@capxul/mcp 3.2.0 → 4.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/README.md +51 -14
  2. package/dist/main.mjs +1506 -569
  3. package/package.json +6 -3
package/README.md CHANGED
@@ -5,8 +5,9 @@ resource server in front of the Capxul SDK: the person signs in on the Capxul
5
5
  login page, the agent presents the access token, and the server turns that token
6
6
  into an SDK client for one request.
7
7
 
8
- The artifact is a CLI, not an importable library. Protocol revision
9
- **2026-07-28** only.
8
+ The artifact is a CLI, not an importable library. HTTP supports the primary
9
+ **2026-07-28** revision and stateless **2025-06-18** compatibility for Codex.
10
+ Stdio supports **2026-07-28** only.
10
11
 
11
12
  ## Run
12
13
 
@@ -30,16 +31,31 @@ stderr.
30
31
 
31
32
  ## Tools
32
33
 
33
- | Tool | Scope | What it does |
34
- | --------------------------- | --------------- | ----------------------------------------------------------------- |
35
- | `system.ping` | public | Echo an optional value. Proves the transport only. |
36
- | `system.health` | public | Round-trip a nonce through the backend. |
37
- | `onboarding.completePerson` | `account:write` | Claim a unique username, complete the Profile, and ready Account. |
38
- | `me.get` | `account:read` | Read the signed-in person's profile. |
39
- | `account.status` | `account:read` | Where the account is on the readiness ladder. |
40
- | `account.balance` | `account:read` | Balance and available balance. |
41
-
42
- Prompts, resources, and the money tools arrive in MCP step 2.
34
+ | Tool | Scope | What it does |
35
+ | --------------------------------- | --------------- | --------------------------------------------------------------- |
36
+ | `system.ping` | public | Echo an optional value. Proves the transport only. |
37
+ | `system.health` | public | Round-trip a nonce through the backend. |
38
+ | `onboarding.completePerson` | `account:write` | Claim a unique handle, complete the Profile, and ready Account. |
39
+ | `onboarding.completeOrganization` | `org:manage` | Claim the Account, then create or resume an Organization. |
40
+ | `me.get` | `account:read` | Read the signed-in person's profile. |
41
+ | `account.status` | `account:read` | Where the account is on the readiness ladder. |
42
+ | `account.balance` | `account:read` | Balance and available balance. |
43
+ | `org.list` | `org:manage` | List accessible Organizations. |
44
+ | `org.roles` | `org:manage` | List valid invitation role labels. |
45
+ | `org.members` | `org:manage` | Read member lifecycle states. |
46
+ | `org.invite` | `org:manage` | Invite one Person by email and role. |
47
+ | `org.acceptInvitations` | `org:manage` | Accept invitations for the signed-in email. |
48
+ | `org.activateMember` | `org:manage` | Submit the verified role grant for a ready member Account. |
49
+
50
+ Prompts, resources, and the money tools arrive in a later slice.
51
+
52
+ When `POSTHOG_PROJECT_TOKEN` is set, PostHog MCP Analytics adds two fields to
53
+ every tool schema. `context` is required. The server converts it to a safe
54
+ journey category before capture. `conversation_id` is optional. The server
55
+ creates it on the first call, and the agent must return it on later calls to
56
+ keep one conversation together. The server identifies authenticated events
57
+ with the Capxul auth user ID. It drops tool payloads, email, raw errors, and
58
+ exception events before capture.
43
59
 
44
60
  ## Connect
45
61
 
@@ -52,6 +68,15 @@ the Capxul authorization server, and runs the OAuth flow. The person signs in
52
68
  once and consents to the scopes; the agent presents the token after that. Call
53
69
  `system.ping` first — it needs no token. A new Person must call
54
70
  `onboarding.completePerson` before Organization or money journeys.
71
+ `onboarding.completeOrganization` needs a signer. The explicit dev mode can
72
+ exercise this path. The hosted live service fails closed until the browser
73
+ approval handoff lands.
74
+
75
+ The staff journey is `org.roles` → `org.invite` → invitee Person onboarding →
76
+ `org.acceptInvitations` → founder `org.activateMember` → poll `org.members`
77
+ until `active`. The invitee supplies their ready `accountId` from
78
+ `account.status`. Activation uses the existing verified Permission execution
79
+ and needs the founder signer. The other staff tools do not sign.
55
80
 
56
81
  ## Environment
57
82
 
@@ -63,6 +88,8 @@ once and consents to the scopes; the agent presents the token after that. Call
63
88
  | `CAPXUL_MCP_ACCESS_TOKEN` | Stdio only: the bearer for every request. |
64
89
  | `CAPXUL_MCP_HOST` | Bind interface. Defaults to `127.0.0.1`. |
65
90
  | `CAPXUL_MCP_PORT` | Default port when `--port` is absent. |
91
+ | `POSTHOG_PROJECT_TOKEN` | Enables PostHog MCP Analytics. |
92
+ | `POSTHOG_HOST` | PostHog ingest host. Defaults to `https://us.i.posthog.com`. |
66
93
 
67
94
  Every name is read lazily, so `system.ping` runs on a machine that holds no
68
95
  secret and a missing slot surfaces as a structured error naming the variable.
@@ -82,9 +109,19 @@ packed-install smoke; [#922](https://github.com/Xelmar-tech/infrastructure/issue
82
109
  owns that gap.
83
110
 
84
111
  A live staging run in #1812 proves browser login, `account:write` consent,
85
- Person onboarding, a ready Account, OAuth scope step-up, and all six tools. A
112
+ Person onboarding, a ready Account, OAuth scope step-up, and the Account tools. A
86
113
  second fresh Person received `INVALID_INPUT` when it requested the first
87
- Person's username. The proof does not include an MCP money write.
114
+ Person's handle. A signed staging run also created a ready Organization and
115
+ confirmed its Base Sepolia transaction. The proof does not include an MCP money
116
+ write. The hermetic MCP Analytics proof verifies identity, intent, and an
117
+ echoed conversation across two stateless requests. The staging analytics
118
+ receipt must pass before this slice is released.
119
+
120
+ The three-phase staging staff harness also proves two isolated People, a ready
121
+ Organization, invitation, staff Account onboarding, invitation acceptance,
122
+ verified Permission assignment, and final active membership. The Base Sepolia
123
+ assignment transaction is
124
+ [`0x7e717946…48766d`](https://sepolia.basescan.org/tx/0x7e717946f87dac1345d9487806e5856d85a0f08e15fb11072af0c2311548766d).
88
125
 
89
126
  Read [CONTEXT.md](./CONTEXT.md) before adding a tool or changing the
90
127
  authorization gate, the scope grammar, the wire shapes, or the proof boundary.