gogcli-mcp 2.29.1 → 3.0.0

package/src/connector-runtime.ts

@@ -13,7 +13,7 @@ export type { RunnerFailureKind } from './runner.js';
 
 // Runtime helpers for the Cloudflare connector (worker.ts), split out here so
 // they can be unit-tested under the node pool — worker.ts itself imports the
-// Worker-only `@chrischall/mcp-connector`/`agents` runtime and cannot load in
+// Worker-only `agents` runtime and cannot load in
 // node. These helpers touch only the `runExecutor` seam and global `fetch`.
 
 // Mirrors runner.ts's TIMEOUT_MS: the budget the stdio path gives a `gog` call
@@ -504,14 +504,11 @@ export function makeFlyExecutor(
   // Throttle state for the refusal probe, held PER EXECUTOR rather than in a
   // module-level map.
   //
-  // That is the scope the thing being throttled actually has: on the Worker one
-  // executor is built per agent session (`worker.ts` `init()`), on stdio one per
-  // process (`remote-runner.ts`). So a session that is hammering a refused
-  // credential rate-limits itself without a second, unrelated session's probe
-  // being suppressed by it — a module global would let one caller's retry loop
-  // silence everybody else's first and only measurement. It also means the state
-  // dies with the session instead of accumulating endpoints for the isolate's
-  // lifetime.
+  // That is the scope the thing being throttled actually has: the stateless
+  // Worker caches one executor per endpoint + connector key for the isolate,
+  // while stdio builds one per process (`remote-runner.ts`). Callers sharing a
+  // backend credential therefore share its throttle, without one credential's
+  // retry loop suppressing the first measurement for another credential.
   let lastProbeAt = Number.NEGATIVE_INFINITY;
 
   /**
@@ -860,10 +857,36 @@ async function attempt(
   return stdout;
 }
 
+/**
+ * Cache Fly executors by endpoint and connector key for one runtime isolate.
+ *
+ * `makeFlyExecutor` owns the refusal-probe throttle state, so resolving a new
+ * executor for every stateless tool call would reset that state and allow each
+ * retry to spawn another keyring-locking Google probe.
+ */
+export function createFlyExecutorResolver(
+  factory: (endpoint: string, key: string) => GogExecutor = makeFlyExecutor,
+): (endpoint: string, key: string) => GogExecutor {
+  const byEndpoint = new Map<string, Map<string, GogExecutor>>();
+  return (endpoint, key) => {
+    let byKey = byEndpoint.get(endpoint);
+    if (!byKey) {
+      byKey = new Map();
+      byEndpoint.set(endpoint, byKey);
+    }
+    let executor = byKey.get(key);
+    if (!executor) {
+      executor = factory(endpoint, key);
+      byKey.set(key, executor);
+    }
+    return executor;
+  };
+}
+
 // Wrap an McpServer in a Proxy whose `registerTool` (and `tool`, if any
 // registrar uses it) intercepts the tool handler so it runs inside the
 // `runExecutor` ALS scope. This is the crux of the connector: it lets the
-// UNCHANGED base registrars forward every `gog` call to the per-session Fly
+// UNCHANGED base registrars forward every `gog` call to the request's Fly
 // executor without any change to the registrars or `runner.ts` — when a
 // handler's `run()` looks up `runExecutor.getStore()` it finds `executor` and
 // forwards instead of spawning. Everything else proxies through via Reflect.

