@occam-scaly/mcp-server 0.1.2

package/README.md

@@ -0,0 +1,166 @@
+# @occam-scaly/mcp-server
+
+Model Context Protocol (MCP) server for Scaly. Connect your AI assistant (Claude, Cursor, etc.) to manage your cloud infrastructure.
+
+## Quick Start
+
+Note: If `@occam-scaly/mcp-server` is not published to npm yet, run it from a local checkout of the Scaly repo (see “Development” below) and point your MCP client at `packages/mcp-server/bin/scaly-mcp.js`.
+
+### 1. Get your API key
+
+Go to **Scaly Dashboard → Settings → Integrations → AI Assistants** and generate:
+
+- **Scaly API key** (`SCALY_API_KEY`)
+- **AppSync API key** (`SCALY_APPSYNC_KEY`, optional for Scaly hosted `prod|dev|qa`)
+
+Optional:
+
+- **OIDC session token** (`SCALY_OIDC_TOKEN`) — required only for DB/S3 tools. Get it from Scaly Dashboard → Settings → Integrations → AI Integrations.
+
+### 2. Configure your AI assistant
+
+**Claude Desktop** - Add to `~/.config/claude/claude_desktop_config.json`:
+
+```json
+{
+  "mcpServers": {
+    "scaly": {
+      "command": "npx",
+      "args": ["-y", "@occam-scaly/mcp-server"],
+      "env": {
+        "SCALY_API_KEY": "sk_live_your_key_here",
+        "SCALY_APPSYNC_KEY": "da2_live_your_key_here (optional for Scaly hosted prod/dev/qa)",
+        "SCALY_OIDC_TOKEN": "eyJ... (optional, enables DB/S3 tools)",
+        "SCALY_STAGE": "prod"
+      }
+    }
+  }
+}
+```
+
+**Claude Code** - Add to your Claude Code MCP settings.
+
+### 3. Restart your AI assistant
+
+The Scaly tools will now be available.
+
+## Available Tools
+
+All tools return **JSON-only** responses (wrapped in MCP `content[].text`).
+
+### Core inventory
+
+- `scaly_status` - Overview of stacks/apps + running deployments
+- `scaly_list_apps` / `scaly_get_app`
+- `scaly_list_stacks` / `scaly_get_stack` (alias: `scaly_list_compute`)
+- `scaly_list_addons` / `scaly_get_addon`
+- `scaly_list_jobs` / `scaly_run_job`
+
+### Deployments & operations
+
+- `scaly_list_deployments` / `scaly_get_deployment` (alias: `scaly_get_deployment_status`)
+- `scaly_deploy_app` (currently implemented as stack service restart)
+- `scaly_restart_stack_services`
+- `scaly_retry_deployment`
+- `scaly_get_operation` / `scaly_wait_operation` / `scaly_get_operation_events`
+
+### Configuration
+
+- `scaly_set_env` (alias: `scaly_set_env_var`) – blocks secret-like keys, never echoes values
+- `scaly_get_env_vars` – returns names only
+
+### Project config
+
+- `scaly_plan` – computes a plan from `.scaly/config.yaml` and returns `plan_hash`
+- `scaly_apply` – applies a plan (requires `plan_hash` and `auto_approve: true`)
+- `scaly_pull` – writes `.scaly/config.yaml` by reverse-engineering live state
+
+### Write tools (imperative)
+
+- `scaly_create_stack` / `scaly_update_stack` / `scaly_delete_stack` (preview-first; delete requires confirm)
+- `scaly_create_database` / `scaly_create_storage` / `scaly_create_user_pool`
+- `scaly_create_app`
+- `scaly_link_addon`
+- `scaly_configure_auth`
+
+Notes:
+
+- Phase 4 intentionally omits add-on updates/resizes, add-on deletion, and unlink operations.
+
+### Logs & diagnostics
+
+- `scaly_get_logs` (unified logs)
+- `scaly_diagnose_app`
+
+### Database & S3 (requires OIDC token)
+
+- `scaly_db_query` / `scaly_db_execute`
+- `scaly_db_migration_plan` / `scaly_db_migrate` / `scaly_db_schema_dump`
+- `scaly_s3_list_objects` / `scaly_s3_download_object`
+- `scaly_s3_upload_object` / `scaly_s3_delete_object` (currently NOT_SUPPORTED)
+
+## Resources
+
+- `scaly://capabilities` (YAML)
+- `scaly://resources-schema` (JSON Schema)
+- `scaly://guides/platform` (Markdown)
+- `scaly://guides/golden-paths` (Markdown)
+- Templates: `scaly://guides/frameworks/{name}`, `scaly://guides/patterns/{name}`, `scaly://apps/{id}`, `scaly://stacks/{id}`
+
+## Example Usage
+
+```
+You: "What apps do I have running?"
+
+Claude: [Calling scaly_list_apps]
+
+        {"success":true,"data":{"apps":[...],"count":3},"meta":{...}}
+```
+
+```
+You: "Deploy ml-api"
+
+Claude: [Calling scaly_deploy_app]
+
+        {"success":true,"data":{"operation_id":"dep_abc123",...},"meta":{...}}
+```
+
+## Environment Variables
+
+| Variable               | Required | Description                                                      |
+| ---------------------- | -------- | ---------------------------------------------------------------- |
+| `SCALY_API_KEY`        | Yes      | Your Scaly API key                                               |
+| `SCALY_APPSYNC_KEY`    | No       | AppSync API key (enables API access; defaults for prod/dev/qa)   |
+| `SCALY_OIDC_TOKEN`     | No       | Cognito access token (enables DB/S3 tools)                       |
+| `SCALY_MCP_AUDIT`      | No       | Enable audit logging (`true` by default; set `false` to disable) |
+| `SCALY_MCP_AUDIT_FILE` | No       | Write audit logs as JSONL to this file path (defaults to stderr) |
+| `SCALY_STAGE`          | No       | `prod` (default), `dev`, `qa` (`staging` alias)                  |
+| `SCALY_API_URL`        | No       | Override API URL                                                 |
+
+## Development
+
+```bash
+# Install dependencies
+npm install
+
+# Run in development mode
+npm run dev
+
+# Build
+npm run build
+
+# Type check
+npm run typecheck
+```
+
+## Security
+
+- API keys are scoped to specific permissions
+- Tool outputs are treated as durable transcripts; avoid returning secrets or credentials
+- Never store API keys in version control
+- Revoke keys immediately if compromised
+
+## Support
+
+- Documentation: https://docs.scaly.cloud/mcp
+- Issues: https://github.com/scaly-cloud/mcp-server/issues

