@entergram/mcp 0.1.3 → 0.1.5

package/README.md

@@ -22,24 +22,15 @@ npx -y @entergram/mcp serve
 
 ## Quick Start
 
-Production:
-
 ```bash
 entergram-mcp login
 entergram-mcp serve
 ```
 
-Development:
-
-```bash
-entergram-mcp login --env dev
-entergram-mcp serve --env dev
-```
-
 If you use a custom OAuth client, pass it explicitly:
 
 ```bash
-entergram-mcp login --env dev --client-id entergram-ws-your-client-id
+entergram-mcp login --client-id entergram-ws-your-client-id
 ```
 
 ## Commands
@@ -55,7 +46,7 @@ entergram-mcp print-config
 
 Useful flags:
 
-- `--env dev|production`
+- `--env production`
 - `--client-id ...`
 - `--scope "..."`
 - `--format json|toml`
@@ -71,34 +62,27 @@ entergram-mcp print-config --name entergram
 For TOML-based hosts such as Codex:
 
 ```bash
-entergram-mcp print-config --format toml --name entergram-dev
+entergram-mcp print-config --format toml --name entergram
 ```
 
 Example TOML config:
 
 ```toml
-[mcp_servers.entergram-dev]
+[mcp_servers.entergram]
 command = "entergram-mcp"
 args = ["serve"]
 
-[mcp_servers.entergram-dev.env]
-ENTERGRAM_MCP_ENV = "dev"
+[mcp_servers.entergram.env]
+ENTERGRAM_MCP_ENV = "production"
 ENTERGRAM_MCP_CLIENT_ID = "entergram-ws-your-client-id"
 ENTERGRAM_MCP_SCOPE = "workspace.read members.read accounts.read contacts.read chats.read messages.read messages.write custom_fields.read custom_fields.write tickets.read offline_access"
 ```
 
 ## Defaults
 
-Production:
-
 - gateway: `https://mcp.entergram.com/mcp`
 - client id: `entergram-mcp-cli`
 
-Development:
-
-- gateway: `https://devmcp.entergram.com/mcp`
-- client id: `entergram-dev-mcp-client`
-
 Default local OAuth callback:
 
 `http://127.0.0.1:8787/oauth/callback`
@@ -118,6 +102,13 @@ Use a workspace client if you need broader scopes such as:
 - `custom_fields.read`
 - `custom_fields.write`
 
+When `ENTERGRAM_MCP_CLIENT_ID` starts with `entergram-personal-`, the CLI uses a safer personal default scope that includes:
+
+- `chat_custom_fields.read`
+- `chat_custom_fields.write`
+
+and excludes workspace-admin scopes such as `members.read` and `custom_fields.write`.
+
 If the consent screen does not show the scopes you expect, update that OAuth client's `allowedScopes` in Entergram first, then run login again.
 
 ## Troubleshooting
@@ -137,6 +128,6 @@ If the consent screen does not show the scopes you expect, update that OAuth cli
 - Clear the local session and log in again:
 
 ```bash
-entergram-mcp logout --env dev --client-id entergram-ws-your-client-id
-entergram-mcp login --env dev --client-id entergram-ws-your-client-id
+entergram-mcp logout --client-id entergram-ws-your-client-id
+entergram-mcp login --client-id entergram-ws-your-client-id
 ```

package/dist/cli/config.js

@@ -1,6 +1,6 @@
 import os from "node:os";
 import path from "node:path";
-import { DEFAULT_CALLBACK_HOST, DEFAULT_CALLBACK_PATH, DEFAULT_CALLBACK_PORT, DEFAULT_CONFIG_DIRECTORY_NAME, DEFAULT_SCOPE, } from "./constants.js";
+import { DEFAULT_CALLBACK_HOST, DEFAULT_CALLBACK_PATH, DEFAULT_CALLBACK_PORT, DEFAULT_CONFIG_DIRECTORY_NAME, DEFAULT_PERSONAL_SCOPE, DEFAULT_WORKSPACE_SCOPE, } from "./constants.js";
 const ENVIRONMENT_PRESETS = {
     dev: {
         clientId: "entergram-dev-mcp-client",
@@ -40,6 +40,12 @@ function parsePositiveInteger(value, fallback) {
 function sanitizeFileSegment(value) {
     return value.replace(/[^a-zA-Z0-9._-]+/g, "-");
 }
+function defaultScopeForClientId(clientId) {
+    if (clientId.startsWith("entergram-personal-")) {
+        return DEFAULT_PERSONAL_SCOPE;
+    }
+    return DEFAULT_WORKSPACE_SCOPE;
+}
 export function resolveCliRuntimeConfig(flags) {
     const environment = getEnvironmentName(flags);
     const preset = ENVIRONMENT_PRESETS[environment];
@@ -52,9 +58,10 @@ export function resolveCliRuntimeConfig(flags) {
     const oauthIssuerUrl = getStringFlag(flags, "oauth-issuer-url") ||
         process.env.ENTERGRAM_MCP_OAUTH_ISSUER_URL?.trim() ||
         preset.oauthIssuerUrl;
+    const defaultScope = defaultScopeForClientId(clientId);
     const scope = getStringFlag(flags, "scope") ||
         process.env.ENTERGRAM_MCP_SCOPE?.trim() ||
-        DEFAULT_SCOPE;
+        defaultScope;
     const callbackPort = parsePositiveInteger(getStringFlag(flags, "callback-port") ||
         process.env.ENTERGRAM_MCP_CALLBACK_PORT?.trim(), DEFAULT_CALLBACK_PORT);
     const configDir = getStringFlag(flags, "config-dir") ||

package/dist/cli/constants.js

@@ -1,5 +1,6 @@
 export const CLI_VERSION = "0.1.0";
-export const DEFAULT_SCOPE = "workspace.read members.read accounts.read contacts.read chats.read messages.read messages.write custom_fields.read custom_fields.write tickets.read offline_access";
+export const DEFAULT_WORKSPACE_SCOPE = "workspace.read members.read accounts.read contacts.read chats.read messages.read messages.write custom_fields.read custom_fields.write tickets.read offline_access";
+export const DEFAULT_PERSONAL_SCOPE = "workspace.read accounts.read contacts.read chats.read chat_custom_fields.read chat_custom_fields.write messages.read tickets.read offline_access";
 export const DEFAULT_CALLBACK_HOST = "127.0.0.1";
 export const DEFAULT_CALLBACK_PORT = 8787;
 export const DEFAULT_CALLBACK_PATH = "/oauth/callback";

package/dist/cli/remote-client.js

@@ -50,19 +50,12 @@ export class EntergramRemoteClient {
             if (!(error instanceof UnauthorizedError) || !options.interactive) {
                 throw error;
             }
-            await client.close().catch(() => undefined);
-            ({ client, transport } = createPair());
             const callbackPromise = waitForOAuthCallback(this.config.callbackUrl, 5 * 60 * 1000, () => this.authProvider.expectedState());
-            try {
-                await client.connect(transport);
-            }
-            catch (interactiveError) {
-                if (!(interactiveError instanceof UnauthorizedError)) {
-                    throw interactiveError;
-                }
-            }
             const code = await callbackPromise;
             await transport.finishAuth(code);
+            await client.close().catch(() => undefined);
+            await transport.close().catch(() => undefined);
+            ({ client, transport } = createPair());
             await client.connect(transport);
         }
         this.client = client;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@entergram/mcp",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "private": false,
   "description": "Official Entergram MCP CLI for local MCP hosts with OAuth login, stdio bridging, and host config helpers.",
   "type": "module",