@sweny-ai/core 0.1.39 → 0.1.40

package/dist/cli/main.js

@@ -10,9 +10,9 @@ import { execute } from "../executor.js";
 import { triageWorkflow, implementWorkflow, seedContentWorkflow } from "../workflows/index.js";
 import { consoleLogger } from "../types.js";
 import { ClaudeClient } from "../claude.js";
-import { createSkillMap } from "../skills/index.js";
+import { createSkillMap, validateWorkflowSkills } from "../skills/index.js";
 import { configuredSkills } from "../skills/custom-loader.js";
-import { buildAutoMcpServers, buildProviderContext } from "../mcp.js";
+import { buildAutoMcpServers, buildSkillMcpServers, buildProviderContext } from "../mcp.js";
 import { loadAdditionalContext } from "../templates.js";
 import { validateWorkflow as validateWorkflowSchema } from "../schema.js";
 import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
@@ -561,8 +561,40 @@ export async function workflowRunAction(file, options) {
     const isJson = Boolean(options.json);
     const isTTY = !isJson && (process.stderr.isTTY ?? false);
     const skills = createSkillMap(configuredSkills(process.env, process.cwd()));
-    const mcpAutoConfig = buildMcpAutoConfig(config);
-    const mcpServers = buildAutoMcpServers(mcpAutoConfig);
+    // Hard-fail at startup if the workflow references skills that aren't available.
+    // Each node lists alternatives by category (e.g. [sentry, datadog, betterstack]);
+    // we require at least one configured skill per category.
+    const validation = validateWorkflowSkills(workflow, skills);
+    if (validation.errors.length > 0) {
+        console.error(chalk.red(`\n  Workflow cannot run — missing required skills:\n`));
+        for (const err of validation.errors)
+            console.error(chalk.red(`    \u2717 ${err}`));
+        if (validation.missing.length > 0) {
+            console.error(chalk.dim(`\n  Set the missing env vars and try again:`));
+            for (const m of validation.missing) {
+                if (m.missingEnv.length > 0) {
+                    console.error(chalk.dim(`    - ${m.id}: ${m.missingEnv.join(", ")}`));
+                }
+            }
+        }
+        console.error("");
+        process.exit(1);
+        return;
+    }
+    for (const warn of validation.warnings)
+        console.error(chalk.yellow(`  \u26A0 ${warn}`));
+    // Engine-driven MCP wiring: only inject MCPs for skills that the workflow
+    // actually references AND whose env vars are present.
+    const referencedSkillIds = new Set();
+    for (const node of Object.values(workflow.nodes)) {
+        for (const id of node.skills)
+            referencedSkillIds.add(id);
+    }
+    const mcpServers = buildSkillMcpServers({
+        referencedSkills: referencedSkillIds,
+        credentials: buildCredentialMap(),
+        userMcpServers: Object.keys(config.mcpServers).length > 0 ? config.mcpServers : undefined,
+    });
     const claude = new ClaudeClient({
         maxTurns: config.maxInvestigateTurns || 50,
         cwd: process.cwd(),

package/dist/mcp.d.ts

@@ -1,4 +1,27 @@
 import type { McpAutoConfig, McpServerConfig } from "./types.js";
+export interface SkillMcpOptions {
+    /** Skill IDs referenced by the workflow being executed. Only these get MCPs. */
+    referencedSkills: Set<string>;
+    /** Flat credential map (env vars). MCPs are only wired when their creds are set. */
+    credentials: Record<string, string>;
+    /** User-supplied MCP servers — always win on key conflict. */
+    userMcpServers?: Record<string, McpServerConfig>;
+}
+/**
+ * Build MCP server configs for the skills a workflow references.
+ *
+ * For each skill ID in `referencedSkills`, look up its MCP wiring (if any)
+ * and include it only when the required credentials are present in `credentials`.
+ *
+ * Skills with no MCP variant (e.g. `notification`, `supabase`) are silently
+ * skipped — their in-process tools are wired separately by the executor.
+ *
+ * Unknown skill IDs (not built-in, not in this MCP catalog) are silently
+ * skipped here; the engine's hard-fail validation handles them upstream.
+ *
+ * User-supplied servers always win on key conflict.
+ */
+export declare function buildSkillMcpServers(opts: SkillMcpOptions): Record<string, McpServerConfig>;
 /**
  * Auto-configure well-known MCP servers based on which providers
  * and workspace tools the user has enabled.

