@robosystems/core 0.8.3 → 0.8.4

package/components/console/ConsoleContent.js

@@ -90,7 +90,8 @@ export function ConsoleContent({ config }) {
             (config.enableRecall
                 ? `  /recall     - Recall semantic memories\n`
                 : '') +
-            `  /mcp        - Show MCP connection setup\n` +
+            `  /mcp        - Connect an MCP client (sign in — no key)\n` +
+            `  /mcp key    - Mint a graph-scoped API key for header-only clients\n` +
             `  /help       - Show this help message\n` +
             `  /clear      - Clear console history\n` +
             `  /examples   - Show example queries`;
@@ -405,32 +406,54 @@ export function ConsoleContent({ config }) {
             }
         }
     };
-    const showMcpSetup = async () => {
-        addSystemMessage('Creating graph-scoped connector key...', true);
+    const showMcpSetup = async (mode) => {
         const apiUrl = process.env.NEXT_PUBLIC_ROBOSYSTEMS_API_URL ||
             'https://api.robosystems.ai';
         const { mcp } = config;
         const contextId = graphId || mcp.contextIdFallback;
+        const endpoint = `${apiUrl}/v1/graphs/${contextId}/mcp`;
+        const connectorName = `${mcp.serverName}-${contextId}`;
+        const exampleLines = mcp.exampleQuestions
+            .map((q) => `  • "${q}"`)
+            .join('\n');
+        // The graph id lives in the URL path and never becomes a tool argument,
+        // so one connection is anchored to exactly one graph. OAuth on the
+        // per-graph URL shows this graph preselected on the consent screen; no
+        // key is minted unless asked for, so a sign-in user never leaves an
+        // unused credential behind in Settings → API Keys.
+        if (mode !== 'key') {
+            addSystemMessage(`MCP — connect ${contextId}\n` +
+                `═══════════════════════════════════════════════════════════════\n\n` +
+                `Sign in to connect (recommended). Paste the URL; the client sends\n` +
+                `you to sign in, and this graph is already selected on the consent\n` +
+                `screen. Nothing to copy, store, or rotate.\n\n` +
+                `Claude (claude.ai / Desktop)\n` +
+                `  Settings → Connectors → Add custom connector\n` +
+                `  ${endpoint}\n\n` +
+                `Claude Code (then /mcp to sign in)\n` +
+                `  claude mcp add --transport http ${connectorName} ${endpoint}\n\n` +
+                `Cursor / VS Code (mcp.json)\n` +
+                `  "${connectorName}": { "url": "${endpoint}" }\n\n` +
+                `Any graph from one address: ${apiUrl}/v1/mcp — pick the graph at\n` +
+                `sign-in.\n\n` +
+                `Scripts, CI, or a client that can't sign in? Type /mcp key to mint\n` +
+                `an API key scoped to this graph, with the header snippets filled in.\n\n` +
+                `Once connected, ask questions like:\n` +
+                `${exampleLines}\n\n` +
+                `Clients without HTTP transport support can use the stdio bridge\n` +
+                `in proxy mode: https://github.com/RoboFinSystems/robosystems-mcp-client`, true);
+            return;
+        }
+        addSystemMessage('Creating graph-scoped API key...', true);
         try {
             const { createMcpConnectorUrl } = await import('../../lib/mcp-connector');
-            // The graph id lives in the URL path and never becomes a tool argument,
-            // so one connector is anchored to exactly one graph. Multi-graph users
-            // add one connector per graph, which is why the name carries the id.
-            // The key is graph-scoped: valid only for this graph, revocable in
-            // Settings → API Keys, and rejected on every account-level surface.
+            // Graph-scoped: valid only for this graph and its subgraphs, rejected on
+            // every account-level surface, revocable in Settings → API Keys.
             const connector = await createMcpConnectorUrl(contextId, { apiUrl });
-            const connectorName = `${mcp.serverName}-${contextId}`;
-            const exampleLines = mcp.exampleQuestions
-                .map((q) => `  • "${q}"`)
-                .join('\n');
-            addSystemMessage(`MCP Setup Instructions:\n` +
+            addSystemMessage(`API key for ${contextId}\n` +
                 `═══════════════════════════════════════════════════════════════\n\n` +
-                `Graph-scoped API key created — it works only for ${contextId}\n` +
-                `and can be revoked anytime in Settings → API Keys.\n\n` +
-                `Claude (claude.ai / Desktop)\n` +
-                `  Settings → Connectors → Add custom connector, then paste this\n` +
-                `  URL (the key rides inside it — no header field needed):\n` +
-                `  ${connector.url}\n\n` +
+                `Scoped to this graph only; revoke it anytime in Settings → API Keys.\n` +
+                `It goes in the X-API-Key header — never in the URL.\n\n` +
                 `Claude Code\n` +
                 `  claude mcp add --transport http ${connectorName} \\\n` +
                 `    ${connector.endpoint} \\\n` +
@@ -440,16 +463,12 @@ export function ConsoleContent({ config }) {
                 `    "url": "${connector.endpoint}",\n` +
                 `    "headers": { "X-API-Key": "${connector.apiKey}" }\n` +
                 `  }\n\n` +
-                `Once connected, ask Claude questions like:\n` +
-                `${exampleLines}\n\n` +
-                `Clients without HTTP transport support can use the stdio bridge\n` +
-                `in proxy mode: https://github.com/RoboFinSystems/robosystems-mcp-client\n\n` +
-                `The connector URL contains the key — treat it like a password.`, true);
+                `Treat the key like a password. Shown once.`, true);
         }
         catch (error) {
-            addErrorMessage(`Failed to create connector key: ${error.message || 'Unknown error'}\n\n` +
-                `You can create an API key in Settings and connect with:\n` +
-                `  URL:    ${apiUrl}/v1/graphs/${contextId}/mcp\n` +
+            addErrorMessage(`Failed to create API key: ${error.message || 'Unknown error'}\n\n` +
+                `You can create a key in Settings and connect with:\n` +
+                `  URL:    ${endpoint}\n` +
                 `  Header: X-API-Key: <your key>`);
         }
     };
@@ -602,7 +621,7 @@ export function ConsoleContent({ config }) {
                     return;
                 }
                 case '/mcp':
-                    await showMcpSetup();
+                    await showMcpSetup(command.slice(cmd.length).trim().toLowerCase());
                     return;
                 default:
                     addErrorMessage(`Unknown command: ${cmd}\n\nType /help for available commands.`);

