@payloadcms/plugin-mcp 4.0.0-internal.1f9ae9a → 4.0.0-internal.2fddfc0

package/dist/mcp/sanitizeMCPConfig.js

@@ -1,10 +1,10 @@
-import { COLLECTION_AUTH_BUILTIN_ENTRIES, COLLECTION_AUTH_BUILTINS, COLLECTION_BUILTIN_ENTRIES, COLLECTION_BUILTINS, GLOBAL_BUILTIN_ENTRIES, GLOBAL_BUILTINS } from './builtinTools.js';
+import { defaultAccess } from '../defaultAccess.js';
+import { COLLECTION_AUTH_BUILTIN_ENTRIES, COLLECTION_AUTH_BUILTINS, COLLECTION_BUILTIN_ENTRIES, COLLECTION_BUILTINS, GLOBAL_BUILTIN_ENTRIES, GLOBAL_BUILTINS, TOOL_BUILTIN_ENTRIES, TOOL_BUILTINS } from './builtinTools.js';
 /**
  * Converts the user-configured `MCPPluginConfig` into a `SanitizedMCPPluginConfig`:
  *  - Flattens `tools` / `prompts` / `resources` / per-collection / per-global
  *    tool maps into a single `items` array.
  *  - Applies built-in tools for collections and globals, respecting opt-out user overrides.
- *  - Applies the `userCollection` default
  *
  * Called once during plugin init. After that, `plugins['@payloadcms/plugin-mcp']
  * ?.options` holds the sanitized result
@@ -22,83 +22,136 @@ import { COLLECTION_AUTH_BUILTIN_ENTRIES, COLLECTION_AUTH_BUILTINS, COLLECTION_B
             pluginConfig
         }));
     }
-    for (const [key, tool] of Object.entries(pluginConfig.tools ?? {})){
+    for (const [configKey, { mcpName, tool }] of TOOL_BUILTIN_ENTRIES){
         items.push({
             type: 'tool',
-            key,
-            label: key,
-            tool
+            configKey,
+            label: tool.annotations?.title ?? configKey,
+            mcpName,
+            tool: {
+                ...tool,
+                access: tool.access ?? defaultAccess
+            }
         });
     }
-    for (const [key, prompt] of Object.entries(pluginConfig.prompts ?? {})){
+    for (const [configKey, tool] of Object.entries(pluginConfig.tools ?? {})){
+        if (configKey in TOOL_BUILTINS) {
+            continue;
+        }
+        items.push({
+            type: 'tool',
+            configKey,
+            label: tool.annotations?.title ?? configKey,
+            mcpName: configKey,
+            tool: {
+                ...tool,
+                access: tool.access ?? defaultAccess
+            }
+        });
+    }
+    for (const [configKey, prompt] of Object.entries(pluginConfig.prompts ?? {})){
         items.push({
             type: 'prompt',
-            key,
-            label: prompt.title ?? key,
-            prompt
+            configKey,
+            label: prompt.title ?? configKey,
+            mcpName: configKey,
+            prompt: {
+                ...prompt,
+                access: prompt.access ?? defaultAccess
+            }
         });
     }
-    for (const [key, resource] of Object.entries(pluginConfig.resources ?? {})){
+    for (const [configKey, resource] of Object.entries(pluginConfig.resources ?? {})){
         items.push({
             type: 'resource',
-            key,
-            label: resource.title ?? key,
-            resource
+            configKey,
+            label: resource.title ?? configKey,
+            mcpName: configKey,
+            resource: {
+                ...resource,
+                access: resource.access ?? defaultAccess
+            }
         });
     }
-    // Mirror Payload's own admin.user detection (sanitize.ts) since plugins run first.
-    const firstCollectionWithAuth = config.collections.find(({ auth })=>Boolean(auth));
     return {
         disabled: pluginConfig.disabled,
         items,
         mcp: pluginConfig.mcp,
-        overrideApiKeyCollection: pluginConfig.overrideApiKeyCollection,
-        overrideAuth: pluginConfig.overrideAuth,
-        userCollection: pluginConfig.userCollection ?? config.admin?.user ?? firstCollectionWithAuth?.slug ?? 'users'
+        overrideGetAuthorizedMCP: pluginConfig.overrideGetAuthorizedMCP
     };
 };
 const sanitizeCollectionConfig = ({ collection, pluginConfig })=>{
-    if (collection.slug === 'payload-mcp-api-keys') {
-        return [];
-    }
     const slug = collection.slug;
     const collectionPluginConfig = pluginConfig.collections?.[slug];
     const items = [];
-    for (const [toolKey, tool] of COLLECTION_BUILTIN_ENTRIES){
+    /**
+   * Payload disables duplicate for auth collections by default unless the
+   * collection explicitly opts back in with `disableDuplicate: false`.
+   */ const isDuplicateDisabled = collection.disableDuplicate === true || Boolean(collection.auth) && collection.disableDuplicate !== false;
+    for (const [toolKey, { mcpName, requiresDuplicateEnabled, requiresVersions, tool }] of COLLECTION_BUILTIN_ENTRIES){
+        if (requiresVersions && !collection.versions) {
+            continue;
+        }
+        if (requiresDuplicateEnabled && isDuplicateDisabled) {
+            continue;
+        }
         const matchedConfigEntry = collectionPluginConfig?.tools?.[toolKey];
         if (matchedConfigEntry === false) {
             continue;
         }
+        const override = typeof matchedConfigEntry === 'object' ? matchedConfigEntry : undefined;
+        const annotations = {
+            ...tool.annotations,
+            ...override?.annotations
+        };
         items.push({
             type: 'collectionTool',
             collectionSlug: slug,
-            key: toolKey,
-            label: capitalize(toolKey),
-            tool: overrideBuiltinTool(tool, matchedConfigEntry, collectionPluginConfig)
+            configKey: toolKey,
+            label: annotations.title ?? toolKey,
+            mcpName,
+            tool: {
+                ...tool,
+                access: override?.access ?? tool.access ?? defaultAccess,
+                annotations,
+                description: override?.description ?? tool.description,
+                overrideResponse: override?.overrideResponse ?? collectionPluginConfig?.overrideResponse ?? tool.overrideResponse
+            }
         });
     }
     if (collection.auth) {
-        for (const [authToolKey, { label, tool }] of COLLECTION_AUTH_BUILTIN_ENTRIES){
+        for (const [authToolKey, { mcpName, tool }] of COLLECTION_AUTH_BUILTIN_ENTRIES){
             const matchedConfigEntry = collectionPluginConfig?.tools?.[authToolKey];
             if (!matchedConfigEntry) {
                 continue;
             }
             // `true` means "enable, no override"; only the object form carries fields.
             const override = typeof matchedConfigEntry === 'object' ? matchedConfigEntry : undefined;
+            const annotations = {
+                ...tool.annotations,
+                ...override?.annotations
+            };
             items.push({
                 type: 'collectionTool',
                 collectionSlug: slug,
-                key: authToolKey,
-                label,
-                tool: overrideBuiltinTool(tool, override, collectionPluginConfig)
+                configKey: authToolKey,
+                label: annotations.title ?? authToolKey,
+                mcpName,
+                tool: {
+                    ...tool,
+                    access: override?.access ?? tool.access ?? defaultAccess,
+                    annotations,
+                    description: override?.description ?? tool.description,
+                    overrideResponse: override?.overrideResponse ?? collectionPluginConfig?.overrideResponse ?? tool.overrideResponse
+                }
             });
         }
     }
     // Cast: builtin keys are filtered out below, so the remaining values are
     // always custom tools (`CollectionTool`) or undefined
     const customEntries = Object.entries(collectionPluginConfig?.tools ?? {});
-    for (const [key, customTool] of customEntries){
-        if (key in COLLECTION_BUILTINS || key in COLLECTION_AUTH_BUILTINS) {
+    for (const [configKey, customTool] of customEntries){
+        if (configKey in COLLECTION_BUILTINS || configKey in COLLECTION_AUTH_BUILTINS) {
             continue;
         }
         if (!customTool) {
@@ -107,9 +160,13 @@ const sanitizeCollectionConfig = ({ collection, pluginConfig })=>{
         items.push({
             type: 'collectionTool',
             collectionSlug: slug,
-            key,
-            label: key,
-            tool: customTool
+            configKey,
+            label: customTool.annotations?.title ?? configKey,
+            mcpName: configKey,
+            tool: {
+                ...customTool,
+                access: customTool.access ?? defaultAccess
+            }
         });
     }
     return items;
@@ -118,22 +175,37 @@ const sanitizeGlobalConfig = ({ global, pluginConfig })=>{
     const slug = global.slug;
     const globalPluginConfig = pluginConfig.globals?.[slug];
     const items = [];
-    for (const [toolKey, baseTool] of GLOBAL_BUILTIN_ENTRIES){
+    for (const [toolKey, { mcpName, requiresVersions, tool }] of GLOBAL_BUILTIN_ENTRIES){
+        if (requiresVersions && !global.versions) {
+            continue;
+        }
         const matchedConfigEntry = globalPluginConfig?.tools?.[toolKey];
         if (matchedConfigEntry === false) {
             continue;
         }
+        const override = typeof matchedConfigEntry === 'object' ? matchedConfigEntry : undefined;
+        const annotations = {
+            ...tool.annotations,
+            ...override?.annotations
+        };
         items.push({
             type: 'globalTool',
+            configKey: toolKey,
             globalSlug: slug,
-            key: toolKey,
-            label: capitalize(toolKey),
-            tool: overrideBuiltinTool(baseTool, matchedConfigEntry, globalPluginConfig)
+            label: annotations.title ?? toolKey,
+            mcpName,
+            tool: {
+                ...tool,
+                access: override?.access ?? tool.access ?? defaultAccess,
+                annotations,
+                description: override?.description ?? tool.description,
+                overrideResponse: override?.overrideResponse ?? globalPluginConfig?.overrideResponse ?? tool.overrideResponse
+            }
         });
     }
     const customEntries = Object.entries(globalPluginConfig?.tools ?? {});
-    for (const [key, customTool] of customEntries){
-        if (key in GLOBAL_BUILTINS) {
+    for (const [configKey, customTool] of customEntries){
+        if (configKey in GLOBAL_BUILTINS) {
             continue;
         }
         if (!customTool) {
@@ -141,27 +213,17 @@ const sanitizeGlobalConfig = ({ global, pluginConfig })=>{
         }
         items.push({
             type: 'globalTool',
+            configKey,
             globalSlug: slug,
-            key,
-            label: key,
-            tool: customTool
+            label: customTool.annotations?.title ?? configKey,
+            mcpName: configKey,
+            tool: {
+                ...customTool,
+                access: customTool.access ?? defaultAccess
+            }
         });
     }
     return items;
 };
-const capitalize = (s)=>s.charAt(0).toUpperCase() + s.slice(1);
-/**
- * Spread the static built-in tool and apply consumer-side overrides.
