edgegate-mcp 0.4.1 → 0.7.0

package/dist/tools/list_api_keys.d.ts

@@ -0,0 +1,12 @@
+import { z } from "zod";
+import { EdgeGateClient } from "../client.js";
+import type { ToolResult } from "./setup_workspace.js";
+export declare const listApiKeysInputSchema: z.ZodObject<{
+    workspace_id: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    workspace_id: string;
+}, {
+    workspace_id: string;
+}>;
+export type ListApiKeysInput = z.infer<typeof listApiKeysInputSchema>;
+export declare function listApiKeysHandler(client: EdgeGateClient, input: ListApiKeysInput): Promise<ToolResult>;

package/dist/tools/list_api_keys.js

@@ -0,0 +1,51 @@
+import { z } from "zod";
+import { EdgeGateError } from "../client.js";
+export const listApiKeysInputSchema = z.object({
+    workspace_id: z.string().uuid(),
+});
+export async function listApiKeysHandler(client, input) {
+    try {
+        const keys = await client.listApiKeys(input.workspace_id);
+        if (keys.length === 0) {
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: "No API keys in this workspace yet. Create one with `edgegate_create_api_key`.",
+                    },
+                ],
+            };
+        }
+        return {
+            content: [{ type: "text", text: formatTable(keys) }],
+        };
+    }
+    catch (err) {
+        if (err instanceof EdgeGateError) {
+            return {
+                isError: true,
+                content: [{ type: "text", text: `EdgeGate returned ${err.status}: ${err.detail}` }],
+            };
+        }
+        throw err;
+    }
+}
+function formatTable(keys) {
+    const lines = [
+        `Found ${keys.length} API key${keys.length === 1 ? "" : "s"} in this workspace:`,
+        ``,
+        `| name | id | prefix...suffix | status | last used |`,
+        `|---|---|---|---|---|`,
+    ];
+    for (const k of keys) {
+        const status = k.revoked_at
+            ? "revoked"
+            : k.expires_at && new Date(k.expires_at) < new Date()
+                ? "expired"
+                : "active";
+        lines.push(`| ${k.name} | \`${k.id}\` | \`${k.prefix}...${k.suffix}\` | ${status} | ${k.last_used_at ?? "never"} |`);
+    }
+    lines.push(``, `Revoke a key with \`edgegate_revoke_api_key({ workspace_id, key_id })\`. The plaintext is never recoverable — if it was lost, rotate by creating a new key and revoking the old.`);
+    return lines.join("\n");
+}
+//# sourceMappingURL=list_api_keys.js.map

package/dist/tools/list_api_keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list_api_keys.js","sourceRoot":"","sources":["../../src/tools/list_api_keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAkB,aAAa,EAAE,MAAM,cAAc,CAAC;AAI7D,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;CAChC,CAAC,CAAC;AAIH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAsB,EACtB,KAAuB;IAEvB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC1D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,+EAA+E;qBACtF;iBACF;aACF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;SACrD,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;aACpF,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAsB;IACzC,MAAM,KAAK,GAAa;QACtB,SAAS,IAAI,CAAC,MAAM,WAAW,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,qBAAqB;QAChF,EAAE;QACF,sDAAsD;QACtD,uBAAuB;KACxB,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU;YACzB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,IAAI,IAAI,EAAE;gBACnD,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,QAAQ,CAAC;QACf,KAAK,CAAC,IAAI,CACR,KAAK,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,MAAM,QAAQ,MAAM,MAAM,CAAC,CAAC,YAAY,IAAI,OAAO,IAAI,CACzG,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CACR,EAAE,EACF,kLAAkL,CACnL,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/tools/list_members.d.ts

