feat: WIP initial work on API gateway

apps/api/src/db/schema/deployment.ts

@@ -2,7 +2,8 @@ import {
   agenticProjectConfigSchema,
   type OriginAdapter,
   type PricingPlanList,
-  type Tool
+  type Tool,
+  type ToolConfig
 } from '@agentic/platform-schemas'
 import { validators } from '@agentic/platform-validators'
 import { relations } from '@fisch0920/drizzle-orm'
@@ -74,23 +75,16 @@ export const deployments = pgTable(
         onDelete: 'cascade'
       }),
 
-    // TODO: Tool definitions
+    // Tool definitions exposed by the origin server
-    // tools: jsonb().$type<Tool[]>().default([]),
-
-    // TODO: metadata config (logo, keywords, examples, etc)
-    // TODO: webhooks
-    // TODO: third-party auth provider config
-    // NOTE: will need consumer.authProviders as well as user.authProviders for
-    // this because custom oauth credentials that are deployment-specific. will
-    // prolly also need to hash the individual AuthProviders in
-    // deployment.authProviders to compare across deployments.
-
     tools: jsonb().$type<Tool[]>().notNull(),
 
+    // Tool configs customize the behavior of tools for different pricing plans
+    toolConfigs: jsonb().$type<ToolConfig[]>().default([]).notNull(),
+
     // Origin API URL
     originUrl: text().notNull(),
 
-    // Origin API adapter config (openapi, mcp, hosted externally or internally, etc)
+    // Origin API adapter config (openapi, mcp, raw, hosting considerations, etc)
     originAdapter: jsonb().$type<OriginAdapter>().notNull(),
 
     // Array<PricingPlan>
@@ -99,7 +93,14 @@ export const deployments = pgTable(
     // Which pricing intervals are supported for subscriptions to this project
     pricingIntervals: pricingIntervalEnum().array().default(['month']).notNull()
 
-    // coupons: jsonb().$type<Coupon[]>().default([]).notNull()
+    // TODO: metadata config (logo, keywords, examples, etc)
+    // TODO: webhooks
+    // TODO: coupons
+    // TODO: third-party auth provider config
+    // NOTE: will need consumer.authProviders as well as user.authProviders for
+    // this because custom oauth credentials that are deployment-specific. will
+    // prolly also need to hash the individual AuthProviders in
+    // deployment.authProviders to compare across deployments.
   },
   (table) => [
     uniqueIndex('deployment_identifier_idx').on(table.identifier),
@@ -155,7 +156,9 @@ export const deploymentSelectSchema = createSelectSchema(deployments, {
   sourceUrl: agenticProjectConfigSchema.shape.sourceUrl,
   originAdapter: agenticProjectConfigSchema.shape.originAdapter,
   pricingPlans: agenticProjectConfigSchema.shape.pricingPlans,
-  pricingIntervals: agenticProjectConfigSchema.shape.pricingIntervals
+  pricingIntervals: agenticProjectConfigSchema.shape.pricingIntervals,
+  tools: agenticProjectConfigSchema.shape.toolConfigs,
+  toolConfigs: agenticProjectConfigSchema.shape.toolConfigs
 })
   .omit({
     originUrl: true

packages/cli/src/lib/resolve-deployment.ts

@@ -19,10 +19,13 @@ export async function resolveDeployment({
   if (!deploymentIdentifier) {
     const config = await loadAgenticConfig({ cwd })
 
-    // TODO: team support
+    // TODO: re-add team support
     const auth = AuthStore.getAuth()
     const namespace = auth.user.username
 
+    // TODO: resolve deploymentIdentifier; config name may include namespace?
+    // TODO: rename parseFaasIdentifier; movingn away from FaaS terminology
+
     deploymentIdentifier = `${namespace}/${config.name}@${fuzzyDeploymentIdentifierVersion}`
   }
 

packages/schemas/package.json

@@ -27,6 +27,7 @@
     "@agentic/platform-openapi": "workspace:*",
     "@agentic/platform-validators": "workspace:*",
     "@hono/zod-openapi": "catalog:",
+    "@modelcontextprotocol/sdk": "catalog:",
     "ms": "catalog:",
     "semver": "catalog:",
     "zod": "catalog:"

packages/schemas/src/agentic-project-config.ts

@@ -1,12 +1,15 @@
 import { z } from '@hono/zod-openapi'
 
-import { originAdapterSchema } from './origin-adapter'
+import {
+  originAdapterConfigSchema,
+  originAdapterSchema
+} from './origin-adapter'
 import {
   pricingIntervalListSchema,
   type PricingPlan,
   pricingPlanListSchema
 } from './pricing'
-import { toolConfigSchema } from './tools'
+import { toolConfigSchema, toolSchema } from './tools'
 
 // TODO:
 // - **service / tool definitions**
@@ -101,7 +104,7 @@ NOTE: Agentic currently only supports \`external\` API servers. If you'd like to
      * for how origin tools / services are defined: either as an OpenAPI spec,
      * an MCP server, or as a raw HTTP REST API.
      */
-    originAdapter: originAdapterSchema.optional().default({
+    originAdapter: originAdapterConfigSchema.optional().default({
       location: 'external',
       type: 'raw'
     }),
@@ -115,7 +118,7 @@ NOTE: Agentic currently only supports \`external\` API servers. If you'd like to
       .default([defaultFreePricingPlan]),
 
     /**
-     * Optional list of billing intervals to enable in the pricingPlans.
+     * Optional list of billing intervals to enable in pricing plans.
      *
      * Defaults to a single monthly interval `['month']`.
      *
@@ -163,7 +166,7 @@ To add support for annual pricing plans, for example, you can use: \`['month', '
      * `toolConfigs`, it will use the default behavior of the Agentic API
      * gateway.
      */
-    toolConfigs: z.array(toolConfigSchema).optional()
+    toolConfigs: z.array(toolConfigSchema).default([]).optional()
   })
   .strip()
 
@@ -171,3 +174,12 @@ export type AgenticProjectConfigInput = z.input<
   typeof agenticProjectConfigSchema
 >
 export type AgenticProjectConfig = z.output<typeof agenticProjectConfigSchema>
+
+export const resolvedAgenticProjectConfigSchema =
+  agenticProjectConfigSchema.extend({
+    originAdapter: originAdapterSchema,
+    tools: z.array(toolSchema).default([])
+  })
+export type ResolvedAgenticProjectConfig = z.output<
+  typeof resolvedAgenticProjectConfigSchema
+>

packages/schemas/src/index.ts

@@ -1,5 +1,6 @@
 export * from './agentic-project-config'
 export * from './define-config'
+export * from './mcp'
 export * from './origin-adapter'
 export * from './pricing'
 export * from './rate-limit'

packages/schemas/src/mcp.ts

@@ -0,0 +1,106 @@
+import { z } from '@hono/zod-openapi'
+
+/**
+ * Capabilities that a server may support.
+ *
+ * Known capabilities are defined here, in this schema, but this is not a
+ * closed set: any server can define its own, additional capabilities.
+ */
+export const mcpServerCapabilitiesSchema = z
+  .object({
+    /**
+     * Experimental, non-standard capabilities that the server supports.
+     */
+    experimental: z.optional(z.object({}).passthrough()),
+
+    /**
+     * Present if the server supports sending log messages to the client.
+     */
+    logging: z.optional(z.object({}).passthrough()),
+
+    /**
+     * Present if the server supports sending completions to the client.
+     */
+    completions: z.optional(z.object({}).passthrough()),
+
+    /**
+     * Present if the server offers any prompt templates.
+     */
+    prompts: z.optional(
+      z
+        .object({
+          /**
+           * Whether this server supports issuing notifications for changes to
+           * the prompt list.
+           */
+          listChanged: z.optional(z.boolean())
+        })
+        .passthrough()
+    ),
+
+    /**
+     * Present if the server offers any resources to read.
+     */
+    resources: z.optional(
+      z
+        .object({
+          /**
+           * Whether this server supports clients subscribing to resource updates.
+           */
+          subscribe: z.optional(z.boolean()),
+
+          /**
+           * Whether this server supports issuing notifications for changes to
+           * the resource list.
+           */
+          listChanged: z.optional(z.boolean())
+        })
+        .passthrough()
+    ),
+
+    /**
+     * Present if the server offers any tools to call.
+     */
+    tools: z.optional(
+      z
+        .object({
+          /**
+           * Whether this server supports issuing notifications for changes to
+           * the tool list.
+           */
+          listChanged: z.optional(z.boolean())
+        })
+        .passthrough()
+    )
+  })
+  .passthrough()
+
+/**
+ * After receiving an initialize request from the client, the server sends
+ * this response.
+ */
+export const mcpServerInfoSchema = z.object({
+  /**
+   * The name of the MCP server.
+   */
+  name: z.string(),
+
+  /**
+   * The version of the MCP server.
+   */
+  version: z.string(),
+
+  /**
+   * The advertised capabilities of the MCP server.
+   */
+  capabilities: mcpServerCapabilitiesSchema.optional(),
+
+  /**
+   * Instructions describing how to use the server and its features.
+   *
+   * This can be used by clients to improve the LLM's understanding of
+   * available tools, resources, etc. It can be thought of like a "hint" to the
+   * model. For example, this information MAY be added to the system prompt.
+   */
+  instructions: z.string().optional()
+})

packages/schemas/src/origin-adapter.ts

@@ -1,5 +1,7 @@
 import { z } from '@hono/zod-openapi'
 
