backlog-mcp-server 0.14.0 → 0.15.1

package/build/handlers/builders/composeToolHandler.js

@@ -6,27 +6,42 @@ import { wrapWithTokenLimit } from '../transformers/wrapWithTokenLimit.js';
 import { wrapWithToolResult } from '../transformers/wrapWithToolResult.js';
 import { z } from 'zod';
 import { generateFieldsDescription } from '../../utils/generateFieldsDescription.js';
+/**
+ * Builds the schema and handler a tool is registered with.
+ *
+ * The returned schema is a fresh object: the tool definition is never mutated.
+ * That matters under the stateless HTTP model, where one toolset group is shared
+ * by every per-request server — an in-place extension would be re-applied on
+ * every request, against a definition other requests are reading concurrently.
+ */
 export function composeToolHandler(tool, options) {
-    const { useFields, errorHandler, maxTokens } = options;
+    const { useFields, errorHandler, maxTokens, useOrganization = false, } = options;
     // Step 1: Add `fields` to schema if needed
     const fieldDesc = useFields
         ? generateFieldsDescription(tool.outputSchema, tool.importantFields ?? [], tool.name)
         : undefined;
-    tool.schema = extendSchema(tool.schema, fieldDesc);
+    const schema = extendSchema(tool.schema, fieldDesc, useOrganization);
     // Step 2: Compose
     const baseHandler = wrapWithErrorHandling(wrapWithOrganizationContext(tool.handler), errorHandler);
-    const handler = useFields ? wrapWithFieldPicking(baseHandler) : baseHandler;
-    return wrapWithToolResult(wrapWithTokenLimit(handler, maxTokens));
+    const composed = useFields ? wrapWithFieldPicking(baseHandler) : baseHandler;
+    return {
+        schema,
+        handler: wrapWithToolResult(wrapWithTokenLimit(composed, maxTokens)),
+    };
 }
-function extendSchema(schema, desc) {
-    const extension = {
-        organization: z
+function extendSchema(schema, desc, withOrganization = false) {
+    const extension = {};
+    if (withOrganization) {
+        extension.organization = z
             .string()
             .optional()
-            .describe('Optional organization name. Use list_organizations to inspect available organizations.'),
-    };
+            .describe('Optional organization name. Use list_organizations to inspect available organizations.');
+    }
     if (desc) {
         extension.fields = z.string().describe(desc);
     }
+    // zod v4 reworked the ZodObject shape generics, so `extend()`'s result no
+    // longer overlaps the declared return type enough for a direct cast. The
+    // shape is correct at runtime; route through `unknown` to keep the assertion.
     return schema.extend(extension);
 }

package/build/handlers/transformers/wrapWithErrorHandling.d.ts

@@ -0,0 +1,2 @@
+import { ErrorLike, SafeResult } from '../../types/result.js';
+export declare function wrapWithErrorHandling<I, O>(fn: (input: I) => Promise<O>, onError?: (err: unknown) => ErrorLike): (input: I) => Promise<SafeResult<O>>;

package/build/handlers/transformers/wrapWithFieldPicking.d.ts

@@ -0,0 +1,4 @@
+import { SafeResult } from '../../types/result.js';
+export declare function wrapWithFieldPicking<I extends {
+    fields?: string;
+}, O>(fn: (input: I) => Promise<SafeResult<O>>): (input: I) => Promise<SafeResult<O>>;

package/build/handlers/transformers/wrapWithOrganizationContext.d.ts

@@ -0,0 +1,3 @@
+export declare function wrapWithOrganizationContext<I extends {
+    organization?: string;
+}, O>(fn: (input: Omit<I, 'organization'>) => Promise<O>): (input: I) => Promise<O>;

package/build/handlers/transformers/wrapWithTokenLimit.d.ts

@@ -0,0 +1,2 @@
+import { SafeResult } from '../../types/result.js';
+export declare function wrapWithTokenLimit<I, O>(fn: (input: I) => Promise<SafeResult<O>>, maxTokens: number): (input: I) => Promise<SafeResult<string>>;

