helipod-mcp 0.3.0 → 0.4.0

package/README.md

@@ -27,11 +27,11 @@ Prefer a key, a local server, or a tool not listed? Read on.
 
 In the [dashboard](https://helipod.io/project) open a project, then **Settings → API keys**. Choose the products (Container API, Database API, VPS API, Domain API) and the reach (one project, or the whole account; the Domain API needs a whole-account key). The key starts with `hel_`.
 
-Optional: an **email API key** from the project's **Email** section, for the email tools.
+For the email tools, enable **Email API** on the key (or sign in with it ticked). An email key from the project's **Email** section also still works, as `HELIPOD_EMAIL_API_KEY`.
 
 ```sh
 export HELIPOD_API_KEY=hel_...
-export HELIPOD_EMAIL_API_KEY=...   # optional
+export HELIPOD_EMAIL_API_KEY=...   # optional: only if you use a separate email key
 ```
 
 Start with a key limited to one project while you try things out.
@@ -150,11 +150,11 @@ Gemini CLI only starts MCP servers in folders you have trusted.
 
 ### Other clients
 
-Run `npx -y helipod-mcp` as a stdio MCP server with `HELIPOD_API_KEY` (and optionally `HELIPOD_EMAIL_API_KEY`) in its environment.
+Run `npx -y helipod-mcp` as a stdio MCP server with `HELIPOD_API_KEY` in its environment (enable the Email API on it for the email tools, or add `HELIPOD_EMAIL_API_KEY`).
 
 ## Hosted server (nothing to install)
 
-Clients that connect by URL can use `https://api.helipod.io/mcp` (Streamable HTTP) with `Authorization: Bearer hel_...` (and `X-Helipod-Email-Key` for the email tools). Same tools; the key is used per request and never stored.
+Clients that connect by URL can use `https://api.helipod.io/mcp` (Streamable HTTP) with `Authorization: Bearer hel_...` (the same key or sign-in serves the email tools when it has the Email API enabled; `X-Helipod-Email-Key` still works). Same tools; the key is used per request and never stored.
 
 ```sh
 claude mcp add --transport http helipod https://api.helipod.io/mcp --header "Authorization: Bearer $HELIPOD_API_KEY"
@@ -211,7 +211,7 @@ Each tool is marked read-only, write or destructive, so clients can ask before r
 | Variable | Default |
 |---|---|
 | `HELIPOD_API_KEY` | (required for containers, VPS, domains) |
-| `HELIPOD_EMAIL_API_KEY` | (required for email tools) |
+| `HELIPOD_EMAIL_API_KEY` | (optional; the email tools use `HELIPOD_API_KEY` when it has the Email API enabled) |
 | `HELIPOD_API_URL` | `https://api.helipod.io/api` |
 | `HELIPOD_EMAIL_API_URL` | `https://mail.helipod.io/api/email` |
 

package/dist/http.js

@@ -35614,19 +35614,28 @@ class HelipodClient {
     return this.request(this.apiUrl, opts.auth === false ? undefined : this.cfg.apiKey, method, path, opts);
   }
   email(method, path, opts = {}) {
-    if (!this.cfg.emailApiKey) {
-      throw new HelipodError(401, "NO_EMAIL_API_KEY", "HELIPOD_EMAIL_API_KEY is not set. Create an email API key in the Helipod dashboard Email section.");
+    const key = this.cfg.emailApiKey || this.cfg.apiKey;
+    if (!key) {
+      throw new HelipodError(401, "NO_API_KEY", "No key set. Use HELIPOD_API_KEY with the Email API enabled (or HELIPOD_EMAIL_API_KEY). Create keys in the Helipod dashboard: Project → Settings → API keys.");
     }
-    return this.request(this.emailApiUrl, this.cfg.emailApiKey, method, path, opts);
+    const headers = !this.cfg.emailApiKey && opts.project ? { "x-helipod-project": opts.project } : undefined;
+    return this.request(this.emailApiUrl, key, method, path, { ...opts, headers });
   }
   async request(base, key, method, path, opts) {
-    const url2 = new URL(base + (path.startsWith("/") ? path : `/${path}`));
+    const raw = path.startsWith("/") ? path : `/${path}`;
+    if (/(^|\/)\.\.?(\/|$)|[?#\\]|\/\/|%2e|%2f|%5c/i.test(raw)) {
+      throw new HelipodError(400, "INVALID_PATH", "An id in this request contains characters that are not allowed.");
+    }
+    const url2 = new URL(base + raw);
     for (const [k, v] of Object.entries(opts.query ?? {}))
       if (v !== undefined && v !== null && v !== "")
         url2.searchParams.set(k, String(v));
     const headers = { accept: "application/json", "user-agent": this.cfg.userAgent ?? "helipod-mcp" };
     if (key)
       headers.authorization = `Bearer ${key}`;
+    for (const [k, v] of Object.entries(opts.headers ?? {}))
+      if (/^[0-9a-f-]{36}$/i.test(v))
+        headers[k] = v;
     if (opts.body !== undefined)
       headers["content-type"] = "application/json";
