@enfyra/mcp-server 0.0.97 → 0.0.99

package/README.md

@@ -183,10 +183,13 @@ The MCP server includes safety guards for LLM callers:
 
 - Generic record mutations validate fields against live metadata.
 - Script-backed records validate `sourceCode` through `/admin/script/validate` before saving.
+- `validate_dynamic_script` checks handler, hook, flow, websocket, GraphQL, and bootstrap script source without saving.
+- `validate_extension_code` checks Enfyra admin extension code through `/enfyra_extension/preview` without saving.
 - `compiledCode` is generated from `sourceCode` and may differ textually because macros are expanded; the MCP server never accepts hand-written `compiledCode`.
 - Relation tools reject physical FK/junction names.
 - Generated code should use relation property names such as `conversation`, `sender`, and `member` instead of physical FK fields such as `conversationId`, `senderId`, or `memberId`.
 - Custom route tools reject `mainTableId` unless the route is the canonical table route.
+- Platform operation tools such as `create_api_endpoint`, `publish_route_methods`, `add_route_methods`, `set_table_graphql`, `ensure_guard`, `ensure_field_permission`, `ensure_column_rule`, `ensure_websocket_event`, `ensure_script_flow_step`, `ensure_menu`, `ensure_page_extension`, `ensure_global_extension`, and `ensure_widget_extension` resolve metadata ids and validate code before saving.
 - Schema changes are serialized.
 - Destructive deletes return a preview before requiring `confirm=true`.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@enfyra/mcp-server",
-  "version": "0.0.97",
+  "version": "0.0.99",
   "description": "MCP server for Enfyra - manage Enfyra instances from MCP-compatible coding tools",
   "type": "module",
   "license": "MIT",

package/src/lib/mcp-examples.js

@@ -996,22 +996,19 @@ ensure_route_access({
       },
       {
         name: 'Publish read-only route',
-        code: `update_record({
-  tableName: "enfyra_route",
-  id: "<route_id>",
-  data: {
-    publicMethods: [{ id: "<GET_method_id_from_list_methods>" }]
-  }
+        code: `publish_route_methods({
+  path: "/articles",
+  methods: ["GET"]
 })`,
         notes: [
-          'Method ids are instance data. Use list_methods or inspect_route output to resolve the GET method id first.',
+          'Use publish_route_methods instead of raw enfyra_route updates; the tool resolves method ids and validates that GET is available.',
           'publicMethods controls anonymous route access. Route permissions are not for public access.',
           'Route permissions apply when the method is not public.',
         ],
       },
       {
         name: 'Rate limit anonymous requests by IP',
-        code: `create_guard({
+        code: `ensure_guard({
   name: "Public signup IP rate limit",
   path: "/newsletter_signup",
   methods: ["POST"],
@@ -1042,7 +1039,7 @@ test_rest_endpoint({
       },
       {
         name: 'Rate limit authenticated users',
-        code: `create_guard({
+        code: `ensure_guard({
   name: "Project create per-user limit",
   path: "/projects",
   methods: ["POST"],
@@ -1064,7 +1061,7 @@ test_rest_endpoint({
       },
       {
         name: 'Restrict an admin-only route to office IPs',
-        code: `create_guard({
+        code: `ensure_guard({
   name: "Admin reports office allowlist",
   path: "/admin/reports",
   methods: ["GET", "POST"],
@@ -1086,7 +1083,7 @@ test_rest_endpoint({
       },
       {
         name: 'Column rule for email format',
-        code: `create_column_rule({
+        code: `ensure_column_rule({
   tableName: "enfyra_user",
   columnName: "email",
   ruleType: "format",
@@ -1101,10 +1098,12 @@ test_rest_endpoint({
       },
       {
         name: 'Field permission condition',
-        code: `create_field_permission({
+        code: `ensure_field_permission({
   tableName: "project",
-  fieldName: "internal_notes",
+  columnName: "internal_notes",
   action: "read",
+  effect: "allow",
+  roleName: "user",
   condition: JSON.stringify({
     owner: { id: { _eq: "@USER.id" } }
   })
@@ -1417,7 +1416,7 @@ update_method({
       },
       {
         name: 'Create menu then extension',
-        code: `create_menu({
+        code: `ensure_menu({
   label: "Reports",
   type: "Menu",
   path: "/reports",
@@ -1433,8 +1432,7 @@ update_method({
 })
 
 // Read the created menu id from the tool response, then:
-create_extension({
-  type: "page",
+ensure_page_extension({
   name: "ReportsPage",
   description: "Reports dashboard",
   menuId: "<created-menu-id>",
@@ -1445,7 +1443,7 @@ create_extension({
           'Menu provides navigation; extension provides content.',
           'Use enfyra_menu.label, not title.',
           'Sensitive admin menus should include a permission condition at creation time.',
-          'For page extensions, create the menu first and pass menuId to create_extension.',
+          'For page extensions, create the menu first with ensure_menu and pass its id to ensure_page_extension.',
           'Page extensions must register the app-shell PageHeader with usePageHeaderRegistry instead of rendering a custom top header.',
           'Use variant: "minimal" for operational pages unless a larger header is intentionally needed.',
           'Do not put ordinary KPI cards in PageHeader.stats; render metrics in the extension body.',
@@ -1488,8 +1486,7 @@ function openLatest() {
 </script>
 \`
 
