@redocly/realm 0.135.0 → 0.136.0-next.0

package/dist/server/plugins/mcp/codemode/capabilities/fetch/index.js

@@ -0,0 +1,4 @@
+import{getCallableApis as a,isFetchCapable as s}from"../../../gateway-mcp/fetch-capability.js";import{FETCH_TOOL_NAME as i}from"../../constants.js";const l=["```ts","/**"," * Call a documented API. Only the callable APIs' documented hosts are reachable."," * Responses cap at 1 MiB and redirects are not followed."," */","declare function fetch(url: string, init?: {","  method?: string;","  /** `content-type` is set automatically for URLSearchParams/FormData unless you set one. */","  headers?: Record<string, string>;","  /** string \xB7 URLSearchParams (\u2192 application/x-www-form-urlencoded) \xB7 FormData (\u2192 multipart/form-data) */","  body?: string | URLSearchParams | FormData;","}): Promise<{","  status: number;","  statusText: string;","  ok: boolean;","  headers: { get(name: string): string | null };","  json(): Promise<unknown>;","  text(): Promise<string>;","}>;","```"].join(`
+`),c=["Example - List the write endpoints of an API and call one of them with `fetch`:","","```ts","const { items } = await tools.listApis({ filter: 'billing' });","const { endpoints } = await tools.getEndpoints({ name: items[0].name });","const ep = endpoints.find((e) => e.method === 'POST' && e.path.includes('invoices'));","const info = await tools.getEndpointInfo({ name: items[0].name, path: ep.path, method: ep.method });","const url = (info.servers?.[0]?.url ?? '') + ep.path;","try {","  const res = await fetch(url, { method: 'POST', body: JSON.stringify({ /* fields from info */ }) });","  return res.ok ? await res.json() : { status: res.status, error: await res.text() };","} catch (error) {","  return { error: error instanceof Error ? error.message : String(error), endpointId: info };","}","```"].join(`
+`);function d(r){const t=new Map;for(const{name:e,version:n}of r){if(!e)continue;const o=t.get(e)??[];n&&o.push(n),t.set(e,o)}return[...t.entries()].map(([e,n])=>n.length>1?`${e} (${n.map(o=>`v${o}`).join(", ")})`:e).join(", ")}const f={id:i,isActive:s,annotations:{readOnlyHint:!1,destructiveHint:!0,openWorldHint:!0},renderSection(r){const t=d(a(r));return["## `fetch` \u2014 call the documented APIs","",l,"","Always call `getEndpointInfo` before `fetch` for the exact URL, required parameters, and body shape. Never guess.","",`Callable APIs (their documented hosts are reachable via \`fetch\`): ${t}`,"",c].join(`
+`)}};export{l as FETCH_DECLARATION,f as fetchCapability};

package/dist/server/plugins/mcp/codemode/capabilities/index.d.ts

@@ -0,0 +1,3 @@
+export type { SandboxCapability } from './types.js';
+export { composeExecuteAnnotations, getActiveCapabilities, renderDescribeToolsOutput, } from './utils.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/server/plugins/mcp/codemode/capabilities/index.js

@@ -0,0 +1 @@
+import{composeExecuteAnnotations as o,getActiveCapabilities as i,renderDescribeToolsOutput as r}from"./utils.js";export{o as composeExecuteAnnotations,i as getActiveCapabilities,r as renderDescribeToolsOutput};

package/dist/server/plugins/mcp/codemode/capabilities/registry.d.ts

@@ -0,0 +1,4 @@
+import type { SandboxCapability } from './types.js';
+/** Every sandbox capability, in the order their sections appear in describe-tools output. */
+export declare const ALL_CAPABILITIES: readonly SandboxCapability[];
+//# sourceMappingURL=registry.d.ts.map

package/dist/server/plugins/mcp/codemode/capabilities/registry.js

@@ -0,0 +1 @@
+import{fetchCapability as t}from"./fetch/index.js";const i=[t];export{i as ALL_CAPABILITIES};

package/dist/server/plugins/mcp/codemode/capabilities/types.d.ts

@@ -0,0 +1,13 @@
+import type { ToolAnnotations } from '@redocly/mcp-typescript-sdk/types.js';
+import type { McpToolContext } from '../../types.js';
+/** A capability is a per-request-gated global the code-mode sandbox exposes beyond the schema-driven `tools.*` surface. */
+export type SandboxCapability = {
+    id: string;
+    /** Whether this capability is live for THIS request (RBAC/config/flag-dependent). */
+    isActive(context: McpToolContext): boolean;
+    /** How this capability changes `execute`'s MCP annotations when active. */
+    annotations: Partial<ToolAnnotations>;
+    /** The self-contained `describe-tools` section for this capability: heading, TS declaration, guidance, and example. */
+    renderSection(context: McpToolContext): string;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/server/plugins/mcp/codemode/capabilities/utils.d.ts

@@ -0,0 +1,13 @@
+import type { ToolAnnotations } from '@redocly/mcp-typescript-sdk/types.js';
+import type { McpToolSchema } from '../../../../types';
+import type { McpToolContext } from '../../types.js';
+import type { SandboxCapability } from './types.js';
+export declare function getActiveCapabilities(context: McpToolContext): SandboxCapability[];
+/** `execute`'s annotations = the read-only base with every active capability's delta merged over it. */
+export declare function composeExecuteAnnotations(active: SandboxCapability[]): ToolAnnotations;
+/**
+ * The describe-tools output: the tool signatures, the always-present
+ * `execute` args note, then one self-contained section per selected capability.
+ */
+export declare function renderDescribeToolsOutput(tools: McpToolSchema[], capabilities: SandboxCapability[], context: McpToolContext): string;
+//# sourceMappingURL=utils.d.ts.map

package/dist/server/plugins/mcp/codemode/capabilities/utils.js

@@ -0,0 +1,7 @@
+import{buildToolTypeDeclarations as i}from"../build-tool-type-declarations.js";import{EXECUTE_BASE_ANNOTATIONS as c}from"../tools/execute-schema.js";import{EXECUTE_ARGS_NOTE as p,USAGE_NOTES as s}from"../prompts.js";import{ALL_CAPABILITIES as u}from"./registry.js";function T(o){return u.filter(t=>t.isActive(o))}function m(o){return o.reduce((t,e)=>({...t,...e.annotations}),{...c})}function l(o,t,e){const n=[];o.length>0&&n.push(`## Sandbox tools
+
+${i(o)}
+
+${s}`),n.push(p);for(const r of t)n.push(r.renderSection(e));return n.join(`
+
+`)}export{m as composeExecuteAnnotations,T as getActiveCapabilities,l as renderDescribeToolsOutput};

package/dist/server/plugins/mcp/codemode/constants.d.ts

@@ -0,0 +1,5 @@
+export declare const EXECUTE_TOOL_NAME = "execute";
+export declare const DESCRIBE_TOOLS_TOOL_NAME = "describe-tools";
+export declare const FETCH_TOOL_NAME = "fetch";
+export declare const CODE_MODE_TOOL_NAMES: ReadonlySet<string>;
+//# sourceMappingURL=constants.d.ts.map

package/dist/server/plugins/mcp/codemode/constants.js

@@ -0,0 +1 @@
+const e="execute",t="describe-tools",E="fetch",O=new Set([e,t]);export{O as CODE_MODE_TOOL_NAMES,t as DESCRIBE_TOOLS_TOOL_NAME,e as EXECUTE_TOOL_NAME,E as FETCH_TOOL_NAME};

package/dist/server/plugins/mcp/codemode/invoke-tool.d.ts

@@ -0,0 +1,4 @@
+import type { McpToolContext, McpToolExtra } from '../types.js';
+/** Call a registered MCP tool from inside the sandbox and return its parsed result. */
+export declare function invokeTool(toolName: string, input: unknown, context: McpToolContext, extra: McpToolExtra): Promise<unknown>;
+//# sourceMappingURL=invoke-tool.d.ts.map

package/dist/server/plugins/mcp/codemode/invoke-tool.js

@@ -0,0 +1 @@
+import{executeMcpTool as i}from"../workers/execute-mcp-tool.js";async function p(t,r,n,c){const e=await i({toolName:t,args:r,context:n,extra:c}),o=u(e);if(e.isError)throw new Error(o);return s(o)}function u(t){return t.content.filter(r=>r.type==="text").map(r=>r.text).join("")}function s(t){try{return JSON.parse(t)}catch{return t}}export{p as invokeTool};

package/dist/server/plugins/mcp/codemode/prompts.d.ts

@@ -0,0 +1,6 @@
+export declare const EXECUTE_ARGS_NOTE = "Both `execute` arguments are required: `code` (the JavaScript to run; return a value to receive it) and `description` (a short human-readable summary of what the code does).";
+export declare function buildExecuteDescription(hasFetch: boolean): string;
+export declare const DESCRIBE_TOOLS_DESCRIPTION: string;
+export declare function buildCodeModeInstructions(hasFetch: boolean): string;
+export declare const USAGE_NOTES = "Types named `OpenApi\u2026` are the standard OpenAPI Specification objects.";
+//# sourceMappingURL=prompts.d.ts.map

