@sodiumhq/mcp-pm 0.1.0-beta.5113 → 0.1.0-beta.5115

package/dist/http.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { t as buildServer } from "./src-Bl4qYJBU.mjs";
+import { t as buildServer } from "./src-DBBUms70.mjs";
 import { createRequire } from "node:module";
+import { SUPPORTED_PROTOCOL_VERSIONS, createMcpHandler } from "@modelcontextprotocol/server";
 import { createHash, randomUUID } from "node:crypto";
 import { createServer } from "node:http";
-import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
-import { SUPPORTED_PROTOCOL_VERSIONS, isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
+import { toNodeHandler } from "@modelcontextprotocol/node";
 import { createRemoteJWKSet, decodeJwt, jwtVerify } from "jose";
 import { hostname } from "node:os";
 //#region src/obo.ts
@@ -247,17 +247,42 @@ const TELEMETRY_CONFIG = loadTelemetryConfig({
 	applicationVersion: VERSION
 });
 const TELEMETRY = TELEMETRY_CONFIG ? new TelemetryClient(TELEMETRY_CONFIG) : null;
+const INSTRUCTION_METHODS = new Set(["initialize", "server/discover"]);
+function requestState(ctx) {
+	const state = (ctx.authInfo?.extra)?.sodium;
+	if (!state) throw new Error("Request reached the MCP handler without authenticated state.");
+	return state;
+}
+const mcpHandler = createMcpHandler((ctx) => {
+	const state = requestState(ctx);
+	return buildServer({
+		context: {
+			bearerToken: state.apiToken,
+			tenant: state.tenant,
+			baseUrl: BASE_URL,
+			writesEnabled: state.writesAllowed
+		},
+		serverName: "Sodium Practice Management",
+		serverVersion: VERSION,
+		includeStartupContext: state.wantsInstructions,
+		onToolCall: state.onToolCall
+	});
+}, { onerror: (error) => {
+	console.error(`[sodium-pm-mcp-http] handler: ${error.message}`);
+} });
+const serveMcp = toNodeHandler(mcpHandler);
+function jsonRpcMethod(body) {
+	if (typeof body === "object" && body !== null && "method" in body) return String(body.method);
+}
 function describeRequest(body) {
 	if (Array.isArray(body)) return "POST batch";
-	if (typeof body === "object" && body !== null && "method" in body) {
-		const method = String(body.method);
-		if (method === "tools/call") {
-			const params = body.params;
-			return `POST tools/call ${typeof params?.name === "string" ? params.name : "?"}`;
-		}
-		return `POST ${method}`;
+	const method = jsonRpcMethod(body);
+	if (method === void 0) return "POST unknown";
+	if (method === "tools/call") {
+		const params = body.params;
+		return `POST tools/call ${typeof params?.name === "string" ? params.name : "?"}`;
 	}
-	return "POST unknown";
+	return `POST ${method}`;
 }
 function unsupportedProtocolVersion(req) {
 	const header = req.headers["mcp-protocol-version"];
@@ -318,38 +343,37 @@ async function handleMcpPost(req, res, body) {
 		const bearerToken = authHeader.slice(7).trim();
 		let writesAllowed = WRITES_ENABLED;
 		let apiToken = bearerToken;
+		let scopes = [];
 		if (AUTH) {
 			const verified = await verifyAccessToken(AUTH, bearerToken);
 			subject = verified.subject;
+			scopes = verified.scopes;
 			writesAllowed = WRITES_ENABLED && verified.scopes.includes(AUTH.scopes.write);
 			if (OBO) apiToken = await getDownstreamToken(OBO, bearerToken);
 		}
 		const tenantHeader = req.headers["x-sodium-tenant"];
 		const tenant = (Array.isArray(tenantHeader) ? tenantHeader[0] : tenantHeader) ?? process.env.SODIUM_TENANT;
-		const isInit = isInitializeRequest(body);
-		const server = await buildServer({
-			context: {
-				bearerToken: apiToken,
-				tenant,
-				baseUrl: BASE_URL,
-				writesEnabled: writesAllowed
-			},
-			serverName: "Sodium Practice Management",
-			serverVersion: VERSION,
-			includeStartupContext: isInit,
+		const method = jsonRpcMethod(body);
+		const state = {
