@lucern/mcp 0.3.0-alpha.17 → 0.3.0-alpha.2

package/README.md

@@ -6,24 +6,21 @@ Standalone MCP server for Lucern's reasoning runtime.
 
 - Distribution target: private/internal registry
 - License: UNLICENSED
-- Expected auth: a Lucern local profile from `lucern auth login`, or `LUCERN_API_KEY`
+- Expected auth: `LUCERN_API_KEY` machine credential
   - Canonical hosted/remote auth: service principal bearer token (`lk_...` / `lsk_...`)
   - Compatibility auth: tenant API key (`luc_...` / `stk_...`)
 
 ## Run
 
 ```bash
-lucern auth login
-npx @lucern/mcp
+npx @lucern/mcp --api-key lk_... --base-url https://your-lucern-host
 ```
 
 Env vars:
 
-- `LUCERN_API_KEY` (machine auth)
-- `LUCERN_USER_TOKEN` or `LUCERN_SESSION_TOKEN` (user auth)
+- `LUCERN_API_KEY` (required)
 - `LUCERN_BASE_URL` (optional)
-- `LUCERN_PROFILE` (optional)
-- `LUCERN_TOPIC_ID` (optional)
+- `LUCERN_PROJECT_ID` (optional)
 - `LUCERN_MCP_TRANSPORT` (`stdio` or `http`, default: `stdio`)
 - `LUCERN_MCP_HOST` (HTTP only, default: `127.0.0.1`)
 - `LUCERN_MCP_PORT` (HTTP only, default: `8080`)
@@ -53,10 +50,6 @@ Auth behavior:
 - If `--api-key` is provided, the server uses that credential for all upstream Lucern API calls.
 - Otherwise (default), the server accepts inbound `Authorization: Bearer lk_/lsk_...` service principal tokens plus `x-lucern-key` or `Authorization: Bearer luc_/stk_...` tenant API keys and forwards them upstream.
 - If `--server-auth-token` is provided, incoming requests must include `Authorization: Bearer <token>` or `x-lucern-mcp-token: <token>`.
-- MCP does not fetch Master Control deploy keys or run its own Permit checks.
-  It is a client of the same `api.lucern.ai` gateway as the CLI and SDK. The
-  gateway resolves the caller, tenant, workspace, and deployment through Master
-  Control, then enforces Permit before executing generated surface calls.
 
 Canonical hosted endpoint:
 
@@ -85,8 +78,7 @@ This package is the **external package MCP** surface (`packages/mcp`) intended f
 
 It is intentionally separate from the **internal Convex MCP** runtime under `convex/mcp/*` used by StackOS internals.
 
-See `docs/reference/mcp-event-packages.md` for package-boundary details and
-`docs/reference/mcp.md` for the generated callable MCP inventory.
+See `docs/lucern-replatform/api/mcp-surface-separation.md` for boundary details.
 
