@backstage/plugin-mcp-actions-backend 0.1.10-next.2 → 0.1.11-next.0

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # @backstage/plugin-mcp-actions-backend
 
+## 0.1.11-next.0
+
+### Patch Changes
+
+- Updated dependencies
+  - @backstage/backend-plugin-api@1.8.1-next.0
+  - @backstage/plugin-catalog-node@2.1.1-next.0
+  - @backstage/catalog-client@1.14.0
+  - @backstage/config@1.3.6
+  - @backstage/errors@1.2.7
+  - @backstage/types@1.2.2
+
+## 0.1.10
+
+### Patch Changes
+
+- 62f0a53: Fixed error forwarding in the actions registry so that known errors like `InputError` and `NotFoundError` thrown by actions preserve their original status codes and messages instead of being wrapped in `ForwardedError` and coerced to 500.
+- dee4283: Added `mcpActions.name` and `mcpActions.description` config options to customize the MCP server identity. Namespaced tool names now use dot separator to align with the MCP spec convention.
+- a49a40d: Updated dependency `zod` to `^3.25.76 || ^4.0.0` & migrated to `/v3` or `/v4` imports.
+- c74b697: Added support for splitting MCP actions into multiple servers via `mcpActions.servers` configuration. Each server gets its own endpoint at `/api/mcp-actions/v1/{key}` with actions scoped using include/exclude filter rules. Tool names are now namespaced with the plugin ID by default, configurable via `mcpActions.namespacedToolNames`. When `mcpActions.servers` is not configured, the plugin continues to serve a single server at `/api/mcp-actions/v1`.
+- dc81af1: Adds two new metrics to track MCP server operations and sessions.
+
+  - `mcp.server.operation.duration`: The duration taken to process an individual MCP operation
+  - `mcp.server.session.duration`: The duration of the MCP session from the perspective of the server
+
+- Updated dependencies
+  - @backstage/backend-plugin-api@1.8.0
+  - @backstage/catalog-client@1.14.0
+  - @backstage/plugin-catalog-node@2.1.0
+
 ## 0.1.10-next.2
 
 ### Patch Changes

package/README.md

@@ -73,7 +73,7 @@ export const myPlugin = createBackendPlugin({
 
 ### Namespaced Tool Names
 
-By default, MCP tool names include the plugin ID prefix to avoid collisions across plugins. For example, an action registered as `greet-user` by `my-custom-plugin` is exposed as `my-custom-plugin:greet-user`.
+By default, MCP tool names include the plugin ID prefix to avoid collisions across plugins. For example, an action registered as `greet-user` by `my-custom-plugin` is exposed as `my-custom-plugin.greet-user`.
 
 You can disable this if you need the short names for backward compatibility:
 

package/config.d.ts

@@ -16,10 +16,22 @@
 
 export interface Config {
   mcpActions?: {
+    /**
+     * Display name for the MCP server. Defaults to "backstage".
+     * Used when running a single bundled server without mcpActions.servers.
+     */
+    name?: string;
+
+    /**
+     * Description of the MCP server.
+     * Used when running a single bundled server without mcpActions.servers.
+     */
+    description?: string;
+
     /**
      * When true, MCP tool names include the plugin ID prefix to avoid
      * collisions across plugins. For example an action registered as
-     * "get-entity" by the catalog plugin becomes "catalog:get-entity".
+     * "get-entity" by the catalog plugin becomes "catalog.get-entity".
      * Defaults to true.
      */
     namespacedToolNames?: boolean;

package/dist/plugin.cjs.js

@@ -62,15 +62,23 @@ const mcpPlugin = backendPluginApi.createBackendPlugin({
             router.use(`/v1/${key}`, streamableRouter);
           }
         } else {
+          const serverConfig = {
+            name: config$1.getOptionalString("mcpActions.name") ?? "backstage",
+            description: config$1.getOptionalString("mcpActions.description"),
+            includeRules: [],
+            excludeRules: []
+          };
           const sseRouter = createSseRouter.createSseRouter({
             mcpService,
-            httpAuth
+            httpAuth,
+            serverConfig
           });
           const streamableRouter = createStreamableRouter.createStreamableRouter({
             mcpService,
             httpAuth,
             logger,
-            metrics
+            metrics,
+            serverConfig
           });
           router.use("/v1/sse", sseRouter);
           router.use("/v1", streamableRouter);

