@latellu/atlas-mcp 1.0.4 → 1.0.6

package/README.md

@@ -69,17 +69,23 @@ atlas-mcp
 4. Copy the key — it is only shown once
 
 **Key types:**
-- `atlas_live_*` — Read-only access (delivery API). Use for fetching content.
-- `atlas_mgmt_*` — Read-write access (management API). Use for creating/updating content.
+- `atlas_live_*` — Delivery API key. Required for every **read** tool (`get_workspace_schema`, `list_*`, `get_*`).
+- `atlas_mgmt_*` — Management API key. Required for every **write** tool (`create_*`, `update_*`, `delete_*`, `publish_*`, `unpublish_*`, `archive_*`, `duplicate_*`, `upload_media`).
+
+The backend enforces one key type per route group — a management key cannot read `/api/v1/public/*`, and a delivery key cannot write to `/api/v1/manage/*`. **For the full tool set (read + write), configure both keys.** A single key only unlocks the half of the tools matching its type; calling a tool that needs the other key type returns a clear error naming the missing env var.
 
 ### Environment Variables
 
 | Variable | Required | Description |
 |----------|----------|-------------|
-| `ATLAS_API_KEY` | Yes | Atlas API key (`atlas_live_*` for read-only, `atlas_mgmt_*` for full access) |
+| `ATLAS_API_KEY` | One of the three below | Single key, auto-detected by prefix (`atlas_live_*` enables read tools, `atlas_mgmt_*` enables write tools) — kept for backward compatibility |
+| `ATLAS_LIVE_API_KEY` | No | Delivery key (`atlas_live_*`), explicitly enables read tools |
+| `ATLAS_MGMT_API_KEY` | No | Management key (`atlas_mgmt_*`), explicitly enables write tools |
 | `ATLAS_API_URL` | No | Atlas API base URL (default: `https://api.atlas.latellu.com`) |
 | `MCP_ALLOWED_UPLOAD_PATHS` | No | Comma-separated list of allowed directories for media upload |
 
+At least one of `ATLAS_API_KEY`, `ATLAS_LIVE_API_KEY`, or `ATLAS_MGMT_API_KEY` must be set. Set `ATLAS_LIVE_API_KEY` and `ATLAS_MGMT_API_KEY` together to enable both read and write tools in the same server.
+
 ### Claude Desktop Configuration
 
