@hed-hog/core 0.0.399 → 0.0.400

package/src/mcp/mcp-server.service.ts

@@ -1,87 +1,111 @@
-import { Server } from '@modelcontextprotocol/sdk/server/index.js';
-import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
-import {
-  CallToolRequestSchema,
-  ListToolsRequestSchema,
-} from '@modelcontextprotocol/sdk/types.js';
-import { Injectable } from '@nestjs/common';
-import { Request, Response } from 'express';
-import { McpAuditService } from './mcp-audit.service';
-import { McpRegistryService } from './mcp-registry.service';
-import { McpContext } from './types/mcp-context.type';
-
-@Injectable()
-export class McpServerService {
-  constructor(
-    private readonly registry: McpRegistryService,
-    private readonly audit: McpAuditService,
-  ) {}
-
-  async handleRequest(req: Request, res: Response, context: McpContext): Promise<void> {
-    const server = this.buildServer(context);
-    const transport = new StreamableHTTPServerTransport({
-      sessionIdGenerator: undefined,
-    });
-    await server.connect(transport);
-    await transport.handleRequest(req, res, req.body);
-  }
-
-  private buildServer(context: McpContext): Server {
-    const server = new Server(
-      { name: 'hedhog-mcp', version: '1.0.0' },
-      { capabilities: { tools: {} } },
-    );
-
-    server.setRequestHandler(ListToolsRequestSchema, async () => ({
-      tools: this.registry.getAll().map((e) => ({
-        name: e.definition.name,
-        description: e.definition.description,
-        inputSchema: e.definition.inputSchema ?? {
-          type: 'object',
-          properties: {},
-        },
-      })),
-    }));
-
-    server.setRequestHandler(CallToolRequestSchema, async (request) => {
-      const toolName = request.params.name;
-      const args = (request.params.arguments ?? {}) as Record<string, any>;
-      const entry = this.registry.get(toolName);
-
-      if (!entry) {
-        return {
-          isError: true,
-          content: [{ type: 'text', text: `Tool '${toolName}' not found` }],
-        };
-      }
-
-      const start = Date.now();
-      try {
-        const result = await entry.handler(args, { ...context, toolName });
-        await this.audit.record({
-          userId: context.userId,
-          toolName,
-          input: args,
-          success: true,
-          durationMs: Date.now() - start,
-        });
-        return { content: [{ type: 'text', text: JSON.stringify(result) }] };
-      } catch (e: any) {
-        await this.audit.record({
-          userId: context.userId,
-          toolName,
-          input: args,
-          success: false,
-          error: e.message,
-          durationMs: Date.now() - start,
-        });
-        return {
-          isError: true,
-          content: [{ type: 'text', text: e.message }],
-        };
-      }
-    });
-
-    return server;
-  }
-}
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import {
+  CallToolRequestSchema,
+  ListToolsRequestSchema,
+} from '@modelcontextprotocol/sdk/types.js';
+import { Injectable } from '@nestjs/common';
+import { Request, Response } from 'express';
+import { McpAuditService } from './mcp-audit.service';
+import { McpPermissionService } from './mcp-permission.service';
+import { McpRegistryService } from './mcp-registry.service';
+import { McpContext } from './types/mcp-context.type';
+
+@Injectable()
+export class McpServerService {
+  constructor(
+    private readonly registry: McpRegistryService,
+    private readonly audit: McpAuditService,
+    private readonly permissions: McpPermissionService,
+  ) {}
+
+  async handleRequest(req: Request, res: Response, context: McpContext): Promise<void> {
+    const server = this.buildServer(context);
+    const transport = new StreamableHTTPServerTransport({
+      sessionIdGenerator: undefined,
+      // Sem sessão o transporte só atende POST, e aí o SSE não compra nada: não
+      // há stream para retomar nem notificação do servidor para empurrar. O que
+      // ele custa é real — um `tools/list` de centenas de KB atravessa o ingress
+      // como um único evento, sujeito ao buffering do nginx. JSON puro entrega a
+      // mesma resposta sem esse caminho.
+      enableJsonResponse: true,
+    });
+    await server.connect(transport);
+    await transport.handleRequest(req, res, req.body);
+  }
+
+  private buildServer(context: McpContext): Server {
+    const server = new Server(
+      { name: 'hedhog-mcp', version: '1.0.0' },
+      { capabilities: { tools: {} } },
+    );
+
+    // A lista sai filtrada pelas mesmas permissões que o McpPermissionGuard
+    // aplica no tools/call. Sem isso o cliente recebe as centenas de tools do
+    // registry inteiro e descobre o que pode usar tomando 403 — além de gastar
+    // o contexto da conversa com ferramentas que nunca vão funcionar.
+    server.setRequestHandler(ListToolsRequestSchema, async () => {
+      const allowed = await this.permissions.getAllowedToolNames(
+        context.userId,
+        context.clientId !== null,
+      );
+
+      return {
+        tools: this.registry
+          .getAll()
+          .filter((e) => allowed.has(e.definition.name))
+          .map((e) => ({
+            name: e.definition.name,
+            description: e.definition.description,
+            inputSchema: e.definition.inputSchema ?? {
+              type: 'object',
+              properties: {},
+            },
+          })),
+      };
+    });
+
+    server.setRequestHandler(CallToolRequestSchema, async (request) => {
+      const toolName = request.params.name;
+      const args = (request.params.arguments ?? {}) as Record<string, any>;
+      const entry = this.registry.get(toolName);
+
+      if (!entry) {
+        return {
+          isError: true,
+          content: [{ type: 'text', text: `Tool '${toolName}' not found` }],
+        };
+      }
+
+      const start = Date.now();
+      try {
+        const result = await entry.handler(args, { ...context, toolName });
+        await this.audit.record({
+          userId: context.userId,
+          clientId: context.clientId,
+          toolName,
+          input: args,
+          success: true,
+          durationMs: Date.now() - start,
+        });
+        return { content: [{ type: 'text', text: JSON.stringify(result) }] };
+      } catch (e: any) {
+        await this.audit.record({
+          userId: context.userId,
+          clientId: context.clientId,
+          toolName,
+          input: args,
+          success: false,
+          error: e.message,
+          durationMs: Date.now() - start,
+        });
+        return {
+          isError: true,
+          content: [{ type: 'text', text: e.message }],
+        };
+      }
+    });
+
+    return server;
+  }
+}

