securenow 8.7.0 → 8.9.0

package/mcp/catalog.js

@@ -1,82 +1,82 @@
-'use strict';
-
-const fs = require('fs');
-const path = require('path');
-
-const TEXT = 'text/plain';
-const JSON_MIME = 'application/json';
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const TEXT = 'text/plain';
+const JSON_MIME = 'application/json';
 const MARKDOWN = 'text/markdown';
 
 const UNIVERSAL_SECURENOW_SETUP_PROMPT = `You are working in an existing JavaScript or TypeScript app. Set up SecureNow end-to-end for the framework/runtime already used by this repo. Treat this as a real onboarding, not just a package install.
 
 Primary goals:
-- Use the latest published SecureNow npm package. Require securenow@8.0.0 or newer for split admin/runtime credentials and runtime-authenticated ingestion.
+- Use the latest published SecureNow npm package. Require securenow@8.0.0 or newer for split admin/runtime credentials and runtime-authenticated ingestion.
 - By default, enable tracing, logs, POST request body capture, multipart metadata capture, and the SecureNow firewall.
 - If I explicitly ask for firewall-only mode, keep the same install/login/verification gates, but use firewall-only preload and do not add tracing, logging, or OTel instrumentation.
-- The firewall must protect the selected SecureNow app, use SecureNow's own blocklist/allowlist/IPDB data, and respect that app's SecureNow AI IPDB confidence threshold. Do not add custom IP reputation providers or custom auto-blocking.
-- Do not confuse IP Allowlist with Trusted IPs. IP Allowlist is restrictive deny-by-default: when any allowlist entry exists for an app/environment, only listed IPs can reach it and all other IPs are blocked. Use Trusted IPs for known-safe monitors, office/VPN traffic, or false-positive suppression. Only use allowlist after explicit human approval to lock the app/environment to known IPs.
+- The firewall must protect the selected SecureNow app, use SecureNow's own blocklist/allowlist/IPDB data, and respect that app's SecureNow AI IPDB confidence threshold. Do not add custom IP reputation providers or custom auto-blocking.
+- Do not confuse IP Allowlist with Trusted IPs. IP Allowlist is restrictive deny-by-default: when any allowlist entry exists for an app/environment, only listed IPs can reach it and all other IPs are blocked. Use Trusted IPs for known-safe monitors, office/VPN traffic, or false-positive suppression. Only use allowlist after explicit human approval to lock the app/environment to known IPs.
 
 Safety rules:
-- Do not print full API keys, JWTs, tokens, or local SecureNow credential files (.securenow/admin.json, .securenow/runtime.json, legacy .securenow/credentials.json, or .securenow/credentials.*.json). Mask secrets.
-- Keep local SecureNow credential files secret (.securenow/admin.json, .securenow/runtime.json, legacy .securenow/credentials.json, and .securenow/credentials.*.json). Do not print them; mask secrets in summaries.
+- Do not print full API keys, JWTs, tokens, or local SecureNow credential files (.securenow/admin.json, .securenow/runtime.json, legacy .securenow/credentials.json, or .securenow/credentials.*.json). Mask secrets.
+- Keep local SecureNow credential files secret (.securenow/admin.json, .securenow/runtime.json, legacy .securenow/credentials.json, and .securenow/credentials.*.json). Do not print them; mask secrets in summaries.
 - Do not manually browse to a SecureNow auth URL. Always start auth with npx securenow login so the CLI generates the required callback and state.
 - If the browser says "Missing callback parameter", you opened the wrong URL: rerun npx securenow login from the project root.
 - Do not skip login, app selection, firewall connection, or verification unless I explicitly say to.
 - Preserve existing middleware, proxy, instrumentation, Docker, PM2, and start scripts.
 
 Runbook:
-1. Identify the project root, package manager, framework, start/build/test scripts, process manager files, Docker files, and existing middleware/proxy/instrumentation.
-   - Use the repo's own scripts for verification. If the correct dev/start/build/test command is missing or ambiguous, ask the customer which command to use.
-   - Ask before starting long-running dev/start servers. Build/test/lint commands can be run when they are standard project scripts and safe for the current task.
-   - Do not invent HTTP URLs. Only probe a local or production URL when the customer provides one, the running app prints one, or project/deploy config clearly defines one.
+1. Identify the project root, package manager, framework, start/build/test scripts, process manager files, Docker files, and existing middleware/proxy/instrumentation.
+   - Use the repo's own scripts for verification. If the correct dev/start/build/test command is missing or ambiguous, ask the customer which command to use.
+   - Ask before starting long-running dev/start servers. Build/test/lint commands can be run when they are standard project scripts and safe for the current task.
+   - Do not invent HTTP URLs. Only probe a local or production URL when the customer provides one, the running app prints one, or project/deploy config clearly defines one.
 2. Install or upgrade SecureNow with the detected package manager, using securenow@latest. Verify the actual installed version with:
    node -p "require('./node_modules/securenow/package.json').version"
    npx securenow version
-   Stop and fix the install if either is below 8.0.0 or npx still resolves an older local package.
-3. Read the installed package surface before editing files: node_modules/securenow/package.json, README/NPM_README, SKILL-API, SKILL-CLI, npx securenow help, and relevant subcommand help for login/init/firewall/doctor/env/test-span/log/mcp.
-4. Mandatory auth/runtime gate:
-   - Run npx securenow whoami from the project root.
-   - If admin auth is missing, run npx securenow admin login from the project root and wait for the browser flow.
-   - If runtime app config is missing, run npx securenow app connect from the project root and wait for the browser flow.
-   - After the CLI exits, rerun npx securenow whoami.
-   - Do not proceed to app edits or verification until whoami shows the required lane(s). SDK setup needs runtime app config; admin/global MCP operations need admin auth.
-5. Validate project-local credentials without exposing secrets:
-   - Confirm .securenow/runtime.json exists for SDK runtime setup, or legacy .securenow/credentials.json exists for old installs.
-   - Confirm the runtime file has SecureNow's default config/explanations block.
-   - Confirm the runtime file has an app key/name/instance and a runtime API key after app selection. The app key only routes telemetry; the runtime API key is required to authenticate telemetry ingestion and firewall sync.
-   - Confirm .securenow/admin.json exists only when admin CLI/MCP auth is needed.
-   - Confirm .securenow/admin.json, .securenow/runtime.json, legacy .securenow/credentials.json, and any .securenow/credentials.*.json runtime files are ignored by git, without ignoring the entire .securenow/ directory.
-6. Run npx securenow init. If it fails with ui.header is not a function or another CLI bug, upgrade to securenow@latest, verify >=8.0.0, and retry. Do not silently ignore init failures.
-7. Configure the least invasive framework-specific integration:
-   - Next.js: preserve instrumentation.js/ts. Register securenow/nextjs only when NEXT_RUNTIME is nodejs. In ESM files, use createRequire before require("securenow/nextjs"). Include require("securenow/nextjs-auto-capture") for body capture. For Next 15+, add securenow to serverExternalPackages. For older Next.js, use experimental.serverComponentsExternalPackages. Preserve proxy.js/middleware.js.
-   - Nuxt/Nitro: use the documented securenow/nuxt module or Nitro server plugin.
-   - Express/Fastify/NestJS/Koa/Hapi/Hono/raw Node: preload securenow/register through existing scripts, NODE_OPTIONS, PM2 node_args, Docker CMD, or the process manager already used.
-   - Firewall-only: preload securenow/firewall-only or use the documented securenow run --firewall-only command. Do not add OTel/tracing/logging in this mode.
-   - Vite/browser-only: use only documented browser integration and state that server firewall protection requires a server runtime.
-8. Do not create or require a .env file for local development or production. The SDK reads defaults from .securenow/runtime.json, with legacy .securenow/credentials.json and generated runtime credential files still supported:
-   - config.logging.enabled: true
-   - config.capture.body: true
-   - config.capture.multipart: true
-   - config.firewall.enabled: true
-   - config.firewall.failMode: "open"
-   - config.capture.maxBodySize: 10240
-   For production, run npx securenow credentials runtime --env production, store the resulting JSON as a deployment secret file, and mount/copy it to <app-root>/.securenow/credentials.json or <app-root>/.securenow/credentials.production.json. Do not recommend env vars unless the user explicitly asks for legacy fallbacks.
-   Do not proceed with telemetry verification if the runtime API key is missing; run npx securenow app connect or npx securenow api-key create first. The v8 ingestion gateway rejects app-key-only telemetry.
-   Local credentials should use config.runtime.deploymentEnvironment="local". Production runtime credentials should use "production". The app key stays the same; traces, logs, firewall status, forensics, and CLI/MCP queries are scoped by environment.
-9. Verify firewall and threshold:
+   Stop and fix the install if either is below 8.0.0 or npx still resolves an older local package.
+3. Read the installed package surface before editing files: node_modules/securenow/package.json, README/NPM_README, SKILL-API, SKILL-CLI, npx securenow help, and relevant subcommand help for login/init/firewall/doctor/env/test-span/log/mcp.
+4. Mandatory auth/runtime gate:
+   - Run npx securenow whoami from the project root.
+   - If admin auth is missing, run npx securenow admin login from the project root and wait for the browser flow.
+   - If runtime app config is missing, run npx securenow app connect from the project root and wait for the browser flow.
+   - After the CLI exits, rerun npx securenow whoami.
+   - Do not proceed to app edits or verification until whoami shows the required lane(s). SDK setup needs runtime app config; admin/global MCP operations need admin auth.
+5. Validate project-local credentials without exposing secrets:
+   - Confirm .securenow/runtime.json exists for SDK runtime setup, or legacy .securenow/credentials.json exists for old installs.
+   - Confirm the runtime file has SecureNow's default config/explanations block.
+   - Confirm the runtime file has an app key/name/instance and a runtime API key after app selection. The app key only routes telemetry; the runtime API key is required to authenticate telemetry ingestion and firewall sync.
+   - Confirm .securenow/admin.json exists only when admin CLI/MCP auth is needed.
+   - Confirm .securenow/admin.json, .securenow/runtime.json, legacy .securenow/credentials.json, and any .securenow/credentials.*.json runtime files are ignored by git, without ignoring the entire .securenow/ directory.
+6. Run npx securenow init. If it fails with ui.header is not a function or another CLI bug, upgrade to securenow@latest, verify >=8.0.0, and retry. Do not silently ignore init failures.
+7. Configure the least invasive framework-specific integration:
+   - Next.js: preserve instrumentation.js/ts. Register securenow/nextjs only when NEXT_RUNTIME is nodejs. In ESM files, use createRequire before require("securenow/nextjs"). Include require("securenow/nextjs-auto-capture") for body capture. For Next 15+, add securenow to serverExternalPackages. For older Next.js, use experimental.serverComponentsExternalPackages. Preserve proxy.js/middleware.js.
+   - Nuxt/Nitro: use the documented securenow/nuxt module or Nitro server plugin.
+   - Express/Fastify/NestJS/Koa/Hapi/Hono/raw Node: preload securenow/register through existing scripts, NODE_OPTIONS, PM2 node_args, Docker CMD, or the process manager already used.
+   - Firewall-only: preload securenow/firewall-only or use the documented securenow run --firewall-only command. Do not add OTel/tracing/logging in this mode.
+   - Vite/browser-only: use only documented browser integration and state that server firewall protection requires a server runtime.
+8. Do not create or require a .env file for local development or production. The SDK reads defaults from .securenow/runtime.json, with legacy .securenow/credentials.json and generated runtime credential files still supported:
+   - config.logging.enabled: true
+   - config.capture.body: true
+   - config.capture.multipart: true
+   - config.firewall.enabled: true
+   - config.firewall.failMode: "open"
+   - config.capture.maxBodySize: 10240
+   For production, run npx securenow credentials runtime --env production, store the resulting JSON as a deployment secret file, and mount/copy it to <app-root>/.securenow/credentials.json or <app-root>/.securenow/credentials.production.json. Do not recommend env vars unless the user explicitly asks for legacy fallbacks.
+   Do not proceed with telemetry verification if the runtime API key is missing; run npx securenow app connect or npx securenow api-key create first. The v8 ingestion gateway rejects app-key-only telemetry.
+   Local credentials should use config.runtime.deploymentEnvironment="local". Production runtime credentials should use "production". The app key stays the same; traces, logs, firewall status, forensics, and CLI/MCP queries are scoped by environment.
+9. Verify firewall and threshold:
    - Run npx securenow firewall apps and npx securenow firewall status.
-   - Confirm the selected app is present, firewallEnabled is true, and the SecureNow AI IPDB confidence threshold is visible.
+   - Confirm the selected app is present, firewallEnabled is true, and the SecureNow AI IPDB confidence threshold is visible.
    - If firewallEnabled is false, run the documented per-app enable command, for example npx securenow firewall enable --app <appKey>, then verify again.
-10. End-to-end proof:
-   - Run npx securenow doctor.
-   - Run npx securenow env and confirm loggingEnabled, captureBody, captureMultipart, and firewallEnabled resolve to true or 1 from credentials/defaults, unless I explicitly requested firewall-only.
-   - If available and not in firewall-only mode, send telemetry:
-     npx securenow test-span securenow.onboarding
-     npx securenow log send "SecureNow onboarding test" --level info
-   - Run the repo build/test/lint command when available. If multiple scripts look plausible or no script exists, ask the customer for the intended command instead of guessing.
-   - If a local app URL is available, make one simple GET request to a real route to generate request telemetry, then check npx securenow status and traces for the selected environment. If no local URL is available, say that URL smoke testing was skipped.
-   - If a production URL is provided or clearly discoverable, make one safe GET request to production and check npx securenow status/traces with --env production. If no production URL is available, do not fabricate one; ask for it or skip production URL smoke testing.
-   - For MCP-capable clients, optionally smoke-test npx securenow mcp with the securenow_auth_status tool.
+10. End-to-end proof:
+   - Run npx securenow doctor.
+   - Run npx securenow env and confirm loggingEnabled, captureBody, captureMultipart, and firewallEnabled resolve to true or 1 from credentials/defaults, unless I explicitly requested firewall-only.
+   - If available and not in firewall-only mode, send telemetry:
+     npx securenow test-span securenow.onboarding
+     npx securenow log send "SecureNow onboarding test" --level info
+   - Run the repo build/test/lint command when available. If multiple scripts look plausible or no script exists, ask the customer for the intended command instead of guessing.
+   - If a local app URL is available, make one simple GET request to a real route to generate request telemetry, then check npx securenow status and traces for the selected environment. If no local URL is available, say that URL smoke testing was skipped.
+   - If a production URL is provided or clearly discoverable, make one safe GET request to production and check npx securenow status/traces with --env production. If no production URL is available, do not fabricate one; ask for it or skip production URL smoke testing.
+   - For MCP-capable clients, optionally smoke-test npx securenow mcp with the securenow_auth_status tool.
 
 Final response:
 - List every changed file.
@@ -85,2131 +85,2177 @@ Final response:
 - Mention skipped checks and why.
 - Provide exact command(s) to start the protected app.`;
 
-
-function string(description) {
-  return { type: 'string', description };
-}
-
-function number(description, extra = {}) {
-  return { type: 'number', description, ...extra };
-}
-
-function boolean(description) {
-  return { type: 'boolean', description };
-}
-
-function arrayOfStrings(description) {
-  return { type: 'array', items: { type: 'string' }, description };
-}
-
-function objectSchema(properties, required = []) {
-  return {
-    type: 'object',
-    additionalProperties: false,
-    properties,
-    required,
-  };
-}
-
-function jsonText(value) {
-  return JSON.stringify(value, null, 2);
-}
-
-function maskSecret(value) {
-  if (!value) return null;
-  const text = String(value);
-  if (text.length <= 12) return '***';
-  return `${text.slice(0, 8)}...${text.slice(-4)}`;
-}
-
-function normalizeAppKeys(value) {
-  if (Array.isArray(value)) return value.filter(Boolean).join(',');
-  return value;
-}
-
-function sanitizeArgs(args = {}) {
-  const clone = { ...args };
-  for (const key of Object.keys(clone)) {
-    if (/token|apiKey|api_key|authorization|password|secret/i.test(key)) {
-      clone[key] = maskSecret(clone[key]);
-    }
-  }
-  return clone;
-}
-
-const confirmSchema = {
-  confirm: boolean('Required for write actions. Must be true.'),
-  reason: string('Short human-readable reason for the write action.'),
-};
-
-const appKeysInput = {
-  appKeys: {
-    oneOf: [
-      { type: 'string' },
-      { type: 'array', items: { type: 'string' } },
-    ],
-    description: 'Application key or comma-separated/list of application keys.',
-  },
-};
-
-const pagingInput = {
-  limit: number('Maximum results to return.', { minimum: 1, maximum: 500 }),
-  page: number('Page number.', { minimum: 1 }),
-};
-
-const timeRangeInput = {
-  from: string('Start time as ISO 8601, optional.'),
-  to: string('End time as ISO 8601, optional.'),
-};
-
-const environmentInput = {
-  environment: string('Deployment environment scope: production, staging, preview, local, test, or all. Default for investigations is production.'),
-};
-
-const decisionReportInput = {
-  decisionReport: {
-    type: 'object',
-    additionalProperties: true,
-    description: 'Structured audit report explaining the decision, evidence reviewed, trace IDs, missing proof, and recommendations.',
-  },
-  decisionSummary: string('Short decision summary to record on the IP/case history.'),
-  outcome: string('Decision outcome: blocked, rate_limited, false_positive, clean, deferred, case_action, rule_tuning, new_alert_rule, ambiguous, skipped, or other.'),
-  evidence: arrayOfStrings('Evidence strings that support the decision.'),
-  reviewedHistory: arrayOfStrings('History/proofs reviewed before deciding.'),
-  traceIds: arrayOfStrings('Trace IDs reviewed for this decision.'),
-  paths: arrayOfStrings('Paths/endpoints reviewed for this decision.'),
-  ips: arrayOfStrings('IP addresses affected by this case-level decision report.'),
-  methods: arrayOfStrings('HTTP methods reviewed for this decision.'),
-  statusCodes: arrayOfStrings('HTTP status codes reviewed for this decision.'),
-  userAgents: arrayOfStrings('User agents reviewed for this decision.'),
-  missingProof: arrayOfStrings('Proof that was missing when the row is skipped or ambiguous.'),
-  recommendations: arrayOfStrings('Follow-up recommendations to record with the decision.'),
-};
-
-const TOOLS = [
-  {
-    name: 'securenow_auth_status',
-    title: 'SecureNow Auth Status',
-    description: 'Show local SecureNow credential source, selected app, and masked runtime API key.',
-    scope: null,
-    localOnly: true,
-    readOnly: true,
-    inputSchema: objectSchema({}),
-  },
-  {
-    name: 'securenow_apps_list',
-    title: 'List Applications',
-    description: 'List SecureNow applications for the authenticated user.',
-    scope: 'applications:read',
-    readOnly: true,
-    method: 'GET',
-    endpoint: '/applications',
-    inputSchema: objectSchema({}),
-  },
-  {
-    name: 'securenow_apps_create',
-    title: 'Create Application',
-    description: 'Create a SecureNow application. Write action; requires confirmation.',
-    scope: 'applications:write',
-    readOnly: false,
-    confirm: true,
-    method: 'POST',
-    endpoint: '/applications',
-    bodyFields: ['name', 'hosts', 'instanceId'],
-    inputSchema: objectSchema({
-      name: string('Application name.'),
-      hosts: arrayOfStrings('Optional hostnames/domains for this application.'),
-      instanceId: string('Optional ClickHouse instance id.'),
-      ...confirmSchema,
-    }, ['name', 'confirm', 'reason']),
-  },
-  {
-    name: 'securenow_apps_info',
-    title: 'Get Application By Key',
-    description: 'Get details for an application by app key.',
-    scope: 'applications:read',
-    readOnly: true,
-    method: 'GET',
-    endpoint: '/applications/key/:key',
-    pathParams: ['key'],
-    inputSchema: objectSchema({
-      key: string('Application key UUID.'),
-    }, ['key']),
-  },
-  {
-    name: 'securenow_firewall_apps',
-    title: 'List Firewall Apps',
-    description: 'List applications with firewall toggle and SecureNow AI IPDB threshold state.',
-    scope: 'applications:read',
-    readOnly: true,
-    method: 'GET',
-    endpoint: '/firewall/apps',
-    inputSchema: objectSchema({}),
-  },
-  {
-    name: 'securenow_firewall_status',
-    title: 'Firewall Status',
-    description: 'Show firewall blocklist/allowlist status for the authenticated account.',
-    scope: 'firewall:read',
-    readOnly: true,
-    method: 'GET',
-    endpoint: '/firewall/status',
-    queryFields: ['environment', 'appKey'],
-    inputSchema: objectSchema({
-      appKey: string('Optional application key UUID to scope the status check.'),
-      ...environmentInput,
-    }),
-  },
-  {
-    name: 'securenow_firewall_enable',
-    title: 'Enable App Firewall',
-    description: 'Turn the per-app firewall ON. Write action; requires confirmation.',
-    scope: 'applications:write',
-    readOnly: false,
-    confirm: true,
-    method: 'PATCH',
-    endpoint: '/firewall/app/:appKey',
-    pathParams: ['appKey'],
-    bodyFields: ['environment'],
-    fixedBody: { enabled: true },
-    inputSchema: objectSchema({
-      appKey: string('Application key UUID.'),
-      ...environmentInput,
-      ...confirmSchema,
-    }, ['appKey', 'confirm', 'reason']),
-  },
-  {
-    name: 'securenow_firewall_disable',
-    title: 'Disable App Firewall',
-    description: 'Turn the per-app firewall OFF. Write action; requires confirmation.',
-    scope: 'applications:write',
-    readOnly: false,
-    destructive: true,
-    confirm: true,
-    method: 'PATCH',
-    endpoint: '/firewall/app/:appKey',
-    pathParams: ['appKey'],
-    bodyFields: ['environment'],
-    fixedBody: { enabled: false },
-    inputSchema: objectSchema({
-      appKey: string('Application key UUID.'),
-      ...environmentInput,
-      ...confirmSchema,
-    }, ['appKey', 'confirm', 'reason']),
-  },
-  {
-    name: 'securenow_firewall_set_threshold',
-    title: 'Set SecureNow AI IPDB Threshold',
-    description: 'Set the per-app SecureNow AI IPDB confidence threshold. Write action; requires confirmation.',
-    scope: 'applications:write',
-    readOnly: false,
-    confirm: true,
-    method: 'PATCH',
-    endpoint: '/firewall/app/:appKey',
-    pathParams: ['appKey'],
-    bodyFields: ['confidenceMinimum', 'environment'],
-    inputSchema: objectSchema({
-      appKey: string('Application key UUID.'),
-      confidenceMinimum: number('Minimum SecureNow AI IPDB confidence score.', { minimum: 0, maximum: 100 }),
-      ...environmentInput,
-      ...confirmSchema,
-    }, ['appKey', 'confidenceMinimum', 'confirm', 'reason']),
-  },
-  {
-    name: 'securenow_firewall_test_ip',
-    title: 'Test Firewall IP Decision',
-    description: 'Check whether an IP would be blocked by the firewall.',
-    scope: 'firewall:read',
-    readOnly: true,
-    method: 'GET',
-    endpoint: '/firewall/check/:ip',
-    pathParams: ['ip'],
-    queryFields: ['environment', 'appKey'],
-    inputSchema: objectSchema({
-      ip: string('IPv4 address to test.'),
-      appKey: string('Optional application key UUID to test the app/environment toggle and scoped lists.'),
-      ...environmentInput,
-    }, ['ip']),
-  },
-  {
-    name: 'securenow_traces_list',
-    title: 'List Traces',
-    description: 'List recent traces for one or more applications.',
-    scope: 'traces:read',
-    readOnly: true,
-    method: 'GET',
-    endpoint: '/traces',
-    queryFields: ['appKeys', 'environment', 'from', 'to', 'limit'],
-    normalize: { appKeys: normalizeAppKeys },
-    inputSchema: objectSchema({
-      ...appKeysInput,
