@secondlayer/mcp 11.0.0 → 11.1.0

package/README.md

@@ -9,6 +9,19 @@ status, archive verify/bootstrap, and hosted credits/quote. Everything else
 (single-record lookups, mempool, stacking, proofs, live Streams reads) is
 available over REST `/v1` + OpenAPI. There is no `consume` tool.
 
+## Hosted
+
+No install: the hosted API serves the read tools over Streamable HTTP, with a
+browser sign-in.
+
+```bash
+claude mcp add --transport http secondlayer https://api.secondlayer.tools/mcp
+```
+
+Clients without OAuth send `Authorization: Bearer <sk-sl_ key>`. Subgraph
+deploys, webhooks, archive, codegen and instance tools are local only. See
+[/docs/mcp](https://secondlayer.tools/docs/mcp#connect).
+
 ## Install
 
 ```bash

package/dist/bin-http.js

@@ -23,6 +23,63 @@ function isHostedArchiveUrl(url) {
   }
 }
 
+// src/lib/tool.ts
+var registeredToolNames = new Set;
+var serverToolNames = new WeakMap;
+var serverToolFilters = new WeakMap;
+function getRegisteredToolNames(server) {
+  return server ? [...serverToolNames.get(server) ?? []] : [...registeredToolNames];
+}
+function restrictTools(server, allow) {
+  serverToolFilters.set(server, allow);
+}
+function envelopeFields(err) {
+  if (!err || typeof err !== "object")
+    return {};
+  const e = err;
+  const body = e.body && typeof e.body === "object" ? e.body : {};
+  const code = typeof e.code === "string" ? e.code : typeof body.code === "string" ? body.code : undefined;
+  const request_id = typeof body.request_id === "string" ? body.request_id : undefined;
+  const fb = body.feedback;
+  const feedback = fb && typeof fb === "object" && typeof fb.url === "string" ? { url: fb.url } : undefined;
+  return {
+    ...code ? { code } : {},
+    ...request_id ? { request_id } : {},
+    ...feedback ? { feedback } : {}
+  };
+}
+function defineTool(server, name, description, schema, handler) {
+  const wrappedHandler = async (args) => {
+    try {
+      return await handler(args);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      const status = err instanceof Error && "status" in err ? err.status : 0;
+      const type = status === 401 ? "unauthorized" : status === 404 ? "not_found" : status === 429 ? "rate_limited" : status >= 500 ? "server_error" : "error";
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify({
+              error: { type, status, message, ...envelopeFields(err) }
+            })
+          }
+        ],
+        isError: true
+      };
+    }
+  };
+  const allow = serverToolFilters.get(server);
+  if (allow && !allow(name))
+    return;
+  if (!allow)
+    registeredToolNames.add(name);
+  const names = serverToolNames.get(server) ?? new Set;
+  names.add(name);
+  serverToolNames.set(server, names);
+  server.tool(name, description, schema, wrappedHandler);
+}
+
 // src/resources.ts
 import {
   ResourceTemplate
@@ -83,37 +140,40 @@ function getArchiveOpsClient() {
 function keyHint(baseUrl = resolveBaseUrl()) {
   return isHostedApiUrl(baseUrl) ? " — set SECONDLAYER_API_KEY (an sk-sl_ key from secondlayer.tools/account/keys)" : " — set INSTANCE_TOKEN from `sl init` for writes";
 }
-async function apiRequest(method, path, body) {
-  const baseUrl = resolveBaseUrl();
-  const apiKey = readApiKey();
-  const res = await fetch(`${baseUrl}${path}`, {
-    method,
-    headers: {
-      "Content-Type": "application/json",
-      ...apiKey ? { Authorization: `Bearer ${apiKey}` } : {}
-    },
-    body: body ? JSON.stringify(body) : undefined
-  });
-  if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    const needsKey = !apiKey && (res.status === 401 || res.status === 403);
-    let parsed;
-    try {
-      parsed = text ? JSON.parse(text) : undefined;
-    } catch {
-      parsed = undefined;
-    }
-    const code = parsed && typeof parsed === "object" && typeof parsed.code === "string" ? parsed.code : undefined;
-    throw Object.assign(new Error((text || `HTTP ${res.status}`) + (needsKey ? keyHint(baseUrl) : "")), {
