datadog-mcp 2.0.2 → 4.0.0

package/dist/index.js

@@ -37,12 +37,12 @@ var configSchema = z.object({
     host: z.string().default("localhost")
   }).default({}),
   limits: z.object({
-    maxResults: z.number().default(100),
-    maxLogLines: z.number().default(100),
-    // Reduced from 500 for token efficiency
-    defaultLimit: z.number().default(25),
-    // Default limit for initial queries
-    maxMetricDataPoints: z.number().default(1e3),
+    defaultLimit: z.number().default(50),
+    // Fallback when AI doesn't specify limit
+    defaultLogLines: z.number().default(200),
+    // Fallback when AI doesn't specify log limit
+    defaultMetricDataPoints: z.number().default(1e3),
+    // Fallback for timeseries data points
     defaultTimeRangeHours: z.number().default(24)
   }).default({}),
   features: z.object({
@@ -115,9 +115,9 @@ function loadConfig() {
       host: args.strings.host ?? process.env.MCP_HOST ?? "localhost"
     },
     limits: {
-      maxResults: Number.parseInt(process.env.MCP_MAX_RESULTS ?? "100", 10),
-      maxLogLines: Number.parseInt(process.env.MCP_MAX_LOG_LINES ?? "500", 10),
-      maxMetricDataPoints: Number.parseInt(process.env.MCP_MAX_METRIC_POINTS ?? "1000", 10),
+      defaultLimit: Number.parseInt(process.env.MCP_DEFAULT_LIMIT ?? "50", 10),
+      defaultLogLines: Number.parseInt(process.env.MCP_DEFAULT_LOG_LINES ?? "200", 10),
+      defaultMetricDataPoints: Number.parseInt(process.env.MCP_DEFAULT_METRIC_POINTS ?? "1000", 10),
       defaultTimeRangeHours: Number.parseInt(process.env.MCP_DEFAULT_TIME_RANGE ?? "24", 10)
     },
     features: {
@@ -394,7 +394,7 @@ var InputSchema = {
   groupStates: z2.array(z2.string()).optional().describe(
     "Filter multi-alert monitors by group states (e.g., alert by host). Does NOT filter by overall monitor status. Values: alert, warn, no data, ok"
   ),
-  limit: z2.number().optional().describe("Maximum number of monitors to return"),
+  limit: z2.number().min(1).optional().describe("Maximum number of monitors to return (default: 50)"),
   config: z2.record(z2.unknown()).optional().describe("Monitor configuration (for create/update)"),
   message: z2.string().optional().describe("Mute message (for mute action)"),
   end: z2.number().optional().describe("Mute end timestamp (for mute action)")
@@ -415,7 +415,7 @@ function formatMonitor(m, site = "datadoghq.com") {
   };
 }
 async function listMonitors(api, params, limits, site) {
-  const effectiveLimit = Math.min(params.limit ?? limits.maxResults, limits.maxResults);
+  const effectiveLimit = params.limit ?? limits.defaultLimit;
   const response = await api.listMonitors({
     name: params.name,
     tags: params.tags?.join(","),
@@ -451,7 +451,7 @@ async function getMonitor(api, id, site) {
 }
 async function searchMonitors(api, query, limits, site) {
   const response = await api.searchMonitors({ query });
-  const monitors = (response.monitors ?? []).slice(0, limits.maxResults).map((m) => ({
+  const monitors = (response.monitors ?? []).map((m) => ({
     id: m.id ?? 0,
     name: m.name ?? "",
     status: String(m.status ?? "unknown"),
@@ -632,7 +632,7 @@ var InputSchema2 = {
   id: z3.string().optional().describe("Dashboard ID (required for get/update/delete)"),
   name: z3.string().optional().describe("Filter by name"),
   tags: z3.array(z3.string()).optional().describe("Filter by tags"),
-  limit: z3.number().optional().describe("Maximum number of dashboards to return"),
+  limit: z3.number().min(1).optional().describe("Maximum number of dashboards to return (default: 50)"),
   config: z3.record(z3.unknown()).optional().describe("Dashboard configuration (for create/update)")
 };
 function formatDashboardSummary(d) {
@@ -648,7 +648,7 @@ function formatDashboardSummary(d) {
   };
 }
 async function listDashboards(api, params, limits) {
-  const effectiveLimit = Math.min(params.limit ?? limits.maxResults, limits.maxResults);
+  const effectiveLimit = params.limit ?? limits.defaultLimit;
   const response = await api.listDashboards({
     filterShared: false
   });
