iit-mcp-autotask 0.4.1 → 0.4.3

package/README.md

@@ -32,7 +32,7 @@ miss never fails the call (typed `absent`); only a missing root record fails the
 | C — dedicated workflow (23) | `autotask_ticket_query` · `autotask_ticket_full_context` · `autotask_ticket_sla_health_check` · `autotask_ticket_find_by_ticket_number` · `autotask_company_full_profile` · `autotask_timeEntry_query` · `autotask_timeEntry_create` · `autotask_quote_get` · `autotask_invoice_get` · `autotask_invoice_markup` · `autotask_configurationItem_profile` · `autotask_configurationItems_find_by_serial` · `autotask_contact_full_profile` · `autotask_contact_find_by_email` · `autotask_project_get_context` · `autotask_serviceCall_query` · `autotask_serviceCall_full_profile` · `autotask_contract_full_profile` · `autotask_contract_query` · `autotask_resource_workload` · `autotask_timeOffRequest_query` · `autotask_company_unbilled_work` · `autotask_aggregate` (names verbatim from the SDK manifest where they exist — case inconsistency included) | Bounded filtered lists, one-call composites, natural-key lookups, the single dedicated write |
 
 Machine-readable catalogue: [`capabilities.json`](capabilities.json) · server metadata: [`server.json`](server.json) ·
-per-workflow mapping: [`docs/capability-matrix.md`](docs/capability-matrix.md) · full design: [`docs/architecture.md`](docs/architecture.md).
+per-workflow mapping: [`docs/capability-matrix.md`](docs/capability-matrix.md) · full design: [`docs/architecture.md`](docs/architecture.md) · contract P&L manual recipe (the `autotask_contract_profitability` gap until it ships): [`docs/contract-economics.md`](docs/contract-economics.md).
 
 ### The 5-META generic layer
 

package/capabilities.json

@@ -539,12 +539,12 @@
     },
     {
       "id": "autotask.contract.full_profile",
-      "description": "One contract + its services (+ units) + its billing rules in a single call: parts degrade to typed absent, never a failure; the contract itself missing → NOT_FOUND. Deeper machinery (bundles, adjustments, exclusions, charges): autotask_read; a contract list: autotask_contract_query.",
+      "description": "One contract + its services + billing rules + recent charges (50 newest) + service units in one call: parts degrade to typed absent, never a failure; the contract itself missing → NOT_FOUND. Deeper machinery (bundles, adjustments, exclusions): autotask_read; contract list: autotask_contract_query.",
       "mcpPrimitive": "tool",
       "toolName": "autotask_contract_full_profile",
       "type": "read",
       "layer": "C",
-      "backingOperation": "contracts.get + contract_services.query + contract_billing_rules.query",
+      "backingOperation": "contracts.get + contract_services.query + contract_billing_rules.query + contract_charges.query + contract_service_units.query",
       "annotations": {
         "readOnly": true,
         "idempotent": true,

package/dist/policy.js

@@ -49,7 +49,13 @@ export function secretReadsPermitted(config) {
 export function policyAllows(operation, record, config) {
     if (config.AUTOTASK_READ_ONLY || config.AUTOTASK_WRITE_POLICY === 'deny')
         return record?.effect === 'read';
-    if (record === undefined || !isWriteEffect(record))
+    // An allow-list is a positive grant. An operation with no registry classification
+    // is not positively granted, so it remains denied instead of falling through to
+    // the generic unknown-operation error. `all` deliberately preserves its existing
+    // open surface; the dispatcher still rejects unknown operations before the SDK.
+    if (record === undefined)
+        return config.AUTOTASK_WRITE_POLICY !== 'allow_list';
+    if (!isWriteEffect(record))
         return true;
     switch (config.AUTOTASK_WRITE_POLICY) {
         case 'allow_list':

package/dist/tools/catalog-data.d.ts

@@ -144,7 +144,7 @@ export declare function cacheOptionsForPreset(preset: 'on' | 'off', fieldCacheTt
  * fails the boot (or the CI test) instead of quietly shipping a tool surface that no longer
  * describes the SDK behind it.
  */
-export declare const BUILT_AGAINST_PLAN_HASH = "4c8d9f800e97c350acc681ade183f67474c044b674494eb78cd0f14a933dc1fc";
+export declare const BUILT_AGAINST_PLAN_HASH = "6547153895b65c577ef59ced6c06361d0763d1299d6048531b8ffa94f77821d3";
 /**
  * Fail fast when the installed SDK's plan has moved out from under this surface.
  * Called at boot (main.ts) and safe to call repeatedly (pure comparison).

