@redocly/redoc 0.137.0-next.6 → 0.137.0-next.8

package/dist/server/plugins/mcp/gateway-mcp/callable-apis.d.ts

@@ -0,0 +1,10 @@
+import type { ApiDescriptionInfo, McpToolContext } from '../types.js';
+export declare function getCallableApis(context: McpToolContext): ApiDescriptionInfo[];
+/**
+ * Fetch capability at request/worker time is derived purely from the build-time stamps:
+ * `fetchEligible` is stamped per API by the lifecycle plugin under `isGatewayCapabilityEnabled`
+ * (entitlement + hide checks), and the map arriving here is already RBAC-filtered.
+ * No EntitlementsProvider read — this code runs in graphs where the provider is uninitialized.
+ */
+export declare function isFetchCapable(context: McpToolContext): boolean;
+//# sourceMappingURL=callable-apis.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/callable-apis.js

@@ -0,0 +1 @@
+function i(e){return Object.values(e.apiDescriptionsMap??{}).filter(t=>t.fetchEligible)}function l(e){return i(e).length>0}export{i as getCallableApis,l as isFetchCapable};

package/dist/server/plugins/mcp/gateway-mcp/fetch/fetch-bridge.js

@@ -1 +1 @@
-import{Agent as Y}from"undici";import{envConfig as z}from"../../../../config/env-config.js";import{logger as B}from"../../../../tools/notifiers/logger.js";import{assertUrlAllowed as G}from"./ssrf-guard.js";import{createSsrfSafeLookup as Q}from"./ssrf-safe-lookup.js";import{SsrfBlockedError as N}from"./ssrf-blocklist.js";import{GatewayFetchBlockedError as P,GatewayFetchSystemError as Z,GatewayFetchUserError as _}from"./fetch-errors.js";import{redactHeaders as W,redactSecretsFromString as q}from"./redact.js";import{extractUpstreamDetail as ee}from"./upstream-detail.js";import{normalizeFetchPath as te}from"./normalize-path.js";import{reportGatewayFetch as I}from"./fetch-telemetry.js";import{logGatewayFetchAudit as J}from"./fetch-audit.js";const K="x-forwarded-for",re=3e4,oe=1024*1024,ne=new Set([401,403,407]);let C;function se(){if(!C){const e=z.isDevelopMode;e&&B.warn("Gateway MCP SSRF guard: loopback upstreams are ALLOWED (develop mode only, never in runtime)."),C=new Y({connect:{lookup:Q({allowLoopback:e})}})}return C}function Fe({allowedHosts:e,apis:t=[],authorization:r,onAuthRequired:o,fetchImpl:c=fetch,dispatcher:a=se(),timeoutMs:m=re,maxResponseBytes:u=oe,maxFetchesPerExec:p,clientIp:k}){const h=[...e,...t.flatMap(n=>n.matchers)],D=t.flatMap(n=>Object.values(n.secrets??{})),l=[r,...D.map(n=>n.value)].filter(n=>!!n),R=D.map(n=>n.header);let O=0;return async n=>{const S=n.method??"GET",T=Date.now();let j,g,b,A={},E,F,M;try{if(p!==void 0){const f=Math.max(0,p);if(O+=1,O>f)throw new _(`Outbound fetch budget exceeded (max ${f} fetches per execute); split the work across calls`)}const d=G(n.url,h);j=d.hostname,g=te(d.pathname);const H=t.filter(f=>f.matchers.some(X=>X.test(d.hostname))),s=H.length===1?H[0]:void 0;b=s?.slug;const w=s?he(s,d.pathname,S):void 0,L=s&&w?me(s,w):void 0,x=L?s?.secrets?.[L]:void 0,U=pe({callerHeaders:n.headers,secret:x,authorization:r,clientIp:k,credentialHeaders:s?.credentialHeaders});A=U.headers,E=x&&!U.callerHeader?L:void 0;const $=new AbortController;M=setTimeout(()=>$.abort(),m);const i=await c(d,{method:S,headers:A,body:n.body,redirect:"manual",signal:$.signal,dispatcher:a});F=i.status;let v="";try{v=await fe(i,u)}finally{if(ne.has(i.status)&&s&&o){const f=ee(v,i.headers.get("content-type"),l);o({api:s.slug,name:s.name,status:i.status,...L?{scheme:L}:{},...w?.length?{schemes:[...w]}:{},...E?{sentScheme:E}:{},...U.callerHeader?{callerHeader:U.callerHeader}:{},...f?{detail:f}:{}})}}let y=Se(i.headers);if(ie(i.status)){y=W(y,R);const{location:f}=y;f&&!ue(f,d,h)&&delete y.location}return I({host:d.hostname,method:S,outcome:"success",durationMs:Date.now()-T,path:g,api:b,status:i.status,bytes:Buffer.byteLength(v,"utf8")}),J({rawUrl:d.href,method:S,host:d.hostname,outcome:"success",durationMs:Date.now()-T,injectedSecretValues:l,path:g,api:b,status:i.status,injectedScheme:E,requestHeaders:A,requestBody:n.body,responseHeaders:y,responseBody:v}),{status:i.status,statusText:i.statusText,ok:i.ok,headers:y,bodyText:v}}catch(d){const{outcome:H,userSafe:s}=ce(d),w=j??(s instanceof P?s.host:void 0)??de(n.url)??"invalid-url";throw I({host:w,method:S,outcome:H,durationMs:Date.now()-T,path:g,api:b,status:F}),J({rawUrl:n.url,method:S,host:w,outcome:H,durationMs:Date.now()-T,injectedSecretValues:l,path:g,api:b,status:F,injectedScheme:E,requestHeaders:A,requestBody:n.body}),s||(B.error(`Gateway MCP fetch failed [${S} ${w}]: ${q(le(d),l)} headers=${JSON.stringify(W(A,R))}`),new Z("Upstream fetch failed due to an internal error"))}finally{M!==void 0&&clearTimeout(M)}}}function ae(e){let t=e;for(let r=0;r<5&&t instanceof Error;r++){if(t instanceof _||t instanceof N)return t;t=t.cause}}function ce(e){const t=ae(e);return{outcome:t instanceof P||t instanceof N?"blocked":t?"user_error":"system_error",userSafe:t}}function de(e){try{return new URL(e).hostname||void 0}catch{return}}function ie(e){return e>=300&&e<400}function ue(e,t,r){try{return!!G(new URL(e,t).href,r)}catch{return!1}}function le(e){if(!(e instanceof Error))return String(e);const t=e.cause;return t instanceof Error?`${e.message}: ${t.message}`:e.message}async function fe(e,t){const r=Number(e.headers.get("content-length"));if(Number.isFinite(r)&&r>t)throw V(t,r);if(!e.body)return"";const o=e.body.getReader(),c=new TextDecoder;let a=0,m="";try{for(;;){const{done:u,value:p}=await o.read();if(u)break;if(a+=p.byteLength,a>t)throw V(t,a);m+=c.decode(p,{stream:!0})}return m+c.decode()}finally{await o.cancel().catch(()=>{})}}function V(e,t){return new _(`Response is too large (over ${e} bytes, got ${t}); request less data`)}function he(e,t,r){const o=e.routes?.find(c=>c.method===r&&c.pattern.test(t));return o?o.schemes:we(e)}function me(e,t){const r=t.filter(o=>e.secrets?.[o]);return r.length===0?t[0]:r.reduce((o,c)=>{const a=e.secrets?.[o]?.savedAt??0;return(e.secrets?.[c]?.savedAt??0)>a?c:o})}function we(e){const t=Object.keys(e.secrets??{});if(t.length===0)return e.defaultScheme?[e.defaultScheme]:[];const r=(e.schemePriority??[]).filter(o=>t.includes(o));return[...r,...t.filter(o=>!r.includes(o))]}function pe({callerHeaders:e,secret:t,authorization:r,clientIp:o,credentialHeaders:c}){const a={},m=new Set,u=t??(r?{header:"Authorization",value:r}:void 0),p=u?new Set((c??[]).map(h=>h.toLowerCase()).filter(h=>h!==u.header.toLowerCase())):new Set;for(const[h,D]of Object.entries(e??{})){const l=h.toLowerCase();l==="host"||l==="content-length"||l!==K&&(p.has(l)||(m.add(l),a[h]=D))}if(o&&(a[K]=o),!u)return{headers:a};const k=u.header.toLowerCase();return m.has(k)?{headers:a,callerHeader:k}:(a[u.header]=u.value,{headers:a})}function Se(e){const t={};return e.forEach((r,o)=>{t[o.toLowerCase()]=r}),t}export{Fe as buildFetchBridge,se as getDefaultAgent,fe as readCappedBody};
+import{Agent as Q}from"undici";import{envConfig as Z}from"../../../../config/env-config.js";import{logger as N}from"../../../../tools/notifiers/logger.js";import{assertUrlAllowed as I}from"./ssrf-guard.js";import{createSsrfSafeLookup as q}from"./ssrf-safe-lookup.js";import{SsrfBlockedError as W}from"./ssrf-blocklist.js";import{GatewayFetchBlockedError as R,GatewayFetchSystemError as ee,GatewayFetchUserError as g}from"./fetch-errors.js";import{redactHeaders as J,redactSecretsFromString as te}from"./redact.js";import{extractUpstreamDetail as re}from"./upstream-detail.js";import{normalizeFetchPath as ne}from"./normalize-path.js";import{reportGatewayFetch as K}from"./fetch-telemetry.js";import{logGatewayFetchAudit as V}from"./fetch-audit.js";const X="x-forwarded-for",oe=3e4,se=1024*1024,ae=new Set([401,403,407]);let C;function ce(){if(!C){const e=Z.isDevelopMode;e&&N.warn("Gateway MCP SSRF guard: loopback upstreams are ALLOWED (develop mode only, never in runtime)."),C=new Q({connect:{lookup:q({allowLoopback:e})}})}return C}function _e({allowedHosts:e,apis:t=[],authorization:r,onAuthRequired:n,fetchImpl:c=fetch,dispatcher:a=ce(),timeoutMs:h=oe,maxResponseBytes:l=se,maxFetchesPerExec:w,clientIp:k}){const f=[...e,...t.flatMap(o=>o.matchers)],$=[...new Set(t.map(o=>o.name).filter(Boolean))].join(", "),m=t.flatMap(o=>Object.values(o.secrets??{})),D=[r,...m.map(o=>o.value)].filter(o=>!!o),x=m.map(o=>o.header);let O=0;return async o=>{const y=o.method??"GET",T=Date.now();let B,b,A,E={},H,_,j;try{if(w!==void 0){const u=Math.max(0,w);if(O+=1,O>u)throw new g(`Outbound fetch budget exceeded (max ${u} fetches per execute); split the work across calls`)}const d=le(o.url,f,$);B=d.hostname,b=ne(d.pathname);const v=t.filter(u=>u.matchers.some(z=>z.test(d.hostname))),s=v.length===1?v[0]:void 0;A=s?.slug;const S=pe(o.securityScheme,s),F=S?[S]:s?ye(s,d.pathname,y):void 0,L=s&&F?Se(s,F):void 0,P=L?s?.secrets?.[L]:void 0,M=be({callerHeaders:o.headers,secret:P,authorization:r,clientIp:k,credentialHeaders:s?.credentialHeaders});E=M.headers,H=P&&!M.callerHeader?L:void 0;const G=new AbortController;j=setTimeout(()=>G.abort(),h);const i=await c(d,{method:y,headers:E,body:o.body,redirect:"manual",signal:G.signal,dispatcher:a});_=i.status;let U="";try{U=await we(i,l)}finally{if(ae.has(i.status)&&s&&n){const u=re(U,i.headers.get("content-type"),D);n({api:s.slug,name:s.name,status:i.status,...L?{scheme:L}:{},...F?.length?{schemes:[...F]}:{},...H?{sentScheme:H}:{},...M.callerHeader?{callerHeader:M.callerHeader}:{},...u?{detail:u}:{}})}}let p=Ae(i.headers);if(fe(i.status)){p=J(p,x);const{location:u}=p;u&&!he(u,d,f)&&delete p.location}return K({host:d.hostname,method:y,outcome:"success",durationMs:Date.now()-T,path:b,api:A,status:i.status,bytes:Buffer.byteLength(U,"utf8")}),V({rawUrl:d.href,method:y,host:d.hostname,outcome:"success",durationMs:Date.now()-T,injectedSecretValues:D,path:b,api:A,status:i.status,injectedScheme:H,requestHeaders:E,requestBody:o.body,responseHeaders:p,responseBody:U}),{status:i.status,statusText:i.statusText,ok:i.ok,headers:p,bodyText:U}}catch(d){const{outcome:v,userSafe:s}=ie(d),S=B??(s instanceof R?s.host:void 0)??ue(o.url)??"invalid-url";throw K({host:S,method:y,outcome:v,durationMs:Date.now()-T,path:b,api:A,status:_}),V({rawUrl:o.url,method:y,host:S,outcome:v,durationMs:Date.now()-T,injectedSecretValues:D,path:b,api:A,status:_,injectedScheme:H,requestHeaders:E,requestBody:o.body}),s||(N.error(`Gateway MCP fetch failed [${y} ${S}]: ${te(me(d),D)} headers=${JSON.stringify(J(E,x))}`),new ee("Upstream fetch failed due to an internal error"))}finally{j!==void 0&&clearTimeout(j)}}}function de(e){let t=e;for(let r=0;r<5&&t instanceof Error;r++){if(t instanceof g||t instanceof W)return t;t=t.cause}}function ie(e){const t=de(e);return{outcome:t instanceof R||t instanceof W?"blocked":t?"user_error":"system_error",userSafe:t}}function le(e,t,r){try{return I(e,t)}catch(n){throw n instanceof R&&r?new R(`${n.message}. \`fetch\` reaches only the documented hosts of the callable APIs (${r}); other documented APIs can be read through the tools but not called.`,n.host):n}}function ue(e){try{return new URL(e).hostname||void 0}catch{return}}function fe(e){return e>=300&&e<400}function he(e,t,r){try{return!!I(new URL(e,t).href,r)}catch{return!1}}function me(e){if(!(e instanceof Error))return String(e);const t=e.cause;return t instanceof Error?`${e.message}: ${t.message}`:e.message}async function we(e,t){const r=Number(e.headers.get("content-length"));if(Number.isFinite(r)&&r>t)throw Y(t,r);if(!e.body)return"";const n=e.body.getReader(),c=new TextDecoder;let a=0,h="";try{for(;;){const{done:l,value:w}=await n.read();if(l)break;if(a+=w.byteLength,a>t)throw Y(t,a);h+=c.decode(w,{stream:!0})}return h+c.decode()}finally{await n.cancel().catch(()=>{})}}function Y(e,t){return new g(`Response is too large (over ${e} bytes, got ${t}); request less data`)}function ye(e,t,r){const n=e.routes?.find(c=>c.method===r&&c.pattern.test(t));return n?n.schemes:ge(e)}function Se(e,t){const r=t.filter(n=>e.secrets?.[n]);return r.length===0?t[0]:r.reduce((n,c)=>{const a=e.secrets?.[n]?.savedAt??0;return(e.secrets?.[c]?.savedAt??0)>a?c:n})}function pe(e,t){if(e==null)return;if(typeof e!="string")throw new g("securityScheme must be a security scheme name (a string)");if(!t)throw new g("securityScheme cannot be applied: the URL host does not identify exactly one callable API");const r=t.schemePriority??[];if(r.length>0&&!r.includes(e))throw new g(`Unknown securityScheme "${e}" for ${t.name}; valid values: ${r.join(", ")}`);return e}function ge(e){const t=Object.keys(e.secrets??{});if(t.length===0)return e.defaultScheme?[e.defaultScheme]:[];const r=(e.schemePriority??[]).filter(n=>t.includes(n));return[...r,...t.filter(n=>!r.includes(n))]}function be({callerHeaders:e,secret:t,authorization:r,clientIp:n,credentialHeaders:c}){const a={},h=new Set,l=t??(r?{header:"Authorization",value:r}:void 0),w=l?new Set((c??[]).map(f=>f.toLowerCase()).filter(f=>f!==l.header.toLowerCase())):new Set;for(const[f,$]of Object.entries(e??{})){const m=f.toLowerCase();m==="host"||m==="content-length"||m!==X&&(w.has(m)||(h.add(m),a[f]=$))}if(n&&(a[X]=n),!l)return{headers:a};const k=l.header.toLowerCase();return h.has(k)?{headers:a,callerHeader:k}:(a[l.header]=l.value,{headers:a})}function Ae(e){const t={};return e.forEach((r,n)=>{t[n.toLowerCase()]=r}),t}export{_e as buildFetchBridge,ce as getDefaultAgent,we as readCappedBody};