@@ -914,7 +914,7 @@ var InputSchema3 = {
   host: z4.string().optional().describe("Filter by host"),
   status: z4.enum(["error", "warn", "info", "debug"]).optional().describe("Filter by log status/level"),
   indexes: z4.array(z4.string()).optional().describe("Log indexes to search"),
-  limit: z4.number().optional().describe("Maximum number of logs to return"),
+  limit: z4.number().min(1).optional().describe("Maximum number of logs to return (default: 200)"),
   sort: z4.enum(["timestamp", "-timestamp"]).optional().describe("Sort order"),
   sample: z4.enum(["first", "spread", "diverse"]).optional().describe(
     "Sampling mode: first (chronological, default), spread (evenly across time range), diverse (distinct message patterns)"
@@ -1009,6 +1009,7 @@ function diverseSample(items, limit) {
     patterns: seen.size
   };
 }
+var SAMPLE_DIVERSITY_MULTIPLIER = 4;
 function buildLogQuery(params) {
   const parts = [];
   if (params.query) {
@@ -1050,10 +1051,10 @@ async function searchLogs(api, params, limits, site) {
     host: params.host,
     status: params.status
   });
-  const requestedLimit = params.limit ?? limits.defaultLimit;
+  const requestedLimit = params.limit ?? limits.defaultLogLines;
   const sampleMode = params.sample ?? "first";
-  const fetchMultiplier = sampleMode === "first" ? 1 : 4;
-  const fetchLimit = Math.min(requestedLimit * fetchMultiplier, limits.maxLogLines);
+  const fetchMultiplier = sampleMode === "first" ? 1 : SAMPLE_DIVERSITY_MULTIPLIER;
+  const fetchLimit = requestedLimit * fetchMultiplier;
   const body = {
     filter: {
       query: fullQuery,
@@ -1226,7 +1227,10 @@ var InputSchema4 = {
   to: z5.string().optional().describe('End time (ONLY for query action). Same formats as "from".'),
   metric: z5.string().optional().describe("Metric name (for metadata action)"),
   tag: z5.string().optional().describe("Filter by tag"),
-  limit: z5.number().optional().describe("Maximum number of results (for search/list)")
+  limit: z5.number().min(1).optional().describe("Maximum number of results (for search/list, default: 50)"),
+  pointLimit: z5.number().min(1).optional().describe(
+    "Maximum data points per timeseries (for query action). AI controls resolution vs token usage (default: 1000)."
+  )
 };
 async function queryMetrics(api, params, limits, site) {
   const defaultFrom = hoursAgo(limits.defaultTimeRangeHours);
@@ -1242,7 +1246,7 @@ async function queryMetrics(api, params, limits, site) {
   });
   const series = (response.series ?? []).map((s) => ({
     metric: s.metric ?? "",
-    points: (s.pointlist ?? []).slice(0, limits.maxMetricDataPoints).map((p) => ({
+    points: (s.pointlist ?? []).slice(0, params.pointLimit ?? limits.defaultMetricDataPoints).map((p) => ({
       timestamp: p[0] ?? 0,
       value: p[1] ?? 0
     })),
@@ -1269,20 +1273,20 @@ async function searchMetrics(api, params, limits) {
   });
   const allMetrics = response.metrics ?? [];
   const lowerQuery = params.query.toLowerCase();
-  const filtered = allMetrics.filter((name) => name.toLowerCase().includes(lowerQuery)).slice(0, params.limit ?? limits.maxResults);
+  const filtered = allMetrics.filter((name) => name.toLowerCase().includes(lowerQuery)).slice(0, params.limit ?? limits.defaultLimit);
   return {
     metrics: filtered,
     total: filtered.length,
     searchedFrom: allMetrics.length
   };
 }
-async function listMetrics(api, params, limits) {
+async function listMetrics(api, params, _limits) {
   const response = await api.listActiveMetrics({
     from: hoursAgo(24),
     host: void 0,
     tagFilter: params.query
   });
-  const metrics = (response.metrics ?? []).slice(0, limits.maxResults);
+  const metrics = response.metrics ?? [];
   return {
     metrics,
     total: response.metrics?.length ?? 0
@@ -1315,7 +1319,7 @@ APM METRICS (auto-generated from traces):
 - trace.{service}.duration - Latency (use avg:, p95:, max:)
 Example: max:trace.{service}.request.duration{*}`,
     InputSchema4,
-    async ({ action, query, from, to, metric, limit }) => {