package/build/handlers/transformers/wrapWithToolResult.d.ts

@@ -0,0 +1,6 @@
+import { CallToolResult, ServerContext } from '@modelcontextprotocol/server';
+import { SafeResult } from '../../types/result.js';
+/**
+ * Convert SafeResult<T> to CallToolResult
+ */
+export declare function wrapWithToolResult<I, T>(fn: (input: I) => Promise<SafeResult<string | T>>): (input: I, extra: ServerContext) => Promise<CallToolResult>;

package/build/httpMcpServer.d.ts

@@ -0,0 +1,22 @@
+import type { Server } from 'node:http';
+import type { BacklogOAuthConfig } from './auth/backlogOAuthConfig.js';
+import type { TokenStore } from './auth/tokenStore.js';
+import type { BacklogMCPServer } from './utils/wrapServerWithToolRegistry.js';
+type RunHttpMcpServerOptions = {
+    host: string;
+    port: number;
+    path: string;
+    version: string;
+    enableJsonResponse: boolean;
+    allowedHosts?: string[];
+    allowedOrigins?: string[];
+    createServer: () => BacklogMCPServer;
+    oauthConfig?: BacklogOAuthConfig;
+    tokenStore?: TokenStore;
+};
+type HttpMcpServerHandle = {
+    httpServer: Server;
+    shutdown: () => Promise<void>;
+};
+export declare const runHttpMcpServer: (options: RunHttpMcpServerOptions) => Promise<HttpMcpServerHandle>;
+export {};

