Open Source

What Changed

Added CRUD tools for Network Flow Reports and a tool for querying the logs similar to the query-costs tool

Testing Done

Unit tests added
Tested again a local data set

Note

Medium Risk
Introduces create/update/delete tools that mutate saved reports, but behavior follows existing report-tool patterns with strong validation and tests; the client minor bump is the main external dependency change.

Overview
Adds six MCP tools for Vantage Network Flow Reports and log queries, wired through @vantage-sh/vantage-client 2.7.0 (bumped from 2.6.0).

Agents can list, get, create, update, and delete saved reports via /v2/network_flow_reports, with path-encoded report tokens on single-resource routes. Create/update share schemas.ts validation: custom ranges require date_interval=custom plus paired start_date/end_date.

query-network-flow-logs hits /v2/network_flow_logs for aggregated traffic (costs/bytes, sampling metadata, pagination). It supports a saved report token or an ad hoc VQL filter (workspace + dates required); custom ranges use start_date/end_date without date_interval=custom, and relative intervals cannot mix with explicit dates.

The new network-flow-reports barrel is registered from src/tools/index.ts. Vitest coverage mirrors other report tool modules.

^{Reviewed by}Cursor Bugbot for commit e3f65a3. Bugbot is set up for automated code reviews on this repo. Configure here.

Summary

Adds a sync-from-core.yml workflow that mirrors vantage-go's receiver
Listens for repository_dispatch events with type vantage-core-api-sync from vantage-sh/core
Regenerates the SDK via npm run generate and opens a PR when changes are detected

Companion PR

Requires a matching dispatch workflow in vantage-sh/core (sync-vantage-ts.yml).

Test plan

Merge companion core PR
Manually run workflow via workflow_dispatch and confirm generation succeeds
Merge an API change to core master and confirm automated PR opens in vantage-ts

Made with Cursor

What Changed

Need to be able to trigger this manually, the last PR bump didn't work

Note

Low Risk
CI-only workflow trigger and guard changes; no application or publish logic was modified.

Overview
Manual runs: The Housekeeping workflow can now be started from the Actions UI via workflow_dispatch, so version PR generation and publish can be retried without waiting for a main push.

Safety on manual triggers: Both generate-version-pr and publish now run only when github.ref == 'refs/heads/main', so a manual run on another branch does not execute those jobs.

^{Reviewed by}Cursor Bugbot for commit 3c21ca4. Bugbot is set up for automated code reviews on this repo. Configure here.

What Changed

Remove sending any PII to Sentry. We only care about code crashes

Note

Low Risk
Single Sentry config flag change with no auth or business-logic impact; slightly less diagnostic context in Sentry events.

Overview
Disables Sentry’s default PII collection on the Cloudflare worker by setting sendDefaultPii to false in the Sentry.withSentry options in cf-worker.ts.

Crash and trace reporting (dsn, release, tracesSampleRate) is unchanged; Sentry will no longer automatically attach request headers and client IP that sendDefaultPii: true would have included.

^{Reviewed by}Cursor Bugbot for commit d2b5968. Bugbot is set up for automated code reviews on this repo. Configure here.

What Changed

Adding automatic creation of GitHub releases to our CI so the latest GitHub release matches the latest NPM release

Also fixed an issue I created when I deleted README.local.md. I did not realize that was being used for the NPM release. I added the file back at README.npmjs.md

Note

Low Risk
Changes are limited to CI release automation, documentation, and a version constant; no runtime auth or API behavior changes.

Overview
Release housekeeping now creates a matching GitHub Release for each published version (via gh release create with generated notes), with idempotent checks so existing tags/releases are skipped. The publish step also sets GH_TOKEN and returns to the repo root after npm publish.

npm package docs are restored by adding README.npmjs.md (client setup for vantage-mcp-server) and wiring build/npm.ts to copy it into local-package/README.md instead of the removed README.local.md.

Version bumped to 2.16.0 in SERVER_VERSION.

^{Reviewed by}Cursor Bugbot for commit de40e2b. Bugbot is set up for automated code reviews on this repo. Configure here.

