@runpod/mcp-server 4.6.0 → 4.7.0

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # @runpod/mcp-server
 
+## 4.7.0
+
+### Minor Changes
+
+- 506e813: Resync the vendored v2 OpenAPI spec with production as of 2026-10-26 and add
+  `list-audit-logs` for reading the account audit trail with filters and pagination.
+  `list-pods` no longer returns live utilization or the direct SSH mapping; use
+  `get-pod` to read those fields for an individual Pod.
+
+  Update run: https://github.com/runpod/runpod-mcp/actions/runs/40308747009
+
+### Patch Changes
+
+- e669dca: Accept Cursor's OAuth callbacks on the hosted server (`cursor://anysphere.cursor-mcp/oauth/callback` and the `https://www.cursor.com/agents/...` and `/bot/...` web callbacks), so Cursor cloud agents and bot integrations can sign in with Runpod. `/register` now rejects a client up front (`invalid_redirect_uri`) when none of its callbacks can be used, and both errors explain how to connect with an API key instead. The install wizard and stdio `search-docs` now default to `https://mcp.runpod.io/` instead of the legacy `https://mcp.getrunpod.io/`.
+- d527e91: Trim the `/directory` server instructions to one sentence listing what the tools cover, without naming secrets, SSH keys or registry credentials. OpenAI's plugin scan held the longer version for review.
+- b7c0525: On `/directory`, stop showing credentials: schema examples that name or hold one (such as `{"JUPYTER_PASSWORD": "hunter2"}` on the `env` field) are dropped, and the secret and registry-credential tools (`list-secrets`, `get-secret`, `delete-secret`, `list-registries`, `get-registry`, `delete-registry`) are left out. OpenAI's plugin review rejected the submission for soliciting access credentials. The default surface is unchanged.
+- 08ddd89: Point both MCP initialize profiles at the Runpod REST API v2 (the OpenAPI spec at
+  https://api.runpod.io/v2/openapi.json and the reference at
+  https://docs.runpod.io/api-reference-v2/overview) for operations outside their tool
+  lists. The default profile permits read-only GET calls when `RUNPOD_API_KEY` is
+  already in the environment and the response cannot expose secret environment
+  values, without accessing client credential stores or making writes outside the
+  MCP tool approval flow. The directory profile names
+  no credentials and presents the reference as informational.
+- 4b8b68e: Address OpenAI plugin review findings. On `/directory`, `pod-action` is replaced by separate `start-pod`, `stop-pod` and `restart-pod` tools (terminate is `delete-pod`); the default surface keeps `pod-action`. `update-template` is now marked destructive, since it overwrites the image, env and registry and can make a template public.
+- 0f519bf: Drop the non-portable `pattern` (a `\p{Z}` Unicode property escape) from the `name` argument of `create-global-volume` and `update-global-volume`. OpenAI's plugin tool scan rejected the schema; the API still enforces the rule and the field description states it.
+- a274524: Generate the tools from the TypeScript SDK's patched copy of the v2 spec, now that the SDK lives in this repository. Argument examples use a placeholder AWS account ID and `changeme` instead of `hunter2` as the example Jupyter password, several argument descriptions drop internal or version-relative wording, and input schemas no longer carry the `x-enum-varnames` code-generation hint.
+
+  Resync the shared spec with production after rebasing, adding the audit logs operation to the SDK's generated types.
+
 ## 4.6.0
 
 ### Minor Changes

package/README.md

@@ -210,11 +210,13 @@ pnpm build
 
 Tools are generated from the vendored v2 OpenAPI spec rather than hand-written: see [specgen/DESIGN.md](specgen/DESIGN.md) for the walkthrough and [specgen/README.md](specgen/README.md) for the regeneration workflow and drift gates.
 
