@redocly/revel 0.138.0-next.9 → 0.138.1

package/dist/server/plugins/mcp/codemode/capabilities/types.d.ts

@@ -1,3 +1,4 @@
+import type { RedoclyConfig } from '@redocly/config';
 import type { ToolAnnotations } from '@modelcontextprotocol/server';
 import type { McpToolContext } from '../../types.js';
 /** A capability is a per-request-gated global the code-mode sandbox exposes beyond the schema-driven `tools.*` surface. */
@@ -6,7 +7,8 @@ export type SandboxCapability = {
     purpose: string;
     /** Whether this capability is live for THIS request (RBAC/config/flag-dependent). */
     isActive(context: McpToolContext): boolean;
-    annotations: Partial<ToolAnnotations>;
+    /** The tool hints this capability adds to `execute` under the project's `mcp` config. */
+    annotations(mcp: RedoclyConfig['mcp'] | undefined): Partial<ToolAnnotations>;
     /**
      * The self-contained `describe-tools` section for this capability: heading, TS declaration,
      * guidance, and an example built only from `describedToolNames`.

package/dist/server/plugins/mcp/codemode/capabilities/utils.d.ts

@@ -1,9 +1,10 @@
+import type { RedoclyConfig } from '@redocly/config';
 import type { ToolAnnotations } from '@modelcontextprotocol/server';
 import type { McpToolSchema } from '../../../../types';
 import type { McpToolContext } from '../../types.js';
 import type { SandboxCapability } from './types.js';
 export declare function getActiveCapabilities(context: McpToolContext): SandboxCapability[];
-export declare function composeExecuteAnnotations(tools: McpToolSchema[], capabilities: SandboxCapability[]): ToolAnnotations;
+export declare function composeExecuteAnnotations(tools: McpToolSchema[], capabilities: SandboxCapability[], mcp: RedoclyConfig['mcp'] | undefined): ToolAnnotations;
 /**
  * The describe-tools output: the tool signatures, the always-present
  * `execute` args note, then one self-contained section per selected capability.

package/dist/server/plugins/mcp/codemode/capabilities/utils.js

@@ -1,7 +1,7 @@
-import{buildToolTypeDeclarations as p,sanitizeToolName as c}from"../build-tool-type-declarations.js";import{buildExecuteExample as u,EXECUTE_ARGS_NOTE as l,USAGE_NOTES as m}from"../prompts.js";import{FETCH_TOOL_NAME as a}from"../constants.js";import{ALL_CAPABILITIES as d}from"./registry.js";function H(t){return d.filter(o=>o.isActive(t))}function h(t,o){const r=[...t,...o].map(({annotations:e})=>e??{}),i=r.filter(e=>e.readOnlyHint!==!0);return{readOnlyHint:i.length===0,destructiveHint:i.some(e=>e.destructiveHint!==!1),idempotentHint:i.every(e=>e.idempotentHint===!0),openWorldHint:r.some(e=>e.openWorldHint!==!1)}}function O(t,o,r){const i=t.map(n=>c(n.name)),e=[];if(t.length>0){const n=p(t),s=n.includes("OpenApi")?`
+import{buildToolTypeDeclarations as p,sanitizeToolName as c}from"../build-tool-type-declarations.js";import{buildExecuteExample as a,EXECUTE_ARGS_NOTE as m,USAGE_NOTES as u}from"../prompts.js";import{FETCH_TOOL_NAME as l}from"../constants.js";import{ALL_CAPABILITIES as d}from"./registry.js";function H(n){return d.filter(o=>o.isActive(n))}function h(n,o,r){const i=[...n.map(({annotations:t})=>t??{}),...o.map(t=>t.annotations(r))],e=i.filter(t=>t.readOnlyHint!==!0);return{readOnlyHint:e.length===0,destructiveHint:e.some(t=>t.destructiveHint!==!1),idempotentHint:e.every(t=>t.idempotentHint===!0),openWorldHint:i.some(t=>t.openWorldHint!==!1)}}function O(n,o,r){const i=n.map(t=>c(t.name)),e=[];if(n.length>0){const t=p(n),s=t.includes("OpenApi")?`
 
-${m}`:"";e.push(`## Sandbox tools
+${u}`:"";e.push(`## Sandbox tools
 
-${n}${s}`)}e.push(l),t.length>0&&!o.some(n=>n.id===a)&&e.push(u(i));for(const n of o)e.push(n.renderSection(r,i));return e.join(`
+${t}${s}`)}e.push(m),n.length>0&&!o.some(t=>t.id===l)&&e.push(a(i));for(const t of o)e.push(t.renderSection(r,i));return e.join(`
 
 `)}export{h as composeExecuteAnnotations,H as getActiveCapabilities,O as renderDescribeToolsOutput};

package/dist/server/plugins/mcp/codemode/code-audit.d.ts

@@ -4,9 +4,10 @@ export type CodeAudit = {
     flags: string;
 };
 /**
- * Fingerprint model-supplied code for the audit trail. The body itself is never reported — it can
- * contain data the model already pulled from a customer API — so callers get a hash plus flags for
- * patterns worth reviewing. The sandbox blocks all of the flagged targets; a flag is an attempt.
+ * Fingerprint model-supplied code. Telemetry never carries the body — it can contain data the model
+ * already pulled from a customer API — so it gets a hash plus flags for patterns worth reviewing; the
+ * redacted body goes only to the audit log. The sandbox blocks all of the flagged targets; a flag is
+ * an attempt.
  */
 export declare function auditCode(code: string): CodeAudit;
 //# sourceMappingURL=code-audit.d.ts.map

package/dist/server/plugins/mcp/codemode/code-execution-audit.js

@@ -1 +1 @@
-import{auditInput as t,auditSha256 as g,logAuditRecord as h}from"../audit/audit-log.js";function f({audit:e,code:c,description:d,sessionHandle:o,toolNames:i,fetchBudget:u,fetchCapable:n,requestId:s,messageId:a}){h("Record code execution input",{code_sha256:e.sha256,code_length:e.length,request_id:s,message_id:a,flags:e.flags,subject_sha256:o?g(o):void 0,description:t(d),tools:[...i].sort().join(","),fetch_capable:n,fetch_budget:u,code:t(c)})}export{f as logCodeExecutionAudit};
+import{auditInput as t,auditSha256 as a,logAuditRecord as f}from"../audit/audit-log.js";import{maskCodeCredentials as g}from"../audit/code-credentials.js";function p({audit:e,code:d,description:c,sessionHandle:o,toolNames:i,fetchBudget:n,fetchCapable:r,requestId:s,messageId:u}){f("Record code execution input",{code_sha256:e.sha256,code_length:e.length,request_id:s,message_id:u,flags:e.flags,subject_sha256:o?a(o):void 0,description:t(c),tools:[...i].sort().join(","),fetch_capable:r,fetch_budget:n,code:t(g(d))})}export{p as logCodeExecutionAudit};

package/dist/server/plugins/mcp/docs-mcp/tools/core/utils.js

@@ -1,6 +1,6 @@
 import c from"node:fs";import f from"node:path";import{MAX_DOCUMENTS_PER_CATEGORY as $}from"../../../constants.js";function j(m,u){return Object.entries(m).map(([h,s])=>{if(!s||s.length===0)return"";const x=s.slice(0,$).map(d=>{const{document:t,highlight:o}=d,p=o?.title||(Array.isArray(t.title)?t.title[0]:t.title);let n=`Document: ${t.title}`;n+=`### [${p}](${t.url})
 
-`;let r;if(t.url)try{let e=t.url.startsWith("/")?t.url.slice(1):t.url;const i=e.indexOf("#");i!==-1&&(e=e.substring(0,i));const l=f.extname(e);l&&(e=e.slice(0,-l.length));let y=e+".md";const a=f.join(u,y);c.existsSync(a)&&(r=c.readFileSync(a,"utf8"))}catch{}return r||(r=o?.text||(Array.isArray(t.text)?t.text[0]:t.text)),n+=r,t.facets&&(n+=`
+`;let r;if(t.url)try{let e=t.url.startsWith("/")?t.url.slice(1):t.url;const i=e.indexOf("#");i!==-1&&(e=e.substring(0,i));const l=f.extname(e);l&&(e=e.slice(0,-l.length));const y=e+".md",a=f.join(u,y);c.existsSync(a)&&(r=c.readFileSync(a,"utf8"))}catch{}return r||(r=o?.text||(Array.isArray(t.text)?t.text[0]:t.text)),n+=r,t.facets&&(n+=`
 
 **Categories:**
 `,Object.entries(t.facets).forEach(([e,i])=>{n+=`- ${e}: ${i}

package/dist/server/plugins/mcp/docs-mcp/tools/openapi/list-apis.js

@@ -1 +1 @@
-import{isFetchCapable as h}from"../../../gateway-mcp/callable-apis.js";import{filterApiDescriptionsByName as b}from"../../utils/api-name-matching.js";import{apiTitleKey as y,countApiTitles as T,orderSharedTitles as x}from"../../utils/api-titles.js";const A=async(r,i)=>{const{filter:s,page:l=1,limit:e=300}=r,c=h(i),a=x(Object.values(i.apiDescriptionsMap)),p=T(a);let t=a;s&&(t=b(t,s));const n=(l-1)*e,m=n+e,u=Math.ceil(t.length/e),f=t.length;return t=t.slice(n,m),{content:[{type:"text",text:JSON.stringify({items:t.map(({relativePath:d,fetchEligible:g,...o})=>({filePath:d,...o,...(p.get(y(o.name))??0)>1?{ambiguousTitle:!0}:{},...c?{callable:g===!0}:{}})),limit:e,total:f,page:l,totalPages:u})}]}};var M={"list-apis":A};export{M as default};
+import{getCallableApis as b}from"../../../gateway-mcp/callable-apis.js";import{filterApiDescriptionsByName as d}from"../../utils/api-name-matching.js";import{apiTitleKey as y,countApiTitles as A,orderSharedTitles as T}from"../../utils/api-titles.js";const x=async(r,l)=>{const{filter:s,page:a=1,limit:e=300}=r,n=new Set(b(l).map(i=>i.relativePath)),m=n.size>0,o=T(Object.values(l.apiDescriptionsMap)),f=A(o);let t=o;s&&(t=d(t,s));const c=(a-1)*e,u=c+e,g=Math.ceil(t.length/e),h=t.length;return t=t.slice(c,u),{content:[{type:"text",text:JSON.stringify({items:t.map(({relativePath:i,fetchEligible:D,...p})=>({filePath:i,...p,...(f.get(y(p.name))??0)>1?{ambiguousTitle:!0}:{},...m?{callable:n.has(i)}:{}})),limit:e,total:h,page:a,totalPages:g})}]}};var I={"list-apis":x};export{I as default};

