@mastra/mcp-docs-server 1.2.15-alpha.9 → 1.2.16-alpha.1

package/.docs/docs/observability/integrations/processors/sensitive-data-filter.md

@@ -1,302 +0,0 @@
-> Discover all available pages from the documentation index: https://mastra.ai/llms.txt
-
-# Sensitive data filter
-
-The Sensitive Data Filter is a span processor that redacts sensitive information from your traces during the processing pipeline before export. This ensures that passwords, API keys, tokens, and other confidential data never leave your application or get stored in observability platforms.
-
-## Default configuration
-
-The Sensitive Data Filter is included in the recommended observability configuration:
-
-```ts
-import {
-  Observability,
-  MastraStorageExporter,
-  MastraPlatformExporter,
-  SensitiveDataFilter,
-} from '@mastra/observability'
-
-export const mastra = new Mastra({
-  observability: new Observability({
-    configs: {
-      default: {
-        serviceName: 'mastra',
-        exporters: [new MastraStorageExporter(), new MastraPlatformExporter()],
-        spanOutputProcessors: [
-          new SensitiveDataFilter(), // Redacts sensitive fields before export
-        ],
-      },
-    },
-  }),
-  storage: new LibSQLStore({
-    id: 'mastra-storage',
-    url: 'file:./mastra.db',
-  }),
-})
-```
-
-With the default configuration, the filter redacts these common sensitive field names:
-
-- `password`
-- `token`
-- `secret`
-- `key`
-- `apikey`
-- `auth`
-- `authorization`
-- `bearer`
-- `bearertoken`
-- `jwt`
-- `credential`
-- `clientsecret`
-- `privatekey`
-- `refresh`
-- `ssn`
-
-> **Note:** Field matching is case-insensitive and normalizes separators. For example, `api-key`, `api_key`, and `Api Key` are all treated as `apikey`.
-
-## How it works
-
-The Sensitive Data Filter processes spans before they're sent to exporters, scanning through:
-
-- **Attributes** - Span metadata and properties
-- **Metadata** - Custom metadata attached to spans
-- **Input** - Data sent to agents, tools, and LLMs
-- **Output** - Responses and results
-- **Error Information** - Stack traces and error details
-
-When a sensitive field is detected, its value is replaced with `[REDACTED]` by default. The filter handles nested objects, arrays, and circular references safely.
-
-## Custom configuration
-
-You can customize which fields are redacted and how redaction displays:
-
-```ts
-import { SensitiveDataFilter, MastraStorageExporter, Observability } from '@mastra/observability'
-
-export const mastra = new Mastra({
-  observability: new Observability({
-    configs: {
-      production: {
-        serviceName: 'my-service',
-        exporters: [new MastraStorageExporter()],
-        spanOutputProcessors: [
-          new SensitiveDataFilter({
-            // Add custom sensitive fields
-            sensitiveFields: [
-              // Default fields
-              'password',
-              'token',
-              'secret',
-              'key',
-              'apikey',
-              // Custom fields for your application
-              'creditCard',
-              'bankAccount',
-              'routingNumber',
-              'email',
-              'phoneNumber',
-              'dateOfBirth',
-            ],
-            // Custom redaction token
-            redactionToken: '***SENSITIVE***',
-            // Redaction style
-            redactionStyle: 'full', // or 'partial'
-          }),
-        ],
-      },
-    },
-  }),
-})
-```
-
-## Redaction styles
-
-The filter supports two redaction styles:
-
-### Full Redaction (Default)
-
-Replaces the entire value with a fixed token:
-
-```jsonc
-// Before
-{
-  "apiKey": "sk-abc123xyz789def456",
-  "userId": "user_12345"
-}
-
-// After
-{
-  "apiKey": "[REDACTED]",
-  "userId": "user_12345"
-}
-```
-
-### Partial Redaction
-
-Shows the first and last 3 characters, useful for debugging without exposing full values:
-
-```ts
-new SensitiveDataFilter({
-  redactionStyle: 'partial',
-})
-```
-
-```json
-// Before
-{
-  "apiKey": "sk-abc123xyz789def456",
-  "creditCard": "4111111111111111"
-}
-
-// After
-{
-  "apiKey": "sk-…456",
-  "creditCard": "411…111"
-}
-```
-
-Values shorter than 7 characters are fully redacted to prevent information leakage.