+import { mcpServerInfoSchema } from './mcp'
+
 export const originAdapterLocationSchema = z.literal('external')
 // z.union([
 //   z.literal('external'),
@@ -31,59 +33,146 @@ export const commonOriginAdapterSchema = z.object({
 // - internal http
 // - etc
 
+export const openapiOriginAdapterConfigSchema = commonOriginAdapterSchema.merge(
+  z.object({
+    /**
+     * OpenAPI 3.x spec describing the origin API server.
+     */
+    type: z.literal('openapi'),
+
+    /**
+     * Local file path, URL, or JSON stringified OpenAPI spec describing the
+     * origin API server.
+     *
+     * Must be a 3.x OpenAPI spec (older versions are not supported).
+     */
+    spec: z
+      .string()
+      .describe(
+        'Local file path, URL, or JSON stringified OpenAPI spec describing the origin API server.'
+      )
+  })
+)
+
+export const mcpOriginAdapterConfigSchema = commonOriginAdapterSchema.merge(
+  z.object({
+    /**
+     * MCP server.
+     */
+    type: z.literal('mcp')
+  })
+)
+
+export const rawOriginAdapterConfigSchema = commonOriginAdapterSchema.merge(
+  z.object({
+    /**
+     * Marks the origin server as a raw HTTP REST API without any additional
+     * tool or service definitions.
+     *
+     * In this mode, Agentic's API gateway acts as a simple reverse-proxy
+     * to the origin server, without validating tools.
+     */
+    type: z.literal('raw')
+  })
+)
+
 /**
- * Origin API adapter is used to configure the origin API server downstream
+ * Origin adapter is used to configure the origin API server downstream from
- * from Agentic's API gateway. It specifies whether the origin API server
+ * Agentic's API gateway. It specifies whether the origin API server denoted
- * denoted by `originUrl` is hosted externally or deployed internally to
+ * by `originUrl` is hosted externally or deployed internally to Agentic's
- * Agentic's infrastructure. It also specifies the format for how origin tools
+ * infrastructure. It also specifies the format for how origin tools are
- * are defined: either as an OpenAPI spec, an MCP server, or as a raw HTTP
+ * defined: either an OpenAPI spec, an MCP server, or as a raw HTTP REST API.
- * REST API.
  *
  * NOTE: Agentic currently only supports `external` API servers. If you'd like
  * to host your API or MCP server on Agentic's infrastructure, please reach out
  * to support@agentic.so.
  */
-export const originAdapterSchema = z
+export const originAdapterConfigSchema = z
   .discriminatedUnion('type', [
-    z
+    openapiOriginAdapterConfigSchema,
-      .object({
-        /**
-         * OpenAPI 3.x spec describing the origin API server.
-         */
-        type: z.literal('openapi'),
 
-        /**
+    mcpOriginAdapterConfigSchema,
-         * JSON stringified OpenAPI spec describing the origin API server.
-         *
-         * The origin API servers are be hidden in the embedded OpenAPI spec,
-         * because clients should only be aware of the upstream Agentic API
-         * gateway.
-         */
-        spec: z
-          .string()
-          .describe(
-            'JSON stringified OpenAPI spec describing the origin API server.'
-          )
-      })
-      .merge(commonOriginAdapterSchema),
 
-    z
+    rawOriginAdapterConfigSchema
-      .object({
-        /**
-         * Marks the origin server as a raw HTTP REST API without any additional
-         * tool or service definitions.
-         *
-         * In this mode, Agentic's API gateway acts as a simple reverse-proxy
-         * to the origin server, without validating tools or services.
-         */
-        type: z.literal('raw')
-      })
-      .merge(commonOriginAdapterSchema)
   ])
   .describe(
-    `Deployment origin API adapter is used to configure the origin API server downstream from Agentic's API gateway. It specifies whether the origin API server denoted by \`originUrl\` is hosted externally or deployed internally to Agentic's infrastructure. It also specifies the format for how origin tools / services are defined: either as an OpenAPI spec, an MCP server, or as a raw HTTP REST API.
+    `Origin adapter is used to configure the origin API server downstream from Agentic's API gateway. It specifies whether the origin API server denoted by \`originUrl\` is hosted externally or deployed internally to Agentic's infrastructure. It also specifies the format for how origin tools are defined: either an OpenAPI spec, an MCP server, or a raw HTTP REST API.
 
 NOTE: Agentic currently only supports \`external\` API servers. If you'd like to host your API or MCP server on Agentic's infrastructure, please reach out to support@agentic.so.`
   )
+  .openapi('OriginAdapterConfig')
+export type OriginAdapterConfig = z.infer<typeof originAdapterConfigSchema>
+
+export const openapiOriginAdapterSchema = commonOriginAdapterSchema.merge(
+  z.object({
+    /**
+     * OpenAPI 3.x spec describing the origin API server.
+     */
+    type: z.literal('openapi'),
+
+    /**
+     * JSON stringified OpenAPI spec describing the origin API server.
+     *
+     * The origin API servers are be hidden in the embedded OpenAPI spec,
+     * because clients should only be aware of the upstream Agentic API
+     * gateway.
+     */
+    spec: z
+      .string()
+      .describe(
+        'JSON stringified OpenAPI spec describing the origin API server.'
+      )
+
+    // TODO: Mapping from tool names to OpenAPI operations, with all the info
+    // the Agentic API gateway needs to know at runtime (HTTP method, path,
+    // params, etc).
+  })
+)
+
+export const mcpOriginAdapterSchema = commonOriginAdapterSchema.merge(
+  z.object({
+    /**
+     * MCP server.
+     */
+    type: z.literal('mcp'),
+
+    /**
+     * MCP server info: name, version, capabilities, instructions, etc.
+     */
+    serverInfo: mcpServerInfoSchema
+  })
+)
+
+export const rawOriginAdapterSchema = commonOriginAdapterSchema.merge(
+  z.object({
+    /**
+     * Marks the origin server as a raw HTTP REST API without any additional
+     * tool or service definitions.
+     *
+     * In this mode, Agentic's API gateway acts as a simple reverse-proxy
+     * to the origin server, without validating tools.
+     */
+    type: z.literal('raw')
+  })
+)
+
+/**
+ * Origin adapter is used to configure the origin API server downstream from
+ * Agentic's API gateway. It specifies whether the origin API server denoted
+ * by `originUrl` is hosted externally or deployed internally to Agentic's
+ * infrastructure. It also specifies the format for how origin tools are
+ * defined: either an OpenAPI spec, an MCP server, or as a raw HTTP REST API.
+ */
+export const originAdapterSchema = z
+  .discriminatedUnion('type', [
+    openapiOriginAdapterSchema,
+
+    mcpOriginAdapterSchema,
+
+    rawOriginAdapterSchema
+  ])
+  .describe(
+    `Origin adapter is used to configure the origin API server downstream from Agentic's API gateway. It specifies whether the origin API server denoted by \`originUrl\` is hosted externally or deployed internally to Agentic's infrastructure. It also specifies the format for how origin tools are defined: either an OpenAPI spec, an MCP server, or a raw HTTP REST API.`
+  )
   .openapi('OriginAdapter')
 export type OriginAdapter = z.infer<typeof originAdapterSchema>

packages/schemas/src/tools.ts

@@ -9,115 +9,14 @@ export const toolNameSchema = z
   .regex(/^[a-zA-Z0-9_]+$/)
   .nonempty()
 
-/**
+export const jsonSchemaObjectSchema = z
- * Additional properties describing a Tool to clients.
- *
- * NOTE: All properties in ToolAnnotations are **hints**.
- *
- * They are not guaranteed to provide a faithful description of tool behavior
- * (including descriptive properties like `title`).
- *
- * Clients should never make tool use decisions based on ToolAnnotations
- * received from untrusted servers.
- */
-export const toolAnnotationsSchema = z
   .object({
-    /**
+    type: z.literal('object'),
-     * A human-readable title for the tool.
+    properties: z.object({}).passthrough().optional(),
-     */
+    required: z.array(z.string()).optional()
-    title: z.string().optional(),
-
-    /**
-     * If true, the tool does not modify its environment.
-     *
-     * Default: false
-     */
-    readOnlyHint: z.boolean().optional(),
-
-    /**
-     * If true, the tool may perform destructive updates to its environment.
-     * If false, the tool performs only additive updates.
-     *
-     * (This property is meaningful only when `readOnlyHint == false`)
-     *
-     * Default: true
-     */
-    destructiveHint: z.boolean().optional(),
-
-    /**
-     * If true, calling the tool repeatedly with the same arguments
-     * will have no additional effect on the its environment.
-     *
-     * (This property is meaningful only when `readOnlyHint == false`)
-     *
-     * Default: false
-     */
-    idempotentHint: z.boolean().optional(),
-
-    /**
-     * If true, this tool may interact with an "open world" of external
-     * entities. If false, the tool's domain of interaction is closed.
-     * For example, the world of a web search tool is open, whereas that
-     * of a memory tool is not.
-     *
-     * Default: true
-     */
-    openWorldHint: z.boolean().optional()
   })
   .passthrough()
-
+  .openapi('JsonSchemaObject')
-/**
- * Definition for an Agentic tool.
- */
-export const toolSchema = z
-  .object({
-    /**
-     * The name of the tool, which acts as a unique, stable identifier for the
-     * tool across deployments.
-     *
-     * @example `"get_weather"`
-     * @example `"google_search"`
-     */
-    name: toolNameSchema,
-
-    /**
-     * A description of the tool intended to be used in prompts for LLMs to
-     * understand when and how to use the tool.
-     */
-    description: z.string().optional(),
-
-    /**
-     * A JSON Schema object defining the expected parameters for the tool.
-     */
-    inputSchema: z
-      .object({
-        type: z.literal('object'),
-        properties: z.object({}).passthrough().optional(),
-        required: z.array(z.string()).optional()
-      })
-      .passthrough(),
-
-    /**
-     * An optional JSON Schema object defining the structure of the tool's
-     * output.
-     */
-    outputSchema: z
-      .object({
-        type: z.literal('object'),
-        properties: z.object({}).passthrough().optional(),
-        required: z.array(z.string()).optional()
-      })
-      .passthrough()
-      .optional(),
-
-    /**
-     * Optional additional tool information.
-     */
-    annotations: toolAnnotationsSchema.optional()
-  })
-  .passthrough()
-  .openapi('Tool')
-export type Tool = z.infer<typeof toolSchema>
 