+    async ({ action, query, from, to, metric, limit, pointLimit }) => {
       try {
         switch (action) {
           case "query": {
@@ -1326,7 +1330,8 @@ Example: max:trace.{service}.request.duration{*}`,
                 {
                   query: metricsQuery,
                   from,
-                  to
+                  to,
+                  pointLimit
                 },
                 limits,
                 site
@@ -1401,7 +1406,7 @@ var InputSchema5 = {
   ),
   errorType: z6.string().optional().describe('Filter by error type (grep-like). Example: "TimeoutError", "ConnectionRefused"'),
   errorMessage: z6.string().optional().describe('Filter by error message (grep-like). Example: "timeout", "connection refused"'),
-  limit: z6.number().optional().describe("Maximum number of results"),
+  limit: z6.number().min(1).optional().describe("Maximum number of results (default: 50)"),
   sort: z6.enum(["timestamp", "-timestamp"]).optional().describe("Sort order"),
   groupBy: z6.array(z6.string()).optional().describe('Fields to group by (for aggregate). Example: ["resource_name", "status"]')
 };
@@ -1541,7 +1546,7 @@ async function searchTraces(api, params, limits, site) {
         },
         sort: params.sort === "timestamp" ? "timestamp" : "-timestamp",
         page: {
-          limit: Math.min(params.limit ?? limits.maxResults, limits.maxResults)
+          limit: params.limit ?? limits.defaultLimit
         }
       }
     }
@@ -1633,7 +1638,7 @@ async function listApmServices(api, params, limits) {
         groupBy: [
           {
             facet: "service",
-            limit: limits.maxResults
+            limit: limits.defaultLimit
           }
         ]
       }
@@ -1756,7 +1761,8 @@ var ActionSchema6 = z7.enum([
   "aggregate",
   "top",
   "timeseries",
-  "incidents"
+  "incidents",
+  "discover"
 ]);
 var InputSchema6 = {
   action: ActionSchema6.describe("Action to perform"),
@@ -1767,7 +1773,7 @@ var InputSchema6 = {
   priority: z7.enum(["normal", "low"]).optional().describe("Event priority"),
   sources: z7.array(z7.string()).optional().describe("Filter by sources"),
   tags: z7.array(z7.string()).optional().describe("Filter by tags"),
-  limit: z7.number().optional().describe("Maximum number of events to return"),
+  limit: z7.number().min(1).optional().describe("Maximum number of events to return (default: 50)"),
   title: z7.string().optional().describe("Event title (for create)"),
   text: z7.string().optional().describe("Event text (for create)"),
   alertType: z7.enum(["error", "warning", "info", "success"]).optional().describe("Alert type (for create)"),
@@ -1778,7 +1784,14 @@ var InputSchema6 = {
   // Phase 2: Incidents deduplication
   dedupeWindow: z7.string().optional().describe("Deduplication window for incidents: 5m, 15m, 1h (default: 5m)"),
   // Phase 3: Monitor enrichment
-  enrich: z7.boolean().optional().describe("Enrich events with monitor metadata (slower, adds monitor details)")
+  enrich: z7.boolean().optional().describe("Enrich events with monitor metadata (slower, adds monitor details)"),
+  // Context tag extraction for top action
+  contextTags: z7.array(z7.string()).optional().describe(
+    "Tag prefixes for context breakdown in top action (default: queue, service, ingress, pod_name, kube_namespace, kube_container_name)"
+  ),
+  maxEvents: z7.number().min(1).max(1e4).optional().describe(
+    "Maximum events to fetch for grouping in top action (default: 10000). Higher = more accurate but slower"
+  )
 };
 function extractMonitorInfo(title) {
   const priorityMatch = title.match(/^\[P(\d+)\]\s*/);
@@ -1901,8 +1914,50 @@ function formatEventV2(e) {
     } : void 0
   };
 }
+function findFirstContextTag(tags, prefixes) {
+  for (const tag of tags) {
+    const colonIndex = tag.indexOf(":");
+    if (colonIndex > 0) {
+      const prefix = tag.substring(0, colonIndex);
+      if (prefixes.has(prefix)) {
+        return tag;
+      }
+    }
+  }
+  return null;
+}
+async function discoverTagsV2(api, params, limits, site) {
+  const result = await searchEventsV2(
