@secondlayer/mcp 3.8.0 → 3.9.0

package/README.md

@@ -10,7 +10,7 @@ bun add @secondlayer/mcp
 
 ## Auth
 
-Most reads are public — subgraph reads, `datasets_*`, `index_*`, and `contracts_find` work with no key. **`streams_*` requires an `SL_API_KEY`** (and the Index tools reject free-tier keys — Build+ for keyed access). Writes (deploy, reindex, delete, subscriptions) and account tools need a key: create one (prefixed `sk-sl_`) in the platform console at https://secondlayer.tools/platform/api-keys and set it as `SL_API_KEY`. Read `secondlayer://context` first — it reports auth state and read-auth tiers.
+Most reads are public — `datasets_*`, `index_*`, and `contracts_find` work with no key. Subgraph tools need an `SL_API_KEY`; separately, **public** subgraphs are anon-readable over HTTP at `GET /v1/subgraphs/<name>/<table>` (`{ rows, next_cursor, tip }` cursor envelope), while private ones need the owning account's key (anon → 404). **`streams_*` requires an `SL_API_KEY`** (and the Index tools reject free-tier keys — Build+ for keyed access). Writes (deploy, publish/unpublish, reindex, delete, subscriptions) and account tools need a key: create one (prefixed `sk-sl_`) in the platform console at https://secondlayer.tools/platform/api-keys and set it as `SL_API_KEY`. Read `secondlayer://context` first — it reports auth state and read-auth tiers.
 
 ## Quick Start — Stdio (IDE)
 
@@ -52,7 +52,7 @@ bunx -p @secondlayer/mcp secondlayer-mcp-http
 
 | Domain | Tools |
 | --- | --- |
-| **Subgraphs** (11) | `subgraphs_list`, `subgraphs_get`, `subgraphs_spec`, `subgraphs_query`, `subgraphs_aggregate`, `subgraphs_reindex`, `subgraphs_operation`, `subgraphs_delete`, `subgraphs_deploy`, `subgraphs_read_source`, `subgraphs_codegen` |
+| **Subgraphs** (16) | `subgraphs_list`, `subgraphs_get`, `subgraphs_spec`, `subgraphs_query`, `subgraphs_aggregate`, `subgraphs_reindex`, `subgraphs_operation`, `subgraphs_backfill`, `subgraphs_stop`, `subgraphs_gaps`, `subgraphs_delete`, `subgraphs_deploy`, `subgraphs_publish`, `subgraphs_unpublish`, `subgraphs_read_source`, `subgraphs_codegen` |
 | **Subscriptions** (12) | `subscriptions_list`, `subscriptions_get`, `subscriptions_create`, `subscriptions_update`, `subscriptions_pause`, `subscriptions_resume`, `subscriptions_delete`, `subscriptions_rotate_secret`, `subscriptions_replay`, `subscriptions_recent_deliveries`, `subscriptions_dead`, `subscriptions_requeue_dead` |
 | **Datasets** (2) | `datasets_list`, `datasets_query` |
 | **Index** (4) | `index_ft_transfers`, `index_nft_transfers`, `index_events`, `index_contract_calls` |
@@ -75,6 +75,10 @@ a webhook on raw chain events (contract / event / function / trait) with no
 subgraph (e.g. `[{ "type": "contract_call", "contractId": "SP....amm",
 "functionName": "swap-*" }]`).
 
+### Subgraph visibility
+
+`subgraphs_deploy` takes a `visibility` param (`public` | `private`; defaults: managed → public, BYO `databaseUrl` → private). Flip later with `subgraphs_publish` / `subgraphs_unpublish` — publishing claims the name in the single global public namespace (409 `PUBLIC_NAME_TAKEN` if claimed). Public subgraphs are anon-readable at `GET /v1/subgraphs/<name>/<table>`.
+
 ### `subgraphs_query` enhancements
 