package/dist/mcp.js

@@ -1,3 +1,163 @@
+/**
+ * Build MCP server configs for the skills a workflow references.
+ *
+ * For each skill ID in `referencedSkills`, look up its MCP wiring (if any)
+ * and include it only when the required credentials are present in `credentials`.
+ *
+ * Skills with no MCP variant (e.g. `notification`, `supabase`) are silently
+ * skipped — their in-process tools are wired separately by the executor.
+ *
+ * Unknown skill IDs (not built-in, not in this MCP catalog) are silently
+ * skipped here; the engine's hard-fail validation handles them upstream.
+ *
+ * User-supplied servers always win on key conflict.
+ */
+export function buildSkillMcpServers(opts) {
+    const auto = {};
+    const refs = opts.referencedSkills;
+    const creds = opts.credentials;
+    // GitHub MCP — wired when workflow uses `github` skill and a token is set.
+    if (refs.has("github") && creds.GITHUB_TOKEN) {
+        auto["github"] = {
+            type: "stdio",
+            command: "npx",
+            args: ["-y", "@modelcontextprotocol/server-github@latest"],
+            env: { GITHUB_PERSONAL_ACCESS_TOKEN: creds.GITHUB_TOKEN },
+        };
+    }
+    // GitLab MCP.
+    if (refs.has("gitlab") && creds.GITLAB_TOKEN) {
+        const env = { GITLAB_PERSONAL_ACCESS_TOKEN: creds.GITLAB_TOKEN };
+        const baseUrl = creds.GITLAB_URL || "https://gitlab.com";
+        if (baseUrl !== "https://gitlab.com")
+            env.GITLAB_API_URL = `${baseUrl}/api/v4`;
+        auto["gitlab"] = {
+            type: "stdio",
+            command: "npx",
+            args: ["-y", "@modelcontextprotocol/server-gitlab@latest"],
+            env,
+        };
+    }
+    // Linear MCP — official remote HTTP endpoint.
+    if (refs.has("linear") && creds.LINEAR_API_KEY) {
+        auto["linear"] = {
+            type: "http",
+            url: "https://mcp.linear.app/mcp",
+            headers: { Authorization: `Bearer ${creds.LINEAR_API_KEY}` },
+        };
+    }
+    // Jira / Confluence — needs all 3 creds.
+    if (refs.has("jira") && creds.JIRA_URL && creds.JIRA_EMAIL && creds.JIRA_API_TOKEN) {
+        auto["jira"] = {
+            type: "stdio",
+            command: "npx",
+            args: ["-y", "@sooperset/mcp-atlassian@latest"],
+            env: {
+                JIRA_URL: creds.JIRA_URL,
+                JIRA_EMAIL: creds.JIRA_EMAIL,
+                JIRA_API_TOKEN: creds.JIRA_API_TOKEN,
+            },
+        };
+    }
+    // Datadog MCP.
+    if (refs.has("datadog") && creds.DD_API_KEY && creds.DD_APP_KEY) {
+        auto["datadog"] = {
+            type: "http",
+            url: "https://mcp.datadoghq.com/api/unstable/mcp-server/mcp",
+            headers: { DD_API_KEY: creds.DD_API_KEY, DD_APPLICATION_KEY: creds.DD_APP_KEY },
+        };
+    }
+    // Sentry MCP — server reads SENTRY_ACCESS_TOKEN, not SENTRY_AUTH_TOKEN.
+    if (refs.has("sentry") && creds.SENTRY_AUTH_TOKEN) {
+        const env = { SENTRY_ACCESS_TOKEN: creds.SENTRY_AUTH_TOKEN };
+        const sentryUrl = creds.SENTRY_URL;
+        if (sentryUrl && sentryUrl !== "https://sentry.io") {
+            try {
+                env.SENTRY_HOST = new URL(sentryUrl).hostname;
+            }
+            catch {