package/dist/server/plugins/mcp/codemode/prompts.js

@@ -0,0 +1,4 @@
+const t="Both `execute` arguments are required: `code` (the JavaScript to run; return a value to receive it) and `description` (a short human-readable summary of what the code does).";function o(e){return["Run JavaScript in a sandbox against the documentation tools on the global `tools` object.",e?"The only extra globals are `tools` and `fetch` - there is no `console`, `setTimeout`, `require`, or Node.js API; all other I/O goes through `tools`.":"The only extra global is `tools` - there is no `fetch`, `console`, `setTimeout`, `require`, or Node.js API; all I/O goes through `tools`.","","Workflow - minimize round-trips; one `describe-tools` call plus one `execute` call covers most requests:","1. Analyze the request and decide which sandbox tools it needs (every tool name is listed in the `describe-tools` input schema / description).","2. Call `describe-tools` with those names to get their exact TypeScript signatures. NEVER call `execute` with guessed method names, parameter names, or enum values.","3. Batch everything into a SINGLE script: chain tool calls, pass one call's output into the next, process results in plain JavaScript, and `return` only what the request needs.","",...e?["Example - list the Billing API endpoints and call one of them:","","```ts","const { items } = await tools.listApis({ filter: 'billing' });","const { endpoints } = await tools.getEndpoints({ name: items[0].name });","const ep = endpoints.find((e) => e.method === 'POST' && e.path.includes('invoices'));","const info = await tools.getEndpointInfo({ name: items[0].name, path: ep.path, method: ep.method });","const url = (info.servers?.[0]?.url ?? '') + ep.path;","try {","  const res = await fetch(url, { method: 'POST', body: JSON.stringify({ /* fields from info */ }) });","  return res.ok ? await res.json() : { status: res.status, error: await res.text() };","} catch (error) {","  return { error: error instanceof Error ? error.message : String(error), endpointId: info };","}","```"]:["Example - list the write endpoints of an API:","","```ts","const { items } = await tools.listApis({ filter: 'billing' });","const { endpoints } = await tools.getEndpoints({ name: items[0].name });","const writes = endpoints.filter((e) => e.method !== 'GET');","return { api: items[0].name, writes: writes.map((e) => `${e.method} ${e.path}`) };","```"]].join(`
+`)}const s=["Get the exact TypeScript signatures of the sandbox tools available to `execute`.","Analyze the user request first, then pass `tools` with only the tool names the request needs (every name is listed in this input schema / description); omit `tools` only when you cannot tell which tools apply.","Always call this before your first `execute` and never guess signatures. Request every tool the task may need in ONE call instead of calling this repeatedly."].join(`
+`);function n(e){return["This server exposes documentation tools (API discovery, endpoint details, security schemes, full-text search) through two tools:","- `describe-tools` returns the exact TypeScript signatures of the sandbox tools.","- `execute` runs JavaScript that calls those tools on the global `tools` object.","Workflow: analyze the request, call `describe-tools` once with only the tool names it needs, then batch everything into a single `execute` script. Minimize round-trips and never guess tool signatures.",e?"The sandbox also has a global `fetch` that can call the documented APIs (allow-listed hosts only). Include `fetch` in your `describe-tools` call to get its contract and the list of callable APIs.":""].join(`
+`)}const i="Types named `OpenApi\u2026` are the standard OpenAPI Specification objects.";export{s as DESCRIBE_TOOLS_DESCRIPTION,t as EXECUTE_ARGS_NOTE,i as USAGE_NOTES,n as buildCodeModeInstructions,o as buildExecuteDescription};

package/dist/server/plugins/mcp/codemode/sandbox/sandbox-polyfills.d.ts

@@ -0,0 +1,3 @@
+export declare const SANDBOX_POLYFILLS = "\n  const URLSearchParams = class URLSearchParams {\n    constructor(init) {\n      this._params = [];\n      if (typeof init === 'string') {\n        const str = init.startsWith('?') ? init.slice(1) : init;\n        for (const pair of (str ? str.split('&') : [])) {\n          const eq = pair.indexOf('=');\n          const k = eq >= 0 ? pair.slice(0, eq) : pair;\n          const v = eq >= 0 ? pair.slice(eq + 1) : '';\n          if (k) this._params.push([decodeURIComponent(k), decodeURIComponent(v)]);\n        }\n      } else if (init != null && typeof init === 'object') {\n        for (const [k, v] of Object.entries(init)) this._params.push([k, String(v)]);\n      }\n    }\n    append(key, value) { this._params.push([String(key), String(value)]); }\n    set(key, value) {\n      const k = String(key), v = String(value);\n      this._params = this._params.filter(([pk]) => pk !== k);\n      this._params.push([k, v]);\n    }\n    get(key) { return (this._params.find(([k]) => k === String(key)) ?? [undefined, null])[1]; }\n    getAll(key) { return this._params.filter(([k]) => k === String(key)).map(([, v]) => v); }\n    has(key) { return this._params.some(([k]) => k === String(key)); }\n    delete(key) { this._params = this._params.filter(([k]) => k !== String(key)); }\n    entries() { return this._params.values(); }\n    [Symbol.iterator]() { return this._params.values(); }\n    toString() {\n      return this._params\n        .map(([k, v]) => encodeURIComponent(k) + '=' + encodeURIComponent(v))\n        .join('&');\n    }\n  };\n  globalThis.URLSearchParams = URLSearchParams;\n\n  const FormData = class FormData {\n    constructor() { this._fields = []; }\n    append(key, value) { this._fields.push([String(key), String(value)]); }\n    set(key, value) {\n      const k = String(key), v = String(value);\n      this._fields = this._fields.filter(([fk]) => fk !== k);\n      this._fields.push([k, v]);\n    }\n    get(key) { return (this._fields.find(([k]) => k === String(key)) ?? [undefined, null])[1]; }\n    has(key) { return this._fields.some(([k]) => k === String(key)); }\n    delete(key) { this._fields = this._fields.filter(([k]) => k !== String(key)); }\n    entries() { return this._fields.values(); }\n    [Symbol.iterator]() { return this._fields.values(); }\n  };\n  globalThis.FormData = FormData;\n";
+export declare const SANDBOX_FETCH_SETUP = "\n  const hostFetch = globalThis.__fetch;\n  delete globalThis.__fetch;\n  globalThis.fetch = (url, init = {}) => {\n    let body;\n    let autoContentType;\n    if (init.body instanceof URLSearchParams) {\n      body = init.body.toString();\n      autoContentType = 'application/x-www-form-urlencoded';\n    } else if (init.body instanceof FormData) {\n      const boundary = '----FormBoundary' + Math.random().toString(36).slice(2);\n      body = init.body._fields\n        .map(([k, v]) =>\n          '--' + boundary + '\\r\\nContent-Disposition: form-data; name=\"' + k + '\"\\r\\n\\r\\n' + v,\n        )\n        .join('\\r\\n') + '\\r\\n--' + boundary + '--';\n      autoContentType = 'multipart/form-data; boundary=' + boundary;\n    } else if (init.body != null && typeof init.body !== 'string') {\n      throw new TypeError('fetch body must be a string, URLSearchParams, or FormData');\n    } else {\n      body = init.body ?? undefined;\n    }\n    const callerHeaders = init.headers;\n    const hasContentType = callerHeaders != null && Object.keys(callerHeaders).some(\n      (k) => k.toLowerCase() === 'content-type',\n    );\n    const headers = autoContentType && !hasContentType\n      ? Object.assign({ 'content-type': autoContentType }, callerHeaders)\n      : callerHeaders;\n    return hostFetch(JSON.stringify({ url: String(url), method: init.method, headers, body }))\n      .then((json) => {\n        const res = JSON.parse(json);\n        const resHeaders = res.headers || {};\n        return {\n          status: res.status,\n          statusText: res.statusText,\n          ok: res.ok,\n          headers: {\n            get: (name) => {\n              const value = resHeaders[String(name).toLowerCase()];\n              return value === undefined ? null : value;\n            },\n          },\n          json: () => Promise.resolve(JSON.parse(res.bodyText)),\n          text: () => Promise.resolve(res.bodyText),\n        };\n      });\n  };\n";
+//# sourceMappingURL=sandbox-polyfills.d.ts.map

package/dist/server/plugins/mcp/codemode/sandbox/sandbox-polyfills.js

@@ -0,0 +1,100 @@
+const e=`
+  const URLSearchParams = class URLSearchParams {
+    constructor(init) {
+      this._params = [];
+      if (typeof init === 'string') {
+        const str = init.startsWith('?') ? init.slice(1) : init;
+        for (const pair of (str ? str.split('&') : [])) {
+          const eq = pair.indexOf('=');
+          const k = eq >= 0 ? pair.slice(0, eq) : pair;
+          const v = eq >= 0 ? pair.slice(eq + 1) : '';
+          if (k) this._params.push([decodeURIComponent(k), decodeURIComponent(v)]);
+        }
+      } else if (init != null && typeof init === 'object') {
+        for (const [k, v] of Object.entries(init)) this._params.push([k, String(v)]);
+      }
+    }
+    append(key, value) { this._params.push([String(key), String(value)]); }
+    set(key, value) {
+      const k = String(key), v = String(value);
+      this._params = this._params.filter(([pk]) => pk !== k);
+      this._params.push([k, v]);
+    }
+    get(key) { return (this._params.find(([k]) => k === String(key)) ?? [undefined, null])[1]; }
+    getAll(key) { return this._params.filter(([k]) => k === String(key)).map(([, v]) => v); }
+    has(key) { return this._params.some(([k]) => k === String(key)); }
+    delete(key) { this._params = this._params.filter(([k]) => k !== String(key)); }
+    entries() { return this._params.values(); }
+    [Symbol.iterator]() { return this._params.values(); }
+    toString() {
+      return this._params
+        .map(([k, v]) => encodeURIComponent(k) + '=' + encodeURIComponent(v))
+        .join('&');
+    }
+  };
+  globalThis.URLSearchParams = URLSearchParams;
+
+  const FormData = class FormData {
+    constructor() { this._fields = []; }
+    append(key, value) { this._fields.push([String(key), String(value)]); }
+    set(key, value) {
+      const k = String(key), v = String(value);
+      this._fields = this._fields.filter(([fk]) => fk !== k);
+      this._fields.push([k, v]);
+    }
+    get(key) { return (this._fields.find(([k]) => k === String(key)) ?? [undefined, null])[1]; }
+    has(key) { return this._fields.some(([k]) => k === String(key)); }
+    delete(key) { this._fields = this._fields.filter(([k]) => k !== String(key)); }
+    entries() { return this._fields.values(); }
+    [Symbol.iterator]() { return this._fields.values(); }
+  };
+  globalThis.FormData = FormData;
+`,t=`
+  const hostFetch = globalThis.__fetch;
+  delete globalThis.__fetch;
+  globalThis.fetch = (url, init = {}) => {
+    let body;
+    let autoContentType;
+    if (init.body instanceof URLSearchParams) {
+      body = init.body.toString();
+      autoContentType = 'application/x-www-form-urlencoded';
+    } else if (init.body instanceof FormData) {
+      const boundary = '----FormBoundary' + Math.random().toString(36).slice(2);
+      body = init.body._fields
+        .map(([k, v]) =>
+          '--' + boundary + '\\r\\nContent-Disposition: form-data; name="' + k + '"\\r\\n\\r\\n' + v,
+        )
+        .join('\\r\\n') + '\\r\\n--' + boundary + '--';
+      autoContentType = 'multipart/form-data; boundary=' + boundary;
+    } else if (init.body != null && typeof init.body !== 'string') {
+      throw new TypeError('fetch body must be a string, URLSearchParams, or FormData');
+    } else {
+      body = init.body ?? undefined;
+    }
+    const callerHeaders = init.headers;
+    const hasContentType = callerHeaders != null && Object.keys(callerHeaders).some(
+      (k) => k.toLowerCase() === 'content-type',
+    );
+    const headers = autoContentType && !hasContentType
+      ? Object.assign({ 'content-type': autoContentType }, callerHeaders)
+      : callerHeaders;
+    return hostFetch(JSON.stringify({ url: String(url), method: init.method, headers, body }))
+      .then((json) => {
+        const res = JSON.parse(json);
+        const resHeaders = res.headers || {};
+        return {
+          status: res.status,
+          statusText: res.statusText,
+          ok: res.ok,
+          headers: {
+            get: (name) => {
+              const value = resHeaders[String(name).toLowerCase()];
+              return value === undefined ? null : value;
+            },
+          },
+          json: () => Promise.resolve(JSON.parse(res.bodyText)),
+          text: () => Promise.resolve(res.bodyText),
+        };
+      });
+  };
+`;export{t as SANDBOX_FETCH_SETUP,e as SANDBOX_POLYFILLS};