@@ -0,0 +1,12 @@
+import { z } from "zod";
+import { EdgeGateClient } from "../client.js";
+import type { ToolResult } from "./setup_workspace.js";
+export declare const listMembersInputSchema: z.ZodObject<{
+    workspace_id: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    workspace_id: string;
+}, {
+    workspace_id: string;
+}>;
+export type ListMembersInput = z.infer<typeof listMembersInputSchema>;
+export declare function listMembersHandler(client: EdgeGateClient, input: ListMembersInput): Promise<ToolResult>;

package/dist/tools/list_members.js

@@ -0,0 +1,43 @@
+import { z } from "zod";
+import { EdgeGateError } from "../client.js";
+export const listMembersInputSchema = z.object({
+    workspace_id: z.string().uuid(),
+});
+export async function listMembersHandler(client, input) {
+    try {
+        const members = await client.listMembers(input.workspace_id);
+        if (members.length === 0) {
+            return {
+                content: [
+                    { type: "text", text: "No members in this workspace yet (which should be impossible — the owner is always a member)." },
+                ],
+            };
+        }
+        return {
+            content: [{ type: "text", text: formatTable(members) }],
+        };
+    }
+    catch (err) {
+        if (err instanceof EdgeGateError) {
+            return {
+                isError: true,
+                content: [{ type: "text", text: `EdgeGate returned ${err.status}: ${err.detail}` }],
+            };
+        }
+        throw err;
+    }
+}
+function formatTable(members) {
+    const lines = [
+        `Found ${members.length} member${members.length === 1 ? "" : "s"} in this workspace:`,
+        ``,
+        `| email | role | user_id |`,
+        `|---|---|---|`,
+    ];
+    for (const m of members) {
+        lines.push(`| ${m.email} | ${m.role} | \`${m.user_id}\` |`);
+    }
+    lines.push(``, `Invite with \`edgegate_invite_member\`, change role with \`edgegate_change_member_role\`, remove with \`edgegate_remove_member\`. Roles: \`owner\` (full control), \`admin\` (manage pipelines + runs, can't change billing or delete workspace), \`viewer\` (read-only).`);
+    return lines.join("\n");
+}
+//# sourceMappingURL=list_members.js.map

package/dist/tools/list_members.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list_members.js","sourceRoot":"","sources":["../../src/tools/list_members.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAkB,aAAa,EAAE,MAAM,cAAc,CAAC;AAI7D,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;CAChC,CAAC,CAAC;AAIH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAsB,EACtB,KAAuB;IAEvB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO;gBACL,OAAO,EAAE;oBACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,+FAA+F,EAAE;iBACxH;aACF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;SACxD,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;aACpF,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,OAAiB;IACpC,MAAM,KAAK,GAAa;QACtB,SAAS,OAAO,CAAC,MAAM,UAAU,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,qBAAqB;QACrF,EAAE;QACF,4BAA4B;QAC5B,eAAe;KAChB,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC;IAC9D,CAAC;IACD,KAAK,CAAC,IAAI,CACR,EAAE,EACF,2QAA2Q,CAC5Q,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/tools/remove_member.d.ts

@@ -0,0 +1,15 @@
+import { z } from "zod";
+import { EdgeGateClient } from "../client.js";
+import type { ToolResult } from "./setup_workspace.js";
+export declare const removeMemberInputSchema: z.ZodObject<{
+    workspace_id: z.ZodString;
+    user_id: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    workspace_id: string;
+    user_id: string;
+}, {
+    workspace_id: string;
+    user_id: string;
+}>;
+export type RemoveMemberInput = z.infer<typeof removeMemberInputSchema>;
+export declare function removeMemberHandler(client: EdgeGateClient, input: RemoveMemberInput): Promise<ToolResult>;

