From c08f7c04267e000d51cfad22ec8337e456d20171 Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Mon, 2 Feb 2026 12:34:56 +0000
Subject: [PATCH 01/13] fix(client): avoid memory leak with abort signals

---
 src/client.ts | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/client.ts b/src/client.ts
index ef1cc2fb..2ac1780d 100644
--- a/src/client.ts
+++ b/src/client.ts
@@ -599,9 +599,10 @@ export class ImageKit {
     controller: AbortController,
   ): Promise<Response> {
     const { signal, method, ...options } = init || {};
-    if (signal) signal.addEventListener('abort', () => controller.abort());
+    const abort = controller.abort.bind(controller);
+    if (signal) signal.addEventListener('abort', abort, { once: true });
 
-    const timeout = setTimeout(() => controller.abort(), ms);
+    const timeout = setTimeout(abort, ms);
 
     const isReadableBody =
       ((globalThis as any).ReadableStream && options.body instanceof (globalThis as any).ReadableStream) ||

From 4b5fcbfd1188573ccd1cea40b8e4924a5e2051dc Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Mon, 2 Feb 2026 16:28:14 +0000
Subject: [PATCH 02/13] chore(client): do not parse responses with empty
 content-length

---
 src/internal/parse.ts | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/internal/parse.ts b/src/internal/parse.ts
index 10d1ca90..611cd86d 100644
--- a/src/internal/parse.ts
+++ b/src/internal/parse.ts
@@ -29,6 +29,12 @@ export async function defaultParseResponse<T>(client: ImageKit, props: APIRespon
     const mediaType = contentType?.split(';')[0]?.trim();
     const isJSON = mediaType?.includes('application/json') || mediaType?.endsWith('+json');
     if (isJSON) {
+      const contentLength = response.headers.get('content-length');
+      if (contentLength === '0') {
+        // if there is no content we can't do anything
+        return undefined as T;
+      }
+
       const json = await response.json();
       return json as T;
     }

From 5f6c688f4f41df60d88fce94bc10cfdce4e29d78 Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Tue, 3 Feb 2026 00:16:32 +0000
Subject: [PATCH 03/13] chore(internal): support oauth authorization code flow
 for MCP servers

---
 packages/mcp-server/package.json   | 4 ++++
 packages/mcp-server/src/headers.ts | 4 +++-
 packages/mcp-server/src/http.ts    | 9 +++++----
 packages/mcp-server/src/options.ts | 1 +
 4 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/packages/mcp-server/package.json b/packages/mcp-server/package.json
index 56c2098f..bdc0aa0f 100644
--- a/packages/mcp-server/package.json
+++ b/packages/mcp-server/package.json
@@ -34,10 +34,12 @@
     "@cloudflare/cabidela": "^0.2.4",
     "@modelcontextprotocol/sdk": "^1.25.2",
     "@valtown/deno-http-worker": "^0.0.21",
+    "cookie-parser": "^1.4.6",
     "cors": "^2.8.5",
     "express": "^5.1.0",
     "fuse.js": "^7.1.0",
     "jq-web": "https://github.com/stainless-api/jq-web/releases/download/v0.8.8/jq-web.tar.gz",
+    "morgan": "^1.10.0",
     "qs": "^6.14.1",
     "typescript": "5.8.3",
     "yargs": "^17.7.2",
@@ -50,9 +52,11 @@
   },
   "devDependencies": {
     "@anthropic-ai/mcpb": "^2.1.2",
+    "@types/cookie-parser": "^1.4.10",
     "@types/cors": "^2.8.19",
     "@types/express": "^5.0.3",
     "@types/jest": "^29.4.0",
+    "@types/morgan": "^1.9.10",
     "@types/qs": "^6.14.0",
     "@types/yargs": "^17.0.8",
     "@typescript-eslint/eslint-plugin": "8.31.1",
diff --git a/packages/mcp-server/src/headers.ts b/packages/mcp-server/src/headers.ts
index 40fd3090..1efed985 100644
--- a/packages/mcp-server/src/headers.ts
+++ b/packages/mcp-server/src/headers.ts
@@ -3,7 +3,7 @@
 import { IncomingMessage } from 'node:http';
 import { ClientOptions } from '@imagekit/nodejs';
 
-export const parseAuthHeaders = (req: IncomingMessage): Partial<ClientOptions> => {
+export const parseAuthHeaders = (req: IncomingMessage, required?: boolean): Partial<ClientOptions> => {
   if (req.headers.authorization) {
     const scheme = req.headers.authorization.split(' ')[0]!;
     const value = req.headers.authorization.slice(scheme.length + 1);
@@ -19,6 +19,8 @@ export const parseAuthHeaders = (req: IncomingMessage): Partial<ClientOptions> =
           'Unsupported authorization scheme. Expected the "Authorization" header to be a supported scheme (Basic).',
         );
     }
+  } else if (required) {
+    throw new Error('Missing required Authorization header; see WWW-Authenticate header for details.');
   }
 
   const privateKey =
diff --git a/packages/mcp-server/src/http.ts b/packages/mcp-server/src/http.ts
index dcfeba6a..42eb5002 100644
--- a/packages/mcp-server/src/http.ts
+++ b/packages/mcp-server/src/http.ts
@@ -2,8 +2,8 @@
 
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
-
 import express from 'express';
+import morgan from 'morgan';
 import { McpOptions } from './options';
 import { ClientOptions, initMcpServer, newMcpServer } from './server';
 import { parseAuthHeaders } from './headers';
@@ -20,7 +20,7 @@ const newServer = ({
   const server = newMcpServer();
 
   try {
-    const authOptions = parseAuthHeaders(req);
+    const authOptions = parseAuthHeaders(req, false);
     initMcpServer({
       server: server,
       clientOptions: {
@@ -75,14 +75,15 @@ const del = async (req: express.Request, res: express.Response) => {
 
 export const streamableHTTPApp = ({
   clientOptions = {},
-  mcpOptions = {},
+  mcpOptions,
 }: {
   clientOptions?: ClientOptions;
-  mcpOptions?: McpOptions;
+  mcpOptions: McpOptions;
 }): express.Express => {
   const app = express();
   app.set('query parser', 'extended');
   app.use(express.json());
+  app.use(morgan('combined'));
 
   app.get('/', get);
   app.post('/', post({ clientOptions, mcpOptions }));
diff --git a/packages/mcp-server/src/options.ts b/packages/mcp-server/src/options.ts
index c66ad8ce..025280ec 100644
--- a/packages/mcp-server/src/options.ts
+++ b/packages/mcp-server/src/options.ts
@@ -35,6 +35,7 @@ export function parseCLIOptions(): CLIOptions {
     })
     .option('port', {
       type: 'number',
+      default: 3000,
       description: 'Port to serve on if using http transport',
     })
     .option('socket', {

From 46c04e16c46bca7bc1b0383d151f027d7d918611 Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Wed, 4 Feb 2026 18:40:04 +0000
Subject: [PATCH 04/13] chore(client): restructure abort controller binding

