@firecms/mcp-server 3.3.0-canary.451aa49 → 3.3.0-canary.7e3431b

package/dist/tools/users.d.ts

@@ -2,6 +2,8 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { FireCMSApiClient } from "../api-client.js";
 /**
  * Register user management tools.
+ * Read operations are available to all authenticated users.
+ * Write operations (add, update, remove) are admin-only.
  */
 export declare function registerUserTools(server: McpServer, api: FireCMSApiClient): void;
 //# sourceMappingURL=users.d.ts.map

package/dist/tools/users.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../../src/tools/users.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,gBAAgB,QAoFzE"}
+{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../../src/tools/users.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,gBAAgB,QAyFzE"}

package/dist/tools/users.js

@@ -1,6 +1,8 @@
 import { z } from "zod";
 /**
  * Register user management tools.
+ * Read operations are available to all authenticated users.
+ * Write operations (add, update, remove) are admin-only.
  */
 export function registerUserTools(server, api) {
     server.registerTool("list_users", {
@@ -8,6 +10,7 @@ export function registerUserTools(server, api) {
         inputSchema: {
             projectId: z.string().describe("The Firebase project ID"),
         },
+        annotations: { readOnlyHint: true },
     }, async ({ projectId }) => {
         try {
             const result = await api.listUsers(projectId);
@@ -18,7 +21,7 @@ export function registerUserTools(server, api) {
         }
     });
     server.registerTool("add_user", {
-        description: "Invite a new user to a FireCMS project. Sends an invitation email.",
+        description: "Invite a new user to a FireCMS project. Sends an invitation email. Admin-only.",
         inputSchema: {
             projectId: z.string().describe("The Firebase project ID"),
             email: z.string().email().describe("Email address of the user to invite"),
@@ -26,6 +29,7 @@ export function registerUserTools(server, api) {
         },
     }, async ({ projectId, email, roles }) => {
         try {
+            await api.assertAdmin(projectId);
             const result = await api.createUser(projectId, email, roles);
             return {
                 content: [{ type: "text", text: `Invited ${email} with roles: ${roles.join(", ")}\n\n${JSON.stringify(result, null, 2)}` }],
@@ -36,7 +40,7 @@ export function registerUserTools(server, api) {
         }
     });
     server.registerTool("update_user_roles", {
-        description: "Update the roles of an existing user in a FireCMS project",
+        description: "Update the roles of an existing user in a FireCMS project. Admin-only.",
         inputSchema: {
             projectId: z.string().describe("The Firebase project ID"),
             userId: z.string().describe("The user ID to update"),
@@ -44,6 +48,7 @@ export function registerUserTools(server, api) {
         },
     }, async ({ projectId, userId, roles }) => {
         try {
+            await api.assertAdmin(projectId);
             const result = await api.updateUser(projectId, userId, roles);
             return {
                 content: [{ type: "text", text: `Updated user ${userId} roles to: ${roles.join(", ")}\n\n${JSON.stringify(result, null, 2)}` }],
@@ -54,13 +59,15 @@ export function registerUserTools(server, api) {
         }
     });
     server.registerTool("remove_user", {
-        description: "Remove a user from a FireCMS project, revoking their access",
+        description: "Remove a user from a FireCMS project, revoking their access. Admin-only.",
         inputSchema: {
             projectId: z.string().describe("The Firebase project ID"),
             userId: z.string().describe("The user ID to remove"),
         },
+        annotations: { destructiveHint: true },
     }, async ({ projectId, userId }) => {
         try {
+            await api.assertAdmin(projectId);
             const result = await api.deleteUser(projectId, userId);
             return {
                 content: [{ type: "text", text: `Removed user ${userId}\n\n${JSON.stringify(result, null, 2)}` }],

