@ferrlabs/mcp 5.0.0 → 5.1.0

package/README.md

@@ -10,21 +10,36 @@
 
 Add to your MCP client configuration (Claude Code, Cursor, etc.):
 
+```json
+{
+  "mcpServers": {
+    "ferrlabs": {
+      "command": "npx",
+      "args": ["-y", "@ferrlabs/mcp"]
+    }
+  }
+}
+```
+
+The first time you call a tool that needs auth, the MCP opens `auth.ferrlabs.com` in your default browser (OAuth 2.0 loopback PKCE). After you click Allow, the token is saved locally and reused for future sessions. No env var required.
+
+### CI / scripted / headless use
+
+Bypass the browser dance by injecting a token directly:
+
 ```json
 {
   "mcpServers": {
     "ferrlabs": {
       "command": "npx",
       "args": ["-y", "@ferrlabs/mcp"],
-      "env": {
-        "FERRLABS_API_TOKEN": "fl_..."
-      }
+      "env": { "FERRLABS_API_TOKEN": "fl_..." }
     }
   }
 }
 ```
 
-Create a token from `app.ferrlabs.com` (Settings → API Tokens) and assign the scopes you want the assistant to have. The token is forwarded as `x-api-token` to `api.ferrlabs.com`.
+Create the token from `app.ferrlabs.com` → Settings → API Tokens. It's forwarded as `x-api-token` to `api.ferrlabs.com`.
 
 ## Available Tools
 
@@ -55,11 +70,26 @@ FerrFlow CLI-specific tools (`dry_run`, `validate_config`, `read_config`, `read_
 
 ## Configuration
 
-| Variable             | Description                                                                  | Default                    |
-| -------------------- | ---------------------------------------------------------------------------- | -------------------------- |
-| `API_URL`            | FerrLabs API base URL (no `/v1` suffix — paths are prefixed in code)         | `https://api.ferrlabs.com` |
-| `FERRLABS_API_TOKEN` | FerrLabs API token (required for authenticated tools)                        | —                          |
-| `FERRFLOW_API_TOKEN` | **Deprecated** — accepted as a fallback for backward compatibility with v3.x | —                          |
+| Variable                  | Description                                                                           | Default                                                                   |
+| ------------------------- | ------------------------------------------------------------------------------------- | ------------------------------------------------------------------------- |
+| `API_URL`                 | FerrLabs API base URL (no `/v1` suffix — paths are prefixed in code)                  | `https://api.ferrlabs.com`                                                |
+| `FERRLABS_AUTH_URL`       | Auth SPA base URL (where the OAuth browser flow lands)                                | `https://auth.ferrlabs.com`                                               |
+| `FERRLABS_API_TOKEN`      | Pre-provisioned token. Bypasses the OAuth flow. Use for CI / scripted environments.   | —                                                                         |
+| `FERRFLOW_API_TOKEN`      | **Deprecated** — accepted as a fallback for backward compatibility with v3.x.         | —                                                                         |
+| `FERRLABS_MCP_NO_OAUTH`   | Set to `1` to disable the OAuth fallback. Then `FERRLABS_API_TOKEN` becomes required. | unset                                                                     |
+| `FERRLABS_MCP_TOKEN_PATH` | Override the path where the OAuth-acquired token is persisted.                        | `%APPDATA%\ferrlabs\mcp\token.json` / `~/.config/ferrlabs/mcp/token.json` |
+| `FERRLABS_MCP_NO_PERSIST` | Set to `1` to keep the token in memory only (re-auth on every cold start).            | unset                                                                     |
+
+### How auth resolution works
+
+On the first authenticated tool call, the MCP looks for a token in this order:
+
+1. In-memory cache (set during this MCP process's lifetime)
+2. `FERRLABS_API_TOKEN` (or `FERRFLOW_API_TOKEN`) env var
+3. Persisted token file (`FERRLABS_MCP_TOKEN_PATH`)
+4. **OAuth 2.0 loopback PKCE flow** — opens the user's browser, captures the callback on `http://127.0.0.1:54321/cb`, exchanges the code for a session token via `POST /v1/auth/exchange`. Token is persisted to step 3 for future sessions.
+
+If you set `FERRLABS_MCP_NO_OAUTH=1`, step 4 is skipped — useful for CI where opening a browser would hang.
 
