@critical-path/mcp 0.8.0 → 0.10.0

package/src/index.test.ts

@@ -216,7 +216,7 @@ describe('@critical-path/mcp', () => {
       expect(await engine.getTask(task.id)).not.toBeNull();
     });
 
-    it('validates tool arguments and strips undeclared fields', async () => {
+    it('validates tool arguments and rejects undeclared fields', async () => {
       const source = await engine.createProject({ name: 'Source', key: 'SRC' });
       const other = await engine.createProject({ name: 'Other', key: 'OTH' });
       const task = await engine.createTask({ projectId: source.id, title: 'Stay put' });
@@ -226,13 +226,28 @@ describe('@critical-path/mcp', () => {
       expect(invalid.isError).toBe(true);
       expect((invalid.content as Array<{ text: string }>)[0].text).toContain('Invalid arguments');
 
-      await client.callTool({
+      const undeclared = await client.callTool({
         name: 'update_task',
         arguments: { id: task.id, title: 'Renamed', projectId: other.id }
       });
-      const updated = await engine.getTask(task.id);
-      expect(updated?.title).toBe('Renamed');
-      expect(updated?.projectId).toBe(source.id);
+      expect(undeclared.isError).toBe(true);
+      expect((undeclared.content as Array<{ text: string }>)[0].text).toContain('projectId');
+      const unchanged = await engine.getTask(task.id);
+      expect(unchanged?.title).toBe('Stay put');
+      expect(unchanged?.projectId).toBe(source.id);
+    });
+
+    it('attributes engine writes to the configured actor', async () => {
+      const project = await engine.createProject({ name: 'Actors', key: 'ACT' });
+      const task = await engine.createTask({ projectId: project.id, title: 'T' });
+
+      const defaultClient = await connect({ engine });
+      const first = await defaultClient.callTool({ name: 'add_comment', arguments: { taskId: task.id, content: 'hi' } });
+      expect(JSON.parse((first.content as Array<{ text: string }>)[0].text).authorId).toBe('mcp-agent');
+
+      const namedClient = await connect({ engine, actor: { userId: 'claude', actorType: 'agent' } });
+      const second = await namedClient.callTool({ name: 'add_comment', arguments: { taskId: task.id, content: 'hi' } });
+      expect(JSON.parse((second.content as Array<{ text: string }>)[0].text).authorId).toBe('claude');
     });
 
     it('marks destructive tools with MCP annotations', async () => {

package/src/server/index.ts

@@ -10,7 +10,7 @@ import {
   ErrorCode,
   McpError
 } from '@modelcontextprotocol/sdk/types.js';
-import type { CriticalPathEngine } from '@critical-path/core';
+import type { Actor, CriticalPathEngine } from '@critical-path/core';
 import type { CriticalPathClient } from '@critical-path/client';
 import { ALL_TOOLS, parseToolArgs, type BackendContext } from '../tools/definitions.js';
 
@@ -20,10 +20,20 @@ export interface CriticalPathMcpServerOptions {
   name?: string;
   version?: string;
   tools?: string[];
+  /**
+   * Identity that changes made through an `engine` are attributed to (activity log, comment
+   * authors, ...). Defaults to `DEFAULT_MCP_ACTOR`. With a `client`, identity comes from the API's
+   * authentication (e.g. the `Authorization` header passed to the client) instead.
+   */
+  actor?: Actor;
 }
 
+export const DEFAULT_MCP_ACTOR: Actor = Object.freeze({ userId: 'mcp-agent', username: 'MCP Agent', actorType: 'agent' });
+
 export function createCriticalPathMcpServer(options: CriticalPathMcpServerOptions): Server {
-  const target: BackendContext | undefined = options.engine || options.client;
+  const target: BackendContext | undefined = options.engine
+    ? options.engine.withActor(options.actor ?? DEFAULT_MCP_ACTOR)
+    : options.client;
   if (!target) {
     throw new Error('Either engine or client must be provided to createCriticalPathMcpServer.');
   }

package/src/tools/definitions.test.ts

@@ -2,8 +2,8 @@ import { describe, it, expect } from 'vitest';
 import { ALL_TOOLS } from './definitions.js';
 
 describe('MCP tool definitions', () => {
-  // Tool arguments are parsed with zodSchema before execution (unknown keys are stripped),
-  // while clients see inputSchema. The two must describe the same fields.
+  // inputSchema is generated from zodSchema by defineTool; this guards the generation itself
+  // (e.g. a zod feature that zod-to-json-schema cannot express would drop fields here).
   it.each(ALL_TOOLS.map((t) => [t.name, t] as const))('%s: zodSchema and inputSchema agree', (_name, tool) => {
     const json = tool.inputSchema as { properties?: Record<string, unknown>; required?: string[] };
     const shape = tool.zodSchema.shape as Record<string, { isOptional(): boolean }>;
@@ -16,4 +16,14 @@ describe('MCP tool definitions', () => {
         .sort()
     ).toEqual([...(json.required ?? [])].sort());
   });
+
+  it('generates closed object schemas with descriptions for every tool', () => {
+    for (const tool of ALL_TOOLS) {
+      expect(tool.inputSchema).toMatchObject({ type: 'object', additionalProperties: false });
+      expect(tool.inputSchema).not.toHaveProperty('$schema');
+    }
+    const updateTask = ALL_TOOLS.find((t) => t.name === 'update_task')!;
+    expect((updateTask.inputSchema as any).properties.isBlocked.description).toBe('Whether the task is blocked');
+  });
 });
+