package/dist/tools/catalog-data.js

@@ -250,15 +250,15 @@ export const TOOL_DESCRIPTIONS = {
     autotask_write: `Route any effect=write registry op by its EXACT key, dry-run-first (dry_run false applies — mutating request is never issued before then). The 3 approval-gated writes also need confirm === the op key (BOTH modes). Read/delete ops refused pre-request. Write-policy gated (POLICY_DENIED pre-request).`,
     autotask_delete: `Route any effect=destructive registry op by its EXACT key, dry-run-first (dry_run false applies). confirm === the op key REQUIRED for every delete. Read/write ops refused. Write-policy gated (POLICY_DENIED). Many entities have no vendor delete (deletable: false) — a vendor limitation, not a refusal.`,
     autotask_resolve_any: `Resolve a bare id or name against several resources at once (default the five workflow resources: companies, tickets, contacts, configuration items, projects) — when you have a value but not the resource. Read-only; a miss is reported per resource, never thrown; returns compact records.`,
-    autotask_search_across_resources: `Free-text search across several resources (default the five workflow resources) — find a record you cannot name. Bounded: limit default 25, max 500 per resource; resources without a search helper are skipped and reported, never errored; returns compact matches. Read-only.`,
-    autotask_ticket_resolve: `Resolve a Ticket from a numeric id (first) or an exact title (exact match only); returns the record with the numeric id. NOT tried: the human ticket number (autotask_ticket_find_by_ticket_number) or a partial/contains match (autotask_ticket_query filter). Read-only. A miss is a typed NOT_FOUND.`,
-    autotask_contact_resolve: `Resolve a Contact from a numeric id (tried first) or exact firstName + lastName (exact match only); returns the record with the numeric id. NOT tried: an email (autotask_contact_find_by_email) or a partial match (autotask_read contacts.query). Read-only. Sensitive. A miss is a typed NOT_FOUND.`,
-    autotask_configurationItems_resolve: `Resolve a Configuration Item from a numeric id or exact referenceTitle (exact match only); returns the record with the numeric id. NOT tried: a serial (autotask_configurationItems_find_by_serial) or a partial match (autotask_read). Read-only. Sensitive. A miss is a typed NOT_FOUND.`,
-    autotask_fetch_many: `Batch up to 500 fetches across MIXED resources: items [{ resource, id, fields? }] — numeric ids (string identifiers: resolve_any). Per-item results: a miss is a typed error row in its own slot. Parent-scoped children not fetchable here; fields = exact vendor names; >500 items → CONFIG_ERROR.`,
+    autotask_search_across_resources: `Free-text search across several resources (default the five workflow resources) — find a record you cannot name. Bounded: limit default 25, max 500 per resource; resources without a search helper are skipped and reported, never errored; returns compact matches with their human reference. Read-only.`,
+    autotask_ticket_resolve: `Resolve a Ticket from a numeric id (first) or an exact title; the record carries its ticketNumber — cite that, never the bare id. NOT tried: the ticket number (autotask_ticket_find_by_ticket_number) or a contains match (autotask_ticket_query). Read-only. A miss is a typed NOT_FOUND.`,
+    autotask_contact_resolve: `Resolve a Contact from a numeric id (tried first) or exact firstName + lastName; the record carries the name — cite that, never the bare id. NOT tried: an email (autotask_contact_find_by_email) or a partial match (autotask_read contacts.query). Read-only. Sensitive. A miss is a typed NOT_FOUND.`,
+    autotask_configurationItems_resolve: `Resolve a Configuration Item from a numeric id or exact referenceTitle; the record carries its referenceTitle — cite that, never the bare id. NOT tried: a serial (autotask_configurationItems_find_by_serial) or a partial match (autotask_read). Read-only. Sensitive. A miss is a typed NOT_FOUND.`,
+    autotask_fetch_many: `Batch up to 500 fetches across MIXED resources: items [{ resource, id, fields? }] — numeric ids (string identifiers: resolve_any). A miss is a typed error row in its slot. Parent-scoped children not fetchable; fields = exact vendor names; records carry their human reference; >500 → CONFIG_ERROR.`,
     autotask_read_batch: `Up to 10 reads in one call: items [{ operation, args? }], the autotask_read shape, read-only. Per-item results (input order): ok + result, or the typed error in its slot — a refused/failed item never fails the batch. Over the remaining local budget -> budget + budgetWarning (warn only — still runs).`,
     autotask_ticket_query: `Query Ticket records with a JSON filter. Zone quirk (ww29): count/query returns 0/empty even when data exists — verify presence with get(id), not count. Bounded: limit default 50, max 2500. per-call options: see the server instructions.`,
     autotask_ticket_full_context: `Full context of ONE ticket: ticket + company + contact + assigned resource + project (a missing part = typed absent, never a failure) + notes, time entries, attachment metadata. Long text truncated at textLimit (default 500). Missing → NOT_FOUND. SLA: autotask_ticket_sla_health_check.`,
-    autotask_ticket_sla_health_check: `The SLA health/results for one ticket you already hold the numeric id of — not the ticket itself (the record: autotask_ticket_resolve; the full context: autotask_ticket_full_context).`,
+    autotask_ticket_sla_health_check: `The SLA health/results for ONE ticket, by numeric id — not the ticket itself (the record: autotask_ticket_resolve; the full context: autotask_ticket_full_context). Report the ticketNumber, never the bare id.`,
     autotask_ticket_find_by_ticket_number: `You have the human ticket number (the ticketNumber string, e.g. T20260101.12345), not the numeric id or title. Exact match; a miss is a typed NOT_FOUND. Returns the ticket record — its full context: autotask_ticket_full_context.`,
     autotask_company_full_profile: `ONE company's full picture: company + locations + contacts + notes + open tickets + projects. openTickets: open = status != 5 (ww29 picklist lacks Closed); always filtered (ww29 tickets surface blind unfiltered) — empty = a TRUE zero. CIs: autotask_read configuration_items.query. Missing → NOT_FOUND`,
