Open Source

Note

Medium Risk
New destructive update tool can change saved cost reports via the API; layout/import moves are mechanical but touch many registered tools. No eval file appears in the diff though repo guidelines require one for new tools.

Overview
Adds update-cost-report, an MCP tool that PUTs to /v2/cost_reports/{token} with optional fields for title, VQL filter, groupings, dates, chart settings, folder, saved filters, business metrics, and report settings. It enforces paired previous-period and start/end dates and blocks mixing date_interval with explicit start/end dates via MCPUserError.

Relocates all cost-report tools from src/tools/ into src/tools/cost-reports/ (create, list, get, delete, forecast, update), adds a family index.ts, and switches the generated src/tools/index.ts to a single import "./cost-reports". Shared Zod for chart types, settings, business metrics, and create vs update defaults lives in schemas.ts; create-cost-report now imports those instead of inline duplicates.

Docs: writing-mcp-tools and AGENTS.md now require moving same-resource siblings into nested folders and document schemas.ts / cost-reports as the reference layout.

Note

Low Risk
Documentation-only changes; no application or tool runtime behavior is modified.

Overview
Adds agent skills under .agents/skills/ for writing MCP tools and writing evals, and rewires contributor docs so agents and humans follow those guides instead of copying legacy patterns.

writing-mcp-tools documents the target conventions: resource-nested tool layout, registerTool / testTool patterns, MCP annotation table (including create-* as non-destructive), minimal descriptions with strong zod .describe() strings, optional outputSchema, and a PR checklist tied to evals.

writing-evals documents the intended evalite workflow (per-file runs, committed evalite.db, prompt matrix, distractors, failure diagnosis) ahead of a follow-up PR that lands the eval harness.

AGENTS.md is replaced with a short router: links to the skills, invariants (zod/v4, pathEncode, MCPUserError, delete/204 behavior), explicit known drift warnings, and verification steps (evals not in CI).

README.md drops the old inline “add a tool” snippet in favor of pointing at the skills, adds a Running Evals section (baseline db, GitHub Pages UI, eval:export), and lists npm run eval* scripts.

Note

Medium Risk
Touches OAuth login/callback flow by switching cookie sameSite/secure behavior to depend on ENVIRONMENT, which could affect authentication if the variable is misconfigured. Remaining changes are mostly type-safety and HTML reformatting noise.

Overview
Introduces src/env.ts with an AppEnv type (a typed ENVIRONMENT plus the generated Env) and updates the worker and OAuth handlers to use it, removing the bespoke RequiredEnv type and related as ... casts.

OAuth consent cookie options now derive sameSite/secure from c.env.ENVIRONMENT instead of a hardcoded development constant. Also adds tmp/* to .gitignore and reformats the consent/homepage HTML templates (no behavioral intent).

Note

Low Risk
Tooling-only configuration changes (formatter/blame settings) with no runtime behavior impact beyond code style enforcement.

Overview
Aligns Biome formatting defaults by switching to 2-space indentation and updating lineWidth to 120 (moved under javascript.formatter), with the config files re-formatted accordingly.

Adds .git-blame-ignore-revs to ignore the formatter-only commit in git blame, and reindents commitlint.config.js to match the new style.

Note

Medium Risk
Introduces a new destructive endpoint wrapper (delete) and surfaces backend errors to users; incorrect usage could lead to irreversible deletions, though the change is small and covered by tests.

Overview
Adds two new MCP tools for cost reports: get-cost-report (GET /v2/cost_reports/:token) and delete-cost-report (DELETE /v2/cost_reports/:token), both using pathEncode for token safety.

Both tools convert API failures into MCPUserError and include Vitest coverage for success/error responses; the tools are registered via the auto-generated src/tools/index.ts (with delete-cost-report marked destructive).

Note

Medium Risk
Mostly additive tooling and tests, but the callApi change affects all API calls and could change behavior for any endpoint that legitimately returns 204 or previously failed JSON parsing on empty bodies.

Overview
Adds new Folder tools: get-folder, update-folder, and destructive delete-folder, each calling the /v2/folders/{token} endpoints and surfacing API failures as MCPUserError (with new Vitest coverage).

Updates the shared callApi helper to treat HTTP 204 No Content as a successful response returning data: undefined, and loosens the test harness API-call typing to allow undefined success data (needed for DELETE).

Note

Low Risk
Adds isolated new tool endpoints with straightforward request/response plumbing and tests; minimal impact on existing behavior aside from tool registration.

Overview
Adds two new tools: get-anomaly (read-only) to fetch an anomaly alert by token via GET /v2/anomaly_alerts/:token, and update-anomaly to update an alert’s status (active/archived/ignored) with optional feedback via PUT /v2/anomaly_alerts/:token.

Registers both tools in the auto-generated src/tools/index.ts, and adds Vitest coverage that validates argument schemas and that non-ok API responses are surfaced as MCPUserError payloads.