+    api,
+    {
+      ...params,
+      limit: 200
+    },
+    limits,
+    site
+  );
+  const prefixSet = /* @__PURE__ */ new Set();
+  for (const event of result.events) {
+    for (const tag of event.tags) {
+      if (tag.includes(":")) {
+        const prefix = tag.split(":")[0];
+        if (prefix) {
+          prefixSet.add(prefix);
+        }
+      }
+    }
+  }
+  return {
+    tagPrefixes: Array.from(prefixSet).sort((a, b) => a.localeCompare(b)),
+    sampleSize: result.events.length,
+    meta: {
+      from: result.meta.from,
+      to: result.meta.to
+    }
+  };
+}
 async function listEventsV1(api, params, limits) {
-  const effectiveLimit = Math.min(params.limit ?? limits.defaultLimit, limits.maxResults);
+  const effectiveLimit = params.limit ?? limits.defaultLimit;
   const defaultFrom = hoursAgo(limits.defaultTimeRangeHours);
   const defaultTo = now();
   const response = await api.listEvents({
@@ -1986,7 +2041,7 @@ async function searchEventsV2(api, params, limits, site) {
     tags: params.tags,
     priority: params.priority
   });
-  const effectiveLimit = Math.min(params.limit ?? limits.defaultLimit, limits.maxResults);
+  const effectiveLimit = params.limit ?? limits.defaultLimit;
   const body = {
     filter: {
       query: fullQuery,
@@ -2090,34 +2145,79 @@ async function aggregateEventsV2(api, params, limits, site) {
   };
 }
 async function topEventsV2(api, params, limits, site) {
+  if (params.contextTags !== void 0) {
+    if (!Array.isArray(params.contextTags)) {
+      throw new Error("contextTags must be an array");
+    }
+    if (params.contextTags.some((tag) => typeof tag !== "string" || tag.trim() === "")) {
+      throw new Error("contextTags must be an array of non-empty strings");
+    }
+  }
   const effectiveQuery = params.query ?? "source:alert";
   const effectiveTags = params.tags ?? ["source:alert"];
-  const result = await aggregateEventsV2(
+  const result = await searchEventsV2(
     api,
     {
-      ...params,
       query: effectiveQuery,
+      from: params.from,
+      to: params.to,
+      sources: params.sources,
       tags: effectiveTags,
-      groupBy: params.groupBy ?? ["monitor_name"],
-      limit: params.limit ?? 10
+      limit: params.maxEvents ?? 1e4
     },
     limits,
     site
   );
-  return {
-    top: result.buckets.map((bucket, index) => ({
-      rank: index + 1,
-      name: bucket.key,
-      monitorId: bucket.sample.monitorId,
-      alertCount: bucket.count,
-      lastAlert: bucket.sample.timestamp,
-      sample: {
-        title: bucket.sample.title,
-        source: bucket.sample.source,
-        alertType: bucket.sample.alertType
+  const monitorGroups = /* @__PURE__ */ new Map();
+  for (const event of result.events) {
+    const monitorName = event.monitorInfo?.name ?? event.title;
+    const monitorId = event.monitorId ?? 0;
+    const key = `${monitorId}|${monitorName}`;
+    let monitorGroup = monitorGroups.get(key);
+    if (!monitorGroup) {
+      monitorGroup = { name: monitorName, monitorId, events: [] };
+      monitorGroups.set(key, monitorGroup);
+    }
+    monitorGroup.events.push(event);
+  }
+  const contextPrefixes = new Set(
+    params.contextTags ?? [
+      "queue",
+      "service",
+      "ingress",
+      "pod_name",
+      "kube_namespace",
+      "kube_container_name"
+    ]
+  );
+  const monitors = Array.from(monitorGroups.values()).map((monitor) => {
+    const contextGroups = /* @__PURE__ */ new Map();
+    for (const event of monitor.events) {
+      const contextTag = findFirstContextTag(event.tags, contextPrefixes);
+      if (contextTag) {
+        contextGroups.set(contextTag, (contextGroups.get(contextTag) || 0) + 1);
       }
-    })),
-    meta: result.meta
+    }
+    return {
+      name: monitor.name,
+      monitor_id: monitor.monitorId,
+      total_count: monitor.events.length,
+      by_context: Array.from(contextGroups.entries()).map(([context, count]) => ({ context, count })).sort((a, b) => b.count - a.count)
+      // Sort by count desc
+    };
