@redocly/revel 0.138.0-next.7 → 0.138.0

package/dist/server/plugins/mcp/codemode/capabilities/fetch/index.js

@@ -1,5 +1,5 @@
-import{getCallableApis as n,isFetchCapable as o}from"../../../gateway-mcp/callable-apis.js";import{FETCH_TOOL_NAME as i}from"../../constants.js";const l=["```ts","/**"," * Call a documented API. Only the callable APIs' documented hosts are reachable."," * Responses cap at 1 MiB and redirects are not followed."," */","declare function fetch(url: string | URL, init?: {","  method?: string;","  /** `content-type` is set automatically for URLSearchParams/FormData unless you set one. */","  headers?: Record<string, string>;","  /** string \xB7 URLSearchParams (\u2192 application/x-www-form-urlencoded) \xB7 FormData (\u2192 multipart/form-data) */","  body?: string | URLSearchParams | FormData;","  /** Security scheme name (from the operation's `security` or `getSecuritySchemes`) whose credential to send. Omit to let the server choose. */","  securityScheme?: string;","}): Promise<{","  status: number;","  statusText: string;","  ok: boolean;","  headers: { get(name: string): string | null };","  json(): Promise<unknown>;","  text(): Promise<string>;","}>;","```"].join(`
-`),c=["listApis","getEndpoints","getEndpointInfo"],p=["Example - list the paid invoices of a billing API:","","```ts","const { items } = await tools.listApis({ filter: 'billing' });","const [api] = items;",`if (!api) return { error: 'no API matches "billing"' };`,"const { endpoints } = await tools.getEndpoints({ name: api.name });","const ep = endpoints.find((e) => e.method === 'GET' && e.path.includes('invoices'));","const info = await tools.getEndpointInfo({ name: api.name, path: ep.path, method: ep.method });","// Replace every `{placeholder}` first.","const url = new URL((info.servers?.[0]?.url ?? '') + ep.path);","// Every name below comes from `info.endpoint.parameters` - read them first, never guess them.","url.searchParams.set('filter', 'status:paid');","url.searchParams.set('sort', '-createdTime');","url.searchParams.set('limit', '100');","try {","  const res = await fetch(url, { method: ep.method });","  return res.ok ? await res.json() : { status: res.status, error: await res.text() };","} catch (error) {","  return { error: error instanceof Error ? error.message : String(error), endpointId: info };","}","```"].join(`
-`),d=["Example - call an endpoint you already read:","","```ts","// Call `getEndpointInfo` first for the server URL, the path, and the parameter names.","// Replace every `{placeholder}` first.","const url = new URL('https://api.example.com/invoices');","url.searchParams.set('filter', 'status:paid');","try {","  const res = await fetch(url, { method: 'GET' });","  return res.ok ? await res.json() : { status: res.status, error: await res.text() };","} catch (error) {","  return { error: error instanceof Error ? error.message : String(error) };","}","```"].join(`
-`);function h(r){return c.every(t=>r.includes(t))?p:d}function m(r){const t=new Map;for(const{name:e,version:a}of r){if(!e)continue;const s=t.get(e)??[];a&&s.push(a),t.set(e,s)}return[...t.entries()].map(([e,a])=>a.length>1?`${e} (${a.map(s=>`v${s}`).join(", ")})`:e).join(", ")}const g={id:i,purpose:"Call the documented APIs over HTTP",isActive:o,annotations:{readOnlyHint:!1,destructiveHint:!0,openWorldHint:!0},renderSection(r,t){const e=m(n(r));return["## `fetch` \u2014 call the documented APIs","",l,"","Always call `getEndpointInfo` before `fetch` for the exact URL, required parameters, and body shape. Put filtering, sorting, and paging in the query parameters, and keep sandbox JS for what the endpoint cannot express. Never guess.","","A `servers[].url` or an endpoint path can hold `{placeholders}`. Replace every one before you call `fetch`. Use the server variable `default`. Ask the user when the `default` only repeats the variable name, such as `{organizationId}`.","",`Callable APIs (their documented hosts are reachable via \`fetch\`): ${e}`,"",h(t)].join(`
-`)}};export{l as FETCH_DECLARATION,g as fetchCapability};
+import{getCallableApis as o,isFetchCapable as s}from"../../../gateway-mcp/callable-apis.js";import{allowsOnlySafeHttpMethods as i,getAllowedHttpMethods as l}from"../../../gateway-mcp/allowed-http-methods.js";import{FETCH_TOOL_NAME as c}from"../../constants.js";const d=["```ts","/**"," * Call a documented operation of a callable API. Undocumented paths and methods are refused."," * Responses cap at 1 MiB and redirects are not followed."," */","declare function fetch(url: string | URL, init?: {","  method?: string;","  /** `content-type` is set automatically for URLSearchParams/FormData unless you set one. */","  headers?: Record<string, string>;","  /** string \xB7 URLSearchParams (\u2192 application/x-www-form-urlencoded) \xB7 FormData (\u2192 multipart/form-data) */","  body?: string | URLSearchParams | FormData;","  /** Security scheme name (from the operation's `security` or `getSecuritySchemes`) whose credential to send. Omit to let the server choose. */","  securityScheme?: string;","}): Promise<{","  status: number;","  statusText: string;","  ok: boolean;","  headers: { get(name: string): string | null };","  json(): Promise<unknown>;","  text(): Promise<string>;","}>;","```"].join(`
+`),p=["listApis","getEndpoints","getEndpointInfo"],h=["Example - list the paid invoices of a billing API:","","```ts","const { items } = await tools.listApis({ filter: 'billing' });","const [api] = items;",`if (!api) return { error: 'no API matches "billing"' };`,"const { endpoints } = await tools.getEndpoints({ name: api.name });","const ep = endpoints.find((e) => e.method === 'GET' && e.path.includes('invoices'));","const info = await tools.getEndpointInfo({ name: api.name, path: ep.path, method: ep.method });","// Replace every `{placeholder}` first.","const url = new URL((info.servers?.[0]?.url ?? '') + ep.path);","// Every name below comes from `info.endpoint.parameters` - read them first, never guess them.","url.searchParams.set('filter', 'status:paid');","url.searchParams.set('sort', '-createdTime');","url.searchParams.set('limit', '100');","try {","  const res = await fetch(url, { method: ep.method });","  return res.ok ? await res.json() : { status: res.status, error: await res.text() };","} catch (error) {","  return { error: error instanceof Error ? error.message : String(error), endpointId: info };","}","```"].join(`
+`),m=["Example - call an endpoint you already read:","","```ts","// Call `getEndpointInfo` first for the server URL, the path, and the parameter names.","// Replace every `{placeholder}` first.","const url = new URL('https://api.example.com/invoices');","url.searchParams.set('filter', 'status:paid');","try {","  const res = await fetch(url, { method: 'GET' });","  return res.ok ? await res.json() : { status: res.status, error: await res.text() };","} catch (error) {","  return { error: error instanceof Error ? error.message : String(error) };","}","```"].join(`
+`);function u(e){return p.every(r=>e.includes(r))?h:m}function f(e){const r=new Map;for(const{name:t,version:a}of e){if(!t)continue;const n=r.get(t)??[];a&&n.push(a),r.set(t,n)}return[...r.entries()].map(([t,a])=>a.length>1?`${t} (${a.map(n=>`v${n}`).join(", ")})`:t).join(", ")}const w={id:c,purpose:"Call the documented APIs over HTTP",isActive:s,annotations:e=>i(e)?{readOnlyHint:!0,destructiveHint:!1,openWorldHint:!0}:{readOnlyHint:!1,destructiveHint:!0,openWorldHint:!0},renderSection(e,r){const t=f(o(e));return["## `fetch` \u2014 call the documented APIs","",d,"","Always call `getEndpointInfo` before `fetch` for the exact URL, required parameters, and body shape. Put filtering, sorting, and paging in the query parameters, and keep sandbox JS for what the endpoint cannot express. Never guess.","","A `servers[].url` or an endpoint path can hold `{placeholders}`. Replace every one before you call `fetch`. Use the server variable `default`. Ask the user when the `default` only repeats the variable name, such as `{organizationId}`.","",`\`fetch\` sends only the methods this project allows: ${l(e.config?.mcp).join(", ")}. Explain any other call to the user instead of making it.`,"",`Callable APIs (their documented hosts are reachable via \`fetch\`): ${t}`,"",u(r)].join(`
+`)}};export{d as FETCH_DECLARATION,w as fetchCapability};

package/dist/server/plugins/mcp/codemode/capabilities/types.d.ts

@@ -1,3 +1,4 @@
+import type { RedoclyConfig } from '@redocly/config';
 import type { ToolAnnotations } from '@modelcontextprotocol/server';
 import type { McpToolContext } from '../../types.js';
 /** A capability is a per-request-gated global the code-mode sandbox exposes beyond the schema-driven `tools.*` surface. */
@@ -6,7 +7,8 @@ export type SandboxCapability = {
     purpose: string;
     /** Whether this capability is live for THIS request (RBAC/config/flag-dependent). */
     isActive(context: McpToolContext): boolean;
-    annotations: Partial<ToolAnnotations>;
+    /** The tool hints this capability adds to `execute` under the project's `mcp` config. */
+    annotations(mcp: RedoclyConfig['mcp'] | undefined): Partial<ToolAnnotations>;
     /**
      * The self-contained `describe-tools` section for this capability: heading, TS declaration,
      * guidance, and an example built only from `describedToolNames`.

package/dist/server/plugins/mcp/codemode/capabilities/utils.d.ts

@@ -1,9 +1,10 @@
+import type { RedoclyConfig } from '@redocly/config';
 import type { ToolAnnotations } from '@modelcontextprotocol/server';
 import type { McpToolSchema } from '../../../../types';
 import type { McpToolContext } from '../../types.js';
 import type { SandboxCapability } from './types.js';
 export declare function getActiveCapabilities(context: McpToolContext): SandboxCapability[];
-export declare function composeExecuteAnnotations(tools: McpToolSchema[], capabilities: SandboxCapability[]): ToolAnnotations;
+export declare function composeExecuteAnnotations(tools: McpToolSchema[], capabilities: SandboxCapability[], mcp: RedoclyConfig['mcp'] | undefined): ToolAnnotations;
 /**
  * The describe-tools output: the tool signatures, the always-present
  * `execute` args note, then one self-contained section per selected capability.

package/dist/server/plugins/mcp/codemode/capabilities/utils.js

@@ -1,7 +1,7 @@
-import{buildToolTypeDeclarations as p,sanitizeToolName as c}from"../build-tool-type-declarations.js";import{buildExecuteExample as u,EXECUTE_ARGS_NOTE as l,USAGE_NOTES as m}from"../prompts.js";import{FETCH_TOOL_NAME as a}from"../constants.js";import{ALL_CAPABILITIES as d}from"./registry.js";function H(t){return d.filter(o=>o.isActive(t))}function h(t,o){const r=[...t,...o].map(({annotations:e})=>e??{}),i=r.filter(e=>e.readOnlyHint!==!0);return{readOnlyHint:i.length===0,destructiveHint:i.some(e=>e.destructiveHint!==!1),idempotentHint:i.every(e=>e.idempotentHint===!0),openWorldHint:r.some(e=>e.openWorldHint!==!1)}}function O(t,o,r){const i=t.map(n=>c(n.name)),e=[];if(t.length>0){const n=p(t),s=n.includes("OpenApi")?`
+import{buildToolTypeDeclarations as p,sanitizeToolName as c}from"../build-tool-type-declarations.js";import{buildExecuteExample as a,EXECUTE_ARGS_NOTE as m,USAGE_NOTES as u}from"../prompts.js";import{FETCH_TOOL_NAME as l}from"../constants.js";import{ALL_CAPABILITIES as d}from"./registry.js";function H(n){return d.filter(o=>o.isActive(n))}function h(n,o,r){const i=[...n.map(({annotations:t})=>t??{}),...o.map(t=>t.annotations(r))],e=i.filter(t=>t.readOnlyHint!==!0);return{readOnlyHint:e.length===0,destructiveHint:e.some(t=>t.destructiveHint!==!1),idempotentHint:e.every(t=>t.idempotentHint===!0),openWorldHint:i.some(t=>t.openWorldHint!==!1)}}function O(n,o,r){const i=n.map(t=>c(t.name)),e=[];if(n.length>0){const t=p(n),s=t.includes("OpenApi")?`
 
