bundleup-sdk 0.4.3 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6a81131b46ad1f04a1714e8e7a07d87d69ee3419648e966daa9099cba31fb4a9
-  data.tar.gz: b1861d43ace1fd90f86e89e8b161b91c135f1fc53215cf0dad3defd95351a048
+  metadata.gz: 9265bf377a655ed9056e02bd22d1ec24fec68304e7ad4881c99013c42ca516f2
+  data.tar.gz: 4f9dac8314ce2d26640048984f7bef53e8921dfa9d4a7be5c5857412af5d3b00
 SHA512:
-  metadata.gz: 13c18248fe861fb462cf3d9019764d13a7925031b49aa40d37f5ab7c3b106e019407140873dda6467057777313bc58cc6cb661daac8f102ff462b318aec4c413
-  data.tar.gz: c3bc826ddfb41e39616049a651b180dffd36bb3ee939f27ee315bd350400ae25dbec72666025f22860944d20f82e1945dc20f856b7a2c2cc0302cb671b7b0f9f
+  metadata.gz: 9e24b6ae2f52e09f5a2eb65e697b1080b4f8a36c5052097ea660b145fec36c7b85aef08ce85979d21023e65aa2788b4444071993e2f3ba3ea5b1f11bdbd2b48f
+  data.tar.gz: 71008902408646b7d4e171c186bc28337f0b67c7b36e218f01b2cf637402b06edf27cc2fa070dd036a35d9d428eecdad51f7935e1f2618e7dfdbd61b92b2949e

data/README.md

@@ -72,6 +72,7 @@ The BundleUp SDK is tested and supported on:
 - 🔌 **100+ Integrations** - Connect to Slack, GitHub, Jira, Linear, and many more
 - 🎯 **Unified API** - Consistent interface across all integrations via Unify API
 - 🔑 **Proxy API** - Direct access to underlying integration APIs
+- 🤖 **MCP** - Hand a connection to any MCP client, or to OpenAI and Anthropic's hosted MCP
 - 🪶 **Lightweight** - Minimal dependencies
 - 🛡️ **Error Handling** - Comprehensive error messages and validation
 - 📚 **Well Documented** - Extensive documentation and examples
@@ -175,6 +176,10 @@ BUNDLEUP_CLIENT = BundleUp::Client.new(ENV['BUNDLEUP_API_KEY'])
 
 ## Core Concepts
 
+### Auth API
+
+The **Auth API** runs the hosted authorization flow: build the URL that sends a user to connect an integration, then exchange the one-time `code` from the redirect for a `connection_id`. See [Authorization Flow](https://docs.bundleup.io/authorization-flow).
+
 ### Platform API
 
 The **Platform API** provides access to core BundleUp features like managing connections and integrations. Use this API to list, retrieve, and delete connections, as well as discover available integrations.
@@ -187,6 +192,10 @@ The **Proxy API** allows you to make direct HTTP requests to the underlying inte
 
 The **Unify API** provides a standardized, normalized interface across different integrations. For example, you can fetch chat channels from Slack, Discord, or Microsoft Teams using the same API call.
 
+### MCP API
+
+The **MCP API** reaches a provider's own MCP server using a connection's stored credentials. Tools are defined by the provider, not by BundleUp. Because the connection is chosen per client, one agent can serve many end users without ever handling a token.
+
 ## API Reference
 
 ### Connections
@@ -515,6 +524,62 @@ class WebhooksController < ApplicationController
 end
 ```
 
+### Auth API
+
+Connect an end user's account and get back a `connection_id`. See [Authorization Flow](https://docs.bundleup.io/authorization-flow) for the full flow.
+
+#### Build the Authorization URL
+
+```ruby
+url = client.auth.build_authorization_url(
+  client_id: 'your-client-id',
+  integration_id: 'github',
+  redirect_uri: 'https://app.example.com/callback',
+  external_id: 'user_42', # optional
+  state: 'random-csrf-token' # optional
+)
+
+# Redirect the user to `url`
+```
+
+**Parameters:**
+
+- `client_id` (String, required): Your workspace client ID
+- `integration_id` (String, required): The integration to connect
+- `redirect_uri` (String, required): Must exactly match a redirect URI registered in your dashboard
+- `external_id` (String, optional): Your own reference, stored on the connection
+- `state` (String, optional): Returned unchanged on the redirect
+
+#### Exchange the Code for a Connection
+
+BundleUp redirects back to `redirect_uri` with a one-time `code`. Exchange it server-side:
+
+```ruby
+connection = client.auth.get_connection_from_code(
+  code: params[:code],
+  redirect_uri: 'https://app.example.com/callback'
+)
+
+puts connection['connection_id']
+```
+
+**Parameters:**
+
+- `code` (String, required): The `code` query parameter from the redirect
+- `redirect_uri` (String, required): The same redirect URI used to build the authorization URL
+
+**Response:**
+
+```ruby
+{
+  'connection_id' => 'conn_abc123',
+  'external_id' => 'user_42',
+  'integration_id' => 'github'
+}
+```
+
+The code expires after 5 minutes and can only be exchanged once. An invalid, expired or reused code raises a `RuntimeError` that includes the API's error body. Missing arguments raise `ArgumentError`.
+
 ### Proxy API
 
 Make direct HTTP requests to integration APIs through BundleUp.
@@ -873,6 +938,38 @@ puts "Pull Requests: #{result['data']}"
 }
 ```
 
