@payloadcms/plugin-mcp 3.87.1 → 3.89.0-internal.4b0e9b6

package/dist/collections/createApiKeysCollection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createApiKeysCollection.d.ts","sourceRoot":"","sources":["../../src/collections/createApiKeysCollection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAkB,MAAM,SAAS,CAAA;AAE/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAKlD,eAAO,MAAM,uBAAuB,gBACrB,eAAe,CAAC,aAAa,CAAC,WAClC,eAAe,CAAC,SAAS,CAAC,eACtB,KAAK,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,iCACtC,WAAW,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,6BACzD,eAAe,KAC7B,gBAuWF,CAAA"}
+{"version":3,"file":"createApiKeysCollection.d.ts","sourceRoot":"","sources":["../../src/collections/createApiKeysCollection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAyC,MAAM,SAAS,CAAA;AAEtF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAKlD,eAAO,MAAM,uBAAuB,gBACrB,eAAe,CAAC,aAAa,CAAC,WAClC,eAAe,CAAC,SAAS,CAAC,eACtB,KAAK,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,iCACtC,WAAW,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,6BACzD,eAAe,KAC7B,gBAiYF,CAAA"}

package/dist/collections/createApiKeysCollection.js

@@ -38,8 +38,24 @@ export const createAPIKeysCollection = (collections, globals, customTools = [],
         };
     }) || [];
     const userCollection = pluginOptions.userCollection;
+    const isAuthenticated = ({ req })=>Boolean(req.user && req.user.collection === userCollection);
+    const restrictToOwnKeys = ({ req })=>req.user && req.user.collection === userCollection ? {
+            user: {
+                equals: req.user.id
+            }
+        } : false;
     return {
         slug: 'payload-mcp-api-keys',
+        access: {
+            // Fail-safe default: any authenticated user may manage only their OWN keys.
+            // Cross-user key issuance is disabled by default (see the `user` field below)
+            // and must be granted explicitly via `overrideApiKeyCollection`.
+            create: isAuthenticated,
+            delete: restrictToOwnKeys,
+            read: restrictToOwnKeys,
+            unlock: restrictToOwnKeys,
+            update: restrictToOwnKeys
+        },
         admin: {
             description: 'API keys control which collections, resources, tools, and prompts MCP clients can access',
             group: 'MCP',
@@ -53,9 +69,18 @@ export const createAPIKeysCollection = (collections, globals, customTools = [],
             {
                 name: 'user',
                 type: 'relationship',
+                access: {
+                    // Bind new keys to the creating user and prevent re-binding on update.
+                    // A key acts as its associated user, so allowing arbitrary assignment lets
+                    // any key manager impersonate anyone. Grant these via `overrideApiKeyCollection`
+                    // to let trusted administrators issue keys on behalf of other users.
+                    create: ()=>false,
+                    update: ()=>false
+                },
                 admin: {
                     description: 'The user that the API key is associated with.'
                 },
+                defaultValue: ({ req })=>req.user && req.user.collection === userCollection ? req.user.id : undefined,
                 relationTo: userCollection,
                 required: true
             },

