drupal-mcp-connector 2.19.0 → 2.20.0

package/.agents/commands/drupal-config-set.md

@@ -1,11 +1,11 @@
 ---
-description: "Set a Drupal configuration value via the governed server-side config tool. Audited and gated server-side; requires the config-editor (Developer) tier. Then export to YAML for a PR."
+description: "Set a Drupal configuration value via the governed server-side config tool. Audited and gated server-side; requires the config-editor (Developer) tier. Then export to YAML for a PR. Refused for `core.extension`, which lists installed modules and themes: use drupal_drush_module_enable or drupal_drush_module_disable instead. Only an operator can allow it, with `allowCoreExtensionChange` in site config (see drupal_security_info), and a value that removes a protected module is still refused."
 argument-hint: "<name> <value> [site]"
 ---
 
 Call the MCP tool `drupal_config_set`.
 
-Set a Drupal configuration value via the governed server-side config tool. Audited and gated server-side; requires the config-editor (Developer) tier. Then export to YAML for a PR.
+Set a Drupal configuration value via the governed server-side config tool. Audited and gated server-side; requires the config-editor (Developer) tier. Then export to YAML for a PR. Refused for `core.extension`, which lists installed modules and themes: use drupal_drush_module_enable or drupal_drush_module_disable instead. Only an operator can allow it, with `allowCoreExtensionChange` in site config (see drupal_security_info), and a value that removes a protected module is still refused.
 
 Parse the arguments supplied with this command into this tool's parameters:
 

package/.agents/commands/drupal-create-node.md

@@ -22,7 +22,7 @@ Parse the arguments supplied with this command into this tool's parameters:
 - `moderationState` (string): Moderation state for content_moderation types, e.g. 'draft' or 'published'. Takes precedence over status.
 - `fields` (object (pass as JSON)): Scalar/attribute field values keyed by Drupal machine name. Formatted text: a string or { value, format?, summary? }. format must be in the field's allowed_formats; a single allowed format is used when omitted. Do NOT put entity-reference fields here — Drupal rejects them as attributes; use `relationships`.
 - `relationships` (object (pass as JSON)): Entity-reference fields as JSON:API relationships, keyed by field machine name. Single-value: { field_resource_type: { data: { type: 'taxonomy_term--resource_type', id: '<uuid>' } } }. Multi-value: { field_tags: { data: [{ type: 'taxonomy_term--tags', id: '<uuid>' }] } }.
-- `dryRun` (boolean (true/false)): Validate and return a preview of the write without committing.
-- `returning` (string): Response verbosity. "full" (default) returns the complete saved entity; "minimal" returns just identity + state (id, type, bundle, title, status, changed, url) — much smaller, recommended for bulk writes where the echoed body would dominate the response.
+- `dryRun` (boolean (true/false)): Return a preview of the payload without committing. Drupal does not evaluate the write: entity access, field access and entity validation are NOT checked, so the real create can still fail with a 403 or a validation 422. The result's `checks` block and `caveat` say what was and was not checked.
+- `returning` (one of: full, minimal): Response verbosity. "full" (default) returns the complete saved entity; "minimal" returns just identity + state (id, type, bundle, title, status, changed, url) — much smaller, recommended for bulk writes where the echoed body would dominate the response.
 
 If a required parameter is missing, ask before calling — do not invent values. Coerce each value to its JSON type (booleans → true/false, numbers → numeric, object/array → parse JSON), then make the single tool call and summarize the result.

package/.agents/commands/drupal-create-translation.md

@@ -20,6 +20,6 @@ Parse the arguments supplied with this command into this tool's parameters:
 - `attributes` (object (pass as JSON)): Translated field values keyed by Drupal machine name
 - `relationships` (object (pass as JSON)): JSON:API relationships. Use for image alt (same file UUID, meta.alt).
 - `revisionId` (string): Paragraph revision id the host already pins. Required for Home-shaped non-default pins.
-- `dryRun` (boolean (true/false)): Validate without saving
+- `dryRun` (boolean (true/false)): Validate without saving. Sentinel's non-saving translation preflight receives the real fields, applies them through field access and validates the entity. The result's `checks` block says what was checked.
 
 If a required parameter is missing, ask before calling — do not invent values. Coerce each value to its JSON type (booleans → true/false, numbers → numeric, object/array → parse JSON), then make the single tool call and summarize the result.

package/.agents/commands/drupal-delete-node.md

@@ -17,6 +17,6 @@ Parse the arguments supplied with this command into this tool's parameters:
 
 **Optional:**
 - `site` (string): Named site from connector config. Omit only on reads: multi-site configs fall back to defaultSite (often local/dev, not production). Writes require an explicit site when more than one site is configured. Every response includes `_target` { name, baseUrl, source } (`hint` when you passed site, `default` when you did not).
-- `dryRun` (boolean (true/false)): Validate and return a preview of the delete without committing.
+- `dryRun` (boolean (true/false)): Return a preview of the delete without committing. Drupal does not evaluate the delete: Drupal's delete access for the entity is NOT checked, only the connector's own policy. The result's `checks` block says so.
 
 If a required parameter is missing, ask before calling — do not invent values. Coerce each value to its JSON type (booleans → true/false, numbers → numeric, object/array → parse JSON), then make the single tool call and summarize the result.

package/.agents/commands/drupal-describe-fields.md

@@ -1,11 +1,11 @@
 ---
-description: "Introspect the fields of a Drupal entity type + bundle: returns a per-field list of { name, type, kind, cardinality?, translatable?, approximate }. Read-only. Built on schema SAMPLING (an existing entity), so results are approximate — only populated fields are visible and required/cardinality/allowedValues are inferred from value shape. When JSON:API field_config is readable, translatable is copied from Field API; omitted means unknown, not false. Authoritative field metadata comes from the Drush bridge (Field API). Use this before creating/updating entities to learn field names."
+description: "Introspect the fields of a Drupal entity type + bundle: returns a per-field list of { name, type, kind, cardinality?, translatable?, approximate }. Read-only. Built on schema SAMPLING (an existing entity), so results are approximate — only populated fields are visible and required/cardinality/allowedValues are inferred from value shape. When JSON:API field_config is readable, translatable is copied from Field API; omitted means unknown, not false. A field this account may not view is left out of the JSON:API resource, so it is NOT in `fields` and looks like a field that does not exist. When field_config is readable (`fieldDefinitions: 'available'`), fields defined for the bundle but absent from the sampled entity are listed apart as `notVisible`; when it is not, denied fields cannot be detected. Absent is not empty. Authoritative field metadata comes from the Drush bridge (Field API). Use this before creating/updating entities to learn field names."
 argument-hint: "<site> [type] [entityType] [bundle]"
 ---
 
 Call the MCP tool `drupal_describe_fields`.
 