---
 src/client.ts | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/client.ts b/src/client.ts
index 2ac1780d..220345d2 100644
--- a/src/client.ts
+++ b/src/client.ts
@@ -599,7 +599,7 @@ export class ImageKit {
     controller: AbortController,
   ): Promise<Response> {
     const { signal, method, ...options } = init || {};
-    const abort = controller.abort.bind(controller);
+    const abort = this._makeAbort(controller);
     if (signal) signal.addEventListener('abort', abort, { once: true });
 
     const timeout = setTimeout(abort, ms);
@@ -625,6 +625,7 @@ export class ImageKit {
       return await this.fetch.call(undefined, url, fetchOptions);
     } finally {
       clearTimeout(timeout);
+      if (signal) signal.removeEventListener('abort', abort);
     }
   }
 
@@ -769,6 +770,12 @@ export class ImageKit {
     return headers.values;
   }
 
+  private _makeAbort(controller: AbortController) {
+    // note: we can't just inline this method inside `fetchWithTimeout()` because then the closure
+    //       would capture all request options, and cause a memory leak.
+    return () => controller.abort();
+  }
+
   private buildBody({ options: { body, headers: rawHeaders } }: { options: FinalRequestOptions }): {
     bodyHeaders: HeadersLike;
     body: BodyInit | undefined;

From ff4b97e40fb46ca0b4f3229074c3f614b045641c Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Wed, 4 Feb 2026 19:12:32 +0000
Subject: [PATCH 05/13] chore(internal): refactor flag parsing for MCP servers
 and add debug flag

---
 packages/mcp-server/package.json   |  1 +
 packages/mcp-server/src/http.ts    | 27 ++++++++++++++++++++++-----
 packages/mcp-server/src/index.ts   |  6 +++++-
 packages/mcp-server/src/options.ts | 28 +++++++++++++++-------------
 4 files changed, 43 insertions(+), 19 deletions(-)

diff --git a/packages/mcp-server/package.json b/packages/mcp-server/package.json
index bdc0aa0f..b289c973 100644
--- a/packages/mcp-server/package.json
+++ b/packages/mcp-server/package.json
@@ -40,6 +40,7 @@
     "fuse.js": "^7.1.0",
     "jq-web": "https://github.com/stainless-api/jq-web/releases/download/v0.8.8/jq-web.tar.gz",
     "morgan": "^1.10.0",
+    "morgan-body": "^2.6.9",
     "qs": "^6.14.1",
     "typescript": "5.8.3",
     "yargs": "^17.7.2",
diff --git a/packages/mcp-server/src/http.ts b/packages/mcp-server/src/http.ts
index 42eb5002..3d728ecc 100644
--- a/packages/mcp-server/src/http.ts
+++ b/packages/mcp-server/src/http.ts
@@ -4,6 +4,7 @@ import { McpServer } from '@modelcontextprotocol/sdk/server/mcp';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
 import express from 'express';
 import morgan from 'morgan';
+import morganBody from 'morgan-body';
 import { McpOptions } from './options';
 import { ClientOptions, initMcpServer, newMcpServer } from './server';
 import { parseAuthHeaders } from './headers';
@@ -76,14 +77,26 @@ const del = async (req: express.Request, res: express.Response) => {
 export const streamableHTTPApp = ({
   clientOptions = {},
   mcpOptions,
+  debug,
 }: {
   clientOptions?: ClientOptions;
   mcpOptions: McpOptions;
+  debug: boolean;
 }): express.Express => {
   const app = express();
   app.set('query parser', 'extended');
   app.use(express.json());
-  app.use(morgan('combined'));
+
+  if (debug) {
+    morganBody(app, {
+      logAllReqHeader: true,
+      logAllResHeader: true,
+      logRequestBody: true,
+      logResponseBody: true,
+    });
+  } else {
+    app.use(morgan('combined'));
+  }
 
   app.get('/', get);
   app.post('/', post({ clientOptions, mcpOptions }));
@@ -92,9 +105,13 @@ export const streamableHTTPApp = ({
   return app;
 };
 
-export const launchStreamableHTTPServer = async (options: McpOptions, port: number | string | undefined) => {
-  const app = streamableHTTPApp({ mcpOptions: options });
-  const server = app.listen(port);
+export const launchStreamableHTTPServer = async (params: {
+  mcpOptions: McpOptions;
+  debug: boolean;
+  port: number | string | undefined;
+}) => {
+  const app = streamableHTTPApp({ mcpOptions: params.mcpOptions, debug: params.debug });
+  const server = app.listen(params.port);
   const address = server.address();
 
   if (typeof address === 'string') {
@@ -102,6 +119,6 @@ export const launchStreamableHTTPServer = async (options: McpOptions, port: numb
   } else if (address !== null) {
     console.error(`MCP Server running on streamable HTTP on port ${address.port}`);
   } else {
-    console.error(`MCP Server running on streamable HTTP on port ${port}`);
+    console.error(`MCP Server running on streamable HTTP on port ${params.port}`);
   }
 };
diff --git a/packages/mcp-server/src/index.ts b/packages/mcp-server/src/index.ts
index 0f6dd426..d75968e3 100644
--- a/packages/mcp-server/src/index.ts
+++ b/packages/mcp-server/src/index.ts
@@ -21,7 +21,11 @@ async function main() {
       await launchStdioServer();
       break;
     case 'http':
-      await launchStreamableHTTPServer(options, options.port ?? options.socket);
+      await launchStreamableHTTPServer({
+        mcpOptions: options,
+        debug: options.debug,
+        port: options.port ?? options.socket,
+      });
       break;
   }
 }
diff --git a/packages/mcp-server/src/options.ts b/packages/mcp-server/src/options.ts
index 025280ec..74380833 100644
--- a/packages/mcp-server/src/options.ts
+++ b/packages/mcp-server/src/options.ts
@@ -4,6 +4,7 @@ import { hideBin } from 'yargs/helpers';
 import z from 'zod';
 
 export type CLIOptions = McpOptions & {
+  debug: boolean;
   transport: 'stdio' | 'http';
   port: number | undefined;
   socket: string | undefined;
@@ -15,17 +16,24 @@ export type McpOptions = {
 
 export function parseCLIOptions(): CLIOptions {
   const opts = yargs(hideBin(process.argv))
-    .option('tools', {
+    .option('debug', { type: 'boolean', description: 'Enable debug logging' })
+    .option('no-tools', {
       type: 'string',
       array: true,
       choices: ['code', 'docs'],
-      description: 'Use dynamic tools or all tools',
+      description: 'Tools to explicitly disable',
     })
-    .option('no-tools', {
+    .option('port', {
+      type: 'number',
+      default: 3000,
+      description: 'Port to serve on if using http transport',
+    })
+    .option('socket', { type: 'string', description: 'Unix socket to serve on if using http transport' })
+    .option('tools', {
       type: 'string',
       array: true,
       choices: ['code', 'docs'],
-      description: 'Do not use any dynamic or all tools',
+      description: 'Tools to explicitly enable',
     })
     .option('transport', {
       type: 'string',
@@ -33,15 +41,8 @@ export function parseCLIOptions(): CLIOptions {
       default: 'stdio',
       description: 'What transport to use; stdio for local servers or http for remote servers',
     })
-    .option('port', {
-      type: 'number',
-      default: 3000,
-      description: 'Port to serve on if using http transport',
-    })
-    .option('socket', {
-      type: 'string',
-      description: 'Unix socket to serve on if using http transport',
-    })
+    .env('MCP_SERVER')
+    .version(true)
     .help();
 
   const argv = opts.parseSync();
@@ -57,6 +58,7 @@ export function parseCLIOptions(): CLIOptions {
 
   return {
     ...(includeDocsTools !== undefined && { includeDocsTools }),
+    debug: !!argv.debug,
     transport,
     port: argv.port,
     socket: argv.socket,

