@frihet/mcp-server 1.17.0 → 2.0.1

package/docs/agent-onboarding.json

@@ -68,11 +68,11 @@
       "FRIHET_TOOL_MODE": "grouped"
     },
     "counts": {
-      "toolNames": 162,
-      "readOnly": 82,
+      "toolNames": 161,
+      "readOnly": 81,
       "writesFrihet": 80,
-      "externalInteraction": 36,
-      "destructive": 61,
+      "externalInteraction": 37,
+      "destructive": 60,
       "resources": 11,
       "prompts": 10
     }
@@ -88,7 +88,7 @@
       {
         "call": "resources/read frihet://tax/rates",
         "kind": "read",
-        "note": "Authoritative IVA / IGIC / IPSI table. Do not recall a rate from memory."
+        "note": "Spanish statutory IVA / IGIC / IPSI reference schedule. Do not recall a rate from memory; server validates transaction math."
       },
       {
         "call": "list_clients",
@@ -109,14 +109,17 @@
       "delete_quote",
       "delete_recurring_invoice",
       "delete_time_entry",
+      "face_submit",
       "match_transaction_to_invoice",
       "period_close",
       "period_reopen",
       "refund_deposit",
       "refund_sale",
       "remove_team_member",
+      "run_recurring_now",
       "send_invoice",
       "send_quote",
+      "ticketbai_submit",
       "verifactu_resubmit"
     ],
     "externalSideEffects": [
@@ -262,6 +265,13 @@
           "money_movement"
         ]
       },
+      {
+        "tool": "run_recurring_now",
+        "effects": [
+          "webhook_delivery_or_configuration",
+          "fiscal_or_einvoice_submission"
+        ]
+      },
       {
         "tool": "send_einvoice",
         "effects": [