package/bin/scaly-mcp.js

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+
+import('../dist/index.js').catch((err) => {
+  console.error('Failed to start Scaly MCP server:', err.message);
+  process.exit(1);
+});

package/dist/audit.d.ts

@@ -0,0 +1,25 @@
+type AuditKind = 'tool_call' | 'resource_read';
+type AuditEvent = {
+    kind: AuditKind;
+    ts: string;
+    request_id: string;
+    stage?: string;
+    api_url?: string;
+    name?: string;
+    uri?: string;
+    input?: unknown;
+    success: boolean;
+    error_code?: string;
+    duration_ms: number;
+    output?: unknown;
+};
+export declare function createAuditLogger({ stage, apiUrl }: {
+    stage?: string;
+    apiUrl?: string;
+}): {
+    enabled: boolean;
+    logToolCall: (e: Omit<AuditEvent, "kind" | "ts" | "stage" | "api_url">) => void;
+    logResourceRead: (e: Omit<AuditEvent, "kind" | "ts" | "stage" | "api_url">) => void;
+};
+export {};
+//# sourceMappingURL=audit.d.ts.map

package/dist/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAIA,KAAK,SAAS,GAAG,WAAW,GAAG,eAAe,CAAC;AAE/C,KAAK,UAAU,GAAG;IAChB,IAAI,EAAE,SAAS,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAgJF,wBAAgB,iBAAiB,CAAC,EAChC,KAAK,EACL,MAAM,EACP,EAAE;IACD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;;qBAqBoB,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,GAAG,SAAS,CAAC;yBAWjE,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,GAAG,SAAS,CAAC;EAY7D"}

