zitadel-mcp-server 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Jeff Takle
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,127 @@
+# Zitadel MCP Server
+
+An [MCP (Model Context Protocol)](https://modelcontextprotocol.io/) server for [Zitadel](https://zitadel.com/) identity management. Manage users, projects, applications, roles, and service accounts through natural language from AI tools like Claude Code.
+
+> *"Create a user for jane@example.com, assign her the app:finance role, and give me the auth config."*
+> — That's three tool calls the AI handles for you.
+
+## Tools (25)
+
+| Category | Tool | Description |
+|----------|------|-------------|
+| **Users** | `zitadel_list_users` | List/search users |
+| | `zitadel_get_user` | Get user details |
+| | `zitadel_create_user` | Create user (sends invite email) |
+| | `zitadel_deactivate_user` | Deactivate user |
+| | `zitadel_reactivate_user` | Reactivate user |
+| **Projects** | `zitadel_list_projects` | List projects |
+| | `zitadel_get_project` | Get project details |
+| | `zitadel_create_project` | Create project |
+| **Applications** | `zitadel_list_apps` | List apps in a project |
+| | `zitadel_get_app` | Get app details + Client ID |
+| | `zitadel_create_oidc_app` | Create OIDC application |
+| | `zitadel_update_app` | Update app (redirect URIs, etc.) |
+| **Roles** | `zitadel_list_project_roles` | List roles in a project |
+| | `zitadel_create_project_role` | Create a role (e.g., `app:finance`) |
+| | `zitadel_list_user_grants` | List user's role grants |
+| | `zitadel_create_user_grant` | Assign roles to user |
+| | `zitadel_remove_user_grant` | Remove role grant |
+| **Service Accounts** | `zitadel_create_service_user` | Create machine user |
+| | `zitadel_create_service_user_key` | Generate key pair |
+| | `zitadel_list_service_user_keys` | List keys (metadata only) |
+| **Organizations** | `zitadel_get_org` | Get current org details |
+| | `zitadel_list_orgs` | List organizations |
+| **Utility** | `zitadel_get_auth_config` | Get .env.local template for an app |
+| **Portal** | `portal_register_app` | Register app in portal DB |
+| | `portal_setup_full_app` | One-click: Zitadel + portal setup |
+
+Portal tools (`portal_*`) are only available when `PORTAL_DATABASE_URL` is configured.
+
+## Prerequisites
+
+1. A Zitadel instance (Cloud or self-hosted)
+2. A service account with **Org Owner** or **IAM Admin** role
+3. A JSON key for the service account
+
+### Creating a Service Account
+
+1. In the Zitadel Console, go to **Users** > **Service Users** > **New**
+2. Give it a name (e.g., `mcp-admin`) and select **Bearer** token type
+3. Go to the service user's **Keys** tab > **New** > **JSON**
+4. Save the downloaded key file — you'll need the `userId`, `keyId`, and base64-encoded `key`
+5. Grant the service account the **Org Owner** role under **Organization** > **Authorizations**
+
+## Setup
+
+```bash
+git clone https://github.com/takleb3rry/zitadel-mcp.git
+cd zitadel-mcp
+npm install
+npm run build
+```
+
+## Configuration
+
+Add the server to your MCP client config. The JSON block below works for both options:
+
+- **Global** (all projects): `~/.claude.json` under the `"mcpServers"` key
+- **Per-project**: `.mcp.json` in the project root
+
+```json
+{
+  "mcpServers": {
+    "zitadel": {
+      "command": "node",
+      "args": ["/path/to/zitadel-mcp/build/index.js"],
+      "env": {
+        "ZITADEL_ISSUER": "https://your-instance.zitadel.cloud",
+        "ZITADEL_SERVICE_ACCOUNT_USER_ID": "...",
+        "ZITADEL_SERVICE_ACCOUNT_KEY_ID": "...",
+        "ZITADEL_SERVICE_ACCOUNT_PRIVATE_KEY": "...",
+        "ZITADEL_ORG_ID": "...",
+        "ZITADEL_PROJECT_ID": "..."
+      }
+    }
+  }
+}
+```
+
+Restart Claude Code after adding the config. The Zitadel tools will appear automatically.