-      ...environmentInput,
-      ...timeRangeInput,
-      limit: number('Maximum traces to return.', { minimum: 1, maximum: 200 }),
-    }, ['appKeys']),
-  },
-  {
-    name: 'securenow_traces_show',
-    title: 'Show Trace',
-    description: 'Show spans for a trace id scoped to one or more app keys.',
-    scope: 'traces:read',
-    readOnly: true,
-    method: 'GET',
-    endpoint: '/traces/:traceId',
-    pathParams: ['traceId'],
-    queryFields: ['appKeys', 'environment'],
-    normalize: { appKeys: normalizeAppKeys },
-    inputSchema: objectSchema({
-      traceId: string('Trace id.'),
-      ...appKeysInput,
-      ...environmentInput,
-    }, ['traceId', 'appKeys']),
-  },
-  {
-    name: 'securenow_logs_list',
-    title: 'List Logs',
-    description: 'List recent logs for one or more applications.',
-    scope: 'logs:read',
-    readOnly: true,
-    method: 'GET',
-    endpoint: '/logs',
-    queryFields: ['appKeys', 'environment', 'from', 'to', 'severity', 'limit'],
-    normalize: { appKeys: normalizeAppKeys },
-    inputSchema: objectSchema({
-      ...appKeysInput,
-      ...environmentInput,
-      ...timeRangeInput,
-      severity: string('Optional severity filter.'),
-      limit: number('Maximum logs to return.', { minimum: 1, maximum: 500 }),
-    }, ['appKeys']),
-  },
-  {
-    name: 'securenow_logs_for_trace',
-    title: 'Logs For Trace',
-    description: 'Show logs correlated to a trace id.',
-    scope: 'logs:read',
-    readOnly: true,
-    method: 'GET',
-    endpoint: '/logs/trace/:traceId',
-    pathParams: ['traceId'],
-    queryFields: ['appKeys', 'environment'],
-    normalize: { appKeys: normalizeAppKeys },
-    inputSchema: objectSchema({
-      traceId: string('Trace id.'),
-      ...appKeysInput,
-      ...environmentInput,
-    }, ['traceId', 'appKeys']),
-  },
-  {
-    name: 'securenow_notifications_list',
-    title: 'List Notifications',
-    description: 'List security notifications.',
-    scope: 'notifications:read',
-    readOnly: true,
-    method: 'GET',
-    endpoint: '/notifications',
-    queryFields: ['limit', 'page'],
-    inputSchema: objectSchema({ ...pagingInput }),
-  },
-  {
-    name: 'securenow_notifications_unread',
-    title: 'Unread Notification Count',
-    description: 'Return unread notification count.',
-    scope: 'notifications:read',
-    readOnly: true,
-    method: 'GET',
-    endpoint: '/notifications/unread-count',
-    inputSchema: objectSchema({}),
-  },
-  {
-    name: 'securenow_notifications_read',
-    title: 'Mark Notification Read',
-    description: 'Mark a notification as read. Write action; requires confirmation.',
-    scope: 'notifications:write',
-    readOnly: false,
-    confirm: true,
-    method: 'PUT',
-    endpoint: '/notifications/:id/read',
-    pathParams: ['id'],
-    inputSchema: objectSchema({
-      id: string('Notification id.'),
-      ...confirmSchema,
-    }, ['id', 'confirm', 'reason']),
-  },
-  {
-    name: 'securenow_notifications_get',
-    title: 'Get Notification',
-    description: 'Get one notification/case with alert context, clusters, and IP investigations.',
-    scope: 'notifications:read',
-    readOnly: true,
-    method: 'GET',
-    endpoint: '/notifications/:id',
-    pathParams: ['id'],
-    inputSchema: objectSchema({
-      id: string('Notification id.'),
-    }, ['id']),
-  },
-  {
-    name: 'securenow_notifications_batch_get',
-    title: 'Get Notifications Batch',
-    description: 'Fetch multiple notification/case records in one request.',
-    scope: 'notifications:read',
-    readOnly: true,
-    method: 'POST',
-    endpoint: '/notifications/batch',
-    bodyFields: ['ids'],
-    inputSchema: objectSchema({
-      ids: arrayOfStrings('Notification ids to fetch, up to 50.'),
-    }, ['ids']),
-  },
-  {
-    name: 'securenow_human_actions_list',
-    title: 'List Human Action Queue',
-    description: 'List approval-gated human decisions prepared by SecureNow AI, ordered by urgency.',
-    scope: 'notifications:read',
-    readOnly: true,
-    method: 'GET',
-    endpoint: '/notifications/approval-tasks',
-    queryFields: ['limit', 'page', 'search'],
-    inputSchema: objectSchema({
-      ...pagingInput,
-      search: string('Optional search over IP, rule, path, or verdict.'),
-    }),
-  },
-  {
-    name: 'securenow_human_actions_grouped_list',
-    title: 'List Grouped Human Actions',
-    description: 'List Requires Human work as root-cause groups with batch-safety preview instead of one row per IP/action.',
-    scope: 'notifications:read',
-    readOnly: true,
-    method: 'GET',
-    endpoint: '/notifications/approval-task-groups',
-    queryFields: ['limit', 'page', 'search'],
-    inputSchema: objectSchema({
-      ...pagingInput,
-      search: string('Optional search over IP, rule, path, action, or verdict.'),
-    }),
-  },
-  {
-    name: 'securenow_alert_review_runs_list',
-    title: 'List Alert Review Root Causes',
-    description: 'List pending alert-review runs as root-cause groups with batch-action preview, rather than row-by-row noisy alert triage.',
-    scope: 'notifications:read',
-    readOnly: true,
-    method: 'GET',
-    endpoint: '/notifications/alert-review-runs',
-    queryFields: ['limit', 'page', 'search', 'rootCauseKey', 'groupKey', 'includeRuns', 'maxScan'],
-    inputSchema: objectSchema({
-      ...pagingInput,
-      search: string('Optional search over rule, route, IP, evidence, or proposed guard.'),
-      rootCauseKey: string('Optional root-cause group key to filter to one group.'),
-      groupKey: string('Compatibility alias for rootCauseKey.'),
-      includeRuns: boolean('Whether to include compact matching run rows in the response.'),
-      maxScan: number('Maximum pending-review rows to scan before grouping. Defaults to 500, capped at 1000.', { minimum: 1, maximum: 1000 }),
-    }),
-  },
-  {
-    name: 'securenow_alert_review_runs_count',
-    title: 'Count Alert Review Runs',
-    description: 'Count pending alert-review rows and the root-cause groups they collapse into.',
-    scope: 'notifications:read',
-    readOnly: true,
-    method: 'GET',
-    endpoint: '/notifications/alert-review-runs/count',
-    queryFields: ['search', 'maxScan'],
-    inputSchema: objectSchema({
-      search: string('Optional search over rule, route, IP, evidence, or proposed guard.'),
-      maxScan: number('Maximum pending-review rows to scan before grouping. Defaults to 500, capped at 1000.', { minimum: 1, maximum: 1000 }),
-    }),
-  },
-  {
-    name: 'securenow_alert_review_run_get',
-    title: 'Get Alert Review Run',
-    description: 'Fetch one pending-review alert run with its root-cause key, evidence-quality score, and similar open siblings.',
-    scope: 'notifications:read',
-    readOnly: true,
-    method: 'GET',
-    endpoint: '/notifications/alert-review-runs/:id',
-    pathParams: ['id'],
-    queryFields: ['maxScan'],
-    inputSchema: objectSchema({
-      id: string('Notification id for the alert review run.'),
-      maxScan: number('Maximum pending-review rows to scan for similar siblings. Defaults to 500, capped at 1000.', { minimum: 1, maximum: 1000 }),
-    }, ['id']),
-  },
-  {
-    name: 'securenow_alert_review_run_resolve',
-    title: 'Resolve Alert Review Run',
-    description: 'Close one pending alert-review row with an auditable no-write decision report.',
-    scope: 'notifications:write',
-    readOnly: false,
-    confirm: true,
-    method: 'POST',
-    endpoint: '/notifications/alert-review-runs/:id/resolve',
-    pathParams: ['id'],
-    fixedBody: { reportSource: 'mcp' },
-    bodyFields: ['confirm', 'reason', 'decisionReport', 'decisionSummary', 'outcome', 'evidence', 'reviewedHistory', 'traceIds', 'paths', 'methods', 'statusCodes', 'userAgents', 'missingProof', 'recommendations'],
-    inputSchema: objectSchema({
-      id: string('Notification id for the alert review run.'),
-      ...decisionReportInput,
-      ...confirmSchema,
-    }, ['id', 'confirm', 'reason']),
-  },
-  {
-    name: 'securenow_alert_review_run_dismiss',
-    title: 'Dismiss Alert Review Run',
-    description: 'Dismiss one pending alert-review row with an audit report and no enforcement write.',
-    scope: 'notifications:write',
-    readOnly: false,
-    confirm: true,
-    method: 'POST',
-    endpoint: '/notifications/alert-review-runs/:id/dismiss',
-    pathParams: ['id'],
-    fixedBody: { reportSource: 'mcp' },
-    bodyFields: ['confirm', 'reason', 'decisionReport', 'decisionSummary', 'outcome', 'evidence', 'reviewedHistory', 'traceIds', 'paths', 'methods', 'statusCodes', 'userAgents', 'missingProof', 'recommendations'],
-    inputSchema: objectSchema({
-      id: string('Notification id for the alert review run.'),
-      ...decisionReportInput,
-      ...confirmSchema,
-    }, ['id', 'confirm', 'reason']),
-  },
-  {
-    name: 'securenow_alert_review_run_keep_alive',
-    title: 'Keep Alert Rule Active',
-    description: 'Mark the noisy/paused alert rule as reviewed, keep it active, and close the pending alert-review row with an audit report.',
-    scope: 'notifications:write',
-    readOnly: false,
-    confirm: true,
-    method: 'POST',
-    endpoint: '/notifications/alert-review-runs/:id/keep-alive',
-    pathParams: ['id'],
-    fixedBody: { reportSource: 'mcp' },
-    bodyFields: ['confirm', 'reason', 'reviewNote', 'decisionReport', 'decisionSummary', 'evidence', 'reviewedHistory', 'traceIds', 'paths', 'methods', 'statusCodes', 'userAgents', 'missingProof', 'recommendations'],
-    inputSchema: objectSchema({
-      id: string('Notification id for the alert review run.'),
-      reviewNote: string('Optional rule-review note. Defaults to reason.'),
-      ...decisionReportInput,
-      ...confirmSchema,
-    }, ['id', 'confirm', 'reason']),
-  },
-  {
-    name: 'securenow_alert_review_run_apply_group_decision',
-    title: 'Apply Alert Review Group Decision',
-    description: 'Apply one verified no-write decision report to every currently matching alert-review row in a root-cause group, leaving non-matching rows open.',
-    scope: 'notifications:write',
-    readOnly: false,
-    confirm: true,
-    method: 'POST',
-    endpoint: '/notifications/alert-review-runs/apply-group-decision',
-    fixedBody: { reportSource: 'mcp' },
-    bodyFields: ['confirm', 'reason', 'rootCauseKey', 'groupKey', 'prototypeRunId', 'notificationIds', 'status', 'outcome', 'allowMixed', 'previewOnly', 'maxRows', 'maxScan', 'search', 'decisionReport', 'decisionSummary', 'evidence', 'reviewedHistory', 'traceIds', 'paths', 'methods', 'statusCodes', 'userAgents', 'missingProof', 'recommendations'],
-    inputSchema: objectSchema({
-      rootCauseKey: string('Root-cause group key from securenow_alert_review_runs_list.'),
-      groupKey: string('Compatibility alias for rootCauseKey.'),
-      prototypeRunId: string('Optional notification id whose root-cause key should be used.'),
-      notificationIds: arrayOfStrings('Optional subset of eligible notification ids to close. Leave empty to apply to every eligible row in the group.'),
-      status: string('Resolution status: resolved or dismissed. Defaults to resolved.'),
-      allowMixed: boolean('Allow a mixed decision/attribution group only after every row was manually reviewed. Defaults to false.'),
-      previewOnly: boolean('When true, returns the eligible rows without writing.'),
-      maxRows: number('Maximum rows to close in this batch. Defaults to 100, capped at 250.', { minimum: 1, maximum: 250 }),
-      maxScan: number('Maximum pending-review rows to scan before grouping. Defaults to 500, capped at 1000.', { minimum: 1, maximum: 1000 }),
-      search: string('Optional search filter applied before grouping.'),
-      ...decisionReportInput,
-      ...confirmSchema,
-    }, ['confirm', 'reason']),
-  },
-  {
-    name: 'securenow_alert_review_apply_group_decision',
-    title: 'Apply Alert Review Group Decision',
-    description: 'Compatibility alias for securenow_alert_review_run_apply_group_decision.',
-    scope: 'notifications:write',
-    readOnly: false,
-    confirm: true,
-    method: 'POST',
-    endpoint: '/notifications/alert-review-runs/apply-group-decision',
-    fixedBody: { reportSource: 'mcp' },
-    bodyFields: ['confirm', 'reason', 'rootCauseKey', 'groupKey', 'prototypeRunId', 'notificationIds', 'status', 'outcome', 'allowMixed', 'previewOnly', 'maxRows', 'maxScan', 'search', 'decisionReport', 'decisionSummary', 'evidence', 'reviewedHistory', 'traceIds', 'paths', 'methods', 'statusCodes', 'userAgents', 'missingProof', 'recommendations'],
-    inputSchema: objectSchema({
-      rootCauseKey: string('Root-cause group key from securenow_alert_review_runs_list.'),
-      groupKey: string('Compatibility alias for rootCauseKey.'),
-      prototypeRunId: string('Optional notification id whose root-cause key should be used.'),
-      notificationIds: arrayOfStrings('Optional subset of eligible notification ids to close. Leave empty to apply to every eligible row in the group.'),
-      status: string('Resolution status: resolved or dismissed. Defaults to resolved.'),
-      allowMixed: boolean('Allow a mixed decision/attribution group only after every row was manually reviewed. Defaults to false.'),
-      previewOnly: boolean('When true, returns the eligible rows without writing.'),
-      maxRows: number('Maximum rows to close in this batch. Defaults to 100, capped at 250.', { minimum: 1, maximum: 250 }),
-      maxScan: number('Maximum pending-review rows to scan before grouping. Defaults to 500, capped at 1000.', { minimum: 1, maximum: 1000 }),
-      search: string('Optional search filter applied before grouping.'),
-      ...decisionReportInput,
-      ...confirmSchema,
-    }, ['confirm', 'reason']),
-  },
-  {
-    name: 'securenow_alert_review_group_similar',
-    title: 'List Similar Alert Review Runs',
-    description: 'Fetch the current rows in one alert-review root-cause group for preview before a batch decision.',
-    scope: 'notifications:read',
-    readOnly: true,
-    method: 'GET',
-    endpoint: '/notifications/alert-review-runs',
-    queryFields: ['rootCauseKey', 'groupKey', 'includeRuns', 'maxScan'],
-    fixedQuery: { includeRuns: true },
-    inputSchema: objectSchema({
-      rootCauseKey: string('Root-cause group key from securenow_alert_review_runs_list.'),
-      groupKey: string('Compatibility alias for rootCauseKey.'),
-      maxScan: number('Maximum pending-review rows to scan before grouping. Defaults to 500, capped at 1000.', { minimum: 1, maximum: 1000 }),
-    }),
-  },
-  {
-    name: 'securenow_human_action_report',
-    title: 'Get Human Action Report',
-    description: 'Fetch the full IP investigation report, investigation steps, proofs, metadata, and AI decision for one human action row.',
-    scope: 'notifications:read',
-    readOnly: true,
-    method: 'GET',
-    endpoint: '/notifications/:notificationId/ips/:ip',
-    pathParams: ['notificationId', 'ip'],
-    inputSchema: objectSchema({
-      notificationId: string('Notification id from the human action row.'),
-      ip: string('IP address from the human action row.'),
-    }, ['notificationId', 'ip']),
-  },
-  {
-    name: 'securenow_human_action_block',
-    title: 'Approve AI Block Recommendation',
-    description: 'Approve the AI-prepared block decision for an IP and optionally attach a structured decision report to the IP history. Write action; requires confirmation.',
-    scope: 'notifications:write',
-    readOnly: false,
-    destructive: true,
-    confirm: true,
-    method: 'PUT',
-    endpoint: '/notifications/:notificationId/ips/:ip/status',
-    pathParams: ['notificationId', 'ip'],
-    fixedBody: { status: 'blocked', decisionSource: 'ai_dag', reportSource: 'mcp' },
-    reasonAsNote: true,
-    bodyFields: ['note', 'verdict', 'riskScore', 'decisionReport', 'decisionSummary', 'outcome', 'evidence', 'reviewedHistory', 'traceIds', 'paths', 'methods', 'statusCodes', 'userAgents', 'missingProof', 'recommendations'],
-    inputSchema: objectSchema({
-      notificationId: string('Notification id from the human action row.'),
-      ip: string('IP address to block.'),
-      note: string('Audit note explaining why the AI block was approved.'),
-      verdict: string('Optional final verdict text.'),
-      riskScore: number('Optional risk score.', { minimum: 0, maximum: 100 }),
-      ...decisionReportInput,
-      ...confirmSchema,
-    }, ['notificationId', 'ip', 'confirm', 'reason']),
-  },
-  {
-    name: 'securenow_human_action_decision_report_add',
-    title: 'Record Human Action Decision Report',
-    description: 'Attach a structured analyst/MCP decision report to one Requires Human IP row without changing its status. Use for rate-limited, skipped, ambiguous, rule-tuning-needed, or already-handled rows. Write action; requires confirmation.',
-    scope: 'notifications:write',
-    readOnly: false,
-    confirm: true,
-    method: 'POST',
-    endpoint: '/notifications/:notificationId/ips/:ip/decision-report',
-    pathParams: ['notificationId', 'ip'],
-    fixedBody: { reportSource: 'mcp' },
-    bodyFields: ['reason', 'decisionReport', 'decisionSummary', 'outcome', 'evidence', 'reviewedHistory', 'traceIds', 'paths', 'methods', 'statusCodes', 'userAgents', 'missingProof', 'recommendations'],
-    inputSchema: objectSchema({
-      notificationId: string('Notification id from the human action row.'),
-      ip: string('IP address for the report.'),
-      ...decisionReportInput,
-      ...confirmSchema,
-    }, ['notificationId', 'ip', 'confirm', 'reason']),
-  },
-  {
-    name: 'securenow_human_action_close_no_write',
-    title: 'Close Human Action Without Enforcement',
-    description: 'Close one Requires Human IP row with an auditable no-write decision report. Use for ambiguous, skipped, rule-tuning-needed, new-rule-needed, rate-limited, or already-handled rows.',
-    scope: 'notifications:write',
-    readOnly: false,
-    confirm: true,
-    method: 'POST',
-    endpoint: '/notifications/:notificationId/ips/:ip/close-no-write',
-    pathParams: ['notificationId', 'ip'],
-    fixedBody: { reportSource: 'mcp' },
-    bodyFields: ['reason', 'decisionReport', 'decisionSummary', 'outcome', 'evidence', 'reviewedHistory', 'traceIds', 'paths', 'methods', 'statusCodes', 'userAgents', 'missingProof', 'recommendations'],
-    inputSchema: objectSchema({
-      notificationId: string('Notification id from the human action row.'),
-      ip: string('IP address for the row to close.'),
-      ...decisionReportInput,
-      ...confirmSchema,
-    }, ['notificationId', 'ip', 'confirm', 'reason']),
-  },
-  {
-    name: 'securenow_human_action_false_positive',
-    title: 'Mark Human Action False Positive',
-    description: 'Mark an AI-prepared human action as a scoped false positive and optionally attach a structured decision report to the IP history. Write action; requires confirmation.',
-    scope: 'notifications:write',
-    readOnly: false,
-    confirm: true,
-    method: 'POST',
-    endpoint: '/notifications/:notificationId/ips/:ip/false-positive',
-    pathParams: ['notificationId', 'ip'],
-    fixedBody: { reportSource: 'mcp' },
-    bodyFields: ['reason', 'conditions', 'matchMode', 'createExclusion', 'applyToExisting', 'ruleScope', 'targetRuleIds', 'aiConfidence', 'decisionReport', 'decisionSummary', 'outcome', 'evidence', 'reviewedHistory', 'traceIds', 'paths', 'methods', 'statusCodes', 'userAgents', 'missingProof', 'recommendations'],
-    inputSchema: objectSchema({
-      notificationId: string('Notification id from the human action row.'),
-      ip: string('IP address to mark as false positive.'),
-      conditions: { type: 'array', items: { type: 'object', additionalProperties: true }, description: 'Restrictive false-positive conditions. Prefer app/rule/path/method/status/user-agent/body scope.' },
-      matchMode: string('Condition match mode: all or any.'),
-      createExclusion: boolean('Whether to create a restrictive exclusion rule.'),
-      applyToExisting: boolean('Whether to apply to existing matching IP investigations.'),
-      ruleScope: string('Scope: this_rule, specific_rules, all_existing, or any_rule.'),
-      targetRuleIds: arrayOfStrings('Specific rule ids when ruleScope is specific_rules.'),
-      aiConfidence: number('AI confidence for audit metadata.', { minimum: 0, maximum: 100 }),
-      ...decisionReportInput,
-      ...confirmSchema,
-    }, ['notificationId', 'ip', 'confirm', 'reason']),
-  },
-  {
-    name: 'securenow_human_case_action_update',
-    title: 'Update Case-Level Human Action',
-    description: 'Approve, reject, execute, or fail a case-level proposed action such as tune_rule or create_exclusion. Write action; requires confirmation.',
-    scope: 'notifications:write',
-    readOnly: false,
-    confirm: true,
-    method: 'PUT',
-    endpoint: '/notifications/:notificationId/agent-case/actions/:actionKey',
-    pathParams: ['notificationId', 'actionKey'],
-    fixedBody: { reportSource: 'mcp' },
-    bodyFields: ['status', 'result', 'decisionReport', 'decisionSummary', 'outcome', 'evidence', 'reviewedHistory', 'traceIds', 'paths', 'ips', 'methods', 'statusCodes', 'userAgents', 'missingProof', 'recommendations'],
-    reasonInResult: true,
-    inputSchema: objectSchema({
-      notificationId: string('Notification id from the case-action row.'),
-      actionKey: string('Proposed action key from the row, for example tune_rule:...'),
-      status: string('New status: proposed, approved, rejected, executed, or failed.'),
-      result: { type: 'object', additionalProperties: true, description: 'Optional structured result/audit details.' },
-      ...decisionReportInput,
-      ...confirmSchema,
-    }, ['notificationId', 'actionKey', 'status', 'confirm', 'reason']),
-  },
-  {
-    name: 'securenow_human_case_decision_report_add',
-    title: 'Record Case Decision Report',
-    description: 'Attach a structured analyst/MCP decision report to a notification/case without changing IP status or proposed action state. Write action; requires confirmation.',
-    scope: 'notifications:write',
-    readOnly: false,
-    confirm: true,
-    method: 'POST',
-    endpoint: '/notifications/:notificationId/decision-report',
-    pathParams: ['notificationId'],
-    fixedBody: { reportSource: 'mcp' },
-    bodyFields: ['reason', 'decisionReport', 'decisionSummary', 'outcome', 'evidence', 'reviewedHistory', 'traceIds', 'paths', 'ips', 'methods', 'statusCodes', 'userAgents', 'missingProof', 'recommendations'],
-    inputSchema: objectSchema({
-      notificationId: string('Notification id from the case-action row.'),
-      ...decisionReportInput,
-      ...confirmSchema,
-    }, ['notificationId', 'confirm', 'reason']),
-  },
-  {
-    name: 'securenow_ip_lookup',
-    title: 'IP Intelligence Lookup',
-    description: 'Look up SecureNow IP intelligence for an IP address.',
-    scope: 'ip_intel:read',
-    readOnly: true,
-    method: 'GET',
-    endpoint: '/ip/:ip',
-    pathParams: ['ip'],
-    inputSchema: objectSchema({
-      ip: string('IPv4 address.'),
-    }, ['ip']),
-  },
-  {
-    name: 'securenow_ip_traces',
-    title: 'IP Traces',
-    description: 'Fetch traces associated with an IP address.',
-    scope: 'ip_intel:read',
-    readOnly: true,
-    method: 'GET',
-    endpoint: '/ip/:ip/traces',
-    pathParams: ['ip'],
-    queryFields: ['appKeys', 'environment'],
-    normalize: { appKeys: normalizeAppKeys },
-    inputSchema: objectSchema({
-      ip: string('IPv4 address.'),
-      ...appKeysInput,
-      ...environmentInput,
-    }, ['ip']),
-  },
-  {
-    name: 'securenow_forensics_query',
-    title: 'Run Forensics Query',
-    description: 'Run a natural-language forensic query. Write scope because it creates an async query job.',
-    scope: 'forensics:write',
-    readOnly: false,
-    confirm: true,
-    method: 'POST',
-    endpoint: '/forensics/query',
-    bodyFields: ['query', 'applicationId', 'instanceId', 'environment'],
-    inputSchema: objectSchema({
-      query: string('Natural-language forensic query.'),
-      applicationId: string('Optional application database id.'),
-      instanceId: string('Optional ClickHouse instance id.'),
-      ...environmentInput,
-      ...confirmSchema,
-    }, ['query', 'confirm', 'reason']),
-  },
-  {
-    name: 'securenow_forensics_library',
-    title: 'Forensics Query Library',
-    description: 'List saved forensics queries.',
-    scope: 'forensics:read',
-    readOnly: true,
-    method: 'GET',
-    endpoint: '/forensics/query-library',
-    inputSchema: objectSchema({}),
-  },
-  {
-    name: 'securenow_analytics_summary',
-    title: 'Analytics Summary',
-    description: 'Fetch response analytics summary.',
-    scope: 'analytics:read',
-    readOnly: true,
-    method: 'GET',
-    endpoint: '/analytics/summary',
-    queryFields: ['instanceId'],
-    inputSchema: objectSchema({
-      instanceId: string('Optional ClickHouse instance id.'),
-    }),
-  },
-  {
-    name: 'securenow_automation_rules_list',
-    title: 'List Automation Rules',
-    description: 'List blocklist automation rules with app/environment scope and stats.',
-    scope: 'automation:read',
-    readOnly: true,
-    method: 'GET',
-    endpoint: '/automation-rules',
-    inputSchema: objectSchema({}),
-  },
-  {
-    name: 'securenow_automation_defaults_ensure',
-    title: 'Ensure Default Automation Rules',
-    description: 'Create or refresh SecureNow default risk-score automation rules for the current account. Write action; requires confirmation.',