-Introspect the fields of a Drupal entity type + bundle: returns a per-field list of { name, type, kind, cardinality?, translatable?, approximate }. Read-only. Built on schema SAMPLING (an existing entity), so results are approximate — only populated fields are visible and required/cardinality/allowedValues are inferred from value shape. When JSON:API field_config is readable, translatable is copied from Field API; omitted means unknown, not false. Authoritative field metadata comes from the Drush bridge (Field API). Use this before creating/updating entities to learn field names.
+Introspect the fields of a Drupal entity type + bundle: returns a per-field list of { name, type, kind, cardinality?, translatable?, approximate }. Read-only. Built on schema SAMPLING (an existing entity), so results are approximate — only populated fields are visible and required/cardinality/allowedValues are inferred from value shape. When JSON:API field_config is readable, translatable is copied from Field API; omitted means unknown, not false. A field this account may not view is left out of the JSON:API resource, so it is NOT in `fields` and looks like a field that does not exist. When field_config is readable (`fieldDefinitions: 'available'`), fields defined for the bundle but absent from the sampled entity are listed apart as `notVisible`; when it is not, denied fields cannot be detected. Absent is not empty. Authoritative field metadata comes from the Drush bridge (Field API). Use this before creating/updating entities to learn field names.
 
 Parse the arguments supplied with this command into this tool's parameters:
 

package/.agents/commands/drupal-drush-config-import.md

@@ -1,11 +1,11 @@
 ---
-description: "Import configuration from the sync directory into the database. Requires write access. Confirm with user before running on production."
+description: "Import configuration from the sync directory into the database. Requires write access. Confirm with user before running on production. Reads `drush config:status` first and refuses the import when `core.extension` differs, because such an import installs and uninstalls modules and can remove a protected one; nothing is imported, and the status read must be allowed in `drushSsh.allowedCommands`. Use drupal_drush_module_enable or drupal_drush_module_disable for a module change. Only an operator can allow it, with `allowCoreExtensionChange` in site config (see drupal_security_info)."
 argument-hint: "[site]"
 ---
 
 Call the MCP tool `drupal_drush_config_import`.
 
-Import configuration from the sync directory into the database. Requires write access. Confirm with user before running on production.
+Import configuration from the sync directory into the database. Requires write access. Confirm with user before running on production. Reads `drush config:status` first and refuses the import when `core.extension` differs, because such an import installs and uninstalls modules and can remove a protected one; nothing is imported, and the status read must be allowed in `drushSsh.allowedCommands`. Use drupal_drush_module_enable or drupal_drush_module_disable for a module change. Only an operator can allow it, with `allowCoreExtensionChange` in site config (see drupal_security_info).
 
 Parse the arguments supplied with this command into this tool's parameters:
 

package/.agents/commands/drupal-drush-module-disable.md

@@ -1,11 +1,11 @@
 ---
-description: "Uninstall a Drupal module. Irreversible for module-stored data. Confirm with user."
+description: "Uninstall a Drupal module. Irreversible for module-stored data. Confirm with user. Refused for a protected module: governance, integrity, secrets, auth and API modules such as mcp_sentinel, audit_chain, key, simple_oauth and jsonapi (see `protectedModules` in drupal_security_info). Only an operator can change that list, in site config. Also refused when the uninstall would cascade to dependents: nothing is uninstalled, the dependents are named, and each must be uninstalled by name first."
 argument-hint: "<moduleName> [site]"
 ---
 
 Call the MCP tool `drupal_drush_module_disable`.
 
-Uninstall a Drupal module. Irreversible for module-stored data. Confirm with user.
+Uninstall a Drupal module. Irreversible for module-stored data. Confirm with user. Refused for a protected module: governance, integrity, secrets, auth and API modules such as mcp_sentinel, audit_chain, key, simple_oauth and jsonapi (see `protectedModules` in drupal_security_info). Only an operator can change that list, in site config. Also refused when the uninstall would cascade to dependents: nothing is uninstalled, the dependents are named, and each must be uninstalled by name first.
 
 > ⚠ **Destructive** — this permanently changes or deletes data. Confirm with the user before calling.
 

package/.agents/commands/drupal-drush-module-list.md

@@ -11,6 +11,6 @@ Parse the arguments supplied with this command into this tool's parameters:
 
 **Optional:**
 - `site` (string): Named site from connector config. Omit only on reads: multi-site configs fall back to defaultSite (often local/dev, not production). Writes require an explicit site when more than one site is configured. Every response includes `_target` { name, baseUrl, source } (`hint` when you passed site, `default` when you did not).
-- `status` (string)
+- `status` (one of: enabled, disabled)
 
 If a required parameter is missing, ask before calling — do not invent values. Coerce each value to its JSON type (booleans → true/false, numbers → numeric, object/array → parse JSON), then make the single tool call and summarize the result.

package/.agents/commands/drupal-drush-user-list.md

@@ -11,7 +11,7 @@ Parse the arguments supplied with this command into this tool's parameters:
 
 **Optional:**
 - `site` (string): Named site from connector config. Omit only on reads: multi-site configs fall back to defaultSite (often local/dev, not production). Writes require an explicit site when more than one site is configured. Every response includes `_target` { name, baseUrl, source } (`hint` when you passed site, `default` when you did not).
-- `status` (string)
+- `status` (one of: active, blocked)
 - `role` (string)
 - `limit` (number)
 

package/.agents/commands/drupal-drush-watchdog.md

@@ -12,7 +12,7 @@ Parse the arguments supplied with this command into this tool's parameters:
 **Optional:**
 - `site` (string): Named site from connector config. Omit only on reads: multi-site configs fall back to defaultSite (often local/dev, not production). Writes require an explicit site when more than one site is configured. Every response includes `_target` { name, baseUrl, source } (`hint` when you passed site, `default` when you did not).
 - `type` (string)
-- `severity` (string)
+- `severity` (one of: emergency, alert, critical, error, warning, notice, info, debug)
 - `limit` (number)
 
 If a required parameter is missing, ask before calling — do not invent values. Coerce each value to its JSON type (booleans → true/false, numbers → numeric, object/array → parse JSON), then make the single tool call and summarize the result.

package/.agents/commands/drupal-entity-create.md

@@ -17,7 +17,7 @@ Parse the arguments supplied with this command into this tool's parameters:
 - `site` (string): Named site from connector config. Omit only on reads: multi-site configs fall back to defaultSite (often local/dev, not production). Writes require an explicit site when more than one site is configured. Every response includes `_target` { name, baseUrl, source } (`hint` when you passed site, `default` when you did not).
 - `attributes` (object (pass as JSON)): Field values keyed by Drupal machine name
 - `relationships` (object (pass as JSON)): Relationship data keyed by field name
-- `dryRun` (boolean (true/false)): Validate and return a preview of the create without committing.
-- `returning` (string): Response verbosity. "full" (default) returns the complete saved entity; "minimal" returns just identity + state (id, type, bundle, title, status, changed, url) — much smaller, recommended for bulk writes where the echoed body would dominate the response.
+- `dryRun` (boolean (true/false)): Return a preview of the payload without committing. Drupal does not evaluate the write: entity access, field access and entity validation are NOT checked, so the real create can still fail with a 403 or a validation 422. The result's `checks` block and `caveat` say what was and was not checked.
+- `returning` (one of: full, minimal): Response verbosity. "full" (default) returns the complete saved entity; "minimal" returns just identity + state (id, type, bundle, title, status, changed, url) — much smaller, recommended for bulk writes where the echoed body would dominate the response.
 
