edgegate-mcp 0.4.0 → 0.7.0

package/skills/edgegate-connect-huggingface.md

@@ -0,0 +1,64 @@
+---
+name: edgegate-connect-huggingface
+description: Connect a personal HuggingFace token to the active workspace so EdgeGate can import private, gated, or Qualcomm-org repos. Walk the user through generating a token, confirming the account, and remembering that rotation is non-disruptive.
+---
+
+# /edgegate-connect-huggingface
+
+Use this skill when the user wants to import a HuggingFace model that the
+anonymous endpoint can't reach — common cases:
+
+- `qualcomm/*` (Qualcomm's own optimized model org)
+- `Intel/*` and many `Xenova/*` repos
+- The user's own private repository
+- Any gated model (Llama family, some image models, etc.) the user has access to
+
+The workspace integration encrypts the token at rest using the same KMS as the
+AI Hub token; it is never echoed in plaintext after the initial connect.
+
+## Steps
+
+1. **Confirm the active workspace.** If you don't already know which workspace
+   the user is operating on, call `edgegate_setup_workspace` first.
+
+2. **Check whether a token is already connected.** Call
+   `edgegate_get_huggingface_integration`. If a token is already active,
+   confirm with the user whether they want to **rotate** (replace) it before
+   asking for a new one.
+
+3. **Walk the user through generating a token** if they don't already have one.
+   - Open <https://huggingface.co/settings/tokens>
+   - Click **Create new token**
+   - Default scope is `Read` — that's enough for the import flow
+   - Copy the token. It starts with `hf_…` and is shown exactly once
+
+4. **Call `edgegate_connect_huggingface`** with the token. The tool validates
+   it against HF's `whoami` endpoint before storing, so a typo'd or revoked
+   token surfaces as a clean 400 with guidance — not a silent failure later
+   during import.
+
+5. **Confirm.** The tool response includes the HF `account_name` and
+   `account_type`. Confirm that matches the user's expectation — for example,
+   if they meant to use their org account but the response shows their
+   personal handle, offer to rotate with the right token.
+
+6. **Move on.** Tell the user the integration is live and that they can now
+   call `edgegate_import_huggingface_model` against any repo their token can
+   read (including the Qualcomm org).
+
+## Failure modes
+
+- **400 "does not look like a HuggingFace token"** — they pasted something
+  that doesn't start with `hf_` or `api_`. Direct them back to
+  <https://huggingface.co/settings/tokens>.
+- **400 "HuggingFace rejected the token"** — token is real-shaped but HF
+  returned 401. Common causes: typo, copied truncated value, token revoked.
+  Suggest regenerating.
+- **409 conflict** — the tool auto-rotates on conflict, so this shouldn't
+  bubble up. If it does, the rotation also failed; surface the error.
+
+## Removing the integration
+
+If the user wants to remove the token (offboarding, key rotation policy,
+account change), call `edgegate_disconnect_huggingface`. The encrypted token
+is deleted; future imports fall back to anonymous access.