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@frihet/mcp-server",
-  "version": "1.17.0",
-  "description": "AI-native MCP server for Frihet ERP — 157 canonical operations for invoicing, expenses, CRM, banking, POS and ES/EU fiscal workflows, with conservative capability and side-effect metadata.",
+  "version": "2.0.1",
+  "description": "AI-native MCP server for Frihet ERP — 156 canonical operations for invoicing, expenses, CRM, banking, POS and ES/EU fiscal workflows, with conservative capability and side-effect metadata.",
   "type": "module",
   "main": "./dist/index.js",
   "bin": {
@@ -9,7 +9,7 @@
   },
   "scripts": {
     "build": "tsc",
-    "test": "npm run build && node --test dist/__tests__/openai-profile.test.js dist/__tests__/openai-client-tax-id-contract.test.js dist/__tests__/tool-exposure.test.js dist/__tests__/fiscal-aliases.test.js dist/__tests__/einvoice-tools.test.js dist/__tests__/einvoice-day4-tools.test.js dist/__tests__/expenses-tools.test.js dist/__tests__/stay-tools.test.js dist/__tests__/pos-tools.test.js dist/__tests__/kitchen-tools.test.js dist/__tests__/banking-tools.test.js dist/__tests__/banking-client-contract.test.js dist/__tests__/pagination-cursor-param.test.js dist/__tests__/fiscal-tools.test.js dist/__tests__/time-tools.test.js dist/__tests__/recurring-tools.test.js dist/__tests__/team-tools.test.js dist/__tests__/team-tools-real-sdk.test.js dist/__tests__/d4b-hr-payroll-onboarding-tools.test.js dist/__tests__/hr-payroll-period-contract.test.js dist/__tests__/webhook-crm-reviewed-contract.test.js dist/__tests__/audit-server-version.test.js dist/__tests__/openai-full-compose.test.js dist/__tests__/openai-review-descriptor.test.js dist/__tests__/contract.test.js dist/__tests__/observability-redaction.test.js dist/__tests__/security-containment-gate0.test.js dist/__tests__/intelligence-duplicate-invoice.test.js dist/__tests__/get-envelope-unwrap-regression.test.js dist/__tests__/binary-content-types.test.js dist/__tests__/api-error-remediation.test.js dist/__tests__/mutation-unwrap-and-schema-regression.test.js dist/__tests__/schema-envelope-guard.test.js dist/__tests__/paginated-strict-output.test.js dist/__tests__/demo-mode.test.js dist/__tests__/idempotency-key-contract.test.js dist/__tests__/source-header-contract.test.js dist/__tests__/truth-in-descriptions.test.js dist/__tests__/mcp-baseline-mutation.test.js dist/__tests__/forms-elicitation.test.js dist/__tests__/agent-onboarding.test.js scripts/__tests__/openai-worker-review-wire.test.mjs scripts/__tests__/sync-openapi-retry.test.mjs scripts/__tests__/conformance-provenance.test.mjs scripts/__tests__/conformance-phase0.test.mjs scripts/__tests__/published-artifact-drift.test.mjs",
+    "test": "npm run build && node --test dist/__tests__/resources-eu-catalog.test.js && node --test dist/__tests__/resources-p1-contract.test.js dist/__tests__/openai-profile.test.js dist/__tests__/openai-client-tax-id-contract.test.js dist/__tests__/tool-exposure.test.js dist/__tests__/fiscal-aliases.test.js dist/__tests__/einvoice-tools.test.js dist/__tests__/einvoice-day4-tools.test.js dist/__tests__/expenses-tools.test.js dist/__tests__/stay-tools.test.js dist/__tests__/pos-tools.test.js dist/__tests__/kitchen-tools.test.js dist/__tests__/banking-tools.test.js dist/__tests__/banking-client-contract.test.js dist/__tests__/pagination-cursor-param.test.js dist/__tests__/fiscal-tools.test.js dist/__tests__/fiscal-period-contract.test.js dist/__tests__/time-tools.test.js dist/__tests__/deposits-tools.test.js dist/__tests__/recurring-tools.test.js dist/__tests__/team-tools.test.js dist/__tests__/team-tools-real-sdk.test.js dist/__tests__/d4b-hr-payroll-onboarding-tools.test.js dist/__tests__/hr-payroll-period-contract.test.js dist/__tests__/webhook-crm-reviewed-contract.test.js dist/__tests__/audit-server-version.test.js dist/__tests__/search-tools.test.js dist/__tests__/openai-full-compose.test.js dist/__tests__/openai-review-descriptor.test.js dist/__tests__/directory-profile-policy.test.js dist/__tests__/claude-profile.test.js dist/__tests__/claude-output-privacy.test.js dist/__tests__/claude-write-route-contract.test.js dist/__tests__/contract.test.js dist/__tests__/observability-redaction.test.js dist/__tests__/security-containment-gate0.test.js dist/__tests__/intelligence-duplicate-invoice.test.js dist/__tests__/get-envelope-unwrap-regression.test.js dist/__tests__/binary-content-types.test.js dist/__tests__/api-error-remediation.test.js dist/__tests__/mutation-unwrap-and-schema-regression.test.js dist/__tests__/schema-envelope-guard.test.js dist/__tests__/paginated-strict-output.test.js dist/__tests__/paginated-metadata-contract.test.js dist/__tests__/demo-mode.test.js dist/__tests__/idempotency-key-contract.test.js dist/__tests__/retry-after-contract.test.js dist/__tests__/source-header-contract.test.js dist/__tests__/no-provisioning-credential-to-public-api.test.js dist/__tests__/truth-in-descriptions.test.js dist/__tests__/mcp-baseline-mutation.test.js dist/__tests__/forms-elicitation.test.js dist/__tests__/agent-onboarding.test.js scripts/__tests__/openai-worker-review-wire.test.mjs scripts/__tests__/sync-openapi-retry.test.mjs scripts/__tests__/conformance-provenance.test.mjs scripts/__tests__/conformance-phase0.test.mjs scripts/__tests__/published-artifact-drift.test.mjs scripts/__tests__/cross-surface-authority.test.mjs scripts/__tests__/release-workflow-contract.test.mjs scripts/__tests__/openai-wrangler-resolution.test.mjs scripts/__tests__/audit-mcp-refs-detector.test.mjs scripts/__tests__/openai-public-surface.test.mjs scripts/__tests__/claude-plugin-package.test.mjs scripts/__tests__/claude-hosted-release.test.mjs scripts/__tests__/claude-hosted-acceptance.test.mjs scripts/__tests__/claude-oauth-provider.test.mjs scripts/__tests__/audit-mcp-refs-published-sot.test.mjs scripts/__tests__/claude-bootstrap-secrets.test.mjs scripts/__tests__/no-public-leak.test.mjs",
