object**. It is **not** \`{ event, data }\`.
+
+Ignore \`POST /your-webhook-url/\` in the bundled v1 spec — its requestBody (\`SubscriptionMultiLite\`: \`{ customer, subscriptions[] }\`) does not match live webhooks.
+
+Rare historical payloads used \`{ event, data, ref?, sender? }\`. If both \`event\` and \`data\` are objects, use \`data\`.
+
+## Registering endpoints (v1 management API)
+
+- GET/POST \`/webhooks/\` · GET/PUT/PATCH/DELETE \`/webhooks/{id}/\` (secret key)
+- Create body: \`{ url, event }\` (\`event\` may be a specific type or a family wildcard like \`payment.*\`)
+- Create/get response includes \`hmac_secret\` (store it; Askell will not show it again in a useful way if you lose it) and \`hmac_digest\` (typically \`SHA512\`)
+
+Tools: \`askell_list_webhooks\`, \`askell_call\` (GET), \`askell_mutate\` (POST/PUT/PATCH/DELETE).
+
+## Event families and payload fields
+
+Live REST \`Subscription\` objects have extra fields the OpenAPI schema omits. Webhook bodies differ slightly from GET \`/subscriptions/\` (notably \`last_billing_log\` vs \`billing_logs[]\`).
+
+### subscription.* (v1)
+\`subscription.created\`, \`subscription.changed\`, \`subscription.renewed\`
+
+\`id\`, \`plan\` (no \`payment_processor\` / membership-card / wallet-pass fields), \`customer\` (numeric id), \`customer_reference\`, \`trial_end\`, \`start_date\`, \`ended_at\`, \`reference\`, \`active\`, \`meta\` (JSON **string**, often \`"{}"\`), \`description\`, \`active_until\`, \`is_on_trial\`, \`token\`, \`is_failing\`, \`last_billing_log\` (single object or null — not \`billing_logs[]\`), \`delivery_address\`, \`amount\`. Live cancel/change events also send \`cancelled\`, \`cancel_date\`, \`has_payment_plan\`, \`payment_plan_info\`.
+
+V2 migration: \`subscription.*\` is **not** aliased onto the new contract (payload is \`SubscriptionContract\`). \`subscription.canceled\` is not sent merely because billing moved to a V2 contract.
+
+### subscription_contract.* (v2)
+\`created\`, \`changed\`, \`renewed\`, \`migrated\`
+
+\`id\`, \`customer\`, \`state\`, \`billing_anchor_at\`, \`next_billing_at\`, \`cancel_at\`, \`cancel_at_period_end\`, \`canceled_at\`, \`ended_at\`, \`currency\`, \`recurring\`, \`legacy_subscription\`, \`legacy_subscription_ids\`, \`migration_effective_at\`, \`billing_managed_by\`, \`created_at\`, \`updated_at\`.
+
+### billing_run.* (v2)
+\`created\`, \`changed\`, \`succeeded\`, \`failed\`, \`retry\`
+
+\`id\`, \`contract\`, \`period_start_at\`, \`period_end_at\`, \`state\`, \`currency\`, \`subtotal_amount\`, \`tax_amount\`, \`total_amount\`, \`attempt_count\`, \`max_attempts\`, \`next_retry_at\`, \`last_attempt_at\`, \`transaction\`, \`created_at\`, \`updated_at\`.
+
+### customer.* (v1)
+\`created\`, \`changed\` — same shape as GET \`/customers/{ref}/\` (\`id\`, names, \`email\`, \`phone\`, \`customer_reference\`, address fields, \`payment_method[]\`).
+
+### payment.* (v1)
+\`created\`, \`changed\`, \`retry\`
+
+\`uuid\`, \`amount\`, \`currency\`, \`description\`, \`reference\`, \`state\` (\`pending\` | \`settled\` | \`failed\` | \`retrying\`), \`created_at\`, \`updated_at\`, \`transactions[]\`.
+
+### checkout.* (v1)
+\`created\`, \`changed\` — \`token\`, \`checkout_url\`, \`status\`.
 `;
 