+The REST client the tools call, [`@runpod/typescript-api-sdk`](https://www.npmjs.com/package/@runpod/typescript-api-sdk), lives in [`packages/typescript-api-sdk/`](packages/typescript-api-sdk/) and is published to npm separately. The vendored spec is in that package; both the SDK types and the MCP tools generate from it.
+
 This project uses [changesets](https://github.com/changesets/changesets) for versioning and npm publishing; every PR with user-facing changes needs a changeset. See `CLAUDE.md` and `docs/context.md` for full contributor guidance, architecture, and the test suite.
 
 ## License
 
-Apache-2.0
+Apache-2.0. The SDK in `packages/typescript-api-sdk/` is MIT-licensed; see its `LICENSE`.
 
 ### JavaScript API migration
 

package/dist/{chunk-4GF3CMSH.mjs → chunk-5IFIMVI6.mjs}

@@ -17,7 +17,7 @@ function authedGraphqlBase(env) {
   return pick(env.RUNPOD_AUTHED_GRAPHQL_URL, "https://api.runpod.io/graphql");
 }
 function hostedMcpBase(env) {
-  return pick(env.RUNPOD_MCP_URL, "https://mcp.getrunpod.io");
+  return pick(env.RUNPOD_MCP_URL, "https://mcp.runpod.io");
 }
 
 export {
@@ -27,4 +27,4 @@ export {
   authedGraphqlBase,
   hostedMcpBase
 };
-//# sourceMappingURL=chunk-4GF3CMSH.mjs.map
+//# sourceMappingURL=chunk-5IFIMVI6.mjs.map