package/dist/tools/remove_member.js

@@ -0,0 +1,64 @@
+import { z } from "zod";
+import { EdgeGateError } from "../client.js";
+export const removeMemberInputSchema = z.object({
+    workspace_id: z.string().uuid(),
+    user_id: z
+        .string()
+        .uuid()
+        .describe("Target member's user_id (from `edgegate_list_members`). The user immediately " +
+        "loses access to the workspace. Their pipelines and runs are preserved — " +
+        "this only removes the membership row."),
+});
+export async function removeMemberHandler(client, input) {
+    try {
+        await client.removeMember(input.workspace_id, input.user_id);
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: [
+                        `Removed user \`${input.user_id}\` from this workspace.`,
+                        ``,
+                        `Pipelines and runs they created are preserved. Re-invite any time with \`edgegate_invite_member\` if it was a mistake.`,
+                    ].join("\n"),
+                },
+            ],
+        };
+    }
+    catch (err) {
+        if (err instanceof EdgeGateError) {
+            if (err.status === 400) {
+                // Most likely "Cannot remove the last owner from workspace".
+                return {
+                    isError: true,
+                    content: [
+                        {
+                            type: "text",
+                            text: `Member removal rejected: ${err.detail}\n\n` +
+                                `If you're trying to remove the last owner, promote another member ` +
+                                `to owner first via \`edgegate_change_member_role\`, then remove ` +
+                                `the original owner.`,
+                        },
+                    ],
+                };
+            }
+            if (err.status === 404) {
+                return {
+                    isError: true,
+                    content: [
+                        {
+                            type: "text",
+                            text: `User \`${input.user_id}\` is not a member of this workspace.`,
+                        },
+                    ],
+                };
+            }
+            return {
+                isError: true,
+                content: [{ type: "text", text: `EdgeGate returned ${err.status}: ${err.detail}` }],
+            };
+        }
+        throw err;
+    }
+}
+//# sourceMappingURL=remove_member.js.map

package/dist/tools/remove_member.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remove_member.js","sourceRoot":"","sources":["../../src/tools/remove_member.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAkB,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7D,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC/B,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,IAAI,EAAE;SACN,QAAQ,CACP,+EAA+E;QAC7E,0EAA0E;QAC1E,uCAAuC,CAC1C;CACJ,CAAC,CAAC;AAIH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAsB,EACtB,KAAwB;IAExB,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7D,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,kBAAkB,KAAK,CAAC,OAAO,yBAAyB;wBACxD,EAAE;wBACF,wHAAwH;qBACzH,CAAC,IAAI,CAAC,IAAI,CAAC;iBACb;aACF;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,6DAA6D;gBAC7D,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EACF,4BAA4B,GAAG,CAAC,MAAM,MAAM;gCAC5C,oEAAoE;gCACpE,kEAAkE;gCAClE,qBAAqB;yBACxB;qBACF;iBACF,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,UAAU,KAAK,CAAC,OAAO,uCAAuC;yBACrE;qBACF;iBACF,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;aACpF,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/tools/revoke_api_key.d.ts

@@ -0,0 +1,15 @@
+import { z } from "zod";
+import { EdgeGateClient } from "../client.js";
+import type { ToolResult } from "./setup_workspace.js";
+export declare const revokeApiKeyInputSchema: z.ZodObject<{
+    workspace_id: z.ZodString;
+    key_id: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    workspace_id: string;
+    key_id: string;
+}, {
+    workspace_id: string;
+    key_id: string;
+}>;
+export type RevokeApiKeyInput = z.infer<typeof revokeApiKeyInputSchema>;
+export declare function revokeApiKeyHandler(client: EdgeGateClient, input: RevokeApiKeyInput): Promise<ToolResult>;