package/dist/server/plugins/mcp/gateway-mcp/fetch-capability.d.ts

@@ -1,13 +1,5 @@
-import type { ApiDescriptionInfo, McpToolContext } from '../types.js';
+import type { McpToolContext } from '../types.js';
 import type { SandboxFetch } from '../codemode/types.js';
 import type { UpstreamAuthRequiredEvent } from './upstream-auth.js';
-export declare function getCallableApis(context: McpToolContext): ApiDescriptionInfo[];
-/**
- * Fetch capability at request/worker time is derived purely from the build-time stamps:
- * `fetchEligible` is stamped per API by the lifecycle plugin under `isGatewayCapabilityEnabled`
- * (entitlement + hide checks), and the map arriving here is already RBAC-filtered.
- * No EntitlementsProvider read — this code runs in graphs where the provider is uninitialized.
- */
-export declare function isFetchCapable(context: McpToolContext): boolean;
 export declare function buildExecuteHostFetch(context: McpToolContext, onAuthRequired?: (event: UpstreamAuthRequiredEvent) => void): Promise<SandboxFetch>;
 //# sourceMappingURL=fetch-capability.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/fetch-capability.js

@@ -1 +1 @@
-import{buildAllowedHostMatchers as s}from"./fetch/allowed-hosts.js";import{buildFetchBridge as c}from"./fetch/fetch-bridge.js";import{credentialHeadersOf as o,orderedSchemesOf as u,resolveUpstreamApiAuth as h}from"./upstream-auth-scheme.js";function i(e){return Object.values(e.apiDescriptionsMap??{}).filter(a=>a.fetchEligible)}function p(e){return i(e).length>0}async function f(e,a){const l=await Promise.all(i(e).map(async t=>{const r=await h(e,t.relativePath);return{slug:t.relativePath,name:t.name,matchers:s(t.servers??[]),secrets:e.upstreamSecrets?.[t.relativePath],defaultScheme:r.defaultScheme,routes:r.routes,credentialHeaders:o(r.schemes),schemePriority:u(r.schemes)}}));return c({allowedHosts:s([]),apis:l,authorization:e.upstreamAuthorization,onAuthRequired:a,maxFetchesPerExec:e.gatewayFetchBudgetPerExec,clientIp:e.clientIp})}export{f as buildExecuteHostFetch,i as getCallableApis,p as isFetchCapable};
+import{getCallableApis as l}from"./callable-apis.js";import{buildAllowedHostMatchers as a}from"./fetch/allowed-hosts.js";import{buildFetchBridge as m}from"./fetch/fetch-bridge.js";import{credentialHeadersOf as o,orderedSchemesOf as c,resolveUpstreamApiAuth as h}from"./upstream-auth-scheme.js";async function f(e,s){const i=await Promise.all(l(e).map(async r=>{const t=await h(e,r.relativePath);return{slug:r.relativePath,name:r.name,matchers:a(r.servers??[]),secrets:e.upstreamSecrets?.[r.relativePath],defaultScheme:t.defaultScheme,routes:t.routes,credentialHeaders:o(t.schemes),schemePriority:c(t.schemes)}}));return m({allowedHosts:a([]),apis:i,authorization:e.upstreamAuthorization,onAuthRequired:s,maxFetchesPerExec:e.gatewayFetchBudgetPerExec,clientIp:e.clientIp})}export{f as buildExecuteHostFetch};

