@payloadcms/plugin-mcp 4.0.0-internal.5a4aa81 → 4.0.0-internal.5e065b3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/bin.js +0 -7
- package/dist/endpoint/index.d.ts.map +1 -1
- package/dist/endpoint/index.js +33 -4
- package/dist/endpoint/index.js.map +1 -1
- package/dist/mcp/buildMcpServer.d.ts +1 -1
- package/dist/mcp/buildMcpServer.d.ts.map +1 -1
- package/dist/mcp/buildMcpServer.js +2 -2
- package/dist/mcp/buildMcpServer.js.map +1 -1
- package/dist/mcp/builtin/collections/authTools.d.ts.map +1 -1
- package/dist/mcp/builtin/collections/authTools.js +4 -3
- package/dist/mcp/builtin/collections/authTools.js.map +1 -1
- package/dist/mcp/builtin/collections/deleteTool.js +6 -2
- package/dist/mcp/builtin/collections/deleteTool.js.map +1 -1
- package/dist/mcp/builtin/collections/duplicateTool.d.ts.map +1 -1
- package/dist/mcp/builtin/collections/duplicateTool.js +6 -2
- package/dist/mcp/builtin/collections/duplicateTool.js.map +1 -1
- package/dist/mcp/builtin/collections/fileInput.d.ts.map +1 -1
- package/dist/mcp/builtin/collections/fileInput.js +19 -54
- package/dist/mcp/builtin/collections/fileInput.js.map +1 -1
- package/dist/mcp/builtin/collections/findTool.js +7 -3
- package/dist/mcp/builtin/collections/findTool.js.map +1 -1
- package/dist/mcp/builtin/collections/getCollectionSchemaTool.d.ts.map +1 -1
- package/dist/mcp/builtin/collections/getCollectionSchemaTool.js +19 -3
- package/dist/mcp/builtin/collections/getCollectionSchemaTool.js.map +1 -1
- package/dist/mcp/builtin/collections/updateTool.d.ts.map +1 -1
- package/dist/mcp/builtin/collections/updateTool.js +6 -2
- package/dist/mcp/builtin/collections/updateTool.js.map +1 -1
- package/dist/mcp/builtin/globals/getGlobalSchemaTool.d.ts.map +1 -1
- package/dist/mcp/builtin/globals/getGlobalSchemaTool.js +19 -3
- package/dist/mcp/builtin/globals/getGlobalSchemaTool.js.map +1 -1
- package/dist/stdio.js +4 -3
- package/dist/stdio.js.map +1 -1
- package/dist/types.d.ts +10 -3
- package/dist/types.d.ts.map +1 -1
- package/dist/types.js.map +1 -1
- package/package.json +6 -6
- package/src/endpoint/index.ts +33 -3
- package/src/mcp/buildMcpServer.ts +3 -3
- package/src/mcp/builtin/collections/authTools.ts +5 -2
- package/src/mcp/builtin/collections/deleteTool.ts +2 -2
- package/src/mcp/builtin/collections/duplicateTool.ts +2 -1
- package/src/mcp/builtin/collections/fileInput.ts +17 -59
- package/src/mcp/builtin/collections/findTool.ts +3 -3
- package/src/mcp/builtin/collections/getCollectionSchemaTool.ts +12 -1
- package/src/mcp/builtin/collections/updateTool.ts +2 -1
- package/src/mcp/builtin/globals/getGlobalSchemaTool.ts +11 -1
- package/src/stdio.ts +2 -2
- package/src/types.ts +11 -3
- package/dist/mcp/builtin/collections/fileInput.spec.js +0 -86
- package/dist/mcp/builtin/collections/fileInput.spec.js.map +0 -1
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@payloadcms/plugin-mcp",
|
|
3
|
-
"version": "4.0.0-internal.
|
|
3
|
+
"version": "4.0.0-internal.5e065b3",
|
|
4
4
|
"description": "MCP (Model Context Protocol) capabilities with Payload",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"plugin",
|
|
@@ -55,15 +55,15 @@
|
|
|
55
55
|
"bin.js"
|
|
56
56
|
],
|
|
57
57
|
"dependencies": {
|
|
58
|
-
"@modelcontextprotocol/server": "2.
|
|
59
|
-
"tsx": "4.
|
|
58
|
+
"@modelcontextprotocol/server": "2.3.1",
|
|
59
|
+
"tsx": "4.23.15"
|
|
60
60
|
},
|
|
61
61
|
"devDependencies": {
|
|
62
62
|
"@payloadcms/eslint-config": "3.28.0",
|
|
63
|
-
"payload": "4.0.0-internal.
|
|
63
|
+
"payload": "4.0.0-internal.5e065b3"
|
|
64
64
|
},
|
|
65
65
|
"peerDependencies": {
|
|
66
|
-
"payload": "4.0.0-internal.
|
|
66
|
+
"payload": "4.0.0-internal.5e065b3"
|
|
67
67
|
},
|
|
68
68
|
"//deps_notes": {
|
|
69
69
|
"tsx": "Required by the `bin.js` stdio mcp. Keep the version pinned to whatever `payload` ships to avoid duplicate installs."