package/build/httpMcpServer.js

@@ -1,78 +1,40 @@
 // Copyright (c) 2025 Nulab inc.
 // Licensed under the MIT License.
-import { randomUUID } from 'node:crypto';
 import { serve } from '@hono/node-server';
-import { WebStandardStreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js';
-import { isInitializeRequest } from '@modelcontextprotocol/sdk/types.js';
+import { hostHeaderValidation, localhostHostValidation, localhostOriginValidation, originValidation, } from '@modelcontextprotocol/hono';
+import { createMcpHandler } from '@modelcontextprotocol/server';
 import { Hono } from 'hono';
 import { runWithAccessToken } from './auth/backlogAuthContext.js';
 import { logger } from './utils/logger.js';
-const jsonRpcError = (code, message) => {
-    return { jsonrpc: '2.0', error: { code, message }, id: null };
-};
-const bodyContainsInitialize = (body) => {
-    return (Array.isArray(body) ? body : [body]).some(isInitializeRequest);
-};
-const buildAllowedHostnames = (host, allowedHosts) => {
-    if (allowedHosts?.length)
-        return allowedHosts;
-    const localhostHosts = ['127.0.0.1', 'localhost', '::1'];
-    return localhostHosts.includes(host)
-        ? ['localhost', '127.0.0.1', '[::1]']
-        : undefined;
-};
-const parseHostname = (hostHeader) => {
-    try {
-        return new URL(`http://${hostHeader}`).hostname;
-    }
-    catch {
-        return null;
-    }
-};
-const checkHostHeader = (hostHeader, allowedHostnames) => {
-    if (!hostHeader)
-        return jsonRpcError(-32000, 'Missing Host header');
-    const hostname = parseHostname(hostHeader);
-    if (hostname === null) {
-        return jsonRpcError(-32000, `Invalid Host header: ${hostHeader}`);
-    }
-    return allowedHostnames.includes(hostname)
-        ? null
-        : jsonRpcError(-32000, `Invalid Host: ${hostname}`);
-};
-const startNewSession = async (req, body, enableJsonResponse, transports, createServer, authInfo) => {
-    const transport = new WebStandardStreamableHTTPServerTransport({
-        sessionIdGenerator: () => randomUUID(),
-        enableJsonResponse,
-        onsessioninitialized: (sid) => {
-            transports[sid] = transport;
-        },
-    });
-    transport.onclose = () => {
-        const sid = transport.sessionId;
-        if (sid)
-            delete transports[sid];
-    };
-    await createServer().connect(transport);
-    return transport.handleRequest(req, { parsedBody: body, authInfo });
-};
+const LOCALHOST_BINDS = ['127.0.0.1', 'localhost', '::1'];
 export const runHttpMcpServer = async (options) => {
-    const { host, port, path: mcpPath, version, enableJsonResponse, allowedHosts, createServer, oauthConfig, tokenStore, } = options;
+    const { host, port, path: mcpPath, version, enableJsonResponse, allowedHosts, allowedOrigins, createServer, oauthConfig, tokenStore, } = options;
     if ((host === '0.0.0.0' || host === '::') && !allowedHosts?.length) {
         logger.warn('Binding to all interfaces without --http-allowed-hosts. ' +
             'Set allowed Host values to prevent DNS rebinding attacks.');
     }
     const app = new Hono();
-    const transports = {};
-    const allowedHostnames = buildAllowedHostnames(host, allowedHosts);
+    const isLocalhostBind = LOCALHOST_BINDS.includes(host);
     const oauthEnabled = !!(oauthConfig && tokenStore);
-    if (allowedHostnames) {
-        app.use('*', async (c, next) => {
-            const hostError = checkHostHeader(c.req.raw.headers.get('host'), allowedHostnames);
-            if (hostError)
-                return c.json(hostError, 403);
-            await next();
-        });
+    // DNS rebinding protection. `Host` is the actual defense: a rebinding page
+    // reaches us carrying its own hostname, which the allow list rejects.
+    if (allowedHosts?.length) {
+        app.use('*', hostHeaderValidation(allowedHosts));
+    }
+    else if (isLocalhostBind) {
+        app.use('*', localhostHostValidation());
+    }
+    // `Origin` is a separate axis and cannot be derived from the allow list: a
+    // browser client's Origin is its own site, never this server's hostname, so
+    // validating one against the other would reject every legitimate remote
+    // client. Default to the localhost set only for a bare loopback bind (the
