@gwdn/nexus-mcp 0.7.0

package/.github/workflows/ci.yml

@@ -0,0 +1,38 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    name: Test (Node ${{ matrix.node-version }})
+    runs-on: blacksmith-2vcpu-ubuntu-2204
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version: [20, 22]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Typecheck
+        run: npm run typecheck
+
+      - name: Test
+        run: npm test
+
+      - name: Build
+        run: npm run build

package/.github/workflows/release.yml

@@ -0,0 +1,57 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    name: Publish to npm
+    runs-on: blacksmith-2vcpu-ubuntu-2204
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+          registry-url: https://registry.npmjs.org
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Typecheck
+        run: npm run typecheck
+
+      - name: Test
+        run: npm test
+
+      - name: Build
+        run: npm run build
+
+      - name: Verify version matches tag
+        run: |
+          PKG_VERSION="v$(node -p "require('./package.json').version")"
+          TAG_VERSION="${GITHUB_REF#refs/tags/}"
+          if [ "$PKG_VERSION" != "$TAG_VERSION" ]; then
+            echo "ERROR: package.json version ($PKG_VERSION) does not match tag ($TAG_VERSION)"
+            exit 1
+          fi
+          echo "Version verified: $TAG_VERSION"
+
+      - name: Publish to npm
+        run: npm publish --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          generate_release_notes: true

package/README.md

@@ -0,0 +1,89 @@
+# nexus-mcp
+
+[![npm](https://img.shields.io/npm/v/@gwdn/nexus-mcp)](https://www.npmjs.com/package/@gwdn/nexus-mcp)
+
+MCP server for the Nexus platform. Provides the mediation layer between
+local agent runtimes (terminals) and the Nexus HTTP API.
+
+## Install
+
+```bash
+npx @gwdn/nexus-mcp
+```
+
+Or add to your agent's MCP configuration:
+
+```json
+{
+  "mcpServers": {
+    "nexus": {
+      "command": "npx",
+      "args": ["-y", "@gwdn/nexus-mcp"],
+      "env": {
+        "NEXUS_API_URL": "https://nexus.gatewarden.eu",
+        "NEXUS_PRIVATE_TOKEN": "nxs_pat_..."
+      }
+    }
+  }
+}
+```
+
+## Architecture
+
+The server exposes 38 tools across 4 layers via the Model Context Protocol
+(stdio transport). All data access goes through the Nexus API — the MCP server
+has no direct database access.
+
+- **Layer 1 — Knowledge Access:** kb_search, kb_memory, kb_get, kb_related, project_list
+- **Layer 2 — Coordination:** vault letters (vl_create/vl_reply/vl_inbox/vl_outbox/vl_ack),
+  tasks (task_create/task_update/task_note/task_list), sessions (session_create/session_list/session_close/session_append),
+  decision comments (dc_add/dc_list), documents (doc_ingest/doc_list),
+  skills (sk_list/sk_get/sk_create/sk_update/sk_activate/sk_assign/sk_unassign/sk_export)
+- **Layer 3 — Governance:** ADR lifecycle (adr_create/adr_submit/adr_decide)
+- **Layer 4 — Reviews:** entity reviews (rv_list/rv_get/rv_create/rv_decide/rv_comment)
+
+## Authentication
+
+Identity is resolved once at startup via `GET /api/mcp/identity` using the
+`NEXUS_PRIVATE_TOKEN` as a Bearer token. All subsequent API calls use the same
+token for authentication. The Nexus backend resolves the token to a user
+identity and enforces project-scoped RBAC.
+
+## Environment Variables
+
+| Variable | Required | Description |
+|---|---|---|
+| `NEXUS_API_URL` | yes | Nexus API base URL (e.g. `https://nexus.gatewarden.eu`) |
+| `NEXUS_PRIVATE_TOKEN` | yes | nxs_pat_* API token for identity resolution |
+
+## Development
+
+```bash
+npm install
+npm run typecheck   # TypeScript check
+npm test            # Run tests
+npm run build       # Compile to dist/
+npm run dev         # Run via tsx (development)
+npm start           # Run compiled JS (production)
+```
+
+## Project Structure
+
+```
+src/
+  server.ts          # MCP server entry point (stdio transport)
+  auth.ts            # Token-based identity resolution via Nexus API
+  nexus-api.ts       # HTTP client for Nexus API (nexusGet, nexusPost)
+  tools/             # Tool modules (38 tools total)
+  __tests__/         # Unit tests (112) and E2E integration tests (34)
+```
+
+## Related
+
+- [nexus](https://github.com/gwnexus/nexus-hub) — Backend + Frontend (Next.js/Supabase/Netlify)
+- [nexus-cli](https://github.com/gwnexus/nexus-cli) — Rust CLI client
+
+## License
+
+Nexus is a product of the Nexus Product Group, owned by
+RelicFrog Holding UG (haftungsbeschränkt).

