@energyatit/mcp-server 0.2.3 → 0.3.0

package/dist/index.js

@@ -2,6 +2,7 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
+const VERSION = "0.3.0";
 // ─── Config ────────────────────────────────────────────────────────────────
 const BASE_URL = (process.env.ENERGYATIT_BASE_URL ??
     process.env.ENERGYATIT_URL ??
@@ -9,7 +10,7 @@ const BASE_URL = (process.env.ENERGYATIT_BASE_URL ??
 const API_KEY = process.env.ENERGYATIT_API_KEY ?? "";
 const TOKEN = process.env.ENERGYATIT_TOKEN ?? "";
 const JOURNEY_TOKEN = process.env.ENERGYATIT_JOURNEY_TOKEN ?? "";
-// ─── Demo Mode ──────────────────────────────────────────────────────────────
+// ─── Auth ──────────────────────────────────────────────────────────────────
 const demoMode = !API_KEY && !TOKEN && !JOURNEY_TOKEN;
 let sessionApiKey = "";
 function authHeaders() {
@@ -24,7 +25,8 @@ function authHeaders() {
         h["X-API-Key"] = sessionApiKey;
     return h;
 }
-// Demo path mapping: read-only tools use public /demo/* routes when in demo mode
+// ─── Demo path mapping ─────────────────────────────────────────────────────
+// Read-only tools in demo mode use public /demo/* or already-public endpoints.
 const DEMO_PATH_MAP = {
     "/api/sites": "/api/v1/demo/sites",
     "/api/assets": "/api/v1/demo/assets",
@@ -35,15 +37,29 @@ const DEMO_PATH_MAP = {
     "/api/v1/integrations/status": "/api/v1/demo/integrations/status",
     "/api/v1/carbon": "/api/v1/demo/carbon",
 };
+// These paths are already public on the server — no rewrite needed, no auth needed.
+const PUBLIC_PATHS = [
+    "/api/health",
+    "/api/v1/health",
+    "/api/v1/status",
+    "/api/v1/pricing",
+    "/api/v1/intel/grid/", // prefix — grid capacity + trends are public
+    "/api/public/", // prefix — all public routes
+];
+function isPublicPath(path) {
+    const basePath = path.split("?")[0];
+    return PUBLIC_PATHS.some(p => basePath === p || basePath.startsWith(p));
+}
 function resolveDemoPath(path) {
     if (!demoMode)
         return path;
-    // Check exact match first
+    if (isPublicPath(path))
+        return path; // already public, no rewrite
     const basePath = path.split("?")[0];
     const qs = path.includes("?") ? path.slice(path.indexOf("?")) : "";
     if (DEMO_PATH_MAP[basePath])
         return DEMO_PATH_MAP[basePath] + qs;
-    // Check prefix matches (e.g. /api/sites/123)
+    // Check prefix matches (e.g. /api/sites/123 → /api/v1/demo/sites/123)
     for (const [from, to] of Object.entries(DEMO_PATH_MAP)) {
         if (basePath.startsWith(from + "/")) {
             return to + basePath.slice(from.length) + qs;
@@ -70,45 +86,64 @@ async function autoProvisionSandbox() {
             method: "POST",
             headers: { "Content-Type": "application/json" },
         });
-        const json = await res.json();
-        if (json.success && json.data) {
-            const data = json.data;
-            if (data.apiKey && typeof data.apiKey === "string") {
-                sessionApiKey = data.apiKey;
-                console.error(`[demo] Auto-provisioned sandbox (key: ${sessionApiKey.slice(0, 20)}...)`);
-                return true;
-            }
+        if (!res.ok) {
+            console.error(`[demo] Sandbox provision HTTP ${res.status}`);
+            return false;
+        }
+        const json = await safeJson(res);
+        if (json?.success && json.data?.apiKey) {
+            sessionApiKey = json.data.apiKey;
+            console.error(`[demo] Auto-provisioned sandbox (key: ${sessionApiKey.slice(0, 20)}...)`);
+            return true;
         }
-        console.error("[demo] Sandbox provision returned unexpected response:", json);
+        console.error("[demo] Sandbox provision: unexpected response");
         return false;
     }
     catch (err) {
-        console.error("[demo] Failed to auto-provision sandbox:", err);
+        console.error("[demo] Sandbox provision failed:", err instanceof Error ? err.message : err);
         return false;
     }
 }
+/** Safely parse JSON — returns null instead of throwing on HTML or malformed responses. */
+async function safeJson(res) {
+    const ct = res.headers.get("content-type") ?? "";
+    if (!ct.includes("json")) {
+        // Server returned HTML (SPA catch-all) or other non-JSON — route doesn't exist or auth redirect
+        return null;
+    }
+    try {
+        return await res.json();
+    }
+    catch {
+        return null;
+    }
+}
 async function apiGet(path) {
     const resolvedPath = resolveDemoPath(path);
-    const res = await fetch(`${BASE_URL}${resolvedPath}`, { headers: authHeaders() });
-    // Auto-provision on 401 in demo mode
