@cloudgrid-io/mcp 0.8.2 → 0.10.0

package/README.md

@@ -66,44 +66,44 @@ It speaks MCP over stdio. Point any MCP client at the `cloudgrid-mcp` command.
 | `gridctl_claim` | `POST /api/v2/entities/:id/pickup` | Claim an anonymous drop into the signed-in account (the claim token IS the drop's owner token). Direct API. |
 | `gridctl_fork` | `POST /api/v2/runtimes/:id/fork` | Start a new entity from an existing runtime (lineage recorded). Needs sign-in. |
 | `gridctl_download` | `GET /api/v2/runtimes/:id/source` | Signed 15-minute source-bundle URLs. Needs sign-in. |
-| `cloudgrid_login` | `GET /auth/login` | Start a CLI-free sign-in; returns a URL to open. Direct API. |
-| `cloudgrid_login_status` | `GET /auth/status` | Finish the sign-in; saves the token to the shared CLI credentials. |
-| `cloudgrid_visibility` | `PATCH /api/v2/inspirations/<id>` | Change who can see a drop (private, space, authenticated, org, link). Needs sign-in. Direct API; also in the web edition. |
+| `gridctl_login` | `GET /auth/login` | Start a CLI-free sign-in; returns a URL to open. Direct API. |
+| `gridctl_login_status` | `GET /auth/status` | Finish the sign-in; saves the token to the shared CLI credentials. |
+| `gridctl_visibility` | `PATCH /api/v2/inspirations/<id>` | Change who can see a drop (private, space, authenticated, org, link). Needs sign-in. Direct API; also in the web edition. |
 
-`cloudgrid_drop`, `cloudgrid_claim`, `cloudgrid_visibility`, and the two
-`cloudgrid_login` tools do not wrap the CLI -- they call the API directly, so they
-also work in the web edition where no CLI exists. `cloudgrid_login` writes the same
+`gridctl_drop`, `gridctl_claim`, `gridctl_visibility`, and the two
+`gridctl_login` tools do not wrap the CLI -- they call the API directly, so they
+also work in the web edition where no CLI exists. `gridctl_login` writes the same
 `~/.cloudgrid/credentials` the CLI uses, so the two share one identity.
 
 ### CLI-wrapping tools (local edition only)
 
 | Tool | Wraps | Notes |
 |---|---|---|
-| `cloudgrid_init` | `cloudgrid init` | Register an app or agent; optionally seed a web service. |
-| `cloudgrid_logs` | `cloudgrid logs` | Snapshot of recent logs. Does not stream. Read-only. |
-| `cloudgrid_share` | `cloudgrid visibility set` | Set visibility, default link. |
-| `cloudgrid_feedback` | `cloudgrid feedback list` | Read the org feedback feed. Read-only. |
-| `cloudgrid_whoami` | `cloudgrid whoami` | Show the signed-in user and active org. Read-only. |
-| `cloudgrid_use` | `cloudgrid use` | Switch the active org. |
-| `cloudgrid_logout` | `cloudgrid logout` | Sign out and clear local credentials. Destructive. |
-| `cloudgrid_status` | `cloudgrid status` | Org dashboard or entity detail. Read-only. |
-| `cloudgrid_info` | `cloudgrid info` | Entity metadata. Read-only. |
-| `cloudgrid_get` | `cloudgrid get grids\|entities\|spaces` | List grids, entities, or spaces. Read-only. |
-| `cloudgrid_describe_grid` | `cloudgrid describe grid <slug>` | Grid detail. Read-only. |
-| `cloudgrid_pickup` | `cloudgrid pickup <name>` | Download an entity's source and bind the folder. |
-| `cloudgrid_rename` | `cloudgrid rename` | Rename an entity's display name. |
-| `cloudgrid_unplug` | `cloudgrid unplug` | Take an entity off the grid. Destructive; requires confirm. |
-| `cloudgrid_delete` | `cloudgrid delete entity` | Archive an inspiration. Destructive; requires confirm. |
-| `cloudgrid_rollback` | `cloudgrid rollback` | Rollback to a previous version. |