|
|
@@ -75,7 +75,7 @@
|
|
|
75
75
|
"build:swc": "swc ./src -d ./dist --config-file .swcrc --strip-leading-paths",
|
|
76
76
|
"build:types": "tsc --emitDeclarationOnly --outDir dist",
|
|
77
77
|
"clean": "rimraf {dist,*.tsbuildinfo}",
|
|
78
|
-
"copyfiles": "copyfiles -u 1 \"src/**/*.{html,css,scss,ttf,woff,woff2,eot,svg,jpg,png,json}\" dist/",
|
|
78
|
+
"copyfiles": "copyfiles -u 1 -e \"**/*.spec.*\" \"src/**/*.{html,css,scss,ttf,woff,woff2,eot,svg,jpg,png,json}\" dist/",
|
|
79
79
|
"lint": "eslint .",
|
|
80
80
|
"lint:fix": "eslint . --fix",
|
|
81
81
|
"pack:plugin": "pnpm build && pnpm pack"
|
package/src/endpoint/index.ts
CHANGED
|
@@ -3,6 +3,7 @@ import type { PayloadHandler, PayloadRequest } from 'payload'
|
|
|
3
3
|
import {
|
|
4
4
|
createMcpHandler,
|
|
5
5
|
isLegacyRequest,
|
|
6
|
+
readRequestBody,
|
|
6
7
|
WebStandardStreamableHTTPServerTransport,
|
|
7
8
|
} from '@modelcontextprotocol/server'
|
|
8
9
|
import { APIError } from 'payload'
|
|
@@ -33,14 +34,17 @@ export const mcpEndpoint: PayloadHandler = async (req) => {
|
|
|
33
34
|
}
|
|
34
35
|
|
|
35
36
|
const authorizedMCP = await getAuthorizedMCP({ overrideAccess, req })
|
|
37
|
+
const maxRequestBodySize = pluginConfig.mcp?.maxRequestBodySize
|
|
36
38
|
// Payload augments the original web-standard Request in place.
|
|
37
39
|
const mcpRequest = req as PayloadRequest & Request
|
|
40
|
+
const parsedBody = await parseRequestBody({ maxRequestBodySize, request: mcpRequest })
|
|
38
41
|
|
|
39
42
|
// Keep the old JSON-only, stateless behavior because the SDK's 2025 fallback uses SSE.
|
|
40
|
-
if (await isLegacyRequest(mcpRequest)) {
|
|
43
|
+
if (await isLegacyRequest(mcpRequest, parsedBody, { maxRequestBodySize })) {
|
|
41
44
|
const server = buildMcpServer({ authorizedMCP, pluginConfig, req })
|
|
42
45
|
const transport = new WebStandardStreamableHTTPServerTransport({
|
|
43
46
|
enableJsonResponse: true,
|
|
47
|
+
maxRequestBodySize,
|
|
44
48
|
sessionIdGenerator: undefined, // stateless mode
|
|
45
49
|
})
|
|
46
50
|
transport.onerror = (err) => {
|
|
@@ -49,7 +53,7 @@ export const mcpEndpoint: PayloadHandler = async (req) => {
|
|
|
49
53
|
|
|
50
54
|
try {
|
|
51
55
|
await server.connect(transport)
|
|
52
|
-
return await transport.handleRequest(mcpRequest)
|
|
56
|
+
return await transport.handleRequest(mcpRequest, { parsedBody })
|
|
53
57
|
} finally {
|
|
54
58
|
await server.close().catch((err) => {
|
|
55
59
|
req.payload.logger.error({ err, msg: 'Error closing MCP server' })
|
|
@@ -59,6 +63,7 @@ export const mcpEndpoint: PayloadHandler = async (req) => {
|
|
|
59
63
|
|
|
60
64
|
const handler = createMcpHandler(() => buildMcpServer({ authorizedMCP, pluginConfig, req }), {
|
|
61
65
|
legacy: 'reject',
|
|
66
|
+
maxRequestBodySize,
|
|
62
67
|
// SDK subscriptions always use SSE, so disable them to keep every response JSON-only.
|
|
63
68
|
maxSubscriptions: 0,
|
|
64
69
|
onerror: (err) => {
|
|
@@ -68,10 +73,35 @@ export const mcpEndpoint: PayloadHandler = async (req) => {
|
|
|
68
73
|
})
|
|
69
74
|
|
|
70
75
|
try {
|
|
71
|
-
return await handler.fetch(mcpRequest)
|
|
76
|
+
return await handler.fetch(mcpRequest, { parsedBody })
|
|
72
77
|
} finally {
|
|
73
78
|
await handler.close().catch((err) => {
|
|
74
79
|
req.payload.logger.error({ err, msg: 'Error closing modern MCP handler' })
|
|
75
80
|
})
|
|
76
81
|
}
|
|
77
82
|
}
|
|
83
|
+
|
|
84
|
+
/**
|
|
85
|
+
* Parses a POST body once so the era check and the SDK handler can share it. The SDK
|
|
86
|
+
* skips its size limit for a pre-parsed body, so this reads with the same limit. It reads
|
|
87
|
+
* a clone and returns `undefined` for any body the SDK should reject (too large, unreadable,
|
|
88
|
+
* or not JSON), leaving the original request for the SDK to read and answer.
