@shuffleio/shuffle-mcps 0.0.36 → 0.0.38

package/README.md

@@ -1,6 +1,6 @@
 <div align="center">
 
-<img src="https://security.shuffler.io/mcp/agent-icon.png" alt="Shuffle MCPs" width="96" />
+<img src="https://shuffle.security/mcp/agent-icon.png" alt="Shuffle MCPs" width="96" />
 
 # Shuffle MCPs
 
@@ -26,11 +26,11 @@ Turn 3,000+ SaaS tools into MCP servers your agents can use. One search, one cli
   </tr>
   <tr>
     <td align="center" width="50%">
-      <img src="https://security.shuffler.io/mcp/search-preview.png" alt="Search 3,000+ integrations" width="380" style="border-radius: 12px;" />
+      <img src="https://shuffle.security/mcp/search-preview.png" alt="Search 3,000+ integrations" width="380" style="border-radius: 12px;" />
       <br/><sub><b>3. Search any of 3,000+ tools</b></sub>
     </td>
     <td align="center" width="50%">
-      <img src="https://security.shuffler.io/mcp/app-detail-preview.png" alt="Authenticate and use as MCP" width="380" style="border-radius: 12px;" />
+      <img src="https://shuffle.security/mcp/app-detail-preview.png" alt="Authenticate and use as MCP" width="380" style="border-radius: 12px;" />
       <br/><sub><b>4. Authenticate — your agent uses it instantly</b></sub>
     </td>
   </tr>
@@ -38,7 +38,7 @@ Turn 3,000+ SaaS tools into MCP servers your agents can use. One search, one cli
 
 &nbsp;
 
-> **See it live:** [security.shuffler.io/shuffle-mcp-demo](https://security.shuffler.io/shuffle-mcp-demo) — a fully working demo of every component in this package (inline search, search drawer, app detail drawer, auth, Try MCP, and Try individual actions). No login required.
+> **See it live:** [shuffle.security/shuffle-mcp-demo](https://shuffle.security/shuffle-mcp-demo) — a fully working demo of every component in this package (inline search, search drawer, app detail drawer, auth, Try MCP, and Try individual actions). No login required.
 
 > **No SDK required.** Once a tool is authenticated in Shuffle, it is live as an MCP server immediately — call it from any agent over plain HTTP. This npm package is the optional UI layer for embedding the search-and-connect flow inside your own product.
 
@@ -99,13 +99,13 @@ The library exports six React components — use one or all of them. They share
 