- * Precedence: per-tool override > scope-level (collection/global) override >
- * the static tool's defaults. `toolEntry` is whatever the user put under
- * `tools: { find: ... }` — could be `true`, `false`, or an override object —
- * so it's narrowed internally.
- */ const overrideBuiltinTool = (tool, toolOverride, entityPluginConfig)=>{
-    return {
-        ...tool,
-        description: toolOverride?.description ?? entityPluginConfig?.description ?? tool.description,
-        overrideResponse: toolOverride?.overrideResponse ?? entityPluginConfig?.overrideResponse ?? tool.overrideResponse
-    };
-};
 
 //# sourceMappingURL=sanitizeMCPConfig.js.map

package/dist/mcp/sanitizeMCPConfig.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/mcp/sanitizeMCPConfig.ts"],"sourcesContent":["import type {\n  CollectionConfig,\n  Config,\n  GlobalConfig,\n  SanitizedCollectionConfig,\n  SanitizedConfig,\n  SanitizedGlobalConfig,\n} from 'payload'\n\nimport type {\n  CollectionTool,\n  GlobalTool,\n  MCPBuiltInToolOverride,\n  MCPItem,\n  MCPPluginCollectionConfig,\n  MCPPluginConfig,\n  MCPPluginGlobalConfig,\n  SanitizedMCPPluginConfig,\n} from '../types.js'\n\nimport {\n  COLLECTION_AUTH_BUILTIN_ENTRIES,\n  COLLECTION_AUTH_BUILTINS,\n  COLLECTION_BUILTIN_ENTRIES,\n  COLLECTION_BUILTINS,\n  GLOBAL_BUILTIN_ENTRIES,\n  GLOBAL_BUILTINS,\n} from './builtinTools.js'\n\n/**\n * Converts the user-configured `MCPPluginConfig` into a `SanitizedMCPPluginConfig`:\n *  - Flattens `tools` / `prompts` / `resources` / per-collection / per-global\n *    tool maps into a single `items` array.\n *  - Applies built-in tools for collections and globals, respecting opt-out user overrides.\n *  - Applies the `userCollection` default\n *\n * Called once during plugin init. After that, `plugins['@payloadcms/plugin-mcp']\n * ?.options` holds the sanitized result\n */\nexport const sanitizeMCPConfig = ({\n  config,\n  pluginConfig,\n}: {\n  config: Config | SanitizedConfig\n  pluginConfig: MCPPluginConfig\n}): SanitizedMCPPluginConfig => {\n  const items: MCPItem[] = []\n\n  for (const collection of config.collections ?? []) {\n    items.push(...sanitizeCollectionConfig({ collection, pluginConfig }))\n  }\n\n  for (const global of config.globals ?? []) {\n    items.push(...sanitizeGlobalConfig({ global, pluginConfig }))\n  }\n\n  for (const [key, tool] of Object.entries(pluginConfig.tools ?? {})) {\n    items.push({\n      type: 'tool',\n      key,\n      label: key,\n      tool,\n    })\n  }\n\n  for (const [key, prompt] of Object.entries(pluginConfig.prompts ?? {})) {\n    items.push({\n      type: 'prompt',\n      key,\n      label: prompt.title ?? key,\n      prompt,\n    })\n  }\n\n  for (const [key, resource] of Object.entries(pluginConfig.resources ?? {})) {\n    items.push({\n      type: 'resource',\n      key,\n      label: resource.title ?? key,\n      resource,\n    })\n  }\n\n  // Mirror Payload's own admin.user detection (sanitize.ts) since plugins run first.\n  const firstCollectionWithAuth = config.collections!.find(({ auth }) => Boolean(auth))\n\n  return {\n    disabled: pluginConfig.disabled,\n    items,\n    mcp: pluginConfig.mcp,\n    overrideApiKeyCollection: pluginConfig.overrideApiKeyCollection,\n    overrideAuth: pluginConfig.overrideAuth,\n    userCollection:\n      pluginConfig.userCollection ?? config.admin?.user ?? firstCollectionWithAuth?.slug ?? 'users',\n  }\n}\n\nconst sanitizeCollectionConfig = ({\n  collection,\n  pluginConfig,\n}: {\n  collection: CollectionConfig | SanitizedCollectionConfig\n  pluginConfig: MCPPluginConfig\n}): MCPItem[] => {\n  if (collection.slug === 'payload-mcp-api-keys') {\n    return []\n  }\n  const slug = collection.slug\n  const collectionPluginConfig = pluginConfig.collections?.[slug]\n  const items: MCPItem[] = []\n\n  for (const [toolKey, tool] of COLLECTION_BUILTIN_ENTRIES) {\n    const matchedConfigEntry = collectionPluginConfig?.tools?.[toolKey]\n    if (matchedConfigEntry === false) {\n      continue\n    }\n    items.push({\n      type: 'collectionTool',\n      collectionSlug: slug,\n      key: toolKey,\n      label: capitalize(toolKey),\n      tool: overrideBuiltinTool(tool, matchedConfigEntry, collectionPluginConfig),\n    })\n  }\n\n  if (collection.auth) {\n    for (const [authToolKey, { label, tool }] of COLLECTION_AUTH_BUILTIN_ENTRIES) {\n      const matchedConfigEntry = collectionPluginConfig?.tools?.[authToolKey]\n      if (!matchedConfigEntry) {\n        continue\n      }\n      // `true` means \"enable, no override\"; only the object form carries fields.\n      const override = typeof matchedConfigEntry === 'object' ? matchedConfigEntry : undefined\n      items.push({\n        type: 'collectionTool',\n        collectionSlug: slug,\n        key: authToolKey,\n        label,\n        tool: overrideBuiltinTool(tool, override, collectionPluginConfig),\n      })\n    }\n  }\n\n  // Cast: builtin keys are filtered out below, so the remaining values are\n  // always custom tools (`CollectionTool`) or undefined\n  const customEntries = Object.entries(collectionPluginConfig?.tools ?? {}) as Array<\n    [string, CollectionTool | undefined]\n  >\n  for (const [key, customTool] of customEntries) {\n    if (key in COLLECTION_BUILTINS || key in COLLECTION_AUTH_BUILTINS) {\n      continue\n    }\n    if (!customTool) {\n      continue\n    }\n    items.push({\n      type: 'collectionTool',\n      collectionSlug: slug,\n      key,\n      label: key,\n      tool: customTool,\n    })\n  }\n\n  return items\n}\n\nconst sanitizeGlobalConfig = ({\n  global,\n  pluginConfig,\n}: {\n  global: GlobalConfig | SanitizedGlobalConfig\n  pluginConfig: MCPPluginConfig\n}): MCPItem[] => {\n  const slug = global.slug\n  const globalPluginConfig = pluginConfig.globals?.