@payloadcms/plugin-mcp 3.85.0 → 4.0.0-internal.1f9ae9a

package/dist/mcp/builtin/globals/updateTool.d.ts

@@ -0,0 +1,2 @@
+export declare const updateGlobalTool: import("../../../types.js").GlobalTool;
+//# sourceMappingURL=updateTool.d.ts.map

package/dist/mcp/builtin/globals/updateTool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"updateTool.d.ts","sourceRoot":"","sources":["../../../../src/mcp/builtin/globals/updateTool.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,gBAAgB,wCAsG3B,CAAA"}

package/dist/mcp/builtin/globals/updateTool.js

@@ -0,0 +1,92 @@
+import { z } from 'zod';
+import { defineGlobalTool } from '../../../defineTool.js';
+import { getLogger } from '../../../utils/getLogger.js';
+import { getGlobalVirtualFieldNames, stripVirtualFields } from '../../../utils/getVirtualFieldNames.js';
+import { localAPIDefaults } from '../../../utils/localAPIDefaults.js';
+import { prepareCollectionSchema } from '../../../utils/schemaConversion/prepareCollectionSchema.js';
+const DEFAULT_DESCRIPTION = 'Update a Payload global singleton configuration.';
+export const updateGlobalTool = defineGlobalTool({
+    description: DEFAULT_DESCRIPTION,
+    input: ({ globalSchema })=>{
+        const partialSchema = prepareCollectionSchema(globalSchema);
+        // Global updates do not require all required fields to be passed => delete .required.
+        //
+        // Local API equivalent: packages/payload/src/global/operations/local/update.ts#BaseOptions#data:
+        // data: DeepPartial<Omit<DataFromGlobalSlug<TSlug>, 'id'>>
+        delete partialSchema.required;
+        return z.object({
+            data: z.fromJSONSchema(partialSchema).describe('The fields to update'),
+            depth: z.number().describe('Optional: Depth of relationships to populate').optional().default(0),
+            draft: z.boolean().describe('Optional: Whether to save as draft (default: false)').optional().default(false),
+            fallbackLocale: z.string().describe('Optional: fallback locale code to use when requested locale is not available').optional(),
+            locale: z.string().describe('Optional: locale code to update data in (e.g., "en", "es"). Use "all" to update all locales for localized fields').optional(),
+            select: z.string().describe('Optional: define exactly which fields you\'d like to return in the response (JSON), e.g., \'{"siteName": "My Site"}\'').optional()
+        });
+    }
+}).handler(async ({ authorizedMCP, globalSlug, input, req })=>{
+    const payload = req.payload;
+    const logger = getLogger({
+        payload
+    });
+    const { data, depth, draft, fallbackLocale, locale, select } = input;
+    logger.info(`Updating global: ${globalSlug}, draft: ${draft}${locale ? `, locale: ${locale}` : ''}`);
+    try {
+        const virtualFieldNames = getGlobalVirtualFieldNames(payload.config, globalSlug);
+        const parsedData = stripVirtualFields(data, virtualFieldNames);
+        let selectClause;
+        if (select) {
+            try {
+                selectClause = JSON.parse(select);
+            } catch  {
+                logger.warn(`Invalid select clause JSON for global: ${select}`);
+                return {
+                    content: [
+                        {
+                            type: 'text',
+                            text: 'Error: Invalid JSON in select clause'
+                        }
+                    ]
+                };
+            }
+        }
+        const updateOptions = {
+            slug: globalSlug,
+            data: parsedData,
+            depth,
+            draft,
+            ...localAPIDefaults(authorizedMCP)
+        };
+        if (locale) {
+            updateOptions.locale = locale;
+        }
+        if (fallbackLocale) {
+            updateOptions.fallbackLocale = fallbackLocale;
+        }
+        if (selectClause) {
+            updateOptions.select = selectClause;
+        }
+        const result = await payload.updateGlobal(updateOptions);
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: `Global "${globalSlug}" updated successfully!\n\`\`\`json\n${JSON.stringify(result)}\n\`\`\``
+                }
+            ],
+            doc: result
+        };
+    } catch (error) {
+        const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+        logger.error(`Error updating global ${globalSlug}: ${errorMessage}`);
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: `Error updating global "${globalSlug}": ${errorMessage}`
+                }
+            ]
+        };
+    }
+});
+
+//# sourceMappingURL=updateTool.js.map