 - `fields` — comma-separated column projection (e.g. `"sender,amount_x"`)

package/dist/bin-http.js

@@ -61,11 +61,14 @@ async function apiRequest(method, path, body) {
 
 // src/lib/format.ts
 function formatSubgraphSummary(s) {
+  const apiUrl = process.env.SECONDLAYER_API_URL || "https://api.secondlayer.tools";
   return {
     name: s.name,
     status: s.status,
     tables: Array.isArray(s.tables) ? s.tables : Object.keys(s.tables),
-    lastProcessedBlock: s.lastProcessedBlock
+    lastProcessedBlock: s.lastProcessedBlock,
+    ...s.visibility ? { visibility: s.visibility } : {},
+    ...s.visibility === "public" ? { publicUrl: `${apiUrl}/v1/subgraphs/${s.name}` } : {}
   };
 }
 function withCap(items, cap) {
@@ -217,7 +220,7 @@ var READ_AUTH_TIERS = {
   datasets: "open — no API key required",
   index: "anonymous reads allowed; free-tier API keys are rejected (Build+ required)",
   streams: "API key required (SL_API_KEY) — keyless calls return 401",
-  subgraphs: "reads public during open beta; writes require an API key"
+  subgraphs: "public subgraphs anon-readable at /v1/subgraphs/<name>/<table> ({ rows, next_cursor, tip } cursor envelope); private subgraphs need the owning account's API key (anon → 404); writes require an API key"
 };
 async function buildContext(deps = { clientProvider: getClient }) {
   const unavailable = "unavailable: set SL_API_KEY";
@@ -727,7 +730,7 @@ import {
 } from "@secondlayer/subgraphs";
 import { z as z8 } from "zod/v4";
 function registerSubgraphTools(server, clientProvider = getClient) {
-  defineTool(server, "subgraphs_list", "List all deployed subgraphs. Returns summary fields only.", {}, async () => {
+  defineTool(server, "subgraphs_list", "List all deployed subgraphs. Returns summary fields only, including visibility — public subgraphs are anon-readable at /v1/subgraphs/<name>.", {}, async () => {
     const { data } = await clientProvider().subgraphs.list();
     return {
       content: [
@@ -760,7 +763,7 @@ function registerSubgraphTools(server, clientProvider = getClient) {
       ]
     };
   });
-  defineTool(server, "subgraphs_query", 'Query rows from a subgraph table (max 200 rows). Filters support operators: "amount.gte": "1000", "sender.neq": "SP...", "name.like": "%token%". Available operators: eq, neq, gt, gte, lt, lte, like. To TAIL new rows (no streaming over MCP): sort=_id, order=desc for the latest, then poll forward with the filter {"_id.gt": "<last _id seen>"}, order=asc. Fetch one row by id with {"_id": "<id>"}.', {
+  defineTool(server, "subgraphs_query", 'Query rows from a subgraph table (max 200 rows). Filters support operators: "amount.gte": "1000", "sender.neq": "SP...", "name.like": "%token%". Available operators: eq, neq, gt, gte, lt, lte, like. To TAIL new rows (no streaming over MCP): sort=_id, order=desc for the latest, then poll forward with the filter {"_id.gt": "<last _id seen>"}, order=asc. Fetch one row by id with {"_id": "<id>"}. Public subgraphs are also keyless over HTTP at GET /v1/subgraphs/<name>/<table> — { rows, next_cursor, tip } envelope, resume with ?cursor=<next_cursor> + _order=asc|desc (no _offset/_sort on /v1); hand that URL to third parties.', {
     name: z8.string().describe("Subgraph name"),
     table: z8.string().describe("Table name"),
     filters: z8.record(z8.string(), z8.string()).optional().describe('Column filters — plain values or with operators (e.g. {"amount.gte": "1000", "sender": "SP..."})'),
@@ -876,12 +879,13 @@ function registerSubgraphTools(server, clientProvider = getClient) {
     const result = await clientProvider().subgraphs.delete(name);
     return { content: [{ type: "text", text: result.message }] };
   });
-  defineTool(server, "subgraphs_deploy", "Deploy a subgraph from TypeScript code. Pass the full defineSubgraph() source — it will be bundled, validated, and deployed. Optional startBlock overrides the source definition for this deploy. Set dryRun to validate and preview the schema/DDL without writing anything. Set databaseUrl to deploy to your own Postgres (BYO data plane) — the server verifies the connection first; with dryRun it returns the DDL + grant script. A breaking BYO schema change is refused and returns a migration plan (drop + rebuild DDL) instead of deploying. Call `subgraphs_reindex` separately if you need a forced reindex.", {