[slug]\n  const items: MCPItem[] = []\n\n  for (const [toolKey, baseTool] of GLOBAL_BUILTIN_ENTRIES) {\n    const matchedConfigEntry = globalPluginConfig?.tools?.[toolKey]\n    if (matchedConfigEntry === false) {\n      continue\n    }\n    items.push({\n      type: 'globalTool',\n      globalSlug: slug,\n      key: toolKey,\n      label: capitalize(toolKey),\n      tool: overrideBuiltinTool(baseTool, matchedConfigEntry, globalPluginConfig),\n    })\n  }\n\n  const customEntries = Object.entries(globalPluginConfig?.tools ?? {}) as Array<\n    [string, GlobalTool | undefined]\n  >\n  for (const [key, customTool] of customEntries) {\n    if (key in GLOBAL_BUILTINS) {\n      continue\n    }\n    if (!customTool) {\n      continue\n    }\n    items.push({\n      type: 'globalTool',\n      globalSlug: slug,\n      key,\n      label: key,\n      tool: customTool,\n    })\n  }\n\n  return items\n}\n\nconst capitalize = (s: string): string => s.charAt(0).toUpperCase() + s.slice(1)\n\n/**\n * Spread the static built-in tool and apply consumer-side overrides.\n * Precedence: per-tool override > scope-level (collection/global) override >\n * the static tool's defaults. `toolEntry` is whatever the user put under\n * `tools: { find: ... }` — could be `true`, `false`, or an override object —\n * so it's narrowed internally.\n */\nconst overrideBuiltinTool = <TTool extends CollectionTool | GlobalTool>(\n  tool: TTool,\n  toolOverride?: MCPBuiltInToolOverride,\n  entityPluginConfig?: TTool extends CollectionTool\n    ? MCPPluginCollectionConfig<any>\n    : MCPPluginGlobalConfig,\n): TTool => {\n  return {\n    ...tool,\n    description: toolOverride?.description ?? entityPluginConfig?.description ?? tool.description,\n    overrideResponse:\n      toolOverride?.overrideResponse ??\n      entityPluginConfig?.overrideResponse ??\n      tool.overrideResponse,\n  }\n}\n"],"names":["COLLECTION_AUTH_BUILTIN_ENTRIES","COLLECTION_AUTH_BUILTINS","COLLECTION_BUILTIN_ENTRIES","COLLECTION_BUILTINS","GLOBAL_BUILTIN_ENTRIES","GLOBAL_BUILTINS","sanitizeMCPConfig","config","pluginConfig","items","collection","collections","push","sanitizeCollectionConfig","global","globals","sanitizeGlobalConfig","key","tool","Object","entries","tools","type","label","prompt","prompts","title","resource","resources","firstCollectionWithAuth","find","auth","Boolean","disabled","mcp","overrideApiKeyCollection","overrideAuth","userCollection","admin","user","slug","collectionPluginConfig","toolKey","matchedConfigEntry","collectionSlug","capitalize","overrideBuiltinTool","authToolKey","override","undefined","customEntries","customTool","globalPluginConfig","baseTool","globalSlug","s","charAt","toUpperCase","slice","toolOverride","entityPluginConfig","description","overrideResponse"],"mappings":"AAoBA,SACEA,+BAA+B,EAC/BC,wBAAwB,EACxBC,0BAA0B,EAC1BC,mBAAmB,EACnBC,sBAAsB,EACtBC,eAAe,QACV,oBAAmB;AAE1B;;;;;;;;;CASC,GACD,OAAO,MAAMC,oBAAoB,CAAC,EAChCC,MAAM,EACNC,YAAY,EAIb;IACC,MAAMC,QAAmB,EAAE;IAE3B,KAAK,MAAMC,cAAcH,OAAOI,WAAW,IAAI,EAAE,CAAE;QACjDF,MAAMG,IAAI,IAAIC,yBAAyB;YAAEH;YAAYF;QAAa;IACpE;IAEA,KAAK,MAAMM,UAAUP,OAAOQ,OAAO,IAAI,EAAE,CAAE;QACzCN,MAAMG,IAAI,IAAII,qBAAqB;YAAEF;YAAQN;QAAa;IAC5D;IAEA,KAAK,MAAM,CAACS,KAAKC,KAAK,IAAIC,OAAOC,OAAO,CAACZ,aAAaa,KAAK,IAAI,CAAC,GAAI;QAClEZ,MAAMG,IAAI,CAAC;YACTU,MAAM;YACNL;YACAM,OAAON;YACPC;QACF;IACF;IAEA,KAAK,MAAM,CAACD,KAAKO,OAAO,IAAIL,OAAOC,OAAO,CAACZ,aAAaiB,OAAO,IAAI,CAAC,GAAI;QACtEhB,MAAMG,IAAI,CAAC;YACTU,MAAM;YACNL;YACAM,OAAOC,OAAOE,KAAK,IAAIT;YACvBO;QACF;IACF;IAEA,KAAK,MAAM,CAACP,KAAKU,SAAS,IAAIR,OAAOC,OAAO,CAACZ,aAAaoB,SAAS,IAAI,CAAC,GAAI;QAC1EnB,MAAMG,IAAI,CAAC;YACTU,MAAM;YACNL;YACAM,OAAOI,SAASD,KAAK,IAAIT;YACzBU;QACF;IACF;IAEA,mFAAmF;IACnF,MAAME,0BAA0BtB,OAAOI,WAAW,CAAEmB,IAAI,CAAC,CAAC,EAAEC,IAAI,EAAE,GAAKC,QAAQD;IAE/E,OAAO;QACLE,UAAUzB,aAAayB,QAAQ;QAC/BxB;QACAyB,KAAK1B,aAAa0B,GAAG;QACrBC,0BAA0B3B,aAAa2B,wBAAwB;QAC/DC,cAAc5B,aAAa4B,YAAY;QACvCC,gBACE7B,aAAa6B,cAAc,IAAI9B,OAAO+B,KAAK,EAAEC,QAAQV,yBAAyBW,QAAQ;IAC1F;AACF,EAAC;AAED,MAAM3B,2BAA2B,CAAC,EAChCH,UAAU,EACVF,YAAY,EAIb;IACC,IAAIE,WAAW8B,IAAI,KAAK,wBAAwB;QAC9C,OAAO,EAAE;IACX;IACA,MAAMA,OAAO9B,WAAW8B,IAAI;IAC5B,MAAMC,yBAAyBjC,aAAaG,WAAW,EAAE,CAAC6B,KAAK;IAC/D,MAAM/B,QAAmB,EAAE;IAE3B,KAAK,MAAM,CAACiC,SAASxB,KAAK,IAAIhB,2BAA4B;QACxD,MAAMyC,qBAAqBF,wBAAwBpB,OAAO,CAACqB,QAAQ;QACnE,IAAIC,uBAAuB,OAAO;YAChC;QACF;QACAlC,MAAMG,IAAI,CAAC;YACTU,MAAM;YACNsB,gBAAgBJ;YAChBvB,KAAKyB;YACLnB,OAAOsB,WAAWH;YAClBxB,MAAM4B,oBAAoB5B,MAAMyB,oBAAoBF;QACtD;IACF;IAEA,IAAI/B,WAAWqB,IAAI,EAAE;QACnB,KAAK,MAAM,CAACgB,aAAa,EAAExB,KAAK,EAAEL,IAAI,EAAE,CAAC,IAAIlB,gCAAiC;YAC5E,MAAM2C,qBAAqBF,wBAAwBpB,OAAO,CAAC0B,YAAY;YACvE,IAAI,CAACJ,oBAAoB;gBACvB;YACF;YACA,2EAA2E;YAC3E,MAAMK,WAAW,OAAOL,uBAAuB,WAAWA,qBAAqBM;YAC/ExC,MAAMG,IAAI,CAAC;gBACTU,MAAM;gBACNsB,gBAAgBJ;gBAChBvB,KAAK8B;gBACLxB;gBACAL,MAAM4B,oBAAoB5B,MAAM8B,UAAUP;YAC5C;QACF;IACF;IAEA,yEAAyE;IACzE,sDAAsD;IACtD,MAAMS,gBAAgB/B,OAAOC,OAAO,CAACqB,wBAAwBpB,SAAS,CAAC;IAGvE,KAAK,MAAM,CAACJ,KAAKkC,WAAW,IAAID,cAAe;QAC7C,IAAIjC,OAAOd,uBAAuBc,OAAOhB,0BAA0B;YACjE;QACF;QACA,IAAI,CAACkD,YAAY;YACf;QACF;QACA1C,MAAMG,IAAI,CAAC;YACTU,MAAM;YACNsB,gBAAgBJ;YAChBvB;YACAM,OAAON;YACPC,MAAMiC;QACR;IACF;IAEA,OAAO1C;AACT;AAEA,MAAMO,uBAAuB,CAAC,EAC5BF,MAAM,EACNN,YAAY,EAIb;IACC,MAAMgC,OAAO1B,OAAO0B,IAAI;IACxB,MAAMY,qBAAqB5C,aAAaO,OAAO,EAAE,CAACyB,KAAK;IACvD,MAAM/B,QAAmB,EAAE;IAE3B,KAAK,MAAM,CAACiC,SAASW,SAAS,IAAIjD,uBAAwB;QACxD,MAAMuC,qBAAqBS,oBAAoB/B,OAAO,CAACqB,QAAQ;QAC/D,IAAIC,uBAAuB,OAAO;YAChC;QACF;QACAlC,MAAMG,IAAI,CAAC;YACTU,MAAM;YACNgC,YAAYd;YACZvB,KAAKyB;YACLnB,OAAOsB,WAAWH;YAClBxB,MAAM4B,oBAAoBO,UAAUV,oBAAoBS;QAC1D;IACF;IAEA,MAAMF,gBAAgB/B,OAAOC,OAAO,CAACgC,oBAAoB/B,SAAS,CAAC;IAGnE,KAAK,MAAM,CAACJ,KAAKkC,WAAW,IAAID,cAAe;QAC7C,IAAIjC,OAAOZ,iBAAiB;YAC1B;QACF;QACA,IAAI,CAAC8C,YAAY;YACf;QACF;QACA1C,MAAMG,IAAI,CAAC;YACTU,MAAM;YACNgC,YAAYd;YACZvB;YACAM,OAAON;YACPC,MAAMiC;QACR;IACF;IAEA,OAAO1C;AACT;AAEA,MAAMoC,aAAa,CAACU,IAAsBA,EAAEC,MAAM,CAAC,GAAGC,WAAW,KAAKF,EAAEG,KAAK,CAAC;AAE9E;;;;;;CAMC,GACD,MAAMZ,sBAAsB,CAC1B5B,MACAyC,cACAC;IAIA,OAAO;QACL,GAAG1C,IAAI;QACP2C,aAAaF,cAAcE,eAAeD,oBAAoBC,eAAe3C,KAAK2C,WAAW;QAC7FC,kBACEH,cAAcG,oBACdF,oBAAoBE,oBACpB5C,KAAK4C,gBAAgB;IACzB;AACF"}