package/dist/server/plugins/mcp/{docs-mcp/codemode → codemode/sandbox}/sandbox.d.ts

@@ -1,3 +1,3 @@
-import type { RunInSandboxOptions, SandboxResult, SandboxTool } from './types.js';
+import type { RunInSandboxOptions, SandboxResult, SandboxTool } from '../types.js';
 export declare function runInSandbox(code: string, tools: Record<string, SandboxTool>, options?: RunInSandboxOptions): Promise<SandboxResult>;
 //# sourceMappingURL=sandbox.d.ts.map

package/dist/server/plugins/mcp/codemode/sandbox/sandbox.js

@@ -0,0 +1,15 @@
+import P from"@jitl/quickjs-singlefile-mjs-release-sync";import{newQuickJSWASMModuleFromVariant as A,shouldInterruptAfterDeadline as j}from"quickjs-emscripten-core";import{SANDBOX_FETCH_SETUP as J,SANDBOX_POLYFILLS as N}from"./sandbox-polyfills.js";const B=1e4,C=64*1024*1024,L=256*1024,y=100,$=1024*1024,I=1024*1024,R=1024*1024;let v;function x(){return v??=A(P)}function F(t,r){const u=t.map(l=>`${JSON.stringify(l)}: (input) => invoke(${JSON.stringify(l)}, JSON.stringify(input ?? {})).then(JSON.parse)`).join(", ");return`(() => {
+    const invoke = globalThis.__invoke;
+    delete globalThis.__invoke;${r?N+J:""}
+    const tools = Object.freeze({ ${u} });
+    globalThis.tools = new Proxy(tools, {
+      get(target, prop) {
+        if (typeof prop !== 'string' || prop in target || prop === 'then' || prop === 'toJSON') {
+          return target[prop];
+        }
+        throw new TypeError('Unknown tool "' + prop + '". Available tools: ' + Object.keys(target).join(', '));
+      },
+    });
+  })();`}async function H(t,r,u={}){const{timeoutMs:i=B,hostFetch:l}=u,T=new Set;let b=0,_=0;const e=(await x()).newContext();let c,h=()=>{};const k=new Promise((o,a)=>{h=()=>a(new Error(`Execution timed out after ${i}ms`))}),O=()=>e.runtime.setInterruptHandler(j(Date.now()+i)),w=()=>{clearTimeout(c),c=setTimeout(h,i)},E=(o,a,g,d)=>{X(e,o,(...p)=>{const f=p.map(s=>e.getString(s)),n=e.newPromise();return T.add(n),_++,clearTimeout(c),Promise.resolve().then(()=>a(f)).then(s=>{if(!e.alive)return;const S=JSON.stringify(s??null);S.length>g?e.newError(d(S.length)).consume(n.reject):e.newString(S).consume(n.resolve)},s=>{e.alive&&e.newError(M(s)).consume(n.reject)}),n.settled.then(()=>{e.alive&&(O(),--_===0&&w(),e.runtime.executePendingJobs())}),n.handle})};let m;try{e.runtime.setMemoryLimit(C),e.runtime.setMaxStackSize(L),O(),w();const o=()=>{if(++b>y)throw new Error(`Exceeded the limit of ${y} tool calls`)};E("__invoke",([n,s])=>(o(),r[n](JSON.parse(s))),$,n=>`Tool output is too large (${n} bytes); request narrower data instead`),l&&E("__fetch",([n])=>(o(),l(JSON.parse(n))),I,n=>`Response is too large (${n} bytes); request less data`),Y(e,F(Object.keys(r),!!l)),m=e.unwrapResult(e.evalCode(`(async () => {
+${t}
+})()`));const a=e.resolvePromise(m);e.runtime.executePendingJobs();const g=await Promise.race([a,k]),d=e.unwrapResult(g),p=e.dump(d);d.dispose();const f=JSON.stringify(p??null).length;return f>R?{error:`Result is too large (${f} bytes); return less data`}:{result:p}}catch(o){return{error:M(o)}}finally{clearTimeout(c),m?.dispose();for(const o of T)o.alive&&o.dispose();try{e.dispose()}catch{v=void 0}}}function X(t,r,u){t.newFunction(r,u).consume(i=>t.setProp(t.global,r,i))}function Y(t,r){t.unwrapResult(t.evalCode(r)).dispose()}function M(t){return t instanceof Error?t.message:String(t)}export{H as runInSandbox};

package/dist/server/plugins/mcp/codemode/tools/describe-tools.d.ts

@@ -0,0 +1,7 @@
+import type { ToolCallback } from '@redocly/mcp-typescript-sdk/server/mcp.js';
+import type { McpToolSchema } from '../../../../types';
+import type { McpToolContext } from '../../types.js';
+import { type SandboxCapability } from '../capabilities/index.js';
+export declare function describeToolsSchema(tools: McpToolSchema[], capabilities: SandboxCapability[]): Record<string, unknown>;
+export declare function describeTools(tools: McpToolSchema[], isToolAvailable: (toolName: string) => Promise<boolean>, capabilities: SandboxCapability[], context: McpToolContext): ToolCallback<Record<string, unknown>>;
+//# sourceMappingURL=describe-tools.d.ts.map

package/dist/server/plugins/mcp/codemode/tools/describe-tools.js

@@ -0,0 +1 @@
+import{renderDescribeToolsOutput as w}from"../capabilities/index.js";import{sanitizeToolName as o}from"../build-tool-type-declarations.js";function g(i,l){const n=[...new Set([...i.map(s=>o(s.name)),...l.map(s=>o(s.id))])];return{type:"object",required:[],additionalProperties:!1,properties:{tools:{type:"array",description:`Tool names to describe: ${n.join(", ")}. Omit to describe everything.`,items:{type:"string"},nullable:!0}}}}function v(i,l,n,s){const r=new Map(i.map(t=>[o(t.name),t])),c=new Map(n.map(t=>[o(t.id),t]));return async t=>{const a=[...new Set((t.tools??[]).map(o))],p=a.length===0,m=a.filter(e=>!r.has(e)&&!c.has(e));if(m.length>0){const e=[...r.keys(),...c.keys()];throw new Error(`Unknown tool(s): ${m.join(", ")}. Valid tools: ${e.join(", ")}.`)}const u=p?n:n.filter(e=>a.includes(o(e.id))),d=p?i:a.filter(e=>r.has(e)).map(e=>r.get(e)),y=await Promise.all(d.map(e=>l(e.name))),f=d.filter((e,b)=>y[b]);return{content:[{type:"text",text:w(f,u,s)}]}}}export{v as describeTools,g as describeToolsSchema};

package/dist/server/plugins/mcp/codemode/tools/execute-schema.d.ts

@@ -0,0 +1,5 @@
+import type { ToolAnnotations } from '@redocly/mcp-typescript-sdk/types.js';
+import type { McpToolSchema } from '../../../../types';
+export declare const EXECUTE_BASE_ANNOTATIONS: ToolAnnotations;
+export declare const EXECUTE_TOOL_SCHEMA: McpToolSchema;
+//# sourceMappingURL=execute-schema.d.ts.map

package/dist/server/plugins/mcp/codemode/tools/execute-schema.js

@@ -0,0 +1 @@
+import{EXECUTE_TOOL_NAME as e}from"../constants.js";import{buildExecuteDescription as t}from"../prompts.js";const i={title:"Execute code",readOnlyHint:!0,openWorldHint:!1},n={name:e,description:t(!1),annotations:i,schema:{type:"object",required:["code","description"],additionalProperties:!1,properties:{code:{type:"string",description:"JavaScript to run in the sandbox. Return a value to receive it as the result.",minLength:1},description:{type:"string",description:"A short, human-readable summary of what this code does.",minLength:1}}}};export{i as EXECUTE_BASE_ANNOTATIONS,n as EXECUTE_TOOL_SCHEMA};

