@bywaleed/onyx-mcp 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Waleed Islam
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,151 @@
+# Onyx MCP
+
+[![CI](https://github.com/ByWaleed/onyx-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/ByWaleed/onyx-mcp/actions/workflows/ci.yml)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+
+MCP Registry name: `io.github.bywaleed/onyx-mcp`
+
+A comprehensive, secure Model Context Protocol server for [Onyx](https://www.onyx.app/), formerly Danswer.
+
+This project exposes Onyx search, chat, agents, projects, documents, connectors, ingestion, and deployment-specific APIs to MCP clients. It is an independent community project and is not an official Onyx package.
+
+## Why This Server
+
+- Uses the current `/chat/send-chat-message` contract.
+- Defaults to Onyx's built-in assistant, persona `0`.
+- Supports scoped Personal Access Tokens and legacy API keys.
+- Starts read-only.
+- Separately gates writes, administration, destructive actions, and raw API access.
+- Applies request timeouts and response-size limits.
+- Never logs authorization headers or tokens.
+- Includes an advanced raw API tool for deployment-specific endpoints.
+
+## Install
+
+```bash
+npx -y @bywaleed/onyx-mcp
+```
+
+Until the first npm release, clone the repository and run `npm install && npm run build`.
+
+Versioned tarballs will be attached to [GitHub Releases](https://github.com/ByWaleed/onyx-mcp/releases) and published to GitHub Packages as `@bywaleed/onyx-mcp`.
+
+## Configuration
+
+Required:
+
+| Variable         | Description                                                   |
+| ---------------- | ------------------------------------------------------------- |
+| `ONYX_API_URL`   | Onyx API base URL, for example `https://onyx.example.com/api` |
+| `ONYX_API_TOKEN` | Onyx PAT or API key                                           |
+
+Optional:
+
+| Variable                      | Default   | Description                                                        |
+| ----------------------------- | --------- | ------------------------------------------------------------------ |
+| `ONYX_DEFAULT_PERSONA_ID`     | `0`       | Default agent used for new chats                                   |
+| `ONYX_MCP_ENABLE_WRITE`       | `false`   | Registers tools that create or modify data                         |
+| `ONYX_MCP_ENABLE_ADMIN`       | `false`   | Registers administrative tools                                     |
+| `ONYX_MCP_ENABLE_DESTRUCTIVE` | `false`   | Registers destructive tools; write must also be enabled            |
+| `ONYX_MCP_ENABLE_RAW_API`     | `false`   | Registers the advanced raw API tool; admin access is also required |
+| `ONYX_MCP_TIMEOUT_MS`         | `30000`   | Request timeout                                                    |
+| `ONYX_MCP_MAX_RESPONSE_BYTES` | `1000000` | Maximum accepted response body                                     |
+| `ONYX_MCP_MAX_CONCURRENCY`    | `8`       | Maximum concurrent requests to Onyx                                |
+
+Onyx still enforces the permissions attached to the supplied token. Enabling a profile cannot grant additional Onyx privileges.
+
+## OpenCode
+
+```json
+{
+  "mcp": {
+    "onyx": {
+      "type": "local",
+      "command": ["npx", "-y", "@bywaleed/onyx-mcp"],
+      "environment": {
+        "ONYX_API_URL": "https://onyx.example.com/api",
+        "ONYX_API_TOKEN": "{env:ONYX_API_TOKEN}"
+      },
+      "enabled": true
+    }
+  }
+}
+```
+
+## Claude Desktop
+
+```json
+{
+  "mcpServers": {
+    "onyx": {
+      "command": "npx",
+      "args": ["-y", "@bywaleed/onyx-mcp"],
+      "env": {
+        "ONYX_API_URL": "https://onyx.example.com/api",
+        "ONYX_API_TOKEN": "your-token"
+      }
+    }
+  }
+}
+```
+
+## Tool Profiles
+
+The read-only profile includes health, identity, permissions, search, chat history, agents, projects, files, tools, document sets, and connector status.
+
+The write profile adds chat creation, chat messages, feedback, and project updates.
+
+The admin profile adds connector, credential, user, agent, and direct-ingestion administration.
+
+The destructive profile adds individually confirmed deletion tools. Bulk deletion is intentionally not exposed as a first-class tool.
+
+The raw API profile adds `onyx_api_request`. It covers APIs specific to an Onyx edition or version. Every raw request requires the admin profile. Mutations also require write access, and deletions require destructive access plus confirmation.
+
+## Tools
+
+The default profile provides health, version, identity, permission, search, agent, chat-history, project, file, document-set, tool, source, and connector-status tools. Write mode adds chat, feedback, and project mutations. Admin mode adds connector, credential, user, agent, and ingestion tools.
+
+Run `onyx_capabilities` to inspect the active profile. MCP clients can also call `tools/list` for complete machine-readable schemas and safety annotations.
+
+## Authentication
+
+Prefer an Onyx PAT with the smallest required scope:
+
+- `read:search` for search.
+- `read:chat` for chat history.
+- `write:chat` for chat creation and messages.
+
+Some Onyx endpoints still use legacy role checks and need an unrestricted PAT or API key. Use a separate administrative server configuration for those operations.
+
+Treat client configuration files as sensitive when they contain a token. Use a dedicated least-privilege token and restrict file permissions to your user account.
+
+## Development
+
+```bash
+npm ci
+npm run verify
+```
+
+## Compatibility
+
+| Component        | Supported                                                                                           |
+| ---------------- | --------------------------------------------------------------------------------------------------- |
+| Node.js          | 20 and 22                                                                                           |
+| MCP SDK/protocol | TypeScript SDK 1.x, MCP through `2025-11-25`                                                        |
+| Onyx             | Current community and enterprise APIs; tested against the repository version documented in releases |
+| Transport        | Local stdio                                                                                         |
+
+The server uses non-streaming Onyx chat responses for a stable MCP result. Onyx editions and releases expose different administrative routes. The raw API tool provides an escape hatch while first-class tools remain curated and safe. MCP SDK 2.x migration is planned as a separate breaking compatibility release.
+
+## Support And Security
+
+- Usage questions: [GitHub Discussions](https://github.com/ByWaleed/onyx-mcp/discussions)
+- Bugs and feature requests: [GitHub Issues](https://github.com/ByWaleed/onyx-mcp/issues)
+- Vulnerabilities: [private security advisory](https://github.com/ByWaleed/onyx-mcp/security/advisories/new)
+- Release history: [CHANGELOG.md](CHANGELOG.md)
+- Maintainer release process: [RELEASING.md](RELEASING.md)
+- MCP Registry metadata: [server.json](server.json)
+
+## License
+
+MIT