|
|
89
|
+
*/
|
|
90
|
+
const parseRequestBody = async ({
|
|
91
|
+
maxRequestBodySize,
|
|
92
|
+
request,
|
|
93
|
+
}: {
|
|
94
|
+
maxRequestBodySize?: number
|
|
95
|
+
request: Request
|
|
96
|
+
}): Promise<unknown> => {
|
|
97
|
+
if (request.method.toUpperCase() !== 'POST') {
|
|
98
|
+
return undefined
|
|
99
|
+
}
|
|
100
|
+
|
|
101
|
+
try {
|
|
102
|
+
const body = await readRequestBody(request.clone(), maxRequestBodySize)
|
|
103
|
+
return body.tooLarge ? undefined : JSON.parse(body.text)
|
|
104
|
+
} catch {
|
|
105
|
+
return undefined
|
|
106
|
+
}
|
|
107
|
+
}
|
|
@@ -17,8 +17,6 @@ import type {
|
|
|
17
17
|
import { getLogger } from '../utils/getLogger.js'
|
|
18
18
|
import { toStandardSchema } from '../utils/toStandardSchema.js'
|
|
19
19
|
|
|
20
|
-
z.config(z.locales.en())
|
|
21
|
-
|
|
22
20
|
/**
|
|
23
21
|
* Serving-entry-agnostic core: registers every authorized MCP item onto a fresh
|
|
24
22
|
* `McpServer` and returns it. The HTTP and stdio entry point callers provide fresh
|
|
@@ -27,7 +25,7 @@ z.config(z.locales.en())
|
|
|
27
25
|
*
|
|
28
26
|
* `req` is the request context handlers see. For HTTP it's the live
|
|
29
27
|
* `PayloadRequest` derived from the incoming HTTP request; for stdio it's a
|
|
30
|
-
* synthesized one built via `
|
|
28
|
+
* synthesized one built via `createPayloadRequest`.
|
|
31
29
|
*/
|
|
32
30
|
export const buildMcpServer = ({
|
|
33
31
|
authorizedMCP,
|
|
@@ -38,6 +36,8 @@ export const buildMcpServer = ({
|
|
|
38
36
|
pluginConfig: SanitizedMCPPluginConfig
|
|
39
37
|
req: PayloadRequest
|
|
40
38
|
}): McpServer => {
|
|
39
|
+
z.config(z.locales.en())
|
|
40
|
+
|
|
41
41
|
const serverOptions = pluginConfig.mcp?.serverOptions || {}
|
|
42
42
|
const server = new McpServer(
|
|
43
43
|
{ name: 'Payload MCP Server', version: '1.0.0', ...serverOptions.serverInfo },
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import {
|
|
1
|
+
import { createPayloadRequest, strictObject, z } from 'payload'
|
|
2
2
|
|
|
3
3
|
import type { MCPToolResponse } from '../../../types.js'
|
|
4
4
|
|
|
@@ -53,7 +53,10 @@ export const authCollectionTool = defineCollectionTool({
|
|
|
53
53
|
if (input.headers) {
|
|
54
54
|
authHeaders = new Headers(input.headers)
|
|
55
55
|
}
|
|
56
|
-
const authReq = await
|
|
56
|
+
const authReq = await createPayloadRequest({
|
|
57
|
+
payload: req.payload,
|
|
58
|
+
req: { headers: authHeaders },
|
|
59
|
+
})
|
|
57
60
|
const result = await req.payload.auth({ headers: authHeaders, req: authReq })
|
|
58
61
|
|
|
59
62
|
if (result.user) {
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import { deleteDocumentsInputSchema } from 'payload'
|
|
1
|
+
import { deleteDocumentsInputSchema, parseDocumentID } from 'payload'
|
|
2
2
|
|
|
3
3
|
import { defaultAccess } from '../../../defaultAccess.js'
|
|
4
4
|
import { defineCollectionTool } from '../../../defineTool.js'
|
|
@@ -32,7 +32,7 @@ export const deleteDocumentsTool = defineCollectionTool({
|
|
|
32
32
|
try {
|
|
33
33
|
if (id !== undefined) {
|
|
34
34
|
const result = await payload.delete({
|
|
35
|
-
id,
|
|
35
|
+
id: parseDocumentID({ id, collectionSlug: slug, payload }),
|
|
36
36
|
collection: slug,
|
|
37
37
|
depth,
|
|
38
38
|
overrideAccess: authorizedMCP.overrideAccess,
|
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
import {
|
|
2
2
|
duplicateDocumentInputSchema,
|
|
3
3
|
getCollectionVirtualFieldNames,
|
|
4
|
+
parseDocumentID,
|
|
4
5
|
stripVirtualFields,
|
|
5
6
|
transformPointDataToPayload,
|
|
6
7
|
validateCollectionData,
|
|
