pulsemcp-cms-admin-mcp-server 0.9.13 → 0.9.15

package/build/shared/src/tools/create-api-key.js

@@ -0,0 +1,78 @@
+import { z } from 'zod';
+const PARAM_DESCRIPTIONS = {
+    tenant_slug: 'The slug of the tenant to create the API key for',
+    name: 'Optional display name for the API key',
+    permission_level: 'Permission level for the key: read_only, read_and_upsert, or full_access. Defaults to full_access.',
+};
+const CreateApiKeySchema = z.object({
+    tenant_slug: z.string().describe(PARAM_DESCRIPTIONS.tenant_slug),
+    name: z.string().optional().describe(PARAM_DESCRIPTIONS.name),
+    permission_level: z
+        .enum(['read_only', 'read_and_upsert', 'full_access'])
+        .optional()
+        .describe(PARAM_DESCRIPTIONS.permission_level),
+});
+export function createApiKey(_server, clientFactory) {
+    return {
+        name: 'create_api_key',
+        description: `Create an API key for a specified tenant. Returns the raw key value, which is only available at creation time.
+
+Example request:
+{
+  "tenant_slug": "acme-corp",
+  "name": "Production Key",
+  "permission_level": "read_and_upsert"
+}
+
+Use cases:
+- Provision API access for a new tenant
+- Create keys with specific permission levels for different use cases
+- Generate read-only keys for monitoring integrations`,
+        inputSchema: {
+            type: 'object',
+            properties: {
+                tenant_slug: { type: 'string', description: PARAM_DESCRIPTIONS.tenant_slug },
+                name: { type: 'string', description: PARAM_DESCRIPTIONS.name },
+                permission_level: {
+                    type: 'string',
+                    enum: ['read_only', 'read_and_upsert', 'full_access'],
+                    description: PARAM_DESCRIPTIONS.permission_level,
+                },
+            },
+            required: ['tenant_slug'],
+        },
+        handler: async (args) => {
+            const validatedArgs = CreateApiKeySchema.parse(args);
+            const client = clientFactory();
+            try {
+                const apiKey = await client.createApiKey({
+                    tenant_slug: validatedArgs.tenant_slug,
+                    name: validatedArgs.name,
+                    permission_level: validatedArgs.permission_level,
+                });
+                let content = `Successfully created API key!\n\n`;
+                content += `**ID:** ${apiKey.id}\n`;
+                if (apiKey.name) {
+                    content += `**Name:** ${apiKey.name}\n`;
+                }
+                content += `**Tenant:** ${apiKey.tenant_slug} (ID: ${apiKey.tenant_id})\n`;
+                content += `**Permission Level:** ${apiKey.permission_level}\n`;
+                content += `**Key:** \`${apiKey.key}\`\n`;
+                content += `**Created:** ${apiKey.created_at}\n`;
+                content += `\n> **Important:** Save this key now — it cannot be retrieved again.`;
+                return { content: [{ type: 'text', text: content }] };
+            }
+            catch (error) {
+                return {
+                    content: [
+                        {
+                            type: 'text',
+                            text: `Error creating API key: ${error instanceof Error ? error.message : String(error)}`,
+                        },
+                    ],
+                    isError: true,
+                };
+            }
+        },
+    };
+}

