@noresponse/mcp 0.5.4 → 0.5.6

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 0.5.6
+
+* `SDK.assessments.create()`:  `response.account.risk.reasons[].code` **Changed** (Breaking ⚠️)
+* `SDK.assessments.get()`:  `response.account.risk.reasons[].code` **Changed** (Breaking ⚠️)
+* `SDK.assessments.query()`:  `response.items[].risk.reasons[].code` **Changed** (Breaking ⚠️)
+* `SDK.accounts.listChanged()`:  `response.items[].risk.reasons[].code` **Changed** (Breaking ⚠️)
+* `SDK.accounts.get()`:  `response.risk.reasons[].code` **Changed** (Breaking ⚠️)
+* `SDK.accounts.listAssessments()`:  `response.items[].risk.reasons[].code` **Changed** (Breaking ⚠️)
+
+## 0.5.5
+
+* `SDK.integrations.create()`: 
+  *  `request.platform.enum(supabase)` **Added**
+  *  `response.platform.enum(supabase)` **Added** (Breaking ⚠️)
+* `SDK.integrations.list()`:  `response.items[].platform.enum(supabase)` **Added** (Breaking ⚠️)
+* `SDK.integrations.rotate()`:  `response.platform.enum(supabase)` **Added** (Breaking ⚠️)
+
 ## 0.5.4
 
 * `SDK.assessments.create()`:  `response.account.risk.reasons[].code` **Changed** (Breaking ⚠️)

package/bin/mcp-server.js

@@ -48104,9 +48104,9 @@ var init_config = __esm(() => {
   SDK_METADATA = {
     language: "typescript",
     openapiDocVersion: "1",
-    sdkVersion: "0.5.4",
+    sdkVersion: "0.5.6",
     genVersion: "internal",
-    userAgent: "noresponse-sdk/mcp-typescript 0.5.4 internal 1 @noresponse/mcp"
+    userAgent: "noresponse-sdk/mcp-typescript 0.5.6 internal 1 @noresponse/mcp"
   };
 });
 
@@ -50318,7 +50318,13 @@ var init_reasoncode = __esm(() => {
     "email_domain_no_mx",
     "email_domain_nonexistent",
     "forum_sanctioned",
-    "prior_payment_abuse"
+    "prior_payment_abuse",
+    "ip_history_match",
+    "identity_attribute_conflict",
+    "impossible_identity_age",
+    "breach_shared_ip",
+    "nationality_mismatch",
+    "minor_identity"
   ]).describe("A stable reason code. New codes may appear; ignore any you do not know.");
 });
 
@@ -50569,7 +50575,7 @@ var init_breachselector = __esm(() => {
     "email",
     "username",
     "ip"
-  ]).describe("The submitted identifier a breach table matched on: email or username. Phone and name are not breach selectors.");
+  ]).describe("The submitted email or username whose own search matched the table. A submitted full name is searched as well, and what it finds feeds the identity's reasons rather than this list.");
 });
 
