@ferrvault/mcp 10.12.0 → 11.0.0

package/dist/tools/__tests__/mutations.test.js

@@ -1,120 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-process.env.FERRLABS_API_TOKEN = 'test-token';
-const handlers = new Map();
-const schemas = new Map();
-const mockServer = {
-    tool: vi.fn((name, _desc, schema, handler) => {
-        handlers.set(name, handler);
-        schemas.set(name, schema);
-    }),
-};
-const mockFetch = vi.fn();
-vi.stubGlobal('fetch', mockFetch);
-function ok(body = { id: 's1' }) {
-    return {
-        ok: true,
-        status: 200,
-        text: () => Promise.resolve(JSON.stringify(body)),
-        json: () => Promise.resolve(body),
-    };
-}
-function lastCall() {
-    const [url, init] = mockFetch.mock.calls[0];
-    return {
-        url: String(url),
-        method: init.method ?? 'GET',
-        body: init.body ? JSON.parse(init.body) : undefined,
-    };
-}
-const VAULT_BASE = 'https://api.ferrlabs.com/orgs/acme/projects/web/vaults/v1';
-describe('ferrvault write tools', () => {
-    beforeEach(async () => {
-        vi.clearAllMocks();
-        handlers.clear();
-        schemas.clear();
-        mockFetch.mockResolvedValue(ok());
-        const { registerSecretMutationTools } = await import('../secret-mutations.js');
-        const { registerVaultMutationTools } = await import('../vaults.js');
-        registerSecretMutationTools(mockServer);
-        registerVaultMutationTools(mockServer);
-    });
-    it('create_secret posts to the vault secrets collection on the FerrLabs API', async () => {
-        await handlers.get('create_secret')({
-            org_slug: 'acme',
-            project_slug: 'web',
-            vault_id: 'v1',
-            name: 'STRIPE_API_KEY',
-            value: 's3cret',
-        });
-        const call = lastCall();
-        expect(call.url).toBe(`${VAULT_BASE}/secrets`);
-        expect(call.method).toBe('POST');
-        expect(call.body).toEqual({ name: 'STRIPE_API_KEY', value: 's3cret', description: null });
-    });
-    it('update_secret patches only the fields that were passed', async () => {
-        await handlers.get('update_secret')({
-            org_slug: 'acme',
-            project_slug: 'web',
-            vault_id: 'v1',
-            secret_id: 'sec1',
-            description: 'rotated by hand',
-        });
-        const call = lastCall();
-        expect(call.url).toBe(`${VAULT_BASE}/secrets/sec1`);
-        expect(call.method).toBe('PATCH');
-        expect(call.body).toEqual({ description: 'rotated by hand' });
-    });
-    it('rotate_secret posts to the rotate sub-resource, not the secret itself', async () => {
-        await handlers.get('rotate_secret')({
-            org_slug: 'acme',
-            project_slug: 'web',
-            vault_id: 'v1',
-            secret_id: 'sec1',
-            value: 'new-value',
-        });
-        const call = lastCall();
-        expect(call.url).toBe(`${VAULT_BASE}/secrets/sec1/rotate`);
-        expect(call.method).toBe('POST');
-        expect(call.body).toEqual({ value: 'new-value' });
-    });
-    it('delete_secret uses DELETE and names the id it removed', async () => {
-        const result = await handlers.get('delete_secret')({
-            org_slug: 'acme',
-            project_slug: 'web',
-            vault_id: 'v1',
-            secret_id: 'sec1',
-        });
-        const call = lastCall();
-        expect(call.url).toBe(`${VAULT_BASE}/secrets/sec1`);
-        expect(call.method).toBe('DELETE');
-        expect(result.content[0].text).toContain('sec1');
-    });
-    it('delete_vault targets the vault itself rather than a secret under it', async () => {
-        const result = await handlers.get('delete_vault')({
-            org_slug: 'acme',
-            project_slug: 'web',
-            vault_id: 'v1',
-        });
-        const call = lastCall();
-        expect(call.url).toBe(VAULT_BASE);
-        expect(call.method).toBe('DELETE');
-        expect(result.content[0].text).toContain('v1');
-    });
-    it('escapes path segments so a slug cannot climb the path', async () => {
-        await handlers.get('delete_secret')({
-            org_slug: 'acme',
-            project_slug: 'web',
-            vault_id: 'v1',
-            secret_id: '../../../orgs',
-        });
-        const call = lastCall();
-        expect(call.url).toBe(`${VAULT_BASE}/secrets/..%2F..%2F..%2Forgs`);
-        expect(call.url).not.toContain('/../');
-    });
-    it('rejects a secret name that is not SCREAMING_SNAKE_CASE', () => {
-        const name = schemas.get('create_secret').name;
-        expect(name.safeParse('STRIPE_API_KEY').success).toBe(true);
-        expect(name.safeParse('stripe_api_key').success).toBe(false);
-        expect(name.safeParse('Stripe-Api-Key').success).toBe(false);
-    });
-});