+##### List Issues
+
+```ruby
+result = unify.git.issues('organization/repo-name', limit: 20)
+
+puts "Issues: #{result['data']}"
+```
+
+**Response:**
+
+```ruby
+{
+  'data' => [
+    {
+      'id' => 67890,
+      'number' => 17,
+      'title' => 'Timestamps drift on retry',
+      'description' => 'Retried requests report the first attempt time',
+      'state' => 'open',
+      'url' => 'https://github.com/org/repo/issues/17',
+      'user' => 'john-doe',
+      'created_at' => '2024-01-15T10:30:00Z',
+      'updated_at' => '2024-01-20T14:22:00Z',
+      'closed_at' => nil
+    }
+  ],
+  'metadata' => {
+    'next' => nil
+  }
+}
+```
+
 ##### List Tags
 
 ```ruby
@@ -956,6 +1053,37 @@ puts "Branches: #{result['data']}"
 }
 ```
 
+##### List Commits
+
+```ruby
+result = unify.git.commits('organization/repo-name', branch: 'main', limit: 20)
+
+puts "Commits: #{result['data']}"
+```
+
+`branch` is optional and accepts a branch name, tag or commit SHA. When it is omitted the
+provider's default branch is used.
+
+**Response:**
+
+```ruby
+{
+  'data' => [
+    {
+      'sha' => 'abc123def4567890abc123def4567890abc123de',
+      'message' => 'Add commits endpoint',
+      'url' => 'https://github.com/org/repo/commit/abc123def4567890abc123def4567890abc123de',
+      'author' => 'Jane Doe',
+      'author_email' => 'jane@example.com',
+      'committed_at' => '2024-01-15T10:30:00Z'
+    }
+  ],
+  'metadata' => {
+    'next' => nil
+  }
+}
+```
+
 #### Ticketing API
 
 The Ticketing API provides a unified interface for ticketing and project management platforms like Jira, Linear, and Asana.
@@ -1028,6 +1156,41 @@ puts "Ticket: #{result['data']}"
 
 A single resource carries no pagination, so there is no `metadata` on this response.
 
+##### List Projects
+
+```ruby
+result = unify.ticketing.projects(
+  limit: 100,
+  after: nil,
+  include_raw: false
+)
+
+puts "Projects: #{result['data']}"
+```
+
+**Response:**
+
+```ruby
+{
+  'data' => [
+    {
+      'id' => '10001',
+      'name' => 'Website Redesign',
+      'status' => 'active',
+      'url' => 'https://jira.example.com/browse/PROJ',
+      'description' => 'All the work for the new marketing site',
+      'created_at' => '2024-01-15T10:30:00Z',
+      'updated_at' => '2024-01-20T14:22:00Z'
+    }
+  ],
+  'metadata' => {
+    'next' => 'cursor_def456'
+  }
+}
+```
+
+**Note:** Not every platform returns every field. Jira does not expose creation or update timestamps for projects, so `created_at` and `updated_at` are `nil` for Jira connections, and `status` is only set when Jira reports whether the project is archived.
+
 #### CRM API
 
 The CRM API provides a unified interface for CRM platforms like Attio, HubSpot, PipeDrive, Salesforce and Zoho.
@@ -1171,6 +1334,169 @@ puts "Events: #{result['data']}"
 
 Recurring events are expanded into their occurrences. All-day events carry a `YYYY-MM-DD` date rather than a timestamp. Attendees, conferencing links and organizers are available through `include_raw` or the Proxy API.
 
