@pairsystems/goodmem-mcp 0.1.20 → 0.1.21

package/dist/index.js

@@ -21115,7 +21115,7 @@ function _concatBytes(a, b) {
   out.set(b, a.length);
   return out;
 }
-var BASED_ON_GOODMEM_COMMIT = "b8e0b5b5b0eb252b5d5f0fcb5439bbe2d12404ba";
+var BASED_ON_GOODMEM_COMMIT = "7454cd497b08cb562aa05c31d031f7d9331d4d64";
 function isConfigured() {
   return goodmemBaseUrl !== "";
 }
@@ -22358,7 +22358,7 @@ function autoInferFromRegistry(registryType, args) {
 }
 var server = new McpServer({
   name: "goodmem",
-  version: "0.1.20"
+  version: "0.1.21"
 });
 server.tool("goodmem_configure", "Configure GoodMem server connection. Call this before using other GoodMem tools if GOODMEM_BASE_URL and GOODMEM_API_KEY environment variables are not set. Session credentials override environment variables. For bootstrap workflows that need to call /v1/system/info or /v1/system/init before keys exist, api_key may be omitted; most other tools will return AuthenticationException until a real key is provided.", {
   base_url: external_exports.string().describe("GoodMem server URL (e.g., https://your-server.example.com)"),
@@ -22444,18 +22444,18 @@ ${allModels.join("\n")}` }] };
 });
 server.tool("goodmem_client_info", "Return the MCP client package version and the goodmem server commit it was built against. No server connection required.", {}, { readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async () => {
   return { content: [{ type: "text", text: JSON.stringify({
-    mcp_version: "0.1.20",
+    mcp_version: "0.1.21",
     based_on_goodmem_commit: BASED_ON_GOODMEM_COMMIT
   }, null, 2) }] };
 });
 function registerTools() {
-  server.tool("goodmem_access_policy_check", "Check effective authorization\n\nEvaluates 1 to 50 concrete operation-and-target checks under the authenticated caller's live authority and any API-key ceiling. Results are positional and advisory: missing targets and denied operations both return allowed=false, and every later resource request performs fresh authorization. Top-level creates target INSTANCE; CREATE_MEMORY and LIST_MEMORY target their parent SPACE; reads, mutations, proxy operations, and access-policy administration target concrete resources. LIST_API_KEY and LIST_RETRIEVE_MEMORY_LOG_POLICY are rejected because their current candidate-based list rules have no instance-wide preflight.", {
+  server.tool("goodmem_access_policy_check", "Check effective authorization\n\nEvaluates 1 to 50 concrete operation-and-target checks under the authenticated caller's live authority and any API-key ceiling. Results are positional and advisory: missing targets and denied operations both return allowed=false, and every later resource request performs fresh authorization. Top-level creates and LIST_API_KEY target INSTANCE; CREATE_MEMORY and LIST_MEMORY target their parent SPACE; reads, mutations, proxy operations, and access-policy administration target concrete resources. LIST_RETRIEVE_MEMORY_LOG_POLICY is rejected because its current candidate-based list rule has no instance-wide preflight.", {
     checks: external_exports.array(external_exports.object({