-| `cloudgrid_versions` | `cloudgrid versions` | List published versions. Read-only. |
-| `cloudgrid_env` | `cloudgrid env` | Get, set, or list environment variables. |
-| `cloudgrid_secrets` | `cloudgrid secrets` | Set or list secret names. Never returns secret values. |
-| `cloudgrid_scaffold` | `cloudgrid scaffold` | Generate starter files. |
-| `cloudgrid_doctor` | `cloudgrid doctor` | Run local diagnostics. Read-only. |
-| `cloudgrid_open` | `cloudgrid open --print` | Return the public URL. Does not open a browser. Read-only. |
-
-`cloudgrid_share` and `cloudgrid_visibility` overlap on purpose: `cloudgrid_share`
-wraps the CLI and defaults to `link`; `cloudgrid_visibility` is direct API, takes an
+| `gridctl_init` | `cloudgrid init` | Register an app or agent; optionally seed a web service. |
+| `gridctl_logs` | `cloudgrid logs` | Snapshot of recent logs. Does not stream. Read-only. |
+| `gridctl_share` | `cloudgrid visibility set` | Set visibility, default link. |
+| `gridctl_feedback` | `cloudgrid feedback list` | Read the org feedback feed. Read-only. |
+| `gridctl_whoami` | `cloudgrid whoami` | Show the signed-in user and active org. Read-only. |
+| `gridctl_use` | `cloudgrid use` | Switch the active org. |
+| `gridctl_logout` | `cloudgrid logout` | Sign out and clear local credentials. Destructive. |
+| `gridctl_status` | `cloudgrid status` | Org dashboard or entity detail. Read-only. |
+| `gridctl_info` | `cloudgrid info` | Entity metadata. Read-only. |
+| `gridctl_get` | `cloudgrid get grids\|entities\|spaces` | List grids, entities, or spaces. Read-only. |
+| `gridctl_describe_grid` | `cloudgrid describe grid <slug>` | Grid detail. Read-only. |
+| `gridctl_pickup` | `cloudgrid pickup <name>` | Download an entity's source and bind the folder. |
+| `gridctl_rename` | `cloudgrid rename` | Rename an entity's display name. |
+| `gridctl_unplug` | `cloudgrid unplug` | Take an entity off the grid. Destructive; requires confirm. |
+| `gridctl_delete` | `cloudgrid delete entity` | Archive an inspiration. Destructive; requires confirm. |
+| `gridctl_rollback` | `cloudgrid rollback` | Rollback to a previous version. |
+| `gridctl_versions` | `cloudgrid versions` | List published versions. Read-only. |
+| `gridctl_env` | `cloudgrid env` | Get, set, or list environment variables. |
+| `gridctl_secrets` | `cloudgrid secrets` | Set or list secret names. Never returns secret values. |
+| `gridctl_scaffold` | `cloudgrid scaffold` | Generate starter files. |
+| `gridctl_doctor` | `cloudgrid doctor` | Run local diagnostics. Read-only. |
+| `gridctl_open` | `cloudgrid open --print` | Return the public URL. Does not open a browser. Read-only. |
+
+`gridctl_share` and `gridctl_visibility` overlap on purpose: `gridctl_share`
+wraps the CLI and defaults to `link`; `gridctl_visibility` is direct API, takes an
 explicit scope, and defaults its target to the session's last drop -- it is the one
 the web edition gets.
 
@@ -113,7 +113,7 @@ All tools carry MCP annotations (`readOnlyHint`, `destructiveHint`,
 ## Test
 
 A smoke test spawns the server with a real MCP client, lists the tools, and calls
-the read-only `cloudgrid_feedback` tool end to end:
+the read-only `gridctl_feedback` tool end to end:
 
 ```
 cd mcp-server
@@ -127,5 +127,5 @@ It needs a logged-in CLI on `$PATH`.
 
 - Shells out with `execFile` and an argument array, so there is no shell and no
   injection surface.
-- `cloudgrid_logs` never uses `--follow`; a streaming call would never return.
+- `gridctl_logs` never uses `--follow`; a streaming call would never return.