+
+### Environment Variables
+
+| Variable | Required | Description |
+|----------|----------|-------------|
+| `ZITADEL_ISSUER` | Yes | Zitadel instance URL |
+| `ZITADEL_SERVICE_ACCOUNT_USER_ID` | Yes | Service account user ID |
+| `ZITADEL_SERVICE_ACCOUNT_KEY_ID` | Yes | Key ID from the JSON key file |
+| `ZITADEL_SERVICE_ACCOUNT_PRIVATE_KEY` | Yes | Base64-encoded RSA private key (the `key` field from the downloaded JSON) |
+| `ZITADEL_ORG_ID` | Yes | Organization ID |
+| `ZITADEL_PROJECT_ID` | No | Default project ID for role operations |
+| `PORTAL_DATABASE_URL` | No | Postgres connection string (enables portal tools) |
+| `LOG_LEVEL` | No | `DEBUG`, `INFO`, `WARN`, `ERROR` (default: `INFO`) |
+
+## Security
+
+**This server has admin-level access to your Zitadel instance.** Understand what that means before using it:
+
+- The service account needs **Org Owner** (or **IAM Admin** for `zitadel_list_orgs`). It can create users, modify roles, and manage applications in your organization.
+- When you create an OIDC app (`zitadel_create_oidc_app`), the **client secret** is returned in the tool response. It is only available at creation time. The AI assistant (and its conversation history) will see it — save it immediately and treat it as sensitive.
+- When you generate a service account key (`zitadel_create_service_user_key`), the **full private key** is returned in the tool response. Same caveat: save it, and be aware it's visible in your MCP client's conversation.
+- All tool arguments containing PII (email, name, URLs) are **redacted from debug logs**. IDs and tool names are still logged.
+- All Zitadel IDs are validated against an alphanumeric format before being used in API paths.
+
+> **Note for new users:** I've scanned all source files in this repo and found nothing notable, but I always recommend you have your own AI or tooling audit the code before installing any MCP server that gets access to your infrastructure. The full source is ~800 lines of TypeScript — a quick review shouldn't take long.
+
+## Development
+
+```bash
+npm run dev    # Run with tsx (hot reload)
+npm run build  # Compile TypeScript
+npm start      # Run compiled version
+npm test       # Run tests
+```
+
+## License
+
+MIT

package/build/auth/client.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Zitadel Management API Client
+ * JWT bearer token authentication via service account
+ *
+ * Ported from app-portal's Zitadel client with class-based config injection
+ */
+import type { ZitadelConfig } from '../utils/config.js';
+export declare class ZitadelClient {
+    private config;
+    private cachedToken;
+    constructor(config: ZitadelConfig);
+    getConfig(): ZitadelConfig;
+    clearTokenCache(): void;
+    /**
+     * Generate a JWT assertion for the service account
+     * Zitadel provides keys in PKCS#1 format; jose expects PKCS#8
+     */
+    private generateJwtAssertion;
+    /**
+     * Exchange JWT assertion for an access token (cached for ~1 hour)
+     */
+    private getAccessToken;
+    /**
+     * Make an authenticated request to the Zitadel Management API
+     * Includes x-zitadel-orgid header, handles 401 cache clearing and empty responses
+     */
+    request<T>(path: string, options?: RequestInit): Promise<T>;
+}

package/build/auth/client.js

@@ -0,0 +1,125 @@
+/**
+ * Zitadel Management API Client
+ * JWT bearer token authentication via service account
+ *
+ * Ported from app-portal's Zitadel client with class-based config injection
+ */
+import { SignJWT, importPKCS8 } from 'jose';
+import { createPrivateKey } from 'crypto';
+import { logger } from '../utils/logger.js';
+export class ZitadelClient {
+    config;
+    cachedToken = null;
+    constructor(config) {
+        this.config = config;
+    }
+    getConfig() {
+        return this.config;
+    }
+    clearTokenCache() {
+        this.cachedToken = null;
+    }
+    /**
+     * Generate a JWT assertion for the service account
+     * Zitadel provides keys in PKCS#1 format; jose expects PKCS#8
+     */
+    async generateJwtAssertion() {
+        const { serviceAccountUserId, serviceAccountKeyId, serviceAccountPrivateKey, issuer } = this.config;
+        // Decode the base64-encoded private key
+        let privateKeyPem;
+        try {
+            privateKeyPem = Buffer.from(serviceAccountPrivateKey, 'base64').toString('utf-8');
+        }
+        catch {
+            privateKeyPem = serviceAccountPrivateKey;
+        }
+        // Convert PKCS#1 to PKCS#8 if needed
+        let pkcs8Pem;
+        if (privateKeyPem.includes('BEGIN RSA PRIVATE KEY')) {
+            const keyObject = createPrivateKey(privateKeyPem);
+            pkcs8Pem = keyObject.export({ type: 'pkcs8', format: 'pem' });
+        }
+        else {
+            pkcs8Pem = privateKeyPem;
+        }
+        const privateKey = await importPKCS8(pkcs8Pem, 'RS256');
+        const now = Math.floor(Date.now() / 1000);