-
-## Field matching rules
-
-The filter uses intelligent field matching:
-
-1. **Case-Insensitive**: `APIKey`, `apikey`, and `ApiKey` are all matched
-
-2. **Separator-Agnostic**: `api-key`, `api_key`, and `apiKey` are treated identically
-
-3. **Exact Matching**: After normalization, fields must match exactly
-
-   - `token` matches `token`, `Token`, `TOKEN`
-   - `token` doesn't match `promptTokens` or `tokenCount`
-
-## Nested object handling
-
-The filter recursively processes nested structures:
-
-```json
-// Before
-{
-  "user": {
-    "id": "12345",
-    "credentials": {
-      "password": "SuperSecret123!",
-      "apiKey": "sk-production-key"
-    }
-  },
-  "config": {
-    "auth": {
-      "jwt": "eyJhbGciOiJIUzI1NiIs..."
-    }
-  }
-}
-
-// After
-{
-  "user": {
-    "id": "12345",
-    "credentials": {
-      "password": "[REDACTED]",
-      "apiKey": "[REDACTED]"
-    }
-  },
-  "config": {
-    "auth": {
-      "jwt": "[REDACTED]"
-    }
-  }
-}
-```
-
-## Performance considerations
-
-The Sensitive Data Filter is designed to be lightweight and efficient:
-
-- **Synchronous Processing**: No async operations, minimal latency impact
-- **Circular Reference Handling**: Safely handles complex object graphs
-- **Error Recovery**: If filtering fails, the field is replaced with an error marker rather than crashing
-
-## Disabling the filter
-
-If you need to disable sensitive data filtering (not recommended for production):
-
-```ts
-export const mastra = new Mastra({
-  observability: new Observability({
-    configs: {
-      debug: {
-        serviceName: 'debug-service',
-        spanOutputProcessors: [], // No processors, including no SensitiveDataFilter
-        exporters: [new MastraStorageExporter()],
-      },
-    },
-  }),
-})
-```
-
-> **Warning:** Only disable sensitive data filtering in controlled environments. Never disable it when sending traces to external services or shared storage.
-
-## Common use cases
-
-### Healthcare Applications
-
-```ts
-new SensitiveDataFilter({
-  sensitiveFields: [
-    // HIPAA-related fields
-    'ssn',
-    'socialSecurityNumber',
-    'medicalRecordNumber',
-    'mrn',
-    'healthInsuranceNumber',
-    'diagnosisCode',
-    'icd10',
-    'prescription',
-    'medication',
-  ],
-})
-```
-
-### Financial Services
-
-```ts
-new SensitiveDataFilter({
-  sensitiveFields: [
-    // PCI compliance fields
-    'creditCard',
-    'ccNumber',
-    'cardNumber',
-    'cvv',
-    'cvc',
-    'securityCode',
-    'expirationDate',
-    'expiry',
-    'bankAccount',
-    'accountNumber',
-    'routingNumber',
-    'iban',
-    'swift',
-  ],
-})
-```
-
-## Error handling
-
-If the filter encounters an error while processing a field, it replaces the field with a safe error marker:
-
-```json
-{
-  "problematicField": {
-    "error": {
-      "processor": "sensitive-data-filter"
-    }
-  }
-}
-```
-
-As a result, processing errors don't prevent traces from being exported or cause application crashes.
-
-## Related
-
-- [SensitiveDataFilter API](https://mastra.ai/reference/observability/tracing/processors/sensitive-data-filter)

package/.docs/guides/build-your-ui/copilotkit/channels.md

@@ -1,86 +0,0 @@
-> Discover all available pages from the documentation index: https://mastra.ai/llms.txt
-
-# CopilotKit channels
-
-The same Mastra agent that powers your in-app copilot can also run as a bot in messaging platforms. CopilotKit's Channels SDK connects your agent to Slack and other messaging platforms, with threads, tool calls, rich interactive messages, and human-in-the-loop approvals handled natively in the channel.
