@payloadcms/plugin-mcp 4.0.0-internal.688c4d0 → 4.0.0-internal.bc5cf8c

package/dist/mcp/sanitizeMCPConfig.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/mcp/sanitizeMCPConfig.ts"],"sourcesContent":["import type {\n  CollectionConfig,\n  Config,\n  GlobalConfig,\n  SanitizedCollectionConfig,\n  SanitizedConfig,\n  SanitizedGlobalConfig,\n} from 'payload'\n\nimport type {\n  CollectionMCPItem,\n  CollectionTool,\n  GlobalMCPItem,\n  GlobalTool,\n  MCPItem,\n  MCPPluginConfig,\n  SanitizedMCPPluginConfig,\n} from '../types.js'\n\nimport {\n  COLLECTION_AUTH_BUILTIN_ENTRIES,\n  COLLECTION_AUTH_BUILTINS,\n  COLLECTION_BUILTIN_ENTRIES,\n  COLLECTION_BUILTINS,\n  GLOBAL_BUILTIN_ENTRIES,\n  GLOBAL_BUILTINS,\n  TOOL_BUILTIN_ENTRIES,\n  TOOL_BUILTINS,\n} from './builtinTools.js'\n\n/**\n * Converts the user-configured `MCPPluginConfig` into a `SanitizedMCPPluginConfig`:\n *  - Flattens `tools` / `prompts` / `resources` / per-collection / per-global\n *    tool maps into a single `items` array.\n *  - Applies built-in tools for collections and globals, respecting opt-out user overrides.\n *  - Applies the `userCollection` default\n *\n * Called once during plugin init. After that, `plugins['@payloadcms/plugin-mcp']\n * ?.options` holds the sanitized result\n */\nexport const sanitizeMCPConfig = ({\n  config,\n  pluginConfig,\n}: {\n  config: Config | SanitizedConfig\n  pluginConfig: MCPPluginConfig\n}): SanitizedMCPPluginConfig => {\n  const items: MCPItem[] = []\n\n  for (const collection of config.collections ?? []) {\n    items.push(...sanitizeCollectionConfig({ collection, pluginConfig }))\n  }\n\n  for (const global of config.globals ?? []) {\n    items.push(...sanitizeGlobalConfig({ global, pluginConfig }))\n  }\n\n  for (const [configKey, { label, mcpName, tool }] of TOOL_BUILTIN_ENTRIES) {\n    items.push({\n      type: 'tool',\n      configKey,\n      label,\n      mcpName,\n      tool,\n    })\n  }\n\n  for (const [configKey, tool] of Object.entries(pluginConfig.tools ?? {})) {\n    if (configKey in TOOL_BUILTINS) {\n      continue\n    }\n    items.push({\n      type: 'tool',\n      configKey,\n      label: configKey,\n      mcpName: configKey,\n      tool,\n    })\n  }\n\n  for (const [configKey, prompt] of Object.entries(pluginConfig.prompts ?? {})) {\n    items.push({\n      type: 'prompt',\n      configKey,\n      label: prompt.title ?? configKey,\n      mcpName: configKey,\n      prompt,\n    })\n  }\n\n  for (const [configKey, resource] of Object.entries(pluginConfig.resources ?? {})) {\n    items.push({\n      type: 'resource',\n      configKey,\n      label: resource.title ?? configKey,\n      mcpName: configKey,\n      resource,\n    })\n  }\n\n  // Mirror Payload's own admin.user detection (sanitize.ts) since plugins run first.\n  const firstCollectionWithAuth = config.collections!.find(({ auth }) => Boolean(auth))\n\n  return {\n    disabled: pluginConfig.disabled,\n    items,\n    mcp: pluginConfig.mcp,\n    overrideApiKeyCollection: pluginConfig.overrideApiKeyCollection,\n    overrideAuth: pluginConfig.overrideAuth,\n    userCollection:\n      pluginConfig.userCollection ?? config.admin?.user ?? firstCollectionWithAuth?.slug ?? 'users',\n  }\n}\n\nconst sanitizeCollectionConfig = ({\n  collection,\n  pluginConfig,\n}: {\n  collection: CollectionConfig | SanitizedCollectionConfig\n  pluginConfig: MCPPluginConfig\n}): CollectionMCPItem[] => {\n  if (collection.slug === 'payload-mcp-api-keys') {\n    return []\n  }\n  const slug = collection.slug\n  const collectionPluginConfig = pluginConfig.collections?.[slug]\n  const items: CollectionMCPItem[] = []\n\n  for (const [toolKey, { mcpName, tool }] of COLLECTION_BUILTIN_ENTRIES) {\n    const matchedConfigEntry = collectionPluginConfig?.tools?.[toolKey]\n    if (matchedConfigEntry === false) {\n      continue\n    }\n    const override = typeof matchedConfigEntry === 'object' ? matchedConfigEntry : undefined\n    items.push({\n      type: 'collectionTool',\n      collectionSlug: slug,\n      configKey: toolKey,\n      label: capitalize(toolKey),\n      mcpName,\n      tool: {\n        ...tool,\n        description: override?.description ?? tool.description,\n        overrideResponse:\n          override?.overrideResponse ??\n          collectionPluginConfig?.overrideResponse ??\n          tool.overrideResponse,\n      },\n    })\n  }\n\n  if (collection.auth) {\n    for (const [authToolKey, { label, mcpName, tool }] of COLLECTION_AUTH_BUILTIN_ENTRIES) {\n      const matchedConfigEntry = collectionPluginConfig?.tools?.[authToolKey]\n      if (!matchedConfigEntry) {\n        continue\n      }\n      // `true` means \"enable, no override\"; only the object form carries fields.\n      const override = typeof matchedConfigEntry === 'object' ? matchedConfigEntry : undefined\n      items.push({\n        type: 'collectionTool',\n        collectionSlug: slug,\n        configKey: authToolKey,\n        label,\n        mcpName,\n        tool: {\n          ...tool,\n          description: override?.description ?? tool.description,\n          overrideResponse:\n            override?.overrideResponse ??\n            collectionPluginConfig?.overrideResponse ??\n            tool.overrideResponse,\n        },\n      })\n    }\n  }\n\n  // Cast: builtin keys are filtered out below, so the remaining values are\n  // always custom tools (`CollectionTool`) or undefined\n  const customEntries = Object.entries(collectionPluginConfig?.tools ?? {}) as Array<\n    [string, CollectionTool | undefined]\n  >\n  for (const [configKey, customTool] of customEntries) {\n    if (configKey in COLLECTION_BUILTINS || configKey in COLLECTION_AUTH_BUILTINS) {\n      continue\n    }\n    if (!customTool) {\n      continue\n    }\n    items.push({\n      type: 'collectionTool',\n      collectionSlug: slug,\n      configKey,\n      label: configKey,\n      mcpName: configKey,\n      tool: customTool,\n    })\n  }\n\n  return items\n}\n\nconst sanitizeGlobalConfig = ({\n  global,\n  pluginConfig,\n}: {\n  global: GlobalConfig | SanitizedGlobalConfig\n  pluginConfig: MCPPluginConfig\n}): GlobalMCPItem[] => {\n  const slug = global.slug\n  const globalPluginConfig = pluginConfig.globals?.[slug]\n  const items: GlobalMCPItem[] = []\n\n  for (const [toolKey, { mcpName, tool }] of GLOBAL_BUILTIN_ENTRIES) {\n    const matchedConfigEntry = globalPluginConfig?.tools?.[toolKey]\n    if (matchedConfigEntry === false) {\n      continue\n    }\n    const override = typeof matchedConfigEntry === 'object' ? matchedConfigEntry : undefined\n    items.push({\n      type: 'globalTool',\n      configKey: toolKey,\n      globalSlug: slug,\n      label: capitalize(toolKey),\n      mcpName,\n      tool: {\n        ...tool,\n        description: override?.description ?? tool.description,\n        overrideResponse:\n          override?.overrideResponse ??\n          globalPluginConfig?.overrideResponse ??\n          tool.overrideResponse,\n      },\n    })\n  }\n\n  const customEntries = Object.entries(globalPluginConfig?.tools ?? {}) as Array<\n    [string, GlobalTool | undefined]\n  >\n  for (const [configKey, customTool] of customEntries) {\n    if (configKey in GLOBAL_BUILTINS) {\n      continue\n    }\n    if (!customTool) {\n      continue\n    }\n    items.push({\n      type: 'globalTool',\n      configKey,\n      globalSlug: slug,\n      label: configKey,\n      mcpName: configKey,\n      tool: customTool,\n    })\n  }\n\n  return items\n}\n\nconst capitalize = (s: string): string => s.charAt(0).toUpperCase() + s.slice(1)\n"],"names":["COLLECTION_AUTH_BUILTIN_ENTRIES","COLLECTION_AUTH_BUILTINS","COLLECTION_BUILTIN_ENTRIES","COLLECTION_BUILTINS","GLOBAL_BUILTIN_ENTRIES","GLOBAL_BUILTINS","TOOL_BUILTIN_ENTRIES","TOOL_BUILTINS","sanitizeMCPConfig","config","pluginConfig","items","collection","collections","push","sanitizeCollectionConfig","global","globals","sanitizeGlobalConfig","configKey","label","mcpName","tool","type","Object","entries","tools","prompt","prompts","title","resource","resources","firstCollectionWithAuth","find","auth","Boolean","disabled","mcp","overrideApiKeyCollection","overrideAuth","userCollection","admin","user","slug","collectionPluginConfig","toolKey","matchedConfigEntry","override","undefined","collectionSlug","capitalize","description","overrideResponse","authToolKey","customEntries","customTool","globalPluginConfig","globalSlug","s","charAt","toUpperCase","slice"],"mappings":"AAmBA,SACEA,+BAA+B,EAC/BC,wBAAwB,EACxBC,0BAA0B,EAC1BC,mBAAmB,EACnBC,sBAAsB,EACtBC,eAAe,EACfC,oBAAoB,EACpBC,aAAa,QACR,oBAAmB;AAE1B;;;;;;;;;CASC,GACD,OAAO,MAAMC,oBAAoB,CAAC,EAChCC,MAAM,EACNC,YAAY,EAIb;IACC,MAAMC,QAAmB,EAAE;IAE3B,KAAK,MAAMC,cAAcH,OAAOI,WAAW,IAAI,EAAE,CAAE;QACjDF,MAAMG,IAAI,IAAIC,yBAAyB;YAAEH;YAAYF;QAAa;IACpE;IAEA,KAAK,MAAMM,UAAUP,OAAOQ,OAAO,IAAI,EAAE,CAAE;QACzCN,MAAMG,IAAI,IAAII,qBAAqB;YAAEF;YAAQN;QAAa;IAC5D;IAEA,KAAK,MAAM,CAACS,WAAW,EAAEC,KAAK,EAAEC,OAAO,EAAEC,IAAI,EAAE,CAAC,IAAIhB,qBAAsB;QACxEK,MAAMG,IAAI,CAAC;YACTS,MAAM;YACNJ;YACAC;YACAC;YACAC;QACF;IACF;IAEA,KAAK,MAAM,CAACH,WAAWG,KAAK,IAAIE,OAAOC,OAAO,CAACf,aAAagB,KAAK,IAAI,CAAC,GAAI;QACxE,IAAIP,aAAaZ,eAAe;YAC9B;QACF;QACAI,MAAMG,IAAI,CAAC;YACTS,MAAM;YACNJ;YACAC,OAAOD;YACPE,SAASF;YACTG;QACF;IACF;IAEA,KAAK,MAAM,CAACH,WAAWQ,OAAO,IAAIH,OAAOC,OAAO,CAACf,aAAakB,OAAO,IAAI,CAAC,GAAI;QAC5EjB,MAAMG,IAAI,CAAC;YACTS,MAAM;YACNJ;YACAC,OAAOO,OAAOE,KAAK,IAAIV;YACvBE,SAASF;YACTQ;QACF;IACF;IAEA,KAAK,MAAM,CAACR,WAAWW,SAAS,IAAIN,OAAOC,OAAO,CAACf,aAAaqB,SAAS,IAAI,CAAC,GAAI;QAChFpB,MAAMG,IAAI,CAAC;YACTS,MAAM;YACNJ;YACAC,OAAOU,SAASD,KAAK,IAAIV;YACzBE,SAASF;YACTW;QACF;IACF;IAEA,mFAAmF;IACnF,MAAME,0BAA0BvB,OAAOI,WAAW,CAAEoB,IAAI,CAAC,CAAC,EAAEC,IAAI,EAAE,GAAKC,QAAQD;IAE/E,OAAO;QACLE,UAAU1B,aAAa0B,QAAQ;QAC/BzB;QACA0B,KAAK3B,aAAa2B,GAAG;QACrBC,0BAA0B5B,aAAa4B,wBAAwB;QAC/DC,cAAc7B,aAAa6B,YAAY;QACvCC,gBACE9B,aAAa8B,cAAc,IAAI/B,OAAOgC,KAAK,EAAEC,QAAQV,yBAAyBW,QAAQ;IAC1F;AACF,EAAC;AAED,MAAM5B,2BAA2B,CAAC,EAChCH,UAAU,EACVF,YAAY,EAIb;IACC,IAAIE,WAAW+B,IAAI,KAAK,wBAAwB;QAC9C,OAAO,EAAE;IACX;IACA,MAAMA,OAAO/B,WAAW+B,IAAI;IAC5B,MAAMC,yBAAyBlC,aAAaG,WAAW,EAAE,CAAC8B,KAAK;IAC/D,MAAMhC,QAA6B,EAAE;IAErC,KAAK,MAAM,CAACkC,SAAS,EAAExB,OAAO,EAAEC,IAAI,EAAE,CAAC,IAAIpB,2BAA4B;QACrE,MAAM4C,qBAAqBF,wBAAwBlB,OAAO,CAACmB,QAAQ;QACnE,IAAIC,uBAAuB,OAAO;YAChC;QACF;QACA,MAAMC,WAAW,OAAOD,uBAAuB,WAAWA,qBAAqBE;QAC/ErC,MAAMG,IAAI,CAAC;YACTS,MAAM;YACN0B,gBAAgBN;YAChBxB,WAAW0B;YACXzB,OAAO8B,WAAWL;YAClBxB;YACAC,MAAM;gBACJ,GAAGA,IAAI;gBACP6B,aAAaJ,UAAUI,eAAe7B,KAAK6B,WAAW;gBACtDC,kBACEL,UAAUK,oBACVR,wBAAwBQ,oBACxB9B,KAAK8B,gBAAgB;YACzB;QACF;IACF;IAEA,IAAIxC,WAAWsB,IAAI,EAAE;QACnB,KAAK,MAAM,CAACmB,aAAa,EAAEjC,KAAK,EAAEC,OAAO,EAAEC,IAAI,EAAE,CAAC,IAAItB,gCAAiC;YACrF,MAAM8C,qBAAqBF,wBAAwBlB,OAAO,CAAC2B,YAAY;YACvE,IAAI,CAACP,oBAAoB;gBACvB;YACF;YACA,2EAA2E;YAC3E,MAAMC,WAAW,OAAOD,uBAAuB,WAAWA,qBAAqBE;YAC/ErC,MAAMG,IAAI,CAAC;gBACTS,MAAM;gBACN0B,gBAAgBN;gBAChBxB,WAAWkC;gBACXjC;gBACAC;gBACAC,MAAM;oBACJ,GAAGA,IAAI;oBACP6B,aAAaJ,UAAUI,eAAe7B,KAAK6B,WAAW;oBACtDC,kBACEL,UAAUK,oBACVR,wBAAwBQ,oBACxB9B,KAAK8B,gBAAgB;gBACzB;YACF;QACF;IACF;IAEA,yEAAyE;IACzE,sDAAsD;IACtD,MAAME,gBAAgB9B,OAAOC,OAAO,CAACmB,wBAAwBlB,SAAS,CAAC;IAGvE,KAAK,MAAM,CAACP,WAAWoC,WAAW,IAAID,cAAe;QACnD,IAAInC,aAAahB,uBAAuBgB,aAAalB,0BAA0B;YAC7E;QACF;QACA,IAAI,CAACsD,YAAY;YACf;QACF;QACA5C,MAAMG,IAAI,CAAC;YACTS,MAAM;YACN0B,gBAAgBN;YAChBxB;YACAC,OAAOD;YACPE,SAASF;YACTG,MAAMiC;QACR;IACF;IAEA,OAAO5C;AACT;AAEA,MAAMO,uBAAuB,CAAC,EAC5BF,MAAM,EACNN,YAAY,EAIb;IACC,MAAMiC,OAAO3B,OAAO2B,IAAI;IACxB,MAAMa,qBAAqB9C,aAAaO,OAAO,EAAE,CAAC0B,KAAK;IACvD,MAAMhC,QAAyB,EAAE;IAEjC,KAAK,MAAM,CAACkC,SAAS,EAAExB,OAAO,EAAEC,IAAI,EAAE,CAAC,IAAIlB,uBAAwB;QACjE,MAAM0C,qBAAqBU,oBAAoB9B,OAAO,CAACmB,QAAQ;QAC/D,IAAIC,uBAAuB,OAAO;YAChC;QACF;QACA,MAAMC,WAAW,OAAOD,uBAAuB,WAAWA,qBAAqBE;QAC/ErC,MAAMG,IAAI,CAAC;YACTS,MAAM;YACNJ,WAAW0B;YACXY,YAAYd;YACZvB,OAAO8B,WAAWL;YAClBxB;YACAC,MAAM;gBACJ,GAAGA,IAAI;gBACP6B,aAAaJ,UAAUI,eAAe7B,KAAK6B,WAAW;gBACtDC,kBACEL,UAAUK,oBACVI,oBAAoBJ,oBACpB9B,KAAK8B,gBAAgB;YACzB;QACF;IACF;IAEA,MAAME,gBAAgB9B,OAAOC,OAAO,CAAC+B,oBAAoB9B,SAAS,CAAC;IAGnE,KAAK,MAAM,CAACP,WAAWoC,WAAW,IAAID,cAAe;QACnD,IAAInC,aAAad,iBAAiB;YAChC;QACF;QACA,IAAI,CAACkD,YAAY;YACf;QACF;QACA5C,MAAMG,IAAI,CAAC;YACTS,MAAM;YACNJ;YACAsC,YAAYd;YACZvB,OAAOD;YACPE,SAASF;YACTG,MAAMiC;QACR;IACF;IAEA,OAAO5C;AACT;AAEA,MAAMuC,aAAa,CAACQ,IAAsBA,EAAEC,MAAM,CAAC,GAAGC,WAAW,KAAKF,EAAEG,KAAK,CAAC"}