What Changed

Working on setting up a staging environment for our agent and I want that to point to a separate staging environment for the MCP server that in turn points to our staging API.

I consolidated the wrangler files into a single file and then updated the GitHub Actions to use the environment for the deploy. There is a separate action to deploy staging so we can manually deploy it from a branch if we need to anything specific.

Testing Done

Confirmed the staging MCP is working in Codex

Note

Medium Risk
Changes production and staging deploy paths, OAuth cookie behavior for staging, and Wrangler/env wiring—mistakes could break deploys or auth on hosted environments.

Overview
Adds a staging Cloudflare Worker deployment at hosted-mcp-staging.vantage.sh that calls https://api.staging.vantage.sh, so agents and other clients can exercise the hosted MCP against staging Vantage.

Wrangler is consolidated from separate wrangler-DEV.jsonc / wrangler-PROD.jsonc files into a single wrangler.jsonc with development, staging, and production env blocks. Local dev and typegen now use wrangler dev --env development and .dev.vars.development (documented via expanded .dev.vars.example).

GitHub Actions: production deploy uses deploy --env production (Wrangler 4.80.0); a new Deploy Worker Staging workflow deploys --env staging on pushes to main and supports workflow_dispatch with an optional ref for branch-specific staging deploys.

OAuth cookies in src/auth.ts now treat any non-development env (including staging) as hosted: SameSite=None and secure cookies. AppEnv includes "staging" as a valid ENVIRONMENT.

README is reworked to prioritize the hosted MCP at https://mcp.vantage.sh/mcp and per-client setup; README.local.md is removed and self-host content is folded into the main README.

^{Reviewed by Cursor Bugbot for commit 82b678f. Bugbot is set up for automated code reviews on this repo. Configure here.}

What Changed

Previously missed adding an update-cost-report tool.

Additionally nested all the cost report tools in a cost-report folder.

Testing Done

Unit tests added

Note

Medium Risk
New destructive update tool can change saved cost reports via the API; layout/import moves are mechanical but touch many registered tools. No eval file appears in the diff though repo guidelines require one for new tools.

Overview
Adds update-cost-report, an MCP tool that PUTs to /v2/cost_reports/{token} with optional fields for title, VQL filter, groupings, dates, chart settings, folder, saved filters, business metrics, and report settings. It enforces paired previous-period and start/end dates and blocks mixing date_interval with explicit start/end dates via MCPUserError.

Relocates all cost-report tools from src/tools/ into src/tools/cost-reports/ (create, list, get, delete, forecast, update), adds a family index.ts, and switches the generated src/tools/index.ts to a single import "./cost-reports". Shared Zod for chart types, settings, business metrics, and create vs update defaults lives in schemas.ts; create-cost-report now imports those instead of inline duplicates.

Docs: writing-mcp-tools and AGENTS.md now require moving same-resource siblings into nested folders and document schemas.ts / cost-reports as the reference layout.

^{Reviewed by}Cursor Bugbot for commit 67c53bc. Bugbot is set up for automated code reviews on this repo. Configure here.

What Changed

Catching this repo up on the agents package. Through that process we have to migrate explicitly to zod v4. We're already using v4 everywhere so now we can drop the zod/v4 import for just zod.

Testing Done

All lints / unit tests pass
Tested again local agent harness to ensure everything still works

Note

Medium Risk
Major bumps to agents and Zod v4 plus a large lockfile refresh can affect runtime validation and agent/MCP behavior; changes are mostly dependency and import paths with no intentional tool logic edits.

Overview
This PR bumps core dependencies and standardizes Zod imports across the MCP server.

package.json raises agents from 0.3.10 to ^0.13.2, zod from v3 to ^4.4.3, and @modelcontextprotocol/sdk to 1.29.0. The npm overrides entry that pinned the MCP SDK is removed. package-lock.json is regenerated with the new transitive tree (including tooling pulled in by the newer agents stack).

Across src/tools/**, every former import … from "zod/v4" is switched to import … from "zod" (including registerTool, tests, and dateValidator). Tool schemas and API behavior are unchanged—this is an import and dependency alignment pass, not new MCP capabilities.

