pulsemcp-cms-admin-mcp-server 0.10.0 → 0.10.2

package/build/shared/src/pulsemcp-admin-client/lib/set-popularity-drop-bypass.js

@@ -0,0 +1,38 @@
+import { adminFetch } from './admin-fetch.js';
+/**
+ * Enable or disable the one-off SYSTEMIC_DROP bypass for popularity estimates.
+ *
+ * POST /api/popularity_drop_bypass with body { enabled } sets the flag and
+ * returns the resulting status. When enabled, the NEXT run of
+ * UpdatePopularityEstimatesFromBigqueryJob flushes legitimate drops held by the
+ * SYSTEMIC_DROP guardrail, then consumes (auto-resets) the flag.
+ */
+export async function setPopularityDropBypass(apiKey, baseUrl, enabled) {
+    const url = new URL('/api/popularity_drop_bypass', baseUrl);
+    const response = await adminFetch(url.toString(), {
+        method: 'POST',
+        headers: {
+            'X-API-Key': apiKey,
+            Accept: 'application/json',
+            'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({ enabled }),
+    });
+    if (!response.ok) {
+        if (response.status === 401) {
+            throw new Error('Invalid API key');
+        }
+        if (response.status === 403) {
+            throw new Error('User lacks write privileges');
+        }
+        if (response.status === 404) {
+            throw new Error('Popularity drop bypass endpoint not found');
+        }
+        if (response.status === 422) {
+            const errorData = (await response.json().catch(() => ({})));
+            throw new Error(`Validation failed: ${errorData.errors?.join(', ') || 'Unknown error'}`);
+        }
+        throw new Error(`Failed to set popularity drop bypass: ${response.status} ${response.statusText}`);
+    }
+    return (await response.json());
+}

package/build/shared/src/pulsemcp-admin-client/pulsemcp-admin-client.integration-mock.js

@@ -940,6 +940,13 @@ export function createMockPulseMCPAdminClient(mockData) {
                 deleted_count: 0,
             };
         },
+        async setPopularityDropBypass(enabled) {
+            return {
+                enabled,
+                enabled_at: enabled ? '2026-06-09T00:00:00Z' : null,
+                enabled_by: enabled ? 'mock-admin' : null,
+            };
+        },
         // Proctor methods
         async runExamForMirror() {
             return {

package/build/shared/src/server.js

@@ -60,6 +60,7 @@ import { retryGoodJob } from './pulsemcp-admin-client/lib/retry-good-job.js';
 import { discardGoodJob } from './pulsemcp-admin-client/lib/discard-good-job.js';
 import { rescheduleGoodJob } from './pulsemcp-admin-client/lib/reschedule-good-job.js';
 import { forceTriggerGoodJobCron } from './pulsemcp-admin-client/lib/force-trigger-good-job-cron.js';
+import { setPopularityDropBypass } from './pulsemcp-admin-client/lib/set-popularity-drop-bypass.js';
 import { cleanupGoodJobs } from './pulsemcp-admin-client/lib/cleanup-good-jobs.js';
 import { runExamForMirror } from './pulsemcp-admin-client/lib/run-exam-for-mirror.js';
 import { saveResultsForMirror } from './pulsemcp-admin-client/lib/save-results-for-mirror.js';
@@ -293,6 +294,9 @@ export class PulseMCPAdminClient {
     async forceTriggerGoodJobCron(cronKey) {
         return forceTriggerGoodJobCron(this.apiKey, this.baseUrl, cronKey);
     }
+    async setPopularityDropBypass(enabled) {
+        return setPopularityDropBypass(this.apiKey, this.baseUrl, enabled);
+    }
     async cleanupGoodJobs(params) {
         return cleanupGoodJobs(this.apiKey, this.baseUrl, params);
     }