 If a required parameter is missing, ask before calling — do not invent values. Coerce each value to its JSON type (booleans → true/false, numbers → numeric, object/array → parse JSON), then make the single tool call and summarize the result.

package/.agents/commands/drupal-entity-delete.md

@@ -18,6 +18,6 @@ Parse the arguments supplied with this command into this tool's parameters:
 
 **Optional:**
 - `site` (string): Named site from connector config. Omit only on reads: multi-site configs fall back to defaultSite (often local/dev, not production). Writes require an explicit site when more than one site is configured. Every response includes `_target` { name, baseUrl, source } (`hint` when you passed site, `default` when you did not).
-- `dryRun` (boolean (true/false)): Validate and return a preview of the delete without committing.
+- `dryRun` (boolean (true/false)): Return a preview of the delete without committing. Drupal does not evaluate the delete: Drupal's delete access for the entity is NOT checked, only the connector's own policy. The result's `checks` block says so.
 
 If a required parameter is missing, ask before calling — do not invent values. Coerce each value to its JSON type (booleans → true/false, numbers → numeric, object/array → parse JSON), then make the single tool call and summarize the result.

package/.agents/commands/drupal-entity-update.md

@@ -1,11 +1,11 @@
 ---
-description: "Update an existing entity of any Drupal entity type. Only include attributes/relationships you want to change. Published moderated targets without an explicit attributes.moderation_state default to moderation_state 'draft' (forward revision). Paragraph / ERR identifiers are resolved to include meta.target_revision_id before PATCH; the write fails if any ref cannot be resolved. On moderated targets a non-saving PATCH preflight runs first (including dryRun) against the same URL the write will hit. An addressable node draft uses Sentinel's governed draft endpoint with live/working revision preconditions (#166); a stray revision with no addressable working copy still fails with revision-surgery language (#201). Preflight does not un-orphan paragraphs already created — probe the host before creating dependents."
+description: "Update an existing entity of any Drupal entity type. Only include attributes/relationships you want to change. Published moderated targets without an explicit attributes.moderation_state default to moderation_state 'draft' (forward revision). Paragraph / ERR identifiers are resolved to include meta.target_revision_id before PATCH; the write fails if any ref cannot be resolved. On moderated targets a non-saving PATCH preflight runs first (including dryRun) against the same URL the write will hit. An addressable node draft uses Sentinel's governed draft endpoint with live/working revision preconditions (#166); a stray revision with no addressable working copy still fails with revision-surgery language (#201). Preflight does not un-orphan paragraphs already created — probe the host before creating dependents. A dryRun that returns without a refusal is not proof the write will succeed: field access and entity validation are checked only when Sentinel's draft endpoint ran, and the result's `checks` block says which checks ran."
 argument-hint: "<entityType> <bundle> <id> [site] [langcode] [attributes] [relationships] [dryRun] [returning]"
 ---
 
 Call the MCP tool `drupal_entity_update`.
 
-Update an existing entity of any Drupal entity type. Only include attributes/relationships you want to change. Published moderated targets without an explicit attributes.moderation_state default to moderation_state 'draft' (forward revision). Paragraph / ERR identifiers are resolved to include meta.target_revision_id before PATCH; the write fails if any ref cannot be resolved. On moderated targets a non-saving PATCH preflight runs first (including dryRun) against the same URL the write will hit. An addressable node draft uses Sentinel's governed draft endpoint with live/working revision preconditions (#166); a stray revision with no addressable working copy still fails with revision-surgery language (#201). Preflight does not un-orphan paragraphs already created — probe the host before creating dependents.
+Update an existing entity of any Drupal entity type. Only include attributes/relationships you want to change. Published moderated targets without an explicit attributes.moderation_state default to moderation_state 'draft' (forward revision). Paragraph / ERR identifiers are resolved to include meta.target_revision_id before PATCH; the write fails if any ref cannot be resolved. On moderated targets a non-saving PATCH preflight runs first (including dryRun) against the same URL the write will hit. An addressable node draft uses Sentinel's governed draft endpoint with live/working revision preconditions (#166); a stray revision with no addressable working copy still fails with revision-surgery language (#201). Preflight does not un-orphan paragraphs already created — probe the host before creating dependents. A dryRun that returns without a refusal is not proof the write will succeed: field access and entity validation are checked only when Sentinel's draft endpoint ran, and the result's `checks` block says which checks ran.
 
 Parse the arguments supplied with this command into this tool's parameters:
 
@@ -19,7 +19,7 @@ Parse the arguments supplied with this command into this tool's parameters:
 - `langcode` (string): Target language for an unpublished working translation (nodes). Continues that translation via Sentinel.
 - `attributes` (object (pass as JSON))
 - `relationships` (object (pass as JSON))
-- `dryRun` (boolean (true/false)): Validate, resolve ERR identifiers, and (on moderated targets) run the core PATCH-guard probe against Drupal, then return a preview without the real write. An existing node draft uses Sentinel's non-saving draft endpoint with the real payload and revision preconditions. Otherwise an id-mismatch core PATCH probes writability without saving. A published node with no distinct working copy whose changed timestamp is later than revision_timestamp (possiblyPatchBlocked) fails dryRun the same as the real write (#273). Any refusal fails the dryRun.
-- `returning` (string): Response verbosity. "full" (default) returns the complete saved entity; "minimal" returns just identity + state (id, type, bundle, title, status, changed, url) — much smaller, recommended for bulk writes where the echoed body would dominate the response.
+- `dryRun` (boolean (true/false)): Validate, resolve ERR identifiers, run the server-side preflight when one applies, and return a preview without the real write. The result's `checks` block says what was checked; `caveat` names what was not. Only an existing node draft (or a langcode translation draft) is checked with the real payload: Sentinel's non-saving draft endpoint applies the submitted fields through field access and validates the entity (`serverPreflight: sentinel_draft`). On other moderated targets an id-mismatch core PATCH with no fields checks entity update access and core's working-copy guard only; field access and entity validation are NOT checked (`core_patch_guard`), so the real write can still fail with a field-access 403 or a 422. Unmoderated targets get no server-side check at all (`none`). A published node with no distinct working copy whose changed timestamp is later than revision_timestamp (possiblyPatchBlocked) fails dryRun the same as the real write (#273). Any refusal fails the dryRun.
+- `returning` (one of: full, minimal): Response verbosity. "full" (default) returns the complete saved entity; "minimal" returns just identity + state (id, type, bundle, title, status, changed, url) — much smaller, recommended for bulk writes where the echoed body would dominate the response.
 