package/src/mcp/mcp.controller.ts

@@ -1,15 +1,19 @@
 import { NoRole } from '@hed-hog/api';
-import { All, Controller, Req, Res, UseGuards } from '@nestjs/common';
+import { All, Controller, Req, Res, UseFilters, UseGuards } from '@nestjs/common';
 import { Request, Response } from 'express';
 import { SettingService } from '../setting/setting.service';
 import { AllowMcpToken } from './decorators/allow-mcp-token.decorator';
 import { McpAuthGuard } from './guards/mcp-auth.guard';
 import { McpPermissionGuard } from './guards/mcp-permission.guard';
+import { McpChallengeFilter } from './filters/mcp-challenge.filter';
 import { McpServerService } from './mcp-server.service';
 
 @NoRole()
 @AllowMcpToken()
 @UseGuards(McpAuthGuard, McpPermissionGuard)
+// Captura tambem o 401 do AuthGuard global, que roda ANTES dos guards acima — e
+// que e justamente quem responde a sondagem sem token de um cliente OAuth.
+@UseFilters(McpChallengeFilter)
 @Controller('mcp')
 export class McpController {
   constructor(
@@ -37,6 +41,9 @@ export class McpController {
       sessionId: String(auth.sessionId),
       locale,
       toolName,
+      // `cid` so existe no token emitido pelo fluxo OAuth. Chave hedhog_mcp_ e
+      // JWT de login nao o tem, e e essa ausencia que marca o caminho interno.
+      clientId: auth.cid ?? null,
     });
   }
 }

