@sdods/mcp 0.3.1 → 0.5.1

package/dist/browser/types.d.ts

@@ -0,0 +1,61 @@
+import type { BrowserName } from '@sdods/contracts';
+/**
+ * The seam a different browser backend would plug into.
+ *
+ * There is one implementation today (`playwright-driver.ts`, wrapping the Playwright MCP server
+ * bundled with the pinned Playwright). It exists as an interface because the obvious alternative —
+ * browser-use — is a Python project whose npm namesake is an unrelated single-maintainer package,
+ * so adopting it is a dependency decision this repo has not made. When it is made, it is a new
+ * file here rather than an edit to 42 tool definitions.
+ */
+export interface BrowserDriver {
+    /** Tool names the backend actually offers, for the drift check. */
+    listTools(): Promise<string[]>;
+    call(tool: string, args: Record<string, unknown>): Promise<DriverResult>;
+    close(): Promise<void>;
+    /** What the backend reported about itself, for diagnostics. */
+    info(): {
+        server: string;
+        version: string;
+    };
+}
+export interface DriverResult {
+    text: string;
+    images: Array<{
+        data: string;
+        mimeType: string;
+    }>;
+    isError: boolean;
+}
+/** What a caller may choose when opening a session; everything else comes from project config. */
+export interface BrowserSessionSpec {
+    sessionId: string;
+    project: string;
+    env?: string;
+    /** `@user:<role>` — reuses the storage state `sdods auth capture` wrote for that role. */
+    role?: string;
+    browser?: BrowserName;
+    headed?: boolean;
+    device?: string;
+    viewport?: {
+        width: number;
+        height: number;
+    };
+    caps?: Array<'vision' | 'pdf' | 'devtools'>;
+    /** `none` keeps large accessibility snapshots out of every response. */
+    snapshotMode?: 'full' | 'none';
+    images?: 'allow' | 'omit';
+}
+export interface SessionInfo {
+    sessionId: string;
+    project: string;
+    env?: string;
+    role?: string;
+    browser: BrowserName;
+    headed: boolean;
+    outputDir: string;
+    openedAt: string;
+    lastUsed: string;
+    server: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/browser/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/install/index.d.ts

@@ -13,6 +13,15 @@ export interface SnippetOptions {
     withPlaywright?: boolean;
 }
 export declare function serverEntry(o: SnippetOptions, client: McpClient): Record<string, unknown>;
+/**
+ * The raw upstream browser server.
+ *
+ * No longer registered by default: SDODS now wraps every one of its tools as `browser_*`, bound to
+ * a project and environment, with credential headers redacted and the two code-execution tools
+ * behind a scope and a switch. Registering the raw server alongside would leave an ungoverned path
+ * to the same browser, which is the thing the wrapper exists to close. Kept for
+ * `--with-playwright`, for anyone who wants upstream directly and accepts that.
+ */
 export declare function playwrightEntry(): Record<string, unknown>;
 /** `codex mcp add` / `claude mcp add` command lines for the same configuration. */
 export declare function cliCommands(o: SnippetOptions): {

package/dist/install/index.js

@@ -20,6 +20,15 @@ export function serverEntry(o, client) {
     }
     return { command: o.command ?? 'npx', args: stdioArgs(o) };
 }
+/**
+ * The raw upstream browser server.
+ *
+ * No longer registered by default: SDODS now wraps every one of its tools as `browser_*`, bound to
+ * a project and environment, with credential headers redacted and the two code-execution tools
+ * behind a scope and a switch. Registering the raw server alongside would leave an ungoverned path
+ * to the same browser, which is the thing the wrapper exists to close. Kept for
+ * `--with-playwright`, for anyone who wants upstream directly and accepts that.
+ */
 export function playwrightEntry() {
     return { command: 'npx', args: ['playwright', 'mcp', '--headless'] };
 }
@@ -42,7 +51,7 @@ export function codexTomlEntries(o) {
         ? { url: o.httpUrl, bearer_token_env_var: 'SDODS_TOKEN' }
         : { command: o.command ?? 'npx', args: stdioArgs(o) };
     const out = { sdods };
-    if (o.withPlaywright !== false)
+    if (o.withPlaywright === true)
         out.playwright = playwrightEntry();
     return out;
 }
@@ -50,7 +59,7 @@ export function codexConfigPath() {
     return join(process.env.CODEX_HOME ?? join(homedir(), '.codex'), 'config.toml');
 }
 export function snippets(o) {
-    const pw = o.withPlaywright === false ? {} : { playwright: playwrightEntry() };
+    const pw = o.withPlaywright === true ? { playwright: playwrightEntry() } : {};
     const cli = cliCommands(o);
     return {
         claude: {

package/dist/prompts/index.js

@@ -29,7 +29,7 @@ Goal: produce \`docs/test-plans/<name>.md\` for the requested feature area.
 