package/dist/server/plugins/mcp/docs-mcp/tools/openapi/utils.d.ts

@@ -8,13 +8,22 @@ type EndpointInfo = Pick<OpenAPIOperation, 'summary' | 'description' | 'security
     path: string;
 };
 export declare function getEndpointsFromPaths(def: OpenAPIDefinition): EndpointInfo[];
-export declare function getApiDescriptionFromFs({ relativePath, outdir, user, rbac, requiresLogin, }: {
-    relativePath: string;
-    outdir: string;
+type ApiDescriptionAccess = {
     user: ApiFunctionsUser;
     rbac?: RbacConfig;
     requiresLogin?: boolean;
+};
+export declare function getApiDescriptionFromFs({ relativePath, outdir, ...access }: ApiDescriptionAccess & {
+    relativePath: string;
+    outdir: string;
 }): Promise<OpenAPIDefinition | undefined>;
+/** The bundled description with no RBAC filtering; never return it to a caller. */
+export declare function readApiDescriptionFromFs(relativePath: string, outdir: string): Promise<OpenAPIDefinition | undefined>;
+/**
+ * A filtered copy of `definition` holding only what the user can read, or undefined when the user
+ * can read none of it; the input is not mutated.
+ */
+export declare function filterApiDescriptionByAccess(definition: OpenAPIDefinition, { user, rbac, requiresLogin }: ApiDescriptionAccess): OpenAPIDefinition | undefined;
 export declare function absolutePath(requestedPath: string): string;
 /** Models copy a path and lose its casing; the definition's own spelling still answers. */
 export declare function matchDocumentedPath(description: OpenAPIDefinition, requestedPath: string): string;

package/dist/server/plugins/mcp/docs-mcp/tools/openapi/utils.js

@@ -1 +1 @@
-import m from"node:path";import{existsSync as f}from"node:fs";import{readFile as u}from"node:fs/promises";import{replaceFileExtension as d}from"../../../../../plugins/api-docs/utils/replace-file-extension.js";import{PUBLIC_API_DEFINITIONS_FOLDER as h}from"../../../../../constants/common.js";import{filterDataByAccessDeep as l}from"../../../../../utils/rbac.js";import{isEndpointHidden as c}from"../../../utils/xmcp-utils.js";import{HTTP_METHODS as x}from"./constants.js";function y(t){return!t||c(t,"docs")?[]:Object.entries(t).filter(r=>{const[e,o]=r;return x.has(e.toLowerCase())&&typeof o=="object"&&o!==null&&!c(o,"docs")})}function P(t){const{paths:r={}}=t,e=[];for(const[o,i]of Object.entries(r))for(const[n,s]of y(i))e.push({path:o,method:n.toUpperCase(),summary:s.summary,description:s.description,security:s.security});return e}async function I({relativePath:t,outdir:r,user:e,rbac:o={},requiresLogin:i=!1}){const n=m.join(r||"",h,d(t,".json"));if(!f(n))return;const a=await u(n,"utf-8"),p=JSON.parse(a);return l(p,{isAuthenticated:e?.isAuthenticated,email:e?.email,teams:e?.teams},o,i)}function D(t){return t.startsWith("/")?t:`/${t}`}function S(t,r){const e=D(r);if(t.paths?.[e])return e;const o=e.toLowerCase();return Object.keys(t.paths??{}).find(n=>n.toLowerCase()===o)??e}export{D as absolutePath,I as getApiDescriptionFromFs,P as getEndpointsFromPaths,S as matchDocumentedPath,y as visibleOperations};
+import a from"node:path";import{existsSync as p}from"node:fs";import{readFile as m}from"node:fs/promises";import{replaceFileExtension as f}from"../../../../../plugins/api-docs/utils/replace-file-extension.js";import{PUBLIC_API_DEFINITIONS_FOLDER as u}from"../../../../../constants/common.js";import{filterDataByAccessDeep as d}from"../../../../../utils/rbac.js";import{isEndpointHidden as c}from"../../../utils/xmcp-utils.js";import{HTTP_METHODS as h}from"./constants.js";function l(t){return!t||c(t,"docs")?[]:Object.entries(t).filter(o=>{const[e,r]=o;return h.has(e.toLowerCase())&&typeof r=="object"&&r!==null&&!c(r,"docs")})}function L(t){const{paths:o={}}=t,e=[];for(const[r,s]of Object.entries(o))for(const[n,i]of l(s))e.push({path:r,method:n.toUpperCase(),summary:i.summary,description:i.description,security:i.security});return e}async function P({relativePath:t,outdir:o,...e}){const r=await y(t,o);return r&&x(r,e)}async function y(t,o){const e=a.join(o||"",u,f(t,".json"));if(p(e))return JSON.parse(await m(e,"utf-8"))}function x(t,{user:o,rbac:e={},requiresLogin:r=!1}){return d(t,{isAuthenticated:o?.isAuthenticated,email:o?.email,teams:o?.teams},e,r)}function D(t){return t.startsWith("/")?t:`/${t}`}function I(t,o){const e=D(o);if(t.paths?.[e])return e;const r=e.toLowerCase();return Object.keys(t.paths??{}).find(n=>n.toLowerCase()===r)??e}export{D as absolutePath,x as filterApiDescriptionByAccess,P as getApiDescriptionFromFs,L as getEndpointsFromPaths,I as matchDocumentedPath,y as readApiDescriptionFromFs,l as visibleOperations};

package/dist/server/plugins/mcp/docs-mcp/utils/resolve-refs.d.ts

@@ -1,5 +1,7 @@
 import type { OpenAPIParameter, Referenced, OpenAPIDefinition } from '@redocly/api-docs';
 import type { McpEndpoint } from '../../types.js';
+import { resolveRef } from '@redocly/api-docs/lib/utils/inline-openapi-refs.js';
+export { resolveRef };
 type JsonValue = string | number | boolean | null | JsonValue[] | {
     [key: string]: JsonValue;
 };
@@ -10,7 +12,6 @@ export type ResolvedOperation = {
     operation: JsonObject;
     components?: Record<string, JsonObject>;
 };
-export declare function resolveRef<T>(ref: string, def?: OpenAPIDefinition): T | undefined;
 type ResolveOperationParams = {
     operation: McpEndpoint;
     pathParams: Referenced<OpenAPIParameter>[];
@@ -22,5 +23,4 @@ export declare function resolveOperation({ operation, pathParams, definition, }:
  * `maxBytes` or the inliner cannot read the operation.
  */
 export declare function inlineOperation({ operation, pathParams, definition }: ResolveOperationParams, maxBytes: number): ResolvedOperation | undefined;
-export {};
 //# sourceMappingURL=resolve-refs.d.ts.map

package/dist/server/plugins/mcp/docs-mcp/utils/resolve-refs.js

@@ -1 +1 @@
-const S=/^#\/components\/([^/]+)\/([^/]+)(\/.*)?$/;function w(e){return e.replace(/~1/g,"/").replace(/~0/g,"~")}function d(e,s){if(!s||!e?.startsWith("#/"))return;const n=e.slice(2).split("/").map(w);let t=s;for(const r of n)if(typeof t=="object"&&t!==null&&r in t)t=t[r];else return;return t}function h(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function O(e,s){const n={},t=new Set,r=new Set,o=[e];for(;o.length>0;){const c=o.pop();if(!(c===null||typeof c!="object")){if(h(c)&&typeof c.$ref=="string"&&!t.has(c.$ref)){t.add(c.$ref);const[,i,f]=S.exec(c.$ref)??[],u=f&&w(f);if(i&&u&&!r.has(`${i}/${u}`)){const l=d(`#/components/${i}/${f}`,s);l!==void 0&&(r.add(`${i}/${u}`),(n[i]??={})[u]=l,o.push(l))}}for(const i of Object.values(c))o.push(i)}}return Object.keys(n).length>0?n:void 0}function R(e,s){const n=h(e)&&typeof e.$ref=="string"?d(e.$ref,s)??e:e,{name:t,in:r}=h(n)?n:{};return typeof t=="string"&&typeof r=="string"?`${r}:${t}`:JSON.stringify(e)}function g(e,s,n){const t=new Map;for(const r of[...e,...s])r&&t.set(R(r,n),r);return[...t.values()]}function C({operation:e,pathParams:s,definition:n}){const t={...e,parameters:g(s,e.parameters??[],n)};return{operation:t,components:O(t,n)}}class E extends Error{}function j(e,s){if(e.remainingBytes-=s,e.remainingBytes<0)throw new E}function $(e,s){return j(e,JSON.stringify(s).length),s}function m(e,s,n){const t=d(e,s);if(t===void 0)return;const r=n.bytesByRef.get(e)??JSON.stringify(t).length;return n.bytesByRef.set(e,r),j(n,r),t}function y(e,s,n){const t=$(n,Object.fromEntries(Object.entries(e).filter(([r,o])=>r!=="$ref"&&o!==void 0)));return{...s,...t}}function a({schema:e,definition:s,budget:n,visitedRefs:t=new Set,maxDepth:r=50,currentDepth:o=0}){if(!e)return;if(o>=r)return $(n,{type:"object",description:`Maximum resolution depth exceeded (${r})`});if("$ref"in e&&e.$ref){if(t.has(e.$ref))return $(n,{type:"object",description:`Circular reference detected: ${e.$ref}`,"x-circular-ref":e.$ref});const f=new Set(t);f.add(e.$ref);const u=m(e.$ref,s,n);if(!u)return $(n,{type:"object",description:`Could not resolve reference: ${e.$ref}`,"x-unresolved-ref":e.$ref});const l=a({schema:u,definition:s,budget:n,visitedRefs:f,maxDepth:r,currentDepth:o+1});return l&&y(e,l,n)}const c={...e};if(c.properties){const f={};for(const[u,l]of Object.entries(c.properties)){const p=a({schema:l,definition:s,budget:n,visitedRefs:new Set(t),maxDepth:r,currentDepth:o+1});f[u]=p||l}c.properties=f}if(c.items&&typeof c.items=="object")if(Array.isArray(c.items))c.items=c.items.map(f=>a({schema:f,definition:s,budget:n,visitedRefs:new Set(t),maxDepth:r,currentDepth:o+1})||f);else{const f=a({schema:c.items,definition:s,budget:n,visitedRefs:new Set(t),maxDepth:r,currentDepth:o+1});f&&(c.items=f)}return["allOf","anyOf","oneOf"].forEach(f=>{const u=c[f];Array.isArray(u)&&(c[f]=u.reduce((l,p)=>{const v=a({schema:p,definition:s,budget:n,visitedRefs:new Set(t),maxDepth:r,currentDepth:o+1});return v&&l.push(v),l},[]))}),c}function P({pathParams:e,opParams:s,definition:n,budget:t}){return[...e,...s].reduce((r,o)=>{if(!o)return r;if("$ref"in o&&o.$ref){const c=m(o.$ref,n,t);if(!c)return r;const i=y(o,c,t);return r.push({...i,schema:"schema"in i&&i.schema?a({schema:i.schema,definition:n,budget:t}):void 0}),r}return r.push({...o,schema:"schema"in o&&o.schema?a({schema:o.schema,definition:n,budget:t}):void 0}),r},[])}function x(e,s,n){const t={...e};if(e.example!==void 0&&(t.example=e.example),!e.examples)return t;const r={};for(const[o,c]of Object.entries(e.examples))if("$ref"in c){const i=m(c.$ref,s,n);i&&(r[o]=i)}else r[o]=c;return t.examples=r,t}function A(e,s,n){if(!e)return;const t="$ref"in e&&e.$ref?m(e.$ref,s,n):e;if(!t)return;const r=y(e,t,n),o={...r};if("content"in r&&r.content){const c={};for(const[i,f]of Object.entries(r.content))c[i]={...x(f,s,n),schema:f.schema?a({schema:f.schema,definition:s,budget:n}):void 0};o.content=c}return o}function B(e,s,n){if(e)return Object.entries(e).reduce((t,[r,o])=>{const c="$ref"in o&&o.$ref?m(o.$ref,s,n):o;if(!c)return t;const i=y(o,c,n),f={...i};if("content"in i&&i.content){const u={};for(const[l,p]of Object.entries(i.content))u[l]={...x(p,s,n),schema:p.schema?a({schema:p.schema,definition:s,budget:n}):void 0};f.content=u}return t[r]=f,t},{})}function N({operation:e,pathParams:s,definition:n},t){const r={remainingBytes:t,bytesByRef:new Map};try{const o={...e,parameters:P({pathParams:s,opParams:e.parameters||[],definition:n,budget:r}),requestBody:A(e.requestBody,n,r),responses:B(e.responses,n,r)};return{operation:o,components:O(o,n)}}catch{return}}export{N as inlineOperation,C as resolveOperation,d as resolveRef};
+import{resolveParameters as y,resolveRef as p,resolveRequestBody as g,resolveResponses as m,unescapeJsonPointerToken as $}from"@redocly/api-docs/lib/utils/inline-openapi-refs.js";const h=/^#\/components\/([^/]+)\/([^/]+)(\/.*)?$/;function d(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function l(e,o){const n={},s=new Set,t=new Set,r=[e];for(;r.length>0;){const c=r.pop();if(!(c===null||typeof c!="object")){if(d(c)&&typeof c.$ref=="string"&&!s.has(c.$ref)){s.add(c.$ref);const[,f,i]=h.exec(c.$ref)??[],u=i&&$(i);if(f&&u&&!t.has(`${f}/${u}`)){const a=p(`#/components/${f}/${i}`,o);a!==void 0&&(t.add(`${f}/${u}`),(n[f]??={})[u]=a,r.push(a))}}for(const f of Object.values(c))r.push(f)}}return Object.keys(n).length>0?n:void 0}function b(e,o){const n=d(e)&&typeof e.$ref=="string"?p(e.$ref,o)??e:e,{name:s,in:t}=d(n)?n:{};return typeof s=="string"&&typeof t=="string"?`${t}:${s}`:JSON.stringify(e)}function O(e,o,n){const s=new Map;for(const t of[...e,...o])t&&s.set(b(t,n),t);return[...s.values()]}function x({operation:e,pathParams:o,definition:n}){const s={...e,parameters:O(o,e.parameters??[],n)};return{operation:s,components:l(s,n)}}class w extends Error{}function B(e){let o=e;const n=new Map;return(s,t)=>{let r=t===void 0?void 0:n.get(t);if(r===void 0&&(r=JSON.stringify(s).length,t!==void 0&&n.set(t,r)),o-=r,o<0)throw new w}}function R({operation:e,pathParams:o,definition:n},s){const t=B(s);try{const r={...e,parameters:y({pathParams:o,opParams:e.parameters||[],definition:n,charge:t}),requestBody:g(e.requestBody,n,t),responses:e.responses&&m(e.responses,n,t)};return{operation:r,components:l(r,n)}}catch{return}}export{R as inlineOperation,x as resolveOperation,p as resolveRef};