package/dist/server/plugins/mcp/handlers/docs-mcp-handler.js

@@ -1 +1 @@
-import{logger as E}from"../../../tools/notifiers/logger.js";import{getFeedbackClientIp as F}from"../../../web-server/utils/feedback-ip.js";import{getForwardedOrigin as g}from"../../../web-server/utils/get-request-origin.js";import{GATEWAY_FETCH_LIMIT_DEFAULTS as N}from"../../../../constants/common.js";import{isObject as v}from"../../../../utils/guards/is-object.js";import{getAccessibleSkills as k}from"../../../utils/skills/get-accessible-skills.js";import{getSkillUrl as B}from"../../../utils/skills/get-skill-url.js";import{createDocsMcpServer as L}from"../servers/docs-server.js";import{filterApiDescriptionsByRbac as H,filterGraphqlDescriptionsByRbac as j}from"../utils.js";import{createMethodNotAllowedError as V,withErrorHandling as $}from"./errors.js";import{constructForbiddenResponse as G,constructInvalidTokenResponse as J,constructUnauthorizedResponse as Y,handleMcpAuth as z}from"../auth/auth-handlers.js";import{shouldHandleMcpAuth as K}from"../../../utils/rbac/should-handle-mcp-auth.js";import{canAnonymousAccessMcpFeature as W}from"../../../utils/rbac/can-anonymous-access-mcp-feature.js";import{extractTokenFromAuthHeader as X}from"../utils/jwt.js";import{DEFAULT_DOCS_MCP_SERVER_NAME as Q}from"../constants.js";import{withPathPrefix as Z}from"@redocly/theme/core/utils";import{PUBLIC_MCP_ROUTE as q}from"@redocly/theme/core/constants/mcp";import{canAccessFeature as x}from"../../../utils/rbac.js";import{ANONYMOUS_AUTH_DETAILS as ee}from"../../../constants/rbac.js";import{DEFAULT_ANONYMOUS_VISITOR_TEAM as re,RbacFeatures as oe}from"../../../../constants/common.js";const h="X-Redocly-AI-Metadata";function se(r){if(r)try{const e=JSON.parse(r);if(v(e))return e;E.warn(`Ignoring ${h} header: not a JSON object.`)}catch{E.warn(`Ignoring ${h} header: invalid JSON.`)}}const ne=async(r,e,o)=>{const i=!!e?.config?.access?.requiresLogin,t=e?.config?.access?.rbac||{},A=o?.props?.config?.mcpMode??"tools",T=o?.props?.config?.gatewayFetchBudgetPerExec??N.budgetPerExec,b=o?.props?.config?.searchIgnoredRoutes??[],s=o,S=!!s?.props?.config?.isPublicEndpoint;let d;const M=r.headers.get("Authorization");if(S)e.user={...ee,email:"",idpAccessToken:void 0,idpId:void 0};else if(K(i,t)){const{isAuthenticated:u,isTokenValid:l,currentUser:p,accessToken:f}=await z(r,e);if(!u){const a=g(r),m=e.config.mcp?.docs?.publicEndpoint&&W(t,i)?`${a}${Z(q)}`:void 0;return l===!1?J(a):Y(a,m)}p&&(e.user=p),d=f}else M&&(d=X(M||"")??void 0);const U={isAuthenticated:!!e.user?.isAuthenticated,teams:e.user?.teams||[re],claims:e.user?.claims??{}};if(!x(oe.MCP,U,t,i))return G();let c;return await $(async()=>{const u=o?.props?.config?.elicitationEnabled??!1;if(r.method==="GET")return new Response(JSON.stringify({error:"Method Not Allowed",message:`In order to use this MCP server, you need to register it in your MCP client (VS Code, Cursor, Claude Code, etc.) using this URL: ${r.url}`}),{status:405,headers:{"Content-Type":"application/json"}});if(r.method!=="POST")return V();const l=s?.props?.config?.apiDescriptionsMap||{},p=s?.props?.config?.graphqlDescriptions||[],f=s?.props?.config?.mcpDocsServerName||Q,{config:{mcp:a={}}}=e,m=H(l,e.user,t,i),D=j(p,e.user,t,i),I=e.config.products?Object.values(e.config.products).map(n=>n?.name):[],R=a.docs?.name||f,y=se(r.headers.get(h)),O=s?.props?.tools||[],w=s?.props?.skillsBaseUrl||g(r),C=k(s?.props?.skills||[],e.user,t,i).map(n=>({slug:n.slug,name:n.name,description:n.description,content:n.content,uri:B(w,n.slug)})),_=await r.json(),P={name:R,tools:O,skills:C,context:{...e,accessToken:d,outdir:e.outdir||"",baseUrl:e.baseUrl||g(r),apiDescriptionsMap:m,graphqlDescriptions:D,products:I,metadata:y,mcpMode:A,elicitationEnabled:u,gatewayFetchBudgetPerExec:T,searchIgnoredRoutes:b,clientIp:F(r)}};return c=await L({...P,getKv:e.getKv}),await ie(r,c,_)},async()=>{c&&(await c.cleanup(),c=void 0)},A)};async function ie(r,e,o){return e.transport.handleRequest(r,o!==void 0?{parsedBody:o}:void 0)}var ye=ne;export{ye as default};
+import{logger as u}from"../../../tools/notifiers/logger.js";import{getFeedbackClientIp as N}from"../../../web-server/utils/feedback-ip.js";import{getForwardedOrigin as g,getInternalOrigin as F}from"../../../web-server/utils/get-request-origin.js";import{GATEWAY_FETCH_LIMIT_DEFAULTS as v}from"../../../../constants/common.js";import{isObject as k}from"../../../../utils/guards/is-object.js";import{getAccessibleSkills as B}from"../../../utils/skills/get-accessible-skills.js";import{getSkillUrl as L}from"../../../utils/skills/get-skill-url.js";import{createMcpHandler as H}from"@modelcontextprotocol/server";import{createDocsMcpServer as V}from"../servers/docs-server.js";import{filterApiDescriptionsByRbac as $,filterGraphqlDescriptionsByRbac as j}from"../utils.js";import{McpClientInputError as G,createMethodNotAllowedError as J,withErrorHandling as K}from"./errors.js";import{constructForbiddenResponse as Y,constructInvalidTokenResponse as z,constructUnauthorizedResponse as W,handleMcpAuth as X}from"../auth/auth-handlers.js";import{shouldHandleMcpAuth as Q}from"../../../utils/rbac/should-handle-mcp-auth.js";import{canAnonymousAccessMcpFeature as Z}from"../../../utils/rbac/can-anonymous-access-mcp-feature.js";import{extractTokenFromAuthHeader as q}from"../utils/jwt.js";import{resolveMcpClient as x}from"../utils/mcp-client.js";import{DEFAULT_DOCS_MCP_SERVER_NAME as ee,SSE_KEEPALIVE_INTERVAL_MS as re}from"../constants.js";import{withPathPrefix as oe}from"@redocly/theme/core/utils";import{PUBLIC_MCP_ROUTE as se}from"@redocly/theme/core/constants/mcp";import{canAccessFeature as ne}from"../../../utils/rbac.js";import{ANONYMOUS_AUTH_DETAILS as ie}from"../../../constants/rbac.js";import{DEFAULT_ANONYMOUS_VISITOR_TEAM as te,RbacFeatures as ce}from"../../../../constants/common.js";const h="X-Redocly-AI-Metadata";function ae(r){if(r)try{const e=JSON.parse(r);if(k(e))return e;u.warn(`Ignoring ${h} header: not a JSON object.`)}catch{u.warn(`Ignoring ${h} header: invalid JSON.`)}}const pe=async(r,e,t)=>{const n=!!e?.config?.access?.requiresLogin,i=e?.config?.access?.rbac||{},A=t?.props?.config?.mcpMode??"tools",T=t?.props?.config?.gatewayFetchBudgetPerExec??v.budgetPerExec,S=t?.props?.config?.searchIgnoredRoutes??[],s=t,b=!!s?.props?.config?.isPublicEndpoint;let p;const E=r.headers.get("Authorization");if(b)e.user={...ie,email:"",idpAccessToken:void 0,idpId:void 0};else if(Q(n,i)){const{isAuthenticated:d,isTokenValid:l,currentUser:a,accessToken:m}=await X(r,e);if(!d){const c=g(r),f=e.config.mcp?.docs?.publicEndpoint&&Z(i,n)?`${c}${oe(se)}`:void 0;return l===!1?z(c):W(c,f)}a&&(e.user=a),p=m}else E&&(p=q(E||"")??void 0);const I={isAuthenticated:!!e.user?.isAuthenticated,teams:e.user?.teams||[te],claims:e.user?.claims??{}};return ne(ce.MCP,I,i,n)?await K(async()=>{const d=t?.props?.config?.elicitationEnabled??!1;if(r.method==="GET")return new Response(JSON.stringify({error:"Method Not Allowed",message:`In order to use this MCP server, you need to register it in your MCP client (VS Code, Cursor, Claude Code, etc.) using this URL: ${r.url}`}),{status:405,headers:{"Content-Type":"application/json"}});if(r.method!=="POST")return J();const l=s?.props?.config?.apiDescriptionsMap||{},a=s?.props?.config?.graphqlDescriptions||[],m=s?.props?.config?.mcpDocsServerName||ee,{config:{mcp:c={}}}=e,f=$(l,e.user,i,n),y=j(a,e.user,i,n),U=e.config.products?Object.values(e.config.products).map(o=>o?.name):[],w=c.docs?.name||m,C=ae(r.headers.get(h)),R=s?.props?.tools||[],_=s?.props?.skillsBaseUrl||g(r),D=B(s?.props?.skills||[],e.user,i,n).map(o=>({slug:o.slug,name:o.name,description:o.description,content:o.content,uri:L(_,o.slug)})),M=await de(r),O={name:w,tools:R,skills:D,context:{...e,accessToken:p,outdir:e.outdir||"",baseUrl:e.baseUrl||g(r),internalBaseUrl:F(r),apiDescriptionsMap:f,graphqlDescriptions:y,products:U,metadata:C,mcpMode:A,elicitationEnabled:d,gatewayFetchBudgetPerExec:T,searchIgnoredRoutes:S,clientIp:N(r),...x(r)}},P=await V({...O,getKv:e.getKv});return await H(async()=>P,{keepAliveMs:re,onerror:o=>u.warn(`MCP handler: ${o.message}`)}).fetch(r,M!==void 0?{parsedBody:M}:void 0)},A):Y()};async function de(r){try{return await r.json()}catch(e){throw new G(e instanceof Error?e.message:String(e),{cause:e})}}var Fe=pe;export{Fe as default};

package/dist/server/plugins/mcp/handlers/errors.d.ts

@@ -12,9 +12,14 @@ export declare class McpError extends Error {
     constructor(code: McpErrorCodeTypes, message: string, data?: unknown, requestId?: string | number | null);
     createErrorResponse(): Response;
 }
+export declare class McpClientInputError extends Error {
+    constructor(message: string, options?: {
+        cause?: unknown;
+    });
+}
 export declare function createMethodNotAllowedError(requestId?: string | number | null): Response;
-export declare function createInternalServerError(error: Error | string, requestId?: string | number | null, mode?: McpMode): Response;
+export declare function createInternalServerError(error: Error | string, requestId?: string | number | null): Response;
 export declare function createInvalidRequestError(message?: string, requestId?: string | number | null): Response;
 export declare function createInvalidParamsError(message?: string, requestId?: string | number | null): Response;
-export declare function withErrorHandling<T>(operation: () => Promise<T>, cleanup?: () => Promise<void>, mode?: McpMode): Promise<T | Response>;
+export declare function withErrorHandling<T>(operation: () => Promise<T>, mode?: McpMode): Promise<T | Response>;
 //# sourceMappingURL=errors.d.ts.map

package/dist/server/plugins/mcp/handlers/errors.js

@@ -1 +1 @@
-import{telemetry as c}from"../../../telemetry/index.js";import{McpErrorCodes as s,McpServerType as d}from"../constants.js";import{serverAttributes as i}from"../utils/telemetry-attributes.js";class n extends Error{code;data;requestId;constructor(e,t,o,a){super(t),this.name="McpError",this.code=e,this.data=o,this.requestId=a}createErrorResponse(){const e={jsonrpc:"2.0",error:{code:this.code,message:this.message,...this.data?{data:this.data}:{}},id:this.requestId??null},t=u(this.code);return new Response(JSON.stringify(e),{status:t,headers:{"Content-Type":"application/json"}})}}function u(r){switch(r){case s.InvalidRequest:case s.InvalidParams:return 400;case s.MethodNotFound:return 404;case s.ServerError:return 405;case s.InternalError:default:return 500}}function h(r){return new n(s.ServerError,"Method not allowed",void 0,r).createErrorResponse()}function p(r,e,t="tools"){const o=r instanceof Error?r.message:String(r),a=r instanceof Error?r.stack:void 0;return c.sendMcpErrorMessage([{...i(d.Docs),message:o,stack:a||"",error_class:"server_error",mode:t}]),new n(s.InternalError,"Internal server error mcp",o,e).createErrorResponse()}function v(r="Invalid request",e){return new n(s.InvalidRequest,r,void 0,e).createErrorResponse()}function I(r="Invalid parameters",e){return new n(s.InvalidParams,r,void 0,e).createErrorResponse()}async function g(r,e,t="tools"){try{return await r()}catch(o){return c.sendMcpErrorMessage([{...i(d.Docs),message:o?.message||"",stack:o?.stack||"",error_class:"server_error",mode:t}]),e&&e(),p(o,void 0,t)}}export{n as McpError,p as createInternalServerError,I as createInvalidParamsError,v as createInvalidRequestError,h as createMethodNotAllowedError,g as withErrorHandling};
+import{telemetry as c}from"../../../telemetry/index.js";import{McpErrorCodes as o,McpServerType as i}from"../constants.js";import{serverAttributes as d}from"../utils/telemetry-attributes.js";class s extends Error{code;data;requestId;constructor(e,t,n,a){super(t),this.name="McpError",this.code=e,this.data=n,this.requestId=a}createErrorResponse(){const e={jsonrpc:"2.0",error:{code:this.code,message:this.message,...this.data?{data:this.data}:{}},id:this.requestId??null},t=p(this.code);return new Response(JSON.stringify(e),{status:t,headers:{"Content-Type":"application/json"}})}}class u extends Error{constructor(e,t){super(e,t),this.name="McpClientInputError"}}function p(r){switch(r){case o.InvalidRequest:case o.InvalidParams:return 400;case o.MethodNotFound:return 404;case o.ServerError:return 405;case o.InternalError:default:return 500}}function I(r){return new s(o.ServerError,"Method not allowed",void 0,r).createErrorResponse()}function l(r,e){const t=r instanceof Error?r.message:String(r);return new s(o.InternalError,"Internal server error mcp",t,e).createErrorResponse()}function f(r="Invalid request",e){return new s(o.InvalidRequest,r,void 0,e).createErrorResponse()}function v(r="Invalid parameters",e){return new s(o.InvalidParams,r,void 0,e).createErrorResponse()}async function M(r,e="tools"){try{return await r()}catch(t){return c.sendMcpErrorMessage([{...d(i.Docs),message:t?.message||"",stack:t?.stack||"",error_class:t instanceof u?"client_error":"server_error",mode:e}]),l(t)}}export{u as McpClientInputError,s as McpError,l as createInternalServerError,v as createInvalidParamsError,f as createInvalidRequestError,I as createMethodNotAllowedError,M as withErrorHandling};