package/SECURITY.md

@@ -0,0 +1,30 @@
+# Security Policy
+
+## Reporting
+
+Report security issues privately through [GitHub Security Advisories](https://github.com/ByWaleed/onyx-mcp/security/advisories/new). Do not create a public issue for a suspected vulnerability.
+
+You should receive an acknowledgement within seven days. Resolution time depends on severity and complexity.
+
+## Supported Versions
+
+| Version        | Supported   |
+| -------------- | ----------- |
+| Latest release | Yes         |
+| Older releases | Best effort |
+
+## Credential Safety
+
+- Use a scoped Onyx Personal Access Token where possible.
+- Do not commit tokens or put them directly in shared configuration files.
+- Run administrative access as a separate MCP server configuration.
+- Leave destructive and raw API access disabled unless required.
+- Raw API access always requires the administrative profile.
+- Use HTTPS for remote Onyx deployments. Plain HTTP is accepted only for loopback development hosts.
+- Rotate a token immediately if it appears in logs, shell history, or source control.
+
+## Safety Model
+
+This server has local capability gates, but Onyx is the source of truth for authorization. The server cannot grant access that the configured Onyx token does not have.
+
+Destructive first-class tools require both `ONYX_MCP_ENABLE_DESTRUCTIVE=true` and an explicit `confirm: true` argument. Raw DELETE requests have the same requirement.

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { loadConfig } from "./config.js";
+import { createServer } from "./server.js";
+async function main() {
+    const server = createServer(loadConfig());
+    await server.connect(new StdioServerTransport());
+}
+main().catch((error) => {
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(`Failed to start onyx-mcp: ${message}`);
+    process.exitCode = 1;
+});

package/dist/client.d.ts

@@ -0,0 +1,16 @@
+import type { Config } from "./config.js";
+export interface RequestOptions {
+    method?: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+    query?: Record<string, unknown>;
+    body?: unknown;
+}
+export declare class OnyxClient {
+    private readonly config;
+    private readonly fetchImpl;
+    private activeRequests;
+    private readonly waiters;
+    constructor(config: Config, fetchImpl?: typeof fetch);
+    private acquire;
+    private release;
+    request<T = unknown>(path: string, options?: RequestOptions): Promise<T>;
+}

package/dist/client.js

@@ -0,0 +1,155 @@
+import { OnyxApiError } from "./errors.js";
+import { getRequestSignal } from "./request-context.js";
+function addQuery(url, query) {
+    const serialize = (value) => typeof value === "object" ? JSON.stringify(value) : String(value);
+    for (const [key, value] of Object.entries(query)) {
+        if (value === undefined || value === null || value === "")
+            continue;
+        if (Array.isArray(value)) {
+            for (const item of value)
+                url.searchParams.append(key, serialize(item));
+        }
+        else {
+            url.searchParams.set(key, serialize(value));
+        }
+    }
+}
+export class OnyxClient {
+    config;
+    fetchImpl;
+    activeRequests = 0;
+    waiters = [];
+    constructor(config, fetchImpl = fetch) {
+        this.config = config;
+        this.fetchImpl = fetchImpl;
+    }
+    async acquire(signal) {
+        signal?.throwIfAborted();
+        if (this.activeRequests < (this.config.maxConcurrency ?? 8)) {
+            this.activeRequests += 1;
+            return;
+        }
+        await new Promise((resolve, reject) => {
+            const resume = () => {
+                signal?.removeEventListener("abort", abort);
+                this.activeRequests += 1;
+                resolve();
+            };
+            const abort = () => {
+                const index = this.waiters.indexOf(resume);
+                if (index >= 0)
+                    this.waiters.splice(index, 1);
+                reject(new DOMException("The operation was aborted", "AbortError"));
+            };
+            this.waiters.push(resume);
+            signal?.addEventListener("abort", abort, { once: true });
+        });
+    }
+    release() {
+        this.activeRequests -= 1;
+        this.waiters.shift()?.();
+    }
+    async request(path, options = {}) {
+        const baseUrl = new URL(`${this.config.apiUrl}/`);
+        const url = new URL(path.startsWith("/") ? path.slice(1) : path, baseUrl);
+        const apiPrefix = baseUrl.pathname.endsWith("/")
+            ? baseUrl.pathname
+            : `${baseUrl.pathname}/`;
+        if (url.origin !== baseUrl.origin ||
+            !`${url.pathname}/`.startsWith(apiPrefix)) {
+            throw new Error("Onyx API path must stay within the configured API base URL");
+        }
+        if (options.query)
+            addQuery(url, options.query);
+        const callerSignal = getRequestSignal();
+        callerSignal?.throwIfAborted();
+        await this.acquire(callerSignal);
+        const controller = new AbortController();
+        const abortFromCaller = () => controller.abort(callerSignal?.reason);
+        let timeout;
+        const headers = {
+            Accept: "application/json",
+            Authorization: `Bearer ${this.config.apiToken}`,
+        };
+        let body;
+        if (options.body !== undefined) {
+            headers["Content-Type"] = "application/json";
+            body = JSON.stringify(options.body);
+        }
+        try {
+            callerSignal?.throwIfAborted();
+            callerSignal?.addEventListener("abort", abortFromCaller, { once: true });
+            timeout = setTimeout(() => controller.abort(), this.config.timeoutMs);
+            const requestInit = {
+                method: options.method ?? "GET",
+                headers,
+                signal: controller.signal,
+                ...(body === undefined ? {} : { body }),
+            };
+            const response = await this.fetchImpl(url, requestInit);
+            const declaredLength = Number(response.headers.get("content-length"));
+            if (Number.isFinite(declaredLength) &&
+                declaredLength > this.config.maxResponseBytes) {
+                controller.abort();
+                throw new OnyxApiError(`Onyx response exceeded ${this.config.maxResponseBytes} bytes`, response.status);
+            }
+            const chunks = [];
+            let receivedBytes = 0;
+            if (response.body) {
+                const reader = response.body.getReader();
+                while (true) {
+                    const { done, value } = await reader.read();
+                    if (done)
+                        break;
+                    receivedBytes += value.byteLength;
+                    if (receivedBytes > this.config.maxResponseBytes) {
+                        await reader.cancel();
+                        controller.abort();
+                        throw new OnyxApiError(`Onyx response exceeded ${this.config.maxResponseBytes} bytes`, response.status);
+                    }
+                    chunks.push(value);
+                }
+            }
+            const bytes = new Uint8Array(receivedBytes);
+            let offset = 0;
+            for (const chunk of chunks) {
+                bytes.set(chunk, offset);
+                offset += chunk.byteLength;
+            }
+            const text = new TextDecoder().decode(bytes);
+            let data = null;
+            if (text) {
+                try {
+                    data = JSON.parse(text);
+                }
+                catch {
+                    data = text;
+                }
+            }
+            if (!response.ok) {
+                const detail = typeof data === "object" && data !== null && "detail" in data
+                    ? String(data.detail)
+                    : response.statusText;
+                throw new OnyxApiError(`Onyx request failed: ${detail}`, response.status, data);
+            }
+            return data;
+        }
+        catch (error) {
+            if (error instanceof OnyxApiError)
+                throw error;
+            if (error instanceof Error && error.name === "AbortError") {
+                if (callerSignal?.aborted) {
+                    throw new Error("Onyx request was cancelled", { cause: error });
+                }
+                throw new Error(`Onyx request timed out after ${this.config.timeoutMs}ms`, { cause: error });
+            }
+            throw error;
+        }
+        finally {
+            if (timeout !== undefined)
+                clearTimeout(timeout);
+            callerSignal?.removeEventListener("abort", abortFromCaller);
+            this.release();
+        }
+    }
+}