package/src/gmail-dispatch-guard.ts

@@ -0,0 +1,106 @@
+import type { CallToolResult, InputRequiredResult, ServerContext } from '@modelcontextprotocol/server';
+import { readEnvVar, requireConfirmation } from '@chrischall/mcp-utils';
+
+// ============================================================================
+// THE SAFETY RAIL. gog_gmail_reply / reply_all / send / forward / autoreply are
+// the only tools in this fleet that put a message irreversibly into someone
+// else's mailbox on the FIRST call. Every other Gmail write either stages
+// something (drafts) or acts on mail already in this account (labels,
+// archive, trash). A caller that meant "save a draft" and picked the wrong
+// tool — or an agent that inherited the wrong reply target — used to find out
+// only after the send API call already succeeded.
+//
+// MCP elicitation makes the first round inert: it returns an input_required
+// result containing the preview, and only the protocol retry carrying the
+// user's accepted confirmation dispatches. The confirmation is never a tool
+// argument, so a model cannot bypass the user by setting a boolean itself.
+// ============================================================================
+/** Apply the shared stateless confirmation flow with Gmail-specific copy. */
+export function requireGmailDispatchConfirmation(
+  ctx: ServerContext,
+  op: string,
+  details: Record<string, unknown>,
+): InputRequiredResult | CallToolResult | undefined {
+  return requireConfirmation(ctx, {
+    action: op,
+    message: 'Review and confirm this email dispatch:',
+    details,
+    confirmationLabel: 'Confirm that this email should be sent now.',
+  });
+}
+
+// Over-inclusive on purpose: this feeds an audit log and a caller-facing
+// preview, neither of which is the enforcement point (the protocol gate is).
+// Missing a real recipient would be the dangerous direction of error; catching
+// an extra email-shaped substring is not.
+const EMAIL_PATTERN = /[a-z0-9!#$%&'*+/=?^_`{|}~.-]+@[a-z0-9-]+(?:\.[a-z0-9-]+)+/gi;
+
+export function extractEmails(...values: Array<string | undefined | null>): string[] {
+  const seen = new Set<string>();
+  const out: string[] = [];
+  for (const value of values) {
+    if (!value) continue;
+    const matches = value.match(EMAIL_PATTERN);
+    if (!matches) continue;
+    for (const match of matches) {
+      const lower = match.toLowerCase();
+      if (!seen.has(lower)) {
+        seen.add(lower);
+        out.push(lower);
+      }
+    }
+  }
+  return out;
+}
+
+// GOG_GMAIL_TRUSTED_DOMAINS names domains that are never "external" — by
+// default just the sending account's own domain, so a reply-all that includes
+// the account itself never reads as a surprise. Comma-separated, additive.
+function trustedDomains(account: string | undefined): Set<string> {
+  const domains = new Set<string>();
+  const raw = readEnvVar('GOG_GMAIL_TRUSTED_DOMAINS');
+  if (raw) {
+    for (const part of raw.split(',')) {
+      const domain = part.trim().toLowerCase();
+      if (domain) domains.add(domain);
+    }
+  }
+  const acct = account ?? readEnvVar('GOG_ACCOUNT');
+  const at = acct?.indexOf('@') ?? -1;
+  if (acct && at > -1) domains.add(acct.slice(at + 1).toLowerCase());
+  return domains;
+}
+
+// A distinguishable, greppable event for every mail dispatch — recipient
+// count plus whichever recipients fall outside the trusted-domain list — so an
+// unexpected external send (outside counsel, a wrong-number alias) can be
+// caught after the fact even if the confirmation step above is somehow
+// bypassed by a future caller. stdout is the JSON-RPC channel, so this goes to
+// stderr like every other diagnostic in this repo.
+export function logGmailDispatch(tool: string, recipients: string[], account?: string): void {
+  const domains = trustedDomains(account);
+  const externalRecipients = recipients.filter((recipient) => {
+    const at = recipient.indexOf('@');
+    const domain = at > -1 ? recipient.slice(at + 1) : '';
+    return !domain || !domains.has(domain);
+  });
+  const event = {
+    event: 'gmail_dispatch',
+    tool,
+    recipientCount: recipients.length,
+    externalRecipientCount: externalRecipients.length,
+    hasExternalRecipients: externalRecipients.length > 0,
+    externalRecipients,
+    timestamp: new Date().toISOString(),
+  };
+  process.stderr.write(`${JSON.stringify(event)}\n`);
+}
+
+// The single place a CallToolResult's text is pulled back out, for the tools
+// here that need to read gog's own JSON before deciding what to preview or
+// log. Mirrors the shape every runOrDiagnose result actually returns
+// (content[0].text); never throws on an unexpected shape.
+export function resultText(result: CallToolResult): string {
+  const first = result.content[0];
+  return first && first.type === 'text' && typeof first.text === 'string' ? first.text : '{}';
+}