package/dist/mcp/builtin/globals/updateTool.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/mcp/builtin/globals/updateTool.ts"],"sourcesContent":["import type { SelectType } from 'payload'\n\nimport { z } from 'zod'\n\nimport { defineGlobalTool } from '../../../defineTool.js'\nimport { getLogger } from '../../../utils/getLogger.js'\nimport {\n  getGlobalVirtualFieldNames,\n  stripVirtualFields,\n} from '../../../utils/getVirtualFieldNames.js'\nimport { localAPIDefaults } from '../../../utils/localAPIDefaults.js'\nimport { prepareCollectionSchema } from '../../../utils/schemaConversion/prepareCollectionSchema.js'\n\nconst DEFAULT_DESCRIPTION = 'Update a Payload global singleton configuration.'\n\nexport const updateGlobalTool = defineGlobalTool({\n  description: DEFAULT_DESCRIPTION,\n  input: ({ globalSchema }) => {\n    const partialSchema = prepareCollectionSchema(globalSchema)\n    // Global updates do not require all required fields to be passed => delete .required.\n    //\n    // Local API equivalent: packages/payload/src/global/operations/local/update.ts#BaseOptions#data:\n    // data: DeepPartial<Omit<DataFromGlobalSlug<TSlug>, 'id'>>\n    delete partialSchema.required\n\n    return z.object({\n      data: z\n        .fromJSONSchema(partialSchema as unknown as z.core.JSONSchema.JSONSchema)\n        .describe('The fields to update'),\n      depth: z\n        .number()\n        .describe('Optional: Depth of relationships to populate')\n        .optional()\n        .default(0),\n      draft: z\n        .boolean()\n        .describe('Optional: Whether to save as draft (default: false)')\n        .optional()\n        .default(false),\n      fallbackLocale: z\n        .string()\n        .describe('Optional: fallback locale code to use when requested locale is not available')\n        .optional(),\n      locale: z\n        .string()\n        .describe(\n          'Optional: locale code to update data in (e.g., \"en\", \"es\"). Use \"all\" to update all locales for localized fields',\n        )\n        .optional(),\n      select: z\n        .string()\n        .describe(\n          'Optional: define exactly which fields you\\'d like to return in the response (JSON), e.g., \\'{\"siteName\": \"My Site\"}\\'',\n        )\n        .optional(),\n    })\n  },\n}).handler(async ({ authorizedMCP, globalSlug, input, req }) => {\n  const payload = req.payload\n  const logger = getLogger({ payload })\n\n  const { data, depth, draft, fallbackLocale, locale, select } = input\n\n  logger.info(\n    `Updating global: ${globalSlug}, draft: ${draft}${locale ? `, locale: ${locale}` : ''}`,\n  )\n\n  try {\n    const virtualFieldNames = getGlobalVirtualFieldNames(payload.config, globalSlug)\n    const parsedData = stripVirtualFields(data as Record<string, unknown>, virtualFieldNames)\n\n    let selectClause: SelectType | undefined\n    if (select) {\n      try {\n        selectClause = JSON.parse(select) as SelectType\n      } catch {\n        logger.warn(`Invalid select clause JSON for global: ${select}`)\n        return { content: [{ type: 'text', text: 'Error: Invalid JSON in select clause' }] }\n      }\n    }\n\n    const updateOptions: Parameters<typeof payload.updateGlobal>[0] = {\n      slug: globalSlug,\n      data: parsedData,\n      depth,\n      draft,\n      ...localAPIDefaults(authorizedMCP),\n    }\n\n    if (locale) {\n      updateOptions.locale = locale\n    }\n    if (fallbackLocale) {\n      updateOptions.fallbackLocale = fallbackLocale\n    }\n    if (selectClause) {\n      updateOptions.select = selectClause\n    }\n\n    const result = await payload.updateGlobal(updateOptions)\n\n    return {\n      content: [\n        {\n          type: 'text',\n          text: `Global \"${globalSlug}\" updated successfully!\\n\\`\\`\\`json\\n${JSON.stringify(result)}\\n\\`\\`\\``,\n        },\n      ],\n      doc: result as Record<string, unknown>,\n    }\n  } catch (error) {\n    const errorMessage = error instanceof Error ? error.message : 'Unknown error'\n    logger.error(`Error updating global ${globalSlug}: ${errorMessage}`)\n    return {\n      content: [{ type: 'text', text: `Error updating global \"${globalSlug}\": ${errorMessage}` }],\n    }\n  }\n})\n"],"names":["z","defineGlobalTool","getLogger","getGlobalVirtualFieldNames","stripVirtualFields","localAPIDefaults","prepareCollectionSchema","DEFAULT_DESCRIPTION","updateGlobalTool","description","input","globalSchema","partialSchema","required","object","data","fromJSONSchema","describe","depth","number","optional","default","draft","boolean","fallbackLocale","string","locale","select","handler","authorizedMCP","globalSlug","req","payload","logger","info","virtualFieldNames","config","parsedData","selectClause","JSON","parse","warn","content","type","text","updateOptions","slug","result","updateGlobal","stringify","doc","error","errorMessage","Error","message"],"mappings":"AAEA,SAASA,CAAC,QAAQ,MAAK;AAEvB,SAASC,gBAAgB,QAAQ,yBAAwB;AACzD,SAASC,SAAS,QAAQ,8BAA6B;AACvD,SACEC,0BAA0B,EAC1BC,kBAAkB,QACb,yCAAwC;AAC/C,SAASC,gBAAgB,QAAQ,qCAAoC;AACrE,SAASC,uBAAuB,QAAQ,6DAA4D;AAEpG,MAAMC,sBAAsB;AAE5B,OAAO,MAAMC,mBAAmBP,iBAAiB;IAC/CQ,aAAaF;IACbG,OAAO,CAAC,EAAEC,YAAY,EAAE;QACtB,MAAMC,gBAAgBN,wBAAwBK;QAC9C,sFAAsF;QACtF,EAAE;QACF,iGAAiG;QACjG,2DAA2D;QAC3D,OAAOC,cAAcC,QAAQ;QAE7B,OAAOb,EAAEc,MAAM,CAAC;YACdC,MAAMf,EACHgB,cAAc,CAACJ,eACfK,QAAQ,CAAC;YACZC,OAAOlB,EACJmB,MAAM,GACNF,QAAQ,CAAC,gDACTG,QAAQ,GACRC,OAAO,CAAC;YACXC,OAAOtB,EACJuB,OAAO,GACPN,QAAQ,CAAC,uDACTG,QAAQ,GACRC,OAAO,CAAC;YACXG,gBAAgBxB,EACbyB,MAAM,GACNR,QAAQ,CAAC,gFACTG,QAAQ;YACXM,QAAQ1B,EACLyB,MAAM,GACNR,QAAQ,CACP,oHAEDG,QAAQ;YACXO,QAAQ3B,EACLyB,MAAM,GACNR,QAAQ,CACP,yHAEDG,QAAQ;QACb;IACF;AACF,GAAGQ,OAAO,CAAC,OAAO,EAAEC,aAAa,EAAEC,UAAU,EAAEpB,KAAK,EAAEqB,GAAG,EAAE;IACzD,MAAMC,UAAUD,IAAIC,OAAO;IAC3B,MAAMC,SAAS/B,UAAU;QAAE8B;IAAQ;IAEnC,MAAM,EAAEjB,IAAI,EAAEG,KAAK,EAAEI,KAAK,EAAEE,cAAc,EAAEE,MAAM,EAAEC,MAAM,EAAE,GAAGjB;IAE/DuB,OAAOC,IAAI,CACT,CAAC,iBAAiB,EAAEJ,WAAW,SAAS,EAAER,QAAQI,SAAS,CAAC,UAAU,EAAEA,QAAQ,GAAG,IAAI;IAGzF,IAAI;QACF,MAAMS,oBAAoBhC,2BAA2B6B,QAAQI,MAAM,EAAEN;QACrE,MAAMO,aAAajC,mBAAmBW,MAAiCoB;QAEvE,IAAIG;QACJ,IAAIX,QAAQ;YACV,IAAI;gBACFW,eAAeC,KAAKC,KAAK,CAACb;YAC5B,EAAE,OAAM;gBACNM,OAAOQ,IAAI,CAAC,CAAC,uCAAuC,EAAEd,QAAQ;gBAC9D,OAAO;oBAAEe,SAAS;wBAAC;4BAAEC,MAAM;4BAAQC,MAAM;wBAAuC;qBAAE;gBAAC;YACrF;QACF;QAEA,MAAMC,gBAA4D;YAChEC,MAAMhB;YACNf,MAAMsB;YACNnB;YACAI;YACA,GAAGjB,iBAAiBwB,cAAc;QACpC;QAEA,IAAIH,QAAQ;YACVmB,cAAcnB,MAAM,GAAGA;QACzB;QACA,IAAIF,gBAAgB;YAClBqB,cAAcrB,cAAc,GAAGA;QACjC;QACA,IAAIc,cAAc;YAChBO,cAAclB,MAAM,GAAGW;QACzB;QAEA,MAAMS,SAAS,MAAMf,QAAQgB,YAAY,CAACH;QAE1C,OAAO;YACLH,SAAS;gBACP;oBACEC,MAAM;oBACNC,MAAM,CAAC,QAAQ,EAAEd,WAAW,qCAAqC,EAAES,KAAKU,SAAS,CAACF,QAAQ,QAAQ,CAAC;gBACrG;aACD;YACDG,KAAKH;QACP;IACF,EAAE,OAAOI,OAAO;QACd,MAAMC,eAAeD,iBAAiBE,QAAQF,MAAMG,OAAO,GAAG;QAC9DrB,OAAOkB,KAAK,CAAC,CAAC,sBAAsB,EAAErB,WAAW,EAAE,EAAEsB,cAAc;QACnE,OAAO;YACLV,SAAS;gBAAC;oBAAEC,MAAM;oBAAQC,MAAM,CAAC,uBAAuB,EAAEd,WAAW,GAAG,EAAEsB,cAAc;gBAAC;aAAE;QAC7F;IACF;AACF,GAAE"}

package/dist/mcp/builtinTools.d.ts

@@ -0,0 +1,37 @@
+import type { CollectionTool, GlobalTool } from '../types.js';
+/**
+ * The static built-in collection CRUD tools. Keys here are the source of truth
+ * for `MCPCollectionBuiltinName` — adding/removing an entry updates the type
+ * automatically.
+ */
+export declare const COLLECTION_BUILTINS: Record<MCPCollectionBuiltinName, CollectionTool>;
+/**
+ * The static auth tools surfaced under auth-enabled collections. Each entry
+ * carries the admin-UI label alongside the tool. Keys are the source of truth
+ * for `MCPCollectionAuthToolName`.
+ */
+export declare const COLLECTION_AUTH_BUILTINS: Record<MCPCollectionAuthToolName, {
+    label: string;
+    tool: CollectionTool;
+}>;
+/**
+ * The static built-in global tools. Keys are the source of truth for
+ * `MCPGlobalBuiltinName`.
+ */
+export declare const GLOBAL_BUILTINS: Record<MCPGlobalBuiltinName, GlobalTool>;
+export type MCPCollectionBuiltinName = 'create' | 'delete' | 'find' | 'update';
+export type MCPCollectionAuthToolName = 'auth' | 'forgotPassword' | 'login' | 'resetPassword' | 'unlock' | 'verify';
+export type MCPGlobalBuiltinName = 'find' | 'update';
+/**
+ * Pre-typed `Object.entries` for each registry. The cast from `string` to the
+ * literal key union lives here once so consumers can iterate without their own
+ * cast — TypeScript's `Object.entries` always widens keys to `string`, which
+ * defeats the narrow type lookups on `MCPCollectionToolsMap`.
+ */
+export declare const COLLECTION_BUILTIN_ENTRIES: Array<[MCPCollectionBuiltinName, CollectionTool]>;
+export declare const COLLECTION_AUTH_BUILTIN_ENTRIES: Array<[MCPCollectionAuthToolName, {
+    label: string;
+    tool: CollectionTool;
+}]>;
+export declare const GLOBAL_BUILTIN_ENTRIES: Array<[MCPGlobalBuiltinName, GlobalTool]>;
+//# sourceMappingURL=builtinTools.d.ts.map