+        return new SignJWT({})
+            .setProtectedHeader({ alg: 'RS256', kid: serviceAccountKeyId })
+            .setIssuedAt(now)
+            .setExpirationTime(now + 3600)
+            .setIssuer(serviceAccountUserId)
+            .setSubject(serviceAccountUserId)
+            .setAudience(issuer)
+            .sign(privateKey);
+    }
+    /**
+     * Exchange JWT assertion for an access token (cached for ~1 hour)
+     */
+    async getAccessToken() {
+        // Return cached token if still valid (with 60s safety buffer)
+        if (this.cachedToken && Date.now() < this.cachedToken.expiresAt - 60000) {
+            return this.cachedToken.token;
+        }
+        const jwtAssertion = await this.generateJwtAssertion();
+        const tokenUrl = `${this.config.issuer}/oauth/v2/token`;
+        const response = await fetch(tokenUrl, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({
+                grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',
+                assertion: jwtAssertion,
+                scope: 'openid urn:zitadel:iam:org:project:id:zitadel:aud',
+            }),
+        });
+        if (!response.ok) {
+            const errorText = await response.text();
+            logger.error('Token exchange failed', { status: response.status, error: errorText });
+            throw new Error(`Failed to get access token: ${response.status} ${errorText}`);
+        }
+        const data = await response.json();
+        this.cachedToken = {
+            token: data.access_token,
+            expiresAt: Date.now() + (data.expires_in || 3600) * 1000,
+        };
+        return data.access_token;
+    }
+    /**
+     * Make an authenticated request to the Zitadel Management API
+     * Includes x-zitadel-orgid header, handles 401 cache clearing and empty responses
+     */
+    async request(path, options = {}) {
+        const token = await this.getAccessToken();
+        const url = `${this.config.issuer}${path}`;
+        const headers = {
+            Authorization: `Bearer ${token}`,
+            'Content-Type': 'application/json',
+            'x-zitadel-orgid': this.config.orgId,
+            ...(options.headers || {}),
+        };
+        const response = await fetch(url, { ...options, headers });
+        if (!response.ok) {
+            let errorData = null;
+            try {
+                errorData = await response.json();
+            }
+            catch {
+                // Ignore JSON parse errors
+            }
+            const errorMessage = errorData?.message || `HTTP ${response.status}`;
+            logger.error('Zitadel API error', { status: response.status, path, error: errorData });
+            // Clear token cache on auth failures
+            if (response.status === 401) {
+                this.clearTokenCache();
+            }
+            throw new Error(`Zitadel API error: ${errorMessage}`);
+        }
+        // Handle empty responses (e.g. DELETE operations)
+        const text = await response.text();
+        if (!text) {
+            return {};
+        }
+        return JSON.parse(text);
+    }
+}
+//# sourceMappingURL=client.js.map

package/build/auth/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/auth/client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAG1C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,MAAM,OAAO,aAAa;IAChB,MAAM,CAAgB;IACtB,WAAW,GAAgD,IAAI,CAAC;IAExE,YAAY,MAAqB;QAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,eAAe;QACb,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,oBAAoB;QAChC,MAAM,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QAEpG,wCAAwC;QACxC,IAAI,aAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACpF,CAAC;QAAC,MAAM,CAAC;YACP,aAAa,GAAG,wBAAwB,CAAC;QAC3C,CAAC;QAED,qCAAqC;QACrC,IAAI,QAAgB,CAAC;QACrB,IAAI,aAAa,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;YACpD,MAAM,SAAS,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;YAClD,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;QAC1E,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,aAAa,CAAC;QAC3B,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAE1C,OAAO,IAAI,OAAO,CAAC,EAAE,CAAC;aACnB,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,mBAAmB,EAAE,CAAC;aAC9D,WAAW,CAAC,GAAG,CAAC;aAChB,iBAAiB,CAAC,GAAG,GAAG,IAAI,CAAC;aAC7B,SAAS,CAAC,oBAAoB,CAAC;aAC/B,UAAU,CAAC,oBAAoB,CAAC;aAChC,WAAW,CAAC,MAAM,CAAC;aACnB,IAAI,CAAC,UAAU,CAAC,CAAC;IACtB,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,cAAc;QAC1B,8DAA8D;QAC9D,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,GAAG,KAAK,EAAE,CAAC;YACxE,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;QAChC,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACvD,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,iBAAiB,CAAC;QAExD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,6CAA6C;gBACzD,SAAS,EAAE,YAAY;gBACvB,KAAK,EAAE,mDAAmD;aAC3D,