package/lib/mcp-connector.d.ts

@@ -1,7 +1,5 @@
 export interface McpConnectorUrl {
-    /** Pasteable connector URL with the graph-scoped key embedded as `?token=` */
-    url: string;
-    /** Bare MCP endpoint URL (no credential) — for header-capable clients */
+    /** Bare per-graph MCP endpoint URL (no credential) */
     endpoint: string;
     /** The plaintext graph-scoped API key (returned once at mint) */
     apiKey: string;
@@ -10,18 +8,16 @@ export interface McpConnectorUrl {
     graphId: string;
 }
 /**
- * Mint a graph-scoped API key and assemble the MCP connector URL for it.
+ * Mint a graph-scoped API key for the per-graph MCP endpoint.
  *
- * The URL is for clients that cannot send custom headers (claude.ai /
- * Claude Desktop custom connectors): the scoped key travels as a `token`
- * query parameter, which the server honors only on the MCP endpoint and
- * only for keys scoped to that URL's graph — account-wide keys are
- * rejected there. The key works for exactly this graph (and its
- * subgraphs), is rejected on every account-level surface, and can be
- * revoked from Settings → API Keys like any other key.
- *
- * Header-capable clients (Claude Code, Cursor, VS Code) should use the
- * bare `endpoint` with the key in an `X-API-Key` header instead.
+ * For clients that cannot sign in (scripts, CI, editors without OAuth):
+ * the key goes in an `X-API-Key` header on `endpoint`. It works for
+ * exactly this graph (and its subgraphs), is rejected on every
+ * account-level surface, and can be revoked from Settings → API Keys like
+ * any other key. Credentials never travel in the URL — the `?token=`
+ * connector URL was the bridge to OAuth and the server no longer honors
+ * it. OAuth-capable clients need no key at all: they add `endpoint` (or
+ * the graph-agnostic `/v1/mcp`) and sign in.
  */
 export declare function createMcpConnectorUrl(graphId: string, options?: {
     apiUrl?: string;

package/lib/mcp-connector.js

@@ -1,17 +1,15 @@
 const DEFAULT_API_URL = 'https://api.robosystems.ai';
 /**
- * Mint a graph-scoped API key and assemble the MCP connector URL for it.
+ * Mint a graph-scoped API key for the per-graph MCP endpoint.
  *
- * The URL is for clients that cannot send custom headers (claude.ai /
- * Claude Desktop custom connectors): the scoped key travels as a `token`
- * query parameter, which the server honors only on the MCP endpoint and
- * only for keys scoped to that URL's graph — account-wide keys are
- * rejected there. The key works for exactly this graph (and its
- * subgraphs), is rejected on every account-level surface, and can be
- * revoked from Settings → API Keys like any other key.
- *
- * Header-capable clients (Claude Code, Cursor, VS Code) should use the
- * bare `endpoint` with the key in an `X-API-Key` header instead.
+ * For clients that cannot sign in (scripts, CI, editors without OAuth):
+ * the key goes in an `X-API-Key` header on `endpoint`. It works for
+ * exactly this graph (and its subgraphs), is rejected on every
+ * account-level surface, and can be revoked from Settings → API Keys like
+ * any other key. Credentials never travel in the URL — the `?token=`
+ * connector URL was the bridge to OAuth and the server no longer honors
+ * it. OAuth-capable clients need no key at all: they add `endpoint` (or
+ * the graph-agnostic `/v1/mcp`) and sign in.
  */
 export async function createMcpConnectorUrl(graphId, options = {}) {
     var _a, _b;
@@ -26,7 +24,6 @@ export async function createMcpConnectorUrl(graphId, options = {}) {
     }
     const endpoint = `${apiUrl}/v1/graphs/${graphId}/mcp`;
     return {
-        url: `${endpoint}?token=${response.data.key}`,
         endpoint,
         apiKey: response.data.key,
         keyName,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@robosystems/core",
-  "version": "0.8.3",
+  "version": "0.8.4",
   "description": "Shared RoboSystems frontend core library (auth, contexts, task monitoring, UI components) for the RoboSystems Next.js apps",
   "license": "MIT",
   "private": false,