@redocly/realm 0.135.0 → 0.136.0-next.1

package/dist/server/plugins/mcp/codemode/sandbox/polyfills.d.ts

@@ -0,0 +1,2 @@
+export declare const SANDBOX_FETCH_SETUP = "\n  const URLSearchParams = class URLSearchParams {\n    constructor(init) {\n      this._params = [];\n      if (typeof init === 'string') {\n        const str = init.startsWith('?') ? init.slice(1) : init;\n        for (const pair of (str ? str.split('&') : [])) {\n          const eq = pair.indexOf('=');\n          const k = eq >= 0 ? pair.slice(0, eq) : pair;\n          const v = eq >= 0 ? pair.slice(eq + 1) : '';\n          if (k) this._params.push([decodeURIComponent(k), decodeURIComponent(v)]);\n        }\n      } else if (init != null && typeof init === 'object') {\n        for (const [k, v] of Object.entries(init)) this._params.push([k, String(v)]);\n      }\n    }\n    append(key, value) { this._params.push([String(key), String(value)]); }\n    set(key, value) {\n      const k = String(key), v = String(value);\n      this._params = this._params.filter(([pk]) => pk !== k);\n      this._params.push([k, v]);\n    }\n    get(key) { return (this._params.find(([k]) => k === String(key)) ?? [undefined, null])[1]; }\n    getAll(key) { return this._params.filter(([k]) => k === String(key)).map(([, v]) => v); }\n    has(key) { return this._params.some(([k]) => k === String(key)); }\n    delete(key) { this._params = this._params.filter(([k]) => k !== String(key)); }\n    entries() { return this._params.values(); }\n    [Symbol.iterator]() { return this._params.values(); }\n    toString() {\n      return this._params\n        .map(([k, v]) => encodeURIComponent(k) + '=' + encodeURIComponent(v))\n        .join('&');\n    }\n  };\n  globalThis.URLSearchParams = URLSearchParams;\n\n  const FormData = class FormData {\n    constructor() { this._fields = []; }\n    append(key, value) { this._fields.push([String(key), String(value)]); }\n    set(key, value) {\n      const k = String(key), v = String(value);\n      this._fields = this._fields.filter(([fk]) => fk !== k);\n      this._fields.push([k, v]);\n    }\n    get(key) { return (this._fields.find(([k]) => k === String(key)) ?? [undefined, null])[1]; }\n    has(key) { return this._fields.some(([k]) => k === String(key)); }\n    delete(key) { this._fields = this._fields.filter(([k]) => k !== String(key)); }\n    entries() { return this._fields.values(); }\n    [Symbol.iterator]() { return this._fields.values(); }\n  };\n  globalThis.FormData = FormData;\n\n  const hostFetch = globalThis.__fetchBridge.fetch;\n  delete globalThis.__fetchBridge;\n  globalThis.fetch = (url, init = {}) => {\n    let body;\n    let autoContentType;\n    if (init.body instanceof URLSearchParams) {\n      body = init.body.toString();\n      autoContentType = 'application/x-www-form-urlencoded';\n    } else if (init.body instanceof FormData) {\n      const boundary = '----FormBoundary' + Math.random().toString(36).slice(2);\n      body = init.body._fields\n        .map(([k, v]) =>\n          '--' + boundary + '\\r\\nContent-Disposition: form-data; name=\"' + k + '\"\\r\\n\\r\\n' + v,\n        )\n        .join('\\r\\n') + '\\r\\n--' + boundary + '--';\n      autoContentType = 'multipart/form-data; boundary=' + boundary;\n    } else if (init.body != null && typeof init.body !== 'string') {\n      throw new TypeError('fetch body must be a string, URLSearchParams, or FormData');\n    } else {\n      body = init.body ?? undefined;\n    }\n    const callerHeaders = init.headers;\n    const hasContentType = callerHeaders != null && Object.keys(callerHeaders).some(\n      (k) => k.toLowerCase() === 'content-type',\n    );\n    const headers = autoContentType && !hasContentType\n      ? Object.assign({ 'content-type': autoContentType }, callerHeaders)\n      : callerHeaders;\n    return hostFetch({ url: String(url), method: init.method, headers, body })\n      .then((res) => {\n        const resHeaders = res.headers || {};\n        return {\n          status: res.status,\n          statusText: res.statusText,\n          ok: res.ok,\n          headers: {\n            get: (name) => {\n              const value = resHeaders[String(name).toLowerCase()];\n              return value === undefined ? null : value;\n            },\n          },\n          json: () => Promise.resolve(JSON.parse(res.bodyText)),\n          text: () => Promise.resolve(res.bodyText),\n        };\n      });\n  };\n";
+//# sourceMappingURL=polyfills.d.ts.map

package/dist/server/plugins/mcp/codemode/sandbox/polyfills.js

@@ -0,0 +1,99 @@
+import{FETCH_BRIDGE_FUNCTION_NAME as t,FETCH_BRIDGE_GLOBAL_NAME as e}from"../constants.js";const s=`
+  const URLSearchParams = class URLSearchParams {
+    constructor(init) {
+      this._params = [];
+      if (typeof init === 'string') {
+        const str = init.startsWith('?') ? init.slice(1) : init;
+        for (const pair of (str ? str.split('&') : [])) {
+          const eq = pair.indexOf('=');
+          const k = eq >= 0 ? pair.slice(0, eq) : pair;
+          const v = eq >= 0 ? pair.slice(eq + 1) : '';
+          if (k) this._params.push([decodeURIComponent(k), decodeURIComponent(v)]);
+        }
+      } else if (init != null && typeof init === 'object') {
+        for (const [k, v] of Object.entries(init)) this._params.push([k, String(v)]);
+      }
+    }
+    append(key, value) { this._params.push([String(key), String(value)]); }
+    set(key, value) {
+      const k = String(key), v = String(value);
+      this._params = this._params.filter(([pk]) => pk !== k);
+      this._params.push([k, v]);
+    }
+    get(key) { return (this._params.find(([k]) => k === String(key)) ?? [undefined, null])[1]; }
+    getAll(key) { return this._params.filter(([k]) => k === String(key)).map(([, v]) => v); }
+    has(key) { return this._params.some(([k]) => k === String(key)); }
+    delete(key) { this._params = this._params.filter(([k]) => k !== String(key)); }
+    entries() { return this._params.values(); }
+    [Symbol.iterator]() { return this._params.values(); }
+    toString() {
+      return this._params
+        .map(([k, v]) => encodeURIComponent(k) + '=' + encodeURIComponent(v))
+        .join('&');
+    }
+  };
+  globalThis.URLSearchParams = URLSearchParams;
+
+  const FormData = class FormData {
+    constructor() { this._fields = []; }
+    append(key, value) { this._fields.push([String(key), String(value)]); }
+    set(key, value) {
+      const k = String(key), v = String(value);
+      this._fields = this._fields.filter(([fk]) => fk !== k);
+      this._fields.push([k, v]);
+    }
+    get(key) { return (this._fields.find(([k]) => k === String(key)) ?? [undefined, null])[1]; }
+    has(key) { return this._fields.some(([k]) => k === String(key)); }
+    delete(key) { this._fields = this._fields.filter(([k]) => k !== String(key)); }
+    entries() { return this._fields.values(); }
+    [Symbol.iterator]() { return this._fields.values(); }
+  };
+  globalThis.FormData = FormData;
+`,r=`
+  const hostFetch = globalThis.${e}.${t};
+  delete globalThis.${e};
+  globalThis.fetch = (url, init = {}) => {
+    let body;
+    let autoContentType;
+    if (init.body instanceof URLSearchParams) {
+      body = init.body.toString();
+      autoContentType = 'application/x-www-form-urlencoded';
+    } else if (init.body instanceof FormData) {
+      const boundary = '----FormBoundary' + Math.random().toString(36).slice(2);
+      body = init.body._fields
+        .map(([k, v]) =>
+          '--' + boundary + '\\r\\nContent-Disposition: form-data; name="' + k + '"\\r\\n\\r\\n' + v,
+        )
+        .join('\\r\\n') + '\\r\\n--' + boundary + '--';
+      autoContentType = 'multipart/form-data; boundary=' + boundary;
+    } else if (init.body != null && typeof init.body !== 'string') {
+      throw new TypeError('fetch body must be a string, URLSearchParams, or FormData');
+    } else {
+      body = init.body ?? undefined;
+    }
+    const callerHeaders = init.headers;
+    const hasContentType = callerHeaders != null && Object.keys(callerHeaders).some(
+      (k) => k.toLowerCase() === 'content-type',
+    );
+    const headers = autoContentType && !hasContentType
+      ? Object.assign({ 'content-type': autoContentType }, callerHeaders)
+      : callerHeaders;
+    return hostFetch({ url: String(url), method: init.method, headers, body })
+      .then((res) => {
+        const resHeaders = res.headers || {};
+        return {
+          status: res.status,
+          statusText: res.statusText,
+          ok: res.ok,
+          headers: {
+            get: (name) => {
+              const value = resHeaders[String(name).toLowerCase()];
+              return value === undefined ? null : value;
+            },
+          },
+          json: () => Promise.resolve(JSON.parse(res.bodyText)),
+          text: () => Promise.resolve(res.bodyText),
+        };
+      });
+  };
+`,i=`${s}${r}`;export{i as SANDBOX_FETCH_SETUP};

package/dist/server/plugins/mcp/codemode/tools/describe-tools.d.ts

@@ -0,0 +1,7 @@
+import type { ToolCallback } from '@redocly/mcp-typescript-sdk/server/mcp.js';
+import type { McpToolSchema } from '../../../../types';
+import type { McpToolContext } from '../../types.js';
+import { type SandboxCapability } from '../capabilities/index.js';
+export declare function describeToolsSchema(tools: McpToolSchema[], capabilities: SandboxCapability[]): Record<string, unknown>;
+export declare function describeTools(tools: McpToolSchema[], isToolAvailable: (toolName: string) => Promise<boolean>, capabilities: SandboxCapability[], context: McpToolContext): ToolCallback<Record<string, unknown>>;
+//# sourceMappingURL=describe-tools.d.ts.map

package/dist/server/plugins/mcp/codemode/tools/describe-tools.js

@@ -0,0 +1 @@
+import{renderDescribeToolsOutput as w}from"../capabilities/index.js";import{sanitizeToolName as o}from"../build-tool-type-declarations.js";function g(i,l){const n=[...new Set([...i.map(s=>o(s.name)),...l.map(s=>o(s.id))])];return{type:"object",required:[],additionalProperties:!1,properties:{tools:{type:"array",description:`Tool names to describe: ${n.join(", ")}. Omit to describe everything.`,items:{type:"string"},nullable:!0}}}}function v(i,l,n,s){const r=new Map(i.map(t=>[o(t.name),t])),c=new Map(n.map(t=>[o(t.id),t]));return async t=>{const a=[...new Set((t.tools??[]).map(o))],p=a.length===0,m=a.filter(e=>!r.has(e)&&!c.has(e));if(m.length>0){const e=[...r.keys(),...c.keys()];throw new Error(`Unknown tool(s): ${m.join(", ")}. Valid tools: ${e.join(", ")}.`)}const u=p?n:n.filter(e=>a.includes(o(e.id))),d=p?i:a.filter(e=>r.has(e)).map(e=>r.get(e)),y=await Promise.all(d.map(e=>l(e.name))),f=d.filter((e,b)=>y[b]);return{content:[{type:"text",text:w(f,u,s)}]}}}export{v as describeTools,g as describeToolsSchema};

