@centrali-io/centrali-mcp 4.2.6 → 4.2.8

package/dist/tools/compute.js

@@ -155,11 +155,22 @@ function registerComputeTools(server, sdk) {
     }));
     server.tool("create_function", "Create a new compute function. Compute functions are JavaScript code blocks that run server-side.", {
         name: zod_1.z.string().describe("Display name for the function"),
-        code: zod_1.z.string().describe("JavaScript source code. Must export an async function: module.exports = async (ctx) => { ... }"),
+        code: zod_1.z.string().describe("JavaScript source code. Must define 'async function run() { ... }'. Globals: api, triggerParams, executionParams. Do NOT use module.exports."),
         description: zod_1.z.string().optional().describe("Optional description of what the function does"),
-        timeoutMs: zod_1.z.number().optional().describe("Execution timeout in milliseconds (default: 30000, min: 1000, max: 300000)"),
+        timeoutMs: zod_1.z.number().optional().describe("Execution timeout in milliseconds (default: 30000, max: 300000 / 5 minutes)"),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ name, code, description, timeoutMs }) {
         try {
+            if (/module\.exports\s*=/.test(code)) {
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: "Error: Do not use module.exports. Functions must define 'async function run() { ... }'. Globals available: api, triggerParams, executionParams.",
+                        },
+                    ],
+                    isError: true,
+                };
+            }
             const input = { name, code };
             if (description !== undefined)
                 input.description = description;
@@ -188,10 +199,21 @@ function registerComputeTools(server, sdk) {
         functionId: zod_1.z.string().describe("The compute function ID (UUID) to update"),
         name: zod_1.z.string().optional().describe("Updated display name"),
         description: zod_1.z.string().optional().describe("Updated description"),
-        code: zod_1.z.string().optional().describe("Updated JavaScript source code"),
-        timeoutMs: zod_1.z.number().optional().describe("Updated execution timeout in milliseconds (min: 1000, max: 300000)"),
+        code: zod_1.z.string().optional().describe("Updated JavaScript source code. Must define 'async function run() { ... }'. Do NOT use module.exports."),
+        timeoutMs: zod_1.z.number().optional().describe("Updated execution timeout in milliseconds (max: 300000 / 5 minutes)"),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ functionId, name, description, code, timeoutMs }) {
         try {
+            if (code && /module\.exports\s*=/.test(code)) {
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: "Error: Do not use module.exports. Functions must define 'async function run() { ... }'. Globals available: api, triggerParams, executionParams.",
+                        },
+                    ],
+                    isError: true,
+                };
+            }
             const input = {};
             if (name !== undefined)
                 input.name = name;
@@ -247,14 +269,25 @@ function registerComputeTools(server, sdk) {
         }
     }));
     server.tool("test_function", "Test execute code without saving it as a function. Useful for validating function code before creating or updating.", {
-        code: zod_1.z.string().describe("JavaScript code to test. Must export an async function: module.exports = async (ctx) => { ... }"),
+        code: zod_1.z.string().describe("JavaScript code to test. Must define 'async function run() { ... }'. Globals: api, triggerParams, executionParams. Do NOT use module.exports."),
         params: zod_1.z
             .record(zod_1.z.string(), zod_1.z.any())
             .optional()
             .describe("Optional parameters passed to the function as executionParams"),
-        timeoutMs: zod_1.z.number().optional().describe("Execution timeout in milliseconds (default: 30000, min: 1000, max: 300000)"),
+        timeoutMs: zod_1.z.number().optional().describe("Execution timeout in milliseconds (default: 30000, max: 300000 / 5 minutes)"),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ code, params, timeoutMs }) {
         try {
+            if (/module\.exports\s*=/.test(code)) {
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: "Error: Do not use module.exports. Functions must define 'async function run() { ... }'. Globals available: api, triggerParams, executionParams.",
+                        },
+                    ],
+                    isError: true,
+                };
+            }
             const testInput = { code };
             if (params !== undefined)
                 testInput.params = params;
@@ -454,4 +487,75 @@ function registerComputeTools(server, sdk) {
             };
         }
     }));
+    // ── Allowed Domains tools ──────────────────────────────────────────
+    server.tool("list_allowed_domains", "List all allowed domains for compute function HTTP requests. Functions can only call external APIs on domains in this allowlist.", {}, () => __awaiter(this, void 0, void 0, function* () {
+        try {
+            const result = yield sdk.allowedDomains.list();
+            return {
+                content: [
+                    { type: "text", text: JSON.stringify(result.data, null, 2) },
+                ],
+            };
+        }
+        catch (error) {
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: formatError(error, "listing allowed domains"),
+                    },
+                ],
+                isError: true,
+            };
+        }
+    }));
+    server.tool("add_allowed_domain", "Add a domain to the allowlist so compute functions can make HTTP requests to it. Supports wildcards (e.g., '*.example.com').", {
+        domain: zod_1.z.string().describe("Domain to allow (e.g., 'api.stripe.com' or '*.googleapis.com')"),
+    }, (_a) => __awaiter(this, [_a], void 0, function* ({ domain }) {
+        try {
+            const result = yield sdk.allowedDomains.add({ domain });
+            return {
+                content: [
+                    { type: "text", text: JSON.stringify(result.data, null, 2) },
+                ],
+            };
+        }
+        catch (error) {
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: formatError(error, `adding allowed domain '${domain}'`),
+                    },
+                ],
+                isError: true,
+            };
+        }
+    }));
+    server.tool("remove_allowed_domain", "Remove a domain from the allowlist. Compute functions will no longer be able to call this domain.", {
+        domainId: zod_1.z.string().describe("The allowed domain ID (UUID) to remove"),
+    }, (_a) => __awaiter(this, [_a], void 0, function* ({ domainId }) {
+        try {
+            yield sdk.allowedDomains.remove(domainId);
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: `Allowed domain '${domainId}' removed successfully.`,
+                    },
+                ],
+            };
+        }
+        catch (error) {
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: formatError(error, `removing allowed domain '${domainId}'`),
+                    },
+                ],
+                isError: true,
+            };
+        }
+    }));
 }