package/dist/tools/users.js.map

@@ -1 +1 @@
-{"version":3,"file":"users.js","sourceRoot":"","sources":["../../src/tools/users.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAiB,EAAE,GAAqB;IAEtE,MAAM,CAAC,YAAY,CACf,YAAY,EACZ;QACI,WAAW,EAAE,qGAAqG;QAClH,WAAW,EAAE;YACT,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yBAAyB,CAAC;SAC5D;KACJ,EACD,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;QACpB,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YAC9C,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3F,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YAClB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACpG,CAAC;IACL,CAAC,CACJ,CAAC;IAEF,MAAM,CAAC,YAAY,CACf,UAAU,EACV;QACI,WAAW,EAAE,oEAAoE;QACjF,WAAW,EAAE;YACT,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yBAAyB,CAAC;YACzD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC,qCAAqC,CAAC;YACzE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;SACpF;KACJ,EACD,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE;QAClC,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YAC7D,OAAO;gBACH,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,WAAW,KAAK,gBAAgB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;aACvI,CAAC;QACN,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YAClB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACpG,CAAC;IACL,CAAC,CACJ,CAAC;IAEF,MAAM,CAAC,YAAY,CACf,mBAAmB,EACnB;QACI,WAAW,EAAE,2DAA2D;QACxE,WAAW,EAAE;YACT,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yBAAyB,CAAC;YACzD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;YACpD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;SAC9E;KACJ,EACD,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE;QACnC,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YAC9D,OAAO;gBACH,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,gBAAgB,MAAM,cAAc,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;aAC3I,CAAC;QACN,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YAClB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACpG,CAAC;IACL,CAAC,CACJ,CAAC;IAEF,MAAM,CAAC,YAAY,CACf,aAAa,EACb;QACI,WAAW,EAAE,6DAA6D;QAC1E,WAAW,EAAE;YACT,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yBAAyB,CAAC;YACzD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;SACvD;KACJ,EACD,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE;QAC5B,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACvD,OAAO;gBACH,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,gBAAgB,MAAM,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;aAC7G,CAAC;QACN,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YAClB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACpG,CAAC;IACL,CAAC,CACJ,CAAC;AACN,CAAC"}
+{"version":3,"file":"users.js","sourceRoot":"","sources":["../../src/tools/users.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAiB,EAAE,GAAqB;IAEtE,MAAM,CAAC,YAAY,CACf,YAAY,EACZ;QACI,WAAW,EAAE,qGAAqG;QAClH,WAAW,EAAE;YACT,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yBAAyB,CAAC;SAC5D;QACD,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;KACtC,EACD,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;QACpB,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YAC9C,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3F,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YAClB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACpG,CAAC;IACL,CAAC,CACJ,CAAC;IAEF,MAAM,CAAC,YAAY,CACf,UAAU,EACV;QACI,WAAW,EAAE,gFAAgF;QAC7F,WAAW,EAAE;YACT,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yBAAyB,CAAC;YACzD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC,qCAAqC,CAAC;YACzE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;SACpF;KACJ,EACD,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE;QAClC,IAAI,CAAC;YACD,MAAM,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YACjC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YAC7D,OAAO;gBACH,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,WAAW,KAAK,gBAAgB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;aACvI,CAAC;QACN,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YAClB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACpG,CAAC;IACL,CAAC,CACJ,CAAC;IAEF,MAAM,CAAC,YAAY,CACf,mBAAmB,EACnB;QACI,WAAW,EAAE,wEAAwE;QACrF,WAAW,EAAE;YACT,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yBAAyB,CAAC;YACzD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;YACpD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;SAC9E;KACJ,EACD,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE;QACnC,IAAI,CAAC;YACD,MAAM,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YACjC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YAC9D,OAAO;gBACH,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,gBAAgB,MAAM,cAAc,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;aAC3I,CAAC;QACN,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YAClB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACpG,CAAC;IACL,CAAC,CACJ,CAAC;IAEF,MAAM,CAAC,YAAY,CACf,aAAa,EACb;QACI,WAAW,EAAE,0EAA0E;QACvF,WAAW,EAAE;YACT,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yBAAyB,CAAC;YACzD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;SACvD;QACD,WAAW,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;KACzC,EACD,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE;QAC5B,IAAI,CAAC;YACD,MAAM,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YACjC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACvD,OAAO;gBACH,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,gBAAgB,MAAM,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;aAC7G,CAAC;QACN,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YAClB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACpG,CAAC;IACL,CAAC,CACJ,CAAC;AACN,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@firecms/mcp-server",
-  "version": "3.3.0-canary.451aa49",
+  "version": "3.3.0-canary.7e3431b",
   "publishConfig": {
     "access": "public"
   },
@@ -18,9 +18,9 @@
     "clean": "rm -rf dist"
   },
   "dependencies": {
-    "@firecms/cli": "^3.3.0-canary.451aa49",
+    "@firecms/cli": "^3.3.0-canary.7e3431b",
     "@modelcontextprotocol/sdk": "^1.12.1",
-    "axios": "^1.7.0",
+    "axios": "^1.16.1",
     "zod": "^3.24.0"
   },
   "devDependencies": {
@@ -42,7 +42,7 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/FireCMSco/firecms"
-  },
-  "gitHead": "772b4a7f64893038f0cc13669d6bc66ec858fc49"
+    "url": "https://github.com/FireCMSco/firecms.git",
+    "directory": "packages/mcp_server"
+  }
 }

