@kynver-app/mcp-agent-os 0.3.46 → 0.3.49

package/dist/lib/mcp-sse-server.js

@@ -4,7 +4,7 @@ import { createServer } from "node:http";
 import { timingSafeEqual } from "node:crypto";
 import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
 export const MAX_SSE_BODY_BYTES = 1 * 1024 * 1024;
-const FORBIDDEN_QUERY_KEYS = ["secret", "userId"];
+const FORBIDDEN_QUERY_KEYS = ["apiKey", "secret", "userId"];
 export function headerValue(req, name) {
     const v = req.headers[name];
     return typeof v === "string" ? v : Array.isArray(v) ? (v[0] ?? null) : null;
@@ -19,9 +19,6 @@ export function timingSafeEqualString(a, b) {
 export function hasForbiddenQueryAuth(url) {
     return FORBIDDEN_QUERY_KEYS.some((key) => url.searchParams.has(key));
 }
-function queryApiKey(url) {
-    return url.searchParams.get("apiKey")?.trim() ?? "";
-}
 export function resolveListenHost() {
     const configured = process.env.MCP_SSE_HOST?.trim();
     return configured || "127.0.0.1";
@@ -130,7 +127,7 @@ function resolveInternalAuth(req, serviceSecret) {
 }
 function verifyPostAuth(req, url, sessionAuth, serviceSecret) {
     if (sessionAuth.kind === "apiKey") {
-        const token = bearerToken(req) || queryApiKey(url);
+        const token = bearerToken(req);
         return token.length > 0 && timingSafeEqualString(token, sessionAuth.apiKey);
     }
     const internal = resolveInternalAuth(req, serviceSecret);
@@ -170,7 +167,6 @@ export function startKynverMcpSseServer(options) {
     const maxSessionsPerUser = intFromEnv("MCP_SSE_MAX_SESSIONS_PER_USER", 20);
     const idleTimeoutMs = intFromEnv("MCP_SSE_IDLE_TIMEOUT_MS", 5 * 60 * 1000);
     const rateLimitPerMin = intFromEnv("MCP_SSE_RATE_LIMIT_PER_MIN", 120);
-    const rejectQueryApiKey = /^(1|true|yes)$/i.test(process.env.MCP_SSE_REJECT_QUERY_APIKEY ?? "");
     const rateLimiter = createFixedWindowRateLimiter(rateLimitPerMin, 60 * 1000);
     // Close idle SSE sessions so a flood of half-open connections can't pin memory.
     const idleSweep = setInterval(() => {
@@ -198,15 +194,6 @@ export function startKynverMcpSseServer(options) {
                 });
                 return;
             }
-            if (url.searchParams.has("apiKey")) {
-                if (rejectQueryApiKey) {
-                    json(res, 400, {
-                        error: "apiKey via query param is disabled. Use Authorization: Bearer <key>.",
-                    });
-                    return;
-                }
-                console.warn("[MCP SSE] WARNING: apiKey in query string may leak via logs. Prefer Authorization header when your client supports it.");
-            }
             let userId = null;
             let auth = null;
             const internal = serviceSecret ? resolveInternalAuth(req, serviceSecret) : null;
@@ -215,7 +202,7 @@ export function startKynverMcpSseServer(options) {
                 auth = internal.auth;
             }
             else {
-                const apiKey = bearerToken(req) || queryApiKey(url);
+                const apiKey = bearerToken(req);
                 if (apiKey) {
                     userId = await resolveUserFromApiKey(baseUrl, apiKey);
                     if (userId)