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;YACrF,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAmD,CAAC;QAEpF,IAAI,CAAC,WAAW,GAAG;YACjB,KAAK,EAAE,IAAI,CAAC,YAAY;YACxB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI;SACzD,CAAC;QAEF,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAI,IAAY,EAAE,UAAuB,EAAE;QACtD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;QAE3C,MAAM,OAAO,GAA2B;YACtC,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,cAAc,EAAE,kBAAkB;YAClC,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK;YACpC,GAAG,CAAC,OAAO,CAAC,OAAiC,IAAI,EAAE,CAAC;SACrD,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAE3D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,SAAS,GAAwB,IAAI,CAAC;YAC1C,IAAI,CAAC;gBACH,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAkB,CAAC;YACpD,CAAC;YAAC,MAAM,CAAC;gBACP,2BAA2B;YAC7B,CAAC;YAED,MAAM,YAAY,GAAG,SAAS,EAAE,OAAO,IAAI,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;YACrE,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;YAEvF,qCAAqC;YACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,CAAC;YAED,MAAM,IAAI,KAAK,CAAC,sBAAsB,YAAY,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,kDAAkD;QAClD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,EAAO,CAAC;QACjB,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC;CACF"}

package/build/index.d.ts

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+/**
+ * Zitadel MCP Server
+ * Manage users, projects, apps, roles, and service accounts via the Model Context Protocol
+ */
+import 'dotenv/config';

package/build/index.js

@@ -0,0 +1,81 @@
+#!/usr/bin/env node
+/**
+ * Zitadel MCP Server
+ * Manage users, projects, apps, roles, and service accounts via the Model Context Protocol
+ */
+import 'dotenv/config';
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { ListToolsRequestSchema, CallToolRequestSchema } from '@modelcontextprotocol/sdk/types.js';
+import { loadConfig } from './utils/config.js';
+import { ZitadelClient } from './auth/client.js';
+import { getTools, getHandlers } from './tools/index.js';
+import { logger } from './utils/logger.js';
+import { setupErrorHandlers } from './utils/error-handler.js';
+async function main() {
+    setupErrorHandlers();
+    logger.info('Starting Zitadel MCP Server...');
+    // Load and validate configuration
+    const config = loadConfig();
+    const client = new ZitadelClient(config);
+    const ctx = { client, config };
+    // Get tools and handlers (portal tools included conditionally)
+    const tools = getTools(config);
+    const handlers = getHandlers(config);
+    const server = new Server({ name: 'zitadel-mcp-server', version: '1.0.0' }, { capabilities: { tools: {} } });
+    // List tools — strip internal _meta before returning
+    server.setRequestHandler(ListToolsRequestSchema, async () => {
+        const sanitizedTools = tools.map(({ _meta, ...rest }) => rest);
+        return { tools: sanitizedTools };
+    });
+    // Fields that should never appear in debug logs
+    const REDACTED_FIELDS = new Set([
+        'email', 'firstName', 'lastName', 'userName',
+        'redirectUris', 'postLogoutRedirectUris',
+        'appUrl', 'iconUrl',
+    ]);
+    function redactArgs(args) {
+        const safe = {};
+        for (const [key, value] of Object.entries(args)) {
+            safe[key] = REDACTED_FIELDS.has(key) ? '[REDACTED]' : value;
+        }
+        return safe;
+    }
+    // Call tool
+    server.setRequestHandler(CallToolRequestSchema, async (request) => {
+        const toolName = request.params.name;
+        const rawArgs = (request.params.arguments ?? {});
+        logger.debug(`Tool call: ${toolName}`, { args: redactArgs(rawArgs) });
+        try {
+            const handler = handlers[toolName];
+            if (!handler) {
+                return {
+                    content: [{ type: 'text', text: `Unknown tool: ${toolName}` }],
+                    isError: true,
+                };
+            }
+            const result = await handler(rawArgs, ctx);
+            return { content: result.content, isError: result.isError || false };
+        }
+        catch (error) {
+            logger.error(`Error in ${toolName}`, { error: error instanceof Error ? error.message : error });
+            return {
+                content: [{ type: 'text', text: `Error: ${error instanceof Error ? error.message : String(error)}` }],
+                isError: true,
+            };
+        }
+    });
+    // Connect to stdio transport
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    const portalStatus = config.portalDatabaseUrl ? ' (portal extension enabled)' : '';
+    logger.info(`Zitadel MCP Server running with ${tools.length} tools${portalStatus}`);
+}
+// Graceful shutdown
+process.on('SIGINT', () => process.exit(0));
+process.on('SIGTERM', () => process.exit(0));
+main().catch((error) => {
+    logger.error('Fatal error', { error: error instanceof Error ? error.message : error });