 // src/models/breach.ts
@@ -50584,7 +50590,7 @@ var init_breach = __esm(() => {
     domain: string2().optional().describe("The breached site's domain, lower case. Absent when the table has none (a credential list, for example)."),
     exposed: array(BreachExposed$zodSchema).optional(),
     kind: BreachKind$zodSchema.describe("Who is in the table: site_breach, a site's own users; credential_list, a combolist or compilation; stealer_log, malware or botnet victims; scrape; hacking_forum, a criminal hacking, cracking or carding community; abuse_service, the customers of DDoS-for-hire, account generators, dump or card shops, darknet markets, stalkerware or breach-lookup services; darkweb_site, an onion site of unknown purpose."),
-    matched_on: BreachSelector$zodSchema.describe("The submitted identifier a breach table matched on: email or username. Phone and name are not breach selectors."),
+    matched_on: BreachSelector$zodSchema.describe("The submitted email or username whose own search matched the table. A submitted full name is searched as well, and what it finds feeds the identity's reasons rather than this list."),
     month: int().optional().describe("Absent when only the year is known."),
     name: string2(),
     year: int().optional().describe("A breach table's date year.")
@@ -52864,7 +52870,7 @@ var init_assessmentrequestidentifiers = __esm(() => {
   AssessmentRequestIdentifiers$zodSchema = object({
     email: string2().optional().describe("One address: a 1 to 64 character local part without whitespace, angle brackets, control or invisible characters, '@', and a domain with a letter TLD. Send an internationalised domain in punycode. Nothing is trimmed. The local part keeps its case and the domain is lower-cased; no alias rewriting ('+tag', dots or provider heuristics) is applied."),
     ip: string2().optional().describe("The account_creation's client IP address: an IPv4 dotted quad without leading zeros, or an IPv6 address in its RFC 5952 text form (lower case, no leading zeros, the longest zero run compressed). Send an IPv4 client as a dotted quad, not IPv4-mapped. No zone, port or prefix. The server refuses a non-canonical IPv6 spelling, and every private, loopback, link-local, multicast, documentation or otherwise reserved address (the IANA special-purpose registries), with 400: only a public address says anything about a signup."),
-    name: string2().optional().describe("The full name as the user typed it, 1 to 128 characters with no control or invisible characters. It is used only to match names in the evidence."),
+    name: string2().optional().describe("The full name as the user typed it, 1 to 128 characters with no control or invisible characters. It is searched in breach data and matched against names in the evidence. A row holding the signup's own email or username confirms the name; rows sharing another identifier add to the identity's history."),
     phone: string2().optional().describe("Strict E.164: '+', then 8 to 15 digits, the first not 0, with no separators. Phone evidence is gathered asynchronously, so a phone-only request answers 202 pending and the phone is listed in incomplete_sources on the synchronous answer."),
     username: string2().optional().describe("The handle the account is signing up with: 1 to 64 characters, no whitespace, control or invisible characters, and not a credential hash or token. Echoed as received; compared case-insensitively.")
   }).describe("At least one of email, username or phone. name and ip refine the match and travel beside a lookup identifier; a body with only name or ip is refused with 400.");
@@ -53691,7 +53697,8 @@ var init_integrationplatform = __esm(() => {
   init_zod();
   IntegrationPlatform$zodSchema = _enum([
     "workos",
-    "auth0"
+    "auth0",
+    "supabase"
   ]).describe("The authentication provider that calls the endpoint.");
 });
 
@@ -53702,10 +53709,10 @@ var init_integrationrequest = __esm(() => {
   init_integrationhookpoint();
   init_integrationplatform();
   IntegrationRequest$zodSchema = object({
-    hook_points: array(IntegrationHookPoint$zodSchema).optional().describe("The provider events the endpoint scores. Default both: pre_registration (WorkOS user registration Action, Auth0 pre-user-registration trigger) and post_login (WorkOS authentication Action, Auth0 post-login trigger). An event that is not listed is answered allow without an assessment."),
+    hook_points: array(IntegrationHookPoint$zodSchema).optional().describe("The provider events the endpoint scores. Default every hook point the platform has: pre_registration (WorkOS user registration Action, Auth0 pre-user-registration trigger, Supabase Before User Created hook) and post_login (WorkOS authentication Action, Auth0 post-login trigger). Supabase has only pre_registration, so a Supabase integration that lists post_login is refused. An event that is not listed is answered allow without an assessment."),
     platform: IntegrationPlatform$zodSchema.describe("The authentication provider that calls the endpoint."),
-    signing_secret: string2().optional().describe("The WorkOS Actions signing secret, as the WorkOS dashboard shows it: 16 to 256 printable ASCII characters with no spaces. It is stored sealed and is not returned.")
-  }).describe("POST /v1/integrations body. Registers a hosted endpoint for one authentication provider. The workspace is the API key that signs the request, so the body has no workspace field and refuses one like any other unknown member. A WorkOS integration needs signing_secret, the Actions secret shown in the WorkOS dashboard, which NoResponse uses to verify each Action request and to sign its answer. An Auth0 integration sends no signing_secret: NoResponse generates the shared secret and returns it once.");
+    signing_secret: string2().optional().describe("The WorkOS Actions signing secret or the Supabase hook secret, as the provider's dashboard shows it: 16 to 256 printable ASCII characters with no spaces. It is stored sealed and is not returned.")
+  }).describe("POST /v1/integrations body. Registers a hosted endpoint for one authentication provider. The workspace is the API key that signs the request, so the body has no workspace field and refuses one like any other unknown member. A WorkOS integration needs signing_secret, the Actions secret shown in the WorkOS dashboard, which NoResponse uses to verify each Action request and to sign its answer. A Supabase integration needs signing_secret, the hook secret Supabase generates for a Before User Created HTTPS hook (v1,whsec_ and base64), which NoResponse uses to verify each call. An Auth0 integration sends no signing_secret: NoResponse generates the shared secret and returns it once.");
 });
 
 // src/funcs/integrationsCreate.ts
@@ -53788,7 +53795,7 @@ var init_integrationsCreate2 = __esm(() => {
     name: "create_integration",
     description: `Register a hosted provider integration.
 