 | Component | What it does | Live demo |
 |---|---|---|
-| [`<ShuffleMCP />`](#1-shufflemcp--inline-search) | Inline search box that merges Algolia's 3,000+ public app catalog with the current user's private apps | [/shuffle-mcp-demo §1](https://security.shuffler.io/shuffle-mcp-demo) |
-| [`<AppSearchDrawer />`](#2-appsearchdrawer--full-search-drawer) | Right-side drawer wrapping `<ShuffleMCP />` plus a "Your apps" status row. This is the exact "Add Ingestion Source" drawer used in production | [/shuffle-mcp-demo §2](https://security.shuffler.io/shuffle-mcp-demo) |
-| [`<AppDetailDrawer />`](#3-appdetaildrawer--single-app-config) | Right-side drawer for a single app: list/edit/test authentications and try the MCP `tools/call` endpoint inline | [/shuffle-mcp-demo §3](https://security.shuffler.io/shuffle-mcp-demo) |
-| [`<AgentUI />`](#4-agentui--start--debug-agents) | Standalone "What do you want to do?" hero prompt + live decision-by-decision debugger for `/api/v1/agent` runs. Drop-in replacement for the legacy Shuffle Core agent page | [/agents](https://security.shuffler.io/agents) |
-| [`<AgentRunDrawer />`](#5-agentrundrawer--run-agent-side-panel) | Right-side drawer that hosts `<AgentUI />` in compact mode plus optional caller-provided **Permissions** and **Local LLM** tabs (slot-driven, no host context required) | [/shuffle-mcp-demo §1b](https://security.shuffler.io/shuffle-mcp-demo) |
-| [`<AgentActivityList />`](#6-agentactivitylist--past-executions) | Searchable, status-filterable list of past `/api/v1/agent` runs. Pair with `<AgentExecutionDrawer />` to inspect any row in the canonical Simple/Detailed view | [/shuffle-mcp-demo §8](https://security.shuffler.io/shuffle-mcp-demo) |
-| [`<AgentExecutionDrawer />`](#7-agentexecutiondrawer--inspect-one-run) | Right-side drawer that pre-loads a single `AgentRun` into `<AgentUI />` (no `authorization` token required) for read-only inspection | [/agents](https://security.shuffler.io/agents) |
+| [`<ShuffleMCP />`](#1-shufflemcp--inline-search) | Inline search box that merges Algolia's 3,000+ public app catalog with the current user's private apps | [/shuffle-mcp-demo §1](https://shuffle.security/shuffle-mcp-demo) |
+| [`<AppSearchDrawer />`](#2-appsearchdrawer--full-search-drawer) | Right-side drawer wrapping `<ShuffleMCP />` plus a "Your apps" status row. This is the exact "Add Ingestion Source" drawer used in production | [/shuffle-mcp-demo §2](https://shuffle.security/shuffle-mcp-demo) |
+| [`<AppDetailDrawer />`](#3-appdetaildrawer--single-app-config) | Right-side drawer for a single app: list/edit/test authentications and try the MCP `tools/call` endpoint inline | [/shuffle-mcp-demo §3](https://shuffle.security/shuffle-mcp-demo) |
+| [`<AgentUI />`](#4-agentui--start--debug-agents) | Standalone "What do you want to do?" hero prompt + live decision-by-decision debugger for `/api/v1/agent` runs. Drop-in replacement for the legacy Shuffle Core agent page | [/agents](https://shuffle.security/agents) |
+| [`<AgentRunDrawer />`](#5-agentrundrawer--run-agent-side-panel) | Right-side drawer that hosts `<AgentUI />` in compact mode plus optional caller-provided **Permissions** and **Local LLM** tabs (slot-driven, no host context required) | [/shuffle-mcp-demo §1b](https://shuffle.security/shuffle-mcp-demo) |
+| [`<AgentActivityList />`](#6-agentactivitylist--past-executions) | Searchable, status-filterable list of past `/api/v1/agent` runs. Pair with `<AgentExecutionDrawer />` to inspect any row in the canonical Simple/Detailed view | [/shuffle-mcp-demo §8](https://shuffle.security/shuffle-mcp-demo) |
+| [`<AgentExecutionDrawer />`](#7-agentexecutiondrawer--inspect-one-run) | Right-side drawer that pre-loads a single `AgentRun` into `<AgentUI />` (no `authorization` token required) for read-only inspection | [/agents](https://shuffle.security/agents) |
 
 ### 1. `<ShuffleMCP />` — inline search
 
@@ -252,7 +252,7 @@ Useful props:
 | `onRun` | `(info) => void` | Fires whenever a run finishes (success or failure) |
 | `className` / `sx` / `contentSx` | `string` / `SxProps` | Style overrides for the root container and inner content column |
 
-Reference page in production: [`src/pages/dashboard/AgentsPage.tsx`](../pages/dashboard/AgentsPage.tsx) (mounted at [`/agents`](https://security.shuffler.io/agents)).
+Reference page in production: [`src/pages/dashboard/AgentsPage.tsx`](../pages/dashboard/AgentsPage.tsx) (mounted at [`/agents`](https://shuffle.security/agents)).
 