package/dist/tools/revoke_api_key.js

@@ -0,0 +1,49 @@
+import { z } from "zod";
+import { EdgeGateError } from "../client.js";
+export const revokeApiKeyInputSchema = z.object({
+    workspace_id: z.string().uuid(),
+    key_id: z
+        .string()
+        .uuid()
+        .describe("UUID of the key to revoke (the `id` field from `edgegate_list_api_keys`). " +
+        "This is destructive and immediate — any CI job or client still using " +
+        "the plaintext will fail authentication on the next request."),
+});
+export async function revokeApiKeyHandler(client, input) {
+    try {
+        await client.revokeApiKey(input.workspace_id, input.key_id);
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: [
+                        `Revoked API key \`${input.key_id}\`.`,
+                        ``,
+                        `The key is now rejected for all future requests. The audit trail (last_used_at, revoked_at) is preserved on the row — you can still see it in \`edgegate_list_api_keys\`.`,
+                    ].join("\n"),
+                },
+            ],
+        };
+    }
+    catch (err) {
+        if (err instanceof EdgeGateError) {
+            if (err.status === 404) {
+                return {
+                    isError: true,
+                    content: [
+                        {
+                            type: "text",
+                            text: `API key \`${input.key_id}\` not found in this workspace (or already revoked).`,
+                        },
+                    ],
+                };
+            }
+            return {
+                isError: true,
+                content: [{ type: "text", text: `EdgeGate returned ${err.status}: ${err.detail}` }],
+            };
+        }
+        throw err;
+    }
+}
+//# sourceMappingURL=revoke_api_key.js.map

package/dist/tools/revoke_api_key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revoke_api_key.js","sourceRoot":"","sources":["../../src/tools/revoke_api_key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAkB,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7D,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC/B,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,IAAI,EAAE;SACN,QAAQ,CACP,4EAA4E;QAC1E,uEAAuE;QACvE,6DAA6D,CAChE;CACJ,CAAC,CAAC;AAIH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAsB,EACtB,KAAwB;IAExB,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5D,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,qBAAqB,KAAK,CAAC,MAAM,KAAK;wBACtC,EAAE;wBACF,2KAA2K;qBAC5K,CAAC,IAAI,CAAC,IAAI,CAAC;iBACb;aACF;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,aAAa,KAAK,CAAC,MAAM,sDAAsD;yBACtF;qBACF;iBACF,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;aACpF,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/types.d.ts

@@ -1,4 +1,20 @@
 export type UUID = string;
+/** Supported dtypes for AI Hub compile input tensors. */
+export type InputSpecDtype = "float32" | "float16" | "int64" | "int32" | "bool";
+/**
+ * Explicit shape + dtype for one named model input.
+ * Passed as `input_specs` on pipeline create/update to override the default
+ * AI Hub auto-detect or PR-#40 auto-resolve behaviour.
+ *
+ * Example (BERT-family):
+ *   { shape: [1, 128], dtype: "int64" }
+ */
+export interface InputSpec {
+    /** Tensor shape (1–8 positive integers). */
+    shape: number[];
+    /** Element dtype. Defaults to "float32" when omitted. */
+    dtype: InputSpecDtype;
+}
 export interface Workspace {
     id: UUID;
     name: string;
@@ -84,6 +100,74 @@ export interface WorkflowTemplate {
     api_url: string;
     secret_names: string[];
 }
+/**
+ * Returned by GET /integrations/huggingface — status without the token.
+ * The plaintext token is never echoed; only the last 4 chars + lifecycle
+ * fields are visible after the initial connect/rotate call.
+ */
+export interface HuggingFaceIntegrationStatus {
+    id: UUID;
+    provider: "huggingface";
+    status: "active" | "disabled";
+    token_last4: string;
+    created_at: string;
+    updated_at: string;
+}
+/**
+ * Returned by POST /integrations/huggingface and the rotate endpoint.
+ * Includes the whoami account name/type so the caller can confirm the
+ * right account was connected, without leaking the secret.
+ */
+export interface HuggingFaceConnectResponse extends HuggingFaceIntegrationStatus {
+    account_name: string;
+    account_type: string;
+}
+/**
+ * Returned by GET / POST / PUT on /integrations/qaihub.
+ * The plaintext token is never echoed; only token_last4 is visible.
+ */
+export interface QaihubIntegration {
+    id: UUID;
+    provider: "qaihub";
+    status: "active" | "disabled";
+    token_last4: string;
+    created_at: string;
+    updated_at: string;
+}
+/**
+ * Returned by POST /workspaces/{ws}/api-keys.
+ * `plaintext` is the only time the full key is visible — the caller must
+ * persist it immediately; the backend stores only a bcrypt hash.
+ */
+export interface APIKeyCreatedResponse {
+    id: UUID;
+    plaintext: string;
+    name: string;
+    prefix: string;
+    suffix: string;
+    created_at: string;
+    expires_at: string | null;
+}
+/**
+ * Returned by GET /workspaces/{ws}/api-keys (one row per key).
+ * Includes lifecycle fields but never the plaintext or the hash.
+ */
+export interface APIKeyListItem {
+    id: UUID;
+    name: string;
+    prefix: string;
+    suffix: string;
+    last_used_at: string | null;
+    expires_at: string | null;
+    revoked_at: string | null;
+    created_at: string;
+}
+export type WorkspaceRole = "owner" | "admin" | "viewer";
+export interface Member {
+    user_id: UUID;
+    email: string;
+    role: WorkspaceRole;
+}
 /** @deprecated Not used — audit-report endpoint does not exist; use RunBundle instead. */
 export interface AuditReport {
     url?: string;

