@motherbase/cli 0.2.4 → 0.2.5

package/src/mcp/platform-tools.js

@@ -0,0 +1,233 @@
+'use strict';
+
+// The Supabase MCP server's account and project tools, for what Motherbase
+// already serves. Same names and arguments where they fit, so an agent that
+// knows Supabase's tools can use these without learning new ones.
+//
+// Two scopes, because a session may have either or both:
+//   - console tools (organizations, projects) go through `api.consoleRequest`
+//     and need a console login, not a linked project;
+//   - project tools act on the linked (or direct-mode) project through
+//     `api.adminRequest`, like every tool in tools.js.
+//
+// Not here, because there is nothing behind them yet: branching, cost
+// confirmation, docs search, and Supabase's per-call `project_id` on project
+// tools (a session serves the one project it was started for).
+
+const api = require('../api');
+const { upsertFunction } = require('../commands/functions');
+
+const str = description => ({ type: 'string', description });
+const noArgs = { type: 'object', properties: {} };
+const enc = encodeURIComponent;
+
+const FUNCTION_NAME = /^[a-z0-9][a-z0-9-]*$/;
+
+/** A project from the console listing, by name or id; the listing is the only read. */
+async function findProject(ctx, id) {
+  const projects = await api.consoleRequest(ctx, 'GET', '/projects');
+  const project = (Array.isArray(projects) ? projects : []).find(p => p.name === id || p.id === id);
+  if (!project) throw new Error(`No project "${id}" on this console. list_projects shows the ones you can see.`);
+  return project;
+}
+
+/** An edge function by the slug Supabase's tools take: its route, name or id. */
+async function findFunction(ctx, slug) {
+  const listing = await api.adminRequest(ctx, 'GET', '/edge-functions');
+  const fn = ((listing && listing.functions) || []).find(f => f.route === slug || f.name === slug || f.id === slug);
+  if (!fn) throw new Error(`No edge function "${slug}". list_edge_functions shows what is deployed.`);
+  return fn;
+}
+
+/**
+ * The single source file a function deploys as. Supabase's tool takes a file
+ * set; Motherbase stores one module per function, so a set that needs more than
+ * its entrypoint is refused rather than deployed half-complete.
+ */
+function entrypointSource(files, entrypoint) {
+  if (!Array.isArray(files) || !files.length) throw new Error('files must hold at least the entrypoint.');
+  const wanted = entrypoint || 'index.ts';
+  // A lone file is the entrypoint whatever it is called, unless one was named.
+  const entry = files.find(f => f && f.name === wanted) || (!entrypoint && files.length === 1 ? files[0] : undefined);
+  if (!entry) throw new Error(`No file named ${wanted} among files.`);
+  if (files.length > 1) {
+    throw new Error('Edge functions deploy as a single module here: inline the other files into the entrypoint.');
+  }
+  return String(entry.content);
+}
+
+/** Account-level reads. Need a console login. */
+function consoleReadTools(ctx) {
+  return [
+    {
+      name: 'list_organizations',
+      description: 'List the organizations the logged-in operator belongs to, with their role and project count.',
+      inputSchema: noArgs,
+      run: () => api.consoleRequest(ctx, 'GET', '/orgs'),
+    },
+    {
+      name: 'get_organization',
+      description: 'Details of one organization: name, members count and settings.',
+      inputSchema: { type: 'object', properties: { id: str('Organization id.') }, required: ['id'] },
+      run: args => api.consoleRequest(ctx, 'GET', `/orgs/${enc(args.id)}`),
+    },
+    {
+      name: 'list_projects',
+      description: 'List the projects on this console the operator can see, with their status and domain.',
+      inputSchema: {
+        type: 'object',
+        properties: { organization_id: str('Only the projects of this organization.') },