 ### 5. `<AgentRunDrawer />` — Run Agent side panel
 

package/dist/{appsCache-ME4KZMTY.mjs → appsCache-32FX7WJE.mjs}

@@ -2,7 +2,7 @@ import {
   fetchApps,
   fetchAppsViaApiConfig,
   invalidateAppsCache
-} from "./chunk-IABSYB2J.mjs";
+} from "./chunk-DCHKGFML.mjs";
 export {
   fetchApps,
   fetchAppsViaApiConfig,

package/dist/{chunk-IABSYB2J.mjs → chunk-DCHKGFML.mjs}

@@ -50,6 +50,30 @@ var keyFor = (input, init) => {
     return null;
   }
 };
+var withStoredApiKey = (input, init) => {
+  if (typeof window === "undefined") return init;
+  let urlStr;
+  if (typeof input === "string") urlStr = input;
+  else if (input instanceof URL) urlStr = input.toString();
+  else if (input && typeof input.url === "string") urlStr = input.url;
+  else return init;
+  try {
+    const url = new URL(urlStr, window.location.href);
+    const isKnownShuffleOrigin = allowedOrigins.has(url.origin) || url.origin === window.location.origin || url.hostname === "shuffler.io" || url.hostname.endsWith(".shuffler.io") || url.hostname === "tunnel.schemaless.org";
+    if (!url.pathname.startsWith("/api/") || !isKnownShuffleOrigin) return init;
+    const apiKey = window.localStorage.getItem("shuffle_api_key");
+    if (!apiKey) return init;
+    const requestHeaders = typeof Request !== "undefined" && input instanceof Request ? input.headers : void 0;
+    const headers = new Headers(requestHeaders);
+    if (init?.headers) {
+      new Headers(init.headers).forEach((value, name) => headers.set(name, value));
+    }
+    if (!headers.has("Authorization")) headers.set("Authorization", `Bearer ${apiKey}`);
+    return { ...init, headers };
+  } catch {
+    return init;
+  }
+};
 var synthetic503 = (key, retryInMs) => new Response(
   JSON.stringify({
     error: "circuit_breaker_open",
@@ -75,8 +99,9 @@ var installFetchBreaker = () => {
   installed = true;
   const original = window.fetch.bind(window);
   window.fetch = (async (input, init) => {
-    const key = keyFor(input, init);
-    if (!key) return original(input, init);
+    const authenticatedInit = withStoredApiKey(input, init);
+    const key = keyFor(input, authenticatedInit);
+    if (!key) return original(input, authenticatedInit);
     const entry = getEntry(key);
     const now = Date.now();
     let isProbe = false;
@@ -110,7 +135,7 @@ var installFetchBreaker = () => {
     };
     let response;
     try {
-      response = await original(input, init);
+      response = await original(input, authenticatedInit);
     } catch (err) {
       const ts = Date.now();
       entry.failures.push(ts);
@@ -150,11 +175,65 @@ var installFetchBreaker = () => {
   });
 };
 