+    const url = `${BASE_URL}${resolvedPath}`;
+    const headers = isPublicPath(resolvedPath) && demoMode ? { "Content-Type": "application/json" } : authHeaders();
+    let res = await fetch(url, { headers });
+    // Auto-provision on 401 in demo mode (for non-public paths)
     if (res.status === 401 && demoMode && !sessionApiKey) {
         const provisioned = await autoProvisionSandbox();
         if (provisioned) {
-            // Retry with the new key
-            const retry = await fetch(`${BASE_URL}${resolvedPath}`, { headers: authHeaders() });
-            const retryJson = await retry.json();
-            if (retryJson.success === false)
-                throw new Error(String(retryJson.error ?? `API error ${retry.status}`));
-            return retryJson.data ?? retryJson;
+            res = await fetch(url, { headers: authHeaders() });
         }
     }
-    const json = await res.json();
+    if (!res.ok) {
+        const json = await safeJson(res);
+        const msg = json?.error ? String(json.error) : `HTTP ${res.status} ${res.statusText}`;
+        throw new Error(msg);
+    }
+    const json = await safeJson(res);
+    if (!json)
+        throw new Error(`Non-JSON response from ${resolvedPath}`);
     if (json.success === false)
-        throw new Error(String(json.error ?? `API error ${res.status}`));
+        throw new Error(String(json.error ?? "Unknown API error"));
     return json.data ?? json;
 }
 async function apiPost(path, body) {
-    const res = await fetch(`${BASE_URL}${path}`, {
+    let res = await fetch(`${BASE_URL}${path}`, {
         method: "POST",
         headers: authHeaders(),
         body: body ? JSON.stringify(body) : undefined,
@@ -117,31 +152,23 @@ async function apiPost(path, body) {
     if (res.status === 401 && demoMode && !sessionApiKey) {
         const provisioned = await autoProvisionSandbox();
         if (provisioned) {
-            const retry = await fetch(`${BASE_URL}${path}`, {
+            res = await fetch(`${BASE_URL}${path}`, {
                 method: "POST",
                 headers: authHeaders(),
                 body: body ? JSON.stringify(body) : undefined,
             });
-            const retryJson = await retry.json();
-            if (retryJson.success === false)
-                throw new Error(String(retryJson.error ?? `API error ${retry.status}`));
-            return retryJson.data ?? retryJson;
         }
     }
-    const json = await res.json();
-    if (json.success === false)
-        throw new Error(String(json.error ?? `API error ${res.status}`));
-    return json.data ?? json;
-}
-async function apiPatch(path, body) {
-    const res = await fetch(`${BASE_URL}${path}`, {
-        method: "PATCH",
-        headers: authHeaders(),
-        body: body ? JSON.stringify(body) : undefined,
-    });
-    const json = await res.json();
+    if (!res.ok) {
+        const json = await safeJson(res);
+        const msg = json?.error ? String(json.error) : `HTTP ${res.status} ${res.statusText}`;
+        throw new Error(msg);
+    }
+    const json = await safeJson(res);
+    if (!json)
+        throw new Error(`Non-JSON response from ${path}`);
     if (json.success === false)
-        throw new Error(String(json.error ?? `API error ${res.status}`));
+        throw new Error(String(json.error ?? "Unknown API error"));
     return json.data ?? json;
 }
 function text(data) {
@@ -153,7 +180,7 @@ function errorResult(err) {
 // ─── MCP Server ────────────────────────────────────────────────────────────
 const server = new McpServer({
     name: "energyatit",
-    version: "0.2.1",
+    version: VERSION,
 });
 // ── Sites ────────────────────────────────────────────────────────────────
 server.tool("list_sites", "List all energy sites in your tenant", {}, async () => {
@@ -585,7 +612,7 @@ async function main() {
         console.error("Running in demo mode — read-only tools use public endpoints, write tools auto-provision sandbox");
         console.error("Set ENERGYATIT_API_KEY, ENERGYATIT_TOKEN, or ENERGYATIT_JOURNEY_TOKEN for full access.");
     }
-    console.error(`EnergyAtIt MCP server v0.2.1 — connecting to ${BASE_URL}`);
+    console.error(`EnergyAtIt MCP server v${VERSION} — connecting to ${BASE_URL}`);
     const transport = new StdioServerTransport();
     await server.connect(transport);
     console.error("EnergyAtIt MCP server running on stdio");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@energyatit/mcp-server",
-  "version": "0.2.3",
+  "version": "0.3.0",
   "description": "MCP server for EnergyAtIt — connect Claude, GPT, or any MCP client to energy grid data",
   "type": "module",
   "bin": {