pulsemcp-cms-admin-mcp-server 0.10.3 → 0.10.6

package/build/shared/src/tools/link-secret-to-mcp-server.js

@@ -0,0 +1,140 @@
+import { z } from 'zod';
+const PARAM_DESCRIPTIONS = {
+    slug: 'Unique slug identifier for the secret (lowercase, hyphenated, e.g. "linear-api-key"). Used to look up an existing secret or to create a new one.',
+    onepassword_item_id: 'The 1Password item reference the secret value lives in (e.g. "op://Vault/Item/credential"). The raw secret value is NEVER passed through this tool — only this reference. If a secret with this slug already exists, this must match its stored reference.',
+    mcp_server_slug: 'Slug of the MCP server to grant the secret to (e.g. "linear"). The link is what Proctor reads to inject the secret value when running that server.',
+    title: 'Optional human-readable title for the secret (only used when creating a new secret).',
+    description: 'Optional description of what the secret is for (only used when creating a new secret).',
+    onepassword_tag: 'Optional tag scoping which field of the 1Password item to inject for this server (e.g. "production"). Stored on the server↔secret link, so the same secret can inject different fields per server.',
+};
+const LinkSecretToMcpServerSchema = z.object({
+    slug: z.string().describe(PARAM_DESCRIPTIONS.slug),
+    onepassword_item_id: z.string().describe(PARAM_DESCRIPTIONS.onepassword_item_id),
+    mcp_server_slug: z.string().describe(PARAM_DESCRIPTIONS.mcp_server_slug),
+    title: z.string().optional().describe(PARAM_DESCRIPTIONS.title),
+    description: z.string().optional().describe(PARAM_DESCRIPTIONS.description),
+    onepassword_tag: z.string().optional().describe(PARAM_DESCRIPTIONS.onepassword_tag),
+});
+export function linkSecretToMcpServer(_server, clientFactory) {
+    return {
+        name: 'link_secret_to_mcp_server',
+        description: `Make an auth secret available to an MCP server. This upserts a Secret (by slug) that references a 1Password item, then writes the server↔secret link that Proctor reads to inject the secret value at runtime.
+
+The raw secret value stays in 1Password — this tool only deals in the 1Password item reference ("onepassword_item_id") and slug, never a credential value.
+
+Behavior:
+- If no secret with "slug" exists, it is created from "onepassword_item_id" (plus optional title/description).
+- If a secret with "slug" already exists, it is reused. Its stored "onepassword_item_id" must match the one you pass, otherwise the tool errors instead of silently rebinding a shared secret.
+- The link is idempotent: re-running for an already-linked server updates the "onepassword_tag" (when provided) without creating a duplicate.
+
+Example request:
+{
+  "slug": "linear-api-key",
+  "onepassword_item_id": "op://Shared/Linear API Key/credential",
+  "mcp_server_slug": "linear",
+  "onepassword_tag": "production"
+}
+
+Use cases:
+- Onboarding an auth-gated MCP server: register its credential reference and scope it to the server so Proctor can run it.
+- Granting an already-registered secret to an additional server.`,
+        inputSchema: {
+            type: 'object',
+            properties: {
+                slug: { type: 'string', description: PARAM_DESCRIPTIONS.slug },
+                onepassword_item_id: {
+                    type: 'string',
+                    description: PARAM_DESCRIPTIONS.onepassword_item_id,
+                },
+                mcp_server_slug: { type: 'string', description: PARAM_DESCRIPTIONS.mcp_server_slug },
+                title: { type: 'string', description: PARAM_DESCRIPTIONS.title },
+                description: { type: 'string', description: PARAM_DESCRIPTIONS.description },
+                onepassword_tag: { type: 'string', description: PARAM_DESCRIPTIONS.onepassword_tag },
+            },
+            required: ['slug', 'onepassword_item_id', 'mcp_server_slug'],
+        },
+        handler: async (args) => {
+            const validatedArgs = LinkSecretToMcpServerSchema.parse(args);
+            const client = clientFactory();
+            try {
+                const existing = await client.getSecret(validatedArgs.slug);
+                if (existing && existing.onepassword_item_id !== validatedArgs.onepassword_item_id) {
+                    return {
+                        content: [
+                            {
+                                type: 'text',