-      status: res.status,
-      ...parsed !== undefined ? { body: parsed } : {},
-      ...code ? { code } : {}
+function createApiRequest(config) {
+  const doFetch = config.fetchImpl ?? ((...args) => fetch(...args));
+  return async (method, path, body) => {
+    const { baseUrl, apiKey } = config;
+    const res = await doFetch(`${baseUrl}${path}`, {
+      method,
+      headers: {
+        "Content-Type": "application/json",
+        ...apiKey ? { Authorization: `Bearer ${apiKey}` } : {}
+      },
+      body: body ? JSON.stringify(body) : undefined
     });
-  }
-  if (res.status === 204)
-    return;
-  return res.json();
+    if (!res.ok) {
+      const text = await res.text().catch(() => "");
+      const needsKey = !apiKey && (res.status === 401 || res.status === 403);
+      let parsed;
+      try {
+        parsed = text ? JSON.parse(text) : undefined;
+      } catch {
+        parsed = undefined;
+      }
+      const code = parsed && typeof parsed === "object" && typeof parsed.code === "string" ? parsed.code : undefined;
+      throw Object.assign(new Error((text || `HTTP ${res.status}`) + (needsKey ? keyHint(baseUrl) : "")), {
+        status: res.status,
+        ...parsed !== undefined ? { body: parsed } : {},
+        ...code ? { code } : {}
+      });
+    }
+    if (res.status === 204)
+      return;
+    return res.json();
+  };
 }
+var apiRequest = (method, path, body) => createApiRequest({ baseUrl: resolveBaseUrl(), apiKey: readApiKey() })(method, path, body);
 
 // src/lib/format.ts
 function formatSubgraphSummary(s) {
@@ -144,51 +204,6 @@ function textResponse(text, isError) {
   };
 }
 
-// src/lib/tool.ts
-var registeredToolNames = new Set;
-function getRegisteredToolNames() {
-  return [...registeredToolNames];
-}
-function envelopeFields(err) {
-  if (!err || typeof err !== "object")
-    return {};
-  const e = err;
-  const body = e.body && typeof e.body === "object" ? e.body : {};
-  const code = typeof e.code === "string" ? e.code : typeof body.code === "string" ? body.code : undefined;
-  const request_id = typeof body.request_id === "string" ? body.request_id : undefined;
-  const fb = body.feedback;
-  const feedback = fb && typeof fb === "object" && typeof fb.url === "string" ? { url: fb.url } : undefined;
-  return {
-    ...code ? { code } : {},
-    ...request_id ? { request_id } : {},
-    ...feedback ? { feedback } : {}
-  };
-}
-function defineTool(server, name, description, schema, handler) {
-  const wrappedHandler = async (args) => {
-    try {
-      return await handler(args);
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      const status = err instanceof Error && "status" in err ? err.status : 0;
-      const type = status === 401 ? "unauthorized" : status === 404 ? "not_found" : status === 429 ? "rate_limited" : status >= 500 ? "server_error" : "error";
-      return {
-        content: [
-          {
-            type: "text",
-            text: JSON.stringify({
-              error: { type, status, message, ...envelopeFields(err) }
-            })
-          }
-        ],
-        isError: true
-      };
-    }
-  };
-  registeredToolNames.add(name);
-  server.tool(name, description, schema, wrappedHandler);
-}
-
 // src/resources.ts
 var TRAIT_BLURBS = {
   "sip-009": "Non-fungible token (NFT) standard",
@@ -240,9 +255,9 @@ var PRODUCT_ORDER = [
   "archive",
   "credits"
 ];
-function buildCapabilities() {
+function buildCapabilities(server) {
   const byPrefix = new Map;
-  for (const name of getRegisteredToolNames()) {
+  for (const name of getRegisteredToolNames(server)) {
     const sep = name.indexOf("_");
     const prefix = sep === -1 ? name : name.slice(0, sep);
     const tools = byPrefix.get(prefix) ?? [];
@@ -263,7 +278,11 @@ function buildCapabilities() {
     discoverFirst: "Call index_discover / contracts_find to learn what exists (and which filters each surface accepts) before querying."