From cdce131dc17fba5469393a285ac536acd74742b2 Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Wed, 4 Feb 2026 19:33:03 +0000
Subject: [PATCH 06/13] feat(mcp): add initial server instructions

Adds generated MCP server instructions, to help agents get easy tasks on the first try.
---
 packages/mcp-server/src/http.ts   | 10 +++----
 packages/mcp-server/src/server.ts | 48 +++++++++++++++++++++++++++----
 packages/mcp-server/src/stdio.ts  |  4 +--
 3 files changed, 49 insertions(+), 13 deletions(-)

diff --git a/packages/mcp-server/src/http.ts b/packages/mcp-server/src/http.ts
index 3d728ecc..1f851cb6 100644
--- a/packages/mcp-server/src/http.ts
+++ b/packages/mcp-server/src/http.ts
@@ -9,7 +9,7 @@ import { McpOptions } from './options';
 import { ClientOptions, initMcpServer, newMcpServer } from './server';
 import { parseAuthHeaders } from './headers';
 
-const newServer = ({
+const newServer = async ({
   clientOptions,
   req,
   res,
@@ -17,12 +17,12 @@ const newServer = ({
   clientOptions: ClientOptions;
   req: express.Request;
   res: express.Response;
-}): McpServer | null => {
-  const server = newMcpServer();
+}): Promise<McpServer | null> => {
+  const server = await newMcpServer();
 
   try {
     const authOptions = parseAuthHeaders(req, false);
-    initMcpServer({
+    await initMcpServer({
       server: server,
       clientOptions: {
         ...clientOptions,
@@ -46,7 +46,7 @@ const newServer = ({
 const post =
   (options: { clientOptions: ClientOptions; mcpOptions: McpOptions }) =>
   async (req: express.Request, res: express.Response) => {
-    const server = newServer({ ...options, req, res });
+    const server = await newServer({ ...options, req, res });
     // If we return null, we already set the authorization error.
     if (server === null) return;
     const transport = new StreamableHTTPServerTransport();
diff --git a/packages/mcp-server/src/server.ts b/packages/mcp-server/src/server.ts
index 7b26259a..d1c7cbf6 100644
--- a/packages/mcp-server/src/server.ts
+++ b/packages/mcp-server/src/server.ts
@@ -17,23 +17,59 @@ import { HandlerFunction, McpTool } from './types';
 export { McpOptions } from './options';
 export { ClientOptions } from '@imagekit/nodejs';
 
-export const newMcpServer = () =>
+async function getInstructions() {
+  // This API key is optional; providing it allows the server to fetch instructions for unreleased versions.
+  const stainlessAPIKey = readEnv('STAINLESS_API_KEY');
+  const response = await fetch(
+    readEnv('CODE_MODE_INSTRUCTIONS_URL') ?? 'https://api.stainless.com/api/ai/instructions/imagekit',
+    {
+      method: 'GET',
+      headers: { ...(stainlessAPIKey && { Authorization: stainlessAPIKey }) },
+    },
+  );
+
+  let instructions: string | undefined;
+  if (!response.ok) {
+    console.warn(
+      'Warning: failed to retrieve MCP server instructions. Proceeding with default instructions...',
+    );
+
+    instructions = `
+      This is the imagekit MCP server. You will use Code Mode to help the user perform
+      actions. You can use search_docs tool to learn about how to take action with this server. Then, 
+      you will write TypeScript code using the execute tool take action. It is CRITICAL that you be 
+      thoughtful and deliberate when executing code. Always try to entirely solve the problem in code 
+      block: it can be as long as you need to get the job done! 
+    `;
+  }
+
+  instructions ??= ((await response.json()) as { instructions: string }).instructions;
+  instructions = `
+    The current time in Unix timestamps is ${Date.now()}.
+
+    ${instructions}
+  `;
+
+  return instructions;
+}
+
+export const newMcpServer = async () =>
   new McpServer(
     {
       name: 'imagekit_nodejs_api',
       version: '7.3.0',
     },
-    { capabilities: { tools: {}, logging: {} } },
+    {
+      instructions: await getInstructions(),
+      capabilities: { tools: {}, logging: {} },
+    },
   );
 
-// Create server instance
-export const server = newMcpServer();
-
 /**
  * Initializes the provided MCP Server with the given tools and handlers.
  * If not provided, the default client, tools and handlers will be used.
  */
-export function initMcpServer(params: {
+export async function initMcpServer(params: {
   server: Server | McpServer;
   clientOptions?: ClientOptions;
   mcpOptions?: McpOptions;
diff --git a/packages/mcp-server/src/stdio.ts b/packages/mcp-server/src/stdio.ts
index f07696f3..47aeb0c9 100644
--- a/packages/mcp-server/src/stdio.ts
+++ b/packages/mcp-server/src/stdio.ts
@@ -2,9 +2,9 @@ import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'
 import { initMcpServer, newMcpServer } from './server';
 
 export const launchStdioServer = async () => {
-  const server = newMcpServer();
+  const server = await newMcpServer();
 
-  initMcpServer({ server });
+  await initMcpServer({ server });
 
   const transport = new StdioServerTransport();
   await server.connect(transport);

From 0738e8884a59ddac579fab6a65e0221fdff4247c Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Thu, 5 Feb 2026 14:11:33 +0000
Subject: [PATCH 07/13] fix(client): avoid removing abort listener too early

---
 src/client.ts | 1 -
 1 file changed, 1 deletion(-)

diff --git a/src/client.ts b/src/client.ts
index 220345d2..453f5f99 100644
--- a/src/client.ts
+++ b/src/client.ts
@@ -625,7 +625,6 @@ export class ImageKit {
       return await this.fetch.call(undefined, url, fetchOptions);
     } finally {
       clearTimeout(timeout);
-      if (signal) signal.removeEventListener('abort', abort);
     }
   }
 

From 83d1174751241a66748b9d0f4b2b92f37715d4ad Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Fri, 6 Feb 2026 16:56:54 +0000
Subject: [PATCH 08/13] chore(internal): add health check to MCP server when
 running in HTTP mode

