@kitae9999/openlog-cli 0.2.0 → 1.1.0

package/dist/mcp-server.js

@@ -1,84 +1,103 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
-import { OpenLogApiClient } from "./api-client.js";
 import { readAuthFile } from "./auth-store.js";
+import { createAuthenticatedApiClient } from "./authenticated-client.js";
 import { getApiBaseUrl, getWebBaseUrl } from "./config.js";
+import { readMcpPermissions, } from "./mcp-permissions.js";
+import { createContentPreview, McpToolRegistry, READ_TOOL_ANNOTATIONS, WRITE_TOOL_ANNOTATIONS, } from "./mcp-toolkit.js";
+import { registerWorkspaceTools } from "./mcp-workspace-tools.js";
 import { uploadPostImage } from "./post-image-upload.js";
-const WRITE_TOOL_ANNOTATIONS = {
-    readOnlyHint: false,
-    destructiveHint: false,
-    idempotentHint: false,
-    openWorldHint: true,
-};
-export async function runMcpServer() {
+export async function createOpenLogMcpServer(options = {}) {
+    // 의존성을 주입할 수 있는 factory로 구성해 실제 네트워크 없이 도구 목록과 호출을 테스트한다.
+    const permissions = options.permissions ?? (await readMcpPermissions());
+    const createClient = options.createAuthenticatedClient ?? createAuthenticatedApiClient;
+    const readAuth = options.readAuth ?? readAuthFile;
+    const uploadImage = options.uploadImage ?? uploadPostImage;
+    const apiBaseUrl = options.apiBaseUrl ?? getApiBaseUrl();
+    const webBaseUrl = options.webBaseUrl ?? getWebBaseUrl();
     const server = new McpServer({
         name: "openlog",
-        version: "0.2.0",
+        version: "1.0.0",
     });
-    server.registerTool("get_auth_status", {
+    const registry = new McpToolRegistry(server, permissions, createClient);
+    registry.registerLocal("get_mcp_permissions", "read", {
+        title: "Get OpenLog MCP Permissions",
+        description: "Return the active local MCP permission profile and capabilities.",
+        inputSchema: {},
+        annotations: READ_TOOL_ANNOTATIONS,
+    }, async () => ({
+        ...permissions,
+        note: "This is a local agent safety policy, not a server-side authorization boundary.",
+    }));
+    registry.registerLocal("get_auth_status", "read", {
         title: "Get OpenLog Auth Status",
         description: "Check whether the local OpenLog CLI is authenticated.",
         inputSchema: {},
+        annotations: READ_TOOL_ANNOTATIONS,
     }, async () => {
-        let apiBaseUrl = getApiBaseUrl();
+        let resolvedApiBaseUrl = apiBaseUrl;
         try {
-            const authFile = await readAuthFile();
+            const authFile = await readAuth();
             if (!authFile) {
-                return textResult({
+                return {
                     authenticated: false,
-                    apiBaseUrl,
-                });
+                    apiBaseUrl: resolvedApiBaseUrl,
+                };
             }
-            apiBaseUrl = authFile.apiBaseUrl;
-            const me = await createAuthenticatedClient().then((client) => client.get("/auth/me"));
-            return textResult({
+            resolvedApiBaseUrl = authFile.apiBaseUrl;
+            const me = await createClient().then((client) => client.get("/auth/me"));
+            return {
                 authenticated: true,
                 apiBaseUrl: authFile.apiBaseUrl,
                 user: me,
-            });
+            };
         }
         catch (error) {
-            return textResult({
+            return {
                 authenticated: false,
-                apiBaseUrl,
+                apiBaseUrl: resolvedApiBaseUrl,
                 error: error instanceof Error ? error.message : String(error),
-            });
+            };
         }
     });
-    server.registerTool("get_me", {
+    registry.registerAuthenticated("get_me", "read", {
         title: "Get OpenLog Me",
         description: "Return the currently authenticated OpenLog user.",
         inputSchema: {},
-    }, async () => withAuthenticatedClient((client) => client.get("/auth/me")));
-    server.registerTool("list_my_notifications", {
+        annotations: READ_TOOL_ANNOTATIONS,
+    }, (client) => client.get("/auth/me"));
+    registry.registerAuthenticated("list_my_notifications", "read", {