package/src/mcp/mcp.module.ts

@@ -22,11 +22,13 @@ import { SettingModule } from '../setting/setting.module';
 import { TokenModule } from '../token/token.module';
 import { UserModule } from '../user/user.module';
 import { WebhookIntegrationModule } from '../webhook-integration/webhook-integration.module';
+import { McpChallengeFilter } from './filters/mcp-challenge.filter';
 import { McpAuthGuard } from './guards/mcp-auth.guard';
 import { McpPermissionGuard } from './guards/mcp-permission.guard';
 import { McpApiKeyController } from './mcp-api-key.controller';
 import { McpApiKeyService } from './mcp-api-key.service';
 import { McpAuditService } from './mcp-audit.service';
+import { McpPermissionService } from './mcp-permission.service';
 import { McpRegistryService } from './mcp-registry.service';
 import { McpServerService } from './mcp-server.service';
 import { McpController } from './mcp.controller';
@@ -83,8 +85,10 @@ import { AccessLogModule } from '../access-log/access-log.module';
     McpRegistryService,
     McpServerService,
     McpAuditService,
+    McpPermissionService,
     McpAuthGuard,
     McpPermissionGuard,
+    McpChallengeFilter,
     McpApiKeyService,
     McpChatService,
     CoreSettingsMcpTools,
@@ -108,6 +112,6 @@ import { AccessLogModule } from '../access-log/access-log.module';
     CoreMcpChatMcpTools,
     CoreSystemMcpTools,
   ],
-  exports: [McpRegistryService, McpServerService, McpApiKeyService],
+  exports: [McpRegistryService, McpServerService, McpApiKeyService, McpPermissionService],
 })
 export class McpModule {}

package/src/mcp/tools/core-ai.mcp-tools.ts

@@ -46,7 +46,7 @@ export class CoreAiMcpTools {
       page: args.page ?? 1,
       pageSize: args.pageSize ?? 20,
       search: args.search ?? '',
-      sortField: args.sortField ?? 'id',
+      ...(args.sortField ? { sortField: args.sortField } : {}),
       sortOrder: (args.sortOrder as any) ?? 'asc',
       fields: '',
     });

package/src/mcp/tools/core-dashboard-items.mcp-tools.ts

@@ -22,7 +22,7 @@ export class CoreDashboardItemsMcpTools {
   })
   async listDashboardItems(args: { page?: number; pageSize?: number; dashboardId?: number }, context: McpContext): Promise<any> {
     return this.dashboardItemService.getAllDashboardItems(
-      { page: args.page ?? 1, pageSize: args.pageSize ?? 20, search: '', sortField: 'id', sortOrder: 'asc', fields: '' },
+      { page: args.page ?? 1, pageSize: args.pageSize ?? 20, search: '', sortOrder: 'asc', fields: '' },
       context.locale,
       args.dashboardId,
     );

package/src/mcp/tools/core-dashboard.mcp-tools.ts

@@ -30,7 +30,7 @@ export class CoreDashboardMcpTools {
       page: args.page ?? 1,
       pageSize: args.pageSize ?? 20,
       search: args.search ?? '',
-      sortField: args.sortField ?? 'id',
+      ...(args.sortField ? { sortField: args.sortField } : {}),
       sortOrder: args.sortOrder ?? 'asc',
       fields: '',
     });

package/src/mcp/tools/core-event-webhooks.mcp-tools.ts

@@ -30,7 +30,7 @@ export class CoreEventWebhooksMcpTools {
       page: args.page ?? 1,
       pageSize: args.pageSize ?? 20,
       search: args.search ?? '',
-      sortField: args.sortField ?? 'id',
+      ...(args.sortField ? { sortField: args.sortField } : {}),
       sortOrder: (args.sortOrder as any) ?? 'asc',
       fields: '',
     });
@@ -126,7 +126,6 @@ export class CoreEventWebhooksMcpTools {
       page: args.page ?? 1,
       pageSize: args.pageSize ?? 20,
       search: '',
-      sortField: 'id',
       sortOrder: 'desc' as any,
       fields: '',
     });

package/src/mcp/tools/core-files.mcp-tools.ts

@@ -1,15 +1,20 @@
 import { Injectable } from '@nestjs/common';
+import { FileUploadTicketService } from '../../file/file-upload-ticket.service';
 import { FileService } from '../../file/file.service';
 import { McpTool } from '../decorators/mcp-tool.decorator';
 import { McpContext } from '../types/mcp-context.type';
 
 @Injectable()
 export class CoreFilesMcpTools {
-  constructor(private readonly fileService: FileService) {}
+  constructor(
+    private readonly fileService: FileService,
+    private readonly uploadTickets: FileUploadTicketService,
+  ) {}
 
