@soat/sdk 0.14.11 → 0.14.12

package/dist/index.d.cts

@@ -1713,6 +1713,10 @@ type ToolResourceProperties = {
    * Allowlist of actions the tool exposes. For `soat` tools: SOAT platform action names. For `mcp` tools: an optional allowlist of MCP tool names to scope the server surface (`null` exposes every tool).
    */
   actions?: Array<string> | null;
+  /**
+   * For `mcp` tools: an optional denylist of MCP tool names to hide. Applied after `actions` and taking precedence over it — the ergonomic way to scope a read+write MCP server read-only by denying just the write tools. `null` denies nothing.
+   */
+  denied_actions?: Array<string> | null;
   /**
    * Pre-filled parameter values injected at execution time
    */
@@ -3250,6 +3254,10 @@ type Tool = {
    * Allowlist of actions to expose. For `soat` tools: SOAT platform action names (required). For `mcp` tools: an optional allowlist of MCP tool names — when set, only those tools are exposed to the model and callable via `/call`; when `null`, the entire MCP server surface is exposed. Ignored for other tool types.
    */
   actions?: Array<string> | null;
+  /**
+   * For `mcp` tools: an optional denylist of MCP tool names to hide. Applied after `actions` and taking precedence over it — a name in both lists is denied. This is the ergonomic way to scope a read+write MCP server read-only: deny just the write tools instead of enumerating every read tool in `actions`. Names not listed are exposed. `null` (default) denies nothing. Ignored for other tool types.
+   */
+  denied_actions?: Array<string> | null;
   /**
    * Fixed parameters merged into every soat tool call. Keys matching fields in the action's input schema are removed from the schema shown to the model and injected automatically at execution time.
    */
@@ -3315,6 +3323,10 @@ type CreateToolRequest = {
    * Allowlist of actions. For `soat` tools: SOAT platform action names (required). For `mcp` tools: an optional allowlist of MCP tool names to scope the server surface — omit or set `null` to expose every tool the MCP server offers. Ignored for other tool types.
    */
   actions?: Array<string>;
+  /**
+   * For `mcp` tools: an optional denylist of MCP tool names to hide. Applied after `actions` and taking precedence over it. Use it to scope a read+write MCP server read-only by denying just the write tools. Omit or set `null` to deny nothing. Ignored for other tool types.
+   */
+  denied_actions?: Array<string>;
   /**
    * Fixed parameters merged into every soat tool call. Keys matching fields in the action's input schema are removed from the schema shown to the model and injected automatically at execution time.
    */
@@ -3359,6 +3371,10 @@ type UpdateToolRequest = {
    * Allowlist of actions. For `soat` tools: SOAT platform action names. For `mcp` tools: an optional allowlist of MCP tool names to scope the server surface (`null` exposes every tool). Ignored for other tool types.
    */
   actions?: Array<string> | null;
+  /**
+   * For `mcp` tools: an optional denylist of MCP tool names to hide. Applied after `actions` and taking precedence over it. Use it to scope a read+write MCP server read-only by denying just the write tools. `null` denies nothing. Ignored for other tool types.
+   */
+  denied_actions?: Array<string> | null;
   /**
    * Fixed parameters merged into every soat tool call. Keys matching fields in the action's input schema are removed from the schema shown to the model and injected automatically at execution time.
    */
@@ -3384,7 +3400,7 @@ type UpdateToolRequest = {
 };
 type CallToolRequest = {
   /**
-   * For `soat` tools: the action name (must be in the tool's `actions` list). For `mcp` tools: the MCP tool name to invoke (must be in the tool's `actions` allowlist when one is set). Ignored for `http` tools.
+   * For `soat` tools: the action name (must be in the tool's `actions` list). For `mcp` tools: the MCP tool name to invoke (must be in the tool's `actions` allowlist when one is set, and must not be in its `denied_actions` denylist). Ignored for `http` tools.
    *
    */
   action?: string;

