@redocly/redoc-reef 0.138.0-next.9 → 0.139.0-next.1

package/dist/server/plugins/mcp/codemode/code-audit.d.ts

@@ -4,9 +4,10 @@ export type CodeAudit = {
     flags: string;
 };
 /**
- * Fingerprint model-supplied code for the audit trail. The body itself is never reported — it can
- * contain data the model already pulled from a customer API — so callers get a hash plus flags for
- * patterns worth reviewing. The sandbox blocks all of the flagged targets; a flag is an attempt.
+ * Fingerprint model-supplied code. Telemetry never carries the body — it can contain data the model
+ * already pulled from a customer API — so it gets a hash plus flags for patterns worth reviewing; the
+ * redacted body goes only to the audit log. The sandbox blocks all of the flagged targets; a flag is
+ * an attempt.
  */
 export declare function auditCode(code: string): CodeAudit;
 //# sourceMappingURL=code-audit.d.ts.map

package/dist/server/plugins/mcp/codemode/code-execution-audit.js

@@ -1 +1 @@
-import{auditInput as t,auditSha256 as g,logAuditRecord as h}from"../audit/audit-log.js";function f({audit:e,code:c,description:d,sessionHandle:o,toolNames:i,fetchBudget:u,fetchCapable:n,requestId:s,messageId:a}){h("Record code execution input",{code_sha256:e.sha256,code_length:e.length,request_id:s,message_id:a,flags:e.flags,subject_sha256:o?g(o):void 0,description:t(d),tools:[...i].sort().join(","),fetch_capable:n,fetch_budget:u,code:t(c)})}export{f as logCodeExecutionAudit};
+import{auditInput as t,auditSha256 as a,logAuditRecord as f}from"../audit/audit-log.js";import{maskCodeCredentials as g}from"../audit/code-credentials.js";function p({audit:e,code:d,description:c,sessionHandle:o,toolNames:i,fetchBudget:n,fetchCapable:r,requestId:s,messageId:u}){f("Record code execution input",{code_sha256:e.sha256,code_length:e.length,request_id:s,message_id:u,flags:e.flags,subject_sha256:o?a(o):void 0,description:t(c),tools:[...i].sort().join(","),fetch_capable:r,fetch_budget:n,code:t(g(d))})}export{p as logCodeExecutionAudit};

package/dist/server/plugins/mcp/codemode/constants.js

@@ -1 +1 @@
-import{CREATE_ANONYMOUS_SESSION_TOOL_NAME as _,MANAGE_API_CREDENTIALS_TOOL_NAME as E}from"../constants.js";const O="execute",t="describe-tools",e="fetch",A=new Set([O,t,_,E]),N="tools",T="__fetchBridge",L="fetch";export{A as CODE_MODE_TOOL_NAMES,t as DESCRIBE_TOOLS_TOOL_NAME,O as EXECUTE_TOOL_NAME,L as FETCH_BRIDGE_FUNCTION_NAME,T as FETCH_BRIDGE_GLOBAL_NAME,e as FETCH_TOOL_NAME,N as TOOLS_BRIDGE_GLOBAL_NAME};
+import{CREATE_ANONYMOUS_SESSION_TOOL_NAME as _,MANAGE_API_CREDENTIALS_TOOL_NAME as E,SUBMIT_FEEDBACK_TOOL_NAME as O}from"../constants.js";const t="execute",o="describe-tools",e="fetch",N=new Set([t,o,_,E,O]),T="tools",L="__fetchBridge",M="fetch";export{N as CODE_MODE_TOOL_NAMES,o as DESCRIBE_TOOLS_TOOL_NAME,t as EXECUTE_TOOL_NAME,M as FETCH_BRIDGE_FUNCTION_NAME,L as FETCH_BRIDGE_GLOBAL_NAME,e as FETCH_TOOL_NAME,T as TOOLS_BRIDGE_GLOBAL_NAME};

package/dist/server/plugins/mcp/codemode/prompts.d.ts

@@ -1,7 +1,8 @@
 import { type ToolListEntry } from './build-tool-list.js';
 export declare const DESCRIPTION_CHAR_LIMIT = 2048;
 export declare const EXECUTE_ARGS_NOTE = "Both `execute` arguments are required: `code` (the JavaScript to run; return a value to receive it) and `description` (a short human-readable summary of what the code does).";
-export declare function buildExecuteDescription(hasFetch: boolean, toolList?: ToolListEntry[]): string;
+/** The first line names the docs at `docsUrl` when the prose with it fits `DESCRIPTION_CHAR_LIMIT`. */
+export declare function buildExecuteDescription(hasFetch: boolean, toolList?: ToolListEntry[], docsUrl?: string): string;
 export declare const DESCRIBE_TOOLS_DESCRIPTION: string;
 export declare function buildCodeModeInstructions(hasFetch: boolean, toolList?: ToolListEntry[]): string;
 export declare function buildExecuteExample(toolNames: string[]): string;

package/dist/server/plugins/mcp/codemode/prompts.js

@@ -1,8 +1,8 @@
-import{buildToolList as i}from"./build-tool-list.js";const r=2048,d="Both `execute` arguments are required: `code` (the JavaScript to run; return a value to receive it) and `description` (a short human-readable summary of what the code does).",n="Available tools (exact signatures come from `describe-tools`):";function a(e,t){if(t.length===0)return e;const o=r-e.length-n.length-3,s=i(t,o);return s?[e,"",n,s].join(`
-`):e}function h(e,t=[]){const o=["Run JavaScript in a sandbox against the documentation tools on the global `tools` object.",e?"The extra globals are `tools`, `fetch`, `URL`, `URLSearchParams`, and `FormData` - there is no `console`, `setTimeout`, `require`, or Node.js API; all other I/O goes through `tools`.":"The only extra global is `tools` - there is no `fetch`, `console`, `setTimeout`, `require`, or Node.js API; all I/O goes through `tools`.","","Workflow - minimize round-trips; one `describe-tools` call plus one `execute` call covers most requests:","1. Analyze the request and decide which sandbox tools it needs.","2. Call `describe-tools` with those names to get their exact TypeScript signatures - inputs, result shapes, and a worked example. NEVER call `execute` with guessed method names, parameter names, enum values, or result field names: read fields off the declared return types, not from assumptions.","3. Batch everything into a SINGLE script: chain tool calls, pass one call's output into the next, process results in plain JavaScript, and `return` only what the request needs."].join(`
-`);return a(o,t)}const p=["Get the exact TypeScript signatures of the sandbox tools available to `execute`.","Analyze the user request first, then pass `tools` with only the tool names the request needs (every name is listed in this input schema / description); omit `tools` only when you cannot tell which tools apply.","Always call this before your first `execute` and never guess signatures. Request every tool the task may need in ONE call instead of calling this repeatedly."].join(`
-`);function m(e,t=[]){const o=["This server exposes documentation tools (API discovery, endpoint details, security schemes, full-text search) through `describe-tools` and `execute`:","- `describe-tools` returns the exact TypeScript signatures of the sandbox tools.","- `execute` runs JavaScript that calls those tools on the global `tools` object.","Workflow: analyze the request, call `describe-tools` once with `tools` set to only the names it needs, then batch everything into a single `execute` script. Minimize round-trips and never guess tool signatures.",...e?["The sandbox also has a global `fetch` that can call the documented APIs (allow-listed hosts only). Include `fetch` in your `describe-tools` call to get its contract and the list of callable APIs."]:[]].join(`
-`);return a(o,t)}const l=["listApis","getEndpoints"],c=["Example - list the write endpoints of an API:","","```ts","const { items } = await tools.listApis({ filter: 'billing' });","const [api] = items;",`if (!api) return { error: 'no API matches "billing"' };`,"const { endpoints } = await tools.getEndpoints({ name: api.name });","const writes = endpoints.filter((e) => e.method !== 'GET');","return { api: api.name, writes: writes.map((e) => `${e.method} ${e.path}`) };","```"].join(`
-`);function g(e){if(l.every(o=>e.includes(o)))return c;const[t]=e;return t?[`Example - call \`${t}\` and return what the request needs:`,"","```ts",`const result = await tools.${t}({ /* the input its signature above declares */ });`,"return result;","```"].join(`
-`):""}const b=["Types named `OpenApi\u2026` are the standard OpenAPI Specification objects.","Payload samples live on a media type object (`requestBody.content[mediaType]`, `responses[code].content[mediaType]`): `.example` holds a single value, `.examples[name].value` a named map, and some descriptions only set `.schema.example`. Read each before concluding a sample is absent."].join(`
-`);export{p as DESCRIBE_TOOLS_DESCRIPTION,r as DESCRIPTION_CHAR_LIMIT,d as EXECUTE_ARGS_NOTE,b as USAGE_NOTES,m as buildCodeModeInstructions,h as buildExecuteDescription,g as buildExecuteExample};
+import{buildToolList as c}from"./build-tool-list.js";const n=2048,m="Both `execute` arguments are required: `code` (the JavaScript to run; return a value to receive it) and `description` (a short human-readable summary of what the code does).",a="Available tools (exact signatures come from `describe-tools`):";function i(e,t){if(t.length===0)return e;const o=n-e.length-a.length-3,s=c(t,o);return s?[e,"",a,s].join(`
+`):e}const u="Run JavaScript in a sandbox against the documentation tools on the global `tools` object.";function r(e,t){return[e,t?"The extra globals are `tools`, `fetch`, `URL`, `URLSearchParams`, and `FormData` - there is no `console`, `setTimeout`, `require`, or Node.js API; all other I/O goes through `tools`.":"The only extra global is `tools` - there is no `fetch`, `console`, `setTimeout`, `require`, or Node.js API; all I/O goes through `tools`.","","Workflow - minimize round-trips; one `describe-tools` call plus one `execute` call covers most requests:","1. Analyze the request and decide which sandbox tools it needs.","2. Call `describe-tools` with those names to get their exact TypeScript signatures - inputs, result shapes, and a worked example. NEVER call `execute` with guessed method names, parameter names, enum values, or result field names: read fields off the declared return types, not from assumptions.","3. Batch everything into a SINGLE script: chain tool calls, pass one call's output into the next, process results in plain JavaScript, and `return` only what the request needs."].join(`
+`)}function g(e,t=[],o){const s=o&&r(`Run JavaScript in a sandbox against the tools for the documentation at ${o}. The tools are on the global \`tools\` object.`,e),l=s&&s.length<=n?s:r(u,e);return i(l,t)}const b=["Get the exact TypeScript signatures of the sandbox tools available to `execute`.","Analyze the user request first, then pass `tools` with only the tool names the request needs (every name is listed in this input schema / description); omit `tools` only when you cannot tell which tools apply.","Always call this before your first `execute` and never guess signatures. Request every tool the task may need in ONE call instead of calling this repeatedly."].join(`
+`);function x(e,t=[]){const o=["This server exposes documentation tools (API discovery, endpoint details, security schemes, full-text search) through `describe-tools` and `execute`:","- `describe-tools` returns the exact TypeScript signatures of the sandbox tools.","- `execute` runs JavaScript that calls those tools on the global `tools` object.","Workflow: analyze the request, call `describe-tools` once with `tools` set to only the names it needs, then batch everything into a single `execute` script. Minimize round-trips and never guess tool signatures.",...e?["The sandbox also has a global `fetch` that can call the documented APIs (allow-listed hosts only). Include `fetch` in your `describe-tools` call to get its contract and the list of callable APIs."]:[]].join(`
+`);return i(o,t)}const h=["listApis","getEndpoints"],d=["Example - list the write endpoints of an API:","","```ts","const { items } = await tools.listApis({ filter: 'billing' });","const [api] = items;",`if (!api) return { error: 'no API matches "billing"' };`,"const { endpoints } = await tools.getEndpoints({ name: api.name });","const writes = endpoints.filter((e) => e.method !== 'GET');","return { api: api.name, writes: writes.map((e) => `${e.method} ${e.path}`) };","```"].join(`
+`);function f(e){if(h.every(o=>e.includes(o)))return d;const[t]=e;return t?[`Example - call \`${t}\` and return what the request needs:`,"","```ts",`const result = await tools.${t}({ /* the input its signature above declares */ });`,"return result;","```"].join(`
+`):""}const y=["Types named `OpenApi\u2026` are the standard OpenAPI Specification objects.","Payload samples live on a media type object (`requestBody.content[mediaType]`, `responses[code].content[mediaType]`): `.example` holds a single value, `.examples[name].value` a named map, and some descriptions only set `.schema.example`. Read each before concluding a sample is absent."].join(`
+`);export{b as DESCRIBE_TOOLS_DESCRIPTION,n as DESCRIPTION_CHAR_LIMIT,m as EXECUTE_ARGS_NOTE,y as USAGE_NOTES,x as buildCodeModeInstructions,g as buildExecuteDescription,f as buildExecuteExample};

