@setluca/mcp 0.3.7 → 0.4.0

package/CHANGELOG.md

@@ -10,6 +10,17 @@ input schema, or changing what a tool does to a workspace.
 
 ## [Unreleased]
 
+## [0.4.0] - 2026-10-13
+
+### Added
+
+- Add a `claude` toolset, selected with `?toolset=claude` or
+  `LUCA_TOOLSET=claude`. It lists a fixed set of 43 tools for the Claude
+  connector directory and lists only the `luca-api-planner` and
+  `luca-morning-report` prompts. For an OAuth connection
+  it also hides tools above the grant's capability tier, so a `luca:read` grant
+  sees 39. The `full` and `tasks` toolsets are unchanged.
+
 ## [0.3.7] - 2026-10-13
 
 ### Fixed

package/dist/index.js

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 import { serveStdio } from "@modelcontextprotocol/server/stdio";
 import { setEventSink, stderrEventSink } from "./observability.js";
-import { createLucaServer, parseToolset } from "./server.js";
+import { createLucaServer } from "./server.js";
+import { parseToolset } from "./toolsets.js";
 // stdout carries the protocol, so event lines go to stderr.
 setEventSink(stderrEventSink);
 /**

package/dist/oauth-resolver.js

@@ -4,15 +4,18 @@ import * as Redacted from "effect/Redacted";
 import * as Schema from "effect/Schema";
 import { TokenVerificationUnavailable } from "./errors.js";
 import { NonEmptyString } from "./fields.js";
+import { highestCapabilityScope } from "./scopes.js";
 import { callApi, unavailable, } from "./token-verification.js";
 /**
  * The body POST /oauth/resolve answers with for a token it accepted. The API
- * also sends the grant's scopes; the Luca API enforces them on every call, so
- * this resolver does not read them. An empty key is an API fault, not a key,
+ * enforces the grant's scopes on every call. This resolver reads them only to
+ * learn the capability tier, which the `claude` toolset uses to hide tools the
+ * grant cannot call. An empty key is an API fault, not a key,
  * so it fails as unavailable instead of reaching the API as a blank header.
  */
 const ResolvePayload = Schema.Struct({
     apiKey: Schema.optionalKey(NonEmptyString),
+    scopes: Schema.optionalKey(Schema.Array(Schema.String)),
 });
 const decodeResolvePayload = Schema.decodeUnknownEffect(ResolvePayload);
 /**
@@ -50,10 +53,13 @@ function requestConfig(settings, fetchImpl, token) {
     return callApi(settings, fetchImpl, {
         path: "/oauth/resolve",
         init: { method: "POST", headers: { authorization: `Bearer ${token}` } },
-    }, resolvePayload).pipe(Effect.map((payload) => Option.flatMapNullishOr(payload, (body) => body.apiKey).pipe(Option.map((apiKey) => ({
-        ...settings,
-        apiKey: Redacted.make(apiKey),
-    })))));
+    }, resolvePayload).pipe(Effect.map(Option.flatMapNullishOr((body) => body.apiKey === undefined
+        ? undefined
+        : {
+            ...settings,
+            apiKey: Redacted.make(body.apiKey),
+            grant: highestCapabilityScope(body.scopes ?? []),
+        })));
 }
 /** Three base64url segments: the form a JWT access token takes. */
 const JWT_ACCESS_TOKEN = /^[\w-]+\.[\w-]+\.[\w-]+$/;

package/dist/remote.js

@@ -12,8 +12,9 @@ import { optionalField } from "./optional-field.js";
 import { RATE_LIMIT_WINDOW_MS, createLocalRateLimits, } from "./rate-limit.js";
 import { OAUTH_DEFAULT_SCOPE } from "./scopes.js";
 import { toJsonPayload } from "./serialization.js";
-import { createLucaServer, parseToolset } from "./server.js";
+import { createLucaServer } from "./server.js";
 import { sha256Hex } from "./token-verification.js";
+import { parseToolset } from "./toolsets.js";
 export { bindingRateLimits, createLocalRateLimits } from "./rate-limit.js";
 export { apiKeyResolver, looksLikeDeveloperKey } from "./resolvers.js";
 /**
@@ -170,6 +171,7 @@ export function createRemoteResponder(options) {
         const handler = createMcpHandler(() => createLucaServer({
             lucaLayer: Layer.succeed(LucaApi, createLucaApi(config.value, options.apiFetch)),
             ...optionalField("toolset", options.toolset),
+            ...optionalField("grant", config.value.grant),
             ...optionalField("resourceMetadataUrl", options.resourceMetadataUrl),
         }), { ...optionalField("onerror", options.onError) });
         // The handler lives until the response body is done with, then

