@buildinternet/uploads 0.42.0 → 0.42.2

package/dist/mcp/tools.js

@@ -10,7 +10,7 @@ import { validateMetaMap } from "../metadata.js";
 import { mergeDerivedMeta } from "../metadata-vocab.js";
 import { execRunner, ghMetadataFromTargetWithTitle, resolveCurrentBranch, resolveCurrentPullRequest, resolveRepo, } from "../github-gh.js";
 import { appProp, canonicalMetaFromArgs, METADATA_DESCRIPTION, metadataArgWithCanonical, metadataProp, optBool, optPosInt, optString, optStringArray, optStringRecord, stateProp, usage, } from "./args.js";
-import { batchFailureMessage, ToolBatchError } from "./server.js";
+import { batchFailureMessage, mcpDestroyPublic, mcpNoAuth, mcpOAuthAny, mcpOAuthDelete, mcpOAuthRead, mcpOAuthWrite, mcpRead, mcpWriteInternal, mcpWritePublic, stdioOutputSchemas, withOutputSchemas, ToolBatchError, } from "./server.js";
 import { attachmentFromText, buildReportPayload, parseReportType, REPORT_TYPES, submitReport, validateReportMessage, } from "../report.js";
 import { resolveApiUrl } from "../config.js";
 function mcpOptimizeOptions(args, defaults) {
@@ -130,9 +130,12 @@ export function createUploadsMcpTools(opts) {
         }
         return { comment, commentError };
     };
-    return [
+    const tools = [
         {
             name: "gallery_create",
+            title: "Create gallery",
+            annotations: mcpWritePublic,
+            securitySchemes: mcpOAuthWrite,
             description: "Create a public ordered media gallery in the workspace. The returned canonical URL is safe to give users, but anyone who knows it can view the gallery and its media.",
             inputSchema: {
                 type: "object",
@@ -154,6 +157,9 @@ export function createUploadsMcpTools(opts) {
         },
         {
             name: "gallery_get",
+            title: "Get gallery",
+            annotations: mcpRead,
+            securitySchemes: mcpOAuthRead,
             description: "Get a workspace-owned gallery, including ordered media and its canonical public URL. Gallery media is public to anyone with the URL.",
             inputSchema: {
                 type: "object",
@@ -171,6 +177,9 @@ export function createUploadsMcpTools(opts) {
         },
         {
             name: "gallery_add",
+            title: "Add gallery item",
+            annotations: mcpWritePublic,
+            securitySchemes: mcpOAuthWrite,
             description: "Add one existing, publicly served workspace object to a gallery. Reads the latest gallery version before writing, so the optimistic API version is handled safely. Does not upload or delete the object.",
             inputSchema: {
                 type: "object",
@@ -200,6 +209,9 @@ export function createUploadsMcpTools(opts) {
         },
         {
             name: "gallery_link",
+            title: "Link gallery",
+            annotations: mcpWritePublic,
+            securitySchemes: mcpOAuthWrite,
             description: "Link a gallery to an external reference. References use provider-neutral fields; github currently accepts owner/repo#number or a strict GitHub issue/PR URL. No GitHub credentials or API calls are used.",
             inputSchema: {
                 type: "object",
@@ -227,6 +239,9 @@ export function createUploadsMcpTools(opts) {
         },
         {
             name: "gallery_find_by_reference",
+            title: "Find galleries",
+            annotations: mcpRead,
+            securitySchemes: mcpOAuthRead,
             description: "Find workspace galleries linked to an external reference. Returns gallery summaries and canonical public URLs without contacting the provider.",
             inputSchema: {
                 type: "object",
@@ -254,6 +269,9 @@ export function createUploadsMcpTools(opts) {
         },
         {
             name: "put",
+            title: "Upload file",
+            annotations: mcpDestroyPublic,
+            securitySchemes: mcpOAuthWrite,
             description: "Upload one or more files to uploads.sh and get public URL(s) plus GitHub-ready embed markdown. Single-file: pass `file` or `contentBase64`+`filename` (flat result with `url`/`embedUrl`/`markdown`). Multi-file: pass `files` (paths; parallel; returns `uploads`+`failures`). Prefer `embedUrl` in PR/issue markdown. With `pr`/`issue` keys are stable and `comment` syncs the managed attachments comment. All uploads are public; pr/issue keys are predictable — upload only non-sensitive media.",
             inputSchema: {
                 type: "object",
@@ -558,6 +576,9 @@ export function createUploadsMcpTools(opts) {
         },
         {
             name: "screenshot",
+            title: "Capture screenshot",
+            annotations: mcpDestroyPublic,
+            securitySchemes: mcpOAuthWrite,
