@motherbase/cli 0.2.4 → 0.2.6

package/src/mcp/storage-tools.js

@@ -0,0 +1,93 @@
+'use strict';
+
+// Storage configuration over MCP, the counterpart of Supabase's
+// get_storage_config / update_storage_config. Motherbase keeps that
+// configuration in three settings groups plus the S3 endpoint, so these two
+// tools fold them back into the single view an agent expects.
+
+const api = require('../api');
+
+/** Setting group -> the tool argument that edits each of its fields. */
+const WRITABLE = {
+  'storage.limits': { maxUploadBytes: 'maxUploadBytes', allowedMimeTypes: 'allowedMimeTypes' },
+  'storage.imageTransform': { enabled: 'imageTransformEnabled', maxSourceBytes: 'imageTransformMaxSourceBytes' },
+  'storage.policies': { enabled: 'policiesEnabled' },
+};
+
+/** Groups the arguments touch, each with the field values to change. */
+function changesByGroup(args) {
+  const changes = {};
+  for (const [group, fields] of Object.entries(WRITABLE)) {
+    for (const [field, argName] of Object.entries(fields)) {
+      if (args[argName] === undefined) continue;
+      const value = Array.isArray(args[argName]) ? args[argName].join(', ') : args[argName];
+      (changes[group] ||= {})[field] = value;
+    }
+  }
+  return changes;
+}
+
+const valuesOf = group => (group && group.values) || {};
+
+function readStorageTools(ctx) {
+  return [
+    {
+      name: 'get_storage_config',
+      description:
+        'Storage configuration: the global upload size limit and allowed MIME types, image transformations, whether PostgreSQL policies authorize storage access, and the S3 protocol endpoint. Per-bucket limits are on list_storage_buckets.',
+      inputSchema: { type: 'object', properties: {} },
+      run: async () => {
+        const [limits, imageTransform, policies, s3] = await Promise.all([
+          api.adminRequest(ctx, 'GET', '/settings/storage.limits'),
+          api.adminRequest(ctx, 'GET', '/settings/storage.imageTransform'),
+          api.adminRequest(ctx, 'GET', '/settings/storage.policies'),
+          api.adminRequest(ctx, 'GET', '/storage/s3'),
+        ]);
+        return {
+          limits: valuesOf(limits),
+          imageTransform: valuesOf(imageTransform),
+          policies: valuesOf(policies),
+          s3,
+        };
+      },
+    },
+  ];
+}
+
+function writeStorageTools(ctx) {
+  return [
+    {
+      name: 'update_storage_config',
+      description:
+        'Change the global storage configuration. Only the fields you pass change. Per-bucket size limits and MIME types are edited on the bucket itself.',
+      inputSchema: {
+        type: 'object',
+        properties: {
+          maxUploadBytes: { type: 'integer', minimum: 0, description: 'Largest upload in bytes. 0 uses the server default.' },
+          allowedMimeTypes: {
+            type: 'array',
+            items: { type: 'string' },
+            description: 'Allowed MIME types, wildcards like image/* supported. Empty allows everything.',
+          },
+          imageTransformEnabled: { type: 'boolean', description: 'Serve resized images from /storage/v1/render/image.' },
+          imageTransformMaxSourceBytes: { type: 'integer', minimum: 1, description: 'Largest image, in bytes, that will be transformed.' },
+          policiesEnabled: { type: 'boolean', description: 'Authorize storage access with RLS policies on storage.files.' },
+        },
+      },
+      run: async args => {
+        const changes = changesByGroup(args);
+        if (!Object.keys(changes).length) throw new Error('Pass at least one field to change.');
+        // The settings API replaces a group wholesale, so an untouched field
+        // would fall back to its default unless it is sent back as it is.
+        const saved = {};
+        for (const [group, fields] of Object.entries(changes)) {
+          const current = valuesOf(await api.adminRequest(ctx, 'GET', `/settings/${group}`));
+          saved[group] = await api.adminRequest(ctx, 'PUT', `/settings/${group}`, { body: { ...current, ...fields } });
+        }
+        return saved;
+      },
+    },
+  ];
+}
+
+module.exports = { readStorageTools, writeStorageTools, changesByGroup };