package/dist/tools/describe.js

@@ -62,7 +62,7 @@ function registerDescribeTools(server) {
                                 tools: ["search_records"],
                             },
                             compute: {
-                                summary: "Server-side JavaScript functions with triggers (on-demand, event-driven, scheduled, http-trigger).",
+                                summary: "Server-side JavaScript functions with triggers (on-demand, event-driven, scheduled, http-trigger) and domain allowlisting for external API calls.",
                                 describeWith: "describe_compute",
                                 tools: [
                                     "list_functions",
@@ -79,6 +79,9 @@ function registerDescribeTools(server) {
                                     "invoke_trigger",
                                     "pause_trigger",
                                     "resume_trigger",
+                                    "list_allowed_domains",
+                                    "add_allowed_domain",
+                                    "remove_allowed_domain",
                                 ],
                             },
                             smart_queries: {
@@ -429,7 +432,7 @@ function registerDescribeTools(server) {
                                 description: "Create a new compute function",
                                 required_params: ["name", "code"],
                                 optional_params: ["description", "timeoutMs"],
-                                code_format: "module.exports = async (ctx) => { /* your code */ return result; }",
+                                code_format: "async function run() { /* api, triggerParams, executionParams are globals */ return result; }",
                             },
                             update_function: {
                                 description: "Update an existing function. Partial updates supported.",
@@ -478,6 +481,30 @@ function registerDescribeTools(server) {
                                 required_params: ["triggerId"],
                             },
                         },
+                        allowed_domains: {
+                            description: "Workspace-level allowlist controlling which external domains compute functions can call via api.httpGet/httpPost/etc. Functions attempting to reach unlisted domains get an error.",
+                            domain_shape: {
+                                id: "UUID",
+                                domain: "string — the allowed domain (e.g., 'api.stripe.com' or '*.googleapis.com')",
+                                createdAt: "ISO 8601 datetime",
+                                createdBy: "UUID",
+                            },
+                            tools: {
+                                list_allowed_domains: {
+                                    description: "List all allowed domains in the workspace",
+                                },
+                                add_allowed_domain: {
+                                    description: "Add a domain to the allowlist",
+                                    required_params: ["domain"],
+                                },
+                                remove_allowed_domain: {
+                                    description: "Remove a domain from the allowlist by ID",
+                                    required_params: ["domainId"],
+                                },
+                            },
+                            wildcards: "Use '*.example.com' to allow all subdomains of example.com",
+                            note: "Functions can only make HTTP requests to domains on this list. Add domains before creating functions that call external APIs.",
+                        },
                         sandbox_api: {
                             description: "Functions receive an `api` object with built-in utilities. Key crypto methods:",
                             crypto: {
@@ -497,6 +524,7 @@ function registerDescribeTools(server) {
                             "Use test_function to validate code before creating or updating a function",
                             "Use create_function + create_trigger together to set up a complete compute pipeline",
                             "Use api.crypto.signJwt() for GitHub App, Google Cloud, or Azure AD authentication flows",
+                            "Before creating functions that call external APIs, add the target domains with add_allowed_domain",
                         ],
                     }, null, 2),
                 },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@centrali-io/centrali-mcp",
-  "version": "4.2.6",
+  "version": "4.2.8",
   "description": "Centrali MCP Server - AI assistant integration for Centrali workspaces",
   "main": "dist/index.js",
   "type": "commonjs",