     autotask_timeEntry_query: `Query TimeEntry records with a JSON filter — the MSP billing view. Period presets ride autotask_read time_entries.<helper>. Zone (ww29): getPosted/getUnposted 500 — use postedWithin. Bounded: limit default 50, max 2500. per-call options: see the server instructions.`,
@@ -273,15 +273,15 @@ export const TOOL_DESCRIPTIONS = {
     autotask_project_get_context: `One project with its primary context: project + company + opportunity + lead resource. Project phase/task lists do NOT exist on this surface (no such vendor operations) — do not attempt them; charges/notes ride the generic layer (autotask_read). The project record alone: autotask_project_resolve.`,
     autotask_serviceCall_query: `Query ServiceCall records with a JSON filter — the on-site visit queue. Full profile (linked tickets, tasks, assignments): autotask_serviceCall_full_profile. Assignment writes ride autotask_write. Bounded: limit default 50, max 2500. per-call options: see the server instructions.`,
     autotask_serviceCall_full_profile: `One service call + its linked tickets + its tasks (incl. resource assignments). Parts degrade to typed absent (no tasks → NO_TASKS on the assignments part); the service call itself missing → NOT_FOUND. Prefer this before on-site-visit work (assignment writes ride autotask_write).`,
-    autotask_contract_full_profile: `One contract + its services (+ units) + its billing rules in a single call: parts degrade to typed absent, never a failure; the contract itself missing → NOT_FOUND. Deeper machinery (bundles, adjustments, exclusions, charges): autotask_read; a contract list: autotask_contract_query.`,
+    autotask_contract_full_profile: `One contract + its services + billing rules + recent charges (50 newest) + service units in one call: parts degrade to typed absent, never a failure; the contract itself missing → NOT_FOUND. Deeper machinery (bundles, adjustments, exclusions): autotask_read; contract list: autotask_contract_query.`,
     autotask_contract_query: `Query Contract records with a JSON filter — e.g. active contracts for a company (the SLA & recurring-service view). One contract with its services/units/billing rules: autotask_contract_full_profile. Bounded: limit default 50, max 2500. per-call options: see the server instructions.`,
     autotask_resource_workload: `One resource's availability picture: open assigned tickets + service-call assignments + time-off balances + pending time-off requests. Parts degrade to typed absent; resource missing → NOT_FOUND. Approve/reject: autotask_write. The request list: autotask_timeOffRequest_query. Sensitive.`,
     autotask_timeOffRequest_query: `Query TimeOffRequest records with a JSON filter. Approve/reject ride autotask_write (time_off_requests.approve / .reject — dry-run-first; reject takes a reason). Availability: autotask_resource_workload. Bounded: limit default 50, max 2500. per-call options: see the server instructions.`,
     autotask_company_unbilled_work: `A company's unbilled work: posted billing items, the time behind them, per-ticket rollup, the unposted section, totals + hours + warnings. Arguments: id + closed bag (see the server instructions). A filtered empty part is a TRUE zero; shape problems → typed CONFIG_ERROR; missing company → NOT_FOUND.`,
     autotask_aggregate: `Fold a query surface into groups/sums/totals or count it (the count endpoint). operation = an EXACT plan .query op (others refused); filter (grammar; empty array = unfiltered: a 0 on a blind surface is marked blind: true); group_by / sum / top / limit: server instructions. Read op; zero mutating.`,
     autotask_resource_who_am_i: `Identify the authenticated integration by its Resource record (name, zone, tenant). Call first to verify credentials and scope before other work. No arguments; returns the compact ResourceSummary, or null when the configured user cannot be matched. Sensitive.`,
-    autotask_company_resolve: `Resolve a Company from a numeric id (tried first) or a companyName — exact by default, or fuzzy candidates via match:'contains' (+ include_family). Returns the record or candidates with ids. Other forms (e.g. email) are NOT tried; a miss is a typed NOT_FOUND. Read-only. Sensitive.`,
-    autotask_project_resolve: `Resolve a Project from a numeric id (the direct fetch, tried first) or an exact projectName (exact match only). Returns the Project record with the numeric id for get/update/delete. Other identifier forms (e.g. an email address) are NOT tried — a miss is a typed NOT_FOUND. Read-only. Sensitive.`,
+    autotask_company_resolve: `Resolve a Company from a numeric id (tried first) or a companyName — exact by default, or fuzzy candidates via match:'contains' (+ include_family). The record carries companyName — cite that, never the bare id. Other forms (e.g. email) NOT tried; a miss is a typed NOT_FOUND. Read-only. Sensitive.`,
+    autotask_project_resolve: `Resolve a Project from a numeric id (first) or an exact projectName; the record carries its human projectNumber — cite that, never a bare id. Other forms are NOT tried; a miss is a typed NOT_FOUND. By number: autotask_read projects.query filter projectNumber eq. Read-only. Sensitive.`,
     autotask_relationship_map: `ONE resource's relationship surface in a ZERO-wire call: parent, children, natural lookup keys, pinned blind surfaces, create required sets + quirks. Call BEFORE composing multi-resource workflows. Unknown key → typed RESOURCE_UNKNOWN.`,
     autotask_threshold_information: `Request-threshold status: the TENANT-wide vendor count (model) plus the budget block — the LOCAL per-credential hourly window of this client (perHour, used, remaining; null with a budgetNote when the limiter is off). Read-only, no arguments; the budget read is zero wire.`,
 };
@@ -339,7 +339,7 @@ export function cacheOptionsForPreset(preset, fieldCacheTtlMs) {
  * fails the boot (or the CI test) instead of quietly shipping a tool surface that no longer
  * describes the SDK behind it.
  */
-export const BUILT_AGAINST_PLAN_HASH = '4c8d9f800e97c350acc681ade183f67474c044b674494eb78cd0f14a933dc1fc';
+export const BUILT_AGAINST_PLAN_HASH = '6547153895b65c577ef59ced6c06361d0763d1299d6048531b8ffa94f77821d3';
 /**
  * Fail fast when the installed SDK's plan has moved out from under this surface.
  * Called at boot (main.ts) and safe to call repeatedly (pure comparison).

