@datacules/agent-identity-mcp 0.10.0 → 0.11.1

package/dist/esm/index.js

@@ -0,0 +1,161 @@
+/**
+ * @datacules/agent-identity-mcp
+ *
+ * Exposes agent-identity credential resolution as an MCP server.
+ * Any MCP-capable client — Claude Desktop, Claude Code, Cursor,
+ * Windsurf, or a custom agent — can call the following tools:
+ *
+ *   resolve_credential           — resolves a credential for an AgentRequestContext
+ *   resolve_migration_credential — resolves source+target pair for MigrationContext
+ *   list_credentials             — lists active credentials (safe metadata only)
+ *   list_rules                   — lists routing rules (highest priority first)
+ *   health                       — liveness + loaded credential/rule counts
+ *
+ * Supports two transports:
+ *   stdio    — stdin/stdout, compatible with Claude Desktop / Claude Code / Cursor configs
+ *   http+sse — HTTP Server-Sent Events for hosted deployments
+ *
+ * Quick start (stdio):
+ *   import { createAgentIdentityMcpServer } from '@datacules/agent-identity-mcp';
+ *   const { start } = createAgentIdentityMcpServer({ credentials, rules });
+ *   await start();  // reads from stdin, writes to stdout
+ *
+ * Quick start (HTTP):
+ *   const { start } = createAgentIdentityMcpServer({
+ *     credentials, rules, transport: 'http', httpPort: 3002
+ *   });
+ *   await start();
+ *
+ * Claude Desktop config snippet (~/.claude/claude_desktop_config.json):
+ *   {
+ *     "mcpServers": {
+ *       "agent-identity": {
+ *         "command": "npx",
+ *         "args": ["@datacules/agent-identity-mcp"],
+ *         "env": {
+ *           "AGENT_IDENTITY_CREDENTIALS": "<base64-encoded JSON>",
+ *           "AGENT_IDENTITY_RULES": "<base64-encoded JSON>"
+ *         }
+ *       }
+ *     }
+ *   }
+ */
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { CallToolRequestSchema, ListToolsRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
+import { MemoryCredentialStore } from '@datacules/agent-identity';
+import { ALL_TOOLS } from './tools.js';
+import { StdioServerTransport, startHttpMcpTransport } from './transports.js';
+export * from './types.js';
+export { ALL_TOOLS } from './tools.js';
+/**
+ * Create an agent-identity MCP server.
+ *
+ * @example
+ * // stdio (Claude Desktop / Claude Code config)
+ * const { start } = createAgentIdentityMcpServer({ credentials, rules });
+ * await start();
+ *
+ * @example
+ * // HTTP+SSE (hosted / networked)
+ * const { start } = createAgentIdentityMcpServer({
+ *   credentials, rules, transport: 'http', httpPort: 3002,
+ * });
+ * await start();
+ */
+export function createAgentIdentityMcpServer(config) {
+    const { credentials, store: customStore, rules, logger, name = 'agent-identity', version = '0.1.0', transport = 'stdio', httpPort = 3002, httpHost = '127.0.0.1', httpAuthToken, } = config;
+    if (!customStore && !credentials) {
+        throw new Error('[agent-identity-mcp] Provide either credentials[] or a custom store.');
+    }
+    const store = customStore ?? new MemoryCredentialStore(credentials);
+    const deps = { store, rules, logger };
+    // Build the MCP server
+    const server = new Server({ name, version }, { capabilities: { tools: {} } });
+    // Register tools/list handler
+    server.setRequestHandler(ListToolsRequestSchema, async () => ({
+        tools: ALL_TOOLS.map((t) => ({
+            name: t.name,
+            description: t.description,
+            inputSchema: {
+                type: 'object',
+                // Convert Zod schema to JSON Schema via .shape introspection for
+                // simple objects; complex schemas fall back to an open object.
+                properties: extractJsonSchemaProperties(t.inputSchema),
+                required: extractRequiredKeys(t.inputSchema),
+            },
+        })),
+    }));
+    // Register tools/call handler
+    server.setRequestHandler(CallToolRequestSchema, async (request) => {
+        const tool = ALL_TOOLS.find((t) => t.name === request.params.name);
+        if (!tool) {
+            return {
+                content: [{ type: 'text', text: JSON.stringify({ error: `Unknown tool: ${request.params.name}` }) }],
+                isError: true,
+            };
+        }
+        return tool.handler(request.params.arguments ?? {}, deps);
+    });
+    let stopFn = null;
+    const start = async () => {
+        if (transport === 'stdio') {
+            const stdioTransport = new StdioServerTransport();
+            await server.connect(stdioTransport);
+        }
+        else {
+            stopFn = await startHttpMcpTransport({
+                server,
+                port: httpPort,
+                host: httpHost,
+                authToken: httpAuthToken,
+            });
+        }
+    };
+    const stop = async () => {
+        stopFn?.();