+{"version":3,"sources":["../../src/mcp/sanitizeMCPConfig.ts"],"sourcesContent":["import type {\n  CollectionConfig,\n  Config,\n  GlobalConfig,\n  SanitizedCollectionConfig,\n  SanitizedConfig,\n  SanitizedGlobalConfig,\n} from 'payload'\n\nimport type {\n  CollectionMCPItem,\n  CollectionTool,\n  GlobalMCPItem,\n  GlobalTool,\n  MCPItem,\n  MCPPluginConfig,\n  SanitizedMCPPluginConfig,\n} from '../types.js'\n\nimport { defaultAccess } from '../defaultAccess.js'\nimport {\n  COLLECTION_AUTH_BUILTIN_ENTRIES,\n  COLLECTION_AUTH_BUILTINS,\n  COLLECTION_BUILTIN_ENTRIES,\n  COLLECTION_BUILTINS,\n  GLOBAL_BUILTIN_ENTRIES,\n  GLOBAL_BUILTINS,\n  TOOL_BUILTIN_ENTRIES,\n  TOOL_BUILTINS,\n} from './builtinTools.js'\n\n/**\n * Converts the user-configured `MCPPluginConfig` into a `SanitizedMCPPluginConfig`:\n *  - Flattens `tools` / `prompts` / `resources` / per-collection / per-global\n *    tool maps into a single `items` array.\n *  - Applies built-in tools for collections and globals, respecting opt-out user overrides.\n *\n * Called once during plugin init. After that, `plugins['@payloadcms/plugin-mcp']\n * ?.options` holds the sanitized result\n */\nexport const sanitizeMCPConfig = ({\n  config,\n  pluginConfig,\n}: {\n  config: Config | SanitizedConfig\n  pluginConfig: MCPPluginConfig\n}): SanitizedMCPPluginConfig => {\n  const items: MCPItem[] = []\n\n  for (const collection of config.collections ?? []) {\n    items.push(...sanitizeCollectionConfig({ collection, pluginConfig }))\n  }\n\n  for (const global of config.globals ?? []) {\n    items.push(...sanitizeGlobalConfig({ global, pluginConfig }))\n  }\n\n  for (const [configKey, { mcpName, tool }] of TOOL_BUILTIN_ENTRIES) {\n    items.push({\n      type: 'tool',\n      configKey,\n      label: tool.annotations?.title ?? configKey,\n      mcpName,\n      tool: { ...tool, access: tool.access ?? defaultAccess },\n    })\n  }\n\n  for (const [configKey, tool] of Object.entries(pluginConfig.tools ?? {})) {\n    if (configKey in TOOL_BUILTINS) {\n      continue\n    }\n    items.push({\n      type: 'tool',\n      configKey,\n      label: tool.annotations?.title ?? configKey,\n      mcpName: configKey,\n      tool: { ...tool, access: tool.access ?? defaultAccess },\n    })\n  }\n\n  for (const [configKey, prompt] of Object.entries(pluginConfig.prompts ?? {})) {\n    items.push({\n      type: 'prompt',\n      configKey,\n      label: prompt.title ?? configKey,\n      mcpName: configKey,\n      prompt: { ...prompt, access: prompt.access ?? defaultAccess },\n    })\n  }\n\n  for (const [configKey, resource] of Object.entries(pluginConfig.resources ?? {})) {\n    items.push({\n      type: 'resource',\n      configKey,\n      label: resource.title ?? configKey,\n      mcpName: configKey,\n      resource: { ...resource, access: resource.access ?? defaultAccess },\n    })\n  }\n\n  return {\n    disabled: pluginConfig.disabled,\n    items,\n    mcp: pluginConfig.mcp,\n    overrideGetAuthorizedMCP: pluginConfig.overrideGetAuthorizedMCP,\n  }\n}\n\nconst sanitizeCollectionConfig = ({\n  collection,\n  pluginConfig,\n}: {\n  collection: CollectionConfig | SanitizedCollectionConfig\n  pluginConfig: MCPPluginConfig\n}): CollectionMCPItem[] => {\n  const slug = collection.slug\n  const collectionPluginConfig = pluginConfig.collections?.[slug]\n  const items: CollectionMCPItem[] = []\n  /**\n   * Payload disables duplicate for auth collections by default unless the\n   * collection explicitly opts back in with `disableDuplicate: false`.\n   */\n  const isDuplicateDisabled =\n    collection.disableDuplicate === true ||\n    (Boolean(collection.auth) && collection.disableDuplicate !== false)\n\n  for (const [\n    toolKey,\n    { mcpName, requiresDuplicateEnabled, requiresVersions, tool },\n  ] of COLLECTION_BUILTIN_ENTRIES) {\n    if (requiresVersions && !collection.versions) {\n      continue\n    }\n    if (requiresDuplicateEnabled && isDuplicateDisabled) {\n      continue\n    }\n    const matchedConfigEntry = collectionPluginConfig?.tools?.[toolKey]\n    if (matchedConfigEntry === false) {\n      continue\n    }\n    const override = typeof matchedConfigEntry === 'object' ? matchedConfigEntry : undefined\n    const annotations = { ...tool.annotations, ...override?.annotations }\n    items.push({\n      type: 'collectionTool',\n      collectionSlug: slug,\n      configKey: toolKey,\n      label: annotations.title ?? toolKey,\n      mcpName,\n      tool: {\n        ...tool,\n        access: override?.access ?? tool.access ?? defaultAccess,\n        annotations,\n        description: override?.description ?? tool.description,\n        overrideResponse:\n          override?.overrideResponse ??\n          collectionPluginConfig?.overrideResponse ??