-Registers a WorkOS or Auth0 integration and returns its hosted endpoint, url, so a sign-up or sign-in is scored with no server of your own. For WorkOS, send the Actions signing secret from the WorkOS dashboard and point the user registration and authentication Actions at url. For Auth0, the answer's secret is the shared secret of the NoResponse Auth0 Action, shown once: store it as an Action secret. hook_points defaults to both pre_registration and post_login; an event that is not listed is allowed without an assessment. The endpoint waits for the full assessment for at most 2.5 seconds (WorkOS) or 4.5 seconds (Auth0), denies only when risk.block is true and allows on any failure. Requires the integrations scope; at most 10 per account. Not idempotent: a retry after a lost answer registers another integration.`,
+Registers a WorkOS, Auth0 or Supabase integration and returns its hosted endpoint, url, so a sign-up or sign-in is scored with no server of your own. For WorkOS, send the Actions signing secret from the WorkOS dashboard and point the user registration and authentication Actions at url. For Supabase, send the hook secret Supabase generates (v1,whsec_...) and set url as the Before User Created hook's HTTPS endpoint. For Auth0, the answer's secret is the shared secret of the NoResponse Auth0 Action, shown once: store it as an Action secret. hook_points defaults to every hook point the platform has (Supabase has only pre_registration); an event that is not listed is allowed without an assessment. The endpoint waits for the full assessment for at most 2.5 seconds (WorkOS, Supabase) or 4.5 seconds (Auth0), denies only when risk.block is true and allows on any failure. Requires the integrations scope; at most 10 per account. Not idempotent: a retry after a lost answer registers another integration.`,
     annotations: {
       title: "Register a hosted provider integration",
       destructiveHint: false,
@@ -54086,8 +54093,8 @@ var IntegrationRotationRequest$zodSchema;
 var init_integrationrotationrequest = __esm(() => {
   init_zod();
   IntegrationRotationRequest$zodSchema = object({
-    signing_secret: string2().optional().describe("The WorkOS Actions signing secret, as the WorkOS dashboard shows it: 16 to 256 printable ASCII characters with no spaces. It is stored sealed and is not returned.")
-  }).describe("POST /v1/integrations/{integration_id}/rotate body. For an Auth0 integration send {}: NoResponse generates a new shared secret and returns it once. For a WorkOS integration send the new signing_secret after regenerating it in the WorkOS dashboard. Either way the previous secret is still accepted for 24 hours, so the provider can be switched over without a refused call.");
+    signing_secret: string2().optional().describe("The WorkOS Actions signing secret or the Supabase hook secret, as the provider's dashboard shows it: 16 to 256 printable ASCII characters with no spaces. It is stored sealed and is not returned.")
+  }).describe("POST /v1/integrations/{integration_id}/rotate body. For an Auth0 integration send {}: NoResponse generates a new shared secret and returns it once. For a WorkOS or Supabase integration send the new signing_secret after regenerating it in the provider's dashboard. Either way the previous secret is still accepted for 24 hours, so the provider can be switched over without a refused call.");
 });
 
 // src/models/rotateintegrationsecretop.ts
@@ -54215,7 +54222,7 @@ var init_integrationsRotate2 = __esm(() => {
     name: "rotate_integration_secret",
     description: `Replace an integration's secret.
 
