@kadoa/mcp 0.2.4 → 0.2.5-rc.1

package/README.md

@@ -144,6 +144,8 @@ Get your API key from [kadoa.com/settings](https://kadoa.com/settings).
 | `delete_workflow` | Delete a workflow |
 | `approve_workflow` | Approve and activate a workflow |
 | `update_workflow` | Update workflow configuration and schema |
+| `team_list` | List all teams you belong to and see which is active |
+| `team_switch` | Switch the active team by name or ID |
 
 ## Usage Examples
 
@@ -214,6 +216,26 @@ delete_workflow for each, confirming before proceeding.
 - Verify the MCP server is configured correctly
 - Restart your MCP client
 
+## Deploying the Remote Server
+
+The remote MCP server at `mcp.kadoa.com` runs as a Docker container on GKE, deployed from the `kadoa-backend` monorepo.
+
+**To deploy a new version:**
+
+1. Publish a new `@kadoa/mcp` version to npm (`npm publish`)
+2. In `kadoa-backend`, update `infra/docker/mcp/package.json` to the new version and run `bun install` to regenerate the lockfile
+3. Merge to `main` — the CI pipeline (`main-build-deploy.yml`) builds and pushes the Docker image automatically
+4. Trigger the **Deploy to Production** workflow (`deploy-prod.yml`) with:
+   - **Target cluster:** `gcp`
+   - **Deployment scope:** `mcp`
+   - **Image tag:** the tag from step 3 (shown in the build summary)
+   - **Method:** `kubectl`
+
+Infrastructure files in `kadoa-backend`:
+- `infra/docker/mcp/Dockerfile.mcp-server` — Docker image definition
+- `infra/docker/mcp/package.json` — pinned `@kadoa/mcp` version
+- `infra/cdk8s/mcp/` — Kubernetes manifests (cdk8s)
+
 ## Development
 
 ```bash

package/dist/index.js

@@ -53301,7 +53301,7 @@ async function exchangeSupabaseCode(code, codeVerifier) {
   const data = await res.json();
   return data.access_token;
 }
-async function resolveApiKey2(supabaseJwt) {
+async function fetchUserTeams(supabaseJwt) {
   const kadoaApiUrl = process.env.KADOA_PUBLIC_API_URI || "https://api.kadoa.com";
   const userRes = await fetch(`${kadoaApiUrl}/v4/user`, {
     headers: { Authorization: `Bearer ${supabaseJwt}` }
@@ -53314,7 +53314,14 @@ async function resolveApiKey2(supabaseJwt) {
   if (!userData.teams?.length) {
     throw new Error("User has no teams");
   }
-  const teamId = userData.teams[0].id;
+  return userData.teams.map((t) => ({
+    id: t.id,
+    name: t.name,
+    memberRole: t.memberRole
+  }));
+}
+async function resolveTeamApiKey(supabaseJwt, teamId) {
+  const kadoaApiUrl = process.env.KADOA_PUBLIC_API_URI || "https://api.kadoa.com";
   const keyRes = await fetch(`${kadoaApiUrl}/v4/team/${teamId}/api-key`, {
     headers: { Authorization: `Bearer ${supabaseJwt}` }
   });
@@ -53454,21 +53461,20 @@ class KadoaOAuthProvider {
     pendingAuths.delete(state);
     try {
       const supabaseJwt = await exchangeSupabaseCode(code, pending.supabaseCodeVerifier);
-      const apiKey = await resolveApiKey2(supabaseJwt);
-      const mcpCode = randomToken();
-      authCodes.set(mcpCode, {
-        apiKey,
-        codeChallenge: pending.params.codeChallenge,
-        clientId: pending.client.client_id,
-        redirectUri: pending.params.redirectUri,
-        expiresAt: Date.now() + 10 * 60 * 1000
-      });
-      const redirectUrl = new URL(pending.params.redirectUri);
-      redirectUrl.searchParams.set("code", mcpCode);
-      if (pending.params.state) {
-        redirectUrl.searchParams.set("state", pending.params.state);
+      const teams = await fetchUserTeams(supabaseJwt);
+      if (teams.length === 1) {
+        const apiKey = await resolveTeamApiKey(supabaseJwt, teams[0].id);
+        this.completeAuthFlow(pending, apiKey, res);
+        return;
       }
-      res.redirect(redirectUrl.toString());
+      const selectionToken = randomToken();
+      pendingTeamSelections.set(selectionToken, {
+        supabaseJwt,
+        teams,
+        pending,
+        expiresAt: Date.now() + TEAM_SELECTION_TTL
+      });
+      res.type("html").send(renderTeamSelectionPage(teams, selectionToken));