package/dist/mcp/builtinTools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"builtinTools.d.ts","sourceRoot":"","sources":["../../src/mcp/builtinTools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAiB7D;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,wBAAwB,EAAE,cAAc,CAKhF,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAC3C,yBAAyB,EACzB;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,cAAc,CAAA;CAAE,CAQxC,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,oBAAoB,EAAE,UAAU,CAGpE,CAAA;AAED,MAAM,MAAM,wBAAwB,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAA;AAE9E,MAAM,MAAM,yBAAyB,GACjC,MAAM,GACN,gBAAgB,GAChB,OAAO,GACP,eAAe,GACf,QAAQ,GACR,QAAQ,CAAA;AAEZ,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,QAAQ,CAAA;AAEpD;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,EAA0C,KAAK,CACpF,CAAC,wBAAwB,EAAE,cAAc,CAAC,CAC3C,CAAA;AAED,eAAO,MAAM,+BAA+B,EAA+C,KAAK,CAC9F,CAAC,yBAAyB,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,cAAc,CAAA;CAAE,CAAC,CACrE,CAAA;AAED,eAAO,MAAM,sBAAsB,EAAsC,KAAK,CAC5E,CAAC,oBAAoB,EAAE,UAAU,CAAC,CACnC,CAAA"}

package/dist/mcp/builtinTools.js

@@ -0,0 +1,64 @@
+import { authCollectionTool, forgotPasswordCollectionTool, loginCollectionTool, resetPasswordCollectionTool, unlockCollectionTool, verifyCollectionTool } from './builtin/collections/authTools.js';
+import { createCollectionTool } from './builtin/collections/createTool.js';
+import { deleteCollectionTool } from './builtin/collections/deleteTool.js';
+import { findCollectionTool } from './builtin/collections/findTool.js';
+import { updateCollectionTool } from './builtin/collections/updateTool.js';
+import { findGlobalTool } from './builtin/globals/findTool.js';
+import { updateGlobalTool } from './builtin/globals/updateTool.js';
+/**
+ * The static built-in collection CRUD tools. Keys here are the source of truth
+ * for `MCPCollectionBuiltinName` — adding/removing an entry updates the type
+ * automatically.
+ */ export const COLLECTION_BUILTINS = {
+    create: createCollectionTool,
+    delete: deleteCollectionTool,
+    find: findCollectionTool,
+    update: updateCollectionTool
+};
+/**
+ * The static auth tools surfaced under auth-enabled collections. Each entry
+ * carries the admin-UI label alongside the tool. Keys are the source of truth
+ * for `MCPCollectionAuthToolName`.
+ */ export const COLLECTION_AUTH_BUILTINS = {
+    auth: {
+        label: 'Check Auth Status',
+        tool: authCollectionTool
+    },
+    forgotPassword: {
+        label: 'Forgot Password',
+        tool: forgotPasswordCollectionTool
+    },
+    login: {
+        label: 'User Login',
+        tool: loginCollectionTool
+    },
+    resetPassword: {
+        label: 'Reset Password',
+        tool: resetPasswordCollectionTool
+    },
+    unlock: {
+        label: 'Unlock Account',
+        tool: unlockCollectionTool
+    },
+    verify: {
+        label: 'Email Verification',
+        tool: verifyCollectionTool
+    }
+};
+/**
+ * The static built-in global tools. Keys are the source of truth for
+ * `MCPGlobalBuiltinName`.
+ */ export const GLOBAL_BUILTINS = {
+    find: findGlobalTool,
+    update: updateGlobalTool
+};
+/**
+ * Pre-typed `Object.entries` for each registry. The cast from `string` to the
+ * literal key union lives here once so consumers can iterate without their own
+ * cast — TypeScript's `Object.entries` always widens keys to `string`, which
+ * defeats the narrow type lookups on `MCPCollectionToolsMap`.
+ */ export const COLLECTION_BUILTIN_ENTRIES = Object.entries(COLLECTION_BUILTINS);
+export const COLLECTION_AUTH_BUILTIN_ENTRIES = Object.entries(COLLECTION_AUTH_BUILTINS);
+export const GLOBAL_BUILTIN_ENTRIES = Object.entries(GLOBAL_BUILTINS);
+
+//# sourceMappingURL=builtinTools.js.map

package/dist/mcp/builtinTools.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/mcp/builtinTools.ts"],"sourcesContent":["import type { CollectionTool, GlobalTool } from '../types.js'\n\nimport {\n  authCollectionTool,\n  forgotPasswordCollectionTool,\n  loginCollectionTool,\n  resetPasswordCollectionTool,\n  unlockCollectionTool,\n  verifyCollectionTool,\n} from './builtin/collections/authTools.js'\nimport { createCollectionTool } from './builtin/collections/createTool.js'\nimport { deleteCollectionTool } from './builtin/collections/deleteTool.js'\nimport { findCollectionTool } from './builtin/collections/findTool.js'\nimport { updateCollectionTool } from './builtin/collections/updateTool.js'\nimport { findGlobalTool } from './builtin/globals/findTool.js'\nimport { updateGlobalTool } from './builtin/globals/updateTool.js'\n\n/**\n * The static built-in collection CRUD tools. Keys here are the source of truth\n * for `MCPCollectionBuiltinName` — adding/removing an entry updates the type\n * automatically.\n */\nexport const COLLECTION_BUILTINS: Record<MCPCollectionBuiltinName, CollectionTool> = {\n  create: createCollectionTool,\n  delete: deleteCollectionTool,\n  find: findCollectionTool,\n  update: updateCollectionTool,\n}\n\n/**\n * The static auth tools surfaced under auth-enabled collections. Each entry\n * carries the admin-UI label alongside the tool. Keys are the source of truth\n * for `MCPCollectionAuthToolName`.\n */\nexport const COLLECTION_AUTH_BUILTINS: Record<\n  MCPCollectionAuthToolName,\n  { label: string; tool: CollectionTool }\n> = {\n  auth: { label: 'Check Auth Status', tool: authCollectionTool },\n  forgotPassword: { label: 'Forgot Password', tool: forgotPasswordCollectionTool },\n  login: { label: 'User Login', tool: loginCollectionTool },\n  resetPassword: { label: 'Reset Password', tool: resetPasswordCollectionTool },\n  unlock: { label: 'Unlock Account', tool: unlockCollectionTool },\n  verify: { label: 'Email Verification', tool: verifyCollectionTool },\n}\n\n/**\n * The static built-in global tools. Keys are the source of truth for\n * `MCPGlobalBuiltinName`.\n */\nexport const GLOBAL_BUILTINS: Record<MCPGlobalBuiltinName, GlobalTool> = {\n  find: findGlobalTool,\n  update: updateGlobalTool,\n}\n\nexport type MCPCollectionBuiltinName = 'create' | 'delete' | 'find' | 'update'\n\nexport type MCPCollectionAuthToolName =\n  | 'auth'\n  | 'forgotPassword'\n  | 'login'\n  | 'resetPassword'\n  | 'unlock'\n  | 'verify'\n\nexport type MCPGlobalBuiltinName = 'find' | 'update'\n\n/**\n * Pre-typed `Object.entries` for each registry. The cast from `string` to the\n * literal key union lives here once so consumers can iterate without their own\n * cast — TypeScript's `Object.entries` always widens keys to `string`, which\n * defeats the narrow type lookups on `MCPCollectionToolsMap`.\n */\nexport const COLLECTION_BUILTIN_ENTRIES = Object.entries(COLLECTION_BUILTINS) as Array<\n  [MCPCollectionBuiltinName, CollectionTool]\n>\n\nexport const COLLECTION_AUTH_BUILTIN_ENTRIES = Object.entries(COLLECTION_AUTH_BUILTINS) as Array<\n  [MCPCollectionAuthToolName, { label: string; tool: CollectionTool }]\n>\n\nexport const GLOBAL_BUILTIN_ENTRIES = Object.entries(GLOBAL_BUILTINS) as Array<\n  [MCPGlobalBuiltinName, GlobalTool]\n>\n"],"names":["authCollectionTool","forgotPasswordCollectionTool","loginCollectionTool","resetPasswordCollectionTool","unlockCollectionTool","verifyCollectionTool","createCollectionTool","deleteCollectionTool","findCollectionTool","updateCollectionTool","findGlobalTool","updateGlobalTool","COLLECTION_BUILTINS","create","delete","find","update","COLLECTION_AUTH_BUILTINS","auth","label","tool","forgotPassword","login","resetPassword","unlock","verify","GLOBAL_BUILTINS","COLLECTION_BUILTIN_ENTRIES","Object","entries","COLLECTION_AUTH_BUILTIN_ENTRIES","GLOBAL_BUILTIN_ENTRIES"],"mappings":"AAEA,SACEA,kBAAkB,EAClBC,4BAA4B,EAC5BC,mBAAmB,EACnBC,2BAA2B,EAC3BC,oBAAoB,EACpBC,oBAAoB,QACf,qCAAoC;AAC3C,SAASC,oBAAoB,QAAQ,sCAAqC;AAC1E,SAASC,oBAAoB,QAAQ,sCAAqC;AAC1E,SAASC,kBAAkB,QAAQ,oCAAmC;AACtE,SAASC,oBAAoB,QAAQ,sCAAqC;AAC1E,SAASC,cAAc,QAAQ,gCAA+B;AAC9D,SAASC,gBAAgB,QAAQ,kCAAiC;AAElE;;;;CAIC,GACD,OAAO,MAAMC,sBAAwE;IACnFC,QAAQP;IACRQ,QAAQP;IACRQ,MAAMP;IACNQ,QAAQP;AACV,EAAC;AAED;;;;CAIC,GACD,OAAO,MAAMQ,2BAGT;IACFC,MAAM;QAAEC,OAAO;QAAqBC,MAAMpB;IAAmB;IAC7DqB,gBAAgB;QAAEF,OAAO;QAAmBC,MAAMnB;IAA6B;IAC/EqB,OAAO;QAAEH,OAAO;QAAcC,MAAMlB;IAAoB;IACxDqB,eAAe;QAAEJ,OAAO;QAAkBC,MAAMjB;IAA4B;IAC5EqB,QAAQ;QAAEL,OAAO;QAAkBC,MAAMhB;IAAqB;IAC9DqB,QAAQ;QAAEN,OAAO;QAAsBC,MAAMf;IAAqB;AACpE,EAAC;AAED;;;CAGC,GACD,OAAO,MAAMqB,kBAA4D;IACvEX,MAAML;IACNM,QAAQL;AACV,EAAC;AAcD;;;;;CAKC,GACD,OAAO,MAAMgB,6BAA6BC,OAAOC,OAAO,CAACjB,qBAExD;AAED,OAAO,MAAMkB,kCAAkCF,OAAOC,OAAO,CAACZ,0BAE7D;AAED,OAAO,MAAMc,yBAAyBH,OAAOC,OAAO,CAACH,iBAEpD"}