-${m}`:"";e.push(`## Sandbox tools
+${u}`:"";e.push(`## Sandbox tools
 
-${n}${s}`)}e.push(l),t.length>0&&!o.some(n=>n.id===a)&&e.push(u(i));for(const n of o)e.push(n.renderSection(r,i));return e.join(`
+${t}${s}`)}e.push(m),n.length>0&&!o.some(t=>t.id===l)&&e.push(a(i));for(const t of o)e.push(t.renderSection(r,i));return e.join(`
 
 `)}export{h as composeExecuteAnnotations,H as getActiveCapabilities,O as renderDescribeToolsOutput};

package/dist/server/plugins/mcp/codemode/code-audit.d.ts

@@ -4,9 +4,10 @@ export type CodeAudit = {
     flags: string;
 };
 /**
- * Fingerprint model-supplied code for the audit trail. The body itself is never reported — it can
- * contain data the model already pulled from a customer API — so callers get a hash plus flags for
- * patterns worth reviewing. The sandbox blocks all of the flagged targets; a flag is an attempt.
+ * Fingerprint model-supplied code. Telemetry never carries the body — it can contain data the model
+ * already pulled from a customer API — so it gets a hash plus flags for patterns worth reviewing; the
+ * redacted body goes only to the audit log. The sandbox blocks all of the flagged targets; a flag is
+ * an attempt.
  */
 export declare function auditCode(code: string): CodeAudit;
 //# sourceMappingURL=code-audit.d.ts.map

package/dist/server/plugins/mcp/codemode/code-execution-audit.js

@@ -1 +1 @@
-import{auditInput as t,auditSha256 as g,logAuditRecord as h}from"../audit/audit-log.js";function f({audit:e,code:c,description:d,sessionHandle:o,toolNames:i,fetchBudget:u,fetchCapable:n,requestId:s,messageId:a}){h("Record code execution input",{code_sha256:e.sha256,code_length:e.length,request_id:s,message_id:a,flags:e.flags,subject_sha256:o?g(o):void 0,description:t(d),tools:[...i].sort().join(","),fetch_capable:n,fetch_budget:u,code:t(c)})}export{f as logCodeExecutionAudit};
+import{auditInput as t,auditSha256 as a,logAuditRecord as f}from"../audit/audit-log.js";import{maskCodeCredentials as g}from"../audit/code-credentials.js";function p({audit:e,code:d,description:c,sessionHandle:o,toolNames:i,fetchBudget:n,fetchCapable:r,requestId:s,messageId:u}){f("Record code execution input",{code_sha256:e.sha256,code_length:e.length,request_id:s,message_id:u,flags:e.flags,subject_sha256:o?a(o):void 0,description:t(c),tools:[...i].sort().join(","),fetch_capable:r,fetch_budget:n,code:t(g(d))})}export{p as logCodeExecutionAudit};

package/dist/server/plugins/mcp/custom-tools/scan-custom-tools.js

@@ -1 +1 @@
-import{basename as d,join as p}from"node:path";import{envConfig as f}from"../../../config/env-config.js";import{logger as h}from"../../../tools/notifiers/logger.js";import{reporter as s}from"../../../tools/notifiers/reporter.js";import{CODE_MODE_TOOL_NAMES as O}from"../codemode/constants.js";import{ALL_DEFAULT_TOOL_NAMES as E}from"../docs-mcp/tool-schemas.js";import{extractToolDefinition as T}from"./extract-tool-definition.js";const M=/(^|\/)@mcp\/.*\.(ts|js)$/,_=/^[a-zA-Z0-9_-]{1,64}$/,C=new Set([...O,...E]);async function w(o,a,n){if(!f.REDOCLY_EXP_MCP_CUSTOM_TOOLS_ENABLED)return 0;N(o,n);const u=new Set(o.getMcpTools().map(r=>r.name)),l=new Map;for(const r of a.fs.scan(M)){if(r.isVirtual||r.relativePath.endsWith(".d.ts"))continue;const{relativePath:t}=r,e=d(t).replace(/\.(ts|js)$/,"");if(!_.test(e)){await s.panicOnBuildContentError(`Invalid MCP tool file "${t}": the tool name "${e}" is derived from the file name and may only contain letters, numbers, hyphens, and underscores (max 64 characters). Rename the file.`);continue}const c=l.get(e);if(c){await s.panicOnBuildContentError(`Duplicate MCP tool name "${e}": defined by both "${c}" and "${t}". Tool names are file names, so each file name must be unique across @mcp folders.`);continue}if(C.has(e)||u.has(e)){await s.panicOnBuildContentError(`Invalid MCP tool file "${t}": the tool name "${e}" is already used by a built-in MCP tool. Rename the file.`);continue}l.set(e,t);const m=p(o.contentDir,t),i=await T({toolName:e,absoluteSourcePath:m,contentDir:o.contentDir,serverOutDir:o.serverOutDir});if(!i.ok){await s.panicOnBuildContentError(`Invalid MCP tool file "${t}": ${i.errors.join(" ")}`);continue}!i.schema.outputSchema&&!n.warnedNoOutputSchemaTools.has(e)&&(n.warnedNoOutputSchemaTools.add(e),h.warn(`MCP tool "${e}" in %rp declares no \`outputSchema\`. Add one that describes the returned value.`,t)),o.addMcpTools(m,[i.schema]),n.registeredToolNames.push(e)}return n.registeredToolNames.length}function N(o,a){o.removeMcpTools(a.registeredToolNames),a.registeredToolNames=[]}export{N as resetCustomMcpTools,w as scanCustomMcpTools};
+import{basename as d,join as p}from"node:path";import{logger as f}from"../../../tools/notifiers/logger.js";import{reporter as s}from"../../../tools/notifiers/reporter.js";import{CODE_MODE_TOOL_NAMES as h}from"../codemode/constants.js";import{ALL_DEFAULT_TOOL_NAMES as O}from"../docs-mcp/tool-schemas.js";import{extractToolDefinition as T}from"./extract-tool-definition.js";const E=/(^|\/)@mcp\/.*\.(ts|js)$/,M=/^[a-zA-Z0-9_-]{1,64}$/,C=new Set([...h,...O]);async function g(o,a,n){_(o,n);const u=new Set(o.getMcpTools().map(r=>r.name)),l=new Map;for(const r of a.fs.scan(E)){if(r.isVirtual||r.relativePath.endsWith(".d.ts"))continue;const{relativePath:t}=r,e=d(t).replace(/\.(ts|js)$/,"");if(!M.test(e)){await s.panicOnBuildContentError(`Invalid MCP tool file "${t}": the tool name "${e}" is derived from the file name and may only contain letters, numbers, hyphens, and underscores (max 64 characters). Rename the file.`);continue}const c=l.get(e);if(c){await s.panicOnBuildContentError(`Duplicate MCP tool name "${e}": defined by both "${c}" and "${t}". Tool names are file names, so each file name must be unique across @mcp folders.`);continue}if(C.has(e)||u.has(e)){await s.panicOnBuildContentError(`Invalid MCP tool file "${t}": the tool name "${e}" is already used by a built-in MCP tool. Rename the file.`);continue}l.set(e,t);const m=p(o.contentDir,t),i=await T({toolName:e,absoluteSourcePath:m,contentDir:o.contentDir,serverOutDir:o.serverOutDir});if(!i.ok){await s.panicOnBuildContentError(`Invalid MCP tool file "${t}": ${i.errors.join(" ")}`);continue}!i.schema.outputSchema&&!n.warnedNoOutputSchemaTools.has(e)&&(n.warnedNoOutputSchemaTools.add(e),f.warn(`MCP tool "${e}" in %rp declares no \`outputSchema\`. Add one that describes the returned value.`,t)),o.addMcpTools(m,[i.schema]),n.registeredToolNames.push(e)}return n.registeredToolNames.length}function _(o,a){o.removeMcpTools(a.registeredToolNames),a.registeredToolNames=[]}export{_ as resetCustomMcpTools,g as scanCustomMcpTools};