+        await server.close();
+    };
+    return { server, start, stop };
+}
+// ─── JSON Schema helpers (lightweight — no ajv dependency) ───────────────────
+function extractJsonSchemaProperties(schema) {
+    try {
+        const shape = schema?._def?.shape?.() ?? schema?.shape ?? {};
+        const props = {};
+        for (const [key, val] of Object.entries(shape)) {
+            props[key] = zodToJsonSchemaNode(val);
+        }
+        return props;
+    }
+    catch {
+        return {};
+    }
+}
+function extractRequiredKeys(schema) {
+    try {
+        const shape = schema?._def?.shape?.() ?? schema?.shape ?? {};
+        return Object.entries(shape)
+            .filter(([, v]) => {
+            const typeName = v?._def?.typeName;
+            return typeName !== 'ZodOptional' && typeName !== 'ZodDefault';
+        })
+            .map(([k]) => k);
+    }
+    catch {
+        return [];
+    }
+}
+function zodToJsonSchemaNode(zodNode) {
+    const typeName = zodNode?._def?.typeName;
+    switch (typeName) {
+        case 'ZodString': return { type: 'string' };
+        case 'ZodNumber': return { type: 'number' };
+        case 'ZodBoolean': return { type: 'boolean' };
+        case 'ZodEnum': return { type: 'string', enum: zodNode._def.values };
+        case 'ZodOptional':
+        case 'ZodDefault': return zodToJsonSchemaNode(zodNode._def.innerType);
+        case 'ZodObject': return { type: 'object', properties: extractJsonSchemaProperties(zodNode) };
+        default: return { type: 'string' };
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,SAAS,EAAiB,MAAM,YAAY,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAG9E,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AA2BvC;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,4BAA4B,CAC1C,MAAoC;IAEpC,MAAM,EACJ,WAAW,EACX,KAAK,EAAE,WAAW,EAClB,KAAK,EACL,MAAM,EACN,IAAI,GAAG,gBAAgB,EACvB,OAAO,GAAG,OAAO,EACjB,SAAS,GAAG,OAAO,EACnB,QAAQ,GAAG,IAAI,EACf,QAAQ,GAAG,WAAW,EACtB,aAAa,GACd,GAAG,MAAM,CAAC;IAEX,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,KAAK,GACT,WAAW,IAAI,IAAI,qBAAqB,CAAC,WAAY,CAAC,CAAC;IAEzD,MAAM,IAAI,GAAa,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAEhD,uBAAuB;IACvB,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,OAAO,EAAE,EACjB,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;IAEF,8BAA8B;IAC9B,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5D,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3B,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,WAAW,EAAE;gBACX,IAAI,EAAE,QAAiB;gBACvB,iEAAiE;gBACjE,+DAA+D;gBAC/D,UAAU,EAAE,2BAA2B,CAAC,CAAC,CAAC,WAAW,CAAC;gBACtD,QAAQ,EAAE,mBAAmB,CAAC,CAAC,CAAC,WAAW,CAAC;aAC7C;SACF,CAAC,CAAC;KACJ,CAAC,CAAC,CAAC;IAEJ,8BAA8B;IAC9B,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChE,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;gBAC7G,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,IAAI,MAAM,GAAwB,IAAI,CAAC;IAEvC,MAAM,KAAK,GAAG,KAAK,IAAmB,EAAE;QACtC,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YAC1B,MAAM,cAAc,GAAG,IAAI,oBAAoB,EAAE,CAAC;YAClD,MAAM,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,MAAM,qBAAqB,CAAC;gBACnC,MAAM;gBACN,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,QAAQ;gBACd,SAAS,EAAE,aAAa;aACzB,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;QACrC,MAAM,EAAE,EAAE,CAAC;QACX,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC;IAEF,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,gFAAgF;AAEhF,SAAS,2BAA2B,CAAC,MAAW;IAC9C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC;QAC7D,MAAM,KAAK,GAA4B,EAAE,CAAC;QAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/C,KAAK,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAW;IACtC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC;QAC7D,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;aACzB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAgB,EAAE,EAAE;YAC/B,MAAM,QAAQ,GAAG,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC;YACnC,OAAO,QAAQ,KAAK,aAAa,IAAI,QAAQ,KAAK,YAAY,CAAC;QACjE,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAY;IACvC,MAAM,QAAQ,GAAG,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC;IACzC,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,WAAW,CAAC,CAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC7C,KAAK,WAAW,CAAC,CAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC7C,KAAK,YAAY,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC9C,KAAK,SAAS,CAAC,CAAI,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACxE,KAAK,aAAa,CAAC;QACnB,KAAK,YAAY,CAAC,CAAC,OAAO,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtE,KAAK,WAAW,CAAC,CAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,2BAA2B,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/F,OAAO,CAAC,CAAW,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC/C,CAAC;AACH,CAAC"}