package/dist/server/plugins/mcp/index.js

@@ -1 +1 @@
-import{fileURLToPath as N}from"node:url";import{dirname as G,join as D}from"node:path";import{MCP_ROUTE as j,PUBLIC_MCP_ROUTE as M}from"@redocly/theme/core/constants/mcp";import{logger as a}from"../../tools/notifiers/logger.js";import{reporter as U}from"../../tools/notifiers/reporter.js";import{isDefined as F}from"../../../utils/guards/is-defined.js";import{canAnonymousAccessMcpFeature as R}from"../../utils/rbac/can-anonymous-access-mcp-feature.js";import{shouldHandleMcpAuth as v}from"../../utils/rbac/should-handle-mcp-auth.js";import{MCP_CREDENTIALS_HANDLER_ID as T,MCP_CREDENTIALS_ROUTE as $,MCP_DOCS_SERVER_HANDLER_ID as C,MCP_NOT_ALLOWED_TEMPLATE_ID as k}from"../../constants/mcp.js";import{bundledOpenApiDocumentsToMcpOpenApi as x,bundledGraphqlDocumentsToMcpOpenApi as B,buildGraphqlDescriptions as V,collectIgnoredRoutes as J,filterIgnoredApiDescriptions as _,getCleanedUpApiDescriptions as W,isMcpInRedirects as X}from"./utils.js";import{getMcpMode as z,isMcpElicitationEnabled as K}from"./utils/mode.js";import{findGatedToolNames as Q}from"./utils/find-gated-tool-names.js";import{getDefaultToolSchemas as Y}from"./docs-mcp/tool-schemas.js";import{EXECUTE_TOOL_SCHEMA as Z}from"./codemode/tools/execute-schema.js";import{isGatewayCapabilityEnabled as ee,isGatewayEligible as te}from"./gateway-mcp/eligibility.js";import{resolveGatewayFetchLimits as oe}from"./gateway-mcp/rate-limit/limits.js";import{telemetryTraceStep as ie}from"../../../cli/telemetry/helpers/trace-step.js";import{DEFAULT_DOCS_MCP_SERVER_NAME as S}from"./constants.js";const E=G(N(import.meta.url));async function re(){let o=!1;return{id:"mcp",async processContent(e,i){o||await ie("com.redocly.build.plugin.mcp",async n=>{const r=x(await e.loadApiDocuments(i)),d=B(await e.loadApiDocuments(i)),c=await i.getConfig(),{mcp:s,redirects:f}=c;if(n?.setAttribute("config",JSON.stringify(s||{})),!(s?.hide||s?.docs?.hide)&&(X(f)&&await U.panicOnBuildContentError('The reserved route "/mcp" cannot be used in redirect configuration. Please remove any redirects involving "/mcp" from your redocly.yaml config.'),e.createTemplate(k,"@redocly/theme/layouts/McpNotAllowed"),!s?.docs?.hide)){a.info("Configuring MCP servers...");const g=D(E,"./handlers/docs-mcp-handler.js"),l=s?.docs?.ignore||[],p=W(_(r,l)),b=!!c?.access?.requiresLogin,m=c?.access?.rbac||{},u=ee(s),P=new Map;for(const t of p){const I=t.definition.info?.title||"",H=t.definition.info?.version||"";P.set(t.relativePath,{name:I,description:typeof t.definition.info?.description=="string"?t.definition.info.description:"",version:H,servers:t.definition.servers||[],relativePath:t.relativePath,...u&&te(t.definition.info,t.relativePath,m)?{fetchEligible:!0}:{}})}const h=V(_(d,l)),O=Object.values(c.products||{}).map(t=>t?.name).filter(F),L=c.l10n?.locales?.map(t=>t.code)??i.fs.localeFolders,y=z(),A=K(),{budgetPerExec:q}=oe(),w=Y({products:O,locales:L,requiresLogin:b,rbac:m,hasGraphqlApis:h.length>0,elicitationEnabled:A});e.addMcpTools(D(E,"./docs-mcp/tools/index.js"),w),y==="code"&&e.addMcpTools(D(E,"./codemode/tools/execute.js"),[Z]),await se({actions:e,handlerPath:g,apiDescriptionsMap:Object.fromEntries(P),graphqlDescriptions:h,mcpConfig:s,mcpMode:y,elicitationEnabled:A,gatewayFetchBudgetPerExec:q,requiresLogin:b,rbacConfig:m}),o=!0}})},async afterRoutesCreated(e,i){const n=await i.getConfig(),{mcp:r}=n,d=!r?.hide&&!r?.docs?.hide;e.markGatedMcpTools(await Q(e.getMcpTools())),e.setGlobalData({mcpData:{docs:{enabled:d,name:r?.docs?.name||S,publicEndpoint:d&&ne(r,n)}}})}}}var Re=re;function ne(o,e){const i=!!e.access?.requiresLogin,n=e.access?.rbac||{};return!!o?.docs?.publicEndpoint&&v(i,n)&&R(n,i)}async function se({actions:o,handlerPath:e,apiDescriptionsMap:i,graphqlDescriptions:n,mcpConfig:r,mcpMode:d,elicitationEnabled:c,gatewayFetchBudgetPerExec:s,requiresLogin:f,rbacConfig:g}){o.createRequestHandler(C,e);const l=p=>async(b,m)=>{const u=J(m.getAllRoutes(),r?.docs?.ignore||[]);return u.length>0&&a.verbose(`mcp.docs.ignore: hiding ${u.length} page routes from MCP search`),{props:{config:{apiDescriptionsMap:i,graphqlDescriptions:n,mcpDocsServerName:r?.docs?.name||S,mcpMode:d,elicitationEnabled:c,gatewayFetchBudgetPerExec:s,searchIgnoredRoutes:u,...p?{isPublicEndpoint:p}:{}},serverOutDir:o.serverOutDir,tools:o.getMcpTools().map(({importPath:P,...h})=>h)}}};if(o.addApiRoute({slug:j,requestHandlerId:C,httpMethod:"all",getStaticData:l(!1)}),a.info("Registered Docs MCP Server endpoint at /mcp"),r?.docs?.publicEndpoint&&(v(f,g)?R(g,f)?(o.addApiRoute({slug:M,requestHandlerId:C,httpMethod:"all",getStaticData:l(!0)}),a.info(`Registered public Docs MCP Server endpoint at ${M}`)):a.info(`mcp.docs.publicEndpoint is enabled, but anonymous users are denied the MCP feature (rbac.features.mcp or requiresLogin) - skipping ${M}.`):a.info(`mcp.docs.publicEndpoint is enabled, but the project has no protected content - /mcp already serves anonymous users, skipping ${M}.`)),c){const p=D(E,"./handlers/mcp-credentials-handler.js");o.createRequestHandler(T,p),o.addApiRoute({slug:$,requestHandlerId:T,httpMethod:"all",getStaticData:async()=>({props:{}})}),a.info("Registered MCP credentials endpoint at /mcp/credentials")}}export{Re as default,re as mcpServerPlugin};
+import{fileURLToPath as F}from"node:url";import{dirname as $,join as M}from"node:path";import{MCP_ROUTE as k,PUBLIC_MCP_ROUTE as D}from"@redocly/theme/core/constants/mcp";import{logger as c}from"../../tools/notifiers/logger.js";import{reporter as B}from"../../tools/notifiers/reporter.js";import{isDefined as x}from"../../../utils/guards/is-defined.js";import{canAnonymousAccessMcpFeature as P}from"../../utils/rbac/can-anonymous-access-mcp-feature.js";import{shouldHandleMcpAuth as R}from"../../utils/rbac/should-handle-mcp-auth.js";import{MCP_CREDENTIALS_HANDLER_ID as _,MCP_CREDENTIALS_ROUTE as V,MCP_DOCS_SERVER_HANDLER_ID as T,MCP_NOT_ALLOWED_TEMPLATE_ID as J}from"../../constants/mcp.js";import{bundledOpenApiDocumentsToMcpOpenApi as W,bundledGraphqlDocumentsToMcpOpenApi as X,buildGraphqlDescriptions as z,collectIgnoredRoutes as K,filterIgnoredApiDescriptions as S,getCleanedUpApiDescriptions as Q,isMcpInRedirects as Y}from"./utils.js";import{getMcpMode as O,isMcpElicitationEnabled as Z,isMcpGatewayEnabled as ee}from"./utils/mode.js";import{findGatedToolNames as te}from"./utils/find-gated-tool-names.js";import{getDefaultToolSchemas as oe}from"./docs-mcp/tool-schemas.js";import{EXECUTE_TOOL_SCHEMA as ie}from"./codemode/tools/execute-schema.js";import{isGatewayCapabilityEnabled as re,isGatewayEligible as se}from"./gateway-mcp/eligibility.js";import{resolveGatewayFetchLimits as ne}from"./gateway-mcp/rate-limit/limits.js";import{resetCustomMcpTools as ae,scanCustomMcpTools as ce}from"./custom-tools/scan-custom-tools.js";import{telemetryTraceStep as pe}from"../../../cli/telemetry/helpers/trace-step.js";import{DEFAULT_DOCS_MCP_SERVER_NAME as w}from"./constants.js";const b=$(F(import.meta.url));async function le(){let o;const p={registeredToolNames:[]};let l=0,d=!1;return{id:"mcp",async processContent(e,n){await pe("com.redocly.build.plugin.mcp",async s=>{const i=await n.getConfig(),{mcp:r,redirects:g}=i;if(s?.setAttribute("config",JSON.stringify(r||{})),s?.setAttribute("mcpMode",O()),s?.setAttribute("mcpGateway",String(ee())),r?.hide||r?.docs?.hide){ae(e,p);return}Y(g)&&await B.panicOnBuildContentError('The reserved route "/mcp" cannot be used in redirect configuration. Please remove any redirects involving "/mcp" from your redocly.yaml config.'),e.createTemplate(J,"@redocly/theme/layouts/McpNotAllowed");const u=!!i?.access?.requiresLogin,a=i?.access?.rbac||{},E=O(),h=Z(),{budgetPerExec:f}=ne();if(!o){c.info("Configuring MCP servers...");const C=W(await e.loadApiDocuments(n)),L=X(await e.loadApiDocuments(n)),v=r?.docs?.ignore||[],q=Q(S(C,v)),I=re(r),A=new Map;for(const t of q){const j=t.definition.info?.title||"",U=t.definition.info?.version||"";A.set(t.relativePath,{name:j,description:typeof t.definition.info?.description=="string"?t.definition.info.description:"",version:U,servers:t.definition.servers||[],relativePath:t.relativePath,...I&&se(t.definition.info,t.relativePath,a)?{fetchEligible:!0}:{}})}const y=z(S(L,v)),G=Object.values(i.products||{}).map(t=>t?.name).filter(x),N=i.l10n?.locales?.map(t=>t.code)??n.fs.localeFolders,H=oe({products:G,locales:N,requiresLogin:u,rbac:a,hasGraphqlApis:y.length>0,elicitationEnabled:h,hasCallableApis:A.values().some(t=>t.fetchEligible)});e.addMcpTools(M(b,"./docs-mcp/tools/index.js"),H),E==="code"&&e.addMcpTools(M(b,"./codemode/tools/execute.js"),[ie]),o={apiDescriptionsMap:Object.fromEntries(A),graphqlDescriptions:y}}const m=await ce(e,n,p);s?.setAttribute("customToolsCount",String(m)),m!==l&&(l=m,m>0&&c.info(`Registered ${m} custom MCP tool${m===1?"":"s"} from @mcp folders`)),await me({actions:e,handlerPath:M(b,"./handlers/docs-mcp-handler.js"),apiDescriptionsMap:o.apiDescriptionsMap,graphqlDescriptions:o.graphqlDescriptions,mcpConfig:r,mcpMode:E,elicitationEnabled:h,gatewayFetchBudgetPerExec:f,requiresLogin:u,rbacConfig:a}),d||(c.info("Registered Docs MCP Server endpoint at /mcp"),d=!0)})},async afterRoutesCreated(e,n){const s=await n.getConfig(),{mcp:i}=s,r=!i?.hide&&!i?.docs?.hide;e.markGatedMcpTools(await te(e.getMcpTools())),e.setGlobalData({mcpData:{docs:{enabled:r,name:i?.docs?.name||w,publicEndpoint:r&&de(i,s)}}})}}}var Le=le;function de(o,p){const l=!!p.access?.requiresLogin,d=p.access?.rbac||{};return!!o?.docs?.publicEndpoint&&R(l,d)&&P(d,l)}async function me({actions:o,handlerPath:p,apiDescriptionsMap:l,graphqlDescriptions:d,mcpConfig:e,mcpMode:n,elicitationEnabled:s,gatewayFetchBudgetPerExec:i,requiresLogin:r,rbacConfig:g}){o.createRequestHandler(T,p);const u=a=>async(E,h)=>{const f=K(h.getAllRoutes(),e?.docs?.ignore||[]);return f.length>0&&c.verbose(`mcp.docs.ignore: hiding ${f.length} page routes from MCP search`),{props:{config:{apiDescriptionsMap:l,graphqlDescriptions:d,mcpDocsServerName:e?.docs?.name||w,mcpMode:n,elicitationEnabled:s,gatewayFetchBudgetPerExec:i,searchIgnoredRoutes:f,...a?{isPublicEndpoint:a}:{}},serverOutDir:o.serverOutDir,tools:o.getMcpTools().map(({importPath:m,...C})=>C)}}};if(o.addApiRoute({slug:k,requestHandlerId:T,httpMethod:"all",getStaticData:u(!1)}),e?.docs?.publicEndpoint&&(R(r,g)?P(g,r)?(o.addApiRoute({slug:D,requestHandlerId:T,httpMethod:"all",getStaticData:u(!0)}),c.verbose(`Registered public Docs MCP Server endpoint at ${D}`)):c.info(`mcp.docs.publicEndpoint is enabled, but anonymous users are denied the MCP feature (rbac.features.mcp or requiresLogin) - skipping ${D}.`):c.info(`mcp.docs.publicEndpoint is enabled, but the project has no protected content - /mcp already serves anonymous users, skipping ${D}.`)),s){const a=M(b,"./handlers/mcp-credentials-handler.js");o.createRequestHandler(_,a),o.addApiRoute({slug:V,requestHandlerId:_,httpMethod:"all",getStaticData:async()=>({props:{}})}),c.verbose("Registered MCP credentials endpoint at /mcp/credentials")}}export{Le as default,le as mcpServerPlugin};