   @McpTool({
     name: 'core.files.list',
-    description: 'Lists uploaded files with optional pagination. Admin only.',
+    description:
+      'Lists files uploaded by the calling user, with optional pagination. Administrators see every file. Use it to find the fileId of something already in storage instead of uploading it again.',
     inputSchema: {
       type: 'object',
       properties: {
@@ -24,21 +29,29 @@ export class CoreFilesMcpTools {
   })
   async listFiles(
     args: { page?: number; pageSize?: number; search?: string; sortField?: string; sortOrder?: string },
-    _context: McpContext,
+    context: McpContext,
   ): Promise<any> {
-    return this.fileService.getFiles({
-      page: args.page ?? 1,
-      pageSize: args.pageSize ?? 20,
-      search: args.search ?? '',
-      sortField: args.sortField ?? 'id',
-      sortOrder: (args.sortOrder as any) ?? 'asc',
-      fields: '',
-    });
+    // Sem o recorte por dono esta tool é um índice de tudo o que qualquer empresa já
+    // subiu — inclusive o que foi gravado como `is_private` justamente para não ser
+    // listado. Quem administra o acervo continua vendo tudo.
+    const isAdmin = await this.fileService.isFileAdmin(context.userId);
+
+    return this.fileService.getFiles(
+      {
+        page: args.page ?? 1,
+        pageSize: args.pageSize ?? 20,
+        search: args.search ?? '',
+        ...(args.sortField ? { sortField: args.sortField } : {}),
+        sortOrder: (args.sortOrder as any) ?? 'asc',
+        fields: '',
+      },
+      isAdmin ? undefined : context.userId,
+    );
   }
 
   @McpTool({
     name: 'core.files.get',
-    description: 'Returns file details by ID. Admin only.',
+    description: 'Returns file details by ID. The file must belong to the caller, unless the caller is an administrator.',
     inputSchema: {
       type: 'object',
       properties: {
@@ -48,13 +61,14 @@ export class CoreFilesMcpTools {
     },
     readOnly: true,
   })
-  async getFile(args: { fileId: number }, _context: McpContext): Promise<any> {
-    return this.fileService.get(args.fileId);
+  async getFile(args: { fileId: number }, context: McpContext): Promise<any> {
+    return this.fileService.assertFileUsable(args.fileId, context.userId);
   }
 
   @McpTool({
     name: 'core.files.open-url',
-    description: 'Returns a temporary URL to open/view a file inline. Admin only.',
+    description:
+      'Returns a temporary URL to open/view a file inline. The file must belong to the caller, unless the caller is an administrator.',
     inputSchema: {
       type: 'object',
       properties: {
@@ -64,15 +78,19 @@ export class CoreFilesMcpTools {
     },
     readOnly: true,
   })
-  async getOpenUrl(args: { fileId: number }, _context: McpContext): Promise<any> {
-    const file = await this.fileService.get(args.fileId);
-    const url = await this.fileService.tempOpenURL(file.path);
+  async getOpenUrl(args: { fileId: number }, context: McpContext): Promise<any> {
+    await this.fileService.assertFileUsable(args.fileId, context.userId);
+    // `tempURLById`, e não `tempURL(file.path)`: `path` guarda só o basename, enquanto a
+    // chave real no provider inclui o prefixo `location` — a URL assinada sobre o path
+    // cru resolvia para NoSuchKey no S3.
+    const url = await this.fileService.tempOpenURLById(args.fileId);
     return { url };
   }
 
   @McpTool({
     name: 'core.files.download-url',
-    description: 'Returns a temporary URL to download a file. Admin only.',
+    description:
+      'Returns a temporary URL to download a file. The file must belong to the caller, unless the caller is an administrator.',
     inputSchema: {
       type: 'object',
       properties: {
@@ -82,9 +100,9 @@ export class CoreFilesMcpTools {
     },
     readOnly: true,
   })
-  async getDownloadUrl(args: { fileId: number }, _context: McpContext): Promise<any> {
-    const file = await this.fileService.get(args.fileId);
-    const url = await this.fileService.tempURL(file.path);
+  async getDownloadUrl(args: { fileId: number }, context: McpContext): Promise<any> {
+    await this.fileService.assertFileUsable(args.fileId, context.userId);
+    const url = await this.fileService.tempURLById(args.fileId);
     return { url };
   }
 