-    scope: 'automation:write',
-    readOnly: false,
-    confirm: true,
-    method: 'POST',
-    endpoint: '/automation-rules/defaults/ensure',
-    bodyFields: ['forceEnableExisting'],
-    inputSchema: objectSchema({
-      forceEnableExisting: boolean('Re-enable existing SecureNow default rules if the customer disabled them. Defaults to false.'),
-      ...confirmSchema,
-    }, ['confirm', 'reason']),
-  },
-  {
-    name: 'securenow_automation_rule_get',
-    title: 'Get Automation Rule',
-    description: 'Fetch one automation rule.',
-    scope: 'automation:read',
-    readOnly: true,
-    method: 'GET',
-    endpoint: '/automation-rules/:id',
-    pathParams: ['id'],
-    inputSchema: objectSchema({
-      id: string('Automation rule id.'),
-    }, ['id']),
-  },
-  {
-    name: 'securenow_automation_rule_create',
-    title: 'Create Automation Rule',
-    description: 'Create a blocklist automation rule. Write action; requires confirmation.',
-    scope: 'automation:write',
-    readOnly: false,
-    confirm: true,
-    method: 'POST',
-    endpoint: '/automation-rules',
-    bodyFields: ['name', 'description', 'conditions', 'conditionLogic', 'actions', 'status', 'applicationsAll', 'applicationKeys', 'environmentsAll', 'environments'],
-    inputSchema: objectSchema({
-      name: string('Rule name.'),
-      description: string('Optional rule description.'),
-      conditions: { type: 'array', items: { type: 'object', additionalProperties: true }, description: 'Condition array. Fields include abuseConfidenceScore, riskScore, alertName, alertTag, attackType, path, environment.' },
-      conditionLogic: string('AND or OR.'),
-      actions: { type: 'array', items: { type: 'object', additionalProperties: true }, description: 'Action array, for example [{ "type":"addToBlocklist", "config":{ "reason":"...", "ttlHours":24 }}].' },
-      status: string('Initial rule status: active or disabled. Defaults to active.'),
-      applicationsAll: boolean('Apply to all applications.'),
-      applicationKeys: arrayOfStrings('Application keys when not applying to all applications.'),
-      environmentsAll: boolean('Apply to all environments.'),
-      environments: arrayOfStrings('Deployment environments when not applying to all environments.'),
-      ...confirmSchema,
-    }, ['name', 'conditions', 'actions', 'confirm', 'reason']),
-  },
-  {
-    name: 'securenow_automation_rule_update',
-    title: 'Update Automation Rule',
-    description: 'Update a blocklist automation rule. Write action; requires confirmation.',
-    scope: 'automation:write',
-    readOnly: false,
-    confirm: true,
-    method: 'PUT',
-    endpoint: '/automation-rules/:id',
-    pathParams: ['id'],
-    bodyFields: ['name', 'description', 'conditions', 'conditionLogic', 'actions', 'status', 'applicationsAll', 'applicationKeys', 'environmentsAll', 'environments'],
-    inputSchema: objectSchema({
-      id: string('Automation rule id.'),
-      name: string('Rule name.'),
-      description: string('Optional rule description.'),
-      status: string('active or disabled.'),
-      conditions: { type: 'array', items: { type: 'object', additionalProperties: true }, description: 'Condition array.' },
-      conditionLogic: string('AND or OR.'),
-      actions: { type: 'array', items: { type: 'object', additionalProperties: true }, description: 'Action array.' },
-      applicationsAll: boolean('Apply to all applications.'),
-      applicationKeys: arrayOfStrings('Application keys when not applying to all applications.'),
-      environmentsAll: boolean('Apply to all environments.'),
-      environments: arrayOfStrings('Deployment environments when not applying to all environments.'),
-      ...confirmSchema,
-    }, ['id', 'confirm', 'reason']),
-  },
-  {
-    name: 'securenow_automation_rule_dry_run',
-    title: 'Dry-Run Automation Rule',
-    description: 'Preview automation matches without writing blocklist entries.',
-    scope: 'automation:read',
-    readOnly: true,
-    method: 'POST',
-    endpoint: '/automation-rules/:id/dry-run',
-    pathParams: ['id'],
-    bodyFields: ['limit', 'sampleLimit'],
-    inputSchema: objectSchema({
-      id: string('Automation rule id.'),
-      limit: number('Maximum notifications to scan.', { minimum: 1, maximum: 2000 }),
-      sampleLimit: number('Maximum sample matches to return.', { minimum: 1, maximum: 50 }),
-    }, ['id']),
-  },
-  {
-    name: 'securenow_automation_rule_execute',
-    title: 'Execute Automation Rule',
-    description: 'Execute an automation rule and add matching IPs to the blocklist. Write action; requires confirmation.',
-    scope: 'automation:write',
-    readOnly: false,
-    destructive: true,
-    confirm: true,
-    method: 'POST',
-    endpoint: '/automation-rules/:id/execute',
-    pathParams: ['id'],
-    inputSchema: objectSchema({
-      id: string('Automation rule id.'),
-      ...confirmSchema,
-    }, ['id', 'confirm', 'reason']),
-  },
-  {
-    name: 'securenow_automation_rule_delete',
-    title: 'Delete Automation Rule',
-    description: 'Delete an automation rule. Write action; requires confirmation.',
-    scope: 'automation:write',
-    readOnly: false,
-    destructive: true,
-    confirm: true,
-    method: 'DELETE',
-    endpoint: '/automation-rules/:id',
-    pathParams: ['id'],
-    inputSchema: objectSchema({
-      id: string('Automation rule id.'),
-      ...confirmSchema,
-    }, ['id', 'confirm', 'reason']),
-  },
-  {
-    name: 'securenow_rate_limit_list',
-    title: 'List Rate Limits',
-    description: 'List rate-limit remediation rules with app/environment scope.',
-    scope: 'rate_limits:read',
-    readOnly: true,
-    method: 'GET',
-    endpoint: '/rate-limits',
-    queryFields: ['status', 'search', 'page', 'limit', 'appKey', 'environment'],
-    inputSchema: objectSchema({
-      status: string('Rule status: active, disabled, removed, or all. Defaults to active.'),
-      search: string('Optional IP/path/name search.'),
-      ...pagingInput,
-      appKey: string('Optional application key scope.'),
-      ...environmentInput,
-    }),
-  },
-  {
-    name: 'securenow_rate_limit_get',
-    title: 'Get Rate Limit',
-    description: 'Fetch one rate-limit remediation rule.',
-    scope: 'rate_limits:read',
-    readOnly: true,
-    method: 'GET',
-    endpoint: '/rate-limits/:id',
-    pathParams: ['id'],
-    inputSchema: objectSchema({
-      id: string('Rate-limit rule id.'),
-    }, ['id']),
-  },
-  {
-    name: 'securenow_rate_limit_test',
-    title: 'Test Rate Limit Match',
-    description: 'Check whether an IP/path/method would match an active rate-limit rule.',
-    scope: 'rate_limits:read',
-    readOnly: true,
-    method: 'GET',
-    endpoint: '/rate-limits/check',
-    queryFields: ['ip', 'path', 'method', 'appKey', 'environment'],
-    inputSchema: objectSchema({
-      ip: string('IPv4 address to test.'),
-      path: string('Request path to test. Defaults to /.'),
-      method: string('HTTP method to test. Defaults to GET.'),
-      appKey: string('Optional application key scope.'),
-      ...environmentInput,
-    }, ['ip']),
-  },
-  {
-    name: 'securenow_rate_limit_remove',
-    title: 'Remove Rate Limit',
-    description: 'Remove a rate-limit remediation rule. Write action; requires confirmation.',
-    scope: 'rate_limits:write',
-    readOnly: false,
-    confirm: true,
-    method: 'DELETE',
-    endpoint: '/rate-limits/:id',
-    pathParams: ['id'],
-    bodyFields: ['reason'],
-    inputSchema: objectSchema({
-      id: string('Rate-limit rule id.'),
-      ...confirmSchema,
-    }, ['id', 'confirm', 'reason']),
-  },
-  {
-    name: 'securenow_rate_limit_parse',
-    title: 'Parse Rate Limit Text',
-    description: 'Use SecureNow AI to convert natural language into a rate-limit remediation draft without creating it.',
-    scope: 'rate_limits:read',
-    readOnly: true,
-    method: 'POST',
-    endpoint: '/rate-limits/parse',
-    bodyFields: ['text', 'draft'],
-    inputSchema: objectSchema({
-      text: string('Natural-language rate-limit request, e.g. "rate limit /api/login to 2 attempts per minute for this IP".'),
-      draft: { type: 'object', additionalProperties: true, description: 'Optional existing draft fields to preserve or resolve phrases such as "this IP".' },
-    }, ['text']),
-  },
-  {
-    name: 'securenow_rate_limit_create_from_text',
-    title: 'Create Rate Limit From Text',
-    description: 'Create a rate-limit remediation rule from natural language. Write action; requires confirmation.',
-    scope: 'rate_limits:write',
-    readOnly: false,
-    confirm: true,
-    method: 'POST',
-    endpoint: '/rate-limits/from-text',
-    bodyFields: ['text', 'draft', 'reason'],
-    inputSchema: objectSchema({
-      text: string('Natural-language rate-limit request.'),
-      draft: { type: 'object', additionalProperties: true, description: 'Optional existing draft fields or scope hints.' },
-      ...confirmSchema,
-    }, ['text', 'confirm', 'reason']),
-  },
-  {
-    name: 'securenow_alert_rules_list',
-    title: 'List Alert Rules',
-    description: 'List alert rules, including system rules and app scope.',
-    scope: 'alerts:read',
-    readOnly: true,
-    method: 'GET',
-    endpoint: '/alert-rules',
-    inputSchema: objectSchema({}),
-  },
-  {
-    name: 'securenow_alert_rule_get',
-    title: 'Get Alert Rule',
-    description: 'Fetch one alert rule.',
-    scope: 'alerts:read',
-    readOnly: true,
-    method: 'GET',
-    endpoint: '/alert-rules/:id',
-    pathParams: ['id'],
-    inputSchema: objectSchema({
-      id: string('Alert rule id.'),
-    }, ['id']),
-  },
-  {
-    name: 'securenow_alert_rule_update',
-    title: 'Update Alert Rule',
-    description: 'Update alert rule scope/status/schedule/throttle or record a review action. Write action; requires confirmation.',
-    scope: 'alerts:write',
-    readOnly: false,
-    confirm: true,
-    method: 'PUT',
-    endpoint: '/alert-rules/:id',
-    pathParams: ['id'],
-    bodyFields: ['name', 'description', 'status', 'applicationsAll', 'applications', 'schedule', 'throttle', 'alertChannelIds', 'reviewAction', 'reviewNote', 'reviewNotificationId'],
-    inputSchema: objectSchema({
-      id: string('Alert rule id.'),
-      name: string('Rule name for custom rules.'),
-      description: string('Rule description for custom rules.'),
-      status: string('Active, Disabled, or Paused.'),
-      applicationsAll: boolean('Scope rule to all applications.'),
-      applications: arrayOfStrings('Application keys when applicationsAll is false.'),
-      schedule: { type: 'object', additionalProperties: true, description: 'Schedule patch.' },
-      throttle: { type: 'object', additionalProperties: true, description: 'Throttle patch.' },
-      alertChannelIds: arrayOfStrings('Alert channel ids.'),
-      reviewAction: string('Rule review action, e.g. keep_active or saved_new_version.'),
-      reviewNote: string('Review note.'),
-      reviewNotificationId: string('Notification id tied to this review.'),
-      ...confirmSchema,
-    }, ['id', 'confirm', 'reason']),
-  },
-  {
-    name: 'securenow_alert_rule_query_update',
-    title: 'Update System Alert Rule Query',
-    description: 'Admin-only: update the shared public query mapping behind a system alert rule for all customer copies. Write action; requires confirmation.',
-    scope: 'alerts:write',
-    readOnly: false,
-    confirm: true,
-    method: 'PUT',
-    endpoint: '/alert-rules/:id/query-mapping',
-    pathParams: ['id'],
-    bodyFields: ['sqlQuery', 'reason', 'expectedCurrentSqlHash', 'applyGlobally', 'reactivatePausedCopies', 'reviewNotificationId', 'reviewNote', 'source'],
-    fixedBody: { applyGlobally: true, source: 'mcp' },
-    inputSchema: objectSchema({
-      id: string('Alert rule id. Must be a system rule.'),
-      sqlQuery: string('Full replacement SQL query. System SQL must keep __USER_APP_KEYS__ for tenant scoping.'),
-      expectedCurrentSqlHash: string('Optional SHA-256 hash of the current SQL to prevent stale overwrites.'),
-      applyGlobally: boolean('Must be true. Updates the shared public query mapping used by all system rule copies.'),
-      reactivatePausedCopies: boolean('Whether to reactivate paused noisy copies after the query is tuned.'),
-      reviewNotificationId: string('Optional notification id tied to this review/tuning action.'),
-      reviewNote: string('Optional review note. Defaults to reason.'),
-      ...confirmSchema,
-    }, ['id', 'sqlQuery', 'confirm', 'reason']),
-  },
-  {
-    name: 'securenow_alert_rule_instant_update',
-    title: 'Update Instant Alert Rule',
-    description: 'Patch instant rule conditions/config with version/hash guards and before/after seeded tests. System rules require applyGlobally:true and admin permission. Write action; requires confirmation.',
-    scope: 'alerts:write',
-    readOnly: false,
-    confirm: true,
-    method: 'PUT',
-    endpoint: '/alert-rules/:id/instant',
-    pathParams: ['id'],
-    bodyFields: [
-      'operations',
-      'conditions',
-      'enabled',
-      'source',
-      'matchMode',
-      'executionMode',
-      'severity',
-      'throttle',
-      'expectedRuleVersion',
-      'expectedCurrentInstantHash',
-      'expectedCurrentRuleHash',
-      'applyGlobally',
-      'dryRun',
-      'reactivatePausedCopies',
-      'fixtures',
-      'reviewNotificationId',
-      'reviewNote',
-      'reason',
-    ],
-    fixedBody: { auditSource: 'mcp' },
-    inputSchema: objectSchema({
-      id: string('Alert rule id. Fetch with securenow_alert_rule_get first to get ruleVersion and instantHash.'),
-      operations: {
-        type: 'array',
-        items: { type: 'object', additionalProperties: true },
-        description: 'Condition patch operations: add_condition, remove_condition, update_condition. Use zero-based index/conditionIndex for remove/update.',
-      },
-      conditions: {
-        type: 'array',
-        items: { type: 'object', additionalProperties: true },
-        description: 'Optional full replacement instant conditions array. Use operations for smaller patches.',
-      },
-      enabled: boolean('Whether instant detection is enabled.'),
-      source: string('Instant event source. Currently trace.'),
-      matchMode: string('Condition match mode: all or any.'),
-      executionMode: string('Rule execution mode: instant or hybrid when instant detection is enabled.'),
-      severity: string('Optional severity override: critical, high, medium, or low.'),
-      throttle: { type: 'object', additionalProperties: true, description: 'Throttle patch, for example { enabled:true, minutes:15 }.' },
-      expectedRuleVersion: number('Required current reviewState.reviewVersion from securenow_alert_rule_get.', { minimum: 1 }),
-      expectedCurrentInstantHash: string('Required SHA-256 hash of the current instant config from securenow_alert_rule_get.'),
-      expectedCurrentRuleHash: string('Optional SHA-256 hash of the current instant/throttle/severity surface from securenow_alert_rule_get.'),
-      applyGlobally: boolean('Required true for system rules. Updates every customer copy of the system rule.'),
-      dryRun: boolean('When true, validates and runs before/after seeded tests without saving.'),
-      reactivatePausedCopies: boolean('Whether to reactivate paused noisy copies after the instant rule is tuned.'),
-      fixtures: {
-        type: 'array',
-        items: { type: 'object', additionalProperties: true },
-        description: 'Optional seeded fixtures. Each may include kind attack/benign, label, path, method, requestBody, requestHeaders, and expectMatch.',
-      },
-      reviewNotificationId: string('Optional notification id tied to this review/tuning action.'),
-      reviewNote: string('Optional review note. Defaults to reason.'),
-      ...confirmSchema,
-    }, ['id', 'expectedRuleVersion', 'expectedCurrentInstantHash', 'confirm', 'reason']),
-  },
-  {
-    name: 'securenow_alert_rule_conditions_get',
-    title: 'Get Alert Rule Conditions',
-    description: 'Fetch instant rule conditions with rule version and hash guards for safe condition-level tuning.',
-    scope: 'alerts:read',
-    readOnly: true,
-    method: 'GET',
-    endpoint: '/alert-rules/:id/conditions',
-    pathParams: ['id'],
-    inputSchema: objectSchema({
-      id: string('Alert rule id.'),
-    }, ['id']),
-  },
-  {
-    name: 'securenow_alert_rule_condition_update',
-    title: 'Update Alert Rule Condition',
-    description: 'Patch instant alert-rule conditions with version/hash guards and seeded before/after tests. Compatibility alias for condition-level tuning.',
-    scope: 'alerts:write',
-    readOnly: false,
-    confirm: true,
-    method: 'PUT',
-    endpoint: '/alert-rules/:id/instant',
-    pathParams: ['id'],
-    bodyFields: [
-      'confirm',
-      'operations',
-      'conditions',
-      'enabled',
-      'source',
-      'matchMode',
-      'executionMode',
-      'expectedRuleVersion',
-      'expectedCurrentInstantHash',
-      'expectedCurrentRuleHash',
-      'applyGlobally',
-      'reactivatePausedCopies',
-      'fixtures',
-      'reviewNotificationId',
-      'reviewNote',
-      'reason',
-    ],
-    fixedBody: { auditSource: 'mcp' },
-    inputSchema: objectSchema({
-      id: string('Alert rule id. Fetch with securenow_alert_rule_conditions_get first to get ruleVersion and instantHash.'),
-      operations: {
-        type: 'array',
-        items: { type: 'object', additionalProperties: true },
-        description: 'Condition patch operations: add_condition, remove_condition, update_condition. Use zero-based index/conditionIndex for remove/update.',
-      },
-      conditions: {
-        type: 'array',
-        items: { type: 'object', additionalProperties: true },
-        description: 'Optional full replacement instant conditions array. Use operations for smaller patches.',
-      },
-      enabled: boolean('Whether instant detection is enabled.'),
-      source: string('Instant event source. Currently trace.'),
-      matchMode: string('Condition match mode: all or any.'),
-      executionMode: string('Rule execution mode: instant or hybrid when instant detection is enabled.'),
-      expectedRuleVersion: number('Required current reviewState.reviewVersion from securenow_alert_rule_conditions_get.', { minimum: 1 }),
-      expectedCurrentInstantHash: string('Required SHA-256 hash of the current instant config from securenow_alert_rule_conditions_get.'),
-      expectedCurrentRuleHash: string('Optional SHA-256 hash of the current instant/throttle/severity surface from securenow_alert_rule_conditions_get.'),
-      applyGlobally: boolean('Required true for system rules. Updates every customer copy of the system rule.'),
-      reactivatePausedCopies: boolean('Whether to reactivate paused noisy copies after the condition is tuned.'),
-      fixtures: {
-        type: 'array',
-        items: { type: 'object', additionalProperties: true },
-        description: 'Optional seeded fixtures. Each may include kind attack/benign, label, path, method, requestBody, requestHeaders, and expectMatch.',
-      },
-      reviewNotificationId: string('Optional notification id tied to this review/tuning action.'),
-      reviewNote: string('Optional review note. Defaults to reason.'),
-      ...confirmSchema,
-    }, ['id', 'expectedRuleVersion', 'expectedCurrentInstantHash', 'confirm', 'reason']),
-  },
-  {
-    name: 'securenow_alert_rule_condition_candidate_test',
-    title: 'Test Alert Rule Condition Candidate',
-    description: 'Dry-run a condition-level instant-rule patch without saving it, including seeded benign/attack fixture checks.',
-    scope: 'alerts:write',
-    readOnly: false,
-    confirm: true,
-    method: 'PUT',
-    endpoint: '/alert-rules/:id/instant',
-    pathParams: ['id'],
-    bodyFields: [
-      'confirm',
-      'operations',
-      'conditions',
-      'enabled',
-      'source',
-      'matchMode',
-      'executionMode',
-      'expectedRuleVersion',
-      'expectedCurrentInstantHash',
-      'expectedCurrentRuleHash',
-      'applyGlobally',
-      'fixtures',
-      'reviewNotificationId',
-      'reviewNote',
-      'reason',
-    ],
-    fixedBody: { auditSource: 'mcp', dryRun: true },
-    inputSchema: objectSchema({
-      id: string('Alert rule id. Fetch with securenow_alert_rule_conditions_get first to get ruleVersion and instantHash.'),
-      operations: {
-        type: 'array',
-        items: { type: 'object', additionalProperties: true },
-        description: 'Candidate condition operations to test.',
-      },
-      conditions: {
-        type: 'array',
-        items: { type: 'object', additionalProperties: true },
-        description: 'Optional full replacement instant conditions array to test.',
-      },
-      enabled: boolean('Whether instant detection would be enabled.'),
-      source: string('Instant event source. Currently trace.'),
-      matchMode: string('Condition match mode: all or any.'),
-      executionMode: string('Rule execution mode: instant or hybrid when instant detection is enabled.'),
-      expectedRuleVersion: number('Required current reviewState.reviewVersion from securenow_alert_rule_conditions_get.', { minimum: 1 }),
-      expectedCurrentInstantHash: string('Required SHA-256 hash of the current instant config from securenow_alert_rule_conditions_get.'),
-      expectedCurrentRuleHash: string('Optional SHA-256 hash of the current instant/throttle/severity surface from securenow_alert_rule_conditions_get.'),
-      applyGlobally: boolean('Required true for system rules, even for admin dry-runs.'),
-      fixtures: {
-        type: 'array',
-        items: { type: 'object', additionalProperties: true },
-        description: 'Optional seeded fixtures. Each may include kind attack/benign, label, path, method, requestBody, requestHeaders, and expectMatch.',
-      },
-      reviewNotificationId: string('Optional notification id tied to this review/tuning action.'),
-      reviewNote: string('Optional review note. Defaults to reason.'),
-      ...confirmSchema,
-    }, ['id', 'expectedRuleVersion', 'expectedCurrentInstantHash', 'confirm', 'reason']),
-  },
-  {
-    name: 'securenow_alert_rule_condition_diff',
-    title: 'Diff Alert Rule Condition Candidate',
-    description: 'Return the current instant conditions, candidate conditions, hashes, and before/after fixture behavior without saving.',
-    scope: 'alerts:write',
-    readOnly: false,
-    confirm: true,
-    method: 'PUT',
-    endpoint: '/alert-rules/:id/instant',
-    pathParams: ['id'],
-    bodyFields: [
-      'confirm',
-      'operations',
-      'conditions',
-      'enabled',
-      'source',
-      'matchMode',
-      'executionMode',
-      'expectedRuleVersion',
-      'expectedCurrentInstantHash',
-      'expectedCurrentRuleHash',
-      'applyGlobally',
-      'fixtures',
-      'reason',
-    ],
-    fixedBody: { auditSource: 'mcp', dryRun: true },
-    inputSchema: objectSchema({
-      id: string('Alert rule id. Fetch with securenow_alert_rule_conditions_get first to get ruleVersion and instantHash.'),
-      operations: {
-        type: 'array',
-        items: { type: 'object', additionalProperties: true },
-        description: 'Candidate condition operations to diff.',
-      },
-      conditions: {
-        type: 'array',
-        items: { type: 'object', additionalProperties: true },
-        description: 'Optional full replacement instant conditions array to diff.',
-      },
-      enabled: boolean('Whether instant detection would be enabled.'),
-      source: string('Instant event source. Currently trace.'),
-      matchMode: string('Condition match mode: all or any.'),
-      executionMode: string('Rule execution mode: instant or hybrid when instant detection is enabled.'),
-      expectedRuleVersion: number('Required current reviewState.reviewVersion from securenow_alert_rule_conditions_get.', { minimum: 1 }),
-      expectedCurrentInstantHash: string('Required SHA-256 hash of the current instant config from securenow_alert_rule_conditions_get.'),
-      expectedCurrentRuleHash: string('Optional SHA-256 hash of the current instant/throttle/severity surface from securenow_alert_rule_conditions_get.'),
-      applyGlobally: boolean('Required true for system rules, even for admin dry-runs.'),
-      fixtures: {
-        type: 'array',
-        items: { type: 'object', additionalProperties: true },
-        description: 'Optional seeded fixtures used to explain benign removals and attack coverage.',
-      },
-      ...confirmSchema,
-    }, ['id', 'expectedRuleVersion', 'expectedCurrentInstantHash', 'confirm', 'reason']),
-  },
-  {
-    name: 'securenow_alert_rule_test',
-    title: 'Test Alert Rule',
-    description: 'Start a live or dry-run alert rule test.',
-    scope: 'alerts:write',
-    readOnly: false,
-    confirm: true,
-    method: 'POST',
-    endpoint: '/alert-rules/:id/test',
-    pathParams: ['id'],
-    bodyFields: ['applicationKey', 'mode'],
-    inputSchema: objectSchema({
-      id: string('Alert rule id.'),
-      applicationKey: string('Application key to test.'),
-      mode: string('dry_run or live.'),
-      ...confirmSchema,
-    }, ['id', 'confirm', 'reason']),
-  },
-  {
-    name: 'securenow_alert_rule_candidate_test',
-    title: 'Dry-Run Candidate Alert Rule SQL',
-    description: 'Dry-run a candidate SQL/query guard for an alert rule without saving it.',
-    scope: 'alerts:write',