package/build/shared/src/tools/save-mcp-implementation.js

@@ -48,6 +48,9 @@ const PARAM_DESCRIPTIONS = {
     github_owner: 'GitHub organization or username that owns the repository.',
     github_repo: 'GitHub repository name (without owner prefix).',
     github_subfolder: 'Subfolder path within the repository, for monorepos. Omit for root-level projects.',
+    // Package registry fields (UPDATE only)
+    package_registry: "(UPDATE ONLY, SERVER ONLY) Package registry: npm, pypi, cargo, etc. To CLEAR (unlink) the server's registry package, pass an empty string for BOTH `package_registry` and `package_name`. Passing an empty string for only one of the two is rejected with a 422 error.",
+    package_name: '(UPDATE ONLY, SERVER ONLY) Package name on the registry (e.g., "@modelcontextprotocol/server-filesystem"). To CLEAR (unlink) the server\'s registry package, pass an empty string for BOTH `package_name` and `package_registry`. Passing an empty string for only one of the two is rejected with a 422 error.',
     // Remote endpoints
     remote: 'Array of remote endpoint configurations for MCP servers. Providing this replaces ALL existing remotes. Omitting leaves them unchanged. Pass an empty array to delete all. Each remote can have: id (existing remote ID or blank for new), url_direct, url_setup, transport (e.g., "sse"), host_platform (e.g., "smithery"), host_infrastructure (e.g., "cloudflare"), authentication_method (e.g., "open"), cost (e.g., "free"), status (defaults to "live"), display_name, and internal_notes.',
     // Canonical URLs
@@ -90,6 +93,9 @@ const SaveMCPImplementationSchema = z.object({
     github_owner: z.string().optional().describe(PARAM_DESCRIPTIONS.github_owner),
     github_repo: z.string().optional().describe(PARAM_DESCRIPTIONS.github_repo),
     github_subfolder: z.string().optional().describe(PARAM_DESCRIPTIONS.github_subfolder),
+    // Package registry fields (UPDATE only)
+    package_registry: z.string().optional().describe(PARAM_DESCRIPTIONS.package_registry),
+    package_name: z.string().optional().describe(PARAM_DESCRIPTIONS.package_name),
     // Remote endpoints
     remote: z
         .array(z.object({
@@ -208,6 +214,7 @@ Important notes:
   - \`classification\` and \`implementation_language\` only apply to servers
   - \`provider_name\` reuses existing provider if it matches a provider's slug
 - Setting mcp_server_id or mcp_client_id to null will unlink the association (UPDATE only)
+- Registry package (UPDATE only): pass an empty string for BOTH \`package_registry\` and \`package_name\` to CLEAR (unlink) the link; passing only one as empty is rejected with a 422 error; omitting both leaves the link unchanged
 - Remote endpoints are for MCP servers only and configure how they can be accessed
 - Canonical URLs help identify the authoritative source for the implementation
 - After creating/updating, use \`get_mcp_server\` to verify the full state including remotes and canonical URLs`,
@@ -299,6 +306,15 @@ Important notes:
                     type: 'string',
                     description: PARAM_DESCRIPTIONS.github_subfolder,
                 },
+                // Package registry fields (UPDATE only)
+                package_registry: {
+                    type: 'string',
+                    description: PARAM_DESCRIPTIONS.package_registry,
+                },
+                package_name: {
+                    type: 'string',
+                    description: PARAM_DESCRIPTIONS.package_name,
+                },
                 // Remote endpoints
                 remote: {
                     type: 'array',

package/build/shared/src/tools/set-popularity-drop-bypass.js

@@ -0,0 +1,55 @@
+import { z } from 'zod';
+const PARAM_DESCRIPTIONS = {
+    enabled: 'true enables the one-off bypass; false disables it. When enabled, the NEXT run of UpdatePopularityEstimatesFromBigqueryJob flushes the legitimate downward corrections currently held by the SYSTEMIC_DROP guardrail (and clears their popularity_drop_held_since), then the flag auto-resets to false so the bypass never silently stays on.',
+};
+const SetPopularityDropBypassSchema = z.object({
+    enabled: z.boolean().describe(PARAM_DESCRIPTIONS.enabled),
+});
+export function setPopularityDropBypass(_server, clientFactory) {
+    return {
+        name: 'set_popularity_drop_bypass',
+        description: `Enable or disable a deliberate, auditable ONE-OFF bypass of the SYSTEMIC_DROP guardrail in the popularity-estimates pipeline.
+
+Background: UpdatePopularityEstimatesFromBigqueryJob holds large downward popularity corrections when more than ~10% of servers would drop at once (a possible systemic upstream event), keeping each flagged server at its stale value for ~3 days. During a known-legitimate remediation wave (e.g. correcting servers mis-linked to famous registry packages), that guardrail keeps genuinely-corrected servers visible at inflated values.
+
+Enabling this bypass tells the NEXT job run to skip the SYSTEMIC_DROP hold for that single run only: it applies the corrected (dropped) BigQuery values, clears popularity_drop_held_since for the affected servers, then CONSUMES the flag (auto-resets enabled→false). The independent impossible-RISE guardrail is unaffected.
+
+Returns the resulting bypass status (enabled / enabled_at / enabled_by).
+
+Use cases:
+- Enable the bypass before the next scheduled run to flush a known-legitimate correction wave caught in a systemic hold
+- Disable the bypass if it was enabled in error and the next run has not yet consumed it`,
+        inputSchema: {
+            type: 'object',
+            properties: {
+                enabled: { type: 'boolean', description: PARAM_DESCRIPTIONS.enabled },
+            },
+            required: ['enabled'],
+        },
+        handler: async (args) => {
+            const validatedArgs = SetPopularityDropBypassSchema.parse(args);
+            const client = clientFactory();
+            try {
+                const result = await client.setPopularityDropBypass(validatedArgs.enabled);
+                const text = `Popularity drop bypass ${result.enabled ? 'ENABLED' : 'DISABLED'}.
+- enabled: ${result.enabled}
+- enabled_at: ${result.enabled_at ?? '(none)'}
+- enabled_by: ${result.enabled_by ?? '(none)'}${result.enabled
+                    ? '\n\nThe next UpdatePopularityEstimatesFromBigqueryJob run will flush held drops and then auto-reset this flag.'
+                    : ''}`;
+                return { content: [{ type: 'text', text }] };
+            }
+            catch (error) {
+                return {
+                    content: [
+                        {
+                            type: 'text',
+                            text: `Error setting popularity drop bypass: ${error instanceof Error ? error.message : String(error)}`,
+                        },
+                    ],
+                    isError: true,
+                };
+            }
+        },
+    };
+}