package/src/mcp/tools.js

@@ -2,8 +2,9 @@
 
 // The tools an agent gets over MCP.
 //
-// Every one is a call to the project admin API through `api.adminRequest`, the
-// same path every CLI command takes. That is the whole design: authentication,
+// Every one is a call through the CLI's own HTTP layer: `api.adminRequest` for
+// the project, `api.consoleRequest` for the account tools in platform-tools.js,
+// the same paths every CLI command takes. That is the whole design: authentication,
 // console-proxy vs direct mode, and error mapping are solved once in the CLI and
 // reused here, so an MCP session cannot reach anything a `motherbase` command
 // could not, and cannot drift from it either.
@@ -13,6 +14,9 @@
 // this is built on already does.
 
 const api = require('../api');
+const platform = require('./platform-tools');
+const storage = require('./storage-tools');
+const { consoleProjectPath } = require('../commands/_util');
 
 const str = description => ({ type: 'string', description });
 
@@ -78,17 +82,22 @@ function readTools(ctx) {
     },
     {
       name: 'get_logs',
-      description: 'Recent API and database log entries.',
+      description: 'Recent log entries of one service, or of all of them.',
       inputSchema: {
         type: 'object',
         properties: {
+          service: {
+            type: 'string',
+            enum: ['api', 'postgres', 'auth', 'storage', 'realtime', 'edge-function'],
+            description: 'Only this service. api is every HTTP request. Omit for all services.',
+          },
           limit: { type: 'number', description: 'How many entries. Defaults to 100.' },
           level: str("Filter by level: 'info', 'warn' or 'error'."),
         },
       },
       run: args =>
         api.adminRequest(ctx, 'GET', '/logs', {
-          query: { limit: args.limit || 100, level: args.level },
+          query: { limit: args.limit || 100, level: args.level, service: args.service },
         }),
     },
     {
@@ -111,9 +120,148 @@ function readTools(ctx) {
       // must not be able to write, whatever the model believed it was doing.
       run: args => api.adminRequest(ctx, 'POST', '/sql/readonly', { body: { sql: args.sql } }),
     },
+
+    // ── db-core: Database section (indexes, enums, roles, publications, config) ──
+    {
+      name: 'list_indexes',
+      description: 'Every index in a schema, with its table, access method, key columns, uniqueness, size and definition.',
+      inputSchema: { type: 'object', properties: { schema: str('Postgres schema. Defaults to public.') } },
+      run: args => api.adminRequest(ctx, 'GET', '/schema/indexes', { query: { schema: args.schema } }),
+    },
+    {
+      name: 'list_enum_types',
+      description: 'Enumerated types in a schema, with their values in order and the columns that use each one.',
+      inputSchema: { type: 'object', properties: { schema: str('Postgres schema. Defaults to public.') } },
+      run: args => api.adminRequest(ctx, 'GET', '/schema/enums', { query: { schema: args.schema } }),
+    },
+    {
+      name: 'list_roles',
+      description:
+        'Postgres roles with their attributes (login, superuser, bypassrls, connection limit), live connections and memberships. Reserved platform roles carry the reason they cannot be changed.',
+      inputSchema: { type: 'object', properties: {} },
+      run: () => api.adminRequest(ctx, 'GET', '/database/roles'),
+    },
+    {
+      name: 'list_column_privileges',
+      description: 'For one table, which columns each role may SELECT, INSERT, UPDATE or REFERENCE.',
+      inputSchema: {
+        type: 'object',
+        properties: { table: str('Table name.'), schema: str('Postgres schema. Defaults to public.') },
+        required: ['table'],
+      },
+      run: args => api.adminRequest(ctx, 'GET', '/database/column-privileges', { query: { table: args.table, schema: args.schema } }),
+    },
+    {
+      name: 'list_publications',
+      description:
+        'Logical-replication publications, their tables and published actions, and wal_level. Motherbase Realtime does not use publications.',
+      inputSchema: { type: 'object', properties: {} },
+      run: () => api.adminRequest(ctx, 'GET', '/database/publications'),
+    },
+    {
+      name: 'get_postgres_config',
+      description:
+        'Managed Postgres settings (statement_timeout, work_mem, max_connections, ...) with current values, allowed scopes and every database, role or system override.',
+      inputSchema: { type: 'object', properties: {} },
+      run: () => api.adminRequest(ctx, 'GET', '/database/config'),
+    },
+    // ── end db-core ──
+
+    // ── cli-mcp lot: Supabase MCP project tools (platform-tools.js) ──────────
+    ...platform.projectReadTools(ctx),
+    // ── Lot platform: preview branches (Console routes, console mode only) ──
+    {
+      name: 'list_branches',
+      description:
+        'The preview branches of the linked project, main first, with status (creating, seeding, active, failed) and whether each is running.',
+      inputSchema: { type: 'object', properties: {} },
+      run: () => api.consoleRequest(ctx, 'GET', consoleProjectPath(ctx, '/branches')),
+    },
+
+    // ── db-ext ──────────────────────────────────────────────────────────────
+    {
+      name: 'list_queues',
+      description: 'List the message queues (pgmq) with their depth, type and whether RLS is on. Empty when queues are not enabled.',
+      inputSchema: { type: 'object', properties: {} },
+      run: () => api.adminRequest(ctx, 'GET', '/queues'),
+    },
+    {
+      name: 'list_vault_secrets',
+      description: 'List the Vault secrets: id, name, description and dates. Never returns a secret value.',
+      inputSchema: { type: 'object', properties: {} },
+      run: () => api.adminRequest(ctx, 'GET', '/vault'),
+    },
+    {
+      name: 'list_wrappers',
+      description: 'List the foreign data wrappers, foreign servers (never their passwords) and foreign tables.',
+      inputSchema: { type: 'object', properties: {} },
+      run: () => api.adminRequest(ctx, 'GET', '/wrappers'),
+    },
+    {
+      name: 'advise_indexes',
+      description:
+        'Suggest indexes for one SELECT/UPDATE/DELETE statement: the CREATE INDEX statements and the estimated cost drop. The statement is only planned over hypothetical indexes, never run.',
+      inputSchema: {
+        type: 'object',
+        properties: { sql: str('The statement to advise on.') },
+        required: ['sql'],
+      },
+      run: args => api.adminRequest(ctx, 'POST', '/performance/index-advisor', { body: { query: args.sql } }),
+    },
+    // ── /db-ext ─────────────────────────────────────────────────────────────
+
+    // ── auth ──
+    {
+      name: 'get_auth_config',
+      description:
+        'Every auth.* settings group (sign-in methods, URL configuration, rate limits, attack protection, third-party auth, hooks...) with its current values. Secrets are masked.',
+      inputSchema: { type: 'object', properties: {} },
+      run: async () => {
+        const list = await api.adminRequest(ctx, 'GET', '/settings');
+        const keys = ((list && list.groups) || []).map(g => g.key).filter(key => key.startsWith('auth.'));
+        const groups = await Promise.all(keys.map(key => api.adminRequest(ctx, 'GET', `/settings/${key}`)));
+        return { groups };
+      },
+    },
+    {
+      name: 'get_auth_audit_logs',
+      description:
+        'Auth audit trail (auth.audit_log_entries), newest first: sign-ins, sign-ups, token refreshes, recoveries, admin changes. Same data as the Studio Audit Logs page.',
+      inputSchema: {
+        type: 'object',
+        properties: {
+          action: str("Filter by action, e.g. 'login', 'user_signedup', 'user_deleted'."),
+          actor: str('Substring of the actor id or email.'),
+          logType: str("Filter by log type: 'account', 'team', 'token', 'user'..."),
+          from: str('ISO date; only entries at or after it.'),
+          to: str('ISO date; only entries at or before it.'),
+          limit: { type: 'number', description: 'How many entries. Defaults to 50.' },
+        },
+      },
+      run: args =>
+        api.adminRequest(ctx, 'GET', '/auth/audit-logs', {
+          query: {
+            action: args.action,
+            actor: args.actor,
+            log_type: args.logType,
+            from: args.from,
+            to: args.to,
+            per_page: args.limit || 50,
+          },
+        }),
+    },
+    // ── /auth ──
+
+    // ── storage ──────────────────────────────────────────────────────────────
+    ...storage.readStorageTools(ctx),
+    // ── /storage ─────────────────────────────────────────────────────────────
   ];
 }
 