package/dist/tools/composites.js

@@ -13,7 +13,14 @@
  *
  * Parts run as bounded fan-outs over ONE pooled tenant client: the client's own concurrency
  * guard (the agent profile) bounds the in-flight vendor requests; the part list is small and
- * static per tool.
+ * static per tool. Wire budget per call: the contract profile is the widest — 1 root read + 4
+ * parts in one parallel fan-out (contract_services.query / contract_billing_rules.query /
+ * contract_charges.query / contract_service_units.query, each limit 50 → one page), EXCEPT the
+ * charges part, which rides the SDK's count-anchored `latest` 50 (the vendor has no sort
+ * parameter; newest-first = id-newest, tracking the vendor's createDate/datePurchased) — 1 count
+ * + at most 6 page POSTs while the matching set is <= 2500 rows (the SDK's full-set mode); above
+ * that the SDK spends its own id-threshold count-probe budget before a <= 6-page walk, and a
+ * blind surface takes the plain bounded walk. Common case: at most 11 vendor requests per call.
  */
 import { NotFoundError } from 'node-autotask';
 import { TICKET_FULL_CONTEXT_INPUT, COMPANY_FULL_PROFILE_INPUT, CONFIGURATION_ITEM_PROFILE_INPUT, PROJECT_GET_CONTEXT_INPUT, QUOTE_GET_INPUT, INVOICE_GET_INPUT, INVOICE_MARKUP_INPUT, CONTACT_FULL_PROFILE_INPUT, SERVICE_CALL_FULL_PROFILE_INPUT, CONTRACT_FULL_PROFILE_INPUT, RESOURCE_WORKLOAD_INPUT, UNBILLED_WORK_INPUT, AGGREGATE_INPUT, COMPOSITE_OUTPUT, resultOutput, aggregateOutput, unbilledWorkOutput, closedInput, } from './schemas.js';
@@ -25,6 +32,11 @@ import { assertSecretReadPermitted, assertWritePermitted } from '../policy.js';
 const TICKET_STATUS_CLOSED = 5;
 /** The cap on a fan-out `in` filter (the task-id join between two parts). */
 const IN_FILTER_CAP = 100;
+/** The charges part's recent-N cap (issue #49): the N newest contract charges, newest first —
+ *  served through the SDK's count-anchored `latest` (the vendor has no sort parameter). */
+const CHARGES_RECENT_CAP = 50;
+/** The units part's row cap (issue #49). */
+const SERVICE_UNITS_CAP = 50;
 /** Run one part read: a miss/fault degrades to `{ value: null, absent: code }`, never a throw. */
 async function part(ctx, op, args, signal) {
     try {
@@ -370,12 +382,13 @@ function registerServiceCallFullProfile(server, ctx) {
         },
     });
 }
-// ---- autotask_contract_full_profile: the contract, its services, its billing rules ----
+// ---- autotask_contract_full_profile: the contract, its services, its billing rules,
+// ---- its recent charges (issue #49) and its service units (issue #49) ----
 function registerContractFullProfile(server, ctx) {
     const contractInput = closedInput(CONTRACT_FULL_PROFILE_INPUT);
     registerServerComposite(ctx, server, {
         tool: 'autotask_contract_full_profile',
-        title: 'Get a contract with its services and billing rules',
+        title: 'Get a contract with its services, billing rules, recent charges and service units',
         description: ctx.description('autotask_contract_full_profile', 'contracts.get'),
         input: contractInput,
         rootOp: 'contracts.get',
@@ -383,16 +396,34 @@ function registerContractFullProfile(server, ctx) {
             const id = args.id;
             // The declared per-part limits (QUERY_LIMIT: 1-2500, default 50 — schema-validated at the
             // protocol layer); each part reads its own declared argument, not one shared phantom key.
+            // The two issue #49 parts carry NO input knobs (the closed bag is unchanged): the charges
+            // part is the FIXED recent-N and the units part the fixed row cap.
             const serviceLimit = args.service_limit ?? 50;
             const billingRuleLimit = args.billing_rule_limit ?? 50;
             const root = await c.ops.invokeRead(c.client, 'contracts.get', [id], undefined, signal);
             if (root === undefined)
                 return { root: null, rootOp: 'contracts.get', parts: {} };
-            const [services, billingRules] = await Promise.all([
+            const [services, billingRules, charges, units] = await Promise.all([
                 part(c, 'contract_services.query', [{ filter: [{ field: 'contractID', op: 'eq', value: id }], limit: serviceLimit }], signal),
                 part(c, 'contract_billing_rules.query', [{ filter: [{ field: 'contractID', op: 'eq', value: id }], limit: billingRuleLimit }], signal),
+                // The recent charges (issue #49): the vendor has NO sort parameter — the SDK's
+                // count-anchored `latest` (the N highest-id rows, id-descending) is the only ordering
+                // channel; the id order tracks the vendor's createDate/datePurchased, so newest-first
+                // is id-newest-first. limit === latest is the legal coexistence (limit >= latest) and
+                // keeps the walk window explicit (1 count + at most 6 page POSTs).
+                part(c, 'contract_charges.query', [{ filter: [{ field: 'contractID', op: 'eq', value: id }], limit: CHARGES_RECENT_CAP, latest: CHARGES_RECENT_CAP }], signal),
+                part(c, 'contract_service_units.query', [{ filter: [{ field: 'contractID', op: 'eq', value: id }], limit: SERVICE_UNITS_CAP }], signal),
             ]);
-            return { root, rootOp: 'contracts.get', parts: { services: ['contract_services.query', services], billing_rules: ['contract_billing_rules.query', billingRules] } };
+            return {
+                root,
+                rootOp: 'contracts.get',
+                parts: {
+                    services: ['contract_services.query', services],
+                    billing_rules: ['contract_billing_rules.query', billingRules],
+                    charges: ['contract_charges.query', charges],
+                    units: ['contract_service_units.query', units],
+                },
+            };
         },
     });
 }

package/dist/tools/dispatch.js

@@ -134,6 +134,11 @@ async function modeCall(ctx, mode, raw, signal) {
         });
     }
     const rec = ctx.record(args.operation);
+    // In an allow-listed deployment this is deliberately before the registry error:
+    // a newly named operation has no positive grant and receives the stable policy
+    // contract, without reaching an SDK or vendor dispatch. Other policies keep the
+    // existing unknown-operation diagnostic below.
+    assertWritePermitted(args.operation, rec, ctx.config, ctx.log);
     if (rec === undefined) {
         throw new AutotaskConfigError(`invoke: unknown operation "${args.operation}" — it is not in the capability registry (list the exact keys with autotask_catalog)`, { operation: args.operation });
     }
@@ -141,7 +146,6 @@ async function modeCall(ctx, mode, raw, signal) {
         throw crossModeRefusal(rec, args.operation, mode);
     // This server's own policy gates — BEFORE any request is built (the SDK's governor runs
     // inside the invoke; the policy is this deployment's authority, applied at the boundary):
-    assertWritePermitted(args.operation, rec, ctx.config, ctx.log);
     assertSecretReadPermitted(args.operation, ctx.config, ctx.log);
     // Issue #1: strip ONE exact outer <untrusted_content> wrapper from the string inputs before
     // the call (a no-op for args that carry no wrapper; inner text untouched).
@@ -242,11 +246,13 @@ export function registerTimeEntryCreate(server, ctx) {
             record = await ctx.ops.invokeRead(ctx.client, 'time_entries.get', [id], undefined, signal);
         }
         catch (err) {
-            // A FAILED read-back never turns a successful write into an error: the id is
-            // returned with a note (the typed error's machine code only — no vendor body text).
+            // A FAILED read-back never turns a successful write into an error: the note carries
+            // the typed error's machine code only (no vendor body text) and NO bare numeric id —
+            // the created id rides `result` in structuredContent, and the user-facing line cites
+            // the linked ticket's human ticketNumber instead (issue #45).
             record = null;
             const code = err?.code;
-            note = ` the stored record read-back failed (${typeof code === 'string' ? code : 'UNKNOWN'}) — the entry was created (id ${id === undefined ? 'unknown' : id}).`;
+            note = ` the stored record read-back failed (${typeof code === 'string' ? code : 'UNKNOWN'}) — the entry was created; its id rides the result envelope (report the linked ticket's ticketNumber, never a bare id).`;
         }
         if (record === undefined)
             return abortedAnswer(ctx.correlationId);

package/dist/tools/meta.js

@@ -226,7 +226,7 @@ function registerCrossResource(server, ctx) {
     }));
     const fetchInput = closedInput(FETCH_MANY_INPUT);
     server.registerTool(FETCH_MANY_TOOL, {
-        title: 'Fetch many records by numeric id',
+        title: 'Fetch many records by numeric id (records return their human reference)',
         description: ctx.description(FETCH_MANY_TOOL),
         inputSchema: fetchInput.input,
         outputSchema: FETCH_MANY_OUTPUT,

