@artifactly/mcp 0.1.8 → 0.1.9

package/README.md

@@ -35,6 +35,43 @@ npx -y --package=@artifactly/mcp artifactly-mcp
 
 The package also exposes a human CLI as `artifactly`.
 
+## Agent MCP usage
+
+Typical MCP client config:
+
+```toml
+[mcp_servers.artifactly]
+command = "npx"
+args = ["-y", "@artifactly/mcp"]
+```
+
+Robust explicit-bin form:
+
+```toml
+[mcp_servers.artifactly]
+command = "npx"
+args = ["-y", "--package=@artifactly/mcp", "artifactly-mcp"]
+```
+
+Authentication flow:
+
+1. Run `artifactly_request_login_code` with an email address.
+2. Run `artifactly_verify_login_code` with the emailed code.
+3. Use `artifactly_auth_status` to inspect local credentials, or pass `validate: true` to confirm the saved API key with the Artifactly server.
+4. Run `artifactly_logout` to clear local credentials.
+
+Artifact workflow notes:
+
+- Default visibility is `unlisted` for agent-created artifacts.
+- Supported visibility values are `public`, `unlisted`, `private`, and `gated`.
+- `gated` artifacts can be published with an `accessList` of allowed email addresses or updated later with `artifactly_update_artifact`.
+- `artifactly_list_artifacts` supports `limit`, `cursor`, `visibility`, and `kind` filters and omits large artifact content by default.
+- `artifactly_get_artifact` returns full owner-visible artifact details.
+- `artifactly_update_artifact` accepts either `markdown` or `content`, not both; pass `description: ""` to clear a description.
+- `artifactly_publish_file` infers MIME type from file extension unless `mimeType` is supplied; explicit `mimeType` wins.
+- Files larger than 10 MB are rejected before upload to avoid large in-memory base64 payloads.
+- Requests time out after 30 seconds.
+
 Manual publish from a logged-in maintainer account:
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@artifactly/mcp",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "private": false,
   "files": [
     "bin",

package/src/cli/artifactly-cli.test.ts

@@ -6,6 +6,7 @@ import { describe, expect, it } from "vitest";
 
 import {
   createArtifactlyCli,
+  createDefaultPostJson,
   getDefaultCredentialPath,
   readCredentials,
 } from "./artifactly-cli";
@@ -107,4 +108,23 @@ describe("artifactly CLI", () => {
       "/Users/alice/.artifactly/credentials.json",
     );
   });
+
+  it("uses an explicit timeout signal for default POST requests", async () => {
+    const calls: Array<{ url: string; signal?: AbortSignal }> = [];
+    const postJson = createDefaultPostJson("https://artifactly.example", {
+      timeoutMs: 1234,
+      fetcher: async (url, init) => {
+        calls.push({ url: String(url), signal: init?.signal ?? undefined });
+        return new Response(JSON.stringify({ ok: true }), {
+          status: 200,
+          headers: { "content-type": "application/json" },
+        });
+      },
+    });
+
+    await expect(postJson("/api/test", { ok: true })).resolves.toEqual({ ok: true });
+    expect(calls).toEqual([
+      { url: "https://artifactly.example/api/test", signal: expect.any(AbortSignal) },
+    ]);
+  });
 });

package/src/cli/artifactly-cli.ts

@@ -17,6 +17,13 @@ export type PostJson = (
   options?: { apiKey?: string },
 ) => Promise<unknown>;
 
+type Fetcher = typeof fetch;
+
+type DefaultPostJsonOptions = {
+  timeoutMs?: number;
+  fetcher?: Fetcher;
+};
+
 type ArtifactlyCliOptions = {
   apiBaseUrl?: string;
   credentialPath?: string;
@@ -109,15 +116,21 @@ async function defaultPrompt(question: string) {
   }
 }
 