package/dist/mcp/sanitizeMCPConfig.d.ts

@@ -0,0 +1,17 @@
+import type { Config, SanitizedConfig } from 'payload';
+import type { MCPPluginConfig, SanitizedMCPPluginConfig } from '../types.js';
+/**
+ * Converts the user-configured `MCPPluginConfig` into a `SanitizedMCPPluginConfig`:
+ *  - Flattens `tools` / `prompts` / `resources` / per-collection / per-global
+ *    tool maps into a single `items` array.
+ *  - Applies built-in tools for collections and globals, respecting opt-out user overrides.
+ *  - Applies the `userCollection` default
+ *
+ * Called once during plugin init. After that, `plugins['@payloadcms/plugin-mcp']
+ * ?.options` holds the sanitized result
+ */
+export declare const sanitizeMCPConfig: ({ config, pluginConfig, }: {
+    config: Config | SanitizedConfig;
+    pluginConfig: MCPPluginConfig;
+}) => SanitizedMCPPluginConfig;
+//# sourceMappingURL=sanitizeMCPConfig.d.ts.map

package/dist/mcp/sanitizeMCPConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitizeMCPConfig.d.ts","sourceRoot":"","sources":["../../src/mcp/sanitizeMCPConfig.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,MAAM,EAGN,eAAe,EAEhB,MAAM,SAAS,CAAA;AAEhB,OAAO,KAAK,EAMV,eAAe,EAEf,wBAAwB,EACzB,MAAM,aAAa,CAAA;AAWpB;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,GAAI,2BAG/B;IACD,MAAM,EAAE,MAAM,GAAG,eAAe,CAAA;IAChC,YAAY,EAAE,eAAe,CAAA;CAC9B,KAAG,wBAkDH,CAAA"}

package/dist/mcp/sanitizeMCPConfig.js

@@ -0,0 +1,167 @@
+import { COLLECTION_AUTH_BUILTIN_ENTRIES, COLLECTION_AUTH_BUILTINS, COLLECTION_BUILTIN_ENTRIES, COLLECTION_BUILTINS, GLOBAL_BUILTIN_ENTRIES, GLOBAL_BUILTINS } from './builtinTools.js';
+/**
+ * Converts the user-configured `MCPPluginConfig` into a `SanitizedMCPPluginConfig`:
+ *  - Flattens `tools` / `prompts` / `resources` / per-collection / per-global
+ *    tool maps into a single `items` array.
+ *  - Applies built-in tools for collections and globals, respecting opt-out user overrides.
+ *  - Applies the `userCollection` default
+ *
+ * Called once during plugin init. After that, `plugins['@payloadcms/plugin-mcp']
+ * ?.options` holds the sanitized result
+ */ export const sanitizeMCPConfig = ({ config, pluginConfig })=>{
+    const items = [];
+    for (const collection of config.collections ?? []){
+        items.push(...sanitizeCollectionConfig({
+            collection,
+            pluginConfig
+        }));
+    }
+    for (const global of config.globals ?? []){
+        items.push(...sanitizeGlobalConfig({
+            global,
+            pluginConfig
+        }));
+    }
+    for (const [key, tool] of Object.entries(pluginConfig.tools ?? {})){
+        items.push({
+            type: 'tool',
+            key,
+            label: key,
+            tool
+        });
+    }
+    for (const [key, prompt] of Object.entries(pluginConfig.prompts ?? {})){
+        items.push({
+            type: 'prompt',
+            key,
+            label: prompt.title ?? key,
+            prompt
+        });
+    }
+    for (const [key, resource] of Object.entries(pluginConfig.resources ?? {})){
+        items.push({
+            type: 'resource',
+            key,
+            label: resource.title ?? key,
+            resource
+        });
+    }
+    // Mirror Payload's own admin.user detection (sanitize.ts) since plugins run first.
+    const firstCollectionWithAuth = config.collections.find(({ auth })=>Boolean(auth));
+    return {
+        disabled: pluginConfig.disabled,
+        items,
+        mcp: pluginConfig.mcp,
+        overrideApiKeyCollection: pluginConfig.overrideApiKeyCollection,
+        overrideAuth: pluginConfig.overrideAuth,
+        userCollection: pluginConfig.userCollection ?? config.admin?.user ?? firstCollectionWithAuth?.slug ?? 'users'
+    };
+};
+const sanitizeCollectionConfig = ({ collection, pluginConfig })=>{
+    if (collection.slug === 'payload-mcp-api-keys') {
+        return [];
+    }
+    const slug = collection.slug;
+    const collectionPluginConfig = pluginConfig.collections?.[slug];
+    const items = [];
+    for (const [toolKey, tool] of COLLECTION_BUILTIN_ENTRIES){
+        const matchedConfigEntry = collectionPluginConfig?.tools?.[toolKey];
+        if (matchedConfigEntry === false) {
+            continue;
+        }
+        items.push({
+            type: 'collectionTool',
+            collectionSlug: slug,
+            key: toolKey,
+            label: capitalize(toolKey),
+            tool: overrideBuiltinTool(tool, matchedConfigEntry, collectionPluginConfig)
+        });
+    }
+    if (collection.auth) {
+        for (const [authToolKey, { label, tool }] of COLLECTION_AUTH_BUILTIN_ENTRIES){
+            const matchedConfigEntry = collectionPluginConfig?.tools?.[authToolKey];
+            if (!matchedConfigEntry) {
+                continue;
+            }
+            // `true` means "enable, no override"; only the object form carries fields.
+            const override = typeof matchedConfigEntry === 'object' ? matchedConfigEntry : undefined;
+            items.push({
+                type: 'collectionTool',
+                collectionSlug: slug,
+                key: authToolKey,
+                label,
+                tool: overrideBuiltinTool(tool, override, collectionPluginConfig)
+            });
+        }
+    }
+    // Cast: builtin keys are filtered out below, so the remaining values are
+    // always custom tools (`CollectionTool`) or undefined
+    const customEntries = Object.entries(collectionPluginConfig?.tools ?? {});
+    for (const [key, customTool] of customEntries){
+        if (key in COLLECTION_BUILTINS || key in COLLECTION_AUTH_BUILTINS) {
+            continue;
+        }
+        if (!customTool) {
+            continue;
+        }
+        items.push({
+            type: 'collectionTool',
+            collectionSlug: slug,
+            key,
+            label: key,
+            tool: customTool
+        });
+    }
+    return items;
+};
+const sanitizeGlobalConfig = ({ global, pluginConfig })=>{
+    const slug = global.slug;
+    const globalPluginConfig = pluginConfig.globals?.[slug];
+    const items = [];
+    for (const [toolKey, baseTool] of GLOBAL_BUILTIN_ENTRIES){
+        const matchedConfigEntry = globalPluginConfig?.tools?.[toolKey];
+        if (matchedConfigEntry === false) {
+            continue;
+        }
+        items.push({
+            type: 'globalTool',
+            globalSlug: slug,
+            key: toolKey,
+            label: capitalize(toolKey),
+            tool: overrideBuiltinTool(baseTool, matchedConfigEntry, globalPluginConfig)
+        });
+    }
+    const customEntries = Object.entries(globalPluginConfig?.tools ?? {});
+    for (const [key, customTool] of customEntries){
+        if (key in GLOBAL_BUILTINS) {
+            continue;
+        }
+        if (!customTool) {
+            continue;
+        }
+        items.push({
+            type: 'globalTool',
+            globalSlug: slug,
+            key,
+            label: key,
+            tool: customTool
+        });
+    }
+    return items;
+};
+const capitalize = (s)=>s.charAt(0).toUpperCase() + s.slice(1);
+/**
+ * Spread the static built-in tool and apply consumer-side overrides.
+ * Precedence: per-tool override > scope-level (collection/global) override >
+ * the static tool's defaults. `toolEntry` is whatever the user put under
+ * `tools: { find: ... }` — could be `true`, `false`, or an override object —
+ * so it's narrowed internally.
+ */ const overrideBuiltinTool = (tool, toolOverride, entityPluginConfig)=>{
+    return {
+        ...tool,
+        description: toolOverride?.description ?? entityPluginConfig?.description ?? tool.description,
+        overrideResponse: toolOverride?.overrideResponse ?? entityPluginConfig?.overrideResponse ?? tool.overrideResponse
+    };
+};
+
+//# sourceMappingURL=sanitizeMCPConfig.js.map

