@clien-ai/mcp 0.1.0

package/dist/config.js

@@ -0,0 +1,48 @@
+/**
+ * Runtime configuration for @clien-ai/mcp.
+ *
+ * All values are environment-overridable so the package can be pointed at a
+ * local dev server or the test Supabase project during integration tests.
+ * Defaults are production.
+ *
+ * Client IDs are PUBLIC PKCE clients — no secret, safe to embed.
+ */
+const PROD_SUPABASE_URL = 'https://pnjwddgqxiohaziscoye.supabase.co';
+const TEST_SUPABASE_URL = 'https://fudinhtlghtipznalrgy.supabase.co';
+const PROD_CLIENT_ID = '9ab91ab2-844a-4b55-a54c-7f9765aa4aaa';
+const TEST_CLIENT_ID = '7e40f4b2-c10d-4f51-a755-c05e513d3b96';
+const DEFAULT_PORTS = [7873, 7874, 7875];
+const DEFAULT_POLL_INTERVAL_MS = 5000;
+const DEFAULT_OAUTH_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes to complete browser consent
+function readEnv(name) {
+    const val = process.env[name];
+    return val && val.length > 0 ? val : undefined;
+}
+/**
+ * Build runtime config. Prefers env vars (for dev/test), falls back to prod
+ * defaults. Switching to test mode: set CLIEN_MCP_ENV=test.
+ */
+export function loadConfig() {
+    const env = (readEnv('CLIEN_MCP_ENV') ?? 'prod').toLowerCase();
+    const isTest = env === 'test';
+    const serverUrl = readEnv('CLIEN_MCP_SERVER_URL') ??
+        (isTest ? 'https://clien.ai' : 'https://clien.ai');
+    const supabaseUrl = readEnv('CLIEN_MCP_SUPABASE_URL') ??
+        (isTest ? TEST_SUPABASE_URL : PROD_SUPABASE_URL);
+    const clientId = readEnv('CLIEN_MCP_CLIENT_ID') ??
+        (isTest ? TEST_CLIENT_ID : PROD_CLIENT_ID);
+    const pollEnv = readEnv('CLIEN_MCP_POLL_INTERVAL_MS');
+    const pollIntervalMs = pollEnv ? Math.max(500, Number(pollEnv)) : DEFAULT_POLL_INTERVAL_MS;
+    return {
+        serverUrl: serverUrl.replace(/\/$/, ''),
+        supabaseUrl: supabaseUrl.replace(/\/$/, ''),
+        clientId,
+        scope: readEnv('CLIEN_MCP_SCOPE') ?? 'openid',
+        oauthPorts: DEFAULT_PORTS,
+        pollIntervalMs,
+        oauthTimeoutMs: DEFAULT_OAUTH_TIMEOUT_MS,
+    };
+}
+export const PACKAGE_NAME = '@clien-ai/mcp';
+export const PACKAGE_VERSION = '0.1.0';
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAmBH,MAAM,iBAAiB,GAAG,0CAA0C,CAAA;AACpE,MAAM,iBAAiB,GAAG,0CAA0C,CAAA;AAEpE,MAAM,cAAc,GAAG,sCAAsC,CAAA;AAC7D,MAAM,cAAc,GAAG,sCAAsC,CAAA;AAE7D,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAU,CAAA;AACjD,MAAM,wBAAwB,GAAG,IAAI,CAAA;AACrC,MAAM,wBAAwB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA,CAAC,wCAAwC;AAEvF,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC7B,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU;IACxB,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,CAAA;IAC9D,MAAM,MAAM,GAAG,GAAG,KAAK,MAAM,CAAA;IAE7B,MAAM,SAAS,GACb,OAAO,CAAC,sBAAsB,CAAC;QAC/B,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAA;IACpD,MAAM,WAAW,GACf,OAAO,CAAC,wBAAwB,CAAC;QACjC,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAA;IAClD,MAAM,QAAQ,GACZ,OAAO,CAAC,qBAAqB,CAAC;QAC9B,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAA;IAE5C,MAAM,OAAO,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAA;IACrD,MAAM,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAA;IAE1F,OAAO;QACL,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QACvC,WAAW,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAC3C,QAAQ;QACR,KAAK,EAAE,OAAO,CAAC,iBAAiB,CAAC,IAAI,QAAQ;QAC7C,UAAU,EAAE,aAAa;QACzB,cAAc;QACd,cAAc,EAAE,wBAAwB;KACzC,CAAA;AACH,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,eAAe,CAAA;AAC3C,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAA"}

package/dist/server.js

@@ -0,0 +1,189 @@
+/**
+ * MCP stdio server entry point.