package/dist/server/plugins/mcp/codemode/tools/execute-schema.d.ts

@@ -0,0 +1,5 @@
+import type { ToolAnnotations } from '@redocly/mcp-typescript-sdk/types.js';
+import type { McpToolSchema } from '../../../../types';
+export declare const EXECUTE_BASE_ANNOTATIONS: ToolAnnotations;
+export declare const EXECUTE_TOOL_SCHEMA: McpToolSchema;
+//# sourceMappingURL=execute-schema.d.ts.map

package/dist/server/plugins/mcp/codemode/tools/execute-schema.js

@@ -0,0 +1 @@
+import{EXECUTE_TOOL_NAME as e}from"../constants.js";import{buildExecuteDescription as t}from"../prompts.js";const i={title:"Execute code",readOnlyHint:!0,openWorldHint:!1},n={name:e,description:t(!1),annotations:i,schema:{type:"object",required:["code","description"],additionalProperties:!1,properties:{code:{type:"string",description:"JavaScript to run in the sandbox. Return a value to receive it as the result.",minLength:1},description:{type:"string",description:"A short, human-readable summary of what this code does.",minLength:1}}}};export{i as EXECUTE_BASE_ANNOTATIONS,n as EXECUTE_TOOL_SCHEMA};

package/dist/server/plugins/mcp/codemode/tools/execute.js

@@ -0,0 +1 @@
+import{mcpToolHandlers as s}from"../../../../../client/mcp-tool-handlers-entry.js";import{runInSandbox as c}from"../../../../sandbox/sandbox.js";import{isMcpToolAvailable as l}from"../../workers/execute-mcp-tool.js";import{buildExecuteHostFetch as m,isFetchCapable as f}from"../../gateway-mcp/fetch-capability.js";import{CODE_MODE_TOOL_NAMES as u,EXECUTE_TOOL_NAME as p}from"../constants.js";import{sanitizeToolName as d}from"../build-tool-type-declarations.js";import{invokeTool as b}from"../invoke-tool.js";import{createSandboxSetup as T}from"../sandbox/create-sandbox-setup.js";const E=async(e,t,i)=>{const o=await O(t,i),n=f(t)?m(t):void 0,{result:r,error:a}=await c(e.code,{setupContext:T(o,n)});return{content:[{type:"text",text:JSON.stringify({result:r,error:a})}],isError:a!==void 0}};async function O(e,t){const i={};for(const o of Object.keys(s))u.has(o)||!await l({toolName:o,context:e}).catch(()=>!1)||(i[d(o)]=r=>b(o,r,e,t));return i}var C={[p]:E};export{C as default};

package/dist/server/plugins/mcp/codemode/types.d.ts

@@ -0,0 +1,16 @@
+export type SandboxTool = (input: unknown) => Promise<unknown> | unknown;
+export type SandboxFetchRequest = {
+    url: string;
+    method?: string;
+    headers?: Record<string, string>;
+    body?: string;
+};
+export type SandboxFetchResponse = {
+    status: number;
+    statusText: string;
+    ok: boolean;
+    headers: Record<string, string>;
+    bodyText: string;
+};
+export type SandboxFetch = (request: SandboxFetchRequest) => Promise<SandboxFetchResponse>;
+//# sourceMappingURL=types.d.ts.map

package/dist/server/plugins/mcp/constants.d.ts

@@ -8,8 +8,10 @@ export declare const McpErrorCodes: {
     readonly MethodNotFound: -32601;
     readonly InvalidParams: -32602;
 };
+export declare const MCP_PROTOCOL_VERSION = "2025-06-18";
 export declare const DEFAULT_CONNECTION_TIMEOUT_MS = 30000;
 export declare const SSE_KEEPALIVE_INTERVAL_MS = 15000;
 export declare const MAX_DOCUMENTS_PER_CATEGORY = 3;
 export declare const MCP_NOT_ALLOWED_TEMPLATE_ID = "mcp-not-allowed";
+export declare const DEFAULT_DOCS_MCP_SERVER_NAME = "Docs MCP server";
 //# sourceMappingURL=constants.d.ts.map

package/dist/server/plugins/mcp/constants.js

@@ -1 +1 @@
-const o={Docs:"docs"},r={InternalError:-32603,ServerError:-32e3,InvalidRequest:-32600,MethodNotFound:-32601,InvalidParams:-32602},e=3e4,t=15e3,E=3,_="mcp-not-allowed";export{e as DEFAULT_CONNECTION_TIMEOUT_MS,E as MAX_DOCUMENTS_PER_CATEGORY,_ as MCP_NOT_ALLOWED_TEMPLATE_ID,r as McpErrorCodes,o as McpServerType,t as SSE_KEEPALIVE_INTERVAL_MS};
+const o={Docs:"docs"},r={InternalError:-32603,ServerError:-32e3,InvalidRequest:-32600,MethodNotFound:-32601,InvalidParams:-32602},E="2025-06-18",e=3e4,t=15e3,_=3,s="mcp-not-allowed",c="Docs MCP server";export{e as DEFAULT_CONNECTION_TIMEOUT_MS,c as DEFAULT_DOCS_MCP_SERVER_NAME,_ as MAX_DOCUMENTS_PER_CATEGORY,s as MCP_NOT_ALLOWED_TEMPLATE_ID,E as MCP_PROTOCOL_VERSION,r as McpErrorCodes,o as McpServerType,t as SSE_KEEPALIVE_INTERVAL_MS};

package/dist/server/plugins/mcp/docs-mcp/tool-schemas.d.ts

@@ -1,8 +1,4 @@
 import type { McpToolSchema } from '../../../types';
-export declare const EXECUTE_TOOL_NAME = "execute";
-export declare const EXECUTE_TOOL_SCHEMA: McpToolSchema;
-export declare const DESCRIBE_TOOLS_TOOL_NAME = "describe-tools";
-export declare const CODE_MODE_TOOL_NAMES: ReadonlySet<string>;
 export declare function getDefaultToolSchemas(config: {
     products?: string[];
     locales?: string[];