-export function createDefaultPostJson(apiBaseUrl: string): PostJson {
+export function createDefaultPostJson(
+  apiBaseUrl: string,
+  options: DefaultPostJsonOptions = {},
+): PostJson {
+  const fetcher = options.fetcher ?? fetch;
+  const timeoutMs = options.timeoutMs ?? 30_000;
   return async (path, body, options) => {
-    const response = await fetch(`${apiBaseUrl}${path}`, {
+    const response = await fetcher(`${apiBaseUrl}${path}`, {
       method: "POST",
       headers: {
         "content-type": "application/json",
         ...(options?.apiKey ? { authorization: `Bearer ${options.apiKey}` } : {}),
       },
       body: JSON.stringify(body),
+      signal: AbortSignal.timeout(timeoutMs),
     });
     const payload = (await response.json().catch(() => ({}))) as unknown;
     if (!response.ok) {

package/src/mcp/artifactly-mcp-docs.test.ts

@@ -0,0 +1,18 @@
+import { readFileSync } from "node:fs";
+
+import { describe, expect, it } from "vitest";
+
+describe("Artifactly MCP package documentation", () => {
+  it("documents installed-package behavior for agents", () => {
+    const readme = readFileSync("README.md", "utf8");
+
+    expect(readme).toContain("## Agent MCP usage");
+    expect(readme).toContain("artifactly_request_login_code");
+    expect(readme).toContain("artifactly_verify_login_code");
+    expect(readme).toContain("Default visibility is `unlisted`");
+    expect(readme).toContain("public`, `unlisted`, `private`, and `gated`");
+    expect(readme).toContain("`artifactly_list_artifacts` supports `limit`, `cursor`, `visibility`, and `kind`");
+    expect(readme).toContain("Files larger than 10 MB are rejected before upload");
+    expect(readme).toContain("Requests time out after 30 seconds");
+  });
+});

package/src/mcp/artifactly-mcp-server.test.ts

@@ -55,6 +55,22 @@ describe("Artifactly MCP stdio server helpers", () => {
         description: "",
       }).success,
     ).toBe(true);
+    expect(
+      server._registeredTools.artifactly_publish_markdown.inputSchema.safeParse({
+        title: "Gated",
+        markdown: "# Secret",
+        visibility: "gated",
+        accessList: ["agent@example.com"],
+      }).success,
+    ).toBe(true);
+    expect(
+      server._registeredTools.artifactly_list_artifacts.inputSchema.safeParse({
+        limit: 10,
+        cursor: "2026-02-01T00:00:00.000Z",
+        visibility: "gated",
+        kind: "html",
+      }).success,
+    ).toBe(true);
   });
 
   it("maps Artifactly tools to MCP-compatible tool definitions", () => {

package/src/mcp/artifactly-mcp-server.ts

@@ -100,8 +100,14 @@ const publishMarkdownSchema = z.object({
   title: z.string().min(1),
   markdown: z.string().min(1),
   visibility: z.enum(["public", "unlisted", "private", "gated"]).optional(),
+  accessList: z.array(z.string().email()).optional(),
+});
+const listArtifactsSchema = z.object({
+  limit: z.number().int().min(1).max(100).optional(),
+  cursor: z.string().optional(),
+  visibility: z.enum(["public", "unlisted", "private", "gated"]).optional(),
+  kind: z.enum(["markdown", "html", "image", "file", "json", "web_app"]).optional(),
 });
-const listArtifactsSchema = z.object({});
 const getArtifactSchema = z.object({
   artifactId: z.string().min(1),
 });

package/src/mcp/artifactly-mcp.test.ts

@@ -174,6 +174,58 @@ describe("Artifactly MCP tools", () => {
     rmSync(dir, { recursive: true, force: true });
   });
 
+  it("publishes gated markdown with access emails in one call", async () => {
+    const dir = mkdtempSync(join(tmpdir(), "artifactly-mcp-"));
+    const credentialPath = join(dir, "credentials.json");
+    const requests: Array<{ path: string; body: unknown; apiKey?: string }> = [];
+    writeCredentials(
+      {
+        apiBaseUrl: "https://artifactly.example",
+        apiKey: "art_t...et",
+        email: "agent@example.com",
+        workspace: "agent",
+      },
+      credentialPath,
+    );
+
+    await expect(
+      callArtifactlyMcpTool({
+        name: "artifactly_publish_markdown",
+        credentialPath,
+        arguments: {
+          title: "Gated",
+          markdown: "# Secret",
+          visibility: "gated",
+          accessList: ["One@Example.com", "two@example.com"],
+        },
+        postJson: async (path, body, options) => {
+          requests.push({ path, body, apiKey: options?.apiKey });
+          return {
+            id: "artifact_1",
+            accessList: ["one@example.com", "two@example.com"],
+          };
+        },
+      }),
+    ).resolves.toMatchObject({
+      id: "artifact_1",
+      accessList: ["one@example.com", "two@example.com"],
+    });
+    expect(requests).toEqual([
+      {
+        path: "/api/artifacts",
+        apiKey: "art_t...et",
+        body: {
+          title: "Gated",
+          content: "# Secret",
+          kind: "markdown",
+          visibility: "gated",
+          accessList: ["One@Example.com", "two@example.com"],
+        },
+      },
+    ]);
+    rmSync(dir, { recursive: true, force: true });
+  });
+
   it("preserves markdown body whitespace when publishing inline markdown", async () => {
     const dir = mkdtempSync(join(tmpdir(), "artifactly-mcp-"));
     const credentialPath = join(dir, "credentials.json");
@@ -218,7 +270,7 @@ describe("Artifactly MCP tools", () => {
 
