portkey-admin-mcp 0.12.2 → 0.14.0

package/build/server.js

@@ -25,6 +25,128 @@ import cors from "cors";
 import express from "express";
 import helmet from "helmet";
 
+// src/schemas/contracts/access-policies.contract.ts
+import { z } from "zod";
+var AccessPolicySubjectSchema = z.object({
+  type: z.enum(["user", "group", "agent"]).describe("Subject kind; users and agents are matched independently"),
+  id: z.string().min(1).describe(
+    "Subject ID; ANY matches all users or all agents, but cannot identify a group"
+  )
+}).refine((subject) => subject.type !== "group" || subject.id !== "ANY", {
+  message: "ANY is supported only for users and agents"
+});
+var selectionSchema = z.union([
+  z.literal("ALL"),
+  z.array(z.string().min(1)).min(1)
+]);
+var AccessPolicyTargetSchema = z.discriminatedUnion("type", [
+  z.object({
+    type: z.literal("mcp_server").describe("Target an MCP server"),
+    server_id: z.string().min(1).describe(
+      "MCP server UUID or slug in the workspace; responses return the UUID"
+    ),
+    tools: selectionSchema.describe(
+      "ALL tools on the server, or a nonempty list of tool names"
+    )
+  }),
+  z.object({
+    type: z.literal("provider").describe("Target a provider"),
+    provider_id: z.string().min(1).describe(
+      "Provider UUID or slug in the workspace; responses return the UUID"
+    ),
+    models: selectionSchema.optional().describe(
+      "ALL models or a nonempty list of model slugs; omitted defaults to ALL in Portkey"
+    )
+  })
+]);
+var policyFields = {
+  name: z.string().min(1).max(64).describe("Policy name, unique within the workspace (1-64 characters)"),
+  description: z.string().max(256).nullable().optional().describe("Policy description; null clears it"),
+  effect: z.enum(["allow", "deny"]).optional().describe(
+    "Allow or deny access; omitted create effect is inferred, while omitted update effect keeps its stored value"
+  ),
+  subjects: z.array(AccessPolicySubjectSchema).min(1).describe(
+    "Complete subject list; updates replace the existing subjects. A side without entries matches requests without that principal"
+  ),
+  targets: z.array(AccessPolicyTargetSchema).min(1).describe("Complete target list; updates replace the existing targets"),
+  enabled: z.boolean().optional().describe(
+    "Whether the policy is enabled; creates default to true, updates preserve the stored value when omitted"
+  )
+};
+function hasSpecificAllowSubject(policy) {
+  return policy.effect !== "allow" || policy.subjects.some((subject) => subject.id !== "ANY");
+}
+var CreateAccessPolicyRequestSchema = z.object({
+  workspace_id: z.string().optional().describe(
+    "Workspace UUID or slug; required with an organisation-level API key"
+  ),
+  ...policyFields
+}).refine(
+  (policy) => {
+    const effect = policy.effect ?? (policy.subjects.some(
+      (subject) => subject.type === "user" && subject.id === "ANY"
+    ) && policy.subjects.some(
+      (subject) => subject.type === "agent" && subject.id === "ANY"
+    ) ? "deny" : "allow");
+    return hasSpecificAllowSubject({ ...policy, effect });
+  },
+  {
+    message: "An allow policy must name at least one specific user, group, or agent"
+  }
+);
+var UpdateAccessPolicyRequestSchema = z.object({
+  ...policyFields,
+  name: policyFields.name.optional(),
+  version: z.number().int().min(1).describe(
+    "Current version from get_access_policy; a stale version returns HTTP 409"
+  )
+}).refine(hasSpecificAllowSubject, {
+  message: "An allow policy must name at least one specific user, group, or agent"
+});
+var responseFields = {
+  id: z.string().uuid().optional(),
+  name: z.string().optional(),
+  description: z.string().nullable().optional(),
+  enabled: z.boolean().optional(),
+  effect: z.enum(["allow", "deny"]).optional(),
+  version: z.number().int().optional(),
+  status: z.literal("active").optional(),
+  workspace_id: z.string().uuid().optional(),
+  organisation_id: z.string().uuid().optional(),
+  created_by: z.string().nullable().optional(),
+  created_at: z.iso.datetime().optional(),
+  last_updated_at: z.iso.datetime().optional(),
+  object: z.literal("access").optional()
+};
+var AccessPolicyListItemSchema = z.object({
+  ...responseFields,
+  allow_all_users: z.boolean().optional(),
+  allow_all_agents: z.boolean().optional(),
+  target_server_count: z.number().int().optional(),
+  target_provider_count: z.number().int().optional()
+});
+var AccessPolicySchema = z.object({
+  ...responseFields,
+  subjects: z.array(
+    z.object({
+      type: z.enum(["user", "group", "agent"]).optional(),
+      id: z.string().optional(),
+      name: z.string().nullable().optional(),
+      email: z.string().nullable().optional()
+    })
+  ).optional(),
+  targets: z.array(AccessPolicyTargetSchema).optional()
+});
+var ListAccessPoliciesResponseSchema = z.object({
+  object: z.literal("list").optional(),
+  total: z.number().int().optional(),
+  data: z.array(AccessPolicyListItemSchema).optional()
+});
+var CreateAccessPolicyResponseSchema = z.object({
+  id: z.string().uuid().optional(),
+  object: z.literal("access").optional()
+});
+
 // src/services/base.service.ts
 import crypto from "node:crypto";
 
@@ -441,6 +563,48 @@ var BaseService = class {
   }
 };
 
+// src/services/access-policies.service.ts
+function normalizePolicy(value) {
+  const policy = { ...value };
+  for (const field of ["enabled", "allow_all_users", "allow_all_agents"]) {
+    if (policy[field] === 0 || policy[field] === 1)
+      policy[field] = policy[field] === 1;
+  }
+  if (policy.object === "acces") policy.object = "access";
+  return policy;
+}
+var AccessPoliciesService = class extends BaseService {
+  async createAccessPolicy(data) {
+    return CreateAccessPolicyResponseSchema.parse(
+      normalizePolicy(await this.post("/policies/access", data))
+    );
+  }
+  async listAccessPolicies(params) {
+    const response = await this.get(
+      "/policies/access",
+      params
+    );
+    return ListAccessPoliciesResponseSchema.parse({
+      ...response,
+      ...Array.isArray(response.data) ? { data: response.data.map(normalizePolicy) } : {}
+    });
+  }
+  async getAccessPolicy(id) {
+    return AccessPolicySchema.parse(
+      normalizePolicy(
+        await this.get(`/policies/access/${this.encodePathSegment(id)}`)
+      )
+    );
+  }
+  async updateAccessPolicy(id, data) {
+    return this.put(`/policies/access/${this.encodePathSegment(id)}`, data);
+  }
+  async deleteAccessPolicy(id) {
+    await this.delete(`/policies/access/${this.encodePathSegment(id)}`);
+    return {};
+  }
+};
+
 // src/services/analytics.service.ts
 var AnalyticsService = class extends BaseService {
   /**
@@ -467,6 +631,7 @@ var AnalyticsService = class extends BaseService {
       api_key_ids: params.api_key_ids,
       metadata: params.metadata,
       ai_org_model: params.ai_org_model,
+      deployment_id: params.deployment_id,
       trace_id: params.trace_id,
       span_id: params.span_id,
       prompt_slug: params.prompt_slug
@@ -635,6 +800,24 @@ var AnalyticsService = class extends BaseService {
       this.buildAnalyticsParams(params)
     );
   }
+  async getAnalyticsGroupMcp(params) {
+    return this.get(
+      "/analytics/groups/mcp",
+      this.buildAnalyticsParams(params)
+    );
+  }
+  async getAnalyticsGroupA2a(params) {
+    return this.get(
+      "/analytics/groups/a2a",
+      this.buildAnalyticsParams(params)
+    );
+  }
+  async getAnalyticsGroupWorkspaces(params) {
+    return this.get(
+      "/analytics/groups/workspaces",
+      this.buildAnalyticsParams(params)
+    );
+  }
 };
 
 // src/services/audit.service.ts
@@ -761,6 +944,85 @@ var DeploymentsService = class extends BaseService {
   }
 };
 
+// src/schemas/contracts/egress-allowlist.contract.ts
+import { isIP } from "node:net";
+import { z as z2 } from "zod";
+var EgressAllowlistDomainSchema = z2.string().min(1).max(255).refine(
+  (value) => {
+    const host = value.trim();
+    if (isIP(host) || host.startsWith("[") && host.endsWith("]") && isIP(host.slice(1, -1)) === 6)
+      return true;
+    const hostname = host.replace(/^\*\./, "").replace(/\.$/, "");
+    return hostname.split(".").every(
+      (label) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i.test(label)
+    );
+  },
+  {
+    message: "Use a hostname, IP literal, or *. wildcard without scheme, path, credentials, or port"
+  }
+).describe(
+  "Exact hostname, IPv4/IPv6 literal (optionally bracketed), or *. wildcard. No scheme, path, credentials, or port. Portkey trims/lowercases it and rejects cloud-metadata destinations"
+);
+var descriptionSchema = z2.string().max(500).nullable().optional().describe("Optional description (up to 500 characters); null clears it");
+var CreateEgressAllowlistRequestSchema = z2.object({
+  domain: EgressAllowlistDomainSchema,
+  description: descriptionSchema
+});
+var UpdateEgressAllowlistRequestSchema = z2.object({
+  domain: EgressAllowlistDomainSchema.optional(),
+  description: descriptionSchema
+}).refine(
+  (value) => value.domain !== void 0 || value.description !== void 0,
+  { message: "Provide domain or description to update" }
+);
+var EgressAllowlistEntrySchema = z2.object({
+  id: z2.string().uuid().optional(),
+  organisation_id: z2.string().uuid().optional(),
+  domain: z2.string().optional(),
+  description: z2.string().nullable().optional(),
+  status: z2.literal("active").optional(),
+  created_by: z2.string().uuid().nullable().optional(),
+  created_at: z2.iso.datetime().optional(),
+  last_updated_at: z2.iso.datetime().optional(),
+  object: z2.literal("egress-allowlist").optional()
+});
+var ListEgressAllowlistResponseSchema = z2.object({
+  object: z2.literal("list").optional(),
+  total: z2.number().int().optional(),
+  data: z2.array(EgressAllowlistEntrySchema).optional()
+});
+var CreateEgressAllowlistResponseSchema = z2.object({
+  id: z2.string().uuid().optional(),
+  domain: z2.string().optional(),
+  object: z2.literal("egress-allowlist").optional()
+});
+
+// src/services/egress-allowlist.service.ts
+var EgressAllowlistService = class extends BaseService {
+  async createEgressAllowlistEntry(data) {
+    return CreateEgressAllowlistResponseSchema.parse(
+      await this.postV2("/egress-allowlist", data)
+    );
+  }
+  async listEgressAllowlist(params) {
+    return ListEgressAllowlistResponseSchema.parse(
+      await this.getV2("/egress-allowlist", params)
+    );
+  }
+  async getEgressAllowlistEntry(id) {
+    return EgressAllowlistEntrySchema.parse(
+      await this.getV2(`/egress-allowlist/${this.encodePathSegment(id)}`)
+    );
+  }
+  async updateEgressAllowlistEntry(id, data) {
+    return this.putV2(`/egress-allowlist/${this.encodePathSegment(id)}`, data);
+  }
+  async deleteEgressAllowlistEntry(id) {
+    await this.deleteV2(`/egress-allowlist/${this.encodePathSegment(id)}`);
+    return {};
+  }
+};
+
 // src/services/guardrails.service.ts
 var GuardrailsService = class extends BaseService {
   /** Get the organisation-wide input and output guardrail defaults. */
@@ -937,7 +1199,8 @@ var IntegrationsService = class extends BaseService {
       current_page: params?.current_page,
       page_size: params?.page_size,
       workspace_id: params?.workspace_id,
-      type: params?.type
+      type: params?.type,
+      tags: params?.tags === void 0 ? void 0 : JSON.stringify(params.tags)
     });
   }
   // Create a new integration
@@ -966,7 +1229,12 @@ var IntegrationsService = class extends BaseService {
       current_page: params?.current_page,
       page_size: params?.page_size
     });
-    const data = response.data ?? response.models ?? [];
+    const data = (response.data ?? response.models ?? []).map(
+      ({ is_custom, ...model }) => is_custom === void 0 ? model : {
+        ...model,
+        is_custom: typeof is_custom === "number" ? is_custom === 1 : is_custom
+      }
+    );
     return {
       object: response.object ?? "list",
       total: response.total ?? data.length,
@@ -2059,6 +2327,8 @@ function getSharedServiceCacheKey(apiKey) {
 }
 var sharedPortkeyServices = /* @__PURE__ */ new Map();
 var PortkeyService = class {
+  accessPolicies;
+  egressAllowlist;
   users;
   workspaces;
   configs;
@@ -2084,6 +2354,14 @@ var PortkeyService = class {
     const resolvedApiKey = resolvePortkeyApiKey(apiKey);
     const resolvedBaseUrl = process.env.PORTKEY_BASE_URL ?? "https://api.portkey.ai/v1";
     validateUrl(resolvedBaseUrl);
+    this.accessPolicies = new AccessPoliciesService(
+      resolvedApiKey,
+      resolvedBaseUrl
+    );
+    this.egressAllowlist = new EgressAllowlistService(
+      resolvedApiKey,
+      resolvedBaseUrl
+    );
     this.users = new UsersService(resolvedApiKey, resolvedBaseUrl);
     this.workspaces = new WorkspacesService(resolvedApiKey, resolvedBaseUrl);
     this.configs = new ConfigsService(resolvedApiKey, resolvedBaseUrl);
@@ -2129,7 +2407,7 @@ function getSharedPortkeyService(apiKey) {
 }
 
 // src/tools/index.ts
-import { z as z24 } from "zod";
+import { z as z29 } from "zod";
 
 // src/lib/type-guards.ts
 function isRecord(value) {
@@ -2137,97 +2415,97 @@ function isRecord(value) {
 }
 
 // src/schemas/contracts/secret-references.contract.ts
-import { z } from "zod";
-var SecretManagerTypeSchema = z.enum([
+import { z as z3 } from "zod";
+var SecretManagerTypeSchema = z3.enum([
   "aws_sm",
   "azure_kv",
   "hashicorp_vault"
 ]);
-var SecretReferenceListItemSchema = z.object({
-  id: z.string().uuid(),
-  name: z.string(),
-  slug: z.string(),
+var SecretReferenceListItemSchema = z3.object({
+  id: z3.string().uuid(),
+  name: z3.string(),
+  slug: z3.string(),
   manager_type: SecretManagerTypeSchema,
-  status: z.literal("ACTIVE"),
-  created_at: z.iso.datetime(),
-  last_updated_at: z.iso.datetime(),
-  object: z.literal("secret-reference")
+  status: z3.literal("ACTIVE"),
+  created_at: z3.iso.datetime(),
+  last_updated_at: z3.iso.datetime(),
+  object: z3.literal("secret-reference")
 });
-var ListSecretReferencesResponseSchema = z.object({
-  object: z.literal("list"),
-  total: z.number().int().nonnegative(),
-  data: z.array(SecretReferenceListItemSchema)
+var ListSecretReferencesResponseSchema = z3.object({
+  object: z3.literal("list"),
+  total: z3.number().int().nonnegative(),
+  data: z3.array(SecretReferenceListItemSchema)
 });
 var SecretReferenceDetailSchema = SecretReferenceListItemSchema.extend(
   {
-    organisation_id: z.string().uuid(),
-    description: z.string().nullable(),
-    secret_path: z.string(),
-    secret_key: z.string().nullable(),
-    allow_all_workspaces: z.boolean(),
-    tags: z.record(z.string(), z.string()).nullable(),
-    created_by: z.string(),
-    auth_config: z.record(z.string(), z.unknown())
+    organisation_id: z3.string().uuid(),
+    description: z3.string().nullable(),
+    secret_path: z3.string(),
+    secret_key: z3.string().nullable(),
+    allow_all_workspaces: z3.boolean(),
+    tags: z3.record(z3.string(), z3.string()).nullable(),
+    created_by: z3.string(),
+    auth_config: z3.record(z3.string(), z3.unknown())
   }
 );
-var CreateSecretReferenceResponseSchema = z.object({
-  id: z.string().uuid(),
-  slug: z.string(),
-  object: z.literal("secret-reference")
+var CreateSecretReferenceResponseSchema = z3.object({
+  id: z3.string().uuid(),
+  slug: z3.string(),
+  object: z3.literal("secret-reference")
 });
 
-// src/tools/analytics.tools.ts
-import { z as z3 } from "zod";
+// src/tools/access-policies.tools.ts
+import { z as z5 } from "zod";
 
 // src/lib/schemas.ts
-import { z as z2 } from "zod";
-var PromptFunctionSchema = z2.object({
-  name: z2.string().describe("Function name"),
-  description: z2.string().optional().describe("Function description"),
-  parameters: z2.record(z2.string(), z2.unknown()).optional().describe("Function parameters schema")
+import { z as z4 } from "zod";
+var PromptFunctionSchema = z4.object({
+  name: z4.string().describe("Function name"),
+  description: z4.string().optional().describe("Function description"),
+  parameters: z4.record(z4.string(), z4.unknown()).optional().describe("Function parameters schema")
 });
-var PromptToolSchema = z2.object({
-  type: z2.literal("function").describe("Tool type"),
+var PromptToolSchema = z4.object({
+  type: z4.literal("function").describe("Tool type"),
   function: PromptFunctionSchema.describe("Function definition")
 });
-var HyperparametersSchema = z2.object({
-  max_tokens: z2.coerce.number().positive().optional().describe("Maximum tokens to generate"),
-  temperature: z2.coerce.number().min(0).max(2).optional().describe("Sampling temperature (0-2)"),
-  top_p: z2.coerce.number().min(0).max(1).optional().describe("Top-p sampling (0-1)"),
-  top_k: z2.coerce.number().positive().optional().describe("Top-k sampling"),
-  presence_penalty: z2.coerce.number().min(-2).max(2).optional().describe("Presence penalty (-2 to 2)"),
-  frequency_penalty: z2.coerce.number().min(-2).max(2).optional().describe("Frequency penalty (-2 to 2)"),
-  stop: z2.array(z2.string()).optional().describe("Stop sequences")
+var HyperparametersSchema = z4.object({
+  max_tokens: z4.coerce.number().positive().optional().describe("Maximum tokens to generate"),
+  temperature: z4.coerce.number().min(0).max(2).optional().describe("Sampling temperature (0-2)"),
+  top_p: z4.coerce.number().min(0).max(1).optional().describe("Top-p sampling (0-1)"),
+  top_k: z4.coerce.number().positive().optional().describe("Top-k sampling"),
+  presence_penalty: z4.coerce.number().min(-2).max(2).optional().describe("Presence penalty (-2 to 2)"),
+  frequency_penalty: z4.coerce.number().min(-2).max(2).optional().describe("Frequency penalty (-2 to 2)"),
+  stop: z4.array(z4.string()).optional().describe("Stop sequences")
 });
-var PromptAppIdentifierSchema = z2.string().min(1).describe(
+var PromptAppIdentifierSchema = z4.string().min(1).describe(
   "App identifier (REQUIRED). Use your deployed app name, for example 'hourlink' or 'support-console'."
 );
-var PromptEnvironmentIdentifierSchema = z2.string().min(1).describe(
+var PromptEnvironmentIdentifierSchema = z4.string().min(1).describe(
   "Environment identifier (REQUIRED). Use your environment name, for example 'dev', 'staging', 'prod', or 'qa'."
 );
-var BillingMetadataSchema = z2.object({
-  client_id: z2.string().describe("Client ID for billing attribution (REQUIRED)"),
+var BillingMetadataSchema = z4.object({
+  client_id: z4.string().describe("Client ID for billing attribution (REQUIRED)"),
   app: PromptAppIdentifierSchema,
   env: PromptEnvironmentIdentifierSchema,
-  project_id: z2.string().optional().describe("Project ID for granular billing"),
-  feature: z2.string().optional().describe("Feature name for tracking")
+  project_id: z4.string().optional().describe("Project ID for granular billing"),
+  feature: z4.string().optional().describe("Feature name for tracking")
 });
-var ToolChoiceSchema = z2.object({
-  mode: z2.enum(["auto", "none", "function"]).describe(
+var ToolChoiceSchema = z4.object({
+  mode: z4.enum(["auto", "none", "function"]).describe(
     "Tool choice mode: auto lets the model decide, none disables tool use, function forces one function by name"
   ),
-  function_name: z2.string().optional().describe("Required when mode is 'function'; ignored otherwise")
+  function_name: z4.string().optional().describe("Required when mode is 'function'; ignored otherwise")
 }).superRefine((value, ctx) => {
   if (value.mode === "function" && !value.function_name) {
     ctx.addIssue({
-      code: z2.ZodIssueCode.custom,
+      code: z4.ZodIssueCode.custom,
       path: ["function_name"],
       message: "function_name is required when mode is 'function'"
     });
   }
   if (value.mode !== "function" && value.function_name !== void 0) {
     ctx.addIssue({
-      code: z2.ZodIssueCode.custom,
+      code: z4.ZodIssueCode.custom,
       path: ["function_name"],
       message: "function_name is only allowed when mode is 'function'"
     });
@@ -2247,9 +2525,9 @@ function toPromptToolChoice(toolChoice) {
   }
   return toolChoice.mode;
 }
-var CurrentPageSchema = z2.coerce.number().int().nonnegative().optional().describe("Zero-based page number; the first page is 0");
+var CurrentPageSchema = z4.coerce.number().int().nonnegative().optional().describe("Zero-based page number; the first page is 0");
 function pageSizeSchema(max = 100) {
-  return z2.coerce.number().int().positive().max(max).optional().describe(`Results per page (max ${max})`);
+  return z4.coerce.number().int().positive().max(max).optional().describe(`Results per page (max ${max})`);
 }
 var PageSizeSchema = pageSizeSchema();
 