package/dist/server/plugins/mcp/codemode/tools/describe-tools.js

@@ -1,3 +1,3 @@
-import{renderDescribeToolsOutput as _}from"../capabilities/index.js";import{McpServerType as u}from"../../constants.js";import{logMcpToolCallAudit as E,reportMcpToolCalled as k,reportMcpToolError as C}from"../../workers/mcp-tool-telemetry.js";import{DESCRIBE_TOOLS_TOOL_NAME as l}from"../constants.js";import{DESCRIBE_TOOLS_DESCRIPTION as j}from"../prompts.js";import{sanitizeToolName as s}from"../build-tool-type-declarations.js";import{UnknownToolError as O}from"./tool-errors.js";import{callAttribution as N}from"../../utils/telemetry-attributes.js";function U(c,f){const r=[...new Set([...c.map(n=>s(n.name)),...f.map(n=>s(n.id))])];return{name:l,title:"Describe tools",description:j,annotations:{readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},schema:{type:"object",required:[],additionalProperties:!1,properties:{tools:{type:"array",description:`Tool names to describe: ${r.join(", ")}. Omit to describe everything.`,items:r.length>0?{type:"string",enum:r}:{type:"string"},nullable:!0}}}}}function x(c,f,r,n){const p=new Map(c.map(t=>[s(t.name),t])),w=new Map(r.map(t=>[s(t.id),t]));return async t=>{const b=performance.now(),m=n.mcpMode??"code",d=N(n);try{const o=[...new Set((t.tools??[]).map(s))],i=o.length===0,a=o.filter(e=>!p.has(e)&&!w.has(e));if(a.length>0){const e=[...p.keys(),...w.keys()];throw new O(`Unknown tool(s): ${a.join(", ")}. Valid tools: ${e.join(", ")}.`)}const S=i?r:r.filter(e=>o.includes(s(e.id))),T=i?c:o.filter(e=>p.has(e)).map(e=>p.get(e)),v=await Promise.all(T.map(e=>f(e.name))),D=T.filter((e,y)=>v[y]),M=T.filter((e,y)=>!v[y]),g=[_(D,S,n)];M.length>0&&g.push(`Not available for this request: ${M.map(e=>s(e.name)).join(", ")}`);const h=g.join(`
+import{renderDescribeToolsOutput as N}from"../capabilities/index.js";import{McpServerType as u,READ_ONLY_ANNOTATIONS as D}from"../../constants.js";import{logMcpToolCallAudit as E,reportMcpToolCalled as k,reportMcpToolError as C}from"../../workers/mcp-tool-telemetry.js";import{DESCRIBE_TOOLS_TOOL_NAME as l}from"../constants.js";import{DESCRIBE_TOOLS_DESCRIPTION as j}from"../prompts.js";import{sanitizeToolName as s}from"../build-tool-type-declarations.js";import{UnknownToolError as O}from"./tool-errors.js";import{callAttribution as A}from"../../utils/telemetry-attributes.js";function B(c,f){const r=[...new Set([...c.map(n=>s(n.name)),...f.map(n=>s(n.id))])];return{name:l,title:"Get docs function signatures",description:j,annotations:D,schema:{type:"object",required:[],additionalProperties:!1,properties:{tools:{type:"array",description:`Tool names to describe: ${r.join(", ")}. Omit to describe everything.`,items:r.length>0?{type:"string",enum:r}:{type:"string"},nullable:!0}}}}}function z(c,f,r,n){const p=new Map(c.map(t=>[s(t.name),t])),w=new Map(r.map(t=>[s(t.id),t]));return async t=>{const b=performance.now(),m=n.mcpMode??"code",d=A(n);try{const e=[...new Set((t.tools??[]).map(s))],i=e.length===0,a=e.filter(o=>!p.has(o)&&!w.has(o));if(a.length>0){const o=[...p.keys(),...w.keys()];throw new O(`Unknown tool(s): ${a.join(", ")}. Valid tools: ${o.join(", ")}.`)}const S=i?r:r.filter(o=>e.includes(s(o.id))),T=i?c:e.filter(o=>p.has(o)).map(o=>p.get(o)),g=await Promise.all(T.map(o=>f(o.name))),_=T.filter((o,y)=>g[y]),v=T.filter((o,y)=>!g[y]),M=[N(_,S,n)];v.length>0&&M.push(`Not available for this request: ${v.map(o=>s(o.name)).join(", ")}`);const h=M.join(`
 
-`);return E({tool:l,mode:m,serverType:u.Docs,args:t,result:h,...d}),k({tool:l,mode:m,serverType:u.Docs,durationMs:Math.round(performance.now()-b),outputLength:h.length,...d}),{content:[{type:"text",text:h}]}}catch(o){const i=o instanceof O,a=i?"tool_error":"server_error";throw E({tool:l,mode:m,serverType:u.Docs,args:t,errorClass:a,...d}),C({tool:l,mode:m,serverType:u.Docs,durationMs:Math.round(performance.now()-b),message:o instanceof Error?o.message:String(o),stack:!i&&o instanceof Error&&o.stack||"",errorClass:a,...d}),o}}}export{x as describeTools,U as describeToolsSchema};
+`);return E({tool:l,mode:m,serverType:u.Docs,args:t,result:h,...d}),k({tool:l,mode:m,serverType:u.Docs,durationMs:Math.round(performance.now()-b),outputLength:h.length,...d}),{content:[{type:"text",text:h}]}}catch(e){const i=e instanceof O,a=i?"tool_error":"server_error";throw E({tool:l,mode:m,serverType:u.Docs,args:t,errorClass:a,...d}),C({tool:l,mode:m,serverType:u.Docs,durationMs:Math.round(performance.now()-b),message:e instanceof Error?e.message:String(e),stack:!i&&e instanceof Error&&e.stack||"",errorClass:a,...d}),e}}}export{z as describeTools,B as describeToolsSchema};

package/dist/server/plugins/mcp/codemode/tools/execute-schema.d.ts

@@ -1,3 +1,5 @@
+import type { ToolAnnotations } from '@modelcontextprotocol/server';
 import type { McpToolSchema } from '../../../../types';
+export declare function executeToolTitle(annotations: ToolAnnotations): string;
 export declare const EXECUTE_TOOL_SCHEMA: McpToolSchema;
 //# sourceMappingURL=execute-schema.d.ts.map

package/dist/server/plugins/mcp/codemode/tools/execute-schema.js

@@ -1 +1 @@
-import{EXECUTE_TOOL_NAME as e}from"../constants.js";import{buildExecuteDescription as t}from"../prompts.js";const r={name:e,title:"Execute code",description:t(!1),schema:{type:"object",required:["code","description"],additionalProperties:!1,properties:{code:{type:"string",description:"JavaScript to run in the sandbox. Return a value to receive it as the result.",minLength:1},description:{type:"string",description:"A short, human-readable summary of what this code does.",minLength:1},sessionHandle:{type:"string",description:"Handle returned by createAnonymousSession. Required when an API needs credentials. This parameter is only offered when createAnonymousSession is available, so pass it whenever you have called that tool.",minLength:1}}},outputSchema:{type:"object",properties:{result:{description:"The value the code returned, as JSON"},error:{type:"string",description:"Why the code failed. Set only on a failed call"}}}};export{r as EXECUTE_TOOL_SCHEMA};
+import{EXECUTE_TOOL_NAME as o}from"../constants.js";import{buildExecuteDescription as i}from"../prompts.js";const e="Execute code";function s(t){return t.readOnlyHint?"Query the docs with code":e}const a={name:o,title:e,description:i(!1),schema:{type:"object",required:["code","description"],additionalProperties:!1,properties:{code:{type:"string",description:"JavaScript to run in the sandbox. Return a value to receive it as the result.",minLength:1},description:{type:"string",description:"A short, human-readable summary of what this code does.",minLength:1},sessionHandle:{type:"string",description:"Handle returned by createAnonymousSession. Required when an API needs credentials. This parameter is only offered when createAnonymousSession is available, so pass it whenever you have called that tool.",minLength:1}}},outputSchema:{type:"object",properties:{result:{description:"The value the code returned, as JSON"},error:{type:"string",description:"Why the code failed. Set only on a failed call"}}}};export{a as EXECUTE_TOOL_SCHEMA,s as executeToolTitle};

package/dist/server/plugins/mcp/constants.d.ts

@@ -1,3 +1,4 @@
+import type { ToolAnnotations } from '@modelcontextprotocol/server';
 export declare const McpServerType: {
     readonly Docs: 'docs';
 };
@@ -17,5 +18,6 @@ export declare const SUPPORTED_MCP_SCOPES: readonly ['openid', 'profile', 'email
 export declare const CREATE_ANONYMOUS_SESSION_TOOL_NAME = "createAnonymousSession";
 export declare const SUBMIT_FEEDBACK_TOOL_NAME = "submit-feedback";
 export declare const MANAGE_API_CREDENTIALS_TOOL_NAME = "manageApiCredentials";
+export declare const READ_ONLY_ANNOTATIONS: ToolAnnotations;
 export declare const CUSTOM_MCP_TOOLS_META_DIR = "custom-mcp-tools-meta";
 //# sourceMappingURL=constants.d.ts.map

package/dist/server/plugins/mcp/constants.js

@@ -1 +1 @@
-import{LATEST_PROTOCOL_VERSION as o}from"@modelcontextprotocol/server";const t={Docs:"docs"},E={InternalError:-32603,ServerError:-32e3,InvalidRequest:-32600,MethodNotFound:-32601,InvalidParams:-32602},_=o,r=3e4,s=15e3,O=3,n="Docs MCP server",S=["openid","profile","email","offline_access"],c="createAnonymousSession",T="submit-feedback",M="manageApiCredentials",A="custom-mcp-tools-meta";export{c as CREATE_ANONYMOUS_SESSION_TOOL_NAME,A as CUSTOM_MCP_TOOLS_META_DIR,r as DEFAULT_CONNECTION_TIMEOUT_MS,n as DEFAULT_DOCS_MCP_SERVER_NAME,M as MANAGE_API_CREDENTIALS_TOOL_NAME,O as MAX_DOCUMENTS_PER_CATEGORY,_ as MCP_PROTOCOL_VERSION,E as McpErrorCodes,t as McpServerType,s as SSE_KEEPALIVE_INTERVAL_MS,T as SUBMIT_FEEDBACK_TOOL_NAME,S as SUPPORTED_MCP_SCOPES};
+import{LATEST_PROTOCOL_VERSION as o}from"@modelcontextprotocol/server";const t={Docs:"docs"},r={InternalError:-32603,ServerError:-32e3,InvalidRequest:-32600,MethodNotFound:-32601,InvalidParams:-32602},_=o,E=3e4,s=15e3,O=3,n="Docs MCP server",c=["openid","profile","email","offline_access"],S="createAnonymousSession",T="submit-feedback",A="manageApiCredentials",p={readOnlyHint:!0,destructiveHint:!1,openWorldHint:!1},M="custom-mcp-tools-meta";export{S as CREATE_ANONYMOUS_SESSION_TOOL_NAME,M as CUSTOM_MCP_TOOLS_META_DIR,E as DEFAULT_CONNECTION_TIMEOUT_MS,n as DEFAULT_DOCS_MCP_SERVER_NAME,A as MANAGE_API_CREDENTIALS_TOOL_NAME,O as MAX_DOCUMENTS_PER_CATEGORY,_ as MCP_PROTOCOL_VERSION,r as McpErrorCodes,t as McpServerType,p as READ_ONLY_ANNOTATIONS,s as SSE_KEEPALIVE_INTERVAL_MS,T as SUBMIT_FEEDBACK_TOOL_NAME,c as SUPPORTED_MCP_SCOPES};