package/build/shared/src/tools/create-tenant.js

@@ -0,0 +1,58 @@
+import { z } from 'zod';
+const PARAM_DESCRIPTIONS = {
+    slug: 'Unique slug identifier for the new tenant (e.g., "acme-corp")',
+};
+const CreateTenantSchema = z.object({
+    slug: z.string().describe(PARAM_DESCRIPTIONS.slug),
+});
+export function createTenant(_server, clientFactory) {
+    return {
+        name: 'create_tenant',
+        description: `Create a new tenant for sub-registry provisioning.
+
+Example request:
+{
+  "slug": "acme-corp"
+}
+
+Use cases:
+- Provision a new sub-registry tenant
+- Set up a new organization in the PulseMCP platform`,
+        inputSchema: {
+            type: 'object',
+            properties: {
+                slug: { type: 'string', description: PARAM_DESCRIPTIONS.slug },
+            },
+            required: ['slug'],
+        },
+        handler: async (args) => {
+            const validatedArgs = CreateTenantSchema.parse(args);
+            const client = clientFactory();
+            try {
+                const tenant = await client.createTenant({ slug: validatedArgs.slug });
+                let content = `Successfully created tenant!\n\n`;
+                content += `**ID:** ${tenant.id}\n`;
+                content += `**Slug:** ${tenant.slug}\n`;
+                content += `**Admin:** ${tenant.is_admin ? 'Yes' : 'No'}\n`;
+                if (tenant.enrichments && Object.keys(tenant.enrichments).length > 0) {
+                    content += `**Enrichments:** ${Object.keys(tenant.enrichments).join(', ')}\n`;
+                }
+                if (tenant.created_at) {
+                    content += `**Created:** ${tenant.created_at}\n`;
+                }
+                return { content: [{ type: 'text', text: content }] };
+            }
+            catch (error) {
+                return {
+                    content: [
+                        {
+                            type: 'text',
+                            text: `Error creating tenant: ${error instanceof Error ? error.message : String(error)}`,
+                        },
+                    ],
+                    isError: true,
+                };
+            }
+        },
+    };
+}

package/build/shared/src/tools/recache-mcp-server.js

@@ -0,0 +1,49 @@
+import { z } from 'zod';
+const PARAM_DESCRIPTIONS = {
+    slug: 'The slug of the MCP server to recache (e.g., "filesystem")',
+};
+const RecacheMCPServerSchema = z.object({
+    slug: z.string().describe(PARAM_DESCRIPTIONS.slug),
+});
+export function recacheMCPServer(_server, clientFactory) {
+    return {
+        name: 'recache_mcp_server',
+        description: `Refresh the cache for a specific MCP server. Clears and warms the show page, card fragments across all sort variations, canonical URLs, and parent pages.
+
+Example request:
+{
+  "slug": "filesystem"
+}
+
+Use cases:
+- Force a cache refresh after updating server data
+- Fix stale cache entries for a specific server
+- Warm caches after content changes`,
+        inputSchema: {
+            type: 'object',
+            properties: {
+                slug: { type: 'string', description: PARAM_DESCRIPTIONS.slug },
+            },
+            required: ['slug'],
+        },
+        handler: async (args) => {
+            const validatedArgs = RecacheMCPServerSchema.parse(args);
+            const client = clientFactory();
+            try {
+                const result = await client.recacheMCPServer(validatedArgs.slug);
+                return { content: [{ type: 'text', text: result.message }] };
+            }
+            catch (error) {
+                return {
+                    content: [
+                        {
+                            type: 'text',
+                            text: `Error recaching MCP server: ${error instanceof Error ? error.message : String(error)}`,
+                        },
+                    ],
+                    isError: true,
+                };
+            }
+        },
+    };
+}