@@ -2265,44 +2543,111 @@ function jsonResult(data) {
   };
 }
 
+// src/tools/access-policies.tools.ts
+var idSchema = z5.string().uuid().describe(
+  "Access policy UUID from list_access_policies or create_access_policy"
+);
+var listSchema = {
+  workspace_id: z5.string().optional().describe("Workspace UUID or slug"),
+  effect: z5.enum(["allow", "deny"]).optional().describe("Filter by allow or deny effect"),
+  enabled: z5.boolean().optional().describe("Filter enabled or disabled policies; false is preserved"),
+  user_id: z5.string().max(36).optional().describe("Policies naming this user or matching all users"),
+  agent_id: z5.string().max(36).optional().describe("Policies naming this agent or matching all agents"),
+  server_id: z5.string().max(100).optional().describe("Policies targeting this MCP server ID"),
+  search: z5.string().max(64).optional().describe("Search policy names"),
+  created_by: z5.string().max(255).optional().describe("Filter by creator user ID"),
+  start_time: z5.iso.datetime().optional().describe("Policies created at or after this ISO 8601 timestamp"),
+  end_time: z5.iso.datetime().optional().describe("Policies created at or before this ISO 8601 timestamp"),
+  current_page: CurrentPageSchema,
+  page_size: z5.coerce.number().int().nonnegative().optional().describe("Items per page; the published API permits zero")
+};
+var lookupSchema = { id: idSchema };
+var updateSchema = UpdateAccessPolicyRequestSchema.safeExtend({
+  id: idSchema
+});
+function registerAccessPoliciesTools(server, service) {
+  server.registerTool(
+    "create_access_policy",
+    {
+      description: "Create a workspace access policy for users, groups, and agents targeting MCP tools or provider models. Changes who may access those targets. An omitted effect becomes deny only when both user ANY and agent ANY are present; otherwise allow, which requires a specific subject. Returns the policy UUID; use get_access_policy before later updates.",
+      inputSchema: CreateAccessPolicyRequestSchema
+    },
+    async (params) => jsonResult(await service.accessPolicies.createAccessPolicy(params))
+  );
+  server.registerTool(
+    "list_access_policies",
+    {
+      description: "Inspect active workspace access policies, newest first, without changing permissions. Filter by subject, MCP server, effect, enabled state, or creation time. Returns total and the current page of policy summaries with versions; use get_access_policy for complete subjects and targets.",
+      inputSchema: listSchema
+    },
+    async (params) => jsonResult(await service.accessPolicies.listAccessPolicies(params))
+  );
+  server.registerTool(
+    "get_access_policy",
+    {
+      description: "Read one access policy's complete subjects, targets, effect, and current version. Use this before update_access_policy so replacement lists and optimistic concurrency use the latest state. Returns policy details; a missing policy returns HTTP 404.",
+      inputSchema: lookupSchema
+    },
+    async ({ id }) => jsonResult(await service.accessPolicies.getAccessPolicy(id))
+  );
+  server.registerTool(
+    "update_access_policy",
+    {
+      description: "Replace an access policy's complete subjects and targets, changing access permissions. Requires the current version from get_access_policy; a stale version returns HTTP 409 without retrying. Omitted name, description, effect, and enabled retain their stored values. Returns Portkey's acknowledgement; reread before retrying a conflict.",
+      inputSchema: updateSchema,
+      annotations: { destructiveHint: true }
+    },
+    async ({ id, ...params }) => jsonResult(await service.accessPolicies.updateAccessPolicy(id, params))
+  );
+  server.registerTool(
+    "delete_access_policy",
+    {
+      description: "Delete an access policy by UUID, removing its allow or deny rule and changing access permissions. This cannot be undone by this tool. Inspect get_access_policy first; returns Portkey's acknowledgement, or HTTP 404 when the policy is missing.",
+      inputSchema: lookupSchema
+    },
+    async ({ id }) => jsonResult(await service.accessPolicies.deleteAccessPolicy(id))
+  );
+}
+
 // src/tools/analytics.tools.ts
+import { z as z6 } from "zod";
 var baseAnalyticsSchema = {
-  time_of_generation_min: z3.string().describe(
+  time_of_generation_min: z6.string().describe(
     "Start time for the analytics period (ISO8601 format, e.g., '2024-01-01T00:00:00Z')"
   ),
-  time_of_generation_max: z3.string().describe(
+  time_of_generation_max: z6.string().describe(
     "End time for the analytics period (ISO8601 format, e.g., '2024-02-01T00:00:00Z')"
   ),
-  total_units_min: z3.coerce.number().nonnegative().optional().describe("Minimum number of total tokens to filter by"),
-  total_units_max: z3.coerce.number().nonnegative().optional().describe("Maximum number of total tokens to filter by"),
-  cost_min: z3.coerce.number().nonnegative().optional().describe("Minimum cost in cents to filter by"),
-  cost_max: z3.coerce.number().nonnegative().optional().describe("Maximum cost in cents to filter by"),
-  prompt_token_min: z3.coerce.number().nonnegative().optional().describe("Minimum number of prompt tokens"),
-  prompt_token_max: z3.coerce.number().nonnegative().optional().describe("Maximum number of prompt tokens"),
-  completion_token_min: z3.coerce.number().nonnegative().optional().describe("Minimum number of completion tokens"),
-  completion_token_max: z3.coerce.number().nonnegative().optional().describe("Maximum number of completion tokens"),
-  status_code: z3.string().optional().describe(
+  total_units_min: z6.coerce.number().nonnegative().optional().describe("Minimum number of total tokens to filter by"),
+  total_units_max: z6.coerce.number().nonnegative().optional().describe("Maximum number of total tokens to filter by"),
+  cost_min: z6.coerce.number().nonnegative().optional().describe("Minimum cost in cents to filter by"),
+  cost_max: z6.coerce.number().nonnegative().optional().describe("Maximum cost in cents to filter by"),
+  prompt_token_min: z6.coerce.number().nonnegative().optional().describe("Minimum number of prompt tokens"),
+  prompt_token_max: z6.coerce.number().nonnegative().optional().describe("Maximum number of prompt tokens"),
+  completion_token_min: z6.coerce.number().nonnegative().optional().describe("Minimum number of completion tokens"),
+  completion_token_max: z6.coerce.number().nonnegative().optional().describe("Maximum number of completion tokens"),
+  status_code: z6.string().optional().describe(
     "Legacy Portkey query param for HTTP status codes. Comma-separated string; prefer status_codes for structured inputs."
   ),
-  weighted_feedback_min: z3.coerce.number().min(-10).max(10).optional().describe("Minimum weighted feedback score (-10 to 10)"),
-  weighted_feedback_max: z3.coerce.number().min(-10).max(10).optional().describe("Maximum weighted feedback score (-10 to 10)"),
-  virtual_keys: z3.string().optional().describe(
+  weighted_feedback_min: z6.coerce.number().min(-10).max(10).optional().describe("Minimum weighted feedback score (-10 to 10)"),
+  weighted_feedback_max: z6.coerce.number().min(-10).max(10).optional().describe("Maximum weighted feedback score (-10 to 10)"),
+  virtual_keys: z6.string().optional().describe(
     "Legacy Portkey query param for virtual key slugs. Comma-separated string; prefer virtual_key_slugs for structured inputs."
   ),
-  configs: z3.string().optional().describe(
+  configs: z6.string().optional().describe(
     "Legacy Portkey query param for config slugs. Comma-separated string; prefer config_slugs for structured inputs."
   ),
-  status_codes: z3.array(z3.string()).optional().describe(
+  status_codes: z6.array(z6.string()).optional().describe(
     "Structured alias for status_code. Use an array of HTTP status codes; normalized to the legacy comma-separated Portkey query param."
   ),
-  virtual_key_slugs: z3.array(z3.string()).optional().describe(
+  virtual_key_slugs: z6.array(z6.string()).optional().describe(
     "Structured alias for virtual_keys. Use an array of virtual key slugs; normalized to the legacy comma-separated Portkey query param."
   ),
-  config_slugs: z3.array(z3.string()).optional().describe(
+  config_slugs: z6.array(z6.string()).optional().describe(
     "Structured alias for configs. Use an array of config slugs; normalized to the legacy comma-separated Portkey query param."
   ),
-  workspace_slug: z3.string().optional().describe("Filter by specific workspace"),
-  api_key_ids: z3.preprocess((value) => {
+  workspace_slug: z6.string().optional().describe("Filter by specific workspace"),
+  api_key_ids: z6.preprocess((value) => {
     if (value == null) {
       return value;
     }
@@ -2310,34 +2655,40 @@ var baseAnalyticsSchema = {
       return value.map((item) => String(item)).join(",");
     }
     return value;
-  }, z3.string().optional()).describe(
+  }, z6.string().optional()).describe(
     "Legacy Portkey query param for API key UUIDs. Comma-separated string; request_analytics also accepts an array and normalizes it to this form."
   ),
-  metadata: z3.string().optional().describe(
+  metadata: z6.string().optional().describe(
     `Legacy Portkey query param for metadata filtering. Stringified JSON object, e.g. '{"env":"prod","app":"myapp"}'; prefer metadata_filter for structured inputs.`
   ),
-  ai_org_model: z3.string().optional().describe(
+  ai_org_model: z6.string().optional().describe(
     "Legacy Portkey query param for provider/model pairs. Format: 'provider__model' with double underscore, e.g. 'openai__gpt-4' or 'anthropic__claude-3-opus'. Comma-separated string; prefer provider_models for structured inputs."
   ),
-  provider_models: z3.array(z3.string()).optional().describe(
+  provider_models: z6.array(z6.string()).optional().describe(
     "Structured alias for ai_org_model. Use provider__model strings in an array; normalized to the legacy comma-separated Portkey query param."
   ),
-  trace_id: z3.string().optional().describe(
+  deployment_id: z6.string().optional().describe(
+    "Comma-separated list of deployment IDs (UUIDs) to filter by. Prefer deployment_ids for structured inputs."
+  ),
+  deployment_ids: z6.array(z6.string()).optional().describe(
+    "Structured alias for deployment_id. Use an array of deployment UUIDs; normalized to the comma-separated Portkey query param."
+  ),
+  trace_id: z6.string().optional().describe(
     "Legacy Portkey query param for trace IDs. Comma-separated string; prefer trace_ids for structured inputs."
   ),
-  trace_ids: z3.array(z3.string()).optional().describe(
+  trace_ids: z6.array(z6.string()).optional().describe(
     "Structured alias for trace_id. Use an array of trace IDs; normalized to the legacy comma-separated Portkey query param."
   ),
-  span_id: z3.string().optional().describe(
+  span_id: z6.string().optional().describe(
     "Legacy Portkey query param for span IDs. Comma-separated string; prefer span_ids for structured inputs."
   ),
-  span_ids: z3.array(z3.string()).optional().describe(
+  span_ids: z6.array(z6.string()).optional().describe(
     "Structured alias for span_id. Use an array of span IDs; normalized to the legacy comma-separated Portkey query param."
   ),
-  metadata_filter: z3.record(z3.string(), z3.unknown()).optional().describe(
+  metadata_filter: z6.record(z6.string(), z6.unknown()).optional().describe(
     "Structured alias for metadata. Use an object such as { env: 'prod' }; normalized to a JSON string before the request is sent."
   ),
-  prompt_slug: z3.string().optional().describe("Filter by prompt slug")
+  prompt_slug: z6.string().optional().describe("Filter by prompt slug")
 };
 var paginatedAnalyticsSchema = {
   ...baseAnalyticsSchema,
@@ -2346,9 +2697,9 @@ var paginatedAnalyticsSchema = {
 };
 var cacheSummarySchema = {
   ...baseAnalyticsSchema,
-  workspace_slug: z3.string().min(1).describe("Workspace slug to analyze")
+  workspace_slug: z6.string().min(1).describe("Workspace slug to analyze")
 };
-var providerMetricSchema = z3.enum([
+var providerMetricSchema = z6.enum([
   "requests",
   "cost",
   "total_tokens",
@@ -2368,14 +2719,14 @@ var providerGroupAnalyticsSchema = {
   ...cacheSummarySchema,
   current_page: CurrentPageSchema.describe("Zero-based result page"),
   page_size: PageSizeSchema.describe("Number of provider groups per page"),
-  order_by: z3.string().optional().describe("Metric or field used to order groups"),
-  order_by_type: z3.string().optional().describe("Sort direction accepted by Portkey, such as asc or desc"),
-  columns: z3.array(providerMetricSchema).optional().describe("Provider metrics to include in each grouped row"),
-  include_total: z3.boolean().optional().describe("Request the total provider-group count")
+  order_by: z6.string().optional().describe("Metric or field used to order groups"),
+  order_by_type: z6.string().optional().describe("Sort direction accepted by Portkey, such as asc or desc"),
+  columns: z6.array(providerMetricSchema).optional().describe("Provider metrics to include in each grouped row"),
+  include_total: z6.boolean().optional().describe("Request the total provider-group count")
 };
 var analyticsGroupMetadataSchema = {
   ...paginatedAnalyticsSchema,
-  metadata_key: z3.string().describe("The metadata key to group by (e.g., 'env', 'app', 'client_id')")
+  metadata_key: z6.string().describe("The metadata key to group by (e.g., 'env', 'app', 'client_id')")
 };
 function formatGraphAnalytics(summary, dataPoints) {
   return {
@@ -2469,6 +2820,7 @@ function normalizeAnalyticsParams(params) {
     trace_ids,
     span_ids,
     provider_models,
+    deployment_ids,
     metadata_filter,
     ...legacyParams
   } = params;
@@ -2499,6 +2851,10 @@ function normalizeAnalyticsParams(params) {
   if (providerModels !== void 0) {
     normalizedParams.ai_org_model = providerModels;
   }
+  const deploymentId = normalizeCommaSeparatedParam(deployment_ids) ?? normalizeCommaSeparatedParam(legacyParams.deployment_id);
+  if (deploymentId !== void 0) {
+    normalizedParams.deployment_id = deploymentId;
+  }
   const traceId = normalizeCommaSeparatedParam(trace_ids) ?? normalizeCommaSeparatedParam(legacyParams.trace_id);
   if (traceId !== void 0) {
     normalizedParams.trace_id = traceId;
@@ -2808,32 +3164,68 @@ function registerAnalyticsTools(server, service) {
       return jsonResult(formatGroupedAnalytics(analytics, "metadata_groups"));
     }
   );
+  server.tool(
+    "get_analytics_group_mcp",
+    "Get a paginated per-MCP-server breakdown with total_groups, group_count, and an mcp_servers array containing each server name and its request count. Use this to see which MCP servers receive the most traffic; use get_analytics_group_a2a for A2A agents or get_analytics_group_users and get_analytics_group_models for other breakdowns.",
+    paginatedAnalyticsSchema,
+    async (params) => {
+      const analytics = await service.analytics.getAnalyticsGroupMcp(
+        normalizeAnalyticsParams(params)
+      );
+      return jsonResult(formatGroupedAnalytics(analytics, "mcp_servers"));
+    }
+  );
+  server.tool(
+    "get_analytics_group_a2a",
+    "Get a paginated per-agent breakdown with total_groups, group_count, and an agents array containing each A2A (agent-to-agent) agent name and its request count. Use this to see which agents receive the most traffic; use get_analytics_group_mcp for MCP servers instead.",
+    paginatedAnalyticsSchema,
+    async (params) => {
+      const analytics = await service.analytics.getAnalyticsGroupA2a(
+        normalizeAnalyticsParams(params)
+      );
+      return jsonResult(formatGroupedAnalytics(analytics, "agents"));
+    }
+  );
+  server.tool(
+    "get_analytics_group_workspaces",
+    "Get a paginated per-workspace breakdown with total_groups, group_count, is_quota_exceeded when reported, and a workspaces array containing each workspace_slug with request count and cost. Use this for org-wide chargeback or comparing workspaces; pass workspace_slug to other analytics tools to drill into one workspace.",
+    paginatedAnalyticsSchema,
+    async (params) => {
+      const analytics = await service.analytics.getAnalyticsGroupWorkspaces(
+        normalizeAnalyticsParams(params)
+      );
+      return jsonResult({
+        ...formatGroupedAnalytics(analytics, "workspaces"),
+        is_quota_exceeded: analytics.is_quota_exceeded
+      });
+    }
+  );
 }
 
 // src/tools/audit.tools.ts
-import { z as z4 } from "zod";
+import { z as z7 } from "zod";
 var AUDIT_TOOL_SCHEMAS = {
   listAuditLogs: {
-    start_time: z4.string().describe(
+    start_time: z7.string().describe(
       "Start of time range filter (ISO 8601 format, e.g., '2024-01-01T00:00:00Z')"
     ),
-    end_time: z4.string().describe(
+    end_time: z7.string().describe(
       "End of time range filter (ISO 8601 format, e.g., '2024-01-31T23:59:59Z')"
     ),
-    organisation_id: z4.string().describe("Organisation ID whose audit logs to list"),
-    workspace_id: z4.string().optional().describe("Filter audit logs by workspace ID"),
-    user_id: z4.string().optional().describe(
+    organisation_id: z7.string().describe("Organisation ID whose audit logs to list"),
+    workspace_id: z7.string().optional().describe("Filter audit logs by workspace ID"),
+    user_id: z7.string().optional().describe(
       "Filter by the ID of the user or API key that made the request"
     ),
-    user_type: z4.enum(["user", "api_key"]).optional().describe("Filter by whether the request came from a user or an API key"),
-    request_id: z4.string().optional().describe("Filter by request ID"),
-    method: z4.enum(["POST", "PUT", "DELETE"]).optional().describe("Filter by HTTP method of the audited request"),
-    uri: z4.string().optional().describe("Filter by request URI path"),
-    client_ip: z4.string().optional().describe("Filter by client IP address"),
-    country: z4.string().optional().describe("Filter by country derived from the client IP"),
-    response_status_code: z4.coerce.number().int().optional().describe("Filter by HTTP response status code (e.g., 200, 403)"),
-    action: z4.string().optional().describe("Filter by action type (e.g., 'create', 'update', 'delete')"),
-    resource_type: z4.string().optional().describe(
+    user_type: z7.enum(["user", "api_key"]).optional().describe("Filter by whether the request came from a user or an API key"),
+    request_id: z7.string().optional().describe("Filter by request ID"),
+    method: z7.enum(["POST", "PUT", "DELETE"]).optional().describe("Filter by HTTP method of the audited request"),
+    uri: z7.string().optional().describe("Filter by request URI path"),
+    client_ip: z7.string().optional().describe("Filter by client IP address"),
+    country: z7.string().optional().describe("Filter by country derived from the client IP"),
+    response_status_code: z7.coerce.number().int().optional().describe("Filter by HTTP response status code (e.g., 200, 403)"),
+    action: z7.string().optional().describe("Filter by action type (e.g., 'create', 'update', 'delete')"),
+    resource_type: z7.string().optional().describe(
       "Filter by resource type (e.g., 'workspace', 'config', 'virtual_key')"
     ),
     current_page: CurrentPageSchema,
@@ -2890,36 +3282,39 @@ function registerAuditTools(server, service) {
 }
 
 // src/tools/collections.tools.ts
-import { z as z5 } from "zod";
+import { z as z8 } from "zod";
 var COLLECTIONS_TOOL_SCHEMAS = {
   listCollections: {
-    workspace_id: z5.string().optional().describe("Filter by workspace ID"),
-    search: z5.string().optional().describe("Search collections by name"),
+    workspace_id: z8.string().optional().describe("Filter by workspace ID"),
+    search: z8.string().optional().describe("Search collections by name"),
     current_page: CurrentPageSchema,
     page_size: PageSizeSchema
   },
   createCollection: {
-    name: z5.string().describe(
+    name: z8.string().describe(
       "Collection name (e.g., 'hourlink', 'apizone', 'research-pilot')"
     ),
-    workspace_id: z5.string().optional().describe("Workspace ID to create collection in")
+    workspace_id: z8.string().optional().describe("Workspace ID to create collection in"),
+    parent_collection_id: z8.string().optional().describe(
+      "ID or slug of the parent collection to nest under; omit for a top-level collection"
+    )
   },
   getCollection: {
-    collection_id: z5.string().describe("Collection ID or slug to retrieve")
+    collection_id: z8.string().describe("Collection ID or slug to retrieve")
   },
   updateCollection: {
-    collection_id: z5.string().describe("Collection ID to update"),
-    name: z5.string().optional().describe("New name for the collection"),
-    description: z5.string().optional().describe("New description for the collection")
+    collection_id: z8.string().describe("Collection ID to update"),
+    name: z8.string().optional().describe("New name for the collection"),
+    description: z8.string().optional().describe("New description for the collection")
   },
   deleteCollection: {
-    collection_id: z5.string().describe("Collection ID to delete")
+    collection_id: z8.string().describe("Collection ID to delete")
   }
 };
 function registerCollectionsTools(server, service) {
   server.tool(
     "list_collections",
-    "List prompt collections in the workspace, optionally filtering by name or workspace. Returns ids, names, slugs, and timestamps so you can choose a collection_id before create_prompt, get_collection, or list_prompts.",
+    "List prompt collections in the workspace, optionally filtering by name or workspace. Returns ids, names, slugs, parent collection ids, and timestamps so you can choose a collection_id before create_prompt, get_collection, or list_prompts.",
     COLLECTIONS_TOOL_SCHEMAS.listCollections,
     async (params) => {
       const collections = await service.collections.listCollections(params);
@@ -2930,6 +3325,7 @@ function registerCollectionsTools(server, service) {
           name: collection.name,
           slug: collection.slug,
           workspace_id: collection.workspace_id,
+          parent_collection_id: collection.parent_collection_id,
           created_at: collection.created_at,
           last_updated_at: collection.last_updated_at
         }))
@@ -2938,7 +3334,7 @@ function registerCollectionsTools(server, service) {
   );
   server.tool(
     "create_collection",
-    "Create a new prompt collection for organizing prompts by app. Use this when you need a new namespace before create_prompt; returns the collection id and slug, and does not move any prompts.",
+    "Create a new prompt collection for organizing prompts by app. Use this when you need a new namespace before create_prompt; set parent_collection_id to nest it under an existing collection. Returns the collection id and slug, and does not move any prompts.",
     COLLECTIONS_TOOL_SCHEMAS.createCollection,
     async (params) => {
       const result = await service.collections.createCollection(params);
@@ -2951,7 +3347,7 @@ function registerCollectionsTools(server, service) {
   );
   server.tool(
     "get_collection",
-    "Fetch one collection by id or slug and return its name, slug, workspace, and timestamps. Use list_collections when browsing and get_collection when you already know the target.",
+    "Fetch one collection by id or slug and return its name, slug, workspace, parent collection id, child collections with prompt counts, and timestamps. Use list_collections when browsing and get_collection when you already know the target.",
     COLLECTIONS_TOOL_SCHEMAS.getCollection,
     async (params) => {
       const collection = await service.collections.getCollection(
@@ -2962,6 +3358,8 @@ function registerCollectionsTools(server, service) {
         name: collection.name,
         slug: collection.slug,
         workspace_id: collection.workspace_id,
+        parent_collection_id: collection.parent_collection_id,
+        child_collections: collection.child_collections,
         created_at: collection.created_at,
         last_updated_at: collection.last_updated_at
       });
@@ -2999,10 +3397,10 @@ function registerCollectionsTools(server, service) {
 }
 
 // src/tools/configs.tools.ts
-import { z as z6 } from "zod";
-var configTargetSchema = z6.object({
-  provider: z6.string().optional().describe("Provider slug to route requests to"),
-  virtual_key: z6.string().optional().describe("Virtual key slug to use for this routing target")
+import { z as z9 } from "zod";
+var configTargetSchema = z9.object({
+  provider: z9.string().optional().describe("Provider slug to route requests to"),
+  virtual_key: z9.string().optional().describe("Virtual key slug to use for this routing target")
 }).refine((target) => target.provider || target.virtual_key, {
   message: "Each target must have at least provider or virtual_key"
 });
@@ -3012,45 +3410,45 @@ var CONFIGS_TOOL_SCHEMAS = {
     page_size: PageSizeSchema.describe("Number of results per page (max 100)")
   },
   getConfig: {
-    slug: z6.string().describe(
+    slug: z9.string().describe(
       "The unique identifier (slug) of the configuration to retrieve. This can be found in the configuration's URL or from the list_configs tool response"
     )
   },
   createConfig: {
-    name: z6.string().describe("Name for the new configuration"),
-    workspace_id: z6.string().optional().describe("Workspace ID to create config in"),
-    cache_mode: z6.enum(["simple", "semantic"]).optional().describe("Cache mode: 'simple' or 'semantic'"),
-    cache_max_age: z6.coerce.number().positive().optional().describe("Cache max age in seconds"),
-    retry_attempts: z6.coerce.number().positive().max(5).optional().describe("Number of retry attempts (1-5)"),
-    retry_on_status_codes: z6.array(z6.coerce.number()).optional().describe("HTTP status codes to retry on (e.g., [429, 500, 502, 503])"),
-    strategy_mode: z6.enum(["loadbalance", "fallback"]).optional().describe("Routing strategy: 'loadbalance' or 'fallback'"),
-    targets: z6.array(configTargetSchema).optional().describe("Array of target providers with virtual keys")
+    name: z9.string().describe("Name for the new configuration"),
+    workspace_id: z9.string().optional().describe("Workspace ID to create config in"),
+    cache_mode: z9.enum(["simple", "semantic"]).optional().describe("Cache mode: 'simple' or 'semantic'"),
+    cache_max_age: z9.coerce.number().positive().optional().describe("Cache max age in seconds"),
+    retry_attempts: z9.coerce.number().positive().max(5).optional().describe("Number of retry attempts (1-5)"),
+    retry_on_status_codes: z9.array(z9.coerce.number()).optional().describe("HTTP status codes to retry on (e.g., [429, 500, 502, 503])"),
+    strategy_mode: z9.enum(["loadbalance", "fallback"]).optional().describe("Routing strategy: 'loadbalance' or 'fallback'"),
+    targets: z9.array(configTargetSchema).optional().describe("Array of target providers with virtual keys")
   },
   updateConfig: {
-    slug: z6.string().describe("Configuration slug to update"),
-    name: z6.string().optional().describe("New name for the configuration"),
-    status: z6.enum(["active", "inactive"]).optional().describe("Configuration status"),
-    cache_mode: z6.enum(["simple", "semantic"]).optional().describe("Cache mode: 'simple' or 'semantic'"),
-    cache_max_age: z6.coerce.number().positive().optional().describe("Cache max age in seconds"),
-    retry_attempts: z6.coerce.number().positive().max(5).optional().describe("Number of retry attempts (1-5)"),
-    retry_on_status_codes: z6.array(z6.coerce.number()).optional().describe("HTTP status codes to retry on"),
-    strategy_mode: z6.enum(["loadbalance", "fallback"]).optional().describe("Routing strategy"),
-    targets: z6.array(configTargetSchema).optional().describe("Array of target providers")
+    slug: z9.string().describe("Configuration slug to update"),
+    name: z9.string().optional().describe("New name for the configuration"),
+    status: z9.enum(["active", "inactive"]).optional().describe("Configuration status"),
+    cache_mode: z9.enum(["simple", "semantic"]).optional().describe("Cache mode: 'simple' or 'semantic'"),
+    cache_max_age: z9.coerce.number().positive().optional().describe("Cache max age in seconds"),
+    retry_attempts: z9.coerce.number().positive().max(5).optional().describe("Number of retry attempts (1-5)"),
+    retry_on_status_codes: z9.array(z9.coerce.number()).optional().describe("HTTP status codes to retry on"),
+    strategy_mode: z9.enum(["loadbalance", "fallback"]).optional().describe("Routing strategy"),
+    targets: z9.array(configTargetSchema).optional().describe("Array of target providers")
   },
   deleteConfig: {
-    slug: z6.string().describe("Configuration slug to delete")
+    slug: z9.string().describe("Configuration slug to delete")
   },
   listConfigVersions: {
-    slug: z6.string().describe("Configuration slug to list versions for")
+    slug: z9.string().describe("Configuration slug to list versions for")
   }
 };
-var configPayloadSchema = z6.object({
-  cache_mode: z6.enum(["simple", "semantic"]).optional(),
-  cache_max_age: z6.coerce.number().positive().optional(),
-  retry_attempts: z6.coerce.number().positive().max(5).optional(),
-  retry_on_status_codes: z6.array(z6.coerce.number()).optional(),
-  strategy_mode: z6.enum(["loadbalance", "fallback"]).optional(),
-  targets: z6.array(configTargetSchema).optional()
+var configPayloadSchema = z9.object({
+  cache_mode: z9.enum(["simple", "semantic"]).optional(),
+  cache_max_age: z9.coerce.number().positive().optional(),
+  retry_attempts: z9.coerce.number().positive().max(5).optional(),
+  retry_on_status_codes: z9.array(z9.coerce.number()).optional(),
+  strategy_mode: z9.enum(["loadbalance", "fallback"]).optional(),
+  targets: z9.array(configTargetSchema).optional()
 });
 function buildConfigPayload(params) {
   const cache = params.cache_mode !== void 0 || params.cache_max_age !== void 0 ? {
@@ -3071,10 +3469,10 @@ function buildConfigPayload(params) {
 function hasConfigSettings(config) {
   return config.cache !== void 0 || config.retry !== void 0 || config.strategy !== void 0 || config.targets !== void 0;
 }
-var createConfigSchema = z6.object(CONFIGS_TOOL_SCHEMAS.createConfig).superRefine((value, ctx) => {
+var createConfigSchema = z9.object(CONFIGS_TOOL_SCHEMAS.createConfig).superRefine((value, ctx) => {
   if (!hasConfigSettings(buildConfigPayload(value))) {
     ctx.addIssue({
-      code: z6.ZodIssueCode.custom,
+      code: z9.ZodIssueCode.custom,
       message: "At least one config setting (cache_mode, retry_attempts, strategy_mode, or targets) must be provided"
     });
   }
@@ -3219,66 +3617,73 @@ function registerConfigsTools(server, service) {
 }
 
 // src/tools/deployments.tools.ts
-import { z as z7 } from "zod";
-var binaryFlagSchema = z7.union([z7.literal(0), z7.literal(1)]);
-var deploymentTypeSchema = z7.enum(["production", "non_production"]);
-var deploymentStatusSchema = z7.enum(["active", "archived"]);
-var deploymentTagsSchema = z7.record(
-  z7.string().regex(
+import { z as z11 } from "zod";
+
+// src/tools/tags.schemas.ts
+import { z as z10 } from "zod";
+var resourceTagsSchema = z10.record(
+  z10.string().regex(
     /^[a-zA-Z0-9_-]+$/,
     "Tag keys may contain only letters, numbers, underscores, and hyphens"
   ),
-  z7.string()
+  z10.string()
 );
+var integrationTagsSchema = z10.record(z10.string(), z10.string());
+
+// src/tools/deployments.tools.ts
+var binaryFlagSchema = z11.union([z11.literal(0), z11.literal(1)]);
+var deploymentTypeSchema = z11.enum(["production", "non_production"]);
+var deploymentStatusSchema = z11.enum(["active", "archived"]);
+var deploymentTagsSchema = resourceTagsSchema;
 var authSettingsSchema = {
-  gateway_base_url: z7.url().optional().describe("Self-hosted Gateway base URL"),
-  mcp_gateway_base_url: z7.url().optional().describe("MCP Gateway base URL"),
+  gateway_base_url: z11.url().optional().describe("Self-hosted Gateway base URL"),
+  mcp_gateway_base_url: z11.url().optional().describe("MCP Gateway base URL"),
   is_dataservice_hosted: binaryFlagSchema.optional().describe("Whether the deployment hosts its own data service"),
   is_playground_proxy_allowed: binaryFlagSchema.optional().describe("Whether Playground proxy traffic is allowed"),
-  workspaces_allowed: z7.array(z7.string()).optional().describe("Workspace slugs this deployment may serve; empty allows all"),
-  jwt_subs_allowed: z7.array(z7.string()).optional().describe("JWT subject values allowed to use the deployment"),
-  jwt_sub_workspace_mapping: z7.record(z7.string(), z7.string()).optional().describe("JWT subject to workspace-slug mapping")
+  workspaces_allowed: z11.array(z11.string()).optional().describe("Workspace slugs this deployment may serve; empty allows all"),
+  jwt_subs_allowed: z11.array(z11.string()).optional().describe("JWT subject values allowed to use the deployment"),
+  jwt_sub_workspace_mapping: z11.record(z11.string(), z11.string()).optional().describe("JWT subject to workspace-slug mapping")
 };
 var DEPLOYMENTS_TOOL_SCHEMAS = {
   listDeployments: {
-    organisation_id: z7.string().optional().describe("Filter by organisation UUID"),
+    organisation_id: z11.string().optional().describe("Filter by organisation UUID"),
     status: deploymentStatusSchema.optional().describe("Filter by deployment status"),
     type: deploymentTypeSchema.optional().describe("Filter by deployment type"),
-    workspace_slug: z7.array(z7.string()).optional().describe("Filter by one or more workspace slugs"),
-    search: z7.string().optional().describe("Search deployment names"),
+    workspace_slug: z11.array(z11.string()).optional().describe("Filter by one or more workspace slugs"),
+    search: z11.string().optional().describe("Search deployment names"),
     tags: deploymentTagsSchema.optional().describe("Match deployments with all supplied tags")
   },
   registerDeployment: {
-    name: z7.string().min(1).describe("Deployment display name"),
-    organisation_id: z7.string().optional().describe("Owning organisation UUID"),
-    slug: z7.string().min(1).max(50).optional().describe("Optional deployment slug"),
+    name: z11.string().min(1).describe("Deployment display name"),
+    organisation_id: z11.string().optional().describe("Owning organisation UUID"),
+    slug: z11.string().min(1).max(50).optional().describe("Optional deployment slug"),
     type: deploymentTypeSchema.optional().describe("Production or non-production deployment type"),
-    deployment_config: z7.record(z7.string(), z7.unknown()).optional().describe("Gateway deployment configuration"),
-    is_default: z7.boolean().optional().describe("Make this the default deployment"),
+    deployment_config: z11.record(z11.string(), z11.unknown()).optional().describe("Gateway deployment configuration"),
+    is_default: z11.boolean().optional().describe("Make this the default deployment"),
     tags: deploymentTagsSchema.nullable().optional().describe("Deployment tags, or null to create without tags"),
     ...authSettingsSchema
   },
   getDeployment: {
-    id: z7.string().min(1).describe("Deployment UUID or self"),
-    organisation_id: z7.string().optional().describe("Organisation UUID scope")
+    id: z11.string().min(1).describe("Deployment UUID or self"),
+    organisation_id: z11.string().optional().describe("Organisation UUID scope")
   },
   updateDeployment: {
-    id: z7.string().min(1).describe("Deployment UUID"),
-    name: z7.string().optional().describe("Replacement display name"),
+    id: z11.string().min(1).describe("Deployment UUID"),
+    name: z11.string().optional().describe("Replacement display name"),
     type: deploymentTypeSchema.optional().describe("Replacement deployment type"),
     status: deploymentStatusSchema.optional().describe("Replacement deployment status"),
-    deployment_config: z7.record(z7.string(), z7.unknown()).nullable().optional().describe("Replacement Gateway configuration, or null to clear it"),
-    is_default: z7.boolean().optional().describe("Whether this is the default deployment"),
-    rotate_auth: z7.boolean().optional().describe("Rotate the one-time deployment authentication secret"),
-    override_existing: z7.boolean().optional().describe("Allow replacement of existing deployment settings"),
+    deployment_config: z11.record(z11.string(), z11.unknown()).nullable().optional().describe("Replacement Gateway configuration, or null to clear it"),
+    is_default: z11.boolean().optional().describe("Whether this is the default deployment"),
+    rotate_auth: z11.boolean().optional().describe("Rotate the one-time deployment authentication secret"),
+    override_existing: z11.boolean().optional().describe("Allow replacement of existing deployment settings"),
     tags: deploymentTagsSchema.nullable().optional().describe("Replacement deployment tags, or null to clear all tags"),
     ...authSettingsSchema,
-    allow_all_workspaces: z7.boolean().optional().describe("Clear workspace restrictions and allow every workspace"),
-    remove_workspaces_allowed: z7.array(z7.string()).optional().describe("Workspace slugs to remove from the allowlist"),
-    remove_subs_allowed: z7.array(z7.string()).optional().describe("JWT subject values to remove from the allowlist")
+    allow_all_workspaces: z11.boolean().optional().describe("Clear workspace restrictions and allow every workspace"),
+    remove_workspaces_allowed: z11.array(z11.string()).optional().describe("Workspace slugs to remove from the allowlist"),
+    remove_subs_allowed: z11.array(z11.string()).optional().describe("JWT subject values to remove from the allowlist")
   },
   archiveDeployment: {
-    id: z7.string().min(1).describe("Deployment UUID to archive")
+    id: z11.string().min(1).describe("Deployment UUID to archive")
   }
 };
 function compact(value) {
@@ -3387,101 +3792,165 @@ function registerDeploymentsTools(server, service) {
   );
 }
 
