@solvapay/mcp 0.2.3 → 0.2.4

package/dist/{chunk-3VDAADZU.js → chunk-RWJ6GBM5.js}

@@ -76,6 +76,15 @@ import {
   buildSolvaPayDescriptors,
   deriveIcons
 } from "@solvapay/mcp-core";
+function normaliseHideToolsByAudience(config) {
+  if (!config) return { audiences: void 0, options: {} };
+  if (Array.isArray(config)) return { audiences: config, options: {} };
+  const obj = config;
+  return {
+    audiences: obj.audiences,
+    options: obj.bypassWhen !== void 0 ? { bypassWhen: obj.bypassWhen } : {}
+  };
+}
 function registerDescriptor(server, tool) {
   const baseMeta = tool.meta ?? {};
   const baseUi = baseMeta.ui ?? {};
@@ -139,7 +148,6 @@ function buildSolvaPayMcpServer(options) {
     registerDocsResources = true,
     serverName,
     serverVersion = "1.0.0",
-    hideToolsByAudience: _hideToolsByAudience,
     ...descriptorOptions
   } = options;
   const descriptors = buildSolvaPayDescriptors(descriptorOptions);
@@ -206,6 +214,7 @@ function buildSolvaPayMcpServer(options) {
 
 export {
   applyHideToolsByAudience,
+  normaliseHideToolsByAudience,
   buildSolvaPayMcpServer,
   registerPayableTool
 };

package/dist/fetch/index.cjs

@@ -518,6 +518,15 @@ function createSolvaPayMcpFetchHandler(options) {
 var import_server = require("@modelcontextprotocol/ext-apps/server");
 var import_mcp = require("@modelcontextprotocol/sdk/server/mcp.js");
 var import_mcp_core4 = require("@solvapay/mcp-core");
+function normaliseHideToolsByAudience(config) {
+  if (!config) return { audiences: void 0, options: {} };
+  if (Array.isArray(config)) return { audiences: config, options: {} };
+  const obj = config;
+  return {
+    audiences: obj.audiences,
+    options: obj.bypassWhen !== void 0 ? { bypassWhen: obj.bypassWhen } : {}
+  };
+}
 function registerDescriptor(server, tool) {
   const baseMeta = tool.meta ?? {};
   const baseUi = baseMeta.ui ?? {};
@@ -581,7 +590,6 @@ function buildSolvaPayMcpServer(options) {
     registerDocsResources = true,
     serverName,
     serverVersion = "1.0.0",
-    hideToolsByAudience: _hideToolsByAudience,
     ...descriptorOptions
   } = options;
   const descriptors = (0, import_mcp_core4.buildSolvaPayDescriptors)(descriptorOptions);
@@ -769,7 +777,8 @@ function createSolvaPayMcpFetch(options) {
     };
     additionalTools({ server, solvaPay, resourceUri, productRef, registerPayable });
   }
-  (0, import_mcp_core4.applyHideToolsByAudience)(server, hideToolsByAudience);
+  const { audiences, options: filterOptions } = normaliseHideToolsByAudience(hideToolsByAudience);
+  (0, import_mcp_core4.applyHideToolsByAudience)(server, audiences, filterOptions);
   return createSolvaPayMcpFetchHandler({
     server,
     publicBaseUrl,

package/dist/fetch/index.d.cts

@@ -2,7 +2,7 @@ import { OAuthBridgePaths, BuildAuthInfoFromBearerOptions, BuildSolvaPayDescript
 export { BuildAuthInfoFromBearerOptions, McpBearerAuthError, OAuthAuthorizationServerOptions, OAuthBridgePaths, buildAuthInfoFromBearer, getOAuthAuthorizationServerResponse, getOAuthProtectedResourceResponse } from '@solvapay/mcp-core';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { WebStandardStreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js';
-import { AdditionalToolsContext } from '../index.cjs';
+import { AdditionalToolsContext, HideToolsByAudienceConfig } from '../index.cjs';
 import '@modelcontextprotocol/sdk/server/zod-compat.js';
 import '@solvapay/server';
 