+      },
+      run: args => api.consoleRequest(ctx, 'GET', '/projects', { query: { org: args.organization_id } }),
+    },
+    {
+      name: 'get_project',
+      description: 'Details of one project: status, domain and organization.',
+      inputSchema: { type: 'object', properties: { id: str('Project name or id.') }, required: ['id'] },
+      run: args => findProject(ctx, args.id),
+    },
+  ];
+}
+
+/** Account-level changes. Only with `--write`. */
+function consoleWriteTools(ctx) {
+  return [
+    {
+      name: 'create_project',
+      description:
+        'Create a project: a new, isolated stack (database, auth, storage, functions). Provisioning takes a while; poll get_project for its status.',
+      inputSchema: {
+        type: 'object',
+        properties: {
+          name: str('Project name: lowercase letters, digits and hyphens. Also its id.'),
+          organization_id: str('Organization to create it in. Defaults to the default organization.'),
+          domain: str('Domain it is served on. Required unless the console runs in dev mode.'),
+        },
+        required: ['name'],
+      },
+      run: args =>
+        api.consoleRequest(ctx, 'POST', '/projects', {
+          body: { name: args.name, domain: args.domain, orgId: args.organization_id },
+        }),
+    },
+    {
+      name: 'pause_project',
+      description: 'Stop a project\'s containers. Its data is kept; restore_project starts it again.',
+      inputSchema: { type: 'object', properties: { project_id: str('Project name or id.') }, required: ['project_id'] },
+      run: args => api.consoleRequest(ctx, 'POST', `/projects/${enc(args.project_id)}/stop`),
+    },
+    {
+      name: 'restore_project',
+      description: 'Start a paused project again.',
+      inputSchema: { type: 'object', properties: { project_id: str('Project name or id.') }, required: ['project_id'] },
+      run: args => api.consoleRequest(ctx, 'POST', `/projects/${enc(args.project_id)}/start`),
+    },
+  ];
+}
+
+/** Reads on the served project. */
+function projectReadTools(ctx) {
+  return [
+    {
+      name: 'get_project_url',
+      description: 'The API URL (and realtime URL) a client app uses to reach this project.',
+      inputSchema: noArgs,
+      run: async () => {
+        const info = await api.adminRequest(ctx, 'GET', '/connect-info');
+        return { url: info.apiUrl, realtimeUrl: info.wsUrl };
+      },
+    },
+    {
+      name: 'get_publishable_keys',
+      description:
+        'The publishable API keys a client app ships with. Safe to embed: row level security decides what they reach. Secret keys are never returned.',
+      inputSchema: noArgs,
+      run: async () => {
+        const data = await api.adminRequest(ctx, 'GET', '/api-keys');
+        const keys = ((data && data.keys) || [])
+          .filter(k => k.type === 'publishable' && !k.revokedAt)
+          .map(k => ({ name: k.name, api_key: k.token }));
+        return { keys };
+      },
+    },
+    {
+      name: 'list_extensions',
+      description: 'Postgres extensions available in the project database, and which are installed.',
+      inputSchema: noArgs,
+      run: () => api.adminRequest(ctx, 'GET', '/schema/extensions'),
+    },
+    {
+      name: 'list_migrations',
+      description: 'Schema migrations recorded for the project, with their status and when they were applied.',
+      inputSchema: noArgs,
+      run: () => api.adminRequest(ctx, 'GET', '/migrations'),
+    },
+    {
+      name: 'list_edge_functions',
+      description: 'Deployed edge functions: name, route, whether enabled, and limits. get_edge_function returns the source.',
+      inputSchema: noArgs,
+      run: async () => {
+        const data = await api.adminRequest(ctx, 'GET', '/edge-functions');
+        // The source of every function is noise in a listing; get_edge_function has it.