+### MCP API
+
+Reach a provider's own MCP server using a connection's credentials. BundleUp injects and refreshes the access token, so the connection ID is the only thing your agent needs to know about a user.
+
+Supported for providers that run a first-party MCP server — see the [integrations page](https://www.bundleup.io/integrations). Others return an `mcp_not_supported` error.
+
+BundleUp does not ship an MCP client. Hand `hosted` or `transport` to the one you already use, or send JSON-RPC yourself with `post` and `delete`, which return the response untouched as `Faraday::Response` objects, like the Proxy API.
+
+#### Creating an MCP Instance
+
+```ruby
+mcp = client.mcp('conn_123abc')
+```
+
+#### Model-Hosted MCP
+
+OpenAI and Anthropic can connect to an MCP server themselves, with no tool mapping or dispatch loop on your side. Both accept only a single credential and no custom headers, so `hosted` returns the server URL alongside the API key and connection joined into one bearer.
+
+```ruby
+hosted = client.mcp('conn_123abc').hosted
+
+response = openai.responses.create(
+  model: 'gpt-4o',
+  input: 'What issues are assigned to me?',
+  tools: [
+    {
+      type: 'mcp',
+      server_label: 'linear',
+      server_url: hosted[:url],
+      authorization: hosted[:token],
+      require_approval: 'never'
+    }
+  ]
+)
+```
+
+Anthropic's connector takes the same pair as `url` and `authorization_token`.
+
+`server_url` must be exactly the URL `hosted` returns — the proxy rebuilds the upstream URL from the provider's own base, so any path or query you append is ignored rather than rejected.
+
+This sends your API key to the model provider, whose servers make the request. Use an MCP client in your own backend if that is not acceptable.
+
+#### Using an MCP Client Library
+
+`transport` returns the URL and headers if you would rather use an existing MCP client. Pass them to any client that supports the streamable HTTP transport.
+
+```ruby
+transport = client.mcp('conn_123abc').transport
+
+transport[:url]     # => "https://mcp.bundleup.io"
+transport[:headers] # => { "Authorization" => "Bearer ...", "BU-Connection-Id" => "conn_123abc", ... }
+```
+
+#### Sending JSON-RPC Directly
+
+MCP requires an `initialize` handshake before any other method. The session ID comes back on that first response and must be sent on every call after it.
+
+```ruby
+mcp = client.mcp('conn_123abc')
+
+# 1. Handshake
+init = mcp.post({
+  jsonrpc: '2.0',
+  id: 1,
+  method: 'initialize',
+  params: {
+    protocolVersion: '2025-06-18',
+    capabilities: {},
+    clientInfo: { name: 'my-agent', version: '1.0.0' }
+  }
+})
+
+session_id = init.headers['mcp-session-id']
+session = session_id ? { 'Mcp-Session-Id' => session_id } : {}
+
+# 2. Confirm the handshake (a notification — no id, no response body)
+mcp.post({ jsonrpc: '2.0', method: 'notifications/initialized' }, headers: session)
+
+# 3. List tools
+response = mcp.post({ jsonrpc: '2.0', id: 2, method: 'tools/list' }, headers: session)
+result = parse(response)['result']
+
+puts result['tools']
+```
+
+Providers may answer with `text/event-stream` rather than JSON, so responses need unwrapping either way:
+
+```ruby
+require 'json'
+
+def parse(response)
+  return JSON.parse(response.body) unless response.headers['content-type'].to_s.include?('text/event-stream')
+
+  data = response.body.lines
+                 .select { |line| line.start_with?('data:') }
+                 .map { |line| line[5..].strip }
+                 .join("\n")
+
+  JSON.parse(data)
+end
+```
+
+Tool lists can be paginated. If `result['nextCursor']` is set, call `tools/list` again with `params: { cursor: result['nextCursor'] }` until it comes back empty.
+
+Calling a tool follows the same shape:
+
+```ruby
+response = mcp.post({
+  jsonrpc: '2.0',
+  id: 3,
+  method: 'tools/call',
+  params: { name: 'create_issue', arguments: { title: 'Login broken' } }
+}, headers: session)
+```
+
+#### Sessions
+
+MCP sessions live on the provider's server — BundleUp holds no session state. Close one when you are done:
+
+```ruby
+mcp.delete(headers: { 'Mcp-Session-Id' => session_id })
+```
+
+#### Errors
+
+BundleUp rejects a request before it reaches the provider by returning an HTTP error with a JSON body — the response is passed straight through, so check `response.success?` yourself.
+
+```ruby
+response = mcp.post(body)
+
+unless response.success?
+  error = JSON.parse(response.body)
+  # connection_invalid, connection_refresh_failed, mcp_not_supported, rate_limit
+  warn "#{error['code']}: #{error['message']}"
+end
+```
+
+Every JSON-RPC message counts toward the rate limit of 100 requests per 60 seconds, per connection — including the `initialize` handshake.
+
+#### Several Connections
+
+An agent often needs more than one provider for the same end user. With model-hosted MCP there is nothing to merge — pass one `mcp` tool per connection and the model provider keeps them apart by `server_label`:
+
+```ruby
+connections = { 'slack' => user.slack_connection, 'linear' => user.linear_connection }
+
+tools = connections.map do |label, connection_id|
+  hosted = client.mcp(connection_id).hosted
+
+  {
+    type: 'mcp',
+    server_label: label,
+    server_url: hosted[:url],
+    authorization: hosted[:token],
+    require_approval: 'never'
+  }
+end
+```
+
+With an MCP client in your own backend, open one client per connection from its `transport`, prefix each tool name with a label (`slack__send_message`), and route calls back by that prefix. There is no merge helper in the SDK — how tools are namespaced, filtered and recovered from differs enough per agent that it is better written where you can see it.
+
+**Filter before you hand tools to a model** — three providers is easily sixty tools, and accuracy drops as that list grows, so give the agent only the ones it needs.
+
 ## Error Handling
 