-
-> **Info:** Full platform setup lives in the [CopilotKit Channels documentation](https://docs.copilotkit.ai/slack/mastra). This page shows how Channels fit together with a Mastra agent.
-
-## How it fits together
-
-Your Mastra agent stays where it's deployed, exposed over AG-UI through `registerCopilotKit()` (see [CopilotKit overview](https://mastra.ai/guides/build-your-ui/copilotkit/overview)). A channel is a separate long-running process built with `@copilotkit/channels`: you attach one or more platform adapters and point the channel at your agent. `createChannel` takes an array of adapters, so a single process can serve several platforms at once.
-
-Install the SDK (batteries-included, every adapter):
-
-**npm**:
-
-```bash
-npm install @copilotkit/channels
-```
-
-**pnpm**:
-
-```bash
-pnpm add @copilotkit/channels
-```
-
-**Yarn**:
-
-```bash
-yarn add @copilotkit/channels
-```
-
-**Bun**:
-
-```bash
-bun add @copilotkit/channels
-```
-
-```typescript
-import { createChannel, Message, Section } from '@copilotkit/channels'
-import { slack } from '@copilotkit/channels/slack'
-import { mastraAgent } from './agent' // your AG-UI Mastra agent
-
-const channel = createChannel({
-  // Point the channel at your Mastra agent (an AbstractAgent, or a per-thread factory).
-  agent: mastraAgent,
-  adapters: [
-    slack({
-      botToken: process.env.SLACK_BOT_TOKEN!,
-      appToken: process.env.SLACK_APP_TOKEN!,
-    }),
-  ],
-})
-
-channel.onMention(async ({ thread }) => {
-  await thread.runAgent()
-})
-
-await channel.start()
-```
-
-The agent receives ordinary AG-UI input and emits ordinary AG-UI events; the platform mechanics stay behind the adapter, so the same Mastra agent runs unchanged across every channel. Rich messages are written as JSX and rendered to each platform's native format (Block Kit on Slack, for example), so an interactive card degrades gracefully where a platform has no equivalent.
-
-## Slack
-
-The [Slack quickstart](https://docs.copilotkit.ai/slack/mastra) takes you from zero to a bot you can `@`-mention in a channel, then adds an interactive button card. Slack runs over Socket Mode, which opens an outbound WebSocket to Slack, so no public URL or tunnel is required during development.
-
-Set the Slack credentials in your environment:
-
-- `SLACK_BOT_TOKEN`: Bot User OAuth token (`xoxb-...`)
-- `SLACK_APP_TOKEN`: App-level token with the `connections:write` scope (`xapp-...`)
-
-## Other platforms
-
-The Channels SDK isn't limited to Slack. Other platforms like Microsoft Teams run through the same `@copilotkit/channels` API: add the matching adapter to the `adapters` array and the rest of your agent code stays the same. See the [CopilotKit Channels documentation](https://docs.copilotkit.ai/slack/mastra) for the current platform list and per-platform setup.
-
-## Message pipeline and architecture
-
-Managed channels keep a deliberate credential split, which matters when your Mastra agent uses separate model keys and tools:
-
-- **You keep** the agent logic, model credentials, tools, and the channel process.
-- **CopilotKit Intelligence holds** the platform credentials, message delivery, registration, health, and reconnects.
-
-A turn begins when a user messages the app. Intelligence receives the platform event, and the gateway delivers the turn to your running channel process. Your Mastra agent runs and renders a reply. Intelligence then returns the reply as native platform content. Platform credentials never enter the agent process, and enterprise Intelligence can be self-hosted for data residency.
-
-> **Note:** By default, interactive actions live in memory and reset on restart. Back the channel with a durable action and state store (Redis or Postgres) so buttons and per-thread state survive restarts and span multiple instances.

package/.docs/guides/build-your-ui/copilotkit/generative-ui.md

@@ -1,174 +0,0 @@
-> Discover all available pages from the documentation index: https://mastra.ai/llms.txt
-
-# CopilotKit generative UI
-
-Generative UI describes interfaces that agents help create and that users can interact with. CopilotKit organizes these interfaces along a single axis, the **generative UI spectrum**, which runs from author-controlled (you decide every pixel) to agent-invented (the agent owns the rendered surface). Your position on the axis is a trade-off between predictability and breadth.