package/dist/audit.js

@@ -0,0 +1,182 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAuditLogger = createAuditLogger;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_crypto_1 = require("node:crypto");
+function parseBoolEnv(value, defaultValue) {
+    if (value === undefined)
+        return defaultValue;
+    const v = value.trim().toLowerCase();
+    if (['1', 'true', 'yes', 'y', 'on'].includes(v))
+        return true;
+    if (['0', 'false', 'no', 'n', 'off'].includes(v))
+        return false;
+    return defaultValue;
+}
+function sha256(text) {
+    return (0, node_crypto_1.createHash)('sha256').update(text).digest('hex');
+}
+function summarizeString(value) {
+    const maxLen = 200;
+    if (value.length <= maxLen)
+        return value;
+    return { truncated: true, length: value.length, sha256: sha256(value) };
+}
+function redactValue(value, keyPath) {
+    const key = keyPath[keyPath.length - 1] || '';
+    const lower = key.toLowerCase();
+    // Always redact env var values and similar.
+    if (lower === 'value')
+        return '[REDACTED]';
+    // Avoid logging SQL or params verbatim (may contain sensitive data).
+    if (lower === 'sql' && typeof value === 'string') {
+        return {
+            redacted: true,
+            bytes: Buffer.byteLength(value, 'utf8'),
+            sha256: sha256(value)
+        };
+    }
+    if (lower === 'params' && Array.isArray(value)) {
+        return value.map((v) => {
+            if (typeof v === 'string') {
+                return {
+                    type: 'string',
+                    bytes: Buffer.byteLength(v, 'utf8'),
+                    sha256: sha256(v)
+                };
+            }
+            if (typeof v === 'number')
+                return { type: 'number' };
+            if (typeof v === 'boolean')
+                return { type: 'boolean' };
+            if (v === null)
+                return { type: 'null' };
+            if (Array.isArray(v))
+                return { type: 'array' };
+            if (typeof v === 'object')
+                return { type: 'object' };
+            return { type: typeof v };
+        });
+    }
+    // Redact common credential-like fields by name (avoid matching "key" which is often non-secret, e.g., S3 object keys).
+    if (/(secret|token|password|credential|authorization|cookie)/i.test(lower)) {
+        return '[REDACTED]';
+    }
+    if (typeof value === 'string')
+        return summarizeString(value);
+    return value;
+}
+function redactObject(value, keyPath = [], depth = 0) {
+    const maxDepth = 6;
+    if (depth > maxDepth)
+        return '[TRUNCATED]';
+    if (Array.isArray(value)) {
+        return value.map((v) => redactObject(v, keyPath, depth + 1));
+    }
+    if (value && typeof value === 'object') {
+        const out = {};
+        for (const [k, v] of Object.entries(value)) {
+            out[k] = redactObject(redactValue(v, [...keyPath, k]), [...keyPath, k], depth + 1);
+        }
+        return out;
+    }
+    return redactValue(value, keyPath);
+}
+function summarizeOutput(value) {
+    if (!value || typeof value !== 'object')
+        return value;
+    const obj = value;
+    // Avoid logging potentially large/sensitive payloads.
+    const denyKeys = new Set([
+        'rows',
+        'events',
+        'logs',
+        'content',
+        'schema',
+        'stdout',
+        'stderr'
+    ]);
+    const allowKeys = new Set([
+        'operation_id',
+        'app_id',
+        'stack_id',
+        'addon_id',
+        'account_id',
+        'output_path',
+        'migration_path',
+        'count',
+        'row_count',
+        'row_count_returned',
+        'row_count_reported',
+        'bytes',
+        'bytes_written',
+        'command',
+        'preview',
+        'dangerous',
+        'reasons',
+        'truncated',
+        'next_cursor',
+        'next_cursor_token',
+        'next_cursor_page_token',
+        'next_page_token',
+        'next_token'
+    ]);
+    const summary = {};
+    for (const [k, v] of Object.entries(obj)) {
+        if (denyKeys.has(k))
+            continue;
+        if (allowKeys.has(k))
+            summary[k] = redactObject(v, [k]);
+    }
+    // If nothing matched, at least return top-level keys (no values).
+    if (Object.keys(summary).length === 0) {
+        return { keys: Object.keys(obj).slice(0, 50) };
+    }
+    return summary;
+}
+function createAuditLogger({ stage, apiUrl }) {
+    const enabled = parseBoolEnv(process.env.SCALY_MCP_AUDIT, true);
+    const filePath = process.env.SCALY_MCP_AUDIT_FILE?.trim() || null;
+    const write = (event) => {
+        if (!enabled)
+            return;
+        const line = JSON.stringify(event);
+        if (filePath) {
+            try {
+                node_fs_1.default.mkdirSync(node_path_1.default.dirname(filePath), { recursive: true });
+                node_fs_1.default.appendFileSync(filePath, line + '\n', 'utf8');
+                return;
+            }
+            catch {
+                // Fall back to stderr if file writing fails.
+            }
+        }
+        console.error(line);
+    };
+    return {
+        enabled,
+        logToolCall: (e) => write({
+            kind: 'tool_call',
+            ts: new Date().toISOString(),
+            stage,
+            api_url: apiUrl,
+            ...e,
+            input: redactObject(e.input),
+            output: summarizeOutput(e.output)
+        }),
+        logResourceRead: (e) => write({
+            kind: 'resource_read',
+            ts: new Date().toISOString(),
+            stage,
+            api_url: apiUrl,
+            ...e,
+            input: redactObject(e.input),
+            output: summarizeOutput(e.output)
+        })
+    };
+}
+//# sourceMappingURL=audit.js.map