+			apiToken,
+			tenant,
+			writesAllowed,
+			wantsInstructions: method !== void 0 && INSTRUCTION_METHODS.has(method),
 			onToolCall: (info) => {
 				toolCall = info;
 			}
-		});
-		const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: void 0 });
+		};
+		req.auth = {
+			token: apiToken,
+			clientId: subject ?? "local",
+			scopes,
+			extra: { sodium: state }
+		};
 		res.on("close", () => {
 			track(res.statusCode ?? 200);
-			transport.close();
-			server.close();
 		});
-		if (isInit) console.error(`[sodium-pm-mcp-http] initialize (tenant: ${tenant || "per-call"}, writes: ${writesAllowed})`);
-		await server.connect(transport);
-		await transport.handleRequest(req, res, body);
+		if (state.wantsInstructions) console.error(`[sodium-pm-mcp-http] ${method} (tenant: ${tenant || "per-call"}, writes: ${writesAllowed})`);
+		await serveMcp(req, res, body);
 	} catch (error) {
 		track(error instanceof HttpError || error instanceof AuthError ? error.status : 500, error instanceof Error ? error.message : String(error));
 		throw error;
@@ -385,7 +409,7 @@ async function handle(req, res) {
 	}
 	await handleMcpPost(req, res, await readJsonBody(req));
 }
-createServer((req, res) => {
+const httpServer = createServer((req, res) => {
 	handle(req, res).catch((error) => {
 		const message = error instanceof Error ? error.message : String(error);
 		console.error(`[sodium-pm-mcp-http] ${req.method} ${req.url} failed: ${message}`);
@@ -399,7 +423,12 @@ createServer((req, res) => {
 		if (AUTH && error instanceof HttpError && error.status === 401) res.setHeader("WWW-Authenticate", buildChallenge(AUTH));
 		sendJsonError(res, error instanceof HttpError ? error.status : 500, message);
 	});
-}).listen(PORT, HOST, () => {
+});
+process.on("SIGTERM", () => {
+	httpServer.close();
+	mcpHandler.close();
+});
+httpServer.listen(PORT, HOST, () => {
 	console.error(`[sodium-pm-mcp-http] v${VERSION} listening on http://${HOST}:${PORT}${ENDPOINT_PATH} (api: ${BASE_URL}, writes: ${WRITES_ENABLED ? "enabled" : "disabled"})`);
 });
 //#endregion

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { t as buildServer } from "./src-Bl4qYJBU.mjs";
+import { t as buildServer } from "./src-DBBUms70.mjs";
 import { createRequire } from "node:module";
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { serveStdio } from "@modelcontextprotocol/server/stdio";
 import { parseArgs } from "node:util";
 //#region src/config.ts
 function loadContext() {
@@ -32,21 +32,23 @@ function loadContext() {
 //#endregion
 //#region src/index.ts
 const VERSION = createRequire(import.meta.url)("../package.json").version;
-async function main() {
+function main() {
 	const context = loadContext();
-	const server = await buildServer({
+	serveStdio(() => buildServer({
 		context,
 		serverName: "Sodium Practice Management",
 		serverVersion: VERSION
-	});
-	const transport = new StdioServerTransport();
-	await server.connect(transport);
+	}), { onerror: (error) => {
+		console.error(`[sodium-pm-mcp] ${error.message}`);
+	} });
 	console.error(`[sodium-pm-mcp] v${VERSION} ready (tenant: ${context.tenant}, writes: ${context.writesEnabled ? "enabled" : "disabled"})`);
 }
-main().catch((error) => {
+try {
+	main();
+} catch (error) {
 	const message = error instanceof Error ? error.message : String(error);
 	console.error(`[sodium-pm-mcp] fatal: ${message}`);
 	process.exit(1);
-});
+}
 //#endregion
 export {};

package/dist/{src-Bl4qYJBU.mjs → src-DBBUms70.mjs}

@@ -1,4 +1,4 @@
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { McpServer } from "@modelcontextprotocol/server";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 //#region ../mcp-core/src/generated/core/bodySerializer.gen.ts
@@ -9200,6 +9200,13 @@ async function handleCreateSavedTaskFilter(api, args) {