+    // desktop case, where a drive-by page is the threat); a deployment that
+    // declares its hosts opts out unless it names its client origins too.
+    if (allowedOrigins?.length) {
+        app.use('*', originValidation(allowedOrigins));
+    }
+    else if (isLocalhostBind && !allowedHosts?.length) {
+        app.use('*', localhostOriginValidation());
     }
     app.get('/health', (c) => c.json({ status: 'healthy', timestamp: new Date().toISOString(), version }));
     if (oauthEnabled) {
@@ -81,43 +43,30 @@ export const runHttpMcpServer = async (options) => {
         app.route('/', createOAuthRoutes(oauthConfig, tokenStore, mcpPath));
         app.use(mcpPath, createBearerAuthMiddleware(tokenStore, oauthConfig, mcpPath));
     }
+    // MCP 2026-07-28 removed protocol sessions: every request is self-contained,
+    // so the handler builds a fresh server per request instead of keeping a
+    // transport map keyed by mcp-session-id. `legacy` defaults to 'stateless',
+    // which keeps 2025-era clients working over the same endpoint.
+    const mcpHandler = createMcpHandler(() => createServer(), {
+        responseMode: enableJsonResponse ? 'json' : 'auto',
+        onerror: (err) => logger.error({ err }, 'MCP handler error'),
+    });
     app.all(mcpPath, async (c) => {
-        const req = c.req.raw;
-        const authInfo = oauthEnabled
-            ? c.get('authInfo')
-            : undefined;
+        const authInfo = oauthEnabled ? c.get('authInfo') : undefined;
         const accessToken = authInfo?.token;
-        const sessionId = req.headers.get('mcp-session-id');
         try {
-            if (sessionId && transports[sessionId]) {
-                const handleExisting = () => transports[sessionId].handleRequest(req, { authInfo });
-                return accessToken
-                    ? runWithAccessToken(accessToken, handleExisting)
-                    : handleExisting();
-            }
-            if (sessionId) {
-                return c.json(jsonRpcError(-32000, 'Bad Request: Unknown or expired session ID. Send a new initialize request without mcp-session-id.'), 400);
-            }
-            if (req.method !== 'POST') {
-                return c.json(jsonRpcError(-32000, 'Bad Request: No mcp-session-id header.'), 400);
-            }
-            const parsed = await req.json().then((body) => ({ body }), () => null);
-            if (!parsed) {
-                return c.json(jsonRpcError(-32700, 'Parse error: Invalid JSON'), 400);
-            }
-            const { body } = parsed;
-            if (!bodyContainsInitialize(body)) {
-                const err = jsonRpcError(-32000, 'Bad Request: No mcp-session-id header and body is not an initialize request.');
-                return c.json(Array.isArray(body) ? [err] : err, 400);
-            }
-            const handleNew = () => startNewSession(req, body, enableJsonResponse, transports, createServer, authInfo);
+            const dispatch = () => mcpHandler.fetch(c.req.raw, { authInfo });
             return accessToken
-                ? runWithAccessToken(accessToken, handleNew)
-                : handleNew();
+                ? await runWithAccessToken(accessToken, dispatch)
+                : await dispatch();
         }
         catch (error) {
             logger.error({ err: error }, 'Error handling MCP request');
-            return c.json(jsonRpcError(-32603, 'Internal server error'), 500);
+            return c.json({
+                jsonrpc: '2.0',
+                error: { code: -32603, message: 'Internal server error' },
+                id: null,
+            }, 500);
         }
     });
     const httpServer = await new Promise((resolve, reject) => {
@@ -125,14 +74,11 @@ export const runHttpMcpServer = async (options) => {
         srv.on('error', reject);
     });
     const shutdown = async () => {
-        for (const sid of Object.keys(transports)) {
-            try {
-                await transports[sid].close();
-            }
-            catch {
-                /* ignore */
-            }
-            delete transports[sid];
+        try {
+            await mcpHandler.close();
+        }
+        catch {
+            /* ignore */
         }
         httpServer.closeAllConnections();
         await new Promise((resolve) => httpServer.close(() => resolve()));