package/dist/server/plugins/mcp/docs-mcp/tool-schemas.js

@@ -1 +1 @@
-import{shouldHandleMcpAuth as d}from"../auth/auth-handlers.js";import{EXECUTE_DESCRIPTION as h}from"./codemode/prompts.js";import{GRAPHQL_TYPE_KINDS as o}from"./tools/graphql/types.js";const p=["GET","POST","PUT","DELETE","PATCH","OPTIONS","HEAD","TRACE"],t={type:"string",nullable:!0},n={limit:{type:"number"},total:{type:"number"},page:{type:"number"},totalPages:{type:"number"}},r={codemodeType:"OpenApiServer[]"},s={codemodeType:"OpenApiSecurityRequirement[]"},l={codemodeType:"Record<string, OpenApiSecurityScheme>"},y={codemodeType:"OpenApiDocument"},g={codemodeType:"OpenApiOperation & { path: string; method: string }"},c="execute",j={name:c,description:h,schema:{type:"object",required:["code","description"],additionalProperties:!1,properties:{code:{type:"string",description:"JavaScript to run in the sandbox. Return a value to receive it as the result.",minLength:1},description:{type:"string",description:"A short, human-readable summary of what this code does (shown to users in place of the raw call).",minLength:1}}}},f="describe-tools",I=new Set([c,f]),b={type:"object",additionalProperties:!1,required:[],properties:{filter:{type:"string",description:"API name (or part of it)",minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of APIs per page. Default is 300",minimum:1,default:300,nullable:!0}}},a={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"API name",minLength:1},version:{type:"string",description:"API version (required when multiple APIs share the same name but differ by version)",nullable:!0}}},S={type:"object",required:["name","path","method"],additionalProperties:!1,properties:{name:{type:"string",description:"API name",minLength:1},path:{type:"string",description:"Endpoint path (e.g. /api/v1/users)",minLength:1},method:{type:"string",description:"HTTP method (GET, POST, PUT, DELETE, etc.)",enum:[...p,...p.map(e=>e.toLowerCase())],minLength:1},version:{type:"string",description:"API version (required when multiple APIs share the same name but differ by version)",nullable:!0}}},v={type:"object",required:[],additionalProperties:!1,properties:{}};function w(e){const i=[{name:"list-apis",description:"Lists available APIs with their context and purpose",schema:b,annotations:{title:"List APIs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{items:{type:"array",items:{type:"object",properties:{name:{type:"string"},description:t,version:t,servers:r}}},...n}}},{name:"get-endpoints",description:"Get all endpoints for a specific API",schema:a,annotations:{title:"Get Endpoints",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{api:{type:"string"},version:{type:"string"},servers:r,endpoints:{type:"array",items:{type:"object",properties:{path:{type:"string"},method:{type:"string"},summary:t,description:t,security:s}}}}}},{name:"get-endpoint-info",description:"Get comprehensive information about specific endpoint including parameters, security, and examples",schema:S,annotations:{title:"Get Endpoint Info",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{api:{type:"string"},version:{type:"string"},servers:r,endpoint:g,globalSecurity:s,securitySchemes:l}}},{name:"get-security-schemes",description:"Get the security schemes for a specific API",schema:a,annotations:{title:"Get Security Schemes",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{name:t,version:t,securitySchemes:l,security:s}}},{name:"get-full-api-description",description:"Get the complete OpenAPI description",schema:a,annotations:{title:"Get Full API Description",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{api:{type:"string"},version:{type:"string"},definition:y}}},P(e.products,e.locales)];return d(e.requiresLogin,e.rbac)&&i.push({name:"whoami",description:"Get information about the currently authenticated user",schema:v,annotations:{title:"Who Am I",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{email:{type:"string"},name:{type:"string"},subject:{type:"string"},clientId:{type:"string"},scope:{type:"string"},issuedAt:{type:"string"},expiresAt:{type:"string"}}}}),e.hasGraphqlApis&&i.push(...O()),i}const H={type:"object",required:[],additionalProperties:!1,properties:{filter:{type:"string",description:"GraphQL schema name (or part of it)",minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of results per page. Default is 300",minimum:1,default:300,nullable:!0}}},L={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1},kind:{type:"string",description:"Optional: return only a single category of schema members",enum:[...o],nullable:!0},filter:{type:"string",description:'Optional: only members whose name contains this substring (e.g. "book")',minLength:1,nullable:!0},referencesType:{type:"string",description:'Optional: only members that reference this type directly or transitively (via return, field, argument, union-member or input-field types). Finds cross-cutting members that never name it \u2014 e.g. referencesType "Book" surfaces a search query returning a union that includes Book.',minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of results per page. Default is 300",minimum:1,default:300,nullable:!0}}},T={type:"object",required:["name","type"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1},type:{type:"string",description:"Name of the type, operation, or directive",minLength:1},includeReferencedTypes:{type:"boolean",description:"Also include the SDL of every type referenced transitively. Gives the whole subgraph at once, but can be large for highly-connected types.",default:!1,nullable:!0}}},A={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1}}};function O(){return[{name:"list-graphql-apis",description:"Lists available GraphQL schemas with their context and purpose",schema:H,annotations:{title:"List GraphQL APIs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{items:{type:"array",items:{type:"object",properties:{name:{type:"string"},description:t}}},...n}}},{name:"get-graphql-type-list",description:'List all operations and types in a GraphQL schema as a flat, paginated list. Each item is tagged with its kind (query, object, enum, \u2026) and carries a one-line description; operations also include their return type and argument signature \u2014 use it to decide which members to fetch in detail. Narrow the result with `kind` (one category), `filter` (member-name substring, e.g. "book"), or `referencesType` (only members that use a given type, directly or transitively) to explore a domain cheaply instead of pulling the full schema.',schema:L,annotations:{title:"Get GraphQL Type List",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{name:{type:"string"},items:{type:"array",items:{type:"object",properties:{kind:{type:"string",enum:o},name:{type:"string"},description:t,type:{type:"string"},args:{type:"string"}}}},...n}}},{name:"get-graphql-type",description:"Get the SDL for a single GraphQL type, operation (query/mutation/subscription field), or directive. Set includeReferencedTypes to also pull in every type it references transitively \u2014 the full structural subgraph in one call, ideal for complete exploration of an entity (e.g. Book and all the types it touches). That traversal only follows what the target depends on; to go the other direction and find the members that use a type, call get-graphql-type-list with `referencesType`.",schema:T,annotations:{title:"Get GraphQL Type",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"string"}},{name:"get-graphql-schema",description:"Get the complete GraphQL schema as SDL \u2014 the whole type graph in one call. Returns everything, so it can be very large and token-expensive for big schemas; prefer get-graphql-type-list (filter/paginate) plus targeted get-graphql-type calls, and reach for this only for small schemas or when you truly need the full SDL.",schema:A,annotations:{title:"Get GraphQL Schema",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"string"}}]}function P(e,i){const u=e&&e.length>0,m=i&&i.length>0;return{name:"search",description:"Search across the documentation to fetch relevant content for a given query",schema:{type:"object",required:["query"],additionalProperties:!1,properties:{query:{type:"string",description:"Search query. Should be a single word or that phrase that is presented in a documentation.",minLength:1},...u?{product:{type:"string",description:"Optional product name to filter search results by specific product.",enum:e,nullable:!0}}:{},...m?{locale:{type:"string",description:"Optional locale code to filter search results by documentation language (e.g. 'en', 'ja'). Use the locale matching the language of the user's request. Defaults to the project's default locale.",enum:i,nullable:!0}}:{}}},annotations:{title:"Search Documentation",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},outputSchema:{type:"string"}}}export{I as CODE_MODE_TOOL_NAMES,f as DESCRIBE_TOOLS_TOOL_NAME,c as EXECUTE_TOOL_NAME,j as EXECUTE_TOOL_SCHEMA,w as getDefaultToolSchemas};
+import{shouldHandleMcpAuth as m}from"../auth/auth-handlers.js";import{GRAPHQL_TYPE_KINDS as o}from"./tools/graphql/types.js";const p=["GET","POST","PUT","DELETE","PATCH","OPTIONS","HEAD","TRACE"],t={type:"string",nullable:!0},n={limit:{type:"number"},total:{type:"number"},page:{type:"number"},totalPages:{type:"number"}},r={codemodeType:"OpenApiServer[]"},s={codemodeType:"OpenApiSecurityRequirement[]"},l={codemodeType:"Record<string, OpenApiSecurityScheme>"},d={codemodeType:"OpenApiDocument"},h={codemodeType:"OpenApiOperation & { path: string; method: string }"},y={type:"object",additionalProperties:!1,required:[],properties:{filter:{type:"string",description:"API name (or part of it)",minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of APIs per page. Default is 300",minimum:1,default:300,nullable:!0}}},a={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"API name",minLength:1},version:{type:"string",description:"API version (required when multiple APIs share the same name but differ by version)",nullable:!0}}},g={type:"object",required:["name","path","method"],additionalProperties:!1,properties:{name:{type:"string",description:"API name",minLength:1},path:{type:"string",description:"Endpoint path (e.g. /api/v1/users)",minLength:1},method:{type:"string",description:"HTTP method (GET, POST, PUT, DELETE, etc.)",enum:[...p,...p.map(e=>e.toLowerCase())],minLength:1},version:{type:"string",description:"API version (required when multiple APIs share the same name but differ by version)",nullable:!0}}},f={type:"object",required:[],additionalProperties:!1,properties:{}};function q(e){const i=[{name:"list-apis",description:"Lists available APIs with their context and purpose",schema:y,annotations:{title:"List APIs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{items:{type:"array",items:{type:"object",properties:{name:{type:"string"},description:t,version:t,servers:r}}},...n}}},{name:"get-endpoints",description:"Get all endpoints for a specific API",schema:a,annotations:{title:"Get Endpoints",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{api:{type:"string"},version:{type:"string"},servers:r,endpoints:{type:"array",items:{type:"object",properties:{path:{type:"string"},method:{type:"string"},summary:t,description:t,security:s}}}}}},{name:"get-endpoint-info",description:"Get comprehensive information about specific endpoint including parameters, security, and examples",schema:g,annotations:{title:"Get Endpoint Info",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{api:{type:"string"},version:{type:"string"},servers:r,endpoint:h,globalSecurity:s,securitySchemes:l}}},{name:"get-security-schemes",description:"Get the security schemes for a specific API",schema:a,annotations:{title:"Get Security Schemes",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{name:t,version:t,securitySchemes:l,security:s}}},{name:"get-full-api-description",description:"Get the complete OpenAPI description",schema:a,annotations:{title:"Get Full API Description",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{api:{type:"string"},version:{type:"string"},definition:d}}},P(e.products,e.locales)];return m(e.requiresLogin,e.rbac)&&i.push({name:"whoami",description:"Get information about the currently authenticated user",schema:f,annotations:{title:"Who Am I",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{email:{type:"string"},name:{type:"string"},subject:{type:"string"},clientId:{type:"string"},scope:{type:"string"},issuedAt:{type:"string"},expiresAt:{type:"string"}}}}),e.hasGraphqlApis&&i.push(...L()),i}const b={type:"object",required:[],additionalProperties:!1,properties:{filter:{type:"string",description:"GraphQL schema name (or part of it)",minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of results per page. Default is 300",minimum:1,default:300,nullable:!0}}},S={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1},kind:{type:"string",description:"Optional: return only a single category of schema members",enum:[...o],nullable:!0},filter:{type:"string",description:'Optional: only members whose name contains this substring (e.g. "book")',minLength:1,nullable:!0},referencesType:{type:"string",description:'Optional: only members that reference this type directly or transitively (via return, field, argument, union-member or input-field types). Finds cross-cutting members that never name it \u2014 e.g. referencesType "Book" surfaces a search query returning a union that includes Book.',minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of results per page. Default is 300",minimum:1,default:300,nullable:!0}}},H={type:"object",required:["name","type"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1},type:{type:"string",description:"Name of the type, operation, or directive",minLength:1},includeReferencedTypes:{type:"boolean",description:"Also include the SDL of every type referenced transitively. Gives the whole subgraph at once, but can be large for highly-connected types.",default:!1,nullable:!0}}},v={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1}}};function L(){return[{name:"list-graphql-apis",description:"Lists available GraphQL schemas with their context and purpose",schema:b,annotations:{title:"List GraphQL APIs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{items:{type:"array",items:{type:"object",properties:{name:{type:"string"},description:t}}},...n}}},{name:"get-graphql-type-list",description:'List all operations and types in a GraphQL schema as a flat, paginated list. Each item is tagged with its kind (query, object, enum, \u2026) and carries a one-line description; operations also include their return type and argument signature \u2014 use it to decide which members to fetch in detail. Narrow the result with `kind` (one category), `filter` (member-name substring, e.g. "book"), or `referencesType` (only members that use a given type, directly or transitively) to explore a domain cheaply instead of pulling the full schema.',schema:S,annotations:{title:"Get GraphQL Type List",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{name:{type:"string"},items:{type:"array",items:{type:"object",properties:{kind:{type:"string",enum:o},name:{type:"string"},description:t,type:{type:"string"},args:{type:"string"}}}},...n}}},{name:"get-graphql-type",description:"Get the SDL for a single GraphQL type, operation (query/mutation/subscription field), or directive. Set includeReferencedTypes to also pull in every type it references transitively \u2014 the full structural subgraph in one call, ideal for complete exploration of an entity (e.g. Book and all the types it touches). That traversal only follows what the target depends on; to go the other direction and find the members that use a type, call get-graphql-type-list with `referencesType`.",schema:H,annotations:{title:"Get GraphQL Type",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"string"}},{name:"get-graphql-schema",description:"Get the complete GraphQL schema as SDL \u2014 the whole type graph in one call. Returns everything, so it can be very large and token-expensive for big schemas; prefer get-graphql-type-list (filter/paginate) plus targeted get-graphql-type calls, and reach for this only for small schemas or when you truly need the full SDL.",schema:v,annotations:{title:"Get GraphQL Schema",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"string"}}]}function P(e,i){const c=e&&e.length>0,u=i&&i.length>0;return{name:"search",description:"Search across the documentation to fetch relevant content for a given query",schema:{type:"object",required:["query"],additionalProperties:!1,properties:{query:{type:"string",description:"Search query. Should be a single word or that phrase that is presented in a documentation.",minLength:1},...c?{product:{type:"string",description:"Optional product name to filter search results by specific product.",enum:e,nullable:!0}}:{},...u?{locale:{type:"string",description:"Optional locale code to filter search results by documentation language (e.g. 'en', 'ja'). Use the locale matching the language of the user's request. Defaults to the project's default locale.",enum:i,nullable:!0}}:{}}},annotations:{title:"Search Documentation",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},outputSchema:{type:"string"}}}export{q as getDefaultToolSchemas};

package/dist/server/plugins/mcp/docs-mcp/tools/openapi/list-apis.js

@@ -1 +1 @@
-import{filterApiDescriptionsByName as f}from"../../utils.js";const x=async(a,l)=>{const{filter:i,page:n=1,limit:e=300}=a;let t=Object.values(l.apiDescriptionsMap);i&&(t=f(t,i));const s=(n-1)*e,o=s+e,r=Math.ceil(t.length/e),c=t.length;return t=t.slice(s,o),t.length===0?{content:[{type:"text",text:"No APIs available"}]}:{content:[{type:"text",text:JSON.stringify({items:t.map(({relativePath:g,...p})=>p),limit:e,total:c,page:n,totalPages:r})}]}};var m={"list-apis":x};export{m as default};
+import{filterApiDescriptionsByName as f}from"../../utils.js";const g=async(l,a)=>{const{filter:i,page:n=1,limit:e=300}=l;let t=Object.values(a.apiDescriptionsMap);i&&(t=f(t,i));const s=(n-1)*e,o=s+e,c=Math.ceil(t.length/e),r=t.length;return t=t.slice(s,o),t.length===0?{content:[{type:"text",text:"No APIs available"}]}:{content:[{type:"text",text:JSON.stringify({items:t.map(({relativePath:h,fetchEligible:x,...p})=>p),limit:e,total:r,page:n,totalPages:c})}]}};var u={"list-apis":g};export{u as default};

