@oneentry/mcp-platform-server 0.1.4 → 0.1.6

package/dist/bin/cli.js

@@ -19,6 +19,11 @@ Options
   --request-timeout <ms>  per-request timeout, default 30000
   --max-response-bytes <n> response cap handed to the model, default 24576
 
+File uploads (cms_upload_file, cms_import_file_from_url)
+  --upload-root <dir>     directory cms_upload_file may read from, default the working directory
+  --upload-max-bytes <n>  size limit of one upload, default 26214400
+  --upload-allowed-hosts a,b  hosts cms_import_file_from_url may fetch from; required in remote mode
+
 Knowledge (documentation is fetched from GitHub, not bundled)
   --knowledge-repo <o/n>  knowledge repository, default ONEENTRY-PLATFORM/oneentry-platform-rules
   --knowledge-ref <ref>   branch, tag or commit, default main
@@ -31,7 +36,8 @@ Environment
   ONEENTRY_CMS_LOGIN, ONEENTRY_CMS_PASSWORD, ONEENTRY_CMS_TOKEN, ONEENTRY_CMS_BASE_URL, ONEENTRY_MCP_ALLOW,
   ONEENTRY_MCP_AUDIT_PATH, ONEENTRY_MCP_PORT, ONEENTRY_MCP_HOST, ONEENTRY_MCP_CACHE_DIR,
   ONEENTRY_MCP_KNOWLEDGE_REPO, ONEENTRY_MCP_KNOWLEDGE_REF, ONEENTRY_MCP_KNOWLEDGE_PATH,
-  ONEENTRY_MCP_KNOWLEDGE_TTL_MS, ONEENTRY_MCP_OFFLINE, ONEENTRY_GITHUB_TOKEN
+  ONEENTRY_MCP_KNOWLEDGE_TTL_MS, ONEENTRY_MCP_OFFLINE, ONEENTRY_GITHUB_TOKEN,
+  ONEENTRY_MCP_UPLOAD_ROOT, ONEENTRY_MCP_UPLOAD_MAX_BYTES, ONEENTRY_MCP_UPLOAD_ALLOWED_HOSTS
 `;
 const main = async () => {
     const argv = process.argv.slice(2);

package/dist/config/config.d.ts

@@ -26,6 +26,20 @@ export declare const KnowledgeConfigSchema: z.ZodObject<{
     token?: string | undefined;
 }>;
 export type KnowledgeSettings = z.infer<typeof KnowledgeConfigSchema>;
+export declare const UploadConfigSchema: z.ZodObject<{
+    root: z.ZodString;
+    maxBytes: z.ZodNumber;
+    allowedHosts: z.ZodArray<z.ZodString, "many">;
+}, "strip", z.ZodTypeAny, {
+    root: string;
+    maxBytes: number;
+    allowedHosts: string[];
+}, {
+    root: string;
+    maxBytes: number;
+    allowedHosts: string[];
+}>;
+export type UploadSettings = z.infer<typeof UploadConfigSchema>;
 export declare const ConfigSchema: z.ZodObject<{
     mode: z.ZodEnum<["local", "remote"]>;
     baseUrl: z.ZodString;
@@ -59,6 +73,19 @@ export declare const ConfigSchema: z.ZodObject<{
     auditPath: z.ZodOptional<z.ZodString>;
     requestTimeoutMs: z.ZodNumber;
     maxResponseBytes: z.ZodNumber;
+    upload: z.ZodObject<{
+        root: z.ZodString;
+        maxBytes: z.ZodNumber;
+        allowedHosts: z.ZodArray<z.ZodString, "many">;
+    }, "strip", z.ZodTypeAny, {
+        root: string;
+        maxBytes: number;
+        allowedHosts: string[];
+    }, {
+        root: string;
+        maxBytes: number;
+        allowedHosts: string[];
+    }>;
     http: z.ZodObject<{
         port: z.ZodNumber;
         host: z.ZodString;
@@ -87,6 +114,11 @@ export declare const ConfigSchema: z.ZodObject<{
     cacheDir: string;
     requestTimeoutMs: number;
     maxResponseBytes: number;
+    upload: {
+        root: string;
+        maxBytes: number;
+        allowedHosts: string[];
+    };
     http: {
         port: number;
         host: string;
@@ -111,6 +143,11 @@ export declare const ConfigSchema: z.ZodObject<{
     cacheDir: string;
     requestTimeoutMs: number;
     maxResponseBytes: number;
+    upload: {
+        root: string;
+        maxBytes: number;
+        allowedHosts: string[];
+    };
     http: {
         port: number;
         host: string;