package/src/gmail-results.ts

@@ -1,4 +1,4 @@
-import type { CallToolResult } from '@modelcontextprotocol/sdk/types.js';
+import type { CallToolResult } from '@modelcontextprotocol/server';
 import { rawTextResult } from '@chrischall/mcp-utils';
 import { run } from './runner.js';
 import { annotateTruncation, hasMorePages } from './pagination.js';

package/src/lib.ts

@@ -21,6 +21,16 @@ export {
 // same tool name from both registrar lists would be a duplicate-name error.
 export { replySchema, appendReplyFlags } from './tools/gmail.js';
 export type { ReplyFlags } from './tools/gmail.js';
+// The gmail confirmation gate — gog_gmail_reply/send/forward/autoreply are
+// the only tools that dispatch mail irreversibly on the first call. The
+// gmail sub-package's send-side forward/autoreply tools reuse these directly
+// rather than re-declaring the gate; the draft-side twins never import them.
+export {
+  extractEmails,
+  logGmailDispatch,
+  requireGmailDispatchConfirmation,
+  resultText,
+} from './gmail-dispatch-guard.js';
 export { run, runBinary, runExecutor, isGogFileArg, MIN_GOG_VERSION } from './runner.js';
 // Sub-package tools that read gog JSON through bare `run()` (rather than the
 // `runOrDiagnose` seam) must still apply this, or their timestamps skip the
@@ -64,3 +74,22 @@ export {
   registerRunTool,
   assertNotBoth,
 } from './tools/utils.js';
+// Signed URLs for mcp-host's per-registration blob store — the only way a
+// hosted child can hand an agent BYTES it can fetch with `curl`. Exported from
+// the base package so the gmail sub-package (and any later one) shares ONE
+// implementation of the signing; see src/blob-urls.ts for why that matters.
+// Deliberately NOT re-exporting the payload builders: a caller outside this
+// module has no business assembling a payload and signing it by hand, which is
+// the mistake the shared minter exists to prevent.
+export {
+  blobStoreFromEnv,
+  createBlobUrlMinter,
+  BLOB_URL_MAX_TTL_MS,
+  BLOB_URL_DEFAULT_TTL_MS,
+} from './blob-urls.js';
+export type { BlobStoreConfig, BlobUrlMinter, MintOptions } from './blob-urls.js';
+// The other half of that hop: under the hosted connector the bytes are on the
+// RUNNER's disk and this child never sees them, so the runner is asked to
+// stream them to the URL this process minted. See src/blob-upload.ts.
+export { uploadToBlobStore, RUNNER_UPLOAD_TIMEOUT_MS } from './blob-upload.js';
+export type { BlobUploadRequest, BlobUploadOutcome, BlobUploadOptions } from './blob-upload.js';

package/src/pagination.ts

@@ -1,4 +1,4 @@
-import type { CallToolResult } from '@modelcontextprotocol/sdk/types.js';
+import type { CallToolResult } from '@modelcontextprotocol/server';
 import { rawTextResult } from '@chrischall/mcp-utils';
 
 // gog reports an exhausted cursor as `"nextPageToken": ""` rather than omitting

package/src/runner.ts

@@ -217,7 +217,7 @@ const TIMEOUT_MS = 30_000;
 // so the requirement change is surfaced in the release notes (see
 // .github/release.yml). This is the single source of truth for the required
 // version; keep the README/CLAUDE.md mention in sync.
-export const MIN_GOG_VERSION = '0.39.1';
+export const MIN_GOG_VERSION = '0.40.0';
 