package/dist/mcp/sanitizeMCPConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/mcp/sanitizeMCPConfig.ts"],"sourcesContent":["import type {\n  CollectionConfig,\n  Config,\n  GlobalConfig,\n  SanitizedCollectionConfig,\n  SanitizedConfig,\n  SanitizedGlobalConfig,\n} from 'payload'\n\nimport type {\n  CollectionTool,\n  GlobalTool,\n  MCPBuiltInToolOverride,\n  MCPItem,\n  MCPPluginCollectionConfig,\n  MCPPluginConfig,\n  MCPPluginGlobalConfig,\n  SanitizedMCPPluginConfig,\n} from '../types.js'\n\nimport {\n  COLLECTION_AUTH_BUILTIN_ENTRIES,\n  COLLECTION_AUTH_BUILTINS,\n  COLLECTION_BUILTIN_ENTRIES,\n  COLLECTION_BUILTINS,\n  GLOBAL_BUILTIN_ENTRIES,\n  GLOBAL_BUILTINS,\n} from './builtinTools.js'\n\n/**\n * Converts the user-configured `MCPPluginConfig` into a `SanitizedMCPPluginConfig`:\n *  - Flattens `tools` / `prompts` / `resources` / per-collection / per-global\n *    tool maps into a single `items` array.\n *  - Applies built-in tools for collections and globals, respecting opt-out user overrides.\n *  - Applies the `userCollection` default\n *\n * Called once during plugin init. After that, `plugins['@payloadcms/plugin-mcp']\n * ?.options` holds the sanitized result\n */\nexport const sanitizeMCPConfig = ({\n  config,\n  pluginConfig,\n}: {\n  config: Config | SanitizedConfig\n  pluginConfig: MCPPluginConfig\n}): SanitizedMCPPluginConfig => {\n  const items: MCPItem[] = []\n\n  for (const collection of config.collections ?? []) {\n    items.push(...sanitizeCollectionConfig({ collection, pluginConfig }))\n  }\n\n  for (const global of config.globals ?? []) {\n    items.push(...sanitizeGlobalConfig({ global, pluginConfig }))\n  }\n\n  for (const [key, tool] of Object.entries(pluginConfig.tools ?? {})) {\n    items.push({\n      type: 'tool',\n      key,\n      label: key,\n      tool,\n    })\n  }\n\n  for (const [key, prompt] of Object.entries(pluginConfig.prompts ?? {})) {\n    items.push({\n      type: 'prompt',\n      key,\n      label: prompt.title ?? key,\n      prompt,\n    })\n  }\n\n  for (const [key, resource] of Object.entries(pluginConfig.resources ?? {})) {\n    items.push({\n      type: 'resource',\n      key,\n      label: resource.title ?? key,\n      resource,\n    })\n  }\n\n  // Mirror Payload's own admin.user detection (sanitize.ts) since plugins run first.\n  const firstCollectionWithAuth = config.collections!.find(({ auth }) => Boolean(auth))\n\n  return {\n    disabled: pluginConfig.disabled,\n    items,\n    mcp: pluginConfig.mcp,\n    overrideApiKeyCollection: pluginConfig.overrideApiKeyCollection,\n    overrideAuth: pluginConfig.overrideAuth,\n    userCollection:\n      pluginConfig.userCollection ?? config.admin?.user ?? firstCollectionWithAuth?.slug ?? 'users',\n  }\n}\n\nconst sanitizeCollectionConfig = ({\n  collection,\n  pluginConfig,\n}: {\n  collection: CollectionConfig | SanitizedCollectionConfig\n  pluginConfig: MCPPluginConfig\n}): MCPItem[] => {\n  if (collection.slug === 'payload-mcp-api-keys') {\n    return []\n  }\n  const slug = collection.slug\n  const collectionPluginConfig = pluginConfig.collections?.[slug]\n  const items: MCPItem[] = []\n\n  for (const [toolKey, tool] of COLLECTION_BUILTIN_ENTRIES) {\n    const matchedConfigEntry = collectionPluginConfig?.tools?.[toolKey]\n    if (matchedConfigEntry === false) {\n      continue\n    }\n    items.push({\n      type: 'collectionTool',\n      collectionSlug: slug,\n      key: toolKey,\n      label: capitalize(toolKey),\n      tool: overrideBuiltinTool(tool, matchedConfigEntry, collectionPluginConfig),\n    })\n  }\n\n  if (collection.auth) {\n    for (const [authToolKey, { label, tool }] of COLLECTION_AUTH_BUILTIN_ENTRIES) {\n      const matchedConfigEntry = collectionPluginConfig?.tools?.[authToolKey]\n      if (!matchedConfigEntry) {\n        continue\n      }\n      // `true` means \"enable, no override\"; only the object form carries fields.\n      const override = typeof matchedConfigEntry === 'object' ? matchedConfigEntry : undefined\n      items.push({\n        type: 'collectionTool',\n        collectionSlug: slug,\n        key: authToolKey,\n        label,\n        tool: overrideBuiltinTool(tool, override, collectionPluginConfig),\n      })\n    }\n  }\n\n  // Cast: builtin keys are filtered out below, so the remaining values are\n  // always custom tools (`CollectionTool`) or undefined\n  const customEntries = Object.entries(collectionPluginConfig?.tools ?? {}) as Array<\n    [string, CollectionTool | undefined]\n  >\n  for (const [key, customTool] of customEntries) {\n    if (key in COLLECTION_BUILTINS || key in COLLECTION_AUTH_BUILTINS) {\n      continue\n    }\n    if (!customTool) {\n      continue\n    }\n    items.push({\n      type: 'collectionTool',\n      collectionSlug: slug,\n      key,\n      label: key,\n      tool: customTool,\n    })\n  }\n\n  return items\n}\n\nconst sanitizeGlobalConfig = ({\n  global,\n  pluginConfig,\n}: {\n  global: GlobalConfig | SanitizedGlobalConfig\n  pluginConfig: MCPPluginConfig\n}): MCPItem[] => {\n  const slug = global.slug\n  const globalPluginConfig = pluginConfig.globals?.[slug]\n  const items: MCPItem[] = []\n\n  for (const [toolKey, baseTool] of GLOBAL_BUILTIN_ENTRIES) {\n    const matchedConfigEntry = globalPluginConfig?.tools?.