package/dist/tools/resolves.js

@@ -7,18 +7,68 @@ import { assertSecretReadPermitted, assertWritePermitted } from '../policy.js';
 /**
  * The five R4 resolves, in core-tier order (the catalog's order). `field` = the resource's
  * primary text field(s) (from the registry records' purpose text); `getOp` = the numeric-id
- * fetch named in the miss's suggestedAction; `blind` = the company blind-surface clause
- * (companies the API user does not own are invisible to this surface).
+ * fetch named in the miss's suggestedAction; `humanFields` / `human` = the HUMAN reference the
+ * answer cites (issue #45 — the user-facing key; the numeric id is the vendor's internal key for
+ * get/update/delete only). `blind` = the company blind-surface clause (companies the API user
+ * does not own are invisible to this surface).
+ *
+ * `humanFields` (the static field names, named in the miss's suggestedAction and in the
+ * no-human-field line) documents what `human` looks for; `human` extracts the value from the
+ * record ALREADY IN HAND (zero wire — the vendor record carries it).
  */
 const RESOLVES = [
     // The order is the approved surface order (architecture §2.2 = the REGISTERED_TOOL_NAMES
     // constant): company, configurationItems, contact, project, ticket.
-    { tool: 'autotask_company_resolve', operation: 'companies.resolve', title: 'Resolve a company by id or primary text', noun: 'company', field: 'companyName', getOp: 'companies.get', blind: true },
-    { tool: 'autotask_configurationItems_resolve', operation: 'configuration_items.resolve', title: 'Resolve a configuration item by id or primary text', noun: 'configuration item', field: 'referenceTitle', getOp: 'configuration_items.get' },
-    { tool: 'autotask_contact_resolve', operation: 'contacts.resolve', title: 'Resolve a contact by id or primary text', noun: 'contact', field: 'firstName + lastName', getOp: 'contacts.get' },
-    { tool: 'autotask_project_resolve', operation: 'projects.resolve', title: 'Resolve a project by id or primary text', noun: 'project', field: 'projectName', getOp: 'projects.get' },
-    { tool: 'autotask_ticket_resolve', operation: 'tickets.resolve', title: 'Resolve a ticket by id or primary text', noun: 'ticket', field: 'title', getOp: 'tickets.get' },
+    { tool: 'autotask_company_resolve', operation: 'companies.resolve', title: 'Resolve a company by id or primary text', noun: 'company', field: 'companyName', getOp: 'companies.get', humanFields: ['companyName'], human: (r) => humanField(r, 'companyName'), blind: true },
+    { tool: 'autotask_configurationItems_resolve', operation: 'configuration_items.resolve', title: 'Resolve a configuration item by id or primary text', noun: 'configuration item', field: 'referenceTitle', getOp: 'configuration_items.get', humanFields: ['referenceTitle'], human: (r) => humanField(r, 'referenceTitle') },
+    { tool: 'autotask_contact_resolve', operation: 'contacts.resolve', title: 'Resolve a contact by id or primary text', noun: 'contact', field: 'firstName + lastName', getOp: 'contacts.get', humanFields: ['name'], human: humanName },
+    { tool: 'autotask_project_resolve', operation: 'projects.resolve', title: 'Resolve a project by id or primary text', noun: 'project', field: 'projectName', getOp: 'projects.get', humanFields: ['projectNumber', 'projectName'], human: (r) => humanField(r, 'projectNumber') ?? humanField(r, 'projectName') },
+    { tool: 'autotask_ticket_resolve', operation: 'tickets.resolve', title: 'Resolve a ticket by id or primary text', noun: 'ticket', field: 'title', getOp: 'tickets.get', humanFields: ['ticketNumber'], human: (r) => humanField(r, 'ticketNumber') },
 ];
+/** The record as a field bag (a resolve hit is a vendor record; anything else carries no human field). */
+function asRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value) ? value : {};
+}
+/** One non-empty (whitespace-trimmed) string field of the record, or `undefined` — the vendor answers
+ * partial records, and the human-key fields are typed `string` in the vendor model (a non-string value is
+ * not read as a human reference; the no-usable-field line then says so). */
+function stringField(record, field) {
+    const value = record[field];
+    if (typeof value !== 'string')
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
+/** The human reference carried by `field` (issue #45), or `undefined` when the record omits it. */
+function humanField(record, field) {
+    const value = stringField(record, field);
+    return value === undefined ? undefined : { value, label: field };
+}
+/** A contact's human reference: `firstName + lastName` (either part alone is still the person). */
+function humanName(record) {
+    const parts = [stringField(record, 'firstName'), stringField(record, 'lastName')].filter((part) => part !== undefined);
+    return parts.length === 0 ? undefined : { value: parts.join(' '), label: 'name' };
+}
+/**
+ * The resolve success line (issue #45). The user-facing key is the HUMAN reference, so:
+ * - a numeric identifier is paired with the record's human field —
+ *   `Resolved ticket "T20260914.0038" (id 48213).`;
+ * - an identifier that is not the human field names it in a trailing clause —
+ *   `Resolved ticket "Printer on fire" (ticketNumber T20260914.0038).`;
+ * - a record carrying no USABLE human field (absent, empty, whitespace-only, or not a string) keeps the
+ *   pre-#45 text and SAYS SO — naming the field(s) it looked for — so a caller never reads the number
+ *   back as the record's name.
+ */
+function resolveText(spec, identifier, record) {
+    const human = spec.human(asRecord(record));
+    if (human === undefined)
+        return `Resolved ${spec.noun} "${identifier}" (the record carries no usable ${spec.humanFields.join(' or ')}).`;
+    if (typeof identifier === 'number')
+        return `Resolved ${spec.noun} "${human.value}" (id ${identifier}).`;
+    if (identifier === human.value)
+        return `Resolved ${spec.noun} "${identifier}".`;
+    return `Resolved ${spec.noun} "${identifier}" (${human.label} ${human.value}).`;
+}
 /**
  * The typed NOT_FOUND served when the pinned SDK answers `null` (the unambiguous complete
  * non-match; ambiguity and truncation THROW and are not caught here). Both resolve paths share
@@ -32,7 +82,9 @@ function exactMiss(spec, identifier, fuzzy = false) {
         : 'For a contains match use autotask_resolve_any or autotask_search_across_resources (both in this surface)';
     return new NotFoundError(`resolve: no ${spec.noun} exactly matches "${identifier}" — matching is EXACT on ${spec.field}${blind}`, {
         operation: spec.operation,
-        suggestedAction: `${contains}; or fetch by numeric id via ${spec.getOp}.`,
+        // Issue #45: the numeric id is the internal key — the recovery names the human field the
+        // record carries, so the answer never reads back a bare id.
+        suggestedAction: `${contains}; or fetch by numeric id via ${spec.getOp} — then cite the record's ${spec.humanFields.join(' or ')}, never the bare id.`,
     });
 }
 /** Register the five Layer-B resolves. */
@@ -97,7 +149,7 @@ export function registerResolveTools(server, ctx) {
                 return abortedAnswer(ctx.correlationId);
             if (result === null)
                 throw exactMiss(spec, args.identifier, fuzzy);
-            return ok(`Resolved ${spec.noun} "${args.identifier}".`, fuzzy ? { match: 'exact', record: markResult(result, fields) } : { record: markResult(result, fields) });
+            return ok(resolveText(spec, args.identifier, result), fuzzy ? { match: 'exact', record: markResult(result, fields) } : { record: markResult(result, fields) });
         }));
     }
 }