package/skills/edgegate-connect-qaihub.md

@@ -0,0 +1,56 @@
+---
+name: edgegate-connect-qaihub
+description: Connect a Qualcomm AI Hub API token to the active EdgeGate workspace so runs can compile and profile models on real Snapdragon devices. Required before any pipeline can actually execute.
+---
+
+# /edgegate-connect-qaihub
+
+Use this skill when the user is setting up a new EdgeGate workspace, has just
+created one with `edgegate_create_workspace`, or is seeing runs fail with
+`NO_AIHUB_TOKEN`.
+
+Qualcomm AI Hub is the device cloud EdgeGate uses behind the scenes — every
+compile + profile + inference job runs against a real Snapdragon device there.
+Without a token connected, the worker can't talk to Hub, so runs that reach the
+worker fail fast.
+
+## Steps
+
+1. **Confirm the active workspace.** If you don't already know which workspace,
+   call `edgegate_setup_workspace` first.
+
+2. **Check whether a token is already connected.** Call
+   `edgegate_get_qaihub_integration`. If the response says **active** with a
+   `token_last4`, ask the user whether they want to **rotate** (replace) the
+   existing token before continuing. If the response is 404, they need to
+   connect for the first time.
+
+3. **Walk the user through generating a Qualcomm AI Hub token** if they don't
+   already have one:
+   - Open <https://app.aihub.qualcomm.com/account/api-token>
+   - Click **Generate new token** (or copy the existing one if shown)
+   - The token is a long alphanumeric string; copy it
+
+4. **Call `edgegate_connect_qaihub`** with the token. The backend stores it
+   under envelope encryption using the workspace KMS — the plaintext is
+   never returned again, and only `token_last4` is visible afterwards.
+
+5. **Confirm + next step.** Tell the user the integration is live. If this is
+   their first connection, suggest:
+   - `edgegate_create_promptpack` (if they need a new promptpack)
+   - `edgegate_create_pipeline` to define their first regression gate
+
+## Failure modes
+
+- **Already exists (409 conflict)** — the tool transparently rotates instead
+  of failing, so the user shouldn't see this. If it does bubble up, the
+  rotation also failed and the backend error message comes through.
+- **500 from Qualcomm AI Hub itself** — usually a transient outage at Hub
+  (`https://app.aihub.qualcomm.com`). Ask the user to retry in a minute.
+
+## Removing the integration
+
+If the user wants to disconnect (offboarding, key rotation policy, account
+change), call `edgegate_disconnect_qaihub`. The encrypted token is deleted
+and new runs in the workspace fail with `NO_AIHUB_TOKEN` until a fresh
+token is connected.

package/skills/edgegate-import.md

@@ -1,6 +1,6 @@
 ---
 name: edgegate-import
-description: Import a public Hugging Face model (ONNX) into EdgeGate. Use when the user says "import model from huggingface", "pull this HF model", or references an "<owner>/<name>" repo they want to gate.
+description: Import a Hugging Face model (ONNX) into EdgeGate. Use when the user says "import model from huggingface", "pull this HF model", or references an "<owner>/<name>" repo they want to gate. Supports both anonymous (public repos) and personal-token (private / gated / qualcomm-org repos via /edgegate-connect-huggingface) flows.
 ---
 
 # /edgegate-import
@@ -45,5 +45,5 @@ Use this skill when the user says any of:
 ## Failure modes
 
 - **"no ONNX file found"** — The repo doesn't contain a pre-built ONNX. EdgeGate v1 only supports repos with a pre-built ONNX file. Point the user to the dashboard upload flow for converting their own model: `https://edgegate.frozo.ai/workspace/<id>/models`.
-- **"private repo"** — EdgeGate v1 only imports public HuggingFace repos. Ask the user to make the repo public or use the direct upload flow instead.
+- **"private repo" / 401 from HuggingFace** — The anonymous endpoint can't read the repo (gated org like `qualcomm/*`, the user's own private repo, or a gated Llama family model). Offer to run `/edgegate-connect-huggingface` to attach a personal HF token to the workspace; once connected the same import call will succeed.
 - **402 — plan limit** — Direct the user to `https://edgegate.frozo.ai/pricing` to upgrade.

package/skills/edgegate-init.md

@@ -13,6 +13,10 @@ Goal of this skill: take the user from "I have a model file" to "every PR is aut
 
 1. **Confirm workspace.** Call `edgegate_setup_workspace` with no args. Present the list. Ask the user which one to use; if they say "the first one", pick `result[0].id`. Confirm before continuing.
 
+   If the list is empty OR the user wants a new workspace for this project, route to `/edgegate-workspace-setup` instead — that flow creates the workspace, connects Qualcomm AI Hub, optionally mints an API key for CI, and optionally invites teammates, all from chat.
+
+   If they have a workspace but it's missing the Qualcomm AI Hub integration (runs would fail with `NO_AIHUB_TOKEN`), run `/edgegate-connect-qaihub` first.
+
 2. **Define the pipeline.** Ask the user:
    - "Which model file do you want to gate? (path or artifact_id)"
    - "Which Snapdragon devices? (default: Samsung Galaxy S24, Galaxy S23)"
@@ -20,6 +24,8 @@ Goal of this skill: take the user from "I have a model file" to "every PR is aut
 
    If they hand you a file path (e.g. `./model.onnx`), tell them they need to upload it via the dashboard first to get an artifact_id (the MCP tool does not handle uploads in v1.0). Link: `https://edgegate.frozo.ai/workspace/{workspace_id}/models`.
 