@@ -207,11 +207,11 @@ interface CreateSolvaPayMcpFetchOptions extends Omit<BuildSolvaPayDescriptorsOpt
      */
     additionalTools?: (ctx: AdditionalToolsContext) => void;
     /**
-     * Hide tools whose `_meta.audience` matches one of these values from
-     * `tools/list`. See `CreateSolvaPayMcpServerOptions` for the full
-     * rationale.
+     * Hide tools whose `_meta.audience` matches one of these values
+     * from `tools/list`. See `CreateSolvaPayMcpServerOptions` for the
+     * full rationale and the ChatGPT auto-bypass behaviour.
      */
-    hideToolsByAudience?: string[];
+    hideToolsByAudience?: HideToolsByAudienceConfig;
     /**
      * Register the slash-command prompts built from the descriptor
      * bundle. Defaults to `true`.
@@ -235,4 +235,4 @@ interface CreateSolvaPayMcpFetchOptions extends Omit<BuildSolvaPayDescriptorsOpt
  */
 declare function createSolvaPayMcpFetch(options: CreateSolvaPayMcpFetchOptions): (req: Request) => Promise<Response>;
 
-export { AdditionalToolsContext, type CreateSolvaPayMcpFetchHandlerOptions, type CreateSolvaPayMcpFetchOptions, type FetchOAuthOptions, type McpHandlerMode, applyNativeCors, authChallenge, corsPreflight, createAuthorizationServerHandler, createOAuthAuthorizeHandler, createOAuthFetchRouter, createOAuthRegisterHandler, createOAuthRevokeHandler, createOAuthTokenHandler, createOpenidNotFoundHandler, createProtectedResourceHandler, createSolvaPayMcpFetch, createSolvaPayMcpFetchHandler, isNativeClientOrigin, resolveBearer };
+export { AdditionalToolsContext, type CreateSolvaPayMcpFetchHandlerOptions, type CreateSolvaPayMcpFetchOptions, type FetchOAuthOptions, HideToolsByAudienceConfig, type McpHandlerMode, applyNativeCors, authChallenge, corsPreflight, createAuthorizationServerHandler, createOAuthAuthorizeHandler, createOAuthFetchRouter, createOAuthRegisterHandler, createOAuthRevokeHandler, createOAuthTokenHandler, createOpenidNotFoundHandler, createProtectedResourceHandler, createSolvaPayMcpFetch, createSolvaPayMcpFetchHandler, isNativeClientOrigin, resolveBearer };

package/dist/fetch/index.d.ts

@@ -2,7 +2,7 @@ import { OAuthBridgePaths, BuildAuthInfoFromBearerOptions, BuildSolvaPayDescript
 export { BuildAuthInfoFromBearerOptions, McpBearerAuthError, OAuthAuthorizationServerOptions, OAuthBridgePaths, buildAuthInfoFromBearer, getOAuthAuthorizationServerResponse, getOAuthProtectedResourceResponse } from '@solvapay/mcp-core';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { WebStandardStreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js';
-import { AdditionalToolsContext } from '../index.js';
+import { AdditionalToolsContext, HideToolsByAudienceConfig } from '../index.js';
 import '@modelcontextprotocol/sdk/server/zod-compat.js';
 import '@solvapay/server';
 
@@ -207,11 +207,11 @@ interface CreateSolvaPayMcpFetchOptions extends Omit<BuildSolvaPayDescriptorsOpt
      */
     additionalTools?: (ctx: AdditionalToolsContext) => void;
     /**
-     * Hide tools whose `_meta.audience` matches one of these values from
-     * `tools/list`. See `CreateSolvaPayMcpServerOptions` for the full
-     * rationale.
+     * Hide tools whose `_meta.audience` matches one of these values
+     * from `tools/list`. See `CreateSolvaPayMcpServerOptions` for the
+     * full rationale and the ChatGPT auto-bypass behaviour.
      */
-    hideToolsByAudience?: string[];
+    hideToolsByAudience?: HideToolsByAudienceConfig;
     /**
      * Register the slash-command prompts built from the descriptor
      * bundle. Defaults to `true`.
@@ -235,4 +235,4 @@ interface CreateSolvaPayMcpFetchOptions extends Omit<BuildSolvaPayDescriptorsOpt
  */
 declare function createSolvaPayMcpFetch(options: CreateSolvaPayMcpFetchOptions): (req: Request) => Promise<Response>;
 