+{"version":3,"sources":["../../src/mcp/sanitizeMCPConfig.ts"],"sourcesContent":["import type {\n  CollectionConfig,\n  Config,\n  GlobalConfig,\n  SanitizedCollectionConfig,\n  SanitizedConfig,\n  SanitizedGlobalConfig,\n} from 'payload'\n\nimport type {\n  CollectionMCPItem,\n  CollectionTool,\n  GlobalMCPItem,\n  GlobalTool,\n  MCPItem,\n  MCPPluginConfig,\n  SanitizedMCPPluginConfig,\n} from '../types.js'\n\nimport { defaultAccess } from '../defaultAccess.js'\nimport {\n  COLLECTION_AUTH_BUILTIN_ENTRIES,\n  COLLECTION_AUTH_BUILTINS,\n  COLLECTION_BUILTIN_ENTRIES,\n  COLLECTION_BUILTINS,\n  GLOBAL_BUILTIN_ENTRIES,\n  GLOBAL_BUILTINS,\n  TOOL_BUILTIN_ENTRIES,\n  TOOL_BUILTINS,\n} from './builtinTools.js'\n\n/**\n * Converts the user-configured `MCPPluginConfig` into a `SanitizedMCPPluginConfig`:\n *  - Flattens `tools` / `prompts` / `resources` / per-collection / per-global\n *    tool maps into a single `items` array.\n *  - Applies built-in tools for collections and globals, respecting opt-out user overrides.\n *\n * Called once during plugin init. After that, `plugins['@payloadcms/plugin-mcp']\n * ?.options` holds the sanitized result\n */\nexport const sanitizeMCPConfig = ({\n  config,\n  pluginConfig,\n}: {\n  config: Config | SanitizedConfig\n  pluginConfig: MCPPluginConfig\n}): SanitizedMCPPluginConfig => {\n  const items: MCPItem[] = []\n\n  for (const collection of config.collections ?? []) {\n    items.push(...sanitizeCollectionConfig({ collection, pluginConfig }))\n  }\n\n  for (const global of config.globals ?? []) {\n    items.push(...sanitizeGlobalConfig({ global, pluginConfig }))\n  }\n\n  for (const [configKey, { mcpName, tool }] of TOOL_BUILTIN_ENTRIES) {\n    items.push({\n      type: 'tool',\n      configKey,\n      label: tool.annotations?.title ?? configKey,\n      mcpName,\n      tool: { ...tool, access: tool.access ?? defaultAccess },\n    })\n  }\n\n  for (const [configKey, tool] of Object.entries(pluginConfig.tools ?? {})) {\n    if (configKey in TOOL_BUILTINS) {\n      continue\n    }\n    items.push({\n      type: 'tool',\n      configKey,\n      label: tool.annotations?.title ?? configKey,\n      mcpName: configKey,\n      tool: { ...tool, access: tool.access ?? defaultAccess },\n    })\n  }\n\n  for (const [configKey, prompt] of Object.entries(pluginConfig.prompts ?? {})) {\n    items.push({\n      type: 'prompt',\n      configKey,\n      label: prompt.title ?? configKey,\n      mcpName: configKey,\n      prompt: { ...prompt, access: prompt.access ?? defaultAccess },\n    })\n  }\n\n  for (const [configKey, resource] of Object.entries(pluginConfig.resources ?? {})) {\n    items.push({\n      type: 'resource',\n      configKey,\n      label: resource.title ?? configKey,\n      mcpName: configKey,\n      resource: { ...resource, access: resource.access ?? defaultAccess },\n    })\n  }\n\n  return {\n    disabled: pluginConfig.disabled,\n    items,\n    mcp: pluginConfig.mcp,\n    overrideGetAuthorizedMCP: pluginConfig.overrideGetAuthorizedMCP,\n  }\n}\n\nconst sanitizeCollectionConfig = ({\n  collection,\n  pluginConfig,\n}: {\n  collection: CollectionConfig | SanitizedCollectionConfig\n  pluginConfig: MCPPluginConfig\n}): CollectionMCPItem[] => {\n  const slug = collection.slug\n  const collectionPluginConfig = pluginConfig.collections?.[slug]\n  const items: CollectionMCPItem[] = []\n  /**\n   * Payload disables duplicate for auth collections by default unless the\n   * collection explicitly opts back in with `disableDuplicate: false`.\n   */\n  const isDuplicateDisabled =\n    collection.disableDuplicate === true ||\n    (Boolean(collection.auth) && collection.disableDuplicate !== false)\n\n  for (const [\n    toolKey,\n    { mcpName, requiresDuplicateEnabled, requiresVersions, tool },\n  ] of COLLECTION_BUILTIN_ENTRIES) {\n    if (requiresVersions && !collection.versions) {\n      continue\n    }\n    if (requiresDuplicateEnabled && isDuplicateDisabled) {\n      continue\n    }\n    const matchedConfigEntry = collectionPluginConfig?.tools?.[toolKey]\n    if (matchedConfigEntry === false) {\n      continue\n    }\n    const override = typeof matchedConfigEntry === 'object' ? matchedConfigEntry : undefined\n    const annotations = { ...tool.annotations, ...override?.annotations }\n    items.push({\n      type: 'collectionTool',\n      collectionSlug: slug,\n      configKey: toolKey,\n      label: annotations.title ?? toolKey,\n      mcpName,\n      tool: {\n        ...tool,\n        access: override?.access ?? tool.access ?? defaultAccess,\n        annotations,\n        description: override?.description ?? tool.description,\n        overrideResponse:\n          override?.overrideResponse ??\n          collectionPluginConfig?.overrideResponse ??\n          tool.overrideResponse,\n      },\n    })\n  }\n\n  if (collection.auth) {\n    for (const [authToolKey, { mcpName, tool }] of COLLECTION_AUTH_BUILTIN_ENTRIES) {\n      const matchedConfigEntry = collectionPluginConfig?.tools?.[authToolKey]\n      if (!matchedConfigEntry) {\n        continue\n      }\n      // `true` means \"enable, no override\"; only the object form carries fields.\n      const override = typeof matchedConfigEntry === 'object' ? matchedConfigEntry : undefined\n      const annotations = { ...tool.annotations, ...override?.annotations }\n      items.push({\n        type: 'collectionTool',\n        collectionSlug: slug,\n        configKey: authToolKey,\n        label: annotations.title ?? authToolKey,\n        mcpName,\n        tool: {\n          ...tool,\n          access: override?.access ?? tool.access ?? defaultAccess,\n          annotations,\n          description: override?.description ?? tool.description,\n          overrideResponse:\n            override?.overrideResponse ??\n            collectionPluginConfig?.overrideResponse ??\n            tool.overrideResponse,\n        },\n      })\n    }\n  }\n\n  // Cast: builtin keys are filtered out below, so the remaining values are\n  // always custom tools (`CollectionTool`) or undefined\n  const customEntries = Object.entries(collectionPluginConfig?.tools ?? {}) as Array<\n    [string, CollectionTool | undefined]\n  >\n  for (const [configKey, customTool] of customEntries) {\n    if (configKey in COLLECTION_BUILTINS || configKey in COLLECTION_AUTH_BUILTINS) {\n      continue\n    }\n    if (!customTool) {\n      continue\n    }\n    items.push({\n      type: 'collectionTool',\n      collectionSlug: slug,\n      configKey,\n      label: customTool.annotations?.title ?? configKey,\n      mcpName: configKey,\n      tool: { ...customTool, access: customTool.access ?? defaultAccess },\n    })\n  }\n\n  return items\n}\n\nconst sanitizeGlobalConfig = ({\n  global,\n  pluginConfig,\n}: {\n  global: GlobalConfig | SanitizedGlobalConfig\n  pluginConfig: MCPPluginConfig\n}): GlobalMCPItem[] => {\n  const slug = global.slug\n  const globalPluginConfig = pluginConfig.globals?.[slug]\n  const items: GlobalMCPItem[] = []\n\n  for (const [toolKey, { mcpName, requiresVersions, tool }] of GLOBAL_BUILTIN_ENTRIES) {\n    if (requiresVersions && !global.versions) {\n      continue\n    }\n    const matchedConfigEntry = globalPluginConfig?.tools?.[toolKey]\n    if (matchedConfigEntry === false) {\n      continue\n    }\n    const override = typeof matchedConfigEntry === 'object' ? matchedConfigEntry : undefined\n    const annotations = { ...tool.annotations, ...override?.annotations }\n    items.push({\n      type: 'globalTool',\n      configKey: toolKey,\n      globalSlug: slug,\n      label: annotations.title ?? toolKey,\n      mcpName,\n      tool: {\n        ...tool,\n        access: override?.access ?? tool.access ?? defaultAccess,\n        annotations,\n        description: override?.description ?? tool.description,\n        overrideResponse:\n          override?.overrideResponse ??\n          globalPluginConfig?.overrideResponse ??\n          tool.overrideResponse,\n      },\n    })\n  }\n\n  const customEntries = Object.entries(globalPluginConfig?.tools ?? {}) as Array<\n    [string, GlobalTool | undefined]\n  >\n  for (const [configKey, customTool] of customEntries) {\n    if (configKey in GLOBAL_BUILTINS) {\n      continue\n    }\n    if (!customTool) {\n      continue\n    }\n    items.push({\n      type: 'globalTool',\n      configKey,\n      globalSlug: slug,\n      label: customTool.annotations?.title ?? configKey,\n      mcpName: configKey,\n      tool: { ...customTool, access: customTool.access ?? defaultAccess },\n    })\n  }\n\n  return items\n}\n"],"names":["defaultAccess","COLLECTION_AUTH_BUILTIN_ENTRIES","COLLECTION_AUTH_BUILTINS","COLLECTION_BUILTIN_ENTRIES","COLLECTION_BUILTINS","GLOBAL_BUILTIN_ENTRIES","GLOBAL_BUILTINS","TOOL_BUILTIN_ENTRIES","TOOL_BUILTINS","sanitizeMCPConfig","config","pluginConfig","items","collection","collections","push","sanitizeCollectionConfig","global","globals","sanitizeGlobalConfig","configKey","mcpName","tool","type","label","annotations","title","access","Object","entries","tools","prompt","prompts","resource","resources","disabled","mcp","overrideGetAuthorizedMCP","slug","collectionPluginConfig","isDuplicateDisabled","disableDuplicate","Boolean","auth","toolKey","requiresDuplicateEnabled","requiresVersions","versions","matchedConfigEntry","override","undefined","collectionSlug","description","overrideResponse","authToolKey","customEntries","customTool","globalPluginConfig","globalSlug"],"mappings":"AAmBA,SAASA,aAAa,QAAQ,sBAAqB;AACnD,SACEC,+BAA+B,EAC/BC,wBAAwB,EACxBC,0BAA0B,EAC1BC,mBAAmB,EACnBC,sBAAsB,EACtBC,eAAe,EACfC,oBAAoB,EACpBC,aAAa,QACR,oBAAmB;AAE1B;;;;;;;;CAQC,GACD,OAAO,MAAMC,oBAAoB,CAAC,EAChCC,MAAM,EACNC,YAAY,EAIb;IACC,MAAMC,QAAmB,EAAE;IAE3B,KAAK,MAAMC,cAAcH,OAAOI,WAAW,IAAI,EAAE,CAAE;QACjDF,MAAMG,IAAI,IAAIC,yBAAyB;YAAEH;YAAYF;QAAa;IACpE;IAEA,KAAK,MAAMM,UAAUP,OAAOQ,OAAO,IAAI,EAAE,CAAE;QACzCN,MAAMG,IAAI,IAAII,qBAAqB;YAAEF;YAAQN;QAAa;IAC5D;IAEA,KAAK,MAAM,CAACS,WAAW,EAAEC,OAAO,EAAEC,IAAI,EAAE,CAAC,IAAIf,qBAAsB;QACjEK,MAAMG,IAAI,CAAC;YACTQ,MAAM;YACNH;YACAI,OAAOF,KAAKG,WAAW,EAAEC,SAASN;YAClCC;YACAC,MAAM;gBAAE,GAAGA,IAAI;gBAAEK,QAAQL,KAAKK,MAAM,IAAI3B;YAAc;QACxD;IACF;IAEA,KAAK,MAAM,CAACoB,WAAWE,KAAK,IAAIM,OAAOC,OAAO,CAAClB,aAAamB,KAAK,IAAI,CAAC,GAAI;QACxE,IAAIV,aAAaZ,eAAe;YAC9B;QACF;QACAI,MAAMG,IAAI,CAAC;YACTQ,MAAM;YACNH;YACAI,OAAOF,KAAKG,WAAW,EAAEC,SAASN;YAClCC,SAASD;YACTE,MAAM;gBAAE,GAAGA,IAAI;gBAAEK,QAAQL,KAAKK,MAAM,IAAI3B;YAAc;QACxD;IACF;IAEA,KAAK,MAAM,CAACoB,WAAWW,OAAO,IAAIH,OAAOC,OAAO,CAAClB,aAAaqB,OAAO,IAAI,CAAC,GAAI;QAC5EpB,MAAMG,IAAI,CAAC;YACTQ,MAAM;YACNH;YACAI,OAAOO,OAAOL,KAAK,IAAIN;YACvBC,SAASD;YACTW,QAAQ;gBAAE,GAAGA,MAAM;gBAAEJ,QAAQI,OAAOJ,MAAM,IAAI3B;YAAc;QAC9D;IACF;IAEA,KAAK,MAAM,CAACoB,WAAWa,SAAS,IAAIL,OAAOC,OAAO,CAAClB,aAAauB,SAAS,IAAI,CAAC,GAAI;QAChFtB,MAAMG,IAAI,CAAC;YACTQ,MAAM;YACNH;YACAI,OAAOS,SAASP,KAAK,IAAIN;YACzBC,SAASD;YACTa,UAAU;gBAAE,GAAGA,QAAQ;gBAAEN,QAAQM,SAASN,MAAM,IAAI3B;YAAc;QACpE;IACF;IAEA,OAAO;QACLmC,UAAUxB,aAAawB,QAAQ;QAC/BvB;QACAwB,KAAKzB,aAAayB,GAAG;QACrBC,0BAA0B1B,aAAa0B,wBAAwB;IACjE;AACF,EAAC;AAED,MAAMrB,2BAA2B,CAAC,EAChCH,UAAU,EACVF,YAAY,EAIb;IACC,MAAM2B,OAAOzB,WAAWyB,IAAI;IAC5B,MAAMC,yBAAyB5B,aAAaG,WAAW,EAAE,CAACwB,KAAK;IAC/D,MAAM1B,QAA6B,EAAE;IACrC;;;GAGC,GACD,MAAM4B,sBACJ3B,WAAW4B,gBAAgB,KAAK,QAC/BC,QAAQ7B,WAAW8B,IAAI,KAAK9B,WAAW4B,gBAAgB,KAAK;IAE/D,KAAK,MAAM,CACTG,SACA,EAAEvB,OAAO,EAAEwB,wBAAwB,EAAEC,gBAAgB,EAAExB,IAAI,EAAE,CAC9D,IAAInB,2BAA4B;QAC/B,IAAI2C,oBAAoB,CAACjC,WAAWkC,QAAQ,EAAE;YAC5C;QACF;QACA,IAAIF,4BAA4BL,qBAAqB;YACnD;QACF;QACA,MAAMQ,qBAAqBT,wBAAwBT,OAAO,CAACc,QAAQ;QACnE,IAAII,uBAAuB,OAAO;YAChC;QACF;QACA,MAAMC,WAAW,OAAOD,uBAAuB,WAAWA,qBAAqBE;QAC/E,MAAMzB,cAAc;YAAE,GAAGH,KAAKG,WAAW;YAAE,GAAGwB,UAAUxB,WAAW;QAAC;QACpEb,MAAMG,IAAI,CAAC;YACTQ,MAAM;YACN4B,gBAAgBb;YAChBlB,WAAWwB;YACXpB,OAAOC,YAAYC,KAAK,IAAIkB;YAC5BvB;YACAC,MAAM;gBACJ,GAAGA,IAAI;gBACPK,QAAQsB,UAAUtB,UAAUL,KAAKK,MAAM,IAAI3B;gBAC3CyB;gBACA2B,aAAaH,UAAUG,eAAe9B,KAAK8B,WAAW;gBACtDC,kBACEJ,UAAUI,oBACVd,wBAAwBc,oBACxB/B,KAAK+B,gBAAgB;YACzB;QACF;IACF;IAEA,IAAIxC,WAAW8B,IAAI,EAAE;QACnB,KAAK,MAAM,CAACW,aAAa,EAAEjC,OAAO,EAAEC,IAAI,EAAE,CAAC,IAAIrB,gCAAiC;YAC9E,MAAM+C,qBAAqBT,wBAAwBT,OAAO,CAACwB,YAAY;YACvE,IAAI,CAACN,oBAAoB;gBACvB;YACF;YACA,2EAA2E;YAC3E,MAAMC,WAAW,OAAOD,uBAAuB,WAAWA,qBAAqBE;YAC/E,MAAMzB,cAAc;gBAAE,GAAGH,KAAKG,WAAW;gBAAE,GAAGwB,UAAUxB,WAAW;YAAC;YACpEb,MAAMG,IAAI,CAAC;gBACTQ,MAAM;gBACN4B,gBAAgBb;gBAChBlB,WAAWkC;gBACX9B,OAAOC,YAAYC,KAAK,IAAI4B;gBAC5BjC;gBACAC,MAAM;oBACJ,GAAGA,IAAI;oBACPK,QAAQsB,UAAUtB,UAAUL,KAAKK,MAAM,IAAI3B;oBAC3CyB;oBACA2B,aAAaH,UAAUG,eAAe9B,KAAK8B,WAAW;oBACtDC,kBACEJ,UAAUI,oBACVd,wBAAwBc,oBACxB/B,KAAK+B,gBAAgB;gBACzB;YACF;QACF;IACF;IAEA,yEAAyE;IACzE,sDAAsD;IACtD,MAAME,gBAAgB3B,OAAOC,OAAO,CAACU,wBAAwBT,SAAS,CAAC;IAGvE,KAAK,MAAM,CAACV,WAAWoC,WAAW,IAAID,cAAe;QACnD,IAAInC,aAAahB,uBAAuBgB,aAAalB,0BAA0B;YAC7E;QACF;QACA,IAAI,CAACsD,YAAY;YACf;QACF;QACA5C,MAAMG,IAAI,CAAC;YACTQ,MAAM;YACN4B,gBAAgBb;YAChBlB;YACAI,OAAOgC,WAAW/B,WAAW,EAAEC,SAASN;YACxCC,SAASD;YACTE,MAAM;gBAAE,GAAGkC,UAAU;gBAAE7B,QAAQ6B,WAAW7B,MAAM,IAAI3B;YAAc;QACpE;IACF;IAEA,OAAOY;AACT;AAEA,MAAMO,uBAAuB,CAAC,EAC5BF,MAAM,EACNN,YAAY,EAIb;IACC,MAAM2B,OAAOrB,OAAOqB,IAAI;IACxB,MAAMmB,qBAAqB9C,aAAaO,OAAO,EAAE,CAACoB,KAAK;IACvD,MAAM1B,QAAyB,EAAE;IAEjC,KAAK,MAAM,CAACgC,SAAS,EAAEvB,OAAO,EAAEyB,gBAAgB,EAAExB,IAAI,EAAE,CAAC,IAAIjB,uBAAwB;QACnF,IAAIyC,oBAAoB,CAAC7B,OAAO8B,QAAQ,EAAE;YACxC;QACF;QACA,MAAMC,qBAAqBS,oBAAoB3B,OAAO,CAACc,QAAQ;QAC/D,IAAII,uBAAuB,OAAO;YAChC;QACF;QACA,MAAMC,WAAW,OAAOD,uBAAuB,WAAWA,qBAAqBE;QAC/E,MAAMzB,cAAc;YAAE,GAAGH,KAAKG,WAAW;YAAE,GAAGwB,UAAUxB,WAAW;QAAC;QACpEb,MAAMG,IAAI,CAAC;YACTQ,MAAM;YACNH,WAAWwB;YACXc,YAAYpB;YACZd,OAAOC,YAAYC,KAAK,IAAIkB;YAC5BvB;YACAC,MAAM;gBACJ,GAAGA,IAAI;gBACPK,QAAQsB,UAAUtB,UAAUL,KAAKK,MAAM,IAAI3B;gBAC3CyB;gBACA2B,aAAaH,UAAUG,eAAe9B,KAAK8B,WAAW;gBACtDC,kBACEJ,UAAUI,oBACVI,oBAAoBJ,oBACpB/B,KAAK+B,gBAAgB;YACzB;QACF;IACF;IAEA,MAAME,gBAAgB3B,OAAOC,OAAO,CAAC4B,oBAAoB3B,SAAS,CAAC;IAGnE,KAAK,MAAM,CAACV,WAAWoC,WAAW,IAAID,cAAe;QACnD,IAAInC,aAAad,iBAAiB;YAChC;QACF;QACA,IAAI,CAACkD,YAAY;YACf;QACF;QACA5C,MAAMG,IAAI,CAAC;YACTQ,MAAM;YACNH;YACAsC,YAAYpB;YACZd,OAAOgC,WAAW/B,WAAW,EAAEC,SAASN;YACxCC,SAASD;YACTE,MAAM;gBAAE,GAAGkC,UAAU;gBAAE7B,QAAQ6B,WAAW7B,MAAM,IAAI3B;YAAc;QACpE;IACF;IAEA,OAAOY;AACT"}