package/dist/config.d.ts

@@ -0,0 +1,13 @@
+export interface Config {
+    apiUrl: string;
+    apiToken: string;
+    defaultPersonaId: number;
+    enableWrite: boolean;
+    enableAdmin: boolean;
+    enableDestructive: boolean;
+    enableRawApi: boolean;
+    timeoutMs: number;
+    maxResponseBytes: number;
+    maxConcurrency?: number;
+}
+export declare function loadConfig(env?: NodeJS.ProcessEnv): Config;

package/dist/config.js

@@ -0,0 +1,49 @@
+import { z } from "zod";
+const booleanValue = z
+    .enum(["true", "false", "1", "0"])
+    .optional()
+    .transform((value) => value === "true" || value === "1");
+const envSchema = z.object({
+    ONYX_API_URL: z
+        .string()
+        .url()
+        .refine((value) => {
+        const url = new URL(value);
+        return (url.protocol === "https:" ||
+            (url.protocol === "http:" &&
+                ["localhost", "127.0.0.1", "::1"].includes(url.hostname)));
+    }, "ONYX_API_URL must use HTTPS unless it points to a loopback host"),
+    ONYX_API_TOKEN: z.string().min(1),
+    ONYX_DEFAULT_PERSONA_ID: z.coerce.number().int().nonnegative().default(0),
+    ONYX_MCP_ENABLE_WRITE: booleanValue,
+    ONYX_MCP_ENABLE_ADMIN: booleanValue,
+    ONYX_MCP_ENABLE_DESTRUCTIVE: booleanValue,
+    ONYX_MCP_ENABLE_RAW_API: booleanValue,
+    ONYX_MCP_TIMEOUT_MS: z.coerce.number().int().positive().default(30_000),
+    ONYX_MCP_MAX_RESPONSE_BYTES: z.coerce
+        .number()
+        .int()
+        .positive()
+        .default(1_000_000),
+    ONYX_MCP_MAX_CONCURRENCY: z.coerce
+        .number()
+        .int()
+        .positive()
+        .max(100)
+        .default(8),
+});
+export function loadConfig(env = process.env) {
+    const parsed = envSchema.parse(env);
+    return {
+        apiUrl: parsed.ONYX_API_URL.replace(/\/$/, ""),
+        apiToken: parsed.ONYX_API_TOKEN,
+        defaultPersonaId: parsed.ONYX_DEFAULT_PERSONA_ID,
+        enableWrite: parsed.ONYX_MCP_ENABLE_WRITE,
+        enableAdmin: parsed.ONYX_MCP_ENABLE_ADMIN,
+        enableDestructive: parsed.ONYX_MCP_ENABLE_DESTRUCTIVE,
+        enableRawApi: parsed.ONYX_MCP_ENABLE_RAW_API,
+        timeoutMs: parsed.ONYX_MCP_TIMEOUT_MS,
+        maxResponseBytes: parsed.ONYX_MCP_MAX_RESPONSE_BYTES,
+        maxConcurrency: parsed.ONYX_MCP_MAX_CONCURRENCY,
+    };
+}

package/dist/errors.d.ts

@@ -0,0 +1,6 @@
+export declare class OnyxApiError extends Error {
+    readonly status: number;
+    readonly details?: unknown | undefined;
+    constructor(message: string, status: number, details?: unknown | undefined);
+}
+export declare function safeErrorMessage(error: unknown): string;

package/dist/errors.js

@@ -0,0 +1,16 @@
+export class OnyxApiError extends Error {
+    status;
+    details;
+    constructor(message, status, details) {
+        super(message);
+        this.status = status;
+        this.details = details;
+        this.name = "OnyxApiError";
+    }
+}
+export function safeErrorMessage(error) {
+    if (error instanceof OnyxApiError) {
+        return `${error.message} (HTTP ${error.status})`;
+    }
+    return error instanceof Error ? error.message : "Unknown error";
+}