 If a required parameter is missing, ask before calling — do not invent values. Coerce each value to its JSON type (booleans → true/false, numbers → numeric, object/array → parse JSON), then make the single tool call and summarize the result.

package/.agents/commands/drupal-report-field-completeness.md

@@ -1,11 +1,11 @@
 ---
-description: "Score how completely optional fields are filled in for a content type. Finds nodes missing summaries, images, meta descriptions, tags, etc."
+description: "Score how completely optional fields are filled in for a content type. Finds nodes missing summaries, images, meta descriptions, tags, etc. Reads scalar and entity-reference fields; a reference with no target is empty. Sampling-bounded — flags 'approximate' when the scan hits sampleSize. An absent field is not an empty one: JSON:API leaves out a field this account may not view. A node that omits the key is counted as `absent` and stays out of completenessPercent. A field you name that is absent from every sampled node is listed in `notVisible` and not scored (it may be denied to this account, not exist on the content type, or be misspelled). Default field guesses that are absent are dropped."
 argument-hint: "<type> [site] [fields] [sampleSize]"
 ---
 
 Call the MCP tool `drupal_report_field_completeness`.
 
-Score how completely optional fields are filled in for a content type. Finds nodes missing summaries, images, meta descriptions, tags, etc.
+Score how completely optional fields are filled in for a content type. Finds nodes missing summaries, images, meta descriptions, tags, etc. Reads scalar and entity-reference fields; a reference with no target is empty. Sampling-bounded — flags 'approximate' when the scan hits sampleSize. An absent field is not an empty one: JSON:API leaves out a field this account may not view. A node that omits the key is counted as `absent` and stays out of completenessPercent. A field you name that is absent from every sampled node is listed in `notVisible` and not scored (it may be denied to this account, not exist on the content type, or be misspelled). Default field guesses that are absent are dropped.
 
 Parse the arguments supplied with this command into this tool's parameters:
 

package/.agents/commands/drupal-report-missing-field.md

@@ -1,11 +1,11 @@
 ---
-description: "Find entities of a content type where a given field is empty (e.g. a missing meta description, image, or summary). Works for scalar fields and entity-reference fields. Sampling-bounded — flags 'approximate' when the scan is capped."
+description: "Find entities of a content type where a given field is empty (e.g. a missing meta description, image, or summary). Works for scalar fields and entity-reference fields. Sampling-bounded — flags 'approximate' when the scan is capped. An absent field is not an empty one: JSON:API leaves out a field this account may not view. When the field is absent from every sampled entity the result is `notVisible: true` with no findings (the field may be denied to this account, not exist on the bundle, or be misspelled) instead of every entity counted as missing. Otherwise each finding has `reason` 'empty' (key present, no value) or 'absent' (key missing, possibly access-denied)."
 argument-hint: "<field> [site] [type] [sampleSize]"
 ---
 
 Call the MCP tool `drupal_report_missing_field`.
 
-Find entities of a content type where a given field is empty (e.g. a missing meta description, image, or summary). Works for scalar fields and entity-reference fields. Sampling-bounded — flags 'approximate' when the scan is capped.
+Find entities of a content type where a given field is empty (e.g. a missing meta description, image, or summary). Works for scalar fields and entity-reference fields. Sampling-bounded — flags 'approximate' when the scan is capped. An absent field is not an empty one: JSON:API leaves out a field this account may not view. When the field is absent from every sampled entity the result is `notVisible: true` with no findings (the field may be denied to this account, not exist on the bundle, or be misspelled) instead of every entity counted as missing. Otherwise each finding has `reason` 'empty' (key present, no value) or 'absent' (key missing, possibly access-denied).
 
 Parse the arguments supplied with this command into this tool's parameters:
 

package/.agents/commands/drupal-report-seo-meta-coverage.md

@@ -1,11 +1,11 @@
 ---
-description: "Report structured-meta (SEO) coverage for a content type: how many sampled nodes populate each meta field (metatag, meta description). Complements drupal_report_seo_audit with explicit per-field coverage."
+description: "Report structured-meta (SEO) coverage for a content type: how many sampled nodes populate each meta field (metatag, meta description). Complements drupal_report_seo_audit with explicit per-field coverage. Reads scalar and entity-reference fields. A field absent from every sampled node has `present: false` and `coverage: null` (unknown, not 0), and is listed in `notVisible` when you named it. When none of the checked fields is visible, no node is flagged and `nodesMissingAllMeta` is null: JSON:API leaves out a field this account may not view."
 argument-hint: "[site] [type] [fields] [sampleSize]"
 ---
 
 Call the MCP tool `drupal_report_seo_meta_coverage`.
 
-Report structured-meta (SEO) coverage for a content type: how many sampled nodes populate each meta field (metatag, meta description). Complements drupal_report_seo_audit with explicit per-field coverage.
+Report structured-meta (SEO) coverage for a content type: how many sampled nodes populate each meta field (metatag, meta description). Complements drupal_report_seo_audit with explicit per-field coverage. Reads scalar and entity-reference fields. A field absent from every sampled node has `present: false` and `coverage: null` (unknown, not 0), and is listed in `notVisible` when you named it. When none of the checked fields is visible, no node is flagged and `nodesMissingAllMeta` is null: JSON:API leaves out a field this account may not view.
 
