@payloadcms/plugin-mcp 4.0.0-internal.5b1e7cd → 4.0.0-internal.688c4d0

package/src/mcp/builtin/collections/authTools.ts

@@ -0,0 +1,233 @@
+import { z } from 'zod'
+
+import type { MCPToolResponse } from '../../../types.js'
+
+import { defineCollectionTool } from '../../../defineTool.js'
+import { getLogger } from '../../../utils/getLogger.js'
+
+/**
+ * Auth tools surfaced under `collections.<auth-collection>.tools`. Opt-in: they
+ * default off (an LLM with `login` access can probe passwords; not something
+ * to expose by default). Enable in plugin config via `tools: { login: true }`
+ * (or `{ description: '...' }`).
+ *
+ * `auth` (check current token) doesn't actually depend on the collection at
+ * runtime — `payload.auth({ headers })` is global — but it's grouped under the
+ * users collection so all auth-shaped tools live in one place.
+ */
+
+const emailSchema = z.string().email().describe('The user email address')
+
+const wrapError =
+  (name: string) =>
+  ({ collectionSlug, message }: { collectionSlug: string; message: string }): MCPToolResponse => {
+    return {
+      content: [
+        {
+          type: 'text',
+          text: `❌ **Error in ${name}** on ${collectionSlug}: ${message}`,
+        },
+      ],
+    }
+  }
+
+export const authCollectionTool = defineCollectionTool({
+  description: 'Checks authentication status for the current user.',
+  input: z.object({
+    headers: z
+      .string()
+      .describe(
+        'Optional JSON string containing custom headers to send with the authentication request',
+      )
+      .optional(),
+  }),
+}).handler(async ({ collectionSlug, input, req }) => {
+  const logger = getLogger({ payload: req.payload })
+  try {
+    let authHeaders = new Headers()
+    if (input.headers) {
+      try {
+        authHeaders = new Headers(JSON.parse(input.headers) as Record<string, string>)
+      } catch {
+        logger.warn(`Invalid headers JSON for auth: ${input.headers}, using empty headers`)
+      }
+    }
+    const result = await req.payload.auth({ headers: authHeaders })
+    return {
+      content: [
+        {
+          type: 'text',
+          text: `# Authentication Status\n\n\`\`\`json\n${JSON.stringify(result)}\n\`\`\``,
+        },
+      ],
+      doc: result as unknown as Record<string, unknown>,
+    }
+  } catch (error) {
+    const errorMessage = error instanceof Error ? error.message : 'Unknown error'
+    logger.error(`Error in auth tool on ${collectionSlug}: ${errorMessage}`)
+    return wrapError('auth')({ collectionSlug, message: errorMessage })
+  }
+})
+
+export const forgotPasswordCollectionTool = defineCollectionTool({
+  description: 'Sends a password reset email to a user.',
+  input: z.object({
+    disableEmail: z
+      .boolean()
+      .describe('Whether to disable sending the email (for testing)')
+      .optional()
+      .default(false),
+    email: emailSchema,
+  }),
+}).handler(async ({ collectionSlug, input, req }) => {
+  const logger = getLogger({ payload: req.payload })
+  try {
+    const result = await req.payload.forgotPassword({
+      collection: collectionSlug,
+      data: { email: input.email },
+      disableEmail: input.disableEmail,
+    })
+    return {
+      content: [
+        {
+          type: 'text',
+          text: `# Forgot Password Email Sent\n\n**Collection:** ${collectionSlug}\n**Email:** ${input.email}\n\n\`\`\`json\n${JSON.stringify(result)}\n\`\`\``,
+        },
+      ],
+      doc: { result } as Record<string, unknown>,
+    }
+  } catch (error) {
+    const errorMessage = error instanceof Error ? error.message : 'Unknown error'
+    logger.error(`Error in forgotPassword tool on ${collectionSlug}: ${errorMessage}`)
+    return wrapError('forgotPassword')({ collectionSlug, message: errorMessage })
+  }
+})
+
+export const loginCollectionTool = defineCollectionTool({
+  description: 'Authenticates a user with email and password.',
+  input: z.object({
+    depth: z
+      .number()
+      .int()
+      .min(0)
+      .max(10)
+      .describe('Depth of population for relationships')
+      .optional()
+      .default(0),
+    email: emailSchema,
+    password: z.string().describe('The user password'),
+    showHiddenFields: z
+      .boolean()
+      .describe('Whether to show hidden fields in the response')
+      .optional()
+      .default(false),
+  }),
+}).handler(async ({ collectionSlug, input, req }) => {
+  const logger = getLogger({ payload: req.payload })
+  try {
+    const result = await req.payload.login({
+      collection: collectionSlug,
+      data: { email: input.email, password: input.password },
+      depth: input.depth,