+  }).filter((monitor) => monitor.by_context.length > 0);
+  const topMonitors = monitors.sort((a, b) => b.total_count - a.total_count).slice(0, params.limit ?? 10).map((m, i) => ({ rank: i + 1, ...m }));
+  return {
+    top: topMonitors,
+    meta: {
+      query: effectiveQuery,
+      from: result.meta.from,
+      to: result.meta.to,
+      totalMonitors: monitorGroups.size,
+      totalEvents: result.events.length,
+      contextPrefixes,
+      datadog_url: result.meta.datadog_url
+    }
   };
 }
 function parseIntervalToMs(interval) {
@@ -2388,6 +2488,7 @@ async function enrichWithMonitorMetadata(events, monitorsApi) {
       if (monitor) {
         enriched.monitorMetadata = {
           id: monitor.id ?? 0,
+          name: monitor.name ?? "",
           type: String(monitor.type ?? ""),
           message: monitor.message ?? "",
           tags: monitor.tags ?? [],
@@ -2405,16 +2506,15 @@ async function enrichWithMonitorMetadata(events, monitorsApi) {
 function registerEventsTool(server, apiV1, apiV2, monitorsApi, limits, readOnly = false, site = "datadoghq.com") {
   server.tool(
     "events",
-    `Track Datadog events. Actions: list, get, create, search, aggregate, top, timeseries, incidents.
-IMPORTANT: For monitor alert history, use tags: ["source:alert"] to find all triggered monitors.
-Filters: query (text search), sources, tags, priority, time range.
-Use for: monitor alerts, deployments, incidents, change tracking.
+    `Track Datadog events. Actions: list, get, create, search, aggregate, top, timeseries, incidents, discover.
+For monitor alerts, use tags: ["source:alert"].
 
-Use action:"top" with from:"7d" to find the noisiest monitors.
-Use action:"aggregate" with groupBy:["monitor_name"] for alert counts per monitor.
-Use action:"timeseries" with interval:"1h" to see alert trends over time.
-Use action:"incidents" with dedupeWindow:"5m" to deduplicate alerts into incidents.
-Use enrich:true with search to get monitor metadata (slower).`,
+top: Returns monitors with context breakdown. Example: {name, monitor_id, total_count, by_context: [{context: "queue:X", count: 30}]}
+discover: Returns available tag prefixes from events.
+aggregate: Custom groupBy, returns pipe-delimited keys.
+search: Full event details.
+timeseries: Time-bucketed trends with interval.
+incidents: Deduplicate alerts with dedupeWindow.`,
     InputSchema6,
     async ({
       action,
@@ -2433,7 +2533,8 @@ Use enrich:true with search to get monitor metadata (slower).`,
       cursor,
       interval,
       dedupeWindow,
-      enrich
+      enrich,
+      contextTags
     }) => {
       try {
         checkReadOnly(action, readOnly);
@@ -2520,8 +2621,23 @@ Use enrich:true with search to get monitor metadata (slower).`,
                   to,
                   sources,
                   tags,
-                  groupBy,
-                  limit
+                  limit,
+                  contextTags
+                },
+                limits,
+                site
+              )
+            );
+          case "discover":
+            return toolResult(
+              await discoverTagsV2(
+                apiV2,
+                {
+                  query,
+                  from,
+                  to,
+                  sources,
+                  tags
                 },
                 limits,
                 site
@@ -2580,7 +2696,7 @@ var InputSchema7 = {
   id: z8.string().optional().describe("Incident ID (required for get/update/delete)"),
   query: z8.string().optional().describe("Search query (for search action)"),
   status: z8.enum(["active", "stable", "resolved"]).optional().describe("Filter by status (for list)"),
-  limit: z8.number().optional().describe("Maximum number of incidents to return"),
+  limit: z8.number().min(1).optional().describe("Maximum number of incidents to return (default: 50)"),
   config: z8.record(z8.unknown()).optional().describe(
     "Incident configuration (for create/update). Create requires: title. Update can modify: title, status, severity, fields."