package/dist/config/config.js

@@ -12,6 +12,11 @@ export const KnowledgeConfigSchema = z.object({
     offline: z.boolean(),
     token: z.string().min(1).optional(),
 });
+export const UploadConfigSchema = z.object({
+    root: z.string().min(1),
+    maxBytes: z.number().int().positive(),
+    allowedHosts: z.array(z.string()),
+});
 export const ConfigSchema = z.object({
     mode: ServerModeSchema,
     baseUrl: z.string().url(),
@@ -24,6 +29,7 @@ export const ConfigSchema = z.object({
     auditPath: z.string().optional(),
     requestTimeoutMs: z.number().int().positive(),
     maxResponseBytes: z.number().int().positive(),
+    upload: UploadConfigSchema,
     http: z.object({
         port: z.number().int().min(1).max(65535),
         host: z.string().min(1),
@@ -40,6 +46,7 @@ const DEFAULTS = {
     knowledgeRepo: 'ONEENTRY-PLATFORM/oneentry-platform-rules',
     knowledgeRef: 'main',
     knowledgeTtlMs: 3_600_000,
+    uploadMaxBytes: 26_214_400,
 };
 export const parseFlags = (argv) => {
     const flags = {};
@@ -132,6 +139,7 @@ export const loadConfig = (argv, env = process.env, cwd = process.cwd()) => {
     const pickKnowledge = (flagKey, envKey, fileKey) => asString(flags[flagKey]) ?? asString(env[envKey]) ?? knowledgeFile(fileKey);
     const mode = flags['http'] === true || asString(flags['http']) ? 'remote' : 'local';
     const originsRaw = pick('allowed-origins', 'ONEENTRY_MCP_ALLOWED_ORIGINS', 'allowedOrigins');
+    const uploadHostsRaw = pick('upload-allowed-hosts', 'ONEENTRY_MCP_UPLOAD_ALLOWED_HOSTS', 'uploadAllowedHosts');
     const candidate = {
         mode,
         baseUrl: normalizeBaseUrl(pick('base-url', 'ONEENTRY_CMS_BASE_URL', 'baseUrl') ?? DEFAULTS.baseUrl),
@@ -153,6 +161,13 @@ export const loadConfig = (argv, env = process.env, cwd = process.cwd()) => {
         auditPath: pick('audit', 'ONEENTRY_MCP_AUDIT_PATH', 'auditPath'),
         requestTimeoutMs: asNumber(pick('request-timeout', 'ONEENTRY_MCP_REQUEST_TIMEOUT_MS', 'requestTimeoutMs'), DEFAULTS.requestTimeoutMs),
         maxResponseBytes: asNumber(pick('max-response-bytes', 'ONEENTRY_MCP_MAX_RESPONSE_BYTES', 'maxResponseBytes'), DEFAULTS.maxResponseBytes),
+        upload: {
+            root: pick('upload-root', 'ONEENTRY_MCP_UPLOAD_ROOT', 'uploadRoot') ?? cwd,
+            maxBytes: asNumber(pick('upload-max-bytes', 'ONEENTRY_MCP_UPLOAD_MAX_BYTES', 'uploadMaxBytes'), DEFAULTS.uploadMaxBytes),
+            allowedHosts: uploadHostsRaw
+                ? uploadHostsRaw.split(',').map((host) => host.trim().toLowerCase()).filter(Boolean)
+                : [],
+        },
         http: {
             port: asNumber(pick('port', 'ONEENTRY_MCP_PORT', 'port'), DEFAULTS.httpPort),
             host: pick('host', 'ONEENTRY_MCP_HOST', 'host') ?? DEFAULTS.httpHost,

package/dist/knowledge/ru-en-terms.d.ts

@@ -0,0 +1 @@
+export declare const withEnglishTerms: (query: string) => string;