 The SDK raises exceptions for errors. Always wrap SDK calls in rescue blocks for proper error handling.
@@ -1212,7 +1538,9 @@ lib/
 ├── bundleup.rb              # Main entry point
 ├── bundleup/
 │   ├── client.rb            # Main client class
+│   ├── auth.rb              # Auth API (authorization URL + code exchange)
 │   ├── proxy.rb             # Proxy API implementation
+│   ├── mcp.rb               # MCP API (transport + hosted)
 │   ├── unify.rb             # Unify API client wrapper
 │   ├── version.rb           # Gem version
 │   ├── resources/

data/lib/bundleup/auth.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+require 'uri'
+
+module BundleUp
+  # Client for the hosted authorization flow.
+  class Auth
+    BASE_URL = 'https://auth.bundleup.io'
+
+    attr_reader :api_key
+
+    def initialize(api_key)
+      @api_key = api_key
+    end
+
+    # Builds the hosted authorization URL to send the end user to.
+    def build_authorization_url(client_id:, integration_id:, redirect_uri:, external_id: nil, state: nil)
+      raise ArgumentError, 'client_id is required' if blank?(client_id)
+      raise ArgumentError, 'integration_id is required' if blank?(integration_id)
+      raise ArgumentError, 'redirect_uri is required' if blank?(redirect_uri)
+
+      params = {
+        client_id: client_id,
+        integration_id: integration_id,
+        redirect_uri: redirect_uri
+      }
+      params[:external_id] = external_id unless blank?(external_id)
+      params[:state] = state unless blank?(state)
+
+      "#{BASE_URL}/authorize?#{URI.encode_www_form(params)}"
+    end
+
+    # Exchanges the one-time code from the redirect for the connection.
+    # Call this server-side; the code expires after 5 minutes and works once.
+    # Returns { 'connection_id', 'external_id', 'integration_id' }.
+    def get_connection_from_code(code:, redirect_uri:)
+      raise ArgumentError, 'code is required' if blank?(code)
+      raise ArgumentError, 'redirect_uri is required' if blank?(redirect_uri)
+
+      response = connection.post('connection', { code: code, redirect_uri: redirect_uri })
+
+      raise "Failed to get connection: #{response.status}: #{response.body}" unless response.success?
+
+      response.body
+    end
+
+    private
+
+    def blank?(value)
+      value.nil? || value.to_s.empty?
+    end
+
+    # Memoize the Faraday connection to reuse it across requests
+    def connection
+      @connection ||= Faraday.new(url: BASE_URL) do |faraday|
+        faraday.headers = {
+          'Authorization' => "Bearer #{@api_key}",
+          'Content-Type' => 'application/json'
+        }
+
+        faraday.request :json
+        faraday.response :json, content_type: /\bjson$/
+        faraday.adapter Faraday.default_adapter
+      end
+    end
+  end
+end

data/lib/bundleup/client.rb

@@ -11,6 +11,10 @@ module BundleUp
       @api_key = api_key
     end
 
+    def auth
+      @auth ||= BundleUp::Auth.new(@api_key)
+    end
+
     def connections
       @connections ||= BundleUp::Resources::Connection.new(@api_key)
     end

data/lib/bundleup/mcp.rb

@@ -3,11 +3,11 @@
 require 'json'
 
 module BundleUp
-  # Transport for a connection's MCP server.
+  # A connection's MCP server.
   #
-  # +post+ and +delete+ return the raw Faraday response, the way Proxy does.
-  # Use +connect+ for a managed session that handles the handshake and
-  # response decoding.
+  # BundleUp does not ship an MCP client. Hand +transport+ or +hosted+ to the
+  # client you already use, or drive the protocol yourself with +post+ and
+  # +delete+, which return the raw Faraday response the way Proxy does.
   class MCP
     BASE_URL = 'https://mcp.bundleup.io'
 
@@ -47,11 +47,6 @@ module BundleUp
       connection.delete(BASE_URL, nil, default_headers.merge(headers))
     end
 
-    # Open a managed MCP session for this connection.
-    def connect
-      MCPClient.new(BASE_URL, @api_key, @connection_id)
-    end
-
     private
 