 Parse the arguments supplied with this command into this tool's parameters:
 

package/.agents/commands/drupal-report-status-report.md

@@ -11,6 +11,6 @@ Parse the arguments supplied with this command into this tool's parameters:
 
 **Optional:**
 - `site` (string): Named site from connector config. Omit only on reads: multi-site configs fall back to defaultSite (often local/dev, not production). Writes require an explicit site when more than one site is configured. Every response includes `_target` { name, baseUrl, source } (`hint` when you passed site, `default` when you did not).
-- `minSeverity` (string): Lowest severity to include
+- `minSeverity` (one of: warning, error): Lowest severity to include
 
 If a required parameter is missing, ask before calling — do not invent values. Coerce each value to its JSON type (booleans → true/false, numbers → numeric, object/array → parse JSON), then make the single tool call and summarize the result.

package/.agents/commands/drupal-update-node.md

@@ -1,11 +1,11 @@
 ---
-description: "Update an existing node. Only include fields you want to change. For moderated content types, use moderationState (e.g. 'published') rather than status. When the target is published and moderated and you omit moderationState, the connector defaults the write to moderation_state 'draft' (forward revision) so live default revisions are not mutated by accident. Pass langcode to continue an unpublished working translation (Sentinel X-MCP-Draft-Langcode); this does not PATCH canonical langcode and will not create a missing translation — use drupal_create_translation first. Entity-reference fields go in `relationships`, not `fields`. Paragraph / ERR identifiers are resolved to include meta.target_revision_id before PATCH; the write fails if any ref cannot be resolved (an unresolved identifier persists as an empty field). On moderated targets a non-saving PATCH preflight runs first — including on dryRun — against the same URL the write will hit. Existing node drafts use Sentinel's governed draft endpoint with verified live/working revision preconditions; translation-only drafts are discovered through Sentinel inventory (#297). Pass explicit langcode to continue an unpublished translation. Published languages are not converted into drafts; dryRun uses the same target. workingCopy:null from drupal_list_revisions is not proof the node is writable (possiblyPatchBlocked / #201). Preflight here does not un-orphan paragraphs already created; probe the host before creating dependents."
+description: "Update an existing node. Only include fields you want to change. For moderated content types, use moderationState (e.g. 'published') rather than status. When the target is published and moderated and you omit moderationState, the connector defaults the write to moderation_state 'draft' (forward revision) so live default revisions are not mutated by accident. Pass langcode to continue an unpublished working translation (Sentinel X-MCP-Draft-Langcode); this does not PATCH canonical langcode and will not create a missing translation — use drupal_create_translation first. Entity-reference fields go in `relationships`, not `fields`. Paragraph / ERR identifiers are resolved to include meta.target_revision_id before PATCH; the write fails if any ref cannot be resolved (an unresolved identifier persists as an empty field). On moderated targets a non-saving PATCH preflight runs first — including on dryRun — against the same URL the write will hit. Existing node drafts use Sentinel's governed draft endpoint with verified live/working revision preconditions; translation-only drafts are discovered through Sentinel inventory (#297). Pass explicit langcode to continue an unpublished translation. Published languages are not converted into drafts; dryRun uses the same target. workingCopy:null from drupal_list_revisions is not proof the node is writable (possiblyPatchBlocked / #201). Preflight here does not un-orphan paragraphs already created; probe the host before creating dependents. A dryRun that returns without a refusal is not proof the write will succeed: field access and entity validation are checked only when Sentinel's draft endpoint ran, and the result's `checks` block says which checks ran."
 argument-hint: "<type> <id> [site] [title] [body] [summary] [format] [status] [moderationState] [langcode] [fields] [relationships] [dryRun] [returning]"
 ---
 
 Call the MCP tool `drupal_update_node`.
 
-Update an existing node. Only include fields you want to change. For moderated content types, use moderationState (e.g. 'published') rather than status. When the target is published and moderated and you omit moderationState, the connector defaults the write to moderation_state 'draft' (forward revision) so live default revisions are not mutated by accident. Pass langcode to continue an unpublished working translation (Sentinel X-MCP-Draft-Langcode); this does not PATCH canonical langcode and will not create a missing translation — use drupal_create_translation first. Entity-reference fields go in `relationships`, not `fields`. Paragraph / ERR identifiers are resolved to include meta.target_revision_id before PATCH; the write fails if any ref cannot be resolved (an unresolved identifier persists as an empty field). On moderated targets a non-saving PATCH preflight runs first — including on dryRun — against the same URL the write will hit. Existing node drafts use Sentinel's governed draft endpoint with verified live/working revision preconditions; translation-only drafts are discovered through Sentinel inventory (#297). Pass explicit langcode to continue an unpublished translation. Published languages are not converted into drafts; dryRun uses the same target. workingCopy:null from drupal_list_revisions is not proof the node is writable (possiblyPatchBlocked / #201). Preflight here does not un-orphan paragraphs already created; probe the host before creating dependents.
+Update an existing node. Only include fields you want to change. For moderated content types, use moderationState (e.g. 'published') rather than status. When the target is published and moderated and you omit moderationState, the connector defaults the write to moderation_state 'draft' (forward revision) so live default revisions are not mutated by accident. Pass langcode to continue an unpublished working translation (Sentinel X-MCP-Draft-Langcode); this does not PATCH canonical langcode and will not create a missing translation — use drupal_create_translation first. Entity-reference fields go in `relationships`, not `fields`. Paragraph / ERR identifiers are resolved to include meta.target_revision_id before PATCH; the write fails if any ref cannot be resolved (an unresolved identifier persists as an empty field). On moderated targets a non-saving PATCH preflight runs first — including on dryRun — against the same URL the write will hit. Existing node drafts use Sentinel's governed draft endpoint with verified live/working revision preconditions; translation-only drafts are discovered through Sentinel inventory (#297). Pass explicit langcode to continue an unpublished translation. Published languages are not converted into drafts; dryRun uses the same target. workingCopy:null from drupal_list_revisions is not proof the node is writable (possiblyPatchBlocked / #201). Preflight here does not un-orphan paragraphs already created; probe the host before creating dependents. A dryRun that returns without a refusal is not proof the write will succeed: field access and entity validation are checked only when Sentinel's draft endpoint ran, and the result's `checks` block says which checks ran.
 
 Parse the arguments supplied with this command into this tool's parameters:
 
