portkey-admin-mcp 0.12.1 → 0.12.2

package/ENDPOINTS.md

@@ -275,7 +275,7 @@ Routes:
 
 | Tool | Selection guidance and result |
 |---|---|
-| `list_audit_logs` | List audit log events for a Portkey workspace or organization. Returns paginated action-level records with actor, resource, metadata, and timestamps for compliance or incident review; use this instead of analytics when you need individual events, not aggregates. Enterprise-gated. Returns 403 on non-Enterprise Portkey plans. |
+| `list_audit_logs` | List audit log records for a Portkey organization within a time range (Enterprise plan only; other plans get a permissions error). Each record is a state-changing API request (POST, PUT, or DELETE) with timestamp, method, uri, request_id, user_id, user_type (user or api_key), organisation_id, workspace_id, response_status_code, resource_type, action, client_ip, country, plus request_body, query_params, and request_headers as JSON strings. Use it for compliance or incident review of individual events; use analytics instead for aggregates. Enterprise-gated. Returns 403 on non-Enterprise Portkey plans. |
 
 ## labels (5)
 

package/README.md

@@ -238,17 +238,22 @@ For local-only HTTP use, leave `MCP_HOST` at its default `127.0.0.1`. Set `MCP_H
 | `PORTKEY_ALLOW_PRIVATE_BASE_URL` | — | Set to `true` to allow a literal loopback/private `PORTKEY_BASE_URL` |
 | `PORTKEY_ALLOW_INSECURE_HTTP` | — | Separately set to `true` only when a trusted self-hosted gateway cannot use HTTPS |
 | `PORTKEY_TOOL_DOMAINS` | — | Server-side allowlist of the 20 domains: `users`, `workspaces`, `configs`, `deployments`, `keys`, `collections`, `prompts`, `analytics`, `guardrails`, `limits`, `audit`, `labels`, `partials`, `tracing`, `logging`, `providers`, `secret-references`, `integrations`, `mcp-integrations`, `mcp-servers`. HTTP `?tools=` may narrow it but cannot expand it |
+| `MCP_TOOL_DOMAINS` | — | Fallback for `PORTKEY_TOOL_DOMAINS`, used only when that is unset |
+| `MCP_TRANSPORT` | `stdio` | `stdio` or `http`; the Docker image picks its entrypoint from this (set `http` for the HTTP server) |
 | `MCP_HOST` | `127.0.0.1` | Bind address |
 | `MCP_PORT` | `3000` | Port |
+| `PORT` | — | Port override; takes precedence over `MCP_PORT` when set |
 | `MCP_PUBLIC_BASE_URL` | — | Public absolute base URL to advertise from `/auth/info` and the status page; recommended for hosted deployments |
 | `MCP_AUTH_MODE` | `none` | `none`, `bearer`, or `clerk` (`none` is blocked for HTTP unless explicitly overridden) |
 | `MCP_AUTH_TOKEN` | — | Secret for bearer auth |
 | `CLERK_ISSUER` / `CLERK_AUDIENCE` | — | Required issuer and audience when `MCP_AUTH_MODE=clerk` |
+| `CLERK_JWKS_URL` | `<CLERK_ISSUER>/.well-known/jwks.json` | JWKS endpoint for Clerk JWT verification; must be HTTPS. Set it only when the JWKS isn't at the default path |
 | `CLERK_ALLOWED_SUBJECTS` | — | Optional CSV subject allowlist for Clerk; at least one Clerk authorization policy is required |
 | `CLERK_ALLOWED_ORGANIZATION_IDS` / `CLERK_ALLOWED_ROLES` | — | Optional CSV organization and role constraints; every configured constraint must match |