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;GAGG;AAEH,OAAO,eAAe,CAAC;AACvB,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AACnG,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAG9D,KAAK,UAAU,IAAI;IACjB,kBAAkB,EAAE,CAAC;IACrB,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAE9C,kCAAkC;IAClC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,GAAG,GAAmB,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAE/C,+DAA+D;IAC/D,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAErC,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,OAAO,EAAE,EAChD,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;IAEF,qDAAqD;IACrD,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,cAAc,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QAC/D,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,gDAAgD;IAChD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;QAC9B,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU;QAC5C,cAAc,EAAE,wBAAwB;QACxC,QAAQ,EAAE,SAAS;KACpB,CAAC,CAAC;IAEH,SAAS,UAAU,CAAC,IAA6B;QAC/C,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC;QAC9D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,YAAY;IACZ,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;QACrC,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAA4B,CAAC;QAC5E,MAAM,CAAC,KAAK,CAAC,cAAc,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAEtE,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACnC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,iBAAiB,QAAQ,EAAE,EAAE,CAAC;oBACvE,OAAO,EAAE,IAAI;iBACd,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,KAAK,EAAE,CAAC;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,YAAY,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YAChG,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBAC9G,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,6BAA6B;IAC7B,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,MAAM,YAAY,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,EAAE,CAAC;IACnF,MAAM,CAAC,IAAI,CAAC,mCAAmC,KAAK,CAAC,MAAM,SAAS,YAAY,EAAE,CAAC,CAAC;AACtF,CAAC;AAED,oBAAoB;AACpB,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAE7C,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACvF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/build/tools/applications.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Application management tools (4 tools)
+ * OIDC app CRUD via Zitadel Management API v1
+ */
+import type { ToolDefinition, ToolHandler } from '../types/tools.js';
+export declare const APPLICATION_TOOLS: ToolDefinition[];
+export declare const APPLICATION_HANDLERS: Record<string, ToolHandler>;

package/build/tools/applications.js

@@ -0,0 +1,189 @@
+/**
+ * Application management tools (4 tools)
+ * OIDC app CRUD via Zitadel Management API v1
+ */
+import { z } from 'zod';
+import { textResponse, zitadelId } from '../types/tools.js';
+import { logger } from '../utils/logger.js';
+// ─── Tool Definitions ───────────────────────────────────────────────────────
+export const APPLICATION_TOOLS = [
+    {
+        name: 'zitadel_list_apps',
+        description: 'List all applications in a Zitadel project.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                projectId: { type: 'string', description: 'The project ID to list apps for' },
+            },
+            required: ['projectId'],
+        },
+        _meta: { readOnly: true, domain: 'applications' },
+        annotations: { title: 'List Apps', readOnlyHint: true, destructiveHint: false, idempotentHint: true },
+    },
+    {
+        name: 'zitadel_get_app',
+        description: 'Get details of a specific application including its Client ID and OIDC configuration.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                projectId: { type: 'string', description: 'The project ID' },
+                appId: { type: 'string', description: 'The application ID' },
+            },
+            required: ['projectId', 'appId'],
+        },
+        _meta: { readOnly: true, domain: 'applications' },
+        annotations: { title: 'Get App', readOnlyHint: true, destructiveHint: false, idempotentHint: true },
+    },
+    {
+        name: 'zitadel_create_oidc_app',
+        description: 'Create a new OIDC application in a Zitadel project. Returns the Client ID (and Client Secret for confidential clients). Configure redirect URIs, response types, and grant types.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                projectId: { type: 'string', description: 'The project ID to create the app in' },
+                name: { type: 'string', description: 'Application name' },
+                redirectUris: {
+                    type: 'array',
+                    items: { type: 'string' },
+                    description: 'OAuth redirect URIs (e.g., ["https://myapp.example.com/api/auth/callback/zitadel"])',
+                },