+                                text: `Error: a secret with slug "${validatedArgs.slug}" already exists but references a different 1Password item ` +
+                                    `("${existing.onepassword_item_id}", not "${validatedArgs.onepassword_item_id}"). ` +
+                                    `Refusing to rebind it, since other servers may depend on it. ` +
+                                    `Use a different slug, or update the existing secret explicitly if the reference really changed.`,
+                            },
+                        ],
+                        isError: true,
+                    };
+                }
+                let created = false;
+                if (!existing) {
+                    try {
+                        await client.createSecret({
+                            slug: validatedArgs.slug,
+                            onepassword_item_id: validatedArgs.onepassword_item_id,
+                            title: validatedArgs.title,
+                            description: validatedArgs.description,
+                        });
+                    }
+                    catch (createError) {
+                        // The backend also enforces uniqueness on onepassword_item_id, so the
+                        // item may already be registered under a *different* slug than the one
+                        // requested. getSecret(slug) can't surface that (it looks up by slug),
+                        // so translate the opaque uniqueness 422 into actionable guidance
+                        // instead of letting the raw validation message reach the agent.
+                        const message = createError instanceof Error ? createError.message : String(createError);
+                        if (/onepassword item/i.test(message) && /taken/i.test(message)) {
+                            return {
+                                content: [
+                                    {
+                                        type: 'text',
+                                        text: `Error: the 1Password item "${validatedArgs.onepassword_item_id}" is already registered under a different secret slug, ` +
+                                            `so it cannot be created again as "${validatedArgs.slug}". ` +
+                                            `To link it to "${validatedArgs.mcp_server_slug}", re-run this tool with the existing secret's slug ` +
+                                            `(find it via the secrets list), or register a different 1Password item under "${validatedArgs.slug}".`,
+                                    },
+                                ],
+                                isError: true,
+                            };
+                        }
+                        throw createError;
+                    }
+                    created = true;
+                }
+                const result = await client.linkSecretToServer({
+                    secret: validatedArgs.slug,
+                    mcp_server_slug: validatedArgs.mcp_server_slug,
+                    onepassword_tag: validatedArgs.onepassword_tag,
+                });
+                let content = `Successfully linked secret "${result.slug}" to MCP server "${result.link.mcp_server_slug}".\n\n`;
+                content += `**Secret:** ${result.slug} (id ${result.id}) — ${created ? 'created' : 'reused existing'}\n`;
+                content += `**1Password item:** ${result.onepassword_item_id}\n`;
+                content += `**Linked server:** ${result.link.mcp_server_slug} (id ${result.link.mcp_server_id})\n`;
+                if (result.link.onepassword_tag) {
+                    content += `**1Password tag:** ${result.link.onepassword_tag}\n`;
+                }
+                if (result.mcp_server_slugs && result.mcp_server_slugs.length > 0) {
+                    content += `**All servers using this secret:** ${result.mcp_server_slugs.join(', ')}\n`;
+                }
+                return { content: [{ type: 'text', text: content }] };
+            }
+            catch (error) {
+                return {
+                    content: [
+                        {
+                            type: 'text',
+                            text: `Error linking secret to MCP server: ${error instanceof Error ? error.message : String(error)}`,
+                        },
+                    ],
+                    isError: true,
+                };
+            }
+        },
+    };
+}