package/dist/esm/tools.js

@@ -0,0 +1,163 @@
+/**
+ * MCP tool handler implementations for @datacules/agent-identity.
+ *
+ * Each exported function corresponds to one MCP tool:
+ *   resolve_credential        — resolves credential for AgentRequestContext
+ *   resolve_migration_credential — resolves source+target pair for MigrationContext
+ *   list_credentials          — lists active credentials (safe metadata, no raw refs)
+ *   list_rules                — lists routing rules
+ *   health                    — liveness check
+ *
+ * Tool schemas use Zod and are exported as McpToolSchema objects so the
+ * server index can register them with a single loop.
+ */
+import { z } from 'zod';
+import { createRouterFromStore } from '@datacules/agent-identity';
+// ─── Shared Zod schemas ───────────────────────────────────────────────────────
+const SupportedProviderSchema = z.enum(['openai', 'anthropic', 'gemini', 'mistral', 'local']);
+const ResourceKindSchema = z.enum(['shared', 'personal']);
+const MigrationPhaseSchema = z.enum(['dry-run', 'extract', 'transform', 'load', 'verify', 'rollback']);
+const BaseContextSchema = z.object({
+    userId: z.string().min(1),
+    resourceId: z.string().min(1),
+    resourceKind: ResourceKindSchema,
+    provider: SupportedProviderSchema,
+    model: z.string().min(1),
+    action: z.string().min(1),
+    traceId: z.string().min(1),
+    sessionId: z.string().optional(),
+    requestedAt: z.string().optional(),
+    parentTraceId: z.string().optional(),
+    mcpSessionId: z.string().optional(),
+    mcpClientId: z.string().optional(),
+});
+const ResolveCredentialSchema = BaseContextSchema;
+const ResolveMigrationSchema = BaseContextSchema.extend({
+    migrationId: z.string().min(1),
+    phase: MigrationPhaseSchema,
+    sourceResourceId: z.string().min(1),
+    targetResourceId: z.string().min(1),
+    batchIndex: z.number().int().nonnegative().optional(),
+    totalBatches: z.number().int().positive().optional(),
+    dryRun: z.boolean(),
+});
+// ─── Helper ───────────────────────────────────────────────────────────────────
+function ok(data) {
+    return { content: [{ type: 'text', text: JSON.stringify(data, null, 2) }] };
+}
+function err(message) {
+    return { content: [{ type: 'text', text: JSON.stringify({ error: message }) }], isError: true };
+}
+// ─── resolve_credential ───────────────────────────────────────────────────────
+const resolveCredentialTool = {
+    name: 'resolve_credential',
+    description: 'Resolve the correct credential for an agent request. ' +
+        'Provide the full AgentRequestContext (userId, resourceId, resourceKind, provider, model, action, traceId). ' +
+        'Returns the resolved credential metadata — never the raw secret.',
+    inputSchema: ResolveCredentialSchema,
+    async handler(input, { store, rules, logger }) {
+        const parsed = ResolveCredentialSchema.safeParse(input);
+        if (!parsed.success)
+            return err(`Validation error: ${parsed.error.message}`);
+        const ctx = {
+            ...parsed.data,
+            requestedAt: parsed.data.requestedAt ?? new Date().toISOString(),
+        };
+        const router = createRouterFromStore(store, rules, logger);
+        const resolved = router.resolve(ctx);
+        if (!resolved)
+            return err('No credential resolved — no routing rule matched this context.');
+        return ok({
+            ok: true,
+            credentialId: resolved.credentialId,
+            kind: resolved.kind,
+            resolvedFor: resolved.resolvedFor,
+            // ref is intentionally omitted — never surface raw refs over MCP
+        });
+    },
+};
+// ─── resolve_migration_credential ─────────────────────────────────────────────
+const resolveMigrationCredentialTool = {
+    name: 'resolve_migration_credential',
+    description: 'Resolve source and target credentials for a data migration workflow. ' +
