@biomate/mcp-server 0.1.0 → 0.1.1

package/README.md

@@ -27,19 +27,19 @@ Get your API key at **[dev-public.biomate.ai/account/api-keys](https://dev-publi
 
 | Tool | Purpose |
 |---|---|
-| `biomate_session` | Primary: natural-language goal → full workflow execution |
-| `search_workflow` | Search 2,455 indexed workflows by natural language |
+| `biomate_session` | Plan an analysis and return workflow suggestions and clarification requests |
+| `search_workflow` | Search the workflow catalog by natural language |
 | `get_workflow_spec` | Full parameter spec for a workflow |
 | `run_workflow` | Execute with explicit parameters |
-| `get_run` / `watch_run` | Status, phases, steps, outputs |
+| `get_run` / `watch_run` | Status snapshots, outputs and available findings |
 | `cancel_run` | Cancel a running job |
 | `list_runs` | History with filters |
 | `preview_file` | Server-side preview of output files |
-| `export_report` | PDF/markdown publication report |
+| `export_report` | Markdown findings report (may return pending during preparation) |
 | `analyze_results` | AI interpretation of findings |
 | `explain_error` | Root-cause diagnosis for failed runs |
 | `query_database` | UniProt, PDB, NCBI, ChEMBL, AlphaFold |
-| `resolve_accession` | GEO/SRA/ENA → auto-run GEO data connector |
+| `resolve_accession` | Resolve a public accession |
 | `browse_data` / `fetch_public_data` | Browse and stage public datasets |
 | `upload_file` | Get signed S3 PUT URL for local uploads |
 | `recall_memory` | Retrieve relevant prior runs and procedures |
@@ -49,7 +49,7 @@ Get your API key at **[dev-public.biomate.ai/account/api-keys](https://dev-publi
 
 | Variable | Description |
 |---|---|
-| `BIOMATE_API_KEY` | Personal API key (`bm_live_xxx`) — required |
+| `BIOMATE_API_KEY` | Personal API key (`bm_live_xxx`) — alternative to OAuth |
 | `BIOMATE_API_BASE` | BioMate server URL (default: `https://dev-public.biomate.ai`) |
 
 ## Example
@@ -69,3 +69,9 @@ Get your API key at **[dev-public.biomate.ai/account/api-keys](https://dev-publi
 ## License
 
 MIT — this package only. BioMate platform usage governed by [biomate.ai/terms](https://biomate.ai/terms).
+
+## OAuth sign-in (0.1.1)
+
+Run `npx @biomate/connect@0.1.1 claude-code --auth-base https://dev-public.biomate.ai` (or use `claude-desktop`, `cursor`, or `codex`). This explicitly selects the development deployment. The installer stores a protected credential file and sets `BIOMATE_OAUTH_FILE` in the host configuration. The client refreshes and persists rotating tokens and calls the OAuth gateway using the current user identity. Existing OAuth installations must reconnect; a refresh token is never used as a personal API key.
+
+This package has 19 tools. Instrument tools, PDF/DOCX exports, automatic session execution and progress notifications are not supported by this stdio adapter. Use `get_run` to poll status and export Markdown findings.

package/dist/auth.d.ts

@@ -0,0 +1,8 @@
+export type Credential = {
+    authBase: string;
+    clientId: string;
+    access_token: string;
+    refresh_token: string;
+    expires_at: number;
+};
+export declare function oauthCredential(file: string): Promise<Credential>;

package/dist/auth.js

@@ -0,0 +1,54 @@
+import { promises as fs } from 'node:fs';
+import { randomUUID } from 'node:crypto';
+function origin(value) {
+    const url = new URL(value);
+    if (url.protocol !== 'https:' && !(url.protocol === 'http:' && ['127.0.0.1', 'localhost'].includes(url.hostname)))
+        throw new Error('OAuth requires HTTPS');
+    if (url.username || url.password || url.search || url.hash || url.pathname !== '/')
+        throw new Error('OAuth base must be an origin');
+    return url.origin;
+}
+export async function oauthCredential(file) {
+    const lock = file + '.lock';
+    let handle;
+    for (let attempt = 0; attempt < 100; attempt++) {
+        try {
+            handle = await fs.open(lock, 'wx', 0o600);
+            break;
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+            await new Promise(resolve => setTimeout(resolve, 100));
+        }
+    }
+    if (!handle)
+        throw new Error('OAuth credentials locked; retry or reconnect BioMate');
+    try {
+        const current = JSON.parse(await fs.readFile(file, 'utf8'));
+        current.authBase = origin(current.authBase);
+        if (!current.clientId || !current.refresh_token)
+            throw new Error('Reconnect BioMate: incomplete OAuth credentials');
+        if (current.access_token && current.expires_at > Date.now() + 60000)
+            return current;
+        const response = await fetch(current.authBase + '/oauth/token', {
+            method: 'POST', redirect: 'error', signal: AbortSignal.timeout(15000),
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({ grant_type: 'refresh_token', client_id: current.clientId, refresh_token: current.refresh_token }),
+        });
+        if (!response.ok)
+            throw new Error(`OAuth refresh failed (HTTP ${response.status}); reconnect BioMate`);
+        const updated = await response.json();
+        if (!updated.access_token || !updated.refresh_token || !(Number(updated.expires_in) > 0))
+            throw new Error('Invalid OAuth token response; reconnect BioMate');
+        const next = { ...current, access_token: updated.access_token, refresh_token: updated.refresh_token, expires_at: Date.now() + Number(updated.expires_in) * 1000 };
+        const tmp = file + '.' + randomUUID() + '.tmp';
+        await fs.writeFile(tmp, JSON.stringify(next), { mode: 0o600 });
+        await fs.rename(tmp, file);
+        return next;
+    }
+    finally {
+        await handle.close();
+        await fs.unlink(lock);
+    }
+}