+// src/tools/egress-allowlist.tools.ts
+import { z as z12 } from "zod";
+var idSchema2 = z12.string().uuid().describe(
+  "Egress allowlist entry UUID from list_egress_allowlist or create_egress_allowlist_entry"
+);
+var listSchema2 = {
+  search: z12.string().min(1).max(255).optional().describe("Search allowlisted domains"),
+  current_page: CurrentPageSchema,
+  page_size: PageSizeSchema.describe(
+    "Items per page, 1-100; Portkey defaults to 20"
+  )
+};
+var lookupSchema2 = { id: idSchema2 };
+var updateSchema2 = UpdateEgressAllowlistRequestSchema.safeExtend({
+  id: idSchema2
+});
+function registerEgressAllowlistTools(server, service) {
+  server.registerTool(
+    "list_egress_allowlist",
+    {
+      description: "Inspect the organisation's trusted custom-host egress allowlist without changing destinations. Returns total and the current page of entries; filter by domain before creating duplicates, and use get_egress_allowlist_entry to inspect one entry. Requires organisation permission.",
+      inputSchema: listSchema2
+    },
+    async (params) => jsonResult(await service.egressAllowlist.listEgressAllowlist(params))
+  );
+  server.registerTool(
+    "create_egress_allowlist_entry",
+    {
+      description: "Trust a custom hostname, IP literal, or wildcard for organisation egress, widening permitted outbound destinations. Use list_egress_allowlist to inspect existing trust first. Portkey rejects metadata destinations and duplicates. Returns the new UUID and normalized domain; requires organisation permission.",
+      inputSchema: CreateEgressAllowlistRequestSchema
+    },
+    async (params) => jsonResult(
+      await service.egressAllowlist.createEgressAllowlistEntry(params)
+    )
+  );
+  server.registerTool(
+    "get_egress_allowlist_entry",
+    {
+      description: "Read one organisation egress allowlist entry's trusted domain, description, and audit fields. Use this before changing or deleting a destination. Returns entry details, or HTTP 404 if it is missing; requires organisation permission.",
+      inputSchema: lookupSchema2
+    },
+    async ({ id }) => jsonResult(await service.egressAllowlist.getEgressAllowlistEntry(id))
+  );
+  server.registerTool(
+    "update_egress_allowlist_entry",
+    {
+      description: "Change an organisation egress allowlist domain or description, potentially changing trusted outbound destinations. Inspect get_egress_allowlist_entry first. Omitted fields stay unchanged; description null clears it. At least one changed field is required. Returns Portkey's acknowledgement; requires organisation permission.",
+      inputSchema: updateSchema2,
+      annotations: { destructiveHint: true }
+    },
+    async ({ id, ...params }) => jsonResult(
+      await service.egressAllowlist.updateEgressAllowlistEntry(id, params)
+    )
+  );
+  server.registerTool(
+    "delete_egress_allowlist_entry",
+    {
+      description: "Remove an organisation egress allowlist entry, revoking trust in its outbound destination and potentially breaking integrations that use it. Inspect get_egress_allowlist_entry first. Deletion cannot be undone by this tool. Returns Portkey's acknowledgement or HTTP 404; requires organisation permission.",
+      inputSchema: lookupSchema2
+    },
+    async ({ id }) => jsonResult(await service.egressAllowlist.deleteEgressAllowlistEntry(id))
+  );
+}
+
 // src/tools/guardrails.tools.ts
-import { z as z8 } from "zod";
-var guardrailCheckSchema = z8.object({
-  id: z8.string().describe("Check identifier (e.g., 'default.jwt', 'default.pii')"),
-  name: z8.string().optional().describe("Display name for the check"),
-  is_enabled: z8.boolean().optional().describe("Whether the check is enabled"),
-  parameters: z8.record(z8.string(), z8.unknown()).optional().describe(
+import { z as z13 } from "zod";
+var guardrailCheckSchema = z13.object({
+  id: z13.string().describe("Check identifier (e.g., 'default.jwt', 'default.pii')"),
+  name: z13.string().optional().describe("Display name for the check"),
+  is_enabled: z13.boolean().optional().describe("Whether the check is enabled"),
+  parameters: z13.record(z13.string(), z13.unknown()).optional().describe(
     "Check-specific configuration. Supported examples include requestParametersCheck and parameters.forwardHeaders; forwarded headers can expose sensitive values, so allow only the minimum required names."
   )
 });
-var guardrailFeedbackSchema = z8.object({
-  value: z8.coerce.number().optional().describe("Feedback value"),
-  weight: z8.coerce.number().optional().describe("Feedback weight"),
-  metadata: z8.record(z8.string(), z8.unknown()).optional().describe("Additional metadata")
+var guardrailFeedbackSchema = z13.object({
+  value: z13.coerce.number().optional().describe("Feedback value"),
+  weight: z13.coerce.number().optional().describe("Feedback weight"),
+  metadata: z13.record(z13.string(), z13.unknown()).optional().describe("Additional metadata")
 });
-var guardrailActionSchema = z8.object({
-  deny: z8.boolean().optional().describe("Whether to deny the request on check failure"),
-  async: z8.boolean().optional().describe("Whether to run checks asynchronously"),
+var guardrailActionSchema = z13.object({
+  deny: z13.boolean().optional().describe("Whether to deny the request on check failure"),
+  async: z13.boolean().optional().describe("Whether to run checks asynchronously"),
   on_success: guardrailFeedbackSchema.optional().describe("Feedback configuration for successful checks"),
   on_fail: guardrailFeedbackSchema.optional().describe("Feedback configuration for failed checks"),
-  on_fail_action: z8.string().optional().describe("Simple action on failure (e.g., 'block')"),
-  message: z8.string().optional().describe("Message to return when guardrail triggers")
+  on_fail_action: z13.string().optional().describe("Simple action on failure (e.g., 'block')"),
+  message: z13.string().optional().describe("Message to return when guardrail triggers")
 });
-var workspaceGuardrailExclusionSchema = z8.object({
-  workspace_id: z8.string().describe("Workspace ID whose exclusion state changes"),
-  excluded: z8.boolean().describe("True to exclude this workspace; false to restore enforcement")
+var workspaceGuardrailExclusionSchema = z13.object({
+  workspace_id: z13.string().describe("Workspace ID whose exclusion state changes"),
+  excluded: z13.boolean().describe("True to exclude this workspace; false to restore enforcement")
 });
-var guardrailTargetSchema = z8.enum(["llm", "mcp_tools"]);
+var guardrailTargetSchema = z13.enum(["llm", "mcp_tools"]);
 var guardrailMcpServerMappingConfigShape = {
-  run_on: z8.array(z8.enum(["input", "output"])).min(1).default(["input", "output"]).describe("Guardrail phases to run for this MCP server"),
-  mcp_integration_capability_ids: z8.array(z8.string().uuid()).optional().describe("MCP integration capability UUIDs covered by this mapping")
+  run_on: z13.array(z13.enum(["input", "output"])).min(1).default(["input", "output"]).describe("Guardrail phases to run for this MCP server"),
+  mcp_integration_capability_ids: z13.array(z13.string().uuid()).optional().describe("MCP integration capability UUIDs covered by this mapping")
 };
-var guardrailMcpServerMappingConfigSchema = z8.object(
+var guardrailMcpServerMappingConfigSchema = z13.object(
   guardrailMcpServerMappingConfigShape
 );
 var GUARDRAILS_TOOL_SCHEMAS = {
   getOrganisationDefaults: {},
   listGuardrails: {
-    workspace_id: z8.string().optional().describe("Filter guardrails by workspace ID"),
-    organisation_id: z8.string().optional().describe("Filter guardrails by organization ID"),
+    workspace_id: z13.string().optional().describe("Filter guardrails by workspace ID"),
+    organisation_id: z13.string().optional().describe("Filter guardrails by organization ID"),
     page_size: PageSizeSchema.describe(
       "Number of items per page (1-100, default: 100)"
     ),
     current_page: CurrentPageSchema
   },
   getGuardrail: {
-    guardrail_id: z8.string().describe("The guardrail UUID or slug (with guard_ prefix) to retrieve")
+    guardrail_id: z13.string().describe("The guardrail UUID or slug (with guard_ prefix) to retrieve")
   },
   createGuardrail: {
-    name: z8.string().describe("Name of the guardrail"),
+    name: z13.string().describe("Name of the guardrail"),
     target: guardrailTargetSchema.optional().describe("LLM traffic by default, or MCP tool calls"),
-    checks: z8.array(guardrailCheckSchema).min(1).optional().describe(
+    checks: z13.array(guardrailCheckSchema).min(1).optional().describe(
       "Checks to apply; at least one entry. Required when target is llm."
     ),
     actions: guardrailActionSchema.optional().describe("Actions to take when guardrail checks pass or fail"),
-    workspace_id: z8.string().optional().describe("Workspace ID to create the guardrail in"),
-    organisation_id: z8.string().optional().describe("Organisation ID (required if workspace_id not provided)")
+    workspace_id: z13.string().optional().describe("Workspace ID to create the guardrail in"),
+    organisation_id: z13.string().optional().describe("Organisation ID (required if workspace_id not provided)")
   },
   updateGuardrail: {
-    guardrail_id: z8.string().describe("The guardrail UUID or slug to update"),
-    name: z8.string().optional().describe("New name for the guardrail"),
-    checks: z8.array(guardrailCheckSchema).min(1).optional().describe("Updated array of checks to apply"),
+    guardrail_id: z13.string().describe("The guardrail UUID or slug to update"),
+    name: z13.string().optional().describe("New name for the guardrail"),
+    checks: z13.array(guardrailCheckSchema).min(1).optional().describe("Updated array of checks to apply"),
     actions: guardrailActionSchema.optional().describe("Updated actions configuration")
   },
   deleteGuardrail: {
-    guardrail_id: z8.string().describe("The guardrail UUID or slug to delete")
+    guardrail_id: z13.string().describe("The guardrail UUID or slug to delete")
   },
   updateOrganisationDefaults: {
-    input_guardrails: z8.array(z8.string()).optional().describe("Ordered guardrail IDs or slugs to enforce on model input"),
-    output_guardrails: z8.array(z8.string()).optional().describe("Ordered guardrail IDs or slugs to enforce on model output")
+    input_guardrails: z13.array(z13.string()).optional().describe("Ordered guardrail IDs or slugs to enforce on model input"),
+    output_guardrails: z13.array(z13.string()).optional().describe("Ordered guardrail IDs or slugs to enforce on model output")
   },
   listWorkspaceExclusions: {
-    organisation_id: z8.string().describe("Organisation ID whose workspace exclusions should be listed")
+    organisation_id: z13.string().describe("Organisation ID whose workspace exclusions should be listed")
   },
   updateWorkspaceExclusions: {
-    organisation_id: z8.string().describe("Organisation ID whose workspace exclusions should be updated"),
-    workspaces: z8.array(workspaceGuardrailExclusionSchema).min(1).describe("Workspace exclusion states to apply"),
-    override_existing: z8.boolean().optional().describe("Replace existing exclusion states instead of merging changes")
+    organisation_id: z13.string().describe("Organisation ID whose workspace exclusions should be updated"),
+    workspaces: z13.array(workspaceGuardrailExclusionSchema).min(1).describe("Workspace exclusion states to apply"),
+    override_existing: z13.boolean().optional().describe("Replace existing exclusion states instead of merging changes")
   },
   listGuardrailMcpServerMappings: {
-    guardrail_id: z8.string().min(1).describe("Guardrail UUID or slug")
+    guardrail_id: z13.string().min(1).describe("Guardrail UUID or slug")
   },
   replaceGuardrailMcpServerMappings: {
-    guardrail_id: z8.string().min(1).describe("Guardrail UUID or slug"),
-    mcp_servers: z8.record(z8.string().uuid(), guardrailMcpServerMappingConfigSchema).describe(
+    guardrail_id: z13.string().min(1).describe("Guardrail UUID or slug"),
+    mcp_servers: z13.record(z13.string().uuid(), guardrailMcpServerMappingConfigSchema).describe(
       "Complete MCP-server mapping set keyed by server UUID; an empty object clears every mapping"
     )
   },
   upsertGuardrailMcpServerMapping: {
-    guardrail_id: z8.string().min(1).describe("Guardrail UUID or slug"),
-    mcp_server_id: z8.string().uuid().describe("MCP server UUID"),
+    guardrail_id: z13.string().min(1).describe("Guardrail UUID or slug"),
+    mcp_server_id: z13.string().uuid().describe("MCP server UUID"),
     ...guardrailMcpServerMappingConfigShape
   }
 };
-var createGuardrailSchema = z8.object(GUARDRAILS_TOOL_SCHEMAS.createGuardrail).superRefine((value, context) => {
+var createGuardrailSchema = z13.object(GUARDRAILS_TOOL_SCHEMAS.createGuardrail).superRefine((value, context) => {
   if ((value.target ?? "llm") === "llm" && (!value.checks || !value.actions)) {
     context.addIssue({
       code: "custom",
@@ -3490,10 +3959,10 @@ var createGuardrailSchema = z8.object(GUARDRAILS_TOOL_SCHEMAS.createGuardrail).s
     });
   }
 });
-var replaceGuardrailMcpServerMappingsSchema = z8.object(
+var replaceGuardrailMcpServerMappingsSchema = z13.object(
   GUARDRAILS_TOOL_SCHEMAS.replaceGuardrailMcpServerMappings
 );
-var upsertGuardrailMcpServerMappingSchema = z8.object(
+var upsertGuardrailMcpServerMappingSchema = z13.object(
   GUARDRAILS_TOOL_SCHEMAS.upsertGuardrailMcpServerMapping
 );
 var GET_ORGANISATION_DEFAULTS_ANNOTATIONS = {
@@ -3658,7 +4127,7 @@ function registerGuardrailsTools(server, service) {
   );
   server.tool(
     "list_guardrail_mcp_servers",
-    "List every MCP-server mapping for one guardrail, including the input/output phases and mapped capability IDs. Use this before replace_guardrail_mcp_servers because replacement removes every mapping omitted from its request.",
+    "List every MCP-server mapping for one guardrail, including the input/output phases and mapped capability IDs. Requires a guardrail with target mcp_tools. Use this before replace_guardrail_mcp_servers because replacement removes every mapping omitted from its request.",
     GUARDRAILS_TOOL_SCHEMAS.listGuardrailMcpServerMappings,
     {
       title: "List Guardrail MCP Servers",
@@ -3673,7 +4142,7 @@ function registerGuardrailsTools(server, service) {
   );
   server.tool(
     "replace_guardrail_mcp_servers",
-    "Replace the complete MCP-server mapping set for one guardrail. Any existing server omitted from mcp_servers is removed, and an empty object clears all mappings. Read list_guardrail_mcp_servers first. Repeating the same complete map is safe.",
+    "Replace the complete MCP-server mapping set for one guardrail. Requires a guardrail with target mcp_tools. Any existing server omitted from mcp_servers is removed, and an empty object clears all mappings. Read list_guardrail_mcp_servers first. Repeating the same complete map is safe.",
     GUARDRAILS_TOOL_SCHEMAS.replaceGuardrailMcpServerMappings,
     {
       title: "Replace Guardrail MCP Servers",
@@ -3694,7 +4163,7 @@ function registerGuardrailsTools(server, service) {
   );
   server.tool(
     "upsert_guardrail_mcp_server",
-    "Create or replace one guardrail mapping for one MCP server without changing mappings for other servers. run_on defaults to both input and output. Use list_guardrail_mcp_servers to inspect the current mapping set first. Repeating the same mapping is safe.",
+    "Create or replace one guardrail mapping for one MCP server without changing mappings for other servers. Requires a guardrail with target mcp_tools. run_on defaults to both input and output. Use list_guardrail_mcp_servers to inspect the current mapping set first. Repeating the same mapping is safe.",
     GUARDRAILS_TOOL_SCHEMAS.upsertGuardrailMcpServerMapping,
     {
       title: "Upsert Guardrail MCP Server",
@@ -3758,7 +4227,7 @@ function registerGuardrailsTools(server, service) {
 }
 
 // src/tools/integrations.tools.ts
-import { z as z10 } from "zod";
+import { z as z15 } from "zod";
 
 // src/lib/limits.ts
 var PERIODIC_RESET_DEFAULT = "monthly";
@@ -3801,25 +4270,25 @@ function buildRateLimits(params) {
 }
 
