@mongoosejs/studio 0.6.0 → 0.6.1

package/CHANGELOG.md

@@ -0,0 +1,38 @@
+# Changelog
+
+## 0.6.1
+
+### Safer MCP defaults with API keys
+
+MCP now defaults to disabled when Mongoose Studio is configured with an `apiKey`. Existing API-key integrations therefore continue to start without requiring additional MCP configuration.
+
+To enable OAuth-protected MCP, set `mcp: true` and provide `publicUrl` with the publicly reachable base URL where Mongoose Studio is mounted:
+
+```javascript
+app.use('/studio', await studio('/studio/api', mongoose, {
+  apiKey: process.env.MONGOOSE_STUDIO_API_KEY,
+  mcp: true,
+  publicUrl: 'https://myproduct.app/studio'
+}));
+```
+
+Mongoose Studio only requires `publicUrl` when both `apiKey` and `mcp: true` are set. Without an API key, MCP remains enabled by default and protected by `bindIp`.
+
+## 0.6.0
+
+### MCP support
+
+Mongoose Studio now serves an MCP endpoint at `<mount>/mcp` using the same access controls as the rest of Mongoose Studio.
+
+- MCP is enabled by default. Without an API key, access is protected by `bindIp`, so only clients running on the same machine can connect by default.
+- Set `mcp: false` to disable the MCP endpoint and its OAuth discovery metadata.
+- With an `apiKey`, MCP uses OAuth and requires `publicUrl` containing the publicly reachable base URL where Mongoose Studio is mounted, such as `https://myproduct.app/studio`.
+
+```javascript
+app.use('/studio', await studio('/studio/api', mongoose, {
+  apiKey: process.env.MONGOOSE_STUDIO_API_KEY,
+  publicUrl: 'https://myproduct.app/studio'
+}));
+```
+
+Mongoose Studio throws an error during setup when MCP is enabled with an `apiKey` but `publicUrl` is missing.

package/README.md

@@ -56,23 +56,24 @@ app.use('/studio', await studio('/studio/api', mongoose, {
 }));
 ```
 
-The Express integration also exposes a Streamable HTTP MCP endpoint at `/studio/mcp`.
-Set `mcp: false` to turn it off, along with the OAuth protected resource metadata that advertises it.
+Without an API key, the Express integration exposes a Streamable HTTP MCP endpoint at `/studio/mcp` by default.
+Set `mcp: false` to turn it off.
 It provides authorized Dashboard and Model actions, plus `Script.createScript`, as MCP tools.
 With a Pro API key, pass the logged-in Studio access token in the `Authorization` header (either directly or as a bearer token); tools receive that user's roles and permissions.
-Without workspace authentication, the MCP endpoint uses the same localhost and `bindIp` restrictions as the rest of Studio.
+Without workspace authentication, the MCP endpoint uses the same localhost and `bindIp` restrictions as the rest of Mongoose Studio.
 
 #### Connecting ChatGPT or Claude with OAuth
 
-With a Pro API key, `/studio/mcp` is also an OAuth 2.1 protected resource, so MCP clients such as ChatGPT and Claude can connect to it directly.
+With a Pro API key, MCP is disabled by default. Set `mcp: true` to expose `/studio/mcp` as an OAuth 2.1 protected resource so MCP clients such as ChatGPT and Claude can connect to it directly.
 Point the client at your `/studio/mcp` URL and it will discover the Mongoose Studio authorization server, walk the user through signing in and approving access, and receive a short-lived access token.
 Users review and revoke these connections from their Mongoose Studio account page, and the access an AI client gets can never exceed the access the user who approved it already has.
 
 Mongoose Studio advertises itself to MCP clients using its externally reachable URL.
-When MCP and a Pro API key are enabled, set `publicUrl` to the URL where Mongoose Studio is mounted:
+When enabling MCP with a Pro API key, also set `publicUrl` to the URL where Mongoose Studio is mounted:
 
 ```javascript
 opts.publicUrl = 'https://app.example.com/studio';
+opts.mcp = true;
 ```
 
 Mongoose Studio finds the authorization server through the mothership it is already configured to use, so it needs no separate authorization server configuration.

package/docs/mcp-oauth.md

@@ -84,17 +84,18 @@ They can only narrow what the host application already allows: `maxTimeMS` is ca
 
 ## Configuration
 
-The Mongoose Studio side needs a Pro API key and its own externally reachable URL, since the resource identifier is that URL.
-Set `publicUrl` to the URL where Mongoose Studio is mounted:
+MCP is disabled by default when Mongoose Studio has a Pro API key.
+To enable it, set `mcp: true` and set `publicUrl` to the externally reachable URL where Mongoose Studio is mounted:
 