package/build/shared/src/tools/update-mcp-server.js

@@ -13,8 +13,8 @@ const PARAM_DESCRIPTIONS = {
     provider_slug: 'URL slug for provider (auto-generated from name if omitted)',
     provider_url: 'Website URL for provider',
     source_code: 'GitHub repository information',
-    package_registry: 'Package registry: npm, pypi, cargo, etc.',
-    package_name: 'Package name on the registry (e.g., "@modelcontextprotocol/server-filesystem")',
+    package_registry: "Package registry: npm, pypi, cargo, etc. To CLEAR (unlink) the server's registry package, pass an empty string for BOTH `package_registry` and `package_name`. Passing an empty string for only one of the two is rejected with a 422 error.",
+    package_name: 'Package name on the registry (e.g., "@modelcontextprotocol/server-filesystem"). To CLEAR (unlink) the server\'s registry package, pass an empty string for BOTH `package_name` and `package_registry`. Passing an empty string for only one of the two is rejected with a 422 error.',
     recommended: 'Mark this server as recommended by PulseMCP',
     verified_no_remote_canonicals: 'Mark that this server has been verified to have no remote canonical URLs (true = verified no remote canonicals exist, false = reset/canonicals found)',
     created_on_override: 'Override the automatically derived created date (ISO date string, e.g., "2025-01-15")',
@@ -176,6 +176,26 @@ To update an existing remote, include its ID:
 }
 \`\`\`
 
+## Updating / Clearing the Registry Package Link
+Set the link by providing both fields:
+\`\`\`json
+{
+  "implementation_id": 456,
+  "package_registry": "npm",
+  "package_name": "@modelcontextprotocol/server-filesystem"
+}
+\`\`\`
+
+To **clear** (unlink) the registry package, pass an empty string for **both** fields:
+\`\`\`json
+{
+  "implementation_id": 456,
+  "package_registry": "",
+  "package_name": ""
+}
+\`\`\`
+Passing an empty string for only one of the two is rejected with a 422 error ("Package registry and package name must be provided together"); omitting both leaves the link unchanged.
+
 ## Linking/Creating Provider
 Link existing provider by ID:
 \`\`\`json

package/build/shared/src/tools.js

@@ -65,6 +65,7 @@ import { discardGoodJob } from './tools/discard-good-job.js';
 import { rescheduleGoodJob } from './tools/reschedule-good-job.js';
 import { forceTriggerGoodJobCron } from './tools/force-trigger-good-job-cron.js';
 import { cleanupGoodJobs } from './tools/cleanup-good-jobs.js';
+import { setPopularityDropBypass } from './tools/set-popularity-drop-bypass.js';
 // Proctor tools
 import { runExamForMirror } from './tools/run-exam-for-mirror.js';
 import { getExamResult } from './tools/get-exam-result.js';
@@ -263,6 +264,10 @@ const ALL_TOOLS = [
     { factory: rescheduleGoodJob, groups: ['good_jobs'], isWriteOperation: true },
     { factory: forceTriggerGoodJobCron, groups: ['good_jobs'], isWriteOperation: true },
     { factory: cleanupGoodJobs, groups: ['good_jobs'], isWriteOperation: true },
+    // setPopularityDropBypass toggles a one-off bypass of the SYSTEMIC_DROP guardrail in
+    // UpdatePopularityEstimatesFromBigqueryJob. It lives in good_jobs because it controls the
+    // behavior of a background job and is exposed via the same write-enabled good_jobs credential.
+    { factory: setPopularityDropBypass, groups: ['good_jobs'], isWriteOperation: true },
     // Proctor tools
     { factory: runExamForMirror, groups: ['proctor'], isWriteOperation: true },
     { factory: getExamResult, groups: ['proctor'], isWriteOperation: false },