package/dist/auth.d.ts

@@ -0,0 +1,39 @@
+/**
+ * MCP Authentication Layer
+ *
+ * Resolves the NEXUS_PRIVATE_TOKEN environment variable at server startup
+ * to a verified user identity by calling the Nexus API identity endpoint.
+ *
+ * Flow:
+ *   1. Read NEXUS_PRIVATE_TOKEN from process.env
+ *   2. Call GET /api/mcp/identity with Bearer token
+ *   3. Cache resolved identity for the lifetime of the MCP process
+ */
+export interface McpIdentity {
+    userId: string;
+    email: string | null;
+    displayName: string | null;
+    isPlatformAdmin: boolean;
+    isPlatformOwner: boolean;
+    tenantId: string | null;
+    memberships: Array<{
+        project_id: string;
+        role: string;
+    }>;
+    agentAssignments: Array<{
+        project_id: string;
+        agent_id: string;
+        agent_owner: string;
+    }>;
+}
+/**
+ * Resolve the MCP server identity from NEXUS_PRIVATE_TOKEN.
+ * Called once at server startup. Caches the result.
+ * Throws if no valid token is available.
+ */
+export declare function initIdentity(): Promise<McpIdentity>;
+/**
+ * Get the cached MCP identity. Must call initIdentity() first.
+ */
+export declare function getIdentity(): McpIdentity;
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAQH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,eAAe,EAAE,OAAO,CAAA;IACxB,eAAe,EAAE,OAAO,CAAA;IACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,WAAW,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACxD,gBAAgB,EAAE,KAAK,CAAC;QACtB,UAAU,EAAE,MAAM,CAAA;QAClB,QAAQ,EAAE,MAAM,CAAA;QAChB,WAAW,EAAE,MAAM,CAAA;KACpB,CAAC,CAAA;CACH;AASD;;;;GAIG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,WAAW,CAAC,CAyBzD;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,WAAW,CAKzC"}