+// ../lib/platform.ts
+var getPlatform = () => {
+  if (typeof window === "undefined") return "web";
+  const cap = window.Capacitor;
+  if (cap?.isNativePlatform && cap.isNativePlatform()) {
+    const platform = typeof cap.getPlatform === "function" ? cap.getPlatform() : "";
+    if (platform === "ios") return "ios";
+    if (platform === "android") return "android";
+  }
+  const ua = window.navigator?.userAgent || "";
+  if (/iPad|iPhone|iPod/.test(ua) || navigator.platform === "MacIntel" && navigator.maxTouchPoints > 1) {
+    return "ios";
+  }
+  if (/android/i.test(ua)) {
+    return "android";
+  }
+  return "web";
+};
+var isCapacitorNative = () => {
+  if (typeof window === "undefined") return false;
+  const cap = window.Capacitor;
+  return Boolean(cap?.isNativePlatform && cap.isNativePlatform());
+};
+var isIosWebView = () => {
+  if (typeof window === "undefined") return false;
+  const cap = window.Capacitor;
+  if (cap?.isNativePlatform && cap.isNativePlatform()) {
+    return typeof cap.getPlatform === "function" ? cap.getPlatform() === "ios" : true;
+  }
+  const ua = window.navigator?.userAgent || "";
+  const isIosDevice = /iPad|iPhone|iPod/.test(ua) || navigator.platform === "MacIntel" && navigator.maxTouchPoints > 1;
+  const isStandalonePwa = window.navigator.standalone === true || typeof window.matchMedia === "function" && window.matchMedia("(display-mode: standalone)").matches;
+  const isEmbeddedWebview = /(iPhone|iPod|iPad).*AppleWebKit(?!.*Safari)/i.test(ua);
+  return isIosDevice && (isStandalonePwa || isEmbeddedWebview);
+};
+var isAndroidWebView = () => {
+  if (typeof window === "undefined") return false;
+  const cap = window.Capacitor;
+  if (cap?.isNativePlatform && cap.isNativePlatform()) {
+    return typeof cap.getPlatform === "function" ? cap.getPlatform() === "android" : false;
+  }
+  const ua = window.navigator?.userAgent || "";
+  const isAndroidDevice = /android/i.test(ua);
+  const isStandalone = typeof window.matchMedia === "function" && window.matchMedia("(display-mode: standalone)").matches;
+  const isWebview = /;\s*wv|Version\/[\d.]+/i.test(ua) && isAndroidDevice;
+  return isAndroidDevice && (isStandalone || isWebview);
+};
+if (typeof window !== "undefined") {
+  window.isCapacitorNative = isCapacitorNative;
+  window.isIosWebView = isIosWebView;
+  window.isAndroidWebView = isAndroidWebView;
+  window.getPlatform = getPlatform;
+}
+
 // api.ts
 installFetchBreaker();
 var DEV_BACKEND = "https://tunnel.schemaless.org";
 var PROD_BACKEND = "https://shuffler.io";
-var CLOUD_DOMAINS = ["security.shuffler.io", "shutdown.no"];
+var CLOUD_DOMAINS = ["shuffle.security", "www.shuffle.security", "security.shuffler.io", "shutdown.no", "www.shutdown.no"];
 var getEnvVar = (key) => {
   try {
     const meta = new Function("try { return import.meta } catch { return undefined }")();
@@ -169,6 +248,7 @@ var isDevEnvironment = () => {
   return hostname.includes("lovableproject.com") || hostname.includes("id-preview--") || hostname.endsWith(".lovable.app") || hostname.endsWith(".lovable.dev");
 };
 var isCloudDomain = () => {
+  if (isCapacitorNative()) return true;
   const hostname = typeof window !== "undefined" ? window.location.hostname : "";
   return CLOUD_DOMAINS.includes(hostname);
 };
@@ -180,6 +260,7 @@ var getDefaultBaseUrl = () => {
     return envUrl;
   }
   if (isDevEnvironment()) return DEV_BACKEND;
+  if (isCapacitorNative()) return PROD_BACKEND;
   if (isCloudDomain()) return PROD_BACKEND;
   if (typeof window !== "undefined") {
     return window.location.origin;
@@ -200,8 +281,17 @@ var readCachedRegion = () => {
 };
 var cached = readCachedRegion();
 var _regionUrl = cached.url;
+var readCachedCustomHost = () => {
+  if (typeof window === "undefined") return null;
+  try {
+    const raw = localStorage.getItem("shuffle_custom_host_url");
+    return raw ? raw.trim().replace(/\/+$/, "") : null;
+  } catch {
+    return null;
+  }
+};
 var _trackedOrgId = cached.orgId;
-var _hostBaseUrl = null;
+var _hostBaseUrl = readCachedCustomHost();
 var REGION_EVENT = "shuffle:region-url";
 var _lastBroadcastUrl = cached.url;
 var persistRegion = (url, orgId) => {
@@ -350,6 +440,14 @@ var getAuthHeader = (overrideOrgId) => {
   }
   return headers;
 };
+var hasShuffleAuth = () => {
+  try {
+    if (API_CONFIG.apiKey) return true;
+    return !!(localStorage.getItem("session_token") || localStorage.getItem("shuffle_user_info"));
+  } catch {
+    return false;
+  }
+};
 