package/dist/server/plugins/mcp/docs-mcp/tool-schemas.js

@@ -1 +1 @@
-import{SEMANTIC_SEARCH_API_URL as y}from"../../../constants/common.js";import{shouldHandleMcpAuth as f}from"../../../utils/rbac/should-handle-mcp-auth.js";import{CREATE_ANONYMOUS_SESSION_TOOL_NAME as g,SUBMIT_FEEDBACK_TOOL_NAME as b}from"../constants.js";import{GRAPHQL_TYPE_KINDS as l,GRAPHQL_LIST_SCOPES as v}from"./tools/graphql/constants.js";import{OPERATION_METHODS as c}from"./tools/openapi/constants.js";const i={type:"string",nullable:!0},s={limit:{type:"number"},total:{type:"number"},page:{type:"number"},totalPages:{type:"number"}},a={codemodeType:"OpenApiServer[]"},o={codemodeType:"OpenApiSecurityRequirement[]"},u={codemodeType:"Record<string, OpenApiSecurityScheme>"},P={codemodeType:"OpenApiDocument"},A={codemodeType:"OpenApiOperation & { path: string; method: string }"},S={codemodeType:"OpenApiComponents",description:"Components the endpoint references. A `$ref` in `endpoint` resolves against the root of the result."},n={filePath:{type:"string",description:"API definition file path"},otherMatches:{type:"array",description:"Other API definitions the lookup also matched. Present only when several matched; pass `filePath` to pick another one",items:{type:"object",required:["filePath"],properties:{version:{type:"string"},filePath:{type:"string"}}}}},r="When several definitions match the name, the highest version or the shortest file path is used and the rest are listed in `otherMatches`; tell the user which version or file the answer is based on.",H="A `$ref` in `endpoint` points into the `components` key at the root of the result: read `#/components/<section>/<name>` there.",L={type:"object",additionalProperties:!1,required:[],properties:{filter:{type:"string",description:"Matches part of an API name, or of a description when no name matches",minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of APIs per page. Default is 300",minimum:1,default:300,nullable:!0}}},p={type:"object",required:[],additionalProperties:!1,properties:{name:{type:"string",description:"API name, or a unique part of it. Omit when `filePath` is given.",minLength:1,nullable:!0},apiName:{type:"string",description:"Alias of `name`",nullable:!0},api:{type:"string",description:"Alias of `name`",nullable:!0},version:{type:"string",description:"API version. When omitted and several versions exist, the highest one is used",nullable:!0},filePath:{type:"string",description:"API definition file path, as returned by `listApis`",nullable:!0}}},q={type:"object",required:["path","method"],additionalProperties:!1,properties:{name:{type:"string",description:"API name, or a unique part of it. Omit when `filePath` is given.",minLength:1,nullable:!0},apiName:{type:"string",description:"Alias of `name`",nullable:!0},api:{type:"string",description:"Alias of `name`",nullable:!0},path:{type:"string",description:"Endpoint path (e.g. /api/v1/users)",minLength:1},method:{type:"string",description:"HTTP method (GET, POST, PUT, DELETE, etc.)",enum:[...c.map(e=>e.toUpperCase()),...c],minLength:1},version:{type:"string",description:"API version. When omitted and several versions exist, the highest one is used",nullable:!0},filePath:{type:"string",description:"API definition file path, as returned by `listApis`",nullable:!0}}},O={type:"object",required:[],additionalProperties:!1,properties:{}},T={type:"object",required:[],additionalProperties:!1,properties:{}},G={type:"object",required:["path","summary"],additionalProperties:!1,properties:{path:{type:"string",description:"Path or URL of the documentation page the feedback is about (e.g. /guides/auth)",minLength:1,maxLength:1e3},summary:{type:"string",description:"One sentence that names what is wrong with the page",minLength:1,maxLength:500},details:{type:"string",description:"Expected versus actual behavior, missing steps, or the snippet that failed",maxLength:4e3,nullable:!0},targetFeature:{type:"string",description:"The API or feature the page documents",maxLength:500,nullable:!0}}};function I(e){const t=[{name:"list-apis",title:"List APIs",description:"Lists the APIs documented in this project",schema:L,annotations:{readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",required:["items","limit","total","page","totalPages"],properties:{items:{type:"array",items:{type:"object",required:["name","description","version","servers","filePath"],properties:{name:{type:"string"},description:{type:"string"},version:{type:"string"},servers:a,filePath:{type:"string",description:"API definition file path"},ambiguousTitle:{type:"boolean",description:"true = another API shares this title; a lookup picks the highest version, or the shortest file path at the same version, and lists the rest in `otherMatches`. Pass `filePath` to pick another one"},...e.hasCallableApis?{callable:{type:"boolean",description:"true = the documented hosts of this API are reachable via `fetch`; false = documentation only"}}:{}}}},...s}}},{name:"get-endpoints",title:"Get endpoints",description:`Get all endpoints for a specific API. ${r}`,schema:p,annotations:{readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",required:["api","version","filePath","servers","endpoints"],properties:{api:{type:"string"},version:{type:"string"},...n,servers:a,endpoints:{type:"array",items:{type:"object",required:["path","method"],properties:{path:{type:"string"},method:{type:"string"},summary:i,description:i,security:o}}}}}},{name:"get-endpoint-info",title:"Get endpoint info",description:`Get comprehensive information about specific endpoint including parameters, security, and examples. ${H} ${r}`,schema:q,annotations:{readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",required:["api","version","filePath","servers","endpoint","globalSecurity","securitySchemes"],properties:{api:{type:"string"},version:{type:"string"},...n,servers:a,endpoint:A,globalSecurity:o,securitySchemes:u,components:S}}},{name:"get-security-schemes",title:"Get security schemes",description:`Get the security schemes for a specific API. ${r}`,schema:p,annotations:{readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",required:["api","version","filePath","securitySchemes","security"],properties:{api:{type:"string"},version:{type:"string"},...n,securitySchemes:u,security:o}}},{name:"get-full-api-description",title:"Get full API description",description:`Get the complete OpenAPI description. ${r}`,schema:p,annotations:{readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",required:["api","version","filePath","definition"],properties:{api:{type:"string"},version:{type:"string"},...n,definition:P}}},...y?[d(e.products,e.locales)]:[]];return f(e.requiresLogin,e.rbac)&&t.push({name:"whoami",title:"Who am I",description:"Get information about the currently authenticated user",schema:O,annotations:{readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",required:["authenticated"],properties:{authenticated:{type:"boolean"},email:{type:"string"},name:{type:"string"},subject:{type:"string"},clientId:{type:"string"},scope:{type:"string"},issuedAt:{type:"string"},expiresAt:{type:"string"}}}}),e.feedbackHidden||t.push({name:b,title:"Submit feedback",description:"Report a documentation page that is wrong or incomplete",schema:G,annotations:{readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},outputSchema:{type:"object",required:["status","page","message"],properties:{status:{type:"string"},page:{type:"string"},message:{type:"string"}}}}),e.hasGraphqlApis&&t.push(...k()),e.elicitationEnabled&&e.hasCallableApis&&t.push({name:g,title:"Create anonymous session",description:"Create an anonymous session handle for storing upstream API credentials. Pass the returned sessionHandle to execute when an API needs credentials and the caller is not signed in. Treat it as a secret and reuse it across calls.",schema:T,annotations:{readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},outputSchema:{type:"object",required:["sessionHandle"],properties:{sessionHandle:{type:"string"}}}}),t}const w={type:"object",required:[],additionalProperties:!1,properties:{filter:{type:"string",description:"GraphQL schema name (or part of it)",minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of results per page. Default is 300",minimum:1,default:300,nullable:!0}}},j={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1},kind:{type:"string",description:'Optional: return only a single category of schema members. With scope "fields", restricts to the fields of that parent category ("objects", "interfaces", or "inputs" only).',enum:[...l,null],nullable:!0},scope:{type:"string",description:'Optional: what each list item is. "members" (default) lists top-level types and operations. "fields" flattens every field of every object/interface/input type into "ParentType.fieldName" entries with their descriptions \u2014 combine with `filter` to search nested fields anywhere in the schema.',enum:[...v,null],nullable:!0},filter:{type:"string",description:'Optional: only members whose name or description contains this substring, case-insensitive (e.g. "custom tags")',minLength:1,nullable:!0},referencesType:{type:"string",description:'Optional: only members that reference this type directly or transitively (via return, field, argument, union-member or input-field types). Finds cross-cutting members that never name it \u2014 e.g. referencesType "Book" surfaces a search query returning a union that includes Book.',minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of results per page. Default is 300",minimum:1,default:300,nullable:!0}}},E={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1},type:{type:"string",description:"Name of the type, operation, or directive",minLength:1,nullable:!0},typeName:{type:"string",description:"Alias of `type`",nullable:!0},includeReferencedTypes:{type:"boolean",description:"Also include the SDL of every type referenced transitively. Gives the whole subgraph at once, but can be large for highly-connected types.",default:!1,nullable:!0}}},N={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1}}};function k(){return[{name:"list-graphql-apis",title:"List GraphQL APIs",description:"Lists available GraphQL schemas with their context and purpose",schema:w,annotations:{readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",required:["items","limit","total","page","totalPages"],properties:{items:{type:"array",items:{type:"object",required:["name"],properties:{name:{type:"string"},description:i}}},...s}}},{name:"get-graphql-type-list",title:"Get GraphQL type list",description:'List all operations and types in a GraphQL schema as a flat, paginated list. Each item is tagged with its kind (query, object, enum, \u2026) and carries a one-line description; operations also include their return type and argument signature \u2014 use it to decide which members to fetch in detail. Narrow the result with `kind` (one category), `filter` (case-insensitive substring of the member name or description, e.g. "book"), or `referencesType` (only members that use a given type, directly or transitively) to explore a domain cheaply instead of pulling the full schema. To search nested fields \u2014 not just type names \u2014 set scope "fields": it flattens every field of every object/interface/input type into "ParentType.fieldName" entries with their descriptions, so `filter` finds things like an input field whose docstring mentions your keyword.',schema:j,annotations:{readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",required:["name","items","limit","total","page","totalPages"],properties:{name:{type:"string"},items:{type:"array",items:{type:"object",required:["kind","name"],properties:{kind:{type:"string",enum:l},name:{type:"string"},description:i,type:{type:"string"},args:{type:"string"},directives:{type:"string"}}}},...s}}},{name:"get-graphql-type",title:"Get GraphQL type",description:'Get the SDL for a single GraphQL type, operation (query/mutation/subscription field), or directive. Without includeReferencedTypes, the SDL is followed by a one-level manifest of every directly referenced type\'s field names (e.g. "input ActionOperationInput { addTags, removeTags }"), so you can see what nested types contain before fetching them. Set includeReferencedTypes to instead pull in the full SDL of every type it references transitively \u2014 the whole structural subgraph in one call, ideal for complete exploration of an entity (e.g. Book and all the types it touches). That traversal only follows what the target depends on; to go the other direction and find the members that use a type, call get-graphql-type-list with `referencesType`.',schema:E,annotations:{readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"string"}},{name:"get-graphql-schema",title:"Get GraphQL schema",description:"Get the complete GraphQL schema as SDL \u2014 the whole type graph in one call. Returns everything, so it can be very large and token-expensive for big schemas; prefer get-graphql-type-list (filter/paginate) plus targeted get-graphql-type calls, and reach for this only for small schemas or when you truly need the full SDL.",schema:N,annotations:{readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"string"}}]}function d(e,t){const h=e&&e.length>0,m=t&&t.length>0;return{name:"search",title:"Search documentation",description:"Search across the documentation to fetch relevant content for a given query",schema:{type:"object",required:["query"],additionalProperties:!1,properties:{query:{type:"string",description:"Search query. Should be a single word or that phrase that is presented in a documentation.",minLength:1},...h?{product:{type:"string",description:"Optional product name to filter search results by specific product.",enum:[...e,null],nullable:!0}}:{},...m?{locale:{type:"string",description:"Optional locale code to filter search results by documentation language (e.g. 'en', 'ja'). Use the locale matching the language of the user's request. Defaults to the project's default locale.",enum:[...t,null],nullable:!0}}:{}}},annotations:{readOnlyHint:!0,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},outputSchema:{type:"string"}}}const Q=new Set([...I({requiresLogin:!0,hasGraphqlApis:!0,elicitationEnabled:!0,hasCallableApis:!0}).map(e=>e.name),d().name]);export{Q as ALL_DEFAULT_TOOL_NAMES,I as getDefaultToolSchemas};
+import{SEMANTIC_SEARCH_API_URL as g}from"../../../constants/common.js";import{shouldHandleMcpAuth as f}from"../../../utils/rbac/should-handle-mcp-auth.js";import{CREATE_ANONYMOUS_SESSION_TOOL_NAME as b,READ_ONLY_ANNOTATIONS as t,SUBMIT_FEEDBACK_TOOL_NAME as A}from"../constants.js";import{GRAPHQL_TYPE_KINDS as c,GRAPHQL_LIST_SCOPES as P}from"./tools/graphql/constants.js";import{OPERATION_METHODS as h}from"./tools/openapi/constants.js";const n={type:"string",nullable:!0},a={limit:{type:"number"},total:{type:"number"},page:{type:"number"},totalPages:{type:"number"}},o={codemodeType:"OpenApiServer[]"},p={codemodeType:"OpenApiSecurityRequirement[]"},u={codemodeType:"Record<string, OpenApiSecurityScheme>"},v={codemodeType:"OpenApiDocument"},S={codemodeType:"OpenApiOperation & { path: string; method: string }"},L={codemodeType:"OpenApiComponents",description:"Components the endpoint references. A `$ref` in `endpoint` resolves against the root of the result."},r={filePath:{type:"string",description:"API definition file path"},otherMatches:{type:"array",description:"Other API definitions the lookup also matched. Present only when several matched; pass `filePath` to pick another one",items:{type:"object",required:["filePath"],properties:{version:{type:"string"},filePath:{type:"string"}}}}},s="When several definitions match the name, the highest version or the shortest file path is used and the rest are listed in `otherMatches`; tell the user which version or file the answer is based on.",q="A `$ref` in `endpoint` points into the `components` key at the root of the result: read `#/components/<section>/<name>` there.",T={type:"object",additionalProperties:!1,required:[],properties:{filter:{type:"string",description:"Matches part of an API name, or of a description when no name matches",minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of APIs per page. Default is 300",minimum:1,default:300,nullable:!0}}},l={type:"object",required:[],additionalProperties:!1,properties:{name:{type:"string",description:"API name, or a unique part of it. Omit when `filePath` is given.",minLength:1,nullable:!0},apiName:{type:"string",description:"Alias of `name`",nullable:!0},api:{type:"string",description:"Alias of `name`",nullable:!0},version:{type:"string",description:"API version. When omitted and several versions exist, the highest one is used",nullable:!0},filePath:{type:"string",description:"API definition file path, as returned by `listApis`",nullable:!0}}},O={type:"object",required:["path","method"],additionalProperties:!1,properties:{name:{type:"string",description:"API name, or a unique part of it. Omit when `filePath` is given.",minLength:1,nullable:!0},apiName:{type:"string",description:"Alias of `name`",nullable:!0},api:{type:"string",description:"Alias of `name`",nullable:!0},path:{type:"string",description:"Endpoint path (e.g. /api/v1/users)",minLength:1},method:{type:"string",description:"HTTP method (GET, POST, PUT, DELETE, etc.)",enum:[...h.map(e=>e.toUpperCase()),...h],minLength:1},version:{type:"string",description:"API version. When omitted and several versions exist, the highest one is used",nullable:!0},filePath:{type:"string",description:"API definition file path, as returned by `listApis`",nullable:!0}}},G={type:"object",required:[],additionalProperties:!1,properties:{}},I={type:"object",required:[],additionalProperties:!1,properties:{}},w={type:"object",required:["path","summary"],additionalProperties:!1,properties:{path:{type:"string",description:"Path or URL of the documentation page the feedback is about (e.g. /guides/auth)",minLength:1,maxLength:1e3},summary:{type:"string",description:"One sentence that names what is wrong with the page",minLength:1,maxLength:500},details:{type:"string",description:"Expected versus actual behavior, missing steps, or the snippet that failed",maxLength:4e3,nullable:!0},targetFeature:{type:"string",description:"The API or feature the page documents",maxLength:500,nullable:!0}}};function j(e){const i=[{name:"list-apis",title:"List APIs",description:"Lists the APIs documented in this project",schema:T,annotations:t,outputSchema:{type:"object",required:["items","limit","total","page","totalPages"],properties:{items:{type:"array",items:{type:"object",required:["name","description","version","servers","filePath"],properties:{name:{type:"string"},description:{type:"string"},version:{type:"string"},servers:o,filePath:{type:"string",description:"API definition file path"},ambiguousTitle:{type:"boolean",description:"true = another API shares this title; a lookup picks the highest version, or the shortest file path at the same version, and lists the rest in `otherMatches`. Pass `filePath` to pick another one"},...e.hasCallableApis?{callable:{type:"boolean",description:"true = the documented hosts of this API are reachable via `fetch`; false = documentation only"}}:{}}}},...a}}},{name:"get-endpoints",title:"Get endpoints",description:`Get all endpoints for a specific API. ${s}`,schema:l,annotations:t,outputSchema:{type:"object",required:["api","version","filePath","servers","endpoints"],properties:{api:{type:"string"},version:{type:"string"},...r,servers:o,endpoints:{type:"array",items:{type:"object",required:["path","method"],properties:{path:{type:"string"},method:{type:"string"},summary:n,description:n,security:p}}}}}},{name:"get-endpoint-info",title:"Get endpoint info",description:`Get comprehensive information about specific endpoint including parameters, security, and examples. ${q} ${s}`,schema:O,annotations:t,outputSchema:{type:"object",required:["api","version","filePath","servers","endpoint","globalSecurity","securitySchemes"],properties:{api:{type:"string"},version:{type:"string"},...r,servers:o,endpoint:S,globalSecurity:p,securitySchemes:u,components:L}}},{name:"get-security-schemes",title:"Get security schemes",description:`Get the security schemes for a specific API. ${s}`,schema:l,annotations:t,outputSchema:{type:"object",required:["api","version","filePath","securitySchemes","security"],properties:{api:{type:"string"},version:{type:"string"},...r,securitySchemes:u,security:p}}},{name:"get-full-api-description",title:"Get full API description",description:`Get the complete OpenAPI description. ${s}`,schema:l,annotations:t,outputSchema:{type:"object",required:["api","version","filePath","definition"],properties:{api:{type:"string"},version:{type:"string"},...r,definition:v}}},...g?[m(e.products,e.locales)]:[]];return f(e.requiresLogin,e.rbac)&&i.push({name:"whoami",title:"Who am I",description:"Get information about the currently authenticated user",schema:G,annotations:t,outputSchema:{type:"object",required:["authenticated"],properties:{authenticated:{type:"boolean"},email:{type:"string"},name:{type:"string"},subject:{type:"string"},clientId:{type:"string"},scope:{type:"string"},issuedAt:{type:"string"},expiresAt:{type:"string"}}}}),e.feedbackHidden||i.push({name:A,title:"Submit feedback",description:"Report a documentation page that is wrong or incomplete",schema:w,annotations:{readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},outputSchema:{type:"object",required:["status","page","message"],properties:{status:{type:"string"},page:{type:"string"},message:{type:"string"}}}}),e.hasGraphqlApis&&i.push(...D()),e.elicitationEnabled&&e.hasCallableApis&&i.push({name:b,title:"Create anonymous session",description:"Create an anonymous session handle for storing upstream API credentials. Pass the returned sessionHandle to execute when an API needs credentials and the caller is not signed in. Treat it as a secret and reuse it across calls.",schema:I,annotations:t,outputSchema:{type:"object",required:["sessionHandle"],properties:{sessionHandle:{type:"string"}}}}),i}const E={type:"object",required:[],additionalProperties:!1,properties:{filter:{type:"string",description:"GraphQL schema name (or part of it)",minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of results per page. Default is 300",minimum:1,default:300,nullable:!0}}},N={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1},kind:{type:"string",description:'Optional: return only a single category of schema members. With scope "fields", restricts to the fields of that parent category ("objects", "interfaces", or "inputs" only).',enum:[...c,null],nullable:!0},scope:{type:"string",description:'Optional: what each list item is. "members" (default) lists top-level types and operations. "fields" flattens every field of every object/interface/input type into "ParentType.fieldName" entries with their descriptions \u2014 combine with `filter` to search nested fields anywhere in the schema.',enum:[...P,null],nullable:!0},filter:{type:"string",description:'Optional: only members whose name or description contains this substring, case-insensitive (e.g. "custom tags")',minLength:1,nullable:!0},referencesType:{type:"string",description:'Optional: only members that reference this type directly or transitively (via return, field, argument, union-member or input-field types). Finds cross-cutting members that never name it \u2014 e.g. referencesType "Book" surfaces a search query returning a union that includes Book.',minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of results per page. Default is 300",minimum:1,default:300,nullable:!0}}},_={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1},type:{type:"string",description:"Name of the type, operation, or directive",minLength:1,nullable:!0},typeName:{type:"string",description:"Alias of `type`",nullable:!0},includeReferencedTypes:{type:"boolean",description:"Also include the SDL of every type referenced transitively. Gives the whole subgraph at once, but can be large for highly-connected types.",default:!1,nullable:!0}}},k={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1}}};function D(){return[{name:"list-graphql-apis",title:"List GraphQL APIs",description:"Lists available GraphQL schemas with their context and purpose",schema:E,annotations:t,outputSchema:{type:"object",required:["items","limit","total","page","totalPages"],properties:{items:{type:"array",items:{type:"object",required:["name"],properties:{name:{type:"string"},description:n}}},...a}}},{name:"get-graphql-type-list",title:"Get GraphQL type list",description:'List all operations and types in a GraphQL schema as a flat, paginated list. Each item is tagged with its kind (query, object, enum, \u2026) and carries a one-line description; operations also include their return type and argument signature \u2014 use it to decide which members to fetch in detail. Narrow the result with `kind` (one category), `filter` (case-insensitive substring of the member name or description, e.g. "book"), or `referencesType` (only members that use a given type, directly or transitively) to explore a domain cheaply instead of pulling the full schema. To search nested fields \u2014 not just type names \u2014 set scope "fields": it flattens every field of every object/interface/input type into "ParentType.fieldName" entries with their descriptions, so `filter` finds things like an input field whose docstring mentions your keyword.',schema:N,annotations:t,outputSchema:{type:"object",required:["name","items","limit","total","page","totalPages"],properties:{name:{type:"string"},items:{type:"array",items:{type:"object",required:["kind","name"],properties:{kind:{type:"string",enum:c},name:{type:"string"},description:n,type:{type:"string"},args:{type:"string"},directives:{type:"string"}}}},...a}}},{name:"get-graphql-type",title:"Get GraphQL type",description:'Get the SDL for a single GraphQL type, operation (query/mutation/subscription field), or directive. Without includeReferencedTypes, the SDL is followed by a one-level manifest of every directly referenced type\'s field names (e.g. "input ActionOperationInput { addTags, removeTags }"), so you can see what nested types contain before fetching them. Set includeReferencedTypes to instead pull in the full SDL of every type it references transitively \u2014 the whole structural subgraph in one call, ideal for complete exploration of an entity (e.g. Book and all the types it touches). That traversal only follows what the target depends on; to go the other direction and find the members that use a type, call get-graphql-type-list with `referencesType`.',schema:_,annotations:t,outputSchema:{type:"string"}},{name:"get-graphql-schema",title:"Get GraphQL schema",description:"Get the complete GraphQL schema as SDL \u2014 the whole type graph in one call. Returns everything, so it can be very large and token-expensive for big schemas; prefer get-graphql-type-list (filter/paginate) plus targeted get-graphql-type calls, and reach for this only for small schemas or when you truly need the full SDL.",schema:k,annotations:t,outputSchema:{type:"string"}}]}function m(e,i){const d=e&&e.length>0,y=i&&i.length>0;return{name:"search",title:"Search documentation",description:"Search across the documentation to fetch relevant content for a given query",schema:{type:"object",required:["query"],additionalProperties:!1,properties:{query:{type:"string",description:"Search query. Should be a single word or that phrase that is presented in a documentation.",minLength:1},...d?{product:{type:"string",description:"Optional product name to filter search results by specific product.",enum:[...e,null],nullable:!0}}:{},...y?{locale:{type:"string",description:"Optional locale code to filter search results by documentation language (e.g. 'en', 'ja'). Use the locale matching the language of the user's request. Defaults to the project's default locale.",enum:[...i,null],nullable:!0}}:{}}},annotations:t,outputSchema:{type:"string"}}}const M=new Set([...j({requiresLogin:!0,hasGraphqlApis:!0,elicitationEnabled:!0,hasCallableApis:!0}).map(e=>e.name),m().name]);export{M as ALL_DEFAULT_TOOL_NAMES,j as getDefaultToolSchemas};