package/dist/collections/createApiKeysCollection.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/collections/createApiKeysCollection.ts"],"sourcesContent":["import type { CollectionConfig, CollectionSlug } from 'payload'\n\nimport type { MCPPluginConfig } from '../types.js'\n\nimport { toCamelCase } from '../utils/camelCase.js'\nimport { createApiKeyFields } from '../utils/createApiKeyFields.js'\n\nexport const createAPIKeysCollection = (\n  collections: MCPPluginConfig['collections'],\n  globals: MCPPluginConfig['globals'],\n  customTools: Array<{ description: string; name: string }> = [],\n  experimentalTools: NonNullable<MCPPluginConfig['experimental']>['tools'] = {},\n  pluginOptions: MCPPluginConfig,\n): CollectionConfig => {\n  const customToolsFields = customTools.map((tool) => {\n    const camelCasedName = toCamelCase(tool.name)\n    return {\n      name: camelCasedName,\n      type: 'checkbox' as const,\n      admin: {\n        description: tool.description,\n      },\n      defaultValue: true,\n      label: camelCasedName,\n    }\n  })\n\n  const customResourceFields =\n    pluginOptions.mcp?.resources?.map((resource) => {\n      const camelCasedName = toCamelCase(resource.name)\n      return {\n        name: camelCasedName,\n        type: 'checkbox' as const,\n        admin: {\n          description: resource.description,\n        },\n        defaultValue: true,\n        label: camelCasedName,\n      }\n    }) || []\n\n  const customPromptFields =\n    pluginOptions.mcp?.prompts?.map((prompt) => {\n      const camelCasedName = toCamelCase(prompt.name)\n      return {\n        name: camelCasedName,\n        type: 'checkbox' as const,\n        admin: {\n          description: prompt.description,\n        },\n        defaultValue: true,\n        label: camelCasedName,\n      }\n    }) || []\n\n  const userCollection = pluginOptions.userCollection\n\n  return {\n    slug: 'payload-mcp-api-keys',\n    admin: {\n      description:\n        'API keys control which collections, resources, tools, and prompts MCP clients can access',\n      group: 'MCP',\n      useAsTitle: 'label',\n    },\n    auth: {\n      disableLocalStrategy: true,\n      useAPIKey: true,\n    },\n    fields: [\n      {\n        name: 'user',\n        type: 'relationship',\n        admin: {\n          description: 'The user that the API key is associated with.',\n        },\n        relationTo: userCollection as CollectionSlug,\n        required: true,\n      },\n      {\n        name: 'label',\n        type: 'text',\n        admin: {\n          description: 'A useful label for the API key.',\n        },\n      },\n      {\n        name: 'description',\n        type: 'text',\n        admin: {\n          description: 'The purpose of the API key.',\n        },\n      },\n\n      ...createApiKeyFields({\n        config: collections,\n        configType: 'collection',\n      }),\n\n      ...createApiKeyFields({\n        config: globals,\n        configType: 'global',\n      }),\n\n      ...(customTools.length > 0\n        ? [\n            {\n              type: 'collapsible' as const,\n              admin: {\n                description: 'Manage client access to tools',\n                position: 'sidebar' as const,\n              },\n              fields: [\n                {\n                  name: 'payload-mcp-tool',\n                  type: 'group' as const,\n                  fields: customToolsFields,\n                  label: false as const,\n                },\n              ],\n              label: 'Tools',\n            },\n          ]\n        : []),\n\n      ...(pluginOptions.mcp?.resources && pluginOptions.mcp?.resources.length > 0\n        ? [\n            {\n              type: 'collapsible' as const,\n              admin: {\n                description: 'Manage client access to resources',\n                position: 'sidebar' as const,\n              },\n              fields: [\n                {\n                  name: 'payload-mcp-resource',\n                  type: 'group' as const,\n                  fields: customResourceFields,\n                  label: false as const,\n                },\n              ],\n              label: 'Resources',\n            },\n          ]\n        : []),\n\n      ...(pluginOptions.mcp?.prompts && pluginOptions.mcp?.prompts.length > 0\n        ? [\n            {\n              type: 'collapsible' as const,\n              admin: {\n                description: 'Manage client access to prompts',\n                position: 'sidebar' as const,\n              },\n              fields: [\n                {\n                  name: 'payload-mcp-prompt',\n                  type: 'group' as const,\n                  fields: customPromptFields,\n                  label: false as const,\n                },\n              ],\n              label: 'Prompts',\n            },\n          ]\n        : []),\n\n      // Experimental Tools\n      ...(process.env.NODE_ENV === 'development' &&\n      (experimentalTools?.collections?.enabled ||\n        experimentalTools?.jobs?.enabled ||\n        experimentalTools?.config?.enabled ||\n        experimentalTools?.auth?.enabled)\n        ? [\n            {\n              type: 'collapsible' as const,\n              admin: {\n                description: 'Manage client access to experimental tools',\n                position: 'sidebar' as const,\n              },\n              fields: [\n                ...(experimentalTools?.collections?.enabled\n                  ? [\n                      {\n                        name: 'collections',\n                        type: 'group' as const,\n                        fields: [\n                          {\n                            name: 'find',\n                            type: 'checkbox' as const,\n                            admin: {\n                              description:\n                                'Allow LLMs to find and list Payload collections with optional content and document counts.',\n                            },\n                            defaultValue: false,\n                          },\n                          {\n                            name: 'create',\n                            type: 'checkbox' as const,\n                            admin: {\n                              description:\n                                'Allow LLMs to create new Payload collections with specified fields and configuration.',\n                            },\n                            defaultValue: false,\n                          },\n                          {\n                            name: 'update',\n                            type: 'checkbox' as const,\n                            admin: {\n                              description:\n                                'Allow LLMs to update existing Payload collections with new fields, modifications, or configuration changes.',\n                            },\n                            defaultValue: false,\n                          },\n                          {\n                            name: 'delete',\n                            type: 'checkbox' as const,\n                            admin: {\n                              description:\n                                'Allow LLMs to delete Payload collections and optionally update the configuration.',\n                            },\n                            defaultValue: false,\n                          },\n                        ],\n                      },\n                    ]\n                  : []),\n                ...(experimentalTools?.jobs?.enabled\n                  ? [\n                      {\n                        name: 'jobs',\n                        type: 'group' as const,\n                        fields: [\n                          {\n                            name: 'create',\n                            type: 'checkbox' as const,\n                            admin: {\n                              description:\n                                'Allow LLMs to create new Payload jobs (tasks and workflows) with custom schemas and configuration.',\n                            },\n                            defaultValue: false,\n                          },\n                          {\n                            name: 'run',\n                            type: 'checkbox' as const,\n                            admin: {\n                              description:\n                                'Allow LLMs to execute Payload jobs with custom input data and queue options.',\n                            },\n                            defaultValue: false,\n                          },\n                          {\n                            name: 'update',\n                            type: 'checkbox' as const,\n                            admin: {\n                              description:\n                                'Allow LLMs to update existing Payload jobs with new schemas, configuration, or handler code.',\n                            },\n                            defaultValue: false,\n                          },\n                        ],\n                      },\n                    ]\n                  : []),\n                ...(experimentalTools?.config?.enabled\n                  ? [\n                      {\n                        name: 'config',\n                        type: 'group' as const,\n                        fields: [\n                          {\n                            name: 'find',\n                            type: 'checkbox' as const,\n                            admin: {\n                              description:\n                                'Allow LLMs to read and display a Payload configuration file.',\n                            },\n                            defaultValue: false,\n                          },\n                          {\n                            name: 'update',\n                            type: 'checkbox' as const,\n                            admin: {\n                              description:\n                                'Allow LLMs to update a Payload configuration file with various modifications.',\n                            },\n                            defaultValue: false,\n                          },\n                        ],\n                      },\n                    ]\n                  : []),\n                ...(experimentalTools?.auth?.enabled\n                  ? [\n                      {\n                        name: 'auth',\n                        type: 'group' as const,\n                        fields: [\n                          {\n                            name: 'auth',\n                            type: 'checkbox' as const,\n                            admin: {\n                              description:\n                                'Allow LLMs to check authentication status for a user by setting custom headers. (e.g. {\"Authorization\": \"Bearer <token>\"})',\n                            },\n                            defaultValue: false,\n                            label: 'Check Auth Status',\n                          },\n                          {\n                            name: 'login',\n                            type: 'checkbox' as const,\n                            admin: {\n                              description:\n                                'Allow LLMs to authenticate a user with email and password.',\n                            },\n                            defaultValue: false,\n                            label: 'User Login',\n                          },\n                          {\n                            name: 'verify',\n                            type: 'checkbox' as const,\n                            admin: {\n                              description:\n                                'Allow LLMs to verify a user email with a verification token.',\n                            },\n                            defaultValue: false,\n                            label: 'Email Verification',\n                          },\n                          {\n                            name: 'resetPassword',\n                            type: 'checkbox' as const,\n                            admin: {\n                              description:\n                                'Allow LLMs to reset a user password with a reset token.',\n                            },\n                            defaultValue: false,\n                            label: 'Reset Password',\n                          },\n                          {\n                            name: 'forgotPassword',\n                            type: 'checkbox' as const,\n                            admin: {\n                              description: 'Allow LLMs to send a password reset email to a user.',\n                            },\n                            defaultValue: false,\n                            label: 'Forgot Password',\n                          },\n                          {\n                            name: 'unlock',\n                            type: 'checkbox' as const,\n                            admin: {\n                              description:\n                                'Allow LLMs to unlock a user account that has been locked due to failed login attempts.',\n                            },\n                            defaultValue: false,\n                            label: 'Unlock Account',\n                          },\n                        ],\n                      },\n                    ]\n                  : []),\n              ],\n              label: 'Experimental Tools',\n            },\n          ]\n        : []),\n    ],\n    labels: {\n      plural: 'API Keys',\n      singular: 'API Key',\n    },\n  }\n}\n"],"names":["toCamelCase","createApiKeyFields","createAPIKeysCollection","collections","globals","customTools","experimentalTools","pluginOptions","customToolsFields","map","tool","camelCasedName","name","type","admin","description","defaultValue","label","customResourceFields","mcp","resources","resource","customPromptFields","prompts","prompt","userCollection","slug","group","useAsTitle","auth","disableLocalStrategy","useAPIKey","fields","relationTo","required","config","configType","length","position","process","env","NODE_ENV","enabled","jobs","labels","plural","singular"],"mappings":"AAIA,SAASA,WAAW,QAAQ,wBAAuB;AACnD,SAASC,kBAAkB,QAAQ,iCAAgC;AAEnE,OAAO,MAAMC,0BAA0B,CACrCC,aACAC,SACAC,cAA4D,EAAE,EAC9DC,oBAA2E,CAAC,CAAC,EAC7EC;IAEA,MAAMC,oBAAoBH,YAAYI,GAAG,CAAC,CAACC;QACzC,MAAMC,iBAAiBX,YAAYU,KAAKE,IAAI;QAC5C,OAAO;YACLA,MAAMD;YACNE,MAAM;YACNC,OAAO;gBACLC,aAAaL,KAAKK,WAAW;YAC/B;YACAC,cAAc;YACdC,OAAON;QACT;IACF;IAEA,MAAMO,uBACJX,cAAcY,GAAG,EAAEC,WAAWX,IAAI,CAACY;QACjC,MAAMV,iBAAiBX,YAAYqB,SAAST,IAAI;QAChD,OAAO;YACLA,MAAMD;YACNE,MAAM;YACNC,OAAO;gBACLC,aAAaM,SAASN,WAAW;YACnC;YACAC,cAAc;YACdC,OAAON;QACT;IACF,MAAM,EAAE;IAEV,MAAMW,qBACJf,cAAcY,GAAG,EAAEI,SAASd,IAAI,CAACe;QAC/B,MAAMb,iBAAiBX,YAAYwB,OAAOZ,IAAI;QAC9C,OAAO;YACLA,MAAMD;YACNE,MAAM;YACNC,OAAO;gBACLC,aAAaS,OAAOT,WAAW;YACjC;YACAC,cAAc;YACdC,OAAON;QACT;IACF,MAAM,EAAE;IAEV,MAAMc,iBAAiBlB,cAAckB,cAAc;IAEnD,OAAO;QACLC,MAAM;QACNZ,OAAO;YACLC,aACE;YACFY,OAAO;YACPC,YAAY;QACd;QACAC,MAAM;YACJC,sBAAsB;YACtBC,WAAW;QACb;QACAC,QAAQ;YACN;gBACEpB,MAAM;gBACNC,MAAM;gBACNC,OAAO;oBACLC,aAAa;gBACf;gBACAkB,YAAYR;gBACZS,UAAU;YACZ;YACA;gBACEtB,MAAM;gBACNC,MAAM;gBACNC,OAAO;oBACLC,aAAa;gBACf;YACF;YACA;gBACEH,MAAM;gBACNC,MAAM;gBACNC,OAAO;oBACLC,aAAa;gBACf;YACF;eAEGd,mBAAmB;gBACpBkC,QAAQhC;gBACRiC,YAAY;YACd;eAEGnC,mBAAmB;gBACpBkC,QAAQ/B;gBACRgC,YAAY;YACd;eAEI/B,YAAYgC,MAAM,GAAG,IACrB;gBACE;oBACExB,MAAM;oBACNC,OAAO;wBACLC,aAAa;wBACbuB,UAAU;oBACZ;oBACAN,QAAQ;wBACN;4BACEpB,MAAM;4BACNC,MAAM;4BACNmB,QAAQxB;4BACRS,OAAO;wBACT;qBACD;oBACDA,OAAO;gBACT;aACD,GACD,EAAE;eAEFV,cAAcY,GAAG,EAAEC,aAAab,cAAcY,GAAG,EAAEC,UAAUiB,SAAS,IACtE;gBACE;oBACExB,MAAM;oBACNC,OAAO;wBACLC,aAAa;wBACbuB,UAAU;oBACZ;oBACAN,QAAQ;wBACN;4BACEpB,MAAM;4BACNC,MAAM;4BACNmB,QAAQd;4BACRD,OAAO;wBACT;qBACD;oBACDA,OAAO;gBACT;aACD,GACD,EAAE;eAEFV,cAAcY,GAAG,EAAEI,WAAWhB,cAAcY,GAAG,EAAEI,QAAQc,SAAS,IAClE;gBACE;oBACExB,MAAM;oBACNC,OAAO;wBACLC,aAAa;wBACbuB,UAAU;oBACZ;oBACAN,QAAQ;wBACN;4BACEpB,MAAM;4BACNC,MAAM;4BACNmB,QAAQV;4BACRL,OAAO;wBACT;qBACD;oBACDA,OAAO;gBACT;aACD,GACD,EAAE;YAEN,qBAAqB;eACjBsB,QAAQC,GAAG,CAACC,QAAQ,KAAK,iBAC5BnC,CAAAA,mBAAmBH,aAAauC,WAC/BpC,mBAAmBqC,MAAMD,WACzBpC,mBAAmB6B,QAAQO,WAC3BpC,mBAAmBuB,MAAMa,OAAM,IAC7B;gBACE;oBACE7B,MAAM;oBACNC,OAAO;wBACLC,aAAa;wBACbuB,UAAU;oBACZ;oBACAN,QAAQ;2BACF1B,mBAAmBH,aAAauC,UAChC;4BACE;gCACE9B,MAAM;gCACNC,MAAM;gCACNmB,QAAQ;oCACN;wCACEpB,MAAM;wCACNC,MAAM;wCACNC,OAAO;4CACLC,aACE;wCACJ;wCACAC,cAAc;oCAChB;oCACA;wCACEJ,MAAM;wCACNC,MAAM;wCACNC,OAAO;4CACLC,aACE;wCACJ;wCACAC,cAAc;oCAChB;oCACA;wCACEJ,MAAM;wCACNC,MAAM;wCACNC,OAAO;4CACLC,aACE;wCACJ;wCACAC,cAAc;oCAChB;oCACA;wCACEJ,MAAM;wCACNC,MAAM;wCACNC,OAAO;4CACLC,aACE;wCACJ;wCACAC,cAAc;oCAChB;iCACD;4BACH;yBACD,GACD,EAAE;2BACFV,mBAAmBqC,MAAMD,UACzB;4BACE;gCACE9B,MAAM;gCACNC,MAAM;gCACNmB,QAAQ;oCACN;wCACEpB,MAAM;wCACNC,MAAM;wCACNC,OAAO;4CACLC,aACE;wCACJ;wCACAC,cAAc;oCAChB;oCACA;wCACEJ,MAAM;wCACNC,MAAM;wCACNC,OAAO;4CACLC,aACE;wCACJ;wCACAC,cAAc;oCAChB;oCACA;wCACEJ,MAAM;wCACNC,MAAM;wCACNC,OAAO;4CACLC,aACE;wCACJ;wCACAC,cAAc;oCAChB;iCACD;4BACH;yBACD,GACD,EAAE;2BACFV,mBAAmB6B,QAAQO,UAC3B;4BACE;gCACE9B,MAAM;gCACNC,MAAM;gCACNmB,QAAQ;oCACN;wCACEpB,MAAM;wCACNC,MAAM;wCACNC,OAAO;4CACLC,aACE;wCACJ;wCACAC,cAAc;oCAChB;oCACA;wCACEJ,MAAM;wCACNC,MAAM;wCACNC,OAAO;4CACLC,aACE;wCACJ;wCACAC,cAAc;oCAChB;iCACD;4BACH;yBACD,GACD,EAAE;2BACFV,mBAAmBuB,MAAMa,UACzB;4BACE;gCACE9B,MAAM;gCACNC,MAAM;gCACNmB,QAAQ;oCACN;wCACEpB,MAAM;wCACNC,MAAM;wCACNC,OAAO;4CACLC,aACE;wCACJ;wCACAC,cAAc;wCACdC,OAAO;oCACT;oCACA;wCACEL,MAAM;wCACNC,MAAM;wCACNC,OAAO;4CACLC,aACE;wCACJ;wCACAC,cAAc;wCACdC,OAAO;oCACT;oCACA;wCACEL,MAAM;wCACNC,MAAM;wCACNC,OAAO;4CACLC,aACE;wCACJ;wCACAC,cAAc;wCACdC,OAAO;oCACT;oCACA;wCACEL,MAAM;wCACNC,MAAM;wCACNC,OAAO;4CACLC,aACE;wCACJ;wCACAC,cAAc;wCACdC,OAAO;oCACT;oCACA;wCACEL,MAAM;wCACNC,MAAM;wCACNC,OAAO;4CACLC,aAAa;wCACf;wCACAC,cAAc;wCACdC,OAAO;oCACT;oCACA;wCACEL,MAAM;wCACNC,MAAM;wCACNC,OAAO;4CACLC,aACE;wCACJ;wCACAC,cAAc;wCACdC,OAAO;oCACT;iCACD;4BACH;yBACD,GACD,EAAE;qBACP;oBACDA,OAAO;gBACT;aACD,GACD,EAAE;SACP;QACD2B,QAAQ;YACNC,QAAQ;YACRC,UAAU;QACZ;IACF;AACF,EAAC"}
+{"version":3,"sources":["../../src/collections/createApiKeysCollection.ts"],"sourcesContent":["import type { CollectionConfig, CollectionSlug, PayloadRequest, Where } from 'payload'\n\nimport type { MCPPluginConfig } from '../types.js'\n\nimport { toCamelCase } from '../utils/camelCase.js'\nimport { createApiKeyFields } from '../utils/createApiKeyFields.js'\n\nexport const createAPIKeysCollection = (\n  collections: MCPPluginConfig['collections'],\n  globals: MCPPluginConfig['globals'],\n  customTools: Array<{ description: string; name: string }> = [],\n  experimentalTools: NonNullable<MCPPluginConfig['experimental']>['tools'] = {},\n  pluginOptions: MCPPluginConfig,\n): CollectionConfig => {\n  const customToolsFields = customTools.map((tool) => {\n    const camelCasedName = toCamelCase(tool.name)\n    return {\n      name: camelCasedName,\n      type: 'checkbox' as const,\n      admin: {\n        description: tool.description,\n      },\n      defaultValue: true,\n      label: camelCasedName,\n    }\n  })\n\n  const customResourceFields =\n    pluginOptions.mcp?.resources?.map((resource) => {\n      const camelCasedName = toCamelCase(resource.name)\n      return {\n        name: camelCasedName,\n        type: 'checkbox' as const,\n        admin: {\n          description: resource.description,\n        },\n        defaultValue: true,\n        label: camelCasedName,\n      }\n    }) || []\n\n  const customPromptFields =\n    pluginOptions.mcp?.prompts?.map((prompt) => {\n      const camelCasedName = toCamelCase(prompt.name)\n      return {\n        name: camelCasedName,\n        type: 'checkbox' as const,\n        admin: {\n          description: prompt.description,\n        },\n        defaultValue: true,\n        label: camelCasedName,\n      }\n    }) || []\n\n  const userCollection = pluginOptions.userCollection\n\n  const isAuthenticated = ({ req }: { req: PayloadRequest }): boolean =>\n    Boolean(req.user && req.user.collection === userCollection)\n\n  const restrictToOwnKeys = ({ req }: { req: PayloadRequest }): boolean | Where =>\n    req.user && req.user.collection === userCollection ? { user: { equals: req.user.id } } : false\n\n  return {\n    slug: 'payload-mcp-api-keys',\n    access: {\n      // Fail-safe default: any authenticated user may manage only their OWN keys.\n      // Cross-user key issuance is disabled by default (see the `user` field below)\n      // and must be granted explicitly via `overrideApiKeyCollection`.\n      create: isAuthenticated,\n      delete: restrictToOwnKeys,\n      read: restrictToOwnKeys,\n      unlock: restrictToOwnKeys,\n      update: restrictToOwnKeys,\n    },\n    admin: {\n      description:\n        'API keys control which collections, resources, tools, and prompts MCP clients can access',\n      group: 'MCP',\n      useAsTitle: 'label',\n    },\n    auth: {\n      disableLocalStrategy: true,\n      useAPIKey: true,\n    },\n    fields: [\n      {\n        name: 'user',\n        type: 'relationship',\n        access: {\n          // Bind new keys to the creating user and prevent re-binding on update.\n          // A key acts as its associated user, so allowing arbitrary assignment lets\n          // any key manager impersonate anyone. Grant these via `overrideApiKeyCollection`\n          // to let trusted administrators issue keys on behalf of other users.\n          create: () => false,\n          update: () => false,\n        },\n        admin: {\n          description: 'The user that the API key is associated with.',\n        },\n        defaultValue: ({ req }: { req: PayloadRequest }) =>\n          req.user && req.user.collection === userCollection ? req.user.id : undefined,\n        relationTo: userCollection as CollectionSlug,\n        required: true,\n      },\n      {\n        name: 'label',\n        type: 'text',\n        admin: {\n          description: 'A useful label for the API key.',\n        },\n      },\n      {\n        name: 'description',\n        type: 'text',\n        admin: {\n          description: 'The purpose of the API key.',\n        },\n      },\n\n      ...createApiKeyFields({\n        config: collections,\n        configType: 'collection',\n      }),\n\n      ...createApiKeyFields({\n        config: globals,\n        configType: 'global',\n      }),\n\n      ...(customTools.length > 0\n        ? [\n            {\n              type: 'collapsible' as const,\n              admin: {\n                description: 'Manage client access to tools',\n                position: 'sidebar' as const,\n              },\n              fields: [\n                {\n                  name: 'payload-mcp-tool',\n                  type: 'group' as const,\n                  fields: customToolsFields,\n                  label: false as const,\n                },\n              ],\n              label: 'Tools',\n            },\n          ]\n        : []),\n\n      ...(pluginOptions.mcp?.resources && pluginOptions.mcp?.resources.length > 0\n        ? [\n            {\n              type: 'collapsible' as const,\n              admin: {\n                description: 'Manage client access to resources',\n                position: 'sidebar' as const,\n              },\n              fields: [\n                {\n                  name: 'payload-mcp-resource',\n                  type: 'group' as const,\n                  fields: customResourceFields,\n                  label: false as const,\n                },\n              ],\n              label: 'Resources',\n            },\n          ]\n        : []),\n\n      ...(pluginOptions.mcp?.prompts && pluginOptions.mcp?.prompts.length > 0\n        ? [\n            {\n              type: 'collapsible' as const,\n              admin: {\n                description: 'Manage client access to prompts',\n                position: 'sidebar' as const,\n              },\n              fields: [\n                {\n                  name: 'payload-mcp-prompt',\n                  type: 'group' as const,\n                  fields: customPromptFields,\n                  label: false as const,\n                },\n              ],\n              label: 'Prompts',\n            },\n          ]\n        : []),\n\n      // Experimental Tools\n      ...(process.env.NODE_ENV === 'development' &&\n      (experimentalTools?.collections?.enabled ||\n        experimentalTools?.jobs?.enabled ||\n        experimentalTools?.config?.enabled ||\n        experimentalTools?.auth?.enabled)\n        ? [\n            {\n              type: 'collapsible' as const,\n              admin: {\n                description: 'Manage client access to experimental tools',\n                position: 'sidebar' as const,\n              },\n              fields: [\n                ...