     const requestJson = async (method: string, path: string, body?: unknown, options?: { apiKey?: string }) => {
       requests.push({ method, path, body, apiKey: options?.apiKey });
-      if (method === "GET" && path === "/api/artifacts") {
+      if (method === "GET" && path.startsWith("/api/artifacts?")) {
         return { artifacts: [{ id: "artifact_1", title: "Hello" }] };
       }
       if (method === "GET" && path === "/api/artifacts/artifact_1") {
@@ -231,7 +283,12 @@ describe("Artifactly MCP tools", () => {
     };
 
     await expect(
-      callArtifactlyMcpTool({ name: "artifactly_list_artifacts", credentialPath, requestJson }),
+      callArtifactlyMcpTool({
+        name: "artifactly_list_artifacts",
+        credentialPath,
+        arguments: { limit: 10, visibility: "gated", kind: "html", cursor: "2026-02-01T00:00:00.000Z" },
+        requestJson,
+      }),
     ).resolves.toEqual({ artifacts: [{ id: "artifact_1", title: "Hello" }] });
     await expect(
       callArtifactlyMcpTool({
@@ -264,7 +321,12 @@ describe("Artifactly MCP tools", () => {
     ).resolves.toEqual({ ok: true, artifactId: "artifact_1" });
 
     expect(requests).toEqual([
-      { method: "GET", path: "/api/artifacts", apiKey: "art_t...et", body: undefined },
+      {
+        method: "GET",
+        path: "/api/artifacts?limit=10&cursor=2026-02-01T00%3A00%3A00.000Z&visibility=gated&kind=html",
+        apiKey: "art_t...et",
+        body: undefined,
+      },
       { method: "GET", path: "/api/artifacts/artifact_1", apiKey: "art_t...et", body: undefined },
       {
         method: "PATCH",
@@ -417,4 +479,30 @@ describe("Artifactly MCP tools", () => {
 
     rmSync(dir, { recursive: true, force: true });
   });
+
+  it("rejects oversized files before reading them into base64 payloads", async () => {
+    const dir = mkdtempSync(join(tmpdir(), "artifactly-mcp-"));
+    const credentialPath = join(dir, "credentials.json");
+    const bigPath = join(dir, "big.pdf");
+    writeCredentials(
+      {
+        apiBaseUrl: "https://artifactly.example",
+        apiKey: "art_t...et",
+        email: "agent@example.com",
+        workspace: "agent",
+      },
+      credentialPath,
+    );
+    writeFileSync(bigPath, Buffer.alloc(10_000_001));
+
+    await expect(
+      callArtifactlyMcpTool({
+        name: "artifactly_publish_file",
+        credentialPath,
+        arguments: { path: bigPath },
+      }),
+    ).rejects.toThrow(/File is too large.*10 MB/);
+
+    rmSync(dir, { recursive: true, force: true });
+  });
 });

package/src/mcp/artifactly-mcp.ts

@@ -1,4 +1,4 @@
-import { readFileSync } from "node:fs";
+import { readFileSync, statSync } from "node:fs";
 import { basename, extname } from "node:path";
 
 import {
@@ -32,6 +32,9 @@ type RequestJson = (
   options?: { apiKey?: string },
 ) => Promise<unknown>;
 
+const REQUEST_TIMEOUT_MS = 30_000;
+const MAX_UPLOAD_BYTES = 10_000_000;
+
 function createDefaultRequestJson(apiBaseUrl: string): RequestJson {
   return async (method, path, body, options) => {
     const response = await fetch(`${apiBaseUrl}${path}`, {
@@ -41,6 +44,7 @@ function createDefaultRequestJson(apiBaseUrl: string): RequestJson {
         ...(options?.apiKey ? { authorization: `Bearer ${options.apiKey}` } : {}),
       },
       ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
     });
     const payload = (await response.json().catch(() => ({}))) as unknown;
     if (!response.ok) {
@@ -122,6 +126,12 @@ function booleanArg(args: Record<string, unknown> | undefined, key: string): boo
 
 function readFileForPublish(path: string): Buffer {
   try {
+    const stats = statSync(path);
+    if (stats.size > MAX_UPLOAD_BYTES) {
+      throw new Error(
+        `File is too large: ${path}. Maximum supported upload size is 10 MB.`,
+      );
+    }
     return readFileSync(path);
   } catch (error) {
     const code = typeof error === "object" && error && "code" in error ? String(error.code) : "";
@@ -158,6 +168,25 @@ function kindForMime(_path: string, mimeType: string) {
   return "file";
 }
 