package/dist/{chunk-4GF3CMSH.mjs.map → chunk-5IFIMVI6.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/_shared/hosts.ts"],"sourcesContent":["// Env-resolved API base URLs, extracted from the retired dual-version backend\n// resolver (backend.ts) when the spec-generated surface became the only one.\n// The credential preflight compares only active SDK and runtime destinations.\n\nexport type Env = Record<string, string | undefined>;\n\n// '' reads as unset everywhere: the wrong-environment guard already strips\n// empty vars before comparing, and every consumer (the credential checker's\n// probe URL, the GraphQL/log clients) must resolve identically or the\n// guard's \"checker and guard cannot disagree\" invariant breaks.\nfunction pick(value: string | undefined, fallback: string): string {\n  return value?.trim().replace(/\\/+$/, '') || fallback;\n}\n\n// Generated paths include /v2, so the SDK base is the API origin.\nexport function sdkBase(env: Env): string {\n  return pick(env.RUNPOD_API_BASE_URL, 'https://api.runpod.io');\n}\nexport function serverlessBase(env: Env): string {\n  return pick(env.RUNPOD_SERVERLESS_API_URL, 'https://api.runpod.ai/v2');\n}\nexport function publicGraphqlBase(env: Env): string {\n  return pick(env.RUNPOD_PUBLIC_GRAPHQL_URL, 'https://api.runpod.io/graphql');\n}\n// A separate var from publicGraphqlBase despite the identical default:\n// RUNPOD_PUBLIC_GRAPHQL_URL is the documented credential-free discovery\n// override and gets pointed at stubs freely, so routing authed calls through it\n// would turn \"point this anywhere\" into \"send the caller's API key there\".\nexport function authedGraphqlBase(env: Env): string {\n  return pick(env.RUNPOD_AUTHED_GRAPHQL_URL, 'https://api.runpod.io/graphql');\n}\n/** The hosted MCP server: install target, and stdio's search-docs backend. */\nexport function hostedMcpBase(env: Env): string {\n  return pick(env.RUNPOD_MCP_URL, 'https://mcp.getrunpod.io');\n}\n/** The runpod-assistant Convex site serving /v1/search. No default: unset\n *  means search is not configured. */\nexport function knowledgeSearchBase(env: Env): string | undefined {\n  return pick(env.KNOWLEDGE_SEARCH_URL, '') || undefined;\n}\n"],"mappings":";;;AAUA,SAAS,KAAK,OAA2B,UAA0B;AACjE,SAAO,OAAO,KAAK,EAAE,QAAQ,QAAQ,EAAE,KAAK;AAC9C;AAGO,SAAS,QAAQ,KAAkB;AACxC,SAAO,KAAK,IAAI,qBAAqB,uBAAuB;AAC9D;AACO,SAAS,eAAe,KAAkB;AAC/C,SAAO,KAAK,IAAI,2BAA2B,0BAA0B;AACvE;AACO,SAAS,kBAAkB,KAAkB;AAClD,SAAO,KAAK,IAAI,2BAA2B,+BAA+B;AAC5E;AAKO,SAAS,kBAAkB,KAAkB;AAClD,SAAO,KAAK,IAAI,2BAA2B,+BAA+B;AAC5E;AAEO,SAAS,cAAc,KAAkB;AAC9C,SAAO,KAAK,IAAI,gBAAgB,0BAA0B;AAC5D;","names":[]}
+{"version":3,"sources":["../src/_shared/hosts.ts"],"sourcesContent":["// Env-resolved API base URLs, extracted from the retired dual-version backend\n// resolver (backend.ts) when the spec-generated surface became the only one.\n// The credential preflight compares only active SDK and runtime destinations.\n\nexport type Env = Record<string, string | undefined>;\n\n// '' reads as unset everywhere: the wrong-environment guard already strips\n// empty vars before comparing, and every consumer (the credential checker's\n// probe URL, the GraphQL/log clients) must resolve identically or the\n// guard's \"checker and guard cannot disagree\" invariant breaks.\nfunction pick(value: string | undefined, fallback: string): string {\n  return value?.trim().replace(/\\/+$/, '') || fallback;\n}\n\n// Generated paths include /v2, so the SDK base is the API origin.\nexport function sdkBase(env: Env): string {\n  return pick(env.RUNPOD_API_BASE_URL, 'https://api.runpod.io');\n}\nexport function serverlessBase(env: Env): string {\n  return pick(env.RUNPOD_SERVERLESS_API_URL, 'https://api.runpod.ai/v2');\n}\nexport function publicGraphqlBase(env: Env): string {\n  return pick(env.RUNPOD_PUBLIC_GRAPHQL_URL, 'https://api.runpod.io/graphql');\n}\n// A separate var from publicGraphqlBase despite the identical default:\n// RUNPOD_PUBLIC_GRAPHQL_URL is the documented credential-free discovery\n// override and gets pointed at stubs freely, so routing authed calls through it\n// would turn \"point this anywhere\" into \"send the caller's API key there\".\nexport function authedGraphqlBase(env: Env): string {\n  return pick(env.RUNPOD_AUTHED_GRAPHQL_URL, 'https://api.runpod.io/graphql');\n}\n/** The hosted MCP server: install target, and stdio's search-docs backend. */\nexport function hostedMcpBase(env: Env): string {\n  return pick(env.RUNPOD_MCP_URL, 'https://mcp.runpod.io');\n}\n/** The runpod-assistant Convex site serving /v1/search. No default: unset\n *  means search is not configured. */\nexport function knowledgeSearchBase(env: Env): string | undefined {\n  return pick(env.KNOWLEDGE_SEARCH_URL, '') || undefined;\n}\n"],"mappings":";;;AAUA,SAAS,KAAK,OAA2B,UAA0B;AACjE,SAAO,OAAO,KAAK,EAAE,QAAQ,QAAQ,EAAE,KAAK;AAC9C;AAGO,SAAS,QAAQ,KAAkB;AACxC,SAAO,KAAK,IAAI,qBAAqB,uBAAuB;AAC9D;AACO,SAAS,eAAe,KAAkB;AAC/C,SAAO,KAAK,IAAI,2BAA2B,0BAA0B;AACvE;AACO,SAAS,kBAAkB,KAAkB;AAClD,SAAO,KAAK,IAAI,2BAA2B,+BAA+B;AAC5E;AAKO,SAAS,kBAAkB,KAAkB;AAClD,SAAO,KAAK,IAAI,2BAA2B,+BAA+B;AAC5E;AAEO,SAAS,cAAc,KAAkB;AAC9C,SAAO,KAAK,IAAI,gBAAgB,uBAAuB;AACzD;","names":[]}