 // src/tools/secret-mapping.schemas.ts
-import { z as z9 } from "zod";
+import { z as z14 } from "zod";
 function createSecretMappingSchema({
   allowKeyTarget,
   targetFieldDescription,
   secretReferenceDescription,
   valueFormatDescription
 }) {
-  return z9.object({
-    target_field: z9.string().refine(
+  return z14.object({
+    target_field: z14.string().refine(
       (value) => allowKeyTarget && value === "key" || value.startsWith("configurations."),
       allowKeyTarget ? "target_field must be 'key' or start with 'configurations.'" : "target_field must start with 'configurations.'"
     ).describe(targetFieldDescription),
-    secret_reference_id: z9.string().describe(secretReferenceDescription),
-    secret_key: z9.string().nullable().optional().describe("Optional key to select from a multi-value secret"),
-    value_format: z9.enum(["string", "json"]).nullable().optional().describe(valueFormatDescription)
+    secret_reference_id: z14.string().describe(secretReferenceDescription),
+    secret_key: z14.string().nullable().optional().describe("Optional key to select from a multi-value secret"),
+    value_format: z14.enum(["string", "json"]).nullable().optional().describe(valueFormatDescription)
   });
 }
 function uniqueSecretMappingsSchema(itemSchema) {
-  return z9.array(itemSchema).superRefine((mappings, context) => {
+  return z14.array(itemSchema).superRefine((mappings, context) => {
     const firstIndexByTarget = /* @__PURE__ */ new Map();
     for (const [index, mapping] of mappings.entries()) {
       const firstIndex = firstIndexByTarget.get(mapping.target_field);
@@ -3846,8 +4315,8 @@ var integrationSecretMappingSchema = createSecretMappingSchema({
 var integrationSecretMappingsSchema = uniqueSecretMappingsSchema(
   integrationSecretMappingSchema
 );
-var nullableMultiplier = (description) => z10.coerce.number().nonnegative().nullable().optional().describe(description);
-var pricingMultiplierSchema = z10.object({
+var nullableMultiplier = (description) => z15.coerce.number().nonnegative().nullable().optional().describe(description);
+var pricingMultiplierSchema = z15.object({
   default: nullableMultiplier(
     "Fallback multiplier for pricing units; 1 is unchanged, 0.8 is a 20% discount"
   ),
@@ -3891,175 +4360,178 @@ var pricingMultiplierSchema = z10.object({
   cache_write_image_input_token: nullableMultiplier(
     "Cache-write image input token price multiplier"
   ),
-  image: z10.object({
+  image: z15.object({
     default: nullableMultiplier("Default image-generation price multiplier")
   }).nullable().optional().describe("Image-generation pricing multipliers"),
-  additional_units: z10.record(z10.string(), z10.coerce.number().nonnegative().nullable()).nullable().optional().describe(
+  additional_units: z15.record(z15.string(), z15.coerce.number().nonnegative().nullable()).nullable().optional().describe(
     "Multipliers keyed by Portkey pricing unit, such as web_search or file_search"
   )
 });
-var pricingAdjustmentsSchema = z10.object({
+var pricingAdjustmentsSchema = z15.object({
   multiplier: pricingMultiplierSchema.optional().describe("Per-unit multipliers applied over Portkey catalog pricing")
 }).nullable();
-var modelConfigurationsSchema = z10.object({
-  custom_host: z10.string().url().optional().describe("Custom upstream URL used only for this model"),
-  custom_headers: z10.record(z10.string(), z10.string()).optional().describe("Headers sent only for this model; values may contain secrets")
+var modelConfigurationsSchema = z15.object({
+  custom_host: z15.string().url().optional().describe("Custom upstream URL used only for this model"),
+  custom_headers: z15.record(z15.string(), z15.string()).optional().describe("Headers sent only for this model; values may contain secrets")
 });
-var tokenPricingSchema = z10.object({
-  price: z10.coerce.number().nonnegative().describe("Static price per token in the integration pricing unit")
+var tokenPricingSchema = z15.object({
+  price: z15.coerce.number().nonnegative().describe("Static price per token in the integration pricing unit")
 });
-var integrationModelPricingSchema = z10.object({
-  type: z10.literal("static").describe("Static per-token pricing configuration"),
-  pay_as_you_go: z10.object({
+var integrationModelPricingSchema = z15.object({
+  type: z15.literal("static").describe("Static per-token pricing configuration"),
+  pay_as_you_go: z15.object({
     request_token: tokenPricingSchema.optional().describe("Input token pricing"),
     response_token: tokenPricingSchema.optional().describe("Output token pricing")
   }).optional().describe("Pay-as-you-go rates for this integration model")
 });
 var INTEGRATIONS_TOOL_SCHEMAS = {
   getModelPricing: {
-    provider: z10.string().describe(
+    provider: z15.string().describe(
       "Lowercase Portkey provider identifier, such as openai, anthropic, bedrock, or x-ai"
     ),
-    model: z10.string().describe("Exact provider model identifier, such as gpt-4o")
+    model: z15.string().describe("Exact provider model identifier, such as gpt-4o")
   },
   listIntegrations: {
     current_page: CurrentPageSchema,
     page_size: PageSizeSchema.describe(
       "Number of results per page (default 100, max 100)"
     ),
-    workspace_id: z10.string().optional().describe("Filter integrations accessible by a specific workspace"),
-    type: z10.enum(["workspace", "organisation", "all"]).optional().describe(
+    workspace_id: z15.string().optional().describe("Filter integrations accessible by a specific workspace"),
+    type: z15.enum(["workspace", "organisation", "all"]).optional().describe(
       "Filter by integration type: 'workspace', 'organisation', or 'all' (default)"
-    )
+    ),
+    tags: integrationTagsSchema.optional().describe("Match integrations that carry all supplied tags")
   },
   createIntegration: {
-    name: z10.string().describe("Human-readable name for the integration"),
-    ai_provider_id: z10.string().describe(
+    name: z15.string().describe("Human-readable name for the integration"),
+    ai_provider_id: z15.string().describe(
       "ID of the AI provider (e.g., 'openai', 'anthropic', 'azure-openai', 'aws-bedrock', 'vertex-ai')"
     ),
-    slug: z10.string().optional().describe(
+    slug: z15.string().optional().describe(
       "URL-friendly identifier (auto-generated from name if not provided)"
     ),
-    key: z10.string().optional().describe("API key for the provider (if required)"),
-    description: z10.string().optional().describe("Optional description of the integration"),
-    workspace_id: z10.string().optional().describe("Workspace ID for workspace-scoped integrations"),
-    api_version: z10.string().optional().describe("API version (for Azure OpenAI)"),
-    resource_name: z10.string().optional().describe("Resource name (for Azure OpenAI)"),
-    deployment_name: z10.string().optional().describe("Deployment name (for Azure OpenAI)"),
-    aws_region: z10.string().optional().describe("AWS region (for AWS Bedrock)"),
-    aws_access_key_id: z10.string().optional().describe("AWS access key ID (for AWS Bedrock)"),
-    aws_secret_access_key: z10.string().optional().describe("AWS secret access key (for AWS Bedrock)"),
-    vertex_project_id: z10.string().optional().describe("GCP project ID (for Vertex AI)"),
-    vertex_region: z10.string().optional().describe("GCP region (for Vertex AI)"),
-    custom_host: z10.string().optional().describe("Custom base URL for the provider"),
-    create_default_provider: z10.boolean().optional().describe(
+    key: z15.string().optional().describe("API key for the provider (if required)"),
+    description: z15.string().optional().describe("Optional description of the integration"),
+    workspace_id: z15.string().optional().describe("Workspace ID for workspace-scoped integrations"),
+    api_version: z15.string().optional().describe("API version (for Azure OpenAI)"),
+    resource_name: z15.string().optional().describe("Resource name (for Azure OpenAI)"),
+    deployment_name: z15.string().optional().describe("Deployment name (for Azure OpenAI)"),
+    aws_region: z15.string().optional().describe("AWS region (for AWS Bedrock)"),
+    aws_access_key_id: z15.string().optional().describe("AWS access key ID (for AWS Bedrock)"),
+    aws_secret_access_key: z15.string().optional().describe("AWS secret access key (for AWS Bedrock)"),
+    vertex_project_id: z15.string().optional().describe("GCP project ID (for Vertex AI)"),
+    vertex_region: z15.string().optional().describe("GCP region (for Vertex AI)"),
+    custom_host: z15.string().optional().describe("Custom base URL for the provider"),
+    create_default_provider: z15.boolean().optional().describe(
       "Create a provider automatically for a workspace-scoped integration; defaults to true"
     ),
-    default_provider_slug: z10.string().max(255).regex(/^[a-zA-Z0-9_-]+$/).optional().describe("Custom slug for the automatically created workspace provider"),
+    default_provider_slug: z15.string().max(255).regex(/^[a-zA-Z0-9_-]+$/).optional().describe("Custom slug for the automatically created workspace provider"),
     secret_mappings: integrationSecretMappingsSchema.optional().describe(
       "Unique runtime Secret Reference mappings; mapping key allows the key field to be omitted"
     ),
     pricing_adjustments: pricingAdjustmentsSchema.optional().describe(
       "Negotiated discount or markup multipliers for cost accounting"
-    )
+    ),
+    tags: integrationTagsSchema.nullable().optional().describe("Integration tags, or null to create without tags")
   },
   getIntegration: {
-    slug: z10.string().describe("The unique slug identifier of the integration to retrieve")
+    slug: z15.string().describe("The unique slug identifier of the integration to retrieve")
   },
   updateIntegration: {
-    slug: z10.string().describe("The slug of the integration to update"),
-    name: z10.string().optional().describe("New human-readable name for the integration"),
-    key: z10.string().optional().describe("New API key for the provider"),
-    description: z10.string().optional().describe("New description for the integration"),
-    api_version: z10.string().optional().describe("New API version (for Azure OpenAI)"),
-    resource_name: z10.string().optional().describe("New resource name (for Azure OpenAI)"),
-    deployment_name: z10.string().optional().describe("New deployment name (for Azure OpenAI)"),
-    aws_region: z10.string().optional().describe("New AWS region (for AWS Bedrock)"),
-    aws_access_key_id: z10.string().optional().describe("New AWS access key ID (for AWS Bedrock)"),
-    aws_secret_access_key: z10.string().optional().describe("New AWS secret access key (for AWS Bedrock)"),
-    vertex_project_id: z10.string().optional().describe("New GCP project ID (for Vertex AI)"),
-    vertex_region: z10.string().optional().describe("New GCP region (for Vertex AI)"),
-    custom_host: z10.string().optional().describe("New custom base URL for the provider"),
+    slug: z15.string().describe("The slug of the integration to update"),
+    name: z15.string().optional().describe("New human-readable name for the integration"),
+    key: z15.string().optional().describe("New API key for the provider"),
+    description: z15.string().optional().describe("New description for the integration"),
+    api_version: z15.string().optional().describe("New API version (for Azure OpenAI)"),
+    resource_name: z15.string().optional().describe("New resource name (for Azure OpenAI)"),
+    deployment_name: z15.string().optional().describe("New deployment name (for Azure OpenAI)"),
+    aws_region: z15.string().optional().describe("New AWS region (for AWS Bedrock)"),
+    aws_access_key_id: z15.string().optional().describe("New AWS access key ID (for AWS Bedrock)"),
+    aws_secret_access_key: z15.string().optional().describe("New AWS secret access key (for AWS Bedrock)"),
+    vertex_project_id: z15.string().optional().describe("New GCP project ID (for Vertex AI)"),
+    vertex_region: z15.string().optional().describe("New GCP region (for Vertex AI)"),
+    custom_host: z15.string().optional().describe("New custom base URL for the provider"),
     secret_mappings: integrationSecretMappingsSchema.optional().describe(
       "Replacement runtime Secret Reference mappings; each target_field must be unique"
     ),
     pricing_adjustments: pricingAdjustmentsSchema.optional().describe(
       "Replacement cost multiplier configuration, or null to clear adjustments"
-    )
+    ),
+    tags: integrationTagsSchema.nullable().optional().describe("Replacement integration tags, or null to clear all tags")
   },
   deleteIntegration: {
-    slug: z10.string().describe("The slug of the integration to delete")
+    slug: z15.string().describe("The slug of the integration to delete")
   },
   listIntegrationModels: {
-    slug: z10.string().describe("The slug of the integration"),
+    slug: z15.string().describe("The slug of the integration"),
     current_page: CurrentPageSchema,
     page_size: PageSizeSchema.describe("Number of results per page")
   },
   updateIntegrationModels: {
-    slug: z10.string().describe("The slug of the integration"),
-    allow_all_models: z10.boolean().optional().describe(
+    slug: z15.string().describe("The slug of the integration"),
+    allow_all_models: z15.boolean().optional().describe(
       "Whether newly available provider models are enabled by default"
     ),
-    models: z10.array(
-      z10.object({
-        slug: z10.string().describe("The model slug identifier"),
-        model_name: z10.string().optional().describe(
+    models: z15.array(
+      z15.object({
+        slug: z15.string().describe("The model slug identifier"),
+        model_name: z15.string().optional().describe(
           "Display name for the model (required for custom models)"
         ),
-        enabled: z10.boolean().describe("Whether the model is enabled"),
-        is_custom: z10.boolean().optional().describe("Whether this is a custom model (default: false)"),
-        is_finetune: z10.boolean().optional().describe("Whether this entry is a fine-tuned model"),
-        base_model_slug: z10.string().optional().describe("Base model slug for a fine-tuned model"),
+        enabled: z15.boolean().describe("Whether the model is enabled"),
+        is_custom: z15.boolean().optional().describe("Whether this is a custom model (default: false)"),
+        is_finetune: z15.boolean().optional().describe("Whether this entry is a fine-tuned model"),
+        base_model_slug: z15.string().optional().describe("Base model slug for a fine-tuned model"),
         configurations: modelConfigurationsSchema.optional().describe("Per-model custom upstream host and headers"),
         pricing_config: integrationModelPricingSchema.optional().describe("Static custom pricing for this integration model")
       })
     ).describe("Array of model configurations to update")
   },
   deleteIntegrationModel: {
-    slug: z10.string().describe("The slug of the integration"),
-    model_slug: z10.string().describe("The slug of the model to delete")
+    slug: z15.string().describe("The slug of the integration"),
+    model_slug: z15.string().describe("The slug of the model to delete")
   },
   listIntegrationWorkspaces: {
-    slug: z10.string().describe("The slug of the integration"),
+    slug: z15.string().describe("The slug of the integration"),
     current_page: CurrentPageSchema,
     page_size: PageSizeSchema.describe("Number of results per page")
   },
   updateIntegrationWorkspaces: {
-    slug: z10.string().describe("The slug of the integration"),
-    workspaces: z10.array(
-      z10.object({
-        id: z10.string().describe("The workspace ID"),
-        enabled: z10.boolean().describe("Whether the workspace has access to this integration"),
-        credit_limit: z10.coerce.number().positive().optional().describe("Credit limit for this workspace"),
-        alert_threshold: z10.coerce.number().min(0).max(100).optional().describe("Alert threshold percentage (0-100)"),
-        rate_limit_rpm: z10.coerce.number().positive().optional().describe("Rate limit in requests per minute"),
-        reset_usage: z10.boolean().optional().describe("Reset exhausted usage status to active"),
-        create_default_provider: z10.boolean().optional().describe(
+    slug: z15.string().describe("The slug of the integration"),
+    workspaces: z15.array(
+      z15.object({
+        id: z15.string().describe("The workspace ID"),
+        enabled: z15.boolean().describe("Whether the workspace has access to this integration"),
+        credit_limit: z15.coerce.number().positive().optional().describe("Credit limit for this workspace"),
+        alert_threshold: z15.coerce.number().min(0).max(100).optional().describe("Alert threshold percentage (0-100)"),
+        rate_limit_rpm: z15.coerce.number().positive().optional().describe("Rate limit in requests per minute"),
+        reset_usage: z15.boolean().optional().describe("Reset exhausted usage status to active"),
+        create_default_provider: z15.boolean().optional().describe(
           "Override whether a provider is auto-created for this workspace"
         ),
-        default_provider_slug: z10.string().optional().describe(
+        default_provider_slug: z15.string().optional().describe(
           "Override the auto-created provider slug for this workspace"
         )
       })
     ).describe("Array of workspace configurations to update"),
-    global_workspace_access_enabled: z10.boolean().optional().describe(
+    global_workspace_access_enabled: z15.boolean().optional().describe(
       "Enable or disable access for all current and future workspaces"
     ),
-    global_credit_limit: z10.coerce.number().positive().optional().describe(
+    global_credit_limit: z15.coerce.number().positive().optional().describe(
       "Global cost credit limit applied with global workspace access"
     ),
-    global_alert_threshold: z10.coerce.number().nonnegative().max(100).optional().describe("Global cost alert threshold applied to workspace access"),
-    global_rate_limit_rpm: z10.coerce.number().positive().optional().describe("Global requests-per-minute limit for workspace access"),
-    override_existing_workspace_access: z10.boolean().optional().describe("Apply global settings over existing per-workspace access"),
-    create_default_provider: z10.boolean().optional().describe("Auto-create providers when granting workspace access"),
-    default_provider_slug: z10.string().optional().describe("Default slug for providers auto-created in workspaces")
+    global_alert_threshold: z15.coerce.number().nonnegative().max(100).optional().describe("Global cost alert threshold applied to workspace access"),
+    global_rate_limit_rpm: z15.coerce.number().positive().optional().describe("Global requests-per-minute limit for workspace access"),
+    override_existing_workspace_access: z15.boolean().optional().describe("Apply global settings over existing per-workspace access"),
+    create_default_provider: z15.boolean().optional().describe("Auto-create providers when granting workspace access"),
+    default_provider_slug: z15.string().optional().describe("Default slug for providers auto-created in workspaces")
   }
 };
-var updateIntegrationWorkspacesSchema = z10.object(INTEGRATIONS_TOOL_SCHEMAS.updateIntegrationWorkspaces).superRefine((value, ctx) => {
+var updateIntegrationWorkspacesSchema = z15.object(INTEGRATIONS_TOOL_SCHEMAS.updateIntegrationWorkspaces).superRefine((value, ctx) => {
   const hasGlobalLimits = value.global_credit_limit !== void 0 || value.global_alert_threshold !== void 0 || value.global_rate_limit_rpm !== void 0;
   if (hasGlobalLimits && value.global_workspace_access_enabled === void 0) {
     ctx.addIssue({
-      code: z10.ZodIssueCode.custom,
+      code: z15.ZodIssueCode.custom,
       path: ["global_workspace_access_enabled"],
       message: "global_workspace_access_enabled is required when setting global limits."
     });
@@ -4108,14 +4580,15 @@ function registerIntegrationsTools(server, service) {
   );
   server.tool(
     "list_integrations",
-    "List org-level AI provider connections with optional workspace or type filters. Use this to find integration slugs before model or workspace updates. Returns total plus id, name, slug, provider, status, description, workspace counts, and config summary.",
+    "List org-level AI provider connections with optional workspace, type, or tag filters. Use this to find integration slugs before model or workspace updates. Returns total plus id, name, slug, provider, status, description, workspace counts, and config summary.",
     INTEGRATIONS_TOOL_SCHEMAS.listIntegrations,
     async (params) => {
       const integrations = await service.integrations.listIntegrations({
         current_page: params.current_page,
         page_size: params.page_size,
         workspace_id: params.workspace_id,
-        type: params.type
+        type: params.type,
+        ...params.tags !== void 0 ? { tags: params.tags } : {}
       });
       return jsonResult({
         total: integrations.total,
@@ -4135,7 +4608,7 @@ function registerIntegrationsTools(server, service) {
   );
   server.tool(
     "create_integration",
-    "Create an AI-provider integration that becomes the source for workspace providers. ai_provider_id identifies the backend; provider-specific fields configure Azure, Bedrock, Vertex, or custom hosts. For workspace-scoped integrations, create_default_provider controls automatic provider creation. key is write-only, but secret_mappings can resolve it or configuration fields from Secret References at runtime. pricing_adjustments apply negotiated discounts or markups to cost accounting. Use update_integration_models and update_integration_workspaces after creation; returns the new integration id and slug.",
+    "Create an AI-provider integration that becomes the source for workspace providers. ai_provider_id identifies the backend; provider-specific fields configure Azure, Bedrock, Vertex, or custom hosts. For workspace-scoped integrations, create_default_provider controls automatic provider creation. key is write-only, but secret_mappings can resolve it or configuration fields from Secret References at runtime. pricing_adjustments apply negotiated discounts or markups to cost accounting; tags attach key-value labels that list_integrations can filter on. Use update_integration_models and update_integration_workspaces after creation; returns the new integration id and slug.",
     INTEGRATIONS_TOOL_SCHEMAS.createIntegration,
     {
       title: "Create AI Provider Integration",
@@ -4156,7 +4629,8 @@ function registerIntegrationsTools(server, service) {
         ...params.create_default_provider !== void 0 ? { create_default_provider: params.create_default_provider } : {},
         ...params.default_provider_slug !== void 0 ? { default_provider_slug: params.default_provider_slug } : {},
         ...params.secret_mappings !== void 0 ? { secret_mappings: params.secret_mappings } : {},
-        ...params.pricing_adjustments !== void 0 ? { pricing_adjustments: params.pricing_adjustments } : {}
+        ...params.pricing_adjustments !== void 0 ? { pricing_adjustments: params.pricing_adjustments } : {},
+        ...params.tags !== void 0 ? { tags: params.tags } : {}
       });
       return jsonResult({
         message: `Successfully created integration "${params.name}"`,
@@ -4195,7 +4669,7 @@ function registerIntegrationsTools(server, service) {
   );
   server.tool(
     "update_integration",
-    "Update an integration's name, description, API key, provider config, Secret Reference mappings, or pricing adjustments by slug. Only provided fields change; key, secret mapping, and config changes take effect immediately and can disrupt dependent providers or live requests, while pricing multipliers change cost analytics and budget accounting. Review get_integration first. Model availability and workspace access remain separate in update_integration_models and update_integration_workspaces.",
+    "Update an integration's name, description, API key, provider config, Secret Reference mappings, pricing adjustments, or tags by slug. Only provided fields change; tags replaces the whole map and null clears it; key, secret mapping, and config changes take effect immediately and can disrupt dependent providers or live requests, while pricing multipliers change cost analytics and budget accounting. Review get_integration first. Model availability and workspace access remain separate in update_integration_models and update_integration_workspaces.",
     INTEGRATIONS_TOOL_SCHEMAS.updateIntegration,
     {
       title: "Update AI Provider Integration",
@@ -4211,7 +4685,8 @@ function registerIntegrationsTools(server, service) {
         description: params.description,
         configurations: buildIntegrationConfigurations(params),
         secret_mappings: params.secret_mappings,
-        pricing_adjustments: params.pricing_adjustments
+        pricing_adjustments: params.pricing_adjustments,
+        ...params.tags !== void 0 ? { tags: params.tags } : {}
       });
       return jsonResult({
         message: `Successfully updated integration "${params.slug}"`,
@@ -4251,7 +4726,7 @@ function registerIntegrationsTools(server, service) {
           slug: model.slug ?? model.model_id,
           name: model.name ?? model.model_name,
           enabled: model.enabled,
-          is_custom: model.is_custom ?? model.custom,
+          is_custom: model.is_custom !== void 0 ? model.is_custom : model.custom,
           is_finetune: model.is_finetune,
           base_model_slug: model.base_model_slug,
           configurations: model.configurations,
@@ -4391,31 +4866,31 @@ function registerIntegrationsTools(server, service) {
 }
 
 // src/tools/keys.tools.ts
-import { z as z11 } from "zod";
-var virtualKeySecretMappingSchema = z11.object({
-  target_field: z11.string().refine(
+import { z as z16 } from "zod";
+var virtualKeySecretMappingSchema = z16.object({
+  target_field: z16.string().refine(
     (value) => value === "key" || value.startsWith("model_config."),
     "target_field must be 'key' or start with 'model_config.'"
   ).describe("Virtual Key field populated from the Secret Reference"),
-  secret_reference_id: z11.string().describe("Secret Reference ID that owns the external secret"),
-  secret_key: z11.string().nullable().optional().describe("Optional key selected from a structured external secret"),
-  value_format: z11.enum(["json", "string"]).nullable().optional().describe("Whether Portkey reads the mapped value as JSON or a string")
+  secret_reference_id: z16.string().describe("Secret Reference ID that owns the external secret"),
+  secret_key: z16.string().nullable().optional().describe("Optional key selected from a structured external secret"),
+  value_format: z16.enum(["json", "string"]).nullable().optional().describe("Whether Portkey reads the mapped value as JSON or a string")
 });
-var virtualKeyDeploymentSchema = z11.object({
-  api_version: z11.string().min(1).describe("Azure OpenAI API version"),
-  deployment_name: z11.string().min(1).describe("Azure deployment name"),
-  alias: z11.string().optional().describe("Optional model alias for the deployment"),
-  is_default: z11.boolean().optional().describe("Whether this is the default Azure deployment")
+var virtualKeyDeploymentSchema = z16.object({
+  api_version: z16.string().min(1).describe("Azure OpenAI API version"),
+  deployment_name: z16.string().min(1).describe("Azure deployment name"),
+  alias: z16.string().optional().describe("Optional model alias for the deployment"),
+  is_default: z16.boolean().optional().describe("Whether this is the default Azure deployment")
 });
-var apiKeyRateLimitSchema = z11.object({
-  type: z11.enum(["requests", "tokens"]).describe("Whether the limit counts requests or tokens"),
-  unit: z11.enum(["rpd", "rph", "rpm", "rps", "rpw"]).describe("Rate window unit for the request or token count"),
-  value: z11.coerce.number().int().nonnegative().describe("Maximum count in the selected rate window")
+var apiKeyRateLimitSchema = z16.object({
+  type: z16.enum(["requests", "tokens"]).describe("Whether the limit counts requests or tokens"),
+  unit: z16.enum(["rpd", "rph", "rpm", "rps", "rpw"]).describe("Rate window unit for the request or token count"),
+  value: z16.coerce.number().int().nonnegative().describe("Maximum count in the selected rate window")
 });
-var rotationPolicySchema = z11.object({
-  rotation_period: z11.enum(["weekly", "monthly"]).nullable().optional().describe("Built-in weekly or monthly automatic rotation cadence"),
-  next_rotation_at: z11.iso.datetime({ offset: true }).nullable().optional().describe("Explicit next rotation timestamp in ISO 8601 format"),
-  key_transition_period_ms: z11.coerce.number().int().min(18e5).optional().describe("Overlap in milliseconds before the previous key expires")
+var rotationPolicySchema = z16.object({
+  rotation_period: z16.enum(["weekly", "monthly"]).nullable().optional().describe("Built-in weekly or monthly automatic rotation cadence"),
+  next_rotation_at: z16.iso.datetime({ offset: true }).nullable().optional().describe("Explicit next rotation timestamp in ISO 8601 format"),
+  key_transition_period_ms: z16.coerce.number().int().min(18e5).optional().describe("Overlap in milliseconds before the previous key expires")
 }).superRefine((value, context) => {
   if (value.rotation_period && value.next_rotation_at) {
     context.addIssue({
@@ -4431,108 +4906,108 @@ var KEYS_TOOL_SCHEMAS = {
     page_size: PageSizeSchema.describe("Number of results per page (max 100)")
   },
   createVirtualKey: {
-    name: z11.string().describe("Display name for the virtual key"),
-    provider: z11.string().describe(
+    name: z16.string().describe("Display name for the virtual key"),
+    provider: z16.string().describe(
       "Provider slug (e.g., 'openai', 'anthropic', 'azure-openai', 'google')"
     ),
-    key: z11.string().optional().describe("Provider API key; omit when secret_mappings supplies key"),
-    note: z11.string().optional().describe("Optional note or description for this key"),
-    workspace_id: z11.string().optional().describe("Workspace ID to create the key in"),
-    api_version: z11.string().optional().describe("API version (for Azure OpenAI)"),
-    resource_name: z11.string().optional().describe("Resource name (for Azure OpenAI)"),
-    deployment_name: z11.string().optional().describe("Deployment name (for Azure OpenAI)"),
-    deployment_configurations: z11.array(virtualKeyDeploymentSchema).optional().describe(
+    key: z16.string().optional().describe("Provider API key; omit when secret_mappings supplies key"),
+    note: z16.string().optional().describe("Optional note or description for this key"),
+    workspace_id: z16.string().optional().describe("Workspace ID to create the key in"),
+    api_version: z16.string().optional().describe("API version (for Azure OpenAI)"),
+    resource_name: z16.string().optional().describe("Resource name (for Azure OpenAI)"),
+    deployment_name: z16.string().optional().describe("Deployment name (for Azure OpenAI)"),
+    deployment_configurations: z16.array(virtualKeyDeploymentSchema).optional().describe(
       "Azure deployment configurations with API versions and aliases"
     ),
-    expires_at: z11.iso.datetime({ offset: true }).optional().describe("Expiration in ISO 8601 format"),
-    secret_mappings: z11.array(virtualKeySecretMappingSchema).optional().describe("Secret Reference mappings for key or model_config fields"),
-    credit_limit: z11.coerce.number().positive().optional().describe("Maximum usage cost threshold"),
-    alert_threshold: z11.coerce.number().min(0).max(100).optional().describe(
+    expires_at: z16.iso.datetime({ offset: true }).optional().describe("Expiration in ISO 8601 format"),
+    secret_mappings: z16.array(virtualKeySecretMappingSchema).optional().describe("Secret Reference mappings for key or model_config fields"),
+    credit_limit: z16.coerce.number().positive().optional().describe("Maximum usage cost threshold"),
+    alert_threshold: z16.coerce.number().min(0).max(100).optional().describe(
       "Percentage of credit_limit at which to send alert emails (0-100)"
     ),
-    rate_limit_rpm: z11.coerce.number().positive().optional().describe("Requests per minute limit")
+    rate_limit_rpm: z16.coerce.number().positive().optional().describe("Requests per minute limit")
   },
   getVirtualKey: {
-    slug: z11.string().describe("The unique slug identifier of the virtual key to retrieve")
+    slug: z16.string().describe("The unique slug identifier of the virtual key to retrieve")
   },
   updateVirtualKey: {
-    slug: z11.string().describe("The slug of the virtual key to update"),
-    name: z11.string().optional().describe("New display name for the key"),
-    key: z11.string().optional().describe("New provider API key value"),
-    note: z11.string().optional().describe("New note or description"),
-    credit_limit: z11.coerce.number().positive().optional().describe("New credit limit for usage"),
-    alert_threshold: z11.coerce.number().min(0).max(100).optional().describe("New alert threshold percentage (0-100)"),
-    rate_limit_rpm: z11.coerce.number().positive().optional().describe("New rate limit in requests per minute"),
-    deployment_configurations: z11.array(virtualKeyDeploymentSchema).optional().describe("Replacement Azure deployment configurations"),
-    secret_mappings: z11.array(virtualKeySecretMappingSchema).optional().describe("Replacement Secret Reference mappings")
+    slug: z16.string().describe("The slug of the virtual key to update"),
+    name: z16.string().optional().describe("New display name for the key"),
+    key: z16.string().optional().describe("New provider API key value"),
+    note: z16.string().optional().describe("New note or description"),
+    credit_limit: z16.coerce.number().positive().optional().describe("New credit limit for usage"),
+    alert_threshold: z16.coerce.number().min(0).max(100).optional().describe("New alert threshold percentage (0-100)"),
+    rate_limit_rpm: z16.coerce.number().positive().optional().describe("New rate limit in requests per minute"),
+    deployment_configurations: z16.array(virtualKeyDeploymentSchema).optional().describe("Replacement Azure deployment configurations"),
+    secret_mappings: z16.array(virtualKeySecretMappingSchema).optional().describe("Replacement Secret Reference mappings")
   },
   deleteVirtualKey: {
-    slug: z11.string().describe("The slug of the virtual key to delete")
+    slug: z16.string().describe("The slug of the virtual key to delete")
   },
   createApiKey: {
-    type: z11.enum(["organisation", "workspace"]).describe(
+    type: z16.enum(["organisation", "workspace"]).describe(
       "Key type: 'organisation' for org-wide access or 'workspace' for workspace-scoped"
     ),
-    sub_type: z11.enum(["user", "service"]).describe(
+    sub_type: z16.enum(["user", "service"]).describe(
       "Sub-type: 'user' for user-associated keys or 'service' for service accounts"
     ),
-    name: z11.string().describe("Display name for the API key"),
-    description: z11.string().optional().describe("Optional description for the key"),
-    organisation_id: z11.string().optional().describe("Organisation UUID"),
-    workspace_id: z11.string().optional().describe("Workspace ID (required for workspace-type keys)"),
-    user_id: z11.string().optional().describe("User ID (required for user sub-type keys)"),
-    scopes: z11.array(z11.string()).describe(
+    name: z16.string().describe("Display name for the API key"),
+    description: z16.string().optional().describe("Optional description for the key"),
+    organisation_id: z16.string().optional().describe("Organisation UUID"),
+    workspace_id: z16.string().optional().describe("Workspace ID (required for workspace-type keys)"),
+    user_id: z16.string().optional().describe("User ID (required for user sub-type keys)"),
+    scopes: z16.array(z16.string()).describe(
       "Permission scopes for the key (e.g., ['logs.read', 'analytics.read'])"
     ),
-    credit_limit: z11.coerce.number().positive().optional().describe("Credit limit for usage"),
-    alert_threshold: z11.coerce.number().min(0).max(100).optional().describe("Alert threshold percentage (0-100)"),
-    rate_limit_rpm: z11.coerce.number().positive().optional().describe("Rate limit in requests per minute"),
-    rate_limits: z11.array(apiKeyRateLimitSchema).nullable().optional().describe("Request or token rate limits, or null to clear them"),
-    default_config_id: z11.string().optional().describe("Default configuration ID to use with this key"),
-    default_metadata: z11.record(z11.string(), z11.string()).optional().describe("Default metadata key-value pairs"),
-    default_allow_config_override: z11.boolean().optional().describe("Allow callers to override the default config"),
-    alert_emails: z11.array(z11.string()).optional().describe("Email addresses for alerts"),
-    expires_at: z11.iso.datetime({ offset: true }).optional().describe("Expiration date in ISO 8601 format"),
+    credit_limit: z16.coerce.number().positive().optional().describe("Credit limit for usage"),
+    alert_threshold: z16.coerce.number().min(0).max(100).optional().describe("Alert threshold percentage (0-100)"),
+    rate_limit_rpm: z16.coerce.number().positive().optional().describe("Rate limit in requests per minute"),
+    rate_limits: z16.array(apiKeyRateLimitSchema).nullable().optional().describe("Request or token rate limits, or null to clear them"),
+    default_config_id: z16.string().optional().describe("Default configuration ID to use with this key"),
+    default_metadata: z16.record(z16.string(), z16.string()).optional().describe("Default metadata key-value pairs"),
+    default_allow_config_override: z16.boolean().optional().describe("Allow callers to override the default config"),
+    alert_emails: z16.array(z16.string()).optional().describe("Email addresses for alerts"),
+    expires_at: z16.iso.datetime({ offset: true }).optional().describe("Expiration date in ISO 8601 format"),
     rotation_policy: rotationPolicySchema.nullable().optional().describe("Automatic API-key rotation policy, or null to disable it")
   },
   listApiKeys: {
     page_size: PageSizeSchema.describe("Number of results per page (max 100)"),
     current_page: CurrentPageSchema,
-    workspace_id: z11.string().optional().describe("Filter by workspace ID")
+    workspace_id: z16.string().optional().describe("Filter by workspace ID")
   },
   getApiKey: {
-    id: z11.string().uuid().describe("The UUID of the API key to retrieve")
+    id: z16.string().uuid().describe("The UUID of the API key to retrieve")
   },
   updateApiKey: {
-    id: z11.string().uuid().describe("The UUID of the API key to update"),
-    name: z11.string().optional().describe("New display name for the key"),
-    description: z11.string().optional().describe("New description for the key"),
-    scopes: z11.array(z11.string()).optional().describe("New permission scopes for the key"),
-    credit_limit: z11.coerce.number().positive().optional().describe("New credit limit for usage"),
-    alert_threshold: z11.coerce.number().min(0).max(100).optional().describe("New alert threshold percentage (0-100)"),
-    rate_limit_rpm: z11.coerce.number().positive().optional().describe("New rate limit in requests per minute"),
-    rate_limits: z11.array(apiKeyRateLimitSchema).nullable().optional().describe("Replacement request or token rate limits, or null to clear"),
-    reset_usage: z11.coerce.number().nonnegative().optional().describe("Set to a nonnegative acknowledgement value to reset usage"),
-    default_config_id: z11.string().optional().describe("New default configuration ID"),
-    default_metadata: z11.record(z11.string(), z11.string()).optional().describe("New default metadata key-value pairs"),
-    default_allow_config_override: z11.boolean().optional().describe("Whether callers may override the key's default config"),
-    alert_emails: z11.array(z11.string()).optional().describe("New email addresses for alerts"),
-    expires_at: z11.iso.datetime({ offset: true }).nullable().optional().describe(
+    id: z16.string().uuid().describe("The UUID of the API key to update"),
+    name: z16.string().optional().describe("New display name for the key"),
+    description: z16.string().optional().describe("New description for the key"),
+    scopes: z16.array(z16.string()).optional().describe("New permission scopes for the key"),
+    credit_limit: z16.coerce.number().positive().optional().describe("New credit limit for usage"),
+    alert_threshold: z16.coerce.number().min(0).max(100).optional().describe("New alert threshold percentage (0-100)"),
+    rate_limit_rpm: z16.coerce.number().positive().optional().describe("New rate limit in requests per minute"),
+    rate_limits: z16.array(apiKeyRateLimitSchema).nullable().optional().describe("Replacement request or token rate limits, or null to clear"),
+    reset_usage: z16.coerce.number().nonnegative().optional().describe("Set to a nonnegative acknowledgement value to reset usage"),
+    default_config_id: z16.string().optional().describe("New default configuration ID"),
+    default_metadata: z16.record(z16.string(), z16.string()).optional().describe("New default metadata key-value pairs"),
+    default_allow_config_override: z16.boolean().optional().describe("Whether callers may override the key's default config"),
+    alert_emails: z16.array(z16.string()).optional().describe("New email addresses for alerts"),
+    expires_at: z16.iso.datetime({ offset: true }).nullable().optional().describe(
       "New expiration date in ISO 8601 format, or null to remove expiration"
     ),
     rotation_policy: rotationPolicySchema.nullable().optional().describe("Replacement rotation policy, or null to disable it")
   },
   rotateApiKey: {
-    id: z11.string().uuid().describe("API key UUID obtained from list_api_keys"),
-    key_transition_period_ms: z11.coerce.number().int().min(18e5).optional().describe(
+    id: z16.string().uuid().describe("API key UUID obtained from list_api_keys"),
+    key_transition_period_ms: z16.coerce.number().int().min(18e5).optional().describe(
       "Overlap in milliseconds while the previous key remains valid; minimum 1,800,000 (30 minutes), for example 3,600,000 for 1 hour"
     )
   },
   deleteApiKey: {
-    id: z11.string().uuid().describe("The UUID of the API key to delete")
+    id: z16.string().uuid().describe("The UUID of the API key to delete")
   }
 };
-var createVirtualKeySchema = z11.object(KEYS_TOOL_SCHEMAS.createVirtualKey).superRefine((value, context) => {
+var createVirtualKeySchema = z16.object(KEYS_TOOL_SCHEMAS.createVirtualKey).superRefine((value, context) => {
   if (value.key === void 0 && !value.secret_mappings?.some((mapping) => mapping.target_field === "key")) {
     context.addIssue({
       code: "custom",
@@ -4541,17 +5016,17 @@ var createVirtualKeySchema = z11.object(KEYS_TOOL_SCHEMAS.createVirtualKey).supe
     });
   }
 });
-var createApiKeySchema = z11.object(KEYS_TOOL_SCHEMAS.createApiKey).superRefine((value, ctx) => {
+var createApiKeySchema = z16.object(KEYS_TOOL_SCHEMAS.createApiKey).superRefine((value, ctx) => {
   if (value.type === "workspace" && !value.workspace_id) {
     ctx.addIssue({
-      code: z11.ZodIssueCode.custom,
+      code: z16.ZodIssueCode.custom,
       path: ["workspace_id"],
       message: "workspace_id is required when type is 'workspace'"
     });
   }
   if (value.sub_type === "user" && !value.user_id) {
     ctx.addIssue({
-      code: z11.ZodIssueCode.custom,
+      code: z16.ZodIssueCode.custom,
       path: ["user_id"],
       message: "user_id is required when sub_type is 'user'"
     });
@@ -4874,43 +5349,43 @@ function registerKeysTools(server, service) {
 }
 