     def default_headers
@@ -67,201 +62,4 @@ module BundleUp
       @connection ||= Faraday.new { |faraday| faraday.adapter Faraday.default_adapter }
     end
   end
-
-  # A connected MCP session.
-  #
-  # Tools, resources and prompts are defined by the provider — BundleUp does
-  # not rename or normalize them.
-  class MCPClient
-    PROTOCOL_VERSION = '2025-06-18'
-    CLIENT_NAME = 'bundleup-sdk'
-
-    def initialize(base_url, api_key, connection_id)
-      @base_url = base_url
-      @api_key = api_key
-      @connection_id = connection_id
-      @session_id = nil
-      @connected = false
-      @last_id = 0
-    end
-
-    # List the provider's tools, following pagination to the end.
-    def list_tools
-      paginate('tools/list', 'tools')
-    end
-
-    # Call a tool by name, with arguments matching its own input schema.
-    def call_tool(name, args = {})
-      raise ArgumentError, 'Tool name is required to call a tool.' if blank?(name)
-
-      connect
-      send_message('tools/call', { name: name, arguments: args })
-    end
-
-    # List the provider's resources, following pagination to the end.
-    def list_resources
-      paginate('resources/list', 'resources')
-    end
-
-    # Read a resource by URI.
-    def read_resource(uri)
-      raise ArgumentError, 'Resource URI is required to read a resource.' if blank?(uri)
-
-      connect
-      send_message('resources/read', { uri: uri })
-    end
-
-    # List the provider's prompts, following pagination to the end.
-    def list_prompts
-      paginate('prompts/list', 'prompts')
-    end
-
-    # Get a prompt by name.
-    def get_prompt(name, args = {})
-      raise ArgumentError, 'Prompt name is required to get a prompt.' if blank?(name)
-
-      connect
-      send_message('prompts/get', { name: name, arguments: args })
-    end
-
-    # Send any other JSON-RPC method on this session.
-    def request(method, params = nil)
-      raise ArgumentError, 'Method is required to send a request.' if blank?(method)
-
-      connect
-      send_message(method, params)
-    end
-
-    # End the session and reset local state.
-    def close
-      delete_session if @session_id
-
-      @session_id = nil
-      @connected = false
-      nil
-    end
-
-    private
-
-    def blank?(value)
-      value.nil? || value.to_s.empty?
-    end
-
-    def default_headers
-      headers = {
-        'Authorization' => "Bearer #{@api_key}",
-        'Content-Type' => 'application/json',
-        'Accept' => 'application/json, text/event-stream',
-        'BU-Connection-Id' => @connection_id
-      }
-      headers['Mcp-Session-Id'] = @session_id if @session_id
-      headers
-    end
-
-    def connection
-      @connection ||= Faraday.new { |faraday| faraday.adapter Faraday.default_adapter }
-    end
-
-    def post_payload(payload)
-      response = connection.post(@base_url, payload.to_json, default_headers)
-      session_id = response.headers['mcp-session-id']
-      @session_id = session_id if session_id
-
-      raise error_for(response) unless response.success?
-
-      response
-    end
-
-    def error_for(response)
-      fallback = "MCP request failed with status #{response.status}."
-      parsed = JSON.parse(response.body.to_s)
-      return RuntimeError.new(fallback) unless parsed.is_a?(Hash) && parsed['message']
-
-      code = parsed['code']
-      RuntimeError.new(code ? "#{parsed['message']} (#{code})" : parsed['message'])
-    rescue JSON::ParserError
-      RuntimeError.new(fallback)
-    end
-
-    # Run the MCP handshake, once. Deferred until the first call.
-    def connect
-      return if @connected
-
-      send_message('initialize', handshake_params)
-      post_payload({ jsonrpc: '2.0', method: 'notifications/initialized' })
-      @connected = true
-    end
-
-    def handshake_params
-      {
-        protocolVersion: PROTOCOL_VERSION,
-        capabilities: {},
-        clientInfo: { name: CLIENT_NAME, version: BundleUp::VERSION }
-      }
-    end
-
-    def send_message(method, params = nil)
-      @last_id += 1
-      payload = { jsonrpc: '2.0', id: @last_id, method: method }
-      payload[:params] = params unless params.nil?
-
-      message = parse(post_payload(payload), @last_id)
-      raise "No response received for #{method}." if message.nil?
-      raise message['error']['message'].to_s if message['error']
-
-      message['result'] || {}
-    end
-
-    # Providers may answer a plain request/response over text/event-stream.
-    def parse(response, message_id)
-      body = response.body.to_s
-      return nil if body.empty?
-
-      content_type = response.headers['content-type'].to_s
-      return JSON.parse(body) unless content_type.include?('text/event-stream')
-
-      parse_stream(body, message_id)
-    end
-
-    def parse_stream(body, message_id)
-      body.gsub("\r\n", "\n").split("\n\n").each do |event|
-        data = event_data(event)
-        next if data.empty?
-
-        message = JSON.parse(data)
-        # Skip server notifications interleaved on the stream.
-        return message if message.is_a?(Hash) && message['id'] == message_id
-      end
-
-      nil
-    end
-
-    def event_data(event)
-      event.split("\n")
-           .select { |line| line.start_with?('data:') }
-           .map { |line| line.sub('data:', '').strip }
-           .join("\n")
-    end
-
-    def paginate(method, key)
-      connect
-      items = []
-      cursor = nil
-
-      loop do
-        result = send_message(method, cursor ? { cursor: cursor } : nil)
-        items.concat(result[key] || [])
-        cursor = result['nextCursor']
-        break unless cursor
-      end
-
-      items
-    end
-
-    def delete_session
-      connection.delete(@base_url, nil, default_headers)
-    rescue Faraday::Error
-      nil
-    end
-  end
 end

