backlog-mcp-server 0.17.0 → 0.18.1

package/README.ja.md

@@ -16,7 +16,7 @@ Backlog API とやり取りするための Model Context Protocol（MCP）サー
 - Wikiページサポート
 - Gitリポジトリとプルリクエストツール
 - 通知ツール
-- 最適化されたレスポンスのためのGraphQLスタイルのフィールド選択
+- 最適化されたレスポンスのためのフィールド選択
 - 大規模なレスポンスに対するトークン制限
 
 ## 利用開始
@@ -188,6 +188,14 @@ OAuth有効時、サーバーは以下のOAuthエンドポイントを自動的
 
 MCP認可仕様に対応するMCPクライアントは、これらのエンドポイントを自動的に使用します。
 
+`POST /register` は登録できる redirect URI を制限します。ループバック URI
+（`http://localhost`、`http://127.0.0.1`、`http://[::1]`）はユーザーのマシン上で動く
+アプリが認可コードを受け取るための手段で、`"application_type": "native"` を宣言した
+クライアント、または宣言がない場合は redirect URI が**すべて**ループバックである
+クライアントから受け付けます。`"application_type": "web"` を宣言したクライアントや、
+宣言なしでリモートの `https:` URI とループバック URI を混在させた登録は
+`invalid_client_metadata` で拒否されます。
+
 > **制約事項:**
 >
 > - OAuthモードは現在、単一のBacklog組織のみをサポートしています。複数組織設定との併用はできません。
@@ -233,26 +241,6 @@ ENABLE_TOOLSETS="space,project,issue"
 
 > 🧩 ヒント: `project` ツールセットは、他の多くのツールがエントリポイントとしてプロジェクトデータに依存しているため、強く推奨されます。
 
-### 動的なツールセット検出（実験的）
-
-MCPサーバーをAIエージェントと共に使用している場合、実行時にツールセットの動的な検出を有効にすることができます：
-
-CLI経由での有効化：
-
-```
---dynamic-toolsets
-```
-
-または環境変数経由：
-
-```
--e DYNAMIC_TOOLSETS=1 \
-```
-
-動的ツールセットを有効にすると、LLMはツールインターフェースを介してオンデマンドでツールセットを一覧表示およびアクティブ化できるようになります。
-
-> **HTTPでのスコープ:** MCP `2026-07-28` にはプロトコルセッションがないため、アクティブ化したツールセットはクライアント単位ではなく**サーバープロセス単位**で保持されます。HTTPトランスポートでは接続中の全クライアントが1つのツールセット状態を共有し、プロセス再起動でリセットされます。共有されるのはツールの*可視性*のみで、認可は共有されません（各呼び出しは呼び出し元自身の認証情報で認証されます）。
-
 ## 利用可能なツール
 
 以下のような Backlog 機能に対応するツールを提供しています：
@@ -437,7 +425,7 @@ PREFIX="backlog_"
 
 ### レスポンスの最適化とトークン制限
 
-#### フィールド選択（GraphQLスタイル）
+#### フィールド選択
 
 ```
 --optimize-response
@@ -449,17 +437,13 @@ PREFIX="backlog_"
 OPTIMIZE_RESPONSE=1
 ```
 
-次に、特定のフィールドのみを要求します：
+**一覧を返すツール**に `fields` パラメータ（省略可）が追加されます。値はそのツールの結果のトップレベルのフィールド名のリストで、enum として公開されるため、そのツールに存在しない名前は無視されずに拒否されます。単体のレコードを返すツールには追加されません（パラメータは毎セッション費用がかかる一方、1 件のレコードから削れる量はごくわずかなためです）。
 
 ```
-get_project(projectIdOrKey: "PROJECT-KEY", fields: "{ name key description }")
+get_project(projectIdOrKey: "PROJECT-KEY", fields: ["name", "key", "description"])
 ```
 