[toolKey]\n    if (matchedConfigEntry === false) {\n      continue\n    }\n    items.push({\n      type: 'globalTool',\n      globalSlug: slug,\n      key: toolKey,\n      label: capitalize(toolKey),\n      tool: overrideBuiltinTool(baseTool, matchedConfigEntry, globalPluginConfig),\n    })\n  }\n\n  const customEntries = Object.entries(globalPluginConfig?.tools ?? {}) as Array<\n    [string, GlobalTool | undefined]\n  >\n  for (const [key, customTool] of customEntries) {\n    if (key in GLOBAL_BUILTINS) {\n      continue\n    }\n    if (!customTool) {\n      continue\n    }\n    items.push({\n      type: 'globalTool',\n      globalSlug: slug,\n      key,\n      label: key,\n      tool: customTool,\n    })\n  }\n\n  return items\n}\n\nconst capitalize = (s: string): string => s.charAt(0).toUpperCase() + s.slice(1)\n\n/**\n * Spread the static built-in tool and apply consumer-side overrides.\n * Precedence: per-tool override > scope-level (collection/global) override >\n * the static tool's defaults. `toolEntry` is whatever the user put under\n * `tools: { find: ... }` — could be `true`, `false`, or an override object —\n * so it's narrowed internally.\n */\nconst overrideBuiltinTool = <TTool extends CollectionTool | GlobalTool>(\n  tool: TTool,\n  toolOverride?: MCPBuiltInToolOverride,\n  entityPluginConfig?: TTool extends CollectionTool\n    ? MCPPluginCollectionConfig<any>\n    : MCPPluginGlobalConfig,\n): TTool => {\n  return {\n    ...tool,\n    description: toolOverride?.description ?? entityPluginConfig?.description ?? tool.description,\n    overrideResponse:\n      toolOverride?.overrideResponse ??\n      entityPluginConfig?.overrideResponse ??\n      tool.overrideResponse,\n  }\n}\n"],"names":["COLLECTION_AUTH_BUILTIN_ENTRIES","COLLECTION_AUTH_BUILTINS","COLLECTION_BUILTIN_ENTRIES","COLLECTION_BUILTINS","GLOBAL_BUILTIN_ENTRIES","GLOBAL_BUILTINS","sanitizeMCPConfig","config","pluginConfig","items","collection","collections","push","sanitizeCollectionConfig","global","globals","sanitizeGlobalConfig","key","tool","Object","entries","tools","type","label","prompt","prompts","title","resource","resources","firstCollectionWithAuth","find","auth","Boolean","disabled","mcp","overrideApiKeyCollection","overrideAuth","userCollection","admin","user","slug","collectionPluginConfig","toolKey","matchedConfigEntry","collectionSlug","capitalize","overrideBuiltinTool","authToolKey","override","undefined","customEntries","customTool","globalPluginConfig","baseTool","globalSlug","s","charAt","toUpperCase","slice","toolOverride","entityPluginConfig","description","overrideResponse"],"mappings":"AAoBA,SACEA,+BAA+B,EAC/BC,wBAAwB,EACxBC,0BAA0B,EAC1BC,mBAAmB,EACnBC,sBAAsB,EACtBC,eAAe,QACV,oBAAmB;AAE1B;;;;;;;;;CASC,GACD,OAAO,MAAMC,oBAAoB,CAAC,EAChCC,MAAM,EACNC,YAAY,EAIb;IACC,MAAMC,QAAmB,EAAE;IAE3B,KAAK,MAAMC,cAAcH,OAAOI,WAAW,IAAI,EAAE,CAAE;QACjDF,MAAMG,IAAI,IAAIC,yBAAyB;YAAEH;YAAYF;QAAa;IACpE;IAEA,KAAK,MAAMM,UAAUP,OAAOQ,OAAO,IAAI,EAAE,CAAE;QACzCN,MAAMG,IAAI,IAAII,qBAAqB;YAAEF;YAAQN;QAAa;IAC5D;IAEA,KAAK,MAAM,CAACS,KAAKC,KAAK,IAAIC,OAAOC,OAAO,CAACZ,aAAaa,KAAK,IAAI,CAAC,GAAI;QAClEZ,MAAMG,IAAI,CAAC;YACTU,MAAM;YACNL;YACAM,OAAON;YACPC;QACF;IACF;IAEA,KAAK,MAAM,CAACD,KAAKO,OAAO,IAAIL,OAAOC,OAAO,CAACZ,aAAaiB,OAAO,IAAI,CAAC,GAAI;QACtEhB,MAAMG,IAAI,CAAC;YACTU,MAAM;YACNL;YACAM,OAAOC,OAAOE,KAAK,IAAIT;YACvBO;QACF;IACF;IAEA,KAAK,MAAM,CAACP,KAAKU,SAAS,IAAIR,OAAOC,OAAO,CAACZ,aAAaoB,SAAS,IAAI,CAAC,GAAI;QAC1EnB,MAAMG,IAAI,CAAC;YACTU,MAAM;YACNL;YACAM,OAAOI,SAASD,KAAK,IAAIT;YACzBU;QACF;IACF;IAEA,mFAAmF;IACnF,MAAME,0BAA0BtB,OAAOI,WAAW,CAAEmB,IAAI,CAAC,CAAC,EAAEC,IAAI,EAAE,GAAKC,QAAQD;IAE/E,OAAO;QACLE,UAAUzB,aAAayB,QAAQ;QAC/BxB;QACAyB,KAAK1B,aAAa0B,GAAG;QACrBC,0BAA0B3B,aAAa2B,wBAAwB;QAC/DC,cAAc5B,aAAa4B,YAAY;QACvCC,gBACE7B,aAAa6B,cAAc,IAAI9B,OAAO+B,KAAK,EAAEC,QAAQV,yBAAyBW,QAAQ;IAC1F;AACF,EAAC;AAED,MAAM3B,2BAA2B,CAAC,EAChCH,UAAU,EACVF,YAAY,EAIb;IACC,IAAIE,WAAW8B,IAAI,KAAK,wBAAwB;QAC9C,OAAO,EAAE;IACX;IACA,MAAMA,OAAO9B,WAAW8B,IAAI;IAC5B,MAAMC,yBAAyBjC,aAAaG,WAAW,EAAE,CAAC6B,KAAK;IAC/D,MAAM/B,QAAmB,EAAE;IAE3B,KAAK,MAAM,CAACiC,SAASxB,KAAK,IAAIhB,2BAA4B;QACxD,MAAMyC,qBAAqBF,wBAAwBpB,OAAO,CAACqB,QAAQ;QACnE,IAAIC,uBAAuB,OAAO;YAChC;QACF;QACAlC,MAAMG,IAAI,CAAC;YACTU,MAAM;YACNsB,gBAAgBJ;YAChBvB,KAAKyB;YACLnB,OAAOsB,WAAWH;YAClBxB,MAAM4B,oBAAoB5B,MAAMyB,oBAAoBF;QACtD;IACF;IAEA,IAAI/B,WAAWqB,IAAI,EAAE;QACnB,KAAK,MAAM,CAACgB,aAAa,EAAExB,KAAK,EAAEL,IAAI,EAAE,CAAC,IAAIlB,gCAAiC;YAC5E,MAAM2C,qBAAqBF,wBAAwBpB,OAAO,CAAC0B,YAAY;YACvE,IAAI,CAACJ,oBAAoB;gBACvB;YACF;YACA,2EAA2E;YAC3E,MAAMK,WAAW,OAAOL,uBAAuB,WAAWA,qBAAqBM;YAC/ExC,MAAMG,IAAI,CAAC;gBACTU,MAAM;gBACNsB,gBAAgBJ;gBAChBvB,KAAK8B;gBACLxB;gBACAL,MAAM4B,oBAAoB5B,MAAM8B,UAAUP;YAC5C;QACF;IACF;IAEA,yEAAyE;IACzE,sDAAsD;IACtD,MAAMS,gBAAgB/B,OAAOC,OAAO,CAACqB,wBAAwBpB,SAAS,CAAC;IAGvE,KAAK,MAAM,CAACJ,KAAKkC,WAAW,IAAID,cAAe;QAC7C,IAAIjC,OAAOd,uBAAuBc,OAAOhB,0BAA0B;YACjE;QACF;QACA,IAAI,CAACkD,YAAY;YACf;QACF;QACA1C,MAAMG,IAAI,CAAC;YACTU,MAAM;YACNsB,gBAAgBJ;YAChBvB;YACAM,OAAON;YACPC,MAAMiC;QACR;IACF;IAEA,OAAO1C;AACT;AAEA,MAAMO,uBAAuB,CAAC,EAC5BF,MAAM,EACNN,YAAY,EAIb;IACC,MAAMgC,OAAO1B,OAAO0B,IAAI;IACxB,MAAMY,qBAAqB5C,aAAaO,OAAO,EAAE,CAACyB,KAAK;IACvD,MAAM/B,QAAmB,EAAE;IAE3B,KAAK,MAAM,CAACiC,SAASW,SAAS,IAAIjD,uBAAwB;QACxD,MAAMuC,qBAAqBS,oBAAoB/B,OAAO,CAACqB,QAAQ;QAC/D,IAAIC,uBAAuB,OAAO;YAChC;QACF;QACAlC,MAAMG,IAAI,CAAC;YACTU,MAAM;YACNgC,YAAYd;YACZvB,KAAKyB;YACLnB,OAAOsB,WAAWH;YAClBxB,MAAM4B,oBAAoBO,UAAUV,oBAAoBS;QAC1D;IACF;IAEA,MAAMF,gBAAgB/B,OAAOC,OAAO,CAACgC,oBAAoB/B,SAAS,CAAC;IAGnE,KAAK,MAAM,CAACJ,KAAKkC,WAAW,IAAID,cAAe;QAC7C,IAAIjC,OAAOZ,iBAAiB;YAC1B;QACF;QACA,IAAI,CAAC8C,YAAY;YACf;QACF;QACA1C,MAAMG,IAAI,CAAC;YACTU,MAAM;YACNgC,YAAYd;YACZvB;YACAM,OAAON;YACPC,MAAMiC;QACR;IACF;IAEA,OAAO1C;AACT;AAEA,MAAMoC,aAAa,CAACU,IAAsBA,EAAEC,MAAM,CAAC,GAAGC,WAAW,KAAKF,EAAEG,KAAK,CAAC;AAE9E;;;;;;CAMC,GACD,MAAMZ,sBAAsB,CAC1B5B,MACAyC,cACAC;IAIA,OAAO;QACL,GAAG1C,IAAI;QACP2C,aAAaF,cAAcE,eAAeD,oBAAoBC,eAAe3C,KAAK2C,WAAW;QAC7FC,kBACEH,cAAcG,oBACdF,oBAAoBE,oBACpB5C,KAAK4C,gBAAgB;IACzB;AACF"}

