@redocly/realm 0.138.0-next.12 → 0.138.0-next.14

package/dist/server/plugins/mcp/handlers/mcp-credentials-handler.js

@@ -1 +0,0 @@
-import{secretStore as u}from"../gateway-mcp/secret-store.js";import{rejectCredential as b}from"../gateway-mcp/credential-validation.js";import{buildAllowedHostMatchers as A}from"../gateway-mcp/fetch/allowed-hosts.js";import{assertUrlAllowed as j}from"../gateway-mcp/fetch/ssrf-guard.js";import{readCappedBody as v,getDefaultAgent as O}from"../gateway-mcp/fetch/fetch-bridge.js";import{logger as F}from"../../../tools/notifiers/logger.js";import{clearedPage as I,formPage as x,multiOutcomePage as N,notFoundPage as D,successPage as $}from"./mcp-credentials-page.js";const g={"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store","X-Frame-Options":"DENY","Referrer-Policy":"no-referrer","Content-Security-Policy":"default-src 'none'; style-src 'unsafe-inline'; form-action 'self'"},B=3e4,M=64*1024,U=/^bearer\s+/i;let P=fetch;function ee(e){P=e}const G=async(e,i)=>{const t=await i.getKv();if(e.method==="GET"){const n=new URL(e.url).searchParams.get("token")??"",o=await u.peekElicitation(t,n);return o?new Response(x(o,n),{status:200,headers:g}):m()}if(e.method==="POST"){const n=await e.formData(),o=d(n,"token"),s=d(n,"mode")||"token";return s==="multi"?z(t,n,o):s==="client-credentials"?K(t,n,o):s==="clear"?X(t,o):H(t,n,o)}return new Response("Method Not Allowed",{status:405,headers:{Allow:"GET, POST"}})};async function H(e,i,t){const n=d(i,"secret").trim(),o=await u.peekElicitation(e,t);if(!o)return m();const s=b(o.auth,n);if(s)return h(o,t,s);const l=await u.consumeElicitation(e,t);return l?(await u.setSecret(e,l.subject,l.api,l.scheme,S(l.auth,n)),new Response($(l),{status:200,headers:g})):m()}async function X(e,i){const t=await u.consumeElicitation(e,i);return t?(await u.deleteSecret(e,t.subject,t.api,t.scheme),new Response(I(t),{status:200,headers:g})):m()}async function z(e,i,t){const n=await u.peekElicitation(e,t);if(!n?.schemes||n.schemes.length<=1)return m();const o=n.schemes,s=[];for(let r=0;r<o.length;r++){const a=o[r],p=d(i,`secret__${r}`).trim(),E=d(i,`client_id__${r}`).trim(),_=d(i,`client_secret__${r}`).trim();if(a.hasExistingSecret&&d(i,`remove__${r}`)){if(p||E||_)return h(n,t,`${a.name}: enter a new value or tick "Remove the stored credential", not both.`);s.push({kind:"remove",scheme:a.name});continue}if(a.auth.kind==="oauth2ClientCredentials"){if(p){const C=b(a.auth,p);if(C)return h(n,t,`${a.name}: ${C}`);s.push({kind:"set",scheme:a.name,secret:S(a.auth,p)})}else if(E&&_)s.push({kind:"exchange",scheme:a.name,auth:a.auth,clientId:E,clientSecret:_});else if(E||_)return h(n,t,`${a.name}: enter both the client ID and the client secret, or leave both blank.`);continue}if(!p)continue;const y=b(a.auth,p);if(y)return h(n,t,`${a.name}: ${y}`);s.push({kind:"set",scheme:a.name,secret:S(a.auth,p)})}if(s.length===0)return h(n,t,"Fill in at least one credential, or check a box to remove one, before saving.");const l=[];for(const r of s){if(r.kind!=="exchange"){l.push(r);continue}const a=await R(r.auth,r.clientId,r.clientSecret);if(!a.ok)return T(n,t,a.reason,r.scheme);l.push({kind:"set",scheme:r.scheme,secret:a.secret})}const c=await u.consumeElicitation(e,t);if(!c)return m();for(const r of l)r.kind==="remove"?await u.deleteSecret(e,c.subject,c.api,r.scheme):await u.setSecret(e,c.subject,c.api,r.scheme,r.secret);const k=await u.getSecretsForSubject(e,c.subject),f={saved:l.filter(r=>r.kind==="set").map(r=>r.scheme),removed:l.filter(r=>r.kind==="remove").map(r=>r.scheme),stored:Object.keys(k[c.api]??{})};return new Response(N(c,f),{status:200,headers:g})}async function K(e,i,t){const n=d(i,"client_id").trim(),o=d(i,"client_secret").trim(),s=await u.peekElicitation(e,t);if(!s||s.auth.kind!=="oauth2ClientCredentials")return m();if(!n||!o)return h(s,t,"Enter both the client ID and the client secret before saving.");const l=await R(s.auth,n,o);if(!l.ok)return T(s,t,l.reason);const c=await u.consumeElicitation(e,t);return c?(await u.setSecret(e,c.subject,c.api,c.scheme,l.secret),new Response($(c),{status:200,headers:g})):m()}async function R(e,i,t){try{const n=A([{url:e.tokenUrl}]),o=j(e.tokenUrl,n),s=new AbortController,l=setTimeout(()=>s.abort(),B);let c;try{c=await P(o,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"client_credentials",client_id:i,client_secret:t}),redirect:"manual",signal:s.signal,dispatcher:O()})}finally{clearTimeout(l)}if(!c.ok)return w(`token endpoint returned ${c.status}`);let k;try{k=await v(c,M)}catch{return w("token response exceeded the size cap")}let f;try{f=JSON.parse(k)}catch{return w("token response was not valid JSON")}const r=typeof f=="object"&&f!==null&&"access_token"in f?f.access_token:void 0,a=typeof r=="string"?r.trim():"";return a?b(e,a)?w("token response had an access_token that cannot be sent in a header"):{ok:!0,secret:{header:"Authorization",value:`Bearer ${a}`}}:w("token response had no access_token")}catch(n){return w(n instanceof Error?n.message:String(n))}}function w(e){return{ok:!1,reason:e}}function T(e,i,t,n){return F.warn(`gateway oauth2 client_credentials exchange failed for ${e.api}: ${t}`),h(e,i,`${n?`${n}: we`:"We"} could not exchange those client credentials for a token. Check the client ID and secret, then try again.`)}function d(e,i){const t=e.get(i);return typeof t=="string"?t:""}function h(e,i,t){return new Response(x(e,i,t),{status:400,headers:g})}function m(){return new Response(D(),{status:404,headers:g})}function S(e,i){return e.kind==="apiKey"?{header:e.header,value:i}:e.kind==="cookie"?{header:"Cookie",value:`${e.name}=${i}`}:e.kind==="bearer"||e.kind==="oauth2ClientCredentials"?{header:"Authorization",value:J(i)}:{header:"Authorization",value:i}}function J(e){return`Bearer ${e.trim().replace(U,"")}`}var te=G;export{te as default,ee as setCredentialsFetchImpl};

package/dist/server/plugins/mcp/handlers/mcp-credentials-page.d.ts

@@ -1,12 +0,0 @@
-import type { ElicitationTarget } from '../gateway-mcp/secret-store.js';
-export declare function formPage(target: ElicitationTarget, token: string, error?: string): string;
-export declare function clearedPage(target: ElicitationTarget): string;
-export type MultiOutcome = {
-    saved: readonly string[];
-    removed: readonly string[];
-    stored: readonly string[];
-};
-export declare function multiOutcomePage(target: ElicitationTarget, outcome: MultiOutcome): string;
-export declare function successPage(target: ElicitationTarget): string;
-export declare function notFoundPage(): string;
-//# sourceMappingURL=mcp-credentials-page.d.ts.map