package/src/tools/compute.ts

@@ -174,12 +174,24 @@ export function registerComputeTools(server: McpServer, sdk: CentraliSDK) {
     "Create a new compute function. Compute functions are JavaScript code blocks that run server-side.",
     {
       name: z.string().describe("Display name for the function"),
-      code: z.string().describe("JavaScript source code. Must export an async function: module.exports = async (ctx) => { ... }"),
+      code: z.string().describe("JavaScript source code. Must define 'async function run() { ... }'. Globals: api, triggerParams, executionParams. Do NOT use module.exports."),
       description: z.string().optional().describe("Optional description of what the function does"),
-      timeoutMs: z.number().optional().describe("Execution timeout in milliseconds (default: 30000, min: 1000, max: 300000)"),
+      timeoutMs: z.number().optional().describe("Execution timeout in milliseconds (default: 30000, max: 300000 / 5 minutes)"),
     },
     async ({ name, code, description, timeoutMs }) => {
       try {
+        if (/module\.exports\s*=/.test(code)) {
+          return {
+            content: [
+              {
+                type: "text",
+                text: "Error: Do not use module.exports. Functions must define 'async function run() { ... }'. Globals available: api, triggerParams, executionParams.",
+              },
+            ],
+            isError: true,
+          };
+        }
+
         const input: Record<string, any> = { name, code };
         if (description !== undefined) input.description = description;
         if (timeoutMs !== undefined) input.timeoutMs = timeoutMs;
@@ -211,11 +223,23 @@ export function registerComputeTools(server: McpServer, sdk: CentraliSDK) {
       functionId: z.string().describe("The compute function ID (UUID) to update"),
       name: z.string().optional().describe("Updated display name"),
       description: z.string().optional().describe("Updated description"),
-      code: z.string().optional().describe("Updated JavaScript source code"),
-      timeoutMs: z.number().optional().describe("Updated execution timeout in milliseconds (min: 1000, max: 300000)"),
+      code: z.string().optional().describe("Updated JavaScript source code. Must define 'async function run() { ... }'. Do NOT use module.exports."),
+      timeoutMs: z.number().optional().describe("Updated execution timeout in milliseconds (max: 300000 / 5 minutes)"),
     },
     async ({ functionId, name, description, code, timeoutMs }) => {
       try {
+        if (code && /module\.exports\s*=/.test(code)) {
+          return {
+            content: [
+              {
+                type: "text",
+                text: "Error: Do not use module.exports. Functions must define 'async function run() { ... }'. Globals available: api, triggerParams, executionParams.",
+              },
+            ],
+            isError: true,
+          };
+        }
+
         const input: Record<string, any> = {};
         if (name !== undefined) input.name = name;
         if (description !== undefined) input.description = description;
@@ -277,15 +301,27 @@ export function registerComputeTools(server: McpServer, sdk: CentraliSDK) {
     "test_function",
     "Test execute code without saving it as a function. Useful for validating function code before creating or updating.",
     {
-      code: z.string().describe("JavaScript code to test. Must export an async function: module.exports = async (ctx) => { ... }"),
+      code: z.string().describe("JavaScript code to test. Must define 'async function run() { ... }'. Globals: api, triggerParams, executionParams. Do NOT use module.exports."),
       params: z
         .record(z.string(), z.any())
         .optional()
         .describe("Optional parameters passed to the function as executionParams"),
-      timeoutMs: z.number().optional().describe("Execution timeout in milliseconds (default: 30000, min: 1000, max: 300000)"),
+      timeoutMs: z.number().optional().describe("Execution timeout in milliseconds (default: 30000, max: 300000 / 5 minutes)"),
     },
     async ({ code, params, timeoutMs }) => {
       try {
+        if (/module\.exports\s*=/.test(code)) {
+          return {
+            content: [
+              {
+                type: "text",
+                text: "Error: Do not use module.exports. Functions must define 'async function run() { ... }'. Globals available: api, triggerParams, executionParams.",
+              },
+            ],
+            isError: true,
+          };
+        }
+
         const testInput: Record<string, any> = { code };
         if (params !== undefined) testInput.params = params;
         if (timeoutMs !== undefined) testInput.timeoutMs = timeoutMs;
@@ -510,4 +546,91 @@ export function registerComputeTools(server: McpServer, sdk: CentraliSDK) {
       }
     }
   );
+
+  // ── Allowed Domains tools ──────────────────────────────────────────
+
+  server.tool(
+    "list_allowed_domains",
+    "List all allowed domains for compute function HTTP requests. Functions can only call external APIs on domains in this allowlist.",
+    {},
+    async () => {
+      try {
+        const result = await sdk.allowedDomains.list();
+        return {
+          content: [
+            { type: "text", text: JSON.stringify(result.data, null, 2) },
+          ],
+        };
+      } catch (error: unknown) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: formatError(error, "listing allowed domains"),
+            },
+          ],
+          isError: true,
+        };
+      }
+    }
+  );
+
+  server.tool(
+    "add_allowed_domain",
+    "Add a domain to the allowlist so compute functions can make HTTP requests to it. Supports wildcards (e.g., '*.example.com').",
+    {
+      domain: z.string().describe("Domain to allow (e.g., 'api.stripe.com' or '*.googleapis.com')"),
+    },
+    async ({ domain }) => {
+      try {
+        const result = await sdk.allowedDomains.add({ domain });
+        return {
+          content: [
+            { type: "text", text: JSON.stringify(result.data, null, 2) },
+          ],
+        };
+      } catch (error: unknown) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: formatError(error, `adding allowed domain '${domain}'`),
+            },
+          ],
+          isError: true,
+        };
+      }
+    }
+  );
+
+  server.tool(
+    "remove_allowed_domain",
+    "Remove a domain from the allowlist. Compute functions will no longer be able to call this domain.",
+    {
+      domainId: z.string().describe("The allowed domain ID (UUID) to remove"),
+    },
+    async ({ domainId }) => {
+      try {
+        await sdk.allowedDomains.remove(domainId);
+        return {
+          content: [
+            {
+              type: "text",
+              text: `Allowed domain '${domainId}' removed successfully.`,
+            },
+          ],
+        };
+      } catch (error: unknown) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: formatError(error, `removing allowed domain '${domainId}'`),
+            },
+          ],
+          isError: true,
+        };
+      }
+    }
+  );
 }