---
 packages/mcp-server/src/http.ts   | 3 +++
 packages/mcp-server/src/server.ts | 8 ++++----
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/packages/mcp-server/src/http.ts b/packages/mcp-server/src/http.ts
index 1f851cb6..b2031368 100644
--- a/packages/mcp-server/src/http.ts
+++ b/packages/mcp-server/src/http.ts
@@ -98,6 +98,9 @@ export const streamableHTTPApp = ({
     app.use(morgan('combined'));
   }
 
+  app.get('/health', async (req: express.Request, res: express.Response) => {
+    res.status(200).send('OK');
+  });
   app.get('/', get);
   app.post('/', post({ clientOptions, mcpOptions }));
   app.delete('/', del);
diff --git a/packages/mcp-server/src/server.ts b/packages/mcp-server/src/server.ts
index d1c7cbf6..21026821 100644
--- a/packages/mcp-server/src/server.ts
+++ b/packages/mcp-server/src/server.ts
@@ -36,10 +36,10 @@ async function getInstructions() {
 
     instructions = `
       This is the imagekit MCP server. You will use Code Mode to help the user perform
-      actions. You can use search_docs tool to learn about how to take action with this server. Then, 
-      you will write TypeScript code using the execute tool take action. It is CRITICAL that you be 
-      thoughtful and deliberate when executing code. Always try to entirely solve the problem in code 
-      block: it can be as long as you need to get the job done! 
+      actions. You can use search_docs tool to learn about how to take action with this server. Then,
+      you will write TypeScript code using the execute tool take action. It is CRITICAL that you be
+      thoughtful and deliberate when executing code. Always try to entirely solve the problem in code
+      block: it can be as long as you need to get the job done!
     `;
   }
 

From 61a5d8863e4fcb692d187bb0a7b44e1788faf8ee Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Fri, 6 Feb 2026 21:06:00 +0000
Subject: [PATCH 09/13] chore(internal): upgrade hono

---
 packages/mcp-server/cloudflare-worker/package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/mcp-server/cloudflare-worker/package.json b/packages/mcp-server/cloudflare-worker/package.json
index dfdc2bbc..468245d4 100644
--- a/packages/mcp-server/cloudflare-worker/package.json
+++ b/packages/mcp-server/cloudflare-worker/package.json
@@ -20,7 +20,7 @@
     "@cloudflare/workers-oauth-provider": "^0.0.5",
     "@modelcontextprotocol/sdk": "^1.25.2",
     "agents": "^0.0.88",
-    "hono": "^4.11.4",
+    "hono": "^4.11.7",
     "@imagekit/api-mcp": "latest",
     "zod": "^3.24.4"
   }

From 90eae18e29708d7596a6e783cad196c9a4f75f39 Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Mon, 9 Feb 2026 18:33:51 +0000
Subject: [PATCH 10/13] chore(internal): always generate MCP server dockerfiles
 and upgrade associated dependencies

---
 .dockerignore                  | 59 ++++++++++++++++++++++++++++
 packages/mcp-server/Dockerfile | 71 ++++++++++++++++++++++++++++++++++
 2 files changed, 130 insertions(+)
 create mode 100644 .dockerignore
 create mode 100644 packages/mcp-server/Dockerfile

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 00000000..12ff1e64
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,59 @@
+# Dependencies
+node_modules/
+**/node_modules/
+
+# Build outputs
+dist/
+**/dist/
+
+# Git
+.git/
+.gitignore
+
+# CI/CD
+.github/
+.gitlab-ci.yml
+.travis.yml
+
+# IDE
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Testing
+test/
+tests/
+__tests__/
+*.test.js
+*.spec.js
+coverage/
+.nyc_output/
+
+# Logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+
+# Environment
+.env
+.env.*
+
+# Temporary files
+*.tmp
+*.temp
+.cache/
+
+# Examples and scripts
+examples/
+bin/
+
+# Other packages (we only need mcp-server)
+packages/*/
+!packages/mcp-server/
diff --git a/packages/mcp-server/Dockerfile b/packages/mcp-server/Dockerfile
new file mode 100644
index 00000000..3fe3e5a4
--- /dev/null
+++ b/packages/mcp-server/Dockerfile
@@ -0,0 +1,71 @@
+# Dockerfile for Image Kit MCP Server
+#
+# This Dockerfile builds a Docker image for the MCP Server.
+#
+# To build the image locally:
+#   docker build -f packages/mcp-server/Dockerfile -t @imagekit/api-mcp:local .
+#
+# To run the image:
+#   docker run -i @imagekit/api-mcp:local [OPTIONS]
+#
+# Common options:
+#   --tool=<name>              Include specific tools
+#   --resource=<name>          Include tools for specific resources
+#   --operation=read|write     Filter by operation type
+#   --client=<type>            Set client compatibility (e.g., claude, cursor)
+#   --transport=<type>         Set transport type (stdio or http)
+#
+# For a full list of options:
+#   docker run -i @imagekit/api-mcp:local --help
+#
+# Note: The MCP server uses stdio transport by default. Docker's -i flag
+# enables interactive mode, allowing the container to communicate over stdin/stdout.
+
+# Build stage
+FROM node:24-alpine AS builder
+
+# Install bash for build script
+RUN apk add --no-cache bash openssl
+
+# Set working directory
+WORKDIR /build
+
+# Copy entire repository
+COPY . .
+
+# Install all dependencies and build everything
+RUN yarn install --frozen-lockfile && \
+    yarn build
+
+# Production stage
+FROM node:24-alpine
+
+# Add non-root user
+RUN addgroup -g 1001 -S nodejs && adduser -S nodejs -u 1001
+
+# Set working directory
+WORKDIR /app
+
+# Copy the built mcp-server dist directory
+COPY --from=builder /build/packages/mcp-server/dist ./
+
+# Copy node_modules from mcp-server (includes all production deps)
+COPY --from=builder /build/packages/mcp-server/node_modules ./node_modules
+
+# Copy the built @imagekit/nodejs into node_modules
+COPY --from=builder /build/dist ./node_modules/@imagekit/nodejs
+
+# Change ownership to nodejs user
+RUN chown -R nodejs:nodejs /app
+
+# Switch to non-root user
+USER nodejs
+
+# The MCP server uses stdio transport by default
+# No exposed ports needed for stdio communication
+
+# Set the entrypoint to the MCP server
+ENTRYPOINT ["node", "index.js"]
+
+# Allow passing arguments to the MCP server
+CMD []

From 4a861827d463d2b6e9812a4aa58d2df14cb356bf Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Mon, 9 Feb 2026 20:26:57 +0000
Subject: [PATCH 11/13] chore(internal): allow basic filtering of methods
 allowed for MCP code mode