package/dist/server/plugins/mcp/codemode/tools/execute.js

@@ -0,0 +1 @@
+import{mcpToolHandlers as a}from"../../../../../client/mcp-tool-handlers-entry.js";import{isMcpToolAvailable as l}from"../../workers/execute-mcp-tool.js";import{buildExecuteHostFetch as c,isFetchCapable as m}from"../../gateway-mcp/fetch-capability.js";import{CODE_MODE_TOOL_NAMES as f,EXECUTE_TOOL_NAME as p}from"../constants.js";import{sanitizeToolName as u}from"../build-tool-type-declarations.js";import{invokeTool as d}from"../invoke-tool.js";import{runInSandbox as T}from"../sandbox/sandbox.js";const b=async(e,t,i)=>{const o=await E(t,i),s=m(t)?{hostFetch:c(t)}:{},{result:r,error:n}=await T(e.code,o,s);return{content:[{type:"text",text:JSON.stringify({result:r,error:n})}],isError:n!==void 0}};async function E(e,t){const i={};for(const o of Object.keys(a))f.has(o)||!await l({toolName:o,context:e}).catch(()=>!1)||(i[u(o)]=r=>d(o,r,e,t));return i}var M={[p]:b};export{M as default};

package/dist/server/plugins/mcp/codemode/types.d.ts

@@ -0,0 +1,24 @@
+export type SandboxTool = (input: unknown) => Promise<unknown> | unknown;
+export type SandboxFetchRequest = {
+    url: string;
+    method?: string;
+    headers?: Record<string, string>;
+    body?: string;
+};
+export type SandboxFetchResponse = {
+    status: number;
+    statusText: string;
+    ok: boolean;
+    headers: Record<string, string>;
+    bodyText: string;
+};
+export type SandboxFetch = (request: SandboxFetchRequest) => Promise<SandboxFetchResponse>;
+export type SandboxResult = {
+    result?: unknown;
+    error?: string;
+};
+export type RunInSandboxOptions = {
+    timeoutMs?: number;
+    hostFetch?: SandboxFetch;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/server/plugins/mcp/constants.d.ts

@@ -8,8 +8,10 @@ export declare const McpErrorCodes: {
     readonly MethodNotFound: -32601;
     readonly InvalidParams: -32602;
 };
+export declare const MCP_PROTOCOL_VERSION = "2025-06-18";
 export declare const DEFAULT_CONNECTION_TIMEOUT_MS = 30000;
 export declare const SSE_KEEPALIVE_INTERVAL_MS = 15000;
 export declare const MAX_DOCUMENTS_PER_CATEGORY = 3;
 export declare const MCP_NOT_ALLOWED_TEMPLATE_ID = "mcp-not-allowed";
+export declare const DEFAULT_DOCS_MCP_SERVER_NAME = "Docs MCP server";
 //# sourceMappingURL=constants.d.ts.map

package/dist/server/plugins/mcp/constants.js

@@ -1 +1 @@
-const o={Docs:"docs"},r={InternalError:-32603,ServerError:-32e3,InvalidRequest:-32600,MethodNotFound:-32601,InvalidParams:-32602},e=3e4,t=15e3,E=3,_="mcp-not-allowed";export{e as DEFAULT_CONNECTION_TIMEOUT_MS,E as MAX_DOCUMENTS_PER_CATEGORY,_ as MCP_NOT_ALLOWED_TEMPLATE_ID,r as McpErrorCodes,o as McpServerType,t as SSE_KEEPALIVE_INTERVAL_MS};
+const o={Docs:"docs"},r={InternalError:-32603,ServerError:-32e3,InvalidRequest:-32600,MethodNotFound:-32601,InvalidParams:-32602},E="2025-06-18",e=3e4,t=15e3,_=3,s="mcp-not-allowed",c="Docs MCP server";export{e as DEFAULT_CONNECTION_TIMEOUT_MS,c as DEFAULT_DOCS_MCP_SERVER_NAME,_ as MAX_DOCUMENTS_PER_CATEGORY,s as MCP_NOT_ALLOWED_TEMPLATE_ID,E as MCP_PROTOCOL_VERSION,r as McpErrorCodes,o as McpServerType,t as SSE_KEEPALIVE_INTERVAL_MS};

package/dist/server/plugins/mcp/docs-mcp/tool-schemas.d.ts

@@ -1,8 +1,4 @@
 import type { McpToolSchema } from '../../../types';
-export declare const EXECUTE_TOOL_NAME = "execute";
-export declare const EXECUTE_TOOL_SCHEMA: McpToolSchema;
-export declare const DESCRIBE_TOOLS_TOOL_NAME = "describe-tools";
-export declare const CODE_MODE_TOOL_NAMES: ReadonlySet<string>;
 export declare function getDefaultToolSchemas(config: {
     products?: string[];
     locales?: string[];