+                postLogoutRedirectUris: {
+                    type: 'array',
+                    items: { type: 'string' },
+                    description: 'Post-logout redirect URIs (optional)',
+                },
+                appType: {
+                    type: 'string',
+                    enum: ['OIDC_APP_TYPE_WEB', 'OIDC_APP_TYPE_USER_AGENT', 'OIDC_APP_TYPE_NATIVE'],
+                    description: 'Application type (default: OIDC_APP_TYPE_WEB)',
+                },
+                authMethodType: {
+                    type: 'string',
+                    enum: ['OIDC_AUTH_METHOD_TYPE_BASIC', 'OIDC_AUTH_METHOD_TYPE_POST', 'OIDC_AUTH_METHOD_TYPE_NONE', 'OIDC_AUTH_METHOD_TYPE_PRIVATE_KEY_JWT'],
+                    description: 'Auth method. Use NONE for PKCE public clients (default: OIDC_AUTH_METHOD_TYPE_NONE)',
+                },
+                devMode: {
+                    type: 'boolean',
+                    description: 'Enable dev mode to allow http:// redirect URIs (default: false)',
+                },
+            },
+            required: ['projectId', 'name', 'redirectUris'],
+        },
+        _meta: { readOnly: false, domain: 'applications' },
+        annotations: { title: 'Create OIDC App', readOnlyHint: false, destructiveHint: false, idempotentHint: false },
+    },
+    {
+        name: 'zitadel_update_app',
+        description: 'Update an OIDC application\'s configuration (redirect URIs, auth method, etc.).',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                projectId: { type: 'string', description: 'The project ID' },
+                appId: { type: 'string', description: 'The application ID to update' },
+                redirectUris: { type: 'array', items: { type: 'string' }, description: 'Updated redirect URIs' },
+                postLogoutRedirectUris: { type: 'array', items: { type: 'string' }, description: 'Updated post-logout URIs' },
+                devMode: { type: 'boolean', description: 'Enable/disable dev mode' },
+            },
+            required: ['projectId', 'appId'],
+        },
+        _meta: { readOnly: false, domain: 'applications' },
+        annotations: { title: 'Update App', readOnlyHint: false, destructiveHint: false, idempotentHint: true },
+    },
+];
+// ─── Handlers ────────────────────────────────────────────────────────────────
+function formatApp(a) {
+    const state = a.state?.replace('APP_STATE_', '') || 'UNKNOWN';
+    const clientId = a.oidcConfig?.clientId || 'N/A';
+    return `- ${a.name} [${state}] Client ID: ${clientId} | App ID: ${a.id}`;
+}
+const listAppsHandler = async (params, ctx) => {
+    const { projectId } = z.object({ projectId: zitadelId('projectId') }).parse(params);
+    const response = await ctx.client.request(`/management/v1/projects/${projectId}/apps/_search`, {
+        method: 'POST',
+        body: JSON.stringify({ query: { offset: '0', limit: 100 } }),
+    });
+    const apps = response.result || [];
+    if (apps.length === 0) {
+        return textResponse('No applications found in this project.');
+    }
+    const lines = apps.map(formatApp);
+    return textResponse(`Found ${apps.length} application(s):\n\n${lines.join('\n')}`);
+};
+const getAppHandler = async (params, ctx) => {
+    const input = z.object({
+        projectId: zitadelId('projectId'),
+        appId: zitadelId('appId'),
+    }).parse(params);
+    const app = await ctx.client.request(`/management/v1/projects/${input.projectId}/apps/${input.appId}`);
+    const lines = [
+        `Application: ${app.name}`,
+        `App ID: ${app.id}`,
+        `State: ${app.state?.replace('APP_STATE_', '') || 'UNKNOWN'}`,
+    ];
+    if (app.oidcConfig) {
+        const oidc = app.oidcConfig;
+        lines.push(`Client ID: ${oidc.clientId}`, `App Type: ${oidc.appType}`, `Auth Method: ${oidc.authMethodType}`, `Redirect URIs: ${(oidc.redirectUris || []).join(', ') || 'none'}`, `Post-Logout URIs: ${(oidc.postLogoutRedirectUris || []).join(', ') || 'none'}`, `Response Types: ${(oidc.responseTypes || []).join(', ')}`, `Grant Types: ${(oidc.grantTypes || []).join(', ')}`, `Dev Mode: ${oidc.devMode ?? false}`);
+    }
+    lines.push(`Created: ${app.details?.creationDate || 'N/A'}`);
+    return textResponse(lines.join('\n'));
+};
+const createOIDCAppHandler = async (params, ctx) => {
+    const input = z.object({
+        projectId: zitadelId('projectId'),
+        name: z.string().min(1),
+        redirectUris: z.array(z.string().url()).min(1),
+        postLogoutRedirectUris: z.array(z.string().url()).optional(),
+        appType: z.string().default('OIDC_APP_TYPE_WEB'),
+        authMethodType: z.string().default('OIDC_AUTH_METHOD_TYPE_NONE'),
+        devMode: z.boolean().default(false),
+    }).parse(params);
+    logger.info('Creating OIDC app', { name: input.name, projectId: input.projectId });
