Fix screenshot image format, add tool filtering, and CI/CD

.github/workflows/ci.yml

@@ -0,0 +1,21 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: npm
+      - run: npm ci
+      - run: npm run check
+      - run: npm run build
+      - run: npm run test

.github/workflows/release.yml

@@ -0,0 +1,31 @@
+name: Release
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: npm
+          registry-url: https://registry.npmjs.org
+      - run: npm ci
+      - name: Verify version matches release tag
+        run: |
+          PKG_VERSION="v$(node -p 'require("./package.json").version')"
+          if [ "$PKG_VERSION" != "${{ github.event.release.tag_name }}" ]; then
+            echo "::error::package.json version ($PKG_VERSION) does not match release tag (${{ github.event.release.tag_name }})"
+            exit 1
+          fi
+      - run: npm run check
+      - run: npm run build
+      - run: npm run test
+      - run: npm publish --access public

AGENTS.md

@@ -35,13 +35,13 @@ Each file registers one MCP tool via `registerXxxTool(server, manager)`. All too
 `NotificationHandler` listens for device events, updates `DeviceStateStore` (in-memory cache), and pushes MCP resource change notifications.
 
 ### Config (`src/config.ts`)
-CLI args take precedence over env vars. Optional: `--devices`/`ZAPAROO_DEVICES`, `--keys`/`ZAPAROO_KEYS`. Default port is 7497. When no devices are configured, mDNS discovery is enabled automatically. Use `--no-discovery` or `ZAPAROO_NO_DISCOVERY=1` to disable.
+CLI args take precedence over env vars. Optional: `--devices`/`ZAPAROO_DEVICES`, `--keys`/`ZAPAROO_KEYS`. Default port is 7497. When no devices are configured, mDNS discovery is enabled automatically. Use `--no-discovery` or `ZAPAROO_NO_DISCOVERY=1` to disable. Tool filtering: `--allowed-tools`/`ZAPAROO_ALLOWED_TOOLS` (comma-separated whitelist) or `--blocked-tools`/`ZAPAROO_BLOCKED_TOOLS` (comma-separated blacklist). Cannot use both simultaneously.
 
 ## Adding a new tool
 
 1. Create `src/tools/mytool.ts` with a `registerMyTool(server, manager)` function
 2. Define input schema with Zod, use `toolRequest()` from `src/tools/helpers.ts` to call the device
-3. Register it in `src/tools/index.ts` inside `registerAllTools()`
+3. Add an entry to the `registry` array in `src/tools/index.ts` inside `registerAllTools()`
 
 ## Testing
 
@@ -73,3 +73,5 @@ Tests use Vitest and live alongside source files as `*.test.ts`. Test files are
 - Error responses from tools MUST use the `{ isError: true }` pattern (see `src/tools/helpers.ts`)
 - Device IDs use `host:port` format
 - NEVER use CommonJS (`require`/`module.exports`) — this is an ESM-only project
+- PR descriptions MUST NOT include test plans — keep them to a summary only
+- NEVER amend commits — always create new commits