+      showHiddenFields: input.showHiddenFields,
+    })
+    return {
+      content: [
+        {
+          type: 'text',
+          text: `# Login Successful\n\n**User:** ${input.email}\n**Collection:** ${collectionSlug}\n\n\`\`\`json\n${JSON.stringify(result)}\n\`\`\``,
+        },
+      ],
+      doc: result as unknown as Record<string, unknown>,
+    }
+  } catch (error) {
+    const errorMessage = error instanceof Error ? error.message : 'Unknown error'
+    logger.error(`Error in login tool on ${collectionSlug}: ${errorMessage}`)
+    return wrapError('login')({ collectionSlug, message: errorMessage })
+  }
+})
+
+export const resetPasswordCollectionTool = defineCollectionTool({
+  description: 'Resets a user password with a reset token.',
+  input: z.object({
+    password: z.string().describe('The new password for the user'),
+    token: z.string().describe('The password reset token sent to the user email'),
+  }),
+}).handler(async ({ collectionSlug, input, req }) => {
+  const logger = getLogger({ payload: req.payload })
+  try {
+    const result = await req.payload.resetPassword({
+      collection: collectionSlug,
+      data: { password: input.password, token: input.token },
+      overrideAccess: true,
+    })
+    return {
+      content: [
+        {
+          type: 'text',
+          text: `# Password Reset Successful\n\n**Collection:** ${collectionSlug}\n\n\`\`\`json\n${JSON.stringify(result)}\n\`\`\``,
+        },
+      ],
+      doc: result as unknown as Record<string, unknown>,
+    }
+  } catch (error) {
+    const errorMessage = error instanceof Error ? error.message : 'Unknown error'
+    logger.error(`Error in resetPassword tool on ${collectionSlug}: ${errorMessage}`)
+    return wrapError('resetPassword')({ collectionSlug, message: errorMessage })
+  }
+})
+
+export const unlockCollectionTool = defineCollectionTool({
+  description: 'Unlocks a user account that has been locked due to failed login attempts.',
+  input: z.object({ email: emailSchema }),
+}).handler(async ({ collectionSlug, input, req }) => {
+  const logger = getLogger({ payload: req.payload })
+  try {
+    const result = await req.payload.unlock({
+      collection: collectionSlug,
+      data: { email: input.email },
+      overrideAccess: true,
+    })
+    return {
+      content: [
+        {
+          type: 'text',
+          text: `# Account Unlocked\n\n**Collection:** ${collectionSlug}\n**Email:** ${input.email}\n**Result:** ${result ? 'Success' : 'Failed'}`,
+        },
+      ],
+      doc: { result } as Record<string, unknown>,
+    }
+  } catch (error) {
+    const errorMessage = error instanceof Error ? error.message : 'Unknown error'
+    logger.error(`Error in unlock tool on ${collectionSlug}: ${errorMessage}`)
+    return wrapError('unlock')({ collectionSlug, message: errorMessage })
+  }
+})
+
+export const verifyCollectionTool = defineCollectionTool({
+  description: 'Verifies a user email with a verification token.',
+  input: z.object({
+    token: z.string().describe('The verification token sent to the user email'),
+  }),
+}).handler(async ({ collectionSlug, input, req }) => {
+  const logger = getLogger({ payload: req.payload })
+  try {
+    const result = await req.payload.verifyEmail({
+      collection: collectionSlug,
+      token: input.token,
+    })
+    return {
+      content: [
+        {
+          type: 'text',
+          text: `# Email Verification Successful\n\n**Collection:** ${collectionSlug}\n**Result:** ${result ? 'Success' : 'Failed'}`,
+        },
+      ],
+      doc: { result } as Record<string, unknown>,
+    }
+  } catch (error) {
+    const errorMessage = error instanceof Error ? error.message : 'Unknown error'
+    logger.error(`Error in verify tool on ${collectionSlug}: ${errorMessage}`)
+    return wrapError('verify')({ collectionSlug, message: errorMessage })
+  }
+})

package/src/mcp/builtin/collections/createTool.ts

@@ -0,0 +1,112 @@
+import type { SelectType } from 'payload'
+
+import { z } from 'zod'
+
+import { defineCollectionTool } from '../../../defineTool.js'
+import { getLogger } from '../../../utils/getLogger.js'
+import {
+  getCollectionVirtualFieldNames,
+  stripVirtualFields,
+} from '../../../utils/getVirtualFieldNames.js'
+import { localAPIDefaults } from '../../../utils/localAPIDefaults.js'
+import { transformPointDataToPayload } from '../../../utils/transformPointDataToPayload.js'
+import { validateCollectionData } from '../validateEntityData.js'
+import { formatCollectionError } from './formatCollectionError.js'
+
+const DEFAULT_DESCRIPTION =
+  'Create a document in any collection by passing the collection slug and data.'