package/dist/plugin.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.cjs.js","sources":["../src/plugin.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport {\n  coreServices,\n  createBackendPlugin,\n} from '@backstage/backend-plugin-api';\nimport { json } from 'express';\nimport Router from 'express-promise-router';\nimport { McpService } from './services/McpService';\nimport { createStreamableRouter } from './routers/createStreamableRouter';\nimport { createSseRouter } from './routers/createSseRouter';\nimport {\n  actionsRegistryServiceRef,\n  actionsServiceRef,\n  metricsServiceRef,\n} from '@backstage/backend-plugin-api/alpha';\nimport { parseServerConfigs } from './config';\n\n/**\n * mcpPlugin backend plugin\n *\n * @public\n */\nexport const mcpPlugin = createBackendPlugin({\n  pluginId: 'mcp-actions',\n  register(env) {\n    env.registerInit({\n      deps: {\n        logger: coreServices.logger,\n        auth: coreServices.auth,\n        httpAuth: coreServices.httpAuth,\n        httpRouter: coreServices.httpRouter,\n        actions: actionsServiceRef,\n        registry: actionsRegistryServiceRef,\n        rootRouter: coreServices.rootHttpRouter,\n        discovery: coreServices.discovery,\n        config: coreServices.rootConfig,\n        metrics: metricsServiceRef,\n      },\n      async init({\n        actions,\n        logger,\n        httpRouter,\n        httpAuth,\n        rootRouter,\n        discovery,\n        config,\n        metrics,\n      }) {\n        const serverConfigs = parseServerConfigs(config);\n        const namespacedToolNames = config.getOptionalBoolean(\n          'mcpActions.namespacedToolNames',\n        );\n\n        const mcpService = await McpService.create({\n          actions,\n          metrics,\n          namespacedToolNames,\n        });\n\n        const router = Router();\n        router.use(json());\n\n        if (serverConfigs && serverConfigs.size > 0) {\n          for (const [key, serverConfig] of serverConfigs) {\n            const streamableRouter = createStreamableRouter({\n              mcpService,\n              httpAuth,\n              logger,\n              metrics,\n              serverConfig,\n            });\n\n            router.use(`/v1/${key}`, streamableRouter);\n          }\n        } else {\n          const sseRouter = createSseRouter({\n            mcpService,\n            httpAuth,\n          });\n\n          const streamableRouter = createStreamableRouter({\n            mcpService,\n            httpAuth,\n            logger,\n            metrics,\n          });\n\n          router.use('/v1/sse', sseRouter);\n          router.use('/v1', streamableRouter);\n        }\n\n        httpRouter.use(router);\n\n        const oauthEnabled =\n          config.getOptionalBoolean(\n            'auth.experimentalDynamicClientRegistration.enabled',\n          ) ||\n          config.getOptionalBoolean(\n            'auth.experimentalClientIdMetadataDocuments.enabled',\n          );\n\n        if (oauthEnabled) {\n          // OAuth Authorization Server Metadata (RFC 8414)\n          // This should be replaced with throwing a WWW-Authenticate header, but that doesn't seem to be supported by\n          // many of the MCP clients as of yet. So this seems to be the oldest version of the spec that's implemented.\n          rootRouter.use(\n            '/.well-known/oauth-authorization-server',\n            async (_, res) => {\n              const authBaseUrl = await discovery.getBaseUrl('auth');\n              const oidcResponse = await fetch(\n                `${authBaseUrl}/.well-known/openid-configuration`,\n              );\n              res.json(await oidcResponse.json());\n            },\n          );\n\n          // Protected Resource Metadata (RFC 9728)\n          // https://datatracker.ietf.org/doc/html/rfc9728\n          // This allows MCP clients to discover the authorization server for this resource\n          rootRouter.use(\n            '/.well-known/oauth-protected-resource',\n            async (_, res) => {\n              const [authBaseUrl, mcpBaseUrl] = await Promise.all([\n                discovery.getBaseUrl('auth'),\n                discovery.getBaseUrl('mcp-actions'),\n              ]);\n              res.json({\n                resource: mcpBaseUrl,\n                authorization_servers: [authBaseUrl],\n              });\n            },\n          );\n        }\n      },\n    });\n  },\n});\n"],"names":["createBackendPlugin","coreServices","actionsServiceRef","actionsRegistryServiceRef","metricsServiceRef","config","parseServerConfigs","McpService","Router","json","createStreamableRouter","createSseRouter"],"mappings":";;;;;;;;;;;;;;;AAoCO,MAAM,YAAYA,oCAAA,CAAoB;AAAA,EAC3C,QAAA,EAAU,aAAA;AAAA,EACV,SAAS,GAAA,EAAK;AACZ,IAAA,GAAA,CAAI,YAAA,CAAa;AAAA,MACf,IAAA,EAAM;AAAA,QACJ,QAAQC,6BAAA,CAAa,MAAA;AAAA,QACrB,MAAMA,6BAAA,CAAa,IAAA;AAAA,QACnB,UAAUA,6BAAA,CAAa,QAAA;AAAA,QACvB,YAAYA,6BAAA,CAAa,UAAA;AAAA,QACzB,OAAA,EAASC,uBAAA;AAAA,QACT,QAAA,EAAUC,+BAAA;AAAA,QACV,YAAYF,6BAAA,CAAa,cAAA;AAAA,QACzB,WAAWA,6BAAA,CAAa,SAAA;AAAA,QACxB,QAAQA,6BAAA,CAAa,UAAA;AAAA,QACrB,OAAA,EAASG;AAAA,OACX;AAAA,MACA,MAAM,IAAA,CAAK;AAAA,QACT,OAAA;AAAA,QACA,MAAA;AAAA,QACA,UAAA;AAAA,QACA,QAAA;AAAA,QACA,UAAA;AAAA,QACA,SAAA;AAAA,gBACAC,QAAA;AAAA,QACA;AAAA,OACF,EAAG;AACD,QAAA,MAAM,aAAA,GAAgBC,0BAAmBD,QAAM,CAAA;AAC/C,QAAA,MAAM,sBAAsBA,QAAA,CAAO,kBAAA;AAAA,UACjC;AAAA,SACF;AAEA,QAAA,MAAM,UAAA,GAAa,MAAME,qBAAA,CAAW,MAAA,CAAO;AAAA,UACzC,OAAA;AAAA,UACA,OAAA;AAAA,UACA;AAAA,SACD,CAAA;AAED,QAAA,MAAM,SAASC,8BAAA,EAAO;AACtB,QAAA,MAAA,CAAO,GAAA,CAAIC,cAAM,CAAA;AAEjB,QAAA,IAAI,aAAA,IAAiB,aAAA,CAAc,IAAA,GAAO,CAAA,EAAG;AAC3C,UAAA,KAAA,MAAW,CAAC,GAAA,EAAK,YAAY,CAAA,IAAK,aAAA,EAAe;AAC/C,YAAA,MAAM,mBAAmBC,6CAAA,CAAuB;AAAA,cAC9C,UAAA;AAAA,cACA,QAAA;AAAA,cACA,MAAA;AAAA,cACA,OAAA;AAAA,cACA;AAAA,aACD,CAAA;AAED,YAAA,MAAA,CAAO,GAAA,CAAI,CAAA,IAAA,EAAO,GAAG,CAAA,CAAA,EAAI,gBAAgB,CAAA;AAAA,UAC3C;AAAA,QACF,CAAA,MAAO;AACL,UAAA,MAAM,YAAYC,+BAAA,CAAgB;AAAA,YAChC,UAAA;AAAA,YACA;AAAA,WACD,CAAA;AAED,UAAA,MAAM,mBAAmBD,6CAAA,CAAuB;AAAA,YAC9C,UAAA;AAAA,YACA,QAAA;AAAA,YACA,MAAA;AAAA,YACA;AAAA,WACD,CAAA;AAED,UAAA,MAAA,CAAO,GAAA,CAAI,WAAW,SAAS,CAAA;AAC/B,UAAA,MAAA,CAAO,GAAA,CAAI,OAAO,gBAAgB,CAAA;AAAA,QACpC;AAEA,QAAA,UAAA,CAAW,IAAI,MAAM,CAAA;AAErB,QAAA,MAAM,eACJL,QAAA,CAAO,kBAAA;AAAA,UACL;AAAA,aAEFA,QAAA,CAAO,kBAAA;AAAA,UACL;AAAA,SACF;AAEF,QAAA,IAAI,YAAA,EAAc;AAIhB,UAAA,UAAA,CAAW,GAAA;AAAA,YACT,yCAAA;AAAA,YACA,OAAO,GAAG,GAAA,KAAQ;AAChB,cAAA,MAAM,WAAA,GAAc,MAAM,SAAA,CAAU,UAAA,CAAW,MAAM,CAAA;AACrD,cAAA,MAAM,eAAe,MAAM,KAAA;AAAA,gBACzB,GAAG,WAAW,CAAA,iCAAA;AAAA,eAChB;AACA,cAAA,GAAA,CAAI,IAAA,CAAK,MAAM,YAAA,CAAa,IAAA,EAAM,CAAA;AAAA,YACpC;AAAA,WACF;AAKA,UAAA,UAAA,CAAW,GAAA;AAAA,YACT,uCAAA;AAAA,YACA,OAAO,GAAG,GAAA,KAAQ;AAChB,cAAA,MAAM,CAAC,WAAA,EAAa,UAAU,CAAA,GAAI,MAAM,QAAQ,GAAA,CAAI;AAAA,gBAClD,SAAA,CAAU,WAAW,MAAM,CAAA;AAAA,gBAC3B,SAAA,CAAU,WAAW,aAAa;AAAA,eACnC,CAAA;AACD,cAAA,GAAA,CAAI,IAAA,CAAK;AAAA,gBACP,QAAA,EAAU,UAAA;AAAA,gBACV,qBAAA,EAAuB,CAAC,WAAW;AAAA,eACpC,CAAA;AAAA,YACH;AAAA,WACF;AAAA,QACF;AAAA,MACF;AAAA,KACD,CAAA;AAAA,EACH;AACF,CAAC;;;;"}