 ## Smoke test
 

package/dist/auth/__tests__/index.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.test.d.ts.map

package/dist/auth/__tests__/index.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.test.d.ts","sourceRoot":"","sources":["../../../src/auth/__tests__/index.test.ts"],"names":[],"mappings":""}

package/dist/auth/__tests__/index.test.js

@@ -0,0 +1,39 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+describe('getToken', () => {
+    const originalEnv = process.env;
+    beforeEach(() => {
+        vi.resetModules();
+        process.env = { ...originalEnv };
+        delete process.env.FERRLABS_API_TOKEN;
+        delete process.env.FERRFLOW_API_TOKEN;
+        delete process.env.FERRLABS_MCP_NO_OAUTH;
+        process.env.FERRLABS_MCP_NO_PERSIST = '1';
+    });
+    afterEach(() => {
+        process.env = originalEnv;
+    });
+    it('returns FERRLABS_API_TOKEN when set, without touching persistence or OAuth', async () => {
+        process.env.FERRLABS_API_TOKEN = 'fl_env_token';
+        const { getToken } = await import('../index.js');
+        expect(await getToken()).toBe('fl_env_token');
+    });
+    it('falls back to FERRFLOW_API_TOKEN (legacy compat)', async () => {
+        process.env.FERRFLOW_API_TOKEN = 'fl_legacy_token';
+        const { getToken } = await import('../index.js');
+        expect(await getToken()).toBe('fl_legacy_token');
+    });
+    it('throws when no token and FERRLABS_MCP_NO_OAUTH=1', async () => {
+        process.env.FERRLABS_MCP_NO_OAUTH = '1';
+        const { getToken } = await import('../index.js');
+        await expect(getToken()).rejects.toThrow(/FERRLABS_API_TOKEN environment variable is required/);
+    });
+    it('caches the token across calls (env path)', async () => {
+        process.env.FERRLABS_API_TOKEN = 'fl_cached';
+        const { getToken } = await import('../index.js');
+        const a = await getToken();
+        process.env.FERRLABS_API_TOKEN = 'fl_changed';
+        const b = await getToken();
+        expect(a).toBe(b);
+        expect(a).toBe('fl_cached');
+    });
+});

package/dist/auth/__tests__/oauth.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=oauth.test.d.ts.map

package/dist/auth/__tests__/oauth.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.test.d.ts","sourceRoot":"","sources":["../../../src/auth/__tests__/oauth.test.ts"],"names":[],"mappings":""}

package/dist/auth/__tests__/oauth.test.js

@@ -0,0 +1,26 @@
+import { describe, it, expect } from 'vitest';
+import { generatePkcePair } from '../oauth.js';
+import { createHash } from 'node:crypto';
+describe('generatePkcePair', () => {
+    it('returns a verifier between 43 and 128 chars (RFC 7636)', () => {
+        const { verifier } = generatePkcePair();
+        expect(verifier.length).toBeGreaterThanOrEqual(43);
+        expect(verifier.length).toBeLessThanOrEqual(128);
+    });
+    it('returns a challenge that is SHA-256(verifier) base64url-encoded', () => {
+        const { verifier, challenge } = generatePkcePair();
+        const expected = createHash('sha256').update(verifier).digest('base64url');
+        expect(challenge).toBe(expected);
+    });
+    it('returns different verifier+challenge pairs each call', () => {
+        const a = generatePkcePair();
+        const b = generatePkcePair();
+        expect(a.verifier).not.toBe(b.verifier);
+        expect(a.challenge).not.toBe(b.challenge);
+    });
+    it('returns base64url-encoded values (no +, /, =)', () => {
+        const { verifier, challenge } = generatePkcePair();
+        expect(verifier).toMatch(/^[A-Za-z0-9_-]+$/);
+        expect(challenge).toMatch(/^[A-Za-z0-9_-]+$/);
+    });
+});

