@nonbot/mcp 0.2.2 → 0.2.3

package/README.md

@@ -205,6 +205,14 @@ The supervisor surface: what the daemon and the fleet are doing, plus the three
 | `run_snapshot_request` | Ask the operator's daemon to capture the last lines of a RUNNING run's terminal pane (secrets scrubbed, 16KB tail cap, stored server-side for 5 minutes only). | write | `runs:control` |
 | `run_prompt_answer` | Answer a mid-run prompt on the operator's behalf — the daemon types the answer into the live pane. | destructive | `runs:respond` (explicit; a wildcard token does not satisfy it) |
 | `run_stop_daemon` | The panic button — queue a remote shutdown for the operator's daemon (CLI ≥0.9.12). | destructive | `runs:control` |
+
+### radBUGS (1)
+
+File a bug straight into the radBUGS inbox, stamped as filed from MCP.
+
+| Tool | What it does | Kind | PAT scope |
+|---|---|---|---|
+| `radbug_file` | File a bug report into the non.bot radBUGS inbox, stamped as filed from MCP. | write | `radbugs:write` |
 <!-- tool-table:end -->
 
 **Kind** is the tool's MCP annotation: *read* tools never change anything; *destructive* tools are confirm-gated (`portfolio_update` on large removals, `run_prompt_answer`, `run_stop_daemon`). `NON_BOT_MCP_READONLY=1` drops every non-read tool.
@@ -234,7 +242,7 @@ Safety rails on writes: `portfolio_update` pre-fetches the live version, backs t
 - `core/http.ts` — token-bound fetch wrapper
 - `core/validate.ts` — pre-flight graph validation
 - `core/server.ts` — `registerAll(server, ctx)` (the transport-agnostic heart) + `createNonbotMcpServer(ctx)`
-- `core/toolsets/{portfolio,whygraph,run,monitor,ip}.ts`, `core/resources.ts`, `core/prompts.ts`
+- `core/toolsets/{portfolio,whygraph,run,monitor,ip,radbugs}.ts`, `core/resources.ts`, `core/prompts.ts`
 - `src/stdio.ts` — the `nonbot-mcp` bin: env/CLI-auth token + filesystem backup hook
 - `scripts/gen-tool-table.mjs` — prints the tool tables above from the live definitions (`--portfolio-mcp` does the same for the legacy server)
 

package/dist/core/server.d.ts

@@ -1,7 +1,7 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import type { ApiContext } from './config.js';
 export declare const SERVER_NAME = "nonbot-mcp";
-export declare const SERVER_VERSION = "0.2.2";
+export declare const SERVER_VERSION = "0.2.3";
 export declare const INSTRUCTIONS: string;
 export declare function registerAll(server: McpServer, ctx: ApiContext): void;
 export declare function createNonbotMcpServer(ctx: ApiContext): McpServer;

package/dist/core/server.js

@@ -5,10 +5,11 @@ import { registerBuildTools } from './toolsets/build.js';
 import { registerWhygraphTools } from './toolsets/whygraph.js';
 import { registerRunTools } from './toolsets/run.js';
 import { registerMonitorTools } from './toolsets/monitor.js';
+import { registerRadbugsTools } from './toolsets/radbugs.js';
 import { registerResources } from './resources.js';
 import { registerPrompts } from './prompts.js';
 export const SERVER_NAME = 'nonbot-mcp';
-export const SERVER_VERSION = '0.2.2';
+export const SERVER_VERSION = '0.2.3';
 export const INSTRUCTIONS = [
     'non.bot MCP — work against the caller’s real product-management data, not a copy.',
     'Two domains: PORTFOLIOS (the SAFe portfolio canvas — epics → features → stories) and',
@@ -28,6 +29,7 @@ export const INSTRUCTIONS = [
     'tokens with the explicit runs:respond scope only).',
     'IP NODES: ip_list / ip_get read a patent or trademark disclosure; ip_update edits it (op list + expected_version);',
     'ip_evidence_add adds evidence the SERVER hashes, timestamps and numbers — never send a hash or a time.',
+    'RADBUGS: radbug_file files a bug into the non.bot radBUGS inbox (needs the radbugs:write scope).',
 ].join(' ');
 export function registerAll(server, ctx) {
     registerPortfolioTools(server, ctx);
@@ -36,6 +38,7 @@ export function registerAll(server, ctx) {
     registerWhygraphTools(server, ctx);
     registerRunTools(server, ctx);
     registerMonitorTools(server, ctx);
+    registerRadbugsTools(server, ctx);
     registerResources(server, ctx);
     registerPrompts(server, ctx);
 }

package/dist/core/toolsets/radbugs.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { ApiContext } from '../config.js';
+export declare function registerRadbugsTools(server: McpServer, ctx: ApiContext): void;

package/dist/core/toolsets/radbugs.js

@@ -0,0 +1,50 @@
+import { z } from 'zod';
+import { api, expectJson } from '../http.js';
+const SCOPE_MESSAGE = 'This token needs the radbugs:write scope (or the account needs radBUGS access).';
+async function forbiddenText(res) {
+    let reason = '';
+    try {
+        const j = (await res.json());
+        const m = j && typeof j === 'object' ? (j.message ?? j.error) : undefined;
+        if (typeof m === 'string' && m.trim())
+            reason = m.trim().slice(0, 300);
+    }
+    catch {
+    }
+    return reason ? `${SCOPE_MESSAGE} Server said: ${reason}` : SCOPE_MESSAGE;
+}
+function textResult(data) {
+    return { content: [{ type: 'text', text: JSON.stringify(data, null, 2) }] };
+}
+export function registerRadbugsTools(server, ctx) {
+    if (ctx.readonly)
+        return;
+    server.registerTool('radbug_file', {
+        title: 'File a radBUG',
+        description: 'File a bug report into the non.bot radBUGS inbox, stamped as filed from MCP. Give a short title; add a description (steps, expected vs actual), the product area, a priority, and the page URL when known. Returns the created inbox item. Requires the radbugs:write scope and an account with radBUGS access.',
+        inputSchema: {
+            title: z.string().min(1).max(500).describe('Short summary of the bug.'),
+            description: z.string().max(20000).optional().describe('Steps to reproduce, expected vs actual, context.'),
+            area: z.string().max(80).optional().describe('Product area, e.g. "portfolio" or "radmeeting".'),
+            priority: z.enum(['low', 'med', 'high']).optional().describe('How urgent it is.'),
+            page_url: z.string().max(2048).optional().describe('The page the bug was seen on.'),
+        },
+        annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
+    }, async (a) => {
+        const body = { title: a.title };
+        if (a.description !== undefined)
+            body.description = a.description;
+        if (a.area !== undefined)
+            body.area = a.area;
+        if (a.priority !== undefined)
+            body.priority = a.priority;
+        if (a.page_url !== undefined)
+            body.page_url = a.page_url;
+        body.client = 'mcp';
+        const res = await api(ctx, '/api/admin/radbugs', { method: 'POST', body: JSON.stringify(body) });
+        if (res.status === 403) {
+            return { content: [{ type: 'text', text: await forbiddenText(res) }], isError: true };
+        }
+        return textResult(await expectJson(res, 'POST /api/admin/radbugs'));
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nonbot/mcp",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "type": "module",
   "description": "The non.bot MCP server — one server for your portfolios, decision graph, and Runs. Runs over stdio (Claude Code, Cursor, VS Code) with a pat_ token. Built on MCP protocol 2025-11-25.",
   "keywords": [