+        'Requires a full MigrationContext including migrationId, phase, sourceResourceId, targetResourceId, and dryRun flag. ' +
+        'Returns both resolved credential metadata objects — never raw secrets.',
+    inputSchema: ResolveMigrationSchema,
+    async handler(input, { store, rules, logger }) {
+        const parsed = ResolveMigrationSchema.safeParse(input);
+        if (!parsed.success)
+            return err(`Validation error: ${parsed.error.message}`);
+        const ctx = {
+            ...parsed.data,
+            requestedAt: parsed.data.requestedAt ?? new Date().toISOString(),
+        };
+        const router = createRouterFromStore(store, rules, logger);
+        const pair = router.resolvePair(ctx);
+        if (!pair)
+            return err('No credential pair resolved — check that routing rules cover both sourceResourceId and targetResourceId.');
+        return ok({
+            ok: true,
+            migrationId: pair.migrationId,
+            source: { credentialId: pair.source.credentialId, kind: pair.source.kind, resolvedFor: pair.source.resolvedFor },
+            target: { credentialId: pair.target.credentialId, kind: pair.target.kind, resolvedFor: pair.target.resolvedFor },
+            expiresAt: pair.expiresAt ?? null,
+        });
+    },
+};
+// ─── list_credentials ─────────────────────────────────────────────────────────
+const listCredentialsTool = {
+    name: 'list_credentials',
+    description: 'List all active credentials registered with this agent-identity server. ' +
+        'Returns safe metadata only (id, kind, name, scope, status, expiresAt). ' +
+        'Raw refs and secrets are never included.',
+    inputSchema: z.object({
+        kind: z.enum(['fixed', 'user-delegated']).optional().describe('Filter by credential kind'),
+    }),
+    async handler(input, { store }) {
+        const parsed = z.object({ kind: z.enum(['fixed', 'user-delegated']).optional() }).safeParse(input);
+        if (!parsed.success)
+            return err(`Validation error: ${parsed.error.message}`);
+        const creds = parsed.data.kind
+            ? await store.listByKind(parsed.data.kind)
+            : await store.listActive();
+        const safe = creds.map(({ id, kind, name, scope, status, expiresAt }) => ({
+            id, kind, name, scope, status, expiresAt: expiresAt ?? null,
+        }));
+        return ok({ count: safe.length, credentials: safe });
+    },
+};
+// ─── list_rules ───────────────────────────────────────────────────────────────
+const listRulesTool = {
+    name: 'list_rules',
+    description: 'List all routing rules registered with this agent-identity server, ' +
+        'ordered by priority (highest first). Useful for debugging credential routing.',
+    inputSchema: z.object({}),
+    async handler(_input, { rules }) {
+        const sorted = [...rules].sort((a, b) => b.priority - a.priority);
+        return ok({ count: sorted.length, rules: sorted });
+    },
+};
+// ─── health ───────────────────────────────────────────────────────────────────
+const healthTool = {
+    name: 'health',
+    description: 'Check whether the agent-identity MCP server is healthy and how many credentials/rules are loaded.',
+    inputSchema: z.object({}),
+    async handler(_input, { store, rules }) {
+        const active = await store.listActive();
+        return ok({
+            status: 'ok',
+            credentialsLoaded: active.length,
+            rulesLoaded: rules.length,
+            timestamp: new Date().toISOString(),
+        });
+    },
+};
+// ─── Export all tools ─────────────────────────────────────────────────────────
+export const ALL_TOOLS = [
+    resolveCredentialTool,
+    resolveMigrationCredentialTool,
+    listCredentialsTool,
+    listRulesTool,
+    healthTool,
+];
+//# sourceMappingURL=tools.js.map