 Add to `~/Library/Application Support/Claude/claude_desktop_config.json`:
@@ -91,7 +97,8 @@ Add to `~/Library/Application Support/Claude/claude_desktop_config.json`:
       "command": "npx",
       "args": ["-y", "@latellu/atlas-mcp"],
       "env": {
-        "ATLAS_API_KEY": "atlas_mgmt_xxx...",
+        "ATLAS_LIVE_API_KEY": "atlas_live_xxx...",
+        "ATLAS_MGMT_API_KEY": "atlas_mgmt_xxx...",
         "MCP_ALLOWED_UPLOAD_PATHS": "/Users/you/Documents,/Users/you/Pictures"
       }
     }
@@ -99,6 +106,8 @@ Add to `~/Library/Application Support/Claude/claude_desktop_config.json`:
 }
 ```
 
+Write-only setups (no read tools needed) can still set just `ATLAS_API_KEY` to a single `atlas_mgmt_*` key.
+
 ### Cursor Configuration
 
 Add to `.cursor/mcp.json`:
@@ -110,7 +119,8 @@ Add to `.cursor/mcp.json`:
       "command": "npx",
       "args": ["-y", "@latellu/atlas-mcp"],
       "env": {
-        "ATLAS_API_KEY": "atlas_mgmt_xxx..."
+        "ATLAS_LIVE_API_KEY": "atlas_live_xxx...",
+        "ATLAS_MGMT_API_KEY": "atlas_mgmt_xxx..."
       }
     }
   }
@@ -159,8 +169,9 @@ AI: → Calls upload_media with file_path='/Users/you/Pictures/tokyo.png'
 ### Permission Model
 
 **Layer 1: API Key**
-- `atlas_live_*` — Read-only access (delivery API)
-- `atlas_mgmt_*` — Read-write access (management API)
+- `atlas_live_*` — Read tools only (delivery API)
+- `atlas_mgmt_*` — Write tools only (management API)
+- Configure both (`ATLAS_LIVE_API_KEY` + `ATLAS_MGMT_API_KEY`) for the full tool set
 
 **Layer 2: Filesystem Permission**
 - Configurable via `MCP_ALLOWED_UPLOAD_PATHS` env var

package/dist/index.js

@@ -5,13 +5,7 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
-  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
-}) : x)(function(x) {
-  if (typeof require !== "undefined") return require.apply(this, arguments);
-  throw Error('Dynamic require of "' + x + '" is not supported');
-});
-var __commonJS = (cb, mod) => function __require2() {
+var __commonJS = (cb, mod) => function __require() {
   try {
     return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
   } catch (e) {
@@ -3231,8 +3225,8 @@ var require_utils = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path) {
-      let input = path;
+    function removeDotSegments(path2) {
+      let input = path2;
       const output = [];
       let nextSlash = -1;
       let len = 0;
@@ -3484,8 +3478,8 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path, query] = wsComponent.resourceName.split("?");
-        wsComponent.path = path && path !== "/" ? path : void 0;
+        const [path2, query] = wsComponent.resourceName.split("?");
+        wsComponent.path = path2 && path2 !== "/" ? path2 : void 0;
         wsComponent.query = query;
         wsComponent.resourceName = void 0;
       }
@@ -12536,29 +12530,70 @@ var StdioServerTransport = class {
 import { z as z2 } from "zod";
 
 // src/client.ts
+function detectMimeType(fileName) {
+  const ext = fileName.slice(fileName.lastIndexOf(".")).toLowerCase();
+  switch (ext) {
+    case ".jpg":
+    case ".jpeg":
+      return "image/jpeg";
+    case ".png":
+      return "image/png";
+    case ".gif":
+      return "image/gif";
+    case ".webp":
+      return "image/webp";
+    case ".mp4":
+      return "video/mp4";
+    case ".webm":
+      return "video/webm";
+    case ".mov":
+      return "video/quicktime";
+    case ".pdf":
+      return "application/pdf";
+    default:
+      return "application/octet-stream";
+  }
+}
 var AtlasClient = class {
   baseUrl;
-  apiKey;
-  constructor(baseUrl, apiKey) {
+  liveKey;
+  mgmtKey;
+  constructor(baseUrl, keys) {
     this.baseUrl = baseUrl;
-    this.apiKey = apiKey;
+    this.liveKey = keys.liveKey;
+    this.mgmtKey = keys.mgmtKey;
   }
-  async request(path, options) {
-    const url = `${this.baseUrl}${path}`;
+  async httpRequest(path2, apiKey, options) {
+    const url = `${this.baseUrl}${path2}`;
     const response = await fetch(url, {
       ...options,
       headers: {
         "Content-Type": "application/json",
-        "X-API-Key": this.apiKey,
+        "X-API-Key": apiKey,
         ...options?.headers
       }
     });
     return this.handleResponse(response);
   }
-  // Write requests to /api/v1/manage/* carry an Idempotency-Key so that
-  // AI-agent-driven retries don't risk double-create/double-publish.
-  async writeRequest(path, options) {
-    return this.request(path, {
+  // Reads against /api/v1/public/* require a delivery key (atlas_live_*).
+  async publicRequest(path2, options) {
+    if (!this.liveKey) {
+      throw new Error(