package/build/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/build/index.js

@@ -1,17 +1,19 @@
 #!/usr/bin/env node
 // Copyright (c) 2025 Nulab inc.
 // Licensed under the MIT License.
-import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { serveStdio } from '@modelcontextprotocol/server/stdio';
 import { default as env } from 'env-var';
 import yargs from 'yargs';
 import { hideBin } from 'yargs/helpers';
 import { getBacklogOAuthConfig } from './auth/backlogOAuthConfig.js';
 import { createTokenStore } from './auth/tokenStore.js';
 import { createTranslationHelper } from './createTranslationHelper.js';
+import { loadTranslationOverrides } from './loadTranslationOverrides.js';
 import { createBacklogMcpServer } from './createBacklogMcpServer.js';
 import { runHttpMcpServer } from './httpMcpServer.js';
 import { createBacklogClientRegistry, createOAuthBacklogClientRegistry, } from './utils/backlogClientRegistry.js';
 import { logger } from './utils/logger.js';
+import { buildToolsetGroup } from './utils/toolsetUtils.js';
 import packageJson from '../package.json' with { type: 'json' };
 const { version } = packageJson;
 // Swallow SIGPIPE and stdout/stderr EPIPE so the process doesn't crash when a
@@ -75,6 +77,11 @@ const argv = yargs(hideBin(process.argv))
     type: 'string',
     describe: 'Comma-separated allowed Host header values when binding to all interfaces (recommended with 0.0.0.0)',
     default: env.get('MCP_HTTP_ALLOWED_HOSTS').default('').asString(),
+})
+    .option('http-allowed-origins', {
+    type: 'string',
+    describe: 'Comma-separated allowed Origin header hostnames for browser-based clients. Defaults to the localhost set on a loopback bind, and to no Origin check otherwise',
+    default: env.get('MCP_HTTP_ALLOWED_ORIGINS').default('').asString(),
 })
     .option('max-tokens', {
     type: 'number',
@@ -125,15 +132,26 @@ if (tokenStore) {
     cleanupTimer.unref();
 }
 const useFields = argv.optimizeResponse;
-const transHelper = createTranslationHelper();
+const transHelper = createTranslationHelper(loadTranslationOverrides());
 const maxTokens = argv.maxTokens;
 const prefix = argv.prefix;
 const enabledToolsets = argv.dynamicToolsets
     ? argv.enableToolsets.filter((a) => a !== 'all')
     : argv.enableToolsets;
-const mcpOption = { useFields: useFields, maxTokens, prefix };
+const mcpOption = {
+    useFields: useFields,
+    maxTokens,
+    prefix,
+    useOrganization: clientRegistry.isMultiOrganization,
+};
+// Built once and shared by every server the factory produces. `enable_toolset`
+// mutates this group, and the stateless HTTP model discards its server after
+// each request — so a per-server group would lose the enablement immediately.
+// Sharing it makes toolset state process-wide, which is the only scope left now
+// that the protocol has no sessions.
+const sharedToolsetGroup = buildToolsetGroup(backlog, transHelper, enabledToolsets);
 // Factory: creates a fresh MCP server with all tools registered.
-// Used once for stdio; one fresh instance per HTTP session for Streamable HTTP.
+// Used once per stdio connection; one fresh instance per HTTP request.
 const createServer = () => createBacklogMcpServer({
     version,
     useFields,
@@ -143,6 +161,7 @@ const createServer = () => createBacklogMcpServer({
     enabledToolsets,
     mcpOption,
     dynamicToolsets: argv.dynamicToolsets,
+    toolsetGroup: sharedToolsetGroup,
 });
 if (argv.exportTranslations) {
     // Translation keys are only recorded once a tool asks for them, so build a
@@ -175,13 +194,14 @@ async function main() {
     }
     if (argv.transport === 'http') {
         const httpPath = normalizeHttpPath(argv.httpPath);
-        const allowedHostsRaw = argv.httpAllowedHosts;
-        const allowedHosts = allowedHostsRaw && allowedHostsRaw.trim().length > 0
-            ? allowedHostsRaw
+        const parseHostList = (raw) => raw && raw.trim().length > 0
+            ? raw
                 .split(',')
                 .map((h) => h.trim())
                 .filter(Boolean)
             : undefined;
+        const allowedHosts = parseHostList(argv.httpAllowedHosts);
+        const allowedOrigins = parseHostList(argv.httpAllowedOrigins);
         const { shutdown } = await runHttpMcpServer({
             host: argv.httpHost,
             port: argv.httpPort,
@@ -189,6 +209,7 @@ async function main() {
             version,
             enableJsonResponse: argv.httpJsonResponse,
             allowedHosts,
+            allowedOrigins,
             createServer,
             oauthConfig,
             tokenStore,
@@ -214,9 +235,11 @@ async function main() {
             : 'Backlog MCP Server listening (Streamable HTTP)');
         return;
     }
-    const server = createServer();
-    const transport = new StdioServerTransport();
-    await server.connect(transport);
+    // serveStdio owns the era decision for the connection: it pins one instance
+    // from the factory, serving both 2026-07-28 and 2025-era clients.
+    serveStdio(createServer, {
+        onerror: (err) => logger.error({ err }, 'MCP stdio error'),
+    });
     logger.info('Backlog MCP Server running on stdio');
 }
 main().catch((error) => {