   )
@@ -2610,7 +2726,7 @@ function formatIncident(i) {
   };
 }
 async function listIncidents(api, params, limits) {
-  const effectiveLimit = Math.min(params.limit ?? limits.maxResults, limits.maxResults);
+  const effectiveLimit = params.limit ?? limits.defaultLimit;
   const response = await api.listIncidents({
     pageSize: effectiveLimit
   });
@@ -2633,7 +2749,7 @@ async function getIncident(api, id) {
 async function searchIncidents(api, query, limits) {
   const response = await api.searchIncidents({
     query,
-    pageSize: limits.maxResults
+    pageSize: limits.defaultLimit
   });
   const incidents = (response.data?.attributes?.incidents ?? []).map(
     (i) => ({
@@ -2732,7 +2848,7 @@ var InputSchema8 = {
   ids: z9.array(z9.string()).optional().describe("Multiple SLO IDs (for list with specific IDs)"),
   query: z9.string().optional().describe("Search query (for list)"),
   tags: z9.array(z9.string()).optional().describe("Filter by tags (for list)"),
-  limit: z9.number().optional().describe("Maximum number of SLOs to return"),
+  limit: z9.number().min(1).optional().describe("Maximum number of SLOs to return (default: 50)"),
   config: z9.record(z9.unknown()).optional().describe("SLO configuration (for create/update). Must include type, name, thresholds."),
   from: z9.string().optional().describe('Start time for history (ISO 8601 or relative like "7d", "1w")'),
   to: z9.string().optional().describe("End time for history (ISO 8601 or relative, default: now)")
@@ -2759,7 +2875,7 @@ function formatSlo(s) {
   };
 }
 async function listSlos(api, params, limits) {
-  const effectiveLimit = Math.min(params.limit ?? limits.maxResults, limits.maxResults);
+  const effectiveLimit = params.limit ?? limits.defaultLimit;
   const response = await api.listSLOs({
     ids: params.ids?.join(","),
     query: params.query,
@@ -2910,7 +3026,7 @@ var InputSchema9 = {
   testType: z10.enum(["api", "browser"]).optional().describe("Test type filter (for list) or type for create"),
   locations: z10.array(z10.string()).optional().describe("Filter by locations (for list)"),
   tags: z10.array(z10.string()).optional().describe("Filter by tags (for list)"),
-  limit: z10.number().optional().describe("Maximum number of tests to return"),
+  limit: z10.number().min(1).optional().describe("Maximum number of tests to return (default: 50)"),
   config: z10.record(z10.unknown()).optional().describe(
     "Test configuration (for create/update). Includes: name, type, config, options, locations, message."
   )
@@ -2929,7 +3045,7 @@ function formatTest(t) {
   };
 }
 async function listTests(api, params, limits) {
-  const effectiveLimit = Math.min(params.limit ?? limits.maxResults, limits.maxResults);
+  const effectiveLimit = params.limit ?? limits.defaultLimit;
   const response = await api.listTests({
     pageSize: effectiveLimit
   });
@@ -3129,7 +3245,7 @@ var InputSchema10 = {
   action: ActionSchema10.describe("Action to perform"),
   filter: z11.string().optional().describe('Filter hosts by name, alias, or tag (e.g., "env:prod")'),
   from: z11.number().optional().describe("Starting offset for pagination"),
-  count: z11.number().optional().describe("Number of hosts to return"),
+  count: z11.number().min(1).optional().describe("Number of hosts to return"),
   sortField: z11.string().optional().describe('Field to sort by (e.g., "apps", "cpu", "name")'),
   sortDir: z11.enum(["asc", "desc"]).optional().describe("Sort direction"),
   hostName: z11.string().optional().describe("Host name (required for mute/unmute)"),
@@ -3158,7 +3274,7 @@ async function listHosts(api, params, limits) {
   const response = await api.listHosts({
     filter: params.filter,
     from: params.from,
-    count: Math.min(params.count ?? limits.maxResults, limits.maxResults),
+    count: params.count ?? limits.defaultLimit,
     sortField: params.sortField,
     sortDir: params.sortDir
   });
@@ -3252,7 +3368,7 @@ var InputSchema11 = {
   id: z12.string().optional().describe("Downtime ID (required for get/update/cancel)"),
   monitorId: z12.number().optional().describe("Monitor ID (required for listByMonitor)"),
   currentOnly: z12.boolean().optional().describe("Only return active downtimes (for list)"),
-  limit: z12.number().optional().describe("Maximum number of downtimes to return"),
+  limit: z12.number().min(1).optional().describe("Maximum number of downtimes to return (default: 50)"),
   config: z12.record(z12.unknown()).optional().describe("Downtime configuration (for create/update). Must include scope and schedule.")