 - Stateless. Each call is one CLI invocation.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloudgrid-io/mcp",
-  "version": "0.8.2",
+  "version": "0.10.0",
   "description": "MCP server for CloudGrid. Three editions: a local stdio server (full toolset), a hosted web server (light, CLI-free toolset), and a public docs server (search_cloudgrid_documentation) over MCP Streamable HTTP.",
   "type": "module",
   "bin": {
@@ -18,6 +18,9 @@
     "smoke": "node test/smoke.mjs",
     "test:plug-wire": "node test/plug-wire.test.mjs",
     "test:error-reporting": "node test/error-reporting.test.mjs",
+    "test:source": "node test/source-fetch.test.mjs",
+    "test:app-with-data": "node test/app-with-data.test.mjs",
+    "test:content": "node test/content-handling.test.mjs",
     "test:self-healing": "node test/self-healing.test.mjs",
     "test:grid-picker": "node test/grid-picker.test.mjs",
     "test:drift-guard": "node test/drift-guard.mjs",

package/src/corpus/cookbook.md

@@ -74,7 +74,7 @@ curl -sS -X POST https://api.cloudgrid.io/api/v2/plug \
 The response includes `url` (the live link — use it verbatim), `entity_id`,
 `owner_token` (keep both to update the drop later), and `claim_url` (sign in
 before it expires to keep it). This is what the `cloudgrid-drop` skill and the
-`cloudgrid_drop` MCP tool do for you. It is anonymous and serves inspirations
+`gridctl_drop` MCP tool do for you. It is anonymous and serves inspirations
 only; a full app needs the signed-in `plug` flow above.
 
 ## Update your drop in place

package/src/corpus/examples/app-with-data/index.md

@@ -0,0 +1,251 @@
+# Example: app-with-data — "Team Task Board"
+
+A filled reference imitating the `app-with-data` template: a persistent team
+task board. Same stack (Next.js App Router + the `mongodb` driver, grid-shared
+Mongo via `process.env.MONGODB_URL`), slightly richer than the bare todo
+template — tasks have an `assignee` and a `status` (todo / doing / done), and
+the API supports updating status via PATCH.
+
+Data persists in the grid-shared Mongo, so the whole team sees the same board
+across sessions and refresh.
+
+**Same three proven rules as the template:** (1) app code lives under
+**`services/web/`** (the service name, NOT the repo root — `path:` is the URL
+mount); (2) `MONGODB_URL` is read **lazily inside the `getDb` getter**, never at
+module top level (a top-level read fails `next build`); (3) the datastore is
+declared with **`requires: [mongodb]`, not `needs:`** — the deployer only
+injects `MONGODB_URL` from `requires:`.
+
+## cloudgrid.yaml
+
+```yaml
+# NOTE: use `requires:` (NOT `needs:`). The deployer only injects MONGODB_URL
+# from `requires:`; `needs:` builds fine but injects NO DB connection (500s).
+name: team-task-board
+services:
+  web:
+    type: nextjs
+    path: /
+requires:
+  - mongodb
+```
+
+## services/web/package.json
+
+```json
+{
+  "name": "team-task-board",
+  "version": "0.1.0",
+  "private": true,
+  "scripts": { "dev": "next dev", "build": "next build", "start": "next start" },
+  "dependencies": {
+    "next": "^15.1.0",
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0",
+    "mongodb": "^6.12.0"
+  }
+}
+```
+
+## services/web/lib/db.js
+
+```js
+// Cached Mongo client. MONGODB_URL is injected by the grid (dev + runtime).
+// Resolve it LAZILY inside the getter — a top-level read fails `next build`.