package/dist/server/plugins/mcp/docs-mcp/tools/core/create-anonymous-session.js

@@ -1 +1 @@
-import{CREATE_ANONYMOUS_SESSION_TOOL_NAME as t}from"../../../constants.js";import{isFetchCapable as o}from"../../../gateway-mcp/callable-apis.js";import{createSessionHandle as n}from"../../../gateway-mcp/subject.js";const i=async()=>{const e={sessionHandle:n()};return{content:[{type:"text",text:JSON.stringify(e)}],structuredContent:e}};function s(e){return!!e.elicitationEnabled&&e.mcpMode==="code"&&o(e)&&!e.user?.isAuthenticated}var u={[t]:{execute:i,isAvailable:s}};export{u as default,s as isAnonymousSessionToolAvailable};
+import{CREATE_ANONYMOUS_SESSION_TOOL_NAME as t}from"../../../constants.js";import{isFetchCapable as o}from"../../../gateway-mcp/callable-apis.js";import{createSessionHandle as n}from"../../../gateway-mcp/subject.js";const i=async()=>{const e={sessionHandle:n()};return{content:[{type:"text",text:JSON.stringify(e)}],structuredContent:e}};function s(e){return!!e.elicitationEnabled&&o(e)&&!e.user?.isAuthenticated}var u={[t]:{execute:i,isAvailable:s}};export{u as default,s as isAnonymousSessionToolAvailable};