 /**
  * Customizes a tool's behavior for a given pricing plan.
@@ -245,5 +144,104 @@ export const toolConfigSchema = z
   .openapi('ToolConfig')
 export type ToolConfig = z.infer<typeof toolConfigSchema>
 
-export const toolMapSchema = z.record(toolNameSchema, toolSchema)
+/**
-export type ToolMap = z.infer<typeof toolMapSchema>
+ * Additional properties describing a Tool to clients.
+ *
+ * NOTE: All properties in ToolAnnotations are **hints**.
+ *
+ * They are not guaranteed to provide a faithful description of tool behavior
+ * (including descriptive properties like `title`).
+ *
+ * Clients should never make tool use decisions based on ToolAnnotations
+ * received from untrusted servers.
+ */
+export const toolAnnotationsSchema = z
+  .object({
+    /**
+     * A human-readable title for the tool.
+     */
+    title: z.string().optional(),
+
+    /**
+     * If true, the tool does not modify its environment.
+     *
+     * Default: false
+     */
+    readOnlyHint: z.boolean().optional(),
+
+    /**
+     * If true, the tool may perform destructive updates to its environment.
+     * If false, the tool performs only additive updates.
+     *
+     * (This property is meaningful only when `readOnlyHint == false`)
+     *
+     * Default: true
+     */
+    destructiveHint: z.boolean().optional(),
+
+    /**
+     * If true, calling the tool repeatedly with the same arguments
+     * will have no additional effect on the its environment.
+     *
+     * (This property is meaningful only when `readOnlyHint == false`)
+     *
+     * Default: false
+     */
+    idempotentHint: z.boolean().optional(),
+
+    /**
+     * If true, this tool may interact with an "open world" of external
+     * entities. If false, the tool's domain of interaction is closed.
+     * For example, the world of a web search tool is open, whereas that
+     * of a memory tool is not.
+     *
+     * Default: true
+     */
+    openWorldHint: z.boolean().optional()
+  })
+  .passthrough()
+
+/**
+ * Definition for an Agentic tool.
+ */
+export const toolSchema = z
+  .object({
+    /**
+     * The name of the tool, which acts as a unique, stable identifier for the
+     * tool across deployments.
+     *
+     * @example `"get_weather"`
+     * @example `"google_search"`
+     */
+    name: toolNameSchema,
+
+    /**
+     * A description of the tool intended to be used in prompts for LLMs to
+     * understand when and how to use the tool.
+     */
+    description: z.string().optional(),
+
+    /**
+     * A JSON Schema object defining the expected parameters for the tool.
+     */
+    inputSchema: jsonSchemaObjectSchema,
+
+    /**
+     * An optional JSON Schema object defining the structure of the tool's
+     * output.
+     */
+    outputSchema: jsonSchemaObjectSchema.optional(),
+
+    /**
+     * Optional additional tool information.
+     *
+     * Used by MCP servers.
+     */
+    annotations: toolAnnotationsSchema.optional()
+  })
+  .passthrough()
+  .openapi('Tool')
+export type Tool = z.infer<typeof toolSchema>
+
+// export const toolMapSchema = z.record(toolNameSchema, toolSchema)
+// export type ToolMap = z.infer<typeof toolMapSchema>

packages/schemas/src/validate-agentic-project-config.ts

@@ -7,7 +7,9 @@ import type { PricingPlanLineItem } from './pricing'
 import {
   type AgenticProjectConfig,
   type AgenticProjectConfigInput,
-  agenticProjectConfigSchema
+  agenticProjectConfigSchema,
+  type ResolvedAgenticProjectConfig,
+  resolvedAgenticProjectConfigSchema
 } from './agentic-project-config'
 import { getPricingPlansByInterval } from './utils'
 import { validateOriginAdapter } from './validate-origin-adapter'
@@ -18,7 +20,7 @@ export async function validateAgenticProjectConfig(
     strip = false,
     ...opts
   }: { logger?: Logger; cwd?: URL; strip?: boolean; label?: string } = {}
-): Promise<AgenticProjectConfig> {
+): Promise<ResolvedAgenticProjectConfig> {
   const config = parseZodSchema<
     AgenticProjectConfig,
     ZodTypeDef,
@@ -240,12 +242,18 @@ export async function validateAgenticProjectConfig(
     )
   }
 
-  await validateOriginAdapter({
+  const { originAdapter, tools } = await validateOriginAdapter({
+    name,
+    version: config.version,
     label: `project "${name}"`,
     ...opts,
     originUrl,
     originAdapter: config.originAdapter
   })
 
-  return config
+  return parseZodSchema(resolvedAgenticProjectConfigSchema, {
+    ...config,
+    originAdapter,
+    tools
+  })
 }

packages/schemas/src/validate-origin-adapter.ts

@@ -1,25 +1,35 @@
-import type { OriginAdapter } from '@agentic/platform-schemas'
+import type {
+  OriginAdapter,
+  OriginAdapterConfig,
+  Tool
+} from '@agentic/platform-schemas'
 import { assert, type Logger } from '@agentic/platform-core'
 import { validateOpenAPISpec } from '@agentic/platform-openapi'
+import { Client as McpClient } from '@modelcontextprotocol/sdk/client/index.js'
 
 /**
  * Validates and normalizes the origin adapter config for a project.
- *
- * NOTE: This method may mutate `originAdapter.spec`.
  */
 export async function validateOriginAdapter({
+  name,
+  version = '0.0.0',
   originUrl,
   originAdapter,
   label,
   cwd,
   logger
 }: {
+  name: string
   originUrl: string
-  originAdapter: OriginAdapter
+  originAdapter: OriginAdapterConfig
   label: string
+  version?: string
   cwd?: URL
   logger?: Logger
-}): Promise<void> {
+}): Promise<{
+  originAdapter: OriginAdapter
+  tools?: Tool[]
+}> {
   assert(originUrl, 400, `Origin URL is required for ${label}`)
 
   if (originAdapter.type === 'openapi') {
@@ -40,18 +50,59 @@ export async function validateOriginAdapter({
     delete openapiSpec.servers
 
     // TODO: Additional, agentic-specific validation of the OpenAPI spec's
-    // operations to ensure they are valid AI functions.
+    // operations to ensure they are valid tools.
 
     // TODO: Simplify OpenAPI spec by removing any query params and headers
     // specific to the Agentic API gateway.
 
-    // Update the openapi spec with the normalized version
+    // TODO: Extract tool definitions from OpenAPI operationIds
-    originAdapter.spec = JSON.stringify(openapiSpec)
+
+    return {
+      originAdapter: {
+        ...originAdapter,
+        // Update the openapi spec with the normalized version
+        spec: JSON.stringify(openapiSpec)
+      }
+    }
+  } else if (originAdapter.type === 'mcp') {
+    // TODO: Validate MCP server info and tools
+
+    const { SSEClientTransport } = await import(
+      '@modelcontextprotocol/sdk/client/sse.js'
+    )
+    const transport = new SSEClientTransport(new URL(originUrl))
+    const client = new McpClient({ name, version })
+    await client.connect(transport)
+
+    const serverInfo = {
+      name,
+      version,
+      ...client.getServerVersion(),
+      capabilities: client.getServerCapabilities(),
+      instructions: client.getInstructions()
+    }
+
+    const listToolsResponse = await client.listTools()
+
+    // TODO: Validate MCP tools
+    const tools = listToolsResponse.tools
+
+    return {
+      originAdapter: {
+        ...originAdapter,
+        serverInfo
+      },
+      tools
+    }
   } else {
     assert(
       originAdapter.type === 'raw',
       400,
       `Invalid origin adapter type "${originAdapter.type}" for ${label}`
     )
+
+    return {
+      originAdapter
+    }
   }
 }

pnpm-lock.yaml

@@ -30,6 +30,9 @@ catalogs:
     '@hono/zod-openapi':
       specifier: ^0.19.6
       version: 0.19.6
+    '@modelcontextprotocol/sdk':
+      specifier: ^1.11.2
+      version: 1.12.0
     '@openauthjs/openauth':
       specifier: ^0.4.3
       version: 0.4.3
@@ -494,6 +497,9 @@ importers:
       '@hono/zod-openapi':
         specifier: 'catalog:'
         version: 0.19.6(hono@4.7.10)(zod@3.25.30)
+      '@modelcontextprotocol/sdk':
+        specifier: 'catalog:'
+        version: 1.12.0
       ms:
         specifier: 'catalog:'
         version: 2.1.3
@@ -1245,6 +1251,10 @@ packages:
   '@jridgewell/trace-mapping@0.3.9':
     resolution: {integrity: sha512-3Belt6tdc8bPgAtbcmdtNJlirVoTmEb5e2gC94PnkwEW9jI6CAHUeoG85tjWP5WquqfavoMtMwiG4P926ZKKuQ==}
 