package/dist/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":";;;;;AAmKA,8CAkDC;AArND,sDAAyB;AACzB,0DAA6B;AAC7B,6CAAyC;AAmBzC,SAAS,YAAY,CACnB,KAAyB,EACzB,YAAqB;IAErB,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC;IAC7C,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/D,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,MAAM,GAAG,GAAG,CAAC;IACnB,IAAI,KAAK,CAAC,MAAM,IAAI,MAAM;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,OAAiB;IACpD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAEhC,4CAA4C;IAC5C,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,YAAY,CAAC;IAE3C,qEAAqE;IACrE,IAAI,KAAK,KAAK,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACjD,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC;YACvC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC;SACtB,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACrB,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC1B,OAAO;oBACL,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC;oBACnC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;iBAClB,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;YACrD,IAAI,OAAO,CAAC,KAAK,SAAS;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YACvD,IAAI,CAAC,KAAK,IAAI;gBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YACxC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YAC/C,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;YACrD,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,uHAAuH;IACvH,IAAI,0DAA0D,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3E,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;IAC7D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CACnB,KAAc,EACd,UAAoB,EAAE,EACtB,KAAK,GAAG,CAAC;IAET,MAAM,QAAQ,GAAG,CAAC,CAAC;IACnB,IAAI,KAAK,GAAG,QAAQ;QAAE,OAAO,aAAa,CAAC;IAE3C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,CAAC,CAAC,GAAG,YAAY,CACnB,WAAW,CAAC,CAAC,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,EAC/B,CAAC,GAAG,OAAO,EAAE,CAAC,CAAC,EACf,KAAK,GAAG,CAAC,CACV,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAE7C,sDAAsD;IACtD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;QACvB,MAAM;QACN,QAAQ;QACR,MAAM;QACN,SAAS;QACT,QAAQ;QACR,QAAQ;QACR,QAAQ;KACT,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;QACxB,cAAc;QACd,QAAQ;QACR,UAAU;QACV,UAAU;QACV,YAAY;QACZ,aAAa;QACb,gBAAgB;QAChB,OAAO;QACP,WAAW;QACX,oBAAoB;QACpB,oBAAoB;QACpB,OAAO;QACP,eAAe;QACf,SAAS;QACT,SAAS;QACT,WAAW;QACX,SAAS;QACT,WAAW;QACX,aAAa;QACb,mBAAmB;QACnB,wBAAwB;QACxB,iBAAiB;QACjB,YAAY;KACb,CAAC,CAAC;IAEH,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QAC9B,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,kEAAkE;IAClE,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IACjD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAgB,iBAAiB,CAAC,EAChC,KAAK,EACL,MAAM,EAIP;IACC,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAElE,MAAM,KAAK,GAAG,CAAC,KAAiB,EAAE,EAAE;QAClC,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,iBAAE,CAAC,SAAS,CAAC,mBAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC1D,iBAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;gBACjD,OAAO;YACT,CAAC;YAAC,MAAM,CAAC;gBACP,6CAA6C;YAC/C,CAAC;QACH,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC,CAAC;IAEF,OAAO;QACL,OAAO;QACP,WAAW,EAAE,CAAC,CAAwD,EAAE,EAAE,CACxE,KAAK,CAAC;YACJ,IAAI,EAAE,WAAW;YACjB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,KAAK;YACL,OAAO,EAAE,MAAM;YACf,GAAG,CAAC;YACJ,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC;YAC5B,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC;SAClC,CAAC;QACJ,eAAe,EAAE,CACf,CAAwD,EACxD,EAAE,CACF,KAAK,CAAC;YACJ,IAAI,EAAE,eAAe;YACrB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,KAAK;YACL,OAAO,EAAE,MAAM;YACf,GAAG,CAAC;YACJ,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC;YAC5B,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC;SAClC,CAAC;KACL,CAAC;AACJ,CAAC"}