@@ -100,6 +118,168 @@ export class CoreFilesMcpTools {
     },
   })
   async deleteFiles(args: { ids: number[] }, context: McpContext): Promise<any> {
+    for (const id of args.ids ?? []) {
+      await this.fileService.assertFileUsable(id, context.userId);
+    }
+
     return this.fileService.delete(context.locale, { ids: args.ids });
   }
+
+  // ── Upload sem passar o conteúdo pela conversa ─────────────────────────────
+
+  @McpTool({
+    name: 'core.files.create-upload-url',
+    description:
+      'Opens an upload and returns a short-lived, single-use URL to PUT the file to. This is how you send a file without putting its bytes in the conversation: call this, PUT the binary to the returned url, then call core.files.upload.complete to get the fileId, and pass that fileId to whichever tool needs the file. Works for files up to the storage-max-size setting (10mb by default).',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        fileName: { type: 'string', description: 'Original file name (required)' },
+        mimeType: {
+          type: 'string',
+          description:
+            'File MIME type, e.g. application/pdf (required). Must be allowed by the storage-accept-mimetype setting, and is verified against the uploaded bytes.',
+        },
+        sizeBytes: {
+          type: 'number',
+          description:
+            'Exact size of the file in bytes (required). The upload is rejected if the body does not match it.',
+        },
+        destination: {
+          type: 'string',
+          description: 'Storage folder (optional, defaults to mcp/uploads).',
+        },
+        isPrivate: {
+          type: 'boolean',
+          description: 'Keeps the file out of the unauthenticated by-id routes (optional).',
+        },
+        sha256: {
+          type: 'string',
+          description: 'Optional hex sha256 checked against the uploaded content.',
+        },
+        idempotencyKey: {
+          type: 'string',
+          description: 'Optional. Repeating a key returns the same upload instead of opening another.',
+        },
+      },
+      required: ['fileName', 'mimeType', 'sizeBytes'],
+    },
+  })
+  async createUploadUrl(args: any, context: McpContext): Promise<any> {
+    const { ticket } = await this.uploadTickets.create({
+      userId: context.userId,
+      fileName: args.fileName,
+      mimeType: args.mimeType,
+      sizeBytes: args.sizeBytes,
+      destination: args.destination,
+      isPrivate: args.isPrivate,
+      sha256: args.sha256,
+      idempotencyKey: args.idempotencyKey,
+      mode: 'signed_url',
+    });
+
+    return {
+      uploadId: ticket.id,
+      method: 'PUT',
+      url: await this.uploadTickets.buildUploadUrl(ticket.id),
+      headers: { 'Content-Type': ticket.mimetype },
+      expiresAt: ticket.expires_at.toISOString(),
+      sizeBytes: ticket.size_bytes,
+      next: 'PUT the raw file bytes to url, then call core.files.upload.complete with this uploadId.',
+    };
+  }
+
+  @McpTool({
+    name: 'core.files.upload.init',
+    description:
+      'Opens an upload to be sent in base64 chunks. Only for clients that cannot make an HTTP request: it is far slower than core.files.create-upload-url, because the content still travels through the conversation, just split across calls. Follow with core.files.upload.append for each chunk and core.files.upload.complete at the end.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        fileName: { type: 'string', description: 'Original file name (required)' },
+        mimeType: { type: 'string', description: 'File MIME type (required)' },
+        sizeBytes: { type: 'number', description: 'Exact size of the file in bytes (required)' },
+        destination: { type: 'string', description: 'Storage folder (optional)' },
+        isPrivate: { type: 'boolean', description: 'Keeps the file private (optional)' },
+        sha256: { type: 'string', description: 'Optional hex sha256 of the whole file' },
+        idempotencyKey: { type: 'string', description: 'Optional retry key' },
+      },
+      required: ['fileName', 'mimeType', 'sizeBytes'],
+    },
+  })
+  async initChunkedUpload(args: any, context: McpContext): Promise<any> {
+    const { ticket, chunkBytes } = await this.uploadTickets.create({
+      userId: context.userId,
+      fileName: args.fileName,
+      mimeType: args.mimeType,
+      sizeBytes: args.sizeBytes,
+      destination: args.destination,
+      isPrivate: args.isPrivate,
+      sha256: args.sha256,
+      idempotencyKey: args.idempotencyKey,
+      mode: 'chunked',
+    });
+
+    return {
+      uploadId: ticket.id,
+      chunkBytes,
+      totalChunks: Math.ceil(ticket.size_bytes / chunkBytes),
+      expiresAt: ticket.expires_at.toISOString(),
+      next: `Send each chunk with core.files.upload.append, indexes 0..n-1, at most ${chunkBytes} bytes before encoding.`,
+    };
+  }
+
+  @McpTool({
+    name: 'core.files.upload.append',
+    description:
+      'Sends one chunk of an upload opened with core.files.upload.init. Chunks are zero-indexed and must all arrive before complete; re-sending an index overwrites it.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        uploadId: { type: 'number', description: 'Upload ID from core.files.upload.init' },
+        index: { type: 'number', description: 'Zero-based chunk index' },
+        chunkBase64: {
+          type: 'string',
+          description:
+            'Base64 of this chunk of the file. The decoded size must not exceed the chunkBytes returned by init.',
+        },
+      },
+      required: ['uploadId', 'index', 'chunkBase64'],
+    },
+  })
+  async appendUploadChunk(
+    args: { uploadId: number; index: number; chunkBase64: string },
+    context: McpContext,
+  ): Promise<any> {
+    return this.uploadTickets.appendChunk(
+      args.uploadId,
+      args.index,
+      args.chunkBase64,
+      context.userId,
+    );
+  }
+
+  @McpTool({
+    name: 'core.files.upload.complete',
+    description:
+      'Finishes an upload and returns the fileId to pass to other tools. Works for both core.files.create-upload-url and core.files.upload.init, and is idempotent: calling it again for a finished upload returns the same fileId.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        uploadId: { type: 'number', description: 'Upload ID' },
+      },
+      required: ['uploadId'],
+    },
+  })
+  async completeUpload(args: { uploadId: number }, context: McpContext): Promise<any> {
+    const file = await this.uploadTickets.complete(args.uploadId, context.userId);
+
+    return {
+      uploadId: args.uploadId,
+      fileId: file.id,
+      filename: file.filename,
+      size: file.size,
+      mimetype: await this.fileService.mimetypeNameById(file.mimetype_id),
+    };
+  }
 }