+  '@modelcontextprotocol/sdk@1.12.0':
+    resolution: {integrity: sha512-m//7RlINx1F3sz3KqwY1WWzVgTcYX52HYk4bJ1hkBXV3zccAEth+jRvG8DBRrdaQuRsPAJOx2MH3zaHNCKL7Zg==}
+    engines: {node: '>=18'}
+
   '@napi-rs/wasm-runtime@0.2.10':
     resolution: {integrity: sha512-bCsCyeZEwVErsGmyPNSzwfwFn4OdxBj0mmv6hOFucB/k81Ojdu68RbZdxYsRQUPc9l6SU5F/cG+bXgWs3oUgsQ==}
 
@@ -1955,6 +1965,10 @@ packages:
   '@vitest/utils@3.1.4':
     resolution: {integrity: sha512-yriMuO1cfFhmiGc8ataN51+9ooHRuURdfAZfwFd3usWynjzpLslZdYnRegTv32qdgtJTsj15FoeZe2g15fY1gg==}
 
+  accepts@2.0.0:
+    resolution: {integrity: sha512-5cvg6CtKwfgdmVqY1WIiXKc3Q1bkRqGLi+2W/6ao+6Y7gu/RCwRuAhGEzh5B4KlszSuTLgZYuqFqo5bImjNKng==}
+    engines: {node: '>= 0.6'}
+
   acorn-import-attributes@1.9.5:
     resolution: {integrity: sha512-n02Vykv5uA3eHGM/Z2dQrcD56kL8TyDb2p1+0P83PClMnC/nc+anbQRhIOWnSq4Ke/KvDPrY3C9hDtC/A3eHnQ==}
     peerDependencies:
@@ -2107,6 +2121,10 @@ packages:
   blake3-wasm@2.1.5:
     resolution: {integrity: sha512-F1+K8EbfOZE49dtoPtmxUQrpXaBIl3ICvasLh+nJta0xkz+9kF/7uet9fLnwKqhDrmj6g+6K3Tw9yQPUg2ka5g==}
 
+  body-parser@2.2.0:
+    resolution: {integrity: sha512-02qvAaxv8tp7fBa/mw1ga98OGm+eCbqzJOKoRt70sLmfEEi+jyBYVTDGfCL/k06/4EMk/z01gCe7HoCH/f2LTg==}
+    engines: {node: '>=18'}
+
   bottleneck@2.19.5:
     resolution: {integrity: sha512-VHiNCbI1lKdl44tGrhNfU3lup0Tj/ZBMJB5/2ZbNXRCPuRCO7ed2mgcK4r17y+KB2EfuYuRaVlwNbAeaWGSpbw==}
 
@@ -2142,6 +2160,10 @@ packages:
     peerDependencies:
       esbuild: '>=0.18'
 
+  bytes@3.1.2:
+    resolution: {integrity: sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==}
+    engines: {node: '>= 0.8'}
+
   cac@6.7.14:
     resolution: {integrity: sha512-b6Ilus+c3RrdDk+JhLKUAQfzzgLEPy6wcXqS7f/xe1EETvsDP6GORG7SFuOs6cID5YkqchW/LXZbX5bc8j7ZcQ==}
     engines: {node: '>=8'}
@@ -2257,6 +2279,18 @@ packages:
     resolution: {integrity: sha512-5IKcdX0nnYavi6G7TtOhwkYzyjfJlatbjMjuLSfE2kYT5pMDOilZ4OvMhi637CcDICTmz3wARPoyhqyX1Y+XvA==}
     engines: {node: ^14.18.0 || >=16.10.0}
 
+  content-disposition@1.0.0:
+    resolution: {integrity: sha512-Au9nRL8VNUut/XSzbQA38+M78dzP4D+eqg3gfJHMIHHYa3bg067xj1KxMUWj+VULbiZMowKngFFbKczUrNJ1mg==}
+    engines: {node: '>= 0.6'}
+
+  content-type@1.0.5:
+    resolution: {integrity: sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==}
+    engines: {node: '>= 0.6'}
+
+  cookie-signature@1.2.2:
+    resolution: {integrity: sha512-D76uU73ulSXrD1UXF4KE2TMxVVwhsnCgfAyTg9k8P6KGZjlXKrOLe4dJQKI3Bxi5wjesZoFXJWElNWBjPZMbhg==}
+    engines: {node: '>=6.6.0'}
+
   cookie@0.7.2:
     resolution: {integrity: sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==}
     engines: {node: '>= 0.6'}
@@ -2264,6 +2298,10 @@ packages:
   core-js-compat@3.41.0:
     resolution: {integrity: sha512-RFsU9LySVue9RTwdDVX/T0e2Y6jRYWXERKElIjpuEOEnxaXffI0X7RUwVzfYLfzuLXSNJDYoRYUAmRUcyln20A==}
 
+  cors@2.8.5:
+    resolution: {integrity: sha512-KIHbLJqu73RGr/hnbrO9uBeixNGuvSQjul/jdFvS/KFSIH1hWVd1ng7zOHx+YrEfInLG7q4n6GHQ9cDtxv/P6g==}
+    engines: {node: '>= 0.10'}
+
   cross-spawn@7.0.6:
     resolution: {integrity: sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==}
     engines: {node: '>= 8'}
@@ -2350,6 +2388,10 @@ packages:
     resolution: {integrity: sha512-R6ep6JJ+eOBZsBr9esiNN1gxFbZE4Q2cULkUSFumGYecAiS6qodDvcPx/sFuWHMNul7DWmrtoEOpYSm7o6tbSA==}
     engines: {node: '>=18'}
 
+  depd@2.0.0:
+    resolution: {integrity: sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==}
+    engines: {node: '>= 0.8'}
+
   detect-libc@2.0.4:
     resolution: {integrity: sha512-3UDv+G9CsCKO1WKMGw9fwq/SWJYbI0c5Y7LU1AXYoDdbhE2AHQ6N6Nb34sG8Fj7T5APy8qXDCKuuIHd1BR0tVA==}
     engines: {node: '>=8'}
@@ -2466,6 +2508,9 @@ packages:
   eastasianwidth@0.2.0:
     resolution: {integrity: sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA==}
 
+  ee-first@1.1.1:
+    resolution: {integrity: sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==}
+
   electron-to-chromium@1.5.143:
     resolution: {integrity: sha512-QqklJMOFBMqe46k8iIOwA9l2hz57V2OKMmP5eSWcUvwx+mASAsbU+wkF1pHjn9ZVSBPrsYWr4/W/95y5SwYg2g==}
 
@@ -2482,6 +2527,10 @@ packages:
   emoji-regex@9.2.2:
     resolution: {integrity: sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg==}
 
+  encodeurl@2.0.0:
+    resolution: {integrity: sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==}
+    engines: {node: '>= 0.8'}
+
   env-paths@3.0.0:
     resolution: {integrity: sha512-dtJUTepzMW3Lm/NPxRf3wP4642UWhjL2sQxc+ym2YMj1m/H2zDNQOlezafzkHwn6sMstjHTwG6iQQsctDW/b1A==}
     engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
@@ -2544,6 +2593,9 @@ packages:
     resolution: {integrity: sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA==}
     engines: {node: '>=6'}
 
+  escape-html@1.0.3:
+    resolution: {integrity: sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==}
+
   escape-string-regexp@1.0.5:
     resolution: {integrity: sha512-vbRorB5FUQWvla16U8R/qgaFIya2qGzwDrNmCZuYKrbdSUMG6I1ZCGQRefkRVhuOkIGVne7BQ35DSfo1qvJqFg==}
     engines: {node: '>=0.8.0'}
@@ -2691,6 +2743,10 @@ packages:
     resolution: {integrity: sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==}
     engines: {node: '>=0.10.0'}
 
+  etag@1.8.1:
+    resolution: {integrity: sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==}
+    engines: {node: '>= 0.6'}
+
   eventemitter3@5.0.1:
     resolution: {integrity: sha512-GWkBvjiSZK87ELrYOSESUYeVIc9mvLLf/nXalMOS5dYrgZq9o5OVkbZAVM06CVxYsCwH9BDZFPlQTlPA1j4ahA==}
 
@@ -2698,6 +2754,14 @@ packages:
     resolution: {integrity: sha512-sPNTqiMokAvV048P2c9+foqVJzk49o6d4e0D/sq5jog3pw+4kBgyR0gaM1FM7Mx6Kzd9dztesh9oYz1LWWOpzw==}
     engines: {node: '>=10'}
 