package/dist/server/plugins/mcp/docs-mcp/tool-schemas.js

@@ -1 +1 @@
-import{SEMANTIC_SEARCH_API_URL as y}from"../../../constants/common.js";import{shouldHandleMcpAuth as f}from"../../../utils/rbac/should-handle-mcp-auth.js";import{CREATE_ANONYMOUS_SESSION_TOOL_NAME as g,SUBMIT_FEEDBACK_TOOL_NAME as b}from"../constants.js";import{GRAPHQL_TYPE_KINDS as l,GRAPHQL_LIST_SCOPES as v}from"./tools/graphql/constants.js";import{OPERATION_METHODS as c}from"./tools/openapi/constants.js";const i={type:"string",nullable:!0},s={limit:{type:"number"},total:{type:"number"},page:{type:"number"},totalPages:{type:"number"}},a={codemodeType:"OpenApiServer[]"},o={codemodeType:"OpenApiSecurityRequirement[]"},u={codemodeType:"Record<string, OpenApiSecurityScheme>"},P={codemodeType:"OpenApiDocument"},A={codemodeType:"OpenApiOperation & { path: string; method: string }"},S={codemodeType:"OpenApiComponents",description:"Components the endpoint references. A `$ref` in `endpoint` resolves against the root of the result."},n={filePath:{type:"string",description:"API definition file path"},otherMatches:{type:"array",description:"Other API definitions the lookup also matched. Present only when several matched; pass `filePath` to pick another one",items:{type:"object",required:["filePath"],properties:{version:{type:"string"},filePath:{type:"string"}}}}},r="When several definitions match the name, the highest version or the shortest file path is used and the rest are listed in `otherMatches`; tell the user which version or file the answer is based on.",H="A `$ref` in `endpoint` points into the `components` key at the root of the result: read `#/components/<section>/<name>` there.",L={type:"object",additionalProperties:!1,required:[],properties:{filter:{type:"string",description:"Matches part of an API name, or of a description when no name matches",minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of APIs per page. Default is 300",minimum:1,default:300,nullable:!0}}},p={type:"object",required:[],additionalProperties:!1,properties:{name:{type:"string",description:"API name, or a unique part of it. Omit when `filePath` is given.",minLength:1,nullable:!0},apiName:{type:"string",description:"Alias of `name`",nullable:!0},api:{type:"string",description:"Alias of `name`",nullable:!0},version:{type:"string",description:"API version. When omitted and several versions exist, the highest one is used",nullable:!0},filePath:{type:"string",description:"API definition file path, as returned by `listApis`",nullable:!0}}},q={type:"object",required:["path","method"],additionalProperties:!1,properties:{name:{type:"string",description:"API name, or a unique part of it. Omit when `filePath` is given.",minLength:1,nullable:!0},apiName:{type:"string",description:"Alias of `name`",nullable:!0},api:{type:"string",description:"Alias of `name`",nullable:!0},path:{type:"string",description:"Endpoint path (e.g. /api/v1/users)",minLength:1},method:{type:"string",description:"HTTP method (GET, POST, PUT, DELETE, etc.)",enum:[...c.map(e=>e.toUpperCase()),...c],minLength:1},version:{type:"string",description:"API version. When omitted and several versions exist, the highest one is used",nullable:!0},filePath:{type:"string",description:"API definition file path, as returned by `listApis`",nullable:!0}}},O={type:"object",required:[],additionalProperties:!1,properties:{}},T={type:"object",required:[],additionalProperties:!1,properties:{}},G={type:"object",required:["path","summary"],additionalProperties:!1,properties:{path:{type:"string",description:"Path or URL of the documentation page the feedback is about (e.g. /guides/auth)",minLength:1,maxLength:1e3},summary:{type:"string",description:"One sentence that names what is wrong with the page",minLength:1,maxLength:500},details:{type:"string",description:"Expected versus actual behavior, missing steps, or the snippet that failed",maxLength:4e3,nullable:!0},targetFeature:{type:"string",description:"The API or feature the page documents",maxLength:500,nullable:!0}}};function I(e){const t=[{name:"list-apis",title:"List APIs",description:"Lists the APIs documented in this project",schema:L,annotations:{readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",required:["items","limit","total","page","totalPages"],properties:{items:{type:"array",items:{type:"object",required:["name","description","version","servers","filePath"],properties:{name:{type:"string"},description:{type:"string"},version:{type:"string"},servers:a,filePath:{type:"string",description:"API definition file path"},ambiguousTitle:{type:"boolean",description:"true = another API shares this title; a lookup picks the highest version, or the shortest file path at the same version, and lists the rest in `otherMatches`. Pass `filePath` to pick another one"},...e.hasCallableApis?{callable:{type:"boolean",description:"true = the documented hosts of this API are reachable via `fetch`; false = documentation only"}}:{}}}},...s}}},{name:"get-endpoints",title:"Get endpoints",description:`Get all endpoints for a specific API. ${r}`,schema:p,annotations:{readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",required:["api","version","filePath","servers","endpoints"],properties:{api:{type:"string"},version:{type:"string"},...n,servers:a,endpoints:{type:"array",items:{type:"object",required:["path","method"],properties:{path:{type:"string"},method:{type:"string"},summary:i,description:i,security:o}}}}}},{name:"get-endpoint-info",title:"Get endpoint info",description:`Get comprehensive information about specific endpoint including parameters, security, and examples. ${H} ${r}`,schema:q,annotations:{readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",required:["api","version","filePath","servers","endpoint","globalSecurity","securitySchemes"],properties:{api:{type:"string"},version:{type:"string"},...n,servers:a,endpoint:A,globalSecurity:o,securitySchemes:u,components:S}}},{name:"get-security-schemes",title:"Get security schemes",description:`Get the security schemes for a specific API. ${r}`,schema:p,annotations:{readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",required:["api","version","filePath","securitySchemes","security"],properties:{api:{type:"string"},version:{type:"string"},...n,securitySchemes:u,security:o}}},{name:"get-full-api-description",title:"Get full API description",description:`Get the complete OpenAPI description. ${r}`,schema:p,annotations:{readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",required:["api","version","filePath","definition"],properties:{api:{type:"string"},version:{type:"string"},...n,definition:P}}},...y?[d(e.products,e.locales)]:[]];return f(e.requiresLogin,e.rbac)&&t.push({name:"whoami",title:"Who am I",description:"Get information about the currently authenticated user",schema:O,annotations:{readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{email:{type:"string"},name:{type:"string"},subject:{type:"string"},clientId:{type:"string"},scope:{type:"string"},issuedAt:{type:"string"},expiresAt:{type:"string"}}}}),e.feedbackHidden||t.push({name:b,title:"Submit feedback",description:"Report a documentation page that is wrong or incomplete",schema:G,annotations:{readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},outputSchema:{type:"object",required:["status","page","message"],properties:{status:{type:"string"},page:{type:"string"},message:{type:"string"}}}}),e.hasGraphqlApis&&t.push(...k()),e.elicitationEnabled&&e.hasCallableApis&&t.push({name:g,title:"Create anonymous session",description:"Create an anonymous session handle for storing upstream API credentials. Pass the returned sessionHandle to execute when an API needs credentials and the caller is not signed in. Treat it as a secret and reuse it across calls.",schema:T,annotations:{readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},outputSchema:{type:"object",required:["sessionHandle"],properties:{sessionHandle:{type:"string"}}}}),t}const w={type:"object",required:[],additionalProperties:!1,properties:{filter:{type:"string",description:"GraphQL schema name (or part of it)",minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of results per page. Default is 300",minimum:1,default:300,nullable:!0}}},j={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1},kind:{type:"string",description:'Optional: return only a single category of schema members. With scope "fields", restricts to the fields of that parent category ("objects", "interfaces", or "inputs" only).',enum:[...l,null],nullable:!0},scope:{type:"string",description:'Optional: what each list item is. "members" (default) lists top-level types and operations. "fields" flattens every field of every object/interface/input type into "ParentType.fieldName" entries with their descriptions \u2014 combine with `filter` to search nested fields anywhere in the schema.',enum:[...v,null],nullable:!0},filter:{type:"string",description:'Optional: only members whose name or description contains this substring, case-insensitive (e.g. "custom tags")',minLength:1,nullable:!0},referencesType:{type:"string",description:'Optional: only members that reference this type directly or transitively (via return, field, argument, union-member or input-field types). Finds cross-cutting members that never name it \u2014 e.g. referencesType "Book" surfaces a search query returning a union that includes Book.',minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of results per page. Default is 300",minimum:1,default:300,nullable:!0}}},E={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1},type:{type:"string",description:"Name of the type, operation, or directive",minLength:1,nullable:!0},typeName:{type:"string",description:"Alias of `type`",nullable:!0},includeReferencedTypes:{type:"boolean",description:"Also include the SDL of every type referenced transitively. Gives the whole subgraph at once, but can be large for highly-connected types.",default:!1,nullable:!0}}},N={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1}}};function k(){return[{name:"list-graphql-apis",title:"List GraphQL APIs",description:"Lists available GraphQL schemas with their context and purpose",schema:w,annotations:{readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",required:["items","limit","total","page","totalPages"],properties:{items:{type:"array",items:{type:"object",required:["name"],properties:{name:{type:"string"},description:i}}},...s}}},{name:"get-graphql-type-list",title:"Get GraphQL type list",description:'List all operations and types in a GraphQL schema as a flat, paginated list. Each item is tagged with its kind (query, object, enum, \u2026) and carries a one-line description; operations also include their return type and argument signature \u2014 use it to decide which members to fetch in detail. Narrow the result with `kind` (one category), `filter` (case-insensitive substring of the member name or description, e.g. "book"), or `referencesType` (only members that use a given type, directly or transitively) to explore a domain cheaply instead of pulling the full schema. To search nested fields \u2014 not just type names \u2014 set scope "fields": it flattens every field of every object/interface/input type into "ParentType.fieldName" entries with their descriptions, so `filter` finds things like an input field whose docstring mentions your keyword.',schema:j,annotations:{readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",required:["name","items","limit","total","page","totalPages"],properties:{name:{type:"string"},items:{type:"array",items:{type:"object",required:["kind","name"],properties:{kind:{type:"string",enum:l},name:{type:"string"},description:i,type:{type:"string"},args:{type:"string"},directives:{type:"string"}}}},...s}}},{name:"get-graphql-type",title:"Get GraphQL type",description:'Get the SDL for a single GraphQL type, operation (query/mutation/subscription field), or directive. Without includeReferencedTypes, the SDL is followed by a one-level manifest of every directly referenced type\'s field names (e.g. "input ActionOperationInput { addTags, removeTags }"), so you can see what nested types contain before fetching them. Set includeReferencedTypes to instead pull in the full SDL of every type it references transitively \u2014 the whole structural subgraph in one call, ideal for complete exploration of an entity (e.g. Book and all the types it touches). That traversal only follows what the target depends on; to go the other direction and find the members that use a type, call get-graphql-type-list with `referencesType`.',schema:E,annotations:{readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"string"}},{name:"get-graphql-schema",title:"Get GraphQL schema",description:"Get the complete GraphQL schema as SDL \u2014 the whole type graph in one call. Returns everything, so it can be very large and token-expensive for big schemas; prefer get-graphql-type-list (filter/paginate) plus targeted get-graphql-type calls, and reach for this only for small schemas or when you truly need the full SDL.",schema:N,annotations:{readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"string"}}]}function d(e,t){const h=e&&e.length>0,m=t&&t.length>0;return{name:"search",title:"Search documentation",description:"Search across the documentation to fetch relevant content for a given query",schema:{type:"object",required:["query"],additionalProperties:!1,properties:{query:{type:"string",description:"Search query. Should be a single word or that phrase that is presented in a documentation.",minLength:1},...h?{product:{type:"string",description:"Optional product name to filter search results by specific product.",enum:[...e,null],nullable:!0}}:{},...m?{locale:{type:"string",description:"Optional locale code to filter search results by documentation language (e.g. 'en', 'ja'). Use the locale matching the language of the user's request. Defaults to the project's default locale.",enum:[...t,null],nullable:!0}}:{}}},annotations:{readOnlyHint:!0,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},outputSchema:{type:"string"}}}const Q=new Set([...I({requiresLogin:!0,hasGraphqlApis:!0,elicitationEnabled:!0,hasCallableApis:!0}).map(e=>e.name),d().name]);export{Q as ALL_DEFAULT_TOOL_NAMES,I as getDefaultToolSchemas};
+import{SEMANTIC_SEARCH_API_URL as y}from"../../../constants/common.js";import{shouldHandleMcpAuth as f}from"../../../utils/rbac/should-handle-mcp-auth.js";import{CREATE_ANONYMOUS_SESSION_TOOL_NAME as g,SUBMIT_FEEDBACK_TOOL_NAME as b}from"../constants.js";import{GRAPHQL_TYPE_KINDS as l,GRAPHQL_LIST_SCOPES as v}from"./tools/graphql/constants.js";import{OPERATION_METHODS as c}from"./tools/openapi/constants.js";const i={type:"string",nullable:!0},s={limit:{type:"number"},total:{type:"number"},page:{type:"number"},totalPages:{type:"number"}},a={codemodeType:"OpenApiServer[]"},o={codemodeType:"OpenApiSecurityRequirement[]"},u={codemodeType:"Record<string, OpenApiSecurityScheme>"},P={codemodeType:"OpenApiDocument"},A={codemodeType:"OpenApiOperation & { path: string; method: string }"},S={codemodeType:"OpenApiComponents",description:"Components the endpoint references. A `$ref` in `endpoint` resolves against the root of the result."},n={filePath:{type:"string",description:"API definition file path"},otherMatches:{type:"array",description:"Other API definitions the lookup also matched. Present only when several matched; pass `filePath` to pick another one",items:{type:"object",required:["filePath"],properties:{version:{type:"string"},filePath:{type:"string"}}}}},r="When several definitions match the name, the highest version or the shortest file path is used and the rest are listed in `otherMatches`; tell the user which version or file the answer is based on.",H="A `$ref` in `endpoint` points into the `components` key at the root of the result: read `#/components/<section>/<name>` there.",L={type:"object",additionalProperties:!1,required:[],properties:{filter:{type:"string",description:"Matches part of an API name, or of a description when no name matches",minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of APIs per page. Default is 300",minimum:1,default:300,nullable:!0}}},p={type:"object",required:[],additionalProperties:!1,properties:{name:{type:"string",description:"API name, or a unique part of it. Omit when `filePath` is given.",minLength:1,nullable:!0},apiName:{type:"string",description:"Alias of `name`",nullable:!0},api:{type:"string",description:"Alias of `name`",nullable:!0},version:{type:"string",description:"API version. When omitted and several versions exist, the highest one is used",nullable:!0},filePath:{type:"string",description:"API definition file path, as returned by `listApis`",nullable:!0}}},q={type:"object",required:["path","method"],additionalProperties:!1,properties:{name:{type:"string",description:"API name, or a unique part of it. Omit when `filePath` is given.",minLength:1,nullable:!0},apiName:{type:"string",description:"Alias of `name`",nullable:!0},api:{type:"string",description:"Alias of `name`",nullable:!0},path:{type:"string",description:"Endpoint path (e.g. /api/v1/users)",minLength:1},method:{type:"string",description:"HTTP method (GET, POST, PUT, DELETE, etc.)",enum:[...c.map(e=>e.toUpperCase()),...c],minLength:1},version:{type:"string",description:"API version. When omitted and several versions exist, the highest one is used",nullable:!0},filePath:{type:"string",description:"API definition file path, as returned by `listApis`",nullable:!0}}},O={type:"object",required:[],additionalProperties:!1,properties:{}},T={type:"object",required:[],additionalProperties:!1,properties:{}},G={type:"object",required:["path","summary"],additionalProperties:!1,properties:{path:{type:"string",description:"Path or URL of the documentation page the feedback is about (e.g. /guides/auth)",minLength:1,maxLength:1e3},summary:{type:"string",description:"One sentence that names what is wrong with the page",minLength:1,maxLength:500},details:{type:"string",description:"Expected versus actual behavior, missing steps, or the snippet that failed",maxLength:4e3,nullable:!0},targetFeature:{type:"string",description:"The API or feature the page documents",maxLength:500,nullable:!0}}};function I(e){const t=[{name:"list-apis",title:"List APIs",description:"Lists the APIs documented in this project",schema:L,annotations:{readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",required:["items","limit","total","page","totalPages"],properties:{items:{type:"array",items:{type:"object",required:["name","description","version","servers","filePath"],properties:{name:{type:"string"},description:{type:"string"},version:{type:"string"},servers:a,filePath:{type:"string",description:"API definition file path"},ambiguousTitle:{type:"boolean",description:"true = another API shares this title; a lookup picks the highest version, or the shortest file path at the same version, and lists the rest in `otherMatches`. Pass `filePath` to pick another one"},...e.hasCallableApis?{callable:{type:"boolean",description:"true = the documented hosts of this API are reachable via `fetch`; false = documentation only"}}:{}}}},...s}}},{name:"get-endpoints",title:"Get endpoints",description:`Get all endpoints for a specific API. ${r}`,schema:p,annotations:{readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",required:["api","version","filePath","servers","endpoints"],properties:{api:{type:"string"},version:{type:"string"},...n,servers:a,endpoints:{type:"array",items:{type:"object",required:["path","method"],properties:{path:{type:"string"},method:{type:"string"},summary:i,description:i,security:o}}}}}},{name:"get-endpoint-info",title:"Get endpoint info",description:`Get comprehensive information about specific endpoint including parameters, security, and examples. ${H} ${r}`,schema:q,annotations:{readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",required:["api","version","filePath","servers","endpoint","globalSecurity","securitySchemes"],properties:{api:{type:"string"},version:{type:"string"},...n,servers:a,endpoint:A,globalSecurity:o,securitySchemes:u,components:S}}},{name:"get-security-schemes",title:"Get security schemes",description:`Get the security schemes for a specific API. ${r}`,schema:p,annotations:{readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",required:["api","version","filePath","securitySchemes","security"],properties:{api:{type:"string"},version:{type:"string"},...n,securitySchemes:u,security:o}}},{name:"get-full-api-description",title:"Get full API description",description:`Get the complete OpenAPI description. ${r}`,schema:p,annotations:{readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",required:["api","version","filePath","definition"],properties:{api:{type:"string"},version:{type:"string"},...n,definition:P}}},...y?[d(e.products,e.locales)]:[]];return f(e.requiresLogin,e.rbac)&&t.push({name:"whoami",title:"Who am I",description:"Get information about the currently authenticated user",schema:O,annotations:{readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",required:["authenticated"],properties:{authenticated:{type:"boolean"},email:{type:"string"},name:{type:"string"},subject:{type:"string"},clientId:{type:"string"},scope:{type:"string"},issuedAt:{type:"string"},expiresAt:{type:"string"}}}}),e.feedbackHidden||t.push({name:b,title:"Submit feedback",description:"Report a documentation page that is wrong or incomplete",schema:G,annotations:{readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},outputSchema:{type:"object",required:["status","page","message"],properties:{status:{type:"string"},page:{type:"string"},message:{type:"string"}}}}),e.hasGraphqlApis&&t.push(...k()),e.elicitationEnabled&&e.hasCallableApis&&t.push({name:g,title:"Create anonymous session",description:"Create an anonymous session handle for storing upstream API credentials. Pass the returned sessionHandle to execute when an API needs credentials and the caller is not signed in. Treat it as a secret and reuse it across calls.",schema:T,annotations:{readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},outputSchema:{type:"object",required:["sessionHandle"],properties:{sessionHandle:{type:"string"}}}}),t}const w={type:"object",required:[],additionalProperties:!1,properties:{filter:{type:"string",description:"GraphQL schema name (or part of it)",minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of results per page. Default is 300",minimum:1,default:300,nullable:!0}}},j={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1},kind:{type:"string",description:'Optional: return only a single category of schema members. With scope "fields", restricts to the fields of that parent category ("objects", "interfaces", or "inputs" only).',enum:[...l,null],nullable:!0},scope:{type:"string",description:'Optional: what each list item is. "members" (default) lists top-level types and operations. "fields" flattens every field of every object/interface/input type into "ParentType.fieldName" entries with their descriptions \u2014 combine with `filter` to search nested fields anywhere in the schema.',enum:[...v,null],nullable:!0},filter:{type:"string",description:'Optional: only members whose name or description contains this substring, case-insensitive (e.g. "custom tags")',minLength:1,nullable:!0},referencesType:{type:"string",description:'Optional: only members that reference this type directly or transitively (via return, field, argument, union-member or input-field types). Finds cross-cutting members that never name it \u2014 e.g. referencesType "Book" surfaces a search query returning a union that includes Book.',minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of results per page. Default is 300",minimum:1,default:300,nullable:!0}}},E={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1},type:{type:"string",description:"Name of the type, operation, or directive",minLength:1,nullable:!0},typeName:{type:"string",description:"Alias of `type`",nullable:!0},includeReferencedTypes:{type:"boolean",description:"Also include the SDL of every type referenced transitively. Gives the whole subgraph at once, but can be large for highly-connected types.",default:!1,nullable:!0}}},N={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1}}};function k(){return[{name:"list-graphql-apis",title:"List GraphQL APIs",description:"Lists available GraphQL schemas with their context and purpose",schema:w,annotations:{readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",required:["items","limit","total","page","totalPages"],properties:{items:{type:"array",items:{type:"object",required:["name"],properties:{name:{type:"string"},description:i}}},...s}}},{name:"get-graphql-type-list",title:"Get GraphQL type list",description:'List all operations and types in a GraphQL schema as a flat, paginated list. Each item is tagged with its kind (query, object, enum, \u2026) and carries a one-line description; operations also include their return type and argument signature \u2014 use it to decide which members to fetch in detail. Narrow the result with `kind` (one category), `filter` (case-insensitive substring of the member name or description, e.g. "book"), or `referencesType` (only members that use a given type, directly or transitively) to explore a domain cheaply instead of pulling the full schema. To search nested fields \u2014 not just type names \u2014 set scope "fields": it flattens every field of every object/interface/input type into "ParentType.fieldName" entries with their descriptions, so `filter` finds things like an input field whose docstring mentions your keyword.',schema:j,annotations:{readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",required:["name","items","limit","total","page","totalPages"],properties:{name:{type:"string"},items:{type:"array",items:{type:"object",required:["kind","name"],properties:{kind:{type:"string",enum:l},name:{type:"string"},description:i,type:{type:"string"},args:{type:"string"},directives:{type:"string"}}}},...s}}},{name:"get-graphql-type",title:"Get GraphQL type",description:'Get the SDL for a single GraphQL type, operation (query/mutation/subscription field), or directive. Without includeReferencedTypes, the SDL is followed by a one-level manifest of every directly referenced type\'s field names (e.g. "input ActionOperationInput { addTags, removeTags }"), so you can see what nested types contain before fetching them. Set includeReferencedTypes to instead pull in the full SDL of every type it references transitively \u2014 the whole structural subgraph in one call, ideal for complete exploration of an entity (e.g. Book and all the types it touches). That traversal only follows what the target depends on; to go the other direction and find the members that use a type, call get-graphql-type-list with `referencesType`.',schema:E,annotations:{readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"string"}},{name:"get-graphql-schema",title:"Get GraphQL schema",description:"Get the complete GraphQL schema as SDL \u2014 the whole type graph in one call. Returns everything, so it can be very large and token-expensive for big schemas; prefer get-graphql-type-list (filter/paginate) plus targeted get-graphql-type calls, and reach for this only for small schemas or when you truly need the full SDL.",schema:N,annotations:{readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"string"}}]}function d(e,t){const h=e&&e.length>0,m=t&&t.length>0;return{name:"search",title:"Search documentation",description:"Search across the documentation to fetch relevant content for a given query",schema:{type:"object",required:["query"],additionalProperties:!1,properties:{query:{type:"string",description:"Search query. Should be a single word or that phrase that is presented in a documentation.",minLength:1},...h?{product:{type:"string",description:"Optional product name to filter search results by specific product.",enum:[...e,null],nullable:!0}}:{},...m?{locale:{type:"string",description:"Optional locale code to filter search results by documentation language (e.g. 'en', 'ja'). Use the locale matching the language of the user's request. Defaults to the project's default locale.",enum:[...t,null],nullable:!0}}:{}}},annotations:{readOnlyHint:!0,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},outputSchema:{type:"string"}}}const Q=new Set([...I({requiresLogin:!0,hasGraphqlApis:!0,elicitationEnabled:!0,hasCallableApis:!0}).map(e=>e.name),d().name]);export{Q as ALL_DEFAULT_TOOL_NAMES,I as getDefaultToolSchemas};