package/build/lib.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Library entry point.
+ *
+ * `src/index.ts` is the CLI: it parses argv, reads config files and starts a
+ * transport. Consumers that only want the tool layer — to host the same tools on
+ * a different runtime, for example — cannot import it without running all of that.
+ * This module exposes the pieces needed to build a server, and nothing that runs
+ * on import.
+ *
+ * Nothing reachable from here may touch a Node built-in. `loadTranslationOverrides`
+ * is the counter-example worth remembering: it reads the override file from disk,
+ * so it belongs to the CLI and is deliberately absent below. Consumers on other
+ * runtimes pass their own overrides to `createTranslationHelper`.
+ */
+export { allTools } from './tools/tools.js';
+export { composeToolHandler } from './handlers/builders/composeToolHandler.js';
+export { createTranslationHelper } from './createTranslationHelper.js';
+export { backlogErrorHandler } from './backlog/backlogErrorHandler.js';
+export { buildToolSchema } from './types/tool.js';
+export { isErrorLike } from './types/result.js';
+export type { ComposeOptions } from './handlers/builders/composeToolHandler.js';
+export type { TranslationHelper } from './createTranslationHelper.js';
+export type { ToolDefinition, DynamicToolDefinition, ToolRegistrar, } from './types/tool.js';
+export type { Toolset, ToolsetGroup, DynamicToolset, DynamicToolsetGroup, } from './types/toolsets.js';
+export type { ErrorLike, SafeResult } from './types/result.js';

package/build/lib.js

@@ -0,0 +1,20 @@
+/**
+ * Library entry point.
+ *
+ * `src/index.ts` is the CLI: it parses argv, reads config files and starts a
+ * transport. Consumers that only want the tool layer — to host the same tools on
+ * a different runtime, for example — cannot import it without running all of that.
+ * This module exposes the pieces needed to build a server, and nothing that runs
+ * on import.
+ *
+ * Nothing reachable from here may touch a Node built-in. `loadTranslationOverrides`
+ * is the counter-example worth remembering: it reads the override file from disk,
+ * so it belongs to the CLI and is deliberately absent below. Consumers on other
+ * runtimes pass their own overrides to `createTranslationHelper`.
+ */
+export { allTools } from './tools/tools.js';
+export { composeToolHandler } from './handlers/builders/composeToolHandler.js';
+export { createTranslationHelper } from './createTranslationHelper.js';
+export { backlogErrorHandler } from './backlog/backlogErrorHandler.js';
+export { buildToolSchema } from './types/tool.js';
+export { isErrorLike } from './types/result.js';

package/build/loadTranslationOverrides.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Reads description overrides from a `.backlog-mcp-serverrc` file (`.json`,
+ * `.yaml` or `.yml`) in the user's home directory.
+ *
+ * Node-only, and kept separate from `createTranslationHelper` for that reason:
+ * cosmiconfig walks the filesystem and the default search path is the home
+ * directory. The CLI calls this and hands the result to the helper.
+ *
+ * The file is user-authored, so its contents are unknown: anything that is not a
+ * string is dropped here rather than passed on. Every override ends up in a tool
+ * description, and a number or an array there would produce an invalid
+ * `tools/list` payload.
+ */
+export declare function loadTranslationOverrides(options?: {
+    configName?: string;
+    searchDir?: string;
+}): Record<string, string>;

package/build/loadTranslationOverrides.js

@@ -0,0 +1,24 @@
+import { cosmiconfigSync } from 'cosmiconfig';
+import os from 'os';
+/**
+ * Reads description overrides from a `.backlog-mcp-serverrc` file (`.json`,
+ * `.yaml` or `.yml`) in the user's home directory.
+ *
+ * Node-only, and kept separate from `createTranslationHelper` for that reason:
+ * cosmiconfig walks the filesystem and the default search path is the home
+ * directory. The CLI calls this and hands the result to the helper.
+ *
+ * The file is user-authored, so its contents are unknown: anything that is not a
+ * string is dropped here rather than passed on. Every override ends up in a tool
+ * description, and a number or an array there would produce an invalid
+ * `tools/list` payload.
+ */
+export function loadTranslationOverrides(options) {
+    const explorer = cosmiconfigSync(options?.configName ?? 'backlog-mcp-server');
+    const searchPath = options?.searchDir ?? os.homedir();
+    const config = explorer.search(searchPath)?.config;
+    if (typeof config !== 'object' || config === null || Array.isArray(config)) {
+        return {};
+    }
+    return Object.fromEntries(Object.entries(config).filter(([, value]) => typeof value === 'string'));
+}