     } catch (error48) {
       console.error("Auth callback error:", error48);
       const redirectUrl = new URL(pending.params.redirectUri);
@@ -53480,14 +53486,180 @@ class KadoaOAuthProvider {
       res.redirect(redirectUrl.toString());
     }
   }
+  async handleTeamSelection(req, res) {
+    const { token, teamId } = req.body;
+    if (!token || !teamId) {
+      res.status(400).send("Missing token or teamId");
+      return;
+    }
+    const entry = pendingTeamSelections.get(token);
+    if (!entry) {
+      res.status(400).send("Unknown or expired team selection token");
+      return;
+    }
+    if (entry.expiresAt < Date.now()) {
+      pendingTeamSelections.delete(token);
+      res.status(400).send("Team selection expired — please log in again");
+      return;
+    }
+    if (!entry.teams.some((t) => t.id === teamId)) {
+      res.status(403).send("Invalid team selection");
+      return;
+    }
+    pendingTeamSelections.delete(token);
+    try {
+      const apiKey = await resolveTeamApiKey(entry.supabaseJwt, teamId);
+      this.completeAuthFlow(entry.pending, apiKey, res);
+    } catch (error48) {
+      console.error("Team selection error:", error48);
+      const redirectUrl = new URL(entry.pending.params.redirectUri);
+      redirectUrl.searchParams.set("error", "server_error");
+      redirectUrl.searchParams.set("error_description", error48 instanceof Error ? error48.message : "Failed to resolve team API key");
+      if (entry.pending.params.state) {
+        redirectUrl.searchParams.set("state", entry.pending.params.state);
+      }
+      res.redirect(redirectUrl.toString());
+    }
+  }
+  completeAuthFlow(pending, apiKey, res) {
+    const mcpCode = randomToken();
+    authCodes.set(mcpCode, {
+      apiKey,
+      codeChallenge: pending.params.codeChallenge,
+      clientId: pending.client.client_id,
+      redirectUri: pending.params.redirectUri,
+      expiresAt: Date.now() + 10 * 60 * 1000
+    });
+    const redirectUrl = new URL(pending.params.redirectUri);
+    redirectUrl.searchParams.set("code", mcpCode);
+    if (pending.params.state) {
+      redirectUrl.searchParams.set("state", pending.params.state);
+    }
+    res.redirect(redirectUrl.toString());
+  }
 }
-var clients, pendingAuths, authCodes, accessTokens, refreshTokens, ACCESS_TOKEN_TTL = 3600, kadoaClientsStore;
+function renderTeamSelectionPage(teams, selectionToken) {
+  const teamButtons = teams.map((t) => `
+      <button type="submit" name="teamId" value="${t.id}" class="team-btn">
+        <span class="team-name">${escapeHtml(t.name)}</span>
+        ${t.memberRole ? `<span class="team-role">${escapeHtml(t.memberRole.toLowerCase())}</span>` : ""}
+      </button>`).join(`
+`);
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>Select Team - Kadoa</title>
+  <style>
+    * { margin: 0; padding: 0; box-sizing: border-box; }
+
+    body {
+      font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
+      background: #0a0a0f;
+      color: #e4e4e7;
+      min-height: 100vh;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+    }
+
+    .container {
+      width: 100%;
+      max-width: 420px;
+      padding: 2rem;
+    }
+
+    .logo {
+      text-align: center;
+      margin-bottom: 2rem;
+    }
+
+    .logo svg {
+      width: 40px;
+      height: 40px;
+    }
+
+    h1 {
+      font-size: 1.25rem;
+      font-weight: 600;
+      text-align: center;
+      margin-bottom: 0.5rem;
+      color: #fafafa;
+    }
+
+    .subtitle {
+      text-align: center;
+      color: #71717a;
+      font-size: 0.875rem;
+      margin-bottom: 1.5rem;
+    }
+
+    .team-btn {
+      width: 100%;
+      display: flex;
+      align-items: center;
+      justify-content: space-between;
+      padding: 0.875rem 1rem;
+      margin-bottom: 0.5rem;
+      background: #18181b;
+      border: 1px solid #27272a;
+      border-radius: 8px;
+      color: #fafafa;
+      font-size: 0.9375rem;
+      cursor: pointer;
