gogcli-mcp 2.30.0 → 3.0.0

package/manifest.json

@@ -3,7 +3,7 @@
   "manifest_version": "0.3",
   "name": "gogcli-mcp",
   "display_name": "gogcli",
-  "version": "2.30.0",
+  "version": "3.0.0",
   "description": "Google Sheets (and more) for Claude via gogcli — read, write, and manage spreadsheets",
   "author": {
     "name": "Chris Hall",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gogcli-mcp",
-  "version": "2.30.0",
+  "version": "3.0.0",
   "mcpName": "io.github.chrischall/gogcli-mcp",
   "description": "MCP server wrapping gogcli for Google service access",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -41,8 +41,8 @@
     "test:coverage": "vitest run --coverage"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^0.23.3",
-    "@modelcontextprotocol/sdk": "^1.30.0",
+    "@chrischall/mcp-utils": "^0.28.0",
+    "@modelcontextprotocol/server": "^2.0.0",
     "zod": "^4.6.1"
   },
   "devDependencies": {

package/server.json

@@ -7,12 +7,12 @@
     "source": "github",
     "subfolder": "packages/gogcli-mcp"
   },
-  "version": "2.30.0",
+  "version": "3.0.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "gogcli-mcp",
-      "version": "2.30.0",
+      "version": "3.0.0",
       "transport": {
         "type": "stdio"
       },

package/src/connector-auth.ts

@@ -1,24 +1,40 @@
-import type { ConnectorAuth } from '@chrischall/mcp-connector';
 import { logAuthTransition, type AuthTransition } from './auth-log.js';
 import { readGoogleProbe } from './google-probe.js';
 import { redactSecrets } from './runner.js';
 
+/** One credential field rendered by the connector authorization page. */
+export interface LoginField {
+  name: string;
+  label: string;
+  type?: 'text' | 'password';
+}
+
+/** Login-page configuration consumed by the local authorization handler. */
+export interface ConnectorAuth<Props> {
+  service: string;
+  fields: LoginField[];
+  userId?: string;
+  login(fields: Record<string, string>, env: unknown): Promise<Props>;
+  privacyNote?: string;
+  accent?: string;
+}
+
 /**
  * OAuth props stored per user by the Cloudflare connector's OAuth provider.
  *
  * The gogcli remote connector authenticates each user with a single long-lived
  * personal "connector key" — a shared secret (the Fly backend's `RUNNER_KEY`)
  * that authorizes calls to that user's own `gog` backend on Fly.io. There is no
- * refresh cycle: `worker.ts`'s `buildClient` turns this key straight into a
- * per-session Fly executor. These props are encrypted at rest in `OAUTH_KV` by
+ * refresh cycle: `worker.ts` resolves this key to a cached Fly executor for
+ * each stateless request. These props are encrypted at rest in `OAUTH_KV` by
  * the OAuth provider.
  *
  * NOTE: this is a FIELD LOGIN (a personal key), NOT Google OAuth. The Google
  * OAuth handshake lives entirely inside the Fly backend's `gog` install; the
  * connector never sees a Google token.
  *
- * The index signature satisfies `createConnector`'s
- * `Props extends Record<string, unknown>` constraint.
+ * The index signature keeps these props usable across the OAuth provider and
+ * MCP request-context boundaries.
  */
 export interface GogProps {
   key: string;
@@ -275,7 +291,7 @@ async function recordGoogleLayerAtConnect(endpoint: string, key: string): Promis
  * `ConnectorAuth` for the gogcli remote connector: the login page collects the
  * user's connector key, verifies it by hitting the Fly backend's `/health`
  * endpoint with the key as a bearer token, and stores `{ key }` as the OAuth
- * props that `worker.ts`'s `buildClient` turns into a per-session Fly executor.
+ * props that `worker.ts` turns into a request-scoped Fly executor.
  *
  * Only the runner judging the bearer (401/403) refuses the login; a backend that
  * does not answer is retried once and then reported as unreachable, never as a