-export { AdditionalToolsContext, type CreateSolvaPayMcpFetchHandlerOptions, type CreateSolvaPayMcpFetchOptions, type FetchOAuthOptions, type McpHandlerMode, applyNativeCors, authChallenge, corsPreflight, createAuthorizationServerHandler, createOAuthAuthorizeHandler, createOAuthFetchRouter, createOAuthRegisterHandler, createOAuthRevokeHandler, createOAuthTokenHandler, createOpenidNotFoundHandler, createProtectedResourceHandler, createSolvaPayMcpFetch, createSolvaPayMcpFetchHandler, isNativeClientOrigin, resolveBearer };
+export { AdditionalToolsContext, type CreateSolvaPayMcpFetchHandlerOptions, type CreateSolvaPayMcpFetchOptions, type FetchOAuthOptions, HideToolsByAudienceConfig, type McpHandlerMode, applyNativeCors, authChallenge, corsPreflight, createAuthorizationServerHandler, createOAuthAuthorizeHandler, createOAuthFetchRouter, createOAuthRegisterHandler, createOAuthRevokeHandler, createOAuthTokenHandler, createOpenidNotFoundHandler, createProtectedResourceHandler, createSolvaPayMcpFetch, createSolvaPayMcpFetchHandler, isNativeClientOrigin, resolveBearer };

package/dist/fetch/index.js

@@ -1,8 +1,9 @@
 import {
   applyHideToolsByAudience,
   buildSolvaPayMcpServer,
+  normaliseHideToolsByAudience,
   registerPayableTool
-} from "../chunk-3VDAADZU.js";
+} from "../chunk-RWJ6GBM5.js";
 import {
   toOAuthErrorBody
 } from "../chunk-R3OMC7S2.js";
@@ -466,7 +467,8 @@ function createSolvaPayMcpFetch(options) {
     };
     additionalTools({ server, solvaPay, resourceUri, productRef, registerPayable });
   }
-  applyHideToolsByAudience(server, hideToolsByAudience);
+  const { audiences, options: filterOptions } = normaliseHideToolsByAudience(hideToolsByAudience);
+  applyHideToolsByAudience(server, audiences, filterOptions);
   return createSolvaPayMcpFetchHandler({
     server,
     publicBaseUrl,

package/dist/index.cjs

@@ -29,6 +29,15 @@ module.exports = __toCommonJS(index_exports);
 var import_server = require("@modelcontextprotocol/ext-apps/server");
 var import_mcp = require("@modelcontextprotocol/sdk/server/mcp.js");
 var import_mcp_core = require("@solvapay/mcp-core");
+function normaliseHideToolsByAudience(config) {
+  if (!config) return { audiences: void 0, options: {} };
+  if (Array.isArray(config)) return { audiences: config, options: {} };
+  const obj = config;
+  return {
+    audiences: obj.audiences,
+    options: obj.bypassWhen !== void 0 ? { bypassWhen: obj.bypassWhen } : {}
+  };
+}
 function registerDescriptor(server, tool) {
   const baseMeta = tool.meta ?? {};
   const baseUi = baseMeta.ui ?? {};
@@ -92,7 +101,6 @@ function buildSolvaPayMcpServer(options) {
     registerDocsResources = true,
     serverName,
     serverVersion = "1.0.0",
-    hideToolsByAudience: _hideToolsByAudience,
     ...descriptorOptions
   } = options;
   const descriptors = (0, import_mcp_core.buildSolvaPayDescriptors)(descriptorOptions);
@@ -252,7 +260,8 @@ function createSolvaPayMcpServer(options) {
     };
     additionalTools({ server, solvaPay, resourceUri, productRef, registerPayable });
   }
-  (0, import_mcp_core.applyHideToolsByAudience)(server, hideToolsByAudience);
+  const { audiences, options: filterOptions } = normaliseHideToolsByAudience(hideToolsByAudience);
+  (0, import_mcp_core.applyHideToolsByAudience)(server, audiences, filterOptions);
   return server;
 }
 // Annotate the CommonJS export names for ESM import in node:

package/dist/index.d.cts

@@ -1,9 +1,28 @@
 import { McpServer, RegisteredTool } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { ZodRawShapeCompat, AnySchema, ShapeOutput, SchemaOutput } from '@modelcontextprotocol/sdk/server/zod-compat.js';
-import { PayableHandler, BuildBootstrapPayloadFn, McpToolExtra, SolvaPayToolAnnotations, SolvaPayToolIcon, BuildSolvaPayDescriptorsOptions } from '@solvapay/mcp-core';
+import { ApplyHideToolsByAudienceOptions, PayableHandler, BuildBootstrapPayloadFn, McpToolExtra, SolvaPayToolAnnotations, SolvaPayToolIcon, BuildSolvaPayDescriptorsOptions } from '@solvapay/mcp-core';
 export { ContentBlock, CustomerSnapshot, NudgeSpec, PayableHandler, ResponseContext, ResponseOptions, ResponseResult } from '@solvapay/mcp-core';
 import { SolvaPay } from '@solvapay/server';
 
+/**
+ * Shared `McpServer` construction + descriptor-registration loop used
+ * by both the `.` entry (`createSolvaPayMcpServer` in `../server.ts`)
+ * and the `./fetch` entry (`createSolvaPayMcpFetch` in
+ * `../fetch/createSolvaPayMcpFetch.ts`).
+ *
+ * Lifted here so the two public factories stop duplicating the same
+ * 80-line registration wiring. Both entrypoints get the exact same
+ * server shape (11 tools + prompts + docs resource + UI resource)
+ * without importing from each other — Node consumers keep their
+ * existing import path, fetch-first consumers keep theirs, and the
+ * diff-risk from the previous sibling copies is gone.
+ */
+
+type HideToolsByAudienceConfig = readonly string[] | {
+    audiences: readonly string[];
+    bypassWhen?: ApplyHideToolsByAudienceOptions['bypassWhen'];
+};
+
 /**
  * `registerPayableTool(server, name, options)` — one-liner for registering
  * a paywall-protected MCP tool on the official `@modelcontextprotocol/sdk`
@@ -177,20 +196,40 @@ interface CreateSolvaPayMcpServerOptions extends BuildSolvaPayDescriptorsOptions
      * tool whose `_meta.audience` matches one of these values. The
      * tools stay `enabled: true` so `tools/call` still reaches their
      * handlers — this option only affects the `tools/list` response
-     * shape. Pass `['ui']` when deploying to a text-host MCP client
-     * (Claude Desktop, MCPJam, ChatGPT connectors) that won't embed
-     * the SolvaPay iframe surface, so the LLM's tool catalogue only
-     * surfaces the intent tools (`upgrade` / `manage_account` /
-     * `activate_plan` / `topup`) and merchant-registered data tools.
-     * The hidden transport tools (`create_payment_intent`, etc.) stay
-     * callable so the iframe can still invoke them for server-side
-     * work.
+     * shape. Pass `['ui']` to keep the LLM-facing catalogue narrow to
+     * the four intent tools (`upgrade` / `manage_account` /
+     * `activate_plan` / `topup`) plus your own merchant-registered
+     * data tools, while leaving the seven UI transport tools
+     * (`create_payment_intent`, etc.) callable for the SolvaPay
+     * iframe.
+     *
+     * # ChatGPT auto-bypass
+     *
+     * ChatGPT's Custom Connector gateway re-validates iframe-initiated
+     * `tools/call` against the cached `tools/list` catalog, so any
+     * tool hidden by this option becomes uncallable from the embedded
+     * iframe and surfaces in the UI as `MCP error -32000: MCP Resource
+     * not found`. To preserve the cleaner LLM catalog on every other
+     * host while keeping the iframe working on ChatGPT, the SDK
+     * auto-detects ChatGPT-originated `tools/list` requests (matching
+     * `request.headers['user-agent']` and the post-`initialize`
+     * `clientInfo.name` against `/openai-mcp/i`) and returns the full
+     * catalog to them. The detection is verified live against
+     * `openai-mcp/1.0.0 (ChatGPT)` and the broad pattern survives a UA
+     * version bump.
+     *
+     * To extend the bypass to a future iframe-capable host, pass the
+     * object form: `{ audiences: ['ui'], bypassWhen: ctx => … }`.
+     *
+     * To disable the bypass and apply the filter unconditionally
+     * (e.g. on a known text-only deployment), pass `{ audiences:
+     * ['ui'], bypassWhen: () => false }`.
      */
-    hideToolsByAudience?: string[];
+    hideToolsByAudience?: HideToolsByAudienceConfig;
 }
 /**
  * Build the MCP server and register the full SolvaPay tool surface.
  */
 declare function createSolvaPayMcpServer(options: CreateSolvaPayMcpServerOptions): McpServer;
 