package/dist/server/plugins/mcp/docs-mcp/utils.js

@@ -1 +1 @@
-function $(e,o,s){if(!o)return;const n=o.toLowerCase();if(s)return e[`${n}@${s}`];const t=Object.values(e).filter(({name:r})=>r.toLowerCase()===n);if(t.length){if(t.length>1){const r=t.map(({version:c})=>c||"(no version)").join(", ");throw new Error(`Multiple versions of "${o}" found: ${r}. Specify a version to disambiguate.`)}return t[0]}}function v(e,o){return Object.values(e).filter(({name:s})=>s.toLowerCase().includes(o.toLowerCase()))}function d(e,o){if(!o||!e?.startsWith("#/"))return;const s=e.slice(2).split("/");let n=o;for(const t of s)if(typeof n=="object"&&n!==null&&t in n)n=n[t];else return;return n}function l({schema:e,definition:o,visitedRefs:s=new Set,maxDepth:n=50,currentDepth:t=0}){if(!e)return;if(t>=n)return{type:"object",description:`Maximum resolution depth exceeded (${n})`};if("$ref"in e&&e.$ref){if(s.has(e.$ref))return{type:"object",description:`Circular reference detected: ${e.$ref}`,"x-circular-ref":e.$ref};const f=new Set(s);f.add(e.$ref);const u=d(e.$ref,o);return u?l({schema:u,definition:o,visitedRefs:f,maxDepth:n,currentDepth:t+1}):{type:"object",description:`Could not resolve reference: ${e.$ref}`,"x-unresolved-ref":e.$ref}}const r={...e};if(r.properties){const f={};for(const[u,i]of Object.entries(r.properties)){const p=l({schema:i,definition:o,visitedRefs:new Set(s),maxDepth:n,currentDepth:t+1});f[u]=p||i}r.properties=f}if(r.items&&typeof r.items=="object")if(Array.isArray(r.items))r.items=r.items.map(f=>l({schema:f,definition:o,visitedRefs:new Set(s),maxDepth:n,currentDepth:t+1})||f);else{const f=l({schema:r.items,definition:o,visitedRefs:new Set(s),maxDepth:n,currentDepth:t+1});f&&(r.items=f)}return["allOf","anyOf","oneOf"].forEach(f=>{const u=r[f];Array.isArray(u)&&(r[f]=u.reduce((i,p)=>{const m=l({schema:p,definition:o,visitedRefs:new Set(s),maxDepth:n,currentDepth:t+1});return m&&i.push(m),i},[]))}),r}function h({pathParams:e,opParams:o,definition:s}){return[...e,...o].reduce((n,t)=>{if(!t)return n;if("$ref"in t&&t.$ref){const r=d(t.$ref,s);return r&&n.push({...r,schema:"schema"in r&&r.schema?l({schema:r.schema,definition:s}):void 0}),n}return n.push({...t,schema:"schema"in t&&t.schema?l({schema:t.schema,definition:s}):void 0}),n},[])}function a(e,o){const s={...e};if(e.example!==void 0&&(s.example=e.example),!e.examples)return s;const n={};for(const[t,r]of Object.entries(e.examples))if("$ref"in r){const c=d(r.$ref,o);c&&(n[t]=c)}else n[t]=r;return s.examples=n,s}function w(e,o){if(!e)return;const s="$ref"in e&&e.$ref?d(e.$ref,o):e;if(!s)return;const n={...s};if("content"in s&&s.content){const t={};for(const[r,c]of Object.entries(s.content))t[r]={...a(c,o),schema:c.schema?l({schema:c.schema,definition:o}):void 0};n.content=t}return n}function x(e,o){return Object.entries(e).reduce((s,[n,t])=>{const r="$ref"in t&&t.$ref?d(t.$ref,o):t;if(!r)return s;const c={...r};if("content"in r&&r.content){const f={};for(const[u,i]of Object.entries(r.content))f[u]={...a(i,o),schema:i.schema?l({schema:i.schema,definition:o}):void 0};c.content=f}return s[n]=c,s},{})}export{v as filterApiDescriptionsByName,$ as findApiDescriptionByNameAndVersion,h as resolveParameters,d as resolveRef,w as resolveRequestBody,x as resolveResponses,l as resolveSchemaRefs};
+function v(t,o,n){if(!o)return;const s=o.toLowerCase(),r=Object.values(t).filter(({name:i})=>i.toLowerCase()===s);if(r.length===0)return;const e=n?r.filter(i=>i.version===n):r;if(e.length===0)return;if(e.length===1)return e[0];if(new Set(e.map(({version:i})=>i||"")).size>1){const i=e.map(({version:d})=>d||"(no version)").join(", ");throw new Error(`Multiple versions of "${o}" found: ${i}. Specify a version to disambiguate.`)}const c=e.map(({relativePath:i})=>i||"(unknown path)").join(", "),u=e[0].version?` at version "${e[0].version}"`:"";throw new Error(`Multiple APIs are titled "${o}"${u} (${c}). Give them a distinct info.title or info.version so they can be addressed individually.`)}function $(t,o){return Object.values(t).filter(({name:n})=>n.toLowerCase().includes(o.toLowerCase()))}function a(t,o){if(!o||!t?.startsWith("#/"))return;const n=t.slice(2).split("/");let s=o;for(const r of n)if(typeof s=="object"&&s!==null&&r in s)s=s[r];else return;return s}function l({schema:t,definition:o,visitedRefs:n=new Set,maxDepth:s=50,currentDepth:r=0}){if(!t)return;if(r>=s)return{type:"object",description:`Maximum resolution depth exceeded (${s})`};if("$ref"in t&&t.$ref){if(n.has(t.$ref))return{type:"object",description:`Circular reference detected: ${t.$ref}`,"x-circular-ref":t.$ref};const c=new Set(n);c.add(t.$ref);const u=a(t.$ref,o);return u?l({schema:u,definition:o,visitedRefs:c,maxDepth:s,currentDepth:r+1}):{type:"object",description:`Could not resolve reference: ${t.$ref}`,"x-unresolved-ref":t.$ref}}const e={...t};if(e.properties){const c={};for(const[u,i]of Object.entries(e.properties)){const d=l({schema:i,definition:o,visitedRefs:new Set(n),maxDepth:s,currentDepth:r+1});c[u]=d||i}e.properties=c}if(e.items&&typeof e.items=="object")if(Array.isArray(e.items))e.items=e.items.map(c=>l({schema:c,definition:o,visitedRefs:new Set(n),maxDepth:s,currentDepth:r+1})||c);else{const c=l({schema:e.items,definition:o,visitedRefs:new Set(n),maxDepth:s,currentDepth:r+1});c&&(e.items=c)}return["allOf","anyOf","oneOf"].forEach(c=>{const u=e[c];Array.isArray(u)&&(e[c]=u.reduce((i,d)=>{const p=l({schema:d,definition:o,visitedRefs:new Set(n),maxDepth:s,currentDepth:r+1});return p&&i.push(p),i},[]))}),e}function h({pathParams:t,opParams:o,definition:n}){return[...t,...o].reduce((s,r)=>{if(!r)return s;if("$ref"in r&&r.$ref){const e=a(r.$ref,n);return e&&s.push({...e,schema:"schema"in e&&e.schema?l({schema:e.schema,definition:n}):void 0}),s}return s.push({...r,schema:"schema"in r&&r.schema?l({schema:r.schema,definition:n}):void 0}),s},[])}function m(t,o){const n={...t};if(t.example!==void 0&&(n.example=t.example),!t.examples)return n;const s={};for(const[r,e]of Object.entries(t.examples))if("$ref"in e){const f=a(e.$ref,o);f&&(s[r]=f)}else s[r]=e;return n.examples=s,n}function w(t,o){if(!t)return;const n="$ref"in t&&t.$ref?a(t.$ref,o):t;if(!n)return;const s={...n};if("content"in n&&n.content){const r={};for(const[e,f]of Object.entries(n.content))r[e]={...m(f,o),schema:f.schema?l({schema:f.schema,definition:o}):void 0};s.content=r}return s}function b(t,o){return Object.entries(t).reduce((n,[s,r])=>{const e="$ref"in r&&r.$ref?a(r.$ref,o):r;if(!e)return n;const f={...e};if("content"in e&&e.content){const c={};for(const[u,i]of Object.entries(e.content))c[u]={...m(i,o),schema:i.schema?l({schema:i.schema,definition:o}):void 0};f.content=c}return n[s]=f,n},{})}export{$ as filterApiDescriptionsByName,v as findApiDescriptionByNameAndVersion,h as resolveParameters,a as resolveRef,w as resolveRequestBody,b as resolveResponses,l as resolveSchemaRefs};

package/dist/server/plugins/mcp/gateway-mcp/eligibility.d.ts

@@ -0,0 +1,30 @@
+import type { OpenAPIDefinition } from '@redocly/openapi-docs';
+import type { OpenAPIMcp } from '@redocly/openapi-docs/lib/types/open-api.js';
+import type { RbacConfig } from '@redocly/config';
+type GatewayVisibility = {
+    hide?: boolean;
+    docs?: {
+        hide?: boolean;
+        ignore?: readonly string[];
+    };
+    gateway?: {
+        hide?: boolean;
+    };
+};
+/** Whether the gateway fetch capability is on: the feature flag plus none of mcp/docs/gateway hidden. */
+export declare function isGatewayCapabilityEnabled(mcp: GatewayVisibility | undefined): boolean;
+/** Whether an API is eligible for the gateway (fetch-capable `execute` + `/mcp` advertisement). */
+export declare function isGatewayEligible(info: OpenAPIDefinition['info'] | undefined, relativePath: string, rbacConfig: RbacConfig): boolean;
+/**
+ * Whether an API docs page advertises the `/mcp` endpoint via an injected root-level x-mcp:
+ * the capability is on, the author has not provided their own x-mcp servers, and the API is
+ * both gateway-eligible and part of the Docs MCP catalog.
+ */
+export declare function shouldAdvertiseGatewayXMcp(definition: (OpenAPIDefinition & {
+    'x-mcp'?: {
+        servers?: unknown[];
+    };
+}) | undefined, relativePath: string, rbacConfig: RbacConfig, mcpConfig: GatewayVisibility | undefined): boolean;
+export declare function buildGatewayXMcp(url: string): OpenAPIMcp;
+export {};
+//# sourceMappingURL=eligibility.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/eligibility.js