package/dist/knowledge/ru-en-terms.js

@@ -0,0 +1,67 @@
+const RU_EN = {
+    атрибут: 'attribute',
+    блок: 'block',
+    валидатор: 'validator',
+    вложен: 'nested',
+    выгрузк: 'export',
+    групп: 'group',
+    доступ: 'permission access',
+    заказ: 'order',
+    запрос: 'request',
+    значени: 'value',
+    изображени: 'image file',
+    импорт: 'import',
+    индекс: 'index',
+    каталог: 'catalogue catalog',
+    картинк: 'image file',
+    категори: 'page category',
+    локал: 'locale',
+    маркер: 'marker identifier',
+    меню: 'menu',
+    модул: 'module',
+    набор: 'set',
+    настройк: 'settings',
+    ошибк: 'error',
+    пагинац: 'pagination limit offset',
+    парамет: 'parameter',
+    перевод: 'localization locale',
+    подтвержд: 'confirm',
+    поиск: 'search',
+    позиц: 'position',
+    польз: 'user',
+    превью: 'preview',
+    прав: 'permission',
+    продукт: 'product',
+    сортиров: 'sort order',
+    ссылк: 'link',
+    статус: 'status',
+    страниц: 'page',
+    схем: 'schema',
+    товар: 'product',
+    тип: 'type',
+    файл: 'file upload',
+    фильтр: 'filter',
+    форм: 'form',
+    шаблон: 'template',
+    язык: 'language locale',
+};
+const STEMS = Object.keys(RU_EN).sort((a, b) => b.length - a.length);
+export const withEnglishTerms = (query) => {
+    const lower = query.toLowerCase();
+    if (!/[а-яё]/.test(lower)) {
+        return query;
+    }
+    const added = new Set();
+    for (const word of lower.split(/[^\p{L}\p{N}]+/u)) {
+        if (word === '') {
+            continue;
+        }
+        const stem = STEMS.find((candidate) => word.startsWith(candidate));
+        if (stem) {
+            for (const term of RU_EN[stem]?.split(' ') ?? []) {
+                added.add(term);
+            }
+        }
+    }
+    return added.size > 0 ? `${query} ${[...added].join(' ')}` : query;
+};

package/dist/knowledge/search.js

@@ -1,4 +1,5 @@
 import MiniSearch from 'minisearch';
+import { withEnglishTerms } from './ru-en-terms.js';
 const REPO_WEIGHT = { mcp: 1.6, back: 1, front: 0.9 };
 const KIND_WEIGHT = {
     docs: 1.15,
@@ -69,7 +70,7 @@ export class KnowledgeIndex {
     }
     search(query, limit = 8) {
         const terms = query.split(/\s+/).filter((t) => t.length > 1);
-        const raw = this.mini.search(meaningfulQuery(query));
+        const raw = this.mini.search(withEnglishTerms(meaningfulQuery(query)));
         const hits = [];
         for (const result of raw) {
             const chunk = this.byId.get(String(result.id));

package/dist/server.js

@@ -9,6 +9,7 @@ import { registerApiCall } from './tools/api-call.js';
 import { registerApiDiscovery } from './tools/api-discovery.js';
 import { registerDocs } from './tools/docs.js';
 import { registerGuide } from './tools/guide.js';
+import { registerUpload } from './tools/upload.js';
 import { registerWhoami } from './tools/whoami.js';
 const SERVER_VERSION = (() => {
     try {
@@ -58,6 +59,7 @@ export const createServer = (deps, getSession) => {
     const server = new McpServer({ name: 'oneentry-mcp-platform', version: SERVER_VERSION }, {
         instructions: 'OneEntry CMS Admin API. Call cms_guide first, then cms_docs_read on "mcp/operating-rules" before any write. ' +
             'Discover endpoints with cms_api_search, get payload shapes with cms_api_describe, execute with cms_api_call. ' +
+            'Files are the exception: cms_api_call cannot send multipart, so upload with cms_upload_file or cms_import_file_from_url. ' +
             'Never construct paths or operation ids by hand.',
     });
     registerGuide(server, deps);
@@ -65,5 +67,6 @@ export const createServer = (deps, getSession) => {
     registerDocs(server, deps);
     registerApiDiscovery(server, deps);
     registerApiCall(server, getSession);
+    registerUpload(server, getSession);
     return server;
 };