+  eventsource-parser@3.0.2:
+    resolution: {integrity: sha512-6RxOBZ/cYgd8usLwsEl+EC09Au/9BcmCKYF2/xbml6DNczf7nv0MQb+7BA2F+li6//I+28VNlQR37XfQtcAJuA==}
+    engines: {node: '>=18.0.0'}
+
+  eventsource@3.0.7:
+    resolution: {integrity: sha512-CRT1WTyuQoD771GW56XEZFQ/ZoSfWid1alKGDYMmkt2yl8UXrVR4pspqWNEcqKvVIzg6PAltWjxcSSPrboA4iA==}
+    engines: {node: '>=18.0.0'}
+
   exit-hook@2.2.1:
     resolution: {integrity: sha512-eNTPlAD67BmP31LDINZ3U7HSF8l57TxOY2PmBJ1shpCvpnxBF93mWCE8YHBnXs8qiUZJc9WDcWIeC3a2HIAMfw==}
     engines: {node: '>=6'}
@@ -2710,6 +2774,16 @@ packages:
     resolution: {integrity: sha512-/kP8CAwxzLVEeFrMm4kMmy4CCDlpipyA7MYLVrdJIkV0fYF0UaigQHRsxHiuY/GEea+bh4KSv3TIlgr+2UL6bw==}
     engines: {node: '>=12.0.0'}
 
+  express-rate-limit@7.5.0:
+    resolution: {integrity: sha512-eB5zbQh5h+VenMPM3fh+nw1YExi5nMr6HUCR62ELSP11huvxm/Uir1H1QEyTkk5QX6A58pX6NmaTMceKZ0Eodg==}
+    engines: {node: '>= 16'}
+    peerDependencies:
+      express: ^4.11 || 5 || ^5.0.0-beta.1
+
+  express@5.1.0:
+    resolution: {integrity: sha512-DT9ck5YIRU+8GYzzU5kT3eHGA5iL+1Zd0EutOmTE9Dtk+Tvuzd23VBU+ec7HPNSTxXYO55gPV/hq4pSBJDjFpA==}
+    engines: {node: '>= 18'}
+
   exsolve@1.0.5:
     resolution: {integrity: sha512-pz5dvkYYKQ1AHVrgOzBKWeP4u4FRb3a6DNK2ucr0OoNwYIU4QWsJ+NM36LLzORT+z845MzKHHhpXiUF5nvQoJg==}
 
@@ -2754,6 +2828,10 @@ packages:
     resolution: {integrity: sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==}
     engines: {node: '>=8'}
 
+  finalhandler@2.1.0:
+    resolution: {integrity: sha512-/t88Ty3d5JWQbWYgaOGCCYfXRwV1+be02WqYYlL6h0lEiUAMPM8o8qKGO01YIkOHzka2up08wvgYD0mDiI+q3Q==}
+    engines: {node: '>= 0.8'}
+
   find-up-simple@1.0.1:
     resolution: {integrity: sha512-afd4O7zpqHeRyg4PfDQsXmlDe2PfdHtJt6Akt8jOWaApLOZk5JXs6VMR29lz03pRe9mpykrRCYIYxaJYcfpncQ==}
     engines: {node: '>=18'}
@@ -2788,6 +2866,14 @@ packages:
   forwarded-parse@2.1.2:
     resolution: {integrity: sha512-alTFZZQDKMporBH77856pXgzhEzaUVmLCDk+egLgIgHst3Tpndzz8MnKe+GzRJRfvVdn69HhpW7cmXzvtLvJAw==}
 
+  forwarded@0.2.0:
+    resolution: {integrity: sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==}
+    engines: {node: '>= 0.6'}
+
+  fresh@2.0.0:
+    resolution: {integrity: sha512-Rx/WycZ60HOaqLKAi6cHRKKI7zxWbJ31MhntmtwMoaTeF7XFH9hhBp8vITaMidfljRQ6eYWCKkaTK+ykVJHP2A==}
+    engines: {node: '>= 0.8'}
+
   fsevents@2.3.3:
     resolution: {integrity: sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==}
     engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
@@ -2909,10 +2995,18 @@ packages:
     resolution: {integrity: sha512-puUZAUKT5m8Zzvs72XWy3HtvVbTWljRE66cP60bxJzAqf2DgICo7lYTY2IHUmLnNpjYvw5bvmoHvPc0QO2a62w==}
     engines: {node: ^16.14.0 || >=18.0.0}
 
+  http-errors@2.0.0:
+    resolution: {integrity: sha512-FtwrG/euBzaEjYeRqOgly7G0qviiXoJWnvEH2Z1plBdXgbyjv34pHTSb9zoeHMyDy33+DWy5Wt9Wo+TURtOYSQ==}
+    engines: {node: '>= 0.8'}
+
   https-proxy-agent@7.0.6:
     resolution: {integrity: sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==}
     engines: {node: '>= 14'}
 
+  iconv-lite@0.6.3:
+    resolution: {integrity: sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==}
+    engines: {node: '>=0.10.0'}
+
   ignore@5.3.2:
     resolution: {integrity: sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==}
     engines: {node: '>= 4'}
@@ -2940,10 +3034,17 @@ packages:
     resolution: {integrity: sha512-XPdx9Dq4t9Qk1mTMbWONJqU7boCoumEH7fRET37HX5+khDUl3J2W6PdALxhILYlIYx2amlwYcRPp28p0tSiojg==}
     engines: {node: '>=18'}
 
+  inherits@2.0.4:
+    resolution: {integrity: sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==}
+
   internal-slot@1.1.0:
     resolution: {integrity: sha512-4gd7VpWNQNB4UKKCFFVcp1AVv+FMOgs9NKzjHKusc8jTMhd5eL1NqQqOpE0KzMds804/yHlglp3uxgluOqAPLw==}
     engines: {node: '>= 0.4'}
 
+  ipaddr.js@1.9.1:
+    resolution: {integrity: sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==}
+    engines: {node: '>= 0.10'}
+
   is-absolute-url@4.0.1:
     resolution: {integrity: sha512-/51/TKE88Lmm7Gc4/8btclNXWS+g50wXhYJq8HWIBAGUBnoAdRu1aXeh364t/O7wXDAcTJDP8PNuNKWUDWie+A==}
     engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
@@ -3057,6 +3158,9 @@ packages:
     resolution: {integrity: sha512-+Pgi+vMuUNkJyExiMBt5IlFoMyKnr5zhJ4Uspz58WOhBF5QoIZkFyNHIbBAtHwzVAgk5RtndVNsDRN61/mmDqg==}
     engines: {node: '>=12'}
 
+  is-promise@4.0.0:
+    resolution: {integrity: sha512-hvpoI6korhJMnej285dSg6nu1+e6uxs7zG3BYAm5byqDsgJNWwxzM6z6iZiAgQR4TJ30JmBTOwqZUw3WlyH3AQ==}
+
   is-regex@1.2.1:
     resolution: {integrity: sha512-MjYsKHO5O7mCsmRGxWcLWheFqN9DJ/2TmngvjKXihe6efViPqc274+Fx/4fYj/r03+ESvBdTXK0V6tA3rgez1g==}
     engines: {node: '>= 0.4'}
@@ -3270,6 +3374,10 @@ packages:
     resolution: {integrity: sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==}
     engines: {node: '>= 0.4'}
 
+  media-typer@1.1.0:
+    resolution: {integrity: sha512-aisnrDP4GNe06UcKFnV5bfMNPBUw4jsLGaWwWfnH3v02GnBuXX2MCVn5RbrWo0j3pczUilYblq7fQ7Nw2t5XKw==}
+    engines: {node: '>= 0.8'}
+
   memorystream@0.3.1:
     resolution: {integrity: sha512-S3UwM3yj5mtUSEfP41UZmt/0SCoVYUcU1rkXv+BQ5Ig8ndL4sPoJNBUJERafdPb5jjHJGuMgytgKvKIf58XNBw==}
     engines: {node: '>= 0.10.0'}
@@ -3278,6 +3386,10 @@ packages:
     resolution: {integrity: sha512-pxQJQzB6djGPXh08dacEloMFopsOqGVRKFPYvPOt9XDZ1HasbgDZA74CJGreSU4G3Ak7EFJGoiH2auq+yXISgA==}
     engines: {node: '>=18'}
 
+  merge-descriptors@2.0.0:
+    resolution: {integrity: sha512-Snk314V5ayFLhp3fkUREub6WtjBfPdCPY1Ln8/8munuLuiYhsABgBVWsozAG+MWMbVEvcdcpbi9R7ww22l9Q3g==}
+    engines: {node: '>=18'}
+
   merge2@1.4.1:
     resolution: {integrity: sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==}
     engines: {node: '>= 8'}
@@ -3286,6 +3398,14 @@ packages:
     resolution: {integrity: sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==}
     engines: {node: '>=8.6'}
 
+  mime-db@1.54.0:
+    resolution: {integrity: sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==}
+    engines: {node: '>= 0.6'}
+
+  mime-types@3.0.1:
+    resolution: {integrity: sha512-xRc4oEhT6eaBpU1XF7AjpOFD+xQmXNB5OVKwp4tqCuBpHLS/ZbBDrc07mYTDqVMg6PfxUjjNp85O6Cd2Z/5HWA==}
+    engines: {node: '>= 0.6'}
+
   mime@3.0.0:
     resolution: {integrity: sha512-jSCU7/VB1loIWBZe14aEYHU/+1UMEHoaO7qxCOVJOw9GgH72VAWppxNcjU+x9a2k3GSIBXNKxXQFqRvvZ7vr3A==}
     engines: {node: '>=10.0.0'}
@@ -3350,6 +3470,10 @@ packages:
   natural-compare@1.4.0:
     resolution: {integrity: sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==}
 
+  negotiator@1.0.0:
+    resolution: {integrity: sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg==}
+    engines: {node: '>= 0.6'}
+
   node-releases@2.0.19:
     resolution: {integrity: sha512-xxOWJsBKtzAq7DY0J+DTzuz58K8e7sJbdgwkbMWQe8UYB6ekmsQ45q0M/tJDsGaZmbC+l7n57UV8Hl5tHxO9uw==}
 