package/dist/auth.js

@@ -0,0 +1,47 @@
+/**
+ * MCP Authentication Layer
+ *
+ * Resolves the NEXUS_PRIVATE_TOKEN environment variable at server startup
+ * to a verified user identity by calling the Nexus API identity endpoint.
+ *
+ * Flow:
+ *   1. Read NEXUS_PRIVATE_TOKEN from process.env
+ *   2. Call GET /api/mcp/identity with Bearer token
+ *   3. Cache resolved identity for the lifetime of the MCP process
+ */
+import { nexusGet } from './nexus-api.js';
+// Module-level cache: resolved once at startup
+let _identity = null;
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * Resolve the MCP server identity from NEXUS_PRIVATE_TOKEN.
+ * Called once at server startup. Caches the result.
+ * Throws if no valid token is available.
+ */
+export async function initIdentity() {
+    if (_identity)
+        return _identity;
+    const rawToken = process.env.NEXUS_PRIVATE_TOKEN;
+    if (!rawToken) {
+        throw new Error('MCP: NEXUS_PRIVATE_TOKEN is not set. The MCP server requires a valid nxs_pat_* token.');
+    }
+    const result = await nexusGet('/api/mcp/identity');
+    if (!result.ok || !result.data) {
+        throw new Error(`MCP: Identity resolution failed: ${result.error ?? 'Unknown error'}. Check that the token is valid, not expired, and not revoked.`);
+    }
+    _identity = result.data;
+    console.error(`[nexus-mcp] Identity resolved: ${_identity.displayName ?? _identity.email ?? _identity.userId} (admin=${_identity.isPlatformAdmin}, owner=${_identity.isPlatformOwner})`);
+    return _identity;
+}
+/**
+ * Get the cached MCP identity. Must call initIdentity() first.
+ */
+export function getIdentity() {
+    if (!_identity) {
+        throw new Error('MCP: Identity not initialized. Call initIdentity() first.');
+    }
+    return _identity;
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAqBzC,+CAA+C;AAC/C,IAAI,SAAS,GAAuB,IAAI,CAAA;AAExC,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,IAAI,SAAS;QAAE,OAAO,SAAS,CAAA;IAE/B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAA;IAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAA;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAc,mBAAmB,CAAC,CAAA;IAE/D,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,oCAAoC,MAAM,CAAC,KAAK,IAAI,eAAe,gEAAgE,CACpI,CAAA;IACH,CAAC;IAED,SAAS,GAAG,MAAM,CAAC,IAAI,CAAA;IAEvB,OAAO,CAAC,KAAK,CACX,kCAAkC,SAAS,CAAC,WAAW,IAAI,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,MAAM,WAAW,SAAS,CAAC,eAAe,WAAW,SAAS,CAAC,eAAe,GAAG,CAC1K,CAAA;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW;IACzB,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAA;IAC9E,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/dist/nexus-api.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Nexus API client for MCP server context.
+ *
+ * Replaces direct Supabase access with HTTP calls to the Nexus API.
+ * All operations go through /api/mcp/* endpoints, authenticated
+ * via the NEXUS_PRIVATE_TOKEN (nxs_pat_*) Bearer token.
+ */
+/**
+ * Reset the cached API configuration. Used by E2E tests to switch
+ * from mocked env vars to real credentials.
+ */
+export declare function resetApiConfig(): void;
+export interface NexusApiResponse<T = unknown> {
+    ok: boolean;
+    status: number;
+    data: T | null;
+    error: string | null;
+}
+/**
+ * Make an authenticated request to the Nexus API.
+ */
+export declare function nexusApi<T = unknown>(path: string, options?: {
+    method?: 'GET' | 'POST' | 'PATCH' | 'DELETE';
+    body?: unknown;
+    timeoutMs?: number;
+}): Promise<NexusApiResponse<T>>;
+/**
+ * Convenience: POST to a Nexus MCP endpoint.
+ */
+export declare function nexusPost<T = unknown>(path: string, body: unknown): Promise<NexusApiResponse<T>>;
+/**
+ * Convenience: GET from a Nexus MCP endpoint.
+ */
+export declare function nexusGet<T = unknown>(path: string): Promise<NexusApiResponse<T>>;
+//# sourceMappingURL=nexus-api.d.ts.map

package/dist/nexus-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nexus-api.d.ts","sourceRoot":"","sources":["../src/nexus-api.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH;;;GAGG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAGrC;AA0BD,MAAM,WAAW,gBAAgB,CAAC,CAAC,GAAG,OAAO;IAC3C,EAAE,EAAE,OAAO,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,CAAC,GAAG,IAAI,CAAA;IACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAKD;;GAEG;AACH,wBAAsB,QAAQ,CAAC,CAAC,GAAG,OAAO,EACxC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;IACP,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAA;IAC5C,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;CACd,GACL,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CA2C9B;AAED;;GAEG;AACH,wBAAsB,SAAS,CAAC,CAAC,GAAG,OAAO,EACzC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAE9B;AAED;;GAEG;AACH,wBAAsB,QAAQ,CAAC,CAAC,GAAG,OAAO,EACxC,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAE9B"}

