@ductape/mcp 0.2.11 → 0.2.13

package/CHANGELOG.md

@@ -6,6 +6,7 @@
 
 ## Unreleased
 
+- Mark `ductape_function_setup` as read-only, non-destructive, idempotent, and closed-world in both MCP registration APIs so hosts do not incorrectly require mutation approval for its pure setup-plan generation.
 - Broadened Feature guidance from durable/event-driven workflows to synchronous or asynchronous named product capabilities.
 - Added evidence-backed `FEATURE`, `FEATURE_STEP`, `DOMAIN_SERVICE`, `UTILITY`, and `INFRASTRUCTURE_ADAPTER` classification guidance.
 - Added synchronous multi-step examples and repository discovery/grouping rules.

package/dist/index.js

@@ -98,7 +98,7 @@ There are THREE categories of operations. Use the right tool for each:
 
        RESOLVING "No linked project" ERRORS:
        Some commands (declarative sync below, db migrate/schema, products environments *) need a
-       linked project — a local .ductape/config.json with a product tag and env slug. The "link"
+       linked project — a local ductape/config.json with a product tag and env slug. The "link"
        command does NOT validate against the server: it just writes that local file. This means you
        can run ductape_cli("link --product <tag> --env <slug>") even before that environment exists on
        the product yet — do not treat "no linked environment exists server-side" as a reason to avoid
@@ -1468,6 +1468,15 @@ const portableFunctionSetupInputSchema = z.object({
     version: z.string().min(1).describe('Contract version.'),
     operations: z.array(z.string().min(1)).min(1).describe('Operation names that must be registered and exposed.'),
 });
+// This tool only derives setup instructions from its arguments. It performs no network request,
+// filesystem write, process launch, registration, deployment, or infrastructure provisioning.
+// Declare that explicitly so MCP hosts do not send it through mutation approval workflows.
+const portableFunctionSetupAnnotations = {
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false,
+};
 const migrationInputSchema = z.object({
     source: z.string().describe('Absolute path to the existing codebase.'),
     e2e_baseline: z.string().describe('Absolute path to a passing migration-e2e baseline manifest created before migration inspection.'),
@@ -5223,10 +5232,12 @@ async function main() {
         }, eventsDiscoveryHandler);
         server.registerTool('ductape_function_setup', {
             title: 'Ductape Portable Function Setup',
-            description: 'Generate the mandatory secure local + remote runtime setup for application functions used by Features. ' +
+            description: 'Read-only: generate (without applying) the mandatory secure local + remote runtime setup for application functions used by Features. ' +
+                'This tool performs no network requests, writes, registrations, deployments, or infrastructure provisioning. ' +
                 'Use this only after a primitives-first decomposition proves residual application-owned logic remains. The result requires a registered local handler, ' +
                 'a deterministic HTTPS endpoint, raw-body HMAC verification, runtime checks, and fail-closed behavior.',
             inputSchema: portableFunctionSetupInputSchema,
+            annotations: portableFunctionSetupAnnotations,
         }, portableFunctionSetupHandler);
         server.registerTool('ductape_redis_setup', {
             title: 'Ductape Local Redis Setup',
@@ -5361,7 +5372,7 @@ async function main() {
         server.tool('ductape_schema', schemaInputSchema.shape, schemaHandler);
         server.tool('ductape_docs', docsInputSchema.shape, docsHandler);
         server.tool('ductape_events_discover', eventsDiscoveryInputSchema.shape, eventsDiscoveryHandler);
-        server.tool('ductape_function_setup', portableFunctionSetupInputSchema.shape, portableFunctionSetupHandler);
+        server.tool('ductape_function_setup', portableFunctionSetupInputSchema.shape, portableFunctionSetupAnnotations, portableFunctionSetupHandler);
         server.tool('ductape_redis_setup', redisSetupInputSchema.shape, redisSetupHandler);
         server.tool('ductape_migration_plan', migrationInputSchema.shape, migrationHandler);
         server.tool('ductape_cli', cliInputSchema.shape, cliHandler);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ductape/mcp",
-  "version": "0.2.11",
+  "version": "0.2.13",
   "description": "MCP server that exposes Ductape SDK operations via the backend proxy",
   "type": "module",
   "main": "dist/index.js",
@@ -15,7 +15,7 @@
   ],
   "scripts": {
     "build": "tsc",
-    "test": "npm run build && node scripts/check-cli-command-security.mjs && node scripts/check-frontend-analytics-guidance.mjs && node scripts/check-events-discovery.mjs && node scripts/check-schema-fallback.mjs && node scripts/check-portable-functions.mjs",
+    "test": "npm run build && node scripts/check-cli-command-security.mjs && node scripts/check-frontend-analytics-guidance.mjs && node scripts/check-events-discovery.mjs && node scripts/check-schema-fallback.mjs && node scripts/check-portable-functions.mjs && node scripts/check-project-link-guidance.mjs",
     "start": "node dist/index.js",
     "dev": "tsx src/index.ts"
   },