 Method:
 1. Read the project config (project_get_config) and existing features (feature_list) to avoid duplicates.
-2. Explore the application: if a browser MCP is available, navigate the relevant routes and take ARIA snapshots; otherwise read source roots and the OpenAPI spec (analyze_project, analyze_routes).
+2. Explore the application: open a session with browser_session_open, then navigate the relevant routes and take ARIA snapshots with browser_navigate and browser_snapshot; otherwise read source roots and the OpenAPI spec (analyze_project, analyze_routes).
 3. Write independent scenarios grouped by module. For each: title, preconditions, Gherkin steps (reuse step phrasing from step_list), the layer and suite tag, data needs (@data:/@user:), negative cases, and which existing steps already cover it.
 4. Include an "Out of scope / risks" section and an estimate of new steps needed.
 5. Save the plan through the proposal tools; do not modify features directly.`,

package/dist/registry/registry.d.ts

@@ -2,7 +2,7 @@ import { z, type ZodRawShape } from 'zod';
 import { type Scope } from '@sdods/contracts';
 export declare const DOCS_BASE_URL = "https://docs.sdods.com";
 export type ToolAccess = 'read' | 'run' | 'write';
-export type Capability = 'core' | 'analyze' | 'run' | 'data' | 'agents' | 'issues' | 'schedules';
+export type Capability = 'core' | 'analyze' | 'run' | 'data' | 'browser' | 'agents' | 'issues' | 'schedules';
 export declare const ALL_CAPABILITIES: Capability[];
 export declare const DEFAULT_CAPABILITIES: Capability[];
 export interface Principal {
@@ -31,6 +31,18 @@ export interface ToolContext {
     }) => void;
     signal?: AbortSignal;
     logger: ToolLogger;
+    /**
+     * Live browser sessions for this connection. Present only when the `browser` capability is on.
+     *
+     * It hangs off the context rather than living in a module map so that sessions belong to the
+     * principal that opened them: the HTTP transport builds one context per MCP session, so a
+     * second principal cannot name the first one's session id and drive their logged-in browser.
+     */
+    browser?: BrowserSessions;
+}
+/** The subset of the session manager the registry needs to know about, to avoid a cycle. */
+export interface BrowserSessions {
+    closeAll(): Promise<void>;
 }
 export interface ToolAnnotations {
     readOnlyHint?: boolean;
@@ -60,6 +72,11 @@ export interface SdodsTool<S extends ZodRawShape = ZodRawShape> {
     domain: string;
     capability: Capability;
     annotations?: ToolAnnotations;
+    /**
+     * Explicit scope, overriding the access/domain derivation. Lets one tool in a family sit behind
+     * a stricter scope than its siblings without inventing a capability for it.
+     */
+    scope?: Scope;
     docsPath?: string;
     handler: (args: z.infer<z.ZodObject<S>>, ctx: ToolContext) => Promise<ToolResult>;
 }

package/dist/registry/registry.js

@@ -6,15 +6,28 @@ export const ALL_CAPABILITIES = [
     'analyze',
     'run',
     'data',
+    'browser',
     'agents',
     'issues',
     'schedules',
 ];
-export const DEFAULT_CAPABILITIES = ['core', 'analyze', 'run', 'data', 'schedules'];
+// `browser` is on by default: the agents that need a browser used to get one from a separately
+// registered Playwright server, and that registration is being removed. Leaving it opt-in would
+// take the browser away from the planner, generator and healer rather than governing it.
+export const DEFAULT_CAPABILITIES = [
+    'core',
+    'analyze',
+    'run',
+    'data',
+    'browser',
+    'schedules',
+];
 export function defineTool(tool) {
     return tool;
 }
 export function requiredScope(tool) {
+    if (tool.scope)
+        return tool.scope;
     // agents has no read/write pair: run → agents:run, review/apply → agents:review
     if (tool.domain === 'agents')
         return tool.access === 'run' ? 'agents:run' : 'agents:review';