-AIはフィールド選択を使用してレスポンスを最適化します：
-
-```
-get_project(projectIdOrKey: "PROJECT-KEY", fields: "{ name key description }")
-```
+`fields` を省略すると結果全体が返ります。選択は 1 階層のみで、オブジェクトや配列のフィールドを指定した場合はそのまま丸ごと返ります。
 
 利点：
 
@@ -485,6 +469,22 @@ MAX_TOKENS=10000
 
 > 注：これはベストエフォートの緩和策であり、保証された強制ではありません。
 
+### ログ出力
+
+ログは **stderr** に出力されます（stdio トランスポートでは stdout が JSON-RPC のストリームに使われるため）。
+
+| 変数        | 説明                                                                                                                                                                        |
+| ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `LOG_LEVEL` | `fatal` / `error` / `warn` / `info` / `debug` / `trace` / `silent`。既定は `NODE_ENV` が `production`（未設定時もこれに含まれる）のとき `error`、それ以外は `debug`。認識できない値は通知した上で既定値にフォールバックします。 |
+
+出力**フォーマット**は引き続き `NODE_ENV` が決めます（`production` 以外では `pino-pretty` が利用可能なら人間向けの整形出力に切り替わります）。ログ量を変えたいときは `NODE_ENV` ではなく `LOG_LEVEL` を設定してください。デプロイ先で構造化 JSON のまま保てます。
+
+`pino-pretty` は開発用の依存なので、公開されている npm パッケージにもコンテナイメージにも含まれていません。そのため、これらでは `NODE_ENV` の値に関わらず常に構造化 JSON が出力され、出力を変えられるのは `LOG_LEVEL` だけです。
+
+```
+LOG_LEVEL=info node build/index.js --transport http
+```
+
 ### 完全なカスタム設定例
 
 このセクションでは、複数の環境変数を使用した高度な設定を示します。これらは実験的な機能であり、すべてのMCPクライアントでサポートされているとは限りません。これはMCP標準仕様の一部ではなく、注意して使用する必要があります。
@@ -518,8 +518,7 @@ MAX_TOKENS=10000
         "MAX_TOKENS": "10000",
         "OPTIMIZE_RESPONSE": "1",
         "PREFIX": "backlog_",
-        "ENABLE_TOOLSETS": "space,project,issue",
-        "ENABLE_DYNAMIC_TOOLSETS": "1"
+        "ENABLE_TOOLSETS": "space,project,issue"
       }
     }
   }
@@ -546,7 +545,7 @@ pnpm test
 サーバーはいくつかのコマンドラインオプションをサポートしています：
 
 - `--export-descriptions`: ツール一覧の構築時に解決される説明キーと値をエクスポート。旧名は `--export-translations` で、非推奨エイリアスとして当面動作しますが、将来のリリースで削除されます
-- `--optimize-response`: GraphQLスタイルのフィールド選択を有効にする
+- `--optimize-response`: 各ツールに、返す結果フィールドを選ぶ `fields` パラメータを追加する
 - `--max-tokens=NUMBER`: レスポンスの最大トークン制限を設定
 - `--prefix=STRING`: すべてのツール名に付加するオプションの文字列プレフィックス（デフォルト：""）
 - `--enable-toolsets <toolsets...>`: 有効にするツールセットを指定します（カンマ区切りまたは複数の引数）。デフォルトは "all" です。

package/README.md

@@ -17,7 +17,7 @@ A Model Context Protocol (MCP) server for interacting with the Backlog API. This
 - Wiki page support
 - Git repository and pull request tools
 - Notification tools
-- GraphQL-style field selection for optimized responses
+- Field selection for optimized responses
 - Token limiting for large responses
 
 ## Getting Started
@@ -215,6 +215,14 @@ The server automatically exposes the following OAuth endpoints when OAuth is ena
 
 MCP clients that support the MCP authorization specification will use these endpoints automatically.
 