     "canary:mcp": "npm run build && node scripts/canary-mcp.mjs",
     "canary:mcp:check": "npm run build && node scripts/canary-mcp.mjs --check",
     "canary:mcp:snapshot": "npm run build && node scripts/canary-mcp.mjs --snapshot",
@@ -24,7 +24,10 @@
     "test:public-capability-truth": "npm run build && node --test dist/__tests__/public-capability-truth.test.js",
     "gate:openai-review-descriptor": "npm run build && node scripts/check-openai-review-descriptor.mjs",
     "generate:openai-submission": "npm run build && node scripts/generate-openai-submission.mjs --write",
-    "gate:openai-submission": "npm run build && node scripts/generate-openai-submission.mjs --check && node scripts/validate-openai-submission-schema.mjs",
+    "gate:openai-submission": "npm run build && node scripts/generate-openai-submission.mjs --check && node scripts/validate-openai-submission-schema.mjs && node --test scripts/__tests__/openai-plugin-package.test.mjs",
+    "package:openai-plugin": "npm run gate:openai-submission && python3 scripts/package-openai-plugin.py",
+    "check:openai-public-surface": "node scripts/check-openai-public-surface.mjs",
+    "test:openai-public-surface": "node --test scripts/__tests__/openai-public-surface.test.mjs",
     "generate:public-capability-truth": "npm run build && node scripts/generate-public-capability-contract.mjs",
     "generate:agent-onboarding": "npm run build && node scripts/generate-agent-onboarding.mjs",
     "gate:agent-onboarding": "npm run build && node scripts/generate-agent-onboarding.mjs --check",
@@ -32,14 +35,21 @@
     "gate:public-capability-truth": "npm run build && node --test dist/__tests__/public-capability-truth.test.js && node scripts/generate-public-capability-contract.mjs --check",
     "start": "node dist/index.js",
     "postinstall": "node scripts/postinstall.js || true",
-    "prepublishOnly": "node scripts/assert-publish-anchor.mjs && npm run gate:analytics && npm run build && npm run gate:agent-onboarding && npm run gate:public-capability-truth && npm run audit:mcp-refs -- --repo frihet-mcp && npm run gate:no-legacy-region && node scripts/check-no-analytics-emitters.mjs --built",
+    "prepublishOnly": "node scripts/assert-publish-anchor.mjs && npm run gate:analytics && npm run build && npm run gate:agent-onboarding && npm run gate:public-capability-truth && npm run audit:mcp-refs -- --repo frihet-mcp && npm run gate:no-legacy-region && node scripts/check-no-analytics-emitters.mjs --built && npm run gate:cross-surface-authority",
     "audit:mcp-refs": "node scripts/audit-mcp-refs.mjs",
     "audit:mcp-refs:fix": "node scripts/audit-mcp-refs.mjs --fix",
-    "gate:no-leak": "bash scripts/no-public-leak.sh",
+    "gate:no-leak": "node --test scripts/__tests__/no-public-leak.test.mjs && bash scripts/no-public-leak.sh",
     "gate:no-legacy-region": "bash scripts/no-legacy-region.sh",
     "sync:openapi": "node scripts/sync-openapi.mjs",
     "gate:openapi-fresh": "node scripts/sync-openapi.mjs --check",
-    "gate:openapi-fresh:live": "node scripts/sync-openapi.mjs --check --live"
+    "gate:openapi-fresh:live": "node scripts/sync-openapi.mjs --check --live",
+    "gate:cross-surface-authority": "node scripts/cross-surface-authority.mjs",
+    "cross-surface-authority:diff": "node scripts/cross-surface-authority.mjs --diff",
+    "cross-surface-authority:update": "node scripts/cross-surface-authority.mjs --update",
+    "test:cross-surface-authority": "node --test scripts/__tests__/cross-surface-authority.test.mjs",
+    "generate:claude-candidate": "npm run build && node scripts/generate-claude-candidate-contract.mjs",
+    "gate:claude-candidate": "npm run build && node --test dist/__tests__/claude-profile.test.js && node scripts/generate-claude-candidate-contract.mjs --check",
+    "gate:claude-hosted-source": "node scripts/check-claude-hosted-release.mjs --source-only"
   },
   "keywords": [
     "accounting",
@@ -69,7 +79,7 @@
     "tax-compliance",
     "gemini-cli",
     "freelancer",
-    "small-business",
+    "business-management",
     "business-automation",
     "verifactu",
     "webhooks",
@@ -80,7 +90,7 @@
     "spanish-tax",
     "e-invoicing"
   ],
-  "author": "BRTHLS <viktor@brthls.com>",
+  "author": "Frihet <hello@frihet.io>",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -96,7 +106,7 @@
     "url": "https://github.com/Frihet-io/frihet-mcp/issues"
   },
   "engines": {
-    "node": ">=20"
+    "node": "^22.23.4 || ^24.22.1 || ^26.12.1"
   },
   "files": [
     "dist",
@@ -111,10 +121,14 @@
     "LICENSE"
   ],
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.27.0"
+    "@modelcontextprotocol/sdk": "1.31.0"
   },
   "overrides": {
-    "hono": "~4.12.34"
+    "hono": ">=4.13.13",
+    "ip-address": ">=10.7.3",
+    "proxy-addr": ">=2.0.8",
+    "qs": ">=6.15.4",
+    "@ai-sdk/provider-utils": ">=4.0.33 <5"
   },
   "peerDependencies": {
     "zod": ">=3.25.1"