package/dist/tools/schemas.d.ts

@@ -385,7 +385,11 @@ export declare function queryEnvelope(fields?: readonly string[]): z.ZodType;
 /** The five bounded query tools' output: the typed envelope under `result` (mirrors `resultOutput`). */
 export declare function queryEnvelopeOutput(fields?: readonly string[]): z.ZodType;
 /** A composite answer (SDK or server-built): the root record + one entry per part; a part miss
- *  is `null + absent`, never a tool failure — only a missing ROOT fails the composite. */
+ *  is `null + absent`, never a tool failure — only a missing ROOT fails the composite.
+ *  The part names are tool-specific (this shared envelope stays a record): the contract
+ *  profile serves `services` / `billing_rules` / `charges` (the recent-50 via the SDK's
+ *  count-anchored `latest`, newest first — issue #49) / `units` (issue #49), every one riding
+ *  the same value/absent envelope. */
 export declare const COMPOSITE_OUTPUT: z.ZodObject<{
     root: z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
     parts: z.ZodRecord<z.ZodString, z.ZodObject<{

package/dist/tools/schemas.js

@@ -23,7 +23,7 @@ import { AutotaskConfigError } from 'node-autotask';
 // Shared fragments
 // ---------------------------------------------------------------------------
 /** A bare vendor numeric id. */
-export const ID = z.number().int().nonnegative().describe('The vendor numeric id.');
+export const ID = z.number().int().nonnegative().describe("The vendor numeric id — an internal key; an answer cites the record's human reference (e.g. ticketNumber, projectNumber), not this id.");
 /** A bare id or exact name (the helper-tier identifier contract: numeric id tried first). */
 export const IDENTIFIER = z.union([
     z.number().int().nonnegative().describe('Numeric id — the direct fetch, tried first.'),
@@ -220,7 +220,7 @@ export const FETCH_MANY_INPUT = z.object({
     items: z
         .array(z.object({
         resource: z.string().min(1).describe('The plan resource key (e.g. tickets) — top-level resources only.'),
-        id: z.number().int().nonnegative().describe('The vendor numeric id (numeric ids ONLY — string identifiers are autotask_resolve_any territory).'),
+        id: z.number().int().nonnegative().describe('The vendor numeric id (numeric ids ONLY — string identifiers are autotask_resolve_any territory); a fetched record carries its human reference.'),
         fields: INCLUDE_FIELDS,
     }))
         .min(1)
@@ -408,6 +408,8 @@ export const CONTRACT_FULL_PROFILE_INPUT = z.object({
     id: ID.describe('The numeric contract id.'),
     service_limit: QUERY_LIMIT,
     billing_rule_limit: QUERY_LIMIT,
+    // issue #49: the two new parts (charges — the FIXED recent-50 via the SDK's `latest`; units —
+    // the fixed 50-row cap) carry NO input keys: the closed bag above is unchanged.
 });
 export const RESOURCE_WORKLOAD_INPUT = z.object({
     id: ID.describe('The numeric resource id.'),
@@ -488,7 +490,7 @@ export const AGGREGATE_INPUT = z.object({
 export const TIME_ENTRY_CREATE_INPUT = z.object({
     data: z
         .record(z.string(), z.unknown())
-        .describe('The TimeEntry record payload (vendor model fields — the landed shape: resourceID + one of ticketID / taskID / internalAllocationCodeID + dateWorked + hoursWorked + summaryNotes; ticket entries also need roleID; service-ticket entries need startDateTime + endDateTime; a completed ticket is refused; the hours field is hoursWorked, not hours; the allocation/billing code must be an active GENERAL billing code (billingCodeType 0 + isActive true, discover via billing_codes.query) or pass an explicit active general billingCodeID). The zone wall: ww29/australia-nz refuses all time-entry writes for an API-only user (vendor 500) — a real (non-API-only) resource is required.'),
+        .describe('The TimeEntry record payload (vendor model fields — the landed shape: resourceID + one of ticketID / taskID / internalAllocationCodeID + dateWorked + hoursWorked + summaryNotes; ticket entries also need roleID; service-ticket entries need startDateTime + endDateTime; a completed ticket is refused; the hours field is hoursWorked, not hours; the allocation/billing code must be an active GENERAL billing code (billingCodeType 0 + isActive true, discover via billing_codes.query) or pass an explicit active general billingCodeID). The zone wall: ww29/australia-nz refuses all time-entry writes for an API-only user (vendor 500) — a real (non-API-only) resource is required. Report the entry by the linked ticket\'s ticketNumber (resolve the linked ticketID), never by the bare id.'),
     dry_run: z.boolean().optional().describe('Omit or pass true to travel the dry-run path first (simulated: true, the mutating request is never issued); pass false to apply.'),
 });
 // ---------------------------------------------------------------------------
@@ -588,7 +590,11 @@ export function queryEnvelopeOutput(fields = []) {
     return z.object({ result: queryEnvelope(fields) });
 }
 /** A composite answer (SDK or server-built): the root record + one entry per part; a part miss
- *  is `null + absent`, never a tool failure — only a missing ROOT fails the composite. */
+ *  is `null + absent`, never a tool failure — only a missing ROOT fails the composite.
+ *  The part names are tool-specific (this shared envelope stays a record): the contract
+ *  profile serves `services` / `billing_rules` / `charges` (the recent-50 via the SDK's
+ *  count-anchored `latest`, newest first — issue #49) / `units` (issue #49), every one riding
+ *  the same value/absent envelope. */
 export const COMPOSITE_OUTPUT = z.object({
     root: dataField('The root record (a missing root fails the call with the typed vendor error).'),
     parts: z