+                // malformed URL — leave SENTRY_HOST unset
+            }
+        }
+        auto["sentry"] = {
+            type: "stdio",
+            command: "npx",
+            args: ["-y", "@sentry/mcp-server@latest"],
+            env,
+        };
+    }
+    // New Relic MCP — region-aware HTTP endpoint, header is "Api-Key".
+    if (refs.has("newrelic") && creds.NEW_RELIC_API_KEY) {
+        const region = creds.NEW_RELIC_REGION;
+        const url = region === "eu" ? "https://mcp.eu.newrelic.com/mcp/" : "https://mcp.newrelic.com/mcp/";
+        auto["newrelic"] = {
+            type: "http",
+            url,
+            headers: { "Api-Key": creds.NEW_RELIC_API_KEY },
+        };
+    }
+    // BetterStack MCP — accept any of the legacy/telemetry/uptime tokens.
+    const bsToken = creds.BETTERSTACK_API_TOKEN || creds.BETTERSTACK_TELEMETRY_TOKEN || creds.BETTERSTACK_UPTIME_TOKEN;
+    if (refs.has("betterstack") && bsToken) {
+        auto["betterstack"] = {
+            type: "http",
+            url: "https://mcp.betterstack.com",
+            headers: { Authorization: `Bearer ${bsToken}` },
+        };
+    }
+    // Slack MCP — wired when workflow uses `slack` skill and bot token is set.
+    if (refs.has("slack") && creds.SLACK_BOT_TOKEN) {
+        const env = { SLACK_BOT_TOKEN: creds.SLACK_BOT_TOKEN };
+        if (creds.SLACK_TEAM_ID)
+            env.SLACK_TEAM_ID = creds.SLACK_TEAM_ID;
+        auto["slack"] = {
+            type: "stdio",
+            command: "npx",
+            args: ["-y", "@modelcontextprotocol/server-slack@latest"],
+            env,
+        };
+    }
+    // Notion MCP — accept either NOTION_TOKEN or NOTION_API_KEY.
+    if (refs.has("notion")) {
+        const token = creds.NOTION_TOKEN || creds.NOTION_API_KEY;
+        if (token) {
+            auto["notion"] = {
+                type: "stdio",
+                command: "npx",
+                args: ["-y", "@notionhq/notion-mcp-server@latest"],
+                env: { NOTION_TOKEN: token },
+            };
+        }
+    }
+    // PagerDuty MCP — auth scheme is `Token token=<key>`.
+    if (refs.has("pagerduty") && creds.PAGERDUTY_API_TOKEN) {
+        auto["pagerduty"] = {
+            type: "http",
+            url: "https://mcp.pagerduty.com/mcp",
+            headers: { Authorization: `Token token=${creds.PAGERDUTY_API_TOKEN}` },
+        };
+    }
+    // Monday.com MCP.
+    if (refs.has("monday") && creds.MONDAY_TOKEN) {
+        auto["monday"] = {
+            type: "stdio",
+            command: "npx",
+            args: ["-y", "@mondaydotcomorg/monday-api-mcp@latest"],
+            env: { MONDAY_TOKEN: creds.MONDAY_TOKEN },
+        };
+    }
+    // Asana MCP.
+    if (refs.has("asana") && creds.ASANA_ACCESS_TOKEN) {
+        auto["asana"] = {
+            type: "stdio",
+            command: "npx",
+            args: ["-y", "asana-mcp@latest"],
+            env: { ASANA_ACCESS_TOKEN: creds.ASANA_ACCESS_TOKEN },
+        };
+    }
+    // User-supplied servers always win on key conflict.
+    return { ...auto, ...(opts.userMcpServers ?? {}) };
+}
 /**
  * Auto-configure well-known MCP servers based on which providers
  * and workspace tools the user has enabled.