package/dist/esm/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../src/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAyB,MAAM,2BAA2B,CAAC;AAQzF,iFAAiF;AAEjF,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;AAC9F,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;AAC1D,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;AAEvG,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,YAAY,EAAE,kBAAkB;IAChC,QAAQ,EAAE,uBAAuB;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAEH,MAAM,uBAAuB,GAAG,iBAAiB,CAAC;AAElD,MAAM,sBAAsB,GAAG,iBAAiB,CAAC,MAAM,CAAC;IACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,KAAK,EAAE,oBAAoB;IAC3B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACrD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACpD,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;CACpB,CAAC,CAAC;AAuBH,iFAAiF;AAEjF,SAAS,EAAE,CAAC,IAAa;IACvB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED,SAAS,GAAG,CAAC,OAAe;IAC1B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAClG,CAAC;AAED,iFAAiF;AAEjF,MAAM,qBAAqB,GAAsB;IAC/C,IAAI,EAAE,oBAAoB;IAC1B,WAAW,EACT,uDAAuD;QACvD,6GAA6G;QAC7G,kEAAkE;IACpE,WAAW,EAAE,uBAAuB;IACpC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE;QAC3C,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,GAAG,CAAC,qBAAqB,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAE7E,MAAM,GAAG,GAAG;YACV,GAAG,MAAM,CAAC,IAAI;YACd,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACjE,CAAC;QAEF,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,QAAQ;YAAE,OAAO,GAAG,CAAC,gEAAgE,CAAC,CAAC;QAE5F,OAAO,EAAE,CAAC;YACR,EAAE,EAAE,IAAI;YACR,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,iEAAiE;SAClE,CAAC,CAAC;IACL,CAAC;CACF,CAAC;AAEF,iFAAiF;AAEjF,MAAM,8BAA8B,GAAsB;IACxD,IAAI,EAAE,8BAA8B;IACpC,WAAW,EACT,uEAAuE;QACvE,sHAAsH;QACtH,wEAAwE;IAC1E,WAAW,EAAE,sBAAsB;IACnC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE;QAC3C,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,GAAG,CAAC,qBAAqB,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAE7E,MAAM,GAAG,GAAG;YACV,GAAG,MAAM,CAAC,IAAI;YACd,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACjE,CAAC;QAEF,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI;YAAE,OAAO,GAAG,CAAC,0GAA0G,CAAC,CAAC;QAElI,OAAO,EAAE,CAAC;YACR,EAAE,EAAE,IAAI;YACR,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,MAAM,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE;YAChH,MAAM,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE;YAChH,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;SAClC,CAAC,CAAC;IACL,CAAC;CACF,CAAC;AAEF,iFAAiF;AAEjF,MAAM,mBAAmB,GAAsB;IAC7C,IAAI,EAAE,kBAAkB;IACxB,WAAW,EACT,0EAA0E;QAC1E,yEAAyE;QACzE,0CAA0C;IAC5C,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2BAA2B,CAAC;KAC3F,CAAC;IACF,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE;QAC5B,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACnG,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,GAAG,CAAC,qBAAqB,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAE7E,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI;YAC5B,CAAC,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;YAC1C,CAAC,CAAC,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC;QAE7B,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;YACxE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,IAAI,IAAI;SAC5D,CAAC,CAAC,CAAC;QAEJ,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;CACF,CAAC;AAEF,iFAAiF;AAEjF,MAAM,aAAa,GAAsB;IACvC,IAAI,EAAE,YAAY;IAClB,WAAW,EACT,qEAAqE;QACrE,+EAA+E;IACjF,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;IACzB,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE;QAC7B,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;QAClE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACrD,CAAC;CACF,CAAC;AAEF,iFAAiF;AAEjF,MAAM,UAAU,GAAsB;IACpC,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,mGAAmG;IAChH,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;IACzB,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;QACpC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC;QACxC,OAAO,EAAE,CAAC;YACR,MAAM,EAAE,IAAI;YACZ,iBAAiB,EAAE,MAAM,CAAC,MAAM;YAChC,WAAW,EAAE,KAAK,CAAC,MAAM;YACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;IACL,CAAC;CACF,CAAC;AAEF,iFAAiF;AAEjF,MAAM,CAAC,MAAM,SAAS,GAAwB;IAC5C,qBAAqB;IACrB,8BAA8B;IAC9B,mBAAmB;IACnB,aAAa;IACb,UAAU;CACX,CAAC"}

