@kinginsun/mcp-drugsea 0.1.0 → 0.2.1

package/README.md

@@ -2,11 +2,11 @@
 
 MCP (Model Context Protocol) stdio server for [DrugSea / Yaohai](https://db.drugsea.cn) pharmaceutical databases.
 
-The server forwards tool calls to `https://api2.drugsea.cn` with header `X-Yaohai-Api-Key`. It covers:
+The server forwards tool calls to **`https://db3.drugsea.cn/api`** with personal user token auth (`Authorization: Bearer ysk_…`). It covers:
 
 - **yaohai-*** — cross-database catalog / search / detail / global / smart-search (`POST /g/mcp/yaohai/*`)
-- **product-cn-*** — already-marketed China products (`GET /product/cn/...`)
-- **reg-cn-*** — CDE registration / review pipeline (`GET /b/drugreg/cn/...` and facet prefix `/b/es/drugreg/cn/list`)
+- **product-cn-*** — already-marketed China products (search/detail via MCP on db3; facets via GET)
+- **reg-cn-*** — CDE registration / review pipeline (search/detail via MCP on db3; facets via GET)
 
 **GitHub:** [github.com/kinginsun/mcp-drugsea](https://github.com/kinginsun/mcp-drugsea)
 
@@ -24,25 +24,22 @@ npx -y @kinginsun/mcp-drugsea
 
 ## Configuration
 
-### `YAOHAI_MCP_API_KEY` (required)
+### `YAOHAI_MCP_TOKEN` (required)
 
-The server accepts either:
+Authentication uses **personal user tokens only** (`ysk_` + 32 hex chars). The legacy shared `X-Yaohai-Api-Key` header is **not supported**.
 
 | Credential | Format | HTTP header |
 |------------|--------|-------------|
-| Shared MCP key | opaque string (server env `YAOHAI_MCP_API_KEY`) | `X-Yaohai-Api-Key` |
 | Personal user token | `ysk_` + 32 hex chars | `Authorization: Bearer ysk_…` |
 
-This client auto-selects the header from the value shape. You may set `YAOHAI_MCP_TOKEN` instead of `YAOHAI_MCP_API_KEY` for a user token.
-
-**Note:** Production MCP with personal `ysk_` tokens is deployed at **`https://db3.drugsea.cn/api/g/mcp/*`**. Legacy `api2.drugsea.cn` accepts only the shared `X-Yaohai-Api-Key`. On db3, direct GET list/facet routes return encrypted payloads; this client auto-routes `product-cn-search` / `reg-cn-search` / detail through MCP POST when the base URL contains `db3.drugsea.cn`.
-
-Obtain a key from the DrugSea / Yaohai operator, then:
+Obtain a token from DrugSea / Yaohai (user account settings), then:
 
 ```bash
-export YAOHAI_MCP_API_KEY=your_api_key_here
+export YAOHAI_MCP_TOKEN=ysk_your_token_here
 ```
 
+On db3, direct GET list routes may return encrypted payloads; this client auto-routes `product-cn-search` / `reg-cn-search` / detail through MCP POST when the base URL contains `db3.drugsea.cn`.
+
 ### Optional
 
 | Variable | Default | Description |
@@ -60,7 +57,7 @@ export YAOHAI_MCP_API_KEY=your_api_key_here
       "command": "npx",
       "args": ["-y", "@kinginsun/mcp-drugsea"],
       "env": {
-        "YAOHAI_MCP_API_KEY": "your_api_key_here"
+        "YAOHAI_MCP_TOKEN": "ysk_your_token_here"
       }
     }
   }
@@ -76,7 +73,7 @@ export YAOHAI_MCP_API_KEY=your_api_key_here
       "command": "npx",
       "args": ["-y", "@kinginsun/mcp-drugsea"],
       "env": {
-        "YAOHAI_MCP_API_KEY": "your_api_key_here"
+        "YAOHAI_MCP_TOKEN": "ysk_your_token_here"
       }
     }
   }
@@ -99,7 +96,7 @@ If `total > 20`, summarize in chat (about 5–10 sample rows) instead of pasting
 
 xlsx export is not implemented in this MCP (v1 returns JSON samples only).
 
-`product-cn-*` and `reg-cn-*` list/facet/detail calls use the same GET routes as the website. Some API2 deployments IP-allowlist those paths and respond with `非法IP地址`. The `yaohai-*` tools use `POST /g/mcp/yaohai/*`, which is the MCP-keyed surface and is not subject to that list GET allowlist.
+`product-cn-*` and `reg-cn-*` list/facet/detail calls use the same routes as the website where applicable. Some deployments IP-allowlist direct GET paths. The `yaohai-*` tools use `POST /g/mcp/yaohai/*` with Bearer token auth.
 