---
 packages/mcp-server/src/code-tool.ts |  21 +-
 packages/mcp-server/src/http.ts      |   3 +
 packages/mcp-server/src/index.ts     |   2 +-
 packages/mcp-server/src/methods.ts   | 368 +++++++++++++++++++++++++++
 packages/mcp-server/src/options.ts   |  23 ++
 packages/mcp-server/src/server.ts    |   7 +-
 packages/mcp-server/src/stdio.ts     |   5 +-
 7 files changed, 424 insertions(+), 5 deletions(-)
 create mode 100644 packages/mcp-server/src/methods.ts

diff --git a/packages/mcp-server/src/code-tool.ts b/packages/mcp-server/src/code-tool.ts
index 220b5c74..d92db0d3 100644
--- a/packages/mcp-server/src/code-tool.ts
+++ b/packages/mcp-server/src/code-tool.ts
@@ -4,6 +4,7 @@ import { McpTool, Metadata, ToolCallResult, asErrorResult, asTextContentResult }
 import { Tool } from '@modelcontextprotocol/sdk/types.js';
 import { readEnv, requireValue } from './server';
 import { WorkerInput, WorkerOutput } from './code-tool-types';
+import { SdkMethod } from './methods';
 import { ImageKit } from '@imagekit/nodejs';
 
 const prompt = `Runs JavaScript code to interact with the Image Kit API.
@@ -35,7 +36,7 @@ Variables will not persist between calls, so make sure to return or log any data
  *
  * @param endpoints - The endpoints to include in the list.
  */
-export function codeTool(): McpTool {
+export function codeTool(params: { blockedMethods: SdkMethod[] | undefined }): McpTool {
   const metadata: Metadata = { resource: 'all', operation: 'write', tags: [] };
   const tool: Tool = {
     name: 'execute',
@@ -59,6 +60,24 @@ export function codeTool(): McpTool {
     const code = args.code as string;
     const intent = args.intent as string | undefined;
 
+    // Do very basic blocking of code that includes forbidden method names.
+    //
+    // WARNING: This is not secure against obfuscation and other evasion methods. If
+    // stronger security blocks are required, then these should be enforced in the downstream
+    // API (e.g., by having users call the MCP server with API keys with limited permissions).
+    if (params.blockedMethods) {
+      const blockedMatches = params.blockedMethods.filter((method) =>
+        code.includes(method.fullyQualifiedName),
+      );
+      if (blockedMatches.length > 0) {
+        return asErrorResult(
+          `The following methods have been blocked by the MCP server and cannot be used in code execution: ${blockedMatches
+            .map((m) => m.fullyQualifiedName)
+            .join(', ')}`,
+        );
+      }
+    }
+
     // this is not required, but passing a Stainless API key for the matching project_name
     // will allow you to run code-mode queries against non-published versions of your SDK.
     const stainlessAPIKey = readEnv('STAINLESS_API_KEY');
diff --git a/packages/mcp-server/src/http.ts b/packages/mcp-server/src/http.ts
index b2031368..8ca827c2 100644
--- a/packages/mcp-server/src/http.ts
+++ b/packages/mcp-server/src/http.ts
@@ -11,10 +11,12 @@ import { parseAuthHeaders } from './headers';
 
 const newServer = async ({
   clientOptions,
+  mcpOptions,
   req,
   res,
 }: {
   clientOptions: ClientOptions;
+  mcpOptions: McpOptions;
   req: express.Request;
   res: express.Response;
 }): Promise<McpServer | null> => {
@@ -24,6 +26,7 @@ const newServer = async ({
     const authOptions = parseAuthHeaders(req, false);
     await initMcpServer({
       server: server,
+      mcpOptions: mcpOptions,
       clientOptions: {
         ...clientOptions,
         ...authOptions,
diff --git a/packages/mcp-server/src/index.ts b/packages/mcp-server/src/index.ts
index d75968e3..003a7655 100644
--- a/packages/mcp-server/src/index.ts
+++ b/packages/mcp-server/src/index.ts
@@ -18,7 +18,7 @@ async function main() {
 
