@pmoses-s1/s1-secops-mcp 1.3.5 → 1.3.6

package/CHANGELOG.md

@@ -1,5 +1,53 @@
 # Changelog
 
+## 1.3.6 - 2026-08-17
+
+Behaviour change, found by deploying to a real site and not being able to see the
+result.
+
+### Changed
+
+- **`isPublic` / `public` now defaults to TRUE on dashboard creation** in both
+  clients, where the raw `createDashboardV2` API defaults it to false.
+
+  `access.owner` is set to the calling identity. With an API service-account
+  token that is `serviceuser-<uuid>@mgmt-<n>.sentinelone.net`, not a person, so a
+  private dashboard is readable through the API and **invisible in the console to
+  the human operator at any scope**. That is indistinguishable from a failed
+  deploy: the tool reports success, the object exists, and the user sees nothing.
+
+  Verified live: the identical config at the identical site scope went from
+  invisible to visible purely by recreating it with `public: true`, and every
+  pre-existing dashboard at that site carried `public: true`.
+
+  Pass `isPublic: false` / `public=False` deliberately for a dashboard that
+  should stay private to the service account. `shareResource` to a scope does not
+  flip `public`; the two are independent.
+
+### Documented
+
+- **Dashboard names reject punctuation, with only `Invalid name` as the error.**
+  Probed one character class at a time against a live tenant:
+
+  | Accepted | Rejected |
+  |---|---|
+  | letters, digits, space, `-`, `_`, `.`, `/` | `(` `)` `[` `]` `{` `}` `:` `,` `&` `'` `%` `#` |
+
+  So `My Dashboard (prod)` fails with no indication of which character offended.
+  Recorded in the tool description, both client docstrings,
+  `sdl-api/references/config-file-graphql.md` and
+  `sdl-dashboard/references/deployment.md`.
+
+### Tests
+
+115 JS (+1), 61 Python client (+2), 19 panel-safety. The two default-value
+assertions were updated and paired with explicit-false cases, so an accidental
+revert of the default fails the suite.
+
+### Docker
+
+Bundle image stays **1.3.2**; its npm pin moves to 1.3.6.
+
 ## 1.3.5 - 2026-08-17
 
 Completes the scope work in 1.3.4. **Upgrade from 1.3.4 is recommended.**

package/README.md

@@ -73,7 +73,7 @@ Add this to `claude_desktop_config.json` (or `.mcp.json` for Claude Code):
   "mcpServers": {
     "s1-secops-mcp": {
       "command": "npx",
-      "args": ["-y", "@pmoses-s1/s1-secops-mcp@1.3.5"],
+      "args": ["-y", "@pmoses-s1/s1-secops-mcp@1.3.6"],
       "env": {
         "S1_CONSOLE_URL":       "https://usea1-yourorg.sentinelone.net",
         "S1_CONSOLE_API_TOKEN": "eyJ...",

package/deploy/README.md

@@ -57,7 +57,7 @@ Or, equivalently, by package name without the install:
   "mcpServers": {
     "s1-secops-mcp": {
       "command": "npx",
-      "args": ["-y", "@pmoses-s1/s1-secops-mcp@1.3.5"]
+      "args": ["-y", "@pmoses-s1/s1-secops-mcp@1.3.6"]
     }
   }
 }
@@ -376,7 +376,7 @@ Both block the W+X memory mappings V8 needs to JIT JavaScript. Adding them cause
 
 These are supported but not first-class:
 
-- **Docker / docker-compose.** Not shipped in this version. The single-file Node binary doesn't need it. If you want a container, the install is `FROM node:20-alpine` + `RUN npm install -g @pmoses-s1/s1-secops-mcp@1.3.5` + `CMD ["s1-secops-mcp", "--transport", "http", "--host", "0.0.0.0"]`. Mount creds at `/etc/s1-secops-mcp/credentials.json` and tokens at `/etc/s1-secops-mcp/bearer-tokens.json`.
+- **Docker / docker-compose.** Not shipped in this version. The single-file Node binary doesn't need it. If you want a container, the install is `FROM node:20-alpine` + `RUN npm install -g @pmoses-s1/s1-secops-mcp@1.3.6` + `CMD ["s1-secops-mcp", "--transport", "http", "--host", "0.0.0.0"]`. Mount creds at `/etc/s1-secops-mcp/credentials.json` and tokens at `/etc/s1-secops-mcp/bearer-tokens.json`.
 