\n          tool.overrideResponse,\n      },\n    })\n  }\n\n  if (collection.auth) {\n    for (const [authToolKey, { mcpName, tool }] of COLLECTION_AUTH_BUILTIN_ENTRIES) {\n      const matchedConfigEntry = collectionPluginConfig?.tools?.[authToolKey]\n      if (!matchedConfigEntry) {\n        continue\n      }\n      // `true` means \"enable, no override\"; only the object form carries fields.\n      const override = typeof matchedConfigEntry === 'object' ? matchedConfigEntry : undefined\n      const annotations = { ...tool.annotations, ...override?.annotations }\n      items.push({\n        type: 'collectionTool',\n        collectionSlug: slug,\n        configKey: authToolKey,\n        label: annotations.title ?? authToolKey,\n        mcpName,\n        tool: {\n          ...tool,\n          access: override?.access ?? tool.access ?? defaultAccess,\n          annotations,\n          description: override?.description ?? tool.description,\n          overrideResponse:\n            override?.overrideResponse ??\n            collectionPluginConfig?.overrideResponse ??\n            tool.overrideResponse,\n        },\n      })\n    }\n  }\n\n  // Cast: builtin keys are filtered out below, so the remaining values are\n  // always custom tools (`CollectionTool`) or undefined\n  const customEntries = Object.entries(collectionPluginConfig?.tools ?? {}) as Array<\n    [string, CollectionTool | undefined]\n  >\n  for (const [configKey, customTool] of customEntries) {\n    if (configKey in COLLECTION_BUILTINS || configKey in COLLECTION_AUTH_BUILTINS) {\n      continue\n    }\n    if (!customTool) {\n      continue\n    }\n    items.push({\n      type: 'collectionTool',\n      collectionSlug: slug,\n      configKey,\n      label: customTool.annotations?.title ?? configKey,\n      mcpName: configKey,\n      tool: { ...customTool, access: customTool.access ?? defaultAccess },\n    })\n  }\n\n  return items\n}\n\nconst sanitizeGlobalConfig = ({\n  global,\n  pluginConfig,\n}: {\n  global: GlobalConfig | SanitizedGlobalConfig\n  pluginConfig: MCPPluginConfig\n}): GlobalMCPItem[] => {\n  const slug = global.slug\n  const globalPluginConfig = pluginConfig.globals?.[slug]\n  const items: GlobalMCPItem[] = []\n\n  for (const [toolKey, { mcpName, requiresVersions, tool }] of GLOBAL_BUILTIN_ENTRIES) {\n    if (requiresVersions && !global.versions) {\n      continue\n    }\n    const matchedConfigEntry = globalPluginConfig?.tools?.[toolKey]\n    if (matchedConfigEntry === false) {\n      continue\n    }\n    const override = typeof matchedConfigEntry === 'object' ? matchedConfigEntry : undefined\n    const annotations = { ...tool.annotations, ...override?.annotations }\n    items.push({\n      type: 'globalTool',\n      configKey: toolKey,\n      globalSlug: slug,\n      label: annotations.title ?? toolKey,\n      mcpName,\n      tool: {\n        ...tool,\n        access: override?.access ?? tool.access ?? defaultAccess,\n        annotations,\n        description: override?.description ?? tool.description,\n        overrideResponse:\n          override?.overrideResponse ??\n          globalPluginConfig?.overrideResponse ??\n          tool.overrideResponse,\n      },\n    })\n  }\n\n  const customEntries = Object.entries(globalPluginConfig?.tools ?? {}) as Array<\n    [string, GlobalTool | undefined]\n  >\n  for (const [configKey, customTool] of customEntries) {\n    if (configKey in GLOBAL_BUILTINS) {\n      continue\n    }\n    if (!customTool) {\n      continue\n    }\n    items.push({\n      type: 'globalTool',\n      configKey,\n      globalSlug: slug,\n      label: customTool.annotations?.title ?? configKey,\n      mcpName: configKey,\n      tool: { ...customTool, access: customTool.access ?? defaultAccess },\n    })\n  }\n\n  return items\n}\n"],"names":["defaultAccess","COLLECTION_AUTH_BUILTIN_ENTRIES","COLLECTION_AUTH_BUILTINS","COLLECTION_BUILTIN_ENTRIES","COLLECTION_BUILTINS","GLOBAL_BUILTIN_ENTRIES","GLOBAL_BUILTINS","TOOL_BUILTIN_ENTRIES","TOOL_BUILTINS","sanitizeMCPConfig","config","pluginConfig","items","collection","collections","push","sanitizeCollectionConfig","global","globals","sanitizeGlobalConfig","configKey","mcpName","tool","type","label","annotations","title","access","Object","entries","tools","prompt","prompts","resource","resources","disabled","mcp","overrideGetAuthorizedMCP","slug","collectionPluginConfig","isDuplicateDisabled","disableDuplicate","Boolean","auth","toolKey","requiresDuplicateEnabled","requiresVersions","versions","matchedConfigEntry","override","undefined","collectionSlug","description","overrideResponse","authToolKey","customEntries","customTool","globalPluginConfig","globalSlug"],"mappings":"AAmBA,SAASA,aAAa,QAAQ,sBAAqB;AACnD,SACEC,+BAA+B,EAC/BC,wBAAwB,EACxBC,0BAA0B,EAC1BC,mBAAmB,EACnBC,sBAAsB,EACtBC,eAAe,EACfC,oBAAoB,EACpBC,aAAa,QACR,oBAAmB;AAE1B;;;;;;;;CAQC,GACD,OAAO,MAAMC,oBAAoB,CAAC,EAChCC,MAAM,EACNC,YAAY,EAIb;IACC,MAAMC,QAAmB,EAAE;IAE3B,KAAK,MAAMC,cAAcH,OAAOI,WAAW,IAAI,EAAE,CAAE;QACjDF,MAAMG,IAAI,IAAIC,yBAAyB;YAAEH;YAAYF;QAAa;IACpE;IAEA,KAAK,MAAMM,UAAUP,OAAOQ,OAAO,IAAI,EAAE,CAAE;QACzCN,MAAMG,IAAI,IAAII,qBAAqB;YAAEF;YAAQN;QAAa;IAC5D;IAEA,KAAK,MAAM,CAACS,WAAW,EAAEC,OAAO,EAAEC,IAAI,EAAE,CAAC,IAAIf,qBAAsB;QACjEK,MAAMG,IAAI,CAAC;YACTQ,MAAM;YACNH;YACAI,OAAOF,KAAKG,WAAW,EAAEC,SAASN;YAClCC;YACAC,MAAM;gBAAE,GAAGA,IAAI;gBAAEK,QAAQL,KAAKK,MAAM,IAAI3B;YAAc;QACxD;IACF;IAEA,KAAK,MAAM,CAACoB,WAAWE,KAAK,IAAIM,OAAOC,OAAO,CAAClB,aAAamB,KAAK,IAAI,CAAC,GAAI;QACxE,IAAIV,aAAaZ,eAAe;YAC9B;QACF;QACAI,MAAMG,IAAI,CAAC;YACTQ,MAAM;YACNH;YACAI,OAAOF,KAAKG,WAAW,EAAEC,SAASN;YAClCC,SAASD;YACTE,MAAM;gBAAE,GAAGA,IAAI;gBAAEK,QAAQL,KAAKK,MAAM,IAAI3