(experimentalTools?.collections?.enabled\n                  ? [\n                      {\n                        name: 'collections',\n                        type: 'group' as const,\n                        fields: [\n                          {\n                            name: 'find',\n                            type: 'checkbox' as const,\n                            admin: {\n                              description:\n                                'Allow LLMs to find and list Payload collections with optional content and document counts.',\n                            },\n                            defaultValue: false,\n                          },\n                          {\n                            name: 'create',\n                            type: 'checkbox' as const,\n                            admin: {\n                              description:\n                                'Allow LLMs to create new Payload collections with specified fields and configuration.',\n                            },\n                            defaultValue: false,\n                          },\n                          {\n                            name: 'update',\n                            type: 'checkbox' as const,\n                            admin: {\n                              description:\n                                'Allow LLMs to update existing Payload collections with new fields, modifications, or configuration changes.',\n                            },\n                            defaultValue: false,\n                          },\n                          {\n                            name: 'delete',\n                            type: 'checkbox' as const,\n                            admin: {\n                              description:\n                                'Allow LLMs to delete Payload collections and optionally update the configuration.',\n                            },\n                            defaultValue: false,\n                          },\n                        ],\n                      },\n                    ]\n                  : []),\n                ...(experimentalTools?.jobs?.enabled\n                  ? [\n                      {\n                        name: 'jobs',\n                        type: 'group' as const,\n                        fields: [\n                          {\n                            name: 'create',\n                            type: 'checkbox' as const,\n                            admin: {\n                              description:\n                                'Allow LLMs to create new Payload jobs (tasks and workflows) with custom schemas and configuration.',\n                            },\n                            defaultValue: false,\n                          },\n                          {\n                            name: 'run',\n                            type: 'checkbox' as const,\n                            admin: {\n                              description:\n                                'Allow LLMs to execute Payload jobs with custom input data and queue options.',\n                            },\n                            defaultValue: false,\n                          },\n                          {\n                            name: 'update',\n                            type: 'checkbox' as const,\n                            admin: {\n                              description:\n                                'Allow LLMs to update existing Payload jobs with new schemas, configuration, or handler code.',\n                            },\n                            defaultValue: false,\n                          },\n                        ],\n                      },\n                    ]\n                  : []),\n                ...(experimentalTools?.config?.enabled\n                  ? [\n                      {\n                        name: 'config',\n                        type: 'group' as const,\n                        fields: [\n                          {\n                            name: 'find',\n                            type: 'checkbox' as const,\n                            admin: {\n                              description:\n                                'Allow LLMs to read and display a Payload configuration file.',\n                            },\n                            defaultValue: false,\n                          },\n                          {\n                            name: 'update',\n                            type: 'checkbox' as const,\n                            admin: {\n                              description:\n                                'Allow LLMs to update a Payload configuration file with various modifications.',\n                            },\n                            defaultValue: false,\n                          },\n                        ],\n                      },\n                    ]\n                  : []),\n                ...(experimentalTools?.auth?.enabled\n                  ? [\n                      {\n                        name: 'auth',\n                        type: 'group' as const,\n                        fields: [\n                          {\n                            name: 'auth',\n                            type: 'checkbox' as const,\n                            admin: {\n                              description:\n                                'Allow LLMs to check authentication status for a user by setting custom headers. (e.g. {\"Authorization\": \"Bearer <token>\"})',\n                            },\n                            defaultValue: false,\n                            label: 'Check Auth Status',\n                          },\n                          {\n                            name: 'login',\n                            type: 'checkbox' as const,\n                            admin: {\n                              description:\n                                'Allow LLMs to authenticate a user with email and password.',\n                            },\n                            defaultValue: false,\n                            label: 'User Login',\n                          },\n                          {\n                            name: 'verify',\n                            type: 'checkbox' as const,\n                            admin: {\n                              description:\n                                'Allow LLMs to verify a user email with a verification token.',\n                            },\n                            defaultValue: false,\n                            label: 'Email Verification',\n                          },\n                          {\n                            name: 'resetPassword',\n                            type: 'checkbox' as const,\n                            admin: {\n                              description:\n                                'Allow LLMs to reset a user password with a reset token.',\n                            },\n                            defaultValue: false,\n                            label: 'Reset Password',\n                          },\n                          {\n                            name: 'forgotPassword',\n                            type: 'checkbox' as const,\n                            admin: {\n                              description: 'Allow LLMs to send a password reset email to a user.',\n                            },\n                            defaultValue: false,\n                            label: 'Forgot Password',\n                          },\n                          {\n                            name: 'unlock',\n                            type: 'checkbox' as const,\n                            admin: {\n                              description:\n                                'Allow LLMs to unlock a user account that has been locked due to failed login attempts.',\n                            },\n                            defaultValue: false,\n                            label: 'Unlock Account',\n                          },\n                        ],\n                      },\n                    ]\n                  : []),\n              ],\n              label: 'Experimental Tools',\n            },\n          ]\n        : []),\n    ],\n    labels: {\n      plural: 'API Keys',\n      singular: 'API Key',\n    },\n  }\n}\n"],"names":["toCamelCase","createApiKeyFields","createAPIKeysCollection","collections","globals","customTools","experimentalTools","pluginOptions","customToolsFields","map","tool","camelCasedName","name","type","admin","description","defaultValue","label","customResourceFields","mcp","resources","resource","customPromptFields","prompts","prompt","userCollection","isAuthenticated","req","Boolean","user","collection","restrictToOwnKeys","equals","id","slug","access","create","delete","read","unlock","update","group","useAsTitle","auth","disableLocalStrategy","useAPIKey","fields","undefined","relationTo","required","config","configType","length","position","process","env","NODE_ENV","enabled","jobs","labels","plural","singular"],"mappings":"AAIA,SAASA,WAAW,QAAQ,wBAAuB;AACnD,SAASC,kBAAkB,QAAQ,iCAAgC;AAEnE,OAAO,MAAMC,0BAA0B,CACrCC,aACAC,SACAC,cAA4D,EAAE,EAC9DC,oBAA2E,CAAC,CAAC,EAC7EC;IAEA,MAAMC,oBAAoBH,YAAYI,GAAG,CAAC,CAACC;QACzC,MAAMC,iBAAiBX,YAAYU,KAAKE,IAAI;QAC5C,OAAO;YACLA,MAAMD;YACNE,MAAM;YACNC,OAAO;gBACLC,aAAaL,KAAKK,WAAW;YAC/B;YACAC,cAAc;YACdC,OAAON;QACT;IACF;IAEA,MAAMO,uBACJX,cAAcY,GAAG,EAAEC,WAAWX,IAAI,CAACY;QACjC,MAAMV,iBAAiBX,YAAYqB,SAAST,IAAI;QAChD,OAAO;YACLA,MAAMD;YACNE,MAAM;YACNC,OAAO;gBACLC,aAAaM,SAASN,WAAW;YACnC;YACAC,cAAc;YACdC,OAAON;QACT;IACF,MAAM,EAAE;IAEV,MAAMW,qBACJf,cAAcY,GAAG,EAAEI,SAASd,IAAI,CAACe;QAC/B,MAAMb,iBAAiBX,YAAYwB,OAAOZ,IAAI;QAC9C,OAAO;YACLA,MAAMD;YACNE,MAAM;YACNC,OAAO;gBACLC,aAAaS,OAAOT,WAAW;YACjC;YACAC,cAAc;YACdC,OAAON;QACT;IACF,MAAM,EAAE;IAEV,MAAMc,iBAAiBlB,cAAckB,cAAc;IAEnD,MAAMC,kBAAkB,CAAC,EAAEC,GAAG,EAA2B,GACvDC,QAAQD,IAAIE,IAAI,IAAIF,IAAIE,IAAI,CAACC,UAAU,KAAKL;IAE9C,MAAMM,oBAAoB,CAAC,EAAEJ,GAAG,EAA2B,GACzDA,IAAIE,IAAI,IAAIF,IAAIE,IAAI,CAACC,UAAU,KAAKL,iBAAiB;YAAEI,MAAM;gBAAEG,QAAQL,IAAIE,IAAI,CAACI,EAAE;YAAC;QAAE,IAAI;IAE3F,OAAO;QACLC,MAAM;QACNC,QAAQ;YACN,4EAA4E;YAC5E,8EAA8E;YAC9E,iEAAiE;YACjEC,QAAQV;YACRW,QAAQN;YACRO,MAAMP;YACNQ,QAAQR;YACRS,QAAQT;QACV;QACAjB,OAAO;YACLC,aACE;YACF0B,OAAO;YACPC,YAAY;QACd;QACAC,MAAM;YACJC,sBAAsB;YACtBC,WAAW;QACb;QACAC,QAAQ;YACN;gBACElC,MAAM;gBACNC,MAAM;gBACNsB,QAAQ;oBACN,uEAAuE;oBACvE,2EAA2E;oBAC3E,iFAAiF;oBACjF,qEAAqE;oBACrEC,QAAQ,IAAM;oBACdI,QAAQ,IAAM;gBAChB;gBACA1B,OAAO;oBACLC,aAAa;gBACf;gBACAC,cAAc,CAAC,EAAEW,GAAG,EAA2B,GAC7CA,IAAIE,IAAI,IAAIF,IAAIE,IAAI,CAACC,UAAU,KAAKL,iBAAiBE,IAAIE,IAAI,CAACI,EAAE,GAAGc;gBACrEC,YAAYvB;gBACZwB,UAAU;YACZ;YACA;gBACErC,MAAM;gBACNC,MAAM;gBACNC,OAAO;oBACLC,aAAa;gBACf;YACF;YACA;gBACEH,MAAM;gBACNC,MAAM;gBACNC,OAAO;oBACLC,aAAa;gBACf;YACF;eAEGd,mBAAmB;gBACpBiD,QAAQ/C;gBACRgD,YAAY;YACd;eAEGlD,mBAAmB;gBACpBiD,QAAQ9C;gBACR+C,YAAY;YACd;eAEI9C,YAAY+C,MAAM,GAAG,IACrB;gBACE;oBACEvC,MAAM;oBACNC,OAAO;wBACLC,aAAa;wBACbsC,UAAU;oBACZ;oBACAP,QAAQ;wBACN;4BACElC,MAAM;4BACNC,MAAM;4BACNiC,QAAQtC;4BACRS,OAAO;wBACT;qBACD;oBACDA,OAAO;gBACT;aACD,GACD,EAAE;eAEFV,cAAcY,GAAG,EAAEC,aAAab,cAAcY,GAAG,EAAEC,UAAUgC,SAAS,IACtE;gBACE;oBACEvC,MAAM;oBACNC,OAAO;wBACLC,aAAa;wBACbsC,UAAU;oBACZ;oBACAP,QAAQ;wBACN;4BACElC,MAAM;4BACNC,MAAM;4BACNiC,QAAQ5B;4BACRD,OAAO;wBACT;qBACD;oBACDA,OAAO;gBACT;aACD,GACD,EAAE;eAEFV,cAAcY,GAAG,EAAEI,WAAWhB,cAAcY,GAAG,EAAEI,QAAQ6B,SAAS,IAClE;gBACE;oBACEvC,MAAM;oBACNC,OAAO;wBACLC,aAAa;wBACbsC,UAAU;oBACZ;oBACAP,QAAQ;wBACN;4BACElC,MAAM;4BACNC,MAAM;4BACNiC,QAAQxB;4BACRL,OAAO;wBACT;qBACD;oBACDA,OAAO;gBACT;aACD,GACD,EAAE;YAEN,qBAAqB;eACjBqC,QAAQC,GAAG,CAACC,QAAQ,KAAK,iBAC5BlD,CAAAA,mBAAmBH,aAAasD,WAC/BnD,mBAAmBoD,MAAMD,WACzBnD,mBAAmB4C,QAAQO,WAC3BnD,mBAAmBqC,MAAMc,OAAM,IAC7B;gBACE;oBACE5C,MAAM;oBACNC,OAAO;wBACLC,aAAa;wBACbsC,UAAU;oBACZ;oBACAP,QAAQ;2BACFxC,mBAAmBH,aAAasD,UAChC;4BACE;gCACE7C,MAAM;gCACNC,MAAM;gCACNiC,QAAQ;oCACN;wCACElC,MAAM;wCACNC,MAAM;wCACNC,OAAO;4CACLC,aACE;wCACJ;wCACAC,cAAc;oCAChB;oCACA;wCACEJ,MAAM;wCACNC,MAAM;wCACNC,OAAO;4CACLC,aACE;wCACJ;wCACAC,cAAc;oCAChB;oCACA;wCACEJ,MAAM;wCACNC,MAAM;wCACNC,OAAO;4CACLC,aACE;wCACJ;wCACAC,cAAc;oCAChB;oCACA;wCACEJ,MAAM;wCACNC,MAAM;wCACNC,OAAO;4CACLC,aACE;wCACJ;wCACAC,cAAc;oCAChB;iCACD;4BACH;yBACD,GACD,EAAE;2BACFV,mBAAmBoD,MAAMD,UACzB;4BACE;gCACE7C,MAAM;gCACNC,MAAM;gCACNiC,QAAQ;oCACN;wCACElC,MAAM;wCACNC,MAAM;wCACNC,OAAO;4CACLC,aACE;wCACJ;wCACAC,cAAc;oCAChB;oCACA;wCACEJ,MAAM;wCACNC,MAAM;wCACNC,OAAO;4CACLC,aACE;wCACJ;wCACAC,cAAc;oCAChB;oCACA;wCACEJ,MAAM;wCACNC,MAAM;wCACNC,OAAO;4CACLC,aACE;wCACJ;wCACAC,cAAc;oCAChB;iCACD;4BACH;yBACD,GACD,EAAE;2BACFV,mBAAmB4C,QAAQO,UAC3B;4BACE;gCACE7C,MAAM;gCACNC,MAAM;gCACNiC,QAAQ;oCACN;wCACElC,MAAM;wCACNC,MAAM;wCACNC,OAAO;4CACLC,aACE;wCACJ;wCACAC,cAAc;oCAChB;oCACA;wCACEJ,MAAM;wCACNC,MAAM;wCACNC,OAAO;4CACLC,aACE;wCACJ;wCACAC,cAAc;oCAChB;iCACD;4BACH;yBACD,GACD,EAAE;2BACFV,mBAAmBqC,MAAMc,UACzB;4BACE;gCACE7C,MAAM;gCACNC,MAAM;gCACNiC,QAAQ;oCACN;wCACElC,MAAM;wCACNC,MAAM;wCACNC,OAAO;4CACLC,aACE;wCACJ;wCACAC,cAAc;wCACdC,OAAO;oCACT;oCACA;wCACEL,MAAM;wCACNC,MAAM;wCACNC,OAAO;4CACLC,aACE;wCACJ;wCACAC,cAAc;wCACdC,OAAO;oCACT;oCACA;wCACEL,MAAM;wCACNC,MAAM;wCACNC,OAAO;4CACLC,aACE;wCACJ;wCACAC,cAAc;wCACdC,OAAO;oCACT;oCACA;wCACEL,MAAM;wCACNC,MAAM;wCACNC,OAAO;4CACLC,aACE;wCACJ;wCACAC,cAAc;wCACdC,OAAO;oCACT;oCACA;wCACEL,MAAM;wCACNC,MAAM;wCACNC,OAAO;4CACLC,aAAa;wCACf;wCACAC,cAAc;wCACdC,OAAO;oCACT;oCACA;wCACEL,MAAM;wCACNC,MAAM;wCACNC,OAAO;4CACLC,aACE;wCACJ;wCACAC,cAAc;wCACdC,OAAO;oCACT;iCACD;4BACH;yBACD,GACD,EAAE;qBACP;oBACDA,OAAO;gBACT;aACD,GACD,EAAE;SACP;QACD0C,QAAQ;YACNC,QAAQ;YACRC,UAAU;QACZ;IACF;AACF,EAAC"}

