@nexusbloom/mcp-server 1.0.3 → 2.0.2

package/src/validate.js

@@ -0,0 +1,104 @@
+/**
+ * Input validation — delegated to @nexusbloom/core so an agent is told the
+ * same thing the CLI tells a human.
+ *
+ * Validating before the request is not just politeness: it saves a round trip,
+ * and it turns a 400 into an error the agent can act on immediately because the
+ * message names the exact field and what was expected.
+ *
+ * The API remains the authority. This layer only rejects input that core has
+ * proven invalid, so a false positive here would block a call that would have
+ * succeeded — the check is therefore advisory-silent on anything it cannot
+ * prove wrong.
+ */
+
+import { validateInput } from "@nexusbloom/core/types";
+import { ErrorCode, NexusBloomError } from "./errors.js";
+
+/**
+ * Validate params against a tool's input schema.
+ *
+ * @param {object} params
+ * @param {object} inputSchema
+ * @param {string} slug
+ * @throws {NexusBloomError} VALIDATION_FAILED, carrying per-field detail.
+ */
+export function assertValidInput(params, inputSchema, slug) {
+  const schema = inputSchema && typeof inputSchema === "object" ? inputSchema : null;
+
+  // No schema means the API is the only validator available; defer rather than
+  // reject a call that might legitimately succeed.
+  if (!schema || !schema.properties || Object.keys(schema.properties).length === 0) {
+    if (Array.isArray(schema?.required) && schema.required.length > 0) {
+      const missing = schema.required.filter((k) => params?.[k] === undefined || params?.[k] === null);
+      if (missing.length) {
+        throw new NexusBloomError(
+          `Missing required ${missing.length === 1 ? "parameter" : "parameters"} for "${slug}": ${missing.join(", ")}`,
+          ErrorCode.VALIDATION_FAILED,
+          { details: { missing } },
+        );
+      }
+    }
+    return params;
+  }
+
+  // core returns `[]` when valid. A null/undefined return would mean it could
+  // not decide, which must not be read as a pass or a failure.
+  let errors;
+  try {
+    errors = validateInput(params, schema);
+  } catch {
+    return params; // validator itself failed — defer to the API
+  }
+  if (!Array.isArray(errors)) return params;
+  if (errors.length === 0) return params;
+
+  // core returns `{ field, error }` objects, not strings. Joining them raw
+  // produces "[object Object]", which tells an agent nothing about what to fix.
+  const described = errors.map((e) =>
+    e && typeof e === "object"
+      ? `${e.field ?? "input"}: ${e.error ?? "invalid"}`
+      : String(e),
+  );
+
+  const missing = (Array.isArray(schema.required) ? schema.required : []).filter(
+    (k) => params?.[k] === undefined || params?.[k] === null,
+  );
+
+  throw new NexusBloomError(
+    `Invalid input for "${slug}": ${described.join("; ")}`,
+    ErrorCode.VALIDATION_FAILED,
+    { details: { errors: described, missing } },
+  );
+}
+
+/**
+ * Coerce params that arrived as a JSON string.
+ *
+ * Some hosts serialise object arguments to a string. Rejecting that would fail
+ * a call that is well-formed underneath, so a parseable string is unwrapped and
+ * a genuinely unparseable one is reported rather than passed through to the API
+ * as a bare string body.
+ */
+export function coerceParams(params, slug) {
+  if (typeof params !== "string") return params ?? {};
+  const trimmed = params.trim();
+  if (!trimmed) return {};
+
+  let parsed;
+  try {
+    parsed = JSON.parse(trimmed);
+  } catch {
+    throw new NexusBloomError(
+      `"params" for "${slug}" was a string but is not valid JSON. Pass an object, e.g. {"key": "value"}.`,
+      ErrorCode.INVALID_ARGS,
+    );
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new NexusBloomError(
+      `"params" for "${slug}" must be a JSON object, got ${Array.isArray(parsed) ? "an array" : typeof parsed}.`,
+      ErrorCode.INVALID_ARGS,
+    );
+  }
+  return parsed;
+}