     if (opts.idempotencyKey)
@@ -36322,14 +36331,15 @@ var domainTools = [
 ];
 
 // src/tools/email.ts
+var projectId = exports_external.string().uuid().optional().describe("Project whose email to use. Only needed with a whole-account key that reaches several projects with email.");
 var emailTools = [
   defineTool({
     name: "email_status",
     title: "Email status",
     kind: "read",
     description: "Email service of the key's project: plan, usage today and this month, limits, counts.",
-    input: {},
-    run: (_a3, api2) => api2.email("GET", "/status")
+    input: { projectId },
+    run: (a, api2) => api2.email("GET", "/status", { project: a.projectId })
   }),
   defineTool({
     name: "send_email",
@@ -36337,6 +36347,7 @@ var emailTools = [
     kind: "write",
     description: "Send one email from a verified domain of the project (counts against the plan's quota). Use templateId + templateData, or subject + html/text. Pass an idempotencyKey when retrying.",
     input: {
+      projectId,
       from: exports_external.string().describe('"hello@example.com" or "Acme <hello@example.com>"'),
       to: exports_external.array(exports_external.string()).min(1).max(50),
       cc: exports_external.array(exports_external.string()).max(50).optional(),
@@ -36350,63 +36361,63 @@ var emailTools = [
       variables: exports_external.record(exports_external.string(), exports_external.string()).optional(),
       idempotencyKey: exports_external.string().max(128).optional()
     },
-    run: (a, api2) => api2.email("POST", "/send", { body: a })
+    run: ({ projectId: project, ...a }, api2) => api2.email("POST", "/send", { body: a, project })
   }),
   defineTool({
     name: "list_emails",
     title: "List sent emails",
     kind: "read",
     description: "Email log, newest first, with delivery status.",
-    input: { status: exports_external.string().optional(), search: exports_external.string().optional(), limit: exports_external.number().int().min(1).max(100).optional(), cursor: exports_external.string().optional() },
-    run: (a, api2) => api2.email("GET", "/emails", { query: a })
+    input: { projectId, status: exports_external.string().optional(), search: exports_external.string().optional(), limit: exports_external.number().int().min(1).max(100).optional(), cursor: exports_external.string().optional() },
+    run: ({ projectId: project, ...a }, api2) => api2.email("GET", "/emails", { query: a, project })
   }),
   defineTool({
     name: "get_email",
     title: "Get email",
     kind: "read",
     description: "One sent email with its status and events.",
-    input: { emailId: exports_external.string() },
-    run: (a, api2) => api2.email("GET", `/emails/${a.emailId}`)
+    input: { projectId, emailId: exports_external.string() },
+    run: (a, api2) => api2.email("GET", `/emails/${a.emailId}`, { project: a.projectId })
   }),
   defineTool({
     name: "list_email_domains",
     title: "List sending domains",
     kind: "read",
     description: "Sending domains with verification status and the DNS records to add.",
-    input: {},
-    run: (_a3, api2) => api2.email("GET", "/domains")
+    input: { projectId },
+    run: (a, api2) => api2.email("GET", "/domains", { project: a.projectId })
   }),
   defineTool({
     name: "add_email_domain",
     title: "Add sending domain",
     kind: "write",
     description: "Add a sending domain; the response lists the DNS records the user must create, then call verify_email_domain.",
-    input: { domain: exports_external.string() },
-    run: (a, api2) => api2.email("POST", "/domains", { body: { domain: a.domain } })
+    input: { projectId, domain: exports_external.string() },
+    run: (a, api2) => api2.email("POST", "/domains", { body: { domain: a.domain }, project: a.projectId })
   }),
   defineTool({
     name: "verify_email_domain",
     title: "Verify sending domain",
     kind: "write",
     description: "Check a sending domain's DNS records again.",
-    input: { domainId: exports_external.string() },
-    run: (a, api2) => api2.email("POST", `/domains/${a.domainId}/verify`)
+    input: { projectId, domainId: exports_external.string() },
+    run: (a, api2) => api2.email("POST", `/domains/${a.domainId}/verify`, { project: a.projectId })
   }),
   defineTool({
     name: "list_email_templates",
     title: "List email templates",
     kind: "read",
     description: "Email templates of the project.",