package/dist/server/plugins/mcp/gateway-mcp/allowed-http-methods.d.ts

@@ -0,0 +1,11 @@
+import type { RedoclyConfig } from '@redocly/config';
+export type ApiCallsConfig = NonNullable<NonNullable<RedoclyConfig['mcp']>['apiCalls']>;
+type ApiCallsHttpMethod = NonNullable<ApiCallsConfig['allowedHttpMethods']>[number];
+/** The methods agents may send when `mcp.apiCalls.allowedHttpMethods` is not set. */
+export declare const DEFAULT_ALLOWED_HTTP_METHODS: readonly ApiCallsHttpMethod[];
+/** Upper-case HTTP methods agents may send; read-only unless `redocly.yaml` allows more. */
+export declare function getAllowedHttpMethods(mcp: RedoclyConfig['mcp'] | undefined): string[];
+/** Whether every allowed method is safe by HTTP semantics (`GET`, `HEAD`, `OPTIONS`). */
+export declare function allowsOnlySafeHttpMethods(mcp: RedoclyConfig['mcp'] | undefined): boolean;
+export {};
+//# sourceMappingURL=allowed-http-methods.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/allowed-http-methods.js

@@ -0,0 +1 @@
+const o=["GET","HEAD","OPTIONS"],r={GET:!0,HEAD:!0,OPTIONS:!0};function T(t){return(t?.apiCalls?.allowedHttpMethods??o).map(e=>e.toUpperCase())}function p(t){return T(t).every(e=>r[e])}export{o as DEFAULT_ALLOWED_HTTP_METHODS,p as allowsOnlySafeHttpMethods,T as getAllowedHttpMethods};

package/dist/server/plugins/mcp/gateway-mcp/api-call-operations.d.ts

@@ -0,0 +1,32 @@
+import type { OpenAPIDefinition, OpenAPIServer } from '@redocly/api-docs';
+export type ApiCallOperation = {
+    pattern: RegExp;
+    /** Upper case. */
+    method: string;
+    /**
+     * False when `x-mcp.apiCalls.hide` or `x-mcp.docs.hide` on the path item or operation, or an
+     * `mcp.apiCalls.excludeOperations` entry, excludes it.
+     */
+    callable: boolean;
+    /**
+     * False when RBAC hides the operation from the caller. The bridge then answers as for an
+     * undocumented path, so the reply does not reveal that the operation exists.
+     */
+    visible: boolean;
+    /** Number of `{variable}` segments in the path; fewer is more specific. */
+    variables: number;
+};
+/** An `mcp.apiCalls.excludeOperations` entry of one API; no `method` excludes every method of `path`. */
+export type ExcludedOperation = {
+    method?: string;
+    path: string;
+};
+/**
+ * Every operation of the unfiltered `description`, with the ones missing from `visibleDescription`,
+ * the caller's RBAC-filtered copy, marked not visible. A hidden or `excluded` operation stays in the
+ * list, so a less specific template cannot claim its requests.
+ */
+export declare function apiCallOperationsOf(description: OpenAPIDefinition, visibleDescription: OpenAPIDefinition, servers: readonly OpenAPIServer[], excluded?: readonly ExcludedOperation[]): ApiCallOperation[];
+/** The documented operations that an upper-case `method` on `pathname` matches. */
+export declare function matchingApiCallOperations(operations: readonly ApiCallOperation[], pathname: string, method: string): ApiCallOperation[];
+//# sourceMappingURL=api-call-operations.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/api-call-operations.js

@@ -0,0 +1 @@
+import{OPERATION_METHODS as P}from"../docs-mcp/tools/openapi/constants.js";import{isEndpointHidden as u}from"../utils/xmcp-utils.js";import{basePathPrefix as T,operationHttpMethod as d,pathPattern as y,pathTemplateKey as C,pathVariableCount as H}from"./route-pattern.js";const M=new Set(P);function m(t){return u(t,"apiCalls")||u(t,"docs")}function w(t,n,i,a=[]){const b=T(i),c=new Set(a.map(({method:e,path:o})=>p(e&&d(e),o))),f=[];for(const[e,o]of Object.entries(t.paths??{})){if(!o||typeof o!="object")continue;const h=y(b,e);if(!h)continue;const O=m(o)||c.has(p(void 0,e)),x=n.paths?.[e],E=H(e);for(const[r,s]of Object.entries(o)){if(!M.has(r.toLowerCase())||!s||typeof s!="object")continue;const l=d(r);f.push({pattern:h,method:l,callable:!O&&!m(s)&&!c.has(p(l,e)),visible:!!x?.[r],variables:E})}}return f}function p(t,n){return`${t??"*"} ${C(n)}`}function I(t,n,i){return t.filter(a=>a.method===i&&a.pattern.test(n))}export{w as apiCallOperationsOf,I as matchingApiCallOperations};

package/dist/server/plugins/mcp/gateway-mcp/callable-apis.d.ts

@@ -1,10 +1,13 @@
 import type { ApiDescriptionInfo, McpToolContext } from '../types.js';
-export declare function getCallableApis(context: McpToolContext): ApiDescriptionInfo[];
+import type { ExcludedOperation } from './api-call-operations.js';
 /**
- * Fetch capability at request/worker time is derived purely from the build-time stamps:
- * `fetchEligible` is stamped per API by the lifecycle plugin under `isGatewayCapabilityEnabled`
- * (entitlement + hide checks), and the map arriving here is already RBAC-filtered.
+ * The APIs an agent may call in this request: the build-stamped `fetchEligible` entries of the
+ * already RBAC-filtered map, minus what `mcp.apiCalls` removes. The config is read from the
+ * request context, so a `redocly.yaml` edit applies without restarting the dev server.
  * No EntitlementsProvider read — this code runs in graphs where the provider is uninitialized.
  */
+export declare function getCallableApis(context: McpToolContext): ApiDescriptionInfo[];
+/** The `mcp.apiCalls.excludeOperations` entries whose `file` glob matches the API at `relativePath`. */
+export declare function getExcludedOperations(context: McpToolContext, relativePath: string): ExcludedOperation[];
 export declare function isFetchCapable(context: McpToolContext): boolean;
 //# sourceMappingURL=callable-apis.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/callable-apis.js

@@ -1 +1 @@
-function i(e){return Object.values(e.apiDescriptionsMap??{}).filter(t=>t.fetchEligible)}function l(e){return i(e).length>0}export{i as getCallableApis,l as isFetchCapable};
+import c from"picomatch";function r(e){const i=e.config?.mcp?.apiCalls;if(i?.hide)return[];const t=c(i?.excludeFiles??[]);return Object.values(e.apiDescriptionsMap??{}).filter(l=>l.fetchEligible&&!t(l.relativePath))}function n(e,i){return(e.config?.mcp?.apiCalls?.excludeOperations??[]).filter(({file:t})=>c.isMatch(i,t))}function p(e){return r(e).length>0}export{r as getCallableApis,n as getExcludedOperations,p as isFetchCapable};

package/dist/server/plugins/mcp/gateway-mcp/caller-api-calls.d.ts

@@ -0,0 +1,9 @@
+import type { RedoclyConfig } from '@redocly/config';
+/**
+ * `mcp` with `apiCalls` narrowed by the caller's `metadata.apiCalls` (`hide`, `allowedHttpMethods`),
+ * which the AI Assistant fills from `aiAssistant.mcp.apiCalls`. The caller can only take API calls
+ * or methods away: a value of another shape changes nothing, and a method list that keeps none of
+ * the project's methods turns API calls off.
+ */
+export declare function narrowMcpConfigForCaller(mcp: RedoclyConfig['mcp'], metadata: Record<string, unknown> | undefined): RedoclyConfig['mcp'];
+//# sourceMappingURL=caller-api-calls.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/caller-api-calls.js