             description: "Capture a URL or a local .html file and host it — a hosted, PR-embeddable image in one call. Backend `local` drives an already-installed Chrome/Chromium (dynamically loaded; unavailable in some runtimes); `remote` renders server-side via the workspace's render endpoint and counts against the monthly upload budget. Default via=auto prefers local when found, else remote. localhost/private-network URLs and .html files are local-only — via=remote (or auto falling back to remote) fails fast instead of a doomed request. Shares the put upload pipeline: optional frame, optimize-by-default, pr/issue attachment + comment, gallery, metadata. Uploads are public.",
             inputSchema: {
                 type: "object",
@@ -891,6 +912,9 @@ export function createUploadsMcpTools(opts) {
         },
         {
             name: "attach",
+            title: "Attach to GitHub",
+            annotations: mcpDestroyPublic,
+            securitySchemes: mcpOAuthWrite,
             description: "Upload one or more files as stable PR/issue attachments (in parallel) and maintain a managed GitHub comment. Returns `uploads` and `failures` (one bad file does not abort the batch). Each success has `url`, `embedUrl`, and `markdown` (prefer embedUrl for GitHub). With no pr/issue, targets the current branch PR. Attachments are public and keys are predictable; upload only non-sensitive media.",
             inputSchema: {
                 type: "object",
@@ -989,6 +1013,9 @@ export function createUploadsMcpTools(opts) {
         },
         {
             name: "list",
+            title: "List files",
+            annotations: mcpRead,
+            securitySchemes: mcpOAuthRead,
             description: "List uploaded objects in the workspace, filtered by key prefix or by a PR/issue's attachments. Paginate with cursor, or set all to fetch every page.",
             inputSchema: {
                 type: "object",
@@ -1046,6 +1073,9 @@ export function createUploadsMcpTools(opts) {
         },
         {
             name: "staged",
+            title: "List staged files",
+            annotations: mcpRead,
+            securitySchemes: mcpOAuthRead,
             description: "Read-only view of what's staged for a git branch (attach --branch / bare put on a non-default branch) and whether it will auto-attach once a PR opens. One list call against the branch staging prefix plus a repo-binding check (files:read only). Returns { repo, branch, files, binding }; binding.state is self/other/none/unknown and binding.autoAttach is true only for self.",
             inputSchema: {
                 type: "object",
@@ -1071,6 +1101,9 @@ export function createUploadsMcpTools(opts) {
         },
         {
             name: "delete",
+            title: "Delete file",
+            annotations: mcpDestroyPublic,
+            securitySchemes: mcpOAuthDelete,
             description: "Delete an uploaded object by key. Set dryRun to preview without deleting.",
             inputSchema: {
                 type: "object",
@@ -1097,6 +1130,9 @@ export function createUploadsMcpTools(opts) {
         },
         {
             name: "get_metadata",
+            title: "Get metadata",
+            annotations: mcpRead,
+            securitySchemes: mcpOAuthRead,
             description: "Read an object's queryable custom metadata (D1 key-value pairs, not R2 provenance). Returns `{ metadata }` (empty when none). Object must exist. Same as `uploads meta get`.",
             inputSchema: {
                 type: "object",
@@ -1116,6 +1152,9 @@ export function createUploadsMcpTools(opts) {
         },
         {
             name: "set_metadata",
+            title: "Set metadata",
+            annotations: mcpWritePublic,
+            securitySchemes: mcpOAuthWrite,
             description: "Merge-set and/or delete an object's queryable custom metadata (D1 key-value pairs, not R2 provenance). `set` wins over `delete` for the same key. " +
                 METADATA_DESCRIPTION +
                 " Requires at least one of `set` or `delete`. Same as `uploads meta set`.",
@@ -1151,6 +1190,9 @@ export function createUploadsMcpTools(opts) {
         },
         {
             name: "find_files",
+            title: "Find files",
+            annotations: mcpRead,
+            securitySchemes: mcpOAuthRead,
             description: "Find objects whose queryable custom metadata matches ALL of `filters` (ANDed equality) and/or whose key contains `name` (case-insensitive substring). At least one of `filters` or `name` is required. Returns each match's key, public URL, full metadata map, and optional `truncated`. Same as `uploads find k=v...` / `uploads find --name <term>`.",
             inputSchema: {