package/build/shared/src/tools/set-github-repository-classification.js

@@ -0,0 +1,73 @@
+import { z } from 'zod';
+const CLASSIFICATION_VALUES = [
+    'single_mcp_server',
+    'single_mcp_client',
+    'multiple_mcp_servers',
+    'multiple_mcp_clients',
+    'other',
+];
+const PARAM_DESCRIPTIONS = {
+    id: 'The integer id of the GitHub repository record (github_repositories.id).',
+    classification: `The classification to set on the GitHub repository. One of: ${CLASSIFICATION_VALUES.join(', ')}.
+
+- single_mcp_server: the repo is a single MCP server (counts toward the gh_stars popularity path).
+- single_mcp_client: the repo is a single MCP client.
+- multiple_mcp_servers: the repo hosts multiple MCP servers.
+- multiple_mcp_clients: the repo hosts multiple MCP clients.
+- other: NOT a single MCP server (e.g. a broader platform where MCP is one incidental feature). Setting "other" excludes the repo from the gh_stars popularity path — int_github_repositories.sql maps it to mcp_server_count = 0, dropping it from the normalized downloads estimate.`,
+};
+const SetGithubRepositoryClassificationSchema = z.object({
+    id: z.number().int().describe(PARAM_DESCRIPTIONS.id),
+    classification: z.enum(CLASSIFICATION_VALUES).describe(PARAM_DESCRIPTIONS.classification),
+});
+export function setGithubRepositoryClassification(_server, clientFactory) {
+    return {
+        name: 'set_github_repository_classification',
+        description: `Set the \`classification\` field on a GitHub repository record (github_repositories). Identifies the repository by its integer id.
+
+The primary use case is tagging a repository as \`other\` ("not a single MCP server") so it stops inflating PulseMCP popularity estimates. When a broad platform repo (e.g. heyputer/puter) carries a large GitHub-star count, the gh_stars path overstates MCP adoption; setting \`classification: "other"\` drops the repo out of that path (int_github_repositories.sql maps "other" to mcp_server_count = 0). The corrected estimate propagates on the next BigQuery warehouse rebuild and the subsequent UpdatePopularityEstimatesFromBigqueryJob run.
+
+Example request:
+{
+  "id": 12345,
+  "classification": "other"
+}
+
+Use cases:
+- Tag a non-MCP-driven platform repo as "other" to exclude it from gh_stars-based popularity
+- Correct a misclassified repository (e.g. a client repo tagged as a server)`,
+        inputSchema: {
+            type: 'object',
+            properties: {
+                id: { type: 'integer', description: PARAM_DESCRIPTIONS.id },
+                classification: {
+                    type: 'string',
+                    enum: [...CLASSIFICATION_VALUES],
+                    description: PARAM_DESCRIPTIONS.classification,
+                },
+            },
+            required: ['id', 'classification'],
+        },
+        handler: async (args) => {
+            const validatedArgs = SetGithubRepositoryClassificationSchema.parse(args);
+            const client = clientFactory();
+            try {
+                const result = await client.setGithubRepositoryClassification(validatedArgs.id, validatedArgs.classification);
+                const text = `Updated GitHub repository (id: ${result.id}):
+- classification: ${result.classification}`;
+                return { content: [{ type: 'text', text }] };
+            }
+            catch (error) {
+                return {
+                    content: [
+                        {
+                            type: 'text',
+                            text: `Error setting github_repository classification: ${error instanceof Error ? error.message : String(error)}`,
+                        },
+                    ],
+                    isError: true,
+                };
+            }
+        },
+    };
+}

package/build/shared/src/tools.js

@@ -48,12 +48,15 @@ import { listMCPServers } from './tools/list-mcp-servers.js';
 import { getMCPServer } from './tools/get-mcp-server.js';
 import { updateMCPServer } from './tools/update-mcp-server.js';
 import { recacheMCPServer } from './tools/recache-mcp-server.js';
+import { setGithubRepositoryClassification } from './tools/set-github-repository-classification.js';
 // Redirect tools
 import { getRedirects } from './tools/get-redirects.js';
 import { getRedirect } from './tools/get-redirect.js';
 import { createRedirect } from './tools/create-redirect.js';
 import { updateRedirect } from './tools/update-redirect.js';
 import { deleteRedirect } from './tools/delete-redirect.js';
+// Secret tools
+import { linkSecretToMcpServer } from './tools/link-secret-to-mcp-server.js';
 // GoodJob tools
 import { listGoodJobs } from './tools/list-good-jobs.js';
 import { getGoodJob } from './tools/get-good-job.js';
@@ -253,6 +256,8 @@ const ALL_TOOLS = [
     { factory: createRedirect, groups: ['redirects'], isWriteOperation: true },
     { factory: updateRedirect, groups: ['redirects'], isWriteOperation: true },
     { factory: deleteRedirect, groups: ['redirects'], isWriteOperation: true },
+    // Secret tools (write-only: upsert a secret + write the mcp_servers_secrets join Proctor reads)
+    { factory: linkSecretToMcpServer, groups: ['secrets'], isWriteOperation: true },
     // GoodJob tools
     { factory: listGoodJobs, groups: ['good_jobs'], isWriteOperation: false },
     { factory: getGoodJob, groups: ['good_jobs'], isWriteOperation: false },
@@ -281,6 +286,16 @@ const ALL_TOOLS = [
         groups: ['mcp_servers', 'server_directory'],
         isWriteOperation: true,
     },
+    // setGithubRepositoryClassification writes the `classification` field on a
+    // `github_repository` record (e.g. tagging a non-MCP-driven platform repo as
+    // `other` so it drops out of the gh_stars popularity path). It lives in the
+    // mcp_servers / server_directory groups alongside the other server-directory
+    // data-correction tools.
+    {
+        factory: setGithubRepositoryClassification,
+        groups: ['mcp_servers', 'server_directory'],
+        isWriteOperation: true,
+    },
     // Discovered URLs tools
     { factory: listDiscoveredUrls, groups: ['discovered_urls'], isWriteOperation: false },
     {
@@ -317,6 +332,7 @@ const VALID_TOOL_GROUPS = [
     'mcp_servers_readonly',
     'redirects',
     'redirects_readonly',
+    'secrets',
     'good_jobs',
     'good_jobs_readonly',
     'proctor',
@@ -340,6 +356,7 @@ const BASE_TOOL_GROUPS = [
     'mcp_jsons',
     'mcp_servers',
     'redirects',
+    'secrets',
     'good_jobs',
     'proctor',
     'discovered_urls',