@@ -24,7 +24,7 @@ Parse the arguments supplied with this command into this tool's parameters:
 - `langcode` (string): Target language for an unpublished working translation (e.g. 'es'). Continues that translation via Sentinel; does not create a missing translation and does not PATCH canonical langcode.
 - `fields` (object (pass as JSON)): Scalar/attribute field values keyed by machine name. Formatted text: a string or { value, format?, summary? }. format must be in the field's allowed_formats; a single allowed format is used when omitted. Entity-reference fields go in `relationships`, not here.
 - `relationships` (object (pass as JSON)): Entity-reference fields as JSON:API relationships, keyed by field machine name. Single-value uses { data: { type, id } }; multi-value uses { data: [{ type, id }, …] }. Paragraph / ERR items must carry meta.target_revision_id — the connector injects it when missing, and fails the write if it cannot. Image alt on a translation uses the existing file UUID plus meta.alt; replacing the file is refused.
-- `dryRun` (boolean (true/false)): Validate, resolve ERR identifiers, and (on moderated targets) run the core PATCH-guard probe against Drupal, then return a preview without the real write. An existing node draft uses Sentinel's non-saving draft endpoint with the real payload and revision preconditions. Otherwise an id-mismatch core PATCH probes writability without saving. A published node with no distinct working copy whose changed timestamp is later than revision_timestamp (possiblyPatchBlocked) fails dryRun the same as the real write (#273). Any refusal fails the dryRun.
-- `returning` (string): Response verbosity. "full" (default) returns the complete saved entity; "minimal" returns just identity + state (id, type, bundle, title, status, changed, url) — much smaller, recommended for bulk writes where the echoed body would dominate the response.
+- `dryRun` (boolean (true/false)): Validate, resolve ERR identifiers, run the server-side preflight when one applies, and return a preview without the real write. The result's `checks` block says what was checked; `caveat` names what was not. Only an existing node draft (or a langcode translation draft) is checked with the real payload: Sentinel's non-saving draft endpoint applies the submitted fields through field access and validates the entity (`serverPreflight: sentinel_draft`). On other moderated targets an id-mismatch core PATCH with no fields checks entity update access and core's working-copy guard only; field access and entity validation are NOT checked (`core_patch_guard`), so the real write can still fail with a field-access 403 or a 422. Unmoderated targets get no server-side check at all (`none`). A published node with no distinct working copy whose changed timestamp is later than revision_timestamp (possiblyPatchBlocked) fails dryRun the same as the real write (#273). Any refusal fails the dryRun.
+- `returning` (one of: full, minimal): Response verbosity. "full" (default) returns the complete saved entity; "minimal" returns just identity + state (id, type, bundle, title, status, changed, url) — much smaller, recommended for bulk writes where the echoed body would dominate the response.
 
 If a required parameter is missing, ask before calling — do not invent values. Coerce each value to its JSON type (booleans → true/false, numbers → numeric, object/array → parse JSON), then make the single tool call and summarize the result.

