@iobroker/mcp-server 1.5.0 → 1.6.0

package/README.md

@@ -45,10 +45,13 @@ The adapter can be configured through the ioBroker admin interface using JSONCon
   endpoint is reachable without credentials — only use that on a trusted network or behind a reverse proxy
   that provides its own authentication. As a **web extension** the host `web` instance's authentication
   applies instead, so this switch has no effect there.
-- **Default User**: The ioBroker user whose permissions every MCP request runs with (default: `admin`).
-  All object/state reads and writes performed by the tools are executed in the name of this user, so the
-  user's ACLs are enforced. A plain name like `operator` is automatically expanded to `system.user.operator`.
-  When running as a web extension and no user is set here, the host `web` instance's default user is used.
+- **Default User**: The ioBroker user whose permissions MCP requests run with when authentication is
+  disabled (default: `admin`). With authentication enabled, every session runs with the permissions of the
+  user who logged in, and this setting is not used. All object/state reads and writes performed by the tools
+  are executed in the name of that user, so the user's ACLs are enforced. A plain name like `operator` is
+  automatically expanded to `system.user.operator`. As a web extension the host `web` instance's default user
+  applies. A session is bound to the user that opened it: requests of another user with the same session id
+  are answered with `404 Session not found`.
 - **Enable OAuth**: Offer the browser-based OAuth2 login that MCP clients such as Claude Desktop use when
   a connector is added. In standalone mode this requires *Enable Authentication*. As a **web extension**
   it also works, but the login is then provided by the host `web` instance, so OAuth has to be enabled
@@ -307,6 +310,13 @@ client calls it and its result is verified:
     Placeholder for the next version (at the beginning of the line):
     ### **WORK IN PROGRESS**
 -->
+### 1.6.0 (2026-10-24)
+* (@GermanBluefox) With authentication, the tools run with the permissions of the logged-in user instead of the default user; a session can only be used by the user that opened it
+* (@GermanBluefox) As a web extension, the default user of the `web` instance is used
+
+### 1.5.1 (2026-10-24)
+* (@GermanBluefox) Transfer folders left behind by a killed process are removed at startup
+
 ### 1.5.0 (2026-10-24)
 * (@GermanBluefox) Tool results are kept below the 1 MiB limit of MCP clients: lists are paged with `offset`, other results are replaced by a download link
 * (@GermanBluefox) Added download links (`read_file` with `download: true`, complete lists) and upload links (`prepare_upload`, used by `write_file` and `install_package`) for large data (option `transferLinks`)

package/build/devices.d.ts

@@ -7,7 +7,7 @@
  * them into an AI-friendly structure of rooms -> devices -> named controls.
  *
  * All object reads accept an optional `{ user }` so the detection respects the ACLs of
- * the configured default user (see McpServer).
+ * the user of the MCP request (see McpServer).
  */
 import { type ExternalDetectorState, Types } from '@iobroker/type-detector';
 /** Read options passed through to `getObjectViewAsync` (currently only the ACL user). */

package/build/devices.js

@@ -45,7 +45,7 @@ exports.getAiFriendlyStructure = getAiFriendlyStructure;
  * them into an AI-friendly structure of rooms -> devices -> named controls.
  *
  * All object reads accept an optional `{ user }` so the detection respects the ACLs of
- * the configured default user (see McpServer).
+ * the user of the MCP request (see McpServer).
  */
 const type_detector_1 = __importStar(require("@iobroker/type-detector"));
 /**

package/build/index.d.ts

@@ -17,8 +17,10 @@ export default class McpServer {
     private config;
     private readonly extension;
     private readonly routerPrefix;
-    /** The ioBroker user whose permissions every MCP request runs with. */
+    /** The ioBroker user whose permissions MCP requests run with when no user is logged in. */
     private readonly defaultUser;
+    /** The user of the MCP request being processed, set by {@link runAs} for each HTTP request. */
+    private readonly requestUser;
     /** Default language used to localize device/room/function names. */
     private readonly language;
     /**
@@ -149,6 +151,25 @@ export default class McpServer {
         order: number;
         pro: boolean;
     };
+    /** Normalize a plain user name or a `system.user.*` id to the full id. */
+    private static toUserId;
+    /**
+     * The ioBroker user a request runs as: the logged-in user when the request was authenticated (by
+     * us or, as a web extension, by the host `web` instance), otherwise the default user.
+     */
+    private getRequestUser;
+    /** The user the current tool call runs as. Outside a request (embedded mode) the default user. */
+    private get user();
+    /**
+     * Process a request of a session with the permissions of the session's user. The SDK dispatches the
+     * contained messages within this call, so every tool reached from here sees that user in {@link user}.
+     */
+    private runAs;
+    /**
+     * Get the session of a request. A session is bound to the user that opened it: requests of another
+     * user are answered like an unknown session, so that a leaked session id gives no access.
+     */
+    private getSession;
     /** Handle client -> server messages (initialize, tools/call, ...). */
     private handleMcpPost;
     /** Handle server -> client SSE stream (GET) and session termination (DELETE). */
@@ -197,12 +218,12 @@ export default class McpServer {
     private getStates;
     /**
      * Write multiple states as one operation: the write permission of every state is verified first, so a
-     * batch containing a single state the default user may not write fails as a whole and nothing is
+     * batch containing a single state the user may not write fails as a whole and nothing is
      * written. Other failures of single states are reported per item and do not abort the rest.
      */
     private setStates;
     /**
-     * Verify that the default user may write every given state, mirroring the checks js-controller runs in
+     * Verify that the user of the request may write every given state, mirroring the checks js-controller runs in
      * `setForeignState`: the user must be able to read the object (needed for the type coercion in
      * {@link setState}) and the state ACL must allow writing — for an alias also on its write target.
      *
@@ -214,7 +235,7 @@ export default class McpServer {
      * The state ACL check of js-controller for `setState` on a single object.
      *
      * @param obj the state object (objects without ACL are not restricted by js-controller)
-     * @param permissions the merged group permissions of the default user
+     * @param permissions the merged group permissions of the user
      */
     private isStateWritable;
     /**
@@ -395,6 +416,12 @@ export default class McpServer {
      * token. The file lives in a temporary folder until the link expires (or the upload is used).
      */
     private createTransfer;
+    /**
+     * Remove the transfer folders that a process left behind when it was killed. Other MCP servers on this
+     * host (web extension, standalone, admin) use the same temp folder, so only folders unchanged for longer
+     * than a link lives are removed: every new link creates a subfolder and so touches its folder.
+     */
+    private removeStaleTransferDirs;
     /** The public URL of a download or upload link. */
     private transferUrl;
     /** Remove a link and its file. */