+/** `/branches/<name>/<action>` on the linked project. */
+const branchAction = (ctx, action) => args =>
+  api.consoleRequest(ctx, 'POST', consoleProjectPath(ctx, `/branches/${encodeURIComponent(args.name)}/${action}`));
+
 /** Tools that change the database. Only exposed with `--write`. */
 function writeTools(ctx) {
   return [
@@ -151,6 +299,163 @@ function writeTools(ctx) {
       },
       run: args => api.adminRequest(ctx, 'POST', '/sql', { body: { sql: args.sql } }),
     },
+
+    // ── db-core: Postgres settings ──────────────────────────────────────────
+    // A dedicated tool rather than execute_sql_write: the server checks the
+    // name against its curated list and picks the narrowest scope Postgres allows.
+    {
+      name: 'update_postgres_config',
+      description:
+        'Set or reset (value null) managed Postgres settings. Without scope, a session setting such as statement_timeout is pinned on the database; server-wide ones use ALTER SYSTEM and may need a restart, which the result reports.',
+      inputSchema: {
+        type: 'object',
+        properties: {
+          changes: {
+            type: 'array',
+            items: {
+              type: 'object',
+              properties: {
+                name: str('Setting name, e.g. statement_timeout.'),
+                value: { type: ['string', 'null'], description: "New value with its unit, e.g. '30s', or null to reset." },
+                scope: str("'database', 'role' or 'system'. Optional."),
+                role: str('Role name, for scope role.'),
+              },
+              required: ['name', 'value'],
+            },
+          },
+        },
+        required: ['changes'],
+      },
+      run: args => api.adminRequest(ctx, 'PATCH', '/database/config', { body: { changes: args.changes } }),
+    },
+    // ── end db-core ──
+
+    // ── cli-mcp lot: Supabase MCP project tools (platform-tools.js) ──────────
+    ...platform.projectWriteTools(ctx),
+    // ── Lot platform: preview branches (Console routes, console mode only) ──
+    {
+      name: 'create_branch',
+      description:
+        'Create a preview branch: an isolated copy of the project with its own database, cut from its applied migrations (or its data with withData). Takes minutes; poll list_branches until it is active.',
+      inputSchema: {
+        type: 'object',
+        properties: {
+          name: str('Branch name, e.g. the git branch.'),
+          withData: { type: 'boolean', description: 'Copy the rows too, not only the schema. Defaults to false.' },
+        },
+        required: ['name'],
+      },
+      run: args =>
+        api.consoleRequest(ctx, 'POST', consoleProjectPath(ctx, '/branches'), {
+          body: { name: args.name, withData: Boolean(args.withData) },
+        }),
+    },
+    {
+      name: 'delete_branch',
+      description: 'Delete a preview branch and its whole stack.',
+      inputSchema: { type: 'object', properties: { name: str('Branch name.') }, required: ['name'] },
+      run: args =>
+        api.consoleRequest(ctx, 'DELETE', consoleProjectPath(ctx, `/branches/${encodeURIComponent(args.name)}`)),
+    },
+    {
+      name: 'merge_branch',
+      description:
+        "Apply the branch's new migrations to the main project. Refused while the branch is behind main: rebase_branch first.",
+      inputSchema: { type: 'object', properties: { name: str('Branch name.') }, required: ['name'] },
+      run: branchAction(ctx, 'merge'),
+    },
+    {
+      name: 'rebase_branch',
+      description: "Apply the main project's newer migrations to the branch.",
+      inputSchema: { type: 'object', properties: { name: str('Branch name.') }, required: ['name'] },
+      run: branchAction(ctx, 'rebase'),
+    },
+    {
+      name: 'reset_branch',
+      description: 'Recreate the branch from the main project as it is now. Everything done on the branch is lost.',
+      inputSchema: { type: 'object', properties: { name: str('Branch name.') }, required: ['name'] },
+      run: branchAction(ctx, 'reset'),
+    },
+
+    // ── db-ext ──────────────────────────────────────────────────────────────
+    {
+      name: 'create_queue',
+      description: 'Create a message queue (pgmq).',