+        const functions = ((data && data.functions) || []).map(({ code: _code, ...meta }) => meta);
+        return { functions };
+      },
+    },
+    {
+      name: 'get_edge_function',
+      description: 'One deployed edge function with its source code.',
+      inputSchema: {
+        type: 'object',
+        properties: { function_slug: str('The function\'s route (also accepts its name or id).') },
+        required: ['function_slug'],
+      },
+      run: async args => {
+        const fn = await findFunction(ctx, args.function_slug);
+        return api.adminRequest(ctx, 'GET', `/edge-functions/${enc(fn.id)}`);
+      },
+    },
+    {
+      name: 'list_storage_buckets',
+      description: 'Storage buckets with their visibility, quota and usage.',
+      inputSchema: noArgs,
+      run: () => api.adminRequest(ctx, 'GET', '/storage/buckets'),
+    },
+  ];
+}
+
+/** Changes to the served project. Only with `--write`. */
+function projectWriteTools(ctx) {
+  return [
+    {
+      name: 'deploy_edge_function',
+      description:
+        'Deploy an edge function, creating it or replacing the one at the same route. The name is also its route. The code runs on Deno with the Web platform; export a default handler (req: Request) => Response.',
+      inputSchema: {
+        type: 'object',
+        properties: {
+          name: str('Function name: lowercase letters, digits and hyphens.'),
+          entrypoint_path: str('Which of files is the entrypoint. Defaults to index.ts.'),
+          files: {
+            type: 'array',
+            description: 'The function source: its single entrypoint module.',
+            items: {
+              type: 'object',
+              properties: { name: str('File name, e.g. index.ts.'), content: str('File contents.') },
+              required: ['name', 'content'],
+            },
+          },
+        },
+        required: ['name', 'files'],
+      },
+      run: args => {
+        if (!FUNCTION_NAME.test(args.name || '')) {
+          throw new Error('Function names are lowercase letters, digits and hyphens (the name is also the route).');
+        }
+        const code = entrypointSource(args.files, args.entrypoint_path);
+        return upsertFunction(ctx, { name: args.name, route: args.name, code });
+      },
+    },
+  ];
+}
+
+module.exports = { consoleReadTools, consoleWriteTools, projectReadTools, projectWriteTools, entrypointSource };

package/src/mcp/protocol.js

@@ -1,149 +1,149 @@
-'use strict';
-
-// Minimal MCP server over stdio: newline-delimited JSON-RPC 2.0 on stdin/stdout.
-//
-// Why not the official SDK: a stdio tools server needs five methods, and
-// `@modelcontextprotocol/sdk` pulls express, hono, cors, ajv, jose and a dozen
-// more to provide them. This CLI is deliberately zero-dependency, and making
-// `npx @motherbase/cli` install a web framework so that one subcommand can read
-// stdin is not a trade worth making.
-//
-// ponytail: stdio transport and the tools capability only. No resources, no
-// prompts, no sampling, no HTTP/SSE transport. Adopt the official SDK if any of
-// those is ever needed rather than growing this file into a second one.
-
-// Echoed back to the client. MCP clients negotiate by sending their own version;
-// answering with a version we implement is the contract, and every client in the
-// field accepts a server that names an older one.
-const PROTOCOL_VERSION = '2024-11-05';
-
-/** JSON-RPC error codes used here. */
-const METHOD_NOT_FOUND = -32601;
-const INTERNAL_ERROR = -32603;
-const PARSE_ERROR = -32700;
-
-/**
- * Reads newline-delimited JSON from `input`, dispatches to `handlers`, writes
- * responses to `output`.
- *
- * Split from the tool definitions so the transport can be driven by a test with
- * two in-memory streams and no child process.
- */
-function serve({ input, output, handlers, onError }) {
-  let buffer = '';
-
-  const write = message => {
-    output.write(JSON.stringify(message) + '\n');
-  };
-
-  const respond = (id, result) => {
-    // A notification (no id) gets no response. Sending one is a protocol error
-    // that some clients treat as fatal.
-    if (id === undefined || id === null) return;
-    write({ jsonrpc: '2.0', id, result });
-  };
-
-  const fail = (id, code, message) => {
-    if (id === undefined || id === null) return;
-    write({ jsonrpc: '2.0', id, error: { code, message } });
-  };
-
-  const dispatch = async message => {
-    const { id, method, params } = message;
-    const handler = handlers[method];
-    if (!handler) {
-      // Unknown notifications are ignored rather than answered: the spec sends
-      // several the server is not required to know about.