+function queryString(params: Record<string, string | number | undefined>): string {
+  const search = new URLSearchParams();
+  for (const [key, value] of Object.entries(params)) {
+    if (value !== undefined) {
+      search.set(key, String(value));
+    }
+  }
+  const serialized = search.toString();
+  return serialized ? `?${serialized}` : "";
+}
+
+function numberArg(args: Record<string, unknown> | undefined, key: string): number | undefined {
+  const value = args?.[key];
+  if (typeof value === "number" && Number.isInteger(value)) {
+    return value;
+  }
+  return undefined;
+}
+
 export function listArtifactlyMcpTools(): ArtifactlyMcpTool[] {
   return [
     {
@@ -200,14 +229,24 @@ export function listArtifactlyMcpTools(): ArtifactlyMcpTool[] {
           title: { type: "string" },
           markdown: { type: "string" },
           visibility: { type: "string", enum: ["public", "unlisted", "private", "gated"] },
+          accessList: { type: "array", items: { type: "string" } },
         },
         required: ["title", "markdown"],
       },
     },
     {
       name: "artifactly_list_artifacts",
-      description: "List recent Artifactly artifacts when the list API is available.",
-      inputSchema: { type: "object", properties: {} },
+      description:
+        "List recent Artifactly artifacts without large content bodies. Supports limit (1-100), cursor, visibility, and kind filters.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          limit: { type: "number", minimum: 1, maximum: 100 },
+          cursor: { type: "string" },
+          visibility: { type: "string", enum: ["public", "unlisted", "private", "gated"] },
+          kind: { type: "string", enum: ["markdown", "html", "image", "file", "json", "web_app"] },
+        },
+      },
     },
     {
       name: "artifactly_get_artifact",
@@ -248,7 +287,7 @@ export function listArtifactlyMcpTools(): ArtifactlyMcpTool[] {
     {
       name: "artifactly_publish_file",
       description:
-        "Publish a local PDF, HTML, JSON, Markdown, or other file through the Artifactly API. Defaults to unlisted visibility; explicit mimeType takes precedence over file extension.",
+        "Publish a local PDF, HTML, JSON, Markdown, or other file through the Artifactly API. Defaults to unlisted visibility; explicit mimeType takes precedence over file extension. Files larger than 10 MB are rejected before upload.",
       inputSchema: {
         type: "object",
         properties: {
@@ -344,10 +383,17 @@ export async function callArtifactlyMcpTool(input: CallToolInput) {
     const title = requireStringArg(input.arguments, "title");
     const content = requireRawStringArg(input.arguments, "markdown");
     const visibility = stringArg(input.arguments, "visibility") ?? "unlisted";
+    const accessList = stringArrayArg(input.arguments, "accessList");
     return objectResult(
       await postJson(
         "/api/artifacts",
-        { title, content, kind: "markdown", visibility },
+        {
+          title,
+          content,
+          kind: "markdown",
+          visibility,
+          ...(accessList ? { accessList } : {}),
+        },
         { apiKey: credentials.apiKey },
       ),
     );
@@ -357,7 +403,12 @@ export async function callArtifactlyMcpTool(input: CallToolInput) {
     if (!credentials) {
       throw new Error(LOGIN_GUIDANCE);
     }
-    return objectResult(await requestJson("GET", "/api/artifacts", undefined, { apiKey: credentials.apiKey }));
+    const limit = numberArg(input.arguments, "limit");
+    const cursor = stringArg(input.arguments, "cursor");
+    const visibility = stringArg(input.arguments, "visibility");
+    const kind = stringArg(input.arguments, "kind");
+    const query = queryString({ limit, cursor, visibility, kind });
+    return objectResult(await requestJson("GET", `/api/artifacts${query}`, undefined, { apiKey: credentials.apiKey }));
   }
 
   if (input.name === "artifactly_get_artifact") {