package/dist/server/plugins/mcp/handlers/mcp-credentials-page.js

@@ -1,225 +0,0 @@
-import{withPathPrefix as g}from"@redocly/theme/core/utils";import{MCP_CREDENTIALS_ROUTE as C}from"../../../constants/mcp.js";import{ELICITATION_TTL_MS as f}from"../gateway-mcp/secret-store.js";const b=6,v=`<svg class="logo" width="193" height="56" viewBox="0 0 193 56" fill="none" xmlns="http://www.w3.org/2000/svg" role="img" aria-label="Redocly">
-<g clip-path="url(#redocly-logo-clip)">
-<path d="M84.3634 40.7533H80.0357L73.199 30.9849H69.8119V40.8155H66.1738V14.5592H76.3353C78.9067 14.5592 80.9139 15.368 82.2308 16.9857C83.5483 18.5412 84.1756 20.5322 84.1756 22.8343C84.1756 25.0119 83.6107 26.7541 82.4193 28.3095C81.2902 29.865 79.5339 30.7361 77.2134 30.8605L84.3634 40.7533ZM69.8743 17.8568V27.6251H76.2098C79.22 27.6251 80.5999 25.4475 80.5999 22.7098C80.5999 20.0344 79.22 17.7945 76.3353 17.7945H69.8743V17.8568Z" fill="currentColor"/>
-<path d="M103.117 33.225H88.5654C89.0042 36.1492 91.2623 38.078 94.3355 38.078C96.5312 38.078 98.5384 37.0203 99.4789 35.3403C99.8553 35.4648 100.357 35.7137 101.047 35.9626L102.553 36.4603C101.047 39.5091 97.9111 41.1889 94.2731 41.1889C91.701 41.1889 89.506 40.3179 87.6873 38.638C85.931 36.8959 85.1152 34.7182 85.1152 31.9184C85.1152 29.1185 85.9934 26.9409 87.6873 25.2609C89.4436 23.5188 91.6386 22.71 94.2731 22.71C96.8445 22.71 98.9771 23.581 100.608 25.2609C102.302 26.9409 103.18 29.1807 103.18 31.9184C103.117 32.5405 103.117 32.9139 103.117 33.225ZM99.6674 30.4873C99.228 27.563 97.0954 25.7587 94.21 25.7587C91.1999 25.7587 88.9418 27.6252 88.5654 30.4873H99.6674Z" fill="currentColor"/>
-<path d="M120.994 40.7532V38.0155C119.802 40.0066 117.356 41.1265 114.659 41.1265C112.087 41.1265 110.018 40.2555 108.198 38.5755C106.442 36.8334 105.627 34.6557 105.627 31.9181C105.627 29.1183 106.505 26.9406 108.198 25.2607C109.892 23.5808 112.087 22.7098 114.596 22.7098C117.293 22.7098 119.74 23.7675 120.931 25.7585V13.377H124.444V40.8154L120.994 40.7532ZM110.833 27.6873C109.704 28.745 109.202 30.176 109.202 31.9181C109.202 33.6603 109.704 35.0913 110.833 36.2112C111.962 37.3312 113.342 37.8911 114.973 37.8911C116.604 37.8911 117.983 37.3934 119.175 36.3357C120.367 35.2157 120.931 33.7847 120.931 31.9803C120.931 30.1138 120.304 28.745 119.113 27.6873C117.92 26.6295 116.54 26.1318 114.973 26.1318C113.342 26.0696 111.962 26.5673 110.833 27.6873Z" fill="currentColor"/>
-<path d="M129.461 25.1985C131.279 23.4564 133.475 22.6476 136.172 22.6476C138.806 22.6476 141.064 23.5186 142.883 25.1985C144.702 26.8784 145.581 29.1183 145.581 31.8559C145.581 34.5935 144.702 36.8334 142.821 38.5756C141.002 40.3177 138.806 41.1266 136.172 41.1266C133.6 41.1266 131.342 40.2555 129.523 38.5756C127.704 36.8957 126.826 34.6558 126.826 31.8559C126.826 29.0561 127.704 26.8784 129.461 25.1985ZM140.375 27.6251C139.246 26.5673 137.803 26.0696 136.172 26.0696C134.541 26.0696 133.099 26.5673 131.907 27.6251C130.778 28.6828 130.213 30.1138 130.213 31.8559C130.213 33.6603 130.778 35.0913 131.907 36.2112C133.099 37.3312 134.479 37.8289 136.172 37.8289C137.803 37.8289 139.246 37.3312 140.375 36.2112C141.566 35.0913 142.13 33.6603 142.13 31.8559C142.13 30.1138 141.503 28.6828 140.375 27.6251Z" fill="currentColor"/>
-<path d="M163.896 25.4474L161.262 27.6873C160.133 26.5674 158.69 26.0074 156.997 26.0074C155.366 26.0074 153.923 26.5051 152.732 27.6251C151.54 28.6828 150.976 30.1138 150.976 31.856C150.976 33.5981 151.54 35.0913 152.732 36.149C153.923 37.269 155.303 37.829 156.997 37.829C158.753 37.829 160.133 37.269 161.262 36.0869L163.959 38.3267C162.14 40.2555 159.882 41.251 156.997 41.251C154.362 41.251 152.105 40.3799 150.285 38.7C148.404 36.9579 147.525 34.718 147.525 31.9804C147.525 29.2428 148.404 27.0651 150.285 25.323C152.167 23.5808 154.362 22.772 156.997 22.772C159.819 22.6476 162.14 23.5808 163.896 25.4474Z" fill="currentColor"/>
-<path d="M171.987 13.377H168.475V40.8154H171.987V13.377Z" fill="currentColor"/>
-<path d="M181.898 49.4639H178.26L182.024 40.3177L174.873 23.0209H178.574L183.968 35.9624L189.3 23.0209H193L181.898 49.4639Z" fill="currentColor"/>
-<path d="M47.2308 43.491C45.8508 42.5576 44.3455 41.6866 42.8401 41.0644C45.4745 39.9445 47.9207 38.389 49.8651 36.398C53.754 32.5404 56.2002 27.1896 56.2002 21.341C56.2002 15.4303 53.8167 10.1417 49.8651 6.28409C45.9763 2.36431 40.6448 0 34.6861 0H1.63081C1.19174 0 0.752681 0.186656 0.501787 0.497751C0.18817 0.746628 0 1.18215 0 1.61769C0 2.05322 0.18817 2.48875 0.501787 2.73763C0.752681 3.04872 1.19174 3.23538 1.63081 3.23538C6.64866 3.23538 11.2275 5.2886 14.5518 8.52397C17.8134 11.8216 19.8833 16.3635 19.8833 21.341C19.8833 26.3185 17.8134 30.8605 14.5518 34.1581C11.2275 37.3935 6.64866 39.4467 1.63081 39.4467C1.44264 39.4467 1.37992 39.5089 1.19174 39.5089C0.501787 39.6956 0 40.2556 0 41.0022V41.1888C0 42.0599 0.689956 42.6821 1.50536 42.6821H2.57166C6.20962 42.8687 9.59667 44.0509 12.3565 46.0419C15.3672 48.2195 17.688 51.2061 18.9425 54.7526C19.1307 55.3747 19.8206 55.8102 20.4478 55.8102H53.5658C54.0676 55.8102 54.5694 55.5614 54.8203 55.1258C55.1339 54.6903 55.1966 54.1926 55.0085 53.6948C53.5031 49.5884 50.806 46.0419 47.2308 43.491ZM16.8098 36.398C20.6987 32.5404 23.1449 27.1896 23.1449 21.341C23.1449 15.4303 20.7615 10.1417 16.8098 6.28409C15.6181 5.10194 14.3009 4.04422 12.8583 3.17316H34.6861C39.704 3.17316 44.2828 5.22638 47.6071 8.46173C50.8687 11.7594 52.9385 16.3013 52.9385 21.2788C52.9385 26.2563 50.8687 30.7983 47.6071 34.0959C44.2828 37.3313 39.704 39.3845 34.6861 39.3845C34.5606 39.3845 34.4979 39.3845 34.3725 39.4467H12.7956C14.2382 38.7001 15.6181 37.6424 16.8098 36.398ZM14.1755 43.491C13.7992 43.242 13.3601 42.9932 12.9838 42.6821H35.6896C39.3276 42.8687 42.7146 44.0509 45.4745 46.0419C47.858 47.7218 49.8024 49.9617 51.1196 52.6371H21.4514C19.946 48.9662 17.3744 45.8552 14.1755 43.491Z" fill="currentColor"/>
-<path d="M29.668 21.3412C29.668 22.2122 30.3579 22.8966 31.2361 22.8966H47.1679C48.0459 22.8966 48.7359 22.2122 48.7359 21.3412C48.7359 20.4701 48.0459 19.7856 47.1679 19.7856H31.2988C30.3579 19.7856 29.668 20.5323 29.668 21.3412Z" fill="currentColor"/>
-<path d="M28.5385 29.2427H44.4703C45.3484 29.2427 46.0383 28.5583 46.0383 27.6873C46.0383 26.8162 45.3484 26.1318 44.4703 26.1318H28.5385C27.6604 26.1318 26.9705 26.8162 26.9705 27.6873C26.9077 28.5583 27.6604 29.2427 28.5385 29.2427Z" fill="currentColor"/>
-<path d="M28.5385 16.6127H44.4703C45.3484 16.6127 46.0383 15.9282 46.0383 15.0572C46.0383 14.1861 45.3484 13.5017 44.4703 13.5017H28.5385C27.6604 13.5017 26.9705 14.1861 26.9705 15.0572C26.9077 15.8661 27.6604 16.6127 28.5385 16.6127Z" fill="currentColor"/>
-</g>
-<defs><clipPath id="redocly-logo-clip"><rect width="193" height="56" fill="white"/></clipPath></defs>