+      inputSchema: {
+        type: 'object',
+        properties: {
+          name: str('Queue name.'),
+          type: str("'basic' (default), 'unlogged' or 'partitioned'."),
+        },
+        required: ['name'],
+      },
+      run: args => api.adminRequest(ctx, 'POST', '/queues', { body: { name: args.name, type: args.type } }),
+    },
+    {
+      name: 'drop_queue',
+      description: 'Drop a queue and every message in it. Cannot be undone.',
+      inputSchema: { type: 'object', properties: { name: str('Queue name.') }, required: ['name'] },
+      run: args => api.adminRequest(ctx, 'DELETE', `/queues/${encodeURIComponent(args.name)}`),
+    },
+    {
+      name: 'send_queue_message',
+      description: 'Send a JSON message to a queue.',
+      inputSchema: {
+        type: 'object',
+        properties: {
+          name: str('Queue name.'),
+          message: { description: 'Any JSON value.' },
+          delay: { type: 'number', description: 'Seconds before the message becomes visible. Defaults to 0.' },
+        },
+        required: ['name', 'message'],
+      },
+      run: args =>
+        api.adminRequest(ctx, 'POST', `/queues/${encodeURIComponent(args.name)}/messages`, {
+          body: { message: args.message, delay: args.delay },
+        }),
+    },
+    {
+      name: 'read_queue_messages',
+      description:
+        'Read messages from a queue. A write, because it hides them from other readers for the visibility timeout.',
+      inputSchema: {
+        type: 'object',
+        properties: {
+          name: str('Queue name.'),
+          qty: { type: 'number', description: 'How many messages, 1 to 100. Defaults to 1.' },
+          vt: { type: 'number', description: 'Visibility timeout in seconds. Defaults to 30.' },
+        },
+        required: ['name'],
+      },
+      run: args =>
+        api.adminRequest(ctx, 'POST', `/queues/${encodeURIComponent(args.name)}/read`, {
+          body: { qty: args.qty, vt: args.vt },
+        }),
+    },
+    {
+      name: 'create_vault_secret',
+      description: 'Store an encrypted secret in the Vault. There is no tool that reads a value back.',
+      inputSchema: {
+        type: 'object',
+        properties: { name: str('Unique secret name.'), secret: str('The value.'), description: str('Optional note.') },
+        required: ['name', 'secret'],
+      },
+      run: args =>
+        api.adminRequest(ctx, 'POST', '/vault/secrets', {
+          body: { name: args.name, secret: args.secret, description: args.description },
+        }),
+    },
+    {
+      name: 'delete_vault_secret',
+      description: 'Delete a Vault secret by id. Cannot be undone.',
+      inputSchema: { type: 'object', properties: { id: str('Secret id, from list_vault_secrets.') }, required: ['id'] },
+      run: args => api.adminRequest(ctx, 'DELETE', `/vault/secrets/${encodeURIComponent(args.id)}`),
+    },
+    // ── /db-ext ─────────────────────────────────────────────────────────────
+
+    // ── storage ──────────────────────────────────────────────────────────────
+    ...storage.writeStorageTools(ctx),
+    // ── /storage ─────────────────────────────────────────────────────────────
   ];
 }
 
@@ -158,9 +463,16 @@ function writeTools(ctx) {
  * `write` defaults to false, so an agent that connects without being told
  * otherwise can read the schema, lint it and simulate policies, but cannot
  * change anything. Handing an agent DDL is a decision the operator makes.
+ *
+ * `project` and `console` say what this session can reach: the project tools
+ * need a linked (or direct) project, the account tools a console login, and a
+ * tool that can only fail is left out rather than offered.
  */
-function buildTools(ctx, { write = false } = {}) {
-  return write ? [...readTools(ctx), ...writeTools(ctx)] : readTools(ctx);
+function buildTools(ctx, { write = false, project = true, console = false } = {}) {
+  const tools = [];
+  if (project) tools.push(...readTools(ctx), ...(write ? writeTools(ctx) : []));
+  if (console) tools.push(...platform.consoleReadTools(ctx), ...(write ? platform.consoleWriteTools(ctx) : []));
+  return tools;
 }
 
 module.exports = { buildTools, readTools, writeTools };