package/dist/auth/index.d.ts

@@ -0,0 +1,3 @@
+export declare function getToken(): Promise<string>;
+export declare function resetTokenCacheForTesting(): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAMA,wBAAsB,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,CAgChD;AAED,wBAAgB,yBAAyB,IAAI,IAAI,CAGhD"}

package/dist/auth/index.js

@@ -0,0 +1,36 @@
+import { readPersistedToken, writePersistedToken } from './persistence.js';
+import { runLoopbackOauthFlow } from './oauth.js';
+let cached = null;
+let inFlight = null;
+export async function getToken() {
+    if (cached)
+        return cached;
+    const envToken = process.env.FERRLABS_API_TOKEN ?? process.env.FERRFLOW_API_TOKEN;
+    if (envToken) {
+        cached = envToken;
+        return envToken;
+    }
+    const persisted = await readPersistedToken();
+    if (persisted) {
+        cached = persisted;
+        return persisted;
+    }
+    if (process.env.FERRLABS_MCP_NO_OAUTH === '1') {
+        throw new Error('FERRLABS_API_TOKEN environment variable is required (FERRLABS_MCP_NO_OAUTH=1 disables the OAuth fallback).');
+    }
+    if (!inFlight) {
+        inFlight = (async () => {
+            const { token } = await runLoopbackOauthFlow();
+            await writePersistedToken(token);
+            cached = token;
+            return token;
+        })().finally(() => {
+            inFlight = null;
+        });
+    }
+    return inFlight;
+}
+export function resetTokenCacheForTesting() {
+    cached = null;
+    inFlight = null;
+}

package/dist/auth/oauth.d.ts

@@ -0,0 +1,12 @@
+interface PkcePair {
+    verifier: string;
+    challenge: string;
+}
+export declare function generatePkcePair(): PkcePair;
+export interface RunLoopbackFlowResult {
+    token: string;
+    scope?: string;
+}
+export declare function runLoopbackOauthFlow(): Promise<RunLoopbackFlowResult>;
+export {};
+//# sourceMappingURL=oauth.d.ts.map

package/dist/auth/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/auth/oauth.ts"],"names":[],"mappings":"AAWA,UAAU,QAAQ;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,gBAAgB,IAAI,QAAQ,CAI3C;AA4FD,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,qBAAqB,CAAC,CA+C3E"}