package/dist/tools/audit.d.ts

@@ -1,3 +0,0 @@
-import { type McpServer } from '@ferrlabs/mcp-core';
-export declare function registerVaultAuditTools(server: McpServer): void;
-//# sourceMappingURL=audit.d.ts.map

package/dist/tools/audit.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/tools/audit.ts"],"names":[],"mappings":"AACA,OAAO,EAAwB,KAAK,SAAS,EAAc,MAAM,oBAAoB,CAAC;AAqBtF,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,SAAS,QAqDxD"}

package/dist/tools/audit.js

@@ -1,39 +0,0 @@
-import { z } from 'zod';
-import { apiRequest, getToken, toToolText } from '@ferrlabs/mcp-core';
-export function registerVaultAuditTools(server) {
-    server.tool('get_vault_audit_log', 'Recent audit-log entries for a FerrVault vault — who read/wrote/rotated what, when.', {
-        org_slug: z.string().min(1).describe('Organization slug'),
-        project_slug: z.string().min(1).describe('Project slug'),
-        vault_id: z.string().min(1).describe('Vault id'),
-        limit: z
-            .number()
-            .int()
-            .min(1)
-            .max(200)
-            .optional()
-            .describe('Max entries to return (default 50).'),
-    }, async ({ org_slug, project_slug, vault_id, limit }) => {
-        const token = await getToken();
-        const qs = limit !== undefined ? `?limit=${limit}` : '';
-        const entries = await apiRequest(`/orgs/${encodeURIComponent(org_slug)}/projects/${encodeURIComponent(project_slug)}/vaults/${encodeURIComponent(vault_id)}/audit-log${qs}`, { token });
-        return {
-            content: [
-                {
-                    type: 'text',
-                    text: toToolText(entries, { narrowWith: 'Pass a smaller limit.' }),
-                },
-            ],
-        };
-    });
-    server.tool('list_secret_requests', 'List pending "missing secret" requests filed by operators/SDKs when a name lookup misses. Useful to spot secrets that need to be provisioned.', {
-        org_slug: z.string().min(1).describe('Organization slug'),
-        project_slug: z.string().min(1).describe('Project slug'),
-        vault_id: z.string().min(1).describe('Vault id'),
-    }, async ({ org_slug, project_slug, vault_id }) => {
-        const token = await getToken();
-        const requests = await apiRequest(`/orgs/${encodeURIComponent(org_slug)}/projects/${encodeURIComponent(project_slug)}/vaults/${encodeURIComponent(vault_id)}/secret-requests`, { token });
-        return {
-            content: [{ type: 'text', text: toToolText(requests) }],
-        };
-    });
-}

package/dist/tools/secret-mutations.d.ts

@@ -1,3 +0,0 @@
-import { type McpServer } from '@ferrlabs/mcp-core';
-export declare function registerSecretMutationTools(server: McpServer): void;
-//# sourceMappingURL=secret-mutations.d.ts.map