+`POST /register` restricts which redirect URIs a client may register. A loopback
+URI (`http://localhost`, `http://127.0.0.1`, `http://[::1]`) is how an app running
+on the user's machine receives the authorization code, and is accepted from a
+client that declares `"application_type": "native"` — or, when the field is
+absent, from one whose redirect URIs are _all_ loopback. A client declaring
+`"application_type": "web"`, or mixing a remote `https:` URI with a loopback one
+without declaring itself, is rejected with `invalid_client_metadata`.
+
 > **Limitations:**
 >
 > - OAuth mode currently supports a single Backlog organization. It is not compatible with the multi-organization configuration.
@@ -260,26 +268,6 @@ Using selective toolsets can be helpful if the toolset list is too large for you
 
 > 🧩 Tip: `project` toolset is highly recommended, as many other tools rely on project data as an entry point.
 
-### Dynamic Toolset Discovery (Experimental)
-
-If you're using the MCP server with AI agents, you can enable dynamic discovery of toolsets at runtime:
-
-Enabling via CLI:
-
-```
---dynamic-toolsets
-```
-
-Or via environment variable::
-
-```
--e DYNAMIC_TOOLSETS=1 \
-```
-
-With dynamic toolsets enabled, the LLM will be able to list and activate toolsets on demand via tool interface.
-
-> **Scope over HTTP:** MCP `2026-07-28` has no protocol sessions, so an activated toolset is remembered per **server process**, not per client. On the HTTP transport every connected client shares one toolset state, and it resets when the process restarts. Tool _visibility_ is shared; authorization is not — every call is still authenticated with the caller's own credentials.
-
 ## Available Tools
 
 ### Toolset: `space`
@@ -549,7 +537,7 @@ This is especially useful if you're using multiple MCP servers or tools in the s
 
 ### Response Optimization & Token Limits
 
-#### Field Selection (GraphQL-style)
+#### Field Selection
 
 ```
 --optimize-response
@@ -561,17 +549,18 @@ Or environment variable:
 OPTIMIZE_RESPONSE=1
 ```
 
-Then, request only specific fields:
+Tools that return a **list** then take an optional `fields` parameter: a list of
+top-level field names from that tool's own result, published as an enum so a name
+the tool does not have is rejected rather than ignored. Tools that return a single
+record do not get it — the parameter costs schema on every session, and one record
+has almost nothing to trim.
 
 ```
-get_project(projectIdOrKey: "PROJECT-KEY", fields: "{ name key description }")
+get_project(projectIdOrKey: "PROJECT-KEY", fields: ["name", "key", "description"])
 ```
 
-The AI will use field selection to optimize the response:
-
-```
-get_project(projectIdOrKey: "PROJECT-KEY", fields: "{ name key description }")
-```
+Omitting `fields` returns the whole result. Selection is one level deep: naming an
+object or array field returns it whole.
 
 Benefits:
 
@@ -597,6 +586,22 @@ If a response exceeds the limit, it will be truncated with a warning.
 
 > Note: This is a best-effort mitigation, not a guaranteed enforcement.
 
+### Logging
+
+The server logs to **stderr** (stdout carries the JSON-RPC stream on the stdio transport).
+
+| Variable    | Description                                                                                                                                                                                             |
+| ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `LOG_LEVEL` | `fatal`, `error`, `warn`, `info`, `debug`, `trace` or `silent`. Defaults to `error` when `NODE_ENV` is `production` — which is also the default when `NODE_ENV` is unset — and to `debug` otherwise. An unrecognised value is reported and the default is used. |
+
+`NODE_ENV` still selects the output *format*: any value other than `production` switches to human-readable `pino-pretty` output when that package is available. Use `LOG_LEVEL`, not `NODE_ENV`, to change how much is logged, so that a deployment keeps structured JSON:
+
+`pino-pretty` is a development dependency, so neither the published npm package nor the container image carries a copy. In those, logs are structured JSON whatever `NODE_ENV` says, and `LOG_LEVEL` is the only setting that changes the output.
+
+```
+LOG_LEVEL=info node build/index.js --transport http
+```
+
 ### Full Custom Configuration Example
 