package/dist/register.d.ts

@@ -0,0 +1,11 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { CallToolResult, ToolAnnotations } from "@modelcontextprotocol/sdk/types.js";
+import type { z, ZodRawShape } from "zod";
+import type { Config } from "./config.js";
+import type { OnyxClient } from "./client.js";
+export interface ToolContext {
+    server: McpServer;
+    client: OnyxClient;
+    config: Config;
+}
+export declare function addTool<T extends ZodRawShape>(server: McpServer, name: string, description: string, schema: T, handler: (args: z.infer<z.ZodObject<T>>) => Promise<CallToolResult>, annotations?: ToolAnnotations): void;

package/dist/register.js

@@ -0,0 +1,20 @@
+import { runWithRequestSignal } from "./request-context.js";
+export function addTool(server, name, description, schema, handler, annotations = {
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: false,
+    openWorldHint: false,
+}) {
+    const completeAnnotations = {
+        readOnlyHint: false,
+        destructiveHint: false,
+        idempotentHint: false,
+        openWorldHint: false,
+        ...annotations,
+    };
+    server.registerTool(name, {
+        description,
+        inputSchema: schema,
+        annotations: completeAnnotations,
+    }, ((args, extra) => runWithRequestSignal(extra.signal, () => handler(args))));
+}

package/dist/request-context.d.ts

@@ -0,0 +1,2 @@
+export declare function runWithRequestSignal<T>(signal: AbortSignal, action: () => Promise<T>): Promise<T>;
+export declare function getRequestSignal(): AbortSignal | undefined;

package/dist/request-context.js

@@ -0,0 +1,8 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+const signalContext = new AsyncLocalStorage();
+export function runWithRequestSignal(signal, action) {
+    return signalContext.run(signal, action);
+}
+export function getRequestSignal() {
+    return signalContext.getStore();
+}

package/dist/schemas.d.ts

@@ -0,0 +1,38 @@
+import { z } from "zod";
+export declare const filtersSchema: z.ZodObject<{
+    document_sets: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    sources: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    time_cutoff: z.ZodOptional<z.ZodString>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        tag_key: z.ZodString;
+        tag_value: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        tag_key: string;
+        tag_value: string;
+    }, {
+        tag_key: string;
+        tag_value: string;
+    }>, "many">>;
+}, "strip", z.ZodTypeAny, {
+    document_sets?: string[] | undefined;
+    sources?: string[] | undefined;
+    time_cutoff?: string | undefined;
+    tags?: {
+        tag_key: string;
+        tag_value: string;
+    }[] | undefined;
+}, {
+    document_sets?: string[] | undefined;
+    sources?: string[] | undefined;
+    time_cutoff?: string | undefined;
+    tags?: {
+        tag_key: string;
+        tag_value: string;
+    }[] | undefined;
+}>;
+export declare const httpUrlSchema: z.ZodEffects<z.ZodString, string, string>;
+export declare const paginationSchema: {
+    offset: z.ZodOptional<z.ZodNumber>;
+    limit: z.ZodOptional<z.ZodNumber>;
+};
+export declare const rawPathSchema: z.ZodEffects<z.ZodString, string, string>;

package/dist/schemas.js

@@ -0,0 +1,25 @@
+import { z } from "zod";
+export const filtersSchema = z.object({
+    document_sets: z.array(z.string()).optional(),
+    sources: z.array(z.string()).optional(),
+    time_cutoff: z.string().datetime().optional(),
+    tags: z
+        .array(z.object({ tag_key: z.string().min(1), tag_value: z.string() }))
+        .optional(),
+});
+export const httpUrlSchema = z
+    .string()
+    .url()
+    .refine((value) => {
+    const protocol = new URL(value).protocol;
+    return protocol === "http:" || protocol === "https:";
+}, "URL must use HTTP or HTTPS");
+export const paginationSchema = {
+    offset: z.number().int().nonnegative().optional(),
+    limit: z.number().int().positive().max(1000).optional(),
+};
+export const rawPathSchema = z
+    .string()
+    .startsWith("/")
+    .regex(/^\/[A-Za-z0-9._~!$&'()*+,;=:@%/-]*$/, "Path contains unsafe characters")
+    .refine((path) => !path.includes("//") && !path.split("/").includes(".."), "Path must be relative to the Onyx API");

package/dist/server.d.ts

@@ -0,0 +1,5 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { Config } from "./config.js";
+export { OnyxClient } from "./client.js";
+export { loadConfig, type Config } from "./config.js";
+export declare function createServer(config: Config, fetchImpl?: typeof fetch): McpServer;

package/dist/server.js

@@ -0,0 +1,29 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { OnyxClient } from "./client.js";
+import { registerAdminTools } from "./tools/admin.js";
+import { registerChatTools } from "./tools/chat.js";
+import { registerProjectTools } from "./tools/projects.js";
+import { registerRawApiTool } from "./tools/raw.js";
+import { registerSearchTools } from "./tools/search.js";
+import { registerSystemTools } from "./tools/system.js";
+import { VERSION } from "./version.js";
+export { OnyxClient } from "./client.js";
+export { loadConfig } from "./config.js";
+export function createServer(config, fetchImpl = fetch) {
+    const server = new McpServer({
+        name: "onyx-mcp",
+        title: "Onyx MCP",
+        description: "Secure MCP access to Onyx search, chat, projects, and administration.",
+        websiteUrl: "https://github.com/ByWaleed/onyx-mcp",
+        version: VERSION,
+    });
+    const client = new OnyxClient(config, fetchImpl);
+    const context = { server, client, config };
+    registerSystemTools(context);
+    registerSearchTools(context);
+    registerChatTools(context);
+    registerProjectTools(context);
+    registerAdminTools(context);
+    registerRawApiTool(context);
+    return server;
+}

package/dist/tool-helpers.d.ts

@@ -0,0 +1,4 @@
+import type { CallToolResult } from "@modelcontextprotocol/sdk/types.js";
+export declare function success(data: unknown): CallToolResult;
+export declare function failure(error: unknown): CallToolResult;
+export declare function runTool(action: () => Promise<unknown>): Promise<CallToolResult>;

package/dist/tool-helpers.js

@@ -0,0 +1,21 @@
+import { safeErrorMessage } from "./errors.js";
+export function success(data) {
+    return {
+        content: [{ type: "text", text: JSON.stringify(data, null, 2) }],
+        structuredContent: { result: data },
+    };
+}
+export function failure(error) {
+    return {
+        isError: true,
+        content: [{ type: "text", text: safeErrorMessage(error) }],
+    };
+}
+export async function runTool(action) {
+    try {
+        return success(await action());
+    }
+    catch (error) {
+        return failure(error);
+    }
+}