package/dist/server/plugins/mcp/servers/docs-server.d.ts

@@ -1,12 +1,12 @@
+import type { McpServer } from '@modelcontextprotocol/server';
 import type { McpToolSchema } from '../../../types';
 import type { McpToolContext, SkillMcpResource } from '../types.js';
 import type { KvService } from '@redocly/config';
-import { type McpServerInstance } from './mcp-server.js';
 export declare function createDocsMcpServer({ name, tools, context, skills, getKv, }: {
     name: string;
     tools: McpToolSchema[];
     context: McpToolContext;
     skills?: SkillMcpResource[];
     getKv: () => Promise<KvService>;
-}): Promise<McpServerInstance>;
+}): Promise<McpServer>;
 //# sourceMappingURL=docs-server.d.ts.map

package/dist/server/plugins/mcp/servers/docs-server.js

@@ -1 +1 @@
-import{logger as S}from"../../../tools/notifiers/logger.js";import{mcpToolWorkers as v,MCP_TOOL_IS_AVAILABLE_KEY as k}from"../../../workers/mcp-tool-worker-pool.js";import{CREATE_ANONYMOUS_SESSION_TOOL_NAME as L}from"../constants.js";import{isAnonymousSessionToolAvailable as C}from"../docs-mcp/tools/core/create-anonymous-session.js";import{isManageApiCredentialsToolAvailable as y,manageApiCredentials as D,manageApiCredentialsSchema as N}from"../codemode/tools/manage-credentials.js";import{EXECUTE_TOOL_SCHEMA as A}from"../codemode/tools/execute-schema.js";import{EXECUTE_TOOL_NAME as w,CODE_MODE_TOOL_NAMES as H,FETCH_TOOL_NAME as x}from"../codemode/constants.js";import{buildCodeModeInstructions as I,buildExecuteDescription as U}from"../codemode/prompts.js";import{toToolListEntries as F}from"../codemode/build-tool-list.js";import{composeExecuteAnnotations as P,getActiveCapabilities as R}from"../codemode/capabilities/index.js";import{describeToolsSchema as z,describeTools as W}from"../codemode/tools/describe-tools.js";import{toRegisterToolConfig as _}from"../utils/tool-registration.js";import{connectMcpServer as X,createMcpServer as Y,createToolDispatch as $,extractSerializableContext as B}from"./mcp-server.js";function g(c,r){const o=r.schema;if(C(c))return o;const{sessionHandle:f,...l}=o.properties;return{...o,properties:l}}async function se({name:c,tools:r,context:o,skills:f=[],getKv:l}){const s=o.mcpMode==="code",a=s?R(o):[],T=a.some(e=>e.id===x),m=s?r.filter(e=>!H.has(e.name)):[],E=F(m,a),O=s&&y(o),{server:n,transport:h}=Y(c,s?I(T,E):void 0),p=B(o),b={getClientCapabilities:()=>n.server.getClientCapabilities(),getKv:l},d=$(p,b),u=async e=>{try{return await v.exec(k,[{toolName:e,context:p}],{timeout:1e4})}catch(i){return S.error(`Failed to check MCP tool availability for "${e}": ${i instanceof Error?i.message:String(i)}`),!1}};if(s){const e=[{tool:{...A,description:U(T,E),schema:g(o,A),annotations:P(a)},callback:d(w)},{tool:z(m,a),callback:W(m,u,a,o)}],i=r.find(t=>t.name===L);if(i&&C(o)&&e.push({tool:i,callback:d(i.name)}),O){const t=N(o);e.push({tool:{...t,schema:g(o,t)},callback:D(p,b)})}for(const{tool:t,callback:M}of e)n.registerTool(t.name,_(t),M)}else await Promise.all(r.map(async e=>{const i=n.registerTool(e.name,_(e),d(e.name));await u(e.name)||i.disable()}));for(const e of f)n.registerResource(e.slug,e.uri,{title:e.name,description:e.description,mimeType:"text/markdown"},async()=>({contents:[{uri:e.uri,mimeType:"text/markdown",text:e.content}]}));return X(n,h)}export{se as createDocsMcpServer};
+import{logger as S}from"../../../tools/notifiers/logger.js";import{mcpToolWorkers as M,MCP_TOOL_IS_AVAILABLE_KEY as v}from"../../../workers/mcp-tool-worker-pool.js";import{CREATE_ANONYMOUS_SESSION_TOOL_NAME as k}from"../constants.js";import{isAnonymousSessionToolAvailable as C}from"../docs-mcp/tools/core/create-anonymous-session.js";import{isManageApiCredentialsToolAvailable as L,manageApiCredentials as y,manageApiCredentialsSchema as D}from"../codemode/tools/manage-credentials.js";import{EXECUTE_TOOL_SCHEMA as A}from"../codemode/tools/execute-schema.js";import{EXECUTE_TOOL_NAME as w,CODE_MODE_TOOL_NAMES as N,FETCH_TOOL_NAME as x}from"../codemode/constants.js";import{buildCodeModeInstructions as H,buildExecuteDescription as I}from"../codemode/prompts.js";import{toToolListEntries as U}from"../codemode/build-tool-list.js";import{composeExecuteAnnotations as F,getActiveCapabilities as P}from"../codemode/capabilities/index.js";import{describeToolsSchema as R,describeTools as z}from"../codemode/tools/describe-tools.js";import{availableSandboxTools as W}from"../utils/available-sandbox-tools.js";import{toRegisterToolConfig as _}from"../utils/tool-registration.js";import{createMcpServer as X,createToolDispatch as Y,extractSerializableContext as $}from"./mcp-server.js";function g(c,r){const o=r.schema;if(C(c))return o;const{sessionHandle:f,...m}=o.properties;return{...o,properties:m}}async function ae({name:c,tools:r,context:o,skills:f=[],getKv:m}){const l=$(o),a=o.mcpMode==="code",s=a?P(o):[],T=s.some(e=>e.id===x),p=a?await W(r.filter(e=>!N.has(e.name)),l):[],b=U(p,s),O=a&&L(o),n=X(c,a?H(T,b):void 0),E={getClientCapabilities:()=>n.server.getClientCapabilities(),getKv:m},d=Y(l,E),u=async e=>{try{return await M.exec(v,[{toolName:e,context:l}],{timeout:1e4})}catch(i){return S.error(`Failed to check MCP tool availability for "${e}": ${i instanceof Error?i.message:String(i)}`),!1}};if(a){const e=[{tool:{...A,description:I(T,b),schema:g(o,A),annotations:F(s)},callback:d(w)},{tool:R(p,s),callback:z(p,u,s,o)}],i=r.find(t=>t.name===k);if(i&&C(o)&&e.push({tool:i,callback:d(i.name)}),O){const t=D(o);e.push({tool:{...t,schema:g(o,t)},callback:y(l,E)})}for(const{tool:t,callback:h}of e)n.registerTool(t.name,_(t),h)}else await Promise.all(r.map(async e=>{const i=n.registerTool(e.name,_(e),d(e.name));await u(e.name)||i.disable()}));for(const e of f)n.registerResource(e.slug,e.uri,{title:e.name,description:e.description,mimeType:"text/markdown"},async()=>({contents:[{uri:e.uri,mimeType:"text/markdown",text:e.content}]}));return n}export{ae as createDocsMcpServer};

package/dist/server/plugins/mcp/servers/mcp-server.d.ts

@@ -1,16 +1,7 @@
-import { McpServer, WebStandardStreamableHTTPServerTransport } from '@modelcontextprotocol/server';
+import { McpServer } from '@modelcontextprotocol/server';
 import type { McpToolCallback, McpToolContext } from '../types.js';
 import type { KvService } from '@redocly/config';
-export type McpServerInstance = {
-    server: McpServer;
-    transport: WebStandardStreamableHTTPServerTransport;
-    cleanup: () => Promise<void>;
-};
-export declare function createMcpServer(name: string, instructions?: string): {
-    server: McpServer;
-    transport: WebStandardStreamableHTTPServerTransport;
-};
-export declare function connectMcpServer(server: McpServer, transport: WebStandardStreamableHTTPServerTransport): Promise<McpServerInstance>;
+export declare function createMcpServer(name: string, instructions?: string): McpServer;
 export type ToolDispatchDeps = {
     getClientCapabilities: () => {
         elicitation?: {

package/dist/server/plugins/mcp/servers/mcp-server.js

@@ -1,5 +1,5 @@
-import{McpServer as L,WebStandardStreamableHTTPServerTransport as j}from"@modelcontextprotocol/server";import{logger as S}from"../../../tools/notifiers/logger.js";import{mcpToolWorkers as D,MCP_TOOL_WORKER_KEY as K}from"../../../workers/mcp-tool-worker-pool.js";import{SSE_KEEPALIVE_INTERVAL_MS as x}from"../constants.js";import{secretStore as F}from"../gateway-mcp/secret-store.js";import{readAuthRequiredMeta as H,stripAuthRequiredMeta as M,upstreamAuthKey as b}from"../gateway-mcp/upstream-auth.js";import{buildCredentialsToolHint as P,buildSchemeChoiceHint as v,buildUpstreamCredentialFallback as T,buildUpstreamCredentialInputRequired as $,isCredentialElicitationDeclined as N,schemeLabelOf as B}from"../gateway-mcp/elicitation.js";import{DEFAULT_SCHEME_NAME as q,resolveUpstreamApiAuth as G,schemeChoicesOf as W}from"../gateway-mcp/upstream-auth-scheme.js";import{MISSING_SESSION_HANDLE_MESSAGE as V,resolveSecretSubject as Y}from"../gateway-mcp/subject.js";const J=6e4,E=new Map;function Q(e,t){const n=E.get(e);if(n)return n;const r=t().finally(()=>{E.delete(e)});return E.set(e,r),r}function fe(e,t){const n=new L({name:e,version:new Date().toISOString().slice(0,10)},{capabilities:{logging:{}},...t?{instructions:t}:{}}),r=new j({keepAliveMs:x,sessionIdGenerator:void 0});return{server:n,transport:r}}async function he(e,t){return await e.connect(t),{server:e,transport:t,cleanup:async()=>{t.close()}}}function ge(e,t){return n=>async(r,s)=>{S.info(`MCP tool called: ${n}`);const i=e.elicitationEnabled??!1,c=s.mcpReq.envelope!==void 0,o=i?Y(e.user,r.sessionHandle):{kind:"anonymous"},a=o.kind==="resolved"?o.subject:void 0;if(o.kind==="invalid")return{content:[{type:"text",text:o.message}],isError:!0};const p=async()=>{if(!(!i||!a||!t?.getKv))try{const m=await t.getKv();return await F.getSecretsForSubject(m,a)}catch(m){S.warn(`gateway mcp secret store error, continuing unauthenticated: ${String(m)}`);return}};let u;const l=async()=>{u=await p();const m={toolName:n,args:r,context:{...e,upstreamSecrets:u},extra:ie(s)};return await D.exec(K,[m],{timeout:J})};let d=await l();const f=H(d);if(f.length>0&&i&&!a)return M({...d,content:[{type:"text",text:V}],isError:!0});if(f.length>0&&i&&a&&t?.getKv){S.info(`gateway mcp credentials prompt: era=${c?"2026-07-28":"2025"} clientElicitation=${Z(t)}`);const m=await t.getKv(),h=await z(e,f),k=f.map(U=>ee(U,h)),y=te(u),g=c?await ne(e,s,k,a,m,y,h,t):await re(e,k,a,m,y,h);switch(g.kind){case"inputRequired":return g.result;case"retry":d=await l();break;case"prependText":d={...d,content:[{type:"text",text:g.text},...d.content],isError:!0};break;case"none":break}}return M(d)}}function X(e){return!!e?.getClientCapabilities()?.elicitation?.url}function Z(e){const t=e?.getClientCapabilities()?.elicitation;if(!t)return"none";const n=[t.form?"form":void 0,t.url?"url":void 0].filter(Boolean);return n.length>0?n.join("+"):"none"}async function z(e,t){const n=new Map;for(const r of new Set(t.map(s=>s.api)))n.set(r,await G(e,r));return n}function ee(e,t){const n=t.get(e.api);if(!n)return{...e,scheme:e.scheme??q};const r=e.scheme&&n.schemes[e.scheme]?e.scheme:n.defaultScheme;return{...e,scheme:r}}function te(e){const t=new Set;for(const[n,r]of Object.entries(e??{}))for(const s of Object.keys(r))t.add(b({api:n,scheme:s}));return t}function A(e,t){return e.status===401&&!t.has(b(e))}function I(e,t){const n=t.get(e.api),r=e.sentScheme??e.scheme;return n&&r?B(n.schemes,r):void 0}function R(e,t){const n=t.get(e.api);return!n||!e.schemes?.length?[]:W(n,e.schemes)}function _(e,t){return R(e,t).length>1}function w(e,t){return e.map(n=>P(n,I(n,t))).join(`
+import{McpServer as j}from"@modelcontextprotocol/server";import{logger as b}from"../../../tools/notifiers/logger.js";import{mcpToolWorkers as D,MCP_TOOL_WORKER_KEY as F}from"../../../workers/mcp-tool-worker-pool.js";import{secretStore as K}from"../gateway-mcp/secret-store.js";import{readAuthRequiredMeta as L,stripAuthRequiredMeta as M,upstreamAuthKey as S}from"../gateway-mcp/upstream-auth.js";import{buildCredentialsToolHint as H,buildSchemeChoiceHint as B,buildUpstreamCredentialFallback as q,buildUpstreamCredentialInputRequired as P,isCredentialElicitationDeclined as $,schemeLabelOf as x}from"../gateway-mcp/elicitation.js";import{DEFAULT_SCHEME_NAME as T,resolveUpstreamApiAuth as N,schemeChoicesOf as v}from"../gateway-mcp/upstream-auth-scheme.js";import{MISSING_SESSION_HANDLE_MESSAGE as G,resolveSecretSubject as V}from"../gateway-mcp/subject.js";const W=6e4,E=new Map;function Y(e,t){const r=E.get(e);if(r)return r;const n=t().finally(()=>{E.delete(e)});return E.set(e,n),n}function pe(e,t){return new j({name:e,version:new Date().toISOString().slice(0,10)},{capabilities:{logging:{}},...t?{instructions:t}:{}})}function de(e,t){return r=>async(n,s)=>{b.info(`MCP tool called: ${r}`);const i=e.elicitationEnabled??!1,c=s.mcpReq.envelope!==void 0,a=i?V(e.user,n.sessionHandle):{kind:"anonymous"},o=a.kind==="resolved"?a.subject:void 0;if(a.kind==="invalid")return{content:[{type:"text",text:a.message}],isError:!0};const p=async()=>{if(!(!i||!o||!t?.getKv))try{const m=await t.getKv();return await K.getSecretsForSubject(m,o)}catch(m){b.warn(`gateway mcp secret store error, continuing unauthenticated: ${String(m)}`);return}};let u;const l=async()=>{u=await p();const m={toolName:r,args:n,context:{...e,upstreamSecrets:u},extra:re(s)};return await D.exec(F,[m],{timeout:W})};let d=await l();const f=L(d);if(f.length>0&&i&&!o)return M({...d,content:[{type:"text",text:G}],isError:!0});if(f.length>0&&i&&o&&t?.getKv){b.info(`gateway mcp credentials prompt: era=${c?"2026-07-28":"2025"} clientElicitation=${Q(t)}`);const m=await t.getKv(),h=await X(e,f),k=f.map(_=>Z(_,h)),y=z(u),g=c?await ee(e,s,k,o,m,y,h,t):await te(e,k,o,m,y,h);switch(g.kind){case"inputRequired":return g.result;case"retry":d=await l();break;case"prependText":d={...d,content:[{type:"text",text:g.text},...d.content],isError:!0};break;case"none":break}}return M(d)}}function J(e){return!!e?.getClientCapabilities()?.elicitation?.url}function Q(e){const t=e?.getClientCapabilities()?.elicitation;if(!t)return"none";const r=[t.form?"form":void 0,t.url?"url":void 0].filter(Boolean);return r.length>0?r.join("+"):"none"}async function X(e,t){const r=new Map;for(const n of new Set(t.map(s=>s.api)))r.set(n,await N(e,n));return r}function Z(e,t){const r=t.get(e.api);if(!r)return{...e,scheme:e.scheme??T};const n=e.scheme&&r.schemes[e.scheme]?e.scheme:r.defaultScheme;return{...e,scheme:n}}function z(e){const t=new Set;for(const[r,n]of Object.entries(e??{}))for(const s of Object.keys(n))t.add(S({api:r,scheme:s}));return t}function R(e,t){return e.status===401&&!t.has(S(e))}function A(e,t){const r=t.get(e.api),n=e.sentScheme??e.scheme;return r&&n?x(r.schemes,n):void 0}function I(e,t){const r=t.get(e.api);return!r||!e.schemes?.length?[]:v(r,e.schemes)}function C(e,t){return I(e,t).length>1}function w(e,t){return e.map(r=>H(r,A(r,t))).join(`
 