^{Reviewed by Cursor Bugbot for commit a4dec47. Bugbot is set up for automated code reviews on this repo. Configure here.}

What Changed

Applies the writing-mcp-tools to the get-myself tool. Nests the tool in a directory and adds an output schema.

Testing Done

Unit tests pass
Tested locally that everything still works

Note

Low Risk
Read-only auth introspection tool relocation and doc/test updates only; no API or security behavior change in the diff.

Overview
Moves get-myself into a nested src/tools/current-user/ package (with index.ts and regenerated src/tools/index.ts) and fixes imports/paths in the tool and its tests. Tests now use the shared ../utils/testing helper and add an output-schema test table (valid /v2/me fixture) alongside existing success/failure execution cases; the tool description is tightened slightly.

AGENTS.md points the output-schema example at current-user/get-myself. The writing-mcp-tools skill drops the long outputSchema how-to, related checklist items, and the get-myself reference from the anatomy list—documentation now matches the default testTool 3-arg pattern unless output tests are explicitly used.

^{Reviewed by Cursor Bugbot for commit 815a137. Bugbot is set up for automated code reviews on this repo. Configure here.}

What Changed

Adding two skills describing best practices for writing new tools and adding evals.

For writing new tools, the existing set of tools do not all conform to this skill at the moment. The plan is to apply this skill to the existing ones to create uniformity.

For evals, I have a bunch of local work I will put up in a separate PR to scaffold out the eval framework.

Note

Low Risk
Documentation-only changes; no application or tool runtime behavior is modified.

Overview
Adds agent skills under .agents/skills/ for writing MCP tools and writing evals, and rewires contributor docs so agents and humans follow those guides instead of copying legacy patterns.

writing-mcp-tools documents the target conventions: resource-nested tool layout, registerTool / testTool patterns, MCP annotation table (including create-* as non-destructive), minimal descriptions with strong zod .describe() strings, optional outputSchema, and a PR checklist tied to evals.

writing-evals documents the intended evalite workflow (per-file runs, committed evalite.db, prompt matrix, distractors, failure diagnosis) ahead of a follow-up PR that lands the eval harness.

AGENTS.md is replaced with a short router: links to the skills, invariants (zod/v4, pathEncode, MCPUserError, delete/204 behavior), explicit known drift warnings, and verification steps (evals not in CI).

README.md drops the old inline “add a tool” snippet in favor of pointing at the skills, adds a Running Evals section (baseline db, GitHub Pages UI, eval:export), and lists npm run eval* scripts.

^{Reviewed by}Cursor Bugbot for commit 4a2e21d. Bugbot is set up for automated code reviews on this repo. Configure here.

What Changed

Set up optional OTel tracing code so that we can create correlated traces back to our API server

Testing Done

Tested locally exporting via dd-agent
Updated Unit tests

Note

Medium Risk
Adds new tracing and context propagation across the Worker, Durable Object tool execution, and outbound API calls; while intended to be optional, it changes request handling and header injection paths that could affect observability and runtime behavior.

Overview
Adds optional OpenTelemetry/OTLP tracing to correlate Worker requests, MCP tool executions, and outbound Vantage API calls.

The Worker fetch is now wrapped with tracer.wrapFetchHandler, forwards the active traceparent/tracestate into downstream MCP/Durable Object requests, and callApi now uses tracer.traceFetch for traced outbound HTTP calls. Tool registration (registerTool) now creates per-tool spans (parented from incoming request headers) and passes env/waitUntil through the tool execution context.

Introduces a new src/tracing module (span lifecycle, OTLP JSON payload builder/exporter, sampling/config via OTEL_* env vars), adds .dev.vars.example entries for these vars, and adds comprehensive unit tests plus a vitest.config.ts include pattern.

^{Reviewed by Cursor Bugbot for commit c6f47ed. Bugbot is set up for automated code reviews on this repo. Configure here.}

What Changed

Sorry for noise! I reformatted a couple HTML blocks and regenerated the workers-configuration.d.ts which created a huge diff.