-</svg>`;function r(e){return e.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function c(){return r(g(C))}function s(e){return`<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<meta name="robots" content="noindex">
-<title>API credentials</title>
-<style>
-:root{
-color-scheme:light dark;
---font:system-ui,-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif;
---font-mono:ui-monospace,SFMono-Regular,Menlo,Consolas,"Liberation Mono",monospace;
---page-bg:#ededf2;
---card-bg:#fbfbfc;
---border:#dcdde5;
---border-strong:#c4c6d1;
---text:#1a1c21;
---text-muted:#6e6f7a;
---brand:#2467f2;
---action:#1f7cff;
---action-hover:#3072db;
---action-ring:rgba(31,124,255,.25);
---code-bg:#ededf2;
---danger:#c74b55;
---danger-hover:#a9434c;
---error-bg:#fef2f2;
---error-border:#f5a3aa;
---error-text:#8b3c42;
-}
-@media (prefers-color-scheme:dark){:root{
---page-bg:#12141a;
---card-bg:#22242b;
---border:#2a2b33;
---border-strong:#3b3c45;
---text:#fbfbfc;
---text-muted:#9b9ca8;
---brand:#2467f2;
---action:#1f7cff;
---action-hover:#3072db;
---action-ring:rgba(31,124,255,.35);
---code-bg:#2a2b33;
---danger:#e5535f;
---danger-hover:#ef858d;
---error-bg:#2a1517;
---error-border:#8b3c42;
---error-text:#f5a3aa;
-}}
-*{box-sizing:border-box}
-body{font-family:var(--font);margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;background:var(--page-bg);color:var(--text);padding:1.5rem;font-size:14px;line-height:1.5}
-.card{width:100%;max-width:26rem;background:var(--card-bg);border:1px solid var(--border);border-radius:8px;box-shadow:0 1px 2px rgba(26,28,33,.04),0 8px 24px -12px rgba(26,28,33,.18);padding:2rem}
-.logo{color:var(--brand);height:28px;width:auto;display:block;margin:0 0 1.5rem}
-h1{font-size:1.25rem;line-height:1.3;font-weight:600;margin:0 0 .5rem;letter-spacing:-.01em}
-.section{margin-top:1.5rem;padding-top:1.5rem;border-top:1px solid var(--border)}
-.section h2{font-size:.9375rem;font-weight:600;margin:0 0 .5rem;display:flex;align-items:center;gap:.5rem}
-.badge{font-size:.6875rem;font-weight:600;line-height:1;padding:.25rem .5rem;border-radius:999px;border:1px solid var(--border-strong);color:var(--text-muted);background:var(--code-bg)}
-.badge.stored{color:var(--action);border-color:var(--action)}
-p{margin:.75rem 0 0}
-p.hint{color:var(--text-muted);font-size:.8125rem;line-height:1.45}
-p.error{margin:1rem 0 0;padding:.75rem;border:1px solid var(--error-border);border-radius:6px;background:var(--error-bg);color:var(--error-text);font-size:.8125rem;line-height:1.45}
-label{display:block;margin:1rem 0 .25rem;font-weight:600;font-size:.8125rem}
-input[type=password],input[type=text]{width:100%;padding:.625rem .75rem;font-size:.9375rem;font-family:var(--font);border:1px solid var(--border-strong);border-radius:6px;background:var(--card-bg);color:var(--text)}
-input::placeholder{color:var(--text-muted)}
-input:focus{outline:none;border-color:var(--action);box-shadow:0 0 0 3px var(--action-ring)}
-button{margin-top:1.25rem;padding:.625rem 1.25rem;font-size:.9375rem;font-weight:600;font-family:var(--font);color:#fff;background:var(--action);border:1px solid transparent;border-radius:6px;cursor:pointer}
-button:hover{background:var(--action-hover)}
-button:focus-visible{outline:2px solid var(--action);outline-offset:2px}
-button.danger{background:transparent;color:var(--danger);border-color:var(--border-strong)}
-button.danger:hover{background:var(--danger);color:#fff;border-color:var(--danger)}
-button.danger:focus-visible{outline-color:var(--danger)}
-code{font-family:var(--font-mono);background:var(--code-bg);padding:.125rem .375rem;border-radius:4px;font-size:.8125em}
-label.check{display:flex;align-items:center;gap:.5rem;margin-top:.75rem;font-weight:400;font-size:.8125rem;color:var(--text-muted)}
-label.check input{width:auto;margin:0}
-footer{margin-top:1.5rem;padding-top:1rem;border-top:1px solid var(--border);font-size:.75rem;color:var(--text-muted);text-align:center;line-height:1.45}
-</style>
-</head>
-<body><main class="card">${v}${e}</main></body>
-</html>`}function l(e){return`<h1>\u{1F512} ${r(e)}</h1>`}function d(){return"<footer>Secured by Redocly &middot; Credentials never enter the AI conversation</footer>"}function u(){return`<p class="hint">This link expires ${Math.round(f/6e4)} minutes after it was issued. If it stops working, request a new one in your AI client.</p>`}function h({name:e,schemeLabel:t,schemes:o}){return o&&o.length>1?e:t?`${e} (${t})`:e}function y(e){return`
-<div class="section">
-<h2>Remove stored credentials</h2>
-<p class="hint">This API already has credentials stored. Enter new credentials to replace them, or remove them to make calls anonymous again.</p>
-<form method="post" action="${c()}" autocomplete="off">
-<input type="hidden" name="token" value="${r(e)}">
-<input type="hidden" name="mode" value="clear">
-<button class="danger" type="submit">Remove credentials</button>
-</form>
-</div>`}function Z(e,t,o){const n=o?`<p class="error">${r(o)}</p>`:"";if(e.schemes&&e.schemes.length>1)return I(e,e.schemes,t,n);const a=e.hasExistingSecret?y(t):"",i=h(e);switch(e.auth.kind){case"bearer":return $(i,t,a,n);case"apiKey":return x(i,t,e.auth.header,a,n);case"cookie":return k(i,t,e.auth.name,a,n);case"oauth2ClientCredentials":return w(i,t,e.auth.scopes,a,n);default:return A(i,t,a,n)}}function $(e,t,o,n){return s(`
-${l(`Credentials for ${e}`)}
-${n}
-<p class="hint">Encrypted and visible only to you for 24 hours (anonymous) or 30 days (signed in).<br />Sent to the API as the <code>Authorization header</code>. It never passes through the AI conversation.</p>
-<form method="post" action="${c()}" autocomplete="off">
-<input type="hidden" name="token" value="${r(t)}">
-<input type="hidden" name="mode" value="token">
-<label for="secret">API token</label>
-<input type="password" id="secret" name="secret" placeholder="your API token" required autofocus>
-<p class="hint">Paste your token with or without the <code>Bearer prefix</code>. The prefix is added automatically, if missing.</p>
-<button type="submit">Save credentials</button>
-</form>
-${o}
-${u()}
-${d()}`)}function x(e,t,o,n,a){return s(`
-${l(`Credentials for ${e}`)}
-${a}
-<p class="hint">Encrypted and visible only to you for 24 hours (anonymous) or 30 days (signed in).<br />Sent to the API as the <code>${r(o)}</code> header. It never passes through the AI conversation.</p>
-<form method="post" action="${c()}" autocomplete="off">
-<input type="hidden" name="token" value="${r(t)}">
-<input type="hidden" name="mode" value="token">
-<label for="secret">${r(o)} value</label>
-<input type="password" id="secret" name="secret" placeholder="value" required autofocus>
-<button type="submit">Save credentials</button>
-</form>
-${n}
-${u()}
-${d()}`)}function k(e,t,o,n,a){return s(`
-${l(`Credentials for ${e}`)}
-${a}