package/dist/stdio.d.ts

@@ -1,8 +1,9 @@
 /**
  * Stdio adapter for the Payload MCP server.
  *
- * Do not use in production. There's no auth; whoever can spawn the process gets
- * full access to your local data.
+ * Pass PAYLOAD_MCP_AUTHORIZATION when stdio should authenticate with the same
+ * Payload auth header as HTTP. In development, PAYLOAD_MCP_OVERRIDE_ACCESS=true
+ * skips access control for local setup.
  */
 export declare const runMcpStdio: () => Promise<void>;
 //# sourceMappingURL=stdio.d.ts.map

package/dist/stdio.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stdio.d.ts","sourceRoot":"","sources":["../src/stdio.ts"],"names":[],"mappings":"AAeA;;;;;GAKG;AACH,eAAO,MAAM,WAAW,QAAa,OAAO,CAAC,IAAI,CA4EhD,CAAA"}
+{"version":3,"file":"stdio.d.ts","sourceRoot":"","sources":["../src/stdio.ts"],"names":[],"mappings":"AAgBA;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,QAAa,OAAO,CAAC,IAAI,CAyFhD,CAAA"}

package/dist/stdio.js

@@ -2,6 +2,7 @@
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { createLocalReq, getPayload } from 'payload';
 import { findConfig } from 'payload/node';
+import { getAuthorizedMCP } from './endpoint/access.js';
 import { buildMcpServer } from './mcp/buildMcpServer.js';
 import { sanitizeMCPConfig } from './mcp/sanitizeMCPConfig.js';
 import { getPluginConfig } from './utils/getPluginConfig.js';
@@ -9,8 +10,9 @@ import { resolveProjectRoot } from './utils/resolveProjectRoot.js';
 /**
  * Stdio adapter for the Payload MCP server.
  *
- * Do not use in production. There's no auth; whoever can spawn the process gets
- * full access to your local data.
+ * Pass PAYLOAD_MCP_AUTHORIZATION when stdio should authenticate with the same
+ * Payload auth header as HTTP. In development, PAYLOAD_MCP_OVERRIDE_ACCESS=true
+ * skips access control for local setup.
  */ export const runMcpStdio = async ()=>{
     /**
    * If MCP clients spawn stdio servers from an arbitrary working directory,
@@ -52,13 +54,30 @@ import { resolveProjectRoot } from './utils/resolveProjectRoot.js';
         fakePluginFn.sanitizedOptions = pluginConfig;
         (payload.config.plugins ??= []).push(fakePluginFn);
     }
-    const authorizedMCP = {
-        items: pluginConfig.items,
-        overrideAccess: true,
-        user: null
-    };
-    const req = await createLocalReq({}, payload);
+    const overrideAccessEnv = process.env.PAYLOAD_MCP_OVERRIDE_ACCESS;
+    let overrideAccess = false;
+    if (overrideAccessEnv === 'true') {
+        overrideAccess = true;
+    } else if (overrideAccessEnv && overrideAccessEnv !== 'false') {
+        throw new Error('PAYLOAD_MCP_OVERRIDE_ACCESS must be "true" or "false".');
+    }
+    if (overrideAccess && process.env.NODE_ENV !== 'development') {
+        throw new Error('PAYLOAD_MCP_OVERRIDE_ACCESS is only available in development.');
+    }
+    const headers = new Headers();
+    if (process.env.PAYLOAD_MCP_AUTHORIZATION) {
+        headers.set('Authorization', process.env.PAYLOAD_MCP_AUTHORIZATION);
+    }
+    const req = await createLocalReq({
+        req: {
+            headers
+        }
+    }, payload);
     req.payloadAPI = 'MCP';
+    const authorizedMCP = await getAuthorizedMCP({
+        overrideAccess,
+        req
+    });
     const server = buildMcpServer({
         authorizedMCP,
         pluginConfig,

