@critical-path/mcp 0.10.0 → 0.10.2

package/CHANGELOG.md

@@ -1,5 +1,40 @@
 # @critical-path/mcp
 
+## 0.10.2
+
+### Patch Changes
+
+- Updated dependencies [1a516bd]
+  - @critical-path/core@0.27.0
+  - @critical-path/client@0.16.0
+
+## 0.10.1
+
+### Patch Changes
+
+- 719e844: Role-based authorization and multi-tenancy.
+  
+  **@critical-path/core**
+  - New `authorize` engine option and `createRolePolicy()`:
+    - Project roles (`viewer`, `contributor`, `project_manager`, `admin`) come from `project.members`.
+    - Workspace superusers come from `actor.roles`.
+    - Authors manage their own comments and attachments.
+    - Checks run on `withActor` views. Unreadable or cross-tenant projects behave as not found, denied actions throw the new `ForbiddenError`, and lists are filtered.
+  - `Actor` gains `tenantId` and `roles`. Projects, workflows and teams gain `tenantId`, stamped from the actor and never accepted from payloads. Reads are scoped to the actor's tenant, including the default-workflow fallback.
+  - **BREAKING:** `Project.members` is now `{ userId, role }[]` (was `string[]`). Project creators become `admin` members.
+  - New `engine.getActivities()` and `engine.getTimeEntries()`, which respect authorization.
+  - **BREAKING:** on views, presigned uploads require `projectId` and are confined to `projects/<projectId>/`. The presign request schema now requires `projectId`.
+  - `SQLiteStore` persists `tenantId` (migrated automatically).
+  
+  **@critical-path/server**
+  - `RequestContext` gains `tenantId` and `roles`, which are passed to the actor. `ForbiddenError` maps to `403`. Activities and time entries are read through the engine.
+  
+  **@critical-path/client / @critical-path/mcp**
+  - Rebuilt for the new presign `projectId` requirement and project member shape.
+- Updated dependencies [719e844]
+  - @critical-path/core@0.26.0
+  - @critical-path/client@0.15.1
+
 ## 0.10.0
 
 ### Minor Changes

package/README.md

@@ -179,7 +179,7 @@ handle.unregister();
 
 Each tool's JSON `inputSchema` is generated from its zod schema with `defineTool`, so what the model sees always matches what is enforced. Tool arguments are validated against each tool's zod schema before execution, on both the standard server and WebMCP. Invalid or undeclared arguments return an `isError` result naming the problem (for example, `projectId` cannot be passed to `update_task`).
 
-**Identity:** with an `engine`, changes are attributed to the server's `actor` option (default `DEFAULT_MCP_ACTOR`, `mcp-agent`); tools never take author or actor arguments. With a `client`, the API's authentication decides who the caller is. When you pass `tools: [...]` to `createCriticalPathMcpServer`, tools outside that list are neither listed nor callable. `delete_task` is advertised with the MCP `destructiveHint` annotation.
+**Identity:** with an `engine`, changes are attributed to the server's `actor` option (default `DEFAULT_MCP_ACTOR`, `mcp-agent`); tools never take author or actor arguments. If the engine has an `authorize` policy, the actor is checked like any user: give it project memberships (or `roles: ['admin']`), and a `tenantId` in multi-tenant setups. With a `client`, the API's authentication decides who the caller is. When you pass `tools: [...]` to `createCriticalPathMcpServer`, tools outside that list are neither listed nor callable. `delete_task` is advertised with the MCP `destructiveHint` annotation.
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@critical-path/mcp",
-  "version": "0.10.0",
+  "version": "0.10.2",
   "description": "Standard Model Context Protocol (MCP) server and client-side WebMCP support for Critical Path",
   "author": "Jack James",
   "license": "MIT",
@@ -35,8 +35,8 @@
     "@modelcontextprotocol/sdk": "^1.6.0",
     "zod": "^3.24.0",
     "zod-to-json-schema": "^3.25.2",
-    "@critical-path/client": "0.15.0",
-    "@critical-path/core": "0.25.0"
+    "@critical-path/core": "0.27.0",
+    "@critical-path/client": "0.16.0"
   },
   "devDependencies": {
     "@types/node": "^24.0.0",