+
+export const createDocumentTool = defineCollectionTool({
+  description: DEFAULT_DESCRIPTION,
+  input: z.object({
+    data: z.record(z.string(), z.unknown()).describe('The document fields to create'),
+    depth: z
+      .number()
+      .int()
+      .min(0)
+      .max(10)
+      .describe('How many levels deep to populate relationships in response')
+      .optional()
+      .default(0),
+    draft: z
+      .boolean()
+      .describe('Whether to create the document as a draft')
+      .optional()
+      .default(false),
+    fallbackLocale: z
+      .string()
+      .describe('Optional: fallback locale code to use when requested locale is not available')
+      .optional(),
+    locale: z
+      .string()
+      .describe(
+        'Optional: locale code to create the document in (e.g., "en", "es"). Defaults to the default locale',
+      )
+      .optional(),
+    select: z
+      .string()
+      .describe(
+        "Optional: define exactly which fields you'd like to return (JSON), e.g., '{\"title\": true}'",
+      )
+      .optional(),
+  }),
+}).handler(async ({ authorizedMCP, collectionSlug, input, req }) => {
+  const payload = req.payload
+  const logger = getLogger({ payload })
+
+  const { data, depth, draft, fallbackLocale, locale, select } = input
+
+  logger.info(
+    `Creating document in collection: ${collectionSlug}${locale ? ` with locale: ${locale}` : ''}`,
+  )
+
+  try {
+    const virtualFieldNames = getCollectionVirtualFieldNames(payload.config, collectionSlug)
+    const inputData = stripVirtualFields(data, virtualFieldNames)
+    const validationError = validateCollectionData({ collectionSlug, data: inputData, req })
+
+    if (validationError) {
+      return validationError
+    }
+
+    const parsedData = transformPointDataToPayload(inputData)
+
+    let selectClause: SelectType | undefined
+    if (select) {
+      try {
+        selectClause = JSON.parse(select) as SelectType
+      } catch {
+        logger.warn(`Invalid select clause JSON: ${select}`)
+        return { content: [{ type: 'text', text: 'Error: Invalid JSON in select clause' }] }
+      }
+    }
+
+    const result = await payload.create({
+      collection: collectionSlug,
+      data: parsedData,
+      depth,
+      draft,
+      req,
+      ...localAPIDefaults(authorizedMCP),
+      ...(locale ? { locale } : {}),
+      ...(fallbackLocale ? { fallbackLocale } : {}),
+      ...(selectClause ? { select: selectClause } : {}),
+    })
+
+    logger.info(`Successfully created document in ${collectionSlug} with ID: ${result.id}`)
+
+    return {
+      content: [
+        {
+          type: 'text',
+          text: `Document created successfully in collection "${collectionSlug}"!\nCreated document:\n\`\`\`json\n${JSON.stringify(result)}\n\`\`\``,
+        },
+      ],
+      doc: result as Record<string, unknown>,
+    }
+  } catch (error) {
+    const errorMessage = error instanceof Error ? error.message : 'Unknown error'
+    logger.error(`Error creating document in ${collectionSlug}: ${errorMessage}`)
+    return formatCollectionError({ action: 'creating', collectionSlug, error, req })
+  }
+})

package/src/mcp/builtin/collections/deleteTool.ts

@@ -0,0 +1,116 @@
+import { z } from 'zod'
+
+import { defineCollectionTool } from '../../../defineTool.js'
+import { getLogger } from '../../../utils/getLogger.js'
+import { localAPIDefaults } from '../../../utils/localAPIDefaults.js'
+import { whereSchema } from '../../../utils/whereSchema.js'
+
+const DEFAULT_DESCRIPTION =
+  'Delete documents in any collection by passing the collection slug and ID or where clause.'