 export function registerResources(server: McpServer): void {
@@ -79,7 +105,7 @@ export function registerResources(server: McpServer): void {
     'askell://docs/webhook-events',
     {
       title: 'Askell webhook events',
-      description: 'Webhook event types and management overview',
+      description: 'Inbound webhook events, payload shapes, HMAC, and /webhooks/ management',
       mimeType: 'text/markdown',
     },
     async () => ({

package/src/server.ts

@@ -4,7 +4,7 @@ import { AskellClient } from './client/askell-client.ts';
 import type { AppConfig } from './config.ts';
 import { registerResources } from './resources/register.ts';
 import { registerAnalysisTools } from './tools/analysis.ts';
-import { registerCallTool } from './tools/call.ts';
+import { registerCallTools } from './tools/call.ts';
 import { registerDiscoveryTools } from './tools/discovery.ts';
 
 const SERVER_INSTRUCTIONS = `Askell MCP server for payment and subscription operations.
@@ -12,7 +12,7 @@ const SERVER_INSTRUCTIONS = `Askell MCP server for payment and subscription oper
 Workflow:
 1. Use askell_list_operations and askell_describe_operation to discover endpoints, parameters, and auth requirements.
 2. Prefer analysis tools (askell_customer_overview, askell_contract_overview, askell_billing_run_triage, askell_paginate_all, askell_list_webhooks) for common support tasks.
-3. Use askell_call only when no dedicated tool covers the request.
+3. Use askell_call (GET/HEAD) or askell_mutate (POST/PUT/PATCH/DELETE) when no dedicated tool covers the request.
 
 API models:
 - v1 (legacy): PlanVariant + Subscription at paths like /subscriptions/, /customers/. Still supported for existing integrations.
@@ -26,6 +26,11 @@ API layout:
 - V2 list endpoints paginate only when page_size is provided (default 10, max 1000).
 - GET /v2/customer-entitlements/ requires customer_reference query param.
 
+V2 discounts (coupons / promotion codes) — not the same as v1:
+- v2 contracts: one active coupon at a time. GET /v2/subscription-contracts/{id}/discount/ (also nested as contract.discount). Apply with POST .../apply-code/ {promotion_code}. Remove with POST .../remove-discount/.
+- Quotes: pass promotion_code on POST /v2/subscription-offer-quotes/; totals already include the discount when set.
+- v1 Subscription.discount is a 0-100 percent override on a PlanVariant subscription. Do not send it to v2 contract endpoints.
+
 V2 checkout notes:
 - checkout_url on V2 checkouts points to the API object URL, not a browser payment page.
 - Embedded checkout uses POST /v2/checkout-sessions/ plus browser session-token sub-paths (see docs, not all in OpenAPI).
@@ -35,18 +40,19 @@ Auth:
 - Only temporary payment method and checkout status endpoints use the public key.
 
 Safety:
-- Mutating askell_call requests require operator approval when requireMutationApproval is enabled.
-- Large list responses may be truncated or summarized to fit responseMaxBytes; check meta.truncatedByMaxBytes and meta.compacted.
+- Writes go through askell_mutate (destructiveHint). Reads go through askell_call (readOnlyHint).
+- mutationGate=auto (default): confirmation form only if this request's envelope declared form elicitation; otherwise the client's own tool-allow UI is the gate. elicit always returns a form (SDK refuses if the client cannot fulfil it). off never asks.
+- Large list responses are compacted (index of id/dates/plan/customer) to fit responseMaxBytes before dropping rows; check meta.truncatedByMaxBytes, meta.compacted, and meta.compactedMode.
 