 This section demonstrates advanced configuration using multiple environment variables. These are experimental features and may not be supported across all MCP clients. This is not part of the MCP standard specification and should be used with caution.
@@ -630,8 +635,7 @@ This section demonstrates advanced configuration using multiple environment vari
         "MAX_TOKENS": "10000",
         "OPTIMIZE_RESPONSE": "1",
         "PREFIX": "backlog_",
-        "ENABLE_TOOLSETS": "space,project,issue",
-        "ENABLE_DYNAMIC_TOOLSETS": "1"
+        "ENABLE_TOOLSETS": "space,project,issue"
       }
     }
   }
@@ -663,7 +667,7 @@ The server supports several command line options:
 - `--http-allowed-hosts`: Comma-separated allowed `Host` hostnames (port-agnostic). Needed when binding to all interfaces, or on a loopback bind behind a reverse proxy.
 - `--http-allowed-origins`: Comma-separated allowed `Origin` hostnames for browser-based clients. Defaults to the localhost set on a bare loopback bind, and to no `Origin` check otherwise.
 - `--export-descriptions`: Export the description keys and values resolved when building the tool list. Was named `--export-translations`; that spelling still works as a deprecated alias and will be removed in a future release
-- `--optimize-response`: Enable GraphQL-style field selection
+- `--optimize-response`: Add a `fields` parameter to each tool for selecting which result fields to return
 - `--max-tokens=NUMBER`: Set maximum token limit for responses
 - `--prefix=STRING`: Optional string prefix to prepend to all tool names (default: "")
 - `--enable-toolsets <toolsets...>`: Specify which toolsets to enable (comma-separated or multiple arguments). Defaults to "all".

package/build/auth/oauthRoutes.js

@@ -15,17 +15,54 @@ function verifyPkce(codeVerifier, codeChallenge) {
 function oauthError(code, description) {
     return { error: code, error_description: description };
 }
+function isLoopbackRedirectUri(uri) {
+    try {
+        const parsed = new URL(uri);
+        return (parsed.protocol === 'http:' && LOCALHOST_HOSTS.includes(parsed.hostname));
+    }
+    catch {
+        return false;
+    }
+}
 function isValidRedirectUri(uri) {
     try {
         const parsed = new URL(uri);
         if (parsed.protocol === 'https:')
             return true;
-        return (parsed.protocol === 'http:' && LOCALHOST_HOSTS.includes(parsed.hostname));
+        return isLoopbackRedirectUri(uri);
     }
     catch {
         return false;
     }
 }
+/** RFC 7591 defines these two, and defaults to `web` when the field is absent. */
+const APPLICATION_TYPES = ['web', 'native'];
+/**
+ * Decides which application type a registration is held to.
+ *
+ * A loopback redirect URI is the standard way for an app on the user's machine
+ * to receive the authorization code (RFC 8252), and the wrong thing entirely for
+ * an app that has a domain of its own: nobody owns `http://localhost`, so
+ * whichever process is listening on that port receives the code.
+ *
+ * RFC 7591 defaults the field to `web`, which would reject every local MCP
+ * client that does not declare itself — and they do not, because nothing has
+ * ever checked. So an undeclared registration is judged by what it asks for: a
+ * set of redirect URIs that is entirely loopback can only be a native client,
+ * and is treated as one.
+ *
+ * The inference deliberately requires *all* of them. A registration mixing a
+ * remote https URI with a loopback one is the shape this check exists to stop:
+ * something that can serve a redirect on its own domain has no need to also
+ * collect codes on the user's machine. Mixing is only accepted from a client
+ * that declares `native` outright, which RFC 8252 does allow (a native app may
+ * claim an https URI as well as a loopback one).
+ */
+function resolveApplicationType(declared, redirectUris) {
+    if (declared)
+        return declared;
+    return redirectUris.every(isLoopbackRedirectUri) ? 'native' : 'web';
+}
 export function createOAuthRoutes(config, store, mcpPath) {
     const app = new Hono();
     const { serverBaseUrl } = config;
@@ -76,6 +113,21 @@ export function createOAuthRoutes(config, store, mcpPath) {
                 return c.json(oauthError('invalid_client_metadata', `redirect_uri must use https or http://localhost: ${uri}`), 400);
             }
         }
+        // `null` counts as not declared. Serialisers that emit null for an absent
+        // optional field are common, and rejecting it would break clients this
+        // change is meant to leave alone.
+        const declaredApplicationType = body.application_type ?? undefined;
+        if (declaredApplicationType !== undefined &&
+            !APPLICATION_TYPES.includes(declaredApplicationType)) {
+            return c.json(oauthError('invalid_client_metadata', `Unsupported application_type: ${JSON.stringify(declaredApplicationType)}. Supported: ${APPLICATION_TYPES.join(', ')}`), 400);
+        }
+        const applicationType = resolveApplicationType(declaredApplicationType, redirectUris);
+        if (applicationType === 'web') {
+            const loopback = redirectUris.filter(isLoopbackRedirectUri);
+            if (loopback.length > 0) {
+                return c.json(oauthError('invalid_client_metadata', `application_type "web" may not use a loopback redirect_uri: ${loopback.join(', ')}. Declare application_type "native" if this client runs on the user's machine.`), 400);
+            }
+        }
         const authMethod = typeof body.token_endpoint_auth_method === 'string'
             ? body.token_endpoint_auth_method
             : 'client_secret_post';