package/build/shared/src/tools.js

@@ -26,9 +26,11 @@ import { deleteUnofficialMirror } from './tools/delete-unofficial-mirror.js';
 // Official mirrors REST tools (read-only)
 import { getOfficialMirrors } from './tools/get-official-mirrors.js';
 import { getOfficialMirror } from './tools/get-official-mirror.js';
-// Tenant tools (read-only)
+// Tenant tools
 import { getTenants } from './tools/get-tenants.js';
 import { getTenant } from './tools/get-tenant.js';
+import { createTenant } from './tools/create-tenant.js';
+import { createApiKey } from './tools/create-api-key.js';
 // MCP JSON tools
 import { getMcpJsons } from './tools/get-mcp-jsons.js';
 import { getMcpJson } from './tools/get-mcp-json.js';
@@ -39,6 +41,7 @@ import { deleteMcpJson } from './tools/delete-mcp-json.js';
 import { listMCPServers } from './tools/list-mcp-servers.js';
 import { getMCPServer } from './tools/get-mcp-server.js';
 import { updateMCPServer } from './tools/update-mcp-server.js';
+import { recacheMCPServer } from './tools/recache-mcp-server.js';
 // Redirect tools
 import { getRedirects } from './tools/get-redirects.js';
 import { getRedirect } from './tools/get-redirect.js';
@@ -170,9 +173,11 @@ const ALL_TOOLS = [
         groups: ['official_mirrors', 'server_directory'],
         isWriteOperation: false,
     },
-    // Tenant tools (read-only)
+    // Tenant tools
     { factory: getTenants, groups: ['tenants'], isWriteOperation: false },
     { factory: getTenant, groups: ['tenants'], isWriteOperation: false },
+    { factory: createTenant, groups: ['tenants'], isWriteOperation: true },
+    { factory: createApiKey, groups: ['tenants'], isWriteOperation: true },
     // MCP JSON tools (CRUD) (also in server_directory)
     {
         factory: getMcpJsons,
@@ -215,6 +220,11 @@ const ALL_TOOLS = [
         groups: ['mcp_servers', 'server_directory'],
         isWriteOperation: true,
     },
+    {
+        factory: recacheMCPServer,
+        groups: ['mcp_servers', 'server_directory'],
+        isWriteOperation: true,
+    },
     // Redirect tools (CRUD)
     { factory: getRedirects, groups: ['redirects'], isWriteOperation: false },
     { factory: getRedirect, groups: ['redirects'], isWriteOperation: false },
@@ -372,6 +382,7 @@ function shouldIncludeTool(toolDef, enabledGroups) {
  * - unofficial_mirrors: Unofficial mirror CRUD tools (read + write)
  * - unofficial_mirrors_readonly: Unofficial mirror tools (read only)
  * - official_mirrors_readonly: Official mirrors REST API tools (read only)
+ * - tenants: Tenant management tools including API key provisioning (read + write)
  * - tenants_readonly: Tenant tools (read only)
  * - mcp_jsons: MCP JSON configuration tools (read + write)
  * - mcp_jsons_readonly: MCP JSON tools (read only)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pulsemcp-cms-admin-mcp-server",
-  "version": "0.9.13",
+  "version": "0.9.15",
   "description": "Local implementation of PulseMCP CMS Admin MCP server",
   "mcpName": "com.pulsemcp.servers/pulsemcp-cms-admin",
   "main": "build/index.js",
@@ -30,7 +30,7 @@
     "stage-publish": "npm version"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.19.1",
+    "@modelcontextprotocol/sdk": "^1.29.0",
     "zod": "^3.24.1"
   },
   "devDependencies": {

package/shared/pulsemcp-admin-client/lib/add-official-mirror-to-regular-queue.js

@@ -1,3 +1,4 @@
+import { adminFetch } from './admin-fetch.js';
 function mapQueueItem(item) {
     return {
         id: item.id,
@@ -23,7 +24,7 @@ function mapQueueItem(item) {
 }
 export async function addOfficialMirrorToRegularQueue(apiKey, baseUrl, id) {
     const url = new URL(`/api/official_mirror_queues/${id}/add_to_regular_queue`, baseUrl);
-    const response = await fetch(url.toString(), {
+    const response = await adminFetch(url.toString(), {
         method: 'POST',
         headers: {
             'X-API-Key': apiKey,

package/shared/pulsemcp-admin-client/lib/admin-fetch.d.ts

@@ -0,0 +1,6 @@
+export interface AdminFetchDeps {
+    fetchFn?: typeof fetch;
+    getInternalSecret?: () => string | undefined;
+}
+export declare function adminFetch(input: string | URL, init?: RequestInit, deps?: AdminFetchDeps): Promise<Response>;
+//# sourceMappingURL=admin-fetch.d.ts.map