-
-The spectrum has three tiers:
-
-| Tier            | Who controls the surface                                                                   | Primitives                                                           |
-| --------------- | ------------------------------------------------------------------------------------------ | -------------------------------------------------------------------- |
-| **Controlled**  | You wrote the component. The agent picks which one to use and what data to pass.           | Tool call rendering, state rendering, reasoning, components as tools |
-| **Declarative** | The agent emits a structured spec. The frontend composes it from a catalog you registered. | A2UI (fixed-schema and flexible variants)                            |
-| **Open-ended**  | The UI is invented elsewhere (an MCP server) and you sandbox it.                           | MCP Apps                                                             |
-
-Each tier is a Mastra agent exposed through `registerCopilotKit()` (see [CopilotKit overview](https://mastra.ai/guides/build-your-ui/copilotkit/overview)) plus the matching CopilotKit hook on the frontend. For the full concept, see CopilotKit's [generative UI spectrum](https://www.copilotkit.ai/generative-ui-spectrum) and [generative UI overview](https://docs.copilotkit.ai/concepts/generative-ui-overview).
-
-> **Tip:** Mastra's [UI Dojo](https://ui-dojo.mastra.ai/) has working CopilotKit examples. Browse the source under `src/pages/copilot-kit`.
-
-## Controlled
-
-You provide a fixed set of components. The agent chooses which component to render and supplies its data. This predictable, brand-safe approach works well for high-traffic surfaces. The Controlled primitives use CopilotKit's v2 API, imported from `@copilotkit/react-core/v2`.
-
-### Tool call rendering
-
-Render an agent's tool call as a React component. Define the agent and tool on the Mastra server as usual:
-
-```typescript
-import { Agent } from '@mastra/core/agent'
-import { weatherTool } from '../tools/weather-tool'
-
-export const weatherAgent = new Agent({
-  id: 'weather-agent',
-  name: 'Weather Agent',
-  instructions: 'Use the weatherTool to fetch current weather data.',
-  model: 'openai/gpt-5.6-sol',
-  tools: { weatherTool },
-})
-```
-
-On the frontend, register a renderer for the tool by name with `useRenderTool`. It's render-only (it doesn't execute the tool); the `render` function receives the tool call's `status` and, once the agent returns, its `result`:
-
-```tsx
-import { z } from 'zod'
-import { CopilotChat } from '@copilotkit/react-ui'
-import { CopilotKit, useRenderTool } from '@copilotkit/react-core/v2'
-import { Weather } from '@/components/weather'
-
-function Chat() {
-  useRenderTool(
-    {
-      name: 'weatherTool',
-      parameters: z.object({ location: z.string() }),
-      render: ({ status, result }) => {
-        if (status !== 'complete') {
-          return <div>Retrieving weather...</div>
-        }
-        return <Weather {...result} />
-      },
-    },
-    [],
-  )
-
-  return <CopilotChat labels={{ title: 'Weather Assistant' }} />
-}
-
-export default function Page() {
-  return (
-    <CopilotKit runtimeUrl="http://localhost:4111/copilotkit" agent="weatherAgent">
-      <Chat />
-    </CopilotKit>
-  )
-}
-```
-
-Because Mastra streams tool-call arguments incrementally, the `render` function is called repeatedly as the arguments arrive, so the UI can paint progressively while the agent works.
-
-### Components as tools
-
-Register a React component and let the agent call it as a tool. CopilotKit renders it inline with typed props (defined with a Zod schema):
-
-```tsx
-import { z } from 'zod'
-import { useComponent } from '@copilotkit/react-core/v2'
-
-const schema = z.object({ text: z.string() })
-
-function Callout({ text }: z.infer<typeof schema>) {
-  return <div className="callout">{text}</div>
-}
-
-function Chat() {
-  useComponent({ name: 'callout', render: Callout, parameters: schema }, [])
-  return <CopilotChat labels={{ title: 'Assistant' }} />
-}
-```
-
-The agent invokes `callout` like any other tool, and CopilotKit renders `Callout` with the props it passed.