package/src/connector-login.ts

@@ -0,0 +1,87 @@
+import type { ConnectorAuth } from './connector-auth.js';
+
+function escapeHtml(value: unknown): string {
+  return String(value)
+    .replaceAll('&', '&')
+    .replaceAll('<', '&lt;')
+    .replaceAll('>', '&gt;')
+    .replaceAll('"', '&quot;')
+    .replaceAll("'", '&#39;');
+}
+
+function encodeOauthRequest(value: unknown): string {
+  return btoa(JSON.stringify(value));
+}
+
+function renderLoginPage<Props>(
+  auth: ConnectorAuth<Props>,
+  options: { oauthReq: unknown; error?: string },
+): string {
+  const fields = auth.fields.map((field) => `
+    <label>${escapeHtml(field.label)}
+      <input name="${escapeHtml(field.name)}" type="${field.type ?? 'text'}" required>
+    </label>`).join('');
+  return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width">
+<title>Connect ${escapeHtml(auth.service)}</title>
+<style>body{font:16px system-ui;max-width:34rem;margin:4rem auto;padding:0 1rem;color:#202124}form{display:grid;gap:1rem}label{display:grid;gap:.4rem}input,button{font:inherit;padding:.7rem}button{color:white;background:${escapeHtml(auth.accent ?? '#444')};border:0;border-radius:.3rem}.error{color:#b3261e}</style>
+</head><body><h1>Connect ${escapeHtml(auth.service)}</h1>
+${options.error ? `<p class="error">${escapeHtml(options.error)}</p>` : ''}
+<form method="post">${fields}
+<input type="hidden" name="oauthReq" value="${escapeHtml(encodeOauthRequest(options.oauthReq))}">
+<button type="submit">Authorize</button></form>
+${auth.privacyNote ? `<p>${escapeHtml(auth.privacyNote)}</p>` : ''}
+</body></html>`;
+}
+
+function messageOf(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}
+
+/** Serve the connector's GET login form and POST authorization completion. */
+export async function handleAuthorize<Props>(
+  request: Request,
+  env: {
+    OAUTH_PROVIDER: {
+      parseAuthRequest(request: Request): Promise<unknown>;
+      completeAuthorization(input: unknown): Promise<{ redirectTo: string }>;
+    };
+  },
+  auth: ConnectorAuth<Props>,
+): Promise<Response> {
+  if (request.method === 'GET') {
+    const oauthReq = await env.OAUTH_PROVIDER.parseAuthRequest(request);
+    return new Response(renderLoginPage(auth, { oauthReq }), {
+      headers: { 'content-type': 'text/html' },
+    });
+  }
+
+  const formData = await request.formData();
+  const encodedOauthReq = formData.get('oauthReq');
+  const oauthReq = typeof encodedOauthReq === 'string'
+    ? JSON.parse(atob(encodedOauthReq))
+    : undefined;
+  const fields = Object.fromEntries(auth.fields.map((field) => {
+    const value = formData.get(field.name);
+    return [field.name, typeof value === 'string' ? value : ''];
+  }));
+
+  try {
+    const props = await auth.login(fields, env);
+    const firstField = auth.fields[0];
+    const userId = auth.userId ?? (firstField ? fields[firstField.name] : 'public');
+    const { redirectTo } = await env.OAUTH_PROVIDER.completeAuthorization({
+      request: oauthReq,
+      userId,
+      scope: [],
+      metadata: {},
+      props,
+    });
+    return Response.redirect(redirectTo, 302);
+  } catch (error) {
+    return new Response(renderLoginPage(auth, { oauthReq, error: messageOf(error) }), {
+      status: 200,
+      headers: { 'content-type': 'text/html' },
+    });
+  }
+}

package/src/connector-runtime.ts

@@ -13,7 +13,7 @@ export type { RunnerFailureKind } from './runner.js';
 
 // Runtime helpers for the Cloudflare connector (worker.ts), split out here so
 // they can be unit-tested under the node pool — worker.ts itself imports the
-// Worker-only `@chrischall/mcp-connector`/`agents` runtime and cannot load in
+// Worker-only `agents` runtime and cannot load in
 // node. These helpers touch only the `runExecutor` seam and global `fetch`.
 