package/shared/pulsemcp-admin-client/lib/admin-fetch.js

@@ -0,0 +1,33 @@
+// The admin API origin (admin.pulsemcp.com) sits behind Cloudflare, which
+// applies rate limits (100 GET/min/IP → Managed Challenge) and Super Bot
+// Fight Mode to all traffic. Internal clients (this MCP server, the discovery
+// pipeline, etc.) can trip those rules and see spurious 403s even when their
+// X-API-Key is valid. A Cloudflare custom rule skips the WAF stack when the
+// X-PulseMCP-Internal header carries a shared secret.
+//
+// This helper wraps fetch() and injects that header from the env var
+// PULSEMCP_ADMIN_INTERNAL_SECRET when set. When unset, requests still work
+// but are subject to the full WAF treatment — fine for local dev, tests, and
+// staging (admin.staging.pulsemcp.com is grey-clouded, so Cloudflare is not
+// in the path). See pulsemcp/pulsemcp#2882 for context.
+const INTERNAL_HEADER = 'X-PulseMCP-Internal';
+const INTERNAL_SECRET_ENV_VAR = 'PULSEMCP_ADMIN_INTERNAL_SECRET';
+function defaultGetInternalSecret() {
+    const value = process.env[INTERNAL_SECRET_ENV_VAR];
+    return value && value.length > 0 ? value : undefined;
+}
+// `input` is intentionally narrowed to `string | URL` rather than the broader
+// `RequestInfo`. A `Request`'s body is a single-use `ReadableStream`, and
+// narrowing keeps semantics predictable if a retry wrapper is ever layered
+// on top. All call sites in this client lib pass URL strings.
+export async function adminFetch(input, init, deps = {}) {
+    const fetchFn = deps.fetchFn ?? fetch;
+    const getSecret = deps.getInternalSecret ?? defaultGetInternalSecret;
+    const secret = getSecret();
+    if (!secret) {
+        return fetchFn(input, init);
+    }
+    const headers = new Headers(init?.headers);
+    headers.set(INTERNAL_HEADER, secret);
+    return fetchFn(input, { ...init, headers });
+}

package/shared/pulsemcp-admin-client/lib/approve-official-mirror-queue-item-without-modifying.js

@@ -1,3 +1,4 @@
+import { adminFetch } from './admin-fetch.js';
 function mapQueueItem(item) {
     return {
         id: item.id,
@@ -23,7 +24,7 @@ function mapQueueItem(item) {
 }
 export async function approveOfficialMirrorQueueItemWithoutModifying(apiKey, baseUrl, id) {
     const url = new URL(`/api/official_mirror_queues/${id}/approve_without_modifying`, baseUrl);
-    const response = await fetch(url.toString(), {
+    const response = await adminFetch(url.toString(), {
         method: 'POST',
         headers: {
             'X-API-Key': apiKey,

package/shared/pulsemcp-admin-client/lib/approve-official-mirror-queue-item.js

@@ -1,3 +1,4 @@
+import { adminFetch } from './admin-fetch.js';
 function mapQueueItem(item) {
     return {
         id: item.id,
@@ -25,7 +26,7 @@ export async function approveOfficialMirrorQueueItem(apiKey, baseUrl, id, mcpSer
     const url = new URL(`/api/official_mirror_queues/${id}/approve`, baseUrl);
     const formData = new URLSearchParams();
     formData.append('mcp_server_slug', mcpServerSlug);
-    const response = await fetch(url.toString(), {
+    const response = await adminFetch(url.toString(), {
         method: 'POST',
         headers: {
             'X-API-Key': apiKey,

package/shared/pulsemcp-admin-client/lib/cleanup-good-jobs.js

@@ -1,3 +1,4 @@
+import { adminFetch } from './admin-fetch.js';
 export async function cleanupGoodJobs(apiKey, baseUrl, params) {
     const url = new URL('/api/good_jobs/cleanup', baseUrl);
     const body = {};
@@ -7,7 +8,7 @@ export async function cleanupGoodJobs(apiKey, baseUrl, params) {
     if (params?.status !== undefined) {
         body.status = params.status;
     }
-    const response = await fetch(url.toString(), {
+    const response = await adminFetch(url.toString(), {
         method: 'DELETE',
         headers: {
             'X-API-Key': apiKey,

package/shared/pulsemcp-admin-client/lib/create-api-key.d.ts

@@ -0,0 +1,3 @@
+import type { ApiKey, CreateApiKeyParams } from '../../types.js';
+export declare function createApiKey(apiKey: string, baseUrl: string, params: CreateApiKeyParams): Promise<ApiKey>;
+//# sourceMappingURL=create-api-key.d.ts.map