-      if (id === undefined || id === null) return;
-      return fail(id, METHOD_NOT_FOUND, `Unknown method: ${method}`);
-    }
-    try {
-      respond(id, await handler(params || {}));
-    } catch (err) {
-      if (onError) onError(err);
-      fail(id, INTERNAL_ERROR, err && err.message ? err.message : String(err));
-    }
-  };
-
-  return new Promise(resolve => {
-    input.setEncoding('utf8');
-    input.on('data', chunk => {
-      buffer += chunk;
-      let index;
-      while ((index = buffer.indexOf('\n')) >= 0) {
-        const line = buffer.slice(0, index).trim();
-        buffer = buffer.slice(index + 1);
-        if (!line) continue;
-        let message;
-        try {
-          message = JSON.parse(line);
-        } catch {
-          write({ jsonrpc: '2.0', id: null, error: { code: PARSE_ERROR, message: 'Invalid JSON' } });
-          continue;
-        }
-        // Deliberately not awaited: a slow tool call must not stall the reader,
-        // and JSON-RPC responses carry their id so they may arrive out of order.
-        void dispatch(message);
-      }
-    });
-    input.on('end', resolve);
-    input.on('close', resolve);
-  });
-}
-
-/**
- * Build the five handlers a tools-only server needs.
- *
- * `tools` is a list of `{ name, description, inputSchema, run }`. `run` returns
- * anything JSON-serialisable; it is rendered as a text content block, which is
- * what every current client displays and what models read best.
- */
-function toolServer({ name, version, tools }) {
-  const byName = new Map(tools.map(tool => [tool.name, tool]));
-
-  return {
-    initialize: () => ({
-      protocolVersion: PROTOCOL_VERSION,
-      capabilities: { tools: {} },
-      serverInfo: { name, version },
-    }),
-    'notifications/initialized': () => undefined,
-    ping: () => ({}),
-    'tools/list': () => ({
-      tools: tools.map(({ name: toolName, description, inputSchema }) => ({
-        name: toolName,
-        description,
-        inputSchema,
-      })),
-    }),
-    'tools/call': async params => {
-      const tool = byName.get(params.name);
-      if (!tool) {
-        // A missing tool is reported in-band, not as a JSON-RPC error: the model
-        // should see it and correct itself rather than the client showing a
-        // transport failure.
-        return {
-          isError: true,
-          content: [{ type: 'text', text: `Unknown tool: ${params.name}` }],
-        };
-      }
-      try {
-        const result = await tool.run(params.arguments || {});
-        return { content: [{ type: 'text', text: render(result) }] };
-      } catch (err) {
-        return {
-          isError: true,
-          content: [{ type: 'text', text: err && err.message ? err.message : String(err) }],
-        };
-      }
-    },
-  };
-}
-
-function render(value) {
-  if (typeof value === 'string') return value;
-  if (value === undefined) return 'ok';
-  return JSON.stringify(value, null, 2);
-}
-
-module.exports = { serve, toolServer, PROTOCOL_VERSION };
+'use strict';
+
+// Minimal MCP server over stdio: newline-delimited JSON-RPC 2.0 on stdin/stdout.
+//
+// Why not the official SDK: a stdio tools server needs five methods, and
+// `@modelcontextprotocol/sdk` pulls express, hono, cors, ajv, jose and a dozen
+// more to provide them. This CLI is deliberately zero-dependency, and making
+// `npx @motherbase/cli` install a web framework so that one subcommand can read
+// stdin is not a trade worth making.
+//
+// ponytail: stdio transport and the tools capability only. No resources, no
+// prompts, no sampling, no HTTP/SSE transport. Adopt the official SDK if any of
+// those is ever needed rather than growing this file into a second one.
+
+// Echoed back to the client. MCP clients negotiate by sending their own version;
+// answering with a version we implement is the contract, and every client in the
+// field accepts a server that names an older one.
+const PROTOCOL_VERSION = '2024-11-05';
+
+/** JSON-RPC error codes used here. */
+const METHOD_NOT_FOUND = -32601;
+const INTERNAL_ERROR = -32603;
+const PARSE_ERROR = -32700;
+
+/**
+ * Reads newline-delimited JSON from `input`, dispatches to `handlers`, writes
+ * responses to `output`.