 };
 function extractMonitorIdentifier(mi) {
@@ -3281,7 +3397,7 @@ function formatDowntime(d) {
   };
 }
 async function listDowntimes(api, params, limits) {
-  const effectiveLimit = Math.min(params.limit ?? limits.maxResults, limits.maxResults);
+  const effectiveLimit = params.limit ?? limits.defaultLimit;
   const response = await api.listDowntimes({
     currentOnly: params.currentOnly
   });
@@ -3386,9 +3502,9 @@ function formatMonitorDowntime(d) {
     end: attrs?.end ? new Date(attrs.end).toISOString() : null
   };
 }
-async function listMonitorDowntimes(api, monitorId, limits) {
+async function listMonitorDowntimes(api, monitorId, _limits) {
   const response = await api.listMonitorDowntimes({ monitorId });
-  const downtimes = (response.data ?? []).slice(0, limits.maxResults).map(formatMonitorDowntime);
+  const downtimes = (response.data ?? []).map(formatMonitorDowntime);
   return {
     downtimes,
     monitorId,
@@ -3447,7 +3563,7 @@ var InputSchema12 = {
   to: z13.string().optional().describe('End time (ISO 8601, relative like "now", or precise timestamp)'),
   type: z13.enum(["all", "view", "action", "error", "long_task", "resource"]).optional().describe("RUM event type filter"),
   sort: z13.enum(["timestamp", "-timestamp"]).optional().describe("Sort order for events"),
-  limit: z13.number().optional().describe("Maximum number of events to return"),
+  limit: z13.number().min(1).optional().describe("Maximum number of events to return (default: 50)"),
   groupBy: z13.array(z13.string()).optional().describe('Fields to group by for aggregation (e.g., ["@view.url_path", "@session.type"])'),
   compute: z13.object({
     aggregation: z13.enum(["count", "cardinality", "avg", "sum", "min", "max", "percentile"]).optional(),
@@ -3549,7 +3665,7 @@ async function searchEvents(api, params, limits, site) {
     filterFrom: new Date(fromTime * 1e3),
     filterTo: new Date(toTime * 1e3),
     sort: params.sort === "timestamp" ? "timestamp" : "-timestamp",
-    pageLimit: Math.min(params.limit ?? limits.maxResults, limits.maxResults)
+    pageLimit: params.limit ?? limits.defaultLimit
   });
   const events = (response.data ?? []).map(formatEvent);
   return {
@@ -3766,7 +3882,7 @@ async function getSessionWaterfall(api, params, limits, site) {
   const response = await api.listRUMEvents({
     filterQuery: queryParts.join(" "),
     sort: "timestamp",
-    pageLimit: Math.min(limits.maxResults, 1e3)
+    pageLimit: limits.defaultLimit
   });
   const events = (response.data ?? []).map(formatWaterfallEvent);
   const summary = {
@@ -3852,7 +3968,7 @@ var InputSchema13 = {
   to: z14.string().optional().describe('End time (ISO 8601, relative like "now")'),
   severity: z14.enum(["info", "low", "medium", "high", "critical"]).optional().describe("Filter by severity"),
   status: z14.enum(["open", "under_review", "archived"]).optional().describe("Filter signals by status"),
-  pageSize: z14.number().optional().describe("Number of results to return"),
+  pageSize: z14.number().min(1).optional().describe("Number of results to return"),
   pageCursor: z14.string().optional().describe("Cursor for pagination")
 };
 function formatRule(rule) {
@@ -3894,7 +4010,7 @@ function formatSignal(signal) {
 }
 async function listRules(api, params, limits) {
   const response = await api.listSecurityMonitoringRules({
-    pageSize: Math.min(params.pageSize ?? limits.maxResults, limits.maxResults),
+    pageSize: params.pageSize ?? limits.defaultLimit,
     pageNumber: 0
   });
   const rules = (response.data ?? []).map(formatRule);
@@ -3931,7 +4047,7 @@ async function searchSignals(api, params, limits) {
         to: new Date(toTime * 1e3)
       },
       page: {
-        limit: Math.min(params.pageSize ?? limits.maxResults, limits.maxResults),