-    input: {},
-    run: (_a3, api2) => api2.email("GET", "/templates")
+    input: { projectId },
+    run: (a, api2) => api2.email("GET", "/templates", { project: a.projectId })
   }),
   defineTool({
     name: "add_contact",
     title: "Add contact",
     kind: "write",
     description: "Add or update an audience contact.",
-    input: { email: exports_external.string(), firstName: exports_external.string().optional(), lastName: exports_external.string().optional() },
-    run: (a, api2) => api2.email("POST", "/contacts", { body: a })
+    input: { projectId, email: exports_external.string(), firstName: exports_external.string().optional(), lastName: exports_external.string().optional() },
+    run: ({ projectId: project, ...a }, api2) => api2.email("POST", "/contacts", { body: a, project })
   })
 ];
 
@@ -36609,7 +36620,7 @@ var generalTools = [
 ];
 
 // src/server.ts
-var VERSION = "0.3.0";
+var VERSION = "0.4.0";
 var INSTRUCTIONS = `Helipod is a cloud platform (Indonesia): containers, managed Postgres databases, VPS, domains, email and an AI gateway, billed from a prepaid wallet in Rupiah.
 - Start with list_projects to find projects and environment ids.
 - Anything that costs money (create/deploy/scale services, upgrade a database plan, create/renew/upgrade VPS, register/renew/transfer domains): run the dryRun or price lookup first, tell the user the cost in IDR and wait for an explicit yes.

package/dist/index.js

@@ -34759,19 +34759,28 @@ class HelipodClient {
     return this.request(this.apiUrl, opts.auth === false ? undefined : this.cfg.apiKey, method, path, opts);
   }
   email(method, path, opts = {}) {
-    if (!this.cfg.emailApiKey) {
-      throw new HelipodError(401, "NO_EMAIL_API_KEY", "HELIPOD_EMAIL_API_KEY is not set. Create an email API key in the Helipod dashboard Email section.");
+    const key = this.cfg.emailApiKey || this.cfg.apiKey;
+    if (!key) {
+      throw new HelipodError(401, "NO_API_KEY", "No key set. Use HELIPOD_API_KEY with the Email API enabled (or HELIPOD_EMAIL_API_KEY). Create keys in the Helipod dashboard: Project → Settings → API keys.");
     }
-    return this.request(this.emailApiUrl, this.cfg.emailApiKey, method, path, opts);
+    const headers = !this.cfg.emailApiKey && opts.project ? { "x-helipod-project": opts.project } : undefined;
+    return this.request(this.emailApiUrl, key, method, path, { ...opts, headers });
   }
   async request(base, key, method, path, opts) {
-    const url2 = new URL(base + (path.startsWith("/") ? path : `/${path}`));
+    const raw = path.startsWith("/") ? path : `/${path}`;
+    if (/(^|\/)\.\.?(\/|$)|[?#\\]|\/\/|%2e|%2f|%5c/i.test(raw)) {
+      throw new HelipodError(400, "INVALID_PATH", "An id in this request contains characters that are not allowed.");
+    }
+    const url2 = new URL(base + raw);
     for (const [k, v] of Object.entries(opts.query ?? {}))
       if (v !== undefined && v !== null && v !== "")
         url2.searchParams.set(k, String(v));
     const headers = { accept: "application/json", "user-agent": this.cfg.userAgent ?? "helipod-mcp" };
     if (key)
       headers.authorization = `Bearer ${key}`;
+    for (const [k, v] of Object.entries(opts.headers ?? {}))
+      if (/^[0-9a-f-]{36}$/i.test(v))
+        headers[k] = v;
     if (opts.body !== undefined)
       headers["content-type"] = "application/json";
     if (opts.idempotencyKey)
@@ -35467,14 +35476,15 @@ var domainTools = [
 ];
 
 // src/tools/email.ts
+var projectId = exports_external.string().uuid().optional().describe("Project whose email to use. Only needed with a whole-account key that reaches several projects with email.");
 var emailTools = [
   defineTool({
     name: "email_status",
     title: "Email status",
     kind: "read",
     description: "Email service of the key's project: plan, usage today and this month, limits, counts.",
-    input: {},
-    run: (_a3, api2) => api2.email("GET", "/status")
+    input: { projectId },
+    run: (a, api2) => api2.email("GET", "/status", { project: a.projectId })
   }),
   defineTool({
     name: "send_email",
@@ -35482,6 +35492,7 @@ var emailTools = [
     kind: "write",
     description: "Send one email from a verified domain of the project (counts against the plan's quota). Use templateId + templateData, or subject + html/text. Pass an idempotencyKey when retrying.",
     input: {
+      projectId,
       from: exports_external.string().describe('"hello@example.com" or "Acme <hello@example.com>"'),