-export { type AdditionalToolsContext, type CreateSolvaPayMcpServerOptions, type RegisterPayableToolOptions, createSolvaPayMcpServer, registerPayableTool };
+export { type AdditionalToolsContext, type CreateSolvaPayMcpServerOptions, type HideToolsByAudienceConfig, type RegisterPayableToolOptions, createSolvaPayMcpServer, registerPayableTool };

package/dist/index.d.ts

@@ -1,9 +1,28 @@
 import { McpServer, RegisteredTool } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { ZodRawShapeCompat, AnySchema, ShapeOutput, SchemaOutput } from '@modelcontextprotocol/sdk/server/zod-compat.js';
-import { PayableHandler, BuildBootstrapPayloadFn, McpToolExtra, SolvaPayToolAnnotations, SolvaPayToolIcon, BuildSolvaPayDescriptorsOptions } from '@solvapay/mcp-core';
+import { ApplyHideToolsByAudienceOptions, PayableHandler, BuildBootstrapPayloadFn, McpToolExtra, SolvaPayToolAnnotations, SolvaPayToolIcon, BuildSolvaPayDescriptorsOptions } from '@solvapay/mcp-core';
 export { ContentBlock, CustomerSnapshot, NudgeSpec, PayableHandler, ResponseContext, ResponseOptions, ResponseResult } from '@solvapay/mcp-core';
 import { SolvaPay } from '@solvapay/server';
 
+/**
+ * Shared `McpServer` construction + descriptor-registration loop used
+ * by both the `.` entry (`createSolvaPayMcpServer` in `../server.ts`)
+ * and the `./fetch` entry (`createSolvaPayMcpFetch` in
+ * `../fetch/createSolvaPayMcpFetch.ts`).
+ *
+ * Lifted here so the two public factories stop duplicating the same
+ * 80-line registration wiring. Both entrypoints get the exact same
+ * server shape (11 tools + prompts + docs resource + UI resource)
+ * without importing from each other — Node consumers keep their
+ * existing import path, fetch-first consumers keep theirs, and the
+ * diff-risk from the previous sibling copies is gone.
+ */
+
+type HideToolsByAudienceConfig = readonly string[] | {
+    audiences: readonly string[];
+    bypassWhen?: ApplyHideToolsByAudienceOptions['bypassWhen'];
+};
+
 /**
  * `registerPayableTool(server, name, options)` — one-liner for registering
  * a paywall-protected MCP tool on the official `@modelcontextprotocol/sdk`
@@ -177,20 +196,40 @@ interface CreateSolvaPayMcpServerOptions extends BuildSolvaPayDescriptorsOptions
      * tool whose `_meta.audience` matches one of these values. The
      * tools stay `enabled: true` so `tools/call` still reaches their
      * handlers — this option only affects the `tools/list` response
-     * shape. Pass `['ui']` when deploying to a text-host MCP client
-     * (Claude Desktop, MCPJam, ChatGPT connectors) that won't embed
-     * the SolvaPay iframe surface, so the LLM's tool catalogue only
-     * surfaces the intent tools (`upgrade` / `manage_account` /
-     * `activate_plan` / `topup`) and merchant-registered data tools.
-     * The hidden transport tools (`create_payment_intent`, etc.) stay
-     * callable so the iframe can still invoke them for server-side
-     * work.
+     * shape. Pass `['ui']` to keep the LLM-facing catalogue narrow to
+     * the four intent tools (`upgrade` / `manage_account` /
+     * `activate_plan` / `topup`) plus your own merchant-registered
+     * data tools, while leaving the seven UI transport tools
+     * (`create_payment_intent`, etc.) callable for the SolvaPay
+     * iframe.
+     *
+     * # ChatGPT auto-bypass
+     *
+     * ChatGPT's Custom Connector gateway re-validates iframe-initiated
+     * `tools/call` against the cached `tools/list` catalog, so any
+     * tool hidden by this option becomes uncallable from the embedded
+     * iframe and surfaces in the UI as `MCP error -32000: MCP Resource
+     * not found`. To preserve the cleaner LLM catalog on every other
+     * host while keeping the iframe working on ChatGPT, the SDK
+     * auto-detects ChatGPT-originated `tools/list` requests (matching
+     * `request.headers['user-agent']` and the post-`initialize`
+     * `clientInfo.name` against `/openai-mcp/i`) and returns the full
+     * catalog to them. The detection is verified live against
+     * `openai-mcp/1.0.0 (ChatGPT)` and the broad pattern survives a UA
+     * version bump.
+     *
+     * To extend the bypass to a future iframe-capable host, pass the
+     * object form: `{ audiences: ['ui'], bypassWhen: ctx => … }`.
+     *
+     * To disable the bypass and apply the filter unconditionally
+     * (e.g. on a known text-only deployment), pass `{ audiences:
+     * ['ui'], bypassWhen: () => false }`.
      */
-    hideToolsByAudience?: string[];
+    hideToolsByAudience?: HideToolsByAudienceConfig;
 }
 /**
  * Build the MCP server and register the full SolvaPay tool surface.
  */
 declare function createSolvaPayMcpServer(options: CreateSolvaPayMcpServerOptions): McpServer;
 