 // appsCache.ts
 var TTL_MS = 3e4;
@@ -406,6 +504,7 @@ var fetchAppsViaApiConfig = () => {
 export {
   registerProtectedOrigin,
   installFetchBreaker,
+  isCapacitorNative,
   isCloudDomain,
   isCloud,
   isOnprem,
@@ -419,6 +518,7 @@ export {
   getApiUrl,
   shuffleFetch,
   getAuthHeader,
+  hasShuffleAuth,
   fetchApps,
   invalidateAppsCache,
   fetchAppsViaApiConfig

package/dist/index.d.mts

@@ -359,6 +359,11 @@ interface AgentPreset {
         id?: string;
         icon?: string;
     }>;
+    /**
+     * Tools this skill cannot run without. They are always selected and cannot
+     * be removed from the Tools chip row while the skill is active.
+     */
+    requiredApps?: string[];
 }
 declare const AGENT_PRESETS: AgentPreset[];
 interface AgentPresetsProps {
@@ -374,8 +379,10 @@ interface AgentPresetsProps {
     presets?: AgentPreset[];
     /** Ref forwarded to the trigger button so the host can measure its width. */
     chipRef?: React.Ref<HTMLButtonElement>;
+    /** Authoritative support flag from the host's getinfo payload. */
+    isSupport?: boolean;
 }
-declare const AgentPresets: ({ variant, onSelectPreset, selectedPreset, onRemoveSelected, presets, chipRef }: AgentPresetsProps) => React$1.JSX.Element;
+declare const AgentPresets: ({ variant, onSelectPreset, selectedPreset, onRemoveSelected, presets, chipRef, isSupport }: AgentPresetsProps) => React$1.JSX.Element;
 
 /**
  * AgentUI — Standalone "start + debug agents" surface.
@@ -416,6 +423,20 @@ interface AgentUIProps {
      * token to be set on `API_CONFIG`).
      */
     autoLoadApps?: boolean;
+    /** Authoritative support flag from `/api/v1/getinfo`. */
+    isSupport?: boolean;
+    /**
+     * Optional per-skill readiness CTAs. Keyed by skill (preset) id. When the
+     * matching skill is selected and the host reports it has no real content
+     * yet, AgentUI renders a small call-to-action under the prompt.
+     */
+    presetCtas?: Record<string, {
+        /** When false, nothing is rendered (content exists / still loading). */
+        show?: boolean;
+        message: string;
+        actionLabel: string;
+        onAction?: () => void;
+    }>;
     /** Hero title above the prompt. */
     title?: string;
     /** Optional subtitle/description shown under the title. */
@@ -773,6 +794,8 @@ interface AgentActivityResponse {
 interface AgentActivityParams {
     cursor?: string;
     limit?: number;
+    /** Optional page size sent as the `?top` query parameter. */
+    top?: number;
     status?: string;
     startTime?: string;
     endTime?: string;
@@ -854,6 +877,8 @@ interface AgentActivityListProps extends ShuffleHostProps {
     showStatusChips?: boolean;
     /** Page size. Default: 50. */
     limit?: number;
+    /** Optional page size sent as the `?top` query parameter. */
+    top?: number;
     /** Empty-state heading. */
     emptyTitle?: string;
     /** Empty-state subtitle. */
@@ -940,6 +965,8 @@ interface AgentsViewProps extends ShuffleHostProps {
     appsStorageKey?: string;
     /** Usecase-backed agent types shown in the activity list filter dropdown. */
     usecaseFilters?: AgentUsecaseFilter[];
+    /** Per-skill readiness CTAs forwarded to the embedded AgentUI. */
+    presetCtas?: AgentUIProps['presetCtas'];
 }
 
 interface AgentLocalModel {
@@ -1495,6 +1522,8 @@ declare const DATASTORE_CATEGORIES: {
     readonly INCIDENTS: "shuffle-security_incidents";
     readonly VULNERABILITIES: "shuffle-security_vulnerabilities";
     readonly ASSETS: "shuffle-security_assets";
+    readonly PACKAGES: "shuffle-security_packages";
+    readonly SOFTWARE: "shuffle-security_software";
     readonly TEMPLATES: "shuffle-security_templates";
     readonly CONFIGURATION: "shuffle-security_configuration";
     readonly IOCS: "shuffle-security_ioc-config";