package/dist/stdio.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/stdio.ts"],"sourcesContent":["import type { MaybePromise, Plugin, SanitizedConfig } from 'payload'\n\n/* eslint-disable no-console */\nimport { StdioServerTransport } from '@modelcontextprotocol/server'\nimport { fileURLToPath, pathToFileURL } from 'node:url'\nimport { createLocalReq, getPayload } from 'payload'\nimport { findConfig } from 'payload/node'\n\nimport type { AuthorizedMCP, SanitizedMCPPluginConfig } from './types.js'\n\nimport { buildMcpServer } from './mcp/buildMcpServer.js'\nimport { sanitizeMCPConfig } from './mcp/sanitizeMCPConfig.js'\nimport { getPluginConfig } from './utils/getPluginConfig.js'\nimport { resolveProjectRoot } from './utils/resolveProjectRoot.js'\n\n/**\n * Stdio adapter for the Payload MCP server.\n *\n * Do not use in production. There's no auth; whoever can spawn the process gets\n * full access to your local data.\n */\nexport const runMcpStdio = async (): Promise<void> => {\n  /**\n   * If MCP clients spawn stdio servers from an arbitrary working directory,\n   * Payload's cwd-anchored `findConfig()` can't locate the project on\n   * its own. This module always lives inside the project's `node_modules`, so\n   * we derive the project root from its own path and `chdir` into it.\n   *\n   * An absolute `PAYLOAD_CONFIG_PATH` still overrides everything; unusual\n   * layouts (e.g. a monorepo where the package is hoisted above the app) can\n   * fall back to it. See the implementation of findConfig for details.\n   */\n  const projectRoot = resolveProjectRoot(fileURLToPath(import.meta.url))\n  if (projectRoot) {\n    process.chdir(projectRoot)\n  }\n\n  const configPath = findConfig()\n  const configModule = await import(pathToFileURL(configPath).toString())\n  const config = (await (configModule.default ?? configModule)) as MaybePromise<SanitizedConfig>\n\n  const payload = await getPayload({ config })\n\n  /**\n   * If the user added `mcpPlugin({...})` to their `plugins` array, read the\n   * sanitized config they registered. Otherwise fall back to the defaults. That way,\n   * the mcp works on any project that has `@payloadcms/plugin-mcp` installed,\n   * even if the plugin is not added to the plugins array.\n   */\n  let pluginConfig: SanitizedMCPPluginConfig\n  try {\n    pluginConfig = getPluginConfig({ config: payload.config })\n  } catch {\n    pluginConfig = sanitizeMCPConfig({ config: payload.config, pluginConfig: {} })\n\n    const fakePluginFn: Plugin = (config) => config\n    fakePluginFn.slug = '@payloadcms/plugin-mcp'\n    // @ts-expect-error\n    fakePluginFn.sanitizedOptions = pluginConfig\n\n    // Push to payload config, to ensure consecutive calls to `getPluginConfig()` work\n    ;(payload.config.plugins ??= []).push(fakePluginFn)\n  }\n\n  const authorizedMCP: AuthorizedMCP = {\n    items: pluginConfig.items,\n    overrideAccess: true,\n    user: null,\n  }\n\n  const req = await createLocalReq({}, payload)\n  req.payloadAPI = 'MCP' as const\n\n  const server = buildMcpServer({ authorizedMCP, pluginConfig, req })\n\n  const transport = new StdioServerTransport()\n  await server.connect(transport)\n\n  // Process now lives until stdin closes. Wire graceful shutdown so DB\n  // connections (and any other Payload-managed resources) get released.\n  const shutdown = async (code = 0) => {\n    try {\n      await server.close()\n    } catch (err) {\n      console.error('[payload-mcp] error closing server:', err)\n    }\n    try {\n      await payload.destroy()\n    } catch (err) {\n      console.error('[payload-mcp] error destroying payload:', err)\n    }\n    process.exit(code)\n  }\n\n  process.on('SIGINT', () => void shutdown(0))\n  process.on('SIGTERM', () => void shutdown(0))\n  process.stdin.on('close', () => void shutdown(0))\n}\n"],"names":["StdioServerTransport","fileURLToPath","pathToFileURL","createLocalReq","getPayload","findConfig","buildMcpServer","sanitizeMCPConfig","getPluginConfig","resolveProjectRoot","runMcpStdio","projectRoot","url","process","chdir","configPath","configModule","toString","config","default","payload","pluginConfig","fakePluginFn","slug","sanitizedOptions","plugins","push","authorizedMCP","items","overrideAccess","user","req","payloadAPI","server","transport","connect","shutdown","code","close","err","console","error","destroy","exit","on","stdin"],"mappings":"AAEA,6BAA6B,GAC7B,SAASA,oBAAoB,QAAQ,+BAA8B;AACnE,SAASC,aAAa,EAAEC,aAAa,QAAQ,WAAU;AACvD,SAASC,cAAc,EAAEC,UAAU,QAAQ,UAAS;AACpD,SAASC,UAAU,QAAQ,eAAc;AAIzC,SAASC,cAAc,QAAQ,0BAAyB;AACxD,SAASC,iBAAiB,QAAQ,6BAA4B;AAC9D,SAASC,eAAe,QAAQ,6BAA4B;AAC5D,SAASC,kBAAkB,QAAQ,gCAA+B;AAElE;;;;;CAKC,GACD,OAAO,MAAMC,cAAc;IACzB;;;;;;;;;GASC,GACD,MAAMC,cAAcF,mBAAmBR,cAAc,YAAYW,GAAG;IACpE,IAAID,aAAa;QACfE,QAAQC,KAAK,CAACH;IAChB;IAEA,MAAMI,aAAaV;IACnB,MAAMW,eAAe,MAAM,MAAM,CAACd,cAAca,YAAYE,QAAQ;IACpE,MAAMC,SAAU,MAAOF,CAAAA,aAAaG,OAAO,IAAIH,YAAW;IAE1D,MAAMI,UAAU,MAAMhB,WAAW;QAAEc;IAAO;IAE1C;;;;;GAKC,GACD,IAAIG;IACJ,IAAI;QACFA,eAAeb,gBAAgB;YAAEU,QAAQE,QAAQF,MAAM;QAAC;IAC1D,EAAE,OAAM;QACNG,eAAed,kBAAkB;YAAEW,QAAQE,QAAQF,MAAM;YAAEG,cAAc,CAAC;QAAE;QAE5E,MAAMC,eAAuB,CAACJ,SAAWA;QACzCI,aAAaC,IAAI,GAAG;QACpB,mBAAmB;QACnBD,aAAaE,gBAAgB,GAAGH;QAG9BD,CAAAA,QAAQF,MAAM,CAACO,OAAO,KAAK,EAAE,AAAD,EAAGC,IAAI,CAACJ;IACxC;IAEA,MAAMK,gBAA+B;QACnCC,OAAOP,aAAaO,KAAK;QACzBC,gBAAgB;QAChBC,MAAM;IACR;IAEA,MAAMC,MAAM,MAAM5B,eAAe,CAAC,GAAGiB;IACrCW,IAAIC,UAAU,GAAG;IAEjB,MAAMC,SAAS3B,eAAe;QAAEqB;QAAeN;QAAcU;IAAI;IAEjE,MAAMG,YAAY,IAAIlC;IACtB,MAAMiC,OAAOE,OAAO,CAACD;IAErB,qEAAqE;IACrE,sEAAsE;IACtE,MAAME,WAAW,OAAOC,OAAO,CAAC;QAC9B,IAAI;YACF,MAAMJ,OAAOK,KAAK;QACpB,EAAE,OAAOC,KAAK;YACZC,QAAQC,KAAK,CAAC,uCAAuCF;QACvD;QACA,IAAI;YACF,MAAMnB,QAAQsB,OAAO;QACvB,EAAE,OAAOH,KAAK;YACZC,QAAQC,KAAK,CAAC,2CAA2CF;QAC3D;QACA1B,QAAQ8B,IAAI,CAACN;IACf;IAEAxB,QAAQ+B,EAAE,CAAC,UAAU,IAAM,KAAKR,SAAS;IACzCvB,QAAQ+B,EAAE,CAAC,WAAW,IAAM,KAAKR,SAAS;IAC1CvB,QAAQgC,KAAK,CAACD,EAAE,CAAC,SAAS,IAAM,KAAKR,SAAS;AAChD,EAAC"}
+{"version":3,"sources":["../src/stdio.ts"],"sourcesContent":["import type { MaybePromise, Plugin, SanitizedConfig } from 'payload'\n\n/* eslint-disable no-console */\nimport { StdioServerTransport } from '@modelcontextprotocol/server'\nimport { fileURLToPath, pathToFileURL } from 'node:url'\nimport { createLocalReq, getPayload } from 'payload'\nimport { findConfig } from 'payload/node'\n\nimport type { SanitizedMCPPluginConfig } from './types.js'\n\nimport { getAuthorizedMCP } from './endpoint/access.js'\nimport { buildMcpServer } from './mcp/buildMcpServer.js'\nimport { sanitizeMCPConfig } from './mcp/sanitizeMCPConfig.js'\nimport { getPluginConfig } from './utils/getPluginConfig.js'\nimport { resolveProjectRoot } from './utils/resolveProjectRoot.js'\n\n/**\n * Stdio adapter for the Payload MCP server.\n *\n * Pass PAYLOAD_MCP_AUTHORIZATION when stdio should authenticate with the same\n * Payload auth header as HTTP. In development, PAYLOAD_MCP_OVERRIDE_ACCESS=true\n * skips access control for local setup.\n */\nexport const runMcpStdio = async (): Promise<void> => {\n  /**\n   * If MCP clients spawn stdio servers from an arbitrary working directory,\n   * Payload's cwd-anchored `findConfig()` can't locate the project on\n   * its own. This module always lives inside the project's `node_modules`, so\n   * we derive the project root from its own path and `chdir` into it.\n   *\n   * An absolute `PAYLOAD_CONFIG_PATH` still overrides everything; unusual\n   * layouts (e.g. a monorepo where the package is hoisted above the app) can\n   * fall back to it. See the implementation of findConfig for details.\n   */\n  const projectRoot = resolveProjectRoot(fileURLToPath(import.meta.url))\n  if (projectRoot) {\n    process.chdir(projectRoot)\n  }\n\n  const configPath = findConfig()\n  const configModule = await import(pathToFileURL(configPath).toString())\n  const config = (await (configModule.default ?? configModule)) as MaybePromise<SanitizedConfig>\n\n  const payload = await getPayload({ config })\n\n  /**\n   * If the user added `mcpPlugin({...})` to their `plugins` array, read the\n   * sanitized config they registered. Otherwise fall back to the defaults. That way,\n   * the mcp works on any project that has `@payloadcms/plugin-mcp` installed,\n   * even if the plugin is not added to the plugins array.\n   */\n  let pluginConfig: SanitizedMCPPluginConfig\n  try {\n    pluginConfig = getPluginConfig({ config: payload.config })\n  } catch {\n    pluginConfig = sanitizeMCPConfig({ config: payload.config, pluginConfig: {} })\n\n    const fakePluginFn: Plugin = (config) => config\n    fakePluginFn.slug = '@payloadcms/plugin-mcp'\n    // @ts-expect-error\n    fakePluginFn.sanitizedOptions = pluginConfig\n\n    // Push to payload config, to ensure consecutive calls to `getPluginConfig()` work\n    ;(payload.config.plugins ??= []).push(fakePluginFn)\n  }\n\n  const overrideAccessEnv = process.env.PAYLOAD_MCP_OVERRIDE_ACCESS\n  let overrideAccess = false\n\n  if (overrideAccessEnv === 'true') {\n    overrideAccess = true\n  } else if (overrideAccessEnv && overrideAccessEnv !== 'false') {\n    throw new Error('PAYLOAD_MCP_OVERRIDE_ACCESS must be \"true\" or \"false\".')\n  }\n\n  if (overrideAccess && process.env.NODE_ENV !== 'development') {\n    throw new Error('PAYLOAD_MCP_OVERRIDE_ACCESS is only available in development.')\n  }\n\n  const headers = new Headers()\n  if (process.env.PAYLOAD_MCP_AUTHORIZATION) {\n    headers.set('Authorization', process.env.PAYLOAD_MCP_AUTHORIZATION)\n  }\n\n  const req = await createLocalReq({ req: { headers } }, payload)\n  req.payloadAPI = 'MCP' as const\n  const authorizedMCP = await getAuthorizedMCP({ overrideAccess, req })\n\n  const server = buildMcpServer({ authorizedMCP, pluginConfig, req })\n\n  const transport = new StdioServerTransport()\n  await server.connect(transport)\n\n  // Process now lives until stdin closes. Wire graceful shutdown so DB\n  // connections (and any other Payload-managed resources) get released.\n  const shutdown = async (code = 0) => {\n    try {\n      await server.close()\n    } catch (err) {\n      console.error('[payload-mcp] error closing server:', err)\n    }\n    try {\n      await payload.destroy()\n    } catch (err) {\n      console.error('[payload-mcp] error destroying payload:', err)\n    }\n    process.exit(code)\n  }\n\n  process.on('SIGINT', () => void shutdown(0))\n  process.on('SIGTERM', () => void shutdown(0))\n  process.stdin.on('close', () => void shutdown(0))\n}\n"],"names":["StdioServerTransport","fileURLToPath","pathToFileURL","createLocalReq","getPayload","findConfig","getAuthorizedMCP","buildMcpServer","sanitizeMCPConfig","getPluginConfig","resolveProjectRoot","runMcpStdio","projectRoot","url","process","chdir","configPath","configModule","toString","config","default","payload","pluginConfig","fakePluginFn","slug","sanitizedOptions","plugins","push","overrideAccessEnv","env","PAYLOAD_MCP_OVERRIDE_ACCESS","overrideAccess","Error","NODE_ENV","headers","Headers","PAYLOAD_MCP_AUTHORIZATION","set","req","payloadAPI","authorizedMCP","server","transport","connect","shutdown","code","close","err","console","error","destroy","exit","on","stdin"],"mappings":"AAEA,6BAA6B,GAC7B,SAASA,oBAAoB,QAAQ,+BAA8B;AACnE,SAASC,aAAa,EAAEC,aAAa,QAAQ,WAAU;AACvD,SAASC,cAAc,EAAEC,UAAU,QAAQ,UAAS;AACpD,SAASC,UAAU,QAAQ,eAAc;AAIzC,SAASC,gBAAgB,QAAQ,uBAAsB;AACvD,SAASC,cAAc,QAAQ,0BAAyB;AACxD,SAASC,iBAAiB,QAAQ,6BAA4B;AAC9D,SAASC,eAAe,QAAQ,6BAA4B;AAC5D,SAASC,kBAAkB,QAAQ,gCAA+B;AAElE;;;;;;CAMC,GACD,OAAO,MAAMC,cAAc;IACzB;;;;;;;;;GASC,GACD,MAAMC,cAAcF,mBAAmBT,cAAc,YAAYY,GAAG;IACpE,IAAID,aAAa;QACfE,QAAQC,KAAK,CAACH;IAChB;IAEA,MAAMI,aAAaX;IACnB,MAAMY,eAAe,MAAM,MAAM,CAACf,cAAcc,YAAYE,QAAQ;IACpE,MAAMC,SAAU,MAAOF,CAAAA,aAAaG,OAAO,IAAIH,YAAW;IAE1D,MAAMI,UAAU,MAAMjB,WAAW;QAAEe;IAAO;IAE1C;;;;;GAKC,GACD,IAAIG;IACJ,IAAI;QACFA,eAAeb,gBAAgB;YAAEU,QAAQE,QAAQF,MAAM;QAAC;IAC1D,EAAE,OAAM;QACNG,eAAed,kBAAkB;YAAEW,QAAQE,QAAQF,MAAM;YAAEG,cAAc,CAAC;QAAE;QAE5E,MAAMC,eAAuB,CAACJ,SAAWA;QACzCI,aAAaC,IAAI,GAAG;QACpB,mBAAmB;QACnBD,aAAaE,gBAAgB,GAAGH;QAG9BD,CAAAA,QAAQF,MAAM,CAACO,OAAO,KAAK,EAAE,AAAD,EAAGC,IAAI,CAACJ;IACxC;IAEA,MAAMK,oBAAoBd,QAAQe,GAAG,CAACC,2BAA2B;IACjE,IAAIC,iBAAiB;IAErB,IAAIH,sBAAsB,QAAQ;QAChCG,iBAAiB;IACnB,OAAO,IAAIH,qBAAqBA,sBAAsB,SAAS;QAC7D,MAAM,IAAII,MAAM;IAClB;IAEA,IAAID,kBAAkBjB,QAAQe,GAAG,CAACI,QAAQ,KAAK,eAAe;QAC5D,MAAM,IAAID,MAAM;IAClB;IAEA,MAAME,UAAU,IAAIC;IACpB,IAAIrB,QAAQe,GAAG,CAACO,yBAAyB,EAAE;QACzCF,QAAQG,GAAG,CAAC,iBAAiBvB,QAAQe,GAAG,CAACO,yBAAyB;IACpE;IAEA,MAAME,MAAM,MAAMnC,eAAe;QAAEmC,KAAK;YAAEJ;QAAQ;IAAE,GAAGb;IACvDiB,IAAIC,UAAU,GAAG;IACjB,MAAMC,gBAAgB,MAAMlC,iBAAiB;QAAEyB;QAAgBO;IAAI;IAEnE,MAAMG,SAASlC,eAAe;QAAEiC;QAAelB;QAAcgB;IAAI;IAEjE,MAAMI,YAAY,IAAI1C;IACtB,MAAMyC,OAAOE,OAAO,CAACD;IAErB,qEAAqE;IACrE,sEAAsE;IACtE,MAAME,WAAW,OAAOC,OAAO,CAAC;QAC9B,IAAI;YACF,MAAMJ,OAAOK,KAAK;QACpB,EAAE,OAAOC,KAAK;YACZC,QAAQC,KAAK,CAAC,uCAAuCF;QACvD;QACA,IAAI;YACF,MAAM1B,QAAQ6B,OAAO;QACvB,EAAE,OAAOH,KAAK;YACZC,QAAQC,KAAK,CAAC,2CAA2CF;QAC3D;QACAjC,QAAQqC,IAAI,CAACN;IACf;IAEA/B,QAAQsC,EAAE,CAAC,UAAU,IAAM,KAAKR,SAAS;IACzC9B,QAAQsC,EAAE,CAAC,WAAW,IAAM,KAAKR,SAAS;IAC1C9B,QAAQuC,KAAK,CAACD,EAAE,CAAC,SAAS,IAAM,KAAKR,SAAS;AAChD,EAAC"}