package/dist/tools/server.d.ts

@@ -24,7 +24,7 @@ import type { Config } from '../config.js';
 import type { Logger } from '../logger.js';
 /** The wire identity of this server (the initialize answer + the `/metadata` payload). */
 export declare const SERVER_NAME = "iit-mcp-autotask";
-export declare const SERVER_VERSION = "0.4.1";
+export declare const SERVER_VERSION = "0.4.3";
 export declare const SERVER_TITLE = "Autotask MCP Server";
 /**
  * The MCP protocol era this server advertises (the `/metadata` stamp, both levels).
@@ -62,7 +62,7 @@ export declare const SERVER_INSTRUCTIONS: string;
 /** The full identity stamp (the `/metadata` build block — the era pair, FR-2). */
 export declare const SERVER_IDENTITY: {
     readonly name: "iit-mcp-autotask";
-    readonly version: "0.4.1";
+    readonly version: "0.4.3";
     readonly mcpProtocolBaseline: "2026-07-28";
     readonly legacyProtocolFallback: "2025-11-25";
 };

package/dist/tools/server.js

@@ -27,7 +27,7 @@ import { UNTRUSTED_NOTE } from './catalog-data.js';
 import { registerTools } from './register.js';
 /** The wire identity of this server (the initialize answer + the `/metadata` payload). */
 export const SERVER_NAME = 'iit-mcp-autotask';
-export const SERVER_VERSION = '0.4.1';
+export const SERVER_VERSION = '0.4.3';
 export const SERVER_TITLE = 'Autotask MCP Server';
 /**
  * The MCP protocol era this server advertises (the `/metadata` stamp, both levels).
@@ -78,6 +78,7 @@ Lookup protocol (usage rules — follow them):
 2. Queues, status, priority, ticket type, issue type and source are picklists, not records; their labels need the field catalog with labels (SDK 0.9.0 line), not a name search.
 3. After any write, read the stored record back (see #19) and report it.
 4. An empty or null result is not an answer until the documented fallbacks have been tried.
+5. Report every record by its HUMAN reference, never a bare numeric id (issue #45): a ticket by ticketNumber, a project by projectNumber (projectName when the record carries none), a company by companyName, a contact by name, a configuration item by referenceTitle. The record you hold carries it — the numeric id is an internal key for get/update/delete only. An error that names numeric resourceIds is the same case, but read it carefully: the array carries NO label saying what those ids are. The SDK stamps them across entity types — the failed record's own id, the candidate ids of a RESOLUTION_AMBIGUOUS, a company id, a billing-code id, a staff resource id. Resolve them only against the entity the error's own message, suggestedAction, or (for a plain <resource>.get miss on the operation's own record) its operation key NAMES (resources for a staff id — assignedResourceID / owner / resourceID, and operations.expandResourceNames resolves RESOURCES ids ONLY, never a ticket/company/billing-code id; billing_codes for an allocation code; companies for a company id); when none of those names the entity, ask the user instead of guessing. Resolve many ids in ONE bounded call (autotask_fetch_many items [{ resource, id }] caps at 500 per call — chunk past that; or autotask_read <resource>.query with filter [{ field: 'id', op: 'in', value: [...] }]) — never one resolve per row.
 
 Query options (the bounded query tools — the five *query tools + autotask_read query/count ops):
 - latest: N returns only the N newest records (highest id), no paging — always pair it with a filter, ideally a narrow date window (the vendor has no sort; an unfiltered latest on a blind surface returns an empty stamped result, and a very large match set can fail with LATEST_THRESHOLD_UNRESOLVED or LATEST_WINDOW_INCOMPLETE, whose suggestedAction says how to narrow).
@@ -109,11 +110,11 @@ Rate budget and low-budget behaviour: autotask_threshold_information serves two
 
 autotask_read query params: latest (the N newest rows by id), noteChars (cap free-text fields), and fieldsPreset: 'billing_join' on billing_items.query (the 14 billing join/measure columns; not combinable with includeFields). For query/count ops args[0].filter must be a conditions array or { filter: [...] } — a bare condition/group object or any other shape is refused before dispatch (refused rather than risk an unfiltered query).
 
-Recipe — autotask_company_unbilled_work: id + the optional closed bag — source ('posted_uninvoiced' default, the billing items with no invoiceID; 'invoice' — needs invoice_id; 'date_range' — needs date_from + date_to; 'tickets' — needs non-empty ticket_ids), include_parent (default true — ONE level only), date_from / date_to (YYYY-MM-DD; narrows the billing items' itemDate in every source), include_notes (default false — the note fields are EXCLUDED; when true they are capped at note_chars, default 400, a cut value ending with the … [+M chars truncated] marker), rollup ('ticket' default — per-ticket rows; 'entry' — the capped per-entry list), limit (the per-part record cap, default 25, clamped 1..500). Wire: 6(+1) bounded reads; the unposted anti-join + totals + warnings are client-side folds (zero wire).
+Recipe — autotask_company_unbilled_work: id + the optional closed bag — source ('posted_uninvoiced' default, the billing items with no invoiceID; 'invoice' — needs invoice_id; 'date_range' — needs date_from + date_to; 'tickets' — needs non-empty ticket_ids), include_parent (default true — ONE level only), date_from / date_to (YYYY-MM-DD; narrows the billing items' itemDate in every source), include_notes (default false — the note fields are EXCLUDED; when true they are capped at note_chars, default 400, a cut value ending with the … [+M chars truncated] marker), rollup ('ticket' default — per-ticket rows; 'entry' — the capped per-entry list), limit (the per-part record cap, default 25, clamped 1..500). Wire: 6(+1) bounded reads; the unposted anti-join + totals + warnings are client-side folds (zero wire). Per-ticket rollup rows carry the numeric ticketId ONLY — resolve the distinct ids in ONE bounded call (autotask_read tickets.query with filter [{ field: 'id', op: 'in', value: [...] }], include_fields ['id','ticketNumber'], or autotask_fetch_many) when the answer must name the tickets; report the ticketNumber, never the bare id (rule 5).
 