-
-### State rendering
-
-Render UI from the agent's state and re-render as it streams. On Mastra, agent state is the agent's working memory, streamed to the client as it changes. Read it with `useAgent`; `agent.state` is reactive, so the component updates automatically:
-
-```tsx
-import { useAgent } from '@copilotkit/react-core/v2'
-
-function TaskBoard() {
-  const { agent } = useAgent()
-  const tasks = (agent.state.tasks as any[]) ?? []
-
-  return (
-    <ul>
-      {tasks.map((task, i) => (
-        <li key={i}>
-          {task.title}: {task.status}
-        </li>
-      ))}
-    </ul>
-  )
-}
-```
-
-### Reasoning
-
-Reasoning is zero-config: when your Mastra agent runs a reasoning-capable model, `CopilotChat` renders the model's thinking inline as a dedicated message type, with no extra code. To restyle it, pass your own component to the `reasoningMessage` slot on `CopilotChat`. See CopilotKit's [generative UI guides](https://docs.copilotkit.ai/) for details.
-
-## Declarative
-
-Instead of a fixed component per tool, you register a catalog of typed building blocks and the agent assembles them into a UI tree per request. CopilotKit calls this **A2UI** (Agent-to-UI), which has fixed-schema and flexible variants. It suits the long tail of secondary interactions where breadth matters more than pixel-perfection.
-
-The path of least resistance is to pass your catalog to the `<CopilotKit>` provider. That single prop enables A2UI rendering and injects the A2UI tool into your agent, so no backend change is needed:
-
-```tsx
-import { CopilotKit } from '@copilotkit/react-core/v2'
-import { myCatalog } from './a2ui-catalog'
-
-export default function Page() {
-  return (
-    <CopilotKit
-      runtimeUrl="http://localhost:4111/copilotkit"
-      agent="weatherAgent"
-      a2ui={{ catalog: myCatalog }}
-    >
-      {/* your app */}
-    </CopilotKit>
-  )
-}
-```
-
-The catalog defines the primitives (their schemas) and the renderers (how each primitive displays). In the fixed-schema variant, the components are pre-authored and the agent's tool only supplies data. The flexible variant lets the agent compose the tree more freely. See CopilotKit's [A2UI documentation](https://docs.copilotkit.ai/a2a/generative-ui/a2ui).
-
-## Open-ended
-
-At the far end of the spectrum, the agent owns the entire surface: the UI is invented elsewhere and sandboxed in your app. CopilotKit supports this through **MCP Apps**, where an MCP server provides UI that renders inside your application. This tier trades determinism for novelty and is the most experimental point on the spectrum.
-
-The path of least resistance keeps the frontend untouched: your existing `<CopilotKit>` provider is enough. On the backend, point `registerCopilotKit()` at one or more MCP servers with the `mcpApps` option (it's forwarded to the CopilotKit runtime):
-
-```typescript
-registerCopilotKit({
-  path: '/copilotkit',
-  resourceId: 'weatherAgent',
-  mcpApps: {
-    servers: [{ type: 'http', url: 'http://localhost:3108/mcp', serverId: 'my-server' }],
-  },
-})
-```
-
-When the agent calls an MCP App tool, CopilotKit fetches and renders that tool's UI in the chat with no additional frontend code. See CopilotKit's [MCP Apps documentation](https://docs.copilotkit.ai/agno/generative-ui/mcp-apps).
-
-## App control and interactivity
-
-Some capabilities sit next to the spectrum rather than on it: they control your app or gate a run instead of rendering agent output. Both are covered in [Get started](https://mastra.ai/guides/build-your-ui/copilotkit/overview):
-
-- **Frontend tools** (`useFrontendTool`): let the agent act on your application. This is part of CopilotKit's separate [App Control](https://docs.copilotkit.ai/) concept, alongside shared state and agent context.
-- **Human-in-the-loop**: pause a run and wait for user approval or edits. Backend side, see Mastra's [Agent approval](https://mastra.ai/docs/agents/agent-approval); frontend side, see CopilotKit's [`useHumanInTheLoop`](https://docs.copilotkit.ai/reference/hooks/useHumanInTheLoop).