package/src/api-client.ts

@@ -1,14 +1,34 @@
 import axios, { AxiosInstance, AxiosRequestConfig } from "axios";
-import { getValidTokens } from "./auth.js";
+import { getValidTokens, getCurrentUserEmail } from "./auth.js";
 
 const API_URL = "https://api.firecms.co";
 
+/**
+ * The Firestore path where collection schemas are persisted in the CLIENT's
+ * Firestore (not the SaaS backend). The backend's document CRUD endpoints
+ * proxy operations into the client's project Firestore.
+ */
+const COLLECTIONS_CONFIG_PATH = "__FIRECMS/config/collections";
+
 /**
  * Typed HTTP client for the FireCMS Cloud backend REST API.
  * Uses the same tokens as the FireCMS CLI (from ~/.firecms/tokens.json).
+ *
+ * Architecture notes:
+ * - Collection schemas are stored in the CLIENT's Firestore at
+ *   `__FIRECMS/config/collections/{collectionId}`. We use the existing
+ *   document CRUD proxy endpoints to read/write them.
+ * - Project config (name, colors, locale) is stored in the SaaS backend's
+ *   Firestore at `projects/{projectId}`. Dedicated `/config` endpoints
+ *   handle this.
+ * - Bulk import uses the admin `batch_write` endpoint.
  */
 export class FireCMSApiClient {
     private client: AxiosInstance;
+    private adminCache: Map<string, { isAdmin: boolean; checkedAt: number }> = new Map();
+
+    /** Cache admin checks for 5 minutes */
+    private static ADMIN_CACHE_TTL_MS = 5 * 60 * 1000;
 
     constructor() {
         this.client = axios.create({
@@ -38,6 +58,44 @@ export class FireCMSApiClient {
         return response.data;
     }
 
+    // ─── Admin guard ──────────────────────────────────────────
+
+    /**
+     * Verify that the current user is an admin of the given project.
+     * Results are cached for 5 minutes per project.
+     * @throws Error if the user is not an admin.
+     */
+    async assertAdmin(projectId: string): Promise<void> {
+        const cached = this.adminCache.get(projectId);
+        if (cached && (Date.now() - cached.checkedAt) < FireCMSApiClient.ADMIN_CACHE_TTL_MS) {
+            if (!cached.isAdmin) {
+                throw this.notAdminError(projectId);
+            }
+            return;
+        }
+
+        const users = await this.listUsers(projectId);
+        const currentEmail = getCurrentUserEmail();
+        const me = (users as any[]).find((u: any) =>
+            u.email?.toLowerCase() === currentEmail?.toLowerCase()
+        );
+        const isAdmin = me?.roles?.includes("admin") ?? false;
+
+        this.adminCache.set(projectId, { isAdmin, checkedAt: Date.now() });
+
+        if (!isAdmin) {
+            throw this.notAdminError(projectId);
+        }
+    }
+
+    private notAdminError(projectId: string): Error {
+        const email = getCurrentUserEmail() ?? "unknown";
+        return new Error(
+            `Access denied: ${email} is not an admin of project "${projectId}". ` +
+            `The FireCMS MCP server requires admin access for this operation.`
+        );
+    }
+
     // ─── Projects ──────────────────────────────────────────
 
     async listProjects(): Promise<any> {
@@ -51,6 +109,23 @@ export class FireCMSApiClient {
         });
     }
 