 // src/tools/labels.tools.ts
-import { z as z12 } from "zod";
+import { z as z17 } from "zod";
 var LABELS_TOOL_SCHEMAS = {
   createPromptLabel: {
-    name: z12.string().describe("Name of the label"),
-    organisation_id: z12.string().optional().describe("Organisation ID to create the label in"),
-    workspace_id: z12.string().optional().describe("Workspace ID to create the label in"),
-    description: z12.string().optional().describe("Description of the label"),
-    color_code: z12.string().regex(/^#[0-9A-Fa-f]{6}$/).optional().describe(
+    name: z17.string().describe("Name of the label"),
+    organisation_id: z17.string().optional().describe("Organisation ID to create the label in"),
+    workspace_id: z17.string().optional().describe("Workspace ID to create the label in"),
+    description: z17.string().optional().describe("Description of the label"),
+    color_code: z17.string().regex(/^#[0-9A-Fa-f]{6}$/).optional().describe(
       "Hex format, e.g. '#FF5733'. Optional \u2014 omit for default color."
     )
   },
   listPromptLabels: {
-    organisation_id: z12.string().optional().describe("Filter by organisation ID"),
-    workspace_id: z12.string().optional().describe("Filter by workspace ID"),
-    search: z12.string().optional().describe("Search labels by name"),
+    organisation_id: z17.string().optional().describe("Filter by organisation ID"),
+    workspace_id: z17.string().optional().describe("Filter by workspace ID"),
+    search: z17.string().optional().describe("Search labels by name"),
     current_page: CurrentPageSchema,
     page_size: PageSizeSchema
   },
   getPromptLabel: {
-    label_id: z12.string().describe("Label ID to retrieve"),
-    organisation_id: z12.string().optional().describe("Organisation ID for filtering"),
-    workspace_id: z12.string().optional().describe("Workspace ID for filtering")
+    label_id: z17.string().describe("Label ID to retrieve"),
+    organisation_id: z17.string().optional().describe("Organisation ID for filtering"),
+    workspace_id: z17.string().optional().describe("Workspace ID for filtering")
   },
   updatePromptLabel: {
-    label_id: z12.string().describe("Label ID to update"),
-    name: z12.string().optional().describe("New name for the label"),
-    description: z12.string().optional().describe("New description"),
-    color_code: z12.string().regex(/^#[0-9A-Fa-f]{6}$/).optional().describe("New hex color code (e.g., '#FF5733')")
+    label_id: z17.string().describe("Label ID to update"),
+    name: z17.string().optional().describe("New name for the label"),
+    description: z17.string().optional().describe("New description"),
+    color_code: z17.string().regex(/^#[0-9A-Fa-f]{6}$/).optional().describe("New hex color code (e.g., '#FF5733')")
   },
   deletePromptLabel: {
-    label_id: z12.string().describe("Label ID to delete")
+    label_id: z17.string().describe("Label ID to delete")
   }
 };
-var createPromptLabelSchema = z12.object(LABELS_TOOL_SCHEMAS.createPromptLabel).superRefine((value, ctx) => {
+var createPromptLabelSchema = z17.object(LABELS_TOOL_SCHEMAS.createPromptLabel).superRefine((value, ctx) => {
   if (!value.organisation_id && !value.workspace_id) {
     ctx.addIssue({
-      code: z12.ZodIssueCode.custom,
+      code: z17.ZodIssueCode.custom,
       message: "Either organisation_id or workspace_id is required"
     });
   }
@@ -5007,13 +5482,13 @@ function registerLabelsTools(server, service) {
 }
 
 // src/tools/limits.tools.ts
-import { z as z13 } from "zod";
-var statusSchema = z13.enum(["active", "archived"]);
-var rateUnitSchema = z13.enum(["rpm", "rph", "rpd", "rpw"]);
-var rateTargetSchema = z13.enum(["llm", "mcp_tools"]);
-var conditionValueSchema = z13.union([z13.string(), z13.array(z13.string()).min(1)]);
-var conditionSchema = z13.object({
-  key: z13.string().min(1).describe(
+import { z as z18 } from "zod";
+var statusSchema = z18.enum(["active", "archived"]);
+var rateUnitSchema = z18.enum(["rpm", "rph", "rpd", "rpw"]);
+var rateTargetSchema = z18.enum(["llm", "mcp_tools"]);
+var conditionValueSchema = z18.union([z18.string(), z18.array(z18.string()).min(1)]);
+var conditionSchema = z18.object({
+  key: z18.string().min(1).describe(
     "Match key such as api_key, virtual_key, provider, config, prompt, model, endpoint_type, mcp_server, mcp_tool, workspace_id, or metadata.*"
   ),
   value: conditionValueSchema.describe(
@@ -5021,8 +5496,8 @@ var conditionSchema = z13.object({
   ),
   excludes: conditionValueSchema.optional().describe("Values to exclude")
 });
-var groupBySchema = z13.object({
-  key: z13.string().min(1).describe(
+var groupBySchema = z18.object({
+  key: z18.string().min(1).describe(
     "Counter grouping key such as api_key, workspace_id, virtual_key, provider, config, prompt, model, mcp_server, mcp_tool, or metadata.*"
   )
 });
@@ -5032,88 +5507,88 @@ var paginationSchema = {
 };
 var LIMITS_TOOL_SCHEMAS = {
   listRateLimits: {
-    workspace_id: z13.string().optional().describe("Filter by workspace UUID"),
+    workspace_id: z18.string().optional().describe("Filter by workspace UUID"),
     status: statusSchema.optional().describe("Filter by active or archived status"),
-    type: z13.enum(["requests", "tokens"]).optional().describe("Filter by counter type"),
+    type: z18.enum(["requests", "tokens"]).optional().describe("Filter by counter type"),
     unit: rateUnitSchema.optional().describe("Filter by reset interval"),
     target: rateTargetSchema.optional().describe("Filter by LLM or MCP-tool target"),
     ...paginationSchema
   },
   getRateLimit: {
-    id: z13.string().min(1).describe("Rate-limit policy UUID"),
+    id: z18.string().min(1).describe("Rate-limit policy UUID"),
     status: statusSchema.optional().describe("Include an archived policy by status")
   },
   createRateLimit: {
-    conditions: z13.array(conditionSchema).min(1).describe("Policy match conditions"),
-    group_by: z13.array(groupBySchema).min(1).describe("Counter grouping dimensions"),
-    type: z13.enum(["requests", "tokens"]).describe("Counter type"),
+    conditions: z18.array(conditionSchema).min(1).describe("Policy match conditions"),
+    group_by: z18.array(groupBySchema).min(1).describe("Counter grouping dimensions"),
+    type: z18.enum(["requests", "tokens"]).describe("Counter type"),
     unit: rateUnitSchema.describe("Counter reset interval"),
-    value: z13.coerce.number().nonnegative().describe("Maximum requests or tokens"),
-    name: z13.string().optional().describe("Optional policy display name"),
+    value: z18.coerce.number().nonnegative().describe("Maximum requests or tokens"),
+    name: z18.string().optional().describe("Optional policy display name"),
     target: rateTargetSchema.optional().describe("LLM or MCP-tool enforcement target"),
-    workspace_id: z13.string().optional().describe("Workspace UUID scope"),
-    organisation_id: z13.string().optional().describe("Organisation UUID scope")
+    workspace_id: z18.string().optional().describe("Workspace UUID scope"),
+    organisation_id: z18.string().optional().describe("Organisation UUID scope")
   },
   updateRateLimit: {
-    id: z13.string().min(1).describe("Rate-limit policy UUID"),
-    name: z13.string().optional().describe("Replacement display name"),
+    id: z18.string().min(1).describe("Rate-limit policy UUID"),
+    name: z18.string().optional().describe("Replacement display name"),
     unit: rateUnitSchema.optional().describe("Replacement reset interval"),
-    value: z13.coerce.number().nonnegative().optional().describe("Replacement maximum"),
-    conditions: z13.array(conditionSchema).min(1).optional().describe("Replacement conditions")
+    value: z18.coerce.number().nonnegative().optional().describe("Replacement maximum"),
+    conditions: z18.array(conditionSchema).min(1).optional().describe("Replacement conditions")
   },
   deleteRateLimit: {
-    id: z13.string().min(1).describe("Rate-limit policy UUID to delete")
+    id: z18.string().min(1).describe("Rate-limit policy UUID to delete")
   },
   listUsageLimits: {
-    workspace_id: z13.string().optional().describe("Filter by workspace UUID"),
+    workspace_id: z18.string().optional().describe("Filter by workspace UUID"),
     status: statusSchema.optional().describe("Filter by active or archived status"),
-    type: z13.enum(["cost", "tokens"]).optional().describe("Filter by budget type"),
+    type: z18.enum(["cost", "tokens"]).optional().describe("Filter by budget type"),
     ...paginationSchema
   },
   getUsageLimit: {
-    id: z13.string().min(1).describe("Usage-limit policy UUID"),
+    id: z18.string().min(1).describe("Usage-limit policy UUID"),
     status: statusSchema.optional().describe("Include an archived policy by status"),
-    include_usage: z13.boolean().optional().describe("Include per-value usage counters")
+    include_usage: z18.boolean().optional().describe("Include per-value usage counters")
   },
   createUsageLimit: {
-    conditions: z13.array(conditionSchema).min(1).describe("Policy match conditions"),
-    group_by: z13.array(groupBySchema).min(1).describe("Usage grouping dimensions"),
-    type: z13.enum(["cost", "tokens"]).describe("Budget type"),
-    credit_limit: z13.coerce.number().nonnegative().describe("Maximum cumulative usage"),
-    name: z13.string().optional().describe("Optional policy display name"),
-    alert_threshold: z13.coerce.number().nonnegative().nullable().optional().describe("Optional alert threshold"),
-    periodic_reset: z13.enum(["monthly", "weekly"]).nullable().optional().describe("Optional reset schedule"),
-    workspace_id: z13.string().optional().describe("Workspace UUID scope"),
-    organisation_id: z13.string().optional().describe("Organisation UUID scope")
+    conditions: z18.array(conditionSchema).min(1).describe("Policy match conditions"),
+    group_by: z18.array(groupBySchema).min(1).describe("Usage grouping dimensions"),
+    type: z18.enum(["cost", "tokens"]).describe("Budget type"),
+    credit_limit: z18.coerce.number().nonnegative().describe("Maximum cumulative usage"),
+    name: z18.string().optional().describe("Optional policy display name"),
+    alert_threshold: z18.coerce.number().nonnegative().nullable().optional().describe("Optional alert threshold"),
+    periodic_reset: z18.enum(["monthly", "weekly"]).nullable().optional().describe("Optional reset schedule"),
+    workspace_id: z18.string().optional().describe("Workspace UUID scope"),
+    organisation_id: z18.string().optional().describe("Organisation UUID scope")
   },
   updateUsageLimit: {
-    id: z13.string().min(1).describe("Usage-limit policy UUID"),
-    name: z13.string().max(255).optional().describe("Replacement display name"),
-    description: z13.string().max(500).nullable().optional().describe("Replacement description, or null to clear it"),
-    conditions: z13.array(conditionSchema).min(1).optional().describe("Complete replacement condition set"),
-    credit_limit: z13.coerce.number().nonnegative().optional().describe("Replacement cumulative maximum"),
-    alert_threshold: z13.coerce.number().nonnegative().nullable().optional().describe("Replacement alert threshold"),
-    periodic_reset: z13.enum(["monthly", "weekly"]).nullable().optional().describe("Replacement reset schedule"),
-    periodic_reset_days: z13.coerce.number().int().min(1).max(365).nullable().optional().describe("Custom reset interval in days, or null to clear it"),
-    next_usage_reset_at: z13.iso.datetime({ offset: true }).nullable().optional().describe("Next reset timestamp in ISO 8601 format, or null to clear it"),
-    reset_usage_for_value: z13.string().optional().describe("Grouped value whose usage should reset")
+    id: z18.string().min(1).describe("Usage-limit policy UUID"),
+    name: z18.string().max(255).optional().describe("Replacement display name"),
+    description: z18.string().max(500).nullable().optional().describe("Replacement description, or null to clear it"),
+    conditions: z18.array(conditionSchema).min(1).optional().describe("Complete replacement condition set"),
+    credit_limit: z18.coerce.number().nonnegative().optional().describe("Replacement cumulative maximum"),
+    alert_threshold: z18.coerce.number().nonnegative().nullable().optional().describe("Replacement alert threshold"),
+    periodic_reset: z18.enum(["monthly", "weekly"]).nullable().optional().describe("Replacement reset schedule"),
+    periodic_reset_days: z18.coerce.number().int().min(1).max(365).nullable().optional().describe("Custom reset interval in days, or null to clear it"),
+    next_usage_reset_at: z18.iso.datetime({ offset: true }).nullable().optional().describe("Next reset timestamp in ISO 8601 format, or null to clear it"),
+    reset_usage_for_value: z18.string().optional().describe("Grouped value whose usage should reset")
   },
   deleteUsageLimit: {
-    id: z13.string().min(1).describe("Usage-limit policy UUID to archive")
+    id: z18.string().min(1).describe("Usage-limit policy UUID to archive")
   },
   listUsageLimitEntities: {
-    limit_id: z13.string().min(1).describe("Usage-limit policy UUID"),
-    status: z13.enum(["active", "exhausted"]).optional().describe("Filter by enforcement state"),
-    search: z13.string().optional().describe("Search tracked values"),
+    limit_id: z18.string().min(1).describe("Usage-limit policy UUID"),
+    status: z18.enum(["active", "exhausted"]).optional().describe("Filter by enforcement state"),
+    search: z18.string().optional().describe("Search tracked values"),
     page_size: PageSizeSchema.describe("Number of entities per page"),
     current_page: CurrentPageSchema.describe("Zero-based page number")
   },
   resetUsageLimitEntity: {
-    limit_id: z13.string().min(1).describe("Usage-limit policy UUID"),
-    entity_id: z13.string().min(1).describe("Tracked entity UUID to reset")
+    limit_id: z18.string().min(1).describe("Usage-limit policy UUID"),
+    entity_id: z18.string().min(1).describe("Tracked entity UUID to reset")
   }
 };
-var updateUsageLimitSchema = z13.object(LIMITS_TOOL_SCHEMAS.updateUsageLimit).superRefine((value, context) => {
+var updateUsageLimitSchema = z18.object(LIMITS_TOOL_SCHEMAS.updateUsageLimit).superRefine((value, context) => {
   if (value.periodic_reset != null && value.periodic_reset_days != null) {
     context.addIssue({
       code: "custom",
@@ -5253,8 +5728,8 @@ function registerLimitsTools(server, service) {
 }
 
 // src/tools/logging.tools.ts
-import { z as z14 } from "zod";
-var logExportFieldSchema = z14.enum([
+import { z as z19 } from "zod";
+var logExportFieldSchema = z19.enum([
   "id",
   "trace_id",
   "created_at",
@@ -5277,12 +5752,12 @@ var logExportFieldSchema = z14.enum([
   "metadata"
 ]);
 var getLogShape = {
-  log_id: z14.string().describe("Gateway log ID to retrieve"),
-  path_format: z14.enum(["v1", "v2"]).optional().describe("Log storage path format; defaults to v1"),
-  created_at: z14.iso.datetime({ offset: true }).optional().describe("Log creation timestamp in ISO 8601 format; required for v2"),
-  type: z14.enum(["hooks"]).optional().describe("Set to hooks when retrieving a hook execution log")
+  log_id: z19.string().describe("Gateway log ID to retrieve"),
+  path_format: z19.enum(["v1", "v2"]).optional().describe("Log storage path format; defaults to v1"),
+  created_at: z19.iso.datetime({ offset: true }).optional().describe("Log creation timestamp in ISO 8601 format; required for v2"),
+  type: z19.enum(["hooks"]).optional().describe("Set to hooks when retrieving a hook execution log")
 };
-var getLogSchema = z14.object(getLogShape).superRefine((input, context) => {
+var getLogSchema = z19.object(getLogShape).superRefine((input, context) => {
   if (input.path_format === "v2" && input.created_at === void 0) {
     context.addIssue({
       code: "custom",
@@ -5293,67 +5768,67 @@ var getLogSchema = z14.object(getLogShape).superRefine((input, context) => {
 });
 var LOGGING_TOOL_SCHEMAS = {
   getLogExportFieldRestrictions: {
-    workspace_id: z14.string().describe("Workspace ID whose export field restrictions should be read")
+    workspace_id: z19.string().describe("Workspace ID whose export field restrictions should be read")
   },
   insertLog: {
-    request_url: z14.string().optional().describe("The endpoint URL being called"),
-    request_provider: z14.string().optional().describe("AI provider name (e.g., 'openai', 'anthropic')"),
-    request_method: z14.string().optional().default("post").describe("HTTP method used (defaults to 'post')"),
-    request_headers: z14.record(z14.string(), z14.string()).optional().describe("Request headers as key-value pairs"),
-    request_body: z14.record(z14.string(), z14.unknown()).optional().describe("Request payload/body"),
-    response_status: z14.coerce.number().optional().default(200).describe("HTTP response status code (defaults to 200)"),
-    response_headers: z14.record(z14.string(), z14.string()).optional().describe("Response headers as key-value pairs"),
-    response_body: z14.record(z14.string(), z14.unknown()).optional().describe("Response payload/body"),
-    response_time: z14.coerce.number().optional().describe("Response latency in milliseconds"),
-    streaming_mode: z14.boolean().optional().default(false).describe("Whether the response was streamed"),
-    metadata_organization: z14.string().optional().describe("Organization identifier for the log"),
-    metadata_user: z14.string().optional().describe("User identifier for the log"),
-    metadata_trace_id: z14.string().optional().describe("Trace ID for distributed tracing"),
-    metadata_span_id: z14.string().optional().describe("Span ID for tracing"),
-    metadata_span_name: z14.string().optional().describe("Span name for tracing"),
-    metadata_parent_span_id: z14.string().optional().describe("Parent span ID for tracing"),
-    metadata_custom: z14.record(z14.string(), z14.unknown()).optional().describe("Additional custom metadata key-value pairs")
+    request_url: z19.string().optional().describe("The endpoint URL being called"),
+    request_provider: z19.string().optional().describe("AI provider name (e.g., 'openai', 'anthropic')"),
+    request_method: z19.string().optional().default("post").describe("HTTP method used (defaults to 'post')"),
+    request_headers: z19.record(z19.string(), z19.string()).optional().describe("Request headers as key-value pairs"),
+    request_body: z19.record(z19.string(), z19.unknown()).optional().describe("Request payload/body"),
+    response_status: z19.coerce.number().optional().default(200).describe("HTTP response status code (defaults to 200)"),
+    response_headers: z19.record(z19.string(), z19.string()).optional().describe("Response headers as key-value pairs"),
+    response_body: z19.record(z19.string(), z19.unknown()).optional().describe("Response payload/body"),
+    response_time: z19.coerce.number().optional().describe("Response latency in milliseconds"),
+    streaming_mode: z19.boolean().optional().default(false).describe("Whether the response was streamed"),
+    metadata_organization: z19.string().optional().describe("Organization identifier for the log"),
+    metadata_user: z19.string().optional().describe("User identifier for the log"),
+    metadata_trace_id: z19.string().optional().describe("Trace ID for distributed tracing"),
+    metadata_span_id: z19.string().optional().describe("Span ID for tracing"),
+    metadata_span_name: z19.string().optional().describe("Span name for tracing"),
+    metadata_parent_span_id: z19.string().optional().describe("Parent span ID for tracing"),
+    metadata_custom: z19.record(z19.string(), z19.unknown()).optional().describe("Additional custom metadata key-value pairs")
   },
   createLogExport: {
-    workspace_id: z14.string().optional().describe("Workspace ID for the export"),
-    description: z14.string().optional().describe("Human-readable description for the export job"),
-    time_min: z14.string().describe(
+    workspace_id: z19.string().optional().describe("Workspace ID for the export"),
+    description: z19.string().optional().describe("Human-readable description for the export job"),
+    time_min: z19.string().describe(
       "Minimum time filter in date format (e.g., '2024-01-01' or ISO 8601)"
     ),
-    time_max: z14.string().describe(
+    time_max: z19.string().describe(
       "Maximum time filter in date format (e.g., '2024-01-31' or ISO 8601)"
     ),
-    cost_min: z14.coerce.number().optional().describe("Minimum cost filter"),
-    cost_max: z14.coerce.number().optional().describe("Maximum cost filter"),
-    total_units_min: z14.coerce.number().optional().describe("Minimum total units (tokens) filter"),
-    total_units_max: z14.coerce.number().optional().describe("Maximum total units (tokens) filter"),
-    ai_model: z14.array(z14.string()).optional().describe("Filter by specific AI model names"),
-    requested_fields: z14.array(logExportFieldSchema).describe(
+    cost_min: z19.coerce.number().optional().describe("Minimum cost filter"),
+    cost_max: z19.coerce.number().optional().describe("Maximum cost filter"),
+    total_units_min: z19.coerce.number().optional().describe("Minimum total units (tokens) filter"),
+    total_units_max: z19.coerce.number().optional().describe("Maximum total units (tokens) filter"),
+    ai_model: z19.array(z19.string()).optional().describe("Filter by specific AI model names"),
+    requested_fields: z19.array(logExportFieldSchema).describe(
       "Fields to include in export: id, trace_id, created_at, request, response, is_success, ai_org, ai_model, req_units, res_units, total_units, request_url, cost, cost_currency, response_time, response_status_code, mode, config, prompt_slug, metadata"
     )
   },
   listLogExports: {
-    workspace_id: z14.string().describe("Workspace ID to list exports for (required)")
+    workspace_id: z19.string().describe("Workspace ID to list exports for (required)")
   },
   getLogExport: {
-    export_id: z14.string().describe("The unique ID of the log export")
+    export_id: z19.string().describe("The unique ID of the log export")
   },
   startLogExport: {
-    export_id: z14.string().describe("The unique ID of the log export to start")
+    export_id: z19.string().describe("The unique ID of the log export to start")
   },
   cancelLogExport: {
-    export_id: z14.string().describe("The unique ID of the log export to cancel")
+    export_id: z19.string().describe("The unique ID of the log export to cancel")
   },
   downloadLogExport: {
-    export_id: z14.string().describe("The unique ID of the log export to download")
+    export_id: z19.string().describe("The unique ID of the log export to download")
   },
   updateLogExport: {
-    export_id: z14.string().describe("The unique ID of the log export to update"),
-    workspace_id: z14.string().optional().describe("Workspace ID for the export"),
-    time_of_generation_max: z14.string().optional().describe(
+    export_id: z19.string().describe("The unique ID of the log export to update"),
+    workspace_id: z19.string().optional().describe("Workspace ID for the export"),
+    time_of_generation_max: z19.string().optional().describe(
       "Maximum time filter in date format (e.g., '2024-07-25' or ISO 8601)"
     ),
-    requested_fields: z14.array(logExportFieldSchema).optional().describe(
+    requested_fields: z19.array(logExportFieldSchema).optional().describe(
       "Fields to include in export: id, trace_id, created_at, request, response, is_success, ai_org, ai_model, req_units, res_units, total_units, request_url, cost, cost_currency, response_time, response_status_code, mode, config, prompt_slug, metadata"
     )
   }
@@ -5579,7 +6054,7 @@ function registerLoggingTools(server, service) {
 }
 