@@ -0,0 +1 @@
+import{DEFAULT_ALLOWED_HTTP_METHODS as d}from"./allowed-http-methods.js";function h(e,a){const o=a?.apiCalls;if(!o||typeof o!="object")return e;const{hide:i,allowedHttpMethods:s}=o,t={...e?.apiCalls};if(i===!0&&(t.hide=!0),Array.isArray(s)){const n=new Set(s.map(r=>String(r).toUpperCase())),l=(e?.apiCalls?.allowedHttpMethods??d).filter(r=>n.has(r));l.length===0?t.hide=!0:t.allowedHttpMethods=l}return{...e,apiCalls:t}}export{h as narrowMcpConfigForCaller};

package/dist/server/plugins/mcp/gateway-mcp/elicitation.d.ts

@@ -8,6 +8,7 @@ export type CredentialTarget = {
     name: string;
     scheme: string;
     schemeLabel?: string;
+    acceptedSchemes?: string[];
 };
 /**
  * Why the prompt is being raised. `authFailure` is the automatic path behind an upstream 401;

package/dist/server/plugins/mcp/gateway-mcp/elicitation.js

@@ -1,5 +1,5 @@
-import{inputRequired as h,inputResponse as y}from"@modelcontextprotocol/server";import{withPathPrefix as I}from"@redocly/theme/core/utils";import{MCP_CREDENTIALS_ROUTE as A}from"../../../constants/mcp.js";import{MANAGE_API_CREDENTIALS_TOOL_NAME as u}from"../constants.js";import{secretStore as l,ELICITATION_TTL_MS as P}from"./secret-store.js";import{operationsForScheme as E,orderedSchemesOf as g}from"./upstream-auth-scheme.js";import{ANONYMOUS_SUBJECT_PREFIX as p}from"./subject.js";const m="credentials",d=new Map;function F(e,t){const r=d.get(e);if(r)return r;const n=t().finally(()=>{d.delete(e)});return d.set(e,n),n}function D(e){return!!e?.elicitation?.url}function H(e){return e.envelope!==void 0}function q(e){const t=y(e,m);if(t.kind==="elicit")return t.action==="accept"?"accepted":"declined"}function B(e,t){return[`The user accepted the prompt to add credentials for the "${e}" API.`,...t?["The credentials page:",t]:[],"",`Wait until the user says they saved the credentials, then retry the call that needed them. Do not call \`${u}\` again unless the user asks for a new link.`].join(`
-`)}async function Y(e,{kv:t,subject:r,baseUrl:n,apis:o}){if(typeof e!="string")return;const i=await l.peekElicitation(t,e);if(!(i?.subject!==r||!o.includes(i.api)))return{apiName:i.name,url:T(n,e)}}function W(e,t){return Object.keys(e).length>1?t:void 0}async function z(e){const{token:t,url:r}=await f(e);return h({inputRequests:{[m]:h.elicitUrl({message:C(e),url:r})},requestState:t})}async function G(e){const{url:t}=await f(e);return _(e,t,S(e.subject))}function J(e,t){const r=b(e);if(e.status===401&&!e.sentScheme){const[i,s]=e.callerHeader?[`Your code set the "${e.callerHeader}" header itself, so the stored credential was not sent.`,"Remove that header from the request and retry. Do not replace the stored credentials."]:["No stored credential was sent with this request, so this result says nothing about the stored credentials.","Do not replace them. Check whether this operation needs a different kind of credential or a different route."];return[`The "${e.name}" API returned ${r}. ${i}`,"",s].join(`
-`)}const n=e.status===401?`The "${e.name}" API rejected the stored ${t?`"${t}" `:""}credential (${r}).`:`The "${e.name}" API rejected the request with ${r}.`,o=t?`api: "${e.api}" and scheme: "${t}"`:`api: "${e.api}"`;return[n,"",`Do not retry the same call. Call \`${u}\` with ${o} to get a link the user has to open in a browser to replace or remove the stored credentials, then retry once they confirm they saved them.`].join(`
-`)}function b({status:e,detail:t}){return t?`HTTP ${e}: ${t}`:`HTTP ${e}`}async function f({kv:e,subject:t,baseUrl:r,target:n,auth:o,apiAuth:i,hasExistingSecret:s}){const a=i?await k(e,t,n.api,i):[],c=await l.createElicitation(e,{subject:t,api:n.api,name:n.name,scheme:n.scheme,...n.schemeLabel?{schemeLabel:n.schemeLabel}:{},auth:o,hasExistingSecret:s,...a.length>1?{schemes:a}:{}});return{token:c,url:T(r,c)}}async function k(e,t,r,n){const i=(await l.getSecretsForSubject(e,t))[r]??{};return g(n.schemes).map(s=>{const a=E(n,s),c=n.descriptions?.[s];return{name:s,...c?{label:c}:{},auth:n.schemes[s],hasExistingSecret:!!i[s],...a.length>0?{operations:a}:{}}})}function S(e){return e.startsWith(p)?e.slice(p.length):void 0}function C({target:e,hasExistingSecret:t,reason:r}){const n=`The link works for ${$()} minutes.`,o=x(e),i=r.kind==="authFailure"&&r.detail?` The API answered: ${r.detail}.`:"";return t?`Open this page in a browser to replace or remove the stored credentials for ${o}. They go straight to the API and never enter the chat. ${n}`:`${O(o)} needs credentials.${i} Open this page in a browser to paste them - they go straight to the API and never enter the chat. ${n}`}function x({name:e,schemeLabel:t}){return t?`the "${t}" scheme of the "${e}" API`:`the "${e}" API`}function O(e){return e.charAt(0).toUpperCase()+e.slice(1)}function $(){return Math.round(P/6e4)}function T(e,t){const r=I(A);if(!e)return`${r}?token=${t}`;try{const n=new URL(r,e);return n.searchParams.set("token",t),n.toString()}catch{return`${e}${r}?token=${t}`}}function _({target:e,reason:t,hasExistingSecret:r},n,o){const s=[`**Stop and show the user this link. They have to open it in a browser to ${r?`replace or remove the stored credentials for the "${e.name}" API`:`add credentials for the "${e.name}" API`} - nothing continues until they do.**`,"",n,"",`The link is valid ${$()} minutes and opens a form on this site. Credentials go straight to the API from there: never ask for them in the conversation and never pass them as a tool argument.`,"",t.kind==="authFailure"?`The upstream API "${e.name}" returned ${t.status}${t.detail?` (${t.detail})`:""} and needs credentials.`:r?`Credentials are already stored for the "${e.name}" API; the link lets the user replace or remove them.`:`The "${e.name}" API needs credentials.`,...e.schemeLabel?[`The operation authenticates with its "${e.schemeLabel}" security scheme.`]:[],o?`Once the user confirms they saved them, call this tool again with sessionHandle: "${o}" - the credentials are stored against that handle, applied server-side, and never appear in the conversation.`:"Once the user confirms they saved them, call this tool again - the credentials are applied server-side and never appear in the conversation."],a=t.kind==="authFailure"?t.otherApiNames??[]:[];if(a.length>0){const c=a.map(w=>`"${w}"`).join(", ");s.push("",`The remaining APIs (${c}) will prompt for credentials on subsequent calls.`)}return s.join(`
-`)}export{m as CREDENTIALS_INPUT_REQUEST_KEY,Y as acceptedCredentialsLink,B as buildCredentialsAcceptedHint,J as buildCredentialsToolHint,G as buildUpstreamCredentialFallback,z as buildUpstreamCredentialInputRequired,q as credentialElicitationAnswer,F as dedupeElicitation,H as isStatelessRequest,W as schemeLabelOf,D as supportsUrlElicitation};
+import{inputRequired as d,inputResponse as I}from"@modelcontextprotocol/server";import{withPathPrefix as w}from"@redocly/theme/core/utils";import{MCP_CREDENTIALS_ROUTE as E}from"../../../constants/mcp.js";import{MANAGE_API_CREDENTIALS_TOOL_NAME as h}from"../constants.js";import{secretStore as l,ELICITATION_TTL_MINUTES as u}from"./secret-store.js";import{operationsForScheme as A,orderedSchemesOf as P}from"./upstream-auth-scheme.js";import{ANONYMOUS_SUBJECT_PREFIX as p}from"./subject.js";const m="credentials",c=new Map;function F(e,t){const n=c.get(e);if(n)return n;const i=t().finally(()=>{c.delete(e)});return c.set(e,i),i}function M(e){return!!e?.elicitation?.url}function D(e){return e.envelope!==void 0}function H(e){const t=I(e,m);if(t.kind==="elicit")return t.action==="accept"?"accepted":"declined"}function q(e,t){return[`The user accepted the prompt to add credentials for the "${e}" API.`,...t?["The credentials page:",t]:[],"",`Wait until the user says they saved the credentials, then retry the call that needed them. Do not call \`${h}\` again unless the user asks for a new link.`].join(`
+`)}async function B(e,{kv:t,subject:n,baseUrl:i,apis:r}){if(typeof e!="string")return;const s=await l.peekElicitation(t,e);if(!(s?.subject!==n||!r.includes(s.api)))return{apiName:s.name,url:$(i,e)}}function W(e,t){return Object.keys(e).length>1?t:void 0}async function Y(e){const{token:t,url:n}=await f(e);return d({inputRequests:{[m]:d.elicitUrl({message:C(e),url:n})},requestState:t})}async function z(e){const{url:t}=await f(e);return x(e,t,S(e.subject))}function G(e,t){const n=b(e);if(e.status===401&&!e.sentScheme)return[`The "${e.name}" API returned ${n}. No stored credential was sent with this request, so this result says nothing about the stored credentials.`,"","Do not replace them. Check whether this operation needs a different kind of credential or a different route."].join(`
+`);const i=e.status===401?`The "${e.name}" API rejected the stored ${t?`"${t}" `:""}credential (${n}).`:`The "${e.name}" API rejected the request with ${n}.`,r=t?`api: "${e.api}" and scheme: "${t}"`:`api: "${e.api}"`;return[i,"",`Do not retry the same call. Call \`${h}\` with ${r} to get a link the user has to open in a browser to replace or remove the stored credentials, then retry once they confirm they saved them.`].join(`
+`)}function b({status:e,detail:t}){return t?`HTTP ${e}: ${t}`:`HTTP ${e}`}async function f({kv:e,subject:t,baseUrl:n,target:i,auth:r,apiAuth:s}){const a=s?k(s):[],o=await l.createElicitation(e,{subject:t,api:i.api,name:i.name,scheme:i.scheme,...i.schemeLabel?{schemeLabel:i.schemeLabel}:{},auth:r,...a.length>1?{schemes:a}:{},...a.length>1&&i.acceptedSchemes?{acceptedSchemes:i.acceptedSchemes}:{}});return{token:o,url:$(n,o)}}function k(e){return P(e.schemes).map(t=>{const n=A(e,t),i=e.descriptions?.[t];return{name:t,...i?{label:i}:{},auth:e.schemes[t],...n.length>0?{operations:n}:{}}})}function S(e){return e.startsWith(p)?e.slice(p.length):void 0}function C({target:e,hasExistingSecret:t,reason:n}){const i=`The link works for ${u} minutes.`,r=O(e),s=n.kind==="authFailure"&&n.detail?` The API answered: ${n.detail}.`:"";return t?`Open this page in a browser to replace or remove the stored credentials for ${r}. They stay out of the chat. ${i}`:`${g(r)} needs credentials.${s} Open this page in a browser to paste them - they stay out of the chat. ${i}`}function O({name:e,schemeLabel:t}){return t?`the "${t}" scheme of the "${e}" API`:`the "${e}" API`}function g(e){return e.charAt(0).toUpperCase()+e.slice(1)}function $(e,t){const n=w(E);if(!e)return`${n}?token=${t}`;try{const i=new URL(n,e);return i.searchParams.set("token",t),i.toString()}catch{return`${e}${n}?token=${t}`}}function x({target:e,reason:t,hasExistingSecret:n},i,r){const a=[`**Stop and show the user this link. They have to open it in a browser to ${n?`replace or remove the stored credentials for the "${e.name}" API`:`add credentials for the "${e.name}" API`} - nothing continues until they do.**`,"",i,"",`The link is valid ${u} minutes and opens a form on this site. The site stores the credentials and adds them to API calls: never ask for them in the conversation and never pass them as a tool argument.`,"",t.kind==="authFailure"?`The upstream API "${e.name}" returned ${t.status}${t.detail?` (${t.detail})`:""} and needs credentials.`:n?`Credentials are already stored for the "${e.name}" API; the link lets the user replace or remove them.`:`The "${e.name}" API needs credentials.`,...e.schemeLabel?[`The operation authenticates with its "${e.schemeLabel}" security scheme.`]:[],r?`Once the user confirms they saved them, retry the call that needed them with sessionHandle: "${r}" - the credentials are stored against that handle, applied server-side, and never appear in the conversation.`:"Once the user confirms they saved them, retry the call that needed them - the credentials are applied server-side and never appear in the conversation."],o=t.kind==="authFailure"?t.otherApiNames??[]:[];if(o.length>0){const T=o.map(y=>`"${y}"`).join(", ");a.push("",`The remaining APIs (${T}) will prompt for credentials on subsequent calls.`)}return a.join(`
+`)}export{m as CREDENTIALS_INPUT_REQUEST_KEY,B as acceptedCredentialsLink,q as buildCredentialsAcceptedHint,G as buildCredentialsToolHint,z as buildUpstreamCredentialFallback,Y as buildUpstreamCredentialInputRequired,H as credentialElicitationAnswer,F as dedupeElicitation,D as isStatelessRequest,W as schemeLabelOf,M as supportsUrlElicitation};