+import { MongoClient } from "mongodb";
+
+function clientPromise() {
+  const uri = process.env.MONGODB_URL;
+  if (!uri) {
+    throw new Error(
+      "MONGODB_URL is not set. The grid injects it — run `grid dev` locally or " +
+        "deploy with `grid plug`. Do not set it by hand.",
+    );
+  }
+  if (!globalThis.__mongoClientPromise) {
+    globalThis.__mongoClientPromise = new MongoClient(uri).connect();
+  }
+  return globalThis.__mongoClientPromise;
+}
+
+export async function getDb() {
+  return (await clientPromise()).db();
+}
+```
+
+## services/web/app/api/tasks/route.js
+
+```js
+import { NextResponse } from "next/server";
+import { ObjectId } from "mongodb";
+import { getDb } from "../../../lib/db.js";
+
+export const dynamic = "force-dynamic";
+
+const STATUSES = ["todo", "doing", "done"];
+
+async function tasks() {
+  return (await getDb()).collection("tasks");
+}
+
+// GET /api/tasks — list the board.
+export async function GET() {
+  const col = await tasks();
+  const items = await col.find({}).sort({ createdAt: -1 }).toArray();
+  return NextResponse.json(
+    items.map((t) => ({
+      id: t._id.toString(),
+      title: t.title,
+      assignee: t.assignee || "",
+      status: t.status || "todo",
+    })),
+  );
+}
+
+// POST /api/tasks — add a task. Body: { title, assignee }.
+export async function POST(request) {
+  const body = await request.json().catch(() => ({}));
+  const title = typeof body.title === "string" ? body.title.trim() : "";
+  if (!title) return NextResponse.json({ error: "title is required" }, { status: 400 });
+  const doc = {
+    title,
+    assignee: typeof body.assignee === "string" ? body.assignee.trim() : "",
+    status: "todo",
+    createdAt: new Date(),
+  };
+  const col = await tasks();
+  const res = await col.insertOne(doc);
+  return NextResponse.json({ id: res.insertedId.toString(), ...doc }, { status: 201 });
+}
+
+// PATCH /api/tasks — move a task. Body: { id, status }.
+export async function PATCH(request) {
+  const body = await request.json().catch(() => ({}));
+  const { id, status } = body;
+  if (!id || !ObjectId.isValid(id) || !STATUSES.includes(status)) {
+    return NextResponse.json({ error: "valid id and status required" }, { status: 400 });
+  }
+  const col = await tasks();
+  await col.updateOne({ _id: new ObjectId(id) }, { $set: { status } });
+  return NextResponse.json({ ok: true });
+}
+
+// DELETE /api/tasks?id=<id>
+export async function DELETE(request) {
+  const id = new URL(request.url).searchParams.get("id");
+  if (!id || !ObjectId.isValid(id)) {
+    return NextResponse.json({ error: "valid id is required" }, { status: 400 });
+  }
+  const col = await tasks();
+  await col.deleteOne({ _id: new ObjectId(id) });
+  return NextResponse.json({ ok: true });
+}
+```
+
+## services/web/app/page.js
+
+```js
+import { getDb } from "../lib/db.js";
+import Board from "./board.js";
+
+export const dynamic = "force-dynamic";
+
+async function listTasks() {
+  const items = await (await getDb())
+    .collection("tasks")
+    .find({})
+    .sort({ createdAt: -1 })
+    .toArray();
+  return items.map((t) => ({
+    id: t._id.toString(),
+    title: t.title,
+    assignee: t.assignee || "",
+    status: t.status || "todo",
+  }));
+}
+
+export default async function Page() {
+  const tasks = await listTasks();
+  return (
+    <main>
+      <h1>Team Task Board</h1>
+      <p className="hint">Shared across the team — persisted in grid Mongo.</p>
+      <Board initialTasks={tasks} />
+    </main>
+  );
+}
+```
+
+## services/web/app/board.js
+
+```js
+"use client";
+import { useState } from "react";
+
+const COLUMNS = ["todo", "doing", "done"];
+const LABELS = { todo: "To do", doing: "Doing", done: "Done" };
+
+export default function Board({ initialTasks }) {
+  const [tasks, setTasks] = useState(initialTasks);
+  const [title, setTitle] = useState("");
+  const [assignee, setAssignee] = useState("");
+
+  async function add(e) {
+    e.preventDefault();
+    if (!title.trim()) return;
+    const res = await fetch("/api/tasks", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ title, assignee }),