+
+export const deleteDocumentsTool = defineCollectionTool({
+  description: DEFAULT_DESCRIPTION,
+  input: z.object({
+    id: z
+      .union([z.string(), z.number()])
+      .describe('Optional: specific document ID to delete')
+      .optional(),
+    depth: z
+      .number()
+      .int()
+      .min(0)
+      .max(10)
+      .describe('Depth of population for relationships in response')
+      .optional()
+      .default(0),
+    fallbackLocale: z
+      .string()
+      .describe('Optional: fallback locale code to use when requested locale is not available')
+      .optional(),
+    locale: z
+      .string()
+      .describe(
+        'Optional: locale code for the operation (e.g., "en", "es"). Defaults to the default locale',
+      )
+      .optional(),
+    where: whereSchema
+      .describe(
+        'Optional: where clause to delete multiple documents. Use field names with Payload operators, and/or arrays for grouping. Example: {"title":{"contains":"test"}}',
+      )
+      .optional(),
+  }),
+}).handler(async ({ authorizedMCP, collectionSlug, input, req }) => {
+  const payload = req.payload
+  const logger = getLogger({ payload })
+
+  const { id, depth, fallbackLocale, locale, where } = input
+
+  logger.info(
+    `Deleting document from collection: ${collectionSlug}${id ? ` with ID: ${id}` : ' with where clause'}${locale ? `, locale: ${locale}` : ''}`,
+  )
+
+  try {
+    if (!id && !where) {
+      return {
+        content: [{ type: 'text', text: 'Error: Either id or where clause must be provided' }],
+      }
+    }
+
+    const deleteOptions: Record<string, unknown> = {
+      collection: collectionSlug,
+      depth,
+      req,
+      ...localAPIDefaults(authorizedMCP),
+      ...(locale && { locale }),
+      ...(fallbackLocale && { fallbackLocale }),
+    }
+
+    if (id) {
+      deleteOptions.id = id
+    } else {
+      deleteOptions.where = where
+    }
+
+    const result = await payload.delete(deleteOptions as Parameters<typeof payload.delete>[0])
+
+    if (id) {
+      return {
+        content: [
+          {
+            type: 'text',
+            text: `Document deleted successfully from collection "${collectionSlug}"!\nDeleted document:\n\`\`\`json\n${JSON.stringify(result)}\n\`\`\``,
+          },
+        ],
+        doc: result as Record<string, unknown>,
+      }
+    }
+
+    const bulkResult = result as { docs?: unknown[]; errors?: unknown[] }
+    const docs = bulkResult.docs || []
+    const errors = bulkResult.errors || []
+
+    let responseText = `Document deleted successfully from collection "${collectionSlug}"!\nDeleted: ${docs.length} documents\nErrors: ${errors.length}\n---`
+    if (docs.length > 0) {
+      responseText += `\n\nDeleted documents:\n\`\`\`json\n${JSON.stringify(docs)}\n\`\`\``
+    }
+    if (errors.length > 0) {
+      responseText += `\n\nErrors:\n\`\`\`json\n${JSON.stringify(errors)}\n\`\`\``
+    }
+
+    return {
+      content: [{ type: 'text', text: responseText }],
+      doc: { docs, errors } as unknown as Record<string, unknown>,
+    }
+  } catch (error) {
+    const errorMessage = error instanceof Error ? error.message : 'Unknown error'
+    logger.error(`Error deleting document from ${collectionSlug}: ${errorMessage}`)
+    return {
+      content: [
+        {
+          type: 'text',
+          text: `Error deleting document from collection "${collectionSlug}": ${errorMessage}`,
+        },
+      ],
+    }
+  }
+})

package/src/mcp/builtin/collections/findTool.ts

@@ -0,0 +1,177 @@
+import type { SelectType } from 'payload'
+
+import { z } from 'zod'
+
+import { defineCollectionTool } from '../../../defineTool.js'
+import { getLogger } from '../../../utils/getLogger.js'
+import { localAPIDefaults } from '../../../utils/localAPIDefaults.js'
+import { whereSchema } from '../../../utils/whereSchema.js'
+
+const DEFAULT_DESCRIPTION =
+  'Find documents in any collection by passing the collection slug and optional ID or where clause.'