package/dist/endpoints/mcp.d.ts

@@ -1,4 +1,4 @@
-import { type PayloadHandler } from 'payload';
+import type { PayloadHandler } from 'payload';
 import type { MCPPluginConfig } from '../types.js';
 export declare const initializeMCPHandler: (pluginOptions: MCPPluginConfig) => PayloadHandler;
 //# sourceMappingURL=mcp.d.ts.map

package/dist/endpoints/mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/endpoints/mcp.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,cAAc,EAAiD,MAAM,SAAS,CAAA;AAE5F,OAAO,KAAK,EAAqB,eAAe,EAAE,MAAM,aAAa,CAAA;AAKrE,eAAO,MAAM,oBAAoB,kBAAmB,eAAe,mBAkFlE,CAAA"}
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/endpoints/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAE7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAOlD,eAAO,MAAM,oBAAoB,kBAAmB,eAAe,mBAgBlE,CAAA"}

package/dist/endpoints/mcp.js

@@ -1,69 +1,22 @@
-import crypto from 'crypto';
-import { UnauthorizedError } from 'payload';
 import { createRequestFromPayloadRequest } from '../mcp/createRequest.js';
-import { getMCPHandler } from '../mcp/getMcpHandler.js';
+import { getMcpHandler } from '../mcp/getMcpHandler.js';
+import { resolveAccessSettings } from './resolveAccessSettings.js';
+import { withRestoredWebGlobals } from './withRestoredWebGlobals.js';
 export const initializeMCPHandler = (pluginOptions)=>{
     const mcpHandler = async (req)=>{
-        const { payload } = req;
-        const MCPOptions = pluginOptions.mcp || {};
-        const MCPHandlerOptions = MCPOptions.handlerOptions || {};
-        const useVerboseLogs = MCPHandlerOptions.verboseLogs ?? false;
+        const useVerboseLogs = pluginOptions.mcp?.handlerOptions?.verboseLogs ?? false;
         req.payloadAPI = 'MCP';
-        const getDefaultMcpAccessSettings = async (overrideApiKey)=>{
-            const apiKey = overrideApiKey ?? req.headers.get('Authorization')?.startsWith('Bearer ') ? req.headers.get('Authorization')?.replace('Bearer ', '').trim() : null;
-            if (apiKey === null) {
-                throw new UnauthorizedError();
-            }
-            const sha256APIKeyIndex = crypto.createHmac('sha256', payload.secret).update(apiKey || '').digest('hex');
-            const where = {
-                apiKeyIndex: {
-                    equals: sha256APIKeyIndex
-                }
-            };
-            const { docs } = await payload.find({
-                collection: 'payload-mcp-api-keys',
-                depth: 1,
-                limit: 1,
-                pagination: false,
-                where
-            });
-            if (docs.length === 0) {
-                throw new UnauthorizedError();
-            }
-            if (useVerboseLogs) {
-                payload.logger.info('[payload-mcp] API Key is valid');
-            }
-            const user = docs[0]?.user;
-            user.collection = pluginOptions.userCollection;
-            user._strategy = 'mcp-api-key';
-            return docs[0];
-        };
-        const mcpAccessSettings = pluginOptions.overrideAuth ? await pluginOptions.overrideAuth(req, getDefaultMcpAccessSettings) : await getDefaultMcpAccessSettings();
-        // @modelcontextprotocol/sdk's StreamableHTTPServerTransport uses @hono/node-server's
-        // getRequestListener, which replaces global.Request and global.Response with Hono
-        // custom classes. Unfortunately, we cannot pass overrideGlobalObjects: false because the option is
-        // consumed inside the SDK transport and is not exposed to callers.
-        // Save originals here and restore after the handler resolves so that Next.js
-        // instanceof Response checks on subsequent route handlers keep working.
-        const globals = globalThis;
-        const originalResponse = globals['Response'];
-        const originalRequest = globals['Request'];
-        const handler = getMCPHandler(pluginOptions, mcpAccessSettings, req);
-        const request = createRequestFromPayloadRequest(req);
-        try {
+        const mcpAccessSettings = await resolveAccessSettings({
+            pluginOptions,
+            req,
+            useVerboseLogs
+        });
+        req.user = mcpAccessSettings.user;
+        return await withRestoredWebGlobals(async ()=>{
+            const handler = getMcpHandler(pluginOptions, mcpAccessSettings, req);
+            const request = createRequestFromPayloadRequest(req);
             return await handler(request);
-        } finally{
-            if (globals['Response'] !== originalResponse) {
-                Object.defineProperty(globalThis, 'Response', {
-                    value: originalResponse
-                });
-            }
-            if (globals['Request'] !== originalRequest) {
-                Object.defineProperty(globalThis, 'Request', {
-                    value: originalRequest
-                });
-            }
-        }
+        });
     };
     return mcpHandler;
 };