package/dist/server/plugins/mcp/docs-mcp/tools/core/utils.js

@@ -1,6 +1,6 @@
 import c from"node:fs";import f from"node:path";import{MAX_DOCUMENTS_PER_CATEGORY as $}from"../../../constants.js";function j(m,u){return Object.entries(m).map(([h,s])=>{if(!s||s.length===0)return"";const x=s.slice(0,$).map(d=>{const{document:t,highlight:o}=d,p=o?.title||(Array.isArray(t.title)?t.title[0]:t.title);let n=`Document: ${t.title}`;n+=`### [${p}](${t.url})
 
-`;let r;if(t.url)try{let e=t.url.startsWith("/")?t.url.slice(1):t.url;const i=e.indexOf("#");i!==-1&&(e=e.substring(0,i));const l=f.extname(e);l&&(e=e.slice(0,-l.length));let y=e+".md";const a=f.join(u,y);c.existsSync(a)&&(r=c.readFileSync(a,"utf8"))}catch{}return r||(r=o?.text||(Array.isArray(t.text)?t.text[0]:t.text)),n+=r,t.facets&&(n+=`
+`;let r;if(t.url)try{let e=t.url.startsWith("/")?t.url.slice(1):t.url;const i=e.indexOf("#");i!==-1&&(e=e.substring(0,i));const l=f.extname(e);l&&(e=e.slice(0,-l.length));const y=e+".md",a=f.join(u,y);c.existsSync(a)&&(r=c.readFileSync(a,"utf8"))}catch{}return r||(r=o?.text||(Array.isArray(t.text)?t.text[0]:t.text)),n+=r,t.facets&&(n+=`
 
 **Categories:**
 `,Object.entries(t.facets).forEach(([e,i])=>{n+=`- ${e}: ${i}

package/dist/server/plugins/mcp/docs-mcp/tools/core/whoami.js

@@ -1 +1 @@
-const s=async(i,e)=>e.user?.isAuthenticated?{content:[{type:"text",text:JSON.stringify({email:e.user.email,name:e.user.claims?.name,subject:e.user.claims?.sub,clientId:e.user.claims?.client_id,scope:e.user.claims?.scope,issuedAt:e.user.claims?.iat?new Date(Number(e.user.claims.iat)*1e3).toISOString():void 0,expiresAt:e.user.claims?.exp?new Date(Number(e.user.claims.exp)*1e3).toISOString():void 0})}],isError:!1}:{content:[{type:"text",text:JSON.stringify({error:"Not authenticated",message:"No valid authentication token found. Please authenticate first."})}],isError:!0};var r={whoami:s};export{r as default};
+const s=async(i,e)=>e.user?.isAuthenticated?{content:[{type:"text",text:JSON.stringify({authenticated:!0,email:e.user.email,name:e.user.claims?.name,subject:e.user.claims?.sub,clientId:e.user.claims?.client_id,scope:e.user.claims?.scope,issuedAt:e.user.claims?.iat?new Date(Number(e.user.claims.iat)*1e3).toISOString():void 0,expiresAt:e.user.claims?.exp?new Date(Number(e.user.claims.exp)*1e3).toISOString():void 0})}]}:{content:[{type:"text",text:JSON.stringify({authenticated:!1})}]};var a={whoami:s};export{a as default};