+  defineTool(server, "subgraphs_deploy", "Deploy a subgraph from TypeScript code. Pass the full defineSubgraph() source — it will be bundled, validated, and deployed. Optional startBlock overrides the source definition for this deploy. Set dryRun to validate and preview the schema/DDL without writing anything. Set databaseUrl to deploy to your own Postgres (BYO data plane) — the server verifies the connection first; with dryRun it returns the DDL + grant script. A breaking BYO schema change is refused and returns a migration plan (drop + rebuild DDL) instead of deploying. Visibility defaults: managed deploys are public (anon-readable at /v1/subgraphs/<name>, name claimed in the global public namespace), BYO deploys are private. Call `subgraphs_reindex` separately if you need a forced reindex.", {
     code: z8.string().describe("TypeScript source code containing a defineSubgraph() call"),
     startBlock: z8.number().int().nonnegative().optional().describe("Override the definition startBlock for this deploy"),
     databaseUrl: z8.string().optional().describe("BYO data plane: Postgres connection string to host the subgraph's schema and rows in your own database"),
-    dryRun: z8.boolean().optional().describe("Validate and preview the deploy (schema/DDL, BYO connection) without writing changes")
-  }, async ({ code, startBlock, databaseUrl, dryRun }) => {
+    dryRun: z8.boolean().optional().describe("Validate and preview the deploy (schema/DDL, BYO connection) without writing changes"),
+    visibility: z8.enum(["public", "private"]).optional().describe("Read visibility: public = anon /v1 reads + global name claim; private = owning account's key only. Defaults: managed → public, BYO → private.")
+  }, async ({ code, startBlock, databaseUrl, dryRun, visibility }) => {
     const bundled = await bundleSubgraphCode(code);
     try {
       const result = await clientProvider().subgraphs.deploy({
@@ -894,7 +898,8 @@ function registerSubgraphTools(server, clientProvider = getClient) {
         sourceCode: code,
         ...startBlock !== undefined ? { startBlock } : {},
         ...databaseUrl !== undefined ? { databaseUrl } : {},
-        ...dryRun !== undefined ? { dryRun } : {}
+        ...dryRun !== undefined ? { dryRun } : {},
+        ...visibility !== undefined ? { visibility } : {}
       });
       return {
         content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
@@ -913,6 +918,18 @@ function registerSubgraphTools(server, clientProvider = getClient) {
       throw err;
     }
   });
+  defineTool(server, "subgraphs_publish", "Make a subgraph publicly readable at /v1/subgraphs/<name> — anyone (or any agent) can read it without a key. Claims the name in the global public namespace; fails with PUBLIC_NAME_TAKEN if another account holds it.", { name: z8.string().describe("Subgraph name") }, async ({ name }) => {
+    const result = await clientProvider().subgraphs.publish(name);
+    return {
+      content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+    };
+  });
+  defineTool(server, "subgraphs_unpublish", "Make a subgraph private again — /v1 reads then require the owning account's bearer key, and the global public name claim is released.", { name: z8.string().describe("Subgraph name") }, async ({ name }) => {
+    const result = await clientProvider().subgraphs.unpublish(name);
+    return {
+      content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+    };
+  });
   defineTool(server, "subgraphs_read_source", "Fetch the deployed TypeScript source of a subgraph (plus its stored version). Returns a readOnly payload for subgraphs deployed before source capture — in that case the caller should redeploy via CLI before editing.", { name: z8.string().describe("Subgraph name") }, async ({ name }) => {
     const source = await clientProvider().subgraphs.getSource(name);
     return {
@@ -1203,5 +1220,5 @@ httpServer.listen(port, () => {
     console.error("Warning: SECONDLAYER_MCP_SECRET not set, authentication disabled");
 });
 
-//# debugId=4D2E7E6934E70FD064756E2164756E21
+//# debugId=38C3E42509C42A3264756E2164756E21
 //# sourceMappingURL=bin-http.js.map