   };
 }
-function readAuthTiers(credential) {
+function readAuthTiers(credential, hosted) {
+  if (hosted) {
+    const reads = `keyed: every read uses ${credential} and is metered to the account's credits (the first 1M rows each month are free)`;
+    return { index: reads, streams: reads };
+  }
   const reads = `keyless while the API is only reachable on loopback; ${credential} is required once it is published past loopback`;
   return {
     index: reads,
@@ -274,8 +293,9 @@ function readAuthTiers(credential) {
 function credentialLabel() {
   return isHostedApiUrl2(resolveBaseUrl2()) ? "SECONDLAYER_API_KEY (an sk-sl_ account key)" : "INSTANCE_TOKEN";
 }
+var HOSTED_CREDENTIAL = "the caller's OAuth sign-in (or sk-sl_ account key)";
 async function buildContext(deps = { clientProvider: getClient }) {
-  const credential = credentialLabel();
+  const credential = deps.hosted ? HOSTED_CREDENTIAL : credentialLabel();
   const unavailable = `unavailable: set ${credential}`;
   const orNull = (field) => {
     if (!field)
@@ -288,7 +308,7 @@ async function buildContext(deps = { clientProvider: getClient }) {
   const instance = snap?.instance?.value ? snap.instance.value : orNull(snap?.instance);
   return {
     authState: {
-      apiKeySet: Boolean(readApiKey())
+      apiKeySet: deps.hosted ? true : Boolean(readApiKey())
     },
     whatExists: {
       account: orNull(snap?.account),
@@ -299,12 +319,13 @@ async function buildContext(deps = { clientProvider: getClient }) {
       activeOperations: orNull(snap?.activeOperations),
       instance
     },
-    whatYouCanDo: buildCapabilities(),
-    readAuthTiers: readAuthTiers(credential),
+    whatYouCanDo: buildCapabilities(deps.server),
+    readAuthTiers: readAuthTiers(credential, Boolean(deps.hosted)),
     ...snap?.instance?.value?.state === "empty-index" ? { nextStep: BOOTSTRAP_STEP } : {}
   };
 }
-function registerResources(server) {
+function registerResources(server, deps = { clientProvider: getClient }) {
+  const contextDeps = deps.hosted ? { ...deps, server } : deps;
   server.resource("context", "secondlayer://context", {
     description: "Live agent context — what exists (your subgraphs, webhooks, account), what you can do, and read-auth tiers. Read this first."
   }, async () => ({
@@ -312,7 +333,7 @@ function registerResources(server) {
       {
         uri: "secondlayer://context",
         mimeType: "application/json",
-        text: JSON.stringify(await buildContext(), null, 2)
+        text: JSON.stringify(await buildContext(contextDeps), null, 2)
       }
     ]
   }));
@@ -350,24 +371,26 @@ function registerResources(server) {
       }
     ]
   }));
-  server.resource("chain-triggers", "secondlayer://chain-triggers", {
-    description: "Chain-webhook trigger types and the filter fields each accepts (for webhooks_create triggers)."
-  }, async () => ({
-    contents: [
-      {
-        uri: "secondlayer://chain-triggers",
-        mimeType: "application/json",
-        text: JSON.stringify(CHAIN_TRIGGER_FIELDS, null, 2)
-      }
-    ]
-  }));
+  if (!deps.hosted) {
+    server.resource("chain-triggers", "secondlayer://chain-triggers", {
+      description: "Chain-webhook trigger types and the filter fields each accepts (for webhooks_create triggers)."
+    }, async () => ({
+      contents: [
+        {
+          uri: "secondlayer://chain-triggers",
+          mimeType: "application/json",
+          text: JSON.stringify(CHAIN_TRIGGER_FIELDS, null, 2)
+        }
+      ]
+    }));
+  }
   server.resource("samples", new ResourceTemplate("secondlayer://samples/{contractId}", {
     list: undefined
   }), {
     description: "Decoded camelCase print samples for a contract (schema + up to 5 events). Use before writing a print_event handler."
   }, async (uri, variables) => {
     const contractId = String(Array.isArray(variables.contractId) ? variables.contractId[0] : variables.contractId ?? "");
-    const body = await buildSamplesResource(contractId);
+    const body = await buildSamplesResource(contractId, deps.clientProvider);
     return {
       contents: [
         {
@@ -432,14 +455,14 @@ async function buildSamplesResource(contractId, clientProvider = getClient) {
 
 // src/tools/account.ts
 import { z } from "zod";
-function registerAccountTools(server) {
+function registerAccountTools(server, request = apiRequest) {
   defineTool(server, "account_whoami", "Show the archive account email at api.secondlayer.tools, not the self-host instance.", {}, async () => {
-    const result = await apiRequest("GET", "/api/accounts/me");
+    const result = await request("GET", "/api/accounts/me");
     return jsonResponse(result);
   });