package/dist/endpoints/mcp.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/endpoints/mcp.ts"],"sourcesContent":["import crypto from 'crypto'\nimport { type PayloadHandler, type TypedUser, UnauthorizedError, type Where } from 'payload'\n\nimport type { MCPAccessSettings, MCPPluginConfig } from '../types.js'\n\nimport { createRequestFromPayloadRequest } from '../mcp/createRequest.js'\nimport { getMCPHandler } from '../mcp/getMcpHandler.js'\n\nexport const initializeMCPHandler = (pluginOptions: MCPPluginConfig) => {\n  const mcpHandler: PayloadHandler = async (req) => {\n    const { payload } = req\n    const MCPOptions = pluginOptions.mcp || {}\n    const MCPHandlerOptions = MCPOptions.handlerOptions || {}\n    const useVerboseLogs = MCPHandlerOptions.verboseLogs ?? false\n\n    req.payloadAPI = 'MCP' as const\n\n    const getDefaultMcpAccessSettings = async (overrideApiKey?: null | string) => {\n      const apiKey =\n        (overrideApiKey ?? req.headers.get('Authorization')?.startsWith('Bearer '))\n          ? req.headers.get('Authorization')?.replace('Bearer ', '').trim()\n          : null\n\n      if (apiKey === null) {\n        throw new UnauthorizedError()\n      }\n\n      const sha256APIKeyIndex = crypto\n        .createHmac('sha256', payload.secret)\n        .update(apiKey || '')\n        .digest('hex')\n\n      const where: Where = {\n        apiKeyIndex: {\n          equals: sha256APIKeyIndex,\n        },\n      }\n\n      const { docs } = await payload.find({\n        collection: 'payload-mcp-api-keys',\n        depth: 1,\n        limit: 1,\n        pagination: false,\n        where,\n      })\n\n      if (docs.length === 0) {\n        throw new UnauthorizedError()\n      }\n\n      if (useVerboseLogs) {\n        payload.logger.info('[payload-mcp] API Key is valid')\n      }\n\n      const user = docs[0]?.user as TypedUser\n      user.collection = pluginOptions.userCollection as string\n      user._strategy = 'mcp-api-key' as const\n\n      return docs[0] as unknown as MCPAccessSettings\n    }\n\n    const mcpAccessSettings = pluginOptions.overrideAuth\n      ? await pluginOptions.overrideAuth(req, getDefaultMcpAccessSettings)\n      : await getDefaultMcpAccessSettings()\n\n    // @modelcontextprotocol/sdk's StreamableHTTPServerTransport uses @hono/node-server's\n    // getRequestListener, which replaces global.Request and global.Response with Hono\n    // custom classes. Unfortunately, we cannot pass overrideGlobalObjects: false because the option is\n    // consumed inside the SDK transport and is not exposed to callers.\n    // Save originals here and restore after the handler resolves so that Next.js\n    // instanceof Response checks on subsequent route handlers keep working.\n    const globals = globalThis as Record<string, unknown>\n    const originalResponse = globals['Response']\n    const originalRequest = globals['Request']\n\n    const handler = getMCPHandler(pluginOptions, mcpAccessSettings, req)\n    const request = createRequestFromPayloadRequest(req)\n\n    try {\n      return await handler(request)\n    } finally {\n      if (globals['Response'] !== originalResponse) {\n        Object.defineProperty(globalThis, 'Response', { value: originalResponse })\n      }\n      if (globals['Request'] !== originalRequest) {\n        Object.defineProperty(globalThis, 'Request', { value: originalRequest })\n      }\n    }\n  }\n  return mcpHandler\n}\n"],"names":["crypto","UnauthorizedError","createRequestFromPayloadRequest","getMCPHandler","initializeMCPHandler","pluginOptions","mcpHandler","req","payload","MCPOptions","mcp","MCPHandlerOptions","handlerOptions","useVerboseLogs","verboseLogs","payloadAPI","getDefaultMcpAccessSettings","overrideApiKey","apiKey","headers","get","startsWith","replace","trim","sha256APIKeyIndex","createHmac","secret","update","digest","where","apiKeyIndex","equals","docs","find","collection","depth","limit","pagination","length","logger","info","user","userCollection","_strategy","mcpAccessSettings","overrideAuth","globals","globalThis","originalResponse","originalRequest","handler","request","Object","defineProperty","value"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAC3B,SAA8CC,iBAAiB,QAAoB,UAAS;AAI5F,SAASC,+BAA+B,QAAQ,0BAAyB;AACzE,SAASC,aAAa,QAAQ,0BAAyB;AAEvD,OAAO,MAAMC,uBAAuB,CAACC;IACnC,MAAMC,aAA6B,OAAOC;QACxC,MAAM,EAAEC,OAAO,EAAE,GAAGD;QACpB,MAAME,aAAaJ,cAAcK,GAAG,IAAI,CAAC;QACzC,MAAMC,oBAAoBF,WAAWG,cAAc,IAAI,CAAC;QACxD,MAAMC,iBAAiBF,kBAAkBG,WAAW,IAAI;QAExDP,IAAIQ,UAAU,GAAG;QAEjB,MAAMC,8BAA8B,OAAOC;YACzC,MAAMC,SACJ,AAACD,kBAAkBV,IAAIY,OAAO,CAACC,GAAG,CAAC,kBAAkBC,WAAW,aAC5Dd,IAAIY,OAAO,CAACC,GAAG,CAAC,kBAAkBE,QAAQ,WAAW,IAAIC,SACzD;YAEN,IAAIL,WAAW,MAAM;gBACnB,MAAM,IAAIjB;YACZ;YAEA,MAAMuB,oBAAoBxB,OACvByB,UAAU,CAAC,UAAUjB,QAAQkB,MAAM,EACnCC,MAAM,CAACT,UAAU,IACjBU,MAAM,CAAC;YAEV,MAAMC,QAAe;gBACnBC,aAAa;oBACXC,QAAQP;gBACV;YACF;YAEA,MAAM,EAAEQ,IAAI,EAAE,GAAG,MAAMxB,QAAQyB,IAAI,CAAC;gBAClCC,YAAY;gBACZC,OAAO;gBACPC,OAAO;gBACPC,YAAY;gBACZR;YACF;YAEA,IAAIG,KAAKM,MAAM,KAAK,GAAG;gBACrB,MAAM,IAAIrC;YACZ;YAEA,IAAIY,gBAAgB;gBAClBL,QAAQ+B,MAAM,CAACC,IAAI,CAAC;YACtB;YAEA,MAAMC,OAAOT,IAAI,CAAC,EAAE,EAAES;YACtBA,KAAKP,UAAU,GAAG7B,cAAcqC,cAAc;YAC9CD,KAAKE,SAAS,GAAG;YAEjB,OAAOX,IAAI,CAAC,EAAE;QAChB;QAEA,MAAMY,oBAAoBvC,cAAcwC,YAAY,GAChD,MAAMxC,cAAcwC,YAAY,CAACtC,KAAKS,+BACtC,MAAMA;QAEV,qFAAqF;QACrF,kFAAkF;QAClF,mGAAmG;QACnG,mEAAmE;QACnE,6EAA6E;QAC7E,wEAAwE;QACxE,MAAM8B,UAAUC;QAChB,MAAMC,mBAAmBF,OAAO,CAAC,WAAW;QAC5C,MAAMG,kBAAkBH,OAAO,CAAC,UAAU;QAE1C,MAAMI,UAAU/C,cAAcE,eAAeuC,mBAAmBrC;QAChE,MAAM4C,UAAUjD,gCAAgCK;QAEhD,IAAI;YACF,OAAO,MAAM2C,QAAQC;QACvB,SAAU;YACR,IAAIL,OAAO,CAAC,WAAW,KAAKE,kBAAkB;gBAC5CI,OAAOC,cAAc,CAACN,YAAY,YAAY;oBAAEO,OAAON;gBAAiB;YAC1E;YACA,IAAIF,OAAO,CAAC,UAAU,KAAKG,iBAAiB;gBAC1CG,OAAOC,cAAc,CAACN,YAAY,WAAW;oBAAEO,OAAOL;gBAAgB;YACxE;QACF;IACF;IACA,OAAO3C;AACT,EAAC"}
+{"version":3,"sources":["../../src/endpoints/mcp.ts"],"sourcesContent":["import type { PayloadHandler } from 'payload'\n\nimport type { MCPPluginConfig } from '../types.js'\n\nimport { createRequestFromPayloadRequest } from '../mcp/createRequest.js'\nimport { getMcpHandler } from '../mcp/getMcpHandler.js'\nimport { resolveAccessSettings } from './resolveAccessSettings.js'\nimport { withRestoredWebGlobals } from './withRestoredWebGlobals.js'\n\nexport const initializeMCPHandler = (pluginOptions: MCPPluginConfig) => {\n  const mcpHandler: PayloadHandler = async (req) => {\n    const useVerboseLogs = pluginOptions.mcp?.handlerOptions?.verboseLogs ?? false\n\n    req.payloadAPI = 'MCP' as const\n\n    const mcpAccessSettings = await resolveAccessSettings({ pluginOptions, req, useVerboseLogs })\n    req.user = mcpAccessSettings.user\n\n    return await withRestoredWebGlobals(async () => {\n      const handler = getMcpHandler(pluginOptions, mcpAccessSettings, req)\n      const request = createRequestFromPayloadRequest(req)\n      return await handler(request)\n    })\n  }\n  return mcpHandler\n}\n"],"names":["createRequestFromPayloadRequest","getMcpHandler","resolveAccessSettings","withRestoredWebGlobals","initializeMCPHandler","pluginOptions","mcpHandler","req","useVerboseLogs","mcp","handlerOptions","verboseLogs","payloadAPI","mcpAccessSettings","user","handler","request"],"mappings":"AAIA,SAASA,+BAA+B,QAAQ,0BAAyB;AACzE,SAASC,aAAa,QAAQ,0BAAyB;AACvD,SAASC,qBAAqB,QAAQ,6BAA4B;AAClE,SAASC,sBAAsB,QAAQ,8BAA6B;AAEpE,OAAO,MAAMC,uBAAuB,CAACC;IACnC,MAAMC,aAA6B,OAAOC;QACxC,MAAMC,iBAAiBH,cAAcI,GAAG,EAAEC,gBAAgBC,eAAe;QAEzEJ,IAAIK,UAAU,GAAG;QAEjB,MAAMC,oBAAoB,MAAMX,sBAAsB;YAAEG;YAAeE;YAAKC;QAAe;QAC3FD,IAAIO,IAAI,GAAGD,kBAAkBC,IAAI;QAEjC,OAAO,MAAMX,uBAAuB;YAClC,MAAMY,UAAUd,cAAcI,eAAeQ,mBAAmBN;YAChE,MAAMS,UAAUhB,gCAAgCO;YAChD,OAAO,MAAMQ,QAAQC;QACvB;IACF;IACA,OAAOV;AACT,EAAC"}

package/dist/endpoints/resolveAccessSettings.d.ts

@@ -0,0 +1,10 @@
+import { type PayloadRequest } from 'payload';
+import type { MCPAccessSettings, MCPPluginConfig } from '../types.js';
+type ResolveAccessSettingsArgs = {
+    pluginOptions: MCPPluginConfig;
+    req: PayloadRequest;
+    useVerboseLogs: boolean;
+};
+export declare const resolveAccessSettings: (args: ResolveAccessSettingsArgs) => Promise<MCPAccessSettings>;
+export {};
+//# sourceMappingURL=resolveAccessSettings.d.ts.map

package/dist/endpoints/resolveAccessSettings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveAccessSettings.d.ts","sourceRoot":"","sources":["../../src/endpoints/resolveAccessSettings.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,cAAc,EAAiD,MAAM,SAAS,CAAA;AAE5F,OAAO,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAErE,KAAK,yBAAyB,GAAG;IAC/B,aAAa,EAAE,eAAe,CAAA;IAC9B,GAAG,EAAE,cAAc,CAAA;IACnB,cAAc,EAAE,OAAO,CAAA;CACxB,CAAA;AAwDD,eAAO,MAAM,qBAAqB,SAC1B,yBAAyB,KAC9B,OAAO,CAAC,iBAAiB,CAM3B,CAAA"}