package/dist/client.d.ts

@@ -0,0 +1,16 @@
+import { GraphQLClient } from 'graphql-request';
+import type { Config } from './config.js';
+export declare function initClient(config: Config): GraphQLClient;
+export declare function initOidcClient(config: Config): GraphQLClient | null;
+export declare function getClient(): GraphQLClient;
+export declare function getOidcClient(): GraphQLClient;
+export declare function query<T>(gql: string, variables?: Record<string, unknown>): Promise<T>;
+export declare function oidcQuery<T>(gql: string, variables?: Record<string, unknown>): Promise<T>;
+export declare const FRAGMENTS: {
+    app: string;
+    stack: string;
+    deployment: string;
+    scheduledJob: string;
+    jobRun: string;
+};
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAK1C,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,CAYxD;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAYnE;AAED,wBAAgB,SAAS,IAAI,aAAa,CAKzC;AAED,wBAAgB,aAAa,IAAI,aAAa,CAO7C;AAGD,wBAAsB,KAAK,CAAC,CAAC,EAC3B,GAAG,EAAE,MAAM,EACX,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAClC,OAAO,CAAC,CAAC,CAAC,CAYZ;AAED,wBAAsB,SAAS,CAAC,CAAC,EAC/B,GAAG,EAAE,MAAM,EACX,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAClC,OAAO,CAAC,CAAC,CAAC,CAWZ;AAGD,eAAO,MAAM,SAAS;;;;;;CA8DrB,CAAC"}