 | `CLERK_REQUIRED_PERMISSIONS` | — | Optional CSV permissions that must all be present in the verified Clerk JWT |
 | `MCP_ALLOW_UNAUTHENTICATED_HTTP` | — | Set to `true` only for intentional local unauthenticated HTTP debugging |
 | `MCP_SESSION_MODE` | `stateful` | `stateful` or `stateless` |
+| `MCP_SESSION_TIMEOUT` | `3600000` | Idle timeout for stateful sessions, in milliseconds; `0` or more |
 | `MCP_MAX_SESSIONS` | `100` | Maximum concurrent stateful sessions or active stateless request handlers |
 | `MCP_EVENT_STORE` | `off` | `off`, `memory`, or `redis`; stateless `GET /mcp` replay requires `memory` or `redis` |
 | `MCP_EVENT_TTL_SECONDS` | `300` | Replay retention in seconds |
@@ -260,11 +265,22 @@ For local-only HTTP use, leave `MCP_HOST` at its default `127.0.0.1`. Set `MCP_H
 | `MCP_REDIS_KEY_PREFIX` | `mcp:event-store` | Dedicated Redis namespace for replay data |
 | `MCP_TLS_KEY_PATH` | — | TLS key for native HTTPS |
 | `MCP_TLS_CERT_PATH` | — | TLS cert for native HTTPS |
+| `MCP_TLS_CA_PATH` | — | Optional CA bundle for native HTTPS; only used when the TLS key and cert are set |
+| `MCP_SHUTDOWN_TIMEOUT_MS` | `10000` | How long graceful shutdown waits before the process is forced to exit, in milliseconds; must be positive |
+| `MCP_MAX_REQUEST_SIZE` | `1mb` | Maximum HTTP request body size |
+| `MCP_READY_CHECK_MODE` | `local` | `local` or `portkey`; `portkey` makes `/ready` also check Portkey connectivity |
+| `LOG_LEVEL` | `info` | `debug`, `info`, `warn`, or `error` |
 | `ALLOWED_ORIGINS` | — | CORS allow-list; also used to validate the `Host` header (DNS-rebinding protection) when `MCP_AUTH_MODE=none` |
+| `CORS_ORIGIN` | — | Legacy fallback for `ALLOWED_ORIGINS`, used only when that is unset |
 | `MCP_TRUST_PROXY` | `loopback` | Express trust-proxy policy. Use an exact nonnegative hop count or trusted proxy subnet; `true` is rejected because it trusts forwarding headers from every peer |
 | `RATE_LIMIT_STORE` | `memory` | `redis` for multi-instance/serverless deployments; production memory mode requires `RATE_LIMIT_SINGLE_PROCESS=true` |
+| `RATE_LIMIT_ENABLED` | `true` | Set to `false` to turn the pre-authentication rate limiter off |
+| `RATE_LIMIT_SINGLE_PROCESS` | — | Set to `true` to acknowledge a single-process deployment when using in-memory limiting in production |
 | `RATE_LIMIT_REDIS_URL` | — | Shared limiter Redis URL, falling back to `MCP_REDIS_URL`/`REDIS_URL`; production requires `rediss://` |
 | `RATE_LIMIT_REDIS_KEY_PREFIX` | `mcp:rate-limit` | Redis namespace for atomic pre-authentication IP and principal-plus-IP token buckets |
+| `RATE_LIMIT_MAX` | `60` | Maximum tokens in each pre-authentication IP and principal-plus-IP bucket |
+| `RATE_LIMIT_WINDOW_MS` | `60000` | Rate-limit window in milliseconds |
+| `RATE_LIMIT_REFILL` | `60` | Tokens refilled each window |
 | `RATE_LIMIT_MAX_BUCKETS` | `10000` | Maximum local buckets in explicit memory mode before new clients share overflow capacity |
 