B;YAAc;QACxD;IACF;IAEA,KAAK,MAAM,CAACoB,WAAWW,OAAO,IAAIH,OAAOC,OAAO,CAAClB,aAAaqB,OAAO,IAAI,CAAC,GAAI;QAC5EpB,MAAMG,IAAI,CAAC;YACTQ,MAAM;YACNH;YACAI,OAAOO,OAAOL,KAAK,IAAIN;YACvBC,SAASD;YACTW,QAAQ;gBAAE,GAAGA,MAAM;gBAAEJ,QAAQI,OAAOJ,MAAM,IAAI3B;YAAc;QAC9D;IACF;IAEA,KAAK,MAAM,CAACoB,WAAWa,SAAS,IAAIL,OAAOC,OAAO,CAAClB,aAAauB,SAAS,IAAI,CAAC,GAAI;QAChFtB,MAAMG,IAAI,CAAC;YACTQ,MAAM;YACNH;YACAI,OAAOS,SAASP,KAAK,IAAIN;YACzBC,SAASD;YACTa,UAAU;gBAAE,GAAGA,QAAQ;gBAAEN,QAAQM,SAASN,MAAM,IAAI3B;YAAc;QACpE;IACF;IAEA,OAAO;QACLmC,UAAUxB,aAAawB,QAAQ;QAC/BvB;QACAwB,KAAKzB,aAAayB,GAAG;QACrBC,0BAA0B1B,aAAa0B,wBAAwB;IACjE;AACF,EAAC;AAED,MAAMrB,2BAA2B,CAAC,EAChCH,UAAU,EACVF,YAAY,EAIb;IACC,MAAM2B,OAAOzB,WAAWyB,IAAI;IAC5B,MAAMC,yBAAyB5B,aAAaG,WAAW,EAAE,CAACwB,KAAK;IAC/D,MAAM1B,QAA6B,EAAE;IACrC;;;GAGC,GACD,MAAM4B,sBACJ3B,WAAW4B,gBAAgB,KAAK,QAC/BC,QAAQ7B,WAAW8B,IAAI,KAAK9B,WAAW4B,gBAAgB,KAAK;IAE/D,KAAK,MAAM,CACTG,SACA,EAAEvB,OAAO,EAAEwB,wBAAwB,EAAEC,gBAAgB,EAAExB,IAAI,EAAE,CAC9D,IAAInB,2BAA4B;QAC/B,IAAI2C,oBAAoB,CAACjC,WAAWkC,QAAQ,EAAE;YAC5C;QACF;QACA,IAAIF,4BAA4BL,qBAAqB;YACnD;QACF;QACA,MAAMQ,qBAAqBT,wBAAwBT,OAAO,CAACc,QAAQ;QACnE,IAAII,uBAAuB,OAAO;YAChC;QACF;QACA,MAAMC,WAAW,OAAOD,uBAAuB,WAAWA,qBAAqBE;QAC/E,MAAMzB,cAAc;YAAE,GAAGH,KAAKG,WAAW;YAAE,GAAGwB,UAAUxB,WAAW;QAAC;QACpEb,MAAMG,IAAI,CAAC;YACTQ,MAAM;YACN4B,gBAAgBb;YAChBlB,WAAWwB;YACXpB,OAAOC,YAAYC,KAAK,IAAIkB;YAC5BvB;YACAC,MAAM;gBACJ,GAAGA,IAAI;gBACPK,QAAQsB,UAAUtB,UAAUL,KAAKK,MAAM,IAAI3B;gBAC3CyB;gBACA2B,aAAaH,UAAUG,eAAe9B,KAAK8B,WAAW;gBACtDC,kBACEJ,UAAUI,oBACVd,wBAAwBc,oBACxB/B,KAAK+B,gBAAgB;YACzB;QACF;IACF;IAEA,IAAIxC,WAAW8B,IAAI,EAAE;QACnB,KAAK,MAAM,CAACW,aAAa,EAAEjC,OAAO,EAAEC,IAAI,EAAE,CAAC,IAAIrB,gCAAiC;YAC9E,MAAM+C,qBAAqBT,wBAAwBT,OAAO,CAACwB,YAAY;YACvE,IAAI,CAACN,oBAAoB;gBACvB;YACF;YACA,2EAA2E;YAC3E,MAAMC,WAAW,OAAOD,uBAAuB,WAAWA,qBAAqBE;YAC/E,MAAMzB,cAAc;gBAAE,GAAGH,KAAKG,WAAW;gBAAE,GAAGwB,UAAUxB,WAAW;YAAC;YACpEb,MAAMG,IAAI,CAAC;gBACTQ,MAAM;gBACN4B,gBAAgBb;gBAChBlB,WAAWkC;gBACX9B,OAAOC,YAAYC,KAAK,IAAI4B;gBAC5BjC;gBACAC,MAAM;oBACJ,GAAGA,IAAI;oBACPK,QAAQsB,UAAUtB,UAAUL,KAAKK,MAAM,IAAI3B;oBAC3CyB;oBACA2B,aAAaH,UAAUG,eAAe9B,KAAK8B,WAAW;oBACtDC,kBACEJ,UAAUI,oBACVd,wBAAwBc,oBACxB/B,KAAK+B,gBAAgB;gBACzB;YACF;QACF;IACF;IAEA,yEAAyE;IACzE,sDAAsD;IACtD,MAAME,gBAAgB3B,OAAOC,OAAO,CAACU,wBAAwBT,SAAS,CAAC;IAGvE,KAAK,MAAM,CAACV,WAAWoC,WAAW,IAAID,cAAe;QACnD,IAAInC,aAAahB,uBAAuBgB,aAAalB,0BAA0B;YAC7E;QACF;QACA,IAAI,CAACsD,YAAY;YACf;QACF;QACA5C,MAAMG,IAAI,CAAC;YACTQ,MAAM;YACN4B,gBAAgBb;YAChBlB;YACAI,OAAOgC,WAAW/B,WAAW,EAAEC,SAASN;YACxCC,SAASD;YACTE,MAAM;gBAAE,GAAGkC,UAAU;gBAAE7B,QAAQ6B,WAAW7B,MAAM,IAAI3B;YAAc;QACpE;IACF;IAEA,OAAOY;AACT;AAEA,MAAMO,uBAAuB,CAAC,EAC5BF,MAAM,EACNN,YAAY,EAIb;IACC,MAAM2B,OAAOrB,OAAOqB,IAAI;IACxB,MAAMmB,qBAAqB9C,aAAaO,OAAO,EAAE,CAACoB,KAAK;IACvD,MAAM1B,QAAyB,EAAE;IAEjC,KAAK,MAAM,CAACgC,SAAS,EAAEvB,OAAO,EAAEyB,gBAAgB,EAAExB,IAAI,EAAE,CAAC,IAAIjB,uBAAwB;QACnF,IAAIyC,oBAAoB,CAAC7B,OAAO8B,QAAQ,EAAE;YACxC;QACF;QACA,MAAMC,qBAAqBS,oBAAoB3B,OAAO,CAACc,QAAQ;QAC/D,IAAII,uBAAuB,OAAO;YAChC;QACF;QACA,MAAMC,WAAW,OAAOD,uBAAuB,WAAWA,qBAAqBE;QAC/E,MAAMzB,cAAc;YAAE,GAAGH,KAAKG,WAAW;YAAE,GAAGwB,UAAUxB,WAAW;QAAC;QACpEb,MAAMG,IAAI,CAAC;YACTQ,MAAM;YACNH,WAAWwB;YACXc,YAAYpB;YACZd,OAAOC,YAAYC,KAAK,IAAIkB;YAC5BvB;YACAC,MAAM;gBACJ,GAAGA,IAAI;gBACPK,QAAQsB,UAAUtB,UAAUL,KAAKK,MAAM,IAAI3B;gBAC3CyB;gBACA2B,aAAaH,UAAUG,eAAe9B,KAAK8B,WAAW;gBACtDC,kBACEJ,UAAUI,oBACVI,oBAAoBJ,oBACpB/B,KAAK+B,gBAAgB;YACzB;QACF;IACF;IAEA,MAAME,gBAAgB3B,OAAOC,OAAO,CAAC4B,oBAAoB3B,SAAS,CAAC;IAGnE,KAAK,MAAM,CAACV,WAAWoC,WAAW,IAAID,cAAe;QACnD,IAAInC,aAAad,iBAAiB;YAChC;QACF;QACA,IAAI,CAACkD,YAAY;YACf;QACF;QACA5C,MAAMG,IAAI,CAAC;YACTQ,MAAM;YACNH;YACAsC,YAAYpB;YACZd,OAAOgC,WAAW/B,WAAW,EAAEC,SAASN;YACxCC,SAASD;YACTE,MAAM;gBAAE,GAAGkC,UAAU;gBAAE7B,QAAQ6B,WAAW7B,MAAM,IAAI3B;YAAc;QACpE;IACF;IAEA,OAAOY;AACT"}

package/dist/stdio.d.ts

@@ -1,8 +1,9 @@
 /**
  * Stdio adapter for the Payload MCP server.
  *
- * Do not use in production. There's no auth; whoever can spawn the process gets
- * full access to your local data.
+ * Pass PAYLOAD_MCP_AUTHORIZATION when stdio should authenticate with the same
+ * Payload auth header as HTTP. In development, PAYLOAD_MCP_OVERRIDE_ACCESS=true
+ * skips access control for local setup.
  */
 export declare const runMcpStdio: () => Promise<void>;
 //# sourceMappingURL=stdio.d.ts.map

package/dist/stdio.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stdio.d.ts","sourceRoot":"","sources":["../src/stdio.ts"],"names":[],"mappings":"AAeA;;;;;GAKG;AACH,eAAO,MAAM,WAAW,QAAa,OAAO,CAAC,IAAI,CA4EhD,CAAA"}
+{"version":3,"file":"stdio.d.ts","sourceRoot":"","sources":["../src/stdio.ts"],"names":[],"mappings":"AAgBA;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,QAAa,OAAO,CAAC,IAAI,CAyFhD,CAAA"}

package/dist/stdio.js

@@ -2,6 +2,7 @@
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { createLocalReq, getPayload } from 'payload';
 import { findConfig } from 'payload/node';
+import { getAuthorizedMCP } from './endpoint/access.js';
 import { buildMcpServer } from './mcp/buildMcpServer.js';
 import { sanitizeMCPConfig } from './mcp/sanitizeMCPConfig.js';
 import { getPluginConfig } from './utils/getPluginConfig.js';
@@ -9,8 +10,9 @@ import { resolveProjectRoot } from './utils/resolveProjectRoot.js';
 /**
  * Stdio adapter for the Payload MCP server.
  *
- * Do not use in production. There's no auth; whoever can spawn the process gets
- * full access to your local data.
+ * Pass PAYLOAD_MCP_AUTHORIZATION when stdio should authenticate with the same
+ * Payload auth header as HTTP. In development, PAYLOAD_MCP_OVERRIDE_ACCESS=true
+ * skips access control for local setup.