package/src/mcp/tools/core-integration-events.mcp-tools.ts

@@ -30,7 +30,7 @@ export class CoreIntegrationEventsMcpTools {
       page: args.page ?? 1,
       pageSize: args.pageSize ?? 20,
       search: args.search ?? '',
-      sortField: args.sortField ?? 'slug',
+      ...(args.sortField ? { sortField: args.sortField } : {}),
       sortOrder: (args.sortOrder as any) ?? 'asc',
       fields: '',
     });

package/src/mcp/tools/core-mail-sent.mcp-tools.ts

@@ -32,7 +32,7 @@ export class CoreMailSentMcpTools {
       page: args.page ?? 1,
       pageSize: args.pageSize ?? 20,
       search: args.search ?? '',
-      sortField: args.sortField ?? 'id',
+      ...(args.sortField ? { sortField: args.sortField } : {}),
       sortOrder: args.sortOrder ?? 'asc',
       fields: '',
       status: args.status,

package/src/mcp/tools/core-mail.mcp-tools.ts

@@ -30,7 +30,7 @@ export class CoreMailMcpTools {
       page: args.page ?? 1,
       pageSize: args.pageSize ?? 20,
       search: args.search ?? '',
-      sortField: args.sortField ?? 'id',
+      ...(args.sortField ? { sortField: args.sortField } : {}),
       sortOrder: (args.sortOrder as any) ?? 'asc',
       fields: '',
     });

package/src/mcp/tools/core-menus.mcp-tools.ts

@@ -61,7 +61,7 @@ export class CoreMenusMcpTools {
       page: args.page ?? 1,
       pageSize: args.pageSize ?? 20,
       search: args.search ?? '',
-      sortField: args.sortField ?? 'id',
+      ...(args.sortField ? { sortField: args.sortField } : {}),
       sortOrder: (args.sortOrder as any) ?? 'asc',
       fields: '',
     });
@@ -173,7 +173,6 @@ export class CoreMenusMcpTools {
       page: args.page ?? 1,
       pageSize: args.pageSize ?? 20,
       search: '',
-      sortField: 'id',
       sortOrder: PageOrderDirection.Asc,
       fields: '',
     });

package/src/mcp/tools/core-notifications.mcp-tools.ts

@@ -24,7 +24,6 @@ export class CoreNotificationsMcpTools {
       page: args.page ?? 1,
       pageSize: args.pageSize ?? 20,
       search: '',
-      sortField: 'id',
       sortOrder: 'desc',
       fields: '',
     });