package/dist/tools/api-call.js

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import { AuditLog } from '../api/audit.js';
-import { buildUrl, normalizeBody, RequestBuildError } from '../api/client.js';
+import { buildUrl, normalizeBody, RequestBuildError, unsupportedBodyFormat, } from '../api/client.js';
 import { checkLevel, decide } from '../api/policy.js';
 import { shapeResponse, summarizeTarget } from '../api/shape.js';
 import { errorResult, jsonResult } from './result.js';
@@ -40,6 +40,10 @@ export const registerApiCall = (server, getSession) => {
                 hint: 'Operation ids come from cms_api_search — do not construct them by hand.',
             });
         }
+        const formatDenial = unsupportedBodyFormat(operation);
+        if (formatDenial) {
+            return errorResult(formatDenial, { opId, contentType: operation.body?.contentType });
+        }
         const normalizedBody = normalizeBody(body);
         const args = {
             ...(path ? { path } : {}),
@@ -141,6 +145,15 @@ export const registerApiCall = (server, getSession) => {
             status: result.status,
             truncated: shaped.truncated,
             body: shaped.body,
+            ...(operation.verifyWith
+                ? {
+                    verifyWith: operation.verifyWith,
+                    next: `This write is not confirmed by its status. Read it back with ` +
+                        `${operation.verifyWith.opId} and check "${operation.verifyWith.check}" ` +
+                        'before reporting success.',
+                }
+                : {}),
+            ...(operation.silentNoOp ? { silentNoOp: operation.silentNoOp } : {}),
         });
     });
 };