@@ -50,7 +51,7 @@ export const duplicateDocumentTool = defineCollectionTool({
|
|
|
50
51
|
const parsedData = inputData ? transformPointDataToPayload(inputData) : undefined
|
|
51
52
|
|
|
52
53
|
const result = await payload.duplicate({
|
|
53
|
-
id,
|
|
54
|
+
id: parseDocumentID({ id, collectionSlug: slug, payload }),
|
|
54
55
|
collection: slug,
|
|
55
56
|
depth,
|
|
56
57
|
draft,
|
|
@@ -1,7 +1,11 @@
|
|
|
1
|
-
import type { CollectionSlug, File,
|
|
1
|
+
import type { CollectionSlug, File, PayloadRequest } from 'payload'
|
|
2
2
|
|
|
3
3
|
import { APIError, z } from 'payload'
|
|
4
|
-
import {
|
|
4
|
+
import {
|
|
5
|
+
externalURLInputSchema,
|
|
6
|
+
getFileFromUploadInstructions,
|
|
7
|
+
resolveURLUploadInput,
|
|
8
|
+
} from 'payload/internal'
|
|
5
9
|
import { sanitizeFilename } from 'payload/shared'
|
|
6
10
|
|
|
7
11
|
const mimeTypeSchema = z
|
|
@@ -30,11 +34,7 @@ export const fileInputSchema = z
|
|
|
30
34
|
mimeType: mimeTypeSchema.check(z.describe('The file MIME type, for example image/png.')),
|
|
31
35
|
source: z.literal('base64'),
|
|
32
36
|
}),
|
|
33
|
-
|
|
34
|
-
name: z.optional(z.string().check(z.minLength(1))).check(z.describe('File name override.')),
|
|
35
|
-
source: z.literal('externalURL'),
|
|
36
|
-
url: z.url().check(z.describe('The http or https URL to download.')),
|
|
37
|
-
}),
|
|
37
|
+
externalURLInputSchema,
|
|
38
38
|
z.strictObject({
|
|
39
39
|
file: uploadFileSchema.check(z.describe('getUploadInstructions file field post-upload.')),
|
|
40
40
|
source: z.literal('uploadReference'),
|
|
@@ -75,6 +75,10 @@ export async function resolveFile({
|
|
|
75
75
|
}
|
|
76
76
|
}
|
|
77
77
|
|
|
78
|
+
if (input.source === 'externalURL') {
|
|
79
|
+
return resolveURLUploadInput({ slug, input, req })
|
|
80
|
+
}
|
|
81
|
+
|
|
78
82
|
const uploadConfig = req.payload.collections[slug]?.config.upload
|
|
79
83
|
|
|
80
84
|
if (!uploadConfig) {
|
|
@@ -82,48 +86,12 @@ export async function resolveFile({
|
|
|
82
86
|
}
|
|
83
87
|
|
|
84
88
|
const maxFileSize = req.payload.config.upload.limits?.fileSize
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
name: sanitizeFilename(input.name),
|
|
92
|
-
data,
|
|
93
|
-
mimetype: input.mimeType,
|
|
94
|
-
size: data.length,
|
|
95
|
-
}
|
|
96
|
-
} else {
|
|
97
|
-
if (uploadConfig.pasteURL === false) {
|
|
98
|
-
throw new APIError(`Uploading files from URLs is disabled for collection "${slug}".`, 400)
|
|
99
|
-
}
|
|
100
|
-
|
|
101
|
-
const url = new URL(input.url)
|
|
102
|
-
|
|
103
|
-
if (!['http:', 'https:'].includes(url.protocol)) {
|
|
104
|
-
throw new APIError('File URLs must use http or https.', 400)
|
|
105
|
-
}
|
|
106
|
-
|
|
107
|
-
if (
|
|
108
|
-
typeof uploadConfig.pasteURL === 'object' &&
|
|
109
|
-
!isURLAllowed(input.url, uploadConfig.pasteURL.allowList)
|
|
110
|
-
) {
|
|
111
|
-
throw new APIError('The provided file URL is not allowed.', 400)
|
|
112
|
-
}
|
|
113
|
-
|
|
114
|
-
file = await getExternalFile({
|
|
115
|
-
data: {
|
|
116
|
-
filename: sanitizeFilename(input.name || getURLFilename(url)),
|
|
117
|
-
url: input.url,
|
|
118
|
-
} as FileData,
|
|
119
|
-
req,
|
|
120
|
-
uploadConfig: {
|
|
121
|
-
...uploadConfig,
|
|
122
|
-
externalFileHeaderFilter: uploadConfig.externalFileHeaderFilter ?? (() => ({})),
|
|
123
|
-
},
|
|
124
|
-
})
|
|
125
|
-
file.mimetype = file.mimetype?.split(';')[0] || 'application/octet-stream'
|
|
126
|
-
file.size = file.data.length
|
|
89
|
+
const data = decodeBase64({ maxFileSize, value: input.data })
|
|
90
|
+
const file: File = {
|
|
91
|
+