                 type: "object",
@@ -1191,6 +1233,9 @@ export function createUploadsMcpTools(opts) {
         },
         {
             name: "list_metadata_keys",
+            title: "List metadata keys",
+            annotations: mcpRead,
+            securitySchemes: mcpOAuthRead,
             description: "List the distinct queryable metadata keys present in the workspace, with file counts and distinct-value counts. Use this to discover what is filterable before calling find_files — keys are user/agent-defined, not a fixed schema. Same as `uploads meta keys`. Pass optional `key` to list that key's values instead (`uploads meta values <key>`).",
             inputSchema: {
                 type: "object",
@@ -1211,6 +1256,9 @@ export function createUploadsMcpTools(opts) {
         },
         {
             name: "usage",
+            title: "Show usage",
+            annotations: mcpRead,
+            securitySchemes: mcpOAuthRead,
             description: "Workspace storage and monthly upload counters (and remaining headroom when budgets are configured). Same as `uploads usage`.",
             inputSchema: {
                 type: "object",
@@ -1224,6 +1272,9 @@ export function createUploadsMcpTools(opts) {
         },
         {
             name: "reconcile",
+            title: "Reconcile usage",
+            annotations: mcpWriteInternal,
+            securitySchemes: mcpOAuthWrite,
             description: "Rebuild usage ledger bytes/objects from storage (source of truth). Preserves the monthly upload counter. Requires files:write. Same as `uploads reconcile`.",
             inputSchema: {
                 type: "object",
@@ -1237,6 +1288,9 @@ export function createUploadsMcpTools(opts) {
         },
         {
             name: "purge_expired",
+            title: "Purge expired files",
+            annotations: mcpDestroyPublic,
+            securitySchemes: mcpOAuthDelete,
             description: "Delete objects older than the workspace retentionDays setting, then reconcile. Skips if retention is unset. Requires files:delete. Same as `uploads purge-expired`.",
             inputSchema: {
                 type: "object",
@@ -1250,6 +1304,9 @@ export function createUploadsMcpTools(opts) {
         },
         {
             name: "comment",
+            title: "Sync attachments comment",
+            annotations: mcpDestroyPublic,
+            securitySchemes: mcpOAuthWrite,
             description: "Create or update the managed attachments comment on a GitHub PR or issue, listing everything uploaded for it. Posts as uploads-sh[bot] when the GitHub App is installed on the repo; otherwise via local gh auth. Edits its own prior comment in place and never touches other comments.",
             inputSchema: {
                 type: "object",
@@ -1273,6 +1330,9 @@ export function createUploadsMcpTools(opts) {
         },
         {
             name: "health",
+            title: "Check health",
+            annotations: mcpRead,
+            securitySchemes: mcpNoAuth,
             description: "Check uploads.sh API liveness. No auth or arguments required.",
             inputSchema: { type: "object", properties: {}, additionalProperties: false },
             async handler(args) {
@@ -1283,6 +1343,9 @@ export function createUploadsMcpTools(opts) {
         },
         {
             name: "doctor",
+            title: "Diagnose setup",
+            annotations: mcpRead,
+            securitySchemes: mcpOAuthAny,
             description: "Diagnose the configuration: API health, token auth, and workspace/token alignment. Returns the same report as `uploads doctor --json`, including hints.",
             inputSchema: {
                 type: "object",
@@ -1296,6 +1359,9 @@ export function createUploadsMcpTools(opts) {
         },
         {
             name: "report",
+            title: "Send diagnostic report",
+            annotations: mcpWriteInternal,
+            securitySchemes: mcpOAuthWrite,
             description: "Send an explicit diagnostic report to the uploads team (message + optional text log). " +
                 "Only call this when the user asked to submit feedback, a bug report, or error logs — " +
                 "never automatically. Do not include tokens, secrets, or private file contents. " +
@@ -1377,4 +1443,5 @@ export function createUploadsMcpTools(opts) {
             },
         },
     ];
+    return withOutputSchemas(tools, stdioOutputSchemas, { required: false });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@buildinternet/uploads",
-  "version": "0.42.0",
+  "version": "0.42.2",
   "description": "CLI and client for uploads.sh — workspace-scoped image hosting for GitHub embeds",
   "type": "module",
   "sideEffects": false,