 // Interpret the GOG_READONLY kill-switch. `readEnvVar` already treats blank
 // values, 'undefined'/'null' sentinels, and unresolved .mcpb placeholders
@@ -236,12 +236,29 @@ function readonlyEnvEnabled(): boolean {
 // instead of the stored refresh token. The broader patterns are
 // defense-in-depth — the parent process's shell may have other Google /
 // cloud / API secrets in scope that the child has no business seeing.
+//
+// `_KEY`, not `_API_KEY|_PRIVATE_KEY`: those were four spellings of "a key"
+// with the bare one missing, and TWO credentials this repo hands its own
+// process fell in that gap. `MCP_BLOB_SIGNING_KEY` mints the signed blob URLs
+// a `deliver="url"` download is uploaded to — a signature IS the whole access
+// control on that store — and `GOG_RUNNER_KEY` is the bearer for the Fly
+// backend, where `POST /run` is arbitrary `gog` argv. Neither is read by the
+// child: both are spent HERE, and when `GOG_RUNNER_URL` is set nothing is
+// spawned at all. `_CREDENTIALS` generalises the named
+// GOOGLE_APPLICATION_CREDENTIALS above, which stays named because it is the
+// one gog itself would act on.
+//
+// The list is bounded by what the child LEGITIMATELY READS, which is why
+// `_PASSWORD` is deliberately NOT on it: `GOG_KEYRING_PASSWORD` decrypts gog's
+// own file keyring (`GOG_KEYRING_BACKEND=file`), so that rule would strip the
+// one credential the child needs and turn every call into an auth failure.
+// Both directions are tested — a widening with no control case is a guess.
 function sanitizedEnv(): NodeJS.ProcessEnv {
   const result: NodeJS.ProcessEnv = {};
   for (const [key, value] of Object.entries(process.env)) {
     if (key === 'GOG_ACCESS_TOKEN') continue;
     if (key === 'GOOGLE_APPLICATION_CREDENTIALS') continue;
-    if (/(_TOKEN|_SECRET|_API_KEY|_PRIVATE_KEY)$/.test(key)) continue;
+    if (/(_TOKEN|_SECRET|_KEY|_CREDENTIALS)$/.test(key)) continue;
     result[key] = value;
   }
   return result;

package/src/tools/api.ts

@@ -1,4 +1,4 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { McpServer } from '@modelcontextprotocol/server';
 import { z } from 'zod';
 import { accountParam, runOrDiagnose } from './utils.js';
 
@@ -10,10 +10,10 @@ export function registerApiTools(server: McpServer): void {
   server.registerTool('gog_api_list', {
     description: 'List the Google Discovery APIs available for gog_api_call / gog_api_describe (name + version + title).',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       all: z.boolean().optional().describe('Include every Discovery API (including preview/less-common ones) instead of the curated default set'),
       account: accountParam,
-    },
+    }),
   }, async ({ all, account }) => {
     const args = ['api', 'list'];
     if (all) args.push('--all');
@@ -23,12 +23,12 @@ export function registerApiTools(server: McpServer): void {
   server.registerTool('gog_api_describe', {
     description: 'Describe a Google Discovery API, or a single method within it — its parameters, request/response schema, and required OAuth scopes. Use this to discover the exact api/version/method and params before calling gog_api_call.',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       api: z.string().describe('Discovery API name (e.g. drive, gmail, calendar)'),
       version: z.string().describe('API version (e.g. v3, v1)'),
       method: z.string().optional().describe('Optional method id to describe a single method (e.g. files.list); omit to describe the whole API'),
       account: accountParam,
-    },
+    }),
   }, async ({ api, version, method, account }) => {
     const args = ['api', 'describe', api, version];
     if (method) args.push(method);
@@ -38,7 +38,7 @@ export function registerApiTools(server: McpServer): void {
   server.registerTool('gog_api_call', {
     description: 'Call any Discovery-described Google API method directly — an escape hatch for endpoints gog has no dedicated tool for. Find the exact api/version/method/params with gog_api_describe first. Read methods (GET/LIST) run as-is. Mutating methods (POST/PUT/PATCH/DELETE) are refused unless you set allowWrite=true — keep it false to preview, or set dryRun=true to print the intended request without sending it.',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       api: z.string().describe('Discovery API name (e.g. drive, gmail, calendar)'),
       version: z.string().describe('API version (e.g. v3, v1)'),
       method: z.string().describe('Method id to call (e.g. files.list, files.create)'),
@@ -48,7 +48,7 @@ export function registerApiTools(server: McpServer): void {
       allowWrite: z.boolean().optional().describe('Required to invoke a mutating method (POST/PUT/PATCH/DELETE). Without it, gog refuses write methods. Leave unset for read-only calls.'),
       dryRun: z.boolean().optional().describe('Print the intended request and exit without sending it (no changes made)'),
       account: accountParam,
-    },
+    }),
   }, async ({ api, version, method, params, body, scope, allowWrite, dryRun, account }) => {
     const args = ['api', 'call', api, version, method];
     if (params) args.push(`--params=${params}`);