package/node_modules/@pulsemcp/mcp-elicitation/package.json

@@ -23,6 +23,6 @@
   "devDependencies": {
     "@types/node": "^24.10.12",
     "typescript": "^5.7.3",
-    "vitest": "^4.1.8"
+    "vitest": "^4.1.9"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pulsemcp-cms-admin-mcp-server",
-  "version": "0.10.3",
+  "version": "0.10.6",
   "description": "Local implementation of PulseMCP CMS Admin MCP server",
   "mcpName": "com.pulsemcp/pulsemcp-cms-admin",
   "main": "build/index.js",

package/shared/pulsemcp-admin-client/lib/create-secret.d.ts

@@ -0,0 +1,7 @@
+import type { Secret, CreateSecretParams } from '../../types.js';
+/**
+ * Create a secret. The secret's value stays in 1Password — this only records
+ * the `onepassword_item_id` reference plus metadata.
+ */
+export declare function createSecret(apiKey: string, baseUrl: string, params: CreateSecretParams): Promise<Secret>;
+//# sourceMappingURL=create-secret.d.ts.map

package/shared/pulsemcp-admin-client/lib/create-secret.js

@@ -0,0 +1,41 @@
+import { adminFetch } from './admin-fetch.js';
+/**
+ * Create a secret. The secret's value stays in 1Password — this only records
+ * the `onepassword_item_id` reference plus metadata.
+ */
+export async function createSecret(apiKey, baseUrl, params) {
+    const url = new URL('/api/secrets', baseUrl);
+    const body = {
+        slug: params.slug,
+        onepassword_item_id: params.onepassword_item_id,
+    };
+    if (params.title !== undefined) {
+        body.title = params.title;
+    }
+    if (params.description !== undefined) {
+        body.description = params.description;
+    }
+    const response = await adminFetch(url.toString(), {
+        method: 'POST',
+        headers: {
+            'X-API-Key': apiKey,
+            'Content-Type': 'application/json',
+            Accept: 'application/json',
+        },
+        body: JSON.stringify(body),
+    });
+    if (!response.ok) {
+        if (response.status === 401) {
+            throw new Error('Invalid API key');
+        }
+        if (response.status === 403) {
+            throw new Error('User lacks write privileges');
+        }
+        if (response.status === 422) {
+            const errorData = (await response.json());
+            throw new Error(`Validation failed: ${errorData.errors?.join(', ') || 'Unknown error'}`);
+        }
+        throw new Error(`Failed to create secret: ${response.status} ${response.statusText}`);
+    }
+    return (await response.json());
+}

package/shared/pulsemcp-admin-client/lib/get-secret.d.ts

@@ -0,0 +1,7 @@
+import type { Secret } from '../../types.js';
+/**
+ * Fetch a secret by id or slug. Returns null when the secret does not exist
+ * (HTTP 404) so callers can branch on create-vs-reuse without catching errors.
+ */
+export declare function getSecret(apiKey: string, baseUrl: string, idOrSlug: string | number): Promise<Secret | null>;
+//# sourceMappingURL=get-secret.d.ts.map