@@ -3405,6 +3529,13 @@ packages:
   ohash@2.0.11:
     resolution: {integrity: sha512-RdR9FQrFwNBNXAr4GixM8YaRZRJ5PUWbKYbE5eOsrwAjJW0q2REGcf79oYPsLyskQCZG1PLN+S/K1V00joZAoQ==}
 
+  on-finished@2.4.1:
+    resolution: {integrity: sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==}
+    engines: {node: '>= 0.8'}
+
+  once@1.4.0:
+    resolution: {integrity: sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==}
+
   onetime@7.0.0:
     resolution: {integrity: sha512-VXJjc87FScF88uafS3JllDgvAm+c/Slfz06lorj2uAY34rlUu0Nt+v8wreiImcrgAjjIHp1rXpTDlLOGw29WwQ==}
     engines: {node: '>=18'}
@@ -3472,6 +3603,10 @@ packages:
     resolution: {integrity: sha512-ybiGyvspI+fAoRQbIPRddCcSTV9/LsJbf0e/S85VLowVGzRmokfneg2kwVW/KU5rOXrPSbF1qAKPMgNTqqROQQ==}
     engines: {node: '>=18'}
 
+  parseurl@1.3.3:
+    resolution: {integrity: sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==}
+    engines: {node: '>= 0.8'}
+
   path-exists@4.0.0:
     resolution: {integrity: sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==}
     engines: {node: '>=8'}
@@ -3490,6 +3625,10 @@ packages:
   path-to-regexp@6.3.0:
     resolution: {integrity: sha512-Yhpw4T9C6hPpgPeA28us07OJeqZ5EzQTkbfwuhsUg0c237RomFoETJgmp2sa3F/41gfLE6G5cqcYwznmeEeOlQ==}
 
+  path-to-regexp@8.2.0:
+    resolution: {integrity: sha512-TdrF7fW9Rphjq4RjrW0Kp2AW0Ahwu9sRGTkS6bvDi0SCwZlEZYmcfDbEsTz8RVk0EHIS/Vd1bv3JhG+1xZuAyQ==}
+    engines: {node: '>=16'}
+
   path-type@6.0.0:
     resolution: {integrity: sha512-Vj7sf++t5pBD637NSfkxpHSMfWaeig5+DKWLhcqIYx6mWQz5hdJTGDVMQiJcw1ZYkhs7AazKDGpRVji1LJCZUQ==}
     engines: {node: '>=18'}
@@ -3532,6 +3671,10 @@ packages:
     resolution: {integrity: sha512-TfySrs/5nm8fQJDcBDuUng3VOUKsd7S+zqvbOTiGXHfxX4wK31ard+hoNuvkicM/2YFzlpDgABOevKSsB4G/FA==}
     engines: {node: '>= 6'}
 
+  pkce-challenge@5.0.0:
+    resolution: {integrity: sha512-ueGLflrrnvwB3xuo/uGob5pd5FN7l0MsLf0Z87o/UQmRtwjvfylfc9MurIxRAWywCYTgrvpXBcqjV4OfCYGCIQ==}
+    engines: {node: '>=16.20.0'}
+
   pkg-types@1.3.1:
     resolution: {integrity: sha512-/Jm5M4RvtBFVkKWRu2BLUTNP8/M2a+UwuAX+ae4770q1qVGtfjG+WTCupoZixokjmHiry8uI+dlY8KXYV5HVVQ==}
 
@@ -3600,6 +3743,10 @@ packages:
   prop-types@15.8.1:
     resolution: {integrity: sha512-oj87CgZICdulUohogVAR7AjlC0327U4el4L6eAvOqCeudMDVU0NThNaV+b9Df4dXgSP1gXMTnPdhfe/2qDH5cg==}
 
+  proxy-addr@2.0.7:
+    resolution: {integrity: sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==}
+    engines: {node: '>= 0.10'}
+
   punycode@2.3.1:
     resolution: {integrity: sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==}
     engines: {node: '>=6'}
@@ -3614,6 +3761,14 @@ packages:
   queue-microtask@1.2.3:
     resolution: {integrity: sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==}
 
+  range-parser@1.2.1:
+    resolution: {integrity: sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg==}
+    engines: {node: '>= 0.6'}
+
+  raw-body@3.0.0:
+    resolution: {integrity: sha512-RmkhL8CAyCRPXCE28MMH0z2PNWQBNk2Q09ZdxM9IOOXwxwZbN+qbWaatPkdkWIKL2ZVDImrN/pK5HTRz2PcS4g==}
+    engines: {node: '>= 0.8'}
+
   react-is@16.13.1:
     resolution: {integrity: sha512-24e6ynE2H+OKt4kqsOvNd8kBpV65zoxbA4BVsEOB3ARVWQki/DHzaUoC5KuON/BiccDaCCTZBuOcfZs70kR8bQ==}
 
@@ -3700,6 +3855,10 @@ packages:
     engines: {node: '>=18.0.0', npm: '>=8.0.0'}
     hasBin: true
 
+  router@2.2.0:
+    resolution: {integrity: sha512-nLTrUKm2UyiL7rlhapu/Zl45FwNgkZGaCpZbIHajDYgwlJCOzLSk+cIPAnsEqV955GjILJnKbdQC1nVPz+gAYQ==}
+    engines: {node: '>= 18'}
+
   run-applescript@7.0.0:
     resolution: {integrity: sha512-9by4Ij99JUr/MCFBUkDKLWK3G9HVXmabKz9U5MlIAIuvuzkiOicRYs8XJLxX+xahD+mLiiCYDqF9dKAgtzKP1A==}
     engines: {node: '>=18'}
@@ -3711,6 +3870,9 @@ packages:
     resolution: {integrity: sha512-AURm5f0jYEOydBj7VQlVvDrjeFgthDdEF5H1dP+6mNpoXOMo1quQqJ4wvJDyRZ9+pO3kGWoOdmV08cSv2aJV6Q==}
     engines: {node: '>=0.4'}
 
+  safe-buffer@5.2.1:
+    resolution: {integrity: sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==}
+
   safe-push-apply@1.0.0:
     resolution: {integrity: sha512-iKE9w/Z7xCzUMIZqdBsp6pEQvwuEebH4vdpjcDWnyzaI6yl6O9FHvVpmGelvEHNsoY6wGblkxR6Zty/h00WiSA==}
     engines: {node: '>= 0.4'}
@@ -3722,6 +3884,9 @@ packages:
   safe-regex@2.1.1:
     resolution: {integrity: sha512-rx+x8AMzKb5Q5lQ95Zoi6ZbJqwCLkqi3XuJXp5P3rT8OEc6sZCJG5AE5dU3lsgRr/F4Bs31jSlVN+j5KrsGu9A==}
 
+  safer-buffer@2.1.2:
+    resolution: {integrity: sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==}
+
   semver@6.3.1:
     resolution: {integrity: sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==}
     hasBin: true
@@ -3731,6 +3896,14 @@ packages:
     engines: {node: '>=10'}
     hasBin: true
 
+  send@1.2.0:
+    resolution: {integrity: sha512-uaW0WwXKpL9blXE2o0bRhoL2EGXIrZxQ2ZQ4mgcfoBxdFmQold+qWsD2jLrfZ0trjKL6vOw0j//eAwcALFjKSw==}
+    engines: {node: '>= 18'}
+
+  serve-static@2.2.0:
+    resolution: {integrity: sha512-61g9pCh0Vnh7IutZjtLGGpTA355+OPn2TyDv/6ivP2h/AdAVX9azsoxmg2/M6nZeQZNYBEwIcsne1mJd9oQItQ==}
+    engines: {node: '>= 18'}
+
   set-function-length@1.2.2:
     resolution: {integrity: sha512-pgRc4hJ4/sNjWCSS9AmnS40x3bNMDTknHgL5UaMBTMyJnU90EgWh1Rz+MC9eFu4BuN/UwZjKQuY/1v3rM7HMfg==}
     engines: {node: '>= 0.4'}
@@ -3743,6 +3916,9 @@ packages:
     resolution: {integrity: sha512-RJRdvCo6IAnPdsvP/7m6bsQqNnn1FCBX5ZNtFL98MmFF/4xAIJTIg1YbHW5DC2W5SKZanrC6i4HsJqlajw/dZw==}
     engines: {node: '>= 0.4'}
 
+  setprototypeof@1.2.0:
+    resolution: {integrity: sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==}
+
   sharp@0.33.5:
     resolution: {integrity: sha512-haPVm1EkS9pgvHrQ/F3Xy+hgcuMV0Wm9vfIBSiwZ05k+xgb0PkBQpGsAA/oWdDobNaZTH5ppvHtzCFbnSEwHVw==}
     engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
@@ -3848,6 +4024,10 @@ packages:
   stacktracey@2.1.8:
     resolution: {integrity: sha512-Kpij9riA+UNg7TnphqjH7/CzctQ/owJGNbFkfEeve4Z4uxT5+JapVLFXcsurIfN34gnTWZNJ/f7NMG0E8JDzTw==}
 