package/dist/types.d.ts

@@ -1,34 +1,15 @@
-import type { CallToolResult, ContentBlock, JsonSchemaType, McpServer, ResourceTemplate, ServerContext, StandardSchemaWithJSON } from '@modelcontextprotocol/server';
-import type { AuthCollectionSlug, CollectionConfig, CollectionSlug, DefaultDocumentIDType, GlobalSlug, MaybePromise, PayloadRequest, TypedUser } from 'payload';
+import type { CallToolResult, ContentBlock, JsonSchemaType, McpServer, ResourceTemplate, ServerContext, StandardSchemaWithJSON, ToolAnnotations } from '@modelcontextprotocol/server';
+import type { AuthCollectionSlug, CollectionSlug, GlobalSlug, MaybePromise, PayloadRequest, SanitizedPermissions, TypedUser } from 'payload';
+import type { GetAuthorizedMCPArgs } from './endpoint/access.js';
 import type { MCPCollectionAuthToolName, MCPCollectionBuiltinName, MCPGlobalBuiltinName } from './mcp/builtinTools.js';
 export type { MCPCollectionAuthToolName, MCPCollectionBuiltinName, MCPGlobalBuiltinName };
-/** Re-exported from `@modelcontextprotocol/server` — the JSON Schema shape the MCP runtime validates against. */
-export type { JsonSchemaType, StandardSchemaWithJSON };
+/** Re-exported from `@modelcontextprotocol/server` — common MCP types used in plugin config. */
+export type { JsonSchemaType, StandardSchemaWithJSON, ToolAnnotations };
 /**
  * What a tool's `input` (or a prompt's `argsSchema`) can be — either a raw
  * JSON Schema literal, or a Standard Schema instance (Zod, Valibot, …).
  */
 export type ToolInputSchema = JsonSchemaType | StandardSchemaWithJSON;
-/**
- * Serializable mirror of `SanitizedMCPPluginConfig` for client components —
- * the full sanitized config carries functions (tool handlers, etc.) that can't
- * cross the server→client boundary. Built by `sanitizeClientPluginConfig` and
- * passed to the `AccessField` component via `clientProps`.
- *
- * @internal
- */
-export type ClientMCPPluginConfig = {
-    items: Array<{
-        collectionSlug?: string;
-        configKey: string;
-        description?: string;
-        globalSlug?: string;
-        /** Admin-UI bucket for collection/global tools: built-in CRUD, auth, or custom. */
-        group?: 'auth' | 'custom' | 'operations';
-        label: string;
-        type: 'collectionTool' | 'globalTool' | 'prompt' | 'resource' | 'tool';
-    }>;
-};
 export type MCPToolResponse = {
     content: ContentBlock[];
     /**
@@ -44,6 +25,16 @@ export type MCPResponseOverride = (response: MCPToolResponse, doc: Record<string
  * its inferred output; anything else falls back to `Record<string, unknown>`.
  */
 export type TypedInput<TSchema> = TSchema extends StandardSchemaWithJSON ? StandardSchemaWithJSON extends TSchema ? Record<string, unknown> : StandardSchemaWithJSON.InferOutput<TSchema> : Record<string, unknown>;
+export type MCPAccessArgs = {
+    permissions?: SanitizedPermissions;
+    req: PayloadRequest;
+};
+export type CollectionMCPAccessArgs = {
+    collectionSlug: CollectionSlug;
+} & MCPAccessArgs;
+export type GlobalMCPAccessArgs = {
+    globalSlug: GlobalSlug;
+} & MCPAccessArgs;
 export type ToolHandlerArgs<TSchema = undefined> = {
     authorizedMCP: AuthorizedMCP;
     input: TypedInput<TSchema>;
@@ -57,6 +48,8 @@ export type GlobalToolHandlerArgs<TSchema = undefined> = {
     globalSlug: GlobalSlug;
 } & ToolHandlerArgs<TSchema>;
 export type Tool<TSchema extends ToolInputSchema | undefined = ToolInputSchema | undefined> = {
+    access?: (args: MCPAccessArgs) => MaybePromise<boolean>;
+    annotations?: ToolAnnotations;
     description: string;
     handler: (args: ToolHandlerArgs<TSchema>) => MaybePromise<MCPToolResponse>;
     input?: TSchema;
@@ -66,19 +59,30 @@ export type Tool<TSchema extends ToolInputSchema | undefined = ToolInputSchema |
     overrideResponse?: MCPResponseOverride;
 };
 export type CollectionTool<TSchema extends ToolInputSchema | undefined = ToolInputSchema | undefined> = {
+    access?: (args: CollectionMCPAccessArgs) => MaybePromise<boolean>;
     handler: (args: CollectionToolHandlerArgs<TSchema>) => MaybePromise<MCPToolResponse>;
     input?: TSchema;
-} & Pick<Tool, 'description' | 'overrideResponse'>;
+} & Pick<Tool, 'annotations' | 'description' | 'overrideResponse'>;
 export type GlobalTool<TSchema extends ToolInputSchema | undefined = ToolInputSchema | undefined> = {
+    access?: (args: GlobalMCPAccessArgs) => MaybePromise<boolean>;
     handler: (args: GlobalToolHandlerArgs<TSchema>) => MaybePromise<MCPToolResponse>;
     input?: TSchema;
-} & Pick<Tool, 'description' | 'overrideResponse'>;
+} & Pick<Tool, 'annotations' | 'description' | 'overrideResponse'>;
 /**
  * Configures (or disables) a built-in tool without replacing it.
  * `handler?: never` prevents a full `CollectionTool`/`GlobalTool` (which has a
  * required handler) from being silently accepted at a built-in key slot.
  */
-export type MCPBuiltInToolOverride = {
+export type MCPBuiltInCollectionToolOverride = {
+    access?: (args: CollectionMCPAccessArgs) => MaybePromise<boolean>;
+    annotations?: ToolAnnotations;
+    description?: string;
+    handler?: never;
+    overrideResponse?: MCPResponseOverride;
+};
+export type MCPBuiltInGlobalToolOverride = {
+    access?: (args: GlobalMCPAccessArgs) => MaybePromise<boolean>;
+    annotations?: ToolAnnotations;
     description?: string;
     handler?: never;
     overrideResponse?: MCPResponseOverride;
@@ -90,19 +94,19 @@ export type MCPBuiltInToolOverride = {
  */
 export type MCPTopLevelToolEntry = Tool;
 export type MCPCollectionToolsMap = {
-    [customToolName: string]: boolean | CollectionTool | MCPBuiltInToolOverride | undefined;
+    [customToolName: string]: boolean | CollectionTool | MCPBuiltInCollectionToolOverride | undefined;
 } & {
-    [K in MCPCollectionBuiltinName]?: false | MCPBuiltInToolOverride;
+    [K in MCPCollectionBuiltinName]?: false | MCPBuiltInCollectionToolOverride;
 };
 export type MCPAuthCollectionToolsMap = {
-    [K in MCPCollectionAuthToolName]?: MCPBuiltInToolOverride | true;
+    [K in MCPCollectionAuthToolName]?: MCPBuiltInCollectionToolOverride | true;
 } & MCPCollectionToolsMap;
 /** Auth-enabled collections get auth-tool name autocomplete; others get CRUD-only. */
 export type MCPToolsMapForCollection<Slug extends CollectionSlug> = Slug extends AuthCollectionSlug ? MCPAuthCollectionToolsMap : MCPCollectionToolsMap;
 export type MCPGlobalToolsMap = {
-    [customToolName: string]: boolean | GlobalTool | MCPBuiltInToolOverride | undefined;
+    [customToolName: string]: boolean | GlobalTool | MCPBuiltInGlobalToolOverride | undefined;
 } & {
-    [K in MCPGlobalBuiltinName]?: false | MCPBuiltInToolOverride;
+    [K in MCPGlobalBuiltinName]?: false | MCPBuiltInGlobalToolOverride;
 };
 export type MCPTopLevelToolsMap = Record<string, Tool>;
 export type PromptHandlerArgs<TSchema = undefined> = {
@@ -111,6 +115,7 @@ export type PromptHandlerArgs<TSchema = undefined> = {
     serverContext: ServerContext;
 };
 export type Prompt<TSchema extends ToolInputSchema = ToolInputSchema> = {
+    access?: (args: MCPAccessArgs) => MaybePromise<boolean>;
     argsSchema: TSchema;
     description: string;
     handler: (args: PromptHandlerArgs<TSchema>) => MaybePromise<{
@@ -132,6 +137,7 @@ export type ResourceHandlerArgs = {
     uri: URL;
 };
 export type Resource = {
+    access?: (args: MCPAccessArgs) => MaybePromise<boolean>;
     description: string;
     handler: (args: ResourceHandlerArgs) => MaybePromise<{
         contents: Array<{
@@ -165,7 +171,7 @@ export type MCPPluginConfig = {
     collections?: {
         [Slug in CollectionSlug]?: MCPPluginCollectionConfig<Slug>;
     };
-    /** Skip MCP registration. The API key collection is still added (so DB / types stay stable). */
+    /** Skip MCP endpoint registration. */
     disabled?: boolean;
     globals?: {
         [Slug in GlobalSlug]?: MCPPluginGlobalConfig;
@@ -174,75 +180,29 @@ export type MCPPluginConfig = {
         serverOptions?: MCPServerOptions;
         verboseLogs?: boolean;
     };
-    overrideApiKeyCollection?: (collection: CollectionConfig) => CollectionConfig;
-    /** Replace the default API-key auth with a custom resolver. */
-    overrideAuth?: (args: {
-        getAPIKeyDoc: (overrideApiKey?: string) => Promise<MCPAPIKeysDoc>;
-        getAuthorizedMCP: (args: {
-            apiKeyDoc: MCPAPIKeysDoc;
-        }) => AuthorizedMCP;
+    /** Replace the default MCP authorization resolver. */
+    overrideGetAuthorizedMCP?: (args: {
         pluginConfig: SanitizedMCPPluginConfig;
-        req: PayloadRequest;
-    }) => MaybePromise<AuthorizedMCP>;
+    } & GetAuthorizedMCPArgs) => MaybePromise<AuthorizedMCP>;
     prompts?: Record<string, Prompt>;
     resources?: Record<string, Resource>;
     /** Cross-cutting tools (not scoped to any collection or global). */
     tools?: MCPTopLevelToolsMap;
-    userCollection?: CollectionSlug;
 };
 export type SanitizedMCPPluginConfig = {
     items: MCPItem[];
-    userCollection: CollectionSlug;
-} & Pick<MCPPluginConfig, 'disabled' | 'mcp' | 'overrideApiKeyCollection' | 'overrideAuth'>;
+} & Pick<MCPPluginConfig, 'disabled' | 'mcp' | 'overrideGetAuthorizedMCP'>;
 export type MCPServerOptions = {
     options?: ConstructorParameters<typeof McpServer>[1];
     serverInfo?: Partial<ConstructorParameters<typeof McpServer>[0]>;
 };
 /**
- * Nested access tree as stored in the collection.
- * A `false` leaf disables that tool; missing keys defer to
- * defaults (built-in CRUD is on, opt-in tools are off).
- */
-export type MCPAPIKeysDocAccessTree = {
-    collections?: {
-        [CollectionSlug: CollectionSlug]: {
-            [ToolKey: string]: boolean;
-        };
-    };
-    globals?: {
-        [GlobalSlug: GlobalSlug]: {
-            [ToolKey: string]: boolean;
-        };
-    };
-    prompts?: {
-        [PromptKey: string]: boolean;
-    };
-    resources?: {
-        [ResourceKey: string]: boolean;
-    };
-    tools?: {
-        [ToolKey: string]: boolean;
-    };
-};
-/**
- * Stored on `payload-mcp-api-keys` docs
- */
-export type MCPAPIKeysDoc = {
-    access: MCPAPIKeysDocAccessTree;
-    apiKey?: string;
-    apiKeyIndex?: string;
-    id: DefaultDocumentIDType;
-    lastUsed?: string;
-    overrideAccess?: boolean;
-    user: null | TypedUser;
-};
-/**
- * One MCP primitive plus the metadata needed for access checks, admin UI, and
+ * One MCP primitive plus the metadata needed for config-driven filtering and
  * registration.
  *
- * - `configKey`: the config/API-key identifier, e.g. `find` or `echo`.
+ * - `configKey`: the config identifier, e.g. `find` or `echo`.
  * - `mcpName`: the MCP wire name, e.g. `findDocuments` or `echo`.
- * - `label`: human-readable admin checkbox text.
+ * - `label`: human-readable display text.
  */
 export type MCPItemBase = {
     configKey: string;
@@ -270,10 +230,10 @@ export type MCPItem = ({
     type: 'tool';
 } & MCPItemBase) | CollectionMCPItem | GlobalMCPItem;
 /**
- * The caller's identity + the MCP items they can use for this request. Returned
- * by `getAuthorizedMCP`; denied items are simply absent from `items`. Handlers
- * receive this via `args.authorizedMCP` so they can spread
- * `localAPIDefaults(authorizedMCP)` into every local API call.
+ * The caller's identity + the MCP items authorized for this request. Disabled
+ * items and items blocked by access callbacks or Payload operation access are
+ * absent from `items`. Tool handlers receive this via `args.authorizedMCP` so
+ * they can spread `localAPIDefaults(authorizedMCP)` into every local API call.
  */
 export type AuthorizedMCP = {
     items: MCPItem[];