What I actually changed

Added src/env.ts and the AppEnv type which extends the generated Env.

This change is a preface for some work I'm doing to add a bunch of optional environment variable for tracing. This change also removed a bunch of as RequiredEnv casts

Note

Medium Risk
Touches OAuth login/callback flow by switching cookie sameSite/secure behavior to depend on ENVIRONMENT, which could affect authentication if the variable is misconfigured. Remaining changes are mostly type-safety and HTML reformatting noise.

Overview
Introduces src/env.ts with an AppEnv type (a typed ENVIRONMENT plus the generated Env) and updates the worker and OAuth handlers to use it, removing the bespoke RequiredEnv type and related as ... casts.

OAuth consent cookie options now derive sameSite/secure from c.env.ENVIRONMENT instead of a hardcoded development constant. Also adds tmp/* to .gitignore and reformats the consent/homepage HTML templates (no behavioral intent).

^{Reviewed by}Cursor Bugbot for commit 47a8e95. Bugbot is set up for automated code reviews on this repo. Configure here.

What Changed

I bumped the agent version in #64 but I forgot to include updating new variables in the Chart. This PR properly exposes VANTAGE_ALLOWED_LABELS

What Changed

Fixing the publishing workflow. Same approach as on the MCP Server vantage-sh/vantage-mcp-server#97

What Changed

Changed the Biome formatter to match the rest of our projects
Fixed other lint warnings

Note

Low Risk
Tooling-only configuration changes (formatter/blame settings) with no runtime behavior impact beyond code style enforcement.

Overview
Aligns Biome formatting defaults by switching to 2-space indentation and updating lineWidth to 120 (moved under javascript.formatter), with the config files re-formatted accordingly.

Adds .git-blame-ignore-revs to ignore the formatter-only commit in git blame, and reindents commitlint.config.js to match the new style.

^{Reviewed by}Cursor Bugbot for commit 89a4453. Bugbot is set up for automated code reviews on this repo. Configure here.

I would like us to set up auto approval to the house keeping PRs, such as #111 so that we don't have to remember to merge them. First step is to set the PR to be on auto merge. Then we'll need to set up functionality to automatically add an approval

Note

Low Risk
Small change to release automation that only adds an extra gh CLI call; primary risk is unintended auto-merging if branch/PR targeting is misconfigured.

Overview
After creating the automated-bump version PR, generate-version-pr.ts now runs gh pr merge --auto --squash to enable auto-merge for that PR, reducing manual housekeeping.

The change only affects the post-creation step of the existing release automation; dry-run behavior remains unchanged.

^{Reviewed by Cursor Bugbot for commit a84b88a. Bugbot is set up for automated code reviews on this repo. Configure here.}

Open Source

My open source contributions

Move shared utils out of tools and set up test/

What Changed

Test plan

Chain GHA

What Changed

Add auto-merge.

What Changed

Update automation to auto bump the package version

What Changed

Add tools for network flow reports

What Changed

Testing Done

chore: add sync-from-core workflow for vantage-core API changes

Summary

Companion PR

Test plan

Add workflow dispatch to housekeeping

What Changed

Don't need to send PII to Sentry

What Changed

feat: Add workspace_token to update-dashboard

Summary

Test plan

Keep npm and GitHub tags/releases in sync

What Changed

Change our GHA to allow dependabot PRs though

What Changed

Add staging environment

What Changed

Testing Done

Bump version -> 2.4.0

What Changed

Add update-cost-report tool

What Changed

Testing Done

Update `agents` & `zod`

What Changed

Testing Done

feat: Apply new skill to get-myself.

What Changed

Testing Done

Add Agent Skills for writing tools and evals.

What Changed

Add Optional OTel Tracing

What Changed

Testing Done

Add AppEnv type

What Changed

Add allowed labels to Chart

What Changed

chore: Bump agent appVersion to 1.2.2.

What Changed

Fix the publishing workflow

What Changed

Add Biome

What Changed

Change Biome formatting / Fix lint warnings

What Changed

Add auto-merge to housekeeping