 ## Tools
 
@@ -143,17 +140,17 @@ xlsx export is not implemented in this MCP (v1 returns JSON samples only).
 
 ```bash
 echo '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}' \
-  | YAOHAI_MCP_API_KEY=your_key node dist/index.js
+  | YAOHAI_MCP_TOKEN=ysk_your_token_here node dist/index.js
 ```
 
 ```bash
 echo '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"yaohai-catalog","arguments":{"q":"医保"}}}' \
-  | YAOHAI_MCP_API_KEY=your_key node dist/index.js
+  | YAOHAI_MCP_TOKEN=ysk_your_token_here node dist/index.js
 ```
 
 ```bash
 echo '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"product-cn-search","arguments":{"query":{"drug_name":"阿司匹林"},"limit":3}}}' \
-  | YAOHAI_MCP_API_KEY=your_key node dist/index.js
+  | YAOHAI_MCP_TOKEN=ysk_your_token_here node dist/index.js
 ```
 
 ## Requirements

package/dist/api.js

@@ -2,12 +2,35 @@ import http from "node:http";
 import https from "node:https";
 import { URL } from "node:url";
 import { normalizeRecord, parseFacetList } from "./normalize.js";
-export class MissingApiKeyError extends Error {
-    constructor() {
-        super("Set YAOHAI_MCP_API_KEY (shared key) or YAOHAI_MCP_TOKEN (ysk_… user token)");
-        this.name = "MissingApiKeyError";
+export class MissingTokenError extends Error {
+    constructor(message) {
+        super(message ??
+            "Set YAOHAI_MCP_TOKEN to your personal DrugSea token (ysk_ + 32 hex chars)");
+        this.name = "MissingTokenError";
     }
 }
+/** @deprecated Use MissingTokenError */
+export const MissingApiKeyError = MissingTokenError;
+const USER_TOKEN_RE = /^ysk_[0-9a-f]{32}$/i;
+export function getUserToken() {
+    const token = process.env.YAOHAI_MCP_TOKEN?.trim() || "";
+    if (!token) {
+        throw new MissingTokenError();
+    }
+    if (!USER_TOKEN_RE.test(token)) {
+        throw new MissingTokenError("YAOHAI_MCP_TOKEN must be a personal user token: ysk_ + 32 hex chars");
+    }
+    return token;
+}
+/** @deprecated Use getUserToken */
+export const getApiKey = getUserToken;
+export function getAuthHeaders(extra = {}) {
+    const token = getUserToken();
+    return {
+        ...extra,
+        Authorization: `Bearer ${token}`,
+    };
+}
 export class ApiError extends Error {
     status;
     raw;
@@ -18,27 +41,6 @@ export class ApiError extends Error {
         this.raw = raw;
     }
 }
-export function getApiKey() {
-    const token = process.env.YAOHAI_MCP_TOKEN?.trim() || "";
-    const key = process.env.YAOHAI_MCP_API_KEY?.trim() || "";
-    const value = token || key;
-    if (!value) {
-        throw new MissingApiKeyError();
-    }
-    return value;
-}
-/** Shared server key → X-Yaohai-Api-Key; user token ysk_… → Authorization Bearer. */
-export function getAuthHeaders(extra = {}) {
-    const credential = getApiKey();
-    const headers = { ...extra };
-    if (credential.startsWith("ysk_")) {
-        headers.Authorization = `Bearer ${credential}`;
-    }
-    else {
-        headers["X-Yaohai-Api-Key"] = credential;
-    }
-    return headers;
-}
 export function getBaseUrl() {
     return (process.env.YAOHAI_BASE_URL || "https://db3.drugsea.cn/api").replace(/\/$/, "");
 }

