@casys/mcp-erpnext 2.4.0 → 2.4.2

package/README.md

@@ -6,7 +6,7 @@
 [![MCP](https://img.shields.io/badge/MCP-server-1f6feb?logo=modelcontextprotocol&logoColor=white)](https://modelcontextprotocol.io)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 
-MCP server for [ERPNext](https://erpnext.com) / Frappe ERP — **122 tools**
+MCP server for [ERPNext](https://erpnext.com) / Frappe ERP — **123 tools**
 across **14 categories**, with **7 interactive UI viewers**.
 
 Connect any MCP-compatible AI agent (Claude Desktop, Claude Code, VS Code
@@ -151,6 +151,21 @@ ERPNEXT_API_SECRET=xxx \
 npx -y @casys/mcp-erpnext --http --port=3012
 ```
 
+### Deno (HTTP mode)
+
+```bash
+ERPNEXT_URL=http://localhost:8000 \
+ERPNEXT_API_KEY=xxx \
+ERPNEXT_API_SECRET=xxx \
+deno run -A npm:@casys/mcp-erpnext --http --port=3012
+```
+
+> **Note:** Versions ≤ 2.3.1 of the npm bundle crashed with
+> `ReferenceError: Deno is not defined` in HTTP mode — fixed in 2.4.0
+> (`@casys/mcp-server` ≥ 0.21.1). If you hit this error, upgrade with
+> `npx -y @casys/mcp-erpnext@latest`, or use the Deno runner above. See
+> [`docs/known-issues.md`](docs/known-issues.md).
+
 ### Category filtering
 
 Load only the categories you need:
@@ -220,7 +235,7 @@ npm install
 node build-all.mjs
 ```
 
-## Tools (122)
+## Tools (123)
 
 **14 categories** covering the full ERPNext surface. Each `_list` tool returns
 interactive results in the doclist-viewer with row click, inline detail, and
@@ -238,7 +253,7 @@ cross-viewer navigation.
 | **Manufacturing** | 7     | doclist              | BOMs, Work Orders, Job Cards                                           |
 | **CRM**           | 8     | doclist              | Leads, Opportunities, Contacts, Campaigns                              |
 | **Assets**        | 8     | doclist              | Assets, Movements, Maintenance, Categories                             |
-| **Operations**    | 8     | doclist              | Generic CRUD + native assignment for **any** DocType (`erpnext_doc_*`) |
+| **Operations**    | 9     | doclist              | Generic CRUD + native assignment for **any** DocType (`erpnext_doc_*`) |
 | **Kanban**        | 2     | kanban               | Task/Opportunity/Issue boards with drag-and-drop                       |
 | **Analytics**     | 17    | chart / kpi / funnel | 12 chart types, 5 KPIs, sales funnel                                   |
 | **Setup**         | 3     | —                    | Company creation, assignable user listing                              |

package/mcp-erpnext.mjs

@@ -3775,6 +3775,7 @@ var require_fast_uri = __commonJS({
       return uriTokens.join("");
     }
     var URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u;
+    var AUTHORITY_PREFIX = /^(?:[^#/:?]+:)?\/\/([^/?#]*)/;
     function getParseError(parsed, matches) {
       if (matches[2] !== void 0 && parsed.path && parsed.path[0] !== "/") {
         return 'URI path must start with "/" when authority is present.';
@@ -3804,6 +3805,11 @@ var require_fast_uri = __commonJS({
           uri = "//" + uri;
         }
       }
+      const authorityMatch = uri.match(AUTHORITY_PREFIX);
+      if (authorityMatch !== null && authorityMatch[1].indexOf("\\") !== -1) {
+        parsed.error = "URI authority must not contain a literal backslash.";
+        malformedAuthorityOrPort = true;
+      }
       const matches = uri.match(URI_PARSE);
       if (matches) {
         parsed.scheme = matches[1];
@@ -29680,6 +29686,12 @@ var parseBody = async (request, options = /* @__PURE__ */ Object.create(null)) =
   return {};
 };
 async function parseFormData(request, options) {
+  if (!isRawRequest(request) && request.bodyCache.formData) {
+    return convertFormDataToBodyData(
+      await request.bodyCache.formData,
+      options
+    );
+  }
   const headers = isRawRequest(request) ? request.headers : request.raw.headers;
   const arrayBuffer = await request.arrayBuffer();
   const formDataPromise = bufferToFormData(arrayBuffer, headers.get("Content-Type") || "");
@@ -39517,6 +39529,7 @@ var hrTools = [
 