-`)}function C(e,t,n){const r=e.map(s=>v(s,R(s,n)));return t.length>0&&r.push(w(t,n)),r.join(`
+`)}function U(e,t,r){const n=e.map(s=>B(s,I(s,r)));return t.length>0&&n.push(w(t,r)),n.join(`
 
-`)}function O(e,t,n,r,s){const[i,...c]=t,o=s.get(i.api),a=i.scheme??o?.defaultScheme??q,p=I(i,s);return{subject:n,baseUrl:e.baseUrl??"",target:{api:i.api,name:i.name,scheme:a,...p?{schemeLabel:p}:{}},auth:o?.schemes[a]??{kind:"raw"},...o?{apiAuth:o}:{},kv:r,hasExistingSecret:!1,reason:{kind:"authFailure",status:i.status,...i.detail?{detail:i.detail}:{},otherApiNames:c.map(u=>u.name)}}}async function ne(e,t,n,r,s,i,c,o){if(N(t.mcpReq.inputResponses))return{kind:"none"};const a=n.filter(l=>A(l,i));if(a.length===0)return{kind:"prependText",text:w(n,c)};const p=a.filter(l=>_(l,c));if(p.length>0){const l=n.filter(d=>!p.includes(d));return{kind:"prependText",text:C(p,l,c)}}const u=O(e,a,r,s,c);return X(o)?{kind:"inputRequired",result:await $(u)}:{kind:"prependText",text:await T(u)}}async function re(e,t,n,r,s,i){const c=t.filter(u=>A(u,s));if(c.length===0)return{kind:"prependText",text:w(t,i)};const o=c.filter(u=>_(u,i));if(o.length>0){const u=t.filter(l=>!o.includes(l));return{kind:"prependText",text:C(o,u,i)}}const a=O(e,c,n,r,i);return{kind:"prependText",text:await Q(`${n}:${b(c[0])}`,()=>T(a))}}function ie(e){return{sessionId:e.sessionId,authInfo:e.http?.authInfo,requestId:e.mcpReq.id,_meta:e.mcpReq._meta}}function Se(e){return{user:e.user,config:e.config,outdir:e.outdir,baseUrl:e.baseUrl,params:e.params,query:e.query,cookies:e.cookies,apiDescriptionsMap:e.apiDescriptionsMap,graphqlDescriptions:e.graphqlDescriptions,products:e.products,accessToken:e.accessToken,metadata:e.metadata,upstreamAuthorization:e.upstreamAuthorization,mcpMode:e.mcpMode,elicitationEnabled:e.elicitationEnabled,gatewayFetchBudgetPerExec:e.gatewayFetchBudgetPerExec,clientIp:e.clientIp,upstreamSecrets:e.upstreamSecrets,searchIgnoredRoutes:e.searchIgnoredRoutes}}export{he as connectMcpServer,fe as createMcpServer,ge as createToolDispatch,Se as extractSerializableContext};
+`)}function O(e,t,r,n,s){const[i,...c]=t,a=s.get(i.api),o=i.scheme??a?.defaultScheme??T,p=A(i,s);return{subject:r,baseUrl:e.baseUrl??"",target:{api:i.api,name:i.name,scheme:o,...p?{schemeLabel:p}:{}},auth:a?.schemes[o]??{kind:"raw"},...a?{apiAuth:a}:{},kv:n,hasExistingSecret:!1,reason:{kind:"authFailure",status:i.status,...i.detail?{detail:i.detail}:{},otherApiNames:c.map(u=>u.name)}}}async function ee(e,t,r,n,s,i,c,a){if($(t.mcpReq.inputResponses))return{kind:"none"};const o=r.filter(l=>R(l,i));if(o.length===0)return{kind:"prependText",text:w(r,c)};const p=o.filter(l=>C(l,c));if(p.length>0){const l=r.filter(d=>!p.includes(d));return{kind:"prependText",text:U(p,l,c)}}const u=O(e,o,n,s,c);return J(a)?{kind:"inputRequired",result:await P(u)}:{kind:"prependText",text:await q(u)}}async function te(e,t,r,n,s,i){const c=t.filter(u=>R(u,s));if(c.length===0)return{kind:"prependText",text:w(t,i)};const a=c.filter(u=>C(u,i));if(a.length>0){const u=t.filter(l=>!a.includes(l));return{kind:"prependText",text:U(a,u,i)}}const o=O(e,c,r,n,i);return{kind:"prependText",text:await Y(`${r}:${S(c[0])}`,()=>q(o))}}function re(e){return{sessionId:e.sessionId,authInfo:e.http?.authInfo,requestId:e.mcpReq.id,_meta:e.mcpReq._meta}}function me(e){return{user:e.user,config:e.config,outdir:e.outdir,baseUrl:e.baseUrl,params:e.params,query:e.query,cookies:e.cookies,apiDescriptionsMap:e.apiDescriptionsMap,graphqlDescriptions:e.graphqlDescriptions,products:e.products,accessToken:e.accessToken,metadata:e.metadata,upstreamAuthorization:e.upstreamAuthorization,mcpMode:e.mcpMode,elicitationEnabled:e.elicitationEnabled,gatewayFetchBudgetPerExec:e.gatewayFetchBudgetPerExec,clientIp:e.clientIp,client:e.client,clientVersion:e.clientVersion,upstreamSecrets:e.upstreamSecrets,searchIgnoredRoutes:e.searchIgnoredRoutes,internalBaseUrl:e.internalBaseUrl,fs:void 0}}export{pe as createMcpServer,de as createToolDispatch,me as extractSerializableContext};

package/dist/server/plugins/mcp/types.d.ts

@@ -1,4 +1,4 @@
-import type { ApiFunctionsContext, ApiFunctionsContextMethods, PageStaticData } from '@redocly/config';
+import type { ApiFunctionsContext, ApiFunctionsContextMethods, McpToolDefinition, McpToolFileSystem, McpToolJsonValue, PageStaticData } from '@redocly/config';
 import type { AuthInfo, CallToolResult, RequestId, RequestMeta, StandardSchemaWithJSON, ToolCallback } from '@modelcontextprotocol/server';
 import type { OpenAPIPath, OpenAPIServer, OpenAPIOperation } from '@redocly/api-docs';
 import type { McpErrorCodes, McpServerType } from './constants';
@@ -79,7 +79,10 @@ export type SemanticSearchResult = {
     url: string;
     content: string;
 };
-export type McpToolWorkerResponse = CallToolResult;
+export type McpErrorClass = 'tool_error' | 'sandbox_error' | 'client_error' | 'server_error';
+export type McpToolWorkerResponse = CallToolResult & {
+    errorClass?: McpErrorClass;
+};
 export type ToolArgs = Record<string, unknown>;
 export type McpToolCallback = ToolCallback<StandardSchemaWithJSON<ToolArgs, ToolArgs>>;
 export type McpToolExtra = {
@@ -99,10 +102,14 @@ export type McpToolContext = Omit<ApiFunctionsContext, 'telemetry' | 'getKv' | k
     elicitationEnabled?: boolean;
     gatewayFetchBudgetPerExec?: number;
     clientIp?: string;
+    client?: string;
+    clientVersion?: string;
     upstreamSecrets?: UpstreamSecrets;
     searchIgnoredRoutes?: string[];
+    internalBaseUrl?: string;
+    fs?: McpToolFileSystem;
 };
-export type McpToolHandler<TArgs extends ToolArgs = ToolArgs> = (args: TArgs, context: McpToolContext, extra: McpToolExtra) => Promise<McpToolWorkerResponse>;
+export type McpToolHandler<TArgs extends ToolArgs = ToolArgs> = (args: TArgs, context: McpToolContext, extra: McpToolExtra) => Promise<McpToolWorkerResponse | McpToolJsonValue>;
 export type McpToolIsAvailable = (context: McpToolContext) => boolean | Promise<boolean>;
 export type McpToolHandlerExtended<TArgs extends ToolArgs = ToolArgs> = {
     execute: McpToolHandler<TArgs>;
@@ -114,5 +121,24 @@ export type McpToolExecutionParams = {
     context: McpToolContext;
     extra: McpToolExtra;
 };
+export type CustomMcpToolsState = {
+    registeredToolNames: string[];
+};
+export type ToolDefinitionValidationResult = {
+    ok: true;
+    schema: McpToolSchema;
+} | {
+    ok: false;
+    errors: string[];
+};
+export type ToolFileDefaultExport = Partial<McpToolDefinition> | null | undefined;
+export type McpToolModuleGetter = () => Promise<{
+    default: McpToolModuleExport;
+}>;
+export type McpToolMapExport = Record<string, McpToolHandler | McpToolHandlerExtended | undefined>;
+export type McpToolFileExport = McpToolHandlerExtended & {
+    description: string;
+};
+export type McpToolModuleExport = McpToolMapExport | McpToolFileExport;
 export {};
 //# sourceMappingURL=types.d.ts.map