   defineTool(server, "account_create_key", "Mint an account key (sk-sl_*) for archive credits, quote, and fetch at api.secondlayer.tools. The returned `key` is shown ONCE.", {
     name: z.string().optional().describe("Optional label for the key")
-  }, async ({ name }) => jsonResponse(await apiRequest("POST", "/api/keys", { name })));
+  }, async ({ name }) => jsonResponse(await request("POST", "/api/keys", { name })));
 }
 
 // src/tools/archive-cli.ts
@@ -1144,35 +1167,103 @@ function registerWebhookTools(server, clientProvider = getClient) {
 }
 
 // src/tool-groups.ts
+var ENV_TOOL_DEPS = {
+  clientProvider: getClient,
+  archiveOpsClientProvider: getArchiveOpsClient,
+  apiRequest
+};
 var TOOL_GROUPS = [
-  { group: "scaffold", register: registerScaffoldTools },
-  { group: "subgraphs", register: registerSubgraphTools },
-  { group: "webhooks", register: registerWebhookTools },
-  { group: "index", register: registerIndexTools },
-  { group: "streams", register: registerStreamsTools },
-  { group: "contracts", register: registerContractTools },
-  { group: "codegen", register: registerCodegenTools },
-  { group: "instance", register: registerInstanceTools },
-  { group: "archive", register: registerArchiveTools },
-  { group: "archive", register: registerArchiveCliTools },
-  { group: "account", register: registerAccountTools, hostedOnly: true }
+  {
+    group: "scaffold",
+    register: (s, d = ENV_TOOL_DEPS) => registerScaffoldTools(s, d.clientProvider),
+    hosted: true
+  },
+  {
+    group: "subgraphs",
+    register: (s, d = ENV_TOOL_DEPS) => registerSubgraphTools(s, d.clientProvider),
+    hosted: false
+  },
+  {
+    group: "webhooks",
+    register: (s, d = ENV_TOOL_DEPS) => registerWebhookTools(s, d.clientProvider),
+    hosted: false
+  },
+  {
+    group: "index",
+    register: (s, d = ENV_TOOL_DEPS) => registerIndexTools(s, d.clientProvider),
+    hosted: true
+  },
+  {
+    group: "streams",
+    register: (s, d = ENV_TOOL_DEPS) => registerStreamsTools(s, d.clientProvider),
+    hosted: true
+  },
+  {
+    group: "contracts",
+    register: (s, d = ENV_TOOL_DEPS) => registerContractTools(s, d.clientProvider),
+    hosted: true
+  },
+  { group: "codegen", register: (s) => registerCodegenTools(s), hosted: false },
+  {
+    group: "instance",
+    register: (s, d = ENV_TOOL_DEPS) => registerInstanceTools(s, d.clientProvider),
+    hosted: false
+  },
+  {
+    group: "archive",
+    register: (s, d = ENV_TOOL_DEPS) => registerArchiveTools(s, d.clientProvider, d.archiveOpsClientProvider),
+    hosted: false
+  },
+  {
+    group: "archive",
+    register: (s) => registerArchiveCliTools(s),
+    hosted: false
+  },
+  {
+    group: "account",
+    register: (s, d = ENV_TOOL_DEPS) => registerAccountTools(s, d.apiRequest),
+    hostedOnly: true,
+    hosted: ["account_whoami"]
+  }
 ];
+function isHostedTool(group, tool) {
+  return group.hosted === true || Array.isArray(group.hosted) && group.hosted.includes(tool);
+}
 
 // src/server.ts
 var __dirname2 = dirname(fileURLToPath(import.meta.url));
 var pkg = JSON.parse(readFileSync(join2(__dirname2, "../package.json"), "utf-8"));
-function createServer() {
+function createServer(options = {}) {
   const server = new McpServer({
     name: "secondlayer",
     version: pkg.version
   });
-  const hosted = isHostedArchiveUrl(resolveBaseUrl3());
+  const deps = {
+    clientProvider: options.clientProvider ?? ENV_TOOL_DEPS.clientProvider,
+    archiveOpsClientProvider: options.archiveOpsClientProvider ?? ENV_TOOL_DEPS.archiveOpsClientProvider,
+    apiRequest: options.apiRequest ?? ENV_TOOL_DEPS.apiRequest
+  };
+  if (options.hosted) {
+    for (const group of TOOL_GROUPS) {
+      if (group.hosted === false)
+        continue;
+      restrictTools(server, (name) => isHostedTool(group, name));
+      group.register(server, deps);
+    }
+    restrictTools(server, () => false);
+    registerResources(server, {
+      clientProvider: deps.clientProvider,
+      hosted: true
+    });
+    return server;
+  }
+  const hostedApi = isHostedArchiveUrl(resolveBaseUrl3());
   for (const { register, hostedOnly } of TOOL_GROUPS) {
-    if (hostedOnly && !hosted)
+    if (hostedOnly && !hostedApi)
       continue;
-    register(server);
+    register(server, deps);
   }
-  registerResources(server);
+  registerResources(server, { clientProvider: deps.clientProvider });
   return server;
 }
 
@@ -1262,5 +1353,5 @@ httpServer.listen(port, () => {
     console.error("Warning: SECONDLAYER_MCP_SECRET not set, authentication disabled");
 });
 
-//# debugId=52D7E49B3C2D102864756E2164756E21
+//# debugId=64D4C1ABC06CBDC864756E2164756E21
 //# sourceMappingURL=bin-http.js.map