  */ export const runMcpStdio = async ()=>{
     /**
    * If MCP clients spawn stdio servers from an arbitrary working directory,
@@ -52,13 +54,30 @@ import { resolveProjectRoot } from './utils/resolveProjectRoot.js';
         fakePluginFn.sanitizedOptions = pluginConfig;
         (payload.config.plugins ??= []).push(fakePluginFn);
     }
-    const authorizedMCP = {
-        items: pluginConfig.items,
-        overrideAccess: true,
-        user: null
-    };
-    const req = await createLocalReq({}, payload);
+    const overrideAccessEnv = process.env.PAYLOAD_MCP_OVERRIDE_ACCESS;
+    let overrideAccess = false;
+    if (overrideAccessEnv === 'true') {
+        overrideAccess = true;
+    } else if (overrideAccessEnv && overrideAccessEnv !== 'false') {
+        throw new Error('PAYLOAD_MCP_OVERRIDE_ACCESS must be "true" or "false".');
+    }
+    if (overrideAccess && process.env.NODE_ENV !== 'development') {
+        throw new Error('PAYLOAD_MCP_OVERRIDE_ACCESS is only available in development.');
+    }
+    const headers = new Headers();
+    if (process.env.PAYLOAD_MCP_AUTHORIZATION) {
+        headers.set('Authorization', process.env.PAYLOAD_MCP_AUTHORIZATION);
+    }
+    const req = await createLocalReq({
+        req: {
+            headers
+        }
+    }, payload);
     req.payloadAPI = 'MCP';
+    const authorizedMCP = await getAuthorizedMCP({
+        overrideAccess,
+        req
+    });
     const server = buildMcpServer({
         authorizedMCP,
         pluginConfig,

package/dist/stdio.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/stdio.ts"],"sourcesContent":["import type { MaybePromise, Plugin, SanitizedConfig } from 'payload'\n\n/* eslint-disable no-console */\nimport { StdioServerTransport } from '@modelcontextprotocol/server'\nimport { fileURLToPath, pathToFileURL } from 'node:url'\nimport { createLocalReq, getPayload } from 'payload'\nimport { findConfig } from 'payload/node'\n\nimport type { AuthorizedMCP, SanitizedMCPPluginConfig } from './types.js'\n\nimport { buildMcpServer } from './mcp/buildMcpServer.js'\nimport { sanitizeMCPConfig } from './mcp/sanitizeMCPConfig.js'\nimport { getPluginConfig } from './utils/getPluginConfig.js'\nimport { resolveProjectRoot } from './utils/resolveProjectRoot.js'\n\n/**\n * Stdio adapter for the Payload MCP server.\n *\n * Do not use in production. There's no auth; whoever can spawn the process gets\n * full access to your local data.\n */\nexport const runMcpStdio = async (): Promise<void> => {\n  /**\n   * If MCP clients spawn stdio servers from an arbitrary working directory,\n   * Payload's cwd-anchored `findConfig()` can't locate the project on\n   * its own. This module always lives inside the project's `node_modules`, so\n   * we derive the project root from its own path and `chdir` into it.\n   *\n   * An absolute `PAYLOAD_CONFIG_PATH` still overrides everything; unusual\n   * layouts (e.g. a monorepo where the package is hoisted above the app) can\n   * fall back to it. See the implementation of findConfig for details.\n   */\n  const projectRoot = resolveProjectRoot(fileURLToPath(import.meta.url))\n  if (projectRoot) {\n    process.chdir(projectRoot)\n  }\n\n  const configPath = findConfig()\n  const configModule = await import(pathToFileURL(configPath).toString())\n  const config = (await (configModule.default ?? configModule)) as MaybePromise<SanitizedConfig>\n\n  const payload = await getPayload({ config })\n\n  /**\n   * If the user added `mcpPlugin({...})` to their `plugins` array, read the\n   * sanitized config they registered. Otherwise fall back to the defaults. That way,\n   * the mcp works on any project that has `@payloadcms/plugin-mcp` installed,\n   * even if the plugin is not added to the plugins array.\n   */\n  let pluginConfig: SanitizedMCPPluginConfig\n  try {\n    pluginConfig = getPluginConfig({ config: payload.config })\n  } catch {\n    pluginConfig = sanitizeMCPConfig({ config: payload.config, pluginConfig: {} })\n\n    const fakePluginFn: Plugin = (config) => config\n    fakePluginFn.slug = '@payloadcms/plugin-mcp'\n    // @ts-expect-error\n    fakePluginFn.sanitizedOptions = pluginConfig\n\n    // Push to payload config, to ensure consecutive calls to `getPluginConfig()` work\n    ;(payload.config.plugins ??= []).push(fakePluginFn)\n  }\n\n  const authorizedMCP: AuthorizedMCP = {\n    items: pluginConfig.items,\n    overrideAccess: true,\n    user: null,\n  }\n\n  const req = await createLocalReq({}, payload)\n  req.payloadAPI = 'MCP' as const\n\n  const server = buildMcpServer({ authorizedMCP, pluginConfig, req })\n\n  const transport = new StdioServerTransport()\n  await server.connect(transport)\n\n  // Process now lives until stdin closes. Wire graceful shutdown so DB\n  // connections (and any other Payload-managed resources) get released.\n  const shutdown = async (code = 0) => {\n    try {\n      await server.close()\n    } catch (err) {\n      console.error('[payload-mcp] error closing server:', err)\n    }\n    try {\n      await payload.destroy()\n    } catch (err) {\n      console.error('[payload-mcp] error destroying payload:', err)\n    }\n    process.exit(code)\n  }\n\n  process.on('SIGINT', () => void shutdown(0))\n  process.on('SIGTERM', () => void shutdown(0))\n  process.stdin.on('close', () => void shutdown(0))\n}\n"],"names":["StdioServerTransport","fileURLToPath","pathToFileURL","createLocalReq","getPayload","findConfig","buildMcpServer","sanitizeMCPConfig","getPluginConfig","resolveProjectRoot","runMcpStdio","projectRoot","url","process","chdir","configPath","configModule","toString","config","default","payload","pluginConfig","fakePluginFn","slug","sanitizedOptions","plugins","push","authorizedMCP","items","overrideAccess","user","req","payloadAPI","server","transport","connect","shutdown","code","close","err","console","error","destroy","exit","on","stdin"],"mappings":"AAEA,6BAA6B,GAC7B,SAASA,oBAAoB,QAAQ,+BAA8B;AACnE,SAASC,aAAa,EAAEC,aAAa,QAAQ,WAAU;AACvD,SAASC,cAAc,EAAEC,UAAU,QAAQ,UAAS;AACpD,SAASC,UAAU,QAAQ,eAAc;AAIzC,SAASC,cAAc,QAAQ,0BAAyB;AACxD,SAASC,iBAAiB,QAAQ,6BAA4B;AAC9D,SAASC,eAAe,QAAQ,6BAA4B;AAC5D,SAASC,kBAAkB,QAAQ,gCAA+B;AAElE;;;;;CAKC,GACD,OAAO,MAAMC,cAAc;IACzB;;;;;;;;;GASC,GACD,MAAMC,cAAcF,mBAAmBR,cAAc,YAAYW,GAAG;IACpE,IAAID,aAAa;QACfE,QAAQC,KAAK,CAACH;IAChB;IAEA,MAAMI,aAAaV;IACnB,MAAMW,eAAe,MAAM,MAAM,CAACd,cAAca,YAAYE,QAAQ;IACpE,MAAMC,SAAU,MAAOF,CAAAA,aAAaG,OAAO,IAAIH,YAAW;IAE1D,MAAMI,UAAU,MAAMhB,WAAW;QAAEc;IAAO;IAE1C;;;;;GAKC,GACD,IAAIG;IACJ,IAAI;QACFA,eAAeb,gBAAgB;YAAEU,QAAQE,QAAQF,MAAM;QAAC;IAC1D,EAAE,OAAM;QACNG,eAAed,kBAAkB;YAAEW,QAAQE,QAAQF,MAAM;YAAEG,cAAc,CAAC;QAAE;QAE5E,MAAMC,eAAuB,CAACJ,SAAWA;QACzCI,aAAaC,IAAI,GAAG;QACpB,mBAAmB;QACnBD,aAAaE,gBAAgB,GAAGH;QAG9BD,CAAAA,QAAQF,MAAM,CAACO,OAAO,KAAK,EAAE,AAAD,EAAGC,IAAI,CAACJ;IACxC;IAEA,MAAMK,gBAA+B;QACnCC,OAAOP,aAAaO,KAAK;QACzBC,gBAAgB;QAChBC,MAAM;IACR;IAEA,MAAMC,MAAM,MAAM5B,eAAe,CAAC,GAAGiB;IACrCW,IAAIC,UAAU,GAAG;IAEjB,MAAMC,SAAS3B,eAAe;QAAEqB;QAAeN;QAAcU;IAAI;IAEjE,MAAMG,YAAY,IAAIlC;IACtB,MAAMiC,OAAOE,OAAO,CAACD;IAErB,qEAAqE;IACrE,sEAAsE;IACtE,MAAME,WAAW,OAAOC,OAAO,CAAC;QAC9B,IAAI;YACF,MAAMJ,OAAOK,KAAK;QACpB,EAAE,OAAOC,KAAK;YACZC,QAAQC,KAAK,CAAC,uCAAuCF;QACvD;QACA,IAAI;YACF,MAAMnB,QAAQsB,OAAO;QACvB,EAAE,OAAOH,KAAK;YACZC,QAAQC,KAAK,CAAC,2CAA2CF;QAC3D;QACA1B,QAAQ8B,IAAI,CAACN;IACf;IAEAxB,QAAQ+B,EAAE,CAAC,UAAU,IAAM,KAAKR,SAAS;IACzCvB,QAAQ+B,EAAE,CAAC,WAAW,IAAM,KAAKR,SAAS;IAC1CvB,QAAQgC,KAAK,CAACD,EAAE,CAAC,SAAS,IAAM,KAAKR,SAAS;AAChD,EAAC"}