 // Mirrors runner.ts's TIMEOUT_MS: the budget the stdio path gives a `gog` call
@@ -504,14 +504,11 @@ export function makeFlyExecutor(
   // Throttle state for the refusal probe, held PER EXECUTOR rather than in a
   // module-level map.
   //
-  // That is the scope the thing being throttled actually has: on the Worker one
-  // executor is built per agent session (`worker.ts` `init()`), on stdio one per
-  // process (`remote-runner.ts`). So a session that is hammering a refused
-  // credential rate-limits itself without a second, unrelated session's probe
-  // being suppressed by it — a module global would let one caller's retry loop
-  // silence everybody else's first and only measurement. It also means the state
-  // dies with the session instead of accumulating endpoints for the isolate's
-  // lifetime.
+  // That is the scope the thing being throttled actually has: the stateless
+  // Worker caches one executor per endpoint + connector key for the isolate,
+  // while stdio builds one per process (`remote-runner.ts`). Callers sharing a
+  // backend credential therefore share its throttle, without one credential's
+  // retry loop suppressing the first measurement for another credential.
   let lastProbeAt = Number.NEGATIVE_INFINITY;
 
   /**
@@ -860,10 +857,36 @@ async function attempt(
   return stdout;
 }
 
+/**
+ * Cache Fly executors by endpoint and connector key for one runtime isolate.
+ *
+ * `makeFlyExecutor` owns the refusal-probe throttle state, so resolving a new
+ * executor for every stateless tool call would reset that state and allow each
+ * retry to spawn another keyring-locking Google probe.
+ */
+export function createFlyExecutorResolver(
+  factory: (endpoint: string, key: string) => GogExecutor = makeFlyExecutor,
+): (endpoint: string, key: string) => GogExecutor {
+  const byEndpoint = new Map<string, Map<string, GogExecutor>>();
+  return (endpoint, key) => {
+    let byKey = byEndpoint.get(endpoint);
+    if (!byKey) {
+      byKey = new Map();
+      byEndpoint.set(endpoint, byKey);
+    }
+    let executor = byKey.get(key);
+    if (!executor) {
+      executor = factory(endpoint, key);
+      byKey.set(key, executor);
+    }
+    return executor;
+  };
+}
+
 // Wrap an McpServer in a Proxy whose `registerTool` (and `tool`, if any
 // registrar uses it) intercepts the tool handler so it runs inside the
 // `runExecutor` ALS scope. This is the crux of the connector: it lets the
-// UNCHANGED base registrars forward every `gog` call to the per-session Fly
+// UNCHANGED base registrars forward every `gog` call to the request's Fly
 // executor without any change to the registrars or `runner.ts` — when a
 // handler's `run()` looks up `runExecutor.getStore()` it finds `executor` and
 // forwards instead of spawning. Everything else proxies through via Reflect.