package/dist/tools/admin.d.ts

@@ -0,0 +1,2 @@
+import type { ToolContext } from "../register.js";
+export declare function registerAdminTools({ server, client, config, }: ToolContext): void;

package/dist/tools/admin.js

@@ -0,0 +1,56 @@
+import { z } from "zod";
+import { addTool } from "../register.js";
+import { runTool } from "../tool-helpers.js";
+export function registerAdminTools({ server, client, config, }) {
+    if (!config.enableAdmin)
+        return;
+    addTool(server, "onyx_admin_list_connectors", "List configured Onyx connectors.", {}, () => runTool(() => client.request("/manage/admin/connector")), { readOnlyHint: true, idempotentHint: true, openWorldHint: false });
+    addTool(server, "onyx_admin_connector_status", "Get detailed indexing status for Onyx connectors.", {}, () => runTool(() => client.request("/manage/admin/connector/status")), { readOnlyHint: true, idempotentHint: true, openWorldHint: false });
+    addTool(server, "onyx_admin_list_credentials", "List credential metadata. Secret values are controlled and masked by Onyx.", {}, () => runTool(() => client.request("/manage/admin/credential")), { readOnlyHint: true, idempotentHint: true, openWorldHint: false });
+    addTool(server, "onyx_admin_list_users", "List users managed by this Onyx deployment.", {}, () => runTool(() => client.request("/manage/users")), { readOnlyHint: true, idempotentHint: true, openWorldHint: false });
+    addTool(server, "onyx_admin_list_agents", "List agents with administrative metadata.", {}, () => runTool(() => client.request("/admin/agents")), { readOnlyHint: true, idempotentHint: true, openWorldHint: false });
+    addTool(server, "onyx_admin_list_ingested_documents", "List documents added through the direct ingestion API.", {}, () => runTool(() => client.request("/onyx-api/ingestion")), { readOnlyHint: true, idempotentHint: true, openWorldHint: false });
+    if (!config.enableWrite)
+        return;
+    addTool(server, "onyx_admin_ingest_document", "Create or update a document through Onyx's direct ingestion API. This changes the search index.", {
+        document: z.object({
+            id: z.string().optional(),
+            semantic_identifier: z.string().min(1),
+            sections: z
+                .array(z.object({
+                type: z.literal("text"),
+                text: z.string(),
+                link: z.string().url().nullable().optional(),
+                heading: z.string().nullable().optional(),
+            }))
+                .min(1),
+            source: z.string().optional(),
+            metadata: z.record(z.union([z.string(), z.array(z.string())])),
+            title: z.string().nullable().optional(),
+            doc_updated_at: z.string().datetime().optional(),
+            doc_created_at: z.string().datetime().optional(),
+        }),
+        cc_pair_id: z.number().int().positive().optional(),
+    }, ({ document, cc_pair_id }) => runTool(() => client.request("/onyx-api/ingestion", {
+        method: "POST",
+        body: { document, cc_pair_id },
+    })), { readOnlyHint: false, destructiveHint: false, openWorldHint: false });
+    addTool(server, "onyx_admin_run_connector", "Start one connector indexing run. This can consume significant resources.", {
+        connector_id: z.number().int().positive(),
+        credential_ids: z.array(z.number().int().positive()).optional(),
+        from_beginning: z.boolean().optional(),
+    }, (body) => runTool(() => client.request("/manage/admin/connector/run-once", {
+        method: "POST",
+        body,
+    })), { readOnlyHint: false, destructiveHint: false, openWorldHint: false });
+    if (!config.enableDestructive)
+        return;
+    addTool(server, "onyx_admin_delete_ingested_document", "Delete a document created through the direct ingestion API. This action is destructive.", { document_id: z.string().min(1), confirm: z.literal(true) }, ({ document_id }) => runTool(() => client.request(`/onyx-api/ingestion/${encodeURIComponent(document_id)}`, {
+        method: "DELETE",
+    })), {
+        readOnlyHint: false,
+        destructiveHint: true,
+        idempotentHint: true,
+        openWorldHint: false,
+    });
+}

package/dist/tools/chat.d.ts

@@ -0,0 +1,2 @@
+import type { ToolContext } from "../register.js";
+export declare function registerChatTools({ server, client, config, }: ToolContext): void;