package/dist/nexus-api.js

@@ -0,0 +1,90 @@
+/**
+ * Nexus API client for MCP server context.
+ *
+ * Replaces direct Supabase access with HTTP calls to the Nexus API.
+ * All operations go through /api/mcp/* endpoints, authenticated
+ * via the NEXUS_PRIVATE_TOKEN (nxs_pat_*) Bearer token.
+ */
+let _baseUrl = null;
+let _token = null;
+/**
+ * Reset the cached API configuration. Used by E2E tests to switch
+ * from mocked env vars to real credentials.
+ */
+export function resetApiConfig() {
+    _baseUrl = null;
+    _token = null;
+}
+function getConfig() {
+    if (_baseUrl && _token)
+        return { baseUrl: _baseUrl, token: _token };
+    const url = process.env.NEXUS_API_URL ?? process.env.NEXUS_URL;
+    const token = process.env.NEXUS_PRIVATE_TOKEN;
+    if (!url) {
+        throw new Error('MCP: Missing NEXUS_API_URL. Set the base URL of the Nexus app (e.g. https://nexus.gatewarden.eu).');
+    }
+    if (!token) {
+        throw new Error('MCP: Missing NEXUS_PRIVATE_TOKEN. The MCP server requires a valid nxs_pat_* token.');
+    }
+    // Normalize: strip trailing slash
+    _baseUrl = url.replace(/\/$/, '');
+    _token = token.trim();
+    return { baseUrl: _baseUrl, token: _token };
+}
+/** Default HTTP timeout in milliseconds (30 seconds). */
+const DEFAULT_TIMEOUT_MS = 30_000;
+/**
+ * Make an authenticated request to the Nexus API.
+ */
+export async function nexusApi(path, options = {}) {
+    const { baseUrl, token } = getConfig();
+    const method = options.method ?? 'GET';
+    const url = `${baseUrl}${path}`;
+    const headers = {
+        Authorization: `Bearer ${token}`,
+        'Content-Type': 'application/json',
+    };
+    try {
+        const fetchOpts = {
+            method,
+            headers,
+            signal: AbortSignal.timeout(options.timeoutMs ?? DEFAULT_TIMEOUT_MS),
+        };
+        if (options.body !== undefined) {
+            fetchOpts.body = JSON.stringify(options.body);
+        }
+        const response = await fetch(url, fetchOpts);
+        const data = (await response.json());
+        if (!response.ok) {
+            return {
+                ok: false,
+                status: response.status,
+                data: null,
+                error: data?.error ??
+                    `HTTP ${response.status}`,
+            };
+        }
+        return { ok: true, status: response.status, data, error: null };
+    }
+    catch (err) {
+        return {
+            ok: false,
+            status: 0,
+            data: null,
+            error: err instanceof Error ? err.message : 'Unknown fetch error',
+        };
+    }
+}
+/**
+ * Convenience: POST to a Nexus MCP endpoint.
+ */
+export async function nexusPost(path, body) {
+    return nexusApi(path, { method: 'POST', body });
+}
+/**
+ * Convenience: GET from a Nexus MCP endpoint.
+ */
+export async function nexusGet(path) {
+    return nexusApi(path, { method: 'GET' });
+}
+//# sourceMappingURL=nexus-api.js.map

package/dist/nexus-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nexus-api.js","sourceRoot":"","sources":["../src/nexus-api.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,IAAI,QAAQ,GAAkB,IAAI,CAAA;AAClC,IAAI,MAAM,GAAkB,IAAI,CAAA;AAEhC;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,QAAQ,GAAG,IAAI,CAAA;IACf,MAAM,GAAG,IAAI,CAAA;AACf,CAAC;AAED,SAAS,SAAS;IAChB,IAAI,QAAQ,IAAI,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;IAEnE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAA;IAC9D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAA;IAE7C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,mGAAmG,CACpG,CAAA;IACH,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAA;IACH,CAAC;IAED,kCAAkC;IAClC,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IACjC,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IAErB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;AAC7C,CAAC;AASD,yDAAyD;AACzD,MAAM,kBAAkB,GAAG,MAAM,CAAA;AAEjC;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAY,EACZ,UAII,EAAE;IAEN,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,SAAS,EAAE,CAAA;IACtC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAA;IACtC,MAAM,GAAG,GAAG,GAAG,OAAO,GAAG,IAAI,EAAE,CAAA;IAE/B,MAAM,OAAO,GAA2B;QACtC,aAAa,EAAE,UAAU,KAAK,EAAE;QAChC,cAAc,EAAE,kBAAkB;KACnC,CAAA;IAED,IAAI,CAAC;QACH,MAAM,SAAS,GAAgB;YAC7B,MAAM;YACN,OAAO;YACP,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;SACrE,CAAA;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,SAAS,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC/C,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;QAC5C,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA2B,CAAA;QAE9D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,IAAI,EAAE,IAAI;gBACV,KAAK,EACF,IAAgC,EAAE,KAAe;oBAClD,QAAQ,QAAQ,CAAC,MAAM,EAAE;aAC5B,CAAA;QACH,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IACjE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,CAAC;YACT,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB;SAClE,CAAA;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAY,EACZ,IAAa;IAEb,OAAO,QAAQ,CAAI,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;AACpD,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAY;IAEZ,OAAO,QAAQ,CAAI,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;AAC7C,CAAC"}