package/src/tools/describe.ts

@@ -62,7 +62,7 @@ export function registerDescribeTools(server: McpServer) {
                 },
                 compute: {
                   summary:
-                    "Server-side JavaScript functions with triggers (on-demand, event-driven, scheduled, http-trigger).",
+                    "Server-side JavaScript functions with triggers (on-demand, event-driven, scheduled, http-trigger) and domain allowlisting for external API calls.",
                   describeWith: "describe_compute",
                   tools: [
                     "list_functions",
@@ -79,6 +79,9 @@ export function registerDescribeTools(server: McpServer) {
                     "invoke_trigger",
                     "pause_trigger",
                     "resume_trigger",
+                    "list_allowed_domains",
+                    "add_allowed_domain",
+                    "remove_allowed_domain",
                   ],
                 },
                 smart_queries: {
@@ -499,7 +502,7 @@ export function registerDescribeTools(server: McpServer) {
                   description: "Create a new compute function",
                   required_params: ["name", "code"],
                   optional_params: ["description", "timeoutMs"],
-                  code_format: "module.exports = async (ctx) => { /* your code */ return result; }",
+                  code_format: "async function run() { /* api, triggerParams, executionParams are globals */ return result; }",
                 },
                 update_function: {
                   description: "Update an existing function. Partial updates supported.",
@@ -548,6 +551,30 @@ export function registerDescribeTools(server: McpServer) {
                   required_params: ["triggerId"],
                 },
               },
+              allowed_domains: {
+                description: "Workspace-level allowlist controlling which external domains compute functions can call via api.httpGet/httpPost/etc. Functions attempting to reach unlisted domains get an error.",
+                domain_shape: {
+                  id: "UUID",
+                  domain: "string — the allowed domain (e.g., 'api.stripe.com' or '*.googleapis.com')",
+                  createdAt: "ISO 8601 datetime",
+                  createdBy: "UUID",
+                },
+                tools: {
+                  list_allowed_domains: {
+                    description: "List all allowed domains in the workspace",
+                  },
+                  add_allowed_domain: {
+                    description: "Add a domain to the allowlist",
+                    required_params: ["domain"],
+                  },
+                  remove_allowed_domain: {
+                    description: "Remove a domain from the allowlist by ID",
+                    required_params: ["domainId"],
+                  },
+                },
+                wildcards: "Use '*.example.com' to allow all subdomains of example.com",
+                note: "Functions can only make HTTP requests to domains on this list. Add domains before creating functions that call external APIs.",
+              },
               sandbox_api: {
                 description: "Functions receive an `api` object with built-in utilities. Key crypto methods:",
                 crypto: {
@@ -567,6 +594,7 @@ export function registerDescribeTools(server: McpServer) {
                 "Use test_function to validate code before creating or updating a function",
                 "Use create_function + create_trigger together to set up a complete compute pipeline",
                 "Use api.crypto.signJwt() for GitHub App, Google Cloud, or Azure AD authentication flows",
+                "Before creating functions that call external APIs, add the target domains with add_allowed_domain",
               ],
             },
             null,