package/node_modules/@pulsemcp/mcp-elicitation/package.json

@@ -23,6 +23,6 @@
   "devDependencies": {
     "@types/node": "^24.10.12",
     "typescript": "^5.7.3",
-    "vitest": "^3.2.3"
+    "vitest": "^4.1.8"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pulsemcp-cms-admin-mcp-server",
-  "version": "0.10.0",
+  "version": "0.10.2",
   "description": "Local implementation of PulseMCP CMS Admin MCP server",
   "mcpName": "com.pulsemcp/pulsemcp-cms-admin",
   "main": "build/index.js",

package/shared/pulsemcp-admin-client/lib/set-popularity-drop-bypass.d.ts

@@ -0,0 +1,11 @@
+import type { PopularityDropBypassStatus } from '../../types.js';
+/**
+ * Enable or disable the one-off SYSTEMIC_DROP bypass for popularity estimates.
+ *
+ * POST /api/popularity_drop_bypass with body { enabled } sets the flag and
+ * returns the resulting status. When enabled, the NEXT run of
+ * UpdatePopularityEstimatesFromBigqueryJob flushes legitimate drops held by the
+ * SYSTEMIC_DROP guardrail, then consumes (auto-resets) the flag.
+ */
+export declare function setPopularityDropBypass(apiKey: string, baseUrl: string, enabled: boolean): Promise<PopularityDropBypassStatus>;
+//# sourceMappingURL=set-popularity-drop-bypass.d.ts.map

package/shared/pulsemcp-admin-client/lib/set-popularity-drop-bypass.js

@@ -0,0 +1,38 @@
+import { adminFetch } from './admin-fetch.js';
+/**
+ * Enable or disable the one-off SYSTEMIC_DROP bypass for popularity estimates.
+ *
+ * POST /api/popularity_drop_bypass with body { enabled } sets the flag and
+ * returns the resulting status. When enabled, the NEXT run of
+ * UpdatePopularityEstimatesFromBigqueryJob flushes legitimate drops held by the
+ * SYSTEMIC_DROP guardrail, then consumes (auto-resets) the flag.
+ */
+export async function setPopularityDropBypass(apiKey, baseUrl, enabled) {
+    const url = new URL('/api/popularity_drop_bypass', baseUrl);
+    const response = await adminFetch(url.toString(), {
+        method: 'POST',
+        headers: {
+            'X-API-Key': apiKey,
+            Accept: 'application/json',
+            'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({ enabled }),
+    });
+    if (!response.ok) {
+        if (response.status === 401) {
+            throw new Error('Invalid API key');
+        }
+        if (response.status === 403) {
+            throw new Error('User lacks write privileges');
+        }
+        if (response.status === 404) {
+            throw new Error('Popularity drop bypass endpoint not found');
+        }
+        if (response.status === 422) {
+            const errorData = (await response.json().catch(() => ({})));
+            throw new Error(`Validation failed: ${errorData.errors?.join(', ') || 'Unknown error'}`);
+        }
+        throw new Error(`Failed to set popularity drop bypass: ${response.status} ${response.statusText}`);
+    }
+    return (await response.json());
+}

package/shared/pulsemcp-admin-client/pulsemcp-admin-client.integration-mock.js

@@ -940,6 +940,13 @@ export function createMockPulseMCPAdminClient(mockData) {
                 deleted_count: 0,
             };
         },
+        async setPopularityDropBypass(enabled) {
+            return {
+                enabled,
+                enabled_at: enabled ? '2026-06-09T00:00:00Z' : null,
+                enabled_by: enabled ? 'mock-admin' : null,
+            };
+        },
         // Proctor methods
         async runExamForMirror() {
             return {