package/src/tools/appscript.ts

@@ -1,4 +1,4 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { McpServer } from '@modelcontextprotocol/server';
 import { z } from 'zod';
 import {
   accountParam,
@@ -35,10 +35,10 @@ export function registerAppScriptTools(server: McpServer): void {
       'Get an Apps Script project\'s metadata: title, creator, create/update times, and the parent Drive file when the '
       + 'project is bound to a Sheet, Doc or Form. Use gog_appscript_content to read the actual code.' + apiEnableNote,
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       scriptId: scriptIdParam,
       account: accountParam,
-    },
+    }),
   }, async ({ scriptId, account }) => {
     return runOrDiagnose(['appscript', 'get', scriptId], { account });
   });
@@ -49,10 +49,10 @@ export function registerAppScriptTools(server: McpServer): void {
       + 'tool to reach for when the question is "what does this script do"; it needs no filesystem, so it works the same '
       + 'on a hosted deployment as it does locally, unlike gog_appscript_pull.' + apiEnableNote,
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       scriptId: scriptIdParam,
       account: accountParam,
-    },
+    }),
   }, async ({ scriptId, account }) => {
     return runOrDiagnose(['appscript', 'content', scriptId], { account });
   });
@@ -65,12 +65,12 @@ export function registerAppScriptTools(server: McpServer): void {
       + 'reach them. Use gog_appscript_content there instead — it returns the same source in the response. Existing files '
       + 'are left alone unless overwrite is set. Read-only as far as Google is concerned: nothing is pushed back.'
       + apiEnableNote,
-    inputSchema: {
+    inputSchema: z.object({
       scriptId: scriptIdParam,
       dir: z.string().describe('Destination directory, resolved on the machine where gog runs'),
       overwrite: z.boolean().optional().describe('Overwrite files that already exist in dir'),
       account: accountParam,
-    },
+    }),
   }, async ({ scriptId, dir, overwrite, account }) => {
     const args = ['appscript', 'pull', scriptId, dir];
     if (overwrite) args.push('--overwrite');
@@ -82,11 +82,11 @@ export function registerAppScriptTools(server: McpServer): void {
       'Create a new, empty Apps Script project. Pass parentId to bind it to a Drive file (a Sheet, Doc or Form), which is '
       + 'what makes the script a container-bound script with access to that document; omit it for a standalone project. '
       + 'gog cannot upload code, so the project starts empty either way.' + apiEnableNote,
-    inputSchema: {
+    inputSchema: z.object({
       title: z.string().describe('Project title'),
       parentId: z.string().optional().describe('Drive file ID to bind the project to (Sheet, Doc or Form). Omit for a standalone project.'),
       account: accountParam,
-    },
+    }),
   }, async ({ title, parentId, account }) => {
     const args = ['appscript', 'create', `--title=${title}`];
     if (parentId) args.push(`--parent-id=${parentId}`);
@@ -99,11 +99,11 @@ export function registerAppScriptTools(server: McpServer): void {
       + 'deployment ID from here is what gog_appscript_run_function needs when a script is not running in dev mode.'
       + apiEnableNote,
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       scriptId: scriptIdParam,
       ...paginationParams,
       account: accountParam,
-    },
+    }),
   }, async ({ scriptId, max, pageToken, page, all, account }) => {
     const args = ['appscript', 'deployments', scriptId];
     pushPaginationFlags(args, { max, pageToken, page, all });
@@ -115,11 +115,11 @@ export function registerAppScriptTools(server: McpServer): void {
       'List a project\'s saved versions — the immutable snapshots deployments point at, with their numbers and '
       + 'descriptions. Useful for answering "what is actually deployed" next to gog_appscript_deployments.' + apiEnableNote,
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       scriptId: scriptIdParam,
       ...paginationParams,
       account: accountParam,
-    },
+    }),
   }, async ({ scriptId, max, pageToken, page, all, account }) => {
     const args = ['appscript', 'versions', scriptId];
     pushPaginationFlags(args, { max, pageToken, page, all });
@@ -136,13 +136,13 @@ export function registerAppScriptTools(server: McpServer): void {
       + 'deployed version, and only works if the account owns the script. '
       + 'This is NOT the escape hatch — gog_appscript_run is that.' + apiEnableNote,
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       scriptId: scriptIdParam,
       functionName: z.string().describe('Name of the function to call, e.g. "doWork"'),
       params: z.string().optional().describe('Function parameters as a JSON ARRAY of positional arguments, e.g. \'["a", 1]\' — not an object'),
       devMode: z.boolean().optional().describe('Run the latest saved code rather than the deployed version (owner only)'),
       account: accountParam,
-    },
+    }),
   }, async ({ scriptId, functionName, params, devMode, account }) => {
     // gog passes --params through to the API as-is, so a malformed value comes
     // back as a Google error about the request body rather than about the