 ## Claude Code config
 
@@ -97,17 +89,15 @@ See `docs/reference/mcp-event-packages.md` for package-boundary details and
       "command": "npx",
       "args": ["@lucern/mcp"],
       "env": {
-        "LUCERN_PROFILE": "default"
+        "LUCERN_API_KEY": "lk_...",
+        "LUCERN_BASE_URL": "https://your-lucern-host",
+        "LUCERN_PROJECT_ID": "project_123"
       }
     }
   }
 }
 ```
 
-Run `lucern auth login` first. The MCP process loads `~/.lucern/profiles.json`
-and `~/.lucern/credentials`, so CLI and MCP share the same user-level auth
-without copying tokens into every client config.
-
 ## Exports
 
 - `createLucernStandaloneMcpServer`

package/bin/lucern-mcp.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { runLucernMcpCli } from "../dist/cli.js";
+import { runLucernMcpCli } from "../dist/lib/platform/mcp/cli.js";
 
 runLucernMcpCli().catch((error) => {
   console.error(

package/dist/gateway.d.ts

@@ -1,6 +1,4 @@
 import { GatewayAuthContext } from '@lucern/contracts';
-import { ConvexHttpClient } from 'convex/browser';
-import { Permit } from 'permitio';
 
 declare function handleBeliefCreate(args: {
     authContext: GatewayAuthContext;
@@ -326,33 +324,6 @@ declare function handleGraphNeighborhood(args: {
         maxDepth?: number;
     };
 }): Promise<Response>;
-declare function handleGraphNodeList(args: {
-    authContext: GatewayAuthContext;
-    correlationId: string;
-    policyTraceId: string;
-    query: {
-        nodeId?: string;
-        globalId?: string;
-        topicId?: string;
-        projectId?: string;
-        nodeType?: string;
-        limit?: number;
-    };
-}): Promise<Response>;
-declare function handleGraphEdgeList(args: {
-    authContext: GatewayAuthContext;
-    correlationId: string;
-    policyTraceId: string;
-    query: {
-        edgeId?: string;
-        topicId?: string;
-        projectId?: string;
-        fromNodeId?: string;
-        toNodeId?: string;
-        edgeType?: string;
-        limit?: number;
-    };
-}): Promise<Response>;
 declare function handleGraphTraverse(args: {
     authContext: GatewayAuthContext;
     correlationId: string;
@@ -395,101 +366,6 @@ declare function handleGraphFalsify(args: {
     body: unknown;
 }): Promise<Response>;
 
-type QueryRecord = Record<string, unknown>;
-declare function handleGraphAnalysisSave(args: {
-    authContext: GatewayAuthContext;
-    correlationId: string;
-    policyTraceId: string;
-    body: unknown;
-}): Promise<Response>;
-declare function handleGraphAnalysisList(args: {
-    authContext: GatewayAuthContext;
-    correlationId: string;
-    policyTraceId: string;
-    query: QueryRecord;
-}): Promise<Response>;
-declare function handleGraphAnalysisLatest(args: {
-    authContext: GatewayAuthContext;
-    correlationId: string;
-    policyTraceId: string;
-    query: QueryRecord;
-}): Promise<Response>;
-declare function handleGraphAnalysisSaveSuggestions(args: {
-    authContext: GatewayAuthContext;
-    correlationId: string;
-    policyTraceId: string;
-    body: unknown;
-}): Promise<Response>;
-declare function handleGraphAnalysisListSuggestions(args: {
-    authContext: GatewayAuthContext;
-    correlationId: string;
-    policyTraceId: string;
-    query: QueryRecord;
-}): Promise<Response>;
-declare function handleGraphAnalysisListChanges(args: {
-    authContext: GatewayAuthContext;
-    correlationId: string;
-    policyTraceId: string;
-    query: QueryRecord;
-}): Promise<Response>;
-declare function handleGraphAnalysisUpdateSuggestion(args: {
-    authContext: GatewayAuthContext;
-    correlationId: string;
-    policyTraceId: string;
-    suggestionId: string;
-    body: unknown;
-}): Promise<Response>;
-declare function handleGraphAnalysisCompute(args: {
-    authContext: GatewayAuthContext;
-    correlationId: string;
-    policyTraceId: string;
-    body: unknown;
-}): Promise<Response>;
-declare function handleGraphRecommendationsList(args: {
-    authContext: GatewayAuthContext;
-    correlationId: string;
-    policyTraceId: string;
-    query: QueryRecord;