package/dist/server.d.ts

@@ -24,6 +24,8 @@ export declare function buildSdodsMcpServer(opts?: BuildServerOptions): {
     ctx: ToolContext;
     registry: ToolRegistry;
     toolCount: number;
+    /** Closes the server AND any browser it started. A leaked headless browser outlives the run. */
+    close: () => Promise<void>;
 };
 export declare function registerPrompts(server: McpServer, ctx: ToolContext): void;
 //# sourceMappingURL=server.d.ts.map

package/dist/server.js

@@ -1,5 +1,7 @@
 import { z } from 'zod';
 import { McpServer } from '@modelcontextprotocol/server';
+import { SCOPES } from '@sdods/contracts';
+import { BrowserSessionManager } from './browser/session.js';
 import { cliOrNote } from './cli.js';
 import { findRepoRoot } from './cli.js';
 import { toMcpServer } from './registry/adapters.js';
@@ -46,47 +48,29 @@ export const LOCAL_ADMIN = { name: 'local', scopes: ['*'], via: 'stdio' };
 export function buildToolContext(opts = {}) {
     const rootDir = opts.rootDir ?? findRepoRoot(opts.cwd ?? process.cwd());
     const principal = opts.principal ?? LOCAL_ADMIN;
+    const caps = parseCaps(opts.caps);
     return {
         rootDir,
         cwd: opts.cwd ?? rootDir,
         principal: principal.scopes.includes('*') ? { ...principal, scopes: allScopes() } : principal,
-        caps: parseCaps(opts.caps),
+        caps,
         project: opts.project,
         env: opts.env,
         onProgress: opts.onProgress,
         logger: opts.logger ?? stderrLogger(),
+        browser: caps.has('browser') ? new BrowserSessionManager({ rootDir }) : undefined,
     };
 }
+/**
+ * Every scope, for a principal that carries `*`.
+ *
+ * This used to be a hand-copied list with a comment about avoiding a static dependency on the
+ * scope shape — but the registry imports from @sdods/contracts two files away, so the copy bought
+ * nothing and could only drift. A scope missing here is not a visible bug: it silently withholds
+ * tools from an admin.
+ */
 function allScopes() {
-    // lazy import to avoid a static dependency on the scope list shape
-    return [
-        'orgs:read',
-        'orgs:admin',
-        'workspaces:read',
-        'workspaces:write',
-        'projects:read',
-        'projects:write',
-        'envs:read',
-        'envs:write',
-        'datasets:read',
-        'datasets:write',
-        'runs:read',
-        'runs:write',
-        'runs:ingest',
-        'artifacts:read',
-        'features:read',
-        'features:write',
-        'agents:run',
-        'agents:review',
-        'integrations:read',
-        'integrations:write',
-        'schedules:read',
-        'schedules:write',
-        'processes:read',
-        'processes:write',
-        'users:admin',
-        'audit:read',
-    ];
+    return [...SCOPES];
 }
 /** Build a fully wired MCP server (tools + resources + prompts) for a context. */
 export function buildSdodsMcpServer(opts = {}) {
@@ -99,7 +83,16 @@ export function buildSdodsMcpServer(opts = {}) {
     const toolCount = toMcpServer(registry, server, ctx);
     registerResources(server, ctx);
     registerPrompts(server, ctx);
-    return { server, ctx, registry, toolCount };
+    return {
+        server,
+        ctx,
+        registry,
+        toolCount,
+        close: async () => {
+            await ctx.browser?.closeAll();
+            await server.close();
+        },
+    };
 }
 export function registerPrompts(server, ctx) {
     for (const role of Object.keys(ROLE_PROMPTS)) {

package/dist/tools/browser.d.ts

@@ -0,0 +1,3 @@
+import { type SdodsTool } from '../registry/registry.js';
+export declare const browserTools: Array<SdodsTool<any>>;
+//# sourceMappingURL=browser.d.ts.map