package/src/tools/auth.ts

@@ -1,4 +1,4 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { McpServer } from '@modelcontextprotocol/server';
 import { z } from 'zod';
 import { run } from '../runner.js';
 import { errorResult, rawTextResult } from '@chrischall/mcp-utils';
@@ -35,7 +35,7 @@ function registerAuthToolsWith(server: McpServer, defaultServices: string): void
       'exactly like a healthy one, scopes and all. Use gog_auth_health to check whether an account ' +
       'can actually authenticate.',
     annotations: { readOnlyHint: true },
-    inputSchema: {},
+    inputSchema: z.object({}),
   }, async () => {
     try {
       return rawTextResult(await run(['auth', 'list']));
@@ -50,7 +50,7 @@ function registerAuthToolsWith(server: McpServer, defaultServices: string): void
       'name this is not a health check — it reads local setup and does not contact Google, so it says ' +
       'nothing about whether an account can still authenticate. Use gog_auth_health for that.',
     annotations: { readOnlyHint: true },
-    inputSchema: {},
+    inputSchema: z.object({}),
   }, async () => {
     try {
       return rawTextResult(await run(['auth', 'status']));
@@ -72,7 +72,7 @@ function registerAuthToolsWith(server: McpServer, defaultServices: string): void
       'connector key that reaches the gog machine, and nothing else — the Google credential lives on ' +
       'that machine and can be dead while the connection looks perfectly healthy.',
     annotations: { readOnlyHint: true },
-    inputSchema: {},
+    inputSchema: z.object({}),
   }, async () => {
     try {
       // `run` injects --json; --check makes gog probe each token live.
@@ -85,7 +85,7 @@ function registerAuthToolsWith(server: McpServer, defaultServices: string): void
   server.registerTool('gog_auth_services', {
     description: 'List all Google services supported by gogcli and the OAuth scopes each requires.',
     annotations: { readOnlyHint: true },
-    inputSchema: {},
+    inputSchema: z.object({}),
   }, async () => {
     try {
       return rawTextResult(await run(['auth', 'services']));
@@ -102,11 +102,11 @@ function registerAuthToolsWith(server: McpServer, defaultServices: string): void
       'If the browser does not open automatically, a fallback URL is included in the response. ' +
       'Use gog_auth_list to check which accounts are already configured.',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       email: z.string().describe('Google account email to authorize'),
       services: z.string().optional().default(defaultServices).describe(servicesDescribe),
       extraScopes: z.string().optional().describe(extraScopesDescribe),
-    },
+    }),
   }, async ({ email, services = defaultServices, extraScopes }) => {
     try {
       const args = ['auth', 'add', email, '--services', services];
@@ -135,11 +135,11 @@ function registerAuthToolsWith(server: McpServer, defaultServices: string): void
       'full redirected URL (from the address bar) and you pass it to gog_auth_add_complete. The link is ' +
       'valid for 10 minutes. If you pass a custom `services` here, pass the SAME value to ' +
       'gog_auth_add_complete or the second step will not match this one.',
-    inputSchema: {
+    inputSchema: z.object({
       email: z.string().describe('Google account email to authorize'),
       services: z.string().optional().default(defaultServices).describe(servicesDescribe),
       extraScopes: z.string().optional().describe(`${extraScopesDescribe} Pass the SAME value to gog_auth_add_complete.`),
-    },
+    }),
   }, async ({ email, services = defaultServices, extraScopes }) => {
     try {
       // --force-consent guarantees a refresh token even if a prior grant exists
@@ -161,7 +161,7 @@ function registerAuthToolsWith(server: McpServer, defaultServices: string): void
       'it. Use the SAME `services` value you passed to gog_auth_add_url. Must run within 10 minutes of ' +
       'step 1 and against the same gogcli host.',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       email: z.string().describe('Google account email being authorized (same as step 1)'),
       redirectUrl: z.string().describe(
         'The full localhost redirect URL the user copied from the browser address bar after signing in ' +
@@ -174,7 +174,7 @@ function registerAuthToolsWith(server: McpServer, defaultServices: string): void
         'Extra OAuth scope URIs — MUST match the value passed to gog_auth_add_url, for the same reason `services` must: ' +
         'the two steps have to describe the same grant.',
       ),
-    },
+    }),
   }, async ({ email, redirectUrl, services = defaultServices, extraScopes }) => {
     try {
       const args = ['auth', 'add', email, '--remote', '--step', '2', '--auth-url', redirectUrl,