       to: exports_external.array(exports_external.string()).min(1).max(50),
       cc: exports_external.array(exports_external.string()).max(50).optional(),
@@ -35495,63 +35506,63 @@ var emailTools = [
       variables: exports_external.record(exports_external.string(), exports_external.string()).optional(),
       idempotencyKey: exports_external.string().max(128).optional()
     },
-    run: (a, api2) => api2.email("POST", "/send", { body: a })
+    run: ({ projectId: project, ...a }, api2) => api2.email("POST", "/send", { body: a, project })
   }),
   defineTool({
     name: "list_emails",
     title: "List sent emails",
     kind: "read",
     description: "Email log, newest first, with delivery status.",
-    input: { status: exports_external.string().optional(), search: exports_external.string().optional(), limit: exports_external.number().int().min(1).max(100).optional(), cursor: exports_external.string().optional() },
-    run: (a, api2) => api2.email("GET", "/emails", { query: a })
+    input: { projectId, status: exports_external.string().optional(), search: exports_external.string().optional(), limit: exports_external.number().int().min(1).max(100).optional(), cursor: exports_external.string().optional() },
+    run: ({ projectId: project, ...a }, api2) => api2.email("GET", "/emails", { query: a, project })
   }),
   defineTool({
     name: "get_email",
     title: "Get email",
     kind: "read",
     description: "One sent email with its status and events.",
-    input: { emailId: exports_external.string() },
-    run: (a, api2) => api2.email("GET", `/emails/${a.emailId}`)
+    input: { projectId, emailId: exports_external.string() },
+    run: (a, api2) => api2.email("GET", `/emails/${a.emailId}`, { project: a.projectId })
   }),
   defineTool({
     name: "list_email_domains",
     title: "List sending domains",
     kind: "read",
     description: "Sending domains with verification status and the DNS records to add.",
-    input: {},
-    run: (_a3, api2) => api2.email("GET", "/domains")
+    input: { projectId },
+    run: (a, api2) => api2.email("GET", "/domains", { project: a.projectId })
   }),
   defineTool({
     name: "add_email_domain",
     title: "Add sending domain",
     kind: "write",
     description: "Add a sending domain; the response lists the DNS records the user must create, then call verify_email_domain.",
-    input: { domain: exports_external.string() },
-    run: (a, api2) => api2.email("POST", "/domains", { body: { domain: a.domain } })
+    input: { projectId, domain: exports_external.string() },
+    run: (a, api2) => api2.email("POST", "/domains", { body: { domain: a.domain }, project: a.projectId })
   }),
   defineTool({
     name: "verify_email_domain",
     title: "Verify sending domain",
     kind: "write",
     description: "Check a sending domain's DNS records again.",
-    input: { domainId: exports_external.string() },
-    run: (a, api2) => api2.email("POST", `/domains/${a.domainId}/verify`)
+    input: { projectId, domainId: exports_external.string() },
+    run: (a, api2) => api2.email("POST", `/domains/${a.domainId}/verify`, { project: a.projectId })
   }),
   defineTool({
     name: "list_email_templates",
     title: "List email templates",
     kind: "read",
     description: "Email templates of the project.",
-    input: {},
-    run: (_a3, api2) => api2.email("GET", "/templates")
+    input: { projectId },
+    run: (a, api2) => api2.email("GET", "/templates", { project: a.projectId })
   }),
   defineTool({
     name: "add_contact",
     title: "Add contact",
     kind: "write",
     description: "Add or update an audience contact.",
-    input: { email: exports_external.string(), firstName: exports_external.string().optional(), lastName: exports_external.string().optional() },
-    run: (a, api2) => api2.email("POST", "/contacts", { body: a })
+    input: { projectId, email: exports_external.string(), firstName: exports_external.string().optional(), lastName: exports_external.string().optional() },
+    run: ({ projectId: project, ...a }, api2) => api2.email("POST", "/contacts", { body: a, project })
   })
 ];
 
@@ -35754,7 +35765,7 @@ var generalTools = [
 ];
 
 // src/server.ts
-var VERSION = "0.3.0";
+var VERSION = "0.4.0";
 var INSTRUCTIONS = `Helipod is a cloud platform (Indonesia): containers, managed Postgres databases, VPS, domains, email and an AI gateway, billed from a prepaid wallet in Rupiah.