package/dist/server/plugins/mcp/docs-mcp/tools/openapi/list-apis.js

@@ -1 +1 @@
-import{isFetchCapable as h}from"../../../gateway-mcp/callable-apis.js";import{filterApiDescriptionsByName as b}from"../../utils/api-name-matching.js";import{apiTitleKey as y,countApiTitles as T,orderSharedTitles as x}from"../../utils/api-titles.js";const A=async(r,i)=>{const{filter:s,page:l=1,limit:e=300}=r,c=h(i),a=x(Object.values(i.apiDescriptionsMap)),p=T(a);let t=a;s&&(t=b(t,s));const n=(l-1)*e,m=n+e,u=Math.ceil(t.length/e),f=t.length;return t=t.slice(n,m),{content:[{type:"text",text:JSON.stringify({items:t.map(({relativePath:d,fetchEligible:g,...o})=>({filePath:d,...o,...(p.get(y(o.name))??0)>1?{ambiguousTitle:!0}:{},...c?{callable:g===!0}:{}})),limit:e,total:f,page:l,totalPages:u})}]}};var M={"list-apis":A};export{M as default};
+import{getCallableApis as b}from"../../../gateway-mcp/callable-apis.js";import{filterApiDescriptionsByName as d}from"../../utils/api-name-matching.js";import{apiTitleKey as y,countApiTitles as A,orderSharedTitles as T}from"../../utils/api-titles.js";const x=async(r,l)=>{const{filter:s,page:a=1,limit:e=300}=r,n=new Set(b(l).map(i=>i.relativePath)),m=n.size>0,o=T(Object.values(l.apiDescriptionsMap)),f=A(o);let t=o;s&&(t=d(t,s));const c=(a-1)*e,u=c+e,g=Math.ceil(t.length/e),h=t.length;return t=t.slice(c,u),{content:[{type:"text",text:JSON.stringify({items:t.map(({relativePath:i,fetchEligible:D,...p})=>({filePath:i,...p,...(f.get(y(p.name))??0)>1?{ambiguousTitle:!0}:{},...m?{callable:n.has(i)}:{}})),limit:e,total:h,page:a,totalPages:g})}]}};var I={"list-apis":x};export{I as default};

package/dist/server/plugins/mcp/docs-mcp/tools/openapi/utils.d.ts

@@ -8,13 +8,22 @@ type EndpointInfo = Pick<OpenAPIOperation, 'summary' | 'description' | 'security
     path: string;
 };
 export declare function getEndpointsFromPaths(def: OpenAPIDefinition): EndpointInfo[];
-export declare function getApiDescriptionFromFs({ relativePath, outdir, user, rbac, requiresLogin, }: {
-    relativePath: string;
-    outdir: string;
+type ApiDescriptionAccess = {
     user: ApiFunctionsUser;
     rbac?: RbacConfig;
     requiresLogin?: boolean;
+};
+export declare function getApiDescriptionFromFs({ relativePath, outdir, ...access }: ApiDescriptionAccess & {
+    relativePath: string;
+    outdir: string;
 }): Promise<OpenAPIDefinition | undefined>;
+/** The bundled description with no RBAC filtering; never return it to a caller. */
+export declare function readApiDescriptionFromFs(relativePath: string, outdir: string): Promise<OpenAPIDefinition | undefined>;
+/**
+ * A filtered copy of `definition` holding only what the user can read, or undefined when the user
+ * can read none of it; the input is not mutated.
+ */
+export declare function filterApiDescriptionByAccess(definition: OpenAPIDefinition, { user, rbac, requiresLogin }: ApiDescriptionAccess): OpenAPIDefinition | undefined;
 export declare function absolutePath(requestedPath: string): string;
 /** Models copy a path and lose its casing; the definition's own spelling still answers. */
 export declare function matchDocumentedPath(description: OpenAPIDefinition, requestedPath: string): string;

package/dist/server/plugins/mcp/docs-mcp/tools/openapi/utils.js

@@ -1 +1 @@
-import m from"node:path";import{existsSync as f}from"node:fs";import{readFile as u}from"node:fs/promises";import{replaceFileExtension as d}from"../../../../../plugins/api-docs/utils/replace-file-extension.js";import{PUBLIC_API_DEFINITIONS_FOLDER as h}from"../../../../../constants/common.js";import{filterDataByAccessDeep as l}from"../../../../../utils/rbac.js";import{isEndpointHidden as c}from"../../../utils/xmcp-utils.js";import{HTTP_METHODS as x}from"./constants.js";function y(t){return!t||c(t,"docs")?[]:Object.entries(t).filter(r=>{const[e,o]=r;return x.has(e.toLowerCase())&&typeof o=="object"&&o!==null&&!c(o,"docs")})}function P(t){const{paths:r={}}=t,e=[];for(const[o,i]of Object.entries(r))for(const[n,s]of y(i))e.push({path:o,method:n.toUpperCase(),summary:s.summary,description:s.description,security:s.security});return e}async function I({relativePath:t,outdir:r,user:e,rbac:o={},requiresLogin:i=!1}){const n=m.join(r||"",h,d(t,".json"));if(!f(n))return;const a=await u(n,"utf-8"),p=JSON.parse(a);return l(p,{isAuthenticated:e?.isAuthenticated,email:e?.email,teams:e?.teams},o,i)}function D(t){return t.startsWith("/")?t:`/${t}`}function S(t,r){const e=D(r);if(t.paths?.[e])return e;const o=e.toLowerCase();return Object.keys(t.paths??{}).find(n=>n.toLowerCase()===o)??e}export{D as absolutePath,I as getApiDescriptionFromFs,P as getEndpointsFromPaths,S as matchDocumentedPath,y as visibleOperations};
+import a from"node:path";import{existsSync as p}from"node:fs";import{readFile as m}from"node:fs/promises";import{replaceFileExtension as f}from"../../../../../plugins/api-docs/utils/replace-file-extension.js";import{PUBLIC_API_DEFINITIONS_FOLDER as u}from"../../../../../constants/common.js";import{filterDataByAccessDeep as d}from"../../../../../utils/rbac.js";import{isEndpointHidden as c}from"../../../utils/xmcp-utils.js";import{HTTP_METHODS as h}from"./constants.js";function l(t){return!t||c(t,"docs")?[]:Object.entries(t).filter(o=>{const[e,r]=o;return h.has(e.toLowerCase())&&typeof r=="object"&&r!==null&&!c(r,"docs")})}function L(t){const{paths:o={}}=t,e=[];for(const[r,s]of Object.entries(o))for(const[n,i]of l(s))e.push({path:r,method:n.toUpperCase(),summary:i.summary,description:i.description,security:i.security});return e}async function P({relativePath:t,outdir:o,...e}){const r=await y(t,o);return r&&x(r,e)}async function y(t,o){const e=a.join(o||"",u,f(t,".json"));if(p(e))return JSON.parse(await m(e,"utf-8"))}function x(t,{user:o,rbac:e={},requiresLogin:r=!1}){return d(t,{isAuthenticated:o?.isAuthenticated,email:o?.email,teams:o?.teams},e,r)}function D(t){return t.startsWith("/")?t:`/${t}`}function I(t,o){const e=D(o);if(t.paths?.[e])return e;const r=e.toLowerCase();return Object.keys(t.paths??{}).find(n=>n.toLowerCase()===r)??e}export{D as absolutePath,x as filterApiDescriptionByAccess,P as getApiDescriptionFromFs,L as getEndpointsFromPaths,I as matchDocumentedPath,y as readApiDescriptionFromFs,l as visibleOperations};

package/dist/server/plugins/mcp/docs-mcp/utils/resolve-refs.d.ts

@@ -1,5 +1,7 @@
 import type { OpenAPIParameter, Referenced, OpenAPIDefinition } from '@redocly/api-docs';
 import type { McpEndpoint } from '../../types.js';
+import { resolveRef } from '@redocly/api-docs/lib/utils/inline-openapi-refs.js';
+export { resolveRef };
 type JsonValue = string | number | boolean | null | JsonValue[] | {
     [key: string]: JsonValue;
 };
@@ -10,7 +12,6 @@ export type ResolvedOperation = {
     operation: JsonObject;
     components?: Record<string, JsonObject>;
 };
-export declare function resolveRef<T>(ref: string, def?: OpenAPIDefinition): T | undefined;
 type ResolveOperationParams = {
     operation: McpEndpoint;
     pathParams: Referenced<OpenAPIParameter>[];
@@ -22,5 +23,4 @@ export declare function resolveOperation({ operation, pathParams, definition, }:
  * `maxBytes` or the inliner cannot read the operation.
  */
 export declare function inlineOperation({ operation, pathParams, definition }: ResolveOperationParams, maxBytes: number): ResolvedOperation | undefined;
-export {};
 //# sourceMappingURL=resolve-refs.d.ts.map

package/dist/server/plugins/mcp/docs-mcp/utils/resolve-refs.js

@@ -1 +1 @@
-const S=/^#\/components\/([^/]+)\/([^/]+)(\/.*)?$/;function w(e){return e.replace(/~1/g,"/").replace(/~0/g,"~")}function d(e,s){if(!s||!e?.startsWith("#/"))return;const n=e.slice(2).split("/").map(w);let t=s;for(const r of n)if(typeof t=="object"&&t!==null&&r in t)t=t[r];else return;return t}function h(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function O(e,s){const n={},t=new Set,r=new Set,o=[e];for(;o.length>0;){const c=o.pop();if(!(c===null||typeof c!="object")){if(h(c)&&typeof c.$ref=="string"&&!t.has(c.$ref)){t.add(c.$ref);const[,i,f]=S.exec(c.$ref)??[],u=f&&w(f);if(i&&u&&!r.has(`${i}/${u}`)){const l=d(`#/components/${i}/${f}`,s);l!==void 0&&(r.add(`${i}/${u}`),(n[i]??={})[u]=l,o.push(l))}}for(const i of Object.values(c))o.push(i)}}return Object.keys(n).length>0?n:void 0}function R(e,s){const n=h(e)&&typeof e.$ref=="string"?d(e.$ref,s)??e:e,{name:t,in:r}=h(n)?n:{};return typeof t=="string"&&typeof r=="string"?`${r}:${t}`:JSON.stringify(e)}function g(e,s,n){const t=new Map;for(const r of[...e,...s])r&&t.set(R(r,n),r);return[...t.values()]}function C({operation:e,pathParams:s,definition:n}){const t={...e,parameters:g(s,e.parameters??[],n)};return{operation:t,components:O(t,n)}}class E extends Error{}function j(e,s){if(e.remainingBytes-=s,e.remainingBytes<0)throw new E}function $(e,s){return j(e,JSON.stringify(s).length),s}function m(e,s,n){const t=d(e,s);if(t===void 0)return;const r=n.bytesByRef.get(e)??JSON.stringify(t).length;return n.bytesByRef.set(e,r),j(n,r),t}function y(e,s,n){const t=$(n,Object.fromEntries(Object.entries(e).filter(([r,o])=>r!=="$ref"&&o!==void 0)));return{...s,...t}}function a({schema:e,definition:s,budget:n,visitedRefs:t=new Set,maxDepth:r=50,currentDepth:o=0}){if(!e)return;if(o>=r)return $(n,{type:"object",description:`Maximum resolution depth exceeded (${r})`});if("$ref"in e&&e.$ref){if(t.has(e.$ref))return $(n,{type:"object",description:`Circular reference detected: ${e.$ref}`,"x-circular-ref":e.$ref});const f=new Set(t);f.add(e.$ref);const u=m(e.$ref,s,n);if(!u)return $(n,{type:"object",description:`Could not resolve reference: ${e.$ref}`,"x-unresolved-ref":e.$ref});const l=a({schema:u,definition:s,budget:n,visitedRefs:f,maxDepth:r,currentDepth:o+1});return l&&y(e,l,n)}const c={...e};if(c.properties){const f={};for(const[u,l]of Object.entries(c.properties)){const p=a({schema:l,definition:s,budget:n,visitedRefs:new Set(t),maxDepth:r,currentDepth:o+1});f[u]=p||l}c.properties=f}if(c.items&&typeof c.items=="object")if(Array.isArray(c.items))c.items=c.items.map(f=>a({schema:f,definition:s,budget:n,visitedRefs:new Set(t),maxDepth:r,currentDepth:o+1})||f);else{const f=a({schema:c.items,definition:s,budget:n,visitedRefs:new Set(t),maxDepth:r,currentDepth:o+1});f&&(c.items=f)}return["allOf","anyOf","oneOf"].forEach(f=>{const u=c[f];Array.isArray(u)&&(c[f]=u.reduce((l,p)=>{const v=a({schema:p,definition:s,budget:n,visitedRefs:new Set(t),maxDepth:r,currentDepth:o+1});return v&&l.push(v),l},[]))}),c}function P({pathParams:e,opParams:s,definition:n,budget:t}){return[...e,...s].reduce((r,o)=>{if(!o)return r;if("$ref"in o&&o.$ref){const c=m(o.$ref,n,t);if(!c)return r;const i=y(o,c,t);return r.push({...i,schema:"schema"in i&&i.schema?a({schema:i.schema,definition:n,budget:t}):void 0}),r}return r.push({...o,schema:"schema"in o&&o.schema?a({schema:o.schema,definition:n,budget:t}):void 0}),r},[])}function x(e,s,n){const t={...e};if(e.example!==void 0&&(t.example=e.example),!e.examples)return t;const r={};for(const[o,c]of Object.entries(e.examples))if("$ref"in c){const i=m(c.$ref,s,n);i&&(r[o]=i)}else r[o]=c;return t.examples=r,t}function A(e,s,n){if(!e)return;const t="$ref"in e&&e.$ref?m(e.$ref,s,n):e;if(!t)return;const r=y(e,t,n),o={...r};if("content"in r&&r.content){const c={};for(const[i,f]of Object.entries(r.content))c[i]={...x(f,s,n),schema:f.schema?a({schema:f.schema,definition:s,budget:n}):void 0};o.content=c}return o}function B(e,s,n){if(e)return Object.entries(e).reduce((t,[r,o])=>{const c="$ref"in o&&o.$ref?m(o.$ref,s,n):o;if(!c)return t;const i=y(o,c,n),f={...i};if("content"in i&&i.content){const u={};for(const[l,p]of Object.entries(i.content))u[l]={...x(p,s,n),schema:p.schema?a({schema:p.schema,definition:s,budget:n}):void 0};f.content=u}return t[r]=f,t},{})}function N({operation:e,pathParams:s,definition:n},t){const r={remainingBytes:t,bytesByRef:new Map};try{const o={...e,parameters:P({pathParams:s,opParams:e.parameters||[],definition:n,budget:r}),requestBody:A(e.requestBody,n,r),responses:B(e.responses,n,r)};return{operation:o,components:O(o,n)}}catch{return}}export{N as inlineOperation,C as resolveOperation,d as resolveRef};
+import{resolveParameters as y,resolveRef as p,resolveRequestBody as g,resolveResponses as m,unescapeJsonPointerToken as $}from"@redocly/api-docs/lib/utils/inline-openapi-refs.js";const h=/^#\/components\/([^/]+)\/([^/]+)(\/.*)?$/;function d(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function l(e,o){const n={},s=new Set,t=new Set,r=[e];for(;r.length>0;){const c=r.pop();if(!(c===null||typeof c!="object")){if(d(c)&&typeof c.$ref=="string"&&!s.has(c.$ref)){s.add(c.$ref);const[,f,i]=h.exec(c.$ref)??[],u=i&&$(i);if(f&&u&&!t.has(`${f}/${u}`)){const a=p(`#/components/${f}/${i}`,o);a!==void 0&&(t.add(`${f}/${u}`),(n[f]??={})[u]=a,r.push(a))}}for(const f of Object.values(c))r.push(f)}}return Object.keys(n).length>0?n:void 0}function b(e,o){const n=d(e)&&typeof e.$ref=="string"?p(e.$ref,o)??e:e,{name:s,in:t}=d(n)?n:{};return typeof s=="string"&&typeof t=="string"?`${t}:${s}`:JSON.stringify(e)}function O(e,o,n){const s=new Map;for(const t of[...e,...o])t&&s.set(b(t,n),t);return[...s.values()]}function x({operation:e,pathParams:o,definition:n}){const s={...e,parameters:O(o,e.parameters??[],n)};return{operation:s,components:l(s,n)}}class w extends Error{}function B(e){let o=e;const n=new Map;return(s,t)=>{let r=t===void 0?void 0:n.get(t);if(r===void 0&&(r=JSON.stringify(s).length,t!==void 0&&n.set(t,r)),o-=r,o<0)throw new w}}function R({operation:e,pathParams:o,definition:n},s){const t=B(s);try{const r={...e,parameters:y({pathParams:o,opParams:e.parameters||[],definition:n,charge:t}),requestBody:g(e.requestBody,n,t),responses:e.responses&&m(e.responses,n,t)};return{operation:r,components:l(r,n)}}catch{return}}export{R as inlineOperation,x as resolveOperation,p as resolveRef};