package/CHANGELOG.md

@@ -7,6 +7,257 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.20.0] - 2026-09-19
+
+### Added
+- **Prompts for module-owned tools (#332).** Every module tool that discovery
+  returns for a request also gets a per-tool prompt
+  (`drupal-module-<operation>-<namespace>--<alias>`). Visibility follows the
+  tool: same caller scope, site grant and source checks, no cross-request
+  cache. The prompt lists the module's own parameters and explains the
+  `{ catalogRevision, arguments }` call shape without embedding a revision.
+  Write prompts say that module writes are not retried; delete prompts carry
+  the destructive warning.
+- **Opt-in slash stubs for module-owned tools (#332).**
+  `npm run install:commands -- --modules` discovers the module tools your local
+  config approves and writes `drupal-<namespace>-<alias>.md` stubs next to the
+  built-in ones (and adds them to the Codex catalog). A name that matches a
+  built-in command, or that two module tools share, is refused. If a source
+  returns nothing the run fails and writes nothing; if it returns only some
+  configured tools, the missing ones are named and older stubs are kept. A
+  plain `install:commands` never writes module stubs and leaves installed ones
+  in place.
+- **Example config documents module tools and bindings (#348).**
+  `config/config.example.json` now has a `_server_tools.example` block with
+  `serverTools.modules` (a namespace, two module-owned tools) and all seven
+  `serverTools.bindings`, plus notes on each key. The `drushSsh` SQL note names
+  the `sqlQuery` binding. A test runs the example through the module registry's
+  validation.
+
+### Changed
+- Prompts and command stubs show a parameter's allowed values when its schema
+  has a short string `enum` (`one of: full, minimal`). Eight built-in stubs
+  under `.agents/commands/` were regenerated.
+- **`drupal_drush_module_disable` refuses protected modules (#346).** The tool
+  no longer uninstalls governance, integrity, secrets, auth and API modules
+  (`mcp_sentinel`, `audit_chain`, `field_guard`, `file_gate`, `key`, `encrypt`,
+  `simple_oauth`, `consumers`, `jsonapi`, `serialization`, `mcp_server`,
+  `mcp_server_tool_bridge`, `tool`, `content_moderation`, `workflows`). The list
+  is on for every preset. `security.protectedModules` adds modules;
+  `security.allowProtectedModuleUninstall` is the explicit opt-out. A malformed
+  value in either key blocks every uninstall. The bridge now answers the
+  `pm:uninstall` cascade prompt "no": an uninstall that would also remove
+  dependents is refused and names them. The handler also checks
+  `allowDestructive` itself. `drupal_security_info` shows the effective list.
+  One stub under `.agents/commands/` was regenerated.
+- **`core.extension` can no longer be changed through config tools by default (#349).**
+  The protected-module list covered `drupal_drush_module_disable` only. Two
+  other tools could still uninstall a module. `drupal_config_set` now refuses a
+  write to `core.extension` and names `drupal_drush_module_enable` and
+  `drupal_drush_module_disable`; the name check ignores surrounding space and
+  case, and covers the binding path and the unbound path.
+  `drupal_drush_config_import` now runs `drush config:status` first and imports
+  nothing when `core.extension` differs, or when the status cannot be read or
+  understood. The connector cannot read the sync directory, so it refuses on
+  "core.extension differs" and does not name the modules. **Operators:** if
+  `drushSsh.allowedCommands` is set and lists `config:import`, add
+  `config:status`, or every import is refused. An import that leaves
+  `core.extension` alone, and `drupal_config_set` on any other object, work as
+  before. New per-site key `security.allowCoreExtensionChange` (`true` or
+  `false`, default `false` on every preset) opens both; any other value keeps
+  both refused. With it set, `drupal_config_set` still reads the current module
+  list and refuses a value that removes or alters an installed protected module,
+  and `drupal_drush_config_import` runs unchecked. `drupal_security_info` shows
+  the key. `docs/security.md` lists what stays out of the connector's reach (an
+  import run on the server, another client, the window between the status read
+  and the import) and points to MCP Sentinel's `denied_config_types` as the
+  source-side control. Two stubs under `.agents/commands/` were regenerated.
+
+### Fixed
+- **Server-tool bridge errors no longer relay the response body or raw tool
+  text (#362).** `src/lib/server-tools.js` put four untrusted strings into its
+  errors with no cleaning and no bound: the body of a non-2xx `tools/call` or
+  `tools/list`, the body of a failed session handshake, a JSON-RPC
+  `error.message`, and the text of a tool result with `isError`. An HTML error
+  page, a server path or a backtrace reached the MCP client through the config
+  tools, the Drush-bound tools and the verifier's evidence. They now go through
+  `describeErrorBody()` and `cleanErrorText()`, as the JSON:API, GraphQL and
+  upload paths do. The prefix, the HTTP status and an integer JSON-RPC code are
+  unchanged (`Server-tool call <tool> failed <status>: …`,
+  `Server-tool <tool> error (<code>): …`,
+  `Server-tool <tool> reported an error: …`), so the verifier still classifies
+  them. A JSON-RPC error sent with a 4xx or 5xx reads
+  `failed <status>: JSON-RPC error <code>: <message>`. An empty body reads
+  `the server returned an empty body`. A JSON-RPC code that is not an integer
+  is no longer printed, and `error.data` is never read. A governed refusal's
+  text stays readable. Source budget codes are still looked for in the whole
+  text before it is cut.
+- **A module tool's failure is cleaned before it is relayed (#362).** The
+  module registry relays a failed result (`isError`, or `success: false`)
+  because the module's message is what the caller needs. It now goes through
+  the new `cleanErrorData()`: the shape, keys, codes, numbers and booleans
+  stay, every string is cleaned like any other error detail, and the payload
+  is bounded (400 characters a string, 4,000 in total, 50 entries a level, 6
+  levels). A successful result is not changed. A transport failure behind the
+  registry was already replaced by a fixed message and still is.
+- **The verifier reads the HTTP status from the response, not from its body
+  (#361).** `classifyBridgeError()` found the status of a failed bridge call
+  with a pattern that also matched the response body, so a 500 whose body held
+  "failed 403:" scored as a refusal and the config probe passed although the
+  tool never ran. The words "reported an error" and a quoted JSON-RPC code in a
+  body had the same effect. The bridge client now sets `status` on the error
+  for a non-2xx response, as `drupalFetch` does, and marks what failed
+  (`bridgeFailure`: `session`, `http`, `rpc` or `tool`, plus `rpcCode`). The
+  verifier reads those properties through `httpStatusOf()`. An error with no
+  marker is read only from the start of a documented message. A 401 or 403
+  from the token endpoint or the session handshake is no longer a refusal: no
+  tool was reached. A JSON-RPC error with no integer code is `skipped`.
+- **A server failure no longer passes `probe_mass_read` or `principal_auth`
+  (#361).** Any failed mass read passed, including a 5xx, a 404 and a request
+  that never answered. The probe now passes on 401, 403 or 429, or on another
+  4xx (not 404) that carries the source's refusal code; anything else is
+  `skipped`. `principal_auth` is `skipped` when the anonymous request fails
+  with a 5xx or no answer, instead of counting that as "anonymous access is
+  refused".
+- **Error details keep the URL paths the caller supplied (#357).** The error
+  cleaning added for #343 and #345 replaced every slash-led path of two or more
+  segments with `[path]`, so "The alias /about/team is already in use" arrived
+  as "The alias [path] is already in use". A path is now redacted only when it
+  looks like a filesystem path: it starts with a filesystem root (`/var`,
+  `/tmp`, `/home`, …), has a segment that marks a code tree or a file directory
+  (`vendor`, `modules`, `core`, `files`, …), or has a server-side file extension
+  (`.php`, `.yml`, `.log`, …). `/about/team`, `/node/12/edit` and
+  `/jsonapi/node/article/<id>` are kept. Windows drive and UNC paths,
+  `file://` and `phar://` URIs, and a filesystem path straight after a colon
+  (`include_path=.:/usr/share/php`) were not redacted before and now are.
+  Stream-wrapper redaction is unchanged. `docs/security.md` lists the rules and
+  their limits.
+- **`dryRun` says what it checked (#336).** A preview could return without a
+  refusal and the real write then failed with a field-access 403. The core PATCH
+  probe sends no fields, and core rejects its id before it checks field access
+  or validation. Drupal never evaluated an unmoderated update, a create or a
+  delete preview. Every `dryRun` result on `drupal_create_node`, `drupal_update_node`,
+  `drupal_delete_node`, `drupal_entity_create`, `drupal_entity_update`,
+  `drupal_entity_delete` and `drupal_create_translation` now carries a `checks`
+  block (`serverPreflight`, `connectorPolicy`, `entityAccess`, `revisionGuard`,