package/dist/auth/oauth.js

@@ -0,0 +1,123 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { createServer } from 'node:http';
+import { spawn } from 'node:child_process';
+import { platform } from 'node:os';
+const AUTH_BASE = process.env.FERRLABS_AUTH_URL ?? 'https://auth.ferrlabs.com';
+const API_BASE = process.env.API_URL ?? 'https://api.ferrlabs.com';
+const CLIENT_ID = 'mcp';
+const REDIRECT_PORTS = [54321, 54322];
+const AUTH_TIMEOUT_MS = 2 * 60 * 1000;
+export function generatePkcePair() {
+    const verifier = randomBytes(64).toString('base64url');
+    const challenge = createHash('sha256').update(verifier).digest('base64url');
+    return { verifier, challenge };
+}
+function generateState() {
+    return randomBytes(16).toString('base64url');
+}
+function openBrowser(url) {
+    const args = (() => {
+        switch (platform()) {
+            case 'win32':
+                return { cmd: 'cmd', args: ['/c', 'start', '""', url] };
+            case 'darwin':
+                return { cmd: 'open', args: [url] };
+            default:
+                return { cmd: 'xdg-open', args: [url] };
+        }
+    })();
+    const child = spawn(args.cmd, args.args, { detached: true, stdio: 'ignore' });
+    child.on('error', () => {
+        // ignore — caller will time out and surface the URL via error
+    });
+    child.unref();
+}
+function listenForCallback(port, expectedState) {
+    return new Promise((resolve, reject) => {
+        const server = createServer((req, res) => {
+            try {
+                const url = new URL(req.url ?? '/', `http://127.0.0.1:${port}`);
+                if (url.pathname !== '/cb') {
+                    res.writeHead(404).end('Not found');
+                    return;
+                }
+                const code = url.searchParams.get('code');
+                const state = url.searchParams.get('state');
+                if (!code || !state) {
+                    res.writeHead(400).end('Missing code or state');
+                    return;
+                }
+                if (state !== expectedState) {
+                    res.writeHead(400).end('state mismatch');
+                    reject(new Error('OAuth callback state mismatch (CSRF protection triggered)'));
+                    server.close();
+                    return;
+                }
+                res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8', Connection: 'close' });
+                res.end("<!doctype html><html><body style='font-family:sans-serif;padding:2rem;color:#1e293b'><h1>Authorized</h1><p>You can close this tab and return to your terminal.</p></body></html>");
+                setImmediate(() => server.close());
+                resolve({ code, state });
+            }
+            catch (err) {
+                res.writeHead(500).end('Internal error');
+                reject(err instanceof Error ? err : new Error(String(err)));
+            }
+        });
+        server.on('error', reject);
+        server.listen(port, '127.0.0.1');
+    });
+}
+async function exchangeCodeForToken(code, codeVerifier, redirectUri) {
+    const res = await fetch(`${API_BASE}/v1/auth/exchange`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', 'User-Agent': 'ferrlabs-mcp/oauth' },
+        body: JSON.stringify({
+            code,
+            client_id: CLIENT_ID,
+            redirect_uri: redirectUri,
+            code_verifier: codeVerifier,
+        }),
+    });
+    if (!res.ok) {
+        const body = (await res.json().catch(() => ({})));
+        throw new Error(`OAuth exchange failed (HTTP ${res.status}): ${body.error ?? body.message ?? 'unknown'}`);
+    }
+    const data = (await res.json());
+    if (!data.token)
+        throw new Error('OAuth exchange returned no token');
+    return data.token;
+}
+export async function runLoopbackOauthFlow() {
+    const pkce = generatePkcePair();
+    const state = generateState();
+    let port = null;
+    let callbackPromise = null;
+    for (const candidate of REDIRECT_PORTS) {
+        try {
+            callbackPromise = listenForCallback(candidate, state);
+            port = candidate;
+            break;
+        }
+        catch {
+            callbackPromise = null;
+        }
+    }
+    if (port === null || !callbackPromise) {
+        throw new Error(`Could not bind any of the loopback ports (${REDIRECT_PORTS.join(', ')}). Close whatever is using them and retry.`);
+    }
+    const redirectUri = `http://127.0.0.1:${port}/cb`;
+    const authorizeUrl = new URL(`${AUTH_BASE}/authorize`);
+    authorizeUrl.searchParams.set('client_id', CLIENT_ID);
+    authorizeUrl.searchParams.set('redirect_uri', redirectUri);
+    authorizeUrl.searchParams.set('response_type', 'code');
+    authorizeUrl.searchParams.set('code_challenge', pkce.challenge);
+    authorizeUrl.searchParams.set('code_challenge_method', 'S256');
+    authorizeUrl.searchParams.set('state', state);
+    openBrowser(authorizeUrl.toString());
+    const timeoutPromise = new Promise((_, reject) => {
+        setTimeout(() => reject(new Error(`OAuth flow timed out after ${AUTH_TIMEOUT_MS / 1000}s. If your browser didn't open, visit: ${authorizeUrl.toString()}`)), AUTH_TIMEOUT_MS);
+    });
+    const { code } = await Promise.race([callbackPromise, timeoutPromise]);
+    const token = await exchangeCodeForToken(code, pkce.verifier, redirectUri);
+    return { token };
+}

