@absolutejs/mcp 0.8.0 → 0.9.0

package/README.md

@@ -1,5 +1,9 @@
 # @absolutejs/mcp
 
+MCP tool discovery preserves the OpenID AuthZEN COAZ `coaz` marker and
+`x-coaz-mapping` JSON Schema extension end to end. Use `@absolutejs/policy` to
+validate and evaluate the mapping before dispatching an authorized tool call.
+
 Serve a remote [Model Context Protocol](https://modelcontextprotocol.io) endpoint
 — streamable HTTP, stateless — from a tool/prompt/resource registry. You supply
 **which** tools to expose and **how** to authorize a request into a caller; the

package/dist/index.js

@@ -265,6 +265,7 @@ var createMcpClient = (options) => {
       const tools = isRecord(result) && Array.isArray(result.tools) ? result.tools : [];
       collected.push(...tools.filter(isRecord).map((tool) => ({
         annotations: isRecord(tool.annotations) ? tool.annotations : undefined,
+        coaz: typeof tool.coaz === "boolean" ? tool.coaz : undefined,
         description: typeof tool.description === "string" ? tool.description : undefined,
         inputSchema: isRecord(tool.inputSchema) ? tool.inputSchema : undefined,
         name: typeof tool.name === "string" ? tool.name : "",
@@ -763,6 +764,7 @@ var toolsList = async (config, caller, scopes, id, params) => {
   const tools = await config.tools({ caller, meta: {} });
   const visible = Object.entries(tools).filter(([, tool]) => scopeAllows(tool, scopes) && agencyAllows(config, tool, scopes)).map(([name, tool]) => ({
     annotations: tool.annotations,
+    ...tool.coaz === undefined ? {} : { coaz: tool.coaz },
     description: tool.description,
     inputSchema: tool.inputSchema,
     name,

package/dist/manifest.js

@@ -5916,6 +5916,14 @@ var serializedTool = Type.Object({
 });
 var manifestSchema = Type.Object({
   contract: Type.Union([Type.Literal(1), Type.Literal(2)]),
+  discovery: Type.Optional(Type.Object({
+    audiences: Type.Optional(Type.Array(Type.String({ minLength: 1 }))),
+    certificationUrl: Type.Optional(Type.String()),
+    intents: Type.Optional(Type.Array(Type.String({ minLength: 1 }))),
+    keywords: Type.Optional(Type.Array(Type.String({ minLength: 1 }))),
+    protocols: Type.Optional(Type.Array(Type.String({ minLength: 1 }))),
+    url: Type.Optional(Type.String())
+  })),
   identity: Type.Object({
     accent: Type.Optional(Type.String({ pattern: "^#[0-9a-fA-F]{3,8}$" })),
     category: Type.String({ minLength: 1 }),

package/dist/src/client.d.ts

@@ -34,6 +34,7 @@ export type McpClientOptions = {
 };
 export type McpRemoteTool = {
     annotations?: McpToolAnnotations;
+    coaz?: boolean;
     description?: string;
     inputSchema?: Record<string, unknown>;
     name: string;

package/dist/src/types.d.ts

@@ -110,6 +110,9 @@ export type McpToolCallContext = {
 /** One callable tool. `inputSchema` is a JSON Schema object. */
 export type McpTool = {
     annotations?: McpToolAnnotations;
+    /** OpenID AuthZEN COAZ opt-in marker. When true, inputSchema MUST carry an
+     *  `x-coaz-mapping`; hosts should evaluate it before invoking the handler. */
+    coaz?: boolean;
     /** Enforceable semantic effects from manifest contract 2. A tool carrying
      *  this is hidden unless the server configures `agency`. */
     authorization?: ToolAuthorization;

package/package.json

@@ -11,8 +11,8 @@
     "elysia": ">=1.1.0"
   },
   "dependencies": {
-    "@absolutejs/agency": "^0.3.0",
-    "@absolutejs/manifest": "^0.2.0",
+    "@absolutejs/agency": "^0.4.0",
+    "@absolutejs/manifest": "^0.3.0",
     "@sinclair/typebox": "^0.34.0"
   },
   "license": "BUSL-1.1",
@@ -58,5 +58,5 @@
     "typecheck": "tsc --noEmit --project tsconfig.json"
   },
   "types": "./dist/src/index.d.ts",
-  "version": "0.8.0"
+  "version": "0.9.0"
 }