+ *
+ * Split from the tool definitions so the transport can be driven by a test with
+ * two in-memory streams and no child process.
+ */
+function serve({ input, output, handlers, onError }) {
+  let buffer = '';
+
+  const write = message => {
+    output.write(JSON.stringify(message) + '\n');
+  };
+
+  const respond = (id, result) => {
+    // A notification (no id) gets no response. Sending one is a protocol error
+    // that some clients treat as fatal.
+    if (id === undefined || id === null) return;
+    write({ jsonrpc: '2.0', id, result });
+  };
+
+  const fail = (id, code, message) => {
+    if (id === undefined || id === null) return;
+    write({ jsonrpc: '2.0', id, error: { code, message } });
+  };
+
+  const dispatch = async message => {
+    const { id, method, params } = message;
+    const handler = handlers[method];
+    if (!handler) {
+      // Unknown notifications are ignored rather than answered: the spec sends
+      // several the server is not required to know about.
+      if (id === undefined || id === null) return;
+      return fail(id, METHOD_NOT_FOUND, `Unknown method: ${method}`);
+    }
+    try {
+      respond(id, await handler(params || {}));
+    } catch (err) {
+      if (onError) onError(err);
+      fail(id, INTERNAL_ERROR, err && err.message ? err.message : String(err));
+    }
+  };
+
+  return new Promise(resolve => {
+    input.setEncoding('utf8');
+    input.on('data', chunk => {
+      buffer += chunk;
+      let index;
+      while ((index = buffer.indexOf('\n')) >= 0) {
+        const line = buffer.slice(0, index).trim();
+        buffer = buffer.slice(index + 1);
+        if (!line) continue;
+        let message;
+        try {
+          message = JSON.parse(line);
+        } catch {
+          write({ jsonrpc: '2.0', id: null, error: { code: PARSE_ERROR, message: 'Invalid JSON' } });
+          continue;
+        }
+        // Deliberately not awaited: a slow tool call must not stall the reader,
+        // and JSON-RPC responses carry their id so they may arrive out of order.
+        void dispatch(message);
+      }
+    });
+    input.on('end', resolve);
+    input.on('close', resolve);
+  });
+}
+
+/**
+ * Build the five handlers a tools-only server needs.
+ *
+ * `tools` is a list of `{ name, description, inputSchema, run }`. `run` returns
+ * anything JSON-serialisable; it is rendered as a text content block, which is
+ * what every current client displays and what models read best.
+ */
+function toolServer({ name, version, tools }) {
+  const byName = new Map(tools.map(tool => [tool.name, tool]));
+
+  return {
+    initialize: () => ({
+      protocolVersion: PROTOCOL_VERSION,
+      capabilities: { tools: {} },
+      serverInfo: { name, version },
+    }),
+    'notifications/initialized': () => undefined,
+    ping: () => ({}),
+    'tools/list': () => ({
+      tools: tools.map(({ name: toolName, description, inputSchema }) => ({
+        name: toolName,
+        description,
+        inputSchema,
+      })),
+    }),
+    'tools/call': async params => {
+      const tool = byName.get(params.name);
+      if (!tool) {
+        // A missing tool is reported in-band, not as a JSON-RPC error: the model
+        // should see it and correct itself rather than the client showing a
+        // transport failure.
+        return {
+          isError: true,
+          content: [{ type: 'text', text: `Unknown tool: ${params.name}` }],
+        };
+      }
+      try {
+        const result = await tool.run(params.arguments || {});
+        return { content: [{ type: 'text', text: render(result) }] };
+      } catch (err) {
+        return {
+          isError: true,
+          content: [{ type: 'text', text: err && err.message ? err.message : String(err) }],
+        };
+      }
+    },
+  };
+}
+
+function render(value) {
+  if (typeof value === 'string') return value;
+  if (value === undefined) return 'ok';
+  return JSON.stringify(value, null, 2);
+}
+
+module.exports = { serve, toolServer, PROTOCOL_VERSION };

package/src/mcp/storage-tools.js

@@ -0,0 +1,93 @@
+'use strict';
+
+// Storage configuration over MCP, the counterpart of Supabase's
+// get_storage_config / update_storage_config. Motherbase keeps that
+// configuration in three settings groups plus the S3 endpoint, so these two
+// tools fold them back into the single view an agent expects.