-<p class="hint">Encrypted and visible only to you for 24 hours (anonymous) or 30 days (signed in).<br />Sent to the API as the <code>${r(o)}</code> cookie. It never passes through the AI conversation.</p>
-<form method="post" action="${c()}" autocomplete="off">
-<input type="hidden" name="token" value="${r(t)}">
-<input type="hidden" name="mode" value="token">
-<label for="secret">${r(o)} cookie value</label>
-<input type="password" id="secret" name="secret" placeholder="value" required autofocus>
-<p class="hint">Paste only the value. It's sent as <code>${r(o)}=&lt;value&gt;</code>.</p>
-<button type="submit">Save credentials</button>
-</form>
-${n}
-${u()}
-${d()}`)}function w(e,t,o,n,a){const i=o.length>0?o.map(r).join(", "):"default scopes";return s(`
-${l(`Credentials for ${e}`)}
-${a}
-<p class="hint">Paste your token, or provide your OAuth2 client credentials.</p>
-<div class="section">
-<h2>I have a token</h2>
-<form method="post" action="${c()}" autocomplete="off">
-<input type="hidden" name="token" value="${r(t)}">
-<input type="hidden" name="mode" value="token">
-<label for="secret">API token</label>
-<input type="password" id="secret" name="secret" placeholder="your API token" required autofocus>
-<p class="hint"><code>Bearer</code> prefix is added automatically, if missing.</p>
-<button type="submit">Save token</button>
-</form>
-</div>
-<div class="section">
-<h2>Exchange client credentials</h2>
-<p class="hint">We request a token from the API on your behalf. Scopes: ${i}.</p>
-<form method="post" action="${c()}" autocomplete="off">
-<input type="hidden" name="token" value="${r(t)}">
-<input type="hidden" name="mode" value="client-credentials">
-<label for="client_id">Client ID</label>
-<input type="text" id="client_id" name="client_id" required>
-<label for="client_secret">Client secret</label>
-<input type="password" id="client_secret" name="client_secret" required>
-<button type="submit">Exchange &amp; save</button>
-</form>
-</div>
-${n}
-${u()}
-${d()}`)}function A(e,t,o,n){return s(`
-${l(`Credentials for ${e}`)}
-${n}
-<p class="hint">The value is stored and encrypted only for you for 24 hours (anonymous) or 30 days (signed in).<br />It is sent to the API as the <code>Authorization</code> header. It never passes through the AI conversation.</p>
-<form method="post" action="${c()}" autocomplete="off">
-<input type="hidden" name="token" value="${r(t)}">
-<input type="hidden" name="mode" value="token">
-<label for="secret">Authorization header value</label>
-<input type="password" id="secret" name="secret" placeholder="Bearer &lt;your token&gt;" required autofocus>
-<button type="submit">Save credentials</button>
-</form>
-${o}
-${u()}
-${d()}`)}function I(e,t,o,n){const a=t.map((i,p)=>P(i,p)).join(`
-`);return s(`
-${l(`Credentials for ${e.name}`)}
-${n}
-<p class="hint">This API accepts more than one kind of credential. Fill in the one(s) you have and leave the rest blank - each value is stored encrypted for you only (24 hours for anonymous callers, 30 days when signed in) and sent straight to the API. It never passes through the AI conversation.</p>
-<form method="post" action="${c()}" autocomplete="off">
-<input type="hidden" name="token" value="${r(o)}">
-<input type="hidden" name="mode" value="multi">
-${a}
-<button type="submit">Save credentials</button>
-</form>
-${u()}
-${d()}`)}function P(e,t){const o=M(e.auth),n=e.label?`<p class="hint">${r(e.label)}</p>`:"",a=S(e.operations),i=e.hasExistingSecret?`<label class="check"><input type="checkbox" name="remove__${t}" value="1"> Remove the stored credential</label>`:"",p=e.hasExistingSecret?'<span class="badge stored">Stored</span>':'<span class="badge">Not set</span>';return`
-<div class="section">
-<h2>${r(e.name)} ${p}</h2>
-<p class="hint">Sent to the API as the <code>${r(o.code)}</code> ${o.suffix}.</p>
-${n}
-${a}
-${_(e.auth,t)}
-${i}
-</div>`}function _(e,t){const o=`secret__${t}`;if(e.kind==="oauth2ClientCredentials"){const a=e.scopes.length>0?e.scopes.map(r).join(", "):"default scopes";return`<label for="${o}">API token</label>
-<input type="password" id="${o}" name="${o}" placeholder="paste a token you already have">
-<p class="hint">Or exchange client credentials for one (scopes: ${a}). We add <code>Bearer</code> automatically.</p>
-<label for="client_id__${t}">Client ID</label>
-<input type="text" id="client_id__${t}" name="client_id__${t}">
-<label for="client_secret__${t}">Client secret</label>
-<input type="password" id="client_secret__${t}" name="client_secret__${t}">`}const n=H(e);return`<label for="${o}">${r(n)}</label>
-<input type="password" id="${o}" name="${o}" placeholder="value">`}function H(e){switch(e.kind){case"apiKey":return`${e.header} value`;case"cookie":return`${e.name} cookie value`;case"bearer":return"API token";default:return"Authorization header value"}}function M(e){switch(e.kind){case"apiKey":return{code:e.header,suffix:"header"};case"cookie":return{code:e.name,suffix:"cookie"};case"bearer":return{code:"Authorization",suffix:"header (bearer token)"};case"oauth2ClientCredentials":return{code:"Authorization",suffix:"header (OAuth2 bearer token)"};default:return{code:"Authorization",suffix:"header"}}}function S(e){if(!e||e.length===0)return"";const t=e.slice(0,b).map(r).join(", "),o=e.length-b,n=o>0?`, and ${o} more`:"";return`<p class="hint">Used by ${t}${n}.</p>`}function E(e){return s(`
-${l("Credentials removed")}
-<p>Credentials for ${r(h(e))} are removed. Calls to the API are anonymous again until you add new credentials.</p>
-${d()}`)}function R(e,t){const o=t.saved.length===0?"Credentials removed":t.removed.length===0?"Credentials saved":"Credentials updated",n=[t.saved.length>0?`<p>Saved: ${m(t.saved)}.</p>`:"",t.removed.length>0?`<p>Removed: ${m(t.removed)}.</p>`:"",t.stored.length>0?`<p>${r(e.name)} now has stored credentials for ${m(t.stored)}.</p>`:`<p>${r(e.name)} has no stored credentials. Calls to the API are anonymous until you add new ones.</p>`];return s(`
-${l(o)}
-${n.join(`
-`)}
-<p>Retry in your AI client, or confirm any prompt it left open. You can close this tab.</p>
-<p class="hint">This link is single-use and is now spent. To change anything, request a new one in your AI client.</p>
-${d()}`)}function m(e){return e.map(t=>`<code>${r(t)}</code>`).join(", ")}function F(e){return s(`
-${l("Credentials saved")}
-<p>Credentials for ${r(h(e))} are saved. Retry in your AI client, or confirm any prompt it left open. You can close this tab.</p>
-<p class="hint">This link is single-use and is now spent. To change anything, request a new one in your AI client.</p>
-${d()}`)}function q(){return s(`${l("Link expired")}<p>This credentials link is invalid, already used, or older than ${Math.round(f/6e4)} minutes. Retry in your AI client to get a fresh link.</p>${d()}`)}export{E as clearedPage,Z as formPage,R as multiOutcomePage,q as notFoundPage,F as successPage};