name: sanitizeFilename(input.name),
|
|
92
|
+
data,
|
|
93
|
+
mimetype: input.mimeType,
|
|
94
|
+
size: data.length,
|
|
127
95
|
}
|
|
128
96
|
|
|
129
97
|
if (maxFileSize !== undefined && Number.isFinite(maxFileSize) && file.size > maxFileSize) {
|
|
@@ -157,13 +125,3 @@ function decodeBase64({ maxFileSize, value }: { maxFileSize?: number; value: str
|
|
|
157
125
|
|
|
158
126
|
return data
|
|
159
127
|
}
|
|
160
|
-
|
|
161
|
-
function getURLFilename(url: URL): string {
|
|
162
|
-
const pathSegment = url.pathname.split('/').pop() || 'upload'
|
|
163
|
-
|
|
164
|
-
try {
|
|
165
|
-
return decodeURIComponent(pathSegment)
|
|
166
|
-
} catch {
|
|
167
|
-
return pathSegment
|
|
168
|
-
}
|
|
169
|
-
}
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import { findDocumentsInputSchema } from 'payload'
|
|
1
|
+
import { findDocumentsInputSchema, parseDocumentID } from 'payload'
|
|
2
2
|
|
|
3
3
|
import { defaultAccess } from '../../../defaultAccess.js'
|
|
4
4
|
import { defineCollectionTool } from '../../../defineTool.js'
|
|
@@ -45,10 +45,10 @@ export const findDocumentsTool = defineCollectionTool({
|
|
|
45
45
|
)
|
|
46
46
|
|
|
47
47
|
try {
|
|
48
|
-
if (id) {
|
|
48
|
+
if (id !== undefined) {
|
|
49
49
|
try {
|
|
50
50
|
const doc = await payload.findByID({
|
|
51
|
-
id,
|
|
51
|
+
id: parseDocumentID({ id, collectionSlug: slug, payload }),
|
|
52
52
|
collection: slug,
|
|
53
53
|
depth,
|
|
54
54
|
overrideAccess: authorizedMCP.overrideAccess,
|
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
import { getAccessResults, getCollectionInputSchema, getCollectionSchemaInputSchema } from 'payload'
|
|
2
|
+
import { getLLMInstructions } from 'payload/internal'
|
|
2
3
|
|
|
3
4
|
import { defaultAccess } from '../../../defaultAccess.js'
|
|
4
5
|
import { defineCollectionTool } from '../../../defineTool.js'
|
|
@@ -16,7 +17,8 @@ export const getCollectionSchemaTool = defineCollectionTool({
|
|
|
16
17
|
readOnlyHint: true,
|
|
17
18
|
title: 'Get Collection Schema',
|
|
18
19
|
},
|
|
19
|
-
description:
|
|
20
|
+
description:
|
|
21
|
+
'Get the input schema and LLM instructions before creating or updating documents in a collection.',
|
|
20
22
|
input: getCollectionSchemaInputSchema,
|
|
21
23
|
}).handler(async ({ slug, authorizedMCP, req }) => {
|
|
22
24
|
const permissions = authorizedMCP.overrideAccess
|
|
@@ -64,17 +66,26 @@ export const getCollectionSchemaTool = defineCollectionTool({
|
|
|
64
66
|
}
|
|
65
67
|
: { enabled: false }
|
|
66
68
|
|
|
69
|
+
const instructions = await getLLMInstructions({
|
|
70
|
+
slug,
|
|
71
|
+
type: 'collection',
|
|
72
|
+
overrideAccess: authorizedMCP.overrideAccess,
|
|
73
|
+
req,
|
|
74
|
+
})
|
|
75
|
+
|
|
67
76
|
return {
|
|
68
77
|
content: [
|
|
69
78
|
{
|
|
70
79
|
type: 'text',
|
|
71
80
|
text: `Schema for collection "${slug}":\n\`\`\`json\n${JSON.stringify(inputSchema)}\n\`\`\`\nUpload configuration:\n\`\`\`json\n${JSON.stringify(upload)}\n\`\`\``,
|
|
72
81
|
},
|
|
82
|
+
...(instructions ? [{ type: 'text' as const, text: instructions }] : []),
|
|
73
83
|
],
|
|
74
84
|
structuredContent: {
|
|
75
85
|
slug,
|
|
76
86
|
schema: inputSchema,
|
|
77
87
|
upload,
|
|
88
|
+
...(instructions ? { instructions } : {}),
|
|
78
89
|
},
|
|
79
90
|
}
|
|
80
91
|
})
|
|
@@ -3,6 +3,7 @@ import type { Where } from 'payload'
|
|
|
3
3
|
import {
|
|
4
4
|
getCollectionInputSchema,
|
|
5
5
|
getCollectionVirtualFieldNames,
|
|
6
|
+
parseDocumentID,
|
|
6
7
|
stripVirtualFields,
|
|
7
8
|
transformPointDataToPayload,
|
|
8
9
|
updateDocumentInputSchema,