package/dist/server.d.ts

@@ -0,0 +1,67 @@
+#!/usr/bin/env node
+/**
+ * nexus-mcp -- MCP Server for Nexus
+ *
+ * Provides Knowledge Access (Layer 1), Coordination (Layer 2),
+ * Governance (Layer 3), and Reviews (Layer 4) tools.
+ * Runs as a standalone stdio MCP server.
+ *
+ * Authentication:
+ *   Identity is resolved once at startup from NEXUS_PRIVATE_TOKEN (nxs_pat_*).
+ *   All write tools receive user_id automatically from the resolved identity.
+ *   Callers no longer pass user_id as a parameter.
+ *
+ * Layer 1 - Knowledge Access:
+ *   - kb_search: Search project knowledge (keyword/semantic/hybrid)
+ *   - kb_memory: Curated project context for agent bootstrapping
+ *   - kb_get: Fetch a single knowledge object
+ *   - kb_related: Navigate entity relationships
+ *   - project_list: List accessible projects
+ *
+ * Layer 2 - Coordination:
+ *   - vl_create: Create a new vault letter
+ *   - vl_reply: Reply to an existing vault letter
+ *   - vl_inbox: List letters addressed to the calling agent/user
+ *   - vl_outbox: List letters sent by the calling agent/user
+ *   - vl_ack: Acknowledge receipt of a new vault letter
+ *   - task_create: Create a task in a project
+ *   - task_update: Update task status, priority, or assignee
+ *   - task_note: Append a note to a task (append-only)
+ *   - task_list: List tasks for a project with filters
+ *   - dc_add: Add a comment to an ADR (append-only)
+ *   - dc_list: List comments for an ADR
+ *   - sk_list: List skills for the current tenant
+ *   - sk_get: Get full skill content by identifier
+ *   - sk_create: Create a new skill in draft status
+ *   - sk_update: Update skill content or metadata
+ *   - sk_activate: Change skill status (draft/active/archived)
+ *   - sk_assign: Assign a skill to a project
+ *   - sk_unassign: Remove a skill assignment from a project
+ *   - sk_export: Export all skill assignments for a project
+ *   - doc_ingest: Push text/markdown content into project knowledge base
+ *   - doc_list: List ingested documents for a project
+ *   - session_append: Append to a session (write-isolated)
+ *   - session_create: Start a new work session
+ *   - session_close: End a session with summary and next entry point
+ *   - session_list: List open sessions for a project
+ *
+ * Layer 3 - Governance:
+ *   - adr_create: Create a new ADR draft
+ *   - adr_submit: Submit an ADR for review
+ *   - adr_decide: Accept or reject an ADR
+ *
+ * Layer 4 - Reviews:
+ *   - rv_list: List reviews with optional filters
+ *   - rv_get: Get a review by ID or entity reference
+ *   - rv_create: Create a new review for an entity
+ *   - rv_decide: Transition a review state
+ *   - rv_comment: Add a comment to a review
+ *
+ * Usage:
+ *   npx tsx src/mcp/server.ts
+ *
+ * Or via .mcp.json configuration:
+ *   { "command": "npx", "args": ["tsx", "src/mcp/server.ts"] }
+ */
+export {};
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG"}