package/test-mcp-client.mjs

@@ -1,104 +0,0 @@
-#!/usr/bin/env node
-/**
- * MCP Server Test — uses the MCP SDK Client directly.
- * Tests both direct slug execution and meta-tool paths.
- *
- * Usage: node test-mcp-client.mjs
- */
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
-
-async function main() {
-  console.log("═══ MCP Server Test ═══\n");
-
-  const transport = new StdioClientTransport({
-    command: "npx",
-    args: ["@nexusbloom/mcp-server"],
-  });
-
-  const client = new Client(
-    { name: "mcp-test-client", version: "1.0.0" },
-    { capabilities: {} }
-  );
-
-  await client.connect(transport);
-  console.log("✅ Connected to MCP server\n");
-
-  // ── Test 1: ListTools ─────────────────────────────────────────
-  const { tools } = await client.listTools();
-  console.log(`✅ Tools available: ${tools.length}`);
-  const slugs = tools.filter((t) => t.name !== "nexusbloom").map((t) => t.name);
-  const metaTool = tools.find((t) => t.name === "nexusbloom");
-  if (metaTool) console.log(`✅ Meta-tool "nexusbloom" registered`);
-  console.log(`   Example tools: ${slugs.slice(0, 5).join(", ")}...`);
-  console.log();
-
-  // ── Test 2: Direct slug execution ─────────────────────────────
-  // AI agents call tools by their slug name directly
-  console.log("── Test: Direct slug execution ──");
-  const cronResult = await client.callTool({
-    name: "cron-expression-builder",
-    arguments: { expression: "0 0 * * *" },
-  });
-  const cronText = cronResult.content.find((c) => c.type === "text")?.text || "";
-  if (cronText.includes(`"valid": true`)) {
-    console.log("✅ cron-expression-builder executed directly by slug");
-    console.log(`   → ${cronText.split("\n")[1] || "valid=true"}`);
-  } else {
-    console.log(`⚠  Unexpected: ${cronText.substring(0, 100)}`);
-  }
-
-  const dataResult = await client.callTool({
-    name: "data-generator",
-    arguments: { count: 2 },
-  });
-  const dataText = dataResult.content.find((c) => c.type === "text")?.text || "";
-  if (dataText.includes("data-generator")) {
-    console.log("✅ data-generator executed directly by slug");
-  }
-  console.log();
-
-  // ── Test 3: Meta-tool "list" ──────────────────────────────────
-  console.log("── Test: Meta-tool list ──");
-  const listResult = await client.callTool({
-    name: "nexusbloom",
-    arguments: { command: "list" },
-  });
-  const listText = listResult.content.find((c) => c.type === "text")?.text || "";
-  if (listText.includes("NexusBloom Tools")) {
-    console.log("✅ Meta-tool list works");
-  }
-  console.log();
-
-  // ── Test 4: Meta-tool "schema" ────────────────────────────────
-  console.log("── Test: Meta-tool schema ──");
-  const schemaResult = await client.callTool({
-    name: "nexusbloom",
-    arguments: { command: "schema", slug: "cron-expression-builder" },
-  });
-  const schemaText = schemaResult.content.find((c) => c.type === "text")?.text || "";
-  if (schemaText.includes("Cron Expression Builder")) {
-    console.log("✅ Meta-tool schema works");
-  }
-  console.log();
-
-  // ── Test 5: Meta-tool "run" ───────────────────────────────────
-  console.log("── Test: Meta-tool run ──");
-  const runResult = await client.callTool({
-    name: "nexusbloom",
-    arguments: { command: "run", slug: "data-generator", params: { count: 3 } },
-  });
-  const runText = runResult.content.find((c) => c.type === "text")?.text || "";
-  if (runText.includes("data-generator")) {
-    console.log("✅ Meta-tool run works");
-  }
-  console.log();
-
-  await client.close();
-  console.log("═══ All MCP tests passed! ═══");
-}
-
-main().catch((err) => {
-  console.error("❌ MCP test failed:", err.message);
-  process.exit(1);
-});