-create_extension({
-  type: "widget",
+ensure_widget_extension({
   name: "ReportStatusWidget",
   description: "Report status summary cards",
   code: reportStatusWidgetCode,
@@ -1497,8 +1494,7 @@ create_extension({
 })
 
 // Read the created widget record id, then embed it from the page extension.
-create_extension({
-  type: "page",
+ensure_page_extension({
   name: "ReportsPage",
   menuId: "<reports-menu-id>",
   code: "<template><section class=\\"min-h-full w-full space-y-4\\"><Widget :id=\\"<report-status-widget-id>\\" :total=\\"totalReports\\" :rows=\\"reportRows\\" :open-details=\\"openReportDetails\\" @refresh=\\"refresh\\" /><Widget :id=\\"<report-table-widget-id>\\" :rows=\\"reportRows\\" @refresh=\\"refresh\\" /></section></template><script setup>const { registerPageHeader } = usePageHeaderRegistry(); registerPageHeader({ title: 'Reports', description: 'Operational report overview.', leadingIcon: 'lucide:bar-chart-3', gradient: 'cyan', variant: 'minimal' }); const totalReports = ref(0); const reportRows = ref([]); function refresh() {} function openReportDetails(row) { navigateTo('/data/report?filter=' + encodeURIComponent(JSON.stringify({ id: { _eq: row.id } }))) }</script>",
@@ -1574,8 +1570,7 @@ onUnmounted(() => {
 </script>
 \`
 
-create_extension({
-  type: "global",
+ensure_global_extension({
   name: "NotificationBellGlobal",
   description: "Registers the app-wide notification bell in the account panel",
   code: notificationBellCode,
@@ -1719,7 +1714,7 @@ registerHeaderActions([
       {
         name: 'Plan an admin dashboard as multiple pages',
         code: `// Recommended menu shape for an operations surface:
-create_menu({
+ensure_menu({
   type: "Dropdown Menu",
   label: "Operations",
   path: "/operations",

package/src/lib/mcp-instructions.js

@@ -29,6 +29,8 @@ export function buildMcpServerInstructions(apiBaseUrl) {
     '- Inspect narrowly. Use `inspect_table`, `inspect_route`, and `inspect_feature` for the table/route/feature being changed instead of loading broad metadata.',
     '- Load examples only when needed. Before generating schemas, app connection code, OAuth, Socket.IO, handlers/hooks, flows, files, guards, permissions, or extensions, call `get_enfyra_examples` with the matching category.',
     '- For server scripts, call `discover_script_contexts` before writing or reviewing handler/hook/flow/websocket/GraphQL logic.',
+    '- Prefer the most specific business operation tool over raw metadata CRUD: `create_api_endpoint`; route tools such as `add_route_methods`, `publish_route_methods`, and `unpublish_route_methods`; `set_table_graphql`; `ensure_guard`; permission/rule tools; websocket tools; flow tools such as `ensure_manual_flow`, `ensure_scheduled_flow`, and fixed-type flow step tools; and extension tools such as `ensure_menu`, `ensure_page_extension`, `ensure_global_extension`, and `ensure_widget_extension`.',
+    '- Before saving standalone dynamic script or extension code, call `validate_dynamic_script` or `validate_extension_code` unless the chosen ensure/update tool already validates the code.',
     '- For existing script-backed records, use `trace_metadata_usage` then `get_script_source`; edit with `patch_script_source` or `update_script_source` so source is hash-checked and validated.',
     '- Validate behavior with `test_rest_endpoint`, `run_admin_test`, `test_flow_step`, or the route-specific tool before claiming a dynamic feature works.',
     '',
@@ -40,7 +42,7 @@ export function buildMcpServerInstructions(apiBaseUrl) {
     '- Dynamic repository reads use `filter`, not `where`: `@REPOS.table.find({ filter: {...} })`, `#table.find({ filter: {...} })`, and `exists(filter)`.',
     '- Use `enfyra_user` as the user table. Model record links as real relations using relation `propertyName` values, not physical FK fields like `userId`, `conversationId`, `senderId`, or `memberId` in generated DB code.',
     '- Do not call internal/no-route system tables such as `enfyra_column` or `enfyra_session` through generic CRUD. Use table/column/relation tools and route-backed tables discovered from metadata.',
-    '- Custom API paths use `create_route` without `mainTableId`; `create_table` is only for new persisted data.',
+    '- Custom API paths use `create_api_endpoint` when a handler is needed. Use lower-level `create_route` without `mainTableId` only when intentionally creating a route shell; `create_table` is only for new persisted data.',
     '- For canonical table reads and RLS, preserve client-controlled query shape: do not override `@QUERY.fields`, `@QUERY.deep`, `@QUERY.sort`, `@QUERY.limit`, `@QUERY.page`, `@QUERY.meta`, `@QUERY.aggregate`, or `debugMode`. Merge only security filters into `@QUERY.filter`.',
     '- Script source is `sourceCode`; `compiledCode` is generated and may differ textually because macros expand. Do not warn about source/compiled mismatch unless validation or runtime behavior proves the compiled artifact is stale.',
     '- For intentional user/domain errors in scripts use `@THROW400`-style helpers or `$ctx.$throw[...]`, not `throw new Error(...)`.',