package/shared/server.d.ts

@@ -1,5 +1,5 @@
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
-import type { Post, PostsResponse, CreatePostParams, UpdatePostParams, ImageUploadResponse, Author, AuthorsResponse, MCPServer, MCPClient, MCPImplementation, MCPImplementationsResponse, SaveMCPImplementationParams, CreateMCPImplementationParams, Provider, ProvidersResponse, OfficialMirrorQueueStatus, OfficialMirrorQueueResponse, OfficialMirrorQueueItemDetail, OfficialMirrorQueueActionResponse, UnofficialMirror, UnofficialMirrorsResponse, CreateUnofficialMirrorParams, UpdateUnofficialMirrorParams, OfficialMirrorRest, OfficialMirrorsResponse, Tenant, TenantsResponse, ListTenantServersResponse, BulkUpdateTenantServersParams, BulkUpdateTenantServersResponse, McpJson, McpJsonsResponse, CreateMcpJsonParams, UpdateMcpJsonParams, UnifiedMCPServer, UnifiedMCPServersResponse, UpdateUnifiedMCPServerParams, Redirect, RedirectsResponse, RedirectStatus, CreateRedirectParams, UpdateRedirectParams, GoodJob, GoodJobsResponse, GoodJobStatus, GoodJobCronSchedule, GoodJobProcess, GoodJobStatistics, GoodJobActionResponse, GoodJobCleanupResponse, ProctorRunExamParams, ProctorRunExamResponse, ProctorSaveResultsParams, ProctorSaveResultsResponse, ProctorRunsResponse, GetProctorRunsParams, ProctorMetadataResponse, DiscoveredUrlsResponse, MarkDiscoveredUrlProcessedParams, MarkDiscoveredUrlProcessedResponse, DiscoveredUrlStats, MozMetricsResponse, MozBacklinksResponse, MozStoredMetricsResponse, CreateTenantParams, ApiKey, CreateApiKeyParams, DeleteTenantParams, DeleteTenantResponse, DeleteApiKeyResponse, RecacheMCPServerResponse, SetKnownMissingInitToolsListResponse } from './types.js';
+import type { Post, PostsResponse, CreatePostParams, UpdatePostParams, ImageUploadResponse, Author, AuthorsResponse, MCPServer, MCPClient, MCPImplementation, MCPImplementationsResponse, SaveMCPImplementationParams, CreateMCPImplementationParams, Provider, ProvidersResponse, OfficialMirrorQueueStatus, OfficialMirrorQueueResponse, OfficialMirrorQueueItemDetail, OfficialMirrorQueueActionResponse, UnofficialMirror, UnofficialMirrorsResponse, CreateUnofficialMirrorParams, UpdateUnofficialMirrorParams, OfficialMirrorRest, OfficialMirrorsResponse, Tenant, TenantsResponse, ListTenantServersResponse, BulkUpdateTenantServersParams, BulkUpdateTenantServersResponse, McpJson, McpJsonsResponse, CreateMcpJsonParams, UpdateMcpJsonParams, UnifiedMCPServer, UnifiedMCPServersResponse, UpdateUnifiedMCPServerParams, Redirect, RedirectsResponse, RedirectStatus, CreateRedirectParams, UpdateRedirectParams, GoodJob, GoodJobsResponse, GoodJobStatus, GoodJobCronSchedule, GoodJobProcess, GoodJobStatistics, GoodJobActionResponse, GoodJobCleanupResponse, PopularityDropBypassStatus, ProctorRunExamParams, ProctorRunExamResponse, ProctorSaveResultsParams, ProctorSaveResultsResponse, ProctorRunsResponse, GetProctorRunsParams, ProctorMetadataResponse, DiscoveredUrlsResponse, MarkDiscoveredUrlProcessedParams, MarkDiscoveredUrlProcessedResponse, DiscoveredUrlStats, MozMetricsResponse, MozBacklinksResponse, MozStoredMetricsResponse, CreateTenantParams, ApiKey, CreateApiKeyParams, DeleteTenantParams, DeleteTenantResponse, DeleteApiKeyResponse, RecacheMCPServerResponse, SetKnownMissingInitToolsListResponse } from './types.js';
 export interface IPulseMCPAdminClient {
     getPosts(params?: {
         search?: string;
@@ -166,6 +166,7 @@ export interface IPulseMCPAdminClient {
     discardGoodJob(id: string): Promise<GoodJobActionResponse>;
     rescheduleGoodJob(id: string, scheduledAt: string): Promise<GoodJobActionResponse>;
     forceTriggerGoodJobCron(cronKey: string): Promise<GoodJobActionResponse>;
+    setPopularityDropBypass(enabled: boolean): Promise<PopularityDropBypassStatus>;
     cleanupGoodJobs(params?: {
         older_than_days?: number;
         status?: GoodJobStatus;
@@ -366,6 +367,7 @@ export declare class PulseMCPAdminClient implements IPulseMCPAdminClient {
     discardGoodJob(id: string): Promise<GoodJobActionResponse>;
     rescheduleGoodJob(id: string, scheduledAt: string): Promise<GoodJobActionResponse>;
     forceTriggerGoodJobCron(cronKey: string): Promise<GoodJobActionResponse>;
+    setPopularityDropBypass(enabled: boolean): Promise<PopularityDropBypassStatus>;
     cleanupGoodJobs(params?: {
         older_than_days?: number;
         status?: GoodJobStatus;

package/shared/server.js

@@ -60,6 +60,7 @@ import { retryGoodJob } from './pulsemcp-admin-client/lib/retry-good-job.js';
 import { discardGoodJob } from './pulsemcp-admin-client/lib/discard-good-job.js';
 import { rescheduleGoodJob } from './pulsemcp-admin-client/lib/reschedule-good-job.js';
 import { forceTriggerGoodJobCron } from './pulsemcp-admin-client/lib/force-trigger-good-job-cron.js';
+import { setPopularityDropBypass } from './pulsemcp-admin-client/lib/set-popularity-drop-bypass.js';
 import { cleanupGoodJobs } from './pulsemcp-admin-client/lib/cleanup-good-jobs.js';
 import { runExamForMirror } from './pulsemcp-admin-client/lib/run-exam-for-mirror.js';
 import { saveResultsForMirror } from './pulsemcp-admin-client/lib/save-results-for-mirror.js';
@@ -293,6 +294,9 @@ export class PulseMCPAdminClient {
     async forceTriggerGoodJobCron(cronKey) {
         return forceTriggerGoodJobCron(this.apiKey, this.baseUrl, cronKey);
     }
+    async setPopularityDropBypass(enabled) {
+        return setPopularityDropBypass(this.apiKey, this.baseUrl, enabled);
+    }
     async cleanupGoodJobs(params) {
         return cleanupGoodJobs(this.apiKey, this.baseUrl, params);
     }