+ *
+ * Registers the `clien_research` tool. Auth happens lazily on first tool call
+ * so the server can announce its tool list without a browser interruption.
+ */
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { CallToolRequestSchema, ListToolsRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
+import { loadConfig, PACKAGE_NAME, PACKAGE_VERSION } from './config.js';
+import { ensureSession, } from './auth/oauth.js';
+import { clearTokens, loadRefreshToken, saveRefreshToken, withTokenLock, } from './auth/storage.js';
+import { ResearchToolError, runResearch, } from './tools/research.js';
+function log(...args) {
+    // stderr only — stdout is the MCP transport.
+    console.error('[clien-mcp]', ...args);
+}
+/**
+ * Default browser opener — lazily imports `open` so the package still loads
+ * on systems that can't open a browser (we handle the error in OAuth).
+ */
+async function defaultBrowserOpener() {
+    const mod = (await import('open'));
+    const fn = typeof mod === 'function'
+        ? mod
+        : mod.default;
+    return async (url) => {
+        await fn(url);
+    };
+}
+/**
+ * Input schema for the tool advert. Hand-rolled JSON Schema so we avoid the
+ * `zod-to-json-schema` dependency. Must stay in sync with `ResearchInputSchema`
+ * in `src/tools/research.ts` — the Zod parser is still the source of truth at
+ * runtime; this is only the spec advertised to the caller.
+ *
+ * Drift surfaces silently: the Zod parser still accepts the input, but strict
+ * MCP clients (`additionalProperties: false`) strip undeclared fields before
+ * they reach the parser, and LLM callers never learn the field exists.
+ * Enforcement: `__tests__/schema-contract.test.ts` walks both schemas and
+ * fails if their property keys or required-field sets diverge. Exported here
+ * so that test can import it. See
+ * `docs/solutions/design-patterns/cross-package-schema-duplication-contract-2026-05-12.md`.
+ */
+export const RESEARCH_INPUT_SCHEMA = {
+    type: 'object',
+    properties: {
+        idea: {
+            type: 'string',
+            minLength: 1,
+            maxLength: 10_000,
+            description: 'The product idea, feature hypothesis, or research question to validate. ' +
+                'Can be a one-liner or several paragraphs — more context yields a better report.',
+        },
+        depth: {
+            type: 'string',
+            enum: ['quick', 'deep'],
+            default: 'deep',
+            description: '"deep" (default) runs a 15-25 minute full research pass. ' +
+                '"quick" caps cost and runs a tighter pass.',
+        },
+        project_id: {
+            type: 'string',
+            format: 'uuid',
+            description: 'Optional Clien.ai project UUID to attach this run to. When omitted, ' +
+                'the run is standalone and not associated with any project.',
+        },
+        project_name: {
+            type: 'string',
+            minLength: 1,
+            maxLength: 100,
+            description: 'Name for a new Clien.ai project to attach this run to. You SHOULD ' +
+                'supply this whenever `project_id` is not set, otherwise the ' +
+                'resulting report will not be discoverable in the Clien.ai web UI. ' +
+                'Derive a short (2-4 word) human-readable name from the idea — ' +
+                'typically the product name. Guidance on when to create a new ' +
+                'project vs. reuse an existing one: create a NEW project (supply a ' +
+                'fresh `project_name`) for each distinct research idea or product ' +
+                'concept; REUSE an existing `project_id` only when the user ' +
+                'explicitly asks to add follow-up research to a prior run on the ' +
+                'same idea. Ignored when `project_id` is also provided.',
+        },
+    },
+    required: ['idea'],
+    additionalProperties: false,
+};
+export function createMcpServer() {
+    const config = loadConfig();
+    // Per-instance session cache. Scoping this to the closure (rather than the
+    // module) means each `createMcpServer()` call gets its own cache, so tests
+    // that build a fresh server per case start cold without any shared-state
+    // gymnastics. In production we only ever construct one server per process
+    // (`startStdioServer`), so behavior is identical.