package/dist/endpoints/resolveAccessSettings.js

@@ -0,0 +1,44 @@
+import crypto from 'crypto';
+import { UnauthorizedError } from 'payload';
+const createDefaultAccessSettingsResolver = ({ pluginOptions, req, useVerboseLogs })=>{
+    return async (overrideApiKey)=>{
+        const authorization = req.headers.get('Authorization');
+        const apiKey = overrideApiKey ?? (authorization?.startsWith('Bearer ') ? authorization.replace('Bearer ', '').trim() : null);
+        if (apiKey === null) {
+            throw new UnauthorizedError();
+        }
+        const sha256APIKeyIndex = crypto.createHmac('sha256', req.payload.secret).update(apiKey || '').digest('hex');
+        const where = {
+            apiKeyIndex: {
+                equals: sha256APIKeyIndex
+            }
+        };
+        const { docs } = await req.payload.find({
+            collection: 'payload-mcp-api-keys',
+            depth: 1,
+            limit: 1,
+            pagination: false,
+            where
+        });
+        const apiKeyDoc = docs[0];
+        if (!apiKeyDoc) {
+            throw new UnauthorizedError();
+        }
+        if (useVerboseLogs) {
+            req.payload.logger.info('[payload-mcp] API Key is valid');
+        }
+        const user = apiKeyDoc.user;
+        if (!user || typeof user !== 'object' || !('id' in user)) {
+            throw new UnauthorizedError();
+        }
+        user.collection = pluginOptions.userCollection;
+        user._strategy = 'mcp-api-key';
+        return apiKeyDoc;
+    };
+};
+export const resolveAccessSettings = async (args)=>{
+    const getDefaultMcpAccessSettings = createDefaultAccessSettingsResolver(args);
+    return args.pluginOptions.overrideAuth ? await args.pluginOptions.overrideAuth(args.req, getDefaultMcpAccessSettings) : await getDefaultMcpAccessSettings();
+};
+
+//# sourceMappingURL=resolveAccessSettings.js.map

package/dist/endpoints/resolveAccessSettings.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/endpoints/resolveAccessSettings.ts"],"sourcesContent":["import crypto from 'crypto'\nimport { type PayloadRequest, type TypedUser, UnauthorizedError, type Where } from 'payload'\n\nimport type { MCPAccessSettings, MCPPluginConfig } from '../types.js'\n\ntype ResolveAccessSettingsArgs = {\n  pluginOptions: MCPPluginConfig\n  req: PayloadRequest\n  useVerboseLogs: boolean\n}\n\nconst createDefaultAccessSettingsResolver = ({\n  pluginOptions,\n  req,\n  useVerboseLogs,\n}: ResolveAccessSettingsArgs) => {\n  return async (overrideApiKey?: null | string): Promise<MCPAccessSettings> => {\n    const authorization = req.headers.get('Authorization')\n    const apiKey =\n      overrideApiKey ??\n      (authorization?.startsWith('Bearer ') ? authorization.replace('Bearer ', '').trim() : null)\n\n    if (apiKey === null) {\n      throw new UnauthorizedError()\n    }\n\n    const sha256APIKeyIndex = crypto\n      .createHmac('sha256', req.payload.secret)\n      .update(apiKey || '')\n      .digest('hex')\n    const where: Where = {\n      apiKeyIndex: {\n        equals: sha256APIKeyIndex,\n      },\n    }\n    const { docs } = await req.payload.find({\n      collection: 'payload-mcp-api-keys',\n      depth: 1,\n      limit: 1,\n      pagination: false,\n      where,\n    })\n    const apiKeyDoc = docs[0]\n\n    if (!apiKeyDoc) {\n      throw new UnauthorizedError()\n    }\n\n    if (useVerboseLogs) {\n      req.payload.logger.info('[payload-mcp] API Key is valid')\n    }\n\n    const user = apiKeyDoc.user as TypedUser\n\n    if (!user || typeof user !== 'object' || !('id' in user)) {\n      throw new UnauthorizedError()\n    }\n\n    user.collection = pluginOptions.userCollection as string\n    user._strategy = 'mcp-api-key' as const\n\n    return apiKeyDoc as unknown as MCPAccessSettings\n  }\n}\n\nexport const resolveAccessSettings = async (\n  args: ResolveAccessSettingsArgs,\n): Promise<MCPAccessSettings> => {\n  const getDefaultMcpAccessSettings = createDefaultAccessSettingsResolver(args)\n\n  return args.pluginOptions.overrideAuth\n    ? await args.pluginOptions.overrideAuth(args.req, getDefaultMcpAccessSettings)\n    : await getDefaultMcpAccessSettings()\n}\n"],"names":["crypto","UnauthorizedError","createDefaultAccessSettingsResolver","pluginOptions","req","useVerboseLogs","overrideApiKey","authorization","headers","get","apiKey","startsWith","replace","trim","sha256APIKeyIndex","createHmac","payload","secret","update","digest","where","apiKeyIndex","equals","docs","find","collection","depth","limit","pagination","apiKeyDoc","logger","info","user","userCollection","_strategy","resolveAccessSettings","args","getDefaultMcpAccessSettings","overrideAuth"],"mappings":"AAAA,OAAOA,YAAY,SAAQ;AAC3B,SAA8CC,iBAAiB,QAAoB,UAAS;AAU5F,MAAMC,sCAAsC,CAAC,EAC3CC,aAAa,EACbC,GAAG,EACHC,cAAc,EACY;IAC1B,OAAO,OAAOC;QACZ,MAAMC,gBAAgBH,IAAII,OAAO,CAACC,GAAG,CAAC;QACtC,MAAMC,SACJJ,kBACCC,CAAAA,eAAeI,WAAW,aAAaJ,cAAcK,OAAO,CAAC,WAAW,IAAIC,IAAI,KAAK,IAAG;QAE3F,IAAIH,WAAW,MAAM;YACnB,MAAM,IAAIT;QACZ;QAEA,MAAMa,oBAAoBd,OACvBe,UAAU,CAAC,UAAUX,IAAIY,OAAO,CAACC,MAAM,EACvCC,MAAM,CAACR,UAAU,IACjBS,MAAM,CAAC;QACV,MAAMC,QAAe;YACnBC,aAAa;gBACXC,QAAQR;YACV;QACF;QACA,MAAM,EAAES,IAAI,EAAE,GAAG,MAAMnB,IAAIY,OAAO,CAACQ,IAAI,CAAC;YACtCC,YAAY;YACZC,OAAO;YACPC,OAAO;YACPC,YAAY;YACZR;QACF;QACA,MAAMS,YAAYN,IAAI,CAAC,EAAE;QAEzB,IAAI,CAACM,WAAW;YACd,MAAM,IAAI5B;QACZ;QAEA,IAAII,gBAAgB;YAClBD,IAAIY,OAAO,CAACc,MAAM,CAACC,IAAI,CAAC;QAC1B;QAEA,MAAMC,OAAOH,UAAUG,IAAI;QAE3B,IAAI,CAACA,QAAQ,OAAOA,SAAS,YAAY,CAAE,CAAA,QAAQA,IAAG,GAAI;YACxD,MAAM,IAAI/B;QACZ;QAEA+B,KAAKP,UAAU,GAAGtB,cAAc8B,cAAc;QAC9CD,KAAKE,SAAS,GAAG;QAEjB,OAAOL;IACT;AACF;AAEA,OAAO,MAAMM,wBAAwB,OACnCC;IAEA,MAAMC,8BAA8BnC,oCAAoCkC;IAExE,OAAOA,KAAKjC,aAAa,CAACmC,YAAY,GAClC,MAAMF,KAAKjC,aAAa,CAACmC,YAAY,CAACF,KAAKhC,GAAG,EAAEiC,+BAChD,MAAMA;AACZ,EAAC"}

package/dist/endpoints/withRestoredWebGlobals.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Restores globals replaced by @hono/node-server while handling an MCP request.
+ */
+export declare const withRestoredWebGlobals: <T>(handler: () => Promise<T>) => Promise<T>;
+//# sourceMappingURL=withRestoredWebGlobals.d.ts.map

package/dist/endpoints/withRestoredWebGlobals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"withRestoredWebGlobals.d.ts","sourceRoot":"","sources":["../../src/endpoints/withRestoredWebGlobals.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,eAAO,MAAM,sBAAsB,GAAU,CAAC,WAAW,MAAM,OAAO,CAAC,CAAC,CAAC,KAAG,OAAO,CAAC,CAAC,CAepF,CAAA"}

package/dist/endpoints/withRestoredWebGlobals.js

@@ -0,0 +1,23 @@
+/**
+ * Restores globals replaced by @hono/node-server while handling an MCP request.
+ */ export const withRestoredWebGlobals = async (handler)=>{
+    const globals = globalThis;
+    const originalRequest = globals['Request'];
+    const originalResponse = globals['Response'];
+    try {
+        return await handler();
+    } finally{
+        if (globals['Response'] !== originalResponse) {
+            Object.defineProperty(globalThis, 'Response', {
+                value: originalResponse
+            });
+        }
+        if (globals['Request'] !== originalRequest) {
+            Object.defineProperty(globalThis, 'Request', {
+                value: originalRequest
+            });
+        }
+    }
+};
+
+//# sourceMappingURL=withRestoredWebGlobals.js.map