 Production containers must choose their rate-limit topology explicitly: set
@@ -332,6 +348,9 @@ The live smoke suite reports expected credential-scope denials and the explicitl
 tracked hosted control-plane route gaps as skips. Unexpected HTTP responses,
 network errors, and response-contract failures still fail the run.
 
+`list_audit_logs` is Enterprise-only, so the smoke suite skips its check unless
+`PORTKEY_ORGANISATION_ID` is set. Set it to your organisation ID to exercise that route.
+
 The required CI and release gates measure every TypeScript source file and fail
 below 80% line coverage. The current full report is 98.19% lines, 91.92%
 branches, and 98.58% functions.
@@ -361,7 +380,7 @@ tool catalog in this repository as authoritative when a third-party index lags.
 ### Built With
 
 [![TypeScript](https://img.shields.io/badge/TypeScript_7.0-3178C6?logo=typescript&logoColor=fff)](https://www.typescriptlang.org/)
-[![MCP SDK](https://img.shields.io/badge/MCP_SDK_1.30-000?logo=modelcontextprotocol&logoColor=fff)](https://github.com/modelcontextprotocol/typescript-sdk)
+[![MCP SDK](https://img.shields.io/badge/MCP_SDK_1.31-000?logo=modelcontextprotocol&logoColor=fff)](https://github.com/modelcontextprotocol/typescript-sdk)
 [![Zod 4](https://img.shields.io/badge/Zod_4-3E67B1?logo=zod&logoColor=fff)](https://zod.dev/)
 [![Biome](https://img.shields.io/badge/Biome_2.5-60a5fa?logo=biome&logoColor=fff)](https://biomejs.dev/)
 [![Node 24](https://img.shields.io/badge/Node_24-339933?logo=nodedotjs&logoColor=fff)](https://nodejs.org/)

package/docs/DISTRIBUTION.md

@@ -1,6 +1,8 @@
 # Distribution and directory inventory
 
-> Last audited: 2026-09-08
+> Last audited: 2026-10-02. Rechecked that day: the Awesome MCP Servers PR, the
+> LobeHub listings, the Docker MCP Catalog PR, and Glama. The other downstream
+> rows below still reflect 2026-09-08.
 
 The generated catalog in this repository is the source of truth for tool names,
 counts, and descriptions. Public directory pages can lag a release or retain a
@@ -14,8 +16,8 @@ legacy repository owner, so they should not be used to validate the runtime.
 | [npm](https://www.npmjs.com/package/portkey-admin-mcp) | Canonical package distribution | Automated from a protected release tag using `package.json` |
 | [Official MCP Registry](https://registry.modelcontextprotocol.io/v0/servers?search=io.github.CodesWhat/portkey-admin-mcp) | Canonical MCP metadata under `io.github.CodesWhat/portkey-admin-mcp` | Automated after npm publication using `server.json` |
 | [LobeHub](https://lobehub.com/mcp/codeswhat-portkey-admin-mcp) | Claimed marketplace listing | Run `npm run update:lobehub` after release; `lhm.plugin.json` is owner-declared metadata |
-| [Glama](https://glama.ai/mcp/servers/CodesWhat/portkey-admin-mcp) | Claimed directory and quality listing | Indexes GitHub; use the listing's **Sync Server** control when the tagged commit or catalog lags |
-| [Awesome MCP Servers](https://github.com/punkpeye/awesome-mcp-servers/pull/13074) | Community list entry; CodesWhat correction is awaiting upstream merge | Keep PR #13074 current with the repository owner, Glama badge, and released catalog count |
+| [Glama](https://glama.ai/mcp/servers/CodesWhat/portkey-admin-mcp) | Claimed directory and quality listing. On 2026-10-02 its tool definitions were still at v0.11.5 (last synced 2026-09-08), its description said 150 tools across 18 domains, and its FAQ said 151 tools. The README text it shows says 181 tools across 20 domains | Indexes GitHub; use the listing's **Sync Server** control to pick up 0.12.1, then verify the version and tool count it shows |
+| [Awesome MCP Servers](https://github.com/punkpeye/awesome-mcp-servers/pull/13074) | Community list entry; the CodesWhat correction (PR #13074) merged on 2026-09-13 | Update the entry through a new PR when the repository owner, Glama badge, or released catalog count changes |
 
 The canonical description for owner-controlled records is:
 
@@ -30,11 +32,11 @@ runtime catalog before release.
 
 | Surface | State on 2026-09-08 | Maintenance decision |
 |---|---|---|
-| [LobeHub legacy listing](https://lobehub.com/mcp/scttbnsn-portkey-admin-mcp) | A second claimed listing remains published at version 0.3.5 under the previous owner slug | Unpublish `scttbnsn-portkey-admin-mcp` after the canonical CodesWhat listing reaches 0.12.0, then verify only the canonical listing remains |
+| [LobeHub legacy listing](https://lobehub.com/mcp/scttbnsn-portkey-admin-mcp) | Unpublished on 2026-09-08. On 2026-10-02 the market CLI listed it as `unpublished` at version 0.3.5 and the public page returned 404, while the canonical `codeswhat-portkey-admin-mcp` listing was `published` at 0.12.1 | Nothing to do; only the canonical listing is published |
 | [PulseMCP](https://www.pulsemcp.com/servers) | A legacy record uses `io.github.s-b-e-n-s-o-n/portkey-admin-mcp` and an old count; listing changes are paused | Recheck when its submission and correction flow reopens; prefer MCP Registry ingestion |
 | [mcp.so](https://mcp.so/servers/portkey-admin-mcp) | Live but stale under the previous owner, with a visible claim control and conflicting counts | Claim and refresh only through its owner workflow; do not automate an undocumented interface |
-| [mcpservers.org](https://mcpservers.org/servers/s-b-e-n-s-o-n/portkey-admin-mcp) | Scrapes the current README but retains the previous owner slug and a 151-tool headline | Use its **Request update** flow after 0.12.0, then treat the result as downstream indexing rather than a release gate |
-| [FindMCP](https://findmcp.app/servers/io-github-s-b-e-n-s-o-n-portkey-admin-mcp) | Mirrors the legacy MCP Registry namespace and old catalog, with no canonical CodesWhat record | After 0.12.0, use **Claim this listing** or **Submit Update** for the CodesWhat record and report the old page as duplicate or incorrect |
+| [mcpservers.org](https://mcpservers.org/servers/s-b-e-n-s-o-n/portkey-admin-mcp) | Scrapes the current README but retains the previous owner slug and a 151-tool headline | Use its **Request update** flow, then treat the result as downstream indexing rather than a release gate |
+| [FindMCP](https://findmcp.app/servers/io-github-s-b-e-n-s-o-n-portkey-admin-mcp) | Mirrors the legacy MCP Registry namespace and old catalog, with no canonical CodesWhat record | Use **Claim this listing** or **Submit Update** for the CodesWhat record and report the old page as duplicate or incorrect |
 | [Enterprise DNA](https://enterprisedna.co/directories/mcp/s-b-e-n-s-o-n-portkey-admin-mcp/) | Scraped page under the previous GitHub owner | Treat as a downstream mirror unless it publishes a maintainer update path |
 