package/build/backlog/customFields.js

@@ -49,20 +49,23 @@ export function customFieldFiltersToPayload(customFields) {
                 break;
             }
             case 'list': {
-                if (Array.isArray(field.value)) {
-                    const values = field.value.filter((value) => Number.isFinite(value));
-                    if (values.length > 0) {
-                        result[`${baseKey}[]`] = values;
-                    }
-                }
-                else if (Number.isFinite(field.value)) {
-                    result[baseKey] = field.value;
+                // Always an array, single value included. Backlog matches a list custom
+                // field only on the indexed parameters `customField_1[0]=…`, which
+                // `Request.toQueryString` produces from an array under a `customField_`
+                // key. A bare `customField_1=…` is not matched, and neither is the
+                // `customField_1[][0]=…` that a `[]` suffix on this key would produce.
+                // Neither is rejected either — the filter is silently ignored and every
+                // issue comes back, so the caller cannot tell a filtered query from an
+                // unfiltered one.
+                const values = (Array.isArray(field.value) ? field.value : [field.value]).filter((value) => Number.isFinite(value));
+                if (values.length > 0) {
+                    result[baseKey] = values;
                 }
                 break;
             }
             default: {
                 const exhaustiveCheck = field;
-                throw new Error(`Unsupported custom field filter type: ${exhaustiveCheck}`);
+                throw new Error(`Unsupported custom field filter type: ${JSON.stringify(exhaustiveCheck)}`);
             }
         }
     }

package/build/createBacklogMcpServer.d.ts

@@ -12,13 +12,11 @@ export type CreateBacklogMcpServerConfig = {
     descriptionHelper: DescriptionHelper;
     enabledToolsets: string[];
     mcpOption: MCPOptions;
-    dynamicToolsets: boolean;
     /**
      * A toolset group to register from, instead of building one from
-     * `enabledToolsets`. Callers that produce many servers from one factory pass
-     * a single shared group: `enable_toolset` mutates it, and under the stateless
-     * HTTP model — one server per request — a group built per server would throw
-     * that mutation away the moment the request ends.
+     * `enabledToolsets`. Callers that produce many servers from one factory pass a
+     * single shared group so the tool tree is built once rather than per request.
+     * Nothing mutates it.
      */
     toolsetGroup?: ToolsetGroup;
 };
@@ -26,4 +24,4 @@ export type CreateBacklogMcpServerConfig = {
  * Builds a fresh MCP server instance with all Backlog tools registered.
  * Used once per stdio connection; one instance per HTTP request for Streamable HTTP.
  */
-export declare function createBacklogMcpServer({ version, useFields, backlog, clientRegistry, descriptionHelper, enabledToolsets, mcpOption, dynamicToolsets, toolsetGroup: sharedToolsetGroup, }: CreateBacklogMcpServerConfig): BacklogMCPServer;
+export declare function createBacklogMcpServer({ version, useFields, backlog, clientRegistry, descriptionHelper, enabledToolsets, mcpOption, toolsetGroup: sharedToolsetGroup, }: CreateBacklogMcpServerConfig): BacklogMCPServer;