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.4.1";
-export declare const USER_AGENT = "edgegate-mcp/0.4.1";
+export declare const VERSION = "0.7.0";
+export declare const USER_AGENT = "edgegate-mcp/0.7.0";

package/dist/version.js

@@ -1,3 +1,3 @@
-export const VERSION = "0.4.1";
+export const VERSION = "0.7.0";
 export const USER_AGENT = `edgegate-mcp/${VERSION}`;
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "edgegate-mcp",
-  "version": "0.4.1",
+  "version": "0.7.0",
   "description": "MCP server for EdgeGate — set up edge-AI regression gates from Claude Code, Cursor, or Claude Desktop.",
   "license": "MIT",
   "type": "module",

package/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "edgegate",
-  "version": "0.4.1",
+  "version": "0.7.0",
   "description": "Edge-AI regression gates from Claude Code — set up CI, run benchmarks, compare runs, export reports, and fetch audit bundles from any prompt.",
   "author": "Frozo / EdgeGate",
   "homepage": "https://edgegate.frozo.ai",
@@ -25,6 +25,10 @@
     "skills/edgegate-compare.md",
     "skills/edgegate-export.md",
     "skills/edgegate-import.md",
-    "skills/edgegate-promptpacks.md"
+    "skills/edgegate-promptpacks.md",
+    "skills/edgegate-connect-huggingface.md",
+    "skills/edgegate-connect-qaihub.md",
+    "skills/edgegate-workspace-setup.md",
+    "skills/edgegate-members.md"
   ]
 }