-    readOnly: false,
-    confirm: true,
-    method: 'POST',
-    endpoint: '/alert-rules/:id/test',
-    pathParams: ['id'],
-    bodyFields: ['applicationKey', 'candidateSqlQuery'],
-    fixedBody: { mode: 'dry_run' },
-    inputSchema: objectSchema({
-      id: string('Alert rule id.'),
-      applicationKey: string('Application key to test.'),
-      candidateSqlQuery: string('Full candidate SQL query to dry-run without saving.'),
-      ...confirmSchema,
-    }, ['id', 'candidateSqlQuery', 'confirm', 'reason']),
-  },
-  {
-    name: 'securenow_alert_rule_test_result',
-    title: 'Get Alert Rule Test Result',
-    description: 'Poll alert rule test status and results.',
-    scope: 'alerts:read',
-    readOnly: true,
-    method: 'GET',
-    endpoint: '/alert-rules/:id/test/:testId',
-    pathParams: ['id', 'testId'],
-    inputSchema: objectSchema({
-      id: string('Alert rule id.'),
-      testId: string('Alert rule test id.'),
-    }, ['id', 'testId']),
-  },
-  {
-    name: 'securenow_alert_rule_exclusions_list',
-    title: 'List Alert Rule Exclusions',
-    description: 'List exclusions embedded on one alert rule.',
-    scope: 'alerts:read',
-    readOnly: true,
-    method: 'GET',
-    endpoint: '/alert-rules/:id/exclusions',
-    pathParams: ['id'],
-    inputSchema: objectSchema({
-      id: string('Alert rule id.'),
-    }, ['id']),
-  },
-  {
-    name: 'securenow_alert_rule_exclusion_add',
-    title: 'Add Alert Rule Exclusion',
-    description: 'Add a restrictive exclusion to one alert rule. Write action; requires confirmation.',
-    scope: 'alerts:write',
-    readOnly: false,
-    confirm: true,
-    method: 'POST',
-    endpoint: '/alert-rules/:id/exclusions',
-    pathParams: ['id'],
-    bodyFields: ['conditions', 'matchMode', 'reason', 'pathPattern', 'isActive'],
-    inputSchema: objectSchema({
-      id: string('Alert rule id.'),
-      conditions: { type: 'array', items: { type: 'object', additionalProperties: true }, description: 'Restrictive exclusion conditions.' },
-      matchMode: string('all or any.'),
-      reason: string('Exclusion reason.'),
-      pathPattern: string('Optional path pattern.'),
-      isActive: boolean('Whether the exclusion is active.'),
-      ...confirmSchema,
-    }, ['id', 'confirm', 'reason']),
-  },
-  {
-    name: 'securenow_alert_rule_exclusion_remove',
-    title: 'Remove Alert Rule Exclusion',
-    description: 'Remove an alert rule exclusion. Write action; requires confirmation.',
-    scope: 'alerts:write',
-    readOnly: false,
-    confirm: true,
-    method: 'DELETE',
-    endpoint: '/alert-rules/:id/exclusions/:exclusionId',
-    pathParams: ['id', 'exclusionId'],
-    inputSchema: objectSchema({
-      id: string('Alert rule id.'),
-      exclusionId: string('Exclusion id.'),
-      ...confirmSchema,
-    }, ['id', 'exclusionId', 'confirm', 'reason']),
-  },
-  {
-    name: 'securenow_blocklist_list',
-    title: 'List Blocklist',
-    description: 'List blocked IPs.',
-    scope: 'blocklist:read',
-    readOnly: true,
-    method: 'GET',
-    endpoint: '/blocklist',
-    queryFields: ['page', 'limit', 'status', 'approvalStatus', 'search', 'view', 'appKey', 'environment'],
-    inputSchema: objectSchema({
-      ...pagingInput,
-      status: string('Block entry status: active or removed. Defaults to active.'),
-      approvalStatus: string('Optional approval filter: pending, approved, or rejected.'),
-      search: string('Optional IP prefix search.'),
-      view: string('List view: all or operational.'),
-      appKey: string('Optional application key scope.'),
-      ...environmentInput,
-    }),
-  },
-  {
-    name: 'securenow_blocklist_pending_list',
-    title: 'List Pending Block Approvals',
-    description: 'List legacy or AI-prepared blocklist entries with approvalStatus=pending. Pending blocks are not enforced until approved.',
-    scope: 'blocklist:read',
-    readOnly: true,
-    method: 'GET',
-    endpoint: '/blocklist/pending',
-    queryFields: ['page', 'limit', 'search', 'appKey', 'environment'],
-    inputSchema: objectSchema({
-      ...pagingInput,
-      search: string('Optional IP prefix search.'),
-      appKey: string('Optional application key scope.'),
-      ...environmentInput,
-    }),
-  },
-  {
-    name: 'securenow_blocklist_pending_approve',
-    title: 'Approve Pending Block',
-    description: 'Approve one pending blocklist entry so the firewall enforces it. Write action; requires confirmation.',
-    scope: 'blocklist:write',
-    readOnly: false,
-    destructive: true,
-    confirm: true,
-    method: 'POST',
-    endpoint: '/blocklist/:id/approve',
-    pathParams: ['id'],
-    bodyFields: ['reason'],
-    inputSchema: objectSchema({
-      id: string('Pending blocklist entry id.'),
-      ...confirmSchema,
-    }, ['id', 'confirm', 'reason']),
-  },
-  {
-    name: 'securenow_blocklist_pending_reject',
-    title: 'Reject Pending Block',
-    description: 'Reject one pending blocklist entry and remove it from enforcement consideration. Write action; requires confirmation.',
-    scope: 'blocklist:write',
-    readOnly: false,
-    confirm: true,
-    method: 'POST',
-    endpoint: '/blocklist/:id/reject',
-    pathParams: ['id'],
-    bodyFields: ['reason'],
-    inputSchema: objectSchema({
-      id: string('Pending blocklist entry id.'),
-      ...confirmSchema,
-    }, ['id', 'confirm', 'reason']),
-  },
-  {
-    name: 'securenow_blocklist_pending_bulk_approve',
-    title: 'Bulk Approve Pending Blocks',
-    description: 'Approve multiple pending blocklist entries after they have all been reviewed under the same safe policy. Write action; requires confirmation.',
-    scope: 'blocklist:write',
-    readOnly: false,
-    destructive: true,
-    confirm: true,
-    method: 'POST',
-    endpoint: '/blocklist/bulk-approve',
-    bodyFields: ['ids', 'reason'],
-    inputSchema: objectSchema({
-      ids: arrayOfStrings('Pending blocklist entry ids to approve.'),
-      ...confirmSchema,
-    }, ['ids', 'confirm', 'reason']),
-  },
-  {
-    name: 'securenow_blocklist_pending_bulk_reject',
-    title: 'Bulk Reject Pending Blocks',
-    description: 'Reject multiple pending blocklist entries after they have all been reviewed as false positives or stale/ambiguous. Write action; requires confirmation.',
-    scope: 'blocklist:write',
-    readOnly: false,
-    confirm: true,
-    method: 'POST',
-    endpoint: '/blocklist/bulk-reject',
-    bodyFields: ['ids', 'reason'],
-    inputSchema: objectSchema({
-      ids: arrayOfStrings('Pending blocklist entry ids to reject.'),
-      ...confirmSchema,
-    }, ['ids', 'confirm', 'reason']),
-  },
-  {
-    name: 'securenow_blocklist_add',
-    title: 'Add Blocked IP',
-    description: 'Add an IP/CIDR to the blocklist, optionally scoped to a route/method. Write action; requires confirmation.',
-    scope: 'blocklist:write',
-    readOnly: false,
-    confirm: true,
-    method: 'POST',
-    endpoint: '/blocklist',
-    bodyFields: ['ip', 'reason', 'expiresAt', 'metadata', 'appKey', 'environment', 'pathPattern', 'pathMatchMode', 'method'],
-    inputSchema: objectSchema({
-      ip: string('IPv4 address or CIDR.'),
-      reason: string('Reason for blocking.'),
-      expiresAt: string('Optional expiry time as ISO 8601.'),
-      metadata: { type: 'object', additionalProperties: true, description: 'Optional metadata.' },
-      appKey: string('Optional application key to scope this block. Omit for all apps.'),
-      pathPattern: string('Optional route/path pattern, for example /admin*. Omit to block all routes.'),
-      pathMatchMode: { type: 'string', enum: ['exact', 'prefix', 'regex'], description: 'Path matching mode. Defaults to prefix.' },
-      method: { type: 'string', enum: ['ALL', 'GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS'], description: 'HTTP method scope. Defaults to ALL.' },
-      ...environmentInput,
-      ...confirmSchema,
-    }, ['ip', 'confirm', 'reason']),
-  },
-  {
-    name: 'securenow_blocklist_remove',
-    title: 'Unblock IP (Compat Alias)',
-    description: 'Compatibility alias for unblocking a blocklist entry while retaining block report/history. Write action; requires confirmation.',
-    scope: 'blocklist:write',
-    readOnly: false,
-    confirm: true,
-    method: 'POST',
-    endpoint: '/blocklist/:id/unblock',
-    pathParams: ['id'],
-    bodyFields: ['reason'],
-    inputSchema: objectSchema({
-      id: string('Blocklist entry id.'),
-      ...confirmSchema,
-    }, ['id', 'confirm', 'reason']),
-  },
-  {
-    name: 'securenow_blocklist_unblock',
-    title: 'Unblock IP And Keep History',
-    description: 'Unblock a blocklist entry so firewall enforcement stops, while retaining the block report, history, and unblock audit trail. Write action; requires confirmation.',
-    scope: 'blocklist:write',
-    readOnly: false,
-    confirm: true,
-    method: 'POST',
-    endpoint: '/blocklist/:id/unblock',
-    pathParams: ['id'],
-    bodyFields: ['reason'],
-    inputSchema: objectSchema({
-      id: string('Blocklist entry id.'),
-      ...confirmSchema,
-    }, ['id', 'confirm', 'reason']),
-  },
-  {
-    name: 'securenow_blocklist_stats',
-    title: 'Blocklist Stats',
-    description: 'Return blocklist statistics.',
-    scope: 'blocklist:read',
-    readOnly: true,
-    method: 'GET',
-    endpoint: '/blocklist/stats',
-    inputSchema: objectSchema({}),
-  },
-  {
-    name: 'securenow_allowlist_list',
-    title: 'List Restrictive Allowlist',
-    description: 'List restrictive allowlist entries. If any active entry exists for an app/environment, only listed IPs can reach it and all other IPs are blocked. This is not the Trusted IP list.',
-    scope: 'allowlist:read',
-    readOnly: true,
-    method: 'GET',
-    endpoint: '/allowlist',
-    queryFields: ['page', 'limit', 'appKey', 'environment'],
-    inputSchema: objectSchema({
-      ...pagingInput,
-      appKey: string('Optional application key scope.'),
-      ...environmentInput,
-    }),
-  },
-  {
-    name: 'securenow_allowlist_add',
-    title: 'Add Restrictive Allowlist IP',
-    description: 'Dangerous production action: add an IP/CIDR to the restrictive allowlist. Once active, allowlist mode blocks every IP except listed entries. Do not use this to mark an IP trusted or suppress false positives; use securenow_trusted_add instead. Requires explicit human approval confirming deny-all behavior.',
-    scope: 'allowlist:write',
-    readOnly: false,
-    confirm: true,
-    method: 'POST',
-    endpoint: '/allowlist',
-    fixedBody: { initiatedBy: 'mcp' },
-    bodyFields: ['ip', 'label', 'reason', 'expiresAt', 'applicationsAll', 'applicationKeys', 'environment', 'allowlistDenyAllApproved'],
-    inputSchema: objectSchema({
-      ip: string('IPv4 address or CIDR.'),
-      label: string('Human-readable label.'),
-      reason: string('Required human-approved reason. Must acknowledge that allowlist blocks all non-listed IPs and why Trusted IPs is not the correct action.'),
-      expiresAt: string('Optional expiry time as ISO 8601.'),
-      applicationsAll: boolean('Apply to all applications.'),
-      applicationKeys: arrayOfStrings('Application keys to scope this allowlist entry to.'),
-      allowlistDenyAllApproved: boolean('Must be true only after the user explicitly approves deny-by-default allowlist behavior. Do not set this for trusted IPs, monitors, false positives, or investigation cleanup.'),
-      ...environmentInput,
-      ...confirmSchema,
-    }, ['ip', 'confirm', 'reason', 'allowlistDenyAllApproved']),
-  },
-  {
-    name: 'securenow_allowlist_remove',
-    title: 'Remove Allowed IP',
-    description: 'Remove an allowlist entry. Write action; requires confirmation.',
-    scope: 'allowlist:write',
-    readOnly: false,
-    confirm: true,
-    method: 'DELETE',
-    endpoint: '/allowlist/:id',
-    pathParams: ['id'],
-    inputSchema: objectSchema({
-      id: string('Allowlist entry id.'),
-      ...confirmSchema,
-    }, ['id', 'confirm', 'reason']),
-  },
-  {
-    name: 'securenow_trusted_list',
-    title: 'List Trusted IPs',
-    description: 'List trusted IPs. Trusted IPs are for known-safe traffic and do not turn on deny-by-default allowlist mode.',
-    scope: 'trusted_ips:read',
-    readOnly: true,
-    method: 'GET',
-    endpoint: '/trusted-ips',
-    queryFields: ['appKey', 'environment'],
-    inputSchema: objectSchema({
-      appKey: string('Optional application key scope.'),
-      ...environmentInput,
-    }),
-  },
-  {
-    name: 'securenow_trusted_add',
-    title: 'Add Trusted IP',
-    description: 'Add a trusted IP/CIDR for known-safe infrastructure, monitors, office/VPN traffic, or scoped false-positive suppression. This does not enable deny-by-default allowlist mode and is the correct tool when an IP should be trusted without blocking other visitors. Write action; requires confirmation.',
-    scope: 'trusted_ips:write',
-    readOnly: false,
-    confirm: true,
-    method: 'POST',
-    endpoint: '/trusted-ips',
-    bodyFields: ['ip', 'label', 'note', 'applicationsAll', 'applicationKeys', 'environment'],
-    inputSchema: objectSchema({
-      ip: string('IPv4 address or CIDR.'),
-      label: string('Human-readable label.'),
-      note: string('Optional note.'),
-      applicationsAll: boolean('Apply to all applications.'),
-      applicationKeys: arrayOfStrings('Application keys to scope this trusted IP to.'),
-      ...environmentInput,
-      ...confirmSchema,
-    }, ['ip', 'confirm', 'reason']),
-  },
-  {
-    name: 'securenow_trusted_remove',
-    title: 'Remove Trusted IP',
-    description: 'Remove a trusted IP entry. Write action; requires confirmation.',
-    scope: 'trusted_ips:write',
-    readOnly: false,
-    confirm: true,
-    method: 'DELETE',
-    endpoint: '/trusted-ips/:id',
-    pathParams: ['id'],
-    inputSchema: objectSchema({
-      id: string('Trusted IP entry id.'),
-      ...confirmSchema,
-    }, ['id', 'confirm', 'reason']),
-  },
-];
-
-const RESOURCES = [
-  {
-    uri: 'securenow://docs/skill-api',
-    name: 'skill-api',
-    title: 'SecureNow SDK Skill',
-    description: 'Installed SDK skill instructions from SKILL-API.md.',
-    mimeType: MARKDOWN,
-    file: '../SKILL-API.md',
-  },
-  {
-    uri: 'securenow://docs/skill-cli',
-    name: 'skill-cli',
-    title: 'SecureNow CLI Skill',
-    description: 'Installed CLI skill instructions from SKILL-CLI.md.',
-    mimeType: MARKDOWN,
-    file: '../SKILL-CLI.md',
-  },
-  {
-    uri: 'securenow://docs/npm-readme',
-    name: 'npm-readme',
-    title: 'SecureNow npm README',
-    description: 'Installed npm README.',
-    mimeType: MARKDOWN,
-    file: '../NPM_README.md',
-  },
-  {
-    uri: 'securenow://project/config',
-    name: 'project-config',
-    title: 'SecureNow Project Config',
-    description: 'Resolved local SecureNow config and masked credentials.',
-    mimeType: JSON_MIME,
-    dynamic: 'projectConfig',
-  },
-  {
-    uri: 'securenow://tools/catalog',
-    name: 'tools-catalog',
-    title: 'SecureNow MCP Tool Catalog',
-    description: 'MCP tool names, scopes, and write/read classification.',
-    mimeType: JSON_MIME,
-    dynamic: 'toolsCatalog',
-  },
-];
-
-const PROMPTS = [
-  {
-    name: 'secure_project_setup',
-    title: 'Secure Project Setup',
-    description: 'Generic framework setup prompt for SecureNow tracing, logs, body capture, multipart, and firewall defaults.',
-    arguments: [
-      { name: 'projectRoot', description: 'Project root to configure.', required: false },
-      { name: 'startCommand', description: 'Optional customer-approved command to start the app.', required: false },
-      { name: 'buildCommand', description: 'Optional customer-approved build command.', required: false },
-      { name: 'testCommand', description: 'Optional customer-approved test command.', required: false },
-      { name: 'localUrl', description: 'Optional local URL to smoke-test after the app is running.', required: false },
-      { name: 'productionUrl', description: 'Optional production URL to smoke-test with --env production.', required: false },
-    ],
-  },
-  {
-    name: 'verify_firewall_default_on',
-    title: 'Verify Default-On Firewall',
-    description: 'Verify SecureNow CLI login, app firewall toggle, credentials, and SDK defaults.',
-    arguments: [
-      { name: 'appKey', description: 'Optional SecureNow app key.', required: false },
-    ],
-  },
-  {
-    name: 'investigate_ip',
-    title: 'Investigate IP',
-    description: 'Investigate an IP with SecureNow IP intelligence, traces, logs, and remediation options.',
-    arguments: [
-      { name: 'ip', description: 'IP address to investigate.', required: true },
-      { name: 'appKeys', description: 'Optional comma-separated app keys.', required: false },
-      { name: 'environment', description: 'Environment to investigate. Defaults to production; use all only when explicitly needed.', required: false },
-    ],
-  },
-  {
-    name: 'investigate_human_action_row',
-    title: 'Investigate Human Action Row',
-    description: 'Use MCP tools to deeply review one Requires Human row and reach a safe audited outcome.',
-    arguments: [
-      { name: 'rowNumber', description: '1-based row number from the Requires Human queue.', required: true },
-      { name: 'page', description: 'Queue page number. Defaults to 1.', required: false },
-      { name: 'limit', description: 'Rows to fetch. Defaults to 20.', required: false },
-      { name: 'confirmWrites', description: 'Set true only when the user explicitly wants the MCP agent to execute decisions.', required: false },
-    ],
-  },
-  {
-    name: 'work_human_actions',
-    title: 'Work Human Actions',
-    description: 'Use MCP tools to work the approval queue from most urgent to least urgent, with trace verification and scoped decisions.',
-    arguments: [
-      { name: 'limit', description: 'Maximum rows to review this run. Defaults to 10.', required: false },
-      { name: 'search', description: 'Optional search filter for the queue.', required: false },
-      { name: 'confirmWrites', description: 'Set true only when the user explicitly wants the MCP agent to execute decisions.', required: false },
-    ],
-  },
-  {
-    name: 'cleanup_legacy_pending_blocks',
-    title: 'Clean Legacy Pending Blocks',
-    description: 'Use MCP tools to review and approve/reject legacy pending blocklist rows so only current human work remains.',
-    arguments: [
-      { name: 'limit', description: 'Maximum pending block rows to review this run. Defaults to 50.', required: false },
-      { name: 'environment', description: 'Environment scope. Defaults to production.', required: false },
-      { name: 'confirmWrites', description: 'Set true only when the user explicitly wants the MCP agent to execute approvals/rejections.', required: false },
-    ],
-  },
-  {
-    name: 'configure_default_automation',
-    title: 'Configure Default Automation',
-    description: 'Use MCP tools to set conservative default SecureNow automation rules based on the canonical riskScore and supporting evidence.',
-    arguments: [
-      { name: 'environment', description: 'Environment scope. Defaults to production.', required: false },
-      { name: 'confirmWrites', description: 'Set true only when the user explicitly wants the MCP agent to create/update automation rules.', required: false },
-    ],
-  },
-];
-
-function promptMessages(name, args = {}) {
-  if (name === 'secure_project_setup') {
-    return [
-      {
-        role: 'user',
-        content: {
-          type: 'text',
-          text: [
-            args.projectRoot ? `Project root: ${args.projectRoot}` : null,
-            args.startCommand ? `Customer-approved start command: ${args.startCommand}` : null,
-            args.buildCommand ? `Customer-approved build command: ${args.buildCommand}` : null,
-            args.testCommand ? `Customer-approved test command: ${args.testCommand}` : null,
-            args.localUrl ? `Local URL for smoke testing: ${args.localUrl}` : null,
-            args.productionUrl ? `Production URL for smoke testing: ${args.productionUrl}` : null,
-            UNIVERSAL_SECURENOW_SETUP_PROMPT,
-          ].filter(Boolean).join('\n\n'),
-        },
-      },
-    ];
-  }
-
-  if (name === 'verify_firewall_default_on') {
-    return [
-      {
-        role: 'user',
-        content: {
-          type: 'text',
-          text: [
-            'Verify SecureNow default-on protection for this project.',
-            args.appKey ? `App key: ${args.appKey}` : null,
-            'Check npx securenow whoami, npx securenow api-key show, npx securenow firewall apps, and npx securenow firewall status.',
-            'Confirm traces, logs, capture.body, capture.multipart, and firewall.enabled are enabled by .securenow/runtime.json defaults unless explicitly set false. Legacy .securenow/credentials.json is still accepted.',
-            'Do not print full tokens or API keys.',
-          ].filter(Boolean).join('\n'),
-        },
-      },
-    ];
-  }
-
-  if (name === 'investigate_ip') {
-    return [
-      {
-        role: 'user',
-        content: {
-          type: 'text',
-          text: [
-            `Investigate IP ${args.ip || '<ip>'} with SecureNow.`,
-            args.appKeys ? `Scope to app keys: ${args.appKeys}` : null,
-            `Environment scope: ${args.environment || 'production'}.`,
-            'Use IP intelligence first, then related traces/logs, then recommend remediation.',
-            'Only block or trust the IP after explicit user confirmation. Never use IP Allowlist for false positives or trusted traffic; allowlist is deny-by-default and blocks all non-listed IPs.',
-          ].filter(Boolean).join('\n'),
-        },
-      },
-    ];
-  }
-
-  if (name === 'investigate_human_action_row') {
-    const rowNumber = args.rowNumber || '<rowNumber>';
-    const page = args.page || 1;
-    const limit = args.limit || 20;
-    const confirmWrites = args.confirmWrites === true || args.confirmWrites === 'true';
-    return [
-      {
-        role: 'user',
-        content: {
-          type: 'text',
-          text: [
-            `Investigate Requires Human row ${rowNumber} using SecureNow MCP.`,
-            `Fetch page=${page}, limit=${limit} with securenow_human_actions_list, select row ${rowNumber}, then call securenow_notifications_get and securenow_human_action_report for that notificationId and IP.`,
-            'Read the AI report, finalDecision, investigation steps, findings, proofs, metadata paths/user agents/status codes, and trace IDs.',
-            'Open trace evidence with securenow_traces_show and correlated logs with securenow_logs_for_trace when trace IDs are available.',
-            'Return one clear outcome: Block IP, Rate Limit, False Positive, Rule Tuning Applied/Needed, New Alert Rule Needed, Case Action Approved/Rejected, or Ambiguous/Skipped with exact missing proof.',
-            'A row can be finished without an enforcement write when no write is safe. In that case record or prepare a structured no-write decision report explaining the missing proof, missing permission, or vague guard.',
-            'If evidence is mixed, split the decision by IP/cluster. Block only proven malicious IPs, false-positive only exact benign shapes, rate-limit only route-specific volume abuse, and leave ambiguous members with missing proof.',
-            'If the right fix is global/system rule tuning and the MCP tool returns access denied, do not create customer-specific false positives. Prepare the exact attack-preserving guard/SQL, dry-run it if possible, and record outcome=rule_tuning with missingProof naming the missing permission.',
-            'If an AI proposed action says to use a shared benign shape but does not provide exact path/method/status/user-agent/body/header conditions, do not execute it. Record the missing guard fields instead.',
-            'Use rate limiting only as temporary soft remediation for repeated route-specific abuse such as login brute force, credential stuffing, scraping/API bursts, enumeration, recon/probing, or repeated noisy payloads where risk/impact evidence is below the block threshold.',
-            'Do not rate-limit instead of blocking when there is confirmed exploit success, token/data exposure, SSRF reachability, file read, RCE, persistence, malware/C2, or riskScore >= 85 with high-confidence malicious evidence. Do not rate-limit benign false positives, trusted monitors, app-server/proxy attribution problems, isolated one-off requests, or broad noisy rules that need alert tuning.',
-            'Do not create or recommend IP Allowlist entries during investigations unless the user explicitly asks to lock the app/environment to a known set of IPs. For safe monitors, offices, VPNs, or false positives, use Trusted IPs or scoped false-positive exclusions instead.',
-            confirmWrites
-              ? 'The user requested execution. If evidence supports the decision, call securenow_human_action_block, securenow_rate_limit_create_from_text plus securenow_human_action_decision_report_add(outcome=rate_limited), or securenow_human_action_false_positive with confirm:true, a precise reason, and a decisionReport containing summary, evidence, reviewedHistory, traceIds, and missingProof when relevant. If no enforcement write is safe, call securenow_human_action_decision_report_add with outcome=rule_tuning, new_alert_rule, ambiguous, skipped, or other so the audit trail is complete without changing IP status.'