package/shared/pulsemcp-admin-client/lib/create-api-key.js

@@ -0,0 +1,51 @@
+import { adminFetch } from './admin-fetch.js';
+export async function createApiKey(apiKey, baseUrl, params) {
+    const url = new URL('/api/api_keys', baseUrl);
+    const body = {
+        tenant_slug: params.tenant_slug,
+    };
+    if (params.name !== undefined) {
+        body.name = params.name;
+    }
+    if (params.permission_level !== undefined) {
+        body.permission_level = params.permission_level;
+    }
+    const response = await adminFetch(url.toString(), {
+        method: 'POST',
+        headers: {
+            'X-API-Key': apiKey,
+            'Content-Type': 'application/json',
+            Accept: 'application/json',
+        },
+        body: JSON.stringify(body),
+    });
+    if (!response.ok) {
+        if (response.status === 401) {
+            throw new Error('Invalid API key');
+        }
+        if (response.status === 403) {
+            throw new Error('User lacks write privileges');
+        }
+        if (response.status === 404) {
+            const errorData = (await response.json());
+            throw new Error(errorData.error || 'Tenant not found');
+        }
+        if (response.status === 422) {
+            const errorData = (await response.json());
+            const message = errorData.errors?.join(', ') || errorData.error || 'Unknown error';
+            throw new Error(`Validation failed: ${message}`);
+        }
+        throw new Error(`Failed to create API key: ${response.status} ${response.statusText}`);
+    }
+    const result = (await response.json());
+    return {
+        id: result.id,
+        name: result.name,
+        tenant_id: result.tenant_id,
+        tenant_slug: result.tenant_slug,
+        tenant_is_admin: result.tenant_is_admin,
+        permission_level: result.permission_level,
+        key: result.key,
+        created_at: result.created_at,
+    };
+}

package/shared/pulsemcp-admin-client/lib/create-mcp-implementation.js

@@ -1,3 +1,4 @@
+import { adminFetch } from './admin-fetch.js';
 export async function createMCPImplementation(apiKey, baseUrl, params) {
     const url = new URL(`/api/implementations`, baseUrl);
     // Build form data for the POST request
@@ -141,7 +142,7 @@ export async function createMCPImplementation(apiKey, baseUrl, params) {
             });
         }
     }
-    const response = await fetch(url.toString(), {
+    const response = await adminFetch(url.toString(), {
         method: 'POST',
         headers: {
             'X-API-Key': apiKey,

package/shared/pulsemcp-admin-client/lib/create-mcp-json.js

@@ -1,3 +1,4 @@
+import { adminFetch } from './admin-fetch.js';
 export async function createMcpJson(apiKey, baseUrl, params) {
     const url = new URL('/api/mcp_jsons', baseUrl);
     const body = {
@@ -8,7 +9,7 @@ export async function createMcpJson(apiKey, baseUrl, params) {
     if (params.description !== undefined) {
         body.description = params.description;
     }
-    const response = await fetch(url.toString(), {
+    const response = await adminFetch(url.toString(), {
         method: 'POST',
         headers: {
             'X-API-Key': apiKey,

package/shared/pulsemcp-admin-client/lib/create-post.js

@@ -1,3 +1,4 @@
+import { adminFetch } from './admin-fetch.js';
 export async function createPost(apiKey, baseUrl, params) {
     const url = new URL('/posts', baseUrl);
     // Build form data for the POST request
@@ -47,7 +48,7 @@ export async function createPost(apiKey, baseUrl, params) {
             formData.append('post[featured_mcp_client_ids][]', id.toString());
         });
     }
-    const response = await fetch(url.toString(), {
+    const response = await adminFetch(url.toString(), {
         method: 'POST',
         headers: {
             'X-API-Key': apiKey,

package/shared/pulsemcp-admin-client/lib/create-redirect.js

@@ -1,3 +1,4 @@
+import { adminFetch } from './admin-fetch.js';
 export async function createRedirect(apiKey, baseUrl, params) {
     const url = new URL('/api/redirects', baseUrl);
     const body = {
@@ -7,7 +8,7 @@ export async function createRedirect(apiKey, baseUrl, params) {
     if (params.status !== undefined) {
         body.status = params.status;
     }
-    const response = await fetch(url.toString(), {
+    const response = await adminFetch(url.toString(), {
         method: 'POST',
         headers: {
             'X-API-Key': apiKey,