package/dist/scopes.js

@@ -1,4 +1,5 @@
 import * as Arr from "effect/Array";
+import * as Option from "effect/Option";
 import * as Order from "effect/Order";
 /**
  * The OAuth scopes this server advertises, and the API-key scopes each one
@@ -147,6 +148,14 @@ export function tierGrants(scope, apiScope) {
 export function capabilityRank(scope) {
     return CAPABILITY_LADDER.indexOf(scope);
 }
+/**
+ * The highest capability scope in a grant's scope list. A list naming none
+ * (only `offline_access`, say, or an empty list) resolves to `luca:read`, the
+ * lowest, so an unreadable grant never lists more than a read grant would.
+ */
+export function highestCapabilityScope(scopes) {
+    return Arr.findLast(CAPABILITY_LADDER, (scope) => Arr.contains(scopes, scope)).pipe(Option.getOrElse(() => "luca:read"));
+}
 /**
  * The lowest capability scope that grants `apiScope`, or `undefined` when no
  * tier grants it. Reading the ladder from the bottom is what makes the answer

package/dist/server.js

@@ -16,12 +16,13 @@ import { optionalField } from "./optional-field.js";
 import { LUCA_API_PLANNER_PROMPT, LUCA_PROMPTS, } from "./prompts.js";
 import { provenanceFields } from "./provenance.js";
 import { LUCA_OPERATION_MANIFEST_RESOURCE, LUCA_RESOURCES, } from "./resources.js";
-import { oauthScopeForOperation } from "./scopes.js";
+import { capabilityRank, oauthScopeForOperation, } from "./scopes.js";
 import { toJsonText } from "./serialization.js";
 import { toolSchema } from "./standard-schema.js";
 import { LUCA_TASK_TOOLS } from "./task-tools.js";
 import { buildCache } from "./tool-cache.js";
 import { fromOperation, fromTaskTool, operationProgram, registerTool, } from "./tool.js";
+import { TOOLSETS } from "./toolsets.js";
 import { LUCA_MCP_VERSION } from "./version.js";
 const LucaLive = LucaApiLive.pipe(Layer.provide(LucaConfigLive));
 /**
@@ -94,11 +95,6 @@ const LUCA_CACHE_HINTS = {
     },
     "server/discover": { ttlMs: STATIC_LIST_TTL_MS, cacheScope: "private" },
 };
-// Only "tasks" selects the trimmed surface; every other value, including an
-// unset query param, takes the full-surface branch.
-export function parseToolset(value) {
-    return value === "tasks" ? "tasks" : "full";
-}
 function registerLucaResources(server, lucaLayer, completions, resourceMetadataUrl) {
     Arr.forEach(LUCA_RESOURCES, (resource) => {
         const operation = operationById(resource.operationId);
@@ -299,16 +295,14 @@ function registerPrompt(server, prompt, completions) {
  * Build the Luca MCP server: registers the operation tools, the task tools, the
  * `luca://…` resources, and the planner prompt against a shared `LucaApi` layer.
  * `options.lucaLayer` swaps the HTTP client (tests inject an in-memory handler);
- * `options.toolset` picks the tool set. `"tasks"` exposes only the task tools
- * plus capability discovery, and `"full"`, the default, exposes everything.
+ * `options.toolset` picks the tool set from `TOOLSETS`; `"full"`, the default,
+ * exposes everything. `options.grant` trims the `claude` set to the tools the
+ * connection's OAuth grant can call.
  */
 export function createLucaServer(options = {}) {
     const lucaLayer = options.lucaLayer ?? LucaLive;
-    // The default value is only ever compared against `"tasks"` below; any other
-    // string (including `""`) takes the full-surface branch, so the literal here
-    // cannot change behavior.
-    // Stryker disable next-line StringLiteral: only `"tasks"` is compared downstream, so any non-tasks default behaves as full
     const toolset = options.toolset ?? "full";
+    const definition = TOOLSETS[toolset];
     const surface = {
         toolset,
         ...optionalField("resourceMetadataUrl", options.resourceMetadataUrl),
@@ -317,18 +311,20 @@ export function createLucaServer(options = {}) {
         cacheHints: LUCA_CACHE_HINTS,
         instructions: LUCA_SERVER_INSTRUCTIONS,
     });
-    // The tasks set carries one operation, capability discovery, so a client can
-    // still learn what the workspace supports without the full tool list.
-    const operations = toolset === "tasks" ? [operationById("capabilities.get")] : LUCA_OPERATIONS;
-    Arr.forEach(operations, (operation) => {
-        registerTool(server, fromOperation(operation), lucaLayer, surface);
-    });
-    Arr.forEach(LUCA_TASK_TOOLS, (tool) => {
-        registerTool(server, fromTaskTool(tool), lucaLayer, surface);
+    const listed = (tool) => !definition.grantFiltered ||
+        options.grant === undefined ||
+        capabilityRank(tool.oauthScope) <= capabilityRank(options.grant);
+    const inToolset = (name) => definition.tools === undefined || Arr.contains(definition.tools, name);
+    const tools = [
+        ...LUCA_OPERATIONS.filter((operation) => inToolset(operation.toolName)).map(fromOperation),
+        ...LUCA_TASK_TOOLS.filter((tool) => inToolset(tool.name)).map(fromTaskTool),
+    ].filter(listed);
+    Arr.forEach(tools, (tool) => {
+        registerTool(server, tool, lucaLayer, surface);
     });
     registerOperationManifestResource(server);
     const completions = completionCallbacks(operationById, lucaLayer);
     registerLucaResources(server, lucaLayer, completions, options.resourceMetadataUrl);
-    registerPrompts(server, LUCA_PROMPTS, completions);
+    registerPrompts(server, LUCA_PROMPTS.filter((prompt) => !Arr.contains(definition.hiddenPrompts, prompt.name)), completions);
     return server;
 }