package/dist/index.d.ts

@@ -359,6 +359,11 @@ interface AgentPreset {
         id?: string;
         icon?: string;
     }>;
+    /**
+     * Tools this skill cannot run without. They are always selected and cannot
+     * be removed from the Tools chip row while the skill is active.
+     */
+    requiredApps?: string[];
 }
 declare const AGENT_PRESETS: AgentPreset[];
 interface AgentPresetsProps {
@@ -374,8 +379,10 @@ interface AgentPresetsProps {
     presets?: AgentPreset[];
     /** Ref forwarded to the trigger button so the host can measure its width. */
     chipRef?: React.Ref<HTMLButtonElement>;
+    /** Authoritative support flag from the host's getinfo payload. */
+    isSupport?: boolean;
 }
-declare const AgentPresets: ({ variant, onSelectPreset, selectedPreset, onRemoveSelected, presets, chipRef }: AgentPresetsProps) => React$1.JSX.Element;
+declare const AgentPresets: ({ variant, onSelectPreset, selectedPreset, onRemoveSelected, presets, chipRef, isSupport }: AgentPresetsProps) => React$1.JSX.Element;
 
 /**
  * AgentUI — Standalone "start + debug agents" surface.
@@ -416,6 +423,20 @@ interface AgentUIProps {
      * token to be set on `API_CONFIG`).
      */
     autoLoadApps?: boolean;
+    /** Authoritative support flag from `/api/v1/getinfo`. */
+    isSupport?: boolean;
+    /**
+     * Optional per-skill readiness CTAs. Keyed by skill (preset) id. When the
+     * matching skill is selected and the host reports it has no real content
+     * yet, AgentUI renders a small call-to-action under the prompt.
+     */
+    presetCtas?: Record<string, {
+        /** When false, nothing is rendered (content exists / still loading). */
+        show?: boolean;
+        message: string;
+        actionLabel: string;
+        onAction?: () => void;
+    }>;
     /** Hero title above the prompt. */
     title?: string;
     /** Optional subtitle/description shown under the title. */
@@ -773,6 +794,8 @@ interface AgentActivityResponse {
 interface AgentActivityParams {
     cursor?: string;
     limit?: number;
+    /** Optional page size sent as the `?top` query parameter. */
+    top?: number;
     status?: string;
     startTime?: string;
     endTime?: string;
@@ -854,6 +877,8 @@ interface AgentActivityListProps extends ShuffleHostProps {
     showStatusChips?: boolean;
     /** Page size. Default: 50. */
     limit?: number;
+    /** Optional page size sent as the `?top` query parameter. */
+    top?: number;
     /** Empty-state heading. */
     emptyTitle?: string;
     /** Empty-state subtitle. */
@@ -940,6 +965,8 @@ interface AgentsViewProps extends ShuffleHostProps {
     appsStorageKey?: string;
     /** Usecase-backed agent types shown in the activity list filter dropdown. */
     usecaseFilters?: AgentUsecaseFilter[];
+    /** Per-skill readiness CTAs forwarded to the embedded AgentUI. */
+    presetCtas?: AgentUIProps['presetCtas'];
 }
 
 interface AgentLocalModel {
@@ -1495,6 +1522,8 @@ declare const DATASTORE_CATEGORIES: {
     readonly INCIDENTS: "shuffle-security_incidents";
     readonly VULNERABILITIES: "shuffle-security_vulnerabilities";
     readonly ASSETS: "shuffle-security_assets";
+    readonly PACKAGES: "shuffle-security_packages";
+    readonly SOFTWARE: "shuffle-security_software";
     readonly TEMPLATES: "shuffle-security_templates";
     readonly CONFIGURATION: "shuffle-security_configuration";
     readonly IOCS: "shuffle-security_ioc-config";