@smartytalent/mcp-tools 0.6.1 → 0.7.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/tools.json +146 -0
- package/package.json +1 -1
package/dist/tools.json
CHANGED
|
@@ -219,6 +219,7 @@
|
|
|
219
219
|
"method": {
|
|
220
220
|
"type": "string",
|
|
221
221
|
"enum": [
|
|
222
|
+
"ops-confirmed",
|
|
222
223
|
"dns-txt",
|
|
223
224
|
"entra-verified"
|
|
224
225
|
]
|
|
@@ -678,6 +679,7 @@
|
|
|
678
679
|
"method": {
|
|
679
680
|
"type": "string",
|
|
680
681
|
"enum": [
|
|
682
|
+
"ops-confirmed",
|
|
681
683
|
"dns-txt",
|
|
682
684
|
"entra-verified"
|
|
683
685
|
]
|
|
@@ -1221,6 +1223,150 @@
|
|
|
1221
1223
|
"operationId": "tenantPhoneNumbersUnassignOptions"
|
|
1222
1224
|
}
|
|
1223
1225
|
},
|
|
1226
|
+
{
|
|
1227
|
+
"name": "show_tenant_sso",
|
|
1228
|
+
"description": "Show Tenant Enterprise SSO",
|
|
1229
|
+
"inputSchema": {
|
|
1230
|
+
"type": "object",
|
|
1231
|
+
"properties": {}
|
|
1232
|
+
},
|
|
1233
|
+
"_meta": {
|
|
1234
|
+
"method": "GET",
|
|
1235
|
+
"path": "/v1/tenants/{tenantId}/sso",
|
|
1236
|
+
"operationId": "showTenantSso"
|
|
1237
|
+
}
|
|
1238
|
+
},
|
|
1239
|
+
{
|
|
1240
|
+
"name": "configure_tenant_sso",
|
|
1241
|
+
"description": "Configure Tenant Enterprise SSO",
|
|
1242
|
+
"inputSchema": {
|
|
1243
|
+
"type": "object",
|
|
1244
|
+
"properties": {
|
|
1245
|
+
"data": {
|
|
1246
|
+
"type": "object",
|
|
1247
|
+
"properties": {
|
|
1248
|
+
"type": {
|
|
1249
|
+
"type": "string",
|
|
1250
|
+
"enum": [
|
|
1251
|
+
"tenant-sso"
|
|
1252
|
+
]
|
|
1253
|
+
},
|
|
1254
|
+
"attributes": {
|
|
1255
|
+
"title": "TenantSsoAttributesSchema",
|
|
1256
|
+
"type": "object",
|
|
1257
|
+
"description": "Enterprise SSO configuration for one tenant. Written only by the /v1/tenants/{tenantId}/sso doors (sysowner); the generic tenant PATCH strips settings.sso.",
|
|
1258
|
+
"properties": {
|
|
1259
|
+
"provider": {
|
|
1260
|
+
"type": "string",
|
|
1261
|
+
"enum": [
|
|
1262
|
+
"microsoft"
|
|
1263
|
+
],
|
|
1264
|
+
"description": "Identity provider family behind the tenant's IdP"
|
|
1265
|
+
},
|
|
1266
|
+
"entraTenantId": {
|
|
1267
|
+
"type": "string",
|
|
1268
|
+
"description": "GUID of the customer's Entra tenant. One Cognito IdP serves exactly one Entra tenant: Cognito compares the token iss to a single configured issuer and Entra mints iss per tenant, so a multi-tenant issuer can never match. NOTE: CreateIdentityProvider accepts a /common issuer without error and only sign-in fails, which is why 'common' is rejected here."
|
|
1269
|
+
},
|
|
1270
|
+
"idpName": {
|
|
1271
|
+
"type": "string",
|
|
1272
|
+
"description": "Derived server-side as ms-{shortCode} and ignored if sent. The name carries the tenant, which is how the auth triggers resolve it without scanning; it must fit Cognito's 32-character IdP name limit."
|
|
1273
|
+
},
|
|
1274
|
+
"domains": {
|
|
1275
|
+
"type": "array",
|
|
1276
|
+
"description": "Email domains of the customer. A domain gates JIT and auto-link ONLY once it carries verifiedAt - uniqueness in the claim registry is not proof of ownership. Public mail providers (gmail.com and friends) are rejected: a shared domain can never prove its holder employs the person signing in.",
|
|
1277
|
+
"items": {
|
|
1278
|
+
"type": "object",
|
|
1279
|
+
"properties": {
|
|
1280
|
+
"name": {
|
|
1281
|
+
"type": "string"
|
|
1282
|
+
},
|
|
1283
|
+
"verifiedAt": {
|
|
1284
|
+
"type": "string"
|
|
1285
|
+
},
|
|
1286
|
+
"method": {
|
|
1287
|
+
"type": "string",
|
|
1288
|
+
"enum": [
|
|
1289
|
+
"ops-confirmed",
|
|
1290
|
+
"dns-txt",
|
|
1291
|
+
"entra-verified"
|
|
1292
|
+
]
|
|
1293
|
+
}
|
|
1294
|
+
}
|
|
1295
|
+
}
|
|
1296
|
+
},
|
|
1297
|
+
"defaultRole": {
|
|
1298
|
+
"type": "string",
|
|
1299
|
+
"description": "Role granted when a pending JIT user is APPROVED - never granted by the act of signing in. Domain-gated JIT makes the whole customer workforce eligible, so an automatic operational role would expose candidate data to anyone who can authenticate at the customer's IdP. Privileged roles (owner/admin/sysowner) are rejected."