package/skills/edgegate-connect-huggingface.md

@@ -0,0 +1,64 @@
+---
+name: edgegate-connect-huggingface
+description: Connect a personal HuggingFace token to the active workspace so EdgeGate can import private, gated, or Qualcomm-org repos. Walk the user through generating a token, confirming the account, and remembering that rotation is non-disruptive.
+---
+
+# /edgegate-connect-huggingface
+
+Use this skill when the user wants to import a HuggingFace model that the
+anonymous endpoint can't reach — common cases:
+
+- `qualcomm/*` (Qualcomm's own optimized model org)
+- `Intel/*` and many `Xenova/*` repos
+- The user's own private repository
+- Any gated model (Llama family, some image models, etc.) the user has access to
+
+The workspace integration encrypts the token at rest using the same KMS as the
+AI Hub token; it is never echoed in plaintext after the initial connect.
+
+## Steps
+
+1. **Confirm the active workspace.** If you don't already know which workspace
+   the user is operating on, call `edgegate_setup_workspace` first.
+
+2. **Check whether a token is already connected.** Call
+   `edgegate_get_huggingface_integration`. If a token is already active,
+   confirm with the user whether they want to **rotate** (replace) it before
+   asking for a new one.
+
+3. **Walk the user through generating a token** if they don't already have one.
+   - Open <https://huggingface.co/settings/tokens>
+   - Click **Create new token**
+   - Default scope is `Read` — that's enough for the import flow
+   - Copy the token. It starts with `hf_…` and is shown exactly once
+
+4. **Call `edgegate_connect_huggingface`** with the token. The tool validates
+   it against HF's `whoami` endpoint before storing, so a typo'd or revoked
+   token surfaces as a clean 400 with guidance — not a silent failure later
+   during import.
+
+5. **Confirm.** The tool response includes the HF `account_name` and
+   `account_type`. Confirm that matches the user's expectation — for example,
+   if they meant to use their org account but the response shows their
+   personal handle, offer to rotate with the right token.
+
+6. **Move on.** Tell the user the integration is live and that they can now
+   call `edgegate_import_huggingface_model` against any repo their token can
+   read (including the Qualcomm org).
+
+## Failure modes
+
+- **400 "does not look like a HuggingFace token"** — they pasted something
+  that doesn't start with `hf_` or `api_`. Direct them back to
+  <https://huggingface.co/settings/tokens>.
+- **400 "HuggingFace rejected the token"** — token is real-shaped but HF
+  returned 401. Common causes: typo, copied truncated value, token revoked.
+  Suggest regenerating.
+- **409 conflict** — the tool auto-rotates on conflict, so this shouldn't
+  bubble up. If it does, the rotation also failed; surface the error.
+
+## Removing the integration
+
+If the user wants to remove the token (offboarding, key rotation policy,
+account change), call `edgegate_disconnect_huggingface`. The encrypted token
+is deleted; future imports fall back to anonymous access.

package/skills/edgegate-connect-qaihub.md

@@ -0,0 +1,56 @@
+---
+name: edgegate-connect-qaihub
+description: Connect a Qualcomm AI Hub API token to the active EdgeGate workspace so runs can compile and profile models on real Snapdragon devices. Required before any pipeline can actually execute.
+---
+
+# /edgegate-connect-qaihub
+
+Use this skill when the user is setting up a new EdgeGate workspace, has just
+created one with `edgegate_create_workspace`, or is seeing runs fail with
+`NO_AIHUB_TOKEN`.
+
+Qualcomm AI Hub is the device cloud EdgeGate uses behind the scenes — every
+compile + profile + inference job runs against a real Snapdragon device there.
+Without a token connected, the worker can't talk to Hub, so runs that reach the
+worker fail fast.
+
+## Steps
+
+1. **Confirm the active workspace.** If you don't already know which workspace,
+   call `edgegate_setup_workspace` first.
+
+2. **Check whether a token is already connected.** Call
+   `edgegate_get_qaihub_integration`. If the response says **active** with a
+   `token_last4`, ask the user whether they want to **rotate** (replace) the
+   existing token before continuing. If the response is 404, they need to
+   connect for the first time.
+
+3. **Walk the user through generating a Qualcomm AI Hub token** if they don't
+   already have one:
+   - Open <https://app.aihub.qualcomm.com/account/api-token>
+   - Click **Generate new token** (or copy the existing one if shown)
+   - The token is a long alphanumeric string; copy it
+
+4. **Call `edgegate_connect_qaihub`** with the token. The backend stores it
+   under envelope encryption using the workspace KMS — the plaintext is
+   never returned again, and only `token_last4` is visible afterwards.
+
+5. **Confirm + next step.** Tell the user the integration is live. If this is
+   their first connection, suggest:
+   - `edgegate_create_promptpack` (if they need a new promptpack)
+   - `edgegate_create_pipeline` to define their first regression gate
+
+## Failure modes
+
+- **Already exists (409 conflict)** — the tool transparently rotates instead
+  of failing, so the user shouldn't see this. If it does bubble up, the
+  rotation also failed and the backend error message comes through.
+- **500 from Qualcomm AI Hub itself** — usually a transient outage at Hub
+  (`https://app.aihub.qualcomm.com`). Ask the user to retry in a minute.
+
+## Removing the integration
+
+If the user wants to disconnect (offboarding, key rotation policy, account
+change), call `edgegate_disconnect_qaihub`. The encrypted token is deleted
+and new runs in the workspace fail with `NO_AIHUB_TOKEN` until a fresh
+token is connected.