package/dist/stdio.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Stdio adapter for the Payload MCP server.
+ *
+ * Do not use in production. There's no auth; whoever can spawn the process gets
+ * full access to your local data.
+ */
+export declare const runMcpStdio: () => Promise<void>;
+//# sourceMappingURL=stdio.d.ts.map

package/dist/stdio.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdio.d.ts","sourceRoot":"","sources":["../src/stdio.ts"],"names":[],"mappings":"AAeA;;;;;GAKG;AACH,eAAO,MAAM,WAAW,QAAa,OAAO,CAAC,IAAI,CA4EhD,CAAA"}

package/dist/stdio.js

@@ -0,0 +1,89 @@
+/* eslint-disable no-console */ import { StdioServerTransport } from '@modelcontextprotocol/server';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { createLocalReq, getPayload } from 'payload';
+import { findConfig } from 'payload/node';
+import { buildMcpServer } from './mcp/buildMcpServer.js';
+import { sanitizeMCPConfig } from './mcp/sanitizeMCPConfig.js';
+import { getPluginConfig } from './utils/getPluginConfig.js';
+import { resolveProjectRoot } from './utils/resolveProjectRoot.js';
+/**
+ * Stdio adapter for the Payload MCP server.
+ *
+ * Do not use in production. There's no auth; whoever can spawn the process gets
+ * full access to your local data.
+ */ export const runMcpStdio = async ()=>{
+    /**
+   * If MCP clients spawn stdio servers from an arbitrary working directory,
+   * Payload's cwd-anchored `findConfig()` can't locate the project on
+   * its own. This module always lives inside the project's `node_modules`, so
+   * we derive the project root from its own path and `chdir` into it.
+   *
+   * An absolute `PAYLOAD_CONFIG_PATH` still overrides everything; unusual
+   * layouts (e.g. a monorepo where the package is hoisted above the app) can
+   * fall back to it. See the implementation of findConfig for details.
+   */ const projectRoot = resolveProjectRoot(fileURLToPath(import.meta.url));
+    if (projectRoot) {
+        process.chdir(projectRoot);
+    }
+    const configPath = findConfig();
+    const configModule = await import(pathToFileURL(configPath).toString());
+    const config = await (configModule.default ?? configModule);
+    const payload = await getPayload({
+        config
+    });
+    /**
+   * If the user added `mcpPlugin({...})` to their `plugins` array, read the
+   * sanitized config they registered. Otherwise fall back to the defaults. That way,
+   * the mcp works on any project that has `@payloadcms/plugin-mcp` installed,
+   * even if the plugin is not added to the plugins array.
+   */ let pluginConfig;
+    try {
+        pluginConfig = getPluginConfig({
+            config: payload.config
+        });
+    } catch  {
+        pluginConfig = sanitizeMCPConfig({
+            config: payload.config,
+            pluginConfig: {}
+        });
+        const fakePluginFn = (config)=>config;
+        fakePluginFn.slug = '@payloadcms/plugin-mcp';
+        // @ts-expect-error
+        fakePluginFn.sanitizedOptions = pluginConfig;
+        (payload.config.plugins ??= []).push(fakePluginFn);
+    }
+    const authorizedMCP = {
+        items: pluginConfig.items,
+        overrideAccess: true,
+        user: null
+    };
+    const req = await createLocalReq({}, payload);
+    req.payloadAPI = 'MCP';
+    const server = buildMcpServer({
+        authorizedMCP,
+        pluginConfig,
+        req
+    });
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    // Process now lives until stdin closes. Wire graceful shutdown so DB
+    // connections (and any other Payload-managed resources) get released.
+    const shutdown = async (code = 0)=>{
+        try {
+            await server.close();
+        } catch (err) {
+            console.error('[payload-mcp] error closing server:', err);
+        }
+        try {
+            await payload.destroy();
+        } catch (err) {
+            console.error('[payload-mcp] error destroying payload:', err);
+        }
+        process.exit(code);
+    };
+    process.on('SIGINT', ()=>void shutdown(0));
+    process.on('SIGTERM', ()=>void shutdown(0));
+    process.stdin.on('close', ()=>void shutdown(0));
+};
+
+//# sourceMappingURL=stdio.js.map

