fix(tools): address final code review findings on validation, concurrency, and testing

src/tools/index.ts

@@ -30,6 +30,7 @@ export const allTools: AnyToolDefinition[] = [
 
 export interface RegisterToolsOptions {
   readOnly?: boolean;
+  tools?: AnyToolDefinition[];
 }
 
 /**
@@ -41,12 +42,13 @@ export function registerAllTools(
   options?: RegisterToolsOptions
 ): void {
   const isReadOnly = options?.readOnly ?? false;
+  const toolsToRegister = options?.tools ?? allTools;
 
-  for (const tool of allTools) {
+  for (const tool of toolsToRegister) {
     // If server is in read-only mode, skip any non-read-only tools
     if (isReadOnly && !tool.readOnly) {
       continue;
     }
-    registerTool(server, tool);
+    registerTool(server, tool as unknown as ToolDefinition);
   }
 }

src/tools/projects.ts

@@ -47,7 +47,13 @@ export async function handleListProjects(
   try {
     let filters: FilterElement[] | undefined;
     if (args.filters) {
-      filters = JSON.parse(args.filters) as FilterElement[];
+      const parsed = JSON.parse(args.filters);
+      if (!Array.isArray(parsed)) {
+        return formatToolError(
+          new Error("filters parameter must be a JSON array string")
+        );
+      }
+      filters = parsed as FilterElement[];
     }
 
     const result = await listProjects({
@@ -71,7 +77,7 @@ export async function handleListProjects(
 
 export const getProjectShape = {
   projectId: z
-    .union([z.number().int().positive(), z.string()])
+    .union([z.number().int().positive(), z.string().min(1)])
     .describe("Numeric project ID or string identifier/slug"),
 };
 

src/tools/queries.ts

@@ -93,11 +93,13 @@ export async function handleGetQuery(
   args: GetQueryArgs
 ): Promise<McpToolResponse> {
   try {
-    const query = await getQuery(args.queryId);
-    const results = await getQueryResults(args.queryId, {
-      pageSize: args.pageSize,
-      offset: args.offset,
-    });
+    const [query, results] = await Promise.all([
+      getQuery(args.queryId),
+      getQueryResults(args.queryId, {
+        pageSize: args.pageSize,
+        offset: args.offset,
+      }),
+    ]);
 
     return formatToolSuccess({
       query,