package/build/createBacklogMcpServer.js

@@ -3,13 +3,10 @@
 import { McpServer } from '@modelcontextprotocol/server';
 import { registerDynamicTools, registerTools } from './registerTools.js';
 import { organizationTools } from './tools/dynamicTools/organizations.js';
-import { dynamicTools } from './tools/dynamicTools/toolsets.js';
-import { createToolRegistrar } from './utils/toolRegistrar.js';
 import { buildToolsetGroup } from './utils/toolsetUtils.js';
 import { wrapServerWithToolRegistry, } from './utils/wrapServerWithToolRegistry.js';
-// The tool list is fixed for the process lifetime (it only depends on CLI flags
-// and environment), so clients may cache it. With dynamic toolsets the list can
-// grow at runtime, so no hint is published in that case.
+// The tool list is fixed for the process lifetime: it only depends on CLI flags
+// and environment, so clients may cache it.
 const TOOL_LIST_CACHE_HINT = {
     'tools/list': { ttlMs: 5 * 60 * 1000, cacheScope: 'public' },
 };
@@ -17,12 +14,12 @@ const TOOL_LIST_CACHE_HINT = {
  * Builds a fresh MCP server instance with all Backlog tools registered.
  * Used once per stdio connection; one instance per HTTP request for Streamable HTTP.
  */
-export function createBacklogMcpServer({ version, useFields, backlog, clientRegistry, descriptionHelper, enabledToolsets, mcpOption, dynamicToolsets, toolsetGroup: sharedToolsetGroup, }) {
+export function createBacklogMcpServer({ version, useFields, backlog, clientRegistry, descriptionHelper, enabledToolsets, mcpOption, toolsetGroup: sharedToolsetGroup, }) {
     const server = wrapServerWithToolRegistry(new McpServer({
         name: 'backlog',
         title: useFields ? 'backlog (field selection enabled)' : 'backlog',
         version,
-    }, dynamicToolsets ? undefined : { cacheHints: TOOL_LIST_CACHE_HINT }));
+    }, { cacheHints: TOOL_LIST_CACHE_HINT }));
     const toolsetGroup = sharedToolsetGroup ??
         buildToolsetGroup(backlog, descriptionHelper, enabledToolsets);
     registerTools(server, toolsetGroup, mcpOption);
@@ -32,10 +29,5 @@ export function createBacklogMcpServer({ version, useFields, backlog, clientRegi
     if (mcpOption.useOrganization) {
         registerDynamicTools(server, organizationTools(clientRegistry, descriptionHelper), mcpOption.prefix);
     }
-    if (dynamicToolsets) {
-        const registrar = createToolRegistrar(server, toolsetGroup, mcpOption);
-        const dynamicToolsetGroup = dynamicTools(registrar, descriptionHelper, toolsetGroup);
-        registerDynamicTools(server, dynamicToolsetGroup, mcpOption.prefix);
-    }
     return server;
 }

package/build/handlers/builders/composeToolHandler.d.ts

@@ -13,7 +13,7 @@ export interface ComposeOptions {
     useOrganization?: boolean;
 }
 type ComposedInput = {
-    fields?: string;
+    fields?: string[];
     organization?: string;
 } & Record<string, unknown>;
 /**