-Recipe — autotask_aggregate: operation (the EXACT registry query op — a plan resource's .query ONLY; a special op, a .count row or an unknown resource is refused pre-request, naming autotask_catalog), filter (the query-bag condition grammar — 13 operators; an empty array = the unfiltered call: a 0 on a plan-pinned blind surface is marked blind: true, never a silent absence; a filtered 0 on an unfiltered-blind surface is a true zero) + the optional closed bag: group_by (vendor field names — the group key is the field tuple), sum (numeric vendor fields), top (default 25, clamped 1..100 — the group-row cap), limit (default 2500 — the total-record cap for the walk modes; the house hard max). NEITHER group_by NOR sum = COUNT mode (exactly one POST /query/count — no walk, no GETs; the count endpoint is not cached); a group_by or sum = WALK mode (/query pages of min(500, limit), <= ceil(limit/500) pages + the 1000-page guard; the queries are not cached). The fold is client-side: groups carry count + the requested sums; totalGroups + groupsTruncated say when top cut the groups; hasMore + totalScanned say when the walk truncated — groups/sums cover the returned rows ONLY (no silent partial sums); a mid-walk RATE_LIMITED propagates (the partial fold is discarded).
+Recipe — autotask_aggregate: operation (the EXACT registry query op — a plan resource's .query ONLY; a special op, a .count row or an unknown resource is refused pre-request, naming autotask_catalog), filter (the query-bag condition grammar — 13 operators; an empty array = the unfiltered call: a 0 on a plan-pinned blind surface is marked blind: true, never a silent absence; a filtered 0 on an unfiltered-blind surface is a true zero) + the optional closed bag: group_by (vendor field names — the group key is the field tuple), sum (numeric vendor fields), top (default 25, clamped 1..100 — the group-row cap), limit (default 2500 — the total-record cap for the walk modes; the house hard max). NEITHER group_by NOR sum = COUNT mode (exactly one POST /query/count — no walk, no GETs; the count endpoint is not cached); a group_by or sum = WALK mode (/query pages of min(500, limit), <= ceil(limit/500) pages + the 1000-page guard; the queries are not cached). The fold is client-side: groups carry count + the requested sums; totalGroups + groupsTruncated say when top cut the groups; hasMore + totalScanned say when the walk truncated — groups/sums cover the returned rows ONLY (no silent partial sums); a mid-walk RATE_LIMITED propagates (the partial fold is discarded). Group/sum rows carry the vendor fields you grouped by — when a grouped field is a numeric FK (e.g. ticketID, companyID), resolve the distinct ids in ONE bounded call (the owning resource's query with filter [{ field: 'id', op: 'in', value: [...] }], or autotask_fetch_many) before reporting them (rule 5).
 
-Recipe — autotask_timeEntry_create: data is required (the TimeEntry payload — vendor model fields); vendor field chain (a bare payload burns vendor 500s, one per real wire dial): link the entry to one of ticketID / taskID / internalAllocationCodeID; entries on Tickets also require roleID; entries on Service tickets require startDateTime + endDateTime; the hours field is hoursWorked (NOT hours) — at least one of hoursWorked or (startDateTime + endDateTime) is required; the linked ticket must be open (a completed ticket is refused); the allocation code must be an active GENERAL billing code (billingCodeType 0 + isActive true — discover one via billing_codes.query) or pass an explicit active general billingCodeID. On apply (dry_run: false) the tool reads back the created record (live: the write clears the SDK read cache) and returns it as record next to result.id; a dry run returns no record; a read-back failure returns the id with a note and never fails the write.
+Recipe — autotask_timeEntry_create: data is required (the TimeEntry payload — vendor model fields); vendor field chain (a bare payload burns vendor 500s, one per real wire dial): link the entry to one of ticketID / taskID / internalAllocationCodeID; entries on Tickets also require roleID; entries on Service tickets require startDateTime + endDateTime; the hours field is hoursWorked (NOT hours) — at least one of hoursWorked or (startDateTime + endDateTime) is required; the linked ticket must be open (a completed ticket is refused); the allocation code must be an active GENERAL billing code (billingCodeType 0 + isActive true — discover one via billing_codes.query) or pass an explicit active general billingCodeID. On apply (dry_run: false) the tool reads back the created record (live: the write clears the SDK read cache) and returns it as record next to result.id; a dry run returns no record; a read-back failure leaves record null, adds a note naming the typed error code and never fails the write (the created id rides result). Report the entry by the LINKED TICKET's human ticketNumber — autotask_ticket_resolve on the linked ticketID (NOT autotask_ticket_find_by_ticket_number, which takes the ticketNumber string, not the id) — never by the created entry's bare id.
 
 Writes: dry-run-first — omit dry_run or pass true → the pinned DryRunResult envelope (simulated: true — the mutating request is never issued); pass dry_run: false to apply. The 3 approval-gated writes (configuration_items.moveConfigurationItem, contacts.moveToCompany, resources.transferOwnership) additionally require confirm === the operation key, in BOTH dry-run and apply mode. Deletes (all 54) require confirm === the operation key in BOTH modes — the deliberate act is the call, not the delete. time_entries.create reached through the generic autotask_write returns only { id } on apply — autotask_timeEntry_create is the path that returns the stored record.
 `.trim();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "iit-mcp-autotask",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "description": "MCP server for the Autotask (Datto) PSA domain, built on the node-autotask SDK",
   "license": "MIT",
   "author": "Max Soukhomlinov",
@@ -47,7 +47,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/server": "^2.2.0",
-    "node-autotask": "0.10.0",
+    "node-autotask": "0.11.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/server.json

@@ -1,6 +1,6 @@
 {
   "name": "iit-mcp-autotask",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "description": "MCP server for the Autotask (Datto) PSA API, powered by the node-autotask SDK",
   "mcpProtocolBaseline": "2026-07-28",
   "legacyProtocolFallback": "2025-11-25",
@@ -29,7 +29,7 @@
   "capabilitiesManifest": "capabilities.json",
   "sdk": {
     "package": "node-autotask",
-    "versionRange": "0.10.0"
+    "versionRange": "0.11.0"
   },
   "vendorExtensions": false
 }