+{"version":3,"file":"plugin.cjs.js","sources":["../src/plugin.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport {\n  coreServices,\n  createBackendPlugin,\n} from '@backstage/backend-plugin-api';\nimport { json } from 'express';\nimport Router from 'express-promise-router';\nimport { McpService } from './services/McpService';\nimport { createStreamableRouter } from './routers/createStreamableRouter';\nimport { createSseRouter } from './routers/createSseRouter';\nimport {\n  actionsRegistryServiceRef,\n  actionsServiceRef,\n  metricsServiceRef,\n} from '@backstage/backend-plugin-api/alpha';\nimport { parseServerConfigs } from './config';\n\n/**\n * mcpPlugin backend plugin\n *\n * @public\n */\nexport const mcpPlugin = createBackendPlugin({\n  pluginId: 'mcp-actions',\n  register(env) {\n    env.registerInit({\n      deps: {\n        logger: coreServices.logger,\n        auth: coreServices.auth,\n        httpAuth: coreServices.httpAuth,\n        httpRouter: coreServices.httpRouter,\n        actions: actionsServiceRef,\n        registry: actionsRegistryServiceRef,\n        rootRouter: coreServices.rootHttpRouter,\n        discovery: coreServices.discovery,\n        config: coreServices.rootConfig,\n        metrics: metricsServiceRef,\n      },\n      async init({\n        actions,\n        logger,\n        httpRouter,\n        httpAuth,\n        rootRouter,\n        discovery,\n        config,\n        metrics,\n      }) {\n        const serverConfigs = parseServerConfigs(config);\n        const namespacedToolNames = config.getOptionalBoolean(\n          'mcpActions.namespacedToolNames',\n        );\n\n        const mcpService = await McpService.create({\n          actions,\n          metrics,\n          namespacedToolNames,\n        });\n\n        const router = Router();\n        router.use(json());\n\n        if (serverConfigs && serverConfigs.size > 0) {\n          for (const [key, serverConfig] of serverConfigs) {\n            const streamableRouter = createStreamableRouter({\n              mcpService,\n              httpAuth,\n              logger,\n              metrics,\n              serverConfig,\n            });\n\n            router.use(`/v1/${key}`, streamableRouter);\n          }\n        } else {\n          const serverConfig = {\n            name: config.getOptionalString('mcpActions.name') ?? 'backstage',\n            description: config.getOptionalString('mcpActions.description'),\n            includeRules: [],\n            excludeRules: [],\n          };\n\n          const sseRouter = createSseRouter({\n            mcpService,\n            httpAuth,\n            serverConfig,\n          });\n\n          const streamableRouter = createStreamableRouter({\n            mcpService,\n            httpAuth,\n            logger,\n            metrics,\n            serverConfig,\n          });\n\n          router.use('/v1/sse', sseRouter);\n          router.use('/v1', streamableRouter);\n        }\n\n        httpRouter.use(router);\n\n        const oauthEnabled =\n          config.getOptionalBoolean(\n            'auth.experimentalDynamicClientRegistration.enabled',\n          ) ||\n          config.getOptionalBoolean(\n            'auth.experimentalClientIdMetadataDocuments.enabled',\n          );\n\n        if (oauthEnabled) {\n          // OAuth Authorization Server Metadata (RFC 8414)\n          // This should be replaced with throwing a WWW-Authenticate header, but that doesn't seem to be supported by\n          // many of the MCP clients as of yet. So this seems to be the oldest version of the spec that's implemented.\n          rootRouter.use(\n            '/.well-known/oauth-authorization-server',\n            async (_, res) => {\n              const authBaseUrl = await discovery.getBaseUrl('auth');\n              const oidcResponse = await fetch(\n                `${authBaseUrl}/.well-known/openid-configuration`,\n              );\n              res.json(await oidcResponse.json());\n            },\n          );\n\n          // Protected Resource Metadata (RFC 9728)\n          // https://datatracker.ietf.org/doc/html/rfc9728\n          // This allows MCP clients to discover the authorization server for this resource\n          rootRouter.use(\n            '/.well-known/oauth-protected-resource',\n            async (_, res) => {\n              const [authBaseUrl, mcpBaseUrl] = await Promise.all([\n                discovery.getBaseUrl('auth'),\n                discovery.getBaseUrl('mcp-actions'),\n              ]);\n              res.json({\n                resource: mcpBaseUrl,\n                authorization_servers: [authBaseUrl],\n              });\n            },\n          );\n        }\n      },\n    });\n  },\n});\n"],"names":["createBackendPlugin","coreServices","actionsServiceRef","actionsRegistryServiceRef","metricsServiceRef","config","parseServerConfigs","McpService","Router","json","createStreamableRouter","createSseRouter"],"mappings":";;;;;;;;;;;;;;;AAoCO,MAAM,YAAYA,oCAAA,CAAoB;AAAA,EAC3C,QAAA,EAAU,aAAA;AAAA,EACV,SAAS,GAAA,EAAK;AACZ,IAAA,GAAA,CAAI,YAAA,CAAa;AAAA,MACf,IAAA,EAAM;AAAA,QACJ,QAAQC,6BAAA,CAAa,MAAA;AAAA,QACrB,MAAMA,6BAAA,CAAa,IAAA;AAAA,QACnB,UAAUA,6BAAA,CAAa,QAAA;AAAA,QACvB,YAAYA,6BAAA,CAAa,UAAA;AAAA,QACzB,OAAA,EAASC,uBAAA;AAAA,QACT,QAAA,EAAUC,+BAAA;AAAA,QACV,YAAYF,6BAAA,CAAa,cAAA;AAAA,QACzB,WAAWA,6BAAA,CAAa,SAAA;AAAA,QACxB,QAAQA,6BAAA,CAAa,UAAA;AAAA,QACrB,OAAA,EAASG;AAAA,OACX;AAAA,MACA,MAAM,IAAA,CAAK;AAAA,QACT,OAAA;AAAA,QACA,MAAA;AAAA,QACA,UAAA;AAAA,QACA,QAAA;AAAA,QACA,UAAA;AAAA,QACA,SAAA;AAAA,gBACAC,QAAA;AAAA,QACA;AAAA,OACF,EAAG;AACD,QAAA,MAAM,aAAA,GAAgBC,0BAAmBD,QAAM,CAAA;AAC/C,QAAA,MAAM,sBAAsBA,QAAA,CAAO,kBAAA;AAAA,UACjC;AAAA,SACF;AAEA,QAAA,MAAM,UAAA,GAAa,MAAME,qBAAA,CAAW,MAAA,CAAO;AAAA,UACzC,OAAA;AAAA,UACA,OAAA;AAAA,UACA;AAAA,SACD,CAAA;AAED,QAAA,MAAM,SAASC,8BAAA,EAAO;AACtB,QAAA,MAAA,CAAO,GAAA,CAAIC,cAAM,CAAA;AAEjB,QAAA,IAAI,aAAA,IAAiB,aAAA,CAAc,IAAA,GAAO,CAAA,EAAG;AAC3C,UAAA,KAAA,MAAW,CAAC,GAAA,EAAK,YAAY,CAAA,IAAK,aAAA,EAAe;AAC/C,YAAA,MAAM,mBAAmBC,6CAAA,CAAuB;AAAA,cAC9C,UAAA;AAAA,cACA,QAAA;AAAA,cACA,MAAA;AAAA,cACA,OAAA;AAAA,cACA;AAAA,aACD,CAAA;AAED,YAAA,MAAA,CAAO,GAAA,CAAI,CAAA,IAAA,EAAO,GAAG,CAAA,CAAA,EAAI,gBAAgB,CAAA;AAAA,UAC3C;AAAA,QACF,CAAA,MAAO;AACL,UAAA,MAAM,YAAA,GAAe;AAAA,YACnB,IAAA,EAAML,QAAA,CAAO,iBAAA,CAAkB,iBAAiB,CAAA,IAAK,WAAA;AAAA,YACrD,WAAA,EAAaA,QAAA,CAAO,iBAAA,CAAkB,wBAAwB,CAAA;AAAA,YAC9D,cAAc,EAAC;AAAA,YACf,cAAc;AAAC,WACjB;AAEA,UAAA,MAAM,YAAYM,+BAAA,CAAgB;AAAA,YAChC,UAAA;AAAA,YACA,QAAA;AAAA,YACA;AAAA,WACD,CAAA;AAED,UAAA,MAAM,mBAAmBD,6CAAA,CAAuB;AAAA,YAC9C,UAAA;AAAA,YACA,QAAA;AAAA,YACA,MAAA;AAAA,YACA,OAAA;AAAA,YACA;AAAA,WACD,CAAA;AAED,UAAA,MAAA,CAAO,GAAA,CAAI,WAAW,SAAS,CAAA;AAC/B,UAAA,MAAA,CAAO,GAAA,CAAI,OAAO,gBAAgB,CAAA;AAAA,QACpC;AAEA,QAAA,UAAA,CAAW,IAAI,MAAM,CAAA;AAErB,QAAA,MAAM,eACJL,QAAA,CAAO,kBAAA;AAAA,UACL;AAAA,aAEFA,QAAA,CAAO,kBAAA;AAAA,UACL;AAAA,SACF;AAEF,QAAA,IAAI,YAAA,EAAc;AAIhB,UAAA,UAAA,CAAW,GAAA;AAAA,YACT,yCAAA;AAAA,YACA,OAAO,GAAG,GAAA,KAAQ;AAChB,cAAA,MAAM,WAAA,GAAc,MAAM,SAAA,CAAU,UAAA,CAAW,MAAM,CAAA;AACrD,cAAA,MAAM,eAAe,MAAM,KAAA;AAAA,gBACzB,GAAG,WAAW,CAAA,iCAAA;AAAA,eAChB;AACA,cAAA,GAAA,CAAI,IAAA,CAAK,MAAM,YAAA,CAAa,IAAA,EAAM,CAAA;AAAA,YACpC;AAAA,WACF;AAKA,UAAA,UAAA,CAAW,GAAA;AAAA,YACT,uCAAA;AAAA,YACA,OAAO,GAAG,GAAA,KAAQ;AAChB,cAAA,MAAM,CAAC,WAAA,EAAa,UAAU,CAAA,GAAI,MAAM,QAAQ,GAAA,CAAI;AAAA,gBAClD,SAAA,CAAU,WAAW,MAAM,CAAA;AAAA,gBAC3B,SAAA,CAAU,WAAW,aAAa;AAAA,eACnC,CAAA;AACD,cAAA,GAAA,CAAI,IAAA,CAAK;AAAA,gBACP,QAAA,EAAU,UAAA;AAAA,gBACV,qBAAA,EAAuB,CAAC,WAAW;AAAA,eACpC,CAAA;AAAA,YACH;AAAA,WACF;AAAA,QACF;AAAA,MACF;AAAA,KACD,CAAA;AAAA,EACH;AACF,CAAC;;;;"}