package/dist/server/plugins/mcp/utils/available-sandbox-tools.d.ts

@@ -0,0 +1,4 @@
+import type { McpToolSchema } from '../../../types';
+import type { McpToolContext } from '../types.js';
+export declare function availableSandboxTools(candidates: McpToolSchema[], context: McpToolContext): Promise<McpToolSchema[]>;
+//# sourceMappingURL=available-sandbox-tools.d.ts.map

package/dist/server/plugins/mcp/utils/available-sandbox-tools.js

@@ -0,0 +1 @@
+import{logger as i}from"../../../tools/notifiers/logger.js";import{mcpToolWorkers as a,MCP_TOOL_AVAILABILITY_KEY as m}from"../../../workers/mcp-tool-worker-pool.js";async function p(o,t){if(o.length===0)return o;const l=o.map(r=>r.name);let e;try{e=await a.exec(m,[{toolNames:l,context:t}],{timeout:1e4})}catch(r){return i.error(`Failed to resolve MCP tool availability: ${r instanceof Error?r.message:String(r)}`),o}return!e||typeof e!="object"?o:o.filter(r=>e[r.name]!==!1)}export{p as availableSandboxTools};

package/dist/server/plugins/mcp/utils/find-gated-tool-names.d.ts

@@ -1,8 +1,7 @@
 import type { McpToolRegistration } from '../../../types';
-import type { McpToolHandler, McpToolHandlerExtended } from '../types.js';
-type ToolHandlers = Record<string, McpToolHandler | McpToolHandlerExtended>;
+import type { McpToolModuleExport } from '../types.js';
 type ToolModuleLoader = (importPath: string) => Promise<{
-    default: ToolHandlers;
+    default: McpToolModuleExport;
 }>;
 /**
  * Names of the tools whose handler declares an `isAvailable` predicate — the ones the live

package/dist/server/plugins/mcp/utils/find-gated-tool-names.js

@@ -1 +1 @@
-const r=t=>import(t);async function f(t,o=r){const n=[];for(const{name:a,importPath:i}of t){const e=await c(i,o);(!e||s(e[a]))&&n.push(a)}return n}async function c(t,o){try{const{default:n}=await o(t);return n}catch{return}}function s(t){return typeof t=="object"&&typeof t.isAvailable=="function"}export{f as findGatedToolNames};
+import{resolveToolHandler as l}from"../workers/execute-mcp-tool.js";const s=t=>import(t);async function d(t,o=s){const n=[];for(const{name:e,importPath:r,hasAvailabilityGate:a}of t){if(a!==void 0){a&&n.push(e);continue}const i=await c(r,o);(!i||f(l(i,e)))&&n.push(e)}return n}async function c(t,o){try{const{default:n}=await o(t);return n}catch{return}}function f(t){return typeof t=="object"&&typeof t.isAvailable=="function"}export{d as findGatedToolNames};

package/dist/server/plugins/mcp/utils/mcp-client.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Both markers are parenthesised so neither can collide with a real client: a name is built out
+ * of `[a-z0-9._-]`, which cannot produce a bracket.
+ */
+export declare function resolveMcpClient(request: Request): {
+    client: string;
+    clientVersion?: string;
+};
+export declare function parseUserAgent(userAgent: string | null | undefined): {
+    client: string;
+    clientVersion?: string;
+};
+//# sourceMappingURL=mcp-client.d.ts.map

package/dist/server/plugins/mcp/utils/mcp-client.js

@@ -0,0 +1 @@
+const o="(none)",r="(unparsed)",N=40,i=/^[A-Za-z0-9._\- ]+/,c=/\s+([0-9]\S*).*$/,l=/^[/\s]+v?([0-9][^\s;,)]*)/;function a(e){return E(e.headers.get("user-agent"))}function E(e){if(e==null)return{client:o};const n=i.exec(e)?.[0]??"",t=n.replace(c,"").trim();if(!t)return{client:r};const s=c.exec(n)?.[1]??l.exec(e.slice(n.length))?.[1];return{client:t.replace(/\s+/g,"-").toLowerCase().slice(0,40),clientVersion:s?.slice(0,40)}}export{E as parseUserAgent,a as resolveMcpClient};

package/dist/server/plugins/mcp/workers/execute-mcp-tool.d.ts

@@ -1,4 +1,9 @@
-import type { McpToolExecutionParams, McpToolWorkerResponse } from '../types.js';
+import type { McpToolContext, McpToolExecutionParams, McpToolHandler, McpToolHandlerExtended, McpToolModuleExport, McpToolWorkerResponse } from '../types.js';
 export declare function executeMcpTool(params: McpToolExecutionParams): Promise<McpToolWorkerResponse>;
+export declare function resolveToolHandler(moduleDefault: McpToolModuleExport, toolName: string): McpToolHandler | McpToolHandlerExtended | undefined;
 export declare function isMcpToolAvailable(params: Omit<McpToolExecutionParams, 'args' | 'extra'>): Promise<boolean>;
+export declare function mcpToolAvailability(params: {
+    toolNames: string[];
+    context: McpToolContext;
+}): Promise<Record<string, boolean>>;
 //# sourceMappingURL=execute-mcp-tool.d.ts.map

package/dist/server/plugins/mcp/workers/execute-mcp-tool.js

@@ -1 +1 @@
-import{telemetry as h}from"../../../telemetry/index.js";import{mcpToolHandlers as y}from"../../../../client/mcp-tool-handlers-entry.js";import{McpServerType as c}from"../constants.js";import{EXECUTE_TOOL_NAME as T}from"../codemode/constants.js";import{logMcpToolCallAudit as M,reportMcpToolCalled as C,reportMcpToolError as u}from"./mcp-tool-telemetry.js";function E(e){return e.content.map(o=>o.type==="text"?o.text:"")}async function j(e){h.initialize();const{toolName:o,args:a,context:l,extra:r}=e,n=l?.mcpMode??"tools",s=performance.now();try{const t=y[o];if(!t)throw new Error(`Unknown MCP tool: ${o}`);const{default:x}=await t(),i=x[o];if(!i)throw new Error(`MCP tool module does not export a handler for "${o}". Expected \`export default { '${o}': handler }\`.`);const f=await(typeof i=="function"?i:i.execute)(a,l,r);if(!v(f))throw new Error(`MCP tool "${o}" returned an invalid result.`);const m=Math.round(performance.now()-s),p=f.isError?o===T?"sandbox_error":"tool_error":void 0,d=E(f),w=d.join("");return M({tool:o,mode:n,serverType:c.Docs,args:a,result:w,errorClass:p}),p?u({tool:o,message:d.join(" "),mode:n,serverType:c.Docs,durationMs:m,errorClass:p}):C({tool:o,mode:n,serverType:c.Docs,durationMs:m,outputLength:w.length}),f}catch(t){throw M({tool:o,mode:n,serverType:c.Docs,args:a,errorClass:"server_error"}),u({tool:o,message:t instanceof Error?t.message:String(t),mode:n,serverType:c.Docs,durationMs:Math.round(performance.now()-s),stack:t instanceof Error&&t.stack||"",errorClass:"server_error"}),t}}function v(e){return!e||typeof e!="object"?!1:Array.isArray(e.content)}async function P(e){h.initialize();const{toolName:o,context:a}=e,l=performance.now();try{const r=y[o];if(!r)return!1;const{default:n}=await r(),s=n[o];return s?typeof s=="object"&&typeof s.isAvailable=="function"?await s.isAvailable(a):!0:!1}catch(r){throw u({tool:o,message:"Failed to check if MCP tool is available: "+(r instanceof Error?r.message:String(r)),mode:a?.mcpMode??"tools",serverType:c.Docs,durationMs:Math.round(performance.now()-l),stack:r instanceof Error&&r.stack||"",errorClass:"server_error"}),r}}export{j as executeMcpTool,P as isMcpToolAvailable};
+import{telemetry as h}from"../../../telemetry/index.js";import{McpServerType as c}from"../constants.js";import{EXECUTE_TOOL_NAME as w}from"../codemode/constants.js";import{isPlainObject as f}from"../../../../utils/guards/is-plain-object.js";import{logMcpToolCallAudit as g,reportMcpToolCalled as _,reportMcpToolError as u}from"./mcp-tool-telemetry.js";import{attachToolFileSystem as E}from"./tool-file-system.js";import{importMcpToolHandlers as S}from"./import-mcp-tool-handlers.js";function A(e){return e.content.map(t=>t.type==="text"?t.text:"")}async function J(e){h.initialize();const{toolName:t,args:o,extra:s}=e,r=E(e.context),n=r?.mcpMode??"tools",a={client:r?.client,clientVersion:r?.clientVersion},d=performance.now();try{const i=await M(t);if(!i)throw new Error(`MCP tool "${t}" is not registered or its module does not export a handler for "${t}". Expected \`export default { '${t}': handler }\` or a single tool definition with \`description\` and \`execute\` as the default export.`);const C=typeof i=="function"?i:i.execute,l=P(t,await C(o,r,s),n),m=Math.round(performance.now()-d),{errorClass:y}=l;delete l.errorClass;const p=l.isError?y??(t===w?"sandbox_error":"tool_error"):void 0,v=t===w&&y==="tool_error",x=A(l),T=x.join("");return g({tool:t,mode:n,serverType:c.Docs,args:o,result:T,errorClass:p,...a}),p?v||u({tool:t,message:x.join(" "),mode:n,serverType:c.Docs,durationMs:m,errorClass:p,...a}):_({tool:t,mode:n,serverType:c.Docs,durationMs:m,outputLength:T.length,...a}),l}catch(i){throw g({tool:t,mode:n,serverType:c.Docs,args:o,errorClass:"server_error",...a}),u({tool:t,message:i instanceof Error?i.message:String(i),mode:n,serverType:c.Docs,durationMs:Math.round(performance.now()-d),stack:i instanceof Error&&i.stack||"",errorClass:"server_error",...a}),i}}function b(e){return"execute"in e&&typeof e.execute=="function"&&"description"in e&&typeof e.description=="string"}async function M(e){const t=(await S())[e];if(!t)return;const{default:o}=await t();return O(o,e)}function O(e,t){return b(e)?e:e[t]}function P(e,t,o){if(L(t))return t;if(typeof t=="string")return{content:[{type:"text",text:t}]};let s;try{s=JSON.stringify(t)}catch(n){throw new Error(`MCP tool "${e}" returned a value that cannot be serialized to JSON: `+(n instanceof Error?n.message:String(n)))}if(s===void 0)throw new Error(`MCP tool "${e}" returned an invalid result.`);const r=o==="code"?JSON.parse(s):void 0;return f(r)?{content:[{type:"text",text:s}],structuredContent:r}:{content:[{type:"text",text:s}]}}const k=new Set(["text","image","audio","resource","resource_link"]);function L(e){if(!f(e))return!1;const{content:t}=e;return Array.isArray(t)&&t.every(o=>f(o)&&k.has(o.type))}async function j(e){h.initialize();const{toolName:t}=e,o=E(e.context),s=performance.now();try{const r=await M(t);return r?typeof r=="object"&&typeof r.isAvailable=="function"?await r.isAvailable(o):!0:!1}catch(r){throw u({tool:t,message:"Failed to check if MCP tool is available: "+(r instanceof Error?r.message:String(r)),mode:o?.mcpMode??"tools",serverType:c.Docs,durationMs:Math.round(performance.now()-s),stack:r instanceof Error&&r.stack||"",errorClass:"server_error",client:o?.client,clientVersion:o?.clientVersion}),r}}async function F(e){const{toolNames:t,context:o}=e,s=await Promise.all(t.map(r=>j({toolName:r,context:o}).catch(()=>!1)));return Object.fromEntries(t.map((r,n)=>[r,s[n]]))}export{J as executeMcpTool,j as isMcpToolAvailable,F as mcpToolAvailability,O as resolveToolHandler};

package/dist/server/plugins/mcp/workers/import-mcp-tool-handlers.d.ts

@@ -0,0 +1,5 @@
+import type { McpToolModuleGetter } from '../types.js';
+type McpToolHandlers = Record<string, McpToolModuleGetter | undefined>;
+export declare function importMcpToolHandlers(): Promise<McpToolHandlers>;
+export {};
+//# sourceMappingURL=import-mcp-tool-handlers.d.ts.map