@@ -0,0 +1 @@
+import{join as r}from"node:path";import{PUBLIC_API_DEFINITIONS_FOLDER as s}from"../../../constants/common.js";import{DEFAULT_ANONYMOUS_VISITOR_TEAM as a}from"../../../../constants/common.js";import{canDownloadApiDefinition as n}from"../../../utils/rbac.js";import{MCP_PROTOCOL_VERSION as p}from"../constants.js";import{isApiIncludedInDocsMcp as l}from"../utils.js";import{isMcpGatewayEnabled as c}from"../utils/mode.js";import{isDefinitionHidden as f,hasGatewayConfig as m}from"../utils/xmcp-utils.js";function u(o){return c()&&!o?.hide&&!o?.docs?.hide&&!o?.gateway?.hide}function d(o,e,i){return f(o,"gateway")?!1:n(r(s,e),i,!1,{isAuthenticated:!1,teams:[a]})||m(o)}function D(o,e,i,t){return u(t)&&!o?.["x-mcp"]?.servers?.length&&d(o?.info,e,i)&&l(e,o,t)}function M(o){return{protocolVersion:p,capabilities:{tools:{}},servers:[{url:o}],tools:[],resources:[],prompts:[]}}export{M as buildGatewayXMcp,u as isGatewayCapabilityEnabled,d as isGatewayEligible,D as shouldAdvertiseGatewayXMcp};

package/dist/server/plugins/mcp/gateway-mcp/fetch/allowed-hosts.d.ts

@@ -0,0 +1,13 @@
+import type { OpenAPIServer } from '@redocly/openapi-docs/lib/types/open-api.js';
+/**
+ * Build case-insensitive host matchers from an API's server URL templates (plus any
+ * configured extra hosts). A server URL host may contain server-variable placeholders
+ * (e.g. a tenant `{subdomain}`); each placeholder expands to its `enum` values, or - when
+ * free-form - to one DNS label plus any fixed parent domain carried by the variable's
+ * `default`. So `{subdomain}.dealpos.com` matches `acme.dealpos.com`, and a whole-host
+ * `{subdomain}` defaulting to `acme.dealpos.net` matches `<tenant>.dealpos.net`, but neither
+ * matches `a.b.dealpos.com`, the bare parent domain, or an unrelated host.
+ */
+export declare function buildAllowedHostMatchers(servers?: readonly OpenAPIServer[], extraHosts?: readonly string[]): RegExp[];
+export declare function isHostAllowed(host: string, matchers: readonly RegExp[]): boolean;
+//# sourceMappingURL=allowed-hosts.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/fetch/allowed-hosts.js

@@ -0,0 +1 @@
+const i=/\{([^}]+)\}/g;function m(n=[],e=[]){const t=[];for(const r of n){const o=u(r);o&&t.push(o)}for(const r of e){const o=h(r);o&&t.push(o)}return t}function p(n,e){return e.some(t=>t.test(n))}function u(n){const e=f(n.url);if(!e)return null;let t="",r=0;for(const o of e.matchAll(i)){const[c,l]=o;t+=s(e.slice(r,o.index)),t+=a(n.variables?.[l]),r=o.index+c.length}return t+=s(e.slice(r)),t.includes("\\.")?new RegExp(`^${t}$`,"i"):null}function a(n){const e=n?.enum?.filter(Boolean);if(e&&e.length>0)return`(?:${e.map(s).join("|")})`;const t=n?.default?.split(".").slice(1).join(".");return t?`[^.]+\\.${s(t)}`:"[^.]+"}function h(n){const e=n.trim().toLowerCase();return e?e.startsWith("*.")?new RegExp(`^[^.]+\\.${s(e.slice(2))}$`,"i"):new RegExp(`^${s(e)}$`,"i"):null}function f(n){if(!n)return null;const t=n.replace(/^[a-z][a-z0-9+.-]*:\/\//i,"").split(/[/?#]/,1)[0];return t&&(t.includes("@")?t.slice(t.lastIndexOf("@")+1):t).replace(/:(?:\d+|\{[^}]+\})$/,"")||null}function s(n){return n.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}export{m as buildAllowedHostMatchers,p as isHostAllowed};

package/dist/server/plugins/mcp/gateway-mcp/fetch/fetch-bridge.d.ts

@@ -0,0 +1,12 @@
+import type { SandboxFetch } from '../../codemode/types.js';
+type FetchBridgeOptions = {
+    allowedHosts: readonly RegExp[];
+    authorization?: string;
+    fetchImpl?: typeof fetch;
+    timeoutMs?: number;
+    maxResponseBytes?: number;
+};
+/** Build the host-side `fetch` the gateway sandbox calls. */
+export declare function buildFetchBridge({ allowedHosts, authorization, fetchImpl, timeoutMs, maxResponseBytes }: FetchBridgeOptions): SandboxFetch;
+export {};
+//# sourceMappingURL=fetch-bridge.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/fetch/fetch-bridge.js

@@ -0,0 +1 @@
+import{assertUrlAllowed as f}from"./ssrf-guard.js";const b=3e4,w=1024*1024;function m({allowedHosts:t,authorization:e,fetchImpl:o=fetch,timeoutMs:n=b,maxResponseBytes:s=w}){return async r=>{const a=f(r.url,t),d=g(r.headers,e),c=new AbortController,u=setTimeout(()=>c.abort(),n);try{const i=await o(a,{method:r.method??"GET",headers:d,body:r.body,redirect:"manual",signal:c.signal}),h=await y(i,s);return{status:i.status,statusText:i.statusText,ok:i.ok,headers:T(i.headers),bodyText:h}}finally{clearTimeout(u)}}}async function y(t,e){const o=Number(t.headers.get("content-length"));if(Number.isFinite(o)&&o>e)throw l(e,o);if(!t.body)return"";const n=t.body.getReader(),s=new TextDecoder;let r=0,a="";try{for(;;){const{done:d,value:c}=await n.read();if(d)break;if(r+=c.byteLength,r>e)throw l(e,r);a+=s.decode(c,{stream:!0})}return a+s.decode()}finally{await n.cancel().catch(()=>{})}}function l(t,e){return new Error(`Response is too large (over ${t} bytes, got ${e}); request less data`)}function g(t,e){const o={};let n=!1;for(const[s,r]of Object.entries(t??{})){const a=s.toLowerCase();a==="host"||a==="content-length"||(a==="authorization"&&(n=!0),o[s]=r)}return e&&!n&&(o.Authorization=e),o}function T(t){const e={};return t.forEach((o,n)=>{e[n.toLowerCase()]=o}),e}export{m as buildFetchBridge};

package/dist/server/plugins/mcp/gateway-mcp/fetch/ssrf-guard.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Validate an outbound request URL against an API's host allow-list before the gateway fetches it.
+ *
+ * Returns the parsed URL on success; throws with a clear message otherwise.
+ */
+export declare function assertUrlAllowed(rawUrl: string, matchers: readonly RegExp[]): URL;
+/** True for loopback, private, link-local, unspecified, or otherwise internal addresses. */
+export declare function isBlockedAddress(host: string): boolean;
+//# sourceMappingURL=ssrf-guard.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/fetch/ssrf-guard.js

@@ -0,0 +1 @@
+import{isHostAllowed as f}from"./allowed-hosts.js";function c(e,r){let t;try{t=new URL(e)}catch{throw new Error(`Invalid URL: ${e}`)}if(t.protocol!=="http:"&&t.protocol!=="https:")throw new Error(`Only http(s) URLs are allowed, got ${t.protocol}`);const n=o(t.hostname);if(u(n)||!f(n,r))throw new Error(`Host "${n}" is not allowed`);return t}function u(e){const r=o(e.toLowerCase());return r==="localhost"||r.endsWith(".localhost")?!0:i(r)?s(r):r.includes(":")?l(r):!1}function o(e){return e.replace(/^\[|\]$/g,"")}function i(e){return/^\d{1,3}(\.\d{1,3}){3}$/.test(e)}function s(e){const[r,t]=e.split(".").map(Number);return r===0||r===10||r===127||r===169&&t===254||r===172&&t>=16&&t<=31||r===192&&t===168||r===100&&t>=64&&t<=127}function l(e){if(e==="::1"||e==="::")return!0;const r=e.match(/::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/);if(r)return s(r[1]);const t=parseInt(e.split(":")[0],16);return Number.isNaN(t)?!1:t>=65152&&t<=65215||t>=64512&&t<=65023}export{c as assertUrlAllowed,u as isBlockedAddress};

package/dist/server/plugins/mcp/gateway-mcp/fetch-capability.d.ts

@@ -0,0 +1,6 @@
+import type { ApiDescriptionInfo, McpToolContext } from '../types.js';
+import type { SandboxFetch } from '../codemode/types.js';
+export declare function getCallableApis(context: McpToolContext): ApiDescriptionInfo[];
+export declare function isFetchCapable(context: McpToolContext): boolean;
+export declare function buildExecuteHostFetch(context: McpToolContext): SandboxFetch;
+//# sourceMappingURL=fetch-capability.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/fetch-capability.js

@@ -0,0 +1 @@
+import{isGatewayCapabilityEnabled as a}from"./eligibility.js";import{buildAllowedHostMatchers as l}from"./fetch/allowed-hosts.js";import{buildFetchBridge as s}from"./fetch/fetch-bridge.js";function i(t){return Object.values(t.apiDescriptionsMap??{}).filter(e=>e.fetchEligible)}function u(t){const e=t.config?.mcp;return a(e)&&i(t).length>0}function f(t){const e=t.config?.mcp,o=i(t).flatMap(r=>r.servers??[]);return s({allowedHosts:l(o,e?.gateway?.allowedHosts),authorization:t.upstreamAuthorization})}export{f as buildExecuteHostFetch,i as getCallableApis,u as isFetchCapable};