package/skills/edgegate-import.md

@@ -1,6 +1,6 @@
 ---
 name: edgegate-import
-description: Import a public Hugging Face model (ONNX) into EdgeGate. Use when the user says "import model from huggingface", "pull this HF model", or references an "<owner>/<name>" repo they want to gate.
+description: Import a Hugging Face model (ONNX) into EdgeGate. Use when the user says "import model from huggingface", "pull this HF model", or references an "<owner>/<name>" repo they want to gate. Supports both anonymous (public repos) and personal-token (private / gated / qualcomm-org repos via /edgegate-connect-huggingface) flows.
 ---
 
 # /edgegate-import
@@ -45,5 +45,5 @@ Use this skill when the user says any of:
 ## Failure modes
 
 - **"no ONNX file found"** — The repo doesn't contain a pre-built ONNX. EdgeGate v1 only supports repos with a pre-built ONNX file. Point the user to the dashboard upload flow for converting their own model: `https://edgegate.frozo.ai/workspace/<id>/models`.
-- **"private repo"** — EdgeGate v1 only imports public HuggingFace repos. Ask the user to make the repo public or use the direct upload flow instead.
+- **"private repo" / 401 from HuggingFace** — The anonymous endpoint can't read the repo (gated org like `qualcomm/*`, the user's own private repo, or a gated Llama family model). Offer to run `/edgegate-connect-huggingface` to attach a personal HF token to the workspace; once connected the same import call will succeed.
 - **402 — plan limit** — Direct the user to `https://edgegate.frozo.ai/pricing` to upgrade.

package/skills/edgegate-init.md

@@ -13,6 +13,10 @@ Goal of this skill: take the user from "I have a model file" to "every PR is aut
 
 1. **Confirm workspace.** Call `edgegate_setup_workspace` with no args. Present the list. Ask the user which one to use; if they say "the first one", pick `result[0].id`. Confirm before continuing.
 
+   If the list is empty OR the user wants a new workspace for this project, route to `/edgegate-workspace-setup` instead — that flow creates the workspace, connects Qualcomm AI Hub, optionally mints an API key for CI, and optionally invites teammates, all from chat.
+
+   If they have a workspace but it's missing the Qualcomm AI Hub integration (runs would fail with `NO_AIHUB_TOKEN`), run `/edgegate-connect-qaihub` first.
+
 2. **Define the pipeline.** Ask the user:
    - "Which model file do you want to gate? (path or artifact_id)"
    - "Which Snapdragon devices? (default: Samsung Galaxy S24, Galaxy S23)"
@@ -20,6 +24,8 @@ Goal of this skill: take the user from "I have a model file" to "every PR is aut
 
    If they hand you a file path (e.g. `./model.onnx`), tell them they need to upload it via the dashboard first to get an artifact_id (the MCP tool does not handle uploads in v1.0). Link: `https://edgegate.frozo.ai/workspace/{workspace_id}/models`.
 
+   If they hand you a HuggingFace repo id (e.g. `microsoft/resnet-50`), call `edgegate_import_huggingface_model` to import it and get an artifact_id back. If the repo is private / gated / from the Qualcomm org, the import will 401 — offer to run `/edgegate-connect-huggingface` to attach a personal HF token to the workspace, then retry the import.
+
    If they hand you an artifact_id, proceed to `edgegate_create_pipeline`.
 