       operation: external_exports.enum(["CREATE_USER", "READ_USER", "UPDATE_USER", "DELETE_USER", "LIST_USER", "MANAGE_USER_ENROLLMENT", "CREATE_SERVICE_IDENTITY", "READ_SERVICE_IDENTITY", "UPDATE_SERVICE_IDENTITY", "DELETE_SERVICE_IDENTITY", "LIST_SERVICE_IDENTITY", "CREATE_SPACE", "READ_SPACE", "UPDATE_SPACE", "DELETE_SPACE", "LIST_SPACE", "CREATE_API_KEY", "READ_API_KEY", "UPDATE_API_KEY", "DELETE_API_KEY", "LIST_API_KEY", "CREATE_EMBEDDER", "READ_EMBEDDER", "UPDATE_EMBEDDER", "DELETE_EMBEDDER", "LIST_EMBEDDER", "PING_EMBEDDER", "EXECUTE_EMBEDDER", "READ_EMBEDDER_CREDENTIALS", "CREATE_RERANKER", "READ_RERANKER", "UPDATE_RERANKER", "DELETE_RERANKER", "LIST_RERANKER", "PING_RERANKER", "EXECUTE_RERANKER", "READ_RERANKER_CREDENTIALS", "CREATE_LLM", "READ_LLM", "UPDATE_LLM", "DELETE_LLM", "LIST_LLM", "PING_LLM", "EXECUTE_LLM", "READ_LLM_CREDENTIALS", "PROXY_INFERENCE_TARGET", "OCR_DOCUMENT", "CREATE_MEMORY", "READ_MEMORY", "DELETE_MEMORY", "LIST_MEMORY", "CREATE_EXTENSION", "READ_EXTENSION", "UPDATE_EXTENSION", "DELETE_EXTENSION", "LIST_EXTENSION", "DOWNLOAD_EXTENSION", "READ_INSTANCE", "TRANSFER_INSTANCE_OWNERSHIP", "TRANSFER_RESOURCE_OWNERSHIP", "RELOAD_LICENSE", "DRAIN_SERVER", "PURGE_BACKGROUND_JOBS", "CREATE_RETRIEVE_MEMORY_LOG_POLICY", "READ_RETRIEVE_MEMORY_LOG_POLICY", "LIST_RETRIEVE_MEMORY_LOG_POLICY", "DELETE_RETRIEVE_MEMORY_LOG_POLICY", "MANAGE_ACCESS"]).describe("Operation the caller proposes to perform."),
       target: external_exports.object({
         kind: external_exports.enum(["INSTANCE", "USER", "SERVICE_IDENTITY", "SPACE", "API_KEY", "EMBEDDER", "RERANKER", "LLM", "MEMORY", "EXTENSION", "RETRIEVE_MEMORY_LOG_POLICY"]).describe("Concrete target kind."),
         resourceId: external_exports.string().describe("Concrete resource UUID; omitted for the singleton INSTANCE target.").optional()
-      }).passthrough().describe("Target required by the operation: INSTANCE for top-level creates, parent SPACE for CREATE_MEMORY or LIST_MEMORY, otherwise the concrete resource.")
+      }).passthrough().describe("Target required by the operation: INSTANCE for top-level creates and LIST_API_KEY; parent SPACE for CREATE_MEMORY or LIST_MEMORY; otherwise the concrete resource.")
     }).passthrough()).describe("Concrete checks evaluated in request order.")
   }, { readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async (args) => {
     const body = {};
@@ -22788,7 +22788,7 @@ function registerTools() {
     const result = await callApi("GET", `/v1/apikeys/${encodeURIComponent(String(args.id))}`, void 0);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_apikeys_list", "List API keys\n\nRetrieves one UUID-ordered page of API keys discoverable under the authenticated principal's effective API-key policy. Subject, owner, and lifecycle filters are applied after authorization. FULL includes complete immutable ceilings; BASIC omits them, sets ceilingOmitted=true, and permits larger pages. Raw key values and key hashes are never returned.", {
+  server.tool("goodmem_apikeys_list", "List API keys\n\nRequires LIST_API_KEY on the singleton instance, then retrieves one UUID-ordered page containing only credentials that independently pass READ_API_KEY. Both gates use the authenticated principal's live authority and any scoped-key ceiling. Subject, owner, and lifecycle filters are applied after authorization. FULL includes complete immutable ceilings; BASIC omits them, sets ceilingOmitted=true, and permits larger pages. Raw key values and key hashes are never returned.", {
     subject_principal_id: external_exports.string().describe("Filter by exact subject-principal UUID").optional(),
     owner_principal_id: external_exports.string().describe("Filter by exact administrative-owner UUID").optional(),
     lifecycle_state: external_exports.enum(["NOT_YET_VALID", "USABLE", "EXPIRED", "REVOKED"]).describe("Filter by precise lifecycle state").optional(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pairsystems/goodmem-mcp",
-  "version": "0.1.20",
+  "version": "0.1.21",
   "description": "GoodMem MCP server \u2014 exposes GoodMem API as MCP tools",
   "type": "module",
   "main": "dist/index.js",