@sodiumhq/mcp-pm 0.1.0-beta.4579 → 0.1.0-beta.4707

package/dist/http.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as buildServer } from "./src-dwGvEajk.mjs";
+import { t as buildServer } from "./src-DNCbW1Ge.mjs";
 import { createRequire } from "node:module";
 import { createHash, randomUUID } from "node:crypto";
 import { createServer } from "node:http";

package/dist/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as buildServer } from "./src-dwGvEajk.mjs";
+import { t as buildServer } from "./src-DNCbW1Ge.mjs";
 import { createRequire } from "node:module";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { parseArgs } from "node:util";

package/dist/{src-dwGvEajk.mjs → src-DNCbW1Ge.mjs}

@@ -3577,7 +3577,7 @@ var SodiumApiClient = class {
 //#endregion
 //#region ../mcp-core/src/context/instructions.ts
 const ROSTER_CAP = 20;
-async function buildInstructions(api, writesEnabled, selection) {
+async function buildInstructions(api, ctx, selection) {
 	const [user, tenant, practice, team] = await Promise.allSettled([
 		api.getCurrentUser(),
 		api.getTenantDetails(),
@@ -3627,7 +3627,8 @@ async function buildInstructions(api, writesEnabled, selection) {
 		} else lines.push("Call list_practices to see the available practices.");
 	} else if (selection.kind === "none") lines.push("", "This user does not belong to any usable practice. Tell them their Sodium account has no active practice and there is nothing to show.");
 	else if (selection.kind === "auto") lines.push("", `Working in ${selection.practice.name} (${selection.practice.code}) — the only practice this user belongs to. It is selected automatically; no 'practice' argument is needed.`);
-	lines.push("", writesEnabled ? "Write mode: ENABLED. Create/update tools are available; destructive and bulk operations are not." : "Write mode: DISABLED. Read-only — tell the user to relaunch with --enable-writes if they want changes made.");
+	const isStdio = Boolean(ctx.apiKey) && !ctx.bearerToken;
+	lines.push("", ctx.writesEnabled ? "Write mode: ENABLED. Create and update tools are available; delete and bulk operations are not exposed." : isStdio ? "Write mode: DISABLED. Read-only — tell the user to restart the server with --enable-writes (or SODIUM_ENABLE_WRITES=true) if they want changes made." : "Write mode: DISABLED. Read-only — this connection was authorised for read access only. Tell the user to reconnect the Sodium connector and approve write access if they want changes made.");
 	if (team.status === "fulfilled") {
 		const members = team.value.data ?? [];
 		const total = team.value.totalCount ?? members.length;
@@ -7073,8 +7074,9 @@ function formatThread(t) {
 	const from = t.latestFromName ?? t.latestFromEmail ?? "?";
 	const counts = `${t.messageCount ?? 0} message${t.messageCount === 1 ? "" : "s"}${t.unreadCount ? `, ${t.unreadCount} unread` : ""}`;
 	const attach = t.hasAttachments ? " · has attachments" : "";
+	const ids = `\n  configCode: ${t.configCode ?? "?"} · conversationId: ${t.conversationId ?? "?"}`;
 	const snippet = t.snippet ? `\n  ${t.snippet.length > 160 ? `${t.snippet.slice(0, 160)}…` : t.snippet}` : "";
-	return `- ${when} · "${t.subject ?? "(no subject)"}" · latest from ${from} · ${counts}${attach}${snippet}`;
+	return `- ${when} · "${t.subject ?? "(no subject)"}" · latest from ${from} · ${counts}${attach}${ids}${snippet}`;
 }
 async function handleListClientEmails(api, args) {
 	try {
@@ -7096,6 +7098,7 @@ async function handleListClientEmails(api, args) {
 			...items.map(formatThread)
 		];
 		if (result.hasMore) lines.push("", `More results available — call again with offset: ${(args.offset ?? 0) + items.length}.`);
+		lines.push("", "Use get_client_email_thread with a thread's configCode + conversationId to read the whole conversation.");
 		return { content: [{
 			type: "text",
 			text: lines.join("\n")
@@ -7111,6 +7114,12 @@ async function handleListClientEmails(api, args) {
 	}
 }
 //#endregion
+//#region ../mcp-core/src/tools/aml-common.ts
+function isAmlNotConfigured(error) {
+	return error instanceof SodiumApiError && error.statusCode === 400 && /aml connection/i.test(error.message);
+}
+const AML_NOT_CONFIGURED = "This practice has no AML provider connected in Sodium, so there are no AML/KYC records to show. Records appear here once an AML connection is set up in Sodium.";
+//#endregion
 //#region ../mcp-core/src/tools/list-aml-clients.ts
 const ListAmlClientsInputSchema = {
 	search: z.string().min(3, "Search must be at least 3 characters when provided").optional().describe("Search across AML client name, reference, or contact details. Minimum 3 characters. Use the PM client's name to find its AML record."),
@@ -7156,6 +7165,10 @@ async function handleListAmlClients(api, args) {
 			text: lines.join("\n")
 		}] };
 	} catch (error) {
+		if (isAmlNotConfigured(error)) return { content: [{
+			type: "text",
+			text: AML_NOT_CONFIGURED
+		}] };
 		return {
 			content: [{
 				type: "text",