+  `fieldAccess`, `entityValidation`, each `checked` or `not_checked`) and a
+  `caveat` when anything was not checked. `fieldAccess` and `entityValidation`
+  are `checked` only when Sentinel's non-saving draft endpoint evaluated the
+  real payload. No new probe was added, and existing preview fields are
+  unchanged. Tool descriptions, `docs/tools-reference.md` and the README state
+  the limit. Seven stubs under `.agents/commands/` were regenerated. The
+  internal `preflightPatchWritable` result drops `writable: true` for
+  `revisionGuardPassed` and `payloadEvaluated: false`.
+- **Config tools call the wire name the source advertises (#335).** Without
+  `serverTools.bindings`, `drupal_config_get` / `_list` / `_set` and the config
+  reports called `tool_api.mcp_sentinel_config_*`. Current `mcp_server`
+  releases publish `tool_api__mcp_sentinel_config_*`. The connector now reads
+  the source's `tools/list` and uses the name it lists, accepting either form
+  and preferring the double underscore. If the source lists neither, the call
+  fails with "not advertised by the source" and nothing is sent. The
+  `SERVER_TOOLS` export in `src/lib/server-tools.js` is replaced by
+  `SERVER_TOOL_IDS` and `resolveServerToolName`. The bindings path is unchanged.
+- **The verifier's config probe can no longer pass on a missing tool (#335).**
+  `probe_config_change` and `entitlement_filtering` read the source catalog
+  first and score a refusal only for a tool the catalog lists. A tool that is
+  not advertised, or a catalog that cannot be read, is `skipped` with the
+  reason, and the run is not ok. A served write still fails the probe whether
+  or not the tool was advertised. `verifyLive` takes a new `listTools`
+  dependency; without it the probe cannot pass. This applies to a configured
+  `configSet` binding too.
+- **A field the account may not view is no longer reported as empty (#337).**
+  JSON:API leaves a view-denied field out of the resource and keeps the key of
+  an empty one. `drupal_report_missing_field` counted every entity as missing a
+  field it could not see. When the field is absent from every sampled entity
+  the report now returns `notVisible: true`, `totalMissing: null` and no
+  findings, and says the field may be denied, not on the bundle, or misspelled.
+  When only some entities omit it, each finding carries `reason` (`empty` or
+  `absent`) and the result adds `totalEmpty` and `totalAbsent`.
+  `drupal_describe_fields` reports `fieldDefinitions` (`available` or
+  `unavailable`) and, when `field_config` is readable, lists fields defined for
+  the bundle but absent from the sampled entity as `notVisible`. No request was
+  added per entity. Tool descriptions and `docs/tools-reference.md` state the
+  limit. Two stubs under `.agents/commands/` were regenerated.
+- **Northbound Drupal HTTP timeouts.** JSON:API, GraphQL, and file-upload
+  `node-fetch` calls abort after 30s (`AbortSignal.timeout`), matching the
+  Drush SSH bound. A hung Drupal host no longer stalls the MCP process.
+- **Upload failures no longer return the raw response body (#343).**
+  `drupal_upload_file` and `drupal_upload_file_and_create_media` threw
+  `File upload failed <status>: <body>`. The error now keeps the status and
+  surfaces Drupal's `errors[].detail` (or `title`, or a plain `message`), with
+  markup and control characters stripped, server paths and stream-wrapper URIs
+  redacted, and a 400-character bound. An HTML page or a JSON body with no
+  error detail is never shown. New helper: `src/lib/error-body.js`.
+- **JSON:API and GraphQL failures no longer return the raw response body (#345).**
+  `drupalFetch()` fell back to the whole body when it was not a JSON:API error
+  document, and `drupalGraphqlFetch()` always sent the whole body, so an HTML
+  error page from Drupal, PHP or a proxy reached the MCP client. Both now use
+  `describeErrorBody()`, like uploads since #343. The messages keep their
+  shape, `Drupal <status> on <method> <path>: <detail>` and
+  `GraphQL request failed <status>: <detail>`, and keep `errors[].detail` and
+  GraphQL `errors[].message`. The detail has markup and control characters
+  stripped, server paths and stream-wrapper URIs redacted and any backtrace
+  removed. One detail is cut to 400 characters and a list of details to 1,200.
+  Each detail is cleaned on its own, so a backtrace in one error does not
+  remove the next. An OAuth error document surfaces `error` and
+  `error_description`, never `hint`. An empty or unreadable body reports the
+  status with `(empty response body)` or `(response body could not be read)`.
+  Path redaction was narrowed afterwards; see #357. Successful responses
+  are unchanged. Every matcher on these messages has a regression test in
+  `tests/lib/fetch-error-matchers.test.js`.
+- **GraphQL errors on a 200 response are cleaned and bounded (#356).** GraphQL
+  reports a failed query as HTTP 200 with an `errors` array, so those errors
+  skipped the cleaning added for #345. `drupal_graphql` (the thrown message and
+  the `warnings` of a partial result), `drupal_graphql_introspect`, the GraphQL
+  backend, the backend probe and the SEO audit's metatag lookup joined
+  `errors[].message` as received, with no length limit. `drupalGraphqlFetch()`
+  now replaces the array with a cleaned form before any caller reads it:
+  `message`, `path`, `locations` and the machine values `extensions.code`,
+  `category` and `classification`. `extensions.trace`, `debugMessage`, `file`,
+  `line` and any stack are dropped. A message has markup and control characters
+  stripped, paths redacted, any backtrace removed, and is cut to 400 characters.
+  At most 50 errors and 4,000 characters of message are kept, and a last entry
+  says how many were left out. Thrown messages are cut to 1,200 characters.
+  `drupal_graphql_introspect` with a `typeName` now reports the server's errors
+  for a failed lookup instead of "Type not found in schema", and the GraphQL
+  backend's schema load reports them instead of a `TypeError`. `data` is
+  unchanged.
+- **Field reports score reference fields and name fields they cannot see (#341).**
+  `drupal_report_field_completeness` skipped entity-reference fields and dropped
+  a requested field that was absent from every sampled node. It now reads
+  references, counts a node that omits the key as `absent`, lists such a
+  requested field in `notVisible`, and sets `approximate` from `sampleSize`. A
+  link value counts as populated. `drupal_report_seo_meta_coverage` follows the
+  same rules: `coverage: null` for an absent field, and no node flagged when no
+  checked field is visible. Two stubs under `.agents/commands/` were regenerated.
+- **A status number in an error's text is no longer read as the response status (#355).**
+  `drupal_report_orphaned_references` reported a reference as an orphan when the
+  lookup failed with a 500 whose detail mentioned "404". Four other matchers had
+  the same fault. A 404 on `/jsonapi/node/article/401` read as an authentication
+  failure and cleared the cached OAuth token. A failed PATCH probe whose detail
+  mentioned "Drupal 422" read as a passed working-copy check. A 403 or 500 that
+  mentioned "422" and "inaccessible" triggered the menu-link retry. A 500 on a
+  Sentinel draft or translation endpoint whose detail mentioned "Drupal 404" was
+  reported as a missing endpoint. Errors thrown by `drupalFetch()`,
+  `drupalGraphqlFetch()` and the upload helper now carry the HTTP status on a
+  `status` property, and all five matchers read it through `httpStatusOf()`
+  (`src/lib/error-status.js`). An error with no `status` is read only from the
+  status token at the start of a documented message (`Drupal <status> …`,
+  `GraphQL request failed <status>`, `File upload failed <status>`). The orphan
+  report no longer treats a bare "404" elsewhere in a message as a missing
+  target; such a failure counts as unverifiable.
+
+## [2.19.1] - 2026-09-17
+
+### Changed
+- **Remove leftover Sentinel facades (#328).** `draft-write.js` and
+  `node-draft-inventory.js` were re-exports of `sentinel-draft.js`. Tests
+  import the client directly. Unused exports (`toolMessage`, `redactResponse`)
+  are gone; `DIAGNOSTIC_TOOLS` and `POLICY_DIGEST` each live in one place.
+- README and docs now report **123 tools across 27 modules** and **128 prompts**
+  (one per tool plus 5 workflow prompts). Codegen (`drupal_codegen_*`) shipped
+  in 2.16.0 but was missing from the public counts and the npm project page.
+
 ## [2.19.0] - 2026-09-16
 
 ### Added
@@ -1679,6 +1930,9 @@ The connector is now **dual-protocol**: every tool runs against an abstract back
 - User tools gained explicit PII-access assertions.
 - Whole tree lint-clean (`npm run lint`) with object-injection sinks rewritten to safe lookups.
 
+[2.19.1]: https://github.com/Wilkes-Liberty/drupal-mcp-connector/releases/tag/v2.19.1
+[2.19.0]: https://github.com/Wilkes-Liberty/drupal-mcp-connector/releases/tag/v2.19.0
+[2.18.0]: https://github.com/Wilkes-Liberty/drupal-mcp-connector/releases/tag/v2.18.0
 [2.17.0]: https://github.com/Wilkes-Liberty/drupal-mcp-connector/releases/tag/v2.17.0
 [2.16.0]: https://github.com/Wilkes-Liberty/drupal-mcp-connector/releases/tag/v2.16.0
 [2.15.2]: https://github.com/Wilkes-Liberty/drupal-mcp-connector/releases/tag/v2.15.2