+   If they hand you a HuggingFace repo id (e.g. `microsoft/resnet-50`), call `edgegate_import_huggingface_model` to import it and get an artifact_id back. If the repo is private / gated / from the Qualcomm org, the import will 401 — offer to run `/edgegate-connect-huggingface` to attach a personal HF token to the workspace, then retry the import.
+
    If they hand you an artifact_id, proceed to `edgegate_create_pipeline`.
 
 3. **Trigger the first run.** Call `edgegate_run_gate` with the workspace_id + new pipeline_id. Tell the user the run_id. Note that runs take 3-5 min per device.
@@ -28,6 +34,17 @@ Goal of this skill: take the user from "I have a model file" to "every PR is aut
 
 5. **Confirm.** Tell the user what's now set up: workspace `<name>`, pipeline `<name>`, run `<id>` in flight, and (if applicable) GitHub Action wired.
 
+## Input shape overrides (`input_specs`)
+
+If creating a pipeline for a text or audio model, the backend auto-resolves dynamic shapes
+(defaults: batch=1, sequence=128). If those defaults don't fit — long-context LLM, custom
+audio model, or mixed-input model — pass `input_specs` explicitly with the right shape per input.
+
+Examples:
+- Long-context BERT (seq_len=512): `{ input_ids: { shape: [1, 512], dtype: "int64" }, attention_mask: { shape: [1, 512], dtype: "int64" } }`
+- Audio model (mel-spectrogram): `{ mel_features: { shape: [1, 80, 3000], dtype: "float32" } }`
+- Image model: omit entirely — the backend reads static shapes from the ONNX file.
+
 ## Failure modes
 
 - **No workspaces.** The API key may have been revoked. Direct the user to `https://edgegate.frozo.ai/workspace/<id>/settings#api-keys` to generate a fresh key.

package/skills/edgegate-members.md

@@ -0,0 +1,51 @@
+---
+name: edgegate-members
+description: List, invite, change role of, or remove EdgeGate workspace members. Use for any "add Alice as admin", "show me who's on this workspace", "Bob left the team", or similar membership management.
+---
+
+# /edgegate-members
+
+Composes the four member tools into a single skill the LLM can route any
+membership-management request through.
+
+## Roles
+
+| Role | Can do | Can NOT do |
+|---|---|---|
+| `owner` | Everything: members, billing, delete workspace, AI Hub connect, pipelines, runs | (nothing — full power) |
+| `admin` | Pipelines, runs, integrations, members (except adding owners) | Billing, delete workspace, downgrade self |
+| `viewer` | Read pipelines, runs, reports, members | Anything write |
+
+## Steps by intent
+
+### "Show me the members" / "Who's on this workspace?"
+Call `edgegate_list_members({ workspace_id })`. Returns email + role + user_id.
+
+### "Add Alice as admin"
+1. Call `edgegate_invite_member({ workspace_id, user_email, role })`.
+2. If the response is 404, Alice doesn't have an EdgeGate account yet — tell
+   the user Alice needs to register at <https://edgegate.frozo.ai/register>
+   first, then re-run.
+3. If 409, Alice is already a member — offer to update her role with
+   `/edgegate-members → change role` instead.
+
+### "Make Bob an owner" / "Downgrade Carol to viewer"
+1. Get Bob's user_id from `edgegate_list_members` if not already known.
+2. Call `edgegate_change_member_role({ workspace_id, user_id, role })`.
+3. If the response is 400 with "Cannot remove the last owner", explain to
+   the user: they need to promote another member to owner first, then come
+   back to downgrade the original owner.
+
+### "Remove Dave"
+1. Get Dave's user_id.
+2. Confirm with the user (this is destructive — Dave loses access
+   immediately). Mention that Dave's pipelines and runs are preserved.
+3. Call `edgegate_remove_member({ workspace_id, user_id })`.
+4. Same last-owner guard as above applies.
+
+## Failure modes
+
+- **403** on invite / change / remove — the caller's own role is too low. The
+  detail message names the required role.
+- **404** on user lookup — the email or user_id doesn't exist in EdgeGate.
+- **plan_limit_exceeded** on invite — workspace seat cap; direct to pricing.