 - Start with list_projects to find projects and environment ids.
 - Anything that costs money (create/deploy/scale services, upgrade a database plan, create/renew/upgrade VPS, register/renew/transfer domains): run the dryRun or price lookup first, tell the user the cost in IDR and wait for an explicit yes.

package/dist/stdio.js

@@ -34866,19 +34866,28 @@ class HelipodClient {
     return this.request(this.apiUrl, opts.auth === false ? undefined : this.cfg.apiKey, method, path, opts);
   }
   email(method, path, opts = {}) {
-    if (!this.cfg.emailApiKey) {
-      throw new HelipodError(401, "NO_EMAIL_API_KEY", "HELIPOD_EMAIL_API_KEY is not set. Create an email API key in the Helipod dashboard Email section.");
+    const key = this.cfg.emailApiKey || this.cfg.apiKey;
+    if (!key) {
+      throw new HelipodError(401, "NO_API_KEY", "No key set. Use HELIPOD_API_KEY with the Email API enabled (or HELIPOD_EMAIL_API_KEY). Create keys in the Helipod dashboard: Project → Settings → API keys.");
     }
-    return this.request(this.emailApiUrl, this.cfg.emailApiKey, method, path, opts);
+    const headers = !this.cfg.emailApiKey && opts.project ? { "x-helipod-project": opts.project } : undefined;
+    return this.request(this.emailApiUrl, key, method, path, { ...opts, headers });
   }
   async request(base, key, method, path, opts) {
-    const url2 = new URL(base + (path.startsWith("/") ? path : `/${path}`));
+    const raw = path.startsWith("/") ? path : `/${path}`;
+    if (/(^|\/)\.\.?(\/|$)|[?#\\]|\/\/|%2e|%2f|%5c/i.test(raw)) {
+      throw new HelipodError(400, "INVALID_PATH", "An id in this request contains characters that are not allowed.");
+    }
+    const url2 = new URL(base + raw);
     for (const [k, v] of Object.entries(opts.query ?? {}))
       if (v !== undefined && v !== null && v !== "")
         url2.searchParams.set(k, String(v));
     const headers = { accept: "application/json", "user-agent": this.cfg.userAgent ?? "helipod-mcp" };
     if (key)
       headers.authorization = `Bearer ${key}`;
+    for (const [k, v] of Object.entries(opts.headers ?? {}))
+      if (/^[0-9a-f-]{36}$/i.test(v))
+        headers[k] = v;
     if (opts.body !== undefined)
       headers["content-type"] = "application/json";
     if (opts.idempotencyKey)
@@ -35574,14 +35583,15 @@ var domainTools = [
 ];
 
 // src/tools/email.ts
+var projectId = exports_external.string().uuid().optional().describe("Project whose email to use. Only needed with a whole-account key that reaches several projects with email.");
 var emailTools = [
   defineTool({
     name: "email_status",
     title: "Email status",
     kind: "read",
     description: "Email service of the key's project: plan, usage today and this month, limits, counts.",
-    input: {},
-    run: (_a3, api2) => api2.email("GET", "/status")
+    input: { projectId },
+    run: (a, api2) => api2.email("GET", "/status", { project: a.projectId })
   }),
   defineTool({
     name: "send_email",
@@ -35589,6 +35599,7 @@ var emailTools = [
     kind: "write",
     description: "Send one email from a verified domain of the project (counts against the plan's quota). Use templateId + templateData, or subject + html/text. Pass an idempotencyKey when retrying.",
     input: {
+      projectId,
       from: exports_external.string().describe('"hello@example.com" or "Acme <hello@example.com>"'),
       to: exports_external.array(exports_external.string()).min(1).max(50),
       cc: exports_external.array(exports_external.string()).max(50).optional(),
@@ -35602,63 +35613,63 @@ var emailTools = [
       variables: exports_external.record(exports_external.string(), exports_external.string()).optional(),
       idempotencyKey: exports_external.string().max(128).optional()
     },
-    run: (a, api2) => api2.email("POST", "/send", { body: a })
+    run: ({ projectId: project, ...a }, api2) => api2.email("POST", "/send", { body: a, project })
