@lightsage/mcp 0.4.14 → 0.4.15

package/README.md

@@ -33,9 +33,9 @@ Lightsage Public API: Public API for Lightsage CLI and external integrations.
 <details>
 <summary>Claude Desktop</summary>
 
-Install the MCP server as a Desktop Extension using the pre-built [`mcp-server.mcpb`](https://github.com/lightsagehq/mcp/releases/download/v0.4.14/mcp-server.mcpb) file:
+Install the MCP server as a Desktop Extension using the pre-built [`mcp-server.mcpb`](https://github.com/lightsagehq/mcp/releases/download/v0.4.15/mcp-server.mcpb) file:
 
-Simply drag and drop the [`mcp-server.mcpb`](https://github.com/lightsagehq/mcp/releases/download/v0.4.14/mcp-server.mcpb) file onto Claude Desktop to install the extension.
+Simply drag and drop the [`mcp-server.mcpb`](https://github.com/lightsagehq/mcp/releases/download/v0.4.15/mcp-server.mcpb) file onto Claude Desktop to install the extension.
 
 The MCP bundle package includes the MCP server and all necessary configuration. Once installed, the server will be available without additional setup.
 

package/api/mcp.js

@@ -6,8 +6,10 @@ import {
   oauthEnabled,
   verifyOAuthToken,
   wwwAuthenticateHeader,
-  exchangeForLightsageKey,
+  exchangeForLightsageIdentity,
+  exchangeFailureResponse,
 } from "../lib/oauth.js";
+import { registerProfileTool } from "../lib/profile.js";
 
 const logLevel = process.env.MCP_LOG_LEVEL || "info";
 const logger = createConsoleLogger(logLevel);
@@ -99,10 +101,11 @@ export default async function handler(req, res) {
   // A caller-supplied Lightsage API key remains a first-class authentication
   // path when OAuth is enabled. If no key is present, verify the Clerk OAuth
   // access token and exchange that identity for a Lightsage public-API key.
+  let profile = null;
   if (useOAuth && !requestApiKey) {
     let auth;
     try {
-      auth = await verifyOAuthToken(req);
+      auth = await verifyOAuthToken(req, logger);
     } catch (error) {
       logger.error("OAuth token verification error", {
         error: error instanceof Error ? error.message : String(error),
@@ -117,13 +120,21 @@ export default async function handler(req, res) {
     }
 
     try {
-      const apiKey = await exchangeForLightsageKey(auth.userId, auth.clientId);
-      headers.set("lightsage-api-key-auth", apiKey);
+      const identity = await exchangeForLightsageIdentity(
+        auth.userId,
+        auth.clientId,
+      );
+      headers.set("lightsage-api-key-auth", identity.apiKey);
+      profile = identity.profile;
     } catch (error) {
       logger.error("Lightsage key exchange failed", {
         error: error instanceof Error ? error.message : String(error),
       });
-      res.status(502).json({ error: "key_exchange_failed" });
+      const failure = exchangeFailureResponse(req, error);
+      for (const [name, value] of Object.entries(failure.headers)) {
+        res.setHeader(name, value);
+      }
+      res.status(failure.status).json(failure.body);
       return;
     }
   }
@@ -146,6 +157,11 @@ export default async function handler(req, res) {
     getSDK: () => buildSDK(headers, flags, disableStaticAuth, logger),
   });
 
+  // Only an OAuth connection has a profile; API-key callers skip the tool.
+  if (profile) {
+    registerProfileTool(mcpServer, profile);
+  }
+
   mcpServer.server.onerror = (error) => {
     logger.error("MCP protocol error", {
       error: error instanceof Error ? error.message : String(error),