package/build/handlers/builders/composeToolHandler.js

@@ -5,7 +5,7 @@ import { wrapWithOrganizationContext } from '../transformers/wrapWithOrganizatio
 import { wrapWithTokenLimit } from '../transformers/wrapWithTokenLimit.js';
 import { wrapWithToolResult } from '../transformers/wrapWithToolResult.js';
 import { z } from 'zod';
-import { generateFieldsDescription } from '../../utils/generateFieldsDescription.js';
+import { fieldSelectionSchema } from '../../utils/fieldSelection.js';
 /**
  * Builds the schema and handler a tool is registered with.
  *
@@ -16,20 +16,24 @@ import { generateFieldsDescription } from '../../utils/generateFieldsDescription
  */
 export function composeToolHandler(tool, options) {
     const { useFields, errorHandler, maxTokens, useOrganization = false, } = options;
-    // Step 1: Add `fields` to schema if needed
-    const fieldDesc = useFields
-        ? generateFieldsDescription(tool.outputSchema, tool.importantFields ?? [], tool.name)
+    // Step 1: Add `fields` to schema if needed.
+    //
+    // Only on tools that return a list. That is where a response grows without
+    // bound and trimming it pays for the schema every client downloads; a tool
+    // returning one record saves a few hundred bytes at best.
+    const fields = useFields && tool.returnsList
+        ? fieldSelectionSchema(tool.outputFields, tool.importantFields ?? [])
         : undefined;
-    const schema = extendSchema(tool.schema, fieldDesc, useOrganization);
+    const schema = extendSchema(tool.schema, fields, useOrganization);
     // Step 2: Compose
     const baseHandler = wrapWithErrorHandling(wrapWithOrganizationContext(tool.handler), errorHandler);
-    const composed = useFields ? wrapWithFieldPicking(baseHandler) : baseHandler;
+    const composed = useFields && fields ? wrapWithFieldPicking(baseHandler) : baseHandler;
     return {
         schema,
         handler: wrapWithToolResult(wrapWithTokenLimit(composed, maxTokens)),
     };
 }
-function extendSchema(schema, desc, withOrganization = false) {
+function extendSchema(schema, fields, withOrganization = false) {
     const extension = {};
     if (withOrganization) {
         extension.organization = z
@@ -37,8 +41,10 @@ function extendSchema(schema, desc, withOrganization = false) {
             .optional()
             .describe('Optional organization name. Use list_organizations to inspect available organizations.');
     }
-    if (desc) {
-        extension.fields = z.string().describe(desc);
+    // Optional, as `wrapWithFieldPicking` assumes: it returns the whole result
+    // when `fields` is absent.
+    if (fields) {
+        extension.fields = fields;
     }
     // zod v4 reworked the ZodObject shape generics, so `extend()`'s result no
     // longer overlaps the declared return type enough for a direct cast. The

package/build/handlers/transformers/wrapWithFieldPicking.d.ts

@@ -1,4 +1,17 @@
 import { SafeResult } from '../../types/result.js';
+/**
+ * Narrows a successful result to the fields the caller asked for.
+ *
+ * `fields` is a list of top-level names, validated against the tool's own enum
+ * before it reaches here, so an unknown name is rejected by the protocol rather
+ * than dropped in silence. A missing or empty list returns everything.
+ *
+ * One level deep on purpose. This used to accept a GraphQL selection set and
+ * parse it with the `graphql` package: ~1 MB for a single `parse` call, a grammar
+ * that accepted aliases, fragments, arguments and directives and then honoured
+ * none of them, and a descent into an array field that returned `{}` and lost the
+ * data outright.
+ */
 export declare function wrapWithFieldPicking<I extends {
-    fields?: string;
+    fields?: string[];
 }, O>(fn: (input: I) => Promise<SafeResult<O>>): (input: I) => Promise<SafeResult<O>>;