package/dist/services/McpService.cjs.js

@@ -35,12 +35,14 @@ class McpService {
     credentials,
     serverConfig
   }) {
-    const serverName = serverConfig?.name ?? "backstage";
     const server = new index_js.Server(
       {
-        name: serverName,
+        name: serverConfig?.name ?? "backstage",
         // TODO: this version will most likely change in the future.
-        version: package_json.version
+        version: package_json.version,
+        ...serverConfig?.description && {
+          description: serverConfig.description
+        }
       },
       { capabilities: { tools: {} } }
     );
@@ -151,7 +153,7 @@ class McpService {
   }
   getToolName(action) {
     if (this.namespacedToolNames) {
-      return action.id;
+      return `${action.pluginId}.${action.name}`;
     }
     return action.name;
   }

package/dist/services/McpService.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"McpService.cjs.js","sources":["../../src/services/McpService.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { BackstageCredentials } from '@backstage/backend-plugin-api';\nimport { Server as McpServer } from '@modelcontextprotocol/sdk/server/index.js';\nimport {\n  ListToolsRequestSchema,\n  CallToolRequestSchema,\n} from '@modelcontextprotocol/sdk/types.js';\nimport { JsonObject } from '@backstage/types';\nimport {\n  ActionsService,\n  ActionsServiceAction,\n  MetricsServiceHistogram,\n  MetricsService,\n} from '@backstage/backend-plugin-api/alpha';\nimport { version } from '@backstage/plugin-mcp-actions-backend/package.json';\nimport { NotFoundError } from '@backstage/errors';\nimport { performance } from 'node:perf_hooks';\n\nimport { handleErrors } from './handleErrors';\nimport { bucketBoundaries, McpServerOperationAttributes } from '../metrics';\nimport { FilterRule, McpServerConfig } from '../config';\n\nexport class McpService {\n  private readonly actions: ActionsService;\n  private readonly namespacedToolNames: boolean;\n  private readonly operationDuration: MetricsServiceHistogram<McpServerOperationAttributes>;\n\n  constructor(\n    actions: ActionsService,\n    metrics: MetricsService,\n    namespacedToolNames?: boolean,\n  ) {\n    this.actions = actions;\n    this.namespacedToolNames = namespacedToolNames ?? true;\n    this.operationDuration =\n      metrics.createHistogram<McpServerOperationAttributes>(\n        'mcp.server.operation.duration',\n        {\n          description: 'MCP request duration as observed on the receiver',\n          unit: 's',\n          advice: { explicitBucketBoundaries: bucketBoundaries },\n        },\n      );\n  }\n\n  static async create({\n    actions,\n    metrics,\n    namespacedToolNames,\n  }: {\n    actions: ActionsService;\n    metrics: MetricsService;\n    namespacedToolNames?: boolean;\n  }) {\n    return new McpService(actions, metrics, namespacedToolNames);\n  }\n\n  getServer({\n    credentials,\n    serverConfig,\n  }: {\n    credentials: BackstageCredentials;\n    serverConfig?: McpServerConfig;\n  }) {\n    const serverName = serverConfig?.name ?? 'backstage';\n\n    const server = new McpServer(\n      {\n        name: serverName,\n        // TODO: this version will most likely change in the future.\n        version,\n      },\n      { capabilities: { tools: {} } },\n    );\n\n    server.setRequestHandler(ListToolsRequestSchema, async () => {\n      const startTime = performance.now();\n      let errorType: string | undefined;\n\n      try {\n        const { actions: allActions } = await this.actions.list({\n          credentials,\n        });\n        const actions = serverConfig\n          ? this.filterActions(allActions, serverConfig)\n          : allActions;\n\n        return {\n          tools: actions.map(action => ({\n            inputSchema: action.schema.input,\n            // todo(blam): this is unfortunately not supported by most clients yet.\n            // When this is provided you need to provide structuredContent instead.\n            // outputSchema: action.schema.output,\n            name: this.getToolName(action),\n            description: action.description,\n            annotations: {\n              title: action.title,\n              destructiveHint: action.attributes.destructive,\n              idempotentHint: action.attributes.idempotent,\n              readOnlyHint: action.attributes.readOnly,\n              openWorldHint: false,\n            },\n          })),\n        };\n      } catch (err) {\n        errorType = err instanceof Error ? err.name : 'Error';\n        throw err;\n      } finally {\n        const durationSeconds = (performance.now() - startTime) / 1000;\n\n        this.operationDuration.record(durationSeconds, {\n          'mcp.method.name': 'tools/list',\n          ...(errorType && { 'error.type': errorType }),\n        });\n      }\n    });\n\n    server.setRequestHandler(CallToolRequestSchema, async ({ params }) => {\n      const startTime = performance.now();\n      let errorType: string | undefined;\n      let isError = false;\n\n      try {\n        const result = await handleErrors(async () => {\n          const { actions: allActions } = await this.actions.list({\n            credentials,\n          });\n          const actions = serverConfig\n            ? this.filterActions(allActions, serverConfig)\n            : allActions;\n\n          const action = actions.find(a => this.getToolName(a) === params.name);\n\n          if (!action) {\n            throw new NotFoundError(`Action \"${params.name}\" not found`);\n          }\n\n          const { output } = await this.actions.invoke({\n            id: action.id,\n            input: params.arguments as JsonObject,\n            credentials,\n          });\n\n          return {\n            // todo(blam): unfortunately structuredContent is not supported by most clients yet.