package/dist/stdio.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/stdio.ts"],"sourcesContent":["import type { MaybePromise, Plugin, SanitizedConfig } from 'payload'\n\n/* eslint-disable no-console */\nimport { StdioServerTransport } from '@modelcontextprotocol/server'\nimport { fileURLToPath, pathToFileURL } from 'node:url'\nimport { createLocalReq, getPayload } from 'payload'\nimport { findConfig } from 'payload/node'\n\nimport type { AuthorizedMCP, SanitizedMCPPluginConfig } from './types.js'\n\nimport { buildMcpServer } from './mcp/buildMcpServer.js'\nimport { sanitizeMCPConfig } from './mcp/sanitizeMCPConfig.js'\nimport { getPluginConfig } from './utils/getPluginConfig.js'\nimport { resolveProjectRoot } from './utils/resolveProjectRoot.js'\n\n/**\n * Stdio adapter for the Payload MCP server.\n *\n * Do not use in production. There's no auth; whoever can spawn the process gets\n * full access to your local data.\n */\nexport const runMcpStdio = async (): Promise<void> => {\n  /**\n   * If MCP clients spawn stdio servers from an arbitrary working directory,\n   * Payload's cwd-anchored `findConfig()` can't locate the project on\n   * its own. This module always lives inside the project's `node_modules`, so\n   * we derive the project root from its own path and `chdir` into it.\n   *\n   * An absolute `PAYLOAD_CONFIG_PATH` still overrides everything; unusual\n   * layouts (e.g. a monorepo where the package is hoisted above the app) can\n   * fall back to it. See the implementation of findConfig for details.\n   */\n  const projectRoot = resolveProjectRoot(fileURLToPath(import.meta.url))\n  if (projectRoot) {\n    process.chdir(projectRoot)\n  }\n\n  const configPath = findConfig()\n  const configModule = await import(pathToFileURL(configPath).toString())\n  const config = (await (configModule.default ?? configModule)) as MaybePromise<SanitizedConfig>\n\n  const payload = await getPayload({ config })\n\n  /**\n   * If the user added `mcpPlugin({...})` to their `plugins` array, read the\n   * sanitized config they registered. Otherwise fall back to the defaults. That way,\n   * the mcp works on any project that has `@payloadcms/plugin-mcp` installed,\n   * even if the plugin is not added to the plugins array.\n   */\n  let pluginConfig: SanitizedMCPPluginConfig\n  try {\n    pluginConfig = getPluginConfig({ config: payload.config })\n  } catch {\n    pluginConfig = sanitizeMCPConfig({ config: payload.config, pluginConfig: {} })\n\n    const fakePluginFn: Plugin = (config) => config\n    fakePluginFn.slug = '@payloadcms/plugin-mcp'\n    // @ts-expect-error\n    fakePluginFn.sanitizedOptions = pluginConfig\n\n    // Push to payload config, to ensure consecutive calls to `getPluginConfig()` work\n    ;(payload.config.plugins ??= []).push(fakePluginFn)\n  }\n\n  const authorizedMCP: AuthorizedMCP = {\n    items: pluginConfig.items,\n    overrideAccess: true,\n    user: null,\n  }\n\n  const req = await createLocalReq({}, payload)\n  req.payloadAPI = 'MCP' as const\n\n  const server = buildMcpServer({ authorizedMCP, pluginConfig, req })\n\n  const transport = new StdioServerTransport()\n  await server.connect(transport)\n\n  // Process now lives until stdin closes. Wire graceful shutdown so DB\n  // connections (and any other Payload-managed resources) get released.\n  const shutdown = async (code = 0) => {\n    try {\n      await server.close()\n    } catch (err) {\n      console.error('[payload-mcp] error closing server:', err)\n    }\n    try {\n      await payload.destroy()\n    } catch (err) {\n      console.error('[payload-mcp] error destroying payload:', err)\n    }\n    process.exit(code)\n  }\n\n  process.on('SIGINT', () => void shutdown(0))\n  process.on('SIGTERM', () => void shutdown(0))\n  process.stdin.on('close', () => void shutdown(0))\n}\n"],"names":["StdioServerTransport","fileURLToPath","pathToFileURL","createLocalReq","getPayload","findConfig","buildMcpServer","sanitizeMCPConfig","getPluginConfig","resolveProjectRoot","runMcpStdio","projectRoot","url","process","chdir","configPath","configModule","toString","config","default","payload","pluginConfig","fakePluginFn","slug","sanitizedOptions","plugins","push","authorizedMCP","items","overrideAccess","user","req","payloadAPI","server","transport","connect","shutdown","code","close","err","console","error","destroy","exit","on","stdin"],"mappings":"AAEA,6BAA6B,GAC7B,SAASA,oBAAoB,QAAQ,+BAA8B;AACnE,SAASC,aAAa,EAAEC,aAAa,QAAQ,WAAU;AACvD,SAASC,cAAc,EAAEC,UAAU,QAAQ,UAAS;AACpD,SAASC,UAAU,QAAQ,eAAc;AAIzC,SAASC,cAAc,QAAQ,0BAAyB;AACxD,SAASC,iBAAiB,QAAQ,6BAA4B;AAC9D,SAASC,eAAe,QAAQ,6BAA4B;AAC5D,SAASC,kBAAkB,QAAQ,gCAA+B;AAElE;;;;;CAKC,GACD,OAAO,MAAMC,cAAc;IACzB;;;;;;;;;GASC,GACD,MAAMC,cAAcF,mBAAmBR,cAAc,YAAYW,GAAG;IACpE,IAAID,aAAa;QACfE,QAAQC,KAAK,CAACH;IAChB;IAEA,MAAMI,aAAaV;IACnB,MAAMW,eAAe,MAAM,MAAM,CAACd,cAAca,YAAYE,QAAQ;IACpE,MAAMC,SAAU,MAAOF,CAAAA,aAAaG,OAAO,IAAIH,YAAW;IAE1D,MAAMI,UAAU,MAAMhB,WAAW;QAAEc;IAAO;IAE1C;;;;;GAKC,GACD,IAAIG;IACJ,IAAI;QACFA,eAAeb,gBAAgB;YAAEU,QAAQE,QAAQF,MAAM;QAAC;IAC1D,EAAE,OAAM;QACNG,eAAed,kBAAkB;YAAEW,QAAQE,QAAQF,MAAM;YAAEG,cAAc,CAAC;QAAE;QAE5E,MAAMC,eAAuB,CAACJ,SAAWA;QACzCI,aAAaC,IAAI,GAAG;QACpB,mBAAmB;QACnBD,aAAaE,gBAAgB,GAAGH;QAG9BD,CAAAA,QAAQF,MAAM,CAACO,OAAO,KAAK,EAAE,AAAD,EAAGC,IAAI,CAACJ;IACxC;IAEA,MAAMK,gBAA+B;QACnCC,OAAOP,aAAaO,KAAK;QACzBC,gBAAgB;QAChBC,MAAM;IACR;IAEA,MAAMC,MAAM,MAAM5B,eAAe,CAAC,GAAGiB;IACrCW,IAAIC,UAAU,GAAG;IAEjB,MAAMC,SAAS3B,eAAe;QAAEqB;QAAeN;QAAcU;IAAI;IAEjE,MAAMG,YAAY,IAAIlC;IACtB,MAAMiC,OAAOE,OAAO,CAACD;IAErB,qEAAqE;IACrE,sEAAsE;IACtE,MAAME,WAAW,OAAOC,OAAO,CAAC;QAC9B,IAAI;YACF,MAAMJ,OAAOK,KAAK;QACpB,EAAE,OAAOC,KAAK;YACZC,QAAQC,KAAK,CAAC,uCAAuCF;QACvD;QACA,IAAI;YACF,MAAMnB,QAAQsB,OAAO;QACvB,EAAE,OAAOH,KAAK;YACZC,QAAQC,KAAK,CAAC,2CAA2CF;QAC3D;QACA1B,QAAQ8B,IAAI,CAACN;IACf;IAEAxB,QAAQ+B,EAAE,CAAC,UAAU,IAAM,KAAKR,SAAS;IACzCvB,QAAQ+B,EAAE,CAAC,WAAW,IAAM,KAAKR,SAAS;IAC1CvB,QAAQgC,KAAK,CAACD,EAAE,CAAC,SAAS,IAAM,KAAKR,SAAS;AAChD,EAAC"}