package/src/gmail-dispatch-guard.ts

@@ -0,0 +1,106 @@
+import type { CallToolResult, InputRequiredResult, ServerContext } from '@modelcontextprotocol/server';
+import { readEnvVar, requireConfirmation } from '@chrischall/mcp-utils';
+
+// ============================================================================
+// THE SAFETY RAIL. gog_gmail_reply / reply_all / send / forward / autoreply are
+// the only tools in this fleet that put a message irreversibly into someone
+// else's mailbox on the FIRST call. Every other Gmail write either stages
+// something (drafts) or acts on mail already in this account (labels,
+// archive, trash). A caller that meant "save a draft" and picked the wrong
+// tool — or an agent that inherited the wrong reply target — used to find out
+// only after the send API call already succeeded.
+//
+// MCP elicitation makes the first round inert: it returns an input_required
+// result containing the preview, and only the protocol retry carrying the
+// user's accepted confirmation dispatches. The confirmation is never a tool
+// argument, so a model cannot bypass the user by setting a boolean itself.
+// ============================================================================
+/** Apply the shared stateless confirmation flow with Gmail-specific copy. */
+export function requireGmailDispatchConfirmation(
+  ctx: ServerContext,
+  op: string,
+  details: Record<string, unknown>,
+): InputRequiredResult | CallToolResult | undefined {
+  return requireConfirmation(ctx, {
+    action: op,
+    message: 'Review and confirm this email dispatch:',
+    details,
+    confirmationLabel: 'Confirm that this email should be sent now.',
+  });
+}
+
+// Over-inclusive on purpose: this feeds an audit log and a caller-facing
+// preview, neither of which is the enforcement point (the protocol gate is).
+// Missing a real recipient would be the dangerous direction of error; catching
+// an extra email-shaped substring is not.
+const EMAIL_PATTERN = /[a-z0-9!#$%&'*+/=?^_`{|}~.-]+@[a-z0-9-]+(?:\.[a-z0-9-]+)+/gi;
+
+export function extractEmails(...values: Array<string | undefined | null>): string[] {
+  const seen = new Set<string>();
+  const out: string[] = [];
+  for (const value of values) {
+    if (!value) continue;
+    const matches = value.match(EMAIL_PATTERN);
+    if (!matches) continue;
+    for (const match of matches) {
+      const lower = match.toLowerCase();
+      if (!seen.has(lower)) {
+        seen.add(lower);
+        out.push(lower);
+      }
+    }
+  }
+  return out;
+}
+
+// GOG_GMAIL_TRUSTED_DOMAINS names domains that are never "external" — by
+// default just the sending account's own domain, so a reply-all that includes
+// the account itself never reads as a surprise. Comma-separated, additive.
+function trustedDomains(account: string | undefined): Set<string> {
+  const domains = new Set<string>();
+  const raw = readEnvVar('GOG_GMAIL_TRUSTED_DOMAINS');
+  if (raw) {
+    for (const part of raw.split(',')) {
+      const domain = part.trim().toLowerCase();
+      if (domain) domains.add(domain);
+    }
+  }
+  const acct = account ?? readEnvVar('GOG_ACCOUNT');
+  const at = acct?.indexOf('@') ?? -1;
+  if (acct && at > -1) domains.add(acct.slice(at + 1).toLowerCase());
+  return domains;
+}
+
+// A distinguishable, greppable event for every mail dispatch — recipient
+// count plus whichever recipients fall outside the trusted-domain list — so an
+// unexpected external send (outside counsel, a wrong-number alias) can be
+// caught after the fact even if the confirmation step above is somehow
+// bypassed by a future caller. stdout is the JSON-RPC channel, so this goes to
+// stderr like every other diagnostic in this repo.
+export function logGmailDispatch(tool: string, recipients: string[], account?: string): void {
+  const domains = trustedDomains(account);
+  const externalRecipients = recipients.filter((recipient) => {
+    const at = recipient.indexOf('@');
+    const domain = at > -1 ? recipient.slice(at + 1) : '';
+    return !domain || !domains.has(domain);
+  });
+  const event = {
+    event: 'gmail_dispatch',
+    tool,
+    recipientCount: recipients.length,
+    externalRecipientCount: externalRecipients.length,
+    hasExternalRecipients: externalRecipients.length > 0,
+    externalRecipients,
+    timestamp: new Date().toISOString(),
+  };
+  process.stderr.write(`${JSON.stringify(event)}\n`);
+}
+
+// The single place a CallToolResult's text is pulled back out, for the tools
+// here that need to read gog's own JSON before deciding what to preview or
+// log. Mirrors the shape every runOrDiagnose result actually returns
+// (content[0].text); never throws on an unexpected shape.
+export function resultText(result: CallToolResult): string {
+  const first = result.content[0];
+  return first && first.type === 'text' && typeof first.text === 'string' ? first.text : '{}';
+}

package/src/gmail-results.ts

@@ -1,4 +1,4 @@
-import type { CallToolResult } from '@modelcontextprotocol/sdk/types.js';
+import type { CallToolResult } from '@modelcontextprotocol/server';
 import { rawTextResult } from '@chrischall/mcp-utils';
 import { run } from './runner.js';
 import { annotateTruncation, hasMorePages } from './pagination.js';

package/src/lib.ts

@@ -21,6 +21,16 @@ export {
 // same tool name from both registrar lists would be a duplicate-name error.
 export { replySchema, appendReplyFlags } from './tools/gmail.js';
 export type { ReplyFlags } from './tools/gmail.js';
+// The gmail confirmation gate — gog_gmail_reply/send/forward/autoreply are
+// the only tools that dispatch mail irreversibly on the first call. The
+// gmail sub-package's send-side forward/autoreply tools reuse these directly
+// rather than re-declaring the gate; the draft-side twins never import them.
+export {
+  extractEmails,
+  logGmailDispatch,
+  requireGmailDispatchConfirmation,
+  resultText,
+} from './gmail-dispatch-guard.js';
 export { run, runBinary, runExecutor, isGogFileArg, MIN_GOG_VERSION } from './runner.js';
 // Sub-package tools that read gog JSON through bare `run()` (rather than the
 // `runOrDiagnose` seam) must still apply this, or their timestamps skip the

package/src/pagination.ts

@@ -1,4 +1,4 @@
-import type { CallToolResult } from '@modelcontextprotocol/sdk/types.js';
+import type { CallToolResult } from '@modelcontextprotocol/server';
 import { rawTextResult } from '@chrischall/mcp-utils';
 