package/dist/server/plugins/mcp/docs-mcp/tool-schemas.js

@@ -1 +1 @@
-import{shouldHandleMcpAuth as d}from"../auth/auth-handlers.js";import{EXECUTE_DESCRIPTION as h}from"./codemode/prompts.js";import{GRAPHQL_TYPE_KINDS as o}from"./tools/graphql/types.js";const p=["GET","POST","PUT","DELETE","PATCH","OPTIONS","HEAD","TRACE"],t={type:"string",nullable:!0},n={limit:{type:"number"},total:{type:"number"},page:{type:"number"},totalPages:{type:"number"}},r={codemodeType:"OpenApiServer[]"},s={codemodeType:"OpenApiSecurityRequirement[]"},l={codemodeType:"Record<string, OpenApiSecurityScheme>"},y={codemodeType:"OpenApiDocument"},g={codemodeType:"OpenApiOperation & { path: string; method: string }"},c="execute",j={name:c,description:h,schema:{type:"object",required:["code","description"],additionalProperties:!1,properties:{code:{type:"string",description:"JavaScript to run in the sandbox. Return a value to receive it as the result.",minLength:1},description:{type:"string",description:"A short, human-readable summary of what this code does (shown to users in place of the raw call).",minLength:1}}}},f="describe-tools",I=new Set([c,f]),b={type:"object",additionalProperties:!1,required:[],properties:{filter:{type:"string",description:"API name (or part of it)",minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of APIs per page. Default is 300",minimum:1,default:300,nullable:!0}}},a={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"API name",minLength:1},version:{type:"string",description:"API version (required when multiple APIs share the same name but differ by version)",nullable:!0}}},S={type:"object",required:["name","path","method"],additionalProperties:!1,properties:{name:{type:"string",description:"API name",minLength:1},path:{type:"string",description:"Endpoint path (e.g. /api/v1/users)",minLength:1},method:{type:"string",description:"HTTP method (GET, POST, PUT, DELETE, etc.)",enum:[...p,...p.map(e=>e.toLowerCase())],minLength:1},version:{type:"string",description:"API version (required when multiple APIs share the same name but differ by version)",nullable:!0}}},v={type:"object",required:[],additionalProperties:!1,properties:{}};function w(e){const i=[{name:"list-apis",description:"Lists available APIs with their context and purpose",schema:b,annotations:{title:"List APIs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{items:{type:"array",items:{type:"object",properties:{name:{type:"string"},description:t,version:t,servers:r}}},...n}}},{name:"get-endpoints",description:"Get all endpoints for a specific API",schema:a,annotations:{title:"Get Endpoints",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{api:{type:"string"},version:{type:"string"},servers:r,endpoints:{type:"array",items:{type:"object",properties:{path:{type:"string"},method:{type:"string"},summary:t,description:t,security:s}}}}}},{name:"get-endpoint-info",description:"Get comprehensive information about specific endpoint including parameters, security, and examples",schema:S,annotations:{title:"Get Endpoint Info",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{api:{type:"string"},version:{type:"string"},servers:r,endpoint:g,globalSecurity:s,securitySchemes:l}}},{name:"get-security-schemes",description:"Get the security schemes for a specific API",schema:a,annotations:{title:"Get Security Schemes",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{name:t,version:t,securitySchemes:l,security:s}}},{name:"get-full-api-description",description:"Get the complete OpenAPI description",schema:a,annotations:{title:"Get Full API Description",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{api:{type:"string"},version:{type:"string"},definition:y}}},P(e.products,e.locales)];return d(e.requiresLogin,e.rbac)&&i.push({name:"whoami",description:"Get information about the currently authenticated user",schema:v,annotations:{title:"Who Am I",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{email:{type:"string"},name:{type:"string"},subject:{type:"string"},clientId:{type:"string"},scope:{type:"string"},issuedAt:{type:"string"},expiresAt:{type:"string"}}}}),e.hasGraphqlApis&&i.push(...O()),i}const H={type:"object",required:[],additionalProperties:!1,properties:{filter:{type:"string",description:"GraphQL schema name (or part of it)",minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of results per page. Default is 300",minimum:1,default:300,nullable:!0}}},L={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1},kind:{type:"string",description:"Optional: return only a single category of schema members",enum:[...o],nullable:!0},filter:{type:"string",description:'Optional: only members whose name contains this substring (e.g. "book")',minLength:1,nullable:!0},referencesType:{type:"string",description:'Optional: only members that reference this type directly or transitively (via return, field, argument, union-member or input-field types). Finds cross-cutting members that never name it \u2014 e.g. referencesType "Book" surfaces a search query returning a union that includes Book.',minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of results per page. Default is 300",minimum:1,default:300,nullable:!0}}},T={type:"object",required:["name","type"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1},type:{type:"string",description:"Name of the type, operation, or directive",minLength:1},includeReferencedTypes:{type:"boolean",description:"Also include the SDL of every type referenced transitively. Gives the whole subgraph at once, but can be large for highly-connected types.",default:!1,nullable:!0}}},A={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1}}};function O(){return[{name:"list-graphql-apis",description:"Lists available GraphQL schemas with their context and purpose",schema:H,annotations:{title:"List GraphQL APIs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{items:{type:"array",items:{type:"object",properties:{name:{type:"string"},description:t}}},...n}}},{name:"get-graphql-type-list",description:'List all operations and types in a GraphQL schema as a flat, paginated list. Each item is tagged with its kind (query, object, enum, \u2026) and carries a one-line description; operations also include their return type and argument signature \u2014 use it to decide which members to fetch in detail. Narrow the result with `kind` (one category), `filter` (member-name substring, e.g. "book"), or `referencesType` (only members that use a given type, directly or transitively) to explore a domain cheaply instead of pulling the full schema.',schema:L,annotations:{title:"Get GraphQL Type List",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{name:{type:"string"},items:{type:"array",items:{type:"object",properties:{kind:{type:"string",enum:o},name:{type:"string"},description:t,type:{type:"string"},args:{type:"string"}}}},...n}}},{name:"get-graphql-type",description:"Get the SDL for a single GraphQL type, operation (query/mutation/subscription field), or directive. Set includeReferencedTypes to also pull in every type it references transitively \u2014 the full structural subgraph in one call, ideal for complete exploration of an entity (e.g. Book and all the types it touches). That traversal only follows what the target depends on; to go the other direction and find the members that use a type, call get-graphql-type-list with `referencesType`.",schema:T,annotations:{title:"Get GraphQL Type",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"string"}},{name:"get-graphql-schema",description:"Get the complete GraphQL schema as SDL \u2014 the whole type graph in one call. Returns everything, so it can be very large and token-expensive for big schemas; prefer get-graphql-type-list (filter/paginate) plus targeted get-graphql-type calls, and reach for this only for small schemas or when you truly need the full SDL.",schema:A,annotations:{title:"Get GraphQL Schema",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"string"}}]}function P(e,i){const u=e&&e.length>0,m=i&&i.length>0;return{name:"search",description:"Search across the documentation to fetch relevant content for a given query",schema:{type:"object",required:["query"],additionalProperties:!1,properties:{query:{type:"string",description:"Search query. Should be a single word or that phrase that is presented in a documentation.",minLength:1},...u?{product:{type:"string",description:"Optional product name to filter search results by specific product.",enum:e,nullable:!0}}:{},...m?{locale:{type:"string",description:"Optional locale code to filter search results by documentation language (e.g. 'en', 'ja'). Use the locale matching the language of the user's request. Defaults to the project's default locale.",enum:i,nullable:!0}}:{}}},annotations:{title:"Search Documentation",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},outputSchema:{type:"string"}}}export{I as CODE_MODE_TOOL_NAMES,f as DESCRIBE_TOOLS_TOOL_NAME,c as EXECUTE_TOOL_NAME,j as EXECUTE_TOOL_SCHEMA,w as getDefaultToolSchemas};
+import{shouldHandleMcpAuth as m}from"../auth/auth-handlers.js";import{GRAPHQL_TYPE_KINDS as o}from"./tools/graphql/types.js";const p=["GET","POST","PUT","DELETE","PATCH","OPTIONS","HEAD","TRACE"],t={type:"string",nullable:!0},n={limit:{type:"number"},total:{type:"number"},page:{type:"number"},totalPages:{type:"number"}},r={codemodeType:"OpenApiServer[]"},s={codemodeType:"OpenApiSecurityRequirement[]"},l={codemodeType:"Record<string, OpenApiSecurityScheme>"},d={codemodeType:"OpenApiDocument"},h={codemodeType:"OpenApiOperation & { path: string; method: string }"},y={type:"object",additionalProperties:!1,required:[],properties:{filter:{type:"string",description:"API name (or part of it)",minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of APIs per page. Default is 300",minimum:1,default:300,nullable:!0}}},a={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"API name",minLength:1},version:{type:"string",description:"API version (required when multiple APIs share the same name but differ by version)",nullable:!0}}},g={type:"object",required:["name","path","method"],additionalProperties:!1,properties:{name:{type:"string",description:"API name",minLength:1},path:{type:"string",description:"Endpoint path (e.g. /api/v1/users)",minLength:1},method:{type:"string",description:"HTTP method (GET, POST, PUT, DELETE, etc.)",enum:[...p,...p.map(e=>e.toLowerCase())],minLength:1},version:{type:"string",description:"API version (required when multiple APIs share the same name but differ by version)",nullable:!0}}},f={type:"object",required:[],additionalProperties:!1,properties:{}};function q(e){const i=[{name:"list-apis",description:"Lists available APIs with their context and purpose",schema:y,annotations:{title:"List APIs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{items:{type:"array",items:{type:"object",properties:{name:{type:"string"},description:t,version:t,servers:r}}},...n}}},{name:"get-endpoints",description:"Get all endpoints for a specific API",schema:a,annotations:{title:"Get Endpoints",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{api:{type:"string"},version:{type:"string"},servers:r,endpoints:{type:"array",items:{type:"object",properties:{path:{type:"string"},method:{type:"string"},summary:t,description:t,security:s}}}}}},{name:"get-endpoint-info",description:"Get comprehensive information about specific endpoint including parameters, security, and examples",schema:g,annotations:{title:"Get Endpoint Info",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{api:{type:"string"},version:{type:"string"},servers:r,endpoint:h,globalSecurity:s,securitySchemes:l}}},{name:"get-security-schemes",description:"Get the security schemes for a specific API",schema:a,annotations:{title:"Get Security Schemes",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{name:t,version:t,securitySchemes:l,security:s}}},{name:"get-full-api-description",description:"Get the complete OpenAPI description",schema:a,annotations:{title:"Get Full API Description",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{api:{type:"string"},version:{type:"string"},definition:d}}},P(e.products,e.locales)];return m(e.requiresLogin,e.rbac)&&i.push({name:"whoami",description:"Get information about the currently authenticated user",schema:f,annotations:{title:"Who Am I",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{email:{type:"string"},name:{type:"string"},subject:{type:"string"},clientId:{type:"string"},scope:{type:"string"},issuedAt:{type:"string"},expiresAt:{type:"string"}}}}),e.hasGraphqlApis&&i.push(...L()),i}const b={type:"object",required:[],additionalProperties:!1,properties:{filter:{type:"string",description:"GraphQL schema name (or part of it)",minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of results per page. Default is 300",minimum:1,default:300,nullable:!0}}},S={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1},kind:{type:"string",description:"Optional: return only a single category of schema members",enum:[...o],nullable:!0},filter:{type:"string",description:'Optional: only members whose name contains this substring (e.g. "book")',minLength:1,nullable:!0},referencesType:{type:"string",description:'Optional: only members that reference this type directly or transitively (via return, field, argument, union-member or input-field types). Finds cross-cutting members that never name it \u2014 e.g. referencesType "Book" surfaces a search query returning a union that includes Book.',minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of results per page. Default is 300",minimum:1,default:300,nullable:!0}}},H={type:"object",required:["name","type"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1},type:{type:"string",description:"Name of the type, operation, or directive",minLength:1},includeReferencedTypes:{type:"boolean",description:"Also include the SDL of every type referenced transitively. Gives the whole subgraph at once, but can be large for highly-connected types.",default:!1,nullable:!0}}},v={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1}}};function L(){return[{name:"list-graphql-apis",description:"Lists available GraphQL schemas with their context and purpose",schema:b,annotations:{title:"List GraphQL APIs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{items:{type:"array",items:{type:"object",properties:{name:{type:"string"},description:t}}},...n}}},{name:"get-graphql-type-list",description:'List all operations and types in a GraphQL schema as a flat, paginated list. Each item is tagged with its kind (query, object, enum, \u2026) and carries a one-line description; operations also include their return type and argument signature \u2014 use it to decide which members to fetch in detail. Narrow the result with `kind` (one category), `filter` (member-name substring, e.g. "book"), or `referencesType` (only members that use a given type, directly or transitively) to explore a domain cheaply instead of pulling the full schema.',schema:S,annotations:{title:"Get GraphQL Type List",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{name:{type:"string"},items:{type:"array",items:{type:"object",properties:{kind:{type:"string",enum:o},name:{type:"string"},description:t,type:{type:"string"},args:{type:"string"}}}},...n}}},{name:"get-graphql-type",description:"Get the SDL for a single GraphQL type, operation (query/mutation/subscription field), or directive. Set includeReferencedTypes to also pull in every type it references transitively \u2014 the full structural subgraph in one call, ideal for complete exploration of an entity (e.g. Book and all the types it touches). That traversal only follows what the target depends on; to go the other direction and find the members that use a type, call get-graphql-type-list with `referencesType`.",schema:H,annotations:{title:"Get GraphQL Type",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"string"}},{name:"get-graphql-schema",description:"Get the complete GraphQL schema as SDL \u2014 the whole type graph in one call. Returns everything, so it can be very large and token-expensive for big schemas; prefer get-graphql-type-list (filter/paginate) plus targeted get-graphql-type calls, and reach for this only for small schemas or when you truly need the full SDL.",schema:v,annotations:{title:"Get GraphQL Schema",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"string"}}]}function P(e,i){const c=e&&e.length>0,u=i&&i.length>0;return{name:"search",description:"Search across the documentation to fetch relevant content for a given query",schema:{type:"object",required:["query"],additionalProperties:!1,properties:{query:{type:"string",description:"Search query. Should be a single word or that phrase that is presented in a documentation.",minLength:1},...c?{product:{type:"string",description:"Optional product name to filter search results by specific product.",enum:e,nullable:!0}}:{},...u?{locale:{type:"string",description:"Optional locale code to filter search results by documentation language (e.g. 'en', 'ja'). Use the locale matching the language of the user's request. Defaults to the project's default locale.",enum:i,nullable:!0}}:{}}},annotations:{title:"Search Documentation",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},outputSchema:{type:"string"}}}export{q as getDefaultToolSchemas};