+
+export const findDocumentsTool = defineCollectionTool({
+  description: DEFAULT_DESCRIPTION,
+  input: z.object({
+    id: z
+      .union([z.string(), z.number()])
+      .describe(
+        'Optional: specific document ID to retrieve. If not provided, returns all documents',
+      )
+      .optional(),
+    depth: z
+      .number()
+      .int()
+      .min(0)
+      .max(10)
+      .describe('How many levels deep to populate relationships (default: 0)')
+      .optional()
+      .default(0),
+    draft: z
+      .boolean()
+      .describe(
+        'Optional: whether the document should be queried from the versions table/collection or not.',
+      )
+      .optional(),
+    fallbackLocale: z
+      .string()
+      .describe('Optional: fallback locale code to use when requested locale is not available')
+      .optional(),
+    limit: z
+      .number()
+      .int()
+      .min(1)
+      .max(100)
+      .describe('Maximum number of documents to return (default: 10, max: 100)')
+      .optional()
+      .default(10),
+    locale: z
+      .string()
+      .describe(
+        'Optional: locale code to retrieve data in (e.g., "en", "es"). Use "all" to retrieve all locales for localized fields',
+      )
+      .optional(),
+    page: z
+      .number()
+      .int()
+      .min(1)
+      .describe('Page number for pagination (default: 1)')
+      .optional()
+      .default(1),
+    select: z
+      .string()
+      .describe(
+        "Optional: define exactly which fields you'd like to return in the response (JSON), e.g., '{\"title\": true}'",
+      )
+      .optional(),
+    sort: z
+      .string()
+      .describe('Field to sort by (e.g., "createdAt", "-updatedAt" for descending)')
+      .optional(),
+    where: whereSchema
+      .describe(
+        'Optional: where clause for filtering. Use field names with Payload operators, and/or arrays for grouping. Example: {"title":{"contains":"test"}}',
+      )
+      .optional(),
+  }),
+}).handler(async ({ authorizedMCP, collectionSlug, input, req }) => {
+  const payload = req.payload
+  const logger = getLogger({ payload })
+
+  const { id, depth, draft, fallbackLocale, limit, locale, page, select, sort, where } = input
+
+  logger.info(
+    `Reading document from collection: ${collectionSlug}${id ? ` with ID: ${id}` : ''}, limit: ${limit}, page: ${page}${locale ? `, locale: ${locale}` : ''}`,
+  )
+
+  try {
+    let selectClause: SelectType | undefined
+    if (select) {
+      try {
+        selectClause = JSON.parse(select) as SelectType
+      } catch {
+        logger.warn(`Invalid select clause JSON: ${select}`)
+        return { content: [{ type: 'text', text: 'Error: Invalid JSON in select clause' }] }
+      }
+    }
+
+    if (id) {
+      try {
+        const doc = await payload.findByID({
+          id,
+          collection: collectionSlug,
+          depth,
+          req,
+          ...localAPIDefaults(authorizedMCP),
+          ...(selectClause && { select: selectClause }),
+          ...(locale && { locale }),
+          ...(fallbackLocale && { fallbackLocale }),
+          ...(draft !== undefined && { draft }),
+        })
+
+        return {
+          content: [
+            {
+              type: 'text',
+              text: `Document from collection "${collectionSlug}":\n${JSON.stringify(doc)}`,
+            },
+          ],
+          doc: doc as Record<string, unknown>,
+        }
+      } catch {
+        logger.warn(`Document not found with ID: ${id} in collection: ${collectionSlug}`)
+        return {
+          content: [
+            {
+              type: 'text',
+              text: `Error: Document with ID "${id}" not found in collection "${collectionSlug}"`,
+            },
+          ],
+        }
+      }
+    }
+
+    const findOptions: Parameters<typeof payload.find>[0] = {
+      collection: collectionSlug,
+      depth,
+      limit,
+      page,
+      req,
+      ...localAPIDefaults(authorizedMCP),
+      ...(selectClause && { select: selectClause }),
+      ...(locale && { locale }),
+      ...(fallbackLocale && { fallbackLocale }),
+      ...(draft !== undefined && { draft }),
+    }
+
+    if (sort) {
+      findOptions.sort = sort
+    }
+    if (where) {
+      findOptions.where = where
+    }
+
+    const result = await payload.find(findOptions)
+
+    let responseText = `Collection: "${collectionSlug}"\nTotal: ${result.totalDocs} documents\nPage: ${result.page} of ${result.totalPages}\n`
+    for (const doc of result.docs) {
+      responseText += `\n\`\`\`json\n${JSON.stringify(doc)}\n\`\`\``
+    }
+
+    return {
+      content: [{ type: 'text', text: responseText }],
+      doc: result as unknown as Record<string, unknown>,
+    }
+  } catch (error) {
+    const errorMessage = error instanceof Error ? error.message : 'Unknown error'
+    logger.error(`Error reading documents from collection ${collectionSlug}: ${errorMessage}`)
+    return {
+      content: [
+        {
+          type: 'text',
+          text: `❌ **Error reading documents from collection "${collectionSlug}":** ${errorMessage}`,
+        },
+      ],
+    }
+  }
+})