         title: "List My OpenLog Notifications",
         description: "Return notifications for the authenticated OpenLog user.",
         inputSchema: {
             size: z.number().int().min(1).max(20).default(20),
         },
-    }, async ({ size }) => withAuthenticatedClient((client) => client.get(`/notifications?${new URLSearchParams({ size: String(size) })}`)));
-    server.registerTool("list_my_liked_posts", {
+        annotations: READ_TOOL_ANNOTATIONS,
+    }, (client, { size }) => client.get(`/notifications?${new URLSearchParams({ size: String(size) })}`));
+    registry.registerAuthenticated("list_my_liked_posts", "read", {
         title: "List My Liked OpenLog Posts",
         description: "Return posts liked by the authenticated OpenLog user.",
         inputSchema: {
             cursor: z.string().optional(),
             size: z.number().int().min(1).max(20).default(10),
         },
-    }, async ({ cursor, size }) => {
+        annotations: READ_TOOL_ANNOTATIONS,
+    }, (client, { cursor, size }) => {
         const params = new URLSearchParams({ size: String(size) });
         if (cursor) {
             params.set("cursor", cursor);
         }
-        return withAuthenticatedClient((client) => client.get(`/users/me/liked-posts?${params}`));
+        return client.get(`/users/me/liked-posts?${params}`);
     });
-    server.registerTool("list_my_posts", {
+    registry.registerAuthenticated("list_my_posts", "read", {
         title: "List My OpenLog Posts",
         description: "Return posts authored by the authenticated OpenLog user.",
         inputSchema: {
             size: z.number().int().min(1).max(100).default(20),
         },
-    }, async ({ size }) => withAuthenticatedClient(async (client) => {
+        annotations: READ_TOOL_ANNOTATIONS,
+    }, async (client, { size }) => {
         const me = await client.get("/auth/me");
         const username = me.username?.trim();
         if (!username) {
@@ -92,23 +111,22 @@ export async function runMcpServer() {
             hasMore: posts.length > size,
             posts: posts.slice(0, size),
         };
-    }));
-    server.registerTool("upload_post_image", {
+    });
+    registry.registerAuthenticated("upload_post_image", "write", {
         title: "Upload OpenLog Post Image",
         description: "Convert a local image file to WebP, upload it to OpenLog, and return markdown for post content.",
-        annotations: WRITE_TOOL_ANNOTATIONS,
         inputSchema: {
             filePath: z.string().min(1),
             altText: z.string().optional(),
         },
-    }, async ({ filePath, altText }) => withAuthenticatedClient((client) => uploadPostImage(client, {
+        annotations: WRITE_TOOL_ANNOTATIONS,
+    }, (client, { filePath, altText }) => uploadImage(client, {
         filePath,
         altText,
-    })));
-    server.registerTool("publish_post", {
+    }));
+    registry.registerAuthenticated("publish_post", "publish", {
         title: "Publish OpenLog Post",
-        description: "Publish a new post to the authenticated OpenLog account. Requires confirm: true unless skipConfirmation: true is explicitly provided.",
-        annotations: WRITE_TOOL_ANNOTATIONS,
+        description: "Publish a new post. Requires confirm: true unless skipConfirmation: true is explicitly provided.",
         inputSchema: {
             title: z.string().min(1),
             description: z.string().min(1),
@@ -123,7 +141,8 @@ export async function runMcpServer() {
             confirm: z.boolean().optional(),
             skipConfirmation: z.boolean().optional(),
         },
-    }, async ({ title, description, content, topics, links, confirm, skipConfirmation, }) => withAuthenticatedClient(async (client) => {
+        annotations: WRITE_TOOL_ANNOTATIONS,
+    }, async (client, { title, description, content, topics, links, confirm, skipConfirmation, }) => {
         const post = normalizePostInput({
             title,
             description,
@@ -131,6 +150,7 @@ export async function runMcpServer() {
             topics,
             links,
         });
+        // 명시적 확인 전에는 POST를 실행하지 않고 실제 발행 입력의 미리보기만 반환한다.