package/dist/server/plugins/mcp/docs-mcp/tools/openapi/list-apis.js

@@ -1 +1 @@
-import{filterApiDescriptionsByName as f}from"../../utils.js";const x=async(a,l)=>{const{filter:i,page:n=1,limit:e=300}=a;let t=Object.values(l.apiDescriptionsMap);i&&(t=f(t,i));const s=(n-1)*e,o=s+e,r=Math.ceil(t.length/e),c=t.length;return t=t.slice(s,o),t.length===0?{content:[{type:"text",text:"No APIs available"}]}:{content:[{type:"text",text:JSON.stringify({items:t.map(({relativePath:g,...p})=>p),limit:e,total:c,page:n,totalPages:r})}]}};var m={"list-apis":x};export{m as default};
+import{filterApiDescriptionsByName as f}from"../../utils.js";const g=async(l,a)=>{const{filter:i,page:n=1,limit:e=300}=l;let t=Object.values(a.apiDescriptionsMap);i&&(t=f(t,i));const s=(n-1)*e,o=s+e,c=Math.ceil(t.length/e),r=t.length;return t=t.slice(s,o),t.length===0?{content:[{type:"text",text:"No APIs available"}]}:{content:[{type:"text",text:JSON.stringify({items:t.map(({relativePath:h,fetchEligible:x,...p})=>p),limit:e,total:r,page:n,totalPages:c})}]}};var u={"list-apis":g};export{u as default};

package/dist/server/plugins/mcp/docs-mcp/utils.js

@@ -1 +1 @@
-function $(e,o,s){if(!o)return;const n=o.toLowerCase();if(s)return e[`${n}@${s}`];const t=Object.values(e).filter(({name:r})=>r.toLowerCase()===n);if(t.length){if(t.length>1){const r=t.map(({version:c})=>c||"(no version)").join(", ");throw new Error(`Multiple versions of "${o}" found: ${r}. Specify a version to disambiguate.`)}return t[0]}}function v(e,o){return Object.values(e).filter(({name:s})=>s.toLowerCase().includes(o.toLowerCase()))}function d(e,o){if(!o||!e?.startsWith("#/"))return;const s=e.slice(2).split("/");let n=o;for(const t of s)if(typeof n=="object"&&n!==null&&t in n)n=n[t];else return;return n}function l({schema:e,definition:o,visitedRefs:s=new Set,maxDepth:n=50,currentDepth:t=0}){if(!e)return;if(t>=n)return{type:"object",description:`Maximum resolution depth exceeded (${n})`};if("$ref"in e&&e.$ref){if(s.has(e.$ref))return{type:"object",description:`Circular reference detected: ${e.$ref}`,"x-circular-ref":e.$ref};const f=new Set(s);f.add(e.$ref);const u=d(e.$ref,o);return u?l({schema:u,definition:o,visitedRefs:f,maxDepth:n,currentDepth:t+1}):{type:"object",description:`Could not resolve reference: ${e.$ref}`,"x-unresolved-ref":e.$ref}}const r={...e};if(r.properties){const f={};for(const[u,i]of Object.entries(r.properties)){const p=l({schema:i,definition:o,visitedRefs:new Set(s),maxDepth:n,currentDepth:t+1});f[u]=p||i}r.properties=f}if(r.items&&typeof r.items=="object")if(Array.isArray(r.items))r.items=r.items.map(f=>l({schema:f,definition:o,visitedRefs:new Set(s),maxDepth:n,currentDepth:t+1})||f);else{const f=l({schema:r.items,definition:o,visitedRefs:new Set(s),maxDepth:n,currentDepth:t+1});f&&(r.items=f)}return["allOf","anyOf","oneOf"].forEach(f=>{const u=r[f];Array.isArray(u)&&(r[f]=u.reduce((i,p)=>{const m=l({schema:p,definition:o,visitedRefs:new Set(s),maxDepth:n,currentDepth:t+1});return m&&i.push(m),i},[]))}),r}function h({pathParams:e,opParams:o,definition:s}){return[...e,...o].reduce((n,t)=>{if(!t)return n;if("$ref"in t&&t.$ref){const r=d(t.$ref,s);return r&&n.push({...r,schema:"schema"in r&&r.schema?l({schema:r.schema,definition:s}):void 0}),n}return n.push({...t,schema:"schema"in t&&t.schema?l({schema:t.schema,definition:s}):void 0}),n},[])}function a(e,o){const s={...e};if(e.example!==void 0&&(s.example=e.example),!e.examples)return s;const n={};for(const[t,r]of Object.entries(e.examples))if("$ref"in r){const c=d(r.$ref,o);c&&(n[t]=c)}else n[t]=r;return s.examples=n,s}function w(e,o){if(!e)return;const s="$ref"in e&&e.$ref?d(e.$ref,o):e;if(!s)return;const n={...s};if("content"in s&&s.content){const t={};for(const[r,c]of Object.entries(s.content))t[r]={...a(c,o),schema:c.schema?l({schema:c.schema,definition:o}):void 0};n.content=t}return n}function x(e,o){return Object.entries(e).reduce((s,[n,t])=>{const r="$ref"in t&&t.$ref?d(t.$ref,o):t;if(!r)return s;const c={...r};if("content"in r&&r.content){const f={};for(const[u,i]of Object.entries(r.content))f[u]={...a(i,o),schema:i.schema?l({schema:i.schema,definition:o}):void 0};c.content=f}return s[n]=c,s},{})}export{v as filterApiDescriptionsByName,$ as findApiDescriptionByNameAndVersion,h as resolveParameters,d as resolveRef,w as resolveRequestBody,x as resolveResponses,l as resolveSchemaRefs};
+function v(t,o,n){if(!o)return;const s=o.toLowerCase(),r=Object.values(t).filter(({name:i})=>i.toLowerCase()===s);if(r.length===0)return;const e=n?r.filter(i=>i.version===n):r;if(e.length===0)return;if(e.length===1)return e[0];if(new Set(e.map(({version:i})=>i||"")).size>1){const i=e.map(({version:d})=>d||"(no version)").join(", ");throw new Error(`Multiple versions of "${o}" found: ${i}. Specify a version to disambiguate.`)}const c=e.map(({relativePath:i})=>i||"(unknown path)").join(", "),u=e[0].version?` at version "${e[0].version}"`:"";throw new Error(`Multiple APIs are titled "${o}"${u} (${c}). Give them a distinct info.title or info.version so they can be addressed individually.`)}function $(t,o){return Object.values(t).filter(({name:n})=>n.toLowerCase().includes(o.toLowerCase()))}function a(t,o){if(!o||!t?.startsWith("#/"))return;const n=t.slice(2).split("/");let s=o;for(const r of n)if(typeof s=="object"&&s!==null&&r in s)s=s[r];else return;return s}function l({schema:t,definition:o,visitedRefs:n=new Set,maxDepth:s=50,currentDepth:r=0}){if(!t)return;if(r>=s)return{type:"object",description:`Maximum resolution depth exceeded (${s})`};if("$ref"in t&&t.$ref){if(n.has(t.$ref))return{type:"object",description:`Circular reference detected: ${t.$ref}`,"x-circular-ref":t.$ref};const c=new Set(n);c.add(t.$ref);const u=a(t.$ref,o);return u?l({schema:u,definition:o,visitedRefs:c,maxDepth:s,currentDepth:r+1}):{type:"object",description:`Could not resolve reference: ${t.$ref}`,"x-unresolved-ref":t.$ref}}const e={...t};if(e.properties){const c={};for(const[u,i]of Object.entries(e.properties)){const d=l({schema:i,definition:o,visitedRefs:new Set(n),maxDepth:s,currentDepth:r+1});c[u]=d||i}e.properties=c}if(e.items&&typeof e.items=="object")if(Array.isArray(e.items))e.items=e.items.map(c=>l({schema:c,definition:o,visitedRefs:new Set(n),maxDepth:s,currentDepth:r+1})||c);else{const c=l({schema:e.items,definition:o,visitedRefs:new Set(n),maxDepth:s,currentDepth:r+1});c&&(e.items=c)}return["allOf","anyOf","oneOf"].forEach(c=>{const u=e[c];Array.isArray(u)&&(e[c]=u.reduce((i,d)=>{const p=l({schema:d,definition:o,visitedRefs:new Set(n),maxDepth:s,currentDepth:r+1});return p&&i.push(p),i},[]))}),e}function h({pathParams:t,opParams:o,definition:n}){return[...t,...o].reduce((s,r)=>{if(!r)return s;if("$ref"in r&&r.$ref){const e=a(r.$ref,n);return e&&s.push({...e,schema:"schema"in e&&e.schema?l({schema:e.schema,definition:n}):void 0}),s}return s.push({...r,schema:"schema"in r&&r.schema?l({schema:r.schema,definition:n}):void 0}),s},[])}function m(t,o){const n={...t};if(t.example!==void 0&&(n.example=t.example),!t.examples)return n;const s={};for(const[r,e]of Object.entries(t.examples))if("$ref"in e){const f=a(e.$ref,o);f&&(s[r]=f)}else s[r]=e;return n.examples=s,n}function w(t,o){if(!t)return;const n="$ref"in t&&t.$ref?a(t.$ref,o):t;if(!n)return;const s={...n};if("content"in n&&n.content){const r={};for(const[e,f]of Object.entries(n.content))r[e]={...m(f,o),schema:f.schema?l({schema:f.schema,definition:o}):void 0};s.content=r}return s}function b(t,o){return Object.entries(t).reduce((n,[s,r])=>{const e="$ref"in r&&r.$ref?a(r.$ref,o):r;if(!e)return n;const f={...e};if("content"in e&&e.content){const c={};for(const[u,i]of Object.entries(e.content))c[u]={...m(i,o),schema:i.schema?l({schema:i.schema,definition:o}):void 0};f.content=c}return n[s]=f,n},{})}export{$ as filterApiDescriptionsByName,v as findApiDescriptionByNameAndVersion,h as resolveParameters,a as resolveRef,w as resolveRequestBody,b as resolveResponses,l as resolveSchemaRefs};