 // gog reports an exhausted cursor as `"nextPageToken": ""` rather than omitting

package/src/tools/api.ts

@@ -1,4 +1,4 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { McpServer } from '@modelcontextprotocol/server';
 import { z } from 'zod';
 import { accountParam, runOrDiagnose } from './utils.js';
 
@@ -10,10 +10,10 @@ export function registerApiTools(server: McpServer): void {
   server.registerTool('gog_api_list', {
     description: 'List the Google Discovery APIs available for gog_api_call / gog_api_describe (name + version + title).',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       all: z.boolean().optional().describe('Include every Discovery API (including preview/less-common ones) instead of the curated default set'),
       account: accountParam,
-    },
+    }),
   }, async ({ all, account }) => {
     const args = ['api', 'list'];
     if (all) args.push('--all');
@@ -23,12 +23,12 @@ export function registerApiTools(server: McpServer): void {
   server.registerTool('gog_api_describe', {
     description: 'Describe a Google Discovery API, or a single method within it — its parameters, request/response schema, and required OAuth scopes. Use this to discover the exact api/version/method and params before calling gog_api_call.',
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       api: z.string().describe('Discovery API name (e.g. drive, gmail, calendar)'),
       version: z.string().describe('API version (e.g. v3, v1)'),
       method: z.string().optional().describe('Optional method id to describe a single method (e.g. files.list); omit to describe the whole API'),
       account: accountParam,
-    },
+    }),
   }, async ({ api, version, method, account }) => {
     const args = ['api', 'describe', api, version];
     if (method) args.push(method);
@@ -38,7 +38,7 @@ export function registerApiTools(server: McpServer): void {
   server.registerTool('gog_api_call', {
     description: 'Call any Discovery-described Google API method directly — an escape hatch for endpoints gog has no dedicated tool for. Find the exact api/version/method/params with gog_api_describe first. Read methods (GET/LIST) run as-is. Mutating methods (POST/PUT/PATCH/DELETE) are refused unless you set allowWrite=true — keep it false to preview, or set dryRun=true to print the intended request without sending it.',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       api: z.string().describe('Discovery API name (e.g. drive, gmail, calendar)'),
       version: z.string().describe('API version (e.g. v3, v1)'),
       method: z.string().describe('Method id to call (e.g. files.list, files.create)'),
@@ -48,7 +48,7 @@ export function registerApiTools(server: McpServer): void {
       allowWrite: z.boolean().optional().describe('Required to invoke a mutating method (POST/PUT/PATCH/DELETE). Without it, gog refuses write methods. Leave unset for read-only calls.'),
       dryRun: z.boolean().optional().describe('Print the intended request and exit without sending it (no changes made)'),
       account: accountParam,
-    },
+    }),
   }, async ({ api, version, method, params, body, scope, allowWrite, dryRun, account }) => {
     const args = ['api', 'call', api, version, method];
     if (params) args.push(`--params=${params}`);