data/lib/bundleup/unify/git.rb

@@ -30,6 +30,21 @@ module BundleUp
         response.body
       end
 
+      # Fetches issues for a specific repository from the connected Git provider.
+      def issues(repo_name, params = {})
+        raise ArgumentError, 'repo_name is required to fetch issues.' if blank?(repo_name)
+
+        encoded_repo_name = URI.encode_www_form_component(repo_name)
+
+        response = connection.get("git/repos/#{encoded_repo_name}/issues") do |req|
+          req.params = params
+        end
+
+        raise "Failed to fetch git/repos/#{encoded_repo_name}/issues: #{response.status}" unless response.success?
+
+        response.body
+      end
+
       # Fetches tags for a specific repository from the connected Git provider.
       def tags(repo_name, params = {})
         raise ArgumentError, 'repo_name is required to fetch tags.' if blank?(repo_name)

data/lib/bundleup/unify/ticketing.rb

@@ -33,6 +33,17 @@ module BundleUp
         response.body
       end
 
+      # Fetches projects from the connected ticketing tool.
+      def projects(params = {})
+        response = connection.get('ticketing/projects') do |req|
+          req.params = params
+        end
+
+        raise "Failed to fetch ticketing/projects: #{response.status}" unless response.success?
+
+        response.body
+      end
+
       private
 
       def blank?(value)

data/lib/bundleup/unify.rb

@@ -54,11 +54,6 @@ module BundleUp
       def me(params = {})
         (@me ||= BundleUp::Unify::Me.new(api_key, connection_id)).get(params)
       end
-
-      # Access the Unified MCP server for the connection.
-      def mcp
-        @mcp ||= BundleUp::Unify::MCP.new(api_key, connection_id)
-      end
     end
   end
 end

data/lib/bundleup/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module BundleUp
-  VERSION = '0.4.3'
+  VERSION = '0.6.0'
 end

data/lib/bundleup.rb

@@ -4,6 +4,7 @@ require 'faraday'
 
 require_relative 'bundleup/version'
 require_relative 'bundleup/client'
+require_relative 'bundleup/auth'
 require_relative 'bundleup/proxy'
 require_relative 'bundleup/unify'
 require_relative 'bundleup/mcp'
@@ -22,7 +23,6 @@ require_relative 'bundleup/unify/ticketing'
 require_relative 'bundleup/unify/crm'
 require_relative 'bundleup/unify/drive'
 require_relative 'bundleup/unify/calendar'
-require_relative 'bundleup/unify/mcp'
 require_relative 'bundleup/unify/me'
 
 # Main module for the BundleUp SDK.

data/sig/bundleup/auth.rbs

@@ -0,0 +1,31 @@
+module BundleUp
+  class Auth
+    BASE_URL: String
+
+    type connection = {
+      "connection_id" => String,
+      "external_id" => String?,
+      "integration_id" => String
+    }
+
+    attr_reader api_key: String
+
+    def initialize: (String api_key) -> void
+
+    def build_authorization_url: (
+      client_id: String,
+      integration_id: String,
+      redirect_uri: String,
+      ?external_id: String?,
+      ?state: String?
+    ) -> String
+
+    def get_connection_from_code: (code: String, redirect_uri: String) -> connection
+
+    private
+
+    def blank?: (untyped value) -> bool
+
+    def connection: () -> untyped
+  end
+end

data/sig/bundleup/unify/git.rbs

@@ -26,6 +26,19 @@ module BundleUp
         merged_at: String?
       }
 
+      type git_issue = {
+        id: Integer,
+        number: Integer,
+        title: String,
+        description: String?,
+        state: String,
+        url: String,
+        user: String?,
+        created_at: String,
+        updated_at: String,
+        closed_at: String?
+      }
+
       type git_tag = { name: String, commit_sha: String }
 
       type git_release = {
@@ -41,13 +54,24 @@ module BundleUp
 
       type git_branch = { name: String, commit_sha: String, protected: bool }
 
+      type git_commit = {
+        sha: String,
+        message: String?,
+        url: String,
+        author: String?,
+        author_email: String?,
+        committed_at: String?
+      }
+
       type metadata = { next: String? }
 
       def repos: (?Hash[Symbol, untyped] params) -> { data: Array[git_repo], metadata: metadata }
       def pulls: (String repo_name, ?Hash[Symbol, untyped] params) -> { data: Array[git_pull], metadata: metadata }
+      def issues: (String repo_name, ?Hash[Symbol, untyped] params) -> { data: Array[git_issue], metadata: metadata }
       def tags: (String repo_name, ?Hash[Symbol, untyped] params) -> { data: Array[git_tag], metadata: metadata }
       def releases: (String repo_name, ?Hash[Symbol, untyped] params) -> { data: Array[git_release], metadata: metadata }
       def branches: (String repo_name, ?Hash[Symbol, untyped] params) -> { data: Array[git_branch], metadata: metadata }
+      def commits: (String repo_name, ?Hash[Symbol, untyped] params) -> { data: Array[git_commit], metadata: metadata }
     end
   end
 end