package/build/handlers/transformers/wrapWithFieldPicking.js

@@ -1,55 +1,49 @@
-import { parse } from 'graphql';
 import { isErrorLike } from '../../types/result.js';
+/**
+ * Narrows a successful result to the fields the caller asked for.
+ *
+ * `fields` is a list of top-level names, validated against the tool's own enum
+ * before it reaches here, so an unknown name is rejected by the protocol rather
+ * than dropped in silence. A missing or empty list returns everything.
+ *
+ * One level deep on purpose. This used to accept a GraphQL selection set and
+ * parse it with the `graphql` package: ~1 MB for a single `parse` call, a grammar
+ * that accepted aliases, fragments, arguments and directives and then honoured
+ * none of them, and a descent into an array field that returned `{}` and lost the
+ * data outright.
+ */
 export function wrapWithFieldPicking(fn) {
     return async (input) => {
         const { fields, ...rest } = input;
         const result = await fn(rest);
-        if (!fields || isErrorLike(result)) {
+        if (!fields || fields.length === 0 || isErrorLike(result)) {
             return result;
         }
-        const selectionSet = parseFieldsSelection(fields);
-        const resultData = result.data;
-        if (Array.isArray(resultData)) {
+        const data = result.data;
+        if (Array.isArray(data)) {
             return {
                 kind: 'ok',
-                data: resultData.map((item) => pickFieldsFromData(item, selectionSet)),
+                data: data.map((item) => pick(item, fields)),
             };
         }
-        else if (typeof result === 'object' && result !== null) {
+        if (typeof data === 'object' && data !== null) {
             return {
                 kind: 'ok',
-                data: pickFieldsFromData(resultData, selectionSet),
+                data: pick(data, fields),
             };
         }
-        else {
-            return result;
-        }
+        // A scalar has no fields to narrow.
+        return result;
     };
 }
-function parseFieldsSelection(fieldsString) {
-    const query = `query Dummy ${fieldsString}`;
-    const ast = parse(query);
-    const opDef = ast.definitions[0];
-    if (opDef.kind !== 'OperationDefinition' || !opDef.selectionSet) {
-        throw new Error('Invalid GraphQL fields');
-    }
-    return opDef.selectionSet;
-}
-function pickFieldsFromData(data, selectionSet) {
-    const result = {};
-    for (const selection of selectionSet.selections) {
-        if (selection.kind === 'Field') {
-            const key = selection.name.value;
-            if (data != null && key in data) {
-                const value = data[key];
-                if (selection.selectionSet && value != null) {
-                    result[key] = pickFieldsFromData(data[key], selection.selectionSet);
-                }
-                else {
-                    result[key] = data[key];
-                }
-            }
-        }
+function pick(value, fields) {
+    if (typeof value !== 'object' || value === null)
+        return value;
+    const source = value;
+    const picked = {};
+    for (const field of fields) {
+        if (field in source)
+            picked[field] = source[field];
     }
-    return result;
+    return picked;
 }

package/build/httpMcpServer.js

@@ -16,6 +16,14 @@ export const runHttpMcpServer = async (options) => {
     const app = new Hono();
     const isLocalhostBind = LOCALHOST_BINDS.includes(host);
     const oauthEnabled = !!(oauthConfig && tokenStore);
+    // Registered before the Host and Origin guards so that it stays reachable
+    // under an allow list. A load balancer health check addresses the target
+    // directly and puts its address in `Host` — AWS ALB gives no way to override
+    // it — so a guarded `/health` can only ever answer 403, leaving an operator
+    // to choose between dropping the allow list and treating 403 as healthy.
+    // Exempting it costs nothing: the response is constant and reaches no state,
+    // so there is nothing here for a rebinding page to reach either.
+    app.get('/health', (c) => c.json({ status: 'healthy', timestamp: new Date().toISOString(), version }));
     // DNS rebinding protection. `Host` is the actual defense: a rebinding page
     // reaches us carrying its own hostname, which the allow list rejects.
     if (allowedHosts?.length) {
@@ -36,7 +44,6 @@ export const runHttpMcpServer = async (options) => {
     else if (isLocalhostBind && !allowedHosts?.length) {
         app.use('*', localhostOriginValidation());
     }
-    app.get('/health', (c) => c.json({ status: 'healthy', timestamp: new Date().toISOString(), version }));
     if (oauthEnabled) {
         const { createOAuthRoutes } = await import('./auth/oauthRoutes.js');
         const { createBearerAuthMiddleware } = await import('./auth/bearerAuthMiddleware.js');