package/dist/esm/transports.js

@@ -0,0 +1,88 @@
+/**
+ * Transport helpers for @datacules/agent-identity-mcp.
+ *
+ * Provides two transports:
+ *   - StdioServerTransport  : stdin/stdout, for Claude Desktop / Claude Code / Cursor config
+ *   - createHttpMcpTransport: HTTP + SSE, for hosted / networked deployments
+ *
+ * The HTTP transport adds optional bearer-token auth. The SSE endpoint at
+ * GET /sse initialises a session; the message endpoint at POST /messages
+ * receives client tool calls and posts responses back over the SSE stream.
+ */
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { SSEServerTransport } from '@modelcontextprotocol/sdk/server/sse.js';
+export { StdioServerTransport };
+/**
+ * Start an HTTP + SSE MCP transport.
+ *
+ * Session lifecycle:
+ *   1. Client opens GET /sse — transport creates an SSEServerTransport,
+ *      connects it to the MCP Server, and starts streaming.
+ *   2. Client POSTs tool calls to POST /messages?sessionId=<id>.
+ *   3. Transport routes each message to the correct session and replies
+ *      via the open SSE stream.
+ *
+ * Returns a cleanup function that closes the HTTP server.
+ */
+export async function startHttpMcpTransport(options) {
+    const { server, port = 3002, host = '127.0.0.1', authToken } = options;
+    // Session registry: sessionId → active SSEServerTransport
+    const sessions = new Map();
+    const http = await import('node:http');
+    function authenticate(req, res) {
+        if (!authToken)
+            return true;
+        const header = req.headers['authorization'] ?? '';
+        if (header === `Bearer ${authToken}`)
+            return true;
+        res.writeHead(401, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Unauthorized — valid Bearer token required' }));
+        return false;
+    }
+    const httpServer = http.createServer(async (req, res) => {
+        const url = new URL(req.url ?? '/', `http://${host}:${port}`);
+        // CORS for browser-based MCP clients
+        res.setHeader('Access-Control-Allow-Origin', '*');
+        res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
+        res.setHeader('Access-Control-Allow-Headers', 'Authorization, Content-Type');
+        if (req.method === 'OPTIONS') {
+            res.writeHead(204);
+            res.end();
+            return;
+        }
+        if (!authenticate(req, res))
+            return;
+        // ── SSE session init ──────────────────────────────────────────────────
+        if (req.method === 'GET' && url.pathname === '/sse') {
+            const transport = new SSEServerTransport('/messages', res);
+            sessions.set(transport.sessionId, transport);
+            req.on('close', () => sessions.delete(transport.sessionId));
+            await server.connect(transport);
+            return;
+        }
+        // ── Incoming tool call message ────────────────────────────────────────
+        if (req.method === 'POST' && url.pathname === '/messages') {
+            const sessionId = url.searchParams.get('sessionId') ?? '';
+            const transport = sessions.get(sessionId);
+            if (!transport) {
+                res.writeHead(404, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: `Session ${sessionId} not found or expired` }));
+                return;
+            }
+            await transport.handlePostMessage(req, res);
+            return;
+        }
+        // ── Health probe (GET /) ──────────────────────────────────────────────
+        if (req.method === 'GET' && url.pathname === '/') {
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ ok: true, sessions: sessions.size, transport: 'http+sse' }));
+            return;
+        }
+        res.writeHead(404);
+        res.end();
+    });
+    await new Promise((resolve) => httpServer.listen(port, host, resolve));
+    console.error(`[agent-identity-mcp] HTTP+SSE transport listening on http://${host}:${port}`);
+    return () => httpServer.close();
+}
+//# sourceMappingURL=transports.js.map

package/dist/esm/transports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transports.js","sourceRoot":"","sources":["../../src/transports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAI7E,OAAO,EAAE,oBAAoB,EAAE,CAAC;AAoBhC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAgC;IAC1E,MAAM,EAAE,MAAM,EAAE,IAAI,GAAG,IAAI,EAAE,IAAI,GAAG,WAAW,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAEvE,0DAA0D;IAC1D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA8B,CAAC;IAEvD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAEvC,SAAS,YAAY,CAAC,GAAoB,EAAE,GAAmB;QAC7D,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5B,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,MAAM,KAAK,UAAU,SAAS,EAAE;YAAE,OAAO,IAAI,CAAC;QAClD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC,CAAC,CAAC;QACjF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAE,EAAE;QACvF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;QAE9D,qCAAqC;QACrC,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;QAClD,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,oBAAoB,CAAC,CAAC;QACpE,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,6BAA6B,CAAC,CAAC;QAC7E,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QAExE,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO;QAEpC,yEAAyE;QACzE,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YACpD,MAAM,SAAS,GAAG,IAAI,kBAAkB,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YAC3D,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAE7C,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;YAE5D,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;QAED,yEAAyE;QACzE,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC1D,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YAC1D,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAE1C,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,SAAS,uBAAuB,EAAE,CAAC,CAAC,CAAC;gBAChF,OAAO;YACT,CAAC;YAED,MAAM,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC5C,OAAO;QACT,CAAC;QAED,yEAAyE;QACzE,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;YACjD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;YACtF,OAAO;QACT,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAAC,GAAG,CAAC,GAAG,EAAE,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7E,OAAO,CAAC,KAAK,CAAC,+DAA+D,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;IAE7F,OAAO,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;AAClC,CAAC"}