|
|
@@ -75,7 +76,7 @@ export const updateDocumentTool = defineCollectionTool({
|
|
|
75
76
|
|
|
76
77
|
if (id !== undefined) {
|
|
77
78
|
const result = await payload.update({
|
|
78
|
-
id,
|
|
79
|
+
id: parseDocumentID({ id, collectionSlug: slug, payload }),
|
|
79
80
|
collection: slug,
|
|
80
81
|
data: parsedData,
|
|
81
82
|
depth,
|
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
import { getAccessResults, getGlobalInputSchema, getGlobalSchemaInputSchema } from 'payload'
|
|
2
|
+
import { getLLMInstructions } from 'payload/internal'
|
|
2
3
|
|
|
3
4
|
import { defaultAccess } from '../../../defaultAccess.js'
|
|
4
5
|
import { defineGlobalTool } from '../../../defineTool.js'
|
|
@@ -16,7 +17,7 @@ export const getGlobalSchemaTool = defineGlobalTool({
|
|
|
16
17
|
readOnlyHint: true,
|
|
17
18
|
title: 'Get Global Schema',
|
|
18
19
|
},
|
|
19
|
-
description: 'Get the input schema
|
|
20
|
+
description: 'Get the input schema and LLM instructions before updating a global.',
|
|
20
21
|
input: getGlobalSchemaInputSchema,
|
|
21
22
|
}).handler(async ({ slug, authorizedMCP, req }) => {
|
|
22
23
|
const permissions = authorizedMCP.overrideAccess
|
|
@@ -48,16 +49,25 @@ export const getGlobalSchemaTool = defineGlobalTool({
|
|
|
48
49
|
}
|
|
49
50
|
}
|
|
50
51
|
|
|
52
|
+
const instructions = await getLLMInstructions({
|
|
53
|
+
slug,
|
|
54
|
+
type: 'global',
|
|
55
|
+
overrideAccess: authorizedMCP.overrideAccess,
|
|
56
|
+
req,
|
|
57
|
+
})
|
|
58
|
+
|
|
51
59
|
return {
|
|
52
60
|
content: [
|
|
53
61
|
{
|
|
54
62
|
type: 'text',
|
|
55
63
|
text: `Schema for global "${slug}":\n\`\`\`json\n${JSON.stringify(inputSchema)}\n\`\`\``,
|
|
56
64
|
},
|
|
65
|
+
...(instructions ? [{ type: 'text' as const, text: instructions }] : []),
|
|
57
66
|
],
|
|
58
67
|
structuredContent: {
|
|
59
68
|
slug,
|
|
60
69
|
schema: inputSchema,
|
|
70
|
+
...(instructions ? { instructions } : {}),
|
|
61
71
|
},
|
|
62
72
|
}
|
|
63
73
|
})
|
package/src/stdio.ts
CHANGED
|
@@ -3,7 +3,7 @@ import type { Config, Plugin, SanitizedConfig } from 'payload'
|
|
|
3
3
|
/* eslint-disable no-console */
|
|
4
4
|
import { serveStdio } from '@modelcontextprotocol/server/stdio'
|
|
5
5
|
import { fileURLToPath, pathToFileURL } from 'node:url'
|
|
6
|
-
import {
|
|
6
|
+
import { createPayloadRequest, getPayload } from 'payload'
|
|
7
7
|
import { findConfig, loadEnv } from 'payload/node'
|
|
8
8
|
|
|
9
9
|
import type { SanitizedMCPPluginConfig } from './types.js'
|
|
@@ -91,7 +91,7 @@ export const runMcpStdio = async (): Promise<void> => {
|
|
|
91
91
|
headers.set('Authorization', process.env.PAYLOAD_MCP_AUTHORIZATION)
|
|
92
92
|
}
|
|
93
93
|
|
|
94
|
-
const req = await
|
|
94
|
+
const req = await createPayloadRequest({ payload, req: { headers } })
|
|
95
95
|
req.payloadAPI = 'MCP' as const
|
|
96
96
|
const authorizedMCP = await getAuthorizedMCP({ overrideAccess, req })
|
|
97
97
|
|
package/src/types.ts
CHANGED
|
@@ -1,8 +1,9 @@
|
|
|
1
1
|
import type {
|
|
2
2
|
CallToolResult,
|
|
3
3
|
ContentBlock,
|
|
4
|
+
Implementation,
|
|
4
5
|
JsonSchemaType,
|
|
5
|
-
|
|
6
|
+
McpServerOptions,
|
|
6
7
|
ResourceTemplate,
|
|
7
8
|
ServerContext,
|
|
8
9
|
StandardSchemaWithJSON,
|
|
@@ -279,6 +280,13 @@ export type MCPPluginConfig = {
|
|
|
279
280
|
afterToolCall?: MCPAfterToolCallHook[]
|
|
280
281
|
}
|
|
281
282
|
mcp?: {
|
|
283
|
+
/**
|
|
284
|
+
* Largest HTTP request body, in bytes, that the MCP endpoint accepts. Larger requests
|
|
285
|
+
* are answered with `413`. Base64 file uploads count toward this limit.