package/shared/pulsemcp-admin-client/lib/get-secret.js

@@ -0,0 +1,28 @@
+import { adminFetch } from './admin-fetch.js';
+/**
+ * Fetch a secret by id or slug. Returns null when the secret does not exist
+ * (HTTP 404) so callers can branch on create-vs-reuse without catching errors.
+ */
+export async function getSecret(apiKey, baseUrl, idOrSlug) {
+    const url = new URL(`/api/secrets/${encodeURIComponent(String(idOrSlug))}`, baseUrl);
+    const response = await adminFetch(url.toString(), {
+        method: 'GET',
+        headers: {
+            'X-API-Key': apiKey,
+            Accept: 'application/json',
+        },
+    });
+    if (!response.ok) {
+        if (response.status === 404) {
+            return null;
+        }
+        if (response.status === 401) {
+            throw new Error('Invalid API key');
+        }
+        if (response.status === 403) {
+            throw new Error('User lacks admin privileges');
+        }
+        throw new Error(`Failed to fetch secret: ${response.status} ${response.statusText}`);
+    }
+    return (await response.json());
+}

package/shared/pulsemcp-admin-client/lib/link-secret-to-server.d.ts

@@ -0,0 +1,12 @@
+import type { LinkSecretToServerParams, SecretWithLink } from '../../types.js';
+/**
+ * Link an MCP server to a secret by writing the mcp_servers_secrets join row.
+ * This join is what Proctor reads to inject the secret value at runtime, so it
+ * is the operation that actually scopes a stored secret to a server.
+ *
+ * Idempotent on the backend: relinking an already-linked server returns the
+ * existing join (updating onepassword_tag when a new value is supplied) instead
+ * of erroring or duplicating.
+ */
+export declare function linkSecretToServer(apiKey: string, baseUrl: string, params: LinkSecretToServerParams): Promise<SecretWithLink>;
+//# sourceMappingURL=link-secret-to-server.d.ts.map

package/shared/pulsemcp-admin-client/lib/link-secret-to-server.js

@@ -0,0 +1,50 @@
+import { adminFetch } from './admin-fetch.js';
+/**
+ * Link an MCP server to a secret by writing the mcp_servers_secrets join row.
+ * This join is what Proctor reads to inject the secret value at runtime, so it
+ * is the operation that actually scopes a stored secret to a server.
+ *
+ * Idempotent on the backend: relinking an already-linked server returns the
+ * existing join (updating onepassword_tag when a new value is supplied) instead
+ * of erroring or duplicating.
+ */
+export async function linkSecretToServer(apiKey, baseUrl, params) {
+    const url = new URL(`/api/secrets/${encodeURIComponent(String(params.secret))}/servers`, baseUrl);
+    const body = {};
+    if (params.mcp_server_id !== undefined) {
+        body.mcp_server_id = params.mcp_server_id;
+    }
+    if (params.mcp_server_slug !== undefined) {
+        body.mcp_server_slug = params.mcp_server_slug;
+    }
+    if (params.onepassword_tag !== undefined) {
+        body.onepassword_tag = params.onepassword_tag;
+    }
+    const response = await adminFetch(url.toString(), {
+        method: 'POST',
+        headers: {
+            'X-API-Key': apiKey,
+            'Content-Type': 'application/json',
+            Accept: 'application/json',
+        },
+        body: JSON.stringify(body),
+    });
+    if (!response.ok) {
+        if (response.status === 401) {
+            throw new Error('Invalid API key');
+        }
+        if (response.status === 403) {
+            throw new Error('User lacks write privileges');
+        }
+        if (response.status === 404) {
+            const errorData = (await response.json().catch(() => ({})));
+            throw new Error(errorData.error || 'Secret or MCP server not found');
+        }
+        if (response.status === 422) {
+            const errorData = (await response.json());
+            throw new Error(`Validation failed: ${errorData.errors?.join(', ') || 'Unknown error'}`);
+        }
+        throw new Error(`Failed to link secret to server: ${response.status} ${response.statusText}`);
+    }
+    return (await response.json());
+}

package/shared/pulsemcp-admin-client/lib/set-github-repository-classification.d.ts