package/dist/server/plugins/mcp/index.d.ts

@@ -1,4 +0,0 @@
-import type { LifecyclePluginInstance } from '../../types';
-export declare function mcpServerPlugin(): Promise<LifecyclePluginInstance>;
-export default mcpServerPlugin;
-//# sourceMappingURL=index.d.ts.map

package/dist/server/plugins/mcp/index.js

@@ -1 +0,0 @@
-import{fileURLToPath as U}from"node:url";import{dirname as $,join as h}from"node:path";import{MCP_ROUTE as k,PUBLIC_MCP_ROUTE as D}from"@redocly/theme/core/constants/mcp";import{logger as c}from"../../tools/notifiers/logger.js";import{reporter as F}from"../../tools/notifiers/reporter.js";import{isDefined as B}from"../../../utils/guards/is-defined.js";import{MCP_CREDENTIALS_HANDLER_ID as P,MCP_CREDENTIALS_ROUTE as x,MCP_DOCS_SERVER_HANDLER_ID as E,MCP_NOT_ALLOWED_TEMPLATE_ID as V}from"../../constants/mcp.js";import{bundledOpenApiDocumentsToMcpOpenApi as J,bundledGraphqlDocumentsToMcpOpenApi as W,buildGraphqlDescriptions as X,collectIgnoredRoutes as z,filterIgnoredApiDescriptions as A,getCleanedUpApiDescriptions as K,isMcpInRedirects as Q}from"./utils.js";import{getMcpMode as R,isMcpElicitationEnabled as Y,isMcpGatewayEnabled as Z}from"./utils/mode.js";import{getPublicMcpEndpointStatus as _}from"./utils/public-endpoint.js";import{findGatedToolNames as ee}from"./utils/find-gated-tool-names.js";import{getDefaultToolSchemas as te}from"./docs-mcp/tool-schemas.js";import{EXECUTE_TOOL_SCHEMA as oe}from"./codemode/tools/execute-schema.js";import{isGatewayCapabilityEnabled as ie,isGatewayEligible as re}from"./gateway-mcp/eligibility.js";import{resolveGatewayFetchLimits as se}from"./gateway-mcp/rate-limit/limits.js";import{resetCustomMcpTools as ne,scanCustomMcpTools as ae}from"./custom-tools/scan-custom-tools.js";import{telemetryTraceStep as ce}from"../../../cli/telemetry/helpers/trace-step.js";import{DEFAULT_DOCS_MCP_SERVER_NAME as S}from"./constants.js";const M=$(U(import.meta.url));async function pe(){let i;const l={registeredToolNames:[],warnedNoOutputSchemaTools:new Set};let m=0,u=!1;return{id:"mcp",async processContent(e,n){await ce("com.redocly.build.plugin.mcp",async s=>{const o=await n.getConfig(),{mcp:r,redirects:f}=o;if(s?.setAttribute("config",JSON.stringify(r||{})),s?.setAttribute("mcpMode",R()),s?.setAttribute("mcpGateway",String(Z())),r?.hide||r?.docs?.hide){ne(e,l);return}Q(f)&&await F.panicOnBuildContentError('The reserved route "/mcp" cannot be used in redirect configuration. Please remove any redirects involving "/mcp" from your redocly.yaml config.'),e.createTemplate(V,"@redocly/theme/layouts/McpNotAllowed");const p=!!o?.access?.requiresLogin,b=o?.access?.rbac||{},g=R(),d=Y(),{budgetPerExec:T}=se();if(!i){c.info("Configuring MCP servers...");const w=J(await e.loadApiDocuments(n)),O=W(await e.loadApiDocuments(n)),v=r?.docs?.ignore||[],L=K(A(w,v)),q=ie(r),C=new Map;for(const t of L){const H=t.definition.info?.title||"",j=t.definition.info?.version||"";C.set(t.relativePath,{name:H,description:typeof t.definition.info?.description=="string"?t.definition.info.description:"",version:j,servers:t.definition.servers||[],relativePath:t.relativePath,...q&&re(t.definition.info,t.relativePath,b)?{fetchEligible:!0}:{}})}const y=X(A(O,v)),I=Object.values(o.products||{}).map(t=>t?.name).filter(B),N=o.l10n?.locales?.map(t=>t.code)??n.fs.localeFolders,G=te({products:I,locales:N,requiresLogin:p,rbac:b,hasGraphqlApis:y.length>0,elicitationEnabled:d,hasCallableApis:C.values().some(t=>t.fetchEligible),feedbackHidden:o.feedback?.hide===!0});e.addMcpTools(h(M,"./docs-mcp/tools/index.js"),G),g==="code"&&e.addMcpTools(h(M,"./codemode/tools/execute.js"),[oe]),i={apiDescriptionsMap:Object.fromEntries(C),graphqlDescriptions:y}}const a=await ae(e,n,l);s?.setAttribute("customToolsCount",String(a)),a!==m&&(m=a,a>0&&c.info(`Registered ${a} custom MCP tool${a===1?"":"s"} from @mcp folders`)),await de({actions:e,handlerPath:h(M,"./handlers/docs-mcp-handler.js"),apiDescriptionsMap:i.apiDescriptionsMap,graphqlDescriptions:i.graphqlDescriptions,mcpConfig:r,mcpMode:g,elicitationEnabled:d,gatewayFetchBudgetPerExec:T,publicEndpointStatus:_(o)}),u||(c.info("Registered Docs MCP Server endpoint at /mcp"),u=!0)})},async afterRoutesCreated(e,n){const s=await n.getConfig(),{mcp:o}=s,r=!o?.hide&&!o?.docs?.hide;e.markGatedMcpTools(await ee(e.getMcpTools())),e.setGlobalData({mcpData:{docs:{enabled:r,name:o?.docs?.name||S,publicEndpoint:_(s)==="served"}}})}}}var Se=pe;async function de({actions:i,handlerPath:l,apiDescriptionsMap:m,graphqlDescriptions:u,mcpConfig:e,mcpMode:n,elicitationEnabled:s,gatewayFetchBudgetPerExec:o,publicEndpointStatus:r}){i.createRequestHandler(E,l);const f=p=>async(b,g)=>{const d=z(g.getAllRoutes(),e?.docs?.ignore||[]);return d.length>0&&c.verbose(`mcp.docs.ignore: hiding ${d.length} page routes from MCP search`),{props:{config:{apiDescriptionsMap:m,graphqlDescriptions:u,mcpDocsServerName:e?.docs?.name||S,mcpMode:n,elicitationEnabled:s,gatewayFetchBudgetPerExec:o,searchIgnoredRoutes:d,...p?{isPublicEndpoint:p}:{}},serverOutDir:i.serverOutDir,tools:i.getMcpTools().map(({importPath:T,...a})=>a)}}};if(i.addApiRoute({slug:k,requestHandlerId:E,httpMethod:"all",getStaticData:f(!1)}),r==="no-protected-content"?c.info(`mcp.docs.publicEndpoint is enabled, but the project has no protected content - /mcp already serves anonymous users, skipping ${D}.`):r==="anonymous-denied"?c.info(`mcp.docs.publicEndpoint is enabled, but anonymous users are denied the MCP feature (rbac.features.mcp or requiresLogin) - skipping ${D}.`):r==="served"&&(i.addApiRoute({slug:D,requestHandlerId:E,httpMethod:"all",getStaticData:f(!0)}),c.verbose(`Registered public Docs MCP Server endpoint at ${D}`)),s){const p=h(M,"./handlers/mcp-credentials-handler.js");i.createRequestHandler(P,p),i.addApiRoute({slug:x,requestHandlerId:P,httpMethod:"all",getStaticData:async()=>({props:{}})}),c.verbose("Registered MCP credentials endpoint at /mcp/credentials")}}export{Se as default,pe as mcpServerPlugin};

package/dist/server/plugins/mcp/servers/docs-server.d.ts

@@ -1,12 +0,0 @@
-import type { McpServer } from '@modelcontextprotocol/server';
-import type { McpToolSchema } from '../../../types';
-import type { McpToolContext, SkillMcpResource } from '../types.js';
-import type { KvService } from '@redocly/config';
-export declare function createDocsMcpServer({ name, tools, context, skills, getKv, }: {
-    name: string;
-    tools: McpToolSchema[];
-    context: McpToolContext;
-    skills?: SkillMcpResource[];
-    getKv: () => Promise<KvService>;
-}): Promise<McpServer>;
-//# sourceMappingURL=docs-server.d.ts.map

package/dist/server/plugins/mcp/servers/docs-server.js

@@ -1 +0,0 @@
-import{logger as v}from"../../../tools/notifiers/logger.js";import{mcpToolWorkers as L,MCP_TOOL_IS_AVAILABLE_KEY as k}from"../../../workers/mcp-tool-worker-pool.js";import{CREATE_ANONYMOUS_SESSION_TOOL_NAME as C,MANAGE_API_CREDENTIALS_TOOL_NAME as y}from"../constants.js";import{isAnonymousSessionToolAvailable as D}from"../docs-mcp/tools/core/create-anonymous-session.js";import{isManageApiCredentialsToolAvailable as N,manageApiCredentials as x,manageApiCredentialsSchema as w}from"../codemode/tools/manage-credentials.js";import{EXECUTE_TOOL_SCHEMA as _}from"../codemode/tools/execute-schema.js";import{EXECUTE_TOOL_NAME as I,CODE_MODE_TOOL_NAMES as H,FETCH_TOOL_NAME as P}from"../codemode/constants.js";import{buildCodeModeInstructions as R,buildExecuteDescription as U}from"../codemode/prompts.js";import{toToolListEntries as F}from"../codemode/build-tool-list.js";import{composeExecuteAnnotations as z,getActiveCapabilities as B}from"../codemode/capabilities/index.js";import{describeToolsSchema as W,describeTools as X}from"../codemode/tools/describe-tools.js";import{availableSandboxTools as Y}from"../utils/available-sandbox-tools.js";import{isToolDisabledByCaller as S}from"../utils/disabled-tools.js";import{toRegisterToolConfig as h}from"../utils/tool-registration.js";import{createMcpServer as $,createToolDispatch as j,extractSerializableContext as G}from"./mcp-server.js";function O(r,t){const o=t.schema;if(r)return o;const{sessionHandle:T,...p}=o.properties;return{...o,properties:p}}function K(r){return Object.fromEntries(r.map(t=>[t.name,t.schema]))}async function me({name:r,tools:t,context:o,skills:T=[],getKv:p}){const n=G(o),s=o.mcpMode==="code",l=s?B(o):[],b=l.some(e=>e.id===P),c=s?await Y(t.filter(e=>!H.has(e.name)),n):[],E=F(c,l),d=D(o)&&!S(C,o.metadata),g=s&&N(o)&&!S(y,o.metadata),m=$(r,s?R(b,E):void 0),u={getClientCapabilities:()=>m.server.getClientCapabilities(),getKv:p},f=j(s?{...n,sandboxToolSchemas:K(c)}:n,u),A=async e=>{try{return await L.exec(k,[{toolName:e,context:n}],{timeout:1e4})}catch(i){return v.error(`Failed to check MCP tool availability for "${e}": ${i instanceof Error?i.message:String(i)}`),!1}};if(s){const e=[{tool:{..._,description:U(b,E),schema:O(d,_),annotations:z(c,l)},callback:f(I)},{tool:W(c,l),callback:X(c,A,l,o)}],i=t.find(a=>a.name===C);if(i&&d&&e.push({tool:i,callback:f(i.name)}),g){const a=w(o);e.push({tool:{...a,schema:O(d,a)},callback:x(n,u)})}for(const{tool:a,callback:M}of e)m.registerTool(a.name,h(a),M)}else await Promise.all(t.map(async e=>{const i=m.registerTool(e.name,h({...e,outputSchema:void 0}),f(e.name));await A(e.name)||i.disable()}));for(const e of T)m.registerResource(e.slug,e.uri,{title:e.name,description:e.description,mimeType:"text/markdown"},async()=>({contents:[{uri:e.uri,mimeType:"text/markdown",text:e.content}]}));return m}export{me as createDocsMcpServer};