package/dist/auth/persistence.d.ts

@@ -0,0 +1,4 @@
+export declare function readPersistedToken(): Promise<string | null>;
+export declare function writePersistedToken(token: string, scopes?: string[]): Promise<void>;
+export declare function clearPersistedToken(): Promise<void>;
+//# sourceMappingURL=persistence.d.ts.map

package/dist/auth/persistence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"persistence.d.ts","sourceRoot":"","sources":["../../src/auth/persistence.ts"],"names":[],"mappings":"AAmCA,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAYjE;AAED,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBzF;AAED,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC,CAOzD"}

package/dist/auth/persistence.js

@@ -0,0 +1,61 @@
+import { mkdir, readFile, writeFile, chmod } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { homedir, platform } from 'node:os';
+function defaultTokenPath() {
+    const override = process.env.FERRLABS_MCP_TOKEN_PATH;
+    if (override)
+        return override;
+    const home = homedir();
+    switch (platform()) {
+        case 'win32':
+            return join(process.env.APPDATA ?? join(home, 'AppData', 'Roaming'), 'ferrlabs', 'mcp', 'token.json');
+        case 'darwin':
+            return join(home, 'Library', 'Application Support', 'ferrlabs', 'mcp', 'token.json');
+        default:
+            return join(process.env.XDG_CONFIG_HOME ?? join(home, '.config'), 'ferrlabs', 'mcp', 'token.json');
+    }
+}
+export async function readPersistedToken() {
+    if (process.env.FERRLABS_MCP_NO_PERSIST === '1')
+        return null;
+    try {
+        const raw = await readFile(defaultTokenPath(), 'utf8');
+        const parsed = JSON.parse(raw);
+        if (typeof parsed.token === 'string' && parsed.token.length > 0) {
+            return parsed.token;
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+export async function writePersistedToken(token, scopes) {
+    if (process.env.FERRLABS_MCP_NO_PERSIST === '1')
+        return;
+    const path = defaultTokenPath();
+    await mkdir(dirname(path), { recursive: true });
+    const payload = {
+        token,
+        obtained_at: new Date().toISOString(),
+        scopes,
+    };
+    await writeFile(path, JSON.stringify(payload, null, 2), 'utf8');
+    if (platform() !== 'win32') {
+        try {
+            await chmod(path, 0o600);
+        }
+        catch {
+            // ignore — best effort on platforms that don't support POSIX modes
+        }
+    }
+}
+export async function clearPersistedToken() {
+    const { unlink } = await import('node:fs/promises');
+    try {
+        await unlink(defaultTokenPath());
+    }
+    catch {
+        // ignore
+    }
+}

package/dist/tools/issues.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"issues.d.ts","sourceRoot":"","sources":["../../src/tools/issues.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAgCpE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,QA+BpD"}
+{"version":3,"file":"issues.d.ts","sourceRoot":"","sources":["../../src/tools/issues.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAsBpE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,QA+BpD"}

package/dist/tools/issues.js

@@ -1,12 +1,6 @@
 import { z } from 'zod';
 import { apiRequest } from './api-client.js';
-const API_TOKEN = process.env.FERRLABS_API_TOKEN ?? process.env.FERRFLOW_API_TOKEN;
-function requireToken() {
-    if (!API_TOKEN) {
-        throw new Error('FERRLABS_API_TOKEN environment variable is required for authenticated operations.');
-    }
-    return API_TOKEN;
-}
+import { getToken } from '../auth/index.js';
 export function registerIssuesTools(server) {
     server.tool('list_issues', 'List FerrTrack issues for a project (FerrTrack — issue tracker)', {
         org_slug: z.string().min(1).describe('Organization slug'),
@@ -20,7 +14,7 @@ export function registerIssuesTools(server) {
             .optional()
             .describe('Items per page (default 25, max 100)'),
     }, async ({ org_slug, project_slug, page, per_page }) => {
-        const token = requireToken();
+        const token = await getToken();
         const params = new URLSearchParams();
         if (page !== undefined)
             params.set('page', String(page));