   switch (options.transport) {
     case 'stdio':
-      await launchStdioServer();
+      await launchStdioServer(options);
       break;
     case 'http':
       await launchStreamableHTTPServer({
diff --git a/packages/mcp-server/src/methods.ts b/packages/mcp-server/src/methods.ts
new file mode 100644
index 00000000..4757e2b0
--- /dev/null
+++ b/packages/mcp-server/src/methods.ts
@@ -0,0 +1,368 @@
+import { McpOptions } from './options';
+
+export type SdkMethod = {
+  clientCallName: string;
+  fullyQualifiedName: string;
+  httpMethod?: 'get' | 'post' | 'put' | 'patch' | 'delete' | 'query';
+  httpPath?: string;
+};
+
+export const sdkMethods: SdkMethod[] = [
+  {
+    clientCallName: 'client.customMetadataFields.create',
+    fullyQualifiedName: 'customMetadataFields.create',
+    httpMethod: 'post',
+    httpPath: '/v1/customMetadataFields',
+  },
+  {
+    clientCallName: 'client.customMetadataFields.update',
+    fullyQualifiedName: 'customMetadataFields.update',
+    httpMethod: 'patch',
+    httpPath: '/v1/customMetadataFields/{id}',
+  },
+  {
+    clientCallName: 'client.customMetadataFields.list',
+    fullyQualifiedName: 'customMetadataFields.list',
+    httpMethod: 'get',
+    httpPath: '/v1/customMetadataFields',
+  },
+  {
+    clientCallName: 'client.customMetadataFields.delete',
+    fullyQualifiedName: 'customMetadataFields.delete',
+    httpMethod: 'delete',
+    httpPath: '/v1/customMetadataFields/{id}',
+  },
+  {
+    clientCallName: 'client.files.update',
+    fullyQualifiedName: 'files.update',
+    httpMethod: 'patch',
+    httpPath: '/v1/files/{fileId}/details',
+  },
+  {
+    clientCallName: 'client.files.delete',
+    fullyQualifiedName: 'files.delete',
+    httpMethod: 'delete',
+    httpPath: '/v1/files/{fileId}',
+  },
+  {
+    clientCallName: 'client.files.copy',
+    fullyQualifiedName: 'files.copy',
+    httpMethod: 'post',
+    httpPath: '/v1/files/copy',
+  },
+  {
+    clientCallName: 'client.files.get',
+    fullyQualifiedName: 'files.get',
+    httpMethod: 'get',
+    httpPath: '/v1/files/{fileId}/details',
+  },
+  {
+    clientCallName: 'client.files.move',
+    fullyQualifiedName: 'files.move',
+    httpMethod: 'post',
+    httpPath: '/v1/files/move',
+  },
+  {
+    clientCallName: 'client.files.rename',
+    fullyQualifiedName: 'files.rename',
+    httpMethod: 'put',
+    httpPath: '/v1/files/rename',
+  },
+  {
+    clientCallName: 'client.files.upload',
+    fullyQualifiedName: 'files.upload',
+    httpMethod: 'post',
+    httpPath: '/api/v1/files/upload',
+  },
+  {
+    clientCallName: 'client.files.bulk.delete',
+    fullyQualifiedName: 'files.bulk.delete',
+    httpMethod: 'post',
+    httpPath: '/v1/files/batch/deleteByFileIds',
+  },
+  {
+    clientCallName: 'client.files.bulk.addTags',
+    fullyQualifiedName: 'files.bulk.addTags',
+    httpMethod: 'post',
+    httpPath: '/v1/files/addTags',
+  },
+  {
+    clientCallName: 'client.files.bulk.removeAITags',
+    fullyQualifiedName: 'files.bulk.removeAITags',
+    httpMethod: 'post',
+    httpPath: '/v1/files/removeAITags',
+  },
+  {
+    clientCallName: 'client.files.bulk.removeTags',
+    fullyQualifiedName: 'files.bulk.removeTags',
+    httpMethod: 'post',
+    httpPath: '/v1/files/removeTags',
+  },
+  {
+    clientCallName: 'client.files.versions.list',
+    fullyQualifiedName: 'files.versions.list',
+    httpMethod: 'get',
+    httpPath: '/v1/files/{fileId}/versions',
+  },
+  {
+    clientCallName: 'client.files.versions.delete',
+    fullyQualifiedName: 'files.versions.delete',
+    httpMethod: 'delete',
+    httpPath: '/v1/files/{fileId}/versions/{versionId}',
+  },
+  {
+    clientCallName: 'client.files.versions.get',
+    fullyQualifiedName: 'files.versions.get',
+    httpMethod: 'get',
+    httpPath: '/v1/files/{fileId}/versions/{versionId}',
+  },
+  {
+    clientCallName: 'client.files.versions.restore',
+    fullyQualifiedName: 'files.versions.restore',
+    httpMethod: 'put',
+    httpPath: '/v1/files/{fileId}/versions/{versionId}/restore',
+  },
+  {
+    clientCallName: 'client.files.metadata.get',
+    fullyQualifiedName: 'files.metadata.get',
+    httpMethod: 'get',
+    httpPath: '/v1/files/{fileId}/metadata',
+  },
+  {
+    clientCallName: 'client.files.metadata.getFromURL',
+    fullyQualifiedName: 'files.metadata.getFromURL',
+    httpMethod: 'get',
+    httpPath: '/v1/metadata',
+  },
+  {
+    clientCallName: 'client.savedExtensions.create',
+    fullyQualifiedName: 'savedExtensions.create',
+    httpMethod: 'post',
+    httpPath: '/v1/saved-extensions',
+  },
+  {
+    clientCallName: 'client.savedExtensions.update',
+    fullyQualifiedName: 'savedExtensions.update',
+    httpMethod: 'patch',
+    httpPath: '/v1/saved-extensions/{id}',
+  },
+  {
+    clientCallName: 'client.savedExtensions.list',
+    fullyQualifiedName: 'savedExtensions.list',
+    httpMethod: 'get',
+    httpPath: '/v1/saved-extensions',
+  },
+  {
+    clientCallName: 'client.savedExtensions.delete',
+    fullyQualifiedName: 'savedExtensions.delete',
+    httpMethod: 'delete',
+    httpPath: '/v1/saved-extensions/{id}',
+  },
+  {
+    clientCallName: 'client.savedExtensions.get',
+    fullyQualifiedName: 'savedExtensions.get',
+    httpMethod: 'get',
+    httpPath: '/v1/saved-extensions/{id}',
+  },
+  {
+    clientCallName: 'client.assets.list',
+    fullyQualifiedName: 'assets.list',
+    httpMethod: 'get',
+    httpPath: '/v1/files',
+  },
+  {
+    clientCallName: 'client.cache.invalidation.create',
+    fullyQualifiedName: 'cache.invalidation.create',
+    httpMethod: 'post',
+    httpPath: '/v1/files/purge',
+  },
+  {
+    clientCallName: 'client.cache.invalidation.get',
+    fullyQualifiedName: 'cache.invalidation.get',
+    httpMethod: 'get',
+    httpPath: '/v1/files/purge/{requestId}',
+  },
+  {
+    clientCallName: 'client.folders.create',
+    fullyQualifiedName: 'folders.create',
+    httpMethod: 'post',
+    httpPath: '/v1/folder',
+  },
+  {
+    clientCallName: 'client.folders.delete',
+    fullyQualifiedName: 'folders.delete',
+    httpMethod: 'delete',
+    httpPath: '/v1/folder',
+  },
+  {
+    clientCallName: 'client.folders.copy',
+    fullyQualifiedName: 'folders.copy',
+    httpMethod: 'post',
+    httpPath: '/v1/bulkJobs/copyFolder',
+  },
+  {
+    clientCallName: 'client.folders.move',
+    fullyQualifiedName: 'folders.move',
+    httpMethod: 'post',
+    httpPath: '/v1/bulkJobs/moveFolder',
+  },
+  {
+    clientCallName: 'client.folders.rename',
+    fullyQualifiedName: 'folders.rename',
+    httpMethod: 'post',
+    httpPath: '/v1/bulkJobs/renameFolder',
+  },
+  {
+    clientCallName: 'client.folders.job.get',
+    fullyQualifiedName: 'folders.job.get',
+    httpMethod: 'get',
+    httpPath: '/v1/bulkJobs/{jobId}',
+  },
+  {
+    clientCallName: 'client.accounts.usage.get',
+    fullyQualifiedName: 'accounts.usage.get',
+    httpMethod: 'get',
+    httpPath: '/v1/accounts/usage',
+  },
+  {
+    clientCallName: 'client.accounts.origins.create',
+    fullyQualifiedName: 'accounts.origins.create',
+    httpMethod: 'post',
+    httpPath: '/v1/accounts/origins',
+  },
+  {
+    clientCallName: 'client.accounts.origins.update',
+    fullyQualifiedName: 'accounts.origins.update',
+    httpMethod: 'put',
+    httpPath: '/v1/accounts/origins/{id}',
+  },
+  {
+    clientCallName: 'client.accounts.origins.list',
+    fullyQualifiedName: 'accounts.origins.list',
+    httpMethod: 'get',
+    httpPath: '/v1/accounts/origins',
+  },
+  {
+    clientCallName: 'client.accounts.origins.delete',
+    fullyQualifiedName: 'accounts.origins.delete',
+    httpMethod: 'delete',
+    httpPath: '/v1/accounts/origins/{id}',
+  },
+  {
+    clientCallName: 'client.accounts.origins.get',
+    fullyQualifiedName: 'accounts.origins.get',
+    httpMethod: 'get',
+    httpPath: '/v1/accounts/origins/{id}',
+  },
+  {
+    clientCallName: 'client.accounts.urlEndpoints.create',
+    fullyQualifiedName: 'accounts.urlEndpoints.create',
+    httpMethod: 'post',
+    httpPath: '/v1/accounts/url-endpoints',
+  },
+  {
+    clientCallName: 'client.accounts.urlEndpoints.update',
+    fullyQualifiedName: 'accounts.urlEndpoints.update',
+    httpMethod: 'put',
+    httpPath: '/v1/accounts/url-endpoints/{id}',
+  },
+  {
+    clientCallName: 'client.accounts.urlEndpoints.list',
+    fullyQualifiedName: 'accounts.urlEndpoints.list',
+    httpMethod: 'get',
+    httpPath: '/v1/accounts/url-endpoints',
+  },
+  {
+    clientCallName: 'client.accounts.urlEndpoints.delete',
+    fullyQualifiedName: 'accounts.urlEndpoints.delete',
+    httpMethod: 'delete',
+    httpPath: '/v1/accounts/url-endpoints/{id}',
+  },
+  {
+    clientCallName: 'client.accounts.urlEndpoints.get',
+    fullyQualifiedName: 'accounts.urlEndpoints.get',
+    httpMethod: 'get',
+    httpPath: '/v1/accounts/url-endpoints/{id}',
+  },
+  {
+    clientCallName: 'client.beta.v2.files.upload',
+    fullyQualifiedName: 'beta.v2.files.upload',
+    httpMethod: 'post',
+    httpPath: '/api/v2/files/upload',
+  },
+  { clientCallName: 'client.webhooks.unsafeUnwrap', fullyQualifiedName: 'webhooks.unsafeUnwrap' },
+  { clientCallName: 'client.webhooks.unwrap', fullyQualifiedName: 'webhooks.unwrap' },
+];
+
+function allowedMethodsForCodeTool(options: McpOptions | undefined): SdkMethod[] | undefined {
+  if (!options) {
+    return undefined;
+  }
+
+  let allowedMethods: SdkMethod[];
+
+  if (options.codeAllowHttpGets || options.codeAllowedMethods) {
+    // Start with nothing allowed and then add into it from options
+    let allowedMethodsSet = new Set<SdkMethod>();
+
+    if (options.codeAllowHttpGets) {
+      // Add all methods that map to an HTTP GET
+      sdkMethods
+        .filter((method) => method.httpMethod === 'get')
+        .forEach((method) => allowedMethodsSet.add(method));
+    }
+
+    if (options.codeAllowedMethods) {
+      // Add all methods that match any of the allowed regexps
+      const allowedRegexps = options.codeAllowedMethods.map((pattern) => {
+        try {
+          return new RegExp(pattern);
+        } catch (e) {
+          throw new Error(
+            `Invalid regex pattern for allowed method: "${pattern}": ${e instanceof Error ? e.message : e}`,
+          );
+        }
+      });
+
+      sdkMethods
+        .filter((method) => allowedRegexps.some((regexp) => regexp.test(method.fullyQualifiedName)))
+        .forEach((method) => allowedMethodsSet.add(method));
+    }
+
+    allowedMethods = Array.from(allowedMethodsSet);
+  } else {
+    // Start with everything allowed
+    allowedMethods = [...sdkMethods];
+  }
+
+  if (options.codeBlockedMethods) {
+    // Filter down based on blocked regexps
+    const blockedRegexps = options.codeBlockedMethods.map((pattern) => {
+      try {
+        return new RegExp(pattern);
+      } catch (e) {
+        throw new Error(
+          `Invalid regex pattern for blocked method: "${pattern}": ${e instanceof Error ? e.message : e}`,
+        );
+      }
+    });
+
+    allowedMethods = allowedMethods.filter(
+      (method) => !blockedRegexps.some((regexp) => regexp.test(method.fullyQualifiedName)),
+    );
+  }
+
+  return allowedMethods;
+}
+
+export function blockedMethodsForCodeTool(options: McpOptions | undefined): SdkMethod[] | undefined {
+  const allowedMethods = allowedMethodsForCodeTool(options);
+  if (!allowedMethods) {
+    return undefined;
+  }
+
+  const allowedSet = new Set(allowedMethods.map((method) => method.fullyQualifiedName));
+
+  // Return any methods that are not explicitly allowed
+  return sdkMethods.filter((method) => !allowedSet.has(method.fullyQualifiedName));
+}
diff --git a/packages/mcp-server/src/options.ts b/packages/mcp-server/src/options.ts
index 74380833..92d1b074 100644
--- a/packages/mcp-server/src/options.ts
+++ b/packages/mcp-server/src/options.ts
@@ -12,10 +12,30 @@ export type CLIOptions = McpOptions & {
 
