@shipstatic/mcp 1.11.0 → 1.12.0-beta.1

package/dist/call.d.ts

@@ -13,19 +13,6 @@ export interface ErrorHints {
 export type CallFn = <T>(fn: () => Promise<T>) => Promise<CallToolResult>;
 export interface CallOptions {
     hints: ErrorHints;
-    /**
-     * Attach a plain-object SUCCESS result as `structuredContent` beside the
-     * text. Hosted-only: it is what feeds the Apps-SDK widget, and the MCP spec
-     * pairs it with an `outputSchema`, which is a hand-maintained zod twin of a
-     * published type. One such twin is worth it for a widget; fifteen would be a
-     * drift surface with no consumer asking for it. See
-     * `cloudflare/mcp/CLAUDE.md`, "What deliberately differs".
-     *
-     * It does NOT gate the ERROR envelope, which every transport carries — see
-     * `toErrorResult`. The objection above is about fifteen success shapes; a
-     * failure has exactly one published shape, and no schema to keep in step.
-     */
-    structuredContent?: boolean;
     /**
      * Called when the API refuses on CREDENTIAL grounds — and only then.
      *

package/dist/call.js

@@ -39,7 +39,7 @@ const MAINTENANCE_HINT = 'The platform is temporarily closed for scheduled maint
  * kept equal by review.
  */
 export function createCall(options) {
-    const { hints, structuredContent = false, onAuthFailure } = options;
+    const { hints, onAuthFailure } = options;
     return async function call(fn) {
         try {
             const result = await fn();
@@ -48,13 +48,15 @@ export function createCall(options) {
             if (result === undefined) {
                 return { content: [{ type: 'text', text: 'Done.' }] };
             }
+            // The wire shape rides twice: as the text every client reads, and as
+            // `structuredContent` for the tool's `outputSchema` (every tool declares
+            // one, imported from the constitution; the SDK validates the result
+            // against it and refuses a result that carries none). A non-object has
+            // no schema to satisfy and rides the text channel alone.
             const text = JSON.stringify(result, null, 2);
-            const structured = structuredContent && isPlainObject(result)
-                ? result
-                : undefined;
             return {
                 content: [{ type: 'text', text }],
-                ...(structured ? { structuredContent: structured } : {}),
+                ...(isPlainObject(result) ? { structuredContent: result } : {}),
             };
         }
         catch (error) {
@@ -98,13 +100,9 @@ function isPlainObject(value) {
  * need of a precise backoff to parse "try again in 9 minutes" out of English.
  *
  * Safe on every arm, and checked rather than assumed: the MCP SDK validates
- * `structuredContent` only when a tool declares an `outputSchema`, and returns
- * early again when `isError` is set. No tool here declares one. So this is
- * additive for every client and invisible to any that does not look.
- *
- * It is deliberately NOT behind `CallOptions.structuredContent` — that flag
- * governs success shapes, where the schema-twin objection lives. A failure has
- * one published shape on every transport.
+ * `structuredContent` against a declared `outputSchema` only when `isError`
+ * is not set, so an error envelope never meets a success schema. Every tool
+ * declares one (imported from the constitution), and this arm is unaffected.
  */
 function toErrorResult(error, hints, onAuthFailure) {
     if (isShipError(error)) {

package/dist/server.js

@@ -1,5 +1,6 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { DeploymentVia, MY_API_KEY_URL } from '@shipstatic/types';
+import { DeploymentCreateResponseSchema } from '@shipstatic/types/schemas';
 import { z } from 'zod';
 import { call } from './call.js';
 import { registerAccountTools, TOOLS } from './tools.js';
@@ -43,6 +44,7 @@ export function createServer(ship, options) {
         // shares with the hosted one; only the input schema is this door's own.
         description: `Deploy a static site instantly: ${D.free}. Returns the live URL, file count, and size. Without SHIP_TOKEN, the response also includes a one-time claim URL, and the site expires in ${PUBLIC_EXPIRY} unless claimed. ${D.password}`,
         annotations: annotate(TOOLS[UPLOAD_TOOL_NAME]),
+        outputSchema: DeploymentCreateResponseSchema,
         inputSchema: {
             path: z
                 .string()

