@setluca/mcp 0.3.6 → 0.4.0

package/CHANGELOG.md

@@ -10,6 +10,29 @@ input schema, or changing what a tool does to a workspace.
 
 ## [Unreleased]
 
+## [0.4.0] - 2026-10-13
+
+### Added
+
+- Add a `claude` toolset, selected with `?toolset=claude` or
+  `LUCA_TOOLSET=claude`. It lists a fixed set of 43 tools for the Claude
+  connector directory and lists only the `luca-api-planner` and
+  `luca-morning-report` prompts. For an OAuth connection
+  it also hides tools above the grant's capability tier, so a `luca:read` grant
+  sees 39. The `full` and `tasks` toolsets are unchanged.
+
+## [0.3.7] - 2026-10-13
+
+### Fixed
+
+- Describe what `luca_book_call` does: it records a booked call in Luca, but it
+  doesn't create a calendar event or send the lead an invite. Its description
+  said it booked a slot the provider confirmed.
+- Describe which bookings `luca_reschedule_call` can move. Manual bookings move
+  in Luca. Cal.com and Google Calendar bookings also move on that calendar.
+  Calendly, GoHighLevel and iClosed bookings are refused, and so is a provider
+  booking with no calendar event.
+
 ## [0.3.6] - 2026-10-13
 
 ### Fixed

package/dist/index.js

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 import { serveStdio } from "@modelcontextprotocol/server/stdio";
 import { setEventSink, stderrEventSink } from "./observability.js";
-import { createLucaServer, parseToolset } from "./server.js";
+import { createLucaServer } from "./server.js";
+import { parseToolset } from "./toolsets.js";
 // stdout carries the protocol, so event lines go to stderr.
 setEventSink(stderrEventSink);
 /**

package/dist/oauth-resolver.js

@@ -4,15 +4,18 @@ import * as Redacted from "effect/Redacted";
 import * as Schema from "effect/Schema";
 import { TokenVerificationUnavailable } from "./errors.js";
 import { NonEmptyString } from "./fields.js";
+import { highestCapabilityScope } from "./scopes.js";
 import { callApi, unavailable, } from "./token-verification.js";
 /**
  * The body POST /oauth/resolve answers with for a token it accepted. The API
- * also sends the grant's scopes; the Luca API enforces them on every call, so
- * this resolver does not read them. An empty key is an API fault, not a key,
+ * enforces the grant's scopes on every call. This resolver reads them only to
+ * learn the capability tier, which the `claude` toolset uses to hide tools the
+ * grant cannot call. An empty key is an API fault, not a key,
  * so it fails as unavailable instead of reaching the API as a blank header.
  */
 const ResolvePayload = Schema.Struct({
     apiKey: Schema.optionalKey(NonEmptyString),
+    scopes: Schema.optionalKey(Schema.Array(Schema.String)),
 });
 const decodeResolvePayload = Schema.decodeUnknownEffect(ResolvePayload);
 /**
@@ -50,10 +53,13 @@ function requestConfig(settings, fetchImpl, token) {
     return callApi(settings, fetchImpl, {
         path: "/oauth/resolve",
         init: { method: "POST", headers: { authorization: `Bearer ${token}` } },
-    }, resolvePayload).pipe(Effect.map((payload) => Option.flatMapNullishOr(payload, (body) => body.apiKey).pipe(Option.map((apiKey) => ({
-        ...settings,
-        apiKey: Redacted.make(apiKey),
-    })))));
+    }, resolvePayload).pipe(Effect.map(Option.flatMapNullishOr((body) => body.apiKey === undefined
+        ? undefined
+        : {
+            ...settings,
+            apiKey: Redacted.make(body.apiKey),
+            grant: highestCapabilityScope(body.scopes ?? []),
+        })));
 }
 /** Three base64url segments: the form a JWT access token takes. */
 const JWT_ACCESS_TOKEN = /^[\w-]+\.[\w-]+\.[\w-]+$/;