package/dist/server/plugins/mcp/gateway-mcp/eligibility.d.ts

@@ -1,9 +1,13 @@
 import type { OpenAPIDefinition, OpenAPIMcp } from '@redocly/api-docs';
-import type { RbacConfig, RedoclyConfig } from '@redocly/config';
+import type { RedoclyConfig } from '@redocly/config';
 /** Whether the gateway fetch capability is on: the feature flag plus none of mcp/docs hidden. */
 export declare function isGatewayCapabilityEnabled(mcp?: RedoclyConfig['mcp']): boolean;
-/** Whether an API is eligible for the gateway (fetch-capable `execute` + `/mcp` advertisement). */
-export declare function isGatewayEligible(info: OpenAPIDefinition['info'] | undefined, relativePath: string, rbacConfig: RbacConfig): boolean;
+/**
+ * Whether the API description allows agent calls: every documented API does unless its
+ * `info.x-mcp.apiCalls.hide` is set. Who may call it is decided per request by RBAC, and
+ * `mcp.apiCalls` config by `getCallableApis`.
+ */
+export declare function isGatewayEligible(info: OpenAPIDefinition['info'] | undefined): boolean;
 /**
  * Whether an API docs page advertises the `/mcp` endpoint via an injected root-level x-mcp:
  * the capability is on, the author has not provided their own x-mcp servers, and the API is
@@ -13,6 +17,6 @@ export declare function shouldAdvertiseGatewayXMcp(definition: (OpenAPIDefinitio
     'x-mcp'?: {
         servers?: unknown[];
     };
-}) | undefined, relativePath: string, rbacConfig: RbacConfig, mcpConfig?: RedoclyConfig['mcp']): boolean;
+}) | undefined, relativePath: string, mcpConfig?: RedoclyConfig['mcp']): boolean;
 export declare function buildGatewayXMcp(url: string): OpenAPIMcp;
 //# sourceMappingURL=eligibility.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/eligibility.js

@@ -1 +1 @@
-import{join as e}from"node:path";import{PUBLIC_API_DEFINITIONS_FOLDER as s}from"../../../constants/common.js";import{ANONYMOUS_AUTH_DETAILS as n}from"../../../constants/rbac.js";import{canDownloadApiDefinition as a}from"../../../utils/rbac.js";import{MCP_PROTOCOL_VERSION as p}from"../constants.js";import{isApiIncludedInDocsMcp as c}from"../utils.js";import{isMcpGatewayEnabled as l}from"../utils/mode.js";import{isDefinitionHidden as m,hasGatewayConfig as f}from"../utils/xmcp-utils.js";function u(o){return l()&&!o?.hide&&!o?.docs?.hide}function d(o,r,i){return m(o,"gateway")?!1:a(e(s,r),i,!1,n)||f(o)}function _(o,r,i,t){return u(t)&&!o?.["x-mcp"]?.servers?.length&&d(o?.info,r,i)&&c(r,o,t)}function G(o){return{protocolVersion:p,capabilities:{tools:{}},servers:[{url:o}],tools:[],resources:[],prompts:[]}}export{G as buildGatewayXMcp,u as isGatewayCapabilityEnabled,d as isGatewayEligible,_ as shouldAdvertiseGatewayXMcp};
+import{MCP_PROTOCOL_VERSION as t}from"../constants.js";import{isApiIncludedInDocsMcp as i}from"../utils.js";import{isMcpGatewayEnabled as s}from"../utils/mode.js";import{isDefinitionHidden as a}from"../utils/xmcp-utils.js";function p(e){return s()&&!e?.hide&&!e?.docs?.hide}function n(e){return!a(e,"apiCalls")}function m(e,o,r){return p(r)&&!e?.["x-mcp"]?.servers?.length&&n(e?.info)&&i(o,e,r)}function f(e){return{protocolVersion:t,capabilities:{tools:{}},servers:[{url:e}],tools:[],resources:[],prompts:[]}}export{f as buildGatewayXMcp,p as isGatewayCapabilityEnabled,n as isGatewayEligible,m as shouldAdvertiseGatewayXMcp};

package/dist/server/plugins/mcp/gateway-mcp/fetch/fetch-audit.d.ts

@@ -6,6 +6,7 @@ type GatewayFetchAuditRecord = {
     outcome: GatewayFetchOutcome;
     durationMs: number;
     injectedSecretValues: readonly string[];
+    credentialQueryParams?: readonly string[];
     path?: string;
     api?: string;
     status?: number;
@@ -20,6 +21,6 @@ type GatewayFetchAuditRecord = {
  * telemetry event verbatim so a Grafana row joins onto this line; `url_sha256` identifies the
  * request itself, since the telemetry event's `path` is deliberately normalized.
  */
-export declare function logGatewayFetchAudit({ rawUrl, method, host, outcome, durationMs, injectedSecretValues, path, api, status, injectedScheme, requestHeaders, requestBody, responseHeaders, responseBody, }: GatewayFetchAuditRecord): void;
+export declare function logGatewayFetchAudit({ rawUrl, method, host, outcome, durationMs, injectedSecretValues, credentialQueryParams, path, api, status, injectedScheme, requestHeaders, requestBody, responseHeaders, responseBody, }: GatewayFetchAuditRecord): void;
 export {};
 //# sourceMappingURL=fetch-audit.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/fetch/fetch-audit.js

@@ -1 +1 @@
-import{auditHeaderNames as n,auditInput as g,auditOutputDigest as b,auditSha256 as l,auditUrl as y,logAuditRecord as A}from"../../audit/audit-log.js";function R({rawUrl:e,method:u,host:i,outcome:r,durationMs:o,injectedSecretValues:t,path:_,api:h,status:f,injectedScheme:m,requestHeaders:p,requestBody:d,responseHeaders:c,responseBody:s}){const a=s===void 0?void 0:b(s);A("Record gateway fetch",{url_sha256:l(e),host:i,method:u,path:_,api:h,outcome:r,status:f,injected_scheme:m,duration_ms:o,url:y(e,t),request_header_names:n(p),request_body:d===void 0?void 0:g(d,t),response_header_names:n(c),response_sha256:a?.sha256,response_bytes:a?.bytes})}export{R as logGatewayFetchAudit};
+import{auditHeaderNames as n,auditInput as b,auditOutputDigest as l,auditSha256 as y,auditUrl as A,logAuditRecord as D}from"../../audit/audit-log.js";function q({rawUrl:e,method:u,host:i,outcome:r,durationMs:o,injectedSecretValues:t,credentialQueryParams:_,path:h,api:f,status:m,injectedScheme:p,requestHeaders:c,requestBody:d,responseHeaders:g,responseBody:s}){const a=s===void 0?void 0:l(s);D("Record gateway fetch",{url_sha256:y(e),host:i,method:u,path:h,api:f,outcome:r,status:m,injected_scheme:p,duration_ms:o,url:A(e,t,_),request_header_names:n(c),request_body:d===void 0?void 0:b(d,t),response_header_names:n(g),response_sha256:a?.sha256,response_bytes:a?.bytes})}export{q as logGatewayFetchAudit};