package/src/tools/appscript.ts

@@ -1,4 +1,4 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { McpServer } from '@modelcontextprotocol/server';
 import { z } from 'zod';
 import {
   accountParam,
@@ -35,10 +35,10 @@ export function registerAppScriptTools(server: McpServer): void {
       'Get an Apps Script project\'s metadata: title, creator, create/update times, and the parent Drive file when the '
       + 'project is bound to a Sheet, Doc or Form. Use gog_appscript_content to read the actual code.' + apiEnableNote,
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       scriptId: scriptIdParam,
       account: accountParam,
-    },
+    }),
   }, async ({ scriptId, account }) => {
     return runOrDiagnose(['appscript', 'get', scriptId], { account });
   });
@@ -49,10 +49,10 @@ export function registerAppScriptTools(server: McpServer): void {
       + 'tool to reach for when the question is "what does this script do"; it needs no filesystem, so it works the same '
       + 'on a hosted deployment as it does locally, unlike gog_appscript_pull.' + apiEnableNote,
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       scriptId: scriptIdParam,
       account: accountParam,
-    },
+    }),
   }, async ({ scriptId, account }) => {
     return runOrDiagnose(['appscript', 'content', scriptId], { account });
   });
@@ -65,12 +65,12 @@ export function registerAppScriptTools(server: McpServer): void {
       + 'reach them. Use gog_appscript_content there instead — it returns the same source in the response. Existing files '
       + 'are left alone unless overwrite is set. Read-only as far as Google is concerned: nothing is pushed back.'
       + apiEnableNote,
-    inputSchema: {
+    inputSchema: z.object({
       scriptId: scriptIdParam,
       dir: z.string().describe('Destination directory, resolved on the machine where gog runs'),
       overwrite: z.boolean().optional().describe('Overwrite files that already exist in dir'),
       account: accountParam,
-    },
+    }),
   }, async ({ scriptId, dir, overwrite, account }) => {
     const args = ['appscript', 'pull', scriptId, dir];
     if (overwrite) args.push('--overwrite');
@@ -82,11 +82,11 @@ export function registerAppScriptTools(server: McpServer): void {
       'Create a new, empty Apps Script project. Pass parentId to bind it to a Drive file (a Sheet, Doc or Form), which is '
       + 'what makes the script a container-bound script with access to that document; omit it for a standalone project. '
       + 'gog cannot upload code, so the project starts empty either way.' + apiEnableNote,
-    inputSchema: {
+    inputSchema: z.object({
       title: z.string().describe('Project title'),
       parentId: z.string().optional().describe('Drive file ID to bind the project to (Sheet, Doc or Form). Omit for a standalone project.'),
       account: accountParam,
-    },
+    }),
   }, async ({ title, parentId, account }) => {
     const args = ['appscript', 'create', `--title=${title}`];
     if (parentId) args.push(`--parent-id=${parentId}`);
@@ -99,11 +99,11 @@ export function registerAppScriptTools(server: McpServer): void {
       + 'deployment ID from here is what gog_appscript_run_function needs when a script is not running in dev mode.'
       + apiEnableNote,
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       scriptId: scriptIdParam,
       ...paginationParams,
       account: accountParam,
-    },
+    }),
   }, async ({ scriptId, max, pageToken, page, all, account }) => {
     const args = ['appscript', 'deployments', scriptId];
     pushPaginationFlags(args, { max, pageToken, page, all });
@@ -115,11 +115,11 @@ export function registerAppScriptTools(server: McpServer): void {
       'List a project\'s saved versions — the immutable snapshots deployments point at, with their numbers and '
       + 'descriptions. Useful for answering "what is actually deployed" next to gog_appscript_deployments.' + apiEnableNote,
     annotations: { readOnlyHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       scriptId: scriptIdParam,
       ...paginationParams,
       account: accountParam,
-    },
+    }),
   }, async ({ scriptId, max, pageToken, page, all, account }) => {
     const args = ['appscript', 'versions', scriptId];
     pushPaginationFlags(args, { max, pageToken, page, all });
@@ -136,13 +136,13 @@ export function registerAppScriptTools(server: McpServer): void {
       + 'deployed version, and only works if the account owns the script. '
       + 'This is NOT the escape hatch — gog_appscript_run is that.' + apiEnableNote,
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       scriptId: scriptIdParam,
       functionName: z.string().describe('Name of the function to call, e.g. "doWork"'),
       params: z.string().optional().describe('Function parameters as a JSON ARRAY of positional arguments, e.g. \'["a", 1]\' — not an object'),
       devMode: z.boolean().optional().describe('Run the latest saved code rather than the deployed version (owner only)'),
       account: accountParam,
-    },
+    }),
   }, async ({ scriptId, functionName, params, devMode, account }) => {
     // gog passes --params through to the API as-is, so a malformed value comes
     // back as a Google error about the request body rather than about the