+  statuses@2.0.1:
+    resolution: {integrity: sha512-RwNA9Z/7PrK06rYLIzFMlaF+l73iwpzsqRIFgbMLbTcLD6cOao82TaWefPXQvB2fOC4AjuYSEndS7N/mTCbkdQ==}
+    engines: {node: '>= 0.8'}
+
   std-env@3.9.0:
     resolution: {integrity: sha512-UGvjygr6F6tpH7o2qyqR6QYpwraIjKSdtzyBdyytFOHmPZY917kwdwLG0RbOjWOnKmnm3PeHjaoLLMie7kPLQw==}
 
@@ -3988,6 +4168,10 @@ packages:
     resolution: {integrity: sha512-/m8M+2BJUpoJdgAHoG+baCwBT+tf2VraSfkBgl0Y00qIWt41DJ8R5B8nsEw0I58YwF5IZH6z24/2TobDKnqSWw==}
     engines: {node: '>=12'}
 
+  toidentifier@1.0.1:
+    resolution: {integrity: sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==}
+    engines: {node: '>=0.6'}
+
   toucan-js@4.1.1:
     resolution: {integrity: sha512-GTPwEaCRN8IbYe5/VeGiwxYvMO0dKaC16fTeLbF+QGswjkLZ9JUqAfDhLMyH2SWukYhmetH+uxWa1Bhluv/evQ==}
 
@@ -4089,6 +4273,10 @@ packages:
     resolution: {integrity: sha512-TeTSQ6H5YHvpqVwBRcnLDCBnDOHWYu7IvGbHT6N8AOymcr9PJGjc1GTtiWZTYg0NCgYwvnYWEkVChQAr9bjfwA==}
     engines: {node: '>=16'}
 
+  type-is@2.0.1:
+    resolution: {integrity: sha512-OZs6gsjF4vMp32qrCbiVSkrFmXtG/AZhY3t0iAMrMBiAZyV9oALtXO8hsrHbMXF9x6L3grlFuwW2oAz7cav+Gw==}
+    engines: {node: '>= 0.6'}
+
   typed-array-buffer@1.0.3:
     resolution: {integrity: sha512-nAYYwfY3qnzX30IkA6AQZjVbtK6duGontcQm1WSG1MD94YLqK0515GNApXkoxKOWMusVssAHWLh9SeaoefYFGw==}
     engines: {node: '>= 0.4'}
@@ -4155,6 +4343,10 @@ packages:
   universal-user-agent@7.0.3:
     resolution: {integrity: sha512-TmnEAEAsBJVZM/AADELsK76llnwcf9vMKuPz8JflO1frO8Lchitr0fNaN9d+Ap0BjKtqWqd/J17qeDnXh8CL2A==}
 
+  unpipe@1.0.0:
+    resolution: {integrity: sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==}
+    engines: {node: '>= 0.8'}
+
   update-browserslist-db@1.1.3:
     resolution: {integrity: sha512-UxhIZQ+QInVdunkDAaiazvvT/+fXL5Osr0JZlJulepYu6Jd7qJtDZjlur0emRlT71EN3ScPoE7gvsuIKKNavKw==}
     hasBin: true
@@ -4174,6 +4366,10 @@ packages:
   validate-npm-package-license@3.0.4:
     resolution: {integrity: sha512-DpKm2Ui/xN7/HQKCtpZxoRWBhZ9Z0kqtygG8XCgNQ8ZlDnxuQmWhj566j8fN4Cu3/JmbhsDo7fcAJq4s9h27Ew==}
 
+  vary@1.1.2:
+    resolution: {integrity: sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==}
+    engines: {node: '>= 0.8'}
+
   vite-node@3.1.4:
     resolution: {integrity: sha512-6enNwYnpyDo4hEgytbmc6mYWHXDHYEn0D1/rw4Q+tnHUGtKTJsn8T1YkX6Q18wI5LCrS8CTYlBaiCqxOy2kvUA==}
     engines: {node: ^18.0.0 || ^20.0.0 || >=22.0.0}
@@ -4333,6 +4529,9 @@ packages:
     resolution: {integrity: sha512-G8ura3S+3Z2G+mkgNRq8dqaFZAuxfsxpBB8OCTGRTCtp+l/v9nbFNmCUP1BZMts3G1142MsZfn6eeUKrr4PD1Q==}
     engines: {node: '>=18'}
 
+  wrappy@1.0.2:
+    resolution: {integrity: sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==}
+
   ws@8.18.0:
     resolution: {integrity: sha512-8VbfWfHLbbwu3+N6OKsOMpBdT4kXPDDB9cJk2bJ6mh9ucxdlnNvH1e+roYkKmN9Nxw2yjz7VzeO9oOz2zJ04Pw==}
     engines: {node: '>=10.0.0'}
@@ -4860,6 +5059,22 @@ snapshots:
       '@jridgewell/resolve-uri': 3.1.2
       '@jridgewell/sourcemap-codec': 1.5.0
 
+  '@modelcontextprotocol/sdk@1.12.0':
+    dependencies:
+      ajv: 6.12.6
+      content-type: 1.0.5
+      cors: 2.8.5
+      cross-spawn: 7.0.6
+      eventsource: 3.0.7
+      express: 5.1.0
+      express-rate-limit: 7.5.0(express@5.1.0)
+      pkce-challenge: 5.0.0
+      raw-body: 3.0.0
+      zod: 3.25.30
+      zod-to-json-schema: 3.24.5(zod@3.25.30)
+    transitivePeerDependencies:
+      - supports-color
+
   '@napi-rs/wasm-runtime@0.2.10':
     dependencies:
       '@emnapi/core': 1.4.3
@@ -5685,6 +5900,11 @@ snapshots:
       loupe: 3.1.3
       tinyrainbow: 2.0.0
 
+  accepts@2.0.0:
+    dependencies:
+      mime-types: 3.0.1
+      negotiator: 1.0.0
+
   acorn-import-attributes@1.9.5(acorn@8.14.1):
     dependencies:
       acorn: 8.14.1
@@ -5843,6 +6063,20 @@ snapshots:
 
   blake3-wasm@2.1.5: {}
 
+  body-parser@2.2.0:
+    dependencies:
+      bytes: 3.1.2
+      content-type: 1.0.5
+      debug: 4.4.1(supports-color@10.0.0)
+      http-errors: 2.0.0
+      iconv-lite: 0.6.3
+      on-finished: 2.4.1
+      qs: 6.14.0
+      raw-body: 3.0.0
+      type-is: 2.0.1
+    transitivePeerDependencies:
+      - supports-color
+
   bottleneck@2.19.5: {}
 
   brace-expansion@1.1.11:
@@ -5878,6 +6112,8 @@ snapshots:
       esbuild: 0.25.4
       load-tsconfig: 0.2.5
 
+  bytes@3.1.2: {}
+
   cac@6.7.14: {}
 
   call-bind-apply-helpers@1.0.2:
@@ -5987,12 +6223,25 @@ snapshots:
 
   consola@3.4.2: {}
 
+  content-disposition@1.0.0:
+    dependencies:
+      safe-buffer: 5.2.1
+
+  content-type@1.0.5: {}
+
+  cookie-signature@1.2.2: {}
+
   cookie@0.7.2: {}
 
   core-js-compat@3.41.0:
     dependencies:
       browserslist: 4.24.4
 
+  cors@2.8.5:
+    dependencies:
+      object-assign: 4.1.1
+      vary: 1.1.2
+
   cross-spawn@7.0.6:
     dependencies:
       path-key: 3.1.1
@@ -6078,6 +6327,8 @@ snapshots:
       p-map: 7.0.3
       slash: 5.1.0
 
+  depd@2.0.0: {}
+
   detect-libc@2.0.4: {}
 
   doctrine@2.1.0:
@@ -6114,6 +6365,8 @@ snapshots:
 
   eastasianwidth@0.2.0: {}
 
+  ee-first@1.1.1: {}
+
   electron-to-chromium@1.5.143: {}
 
   email-validator@2.0.4: {}
@@ -6124,6 +6377,8 @@ snapshots:
 
   emoji-regex@9.2.2: {}
 
+  encodeurl@2.0.0: {}
+
   env-paths@3.0.0: {}
 
   environment@1.1.0: {}
@@ -6290,6 +6545,8 @@ snapshots:
 
   escalade@3.2.0: {}
 
+  escape-html@1.0.3: {}
+
   escape-string-regexp@1.0.5: {}
 
   escape-string-regexp@4.0.0: {}
@@ -6511,18 +6768,62 @@ snapshots:
 
   esutils@2.0.3: {}
 
+  etag@1.8.1: {}
+
   eventemitter3@5.0.1: {}
 
   eventid@2.0.1:
     dependencies:
       uuid: 8.3.2
 
+  eventsource-parser@3.0.2: {}
+
+  eventsource@3.0.7:
+    dependencies:
+      eventsource-parser: 3.0.2
+
   exit-hook@2.2.1: {}
 
   exit-hook@4.0.0: {}
 
   expect-type@1.2.1: {}
 
+  express-rate-limit@7.5.0(express@5.1.0):
+    dependencies:
+      express: 5.1.0
+
+  express@5.1.0:
+    dependencies:
+      accepts: 2.0.0
+      body-parser: 2.2.0
+      content-disposition: 1.0.0
+      content-type: 1.0.5
+      cookie: 0.7.2
+      cookie-signature: 1.2.2
+      debug: 4.4.1(supports-color@10.0.0)
+      encodeurl: 2.0.0
+      escape-html: 1.0.3
+      etag: 1.8.1
+      finalhandler: 2.1.0
+      fresh: 2.0.0
+      http-errors: 2.0.0
+      merge-descriptors: 2.0.0
+      mime-types: 3.0.1
+      on-finished: 2.4.1
+      once: 1.4.0
+      parseurl: 1.3.3
+      proxy-addr: 2.0.7
+      qs: 6.14.0
+      range-parser: 1.2.1
+      router: 2.2.0
+      send: 1.2.0
+      serve-static: 2.2.0
+      statuses: 2.0.1
+      type-is: 2.0.1
+      vary: 1.1.2
+    transitivePeerDependencies:
+      - supports-color
+
   exsolve@1.0.5: {}
 
   fast-content-type-parse@3.0.0: {}
@@ -6563,6 +6864,17 @@ snapshots:
     dependencies:
       to-regex-range: 5.0.1
 