package/dist/remote.js

@@ -12,8 +12,9 @@ import { optionalField } from "./optional-field.js";
 import { RATE_LIMIT_WINDOW_MS, createLocalRateLimits, } from "./rate-limit.js";
 import { OAUTH_DEFAULT_SCOPE } from "./scopes.js";
 import { toJsonPayload } from "./serialization.js";
-import { createLucaServer, parseToolset } from "./server.js";
+import { createLucaServer } from "./server.js";
 import { sha256Hex } from "./token-verification.js";
+import { parseToolset } from "./toolsets.js";
 export { bindingRateLimits, createLocalRateLimits } from "./rate-limit.js";
 export { apiKeyResolver, looksLikeDeveloperKey } from "./resolvers.js";
 /**
@@ -170,6 +171,7 @@ export function createRemoteResponder(options) {
         const handler = createMcpHandler(() => createLucaServer({
             lucaLayer: Layer.succeed(LucaApi, createLucaApi(config.value, options.apiFetch)),
             ...optionalField("toolset", options.toolset),
+            ...optionalField("grant", config.value.grant),
             ...optionalField("resourceMetadataUrl", options.resourceMetadataUrl),
         }), { ...optionalField("onerror", options.onError) });
         // The handler lives until the response body is done with, then

package/dist/scopes.js

@@ -1,4 +1,5 @@
 import * as Arr from "effect/Array";
+import * as Option from "effect/Option";
 import * as Order from "effect/Order";
 /**
  * The OAuth scopes this server advertises, and the API-key scopes each one
@@ -147,6 +148,14 @@ export function tierGrants(scope, apiScope) {
 export function capabilityRank(scope) {
     return CAPABILITY_LADDER.indexOf(scope);
 }
+/**
+ * The highest capability scope in a grant's scope list. A list naming none
+ * (only `offline_access`, say, or an empty list) resolves to `luca:read`, the
+ * lowest, so an unreadable grant never lists more than a read grant would.
+ */
+export function highestCapabilityScope(scopes) {
+    return Arr.findLast(CAPABILITY_LADDER, (scope) => Arr.contains(scopes, scope)).pipe(Option.getOrElse(() => "luca:read"));
+}
 /**
  * The lowest capability scope that grants `apiScope`, or `undefined` when no
  * tier grants it. Reading the ladder from the bottom is what makes the answer

package/dist/server.js

@@ -16,12 +16,13 @@ import { optionalField } from "./optional-field.js";
 import { LUCA_API_PLANNER_PROMPT, LUCA_PROMPTS, } from "./prompts.js";
 import { provenanceFields } from "./provenance.js";
 import { LUCA_OPERATION_MANIFEST_RESOURCE, LUCA_RESOURCES, } from "./resources.js";
-import { oauthScopeForOperation } from "./scopes.js";
+import { capabilityRank, oauthScopeForOperation, } from "./scopes.js";
 import { toJsonText } from "./serialization.js";
 import { toolSchema } from "./standard-schema.js";
 import { LUCA_TASK_TOOLS } from "./task-tools.js";
 import { buildCache } from "./tool-cache.js";
 import { fromOperation, fromTaskTool, operationProgram, registerTool, } from "./tool.js";
+import { TOOLSETS } from "./toolsets.js";
 import { LUCA_MCP_VERSION } from "./version.js";
 const LucaLive = LucaApiLive.pipe(Layer.provide(LucaConfigLive));
 /**
@@ -94,11 +95,6 @@ const LUCA_CACHE_HINTS = {
     },
     "server/discover": { ttlMs: STATIC_LIST_TTL_MS, cacheScope: "private" },
 };
-// Only "tasks" selects the trimmed surface; every other value, including an
-// unset query param, takes the full-surface branch.
-export function parseToolset(value) {
-    return value === "tasks" ? "tasks" : "full";
-}
 function registerLucaResources(server, lucaLayer, completions, resourceMetadataUrl) {
     Arr.forEach(LUCA_RESOURCES, (resource) => {
         const operation = operationById(resource.operationId);
@@ -299,16 +295,14 @@ function registerPrompt(server, prompt, completions) {
  * Build the Luca MCP server: registers the operation tools, the task tools, the
  * `luca://…` resources, and the planner prompt against a shared `LucaApi` layer.
  * `options.lucaLayer` swaps the HTTP client (tests inject an in-memory handler);
- * `options.toolset` picks the tool set. `"tasks"` exposes only the task tools
- * plus capability discovery, and `"full"`, the default, exposes everything.
+ * `options.toolset` picks the tool set from `TOOLSETS`; `"full"`, the default,
+ * exposes everything. `options.grant` trims the `claude` set to the tools the
+ * connection's OAuth grant can call.
  */
 export function createLucaServer(options = {}) {
     const lucaLayer = options.lucaLayer ?? LucaLive;
-    // The default value is only ever compared against `"tasks"` below; any other
-    // string (including `""`) takes the full-surface branch, so the literal here
-    // cannot change behavior.
-    // Stryker disable next-line StringLiteral: only `"tasks"` is compared downstream, so any non-tasks default behaves as full
     const toolset = options.toolset ?? "full";
+    const definition = TOOLSETS[toolset];
     const surface = {
         toolset,
         ...optionalField("resourceMetadataUrl", options.resourceMetadataUrl),
@@ -317,18 +311,20 @@ export function createLucaServer(options = {}) {
         cacheHints: LUCA_CACHE_HINTS,
         instructions: LUCA_SERVER_INSTRUCTIONS,
     });
-    // The tasks set carries one operation, capability discovery, so a client can
-    // still learn what the workspace supports without the full tool list.
-    const operations = toolset === "tasks" ? [operationById("capabilities.get")] : LUCA_OPERATIONS;
-    Arr.forEach(operations, (operation) => {
-        registerTool(server, fromOperation(operation), lucaLayer, surface);
-    });
-    Arr.forEach(LUCA_TASK_TOOLS, (tool) => {
-        registerTool(server, fromTaskTool(tool), lucaLayer, surface);
+    const listed = (tool) => !definition.grantFiltered ||
+        options.grant === undefined ||
+        capabilityRank(tool.oauthScope) <= capabilityRank(options.grant);
+    const inToolset = (name) => definition.tools === undefined || Arr.contains(definition.tools, name);
+    const tools = [
+        ...LUCA_OPERATIONS.filter((operation) => inToolset(operation.toolName)).map(fromOperation),
+        ...LUCA_TASK_TOOLS.filter((tool) => inToolset(tool.name)).map(fromTaskTool),
+    ].filter(listed);
+    Arr.forEach(tools, (tool) => {
+        registerTool(server, tool, lucaLayer, surface);
     });
     registerOperationManifestResource(server);
     const completions = completionCallbacks(operationById, lucaLayer);
     registerLucaResources(server, lucaLayer, completions, options.resourceMetadataUrl);
-    registerPrompts(server, LUCA_PROMPTS, completions);
+    registerPrompts(server, LUCA_PROMPTS.filter((prompt) => !Arr.contains(definition.hiddenPrompts, prompt.name)), completions);
     return server;
 }