 These listings are discoverability mirrors, not release gates. Do not copy their
@@ -42,11 +44,12 @@ counts or descriptions back into project metadata.
 
 ## Recommended expansion
 
-The [Docker MCP Catalog](https://hub.docker.com/mcp) is the next useful listing.
-It is curated, has a documented pull-request submission path, and matches the
-repository's existing non-root Docker image and stdio support. The submission
-should reference a released commit and pass Docker's image validation before it
-is treated as complete.
+The [Docker MCP Catalog](https://hub.docker.com/mcp) is curated, has a documented
+pull-request submission path, and matches the repository's existing non-root
+Docker image and stdio support. The submission is
+[docker/mcp-registry#5026](https://github.com/docker/mcp-registry/pull/5026),
+open and awaiting maintainer review as of 2026-10-02, and pinned to the 0.12.0
+release commit. It isn't complete until Docker merges it and the listing is live.
 
 [Smithery](https://smithery.ai/docs/build/publish) is deferred. Its current
 publishing paths expect a public Streamable HTTP endpoint or an MCPB bundle for a

package/package.json

@@ -25,8 +25,9 @@
 		"record:fixtures": "tsx tests/fixtures/record.ts",
 		"verify:tool-quality": "node scripts/check-tool-definition-quality.mjs",
 		"verify:readme-tools": "node scripts/verify-readme-tools.mjs",
+		"verify:generated": "node scripts/verify-generated.mjs",
 		"knip": "knip",
-		"ci": "npm run lint && npm run knip && npm run typecheck && npm run typecheck:tests && npm run test:coverage && npm run build && npm run verify:tool-quality && npm run test:e2e && npm run verify:readme-tools",
+		"ci": "npm run lint && npm run knip && npm run typecheck && npm run typecheck:tests && npm run test:coverage && npm run build && npm run verify:tool-quality && npm run test:e2e && npm run verify:readme-tools && npm run verify:generated",
 		"start:http": "node build/server.js",
 		"generate:lobehub-tools": "npm run build && node scripts/generate-lobehub-tools.mjs && biome format --write lhm.plugin.json",
 		"generate:endpoints": "node scripts/generate-endpoints.mjs",
@@ -47,18 +48,18 @@
 		"docs/VERCEL_DEPLOYMENT.md"
 	],
 	"dependencies": {
-		"@modelcontextprotocol/sdk": "^1.30.0",
+		"@modelcontextprotocol/sdk": "^1.31.0",
 		"cors": "^2.8.6",
 		"express": "^5.2.1",
 		"express-rate-limit": "^8.2.1",
 		"helmet": "^8.3.0",
 		"jose": "^6.2.2",
 		"redis": "^6.1.0",
-		"zod": "^4.3.6"
+		"zod": "^4.6.5"
 	},
 	"name": "portkey-admin-mcp",
 	"mcpName": "io.github.CodesWhat/portkey-admin-mcp",
-	"version": "0.12.1",
+	"version": "0.12.2",
 	"main": "build/index.js",
 	"keywords": [
 		"mcp",