-export { type AdditionalToolsContext, type CreateSolvaPayMcpServerOptions, type RegisterPayableToolOptions, createSolvaPayMcpServer, registerPayableTool };
+export { type AdditionalToolsContext, type CreateSolvaPayMcpServerOptions, type HideToolsByAudienceConfig, type RegisterPayableToolOptions, createSolvaPayMcpServer, registerPayableTool };

package/dist/index.js

@@ -1,8 +1,9 @@
 import {
   applyHideToolsByAudience,
   buildSolvaPayMcpServer,
+  normaliseHideToolsByAudience,
   registerPayableTool
-} from "./chunk-3VDAADZU.js";
+} from "./chunk-RWJ6GBM5.js";
 
 // src/server.ts
 function createSolvaPayMcpServer(options) {
@@ -35,7 +36,8 @@ function createSolvaPayMcpServer(options) {
     };
     additionalTools({ server, solvaPay, resourceUri, productRef, registerPayable });
   }
-  applyHideToolsByAudience(server, hideToolsByAudience);
+  const { audiences, options: filterOptions } = normaliseHideToolsByAudience(hideToolsByAudience);
+  applyHideToolsByAudience(server, audiences, filterOptions);
   return server;
 }
 export {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solvapay/mcp",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "Official @modelcontextprotocol/sdk + @modelcontextprotocol/ext-apps adapter for the SolvaPay MCP toolbox (createSolvaPayMcpServer, registerPayableTool) with ./fetch + ./express subpath exports for runtime-specific OAuth bridges.",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -43,7 +43,7 @@
     "@modelcontextprotocol/ext-apps": "^1.5.0",
     "@modelcontextprotocol/sdk": "^1.28.0",
     "zod": "^3.25.0 || ^4.0.0",
-    "@solvapay/mcp-core": "0.2.3",
+    "@solvapay/mcp-core": "0.2.4",
     "@solvapay/server": "^1.0.11"
   },
   "peerDependenciesMeta": {
@@ -58,7 +58,7 @@
     "typescript": "^5.9.3",
     "vitest": "^4.1.2",
     "zod": "^4.3.6",
-    "@solvapay/mcp-core": "0.2.3",
+    "@solvapay/mcp-core": "0.2.4",
     "@solvapay/server": "1.0.11",
     "@solvapay/test-utils": "^0.0.0"
   },