package/dist/tools/orgs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"orgs.d.ts","sourceRoot":"","sources":["../../src/tools/orgs.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AA+BpE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,QA+BlD"}
+{"version":3,"file":"orgs.d.ts","sourceRoot":"","sources":["../../src/tools/orgs.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAqBpE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,QA+BlD"}

package/dist/tools/orgs.js

@@ -1,15 +1,9 @@
 import { z } from 'zod';
 import { apiRequest } from './api-client.js';
-const API_TOKEN = process.env.FERRLABS_API_TOKEN ?? process.env.FERRFLOW_API_TOKEN;
-function requireToken() {
-    if (!API_TOKEN) {
-        throw new Error('FERRLABS_API_TOKEN environment variable is required for authenticated operations.');
-    }
-    return API_TOKEN;
-}
+import { getToken } from '../auth/index.js';
 export function registerOrgsTools(server) {
     server.tool('list_orgs', 'List FerrLabs organizations the authenticated user belongs to', {}, async () => {
-        const token = requireToken();
+        const token = await getToken();
         const orgs = await apiRequest('/v1/orgs', { token });
         return {
             content: [{ type: 'text', text: JSON.stringify(orgs, null, 2) }],
@@ -18,7 +12,7 @@ export function registerOrgsTools(server) {
     server.tool('list_projects', 'List projects inside a FerrLabs organization', {
         org_slug: z.string().min(1).describe('Organization slug (from list_orgs)'),
     }, async ({ org_slug }) => {
-        const token = requireToken();
+        const token = await getToken();
         const projects = await apiRequest(`/v1/orgs/${encodeURIComponent(org_slug)}/projects`, { token });
         return {
             content: [{ type: 'text', text: JSON.stringify(projects, null, 2) }],

package/dist/tools/subscriptions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subscriptions.d.ts","sourceRoot":"","sources":["../../src/tools/subscriptions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AA0BpE,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,SAAS,QAkB3D"}
+{"version":3,"file":"subscriptions.d.ts","sourceRoot":"","sources":["../../src/tools/subscriptions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAgBpE,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,SAAS,QAkB3D"}

package/dist/tools/subscriptions.js

@@ -1,17 +1,11 @@
 import { z } from 'zod';
 import { apiRequest } from './api-client.js';
-const API_TOKEN = process.env.FERRLABS_API_TOKEN ?? process.env.FERRFLOW_API_TOKEN;
-function requireToken() {
-    if (!API_TOKEN) {
-        throw new Error('FERRLABS_API_TOKEN environment variable is required for authenticated operations.');
-    }
-    return API_TOKEN;
-}
+import { getToken } from '../auth/index.js';
 export function registerSubscriptionsTools(server) {
     server.tool('list_subscriptions', 'List FerrLabs product subscriptions for an organization (FerrVault, FerrTrack, FerrGrowth, FerrFleet)', {
         org_slug: z.string().min(1).describe('Organization slug'),
     }, async ({ org_slug }) => {
-        const token = requireToken();
+        const token = await getToken();
         const subs = await apiRequest(`/v1/orgs/${encodeURIComponent(org_slug)}/subscriptions`, { token });
         return {
             content: [{ type: 'text', text: JSON.stringify(subs, null, 2) }],

package/dist/tools/tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/tools/tokens.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAsCpE,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,QA4EnD"}
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/tools/tokens.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AA4BpE,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,QA4EnD"}