package/dist/tools/api-discovery.js

@@ -1,5 +1,56 @@
 import { z } from 'zod';
+import { unsupportedBodyFormat } from '../api/client.js';
 import { errorResult, jsonResult } from './result.js';
+const sampleValue = (schema, example) => {
+    if (example !== undefined) {
+        return example;
+    }
+    if (schema.example !== undefined) {
+        return schema.example;
+    }
+    if (schema.enum && schema.enum.length > 0) {
+        return schema.enum[0];
+    }
+    switch (schema.type) {
+        case 'number':
+        case 'integer':
+            return 0;
+        case 'boolean':
+            return false;
+        case 'array':
+            return [];
+        case 'object':
+            return {};
+        default:
+            return `<${schema['x-source-type'] ?? schema.type ?? 'value'}>`;
+    }
+};
+const isWorthShowing = (param) => param.required ||
+    param.example !== undefined ||
+    param.schema.example !== undefined ||
+    param.schema.default !== undefined;
+const argsFor = (params, location, filter) => {
+    const out = {};
+    for (const param of params) {
+        if (param.location !== location || !filter(param)) {
+            continue;
+        }
+        out[param.name] = sampleValue(param.schema, param.example);
+    }
+    return out;
+};
+const callExample = (operation) => {
+    const path = argsFor(operation.params, 'path', () => true);
+    const query = argsFor(operation.params, 'query', isWorthShowing);
+    return {
+        opId: operation.opId,
+        ...(Object.keys(path).length > 0 ? { path } : {}),
+        ...(Object.keys(query).length > 0 ? { query } : {}),
+        ...(operation.body?.schema.example !== undefined
+            ? { body: operation.body.schema.example }
+            : {}),
+    };
+};
 export const registerApiDiscovery = (server, deps) => {
     const { catalog } = deps;
     server.registerTool('cms_api_search', {
@@ -22,10 +73,16 @@ export const registerApiDiscovery = (server, deps) => {
             ...(limit ? { limit } : {}),
         });
         if (hits.length === 0) {
+            const unexposed = catalog.unexposedMatches(query);
             return jsonResult({
                 hits: [],
                 tags: [...new Set(catalog.operations().map((o) => o.tag))].sort(),
-                hint: 'Nothing matched. Try a bare entity name, or filter by one of the tags listed here.',
+                ...(unexposed.length > 0 ? { knownButNotExposed: unexposed } : {}),
+                hint: unexposed.length > 0
+                    ? 'Nothing matched in this catalog, but the platform does know the names under ' +
+                        '"knownButNotExposed" — this instance simply does not serve them, so no path ' +
+                        'you construct will reach them. Do not guess URLs: report them as unavailable here.'
+                    : 'Nothing matched. Try a bare entity name, or filter by one of the tags listed here.',
             });
         }
         return jsonResult({
@@ -35,7 +92,7 @@ export const registerApiDiscovery = (server, deps) => {
     });
     server.registerTool('cms_api_describe', {
         title: 'Describe an Admin API operation',
-        description: 'Full detail for one operation: path and query parameters, request-body schema, required permission, risk level, and whether it is permanently confirm-gated. Fields marked "x-loose": true could not be converted to a JSON Schema type — trust their example, not their type.',
+        description: 'Full detail for one operation: a ready-to-copy "example" call, path and query parameters, request-body schema, required permission, risk level, and whether it is permanently confirm-gated. Fields marked "x-loose": true could not be converted to a JSON Schema type — trust their example, not their type. Where a body shape has been verified on a live instance it is returned as "curatedBody", which wins over the document\'s own example wherever the two disagree. Where the operation is known to answer success without doing the work, "silentNoOp" and "verifyWith" say so and name the read that proves it.',
         inputSchema: {
             opId: z.string().min(1).describe('Operation id from cms_api_search, e.g. "AdminPagesController_findAllRoot".'),
         },
@@ -43,18 +100,28 @@ export const registerApiDiscovery = (server, deps) => {
     }, ({ opId }) => {
         const operation = catalog.get(opId);
         if (!operation) {
+            const unexposed = catalog.unexposedMatches(opId);
             return errorResult(`Unknown opId "${opId}".`, {
                 didYouMean: catalog.suggest(opId),
-                hint: 'Operation ids come from cms_api_search — do not construct them by hand.',
+                ...(unexposed.length > 0 ? { knownButNotExposed: unexposed } : {}),
+                hint: unexposed.length > 0
+                    ? 'The platform knows this name, but this instance does not serve the operation, ' +
+                        'so it cannot be called from here by any path. Report it as unavailable.'
+                    : 'Operation ids come from cms_api_search — do not construct them by hand.',
             });
         }
-        const loose = [
-            ...(operation.body?.schema.properties
-                ? Object.entries(operation.body.schema.properties)
-                    .filter(([, schema]) => schema['x-loose'] === true)
-                    .map(([name, schema]) => ({ field: name, sourceType: schema['x-source-type'] }))
-                : []),
-        ];
+        const formatDenial = unsupportedBodyFormat(operation);
+        const properties = operation.body?.schema.properties;
+        const loose = properties
+            ? Object.entries(properties)
+                .filter(([, schema]) => schema['x-loose'] === true)
+                .map(([name, schema]) => ({ field: name, sourceType: schema['x-source-type'] }))
+            : [];
+        const mismatched = properties
+            ? Object.entries(properties)
+                .filter(([, schema]) => schema['x-example-mismatch'] !== undefined)
+                .map(([name, schema]) => ({ field: name, problem: schema['x-example-mismatch'] }))
+            : [];
         return jsonResult({
             opId: operation.opId,
             method: operation.method.toUpperCase(),
@@ -66,12 +133,51 @@ export const registerApiDiscovery = (server, deps) => {
             risk: operation.risk,
             alwaysConfirm: operation.alwaysConfirm,
             params: operation.params,
+            paramsByLocation: {
+                path: operation.params.filter((p) => p.location === 'path').map((p) => p.name),
+                query: operation.params.filter((p) => p.location === 'query').map((p) => p.name),
+            },
             body: operation.body ?? null,
+            example: callExample(operation),
             looseFields: loose,
+            ...(mismatched.length > 0
+                ? {
+                    exampleMismatches: mismatched,
+                    exampleMismatchHint: 'These fields declare one type and give an example of another. The example is ' +
+                        'the contract — the instance accepts what the example shows.',
+                }
+                : {}),
+            ...(operation.curatedExample !== undefined
+                ? {
+                    curatedBody: operation.curatedExample,
+                    curatedBodySource: 'Verified on a live instance. Where this disagrees with "example" or with the ' +
+                        'body schema above, this is the shape the instance and the admin panel read — ' +
+                        'copy it and read "note" for what each part of it prevents.',
+                }
+                : {}),
+            ...(operation.note ? { note: operation.note } : {}),
+            ...(operation.silentNoOp ? { silentNoOp: operation.silentNoOp } : {}),
+            ...(operation.verifyWith ? { verifyWith: operation.verifyWith } : {}),
+            ...(operation.body?.schema['x-unresolved'] === true
+                ? {
+                    bodySchemaUnresolved: 'The document does not resolve this body schema, so the empty "properties" ' +
+                        'above means "unknown", not "no fields". Build the body from "example"; ' +
+                        'if there is none, ask the human rather than guessing.',
+                }
+                : {}),
+            ...(formatDenial ? { notExecutable: formatDenial } : {}),
             responseSummary: operation.responseSummary ?? null,
-            next: operation.risk === 'read'
-                ? 'Call it with cms_api_call { opId, path, query }.'
-                : 'Search the knowledge base with cms_docs_search for this entity, then call cms_api_call with dryRun: true first.',
+            next: formatDenial
+                ? operation.body?.contentType === 'multipart/form-data'
+                    ? 'Do not call this with cms_api_call — upload with cms_upload_file or cms_import_file_from_url.'
+                    : 'Do not call this operation — report it as unavailable through MCP.'
+                : operation.risk === 'read'
+                    ? 'Call it with cms_api_call, copying the "example" above.'
+                    : operation.verifyWith
+                        ? 'Search the knowledge base with cms_docs_search for this entity, call cms_api_call ' +
+                            `with dryRun: true first, and afterwards read the result back with ` +
+                            `${operation.verifyWith.opId} — a success status is not evidence here.`
+                        : 'Search the knowledge base with cms_docs_search for this entity, then call cms_api_call with dryRun: true first.',
         });
     });
 };