+    // ─── Project Config (SaaS backend Firestore) ──────────
+
+    async getProjectConfig(projectId: string): Promise<any> {
+        return this.request({
+            method: "GET",
+            url: `/projects/${projectId}/config`,
+        });
+    }
+
+    async updateProjectConfig(projectId: string, data: Record<string, any>): Promise<any> {
+        return this.request({
+            method: "PATCH",
+            url: `/projects/${projectId}/config`,
+            data,
+        });
+    }
+
     // ─── Users ─────────────────────────────────────────────
 
     async listUsers(projectId: string): Promise<any> {
@@ -77,7 +152,129 @@ export class FireCMSApiClient {
         return this.request({ method: "DELETE", url: `/projects/${projectId}/users/${userId}` });
     }
 
-    // ─── Collections ───────────────────────────────────────
+    // ─── Collection Schemas (client Firestore via document proxy) ───────
+
+    /**
+     * List all persisted collection schemas.
+     * Uses the document list endpoint to read from `__FIRECMS/config/collections`.
+     */
+    async listCollectionSchemas(projectId: string): Promise<any[]> {
+        const response: any = await this.request({
+            method: "POST",
+            url: `/projects/${projectId}/documents/list`,
+            data: { path: COLLECTIONS_CONFIG_PATH, limit: 500 },
+        });
+        // The document list endpoint returns { data: Document[] } or { documents: Document[] }
+        return response?.data ?? response?.documents ?? [];
+    }
+
+    /**
+     * Get a single collection schema by its document ID.
+     */
+    async getCollectionSchema(projectId: string, collectionId: string): Promise<any> {
+        return this.request({
+            method: "POST",
+            url: `/projects/${projectId}/documents/get`,
+            data: { path: COLLECTIONS_CONFIG_PATH, documentId: collectionId },
+        });
+    }
+
+    /**
+     * Create or fully replace a collection schema.
+     * Uses the document create/update endpoints to write to `__FIRECMS/config/collections/{id}`.
+     */
+    async saveCollectionSchema(projectId: string, collectionId: string, schema: Record<string, any>): Promise<any> {
+        // Try update first (if doc exists), fall back to create
+        try {
+            return await this.request({
+                method: "POST",
+                url: `/projects/${projectId}/documents/update`,
+                data: {
+                    path: COLLECTIONS_CONFIG_PATH,
+                    documentId: collectionId,
+                    data: { ...schema, id: collectionId },
+                },
+            });
+        } catch (error: any) {
+            // If the document doesn't exist, create it
+            if (error.response?.status === 404) {
+                return this.request({
+                    method: "POST",
+                    url: `/projects/${projectId}/documents/create`,
+                    data: {
+                        path: COLLECTIONS_CONFIG_PATH,
+                        documentId: collectionId,
+                        data: { ...schema, id: collectionId },
+                    },
+                });
+            }
+            throw error;
+        }
+    }
+
+    /**
+     * Partially update an existing collection schema (merge).
+     */
+    async updateCollectionSchema(projectId: string, collectionId: string, data: Record<string, any>): Promise<any> {
+        return this.request({
+            method: "POST",
+            url: `/projects/${projectId}/documents/update`,
+            data: {
+                path: COLLECTIONS_CONFIG_PATH,
+                documentId: collectionId,
+                data,
+            },
+        });
+    }
+
+    /**
+     * Delete a collection schema.
+     */
+    async deleteCollectionSchema(projectId: string, collectionId: string): Promise<any> {
+        return this.request({
+            method: "POST",
+            url: `/projects/${projectId}/documents/delete`,
+            data: {
+                path: COLLECTIONS_CONFIG_PATH,
+                documentId: collectionId,
+            },
+        });
+    }
+
+    /**
+     * Add or update a single property within a collection schema.
+     * Reads the current schema, modifies the property, and writes back.
+     */
+    async saveProperty(projectId: string, collectionId: string, propertyKey: string, property: Record<string, any>, namespace?: string): Promise<any> {
+        // Get current schema
+        const current: any = await this.getCollectionSchema(projectId, collectionId);
+        const schemaData = current?.data ?? current ?? {};
+
+        // Build the properties map
+        const properties = schemaData.properties ?? {};
+        const key = namespace ? `${namespace}:${propertyKey}` : propertyKey;
+        properties[key] = property;
+
+        // Write back
+        return this.updateCollectionSchema(projectId, collectionId, { properties });
+    }
+
+    /**
+     * Delete a property from a collection schema.
+     * Reads the current schema, removes the property, and writes back.
+     */
+    async deleteProperty(projectId: string, collectionId: string, propertyKey: string, namespace?: string): Promise<any> {
+        const current: any = await this.getCollectionSchema(projectId, collectionId);
+        const schemaData = current?.data ?? current ?? {};
+
+        const properties = schemaData.properties ?? {};
+        const key = namespace ? `${namespace}:${propertyKey}` : propertyKey;
+        delete properties[key];
+
+        return this.updateCollectionSchema(projectId, collectionId, { properties });
+    }
+
+    // ─── AI Collection Generation ──────────────────────────
 