|
|
286
|
+
*
|
|
287
|
+
* @default 4194304 (4 MiB, the MCP SDK default)
|
|
288
|
+
*/
|
|
289
|
+
maxRequestBodySize?: number
|
|
282
290
|
serverOptions?: MCPServerOptions
|
|
283
291
|
verboseLogs?: boolean
|
|
284
292
|
}
|
|
@@ -304,8 +312,8 @@ export type SanitizedMCPPluginConfig = {
|
|
|
304
312
|
} & Pick<MCPPluginConfig, 'disabled' | 'hooks' | 'mcp' | 'overrideGetAuthorizedMCP'>
|
|
305
313
|
|
|
306
314
|
export type MCPServerOptions = {
|
|
307
|
-
options?:
|
|
308
|
-
serverInfo?: Partial<
|
|
315
|
+
options?: McpServerOptions
|
|
316
|
+
serverInfo?: Partial<Implementation>
|
|
309
317
|
}
|
|
310
318
|
|
|
311
319
|
/**
|
|
@@ -1,86 +0,0 @@
|
|
|
1
|
-
import { describe, expect, it } from 'vitest';
|
|
2
|
-
import { fileInputSchema, resolveFile } from './fileInput.js';
|
|
3
|
-
describe('MCP file input', ()=>{
|
|
4
|
-
it('should reject malformed MIME types', ()=>{
|
|
5
|
-
const result = fileInputSchema.safeParse({
|
|
6
|
-
data: 'aGVsbG8=',
|
|
7
|
-
mimeType: 'text/plain\r\nx-test: value',
|
|
8
|
-
name: 'hello.txt',
|
|
9
|
-
source: 'base64'
|
|
10
|
-
});
|
|
11
|
-
expect(result.success).toBe(false);
|
|
12
|
-
});
|
|
13
|
-
it('should accept a prepared upload', ()=>{
|
|
14
|
-
const result = fileInputSchema.safeParse({
|
|
15
|
-
file: {
|
|
16
|
-
filename: 'image.png',
|
|
17
|
-
mimeType: 'image/png',
|
|
18
|
-
size: 123,
|
|
19
|
-
uploadReference: {
|
|
20
|
-
uploadId: 'upload-id'
|
|
21
|
-
}
|
|
22
|
-
},
|
|
23
|
-
source: 'uploadReference'
|
|
24
|
-
});
|
|
25
|
-
expect(result.success).toBe(true);
|
|
26
|
-
});
|
|
27
|
-
it('should reject oversized base64 files', async ()=>{
|
|
28
|
-
const req = createRequest({
|
|
29
|
-
maxFileSize: 4
|
|
30
|
-
});
|
|
31
|
-
await expect(resolveFile({
|
|
32
|
-
slug: 'media',
|
|
33
|
-
input: {
|
|
34
|
-
data: Buffer.from('hello').toString('base64'),
|
|
35
|
-
mimeType: 'text/plain',
|
|
36
|
-
name: 'hello.txt',
|
|
37
|
-
source: 'base64'
|
|
38
|
-
},
|
|
39
|
-
req
|
|
40
|
-
})).rejects.toThrow('File exceeds the 4 byte upload limit.');
|
|
41
|
-
});
|
|
42
|
-
it('should reject URLs outside the collection allowlist', async ()=>{
|
|
43
|
-
const req = createRequest({
|
|
44
|
-
allowList: [
|
|
45
|
-
{
|
|
46
|
-
hostname: 'assets.example.com',
|
|
47
|
-
protocol: 'https'
|
|
48
|
-
}
|
|
49
|
-
]
|
|
50
|
-
});
|
|
51
|
-
await expect(resolveFile({
|
|
52
|
-
slug: 'media',
|
|
53
|
-
input: {
|
|
54
|
-
source: 'externalURL',
|
|
55
|
-
url: 'https://example.com/image.png'
|
|
56
|
-
},
|
|
57
|
-
req
|
|
58
|
-
})).rejects.toThrow('The provided file URL is not allowed.');
|
|
59
|
-
});
|
|
60
|
-
});
|
|
61
|
-
function createRequest({ allowList, maxFileSize }) {
|
|
62
|
-
return {
|
|
63
|
-
payload: {
|
|
64
|
-
collections: {
|
|
65
|
-
media: {
|
|
66
|
-
config: {
|
|
67
|
-
upload: allowList ? {
|
|
68
|
-
pasteURL: {
|
|
69
|
-
allowList
|
|
70
|
-
}
|
|
71
|
-
} : {}
|
|
72
|
-
}
|
|
73
|
-
}
|
|
74
|
-
},
|
|
75
|
-
config: {
|
|
76
|
-
upload: {
|
|
77
|
-
limits: {
|
|
78
|
-
fileSize: maxFileSize
|
|
79
|
-
}
|
|
80
|
-
}
|
|
81
|
-
}
|
|
82
|
-
}
|
|
83
|
-
};
|
|
84
|
-
}
|
|
85
|
-
|
|
86
|
-