package/shared/tools/save-mcp-implementation.d.ts

@@ -91,6 +91,14 @@ export declare function saveMCPImplementation(_server: Server, clientFactory: Cl
                 type: string;
                 description: "Subfolder path within the repository, for monorepos. Omit for root-level projects.";
             };
+            package_registry: {
+                type: string;
+                description: "(UPDATE ONLY, SERVER ONLY) Package registry: npm, pypi, cargo, etc. To CLEAR (unlink) the server's registry package, pass an empty string for BOTH `package_registry` and `package_name`. Passing an empty string for only one of the two is rejected with a 422 error.";
+            };
+            package_name: {
+                type: string;
+                description: "(UPDATE ONLY, SERVER ONLY) Package name on the registry (e.g., \"@modelcontextprotocol/server-filesystem\"). To CLEAR (unlink) the server's registry package, pass an empty string for BOTH `package_name` and `package_registry`. Passing an empty string for only one of the two is rejected with a 422 error.";
+            };
             remote: {
                 type: string;
                 items: {

package/shared/tools/save-mcp-implementation.js

@@ -48,6 +48,9 @@ const PARAM_DESCRIPTIONS = {
     github_owner: 'GitHub organization or username that owns the repository.',
     github_repo: 'GitHub repository name (without owner prefix).',
     github_subfolder: 'Subfolder path within the repository, for monorepos. Omit for root-level projects.',
+    // Package registry fields (UPDATE only)
+    package_registry: "(UPDATE ONLY, SERVER ONLY) Package registry: npm, pypi, cargo, etc. To CLEAR (unlink) the server's registry package, pass an empty string for BOTH `package_registry` and `package_name`. Passing an empty string for only one of the two is rejected with a 422 error.",
+    package_name: '(UPDATE ONLY, SERVER ONLY) Package name on the registry (e.g., "@modelcontextprotocol/server-filesystem"). To CLEAR (unlink) the server\'s registry package, pass an empty string for BOTH `package_name` and `package_registry`. Passing an empty string for only one of the two is rejected with a 422 error.',
     // Remote endpoints
     remote: 'Array of remote endpoint configurations for MCP servers. Providing this replaces ALL existing remotes. Omitting leaves them unchanged. Pass an empty array to delete all. Each remote can have: id (existing remote ID or blank for new), url_direct, url_setup, transport (e.g., "sse"), host_platform (e.g., "smithery"), host_infrastructure (e.g., "cloudflare"), authentication_method (e.g., "open"), cost (e.g., "free"), status (defaults to "live"), display_name, and internal_notes.',
     // Canonical URLs
@@ -90,6 +93,9 @@ const SaveMCPImplementationSchema = z.object({
     github_owner: z.string().optional().describe(PARAM_DESCRIPTIONS.github_owner),
     github_repo: z.string().optional().describe(PARAM_DESCRIPTIONS.github_repo),
     github_subfolder: z.string().optional().describe(PARAM_DESCRIPTIONS.github_subfolder),
+    // Package registry fields (UPDATE only)
+    package_registry: z.string().optional().describe(PARAM_DESCRIPTIONS.package_registry),
+    package_name: z.string().optional().describe(PARAM_DESCRIPTIONS.package_name),
     // Remote endpoints
     remote: z
         .array(z.object({
@@ -208,6 +214,7 @@ Important notes:
   - \`classification\` and \`implementation_language\` only apply to servers
   - \`provider_name\` reuses existing provider if it matches a provider's slug
 - Setting mcp_server_id or mcp_client_id to null will unlink the association (UPDATE only)
+- Registry package (UPDATE only): pass an empty string for BOTH \`package_registry\` and \`package_name\` to CLEAR (unlink) the link; passing only one as empty is rejected with a 422 error; omitting both leaves the link unchanged
 - Remote endpoints are for MCP servers only and configure how they can be accessed
 - Canonical URLs help identify the authoritative source for the implementation
 - After creating/updating, use \`get_mcp_server\` to verify the full state including remotes and canonical URLs`,
@@ -299,6 +306,15 @@ Important notes:
                     type: 'string',
                     description: PARAM_DESCRIPTIONS.github_subfolder,
                 },
+                // Package registry fields (UPDATE only)
+                package_registry: {
+                    type: 'string',
+                    description: PARAM_DESCRIPTIONS.package_registry,
+                },
+                package_name: {
+                    type: 'string',
+                    description: PARAM_DESCRIPTIONS.package_name,
+                },
                 // Remote endpoints
                 remote: {
                     type: 'array',