package/dist/index.js

@@ -2,10 +2,10 @@
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
-import { clampLimit, clampOffset, fetchDetail, fetchFacets, listSearch, mcpDbDetail, mcpDbSearch, prefersMcpListApi, yaohaiPost, } from "./api.js";
+import { ApiError, clampLimit, clampOffset, fetchDetail, fetchFacets, listSearch, mcpDbDetail, mcpDbSearch, prefersMcpListApi, yaohaiPost, } from "./api.js";
 import { ATC_HINT, PRODUCT_CN_COMMON_FIELDS, PRODUCT_CN_DETAIL_PATH, PRODUCT_CN_FACET_FIELDS, PRODUCT_CN_FACET_PREFIX, PRODUCT_CN_VIEW_TYPES, REG_CN_COMMON_FIELDS, REG_CN_DETAIL_PATH, REG_CN_FACET_FIELDS, REG_CN_FACET_PREFIX, REG_CN_VIEW_TYPES, applyProductCnDefaults, applyRegCnDefaults, productCnSearchPath, regCnSearchPath, } from "./fields.js";
 import { EmptyObjectSchema, ProductCnDetailSchema, ProductCnFacetsSchema, ProductCnSearchSchema, RegCnDetailSchema, RegCnFacetsSchema, RegCnSearchSchema, YaohaiCatalogSchema, YaohaiDetailSchema, YaohaiGlobalSearchSchema, YaohaiSearchSchema, YaohaiSmartSearchSchema, } from "./types.js";
-const PACKAGE_VERSION = "0.1.0";
+const PACKAGE_VERSION = "0.2.0";
 const YAOHAI_LIMIT_MAX = 50;
 const YAOHAI_LIMIT_DEFAULT = 10;
 const CN_LIMIT_MAX = 100;
@@ -111,6 +111,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
             {
                 name: "yaohai-smart-search",
                 description: "Natural-language Yaohai search: auto-routes the question to up to 3 databases. Use when the user question is broad or the target DB is unclear. " +
+                    "Falls back to global search when the router matches nothing or finds no rows. " +
                     ROUTING_HINT,
                 inputSchema: {
                     type: "object",
@@ -259,6 +260,170 @@ function encodeId(id) {
 function asQuery(query) {
     return { ...(query ?? {}) };
 }
+async function globalSearchContent(q, query, limit) {
+    const gquery = asQuery(query);
+    if (q && (gquery.term === undefined || gquery.term === "")) {
+        gquery.term = q;
+    }
+    const content = await yaohaiPost("/g/mcp/yaohai/global-search", {
+        query: gquery,
+        limit,
+        offset: 0,
+    });
+    return content;
+}
+function allSmartResultsEmpty(content) {
+    if (!content || typeof content !== "object") {
+        return true;
+    }
+    const results = content.results;
+    if (!Array.isArray(results) || results.length === 0) {
+        return true;
+    }
+    return results.every((entry) => {
+        const result = entry?.result;
+        if (!result || typeof result !== "object") {
+            return true;
+        }
+        const total = result.total;
+        return typeof total === "number" ? total === 0 : true;
+    });
+}
+/**
+ * The backend router searches the entire question string in one field per DB,
+ * which rarely matches (e.g. item="医保目录 阿司匹林" → 0 rows), and sometimes
+ * picks a field the DB does not support (e.g. `item` on jicai). Retry each
+ * empty matched DB with the individual tokens of the question across the
+ * router's field plus the catalog's search_fields for that DB.
+ */
+async function retrySmartResultsWithTokens(content, q, limit) {
+    const results = content.results;
+    if (!Array.isArray(results)) {
+        return null;
+    }
+    const tokens = q.split(/\s+/).filter((t) => t && t !== q);
+    if (tokens.length === 0) {
+        return null;
+    }
+    const catalogFields = new Map();
+    async function searchFieldsFor(dbname) {
+        if (catalogFields.has(dbname)) {
+            return catalogFields.get(dbname);
+        }
+        let keys = [];
+        try {
+            const cat = (await yaohaiPost("/g/mcp/yaohai/catalog", { q: dbname }));
+            const db = (cat.databases ?? []).find((d) => d.id === dbname);
+            keys = (db?.search_fields ?? [])
+                .map((f) => f.key)
+                .filter((k) => typeof k === "string");
+        }
+        catch {
+            keys = [];
+        }
+        catalogFields.set(dbname, keys);
+        return keys;
+    }
+    let changed = false;
+    const patched = [];
+    for (const entry of results) {
+        const inner = entry?.result;
+        if (!inner || typeof inner !== "object") {
+            patched.push(entry);
+            continue;
+        }
+        const r = inner;
+        if (r.total !== 0 || typeof r.dbname !== "string") {
+            patched.push(entry);
+            continue;
+        }
+        const queryApplied = r.query_applied;
+        const appliedKeys = queryApplied ? Object.keys(queryApplied) : [];
+        const singleFieldWholeQuestion = appliedKeys.length === 1 && queryApplied[appliedKeys[0]] === q;
+        if (!singleFieldWholeQuestion) {
+            patched.push(entry);
+            continue;
+        }
+        const routerField = appliedKeys[0];
+        const fields = [routerField, ...(await searchFieldsFor(r.dbname))];
+        const uniqueFields = [...new Set(fields)].slice(0, 6);
+        let replaced = false;
+        outer: for (const token of tokens.slice(0, 3)) {
+            for (const field of uniqueFields) {
+                try {
+                    const retry = (await yaohaiPost("/g/mcp/yaohai/search", {
+                        dbname: r.dbname,
+                        query: { [field]: token },
+                        limit,
+                        offset: 0,
+                    }));
+                    if (typeof retry.total === "number" && retry.total > 0) {
+                        patched.push({
+                            ...entry,
+                            result: { ...retry, retry: { token, field } },
+                        });