+    const response = await ctx.client.request(`/management/v1/projects/${input.projectId}/apps/oidc`, {
+        method: 'POST',
+        body: JSON.stringify({
+            name: input.name,
+            redirectUris: input.redirectUris,
+            responseTypes: ['OIDC_RESPONSE_TYPE_CODE'],
+            grantTypes: ['OIDC_GRANT_TYPE_AUTHORIZATION_CODE'],
+            appType: input.appType,
+            authMethodType: input.authMethodType,
+            postLogoutRedirectUris: input.postLogoutRedirectUris,
+            devMode: input.devMode,
+        }),
+    });
+    const lines = [
+        `OIDC Application created successfully.`,
+        `App ID: ${response.appId}`,
+        `Client ID: ${response.clientId}`,
+    ];
+    if (response.clientSecret) {
+        lines.push(`Client Secret: ${response.clientSecret}`, ``, `WARNING: Save the Client Secret now — it cannot be retrieved again.`);
+    }
+    return textResponse(lines.join('\n'));
+};
+const updateAppHandler = async (params, ctx) => {
+    const input = z.object({
+        projectId: zitadelId('projectId'),
+        appId: zitadelId('appId'),
+        redirectUris: z.array(z.string()).optional(),
+        postLogoutRedirectUris: z.array(z.string()).optional(),
+        devMode: z.boolean().optional(),
+    }).parse(params);
+    const body = {};
+    if (input.redirectUris)
+        body['redirectUris'] = input.redirectUris;
+    if (input.postLogoutRedirectUris)
+        body['postLogoutRedirectUris'] = input.postLogoutRedirectUris;
+    if (input.devMode !== undefined)
+        body['devMode'] = input.devMode;
+    await ctx.client.request(`/management/v1/projects/${input.projectId}/apps/${input.appId}/oidc`, { method: 'PUT', body: JSON.stringify(body) });
+    return textResponse(`Application ${input.appId} updated successfully.`);
+};
+// ─── Export ──────────────────────────────────────────────────────────────────
+export const APPLICATION_HANDLERS = {
+    zitadel_list_apps: listAppsHandler,
+    zitadel_get_app: getAppHandler,
+    zitadel_create_oidc_app: createOIDCAppHandler,
+    zitadel_update_app: updateAppHandler,
+};
+//# sourceMappingURL=applications.js.map

package/build/tools/applications.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"applications.js","sourceRoot":"","sources":["../../src/tools/applications.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE5D,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,+EAA+E;AAE/E,MAAM,CAAC,MAAM,iBAAiB,GAAqB;IACjD;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,6CAA6C;QAC1D,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,iCAAiC,EAAE;aAC9E;YACD,QAAQ,EAAE,CAAC,WAAW,CAAC;SACxB;QACD,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE;QACjD,WAAW,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE;KACtG;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,uFAAuF;QACpG,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,gBAAgB,EAAE;gBAC5D,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE;aAC7D;YACD,QAAQ,EAAE,CAAC,WAAW,EAAE,OAAO,CAAC;SACjC;QACD,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE;QACjD,WAAW,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE;KACpG;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EAAE,mLAAmL;QAChM,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,qCAAqC,EAAE;gBACjF,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kBAAkB,EAAE;gBACzD,YAAY,EAAE;oBACZ,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACzB,WAAW,EAAE,qFAAqF;iBACnG;gBACD,sBAAsB,EAAE;oBACtB,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACzB,WAAW,EAAE,sCAAsC;iBACpD;gBACD,OAAO,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,mBAAmB,EAAE,0BAA0B,EAAE,sBAAsB,CAAC;oBAC/E,WAAW,EAAE,+CAA+C;iBAC7D;gBACD,cAAc,EAAE;oBACd,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,6BAA6B,EAAE,4BAA4B,EAAE,4BAA4B,EAAE,uCAAuC,CAAC;oBAC1I,WAAW,EAAE,qFAAqF;iBACnG;gBACD,OAAO,EAAE;oBACP,IAAI,EAAE,SAAS;oBACf,WAAW,EAAE,iEAAiE;iBAC/E;aACF;YACD,QAAQ,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,CAAC;SAChD;QACD,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE;QAClD,WAAW,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE;KAC9G;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EAAE,iFAAiF;QAC9F,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,gBAAgB,EAAE;gBAC5D,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,8BAA8B,EAAE;gBACtE,YAAY,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,uBAAuB,EAAE;gBAChG,sBAAsB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,0BAA0B,EAAE;gBAC7G,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,yBAAyB,EAAE;aACrE;YACD,QAAQ,EAAE,CAAC,WAAW,EAAE,OAAO,CAAC;SACjC;QACD,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE;QAClD,WAAW,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE;KACxG;CACF,CAAC;AAEF,gFAAgF;AAEhF,SAAS,SAAS,CAAC,CAAa;IAC9B,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;IAC9D,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,EAAE,QAAQ,IAAI,KAAK