package/dist/esm/types.js

@@ -0,0 +1,9 @@
+/**
+ * MCP-specific type extensions for @datacules/agent-identity.
+ *
+ * McpRequestContext extends AgentRequestContext with the MCP session and
+ * client identifiers so audit logs can trace a credential resolution back
+ * to the exact MCP session that triggered it.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/esm/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/dist/types/index.d.ts

@@ -0,0 +1,84 @@
+/**
+ * @datacules/agent-identity-mcp
+ *
+ * Exposes agent-identity credential resolution as an MCP server.
+ * Any MCP-capable client — Claude Desktop, Claude Code, Cursor,
+ * Windsurf, or a custom agent — can call the following tools:
+ *
+ *   resolve_credential           — resolves a credential for an AgentRequestContext
+ *   resolve_migration_credential — resolves source+target pair for MigrationContext
+ *   list_credentials             — lists active credentials (safe metadata only)
+ *   list_rules                   — lists routing rules (highest priority first)
+ *   health                       — liveness + loaded credential/rule counts
+ *
+ * Supports two transports:
+ *   stdio    — stdin/stdout, compatible with Claude Desktop / Claude Code / Cursor configs
+ *   http+sse — HTTP Server-Sent Events for hosted deployments
+ *
+ * Quick start (stdio):
+ *   import { createAgentIdentityMcpServer } from '@datacules/agent-identity-mcp';
+ *   const { start } = createAgentIdentityMcpServer({ credentials, rules });
+ *   await start();  // reads from stdin, writes to stdout
+ *
+ * Quick start (HTTP):
+ *   const { start } = createAgentIdentityMcpServer({
+ *     credentials, rules, transport: 'http', httpPort: 3002
+ *   });
+ *   await start();
+ *
+ * Claude Desktop config snippet (~/.claude/claude_desktop_config.json):
+ *   {
+ *     "mcpServers": {
+ *       "agent-identity": {
+ *         "command": "npx",
+ *         "args": ["@datacules/agent-identity-mcp"],
+ *         "env": {
+ *           "AGENT_IDENTITY_CREDENTIALS": "<base64-encoded JSON>",
+ *           "AGENT_IDENTITY_RULES": "<base64-encoded JSON>"
+ *         }
+ *       }
+ *     }
+ *   }
+ */
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import type { AuditLogger, Credential, CredentialStore, RoutingRule } from '@datacules/agent-identity';
+import type { AgentIdentityMcpServerOptions } from './types.js';
+export * from './types.js';
+export { ALL_TOOLS } from './tools.js';
+export interface AgentIdentityMcpServerInit {
+    /**
+     * Credential array (convenience). Wrapped in a MemoryCredentialStore
+     * unless `store` is also provided, in which case `store` takes precedence.
+     */
+    credentials?: Credential[];
+    /** Custom CredentialStore (e.g. VaultCredentialStore, AwsCredentialStore) */
+    store?: CredentialStore;
+    rules: RoutingRule[];
+    logger?: AuditLogger;
+}
+export type AgentIdentityMcpServerConfig = AgentIdentityMcpServerInit & AgentIdentityMcpServerOptions;
+export interface AgentIdentityMcpServerHandle {
+    /** MCP Server instance (use to attach additional request handlers if needed) */
+    server: Server;
+    /** Start the server and connect the configured transport. Resolves when ready. */
+    start: () => Promise<void>;
+    /** Stop / clean up (closes HTTP server for http transport; no-op for stdio) */
+    stop: () => Promise<void>;
+}
+/**
+ * Create an agent-identity MCP server.
+ *
+ * @example
+ * // stdio (Claude Desktop / Claude Code config)
+ * const { start } = createAgentIdentityMcpServer({ credentials, rules });
+ * await start();
+ *
+ * @example
+ * // HTTP+SSE (hosted / networked)
+ * const { start } = createAgentIdentityMcpServer({
+ *   credentials, rules, transport: 'http', httpPort: 3002,
+ * });
+ * await start();
+ */
+export declare function createAgentIdentityMcpServer(config: AgentIdentityMcpServerConfig): AgentIdentityMcpServerHandle;
+//# sourceMappingURL=index.d.ts.map