package/dist/server/plugins/mcp/gateway-mcp/fetch/fetch-bridge.d.ts

@@ -2,6 +2,7 @@ import { Agent, type Dispatcher } from 'undici';
 import type { SandboxFetch } from '../../codemode/types.js';
 import type { UpstreamAuthRequiredEvent } from '../upstream-auth.js';
 import type { StoredSecret } from '../secret-store.js';
+import { type ApiCallOperation } from '../api-call-operations.js';
 export declare function getDefaultAgent(): Agent;
 export type FetchBridgeRoute = {
     pattern: RegExp;
@@ -16,7 +17,13 @@ export type FetchBridgeApi = {
     defaultScheme?: string;
     routes?: readonly FetchBridgeRoute[];
     credentialHeaders?: readonly string[];
+    credentialQueryParams?: readonly string[];
     schemePriority?: readonly string[];
+    /**
+     * The documented operations agents may reach on this API's hosts; see `apiCallOperationsOf`.
+     * Undefined puts no path restriction on the API.
+     */
+    operations?: readonly ApiCallOperation[];
 };
 type FetchBridgeOptions = {
     allowedHosts: readonly RegExp[];
@@ -28,10 +35,13 @@ type FetchBridgeOptions = {
     timeoutMs?: number;
     maxResponseBytes?: number;
     maxFetchesPerExec?: number;
+    beforeSend?: () => Promise<void>;
     clientIp?: string;
+    /** Upper-case methods that may reach the network (`mcp.apiCalls.allowedHttpMethods`); undefined allows all. */
+    allowedHttpMethods?: readonly string[];
 };
 /** Build the host-side `fetch` the gateway sandbox calls. */
-export declare function buildFetchBridge({ allowedHosts, apis, authorization, onAuthRequired, fetchImpl, dispatcher, timeoutMs, maxResponseBytes, maxFetchesPerExec, clientIp, }: FetchBridgeOptions): SandboxFetch;
+export declare function buildFetchBridge({ allowedHosts, apis, authorization, onAuthRequired, fetchImpl, dispatcher, timeoutMs, maxResponseBytes, maxFetchesPerExec, beforeSend, clientIp, allowedHttpMethods, }: FetchBridgeOptions): SandboxFetch;
 export declare function readCappedBody(response: Response, maxBytes: number): Promise<string>;
 export {};
 //# sourceMappingURL=fetch-bridge.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/fetch/fetch-bridge.js