 // src/tools/mcp-integrations.tools.ts
-import { z as z15 } from "zod";
+import { z as z20 } from "zod";
 var mcpSecretMappingSchema = createSecretMappingSchema({
   allowKeyTarget: false,
   targetFieldDescription: "Configuration field resolved at runtime, such as configurations.oauth_metadata",
@@ -5589,10 +6064,10 @@ var mcpSecretMappingSchema = createSecretMappingSchema({
 var mcpSecretMappingsSchema = uniqueSecretMappingsSchema(
   mcpSecretMappingSchema
 );
-var mcpConfigurationsSchema = z15.record(z15.string(), z15.unknown()).superRefine((value, ctx) => {
+var mcpConfigurationsSchema = z20.record(z20.string(), z20.unknown()).superRefine((value, ctx) => {
   if ("custom_headers" in value && !isStringRecord(value.custom_headers)) {
     ctx.addIssue({
-      code: z15.ZodIssueCode.custom,
+      code: z20.ZodIssueCode.custom,
       path: ["custom_headers"],
       message: "configurations.custom_headers must be a string-to-string record"
     });
@@ -5604,31 +6079,31 @@ var MCP_INTEGRATIONS_TOOL_SCHEMAS = {
     page_size: pageSizeSchema(1e3).describe(
       "Number of results per page (max 1000)"
     ),
-    workspace_id: z15.string().optional().describe("Filter by workspace ID"),
-    organisation_id: z15.string().optional().describe("Filter by organisation UUID"),
-    type: z15.enum(["workspace", "organisation", "all"]).optional().describe(
+    workspace_id: z20.string().optional().describe("Filter by workspace ID"),
+    organisation_id: z20.string().optional().describe("Filter by organisation UUID"),
+    type: z20.enum(["workspace", "organisation", "all"]).optional().describe(
       "Filter by workspace, organisation, or all integration ownership"
     ),
-    search: z15.string().optional().describe("Search integrations by name")
+    search: z20.string().optional().describe("Search integrations by name")
   },
   createMcpIntegration: {
-    name: z15.string().describe("Display name for the MCP integration"),
-    url: z15.string().describe("URL endpoint of the MCP server to integrate"),
-    auth_type: z15.string().min(1).describe(
+    name: z20.string().describe("Display name for the MCP integration"),
+    url: z20.string().describe("URL endpoint of the MCP server to integrate"),
+    auth_type: z20.string().min(1).describe(
       "Authentication type. Current examples are 'none', 'headers' (custom headers), and 'oauth_auto' (OAuth); Portkey may accept additional values."
     ),
-    transport: z15.enum(["http", "sse"]).describe(
+    transport: z20.enum(["http", "sse"]).describe(
       "MCP transport protocol: 'http' (streamable HTTP) or 'sse' (server-sent events)"
     ),
-    slug: z15.string().optional().describe("Custom slug. Auto-generated if omitted"),
-    description: z15.string().optional().describe("Description of the MCP integration"),
-    custom_headers: z15.record(z15.string(), z15.string()).optional().describe(
+    slug: z20.string().optional().describe("Custom slug. Auto-generated if omitted"),
+    description: z20.string().optional().describe("Description of the MCP integration"),
+    custom_headers: z20.record(z20.string(), z20.string()).optional().describe(
       'Custom headers for authentication (e.g. { "Authorization": "Bearer xxx" }). Sent via configurations.custom_headers'
     ),
     configurations: mcpConfigurationsSchema.optional().describe(
       "Additional documented or forward-compatible configuration fields. For headers auth, configurations.custom_headers is a string-to-string header map."
     ),
-    workspace_id: z15.string().optional().describe(
+    workspace_id: z20.string().optional().describe(
       "Workspace ID \u2014 required when using organization admin API keys"
     ),
     secret_mappings: mcpSecretMappingsSchema.optional().describe(
@@ -5636,18 +6111,18 @@ var MCP_INTEGRATIONS_TOOL_SCHEMAS = {
     )
   },
   getMcpIntegration: {
-    id: z15.string().describe("The MCP integration ID or slug to retrieve")
+    id: z20.string().describe("The MCP integration ID or slug to retrieve")
   },
   updateMcpIntegration: {
-    id: z15.string().describe("The MCP integration ID or slug to update"),
-    name: z15.string().optional().describe("New display name"),
-    description: z15.string().optional().describe("New description"),
-    url: z15.string().optional().describe("New URL endpoint"),
-    auth_type: z15.string().min(1).optional().describe(
+    id: z20.string().describe("The MCP integration ID or slug to update"),
+    name: z20.string().optional().describe("New display name"),
+    description: z20.string().optional().describe("New description"),
+    url: z20.string().optional().describe("New URL endpoint"),
+    auth_type: z20.string().min(1).optional().describe(
       "New authentication type. Current examples are 'none', 'headers' (custom headers), and 'oauth_auto' (OAuth); Portkey may accept additional values."
     ),
-    transport: z15.enum(["http", "sse"]).optional().describe("New transport protocol"),
-    custom_headers: z15.record(z15.string(), z15.string()).optional().describe(
+    transport: z20.enum(["http", "sse"]).optional().describe("New transport protocol"),
+    custom_headers: z20.record(z20.string(), z20.string()).optional().describe(
       "New custom headers for authentication. Sent via configurations.custom_headers"
     ),
     configurations: mcpConfigurationsSchema.optional().describe(
@@ -5658,50 +6133,50 @@ var MCP_INTEGRATIONS_TOOL_SCHEMAS = {
     )
   },
   deleteMcpIntegration: {
-    id: z15.string().describe("The MCP integration ID or slug to delete")
+    id: z20.string().describe("The MCP integration ID or slug to delete")
   },
   getMcpIntegrationMetadata: {
-    id: z15.string().describe("The MCP integration ID or slug")
+    id: z20.string().describe("The MCP integration ID or slug")
   },
   listMcpIntegrationCapabilities: {
-    id: z15.string().describe("The MCP integration ID or slug")
+    id: z20.string().describe("The MCP integration ID or slug")
   },
   updateMcpIntegrationCapabilities: {
-    id: z15.string().describe("The MCP integration ID or slug"),
-    capabilities: z15.array(
-      z15.object({
-        name: z15.string().describe("Capability name"),
-        type: z15.enum(["tool", "prompt", "resource"]).describe("Capability type"),
-        enabled: z15.boolean().describe("Whether to enable the capability")
+    id: z20.string().describe("The MCP integration ID or slug"),
+    capabilities: z20.array(
+      z20.object({
+        name: z20.string().describe("Capability name"),
+        type: z20.enum(["tool", "prompt", "resource"]).describe("Capability type"),
+        enabled: z20.boolean().describe("Whether to enable the capability")
       })
     ).min(1).describe("Array of capability updates")
   },
   listMcpIntegrationWorkspaces: {
-    id: z15.string().describe("The MCP integration ID or slug")
+    id: z20.string().describe("The MCP integration ID or slug")
   },
   updateMcpIntegrationWorkspaces: {
-    id: z15.string().describe("The MCP integration ID or slug"),
-    workspaces: z15.array(
-      z15.object({
-        id: z15.string().describe("Workspace ID"),
-        enabled: z15.boolean().describe("Whether workspace has access")
+    id: z20.string().describe("The MCP integration ID or slug"),
+    workspaces: z20.array(
+      z20.object({
+        id: z20.string().describe("Workspace ID"),
+        enabled: z20.boolean().describe("Whether workspace has access")
       })
     ).min(1).describe("Array of workspace access updates")
   }
 };
-var createMcpIntegrationSchema = z15.object(MCP_INTEGRATIONS_TOOL_SCHEMAS.createMcpIntegration).superRefine((value, ctx) => {
+var createMcpIntegrationSchema = z20.object(MCP_INTEGRATIONS_TOOL_SCHEMAS.createMcpIntegration).superRefine((value, ctx) => {
   const configuredHeaders = value.configurations?.custom_headers;
   if (value.auth_type === "headers" && (!value.custom_headers || Object.keys(value.custom_headers).length === 0) && (!isStringRecord(configuredHeaders) || Object.keys(configuredHeaders).length === 0) && !value.secret_mappings?.some(
     (mapping) => mapping.target_field === "configurations.custom_headers"
   )) {
     ctx.addIssue({
-      code: z15.ZodIssueCode.custom,
+      code: z20.ZodIssueCode.custom,
       path: [],
       message: "custom_headers, configurations.custom_headers, or secret_mappings targeting configurations.custom_headers must be provided when auth_type is 'headers'"
     });
   }
 });
-var updateMcpIntegrationSchema = z15.object(
+var updateMcpIntegrationSchema = z20.object(
   MCP_INTEGRATIONS_TOOL_SCHEMAS.updateMcpIntegration
 );
 function isRecord2(value) {
@@ -5942,68 +6417,68 @@ function registerMcpIntegrationsTools(server, service) {
 }
 
 // src/tools/mcp-servers.tools.ts
-import { z as z16 } from "zod";
+import { z as z21 } from "zod";
 var MCP_SERVERS_TOOL_SCHEMAS = {
   listMcpServers: {
     current_page: CurrentPageSchema,
     page_size: PageSizeSchema.describe("Number of results per page (max 100)"),
-    workspace_id: z16.string().optional().describe("Filter by workspace ID")
+    workspace_id: z21.string().optional().describe("Filter by workspace ID")
   },
   createMcpServer: {
-    name: z16.string().describe("Display name for the MCP server"),
-    mcp_integration_id: z16.string().describe("ID or slug of the MCP integration this server belongs to"),
-    slug: z16.string().optional().describe("Custom slug. Auto-generated if omitted"),
-    description: z16.string().optional().describe("Description of the MCP server")
+    name: z21.string().describe("Display name for the MCP server"),
+    mcp_integration_id: z21.string().describe("ID or slug of the MCP integration this server belongs to"),
+    slug: z21.string().optional().describe("Custom slug. Auto-generated if omitted"),
+    description: z21.string().optional().describe("Description of the MCP server")
   },
   getMcpServer: {
-    id: z16.string().describe("The MCP server ID or slug to retrieve")
+    id: z21.string().describe("The MCP server ID or slug to retrieve")
   },
   updateMcpServer: {
-    id: z16.string().describe("The MCP server ID or slug to update"),
-    name: z16.string().optional().describe("New display name"),
-    description: z16.string().optional().describe("New description")
+    id: z21.string().describe("The MCP server ID or slug to update"),
+    name: z21.string().optional().describe("New display name"),
+    description: z21.string().optional().describe("New description")
   },
   deleteMcpServer: {
-    id: z16.string().describe("The MCP server ID or slug to delete")
+    id: z21.string().describe("The MCP server ID or slug to delete")
   },
   testMcpServer: {
-    id: z16.string().describe("The MCP server ID or slug to test")
+    id: z21.string().describe("The MCP server ID or slug to test")
   },
   listMcpServerCapabilities: {
-    id: z16.string().describe("The MCP server ID or slug"),
+    id: z21.string().describe("The MCP server ID or slug"),
     current_page: CurrentPageSchema,
     page_size: PageSizeSchema.describe("Number of results per page (max 100)")
   },
   updateMcpServerCapabilities: {
-    id: z16.string().describe("The MCP server ID or slug"),
-    capabilities: z16.array(
-      z16.object({
-        name: z16.string().describe("Capability name"),
-        type: z16.enum(["tool", "prompt", "resource"]).describe("Capability type"),
-        enabled: z16.boolean().describe("Whether to enable the capability")
+    id: z21.string().describe("The MCP server ID or slug"),
+    capabilities: z21.array(
+      z21.object({
+        name: z21.string().describe("Capability name"),
+        type: z21.enum(["tool", "prompt", "resource"]).describe("Capability type"),
+        enabled: z21.boolean().describe("Whether to enable the capability")
       })
     ).min(1).describe("Array of capability updates")
   },
   listMcpServerUserAccess: {
-    id: z16.string().describe("The MCP server ID or slug"),
+    id: z21.string().describe("The MCP server ID or slug"),
     current_page: CurrentPageSchema,
     page_size: PageSizeSchema.describe("Number of results per page (max 100)")
   },
   updateMcpServerUserAccess: {
-    id: z16.string().describe("The MCP server ID or slug"),
-    users: z16.array(
-      z16.object({
-        user_id: z16.string().describe("User ID"),
-        enabled: z16.boolean().describe("Whether user has access")
+    id: z21.string().describe("The MCP server ID or slug"),
+    users: z21.array(
+      z21.object({
+        user_id: z21.string().describe("User ID"),
+        enabled: z21.boolean().describe("Whether user has access")
       })
     ).min(1).describe("Array of user access updates")
   },
   listMcpServerConnections: {
-    id: z16.string().describe("MCP server ID or slug whose connections to list"),
-    user_id: z16.string().uuid().optional().describe(
+    id: z21.string().describe("MCP server ID or slug whose connections to list"),
+    user_id: z21.string().uuid().optional().describe(
       "User UUID to filter; user-scoped keys default to their own user when omitted"
     ),
-    workspace_id: z16.string().optional().describe(
+    workspace_id: z21.string().optional().describe(
       "Workspace ID or slug; required with an organisation admin API key"
     ),
     current_page: CurrentPageSchema.describe(
@@ -6014,11 +6489,11 @@ var MCP_SERVERS_TOOL_SCHEMAS = {
     )
   },
   disconnectMcpServerConnection: {
-    id: z16.string().describe("MCP server ID or slug containing the active connection"),
-    user_id: z16.string().uuid().optional().describe(
+    id: z21.string().describe("MCP server ID or slug containing the active connection"),
+    user_id: z21.string().uuid().optional().describe(
       "User UUID to disconnect; required with service keys and derived from user keys when omitted"
     ),
-    workspace_id: z16.string().optional().describe(
+    workspace_id: z21.string().optional().describe(
       "Workspace ID or slug; required with an organisation admin API key"
     )
   }
@@ -6245,40 +6720,40 @@ function registerMcpServersTools(server, service) {
 }
 
 // src/tools/partials.tools.ts
-import { z as z17 } from "zod";
+import { z as z22 } from "zod";
 var PARTIALS_TOOL_SCHEMAS = {
   createPromptPartial: {
-    name: z17.string().describe("Display name for the partial"),
-    string: z17.string().describe("The partial content/template string"),
-    workspace_id: z17.string().optional().describe(
+    name: z22.string().describe("Display name for the partial"),
+    string: z22.string().describe("The partial content/template string"),
+    workspace_id: z22.string().optional().describe(
       "Workspace ID to create partial in (required for org-level API keys)"
     ),
-    version_description: z17.string().optional().describe("Description for this version")
+    version_description: z22.string().optional().describe("Description for this version")
   },
   listPromptPartials: {
-    collection_id: z17.string().optional().describe(
+    collection_id: z22.string().optional().describe(
       "Filter by collection ID. Optional \u2014 omit to list all partials across collections"
     )
   },
   getPromptPartial: {
-    prompt_partial_id: z17.string().describe("Prompt partial ID or slug to retrieve")
+    prompt_partial_id: z22.string().describe("Prompt partial ID or slug to retrieve")
   },
   updatePromptPartial: {
-    prompt_partial_id: z17.string().describe("Prompt partial ID or slug to update"),
-    name: z17.string().optional().describe("New display name for the partial"),
-    string: z17.string().optional().describe("New content for the partial"),
-    description: z17.string().optional().describe("Description for this version"),
-    status: z17.enum(["active", "archived"]).optional().describe("New status for the partial")
+    prompt_partial_id: z22.string().describe("Prompt partial ID or slug to update"),
+    name: z22.string().optional().describe("New display name for the partial"),
+    string: z22.string().optional().describe("New content for the partial"),
+    description: z22.string().optional().describe("Description for this version"),
+    status: z22.enum(["active", "archived"]).optional().describe("New status for the partial")
   },
   deletePromptPartial: {
-    prompt_partial_id: z17.string().describe("Prompt partial ID or slug to delete")
+    prompt_partial_id: z22.string().describe("Prompt partial ID or slug to delete")
   },
   listPartialVersions: {
-    prompt_partial_id: z17.string().describe("Prompt partial ID or slug to list versions for")
+    prompt_partial_id: z22.string().describe("Prompt partial ID or slug to list versions for")
   },
   publishPartial: {
-    prompt_partial_id: z17.string().describe("Prompt partial ID or slug"),
-    version: z17.coerce.number().positive().describe("Version number to publish as default")
+    prompt_partial_id: z22.string().describe("Prompt partial ID or slug"),
+    version: z22.coerce.number().positive().describe("Version number to publish as default")
   }
 };
 function registerPartialsTools(server, service) {
@@ -6415,101 +6890,101 @@ function registerPartialsTools(server, service) {
 }
 
 // src/tools/prompts.tools.ts
-import { z as z18 } from "zod";
-var PROMPT_VARIABLES_SCHEMA = z18.record(z18.string(), z18.union([z18.string(), z18.number(), z18.boolean()])).describe("Variable values to substitute into the template");
-var PROMPT_TEMPLATE_CONTENT_BLOCK_SCHEMA = z18.object({
-  type: z18.string().describe("Content block type"),
-  text: z18.string().optional().describe("Text content for text-based blocks")
+import { z as z23 } from "zod";
+var PROMPT_VARIABLES_SCHEMA = z23.record(z23.string(), z23.union([z23.string(), z23.number(), z23.boolean()])).describe("Variable values to substitute into the template");
+var PROMPT_TEMPLATE_CONTENT_BLOCK_SCHEMA = z23.object({
+  type: z23.string().describe("Content block type"),
+  text: z23.string().optional().describe("Text content for text-based blocks")
 }).passthrough().describe("Content block within a structured chat message");
-var PROMPT_TEMPLATE_MESSAGE_SCHEMA = z18.object({
-  role: z18.enum(["system", "user", "assistant"]).describe("Message role in the chat template"),
-  content: z18.array(PROMPT_TEMPLATE_CONTENT_BLOCK_SCHEMA).describe("Message content blocks")
+var PROMPT_TEMPLATE_MESSAGE_SCHEMA = z23.object({
+  role: z23.enum(["system", "user", "assistant"]).describe("Message role in the chat template"),
+  content: z23.array(PROMPT_TEMPLATE_CONTENT_BLOCK_SCHEMA).describe("Message content blocks")
 }).passthrough().describe("Structured chat message in a prompt template");
 var PROMPTS_TOOL_SCHEMAS = {
   createPrompt: {
-    name: z18.string().describe("Display name for the prompt"),
-    collection_id: z18.string().describe(
+    name: z23.string().describe("Display name for the prompt"),
+    collection_id: z23.string().describe(
       "Collection ID to organize the prompt in (use list_collections to find)"
     ),
-    string: z18.string().optional().describe(
+    string: z23.string().optional().describe(
       "Legacy prompt template string. Use plain text for single-message prompts, or a JSON-encoded messages array string for multi-message chat prompts."
     ),
-    messages: z18.array(PROMPT_TEMPLATE_MESSAGE_SCHEMA).optional().describe(
+    messages: z23.array(PROMPT_TEMPLATE_MESSAGE_SCHEMA).optional().describe(
       "Structured chat template alias. Serialized to the legacy string format before creation."
     ),
-    parameters: z18.record(z18.string(), z18.unknown()).describe("Default values for template variables"),
-    virtual_key: z18.string().describe("Virtual key slug for model access"),
-    model: z18.string().optional().describe(
+    parameters: z23.record(z23.string(), z23.unknown()).describe("Default values for template variables"),
+    virtual_key: z23.string().describe("Virtual key slug for model access"),
+    model: z23.string().optional().describe(
       "Model identifier (e.g., 'gpt-4', 'claude-3-opus'). Required unless ai_model_id or finetune_id is provided"
     ),
-    ai_model_id: z18.string().optional().describe(
+    ai_model_id: z23.string().optional().describe(
       "AI model ID (alternative to model). Required unless model or finetune_id is provided"
     ),
-    finetune_id: z18.string().optional().describe(
+    finetune_id: z23.string().optional().describe(
       "Fine-tune ID (alternative to model). Required unless model or ai_model_id is provided"
     ),
-    version_description: z18.string().optional().describe("Description for this prompt version"),
-    template_metadata: z18.record(z18.string(), z18.unknown()).optional().describe("Custom metadata (app, env, source_file, etc.)"),
-    functions: z18.array(PromptFunctionSchema).optional().describe("Function definitions for function calling"),
-    tools: z18.array(PromptToolSchema).optional().describe("Tool definitions for tool use"),
+    version_description: z23.string().optional().describe("Description for this prompt version"),
+    template_metadata: z23.record(z23.string(), z23.unknown()).optional().describe("Custom metadata (app, env, source_file, etc.)"),
+    functions: z23.array(PromptFunctionSchema).optional().describe("Function definitions for function calling"),
+    tools: z23.array(PromptToolSchema).optional().describe("Tool definitions for tool use"),
     tool_choice: ToolChoiceSchema.optional().describe("Tool choice strategy"),
-    is_raw_template: z18.boolean().optional().describe("Render the stored template as a raw structural template"),
-    dry_run: z18.boolean().optional().describe("When true, validate without creating")
+    is_raw_template: z23.boolean().optional().describe("Render the stored template as a raw structural template"),
+    dry_run: z23.boolean().optional().describe("When true, validate without creating")
   },
   listPrompts: {
-    collection_id: z18.string().optional().describe(
+    collection_id: z23.string().optional().describe(
       "Filter by collection ID (recommended for app-specific prompts)"
     ),
-    workspace_id: z18.string().optional().describe("Filter by workspace ID"),
-    search: z18.string().optional().describe("Search prompts by name"),
+    workspace_id: z23.string().optional().describe("Filter by workspace ID"),
+    search: z23.string().optional().describe("Search prompts by name"),
     current_page: CurrentPageSchema,
     page_size: PageSizeSchema
   },
   getPrompt: {
-    prompt_id: z18.string().describe("Prompt ID or slug to retrieve")
+    prompt_id: z23.string().describe("Prompt ID or slug to retrieve")
   },
   updatePrompt: {
-    prompt_id: z18.string().describe("Prompt ID or slug to update"),
-    name: z18.string().optional().describe("New display name for the prompt"),
-    collection_id: z18.string().optional().describe("Move to a different collection"),
-    string: z18.string().optional().describe(
+    prompt_id: z23.string().describe("Prompt ID or slug to update"),
+    name: z23.string().optional().describe("New display name for the prompt"),
+    collection_id: z23.string().optional().describe("Move to a different collection"),
+    string: z23.string().optional().describe(
       "Legacy prompt template string. Use plain text for single-message prompts, or a JSON-encoded messages array string for multi-message chat prompts."
     ),
-    messages: z18.array(PROMPT_TEMPLATE_MESSAGE_SCHEMA).optional().describe(
+    messages: z23.array(PROMPT_TEMPLATE_MESSAGE_SCHEMA).optional().describe(
       "Structured chat template alias for updates. Serialized to the legacy string format before the prompt is updated."
     ),
-    parameters: z18.record(z18.string(), z18.unknown()).optional().describe("New default values for template variables"),
-    model: z18.string().optional().describe("New model identifier"),
-    virtual_key: z18.string().optional().describe("New virtual key slug"),
-    version_description: z18.string().optional().describe("Description for this version"),
-    template_metadata: z18.record(z18.string(), z18.unknown()).optional().describe("New metadata"),
-    functions: z18.array(PromptFunctionSchema).optional().describe("New function definitions"),
-    tools: z18.array(PromptToolSchema).optional().describe("New tool definitions"),
+    parameters: z23.record(z23.string(), z23.unknown()).optional().describe("New default values for template variables"),
+    model: z23.string().optional().describe("New model identifier"),
+    virtual_key: z23.string().optional().describe("New virtual key slug"),
+    version_description: z23.string().optional().describe("Description for this version"),
+    template_metadata: z23.record(z23.string(), z23.unknown()).optional().describe("New metadata"),
+    functions: z23.array(PromptFunctionSchema).optional().describe("New function definitions"),
+    tools: z23.array(PromptToolSchema).optional().describe("New tool definitions"),
     tool_choice: ToolChoiceSchema.optional().describe(
       "New tool choice strategy"
     ),
-    is_raw_template: z18.boolean().optional().describe("Enable or disable raw structural-template rendering"),
-    dry_run: z18.boolean().optional().describe("When true, validate without updating")
+    is_raw_template: z23.boolean().optional().describe("Enable or disable raw structural-template rendering"),
+    dry_run: z23.boolean().optional().describe("When true, validate without updating")
   },
   deletePrompt: {
-    prompt_id: z18.string().describe("Prompt ID or slug to delete")
+    prompt_id: z23.string().describe("Prompt ID or slug to delete")
   },
   publishPrompt: {
-    prompt_id: z18.string().describe("Prompt ID or slug to publish"),
-    version: z18.coerce.number().positive().describe("Version number to publish as the default")
+    prompt_id: z23.string().describe("Prompt ID or slug to publish"),
+    version: z23.coerce.number().positive().describe("Version number to publish as the default")
   },
   listPromptVersions: {
-    prompt_id: z18.string().describe("Prompt ID or slug to list versions for")
+    prompt_id: z23.string().describe("Prompt ID or slug to list versions for")
   },
   renderPrompt: {
-    prompt_id: z18.string().describe("Prompt ID or slug to render"),
+    prompt_id: z23.string().describe("Prompt ID or slug to render"),
     variables: PROMPT_VARIABLES_SCHEMA,
     hyperparameters: HyperparametersSchema.optional().describe(
       "Override default hyperparameters"
     )
   },
   runPromptCompletion: {
-    prompt_id: z18.string().describe("Prompt ID or slug to execute"),
+    prompt_id: z23.string().describe("Prompt ID or slug to execute"),
     variables: PROMPT_VARIABLES_SCHEMA,
     metadata: BillingMetadataSchema.describe(
       "Billing metadata - client_id, app, env are REQUIRED for cost attribution"
@@ -6519,77 +6994,77 @@ var PROMPTS_TOOL_SCHEMAS = {
     )
   },
   migratePrompt: {
-    name: z18.string().describe("Prompt name to create or find for update"),
+    name: z23.string().describe("Prompt name to create or find for update"),
     app: PromptAppIdentifierSchema,
     env: PromptEnvironmentIdentifierSchema,
-    collection_id: z18.string().describe("Collection ID to search in and create under"),
-    string: z18.string().optional().describe(
+    collection_id: z23.string().describe("Collection ID to search in and create under"),
+    string: z23.string().optional().describe(
       "Legacy prompt template string with {{variable}} mustache syntax."
     ),
-    messages: z18.array(PROMPT_TEMPLATE_MESSAGE_SCHEMA).optional().describe(
+    messages: z23.array(PROMPT_TEMPLATE_MESSAGE_SCHEMA).optional().describe(
       "Structured chat template alias for migrations. Serialized to the legacy string format before the prompt is created or updated."
     ),
-    parameters: z18.record(z18.string(), z18.unknown()).describe("Default values for template variables"),
-    virtual_key: z18.string().describe("Virtual key slug for model access"),
-    model: z18.string().optional().describe("Model identifier"),
-    version_description: z18.string().optional().describe("Description for this version"),
-    template_metadata: z18.record(z18.string(), z18.unknown()).optional().describe("Additional custom metadata"),
-    functions: z18.array(PromptFunctionSchema).optional().describe("Function definitions"),
-    tools: z18.array(PromptToolSchema).optional().describe("Tool definitions"),
+    parameters: z23.record(z23.string(), z23.unknown()).describe("Default values for template variables"),
+    virtual_key: z23.string().describe("Virtual key slug for model access"),
+    model: z23.string().optional().describe("Model identifier"),
+    version_description: z23.string().optional().describe("Description for this version"),
+    template_metadata: z23.record(z23.string(), z23.unknown()).optional().describe("Additional custom metadata"),
+    functions: z23.array(PromptFunctionSchema).optional().describe("Function definitions"),
+    tools: z23.array(PromptToolSchema).optional().describe("Tool definitions"),
     tool_choice: ToolChoiceSchema.optional().describe("Tool choice strategy"),
-    is_raw_template: z18.boolean().optional().describe("Preserve raw structural-template rendering semantics"),
-    dry_run: z18.boolean().optional().describe(
+    is_raw_template: z23.boolean().optional().describe("Preserve raw structural-template rendering semantics"),
+    dry_run: z23.boolean().optional().describe(
       "When true, only check what action would be taken without making changes"
     )
   },
   promotePrompt: {
-    source_prompt_id: z18.string().describe("Source prompt ID or slug (e.g., staging prompt)"),
-    target_collection_id: z18.string().describe("Target collection ID for the promoted prompt"),
-    target_name: z18.string().optional().describe(
+    source_prompt_id: z23.string().describe("Source prompt ID or slug (e.g., staging prompt)"),
+    target_collection_id: z23.string().describe("Target collection ID for the promoted prompt"),
+    target_name: z23.string().optional().describe(
       "Target prompt name (defaults to source name with env suffix replaced)"
     ),
     target_env: PromptEnvironmentIdentifierSchema,
-    virtual_key: z18.string().optional().describe(
+    virtual_key: z23.string().optional().describe(
       "Virtual key ID to use (defaults to source prompt's virtual_key)"
     )
   },
   validateCompletionMetadata: {
-    client_id: z18.string().optional().describe("Client ID for billing attribution"),
+    client_id: z23.string().optional().describe("Client ID for billing attribution"),
     app: PromptAppIdentifierSchema.optional(),
     env: PromptEnvironmentIdentifierSchema.optional(),
-    project_id: z18.string().optional().describe("Project ID for granular billing"),
-    feature: z18.string().optional().describe("Feature name for tracking")
+    project_id: z23.string().optional().describe("Project ID for granular billing"),
+    feature: z23.string().optional().describe("Feature name for tracking")
   },
   getPromptVersion: {
-    prompt_id: z18.string().describe("Prompt ID or slug"),
-    version_id: z18.string().describe("Version UUID to retrieve")
+    prompt_id: z23.string().describe("Prompt ID or slug"),
+    version_id: z23.string().describe("Version UUID to retrieve")
   },
   updatePromptVersion: {
-    prompt_id: z18.string().describe("Prompt ID or slug"),
-    version_id: z18.string().describe("Version UUID to update"),
-    label_id: z18.string().nullable().describe(
+    prompt_id: z23.string().describe("Prompt ID or slug"),
+    version_id: z23.string().describe("Version UUID to update"),
+    label_id: z23.string().nullable().describe(
       "Label ID to assign to this version, or null to remove the label"
     )
   }
 };
-var createPromptSchema = z18.object(PROMPTS_TOOL_SCHEMAS.createPrompt).superRefine((value, ctx) => {
+var createPromptSchema = z23.object(PROMPTS_TOOL_SCHEMAS.createPrompt).superRefine((value, ctx) => {
   if (!value.model && !value.ai_model_id && !value.finetune_id) {
     ctx.addIssue({
-      code: z18.ZodIssueCode.custom,
+      code: z23.ZodIssueCode.custom,
       message: "At least one of model, ai_model_id, or finetune_id must be provided"
     });
   }
   if (value.string === void 0 && value.messages === void 0) {
     ctx.addIssue({
-      code: z18.ZodIssueCode.custom,
+      code: z23.ZodIssueCode.custom,
       message: "Provide either string or messages"
     });
   }
 });
-var migratePromptSchema = z18.object(PROMPTS_TOOL_SCHEMAS.migratePrompt).superRefine((value, ctx) => {
+var migratePromptSchema = z23.object(PROMPTS_TOOL_SCHEMAS.migratePrompt).superRefine((value, ctx) => {
   if (value.string === void 0 && value.messages === void 0) {
     ctx.addIssue({
-      code: z18.ZodIssueCode.custom,
+      code: z23.ZodIssueCode.custom,
       message: "Provide either string or messages"
     });
   }
@@ -7042,70 +7517,70 @@ function registerPromptsTools(server, service) {
 }
 