-              : 'Do not execute write tools yet. Prepare the recommended decision and exact tool call the user can approve.',
-            'If many IPs share the same benign path/status/user-agent pattern, recommend tightening the alert rule with a precise guard instead of reviewing each IP as malicious.',
-            'False positives must be narrow: app + alert rule + path + method/status/user-agent/body evidence where possible. Never globally trust an IP by default.',
-          ].join('\n'),
-        },
-      },
-    ];
-  }
-
-  if (name === 'work_human_actions') {
-    const limit = args.limit || 10;
-    const confirmWrites = args.confirmWrites === true || args.confirmWrites === 'true';
-    return [
-      {
-        role: 'user',
-        content: {
-          type: 'text',
-          text: [
-            'Work my SecureNow Requires Human queue like a senior security analyst using the MCP tools.',
-            `Review up to ${limit} row(s), most urgent first.${args.search ? ` Search filter: ${args.search}.` : ''}`,
-            'Start with securenow_human_actions_list. For each row, call securenow_notifications_get and securenow_human_action_report, inspect the AI report/investigation steps/proofs/trace IDs, and fetch trace/log evidence where useful.',
-            'For each row choose exactly one outcome: Block IP, Rate Limit, False Positive, Rule Tuning Applied/Needed, New Alert Rule Needed, Case Action Approved/Rejected, or Ambiguous/Skipped with exact missing proof.',
-            'Finished does not always mean enforcement changed. A row is also finished when a structured no-write decision report records the exact proof gap, missing permission, or vague guard and no weaker substitute write is used.',
-            'If a global/system rule update is the right fix but access is denied, do not mark customer-specific false positives just to clear the row. Prepare the exact attack-preserving guard/SQL, dry-run it when possible, and record outcome=rule_tuning with missingProof.',
-            'If evidence is mixed, do partial resolution: block proven malicious IPs, false-positive exact benign shapes, rate-limit route-specific volume abuse, and leave ambiguous IPs with their missing proof.',
-            'Reject vague AI proposed actions. If the prompt/action lacks concrete rule id, path, method, status, user-agent/body/header guard, benign samples, and attack examples that still match, record it as ambiguous or rule_tuning needed.',
-            'Use Rate Limit only for repeated route-specific abuse where temporary friction is safer than blocking: login brute force/credential stuffing, password reset/account enumeration, scraping/API bursts, path or ID enumeration, recon/probing, or repeated noisy payloads without confirmed exploit success.',
-            'Do not rate-limit confirmed high-risk attacks that should be blocked, benign traffic that should be false-positive scoped, broad noisy rules that need tuning, app-server/proxy attribution problems, or isolated one-off requests.',
-            'Do not create or recommend IP Allowlist entries while working this queue unless the user explicitly approves deny-by-default allowlist mode for the whole app/environment. Use Trusted IPs for trusted/bypass cases.',
-            confirmWrites
-              ? 'The user requested execution. For supported decisions, call the correct write tool with confirm:true, a precise reason, and a decisionReport containing summary, evidence, reviewedHistory, traceIds, and missingProof when relevant, then continue. For skipped/ambiguous/rule-tuning-needed/new-rule-needed rows that should be auditable without changing enforcement status, use securenow_human_action_decision_report_add or securenow_human_case_decision_report_add.'
-              : 'Do not execute write tools yet. Produce a row-by-row action plan and exact MCP write calls for user approval.',
-            'For block decisions, use securenow_human_action_block. For rate-limit decisions, use securenow_rate_limit_create_from_text and then securenow_human_action_decision_report_add with outcome=rate_limited. For false positives, use securenow_human_action_false_positive with restrictive conditions. For case-level tune_rule/create_exclusion rows, inspect securenow_notifications_get and then use securenow_human_case_action_update only when the action is safe to approve/reject.',
-            'End with counts: handled, blocked/proposed block, rate limits created/proposed, false positives, rule tuning/admin permission blockers with exact guard, partial resolutions, skipped with missing proof, and still waiting.',
-          ].join('\n'),
-        },
-      },
-    ];
-  }
-
-  if (name === 'cleanup_legacy_pending_blocks') {
-    const limit = args.limit || 50;
-    const environment = args.environment || 'production';
-    const confirmWrites = args.confirmWrites === true || args.confirmWrites === 'true';
-    return [
-      {
-        role: 'user',
-        content: {
-          type: 'text',
-          text: [
-            'Clean my SecureNow legacy pending blocklist queue using MCP tools.',
-            `Review up to ${limit} pending block row(s). Environment scope: ${environment}.`,
-            'Start with securenow_blocklist_stats, then securenow_blocklist_pending_list({ page: 1, limit, environment }).',
-            'For each pending block, inspect id, IP, source, reason, metadata.riskScore, metadata.aiRiskScore, metadata.abuseConfidenceScore, automation rule, linked notification, age, app, and environment.',
-            'When investigationNotificationId exists, fetch securenow_notifications_get for that case and use the linked IP report/history as evidence.',
-            'Approve only when the row has clear malicious evidence, riskScore >= 90, or SecureNow AI IPDB evidence score >= 80 with no false-positive/test signal.',
-            'Reject stale, ambiguous, synthetic/test, self-traffic, or false-positive rows. Prefer narrow rule/exclusion tuning when the same benign pattern repeats.',
-            confirmWrites
-              ? 'The user requested execution. Use securenow_blocklist_pending_approve or securenow_blocklist_pending_reject with confirm:true and a precise reason. Use bulk tools only after every selected row satisfies the same reviewed policy.'
-              : 'Do not execute writes yet. Produce exact approve/reject MCP calls grouped by safe policy for user approval.',
-            'After each write or batch, re-fetch securenow_blocklist_stats and securenow_blocklist_pending_list until the legacy pending count is zero or only ambiguous rows remain.',
-            'End with counts: approved, rejected, skipped ambiguous, legacyPendingBlockCount, and remaining proof gaps.',
-          ].join('\n'),
-        },
-      },
-    ];
-  }
-
-  if (name === 'configure_default_automation') {
-    const environment = args.environment || 'production';
-    const confirmWrites = args.confirmWrites === true || args.confirmWrites === 'true';
-    return [
-      {
-        role: 'user',
-        content: {
-          type: 'text',
-          text: [
-            'Configure SecureNow default automation using the MCP tools.',
-            `Review environment context: ${environment}. Built-in defaults apply to all apps and all environments unless the customer narrows them later.`,
-            'Use one canonical product score for automation decisions: riskScore. SecureNow AI IPDB score and AI confidence remain supporting evidence.',
-            'Built-in defaults are active by default:',
-            '- Critical Risk Auto-Block: riskScore>=95, TTL 168h.',
-            '- High Risk Auto-Block: riskScore>=90 AND riskScore<95, TTL 72h.',
-            '- Elevated Risk Auto-Block: riskScore>=85 AND riskScore<90, TTL 24h.',
-            'Start with securenow_automation_defaults_ensure({ confirm:true, reason:"Provision SecureNow default risk-score automation" }) when writes are confirmed, otherwise start with securenow_automation_rules_list and report what would be ensured.',
-            'After ensuring defaults, dry-run each default rule with securenow_automation_rule_dry_run to inspect sample matches. Disable or tune only if evidence shows customer-specific false positives.',
-            confirmWrites
-              ? 'The user requested execution. Ensure defaults with confirm:true, do not force-enable previously disabled defaults unless the user explicitly asked, and re-list rules after writes.'
-              : 'Do not execute writes yet. Return exact MCP update/create calls and dry-run calls for approval.',
-            'End with active rules, disabled rules that should stay disabled, and any risk from automation scope.',
-          ].join('\n'),
-        },
-      },
-    ];
-  }
-
-  throw new Error(`Unknown prompt: ${name}`);
-}
-
-function getTool(name) {
-  return TOOLS.find((tool) => tool.name === name) || null;
-}
-
-function mcpToolDefinition(tool) {
-  return {
-    name: tool.name,
-    title: tool.title,
-    description: tool.description,
-    inputSchema: tool.inputSchema || objectSchema({}),
-    annotations: {
-      readOnlyHint: !!tool.readOnly,
-      destructiveHint: !!tool.destructive,
-      idempotentHint: !!tool.readOnly,
-  },
-};
-}
-
-function listTools() {
-  return TOOLS.map(mcpToolDefinition);
-}
-
-function listResources() {
-  return RESOURCES.map(({ file, dynamic, ...resource }) => resource);
-}
-
-function listPrompts() {
-  return PROMPTS;
-}
-
-function assertConfirmed(tool, args = {}) {
-  if (!tool.confirm) return;
-  if (args.confirm !== true) {
-    throw new Error(`${tool.name} is a write action. Pass confirm:true and a reason to proceed.`);
-  }
-  if (!args.reason || !String(args.reason).trim()) {
-    throw new Error(`${tool.name} requires a non-empty reason.`);
-  }
-  if (tool.name === 'securenow_allowlist_add' && args.allowlistDenyAllApproved !== true) {
-    throw new Error('securenow_allowlist_add is deny-by-default: it blocks every non-listed IP for the scoped app/environment. Pass allowlistDenyAllApproved:true only after explicit human approval. Use securenow_trusted_add for trusted IPs or false positives.');
-  }
-}
-
-function buildApiRequest(tool, rawArgs = {}) {
-  const args = { ...rawArgs };
-  let endpoint = tool.endpoint;
-
-  for (const key of tool.pathParams || []) {
-    if (args[key] == null || args[key] === '') throw new Error(`Missing required argument: ${key}`);
-    endpoint = endpoint.replace(`:${key}`, encodeURIComponent(String(args[key])));
-  }
-
-  const query = { ...(tool.fixedQuery || {}) };
-  for (const key of tool.queryFields || []) {
-    let value = args[key];
-    if (tool.normalize && typeof tool.normalize[key] === 'function') {
-      value = tool.normalize[key](value);
-    }
-    if (value != null && value !== '') query[key] = value;
-  }
-
-  const body = { ...(tool.fixedBody || {}) };
-  for (const key of tool.bodyFields || []) {
-    let value = args[key];
-    if (tool.normalize && typeof tool.normalize[key] === 'function') {
-      value = tool.normalize[key](value);
-    }
-    if (value != null && value !== '') body[key] = value;
-  }
-
-  if (tool.reasonAsNote && !body.note && args.reason) {
-    body.note = args.reason;
-  }
-  if (tool.reasonInResult && args.reason) {
-    body.result = {
-      ...(body.result && typeof body.result === 'object' ? body.result : {}),
-      reason: args.reason,
-    };
-  }
-
-  return {
-    method: tool.method,
-    endpoint,
-    query,
-    body: Object.keys(body).length > 0 ? body : null,
-  };
-}
-
-function readStaticResource(resource) {
-  const filepath = path.resolve(__dirname, resource.file);
-  return fs.readFileSync(filepath, 'utf8');
-}
-
-function resourceContent(resource, dynamicHandlers = {}) {
-  if (resource.file) return readStaticResource(resource);
-  if (resource.dynamic && dynamicHandlers[resource.dynamic]) {
-    return dynamicHandlers[resource.dynamic]();
-  }
-  throw new Error(`Resource is not readable: ${resource.uri}`);
-}
-
-module.exports = {
-  TOOLS,
-  RESOURCES,
-  PROMPTS,
-  TEXT,
-  JSON_MIME,
-  MARKDOWN,
-  getTool,
-  mcpToolDefinition,
-  listTools,
-  listResources,
-  listPrompts,
-  promptMessages,
-  assertConfirmed,
-  buildApiRequest,
-  resourceContent,
-  jsonText,
-  maskSecret,
-  sanitizeArgs,
-};
+
+function string(description) {
+  return { type: 'string', description };
+}
+
+function number(description, extra = {}) {
+  return { type: 'number', description, ...extra };
+}
+
+function boolean(description) {
+  return { type: 'boolean', description };
+}
+
+function arrayOfStrings(description) {
+  return { type: 'array', items: { type: 'string' }, description };
+}
+
+function objectSchema(properties, required = []) {
+  return {
+    type: 'object',
+    additionalProperties: false,
+    properties,
+    required,
+  };
+}
+
+function jsonText(value) {
+  return JSON.stringify(value, null, 2);
+}
+
+function maskSecret(value) {
+  if (!value) return null;
+  const text = String(value);
+  if (text.length <= 12) return '***';
+  return `${text.slice(0, 8)}...${text.slice(-4)}`;
+}
+
+function normalizeAppKeys(value) {
+  if (Array.isArray(value)) return value.filter(Boolean).join(',');
+  return value;
+}
+
+function sanitizeArgs(args = {}) {
+  const clone = { ...args };
+  for (const key of Object.keys(clone)) {
+    if (/token|apiKey|api_key|authorization|password|secret/i.test(key)) {
+      clone[key] = maskSecret(clone[key]);
+    }
+  }
+  return clone;
+}
+
+const confirmSchema = {
+  confirm: boolean('Required for write actions. Must be true.'),
+  reason: string('Short human-readable reason for the write action.'),
+};
+
+const appKeysInput = {
+  appKeys: {
+    oneOf: [
+      { type: 'string' },
+      { type: 'array', items: { type: 'string' } },
+    ],
+    description: 'Application key or comma-separated/list of application keys.',
+  },
+};
+
+const pagingInput = {
+  limit: number('Maximum results to return.', { minimum: 1, maximum: 500 }),
+  page: number('Page number.', { minimum: 1 }),
+};
+
+const timeRangeInput = {
+  from: string('Start time as ISO 8601, optional.'),
+  to: string('End time as ISO 8601, optional.'),
+};
+
+const environmentInput = {
+  environment: string('Deployment environment scope: production, staging, preview, local, test, or all. Default for investigations is production.'),
+};
+
+const decisionReportInput = {
+  decisionReport: {
+    type: 'object',
+    additionalProperties: true,
+    description: 'Structured audit report explaining the decision, evidence reviewed, trace IDs, missing proof, and recommendations.',
+  },
+  decisionSummary: string('Short decision summary to record on the IP/case history.'),
+  outcome: string('Decision outcome: blocked, rate_limited, false_positive, clean, deferred, case_action, rule_tuning, new_alert_rule, ambiguous, skipped, or other.'),
+  evidence: arrayOfStrings('Evidence strings that support the decision.'),
+  reviewedHistory: arrayOfStrings('History/proofs reviewed before deciding.'),
+  traceIds: arrayOfStrings('Trace IDs reviewed for this decision.'),
+  paths: arrayOfStrings('Paths/endpoints reviewed for this decision.'),
+  ips: arrayOfStrings('IP addresses affected by this case-level decision report.'),
+  methods: arrayOfStrings('HTTP methods reviewed for this decision.'),
+  statusCodes: arrayOfStrings('HTTP status codes reviewed for this decision.'),
+  userAgents: arrayOfStrings('User agents reviewed for this decision.'),
+  missingProof: arrayOfStrings('Proof that was missing when the row is skipped or ambiguous.'),
+  recommendations: arrayOfStrings('Follow-up recommendations to record with the decision.'),
+};
+
+const TOOLS = [
+  {
+    name: 'securenow_auth_status',
+    title: 'SecureNow Auth Status',
+    description: 'Show local SecureNow credential source, selected app, and masked runtime API key.',
+    scope: null,
+    localOnly: true,
+    readOnly: true,
+    inputSchema: objectSchema({}),
+  },
+  {
+    name: 'securenow_apps_list',
+    title: 'List Applications',
+    description: 'List SecureNow applications for the authenticated user.',
+    scope: 'applications:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/applications',
+    inputSchema: objectSchema({}),
+  },
+  {
+    name: 'securenow_apps_create',
+    title: 'Create Application',
+    description: 'Create a SecureNow application. Write action; requires confirmation.',
+    scope: 'applications:write',
+    readOnly: false,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/applications',
+    bodyFields: ['name', 'hosts', 'instanceId'],
+    inputSchema: objectSchema({
+      name: string('Application name.'),
+      hosts: arrayOfStrings('Optional hostnames/domains for this application.'),
+      instanceId: string('Optional ClickHouse instance id.'),
+      ...confirmSchema,
+    }, ['name', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_apps_info',
+    title: 'Get Application By Key',
+    description: 'Get details for an application by app key.',
+    scope: 'applications:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/applications/key/:key',
+    pathParams: ['key'],
+    inputSchema: objectSchema({
+      key: string('Application key UUID.'),
+    }, ['key']),
+  },
+  {
+    name: 'securenow_firewall_apps',
+    title: 'List Firewall Apps',
+    description: 'List applications with firewall toggle and SecureNow AI IPDB threshold state.',
+    scope: 'applications:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/firewall/apps',
+    inputSchema: objectSchema({}),
+  },
+  {
+    name: 'securenow_firewall_status',
+    title: 'Firewall Status',
+    description: 'Show firewall blocklist/allowlist status for the authenticated account.',
+    scope: 'firewall:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/firewall/status',
+    queryFields: ['environment', 'appKey'],
+    inputSchema: objectSchema({
+      appKey: string('Optional application key UUID to scope the status check.'),
+      ...environmentInput,
+    }),
+  },
+  {
+    name: 'securenow_firewall_enable',
+    title: 'Enable App Firewall',
+    description: 'Turn the per-app firewall ON. Write action; requires confirmation.',
+    scope: 'applications:write',
+    readOnly: false,
+    confirm: true,
+    method: 'PATCH',
+    endpoint: '/firewall/app/:appKey',
+    pathParams: ['appKey'],
+    bodyFields: ['environment'],
+    fixedBody: { enabled: true },
+    inputSchema: objectSchema({
+      appKey: string('Application key UUID.'),
+      ...environmentInput,
+      ...confirmSchema,
+    }, ['appKey', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_firewall_disable',
+    title: 'Disable App Firewall',
+    description: 'Turn the per-app firewall OFF. Write action; requires confirmation.',
+    scope: 'applications:write',
+    readOnly: false,
+    destructive: true,
+    confirm: true,
+    method: 'PATCH',
+    endpoint: '/firewall/app/:appKey',
+    pathParams: ['appKey'],
+    bodyFields: ['environment'],
+    fixedBody: { enabled: false },
+    inputSchema: objectSchema({
+      appKey: string('Application key UUID.'),
+      ...environmentInput,
+      ...confirmSchema,
+    }, ['appKey', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_firewall_set_threshold',
+    title: 'Set SecureNow AI IPDB Threshold',
+    description: 'Set the per-app SecureNow AI IPDB confidence threshold. Write action; requires confirmation.',
+    scope: 'applications:write',
+    readOnly: false,
+    confirm: true,
+    method: 'PATCH',
+    endpoint: '/firewall/app/:appKey',
+    pathParams: ['appKey'],
+    bodyFields: ['confidenceMinimum', 'environment'],
+    inputSchema: objectSchema({
+      appKey: string('Application key UUID.'),
+      confidenceMinimum: number('Minimum SecureNow AI IPDB confidence score.', { minimum: 0, maximum: 100 }),
+      ...environmentInput,
+      ...confirmSchema,
+    }, ['appKey', 'confidenceMinimum', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_firewall_test_ip',
+    title: 'Test Firewall IP Decision',
+    description: 'Check whether an IP would be blocked by the firewall.',
+    scope: 'firewall:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/firewall/check/:ip',
+    pathParams: ['ip'],
+    queryFields: ['environment', 'appKey'],
+    inputSchema: objectSchema({
+      ip: string('IPv4 address to test.'),
+      appKey: string('Optional application key UUID to test the app/environment toggle and scoped lists.'),
+      ...environmentInput,
+    }, ['ip']),
+  },
+  {
+    name: 'securenow_traces_list',
+    title: 'List Traces',
+    description: 'List recent traces for one or more applications.',
+    scope: 'traces:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/traces',
+    queryFields: ['appKeys', 'environment', 'from', 'to', 'limit'],
+    normalize: { appKeys: normalizeAppKeys },
+    inputSchema: objectSchema({
+      ...appKeysInput,
+      ...environmentInput,
+      ...timeRangeInput,
+      limit: number('Maximum traces to return.', { minimum: 1, maximum: 200 }),
+    }, ['appKeys']),
+  },
+  {
+    name: 'securenow_traces_show',
+    title: 'Show Trace',
+    description: 'Show spans for a trace id scoped to one or more app keys.',
+    scope: 'traces:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/traces/:traceId',
+    pathParams: ['traceId'],
+    queryFields: ['appKeys', 'environment'],
+    normalize: { appKeys: normalizeAppKeys },
+    inputSchema: objectSchema({
+      traceId: string('Trace id.'),
+      ...appKeysInput,
+      ...environmentInput,
+    }, ['traceId', 'appKeys']),
+  },
+  {
+    name: 'securenow_logs_list',
+    title: 'List Logs',
+    description: 'List recent logs for one or more applications.',
+    scope: 'logs:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/logs',
+    queryFields: ['appKeys', 'environment', 'from', 'to', 'severity', 'limit'],
+    normalize: { appKeys: normalizeAppKeys },
+    inputSchema: objectSchema({
+      ...appKeysInput,
+      ...environmentInput,
+      ...timeRangeInput,
+      severity: string('Optional severity filter.'),
+      limit: number('Maximum logs to return.', { minimum: 1, maximum: 500 }),
+    }, ['appKeys']),
+  },
+  {
+    name: 'securenow_logs_for_trace',
+    title: 'Logs For Trace',
+    description: 'Show logs correlated to a trace id.',
+    scope: 'logs:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/logs/trace/:traceId',
+    pathParams: ['traceId'],
+    queryFields: ['appKeys', 'environment'],
+    normalize: { appKeys: normalizeAppKeys },
+    inputSchema: objectSchema({
+      traceId: string('Trace id.'),
+      ...appKeysInput,
+      ...environmentInput,
+    }, ['traceId', 'appKeys']),
+  },
+  {
+    name: 'securenow_notifications_list',
+    title: 'List Notifications',
+    description: 'List security notifications.',
+    scope: 'notifications:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/notifications',
+    queryFields: ['limit', 'page'],
+    inputSchema: objectSchema({ ...pagingInput }),
+  },
+  {
+    name: 'securenow_notifications_unread',
+    title: 'Unread Notification Count',
+    description: 'Return unread notification count.',
+    scope: 'notifications:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/notifications/unread-count',
+    inputSchema: objectSchema({}),
+  },
+  {
+    name: 'securenow_notifications_read',
+    title: 'Mark Notification Read',
+    description: 'Mark a notification as read. Write action; requires confirmation.',
+    scope: 'notifications:write',
+    readOnly: false,
+    confirm: true,
+    method: 'PUT',
+    endpoint: '/notifications/:id/read',
+    pathParams: ['id'],
+    inputSchema: objectSchema({
+      id: string('Notification id.'),
+      ...confirmSchema,
+    }, ['id', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_notifications_get',
+    title: 'Get Notification',
+    description: 'Get one notification/case with alert context, clusters, and IP investigations.',
+    scope: 'notifications:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/notifications/:id',
+    pathParams: ['id'],
+    inputSchema: objectSchema({
+      id: string('Notification id.'),
+    }, ['id']),
+  },
+  {
+    name: 'securenow_notifications_batch_get',
+    title: 'Get Notifications Batch',
+    description: 'Fetch multiple notification/case records in one request.',
+    scope: 'notifications:read',
+    readOnly: true,
+    method: 'POST',
+    endpoint: '/notifications/batch',
+    bodyFields: ['ids'],
+    inputSchema: objectSchema({
+      ids: arrayOfStrings('Notification ids to fetch, up to 50.'),
+    }, ['ids']),
+  },
+  {
+    name: 'securenow_human_actions_list',
+    title: 'List Human Action Queue',
+    description: 'List approval-gated human decisions prepared by SecureNow AI, ordered by urgency.',
+    scope: 'notifications:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/notifications/approval-tasks',
+    queryFields: ['limit', 'page', 'search'],
+    inputSchema: objectSchema({
+      ...pagingInput,
+      search: string('Optional search over IP, rule, path, or verdict.'),
+    }),
+  },
+  {
+    name: 'securenow_human_actions_grouped_list',
+    title: 'List Grouped Human Actions',
+    description: 'List Requires Human work as root-cause groups with batch-safety preview instead of one row per IP/action.',
+    scope: 'notifications:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/notifications/approval-task-groups',
+    queryFields: ['limit', 'page', 'search'],
+    inputSchema: objectSchema({
+      ...pagingInput,
+      search: string('Optional search over IP, rule, path, action, or verdict.'),
+    }),
+  },
+  {
+    name: 'securenow_alert_review_runs_list',
+    title: 'List Alert Review Root Causes',
+    description: 'List pending alert-review runs as root-cause groups with batch-action preview, rather than row-by-row noisy alert triage.',
+    scope: 'notifications:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/notifications/alert-review-runs',
+    queryFields: ['limit', 'page', 'search', 'rootCauseKey', 'groupKey', 'includeRuns', 'maxScan'],
+    inputSchema: objectSchema({
+      ...pagingInput,
+      search: string('Optional search over rule, route, IP, evidence, or proposed guard.'),
+      rootCauseKey: string('Optional root-cause group key to filter to one group.'),
+      groupKey: string('Compatibility alias for rootCauseKey.'),
+      includeRuns: boolean('Whether to include compact matching run rows in the response.'),
+      maxScan: number('Maximum pending-review rows to scan before grouping. Defaults to 500, capped at 1000.', { minimum: 1, maximum: 1000 }),
+    }),
+  },
+  {
+    name: 'securenow_alert_review_runs_count',
+    title: 'Count Alert Review Runs',
+    description: 'Count pending alert-review rows and the root-cause groups they collapse into.',
+    scope: 'notifications:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/notifications/alert-review-runs/count',
+    queryFields: ['search', 'maxScan'],
+    inputSchema: objectSchema({
+      search: string('Optional search over rule, route, IP, evidence, or proposed guard.'),
+      maxScan: number('Maximum pending-review rows to scan before grouping. Defaults to 500, capped at 1000.', { minimum: 1, maximum: 1000 }),
+    }),
+  },
+  {
+    name: 'securenow_alert_review_run_get',
+    title: 'Get Alert Review Run',
+    description: 'Fetch one pending-review alert run with its root-cause key, evidence-quality score, and similar open siblings.',
+    scope: 'notifications:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/notifications/alert-review-runs/:id',
+    pathParams: ['id'],
+    queryFields: ['maxScan'],
+    inputSchema: objectSchema({
+      id: string('Notification id for the alert review run.'),