package/dist/tools/chat.js

@@ -0,0 +1,98 @@
+import { z } from "zod";
+import { addTool } from "../register.js";
+import { filtersSchema } from "../schemas.js";
+import { runTool } from "../tool-helpers.js";
+export function registerChatTools({ server, client, config, }) {
+    addTool(server, "onyx_list_chats", "List chat sessions owned by the authenticated user.", {
+        page_size: z.number().int().positive().max(100).optional(),
+        project_id: z.number().int().positive().optional(),
+        only_non_project_chats: z.boolean().optional(),
+        include_failed_chats: z.boolean().optional(),
+        before: z.string().datetime().optional(),
+    }, (args) => runTool(() => client.request("/chat/get-user-chat-sessions", { query: args })), { readOnlyHint: true, idempotentHint: true, openWorldHint: false });
+    addTool(server, "onyx_get_chat", "Get a chat session and its message history.", { chat_session_id: z.string().uuid() }, ({ chat_session_id }) => runTool(() => client.request(`/chat/get-chat-session/${chat_session_id}`)), { readOnlyHint: true, idempotentHint: true, openWorldHint: false });
+    addTool(server, "onyx_search_chats", "Search the authenticated user's chat history.", {
+        query: z.string().min(1),
+        page: z.number().int().positive().optional(),
+        page_size: z.number().int().positive().max(100).optional(),
+    }, (args) => runTool(() => client.request("/chat/search", { query: args })), { readOnlyHint: true, idempotentHint: true, openWorldHint: false });
+    if (!config.enableWrite)
+        return;
+    addTool(server, "onyx_create_chat", "Create a persistent Onyx chat session.", {
+        persona_id: z.number().int().nonnegative().optional(),
+        description: z.string().max(500).optional(),
+        project_id: z.number().int().positive().optional(),
+        incognito: z.boolean().optional(),
+    }, (args) => runTool(() => client.request("/chat/create-chat-session", {
+        method: "POST",
+        body: {
+            ...args,
+            persona_id: args.persona_id ?? config.defaultPersonaId,
+        },
+    })), { readOnlyHint: false, destructiveHint: false, openWorldHint: false });
+    addTool(server, "onyx_chat", "Ask an Onyx agent a question. Creates a persistent session when chat_session_id is omitted. May invoke search, tools, and an LLM.", {
+        message: z.string().min(1),
+        chat_session_id: z.string().uuid().optional(),
+        persona_id: z.number().int().nonnegative().optional(),
+        filters: filtersSchema.optional(),
+        deep_research: z.boolean().optional(),
+        allowed_tool_ids: z.array(z.number().int().positive()).optional(),
+        forced_tool_id: z.number().int().positive().optional(),
+        include_citations: z.boolean().optional(),
+    }, ({ message, chat_session_id, persona_id, filters, ...options }) => runTool(() => client.request("/chat/send-chat-message", {
+        method: "POST",
+        body: {
+            message,
+            ...(chat_session_id
+                ? { chat_session_id }
+                : {
+                    chat_session_info: {
+                        persona_id: persona_id ?? config.defaultPersonaId,
+                    },
+                }),
+            internal_search_filters: filters,
+            stream: false,
+            ...options,
+        },
+    })), { readOnlyHint: false, destructiveHint: false, openWorldHint: true });
+    addTool(server, "onyx_stop_chat", "Stop active generation for a chat session.", { chat_session_id: z.string().uuid() }, ({ chat_session_id }) => runTool(() => client.request(`/chat/stop-chat-session/${chat_session_id}`, {
+        method: "POST",
+    })), {
+        readOnlyHint: false,
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: false,
+    });
+    addTool(server, "onyx_submit_feedback", "Add or update feedback for an Onyx chat message.", {
+        chat_message_id: z.number().int().positive(),
+        is_positive: z.boolean().nullable().optional(),
+        feedback_text: z.string().max(5000).optional(),
+        predefined_feedback: z.string().max(500).optional(),
+    }, (body) => runTool(() => {
+        if (body.is_positive === undefined && !body.feedback_text) {
+            throw new Error("is_positive or feedback_text is required");
+        }
+        return client.request("/chat/create-chat-message-feedback", {
+            method: "POST",
+            body,
+        });
+    }), {
+        readOnlyHint: false,
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: false,
+    });
+    if (!config.enableDestructive)
+        return;
+    addTool(server, "onyx_delete_chat", "Delete one Onyx chat session according to the deployment's retention policy.", {
+        chat_session_id: z.string().uuid(),
+        confirm: z.literal(true).describe("Must be true to confirm deletion."),
+    }, ({ chat_session_id }) => runTool(() => client.request(`/chat/delete-chat-session/${chat_session_id}`, {
+        method: "DELETE",
+    })), {
+        readOnlyHint: false,
+        destructiveHint: true,
+        idempotentHint: true,
+        openWorldHint: false,
+    });
+}

package/dist/tools/projects.d.ts

@@ -0,0 +1,2 @@
+import type { ToolContext } from "../register.js";
+export declare function registerProjectTools({ server, client, config, }: ToolContext): void;

package/dist/tools/projects.js

@@ -0,0 +1,51 @@
+import { z } from "zod";
+import { addTool } from "../register.js";
+import { runTool } from "../tool-helpers.js";
+export function registerProjectTools({ server, client, config, }) {
+    addTool(server, "onyx_list_projects", "List Onyx projects.", {}, () => runTool(() => client.request("/user/projects")), { readOnlyHint: true, idempotentHint: true, openWorldHint: false });
+    addTool(server, "onyx_get_project", "Get an Onyx project and its details.", { project_id: z.number().int().positive() }, ({ project_id }) => runTool(() => client.request(`/user/projects/${project_id}/details`)), { readOnlyHint: true, idempotentHint: true, openWorldHint: false });
+    addTool(server, "onyx_list_project_files", "List files linked to an Onyx project.", { project_id: z.number().int().positive() }, ({ project_id }) => runTool(() => client.request(`/user/projects/files/${project_id}`)), { readOnlyHint: true, idempotentHint: true, openWorldHint: false });
+    addTool(server, "onyx_get_file", "Get metadata and processing status for an Onyx user file.", { file_id: z.string().uuid() }, ({ file_id }) => runTool(() => client.request(`/user/projects/file/${encodeURIComponent(file_id)}`)), { readOnlyHint: true, idempotentHint: true, openWorldHint: false });
+    if (!config.enableWrite)
+        return;
+    addTool(server, "onyx_create_project", "Create an Onyx project.", { name: z.string().min(1).max(255) }, ({ name }) => runTool(() => client.request("/user/projects/create", {
+        method: "POST",
+        query: { name },
+    })), { readOnlyHint: false, destructiveHint: false, openWorldHint: false });
+    addTool(server, "onyx_update_project", "Update an Onyx project's name or description.", {
+        project_id: z.number().int().positive(),
+        name: z.string().min(1).max(255).optional(),
+        description: z.string().max(255).optional(),
+    }, ({ project_id, ...body }) => runTool(() => client.request(`/user/projects/${project_id}`, {
+        method: "PATCH",
+        body,
+    })), {
+        readOnlyHint: false,
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: false,
+    });
+    addTool(server, "onyx_set_project_instructions", "Set the instructions used by an Onyx project.", {
+        project_id: z.number().int().positive(),
+        instructions: z.string().max(20_000),
+    }, ({ project_id, instructions }) => runTool(() => client.request(`/user/projects/${project_id}/instructions`, {
+        method: "POST",
+        body: { instructions },
+    })), {
+        readOnlyHint: false,
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: false,
+    });
+    if (!config.enableDestructive)
+        return;
+    addTool(server, "onyx_delete_project", "Permanently delete an Onyx project. This action is destructive.", {
+        project_id: z.number().int().positive(),
+        confirm: z.literal(true),
+    }, ({ project_id }) => runTool(() => client.request(`/user/projects/${project_id}`, { method: "DELETE" })), {
+        readOnlyHint: false,
+        destructiveHint: true,
+        idempotentHint: true,
+        openWorldHint: false,
+    });
+}