+        limit: params.pageSize ?? limits.defaultLimit,
         cursor: params.pageCursor
       },
       sort: "timestamp"
@@ -3960,7 +4076,7 @@ async function listFindings(api, params, limits) {
         to: /* @__PURE__ */ new Date()
       },
       page: {
-        limit: Math.min(params.pageSize ?? limits.maxResults, limits.maxResults),
+        limit: params.pageSize ?? limits.defaultLimit,
         cursor: params.pageCursor
       }
     }
@@ -4037,7 +4153,7 @@ var InputSchema14 = {
     end: z15.number().optional()
   }).optional().describe("Time configuration for notebook"),
   status: z15.enum(["published"]).optional().describe("Notebook status"),
-  pageSize: z15.number().optional().describe("Number of notebooks to return"),
+  pageSize: z15.number().min(1).optional().describe("Number of notebooks to return"),
   pageNumber: z15.number().optional().describe("Page number for pagination")
 };
 function formatNotebookSummary(nb) {
@@ -4092,8 +4208,8 @@ async function listNotebooks(api, params, limits) {
     authorHandle: params.authorHandle,
     excludeAuthorHandle: params.excludeAuthorHandle,
     includeCells: params.includeCells ?? false,
-    count: Math.min(params.pageSize ?? limits.maxResults, limits.maxResults),
-    start: (params.pageNumber ?? 0) * (params.pageSize ?? limits.maxResults)
+    count: params.pageSize ?? limits.defaultLimit,
+    start: (params.pageNumber ?? 0) * (params.pageSize ?? limits.defaultLimit)
   });
   const notebooks = (response.data ?? []).map(formatNotebookSummary);
   return {
@@ -4310,7 +4426,7 @@ var InputSchema15 = {
   id: z16.string().optional().describe("User ID (required for get action)"),
   filter: z16.string().optional().describe("Filter users by name or email"),
   status: z16.enum(["Active", "Pending", "Disabled"]).optional().describe("Filter by user status"),
-  pageSize: z16.number().optional().describe("Number of users to return per page"),
+  pageSize: z16.number().min(1).optional().describe("Number of users to return per page"),
   pageNumber: z16.number().optional().describe("Page number for pagination")
 };
 function formatUser(user) {
@@ -4338,7 +4454,7 @@ async function listUsers(api, params, limits) {
   const response = await api.listUsers({
     filter: params.filter,
     filterStatus: params.status,
-    pageSize: Math.min(params.pageSize ?? limits.maxResults, limits.maxResults),
+    pageSize: params.pageSize ?? limits.defaultLimit,
     pageNumber: params.pageNumber ?? 0
   });
   const users = (response.data ?? []).map(formatUser);
@@ -4392,7 +4508,7 @@ var InputSchema16 = {
   action: ActionSchema16.describe("Action to perform"),
   id: z17.string().optional().describe("Team ID (required for get/members actions)"),
   filter: z17.string().optional().describe("Filter teams by name"),
-  pageSize: z17.number().optional().describe("Number of teams to return per page"),
+  pageSize: z17.number().min(1).optional().describe("Number of teams to return per page"),
   pageNumber: z17.number().optional().describe("Page number for pagination")
 };
 function formatTeam(team) {
@@ -4426,7 +4542,7 @@ function formatTeamMember(member) {
 async function listTeams(api, params, limits) {
   const response = await api.listTeams({
     filterKeyword: params.filter,
-    pageSize: Math.min(params.pageSize ?? limits.maxResults, limits.maxResults),
+    pageSize: params.pageSize ?? limits.defaultLimit,
     pageNumber: params.pageNumber ?? 0
   });
   const teams = (response.data ?? []).map(formatTeam);
@@ -4449,7 +4565,7 @@ async function getTeam(api, teamId) {
 async function getTeamMembers(api, teamId, limits) {
   const response = await api.getTeamMemberships({
     teamId,
-    pageSize: limits.maxResults
+    pageSize: limits.defaultLimit
   });
   const members = (response.data ?? []).map(formatTeamMember);
   return {