package/dist/endpoints/withRestoredWebGlobals.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/endpoints/withRestoredWebGlobals.ts"],"sourcesContent":["/**\n * Restores globals replaced by @hono/node-server while handling an MCP request.\n */\nexport const withRestoredWebGlobals = async <T>(handler: () => Promise<T>): Promise<T> => {\n  const globals = globalThis as Record<string, unknown>\n  const originalRequest = globals['Request']\n  const originalResponse = globals['Response']\n\n  try {\n    return await handler()\n  } finally {\n    if (globals['Response'] !== originalResponse) {\n      Object.defineProperty(globalThis, 'Response', { value: originalResponse })\n    }\n    if (globals['Request'] !== originalRequest) {\n      Object.defineProperty(globalThis, 'Request', { value: originalRequest })\n    }\n  }\n}\n"],"names":["withRestoredWebGlobals","handler","globals","globalThis","originalRequest","originalResponse","Object","defineProperty","value"],"mappings":"AAAA;;CAEC,GACD,OAAO,MAAMA,yBAAyB,OAAUC;IAC9C,MAAMC,UAAUC;IAChB,MAAMC,kBAAkBF,OAAO,CAAC,UAAU;IAC1C,MAAMG,mBAAmBH,OAAO,CAAC,WAAW;IAE5C,IAAI;QACF,OAAO,MAAMD;IACf,SAAU;QACR,IAAIC,OAAO,CAAC,WAAW,KAAKG,kBAAkB;YAC5CC,OAAOC,cAAc,CAACJ,YAAY,YAAY;gBAAEK,OAAOH;YAAiB;QAC1E;QACA,IAAIH,OAAO,CAAC,UAAU,KAAKE,iBAAiB;YAC1CE,OAAOC,cAAc,CAACJ,YAAY,WAAW;gBAAEK,OAAOJ;YAAgB;QACxE;IACF;AACF,EAAC"}

package/dist/mcp/getMcpHandler.d.ts

@@ -1,4 +1,4 @@
 import { type PayloadRequest } from 'payload';
 import type { MCPAccessSettings, MCPPluginConfig } from '../types.js';
-export declare const getMCPHandler: (pluginOptions: MCPPluginConfig, mcpAccessSettings: MCPAccessSettings, req: PayloadRequest) => (request: Request) => Promise<Response>;
+export declare const getMcpHandler: (pluginOptions: MCPPluginConfig, mcpAccessSettings: MCPAccessSettings, req: PayloadRequest) => (request: Request) => Promise<Response>;
 //# sourceMappingURL=getMcpHandler.d.ts.map

package/dist/mcp/getMcpHandler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getMcpHandler.d.ts","sourceRoot":"","sources":["../../src/mcp/getMcpHandler.ts"],"names":[],"mappings":"AAIA,OAAO,EAAgC,KAAK,cAAc,EAAkB,MAAM,SAAS,CAAA;AAE3F,OAAO,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAuCrE,eAAO,MAAM,aAAa,kBACT,eAAe,qBACX,iBAAiB,OAC/B,cAAc,4CAgfpB,CAAA"}
+{"version":3,"file":"getMcpHandler.d.ts","sourceRoot":"","sources":["../../src/mcp/getMcpHandler.ts"],"names":[],"mappings":"AAIA,OAAO,EAAgC,KAAK,cAAc,EAAE,MAAM,SAAS,CAAA;AAE3E,OAAO,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAuCrE,eAAO,MAAM,aAAa,kBACT,eAAe,qBACX,iBAAiB,OAC/B,cAAc,4CAifpB,CAAA"}

package/dist/mcp/getMcpHandler.js

@@ -31,7 +31,7 @@ import { updateConfigTool } from './tools/config/update.js';
 import { createJobTool } from './tools/job/create.js';
 import { runJobTool } from './tools/job/run.js';
 import { updateJobTool } from './tools/job/update.js';
-export const getMCPHandler = (pluginOptions, mcpAccessSettings, req)=>{
+export const getMcpHandler = (pluginOptions, mcpAccessSettings, req)=>{
     const { payload } = req;
     const configSchema = configToJSONSchema(payload.config, payload.db.defaultIDType, req.i18n, {
         forceInlineBlocks: true
@@ -50,21 +50,21 @@ export const getMCPHandler = (pluginOptions, mcpAccessSettings, req)=>{
     // User
     const user = mcpAccessSettings.user;
     // MCP Server and Handler Options
-    const MCPOptions = pluginOptions.mcp || {};
-    const customMCPTools = MCPOptions.tools || [];
-    const customMCPPrompts = MCPOptions.prompts || [];
-    const customMCPResources = MCPOptions.resources || [];
-    const MCPHandlerOptions = MCPOptions.handlerOptions || {};
-    const serverOptions = MCPOptions.serverOptions || {};
-    const useVerboseLogs = MCPHandlerOptions.verboseLogs ?? false;
+    const mcpOptions = pluginOptions.mcp || {};
+    const customTools = mcpOptions.tools || [];
+    const customPrompts = mcpOptions.prompts || [];
+    const customResources = mcpOptions.resources || [];
+    const mcpHandlerOptions = mcpOptions.handlerOptions || {};
+    const serverOptions = mcpOptions.serverOptions || {};
+    const useVerboseLogs = mcpHandlerOptions.verboseLogs ?? false;
     // Experimental MCP Tool Requirements
     const isDevelopment = process.env.NODE_ENV === 'development';
-    const experimentalTools = pluginOptions?.experimental?.tools || {};
+    const experimentalTools = pluginOptions.experimental?.tools || {};
     const collectionsPluginConfig = pluginOptions.collections || {};
     const globalsPluginConfig = pluginOptions.globals || {};
-    const collectionsDirPath = experimentalTools && experimentalTools.collections?.collectionsDirPath ? experimentalTools.collections.collectionsDirPath : join(process.cwd(), 'src/collections');
-    const configFilePath = experimentalTools && experimentalTools.config?.configFilePath ? experimentalTools.config.configFilePath : join(process.cwd(), 'src/payload.config.ts');
-    const jobsDirPath = experimentalTools && experimentalTools.jobs?.jobsDirPath ? experimentalTools.jobs.jobsDirPath : join(process.cwd(), 'src/jobs');
+    const collectionsDirPath = experimentalTools.collections?.collectionsDirPath || join(process.cwd(), 'src/collections');
+    const configFilePath = experimentalTools.config?.configFilePath || join(process.cwd(), 'src/payload.config.ts');
+    const jobsDirPath = experimentalTools.jobs?.jobsDirPath || join(process.cwd(), 'src/jobs');
     try {
         return createMcpHandler((server)=>{
             // Get enabled collections
@@ -117,7 +117,7 @@ export const getMCPHandler = (pluginOptions, mcpAccessSettings, req)=>{
                 }
             });
             // Custom tools
-            customMCPTools.forEach((tool)=>{
+            customTools.forEach((tool)=>{
                 const camelCasedToolName = toCamelCase(tool.name);
                 const isToolEnabled = mcpAccessSettings['payload-mcp-tool']?.[camelCasedToolName] ?? false;
                 registerTool(isToolEnabled, tool.name, ()=>server.registerTool(tool.name, {
@@ -126,7 +126,7 @@ export const getMCPHandler = (pluginOptions, mcpAccessSettings, req)=>{
                     }, payloadToolHandler(tool.handler)), payload, useVerboseLogs);
             });
             // Custom prompts
-            customMCPPrompts.forEach((prompt)=>{
+            customPrompts.forEach((prompt)=>{
                 const camelCasedPromptName = toCamelCase(prompt.name);
                 const isPromptEnabled = mcpAccessSettings['payload-mcp-prompt']?.[camelCasedPromptName] ?? false;
                 if (isPromptEnabled) {
@@ -143,7 +143,7 @@ export const getMCPHandler = (pluginOptions, mcpAccessSettings, req)=>{
                 }
             });
             // Custom resources
-            customMCPResources.forEach((resource)=>{
+            customResources.forEach((resource)=>{
                 const camelCasedResourceName = toCamelCase(resource.name);
                 const isResourceEnabled = mcpAccessSettings['payload-mcp-resource']?.[camelCasedResourceName] ?? false;
                 if (isResourceEnabled) {
@@ -200,13 +200,13 @@ export const getMCPHandler = (pluginOptions, mcpAccessSettings, req)=>{
             if (mcpAccessSettings.auth?.verify && experimentalTools.auth?.enabled && isDevelopment) {
                 registerTool(mcpAccessSettings.auth.verify, 'Verify', ()=>verifyTool(server, req, useVerboseLogs), payload, useVerboseLogs);
             }
-            if (mcpAccessSettings.auth?.resetPassword && experimentalTools.auth?.enabled) {
+            if (mcpAccessSettings.auth?.resetPassword && experimentalTools.auth?.enabled && isDevelopment) {
                 registerTool(mcpAccessSettings.auth.resetPassword, 'Reset Password', ()=>resetPasswordTool(server, req, useVerboseLogs), payload, useVerboseLogs);
             }
-            if (mcpAccessSettings.auth?.forgotPassword && experimentalTools.auth?.enabled) {
+            if (mcpAccessSettings.auth?.forgotPassword && experimentalTools.auth?.enabled && isDevelopment) {
                 registerTool(mcpAccessSettings.auth.forgotPassword, 'Forgot Password', ()=>forgotPasswordTool(server, req, useVerboseLogs), payload, useVerboseLogs);
             }
-            if (mcpAccessSettings.auth?.unlock && experimentalTools.auth?.enabled) {
+            if (mcpAccessSettings.auth?.unlock && experimentalTools.auth?.enabled && isDevelopment) {
                 registerTool(mcpAccessSettings.auth.unlock, 'Unlock', ()=>unlockTool(server, req, useVerboseLogs), payload, useVerboseLogs);
             }
             if (useVerboseLogs) {
@@ -216,11 +216,11 @@ export const getMCPHandler = (pluginOptions, mcpAccessSettings, req)=>{
             instructions: serverOptions.instructions,
             serverInfo: serverOptions.serverInfo
         }, {
-            basePath: MCPHandlerOptions.basePath || payload.config.routes?.api || '/api',
-            disableSse: MCPHandlerOptions.disableSse ?? true,
-            maxDuration: MCPHandlerOptions.maxDuration || 60,
-            onEvent: MCPHandlerOptions.onEvent,
-            redisUrl: MCPHandlerOptions.redisUrl,
+            basePath: mcpHandlerOptions.basePath || payload.config.routes?.api || '/api',
+            disableSse: mcpHandlerOptions.disableSse ?? true,
+            maxDuration: mcpHandlerOptions.maxDuration || 60,
+            onEvent: mcpHandlerOptions.onEvent,
+            redisUrl: mcpHandlerOptions.redisUrl,
             verboseLogs: useVerboseLogs
         });
     } catch (error) {