+    });
+    if (res.ok) { setTasks((p) => [await res.json(), ...p]); setTitle(""); setAssignee(""); }
+  }
+
+  async function move(id, status) {
+    const res = await fetch("/api/tasks", {
+      method: "PATCH",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ id, status }),
+    });
+    if (res.ok) setTasks((p) => p.map((t) => (t.id === id ? { ...t, status } : t)));
+  }
+
+  return (
+    <div>
+      <form onSubmit={add} className="row">
+        <input value={title} onChange={(e) => setTitle(e.target.value)} placeholder="Task title…" />
+        <input value={assignee} onChange={(e) => setAssignee(e.target.value)} placeholder="Assignee" />
+        <button type="submit">Add</button>
+      </form>
+      <div className="board">
+        {COLUMNS.map((col) => (
+          <section key={col}>
+            <h2>{LABELS[col]}</h2>
+            {tasks.filter((t) => t.status === col).map((t) => (
+              <article key={t.id}>
+                <strong>{t.title}</strong>
+                {t.assignee && <em> · {t.assignee}</em>}
+                <div className="moves">
+                  {COLUMNS.filter((c) => c !== col).map((c) => (
+                    <button key={c} onClick={() => move(t.id, c)}>→ {LABELS[c]}</button>
+                  ))}
+                </div>
+              </article>
+            ))}
+          </section>
+        ))}
+      </div>
+    </div>
+  );
+}
+```
+
+## Notes
+
+- Deploy the same way as the template: `grid dev` locally, `grid plug` to deploy
+  (async — poll status to a live URL). Re-plug the same entity to keep one URL.
+- The only store this needs is Mongo (`requires: [mongodb]` — not `needs:`; the
+  deployer only injects `MONGODB_URL` from `requires:`). Add `redis: private`
+  only for caching/sessions/pubsub you actually use.
+- All app code lives under `services/web/`; the connection is read lazily inside
+  `getDb`, never at module top level.

package/src/corpus/install.md

@@ -113,7 +113,7 @@ https://github.com/cloudgrid-io/mcp/releases/latest/download/cloudgrid.mcpb
 
 The bundle carries the full local toolset (including the `cloudgrid` CLI), so deploy
 and secrets tools work without a separate install. Sign in from chat with the
-`cloudgrid_login` tool on first use.
+`gridctl_login` tool on first use.
 
 ## For agents
 

package/src/corpus/skill-claim.md

@@ -69,5 +69,5 @@ new_expires_at, role_granted: "owner", ... }`.
 ## Notes
 
 - One pickup claims one entity. To claim several, repeat with each entity id + token.
-- The MCP `cloudgrid_claim` tool does this for you, and remembers the entity id +
+- The MCP `gridctl_claim` tool does this for you, and remembers the entity id +
   token from the last anonymous drop so you can claim with no arguments.

package/src/corpus/skill-drop.md

@@ -78,7 +78,7 @@ A signed-in drop returns HTTP 202 with `entity_id`, `url`, `slug` + `grid` and n
 not compose it. The org is taken from the `X-CloudGrid-Org` header — there is no
 `org_slug` form field. If the user is a member of several orgs and the header is
 missing, the API replies with the list of orgs to choose from. The MCP
-`cloudgrid_drop` tool does this automatically when credentials are present.
+`gridctl_drop` tool does this automatically when credentials are present.
 
 ## Re-plug: update the same URL in place
 
@@ -120,7 +120,7 @@ Rules that matter:
 - An anonymous edit without a valid `owner_token` returns **401**.
 - Anonymous edits count against the same daily anonymous cap as creates.
 - Only re-plug when the user is iterating on an existing artifact. If they want a
-  separate new link, omit `target_entity_id` (the MCP `cloudgrid_drop` tool's
+  separate new link, omit `target_entity_id` (the MCP `gridctl_drop` tool's
   `fresh` flag does the same: it forces a new entity instead of updating).
 
 ## After the drop

package/src/corpus/skill-login.md

@@ -81,6 +81,6 @@ made an anonymous drop earlier, this is the moment to offer to claim it.
 
 - Enterprise single sign-on is not supported in this flow yet; those users sign in
   through the Console for now.