@@ -1 +1 @@
-import{Agent as Q}from"undici";import{envConfig as Z}from"../../../../config/env-config.js";import{logger as N}from"../../../../tools/notifiers/logger.js";import{assertUrlAllowed as I}from"./ssrf-guard.js";import{createSsrfSafeLookup as q}from"../../../../web-server/utils/ssrf-safe-lookup.js";import{SsrfBlockedError as W}from"../../../../web-server/utils/ssrf-blocklist.js";import{GatewayFetchBlockedError as R,GatewayFetchSystemError as ee,GatewayFetchUserError as g}from"./fetch-errors.js";import{redactHeaders as J,redactSecretsFromString as te}from"./redact.js";import{extractUpstreamDetail as re}from"./upstream-detail.js";import{normalizeFetchPath as ne}from"./normalize-path.js";import{reportGatewayFetch as K}from"./fetch-telemetry.js";import{logGatewayFetchAudit as V}from"./fetch-audit.js";const X="x-forwarded-for",oe=3e4,se=1024*1024,ae=new Set([401,403,407]);let C;function ce(){if(!C){const e=Z.isDevelopMode;e&&N.warn("Gateway MCP SSRF guard: loopback upstreams are ALLOWED (develop mode only, never in runtime)."),C=new Q({connect:{lookup:q({allowLoopback:e})}})}return C}function _e({allowedHosts:e,apis:t=[],authorization:r,onAuthRequired:n,fetchImpl:c=fetch,dispatcher:a=ce(),timeoutMs:h=oe,maxResponseBytes:l=se,maxFetchesPerExec:w,clientIp:k}){const f=[...e,...t.flatMap(o=>o.matchers)],$=[...new Set(t.map(o=>o.name).filter(Boolean))].join(", "),m=t.flatMap(o=>Object.values(o.secrets??{})),D=[r,...m.map(o=>o.value)].filter(o=>!!o),x=m.map(o=>o.header);let O=0;return async o=>{const y=o.method??"GET",T=Date.now();let B,b,A,E={},H,_,j;try{if(w!==void 0){const u=Math.max(0,w);if(O+=1,O>u)throw new g(`Outbound fetch budget exceeded (max ${u} fetches per execute); split the work across calls`)}const d=le(o.url,f,$);B=d.hostname,b=ne(d.pathname);const v=t.filter(u=>u.matchers.some(z=>z.test(d.hostname))),s=v.length===1?v[0]:void 0;A=s?.slug;const S=pe(o.securityScheme,s),F=S?[S]:s?ye(s,d.pathname,y):void 0,L=s&&F?Se(s,F):void 0,P=L?s?.secrets?.[L]:void 0,M=be({callerHeaders:o.headers,secret:P,authorization:r,clientIp:k,credentialHeaders:s?.credentialHeaders});E=M.headers,H=P&&!M.callerHeader?L:void 0;const G=new AbortController;j=setTimeout(()=>G.abort(),h);const i=await c(d,{method:y,headers:E,body:o.body,redirect:"manual",signal:G.signal,dispatcher:a});_=i.status;let U="";try{U=await we(i,l)}finally{if(ae.has(i.status)&&s&&n){const u=re(U,i.headers.get("content-type"),D);n({api:s.slug,name:s.name,status:i.status,...L?{scheme:L}:{},...F?.length?{schemes:[...F]}:{},...H?{sentScheme:H}:{},...M.callerHeader?{callerHeader:M.callerHeader}:{},...u?{detail:u}:{}})}}let p=Ae(i.headers);if(fe(i.status)){p=J(p,x);const{location:u}=p;u&&!he(u,d,f)&&delete p.location}return K({host:d.hostname,method:y,outcome:"success",durationMs:Date.now()-T,path:b,api:A,status:i.status,bytes:Buffer.byteLength(U,"utf8")}),V({rawUrl:d.href,method:y,host:d.hostname,outcome:"success",durationMs:Date.now()-T,injectedSecretValues:D,path:b,api:A,status:i.status,injectedScheme:H,requestHeaders:E,requestBody:o.body,responseHeaders:p,responseBody:U}),{status:i.status,statusText:i.statusText,ok:i.ok,headers:p,bodyText:U}}catch(d){const{outcome:v,userSafe:s}=ie(d),S=B??(s instanceof R?s.host:void 0)??ue(o.url)??"invalid-url";throw K({host:S,method:y,outcome:v,durationMs:Date.now()-T,path:b,api:A,status:_}),V({rawUrl:o.url,method:y,host:S,outcome:v,durationMs:Date.now()-T,injectedSecretValues:D,path:b,api:A,status:_,injectedScheme:H,requestHeaders:E,requestBody:o.body}),s||(N.error(`Gateway MCP fetch failed [${y} ${S}]: ${te(me(d),D)} headers=${JSON.stringify(J(E,x))}`),new ee("Upstream fetch failed due to an internal error"))}finally{j!==void 0&&clearTimeout(j)}}}function de(e){let t=e;for(let r=0;r<5&&t instanceof Error;r++){if(t instanceof g||t instanceof W)return t;t=t.cause}}function ie(e){const t=de(e);return{outcome:t instanceof R||t instanceof W?"blocked":t?"user_error":"system_error",userSafe:t}}function le(e,t,r){try{return I(e,t)}catch(n){throw n instanceof R&&r?new R(`${n.message}. \`fetch\` reaches only the documented hosts of the callable APIs (${r}); other documented APIs can be read through the tools but not called.`,n.host):n}}function ue(e){try{return new URL(e).hostname||void 0}catch{return}}function fe(e){return e>=300&&e<400}function he(e,t,r){try{return!!I(new URL(e,t).href,r)}catch{return!1}}function me(e){if(!(e instanceof Error))return String(e);const t=e.cause;return t instanceof Error?`${e.message}: ${t.message}`:e.message}async function we(e,t){const r=Number(e.headers.get("content-length"));if(Number.isFinite(r)&&r>t)throw Y(t,r);if(!e.body)return"";const n=e.body.getReader(),c=new TextDecoder;let a=0,h="";try{for(;;){const{done:l,value:w}=await n.read();if(l)break;if(a+=w.byteLength,a>t)throw Y(t,a);h+=c.decode(w,{stream:!0})}return h+c.decode()}finally{await n.cancel().catch(()=>{})}}function Y(e,t){return new g(`Response is too large (over ${e} bytes, got ${t}); request less data`)}function ye(e,t,r){const n=e.routes?.find(c=>c.method===r&&c.pattern.test(t));return n?n.schemes:ge(e)}function Se(e,t){const r=t.filter(n=>e.secrets?.[n]);return r.length===0?t[0]:r.reduce((n,c)=>{const a=e.secrets?.[n]?.savedAt??0;return(e.secrets?.[c]?.savedAt??0)>a?c:n})}function pe(e,t){if(e==null)return;if(typeof e!="string")throw new g("securityScheme must be a security scheme name (a string)");if(!t)throw new g("securityScheme cannot be applied: the URL host does not identify exactly one callable API");const r=t.schemePriority??[];if(r.length>0&&!r.includes(e))throw new g(`Unknown securityScheme "${e}" for ${t.name}; valid values: ${r.join(", ")}`);return e}function ge(e){const t=Object.keys(e.secrets??{});if(t.length===0)return e.defaultScheme?[e.defaultScheme]:[];const r=(e.schemePriority??[]).filter(n=>t.includes(n));return[...r,...t.filter(n=>!r.includes(n))]}function be({callerHeaders:e,secret:t,authorization:r,clientIp:n,credentialHeaders:c}){const a={},h=new Set,l=t??(r?{header:"Authorization",value:r}:void 0),w=l?new Set((c??[]).map(f=>f.toLowerCase()).filter(f=>f!==l.header.toLowerCase())):new Set;for(const[f,$]of Object.entries(e??{})){const m=f.toLowerCase();m==="host"||m==="content-length"||m!==X&&(w.has(m)||(h.add(m),a[f]=$))}if(n&&(a[X]=n),!l)return{headers:a};const k=l.header.toLowerCase();return h.has(k)?{headers:a,callerHeader:k}:(a[l.header]=l.value,{headers:a})}function Ae(e){const t={};return e.forEach((r,n)=>{t[n.toLowerCase()]=r}),t}export{_e as buildFetchBridge,ce as getDefaultAgent,we as readCappedBody};
+import{Agent as ie}from"undici";import{envConfig as le}from"../../../../config/env-config.js";import{logger as K}from"../../../../tools/notifiers/logger.js";import{auditHeaderNames as de}from"../../audit/audit-log.js";import{assertUrlAllowed as X}from"./ssrf-guard.js";import{createSsrfSafeLookup as ue}from"../../../../web-server/utils/ssrf-safe-lookup.js";import{SsrfBlockedError as J}from"../../../../web-server/utils/ssrf-blocklist.js";import{GatewayFetchBlockedError as p,GatewayFetchSystemError as fe,GatewayFetchUserError as S}from"./fetch-errors.js";import{redactHeaders as he,redactSecretValuesFromHeaders as me,redactSecretsFromString as _,secretEchoForms as pe}from"./redact.js";import{extractUpstreamDetail as we}from"./upstream-detail.js";import{normalizeFetchPath as ye}from"./normalize-path.js";import{reportGatewayFetch as Z}from"./fetch-telemetry.js";import{logGatewayFetchAudit as q}from"./fetch-audit.js";import{matchingApiCallOperations as Se}from"../api-call-operations.js";import{operationHttpMethod as be}from"../route-pattern.js";const ee="x-forwarded-for",ge=3e4,Ae=1024*1024,Ee=/%2f|%5c/i,ve=new Set([401,403,407]),$e=["authorization","proxy-authorization","cookie","x-api-key"];let x;function ke(){if(!x){const e=le.isDevelopMode;e&&K.warn("Gateway MCP SSRF guard: loopback upstreams are ALLOWED (develop mode only, never in runtime)."),x=new ie({connect:{lookup:ue({allowLoopback:e})}})}return x}function nt({allowedHosts:e,apis:t=[],authorization:r,onAuthRequired:n,fetchImpl:c=fetch,dispatcher:d=ke(),timeoutMs:f=ge,maxResponseBytes:b=Ae,maxFetchesPerExec:i,beforeSend:oe,clientIp:ae,allowedHttpMethods:P}){const O=[...e,...t.flatMap(a=>a.matchers)],se=[...new Set(t.map(a=>a.name).filter(Boolean))].join(", "),j=t.flatMap(a=>Object.values(a.secrets??{})),w=[...r?[{header:"Authorization",value:r}]:[],...j].flatMap(pe),ce=j.map(a=>a.header),I=t.flatMap(a=>a.credentialQueryParams??[]);let N=0,B=!1;return async a=>{const l=be(a.method??"GET"),D=Date.now();let G,A,E,v={},$,U,H;try{if(i!==void 0){const o=Math.max(0,i);if(N+=1,N>o)throw new S(`Outbound fetch budget exceeded (max ${o} fetches per execute); split the work across calls`)}if(P&&!P.includes(l))throw new p(`${l} is not allowed: this project permits only ${P.join(", ")} API calls`,te(a.url));const s=Re(a.url,O,se);if(G=s.hostname,A=ye(s.pathname),Ee.test(s.pathname))throw new p(`${l} ${s.pathname} is refused: the path holds an encoded path separator (%2F or %5C), which could reach an operation other than the documented one`,s.hostname);const y=t.filter(o=>o.matchers.some(T=>T.test(s.hostname))),m=y.flatMap(o=>o.operations?Se(o.operations,s.pathname,l).map(T=>({api:o,callable:T.callable,visible:T.visible,variables:T.variables})):[{api:o,callable:!0,visible:!0,variables:Number.POSITIVE_INFINITY}]),k=Math.min(...m.map(o=>o.variables)),M=m.filter(o=>o.variables===k);if(y.length>0&&(m.length===0||M.some(o=>!o.visible)))throw new p(`${l} ${s.pathname} is not a documented operation of ${y.map(o=>o.name).join(", ")}; \`fetch\` calls only the operations the API description documents`,s.hostname);const V=M.find(o=>!o.callable);if(V)throw new p(`${l} ${s.pathname} is not callable: this operation of ${V.api.name} is excluded from agent calls`,s.hostname);const h=new Set(M.map(o=>o.api)).size===1?M[0].api:void 0;E=h?.slug;const z=He(a.securityScheme,h),F=z?[z]:h?Pe(h,s.pathname,l):void 0,C=h&&F?Ue(h,F):void 0,Q=C?h?.secrets?.[C]:void 0,L=Q??(r?{header:"Authorization",value:r}:void 0);v=je({callerHeaders:a.headers,injected:L,clientIp:ae});const W=xe(a.headers,s,y,L);if(W&&(L||B))throw new S(Oe(W,!!L));await oe?.(),B||=!!L,$=Q?C:void 0;const Y=new AbortController;H=setTimeout(()=>Y.abort(),f);const u=await c(s,{method:l,headers:v,body:a.body,redirect:"manual",signal:Y.signal,dispatcher:d});U=u.status;let R="";try{R=await Fe(u,b)}finally{if(ve.has(u.status)&&h&&n){const o=we(R,u.headers.get("content-type"),w);n({api:h.slug,name:h.name,status:u.status,...C?{scheme:C}:{},...F?.length?{schemes:[...F]}:{},...$?{sentScheme:$}:{},...o?{detail:o}:{}})}}let g=me(Ie(u.headers),w);if(Te(u.status)){g=he(g,ce);const{location:o}=g;o&&!De(o,s,O)&&delete g.location}return Z({host:s.hostname,method:l,outcome:"success",durationMs:Date.now()-D,path:A,api:E,status:u.status,bytes:Buffer.byteLength(R,"utf8")}),q({rawUrl:s.href,method:l,host:s.hostname,outcome:"success",durationMs:Date.now()-D,injectedSecretValues:w,credentialQueryParams:I,path:A,api:E,status:u.status,injectedScheme:$,requestHeaders:v,requestBody:a.body,responseHeaders:g,responseBody:R}),{status:u.status,statusText:_(u.statusText,w),ok:u.ok,headers:g,bodyText:_(R,w)}}catch(s){const{outcome:y,userSafe:m}=Le(s),k=G??(m instanceof p?m.host:void 0)??te(a.url)??"invalid-url";throw Z({host:k,method:l,outcome:y,durationMs:Date.now()-D,path:A,api:E,status:U}),q({rawUrl:a.url,method:l,host:k,outcome:y,durationMs:Date.now()-D,injectedSecretValues:w,credentialQueryParams:I,path:A,api:E,status:U,injectedScheme:$,requestHeaders:v,requestBody:a.body}),m||(K.error(`Gateway MCP fetch failed [${l} ${k}]: ${_(Me(s),w)} headers=${de(v)}`),new fe("Upstream fetch failed due to an internal error"))}finally{H!==void 0&&clearTimeout(H)}}}function Ce(e){let t=e;for(let r=0;r<5&&t instanceof Error;r++){if(t instanceof S||t instanceof J)return t;t=t.cause}}function Le(e){const t=Ce(e);return{outcome:t instanceof p||t instanceof J?"blocked":t?"user_error":"system_error",userSafe:t}}function Re(e,t,r){try{return X(e,t)}catch(n){throw n instanceof p&&r?new p(`${n.message}. \`fetch\` reaches only the documented hosts of the callable APIs (${r}); other documented APIs can be read through the tools but not called.`,n.host):n}}function te(e){try{return new URL(e).hostname||void 0}catch{return}}function Te(e){return e>=300&&e<400}function De(e,t,r){try{return!!X(new URL(e,t).href,r)}catch{return!1}}function Me(e){if(!(e instanceof Error))return String(e);const t=e.cause;return t instanceof Error?`${e.message}: ${t.message}`:e.message}async function Fe(e,t){const r=Number(e.headers.get("content-length"));if(Number.isFinite(r)&&r>t)throw re(t,r);if(!e.body)return"";const n=e.body.getReader(),c=new TextDecoder;let d=0,f="";try{for(;;){const{done:b,value:i}=await n.read();if(b)break;if(d+=i.byteLength,d>t)throw re(t,d);f+=c.decode(i,{stream:!0})}return f+c.decode()}finally{await n.cancel().catch(()=>{})}}function re(e,t){return new S(`Response is too large (over ${e} bytes, got ${t}); request less data`)}function Pe(e,t,r){const n=e.routes?.find(c=>c.method===r&&c.pattern.test(t));return n?n.schemes:_e(e)}function Ue(e,t){const r=t.filter(n=>e.secrets?.[n]);return r.length===0?t[0]:r.reduce((n,c)=>{const d=e.secrets?.[n]?.savedAt??0;return(e.secrets?.[c]?.savedAt??0)>d?c:n})}function He(e,t){if(e==null)return;if(typeof e!="string")throw new S("securityScheme must be a security scheme name (a string)");if(!t)throw new S("securityScheme cannot be applied: the URL host does not identify exactly one callable API");const r=t.schemePriority??[];if(r.length>0&&!r.includes(e))throw new S(`Unknown securityScheme "${e}" for ${t.name}; valid values: ${r.join(", ")}`);return e}function _e(e){const t=Object.keys(e.secrets??{});if(t.length===0)return e.defaultScheme?[e.defaultScheme]:[];const r=(e.schemePriority??[]).filter(n=>t.includes(n));return[...r,...t.filter(n=>!r.includes(n))]}function xe(e,t,r,n){const c=ne([...$e,...r.flatMap(i=>i.credentialHeaders??[]),...n?[n.header]:[]]),d=Object.keys(e??{}).find(i=>c.has(i.toLowerCase()));if(d)return{kind:"header",name:d};const f=ne(r.flatMap(i=>i.credentialQueryParams??[])),b=[...t.searchParams.keys()].find(i=>f.has(i.toLowerCase()));return b?{kind:"query parameter",name:b}:void 0}function ne(e){return new Set(e.map(t=>t.toLowerCase()))}function Oe({kind:e,name:t},r){return r?`Remove the "${t}" ${e}: this request already sends the stored credential.`:`Remove the "${t}" ${e}: this script already sent a stored credential, so it cannot also send its own.`}function je({callerHeaders:e,injected:t,clientIp:r}){const n={};for(const[c,d]of Object.entries(e??{})){const f=c.toLowerCase();f==="host"||f==="content-length"||f!==ee&&(n[c]=d)}return r&&(n[ee]=r),t&&(n[t.header]=t.value),n}function Ie(e){const t={};return e.forEach((r,n)=>{t[n.toLowerCase()]=r}),t}export{nt as buildFetchBridge,ke as getDefaultAgent,Fe as readCappedBody};

package/dist/server/plugins/mcp/gateway-mcp/fetch/redact.d.ts

@@ -1,4 +1,15 @@
 export declare const REDACTED = "\u00AB[redacted]\u00BB";
+/**
+ * Every form in which an upstream can echo an injected credential: the full header value, the
+ * token without its auth scheme, the decoded `user:password` of a Basic value, and the cookie
+ * value without its name, each also JSON-escaped and URL-encoded. Parts under 8 characters are
+ * left out so they do not redact unrelated text.
+ */
+export declare function secretEchoForms({ header, value }: {
+    header: string;
+    value: string;
+}): string[];
 export declare function redactSecretsFromString(text: string, secretValues: readonly string[]): string;
+export declare function redactSecretValuesFromHeaders(headers: Record<string, string>, secretValues: readonly string[]): Record<string, string>;
 export declare function redactHeaders(headers: Record<string, string>, extraSensitiveNames?: readonly string[]): Record<string, string>;
 //# sourceMappingURL=redact.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/fetch/redact.js