package/dist/server/plugins/mcp/gateway-mcp/allowed-http-methods.d.ts

@@ -0,0 +1,11 @@
+import type { RedoclyConfig } from '@redocly/config';
+export type ApiCallsConfig = NonNullable<NonNullable<RedoclyConfig['mcp']>['apiCalls']>;
+type ApiCallsHttpMethod = NonNullable<ApiCallsConfig['allowedHttpMethods']>[number];
+/** The methods agents may send when `mcp.apiCalls.allowedHttpMethods` is not set. */
+export declare const DEFAULT_ALLOWED_HTTP_METHODS: readonly ApiCallsHttpMethod[];
+/** Upper-case HTTP methods agents may send; read-only unless `redocly.yaml` allows more. */
+export declare function getAllowedHttpMethods(mcp: RedoclyConfig['mcp'] | undefined): string[];
+/** Whether every allowed method is safe by HTTP semantics (`GET`, `HEAD`, `OPTIONS`). */
+export declare function allowsOnlySafeHttpMethods(mcp: RedoclyConfig['mcp'] | undefined): boolean;
+export {};
+//# sourceMappingURL=allowed-http-methods.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/allowed-http-methods.js

@@ -0,0 +1 @@
+const o=["GET","HEAD","OPTIONS"],r={GET:!0,HEAD:!0,OPTIONS:!0};function T(t){return(t?.apiCalls?.allowedHttpMethods??o).map(e=>e.toUpperCase())}function p(t){return T(t).every(e=>r[e])}export{o as DEFAULT_ALLOWED_HTTP_METHODS,p as allowsOnlySafeHttpMethods,T as getAllowedHttpMethods};

package/dist/server/plugins/mcp/gateway-mcp/api-call-operations.d.ts

@@ -0,0 +1,32 @@
+import type { OpenAPIDefinition, OpenAPIServer } from '@redocly/api-docs';
+export type ApiCallOperation = {
+    pattern: RegExp;
+    /** Upper case. */
+    method: string;
+    /**
+     * False when `x-mcp.apiCalls.hide` or `x-mcp.docs.hide` on the path item or operation, or an
+     * `mcp.apiCalls.excludeOperations` entry, excludes it.
+     */
+    callable: boolean;
+    /**
+     * False when RBAC hides the operation from the caller. The bridge then answers as for an
+     * undocumented path, so the reply does not reveal that the operation exists.
+     */
+    visible: boolean;
+    /** Number of `{variable}` segments in the path; fewer is more specific. */
+    variables: number;
+};
+/** An `mcp.apiCalls.excludeOperations` entry of one API; no `method` excludes every method of `path`. */
+export type ExcludedOperation = {
+    method?: string;
+    path: string;
+};
+/**
+ * Every operation of the unfiltered `description`, with the ones missing from `visibleDescription`,
+ * the caller's RBAC-filtered copy, marked not visible. A hidden or `excluded` operation stays in the
+ * list, so a less specific template cannot claim its requests.
+ */
+export declare function apiCallOperationsOf(description: OpenAPIDefinition, visibleDescription: OpenAPIDefinition, servers: readonly OpenAPIServer[], excluded?: readonly ExcludedOperation[]): ApiCallOperation[];
+/** The documented operations that an upper-case `method` on `pathname` matches. */
+export declare function matchingApiCallOperations(operations: readonly ApiCallOperation[], pathname: string, method: string): ApiCallOperation[];
+//# sourceMappingURL=api-call-operations.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/api-call-operations.js

@@ -0,0 +1 @@
+import{OPERATION_METHODS as P}from"../docs-mcp/tools/openapi/constants.js";import{isEndpointHidden as u}from"../utils/xmcp-utils.js";import{basePathPrefix as T,operationHttpMethod as d,pathPattern as y,pathTemplateKey as C,pathVariableCount as H}from"./route-pattern.js";const M=new Set(P);function m(t){return u(t,"apiCalls")||u(t,"docs")}function w(t,n,i,a=[]){const b=T(i),c=new Set(a.map(({method:e,path:o})=>p(e&&d(e),o))),f=[];for(const[e,o]of Object.entries(t.paths??{})){if(!o||typeof o!="object")continue;const h=y(b,e);if(!h)continue;const O=m(o)||c.has(p(void 0,e)),x=n.paths?.[e],E=H(e);for(const[r,s]of Object.entries(o)){if(!M.has(r.toLowerCase())||!s||typeof s!="object")continue;const l=d(r);f.push({pattern:h,method:l,callable:!O&&!m(s)&&!c.has(p(l,e)),visible:!!x?.[r],variables:E})}}return f}function p(t,n){return`${t??"*"} ${C(n)}`}function I(t,n,i){return t.filter(a=>a.method===i&&a.pattern.test(n))}export{w as apiCallOperationsOf,I as matchingApiCallOperations};

package/dist/server/plugins/mcp/gateway-mcp/callable-apis.d.ts

@@ -1,10 +1,13 @@
 import type { ApiDescriptionInfo, McpToolContext } from '../types.js';
-export declare function getCallableApis(context: McpToolContext): ApiDescriptionInfo[];
+import type { ExcludedOperation } from './api-call-operations.js';
 /**
- * Fetch capability at request/worker time is derived purely from the build-time stamps:
- * `fetchEligible` is stamped per API by the lifecycle plugin under `isGatewayCapabilityEnabled`
- * (entitlement + hide checks), and the map arriving here is already RBAC-filtered.
+ * The APIs an agent may call in this request: the build-stamped `fetchEligible` entries of the
+ * already RBAC-filtered map, minus what `mcp.apiCalls` removes. The config is read from the
+ * request context, so a `redocly.yaml` edit applies without restarting the dev server.
  * No EntitlementsProvider read — this code runs in graphs where the provider is uninitialized.
  */
+export declare function getCallableApis(context: McpToolContext): ApiDescriptionInfo[];
+/** The `mcp.apiCalls.excludeOperations` entries whose `file` glob matches the API at `relativePath`. */
+export declare function getExcludedOperations(context: McpToolContext, relativePath: string): ExcludedOperation[];
 export declare function isFetchCapable(context: McpToolContext): boolean;
 //# sourceMappingURL=callable-apis.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/callable-apis.js

@@ -1 +1 @@
-function i(e){return Object.values(e.apiDescriptionsMap??{}).filter(t=>t.fetchEligible)}function l(e){return i(e).length>0}export{i as getCallableApis,l as isFetchCapable};
+import c from"picomatch";function r(e){const i=e.config?.mcp?.apiCalls;if(i?.hide)return[];const t=c(i?.excludeFiles??[]);return Object.values(e.apiDescriptionsMap??{}).filter(l=>l.fetchEligible&&!t(l.relativePath))}function n(e,i){return(e.config?.mcp?.apiCalls?.excludeOperations??[]).filter(({file:t})=>c.isMatch(i,t))}function p(e){return r(e).length>0}export{r as getCallableApis,n as getExcludedOperations,p as isFetchCapable};

package/dist/server/plugins/mcp/gateway-mcp/caller-api-calls.d.ts

@@ -0,0 +1,9 @@
+import type { RedoclyConfig } from '@redocly/config';
+/**
+ * `mcp` with `apiCalls` narrowed by the caller's `metadata.apiCalls` (`hide`, `allowedHttpMethods`),
+ * which the AI Assistant fills from `aiAssistant.mcp.apiCalls`. The caller can only take API calls
+ * or methods away: a value of another shape changes nothing, and a method list that keeps none of
+ * the project's methods turns API calls off.
+ */
+export declare function narrowMcpConfigForCaller(mcp: RedoclyConfig['mcp'], metadata: Record<string, unknown> | undefined): RedoclyConfig['mcp'];
+//# sourceMappingURL=caller-api-calls.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/caller-api-calls.js