 // src/tools/providers.tools.ts
-import { z as z19 } from "zod";
+import { z as z24 } from "zod";
 var PROVIDERS_TOOL_SCHEMAS = {
   listProviders: {
     current_page: CurrentPageSchema,
     page_size: PageSizeSchema.describe(
       "Number of results per page (max 100, default 50)"
     ),
-    workspace_id: z19.string().optional().describe(
+    workspace_id: z24.string().optional().describe(
       "Workspace ID - required when using organization admin keys, optional with workspace API keys"
     )
   },
   createProvider: {
-    name: z19.string().describe("Display name for the provider"),
-    integration_id: z19.string().describe(
+    name: z24.string().describe("Display name for the provider"),
+    integration_id: z24.string().describe(
       "Integration slug for the provider (e.g., 'openai', 'anthropic', 'azure-openai')"
     ),
-    workspace_id: z19.string().optional().describe(
+    workspace_id: z24.string().optional().describe(
       "Workspace ID - required when using organization admin API keys"
     ),
-    slug: z19.string().optional().describe(
+    slug: z24.string().optional().describe(
       "Custom slug for the provider. Auto-generated with random suffix if omitted"
     ),
-    note: z19.string().optional().describe("Optional note or description for the provider"),
-    credit_limit: z19.coerce.number().positive().optional().describe("Credit limit for usage"),
-    alert_threshold: z19.coerce.number().min(0).max(100).optional().describe("Alert threshold percentage (0-100)"),
-    usage_limit_type: z19.enum(["cost", "tokens"]).optional().describe(
+    note: z24.string().optional().describe("Optional note or description for the provider"),
+    credit_limit: z24.coerce.number().positive().optional().describe("Credit limit for usage"),
+    alert_threshold: z24.coerce.number().min(0).max(100).optional().describe("Alert threshold percentage (0-100)"),
+    usage_limit_type: z24.enum(["cost", "tokens"]).optional().describe(
       "Type of usage limit: 'cost' (monetary) or 'tokens' (token count). Defaults to 'cost'."
     ),
-    periodic_reset: z19.enum(["monthly", "weekly"]).optional().describe(
+    periodic_reset: z24.enum(["monthly", "weekly"]).optional().describe(
       "Period for resetting usage limits: 'monthly' or 'weekly'. Defaults to 'monthly'."
     ),
-    rate_limit_value: z19.coerce.number().positive().optional().describe("Must be provided together with rate_limit_unit."),
-    rate_limit_unit: z19.enum(["rpm", "rph", "rpd"]).optional().describe(
+    rate_limit_value: z24.coerce.number().positive().optional().describe("Must be provided together with rate_limit_unit."),
+    rate_limit_unit: z24.enum(["rpm", "rph", "rpd"]).optional().describe(
       "Must be provided together with rate_limit_value. Values: 'rpm' (requests/min), 'rph' (requests/hour), or 'rpd' (requests/day)."
     ),
-    expires_at: z19.string().optional().describe("Expiration date in ISO 8601 format")
+    expires_at: z24.string().optional().describe("Expiration date in ISO 8601 format")
   },
   getProvider: {
-    slug: z19.string().describe("The unique slug identifier of the provider to retrieve"),
-    workspace_id: z19.string().optional().describe("Workspace ID - required when using organization admin keys")
+    slug: z24.string().describe("The unique slug identifier of the provider to retrieve"),
+    workspace_id: z24.string().optional().describe("Workspace ID - required when using organization admin keys")
   },
   updateProvider: {
-    slug: z19.string().describe("The slug of the provider to update"),
-    workspace_id: z19.string().optional().describe("Workspace ID - required when using organization admin keys"),
-    name: z19.string().optional().describe("New display name for the provider"),
-    note: z19.string().optional().describe("New note or description for the provider"),
-    credit_limit: z19.coerce.number().positive().optional().describe("New credit limit for usage"),
-    alert_threshold: z19.coerce.number().min(0).max(100).optional().describe("New alert threshold percentage (0-100)"),
-    usage_limit_type: z19.enum(["cost", "tokens"]).optional().describe(
+    slug: z24.string().describe("The slug of the provider to update"),
+    workspace_id: z24.string().optional().describe("Workspace ID - required when using organization admin keys"),
+    name: z24.string().optional().describe("New display name for the provider"),
+    note: z24.string().optional().describe("New note or description for the provider"),
+    credit_limit: z24.coerce.number().positive().optional().describe("New credit limit for usage"),
+    alert_threshold: z24.coerce.number().min(0).max(100).optional().describe("New alert threshold percentage (0-100)"),
+    usage_limit_type: z24.enum(["cost", "tokens"]).optional().describe(
       "Type of usage limit: 'cost' (monetary) or 'tokens' (token count). Defaults to 'cost'."
     ),
-    periodic_reset: z19.enum(["monthly", "weekly"]).optional().describe(
+    periodic_reset: z24.enum(["monthly", "weekly"]).optional().describe(
       "Period for resetting usage limits: 'monthly' or 'weekly'. Defaults to 'monthly'."
     ),
-    rate_limit_value: z19.coerce.number().positive().optional().describe("New rate limit value"),
-    rate_limit_unit: z19.enum(["rpm", "rph", "rpd"]).optional().describe(
+    rate_limit_value: z24.coerce.number().positive().optional().describe("New rate limit value"),
+    rate_limit_unit: z24.enum(["rpm", "rph", "rpd"]).optional().describe(
       "Rate limit unit: 'rpm' (requests per minute), 'rph' (requests per hour), or 'rpd' (requests per day)"
     ),
-    expires_at: z19.string().optional().describe("New expiration date in ISO 8601 format"),
-    reset_usage: z19.boolean().optional().describe("Set to true to reset accumulated usage metrics")
+    expires_at: z24.string().optional().describe("New expiration date in ISO 8601 format"),
+    reset_usage: z24.boolean().optional().describe("Set to true to reset accumulated usage metrics")
   },
   deleteProvider: {
-    slug: z19.string().describe("The slug of the provider to delete"),
-    workspace_id: z19.string().optional().describe("Workspace ID - required when using organization admin keys")
+    slug: z24.string().describe("The slug of the provider to delete"),
+    workspace_id: z24.string().optional().describe("Workspace ID - required when using organization admin keys")
   }
 };
 function registerProvidersTools(server, service) {
@@ -7252,73 +7727,73 @@ function registerProvidersTools(server, service) {
 }
 
 // src/tools/secret-references.tools.ts
-import { z as z20 } from "zod";
+import { z as z25 } from "zod";
 var authFields = {
-  aws_auth_type: z20.enum(["accessKey", "assumedRole", "serviceRole"]).describe(
+  aws_auth_type: z25.enum(["accessKey", "assumedRole", "serviceRole"]).describe(
     "AWS authentication mode: accessKey uses a key pair, assumedRole uses an IAM role, and serviceRole uses the runtime workload identity"
   ),
-  aws_access_key_id: z20.string().min(1).describe("AWS access key ID; required when aws_auth_type is accessKey"),
-  aws_secret_access_key: z20.string().min(1).describe(
+  aws_access_key_id: z25.string().min(1).describe("AWS access key ID; required when aws_auth_type is accessKey"),
+  aws_secret_access_key: z25.string().min(1).describe(
     "AWS secret access key; required when aws_auth_type is accessKey and exposed to the MCP transcript"
   ),
-  aws_region: z20.string().min(1).describe("AWS region containing the secret, for example us-east-1"),
-  aws_role_arn: z20.string().min(1).describe(
+  aws_region: z25.string().min(1).describe("AWS region containing the secret, for example us-east-1"),
+  aws_role_arn: z25.string().min(1).describe(
     "IAM role ARN to assume; required when aws_auth_type is assumedRole"
   ),
-  aws_external_id: z20.string().nullable().describe("Optional external ID required by the target IAM role"),
-  azure_auth_mode: z20.enum(["entra", "managed", "default"]).describe(
+  aws_external_id: z25.string().nullable().describe("Optional external ID required by the target IAM role"),
+  azure_auth_mode: z25.enum(["entra", "managed", "default"]).describe(
     "Azure authentication mode: entra uses a client secret, managed uses managed identity, and default uses the runtime credential chain"
   ),
-  azure_entra_tenant_id: z20.string().min(1).describe("Microsoft Entra tenant ID; required for entra authentication"),
-  azure_entra_client_id: z20.string().min(1).describe(
+  azure_entra_tenant_id: z25.string().min(1).describe("Microsoft Entra tenant ID; required for entra authentication"),
+  azure_entra_client_id: z25.string().min(1).describe(
     "Microsoft Entra application client ID; required for entra authentication"
   ),
-  azure_entra_client_secret: z20.string().min(1).describe(
+  azure_entra_client_secret: z25.string().min(1).describe(
     "Microsoft Entra client secret; required for entra authentication and exposed to the MCP transcript"
   ),
-  azure_managed_client_id: z20.string().min(1).describe(
+  azure_managed_client_id: z25.string().min(1).describe(
     "Optional client ID of a user-assigned managed identity; omit for the system-assigned identity"
   ),
-  azure_vault_url: z20.url().describe(
+  azure_vault_url: z25.url().describe(
     "Azure Key Vault URL, for example https://example.vault.azure.net"
   ),
-  vault_auth_type: z20.enum(["token", "approle", "kubernetes"]).describe(
+  vault_auth_type: z25.enum(["token", "approle", "kubernetes"]).describe(
     "HashiCorp Vault authentication mode: token, AppRole, or Kubernetes"
   ),
-  vault_addr: z20.url().describe("Base URL of the HashiCorp Vault server"),
-  vault_token: z20.string().min(1).describe(
+  vault_addr: z25.url().describe("Base URL of the HashiCorp Vault server"),
+  vault_token: z25.string().min(1).describe(
     "HashiCorp Vault token; required for token authentication and exposed to the MCP transcript"
   ),
-  vault_namespace: z20.string().min(1).describe("Optional HashiCorp Vault Enterprise namespace"),
-  vault_role_id: z20.string().min(1).describe(
+  vault_namespace: z25.string().min(1).describe("Optional HashiCorp Vault Enterprise namespace"),
+  vault_role_id: z25.string().min(1).describe(
     "HashiCorp Vault AppRole role ID; required for approle authentication"
   ),
-  vault_secret_id: z20.string().min(1).describe(
+  vault_secret_id: z25.string().min(1).describe(
     "HashiCorp Vault AppRole secret ID; required for approle authentication and exposed to the MCP transcript"
   ),
-  vault_role: z20.string().min(1).describe("HashiCorp Vault Kubernetes auth role name")
+  vault_role: z25.string().min(1).describe("HashiCorp Vault Kubernetes auth role name")
 };
-var authConfigSchema = z20.union([
-  z20.object({
-    aws_auth_type: z20.literal("accessKey").describe("Use an AWS access key ID and secret access key"),
+var authConfigSchema = z25.union([
+  z25.object({
+    aws_auth_type: z25.literal("accessKey").describe("Use an AWS access key ID and secret access key"),
     aws_access_key_id: authFields.aws_access_key_id,
     aws_secret_access_key: authFields.aws_secret_access_key,
     aws_region: authFields.aws_region
   }).strict(),
-  z20.object({
-    aws_auth_type: z20.literal("assumedRole").describe("Assume the specified AWS IAM role"),
+  z25.object({
+    aws_auth_type: z25.literal("assumedRole").describe("Assume the specified AWS IAM role"),
     aws_role_arn: authFields.aws_role_arn,
     aws_external_id: authFields.aws_external_id.optional(),
     aws_region: authFields.aws_region
   }).strict(),
-  z20.object({
-    aws_auth_type: z20.literal("serviceRole").describe("Use the AWS workload or service role available at runtime"),
-    aws_region: z20.string().optional().describe(
+  z25.object({
+    aws_auth_type: z25.literal("serviceRole").describe("Use the AWS workload or service role available at runtime"),
+    aws_region: z25.string().optional().describe(
       "Optional AWS region containing the secret, for example us-east-1"
     )
   }).strict(),
-  z20.object({
-    azure_auth_mode: z20.literal("entra").describe(
+  z25.object({
+    azure_auth_mode: z25.literal("entra").describe(
       "Authenticate with a Microsoft Entra application client secret"
     ),
     azure_entra_tenant_id: authFields.azure_entra_tenant_id,
@@ -7326,30 +7801,30 @@ var authConfigSchema = z20.union([
     azure_entra_client_secret: authFields.azure_entra_client_secret,
     azure_vault_url: authFields.azure_vault_url
   }).strict(),
-  z20.object({
-    azure_auth_mode: z20.literal("managed").describe("Authenticate with an Azure managed identity"),
+  z25.object({
+    azure_auth_mode: z25.literal("managed").describe("Authenticate with an Azure managed identity"),
     azure_managed_client_id: authFields.azure_managed_client_id.optional(),
     azure_vault_url: authFields.azure_vault_url
   }).strict(),
-  z20.object({
-    azure_auth_mode: z20.literal("default").describe("Use Azure's default runtime credential chain"),
+  z25.object({
+    azure_auth_mode: z25.literal("default").describe("Use Azure's default runtime credential chain"),
     azure_vault_url: authFields.azure_vault_url
   }).strict(),
-  z20.object({
-    vault_auth_type: z20.literal("token").describe("Authenticate to HashiCorp Vault with a token"),
+  z25.object({
+    vault_auth_type: z25.literal("token").describe("Authenticate to HashiCorp Vault with a token"),
     vault_addr: authFields.vault_addr,
     vault_token: authFields.vault_token,
     vault_namespace: authFields.vault_namespace.optional()
   }).strict(),
-  z20.object({
-    vault_auth_type: z20.literal("approle").describe("Authenticate to HashiCorp Vault with AppRole credentials"),
+  z25.object({
+    vault_auth_type: z25.literal("approle").describe("Authenticate to HashiCorp Vault with AppRole credentials"),
     vault_addr: authFields.vault_addr,
     vault_role_id: authFields.vault_role_id,
     vault_secret_id: authFields.vault_secret_id,
     vault_namespace: authFields.vault_namespace.optional()
   }).strict(),
-  z20.object({
-    vault_auth_type: z20.literal("kubernetes").describe(
+  z25.object({
+    vault_auth_type: z25.literal("kubernetes").describe(
       "Authenticate to HashiCorp Vault with a Kubernetes service account"
     ),
     vault_addr: authFields.vault_addr,
@@ -7357,61 +7832,61 @@ var authConfigSchema = z20.union([
     vault_namespace: authFields.vault_namespace.optional()
   }).strict()
 ]);
-var updateAuthConfigSchema = z20.union([
-  z20.object({
+var updateAuthConfigSchema = z25.union([
+  z25.object({
     aws_auth_type: authFields.aws_auth_type.optional(),
     aws_access_key_id: authFields.aws_access_key_id.optional(),
     aws_secret_access_key: authFields.aws_secret_access_key.optional(),
-    aws_region: z20.string().optional().describe("AWS region containing the secret, for example us-east-1"),
+    aws_region: z25.string().optional().describe("AWS region containing the secret, for example us-east-1"),
     aws_role_arn: authFields.aws_role_arn.optional(),
     aws_external_id: authFields.aws_external_id.optional()
   }).strict(),
-  z20.object({
+  z25.object({
     azure_auth_mode: authFields.azure_auth_mode.optional(),
     azure_entra_tenant_id: authFields.azure_entra_tenant_id.optional(),
     azure_entra_client_id: authFields.azure_entra_client_id.optional(),
     azure_entra_client_secret: authFields.azure_entra_client_secret.optional(),
-    azure_managed_client_id: z20.string().optional().describe(
+    azure_managed_client_id: z25.string().optional().describe(
       "Optional client ID of a user-assigned managed identity; omit for the system-assigned identity"
     ),
     azure_vault_url: authFields.azure_vault_url.optional()
   }).strict(),
-  z20.object({
+  z25.object({
     vault_auth_type: authFields.vault_auth_type.optional(),
     vault_addr: authFields.vault_addr.optional(),
     vault_token: authFields.vault_token.optional(),
-    vault_namespace: z20.string().optional().describe("Optional HashiCorp Vault Enterprise namespace"),
+    vault_namespace: z25.string().optional().describe("Optional HashiCorp Vault Enterprise namespace"),
     vault_role_id: authFields.vault_role_id.optional(),
     vault_secret_id: authFields.vault_secret_id.optional(),
     vault_role: authFields.vault_role.optional()
   }).strict()
 ]);
-var managerTypeSchema = z20.enum(["aws_sm", "azure_kv", "hashicorp_vault"]).describe(
+var managerTypeSchema = z25.enum(["aws_sm", "azure_kv", "hashicorp_vault"]).describe(
   "External secret manager: aws_sm for AWS Secrets Manager, azure_kv for Azure Key Vault, or hashicorp_vault for HashiCorp Vault; must match the auth_config field family"
 );
-var tagsSchema = z20.record(z20.string(), z20.string()).describe("Tag filters or metadata as string key-value pairs");
+var tagsSchema = z25.record(z25.string(), z25.string()).describe("Tag filters or metadata as string key-value pairs");
 var SECRET_REFERENCE_TOOL_SCHEMAS = {
   create: {
-    name: z20.string().min(1).max(255).describe("Human-readable name"),
+    name: z25.string().min(1).max(255).describe("Human-readable name"),
     manager_type: managerTypeSchema,
     auth_config: authConfigSchema.describe(
       "Choose exactly one documented authentication shape matching manager_type. Credentials are sent to Portkey and visible in the MCP transcript; prefer workload identity or short-lived credentials when available."
     ),
-    secret_path: z20.string().max(1024).describe("Path of the secret in the external secret manager"),
-    organisation_id: z20.string().uuid().optional().describe(
+    secret_path: z25.string().max(1024).describe("Path of the secret in the external secret manager"),
+    organisation_id: z25.string().uuid().optional().describe(
       "Organisation UUID; required when the MCP server is not authenticated with a Portkey API key"
     ),
-    slug: z20.string().max(255).regex(/^[a-zA-Z0-9_-]+$/).optional().describe(
+    slug: z25.string().max(255).regex(/^[a-zA-Z0-9_-]+$/).optional().describe(
       "Optional stable slug containing only letters, numbers, underscores, or hyphens; Portkey generates one when omitted"
     ),
-    description: z20.string().max(1024).nullable().optional().describe("Optional description; use null to leave it empty"),
-    secret_key: z20.string().max(255).nullable().optional().describe(
+    description: z25.string().max(1024).nullable().optional().describe("Optional description; use null to leave it empty"),
+    secret_key: z25.string().max(255).nullable().optional().describe(
       "Optional key within a structured external secret; null uses the whole secret value"
     ),
-    allow_all_workspaces: z20.boolean().optional().describe(
+    allow_all_workspaces: z25.boolean().optional().describe(
       "Whether every workspace may use this reference; defaults to true and cannot be true with allowed_workspaces"
     ),
-    allowed_workspaces: z20.array(z20.string()).min(1).optional().describe(
+    allowed_workspaces: z25.array(z25.string()).min(1).optional().describe(
       "Workspace UUIDs or slugs allowed to use this reference; omit when allow_all_workspaces is true"
     ),
     tags: tagsSchema.nullable().optional().describe(
@@ -7423,7 +7898,7 @@ var SECRET_REFERENCE_TOOL_SCHEMAS = {
       "Filter by external secret manager: aws_sm, azure_kv, or hashicorp_vault"
     ),
     tags: tagsSchema.optional().describe("Return references matching these tags"),
-    search: z20.string().min(1).max(255).optional().describe("Search references by name"),
+    search: z25.string().min(1).max(255).optional().describe("Search references by name"),
     current_page: CurrentPageSchema.describe(
       "Zero-based page number; defaults to 0"
     ),
@@ -7432,29 +7907,29 @@ var SECRET_REFERENCE_TOOL_SCHEMAS = {
     )
   },
   get: {
-    id: z20.string().min(1).describe("Secret Reference UUID or slug")
+    id: z25.string().min(1).describe("Secret Reference UUID or slug")
   },
   update: {
-    id: z20.string().min(1).describe("Secret Reference UUID or slug"),
-    name: z20.string().min(1).max(255).optional().describe("New human-readable name"),
-    description: z20.string().max(1024).nullable().optional().describe("New description, or null to clear it"),
+    id: z25.string().min(1).describe("Secret Reference UUID or slug"),
+    name: z25.string().min(1).max(255).optional().describe("New human-readable name"),
+    description: z25.string().max(1024).nullable().optional().describe("New description, or null to clear it"),
     auth_config: updateAuthConfigSchema.optional().describe(
       "Provide at least one changed authentication field to merge into the existing configuration; choose one AWS, Azure, or HashiCorp field family and do not mix families"
     ),
-    secret_path: z20.string().max(1024).optional().describe("New path of the secret in the external secret manager"),
-    secret_key: z20.string().max(255).nullable().optional().describe(
+    secret_path: z25.string().max(1024).optional().describe("New path of the secret in the external secret manager"),
+    secret_key: z25.string().max(255).nullable().optional().describe(
       "New key within a structured secret, or null to use the whole value"
     ),
-    allow_all_workspaces: z20.boolean().optional().describe(
+    allow_all_workspaces: z25.boolean().optional().describe(
       "Whether every workspace may use this reference; cannot be true with allowed_workspaces"
     ),
-    allowed_workspaces: z20.array(z20.string()).min(1).optional().describe(
+    allowed_workspaces: z25.array(z25.string()).min(1).optional().describe(
       "Replacement list of workspace UUIDs or slugs allowed to use this reference; supplying it sets allow_all_workspaces=false"
     ),
     tags: tagsSchema.nullable().optional().describe("Replacement string key-value tags, or null to clear them")
   },
   delete: {
-    id: z20.string().min(1).describe("Secret Reference UUID or slug")
+    id: z25.string().min(1).describe("Secret Reference UUID or slug")
   }
 };
 function validateWorkspaceAccess(value) {
@@ -7618,29 +8093,29 @@ function registerSecretReferencesTools(server, service) {
 }
 
 // src/tools/tracing.tools.ts
-import { z as z21 } from "zod";
+import { z as z26 } from "zod";
 var TRACING_TOOL_SCHEMAS = {
   createFeedback: {
-    trace_id: z21.string().describe(
+    trace_id: z26.string().describe(
       "The trace ID to associate the feedback with. This links feedback to a specific request/generation."
     ),
-    value: z21.coerce.number().describe(
+    value: z26.coerce.number().describe(
       "Feedback value/rating. Common patterns: 1 for positive (thumbs up), 0 for negative (thumbs down), or use a scale like 1-5."
     ),
-    weight: z21.coerce.number().positive().optional().describe(
+    weight: z26.coerce.number().positive().optional().describe(
       "Optional weighting factor for the feedback. Use to give more importance to certain feedback."
     ),
-    metadata: z21.record(z21.string(), z21.unknown()).optional().describe(
+    metadata: z26.record(z26.string(), z26.unknown()).optional().describe(
       "Optional custom metadata for categorization and analysis (e.g., feedback_source, category, user_segment)."
     )
   },
   updateFeedback: {
-    id: z21.string().describe("The unique identifier of the feedback to update"),
-    value: z21.coerce.number().optional().describe(
+    id: z26.string().describe("The unique identifier of the feedback to update"),
+    value: z26.coerce.number().optional().describe(
       "New feedback value/rating. Common patterns: 1 for positive, 0 for negative."
     ),
-    weight: z21.coerce.number().positive().optional().describe("New weighting factor for the feedback"),
-    metadata: z21.record(z21.string(), z21.unknown()).optional().describe("New or updated custom metadata for the feedback")
+    weight: z26.coerce.number().positive().optional().describe("New weighting factor for the feedback"),
+    metadata: z26.record(z26.string(), z26.unknown()).optional().describe("New or updated custom metadata for the feedback")
   }
 };
 function registerTracingTools(server, service) {
@@ -7682,82 +8157,82 @@ function registerTracingTools(server, service) {
 }
 