   }),
   defineTool({
     name: "list_emails",
     title: "List sent emails",
     kind: "read",
     description: "Email log, newest first, with delivery status.",
-    input: { status: exports_external.string().optional(), search: exports_external.string().optional(), limit: exports_external.number().int().min(1).max(100).optional(), cursor: exports_external.string().optional() },
-    run: (a, api2) => api2.email("GET", "/emails", { query: a })
+    input: { projectId, status: exports_external.string().optional(), search: exports_external.string().optional(), limit: exports_external.number().int().min(1).max(100).optional(), cursor: exports_external.string().optional() },
+    run: ({ projectId: project, ...a }, api2) => api2.email("GET", "/emails", { query: a, project })
   }),
   defineTool({
     name: "get_email",
     title: "Get email",
     kind: "read",
     description: "One sent email with its status and events.",
-    input: { emailId: exports_external.string() },
-    run: (a, api2) => api2.email("GET", `/emails/${a.emailId}`)
+    input: { projectId, emailId: exports_external.string() },
+    run: (a, api2) => api2.email("GET", `/emails/${a.emailId}`, { project: a.projectId })
   }),
   defineTool({
     name: "list_email_domains",
     title: "List sending domains",
     kind: "read",
     description: "Sending domains with verification status and the DNS records to add.",
-    input: {},
-    run: (_a3, api2) => api2.email("GET", "/domains")
+    input: { projectId },
+    run: (a, api2) => api2.email("GET", "/domains", { project: a.projectId })
   }),
   defineTool({
     name: "add_email_domain",
     title: "Add sending domain",
     kind: "write",
     description: "Add a sending domain; the response lists the DNS records the user must create, then call verify_email_domain.",
-    input: { domain: exports_external.string() },
-    run: (a, api2) => api2.email("POST", "/domains", { body: { domain: a.domain } })
+    input: { projectId, domain: exports_external.string() },
+    run: (a, api2) => api2.email("POST", "/domains", { body: { domain: a.domain }, project: a.projectId })
   }),
   defineTool({
     name: "verify_email_domain",
     title: "Verify sending domain",
     kind: "write",
     description: "Check a sending domain's DNS records again.",
-    input: { domainId: exports_external.string() },
-    run: (a, api2) => api2.email("POST", `/domains/${a.domainId}/verify`)
+    input: { projectId, domainId: exports_external.string() },
+    run: (a, api2) => api2.email("POST", `/domains/${a.domainId}/verify`, { project: a.projectId })
   }),
   defineTool({
     name: "list_email_templates",
     title: "List email templates",
     kind: "read",
     description: "Email templates of the project.",
-    input: {},
-    run: (_a3, api2) => api2.email("GET", "/templates")
+    input: { projectId },
+    run: (a, api2) => api2.email("GET", "/templates", { project: a.projectId })
   }),
   defineTool({
     name: "add_contact",
     title: "Add contact",
     kind: "write",
     description: "Add or update an audience contact.",
-    input: { email: exports_external.string(), firstName: exports_external.string().optional(), lastName: exports_external.string().optional() },
-    run: (a, api2) => api2.email("POST", "/contacts", { body: a })
+    input: { projectId, email: exports_external.string(), firstName: exports_external.string().optional(), lastName: exports_external.string().optional() },
+    run: ({ projectId: project, ...a }, api2) => api2.email("POST", "/contacts", { body: a, project })
   })
 ];
 
@@ -35861,7 +35872,7 @@ var generalTools = [
 ];
 
 // src/server.ts
-var VERSION = "0.3.0";
+var VERSION = "0.4.0";
 var INSTRUCTIONS = `Helipod is a cloud platform (Indonesia): containers, managed Postgres databases, VPS, domains, email and an AI gateway, billed from a prepaid wallet in Rupiah.