package/dist/client.js

@@ -0,0 +1,142 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FRAGMENTS = void 0;
+exports.initClient = initClient;
+exports.initOidcClient = initOidcClient;
+exports.getClient = getClient;
+exports.getOidcClient = getOidcClient;
+exports.query = query;
+exports.oidcQuery = oidcQuery;
+const graphql_request_1 = require("graphql-request");
+let client = null;
+let oidcClient = null;
+function initClient(config) {
+    // Two-key auth:
+    // - x-api-key: AppSync API key (enables API access)
+    // - x-scaly-api-key: User's Scaly API key (for authorization/scopes)
+    client = new graphql_request_1.GraphQLClient(config.apiUrl, {
+        headers: {
+            'x-api-key': config.appSyncApiKey,
+            'x-scaly-api-key': config.scalyApiKey,
+            'Content-Type': 'application/json'
+        }
+    });
+    return client;
+}
+function initOidcClient(config) {
+    if (!config.oidcToken)
+        return null;
+    oidcClient = new graphql_request_1.GraphQLClient(config.apiUrl, {
+        headers: {
+            // OIDC JWT auth for sensitive operations (DB/S3 execution tools)
+            authorization: `Bearer ${config.oidcToken}`,
+            // Keep AppSync key so the endpoint is reachable in all auth-mode configs
+            'x-api-key': config.appSyncApiKey,
+            'Content-Type': 'application/json'
+        }
+    });
+    return oidcClient;
+}
+function getClient() {
+    if (!client) {
+        throw new Error('GraphQL client not initialized. Call initClient first.');
+    }
+    return client;
+}
+function getOidcClient() {
+    if (!oidcClient) {
+        throw new Error('OIDC client not initialized. Set SCALY_OIDC_TOKEN and restart the MCP server.');
+    }
+    return oidcClient;
+}
+// GraphQL query/mutation helpers
+async function query(gql, variables) {
+    const c = getClient();
+    try {
+        return await c.request(gql, variables);
+    }
+    catch (error) {
+        // Extract meaningful error message
+        const message = error?.response?.errors?.[0]?.message ||
+            error?.message ||
+            'Unknown GraphQL error';
+        throw new Error(`Scaly API error: ${message}`);
+    }
+}
+async function oidcQuery(gql, variables) {
+    const c = getOidcClient();
+    try {
+        return await c.request(gql, variables);
+    }
+    catch (error) {
+        const message = error?.response?.errors?.[0]?.message ||
+            error?.message ||
+            'Unknown GraphQL error';
+        throw new Error(`Scaly API error: ${message}`);
+    }
+}
+// Common GraphQL fragments - aligned with actual schema
+exports.FRAGMENTS = {
+    app: `
+    fragment AppFields on App {
+      id
+      name
+      status
+      stackId
+      accountId
+      source
+      createdAt
+      updatedAt
+    }
+  `,
+    stack: `
+    fragment StackFields on Stack {
+      id
+      name
+      status
+      size
+      createdAt
+      updatedAt
+    }
+  `,
+    deployment: `
+    fragment DeploymentFields on Deployment {
+      id
+      status
+      resourceId
+      resourceType
+      createdAt
+      updatedAt
+      metadata
+    }
+  `,
+    scheduledJob: `
+    fragment ScheduledJobFields on ScheduledJob {