package/build/registerTools.d.ts

@@ -0,0 +1,5 @@
+import { MCPOptions } from './types/mcp.js';
+import { DynamicToolsetGroup, ToolsetGroup } from './types/toolsets.js';
+import { BacklogMCPServer } from './utils/wrapServerWithToolRegistry.js';
+export declare function registerTools(server: BacklogMCPServer, toolsetGroup: ToolsetGroup, options: MCPOptions): void;
+export declare function registerDynamicTools(server: BacklogMCPServer, dynamicToolsetGroup: DynamicToolsetGroup, prefix: string): void;

package/build/registerTools.js

@@ -1,17 +1,18 @@
 import { backlogErrorHandler } from './backlog/backlogErrorHandler.js';
 import { composeToolHandler } from './handlers/builders/composeToolHandler.js';
 export function registerTools(server, toolsetGroup, options) {
-    const { useFields, maxTokens, prefix } = options;
+    const { useFields, maxTokens, prefix, useOrganization } = options;
     registerToolsets({
         server,
         toolsetGroup,
         prefix,
-        handlerStrategy: (tool) => 
+        prepareTool: (tool) => 
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
         composeToolHandler(tool, {
             useFields,
             errorHandler: backlogErrorHandler,
             maxTokens,
+            useOrganization,
         }),
     });
 }
@@ -20,18 +21,18 @@ export function registerDynamicTools(server, dynamicToolsetGroup, prefix) {
         server,
         toolsetGroup: dynamicToolsetGroup,
         prefix,
-        handlerStrategy: (tool) => tool.handler,
+        prepareTool: (tool) => ({ schema: tool.schema, handler: tool.handler }),
     });
 }
-function registerToolsets({ server, toolsetGroup, prefix, handlerStrategy, }) {
+function registerToolsets({ server, toolsetGroup, prefix, prepareTool, }) {
     for (const toolset of toolsetGroup.toolsets) {
         if (!toolset.enabled) {
             continue;
         }
         for (const tool of toolset.tools) {
             const toolNameWithPrefix = `${prefix}${tool.name}`;
-            const handler = handlerStrategy(tool);
-            server.registerOnce(toolNameWithPrefix, tool.description, tool.schema.shape, handler);
+            const { schema, handler } = prepareTool(tool);
+            server.registerOnce(toolNameWithPrefix, tool.description, schema, handler);
         }
     }
 }

package/build/tools/addDocument.d.ts

@@ -0,0 +1,15 @@
+import { Backlog } from 'backlog-js';
+import { z } from 'zod';
+import { TranslationHelper } from '../createTranslationHelper.js';
+import { DocumentItemSchema } from '../types/zod/backlogOutputDefinition.js';
+import { ToolDefinition } from '../types/tool.js';
+declare const addDocumentSchema: (t: TranslationHelper["t"]) => {
+    projectId: z.ZodNumber;
+    title: z.ZodOptional<z.ZodString>;
+    content: z.ZodOptional<z.ZodString>;
+    emoji: z.ZodOptional<z.ZodString>;
+    parentId: z.ZodOptional<z.ZodString>;
+    addLast: z.ZodOptional<z.ZodBoolean>;
+};
+export declare const addDocumentTool: (backlog: Backlog, { t }: TranslationHelper) => ToolDefinition<ReturnType<typeof addDocumentSchema>, (typeof DocumentItemSchema)["shape"]>;
+export {};

package/build/tools/addIssue.d.ts

@@ -0,0 +1,30 @@
+import { Backlog } from 'backlog-js';
+import { z } from 'zod';
+import { TranslationHelper } from '../createTranslationHelper.js';
+import { IssueSchema } from '../types/zod/backlogOutputDefinition.js';
+import { ToolDefinition } from '../types/tool.js';
+declare const addIssueSchema: (t: TranslationHelper["t"]) => {
+    projectId: z.ZodNumber;
+    summary: z.ZodString;
+    issueTypeId: z.ZodNumber;
+    priorityId: z.ZodNumber;
+    description: z.ZodOptional<z.ZodString>;
+    startDate: z.ZodOptional<z.ZodString>;
+    dueDate: z.ZodOptional<z.ZodString>;
+    estimatedHours: z.ZodOptional<z.ZodNumber>;
+    actualHours: z.ZodOptional<z.ZodNumber>;
+    categoryId: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
+    versionId: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
+    milestoneId: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
+    assigneeId: z.ZodOptional<z.ZodNumber>;
+    notifiedUserId: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
+    attachmentId: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
+    parentIssueId: z.ZodOptional<z.ZodNumber>;
+    customFields: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        id: z.ZodNumber;
+        value: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodArray<z.ZodString>, z.ZodArray<z.ZodNumber>]>>;
+        otherValue: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+};
+export declare const addIssueTool: (backlog: Backlog, { t }: TranslationHelper) => ToolDefinition<ReturnType<typeof addIssueSchema>, (typeof IssueSchema)["shape"]>;
+export {};