package/dist/tools/tokens.js

@@ -1,15 +1,9 @@
 import { z } from 'zod';
 import { apiRequest } from './api-client.js';
-const API_TOKEN = process.env.FERRLABS_API_TOKEN ?? process.env.FERRFLOW_API_TOKEN;
-function requireToken() {
-    if (!API_TOKEN) {
-        throw new Error('FERRLABS_API_TOKEN environment variable is required for authenticated operations (FERRFLOW_API_TOKEN is accepted as a fallback for backward compatibility).');
-    }
-    return API_TOKEN;
-}
+import { getToken } from '../auth/index.js';
 export function registerTokenTools(server) {
     server.tool('get_me', 'Get the current authenticated FerrLabs user profile', {}, async () => {
-        const token = requireToken();
+        const token = await getToken();
         const user = await apiRequest('/v1/auth/me', { token });
         return {
             content: [
@@ -21,7 +15,7 @@ export function registerTokenTools(server) {
         };
     });
     server.tool('list_tokens', 'List all API tokens for the authenticated user', {}, async () => {
-        const token = requireToken();
+        const token = await getToken();
         const tokens = await apiRequest('/v1/auth/tokens', { token });
         return {
             content: [
@@ -37,7 +31,7 @@ export function registerTokenTools(server) {
         scopes: z.array(z.string()).describe('Token scopes (e.g. ["*"] for all)'),
         expires_at: z.string().optional().describe('Expiration date (ISO 8601)'),
     }, async ({ name, scopes, expires_at }) => {
-        const token = requireToken();
+        const token = await getToken();
         const result = await apiRequest('/v1/auth/tokens', {
             method: 'POST',
             body: { name, scopes, expires_at },
@@ -56,7 +50,7 @@ export function registerTokenTools(server) {
     server.tool('revoke_token', 'Revoke a FerrLabs API token by ID', {
         token_id: z.string().uuid().describe('Token ID to revoke'),
     }, async ({ token_id }) => {
-        const token = requireToken();
+        const token = await getToken();
         await apiRequest(`/v1/auth/tokens/${token_id}`, {
             method: 'DELETE',
             token,

package/dist/tools/vaults.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vaults.d.ts","sourceRoot":"","sources":["../../src/tools/vaults.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAuBpE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,QAmBpD"}
+{"version":3,"file":"vaults.d.ts","sourceRoot":"","sources":["../../src/tools/vaults.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAapE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,QAmBpD"}

package/dist/tools/vaults.js

@@ -1,18 +1,12 @@
 import { z } from 'zod';
 import { apiRequest } from './api-client.js';
-const API_TOKEN = process.env.FERRLABS_API_TOKEN ?? process.env.FERRFLOW_API_TOKEN;
-function requireToken() {
-    if (!API_TOKEN) {
-        throw new Error('FERRLABS_API_TOKEN environment variable is required for authenticated operations.');
-    }
-    return API_TOKEN;
-}
+import { getToken } from '../auth/index.js';
 export function registerVaultsTools(server) {
     server.tool('list_vaults', 'List FerrVault vaults inside a project (FerrVault — secrets management)', {
         org_slug: z.string().min(1).describe('Organization slug'),
         project_slug: z.string().min(1).describe('Project slug'),
     }, async ({ org_slug, project_slug }) => {
-        const token = requireToken();
+        const token = await getToken();
         const vaults = await apiRequest(`/v1/orgs/${encodeURIComponent(org_slug)}/projects/${encodeURIComponent(project_slug)}/vaults`, { token });
         return {
             content: [{ type: 'text', text: JSON.stringify(vaults, null, 2) }],

package/package.json

@@ -50,7 +50,7 @@
     "url": "https://github.com/FerrLabs/MCP.git"
   },
   "type": "module",
-  "version": "5.0.0",
+  "version": "5.1.0",
   "scripts": {
     "build": "tsc",
     "ci:local": "pnpm typecheck && pnpm test && pnpm build",