package/dist/server/plugins/mcp/handlers/docs-mcp-handler.js

@@ -1 +1 @@
-import{toFetchResponse as b,toReqRes as N}from"fetch-to-node";import{logger as m}from"../../../tools/notifiers/logger.js";import{isObject as k}from"../../../../utils/guards/is-object.js";import{createDocsMcpServer as O}from"../servers/docs-server.js";import{filterApiDescriptionsByRbac as U,filterGraphqlDescriptionsByRbac as E}from"../utils.js";import{createMethodNotAllowedError as H,withErrorHandling as I}from"./errors.js";import{attachSseKeepalive as j}from"./sse-keepalive.js";import{McpServerType as L}from"../constants.js";import{constructInvalidTokenResponse as J,constructUnauthorizedResponse as P,handleMcpAuth as q,shouldHandleMcpAuth as B}from"../auth/auth-handlers.js";import{extractTokenFromAuthHeader as G}from"../utils/jwt.js";const u="X-Redocly-AI-Metadata";function $(r){if(r)try{const e=JSON.parse(r);if(k(e))return e;m.warn(`Ignoring ${u} header: not a JSON object.`)}catch{m.warn(`Ignoring ${u} header: invalid JSON.`)}}const z=async(r,e,h)=>{const n=!!e?.config?.access?.requiresLogin,i=e?.config?.access?.rbac||{};let a;const f=r.headers.get("Authorization");if(B(n,i)){const{isAuthenticated:o,isTokenValid:c,currentUser:t,accessToken:p}=await q(r,e);if(!o)return P(new URL(r.url).origin);if(!c)return J();t&&(e.user=t),a=p}else f&&(a=G(f||"")??void 0);let s;const g=async()=>{s&&(await s.cleanup(),s=void 0)};return await I(async()=>{if(r.method==="GET")return new Response(JSON.stringify({error:"Method Not Allowed",message:`In order to use this MCP server, you need register it in your MCP Client (VS Code, Cursor, Claude Code, etc.) using that URL: ${r.url}`}),{status:405,headers:{"Content-Type":"application/json"}});if(r.method!=="POST")return H();const o=h,c=o?.props?.config?.apiDescriptionsMap||{},t=o?.props?.config?.graphqlDescriptions||[],p=o?.props?.config?.mcpDocsServerName||"Docs MCP server",{config:{mcp:D={}}}=e,M=U(c,e.user,i,n),R=E(t,e.user,i,n),y=e.config.products?Object.values(e.config.products).map(l=>l?.name):[],A=D.docs?.name||p,w=$(r.headers.get(u)),T=o?.props?.tools||[];s=await O({name:A,tools:T,context:{...e,accessToken:a,outdir:e.outdir||"",baseUrl:e.baseUrl||new URL(r.url).origin,apiDescriptionsMap:M,graphqlDescriptions:R,products:y,metadata:w}});const v=await r.json(),{req:C,res:d}=N(r),S=j(d);try{await s.transport.handleRequest(C,d,v)}catch(l){throw S.stop(),l}return b(d)},L.Docs,g)};var ee=z;export{ee as default};
+import{toFetchResponse as E,toReqRes as k}from"fetch-to-node";import{logger as m}from"../../../tools/notifiers/logger.js";import{isObject as v}from"../../../../utils/guards/is-object.js";import{getAccessibleSkills as N}from"../../../utils/skills/get-accessible-skills.js";import{getSkillUrl as O}from"../../../utils/skills/get-skill-url.js";import{createDocsMcpServer as L}from"../servers/docs-server.js";import{filterApiDescriptionsByRbac as H,filterGraphqlDescriptionsByRbac as I}from"../utils.js";import{createMethodNotAllowedError as j,withErrorHandling as B}from"./errors.js";import{attachSseKeepalive as _}from"./sse-keepalive.js";import{constructInvalidTokenResponse as J,constructUnauthorizedResponse as P,handleMcpAuth as F,shouldHandleMcpAuth as G}from"../auth/auth-handlers.js";import{extractTokenFromAuthHeader as V}from"../utils/jwt.js";import{DEFAULT_DOCS_MCP_SERVER_NAME as $}from"../constants.js";const u="X-Redocly-AI-Metadata";function q(r){if(r)try{const e=JSON.parse(r);if(v(e))return e;m.warn(`Ignoring ${u} header: not a JSON object.`)}catch{m.warn(`Ignoring ${u} header: invalid JSON.`)}}const z=async(r,e,g)=>{const t=!!e?.config?.access?.requiresLogin,i=e?.config?.access?.rbac||{};let c;const f=r.headers.get("Authorization");if(G(t,i)){const{isAuthenticated:s,isTokenValid:p,currentUser:a,accessToken:d}=await F(r,e);if(!s)return P(new URL(r.url).origin);if(!p)return J();a&&(e.user=a),c=d}else f&&(c=V(f||"")??void 0);let n;return await B(async()=>{if(r.method==="GET")return new Response(JSON.stringify({error:"Method Not Allowed",message:`In order to use this MCP server, you need register it in your MCP Client (VS Code, Cursor, Claude Code, etc.) using that URL: ${r.url}`}),{status:405,headers:{"Content-Type":"application/json"}});if(r.method!=="POST")return j();const s=g,p=s?.props?.config?.apiDescriptionsMap||{},a=s?.props?.config?.graphqlDescriptions||[],d=s?.props?.config?.mcpDocsServerName||$,{config:{mcp:h={}}}=e,R=H(p,e.user,i,t),A=I(a,e.user,i,t),D=s?.props?.skillsBaseUrl||new URL(r.url).origin,M=N(s?.props?.skills||[],e.user,i,t).map(o=>({slug:o.slug,name:o.name,description:o.description,content:o.content,uri:O(D,o.slug)})),w=e.config.products?Object.values(e.config.products).map(o=>o?.name):[],y=h.docs?.name||d,S=q(r.headers.get(u)),T=s?.props?.tools||[];n=await L({name:y,tools:T,skills:M,context:{...e,accessToken:c,outdir:e.outdir||"",baseUrl:e.baseUrl||new URL(r.url).origin,apiDescriptionsMap:R,graphqlDescriptions:A,products:w,metadata:S}});const U=await r.json(),{req:C,res:l}=k(r),b=_(l);try{await n.transport.handleRequest(C,l,U)}catch(o){throw b.stop(),o}return E(l)},async()=>{n&&(await n.cleanup(),n=void 0)})};var ie=z;export{ie as default};

package/dist/server/plugins/mcp/handlers/errors.d.ts

@@ -1,4 +1,4 @@
-import type { McpErrorCodeTypes, McpServerType } from '../types.js';
+import type { McpErrorCodeTypes } from '../types.js';
 export type McpErrorData = {
     readonly code: McpErrorCodeTypes;
     readonly message: string;
@@ -10,29 +10,11 @@ export declare class McpError extends Error {
     readonly data?: unknown;
     readonly requestId?: string | number | null;
     constructor(code: McpErrorCodeTypes, message: string, data?: unknown, requestId?: string | number | null);
-    /**
-     * Creates a JSON-RPC 2.0 compliant error response
-     */
     createErrorResponse(): Response;
 }
-/**
- * Creates a method not allowed error response
- */
 export declare function createMethodNotAllowedError(requestId?: string | number | null): Response;
-/**
- * Creates an internal server error response with telemetry
- */
-export declare function createInternalServerError(error: Error | string, serverType?: McpServerType, requestId?: string | number | null): Response;
-/**
- * Creates an invalid request error response
- */
+export declare function createInternalServerError(error: Error | string, requestId?: string | number | null): Response;
 export declare function createInvalidRequestError(message?: string, requestId?: string | number | null): Response;
-/**
- * Creates an invalid parameters error response
- */
 export declare function createInvalidParamsError(message?: string, requestId?: string | number | null): Response;
-/**
- * Safely handles errors in async functions with proper cleanup
- */
-export declare function withErrorHandling<T>(operation: () => Promise<T>, serverType: McpServerType, cleanup?: () => Promise<void>): Promise<T | Response>;
+export declare function withErrorHandling<T>(operation: () => Promise<T>, cleanup?: () => Promise<void>): Promise<T | Response>;
 //# sourceMappingURL=errors.d.ts.map

package/dist/server/plugins/mcp/handlers/errors.js

@@ -1 +1 @@
-import{telemetry as c}from"../../../telemetry/index.js";import{McpErrorCodes as o,McpServerType as i}from"../constants.js";import{getMcpMode as d}from"../mode.js";class n extends Error{code;data;requestId;constructor(r,t,s,a){super(t),this.name="McpError",this.code=r,this.data=s,this.requestId=a}createErrorResponse(){const r={jsonrpc:"2.0",error:{code:this.code,message:this.message,...this.data?{data:this.data}:{}},id:this.requestId??null},t=u(this.code);return new Response(JSON.stringify(r),{status:t,headers:{"Content-Type":"application/json"}})}}function u(e){switch(e){case o.InvalidRequest:case o.InvalidParams:return 400;case o.MethodNotFound:return 404;case o.ServerError:return 405;case o.InternalError:default:return 500}}function h(e){return new n(o.ServerError,"Method not allowed",void 0,e).createErrorResponse()}function p(e,r=i.Docs,t){const s=e instanceof Error?e.message:String(e),a=e instanceof Error?e.stack:void 0;return c.sendMcpErrorMessage([{id:r,object:"mcpServer",uri:`urn:redocly:realm:mcp:server:${r}`,server_type:r,message:s,stack:a||"",mode:d()}]),new n(o.InternalError,"Internal server error mcp",s,t).createErrorResponse()}function v(e="Invalid request",r){return new n(o.InvalidRequest,e,void 0,r).createErrorResponse()}function I(e="Invalid parameters",r){return new n(o.InvalidParams,e,void 0,r).createErrorResponse()}async function M(e,r,t){try{return await e()}catch(s){return c.sendMcpErrorMessage([{id:r,object:"mcpServer",uri:`urn:redocly:realm:mcp:server:${r}`,server_type:r,message:s?.message||"",stack:s?.stack||"",mode:d()}]),t&&t(),p(s,r)}}export{n as McpError,p as createInternalServerError,I as createInvalidParamsError,v as createInvalidRequestError,h as createMethodNotAllowedError,M as withErrorHandling};
+import{telemetry as d}from"../../../telemetry/index.js";import{McpErrorCodes as o,McpServerType as s}from"../constants.js";import{getMcpMode as i}from"../utils/mode.js";class n extends Error{code;data;requestId;constructor(e,t,a,c){super(t),this.name="McpError",this.code=e,this.data=a,this.requestId=c}createErrorResponse(){const e={jsonrpc:"2.0",error:{code:this.code,message:this.message,...this.data?{data:this.data}:{}},id:this.requestId??null},t=p(this.code);return new Response(JSON.stringify(e),{status:t,headers:{"Content-Type":"application/json"}})}}function p(r){switch(r){case o.InvalidRequest:case o.InvalidParams:return 400;case o.MethodNotFound:return 404;case o.ServerError:return 405;case o.InternalError:default:return 500}}function v(r){return new n(o.ServerError,"Method not allowed",void 0,r).createErrorResponse()}function u(r,e){const t=r instanceof Error?r.message:String(r),a=r instanceof Error?r.stack:void 0;return d.sendMcpErrorMessage([{id:s.Docs,object:"mcpServer",uri:`urn:redocly:realm:mcp:server:${s.Docs}`,server_type:s.Docs,message:t,stack:a||"",mode:i()}]),new n(o.InternalError,"Internal server error mcp",t,e).createErrorResponse()}function f(r="Invalid request",e){return new n(o.InvalidRequest,r,void 0,e).createErrorResponse()}function h(r="Invalid parameters",e){return new n(o.InvalidParams,r,void 0,e).createErrorResponse()}async function I(r,e){try{return await r()}catch(t){return d.sendMcpErrorMessage([{id:s.Docs,object:"mcpServer",uri:`urn:redocly:realm:mcp:server:${s.Docs}`,server_type:s.Docs,message:t?.message||"",stack:t?.stack||"",mode:i()}]),e&&e(),u(t)}}export{n as McpError,u as createInternalServerError,h as createInvalidParamsError,f as createInvalidRequestError,v as createMethodNotAllowedError,I as withErrorHandling};