 ```javascript
 app.use('/studio', await studio('/studio/api', mongoose, {
   apiKey: process.env.MONGOOSE_STUDIO_API_KEY,
+  mcp: true,
   publicUrl: 'https://app.example.com/studio'
 }));
 ```
 
-Pass `mcp: false` to serve Studio without an MCP endpoint at all.
+Pass `mcp: false` to serve Mongoose Studio without an MCP endpoint at all.
 Neither the endpoint nor its protected resource metadata is then mounted, so there is nothing for an MCP client to discover.
 Without an API key, the MCP endpoint follows the normal localhost or `bindIp` restrictions and does not mount OAuth protected resource metadata.
 
@@ -102,5 +103,5 @@ Mongoose Studio registers that URL with the authorization server the first time
 It advertises the configured mothership's origin in `authorization_servers`, keeping authentication with the same service Mongoose Studio already uses.
 
 Browser based MCP clients, claude.ai among them, run discovery from the page rather than from a server.
-Studio therefore serves the MCP endpoint and its metadata with CORS, and exposes `WWW-Authenticate` via `Access-Control-Expose-Headers`.
+Mongoose Studio therefore serves the MCP endpoint and its metadata with CORS, and exposes `WWW-Authenticate` via `Access-Control-Expose-Headers`.
 Without that last header a browser hides the challenge from the client, and the client cannot find the authorization server at all.

package/express.js

@@ -17,7 +17,8 @@ const MCP_ACCESS_TOKEN_PREFIX = 'mcp_at_';
 module.exports = async function mongooseStudioExpressApp(apiUrl, conn, options) {
   const router = express.Router();
   options = options ? { changeStream: true, ...options } : { changeStream: true };
-  if (options.mcp !== false && options.apiKey && !options.publicUrl) {
+  options.mcp = options.mcp ?? !options.apiKey;
+  if (options.mcp && options.apiKey && !options.publicUrl) {
     throw new Error('Mongoose Studio requires the publicUrl option when MCP is enabled with an API key');
   }
   const hasBindIpOption = Object.prototype.hasOwnProperty.call(options, 'bindIp');
@@ -124,10 +125,10 @@ module.exports = async function mongooseStudioExpressApp(apiUrl, conn, options)
   // issued by the mothership. Mongoose Studio is the protected resource: it publishes the
   // metadata that points clients at the authorization server, and resolves each
   // token to its current grant before handling the request.
-  const mcpEnabled = options.mcp !== false;
+  const mcpEnabled = options.mcp;
   const registeredMCPResources = new Set();
   const mcpAuthorizationServerUrl = new URL(mothershipUrl).origin;
-  const mcpResource = workspace ? canonicalize(`${options.publicUrl.replace(/\/+$/, '')}/mcp`) : null;
+  const mcpResource = mcpEnabled && workspace ? canonicalize(`${options.publicUrl.replace(/\/+$/, '')}/mcp`) : null;
 
   async function registerMCPResource(resource) {
     if (registeredMCPResources.has(resource)) {

package/frontend/index.js

@@ -37,7 +37,7 @@ module.exports = async function frontend(apiUrl, isLambda, options, workspace) {
     baseURL: apiUrl,
     isLambda,
     mcp: options?.mcp !== false,
-    mcpUrl: workspaceBaseUrl ? `${workspaceBaseUrl}/mcp` : null,
+    mcpUrl: options?.mcp !== false && workspaceBaseUrl ? `${workspaceBaseUrl}/mcp` : null,
     mothershipUrl: apiKey ? mothershipUrl : null,
     workspace: workspaceData
   };

package/frontend/public/app.js

@@ -66655,7 +66655,7 @@ var src_default = VueToastificationPlugin;
 (module) {
 
 "use strict";