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,YAAY,EACZ,cAAc,EACd,SAAS,EACT,gBAAgB,EAChB,aAAa,EACb,sBAAsB,EACvB,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EACV,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,qBAAqB,EACrB,UAAU,EACV,YAAY,EACZ,cAAc,EACd,SAAS,EACV,MAAM,SAAS,CAAA;AAEhB,OAAO,KAAK,EACV,yBAAyB,EACzB,wBAAwB,EACxB,oBAAoB,EACrB,MAAM,uBAAuB,CAAA;AAE9B,YAAY,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,CAAA;AAEzF,iHAAiH;AACjH,YAAY,EAAE,cAAc,EAAE,sBAAsB,EAAE,CAAA;AAEtD;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,cAAc,GAAG,sBAAsB,CAAA;AAErE;;;;;;;GAOG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,KAAK,EAAE,KAAK,CAAC;QACX,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB,SAAS,EAAE,MAAM,CAAA;QACjB,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,mFAAmF;QACnF,KAAK,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,YAAY,CAAA;QACxC,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,EAAE,gBAAgB,GAAG,YAAY,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,CAAA;KACvE,CAAC,CAAA;CACH,CAAA;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,YAAY,EAAE,CAAA;IACvB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B,GAAG,IAAI,CAAC,cAAc,EAAE,OAAO,GAAG,SAAS,GAAG,mBAAmB,CAAC,CAAA;AAEnE,MAAM,MAAM,mBAAmB,GAAG,CAChC,QAAQ,EAAE,eAAe,EACzB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,GAAG,EAAE,cAAc,KAChB,eAAe,CAAA;AAEpB;;;GAGG;AACH,MAAM,MAAM,UAAU,CAAC,OAAO,IAAI,OAAO,SAAS,sBAAsB,GACpE,sBAAsB,SAAS,OAAO,GACpC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACvB,sBAAsB,CAAC,WAAW,CAAC,OAAO,CAAC,GAC7C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE3B,MAAM,MAAM,eAAe,CAAC,OAAO,GAAG,SAAS,IAAI;IACjD,aAAa,EAAE,aAAa,CAAA;IAC5B,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAA;IAC1B,GAAG,EAAE,cAAc,CAAA;IACnB,aAAa,EAAE,aAAa,CAAA;CAC7B,CAAA;AAED,MAAM,MAAM,yBAAyB,CAAC,OAAO,GAAG,SAAS,IAAI;IAC3D,cAAc,EAAE,cAAc,CAAA;CAC/B,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;AAE5B,MAAM,MAAM,qBAAqB,CAAC,OAAO,GAAG,SAAS,IAAI;IACvD,UAAU,EAAE,UAAU,CAAA;CACvB,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;AAE5B,MAAM,MAAM,IAAI,CAAC,OAAO,SAAS,eAAe,GAAG,SAAS,GAAG,eAAe,GAAG,SAAS,IAAI;IAC5F,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,CAAC,IAAI,EAAE,eAAe,CAAC,OAAO,CAAC,KAAK,YAAY,CAAC,eAAe,CAAC,CAAA;IAC1E,KAAK,CAAC,EAAE,OAAO,CAAA;IACf;;OAEG;IACH,gBAAgB,CAAC,EAAE,mBAAmB,CAAA;CACvC,CAAA;AAED,MAAM,MAAM,cAAc,CACxB,OAAO,SAAS,eAAe,GAAG,SAAS,GAAG,eAAe,GAAG,SAAS,IACvE;IACF,OAAO,EAAE,CAAC,IAAI,EAAE,yBAAyB,CAAC,OAAO,CAAC,KAAK,YAAY,CAAC,eAAe,CAAC,CAAA;IACpF,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB,GAAG,IAAI,CAAC,IAAI,EAAE,aAAa,GAAG,kBAAkB,CAAC,CAAA;AAElD,MAAM,MAAM,UAAU,CAAC,OAAO,SAAS,eAAe,GAAG,SAAS,GAAG,eAAe,GAAG,SAAS,IAC9F;IACE,OAAO,EAAE,CAAC,IAAI,EAAE,qBAAqB,CAAC,OAAO,CAAC,KAAK,YAAY,CAAC,eAAe,CAAC,CAAA;IAChF,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB,GAAG,IAAI,CAAC,IAAI,EAAE,aAAa,GAAG,kBAAkB,CAAC,CAAA;AAEpD;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,KAAK,CAAA;IACf,gBAAgB,CAAC,EAAE,mBAAmB,CAAA;CACvC,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAA;AAEvC,MAAM,MAAM,qBAAqB,GAAG;IAClC,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,GAAG,cAAc,GAAG,sBAAsB,GAAG,SAAS,CAAA;CACxF,GAAG;KACD,CAAC,IAAI,wBAAwB,CAAC,CAAC,EAAE,KAAK,GAAG,sBAAsB;CACjE,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG;KACrC,CAAC,IAAI,yBAAyB,CAAC,CAAC,EAAE,sBAAsB,GAAG,IAAI;CACjE,GAAG,qBAAqB,CAAA;AAEzB,sFAAsF;AACtF,MAAM,MAAM,wBAAwB,CAAC,IAAI,SAAS,cAAc,IAAI,IAAI,SAAS,kBAAkB,GAC/F,yBAAyB,GACzB,qBAAqB,CAAA;AAEzB,MAAM,MAAM,iBAAiB,GAAG;IAC9B,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,sBAAsB,GAAG,SAAS,CAAA;CACpF,GAAG;KACD,CAAC,IAAI,oBAAoB,CAAC,CAAC,EAAE,KAAK,GAAG,sBAAsB;CAC7D,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;AAEtD,MAAM,MAAM,iBAAiB,CAAC,OAAO,GAAG,SAAS,IAAI;IACnD,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAA;IAC1B,GAAG,EAAE,cAAc,CAAA;IACnB,aAAa,EAAE,aAAa,CAAA;CAC7B,CAAA;AAED,MAAM,MAAM,MAAM,CAAC,OAAO,SAAS,eAAe,GAAG,eAAe,IAAI;IACtE,UAAU,EAAE,OAAO,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,CAAC,IAAI,EAAE,iBAAiB,CAAC,OAAO,CAAC,KAAK,YAAY,CAAC;QAC1D,QAAQ,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE;gBAAE,IAAI,EAAE,MAAM,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAA;aAAE,CAAC;YAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAAA;SAAE,CAAC,CAAA;KACzF,CAAC,CAAA;IACF,KAAK,EAAE,MAAM,CAAA;CACd,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,yFAAyF;IACzF,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9B,GAAG,EAAE,cAAc,CAAA;IACnB,aAAa,EAAE,aAAa,CAAA;IAC5B,GAAG,EAAE,GAAG,CAAA;CACT,CAAA;AAED,MAAM,MAAM,QAAQ,GAAG;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,CAAC,IAAI,EAAE,mBAAmB,KAAK,YAAY,CAAC;QACnD,QAAQ,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAC/C,CAAC,CAAA;IACF,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,gBAAgB,GAAG,MAAM,CAAA;CAC/B,CAAA;AAED,MAAM,MAAM,yBAAyB,CAAC,KAAK,SAAS,cAAc,IAAI;IACpE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,mBAAmB,CAAA;IACtC,KAAK,CAAC,EAAE,wBAAwB,CAAC,KAAK,CAAC,CAAA;CACxC,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,gBAAgB,CAAC,EAAE,mBAAmB,CAAA;IACtC,KAAK,CAAC,EAAE,iBAAiB,CAAA;CAC1B,CAAA;AAED;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,WAAW,CAAC,EAAE;SACX,IAAI,IAAI,cAAc,CAAC,CAAC,EAAE,yBAAyB,CAAC,IAAI,CAAC;KAC3D,CAAA;IACD,gGAAgG;IAChG,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,OAAO,CAAC,EAAE;SACP,IAAI,IAAI,UAAU,CAAC,CAAC,EAAE,qBAAqB;KAC7C,CAAA;IACD,GAAG,CAAC,EAAE;QACJ,aAAa,CAAC,EAAE,gBAAgB,CAAA;QAChC,WAAW,CAAC,EAAE,OAAO,CAAA;KACtB,CAAA;IACD,wBAAwB,CAAC,EAAE,CAAC,UAAU,EAAE,gBAAgB,KAAK,gBAAgB,CAAA;IAC7E,+DAA+D;IAC/D,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE;QACpB,YAAY,EAAE,CAAC,cAAc,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAA;QACjE,gBAAgB,EAAE,CAAC,IAAI,EAAE;YAAE,SAAS,EAAE,aAAa,CAAA;SAAE,KAAK,aAAa,CAAA;QACvE,YAAY,EAAE,wBAAwB,CAAA;QACtC,GAAG,EAAE,cAAc,CAAA;KACpB,KAAK,YAAY,CAAC,aAAa,CAAC,CAAA;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACpC,oEAAoE;IACpE,KAAK,CAAC,EAAE,mBAAmB,CAAA;IAC3B,cAAc,CAAC,EAAE,cAAc,CAAA;CAChC,CAAA;AAED,MAAM,MAAM,wBAAwB,GAAG;IACrC,KAAK,EAAE,OAAO,EAAE,CAAA;IAChB,cAAc,EAAE,cAAc,CAAA;CAC/B,GAAG,IAAI,CAAC,eAAe,EAAE,UAAU,GAAG,KAAK,GAAG,0BAA0B,GAAG,cAAc,CAAC,CAAA;AAE3F,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,CAAC,EAAE,qBAAqB,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAA;IACpD,UAAU,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;CACjE,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,WAAW,CAAC,EAAE;QACZ,CAAC,cAAc,EAAE,cAAc,GAAG;YAChC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAA;SAC3B,CAAA;KACF,CAAA;IACD,OAAO,CAAC,EAAE;QACR,CAAC,UAAU,EAAE,UAAU,GAAG;YACxB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAA;SAC3B,CAAA;KACF,CAAA;IACD,OAAO,CAAC,EAAE;QACR,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAA;KAC7B,CAAA;IACD,SAAS,CAAC,EAAE;QACV,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAA;KAC/B,CAAA;IACD,KAAK,CAAC,EAAE;QACN,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAA;KAC3B,CAAA;CACF,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,uBAAuB,CAAA;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,EAAE,EAAE,qBAAqB,CAAA;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,IAAI,EAAE,IAAI,GAAG,SAAS,CAAA;CACvB,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,cAAc,EAAE,cAAc,CAAA;IAC9B,IAAI,EAAE,cAAc,CAAA;IACpB,IAAI,EAAE,gBAAgB,CAAA;CACvB,GAAG,WAAW,CAAA;AAEf,MAAM,MAAM,aAAa,GAAG;IAC1B,UAAU,EAAE,UAAU,CAAA;IACtB,IAAI,EAAE,UAAU,CAAA;IAChB,IAAI,EAAE,YAAY,CAAA;CACnB,GAAG,WAAW,CAAA;AAEf,MAAM,MAAM,OAAO,GACf,CAAC;IACC,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,QAAQ,CAAA;CACf,GAAG,WAAW,CAAC,GAChB,CAAC;IACC,QAAQ,EAAE,QAAQ,CAAA;IAClB,IAAI,EAAE,UAAU,CAAA;CACjB,GAAG,WAAW,CAAC,GAChB,CAAC;IACC,IAAI,EAAE,IAAI,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;CACb,GAAG,WAAW,CAAC,GAChB,iBAAiB,GACjB,aAAa,CAAA;AAEjB;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,KAAK,EAAE,OAAO,EAAE,CAAA;IAChB,cAAc,EAAE,OAAO,CAAA;IACvB,IAAI,EAAE,IAAI,GAAG,SAAS,CAAA;CACvB,CAAA"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,YAAY,EACZ,cAAc,EACd,SAAS,EACT,gBAAgB,EAChB,aAAa,EACb,sBAAsB,EACtB,eAAe,EAChB,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EACV,kBAAkB,EAClB,cAAc,EACd,UAAU,EACV,YAAY,EACZ,cAAc,EACd,oBAAoB,EACpB,SAAS,EACV,MAAM,SAAS,CAAA;AAEhB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAChE,OAAO,KAAK,EACV,yBAAyB,EACzB,wBAAwB,EACxB,oBAAoB,EACrB,MAAM,uBAAuB,CAAA;AAE9B,YAAY,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,CAAA;AAEzF,gGAAgG;AAChG,YAAY,EAAE,cAAc,EAAE,sBAAsB,EAAE,eAAe,EAAE,CAAA;AAEvE;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,cAAc,GAAG,sBAAsB,CAAA;AAErE,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,YAAY,EAAE,CAAA;IACvB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B,GAAG,IAAI,CAAC,cAAc,EAAE,OAAO,GAAG,SAAS,GAAG,mBAAmB,CAAC,CAAA;AAEnE,MAAM,MAAM,mBAAmB,GAAG,CAChC,QAAQ,EAAE,eAAe,EACzB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,GAAG,EAAE,cAAc,KAChB,eAAe,CAAA;AAEpB;;;GAGG;AACH,MAAM,MAAM,UAAU,CAAC,OAAO,IAAI,OAAO,SAAS,sBAAsB,GACpE,sBAAsB,SAAS,OAAO,GACpC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACvB,sBAAsB,CAAC,WAAW,CAAC,OAAO,CAAC,GAC7C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE3B,MAAM,MAAM,aAAa,GAAG;IAC1B,WAAW,CAAC,EAAE,oBAAoB,CAAA;IAClC,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,cAAc,EAAE,cAAc,CAAA;CAC/B,GAAG,aAAa,CAAA;AAEjB,MAAM,MAAM,mBAAmB,GAAG;IAChC,UAAU,EAAE,UAAU,CAAA;CACvB,GAAG,aAAa,CAAA;AAEjB,MAAM,MAAM,eAAe,CAAC,OAAO,GAAG,SAAS,IAAI;IACjD,aAAa,EAAE,aAAa,CAAA;IAC5B,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAA;IAC1B,GAAG,EAAE,cAAc,CAAA;IACnB,aAAa,EAAE,aAAa,CAAA;CAC7B,CAAA;AAED,MAAM,MAAM,yBAAyB,CAAC,OAAO,GAAG,SAAS,IAAI;IAC3D,cAAc,EAAE,cAAc,CAAA;CAC/B,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;AAE5B,MAAM,MAAM,qBAAqB,CAAC,OAAO,GAAG,SAAS,IAAI;IACvD,UAAU,EAAE,UAAU,CAAA;CACvB,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;AAE5B,MAAM,MAAM,IAAI,CAAC,OAAO,SAAS,eAAe,GAAG,SAAS,GAAG,eAAe,GAAG,SAAS,IAAI;IAC5F,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,aAAa,KAAK,YAAY,CAAC,OAAO,CAAC,CAAA;IACvD,WAAW,CAAC,EAAE,eAAe,CAAA;IAC7B,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,CAAC,IAAI,EAAE,eAAe,CAAC,OAAO,CAAC,KAAK,YAAY,CAAC,eAAe,CAAC,CAAA;IAC1E,KAAK,CAAC,EAAE,OAAO,CAAA;IACf;;OAEG;IACH,gBAAgB,CAAC,EAAE,mBAAmB,CAAA;CACvC,CAAA;AAED,MAAM,MAAM,cAAc,CACxB,OAAO,SAAS,eAAe,GAAG,SAAS,GAAG,eAAe,GAAG,SAAS,IACvE;IACF,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,uBAAuB,KAAK,YAAY,CAAC,OAAO,CAAC,CAAA;IACjE,OAAO,EAAE,CAAC,IAAI,EAAE,yBAAyB,CAAC,OAAO,CAAC,KAAK,YAAY,CAAC,eAAe,CAAC,CAAA;IACpF,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB,GAAG,IAAI,CAAC,IAAI,EAAE,aAAa,GAAG,aAAa,GAAG,kBAAkB,CAAC,CAAA;AAElE,MAAM,MAAM,UAAU,CAAC,OAAO,SAAS,eAAe,GAAG,SAAS,GAAG,eAAe,GAAG,SAAS,IAC9F;IACE,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,mBAAmB,KAAK,YAAY,CAAC,OAAO,CAAC,CAAA;IAC7D,OAAO,EAAE,CAAC,IAAI,EAAE,qBAAqB,CAAC,OAAO,CAAC,KAAK,YAAY,CAAC,eAAe,CAAC,CAAA;IAChF,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB,GAAG,IAAI,CAAC,IAAI,EAAE,aAAa,GAAG,aAAa,GAAG,kBAAkB,CAAC,CAAA;AAEpE;;;;GAIG;AACH,MAAM,MAAM,gCAAgC,GAAG;IAC7C,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,uBAAuB,KAAK,YAAY,CAAC,OAAO,CAAC,CAAA;IACjE,WAAW,CAAC,EAAE,eAAe,CAAA;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,KAAK,CAAA;IACf,gBAAgB,CAAC,EAAE,mBAAmB,CAAA;CACvC,CAAA;AAED,MAAM,MAAM,4BAA4B,GAAG;IACzC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,mBAAmB,KAAK,YAAY,CAAC,OAAO,CAAC,CAAA;IAC7D,WAAW,CAAC,EAAE,eAAe,CAAA;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,KAAK,CAAA;IACf,gBAAgB,CAAC,EAAE,mBAAmB,CAAA;CACvC,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAA;AAEvC,MAAM,MAAM,qBAAqB,GAAG;IAClC,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,GAAG,cAAc,GAAG,gCAAgC,GAAG,SAAS,CAAA;CAClG,GAAG;KACD,CAAC,IAAI,wBAAwB,CAAC,CAAC,EAAE,KAAK,GAAG,gCAAgC;CAC3E,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG;KACrC,CAAC,IAAI,yBAAyB,CAAC,CAAC,EAAE,gCAAgC,GAAG,IAAI;CAC3E,GAAG,qBAAqB,CAAA;AAEzB,sFAAsF;AACtF,MAAM,MAAM,wBAAwB,CAAC,IAAI,SAAS,cAAc,IAAI,IAAI,SAAS,kBAAkB,GAC/F,yBAAyB,GACzB,qBAAqB,CAAA;AAEzB,MAAM,MAAM,iBAAiB,GAAG;IAC9B,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,4BAA4B,GAAG,SAAS,CAAA;CAC1F,GAAG;KACD,CAAC,IAAI,oBAAoB,CAAC,CAAC,EAAE,KAAK,GAAG,4BAA4B;CACnE,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;AAEtD,MAAM,MAAM,iBAAiB,CAAC,OAAO,GAAG,SAAS,IAAI;IACnD,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAA;IAC1B,GAAG,EAAE,cAAc,CAAA;IACnB,aAAa,EAAE,aAAa,CAAA;CAC7B,CAAA;AAED,MAAM,MAAM,MAAM,CAAC,OAAO,SAAS,eAAe,GAAG,eAAe,IAAI;IACtE,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,aAAa,KAAK,YAAY,CAAC,OAAO,CAAC,CAAA;IACvD,UAAU,EAAE,OAAO,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,CAAC,IAAI,EAAE,iBAAiB,CAAC,OAAO,CAAC,KAAK,YAAY,CAAC;QAC1D,QAAQ,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE;gBAAE,IAAI,EAAE,MAAM,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAA;aAAE,CAAC;YAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAAA;SAAE,CAAC,CAAA;KACzF,CAAC,CAAA;IACF,KAAK,EAAE,MAAM,CAAA;CACd,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,yFAAyF;IACzF,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9B,GAAG,EAAE,cAAc,CAAA;IACnB,aAAa,EAAE,aAAa,CAAA;IAC5B,GAAG,EAAE,GAAG,CAAA;CACT,CAAA;AAED,MAAM,MAAM,QAAQ,GAAG;IACrB,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,aAAa,KAAK,YAAY,CAAC,OAAO,CAAC,CAAA;IACvD,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,CAAC,IAAI,EAAE,mBAAmB,KAAK,YAAY,CAAC;QACnD,QAAQ,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAC/C,CAAC,CAAA;IACF,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,gBAAgB,GAAG,MAAM,CAAA;CAC/B,CAAA;AAED,MAAM,MAAM,yBAAyB,CAAC,KAAK,SAAS,cAAc,IAAI;IACpE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,mBAAmB,CAAA;IACtC,KAAK,CAAC,EAAE,wBAAwB,CAAC,KAAK,CAAC,CAAA;CACxC,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,gBAAgB,CAAC,EAAE,mBAAmB,CAAA;IACtC,KAAK,CAAC,EAAE,iBAAiB,CAAA;CAC1B,CAAA;AAED;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,WAAW,CAAC,EAAE;SACX,IAAI,IAAI,cAAc,CAAC,CAAC,EAAE,yBAAyB,CAAC,IAAI,CAAC;KAC3D,CAAA;IACD,sCAAsC;IACtC,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,OAAO,CAAC,EAAE;SACP,IAAI,IAAI,UAAU,CAAC,CAAC,EAAE,qBAAqB;KAC7C,CAAA;IACD,GAAG,CAAC,EAAE;QACJ,aAAa,CAAC,EAAE,gBAAgB,CAAA;QAChC,WAAW,CAAC,EAAE,OAAO,CAAA;KACtB,CAAA;IACD,sDAAsD;IACtD,wBAAwB,CAAC,EAAE,CACzB,IAAI,EAAE;QACJ,YAAY,EAAE,wBAAwB,CAAA;KACvC,GAAG,oBAAoB,KACrB,YAAY,CAAC,aAAa,CAAC,CAAA;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACpC,oEAAoE;IACpE,KAAK,CAAC,EAAE,mBAAmB,CAAA;CAC5B,CAAA;AAED,MAAM,MAAM,wBAAwB,GAAG;IACrC,KAAK,EAAE,OAAO,EAAE,CAAA;CACjB,GAAG,IAAI,CAAC,eAAe,EAAE,UAAU,GAAG,KAAK,GAAG,0BAA0B,CAAC,CAAA;AAE1E,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,CAAC,EAAE,qBAAqB,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAA;IACpD,UAAU,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;CACjE,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,cAAc,EAAE,cAAc,CAAA;IAC9B,IAAI,EAAE,cAAc,CAAA;IACpB,IAAI,EAAE,gBAAgB,CAAA;CACvB,GAAG,WAAW,CAAA;AAEf,MAAM,MAAM,aAAa,GAAG;IAC1B,UAAU,EAAE,UAAU,CAAA;IACtB,IAAI,EAAE,UAAU,CAAA;IAChB,IAAI,EAAE,YAAY,CAAA;CACnB,GAAG,WAAW,CAAA;AAEf,MAAM,MAAM,OAAO,GACf,CAAC;IACC,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,QAAQ,CAAA;CACf,GAAG,WAAW,CAAC,GAChB,CAAC;IACC,QAAQ,EAAE,QAAQ,CAAA;IAClB,IAAI,EAAE,UAAU,CAAA;CACjB,GAAG,WAAW,CAAC,GAChB,CAAC;IACC,IAAI,EAAE,IAAI,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;CACb,GAAG,WAAW,CAAC,GAChB,iBAAiB,GACjB,aAAa,CAAA;AAEjB;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,KAAK,EAAE,OAAO,EAAE,CAAA;IAChB,cAAc,EAAE,OAAO,CAAA;IACvB,IAAI,EAAE,IAAI,GAAG,SAAS,CAAA;CACvB,CAAA"}

package/dist/types.js

@@ -1,8 +1,8 @@
 /**
- * The caller's identity + the MCP items they can use for this request. Returned
- * by `getAuthorizedMCP`; denied items are simply absent from `items`. Handlers
- * receive this via `args.authorizedMCP` so they can spread
- * `localAPIDefaults(authorizedMCP)` into every local API call.
+ * The caller's identity + the MCP items authorized for this request. Disabled
+ * items and items blocked by access callbacks or Payload operation access are
+ * absent from `items`. Tool handlers receive this via `args.authorizedMCP` so
+ * they can spread `localAPIDefaults(authorizedMCP)` into every local API call.
  */ export { };
 