 - Start with list_projects to find projects and environment ids.
 - Anything that costs money (create/deploy/scale services, upgrade a database plan, create/renew/upgrade VPS, register/renew/transfer domains): run the dryRun or price lookup first, tell the user the cost in IDR and wait for an explicit yes.
@@ -35891,6 +35902,6 @@ var server = createHelipodServer({
   emailApiUrl: process.env.HELIPOD_EMAIL_API_URL
 });
 if (!process.env.HELIPOD_API_KEY && !process.env.HELIPOD_EMAIL_API_KEY) {
-  console.error("helipod-mcp: set HELIPOD_API_KEY (and optionally HELIPOD_EMAIL_API_KEY). Create keys in the Helipod dashboard.");
+  console.error("helipod-mcp: set HELIPOD_API_KEY (enable the Email API on it for the email tools). Create keys in the Helipod dashboard: Project → Settings → API keys.");
 }
 await server.connect(new StdioServerTransport);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "helipod-mcp",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "MCP server for Helipod: containers, databases, VPS, domains and email from Claude Code, Codex, Cursor and other AI tools.",
   "type": "module",
   "bin": {

package/skills/helipod/SKILL.md

@@ -12,7 +12,7 @@ Helipod is a cloud platform in Indonesia: containers (deploy apps from Git, imag
 - **MCP tools** (preferred): if tools like `list_projects`, `create_service`, `list_vps_plans` are available, use them.
 - **Without MCP**: call the HTTP API with `Authorization: Bearer $HELIPOD_API_KEY`.
   - Container, Database, VPS, Domain APIs: `https://api.helipod.io/api` (`/containers/...`, `/databases/...`, `/vps/...`, `/domains/...`)
-  - Email API: `https://mail.helipod.io/api/email` with `$HELIPOD_EMAIL_API_KEY` (a separate email key)
+  - Email API: `https://mail.helipod.io/api/email` with `$HELIPOD_API_KEY` when the key has the Email API enabled (a whole-account key adds `X-Helipod-Project: <projectId>`), or a separate email key `$HELIPOD_EMAIL_API_KEY`
   - AI gateway: `https://ai.helipod.io/v1` with a `hel_ai_...` key (OpenAI and Anthropic compatible)
 - Keys are created in the dashboard: Project → Settings → API keys. A key is limited to the products and project chosen there; `403 SCOPE_NOT_ALLOWED` means the key lacks that product, `404` on an id means it is outside the key's reach.
 - Every response is `{ "success": true, "data": ... }` or `{ "success": false, "error": "...", "code": "..." }`.

package/skills/helipod-email/SKILL.md

@@ -5,7 +5,7 @@ description: Send transactional email from an application through Helipod Email
 
 # Helipod Email
 
-Uses a separate **email API key** (dashboard → Email → API keys) as `HELIPOD_EMAIL_API_KEY`. Base URL: `https://mail.helipod.io/api/email`.
+Uses the Helipod API key `HELIPOD_API_KEY` with **Email API** enabled (Settings → API keys; a whole-account key adds `X-Helipod-Project: <projectId>`), or a separate email key from the Email section as `HELIPOD_EMAIL_API_KEY`. Base URL: `https://mail.helipod.io/api/email`.
 
 ## Set up
 
@@ -20,7 +20,7 @@ Never put the key in client-side code. Store it as a secret (on Helipod: `set_va
 ```js
 await fetch("https://mail.helipod.io/api/email/send", {
   method: "POST",
-  headers: { Authorization: `Bearer ${process.env.HELIPOD_EMAIL_API_KEY}`, "Content-Type": "application/json" },
+  headers: { Authorization: `Bearer ${process.env.HELIPOD_EMAIL_API_KEY ?? process.env.HELIPOD_API_KEY}`, "Content-Type": "application/json" },
   body: JSON.stringify({
     from: "Acme <hello@mail.example.com>",
     to: ["user@example.com"],