-module.exports = /*#__PURE__*/JSON.parse('{"name":"@mongoosejs/studio","version":"0.6.0","description":"AI-Powered Data Workspace for MongoDB: Turn your MongoDB data into dashboards, maps, and interactive workflows - powered by your Mongoose models and AI.","homepage":"https://mongoosestudio.app/","repository":{"type":"git","url":"https://github.com/mongoosejs/studio"},"license":"Apache-2.0","dependencies":{"@ai-sdk/anthropic":"2.x","@ai-sdk/google":"2.x","@ai-sdk/openai":"2.x","@modelcontextprotocol/sdk":"^1.30.1","ace-builds":"^1.43.6","ai":"5.x","archetype":"0.13.1","csv-stringify":"6.3.0","ejson":"^2.2.3","extrovert":"^0.2.1","marked":"15.0.12","mpath":"^0.9.0","node-inspect-extracted":"3.x","regexp.escape":"^2.0.1","tailwindcss":"3.4.0","time-commando":"1.0.1","typescript":"^6.0.2","vue":"3.x","vue-toastification":"^2.0.0-rc.5","webpack":"5.x","xss":"^1.0.15","zod":"^4.6.5"},"peerDependencies":{"@nestjs/common":"10.x || 11.x","mongoose":"7.x || 8.x || ^9.0.0"},"peerDependenciesMeta":{"@nestjs/common":{"optional":true}},"optionalPeerDependencies":{"@mongoosejs/task":"0.5.x || 0.6.x"},"devDependencies":{"@masteringjs/eslint-config":"0.1.1","axios":"1.2.2","dedent":"^1.6.0","eslint":"9.30.0","@nestjs/common":"^11.1.9","express":"4.x","mocha":"10.2.0","mongodb-memory-server":"^11.0.1","mongoose":"9.x","sinon":"^21.0.1"},"scripts":{"lint":"eslint .","seed":"node seed/index.js","start":"node ./local.js","tailwind":"tailwindcss -o ./frontend/public/tw.css","tailwind:watch":"tailwindcss -o ./frontend/public/tw.css --watch","test":"mocha test/*.test.js","test:frontend":"mocha test/frontend/*.test.js","eval:agent":"node eval/agent/run.js"}}');
+module.exports = /*#__PURE__*/JSON.parse('{"name":"@mongoosejs/studio","version":"0.6.1","description":"AI-Powered Data Workspace for MongoDB: Turn your MongoDB data into dashboards, maps, and interactive workflows - powered by your Mongoose models and AI.","homepage":"https://mongoosestudio.app/","repository":{"type":"git","url":"https://github.com/mongoosejs/studio"},"license":"Apache-2.0","dependencies":{"@ai-sdk/anthropic":"2.x","@ai-sdk/google":"2.x","@ai-sdk/openai":"2.x","@modelcontextprotocol/sdk":"^1.30.1","ace-builds":"^1.43.6","ai":"5.x","archetype":"0.13.1","csv-stringify":"6.3.0","ejson":"^2.2.3","extrovert":"^0.2.1","marked":"15.0.12","mpath":"^0.9.0","node-inspect-extracted":"3.x","regexp.escape":"^2.0.1","tailwindcss":"3.4.0","time-commando":"1.0.1","typescript":"^6.0.2","vue":"3.x","vue-toastification":"^2.0.0-rc.5","webpack":"5.x","xss":"^1.0.15","zod":"^4.6.5"},"peerDependencies":{"@nestjs/common":"10.x || 11.x","mongoose":"7.x || 8.x || ^9.0.0"},"peerDependenciesMeta":{"@nestjs/common":{"optional":true}},"optionalPeerDependencies":{"@mongoosejs/task":"0.5.x || 0.6.x"},"devDependencies":{"@masteringjs/eslint-config":"0.1.1","axios":"1.2.2","dedent":"^1.6.0","eslint":"9.30.0","@nestjs/common":"^11.1.9","express":"4.x","mocha":"10.2.0","mongodb-memory-server":"^11.0.1","mongoose":"9.x","sinon":"^21.0.1"},"scripts":{"lint":"eslint .","seed":"node seed/index.js","start":"node ./local.js","tailwind":"tailwindcss -o ./frontend/public/tw.css","tailwind:watch":"tailwindcss -o ./frontend/public/tw.css --watch","test":"mocha test/*.test.js","test:frontend":"mocha test/frontend/*.test.js","eval:agent":"node eval/agent/run.js"}}');
 
 /***/ }
 

package/index.d.ts

@@ -9,7 +9,7 @@ declare module '@mongoosejs/studio' {
       apiKey?: string;
       bindIp?: string | string[] | null;
       maxTimeMS?: number;
-      /** Serve the MCP endpoint at `<mount>/mcp`. Defaults to true. */
+      /** Serve the MCP endpoint at `<mount>/mcp`. Defaults to true without apiKey and false with apiKey. */
       mcp?: boolean;
       readPreference?: 'primary' | 'secondaryPreferred' | 'secondary';
       /** Public base URL Mongoose Studio is mounted on. Required when MCP and apiKey are enabled. */

package/nest.d.ts

@@ -10,6 +10,7 @@ declare module '@mongoosejs/studio/nest' {
     apiKey?: string;
     bindIp?: string | string[] | null;
     maxTimeMS?: number;
+    /** Serve the MCP endpoint. Defaults to true without apiKey and false with apiKey. */
     mcp?: boolean;
     readPreference?: 'primary' | 'secondaryPreferred' | 'secondary';
     publicUrl?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mongoosejs/studio",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "AI-Powered Data Workspace for MongoDB: Turn your MongoDB data into dashboards, maps, and interactive workflows - powered by your Mongoose models and AI.",
   "homepage": "https://mongoosestudio.app/",
   "repository": {