package/dist/server/plugins/mcp/docs-mcp/tools/core/submit-feedback.js

@@ -1,3 +1,3 @@
-import{getPathPrefix as p,withPathPrefix as h,withoutPathPrefix as l}from"@redocly/theme/core/utils";import{ServerRoutes as g}from"../../../../../../constants/api.js";import{normalizeRouteSlug as b}from"../../../../../../utils/path/normalize-route-slug.js";import{SUBMIT_FEEDBACK_TOOL_NAME as y}from"../../../constants.js";const k="mcp",P="mcp-client";function r(t,e=!1){return{content:[{type:"text",text:JSON.stringify(t)}],isError:e}}function i(t){const e=t?.trim();return e||void 0}function U(t){const e=p();return!!e&&(t===e||t.startsWith(`${e}/`))?l(t):t}function F(t,e){try{const{pathname:n}=new URL(t,e),a=new URL(e);return a.pathname=U(b(n)),a.toString()}catch{return}}function T(t){const e=t.client??P;return t.clientVersion?`${e}/${t.clientVersion}`:e}async function A(t){const n=(await t.json().catch(()=>{}))?.errors;return Array.isArray(n)?n.filter(a=>typeof a=="string"):[]}const E=async(t,e)=>{const n=i(t.path),a=i(t.summary);if(!n||!a)return r({error:"Invalid arguments",message:"`path` and `summary` are required."},!0);const c=e.baseUrl;if(!c)return r({error:"Unavailable",message:"The feedback endpoint of this site is not configured."},!0);const s=F(n,c);if(!s)return r({error:"Invalid arguments",message:"`path` must be a page path or URL of this site."},!0);const u=i(t.details),d=T(e),f=e.accessToken?.replace(/^Bearer /,""),m=`${e.internalBaseUrl||c}${h(g.FEEDBACK)}`;let o;try{o=await fetch(m,{method:"POST",headers:{"Content-Type":"application/json","User-Agent":d,...f?{Cookie:`authorization=${f}`}:{},...e.clientIp?{"X-Real-IP":e.clientIp}:{}},body:JSON.stringify({component:"comment",path:s,comment:u?`${a}
+import{getPathPrefix as p,withPathPrefix as h,withoutPathPrefix as l}from"@redocly/theme/core/utils";import{ServerRoutes as g}from"../../../../../../constants/api.js";import{normalizeRouteSlug as b}from"../../../../../../utils/path/normalize-route-slug.js";import{SUBMIT_FEEDBACK_TOOL_NAME as y}from"../../../constants.js";const k="mcp",P="mcp-client";function a(e){return{content:[{type:"text",text:JSON.stringify(e)}],isError:!0}}function i(e){const t=e?.trim();return t||void 0}function U(e){const t=p();return!!t&&(e===t||e.startsWith(`${t}/`))?l(e):e}function E(e,t){try{const{pathname:r}=new URL(e,t),n=new URL(t);return n.pathname=U(b(r)),n.toString()}catch{return}}function F(e){const t=e.client??P;return e.clientVersion?`${t}/${e.clientVersion}`:t}async function T(e){const r=(await e.json().catch(()=>{}))?.errors;return Array.isArray(r)?r.filter(n=>typeof n=="string"):[]}const A=async(e,t)=>{const r=i(e.path),n=i(e.summary);if(!r||!n)return a({error:"Invalid arguments",message:"`path` and `summary` are required."});const c=t.baseUrl;if(!c)return a({error:"Unavailable",message:"The feedback endpoint of this site is not configured."});const s=E(r,c);if(!s)return a({error:"Invalid arguments",message:"`path` must be a page path or URL of this site."});const u=i(e.details),d=F(t),f=t.accessToken?.replace(/^Bearer /,""),m=`${t.internalBaseUrl||c}${h(g.FEEDBACK)}`;let o;try{o=await fetch(m,{method:"POST",headers:{"Content-Type":"application/json","User-Agent":d,...f?{Cookie:`authorization=${f}`}:{},...t.clientIp?{"X-Real-IP":t.clientIp}:{}},body:JSON.stringify({component:"comment",path:s,comment:u?`${n}
 
-${u}`:a,agent:d,targetFeature:i(t.targetFeature),origin:k})})}catch{return r({error:"Failed to submit feedback",message:"The feedback endpoint could not be reached."},!0)}return o.status===403?r({error:"Forbidden",message:"You have no access to this page, so feedback for it is not accepted."},!0):o.status===404?r({error:"Not found",message:`No page exists at ${s}.`},!0):o.status===400?r({error:"Invalid feedback",errors:await A(o)},!0):o.ok?r({status:"received",page:s,message:"Thanks for your feedback. The documentation team sees it on the Feedback page."}):r({error:"Failed to submit feedback",message:`The feedback endpoint answered ${o.status}.`},!0)};var N={[y]:E};export{N as default};
+${u}`:n,agent:d,targetFeature:i(e.targetFeature),origin:k})})}catch{return a({error:"Failed to submit feedback",message:"The feedback endpoint could not be reached."})}return o.status===403?a({error:"Forbidden",message:"You have no access to this page, so feedback for it is not accepted."}):o.status===404?a({error:"Not found",message:`No page exists at ${s}.`}):o.status===400?a({error:"Invalid feedback",errors:await T(o)}):o.ok?{status:"received",page:s,message:"Thanks for your feedback. The documentation team sees it on the Feedback page."}:a({error:"Failed to submit feedback",message:`The feedback endpoint answered ${o.status}.`})};var N={[y]:A};export{N as default};

package/dist/server/plugins/mcp/docs-mcp/tools/core/utils.js

@@ -1,6 +1,6 @@
 import c from"node:fs";import f from"node:path";import{MAX_DOCUMENTS_PER_CATEGORY as $}from"../../../constants.js";function j(m,u){return Object.entries(m).map(([h,s])=>{if(!s||s.length===0)return"";const x=s.slice(0,$).map(d=>{const{document:t,highlight:o}=d,p=o?.title||(Array.isArray(t.title)?t.title[0]:t.title);let n=`Document: ${t.title}`;n+=`### [${p}](${t.url})
 
-`;let r;if(t.url)try{let e=t.url.startsWith("/")?t.url.slice(1):t.url;const i=e.indexOf("#");i!==-1&&(e=e.substring(0,i));const l=f.extname(e);l&&(e=e.slice(0,-l.length));let y=e+".md";const a=f.join(u,y);c.existsSync(a)&&(r=c.readFileSync(a,"utf8"))}catch{}return r||(r=o?.text||(Array.isArray(t.text)?t.text[0]:t.text)),n+=r,t.facets&&(n+=`
+`;let r;if(t.url)try{let e=t.url.startsWith("/")?t.url.slice(1):t.url;const i=e.indexOf("#");i!==-1&&(e=e.substring(0,i));const l=f.extname(e);l&&(e=e.slice(0,-l.length));const y=e+".md",a=f.join(u,y);c.existsSync(a)&&(r=c.readFileSync(a,"utf8"))}catch{}return r||(r=o?.text||(Array.isArray(t.text)?t.text[0]:t.text)),n+=r,t.facets&&(n+=`
 
 **Categories:**
 `,Object.entries(t.facets).forEach(([e,i])=>{n+=`- ${e}: ${i}

package/dist/server/plugins/mcp/docs-mcp/tools/openapi/list-apis.js

@@ -1 +1 @@
-import{isFetchCapable as h}from"../../../gateway-mcp/callable-apis.js";import{filterApiDescriptionsByName as b}from"../../utils/api-name-matching.js";import{apiTitleKey as y,countApiTitles as T,orderSharedTitles as x}from"../../utils/api-titles.js";const A=async(r,i)=>{const{filter:s,page:l=1,limit:e=300}=r,c=h(i),a=x(Object.values(i.apiDescriptionsMap)),p=T(a);let t=a;s&&(t=b(t,s));const n=(l-1)*e,m=n+e,u=Math.ceil(t.length/e),f=t.length;return t=t.slice(n,m),{content:[{type:"text",text:JSON.stringify({items:t.map(({relativePath:d,fetchEligible:g,...o})=>({filePath:d,...o,...(p.get(y(o.name))??0)>1?{ambiguousTitle:!0}:{},...c?{callable:g===!0}:{}})),limit:e,total:f,page:l,totalPages:u})}]}};var M={"list-apis":A};export{M as default};
+import{getCallableApis as b}from"../../../gateway-mcp/callable-apis.js";import{filterApiDescriptionsByName as d}from"../../utils/api-name-matching.js";import{apiTitleKey as y,countApiTitles as A,orderSharedTitles as T}from"../../utils/api-titles.js";const x=async(r,l)=>{const{filter:s,page:a=1,limit:e=300}=r,n=new Set(b(l).map(i=>i.relativePath)),m=n.size>0,o=T(Object.values(l.apiDescriptionsMap)),f=A(o);let t=o;s&&(t=d(t,s));const c=(a-1)*e,u=c+e,g=Math.ceil(t.length/e),h=t.length;return t=t.slice(c,u),{content:[{type:"text",text:JSON.stringify({items:t.map(({relativePath:i,fetchEligible:D,...p})=>({filePath:i,...p,...(f.get(y(p.name))??0)>1?{ambiguousTitle:!0}:{},...m?{callable:n.has(i)}:{}})),limit:e,total:h,page:a,totalPages:g})}]}};var I={"list-apis":x};export{I as default};

package/dist/server/plugins/mcp/docs-mcp/tools/openapi/utils.d.ts

@@ -8,13 +8,22 @@ type EndpointInfo = Pick<OpenAPIOperation, 'summary' | 'description' | 'security
     path: string;
 };
 export declare function getEndpointsFromPaths(def: OpenAPIDefinition): EndpointInfo[];
-export declare function getApiDescriptionFromFs({ relativePath, outdir, user, rbac, requiresLogin, }: {
-    relativePath: string;
-    outdir: string;
+type ApiDescriptionAccess = {
     user: ApiFunctionsUser;
     rbac?: RbacConfig;
     requiresLogin?: boolean;
+};
+export declare function getApiDescriptionFromFs({ relativePath, outdir, ...access }: ApiDescriptionAccess & {
+    relativePath: string;
+    outdir: string;
 }): Promise<OpenAPIDefinition | undefined>;
+/** The bundled description with no RBAC filtering; never return it to a caller. */
+export declare function readApiDescriptionFromFs(relativePath: string, outdir: string): Promise<OpenAPIDefinition | undefined>;
+/**
+ * A filtered copy of `definition` holding only what the user can read, or undefined when the user
+ * can read none of it; the input is not mutated.
+ */
+export declare function filterApiDescriptionByAccess(definition: OpenAPIDefinition, { user, rbac, requiresLogin }: ApiDescriptionAccess): OpenAPIDefinition | undefined;
 export declare function absolutePath(requestedPath: string): string;
 /** Models copy a path and lose its casing; the definition's own spelling still answers. */
 export declare function matchDocumentedPath(description: OpenAPIDefinition, requestedPath: string): string;

package/dist/server/plugins/mcp/docs-mcp/tools/openapi/utils.js

@@ -1 +1 @@
-import m from"node:path";import{existsSync as f}from"node:fs";import{readFile as u}from"node:fs/promises";import{replaceFileExtension as d}from"../../../../../plugins/api-docs/utils/replace-file-extension.js";import{PUBLIC_API_DEFINITIONS_FOLDER as h}from"../../../../../constants/common.js";import{filterDataByAccessDeep as l}from"../../../../../utils/rbac.js";import{isEndpointHidden as c}from"../../../utils/xmcp-utils.js";import{HTTP_METHODS as x}from"./constants.js";function y(t){return!t||c(t,"docs")?[]:Object.entries(t).filter(r=>{const[e,o]=r;return x.has(e.toLowerCase())&&typeof o=="object"&&o!==null&&!c(o,"docs")})}function P(t){const{paths:r={}}=t,e=[];for(const[o,i]of Object.entries(r))for(const[n,s]of y(i))e.push({path:o,method:n.toUpperCase(),summary:s.summary,description:s.description,security:s.security});return e}async function I({relativePath:t,outdir:r,user:e,rbac:o={},requiresLogin:i=!1}){const n=m.join(r||"",h,d(t,".json"));if(!f(n))return;const a=await u(n,"utf-8"),p=JSON.parse(a);return l(p,{isAuthenticated:e?.isAuthenticated,email:e?.email,teams:e?.teams},o,i)}function D(t){return t.startsWith("/")?t:`/${t}`}function S(t,r){const e=D(r);if(t.paths?.[e])return e;const o=e.toLowerCase();return Object.keys(t.paths??{}).find(n=>n.toLowerCase()===o)??e}export{D as absolutePath,I as getApiDescriptionFromFs,P as getEndpointsFromPaths,S as matchDocumentedPath,y as visibleOperations};
+import a from"node:path";import{existsSync as p}from"node:fs";import{readFile as m}from"node:fs/promises";import{replaceFileExtension as f}from"../../../../../plugins/api-docs/utils/replace-file-extension.js";import{PUBLIC_API_DEFINITIONS_FOLDER as u}from"../../../../../constants/common.js";import{filterDataByAccessDeep as d}from"../../../../../utils/rbac.js";import{isEndpointHidden as c}from"../../../utils/xmcp-utils.js";import{HTTP_METHODS as h}from"./constants.js";function l(t){return!t||c(t,"docs")?[]:Object.entries(t).filter(o=>{const[e,r]=o;return h.has(e.toLowerCase())&&typeof r=="object"&&r!==null&&!c(r,"docs")})}function L(t){const{paths:o={}}=t,e=[];for(const[r,s]of Object.entries(o))for(const[n,i]of l(s))e.push({path:r,method:n.toUpperCase(),summary:i.summary,description:i.description,security:i.security});return e}async function P({relativePath:t,outdir:o,...e}){const r=await y(t,o);return r&&x(r,e)}async function y(t,o){const e=a.join(o||"",u,f(t,".json"));if(p(e))return JSON.parse(await m(e,"utf-8"))}function x(t,{user:o,rbac:e={},requiresLogin:r=!1}){return d(t,{isAuthenticated:o?.isAuthenticated,email:o?.email,teams:o?.teams},e,r)}function D(t){return t.startsWith("/")?t:`/${t}`}function I(t,o){const e=D(o);if(t.paths?.[e])return e;const r=e.toLowerCase();return Object.keys(t.paths??{}).find(n=>n.toLowerCase()===r)??e}export{D as absolutePath,x as filterApiDescriptionByAccess,P as getApiDescriptionFromFs,L as getEndpointsFromPaths,I as matchDocumentedPath,y as readApiDescriptionFromFs,l as visibleOperations};