package/shared/pulsemcp-admin-client/lib/create-tenant.d.ts

@@ -0,0 +1,3 @@
+import type { Tenant, CreateTenantParams } from '../../types.js';
+export declare function createTenant(apiKey: string, baseUrl: string, params: CreateTenantParams): Promise<Tenant>;
+//# sourceMappingURL=create-tenant.d.ts.map

package/shared/pulsemcp-admin-client/lib/create-tenant.js

@@ -0,0 +1,35 @@
+import { adminFetch } from './admin-fetch.js';
+export async function createTenant(apiKey, baseUrl, params) {
+    const url = new URL('/api/tenants', baseUrl);
+    const response = await adminFetch(url.toString(), {
+        method: 'POST',
+        headers: {
+            'X-API-Key': apiKey,
+            'Content-Type': 'application/json',
+            Accept: 'application/json',
+        },
+        body: JSON.stringify({ slug: params.slug }),
+    });
+    if (!response.ok) {
+        if (response.status === 401) {
+            throw new Error('Invalid API key');
+        }
+        if (response.status === 403) {
+            throw new Error('User lacks write privileges');
+        }
+        if (response.status === 422) {
+            const errorData = (await response.json());
+            throw new Error(`Validation failed: ${errorData.errors?.join(', ') || 'Unknown error'}`);
+        }
+        throw new Error(`Failed to create tenant: ${response.status} ${response.statusText}`);
+    }
+    const tenant = (await response.json());
+    return {
+        id: tenant.id,
+        slug: tenant.slug,
+        is_admin: tenant.is_admin,
+        enrichments: tenant.enrichments,
+        created_at: tenant.created_at,
+        updated_at: tenant.updated_at,
+    };
+}

package/shared/pulsemcp-admin-client/lib/create-unofficial-mirror.js

@@ -1,3 +1,4 @@
+import { adminFetch } from './admin-fetch.js';
 export async function createUnofficialMirror(apiKey, baseUrl, params) {
     const url = new URL('/api/unofficial_mirrors', baseUrl);
     const body = {
@@ -14,7 +15,7 @@ export async function createUnofficialMirror(apiKey, baseUrl, params) {
     if (params.next_name !== undefined) {
         body.next_name = params.next_name;
     }
-    const response = await fetch(url.toString(), {
+    const response = await adminFetch(url.toString(), {
         method: 'POST',
         headers: {
             'X-API-Key': apiKey,

package/shared/pulsemcp-admin-client/lib/delete-mcp-json.js

@@ -1,6 +1,7 @@
+import { adminFetch } from './admin-fetch.js';
 export async function deleteMcpJson(apiKey, baseUrl, id) {
     const url = new URL(`/api/mcp_jsons/${id}`, baseUrl);
-    const response = await fetch(url.toString(), {
+    const response = await adminFetch(url.toString(), {
         method: 'DELETE',
         headers: {
             'X-API-Key': apiKey,

package/shared/pulsemcp-admin-client/lib/delete-redirect.js

@@ -1,6 +1,7 @@
+import { adminFetch } from './admin-fetch.js';
 export async function deleteRedirect(apiKey, baseUrl, id) {
     const url = new URL(`/api/redirects/${id}`, baseUrl);
-    const response = await fetch(url.toString(), {
+    const response = await adminFetch(url.toString(), {
         method: 'DELETE',
         headers: {
             'X-API-Key': apiKey,

package/shared/pulsemcp-admin-client/lib/delete-unofficial-mirror.js

@@ -1,6 +1,7 @@
+import { adminFetch } from './admin-fetch.js';
 export async function deleteUnofficialMirror(apiKey, baseUrl, id) {
     const url = new URL(`/api/unofficial_mirrors/${id}`, baseUrl);
-    const response = await fetch(url.toString(), {
+    const response = await adminFetch(url.toString(), {
         method: 'DELETE',
         headers: {
             'X-API-Key': apiKey,

