@loopops/mcp-server 2.0.0 → 2.0.2

package/dist/api-client.js

@@ -20,7 +20,7 @@
  *     updater helper, and also keep the latest rotated token in memory
  *     in case Claude Desktop doesn't restart before next use.
  */
-import { homedir } from "node:os";
+import { homedir, platform } from "node:os";
 import { join } from "node:path";
 import { chmodSync, existsSync, readFileSync, writeFileSync } from "node:fs";
 const apiUrl = process.env.API_URL;
@@ -153,34 +153,77 @@ function isRetryable(err) {
     return false;
 }
 /**
- * Persist a rotated refresh token back to ~/.mcp.json. Best-effort — if
- * the write fails, we still keep the new token in-memory so the current
- * subprocess keeps working. Claude Desktop's next spawn will need the
- * disk value though.
+ * OS-specific location Claude Desktop reads its config from. We have
+ * to write here in addition to ~/.mcp.json, because Claude Desktop
+ * does NOT read ~/.mcp.json on macOS (it reads Application Support
+ * instead). If we only update ~/.mcp.json + ~/.claude/settings.json,
+ * Claude Desktop falls behind after every rotation and breaks with
+ * "invalid_grant" on its next cold start.
+ */
+function claudeDesktopConfigPath() {
+    const home = homedir();
+    switch (platform()) {
+        case "darwin":
+            return join(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
+        case "win32": {
+            const appdata = process.env.APPDATA;
+            return appdata
+                ? join(appdata, "Claude", "claude_desktop_config.json")
+                : null;
+        }
+        case "linux":
+            return join(home, ".config", "Claude", "claude_desktop_config.json");
+        default:
+            return null;
+    }
+}
+/**
+ * Persist a rotated refresh token across every config location we know
+ * users store MCP settings in:
+ *   - ~/.mcp.json (CLI canonical, also legacy Claude Desktop path)
+ *   - ~/.claude/settings.json (Claude Code)
+ *   - OS-specific Claude Desktop config (macOS/Windows/Linux)
+ *
+ * We update whichever files have the loop-operations stanza. Missing
+ * files are skipped silently. This mirrors @loopops/mcp-cli's
+ * `updateRefreshToken` helper — keep the two in sync.
+ *
+ * Best-effort: if all writes fail, we still keep the new token
+ * in-memory so the current subprocess keeps working. The next cold
+ * spawn is the one that breaks.
  */
 function persistRotatedRefreshToken(newToken) {
-    try {
-        const path = join(homedir(), ".mcp.json");
-        if (!existsSync(path))
-            return;
-        const raw = readFileSync(path, "utf-8");
-        const data = JSON.parse(raw);
-        const stanza = data.mcpServers?.[SERVER_NAME];
-        if (!stanza?.env)
-            return;
-        stanza.env.OKTA_REFRESH_TOKEN = newToken;
-        writeFileSync(path, JSON.stringify(data, null, 2) + "\n");
+    const paths = [
+        join(homedir(), ".mcp.json"),
+        join(homedir(), ".claude", "settings.json"),
+    ];
+    const desktop = claudeDesktopConfigPath();
+    if (desktop)
+        paths.push(desktop);
+    for (const path of paths) {
         try {
-            chmodSync(path, 0o600);
+            if (!existsSync(path))
+                continue;
+            const raw = readFileSync(path, "utf-8");
+            const data = JSON.parse(raw);
+            const stanza = data.mcpServers?.[SERVER_NAME];
+            if (!stanza?.env)
+                continue;
+            stanza.env.OKTA_REFRESH_TOKEN = newToken;
+            writeFileSync(path, JSON.stringify(data, null, 2) + "\n");
+            try {
+                chmodSync(path, 0o600);
+            }
+            catch {
+                // ok on platforms where this is a no-op
+            }
         }
-        catch {
-            // ok on platforms where this is a no-op
+        catch (err) {
+            // Log to stderr (visible in Claude Desktop/Code logs) but don't
+            // fail the request.
+            console.error(`[MCP] Could not persist rotated refresh token to ${path}:`, err instanceof Error ? err.message : String(err));
         }
     }
-    catch (err) {
-        // Log to stderr (visible in Claude Desktop logs) but don't fail the request.
-        console.error("[MCP] Could not persist rotated refresh token to ~/.mcp.json:", err instanceof Error ? err.message : String(err));
-    }
 }
 /**
  * Mint a fresh access token via Okta's /token endpoint. Updates the

package/dist/tools/eng.js

@@ -1,6 +1,5 @@
 import { execSync } from "node:child_process";
-import { z } from "zod";
-import { trpcMutation, trpcQuery } from "../api-client.js";
+import { trpcQuery } from "../api-client.js";
 import { safeTool } from "./_helpers.js";
 import { rangeSchema } from "./_schemas.js";
 export function registerEngTools(server, allowed) {
@@ -11,25 +10,8 @@ export function registerEngTools(server, allowed) {
                 .describe("Time window. Short ranges (1h, 6h, 24h, 7d) are most useful. Default: 24h."),
         }, safeTool(async ({ range }) => trpcQuery("mcp.systemDiagnostics", { range })));
     }
-    if (allowed.has("revoke_api_key")) {
-        server.tool("revoke_api_key", "Immediately revoke every active MCP API key for a user. The user's loop_sk_* tokens in Claude Desktop stop working on the next tRPC call (401). Use for urgent access cutoff (suspected compromise, termination not yet processed in Okta). Routine offboarding should just deactivate the user in Okta — the 5-min reconciler picks that up.", {
-            email: z
-                .string()
-                .email()
-                .describe("Email of the Loop user to revoke."),
-            reason: z
-                .string()
-                .min(8)
-                .describe("Why you're revoking. Required — recorded in audit_log."),
-        }, safeTool(async ({ email, reason }) => trpcMutation("mcp.revokeApiKey", { email, reason })));
-    }
     if (allowed.has("access_review")) {
-        server.tool("access_review", "Produce a user-access snapshot for SOC/security review. Lists every Loop user with role, status, SF linkage, active/revoked key counts, and last-active date. The review itself is audited — auditors can see who produced it and when. Intended for quarterly access reviews.", {
-            includeRevoked: z
-                .boolean()
-                .optional()
-                .describe("If true, also include users whose API keys have been revoked (for full historical picture). Default: false (active access only)."),
-        }, safeTool(async ({ includeRevoked }) => trpcQuery("mcp.accessReview", { includeRevoked })));
+        server.tool("access_review", "Produce a user-access snapshot for SOC/security review. Lists every active Loop user with role, status, SF linkage, and last-active date. The review itself is audited. Intended for quarterly access reviews. For token-level detail (issued/rotated/revoked), query the Okta system log directly.", {}, safeTool(async () => trpcQuery("mcp.accessReview")));
     }
     if (allowed.has("sync_local")) {
         server.tool("sync_local", "Pull the latest changes from the remote repo into your local working tree. Runs `git pull --ff-only` in the repo at $LOOP_REPO_PATH. Use this after update_config / deploy_config writes commits directly to the remote branch so your local clone catches up.", {}, safeTool(async () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@loopops/mcp-server",
-  "version": "2.0.0",
+  "version": "2.0.2",
   "description": "Loop Operations MCP Server — AI skills for RevOps",
   "license": "UNLICENSED",
   "type": "module",