package/dist/tools/browser.js

@@ -0,0 +1,191 @@
+import { z } from 'zod';
+import { BrowserSchema } from '@sdods/contracts';
+import { BROWSER_TOOLS } from '../browser/manifest.js';
+import { UNSAFE_DISABLED_HINT, unsafeToolsEnabled } from '../browser/policy.js';
+import { UPSTREAM_SHAPES } from '../browser/shapes.js';
+import { defineTool, summarize } from '../registry/registry.js';
+/**
+ * The governed browser surface.
+ *
+ * Every upstream Playwright MCP tool is wrapped rather than exposed directly, so that a browser an
+ * agent drives is bound to a project and environment, carries that project's test-id attribute and
+ * login state, writes its artifacts into the run directory, has its auth headers redacted on the
+ * way out, and can be refused by scope. The raw server offered all of that ungoverned, with
+ * `browser_run_code_unsafe` sitting in the same list as `browser_click`.
+ */
+const DEFAULT_SESSION = 'default';
+/** Output beyond this is clipped: `summarize()` bounds `data`, never `text`, and one snapshot of a
+ * large single-page app is tens of thousands of tokens. Every tool that can produce that much has
+ * a `filename` argument, which the clip message points at. */
+const MAX_TEXT = 20_000;
+const sessionArg = {
+    sessionId: z
+        .string()
+        .optional()
+        .describe(`Browser session (default: "${DEFAULT_SESSION}"). See browser_session_open.`),
+};
+function clip(text) {
+    if (text.length <= MAX_TEXT)
+        return text;
+    return `${text.slice(0, MAX_TEXT)}\n\n… truncated at ${MAX_TEXT} characters. Re-run with a \`filename\` argument to write the full output into the session directory.`;
+}
+function sessions(ctx) {
+    const mgr = ctx.browser;
+    if (!mgr)
+        throw Object.assign(new Error('The browser capability is disabled on this server.'), {
+            error: {
+                code: 'CAPABILITY_DISABLED',
+                hint: 'Start with --caps browser (it is on by default).',
+            },
+        });
+    return mgr;
+}
+/** One wrapper per upstream tool. */
+function wrap(name) {
+    const spec = BROWSER_TOOLS[name];
+    const upstreamShape = UPSTREAM_SHAPES[name];
+    return defineTool({
+        name,
+        title: name.replace(/^browser_/, '').replace(/_/g, ' '),
+        description: [
+            `Playwright MCP \`${name}\`, bound to an SDODS project and environment.`,
+            spec.note,
+            spec.pack === 'default' ? undefined : `Requires the \`${spec.pack}\` capability pack.`,
+        ]
+            .filter(Boolean)
+            .join(' '),
+        shape: { ...sessionArg, ...upstreamShape },
+        access: spec.access,
+        domain: 'browser',
+        capability: 'browser',
+        ...(spec.scope ? { scope: spec.scope } : {}),
+        annotations: {
+            readOnlyHint: spec.access === 'read',
+            destructiveHint: spec.access === 'write',
+            openWorldHint: true,
+        },
+        docsPath: '/docs/reference/mcp-tools',
+        handler: async (args, ctx) => {
+            if (spec.scope === 'browser:admin' && !unsafeToolsEnabled())
+                throw Object.assign(new Error(`${name} is disabled.`), {
+                    error: { code: 'BROWSER_UNSAFE_DISABLED', hint: UNSAFE_DISABLED_HINT },
+                });
+            const mgr = sessions(ctx);
+            const id = args.sessionId ?? DEFAULT_SESSION;
+            // Only a tool that acts may bring a browser up. `browser:read` is granted to every viewer by
+            // the READ_SCOPES filter, so letting an observe tool open a session would let a viewer start
+            // a browser without ever holding browser:write.
+            if (spec.access === 'read' && !mgr.has(id))
+                throw Object.assign(new Error(`No browser session "${id}".`), {
+                    error: {
+                        code: 'BROWSER_NO_SESSION',
+                        hint: 'Open one with browser_session_open, or call an action tool first.',
+                    },
+                });
+            if (!ctx.project && !mgr.has(id))
+                throw Object.assign(new Error('No project for an implicit browser session.'), {
+                    error: {
+                        code: 'BROWSER_NO_PROJECT',
+                        hint: 'Call browser_session_open with a project, or start the server with --project.',
+                    },
+                });
+            const entry = await mgr.ensure(id, { project: ctx.project, env: ctx.env });
+            const result = await entry.driver.call(name, args);