@@ -0,0 +1,3 @@
+import type { GithubRepositoryClassification, SetGithubRepositoryClassificationResponse } from '../../types.js';
+export declare function setGithubRepositoryClassification(apiKey: string, baseUrl: string, id: number, classification: GithubRepositoryClassification): Promise<SetGithubRepositoryClassificationResponse>;
+//# sourceMappingURL=set-github-repository-classification.d.ts.map

package/shared/pulsemcp-admin-client/lib/set-github-repository-classification.js

@@ -0,0 +1,38 @@
+import { adminFetch } from './admin-fetch.js';
+export async function setGithubRepositoryClassification(apiKey, baseUrl, id, classification) {
+    const url = new URL(`/api/github_repositories/${id}/classification`, baseUrl);
+    const body = {
+        classification,
+    };
+    const response = await adminFetch(url.toString(), {
+        method: 'POST',
+        headers: {
+            'X-API-Key': apiKey,
+            Accept: 'application/json',
+            'Content-Type': 'application/json',
+        },
+        body: JSON.stringify(body),
+    });
+    if (!response.ok) {
+        if (response.status === 401) {
+            throw new Error('Invalid API key');
+        }
+        if (response.status === 403) {
+            throw new Error('User lacks write privileges');
+        }
+        if (response.status === 404) {
+            throw new Error(`GitHub repository not found: ${id}`);
+        }
+        if (response.status === 400) {
+            const errBody = (await response.json().catch(() => ({})));
+            throw new Error(errBody.error ?? 'Bad request');
+        }
+        if (response.status === 422) {
+            const errBody = (await response.json().catch(() => ({})));
+            const detailStr = errBody.details?.length ? ` (${errBody.details.join(', ')})` : '';
+            throw new Error(`${errBody.error ?? 'Validation failed'}${detailStr}`);
+        }
+        throw new Error(`Failed to set github_repository classification: ${response.status} ${response.statusText}`);
+    }
+    return (await response.json());
+}

package/shared/pulsemcp-admin-client/pulsemcp-admin-client.integration-mock.d.ts

@@ -1,5 +1,5 @@
 import type { IPulseMCPAdminClient } from '../server.js';
-import type { Post, ImageUploadResponse, Author, MCPServer, MCPClient, MCPImplementation, MCPImplementationsResponse, Provider, ProvidersResponse, OfficialMirrorQueueItem, OfficialMirrorQueueItemDetail, OfficialMirrorQueueResponse, OfficialMirrorQueueActionResponse } from '../types.js';
+import type { Post, ImageUploadResponse, Author, MCPServer, MCPClient, MCPImplementation, MCPImplementationsResponse, Provider, ProvidersResponse, OfficialMirrorQueueItem, OfficialMirrorQueueItemDetail, OfficialMirrorQueueResponse, OfficialMirrorQueueActionResponse, Secret, SecretWithLink } from '../types.js';
 interface MockData {
     posts?: Post[];
     postsBySlug?: Record<string, Post>;
@@ -19,6 +19,9 @@ interface MockData {
     officialMirrorQueueItemsResponse?: OfficialMirrorQueueResponse;
     officialMirrorQueueItemDetail?: OfficialMirrorQueueItemDetail;
     officialMirrorQueueActionResponse?: OfficialMirrorQueueActionResponse;
+    secretsBySlug?: Record<string, Secret>;
+    createSecretResponse?: Secret;
+    linkSecretToServerResponse?: SecretWithLink;
     errors?: {
         getPosts?: Error;
         getPost?: Error;
@@ -42,6 +45,9 @@ interface MockData {
         rejectOfficialMirrorQueueItem?: Error;
         addOfficialMirrorToRegularQueue?: Error;
         unlinkOfficialMirrorQueueItem?: Error;
+        getSecret?: Error;
+        createSecret?: Error;
+        linkSecretToServer?: Error;
     };
 }
 export declare function createMockPulseMCPAdminClient(mockData: MockData): IPulseMCPAdminClient;