+    let cachedSession = null;
+    async function getSession() {
+        if (cachedSession)
+            return cachedSession;
+        const opener = await defaultBrowserOpener();
+        cachedSession = await ensureSession({
+            config,
+            loadRefreshToken,
+            saveRefreshToken,
+            clearTokens,
+            openBrowser: opener,
+            withTokenLock,
+        });
+        return cachedSession;
+    }
+    // Invalidate the in-memory session so the next tool call rebuilds it from
+    // disk. Called from the polling loop when a 401 indicates server-side
+    // revocation — without this, a long-lived MCP process would keep using the
+    // cached (now-invalid) access token until process restart. See issue #168.
+    function invalidateSession() {
+        cachedSession = null;
+    }
+    const server = new Server({ name: PACKAGE_NAME, version: PACKAGE_VERSION }, { capabilities: { tools: {} } });
+    server.setRequestHandler(ListToolsRequestSchema, async () => ({
+        tools: [
+            {
+                name: 'clien_research',
+                description: 'Run a full product-research pass on an idea. Returns a markdown report plus ' +
+                    'structured report_data (hypotheses, competitors[], key findings). Typical wall time ' +
+                    '15-25 minutes; progress is streamed via notifications/progress. ' +
+                    'First call opens a browser for one-time OAuth login; subsequent calls reuse the stored refresh token.',
+                inputSchema: RESEARCH_INPUT_SCHEMA,
+            },
+        ],
+    }));
+    server.setRequestHandler(CallToolRequestSchema, async (request) => {
+        if (request.params.name !== 'clien_research') {
+            throw new Error(`Unknown tool: ${request.params.name}`);
+        }
+        // Per MCP spec, `progressToken` may be a string OR a number, and `0` or
+        // `''` are valid token values. A truthy check (`progressToken ?`) silently
+        // drops progress for those callers. Compare against `undefined` instead.
+        const progressToken = request.params._meta?.progressToken;
+        const onProgress = progressToken !== undefined
+            ? async (progress) => {
+                try {
+                    await server.notification({
+                        method: 'notifications/progress',
+                        params: {
+                            progressToken,
+                            progress: progress.progress,
+                            total: progress.total,
+                            message: progress.message,
+                        },
+                    });
+                }
+                catch (err) {
+                    log('progress notification failed:', err);
+                }
+            }
+            : undefined;
+        try {
+            const session = await getSession();
+            const result = await runResearch(request.params.arguments, {
+                config,
+                session,
+                onProgress,
+                invalidateSession,
+            });
+            return {
+                content: result.content,
+                _meta: result._meta,
+            };
+        }
+        catch (err) {
+            const message = err instanceof ResearchToolError
+                ? err.userMessage
+                : err instanceof Error
+                    ? err.message
+                    : String(err);
+            log('tool error:', message);
+            return {
+                isError: true,
+                content: [{ type: 'text', text: message }],
+            };
+        }
+    });
+    return server;
+}
+export async function startStdioServer() {
+    const server = createMcpServer();
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    log(`connected on stdio — ${PACKAGE_NAME}@${PACKAGE_VERSION}`);
+}