package/dist/tools/onboarding.d.ts

@@ -1,19 +0,0 @@
-/**
- * Onboarding tools for the Frihet MCP server — D4-B megasprint (2 tools).
- *
- * Tools:
- *   1. onboarding_status      — current workspace onboarding state (completed/pending steps)
- *   2. onboarding_persona_set — set workspace persona (autonomo/empresa/agencia/gestoria)
- *
- * REST surface: /v1/onboarding/status, /v1/onboarding/persona
- *
- * Persona drives module visibility + default chart-of-accounts + onboarding checklist.
- * Persona can only be set once during onboarding; later changes require workspace admin.
- *
- * NOTE: ERP backend endpoints land in parallel D4-A wave. 404s propagate as isError
- * until backend ships.
- */
-import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import type { IFrihetClient } from "../client-interface.js";
-export declare function registerOnboardingTools(server: McpServer, client: IFrihetClient): void;
-//# sourceMappingURL=onboarding.d.ts.map

package/dist/tools/onboarding.js

@@ -1,64 +0,0 @@
-/**
- * Onboarding tools for the Frihet MCP server — D4-B megasprint (2 tools).
- *
- * Tools:
- *   1. onboarding_status      — current workspace onboarding state (completed/pending steps)
- *   2. onboarding_persona_set — set workspace persona (autonomo/empresa/agencia/gestoria)
- *
- * REST surface: /v1/onboarding/status, /v1/onboarding/persona
- *
- * Persona drives module visibility + default chart-of-accounts + onboarding checklist.
- * Persona can only be set once during onboarding; later changes require workspace admin.
- *
- * NOTE: ERP backend endpoints land in parallel D4-A wave. 404s propagate as isError
- * until backend ships.
- */
-import { z } from "zod/v4";
-import { withToolLogging, formatRecord, getContent, mutateContent, READ_ONLY_ANNOTATIONS, UPDATE_ANNOTATIONS, onboardingStatusOutput, onboardingPersonaResultOutput, } from "./shared.js";
-import { withBackendGuard } from "./backend-availability.js";
-export function registerOnboardingTools(server, client) {
-    // -- onboarding_status --
-    server.registerTool("onboarding_status", {
-        title: "Onboarding Status",
-        description: "Return the current workspace onboarding state — persona, completed steps, pending steps, " +
-            "percent complete. Useful to drive in-app guidance, sales follow-up triggers, " +
-            "and partner program tracking. " +
-            "/ Devuelve el estado actual del onboarding del workspace (persona, pasos completados/pendientes).",
-        annotations: READ_ONLY_ANNOTATIONS,
-        inputSchema: {},
-        outputSchema: onboardingStatusOutput,
-    }, async () => withToolLogging("onboarding_status", () => withBackendGuard("onboarding_status", "/v1/onboarding/status", async () => {
-        const result = await client.getOnboardingStatus();
-        return {
-            content: [getContent(formatRecord("Onboarding status", result))],
-            structuredContent: result,
-        };
-    })));
-    // -- onboarding_persona_set --
-    server.registerTool("onboarding_persona_set", {
-        title: "Set Onboarding Persona",
-        description: "Set the workspace persona. Drives module visibility, default chart-of-accounts, " +
-            "and onboarding checklist. Personas:\n" +
-            "  - 'autonomo' — self-employed (autonomo Spain)\n" +
-            "  - 'empresa'  — small/medium business\n" +
-            "  - 'agencia'  — agency / consultancy\n" +
-            "  - 'gestoria' — accounting firm (manages multiple client workspaces)\n" +
-            "\n" +
-            "Idempotent: setting the same persona again is a no-op. " +
-            "/ Define la persona del workspace. Determina modulos visibles, plan contable y checklist.",
-        annotations: UPDATE_ANNOTATIONS,
-        inputSchema: {
-            persona: z
-                .enum(["autonomo", "empresa", "agencia", "gestoria"])
-                .describe("Workspace persona / Persona del workspace"),
-        },
-        outputSchema: onboardingPersonaResultOutput,
-    }, async ({ persona }) => withToolLogging("onboarding_persona_set", () => withBackendGuard("onboarding_persona_set", "/v1/onboarding/persona", async () => {
-        const result = await client.setOnboardingPersona({ persona });
-        return {
-            content: [mutateContent(formatRecord("Persona set", result))],
-            structuredContent: result,
-        };
-    })));
-}
-//# sourceMappingURL=onboarding.js.map