package/dist/server.js

@@ -11,6 +11,7 @@ import { z } from "zod";
 import { get, post, patch } from "./lib/kynver-client.js";
 import { registerPlanTools } from "./tools/plans.js";
 import { registerPlanProgressTools } from "./tools/plan-progress.js";
+import { registerPlanToFactoryTools } from "./tools/plan-to-factory.js";
 import { registerTaskTools } from "./tools/tasks.js";
 import { registerActionRequiredTools } from "./tools/action-required.js";
 import { registerGraphTools } from "./tools/graph.js";
@@ -26,6 +27,9 @@ import { registerSkillsTools } from "./tools/skills.js";
 import { registerMemoryLedgerTools } from "./tools/memory-ledger.js";
 import { registerMemoryVaultTools } from "./tools/memory-vault.js";
 import { registerMonitorTools } from "./tools/monitor.js";
+import { registerMacroControlsTools } from "./tools/macro-controls.js";
+import { registerKariAdMarketingLoopTools } from "./tools/kariad-marketing-loop.js";
+import { registerKariAdOutcomeImportTools } from "./tools/kariad-outcome-import.js";
 import { readOwnPackageVersion } from "./lib/package-version.js";
 const PACKAGE_VERSION = readOwnPackageVersion(import.meta.url);
 function jsonResult(data) {
@@ -709,6 +713,7 @@ export function createAgentOsServer() {
     // First-class AgentOS plans (Phase 5A): versioned operational artifacts.
     registerPlanTools({ register, resolveToolSlug, jsonResult, compact });
     registerPlanProgressTools({ register, resolveToolSlug, jsonResult, compact });
+    registerPlanToFactoryTools({ register, resolveToolSlug, jsonResult, compact });
     // Action Required inbox: agent_os_ask_human + agent_os_await_action (slice 1).
     registerActionRequiredTools({ register, jsonResult, compact });
     // Operational graph insights — Agent SEE (agent_os_graph_query).
@@ -734,5 +739,9 @@ export function createAgentOsServer() {
     registerMemoryLedgerTools({ register, resolveToolSlug, jsonResult });
     registerMemoryVaultTools({ register, resolveToolSlug, jsonResult });
     registerMonitorTools({ register, resolveToolSlug, jsonResult });
+    registerMacroControlsTools({ register, resolveToolSlug, jsonResult });
+    registerKariAdMarketingLoopTools({ register, resolveToolSlug, jsonResult });
+    // KariAd marketing loop — M6 outcome import (analytics feedback + memory learning).
+    registerKariAdOutcomeImportTools({ register, resolveToolSlug, jsonResult });
     return server;
 }

package/dist/tools/kariad-marketing-loop.d.ts

@@ -0,0 +1,21 @@
+/**
+ * KariAd campaign brief MCP tool (M4).
+ *
+ * agent_os_kariad_campaign_brief_create — fuse macro trends, Kynver goals,
+ * and KariAd deep memory into a cited RuntimeCampaignBrief.
+ * Does not publish or spend.
+ */
+type ToolResult = {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    structuredContent?: unknown;
+};
+export interface KariAdMarketingLoopToolDeps {
+    register: (name: string, description: string, inputSchema: Record<string, unknown>, cb: (args: any) => any) => void;
+    resolveToolSlug: (explicitSlug?: string) => Promise<string>;
+    jsonResult: (data: unknown) => ToolResult;
+}
+export declare function registerKariAdMarketingLoopTools({ register, resolveToolSlug, jsonResult, }: KariAdMarketingLoopToolDeps): void;
+export {};

package/dist/tools/kariad-marketing-loop.js

@@ -0,0 +1,41 @@
+/**
+ * KariAd campaign brief MCP tool (M4).
+ *
+ * agent_os_kariad_campaign_brief_create — fuse macro trends, Kynver goals,
+ * and KariAd deep memory into a cited RuntimeCampaignBrief.
+ * Does not publish or spend.
+ */
+import { z } from "zod";
+import { post } from "../lib/kynver-client.js";
+const slugField = z
+    .string()
+    .optional()
+    .describe("AgentOS slug. Defaults to env/primary AgentOS.");
+export function registerKariAdMarketingLoopTools({ register, resolveToolSlug, jsonResult, }) {
+    register("agent_os_kariad_campaign_brief_create", [
+        "Create a compact, cited RuntimeCampaignBrief by combining on-demand macro/social trend signals,",
+        "Kynver marketplace/runtime goals, and KariAd deep brand memory.",
+        "Returns content angles with source links, target audiences, selected brand/workspace, risk labels,",
+        "and recommended next KariAd actions.",
+        "Does NOT publish, schedule, or spend — approval is always required before KariAd execution tools (M5).",
+        "Call agent_os_macro_controls_get first when trend awareness matters for the marketing task.",
+    ].join(" "), {
+        slug: slugField,
+        workspaceId: z.string().describe("KariAd workspace id (from kari_whoami / connection preflight)."),
+        brandId: z.string().describe("KariAd brand id for voice, audience, and calendar context."),
+        brandName: z.string().optional().describe("Optional display name when brand id is known."),
+        goalStatement: z
+            .string()
+            .optional()
+            .describe("Campaign goal override. When omitted, inferred from active Kynver goals/projects."),
+    }, async (args) => {
+        const s = await resolveToolSlug(args.slug);
+        const payload = await post(`/agent-os/${encodeURIComponent(s)}/kariad-marketing-loop/briefs`, {
+            workspaceId: args.workspaceId,
+            brandId: args.brandId,
+            ...(args.brandName ? { brandName: args.brandName } : {}),
+            ...(args.goalStatement ? { goalStatement: args.goalStatement } : {}),
+        });
+        return jsonResult(payload);
+    });
+}