package/shared/pulsemcp-admin-client/pulsemcp-admin-client.integration-mock.js

@@ -1099,5 +1099,64 @@ export function createMockPulseMCPAdminClient(mockData) {
                     : (knownMissingInitToolsListFilterTo ?? null),
             };
         },
+        async setGithubRepositoryClassification(id, classification) {
+            return {
+                id,
+                classification,
+            };
+        },
+        // Secret REST API methods
+        async getSecret(idOrSlug) {
+            if (mockData.errors?.getSecret) {
+                throw mockData.errors.getSecret;
+            }
+            const key = String(idOrSlug);
+            return mockData.secretsBySlug?.[key] ?? null;
+        },
+        async createSecret(params) {
+            if (mockData.errors?.createSecret) {
+                throw mockData.errors.createSecret;
+            }
+            if (mockData.createSecretResponse) {
+                return mockData.createSecretResponse;
+            }
+            return {
+                id: 1,
+                slug: params.slug,
+                onepassword_item_id: params.onepassword_item_id,
+                title: params.title ?? null,
+                description: params.description ?? null,
+                mcp_servers_count: 0,
+                mcp_server_slugs: [],
+                created_at: new Date().toISOString(),
+                updated_at: new Date().toISOString(),
+            };
+        },
+        async linkSecretToServer(params) {
+            if (mockData.errors?.linkSecretToServer) {
+                throw mockData.errors.linkSecretToServer;
+            }
+            if (mockData.linkSecretToServerResponse) {
+                return mockData.linkSecretToServerResponse;
+            }
+            const slug = typeof params.secret === 'string' ? params.secret : `secret-${params.secret}`;
+            const serverSlug = params.mcp_server_slug ?? 'mock-server';
+            return {
+                id: 1,
+                slug,
+                onepassword_item_id: 'op://Vault/Item/credential',
+                title: null,
+                description: null,
+                mcp_servers_count: 1,
+                mcp_server_slugs: [serverSlug],
+                created_at: new Date().toISOString(),
+                updated_at: new Date().toISOString(),
+                link: {
+                    mcp_server_id: params.mcp_server_id ?? 1,
+                    mcp_server_slug: serverSlug,
+                    onepassword_tag: params.onepassword_tag ?? null,
+                },
+            };
+        },
     };
 }