 //# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/types.ts"],"sourcesContent":["import type {\n  CallToolResult,\n  ContentBlock,\n  JsonSchemaType,\n  McpServer,\n  ResourceTemplate,\n  ServerContext,\n  StandardSchemaWithJSON,\n} from '@modelcontextprotocol/server'\nimport type {\n  AuthCollectionSlug,\n  CollectionConfig,\n  CollectionSlug,\n  DefaultDocumentIDType,\n  GlobalSlug,\n  MaybePromise,\n  PayloadRequest,\n  TypedUser,\n} from 'payload'\n\nimport type {\n  MCPCollectionAuthToolName,\n  MCPCollectionBuiltinName,\n  MCPGlobalBuiltinName,\n} from './mcp/builtinTools.js'\n\nexport type { MCPCollectionAuthToolName, MCPCollectionBuiltinName, MCPGlobalBuiltinName }\n\n/** Re-exported from `@modelcontextprotocol/server` — the JSON Schema shape the MCP runtime validates against. */\nexport type { JsonSchemaType, StandardSchemaWithJSON }\n\n/**\n * What a tool's `input` (or a prompt's `argsSchema`) can be — either a raw\n * JSON Schema literal, or a Standard Schema instance (Zod, Valibot, …).\n */\nexport type ToolInputSchema = JsonSchemaType | StandardSchemaWithJSON\n\n/**\n * Serializable mirror of `SanitizedMCPPluginConfig` for client components —\n * the full sanitized config carries functions (tool handlers, etc.) that can't\n * cross the server→client boundary. Built by `sanitizeClientPluginConfig` and\n * passed to the `AccessField` component via `clientProps`.\n *\n * @internal\n */\nexport type ClientMCPPluginConfig = {\n  items: Array<{\n    collectionSlug?: string\n    configKey: string\n    description?: string\n    globalSlug?: string\n    /** Admin-UI bucket for collection/global tools: built-in CRUD, auth, or custom. */\n    group?: 'auth' | 'custom' | 'operations'\n    label: string\n    type: 'collectionTool' | 'globalTool' | 'prompt' | 'resource' | 'tool'\n  }>\n}\n\nexport type MCPToolResponse = {\n  content: ContentBlock[]\n  /**\n   * If available, return the document fetched within the\n   * mcp tool. This is threaded as an additional argument to\n   * overrideResponse functions and stripped before going on the wire.\n   */\n  doc?: Record<string, unknown>\n} & Pick<CallToolResult, '_meta' | 'isError' | 'structuredContent'>\n\nexport type MCPResponseOverride = (\n  response: MCPToolResponse,\n  doc: Record<string, unknown>,\n  req: PayloadRequest,\n) => MCPToolResponse\n\n/**\n * The handler's `input` type. A specific Standard Schema (Zod, Valibot, …) gets\n * its inferred output; anything else falls back to `Record<string, unknown>`.\n */\nexport type TypedInput<TSchema> = TSchema extends StandardSchemaWithJSON\n  ? StandardSchemaWithJSON extends TSchema\n    ? Record<string, unknown>\n    : StandardSchemaWithJSON.InferOutput<TSchema>\n  : Record<string, unknown>\n\nexport type ToolHandlerArgs<TSchema = undefined> = {\n  authorizedMCP: AuthorizedMCP\n  input: TypedInput<TSchema>\n  req: PayloadRequest\n  serverContext: ServerContext\n}\n\nexport type CollectionToolHandlerArgs<TSchema = undefined> = {\n  collectionSlug: CollectionSlug\n} & ToolHandlerArgs<TSchema>\n\nexport type GlobalToolHandlerArgs<TSchema = undefined> = {\n  globalSlug: GlobalSlug\n} & ToolHandlerArgs<TSchema>\n\nexport type Tool<TSchema extends ToolInputSchema | undefined = ToolInputSchema | undefined> = {\n  description: string\n  handler: (args: ToolHandlerArgs<TSchema>) => MaybePromise<MCPToolResponse>\n  input?: TSchema\n  /**\n   * Override the return value of the tool handler\n   */\n  overrideResponse?: MCPResponseOverride\n}\n\nexport type CollectionTool<\n  TSchema extends ToolInputSchema | undefined = ToolInputSchema | undefined,\n> = {\n  handler: (args: CollectionToolHandlerArgs<TSchema>) => MaybePromise<MCPToolResponse>\n  input?: TSchema\n} & Pick<Tool, 'description' | 'overrideResponse'>\n\nexport type GlobalTool<TSchema extends ToolInputSchema | undefined = ToolInputSchema | undefined> =\n  {\n    handler: (args: GlobalToolHandlerArgs<TSchema>) => MaybePromise<MCPToolResponse>\n    input?: TSchema\n  } & Pick<Tool, 'description' | 'overrideResponse'>\n\n/**\n * Configures (or disables) a built-in tool without replacing it.\n * `handler?: never` prevents a full `CollectionTool`/`GlobalTool` (which has a\n * required handler) from being silently accepted at a built-in key slot.\n */\nexport type MCPBuiltInToolOverride = {\n  description?: string\n  handler?: never\n  overrideResponse?: MCPResponseOverride\n}\n\n/**\n * Value at a custom (non-built-in) tool key. Either the tool itself, or `false`\n * to disable it (useful when one plugin defines a custom tool and another\n * wants to opt out per-collection).\n */\nexport type MCPTopLevelToolEntry = Tool\n\nexport type MCPCollectionToolsMap = {\n  [customToolName: string]: boolean | CollectionTool | MCPBuiltInToolOverride | undefined\n} & {\n  [K in MCPCollectionBuiltinName]?: false | MCPBuiltInToolOverride\n}\n\nexport type MCPAuthCollectionToolsMap = {\n  [K in MCPCollectionAuthToolName]?: MCPBuiltInToolOverride | true\n} & MCPCollectionToolsMap\n\n/** Auth-enabled collections get auth-tool name autocomplete; others get CRUD-only. */\nexport type MCPToolsMapForCollection<Slug extends CollectionSlug> = Slug extends AuthCollectionSlug\n  ? MCPAuthCollectionToolsMap\n  : MCPCollectionToolsMap\n\nexport type MCPGlobalToolsMap = {\n  [customToolName: string]: boolean | GlobalTool | MCPBuiltInToolOverride | undefined\n} & {\n  [K in MCPGlobalBuiltinName]?: false | MCPBuiltInToolOverride\n}\n\nexport type MCPTopLevelToolsMap = Record<string, Tool>\n\nexport type PromptHandlerArgs<TSchema = undefined> = {\n  input: TypedInput<TSchema>\n  req: PayloadRequest\n  serverContext: ServerContext\n}\n\nexport type Prompt<TSchema extends ToolInputSchema = ToolInputSchema> = {\n  argsSchema: TSchema\n  description: string\n  handler: (args: PromptHandlerArgs<TSchema>) => MaybePromise<{\n    messages: Array<{ content: { text: string; type: 'text' }; role: 'assistant' | 'user' }>\n  }>\n  title: string\n}\n\nexport type ResourceHandlerArgs = {\n  /** Variables extracted from a `ResourceTemplate` URI. Empty for static-URI resources. */\n  params: Record<string, string>\n  req: PayloadRequest\n  serverContext: ServerContext\n  uri: URL\n}\n\nexport type Resource = {\n  description: string\n  handler: (args: ResourceHandlerArgs) => MaybePromise<{\n    contents: Array<{ text: string; uri: string }>\n  }>\n  mimeType: string\n  title: string\n  uri: ResourceTemplate | string\n}\n\nexport type MCPPluginCollectionConfig<TSlug extends CollectionSlug> = {\n  description?: string\n  /** Fallback for built-in tools that don't set their own `overrideResponse`. */\n  overrideResponse?: MCPResponseOverride\n  tools?: MCPToolsMapForCollection<TSlug>\n}\n\nexport type MCPPluginGlobalConfig = {\n  description?: string\n  overrideResponse?: MCPResponseOverride\n  tools?: MCPGlobalToolsMap\n}\n\n/**\n * The user-facing config shape passed to `mcpPlugin({ ... })`. Tools, prompts,\n * resources, and per-collection/global tool maps live in their own nested\n * fields. `sanitizeMCPConfig` flattens those into `items` and applies defaults\n * to produce a `SanitizedMCPPluginConfig` — the form every internal consumer\n * actually works with.\n */\nexport type MCPPluginConfig = {\n  collections?: {\n    [Slug in CollectionSlug]?: MCPPluginCollectionConfig<Slug>\n  }\n  /** Skip MCP registration. The API key collection is still added (so DB / types stay stable). */\n  disabled?: boolean\n  globals?: {\n    [Slug in GlobalSlug]?: MCPPluginGlobalConfig\n  }\n  mcp?: {\n    serverOptions?: MCPServerOptions\n    verboseLogs?: boolean\n  }\n  overrideApiKeyCollection?: (collection: CollectionConfig) => CollectionConfig\n  /** Replace the default API-key auth with a custom resolver. */\n  overrideAuth?: (args: {\n    getAPIKeyDoc: (overrideApiKey?: string) => Promise<MCPAPIKeysDoc>\n    getAuthorizedMCP: (args: { apiKeyDoc: MCPAPIKeysDoc }) => AuthorizedMCP\n    pluginConfig: SanitizedMCPPluginConfig\n    req: PayloadRequest\n  }) => MaybePromise<AuthorizedMCP>\n  prompts?: Record<string, Prompt>\n  resources?: Record<string, Resource>\n  /** Cross-cutting tools (not scoped to any collection or global). */\n  tools?: MCPTopLevelToolsMap\n  userCollection?: CollectionSlug\n}\n\nexport type SanitizedMCPPluginConfig = {\n  items: MCPItem[]\n  userCollection: CollectionSlug\n} & Pick<MCPPluginConfig, 'disabled' | 'mcp' | 'overrideApiKeyCollection' | 'overrideAuth'>\n\nexport type MCPServerOptions = {\n  options?: ConstructorParameters<typeof McpServer>[1]\n  serverInfo?: Partial<ConstructorParameters<typeof McpServer>[0]>\n}\n\n/**\n * Nested access tree as stored in the collection.\n * A `false` leaf disables that tool; missing keys defer to\n * defaults (built-in CRUD is on, opt-in tools are off).\n */\nexport type MCPAPIKeysDocAccessTree = {\n  collections?: {\n    [CollectionSlug: CollectionSlug]: {\n      [ToolKey: string]: boolean\n    }\n  }\n  globals?: {\n    [GlobalSlug: GlobalSlug]: {\n      [ToolKey: string]: boolean\n    }\n  }\n  prompts?: {\n    [PromptKey: string]: boolean\n  }\n  resources?: {\n    [ResourceKey: string]: boolean\n  }\n  tools?: {\n    [ToolKey: string]: boolean\n  }\n}\n\n/**\n * Stored on `payload-mcp-api-keys` docs\n */\nexport type MCPAPIKeysDoc = {\n  access: MCPAPIKeysDocAccessTree\n  apiKey?: string\n  apiKeyIndex?: string\n  id: DefaultDocumentIDType\n  lastUsed?: string\n  overrideAccess?: boolean\n  user: null | TypedUser\n}\n\n/**\n * One MCP primitive plus the metadata needed for access checks, admin UI, and\n * registration.\n *\n * - `configKey`: the config/API-key identifier, e.g. `find` or `echo`.\n * - `mcpName`: the MCP wire name, e.g. `findDocuments` or `echo`.\n * - `label`: human-readable admin checkbox text.\n */\nexport type MCPItemBase = {\n  configKey: string\n  label: string\n  mcpName: string\n}\n\nexport type CollectionMCPItem = {\n  collectionSlug: CollectionSlug\n  tool: CollectionTool\n  type: 'collectionTool'\n} & MCPItemBase\n\nexport type GlobalMCPItem = {\n  globalSlug: GlobalSlug\n  tool: GlobalTool\n  type: 'globalTool'\n} & MCPItemBase\n\nexport type MCPItem =\n  | ({\n      prompt: Prompt\n      type: 'prompt'\n    } & MCPItemBase)\n  | ({\n      resource: Resource\n      type: 'resource'\n    } & MCPItemBase)\n  | ({\n      tool: Tool\n      type: 'tool'\n    } & MCPItemBase)\n  | CollectionMCPItem\n  | GlobalMCPItem\n\n/**\n * The caller's identity + the MCP items they can use for this request. Returned\n * by `getAuthorizedMCP`; denied items are simply absent from `items`. Handlers\n * receive this via `args.authorizedMCP` so they can spread\n * `localAPIDefaults(authorizedMCP)` into every local API call.\n */\nexport type AuthorizedMCP = {\n  items: MCPItem[]\n  overrideAccess: boolean\n  user: null | TypedUser\n}\n"],"names":[],"mappings":"AAgVA;;;;;CAKC,GACD,WAIC"}
+{"version":3,"sources":["../src/types.ts"],"sourcesContent":["import type {\n  CallToolResult,\n  ContentBlock,\n  JsonSchemaType,\n  McpServer,\n  ResourceTemplate,\n  ServerContext,\n  StandardSchemaWithJSON,\n  ToolAnnotations,\n} from '@modelcontextprotocol/server'\nimport type {\n  AuthCollectionSlug,\n  CollectionSlug,\n  GlobalSlug,\n  MaybePromise,\n  PayloadRequest,\n  SanitizedPermissions,\n  TypedUser,\n} from 'payload'\n\nimport type { GetAuthorizedMCPArgs } from './endpoint/access.js'\nimport type {\n  MCPCollectionAuthToolName,\n  MCPCollectionBuiltinName,\n  MCPGlobalBuiltinName,\n} from './mcp/builtinTools.js'\n\nexport type { MCPCollectionAuthToolName, MCPCollectionBuiltinName, MCPGlobalBuiltinName }\n\n/** Re-exported from `@modelcontextprotocol/server` — common MCP types used in plugin config. */\nexport type { JsonSchemaType, StandardSchemaWithJSON, ToolAnnotations }\n\n/**\n * What a tool's `input` (or a prompt's `argsSchema`) can be — either a raw\n * JSON Schema literal, or a Standard Schema instance (Zod, Valibot, …).\n */\nexport type ToolInputSchema = JsonSchemaType | StandardSchemaWithJSON\n\nexport type MCPToolResponse = {\n  content: ContentBlock[]\n  /**\n   * If available, return the document fetched within the\n   * mcp tool. This is threaded as an additional argument to\n   * overrideResponse functions and stripped before going on the wire.\n   */\n  doc?: Record<string, unknown>\n} & Pick<CallToolResult, '_meta' | 'isError' | 'structuredContent'>\n\nexport type MCPResponseOverride = (\n  response: MCPToolResponse,\n  doc: Record<string, unknown>,\n  req: PayloadRequest,\n) => MCPToolResponse\n\n/**\n * The handler's `input` type. A specific Standard Schema (Zod, Valibot, …) gets\n * its inferred output; anything else falls back to `Record<string, unknown>`.\n */\nexport type TypedInput<TSchema> = TSchema extends StandardSchemaWithJSON\n  ? StandardSchemaWithJSON extends TSchema\n    ? Record<string, unknown>\n    : StandardSchemaWithJSON.InferOutput<TSchema>\n  : Record<string, unknown>\n\nexport type MCPAccessArgs = {\n  permissions?: SanitizedPermissions\n  req: PayloadRequest\n}\n\nexport type CollectionMCPAccessArgs = {\n  collectionSlug: CollectionSlug\n} & MCPAccessArgs\n\nexport type GlobalMCPAccessArgs = {\n  globalSlug: GlobalSlug\n} & MCPAccessArgs\n\nexport type ToolHandlerArgs<TSchema = undefined> = {\n  authorizedMCP: AuthorizedMCP\n  input: TypedInput<TSchema>\n  req: PayloadRequest\n  serverContext: ServerContext\n}\n\nexport type CollectionToolHandlerArgs<TSchema = undefined> = {\n  collectionSlug: CollectionSlug\n} & ToolHandlerArgs<TSchema>\n\nexport type GlobalToolHandlerArgs<TSchema = undefined> = {\n  globalSlug: GlobalSlug\n} & ToolHandlerArgs<TSchema>\n\nexport type Tool<TSchema extends ToolInputSchema | undefined = ToolInputSchema | undefined> = {\n  access?: (args: MCPAccessArgs) => MaybePromise<boolean>\n  annotations?: ToolAnnotations\n  description: string\n  handler: (args: ToolHandlerArgs<TSchema>) => MaybePromise<MCPToolResponse>\n  input?: TSchema\n  /**\n   * Override the return value of the tool handler\n   */\n  overrideResponse?: MCPResponseOverride\n}\n\nexport type CollectionTool<\n  TSchema extends ToolInputSchema | undefined = ToolInputSchema | undefined,\n> = {\n  access?: (args: CollectionMCPAccessArgs) => MaybePromise<boolean>\n  handler: (args: CollectionToolHandlerArgs<TSchema>) => MaybePromise<MCPToolResponse>\n  input?: TSchema\n} & Pick<Tool, 'annotations' | 'description' | 'overrideResponse'>\n\nexport type GlobalTool<TSchema extends ToolInputSchema | undefined = ToolInputSchema | undefined> =\n  {\n    access?: (args: GlobalMCPAccessArgs) => MaybePromise<boolean>\n    handler: (args: GlobalToolHandlerArgs<TSchema>) => MaybePromise<MCPToolResponse>\n    input?: TSchema\n  } & Pick<Tool, 'annotations' | 'description' | 'overrideResponse'>\n\n/**\n * Configures (or disables) a built-in tool without replacing it.\n * `handler?: never` prevents a full `CollectionTool`/`GlobalTool` (which has a\n * required handler) from being silently accepted at a built-in key slot.\n */\nexport type MCPBuiltInCollectionToolOverride = {\n  access?: (args: CollectionMCPAccessArgs) => MaybePromise<boolean>\n  annotations?: ToolAnnotations\n  description?: string\n  handler?: never\n  overrideResponse?: MCPResponseOverride\n}\n\nexport type MCPBuiltInGlobalToolOverride = {\n  access?: (args: GlobalMCPAccessArgs) => MaybePromise<boolean>\n  annotations?: ToolAnnotations\n  description?: string\n  handler?: never\n  overrideResponse?: MCPResponseOverride\n}\n\n/**\n * Value at a custom (non-built-in) tool key. Either the tool itself, or `false`\n * to disable it (useful when one plugin defines a custom tool and another\n * wants to opt out per-collection).\n */\nexport type MCPTopLevelToolEntry = Tool\n\nexport type MCPCollectionToolsMap = {\n  [customToolName: string]: boolean | CollectionTool | MCPBuiltInCollectionToolOverride | undefined\n} & {\n  [K in MCPCollectionBuiltinName]?: false | MCPBuiltInCollectionToolOverride\n}\n\nexport type MCPAuthCollectionToolsMap = {\n  [K in MCPCollectionAuthToolName]?: MCPBuiltInCollectionToolOverride | true\n} & MCPCollectionToolsMap\n\n/** Auth-enabled collections get auth-tool name autocomplete; others get CRUD-only. */\nexport type MCPToolsMapForCollection<Slug extends CollectionSlug> = Slug extends AuthCollectionSlug\n  ? MCPAuthCollectionToolsMap\n  : MCPCollectionToolsMap\n\nexport type MCPGlobalToolsMap = {\n  [customToolName: string]: boolean | GlobalTool | MCPBuiltInGlobalToolOverride | undefined\n} & {\n  [K in MCPGlobalBuiltinName]?: false | MCPBuiltInGlobalToolOverride\n}\n\nexport type MCPTopLevelToolsMap = Record<string, Tool>\n\nexport type PromptHandlerArgs<TSchema = undefined> = {\n  input: TypedInput<TSchema>\n  req: PayloadRequest\n  serverContext: ServerContext\n}\n\nexport type Prompt<TSchema extends ToolInputSchema = ToolInputSchema> = {\n  access?: (args: MCPAccessArgs) => MaybePromise<boolean>\n  argsSchema: TSchema\n  description: string\n  handler: (args: PromptHandlerArgs<TSchema>) => MaybePromise<{\n    messages: Array<{ content: { text: string; type: 'text' }; role: 'assistant' | 'user' }>\n  }>\n  title: string\n}\n\nexport type ResourceHandlerArgs = {\n  /** Variables extracted from a `ResourceTemplate` URI. Empty for static-URI resources. */\n  params: Record<string, string>\n  req: PayloadRequest\n  serverContext: ServerContext\n  uri: URL\n}\n\nexport type Resource = {\n  access?: (args: MCPAccessArgs) => MaybePromise<boolean>\n  description: string\n  handler: (args: ResourceHandlerArgs) => MaybePromise<{\n    contents: Array<{ text: string; uri: string }>\n  }>\n  mimeType: string\n  title: string\n  uri: ResourceTemplate | string\n}\n\nexport type MCPPluginCollectionConfig<TSlug extends CollectionSlug> = {\n  description?: string\n  /** Fallback for built-in tools that don't set their own `overrideResponse`. */\n  overrideResponse?: MCPResponseOverride\n  tools?: MCPToolsMapForCollection<TSlug>\n}\n\nexport type MCPPluginGlobalConfig = {\n  description?: string\n  overrideResponse?: MCPResponseOverride\n  tools?: MCPGlobalToolsMap\n}\n\n/**\n * The user-facing config shape passed to `mcpPlugin({ ... })`. Tools, prompts,\n * resources, and per-collection/global tool maps live in their own nested\n * fields. `sanitizeMCPConfig` flattens those into `items` and applies defaults\n * to produce a `SanitizedMCPPluginConfig` — the form every internal consumer\n * actually works with.\n */\nexport type MCPPluginConfig = {\n  collections?: {\n    [Slug in CollectionSlug]?: MCPPluginCollectionConfig<Slug>\n  }\n  /** Skip MCP endpoint registration. */\n  disabled?: boolean\n  globals?: {\n    [Slug in GlobalSlug]?: MCPPluginGlobalConfig\n  }\n  mcp?: {\n    serverOptions?: MCPServerOptions\n    verboseLogs?: boolean\n  }\n  /** Replace the default MCP authorization resolver. */\n  overrideGetAuthorizedMCP?: (\n    args: {\n      pluginConfig: SanitizedMCPPluginConfig\n    } & GetAuthorizedMCPArgs,\n  ) => MaybePromise<AuthorizedMCP>\n  prompts?: Record<string, Prompt>\n  resources?: Record<string, Resource>\n  /** Cross-cutting tools (not scoped to any collection or global). */\n  tools?: MCPTopLevelToolsMap\n}\n\nexport type SanitizedMCPPluginConfig = {\n  items: MCPItem[]\n} & Pick<MCPPluginConfig, 'disabled' | 'mcp' | 'overrideGetAuthorizedMCP'>\n\nexport type MCPServerOptions = {\n  options?: ConstructorParameters<typeof McpServer>[1]\n  serverInfo?: Partial<ConstructorParameters<typeof McpServer>[0]>\n}\n\n/**\n * One MCP primitive plus the metadata needed for config-driven filtering and\n * registration.\n *\n * - `configKey`: the config identifier, e.g. `find` or `echo`.\n * - `mcpName`: the MCP wire name, e.g. `findDocuments` or `echo`.\n * - `label`: human-readable display text.\n */\nexport type MCPItemBase = {\n  configKey: string\n  label: string\n  mcpName: string\n}\n\nexport type CollectionMCPItem = {\n  collectionSlug: CollectionSlug\n  tool: CollectionTool\n  type: 'collectionTool'\n} & MCPItemBase\n\nexport type GlobalMCPItem = {\n  globalSlug: GlobalSlug\n  tool: GlobalTool\n  type: 'globalTool'\n} & MCPItemBase\n\nexport type MCPItem =\n  | ({\n      prompt: Prompt\n      type: 'prompt'\n    } & MCPItemBase)\n  | ({\n      resource: Resource\n      type: 'resource'\n    } & MCPItemBase)\n  | ({\n      tool: Tool\n      type: 'tool'\n    } & MCPItemBase)\n  | CollectionMCPItem\n  | GlobalMCPItem\n\n/**\n * The caller's identity + the MCP items authorized for this request. Disabled\n * items and items blocked by access callbacks or Payload operation access are\n * absent from `items`. Tool handlers receive this via `args.authorizedMCP` so\n * they can spread `localAPIDefaults(authorizedMCP)` into every local API call.\n */\nexport type AuthorizedMCP = {\n  items: MCPItem[]\n  overrideAccess: boolean\n  user: null | TypedUser\n}\n"],"names":[],"mappings":"AA6SA;;;;;CAKC,GACD,WAIC"}