package/dist/server/plugins/mcp/servers/mcp-server.d.ts

@@ -1,17 +0,0 @@
-import { McpServer } from '@modelcontextprotocol/server';
-import type { McpToolCallback, McpToolContext } from '../types.js';
-import type { KvService } from '@redocly/config';
-export declare function createMcpServer(name: string, instructions?: string): McpServer;
-export type ToolDispatchDeps = {
-    getClientCapabilities: () => {
-        elicitation?: {
-            form?: unknown;
-            url?: unknown;
-        };
-    } | undefined;
-    getKv: () => Promise<KvService>;
-};
-/** Build the tool callback that ships a tool call to the worker pool. */
-export declare function createToolDispatch(serializableContext: McpToolContext, deps?: ToolDispatchDeps): (toolName: string) => McpToolCallback;
-export declare function extractSerializableContext(context: McpToolContext): McpToolContext;
-//# sourceMappingURL=mcp-server.d.ts.map

package/dist/server/plugins/mcp/servers/mcp-server.js

@@ -1,3 +0,0 @@
-import{McpServer as C}from"@modelcontextprotocol/server";import{logger as S}from"../../../tools/notifiers/logger.js";import{mcpToolWorkers as O,MCP_TOOL_WORKER_KEY as _}from"../../../workers/mcp-tool-worker-pool.js";import{secretStore as L}from"../gateway-mcp/secret-store.js";import{readAuthRequiredMeta as D,stripAuthRequiredMeta as E,upstreamAuthKey as b}from"../gateway-mcp/upstream-auth.js";import{acceptedCredentialsLink as K,buildCredentialsAcceptedHint as j,buildCredentialsToolHint as F,buildUpstreamCredentialFallback as q,buildUpstreamCredentialInputRequired as v,credentialElicitationAnswer as H,dedupeElicitation as N,isStatelessRequest as P,schemeLabelOf as $,supportsUrlElicitation as B}from"../gateway-mcp/elicitation.js";import{DEFAULT_SCHEME_NAME as y,resolveUpstreamApiAuth as G}from"../gateway-mcp/upstream-auth-scheme.js";import{MISSING_SESSION_HANDLE_MESSAGE as V,resolveSecretSubject as W}from"../gateway-mcp/subject.js";const Y=6e4;function ue(e,t){return new C({name:e,version:new Date().toISOString().slice(0,10)},{capabilities:{logging:{}},...t?{instructions:t}:{}})}function le(e,t){return r=>async(n,s)=>{S.info(`MCP tool called: ${r}`);const i=e.elicitationEnabled??!1,c=P(s.mcpReq),a=i?W(e.user,n.sessionHandle):{kind:"anonymous"},o=a.kind==="resolved"?a.subject:void 0;if(a.kind==="invalid")return{content:[{type:"text",text:a.message}],isError:!0};const u=async()=>{if(!(!i||!o||!t?.getKv))try{const m=await t.getKv();return await L.getSecretsForSubject(m,o)}catch(m){S.warn(`gateway mcp secret store error, continuing unauthenticated: ${String(m)}`);return}};let l;const p=async()=>{l=await u();const m={toolName:r,args:n,context:{...e,upstreamSecrets:l},extra:ee(s)};return await O.exec(_,[m],{timeout:Y})};let d=await p();const f=D(d);if(f.length>0&&i&&!o)return E(I(d,[{type:"text",text:V}]));if(f.length>0&&i&&o&&t?.getKv){S.info(`gateway mcp credentials prompt: era=${c?"2026-07-28":"2025"} clientElicitation=${J(t)}`);const m=await t.getKv(),h=await Q(e,f),w=f.map(U=>X(U,h)),k=Z(l),g=c?await x(e,s,w,o,m,k,h,t):await z(e,w,o,m,k,h);switch(g.kind){case"inputRequired":return g.result;case"retry":d=await p();break;case"prependText":d=I(d,[{type:"text",text:g.text},...d.content]);break;case"none":break}}return E(d)}}function I(e,t){const{structuredContent:r,...n}=e;return{...n,content:t,isError:!0}}function J(e){const t=e?.getClientCapabilities()?.elicitation;if(!t)return"none";const r=[t.form?"form":void 0,t.url?"url":void 0].filter(Boolean);return r.length>0?r.join("+"):"none"}async function Q(e,t){const r=new Map;for(const n of new Set(t.map(s=>s.api)))r.set(n,await G(e,n));return r}function X(e,t){const r=t.get(e.api);if(!r)return{...e,scheme:e.scheme??y};const n=e.scheme&&r.schemes[e.scheme]?e.scheme:r.defaultScheme;return{...e,scheme:n}}function Z(e){const t=new Set;for(const[r,n]of Object.entries(e??{}))for(const s of Object.keys(n))t.add(b({api:r,scheme:s}));return t}function R(e,t){return e.status===401&&!t.has(b(e))}function T(e,t){const r=t.get(e.api),n=e.sentScheme??e.scheme;return r&&n?$(r.schemes,n):void 0}function M(e,t){return e.map(r=>F(r,T(r,t))).join(`
-
-`)}function A(e,t,r,n,s){const[i,...c]=t,a=s.get(i.api),o=i.scheme??a?.defaultScheme??y,l=(i.schemes?.length??0)<=1?T(i,s):void 0;return{subject:r,baseUrl:e.baseUrl??"",target:{api:i.api,name:i.name,scheme:o,...l?{schemeLabel:l}:{}},auth:a?.schemes[o]??{kind:"raw"},...a?{apiAuth:a}:{},kv:n,hasExistingSecret:!1,reason:{kind:"authFailure",status:i.status,...i.detail?{detail:i.detail}:{},otherApiNames:c.map(p=>p.name)}}}async function x(e,t,r,n,s,i,c,a){const o=H(t.mcpReq.inputResponses);if(o==="declined")return{kind:"none"};const u=r.filter(p=>R(p,i));if(u.length===0)return{kind:"prependText",text:M(r,c)};if(o==="accepted"){const p=await K(t.mcpReq.requestState(),{kv:s,subject:n,baseUrl:e.baseUrl??"",apis:u.map(f=>f.api)}),d=p?.apiName??u[0].name;return{kind:"prependText",text:j(d,p?.url)}}const l=A(e,u,n,s,c);return B(a?.getClientCapabilities())?{kind:"inputRequired",result:await v(l)}:{kind:"prependText",text:await q(l)}}async function z(e,t,r,n,s,i){const c=t.filter(u=>R(u,s));if(c.length===0)return{kind:"prependText",text:M(t,i)};const a=A(e,c,r,n,i);return{kind:"prependText",text:await N(`${r}:${b(c[0])}`,()=>q(a))}}function ee(e){return{sessionId:e.sessionId,authInfo:e.http?.authInfo,requestId:e.mcpReq.id,_meta:e.mcpReq._meta}}function pe(e){return{user:e.user,config:e.config,outdir:e.outdir,baseUrl:e.baseUrl,params:e.params,query:e.query,cookies:e.cookies,apiDescriptionsMap:e.apiDescriptionsMap,graphqlDescriptions:e.graphqlDescriptions,products:e.products,accessToken:e.accessToken,metadata:e.metadata,upstreamAuthorization:e.upstreamAuthorization,mcpMode:e.mcpMode,elicitationEnabled:e.elicitationEnabled,gatewayFetchBudgetPerExec:e.gatewayFetchBudgetPerExec,clientIp:e.clientIp,client:e.client,clientVersion:e.clientVersion,requestId:e.requestId,messageId:e.messageId,upstreamSecrets:e.upstreamSecrets,searchIgnoredRoutes:e.searchIgnoredRoutes,internalBaseUrl:e.internalBaseUrl,sandboxToolSchemas:e.sandboxToolSchemas,fs:void 0}}export{ue as createMcpServer,le as createToolDispatch,pe as extractSerializableContext};