+      transition: background 0.15s, border-color 0.15s;
+    }
+
+    .team-btn:hover {
+      background: #1f1f23;
+      border-color: #3f3f46;
+    }
+
+    .team-btn:active {
+      background: #27272a;
+    }
+
+    .team-name { font-weight: 500; }
+
+    .team-role {
+      font-size: 0.75rem;
+      color: #71717a;
+      text-transform: capitalize;
+    }
+  </style>
+</head>
+<body>
+  <div class="container">
+    <div class="logo">
+      <svg viewBox="0 0 40 40" fill="none" xmlns="http://www.w3.org/2000/svg">
+        <rect width="40" height="40" rx="8" fill="#6d28d9"/>
+        <text x="50%" y="54%" dominant-baseline="middle" text-anchor="middle"
+              fill="white" font-family="sans-serif" font-size="20" font-weight="700">K</text>
+      </svg>
+    </div>
+    <h1>Select a team</h1>
+    <p class="subtitle">Choose which team to connect with this MCP session</p>
+    <form method="POST" action="/team-select">
+      <input type="hidden" name="token" value="${selectionToken}" />
+      ${teamButtons}
+    </form>
+  </div>
+</body>
+</html>`;
+}
+function escapeHtml(str) {
+  return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+var clients, pendingAuths, pendingTeamSelections, authCodes, accessTokens, refreshTokens, TEAM_SELECTION_TTL, ACCESS_TOKEN_TTL = 3600, kadoaClientsStore;
 var init_auth2 = __esm(() => {
   clients = new Map;
   pendingAuths = new Map;
+  pendingTeamSelections = new Map;
   authCodes = new Map;
   accessTokens = new Map;
   refreshTokens = new Map;
+  TEAM_SELECTION_TTL = 10 * 60 * 1000;
   kadoaClientsStore = {
     getClient(clientId) {
       return clients.get(clientId);
@@ -53511,7 +53683,8 @@ __export(exports_http, {
   startHttpServer: () => startHttpServer
 });
 import { randomUUID as randomUUID2 } from "node:crypto";
-function resolveApiKey3(req) {
+import express8 from "express";
+function resolveApiKey2(req) {
   return req.auth?.extra?.apiKey;
 }
 async function startHttpServer() {
@@ -53530,13 +53703,16 @@ async function startHttpServer() {
   app.get("/auth/callback", (req, res) => {
     provider.handleAuthCallback(req, res);
   });
+  app.post("/team-select", express8.urlencoded({ extended: false }), (req, res) => {
+    provider.handleTeamSelection(req, res);
+  });
   app.get("/health", (_req, res) => {
     res.json({ status: "ok", sessions: Object.keys(sessions).length });
   });
   const bearerAuth = requireBearerAuth({ verifier: provider });
   app.post("/mcp", bearerAuth, async (req, res) => {
     const sessionId = req.headers["mcp-session-id"];
-    const apiKey = resolveApiKey3(req);
+    const apiKey = resolveApiKey2(req);
     if (!apiKey) {
       res.status(401).json({
         jsonrpc: "2.0",
@@ -53593,7 +53769,7 @@ async function startHttpServer() {
   });
   app.get("/mcp", bearerAuth, async (req, res) => {
     const sessionId = req.headers["mcp-session-id"];
-    const apiKey = resolveApiKey3(req);
+    const apiKey = resolveApiKey2(req);
     if (!apiKey) {
       res.status(401).send("Unauthorized: Bearer token required");
       return;
@@ -53610,7 +53786,7 @@ async function startHttpServer() {
   });
   app.delete("/mcp", bearerAuth, async (req, res) => {
     const sessionId = req.headers["mcp-session-id"];
-    const apiKey = resolveApiKey3(req);
+    const apiKey = resolveApiKey2(req);
     if (!apiKey) {
       res.status(401).send("Unauthorized: Bearer token required");
       return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kadoa/mcp",
-  "version": "0.2.4",
+  "version": "0.2.5-rc.1",
   "description": "Kadoa MCP Server — manage workflows from Claude Desktop, Cursor, and other MCP clients",
   "type": "module",
   "main": "dist/index.js",
@@ -39,6 +39,12 @@
     "bun-types": "^1.3.3",
     "typescript": "^5.9.3"
   },
-  "keywords": ["kadoa", "mcp", "model-context-protocol", "web-scraping", "data-extraction"],
+  "keywords": [
+    "kadoa",
+    "mcp",
+    "model-context-protocol",
+    "web-scraping",
+    "data-extraction"
+  ],
   "license": "MIT"
 }