 - **External bridge (`supergateway`, `mcp-proxy`).** Pre-1.1.0 deployments used these to wrap the stdio-only server. They still work; this server's native HTTP mode is functionally equivalent and removes the extra process. Prefer native unless you have a specific reason.
 

package/lib/sdl.js

@@ -516,13 +516,25 @@ export async function getDashboard({ id, name, scope }) {
  * "Content is invalid json" / "Additional text after JSON object". Going
  * through this function cannot hit that class of error.
  *
+ * `isPublic` DEFAULTS TO TRUE, unlike the raw API, which defaults it to false.
+ * `access.owner` is set to the calling identity; with a service-account token that
+ * is `serviceuser-<uuid>@mgmt-<n>.sentinelone.net`, not a person. A private
+ * service-user dashboard is readable through the API and INVISIBLE in the console
+ * to the human operator, at any scope, which is indistinguishable from a failed
+ * deploy. Verified live: the same config at the same scope became visible purely
+ * by recreating it with public true. Pass `isPublic: false` deliberately if the
+ * dashboard really should be private to the service account.
+ *
+ * Names reject punctuation and answer only "Invalid name". Accepted: letters,
+ * digits, space, `-`, `_`, `.`, `/`. Rejected: `( ) [ ] { } : , & ' % #`.
+ *
  * DUPLICATE NAMES ARE ALLOWED HERE, unlike putConfigFile. The console itself
  * creates "<name> - Copy" siblings, and shareResource addresses dashboards by
  * id, so duplicate names are not the footgun they are for name-addressed
  * config-file writes. Set `failIfNameExists` to opt into the stricter
  * behaviour; it costs one extra listing call.
  */
-export async function createDashboard({ name, config, isPublic = false, scope, failIfNameExists = false }) {
+export async function createDashboard({ name, config, isPublic = true, scope, failIfNameExists = false }) {
   if (!name || typeof name !== 'string') throw new Error('createDashboard requires a name');
   if (typeof config !== 'string' || !config.trim()) {
     throw new Error('createDashboard requires config as a JSON string (the full dashboard document).');

package/lib/server-core.js

@@ -94,7 +94,7 @@ const PROMPTS = [
 
 export const SERVER_INFO = {
   name: 's1-secops-mcp-server',
-  version: '1.3.5',
+  version: '1.3.6',
 };
 
 export const PROTOCOL_VERSION = '2024-11-05';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pmoses-s1/s1-secops-mcp",
-  "version": "1.3.5",
+  "version": "1.3.6",
   "description": "MCP server orchestrating SentinelOne skills, APIs, and SOC analyst context. Stdio or Streamable HTTP transport with per-user bearer auth for team deployments.",
   "type": "module",
   "main": "index.js",

package/tools/sdl-api.js

@@ -213,13 +213,13 @@ export const tools = [
   // ─── sdl_create_dashboard ─────────────────────────────────────────────────
   {
     name: 'sdl_create_dashboard',
-    description: `Create a dashboard from a complete dashboard-JSON document via createDashboardV2, filed at the given scope. THIS IS THE PREFERRED WAY TO DEPLOY A NEW DASHBOARD: it accepts the whole document (configType, duration, description, tabs[]) in one call, unlike sdl_put_file which writes the raw config file. It also avoids the console's stub-append trap, where creating an empty dashboard in the UI and pasting JSON after the existing "{graphs: []}" stub yields "Content is invalid json / Additional text after JSON object" and leaves an empty dashboard behind. To deploy to a SITE, either pass scope as "<accountId>:<siteId>" here, or create at account scope and then use sdl_share_dashboard. Duplicate names ARE allowed (the console itself makes "<name> - Copy" siblings); set failIfNameExists to refuse instead. ${SCOPE_NOTE}`,
+    description: `Create a dashboard from a complete dashboard-JSON document via createDashboardV2, filed at the given scope. THIS IS THE PREFERRED WAY TO DEPLOY A NEW DASHBOARD: it accepts the whole document (configType, duration, description, tabs[]) in one call, unlike sdl_put_file which writes the raw config file. It also avoids the console's stub-append trap, where creating an empty dashboard in the UI and pasting JSON after the existing "{graphs: []}" stub yields "Content is invalid json / Additional text after JSON object" and leaves an empty dashboard behind. To deploy to a SITE, either pass scope as "<accountId>:<siteId>" here, or create at account scope and then use sdl_share_dashboard. Duplicate names ARE allowed (the console itself makes "<name> - Copy" siblings); set failIfNameExists to refuse instead. Names reject punctuation with only "Invalid name" as the error: accepted are letters, digits, space, hyphen, underscore, dot and slash; rejected are ( ) [ ] { } : , & ' % #. ${SCOPE_NOTE}`,
     inputSchema: {
       type: 'object',
       properties: {
         name: { type: 'string', description: 'Dashboard display name, e.g. "Metacortex Site Replica".' },
         config: { type: 'string', description: 'The full dashboard JSON document as a string: {"configType":"TABBED","duration":"24h","description":"...","tabs":[...]}. Validated as JSON before the mutation is sent.' },
-        isPublic: { type: 'boolean', description: 'Share with all users in scope (the console\'s "Public" badge). Default false.' },
+        isPublic: { type: 'boolean', default: true, description: 'Share with all users in scope (the console\'s "Public" badge). DEFAULTS TO TRUE, unlike the raw API. access.owner is the calling identity, so with a service-account token a private dashboard is readable via API but INVISIBLE in the console to the human operator at any scope, which looks exactly like a failed deploy. Set false only if the dashboard should stay private to the service account.' },
         failIfNameExists: { type: 'boolean', description: 'Refuse if a dashboard of this name already exists at this scope. Default false, which permits siblings. Costs one extra listing call.' },
         scope: scopeProp,
       },