package/dist/tools.d.ts

@@ -35,9 +35,18 @@
  * the agent, the title reads as English for the human, and the description
  * carries every precision neither can. Both catalogue pins assert a title on
  * every tool, so the next one cannot be added without one.
+ *
+ * **Every tool publishes an `outputSchema`, imported from the constitution**
+ * (`@shipstatic/types/schemas`), never written here: a schema written beside
+ * a tool is a twin of a published type, and the SDK enforces it on every
+ * success, so a twin that drifts fails a call that succeeded. The constitution
+ * fences its schemas to its interfaces at compile time; this file only names
+ * which one each tool answers with, and `call` attaches the result as
+ * `structuredContent` so the schema has something to validate.
  */
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import type Ship from '@shipstatic/ship';
+import { z } from 'zod';
 import type { CallFn } from './call.js';
 /**
  * THE REGISTRY: one row per tool, every fact about it that a host reads.
@@ -154,4 +163,32 @@ export type AccountToolName = {
  * place a tool's account requirement is stated.
  */
 export declare const ACCOUNT_TOOL_NAMES: AccountToolName[];
+/**
+ * What `whoami` answers: exactly the keys its description names, and the
+ * schema IS the projection.
+ *
+ * `Account` also carries billing state, the API-key hint, the picture and
+ * timestamps, none of which the description mentions and none of which an
+ * agent acts on. A tool's result is the shape its description states, so the
+ * result is the constitution's `AccountSchema` narrowed to five keys, and
+ * parsing the wire through it is what drops the rest: one declaration owns
+ * both the published `outputSchema` and the projection. `suspended` is
+ * deliberately out: it means every write is refused, and the refusal says so
+ * itself at the moment it matters.
+ */
+export declare const ACCOUNT_SUMMARY: z.ZodObject<{
+    name: z.ZodNullable<z.ZodString>;
+    email: z.ZodString;
+    plan: z.ZodString;
+    usage: z.ZodObject<{
+        deployments: z.ZodInt;
+        platformDomains: z.ZodInt;
+        customDomains: z.ZodInt;
+    }, z.core.$strip>;
+    caps: z.ZodObject<{
+        deployments: z.ZodInt;
+        platformDomains: z.ZodInt;
+        customDomains: z.ZodInt;
+    }, z.core.$strip>;
+}, z.core.$strip>;
 export declare function registerAccountTools(server: McpServer, ship: Ship, call: CallFn): void;