package/dist/types/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAKnE,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAIvG,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,YAAY,CAAC;AAEhE,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAIvC,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;IAC3B,6EAA6E;IAC7E,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,MAAM,4BAA4B,GAAG,0BAA0B,GAAG,6BAA6B,CAAC;AAEtG,MAAM,WAAW,4BAA4B;IAC3C,gFAAgF;IAChF,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,+EAA+E;IAC/E,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,4BAA4B,GACnC,4BAA4B,CA8E9B"}

package/dist/types/tools.d.ts

@@ -0,0 +1,36 @@
+/**
+ * MCP tool handler implementations for @datacules/agent-identity.
+ *
+ * Each exported function corresponds to one MCP tool:
+ *   resolve_credential        — resolves credential for AgentRequestContext
+ *   resolve_migration_credential — resolves source+target pair for MigrationContext
+ *   list_credentials          — lists active credentials (safe metadata, no raw refs)
+ *   list_rules                — lists routing rules
+ *   health                    — liveness check
+ *
+ * Tool schemas use Zod and are exported as McpToolSchema objects so the
+ * server index can register them with a single loop.
+ */
+import { z } from 'zod';
+import type { AuditLogger, CredentialStore, RoutingRule } from '@datacules/agent-identity';
+export interface McpToolDefinition {
+    name: string;
+    description: string;
+    inputSchema: z.ZodTypeAny;
+    handler: (input: unknown, deps: ToolDeps) => Promise<McpToolResult>;
+}
+export interface McpToolResult {
+    content: Array<{
+        type: 'text';
+        text: string;
+    }>;
+    isError?: boolean;
+    [key: string]: unknown;
+}
+export interface ToolDeps {
+    store: CredentialStore;
+    rules: RoutingRule[];
+    logger?: AuditLogger;
+}
+export declare const ALL_TOOLS: McpToolDefinition[];
+//# sourceMappingURL=tools.d.ts.map

package/dist/types/tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../src/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EACV,WAAW,EAEX,eAAe,EACf,WAAW,EACZ,MAAM,2BAA2B,CAAC;AAqCnC,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC;IAC1B,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;CACrE;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,eAAe,CAAC;IACvB,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAwID,eAAO,MAAM,SAAS,EAAE,iBAAiB,EAMxC,CAAC"}

package/dist/types/transports.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Transport helpers for @datacules/agent-identity-mcp.
+ *
+ * Provides two transports:
+ *   - StdioServerTransport  : stdin/stdout, for Claude Desktop / Claude Code / Cursor config
+ *   - createHttpMcpTransport: HTTP + SSE, for hosted / networked deployments
+ *
+ * The HTTP transport adds optional bearer-token auth. The SSE endpoint at
+ * GET /sse initialises a session; the message endpoint at POST /messages
+ * receives client tool calls and posts responses back over the SSE stream.
+ */
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import type { Server } from '@modelcontextprotocol/sdk/server/index.js';
+export { StdioServerTransport };
+export interface HttpMcpTransportOptions {
+    /** MCP Server instance to connect the transport to */
+    server: Server;
+    /** TCP port to listen on (default: 3002) */
+    port?: number;
+    /** Bind address (default: '127.0.0.1') */
+    host?: string;
+    /**
+     * Optional static bearer token.
+     * Requests without a matching Authorization: Bearer <token> header are
+     * rejected with 401. Omit to allow unauthenticated connections (only
+     * appropriate on a private network / localhost).
+     */
+    authToken?: string;
+}
+/**
+ * Start an HTTP + SSE MCP transport.
+ *
+ * Session lifecycle:
+ *   1. Client opens GET /sse — transport creates an SSEServerTransport,
+ *      connects it to the MCP Server, and starts streaming.
+ *   2. Client POSTs tool calls to POST /messages?sessionId=<id>.
+ *   3. Transport routes each message to the correct session and replies
+ *      via the open SSE stream.
+ *
+ * Returns a cleanup function that closes the HTTP server.
+ */
+export declare function startHttpMcpTransport(options: HttpMcpTransportOptions): Promise<() => void>;
+//# sourceMappingURL=transports.d.ts.map

package/dist/types/transports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transports.d.ts","sourceRoot":"","sources":["../../src/transports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAEjF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAGxE,OAAO,EAAE,oBAAoB,EAAE,CAAC;AAIhC,MAAM,WAAW,uBAAuB;IACtC,sDAAsD;IACtD,MAAM,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAoEjG"}