//# sourceMappingURL=fileInput.spec.js.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"sources":["../../../../src/mcp/builtin/collections/fileInput.spec.ts"],"sourcesContent":["import type { PayloadRequest } from 'payload'\n\nimport { describe, expect, it } from 'vitest'\n\nimport { fileInputSchema, resolveFile } from './fileInput.js'\n\ndescribe('MCP file input', () => {\n it('should reject malformed MIME types', () => {\n const result = fileInputSchema.safeParse({\n data: 'aGVsbG8=',\n mimeType: 'text/plain\\r\\nx-test: value',\n name: 'hello.txt',\n source: 'base64',\n })\n\n expect(result.success).toBe(false)\n })\n\n it('should accept a prepared upload', () => {\n const result = fileInputSchema.safeParse({\n file: {\n filename: 'image.png',\n mimeType: 'image/png',\n size: 123,\n uploadReference: { uploadId: 'upload-id' },\n },\n source: 'uploadReference',\n })\n\n expect(result.success).toBe(true)\n })\n\n it('should reject oversized base64 files', async () => {\n const req = createRequest({ maxFileSize: 4 })\n\n await expect(\n resolveFile({\n slug: 'media',\n input: {\n data: Buffer.from('hello').toString('base64'),\n mimeType: 'text/plain',\n name: 'hello.txt',\n source: 'base64',\n },\n req,\n }),\n ).rejects.toThrow('File exceeds the 4 byte upload limit.')\n })\n\n it('should reject URLs outside the collection allowlist', async () => {\n const req = createRequest({\n allowList: [{ hostname: 'assets.example.com', protocol: 'https' }],\n })\n\n await expect(\n resolveFile({\n slug: 'media',\n input: {\n source: 'externalURL',\n url: 'https://example.com/image.png',\n },\n req,\n }),\n ).rejects.toThrow('The provided file URL is not allowed.')\n })\n})\n\nfunction createRequest({\n allowList,\n maxFileSize,\n}: {\n allowList?: Array<{ hostname: string; protocol: 'http' | 'https' }>\n maxFileSize?: number\n}): PayloadRequest {\n return {\n payload: {\n collections: {\n media: {\n config: {\n upload: allowList ? { pasteURL: { allowList } } : {},\n },\n },\n },\n config: {\n upload: {\n limits: {\n fileSize: maxFileSize,\n },\n },\n },\n },\n } as unknown as PayloadRequest\n}\n"],"names":["describe","expect","it","fileInputSchema","resolveFile","result","safeParse","data","mimeType","name","source","success","toBe","file","filename","size","uploadReference","uploadId","req","createRequest","maxFileSize","slug","input","Buffer","from","toString","rejects","toThrow","allowList","hostname","protocol","url","payload","collections","media","config","upload","pasteURL","limits","fileSize"],"mappings":"AAEA,SAASA,QAAQ,EAAEC,MAAM,EAAEC,EAAE,QAAQ,SAAQ;AAE7C,SAASC,eAAe,EAAEC,WAAW,QAAQ,iBAAgB;AAE7DJ,SAAS,kBAAkB;IACzBE,GAAG,sCAAsC;QACvC,MAAMG,SAASF,gBAAgBG,SAAS,CAAC;YACvCC,MAAM;YACNC,UAAU;YACVC,MAAM;YACNC,QAAQ;QACV;QAEAT,OAAOI,OAAOM,OAAO,EAAEC,IAAI,CAAC;IAC9B;IAEAV,GAAG,mCAAmC;QACpC,MAAMG,SAASF,gBAAgBG,SAAS,CAAC;YACvCO,MAAM;gBACJC,UAAU;gBACVN,UAAU;gBACVO,MAAM;gBACNC,iBAAiB;oBAAEC,UAAU;gBAAY;YAC3C;YACAP,QAAQ;QACV;QAEAT,OAAOI,OAAOM,OAAO,EAAEC,IAAI,CAAC;IAC9B;IAEAV,GAAG,wCAAwC;QACzC,MAAMgB,MAAMC,cAAc;YAAEC,aAAa;QAAE;QAE3C,MAAMnB,OACJG,YAAY;YACViB,MAAM;YACNC,OAAO;gBACLf,MAAMgB,OAAOC,IAAI,CAAC,SAASC,QAAQ,CAAC;gBACpCjB,UAAU;gBACVC,MAAM;gBACNC,QAAQ;YACV;YACAQ;QACF,IACAQ,OAAO,CAACC,OAAO,CAAC;IACpB;IAEAzB,GAAG,uDAAuD;QACxD,MAAMgB,MAAMC,cAAc;YACxBS,WAAW;gBAAC;oBAAEC,UAAU;oBAAsBC,UAAU;gBAAQ;aAAE;QACpE;QAEA,MAAM7B,OACJG,YAAY;YACViB,MAAM;YACNC,OAAO;gBACLZ,QAAQ;gBACRqB,KAAK;YACP;YACAb;QACF,IACAQ,OAAO,CAACC,OAAO,CAAC;IACpB;AACF;AAEA,SAASR,cAAc,EACrBS,SAAS,EACTR,WAAW,EAIZ;IACC,OAAO;QACLY,SAAS;YACPC,aAAa;gBACXC,OAAO;oBACLC,QAAQ;wBACNC,QAAQR,YAAY;4BAAES,UAAU;gCAAET;4BAAU;wBAAE,IAAI,CAAC;oBACrD;gBACF;YACF;YACAO,QAAQ;gBACNC,QAAQ;oBACNE,QAAQ;wBACNC,UAAUnB;oBACZ;gBACF;YACF;QACF;IACF;AACF"}
|