@@ -7214,6 +7227,10 @@ async function handleGetAmlClient(api, args) {
 			text: lines.join("\n")
 		}] };
 	} catch (error) {
+		if (isAmlNotConfigured(error)) return { content: [{
+			type: "text",
+			text: AML_NOT_CONFIGURED
+		}] };
 		return {
 			content: [{
 				type: "text",
@@ -7444,13 +7461,14 @@ async function handleGetClientAgentAuthorisations(api, args) {
 			type: "text",
 			text: `No agent authorisation records for client ${args.clientCode}. (Authorisations appear once the client has services that require them.)`
 		}] };
-		const missing = auths.filter((a) => a.isRequired && a.status !== "Granted");
+		const required = auths.filter((a) => a.isRequired);
+		const missing = required.filter((a) => a.status !== "Granted");
 		const lines = [
 			`HMRC agent authorisations for ${args.clientCode}:`,
 			"",
 			...auths.map(formatAuth)
 		];
-		lines.push("", missing.length === 0 ? "All required authorisations are granted." : `⚠ ${missing.length} required authorisation${missing.length === 1 ? " is" : "s are"} not yet granted: ${missing.map((a) => a.authorisationType).join(", ")}. Requesting them is done from the client's page in Sodium.`);
+		lines.push("", required.length === 0 ? "None of this client's current services require an HMRC agent authorisation." : missing.length === 0 ? "All required authorisations are granted." : `⚠ ${missing.length} required authorisation${missing.length === 1 ? " is" : "s are"} not yet granted: ${missing.map((a) => a.authorisationType).join(", ")}. Requesting them is done from the client's page in Sodium.`);
 		return { content: [{
 			type: "text",
 			text: lines.join("\n")
@@ -8285,7 +8303,8 @@ async function handleGetOnboardingStatus(api, args) {
 				}
 				lines.push("(Name-matched — verify it's the right AML record.)");
 			}
-		} else if (aml.status === "rejected") failures.push("AML");
+		} else if (aml.status === "rejected") if (isAmlNotConfigured(aml.reason)) lines.push(AML_NOT_CONFIGURED);
+		else failures.push("AML");
 		else lines.push("(Client name too short to search the AML register.)");
 		lines.push("", "## HMRC agent authorisations");
 		if (auths.status === "fulfilled") {
@@ -8906,7 +8925,7 @@ async function buildServer(config) {
 	let instructions;
 	if (config.includeStartupContext !== false) {
 		const selection = api.hasActiveTenant() ? { kind: "explicit" } : await resolveTenant(api);
-		instructions = await buildInstructions(api, config.context.writesEnabled, selection);
+		instructions = await buildInstructions(api, config.context, selection);
 	}
 	const server = new McpServer({
 		name: config.serverName,
@@ -9420,7 +9439,7 @@ async function buildServer(config) {
 		inputSchema: UpdateClientServiceStageInputSchema,
 		annotations: {
 			readOnlyHint: false,
-			destructiveHint: false,
+			destructiveHint: true,
 			idempotentHint: true,
 			openWorldHint: true
 		}
@@ -9442,7 +9461,7 @@ async function buildServer(config) {
 		inputSchema: SendDataFormInputSchema,
 		annotations: {
 			readOnlyHint: false,
-			destructiveHint: false,
+			destructiveHint: true,
 			idempotentHint: false,
 			openWorldHint: true
 		}
@@ -9464,7 +9483,7 @@ async function buildServer(config) {
 		inputSchema: UpdateClientDatesInputSchema,
 		annotations: {
 			readOnlyHint: false,
-			destructiveHint: false,
+			destructiveHint: true,
 			idempotentHint: true,
 			openWorldHint: true
 		}
@@ -9475,7 +9494,7 @@ async function buildServer(config) {
 		inputSchema: UpdateClientBusinessDetailsInputSchema,
 		annotations: {
 			readOnlyHint: false,
-			destructiveHint: false,
+			destructiveHint: true,
 			idempotentHint: true,
 			openWorldHint: true
 		}
@@ -9497,7 +9516,7 @@ async function buildServer(config) {
 		inputSchema: UpdateWorkflowStepInputSchema,
 		annotations: {
 			readOnlyHint: false,
-			destructiveHint: false,
+			destructiveHint: true,
 			idempotentHint: true,
 			openWorldHint: true
 		}
@@ -9519,7 +9538,7 @@ async function buildServer(config) {
 		inputSchema: UpdateTaskInputSchema,
 		annotations: {
 			readOnlyHint: false,
-			destructiveHint: false,
+			destructiveHint: true,
 			idempotentHint: true,
 			openWorldHint: true
 		}
@@ -9574,7 +9593,7 @@ async function buildServer(config) {
 		inputSchema: SetClientCustomFieldsInputSchema,
 		annotations: {
 			readOnlyHint: false,
-			destructiveHint: false,
+			destructiveHint: true,
 			idempotentHint: true,
 			openWorldHint: true
 		}
@@ -9585,7 +9604,7 @@ async function buildServer(config) {
 		inputSchema: UpdateContactInputSchema,
 		annotations: {
 			readOnlyHint: false,
-			destructiveHint: false,
+			destructiveHint: true,
 			idempotentHint: true,
 			openWorldHint: true
 		}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sodiumhq/mcp-pm",
-  "version": "0.1.0-beta.4579",
+  "version": "0.1.0-beta.4707",
   "description": "Sodium Practice Management MCP server — lets AI assistants interact with your Sodium tenant",
   "type": "module",
   "bin": {