package/dist/server/plugins/mcp/docs-mcp/utils/resolve-refs.d.ts

@@ -1,5 +1,7 @@
 import type { OpenAPIParameter, Referenced, OpenAPIDefinition } from '@redocly/api-docs';
 import type { McpEndpoint } from '../../types.js';
+import { resolveRef } from '@redocly/api-docs/lib/utils/inline-openapi-refs.js';
+export { resolveRef };
 type JsonValue = string | number | boolean | null | JsonValue[] | {
     [key: string]: JsonValue;
 };
@@ -10,7 +12,6 @@ export type ResolvedOperation = {
     operation: JsonObject;
     components?: Record<string, JsonObject>;
 };
-export declare function resolveRef<T>(ref: string, def?: OpenAPIDefinition): T | undefined;
 type ResolveOperationParams = {
     operation: McpEndpoint;
     pathParams: Referenced<OpenAPIParameter>[];
@@ -22,5 +23,4 @@ export declare function resolveOperation({ operation, pathParams, definition, }:
  * `maxBytes` or the inliner cannot read the operation.
  */
 export declare function inlineOperation({ operation, pathParams, definition }: ResolveOperationParams, maxBytes: number): ResolvedOperation | undefined;
-export {};
 //# sourceMappingURL=resolve-refs.d.ts.map

package/dist/server/plugins/mcp/docs-mcp/utils/resolve-refs.js

@@ -1 +1 @@
-const S=/^#\/components\/([^/]+)\/([^/]+)(\/.*)?$/;function w(e){return e.replace(/~1/g,"/").replace(/~0/g,"~")}function d(e,s){if(!s||!e?.startsWith("#/"))return;const n=e.slice(2).split("/").map(w);let t=s;for(const r of n)if(typeof t=="object"&&t!==null&&r in t)t=t[r];else return;return t}function h(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function O(e,s){const n={},t=new Set,r=new Set,o=[e];for(;o.length>0;){const c=o.pop();if(!(c===null||typeof c!="object")){if(h(c)&&typeof c.$ref=="string"&&!t.has(c.$ref)){t.add(c.$ref);const[,i,f]=S.exec(c.$ref)??[],u=f&&w(f);if(i&&u&&!r.has(`${i}/${u}`)){const l=d(`#/components/${i}/${f}`,s);l!==void 0&&(r.add(`${i}/${u}`),(n[i]??={})[u]=l,o.push(l))}}for(const i of Object.values(c))o.push(i)}}return Object.keys(n).length>0?n:void 0}function R(e,s){const n=h(e)&&typeof e.$ref=="string"?d(e.$ref,s)??e:e,{name:t,in:r}=h(n)?n:{};return typeof t=="string"&&typeof r=="string"?`${r}:${t}`:JSON.stringify(e)}function g(e,s,n){const t=new Map;for(const r of[...e,...s])r&&t.set(R(r,n),r);return[...t.values()]}function C({operation:e,pathParams:s,definition:n}){const t={...e,parameters:g(s,e.parameters??[],n)};return{operation:t,components:O(t,n)}}class E extends Error{}function j(e,s){if(e.remainingBytes-=s,e.remainingBytes<0)throw new E}function $(e,s){return j(e,JSON.stringify(s).length),s}function m(e,s,n){const t=d(e,s);if(t===void 0)return;const r=n.bytesByRef.get(e)??JSON.stringify(t).length;return n.bytesByRef.set(e,r),j(n,r),t}function y(e,s,n){const t=$(n,Object.fromEntries(Object.entries(e).filter(([r,o])=>r!=="$ref"&&o!==void 0)));return{...s,...t}}function a({schema:e,definition:s,budget:n,visitedRefs:t=new Set,maxDepth:r=50,currentDepth:o=0}){if(!e)return;if(o>=r)return $(n,{type:"object",description:`Maximum resolution depth exceeded (${r})`});if("$ref"in e&&e.$ref){if(t.has(e.$ref))return $(n,{type:"object",description:`Circular reference detected: ${e.$ref}`,"x-circular-ref":e.$ref});const f=new Set(t);f.add(e.$ref);const u=m(e.$ref,s,n);if(!u)return $(n,{type:"object",description:`Could not resolve reference: ${e.$ref}`,"x-unresolved-ref":e.$ref});const l=a({schema:u,definition:s,budget:n,visitedRefs:f,maxDepth:r,currentDepth:o+1});return l&&y(e,l,n)}const c={...e};if(c.properties){const f={};for(const[u,l]of Object.entries(c.properties)){const p=a({schema:l,definition:s,budget:n,visitedRefs:new Set(t),maxDepth:r,currentDepth:o+1});f[u]=p||l}c.properties=f}if(c.items&&typeof c.items=="object")if(Array.isArray(c.items))c.items=c.items.map(f=>a({schema:f,definition:s,budget:n,visitedRefs:new Set(t),maxDepth:r,currentDepth:o+1})||f);else{const f=a({schema:c.items,definition:s,budget:n,visitedRefs:new Set(t),maxDepth:r,currentDepth:o+1});f&&(c.items=f)}return["allOf","anyOf","oneOf"].forEach(f=>{const u=c[f];Array.isArray(u)&&(c[f]=u.reduce((l,p)=>{const v=a({schema:p,definition:s,budget:n,visitedRefs:new Set(t),maxDepth:r,currentDepth:o+1});return v&&l.push(v),l},[]))}),c}function P({pathParams:e,opParams:s,definition:n,budget:t}){return[...e,...s].reduce((r,o)=>{if(!o)return r;if("$ref"in o&&o.$ref){const c=m(o.$ref,n,t);if(!c)return r;const i=y(o,c,t);return r.push({...i,schema:"schema"in i&&i.schema?a({schema:i.schema,definition:n,budget:t}):void 0}),r}return r.push({...o,schema:"schema"in o&&o.schema?a({schema:o.schema,definition:n,budget:t}):void 0}),r},[])}function x(e,s,n){const t={...e};if(e.example!==void 0&&(t.example=e.example),!e.examples)return t;const r={};for(const[o,c]of Object.entries(e.examples))if("$ref"in c){const i=m(c.$ref,s,n);i&&(r[o]=i)}else r[o]=c;return t.examples=r,t}function A(e,s,n){if(!e)return;const t="$ref"in e&&e.$ref?m(e.$ref,s,n):e;if(!t)return;const r=y(e,t,n),o={...r};if("content"in r&&r.content){const c={};for(const[i,f]of Object.entries(r.content))c[i]={...x(f,s,n),schema:f.schema?a({schema:f.schema,definition:s,budget:n}):void 0};o.content=c}return o}function B(e,s,n){if(e)return Object.entries(e).reduce((t,[r,o])=>{const c="$ref"in o&&o.$ref?m(o.$ref,s,n):o;if(!c)return t;const i=y(o,c,n),f={...i};if("content"in i&&i.content){const u={};for(const[l,p]of Object.entries(i.content))u[l]={...x(p,s,n),schema:p.schema?a({schema:p.schema,definition:s,budget:n}):void 0};f.content=u}return t[r]=f,t},{})}function N({operation:e,pathParams:s,definition:n},t){const r={remainingBytes:t,bytesByRef:new Map};try{const o={...e,parameters:P({pathParams:s,opParams:e.parameters||[],definition:n,budget:r}),requestBody:A(e.requestBody,n,r),responses:B(e.responses,n,r)};return{operation:o,components:O(o,n)}}catch{return}}export{N as inlineOperation,C as resolveOperation,d as resolveRef};
+import{resolveParameters as y,resolveRef as p,resolveRequestBody as g,resolveResponses as m,unescapeJsonPointerToken as $}from"@redocly/api-docs/lib/utils/inline-openapi-refs.js";const h=/^#\/components\/([^/]+)\/([^/]+)(\/.*)?$/;function d(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function l(e,o){const n={},s=new Set,t=new Set,r=[e];for(;r.length>0;){const c=r.pop();if(!(c===null||typeof c!="object")){if(d(c)&&typeof c.$ref=="string"&&!s.has(c.$ref)){s.add(c.$ref);const[,f,i]=h.exec(c.$ref)??[],u=i&&$(i);if(f&&u&&!t.has(`${f}/${u}`)){const a=p(`#/components/${f}/${i}`,o);a!==void 0&&(t.add(`${f}/${u}`),(n[f]??={})[u]=a,r.push(a))}}for(const f of Object.values(c))r.push(f)}}return Object.keys(n).length>0?n:void 0}function b(e,o){const n=d(e)&&typeof e.$ref=="string"?p(e.$ref,o)??e:e,{name:s,in:t}=d(n)?n:{};return typeof s=="string"&&typeof t=="string"?`${t}:${s}`:JSON.stringify(e)}function O(e,o,n){const s=new Map;for(const t of[...e,...o])t&&s.set(b(t,n),t);return[...s.values()]}function x({operation:e,pathParams:o,definition:n}){const s={...e,parameters:O(o,e.parameters??[],n)};return{operation:s,components:l(s,n)}}class w extends Error{}function B(e){let o=e;const n=new Map;return(s,t)=>{let r=t===void 0?void 0:n.get(t);if(r===void 0&&(r=JSON.stringify(s).length,t!==void 0&&n.set(t,r)),o-=r,o<0)throw new w}}function R({operation:e,pathParams:o,definition:n},s){const t=B(s);try{const r={...e,parameters:y({pathParams:o,opParams:e.parameters||[],definition:n,charge:t}),requestBody:g(e.requestBody,n,t),responses:e.responses&&m(e.responses,n,t)};return{operation:r,components:l(r,n)}}catch{return}}export{R as inlineOperation,x as resolveOperation,p as resolveRef};

package/dist/server/plugins/mcp/gateway-mcp/allowed-http-methods.d.ts

@@ -0,0 +1,11 @@
+import type { RedoclyConfig } from '@redocly/config';
+export type ApiCallsConfig = NonNullable<NonNullable<RedoclyConfig['mcp']>['apiCalls']>;
+type ApiCallsHttpMethod = NonNullable<ApiCallsConfig['allowedHttpMethods']>[number];
+/** The methods agents may send when `mcp.apiCalls.allowedHttpMethods` is not set. */
+export declare const DEFAULT_ALLOWED_HTTP_METHODS: readonly ApiCallsHttpMethod[];
+/** Upper-case HTTP methods agents may send; read-only unless `redocly.yaml` allows more. */
+export declare function getAllowedHttpMethods(mcp: RedoclyConfig['mcp'] | undefined): string[];
+/** Whether every allowed method is safe by HTTP semantics (`GET`, `HEAD`, `OPTIONS`). */
+export declare function allowsOnlySafeHttpMethods(mcp: RedoclyConfig['mcp'] | undefined): boolean;
+export {};
+//# sourceMappingURL=allowed-http-methods.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/allowed-http-methods.js

@@ -0,0 +1 @@
+const o=["GET","HEAD","OPTIONS"],r={GET:!0,HEAD:!0,OPTIONS:!0};function T(t){return(t?.apiCalls?.allowedHttpMethods??o).map(e=>e.toUpperCase())}function p(t){return T(t).every(e=>r[e])}export{o as DEFAULT_ALLOWED_HTTP_METHODS,p as allowsOnlySafeHttpMethods,T as getAllowedHttpMethods};

package/dist/server/plugins/mcp/gateway-mcp/api-call-operations.d.ts

@@ -0,0 +1,32 @@
+import type { OpenAPIDefinition, OpenAPIServer } from '@redocly/api-docs';
+export type ApiCallOperation = {
+    pattern: RegExp;
+    /** Upper case. */
+    method: string;
+    /**
+     * False when `x-mcp.apiCalls.hide` or `x-mcp.docs.hide` on the path item or operation, or an
+     * `mcp.apiCalls.excludeOperations` entry, excludes it.
+     */
+    callable: boolean;
+    /**
+     * False when RBAC hides the operation from the caller. The bridge then answers as for an
+     * undocumented path, so the reply does not reveal that the operation exists.
+     */
+    visible: boolean;
+    /** Number of `{variable}` segments in the path; fewer is more specific. */
+    variables: number;
+};
+/** An `mcp.apiCalls.excludeOperations` entry of one API; no `method` excludes every method of `path`. */
+export type ExcludedOperation = {
+    method?: string;
+    path: string;
+};
+/**
+ * Every operation of the unfiltered `description`, with the ones missing from `visibleDescription`,
+ * the caller's RBAC-filtered copy, marked not visible. A hidden or `excluded` operation stays in the
+ * list, so a less specific template cannot claim its requests.
+ */
+export declare function apiCallOperationsOf(description: OpenAPIDefinition, visibleDescription: OpenAPIDefinition, servers: readonly OpenAPIServer[], excluded?: readonly ExcludedOperation[]): ApiCallOperation[];
+/** The documented operations that an upper-case `method` on `pathname` matches. */
+export declare function matchingApiCallOperations(operations: readonly ApiCallOperation[], pathname: string, method: string): ApiCallOperation[];
+//# sourceMappingURL=api-call-operations.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/api-call-operations.js