-}): Promise<Response>;
-declare function handleGraphRecommendationGet(args: {
-    authContext: GatewayAuthContext;
-    correlationId: string;
-    policyTraceId: string;
-    recommendationId: string;
-}): Promise<Response>;
-declare function handleGraphRecommendationStatus(args: {
-    authContext: GatewayAuthContext;
-    correlationId: string;
-    policyTraceId: string;
-    recommendationId: string;
-    body: unknown;
-}): Promise<Response>;
-declare function handleOrgGraphSearch(args: {
-    authContext: GatewayAuthContext;
-    correlationId: string;
-    policyTraceId: string;
-    body: unknown;
-}): Promise<Response>;
-declare function handleOrgGraphNodeGet(args: {
-    authContext: GatewayAuthContext;
-    correlationId: string;
-    policyTraceId: string;
-    nodeId: string;
-    query: QueryRecord;
-}): Promise<Response>;
-declare function handleOrgGraphByProvenance(args: {
-    authContext: GatewayAuthContext;
-    correlationId: string;
-    policyTraceId: string;
-    query: QueryRecord;
-}): Promise<Response>;
-declare function handleOrgGraphPublished(args: {
-    authContext: GatewayAuthContext;
-    correlationId: string;
-    policyTraceId: string;
-    query: QueryRecord;
-}): Promise<Response>;
-
 declare function handleIdentityWhoami(args: {
     authContext: GatewayAuthContext;
     correlationId: string;
@@ -526,33 +402,6 @@ declare function handleOntologyMatch(args: {
     body: unknown;
 }): Promise<Response>;
 
-type PermitWebhookEnv = Record<string, string | undefined>;
-type PermitProjectionClient = Pick<ConvexHttpClient, "action">;
-declare function isPermitWebhookAuthorized(args: {
-    headers: Headers;
-    env?: PermitWebhookEnv;
-}): boolean;
-declare function extractPermitWebhookTenantKeys(body: unknown): string[];
-declare function hasPermitWebhookTenantScope(body: unknown): boolean;
-declare function handlePermitProjectionWebhook(args: {
-    request: Request;
-    body: unknown;
-    correlationId: string;
-    policyTraceId: string;
-    convexClient?: PermitProjectionClient;
-}): Promise<Response>;
-
-type ClerkWebhookClient = Pick<ConvexHttpClient, "query" | "mutation">;
-declare const __testOnly: {
-    setPermitClientFactory(factory: (() => Permit) | null): void;
-};
-declare function handleClerkWebhook(args: {
-    request: Request;
-    correlationId: string;
-    policyTraceId: string;
-    convexClient?: ClerkWebhookClient;
-}): Promise<Response>;
-
 declare function handleQuestionCreate(args: {
     authContext: GatewayAuthContext;
     correlationId: string;
@@ -930,4 +779,4 @@ declare function handleWorktreeBulkCreate(args: {
     body: unknown;
 }): Promise<Response>;
 
-export { __testOnly, extractPermitWebhookTenantKeys, handleBeliefArchive, handleBeliefBatchUpdateCriticality, handleBeliefBisect, handleBeliefConfidenceHistory, handleBeliefCreate, handleBeliefCreateContract, handleBeliefFork, handleBeliefGet, handleBeliefLineage, handleBeliefLink, handleBeliefList, handleBeliefReassignTopic, handleBeliefRefine, handleBeliefRelationships, handleBeliefUnlinkEvidence, handleBeliefUpdateConfidence, handleBeliefUpdateCriticality, handleBeliefUpdateRationale, handleBeliefUpdateStatus, handleClerkWebhook, handleContradictionFlag, handleContradictionGet, handleContradictionList, handleEdgeBatchCreate, handleEdgeCreate, handleEdgeDelete, handleEdgeList, handleEdgeRemove, handleEdgeTraverse, handleEdgeUpdate, handleEdgesRemoveBetween, handleEventsList, handleEventsReplay, handleEvidenceClassify, handleEvidenceClassifyBatch, handleEvidenceCreate, handleEvidenceFlagIncorrect, handleEvidenceGet, handleEvidenceLink, handleEvidenceList, handleEvidenceRemove, handleEvidenceSearch, handleEvidenceUpdate, handleEvidenceUpdateStatus, handleEvidenceUpdateVerificationStatus, handleGraphAnalysisCompute, handleGraphAnalysisLatest, handleGraphAnalysisList, handleGraphAnalysisListChanges, handleGraphAnalysisListSuggestions, handleGraphAnalysisSave, handleGraphAnalysisSaveSuggestions, handleGraphAnalysisUpdateSuggestion, handleGraphAnalyze, handleGraphBias, handleGraphEdgeList, handleGraphFalsify, handleGraphGaps, handleGraphNeighborhood, handleGraphNodeList, handleGraphRecommendationGet, handleGraphRecommendationStatus, handleGraphRecommendationsList, handleGraphTraverse, handleIdentityWhoami, handleOntologyBind, handleOntologyGet, handleOntologyList, handleOntologyMatch, handleOrgGraphByProvenance, handleOrgGraphNodeGet, handleOrgGraphPublished, handleOrgGraphSearch, handlePermitProjectionWebhook, handleQuestionAdd, handleQuestionAdvanceToConviction, handleQuestionAnswer, handleQuestionArchive, handleQuestionBatchCreate, handleQuestionCreate, handleQuestionDelete, handleQuestionFinalizeConviction, handleQuestionGet, handleQuestionGetAnswer, handleQuestionList, handleQuestionRefine, handleQuestionUpdate, handleQuestionUpdateConviction, handleQuestionUpdatePriority, handleQuestionUpdateStatus, handleSearchResources, handleSourceGet, handleSourceUpsert, handleTaskComplete, handleTaskCreate, handleTaskList, handleTaskUpdate, handleTopicBulkCreate, handleTopicCoverage, handleTopicCreate, handleTopicGet, handleTopicList, handleTopicRemove, handleTopicTree, handleTopicUpdate, handleWebhookCreate, handleWebhookDelete, handleWebhookDeliveries, handleWebhookGet, handleWebhookHealth, handleWebhookList, handleWebhookTest, handleWebhookUpdate, handleWorktreeActivate, handleWorktreeAdvancePhase, handleWorktreeBulkCreate, handleWorktreeComplete, handleWorktreeCreate, handleWorktreeList, handleWorktreeListAll, handleWorktreeListCampaigns, handleWorktreeMerge, handleWorktreePatchState, handleWorktreeSetPhase, handleWorktreeUpdate, handleWorktreeUpdateTargets, hasPermitWebhookTenantScope, isPermitWebhookAuthorized };
+export { handleBeliefArchive, handleBeliefBatchUpdateCriticality, handleBeliefBisect, handleBeliefConfidenceHistory, handleBeliefCreate, handleBeliefCreateContract, handleBeliefFork, handleBeliefGet, handleBeliefLineage, handleBeliefLink, handleBeliefList, handleBeliefReassignTopic, handleBeliefRefine, handleBeliefRelationships, handleBeliefUnlinkEvidence, handleBeliefUpdateConfidence, handleBeliefUpdateCriticality, handleBeliefUpdateRationale, handleBeliefUpdateStatus, handleContradictionFlag, handleContradictionGet, handleContradictionList, handleEdgeBatchCreate, handleEdgeCreate, handleEdgeDelete, handleEdgeList, handleEdgeRemove, handleEdgeTraverse, handleEdgeUpdate, handleEdgesRemoveBetween, handleEventsList, handleEventsReplay, handleEvidenceClassify, handleEvidenceClassifyBatch, handleEvidenceCreate, handleEvidenceFlagIncorrect, handleEvidenceGet, handleEvidenceLink, handleEvidenceList, handleEvidenceRemove, handleEvidenceSearch, handleEvidenceUpdate, handleEvidenceUpdateStatus, handleEvidenceUpdateVerificationStatus, handleGraphAnalyze, handleGraphBias, handleGraphFalsify, handleGraphGaps, handleGraphNeighborhood, handleGraphTraverse, handleIdentityWhoami, handleOntologyBind, handleOntologyGet, handleOntologyList, handleOntologyMatch, handleQuestionAdd, handleQuestionAdvanceToConviction, handleQuestionAnswer, handleQuestionArchive, handleQuestionBatchCreate, handleQuestionCreate, handleQuestionDelete, handleQuestionFinalizeConviction, handleQuestionGet, handleQuestionGetAnswer, handleQuestionList, handleQuestionRefine, handleQuestionUpdate, handleQuestionUpdateConviction, handleQuestionUpdatePriority, handleQuestionUpdateStatus, handleSearchResources, handleSourceGet, handleSourceUpsert, handleTaskComplete, handleTaskCreate, handleTaskList, handleTaskUpdate, handleTopicBulkCreate, handleTopicCoverage, handleTopicCreate, handleTopicGet, handleTopicList, handleTopicRemove, handleTopicTree, handleTopicUpdate, handleWebhookCreate, handleWebhookDelete, handleWebhookDeliveries, handleWebhookGet, handleWebhookHealth, handleWebhookList, handleWebhookTest, handleWebhookUpdate, handleWorktreeActivate, handleWorktreeAdvancePhase, handleWorktreeBulkCreate, handleWorktreeComplete, handleWorktreeCreate, handleWorktreeList, handleWorktreeListAll, handleWorktreeListCampaigns, handleWorktreeMerge, handleWorktreePatchState, handleWorktreeSetPhase, handleWorktreeUpdate, handleWorktreeUpdateTargets };