 //#endregion
 //#region ../mcp-core/src/server.ts
 const practiceField = z.string().optional().describe("Practice code to run this call against, from list_practices. Needed only when the user belongs to more than one practice; omit when they have exactly one — it is selected automatically.");
+function captureClientInfo(server, api) {
+	const info = server.server.getClientVersion();
+	if (info?.name && info?.version) api.setMcpClientInfo({
+		name: info.name,
+		version: info.version
+	});
+}
 function registerTenantTool(server, api, name, config, cb) {
 	const inputSchema = {
 		...config.inputSchema ?? {},
@@ -9210,6 +9217,7 @@ function registerTenantTool(server, api, name, config, cb) {
 		inputSchema
 	}, async (args, extra) => {
 		const started = Date.now();
+		captureClientInfo(server, api);
 		const { practice, ...rest } = args;
 		const resolution = await resolveTenantForCall(api, typeof practice === "string" ? practice : void 0);
 		if (!resolution.ok) {
@@ -9276,13 +9284,7 @@ async function buildServer(config) {
 		instructions,
 		capabilities: { tools: {} }
 	});
-	server.server.oninitialized = () => {
-		const info = server.server.getClientVersion();
-		if (info?.name && info?.version) api.setMcpClientInfo({
-			name: info.name,
-			version: info.version
-		});
-	};
+	server.server.oninitialized = () => captureClientInfo(server, api);
 	registerTenantTool(server, api, "get_practice_details", {
 		title: "Get practice details",
 		description: "Get a consolidated overview of the practice including name, contact details, client/service/user counts, connections, and settings. Use this when the user asks about their practice, tenant, or wants a summary of their account.",
@@ -9303,6 +9305,7 @@ async function buildServer(config) {
 			openWorldHint: true
 		}
 	}, async (args) => {
+		captureClientInfo(server, api);
 		await resolveTenantForCall(api, args.practice);
 		return handleWhoami(api);
 	});
@@ -9315,7 +9318,10 @@ async function buildServer(config) {
 			idempotentHint: true,
 			openWorldHint: true
 		}
-	}, () => handleListPractices(api));
+	}, () => {
+		captureClientInfo(server, api);
+		return handleListPractices(api);
+	});
 	registerTenantTool(server, api, "list_clients", {
 		title: "List / search / filter clients",
 		description: "List clients with any combination of: search (code/name/internal reference, 3+ chars), status (Active/Inactive/Prospect/LostProspect), type (PrivateLimitedCompany/PublicLimitedCompany/LimitedLiabilityPartnership/Partnership/Individual/Trust/Charity/SoleTrader), manager/partner/associate user codes, service codes, a saved filter code, sort, and pagination. Use search for 'find ACME'-style queries. Use type for 'list limited companies' (pass PrivateLimitedCompany + PublicLimitedCompany). Use status: ['Active'] to exclude prospects/inactive. Returns up to 50 clients per page — paginate via offset for more. For 'how many X?' questions, pass limit=0 to get just the total count without fetching any client data. Follow up with get_client_summary for full detail on a specific client.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sodiumhq/mcp-pm",
-  "version": "0.1.0-beta.5113",
+  "version": "0.1.0-beta.5115",
   "description": "Sodium Practice Management MCP server — lets AI assistants interact with your Sodium tenant",
   "type": "module",
   "bin": {
@@ -44,9 +44,10 @@
     "prepublishOnly": "pnpm typecheck && pnpm build"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.26.0",
+    "@modelcontextprotocol/node": "2.0.0",
+    "@modelcontextprotocol/server": "2.0.0",
     "jose": "^6.2.3",
-    "zod": "^3.25.67"
+    "zod": "^4.4.3"
   },
   "devDependencies": {
     "@sodiumhq/mcp-core": "workspace:*",