package/dist/task-tools/bookings.js

@@ -118,7 +118,7 @@ function slotNotAvailable(key) {
 const bookCall = taskTool({
     name: "luca_book_call",
     title: "Book a call with a lead",
-    description: 'Book a lead into a slot the provider confirms is open. Checks availability first, against the schedule of the booking type when bookingTypeId is given, and returns the open slots instead of booking when the requested one is taken. A call with an idempotencyKey skips that check so a retry gets the original result back. Booking moves the lead to booked and notifies the coach\'s webhook subscribers, so pass confirm: true only after the coach approves this exact slot. Example: call with { leadId, slotAt: "2026-07-14T15:00:00Z", confirm: true } after the lead agreed to a time.',
+    description: "Record a booked call for a lead in Luca. This does not create an event on the coach's calendar or send the lead an invite: book the call with the provider too, or have the lead book through the coach's booking link. Checks availability first, against the schedule of the booking type when bookingTypeId is given, and returns the open slots instead of booking when the requested one is taken. A call with an idempotencyKey skips that check so a retry gets the original result back. Booking moves the lead to booked and notifies the coach's webhook subscribers, so pass confirm: true only after the coach approves this exact slot. Example: call with { leadId, slotAt: \"2026-07-14T15:00:00Z\", confirm: true } after the lead agreed to a time.",
     inputSchema: {
         ...WORKSPACE_INPUT_FIELDS,
         leadId: NonEmptyString.annotate({ description: "The lead to book." }),
@@ -176,7 +176,7 @@ const DEFAULT_GUEST_LINK_HOURS = 168;
 const rescheduleCall = taskTool({
     name: "luca_reschedule_call",
     title: "Move a call to a new time",
-    description: 'Move a booked call to a new time and hand back a fresh reschedule link for the lead. Checks the new slot is open first, against the schedule of its booking type when it has one, and returns the open slots instead of moving the call when it is taken. A call with an idempotencyKey skips that check so a retry gets the original result back. Moving the call updates the connected calendar and re-arms the lead\'s reminder for the new time, so pass confirm: true only after the coach approves the move. Example: call with { bookingId, slotAt: "2026-07-16T15:00:00Z", confirm: true } after the lead asked to push the call. No message about the move is sent: send the lead the link yourself, or draft the message through the review queue.',
+    description: 'Move a booked call to a new time and hand back a fresh reschedule link for the lead. Checks the new slot is open first, against the schedule of its booking type when it has one, and returns the open slots instead of moving the call when it is taken. A call with an idempotencyKey skips that check so a retry gets the original result back. A manual booking moves in Luca only. A Cal.com or Google Calendar booking moves on that calendar too. A Calendly, GoHighLevel or iClosed booking is refused so the coach can move it with the provider, and so is a provider booking with no calendar event, such as one from luca_book_call. Moving the call re-arms the lead\'s reminder for the new time, so pass confirm: true only after the coach approves the move. Example: call with { bookingId, slotAt: "2026-07-16T15:00:00Z", confirm: true } after the lead asked to push the call. No message about the move is sent: send the lead the link yourself, or draft the message through the review queue.',
     inputSchema: {
         ...WORKSPACE_INPUT_FIELDS,
         bookingId: NonEmptyString.annotate({ description: "The booking to move." }),