package/src/tools/auth.ts

@@ -1,4 +1,4 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { McpServer } from '@modelcontextprotocol/server';
 import { z } from 'zod';
 import { run } from '../runner.js';
 import { errorResult, rawTextResult } from '@chrischall/mcp-utils';
@@ -35,7 +35,7 @@ function registerAuthToolsWith(server: McpServer, defaultServices: string): void
       'exactly like a healthy one, scopes and all. Use gog_auth_health to check whether an account ' +
       'can actually authenticate.',
     annotations: { readOnlyHint: true },
-    inputSchema: {},
+    inputSchema: z.object({}),
   }, async () => {
     try {
       return rawTextResult(await run(['auth', 'list']));
@@ -50,7 +50,7 @@ function registerAuthToolsWith(server: McpServer, defaultServices: string): void
       'name this is not a health check — it reads local setup and does not contact Google, so it says ' +
       'nothing about whether an account can still authenticate. Use gog_auth_health for that.',
     annotations: { readOnlyHint: true },
-    inputSchema: {},
+    inputSchema: z.object({}),
   }, async () => {
     try {
       return rawTextResult(await run(['auth', 'status']));
@@ -72,7 +72,7 @@ function registerAuthToolsWith(server: McpServer, defaultServices: string): void
       'connector key that reaches the gog machine, and nothing else — the Google credential lives on ' +
       'that machine and can be dead while the connection looks perfectly healthy.',
     annotations: { readOnlyHint: true },
-    inputSchema: {},
+    inputSchema: z.object({}),
   }, async () => {
     try {
       // `run` injects --json; --check makes gog probe each token live.
@@ -85,7 +85,7 @@ function registerAuthToolsWith(server: McpServer, defaultServices: string): void
   server.registerTool('gog_auth_services', {
     description: 'List all Google services supported by gogcli and the OAuth scopes each requires.',
     annotations: { readOnlyHint: true },
-    inputSchema: {},
+    inputSchema: z.object({}),
   }, async () => {
     try {
       return rawTextResult(await run(['auth', 'services']));
@@ -102,11 +102,11 @@ function registerAuthToolsWith(server: McpServer, defaultServices: string): void
       'If the browser does not open automatically, a fallback URL is included in the response. ' +
       'Use gog_auth_list to check which accounts are already configured.',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       email: z.string().describe('Google account email to authorize'),
       services: z.string().optional().default(defaultServices).describe(servicesDescribe),
       extraScopes: z.string().optional().describe(extraScopesDescribe),
-    },
+    }),
   }, async ({ email, services = defaultServices, extraScopes }) => {
     try {
       const args = ['auth', 'add', email, '--services', services];
@@ -135,11 +135,11 @@ function registerAuthToolsWith(server: McpServer, defaultServices: string): void
       'full redirected URL (from the address bar) and you pass it to gog_auth_add_complete. The link is ' +
       'valid for 10 minutes. If you pass a custom `services` here, pass the SAME value to ' +
       'gog_auth_add_complete or the second step will not match this one.',
-    inputSchema: {
+    inputSchema: z.object({
       email: z.string().describe('Google account email to authorize'),
       services: z.string().optional().default(defaultServices).describe(servicesDescribe),
       extraScopes: z.string().optional().describe(`${extraScopesDescribe} Pass the SAME value to gog_auth_add_complete.`),
-    },
+    }),
   }, async ({ email, services = defaultServices, extraScopes }) => {
     try {
       // --force-consent guarantees a refresh token even if a prior grant exists
@@ -161,7 +161,7 @@ function registerAuthToolsWith(server: McpServer, defaultServices: string): void
       'it. Use the SAME `services` value you passed to gog_auth_add_url. Must run within 10 minutes of ' +
       'step 1 and against the same gogcli host.',
     annotations: { destructiveHint: true },
-    inputSchema: {
+    inputSchema: z.object({
       email: z.string().describe('Google account email being authorized (same as step 1)'),
       redirectUrl: z.string().describe(
         'The full localhost redirect URL the user copied from the browser address bar after signing in ' +
@@ -174,7 +174,7 @@ function registerAuthToolsWith(server: McpServer, defaultServices: string): void
         'Extra OAuth scope URIs — MUST match the value passed to gog_auth_add_url, for the same reason `services` must: ' +
         'the two steps have to describe the same grant.',
       ),
-    },
+    }),
   }, async ({ email, redirectUrl, services = defaultServices, extraScopes }) => {
     try {
       const args = ['auth', 'add', email, '--remote', '--step', '2', '--auth-url', redirectUrl,