package/dist/server/plugins/mcp/types.d.ts

@@ -1,139 +0,0 @@
-import type { ApiFunctionsContext, ApiFunctionsContextMethods, McpToolDefinition, McpToolFileSystem, McpToolJsonValue, PageStaticData } from '@redocly/config';
-import type { AuthInfo, CallToolResult, RequestId, RequestMeta, StandardSchemaWithJSON, ToolCallback } from '@modelcontextprotocol/server';
-import type { OpenAPIPath, OpenAPIServer, OpenAPIOperation } from '@redocly/api-docs';
-import type { McpErrorCodes, McpServerType } from './constants';
-import type { McpToolSchema } from '../../types';
-import type { Skill } from '../../types/plugins/skills.js';
-import type { UpstreamSecrets } from './gateway-mcp/secret-store.js';
-type ObjectValues<T> = T[keyof T];
-export type McpServerType = ObjectValues<typeof McpServerType>;
-export type McpErrorCodeTypes = ObjectValues<typeof McpErrorCodes>;
-export type ApiDescriptionInfo = {
-    name: string;
-    relativePath: string;
-    description?: string;
-    version?: string;
-    servers?: OpenAPIServer[];
-    fetchEligible?: boolean;
-};
-export type GraphqlDescriptionInfo = {
-    name: string;
-    relativePath: string;
-    description?: string;
-};
-export type McpDocsStaticDataPropsConfig = {
-    mcpDocsServerName: string;
-    apiDescriptionsMap: Record<string, ApiDescriptionInfo>;
-    graphqlDescriptions: GraphqlDescriptionInfo[];
-    mcpMode: McpMode;
-    elicitationEnabled: boolean;
-    gatewayFetchBudgetPerExec: number;
-    searchIgnoredRoutes?: string[];
-    isPublicEndpoint?: boolean;
-};
-export type McpDocsStaticData = PageStaticData & {
-    props: {
-        config: McpDocsStaticDataPropsConfig;
-        serverOutDir?: string;
-        tools?: McpToolSchema[];
-        skills?: Skill[];
-        skillsBaseUrl?: string;
-    };
-};
-export type SkillMcpResource = {
-    slug: string;
-    name: string;
-    description: string;
-    content: string;
-    uri: string;
-};
-export type McpPath = {
-    'x-mcp'?: XMcpConfig;
-} & OpenAPIPath;
-export type XMcpConfig = {
-    docs?: {
-        hide?: boolean;
-    };
-    gateway?: {
-        hide?: boolean;
-    };
-};
-export type XMcpSection = keyof XMcpConfig;
-export type McpEndpoint = OpenAPIOperation & {
-    'x-mcp'?: XMcpConfig;
-};
-export type McpMode = 'tools' | 'code';
-export type SemanticSearchResult = {
-    title: string;
-    url: string;
-    content: string;
-};
-export type McpErrorClass = 'tool_error' | 'sandbox_error' | 'client_error' | 'server_error';
-export type McpToolWorkerResponse = CallToolResult & {
-    errorClass?: McpErrorClass;
-};
-export type ToolArgs = Record<string, unknown>;
-export type McpToolCallback = ToolCallback<StandardSchemaWithJSON<ToolArgs, ToolArgs>>;
-/** The caller and request fields every MCP telemetry event and audit record carries. */
-export type McpCallAttribution = Pick<McpToolContext, 'client' | 'clientVersion' | 'requestId' | 'messageId'>;
-export type McpToolExtra = {
-    sessionId?: string;
-    authInfo?: AuthInfo;
-    requestId: RequestId;
-    _meta?: RequestMeta;
-};
-export type McpToolContext = Omit<ApiFunctionsContext, 'telemetry' | 'getKv' | keyof ApiFunctionsContextMethods> & {
-    apiDescriptionsMap: Record<string, ApiDescriptionInfo>;
-    graphqlDescriptions: GraphqlDescriptionInfo[];
-    products?: string[];
-    accessToken?: string;
-    metadata?: Record<string, unknown>;
-    upstreamAuthorization?: string;
-    mcpMode?: McpMode;
-    elicitationEnabled?: boolean;
-    gatewayFetchBudgetPerExec?: number;
-    clientIp?: string;
-    client?: string;
-    clientVersion?: string;
-    requestId?: string;
-    messageId?: string;
-    upstreamSecrets?: UpstreamSecrets;
-    searchIgnoredRoutes?: string[];
-    internalBaseUrl?: string;
-    sandboxToolSchemas?: Record<string, Record<string, unknown>>;
-    fs?: McpToolFileSystem;
-};
-export type McpToolHandler<TArgs extends ToolArgs = ToolArgs> = (args: TArgs, context: McpToolContext, extra: McpToolExtra) => Promise<McpToolWorkerResponse | McpToolJsonValue>;
-export type McpToolIsAvailable = (context: McpToolContext) => boolean | Promise<boolean>;
-export type McpToolHandlerExtended<TArgs extends ToolArgs = ToolArgs> = {
-    execute: McpToolHandler<TArgs>;
-    isAvailable?: McpToolIsAvailable;
-};
-export type McpToolExecutionParams = {
-    toolName: string;
-    args: ToolArgs;
-    context: McpToolContext;
-    extra: McpToolExtra;
-};
-export type CustomMcpToolsState = {
-    registeredToolNames: string[];
-    warnedNoOutputSchemaTools: Set<string>;
-};
-export type ToolDefinitionValidationResult = {
-    ok: true;
-    schema: McpToolSchema;
-} | {
-    ok: false;
-    errors: string[];
-};
-export type ToolFileDefaultExport = Partial<McpToolDefinition> | null | undefined;
-export type McpToolModuleGetter = () => Promise<{
-    default: McpToolModuleExport;
-}>;
-export type McpToolMapExport = Record<string, McpToolHandler | McpToolHandlerExtended | undefined>;
-export type McpToolFileExport = McpToolHandlerExtended & {
-    description: string;
-};
-export type McpToolModuleExport = McpToolMapExport | McpToolFileExport;
-export {};
-//# sourceMappingURL=types.d.ts.map

package/dist/server/plugins/mcp/utils/available-sandbox-tools.d.ts

@@ -1,4 +0,0 @@
-import type { McpToolSchema } from '../../../types';
-import type { McpToolContext } from '../types.js';
-export declare function availableSandboxTools(candidates: McpToolSchema[], context: McpToolContext): Promise<McpToolSchema[]>;
-//# sourceMappingURL=available-sandbox-tools.d.ts.map

package/dist/server/plugins/mcp/utils/available-sandbox-tools.js

@@ -1 +0,0 @@
-import{logger as a}from"../../../tools/notifiers/logger.js";import{mcpToolWorkers as n,MCP_TOOL_AVAILABILITY_KEY as m}from"../../../workers/mcp-tool-worker-pool.js";async function p(t,l){if(t.length===0)return t;const e=t.map(o=>o.name);let r;try{r=await n.exec(m,[{toolNames:e,context:l}],{timeout:1e4})}catch(o){return i(t,o instanceof Error?o.message:String(o))}return!r||typeof r!="object"?i(t,"the worker returned no availability map"):t.filter(o=>r[o.name]!==!1)}function i(t,l){const e=t.filter(r=>r.hasAvailabilityGate);return e.length===0?t:(a.warn(`MCP tool availability is unknown (${l}); the sandbox tool list drops the gated tools: ${e.map(r=>r.name).join(", ")}.`),t.filter(r=>!r.hasAvailabilityGate))}export{p as availableSandboxTools};

package/dist/server/plugins/mcp/utils/disabled-tools.d.ts

@@ -1,3 +0,0 @@
-import type { McpToolContext } from '../types.js';
-export declare function isToolDisabledByCaller(toolName: string, metadata: McpToolContext['metadata']): boolean;
-//# sourceMappingURL=disabled-tools.d.ts.map