@@ -1 +1 @@
-const s="\xAB[redacted]\xBB",c=["authorization","proxy-authorization","cookie","set-cookie"];function a(r,n){let t=r;for(const e of n)e.trim()&&(t=t.split(e).join(s));return t}function u(r,n=[]){const t=new Set([...c,...n].map(o=>o.toLowerCase())),e={};for(const[o,i]of Object.entries(r))e[o]=t.has(o.toLowerCase())?s:i;return e}export{s as REDACTED,u as redactHeaders,a as redactSecretsFromString};
+const i="\xAB[redacted]\xBB",f=["authorization","proxy-authorization","cookie","set-cookie"],m=8,a=/^([A-Za-z][\w-]*) +(\S+)$/;function p({header:t,value:e}){if(!e.trim())return[];const n=u(t,e).filter(r=>r.trim().length>=8);return[...new Set([e,...n].flatMap(E))]}function u(t,e){if(t.toLowerCase()==="cookie"){const c=e.indexOf("=");return c>0?[e.slice(c+1)]:[]}const n=a.exec(e);if(!n)return[];const[,r,o]=n,s=r.toLowerCase()==="basic"?d(o):void 0;return s?[o,s]:[o]}function d(t){const e=Buffer.from(t,"base64").toString("utf8");return Buffer.from(e,"utf8").toString("base64")===t&&e.includes(":")?e:void 0}function E(t){const e=JSON.stringify(t).slice(1,-1);return[t,e,e.replace(/\//g,"\\/"),encodeURIComponent(t)]}function l(t,e){const n=e.filter(o=>o.trim()).sort((o,s)=>s.length-o.length);let r=t;for(const o of n)r=r.split(o).join(i);return r}function S(t,e){const n={};for(const[r,o]of Object.entries(t))n[r]=l(o,e);return n}function x(t,e=[]){const n=new Set([...f,...e].map(o=>o.toLowerCase())),r={};for(const[o,s]of Object.entries(t))r[o]=n.has(o.toLowerCase())?i:s;return r}export{i as REDACTED,x as redactHeaders,S as redactSecretValuesFromHeaders,l as redactSecretsFromString,p as secretEchoForms};

package/dist/server/plugins/mcp/gateway-mcp/fetch-capability.js

@@ -1 +1 @@
-import{getCallableApis as l}from"./callable-apis.js";import{buildAllowedHostMatchers as a}from"./fetch/allowed-hosts.js";import{buildFetchBridge as m}from"./fetch/fetch-bridge.js";import{credentialHeadersOf as o,orderedSchemesOf as c,resolveUpstreamApiAuth as h}from"./upstream-auth-scheme.js";async function f(e,s){const i=await Promise.all(l(e).map(async r=>{const t=await h(e,r.relativePath);return{slug:r.relativePath,name:r.name,matchers:a(r.servers??[]),secrets:e.upstreamSecrets?.[r.relativePath],defaultScheme:t.defaultScheme,routes:t.routes,credentialHeaders:o(t.schemes),schemePriority:c(t.schemes)}}));return m({allowedHosts:a([]),apis:i,authorization:e.upstreamAuthorization,onAuthRequired:s,maxFetchesPerExec:e.gatewayFetchBudgetPerExec,clientIp:e.clientIp})}export{f as buildExecuteHostFetch};
+import{isDefined as l}from"../../../../utils/guards/is-defined.js";import{filterApiDescriptionByAccess as c,readApiDescriptionFromFs as u}from"../docs-mcp/tools/openapi/utils.js";import{isDefinitionHidden as d}from"../utils/xmcp-utils.js";import{getAllowedHttpMethods as m}from"./allowed-http-methods.js";import{getCallableApis as f,getExcludedOperations as h}from"./callable-apis.js";import{apiCallOperationsOf as p}from"./api-call-operations.js";import{buildAllowedHostMatchers as n}from"./fetch/allowed-hosts.js";import{buildFetchBridge as w}from"./fetch/fetch-bridge.js";import{GatewayFetchUserError as b}from"./fetch/fetch-errors.js";import{sendFetchCount as g}from"./rate-limit/fetch-limiter/fetch-count-client.js";import{credentialHeadersOf as v,orderedSchemesOf as y,resolveUpstreamApiAuth as P}from"./upstream-auth-scheme.js";async function z(e,t){const i=await Promise.all(f(e).map(async r=>{const a=await F(e,r.relativePath),o=a?.visible;if(o&&d(o.info,"apiCalls"))return;const s=await P(e,r.relativePath,async()=>o);return{slug:r.relativePath,name:r.name,matchers:n(r.servers??[]),secrets:e.upstreamSecrets?.[r.relativePath],defaultScheme:s.defaultScheme,routes:s.routes,credentialHeaders:v(s.schemes),credentialQueryParams:s.credentialQueryParams,schemePriority:y(s.schemes),operations:a?.visible?p(a.full,a.visible,r.servers??[],h(e,r.relativePath)):[]}}));return w({allowedHosts:n([]),apis:i.filter(l),authorization:e.upstreamAuthorization,onAuthRequired:t,maxFetchesPerExec:e.gatewayFetchBudgetPerExec,beforeSend:A(e),clientIp:e.clientIp,allowedHttpMethods:m(e.config?.mcp)})}function A(e){const{fetchCountRequest:t,internalBaseUrl:i}=e;if(!(!t||!i))return async()=>{const r=await g(i,t);if(r)throw new b(r)}}async function F(e,t){try{const i=await u(t,e.outdir||"");if(!i)return;const r=c(i,{user:e.user,rbac:e.config?.access?.rbac||{},requiresLogin:!!e.config?.access?.requiresLogin});return{full:i,visible:r}}catch{return}}export{z as buildExecuteHostFetch};

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/fetch-limiter/fetch-count-client.d.ts

@@ -0,0 +1,4 @@
+import type { FetchCountRequest } from '../../../types.js';
+/** The refusal when a limit is reached; when the check itself fails, the fetch is allowed. */
+export declare function sendFetchCount(serverBaseUrl: string, { caller, secret }: FetchCountRequest): Promise<string | undefined>;
+//# sourceMappingURL=fetch-count-client.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/fetch-limiter/fetch-count-client.js

@@ -0,0 +1 @@
+import{withPathPrefix as i}from"@redocly/theme/core/utils";import{ServerRoutes as a}from"../../../../../../constants/api.js";import{logger as e}from"../../../../../tools/notifiers/logger.js";const c=5e3;async function d(r,{caller:n,secret:o}){try{const t=await fetch(`${r}${i(a.MCP_FETCH_COUNT)}`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${o}`},body:JSON.stringify({caller:n}),signal:AbortSignal.timeout(c)});if(t.status===429)return await t.text();t.ok||e.warn(`Fetch limit check answered ${t.status}; the fetch was allowed uncounted`);return}catch(t){e.warn(`Fetch limit check failed; the fetch was allowed uncounted: ${String(t)}`);return}}export{d as sendFetchCount};

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/fetch-limiter/fetch-count-secret.d.ts

@@ -0,0 +1,4 @@
+/** The secret of this server process; only its own execute workers receive it. */
+export declare function fetchCountSecret(): string;
+export declare function isFetchCountSecret(value: string | null | undefined): boolean;
+//# sourceMappingURL=fetch-count-secret.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/fetch-limiter/fetch-count-secret.js

@@ -0,0 +1 @@
+import{randomBytes as o,timingSafeEqual as f}from"node:crypto";const n=o(32).toString("base64url");function i(){return n}function u(t){if(typeof t!="string")return!1;const e=Buffer.from(t),r=Buffer.from(n);return e.length===r.length&&f(e,r)}export{i as fetchCountSecret,u as isFetchCountSecret};

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/fetch-limiter/fetch-count.d.ts

@@ -0,0 +1,11 @@
+import type { FetchCountRequest } from '../../../types.js';
+import type { FetchCounterRepository } from './fetch-counter-repository.js';
+import type { GatewayFetchLimits } from './fetch-limits.js';
+type FetchLimits = Pick<GatewayFetchLimits, 'ratePerMin' | 'quotaPerDay'>;
+/**
+ * Counts one fetch atomically and returns the refusal when a window is full. A signed-in user
+ * is counted by subject, an anonymous caller by IP; a caller with neither is not counted.
+ */
+export declare function applyFetchCount(store: FetchCounterRepository, caller: FetchCountRequest['caller'], limits: FetchLimits, now: number): Promise<string | undefined>;
+export {};
+//# sourceMappingURL=fetch-count.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/fetch-limiter/fetch-count.js

@@ -0,0 +1 @@
+import{logger as u}from"../../../../../tools/notifiers/logger.js";const d=[{seconds:60,limitOf:"ratePerMin",per:"minute"},{seconds:86400,limitOf:"quotaPerDay",per:"day"}];function a(c,r,i){const n=Math.floor(i/1e3);return d.map(e=>{const t=Math.floor(n/e.seconds);return{key:["mcp","fetch-rl",c,String(e.seconds),String(t)],per:e.per,limit:r[e.limitOf],retryAfterSeconds:Math.max(1,(t+1)*e.seconds-n),ttlInSeconds:e.seconds}})}async function l(c,r){const i=await c.getMany(r.map(e=>e.key)),n=r.filter((e,t)=>(i[t]?.value?.count??0)>=e.limit);return n.length>0?n.reduce((e,t)=>e.retryAfterSeconds>=t.retryAfterSeconds?e:t):r.reduce((e,t)=>e.retryAfterSeconds<=t.retryAfterSeconds?e:t)}async function y(c,r,i,n){const e=r.subject??(r.ip&&`ip:${r.ip}`);if(!e)return;const t=a(e,i,n);try{if(await c.incrementBelowLimits(t))return;const{limit:o,per:s,retryAfterSeconds:f}=await l(c,t);return`Outbound fetch limit reached (${o} fetches per ${s}); retry in ${f}s`}catch(o){u.warn(`Fetch limit store failed; the fetch was allowed uncounted: ${String(o)}`);return}}export{y as applyFetchCount};

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/fetch-limiter/fetch-counter-repository.d.ts

@@ -0,0 +1,13 @@
+import type { KvKey } from '@redocly/config';
+import type { RepositoryInstanceOptions } from '../../../../../providers/database/types.js';
+import { KvRepository } from '../../../../../persistence/kv/repositories/kv-repository.js';
+export declare class FetchCounterRepository extends KvRepository {
+    static create(options: RepositoryInstanceOptions): Promise<FetchCounterRepository>;
+    /** Adds one to every slot in one statement unless a slot is at its limit; tells whether it did. */
+    incrementBelowLimits(slots: readonly {
+        key: KvKey;
+        limit: number;
+        ttlInSeconds: number;
+    }[]): Promise<boolean>;
+}
+//# sourceMappingURL=fetch-counter-repository.d.ts.map