+  finalhandler@2.1.0:
+    dependencies:
+      debug: 4.4.1(supports-color@10.0.0)
+      encodeurl: 2.0.0
+      escape-html: 1.0.3
+      on-finished: 2.4.1
+      parseurl: 1.3.3
+      statuses: 2.0.1
+    transitivePeerDependencies:
+      - supports-color
+
   find-up-simple@1.0.1: {}
 
   find-up@5.0.0:
@@ -6598,6 +6910,10 @@ snapshots:
 
   forwarded-parse@2.1.2: {}
 
+  forwarded@0.2.0: {}
+
+  fresh@2.0.0: {}
+
   fsevents@2.3.3:
     optional: true
 
@@ -6729,6 +7045,14 @@ snapshots:
     dependencies:
       lru-cache: 10.4.3
 
+  http-errors@2.0.0:
+    dependencies:
+      depd: 2.0.0
+      inherits: 2.0.4
+      setprototypeof: 1.2.0
+      statuses: 2.0.1
+      toidentifier: 1.0.1
+
   https-proxy-agent@7.0.6(supports-color@10.0.0):
     dependencies:
       agent-base: 7.1.3
@@ -6736,6 +7060,10 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  iconv-lite@0.6.3:
+    dependencies:
+      safer-buffer: 2.1.2
+
   ignore@5.3.2: {}
 
   ignore@7.0.4: {}
@@ -6758,12 +7086,16 @@ snapshots:
 
   index-to-position@1.1.0: {}
 
+  inherits@2.0.4: {}
+
   internal-slot@1.1.0:
     dependencies:
       es-errors: 1.3.0
       hasown: 2.0.2
       side-channel: 1.1.0
 
+  ipaddr.js@1.9.1: {}
+
   is-absolute-url@4.0.1: {}
 
   is-array-buffer@3.0.5:
@@ -6862,6 +7194,8 @@ snapshots:
 
   is-plain-obj@4.1.0: {}
 
+  is-promise@4.0.0: {}
+
   is-regex@1.2.1:
     dependencies:
       call-bound: 1.0.4
@@ -7078,10 +7412,14 @@ snapshots:
 
   math-intrinsics@1.1.0: {}
 
+  media-typer@1.1.0: {}
+
   memorystream@0.3.1: {}
 
   meow@13.2.0: {}
 
+  merge-descriptors@2.0.0: {}
+
   merge2@1.4.1: {}
 
   micromatch@4.0.8:
@@ -7089,6 +7427,12 @@ snapshots:
       braces: 3.0.3
       picomatch: 2.3.1
 
+  mime-db@1.54.0: {}
+
+  mime-types@3.0.1:
+    dependencies:
+      mime-db: 1.54.0
+
   mime@3.0.0: {}
 
   mimic-function@5.0.1: {}
@@ -7154,6 +7498,8 @@ snapshots:
 
   natural-compare@1.4.0: {}
 
+  negotiator@1.0.0: {}
+
   node-releases@2.0.19: {}
 
   normalize-package-data@6.0.2:
@@ -7233,6 +7579,14 @@ snapshots:
 
   ohash@2.0.11: {}
 
+  on-finished@2.4.1:
+    dependencies:
+      ee-first: 1.1.1
+
+  once@1.4.0:
+    dependencies:
+      wrappy: 1.0.2
+
   onetime@7.0.0:
     dependencies:
       mimic-function: 5.0.1
@@ -7333,6 +7687,8 @@ snapshots:
       index-to-position: 1.1.0
       type-fest: 4.41.0
 
+  parseurl@1.3.3: {}
+
   path-exists@4.0.0: {}
 
   path-key@3.1.1: {}
@@ -7346,6 +7702,8 @@ snapshots:
 
   path-to-regexp@6.3.0: {}
 
+  path-to-regexp@8.2.0: {}
+
   path-type@6.0.0: {}
 
   pathe@2.0.3: {}
@@ -7374,6 +7732,8 @@ snapshots:
 
   pirates@4.0.7: {}
 
+  pkce-challenge@5.0.0: {}
+
   pkg-types@1.3.1:
     dependencies:
       confbox: 0.1.8
@@ -7423,6 +7783,11 @@ snapshots:
       object-assign: 4.1.1
       react-is: 16.13.1
 
+  proxy-addr@2.0.7:
+    dependencies:
+      forwarded: 0.2.0
+      ipaddr.js: 1.9.1
+
   punycode@2.3.1: {}
 
   qs@6.14.0:
@@ -7433,6 +7798,15 @@ snapshots:
 
   queue-microtask@1.2.3: {}
 
+  range-parser@1.2.1: {}
+
+  raw-body@3.0.0:
+    dependencies:
+      bytes: 3.1.2
+      http-errors: 2.0.0
+      iconv-lite: 0.6.3
+      unpipe: 1.0.0
+
   react-is@16.13.1: {}
 
   read-package-json-fast@4.0.0:
@@ -7549,6 +7923,16 @@ snapshots:
       '@rollup/rollup-win32-x64-msvc': 4.40.0
       fsevents: 2.3.3
 
+  router@2.2.0:
+    dependencies:
+      debug: 4.4.1(supports-color@10.0.0)
+      depd: 2.0.0
+      is-promise: 4.0.0
+      parseurl: 1.3.3
+      path-to-regexp: 8.2.0
+    transitivePeerDependencies:
+      - supports-color
+
   run-applescript@7.0.0: {}
 
   run-parallel@1.2.0:
@@ -7563,6 +7947,8 @@ snapshots:
       has-symbols: 1.1.0
       isarray: 2.0.5
 
+  safe-buffer@5.2.1: {}
+
   safe-push-apply@1.0.0:
     dependencies:
       es-errors: 1.3.0
@@ -7578,10 +7964,37 @@ snapshots:
     dependencies:
       regexp-tree: 0.1.27
 
+  safer-buffer@2.1.2: {}
+
   semver@6.3.1: {}
 
   semver@7.7.2: {}
 
+  send@1.2.0:
+    dependencies:
+      debug: 4.4.1(supports-color@10.0.0)
+      encodeurl: 2.0.0
+      escape-html: 1.0.3
+      etag: 1.8.1
+      fresh: 2.0.0
+      http-errors: 2.0.0
+      mime-types: 3.0.1
+      ms: 2.1.3
+      on-finished: 2.4.1
+      range-parser: 1.2.1
+      statuses: 2.0.1
+    transitivePeerDependencies:
+      - supports-color
+
+  serve-static@2.2.0:
+    dependencies:
+      encodeurl: 2.0.0
+      escape-html: 1.0.3
+      parseurl: 1.3.3
+      send: 1.2.0
+    transitivePeerDependencies:
+      - supports-color
+
   set-function-length@1.2.2:
     dependencies:
       define-data-property: 1.1.4
@@ -7604,6 +8017,8 @@ snapshots:
       es-errors: 1.3.0
       es-object-atoms: 1.1.1
 
+  setprototypeof@1.2.0: {}
+
   sharp@0.33.5:
     dependencies:
       color: 4.2.3
@@ -7732,6 +8147,8 @@ snapshots:
       as-table: 1.0.55
       get-source: 2.0.12
 
+  statuses@2.0.1: {}
+
   std-env@3.9.0: {}
 
   stdin-discarder@0.2.2: {}
@@ -7881,6 +8298,8 @@ snapshots:
 
   toad-cache@3.7.0: {}
 
+  toidentifier@1.0.1: {}
+
   toucan-js@4.1.1:
     dependencies:
       '@sentry/core': 8.9.2
@@ -7981,6 +8400,12 @@ snapshots:
 
   type-fest@4.41.0: {}
 
+  type-is@2.0.1:
+    dependencies:
+      content-type: 1.0.5
+      media-typer: 1.1.0
+      mime-types: 3.0.1
+
   typed-array-buffer@1.0.3:
     dependencies:
       call-bound: 1.0.4
@@ -8066,6 +8491,8 @@ snapshots:
 
   universal-user-agent@7.0.3: {}
 
+  unpipe@1.0.0: {}
+
   update-browserslist-db@1.1.3(browserslist@4.24.4):
     dependencies:
       browserslist: 4.24.4
@@ -8085,6 +8512,8 @@ snapshots:
       spdx-correct: 3.2.0
       spdx-expression-parse: 3.0.1
 
+  vary@1.1.2: {}
+
   vite-node@3.1.4(@types/node@22.15.21)(jiti@2.4.2)(tsx@4.19.4)(yaml@2.7.1):
     dependencies:
       cac: 6.7.14
@@ -8284,6 +8713,8 @@ snapshots:
       string-width: 7.2.0
       strip-ansi: 7.1.0
 
+  wrappy@1.0.2: {}
+
   ws@8.18.0: {}
 
   xtend@4.0.2: {}