package/dist/server/plugins/mcp/gateway-mcp/eligibility.d.ts

@@ -0,0 +1,30 @@
+import type { OpenAPIDefinition } from '@redocly/openapi-docs';
+import type { OpenAPIMcp } from '@redocly/openapi-docs/lib/types/open-api.js';
+import type { RbacConfig } from '@redocly/config';
+type GatewayVisibility = {
+    hide?: boolean;
+    docs?: {
+        hide?: boolean;
+        ignore?: readonly string[];
+    };
+    gateway?: {
+        hide?: boolean;
+    };
+};
+/** Whether the gateway fetch capability is on: the feature flag plus none of mcp/docs/gateway hidden. */
+export declare function isGatewayCapabilityEnabled(mcp: GatewayVisibility | undefined): boolean;
+/** Whether an API is eligible for the gateway (fetch-capable `execute` + `/mcp` advertisement). */
+export declare function isGatewayEligible(info: OpenAPIDefinition['info'] | undefined, relativePath: string, rbacConfig: RbacConfig): boolean;
+/**
+ * Whether an API docs page advertises the `/mcp` endpoint via an injected root-level x-mcp:
+ * the capability is on, the author has not provided their own x-mcp servers, and the API is
+ * both gateway-eligible and part of the Docs MCP catalog.
+ */
+export declare function shouldAdvertiseGatewayXMcp(definition: (OpenAPIDefinition & {
+    'x-mcp'?: {
+        servers?: unknown[];
+    };
+}) | undefined, relativePath: string, rbacConfig: RbacConfig, mcpConfig: GatewayVisibility | undefined): boolean;
+export declare function buildGatewayXMcp(url: string): OpenAPIMcp;
+export {};
+//# sourceMappingURL=eligibility.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/eligibility.js

@@ -0,0 +1 @@
+import{join as r}from"node:path";import{PUBLIC_API_DEFINITIONS_FOLDER as s}from"../../../constants/common.js";import{DEFAULT_ANONYMOUS_VISITOR_TEAM as a}from"../../../../constants/common.js";import{canDownloadApiDefinition as n}from"../../../utils/rbac.js";import{MCP_PROTOCOL_VERSION as p}from"../constants.js";import{isApiIncludedInDocsMcp as l}from"../utils.js";import{isMcpGatewayEnabled as c}from"../utils/mode.js";import{isDefinitionHidden as f,hasGatewayConfig as m}from"../utils/xmcp-utils.js";function u(o){return c()&&!o?.hide&&!o?.docs?.hide&&!o?.gateway?.hide}function d(o,e,i){return f(o,"gateway")?!1:n(r(s,e),i,!1,{isAuthenticated:!1,teams:[a]})||m(o)}function D(o,e,i,t){return u(t)&&!o?.["x-mcp"]?.servers?.length&&d(o?.info,e,i)&&l(e,o,t)}function M(o){return{protocolVersion:p,capabilities:{tools:{}},servers:[{url:o}],tools:[],resources:[],prompts:[]}}export{M as buildGatewayXMcp,u as isGatewayCapabilityEnabled,d as isGatewayEligible,D as shouldAdvertiseGatewayXMcp};

package/dist/server/plugins/mcp/gateway-mcp/fetch/allowed-hosts.d.ts

@@ -0,0 +1,13 @@
+import type { OpenAPIServer } from '@redocly/openapi-docs/lib/types/open-api.js';
+/**
+ * Build case-insensitive host matchers from an API's server URL templates (plus any
+ * configured extra hosts). A server URL host may contain server-variable placeholders
+ * (e.g. a tenant `{subdomain}`); each placeholder expands to its `enum` values, or - when
+ * free-form - to one DNS label plus any fixed parent domain carried by the variable's
+ * `default`. So `{subdomain}.dealpos.com` matches `acme.dealpos.com`, and a whole-host
+ * `{subdomain}` defaulting to `acme.dealpos.net` matches `<tenant>.dealpos.net`, but neither
+ * matches `a.b.dealpos.com`, the bare parent domain, or an unrelated host.
+ */
+export declare function buildAllowedHostMatchers(servers?: readonly OpenAPIServer[], extraHosts?: readonly string[]): RegExp[];
+export declare function isHostAllowed(host: string, matchers: readonly RegExp[]): boolean;
+//# sourceMappingURL=allowed-hosts.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/fetch/allowed-hosts.js

@@ -0,0 +1 @@
+const i=/\{([^}]+)\}/g;function m(n=[],e=[]){const t=[];for(const r of n){const o=u(r);o&&t.push(o)}for(const r of e){const o=h(r);o&&t.push(o)}return t}function p(n,e){return e.some(t=>t.test(n))}function u(n){const e=f(n.url);if(!e)return null;let t="",r=0;for(const o of e.matchAll(i)){const[c,l]=o;t+=s(e.slice(r,o.index)),t+=a(n.variables?.[l]),r=o.index+c.length}return t+=s(e.slice(r)),t.includes("\\.")?new RegExp(`^${t}$`,"i"):null}function a(n){const e=n?.enum?.filter(Boolean);if(e&&e.length>0)return`(?:${e.map(s).join("|")})`;const t=n?.default?.split(".").slice(1).join(".");return t?`[^.]+\\.${s(t)}`:"[^.]+"}function h(n){const e=n.trim().toLowerCase();return e?e.startsWith("*.")?new RegExp(`^[^.]+\\.${s(e.slice(2))}$`,"i"):new RegExp(`^${s(e)}$`,"i"):null}function f(n){if(!n)return null;const t=n.replace(/^[a-z][a-z0-9+.-]*:\/\//i,"").split(/[/?#]/,1)[0];return t&&(t.includes("@")?t.slice(t.lastIndexOf("@")+1):t).replace(/:(?:\d+|\{[^}]+\})$/,"")||null}function s(n){return n.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}export{m as buildAllowedHostMatchers,p as isHostAllowed};

package/dist/server/plugins/mcp/gateway-mcp/fetch/fetch-bridge.d.ts

@@ -0,0 +1,12 @@
+import type { SandboxFetch } from '../../codemode/types.js';
+type FetchBridgeOptions = {
+    allowedHosts: readonly RegExp[];
+    authorization?: string;
+    fetchImpl?: typeof fetch;
+    timeoutMs?: number;
+    maxResponseBytes?: number;
+};
+/** Build the host-side `fetch` the gateway sandbox calls. */
+export declare function buildFetchBridge({ allowedHosts, authorization, fetchImpl, timeoutMs, maxResponseBytes }: FetchBridgeOptions): SandboxFetch;
+export {};
+//# sourceMappingURL=fetch-bridge.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/fetch/fetch-bridge.js

@@ -0,0 +1 @@
+import{assertUrlAllowed as f}from"./ssrf-guard.js";const b=3e4,w=1024*1024;function m({allowedHosts:t,authorization:e,fetchImpl:o=fetch,timeoutMs:n=b,maxResponseBytes:s=w}){return async r=>{const a=f(r.url,t),d=g(r.headers,e),c=new AbortController,u=setTimeout(()=>c.abort(),n);try{const i=await o(a,{method:r.method??"GET",headers:d,body:r.body,redirect:"manual",signal:c.signal}),h=await y(i,s);return{status:i.status,statusText:i.statusText,ok:i.ok,headers:T(i.headers),bodyText:h}}finally{clearTimeout(u)}}}async function y(t,e){const o=Number(t.headers.get("content-length"));if(Number.isFinite(o)&&o>e)throw l(e,o);if(!t.body)return"";const n=t.body.getReader(),s=new TextDecoder;let r=0,a="";try{for(;;){const{done:d,value:c}=await n.read();if(d)break;if(r+=c.byteLength,r>e)throw l(e,r);a+=s.decode(c,{stream:!0})}return a+s.decode()}finally{await n.cancel().catch(()=>{})}}function l(t,e){return new Error(`Response is too large (over ${t} bytes, got ${e}); request less data`)}function g(t,e){const o={};let n=!1;for(const[s,r]of Object.entries(t??{})){const a=s.toLowerCase();a==="host"||a==="content-length"||(a==="authorization"&&(n=!0),o[s]=r)}return e&&!n&&(o.Authorization=e),o}function T(t){const e={};return t.forEach((o,n)=>{e[n.toLowerCase()]=o}),e}export{m as buildFetchBridge};

package/dist/server/plugins/mcp/gateway-mcp/fetch/ssrf-guard.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Validate an outbound request URL against an API's host allow-list before the gateway fetches it.
+ *
+ * Returns the parsed URL on success; throws with a clear message otherwise.
+ */
+export declare function assertUrlAllowed(rawUrl: string, matchers: readonly RegExp[]): URL;
+/** True for loopback, private, link-local, unspecified, or otherwise internal addresses. */
+export declare function isBlockedAddress(host: string): boolean;
+//# sourceMappingURL=ssrf-guard.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/fetch/ssrf-guard.js

@@ -0,0 +1 @@
+import{isHostAllowed as f}from"./allowed-hosts.js";function c(e,r){let t;try{t=new URL(e)}catch{throw new Error(`Invalid URL: ${e}`)}if(t.protocol!=="http:"&&t.protocol!=="https:")throw new Error(`Only http(s) URLs are allowed, got ${t.protocol}`);const n=o(t.hostname);if(u(n)||!f(n,r))throw new Error(`Host "${n}" is not allowed`);return t}function u(e){const r=o(e.toLowerCase());return r==="localhost"||r.endsWith(".localhost")?!0:i(r)?s(r):r.includes(":")?l(r):!1}function o(e){return e.replace(/^\[|\]$/g,"")}function i(e){return/^\d{1,3}(\.\d{1,3}){3}$/.test(e)}function s(e){const[r,t]=e.split(".").map(Number);return r===0||r===10||r===127||r===169&&t===254||r===172&&t>=16&&t<=31||r===192&&t===168||r===100&&t>=64&&t<=127}function l(e){if(e==="::1"||e==="::")return!0;const r=e.match(/::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/);if(r)return s(r[1]);const t=parseInt(e.split(":")[0],16);return Number.isNaN(t)?!1:t>=65152&&t<=65215||t>=64512&&t<=65023}export{c as assertUrlAllowed,u as isBlockedAddress};

package/dist/server/plugins/mcp/gateway-mcp/fetch-capability.d.ts

@@ -0,0 +1,6 @@
+import type { ApiDescriptionInfo, McpToolContext } from '../types.js';
+import type { SandboxFetch } from '../codemode/types.js';
+export declare function getCallableApis(context: McpToolContext): ApiDescriptionInfo[];
+export declare function isFetchCapable(context: McpToolContext): boolean;
+export declare function buildExecuteHostFetch(context: McpToolContext): SandboxFetch;
+//# sourceMappingURL=fetch-capability.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/fetch-capability.js