-- The MCP server exposes the same flow as `cloudgrid_login` and
-  `cloudgrid_login_status`, which handle the polling and the credentials write for
+- The MCP server exposes the same flow as `gridctl_login` and
+  `gridctl_login_status`, which handle the polling and the credentials write for
   you.

package/src/corpus/templates/app-with-data/README.md

@@ -0,0 +1,70 @@
+# app-with-data template — persistent Next.js + Mongo app
+
+A minimal but real, deployable to-do app. Data lives in the grid-shared MongoDB,
+so it survives refresh and is shared across users/sessions — unlike a static
+page whose state is in memory only.
+
+## How the grid gives you a database
+
+You do **not** provision a database or set a connection string. In
+`cloudgrid.yaml` you declare `requires: [mongodb]`, and the grid:
+
+- provisions shared Mongo for the app, and
+- injects the connection string as the **`MONGODB_URL`** environment variable —
+  at dev-time (`grid dev`) and at runtime (after `grid plug`).
+
+The app reads it via `process.env.MONGODB_URL` in `services/web/lib/db.js` —
+**lazily, inside the `getDb` getter, never at module top level** (a top-level
+read fails `next build`, which imports the module for route analysis before the
+grid injects the var). Never hardcode a connection string; never commit a
+secret. (If you also declare `redis: private`, the grid injects `REDIS_URL` the
+same way.)
+
+> **Use `requires:` (NOT `needs:`).** The CLI warns `requires:` is deprecated,
+> but the deployer currently only injects `MONGODB_URL` from `requires:` —
+> migrating to `needs:` builds fine but injects NO DB connection (every request
+> 500s). Keep `requires:` until CloudGrid's deployer honors `needs:`.
+
+## Service layout
+
+App code lives under **`services/web/`**, not the template root. `path:` in
+`cloudgrid.yaml` is the URL mount, not the filesystem path — the service named
+`web` means the CLI looks for `services/web/`. Files at the root fail with
+`Error: Service directory not found: …/services/web`.
+
+## Run locally
+
+```bash
+npm install
+grid dev          # runs Next.js with MONGODB_URL injected against dev Mongo
+```
+
+## Deploy
+
+```bash
+grid plug         # builds + deploys the folder (async — poll status until live)
+```
+
+A runtime deploy is asynchronous: `plug` returns `status: building`; poll status
+until the app is live, then use the returned live URL. Re-plug the same entity
+to update the same URL.
+
+## File tree
+
+```
+cloudgrid.yaml                        # name + services.web (nextjs) + requires: [mongodb]
+services/web/package.json             # next, react, react-dom, mongodb driver only
+services/web/lib/db.js                # lazy Mongo client from process.env.MONGODB_URL
+services/web/app/layout.js            # root layout + inline CSS
+services/web/app/page.js              # server component: reads todos from Mongo
+services/web/app/todo-form.js         # client form: POST/DELETE via the API
+services/web/app/api/todos/route.js   # GET (list) / POST (add) / DELETE (remove)
+```
+
+## Adapt it
+
+- Rename the `todos` collection in `services/web/app/api/todos/route.js` and
+  `services/web/app/page.js` (e.g. `submissions`, `tasks`, `entries`).
+- Change the document fields (add owners, timestamps, statuses).
+- Add more routes/collections as the app grows.
+- Add `redis: private` to `requires` only if you actually need Redis.

package/src/corpus/templates/app-with-data/cloudgrid.yaml

@@ -0,0 +1,15 @@
+# Rename this app. The grid injects MONGODB_URL (and REDIS_URL if you add a cache)
+# as environment variables at runtime — do NOT set them yourself, and never commit
+# a connection string or secret.
+#
+# NOTE: use `requires:` (NOT `needs:`). The CLI warns that `requires:` is deprecated,
+# but the deployer currently only injects MONGODB_URL from `requires:` — migrating to
+# `needs:` builds fine but injects NO database connection (every request 500s).
+# Keep `requires:` until CloudGrid's deployer honors `needs:`.
+name: my-app
+services:
+  web:
+    type: nextjs
+    path: /
+requires:
+  - mongodb