 export type McpOptions = {
   includeDocsTools?: boolean | undefined;
+  codeAllowHttpGets?: boolean | undefined;
+  codeAllowedMethods?: string[] | undefined;
+  codeBlockedMethods?: string[] | undefined;
 };
 
 export function parseCLIOptions(): CLIOptions {
   const opts = yargs(hideBin(process.argv))
+    .option('code-allow-http-gets', {
+      type: 'boolean',
+      description:
+        'Allow all code tool methods that map to HTTP GET operations. If all code-allow-* flags are unset, then everything is allowed.',
+    })
+    .option('code-allowed-methods', {
+      type: 'string',
+      array: true,
+      description:
+        'Methods to explicitly allow for code tool. Evaluated as regular expressions against method fully qualified names. If all code-allow-* flags are unset, then everything is allowed.',
+    })
+    .option('code-blocked-methods', {
+      type: 'string',
+      array: true,
+      description:
+        'Methods to explicitly block for code tool. Evaluated as regular expressions against method fully qualified names. If all code-allow-* flags are unset, then everything is allowed.',
+    })
     .option('debug', { type: 'boolean', description: 'Enable debug logging' })
     .option('no-tools', {
       type: 'string',
@@ -59,6 +79,9 @@ export function parseCLIOptions(): CLIOptions {
   return {
     ...(includeDocsTools !== undefined && { includeDocsTools }),
     debug: !!argv.debug,
+    codeAllowHttpGets: argv.codeAllowHttpGets,
+    codeAllowedMethods: argv.codeAllowedMethods,
+    codeBlockedMethods: argv.codeBlockedMethods,
     transport,
     port: argv.port,
     socket: argv.socket,
diff --git a/packages/mcp-server/src/server.ts b/packages/mcp-server/src/server.ts
index 21026821..4e87e0eb 100644
--- a/packages/mcp-server/src/server.ts
+++ b/packages/mcp-server/src/server.ts
@@ -12,6 +12,7 @@ import ImageKit from '@imagekit/nodejs';
 import { codeTool } from './code-tool';
 import docsSearchTool from './docs-search-tool';
 import { McpOptions } from './options';
+import { blockedMethodsForCodeTool } from './methods';
 import { HandlerFunction, McpTool } from './types';
 
 export { McpOptions } from './options';
@@ -147,7 +148,11 @@ export async function initMcpServer(params: {
  * Selects the tools to include in the MCP Server based on the provided options.
  */
 export function selectTools(options?: McpOptions): McpTool[] {
-  const includedTools = [codeTool()];
+  const includedTools = [
+    codeTool({
+      blockedMethods: blockedMethodsForCodeTool(options),
+    }),
+  ];
   if (options?.includeDocsTools ?? true) {
     includedTools.push(docsSearchTool);
   }
diff --git a/packages/mcp-server/src/stdio.ts b/packages/mcp-server/src/stdio.ts
index 47aeb0c9..57b99126 100644
--- a/packages/mcp-server/src/stdio.ts
+++ b/packages/mcp-server/src/stdio.ts
@@ -1,10 +1,11 @@
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { McpOptions } from './options';
 import { initMcpServer, newMcpServer } from './server';
 