package/dist/tools/raw.d.ts

@@ -0,0 +1,2 @@
+import type { ToolContext } from "../register.js";
+export declare function registerRawApiTool({ server, client, config, }: ToolContext): void;

package/dist/tools/raw.js

@@ -0,0 +1,35 @@
+import { z } from "zod";
+import { addTool } from "../register.js";
+import { rawPathSchema } from "../schemas.js";
+import { runTool } from "../tool-helpers.js";
+export function registerRawApiTool({ server, client, config, }) {
+    if (!config.enableRawApi)
+        return;
+    addTool(server, "onyx_api_request", "Call a deployment-specific Onyx API endpoint. Read requests need raw API access. Mutating requests also need the matching write, admin, and destructive profiles. Prefer a first-class tool when available.", {
+        method: z.enum(["GET", "POST", "PUT", "PATCH", "DELETE"]),
+        path: rawPathSchema,
+        query: z.record(z.unknown()).optional(),
+        body: z.unknown().optional(),
+        confirm: z.boolean().optional(),
+    }, ({ method, path, query, body, confirm }) => runTool(async () => {
+        const mutating = method !== "GET";
+        const destructive = method === "DELETE";
+        if (!config.enableAdmin) {
+            throw new Error("Raw API requests require ONYX_MCP_ENABLE_ADMIN=true");
+        }
+        if (mutating && !config.enableWrite) {
+            throw new Error("Mutating raw API requests require ONYX_MCP_ENABLE_WRITE=true");
+        }
+        if (destructive && !config.enableDestructive) {
+            throw new Error("Destructive raw API requests require ONYX_MCP_ENABLE_DESTRUCTIVE=true");
+        }
+        if (destructive && confirm !== true) {
+            throw new Error("Destructive raw API requests require confirm=true");
+        }
+        return client.request(path, {
+            method,
+            ...(query === undefined ? {} : { query }),
+            ...(body === undefined ? {} : { body }),
+        });
+    }), { readOnlyHint: false, destructiveHint: true, openWorldHint: true });
+}

package/dist/tools/search.d.ts

@@ -0,0 +1,2 @@
+import type { ToolContext } from "../register.js";
+export declare function registerSearchTools({ server, client }: ToolContext): void;

package/dist/tools/search.js

@@ -0,0 +1,49 @@
+import { z } from "zod";
+import { addTool } from "../register.js";
+import { filtersSchema, httpUrlSchema } from "../schemas.js";
+import { runTool } from "../tool-helpers.js";
+export function registerSearchTools({ server, client }) {
+    addTool(server, "onyx_search", "Search indexed Onyx knowledge with access controls enforced by Onyx.", {
+        query: z
+            .string()
+            .min(1)
+            .max(2048)
+            .describe("Search query, up to 2,048 characters."),
+        filters: filtersSchema.optional(),
+        persona_id: z.number().int().nonnegative().optional(),
+        provider: z
+            .string()
+            .optional()
+            .describe("Model provider; model is also required."),
+        model: z
+            .string()
+            .optional()
+            .describe("Model name; provider is also required."),
+        skip_query_expansion: z.boolean().optional(),
+    }, (args) => runTool(() => (() => {
+        if ((args.provider === undefined) !== (args.model === undefined)) {
+            throw new Error("provider and model must be supplied together");
+        }
+        const { query, filters, ...options } = args;
+        return client.request("/search", {
+            method: "POST",
+            body: { query, ...filters, ...options },
+        });
+    })()), { readOnlyHint: true, idempotentHint: true, openWorldHint: false });
+    addTool(server, "onyx_search_tags", "Find valid indexed tags for search filtering.", {
+        match_pattern: z.string().optional(),
+        sources: z.array(z.string()).optional(),
+        limit: z.number().int().positive().max(1000).optional(),
+    }, (args) => runTool(() => client.request("/query/valid-tags", { query: args })), { readOnlyHint: true, idempotentHint: true, openWorldHint: false });
+    addTool(server, "onyx_web_search", "Search the web through the provider configured in Onyx. This may incur provider costs.", {
+        queries: z.array(z.string().min(1)).min(1).max(20),
+        max_results: z.number().int().positive().max(100).optional(),
+    }, (body) => runTool(() => client.request("/web-search/search-lite", {
+        method: "POST",
+        body,
+    })), { readOnlyHint: true, openWorldHint: true });
+    addTool(server, "onyx_open_urls", "Fetch and extract web pages through Onyx.", { urls: z.array(httpUrlSchema).min(1).max(20) }, ({ urls }) => runTool(() => client.request("/web-search/open-urls", {
+        method: "POST",
+        body: { urls },
+    })), { readOnlyHint: true, openWorldHint: true });
+}

package/dist/tools/system.d.ts

@@ -0,0 +1,2 @@
+import type { ToolContext } from "../register.js";
+export declare function registerSystemTools({ server, client, config, }: ToolContext): void;