+
+const api = require('../api');
+
+/** Setting group -> the tool argument that edits each of its fields. */
+const WRITABLE = {
+  'storage.limits': { maxUploadBytes: 'maxUploadBytes', allowedMimeTypes: 'allowedMimeTypes' },
+  'storage.imageTransform': { enabled: 'imageTransformEnabled', maxSourceBytes: 'imageTransformMaxSourceBytes' },
+  'storage.policies': { enabled: 'policiesEnabled' },
+};
+
+/** Groups the arguments touch, each with the field values to change. */
+function changesByGroup(args) {
+  const changes = {};
+  for (const [group, fields] of Object.entries(WRITABLE)) {
+    for (const [field, argName] of Object.entries(fields)) {
+      if (args[argName] === undefined) continue;
+      const value = Array.isArray(args[argName]) ? args[argName].join(', ') : args[argName];
+      (changes[group] ||= {})[field] = value;
+    }
+  }
+  return changes;
+}
+
+const valuesOf = group => (group && group.values) || {};
+
+function readStorageTools(ctx) {
+  return [
+    {
+      name: 'get_storage_config',
+      description:
+        'Storage configuration: the global upload size limit and allowed MIME types, image transformations, whether PostgreSQL policies authorize storage access, and the S3 protocol endpoint. Per-bucket limits are on list_storage_buckets.',
+      inputSchema: { type: 'object', properties: {} },
+      run: async () => {
+        const [limits, imageTransform, policies, s3] = await Promise.all([
+          api.adminRequest(ctx, 'GET', '/settings/storage.limits'),
+          api.adminRequest(ctx, 'GET', '/settings/storage.imageTransform'),
+          api.adminRequest(ctx, 'GET', '/settings/storage.policies'),
+          api.adminRequest(ctx, 'GET', '/storage/s3'),
+        ]);
+        return {
+          limits: valuesOf(limits),
+          imageTransform: valuesOf(imageTransform),
+          policies: valuesOf(policies),
+          s3,
+        };
+      },
+    },
+  ];
+}
+
+function writeStorageTools(ctx) {
+  return [
+    {
+      name: 'update_storage_config',
+      description:
+        'Change the global storage configuration. Only the fields you pass change. Per-bucket size limits and MIME types are edited on the bucket itself.',
+      inputSchema: {
+        type: 'object',
+        properties: {
+          maxUploadBytes: { type: 'integer', minimum: 0, description: 'Largest upload in bytes. 0 uses the server default.' },
+          allowedMimeTypes: {
+            type: 'array',
+            items: { type: 'string' },
+            description: 'Allowed MIME types, wildcards like image/* supported. Empty allows everything.',
+          },
+          imageTransformEnabled: { type: 'boolean', description: 'Serve resized images from /storage/v1/render/image.' },
+          imageTransformMaxSourceBytes: { type: 'integer', minimum: 1, description: 'Largest image, in bytes, that will be transformed.' },
+          policiesEnabled: { type: 'boolean', description: 'Authorize storage access with RLS policies on storage.files.' },
+        },
+      },
+      run: async args => {
+        const changes = changesByGroup(args);
+        if (!Object.keys(changes).length) throw new Error('Pass at least one field to change.');
+        // The settings API replaces a group wholesale, so an untouched field
+        // would fall back to its default unless it is sent back as it is.
+        const saved = {};
+        for (const [group, fields] of Object.entries(changes)) {
+          const current = valuesOf(await api.adminRequest(ctx, 'GET', `/settings/${group}`));
+          saved[group] = await api.adminRequest(ctx, 'PUT', `/settings/${group}`, { body: { ...current, ...fields } });
+        }
+        return saved;
+      },
+    },
+  ];
+}
+
+module.exports = { readStorageTools, writeStorageTools, changesByGroup };