@@ -0,0 +1 @@
+import{OPERATION_METHODS as P}from"../docs-mcp/tools/openapi/constants.js";import{isEndpointHidden as u}from"../utils/xmcp-utils.js";import{basePathPrefix as T,operationHttpMethod as d,pathPattern as y,pathTemplateKey as C,pathVariableCount as H}from"./route-pattern.js";const M=new Set(P);function m(t){return u(t,"apiCalls")||u(t,"docs")}function w(t,n,i,a=[]){const b=T(i),c=new Set(a.map(({method:e,path:o})=>p(e&&d(e),o))),f=[];for(const[e,o]of Object.entries(t.paths??{})){if(!o||typeof o!="object")continue;const h=y(b,e);if(!h)continue;const O=m(o)||c.has(p(void 0,e)),x=n.paths?.[e],E=H(e);for(const[r,s]of Object.entries(o)){if(!M.has(r.toLowerCase())||!s||typeof s!="object")continue;const l=d(r);f.push({pattern:h,method:l,callable:!O&&!m(s)&&!c.has(p(l,e)),visible:!!x?.[r],variables:E})}}return f}function p(t,n){return`${t??"*"} ${C(n)}`}function I(t,n,i){return t.filter(a=>a.method===i&&a.pattern.test(n))}export{w as apiCallOperationsOf,I as matchingApiCallOperations};

package/dist/server/plugins/mcp/gateway-mcp/callable-apis.d.ts

@@ -1,10 +1,14 @@
 import type { ApiDescriptionInfo, McpToolContext } from '../types.js';
-export declare function getCallableApis(context: McpToolContext): ApiDescriptionInfo[];
+import type { ExcludedOperation } from './api-call-operations.js';
 /**
- * Fetch capability at request/worker time is derived purely from the build-time stamps:
- * `fetchEligible` is stamped per API by the lifecycle plugin under `isGatewayCapabilityEnabled`
- * (entitlement + hide checks), and the map arriving here is already RBAC-filtered.
+ * The APIs an agent may call in this request: the build-stamped `fetchEligible` entries of the
+ * already RBAC-filtered map, minus what `mcp.apiCalls` removes; none outside code mode. The
+ * config is read from the request context, so a `redocly.yaml` edit applies without restarting
+ * the dev server.
  * No EntitlementsProvider read — this code runs in graphs where the provider is uninitialized.
  */
+export declare function getCallableApis(context: McpToolContext): ApiDescriptionInfo[];
+/** The `mcp.apiCalls.excludeOperations` entries whose `file` glob matches the API at `relativePath`. */
+export declare function getExcludedOperations(context: McpToolContext, relativePath: string): ExcludedOperation[];
 export declare function isFetchCapable(context: McpToolContext): boolean;
 //# sourceMappingURL=callable-apis.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/callable-apis.js

@@ -1 +1 @@
-function i(e){return Object.values(e.apiDescriptionsMap??{}).filter(t=>t.fetchEligible)}function l(e){return i(e).length>0}export{i as getCallableApis,l as isFetchCapable};
+import c from"picomatch";function r(e){const i=e.config?.mcp?.apiCalls;if(e.mcpMode!=="code"||i?.hide)return[];const t=c(i?.excludeFiles??[]);return Object.values(e.apiDescriptionsMap??{}).filter(l=>l.fetchEligible&&!t(l.relativePath))}function p(e,i){return(e.config?.mcp?.apiCalls?.excludeOperations??[]).filter(({file:t})=>c.isMatch(i,t))}function n(e){return r(e).length>0}export{r as getCallableApis,p as getExcludedOperations,n as isFetchCapable};

package/dist/server/plugins/mcp/gateway-mcp/caller-api-calls.d.ts

@@ -0,0 +1,9 @@
+import type { RedoclyConfig } from '@redocly/config';
+/**
+ * `mcp` with `apiCalls` narrowed by the caller's `metadata.apiCalls` (`hide`, `allowedHttpMethods`),
+ * which the AI Assistant fills from `aiAssistant.mcp.apiCalls`. The caller can only take API calls
+ * or methods away: a value of another shape changes nothing, and a method list that keeps none of
+ * the project's methods turns API calls off.
+ */
+export declare function narrowMcpConfigForCaller(mcp: RedoclyConfig['mcp'], metadata: Record<string, unknown> | undefined): RedoclyConfig['mcp'];
+//# sourceMappingURL=caller-api-calls.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/caller-api-calls.js

@@ -0,0 +1 @@
+import{DEFAULT_ALLOWED_HTTP_METHODS as d}from"./allowed-http-methods.js";function h(e,a){const o=a?.apiCalls;if(!o||typeof o!="object")return e;const{hide:i,allowedHttpMethods:s}=o,t={...e?.apiCalls};if(i===!0&&(t.hide=!0),Array.isArray(s)){const n=new Set(s.map(r=>String(r).toUpperCase())),l=(e?.apiCalls?.allowedHttpMethods??d).filter(r=>n.has(r));l.length===0?t.hide=!0:t.allowedHttpMethods=l}return{...e,apiCalls:t}}export{h as narrowMcpConfigForCaller};

package/dist/server/plugins/mcp/gateway-mcp/elicitation.d.ts

@@ -8,6 +8,7 @@ export type CredentialTarget = {
     name: string;
     scheme: string;
     schemeLabel?: string;
+    acceptedSchemes?: string[];
 };
 /**
  * Why the prompt is being raised. `authFailure` is the automatic path behind an upstream 401;

package/dist/server/plugins/mcp/gateway-mcp/elicitation.js

@@ -1,5 +1,5 @@
-import{inputRequired as h,inputResponse as y}from"@modelcontextprotocol/server";import{withPathPrefix as I}from"@redocly/theme/core/utils";import{MCP_CREDENTIALS_ROUTE as A}from"../../../constants/mcp.js";import{MANAGE_API_CREDENTIALS_TOOL_NAME as u}from"../constants.js";import{secretStore as l,ELICITATION_TTL_MS as P}from"./secret-store.js";import{operationsForScheme as E,orderedSchemesOf as g}from"./upstream-auth-scheme.js";import{ANONYMOUS_SUBJECT_PREFIX as p}from"./subject.js";const m="credentials",d=new Map;function F(e,t){const r=d.get(e);if(r)return r;const n=t().finally(()=>{d.delete(e)});return d.set(e,n),n}function D(e){return!!e?.elicitation?.url}function H(e){return e.envelope!==void 0}function q(e){const t=y(e,m);if(t.kind==="elicit")return t.action==="accept"?"accepted":"declined"}function B(e,t){return[`The user accepted the prompt to add credentials for the "${e}" API.`,...t?["The credentials page:",t]:[],"",`Wait until the user says they saved the credentials, then retry the call that needed them. Do not call \`${u}\` again unless the user asks for a new link.`].join(`
-`)}async function Y(e,{kv:t,subject:r,baseUrl:n,apis:o}){if(typeof e!="string")return;const i=await l.peekElicitation(t,e);if(!(i?.subject!==r||!o.includes(i.api)))return{apiName:i.name,url:T(n,e)}}function W(e,t){return Object.keys(e).length>1?t:void 0}async function z(e){const{token:t,url:r}=await f(e);return h({inputRequests:{[m]:h.elicitUrl({message:C(e),url:r})},requestState:t})}async function G(e){const{url:t}=await f(e);return _(e,t,S(e.subject))}function J(e,t){const r=b(e);if(e.status===401&&!e.sentScheme){const[i,s]=e.callerHeader?[`Your code set the "${e.callerHeader}" header itself, so the stored credential was not sent.`,"Remove that header from the request and retry. Do not replace the stored credentials."]:["No stored credential was sent with this request, so this result says nothing about the stored credentials.","Do not replace them. Check whether this operation needs a different kind of credential or a different route."];return[`The "${e.name}" API returned ${r}. ${i}`,"",s].join(`
-`)}const n=e.status===401?`The "${e.name}" API rejected the stored ${t?`"${t}" `:""}credential (${r}).`:`The "${e.name}" API rejected the request with ${r}.`,o=t?`api: "${e.api}" and scheme: "${t}"`:`api: "${e.api}"`;return[n,"",`Do not retry the same call. Call \`${u}\` with ${o} to get a link the user has to open in a browser to replace or remove the stored credentials, then retry once they confirm they saved them.`].join(`
-`)}function b({status:e,detail:t}){return t?`HTTP ${e}: ${t}`:`HTTP ${e}`}async function f({kv:e,subject:t,baseUrl:r,target:n,auth:o,apiAuth:i,hasExistingSecret:s}){const a=i?await k(e,t,n.api,i):[],c=await l.createElicitation(e,{subject:t,api:n.api,name:n.name,scheme:n.scheme,...n.schemeLabel?{schemeLabel:n.schemeLabel}:{},auth:o,hasExistingSecret:s,...a.length>1?{schemes:a}:{}});return{token:c,url:T(r,c)}}async function k(e,t,r,n){const i=(await l.getSecretsForSubject(e,t))[r]??{};return g(n.schemes).map(s=>{const a=E(n,s),c=n.descriptions?.[s];return{name:s,...c?{label:c}:{},auth:n.schemes[s],hasExistingSecret:!!i[s],...a.length>0?{operations:a}:{}}})}function S(e){return e.startsWith(p)?e.slice(p.length):void 0}function C({target:e,hasExistingSecret:t,reason:r}){const n=`The link works for ${$()} minutes.`,o=x(e),i=r.kind==="authFailure"&&r.detail?` The API answered: ${r.detail}.`:"";return t?`Open this page in a browser to replace or remove the stored credentials for ${o}. They go straight to the API and never enter the chat. ${n}`:`${O(o)} needs credentials.${i} Open this page in a browser to paste them - they go straight to the API and never enter the chat. ${n}`}function x({name:e,schemeLabel:t}){return t?`the "${t}" scheme of the "${e}" API`:`the "${e}" API`}function O(e){return e.charAt(0).toUpperCase()+e.slice(1)}function $(){return Math.round(P/6e4)}function T(e,t){const r=I(A);if(!e)return`${r}?token=${t}`;try{const n=new URL(r,e);return n.searchParams.set("token",t),n.toString()}catch{return`${e}${r}?token=${t}`}}function _({target:e,reason:t,hasExistingSecret:r},n,o){const s=[`**Stop and show the user this link. They have to open it in a browser to ${r?`replace or remove the stored credentials for the "${e.name}" API`:`add credentials for the "${e.name}" API`} - nothing continues until they do.**`,"",n,"",`The link is valid ${$()} minutes and opens a form on this site. Credentials go straight to the API from there: never ask for them in the conversation and never pass them as a tool argument.`,"",t.kind==="authFailure"?`The upstream API "${e.name}" returned ${t.status}${t.detail?` (${t.detail})`:""} and needs credentials.`:r?`Credentials are already stored for the "${e.name}" API; the link lets the user replace or remove them.`:`The "${e.name}" API needs credentials.`,...e.schemeLabel?[`The operation authenticates with its "${e.schemeLabel}" security scheme.`]:[],o?`Once the user confirms they saved them, call this tool again with sessionHandle: "${o}" - the credentials are stored against that handle, applied server-side, and never appear in the conversation.`:"Once the user confirms they saved them, call this tool again - the credentials are applied server-side and never appear in the conversation."],a=t.kind==="authFailure"?t.otherApiNames??[]:[];if(a.length>0){const c=a.map(w=>`"${w}"`).join(", ");s.push("",`The remaining APIs (${c}) will prompt for credentials on subsequent calls.`)}return s.join(`
-`)}export{m as CREDENTIALS_INPUT_REQUEST_KEY,Y as acceptedCredentialsLink,B as buildCredentialsAcceptedHint,J as buildCredentialsToolHint,G as buildUpstreamCredentialFallback,z as buildUpstreamCredentialInputRequired,q as credentialElicitationAnswer,F as dedupeElicitation,H as isStatelessRequest,W as schemeLabelOf,D as supportsUrlElicitation};
+import{inputRequired as d,inputResponse as I}from"@modelcontextprotocol/server";import{withPathPrefix as w}from"@redocly/theme/core/utils";import{MCP_CREDENTIALS_ROUTE as E}from"../../../constants/mcp.js";import{MANAGE_API_CREDENTIALS_TOOL_NAME as h}from"../constants.js";import{secretStore as l,ELICITATION_TTL_MINUTES as u}from"./secret-store.js";import{operationsForScheme as A,orderedSchemesOf as P}from"./upstream-auth-scheme.js";import{ANONYMOUS_SUBJECT_PREFIX as p}from"./subject.js";const m="credentials",c=new Map;function F(e,t){const n=c.get(e);if(n)return n;const i=t().finally(()=>{c.delete(e)});return c.set(e,i),i}function M(e){return!!e?.elicitation?.url}function D(e){return e.envelope!==void 0}function H(e){const t=I(e,m);if(t.kind==="elicit")return t.action==="accept"?"accepted":"declined"}function q(e,t){return[`The user accepted the prompt to add credentials for the "${e}" API.`,...t?["The credentials page:",t]:[],"",`Wait until the user says they saved the credentials, then retry the call that needed them. Do not call \`${h}\` again unless the user asks for a new link.`].join(`
+`)}async function B(e,{kv:t,subject:n,baseUrl:i,apis:r}){if(typeof e!="string")return;const s=await l.peekElicitation(t,e);if(!(s?.subject!==n||!r.includes(s.api)))return{apiName:s.name,url:$(i,e)}}function W(e,t){return Object.keys(e).length>1?t:void 0}async function Y(e){const{token:t,url:n}=await f(e);return d({inputRequests:{[m]:d.elicitUrl({message:C(e),url:n})},requestState:t})}async function z(e){const{url:t}=await f(e);return x(e,t,S(e.subject))}function G(e,t){const n=b(e);if(e.status===401&&!e.sentScheme)return[`The "${e.name}" API returned ${n}. No stored credential was sent with this request, so this result says nothing about the stored credentials.`,"","Do not replace them. Check whether this operation needs a different kind of credential or a different route."].join(`
+`);const i=e.status===401?`The "${e.name}" API rejected the stored ${t?`"${t}" `:""}credential (${n}).`:`The "${e.name}" API rejected the request with ${n}.`,r=t?`api: "${e.api}" and scheme: "${t}"`:`api: "${e.api}"`;return[i,"",`Do not retry the same call. Call \`${h}\` with ${r} to get a link the user has to open in a browser to replace or remove the stored credentials, then retry once they confirm they saved them.`].join(`
+`)}function b({status:e,detail:t}){return t?`HTTP ${e}: ${t}`:`HTTP ${e}`}async function f({kv:e,subject:t,baseUrl:n,target:i,auth:r,apiAuth:s}){const a=s?k(s):[],o=await l.createElicitation(e,{subject:t,api:i.api,name:i.name,scheme:i.scheme,...i.schemeLabel?{schemeLabel:i.schemeLabel}:{},auth:r,...a.length>1?{schemes:a}:{},...a.length>1&&i.acceptedSchemes?{acceptedSchemes:i.acceptedSchemes}:{}});return{token:o,url:$(n,o)}}function k(e){return P(e.schemes).map(t=>{const n=A(e,t),i=e.descriptions?.[t];return{name:t,...i?{label:i}:{},auth:e.schemes[t],...n.length>0?{operations:n}:{}}})}function S(e){return e.startsWith(p)?e.slice(p.length):void 0}function C({target:e,hasExistingSecret:t,reason:n}){const i=`The link works for ${u} minutes.`,r=O(e),s=n.kind==="authFailure"&&n.detail?` The API answered: ${n.detail}.`:"";return t?`Open this page in a browser to replace or remove the stored credentials for ${r}. They stay out of the chat. ${i}`:`${g(r)} needs credentials.${s} Open this page in a browser to paste them - they stay out of the chat. ${i}`}function O({name:e,schemeLabel:t}){return t?`the "${t}" scheme of the "${e}" API`:`the "${e}" API`}function g(e){return e.charAt(0).toUpperCase()+e.slice(1)}function $(e,t){const n=w(E);if(!e)return`${n}?token=${t}`;try{const i=new URL(n,e);return i.searchParams.set("token",t),i.toString()}catch{return`${e}${n}?token=${t}`}}function x({target:e,reason:t,hasExistingSecret:n},i,r){const a=[`**Stop and show the user this link. They have to open it in a browser to ${n?`replace or remove the stored credentials for the "${e.name}" API`:`add credentials for the "${e.name}" API`} - nothing continues until they do.**`,"",i,"",`The link is valid ${u} minutes and opens a form on this site. The site stores the credentials and adds them to API calls: never ask for them in the conversation and never pass them as a tool argument.`,"",t.kind==="authFailure"?`The upstream API "${e.name}" returned ${t.status}${t.detail?` (${t.detail})`:""} and needs credentials.`:n?`Credentials are already stored for the "${e.name}" API; the link lets the user replace or remove them.`:`The "${e.name}" API needs credentials.`,...e.schemeLabel?[`The operation authenticates with its "${e.schemeLabel}" security scheme.`]:[],r?`Once the user confirms they saved them, retry the call that needed them with sessionHandle: "${r}" - the credentials are stored against that handle, applied server-side, and never appear in the conversation.`:"Once the user confirms they saved them, retry the call that needed them - the credentials are applied server-side and never appear in the conversation."],o=t.kind==="authFailure"?t.otherApiNames??[]:[];if(o.length>0){const T=o.map(y=>`"${y}"`).join(", ");a.push("",`The remaining APIs (${T}) will prompt for credentials on subsequent calls.`)}return a.join(`
+`)}export{m as CREDENTIALS_INPUT_REQUEST_KEY,B as acceptedCredentialsLink,q as buildCredentialsAcceptedHint,G as buildCredentialsToolHint,z as buildUpstreamCredentialFallback,Y as buildUpstreamCredentialInputRequired,H as credentialElicitationAnswer,F as dedupeElicitation,D as isStatelessRequest,W as schemeLabelOf,M as supportsUrlElicitation};