@@ -0,0 +1 @@
+import{isGatewayCapabilityEnabled as a}from"./eligibility.js";import{buildAllowedHostMatchers as l}from"./fetch/allowed-hosts.js";import{buildFetchBridge as s}from"./fetch/fetch-bridge.js";function i(t){return Object.values(t.apiDescriptionsMap??{}).filter(e=>e.fetchEligible)}function u(t){const e=t.config?.mcp;return a(e)&&i(t).length>0}function f(t){const e=t.config?.mcp,o=i(t).flatMap(r=>r.servers??[]);return s({allowedHosts:l(o,e?.gateway?.allowedHosts),authorization:t.upstreamAuthorization})}export{f as buildExecuteHostFetch,i as getCallableApis,u as isFetchCapable};

package/dist/server/plugins/mcp/handlers/docs-mcp-handler.js

@@ -1 +1 @@
-import{toFetchResponse as b,toReqRes as N}from"fetch-to-node";import{logger as m}from"../../../tools/notifiers/logger.js";import{isObject as k}from"../../../../utils/guards/is-object.js";import{createDocsMcpServer as O}from"../servers/docs-server.js";import{filterApiDescriptionsByRbac as U,filterGraphqlDescriptionsByRbac as E}from"../utils.js";import{createMethodNotAllowedError as H,withErrorHandling as I}from"./errors.js";import{attachSseKeepalive as j}from"./sse-keepalive.js";import{McpServerType as L}from"../constants.js";import{constructInvalidTokenResponse as J,constructUnauthorizedResponse as P,handleMcpAuth as q,shouldHandleMcpAuth as B}from"../auth/auth-handlers.js";import{extractTokenFromAuthHeader as G}from"../utils/jwt.js";const u="X-Redocly-AI-Metadata";function $(r){if(r)try{const e=JSON.parse(r);if(k(e))return e;m.warn(`Ignoring ${u} header: not a JSON object.`)}catch{m.warn(`Ignoring ${u} header: invalid JSON.`)}}const z=async(r,e,h)=>{const n=!!e?.config?.access?.requiresLogin,i=e?.config?.access?.rbac||{};let a;const f=r.headers.get("Authorization");if(B(n,i)){const{isAuthenticated:o,isTokenValid:c,currentUser:t,accessToken:p}=await q(r,e);if(!o)return P(new URL(r.url).origin);if(!c)return J();t&&(e.user=t),a=p}else f&&(a=G(f||"")??void 0);let s;const g=async()=>{s&&(await s.cleanup(),s=void 0)};return await I(async()=>{if(r.method==="GET")return new Response(JSON.stringify({error:"Method Not Allowed",message:`In order to use this MCP server, you need register it in your MCP Client (VS Code, Cursor, Claude Code, etc.) using that URL: ${r.url}`}),{status:405,headers:{"Content-Type":"application/json"}});if(r.method!=="POST")return H();const o=h,c=o?.props?.config?.apiDescriptionsMap||{},t=o?.props?.config?.graphqlDescriptions||[],p=o?.props?.config?.mcpDocsServerName||"Docs MCP server",{config:{mcp:D={}}}=e,M=U(c,e.user,i,n),R=E(t,e.user,i,n),y=e.config.products?Object.values(e.config.products).map(l=>l?.name):[],A=D.docs?.name||p,w=$(r.headers.get(u)),T=o?.props?.tools||[];s=await O({name:A,tools:T,context:{...e,accessToken:a,outdir:e.outdir||"",baseUrl:e.baseUrl||new URL(r.url).origin,apiDescriptionsMap:M,graphqlDescriptions:R,products:y,metadata:w}});const v=await r.json(),{req:C,res:d}=N(r),S=j(d);try{await s.transport.handleRequest(C,d,v)}catch(l){throw S.stop(),l}return b(d)},L.Docs,g)};var ee=z;export{ee as default};
+import{toFetchResponse as E,toReqRes as k}from"fetch-to-node";import{logger as m}from"../../../tools/notifiers/logger.js";import{isObject as v}from"../../../../utils/guards/is-object.js";import{getAccessibleSkills as N}from"../../../utils/skills/get-accessible-skills.js";import{getSkillUrl as O}from"../../../utils/skills/get-skill-url.js";import{createDocsMcpServer as L}from"../servers/docs-server.js";import{filterApiDescriptionsByRbac as H,filterGraphqlDescriptionsByRbac as I}from"../utils.js";import{createMethodNotAllowedError as j,withErrorHandling as B}from"./errors.js";import{attachSseKeepalive as _}from"./sse-keepalive.js";import{constructInvalidTokenResponse as J,constructUnauthorizedResponse as P,handleMcpAuth as F,shouldHandleMcpAuth as G}from"../auth/auth-handlers.js";import{extractTokenFromAuthHeader as V}from"../utils/jwt.js";import{DEFAULT_DOCS_MCP_SERVER_NAME as $}from"../constants.js";const u="X-Redocly-AI-Metadata";function q(r){if(r)try{const e=JSON.parse(r);if(v(e))return e;m.warn(`Ignoring ${u} header: not a JSON object.`)}catch{m.warn(`Ignoring ${u} header: invalid JSON.`)}}const z=async(r,e,g)=>{const t=!!e?.config?.access?.requiresLogin,i=e?.config?.access?.rbac||{};let c;const f=r.headers.get("Authorization");if(G(t,i)){const{isAuthenticated:s,isTokenValid:p,currentUser:a,accessToken:d}=await F(r,e);if(!s)return P(new URL(r.url).origin);if(!p)return J();a&&(e.user=a),c=d}else f&&(c=V(f||"")??void 0);let n;return await B(async()=>{if(r.method==="GET")return new Response(JSON.stringify({error:"Method Not Allowed",message:`In order to use this MCP server, you need register it in your MCP Client (VS Code, Cursor, Claude Code, etc.) using that URL: ${r.url}`}),{status:405,headers:{"Content-Type":"application/json"}});if(r.method!=="POST")return j();const s=g,p=s?.props?.config?.apiDescriptionsMap||{},a=s?.props?.config?.graphqlDescriptions||[],d=s?.props?.config?.mcpDocsServerName||$,{config:{mcp:h={}}}=e,R=H(p,e.user,i,t),A=I(a,e.user,i,t),D=s?.props?.skillsBaseUrl||new URL(r.url).origin,M=N(s?.props?.skills||[],e.user,i,t).map(o=>({slug:o.slug,name:o.name,description:o.description,content:o.content,uri:O(D,o.slug)})),w=e.config.products?Object.values(e.config.products).map(o=>o?.name):[],y=h.docs?.name||d,S=q(r.headers.get(u)),T=s?.props?.tools||[];n=await L({name:y,tools:T,skills:M,context:{...e,accessToken:c,outdir:e.outdir||"",baseUrl:e.baseUrl||new URL(r.url).origin,apiDescriptionsMap:R,graphqlDescriptions:A,products:w,metadata:S}});const U=await r.json(),{req:C,res:l}=k(r),b=_(l);try{await n.transport.handleRequest(C,l,U)}catch(o){throw b.stop(),o}return E(l)},async()=>{n&&(await n.cleanup(),n=void 0)})};var ie=z;export{ie as default};

package/dist/server/plugins/mcp/handlers/errors.d.ts

@@ -1,4 +1,4 @@
-import type { McpErrorCodeTypes, McpServerType } from '../types.js';
+import type { McpErrorCodeTypes } from '../types.js';
 export type McpErrorData = {
     readonly code: McpErrorCodeTypes;
     readonly message: string;
@@ -10,29 +10,11 @@ export declare class McpError extends Error {
     readonly data?: unknown;
     readonly requestId?: string | number | null;
     constructor(code: McpErrorCodeTypes, message: string, data?: unknown, requestId?: string | number | null);
-    /**
-     * Creates a JSON-RPC 2.0 compliant error response
-     */
     createErrorResponse(): Response;
 }
-/**
- * Creates a method not allowed error response
- */
 export declare function createMethodNotAllowedError(requestId?: string | number | null): Response;
-/**
- * Creates an internal server error response with telemetry
- */
-export declare function createInternalServerError(error: Error | string, serverType?: McpServerType, requestId?: string | number | null): Response;
-/**
- * Creates an invalid request error response
- */
+export declare function createInternalServerError(error: Error | string, requestId?: string | number | null): Response;
 export declare function createInvalidRequestError(message?: string, requestId?: string | number | null): Response;
-/**
- * Creates an invalid parameters error response
- */
 export declare function createInvalidParamsError(message?: string, requestId?: string | number | null): Response;
-/**
- * Safely handles errors in async functions with proper cleanup
- */
-export declare function withErrorHandling<T>(operation: () => Promise<T>, serverType: McpServerType, cleanup?: () => Promise<void>): Promise<T | Response>;
+export declare function withErrorHandling<T>(operation: () => Promise<T>, cleanup?: () => Promise<void>): Promise<T | Response>;
 //# sourceMappingURL=errors.d.ts.map