 // src/tools/assignment.ts
 var ASSIGNMENT_METHOD = "frappe.desk.form.assign_to.add";
+var UNASSIGNMENT_METHOD = "frappe.desk.form.assign_to.remove";
 var MAX_ASSIGNEES_PER_CALL = 50;
 var ASSIGNMENT_INPUT_PROPERTIES = {
   assign_to: {
@@ -39640,13 +39653,31 @@ async function applyAssignment(doctype, name, assignment, ctx, failureContext) {
   }) : [];
   return { notify_user: true, assignees: assignment.assignees, todos };
 }
-async function fetchDocAfterAssignment(doctype, name, ctx, toolName) {
+async function removeAssignment(doctype, name, assignee, ctx, failureContext) {
+  let nativeResult;
+  try {
+    nativeResult = await ctx.client.callMethod(UNASSIGNMENT_METHOD, {
+      doctype,
+      name,
+      assign_to: assignee
+    });
+  } catch (error2) {
+    const reason = error2 instanceof Error ? error2.message : String(error2);
+    throw new Error(`${failureContext}: ${reason}`, { cause: error2 });
+  }
+  const todos = Array.isArray(nativeResult) ? nativeResult.map((todo) => {
+    const record2 = todo;
+    return { owner: record2.owner, name: record2.name };
+  }) : [];
+  return { removed: assignee, remaining: todos };
+}
+async function fetchDocAfterAssignment(doctype, name, ctx, toolName, action = "assignment") {
   try {
     return await ctx.client.get(doctype, name);
   } catch (error2) {
     const reason = error2 instanceof Error ? error2.message : String(error2);
     throw new Error(
-      `[${toolName}] ${doctype} ${name} assignment succeeded, but re-fetching the document failed: ${reason}`,
+      `[${toolName}] ${doctype} ${name} ${action} succeeded, but re-fetching the document failed: ${reason}`,
       { cause: error2 }
     );
   }
@@ -42168,6 +42199,66 @@ var operationsTools = [
         assignment: assignmentInfo
       };
     }
+  },
+  // ── Generic Unassign ──────────────────────────────────────────────────────
+  {
+    name: "erpnext_doc_unassign",
+    description: "Remove one user's assignment from any ERPNext document through Frappe's native workflow (closes the user's ToDo and resyncs _assign). Works on any DocType. Pass one user per call. Idempotent: removing a user who is not assigned is a no-op on the Frappe side.",
+    category: "operations",
+    inputSchema: {
+      type: "object",
+      properties: {
+        doctype: {
+          type: "string",
+          description: "ERPNext DocType name (e.g. 'Task', 'Issue', 'Opportunity')"
+        },
+        name: {
+          type: "string",
+          description: "Document name/ID (e.g. 'TASK-2026-00001')"
+        },
+        assign_to: {
+          type: "string",
+          description: "User email whose assignment should be removed",
+          minLength: 1
+        }
+      },
+      required: ["doctype", "name", "assign_to"]
+    },
+    handler: async (input, ctx) => {
+      if (!input.doctype) {
+        throw new Error("[erpnext_doc_unassign] 'doctype' is required");
+      }
+      if (!input.name) {
+        throw new Error("[erpnext_doc_unassign] 'name' is required");
+      }
+      if (typeof input.assign_to !== "string" || !input.assign_to.trim()) {
+        throw new Error(
+          "[erpnext_doc_unassign] 'assign_to' must be a non-empty user email"
+        );
+      }
+      const doctype = input.doctype;
+      const name = input.name;
+      const assignee = input.assign_to.trim();
+      const unassignment = await removeAssignment(
+        doctype,
+        name,
+        assignee,
+        ctx,
+        `[erpnext_doc_unassign] ${doctype} ${name} unassignment failed`
+      );
+      const doc = await fetchDocAfterAssignment(
+        doctype,
+        name,
+        ctx,
+        "erpnext_doc_unassign",
+        "unassignment"
+      );
+      return {
+        data: doc,
+        message: `${assignee} unassigned from ${doctype} ${name}`,
+        assignment: unassignment
+      };
+    }
   }
 ];
 
@@ -45259,13 +45350,13 @@ async function main() {
   const portArg = args.find((arg) => arg.startsWith("--port="));
   const httpPort = portArg ? parseInt(portArg.split("=")[1], 10) : DEFAULT_HTTP_PORT;
   const hostnameArg = args.find((arg) => arg.startsWith("--hostname="));
-  const hostname = hostnameArg ? hostnameArg.split("=")[1] : "0.0.0.0";
+  const hostname = hostnameArg ? hostnameArg.split("=")[1] : "127.0.0.1";
   const toolsClient = new ErpNextToolsClient(
     categories ? { categories } : void 0
   );
   const server = new McpApp({
     name: "mcp-erpnext",
-    version: "2.4.0",
+    version: "2.4.2",
     maxConcurrent: 10,
     backpressureStrategy: "queue",
     validateSchema: true,
@@ -45311,6 +45402,12 @@ async function main() {
     `[mcp-erpnext] Initialized \u2014 ${toolsClient.count} tools${categories ? ` (categories: ${categories.join(", ")})` : ""}`
   );
   if (httpFlag) {
+    const isLoopback = hostname === "127.0.0.1" || hostname === "::1" || hostname === "localhost";
+    if (!isLoopback) {
+      console.error(
+        `[mcp-erpnext] WARNING: binding to ${hostname} exposes the HTTP server to the network. Every tool acts with the server's ERPNext API key, so restrict access (firewall, private network, or an authenticating reverse proxy).`
+      );
+    }
     await server.startHttp({
       port: httpPort,
       hostname,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@casys/mcp-erpnext",
-  "version": "2.4.0",
+  "version": "2.4.2",
   "description": "MCP server for ERPNext with interactive UI viewers",
   "type": "module",
   "bin": {