+      maxScan: number('Maximum pending-review rows to scan for similar siblings. Defaults to 500, capped at 1000.', { minimum: 1, maximum: 1000 }),
+    }, ['id']),
+  },
+  {
+    name: 'securenow_alert_review_run_resolve',
+    title: 'Resolve Alert Review Run',
+    description: 'Close one pending alert-review row with an auditable no-write decision report.',
+    scope: 'notifications:write',
+    readOnly: false,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/notifications/alert-review-runs/:id/resolve',
+    pathParams: ['id'],
+    fixedBody: { reportSource: 'mcp' },
+    bodyFields: ['confirm', 'reason', 'decisionReport', 'decisionSummary', 'outcome', 'evidence', 'reviewedHistory', 'traceIds', 'paths', 'methods', 'statusCodes', 'userAgents', 'missingProof', 'recommendations'],
+    inputSchema: objectSchema({
+      id: string('Notification id for the alert review run.'),
+      ...decisionReportInput,
+      ...confirmSchema,
+    }, ['id', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_alert_review_run_dismiss',
+    title: 'Dismiss Alert Review Run',
+    description: 'Dismiss one pending alert-review row with an audit report and no enforcement write.',
+    scope: 'notifications:write',
+    readOnly: false,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/notifications/alert-review-runs/:id/dismiss',
+    pathParams: ['id'],
+    fixedBody: { reportSource: 'mcp' },
+    bodyFields: ['confirm', 'reason', 'decisionReport', 'decisionSummary', 'outcome', 'evidence', 'reviewedHistory', 'traceIds', 'paths', 'methods', 'statusCodes', 'userAgents', 'missingProof', 'recommendations'],
+    inputSchema: objectSchema({
+      id: string('Notification id for the alert review run.'),
+      ...decisionReportInput,
+      ...confirmSchema,
+    }, ['id', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_alert_review_run_keep_alive',
+    title: 'Keep Alert Rule Active',
+    description: 'Mark the noisy/paused alert rule as reviewed, keep it active, and close the pending alert-review row with an audit report.',
+    scope: 'notifications:write',
+    readOnly: false,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/notifications/alert-review-runs/:id/keep-alive',
+    pathParams: ['id'],
+    fixedBody: { reportSource: 'mcp' },
+    bodyFields: ['confirm', 'reason', 'reviewNote', 'decisionReport', 'decisionSummary', 'evidence', 'reviewedHistory', 'traceIds', 'paths', 'methods', 'statusCodes', 'userAgents', 'missingProof', 'recommendations'],
+    inputSchema: objectSchema({
+      id: string('Notification id for the alert review run.'),
+      reviewNote: string('Optional rule-review note. Defaults to reason.'),
+      ...decisionReportInput,
+      ...confirmSchema,
+    }, ['id', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_alert_review_run_apply_group_decision',
+    title: 'Apply Alert Review Group Decision',
+    description: 'Apply one verified no-write decision report to every currently matching alert-review row in a root-cause group, leaving non-matching rows open.',
+    scope: 'notifications:write',
+    readOnly: false,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/notifications/alert-review-runs/apply-group-decision',
+    fixedBody: { reportSource: 'mcp' },
+    bodyFields: ['confirm', 'reason', 'rootCauseKey', 'groupKey', 'prototypeRunId', 'notificationIds', 'status', 'outcome', 'allowMixed', 'previewOnly', 'maxRows', 'maxScan', 'search', 'decisionReport', 'decisionSummary', 'evidence', 'reviewedHistory', 'traceIds', 'paths', 'methods', 'statusCodes', 'userAgents', 'missingProof', 'recommendations'],
+    inputSchema: objectSchema({
+      rootCauseKey: string('Root-cause group key from securenow_alert_review_runs_list.'),
+      groupKey: string('Compatibility alias for rootCauseKey.'),
+      prototypeRunId: string('Optional notification id whose root-cause key should be used.'),
+      notificationIds: arrayOfStrings('Optional subset of eligible notification ids to close. Leave empty to apply to every eligible row in the group.'),
+      status: string('Resolution status: resolved or dismissed. Defaults to resolved.'),
+      allowMixed: boolean('Allow a mixed decision/attribution group only after every row was manually reviewed. Defaults to false.'),
+      previewOnly: boolean('When true, returns the eligible rows without writing.'),
+      maxRows: number('Maximum rows to close in this batch. Defaults to 100, capped at 250.', { minimum: 1, maximum: 250 }),
+      maxScan: number('Maximum pending-review rows to scan before grouping. Defaults to 500, capped at 1000.', { minimum: 1, maximum: 1000 }),
+      search: string('Optional search filter applied before grouping.'),
+      ...decisionReportInput,
+      ...confirmSchema,
+    }, ['confirm', 'reason']),
+  },
+  {
+    name: 'securenow_alert_review_apply_group_decision',
+    title: 'Apply Alert Review Group Decision',
+    description: 'Compatibility alias for securenow_alert_review_run_apply_group_decision.',
+    scope: 'notifications:write',
+    readOnly: false,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/notifications/alert-review-runs/apply-group-decision',
+    fixedBody: { reportSource: 'mcp' },
+    bodyFields: ['confirm', 'reason', 'rootCauseKey', 'groupKey', 'prototypeRunId', 'notificationIds', 'status', 'outcome', 'allowMixed', 'previewOnly', 'maxRows', 'maxScan', 'search', 'decisionReport', 'decisionSummary', 'evidence', 'reviewedHistory', 'traceIds', 'paths', 'methods', 'statusCodes', 'userAgents', 'missingProof', 'recommendations'],
+    inputSchema: objectSchema({
+      rootCauseKey: string('Root-cause group key from securenow_alert_review_runs_list.'),
+      groupKey: string('Compatibility alias for rootCauseKey.'),
+      prototypeRunId: string('Optional notification id whose root-cause key should be used.'),
+      notificationIds: arrayOfStrings('Optional subset of eligible notification ids to close. Leave empty to apply to every eligible row in the group.'),
+      status: string('Resolution status: resolved or dismissed. Defaults to resolved.'),
+      allowMixed: boolean('Allow a mixed decision/attribution group only after every row was manually reviewed. Defaults to false.'),
+      previewOnly: boolean('When true, returns the eligible rows without writing.'),
+      maxRows: number('Maximum rows to close in this batch. Defaults to 100, capped at 250.', { minimum: 1, maximum: 250 }),
+      maxScan: number('Maximum pending-review rows to scan before grouping. Defaults to 500, capped at 1000.', { minimum: 1, maximum: 1000 }),
+      search: string('Optional search filter applied before grouping.'),
+      ...decisionReportInput,
+      ...confirmSchema,
+    }, ['confirm', 'reason']),
+  },
+  {
+    name: 'securenow_alert_review_group_similar',
+    title: 'List Similar Alert Review Runs',
+    description: 'Fetch the current rows in one alert-review root-cause group for preview before a batch decision.',
+    scope: 'notifications:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/notifications/alert-review-runs',
+    queryFields: ['rootCauseKey', 'groupKey', 'includeRuns', 'maxScan'],
+    fixedQuery: { includeRuns: true },
+    inputSchema: objectSchema({
+      rootCauseKey: string('Root-cause group key from securenow_alert_review_runs_list.'),
+      groupKey: string('Compatibility alias for rootCauseKey.'),
+      maxScan: number('Maximum pending-review rows to scan before grouping. Defaults to 500, capped at 1000.', { minimum: 1, maximum: 1000 }),
+    }),
+  },
+  {
+    name: 'securenow_human_action_report',
+    title: 'Get Human Action Report',
+    description: 'Fetch the full IP investigation report, investigation steps, proofs, metadata, and AI decision for one human action row.',
+    scope: 'notifications:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/notifications/:notificationId/ips/:ip',
+    pathParams: ['notificationId', 'ip'],
+    inputSchema: objectSchema({
+      notificationId: string('Notification id from the human action row.'),
+      ip: string('IP address from the human action row.'),
+    }, ['notificationId', 'ip']),
+  },
+  {
+    name: 'securenow_human_action_block',
+    title: 'Approve AI Block Recommendation',
+    description: 'Approve the AI-prepared block decision for an IP and optionally attach a structured decision report to the IP history. Write action; requires confirmation.',
+    scope: 'notifications:write',
+    readOnly: false,
+    destructive: true,
+    confirm: true,
+    method: 'PUT',
+    endpoint: '/notifications/:notificationId/ips/:ip/status',
+    pathParams: ['notificationId', 'ip'],
+    fixedBody: { status: 'blocked', decisionSource: 'ai_dag', reportSource: 'mcp' },
+    reasonAsNote: true,
+    bodyFields: ['note', 'verdict', 'riskScore', 'decisionReport', 'decisionSummary', 'outcome', 'evidence', 'reviewedHistory', 'traceIds', 'paths', 'methods', 'statusCodes', 'userAgents', 'missingProof', 'recommendations'],
+    inputSchema: objectSchema({
+      notificationId: string('Notification id from the human action row.'),
+      ip: string('IP address to block.'),
+      note: string('Audit note explaining why the AI block was approved.'),
+      verdict: string('Optional final verdict text.'),
+      riskScore: number('Optional risk score.', { minimum: 0, maximum: 100 }),
+      ...decisionReportInput,
+      ...confirmSchema,
+    }, ['notificationId', 'ip', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_human_action_decision_report_add',
+    title: 'Record Human Action Decision Report',
+    description: 'Attach a structured analyst/MCP decision report to one Requires Human IP row without changing its status. Use for rate-limited, skipped, ambiguous, rule-tuning-needed, or already-handled rows. Write action; requires confirmation.',
+    scope: 'notifications:write',
+    readOnly: false,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/notifications/:notificationId/ips/:ip/decision-report',
+    pathParams: ['notificationId', 'ip'],
+    fixedBody: { reportSource: 'mcp' },
+    bodyFields: ['reason', 'decisionReport', 'decisionSummary', 'outcome', 'evidence', 'reviewedHistory', 'traceIds', 'paths', 'methods', 'statusCodes', 'userAgents', 'missingProof', 'recommendations'],
+    inputSchema: objectSchema({
+      notificationId: string('Notification id from the human action row.'),
+      ip: string('IP address for the report.'),
+      ...decisionReportInput,
+      ...confirmSchema,
+    }, ['notificationId', 'ip', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_human_action_close_no_write',
+    title: 'Close Human Action Without Enforcement',
+    description: 'Close one Requires Human IP row with an auditable no-write decision report. Use for ambiguous, skipped, rule-tuning-needed, new-rule-needed, rate-limited, or already-handled rows.',
+    scope: 'notifications:write',
+    readOnly: false,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/notifications/:notificationId/ips/:ip/close-no-write',
+    pathParams: ['notificationId', 'ip'],
+    fixedBody: { reportSource: 'mcp' },
+    bodyFields: ['reason', 'decisionReport', 'decisionSummary', 'outcome', 'evidence', 'reviewedHistory', 'traceIds', 'paths', 'methods', 'statusCodes', 'userAgents', 'missingProof', 'recommendations'],
+    inputSchema: objectSchema({
+      notificationId: string('Notification id from the human action row.'),
+      ip: string('IP address for the row to close.'),
+      ...decisionReportInput,
+      ...confirmSchema,
+    }, ['notificationId', 'ip', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_human_action_false_positive',
+    title: 'Mark Human Action False Positive',
+    description: 'Mark an AI-prepared human action as a scoped false positive and optionally attach a structured decision report to the IP history. Write action; requires confirmation.',
+    scope: 'notifications:write',
+    readOnly: false,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/notifications/:notificationId/ips/:ip/false-positive',
+    pathParams: ['notificationId', 'ip'],
+    fixedBody: { reportSource: 'mcp' },
+    bodyFields: ['reason', 'conditions', 'matchMode', 'createExclusion', 'applyToExisting', 'ruleScope', 'targetRuleIds', 'aiConfidence', 'decisionReport', 'decisionSummary', 'outcome', 'evidence', 'reviewedHistory', 'traceIds', 'paths', 'methods', 'statusCodes', 'userAgents', 'missingProof', 'recommendations'],
+    inputSchema: objectSchema({
+      notificationId: string('Notification id from the human action row.'),
+      ip: string('IP address to mark as false positive.'),
+      conditions: { type: 'array', items: { type: 'object', additionalProperties: true }, description: 'Restrictive false-positive conditions. Prefer app/rule/path/method/status/user-agent/body scope.' },
+      matchMode: string('Condition match mode: all or any.'),
+      createExclusion: boolean('Whether to create a restrictive exclusion rule.'),
+      applyToExisting: boolean('Whether to apply to existing matching IP investigations.'),
+      ruleScope: string('Scope: this_rule, specific_rules, all_existing, or any_rule.'),
+      targetRuleIds: arrayOfStrings('Specific rule ids when ruleScope is specific_rules.'),
+      aiConfidence: number('AI confidence for audit metadata.', { minimum: 0, maximum: 100 }),
+      ...decisionReportInput,
+      ...confirmSchema,
+    }, ['notificationId', 'ip', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_human_case_action_update',
+    title: 'Update Case-Level Human Action',
+    description: 'Approve, reject, execute, or fail a case-level proposed action such as tune_rule or create_exclusion. Write action; requires confirmation.',
+    scope: 'notifications:write',
+    readOnly: false,
+    confirm: true,
+    method: 'PUT',
+    endpoint: '/notifications/:notificationId/agent-case/actions/:actionKey',
+    pathParams: ['notificationId', 'actionKey'],
+    fixedBody: { reportSource: 'mcp' },
+    bodyFields: ['status', 'result', 'decisionReport', 'decisionSummary', 'outcome', 'evidence', 'reviewedHistory', 'traceIds', 'paths', 'ips', 'methods', 'statusCodes', 'userAgents', 'missingProof', 'recommendations'],
+    reasonInResult: true,
+    inputSchema: objectSchema({
+      notificationId: string('Notification id from the case-action row.'),
+      actionKey: string('Proposed action key from the row, for example tune_rule:...'),
+      status: string('New status: proposed, approved, rejected, executed, or failed.'),
+      result: { type: 'object', additionalProperties: true, description: 'Optional structured result/audit details.' },
+      ...decisionReportInput,
+      ...confirmSchema,
+    }, ['notificationId', 'actionKey', 'status', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_human_case_decision_report_add',
+    title: 'Record Case Decision Report',
+    description: 'Attach a structured analyst/MCP decision report to a notification/case without changing IP status or proposed action state. Write action; requires confirmation.',
+    scope: 'notifications:write',
+    readOnly: false,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/notifications/:notificationId/decision-report',
+    pathParams: ['notificationId'],
+    fixedBody: { reportSource: 'mcp' },
+    bodyFields: ['reason', 'decisionReport', 'decisionSummary', 'outcome', 'evidence', 'reviewedHistory', 'traceIds', 'paths', 'ips', 'methods', 'statusCodes', 'userAgents', 'missingProof', 'recommendations'],
+    inputSchema: objectSchema({
+      notificationId: string('Notification id from the case-action row.'),
+      ...decisionReportInput,
+      ...confirmSchema,
+    }, ['notificationId', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_ip_lookup',
+    title: 'IP Intelligence Lookup',
+    description: 'Look up SecureNow IP intelligence for an IP address.',
+    scope: 'ip_intel:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/ip/:ip',
+    pathParams: ['ip'],
+    inputSchema: objectSchema({
+      ip: string('IPv4 address.'),
+    }, ['ip']),
+  },
+  {
+    name: 'securenow_ip_traces',
+    title: 'IP Traces',
+    description: 'Fetch traces associated with an IP address.',
+    scope: 'ip_intel:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/ip/:ip/traces',
+    pathParams: ['ip'],
+    queryFields: ['appKeys', 'environment'],
+    normalize: { appKeys: normalizeAppKeys },
+    inputSchema: objectSchema({
+      ip: string('IPv4 address.'),
+      ...appKeysInput,
+      ...environmentInput,
+    }, ['ip']),
+  },
+  {
+    name: 'securenow_forensics_query',
+    title: 'Run Forensics Query',
+    description: 'Run a natural-language forensic query. Write scope because it creates an async query job.',
+    scope: 'forensics:write',
+    readOnly: false,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/forensics/query',
+    bodyFields: ['query', 'applicationId', 'instanceId', 'environment'],
+    inputSchema: objectSchema({
+      query: string('Natural-language forensic query.'),
+      applicationId: string('Optional application database id.'),
+      instanceId: string('Optional ClickHouse instance id.'),
+      ...environmentInput,
+      ...confirmSchema,
+    }, ['query', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_forensics_library',
+    title: 'Forensics Query Library',
+    description: 'List saved forensics queries.',
+    scope: 'forensics:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/forensics/query-library',
+    inputSchema: objectSchema({}),
+  },
+  {
+    name: 'securenow_analytics_summary',
+    title: 'Analytics Summary',
+    description: 'Fetch response analytics summary.',
+    scope: 'analytics:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/analytics/summary',
+    queryFields: ['instanceId'],
+    inputSchema: objectSchema({
+      instanceId: string('Optional ClickHouse instance id.'),
+    }),
+  },
+  {
+    name: 'securenow_automation_rules_list',
+    title: 'List Automation Rules',
+    description: 'List blocklist automation rules with app/environment scope and stats.',
+    scope: 'automation:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/automation-rules',
+    inputSchema: objectSchema({}),
+  },
+  {
+    name: 'securenow_automation_defaults_ensure',
+    title: 'Ensure Default Automation Rules',
+    description: 'Create or refresh SecureNow default risk-score automation rules for the current account. Write action; requires confirmation.',
+    scope: 'automation:write',
+    readOnly: false,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/automation-rules/defaults/ensure',
+    bodyFields: ['forceEnableExisting'],
+    inputSchema: objectSchema({
+      forceEnableExisting: boolean('Re-enable existing SecureNow default rules if the customer disabled them. Defaults to false.'),
+      ...confirmSchema,
+    }, ['confirm', 'reason']),
+  },
+  {
+    name: 'securenow_automation_rule_get',
+    title: 'Get Automation Rule',
+    description: 'Fetch one automation rule.',
+    scope: 'automation:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/automation-rules/:id',
+    pathParams: ['id'],
+    inputSchema: objectSchema({
+      id: string('Automation rule id.'),
+    }, ['id']),
+  },
+  {
+    name: 'securenow_automation_rule_create',
+    title: 'Create Automation Rule',
+    description: 'Create a blocklist automation rule. Write action; requires confirmation.',
+    scope: 'automation:write',
+    readOnly: false,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/automation-rules',
+    bodyFields: ['name', 'description', 'conditions', 'conditionLogic', 'actions', 'status', 'applicationsAll', 'applicationKeys', 'environmentsAll', 'environments'],
+    inputSchema: objectSchema({
+      name: string('Rule name.'),
+      description: string('Optional rule description.'),
+      conditions: { type: 'array', items: { type: 'object', additionalProperties: true }, description: 'Condition array. Fields include abuseConfidenceScore, riskScore, alertName, alertTag, attackType, path, environment.' },
+      conditionLogic: string('AND or OR.'),
+      actions: { type: 'array', items: { type: 'object', additionalProperties: true }, description: 'Action array, for example [{ "type":"addToBlocklist", "config":{ "reason":"...", "ttlHours":24 }}].' },
+      status: string('Initial rule status: active or disabled. Defaults to active.'),
+      applicationsAll: boolean('Apply to all applications.'),
+      applicationKeys: arrayOfStrings('Application keys when not applying to all applications.'),
+      environmentsAll: boolean('Apply to all environments.'),
+      environments: arrayOfStrings('Deployment environments when not applying to all environments.'),
+      ...confirmSchema,
+    }, ['name', 'conditions', 'actions', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_automation_rule_update',
+    title: 'Update Automation Rule',
+    description: 'Update a blocklist automation rule. Write action; requires confirmation.',
+    scope: 'automation:write',
+    readOnly: false,
+    confirm: true,
+    method: 'PUT',
+    endpoint: '/automation-rules/:id',
+    pathParams: ['id'],
+    bodyFields: ['name', 'description', 'conditions', 'conditionLogic', 'actions', 'status', 'applicationsAll', 'applicationKeys', 'environmentsAll', 'environments'],
+    inputSchema: objectSchema({
+      id: string('Automation rule id.'),
+      name: string('Rule name.'),
+      description: string('Optional rule description.'),
+      status: string('active or disabled.'),
+      conditions: { type: 'array', items: { type: 'object', additionalProperties: true }, description: 'Condition array.' },
+      conditionLogic: string('AND or OR.'),
+      actions: { type: 'array', items: { type: 'object', additionalProperties: true }, description: 'Action array.' },
+      applicationsAll: boolean('Apply to all applications.'),
+      applicationKeys: arrayOfStrings('Application keys when not applying to all applications.'),
+      environmentsAll: boolean('Apply to all environments.'),
+      environments: arrayOfStrings('Deployment environments when not applying to all environments.'),
+      ...confirmSchema,
+    }, ['id', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_automation_rule_dry_run',
+    title: 'Dry-Run Automation Rule',
+    description: 'Preview automation matches without writing blocklist entries.',
+    scope: 'automation:read',
+    readOnly: true,
+    method: 'POST',
+    endpoint: '/automation-rules/:id/dry-run',
+    pathParams: ['id'],
+    bodyFields: ['limit', 'sampleLimit'],
+    inputSchema: objectSchema({
+      id: string('Automation rule id.'),
+      limit: number('Maximum notifications to scan.', { minimum: 1, maximum: 2000 }),
+      sampleLimit: number('Maximum sample matches to return.', { minimum: 1, maximum: 50 }),
+    }, ['id']),
+  },
+  {
+    name: 'securenow_automation_rule_execute',
+    title: 'Execute Automation Rule',
+    description: 'Execute an automation rule and add matching IPs to the blocklist. Write action; requires confirmation.',
+    scope: 'automation:write',
+    readOnly: false,
+    destructive: true,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/automation-rules/:id/execute',
+    pathParams: ['id'],
+    inputSchema: objectSchema({
+      id: string('Automation rule id.'),
+      ...confirmSchema,
+    }, ['id', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_automation_rule_delete',
+    title: 'Delete Automation Rule',
+    description: 'Delete an automation rule. Write action; requires confirmation.',
+    scope: 'automation:write',
+    readOnly: false,
+    destructive: true,
+    confirm: true,
+    method: 'DELETE',
+    endpoint: '/automation-rules/:id',
+    pathParams: ['id'],
+    inputSchema: objectSchema({
+      id: string('Automation rule id.'),
+      ...confirmSchema,
+    }, ['id', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_rate_limit_list',
+    title: 'List Rate Limits',
+    description: 'List rate-limit remediation rules with app/environment scope.',
+    scope: 'rate_limits:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/rate-limits',
+    queryFields: ['status', 'search', 'page', 'limit', 'appKey', 'environment'],
+    inputSchema: objectSchema({
+      status: string('Rule status: active, disabled, removed, or all. Defaults to active.'),
+      search: string('Optional IP/path/name search.'),
+      ...pagingInput,
+      appKey: string('Optional application key scope.'),
+      ...environmentInput,
+    }),
+  },
+  {
+    name: 'securenow_rate_limit_get',
+    title: 'Get Rate Limit',
+    description: 'Fetch one rate-limit remediation rule.',
+    scope: 'rate_limits:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/rate-limits/:id',
+    pathParams: ['id'],
+    inputSchema: objectSchema({
+      id: string('Rate-limit rule id.'),
+    }, ['id']),
+  },
+  {
+    name: 'securenow_rate_limit_test',
+    title: 'Test Rate Limit Match',
+    description: 'Check whether an IP/path/method would match an active rate-limit rule.',
+    scope: 'rate_limits:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/rate-limits/check',
+    queryFields: ['ip', 'path', 'method', 'appKey', 'environment'],
+    inputSchema: objectSchema({
+      ip: string('IPv4 address to test.'),
+      path: string('Request path to test. Defaults to /.'),
+      method: string('HTTP method to test. Defaults to GET.'),
+      appKey: string('Optional application key scope.'),
+      ...environmentInput,
+    }, ['ip']),
+  },
+  {
+    name: 'securenow_rate_limit_remove',
+    title: 'Remove Rate Limit',
+    description: 'Remove a rate-limit remediation rule. Write action; requires confirmation.',
+    scope: 'rate_limits:write',
+    readOnly: false,
+    confirm: true,
+    method: 'DELETE',
+    endpoint: '/rate-limits/:id',
+    pathParams: ['id'],
+    bodyFields: ['reason'],
+    inputSchema: objectSchema({
+      id: string('Rate-limit rule id.'),
+      ...confirmSchema,
+    }, ['id', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_rate_limit_parse',
+    title: 'Parse Rate Limit Text',
+    description: 'Use SecureNow AI to convert natural language into a rate-limit remediation draft without creating it.',
+    scope: 'rate_limits:read',
+    readOnly: true,
+    method: 'POST',
+    endpoint: '/rate-limits/parse',
+    bodyFields: ['text', 'draft'],
+    inputSchema: objectSchema({
+      text: string('Natural-language rate-limit request, e.g. "rate limit /api/login to 2 attempts per minute for this IP".'),
+      draft: { type: 'object', additionalProperties: true, description: 'Optional existing draft fields to preserve or resolve phrases such as "this IP".' },
+    }, ['text']),
+  },
+  {
+    name: 'securenow_rate_limit_create_from_text',
+    title: 'Create Rate Limit From Text',
+    description: 'Create a rate-limit remediation rule from natural language. Write action; requires confirmation.',
+    scope: 'rate_limits:write',
+    readOnly: false,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/rate-limits/from-text',
+    bodyFields: ['text', 'draft', 'reason'],
+    inputSchema: objectSchema({
+      text: string('Natural-language rate-limit request.'),
+      draft: { type: 'object', additionalProperties: true, description: 'Optional existing draft fields or scope hints.' },
+      ...confirmSchema,
+    }, ['text', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_alert_rules_list',
+    title: 'List Alert Rules',
+    description: 'List alert rules, including system rules and app scope.',
+    scope: 'alerts:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/alert-rules',
+    inputSchema: objectSchema({}),
+  },
+  {
+    name: 'securenow_alert_rule_get',
+    title: 'Get Alert Rule',
+    description: 'Fetch one alert rule.',
+    scope: 'alerts:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/alert-rules/:id',
+    pathParams: ['id'],
+    inputSchema: objectSchema({