package/dist/tools/secret-mutations.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"secret-mutations.d.ts","sourceRoot":"","sources":["../../src/tools/secret-mutations.ts"],"names":[],"mappings":"AACA,OAAO,EAAwB,KAAK,SAAS,EAAc,MAAM,oBAAoB,CAAC;AAetF,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,SAAS,QA2H5D"}

package/dist/tools/secret-mutations.js

@@ -1,86 +0,0 @@
-import { z } from 'zod';
-import { apiRequest, getToken, toToolText } from '@ferrlabs/mcp-core';
-function vaultBase(org_slug, project_slug, vault_id) {
-    return `/orgs/${encodeURIComponent(org_slug)}/projects/${encodeURIComponent(project_slug)}/vaults/${encodeURIComponent(vault_id)}`;
-}
-export function registerSecretMutationTools(server) {
-    server.tool('create_secret', 'Create a new secret inside a vault. The value is encrypted server-side under the org KEK (envelope encryption) — it never lands in clear in the DB.', {
-        org_slug: z.string().min(1).describe('Organization slug'),
-        project_slug: z.string().min(1).describe('Project slug'),
-        vault_id: z.string().min(1).describe('Vault id'),
-        name: z
-            .string()
-            .min(1)
-            .max(200)
-            .regex(/^[A-Z][A-Z0-9_]*$/, 'name must be SCREAMING_SNAKE_CASE')
-            .describe('Secret name (e.g. STRIPE_API_KEY)'),
-        value: z.string().min(1).describe('Plaintext value — encrypted at rest by the server.'),
-        description: z.string().max(500).optional().describe('Optional human-readable note.'),
-    }, async ({ org_slug, project_slug, vault_id, name, value, description }) => {
-        const token = await getToken();
-        const secret = await apiRequest(`${vaultBase(org_slug, project_slug, vault_id)}/secrets`, {
-            token,
-            method: 'POST',
-            body: { name, value, description: description ?? null },
-        });
-        return {
-            content: [{ type: 'text', text: toToolText(secret) }],
-        };
-    });
-    server.tool('update_secret', 'Update a secret. Pass `value` to rotate it in place (preserves name + id); pass `description` to retitle it. Either or both may be omitted; nothing is touched unless you pass it.', {
-        org_slug: z.string().min(1).describe('Organization slug'),
-        project_slug: z.string().min(1).describe('Project slug'),
-        vault_id: z.string().min(1).describe('Vault id'),
-        secret_id: z.string().min(1).describe('Secret id'),
-        value: z.string().min(1).optional().describe('New plaintext value.'),
-        description: z.string().max(500).nullable().optional(),
-    }, async ({ org_slug, project_slug, vault_id, secret_id, ...patch }) => {
-        const token = await getToken();
-        const body = {};
-        for (const [k, v] of Object.entries(patch)) {
-            if (v !== undefined)
-                body[k] = v;
-        }
-        const secret = await apiRequest(`${vaultBase(org_slug, project_slug, vault_id)}/secrets/${encodeURIComponent(secret_id)}`, { token, method: 'PATCH', body });
-        return {
-            content: [{ type: 'text', text: toToolText(secret) }],
-        };
-    });
-    server.tool('delete_secret', 'Permanently delete a secret. Irreversible at the API level — recovery only via the soft-delete window on the FerrVault dashboard.', {
-        org_slug: z.string().min(1).describe('Organization slug'),
-        project_slug: z.string().min(1).describe('Project slug'),
-        vault_id: z.string().min(1).describe('Vault id'),
-        secret_id: z.string().min(1).describe('Secret id'),
-    }, async ({ org_slug, project_slug, vault_id, secret_id }) => {
-        const token = await getToken();
-        await apiRequest(`${vaultBase(org_slug, project_slug, vault_id)}/secrets/${encodeURIComponent(secret_id)}`, { token, method: 'DELETE' });
-        return {
-            content: [{ type: 'text', text: `Secret ${secret_id} deleted.` }],
-        };
-    });
-    server.tool('rotate_secret', 'Rotate a secret in-place — fans the new value through any FerrVault K8s operator deployments that mount it via SecretRef, so consumers pick up the new value on next sync without an app restart.', {
-        org_slug: z.string().min(1).describe('Organization slug'),
-        project_slug: z.string().min(1).describe('Project slug'),
-        vault_id: z.string().min(1).describe('Vault id'),
-        secret_id: z.string().min(1).describe('Secret id'),
-        value: z.string().min(1).describe('New plaintext value (will replace the current).'),
-    }, async ({ org_slug, project_slug, vault_id, secret_id, value }) => {
-        const token = await getToken();
-        const secret = await apiRequest(`${vaultBase(org_slug, project_slug, vault_id)}/secrets/${encodeURIComponent(secret_id)}/rotate`, { token, method: 'POST', body: { value } });
-        return {
-            content: [{ type: 'text', text: toToolText(secret) }],
-        };
-    });
-    server.tool('archive_secret_request', 'Archive a "missing secret" request — marks it handled and removes it from the active list. Use after provisioning the secret (or deciding it should not be provisioned).', {
-        org_slug: z.string().min(1).describe('Organization slug'),
-        project_slug: z.string().min(1).describe('Project slug'),
-        vault_id: z.string().min(1).describe('Vault id'),
-        request_id: z.string().min(1).describe('Secret-request id'),
-    }, async ({ org_slug, project_slug, vault_id, request_id }) => {
-        const token = await getToken();
-        await apiRequest(`${vaultBase(org_slug, project_slug, vault_id)}/secret-requests/${encodeURIComponent(request_id)}/archive`, { token, method: 'POST' });
-        return {
-            content: [{ type: 'text', text: `Secret request ${request_id} archived.` }],
-        };
-    });
-}