-For Auth0, send {} and the answer's secret is the new shared secret, shown once. For WorkOS, regenerate the Actions secret in the WorkOS dashboard and send it as signing_secret. The replaced secret is still accepted for 24 hours (previous_secret_expires_at). Requires the integrations scope. Not idempotent: a retry after a lost answer rotates again.`,
+For Auth0, send {} and the answer's secret is the new shared secret, shown once. For WorkOS, regenerate the Actions secret in the WorkOS dashboard and send it as signing_secret; for Supabase, generate a new hook secret in the Supabase dashboard and send it as signing_secret. The replaced secret is still accepted for 24 hours (previous_secret_expires_at). Requires the integrations scope. Not idempotent: a retry after a lost answer rotates again.`,
     annotations: {
       title: "Rotate a hosted provider integration's signing secret",
       destructiveHint: false,
@@ -56219,7 +56226,7 @@ endpoint.verification sends a signed challenge now and answers whether the endpo
 function createMCPServer(deps) {
   const server = new McpServer({
     name: "NoResponse",
-    version: "0.5.4"
+    version: "0.5.6"
   });
   const getClient = deps.getSDK || (() => new NoResponseCore({
     security: deps.security,
@@ -56383,7 +56390,7 @@ Revokes a key of the signing key's environment at once: its next request answers
       name: "create_integration",
       description: `Register a hosted provider integration.
 
-Registers a WorkOS or Auth0 integration and returns its hosted endpoint, url, so a sign-up or sign-in is scored with no server of your own. For WorkOS, send the Actions signing secret from the WorkOS dashboard and point the user registration and authentication Actions at url. For Auth0, the answer's secret is the shared secret of the NoResponse Auth0 Action, shown once: store it as an Action secret. hook_points defaults to both pre_registration and post_login; an event that is not listed is allowed without an assessment. The endpoint waits for the full assessment for at most 2.5 seconds (WorkOS) or 4.5 seconds (Auth0), denies only when risk.block is true and allows on any failure. Requires the integrations scope; at most 10 per account. Not idempotent: a retry after a lost answer registers another integration.`
+Registers a WorkOS, Auth0 or Supabase integration and returns its hosted endpoint, url, so a sign-up or sign-in is scored with no server of your own. For WorkOS, send the Actions signing secret from the WorkOS dashboard and point the user registration and authentication Actions at url. For Supabase, send the hook secret Supabase generates (v1,whsec_...) and set url as the Before User Created hook's HTTPS endpoint. For Auth0, the answer's secret is the shared secret of the NoResponse Auth0 Action, shown once: store it as an Action secret. hook_points defaults to every hook point the platform has (Supabase has only pre_registration); an event that is not listed is allowed without an assessment. The endpoint waits for the full assessment for at most 2.5 seconds (WorkOS, Supabase) or 4.5 seconds (Auth0), denies only when risk.block is true and allows on any failure. Requires the integrations scope; at most 10 per account. Not idempotent: a retry after a lost answer registers another integration.`
     },
     {
       name: "list_integrations",
@@ -56401,7 +56408,7 @@ Removes the integration and its secrets; its endpoint answers 404 from then on,
       name: "rotate_integration_secret",
       description: `Replace an integration's secret.
 
-For Auth0, send {} and the answer's secret is the new shared secret, shown once. For WorkOS, regenerate the Actions secret in the WorkOS dashboard and send it as signing_secret. The replaced secret is still accepted for 24 hours (previous_secret_expires_at). Requires the integrations scope. Not idempotent: a retry after a lost answer rotates again.`
+For Auth0, send {} and the answer's secret is the new shared secret, shown once. For WorkOS, regenerate the Actions secret in the WorkOS dashboard and send it as signing_secret; for Supabase, generate a new hook secret in the Supabase dashboard and send it as signing_secret. The replaced secret is still accepted for 24 hours (previous_secret_expires_at). Requires the integrations scope. Not idempotent: a retry after a lost answer rotates again.`
     },
     {
       name: "list_webhook_endpoints",
@@ -64956,7 +64963,7 @@ var routes = buildRouteMap({
 var app = buildApplication(routes, {
   name: "mcp",
   versionInfo: {
-    currentVersion: "0.5.4"
+    currentVersion: "0.5.6"
   }
 });
 run(app, process3.argv.slice(2), buildContext(process3));
@@ -64964,5 +64971,5 @@ export {
   app
 };
 
-//# debugId=E832E0D7E32B5D3864756E2164756E21
+//# debugId=6A4CD5F41543A1EB64756E2164756E21
 //# sourceMappingURL=mcp-server.js.map