package/dist/tools.js

@@ -35,7 +35,16 @@
  * the agent, the title reads as English for the human, and the description
  * carries every precision neither can. Both catalogue pins assert a title on
  * every tool, so the next one cannot be added without one.
+ *
+ * **Every tool publishes an `outputSchema`, imported from the constitution**
+ * (`@shipstatic/types/schemas`), never written here: a schema written beside
+ * a tool is a twin of a published type, and the SDK enforces it on every
+ * success, so a twin that drifts fails a call that succeeded. The constitution
+ * fences its schemas to its interfaces at compile time; this file only names
+ * which one each tool answers with, and `call` attaches the result as
+ * `structuredContent` so the schema has something to validate.
  */
+import { AccountSchema, DeploymentDeleteResponseSchema, DeploymentListResponseSchema, DeploymentSchema, DomainDeleteResponseSchema, DomainDnsResponseSchema, DomainListResponseSchema, DomainRecordsResponseSchema, DomainSchema, DomainSetResultSchema, DomainShareResponseSchema, DomainValidateResponseSchema, DomainVerifyResponseSchema, } from '@shipstatic/types/schemas';
 import { z } from 'zod';
 import { annotate, titled, UPLOAD_TOOL_NAME } from './vocabulary.js';
 /**
@@ -89,18 +98,25 @@ export const TOOLS = {
  */
 export const ACCOUNT_TOOL_NAMES = Object.keys(TOOLS).filter((name) => TOOLS[name].auth === 'required');
 /**
- * What `whoami` answers: exactly the keys its description names.
+ * What `whoami` answers: exactly the keys its description names, and the
+ * schema IS the projection.
  *
  * `Account` also carries billing state, the API-key hint, the picture and
  * timestamps, none of which the description mentions and none of which an
- * agent acts on. A tool's result is the shape its description states; this
- * is the one tool where the wire's own entity said more than the sentence.
- * `suspended` is deliberately out: it means every write is refused, and the
- * refusal says so itself at the moment it matters.
+ * agent acts on. A tool's result is the shape its description states, so the
+ * result is the constitution's `AccountSchema` narrowed to five keys, and
+ * parsing the wire through it is what drops the rest: one declaration owns
+ * both the published `outputSchema` and the projection. `suspended` is
+ * deliberately out: it means every write is refused, and the refusal says so
+ * itself at the moment it matters.
  */
-function accountSummary({ email, name, plan, usage, caps }) {
-    return { email, name, plan, usage, caps };
-}
+export const ACCOUNT_SUMMARY = AccountSchema.pick({
+    email: true,
+    name: true,
+    plan: true,
+    usage: true,
+    caps: true,
+});
 /**
  * The pagination surface, shared by every list tool because it is one
  * contract, not two. A list answers `{<collection>, cursor}` and nothing
@@ -134,12 +150,14 @@ export function registerAccountTools(server, ship, call) {
         title: 'List Deployments',
         description: `List all deployments with their URLs, status, labels, and password protection state.${PAGING_NOTE}`,
         annotations: annotate(TOOLS.deployments_list),
+        outputSchema: DeploymentListResponseSchema,
         inputSchema: PAGINATION_INPUT,
     }), ({ limit, cursor }) => call(() => ship.deployments.list({ limit, cursor })));
     server.registerTool('deployments_get', titled({
         title: 'Get Deployment',
         description: 'Get deployment details including URL, status, file count, size, labels, and password protection state.',
         annotations: annotate(TOOLS.deployments_get),
+        outputSchema: DeploymentSchema,
         inputSchema: {
             deployment: z
                 .string()
@@ -150,6 +168,7 @@ export function registerAccountTools(server, ship, call) {
         title: 'Update Deployment Labels',
         description: 'Update deployment labels. Replaces all existing labels.',
         annotations: annotate(TOOLS.deployments_set),
+        outputSchema: DeploymentSchema,
         inputSchema: {
             deployment: z
                 .string()
@@ -163,6 +182,7 @@ export function registerAccountTools(server, ship, call) {
         title: 'Delete Deployment',
         description: 'Permanently deletes a deployment and its files.',
         annotations: annotate(TOOLS.deployments_delete),
+        outputSchema: DeploymentDeleteResponseSchema,
         inputSchema: {
             deployment: z
                 .string()
@@ -174,6 +194,7 @@ export function registerAccountTools(server, ship, call) {
         title: 'Connect Custom Domain',
         description: 'Create or update a custom domain. Can reserve a name (omit deployment), link it to a deployment, switch deployments, or update labels. domains_records then returns the DNS records to configure.',
         annotations: annotate(TOOLS.domains_set),
+        outputSchema: DomainSetResultSchema,
         inputSchema: {
             domain: z.string().describe('Domain name (e.g. "www.example.com" or "blog.example.com")'),
             deployment: z
@@ -190,12 +211,14 @@ export function registerAccountTools(server, ship, call) {
         title: 'List Domains',
         description: `List all domains with their URLs, linked deployment, and verification status.${PAGING_NOTE}`,
         annotations: annotate(TOOLS.domains_list),
+        outputSchema: DomainListResponseSchema,
         inputSchema: PAGINATION_INPUT,
     }), ({ limit, cursor }) => call(() => ship.domains.list({ limit, cursor })));
     server.registerTool('domains_get', titled({
         title: 'Get Domain',
         description: 'Get domain details including URL, linked deployment, verification status, and labels.',
         annotations: annotate(TOOLS.domains_get),
+        outputSchema: DomainSchema,
         inputSchema: {
             domain: z
                 .string()
@@ -206,6 +229,7 @@ export function registerAccountTools(server, ship, call) {
         title: 'Get DNS Records',
         description: "Returns the DNS records to configure at the domain's DNS provider. Call after domains_set.",
         annotations: annotate(TOOLS.domains_records),
+        outputSchema: DomainRecordsResponseSchema,
         inputSchema: {
             domain: z
                 .string()
@@ -216,6 +240,7 @@ export function registerAccountTools(server, ship, call) {
         title: 'Get DNS Provider',
         description: 'Returns the DNS provider recorded for the domain, if known (e.g. Cloudflare, Namecheap): where its DNS records are configured.',
         annotations: annotate(TOOLS.domains_dns),
+        outputSchema: DomainDnsResponseSchema,
         inputSchema: {
             domain: z
                 .string()
@@ -226,6 +251,7 @@ export function registerAccountTools(server, ship, call) {
         title: 'Share DNS Setup',
         description: "Returns a shareable DNS setup URL that needs no API key, for whoever manages the domain's DNS.",
         annotations: annotate(TOOLS.domains_share),
+        outputSchema: DomainShareResponseSchema,
         inputSchema: {
             domain: z
                 .string()
@@ -236,6 +262,7 @@ export function registerAccountTools(server, ship, call) {
         title: 'Check Domain Availability',
         description: 'Check if a domain name is valid and available before creating it. Returns the normalized form and availability.',
         annotations: annotate(TOOLS.domains_validate),
+        outputSchema: DomainValidateResponseSchema,
         inputSchema: {
             domain: z
                 .string()
@@ -246,6 +273,7 @@ export function registerAccountTools(server, ship, call) {
         title: 'Verify Domain DNS',
         description: 'Trigger DNS verification for a custom domain. Call after the user has configured DNS records from domains_records. Verification is asynchronous — the domain status updates once DNS propagates.',
         annotations: annotate(TOOLS.domains_verify),
+        outputSchema: DomainVerifyResponseSchema,
         inputSchema: {
             domain: z
                 .string()
@@ -256,6 +284,7 @@ export function registerAccountTools(server, ship, call) {
         title: 'Delete Domain',
         description: 'Permanently deletes a domain.',
         annotations: annotate(TOOLS.domains_delete),
+        outputSchema: DomainDeleteResponseSchema,
         inputSchema: {
             domain: z.string().describe('Domain name to delete (e.g. "www.example.com")'),
         },
@@ -265,5 +294,6 @@ export function registerAccountTools(server, ship, call) {
         title: 'Show Account',
         description: "Returns the account's email, name, plan, current usage and plan caps.",
         annotations: annotate(TOOLS.whoami),
-    }), () => call(() => ship.whoami().then(accountSummary)));
+        outputSchema: ACCOUNT_SUMMARY,
+    }), () => call(() => ship.whoami().then((account) => ACCOUNT_SUMMARY.parse(account))));
 }