package/build/tools/addIssueComment.d.ts

@@ -0,0 +1,14 @@
+import { z } from 'zod';
+import { Backlog } from 'backlog-js';
+import { ToolDefinition } from '../types/tool.js';
+import { TranslationHelper } from '../createTranslationHelper.js';
+import { IssueCommentSchema } from '../types/zod/backlogOutputDefinition.js';
+declare const addIssueCommentSchema: (t: TranslationHelper["t"]) => {
+    issueId: z.ZodOptional<z.ZodNumber>;
+    issueKey: z.ZodOptional<z.ZodString>;
+    content: z.ZodString;
+    notifiedUserId: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
+    attachmentId: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
+};
+export declare const addIssueCommentTool: (backlog: Backlog, { t }: TranslationHelper) => ToolDefinition<ReturnType<typeof addIssueCommentSchema>, (typeof IssueCommentSchema)["shape"]>;
+export {};

package/build/tools/addProject.d.ts

@@ -0,0 +1,18 @@
+import { z } from 'zod';
+import { Backlog } from 'backlog-js';
+import { ToolDefinition } from '../types/tool.js';
+import { TranslationHelper } from '../createTranslationHelper.js';
+import { ProjectSchema } from '../types/zod/backlogOutputDefinition.js';
+declare const addProjectSchema: (t: TranslationHelper["t"]) => {
+    name: z.ZodString;
+    key: z.ZodString;
+    chartEnabled: z.ZodOptional<z.ZodBoolean>;
+    subtaskingEnabled: z.ZodOptional<z.ZodBoolean>;
+    projectLeaderCanEditProjectLeader: z.ZodOptional<z.ZodBoolean>;
+    textFormattingRule: z.ZodOptional<z.ZodEnum<{
+        backlog: "backlog";
+        markdown: "markdown";
+    }>>;
+};
+export declare const addProjectTool: (backlog: Backlog, { t }: TranslationHelper) => ToolDefinition<ReturnType<typeof addProjectSchema>, (typeof ProjectSchema)["shape"]>;
+export {};

package/build/tools/addPullRequest.d.ts

@@ -0,0 +1,20 @@
+import { z } from 'zod';
+import { Backlog } from 'backlog-js';
+import { ToolDefinition } from '../types/tool.js';
+import { TranslationHelper } from '../createTranslationHelper.js';
+import { PullRequestSchema } from '../types/zod/backlogOutputDefinition.js';
+declare const addPullRequestSchema: (t: TranslationHelper["t"]) => {
+    projectId: z.ZodOptional<z.ZodNumber>;
+    projectKey: z.ZodOptional<z.ZodString>;
+    repoId: z.ZodOptional<z.ZodNumber>;
+    repoName: z.ZodOptional<z.ZodString>;
+    summary: z.ZodString;
+    description: z.ZodString;
+    base: z.ZodString;
+    branch: z.ZodString;
+    issueId: z.ZodOptional<z.ZodNumber>;
+    assigneeId: z.ZodOptional<z.ZodNumber>;
+    notifiedUserId: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
+};
+export declare const addPullRequestTool: (backlog: Backlog, { t }: TranslationHelper) => ToolDefinition<ReturnType<typeof addPullRequestSchema>, (typeof PullRequestSchema)["shape"]>;
+export {};