 Resources:
 - askell://spec/v1 and askell://spec/v2 — bundled OpenAPI
-- askell://docs/webhook-events — webhook event types including V2 subscription_contract.* and billing_run.*`;
+- askell://docs/webhook-events — inbound webhook payloads (ignore OpenAPI /your-webhook-url/), HMAC-SHA512, /webhooks/ hmac_secret`;
 
 export function createServer(config: AppConfig): McpServer {
   const server = new McpServer(
     {
       name: 'askell-mcp',
-      version: '0.1.0',
+      version: '0.3.0',
     },
     {
       instructions: SERVER_INSTRUCTIONS,
@@ -56,7 +62,7 @@ export function createServer(config: AppConfig): McpServer {
   const client = new AskellClient(config);
 
   registerDiscoveryTools(server);
-  registerCallTool(server, client, config);
+  registerCallTools(server, client, config);
   registerAnalysisTools(server, client);
   registerResources(server);
 

package/src/tools/analysis.ts

@@ -36,12 +36,23 @@ export function registerAnalysisTools(
     {
       title: 'Paginate Askell list endpoint',
       description:
-        'Fetch all pages from a paginated Askell list endpoint (v1/v2). Follows `next` links until exhausted or maxPages is reached. Large results are summarized to fit responseMaxBytes — check meta.truncatedByMaxBytes and meta.compacted in the response.',
+        'Fetch all pages from a paginated Askell list endpoint (v1/v2). Follows `next` links until exhausted or maxPages is reached. When the full payload exceeds responseMaxBytes, items are compacted (summary, then an index of id/dates/plan/customer) so rows are kept — dropping rows is last resort. Check meta.truncatedByMaxBytes, meta.compacted, and meta.compactedMode.',
       inputSchema: z.object({
         path: z.string().describe('List endpoint path, e.g. /subscriptions/'),
-        query: z.record(z.string(), z.unknown()).optional(),
-        apiKeyKind: z.enum(['secret', 'public']).default('secret'),
-        maxPages: z.int().positive().max(100).default(20),
+        query: z
+          .record(z.string(), z.json())
+          .optional()
+          .describe('Query string parameters forwarded to the list endpoint'),
+        apiKeyKind: z
+          .enum(['secret', 'public'])
+          .default('secret')
+          .describe('Which configured API key to use'),
+        maxPages: z
+          .int()
+          .positive()
+          .max(100)
+          .default(20)
+          .describe('Stop after this many pages (default 20, max 100)'),
       }),
       annotations: {
         readOnlyHint: true,
@@ -130,10 +141,17 @@ export function registerAnalysisTools(
     {
       title: 'Subscription contract overview (v2)',
       description:
-        'Fetch a v2 subscription contract and recent billing runs filtered by contract id.',
+        'Fetch a v2 subscription contract and recent billing runs filtered by contract id. The contract payload includes `discount` (active coupon) when one is applied.',
       inputSchema: z.object({
-        contractId: z.union([z.string(), z.number()]),
-        billingRunLimit: z.int().positive().max(50).default(10),
+        contractId: z
+          .union([z.string().min(1), z.int()])
+          .describe('V2 subscription contract id'),
+        billingRunLimit: z
+          .int()
+          .positive()
+          .max(50)
+          .default(10)
+          .describe('Max billing runs to include (page_size)'),
       }),
       annotations: {
         readOnlyHint: true,
@@ -192,8 +210,13 @@ export function registerAnalysisTools(
       description:
         'Fetch a billing run by id with optional related contract context for failure analysis.',
       inputSchema: z.object({
-        billingRunId: z.union([z.string(), z.number()]),
-        includeContract: z.boolean().default(true),
+        billingRunId: z
+          .union([z.string().min(1), z.int()])
+          .describe('V2 billing run id'),
+        includeContract: z
+          .boolean()
+          .default(true)
+          .describe('Also fetch the related subscription contract when the run has a contract id'),
       }),
       annotations: {
         readOnlyHint: true,
@@ -257,7 +280,12 @@ export function registerAnalysisTools(
       description:
         'List Askell webhook endpoints configured for the account (management API only).',
       inputSchema: z.object({
-        page_size: z.int().positive().max(1000).optional(),
+        page_size: z
+          .int()
+          .positive()
+          .max(1000)
+          .optional()
+          .describe('Page size for GET /webhooks/ (Askell default 10, max 1000)'),
       }),
       annotations: {
         readOnlyHint: true,