package/dist/vocabulary.d.ts

@@ -190,9 +190,8 @@ export declare const INSTRUCTION_BLOCKS: {
     readonly opening: "ShipStatic deploys static websites instantly. Free, no account required.";
     readonly live: "The site is live immediately.";
     /**
-     * Two sentences in one block, and a block of its own rather than a clause
-     * of `live`: a door that collects no visitor password (the hosted `/gpt`
-     * door, by OpenAI's data rule) composes `live` without this.
+     * A block of its own rather than a clause of `live`: two sentences, two
+     * facts, and a door may compose them independently.
      *
      * The read-back rule lives HERE and not in the upload description: a
      * password the user never sees locks them out, and `instructions` is the

package/dist/vocabulary.js

@@ -169,9 +169,8 @@ export const INSTRUCTION_BLOCKS = {
     opening: 'ShipStatic deploys static websites instantly. Free, no account required.',
     live: 'The site is live immediately.',
     /**
-     * Two sentences in one block, and a block of its own rather than a clause
-     * of `live`: a door that collects no visitor password (the hosted `/gpt`
-     * door, by OpenAI's data rule) composes `live` without this.
+     * A block of its own rather than a clause of `live`: two sentences, two
+     * facts, and a door may compose them independently.
      *
      * The read-back rule lives HERE and not in the upload description: a
      * password the user never sees locks them out, and `instructions` is the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shipstatic/mcp",
-  "version": "1.11.0",
+  "version": "1.12.0-beta.1",
   "mcpName": "com.shipstatic/mcp",
   "description": "Deploy static websites, landing pages, and prototypes instantly from AI agents. Start with the hosted endpoint at mcp.shipstatic.com (no install, no signup, no API key), or install this package to deploy folders from your own machine. The same fifteen tools either way.",
   "type": "module",
@@ -69,7 +69,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
     "@shipstatic/ship": "2.9.2",
-    "@shipstatic/types": "2.24.0",
+    "@shipstatic/types": "2.25.0-beta.1",
     "zod": "^4.4.3"
   },
   "devDependencies": {