+            return {
+                text: clip(result.text) || `${name} ok`,
+                images: result.images,
+                isError: result.isError,
+            };
+        },
+    });
+}
+const sessionTools = [
+    defineTool({
+        name: 'browser_session_open',
+        title: 'Open a browser session',
+        description: 'Start a browser bound to a project and environment. Applies the project test-id attribute, the environment locale/timezone/headers, an optional role login state, and writes artifacts into the run directory. Calling an action tool without a session opens a default one, so this is for overrides.',
+        shape: {
+            sessionId: z.string().optional().describe(`default: "${DEFAULT_SESSION}"`),
+            project: z.string().optional().describe('project slug (default: the server’s --project)'),
+            env: z.string().optional(),
+            role: z
+                .string()
+                .optional()
+                .describe('reuse the login state captured for this @user:<role>; must already exist'),
+            browser: BrowserSchema.optional().describe('default: chromium'),
+            headed: z.boolean().optional().describe('default: false (headless)'),
+            device: z.string().optional().describe('Playwright device profile, e.g. "iPhone 15"'),
+            viewport: z.object({ width: z.number().int(), height: z.number().int() }).optional(),
+            caps: z
+                .array(z.enum(['vision', 'pdf', 'devtools']))
+                .optional()
+                .describe('extra Playwright capability packs to enable for this session'),
+            snapshotMode: z
+                .enum(['full', 'none'])
+                .optional()
+                .describe('"none" keeps accessibility snapshots out of every response'),
+            images: z.enum(['allow', 'omit']).optional(),
+        },
+        access: 'write',
+        domain: 'browser',
+        capability: 'browser',
+        annotations: { destructiveHint: true, openWorldHint: true },
+        docsPath: '/docs/reference/mcp-tools',
+        handler: async (args, ctx) => {
+            const project = args.project ?? ctx.project;
+            if (!project)
+                throw Object.assign(new Error('A project is required to open a browser session.'), {
+                    error: { code: 'BROWSER_NO_PROJECT', hint: 'Pass project, or start with --project.' },
+                });
+            const info = await sessions(ctx).open({
+                sessionId: args.sessionId ?? DEFAULT_SESSION,
+                project,
+                env: args.env ?? ctx.env,
+                role: args.role,
+                browser: args.browser,
+                headed: args.headed,
+                device: args.device,
+                viewport: args.viewport,
+                caps: args.caps,
+                snapshotMode: args.snapshotMode,
+                images: args.images,
+            });
+            return { text: summarize(`Browser session ${info.sessionId}`, info), data: info };
+        },
+    }),
+    defineTool({
+        name: 'browser_session_close',
+        title: 'Close a browser session',
+        description: 'End a session and stop its browser. Distinct from browser_close, which closes the page and leaves the session running. Artifacts stay on disk.',
+        shape: { sessionId: z.string().optional() },
+        access: 'write',
+        domain: 'browser',
+        capability: 'browser',
+        annotations: { destructiveHint: true },
+        docsPath: '/docs/reference/mcp-tools',
+        handler: async (args, ctx) => {
+            const id = args.sessionId ?? DEFAULT_SESSION;
+            const closed = await sessions(ctx).close(id);
+            return { text: closed ? `Closed browser session ${id}.` : `No browser session ${id}.` };
+        },
+    }),
+    defineTool({
+        name: 'browser_session_list',
+        title: 'List browser sessions',
+        description: 'Open browser sessions on this connection, with their project, env and artifacts.',
+        shape: {},
+        access: 'read',
+        domain: 'browser',
+        capability: 'browser',
+        docsPath: '/docs/reference/mcp-tools',
+        handler: async (_args, ctx) => {
+            const list = sessions(ctx).list();
+            return { text: summarize('Browser sessions', list), data: list };
+        },
+    }),
+];
+export const browserTools = [
+    ...sessionTools,
+    ...Object.keys(BROWSER_TOOLS).sort().map(wrap),
+];
+//# sourceMappingURL=browser.js.map