package/shared/server.d.ts

@@ -1,5 +1,5 @@
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
-import type { Post, PostsResponse, CreatePostParams, UpdatePostParams, ImageUploadResponse, Author, AuthorsResponse, MCPServer, MCPClient, MCPImplementation, MCPImplementationsResponse, SaveMCPImplementationParams, CreateMCPImplementationParams, Provider, ProvidersResponse, OfficialMirrorQueueStatus, OfficialMirrorQueueResponse, OfficialMirrorQueueItemDetail, OfficialMirrorQueueActionResponse, UnofficialMirror, UnofficialMirrorsResponse, CreateUnofficialMirrorParams, UpdateUnofficialMirrorParams, OfficialMirrorRest, OfficialMirrorsResponse, Tenant, TenantsResponse, ListTenantServersResponse, BulkUpdateTenantServersParams, BulkUpdateTenantServersResponse, McpJson, McpJsonsResponse, CreateMcpJsonParams, UpdateMcpJsonParams, UnifiedMCPServer, UnifiedMCPServersResponse, UpdateUnifiedMCPServerParams, Redirect, RedirectsResponse, RedirectStatus, CreateRedirectParams, UpdateRedirectParams, GoodJob, GoodJobsResponse, GoodJobStatus, GoodJobCronSchedule, GoodJobProcess, GoodJobStatistics, GoodJobActionResponse, GoodJobCleanupResponse, PopularityDropBypassStatus, ProctorRunExamParams, ProctorRunExamResponse, ProctorSaveResultsParams, ProctorSaveResultsResponse, ProctorRunsResponse, GetProctorRunsParams, ProctorMetadataResponse, DiscoveredUrlsResponse, MarkDiscoveredUrlProcessedParams, MarkDiscoveredUrlProcessedResponse, DiscoveredUrlStats, MozMetricsResponse, MozBacklinksResponse, MozStoredMetricsResponse, CreateTenantParams, ApiKey, CreateApiKeyParams, DeleteTenantParams, DeleteTenantResponse, DeleteApiKeyResponse, RecacheMCPServerResponse, SetKnownMissingInitToolsListResponse } from './types.js';
+import type { Post, PostsResponse, CreatePostParams, UpdatePostParams, ImageUploadResponse, Author, AuthorsResponse, MCPServer, MCPClient, MCPImplementation, MCPImplementationsResponse, SaveMCPImplementationParams, CreateMCPImplementationParams, Provider, ProvidersResponse, OfficialMirrorQueueStatus, OfficialMirrorQueueResponse, OfficialMirrorQueueItemDetail, OfficialMirrorQueueActionResponse, UnofficialMirror, UnofficialMirrorsResponse, CreateUnofficialMirrorParams, UpdateUnofficialMirrorParams, OfficialMirrorRest, OfficialMirrorsResponse, Tenant, TenantsResponse, ListTenantServersResponse, BulkUpdateTenantServersParams, BulkUpdateTenantServersResponse, McpJson, McpJsonsResponse, CreateMcpJsonParams, UpdateMcpJsonParams, UnifiedMCPServer, UnifiedMCPServersResponse, UpdateUnifiedMCPServerParams, Redirect, RedirectsResponse, RedirectStatus, CreateRedirectParams, UpdateRedirectParams, Secret, CreateSecretParams, LinkSecretToServerParams, SecretWithLink, GoodJob, GoodJobsResponse, GoodJobStatus, GoodJobCronSchedule, GoodJobProcess, GoodJobStatistics, GoodJobActionResponse, GoodJobCleanupResponse, PopularityDropBypassStatus, ProctorRunExamParams, ProctorRunExamResponse, ProctorSaveResultsParams, ProctorSaveResultsResponse, ProctorRunsResponse, GetProctorRunsParams, ProctorMetadataResponse, DiscoveredUrlsResponse, MarkDiscoveredUrlProcessedParams, MarkDiscoveredUrlProcessedResponse, DiscoveredUrlStats, MozMetricsResponse, MozBacklinksResponse, MozStoredMetricsResponse, CreateTenantParams, ApiKey, CreateApiKeyParams, DeleteTenantParams, DeleteTenantResponse, DeleteApiKeyResponse, RecacheMCPServerResponse, SetKnownMissingInitToolsListResponse, GithubRepositoryClassification, SetGithubRepositoryClassificationResponse } from './types.js';
 export interface IPulseMCPAdminClient {
     getPosts(params?: {
         search?: string;
@@ -136,6 +136,7 @@ export interface IPulseMCPAdminClient {
     updateUnifiedMCPServer(implementationId: number, params: UpdateUnifiedMCPServerParams): Promise<UnifiedMCPServer>;
     recacheMCPServer(slug: string): Promise<RecacheMCPServerResponse>;
     setKnownMissingInitToolsList(id: number, knownMissingInitToolsList: boolean, knownMissingInitToolsListFilterTo?: string | null): Promise<SetKnownMissingInitToolsListResponse>;
+    setGithubRepositoryClassification(id: number, classification: GithubRepositoryClassification): Promise<SetGithubRepositoryClassificationResponse>;
     getRedirects(params?: {
         q?: string;
         status?: RedirectStatus;
@@ -149,6 +150,9 @@ export interface IPulseMCPAdminClient {
         success: boolean;
         message: string;
     }>;
+    getSecret(idOrSlug: string | number): Promise<Secret | null>;
+    createSecret(params: CreateSecretParams): Promise<Secret>;
+    linkSecretToServer(params: LinkSecretToServerParams): Promise<SecretWithLink>;
     getGoodJobs(params?: {
         queue_name?: string;
         status?: GoodJobStatus;
@@ -337,6 +341,7 @@ export declare class PulseMCPAdminClient implements IPulseMCPAdminClient {
     updateUnifiedMCPServer(implementationId: number, params: UpdateUnifiedMCPServerParams): Promise<UnifiedMCPServer>;
     recacheMCPServer(slug: string): Promise<RecacheMCPServerResponse>;
     setKnownMissingInitToolsList(id: number, knownMissingInitToolsList: boolean, knownMissingInitToolsListFilterTo?: string | null): Promise<SetKnownMissingInitToolsListResponse>;
+    setGithubRepositoryClassification(id: number, classification: GithubRepositoryClassification): Promise<SetGithubRepositoryClassificationResponse>;
     getRedirects(params?: {
         q?: string;
         status?: RedirectStatus;
@@ -350,6 +355,9 @@ export declare class PulseMCPAdminClient implements IPulseMCPAdminClient {
         success: boolean;
         message: string;
     }>;
+    getSecret(idOrSlug: string | number): Promise<Secret | null>;
+    createSecret(params: CreateSecretParams): Promise<Secret>;
+    linkSecretToServer(params: LinkSecretToServerParams): Promise<SecretWithLink>;
     getGoodJobs(params?: {
         queue_name?: string;
         status?: GoodJobStatus;