package/src/tools/calendar.ts

@@ -1,4 +1,4 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { McpServer } from '@modelcontextprotocol/server';
 import { z } from 'zod';
 import { viewParam, resolveView } from '@chrischall/mcp-utils';
 import { accountParam, runOrDiagnose, registerRunTool, pageTokenParam, pageAliasParam, resolvePageToken } from './utils.js';
@@ -82,7 +82,7 @@ export function registerCalendarTools(server: McpServer): void {
       + 'gog returns only 10 events by default, so a wide date range is USUALLY INCOMPLETE: raise max, or page with pageToken until the response carries no nextPageToken. '
       + 'A response carrying "truncated": true is an incomplete view — never conclude an event does not exist from one.',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       calendarId: z.string().optional().describe('Calendar ID (default: primary calendar)'),
       from: z.string().optional().describe('Start time filter (RFC3339, date, or natural language)'),
       to: z.string().optional().describe('End time filter (RFC3339, date, or natural language). Mutually exclusive with today and with days.'),
@@ -105,7 +105,7 @@ export function registerCalendarTools(server: McpServer): void {
           + 'listing\'s bytes — plus etag/iCalUID/kind. Ask for full when you need a body or a guest list.',
       }),
       account: accountParam,
-    },
+    }),
   }, async ({ calendarId, from, to, days, today, query, max, pageToken, page, all, eventTypes, timezone, view, account }) => {
     const args = ['calendar', 'events'];
     if (calendarId) args.push(calendarId);
@@ -134,12 +134,12 @@ export function registerCalendarTools(server: McpServer): void {
   server.registerTool('gog_calendar_get', {
     description: 'Get a specific calendar event by ID.',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       calendarId: z.string().describe('Calendar ID'),
       eventId: z.string().describe('Event ID'),
       timezone: z.string().optional().describe('Display timezone for event times (IANA name, e.g. America/New_York, or "local" for the system timezone). Default: the event\'s timezone, then its calendar\'s timezone.'),
       account: accountParam,
-    },
+    }),
   }, async ({ calendarId, eventId, timezone, account }) => {
     const args = ['calendar', 'event', calendarId, eventId];
     if (timezone) args.push(`--timezone=${timezone}`);
@@ -149,7 +149,7 @@ export function registerCalendarTools(server: McpServer): void {
   server.registerTool('gog_calendar_create', {
     description: 'Create a calendar event. Set withZoom=true to attach a Zoom meeting (requires Zoom S2S OAuth setup via gog_zoom_auth_setup; the join URL + meeting ID + passcode are appended to the event description — Google rejects native conference card writes from non-Workspace-Marketplace OAuth clients).',
     annotations: { destructiveHint: false },
-    inputSchema: {
+    inputSchema: z.object({
       calendarId: z.string().describe('Calendar ID (use "primary" for the default calendar)'),
       summary: z.string().describe('Event title'),
       from: z.string().describe('Start time (RFC3339 or date for all-day events)'),
@@ -162,7 +162,7 @@ export function registerCalendarTools(server: McpServer): void {