-export const launchStdioServer = async () => {
+export const launchStdioServer = async (mcpOptions: McpOptions) => {
   const server = await newMcpServer();
 
-  await initMcpServer({ server });
+  await initMcpServer({ server, mcpOptions });
 
   const transport = new StdioServerTransport();
   await server.connect(transport);

From 7cd398067ad0736b67bfb3d8ace58d15a94c1fd2 Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Wed, 11 Feb 2026 14:12:05 +0000
Subject: [PATCH 12/13] chore(internal): avoid type checking errors with
 ts-reset

---
 src/client.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/client.ts b/src/client.ts
index 453f5f99..bb01dbea 100644
--- a/src/client.ts
+++ b/src/client.ts
@@ -558,7 +558,7 @@ export class ImageKit {
       loggerFor(this).info(`${responseInfo} - ${retryMessage}`);
 
       const errText = await response.text().catch((err: any) => castToError(err).message);
-      const errJSON = safeJSON(errText);
+      const errJSON = safeJSON(errText) as any;
       const errMessage = errJSON ? undefined : errText;
 
       loggerFor(this).debug(

From 28e6705095504d64caa86c11f3fd15c13f662c41 Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Wed, 11 Feb 2026 14:12:30 +0000
Subject: [PATCH 13/13] release: 7.4.0

---
 .release-please-manifest.json     |  2 +-
 CHANGELOG.md                      | 27 +++++++++++++++++++++++++++
 package.json                      |  2 +-
 packages/mcp-server/package.json  |  2 +-
 packages/mcp-server/src/server.ts |  2 +-
 src/version.ts                    |  2 +-
 6 files changed, 32 insertions(+), 5 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index c575a162..6731678f 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "7.3.0"
+  ".": "7.4.0"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 32b4dc54..45577deb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,32 @@
 # Changelog
 
+## 7.4.0 (2026-02-11)
+
+Full Changelog: [v7.3.0...v7.4.0](https://github.com/imagekit-developer/imagekit-nodejs/compare/v7.3.0...v7.4.0)
+
+### Features
+
+* **mcp:** add initial server instructions ([cdce131](https://github.com/imagekit-developer/imagekit-nodejs/commit/cdce131dc17fba5469393a285ac536acd74742b2))
+
+
+### Bug Fixes
+
+* **client:** avoid memory leak with abort signals ([c08f7c0](https://github.com/imagekit-developer/imagekit-nodejs/commit/c08f7c04267e000d51cfad22ec8337e456d20171))
+* **client:** avoid removing abort listener too early ([0738e88](https://github.com/imagekit-developer/imagekit-nodejs/commit/0738e8884a59ddac579fab6a65e0221fdff4247c))
+
+
+### Chores
+
+* **client:** do not parse responses with empty content-length ([4b5fcbf](https://github.com/imagekit-developer/imagekit-nodejs/commit/4b5fcbfd1188573ccd1cea40b8e4924a5e2051dc))
+* **client:** restructure abort controller binding ([46c04e1](https://github.com/imagekit-developer/imagekit-nodejs/commit/46c04e16c46bca7bc1b0383d151f027d7d918611))
+* **internal:** add health check to MCP server when running in HTTP mode ([83d1174](https://github.com/imagekit-developer/imagekit-nodejs/commit/83d1174751241a66748b9d0f4b2b92f37715d4ad))
+* **internal:** allow basic filtering of methods allowed for MCP code mode ([4a86182](https://github.com/imagekit-developer/imagekit-nodejs/commit/4a861827d463d2b6e9812a4aa58d2df14cb356bf))
+* **internal:** always generate MCP server dockerfiles and upgrade associated dependencies ([90eae18](https://github.com/imagekit-developer/imagekit-nodejs/commit/90eae18e29708d7596a6e783cad196c9a4f75f39))
+* **internal:** avoid type checking errors with ts-reset ([7cd3980](https://github.com/imagekit-developer/imagekit-nodejs/commit/7cd398067ad0736b67bfb3d8ace58d15a94c1fd2))
+* **internal:** refactor flag parsing for MCP servers and add debug flag ([ff4b97e](https://github.com/imagekit-developer/imagekit-nodejs/commit/ff4b97e40fb46ca0b4f3229074c3f614b045641c))
+* **internal:** support oauth authorization code flow for MCP servers ([5f6c688](https://github.com/imagekit-developer/imagekit-nodejs/commit/5f6c688f4f41df60d88fce94bc10cfdce4e29d78))
+* **internal:** upgrade hono ([61a5d88](https://github.com/imagekit-developer/imagekit-nodejs/commit/61a5d8863e4fcb692d187bb0a7b44e1788faf8ee))
+
 ## 7.3.0 (2026-02-02)
 
 Full Changelog: [v7.2.2...v7.3.0](https://github.com/imagekit-developer/imagekit-nodejs/compare/v7.2.2...v7.3.0)
diff --git a/package.json b/package.json
index 2c422387..44bfd22b 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@imagekit/nodejs",
-  "version": "7.3.0",
+  "version": "7.4.0",
   "description": "Offical NodeJS SDK for ImageKit.io integration",
   "author": "Image Kit <developer@imagekit.io>",
   "types": "dist/index.d.ts",
diff --git a/packages/mcp-server/package.json b/packages/mcp-server/package.json
index b289c973..076a5995 100644
--- a/packages/mcp-server/package.json
+++ b/packages/mcp-server/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@imagekit/api-mcp",
-  "version": "7.3.0",
+  "version": "7.4.0",
   "description": "The official MCP Server for the Image Kit API",
   "author": "Image Kit <developer@imagekit.io>",
   "types": "dist/index.d.ts",
diff --git a/packages/mcp-server/src/server.ts b/packages/mcp-server/src/server.ts
index 4e87e0eb..ecbece80 100644
--- a/packages/mcp-server/src/server.ts
+++ b/packages/mcp-server/src/server.ts
@@ -58,7 +58,7 @@ export const newMcpServer = async () =>
   new McpServer(
     {
       name: 'imagekit_nodejs_api',
-      version: '7.3.0',
+      version: '7.4.0',
     },
     {
       instructions: await getInstructions(),
diff --git a/src/version.ts b/src/version.ts
index 3f5548b7..06a61128 100644
--- a/src/version.ts
+++ b/src/version.ts
@@ -1 +1 @@
-export const VERSION = '7.3.0'; // x-release-please-version
+export const VERSION = '7.4.0'; // x-release-please-version