 // src/tools/users.tools.ts
-import { z as z22 } from "zod";
+import { z as z27 } from "zod";
 var USERS_TOOL_SCHEMAS = {
   listAllUsers: {
     current_page: CurrentPageSchema,
     page_size: PageSizeSchema.describe("Number of results per page (max 100)"),
-    role: z22.enum(["admin", "member", "owner"]).optional().describe("Filter by organisation role"),
-    email: z22.string().email().optional().describe("Filter by exact email")
+    role: z27.enum(["admin", "member", "owner"]).optional().describe("Filter by organisation role"),
+    email: z27.string().email().optional().describe("Filter by exact email")
   },
   inviteUser: {
-    email: z22.string().email().describe("Email address of the user to invite"),
-    role: z22.enum(["admin", "member"]).describe(
+    email: z27.string().email().describe("Email address of the user to invite"),
+    role: z27.enum(["admin", "member"]).describe(
       "Organization-level role: 'admin' for full access, 'member' for limited access"
     ),
-    first_name: z22.string().optional().describe("User's first name"),
-    last_name: z22.string().optional().describe("User's last name"),
-    workspaces: z22.array(
-      z22.object({
-        id: z22.string().describe(
+    first_name: z27.string().optional().describe("User's first name"),
+    last_name: z27.string().optional().describe("User's last name"),
+    workspaces: z27.array(
+      z27.object({
+        id: z27.string().describe(
           "Workspace ID/slug where the user will be granted access"
         ),
-        role: z22.enum(["admin", "member", "manager"]).describe(
+        role: z27.enum(["admin", "member", "manager"]).describe(
           "Workspace-level role: 'admin' for full access, 'manager' for workspace management, 'member' for basic access"
         )
       })
     ).describe(
       "List of workspaces and corresponding roles to grant to the user"
     ),
-    workspace_api_key_details: z22.object({
-      name: z22.string().optional().describe("Name of the API key to be created"),
-      expiry: z22.string().optional().describe("Expiration date for the API key (ISO8601 format)"),
-      metadata: z22.record(z22.string(), z22.string()).optional().describe("Additional metadata key-value pairs for the API key"),
-      scopes: z22.array(z22.string()).describe("List of permission scopes for the API key")
+    workspace_api_key_details: z27.object({
+      name: z27.string().optional().describe("Name of the API key to be created"),
+      expiry: z27.string().optional().describe("Expiration date for the API key (ISO8601 format)"),
+      metadata: z27.record(z27.string(), z27.string()).optional().describe("Additional metadata key-value pairs for the API key"),
+      scopes: z27.array(z27.string()).describe("List of permission scopes for the API key")
     }).optional().describe("Optional API key to be created for the user")
   },
   getUserStats: {
-    time_of_generation_min: z22.string().describe(
+    time_of_generation_min: z27.string().describe(
       "Start time for the analytics period (ISO8601 format, e.g., '2024-01-01T00:00:00Z')"
     ),
-    time_of_generation_max: z22.string().describe(
+    time_of_generation_max: z27.string().describe(
       "End time for the analytics period (ISO8601 format, e.g., '2024-02-01T00:00:00Z')"
     ),
-    total_units_min: z22.coerce.number().positive().optional().describe("Minimum number of total tokens to filter by"),
-    total_units_max: z22.coerce.number().positive().optional().describe("Maximum number of total tokens to filter by"),
-    cost_min: z22.coerce.number().positive().optional().describe("Minimum cost in cents to filter by"),
-    cost_max: z22.coerce.number().positive().optional().describe("Maximum cost in cents to filter by"),
-    status_code: z22.string().optional().describe("Filter by specific HTTP status codes (comma-separated)"),
-    virtual_keys: z22.string().optional().describe("Filter by specific virtual key slugs (comma-separated)"),
+    total_units_min: z27.coerce.number().positive().optional().describe("Minimum number of total tokens to filter by"),
+    total_units_max: z27.coerce.number().positive().optional().describe("Maximum number of total tokens to filter by"),
+    cost_min: z27.coerce.number().positive().optional().describe("Minimum cost in cents to filter by"),
+    cost_max: z27.coerce.number().positive().optional().describe("Maximum cost in cents to filter by"),
+    status_code: z27.string().optional().describe("Filter by specific HTTP status codes (comma-separated)"),
+    virtual_keys: z27.string().optional().describe("Filter by specific virtual key slugs (comma-separated)"),
     page_size: PageSizeSchema.describe("Number of results per page (max 100)")
   },
   getUser: {
-    user_id: z22.string().describe("The user ID to retrieve")
+    user_id: z27.string().describe("The user ID to retrieve")
   },
   updateUser: {
-    user_id: z22.string().describe("The user ID to update"),
-    first_name: z22.string().optional().describe("New first name"),
-    last_name: z22.string().optional().describe("New last name"),
-    role: z22.enum(["admin", "member"]).optional().describe("New organization-level role")
+    user_id: z27.string().describe("The user ID to update"),
+    first_name: z27.string().optional().describe("New first name"),
+    last_name: z27.string().optional().describe("New last name"),
+    role: z27.enum(["admin", "member"]).optional().describe("New organization-level role")
   },
   deleteUser: {
-    user_id: z22.string().describe("The user ID to delete")
+    user_id: z27.string().describe("The user ID to delete")
   },
   listUserInvites: {
     current_page: CurrentPageSchema,
     page_size: PageSizeSchema.describe("Number of results per page (max 100)"),
-    role: z22.enum(["admin", "member"]).optional().describe("Filter invitations by organisation role"),
-    email: z22.string().email().optional().describe("Filter by invited email"),
-    status: z22.enum(["pending", "cancelled", "accepted", "expired"]).optional().describe("Filter invitations by lifecycle status")
+    role: z27.enum(["admin", "member"]).optional().describe("Filter invitations by organisation role"),
+    email: z27.string().email().optional().describe("Filter by invited email"),
+    status: z27.enum(["pending", "cancelled", "accepted", "expired"]).optional().describe("Filter invitations by lifecycle status")
   },
   getUserInvite: {
-    invite_id: z22.string().describe("The invite ID to retrieve")
+    invite_id: z27.string().describe("The invite ID to retrieve")
   },
   deleteUserInvite: {
-    invite_id: z22.string().describe("The invite ID to delete")
+    invite_id: z27.string().describe("The invite ID to delete")
   },
   resendUserInvite: {
-    invite_id: z22.string().describe("The invite ID to resend")
+    invite_id: z27.string().describe("The invite ID to resend")
   }
 };
 function formatUser(user) {
@@ -7918,34 +8393,34 @@ function registerUsersTools(server, service) {
 }
 
 // src/tools/workspaces.tools.ts
-import { z as z23 } from "zod";
+import { z as z28 } from "zod";
 var scimWorkspaceMappingBaseShape = {
-  workspace_id: z23.string().describe("Portkey workspace ID that the SCIM group should access"),
-  role: z23.enum(["admin", "member", "manager"]).describe("Workspace role automatically granted to group members")
+  workspace_id: z28.string().describe("Portkey workspace ID that the SCIM group should access"),
+  role: z28.enum(["admin", "member", "manager"]).describe("Workspace role automatically granted to group members")
 };
 var createScimWorkspaceMappingShape = {
   ...scimWorkspaceMappingBaseShape,
-  scim_group_id: z23.string().min(1).optional().describe(
+  scim_group_id: z28.string().min(1).optional().describe(
     "Existing identity-provider SCIM group ID; provide this or scim_group_name, but not both"
   ),
-  scim_group_name: z23.string().min(1).optional().describe(
+  scim_group_name: z28.string().min(1).optional().describe(
     "Existing SCIM group display name; provide this or scim_group_id, but not both"
   )
 };
-var workspaceUsageLimitSchema = z23.object({
-  credit_limit: z23.coerce.number().positive().optional().describe("Maximum cost or token usage for the workspace"),
-  type: z23.enum(["cost", "tokens"]).optional().describe("Whether the limit measures cost or tokens"),
-  alert_threshold: z23.coerce.number().positive().optional().describe("Percentage of the limit that triggers an alert"),
-  periodic_reset: z23.enum(["monthly", "weekly"]).nullable().optional().describe("Built-in weekly or monthly reset cadence"),
-  periodic_reset_days: z23.coerce.number().int().min(1).max(365).nullable().optional().describe("Custom reset cadence in days, from 1 through 365"),
-  next_usage_reset_at: z23.iso.datetime({ offset: true }).nullable().optional().describe("Next reset timestamp in ISO 8601 format")
+var workspaceUsageLimitSchema = z28.object({
+  credit_limit: z28.coerce.number().positive().optional().describe("Maximum cost or token usage for the workspace"),
+  type: z28.enum(["cost", "tokens"]).optional().describe("Whether the limit measures cost or tokens"),
+  alert_threshold: z28.coerce.number().positive().optional().describe("Percentage of the limit that triggers an alert"),
+  periodic_reset: z28.enum(["monthly", "weekly"]).nullable().optional().describe("Built-in weekly or monthly reset cadence"),
+  periodic_reset_days: z28.coerce.number().int().min(1).max(365).nullable().optional().describe("Custom reset cadence in days, from 1 through 365"),
+  next_usage_reset_at: z28.iso.datetime({ offset: true }).nullable().optional().describe("Next reset timestamp in ISO 8601 format")
 });
-var workspaceRateLimitSchema = z23.object({
-  type: z23.enum(["requests", "tokens"]).optional().describe("Whether the limit counts requests or tokens"),
-  unit: z23.enum(["rpd", "rph", "rpm"]).optional().describe("Rate window: requests per day, hour, or minute"),
-  value: z23.coerce.number().int().nonnegative().optional().describe("Maximum count in the selected rate window")
+var workspaceRateLimitSchema = z28.object({
+  type: z28.enum(["requests", "tokens"]).optional().describe("Whether the limit counts requests or tokens"),
+  unit: z28.enum(["rpd", "rph", "rpm"]).optional().describe("Rate window: requests per day, hour, or minute"),
+  value: z28.coerce.number().int().nonnegative().optional().describe("Maximum count in the selected rate window")
 });
-var createScimWorkspaceMappingSchema = z23.object(createScimWorkspaceMappingShape).superRefine((input, context) => {
+var createScimWorkspaceMappingSchema = z28.object(createScimWorkspaceMappingShape).superRefine((input, context) => {
   if (Boolean(input.scim_group_id) === Boolean(input.scim_group_name)) {
     context.addIssue({
       code: "custom",
@@ -7960,99 +8435,101 @@ var WORKSPACES_TOOL_SCHEMAS = {
       "Number of workspaces to return per page (max 100)"
     ),
     current_page: CurrentPageSchema,
-    name: z23.string().optional().describe("Case-sensitive name filter"),
-    exact_name: z23.string().optional().describe("Exact workspace name filter"),
-    status: z23.enum(["active", "archived"]).optional().describe("Filter by workspace lifecycle status")
+    name: z28.string().optional().describe("Case-sensitive name filter"),
+    exact_name: z28.string().optional().describe("Exact workspace name filter"),
+    status: z28.enum(["active", "archived"]).optional().describe("Filter by workspace lifecycle status")
   },
   getWorkspace: {
-    workspace_id: z23.string().describe(
+    workspace_id: z28.string().describe(
       "The unique identifier of the workspace to retrieve. This can be found in the workspace's URL or from the list_workspaces tool response"
     )
   },
   createWorkspace: {
-    name: z23.string().describe("Name of the workspace"),
-    slug: z23.string().optional().describe("URL-friendly slug (auto-generated if not provided)"),
-    description: z23.string().optional().describe("Description of the workspace"),
-    is_default: z23.coerce.number().optional().describe("Set as default workspace (1 = yes, 0 = no)"),
-    metadata: z23.record(z23.string(), z23.string()).optional().describe("Custom metadata key-value pairs"),
-    users: z23.array(z23.string()).optional().describe("Existing user IDs to add"),
-    usage_limits: z23.array(workspaceUsageLimitSchema).optional().describe("Initial workspace usage-limit settings"),
-    rate_limits: z23.array(workspaceRateLimitSchema).optional().describe("Initial workspace rate-limit settings")
+    name: z28.string().describe("Name of the workspace"),
+    slug: z28.string().optional().describe("URL-friendly slug (auto-generated if not provided)"),
+    description: z28.string().optional().describe("Description of the workspace"),
+    is_default: z28.coerce.number().optional().describe("Set as default workspace (1 = yes, 0 = no)"),
+    metadata: z28.record(z28.string(), z28.string()).optional().describe("Custom metadata key-value pairs"),
+    users: z28.array(z28.string()).optional().describe("Existing user IDs to add"),
+    usage_limits: z28.array(workspaceUsageLimitSchema).optional().describe("Initial workspace usage-limit settings"),
+    rate_limits: z28.array(workspaceRateLimitSchema).optional().describe("Initial workspace rate-limit settings")
   },
   updateWorkspace: {
-    workspace_id: z23.string().describe("The workspace ID to update"),
-    name: z23.string().optional().describe("New name for the workspace"),
-    slug: z23.string().optional().describe("New slug for the workspace"),
-    description: z23.string().optional().describe("New description"),
-    is_default: z23.coerce.number().optional().describe("Set as default workspace (1 = yes, 0 = no)"),
-    metadata: z23.record(z23.string(), z23.string()).optional().describe("New metadata key-value pairs"),
-    input_guardrails: z23.array(z23.string()).optional().describe("Guardrail IDs applied to workspace model inputs"),
-    output_guardrails: z23.array(z23.string()).optional().describe("Guardrail IDs applied to workspace model outputs"),
-    user_api_key_config: z23.string().nullable().optional().describe(
+    workspace_id: z28.string().describe("The workspace ID to update"),
+    name: z28.string().optional().describe("New name for the workspace"),
+    slug: z28.string().optional().describe("New slug for the workspace"),
+    description: z28.string().optional().describe("New description"),
+    is_default: z28.coerce.number().optional().describe("Set as default workspace (1 = yes, 0 = no)"),
+    metadata: z28.record(z28.string(), z28.string()).optional().describe("New metadata key-value pairs"),
+    input_guardrails: z28.array(z28.string()).optional().describe("Guardrail IDs applied to workspace model inputs"),
+    output_guardrails: z28.array(z28.string()).optional().describe("Guardrail IDs applied to workspace model outputs"),
+    user_api_key_config: z28.string().nullable().optional().describe(
       "Default config slug for workspace-user API keys, or null to clear"
     ),
-    usage_limits: z23.array(workspaceUsageLimitSchema).optional().describe("Replacement workspace usage-limit settings"),
-    rate_limits: z23.array(workspaceRateLimitSchema).optional().describe("Replacement workspace rate-limit settings")
+    usage_limits: z28.array(workspaceUsageLimitSchema).optional().describe("Replacement workspace usage-limit settings"),
+    rate_limits: z28.array(workspaceRateLimitSchema).optional().describe("Replacement workspace rate-limit settings")
   },
   deleteWorkspace: {
-    workspace_id: z23.string().describe("The workspace ID to delete")
+    workspace_id: z28.string().describe("The workspace ID to delete")
   },
   addWorkspaceMember: {
-    workspace_id: z23.string().describe("The workspace ID to add the member to"),
-    user_id: z23.string().uuid(
+    workspace_id: z28.string().describe("The workspace ID to add the member to"),
+    user_id: z28.string().uuid(
       "user_id must be a valid UUID (use list_all_users to find user IDs)"
     ).describe(
       "The user ID to add (must be a valid UUID from list_all_users, not an email address)"
     ),
-    role: z23.enum(["admin", "member", "manager"]).describe("Role in the workspace")
+    role: z28.enum(["admin", "member", "manager"]).describe("Role in the workspace")
   },
   listWorkspaceMembers: {
-    workspace_id: z23.string().describe("The workspace ID to list members for"),
+    workspace_id: z28.string().describe("The workspace ID to list members for"),
     current_page: CurrentPageSchema.describe("Zero-based page number"),
     page_size: PageSizeSchema.describe("Number of members per page"),
-    role: z23.enum(["admin", "manager", "member"]).optional().describe("Filter by workspace role"),
-    email: z23.string().email().optional().describe("Filter by member email")
+    role: z28.enum(["admin", "manager", "member"]).optional().describe("Filter by workspace role"),
+    email: z28.string().email().optional().describe("Filter by member email")
   },
   getWorkspaceMember: {
-    workspace_id: z23.string().describe("The workspace ID"),
-    user_id: z23.string().uuid(
+    workspace_id: z28.string().describe("The workspace ID"),
+    user_id: z28.string().uuid(
       "user_id must be a valid UUID (use list_all_users to find user IDs)"
     ).describe(
       "The user ID to retrieve (must be a valid UUID from list_all_users, not an email address)"
     )
   },
   updateWorkspaceMember: {
-    workspace_id: z23.string().describe("The workspace ID"),
-    user_id: z23.string().uuid(
+    workspace_id: z28.string().describe("The workspace ID"),
+    user_id: z28.string().uuid(
       "user_id must be a valid UUID (use list_all_users to find user IDs)"
     ).describe(
       "The user ID to update (must be a valid UUID from list_all_users, not an email address)"
     ),
-    role: z23.enum(["admin", "member", "manager"]).describe("New role in the workspace")
+    role: z28.enum(["admin", "member", "manager"]).describe("New role in the workspace")
   },
   removeWorkspaceMember: {
-    workspace_id: z23.string().describe("The workspace ID"),
-    user_id: z23.string().uuid(
+    workspace_id: z28.string().describe("The workspace ID"),
+    user_id: z28.string().uuid(
       "user_id must be a valid UUID (use list_all_users to find user IDs)"
     ).describe("The user ID to remove")
   },
   listScimWorkspaceMappings: {
-    workspace_id: z23.string().optional().describe("Return only mappings for this Portkey workspace ID"),
-    scim_group_id: z23.string().optional().describe(
+    workspace_id: z28.string().optional().describe(
+      "Return only mappings for this Portkey workspace UUID (the id from list_workspaces, not its slug)"
+    ),
+    scim_group_id: z28.string().optional().describe(
       "Return only mappings for this identity-provider SCIM group ID"
     ),
-    role: z23.enum(["admin", "member", "manager"]).optional().describe("Return only mappings that grant this workspace role"),
-    page: z23.coerce.number().int().nonnegative().optional().describe(
+    role: z28.enum(["admin", "member", "manager"]).optional().describe("Return only mappings that grant this workspace role"),
+    page: z28.coerce.number().int().nonnegative().optional().describe(
       "Zero-based results page to retrieve; the first page is 0. These SCIM tools name the parameter page, not the current_page used by other list tools."
     ),
     page_size: PageSizeSchema.describe("Mappings per page, from 1 through 100")
   },
   deleteScimWorkspaceMapping: {
-    mapping_id: z23.string().describe("SCIM workspace mapping ID from list_scim_workspace_mappings")
+    mapping_id: z28.string().describe("SCIM workspace mapping ID from list_scim_workspace_mappings")
   },
   listScimGroups: {
-    search: z23.string().optional().describe("Case-insensitive text to match against SCIM group names"),
-    page: z23.coerce.number().int().nonnegative().optional().describe(
+    search: z28.string().optional().describe("Case-insensitive text to match against SCIM group names"),
+    page: z28.coerce.number().int().nonnegative().optional().describe(
       "Zero-based results page to retrieve; the first page is 0. These SCIM tools name the parameter page, not the current_page used by other list tools."
     ),
     page_size: PageSizeSchema.describe(
@@ -8366,6 +8843,8 @@ function registerWorkspacesTools(server, service) {
 
 // src/tools/index.ts
 var TOOL_DOMAIN_REGISTRARS = [
+  ["access-policies", registerAccessPoliciesTools],
+  ["egress-allowlist", registerEgressAllowlistTools],
   ["users", registerUsersTools],
   ["workspaces", registerWorkspacesTools],
   ["configs", registerConfigsTools],
@@ -8443,6 +8922,9 @@ var ENTERPRISE_GATED_TOOL_NAMES = /* @__PURE__ */ new Set([
   "get_analytics_group_models",
   "get_analytics_group_metadata",
   "get_analytics_group_providers",
+  "get_analytics_group_mcp",
+  "get_analytics_group_a2a",
+  "get_analytics_group_workspaces",
   "list_deployments",
   "register_deployment",
   "get_deployment",
@@ -8539,7 +9021,7 @@ function escapeRegExp(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 function getToolErrorMessage(error) {
-  if (error instanceof z24.ZodError) {
+  if (error instanceof z29.ZodError) {
     return formatZodIssues(error);
   }
   if (error instanceof Error && error.message) {
@@ -8548,71 +9030,81 @@ function getToolErrorMessage(error) {
   return String(error);
 }
 var STANDARD_TOOL_OUTPUT_SCHEMA = {
-  ok: z24.boolean().describe("Whether the tool call succeeded and returned structured data"),
-  data: z24.unknown().optional().describe("Structured success payload when ok is true"),
-  error: z24.object({
-    message: z24.string().describe("Human-readable error message"),
-    details: z24.unknown().optional().describe("Optional structured error details")
+  ok: z29.boolean().describe("Whether the tool call succeeded and returned structured data"),
+  data: z29.unknown().optional().describe("Structured success payload when ok is true"),
+  error: z29.object({
+    message: z29.string().describe("Human-readable error message"),
+    details: z29.unknown().optional().describe("Optional structured error details")
   }).optional().describe("Structured error payload when ok is false")
 };
 var TOOL_SUCCESS_DATA_SCHEMAS = {
-  rotate_api_key: z24.object({
-    message: z24.string().describe("Rotation confirmation"),
-    warning: z24.string().describe("Required handling guidance for the one-time secret"),
-    id: z24.string().uuid().describe("Rotated API key UUID"),
-    key: z24.string().describe("New API key secret, returned only once"),
-    key_transition_expires_at: z24.iso.datetime().describe("Time when the previous key stops working")
+  create_access_policy: CreateAccessPolicyResponseSchema,
+  list_access_policies: ListAccessPoliciesResponseSchema,
+  get_access_policy: AccessPolicySchema,
+  update_access_policy: z29.object({}),
+  delete_access_policy: z29.object({}),
+  create_egress_allowlist_entry: CreateEgressAllowlistResponseSchema,
+  list_egress_allowlist: ListEgressAllowlistResponseSchema,
+  get_egress_allowlist_entry: EgressAllowlistEntrySchema,
+  update_egress_allowlist_entry: z29.object({}),
+  delete_egress_allowlist_entry: z29.object({}),
+  rotate_api_key: z29.object({
+    message: z29.string().describe("Rotation confirmation"),
+    warning: z29.string().describe("Required handling guidance for the one-time secret"),
+    id: z29.string().uuid().describe("Rotated API key UUID"),
+    key: z29.string().describe("New API key secret, returned only once"),
+    key_transition_expires_at: z29.iso.datetime().describe("Time when the previous key stops working")
   }),
-  create_secret_reference: z24.object({
-    message: z24.string().describe("Creation confirmation"),
-    id: z24.string().uuid().describe("New Secret Reference UUID"),
-    slug: z24.string().describe("New Secret Reference slug")
+  create_secret_reference: z29.object({
+    message: z29.string().describe("Creation confirmation"),
+    id: z29.string().uuid().describe("New Secret Reference UUID"),
+    slug: z29.string().describe("New Secret Reference slug")
   }),
-  list_secret_references: z24.object({
-    total: z24.number().int().nonnegative().describe("Total matching references"),
-    secret_references: z24.array(
-      z24.object({
-        id: z24.string().uuid().describe("Secret Reference UUID"),
-        name: z24.string().describe("Human-readable name"),
-        slug: z24.string().describe("Stable Secret Reference slug"),
+  list_secret_references: z29.object({
+    total: z29.number().int().nonnegative().describe("Total matching references"),
+    secret_references: z29.array(
+      z29.object({
+        id: z29.string().uuid().describe("Secret Reference UUID"),
+        name: z29.string().describe("Human-readable name"),
+        slug: z29.string().describe("Stable Secret Reference slug"),
         manager_type: SecretManagerTypeSchema.describe(
           "External secret manager type"
         ),
-        status: z24.literal("ACTIVE").describe("Current reference status"),
-        created_at: z24.iso.datetime().describe("ISO 8601 creation timestamp"),
-        last_updated_at: z24.iso.datetime().describe("ISO 8601 last-update timestamp")
+        status: z29.literal("ACTIVE").describe("Current reference status"),
+        created_at: z29.iso.datetime().describe("ISO 8601 creation timestamp"),
+        last_updated_at: z29.iso.datetime().describe("ISO 8601 last-update timestamp")
       })
     ).describe(
       "Current page of Secret References without authentication values"
     )
   }),
-  get_secret_reference: z24.object({
-    id: z24.string().uuid().describe("Secret Reference UUID"),
-    organisation_id: z24.string().uuid().describe("Owning organisation UUID"),
-    name: z24.string().describe("Human-readable name"),
-    slug: z24.string().describe("Stable Secret Reference slug"),
-    description: z24.string().nullable().describe("Reference description"),
+  get_secret_reference: z29.object({
+    id: z29.string().uuid().describe("Secret Reference UUID"),
+    organisation_id: z29.string().uuid().describe("Owning organisation UUID"),
+    name: z29.string().describe("Human-readable name"),
+    slug: z29.string().describe("Stable Secret Reference slug"),
+    description: z29.string().nullable().describe("Reference description"),
     manager_type: SecretManagerTypeSchema.describe(
       "External secret manager type"
     ),
-    secret_path: z24.string().describe("Path in the external secret manager"),
-    secret_key: z24.string().nullable().describe("Selected key within a structured secret"),
-    allow_all_workspaces: z24.boolean().describe("Whether all workspaces may use the reference"),
-    tags: z24.record(z24.string(), z24.string()).nullable().describe("String metadata tags"),
-    status: z24.literal("ACTIVE").describe("Current reference status"),
-    created_by: z24.string().describe("Creator identifier"),
-    created_at: z24.iso.datetime().describe("ISO 8601 creation timestamp"),
-    last_updated_at: z24.iso.datetime().describe("ISO 8601 last-update timestamp"),
-    auth_config: z24.record(z24.string(), z24.unknown()).describe("Authentication configuration with sensitive values redacted"),
-    object: z24.literal("secret-reference").describe("Portkey object type")
+    secret_path: z29.string().describe("Path in the external secret manager"),
+    secret_key: z29.string().nullable().describe("Selected key within a structured secret"),
+    allow_all_workspaces: z29.boolean().describe("Whether all workspaces may use the reference"),
+    tags: z29.record(z29.string(), z29.string()).nullable().describe("String metadata tags"),
+    status: z29.literal("ACTIVE").describe("Current reference status"),
+    created_by: z29.string().describe("Creator identifier"),
+    created_at: z29.iso.datetime().describe("ISO 8601 creation timestamp"),
+    last_updated_at: z29.iso.datetime().describe("ISO 8601 last-update timestamp"),
+    auth_config: z29.record(z29.string(), z29.unknown()).describe("Authentication configuration with sensitive values redacted"),
+    object: z29.literal("secret-reference").describe("Portkey object type")
   }),
-  update_secret_reference: z24.object({
-    message: z24.string().describe("Update confirmation"),
-    success: z24.literal(true).describe("Whether the update succeeded")
+  update_secret_reference: z29.object({
+    message: z29.string().describe("Update confirmation"),
+    success: z29.literal(true).describe("Whether the update succeeded")
   }),
-  delete_secret_reference: z24.object({
-    message: z24.string().describe("Deletion confirmation"),
-    success: z24.literal(true).describe("Whether the deletion succeeded")
+  delete_secret_reference: z29.object({
+    message: z29.string().describe("Deletion confirmation"),
+    success: z29.literal(true).describe("Whether the deletion succeeded")
   })
 };
 function getToolOutputSchema(toolName) {
@@ -8688,7 +9180,7 @@ function wrapToolCallback(toolName, callback) {
       return normalizeToolResult(await callback(...args));
     } catch (error) {
       const message = getToolErrorMessage(error);
-      const isValidationError = error instanceof z24.ZodError;
+      const isValidationError = error instanceof z29.ZodError;
       const text = isValidationError ? `Invalid arguments for "${toolName}": ${message}` : `Tool "${toolName}" failed: ${message}`;
       Logger.error("Tool callback failed", {
         error: message,
@@ -9799,7 +10291,7 @@ function createManagedEventStore(config) {
 // src/lib/mcp-server.ts
 import { readFileSync } from "node:fs";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { z as z25 } from "zod";
+import { z as z30 } from "zod";
 var PACKAGE_JSON_URL_CANDIDATES = [
   new URL("../../package.json", import.meta.url),
   new URL("../package.json", import.meta.url)
@@ -9872,8 +10364,8 @@ function registerServerPromptsAndResources(server) {
       title: "Plan Portkey Admin Workflow",
       description: "Create a concise, safe plan for a Portkey Admin API task using this MCP server.",
       argsSchema: {
-        task: z25.string().min(1).max(500).describe("Portkey admin task to plan, such as promoting a prompt"),
-        area: z25.string().max(80).optional().describe(
+        task: z30.string().min(1).max(500).describe("Portkey admin task to plan, such as promoting a prompt"),
+        area: z30.string().max(80).optional().describe(
           "Optional Portkey area, such as prompts, analytics, configs, or users"
         )
       }
@@ -9952,6 +10444,7 @@ function createMcpServer(options = {}) {
       version: PACKAGE_VERSION
     },
     {
+      maxToolInputElements: 1e4,
       capabilities: {
         prompts: { listChanged: true },
         resources: { listChanged: true },