\n            // so the validation for the output happens in the default actions registry\n            // and we return it as json text instead for now.\n            content: [\n              {\n                type: 'text',\n                text: ['```json', JSON.stringify(output, null, 2), '```'].join(\n                  '\\n',\n                ),\n              },\n            ],\n          };\n        });\n\n        isError = !!(result as { isError?: boolean })?.isError;\n        return result;\n      } catch (err) {\n        errorType = err instanceof Error ? err.name : 'Error';\n        throw err;\n      } finally {\n        const durationSeconds = (performance.now() - startTime) / 1000;\n\n        // Determine error.type per OTel MCP spec:\n        // - Thrown exceptions use the error name\n        // - CallToolResult with isError=true uses 'tool_error'\n        let errorAttribute: string | undefined = errorType;\n        if (!errorAttribute && isError) {\n          errorAttribute = 'tool_error';\n        }\n\n        this.operationDuration.record(durationSeconds, {\n          'mcp.method.name': 'tools/call',\n          'gen_ai.tool.name': params.name,\n          'gen_ai.operation.name': 'execute_tool',\n          ...(errorAttribute && { 'error.type': errorAttribute }),\n        });\n      }\n    });\n\n    return server;\n  }\n\n  private filterActions(\n    actions: ActionsServiceAction[],\n    serverConfig: McpServerConfig,\n  ): ActionsServiceAction[] {\n    const { includeRules, excludeRules } = serverConfig;\n    if (includeRules.length === 0 && excludeRules.length === 0) {\n      return actions;\n    }\n\n    return actions.filter(action => {\n      if (excludeRules.some(rule => this.matchesRule(action, rule))) {\n        return false;\n      }\n\n      if (includeRules.length === 0) {\n        return true;\n      }\n\n      return includeRules.some(rule => this.matchesRule(action, rule));\n    });\n  }\n\n  private getToolName(action: ActionsServiceAction): string {\n    if (this.namespacedToolNames) {\n      return action.id;\n    }\n    return action.name;\n  }\n\n  private matchesRule(action: ActionsServiceAction, rule: FilterRule): boolean {\n    if (rule.idMatcher && !rule.idMatcher.match(action.id)) {\n      return false;\n    }\n\n    if (rule.attributes) {\n      for (const [key, value] of Object.entries(rule.attributes)) {\n        if (\n          action.attributes[\n            key as 'destructive' | 'readOnly' | 'idempotent'\n          ] !== value\n        ) {\n          return false;\n        }\n      }\n    }\n\n    return true;\n  }\n}\n"],"names":["metrics","bucketBoundaries","McpServer","version","ListToolsRequestSchema","performance","CallToolRequestSchema","handleErrors","NotFoundError"],"mappings":";;;;;;;;;;AAoCO,MAAM,UAAA,CAAW;AAAA,EACL,OAAA;AAAA,EACA,mBAAA;AAAA,EACA,iBAAA;AAAA,EAEjB,WAAA,CACE,OAAA,EACAA,SAAA,EACA,mBAAA,EACA;AACA,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,sBAAsB,mBAAA,IAAuB,IAAA;AAClD,IAAA,IAAA,CAAK,oBACHA,SAAA,CAAQ,eAAA;AAAA,MACN,+BAAA;AAAA,MACA;AAAA,QACE,WAAA,EAAa,kDAAA;AAAA,QACb,IAAA,EAAM,GAAA;AAAA,QACN,MAAA,EAAQ,EAAE,wBAAA,EAA0BC,wBAAA;AAAiB;AACvD,KACF;AAAA,EACJ;AAAA,EAEA,aAAa,MAAA,CAAO;AAAA,IAClB,OAAA;AAAA,IACA,OAAA;AAAA,IACA;AAAA,GACF,EAIG;AACD,IAAA,OAAO,IAAI,UAAA,CAAW,OAAA,EAAS,OAAA,EAAS,mBAAmB,CAAA;AAAA,EAC7D;AAAA,EAEA,SAAA,CAAU;AAAA,IACR,WAAA;AAAA,IACA;AAAA,GACF,EAGG;AACD,IAAA,MAAM,UAAA,GAAa,cAAc,IAAA,IAAQ,WAAA;AAEzC,IAAA,MAAM,SAAS,IAAIC,eAAA;AAAA,MACjB;AAAA,QACE,IAAA,EAAM,UAAA;AAAA;AAAA,iBAENC;AAAA,OACF;AAAA,MACA,EAAE,YAAA,EAAc,EAAE,KAAA,EAAO,IAAG;AAAE,KAChC;AAEA,IAAA,MAAA,CAAO,iBAAA,CAAkBC,iCAAwB,YAAY;AAC3D,MAAA,MAAM,SAAA,GAAYC,4BAAY,GAAA,EAAI;AAClC,MAAA,IAAI,SAAA;AAEJ,MAAA,IAAI;AACF,QAAA,MAAM,EAAE,OAAA,EAAS,UAAA,KAAe,MAAM,IAAA,CAAK,QAAQ,IAAA,CAAK;AAAA,UACtD;AAAA,SACD,CAAA;AACD,QAAA,MAAM,UAAU,YAAA,GACZ,IAAA,CAAK,aAAA,CAAc,UAAA,EAAY,YAAY,CAAA,GAC3C,UAAA;AAEJ,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,CAAA,MAAA,MAAW;AAAA,YAC5B,WAAA,EAAa,OAAO,MAAA,CAAO,KAAA;AAAA;AAAA;AAAA;AAAA,YAI3B,IAAA,EAAM,IAAA,CAAK,WAAA,CAAY,MAAM,CAAA;AAAA,YAC7B,aAAa,MAAA,CAAO,WAAA;AAAA,YACpB,WAAA,EAAa;AAAA,cACX,OAAO,MAAA,CAAO,KAAA;AAAA,cACd,eAAA,EAAiB,OAAO,UAAA,CAAW,WAAA;AAAA,cACnC,cAAA,EAAgB,OAAO,UAAA,CAAW,UAAA;AAAA,cAClC,YAAA,EAAc,OAAO,UAAA,CAAW,QAAA;AAAA,cAChC,aAAA,EAAe;AAAA;AACjB,WACF,CAAE;AAAA,SACJ;AAAA,MACF,SAAS,GAAA,EAAK;AACZ,QAAA,SAAA,GAAY,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,IAAA,GAAO,OAAA;AAC9C,QAAA,MAAM,GAAA;AAAA,MACR,CAAA,SAAE;AACA,QAAA,MAAM,eAAA,GAAA,CAAmBA,2BAAA,CAAY,GAAA,EAAI,GAAI,SAAA,IAAa,GAAA;AAE1D,QAAA,IAAA,CAAK,iBAAA,CAAkB,OAAO,eAAA,EAAiB;AAAA,UAC7C,iBAAA,EAAmB,YAAA;AAAA,UACnB,GAAI,SAAA,IAAa,EAAE,YAAA,EAAc,SAAA;AAAU,SAC5C,CAAA;AAAA,MACH;AAAA,IACF,CAAC,CAAA;AAED,IAAA,MAAA,CAAO,iBAAA,CAAkBC,8BAAA,EAAuB,OAAO,EAAE,QAAO,KAAM;AACpE,MAAA,MAAM,SAAA,GAAYD,4BAAY,GAAA,EAAI;AAClC,MAAA,IAAI,SAAA;AACJ,MAAA,IAAI,OAAA,GAAU,KAAA;AAEd,MAAA,IAAI;AACF,QAAA,MAAM,MAAA,GAAS,MAAME,yBAAA,CAAa,YAAY;AAC5C,UAAA,MAAM,EAAE,OAAA,EAAS,UAAA,KAAe,MAAM,IAAA,CAAK,QAAQ,IAAA,CAAK;AAAA,YACtD;AAAA,WACD,CAAA;AACD,UAAA,MAAM,UAAU,YAAA,GACZ,IAAA,CAAK,aAAA,CAAc,UAAA,EAAY,YAAY,CAAA,GAC3C,UAAA;AAEJ,UAAA,MAAM,MAAA,GAAS,QAAQ,IAAA,CAAK,CAAA,CAAA,KAAK,KAAK,WAAA,CAAY,CAAC,CAAA,KAAM,MAAA,CAAO,IAAI,CAAA;AAEpE,UAAA,IAAI,CAAC,MAAA,EAAQ;AACX,YAAA,MAAM,IAAIC,oBAAA,CAAc,CAAA,QAAA,EAAW,MAAA,CAAO,IAAI,CAAA,WAAA,CAAa,CAAA;AAAA,UAC7D;AAEA,UAAA,MAAM,EAAE,MAAA,EAAO,GAAI,MAAM,IAAA,CAAK,QAAQ,MAAA,CAAO;AAAA,YAC3C,IAAI,MAAA,CAAO,EAAA;AAAA,YACX,OAAO,MAAA,CAAO,SAAA;AAAA,YACd;AAAA,WACD,CAAA;AAED,UAAA,OAAO;AAAA;AAAA;AAAA;AAAA,YAIL,OAAA,EAAS;AAAA,cACP;AAAA,gBACE,IAAA,EAAM,MAAA;AAAA,gBACN,IAAA,EAAM,CAAC,SAAA,EAAW,IAAA,CAAK,SAAA,CAAU,QAAQ,IAAA,EAAM,CAAC,CAAA,EAAG,KAAK,CAAA,CAAE,IAAA;AAAA,kBACxD;AAAA;AACF;AACF;AACF,WACF;AAAA,QACF,CAAC,CAAA;AAED,QAAA,OAAA,GAAU,CAAC,CAAE,MAAA,EAAkC,OAAA;AAC/C,QAAA,OAAO,MAAA;AAAA,MACT,SAAS,GAAA,EAAK;AACZ,QAAA,SAAA,GAAY,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,IAAA,GAAO,OAAA;AAC9C,QAAA,MAAM,GAAA;AAAA,MACR,CAAA,SAAE;AACA,QAAA,MAAM,eAAA,GAAA,CAAmBH,2BAAA,CAAY,GAAA,EAAI,GAAI,SAAA,IAAa,GAAA;AAK1D,QAAA,IAAI,cAAA,GAAqC,SAAA;AACzC,QAAA,IAAI,CAAC,kBAAkB,OAAA,EAAS;AAC9B,UAAA,cAAA,GAAiB,YAAA;AAAA,QACnB;AAEA,QAAA,IAAA,CAAK,iBAAA,CAAkB,OAAO,eAAA,EAAiB;AAAA,UAC7C,iBAAA,EAAmB,YAAA;AAAA,UACnB,oBAAoB,MAAA,CAAO,IAAA;AAAA,UAC3B,uBAAA,EAAyB,cAAA;AAAA,UACzB,GAAI,cAAA,IAAkB,EAAE,YAAA,EAAc,cAAA;AAAe,SACtD,CAAA;AAAA,MACH;AAAA,IACF,CAAC,CAAA;AAED,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEQ,aAAA,CACN,SACA,YAAA,EACwB;AACxB,IAAA,MAAM,EAAE,YAAA,EAAc,YAAA,EAAa,GAAI,YAAA;AACvC,IAAA,IAAI,YAAA,CAAa,MAAA,KAAW,CAAA,IAAK,YAAA,CAAa,WAAW,CAAA,EAAG;AAC1D,MAAA,OAAO,OAAA;AAAA,IACT;AAEA,IAAA,OAAO,OAAA,CAAQ,OAAO,CAAA,MAAA,KAAU;AAC9B,MAAA,IAAI,YAAA,CAAa,KAAK,CAAA,IAAA,KAAQ,IAAA,CAAK,YAAY,MAAA,EAAQ,IAAI,CAAC,CAAA,EAAG;AAC7D,QAAA,OAAO,KAAA;AAAA,MACT;AAEA,MAAA,IAAI,YAAA,CAAa,WAAW,CAAA,EAAG;AAC7B,QAAA,OAAO,IAAA;AAAA,MACT;AAEA,MAAA,OAAO,aAAa,IAAA,CAAK,CAAA,IAAA,KAAQ,KAAK,WAAA,CAAY,MAAA,EAAQ,IAAI,CAAC,CAAA;AAAA,IACjE,CAAC,CAAA;AAAA,EACH;AAAA,EAEQ,YAAY,MAAA,EAAsC;AACxD,IAAA,IAAI,KAAK,mBAAA,EAAqB;AAC5B,MAAA,OAAO,MAAA,CAAO,EAAA;AAAA,IAChB;AACA,IAAA,OAAO,MAAA,CAAO,IAAA;AAAA,EAChB;AAAA,EAEQ,WAAA,CAAY,QAA8B,IAAA,EAA2B;AAC3E,IAAA,IAAI,IAAA,CAAK,aAAa,CAAC,IAAA,CAAK,UAAU,KAAA,CAAM,MAAA,CAAO,EAAE,CAAA,EAAG;AACtD,MAAA,OAAO,KAAA;AAAA,IACT;AAEA,IAAA,IAAI,KAAK,UAAA,EAAY;AACnB,MAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,IAAA,CAAK,UAAU,CAAA,EAAG;AAC1D,QAAA,IACE,MAAA,CAAO,UAAA,CACL,GACF,CAAA,KAAM,KAAA,EACN;AACA,UAAA,OAAO,KAAA;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAEA,IAAA,OAAO,IAAA;AAAA,EACT;AACF;;;;"}
+{"version":3,"file":"McpService.cjs.js","sources":["../../src/services/McpService.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { BackstageCredentials } from '@backstage/backend-plugin-api';\nimport { Server as McpServer } from '@modelcontextprotocol/sdk/server/index.js';\nimport {\n  ListToolsRequestSchema,\n  CallToolRequestSchema,\n} from '@modelcontextprotocol/sdk/types.js';\nimport { JsonObject } from '@backstage/types';\nimport {\n  ActionsService,\n  ActionsServiceAction,\n  MetricsServiceHistogram,\n  MetricsService,\n} from '@backstage/backend-plugin-api/alpha';\nimport { version } from '@backstage/plugin-mcp-actions-backend/package.json';\nimport { NotFoundError } from '@backstage/errors';\nimport { performance } from 'node:perf_hooks';\n\nimport { handleErrors } from './handleErrors';\nimport { bucketBoundaries, McpServerOperationAttributes } from '../metrics';\nimport { FilterRule, McpServerConfig } from '../config';\n\nexport class McpService {\n  private readonly actions: ActionsService;\n  private readonly namespacedToolNames: boolean;\n  private readonly operationDuration: MetricsServiceHistogram<McpServerOperationAttributes>;\n\n  constructor(\n    actions: ActionsService,\n    metrics: MetricsService,\n    namespacedToolNames?: boolean,\n  ) {\n    this.actions = actions;\n    this.namespacedToolNames = namespacedToolNames ?? true;\n    this.operationDuration =\n      metrics.createHistogram<McpServerOperationAttributes>(\n        'mcp.server.operation.duration',\n        {\n          description: 'MCP request duration as observed on the receiver',\n          unit: 's',\n          advice: { explicitBucketBoundaries: bucketBoundaries },\n        },\n      );\n  }\n\n  static async create({\n    actions,\n    metrics,\n    namespacedToolNames,\n  }: {\n    actions: ActionsService;\n    metrics: MetricsService;\n    namespacedToolNames?: boolean;\n  }) {\n    return new McpService(actions, metrics, namespacedToolNames);\n  }\n\n  getServer({\n    credentials,\n    serverConfig,\n  }: {\n    credentials: BackstageCredentials;\n    serverConfig?: McpServerConfig;\n  }) {\n    const server = new McpServer(\n      {\n        name: serverConfig?.name ?? 'backstage',\n        // TODO: this version will most likely change in the future.\n        version,\n        ...(serverConfig?.description && {\n          description: serverConfig.description,\n        }),\n      },\n      { capabilities: { tools: {} } },\n    );\n\n    server.setRequestHandler(ListToolsRequestSchema, async () => {\n      const startTime = performance.now();\n      let errorType: string | undefined;\n\n      try {\n        const { actions: allActions } = await this.actions.list({\n          credentials,\n        });\n        const actions = serverConfig\n          ? this.filterActions(allActions, serverConfig)\n          : allActions;\n\n        return {\n          tools: actions.map(action => ({\n            inputSchema: action.schema.input,\n            // todo(blam): this is unfortunately not supported by most clients yet.