@@ -0,0 +1 @@
+import{DEFAULT_ALLOWED_HTTP_METHODS as d}from"./allowed-http-methods.js";function h(e,a){const o=a?.apiCalls;if(!o||typeof o!="object")return e;const{hide:i,allowedHttpMethods:s}=o,t={...e?.apiCalls};if(i===!0&&(t.hide=!0),Array.isArray(s)){const n=new Set(s.map(r=>String(r).toUpperCase())),l=(e?.apiCalls?.allowedHttpMethods??d).filter(r=>n.has(r));l.length===0?t.hide=!0:t.allowedHttpMethods=l}return{...e,apiCalls:t}}export{h as narrowMcpConfigForCaller};

package/dist/server/plugins/mcp/gateway-mcp/credential-validation.js

@@ -1 +1 @@
-const r=/[\r\n]/,o=255;function a(n){for(let e=0;e<n.length;e+=1){const t=n.charCodeAt(e);if(t===0||t>255)return!0}return!1}function s(n,e){if(!e)return"Enter a value before saving.";if(r.test(e))return"The value contains a line break. Paste it as a single line and save again.";if(a(e))return"The value contains a character that cannot be sent in an HTTP header, such as a curly quote or an invisible character. Copy the value again as plain text and save.";if(n.kind==="cookie")return i(n.name,e)}function i(n,e){if(e.includes(";")||e.toLowerCase().includes(`${n.toLowerCase()}=`))return`This looks like a whole cookie header. Paste only the value of the ${n} cookie, without the "${n}=" prefix and without any other name=value pairs.`}function c(n,e){if(!(!r.test(e)&&!a(e)))throw new Error(`The credential cannot be sent as the ${n} header value.`)}export{c as assertHeaderSafe,s as rejectCredential};
+const r=/[\r\n]/,s=255,i=/^bearer$/i;function a(t){for(let e=0;e<t.length;e+=1){const n=t.charCodeAt(e);if(n===0||n>255)return!0}return!1}function c(t,e){if(!e)return"Enter a value before saving.";if(r.test(e))return"The value contains a line break. Paste it as a single line and save again.";if(a(e))return"The value contains a character that cannot be sent in an HTTP header, such as a curly quote or an invisible character. Copy the value again as plain text and save.";if(t.kind==="cookie")return o(t.name,e);if((t.kind==="bearer"||t.kind==="oauth2ClientCredentials")&&i.test(e))return"Paste the token that follows the word Bearer, not only the word."}function o(t,e){if(e.includes(";")||e.toLowerCase().includes(`${t.toLowerCase()}=`))return`This looks like a whole cookie header. Paste only the value of the ${t} cookie, without the "${t}=" prefix and without any other name=value pairs.`}function h(t,e){if(!(!r.test(e)&&!a(e)))throw new Error(`The credential cannot be sent as the ${t} header value.`)}export{h as assertHeaderSafe,c as rejectCredential};

package/dist/server/plugins/mcp/gateway-mcp/elicitation.d.ts

@@ -8,6 +8,7 @@ export type CredentialTarget = {
     name: string;
     scheme: string;
     schemeLabel?: string;
+    acceptedSchemes?: string[];
 };
 /**
  * Why the prompt is being raised. `authFailure` is the automatic path behind an upstream 401;

package/dist/server/plugins/mcp/gateway-mcp/elicitation.js

@@ -1,5 +1,5 @@
-import{inputRequired as h,inputResponse as y}from"@modelcontextprotocol/server";import{withPathPrefix as I}from"@redocly/theme/core/utils";import{MCP_CREDENTIALS_ROUTE as A}from"../../../constants/mcp.js";import{MANAGE_API_CREDENTIALS_TOOL_NAME as u}from"../constants.js";import{secretStore as l,ELICITATION_TTL_MS as P}from"./secret-store.js";import{operationsForScheme as E,orderedSchemesOf as g}from"./upstream-auth-scheme.js";import{ANONYMOUS_SUBJECT_PREFIX as p}from"./subject.js";const m="credentials",d=new Map;function F(e,t){const r=d.get(e);if(r)return r;const n=t().finally(()=>{d.delete(e)});return d.set(e,n),n}function D(e){return!!e?.elicitation?.url}function H(e){return e.envelope!==void 0}function q(e){const t=y(e,m);if(t.kind==="elicit")return t.action==="accept"?"accepted":"declined"}function B(e,t){return[`The user accepted the prompt to add credentials for the "${e}" API.`,...t?["The credentials page:",t]:[],"",`Wait until the user says they saved the credentials, then retry the call that needed them. Do not call \`${u}\` again unless the user asks for a new link.`].join(`
-`)}async function Y(e,{kv:t,subject:r,baseUrl:n,apis:o}){if(typeof e!="string")return;const i=await l.peekElicitation(t,e);if(!(i?.subject!==r||!o.includes(i.api)))return{apiName:i.name,url:T(n,e)}}function W(e,t){return Object.keys(e).length>1?t:void 0}async function z(e){const{token:t,url:r}=await f(e);return h({inputRequests:{[m]:h.elicitUrl({message:C(e),url:r})},requestState:t})}async function G(e){const{url:t}=await f(e);return _(e,t,S(e.subject))}function J(e,t){const r=b(e);if(e.status===401&&!e.sentScheme){const[i,s]=e.callerHeader?[`Your code set the "${e.callerHeader}" header itself, so the stored credential was not sent.`,"Remove that header from the request and retry. Do not replace the stored credentials."]:["No stored credential was sent with this request, so this result says nothing about the stored credentials.","Do not replace them. Check whether this operation needs a different kind of credential or a different route."];return[`The "${e.name}" API returned ${r}. ${i}`,"",s].join(`
-`)}const n=e.status===401?`The "${e.name}" API rejected the stored ${t?`"${t}" `:""}credential (${r}).`:`The "${e.name}" API rejected the request with ${r}.`,o=t?`api: "${e.api}" and scheme: "${t}"`:`api: "${e.api}"`;return[n,"",`Do not retry the same call. Call \`${u}\` with ${o} to get a link the user has to open in a browser to replace or remove the stored credentials, then retry once they confirm they saved them.`].join(`
-`)}function b({status:e,detail:t}){return t?`HTTP ${e}: ${t}`:`HTTP ${e}`}async function f({kv:e,subject:t,baseUrl:r,target:n,auth:o,apiAuth:i,hasExistingSecret:s}){const a=i?await k(e,t,n.api,i):[],c=await l.createElicitation(e,{subject:t,api:n.api,name:n.name,scheme:n.scheme,...n.schemeLabel?{schemeLabel:n.schemeLabel}:{},auth:o,hasExistingSecret:s,...a.length>1?{schemes:a}:{}});return{token:c,url:T(r,c)}}async function k(e,t,r,n){const i=(await l.getSecretsForSubject(e,t))[r]??{};return g(n.schemes).map(s=>{const a=E(n,s),c=n.descriptions?.[s];return{name:s,...c?{label:c}:{},auth:n.schemes[s],hasExistingSecret:!!i[s],...a.length>0?{operations:a}:{}}})}function S(e){return e.startsWith(p)?e.slice(p.length):void 0}function C({target:e,hasExistingSecret:t,reason:r}){const n=`The link works for ${$()} minutes.`,o=x(e),i=r.kind==="authFailure"&&r.detail?` The API answered: ${r.detail}.`:"";return t?`Open this page in a browser to replace or remove the stored credentials for ${o}. They go straight to the API and never enter the chat. ${n}`:`${O(o)} needs credentials.${i} Open this page in a browser to paste them - they go straight to the API and never enter the chat. ${n}`}function x({name:e,schemeLabel:t}){return t?`the "${t}" scheme of the "${e}" API`:`the "${e}" API`}function O(e){return e.charAt(0).toUpperCase()+e.slice(1)}function $(){return Math.round(P/6e4)}function T(e,t){const r=I(A);if(!e)return`${r}?token=${t}`;try{const n=new URL(r,e);return n.searchParams.set("token",t),n.toString()}catch{return`${e}${r}?token=${t}`}}function _({target:e,reason:t,hasExistingSecret:r},n,o){const s=[`**Stop and show the user this link. They have to open it in a browser to ${r?`replace or remove the stored credentials for the "${e.name}" API`:`add credentials for the "${e.name}" API`} - nothing continues until they do.**`,"",n,"",`The link is valid ${$()} minutes and opens a form on this site. Credentials go straight to the API from there: never ask for them in the conversation and never pass them as a tool argument.`,"",t.kind==="authFailure"?`The upstream API "${e.name}" returned ${t.status}${t.detail?` (${t.detail})`:""} and needs credentials.`:r?`Credentials are already stored for the "${e.name}" API; the link lets the user replace or remove them.`:`The "${e.name}" API needs credentials.`,...e.schemeLabel?[`The operation authenticates with its "${e.schemeLabel}" security scheme.`]:[],o?`Once the user confirms they saved them, call this tool again with sessionHandle: "${o}" - the credentials are stored against that handle, applied server-side, and never appear in the conversation.`:"Once the user confirms they saved them, call this tool again - the credentials are applied server-side and never appear in the conversation."],a=t.kind==="authFailure"?t.otherApiNames??[]:[];if(a.length>0){const c=a.map(w=>`"${w}"`).join(", ");s.push("",`The remaining APIs (${c}) will prompt for credentials on subsequent calls.`)}return s.join(`
-`)}export{m as CREDENTIALS_INPUT_REQUEST_KEY,Y as acceptedCredentialsLink,B as buildCredentialsAcceptedHint,J as buildCredentialsToolHint,G as buildUpstreamCredentialFallback,z as buildUpstreamCredentialInputRequired,q as credentialElicitationAnswer,F as dedupeElicitation,H as isStatelessRequest,W as schemeLabelOf,D as supportsUrlElicitation};
+import{inputRequired as d,inputResponse as I}from"@modelcontextprotocol/server";import{withPathPrefix as w}from"@redocly/theme/core/utils";import{MCP_CREDENTIALS_ROUTE as E}from"../../../constants/mcp.js";import{MANAGE_API_CREDENTIALS_TOOL_NAME as h}from"../constants.js";import{secretStore as l,ELICITATION_TTL_MINUTES as u}from"./secret-store.js";import{operationsForScheme as A,orderedSchemesOf as P}from"./upstream-auth-scheme.js";import{ANONYMOUS_SUBJECT_PREFIX as p}from"./subject.js";const m="credentials",c=new Map;function F(e,t){const n=c.get(e);if(n)return n;const i=t().finally(()=>{c.delete(e)});return c.set(e,i),i}function M(e){return!!e?.elicitation?.url}function D(e){return e.envelope!==void 0}function H(e){const t=I(e,m);if(t.kind==="elicit")return t.action==="accept"?"accepted":"declined"}function q(e,t){return[`The user accepted the prompt to add credentials for the "${e}" API.`,...t?["The credentials page:",t]:[],"",`Wait until the user says they saved the credentials, then retry the call that needed them. Do not call \`${h}\` again unless the user asks for a new link.`].join(`
+`)}async function B(e,{kv:t,subject:n,baseUrl:i,apis:r}){if(typeof e!="string")return;const s=await l.peekElicitation(t,e);if(!(s?.subject!==n||!r.includes(s.api)))return{apiName:s.name,url:$(i,e)}}function W(e,t){return Object.keys(e).length>1?t:void 0}async function Y(e){const{token:t,url:n}=await f(e);return d({inputRequests:{[m]:d.elicitUrl({message:C(e),url:n})},requestState:t})}async function z(e){const{url:t}=await f(e);return x(e,t,S(e.subject))}function G(e,t){const n=b(e);if(e.status===401&&!e.sentScheme)return[`The "${e.name}" API returned ${n}. No stored credential was sent with this request, so this result says nothing about the stored credentials.`,"","Do not replace them. Check whether this operation needs a different kind of credential or a different route."].join(`
+`);const i=e.status===401?`The "${e.name}" API rejected the stored ${t?`"${t}" `:""}credential (${n}).`:`The "${e.name}" API rejected the request with ${n}.`,r=t?`api: "${e.api}" and scheme: "${t}"`:`api: "${e.api}"`;return[i,"",`Do not retry the same call. Call \`${h}\` with ${r} to get a link the user has to open in a browser to replace or remove the stored credentials, then retry once they confirm they saved them.`].join(`
+`)}function b({status:e,detail:t}){return t?`HTTP ${e}: ${t}`:`HTTP ${e}`}async function f({kv:e,subject:t,baseUrl:n,target:i,auth:r,apiAuth:s}){const a=s?k(s):[],o=await l.createElicitation(e,{subject:t,api:i.api,name:i.name,scheme:i.scheme,...i.schemeLabel?{schemeLabel:i.schemeLabel}:{},auth:r,...a.length>1?{schemes:a}:{},...a.length>1&&i.acceptedSchemes?{acceptedSchemes:i.acceptedSchemes}:{}});return{token:o,url:$(n,o)}}function k(e){return P(e.schemes).map(t=>{const n=A(e,t),i=e.descriptions?.[t];return{name:t,...i?{label:i}:{},auth:e.schemes[t],...n.length>0?{operations:n}:{}}})}function S(e){return e.startsWith(p)?e.slice(p.length):void 0}function C({target:e,hasExistingSecret:t,reason:n}){const i=`The link works for ${u} minutes.`,r=O(e),s=n.kind==="authFailure"&&n.detail?` The API answered: ${n.detail}.`:"";return t?`Open this page in a browser to replace or remove the stored credentials for ${r}. They stay out of the chat. ${i}`:`${g(r)} needs credentials.${s} Open this page in a browser to paste them - they stay out of the chat. ${i}`}function O({name:e,schemeLabel:t}){return t?`the "${t}" scheme of the "${e}" API`:`the "${e}" API`}function g(e){return e.charAt(0).toUpperCase()+e.slice(1)}function $(e,t){const n=w(E);if(!e)return`${n}?token=${t}`;try{const i=new URL(n,e);return i.searchParams.set("token",t),i.toString()}catch{return`${e}${n}?token=${t}`}}function x({target:e,reason:t,hasExistingSecret:n},i,r){const a=[`**Stop and show the user this link. They have to open it in a browser to ${n?`replace or remove the stored credentials for the "${e.name}" API`:`add credentials for the "${e.name}" API`} - nothing continues until they do.**`,"",i,"",`The link is valid ${u} minutes and opens a form on this site. The site stores the credentials and adds them to API calls: never ask for them in the conversation and never pass them as a tool argument.`,"",t.kind==="authFailure"?`The upstream API "${e.name}" returned ${t.status}${t.detail?` (${t.detail})`:""} and needs credentials.`:n?`Credentials are already stored for the "${e.name}" API; the link lets the user replace or remove them.`:`The "${e.name}" API needs credentials.`,...e.schemeLabel?[`The operation authenticates with its "${e.schemeLabel}" security scheme.`]:[],r?`Once the user confirms they saved them, retry the call that needed them with sessionHandle: "${r}" - the credentials are stored against that handle, applied server-side, and never appear in the conversation.`:"Once the user confirms they saved them, retry the call that needed them - the credentials are applied server-side and never appear in the conversation."],o=t.kind==="authFailure"?t.otherApiNames??[]:[];if(o.length>0){const T=o.map(y=>`"${y}"`).join(", ");a.push("",`The remaining APIs (${T}) will prompt for credentials on subsequent calls.`)}return a.join(`
+`)}export{m as CREDENTIALS_INPUT_REQUEST_KEY,B as acceptedCredentialsLink,q as buildCredentialsAcceptedHint,G as buildCredentialsToolHint,z as buildUpstreamCredentialFallback,Y as buildUpstreamCredentialInputRequired,H as credentialElicitationAnswer,F as dedupeElicitation,D as isStatelessRequest,W as schemeLabelOf,M as supportsUrlElicitation};