package/dist/tools/index.d.ts

@@ -1,5 +1,6 @@
 import { ToolRegistry, type SdodsTool } from '../registry/registry.js';
 import { analyzeTools } from './analyze.js';
+import { browserTools } from './browser.js';
 import { dataTools } from './data.js';
 import { featureTools } from './feature.js';
 import { issueTools, scheduleTools } from './issue-schedule.js';
@@ -8,5 +9,5 @@ import { proposalTools } from './proposal.js';
 import { runTools } from './run.js';
 export declare const ALL_TOOLS: Array<SdodsTool<any>>;
 export declare function createRegistry(extra?: Array<SdodsTool<any>>): ToolRegistry;
-export { analyzeTools, dataTools, featureTools, issueTools, projectTools, proposalTools, runTools, scheduleTools, };
+export { analyzeTools, browserTools, dataTools, featureTools, issueTools, projectTools, proposalTools, runTools, scheduleTools, };
 //# sourceMappingURL=index.d.ts.map

package/dist/tools/index.js

@@ -1,5 +1,6 @@
 import { ToolRegistry } from '../registry/registry.js';
 import { analyzeTools } from './analyze.js';
+import { browserTools } from './browser.js';
 import { dataTools } from './data.js';
 import { featureTools } from './feature.js';
 import { issueTools, scheduleTools } from './issue-schedule.js';
@@ -10,6 +11,7 @@ export const ALL_TOOLS = [
     ...projectTools,
     ...featureTools,
     ...runTools,
+    ...browserTools,
     ...dataTools,
     ...analyzeTools,
     ...issueTools,
@@ -19,5 +21,5 @@ export const ALL_TOOLS = [
 export function createRegistry(extra = []) {
     return new ToolRegistry().registerAll(ALL_TOOLS).registerAll(extra);
 }
-export { analyzeTools, dataTools, featureTools, issueTools, projectTools, proposalTools, runTools, scheduleTools, };
+export { analyzeTools, browserTools, dataTools, featureTools, issueTools, projectTools, proposalTools, runTools, scheduleTools, };
 //# sourceMappingURL=index.js.map

package/dist/tools/run.d.ts

@@ -11,6 +11,7 @@ export declare const runTools: (import("../registry/registry.js").SdodsTool<{
     }>>>;
     browsers: z.ZodOptional<z.ZodArray<z.ZodEnum<{
         chromium: "chromium";
+        edge: "edge";
         firefox: "firefox";
         webkit: "webkit";
         "mobile-chrome": "mobile-chrome";

package/dist/tools/run.js

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { z } from 'zod';
-import { runFiles } from '@sdods/contracts';
+import { BrowserSchema, runFiles } from '@sdods/contracts';
 import { SdodsCliError, sdodsCli } from '../cli.js';
 import { getRun, lastRun, listRuns, listScenarioDirs, readScenarioDir, screenshotUri, } from '../fs.js';
 import { defineTool, summarize } from '../registry/registry.js';
@@ -10,9 +10,7 @@ const runArgs = {
     env: z.string().optional(),
     tags: z.string().optional().describe('Cucumber tag expression, e.g. "@smoke and not @mock"'),
     layers: z.array(z.enum(['ui', 'api', 'hybrid', 'recorded'])).optional(),
-    browsers: z
-        .array(z.enum(['chromium', 'firefox', 'webkit', 'mobile-chrome', 'mobile-safari']))
-        .optional(),
+    browsers: z.array(BrowserSchema).optional(),
     process: z
         .string()
         .optional()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdods/mcp",
-  "version": "0.3.1",
+  "version": "0.5.1",
   "description": "SDODS MCP server: project analysis, runs, results and proposals as tools for AI clients.",
   "license": "Apache-2.0",
   "author": "SDODS <admin@sdods.com>",
@@ -13,6 +13,7 @@
     "./proposals": "./dist/proposals.js",
     "./prompts": "./dist/prompts/index.js",
     "./install": "./dist/install/index.js",
+    "./browser": "./dist/browser/index.js",
     "./transports/stdio": "./dist/transports/stdio.js",
     "./transports/http": "./dist/transports/http.js"
   },
@@ -26,9 +27,10 @@
     "node": ">=22"
   },
   "dependencies": {
-    "@sdods/contracts": "0.3.1",
+    "@sdods/contracts": "0.5.1",
     "@cucumber/gherkin": "^42.0.1",
     "@cucumber/messages": "^34.2.1",
+    "@modelcontextprotocol/client": "^2.0.0",
     "@modelcontextprotocol/node": "^2.0.0",
     "@modelcontextprotocol/server": "^2.0.0",
     "csv-parse": "^7.0.2",