@motorical/scope-catalog 0.5.0 → 0.7.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@motorical/scope-catalog",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Canonical MCP/OAuth scope metadata for Motorical — descriptions, Public API scope mapping, implied-read rules, and declarative tool/resource membership. One source of truth consumed by motorical-backend and @motorical/mcp.",
   "main": "./src/index.js",
   "engines": {

package/src/tools.js

@@ -34,13 +34,14 @@ const ANALYTICS_TOOLS = [
   'motorical_get_error_codes',
   'motorical_get_rate_limits',
   'motorical_get_account_rate_limits',
-  'motorical_get_onboarding_state',
   'motorical_whoami',
   'motorical_get_logs',
   'motorical_get_message_by_smtp_id',
 ];
 
 const DOMAIN_TOOLS = [
+  // Domain verification, DNS readiness and Motor Block state: a domains read (GET /account/state needs config.read, which read:domains carries).
+  'motorical_get_onboarding_state',
   'motorical_domain_list',
   'motorical_domain_get',
   'motorical_domain_dns_records',
@@ -96,14 +97,22 @@ const ALL_TOOLS = [
   ]),
 ];
 
+/**
+ * Tools any OAuth grant may call, whatever scopes it holds (they carry an empty TOOL_SCOPES entry): a connection must be able to ask
+ * what it holds. Listed on every authenticated hosted server, appended after each server's own tools so the order of main and of
+ * the existing lists is unchanged. motorical_whoami was listed under read:analytics while the route behind it needed config.read,
+ * which read:analytics does not carry, so a read:analytics-only grant saw the tool and was refused (found 2026-10-22).
+ */
+const ANY_GRANT_TOOLS = ['motorical_whoami'];
+
 const SERVER_TOOLS = {
   main: ALL_TOOLS,
-  transactional: TRANSACTIONAL_TOOLS,
+  transactional: [...TRANSACTIONAL_TOOLS, ...ANY_GRANT_TOOLS],
   analytics: ANALYTICS_TOOLS,
-  domains: DOMAIN_TOOLS,
-  sandbox: SANDBOX_TOOLS,
-  webhooks: WEBHOOK_TOOLS,
-  motorBlocks: MOTOR_BLOCK_TOOLS,
+  domains: [...DOMAIN_TOOLS, ...ANY_GRANT_TOOLS],
+  sandbox: [...SANDBOX_TOOLS, ...ANY_GRANT_TOOLS],
+  webhooks: [...WEBHOOK_TOOLS, ...ANY_GRANT_TOOLS],
+  motorBlocks: [...MOTOR_BLOCK_TOOLS, ...ANY_GRANT_TOOLS],
   signup: ['motorical_signup_handoff'],
 };
 
@@ -126,8 +135,8 @@ const TOOL_SCOPES = {
   motorical_get_error_codes: ['read:analytics'],
   motorical_get_rate_limits: ['read:analytics'],
   motorical_get_account_rate_limits: ['read:analytics'],
-  motorical_get_onboarding_state: ['read:analytics'],
-  motorical_whoami: ['read:analytics'],
+  motorical_get_onboarding_state: ['read:domains'],
+  motorical_whoami: [], // any OAuth grant; see ANY_GRANT_TOOLS
   motorical_get_logs: ['read:analytics'],
   motorical_get_message_by_smtp_id: ['read:analytics'],
   motorical_get_config: ['read:domains'],
@@ -189,5 +198,5 @@ const RESOURCE_SCOPES = Object.fromEntries(
 );
 
 module.exports = {
-  MCP_HOST, SERVER_TOOLS, TOOL_SCOPES, scopesForTools, RESOURCE_SCOPES,
+  MCP_HOST, SERVER_TOOLS, TOOL_SCOPES, scopesForTools, RESOURCE_SCOPES, ANY_GRANT_TOOLS,
 };