package/dist/server/plugins/mcp/workers/import-mcp-tool-handlers.js

@@ -0,0 +1 @@
+import{stat as e}from"node:fs/promises";import{join as i}from"node:path";import{pathToFileURL as m}from"node:url";import{envConfig as a}from"../../../config/env-config.js";import{workerBaseDir as s}from"../../../workers/worker-pool.js";let t;async function y(){if(a.isRuntimeMode)return(await import("../../../../client/mcp-tool-handlers-entry.js")).mcpToolHandlers;const o=i(s,"mcp-tool-handlers-entry.js"),{mtimeMs:r}=await e(o);if(t?.mtimeMs!==r){const n=await import(`${m(o).href}?${r}`);t={mtimeMs:r,handlers:n.mcpToolHandlers}}return t.handlers}export{y as importMcpToolHandlers};

package/dist/server/plugins/mcp/workers/mcp-tool-telemetry.d.ts

@@ -1,18 +1,13 @@
-import type { McpMode, McpServerType } from '../types.js';
+import type { McpErrorClass, McpMode, McpServerType } from '../types.js';
 type McpToolEvent = {
     tool: string;
     mode: McpMode;
     serverType: McpServerType;
     durationMs: number;
+    client?: string;
+    clientVersion?: string;
 };
-/**
- * Who an error belongs to. `tool_error` — the caller asked for something that does not exist or
- * does not validate. `sandbox_error` — the model's own generated code threw in code mode.
- * `server_error` — Redocly code failed. Reported explicitly so consumers never have to infer it
- * from whether a stack trace happens to be attached.
- */
-export type McpErrorClass = 'tool_error' | 'sandbox_error' | 'server_error';
-export declare function reportMcpToolCalled({ tool, mode, serverType, durationMs, outputLength, }: McpToolEvent & {
+export declare function reportMcpToolCalled({ tool, mode, serverType, durationMs, outputLength, client, clientVersion, }: McpToolEvent & {
     outputLength: number;
 }): void;
 /**
@@ -21,12 +16,12 @@ export declare function reportMcpToolCalled({ tool, mode, serverType, durationMs
  * identifies the invocation. The result body itself is never recorded — a tool can return
  * credentials no pattern will recognise — so only its digest lands here.
  */
-export declare function logMcpToolCallAudit({ tool, mode, serverType, args, result, errorClass, }: Omit<McpToolEvent, 'durationMs'> & {
+export declare function logMcpToolCallAudit({ tool, mode, serverType, args, result, errorClass, client, clientVersion, }: Omit<McpToolEvent, 'durationMs'> & {
     args: unknown;
     result?: string;
     errorClass?: McpErrorClass;
 }): void;
-export declare function reportMcpToolError({ tool, mode, serverType, durationMs, message, stack, errorClass, }: McpToolEvent & {
+export declare function reportMcpToolError({ tool, mode, serverType, durationMs, message, stack, errorClass, client, clientVersion, }: McpToolEvent & {
     message: string;
     stack?: string;
     errorClass: McpErrorClass;

package/dist/server/plugins/mcp/workers/mcp-tool-telemetry.js

@@ -1 +1 @@
-import{telemetry as u}from"../../../telemetry/index.js";import{serverAttributes as l}from"../utils/telemetry-attributes.js";import{EXECUTE_TOOL_NAME as c}from"../codemode/constants.js";import{auditInput as d,auditOutputDigest as p,auditSha256 as f,logAuditRecord as g}from"../audit/audit-log.js";function E({tool:r,mode:e,serverType:o,durationMs:s,outputLength:t}){u.sendMcpToolCalledMessage([{...l(o),tool:r,mode:e,output_length:t,duration_ms:s}])}function T({tool:r,mode:e,serverType:o,args:s,result:t,errorClass:n}){if(r===c)return;const i=m(s),a=t===void 0?void 0:p(t);g("Record MCP tool call",{tool:r,mode:e,server_type:o,error_class:n,args_sha256:f(i),args:d(i),result_sha256:a?.sha256,result_bytes:a?.bytes})}function m(r){try{return JSON.stringify(r)??String(r)}catch{return"\xAB[unserializable]\xBB"}}function A({tool:r,mode:e,serverType:o,durationMs:s,message:t,stack:n="",errorClass:i}){u.sendMcpErrorMessage([{...l(o),tool:r,message:t,stack:n,error_class:i,mode:e,duration_ms:s}])}export{T as logMcpToolCallAudit,E as reportMcpToolCalled,A as reportMcpToolError};
+import{telemetry as c}from"../../../telemetry/index.js";import{serverAttributes as d}from"../utils/telemetry-attributes.js";import{EXECUTE_TOOL_NAME as p}from"../codemode/constants.js";import{auditInput as _,auditOutputDigest as f,auditSha256 as g,logAuditRecord as m}from"../audit/audit-log.js";function A({tool:r,mode:t,serverType:o,durationMs:i,outputLength:e,client:s,clientVersion:n}){c.sendMcpToolCalledMessage([{...d(o),tool:r,mode:t,output_length:e,duration_ms:i,client:s,client_version:n}])}function C({tool:r,mode:t,serverType:o,args:i,result:e,errorClass:s,client:n,clientVersion:a}){if(r===p)return;const l=M(i),u=e===void 0?void 0:f(e);m("Record MCP tool call",{tool:r,mode:t,server_type:o,error_class:s,client:n,client_version:a,args_sha256:g(l),args:_(l),result_sha256:u?.sha256,result_bytes:u?.bytes})}function M(r){try{return JSON.stringify(r)??String(r)}catch{return"\xAB[unserializable]\xBB"}}function b({tool:r,mode:t,serverType:o,durationMs:i,message:e,stack:s="",errorClass:n,client:a,clientVersion:l}){c.sendMcpErrorMessage([{...d(o),tool:r,message:e,stack:s,error_class:n,mode:t,duration_ms:i,client:a,client_version:l}])}export{C as logMcpToolCallAudit,A as reportMcpToolCalled,b as reportMcpToolError};

package/dist/server/plugins/mcp/workers/tool-file-system.d.ts

@@ -0,0 +1,6 @@
+import type { McpToolFileSystem } from '@redocly/config';
+import type { McpToolContext } from '../types.js';
+export declare function attachToolFileSystem(context: McpToolContext): McpToolContext & {
+    fs: McpToolFileSystem;
+};
+//# sourceMappingURL=tool-file-system.d.ts.map

package/dist/server/plugins/mcp/workers/tool-file-system.js

@@ -0,0 +1 @@
+import{readFile as s,realpath as i}from"node:fs/promises";import{resolve as l,sep as n}from"node:path";function m(r){return{...r,fs:c(r.outdir)}}function c(r){return{async readFile(o){if(!r)throw new Error("Project files are not available in this environment.");const e=await i(r),t=l(e,o.replace(/^\/+/,"")),a=t.startsWith(e+n)?await i(t):t;if(!a.startsWith(e+n))throw new Error(`Invalid file path "${o}".`);return await s(a,"utf8")}}}export{m as attachToolFileSystem};

package/dist/server/sandbox/sandbox.js

@@ -1,3 +1,3 @@
-import _ from"@jitl/quickjs-singlefile-mjs-release-sync";import{newQuickJSWASMModuleFromVariant as E,newVariant as S}from"quickjs-emscripten-core";import{createExecutionBudget as A}from"./utils/execution-budget.js";import{DEFAULT_MAX_LIFETIME_MS as p,DEFAULT_TIMEOUT_MS as y,INITIAL_TOTAL_MEMORY_BYTES as g,MAX_ALLOCATION_BYTES as w,MAX_RESULT_BYTES as x,MAX_STACK_SIZE_BYTES as I,MAX_TOTAL_MEMORY_BYTES as L,WASM_PAGE_BYTES as d}from"./constants/sandbox.js";let l;function h(){return l??=E(S(_,{wasmMemory:new WebAssembly.Memory({initial:g/d,maximum:L/d})}))}async function k(t,c={}){const{timeoutMs:m=y,maxLifetimeMs:M=p,setupContext:f}=c,e=(await h()).newContext();let n,s,r;try{e.runtime.setMemoryLimit(w),e.runtime.setMaxStackSize(I),n=A(e,m,M),s=f?.(e,n)??void 0,r=e.unwrapResult(e.evalCode(`(async () => {
+import p from"@jitl/quickjs-singlefile-mjs-release-sync";import{newQuickJSWASMModuleFromVariant as _,newVariant as E}from"quickjs-emscripten-core";import{createExecutionBudget as S}from"./utils/execution-budget.js";import{returnsFromTopLevel as A}from"./utils/returns-from-top-level.js";import{DEFAULT_MAX_LIFETIME_MS as y,DEFAULT_TIMEOUT_MS as b,INITIAL_TOTAL_MEMORY_BYTES as h,MAX_ALLOCATION_BYTES as L,MAX_RESULT_BYTES as g,MAX_STACK_SIZE_BYTES as w,MAX_TOTAL_MEMORY_BYTES as x,WASM_PAGE_BYTES as d}from"./constants/sandbox.js";let c;function I(){return c??=_(E(p,{wasmMemory:new WebAssembly.Memory({initial:h/d,maximum:x/d})}))}async function P(t,l={}){const{timeoutMs:m=b,maxLifetimeMs:f=y,setupContext:M}=l,e=(await I()).newContext();let n,i,r;try{e.runtime.setMemoryLimit(L),e.runtime.setMaxStackSize(w),n=S(e,m,f),i=M?.(e,n)??void 0,r=e.unwrapResult(e.evalCode(`(async () => {
 ${t}
-})()`));const i=e.resolvePromise(r);e.runtime.executePendingJobs();const T=await Promise.race([i,n.aborted]),u=e.unwrapResult(T),o=e.dump(u);if(u.dispose(),o===void 0)return{error:"The code returned undefined. Check that a top-level `return` yields a defined value: return the value directly (not `return;` or `return undefined`), read an existing field (a wrong field name is undefined), and do not wrap the logic in a function or IIFE whose return value is discarded."};const a=JSON.stringify(o??null).length;return a>x?{error:`Result is too large (${a} bytes); return less data`}:{result:o}}catch(i){return{error:b(i)}}finally{n?.dispose(),r?.dispose();try{s?.()}catch{}try{e.dispose()}catch{l=void 0}}}function b(t){return t instanceof Error?t.message:String(t)}export{k as runInSandbox};
+})()`));const o=e.resolvePromise(r);e.runtime.executePendingJobs();const T=await Promise.race([o,n.aborted]),u=e.unwrapResult(T),s=e.dump(u);if(u.dispose(),s===void 0)return{error:A(e,t)?"The code returned undefined: the `return` ran but produced no value. Read fields off the declared return types \u2014 a field name that does not exist reads as undefined \u2014 and do not `return;` or `return undefined`.":"The code returned undefined because nothing was returned. Add a top-level `return`: a value computed inside a function or IIFE is discarded unless you return it, and a promise chain has to be returned to be awaited."};const a=JSON.stringify(s??null).length;return a>g?{error:`Result is too large (${a} bytes); return less data`}:{result:s}}catch(o){return{error:v(o)}}finally{n?.dispose(),r?.dispose();try{i?.()}catch{}try{e.dispose()}catch{c=void 0}}}function v(t){return t instanceof Error?t.message:String(t)}export{P as runInSandbox};

package/dist/server/sandbox/utils/returns-from-top-level.d.ts

@@ -0,0 +1,4 @@
+import type { QuickJSContext } from 'quickjs-emscripten-core';
+/** Whether `code` returns from the guest wrapper itself rather than from a nested function. */
+export declare function returnsFromTopLevel(context: QuickJSContext, code: string): boolean;
+//# sourceMappingURL=returns-from-top-level.d.ts.map

package/dist/server/sandbox/utils/returns-from-top-level.js

@@ -0,0 +1 @@
+const o="return not in a function";function u(r,t){let e;try{e=r.evalCode(t,"return-probe.js",{type:"module",compileOnly:!0})}catch{return!1}if(!e.error)return e.value.dispose(),!1;const n=r.dump(e.error);return e.error.dispose(),String(n?.message??"").includes(o)}export{u as returnsFromTopLevel};

package/dist/server/store.d.ts

@@ -128,6 +128,7 @@ export declare class Store {
     markGatedMcpTools: (toolNames: string[]) => void;
     addSkills: (skills: Skill[]) => void;
     getSkills: () => Skill[];
+    removeMcpTools: (names: string[]) => void;
     addMiddleware: (middleware: MiddlewareDetails) => void;
     setResourceResponseHeaders: (resourcePath: string, headers: NonNullable<RedoclyConfig['responseHeaders']>[string]) => void;
     getRouteByFsPath: (relativePath: string) => PageRouteDetails | undefined;