|
|
1300
|
+
},
|
|
1301
|
+
"required": {
|
|
1302
|
+
"type": "boolean",
|
|
1303
|
+
"description": "When true, password login is refused for this tenant's users. Owner and sysowner are always exempt - a break-glass account, because an outage in the customer's Entra must not lock them out of the product."
|
|
1304
|
+
},
|
|
1305
|
+
"autoApprove": {
|
|
1306
|
+
"type": "boolean",
|
|
1307
|
+
"description": "When true, a JIT user is activated immediately with defaultRole instead of landing in a pending state. Off by default."
|
|
1308
|
+
},
|
|
1309
|
+
"enabled": {
|
|
1310
|
+
"type": "boolean",
|
|
1311
|
+
"description": "Whether a Cognito identity provider exists for this tenant. Owned by the provisioning step and ignored if sent."
|
|
1312
|
+
},
|
|
1313
|
+
"adminConsentUrl": {
|
|
1314
|
+
"type": "string",
|
|
1315
|
+
"description": "The admin-consent link an operator sends to the customer's IT. Built server-side so the app registration id is never hardcoded in a client. Absent if the platform Microsoft provider cannot be read."
|
|
1316
|
+
},
|
|
1317
|
+
"idpDeleted": {
|
|
1318
|
+
"type": "boolean",
|
|
1319
|
+
"description": "DELETE response only: whether the customer's Cognito identity provider was actually removed. False when it was already gone, so a retry of the teardown reads as success rather than an error."
|
|
1320
|
+
},
|
|
1321
|
+
"domainsReleased": {
|
|
1322
|
+
"type": "array",
|
|
1323
|
+
"description": "DELETE response only: the domains freed in the global claim registry, i.e. the ones another tenant may now claim. Empty when the tenant held none or another tenant owned them.",
|
|
1324
|
+
"items": {
|
|
1325
|
+
"type": "string"
|
|
1326
|
+
}
|
|
1327
|
+
},
|
|
1328
|
+
"loginUrl": {
|
|
1329
|
+
"type": "string",
|
|
1330
|
+
"description": "Ready-made login link for this customer's employees (a tile in their Entra My Apps, an intranet bookmark, the welcome email). Carries identity_provider so Cognito goes straight to their Entra. There is deliberately no email-domain discovery endpoint: Cognito's own domain routing is SAML-only, and a public discovery endpoint would be an oracle for whether a given company is our customer. Lands in the myaccount app, which every role can reach - a JIT employee in the pending state has no role yet, so a role-scoped app would refuse them and the link would look broken. Derived on read, never stored. Absent if the enterprise app client cannot be read."
|
|
1331
|
+
}
|
|
1332
|
+
}
|
|
1333
|
+
}
|
|
1334
|
+
}
|
|
1335
|
+
}
|
|
1336
|
+
}
|
|
1337
|
+
},
|
|
1338
|
+
"_meta": {
|
|
1339
|
+
"method": "POST",
|
|
1340
|
+
"path": "/v1/tenants/{tenantId}/sso",
|
|
1341
|
+
"operationId": "configureTenantSso"
|
|
1342
|
+
}
|
|
1343
|
+
},
|
|
1344
|
+
{
|
|
1345
|
+
"name": "delete_tenant_sso",
|
|
1346
|
+
"description": "Delete Tenant Enterprise SSO",
|
|
1347
|
+
"inputSchema": {
|
|
1348
|
+
"type": "object",
|
|
1349
|
+
"properties": {}
|
|
1350
|
+
},
|
|
1351
|
+
"_meta": {
|
|
1352
|
+
"method": "DELETE",
|
|
1353
|
+
"path": "/v1/tenants/{tenantId}/sso",
|
|
1354
|
+
"operationId": "deleteTenantSso"
|
|
1355
|
+
}
|
|
1356
|
+
},
|
|
1357
|
+
{
|
|
1358
|
+
"name": "tenant_sso_options",
|
|
1359
|
+
"description": "Tenant SSO Options",
|
|
1360
|
+
"inputSchema": {
|
|
1361
|
+
"type": "object",
|
|
1362
|
+
"properties": {}
|
|
1363
|
+
},
|
|
1364
|
+
"_meta": {
|
|
1365
|
+
"method": "OPTIONS",
|
|
1366
|
+
"path": "/v1/tenants/{tenantId}/sso",
|
|
1367
|
+
"operationId": "tenantSsoOptions"
|
|
1368
|
+
}
|
|
1369
|
+
},
|
|
1224
1370
|
{
|
|
1225
1371
|
"name": "purchase_tenant_phone_number",
|
|
1226
1372
|
"description": "Purchase Phone Number",
|