package/skills/edgegate-promptpacks.md

@@ -1,17 +1,18 @@
 ---
 name: edgegate-promptpacks
-description: List or create EdgeGate promptpacks. Use when the user says "list my promptpacks", "what packs do I have", "create a promptpack", "make a new pack", "I need a text embedding pack", or any variation on viewing or authoring test-case packs for EdgeGate pipelines.
+description: List, create, or publish EdgeGate promptpacks. Use when the user says "list my promptpacks", "what packs do I have", "create a promptpack", "make a new pack", "publish a pack", "I need a text embedding pack", or any variation on viewing, authoring, or activating test-case packs for EdgeGate pipelines.
 ---
 
 # /edgegate-promptpacks
 
-The user wants to list existing promptpacks in their workspace, or create a new one.
+The user wants to list existing promptpacks in their workspace, create a new one, or publish one so it is usable in pipelines.
 
 ## Triggers
 
 Use this skill when the user says any of:
 - "list my promptpacks" / "what packs do I have" / "show my packs"
 - "create a promptpack" / "make a new pack" / "add test cases"
+- "publish a promptpack" / "activate a pack" / "make this pack usable"
 - "I need a text embedding pack" / "create an LLM completion benchmark"
 - "set up test cases for my image classification model"
 
@@ -31,6 +32,12 @@ Use this skill when the user says any of:
    b. Suggest 3–5 sensible test cases based on use case (Claude can generate them — see templates below).
    c. Confirm `promptpack_id` (slug, no spaces), `version` (start at `1.0.0` unless user says otherwise), and `name`.
    d. Call `edgegate_create_promptpack(...)`.
+   e. **Immediately publish** — call `edgegate_publish_promptpack({ workspace_id, promptpack_id, version })` right after creation. Do NOT wait for the user to ask. Packs start as `published: false` and are unusable in pipelines until published.
+
+4. **If publishing an existing pack:**
+   - Confirm `promptpack_id` and `version` (use `edgegate_list_promptpacks` if unsure).
+   - Call `edgegate_publish_promptpack({ workspace_id, promptpack_id, version })`.
+   - The operation is idempotent — safe to call even if already published.
 
 ## Case templates by model type
 
@@ -71,10 +78,20 @@ Use this skill when the user says any of:
 
 - Start at `1.0.0` unless the user specifies otherwise.
 - Packs are **immutable** — to update, bump the patch (e.g. `1.0.0` → `1.0.1`) and create a new pack.
-- Only published packs can be referenced in pipelines. Newly created packs are `published: false` — remind the user to publish via the dashboard.
+- Only published packs can be referenced in pipelines. Always call `edgegate_publish_promptpack` immediately after `edgegate_create_promptpack` — do not make the user do this manually.
+
+## Full lifecycle (always follow this sequence)
+
+```
+edgegate_create_promptpack(...)     # creates pack with published=false
+edgegate_publish_promptpack(...)    # publishes it — now usable in pipelines
+edgegate_create_pipeline(...)       # can now reference the promptpack_id
+```
 
 ## Failure modes
 
-- **409 conflict** — (promptpack_id, version) already exists. Bump the version and retry.
+- **409 conflict on create** — (promptpack_id, version) already exists. Bump the version and retry.
+- **409 "already published" on publish** — treated as success (idempotent); the pack is already live.
 - **403 forbidden** — user needs admin role on the workspace.
-- **400 / schema error** — surface the `issues` array to the user; common causes are `case_id` with spaces or special characters, `max_new_tokens` > 256, or more than 50 cases.
+- **404 on publish** — promptpack_id or version not found; confirm with `edgegate_list_promptpacks`.
+- **400 / schema error on create** — surface the `issues` array to the user; common causes are `case_id` with spaces or special characters, `max_new_tokens` > 256, or more than 50 cases.