+        "This operation requires a delivery API key (atlas_live_*). Set ATLAS_LIVE_API_KEY (or ATLAS_API_KEY to an atlas_live_* key) to enable read operations."
+      );
+    }
+    return this.httpRequest(path2, this.liveKey, options);
+  }
+  // Writes against /api/v1/manage/* require a management key (atlas_mgmt_*)
+  // and carry an Idempotency-Key so AI-agent-driven retries don't risk
+  // double-create/double-publish.
+  async manageRequest(path2, options) {
+    if (!this.mgmtKey) {
+      throw new Error(
+        "This operation requires a management API key (atlas_mgmt_*). Set ATLAS_MGMT_API_KEY (or ATLAS_API_KEY to an atlas_mgmt_* key) to enable write operations."
+      );
+    }
+    return this.httpRequest(path2, this.mgmtKey, {
       ...options,
       headers: {
         "Idempotency-Key": crypto.randomUUID(),
@@ -12578,7 +12613,7 @@ var AtlasClient = class {
   }
   // Schema endpoints
   async getWorkspaceSchema() {
-    return this.request("/api/v1/public/schema");
+    return this.publicRequest("/api/v1/public/schema");
   }
   async listContentTypes() {
     const schema = await this.getWorkspaceSchema();
@@ -12599,45 +12634,45 @@ var AtlasClient = class {
     if (params?.page) searchParams.set("page", params.page.toString());
     if (params?.limit) searchParams.set("limit", params.limit.toString());
     if (params?.status) searchParams.set("status", params.status);
-    return this.request(`/api/v1/public/entries?${searchParams.toString()}`);
+    return this.publicRequest(`/api/v1/public/entries?${searchParams.toString()}`);
   }
   async getEntry(contentType, slug) {
-    return this.request(`/api/v1/public/entries/${slug}`);
+    return this.publicRequest(`/api/v1/public/entries/${slug}`);
   }
   async createEntry(contentType, data, slug) {
-    return this.writeRequest(`/api/v1/manage/content-types/${contentType}/entries`, {
+    return this.manageRequest(`/api/v1/manage/content-types/${contentType}/entries`, {
       method: "POST",
       body: JSON.stringify({ slug, data })
     });
   }
   async updateEntry(contentType, slug, data) {
-    return this.writeRequest(`/api/v1/manage/content-types/${contentType}/entries/${slug}`, {
+    return this.manageRequest(`/api/v1/manage/content-types/${contentType}/entries/${slug}`, {
       method: "PUT",
       body: JSON.stringify({ data })
     });
   }
   async deleteEntry(contentType, slug) {
-    return this.writeRequest(`/api/v1/manage/content-types/${contentType}/entries/${slug}`, {
+    return this.manageRequest(`/api/v1/manage/content-types/${contentType}/entries/${slug}`, {
       method: "DELETE"
     });
   }
   async publishEntry(contentType, slug) {
-    return this.writeRequest(`/api/v1/manage/content-types/${contentType}/entries/${slug}/publish`, {
+    return this.manageRequest(`/api/v1/manage/content-types/${contentType}/entries/${slug}/publish`, {
       method: "PATCH"
     });
   }
   async unpublishEntry(contentType, slug) {
-    return this.writeRequest(`/api/v1/manage/content-types/${contentType}/entries/${slug}/unpublish`, {
+    return this.manageRequest(`/api/v1/manage/content-types/${contentType}/entries/${slug}/unpublish`, {
       method: "PATCH"
     });
   }
   async archiveEntry(contentType, slug) {
-    return this.writeRequest(`/api/v1/manage/content-types/${contentType}/entries/${slug}/archive`, {
+    return this.manageRequest(`/api/v1/manage/content-types/${contentType}/entries/${slug}/archive`, {
       method: "PATCH"
     });
   }
   async duplicateEntry(contentType, slug) {
-    return this.writeRequest(`/api/v1/manage/content-types/${contentType}/entries/${slug}/duplicate`, {
+    return this.manageRequest(`/api/v1/manage/content-types/${contentType}/entries/${slug}/duplicate`, {
       method: "POST"
     });
   }
@@ -12646,53 +12681,59 @@ var AtlasClient = class {
     const searchParams = new URLSearchParams();
     if (params?.page) searchParams.set("page", params.page.toString());
     if (params?.limit) searchParams.set("limit", params.limit.toString());
-    return this.request(`/api/v1/public/pages?${searchParams.toString()}`);
+    return this.publicRequest(`/api/v1/public/pages?${searchParams.toString()}`);
   }
   async getPage(slug) {
-    return this.request(`/api/v1/public/pages/${slug}`);
+    return this.publicRequest(`/api/v1/public/pages/${slug}`);
   }
   async createPage(data) {
-    return this.writeRequest("/api/v1/manage/pages", {
+    return this.manageRequest("/api/v1/manage/pages", {
       method: "POST",
       body: JSON.stringify(data)
     });
   }