+{"version":3,"sources":["../src/stdio.ts"],"sourcesContent":["import type { MaybePromise, Plugin, SanitizedConfig } from 'payload'\n\n/* eslint-disable no-console */\nimport { StdioServerTransport } from '@modelcontextprotocol/server'\nimport { fileURLToPath, pathToFileURL } from 'node:url'\nimport { createLocalReq, getPayload } from 'payload'\nimport { findConfig } from 'payload/node'\n\nimport type { SanitizedMCPPluginConfig } from './types.js'\n\nimport { getAuthorizedMCP } from './endpoint/access.js'\nimport { buildMcpServer } from './mcp/buildMcpServer.js'\nimport { sanitizeMCPConfig } from './mcp/sanitizeMCPConfig.js'\nimport { getPluginConfig } from './utils/getPluginConfig.js'\nimport { resolveProjectRoot } from './utils/resolveProjectRoot.js'\n\n/**\n * Stdio adapter for the Payload MCP server.\n *\n * Pass PAYLOAD_MCP_AUTHORIZATION when stdio should authenticate with the same\n * Payload auth header as HTTP. In development, PAYLOAD_MCP_OVERRIDE_ACCESS=true\n * skips access control for local setup.\n */\nexport const runMcpStdio = async (): Promise<void> => {\n  /**\n   * If MCP clients spawn stdio servers from an arbitrary working directory,\n   * Payload's cwd-anchored `findConfig()` can't locate the project on\n   * its own. This module always lives inside the project's `node_modules`, so\n   * we derive the project root from its own path and `chdir` into it.\n   *\n   * An absolute `PAYLOAD_CONFIG_PATH` still overrides everything; unusual\n   * layouts (e.g. a monorepo where the package is hoisted above the app) can\n   * fall back to it. See the implementation of findConfig for details.\n   */\n  const projectRoot = resolveProjectRoot(fileURLToPath(import.meta.url))\n  if (projectRoot) {\n    process.chdir(projectRoot)\n  }\n\n  const configPath = findConfig()\n  const configModule = await import(pathToFileURL(configPath).toString())\n  const config = (await (configModule.default ?? configModule)) as MaybePromise<SanitizedConfig>\n\n  const payload = await getPayload({ config })\n\n  /**\n   * If the user added `mcpPlugin({...})` to their `plugins` array, read the\n   * sanitized config they registered. Otherwise fall back to the defaults. That way,\n   * the mcp works on any project that has `@payloadcms/plugin-mcp` installed,\n   * even if the plugin is not added to the plugins array.\n   */\n  let pluginConfig: SanitizedMCPPluginConfig\n  try {\n    pluginConfig = getPluginConfig({ config: payload.config })\n  } catch {\n    pluginConfig = sanitizeMCPConfig({ config: payload.config, pluginConfig: {} })\n\n    const fakePluginFn: Plugin = (config) => config\n    fakePluginFn.slug = '@payloadcms/plugin-mcp'\n    // @ts-expect-error\n    fakePluginFn.sanitizedOptions = pluginConfig\n\n    // Push to payload config, to ensure consecutive calls to `getPluginConfig()` work\n    ;(payload.config.plugins ??= []).push(fakePluginFn)\n  }\n\n  const overrideAccessEnv = process.env.PAYLOAD_MCP_OVERRIDE_ACCESS\n  let overrideAccess = false\n\n  if (overrideAccessEnv === 'true') {\n    overrideAccess = true\n  } else if (overrideAccessEnv && overrideAccessEnv !== 'false') {\n    throw new Error('PAYLOAD_MCP_OVERRIDE_ACCESS must be \"true\" or \"false\".')\n  }\n\n  if (overrideAccess && process.env.NODE_ENV !== 'development') {\n    throw new Error('PAYLOAD_MCP_OVERRIDE_ACCESS is only available in development.')\n  }\n\n  const headers = new Headers()\n  if (process.env.PAYLOAD_MCP_AUTHORIZATION) {\n    headers.set('Authorization', process.env.PAYLOAD_MCP_AUTHORIZATION)\n  }\n\n  const req = await createLocalReq({ req: { headers } }, payload)\n  req.payloadAPI = 'MCP' as const\n  const authorizedMCP = await getAuthorizedMCP({ overrideAccess, req })\n\n  const server = buildMcpServer({ authorizedMCP, pluginConfig, req })\n\n  const transport = new StdioServerTransport()\n  await server.connect(transport)\n\n  // Process now lives until stdin closes. Wire graceful shutdown so DB\n  // connections (and any other Payload-managed resources) get released.\n  const shutdown = async (code = 0) => {\n    try {\n      await server.close()\n    } catch (err) {\n      console.error('[payload-mcp] error closing server:', err)\n    }\n    try {\n      await payload.destroy()\n    } catch (err) {\n      console.error('[payload-mcp] error destroying payload:', err)\n    }\n    process.exit(code)\n  }\n\n  process.on('SIGINT', () => void shutdown(0))\n  process.on('SIGTERM', () => void shutdown(0))\n  process.stdin.on('close', () => void shutdown(0))\n}\n"],"names":["StdioServerTransport","fileURLToPath","pathToFileURL","createLocalReq","getPayload","findConfig","getAuthorizedMCP","buildMcpServer","sanitizeMCPConfig","getPluginConfig","resolveProjectRoot","runMcpStdio","projectRoot","url","process","chdir","configPath","configModule","toString","config","default","payload","pluginConfig","fakePluginFn","slug","sanitizedOptions","plugins","push","overrideAccessEnv","env","PAYLOAD_MCP_OVERRIDE_ACCESS","overrideAccess","Error","NODE_ENV","headers","Headers","PAYLOAD_MCP_AUTHORIZATION","set","req","payloadAPI","authorizedMCP","server","transport","connect","shutdown","code","close","err","console","error","destroy","exit","on","stdin"],"mappings":"AAEA,6BAA6B,GAC7B,SAASA,oBAAoB,QAAQ,+BAA8B;AACnE,SAASC,aAAa,EAAEC,aAAa,QAAQ,WAAU;AACvD,SAASC,cAAc,EAAEC,UAAU,QAAQ,UAAS;AACpD,SAASC,UAAU,QAAQ,eAAc;AAIzC,SAASC,gBAAgB,QAAQ,uBAAsB;AACvD,SAASC,cAAc,QAAQ,0BAAyB;AACxD,SAASC,iBAAiB,QAAQ,6BAA4B;AAC9D,SAASC,eAAe,QAAQ,6BAA4B;AAC5D,SAASC,kBAAkB,QAAQ,gCAA+B;AAElE;;;;;;CAMC,GACD,OAAO,MAAMC,cAAc;IACzB;;;;;;;;;GASC,GACD,MAAMC,cAAcF,mBAAmBT,cAAc,YAAYY,GAAG;IACpE,IAAID,aAAa;QACfE,QAAQC,KAAK,CAACH;IAChB;IAEA,MAAMI,aAAaX;IACnB,MAAMY,eAAe,MAAM,MAAM,CAACf,cAAcc,YAAYE,QAAQ;IACpE,MAAMC,SAAU,MAAOF,CAAAA,aAAaG,OAAO,IAAIH,YAAW;IAE1D,MAAMI,UAAU,MAAMjB,WAAW;QAAEe;IAAO;IAE1C;;;;;GAKC,GACD,IAAIG;IACJ,IAAI;QACFA,eAAeb,gBAAgB;YAAEU,QAAQE,QAAQF,MAAM;QAAC;IAC1D,EAAE,OAAM;QACNG,eAAed,kBAAkB;YAAEW,QAAQE,QAAQF,MAAM;YAAEG,cAAc,CAAC;QAAE;QAE5E,MAAMC,eAAuB,CAACJ,SAAWA;QACzCI,aAAaC,IAAI,GAAG;QACpB,mBAAmB;QACnBD,aAAaE,gBAAgB,GAAGH;QAG9BD,CAAAA,QAAQF,MAAM,CAACO,OAAO,KAAK,EAAE,AAAD,EAAGC,IAAI,CAACJ;IACxC;IAEA,MAAMK,oBAAoBd,QAAQe,GAAG,CAACC,2BAA2B;IACjE,IAAIC,iBAAiB;IAErB,IAAIH,sBAAsB,QAAQ;QAChCG,iBAAiB;IACnB,OAAO,IAAIH,qBAAqBA,sBAAsB,SAAS;QAC7D,MAAM,IAAII,MAAM;IAClB;IAEA,IAAID,kBAAkBjB,QAAQe,GAAG,CAACI,QAAQ,KAAK,eAAe;QAC5D,MAAM,IAAID,MAAM;IAClB;IAEA,MAAME,UAAU,IAAIC;IACpB,IAAIrB,QAAQe,GAAG,CAACO,yBAAyB,EAAE;QACzCF,QAAQG,GAAG,CAAC,iBAAiBvB,QAAQe,GAAG,CAACO,yBAAyB;IACpE;IAEA,MAAME,MAAM,MAAMnC,eAAe;QAAEmC,KAAK;YAAEJ;QAAQ;IAAE,GAAGb;IACvDiB,IAAIC,UAAU,GAAG;IACjB,MAAMC,gBAAgB,MAAMlC,iBAAiB;QAAEyB;QAAgBO;IAAI;IAEnE,MAAMG,SAASlC,eAAe;QAAEiC;QAAelB;QAAcgB;IAAI;IAEjE,MAAMI,YAAY,IAAI1C;IACtB,MAAMyC,OAAOE,OAAO,CAACD;IAErB,qEAAqE;IACrE,sEAAsE;IACtE,MAAME,WAAW,OAAOC,OAAO,CAAC;QAC9B,IAAI;YACF,MAAMJ,OAAOK,KAAK;QACpB,EAAE,OAAOC,KAAK;YACZC,QAAQC,KAAK,CAAC,uCAAuCF;QACvD;QACA,IAAI;YACF,MAAM1B,QAAQ6B,OAAO;QACvB,EAAE,OAAOH,KAAK;YACZC,QAAQC,KAAK,CAAC,2CAA2CF;QAC3D;QACAjC,QAAQqC,IAAI,CAACN;IACf;IAEA/B,QAAQsC,EAAE,CAAC,UAAU,IAAM,KAAKR,SAAS;IACzC9B,QAAQsC,EAAE,CAAC,WAAW,IAAM,KAAKR,SAAS;IAC1C9B,QAAQuC,KAAK,CAACD,EAAE,CAAC,SAAS,IAAM,KAAKR,SAAS;AAChD,EAAC"}