+      id: string('Alert rule id.'),
+    }, ['id']),
+  },
+  {
+    name: 'securenow_alert_rule_versions',
+    title: 'List Alert Rule Versions',
+    description: 'List a rule\'s configuration version history (newest first). Each material update (SQL/instant/settings), duplicate, and rollback is a version. Lazily seeds a v1 baseline for rules created before versioning.',
+    scope: 'alerts:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/alert-rules/:id/versions',
+    pathParams: ['id'],
+    queryFields: ['limit', 'page'],
+    inputSchema: objectSchema({
+      id: string('Alert rule id.'),
+      ...pagingInput,
+    }, ['id']),
+  },
+  {
+    name: 'securenow_alert_rule_version_get',
+    title: 'Get Alert Rule Version',
+    description: 'Fetch one version\'s full material snapshot (name/severity/mode/schedule/throttle/instant/exclusions and the resolved detection SQL) for diffing before a rollback.',
+    scope: 'alerts:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/alert-rules/:id/versions/:version',
+    pathParams: ['id', 'version'],
+    inputSchema: objectSchema({
+      id: string('Alert rule id.'),
+      version: number('Version number to fetch.', { minimum: 1 }),
+    }, ['id', 'version']),
+  },
+  {
+    name: 'securenow_alert_rule_rollback',
+    title: 'Roll Back Alert Rule',
+    description: 'Restore a prior version\'s full configuration onto a custom alert rule (re-validates the detection SQL first) and record it as a new version. Append-only history — you can roll back a rollback. System (read-only template) rules cannot be rolled back. Write action; requires confirmation.',
+    scope: 'alerts:write',
+    readOnly: false,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/alert-rules/:id/rollback',
+    pathParams: ['id'],
+    bodyFields: ['version', 'reason'],
+    inputSchema: objectSchema({
+      id: string('Alert rule id (must be a custom, non-system rule).'),
+      version: number('Version number to restore. List options with securenow_alert_rule_versions.', { minimum: 1 }),
+      ...confirmSchema,
+    }, ['id', 'version', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_alert_rule_update',
+    title: 'Update Alert Rule',
+    description: 'Update alert rule scope/status/schedule/throttle or record a review action. Write action; requires confirmation.',
+    scope: 'alerts:write',
+    readOnly: false,
+    confirm: true,
+    method: 'PUT',
+    endpoint: '/alert-rules/:id',
+    pathParams: ['id'],
+    bodyFields: ['name', 'description', 'status', 'applicationsAll', 'applications', 'schedule', 'throttle', 'alertChannelIds', 'reviewAction', 'reviewNote', 'reviewNotificationId'],
+    inputSchema: objectSchema({
+      id: string('Alert rule id.'),
+      name: string('Rule name for custom rules.'),
+      description: string('Rule description for custom rules.'),
+      status: string('Active, Disabled, or Paused.'),
+      applicationsAll: boolean('Scope rule to all applications.'),
+      applications: arrayOfStrings('Application keys when applicationsAll is false.'),
+      schedule: { type: 'object', additionalProperties: true, description: 'Schedule patch.' },
+      throttle: { type: 'object', additionalProperties: true, description: 'Throttle patch.' },
+      alertChannelIds: arrayOfStrings('Alert channel ids.'),
+      reviewAction: string('Rule review action, e.g. keep_active or saved_new_version.'),
+      reviewNote: string('Review note.'),
+      reviewNotificationId: string('Notification id tied to this review.'),
+      ...confirmSchema,
+    }, ['id', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_alert_rule_query_update',
+    title: 'Update System Alert Rule Query',
+    description: 'Admin-only: update the shared public query mapping behind a system alert rule for all customer copies. Write action; requires confirmation.',
+    scope: 'alerts:write',
+    readOnly: false,
+    confirm: true,
+    method: 'PUT',
+    endpoint: '/alert-rules/:id/query-mapping',
+    pathParams: ['id'],
+    bodyFields: ['sqlQuery', 'reason', 'expectedCurrentSqlHash', 'applyGlobally', 'reactivatePausedCopies', 'reviewNotificationId', 'reviewNote', 'source'],
+    fixedBody: { applyGlobally: true, source: 'mcp' },
+    inputSchema: objectSchema({
+      id: string('Alert rule id. Must be a system rule.'),
+      sqlQuery: string('Full replacement SQL query. System SQL must keep __USER_APP_KEYS__ for tenant scoping.'),
+      expectedCurrentSqlHash: string('Optional SHA-256 hash of the current SQL to prevent stale overwrites.'),
+      applyGlobally: boolean('Must be true. Updates the shared public query mapping used by all system rule copies.'),
+      reactivatePausedCopies: boolean('Whether to reactivate paused noisy copies after the query is tuned.'),
+      reviewNotificationId: string('Optional notification id tied to this review/tuning action.'),
+      reviewNote: string('Optional review note. Defaults to reason.'),
+      ...confirmSchema,
+    }, ['id', 'sqlQuery', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_alert_rule_instant_update',
+    title: 'Update Instant Alert Rule',
+    description: 'Patch instant rule conditions/config with version/hash guards and before/after seeded tests. System rules require applyGlobally:true and admin permission. Write action; requires confirmation.',
+    scope: 'alerts:write',
+    readOnly: false,
+    confirm: true,
+    method: 'PUT',
+    endpoint: '/alert-rules/:id/instant',
+    pathParams: ['id'],
+    bodyFields: [
+      'operations',
+      'conditions',
+      'enabled',
+      'source',
+      'matchMode',
+      'executionMode',
+      'severity',
+      'throttle',
+      'expectedRuleVersion',
+      'expectedCurrentInstantHash',
+      'expectedCurrentRuleHash',
+      'applyGlobally',
+      'dryRun',
+      'reactivatePausedCopies',
+      'fixtures',
+      'reviewNotificationId',
+      'reviewNote',
+      'reason',
+    ],
+    fixedBody: { auditSource: 'mcp' },
+    inputSchema: objectSchema({
+      id: string('Alert rule id. Fetch with securenow_alert_rule_get first to get ruleVersion and instantHash.'),
+      operations: {
+        type: 'array',
+        items: { type: 'object', additionalProperties: true },
+        description: 'Condition patch operations: add_condition, remove_condition, update_condition. Use zero-based index/conditionIndex for remove/update.',
+      },
+      conditions: {
+        type: 'array',
+        items: { type: 'object', additionalProperties: true },
+        description: 'Optional full replacement instant conditions array. Use operations for smaller patches.',
+      },
+      enabled: boolean('Whether instant detection is enabled.'),
+      source: string('Instant event source. Currently trace.'),
+      matchMode: string('Condition match mode: all or any.'),
+      executionMode: string('Rule execution mode: instant or hybrid when instant detection is enabled.'),
+      severity: string('Optional severity override: critical, high, medium, or low.'),
+      throttle: { type: 'object', additionalProperties: true, description: 'Throttle patch, for example { enabled:true, minutes:15 }.' },
+      expectedRuleVersion: number('Required current reviewState.reviewVersion from securenow_alert_rule_get.', { minimum: 1 }),
+      expectedCurrentInstantHash: string('Required SHA-256 hash of the current instant config from securenow_alert_rule_get.'),
+      expectedCurrentRuleHash: string('Optional SHA-256 hash of the current instant/throttle/severity surface from securenow_alert_rule_get.'),
+      applyGlobally: boolean('Required true for system rules. Updates every customer copy of the system rule.'),
+      dryRun: boolean('When true, validates and runs before/after seeded tests without saving.'),
+      reactivatePausedCopies: boolean('Whether to reactivate paused noisy copies after the instant rule is tuned.'),
+      fixtures: {
+        type: 'array',
+        items: { type: 'object', additionalProperties: true },
+        description: 'Optional seeded fixtures. Each may include kind attack/benign, label, path, method, requestBody, requestHeaders, and expectMatch.',
+      },
+      reviewNotificationId: string('Optional notification id tied to this review/tuning action.'),
+      reviewNote: string('Optional review note. Defaults to reason.'),
+      ...confirmSchema,
+    }, ['id', 'expectedRuleVersion', 'expectedCurrentInstantHash', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_alert_rule_conditions_get',
+    title: 'Get Alert Rule Conditions',
+    description: 'Fetch instant rule conditions with rule version and hash guards for safe condition-level tuning.',
+    scope: 'alerts:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/alert-rules/:id/conditions',
+    pathParams: ['id'],
+    inputSchema: objectSchema({
+      id: string('Alert rule id.'),
+    }, ['id']),
+  },
+  {
+    name: 'securenow_alert_rule_condition_update',
+    title: 'Update Alert Rule Condition',
+    description: 'Patch instant alert-rule conditions with version/hash guards and seeded before/after tests. Compatibility alias for condition-level tuning.',
+    scope: 'alerts:write',
+    readOnly: false,
+    confirm: true,
+    method: 'PUT',
+    endpoint: '/alert-rules/:id/instant',
+    pathParams: ['id'],
+    bodyFields: [
+      'confirm',
+      'operations',
+      'conditions',
+      'enabled',
+      'source',
+      'matchMode',
+      'executionMode',
+      'expectedRuleVersion',
+      'expectedCurrentInstantHash',
+      'expectedCurrentRuleHash',
+      'applyGlobally',
+      'reactivatePausedCopies',
+      'fixtures',
+      'reviewNotificationId',
+      'reviewNote',
+      'reason',
+    ],
+    fixedBody: { auditSource: 'mcp' },
+    inputSchema: objectSchema({
+      id: string('Alert rule id. Fetch with securenow_alert_rule_conditions_get first to get ruleVersion and instantHash.'),
+      operations: {
+        type: 'array',
+        items: { type: 'object', additionalProperties: true },
+        description: 'Condition patch operations: add_condition, remove_condition, update_condition. Use zero-based index/conditionIndex for remove/update.',
+      },
+      conditions: {
+        type: 'array',
+        items: { type: 'object', additionalProperties: true },
+        description: 'Optional full replacement instant conditions array. Use operations for smaller patches.',
+      },
+      enabled: boolean('Whether instant detection is enabled.'),
+      source: string('Instant event source. Currently trace.'),
+      matchMode: string('Condition match mode: all or any.'),
+      executionMode: string('Rule execution mode: instant or hybrid when instant detection is enabled.'),
+      expectedRuleVersion: number('Required current reviewState.reviewVersion from securenow_alert_rule_conditions_get.', { minimum: 1 }),
+      expectedCurrentInstantHash: string('Required SHA-256 hash of the current instant config from securenow_alert_rule_conditions_get.'),
+      expectedCurrentRuleHash: string('Optional SHA-256 hash of the current instant/throttle/severity surface from securenow_alert_rule_conditions_get.'),
+      applyGlobally: boolean('Required true for system rules. Updates every customer copy of the system rule.'),
+      reactivatePausedCopies: boolean('Whether to reactivate paused noisy copies after the condition is tuned.'),
+      fixtures: {
+        type: 'array',
+        items: { type: 'object', additionalProperties: true },
+        description: 'Optional seeded fixtures. Each may include kind attack/benign, label, path, method, requestBody, requestHeaders, and expectMatch.',
+      },
+      reviewNotificationId: string('Optional notification id tied to this review/tuning action.'),
+      reviewNote: string('Optional review note. Defaults to reason.'),
+      ...confirmSchema,
+    }, ['id', 'expectedRuleVersion', 'expectedCurrentInstantHash', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_alert_rule_condition_candidate_test',
+    title: 'Test Alert Rule Condition Candidate',
+    description: 'Dry-run a condition-level instant-rule patch without saving it, including seeded benign/attack fixture checks.',
+    scope: 'alerts:write',
+    readOnly: false,
+    confirm: true,
+    method: 'PUT',
+    endpoint: '/alert-rules/:id/instant',
+    pathParams: ['id'],
+    bodyFields: [
+      'confirm',
+      'operations',
+      'conditions',
+      'enabled',
+      'source',
+      'matchMode',
+      'executionMode',
+      'expectedRuleVersion',
+      'expectedCurrentInstantHash',
+      'expectedCurrentRuleHash',
+      'applyGlobally',
+      'fixtures',
+      'reviewNotificationId',
+      'reviewNote',
+      'reason',
+    ],
+    fixedBody: { auditSource: 'mcp', dryRun: true },
+    inputSchema: objectSchema({
+      id: string('Alert rule id. Fetch with securenow_alert_rule_conditions_get first to get ruleVersion and instantHash.'),
+      operations: {
+        type: 'array',
+        items: { type: 'object', additionalProperties: true },
+        description: 'Candidate condition operations to test.',
+      },
+      conditions: {
+        type: 'array',
+        items: { type: 'object', additionalProperties: true },
+        description: 'Optional full replacement instant conditions array to test.',
+      },
+      enabled: boolean('Whether instant detection would be enabled.'),
+      source: string('Instant event source. Currently trace.'),
+      matchMode: string('Condition match mode: all or any.'),
+      executionMode: string('Rule execution mode: instant or hybrid when instant detection is enabled.'),
+      expectedRuleVersion: number('Required current reviewState.reviewVersion from securenow_alert_rule_conditions_get.', { minimum: 1 }),
+      expectedCurrentInstantHash: string('Required SHA-256 hash of the current instant config from securenow_alert_rule_conditions_get.'),
+      expectedCurrentRuleHash: string('Optional SHA-256 hash of the current instant/throttle/severity surface from securenow_alert_rule_conditions_get.'),
+      applyGlobally: boolean('Required true for system rules, even for admin dry-runs.'),
+      fixtures: {
+        type: 'array',
+        items: { type: 'object', additionalProperties: true },
+        description: 'Optional seeded fixtures. Each may include kind attack/benign, label, path, method, requestBody, requestHeaders, and expectMatch.',
+      },
+      reviewNotificationId: string('Optional notification id tied to this review/tuning action.'),
+      reviewNote: string('Optional review note. Defaults to reason.'),
+      ...confirmSchema,
+    }, ['id', 'expectedRuleVersion', 'expectedCurrentInstantHash', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_alert_rule_condition_diff',
+    title: 'Diff Alert Rule Condition Candidate',
+    description: 'Return the current instant conditions, candidate conditions, hashes, and before/after fixture behavior without saving.',
+    scope: 'alerts:write',
+    readOnly: false,
+    confirm: true,
+    method: 'PUT',
+    endpoint: '/alert-rules/:id/instant',
+    pathParams: ['id'],
+    bodyFields: [
+      'confirm',
+      'operations',
+      'conditions',
+      'enabled',
+      'source',
+      'matchMode',
+      'executionMode',
+      'expectedRuleVersion',
+      'expectedCurrentInstantHash',
+      'expectedCurrentRuleHash',
+      'applyGlobally',
+      'fixtures',
+      'reason',
+    ],
+    fixedBody: { auditSource: 'mcp', dryRun: true },
+    inputSchema: objectSchema({
+      id: string('Alert rule id. Fetch with securenow_alert_rule_conditions_get first to get ruleVersion and instantHash.'),
+      operations: {
+        type: 'array',
+        items: { type: 'object', additionalProperties: true },
+        description: 'Candidate condition operations to diff.',
+      },
+      conditions: {
+        type: 'array',
+        items: { type: 'object', additionalProperties: true },
+        description: 'Optional full replacement instant conditions array to diff.',
+      },
+      enabled: boolean('Whether instant detection would be enabled.'),
+      source: string('Instant event source. Currently trace.'),
+      matchMode: string('Condition match mode: all or any.'),
+      executionMode: string('Rule execution mode: instant or hybrid when instant detection is enabled.'),
+      expectedRuleVersion: number('Required current reviewState.reviewVersion from securenow_alert_rule_conditions_get.', { minimum: 1 }),
+      expectedCurrentInstantHash: string('Required SHA-256 hash of the current instant config from securenow_alert_rule_conditions_get.'),
+      expectedCurrentRuleHash: string('Optional SHA-256 hash of the current instant/throttle/severity surface from securenow_alert_rule_conditions_get.'),
+      applyGlobally: boolean('Required true for system rules, even for admin dry-runs.'),
+      fixtures: {
+        type: 'array',
+        items: { type: 'object', additionalProperties: true },
+        description: 'Optional seeded fixtures used to explain benign removals and attack coverage.',
+      },
+      ...confirmSchema,
+    }, ['id', 'expectedRuleVersion', 'expectedCurrentInstantHash', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_alert_rule_test',
+    title: 'Test Alert Rule',
+    description: 'Start a live or dry-run alert rule test.',
+    scope: 'alerts:write',
+    readOnly: false,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/alert-rules/:id/test',
+    pathParams: ['id'],
+    bodyFields: ['applicationKey', 'mode'],
+    inputSchema: objectSchema({
+      id: string('Alert rule id.'),
+      applicationKey: string('Application key to test.'),
+      mode: string('dry_run or live.'),
+      ...confirmSchema,
+    }, ['id', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_alert_rule_candidate_test',
+    title: 'Dry-Run Candidate Alert Rule SQL',
+    description: 'Dry-run a candidate SQL/query guard for an alert rule without saving it.',
+    scope: 'alerts:write',
+    readOnly: false,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/alert-rules/:id/test',
+    pathParams: ['id'],
+    bodyFields: ['applicationKey', 'candidateSqlQuery'],
+    fixedBody: { mode: 'dry_run' },
+    inputSchema: objectSchema({
+      id: string('Alert rule id.'),
+      applicationKey: string('Application key to test.'),
+      candidateSqlQuery: string('Full candidate SQL query to dry-run without saving.'),
+      ...confirmSchema,
+    }, ['id', 'candidateSqlQuery', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_alert_rule_test_result',
+    title: 'Get Alert Rule Test Result',
+    description: 'Poll alert rule test status and results.',
+    scope: 'alerts:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/alert-rules/:id/test/:testId',
+    pathParams: ['id', 'testId'],
+    inputSchema: objectSchema({
+      id: string('Alert rule id.'),
+      testId: string('Alert rule test id.'),
+    }, ['id', 'testId']),
+  },
+  {
+    name: 'securenow_alert_rule_exclusions_list',
+    title: 'List Alert Rule Exclusions',
+    description: 'List exclusions embedded on one alert rule.',
+    scope: 'alerts:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/alert-rules/:id/exclusions',
+    pathParams: ['id'],
+    inputSchema: objectSchema({
+      id: string('Alert rule id.'),
+    }, ['id']),
+  },
+  {
+    name: 'securenow_alert_rule_exclusion_add',
+    title: 'Add Alert Rule Exclusion',
+    description: 'Add a restrictive exclusion to one alert rule. Write action; requires confirmation.',
+    scope: 'alerts:write',
+    readOnly: false,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/alert-rules/:id/exclusions',
+    pathParams: ['id'],
+    bodyFields: ['conditions', 'matchMode', 'reason', 'pathPattern', 'isActive'],
+    inputSchema: objectSchema({
+      id: string('Alert rule id.'),
+      conditions: { type: 'array', items: { type: 'object', additionalProperties: true }, description: 'Restrictive exclusion conditions.' },
+      matchMode: string('all or any.'),
+      reason: string('Exclusion reason.'),
+      pathPattern: string('Optional path pattern.'),
+      isActive: boolean('Whether the exclusion is active.'),
+      ...confirmSchema,
+    }, ['id', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_alert_rule_exclusion_remove',
+    title: 'Remove Alert Rule Exclusion',
+    description: 'Remove an alert rule exclusion. Write action; requires confirmation.',
+    scope: 'alerts:write',
+    readOnly: false,
+    confirm: true,
+    method: 'DELETE',
+    endpoint: '/alert-rules/:id/exclusions/:exclusionId',
+    pathParams: ['id', 'exclusionId'],
+    inputSchema: objectSchema({
+      id: string('Alert rule id.'),
+      exclusionId: string('Exclusion id.'),
+      ...confirmSchema,
+    }, ['id', 'exclusionId', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_blocklist_list',
+    title: 'List Blocklist',
+    description: 'List blocked IPs.',
+    scope: 'blocklist:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/blocklist',
+    queryFields: ['page', 'limit', 'status', 'approvalStatus', 'search', 'view', 'appKey', 'environment'],
+    inputSchema: objectSchema({
+      ...pagingInput,
+      status: string('Block entry status: active or removed. Defaults to active.'),
+      approvalStatus: string('Optional approval filter: pending, approved, or rejected.'),
+      search: string('Optional IP prefix search.'),
+      view: string('List view: all or operational.'),
+      appKey: string('Optional application key scope.'),
+      ...environmentInput,
+    }),
+  },
+  {
+    name: 'securenow_blocklist_pending_list',
+    title: 'List Pending Block Approvals',
+    description: 'List legacy or AI-prepared blocklist entries with approvalStatus=pending. Pending blocks are not enforced until approved.',
+    scope: 'blocklist:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/blocklist/pending',
+    queryFields: ['page', 'limit', 'search', 'appKey', 'environment'],
+    inputSchema: objectSchema({
+      ...pagingInput,
+      search: string('Optional IP prefix search.'),
+      appKey: string('Optional application key scope.'),
+      ...environmentInput,
+    }),
+  },
+  {
+    name: 'securenow_blocklist_pending_approve',
+    title: 'Approve Pending Block',
+    description: 'Approve one pending blocklist entry so the firewall enforces it. Write action; requires confirmation.',
+    scope: 'blocklist:write',
+    readOnly: false,
+    destructive: true,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/blocklist/:id/approve',
+    pathParams: ['id'],
+    bodyFields: ['reason'],
+    inputSchema: objectSchema({
+      id: string('Pending blocklist entry id.'),
+      ...confirmSchema,
+    }, ['id', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_blocklist_pending_reject',
+    title: 'Reject Pending Block',
+    description: 'Reject one pending blocklist entry and remove it from enforcement consideration. Write action; requires confirmation.',
+    scope: 'blocklist:write',
+    readOnly: false,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/blocklist/:id/reject',
+    pathParams: ['id'],
+    bodyFields: ['reason'],
+    inputSchema: objectSchema({
+      id: string('Pending blocklist entry id.'),
+      ...confirmSchema,
+    }, ['id', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_blocklist_pending_bulk_approve',
+    title: 'Bulk Approve Pending Blocks',
+    description: 'Approve multiple pending blocklist entries after they have all been reviewed under the same safe policy. Write action; requires confirmation.',
+    scope: 'blocklist:write',
+    readOnly: false,
+    destructive: true,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/blocklist/bulk-approve',
+    bodyFields: ['ids', 'reason'],
+    inputSchema: objectSchema({
+      ids: arrayOfStrings('Pending blocklist entry ids to approve.'),
+      ...confirmSchema,
+    }, ['ids', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_blocklist_pending_bulk_reject',
+    title: 'Bulk Reject Pending Blocks',
+    description: 'Reject multiple pending blocklist entries after they have all been reviewed as false positives or stale/ambiguous. Write action; requires confirmation.',
+    scope: 'blocklist:write',
+    readOnly: false,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/blocklist/bulk-reject',
+    bodyFields: ['ids', 'reason'],
+    inputSchema: objectSchema({
+      ids: arrayOfStrings('Pending blocklist entry ids to reject.'),
+      ...confirmSchema,
+    }, ['ids', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_blocklist_add',
+    title: 'Add Blocked IP',
+    description: 'Add an IP/CIDR to the blocklist, optionally scoped to a route/method. Write action; requires confirmation.',
+    scope: 'blocklist:write',
+    readOnly: false,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/blocklist',
+    bodyFields: ['ip', 'reason', 'expiresAt', 'metadata', 'appKey', 'environment', 'pathPattern', 'pathMatchMode', 'method'],
+    inputSchema: objectSchema({
+      ip: string('IPv4 address or CIDR.'),
+      reason: string('Reason for blocking.'),
+      expiresAt: string('Optional expiry time as ISO 8601.'),
+      metadata: { type: 'object', additionalProperties: true, description: 'Optional metadata.' },
+      appKey: string('Optional application key to scope this block. Omit for all apps.'),
+      pathPattern: string('Optional route/path pattern, for example /admin*. Omit to block all routes.'),
+      pathMatchMode: { type: 'string', enum: ['exact', 'prefix', 'regex'], description: 'Path matching mode. Defaults to prefix.' },
+      method: { type: 'string', enum: ['ALL', 'GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS'], description: 'HTTP method scope. Defaults to ALL.' },
+      ...environmentInput,
+      ...confirmSchema,
+    }, ['ip', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_blocklist_remove',
+    title: 'Unblock IP (Compat Alias)',
+    description: 'Compatibility alias for unblocking a blocklist entry while retaining block report/history. Write action; requires confirmation.',
+    scope: 'blocklist:write',
+    readOnly: false,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/blocklist/:id/unblock',
+    pathParams: ['id'],
+    bodyFields: ['reason'],
+    inputSchema: objectSchema({
+      id: string('Blocklist entry id.'),
+      ...confirmSchema,
+    }, ['id', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_blocklist_unblock',
+    title: 'Unblock IP And Keep History',
+    description: 'Unblock a blocklist entry so firewall enforcement stops, while retaining the block report, history, and unblock audit trail. Write action; requires confirmation.',
+    scope: 'blocklist:write',
+    readOnly: false,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/blocklist/:id/unblock',
+    pathParams: ['id'],
+    bodyFields: ['reason'],
+    inputSchema: objectSchema({
+      id: string('Blocklist entry id.'),
+      ...confirmSchema,
+    }, ['id', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_blocklist_stats',
+    title: 'Blocklist Stats',
+    description: 'Return blocklist statistics.',
+    scope: 'blocklist:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/blocklist/stats',
+    inputSchema: objectSchema({}),
+  },
+  {
+    name: 'securenow_allowlist_list',
+    title: 'List Restrictive Allowlist',
+    description: 'List restrictive allowlist entries. If any active entry exists for an app/environment, only listed IPs can reach it and all other IPs are blocked. This is not the Trusted IP list.',
+    scope: 'allowlist:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/allowlist',
+    queryFields: ['page', 'limit', 'appKey', 'environment'],
+    inputSchema: objectSchema({
+      ...pagingInput,
+      appKey: string('Optional application key scope.'),
+      ...environmentInput,