package/shared/tools/set-popularity-drop-bypass.d.ts

@@ -0,0 +1,30 @@
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import type { ClientFactory } from '../server.js';
+export declare function setPopularityDropBypass(_server: Server, clientFactory: ClientFactory): {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        properties: {
+            enabled: {
+                type: string;
+                description: "true enables the one-off bypass; false disables it. When enabled, the NEXT run of UpdatePopularityEstimatesFromBigqueryJob flushes the legitimate downward corrections currently held by the SYSTEMIC_DROP guardrail (and clears their popularity_drop_held_since), then the flag auto-resets to false so the bypass never silently stays on.";
+            };
+        };
+        required: string[];
+    };
+    handler: (args: unknown) => Promise<{
+        content: {
+            type: string;
+            text: string;
+        }[];
+        isError?: undefined;
+    } | {
+        content: {
+            type: string;
+            text: string;
+        }[];
+        isError: boolean;
+    }>;
+};
+//# sourceMappingURL=set-popularity-drop-bypass.d.ts.map

package/shared/tools/set-popularity-drop-bypass.js

@@ -0,0 +1,55 @@
+import { z } from 'zod';
+const PARAM_DESCRIPTIONS = {
+    enabled: 'true enables the one-off bypass; false disables it. When enabled, the NEXT run of UpdatePopularityEstimatesFromBigqueryJob flushes the legitimate downward corrections currently held by the SYSTEMIC_DROP guardrail (and clears their popularity_drop_held_since), then the flag auto-resets to false so the bypass never silently stays on.',
+};
+const SetPopularityDropBypassSchema = z.object({
+    enabled: z.boolean().describe(PARAM_DESCRIPTIONS.enabled),
+});
+export function setPopularityDropBypass(_server, clientFactory) {
+    return {
+        name: 'set_popularity_drop_bypass',
+        description: `Enable or disable a deliberate, auditable ONE-OFF bypass of the SYSTEMIC_DROP guardrail in the popularity-estimates pipeline.
+
+Background: UpdatePopularityEstimatesFromBigqueryJob holds large downward popularity corrections when more than ~10% of servers would drop at once (a possible systemic upstream event), keeping each flagged server at its stale value for ~3 days. During a known-legitimate remediation wave (e.g. correcting servers mis-linked to famous registry packages), that guardrail keeps genuinely-corrected servers visible at inflated values.
+
+Enabling this bypass tells the NEXT job run to skip the SYSTEMIC_DROP hold for that single run only: it applies the corrected (dropped) BigQuery values, clears popularity_drop_held_since for the affected servers, then CONSUMES the flag (auto-resets enabled→false). The independent impossible-RISE guardrail is unaffected.
+
+Returns the resulting bypass status (enabled / enabled_at / enabled_by).
+
+Use cases:
+- Enable the bypass before the next scheduled run to flush a known-legitimate correction wave caught in a systemic hold
+- Disable the bypass if it was enabled in error and the next run has not yet consumed it`,
+        inputSchema: {
+            type: 'object',
+            properties: {
+                enabled: { type: 'boolean', description: PARAM_DESCRIPTIONS.enabled },
+            },
+            required: ['enabled'],
+        },
+        handler: async (args) => {
+            const validatedArgs = SetPopularityDropBypassSchema.parse(args);
+            const client = clientFactory();
+            try {
+                const result = await client.setPopularityDropBypass(validatedArgs.enabled);
+                const text = `Popularity drop bypass ${result.enabled ? 'ENABLED' : 'DISABLED'}.
+- enabled: ${result.enabled}
+- enabled_at: ${result.enabled_at ?? '(none)'}
+- enabled_by: ${result.enabled_by ?? '(none)'}${result.enabled
+                    ? '\n\nThe next UpdatePopularityEstimatesFromBigqueryJob run will flush held drops and then auto-reset this flag.'
+                    : ''}`;
+                return { content: [{ type: 'text', text }] };
+            }
+            catch (error) {
+                return {
+                    content: [
+                        {
+                            type: 'text',
+                            text: `Error setting popularity drop bypass: ${error instanceof Error ? error.message : String(error)}`,
+                        },
+                    ],
+                    isError: true,
+                };
+            }
+        },
+    };
+}