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAA;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAA;AAChF,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AACvE,OAAO,EACL,aAAa,GAGd,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,GACd,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,iBAAiB,EACjB,WAAW,GAEZ,MAAM,qBAAqB,CAAA;AAE5B,SAAS,GAAG,CAAC,GAAG,IAAe;IAC7B,6CAA6C;IAC7C,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,CAAA;AACvC,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,oBAAoB;IACjC,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,CAEM,CAAA;IACvC,MAAM,EAAE,GACN,OAAO,GAAG,KAAK,UAAU;QACvB,CAAC,CAAE,GAAyC;QAC5C,CAAC,CAAE,GAAsD,CAAC,OAAO,CAAA;IACrE,OAAO,KAAK,EAAE,GAAW,EAAE,EAAE;QAC3B,MAAM,EAAE,CAAC,GAAG,CAAC,CAAA;IACf,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA4B;IAC5D,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,IAAI,EAAE;YACJ,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,CAAC;YACZ,SAAS,EAAE,MAAM;YACjB,WAAW,EACT,0EAA0E;gBAC1E,iFAAiF;SACpF;QACD,KAAK,EAAE;YACL,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;YACvB,OAAO,EAAE,MAAM;YACf,WAAW,EACT,2DAA2D;gBAC3D,4CAA4C;SAC/C;QACD,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,MAAM;YACd,WAAW,EACT,sEAAsE;gBACtE,4DAA4D;SAC/D;QACD,YAAY,EAAE;YACZ,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,CAAC;YACZ,SAAS,EAAE,GAAG;YACd,WAAW,EACT,oEAAoE;gBACpE,8DAA8D;gBAC9D,oEAAoE;gBACpE,gEAAgE;gBAChE,+DAA+D;gBAC/D,oEAAoE;gBACpE,mEAAmE;gBACnE,6DAA6D;gBAC7D,kEAAkE;gBAClE,wDAAwD;SAC3D;KACF;IACD,QAAQ,EAAE,CAAC,MAAM,CAAC;IAClB,oBAAoB,EAAE,KAAK;CAC5B,CAAA;AAED,MAAM,UAAU,eAAe;IAC7B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;IAE3B,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,0EAA0E;IAC1E,kDAAkD;IAClD,IAAI,aAAa,GAAmB,IAAI,CAAA;IAExC,KAAK,UAAU,UAAU;QACvB,IAAI,aAAa;YAAE,OAAO,aAAa,CAAA;QACvC,MAAM,MAAM,GAAG,MAAM,oBAAoB,EAAE,CAAA;QAC3C,aAAa,GAAG,MAAM,aAAa,CAAC;YAClC,MAAM;YACN,gBAAgB;YAChB,gBAAgB;YAChB,WAAW;YACX,WAAW,EAAE,MAAM;YACnB,aAAa;SACd,CAAC,CAAA;QACF,OAAO,aAAa,CAAA;IACtB,CAAC;IAED,0EAA0E;IAC1E,sEAAsE;IACtE,2EAA2E;IAC3E,2EAA2E;IAC3E,SAAS,iBAAiB;QACxB,aAAa,GAAG,IAAI,CAAA;IACtB,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,eAAe,EAAE,EAChD,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAA;IAED,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5D,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,gBAAgB;gBACtB,WAAW,EACT,8EAA8E;oBAC9E,sFAAsF;oBACtF,kEAAkE;oBAClE,uGAAuG;gBACzG,WAAW,EAAE,qBAAqB;aACnC;SACF;KACF,CAAC,CAAC,CAAA;IAEH,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChE,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,iBAAiB,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;QACzD,CAAC;QAED,wEAAwE;QACxE,2EAA2E;QAC3E,yEAAyE;QACzE,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,CAAA;QACzD,MAAM,UAAU,GAAG,aAAa,KAAK,SAAS;YAC5C,CAAC,CAAC,KAAK,EAAE,QAAsB,EAAE,EAAE;gBAC/B,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,YAAY,CAAC;wBACxB,MAAM,EAAE,wBAAwB;wBAChC,MAAM,EAAE;4BACN,aAAa;4BACb,QAAQ,EAAE,QAAQ,CAAC,QAAQ;4BAC3B,KAAK,EAAE,QAAQ,CAAC,KAAK;4BACrB,OAAO,EAAE,QAAQ,CAAC,OAAO;yBAC1B;qBACF,CAAC,CAAA;gBACJ,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,GAAG,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAA;gBAC3C,CAAC;YACH,CAAC;YACH,CAAC,CAAC,SAAS,CAAA;QAEb,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAA;YAClC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE;gBACzD,MAAM;gBACN,OAAO;gBACP,UAAU;gBACV,iBAAiB;aAClB,CAAC,CAAA;YACF,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GACX,GAAG,YAAY,iBAAiB;gBAC9B,CAAC,CAAC,GAAG,CAAC,WAAW;gBACjB,CAAC,CAAC,GAAG,YAAY,KAAK;oBACpB,CAAC,CAAC,GAAG,CAAC,OAAO;oBACb,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACnB,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;YAC3B,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;aAC3C,CAAA;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,MAAM,GAAG,eAAe,EAAE,CAAA;IAChC,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAA;IAC5C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IAC/B,GAAG,CAAC,wBAAwB,YAAY,IAAI,eAAe,EAAE,CAAC,CAAA;AAChE,CAAC"}