package/dist/tools/system.js

@@ -0,0 +1,30 @@
+import { z } from "zod";
+import { addTool } from "../register.js";
+import { runTool } from "../tool-helpers.js";
+export function registerSystemTools({ server, client, config, }) {
+    addTool(server, "onyx_health", "Check whether the Onyx API is healthy.", {}, () => runTool(() => client.request("/health")), { readOnlyHint: true, idempotentHint: true, openWorldHint: false });
+    addTool(server, "onyx_version", "Get the Onyx server version.", {}, () => runTool(() => client.request("/version")), { readOnlyHint: true, idempotentHint: true, openWorldHint: false });
+    addTool(server, "onyx_whoami", "Get the authenticated Onyx user.", {}, () => runTool(() => client.request("/me")), { readOnlyHint: true, idempotentHint: true, openWorldHint: false });
+    addTool(server, "onyx_permissions", "Get permissions granted to the authenticated Onyx user.", {}, () => runTool(() => client.request("/me/permissions")), { readOnlyHint: true, idempotentHint: true, openWorldHint: false });
+    addTool(server, "onyx_capabilities", "Show this MCP server's enabled safety profiles and default assistant.", {}, () => runTool(() => Promise.resolve({
+        write: config.enableWrite,
+        admin: config.enableAdmin,
+        destructive: config.enableDestructive,
+        rawApi: config.enableRawApi,
+        defaultPersonaId: config.defaultPersonaId,
+    })), { readOnlyHint: true, idempotentHint: true, openWorldHint: false });
+    addTool(server, "onyx_list_agents", "List Onyx agents available to the authenticated user.", {
+        page_num: z.number().int().nonnegative().optional(),
+        page_size: z.number().int().positive().max(100).optional(),
+        include_deleted: z.boolean().optional(),
+        get_editable: z.boolean().optional(),
+        include_default: z.boolean().optional(),
+    }, (args) => runTool(() => client.request("/agents", { query: args })), { readOnlyHint: true, idempotentHint: true, openWorldHint: false });
+    addTool(server, "onyx_get_agent", "Get one Onyx agent by ID.", { persona_id: z.number().int().nonnegative() }, ({ persona_id }) => runTool(() => client.request(`/persona/${persona_id}`)), { readOnlyHint: true, idempotentHint: true, openWorldHint: false });
+    addTool(server, "onyx_list_tools", "List tools configured in Onyx.", {}, () => runTool(() => client.request("/tool")), { readOnlyHint: true, idempotentHint: true, openWorldHint: false });
+    addTool(server, "onyx_list_document_sets", "List document sets visible to the authenticated user.", { editable_only: z.boolean().optional() }, ({ editable_only }) => runTool(() => client.request("/manage/document-set", {
+        query: { get_editable: editable_only },
+    })), { readOnlyHint: true, idempotentHint: true, openWorldHint: false });
+    addTool(server, "onyx_list_indexed_sources", "List source types indexed by Onyx.", {}, () => runTool(() => client.request("/manage/indexed-sources")), { readOnlyHint: true, idempotentHint: true, openWorldHint: false });
+    addTool(server, "onyx_connector_status", "Get status summaries for Onyx connectors.", {}, () => runTool(() => client.request("/manage/connector-status")), { readOnlyHint: true, idempotentHint: true, openWorldHint: false });
+}

package/dist/version.d.ts

@@ -0,0 +1 @@
+export declare const VERSION = "0.1.0";

package/dist/version.js

@@ -0,0 +1,2 @@
+// Generated from package.json by scripts/sync-version.mjs.
+export const VERSION = "0.1.0";

package/package.json

@@ -0,0 +1,83 @@
+{
+  "name": "@bywaleed/onyx-mcp",
+  "mcpName": "io.github.bywaleed/onyx-mcp",
+  "version": "0.1.0",
+  "description": "A comprehensive, secure Model Context Protocol server for Onyx.",
+  "type": "module",
+  "main": "dist/server.js",
+  "types": "dist/server.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/server.d.ts",
+      "import": "./dist/server.js"
+    }
+  },
+  "bin": {
+    "onyx-mcp": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "SECURITY.md",
+    "server.json"
+  ],
+  "scripts": {
+    "clean": "rm -rf dist",
+    "version:sync": "node scripts/sync-version.mjs",
+    "build": "npm run version:sync && npm run clean && tsc -p tsconfig.json",
+    "check": "tsc -p tsconfig.json --noEmit",
+    "dev": "tsx src/cli.ts",
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
+    "lint": "eslint .",
+    "start": "node dist/cli.js",
+    "test": "vitest run",
+    "test:coverage": "vitest run --coverage",
+    "test:watch": "vitest",
+    "verify": "npm run version:sync && npm run format:check && npm run lint && npm run check && npm test && npm run build",
+    "prepack": "npm run verify"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "keywords": [
+    "onyx",
+    "danswer",
+    "mcp",
+    "model-context-protocol",
+    "enterprise-search",
+    "rag"
+  ],
+  "author": "Waleed Islam",
+  "license": "MIT",
+  "packageManager": "npm@11.6.2",
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ByWaleed/onyx-mcp.git"
+  },
+  "bugs": {
+    "url": "https://github.com/ByWaleed/onyx-mcp/issues"
+  },
+  "homepage": "https://github.com/ByWaleed/onyx-mcp#readme",
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.30.0",
+    "zod": "^3.25.76"
+  },
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "@types/node": "^22.15.3",
+    "@vitest/coverage-v8": "^3.2.7",
+    "eslint": "^10.0.0",
+    "globals": "^16.3.0",
+    "prettier": "^3.6.2",
+    "tsx": "^4.19.4",
+    "typescript": "^5.8.3",
+    "typescript-eslint": "^8.68.0",
+    "vitest": "^3.1.2"
+  }
+}

package/server.json

@@ -0,0 +1,43 @@
+{
+  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
+  "name": "io.github.bywaleed/onyx-mcp",
+  "title": "Onyx MCP",
+  "description": "Secure MCP access to Onyx search, chat, projects, and administration.",
+  "version": "0.1.0",
+  "websiteUrl": "https://github.com/ByWaleed/onyx-mcp",
+  "repository": {
+    "url": "https://github.com/ByWaleed/onyx-mcp",
+    "source": "github",
+    "id": "1351600077"
+  },
+  "packages": [
+    {
+      "registryType": "npm",
+      "registryBaseUrl": "https://registry.npmjs.org",
+      "identifier": "@bywaleed/onyx-mcp",
+      "version": "0.1.0",
+      "runtimeHint": "npx",
+      "transport": {
+        "type": "stdio"
+      },
+      "environmentVariables": [
+        {
+          "name": "ONYX_API_URL",
+          "description": "Onyx API base URL, for example https://onyx.example.com/api",
+          "isRequired": true
+        },
+        {
+          "name": "ONYX_API_TOKEN",
+          "description": "Onyx Personal Access Token or API key",
+          "isRequired": true,
+          "isSecret": true
+        },
+        {
+          "name": "ONYX_DEFAULT_PERSONA_ID",
+          "description": "Default Onyx agent ID for new chats",
+          "default": "0"
+        }
+      ]
+    }
+  ]
+}