package/dist/toolsets.js

@@ -0,0 +1,81 @@
+import { LUCA_TASK_TOOLS } from "./task-tools.js";
+/**
+ * The tools the `claude` toolset exposes. This list is the contract with the
+ * connector directory submission, and a test pins it name for name. Adding or
+ * removing a tool here changes what the directory lists.
+ */
+export const CLAUDE_TOOL_NAMES = [
+    "luca_triage_inbox",
+    "luca_morning_report",
+    "luca_find_leads",
+    "luca_post_call_queue",
+    "luca_analytics_rollup",
+    "luca_analytics_magic_monday",
+    "luca_analytics_deep_dive",
+    "luca_capabilities_get",
+    "luca_leads_list",
+    "luca_leads_get",
+    "luca_leads_explain",
+    "luca_conversations_list",
+    "luca_conversations_get",
+    "luca_conversations_messages",
+    "luca_review_queue_list",
+    "luca_review_queue_explain",
+    "luca_review_queue_sla",
+    "luca_bookings_list",
+    "luca_bookings_get",
+    "luca_bookings_availability",
+    "luca_bookings_brief",
+    "luca_bookings_needs_outcome",
+    "luca_call_events_needing_feedback",
+    "luca_call_events_get",
+    "luca_channels_list",
+    "luca_channels_catalog",
+    "luca_reports_scorecard",
+    "luca_reports_morning",
+    "luca_campaigns_list",
+    "luca_campaigns_get",
+    "luca_campaigns_analytics",
+    "luca_broadcasts_list",
+    "luca_broadcasts_get",
+    "luca_voice_profile",
+    "luca_analytics_funnel",
+    "luca_analytics_ghosted_leads",
+    "luca_analytics_objections",
+    "luca_analytics_insights",
+    "luca_memory_list",
+    "luca_draft_reply",
+    "luca_flag_for_human",
+    "luca_leads_notes_add",
+    "luca_leads_update",
+];
+export const TOOLSETS = {
+    full: { hiddenPrompts: [], grantFiltered: false },
+    tasks: {
+        tools: [
+            "luca_capabilities_get",
+            ...LUCA_TASK_TOOLS.map((tool) => tool.name),
+        ],
+        hiddenPrompts: [],
+        grantFiltered: false,
+    },
+    claude: {
+        tools: CLAUDE_TOOL_NAMES,
+        hiddenPrompts: [
+            "luca-rescue-silent-leads",
+            "luca-plan-campaign",
+            "luca-plan-broadcast",
+            "luca-close-the-call-loop",
+            // These name approve-and-send, reject, or learning tools the set leaves out.
+            "luca-triage-queue",
+            "luca-draft-reply",
+            "luca-weekly-review",
+        ],
+        grantFiltered: true,
+    },
+};
+// Only "tasks" and "claude" select a trimmed surface; every other value,
+// including an unset query param, takes the full-surface branch.
+export function parseToolset(value) {
+    return value === "tasks" || value === "claude" ? value : "full";
+}

package/dist/version.js

@@ -9,6 +9,6 @@
  *
  * Bump this in the same commit as package.json and server.json.
  */
-export const LUCA_MCP_VERSION = "0.3.6";
+export const LUCA_MCP_VERSION = "0.4.0";
 /** The user-agent every outbound Luca API call identifies itself with. */
 export const LUCA_MCP_USER_AGENT = `luca-mcp/${LUCA_MCP_VERSION}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@setluca/mcp",
-  "version": "0.3.6",
+  "version": "0.4.0",
   "private": false,
   "description": "Let your AI assistant help with Luca conversations, leads, replies, campaigns, and bookings.",
   "keywords": [