package/dist/tools/docs.js

@@ -16,7 +16,10 @@ export const registerDocs = (server, deps) => {
         if (hits.length === 0) {
             return jsonResult({
                 hits: [],
-                hint: 'Nothing matched. Try a module name (menus, orders, blocks, attributes) or an entity field name.',
+                hint: 'Nothing matched. The knowledge base is written in English — ask in English, even ' +
+                    'when the conversation is not. Try a module name (menus, orders, blocks, ' +
+                    'attributes) or an entity field name. An empty result means this query found ' +
+                    'nothing, not that the CMS has no documentation for it.',
             });
         }
         return jsonResult({

package/dist/tools/guide.js

@@ -1,3 +1,4 @@
+import { ALWAYS_CONFIRM_PREFIXES } from '../api/operation-notes.js';
 import { textResult } from './result.js';
 const TAG_LIMIT = 24;
 export const renderGuide = (deps) => {
@@ -39,7 +40,10 @@ export const renderGuide = (deps) => {
         '2. `cms_docs_search` — find the reference doc for the entity you are touching;',
         '   `mcp/docs/server/doc-map` lists every document with a one-line "read this when".',
         '3. `cms_api_search` → `cms_api_describe` — get the real operation and its payload shape.',
-        '4. `cms_api_call` — `dryRun: true` first for anything that mutates.',
+        '   Where `cms_api_describe` returns `curatedBody`, that shape was verified on a live instance',
+        '   and wins over the document\'s own example.',
+        '4. `cms_api_call` — `dryRun: true` first for anything that mutates. Files go through',
+        '   `cms_upload_file` or `cms_import_file_from_url` instead.',
         '',
         'Never invent a path: `cms_api_search` is the only authority on what exists.',
         '',
@@ -50,8 +54,20 @@ export const renderGuide = (deps) => {
         '## Hard limits',
         '',
         '- Admin API only. The Content and Developer APIs are deliberately not exposed.',
-        '- `immutable-settings`, `admins`, `backups`, `modules`, `payments/webhook`, `settings-general`,',
-        '  `system/captcha-keys` and `auth/logout/all-users` are permanently confirm-gated.',
+        `- Mutations under ${ALWAYS_CONFIRM_PREFIXES.map((p) => `\`${p}\``).join(', ')} are`,
+        '  permanently confirm-gated, at every allow level.',
+        '- **`cms_api_call` sends JSON only.** The file upload endpoint wants `multipart/form-data`,',
+        '  so it has two tools of its own: `cms_upload_file` for a file on the machine running this',
+        '  server, `cms_import_file_from_url` for one this server downloads. Both need',
+        '  `--allow=write`, both are audited, both support `dryRun`, and both refuse a source outside',
+        '  the operator\'s bounds. Pass `template` — the numeric id of a `/template-previews` record —',
+        '  or the file is stored with no preview and nothing reports it.',
+        '- **The knowledge base is written in English.** Search it in English whatever language the',
+        '  conversation is in; an empty result is a failed query, not a missing document.',
+        '- A success status is not evidence that the write landed. Where an operation is known to',
+        '  answer success without doing the work, `cms_api_describe` says so under `silentNoOp` and',
+        '  names the read that proves it under `verifyWith`. Verify with the read the *consumer*',
+        '  uses, not the one you wrote to.',
         '- Responses are capped; overflow is reported as `_truncated`. Narrow the query instead.',
         ...(catalog.catalog.warnings.length > 0
             ? ['', '## Warnings', '', ...catalog.catalog.warnings.map((w) => `- ${w}`)]

package/dist/tools/upload.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { Session } from '../session.js';
+export declare const registerUpload: (server: McpServer, getSession: () => Session) => void;