package/dist/server/plugins/mcp/gateway-mcp/eligibility.d.ts

@@ -1,9 +1,13 @@
 import type { OpenAPIDefinition, OpenAPIMcp } from '@redocly/api-docs';
-import type { RbacConfig, RedoclyConfig } from '@redocly/config';
+import type { RedoclyConfig } from '@redocly/config';
 /** Whether the gateway fetch capability is on: the feature flag plus none of mcp/docs hidden. */
 export declare function isGatewayCapabilityEnabled(mcp?: RedoclyConfig['mcp']): boolean;
-/** Whether an API is eligible for the gateway (fetch-capable `execute` + `/mcp` advertisement). */
-export declare function isGatewayEligible(info: OpenAPIDefinition['info'] | undefined, relativePath: string, rbacConfig: RbacConfig): boolean;
+/**
+ * Whether the API description allows agent calls: every documented API does unless its
+ * `info.x-mcp.apiCalls.hide` is set. Who may call it is decided per request by RBAC, and
+ * `mcp.apiCalls` config by `getCallableApis`.
+ */
+export declare function isGatewayEligible(info: OpenAPIDefinition['info'] | undefined): boolean;
 /**
  * Whether an API docs page advertises the `/mcp` endpoint via an injected root-level x-mcp:
  * the capability is on, the author has not provided their own x-mcp servers, and the API is
@@ -13,6 +17,6 @@ export declare function shouldAdvertiseGatewayXMcp(definition: (OpenAPIDefinitio
     'x-mcp'?: {
         servers?: unknown[];
     };
-}) | undefined, relativePath: string, rbacConfig: RbacConfig, mcpConfig?: RedoclyConfig['mcp']): boolean;
+}) | undefined, relativePath: string, mcpConfig?: RedoclyConfig['mcp']): boolean;
 export declare function buildGatewayXMcp(url: string): OpenAPIMcp;
 //# sourceMappingURL=eligibility.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/eligibility.js

@@ -1 +1 @@
-import{join as e}from"node:path";import{PUBLIC_API_DEFINITIONS_FOLDER as s}from"../../../constants/common.js";import{ANONYMOUS_AUTH_DETAILS as n}from"../../../constants/rbac.js";import{canDownloadApiDefinition as a}from"../../../utils/rbac.js";import{MCP_PROTOCOL_VERSION as p}from"../constants.js";import{isApiIncludedInDocsMcp as c}from"../utils.js";import{isMcpGatewayEnabled as l}from"../utils/mode.js";import{isDefinitionHidden as m,hasGatewayConfig as f}from"../utils/xmcp-utils.js";function u(o){return l()&&!o?.hide&&!o?.docs?.hide}function d(o,r,i){return m(o,"gateway")?!1:a(e(s,r),i,!1,n)||f(o)}function _(o,r,i,t){return u(t)&&!o?.["x-mcp"]?.servers?.length&&d(o?.info,r,i)&&c(r,o,t)}function G(o){return{protocolVersion:p,capabilities:{tools:{}},servers:[{url:o}],tools:[],resources:[],prompts:[]}}export{G as buildGatewayXMcp,u as isGatewayCapabilityEnabled,d as isGatewayEligible,_ as shouldAdvertiseGatewayXMcp};
+import{MCP_PROTOCOL_VERSION as t}from"../constants.js";import{isApiIncludedInDocsMcp as i}from"../utils.js";import{isMcpGatewayEnabled as s}from"../utils/mode.js";import{isDefinitionHidden as a}from"../utils/xmcp-utils.js";function p(e){return s()&&!e?.hide&&!e?.docs?.hide}function n(e){return!a(e,"apiCalls")}function m(e,o,r){return p(r)&&!e?.["x-mcp"]?.servers?.length&&n(e?.info)&&i(o,e,r)}function f(e){return{protocolVersion:t,capabilities:{tools:{}},servers:[{url:e}],tools:[],resources:[],prompts:[]}}export{f as buildGatewayXMcp,p as isGatewayCapabilityEnabled,n as isGatewayEligible,m as shouldAdvertiseGatewayXMcp};

package/dist/server/plugins/mcp/gateway-mcp/fetch/fetch-audit.d.ts

@@ -6,6 +6,7 @@ type GatewayFetchAuditRecord = {
     outcome: GatewayFetchOutcome;
     durationMs: number;
     injectedSecretValues: readonly string[];
+    credentialQueryParams?: readonly string[];
     path?: string;
     api?: string;
     status?: number;
@@ -20,6 +21,6 @@ type GatewayFetchAuditRecord = {
  * telemetry event verbatim so a Grafana row joins onto this line; `url_sha256` identifies the
  * request itself, since the telemetry event's `path` is deliberately normalized.
  */
-export declare function logGatewayFetchAudit({ rawUrl, method, host, outcome, durationMs, injectedSecretValues, path, api, status, injectedScheme, requestHeaders, requestBody, responseHeaders, responseBody, }: GatewayFetchAuditRecord): void;
+export declare function logGatewayFetchAudit({ rawUrl, method, host, outcome, durationMs, injectedSecretValues, credentialQueryParams, path, api, status, injectedScheme, requestHeaders, requestBody, responseHeaders, responseBody, }: GatewayFetchAuditRecord): void;
 export {};
 //# sourceMappingURL=fetch-audit.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/fetch/fetch-audit.js

@@ -1 +1 @@
-import{auditHeaderNames as n,auditInput as g,auditOutputDigest as b,auditSha256 as l,auditUrl as y,logAuditRecord as A}from"../../audit/audit-log.js";function R({rawUrl:e,method:u,host:i,outcome:r,durationMs:o,injectedSecretValues:t,path:_,api:h,status:f,injectedScheme:m,requestHeaders:p,requestBody:d,responseHeaders:c,responseBody:s}){const a=s===void 0?void 0:b(s);A("Record gateway fetch",{url_sha256:l(e),host:i,method:u,path:_,api:h,outcome:r,status:f,injected_scheme:m,duration_ms:o,url:y(e,t),request_header_names:n(p),request_body:d===void 0?void 0:g(d,t),response_header_names:n(c),response_sha256:a?.sha256,response_bytes:a?.bytes})}export{R as logGatewayFetchAudit};
+import{auditHeaderNames as n,auditInput as b,auditOutputDigest as l,auditSha256 as y,auditUrl as A,logAuditRecord as D}from"../../audit/audit-log.js";function q({rawUrl:e,method:u,host:i,outcome:r,durationMs:o,injectedSecretValues:t,credentialQueryParams:_,path:h,api:f,status:m,injectedScheme:p,requestHeaders:c,requestBody:d,responseHeaders:g,responseBody:s}){const a=s===void 0?void 0:l(s);D("Record gateway fetch",{url_sha256:y(e),host:i,method:u,path:h,api:f,outcome:r,status:m,injected_scheme:p,duration_ms:o,url:A(e,t,_),request_header_names:n(c),request_body:d===void 0?void 0:b(d,t),response_header_names:n(g),response_sha256:a?.sha256,response_bytes:a?.bytes})}export{q as logGatewayFetchAudit};

package/dist/server/plugins/mcp/gateway-mcp/fetch/fetch-bridge.d.ts

@@ -2,6 +2,7 @@ import { Agent, type Dispatcher } from 'undici';
 import type { SandboxFetch } from '../../codemode/types.js';
 import type { UpstreamAuthRequiredEvent } from '../upstream-auth.js';
 import type { StoredSecret } from '../secret-store.js';
+import { type ApiCallOperation } from '../api-call-operations.js';
 export declare function getDefaultAgent(): Agent;
 export type FetchBridgeRoute = {
     pattern: RegExp;
@@ -16,7 +17,13 @@ export type FetchBridgeApi = {
     defaultScheme?: string;
     routes?: readonly FetchBridgeRoute[];
     credentialHeaders?: readonly string[];
+    credentialQueryParams?: readonly string[];
     schemePriority?: readonly string[];
+    /**
+     * The documented operations agents may reach on this API's hosts; see `apiCallOperationsOf`.
+     * Undefined puts no path restriction on the API.
+     */
+    operations?: readonly ApiCallOperation[];
 };
 type FetchBridgeOptions = {
     allowedHosts: readonly RegExp[];
@@ -28,10 +35,13 @@ type FetchBridgeOptions = {
     timeoutMs?: number;
     maxResponseBytes?: number;
     maxFetchesPerExec?: number;
+    beforeSend?: () => Promise<void>;
     clientIp?: string;
+    /** Upper-case methods that may reach the network (`mcp.apiCalls.allowedHttpMethods`); undefined allows all. */
+    allowedHttpMethods?: readonly string[];
 };
 /** Build the host-side `fetch` the gateway sandbox calls. */
-export declare function buildFetchBridge({ allowedHosts, apis, authorization, onAuthRequired, fetchImpl, dispatcher, timeoutMs, maxResponseBytes, maxFetchesPerExec, clientIp, }: FetchBridgeOptions): SandboxFetch;
+export declare function buildFetchBridge({ allowedHosts, apis, authorization, onAuthRequired, fetchImpl, dispatcher, timeoutMs, maxResponseBytes, maxFetchesPerExec, beforeSend, clientIp, allowedHttpMethods, }: FetchBridgeOptions): SandboxFetch;
 export declare function readCappedBody(response: Response, maxBytes: number): Promise<string>;
 export {};
 //# sourceMappingURL=fetch-bridge.d.ts.map