       withZoom: z.boolean().optional().describe('Create a Zoom video conference for this event (requires Zoom S2S OAuth setup)'),
       ...reminderParams,
       account: accountParam,
-    },
+    }),
   }, async ({ calendarId, summary, from, to, description, location, attendees, allDay, timezone, withZoom, reminders, noReminders, account }) => {
     const args = ['calendar', 'create', calendarId, `--summary=${summary}`, `--from=${from}`, `--to=${to}`];
     if (description) args.push(`--description=${description}`);
@@ -178,7 +178,7 @@ export function registerCalendarTools(server: McpServer): void {
   server.registerTool('gog_calendar_update', {
     description: 'Update an existing calendar event. Zoom: withZoom adds a Zoom meeting, regenerateZoom replaces the existing one, removeZoom strips it. removeMeet clears the event\'s Google Meet conference data (e.g. before attaching another provider). Conference flags are independent — use one per call.',
     annotations: { destructiveHint: false },
-    inputSchema: {
+    inputSchema: z.object({
       calendarId: z.string().describe('Calendar ID'),
       eventId: z.string().describe('Event ID'),
       summary: z.string().optional().describe('New event title'),
@@ -195,7 +195,7 @@ export function registerCalendarTools(server: McpServer): void {
       removeMeet: z.boolean().optional().describe('Remove the event\'s Google Meet video conference (clears conference data only)'),
       ...reminderParams,
       account: accountParam,
-    },
+    }),
   }, async ({ calendarId, eventId, summary, from, to, description, location, attendees, addAttendees, attachments, withZoom, regenerateZoom, removeZoom, removeMeet, reminders, noReminders, account }) => {
     const args = ['calendar', 'update', calendarId, eventId];
     if (summary !== undefined) args.push(`--summary=${summary}`);
@@ -217,11 +217,11 @@ export function registerCalendarTools(server: McpServer): void {
   server.registerTool('gog_calendar_delete', {
     description: 'Delete a calendar event.',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       calendarId: z.string().describe('Calendar ID'),
       eventId: z.string().describe('Event ID'),
       account: accountParam,
-    },
+    }),
   }, async ({ calendarId, eventId, account }) => {
     // gog gates this delete behind a confirmation; the runner injects
     // --no-input, so without --force it refuses at runtime.
@@ -231,13 +231,13 @@ export function registerCalendarTools(server: McpServer): void {
   server.registerTool('gog_calendar_respond', {
     description: 'Respond to a calendar event invitation.',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       calendarId: z.string().describe('Calendar ID'),
       eventId: z.string().describe('Event ID'),
       status: z.enum(['accepted', 'declined', 'tentative']).describe('Response status'),
       comment: z.string().optional().describe('Optional comment to include with response'),
       account: accountParam,
-    },
+    }),
   }, async ({ calendarId, eventId, status, comment, account }) => {
     const args = ['calendar', 'respond', calendarId, eventId, `--status=${status}`];
     if (comment) args.push(`--comment=${comment}`);