package/dist/server/plugins/mcp/gateway-mcp/eligibility.d.ts

@@ -1,9 +1,13 @@
 import type { OpenAPIDefinition, OpenAPIMcp } from '@redocly/api-docs';
-import type { RbacConfig, RedoclyConfig } from '@redocly/config';
+import type { RedoclyConfig } from '@redocly/config';
 /** Whether the gateway fetch capability is on: the feature flag plus none of mcp/docs hidden. */
 export declare function isGatewayCapabilityEnabled(mcp?: RedoclyConfig['mcp']): boolean;
-/** Whether an API is eligible for the gateway (fetch-capable `execute` + `/mcp` advertisement). */
-export declare function isGatewayEligible(info: OpenAPIDefinition['info'] | undefined, relativePath: string, rbacConfig: RbacConfig): boolean;
+/**
+ * Whether the API description allows agent calls: every documented API does unless its
+ * `info.x-mcp.apiCalls.hide` is set. Who may call it is decided per request by RBAC, and
+ * `mcp.apiCalls` config by `getCallableApis`.
+ */
+export declare function isGatewayEligible(info: OpenAPIDefinition['info'] | undefined): boolean;
 /**
  * Whether an API docs page advertises the `/mcp` endpoint via an injected root-level x-mcp:
  * the capability is on, the author has not provided their own x-mcp servers, and the API is
@@ -13,6 +17,6 @@ export declare function shouldAdvertiseGatewayXMcp(definition: (OpenAPIDefinitio
     'x-mcp'?: {
         servers?: unknown[];
     };
-}) | undefined, relativePath: string, rbacConfig: RbacConfig, mcpConfig?: RedoclyConfig['mcp']): boolean;
+}) | undefined, relativePath: string, mcpConfig?: RedoclyConfig['mcp']): boolean;
 export declare function buildGatewayXMcp(url: string): OpenAPIMcp;
 //# sourceMappingURL=eligibility.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/eligibility.js

@@ -1 +1 @@
-import{join as e}from"node:path";import{PUBLIC_API_DEFINITIONS_FOLDER as s}from"../../../constants/common.js";import{ANONYMOUS_AUTH_DETAILS as n}from"../../../constants/rbac.js";import{canDownloadApiDefinition as a}from"../../../utils/rbac.js";import{MCP_PROTOCOL_VERSION as p}from"../constants.js";import{isApiIncludedInDocsMcp as c}from"../utils.js";import{isMcpGatewayEnabled as l}from"../utils/mode.js";import{isDefinitionHidden as m,hasGatewayConfig as f}from"../utils/xmcp-utils.js";function u(o){return l()&&!o?.hide&&!o?.docs?.hide}function d(o,r,i){return m(o,"gateway")?!1:a(e(s,r),i,!1,n)||f(o)}function _(o,r,i,t){return u(t)&&!o?.["x-mcp"]?.servers?.length&&d(o?.info,r,i)&&c(r,o,t)}function G(o){return{protocolVersion:p,capabilities:{tools:{}},servers:[{url:o}],tools:[],resources:[],prompts:[]}}export{G as buildGatewayXMcp,u as isGatewayCapabilityEnabled,d as isGatewayEligible,_ as shouldAdvertiseGatewayXMcp};
+import{MCP_PROTOCOL_VERSION as t}from"../constants.js";import{isApiIncludedInDocsMcp as i}from"../utils.js";import{isMcpGatewayEnabled as s}from"../utils/mode.js";import{isDefinitionHidden as a}from"../utils/xmcp-utils.js";function p(e){return s()&&!e?.hide&&!e?.docs?.hide}function n(e){return!a(e,"apiCalls")}function m(e,o,r){return p(r)&&!e?.["x-mcp"]?.servers?.length&&n(e?.info)&&i(o,e,r)}function f(e){return{protocolVersion:t,capabilities:{tools:{}},servers:[{url:e}],tools:[],resources:[],prompts:[]}}export{f as buildGatewayXMcp,p as isGatewayCapabilityEnabled,n as isGatewayEligible,m as shouldAdvertiseGatewayXMcp};

package/dist/server/plugins/mcp/gateway-mcp/fetch/fetch-audit.d.ts

@@ -6,6 +6,7 @@ type GatewayFetchAuditRecord = {
     outcome: GatewayFetchOutcome;
     durationMs: number;
     injectedSecretValues: readonly string[];
+    credentialQueryParams?: readonly string[];
     path?: string;
     api?: string;
     status?: number;
@@ -20,6 +21,6 @@ type GatewayFetchAuditRecord = {
  * telemetry event verbatim so a Grafana row joins onto this line; `url_sha256` identifies the
  * request itself, since the telemetry event's `path` is deliberately normalized.
  */
-export declare function logGatewayFetchAudit({ rawUrl, method, host, outcome, durationMs, injectedSecretValues, path, api, status, injectedScheme, requestHeaders, requestBody, responseHeaders, responseBody, }: GatewayFetchAuditRecord): void;
+export declare function logGatewayFetchAudit({ rawUrl, method, host, outcome, durationMs, injectedSecretValues, credentialQueryParams, path, api, status, injectedScheme, requestHeaders, requestBody, responseHeaders, responseBody, }: GatewayFetchAuditRecord): void;
 export {};
 //# sourceMappingURL=fetch-audit.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/fetch/fetch-audit.js

@@ -1 +1 @@
-import{auditHeaderNames as n,auditInput as g,auditOutputDigest as b,auditSha256 as l,auditUrl as y,logAuditRecord as A}from"../../audit/audit-log.js";function R({rawUrl:e,method:u,host:i,outcome:r,durationMs:o,injectedSecretValues:t,path:_,api:h,status:f,injectedScheme:m,requestHeaders:p,requestBody:d,responseHeaders:c,responseBody:s}){const a=s===void 0?void 0:b(s);A("Record gateway fetch",{url_sha256:l(e),host:i,method:u,path:_,api:h,outcome:r,status:f,injected_scheme:m,duration_ms:o,url:y(e,t),request_header_names:n(p),request_body:d===void 0?void 0:g(d,t),response_header_names:n(c),response_sha256:a?.sha256,response_bytes:a?.bytes})}export{R as logGatewayFetchAudit};
+import{auditHeaderNames as n,auditInput as b,auditOutputDigest as l,auditSha256 as y,auditUrl as A,logAuditRecord as D}from"../../audit/audit-log.js";function q({rawUrl:e,method:u,host:i,outcome:r,durationMs:o,injectedSecretValues:t,credentialQueryParams:_,path:h,api:f,status:m,injectedScheme:p,requestHeaders:c,requestBody:d,responseHeaders:g,responseBody:s}){const a=s===void 0?void 0:l(s);D("Record gateway fetch",{url_sha256:y(e),host:i,method:u,path:h,api:f,outcome:r,status:m,injected_scheme:p,duration_ms:o,url:A(e,t,_),request_header_names:n(c),request_body:d===void 0?void 0:b(d,t),response_header_names:n(g),response_sha256:a?.sha256,response_bytes:a?.bytes})}export{q as logGatewayFetchAudit};