package/dist/server/plugins/mcp/handlers/handle-mcp-request.js

@@ -1 +1 @@
-import{withPathPrefix as h}from"@redocly/theme/core/utils";import{importApiRoutesHandler as g}from"../../../api-routes/import-api-routes-handlers.js";import{enhanceContext as A}from"../../../api-routes/helpers/enhance-context.js";import{telemetry as T}from"../../../telemetry/index.js";import{KvService as D}from"../../../persistence/kv/services/kv-service.js";import{envConfig as o}from"../../../config/env-config.js";import{acceptsHtml as R}from"../../../utils/ai-agent-detection.js";import{handleErrorPageRender as E}from"../../../web-server/utils.js";import{MCP_NOT_ALLOWED_TEMPLATE_ID as c}from"../constants.js";async function b(n,t,e){const i=t.req.raw;if(i.method==="GET"&&R(i.headers.get("accept"))&&e.templates.has(c))return E(t,e,{slug:n.slug},405,c);const r=t.get("auth"),s=await e.resolveRouteStaticData(n)||{},m=h(n.slug),{requestHandlers:p}=await g(e.serverOutDir),l=p[n.requestHandlerId],u=(await l()).default,d=async()=>await D.getInstance({baseDbDir:e.serverOutDir,sqldRemoteDatabaseUrl:o.SQLD_REMOTE_DATABASE_URL,sqldRemoteDatabaseAuthToken:o.SQLD_REMOTE_DATABASE_AUTH_TOKEN}),f=A({honoCtx:t,ctx:{user:{teams:r.teams,email:r.claims.email,claims:r.claims,idpAccessToken:r.idpAccessToken,idpId:r.claims.idpId,isAuthenticated:r.isAuthenticated},config:e.config,outdir:e.outdir,baseUrl:new URL(t.req.url).origin},telemetry:T,getKv:d}),a=await u(t.req.raw,f,{...s,props:{...s.props,routeSlug:m,outdir:e.outdir}});return a instanceof Response?a:typeof a=="string"?new Response(a,{headers:{"Content-Type":"text/plain"}}):new Response(JSON.stringify(a),{headers:{"Content-Type":"application/json"}})}export{b as handleMcpRequest};
+import{withPathPrefix as f}from"@redocly/theme/core/utils";import{importApiRoutesHandler as g}from"../../../api-routes/import-api-routes-handlers.js";import{enhanceContext as h}from"../../../api-routes/helpers/enhance-context.js";import{telemetry as D}from"../../../telemetry/index.js";import{KvService as A}from"../../../persistence/kv/services/kv-service.js";import{envConfig as o}from"../../../config/env-config.js";import{acceptsHtml as T}from"../../../utils/ai-agent-detection.js";import{handleErrorPageRender as R}from"../../../web-server/utils.js";import{MCP_NOT_ALLOWED_TEMPLATE_ID as E}from"../constants.js";import{resolvePublicBaseUrl as w}from"../../../web-server/utils/resolve-public-base-url.js";async function C(i,t,e){const s=t.req.raw;if(s.method==="GET"&&T(s.headers.get("accept"))&&e.globalData.mcpData?.docs?.enabled)return R(t,e,{slug:i.slug},405,E);const r=t.get("auth"),n=await e.resolveRouteStaticData(i)||{},l=f(i.slug),{requestHandlers:c}=await g(e.serverOutDir),m=c[i.requestHandlerId],p=(await m()).default,u=async()=>await A.getInstance({baseDbDir:e.serverOutDir,sqldRemoteDatabaseUrl:o.SQLD_REMOTE_DATABASE_URL,sqldRemoteDatabaseAuthToken:o.SQLD_REMOTE_DATABASE_AUTH_TOKEN}),d=h({honoCtx:t,ctx:{user:{teams:r.teams,email:r.claims.email,claims:r.claims,idpAccessToken:r.idpAccessToken,idpId:r.claims.idpId,isAuthenticated:r.isAuthenticated},config:e.config,outdir:e.outdir,baseUrl:new URL(t.req.url).origin},telemetry:D,getKv:u}),a=await p(t.req.raw,d,{...n,props:{...n.props,routeSlug:l,outdir:e.outdir,skills:e.config.skills?.hide===!0?[]:e.getSkills(),skillsBaseUrl:w(e,t)}});return a instanceof Response?a:typeof a=="string"?new Response(a,{headers:{"Content-Type":"text/plain"}}):new Response(JSON.stringify(a),{headers:{"Content-Type":"application/json"}})}export{C as handleMcpRequest};

package/dist/server/plugins/mcp/index.js

@@ -1 +1 @@
-import{fileURLToPath as b}from"node:url";import{dirname as A,join as a}from"node:path";import{logger as g}from"../../tools/notifiers/logger.js";import{reporter as O}from"../../tools/notifiers/reporter.js";import{isDefined as _}from"../../../utils/guards/is-defined.js";import{buildGraphqlDescriptions as w,filterIgnoredApiDescriptions as h,getCleanedUpApiDescriptions as R,isMcpInRedirects as q}from"./utils.js";import{isMcpCodeModeEnabled as L}from"./mode.js";import{getDefaultToolSchemas as j,EXECUTE_TOOL_SCHEMA as N}from"./docs-mcp/tool-schemas.js";import{telemetryTraceStep as G}from"../../../cli/telemetry/helpers/trace-step.js";import{MCP_NOT_ALLOWED_TEMPLATE_ID as H}from"./constants.js";const D="mcp-docs-server-handler",p=A(b(import.meta.url));async function I(){let i=!1;return{id:"mcp",async processContent(e,r){i||await G("build.plugin.mcp",async c=>{const t=await e.loadOpenApiDefinitions(r),d=await e.loadGraphqlDefinitions(r),s=await r.getConfig(),{mcp:n,redirects:v}=s;if(c?.setAttribute("config",JSON.stringify(n||{})),!(n?.hide||n?.docs?.hide)&&(q(v)&&await O.panicOnBuildContentError('The reserved route "/mcp" cannot be used in redirect configuration. Please remove any redirects involving "/mcp" from your redocly.yaml config.'),e.createTemplate(H,"@redocly/theme/layouts/McpNotAllowed"),!n?.docs?.hide)){g.info("Configuring MCP servers...");const M=a(p,"./handlers/docs-mcp-handler.js"),C=R(h(t,n?.docs?.ignore||[])),l=new Map;for(const o of C){const f=o.definition.info?.title||"",u=o.definition.info?.version||"";l.set(`${f.toLowerCase()}@${u}`,{name:f,description:o.definition.info?.description||"",version:u,servers:o.definition.servers||[],relativePath:o.relativePath})}const m=w(h(d,n?.docs?.ignore||[])),P=Object.values(s.products||{}).map(o=>o?.name).filter(_),y=s.l10n?.locales?.map(o=>o.code)??r.fs.localeFolders,E=!!s?.access?.requiresLogin,S=s?.access?.rbac||{},T=j({products:P,locales:y,requiresLogin:E,rbac:S,hasGraphqlApis:m.length>0});e.addMcpTools(a(p,"./docs-mcp/tools/index.js"),T),L()&&e.addMcpTools(a(p,"./docs-mcp/tools/execute.js"),[N]),await U({actions:e,handlerPath:M,apiDescriptionsMap:Object.fromEntries(l),graphqlDescriptions:m,mcpConfig:n}),i=!0}})},async afterRoutesCreated(e,r){const c=await r.getConfig(),{mcp:t}=c;e.setGlobalData({mcpData:{docs:{enabled:!t?.hide&&!t?.docs?.hide,name:t?.docs?.name}}})}}}var K=I;async function U({actions:i,handlerPath:e,apiDescriptionsMap:r,graphqlDescriptions:c,mcpConfig:t}){i.createRequestHandler(D,e),i.addApiRoute({slug:"/mcp",requestHandlerId:D,httpMethod:"all",getStaticData:async()=>({props:{config:{apiDescriptionsMap:r,graphqlDescriptions:c,mcpDocsServerName:t?.docs?.name||"Docs MCP Server"},serverOutDir:i.serverOutDir,tools:i.getMcpTools().map(({importPath:d,...s})=>s)}})}),g.info("Registered Docs MCP Server endpoint at /mcp")}export{D as MCP_DOCS_SERVER_HANDLER_ID,K as default,I as mcpServerPlugin};
+import{fileURLToPath as O}from"node:url";import{dirname as T,join as c}from"node:path";import{logger as g}from"../../tools/notifiers/logger.js";import{reporter as A}from"../../tools/notifiers/reporter.js";import{isDefined as R}from"../../../utils/guards/is-defined.js";import{buildGraphqlDescriptions as w,filterIgnoredApiDescriptions as u,getCleanedUpApiDescriptions as L,isMcpInRedirects as q}from"./utils.js";import{isMcpCodeModeEnabled as G}from"./utils/mode.js";import{getDefaultToolSchemas as N}from"./docs-mcp/tool-schemas.js";import{EXECUTE_TOOL_SCHEMA as j}from"./codemode/tools/execute-schema.js";import{isGatewayCapabilityEnabled as U,isGatewayEligible as H}from"./gateway-mcp/eligibility.js";import{telemetryTraceStep as I}from"../../../cli/telemetry/helpers/trace-step.js";import{DEFAULT_DOCS_MCP_SERVER_NAME as F,MCP_NOT_ALLOWED_TEMPLATE_ID as x}from"./constants.js";const h="mcp-docs-server-handler",V="/mcp",p=T(O(import.meta.url));async function B(){let r=!1;return{id:"mcp",async processContent(i,o){r||await I("build.plugin.mcp",async a=>{const s=await i.loadOpenApiDefinitions(o),l=await i.loadGraphqlDefinitions(o),n=await o.getConfig(),{mcp:t,redirects:D}=n;if(a?.setAttribute("config",JSON.stringify(t||{})),!(t?.hide||t?.docs?.hide)&&(q(D)&&await A.panicOnBuildContentError('The reserved route "/mcp" cannot be used in redirect configuration. Please remove any redirects involving "/mcp" from your redocly.yaml config.'),i.createTemplate(x,"@redocly/theme/layouts/McpNotAllowed"),!t?.docs?.hide)){g.info("Configuring MCP servers...");const C=c(p,"./handlers/docs-mcp-handler.js"),E=L(u(s,t?.docs?.ignore||[])),M=!!n?.access?.requiresLogin,d=n?.access?.rbac||{},v=U(t),m=new Map;for(const e of E){const b=e.definition.info?.title||"",S=e.definition.info?.version||"";m.set(e.relativePath,{name:b,description:e.definition.info?.description||"",version:S,servers:e.definition.servers||[],relativePath:e.relativePath,...v&&H(e.definition.info,e.relativePath,d)?{fetchEligible:!0}:{}})}const f=w(u(l,t?.docs?.ignore||[])),y=Object.values(n.products||{}).map(e=>e?.name).filter(R),P=n.l10n?.locales?.map(e=>e.code)??o.fs.localeFolders,_=N({products:y,locales:P,requiresLogin:M,rbac:d,hasGraphqlApis:f.length>0});i.addMcpTools(c(p,"./docs-mcp/tools/index.js"),_),G()&&i.addMcpTools(c(p,"./codemode/tools/execute.js"),[j]),await J({actions:i,handlerPath:C,apiDescriptionsMap:Object.fromEntries(m),graphqlDescriptions:f,mcpConfig:t}),r=!0}})},async afterRoutesCreated(i,o){const a=await o.getConfig(),{mcp:s}=a;i.setGlobalData({mcpData:{docs:{enabled:!s?.hide&&!s?.docs?.hide,name:s?.docs?.name}}})}}}var te=B;async function J({actions:r,handlerPath:i,apiDescriptionsMap:o,graphqlDescriptions:a,mcpConfig:s}){r.createRequestHandler(h,i),r.addApiRoute({slug:V,requestHandlerId:h,httpMethod:"all",getStaticData:async()=>({props:{config:{apiDescriptionsMap:o,graphqlDescriptions:a,mcpDocsServerName:s?.docs?.name||F},serverOutDir:r.serverOutDir,tools:r.getMcpTools().map(({importPath:l,...n})=>n)}})}),g.info("Registered Docs MCP Server endpoint at /mcp")}export{h as MCP_DOCS_SERVER_HANDLER_ID,te as default,B as mcpServerPlugin};