     async generateCollection(prompt: string, existingCollections: any[] = [], existingCollection?: any): Promise<any> {
         return this.request({
@@ -87,7 +284,7 @@ export class FireCMSApiClient {
         });
     }
 
-    // ─── Documents (Firestore CRUD via backend) ─────────────
+    // ─── Documents (Firestore CRUD via backend proxy) ──────
 
     async listDocuments(projectId: string, body: {
         path: string;
@@ -143,4 +340,46 @@ export class FireCMSApiClient {
             data: { path, databaseId },
         });
     }
+
+    // ─── Data Import (admin batch_write) ────────────────────
+
+    /**
+     * Bulk import documents into a collection using the admin batch_write endpoint.
+     * This writes directly to the client's Firestore via the delegated service account.
+     */
+    async importDocuments(projectId: string, body: {
+        path: string;
+        documents: Array<{ id?: string; data: Record<string, any> }>;
+        merge?: boolean;
+        databaseId?: string;
+    }): Promise<any> {
+        // Transform documents into BatchOperation format expected by the backend
+        const operations = body.documents.map(doc => ({
+            type: (body.merge ? "update" : "set") as "set" | "update",
+            path: body.path,
+            documentId: doc.id ?? this.generateId(),
+            data: doc.data,
+        }));
+
+        return this.request({
+            method: "POST",
+            url: `/projects/${projectId}/admin/documents/batch_write`,
+            data: {
+                operations,
+                databaseId: body.databaseId,
+            },
+        });
+    }
+
+    /**
+     * Generate a random Firestore-style document ID.
+     */
+    private generateId(): string {
+        const chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+        let id = "";
+        for (let i = 0; i < 20; i++) {
+            id += chars.charAt(Math.floor(Math.random() * chars.length));
+        }
+        return id;
+    }
 }

package/src/resources/project.ts

@@ -3,9 +3,12 @@ import { FireCMSApiClient } from "../api-client.js";
 
 /**
  * Register MCP resources — read-only contextual data about FireCMS projects.
+ * Resources provide ambient context to the LLM without requiring explicit tool calls.
  */
 export function registerProjectResources(server: McpServer, api: FireCMSApiClient) {
 
+    // ─── Root collections ──────────────────────────────────
+
     server.registerResource(
         "project-collections",
         new ResourceTemplate("firecms://projects/{projectId}/collections", { list: undefined }),
@@ -36,6 +39,8 @@ export function registerProjectResources(server: McpServer, api: FireCMSApiClien
         }
     );
 