package/dist/toolsets.js

@@ -0,0 +1,81 @@
+import { LUCA_TASK_TOOLS } from "./task-tools.js";
+/**
+ * The tools the `claude` toolset exposes. This list is the contract with the
+ * connector directory submission, and a test pins it name for name. Adding or
+ * removing a tool here changes what the directory lists.
+ */
+export const CLAUDE_TOOL_NAMES = [
+    "luca_triage_inbox",
+    "luca_morning_report",
+    "luca_find_leads",
+    "luca_post_call_queue",
+    "luca_analytics_rollup",
+    "luca_analytics_magic_monday",
+    "luca_analytics_deep_dive",
+    "luca_capabilities_get",
+    "luca_leads_list",
+    "luca_leads_get",
+    "luca_leads_explain",
+    "luca_conversations_list",
+    "luca_conversations_get",
+    "luca_conversations_messages",
+    "luca_review_queue_list",
+    "luca_review_queue_explain",
+    "luca_review_queue_sla",
+    "luca_bookings_list",
+    "luca_bookings_get",
+    "luca_bookings_availability",
+    "luca_bookings_brief",
+    "luca_bookings_needs_outcome",
+    "luca_call_events_needing_feedback",
+    "luca_call_events_get",
+    "luca_channels_list",
+    "luca_channels_catalog",
+    "luca_reports_scorecard",
+    "luca_reports_morning",
+    "luca_campaigns_list",
+    "luca_campaigns_get",
+    "luca_campaigns_analytics",
+    "luca_broadcasts_list",
+    "luca_broadcasts_get",
+    "luca_voice_profile",
+    "luca_analytics_funnel",
+    "luca_analytics_ghosted_leads",
+    "luca_analytics_objections",
+    "luca_analytics_insights",
+    "luca_memory_list",
+    "luca_draft_reply",
+    "luca_flag_for_human",
+    "luca_leads_notes_add",
+    "luca_leads_update",
+];
+export const TOOLSETS = {
+    full: { hiddenPrompts: [], grantFiltered: false },
+    tasks: {
+        tools: [
+            "luca_capabilities_get",
+            ...LUCA_TASK_TOOLS.map((tool) => tool.name),
+        ],
+        hiddenPrompts: [],
+        grantFiltered: false,
+    },
+    claude: {
+        tools: CLAUDE_TOOL_NAMES,
+        hiddenPrompts: [
+            "luca-rescue-silent-leads",
+            "luca-plan-campaign",
+            "luca-plan-broadcast",
+            "luca-close-the-call-loop",
+            // These name approve-and-send, reject, or learning tools the set leaves out.
+            "luca-triage-queue",
+            "luca-draft-reply",
+            "luca-weekly-review",
+        ],
+        grantFiltered: true,
+    },
+};
+// Only "tasks" and "claude" select a trimmed surface; every other value,
+// including an unset query param, takes the full-surface branch.
+export function parseToolset(value) {
+    return value === "tasks" || value === "claude" ? value : "full";
+}

package/dist/version.js

@@ -9,6 +9,6 @@
  *
  * Bump this in the same commit as package.json and server.json.
  */
-export const LUCA_MCP_VERSION = "0.3.7";
+export const LUCA_MCP_VERSION = "0.4.0";
 /** The user-agent every outbound Luca API call identifies itself with. */
 export const LUCA_MCP_USER_AGENT = `luca-mcp/${LUCA_MCP_VERSION}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@setluca/mcp",
-  "version": "0.3.7",
+  "version": "0.4.0",
   "private": false,
   "description": "Let your AI assistant help with Luca conversations, leads, replies, campaigns, and bookings.",
   "keywords": [