package/dist/utils/getPluginConfig.d.ts

@@ -3,7 +3,7 @@ import type { SanitizedMCPPluginConfig } from '../types.js';
 /**
  * Returns the sanitized plugin config — the form produced by
  * `sanitizeMCPConfig` and stashed back on the plugin's `options` during init.
- * Callers downstream of plugin init can rely on `items`, `userCollection`, etc.
+ * Callers downstream of plugin init can rely on `items` and other defaults
  * being fully resolved.
  */
 export declare const getPluginConfig: (args: {

package/dist/utils/getPluginConfig.js

@@ -1,7 +1,7 @@
 /**
  * Returns the sanitized plugin config — the form produced by
  * `sanitizeMCPConfig` and stashed back on the plugin's `options` during init.
- * Callers downstream of plugin init can rely on `items`, `userCollection`, etc.
+ * Callers downstream of plugin init can rely on `items` and other defaults
  * being fully resolved.
  */ export const getPluginConfig = ({ config })=>{
     const plugin = config.plugins?.find((plugin)=>plugin.slug === '@payloadcms/plugin-mcp');

package/dist/utils/getPluginConfig.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utils/getPluginConfig.ts"],"sourcesContent":["import type { PluginsMap, SanitizedConfig } from 'payload'\n\nimport type { SanitizedMCPPluginConfig } from '../types.js'\n\n/**\n * Returns the sanitized plugin config — the form produced by\n * `sanitizeMCPConfig` and stashed back on the plugin's `options` during init.\n * Callers downstream of plugin init can rely on `items`, `userCollection`, etc.\n * being fully resolved.\n */\nexport const getPluginConfig: (args: { config: SanitizedConfig }) => SanitizedMCPPluginConfig = ({\n  config,\n}) => {\n  const plugin = config.plugins?.find(\n    (plugin) => plugin.slug === '@payloadcms/plugin-mcp',\n  ) as PluginsMap['@payloadcms/plugin-mcp']\n\n  if (!plugin) {\n    throw new Error('MCP Plugin not found in config.plugins.')\n  }\n\n  // @ts-expect-error\n  return plugin.sanitizedOptions\n}\n"],"names":["getPluginConfig","config","plugin","plugins","find","slug","Error","sanitizedOptions"],"mappings":"AAIA;;;;;CAKC,GACD,OAAO,MAAMA,kBAAmF,CAAC,EAC/FC,MAAM,EACP;IACC,MAAMC,SAASD,OAAOE,OAAO,EAAEC,KAC7B,CAACF,SAAWA,OAAOG,IAAI,KAAK;IAG9B,IAAI,CAACH,QAAQ;QACX,MAAM,IAAII,MAAM;IAClB;IAEA,mBAAmB;IACnB,OAAOJ,OAAOK,gBAAgB;AAChC,EAAC"}
+{"version":3,"sources":["../../src/utils/getPluginConfig.ts"],"sourcesContent":["import type { PluginsMap, SanitizedConfig } from 'payload'\n\nimport type { SanitizedMCPPluginConfig } from '../types.js'\n\n/**\n * Returns the sanitized plugin config — the form produced by\n * `sanitizeMCPConfig` and stashed back on the plugin's `options` during init.\n * Callers downstream of plugin init can rely on `items` and other defaults\n * being fully resolved.\n */\nexport const getPluginConfig: (args: { config: SanitizedConfig }) => SanitizedMCPPluginConfig = ({\n  config,\n}) => {\n  const plugin = config.plugins?.find(\n    (plugin) => plugin.slug === '@payloadcms/plugin-mcp',\n  ) as PluginsMap['@payloadcms/plugin-mcp']\n\n  if (!plugin) {\n    throw new Error('MCP Plugin not found in config.plugins.')\n  }\n\n  // @ts-expect-error\n  return plugin.sanitizedOptions\n}\n"],"names":["getPluginConfig","config","plugin","plugins","find","slug","Error","sanitizedOptions"],"mappings":"AAIA;;;;;CAKC,GACD,OAAO,MAAMA,kBAAmF,CAAC,EAC/FC,MAAM,EACP;IACC,MAAMC,SAASD,OAAOE,OAAO,EAAEC,KAC7B,CAACF,SAAWA,OAAOG,IAAI,KAAK;IAG9B,IAAI,CAACH,QAAQ;QACX,MAAM,IAAII,MAAM;IAClB;IAEA,mBAAmB;IACnB,OAAOJ,OAAOK,gBAAgB;AAChC,EAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payloadcms/plugin-mcp",
-  "version": "4.0.0-internal.688c4d0",
+  "version": "4.0.0-internal.bc5cf8c",
   "description": "MCP (Model Context Protocol) capabilities with Payload",
   "keywords": [
     "plugin",
@@ -21,9 +21,6 @@
       "url": "https://payloadcms.com"
     }
   ],
-  "sideEffects": [
-    "*.css"
-  ],
   "type": "module",
   "exports": {
     ".": {
@@ -40,6 +37,11 @@
       "import": "./dist/stdio.js",
       "types": "./dist/stdio.d.ts",
       "default": "./dist/stdio.js"
+    },
+    "./internal": {
+      "import": "./dist/internal.js",
+      "types": "./dist/internal.d.ts",
+      "default": "./dist/internal.js"
     }
   },
   "main": "./dist/index.js",
@@ -56,20 +58,14 @@
     "@cfworker/json-schema": "^4.1.1",
     "@modelcontextprotocol/server": "2.0.0-alpha.2",
     "tsx": "4.22.4",
-    "zod": "^4.0.0",
-    "@payloadcms/translations": "4.0.0-internal.688c4d0"
+    "zod": "^4.0.0"
   },
   "devDependencies": {
-    "@types/react": "19.2.14",
-    "react": "^19.0.1 || ^19.1.2 || ^19.2.1",
-    "payload": "4.0.0-internal.688c4d0",
     "@payloadcms/eslint-config": "3.28.0",
-    "@payloadcms/ui": "4.0.0-internal.688c4d0"
+    "payload": "4.0.0-internal.bc5cf8c"
   },
   "peerDependencies": {
-    "react": "^19.0.1 || ^19.1.2 || ^19.2.1",
-    "@payloadcms/ui": "4.0.0-internal.688c4d0",
-    "payload": "4.0.0-internal.688c4d0"
+    "payload": "4.0.0-internal.bc5cf8c"
   },
   "//deps_notes": {
     "zod": "zod is a hard dependency of @modelcontextprotocol/server, thus we can safely use it without it impacting bundle size. Make extra sure the zod version here matches exactly what's defined in the dependencies of @modelcontextprotocol/server to avoid duplicate versions being installed.",

package/src/defaultAccess.ts

@@ -0,0 +1,3 @@
+import type { MCPAccessArgs } from './types.js'
+
+export const defaultAccess = ({ req }: MCPAccessArgs): boolean => Boolean(req.user)