package/dist/server/plugins/mcp/servers/docs-server.d.ts

@@ -1,15 +1,10 @@
-import { McpServer } from '@redocly/mcp-typescript-sdk/server/mcp.js';
-import { StreamableHTTPServerTransport } from '@redocly/mcp-typescript-sdk/server/streamableHttp.js';
 import type { McpToolSchema } from '../../../types';
-import type { McpToolContext } from '../types.js';
-export type DocsMcpServerInstance = {
-    server: McpServer;
-    transport: StreamableHTTPServerTransport;
-    cleanup: () => Promise<void>;
-};
-export declare function createDocsMcpServer({ name, tools, context }: {
+import type { McpToolContext, SkillMcpResource } from '../types.js';
+import { type McpServerInstance } from './mcp-server.js';
+export declare function createDocsMcpServer({ name, tools, context, skills }: {
     name: string;
     tools: McpToolSchema[];
     context: McpToolContext;
-}): Promise<DocsMcpServerInstance>;
+    skills?: SkillMcpResource[];
+}): Promise<McpServerInstance>;
 //# sourceMappingURL=docs-server.d.ts.map

package/dist/server/plugins/mcp/servers/docs-server.js

@@ -1,3 +1 @@
-import{McpServer as _}from"@redocly/mcp-typescript-sdk/server/mcp.js";import{StreamableHTTPServerTransport as S}from"@redocly/mcp-typescript-sdk/server/streamableHttp.js";import{logger as p}from"../../../tools/notifiers/logger.js";import{mcpToolWorkers as u,MCP_TOOL_WORKER_KEY as b,MCP_TOOL_IS_AVAILABLE_KEY as y}from"../../../workers/mcp-tool-worker-pool.js";import{EXECUTE_TOOL_NAME as d,EXECUTE_TOOL_SCHEMA as f,DESCRIBE_TOOLS_TOOL_NAME as I,CODE_MODE_TOOL_NAMES as C}from"../docs-mcp/tool-schemas.js";import{buildToolTypeDeclarations as M,sanitizeToolName as E}from"../docs-mcp/codemode/build-tool-type-declarations.js";import{CODE_MODE_INSTRUCTIONS as D,DESCRIBE_TOOLS_DESCRIPTION as g,USAGE_NOTES as h}from"../docs-mcp/codemode/prompts.js";import{isMcpCodeModeEnabled as T}from"../mode.js";async function B({name:e,tools:o,context:n}){const a=new _({name:e,version:new Date().toISOString().slice(0,10)},{capabilities:{logging:{}},instructions:T()?D:void 0}),s=new S({sessionIdGenerator:void 0}),c=L(n),l=r=>async(t,m)=>{p.info(`MCP tool called: ${r}`);const O={toolName:r,args:t,context:c,extra:w(m)};return await u.exec(b,[O],{timeout:6e4})},i=async r=>{try{return await u.exec(y,[{toolName:r,context:c}],{timeout:1e4})}catch(t){return p.error(`Failed to check MCP tool availability for "${r}": ${t instanceof Error?t.message:String(t)}`),!1}};if(T()){const r=o.filter(t=>!C.has(t.name));a.tool(d,f.description,f.schema,l(d)),a.tool(I,g,q(r),v(r,i))}else await Promise.all(o.map(async r=>{const t=r.annotations||{title:r.name},m=a.tool(r.name,r.description,r.schema,t,l(r.name));await i(r.name)||m.disable()}));return await a.connect(s),{server:a,transport:s,cleanup:async()=>{s.close()}}}function q(e){const o=[...new Set(e.map(n=>E(n.name)))];return{type:"object",required:[],additionalProperties:!1,properties:{tools:{type:"array",description:"Tool names to describe. Omit to describe every tool.",items:{type:"string",enum:o},nullable:!0}}}}function v(e,o){return async n=>{const a=n.tools,s=a?.length?e.filter(i=>a.includes(E(i.name))):e,c=await Promise.all(s.map(i=>o(i.name))),l=s.filter((i,r)=>c[r]);return{content:[{type:"text",text:`${M(l)}
-
-${h}`}]}}}function w(e){return{sessionId:e.sessionId,authInfo:e.authInfo,requestId:e.requestId,requestInfo:e.requestInfo,_meta:e._meta}}function L(e){return{user:e.user,config:e.config,outdir:e.outdir,baseUrl:e.baseUrl,params:e.params,query:e.query,cookies:e.cookies,apiDescriptionsMap:e.apiDescriptionsMap,graphqlDescriptions:e.graphqlDescriptions,products:e.products,accessToken:e.accessToken,metadata:e.metadata}}export{B as createDocsMcpServer};
+import{logger as O}from"../../../tools/notifiers/logger.js";import{mcpToolWorkers as _,MCP_TOOL_IS_AVAILABLE_KEY as u}from"../../../workers/mcp-tool-worker-pool.js";import{EXECUTE_TOOL_SCHEMA as C}from"../codemode/tools/execute-schema.js";import{EXECUTE_TOOL_NAME as p,DESCRIBE_TOOLS_TOOL_NAME as M,CODE_MODE_TOOL_NAMES as b,FETCH_TOOL_NAME as S}from"../codemode/constants.js";import{buildCodeModeInstructions as A,buildExecuteDescription as h,DESCRIBE_TOOLS_DESCRIPTION as x}from"../codemode/prompts.js";import{composeExecuteAnnotations as L,getActiveCapabilities as D}from"../codemode/capabilities/index.js";import{describeToolsSchema as v,describeTools as y}from"../codemode/tools/describe-tools.js";import{isMcpCodeModeEnabled as g}from"../utils/mode.js";import{connectMcpServer as I,createMcpServer as k,createToolDispatch as w,extractSerializableContext as N}from"./mcp-server.js";async function K({name:E,tools:a,context:i,skills:d=[]}){const n=g(),r=n?D(i):[],s=r.some(e=>e.id===S),{server:o,transport:f}=k(E,n?A(s):void 0),c=N(i),m=w(c),l=async e=>{try{return await _.exec(u,[{toolName:e,context:c}],{timeout:1e4})}catch(t){return O.error(`Failed to check MCP tool availability for "${e}": ${t instanceof Error?t.message:String(t)}`),!1}};if(n){const e=a.filter(t=>!b.has(t.name));o.tool(p,h(s),C.schema,L(r),m(p)),o.tool(M,x,v(e,r),y(e,l,r,i))}else await Promise.all(a.map(async e=>{const t=e.annotations||{title:e.name},T=o.tool(e.name,e.description,e.schema,t,m(e.name));await l(e.name)||T.disable()}));for(const e of d)o.registerResource(e.slug,e.uri,{title:e.name,description:e.description,mimeType:"text/markdown"},async()=>({contents:[{uri:e.uri,mimeType:"text/markdown",text:e.content}]}));return I(o,f)}export{K as createDocsMcpServer};

package/dist/server/plugins/mcp/servers/mcp-server.d.ts

@@ -0,0 +1,18 @@
+import { McpServer } from '@redocly/mcp-typescript-sdk/server/mcp.js';
+import { StreamableHTTPServerTransport } from '@redocly/mcp-typescript-sdk/server/streamableHttp.js';
+import type { ToolCallback } from '@redocly/mcp-typescript-sdk/server/mcp.js';
+import type { McpToolContext } from '../types.js';
+export type McpServerInstance = {
+    server: McpServer;
+    transport: StreamableHTTPServerTransport;
+    cleanup: () => Promise<void>;
+};
+export declare function createMcpServer(name: string, instructions?: string): {
+    server: McpServer;
+    transport: StreamableHTTPServerTransport;
+};
+export declare function connectMcpServer(server: McpServer, transport: StreamableHTTPServerTransport): Promise<McpServerInstance>;
+/** Build the tool callback that ships a tool call to the worker pool. */
+export declare function createToolDispatch(serializableContext: McpToolContext): (toolName: string) => ToolCallback<Record<string, unknown>>;
+export declare function extractSerializableContext(context: McpToolContext): McpToolContext;
+//# sourceMappingURL=mcp-server.d.ts.map

package/dist/server/plugins/mcp/servers/mcp-server.js

@@ -0,0 +1 @@
+import{McpServer as i}from"@redocly/mcp-typescript-sdk/server/mcp.js";import{StreamableHTTPServerTransport as t}from"@redocly/mcp-typescript-sdk/server/streamableHttp.js";import{logger as n}from"../../../tools/notifiers/logger.js";import{mcpToolWorkers as c,MCP_TOOL_WORKER_KEY as u}from"../../../workers/mcp-tool-worker-pool.js";const p=6e4;function T(e,r){const o=new i({name:e,version:new Date().toISOString().slice(0,10)},{capabilities:{logging:{}},...r?{instructions:r}:{}}),a=new t({sessionIdGenerator:void 0});return{server:o,transport:a}}async function g(e,r){return await e.connect(r),{server:e,transport:r,cleanup:async()=>{r.close()}}}function S(e){return r=>async(o,a)=>{n.info(`MCP tool called: ${r}`);const s={toolName:r,args:o,context:e,extra:l(a)};return await c.exec(u,[s],{timeout:p})}}function l(e){return{sessionId:e.sessionId,authInfo:e.authInfo,requestId:e.requestId,requestInfo:e.requestInfo,_meta:e._meta}}function q(e){return{user:e.user,config:e.config,outdir:e.outdir,baseUrl:e.baseUrl,params:e.params,query:e.query,cookies:e.cookies,apiDescriptionsMap:e.apiDescriptionsMap,graphqlDescriptions:e.graphqlDescriptions,products:e.products,accessToken:e.accessToken,metadata:e.metadata,upstreamAuthorization:e.upstreamAuthorization}}export{g as connectMcpServer,T as createMcpServer,S as createToolDispatch,q as extractSerializableContext};