package/shared/pulsemcp-admin-client/lib/discard-good-job.js

@@ -1,6 +1,7 @@
+import { adminFetch } from './admin-fetch.js';
 export async function discardGoodJob(apiKey, baseUrl, id) {
     const url = new URL(`/api/good_jobs/${id}/discard`, baseUrl);
-    const response = await fetch(url.toString(), {
+    const response = await adminFetch(url.toString(), {
         method: 'POST',
         headers: {
             'X-API-Key': apiKey,

package/shared/pulsemcp-admin-client/lib/force-trigger-good-job-cron.js

@@ -1,6 +1,7 @@
+import { adminFetch } from './admin-fetch.js';
 export async function forceTriggerGoodJobCron(apiKey, baseUrl, cronKey) {
     const url = new URL(`/api/good_jobs/cron_schedules/${cronKey}/trigger`, baseUrl);
-    const response = await fetch(url.toString(), {
+    const response = await adminFetch(url.toString(), {
         method: 'POST',
         headers: {
             'X-API-Key': apiKey,

package/shared/pulsemcp-admin-client/lib/get-author-by-id.js

@@ -1,10 +1,11 @@
+import { adminFetch } from './admin-fetch.js';
 // Simple in-memory cache for authors with TTL
 let authorsCache = null;
 let authorsCacheTimestamp = 0;
 const CACHE_TTL_MS = 60000; // 1 minute cache
 async function fetchAndCacheAuthors(apiKey, baseUrl) {
     const url = new URL('/supervisor/authors', baseUrl);
-    const response = await fetch(url.toString(), {
+    const response = await adminFetch(url.toString(), {
         method: 'GET',
         headers: {
             'X-API-Key': apiKey,

package/shared/pulsemcp-admin-client/lib/get-author-by-slug.js

@@ -1,7 +1,8 @@
+import { adminFetch } from './admin-fetch.js';
 export async function getAuthorBySlug(apiKey, baseUrl, slug) {
     // Use the supervisor endpoint which supports JSON
     const url = new URL(`/supervisor/authors/${slug}`, baseUrl);
-    const response = await fetch(url.toString(), {
+    const response = await adminFetch(url.toString(), {
         method: 'GET',
         headers: {
             'X-API-Key': apiKey,

package/shared/pulsemcp-admin-client/lib/get-authors.js

@@ -1,3 +1,4 @@
+import { adminFetch } from './admin-fetch.js';
 export async function getAuthors(apiKey, baseUrl, params) {
     // Use the supervisor endpoint which supports JSON
     const url = new URL('/supervisor/authors', baseUrl);
@@ -8,7 +9,7 @@ export async function getAuthors(apiKey, baseUrl, params) {
     if (params?.page) {
         url.searchParams.append('page', params.page.toString());
     }
-    const response = await fetch(url.toString(), {
+    const response = await adminFetch(url.toString(), {
         method: 'GET',
         headers: {
             'X-API-Key': apiKey,

package/shared/pulsemcp-admin-client/lib/get-discovered-url-stats.js

@@ -1,6 +1,7 @@
+import { adminFetch } from './admin-fetch.js';
 export async function getDiscoveredUrlStats(apiKey, baseUrl) {
     const url = new URL('/api/discovered_urls/stats', baseUrl);
-    const response = await fetch(url.toString(), {
+    const response = await adminFetch(url.toString(), {
         method: 'GET',
         headers: {
             'X-API-Key': apiKey,

package/shared/pulsemcp-admin-client/lib/get-discovered-urls.js

@@ -1,3 +1,4 @@
+import { adminFetch } from './admin-fetch.js';
 function mapDiscoveredUrl(raw) {
     const { id, url, source, created_at, ...rest } = raw;
     return {
@@ -19,7 +20,7 @@ export async function getDiscoveredUrls(apiKey, baseUrl, params) {
     if (params?.per_page) {
         url.searchParams.append('per_page', params.per_page.toString());
     }
-    const response = await fetch(url.toString(), {
+    const response = await adminFetch(url.toString(), {
         method: 'GET',
         headers: {
             'X-API-Key': apiKey,