         if (confirm !== true && skipConfirmation !== true) {
             return {
                 requiresConfirmation: true,
@@ -150,18 +170,30 @@ export async function runMcpServer() {
         return {
             ...published,
             path: postPath,
-            url: new URL(postPath, `${getWebBaseUrl()}/`).toString(),
+            url: new URL(postPath, `${webBaseUrl}/`).toString(),
         };
-    }));
-    server.registerTool("get_post_detail", {
+    });
+    registry.registerAuthenticated("get_post_detail", "read", {
         title: "Get OpenLog Post Detail",
         description: "Return a public OpenLog post detail by author username and post slug.",
         inputSchema: {
             username: z.string().min(1),
             slug: z.string().min(1),
         },
-    }, async ({ username, slug }) => withAuthenticatedClient((client) => client.get(`/users/${encodeURIComponent(username)}/posts/${encodeURIComponent(slug)}`)));
-    await server.connect(new StdioServerTransport());
+        annotations: READ_TOOL_ANNOTATIONS,
+    }, (client, { username, slug }) => client.get(`/users/${encodeURIComponent(username)}/posts/${encodeURIComponent(slug)}`));
+    // 워크스페이스 도구는 별도 catalog에서 등록해 서버 시작 안내와 테스트 목록을 일치시킨다.
+    registerWorkspaceTools(registry, webBaseUrl);
+    return {
+        server,
+        permissions,
+        toolNames: [...registry.toolNames],
+    };
+}
+export async function runMcpServer() {
+    const created = await createOpenLogMcpServer();
+    printMcpStartupHint(created.permissions, created.toolNames);
+    await created.server.connect(new StdioServerTransport());
 }
 function normalizePostInput(input) {
     const title = input.title.trim();
@@ -205,48 +237,22 @@ function normalizeLinks(links) {
     }
     return normalized;
 }
-function createContentPreview(content) {
-    const preview = content.replace(/\s+/g, " ").trim();
-    return preview.length > 500 ? `${preview.slice(0, 497)}...` : preview;
-}
 function buildPublicPostPath(username, slug) {
     return `/@${encodeURIComponent(username)}/posts/${encodeURIComponent(slug)}`;
 }
-async function createAuthenticatedClient() {
-    const authFile = await readAuthFile();
-    if (!authFile) {
-        throw new Error("Run `openlog login` before using OpenLog MCP tools.");
-    }
-    return new OpenLogApiClient({
-        accessToken: authFile.accessToken,
-        apiBaseUrl: authFile.apiBaseUrl,
-    });
-}
-async function withAuthenticatedClient(callback) {
-    try {
-        const client = await createAuthenticatedClient();
-        const result = await callback(client);
-        return textResult(result);
+function printMcpStartupHint(permissions, toolNames) {
+    if (!process.stderr.isTTY) {
+        return;
     }
-    catch (error) {
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: error instanceof Error ? error.message : String(error),
-                },
-            ],
-            isError: true,
-        };
-    }
-}
-function textResult(value) {
-    return {
-        content: [
-            {
-                type: "text",
-                text: typeof value === "string" ? value : JSON.stringify(value, null, 2),
-            },
-        ],
-    };
+    console.error(`OpenLog MCP server is running over stdio.
+
+Profile: ${permissions.profile}
+Capabilities: ${permissions.capabilities.join(", ")}
+
+This terminal is now reserved for MCP protocol traffic.