package/dist/tools/kariad-outcome-import.d.ts

@@ -0,0 +1,17 @@
+/**
+ * M6 outcome import MCP tool — agent_os_kariad_outcome_import
+ */
+type ToolResult = {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    structuredContent?: unknown;
+};
+export interface KariAdOutcomeImportToolDeps {
+    register: (name: string, description: string, inputSchema: Record<string, unknown>, cb: (args: any) => any) => void;
+    resolveToolSlug: (explicitSlug?: string) => Promise<string>;
+    jsonResult: (data: unknown) => ToolResult;
+}
+export declare function registerKariAdOutcomeImportTools({ register, resolveToolSlug, jsonResult, }: KariAdOutcomeImportToolDeps): void;
+export {};

package/dist/tools/kariad-outcome-import.js

@@ -0,0 +1,37 @@
+/**
+ * M6 outcome import MCP tool — agent_os_kariad_outcome_import
+ */
+import { z } from "zod";
+import { post } from "../lib/kynver-client.js";
+const slugField = z
+    .string()
+    .optional()
+    .describe("AgentOS slug. Defaults to env/primary AgentOS.");
+export function registerKariAdOutcomeImportTools({ register, resolveToolSlug, jsonResult, }) {
+    register("agent_os_kariad_outcome_import", [
+        "Import KariAd campaign outcome summaries and produce separate KariAd vs Kynver memory proposals",
+        "with correct ownership, provider-quality metrics, and duplicate suppression.",
+        "Set writeback=true to route cleared proposals to KariAd submit_memory_proposal and Kynver MARM.",
+        "Requires planId + briefId from the marketing loop execution window.",
+    ].join(" "), {
+        slug: slugField,
+        workspaceId: z.string().describe("KariAd workspace id."),
+        brandId: z.string().describe("KariAd brand id."),
+        planId: z.string().describe("KariAd execution plan id for attribution."),
+        briefId: z.string().describe("Runtime campaign brief id for attribution."),
+        writeback: z
+            .boolean()
+            .optional()
+            .describe("When true, persist proposals to KariAd/Kynver. Default dry-run."),
+    }, async (args) => {
+        const s = await resolveToolSlug(args.slug);
+        const payload = await post(`/agent-os/${encodeURIComponent(s)}/kariad-marketing-loop/outcomes/import`, {
+            workspaceId: args.workspaceId,
+            brandId: args.brandId,
+            planId: args.planId,
+            briefId: args.briefId,
+            writeback: args.writeback === true,
+        });
+        return jsonResult(payload);
+    });
+}

package/dist/tools/macro-controls.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Macro/social trend on-demand catch-up MCP tool.
+ *
+ * Runtime agents call agent_os_macro_controls_get before producing social media
+ * posts, ad copy, campaign briefs, launch announcements, or any trend-sensitive
+ * marketing content so they can adapt angle and tone to current signals.
+ *
+ * Read-only. Backed by GET /api/agent-os/{slug}/macro-controls.
+ */
+type ToolResult = {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    structuredContent?: unknown;
+};
+export interface MacroControlsToolDeps {
+    register: (name: string, description: string, inputSchema: Record<string, unknown>, cb: (args: any) => any) => void;
+    resolveToolSlug: (explicitSlug?: string) => Promise<string>;
+    jsonResult: (data: unknown) => ToolResult;
+}
+export declare function registerMacroControlsTools({ register, resolveToolSlug, jsonResult, }: MacroControlsToolDeps): void;
+export {};