\n            // When this is provided you need to provide structuredContent instead.\n            // outputSchema: action.schema.output,\n            name: this.getToolName(action),\n            description: action.description,\n            annotations: {\n              title: action.title,\n              destructiveHint: action.attributes.destructive,\n              idempotentHint: action.attributes.idempotent,\n              readOnlyHint: action.attributes.readOnly,\n              openWorldHint: false,\n            },\n          })),\n        };\n      } catch (err) {\n        errorType = err instanceof Error ? err.name : 'Error';\n        throw err;\n      } finally {\n        const durationSeconds = (performance.now() - startTime) / 1000;\n\n        this.operationDuration.record(durationSeconds, {\n          'mcp.method.name': 'tools/list',\n          ...(errorType && { 'error.type': errorType }),\n        });\n      }\n    });\n\n    server.setRequestHandler(CallToolRequestSchema, async ({ params }) => {\n      const startTime = performance.now();\n      let errorType: string | undefined;\n      let isError = false;\n\n      try {\n        const result = await handleErrors(async () => {\n          const { actions: allActions } = await this.actions.list({\n            credentials,\n          });\n          const actions = serverConfig\n            ? this.filterActions(allActions, serverConfig)\n            : allActions;\n\n          const action = actions.find(a => this.getToolName(a) === params.name);\n\n          if (!action) {\n            throw new NotFoundError(`Action \"${params.name}\" not found`);\n          }\n\n          const { output } = await this.actions.invoke({\n            id: action.id,\n            input: params.arguments as JsonObject,\n            credentials,\n          });\n\n          return {\n            // todo(blam): unfortunately structuredContent is not supported by most clients yet.\n            // so the validation for the output happens in the default actions registry\n            // and we return it as json text instead for now.\n            content: [\n              {\n                type: 'text',\n                text: ['```json', JSON.stringify(output, null, 2), '```'].join(\n                  '\\n',\n                ),\n              },\n            ],\n          };\n        });\n\n        isError = !!(result as { isError?: boolean })?.isError;\n        return result;\n      } catch (err) {\n        errorType = err instanceof Error ? err.name : 'Error';\n        throw err;\n      } finally {\n        const durationSeconds = (performance.now() - startTime) / 1000;\n\n        // Determine error.type per OTel MCP spec:\n        // - Thrown exceptions use the error name\n        // - CallToolResult with isError=true uses 'tool_error'\n        let errorAttribute: string | undefined = errorType;\n        if (!errorAttribute && isError) {\n          errorAttribute = 'tool_error';\n        }\n\n        this.operationDuration.record(durationSeconds, {\n          'mcp.method.name': 'tools/call',\n          'gen_ai.tool.name': params.name,\n          'gen_ai.operation.name': 'execute_tool',\n          ...(errorAttribute && { 'error.type': errorAttribute }),\n        });\n      }\n    });\n\n    return server;\n  }\n\n  private filterActions(\n    actions: ActionsServiceAction[],\n    serverConfig: McpServerConfig,\n  ): ActionsServiceAction[] {\n    const { includeRules, excludeRules } = serverConfig;\n    if (includeRules.length === 0 && excludeRules.length === 0) {\n      return actions;\n    }\n\n    return actions.filter(action => {\n      if (excludeRules.some(rule => this.matchesRule(action, rule))) {\n        return false;\n      }\n\n      if (includeRules.length === 0) {\n        return true;\n      }\n\n      return includeRules.some(rule => this.matchesRule(action, rule));\n    });\n  }\n\n  private getToolName(action: ActionsServiceAction): string {\n    if (this.namespacedToolNames) {\n      return `${action.pluginId}.${action.name}`;\n    }\n    return action.name;\n  }\n\n  private matchesRule(action: ActionsServiceAction, rule: FilterRule): boolean {\n    if (rule.idMatcher && !rule.idMatcher.match(action.id)) {\n      return false;\n    }\n\n    if (rule.attributes) {\n      for (const [key, value] of Object.entries(rule.attributes)) {\n        if (\n          action.attributes[\n            key as 'destructive' | 'readOnly' | 'idempotent'\n          ] !== value\n        ) {\n          return false;\n        }\n      }\n    }\n\n    return true;\n  }\n}\n"],"names":["metrics","bucketBoundaries","McpServer","version","ListToolsRequestSchema","performance","CallToolRequestSchema","handleErrors","NotFoundError"],"mappings":";;;;;;;;;;AAoCO,MAAM,UAAA,CAAW;AAAA,EACL,OAAA;AAAA,EACA,mBAAA;AAAA,EACA,iBAAA;AAAA,EAEjB,WAAA,CACE,OAAA,EACAA,SAAA,EACA,mBAAA,EACA;AACA,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,sBAAsB,mBAAA,IAAuB,IAAA;AAClD,IAAA,IAAA,CAAK,oBACHA,SAAA,CAAQ,eAAA;AAAA,MACN,+BAAA;AAAA,MACA;AAAA,QACE,WAAA,EAAa,kDAAA;AAAA,QACb,IAAA,EAAM,GAAA;AAAA,QACN,MAAA,EAAQ,EAAE,wBAAA,EAA0BC,wBAAA;AAAiB;AACvD,KACF;AAAA,EACJ;AAAA,EAEA,aAAa,MAAA,CAAO;AAAA,IAClB,OAAA;AAAA,IACA,OAAA;AAAA,IACA;AAAA,GACF,EAIG;AACD,IAAA,OAAO,IAAI,UAAA,CAAW,OAAA,EAAS,OAAA,EAAS,mBAAmB,CAAA;AAAA,EAC7D;AAAA,EAEA,SAAA,CAAU;AAAA,IACR,WAAA;AAAA,IACA;AAAA,GACF,EAGG;AACD,IAAA,MAAM,SAAS,IAAIC,eAAA;AAAA,MACjB;AAAA,QACE,IAAA,EAAM,cAAc,IAAA,IAAQ,WAAA;AAAA;AAAA,iBAE5BC,oBAAA;AAAA,QACA,GAAI,cAAc,WAAA,IAAe;AAAA,UAC/B,aAAa,YAAA,CAAa;AAAA;AAC5B,OACF;AAAA,MACA,EAAE,YAAA,EAAc,EAAE,KAAA,EAAO,IAAG;AAAE,KAChC;AAEA,IAAA,MAAA,CAAO,iBAAA,CAAkBC,iCAAwB,YAAY;AAC3D,MAAA,MAAM,SAAA,GAAYC,4BAAY,GAAA,EAAI;AAClC,MAAA,IAAI,SAAA;AAEJ,MAAA,IAAI;AACF,QAAA,MAAM,EAAE,OAAA,EAAS,UAAA,KAAe,MAAM,IAAA,CAAK,QAAQ,IAAA,CAAK;AAAA,UACtD;AAAA,SACD,CAAA;AACD,QAAA,MAAM,UAAU,YAAA,GACZ,IAAA,CAAK,aAAA,CAAc,UAAA,EAAY,YAAY,CAAA,GAC3C,UAAA;AAEJ,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,CAAA,MAAA,MAAW;AAAA,YAC5B,WAAA,EAAa,OAAO,MAAA,CAAO,KAAA;AAAA;AAAA;AAAA;AAAA,YAI3B,IAAA,EAAM,IAAA,CAAK,WAAA,CAAY,MAAM,CAAA;AAAA,YAC7B,aAAa,MAAA,CAAO,WAAA;AAAA,YACpB,WAAA,EAAa;AAAA,cACX,OAAO,MAAA,CAAO,KAAA;AAAA,cACd,eAAA,EAAiB,OAAO,UAAA,CAAW,WAAA;AAAA,cACnC,cAAA,EAAgB,OAAO,UAAA,CAAW,UAAA;AAAA,cAClC,YAAA,EAAc,OAAO,UAAA,CAAW,QAAA;AAAA,cAChC,aAAA,EAAe;AAAA;AACjB,WACF,CAAE;AAAA,SACJ;AAAA,MACF,SAAS,GAAA,EAAK;AACZ,QAAA,SAAA,GAAY,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,IAAA,GAAO,OAAA;AAC9C,QAAA,MAAM,GAAA;AAAA,MACR,CAAA,SAAE;AACA,QAAA,MAAM,eAAA,GAAA,CAAmBA,2BAAA,CAAY,GAAA,EAAI,GAAI,SAAA,IAAa,GAAA;AAE1D,QAAA,IAAA,CAAK,iBAAA,CAAkB,OAAO,eAAA,EAAiB;AAAA,UAC7C,iBAAA,EAAmB,YAAA;AAAA,UACnB,GAAI,SAAA,IAAa,EAAE,YAAA,EAAc,SAAA;AAAU,SAC5C,CAAA;AAAA,MACH;AAAA,IACF,CAAC,CAAA;AAED,IAAA,MAAA,CAAO,iBAAA,CAAkBC,8BAAA,EAAuB,OAAO,EAAE,QAAO,KAAM;AACpE,MAAA,MAAM,SAAA,GAAYD,4BAAY,GAAA,EAAI;AAClC,MAAA,IAAI,SAAA;AACJ,MAAA,IAAI,OAAA,GAAU,KAAA;AAEd,MAAA,IAAI;AACF,QAAA,MAAM,MAAA,GAAS,MAAME,yBAAA,CAAa,YAAY;AAC5C,UAAA,MAAM,EAAE,OAAA,EAAS,UAAA,KAAe,MAAM,IAAA,CAAK,QAAQ,IAAA,CAAK;AAAA,YACtD;AAAA,WACD,CAAA;AACD,UAAA,MAAM,UAAU,YAAA,GACZ,IAAA,CAAK,aAAA,CAAc,UAAA,EAAY,YAAY,CAAA,GAC3C,UAAA;AAEJ,UAAA,MAAM,MAAA,GAAS,QAAQ,IAAA,CAAK,CAAA,CAAA,KAAK,KAAK,WAAA,CAAY,CAAC,CAAA,KAAM,MAAA,CAAO,IAAI,CAAA;AAEpE,UAAA,IAAI,CAAC,MAAA,EAAQ;AACX,YAAA,MAAM,IAAIC,oBAAA,CAAc,CAAA,QAAA,EAAW,MAAA,CAAO,IAAI,CAAA,WAAA,CAAa,CAAA;AAAA,UAC7D;AAEA,UAAA,MAAM,EAAE,MAAA,EAAO,GAAI,MAAM,IAAA,CAAK,QAAQ,MAAA,CAAO;AAAA,YAC3C,IAAI,MAAA,CAAO,EAAA;AAAA,YACX,OAAO,MAAA,CAAO,SAAA;AAAA,YACd;AAAA,WACD,CAAA;AAED,UAAA,OAAO;AAAA;AAAA;AAAA;AAAA,YAIL,OAAA,EAAS;AAAA,cACP;AAAA,gBACE,IAAA,EAAM,MAAA;AAAA,gBACN,IAAA,EAAM,CAAC,SAAA,EAAW,IAAA,CAAK,SAAA,CAAU,QAAQ,IAAA,EAAM,CAAC,CAAA,EAAG,KAAK,CAAA,CAAE,IAAA;AAAA,kBACxD;AAAA;AACF;AACF;AACF,WACF;AAAA,QACF,CAAC,CAAA;AAED,QAAA,OAAA,GAAU,CAAC,CAAE,MAAA,EAAkC,OAAA;AAC/C,QAAA,OAAO,MAAA;AAAA,MACT,SAAS,GAAA,EAAK;AACZ,QAAA,SAAA,GAAY,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,IAAA,GAAO,OAAA;AAC9C,QAAA,MAAM,GAAA;AAAA,MACR,CAAA,SAAE;AACA,QAAA,MAAM,eAAA,GAAA,CAAmBH,2BAAA,CAAY,GAAA,EAAI,GAAI,SAAA,IAAa,GAAA;AAK1D,QAAA,IAAI,cAAA,GAAqC,SAAA;AACzC,QAAA,IAAI,CAAC,kBAAkB,OAAA,EAAS;AAC9B,UAAA,cAAA,GAAiB,YAAA;AAAA,QACnB;AAEA,QAAA,IAAA,CAAK,iBAAA,CAAkB,OAAO,eAAA,EAAiB;AAAA,UAC7C,iBAAA,EAAmB,YAAA;AAAA,UACnB,oBAAoB,MAAA,CAAO,IAAA;AAAA,UAC3B,uBAAA,EAAyB,cAAA;AAAA,UACzB,GAAI,cAAA,IAAkB,EAAE,YAAA,EAAc,cAAA;AAAe,SACtD,CAAA;AAAA,MACH;AAAA,IACF,CAAC,CAAA;AAED,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEQ,aAAA,CACN,SACA,YAAA,EACwB;AACxB,IAAA,MAAM,EAAE,YAAA,EAAc,YAAA,EAAa,GAAI,YAAA;AACvC,IAAA,IAAI,YAAA,CAAa,MAAA,KAAW,CAAA,IAAK,YAAA,CAAa,WAAW,CAAA,EAAG;AAC1D,MAAA,OAAO,OAAA;AAAA,IACT;AAEA,IAAA,OAAO,OAAA,CAAQ,OAAO,CAAA,MAAA,KAAU;AAC9B,MAAA,IAAI,YAAA,CAAa,KAAK,CAAA,IAAA,KAAQ,IAAA,CAAK,YAAY,MAAA,EAAQ,IAAI,CAAC,CAAA,EAAG;AAC7D,QAAA,OAAO,KAAA;AAAA,MACT;AAEA,MAAA,IAAI,YAAA,CAAa,WAAW,CAAA,EAAG;AAC7B,QAAA,OAAO,IAAA;AAAA,MACT;AAEA,MAAA,OAAO,aAAa,IAAA,CAAK,CAAA,IAAA,KAAQ,KAAK,WAAA,CAAY,MAAA,EAAQ,IAAI,CAAC,CAAA;AAAA,IACjE,CAAC,CAAA;AAAA,EACH;AAAA,EAEQ,YAAY,MAAA,EAAsC;AACxD,IAAA,IAAI,KAAK,mBAAA,EAAqB;AAC5B,MAAA,OAAO,CAAA,EAAG,MAAA,CAAO,QAAQ,CAAA,CAAA,EAAI,OAAO,IAAI,CAAA,CAAA;AAAA,IAC1C;AACA,IAAA,OAAO,MAAA,CAAO,IAAA;AAAA,EAChB;AAAA,EAEQ,WAAA,CAAY,QAA8B,IAAA,EAA2B;AAC3E,IAAA,IAAI,IAAA,CAAK,aAAa,CAAC,IAAA,CAAK,UAAU,KAAA,CAAM,MAAA,CAAO,EAAE,CAAA,EAAG;AACtD,MAAA,OAAO,KAAA;AAAA,IACT;AAEA,IAAA,IAAI,KAAK,UAAA,EAAY;AACnB,MAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,IAAA,CAAK,UAAU,CAAA,EAAG;AAC1D,QAAA,IACE,MAAA,CAAO,UAAA,CACL,GACF,CAAA,KAAM,KAAA,EACN;AACA,UAAA,OAAO,KAAA;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAEA,IAAA,OAAO,IAAA;AAAA,EACT;AACF;;;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/plugin-mcp-actions-backend",
-  "version": "0.1.10-next.2",
+  "version": "0.1.11-next.0",
   "backstage": {
     "role": "backend-plugin",
     "pluginId": "mcp-actions",
@@ -39,23 +39,23 @@
     "test": "backstage-cli package test"
   },
   "dependencies": {
-    "@backstage/backend-plugin-api": "1.8.0-next.1",
-    "@backstage/catalog-client": "1.14.0-next.2",
+    "@backstage/backend-plugin-api": "1.8.1-next.0",
+    "@backstage/catalog-client": "1.14.0",
     "@backstage/config": "1.3.6",
     "@backstage/errors": "1.2.7",
-    "@backstage/plugin-catalog-node": "2.1.0-next.2",
+    "@backstage/plugin-catalog-node": "2.1.1-next.0",
     "@backstage/types": "1.2.2",
     "@cfworker/json-schema": "^4.1.1",
     "@modelcontextprotocol/sdk": "^1.25.2",
     "express": "^4.22.0",
     "express-promise-router": "^4.1.0",
     "minimatch": "^10.2.1",
-    "zod": "^3.25.76"
+    "zod": "^3.25.76 || ^4.0.0"
   },
   "devDependencies": {
-    "@backstage/backend-defaults": "0.16.0-next.2",
-    "@backstage/backend-test-utils": "1.11.1-next.2",
-    "@backstage/cli": "0.36.0-next.2",
+    "@backstage/backend-defaults": "0.16.1-next.0",
+    "@backstage/backend-test-utils": "1.11.2-next.0",
+    "@backstage/cli": "0.36.1-next.0",
     "@types/express": "^4.17.6",
     "@types/supertest": "^2.0.8",
     "supertest": "^7.0.0"