data/sig/bundleup/unify/ticketing.rbs

@@ -21,12 +21,24 @@ module BundleUp
         updated_at: String?
       }
 
+      type ticketing_project = {
+        id: String,
+        name: String,
+        status: String?,
+        url: String?,
+        description: String?,
+        created_at: String?,
+        updated_at: String?
+      }
+
       type metadata = { next: String? }
 
       def tickets: (?Hash[Symbol, untyped] params) -> { data: Array[ticketing_ticket], metadata: metadata }
 
       def ticket: (String ticket_id, ?Hash[Symbol, untyped] params) -> { data: ticket }
 
+      def projects: (?Hash[Symbol, untyped] params) -> { data: Array[ticketing_project], metadata: metadata }
+
       private
 
       def blank?: (untyped) -> bool

data/sig/bundleup/unify.rbs

@@ -8,7 +8,7 @@ module BundleUp
 
       def chat: () -> Chat
       def git: () -> Git
-      def pm: () -> PM
+      def ticketing: () -> Ticketing
       def crm: () -> CRM
       def drive: () -> Drive
       def calendar: () -> Calendar

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: bundleup-sdk
 version: !ruby/object:Gem::Version
-  version: 0.4.3
+  version: 0.6.0
 platform: ruby
 authors:
 - BundleUp
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-27 00:00:00.000000000 Z
+date: 2026-10-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: faraday
@@ -167,9 +167,9 @@ files:
 - LICENSE
 - README.md
 - lib/bundleup.rb
+- lib/bundleup/auth.rb
 - lib/bundleup/client.rb
 - lib/bundleup/mcp.rb
-- lib/bundleup/mcp_client.rb
 - lib/bundleup/proxy.rb
 - lib/bundleup/resources/base.rb
 - lib/bundleup/resources/connection.rb
@@ -182,10 +182,10 @@ files:
 - lib/bundleup/unify/crm.rb
 - lib/bundleup/unify/drive.rb
 - lib/bundleup/unify/git.rb
-- lib/bundleup/unify/mcp.rb
 - lib/bundleup/unify/me.rb
 - lib/bundleup/unify/ticketing.rb
 - lib/bundleup/version.rb
+- sig/bundleup/auth.rbs
 - sig/bundleup/unify.rbs
 - sig/bundleup/unify/base.rbs
 - sig/bundleup/unify/calendar.rbs