 3. **Trigger the first run.** Call `edgegate_run_gate` with the workspace_id + new pipeline_id. Tell the user the run_id. Note that runs take 3-5 min per device.
@@ -28,6 +34,17 @@ Goal of this skill: take the user from "I have a model file" to "every PR is aut
 
 5. **Confirm.** Tell the user what's now set up: workspace `<name>`, pipeline `<name>`, run `<id>` in flight, and (if applicable) GitHub Action wired.
 
+## Input shape overrides (`input_specs`)
+
+If creating a pipeline for a text or audio model, the backend auto-resolves dynamic shapes
+(defaults: batch=1, sequence=128). If those defaults don't fit — long-context LLM, custom
+audio model, or mixed-input model — pass `input_specs` explicitly with the right shape per input.
+
+Examples:
+- Long-context BERT (seq_len=512): `{ input_ids: { shape: [1, 512], dtype: "int64" }, attention_mask: { shape: [1, 512], dtype: "int64" } }`
+- Audio model (mel-spectrogram): `{ mel_features: { shape: [1, 80, 3000], dtype: "float32" } }`
+- Image model: omit entirely — the backend reads static shapes from the ONNX file.
+
 ## Failure modes
 
 - **No workspaces.** The API key may have been revoked. Direct the user to `https://edgegate.frozo.ai/workspace/<id>/settings#api-keys` to generate a fresh key.

package/skills/edgegate-members.md

@@ -0,0 +1,51 @@
+---
+name: edgegate-members
+description: List, invite, change role of, or remove EdgeGate workspace members. Use for any "add Alice as admin", "show me who's on this workspace", "Bob left the team", or similar membership management.
+---
+
+# /edgegate-members
+
+Composes the four member tools into a single skill the LLM can route any
+membership-management request through.
+
+## Roles
+
+| Role | Can do | Can NOT do |
+|---|---|---|
+| `owner` | Everything: members, billing, delete workspace, AI Hub connect, pipelines, runs | (nothing — full power) |
+| `admin` | Pipelines, runs, integrations, members (except adding owners) | Billing, delete workspace, downgrade self |
+| `viewer` | Read pipelines, runs, reports, members | Anything write |
+
+## Steps by intent
+
+### "Show me the members" / "Who's on this workspace?"
+Call `edgegate_list_members({ workspace_id })`. Returns email + role + user_id.
+
+### "Add Alice as admin"
+1. Call `edgegate_invite_member({ workspace_id, user_email, role })`.
+2. If the response is 404, Alice doesn't have an EdgeGate account yet — tell
+   the user Alice needs to register at <https://edgegate.frozo.ai/register>
+   first, then re-run.
+3. If 409, Alice is already a member — offer to update her role with
+   `/edgegate-members → change role` instead.
+
+### "Make Bob an owner" / "Downgrade Carol to viewer"
+1. Get Bob's user_id from `edgegate_list_members` if not already known.
+2. Call `edgegate_change_member_role({ workspace_id, user_id, role })`.
+3. If the response is 400 with "Cannot remove the last owner", explain to
+   the user: they need to promote another member to owner first, then come
+   back to downgrade the original owner.
+
+### "Remove Dave"
+1. Get Dave's user_id.
+2. Confirm with the user (this is destructive — Dave loses access
+   immediately). Mention that Dave's pipelines and runs are preserved.
+3. Call `edgegate_remove_member({ workspace_id, user_id })`.
+4. Same last-owner guard as above applies.
+
+## Failure modes
+
+- **403** on invite / change / remove — the caller's own role is too low. The
+  detail message names the required role.
+- **404** on user lookup — the email or user_id doesn't exist in EdgeGate.
+- **plan_limit_exceeded** on invite — workspace seat cap; direct to pricing.