package/dist/mcp.test.js

@@ -1,5 +1,5 @@
 import { describe, it, expect } from "vitest";
-import { buildAutoMcpServers } from "./mcp.js";
+import { buildAutoMcpServers, buildSkillMcpServers } from "./mcp.js";
 // ─── Helpers ─────────────────────────────────────────────────────
 function cfg(overrides = {}) {
     return { credentials: {}, ...overrides };
@@ -345,3 +345,154 @@ describe("buildAutoMcpServers", () => {
         expect(result["slack"]).toBeUndefined();
     });
 });
+// ─── buildSkillMcpServers (engine-driven) ────────────────────────────
+describe("buildSkillMcpServers", () => {
+    it("returns empty when no skills referenced and no creds present", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(),
+            credentials: {},
+        });
+        expect(result).toEqual({});
+    });
+    it("does not wire MCP for a skill not referenced by the workflow", () => {
+        // Token is set, but the workflow doesn't ask for github → no MCP.
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["linear"]),
+            credentials: { GITHUB_TOKEN: "ghp_abc", LINEAR_API_KEY: "lin_abc" },
+        });
+        expect(result["github"]).toBeUndefined();
+        expect(result["linear"]).toBeDefined();
+    });
+    it("does not wire MCP for a referenced skill whose creds are missing", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["github", "linear"]),
+            credentials: { LINEAR_API_KEY: "lin_abc" }, // no GITHUB_TOKEN
+        });
+        expect(result["github"]).toBeUndefined();
+        expect(result["linear"]).toBeDefined();
+    });
+    it("wires github MCP when referenced and GITHUB_TOKEN present", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["github"]),
+            credentials: { GITHUB_TOKEN: "ghp_abc" },
+        });
+        expect(result["github"]).toEqual({
+            type: "stdio",
+            command: "npx",
+            args: ["-y", "@modelcontextprotocol/server-github@latest"],
+            env: { GITHUB_PERSONAL_ACCESS_TOKEN: "ghp_abc" },
+        });
+    });
+    it("wires linear MCP when referenced and LINEAR_API_KEY present", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["linear"]),
+            credentials: { LINEAR_API_KEY: "lin_abc" },
+        });
+        expect(result["linear"]).toEqual({
+            type: "http",
+            url: "https://mcp.linear.app/mcp",
+            headers: { Authorization: "Bearer lin_abc" },
+        });
+    });
+    it("wires sentry MCP with SENTRY_HOST for self-hosted SENTRY_URL", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["sentry"]),
+            credentials: { SENTRY_AUTH_TOKEN: "sntryu_abc", SENTRY_URL: "https://sentry.mycompany.com" },
+        });
+        expect(result["sentry"]?.env).toMatchObject({
+            SENTRY_ACCESS_TOKEN: "sntryu_abc",
+            SENTRY_HOST: "sentry.mycompany.com",
+        });
+    });
+    it("wires datadog MCP when both keys present", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["datadog"]),
+            credentials: { DD_API_KEY: "dd_api", DD_APP_KEY: "dd_app" },
+        });
+        expect(result["datadog"]).toEqual({
+            type: "http",
+            url: "https://mcp.datadoghq.com/api/unstable/mcp-server/mcp",
+            headers: { DD_API_KEY: "dd_api", DD_APPLICATION_KEY: "dd_app" },
+        });
+    });
+    it("does not wire datadog MCP when DD_APP_KEY is missing", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["datadog"]),
+            credentials: { DD_API_KEY: "dd_api" },
+        });
+        expect(result["datadog"]).toBeUndefined();
+    });
+    it("wires slack MCP without an opt-in flag — workflow reference is the opt-in", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["slack"]),
+            credentials: { SLACK_BOT_TOKEN: "xoxb-abc" },
+        });
+        expect(result["slack"]).toEqual({
+            type: "stdio",
+            command: "npx",
+            args: ["-y", "@modelcontextprotocol/server-slack@latest"],
+            env: { SLACK_BOT_TOKEN: "xoxb-abc" },
+        });
+    });
+    it("wires betterstack MCP only when the workflow references betterstack", () => {
+        // Token alone is not enough — must be referenced.
+        const noRef = buildSkillMcpServers({
+            referencedSkills: new Set(["sentry"]),
+            credentials: { BETTERSTACK_API_TOKEN: "bs_abc", SENTRY_AUTH_TOKEN: "sntry_x" },
+        });
+        expect(noRef["betterstack"]).toBeUndefined();
+        const withRef = buildSkillMcpServers({
+            referencedSkills: new Set(["betterstack"]),
+            credentials: { BETTERSTACK_API_TOKEN: "bs_abc" },
+        });
+        expect(withRef["betterstack"]).toEqual({
+            type: "http",
+            url: "https://mcp.betterstack.com",
+            headers: { Authorization: "Bearer bs_abc" },
+        });
+    });
+    it("user-supplied MCP servers win on key conflict", () => {
+        const custom = { type: "stdio", command: "my-github", args: [] };
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["github"]),
+            credentials: { GITHUB_TOKEN: "ghp_abc" },
+            userMcpServers: { github: custom },
+        });
+        expect(result["github"]).toEqual(custom);
+    });
+    it("user-supplied servers can add MCPs alongside auto-wired ones", () => {
+        const my = { type: "http", url: "https://my.example.com" };
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["github"]),
+            credentials: { GITHUB_TOKEN: "ghp_abc" },
+            userMcpServers: { "my-tool": my },
+        });
+        expect(result["github"]).toBeDefined();
+        expect(result["my-tool"]).toEqual(my);
+    });
+    it("silently skips skill IDs with no MCP catalog entry (e.g. notification)", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["notification", "supabase", "github"]),
+            credentials: { GITHUB_TOKEN: "ghp_abc" },
+        });
+        expect(result["notification"]).toBeUndefined();
+        expect(result["supabase"]).toBeUndefined();
+        expect(result["github"]).toBeDefined();
+    });
+    it("wires multiple skills simultaneously", () => {
+        const result = buildSkillMcpServers({
+            referencedSkills: new Set(["github", "linear", "datadog", "slack"]),
+            credentials: {
+                GITHUB_TOKEN: "ghp_abc",
+                LINEAR_API_KEY: "lin_abc",
+                DD_API_KEY: "dd_api",
+                DD_APP_KEY: "dd_app",
+                SLACK_BOT_TOKEN: "xoxb-abc",
+            },
+        });
+        expect(result["github"]).toBeDefined();
+        expect(result["linear"]).toBeDefined();
+        expect(result["datadog"]).toBeDefined();
+        expect(result["slack"]).toBeDefined();
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sweny-ai/core",
-  "version": "0.1.39",
+  "version": "0.1.40",
   "type": "module",
   "bin": {
     "sweny": "./dist/cli/main.js"