   async updatePage(slug, data) {
-    return this.writeRequest(`/api/v1/manage/pages/${slug}`, {
+    return this.manageRequest(`/api/v1/manage/pages/${slug}`, {
       method: "PUT",
       body: JSON.stringify(data)
     });
   }
   async deletePage(slug) {
-    return this.writeRequest(`/api/v1/manage/pages/${slug}`, {
+    return this.manageRequest(`/api/v1/manage/pages/${slug}`, {
       method: "DELETE"
     });
   }
   async publishPage(slug) {
-    return this.writeRequest(`/api/v1/manage/pages/${slug}/publish`, {
+    return this.manageRequest(`/api/v1/manage/pages/${slug}/publish`, {
       method: "PATCH"
     });
   }
   // Media endpoints
   async getMedia(id) {
-    return this.request(`/api/v1/public/media/${id}`);
+    return this.publicRequest(`/api/v1/public/media/${id}`);
   }
   async uploadMedia(filePath, folder, altText) {
+    if (!this.mgmtKey) {
+      throw new Error(
+        "This operation requires a management API key (atlas_mgmt_*). Set ATLAS_MGMT_API_KEY (or ATLAS_API_KEY to an atlas_mgmt_* key) to enable write operations."
+      );
+    }
     const fs = await import("fs");
-    const path = await import("path");
+    const path2 = await import("path");
     if (!fs.existsSync(filePath)) {
       throw new Error(`File not found: ${filePath}`);
     }
-    const fileName = path.basename(filePath);
+    const fileName = path2.basename(filePath);
     const fileBuffer = fs.readFileSync(filePath);
+    const mimeType = detectMimeType(fileName);
     const formData = new FormData();
-    formData.append("file", new Blob([fileBuffer]), fileName);
+    formData.append("file", new Blob([fileBuffer], { type: mimeType }), fileName);
     if (folder) formData.append("folder", folder);
     if (altText) formData.append("alt_text", altText);
     const response = await fetch(`${this.baseUrl}/api/v1/manage/media/upload`, {
       method: "POST",
       headers: {
-        "X-API-Key": this.apiKey,
+        "X-API-Key": this.mgmtKey,
         "Idempotency-Key": crypto.randomUUID()
       },
       body: formData
@@ -12702,11 +12743,11 @@ var AtlasClient = class {
 };
 
 // src/security.ts
+import path from "node:path";
 function validateFilePath(filePath, allowedPaths) {
   if (allowedPaths.length === 0) {
     return;
   }
-  const path = __require("path");
   const absPath = path.resolve(filePath);
   const isAllowed = allowedPaths.some((allowed) => {
     const absAllowed = path.resolve(allowed);
@@ -12721,13 +12762,25 @@ function validateFilePath(filePath, allowedPaths) {
 
 // src/index.ts
 var ATLAS_API_URL = process.env.ATLAS_API_URL || "https://api.atlas.latellu.com";
-var ATLAS_API_KEY = process.env.ATLAS_API_KEY;
 var MCP_ALLOWED_UPLOAD_PATHS = process.env.MCP_ALLOWED_UPLOAD_PATHS ? process.env.MCP_ALLOWED_UPLOAD_PATHS.split(",").map((p) => p.trim()) : [];
-if (!ATLAS_API_KEY) {
-  console.error("ATLAS_API_KEY environment variable is required");
+var LIVE_KEY_PREFIX = "atlas_live_";
+var MGMT_KEY_PREFIX = "atlas_mgmt_";
+function resolveKeys() {
+  const legacyCandidates = [process.env.ATLAS_LIVE_API_KEY, process.env.ATLAS_MGMT_API_KEY, process.env.ATLAS_API_KEY].filter(
+    (v) => !!v
+  );
+  const liveKey2 = process.env.ATLAS_LIVE_API_KEY ?? legacyCandidates.find((k) => k.startsWith(LIVE_KEY_PREFIX));
+  const mgmtKey2 = process.env.ATLAS_MGMT_API_KEY ?? legacyCandidates.find((k) => k.startsWith(MGMT_KEY_PREFIX));
+  return { liveKey: liveKey2, mgmtKey: mgmtKey2 };
+}
+var { liveKey, mgmtKey } = resolveKeys();
+if (!liveKey && !mgmtKey) {
+  console.error(
+    "No valid Atlas API key found. Set ATLAS_API_KEY to an atlas_live_* or atlas_mgmt_* key, or set ATLAS_LIVE_API_KEY / ATLAS_MGMT_API_KEY explicitly (both, for full read+write access)."
+  );
   process.exit(1);
 }
-var atlasClient = new AtlasClient(ATLAS_API_URL, ATLAS_API_KEY);
+var atlasClient = new AtlasClient(ATLAS_API_URL, { liveKey, mgmtKey });
 var server = new McpServer({
   name: "atlas-mcp",
   version: "1.0.0"
@@ -13260,7 +13313,9 @@ server.tool(
 async function main() {
   const transport = new StdioServerTransport();
   await server.connect(transport);
-  console.error("Atlas MCP server started");
+  console.error(
+    `Atlas MCP server started (read tools: ${liveKey ? "enabled" : "disabled, needs atlas_live_*"}, write tools: ${mgmtKey ? "enabled" : "disabled, needs atlas_mgmt_*"})`
+  );
 }
 main().catch((error) => {
   console.error("Fatal error:", error);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@latellu/atlas-mcp",
-  "version": "1.0.4",
+  "version": "1.0.6",
   "publishConfig": {
     "access": "public"
   },