package/dist/index.d.ts

@@ -8,7 +8,7 @@
  * Configuration (environment variables):
  *   BIOMATE_API_BASE   BioMate server URL (default: https://dev-public.biomate.ai)
  *   BIOMATE_API_KEY    Personal API key (bm_live_xxx) from biomate.ai/account/api-keys
- *   BIOMATE_REFRESH_TOKEN  OAuth refresh token (alternative to API key)
+ *   BIOMATE_OAUTH_FILE  Protected credential file written by @biomate/connect
  *
  * Each tool call POSTs to ${BIOMATE_API_BASE}/tools/${toolName} with the
  * Authorization header set. The /tools/* routes are served by BioMate's

package/dist/index.js

@@ -8,12 +8,13 @@
  * Configuration (environment variables):
  *   BIOMATE_API_BASE   BioMate server URL (default: https://dev-public.biomate.ai)
  *   BIOMATE_API_KEY    Personal API key (bm_live_xxx) from biomate.ai/account/api-keys
- *   BIOMATE_REFRESH_TOKEN  OAuth refresh token (alternative to API key)
+ *   BIOMATE_OAUTH_FILE  Protected credential file written by @biomate/connect
  *
  * Each tool call POSTs to ${BIOMATE_API_BASE}/tools/${toolName} with the
  * Authorization header set. The /tools/* routes are served by BioMate's
  * Node.js API server.
  */
+import { oauthCredential } from "./auth.js";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
@@ -21,7 +22,7 @@ import { createRequire } from "module";
 const require = createRequire(import.meta.url);
 // ── Config ────────────────────────────────────────────────────────────────────
 const API_BASE = (process.env.BIOMATE_API_BASE ?? "https://dev-public.biomate.ai").replace(/\/$/, "");
-const API_KEY = process.env.BIOMATE_API_KEY ?? process.env.BIOMATE_REFRESH_TOKEN ?? "";
+const API_KEY = process.env.BIOMATE_API_KEY ?? "";
 // ── Tools manifest ────────────────────────────────────────────────────────────
 const manifest = require("./tools_manifest.json");
 const TOOLS = manifest.mcp.map((t) => ({
@@ -43,7 +44,18 @@ server.setRequestHandler(CallToolRequestSchema, async (req) => {
     let data;
     let ok = true;
     try {
-        const res = await fetch(`${API_BASE}/tools/${name}`, {
+        if (!TOOLS.some(tool => tool.name === name))
+            throw new Error("Unknown tool");
+        let endpoint = `${API_BASE}/tools/${name}`;
+        if (!API_KEY) {
+            if (!process.env.BIOMATE_OAUTH_FILE)
+                throw new Error("Reconnect BioMate with the updated installer or configure a personal API key");
+            const credential = await oauthCredential(process.env.BIOMATE_OAUTH_FILE);
+            headers.Authorization = `Bearer ${credential.access_token}`;
+            endpoint = `${credential.authBase}/oauth/tools/${name}`;
+        }
+        const res = await fetch(endpoint, {
+            redirect: "error",
             method: "POST",
             headers,
             body: JSON.stringify(args ?? {}),
@@ -69,7 +81,7 @@ server.setRequestHandler(CallToolRequestSchema, async (req) => {
     };
 });
 // ── Start ─────────────────────────────────────────────────────────────────────
-if (!API_KEY) {
+if (!API_KEY && !process.env.BIOMATE_OAUTH_FILE) {
     process.stderr.write("[biomate-mcp] WARNING: BIOMATE_API_KEY not set. " +
         "Get your key at https://dev-public.biomate.ai/account/api-keys\n");
 }