package/skills/edgegate-workspace-setup.md

@@ -0,0 +1,74 @@
+---
+name: edgegate-workspace-setup
+description: Bootstrap a new EdgeGate workspace end-to-end — create the workspace, connect Qualcomm AI Hub, mint an API key, and (optionally) invite teammates. Use this when the user has registered but hasn't yet set up a workspace, or wants a parallel one for a new project.
+---
+
+# /edgegate-workspace-setup
+
+This is the **zero-to-runnable workspace** flow. It composes the other
+single-purpose tools into a single guided onboarding sequence so the user can
+go from "I just signed up" to "EdgeGate is running my model on a Snapdragon
+device" without leaving the chat.
+
+## When to use
+
+- User just signed up at <https://edgegate.frozo.ai/register> and wants to
+  start using the MCP
+- User is creating a parallel workspace for a new project / customer / branch
+- User says "set up EdgeGate for me", "create a new workspace and wire it up",
+  or similar
+
+If they already have a usable workspace and just need to connect AI Hub or
+add members, send them to `/edgegate-connect-qaihub` or
+`/edgegate-invite-member` directly instead.
+
+## Steps
+
+1. **Create the workspace.** Ask for a name (e.g. "MobileNet Production",
+   "Customer Pilot — Bosch"). Call `edgegate_create_workspace({ name })` and
+   capture the returned `workspace_id`. Pass that id to every subsequent call.
+
+2. **Connect Qualcomm AI Hub.** Without this, runs will fail with
+   `NO_AIHUB_TOKEN`. Either:
+   - Run the `/edgegate-connect-qaihub` sub-flow, **or**
+   - If the user has their AI Hub token at hand, call
+     `edgegate_connect_qaihub({ workspace_id, token })` directly.
+
+   Pause here until the integration is **active**.
+
+3. **(Optional) Mint a CI API key.** If the user plans to wire EdgeGate into
+   GitHub Actions / GitLab CI / similar, call `edgegate_create_api_key` with
+   a descriptive name (e.g. "GitHub Actions — production"). **Tell them the
+   plaintext is returned exactly once** and they MUST copy it now into their
+   CI secrets manager. Re-show the value, then move on. If they want to
+   actually wire the GitHub Action immediately, follow up with
+   `edgegate_setup_github_action`.
+
+4. **(Optional) Invite teammates.** If the user mentions teammates, run the
+   `/edgegate-invite-member` sub-flow or call `edgegate_invite_member`
+   directly per teammate. Roles: `owner` (full control, billing), `admin`
+   (pipelines + runs, no billing or workspace delete), `viewer` (read-only).
+
+5. **Confirm + suggest next.** Recap what's set up:
+   - workspace name + id
+   - AI Hub: connected (token `****xxxx`)
+   - API keys: how many active
+   - members: count + roles
+
+   Then suggest the next concrete action:
+   - "Import a model from HuggingFace: `edgegate_import_huggingface_model`"
+   - "Create the first regression pipeline: `edgegate_create_pipeline`"
+
+## Failure modes
+
+- **Create workspace → 403 plan_limit_exceeded.** They've hit their plan's
+  workspace cap. Direct them to <https://edgegate.frozo.ai/pricing> to
+  upgrade, or to remove an unused workspace via the dashboard first.
+- **Connect AI Hub → 401 from Hub.** The token they pasted is wrong or
+  revoked. Send them back to
+  <https://app.aihub.qualcomm.com/account/api-token> for a fresh one.
+- **Create API key → 402.** Their plan doesn't include API access. Pro tier
+  or above is required; direct them to pricing.
+- **Invite member → 404.** The email doesn't belong to an existing EdgeGate
+  account. v1 doesn't send invitation emails — the teammate has to register
+  first at <https://edgegate.frozo.ai/register>.