+                        changed = true;
+                        replaced = true;
+                        break outer;
+                    }
+                }
+                catch {
+                    // ignore per-token retry errors; try next field/token
+                }
+            }
+        }
+        if (!replaced) {
+            patched.push(entry);
+        }
+    }
+    if (!changed) {
+        return null;
+    }
+    return { ...content, results: patched };
+}
+/**
+ * Last resort when the router matched databases but every search came back
+ * empty (e.g. the question is just a DB keyword like 集采): browse the matched
+ * databases without a query so the caller still sees representative rows.
+ */
+async function browseMatchedDatabases(content, limit) {
+    const matched = content.matched_databases;
+    if (!Array.isArray(matched) || matched.length === 0) {
+        return null;
+    }
+    const results = [];
+    for (const db of matched.slice(0, 3)) {
+        const id = db?.id;
+        if (typeof id !== "string") {
+            continue;
+        }
+        try {
+            const browse = (await yaohaiPost("/g/mcp/yaohai/search", {
+                dbname: id,
+                query: {},
+                limit,
+                offset: 0,
+            }));
+            if (typeof browse.total === "number" && browse.total > 0) {
+                results.push({
+                    score: db.score,
+                    result: { ...browse, browse: true },
+                });
+            }
+        }
+        catch {
+            // DB not browsable — skip
+        }
+    }
+    if (results.length === 0) {
+        return null;
+    }
+    return {
+        ...content,
+        results,
+        note: "Smart-search found no rows for the full question; showing sample rows from the matched databases instead.",
+    };
+}
 server.setRequestHandler(CallToolRequestSchema, async (request) => {
     const { name, arguments: args } = request.params;
     try {
@@ -306,15 +471,53 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             }
             case "yaohai-smart-search": {
                 const validated = YaohaiSmartSearchSchema.parse(args);
-                const body = {
-                    q: validated.q,
-                    limit: clampLimit(validated.limit, YAOHAI_LIMIT_DEFAULT, YAOHAI_LIMIT_MAX),
-                };
+                const limit = clampLimit(validated.limit, YAOHAI_LIMIT_DEFAULT, YAOHAI_LIMIT_MAX);
+                const body = { q: validated.q, limit };
                 if (validated.query) {
                     body.query = validated.query;
                 }
-                const content = await yaohaiPost("/g/mcp/yaohai/smart-search", body);
-                return ok(content);
+                try {
+                    const content = await yaohaiPost("/g/mcp/yaohai/smart-search", body);
+                    if (allSmartResultsEmpty(content)) {
+                        // Router matched DBs but searched the whole question in one field
+                        // (or picked an unsupported field). Retry with individual tokens
+                        // across the router's field + the DB's catalog search_fields.
+                        const retried = await retrySmartResultsWithTokens(content, validated.q, limit);
+                        if (retried) {
+                            return ok(retried);
+                        }
+                        // Keyword-only question (e.g. "集采"): show sample rows from the
+                        // matched databases.
+                        const browsed = await browseMatchedDatabases(content, limit);
+                        if (browsed) {
+                            return ok(browsed);
+                        }
+                        // Still nothing — try the global panorama.
+                        const fallback = await globalSearchContent(validated.q, validated.query, limit);
+                        return ok({
+                            question: validated.q,
+                            matched_databases: content.matched_databases,
+                            fallback: "global-search",
+                            note: "Smart-search router matched databases but returned no rows; fell back to global search.",
+                            ...fallback,
+                        });
+                    }
+                    return ok(content);
+                }
+                catch (error) {
+                    if (error instanceof ApiError) {
+                        // Backend router could not match any database (e.g. plain drug-name
+                        // question) — fall back to the global panorama search.
+                        const fallback = await globalSearchContent(validated.q, validated.query, limit);
+                        return ok({
+                            question: validated.q,
+                            fallback: "global-search",
+                            note: `Smart-search router failed (${error.message}); fell back to global search.`,
+                            ...fallback,
+                        });
+                    }
+                    throw error;
+                }
             }
             case "product-cn-fields": {
                 EmptyObjectSchema.parse(args ?? {});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kinginsun/mcp-drugsea",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "MCP server for DrugSea / Yaohai pharmaceutical databases: cross-db search, China marketed products (product_cn), and CDE registration review (reg_cn).",
   "type": "module",
   "main": "dist/index.js",