+    }),
+  },
+  {
+    name: 'securenow_allowlist_add',
+    title: 'Add Restrictive Allowlist IP',
+    description: 'Dangerous production action: add an IP/CIDR to the restrictive allowlist. Once active, allowlist mode blocks every IP except listed entries. Do not use this to mark an IP trusted or suppress false positives; use securenow_trusted_add instead. Requires explicit human approval confirming deny-all behavior.',
+    scope: 'allowlist:write',
+    readOnly: false,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/allowlist',
+    fixedBody: { initiatedBy: 'mcp' },
+    bodyFields: ['ip', 'label', 'reason', 'expiresAt', 'applicationsAll', 'applicationKeys', 'environment', 'allowlistDenyAllApproved'],
+    inputSchema: objectSchema({
+      ip: string('IPv4 address or CIDR.'),
+      label: string('Human-readable label.'),
+      reason: string('Required human-approved reason. Must acknowledge that allowlist blocks all non-listed IPs and why Trusted IPs is not the correct action.'),
+      expiresAt: string('Optional expiry time as ISO 8601.'),
+      applicationsAll: boolean('Apply to all applications.'),
+      applicationKeys: arrayOfStrings('Application keys to scope this allowlist entry to.'),
+      allowlistDenyAllApproved: boolean('Must be true only after the user explicitly approves deny-by-default allowlist behavior. Do not set this for trusted IPs, monitors, false positives, or investigation cleanup.'),
+      ...environmentInput,
+      ...confirmSchema,
+    }, ['ip', 'confirm', 'reason', 'allowlistDenyAllApproved']),
+  },
+  {
+    name: 'securenow_allowlist_remove',
+    title: 'Remove Allowed IP',
+    description: 'Remove an allowlist entry. Write action; requires confirmation.',
+    scope: 'allowlist:write',
+    readOnly: false,
+    confirm: true,
+    method: 'DELETE',
+    endpoint: '/allowlist/:id',
+    pathParams: ['id'],
+    inputSchema: objectSchema({
+      id: string('Allowlist entry id.'),
+      ...confirmSchema,
+    }, ['id', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_trusted_list',
+    title: 'List Trusted IPs',
+    description: 'List trusted IPs. Trusted IPs are for known-safe traffic and do not turn on deny-by-default allowlist mode.',
+    scope: 'trusted_ips:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/trusted-ips',
+    queryFields: ['appKey', 'environment'],
+    inputSchema: objectSchema({
+      appKey: string('Optional application key scope.'),
+      ...environmentInput,
+    }),
+  },
+  {
+    name: 'securenow_trusted_add',
+    title: 'Add Trusted IP',
+    description: 'Add a trusted IP/CIDR for known-safe infrastructure, monitors, office/VPN traffic, or scoped false-positive suppression. This does not enable deny-by-default allowlist mode and is the correct tool when an IP should be trusted without blocking other visitors. Write action; requires confirmation.',
+    scope: 'trusted_ips:write',
+    readOnly: false,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/trusted-ips',
+    bodyFields: ['ip', 'label', 'note', 'applicationsAll', 'applicationKeys', 'environment'],
+    inputSchema: objectSchema({
+      ip: string('IPv4 address or CIDR.'),
+      label: string('Human-readable label.'),
+      note: string('Optional note.'),
+      applicationsAll: boolean('Apply to all applications.'),
+      applicationKeys: arrayOfStrings('Application keys to scope this trusted IP to.'),
+      ...environmentInput,
+      ...confirmSchema,
+    }, ['ip', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_trusted_remove',
+    title: 'Remove Trusted IP',
+    description: 'Remove a trusted IP entry. Write action; requires confirmation.',
+    scope: 'trusted_ips:write',
+    readOnly: false,
+    confirm: true,
+    method: 'DELETE',
+    endpoint: '/trusted-ips/:id',
+    pathParams: ['id'],
+    inputSchema: objectSchema({
+      id: string('Trusted IP entry id.'),
+      ...confirmSchema,
+    }, ['id', 'confirm', 'reason']),
+  },
+];
+
+const RESOURCES = [
+  {
+    uri: 'securenow://docs/skill-api',
+    name: 'skill-api',
+    title: 'SecureNow SDK Skill',
+    description: 'Installed SDK skill instructions from SKILL-API.md.',
+    mimeType: MARKDOWN,
+    file: '../SKILL-API.md',
+  },
+  {
+    uri: 'securenow://docs/skill-cli',
+    name: 'skill-cli',
+    title: 'SecureNow CLI Skill',
+    description: 'Installed CLI skill instructions from SKILL-CLI.md.',
+    mimeType: MARKDOWN,
+    file: '../SKILL-CLI.md',
+  },
+  {
+    uri: 'securenow://docs/npm-readme',
+    name: 'npm-readme',
+    title: 'SecureNow npm README',
+    description: 'Installed npm README.',
+    mimeType: MARKDOWN,
+    file: '../NPM_README.md',
+  },
+  {
+    uri: 'securenow://project/config',
+    name: 'project-config',
+    title: 'SecureNow Project Config',
+    description: 'Resolved local SecureNow config and masked credentials.',
+    mimeType: JSON_MIME,
+    dynamic: 'projectConfig',
+  },
+  {
+    uri: 'securenow://tools/catalog',
+    name: 'tools-catalog',
+    title: 'SecureNow MCP Tool Catalog',
+    description: 'MCP tool names, scopes, and write/read classification.',
+    mimeType: JSON_MIME,
+    dynamic: 'toolsCatalog',
+  },
+];
+
+const PROMPTS = [
+  {
+    name: 'secure_project_setup',
+    title: 'Secure Project Setup',
+    description: 'Generic framework setup prompt for SecureNow tracing, logs, body capture, multipart, and firewall defaults.',
+    arguments: [
+      { name: 'projectRoot', description: 'Project root to configure.', required: false },
+      { name: 'startCommand', description: 'Optional customer-approved command to start the app.', required: false },
+      { name: 'buildCommand', description: 'Optional customer-approved build command.', required: false },
+      { name: 'testCommand', description: 'Optional customer-approved test command.', required: false },
+      { name: 'localUrl', description: 'Optional local URL to smoke-test after the app is running.', required: false },
+      { name: 'productionUrl', description: 'Optional production URL to smoke-test with --env production.', required: false },
+    ],
+  },
+  {
+    name: 'verify_firewall_default_on',
+    title: 'Verify Default-On Firewall',
+    description: 'Verify SecureNow CLI login, app firewall toggle, credentials, and SDK defaults.',
+    arguments: [
+      { name: 'appKey', description: 'Optional SecureNow app key.', required: false },
+    ],
+  },
+  {
+    name: 'investigate_ip',
+    title: 'Investigate IP',
+    description: 'Investigate an IP with SecureNow IP intelligence, traces, logs, and remediation options.',
+    arguments: [
+      { name: 'ip', description: 'IP address to investigate.', required: true },
+      { name: 'appKeys', description: 'Optional comma-separated app keys.', required: false },
+      { name: 'environment', description: 'Environment to investigate. Defaults to production; use all only when explicitly needed.', required: false },
+    ],
+  },
+  {
+    name: 'investigate_human_action_row',
+    title: 'Investigate Human Action Row',
+    description: 'Use MCP tools to deeply review one Requires Human row and reach a safe audited outcome.',
+    arguments: [
+      { name: 'rowNumber', description: '1-based row number from the Requires Human queue.', required: true },
+      { name: 'page', description: 'Queue page number. Defaults to 1.', required: false },
+      { name: 'limit', description: 'Rows to fetch. Defaults to 20.', required: false },
+      { name: 'confirmWrites', description: 'Set true only when the user explicitly wants the MCP agent to execute decisions.', required: false },
+    ],
+  },
+  {
+    name: 'work_human_actions',
+    title: 'Work Human Actions',
+    description: 'Use MCP tools to work the approval queue from most urgent to least urgent, with trace verification and scoped decisions.',
+    arguments: [
+      { name: 'limit', description: 'Maximum rows to review this run. Defaults to 10.', required: false },
+      { name: 'search', description: 'Optional search filter for the queue.', required: false },
+      { name: 'confirmWrites', description: 'Set true only when the user explicitly wants the MCP agent to execute decisions.', required: false },
+    ],
+  },
+  {
+    name: 'cleanup_legacy_pending_blocks',
+    title: 'Clean Legacy Pending Blocks',
+    description: 'Use MCP tools to review and approve/reject legacy pending blocklist rows so only current human work remains.',
+    arguments: [
+      { name: 'limit', description: 'Maximum pending block rows to review this run. Defaults to 50.', required: false },
+      { name: 'environment', description: 'Environment scope. Defaults to production.', required: false },
+      { name: 'confirmWrites', description: 'Set true only when the user explicitly wants the MCP agent to execute approvals/rejections.', required: false },
+    ],
+  },
+  {
+    name: 'configure_default_automation',
+    title: 'Configure Default Automation',
+    description: 'Use MCP tools to set conservative default SecureNow automation rules based on the canonical riskScore and supporting evidence.',
+    arguments: [
+      { name: 'environment', description: 'Environment scope. Defaults to production.', required: false },
+      { name: 'confirmWrites', description: 'Set true only when the user explicitly wants the MCP agent to create/update automation rules.', required: false },
+    ],
+  },
+];
+
+function promptMessages(name, args = {}) {
+  if (name === 'secure_project_setup') {
+    return [
+      {
+        role: 'user',
+        content: {
+          type: 'text',
+          text: [
+            args.projectRoot ? `Project root: ${args.projectRoot}` : null,
+            args.startCommand ? `Customer-approved start command: ${args.startCommand}` : null,
+            args.buildCommand ? `Customer-approved build command: ${args.buildCommand}` : null,
+            args.testCommand ? `Customer-approved test command: ${args.testCommand}` : null,
+            args.localUrl ? `Local URL for smoke testing: ${args.localUrl}` : null,
+            args.productionUrl ? `Production URL for smoke testing: ${args.productionUrl}` : null,
+            UNIVERSAL_SECURENOW_SETUP_PROMPT,
+          ].filter(Boolean).join('\n\n'),
+        },
+      },
+    ];
+  }
+
+  if (name === 'verify_firewall_default_on') {
+    return [
+      {
+        role: 'user',
+        content: {
+          type: 'text',
+          text: [
+            'Verify SecureNow default-on protection for this project.',
+            args.appKey ? `App key: ${args.appKey}` : null,
+            'Check npx securenow whoami, npx securenow api-key show, npx securenow firewall apps, and npx securenow firewall status.',
+            'Confirm traces, logs, capture.body, capture.multipart, and firewall.enabled are enabled by .securenow/runtime.json defaults unless explicitly set false. Legacy .securenow/credentials.json is still accepted.',
+            'Do not print full tokens or API keys.',
+          ].filter(Boolean).join('\n'),
+        },
+      },
+    ];
+  }
+
+  if (name === 'investigate_ip') {
+    return [
+      {
+        role: 'user',
+        content: {
+          type: 'text',
+          text: [
+            `Investigate IP ${args.ip || '<ip>'} with SecureNow.`,
+            args.appKeys ? `Scope to app keys: ${args.appKeys}` : null,
+            `Environment scope: ${args.environment || 'production'}.`,
+            'Use IP intelligence first, then related traces/logs, then recommend remediation.',
+            'Only block or trust the IP after explicit user confirmation. Never use IP Allowlist for false positives or trusted traffic; allowlist is deny-by-default and blocks all non-listed IPs.',
+          ].filter(Boolean).join('\n'),
+        },
+      },
+    ];
+  }
+
+  if (name === 'investigate_human_action_row') {
+    const rowNumber = args.rowNumber || '<rowNumber>';
+    const page = args.page || 1;
+    const limit = args.limit || 20;
+    const confirmWrites = args.confirmWrites === true || args.confirmWrites === 'true';
+    return [
+      {
+        role: 'user',
+        content: {
+          type: 'text',
+          text: [
+            `Investigate Requires Human row ${rowNumber} using SecureNow MCP.`,
+            `Fetch page=${page}, limit=${limit} with securenow_human_actions_list, select row ${rowNumber}, then call securenow_notifications_get and securenow_human_action_report for that notificationId and IP.`,
+            'Read the AI report, finalDecision, investigation steps, findings, proofs, metadata paths/user agents/status codes, and trace IDs.',
+            'Open trace evidence with securenow_traces_show and correlated logs with securenow_logs_for_trace when trace IDs are available.',
+            'Return one clear outcome: Block IP, Rate Limit, False Positive, Rule Tuning Applied/Needed, New Alert Rule Needed, Case Action Approved/Rejected, or Ambiguous/Skipped with exact missing proof.',
+            'A row can be finished without an enforcement write when no write is safe. In that case record or prepare a structured no-write decision report explaining the missing proof, missing permission, or vague guard.',
+            'If evidence is mixed, split the decision by IP/cluster. Block only proven malicious IPs, false-positive only exact benign shapes, rate-limit only route-specific volume abuse, and leave ambiguous members with missing proof.',
+            'If the right fix is global/system rule tuning and the MCP tool returns access denied, do not create customer-specific false positives. Prepare the exact attack-preserving guard/SQL, dry-run it if possible, and record outcome=rule_tuning with missingProof naming the missing permission.',
+            'If an AI proposed action says to use a shared benign shape but does not provide exact path/method/status/user-agent/body/header conditions, do not execute it. Record the missing guard fields instead.',
+            'Use rate limiting only as temporary soft remediation for repeated route-specific abuse such as login brute force, credential stuffing, scraping/API bursts, enumeration, recon/probing, or repeated noisy payloads where risk/impact evidence is below the block threshold.',
+            'Do not rate-limit instead of blocking when there is confirmed exploit success, token/data exposure, SSRF reachability, file read, RCE, persistence, malware/C2, or riskScore >= 85 with high-confidence malicious evidence. Do not rate-limit benign false positives, trusted monitors, app-server/proxy attribution problems, isolated one-off requests, or broad noisy rules that need alert tuning.',
+            'Do not create or recommend IP Allowlist entries during investigations unless the user explicitly asks to lock the app/environment to a known set of IPs. For safe monitors, offices, VPNs, or false positives, use Trusted IPs or scoped false-positive exclusions instead.',
+            confirmWrites
+              ? 'The user requested execution. If evidence supports the decision, call securenow_human_action_block, securenow_rate_limit_create_from_text plus securenow_human_action_decision_report_add(outcome=rate_limited), or securenow_human_action_false_positive with confirm:true, a precise reason, and a decisionReport containing summary, evidence, reviewedHistory, traceIds, and missingProof when relevant. If no enforcement write is safe, call securenow_human_action_decision_report_add with outcome=rule_tuning, new_alert_rule, ambiguous, skipped, or other so the audit trail is complete without changing IP status.'
+              : 'Do not execute write tools yet. Prepare the recommended decision and exact tool call the user can approve.',
+            'If many IPs share the same benign path/status/user-agent pattern, recommend tightening the alert rule with a precise guard instead of reviewing each IP as malicious.',
+            'False positives must be narrow: app + alert rule + path + method/status/user-agent/body evidence where possible. Never globally trust an IP by default.',
+          ].join('\n'),
+        },
+      },
+    ];
+  }
+
+  if (name === 'work_human_actions') {
+    const limit = args.limit || 10;
+    const confirmWrites = args.confirmWrites === true || args.confirmWrites === 'true';
+    return [
+      {
+        role: 'user',
+        content: {
+          type: 'text',
+          text: [
+            'Work my SecureNow Requires Human queue like a senior security analyst using the MCP tools.',
+            `Review up to ${limit} row(s), most urgent first.${args.search ? ` Search filter: ${args.search}.` : ''}`,
+            'Start with securenow_human_actions_list. For each row, call securenow_notifications_get and securenow_human_action_report, inspect the AI report/investigation steps/proofs/trace IDs, and fetch trace/log evidence where useful.',
+            'For each row choose exactly one outcome: Block IP, Rate Limit, False Positive, Rule Tuning Applied/Needed, New Alert Rule Needed, Case Action Approved/Rejected, or Ambiguous/Skipped with exact missing proof.',
+            'Finished does not always mean enforcement changed. A row is also finished when a structured no-write decision report records the exact proof gap, missing permission, or vague guard and no weaker substitute write is used.',
+            'If a global/system rule update is the right fix but access is denied, do not mark customer-specific false positives just to clear the row. Prepare the exact attack-preserving guard/SQL, dry-run it when possible, and record outcome=rule_tuning with missingProof.',
+            'If evidence is mixed, do partial resolution: block proven malicious IPs, false-positive exact benign shapes, rate-limit route-specific volume abuse, and leave ambiguous IPs with their missing proof.',
+            'Reject vague AI proposed actions. If the prompt/action lacks concrete rule id, path, method, status, user-agent/body/header guard, benign samples, and attack examples that still match, record it as ambiguous or rule_tuning needed.',
+            'Use Rate Limit only for repeated route-specific abuse where temporary friction is safer than blocking: login brute force/credential stuffing, password reset/account enumeration, scraping/API bursts, path or ID enumeration, recon/probing, or repeated noisy payloads without confirmed exploit success.',
+            'Do not rate-limit confirmed high-risk attacks that should be blocked, benign traffic that should be false-positive scoped, broad noisy rules that need tuning, app-server/proxy attribution problems, or isolated one-off requests.',
+            'Do not create or recommend IP Allowlist entries while working this queue unless the user explicitly approves deny-by-default allowlist mode for the whole app/environment. Use Trusted IPs for trusted/bypass cases.',
+            confirmWrites
+              ? 'The user requested execution. For supported decisions, call the correct write tool with confirm:true, a precise reason, and a decisionReport containing summary, evidence, reviewedHistory, traceIds, and missingProof when relevant, then continue. For skipped/ambiguous/rule-tuning-needed/new-rule-needed rows that should be auditable without changing enforcement status, use securenow_human_action_decision_report_add or securenow_human_case_decision_report_add.'
+              : 'Do not execute write tools yet. Produce a row-by-row action plan and exact MCP write calls for user approval.',
+            'For block decisions, use securenow_human_action_block. For rate-limit decisions, use securenow_rate_limit_create_from_text and then securenow_human_action_decision_report_add with outcome=rate_limited. For false positives, use securenow_human_action_false_positive with restrictive conditions. For case-level tune_rule/create_exclusion rows, inspect securenow_notifications_get and then use securenow_human_case_action_update only when the action is safe to approve/reject.',
+            'End with counts: handled, blocked/proposed block, rate limits created/proposed, false positives, rule tuning/admin permission blockers with exact guard, partial resolutions, skipped with missing proof, and still waiting.',
+          ].join('\n'),
+        },
+      },
+    ];
+  }
+
+  if (name === 'cleanup_legacy_pending_blocks') {
+    const limit = args.limit || 50;
+    const environment = args.environment || 'production';
+    const confirmWrites = args.confirmWrites === true || args.confirmWrites === 'true';
+    return [
+      {
+        role: 'user',
+        content: {
+          type: 'text',
+          text: [
+            'Clean my SecureNow legacy pending blocklist queue using MCP tools.',
+            `Review up to ${limit} pending block row(s). Environment scope: ${environment}.`,
+            'Start with securenow_blocklist_stats, then securenow_blocklist_pending_list({ page: 1, limit, environment }).',
+            'For each pending block, inspect id, IP, source, reason, metadata.riskScore, metadata.aiRiskScore, metadata.abuseConfidenceScore, automation rule, linked notification, age, app, and environment.',
+            'When investigationNotificationId exists, fetch securenow_notifications_get for that case and use the linked IP report/history as evidence.',
+            'Approve only when the row has clear malicious evidence, riskScore >= 90, or SecureNow AI IPDB evidence score >= 80 with no false-positive/test signal.',
+            'Reject stale, ambiguous, synthetic/test, self-traffic, or false-positive rows. Prefer narrow rule/exclusion tuning when the same benign pattern repeats.',
+            confirmWrites
+              ? 'The user requested execution. Use securenow_blocklist_pending_approve or securenow_blocklist_pending_reject with confirm:true and a precise reason. Use bulk tools only after every selected row satisfies the same reviewed policy.'
+              : 'Do not execute writes yet. Produce exact approve/reject MCP calls grouped by safe policy for user approval.',
+            'After each write or batch, re-fetch securenow_blocklist_stats and securenow_blocklist_pending_list until the legacy pending count is zero or only ambiguous rows remain.',
+            'End with counts: approved, rejected, skipped ambiguous, legacyPendingBlockCount, and remaining proof gaps.',
+          ].join('\n'),
+        },
+      },
+    ];
+  }
+
+  if (name === 'configure_default_automation') {
+    const environment = args.environment || 'production';
+    const confirmWrites = args.confirmWrites === true || args.confirmWrites === 'true';
+    return [
+      {
+        role: 'user',
+        content: {
+          type: 'text',
+          text: [
+            'Configure SecureNow default automation using the MCP tools.',
+            `Review environment context: ${environment}. Built-in defaults apply to all apps and all environments unless the customer narrows them later.`,
+            'Use one canonical product score for automation decisions: riskScore. SecureNow AI IPDB score and AI confidence remain supporting evidence.',
+            'Built-in defaults are active by default:',
+            '- Critical Risk Auto-Block: riskScore>=95, TTL 168h.',
+            '- High Risk Auto-Block: riskScore>=90 AND riskScore<95, TTL 72h.',
+            '- Elevated Risk Auto-Block: riskScore>=85 AND riskScore<90, TTL 24h.',
+            'Start with securenow_automation_defaults_ensure({ confirm:true, reason:"Provision SecureNow default risk-score automation" }) when writes are confirmed, otherwise start with securenow_automation_rules_list and report what would be ensured.',
+            'After ensuring defaults, dry-run each default rule with securenow_automation_rule_dry_run to inspect sample matches. Disable or tune only if evidence shows customer-specific false positives.',
+            confirmWrites
+              ? 'The user requested execution. Ensure defaults with confirm:true, do not force-enable previously disabled defaults unless the user explicitly asked, and re-list rules after writes.'
+              : 'Do not execute writes yet. Return exact MCP update/create calls and dry-run calls for approval.',
+            'End with active rules, disabled rules that should stay disabled, and any risk from automation scope.',
+          ].join('\n'),
+        },
+      },
+    ];
+  }
+
+  throw new Error(`Unknown prompt: ${name}`);
+}
+
+function getTool(name) {
+  return TOOLS.find((tool) => tool.name === name) || null;
+}
+
+function mcpToolDefinition(tool) {
+  return {
+    name: tool.name,
+    title: tool.title,
+    description: tool.description,
+    inputSchema: tool.inputSchema || objectSchema({}),
+    annotations: {
+      readOnlyHint: !!tool.readOnly,
+      destructiveHint: !!tool.destructive,
+      idempotentHint: !!tool.readOnly,
+  },
+};
+}
+
+function listTools() {
+  return TOOLS.map(mcpToolDefinition);
+}
+
+function listResources() {
+  return RESOURCES.map(({ file, dynamic, ...resource }) => resource);
+}
+
+function listPrompts() {
+  return PROMPTS;
+}
+
+function assertConfirmed(tool, args = {}) {
+  if (!tool.confirm) return;
+  if (args.confirm !== true) {
+    throw new Error(`${tool.name} is a write action. Pass confirm:true and a reason to proceed.`);
+  }
+  if (!args.reason || !String(args.reason).trim()) {
+    throw new Error(`${tool.name} requires a non-empty reason.`);
+  }
+  if (tool.name === 'securenow_allowlist_add' && args.allowlistDenyAllApproved !== true) {
+    throw new Error('securenow_allowlist_add is deny-by-default: it blocks every non-listed IP for the scoped app/environment. Pass allowlistDenyAllApproved:true only after explicit human approval. Use securenow_trusted_add for trusted IPs or false positives.');
+  }
+}
+
+function buildApiRequest(tool, rawArgs = {}) {
+  const args = { ...rawArgs };
+  let endpoint = tool.endpoint;
+
+  for (const key of tool.pathParams || []) {
+    if (args[key] == null || args[key] === '') throw new Error(`Missing required argument: ${key}`);
+    endpoint = endpoint.replace(`:${key}`, encodeURIComponent(String(args[key])));
+  }
+
+  const query = { ...(tool.fixedQuery || {}) };
+  for (const key of tool.queryFields || []) {
+    let value = args[key];
+    if (tool.normalize && typeof tool.normalize[key] === 'function') {
+      value = tool.normalize[key](value);
+    }
+    if (value != null && value !== '') query[key] = value;
+  }
+
+  const body = { ...(tool.fixedBody || {}) };
+  for (const key of tool.bodyFields || []) {
+    let value = args[key];
+    if (tool.normalize && typeof tool.normalize[key] === 'function') {
+      value = tool.normalize[key](value);
+    }
+    if (value != null && value !== '') body[key] = value;
+  }
+
+  if (tool.reasonAsNote && !body.note && args.reason) {
+    body.note = args.reason;
+  }
+  if (tool.reasonInResult && args.reason) {
+    body.result = {
+      ...(body.result && typeof body.result === 'object' ? body.result : {}),
+      reason: args.reason,
+    };
+  }
+
+  return {
+    method: tool.method,
+    endpoint,
+    query,
+    body: Object.keys(body).length > 0 ? body : null,
+  };
+}
+
+function readStaticResource(resource) {
+  const filepath = path.resolve(__dirname, resource.file);
+  return fs.readFileSync(filepath, 'utf8');
+}
+
+function resourceContent(resource, dynamicHandlers = {}) {
+  if (resource.file) return readStaticResource(resource);
+  if (resource.dynamic && dynamicHandlers[resource.dynamic]) {
+    return dynamicHandlers[resource.dynamic]();
+  }
+  throw new Error(`Resource is not readable: ${resource.uri}`);
+}
+
+module.exports = {
+  TOOLS,
+  RESOURCES,
+  PROMPTS,
+  TEXT,
+  JSON_MIME,
+  MARKDOWN,
+  getTool,
+  mcpToolDefinition,
+  listTools,
+  listResources,
+  listPrompts,
+  promptMessages,
+  assertConfirmed,
+  buildApiRequest,
+  resourceContent,
+  jsonText,
+  maskSecret,
+  sanitizeArgs,
+};