package/dist/server/plugins/mcp/utils/disabled-tools.js

@@ -1 +0,0 @@
-function r(o,s){const l=s?.disabledTools;return Array.isArray(l)&&l.includes(o)}export{r as isToolDisabledByCaller};

package/dist/server/plugins/mcp/utils/find-gated-tool-names.d.ts

@@ -1,12 +0,0 @@
-import type { McpToolRegistration } from '../../../types';
-import type { McpToolModuleExport } from '../types.js';
-type ToolModuleLoader = (importPath: string) => Promise<{
-    default: McpToolModuleExport;
-}>;
-/**
- * Names of the tools whose handler declares an `isAvailable` predicate — the ones the live
- * server enables per caller. Includes every tool of a handler module that fails to load.
- */
-export declare function findGatedToolNames(registrations: McpToolRegistration[], load?: ToolModuleLoader): Promise<string[]>;
-export {};
-//# sourceMappingURL=find-gated-tool-names.d.ts.map

package/dist/server/plugins/mcp/utils/find-gated-tool-names.js

@@ -1 +0,0 @@
-import{resolveToolHandler as l}from"../workers/execute-mcp-tool.js";const s=t=>import(t);async function d(t,o=s){const n=[];for(const{name:e,importPath:r,hasAvailabilityGate:a}of t){if(a!==void 0){a&&n.push(e);continue}const i=await c(r,o);(!i||f(l(i,e)))&&n.push(e)}return n}async function c(t,o){try{const{default:n}=await o(t);return n}catch{return}}function f(t){return typeof t=="object"&&typeof t.isAvailable=="function"}export{d as findGatedToolNames};

package/dist/server/plugins/mcp/utils/json-schema-validator.d.ts

@@ -1,9 +0,0 @@
-import type { jsonSchemaValidator } from '@modelcontextprotocol/server';
-/**
- * Validates tool arguments with the same engine and options the forked SDK
- * (@redocly/mcp-typescript-sdk) used internally, so migrating to the upstream
- * v2 SDK does not change which arguments are accepted. The SDK default would
- * be a lenient draft-2020-12 engine instead.
- */
-export declare const mcpJsonSchemaValidator: jsonSchemaValidator;
-//# sourceMappingURL=json-schema-validator.d.ts.map

package/dist/server/plugins/mcp/utils/json-schema-validator.js

@@ -1 +0,0 @@
-import{AjvJsonSchemaValidator as a}from"@modelcontextprotocol/server/validators/ajv";import l from"@redocly/ajv";const c=new a(new l({allErrors:!0})),j={getValidator(r){const o=c.getValidator(r),t=Object.keys(r.properties??{});return t.length===0||r.additionalProperties!==!1?o:n=>{const e=o(n),i=Object.keys(n??{}).filter(s=>!t.includes(s));return e.valid||i.length===0?e:{...e,errorMessage:`${e.errorMessage}. Unknown properties: ${i.join(", ")}. Accepted properties: ${t.join(", ")}.`}}}};export{j as mcpJsonSchemaValidator};

package/dist/server/plugins/mcp/utils/jwt.d.ts

@@ -1,5 +0,0 @@
-/**
- * Extract JWT token from Authorization header
- */
-export declare function extractTokenFromAuthHeader(authHeader?: string | string[]): string | null;
-//# sourceMappingURL=jwt.d.ts.map

package/dist/server/plugins/mcp/utils/jwt.js

@@ -1 +0,0 @@
-function n(r){if(!r)return null;const e=Array.isArray(r)?r[0]:r;return!e||!e.startsWith("Bearer ")?null:e.replace(/^Bearer /,"")}export{n as extractTokenFromAuthHeader};

package/dist/server/plugins/mcp/utils/mcp-client.d.ts

@@ -1,13 +0,0 @@
-/**
- * Both markers are parenthesised so neither can collide with a real client: a name is built out
- * of `[a-z0-9._-]`, which cannot produce a bracket.
- */
-export declare function resolveMcpClient(request: Request): {
-    client: string;
-    clientVersion?: string;
-};
-export declare function parseUserAgent(userAgent: string | null | undefined): {
-    client: string;
-    clientVersion?: string;
-};
-//# sourceMappingURL=mcp-client.d.ts.map

package/dist/server/plugins/mcp/utils/mcp-client.js

@@ -1 +0,0 @@
-const o="(none)",r="(unparsed)",N=40,i=/^[A-Za-z0-9._\- ]+/,c=/(?<!\s)\s+([0-9]\S*)(?:[^\S\n].*)?$/,l=/^[/\s]+v?([0-9][^\s;,)]*)/;function a(e){return E(e.headers.get("user-agent"))}function E(e){if(e==null)return{client:o};const n=i.exec(e)?.[0]??"",t=n.replace(c,"").trim();if(!t)return{client:r};const s=c.exec(n)?.[1]??l.exec(e.slice(n.length))?.[1];return{client:t.replace(/\s+/g,"-").toLowerCase().slice(0,40),clientVersion:s?.slice(0,40)}}export{E as parseUserAgent,a as resolveMcpClient};

package/dist/server/plugins/mcp/utils/mode.d.ts

@@ -1,17 +0,0 @@
-import type { McpMode } from '../types.js';
-/**
- * Codemode - `execute` sandbox and `describeTools`. Gated by the org-level `mcpMode`
- * entitlement (GrowthBook `mcp-mode` flag → PLAN_GATES JWT).
- *
- * Read the VALUE, never `canAccessFeature('mcpMode')` — 'tools' is truthy.
- * Only call these helpers where EntitlementsProvider is initialized: the build lifecycle
- * and web-server routes. Request handlers and workers run in module graphs with an
- * UNINITIALIZED provider copy — they must read the build-stamped `mcpMode` from static
- * data / McpToolContext instead (see docs-mcp-handler / execute-mcp-tool).
- */
-export declare function isMcpCodeModeEnabled(): boolean;
-/** The gateway capability — a guarded `fetch` in the `execute` sandbox. Requires code mode. */
-export declare function isMcpGatewayEnabled(): boolean;
-export declare function isMcpElicitationEnabled(): boolean;
-export declare function getMcpMode(): McpMode;
-//# sourceMappingURL=mode.d.ts.map

package/dist/server/plugins/mcp/utils/mode.js

@@ -1 +0,0 @@
-import{EntitlementsProvider as e}from"../../../entitlements/entitlements-provider.js";function t(){return e.instance().entitlements?.mcpMode==="code"}function n(){return!!e.instance().canAccessFeature("mcpGateway")&&t()}function c(){return n()}function r(){return t()?"code":"tools"}export{r as getMcpMode,t as isMcpCodeModeEnabled,c as isMcpElicitationEnabled,n as isMcpGatewayEnabled};

package/dist/server/plugins/mcp/utils/public-endpoint.d.ts

@@ -1,9 +0,0 @@
-import type { RedoclyConfig } from '@redocly/config';
-export type PublicMcpEndpointStatus = 'served' | 'disabled' | 'no-protected-content' | 'anonymous-denied';
-/**
- * Whether `/mcp-public` is served for this config, and why not when it is not.
- * Ignores the `mcp` entitlement, so it is safe in request handlers; build-time callers
- * that need the full answer must also check the entitlement.
- */
-export declare function getPublicMcpEndpointStatus(config: Pick<RedoclyConfig, 'mcp' | 'access'>): PublicMcpEndpointStatus;
-//# sourceMappingURL=public-endpoint.d.ts.map

package/dist/server/plugins/mcp/utils/public-endpoint.js

@@ -1 +0,0 @@
-import{canAnonymousAccessMcpFeature as c}from"../../../utils/rbac/can-anonymous-access-mcp-feature.js";import{shouldHandleMcpAuth as i}from"../../../utils/rbac/should-handle-mcp-auth.js";function d(t){const{mcp:n,access:e}=t;if(n?.hide||n?.docs?.hide||!n?.docs?.publicEndpoint)return"disabled";const o=!!e?.requiresLogin,r=e?.rbac||{};return i(o,r)?c(r,o)?"served":"anonymous-denied":"no-protected-content"}export{d as getPublicMcpEndpointStatus};

package/dist/server/plugins/mcp/utils/telemetry-attributes.d.ts

@@ -1,9 +0,0 @@
-import type { McpCallAttribution, McpServerType, McpToolContext } from '../types.js';
-/** CloudEvent resource attributes shared by every `mcpServer` telemetry event. */
-export declare function serverAttributes(serverType: McpServerType): {
-    id: "docs";
-    object: 'mcpServer';
-    uri: string;
-};
-export declare function callAttribution(context: McpToolContext | undefined): McpCallAttribution;
-//# sourceMappingURL=telemetry-attributes.d.ts.map