+Press Ctrl+C to stop it.
+
+Available tools:
+${toolNames.map((name) => `  ${name}`).join("\n")}
+`);
 }

package/dist/mcp-toolkit.js

@@ -0,0 +1,115 @@
+import { hasMcpCapability, } from "./mcp-permissions.js";
+export const READ_TOOL_ANNOTATIONS = {
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: true,
+};
+export const WRITE_TOOL_ANNOTATIONS = {
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: false,
+    openWorldHint: true,
+};
+export const IDEMPOTENT_WRITE_TOOL_ANNOTATIONS = {
+    ...WRITE_TOOL_ANNOTATIONS,
+    idempotentHint: true,
+};
+export const DELETE_TOOL_ANNOTATIONS = {
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: false,
+    openWorldHint: true,
+};
+export class McpToolRegistry {
+    server;
+    permissions;
+    createAuthenticatedClient;
+    toolNames = [];
+    constructor(server, permissions, createAuthenticatedClient) {
+        this.server = server;
+        this.permissions = permissions;
+        this.createAuthenticatedClient = createAuthenticatedClient;
+    }
+    registerAuthenticated(name, capability, config, handler) {
+        // 허용되지 않은 도구는 MCP tools/list 응답에도 나타나지 않게 등록 자체를 생략한다.
+        if (!hasMcpCapability(this.permissions, capability)) {
+            return;
+        }
+        const callback = (async (args) => {
+            // 목록 노출 여부와 별개로 실행 직전에도 권한을 확인해 우회 호출을 막는다.
+            if (!hasMcpCapability(this.permissions, capability)) {
+                return permissionDeniedResult(name, capability);
+            }
+            return withAuthenticatedClient(this.createAuthenticatedClient, (client) => handler(client, args));
+        });
+        this.server.registerTool(name, config, callback);
+        this.toolNames.push(name);
+    }
+    registerLocal(name, capability, config, handler) {
+        // 인증이 필요 없는 로컬 도구도 동일한 capability 정책을 적용한다.
+        if (!hasMcpCapability(this.permissions, capability)) {
+            return;
+        }
+        const callback = (async (args) => {
+            if (!hasMcpCapability(this.permissions, capability)) {
+                return permissionDeniedResult(name, capability);
+            }
+            try {
+                return textResult(await handler(args));
+            }
+            catch (error) {
+                return errorResult(error);
+            }
+        });
+        this.server.registerTool(name, config, callback);
+        this.toolNames.push(name);
+    }
+}
+export async function withAuthenticatedClient(createAuthenticatedClient, callback) {
+    try {
+        const client = await createAuthenticatedClient();
+        return textResult(await callback(client));
+    }
+    catch (error) {
+        // API·인증 오류를 throw하지 않고 MCP 표준 isError 응답으로 정규화한다.
+        return errorResult(error);
+    }
+}
+export function textResult(value) {
+    const serialized = typeof value === "string" ? value : JSON.stringify(value, null, 2);
+    return {
+        content: [
+            {
+                type: "text",
+                text: serialized ?? "null",
+            },
+        ],
+    };
+}
+export function createContentPreview(content) {
+    const preview = content.replace(/\s+/g, " ").trim();
+    return preview.length > 500 ? `${preview.slice(0, 497)}...` : preview;
+}
+function permissionDeniedResult(name, capability) {
+    return {
+        content: [
+            {
+                type: "text",
+                text: `MCP tool ${name} requires the ${capability} capability. Change the profile with \`openlog mcp permissions set\` and restart the MCP server.`,
+            },
+        ],
+        isError: true,
+    };
+}
+function errorResult(error) {
+    return {
+        content: [
+            {
+                type: "text",
+                text: error instanceof Error ? error.message : String(error),
+            },
+        ],
+        isError: true,
+    };
+}