data/lib/bundleup/mcp_client.rb

@@ -1,202 +0,0 @@
-# frozen_string_literal: true
-
-require 'json'
-
-module BundleUp
-  # A connected MCP session.
-  #
-  # Tools, resources and prompts are defined by the provider — BundleUp does
-  # not rename or normalize them.
-  class MCPClient
-    PROTOCOL_VERSION = '2025-06-18'
-    CLIENT_NAME = 'bundleup-sdk'
-
-    def initialize(base_url, api_key, connection_id)
-      @base_url = base_url
-      @api_key = api_key
-      @connection_id = connection_id
-      @session_id = nil
-      @connected = false
-      @last_id = 0
-    end
-
-    # List the provider's tools, following pagination to the end.
-    def tools
-      paginate('tools/list', 'tools')
-    end
-
-    # Call a tool by name, with arguments matching its own input schema.
-    def tool(name, args = {})
-      raise ArgumentError, 'Tool name is required to call a tool.' if blank?(name)
-
-      connect
-      send_message('tools/call', { name: name, arguments: args })
-    end
-
-    # List the provider's resources, following pagination to the end.
-    def resources
-      paginate('resources/list', 'resources')
-    end
-
-    # Read a resource by URI.
-    def resource(uri)
-      raise ArgumentError, 'Resource URI is required to read a resource.' if blank?(uri)
-
-      connect
-      send_message('resources/read', { uri: uri })
-    end
-
-    # List the provider's prompts, following pagination to the end.
-    def prompts
-      paginate('prompts/list', 'prompts')
-    end
-
-    # Get a prompt by name.
-    def prompt(name, args = {})
-      raise ArgumentError, 'Prompt name is required to get a prompt.' if blank?(name)
-
-      connect
-      send_message('prompts/get', { name: name, arguments: args })
-    end
-
-    # Send any other JSON-RPC method on this session.
-    def request(method, params = nil)
-      raise ArgumentError, 'Method is required to send a request.' if blank?(method)
-
-      connect
-      send_message(method, params)
-    end
-
-    # End the session and reset local state.
-    def close
-      delete_session if @session_id
-
-      @session_id = nil
-      @connected = false
-      nil
-    end
-
-    private
-
-    def blank?(value)
-      value.nil? || value.to_s.empty?
-    end
-
-    def default_headers
-      headers = {
-        'Authorization' => '******',
-        'Content-Type' => 'application/json',
-        'Accept' => 'application/json, text/event-stream',
-        'BU-Connection-Id' => @connection_id
-      }
-      headers['Mcp-Session-Id'] = @session_id if @session_id
-      headers
-    end
-
-    def connection
-      @connection ||= Faraday.new { |faraday| faraday.adapter Faraday.default_adapter }
-    end
-
-    def post_payload(payload)
-      response = connection.post(@base_url, payload.to_json, default_headers)
-      session_id = response.headers['mcp-session-id']
-      @session_id = session_id if session_id
-
-      raise error_for(response) unless response.success?
-
-      response
-    end
-
-    def error_for(response)
-      fallback = "MCP request failed with status #{response.status}."
-      parsed = JSON.parse(response.body.to_s)
-      return RuntimeError.new(fallback) unless parsed.is_a?(Hash) && parsed['message']
-
-      code = parsed['code']
-      RuntimeError.new(code ? "#{parsed['message']} (#{code})" : parsed['message'])
-    rescue JSON::ParserError
-      RuntimeError.new(fallback)
-    end
-
-    # Run the MCP handshake, once. Deferred until the first call.
-    def connect
-      return if @connected
-
-      send_message('initialize', handshake_params)
-      post_payload({ jsonrpc: '2.0', method: 'notifications/initialized' })
-      @connected = true
-    end
-
-    def handshake_params
-      {
-        protocolVersion: PROTOCOL_VERSION,
-        capabilities: {},
-        clientInfo: { name: CLIENT_NAME, version: BundleUp::VERSION }
-      }
-    end
-
-    def send_message(method, params = nil)
-      @last_id += 1
-      payload = { jsonrpc: '2.0', id: @last_id, method: method }
-      payload[:params] = params unless params.nil?
-
-      message = parse(post_payload(payload), @last_id)
-      raise "No response received for #{method}." if message.nil?
-      raise message['error']['message'].to_s if message['error']
-
-      message['result'] || {}
-    end
-
-    # Providers may answer a plain request/response over text/event-stream.
-    def parse(response, message_id)
-      body = response.body.to_s
-      return nil if body.empty?
-
-      content_type = response.headers['content-type'].to_s
-      return JSON.parse(body) unless content_type.include?('text/event-stream')
-
-      parse_stream(body, message_id)
-    end
-
-    def parse_stream(body, message_id)
-      body.gsub("\r\n", "\n").split("\n\n").each do |event|
-        data = event_data(event)
-        next if data.empty?
-
-        message = JSON.parse(data)
-        # Skip server notifications interleaved on the stream.
-        return message if message.is_a?(Hash) && message['id'] == message_id
-      end
-
-      nil
-    end
-
-    def event_data(event)
-      event.split("\n")
-           .select { |line| line.start_with?('data:') }
-           .map { |line| line.sub('data:', '').strip }
-           .join("\n")
-    end
-
-    def paginate(method, key)
-      connect
-      items = []
-      cursor = nil
-
-      loop do
-        result = send_message(method, cursor ? { cursor: cursor } : nil)
-        items.concat(result[key] || [])
-        cursor = result['nextCursor']
-        break unless cursor
-      end
-
-      items
-    end
-
-    def delete_session
-      connection.delete(@base_url, nil, default_headers)
-    rescue Faraday::Error
-      nil
-    end
-  end
-end

data/lib/bundleup/unify/mcp.rb

@@ -1,44 +0,0 @@
-# frozen_string_literal: true
-
-module BundleUp
-  module Unify
-    # The Unified MCP server.
-    #
-    # Same protocol and headers as Proxy MCP, but the tools are BundleUp's
-    # normalized ones rather than the provider's. Tools only — Unified MCP
-    # exposes no resources or prompts.
-    #
-    # The server is stateless and POST-only, so there is no session to close.
-    class MCP
-      BASE_URL = 'https://unify.bundleup.io/v1/mcp'
-
-      attr_reader :api_key, :connection_id
-
-      def initialize(api_key, connection_id)
-        @api_key = api_key
-        @connection_id = connection_id
-        @client = ::BundleUp::MCPClient.new(BASE_URL, api_key, connection_id)
-      end
-
-      # The URL and a single bearer token carrying both the API key and the
-      # connection, for model-hosted MCP clients that cannot set headers.
-      def hosted
-        separator = ::BundleUp::MCP::CREDENTIAL_SEPARATOR
-
-        { url: BASE_URL, token: "#{@api_key}#{separator}#{@connection_id}" }
-      end
-
-      # List the available unified tools.
-      def list_tools
-        @client.list_tools
-      end
-
-      # Call a unified tool with optional arguments.
-      def call_tool(name, args = {})
-        raise ArgumentError, 'Tool name is required to call a tool.' if name.nil? || name.to_s.empty?
-
-        @client.call_tool(name, args)
-      end
-    end
-  end
-end