+    // ─── Project users ─────────────────────────────────────
+
     server.registerResource(
         "project-users",
         new ResourceTemplate("firecms://projects/{projectId}/users", { list: undefined }),
@@ -65,4 +70,68 @@ export function registerProjectResources(server: McpServer, api: FireCMSApiClien
             }
         }
     );
+
+    // ─── Collection schemas (full schema tree) ─────────────
+
+    server.registerResource(
+        "project-schemas",
+        new ResourceTemplate("firecms://projects/{projectId}/schemas", { list: undefined }),
+        {
+            description: "All persisted collection schemas for a FireCMS project — the full configuration tree including properties, validation rules, and display settings",
+            mimeType: "application/json",
+        },
+        async (uri, variables) => {
+            const projectId = variables.projectId as string;
+            try {
+                const schemas = await api.listCollectionSchemas(projectId);
+                return {
+                    contents: [{
+                        uri: uri.href,
+                        mimeType: "application/json",
+                        text: JSON.stringify(schemas, null, 2),
+                    }],
+                };
+            } catch (error: any) {
+                return {
+                    contents: [{
+                        uri: uri.href,
+                        mimeType: "application/json",
+                        text: JSON.stringify({ error: error.message }),
+                    }],
+                };
+            }
+        }
+    );
+
+    // ─── Project configuration ─────────────────────────────
+
+    server.registerResource(
+        "project-config",
+        new ResourceTemplate("firecms://projects/{projectId}/config", { list: undefined }),
+        {
+            description: "Project configuration — name, colors, subscription plan, feature toggles, and locale settings",
+            mimeType: "application/json",
+        },
+        async (uri, variables) => {
+            const projectId = variables.projectId as string;
+            try {
+                const config = await api.getProjectConfig(projectId);
+                return {
+                    contents: [{
+                        uri: uri.href,
+                        mimeType: "application/json",
+                        text: JSON.stringify(config, null, 2),
+                    }],
+                };
+            } catch (error: any) {
+                return {
+                    contents: [{
+                        uri: uri.href,
+                        mimeType: "application/json",
+                        text: JSON.stringify({ error: error.message }),
+                    }],
+                };
+            }
+        }
+    );
 }

package/src/server.ts

@@ -4,17 +4,32 @@ import { registerAuthTools } from "./tools/auth.js";
 import { registerProjectTools } from "./tools/projects.js";
 import { registerUserTools } from "./tools/users.js";
 import { registerCollectionTools } from "./tools/collections.js";
+import { registerCollectionSchemaTools } from "./tools/collection-schemas.js";
 import { registerDocumentTools } from "./tools/documents.js";
 import { registerExportTools } from "./tools/export.js";
+import { registerImportTools } from "./tools/import.js";
+import { registerProjectConfigTools } from "./tools/project-config.js";
 import { registerProjectResources } from "./resources/project.js";
 
 /**
  * Create and configure the FireCMS MCP server with all tools and resources.
+ *
+ * Tool categories:
+ * - Auth:              Login/logout/current user
+ * - Projects:          List projects, root collections
+ * - Project Config:    Name, colors, locale, feature toggles (admin-only)
+ * - Users:             User management (invite, roles, remove)
+ * - Collection Schemas: CRUD for collection configurations (admin-only)
+ * - AI Collections:    AI-powered schema generation/modification
+ * - Documents:         Firestore CRUD (list, get, create, update, delete, count)
+ * - Export:            Data export as JSON
+ * - Import:            Bulk data import (admin-only)
+ * - Resources:         Read-only context (collections, users, schemas, config)
  */
 export function createFireCMSMcpServer(): McpServer {
     const server = new McpServer({
         name: "FireCMS Cloud",
-        version: "0.1.0",
+        version: "0.2.0",
     });
 
     const api = new FireCMSApiClient();
@@ -26,6 +41,12 @@ export function createFireCMSMcpServer(): McpServer {
     registerProjectTools(server, api);
     registerUserTools(server, api);
 
+    // Project configuration (admin-only)
+    registerProjectConfigTools(server, api);
+
+    // Collection schema CRUD (admin-only — the core feature for agent-driven CMS management)
+    registerCollectionSchemaTools(server, api);
+
     // Collection schema AI tools (via backend API)
     registerCollectionTools(server, api);
 
@@ -35,7 +56,10 @@ export function createFireCMSMcpServer(): McpServer {
     // Data export (via backend API)
     registerExportTools(server, api);
 
-    // Resources
+    // Data import (admin-only)
+    registerImportTools(server, api);
+
+    // Resources (read-only contextual data)
     registerProjectResources(server, api);
 
     return server;