package/dist/tools/vault-details.d.ts

@@ -1,13 +0,0 @@
-import { type McpServer } from '@ferrlabs/mcp-core';
-interface VaultDetails {
-    id: string;
-    name: string;
-    description: string | null;
-    secret_count: number;
-    created_at: string;
-    updated_at: string;
-}
-export declare function fetchVaultDetails(orgSlug: string, projectSlug: string, vaultId: string): Promise<VaultDetails>;
-export declare function registerVaultDetailsTool(server: McpServer): void;
-export {};
-//# sourceMappingURL=vault-details.d.ts.map

package/dist/tools/vault-details.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"vault-details.d.ts","sourceRoot":"","sources":["../../src/tools/vault-details.ts"],"names":[],"mappings":"AACA,OAAO,EAAwB,KAAK,SAAS,EAAc,MAAM,oBAAoB,CAAC;AAEtF,UAAU,YAAY;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,YAAY,CAAC,CAMvB;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,SAAS,QAgBzD"}

package/dist/tools/vault-details.js

@@ -1,18 +0,0 @@
-import { z } from 'zod';
-import { apiRequest, getToken, toToolText } from '@ferrlabs/mcp-core';
-export async function fetchVaultDetails(orgSlug, projectSlug, vaultId) {
-    const token = await getToken();
-    return apiRequest(`/orgs/${encodeURIComponent(orgSlug)}/projects/${encodeURIComponent(projectSlug)}/vaults/${encodeURIComponent(vaultId)}`, { token });
-}
-export function registerVaultDetailsTool(server) {
-    server.tool('get_vault', 'Get detailed information about a single FerrVault vault — name, description, secret count, timestamps.', {
-        org_slug: z.string().min(1).describe('Organization slug'),
-        project_slug: z.string().min(1).describe('Project slug'),
-        vault_id: z.string().min(1).describe('Vault id'),
-    }, async ({ org_slug, project_slug, vault_id }) => {
-        const vault = await fetchVaultDetails(org_slug, project_slug, vault_id);
-        return {
-            content: [{ type: 'text', text: toToolText(vault) }],
-        };
-    });
-}