+      id
+      name
+      appId
+      command
+      schedule
+      timezone
+      status
+      lastRunAt
+      lastRunStatus
+      nextRunAt
+      createdAt
+      updatedAt
+    }
+  `,
+    jobRun: `
+    fragment JobRunFields on JobRun {
+      id
+      jobId
+      status
+      startedAt
+      finishedAt
+      exitCode
+      error
+      triggeredBy
+    }
+  `
+};
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":";;;AAMA,gCAYC;AAED,wCAYC;AAED,8BAKC;AAED,sCAOC;AAGD,sBAeC;AAED,8BAcC;AAlFD,qDAAgD;AAGhD,IAAI,MAAM,GAAyB,IAAI,CAAC;AACxC,IAAI,UAAU,GAAyB,IAAI,CAAC;AAE5C,SAAgB,UAAU,CAAC,MAAc;IACvC,gBAAgB;IAChB,oDAAoD;IACpD,qEAAqE;IACrE,MAAM,GAAG,IAAI,+BAAa,CAAC,MAAM,CAAC,MAAM,EAAE;QACxC,OAAO,EAAE;YACP,WAAW,EAAE,MAAM,CAAC,aAAa;YACjC,iBAAiB,EAAE,MAAM,CAAC,WAAW;YACrC,cAAc,EAAE,kBAAkB;SACnC;KACF,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,cAAc,CAAC,MAAc;IAC3C,IAAI,CAAC,MAAM,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IACnC,UAAU,GAAG,IAAI,+BAAa,CAAC,MAAM,CAAC,MAAM,EAAE;QAC5C,OAAO,EAAE;YACP,iEAAiE;YACjE,aAAa,EAAE,UAAU,MAAM,CAAC,SAAS,EAAE;YAC3C,yEAAyE;YACzE,WAAW,EAAE,MAAM,CAAC,aAAa;YACjC,cAAc,EAAE,kBAAkB;SACnC;KACF,CAAC,CAAC;IACH,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAgB,SAAS;IACvB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,aAAa;IAC3B,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,iCAAiC;AAC1B,KAAK,UAAU,KAAK,CACzB,GAAW,EACX,SAAmC;IAEnC,MAAM,CAAC,GAAG,SAAS,EAAE,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,CAAC,OAAO,CAAI,GAAG,EAAE,SAAS,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,mCAAmC;QACnC,MAAM,OAAO,GACX,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO;YACrC,KAAK,EAAE,OAAO;YACd,uBAAuB,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,SAAS,CAC7B,GAAW,EACX,SAAmC;IAEnC,MAAM,CAAC,GAAG,aAAa,EAAE,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,CAAC,OAAO,CAAI,GAAG,EAAE,SAAS,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,MAAM,OAAO,GACX,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO;YACrC,KAAK,EAAE,OAAO;YACd,uBAAuB,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED,wDAAwD;AAC3C,QAAA,SAAS,GAAG;IACvB,GAAG,EAAE;;;;;;;;;;;GAWJ;IACD,KAAK,EAAE;;;;;;;;;GASN;IACD,UAAU,EAAE;;;;;;;;;;GAUX;IACD,YAAY,EAAE;;;;;;;;;;;;;;;GAeb;IACD,MAAM,EAAE;;;;;;;;;;;GAWP;CACF,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,24 @@
+import { z } from 'zod';
+declare const ConfigSchema: z.ZodObject<{
+    scalyApiKey: z.ZodString;
+    appSyncApiKey: z.ZodString;
+    oidcToken: z.ZodOptional<z.ZodString>;
+    apiUrl: z.ZodString;
+    stage: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    apiUrl: string;
+    scalyApiKey: string;
+    appSyncApiKey: string;
+    stage?: string | undefined;
+    oidcToken?: string | undefined;
+}, {
+    apiUrl: string;
+    scalyApiKey: string;
+    appSyncApiKey: string;
+    stage?: string | undefined;
+    oidcToken?: string | undefined;
+}>;
+export type Config = z.infer<typeof ConfigSchema>;
+export declare function loadConfig(): Config;
+export {};
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA+BxB,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;EAMhB,CAAC;AAEH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAElD,wBAAgB,UAAU,IAAI,MAAM,CAgDnC"}