package/dist/index.d.mts

@@ -1713,6 +1713,10 @@ type ToolResourceProperties = {
    * Allowlist of actions the tool exposes. For `soat` tools: SOAT platform action names. For `mcp` tools: an optional allowlist of MCP tool names to scope the server surface (`null` exposes every tool).
    */
   actions?: Array<string> | null;
+  /**
+   * For `mcp` tools: an optional denylist of MCP tool names to hide. Applied after `actions` and taking precedence over it — the ergonomic way to scope a read+write MCP server read-only by denying just the write tools. `null` denies nothing.
+   */
+  denied_actions?: Array<string> | null;
   /**
    * Pre-filled parameter values injected at execution time
    */
@@ -3250,6 +3254,10 @@ type Tool = {
    * Allowlist of actions to expose. For `soat` tools: SOAT platform action names (required). For `mcp` tools: an optional allowlist of MCP tool names — when set, only those tools are exposed to the model and callable via `/call`; when `null`, the entire MCP server surface is exposed. Ignored for other tool types.
    */
   actions?: Array<string> | null;
+  /**
+   * For `mcp` tools: an optional denylist of MCP tool names to hide. Applied after `actions` and taking precedence over it — a name in both lists is denied. This is the ergonomic way to scope a read+write MCP server read-only: deny just the write tools instead of enumerating every read tool in `actions`. Names not listed are exposed. `null` (default) denies nothing. Ignored for other tool types.
+   */
+  denied_actions?: Array<string> | null;
   /**
    * Fixed parameters merged into every soat tool call. Keys matching fields in the action's input schema are removed from the schema shown to the model and injected automatically at execution time.
    */
@@ -3315,6 +3323,10 @@ type CreateToolRequest = {
    * Allowlist of actions. For `soat` tools: SOAT platform action names (required). For `mcp` tools: an optional allowlist of MCP tool names to scope the server surface — omit or set `null` to expose every tool the MCP server offers. Ignored for other tool types.
    */
   actions?: Array<string>;
+  /**
+   * For `mcp` tools: an optional denylist of MCP tool names to hide. Applied after `actions` and taking precedence over it. Use it to scope a read+write MCP server read-only by denying just the write tools. Omit or set `null` to deny nothing. Ignored for other tool types.
+   */
+  denied_actions?: Array<string>;
   /**
    * Fixed parameters merged into every soat tool call. Keys matching fields in the action's input schema are removed from the schema shown to the model and injected automatically at execution time.
    */
@@ -3359,6 +3371,10 @@ type UpdateToolRequest = {
    * Allowlist of actions. For `soat` tools: SOAT platform action names. For `mcp` tools: an optional allowlist of MCP tool names to scope the server surface (`null` exposes every tool). Ignored for other tool types.
    */
   actions?: Array<string> | null;
+  /**
+   * For `mcp` tools: an optional denylist of MCP tool names to hide. Applied after `actions` and taking precedence over it. Use it to scope a read+write MCP server read-only by denying just the write tools. `null` denies nothing. Ignored for other tool types.
+   */
+  denied_actions?: Array<string> | null;
   /**
    * Fixed parameters merged into every soat tool call. Keys matching fields in the action's input schema are removed from the schema shown to the model and injected automatically at execution time.
    */
@@ -3384,7 +3400,7 @@ type UpdateToolRequest = {
 };
 type CallToolRequest = {
   /**
-   * For `soat` tools: the action name (must be in the tool's `actions` list). For `mcp` tools: the MCP tool name to invoke (must be in the tool's `actions` allowlist when one is set). Ignored for `http` tools.
+   * For `soat` tools: the action name (must be in the tool's `actions` list). For `mcp` tools: the MCP tool name to invoke (must be in the tool's `actions` allowlist when one is set, and must not be in its `denied_actions` denylist). Ignored for `http` tools.
    *
    */
   action?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@soat/sdk",
-  "version": "0.14.11",
+  "version": "0.14.12",
   "description": "TypeScript SDK for the SOAT API",
   "type": "module",
   "main": "dist/index.mjs",