,CAAC;IACjD,OAAO,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,gBAAgB,QAAQ,cAAc,CAAC,CAAC,EAAE,EAAE,CAAC;AAC3E,CAAC;AAED,MAAM,eAAe,GAAgB,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;IACzD,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAEpF,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CACvC,2BAA2B,SAAS,eAAe,EACnD;QACE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;KAC7D,CACF,CAAC;IAEF,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;IACnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,YAAY,CAAC,wCAAwC,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAClC,OAAO,YAAY,CAAC,SAAS,IAAI,CAAC,MAAM,uBAAuB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACrF,CAAC,CAAC;AAEF,MAAM,aAAa,GAAgB,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;IACvD,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC;QACrB,SAAS,EAAE,SAAS,CAAC,WAAW,CAAC;QACjC,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC;KAC1B,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAEjB,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAClC,2BAA2B,KAAK,CAAC,SAAS,SAAS,KAAK,CAAC,KAAK,EAAE,CACjE,CAAC;IAEF,MAAM,KAAK,GAAG;QACZ,gBAAgB,GAAG,CAAC,IAAI,EAAE;QAC1B,WAAW,GAAG,CAAC,EAAE,EAAE;QACnB,UAAU,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,IAAI,SAAS,EAAE;KAC9D,CAAC;IAEF,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC;QAC5B,KAAK,CAAC,IAAI,CACR,cAAc,IAAI,CAAC,QAAQ,EAAE,EAC7B,aAAa,IAAI,CAAC,OAAO,EAAE,EAC3B,gBAAgB,IAAI,CAAC,cAAc,EAAE,EACrC,kBAAkB,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,EAClE,qBAAqB,CAAC,IAAI,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,EAC/E,mBAAmB,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC1D,gBAAgB,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACpD,aAAa,IAAI,CAAC,OAAO,IAAI,KAAK,EAAE,CACrC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,OAAO,EAAE,YAAY,IAAI,KAAK,EAAE,CAAC,CAAC;IAE7D,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACxC,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAgB,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;IAC9D,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC;QACrB,SAAS,EAAE,SAAS,CAAC,WAAW,CAAC;QACjC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC5D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,mBAAmB,CAAC;QAChD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,4BAA4B,CAAC;QAChE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KACpC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAEjB,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IAEnF,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CACvC,2BAA2B,KAAK,CAAC,SAAS,YAAY,EACtD;QACE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,aAAa,EAAE,CAAC,yBAAyB,CAAC;YAC1C,UAAU,EAAE,CAAC,oCAAoC,CAAC;YAClD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;YACpD,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;KACH,CACF,CAAC;IAEF,MAAM,KAAK,GAAG;QACZ,wCAAwC;QACxC,WAAW,QAAQ,CAAC,KAAK,EAAE;QAC3B,cAAc,QAAQ,CAAC,QAAQ,EAAE;KAClC,CAAC;IAEF,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CACR,kBAAkB,QAAQ,CAAC,YAAY,EAAE,EACzC,EAAE,EACF,qEAAqE,CACtE,CAAC;IACJ,CAAC;IAED,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACxC,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAgB,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;IAC1D,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC;QACrB,SAAS,EAAE,SAAS,CAAC,WAAW,CAAC;QACjC,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC;QACzB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC5C,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QACtD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAChC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAEjB,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,IAAI,KAAK,CAAC,YAAY;QAAE,IAAI,CAAC,cAAc,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC;IAClE,IAAI,KAAK,CAAC,sBAAsB;QAAE,IAAI,CAAC,wBAAwB,CAAC,GAAG,KAAK,CAAC,sBAAsB,CAAC;IAChG,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,IAAI,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;IAEjE,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CACtB,2BAA2B,KAAK,CAAC,SAAS,SAAS,KAAK,CAAC,KAAK,OAAO,EACrE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAC9C,CAAC;IAEF,OAAO,YAAY,CAAC,eAAe,KAAK,CAAC,KAAK,wBAAwB,CAAC,CAAC;AAC1E,CAAC,CAAC;AAEF,gFAAgF;AAEhF,MAAM,CAAC,MAAM,oBAAoB,GAAgC;IAC/D,iBAAiB,EAAE,eAAe;IAClC,eAAe,EAAE,aAAa;IAC9B,uBAAuB,EAAE,oBAAoB;IAC7C,kBAAkB,EAAE,gBAAgB;CACrC,CAAC"}

package/build/tools/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Tool registry — aggregates all tools and handlers
+ * Portal tools conditionally included based on config
+ */
+import type { ToolDefinition, ToolHandler } from '../types/tools.js';
+import type { ZitadelConfig } from '../utils/config.js';
+export declare function getTools(config: ZitadelConfig): ToolDefinition[];
+export declare function getHandlers(config: ZitadelConfig): Record<string, ToolHandler>;