package/dist/config.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadConfig = loadConfig;
+const zod_1 = require("zod");
+// Stage-aware configuration
+// AppSync API keys enable API access; Scaly API keys provide authorization/scopes.
+// The MCP AppSync keys are stage-wide and safe to ship as defaults; users can override with SCALY_APPSYNC_KEY.
+const STAGE_CONFIG = {
+    prod: {
+        apiUrl: 'https://api.scalyapps.io/graphql',
+        defaultAppSyncApiKey: 'da2-2veyt7vqrbaqbjio56tcgpbboe'
+    },
+    dev: {
+        apiUrl: 'https://api.dev.scalyapps.io/graphql',
+        defaultAppSyncApiKey: 'da2-ujszvu6uwbenxfbtuy6svpffxi'
+    },
+    qa: {
+        apiUrl: 'https://api.qa.scalyapps.io/graphql',
+        defaultAppSyncApiKey: 'da2-riqkqxfjpjfihewbm4e2buq2xm'
+    }
+};
+function normalizeStage(stage) {
+    const s = (stage || '').trim().toLowerCase();
+    if (!s)
+        return 'prod';
+    if (s === 'production')
+        return 'prod';
+    if (s === 'staging')
+        return 'qa';
+    return s;
+}
+const ConfigSchema = zod_1.z.object({
+    scalyApiKey: zod_1.z.string().min(1, 'SCALY_API_KEY is required'),
+    appSyncApiKey: zod_1.z.string().min(1, 'SCALY_APPSYNC_KEY is required'),
+    oidcToken: zod_1.z.string().optional(),
+    apiUrl: zod_1.z.string().url(),
+    stage: zod_1.z.string().optional()
+});
+function loadConfig() {
+    const scalyApiKey = process.env.SCALY_API_KEY;
+    const oidcToken = process.env.SCALY_OIDC_TOKEN;
+    const apiUrl = process.env.SCALY_API_URL;
+    const stage = normalizeStage(process.env.SCALY_STAGE);
+    if (!scalyApiKey) {
+        console.error('Error: SCALY_API_KEY environment variable is required.\n\n' +
+            'Get your API key from: Scaly Dashboard → Account → Integrations → AI Assistant\n');
+        process.exit(1);
+    }
+    // Determine API URL: explicit > stage-based > prod default
+    const stageConfig = STAGE_CONFIG[stage] || STAGE_CONFIG.prod;
+    const resolvedUrl = apiUrl || stageConfig.apiUrl;
+    const appSyncApiKey = process.env.SCALY_APPSYNC_KEY || stageConfig.defaultAppSyncApiKey;
+    if (!appSyncApiKey) {
+        console.error('Error: SCALY_APPSYNC_KEY environment variable is required.\n\n' +
+            'This is the stage-wide AppSync key for MCP access.\n' +
+            'If you are using the Scaly hosted environments (prod/dev/qa), you can omit SCALY_APPSYNC_KEY.\n');
+        process.exit(1);
+    }
+    const result = ConfigSchema.safeParse({
+        scalyApiKey,
+        appSyncApiKey,
+        oidcToken,
+        apiUrl: resolvedUrl,
+        stage
+    });
+    if (!result.success) {
+        console.error('Configuration error:', result.error.format());
+        process.exit(1);
+    }
+    // Log which endpoint we're using (helps with debugging)
+    if (stage !== 'prod') {
+        console.error(`Using ${stage} environment: ${resolvedUrl}`);
+    }
+    return result.data;
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":";;AAyCA,gCAgDC;AAzFD,6BAAwB;AAExB,4BAA4B;AAC5B,mFAAmF;AACnF,+GAA+G;AAC/G,MAAM,YAAY,GAGd;IACF,IAAI,EAAE;QACJ,MAAM,EAAE,kCAAkC;QAC1C,oBAAoB,EAAE,gCAAgC;KACvD;IACD,GAAG,EAAE;QACH,MAAM,EAAE,sCAAsC;QAC9C,oBAAoB,EAAE,gCAAgC;KACvD;IACD,EAAE,EAAE;QACF,MAAM,EAAE,qCAAqC;QAC7C,oBAAoB,EAAE,gCAAgC;KACvD;CACF,CAAC;AAEF,SAAS,cAAc,CAAC,KAAyB;IAC/C,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7C,IAAI,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IACtB,IAAI,CAAC,KAAK,YAAY;QAAE,OAAO,MAAM,CAAC;IACtC,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,YAAY,GAAG,OAAC,CAAC,MAAM,CAAC;IAC5B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,2BAA2B,CAAC;IAC3D,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,+BAA+B,CAAC;IACjE,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACxB,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH,SAAgB,UAAU;IACxB,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IACzC,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAEtD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,CAAC,KAAK,CACX,4DAA4D;YAC1D,kFAAkF,CACrF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,2DAA2D;IAC3D,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC;IAC7D,MAAM,WAAW,GAAG,MAAM,IAAI,WAAW,CAAC,MAAM,CAAC;IACjD,MAAM,aAAa,GACjB,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,WAAW,CAAC,oBAAoB,CAAC;IAEpE,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,CAAC,KAAK,CACX,gEAAgE;YAC9D,sDAAsD;YACtD,iGAAiG,CACpG,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC;QACpC,WAAW;QACX,aAAa;QACb,SAAS;QACT,MAAM,EAAE,WAAW;QACnB,KAAK;KACN,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,wDAAwD;IACxD,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO,CAAC,KAAK,CAAC,SAAS,KAAK,iBAAiB,WAAW,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC"}