package/shared/tools/update-mcp-server.d.ts

@@ -78,11 +78,11 @@ export declare function updateMCPServer(_server: Server, clientFactory: ClientFa
             };
             package_registry: {
                 type: string;
-                description: "Package registry: npm, pypi, cargo, etc.";
+                description: "Package registry: npm, pypi, cargo, etc. To CLEAR (unlink) the server's registry package, pass an empty string for BOTH `package_registry` and `package_name`. Passing an empty string for only one of the two is rejected with a 422 error.";
             };
             package_name: {
                 type: string;
-                description: "Package name on the registry (e.g., \"@modelcontextprotocol/server-filesystem\")";
+                description: "Package name on the registry (e.g., \"@modelcontextprotocol/server-filesystem\"). To CLEAR (unlink) the server's registry package, pass an empty string for BOTH `package_name` and `package_registry`. Passing an empty string for only one of the two is rejected with a 422 error.";
             };
             recommended: {
                 type: string;

package/shared/tools/update-mcp-server.js

@@ -13,8 +13,8 @@ const PARAM_DESCRIPTIONS = {
     provider_slug: 'URL slug for provider (auto-generated from name if omitted)',
     provider_url: 'Website URL for provider',
     source_code: 'GitHub repository information',
-    package_registry: 'Package registry: npm, pypi, cargo, etc.',
-    package_name: 'Package name on the registry (e.g., "@modelcontextprotocol/server-filesystem")',
+    package_registry: "Package registry: npm, pypi, cargo, etc. To CLEAR (unlink) the server's registry package, pass an empty string for BOTH `package_registry` and `package_name`. Passing an empty string for only one of the two is rejected with a 422 error.",
+    package_name: 'Package name on the registry (e.g., "@modelcontextprotocol/server-filesystem"). To CLEAR (unlink) the server\'s registry package, pass an empty string for BOTH `package_name` and `package_registry`. Passing an empty string for only one of the two is rejected with a 422 error.',
     recommended: 'Mark this server as recommended by PulseMCP',
     verified_no_remote_canonicals: 'Mark that this server has been verified to have no remote canonical URLs (true = verified no remote canonicals exist, false = reset/canonicals found)',
     created_on_override: 'Override the automatically derived created date (ISO date string, e.g., "2025-01-15")',
@@ -176,6 +176,26 @@ To update an existing remote, include its ID:
 }
 \`\`\`
 
+## Updating / Clearing the Registry Package Link
+Set the link by providing both fields:
+\`\`\`json
+{
+  "implementation_id": 456,
+  "package_registry": "npm",
+  "package_name": "@modelcontextprotocol/server-filesystem"
+}
+\`\`\`
+
+To **clear** (unlink) the registry package, pass an empty string for **both** fields:
+\`\`\`json
+{
+  "implementation_id": 456,
+  "package_registry": "",
+  "package_name": ""
+}
+\`\`\`
+Passing an empty string for only one of the two is rejected with a 422 error ("Package registry and package name must be provided together"); omitting both leaves the link unchanged.
+
 ## Linking/Creating Provider
 Link existing provider by ID:
 \`\`\`json

package/shared/tools.js

@@ -65,6 +65,7 @@ import { discardGoodJob } from './tools/discard-good-job.js';
 import { rescheduleGoodJob } from './tools/reschedule-good-job.js';
 import { forceTriggerGoodJobCron } from './tools/force-trigger-good-job-cron.js';
 import { cleanupGoodJobs } from './tools/cleanup-good-jobs.js';
+import { setPopularityDropBypass } from './tools/set-popularity-drop-bypass.js';
 // Proctor tools
 import { runExamForMirror } from './tools/run-exam-for-mirror.js';
 import { getExamResult } from './tools/get-exam-result.js';
@@ -263,6 +264,10 @@ const ALL_TOOLS = [
     { factory: rescheduleGoodJob, groups: ['good_jobs'], isWriteOperation: true },
     { factory: forceTriggerGoodJobCron, groups: ['good_jobs'], isWriteOperation: true },
     { factory: cleanupGoodJobs, groups: ['good_jobs'], isWriteOperation: true },
+    // setPopularityDropBypass toggles a one-off bypass of the SYSTEMIC_DROP guardrail in
+    // UpdatePopularityEstimatesFromBigqueryJob. It lives in good_jobs because it controls the
+    // behavior of a background job and is exposed via the same write-enabled good_jobs credential.
+    { factory: setPopularityDropBypass, groups: ['good_jobs'], isWriteOperation: true },
     // Proctor tools
     { factory: runExamForMirror, groups: ['proctor'], isWriteOperation: true },
     { factory: getExamResult, groups: ['proctor'], isWriteOperation: false },

package/shared/types.d.ts

@@ -897,6 +897,11 @@ export interface SetKnownMissingInitToolsListResponse {
     known_missing_init_tools_list: boolean;
     known_missing_init_tools_list_filter_to: string | null;
 }
+export interface PopularityDropBypassStatus {
+    enabled: boolean;
+    enabled_at: string | null;
+    enabled_by: string | null;
+}
 export interface MozMetrics {
     page_authority?: number;
     domain_authority?: number;