package/dist/tools/macro-controls.js

@@ -0,0 +1,54 @@
+/**
+ * Macro/social trend on-demand catch-up MCP tool.
+ *
+ * Runtime agents call agent_os_macro_controls_get before producing social media
+ * posts, ad copy, campaign briefs, launch announcements, or any trend-sensitive
+ * marketing content so they can adapt angle and tone to current signals.
+ *
+ * Read-only. Backed by GET /api/agent-os/{slug}/macro-controls.
+ */
+import { z } from "zod";
+import { get } from "../lib/kynver-client.js";
+const slugField = z
+    .string()
+    .optional()
+    .describe("AgentOS slug. Defaults to env/primary AgentOS.");
+export function registerMacroControlsTools({ register, resolveToolSlug, jsonResult, }) {
+    register("agent_os_macro_controls_get", [
+        "Fetch the current macro/social trend snapshot so you can adapt marketing content to active signals.",
+        "",
+        "WHEN TO CALL: before generating social media posts, ad copy, campaign briefs, launch announcements,",
+        "trend-reactive content, or any marketing material where current events could affect brand perception.",
+        "This is an on-demand catch-up step — call it at the START of social/content/marketing work, not on",
+        "every message.",
+        "",
+        "WHAT YOU GET: a compact MacroControlSnapshot with active MacroTrendSignals (topic, sensitivity,",
+        "summary, confidence, sourceLinks), a globalSensitivity aggregate ('safe'|'cautious'|'sensitive'|'blocked'),",
+        "isStale flag, and agentGuidance text you should incorporate into your content plan.",
+        "",
+        "GATING RULES:",
+        "- globalSensitivity='blocked': do NOT publish related content — surface the blocked topics to the",
+        "  operator and wait for explicit approval before proceeding.",
+        "- globalSensitivity='sensitive': draft with extra care, avoid direct references to flagged topics,",
+        "  prefer evergreen angles, and flag for human review before posting.",
+        "- globalSensitivity='cautious': note flagged topics in your plan; adjust tone but may proceed.",
+        "- globalSensitivity='safe' or isStale=true with no signals: proceed with standard brand voice.",
+        "",
+        "If isStale=true AND signals are present, treat the data as advisory only and note staleness in your",
+        "output so the operator knows to refresh. Read-only; safe for unattended invocation.",
+    ].join("\n"), {
+        slug: slugField,
+        includeSensitiveSignals: z
+            .boolean()
+            .optional()
+            .describe("When true, include 'sensitive' and 'blocked' signals in full detail. " +
+            "Default true — omit only when generating a safe-for-display summary."),
+    }, async ({ slug, includeSensitiveSignals = true, }) => {
+        const s = await resolveToolSlug(slug);
+        const snapshot = await get(`/agent-os/${encodeURIComponent(s)}/macro-controls`);
+        if (!includeSensitiveSignals && Array.isArray(snapshot.signals)) {
+            snapshot.signals = snapshot.signals.filter((sig) => sig.sensitivity === "safe" || sig.sensitivity === "cautious");
+        }
+        return jsonResult(snapshot);
+    });
+}

package/dist/tools/plan-to-factory.d.ts

@@ -0,0 +1,2 @@
+import type { PlanToolDeps } from "./plans.js";
+export declare function registerPlanToFactoryTools({ register, resolveToolSlug, jsonResult, }: PlanToolDeps): void;

package/dist/tools/plan-to-factory.js

@@ -0,0 +1,23 @@
+import { z } from "zod";
+import { post } from "../lib/kynver-client.js";
+export function registerPlanToFactoryTools({ register, resolveToolSlug, jsonResult, }) {
+    const slugField = z
+        .string()
+        .optional()
+        .describe("AgentOS workspace slug. Omit to use env or the server-discovered primary.");
+    register("agent_os_plan_run_factory", "Run a plan through the factory: decompose progress rows, mint parent + child harness tasks, wire dependencies and owned paths, and return the next runnable slice.", {
+        planId: z.string(),
+        dryRun: z.boolean().optional(),
+        command: z
+            .string()
+            .optional()
+            .describe('Operator phrase; defaults to "run this plan through the factory".'),
+        slug: slugField,
+    }, async (args) => {
+        const s = await resolveToolSlug(args.slug);
+        return jsonResult(await post(`/agent-os/${s}/plans/${args.planId}/run-factory`, {
+            dryRun: args.dryRun,
+            command: args.command,
+        }));
+    });
+}

package/dist/tools/tasks.js

@@ -147,7 +147,7 @@ export function registerTaskTools({ register, resolveToolSlug, jsonResult, compa
         scheduledFor,
         dependsOnTaskIds,
         lastSummary: z.string().optional().describe("Latest progress summary."),
-        blocker: z.string().optional(),
+        blocker: z.string().nullable().optional().describe("Blocker text, or null to clear it."),
         branch: z.string().optional(),
         worktreePath: z.string().optional(),
         prUrl: z.string().optional(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kynver-app/mcp-agent-os",
-  "version": "0.3.46",
+  "version": "0.3.49",
   "description": "Kynver Agentic OS MCP server \u2014 slug-keyed agent identity, goals, projects, sessions, and long-term memory",
   "type": "module",
   "bin": {