@systemdox/mcp-server 0.1.28 → 0.1.30

package/README.md

@@ -130,7 +130,7 @@ require an API key with `editor`+ role.
 The aggregator. It ranks checks, specs and docs against the task, then
 spends the token budget **fetching the bodies** of the highest-ranked specs and
 docs (`/v1/specs/{id}`, `/v1/docs/{id}/content`) — concurrently, clipped to a
-fair share of what's left. Every item carries the `spec_id` / `doc_id` needed to
+fair share of what's left. Every item carries the `draft_id` / `doc_id` needed to
 fetch it in full, so nothing is a dead end: items whose body did not fit, or
 whose fetch failed, still appear as a title + ID. Tech stack and project rules
 are always included; the budget is spent on bodies, never on truncating the

package/dist/cli.js

@@ -394,15 +394,15 @@ function registerGetSpecs(server2, apiClient2) {
       title: "Get Specs",
       description: "Retrieve SystemDox specifications (proposal, requirements with RFC 2119 keywords, Given/When/Then scenarios). Get a specific spec by ID, filter by status, or search by keyword.",
       inputSchema: {
-        spec_id: z2.string().optional().describe("Specific spec ID to retrieve with full content"),
+        draft_id: z2.string().optional().describe("Specific spec ID to retrieve with full content"),
         status: z2.enum(["draft", "ready", "archived"]).optional().describe("Filter by status"),
         search: z2.string().optional().describe("Keyword search across spec names")
       }
     },
-    async ({ spec_id, status, search }) => {
-      if (spec_id) {
+    async ({ draft_id, status, search }) => {
+      if (draft_id) {
         const spec = await apiClient2.get(
-          `/v1/specs/${spec_id}`
+          `/v1/specs/${draft_id}`
         );
         const sections = [`# ${spec.name}
 
@@ -451,7 +451,7 @@ ${spec.taskContent}`);
         };
       }
       const text = filtered.map(
-        (s) => `- **${s.name}** (${s.specId}) \u2014 ${s.status}, ${s.requirementCount} requirements` + (s.repoFullName ? `, repo: ${s.repoFullName}` : "")
+        (s) => `- **${s.name}** (${s.draftId}) \u2014 ${s.status}, ${s.requirementCount} requirements` + (s.repoFullName ? `, repo: ${s.repoFullName}` : "")
       ).join("\n");
       return {
         content: [
@@ -1117,7 +1117,7 @@ ${g.fix}
 }
 function formatSpecHeadline(s) {
   return `### ${s.name}
-\`spec_id: ${s.specId}\` \xB7 ${s.status} \xB7 ${s.requirementCount} requirements`;
+\`draft_id: ${s.draftId}\` \xB7 ${s.status} \xB7 ${s.requirementCount} requirements`;
 }
 function formatDocHeadline(d) {
   return `### ${d.title}
@@ -1149,9 +1149,9 @@ function formatRules(rules) {
 
 ${text.trim()}`;
 }
-async function fetchSpecBody(api, specId) {
+async function fetchSpecBody(api, draftId) {
   const spec = await api.get(
-    `/v1/specs/${encodeURIComponent(specId)}`
+    `/v1/specs/${encodeURIComponent(draftId)}`
   );
   const parts = [];
   if (spec.proposalContent) {
@@ -1245,16 +1245,16 @@ async function buildContext(api, { taskDescription, filePaths = [], maxTokens })
       updatedAt: g.updatedAt
     })),
     ...specs.filter((s) => s.status !== "archived").map((s) => {
-      refs.set(key("spec", s.specId), {
+      refs.set(key("spec", s.draftId), {
         type: "spec",
-        id: s.specId,
+        id: s.draftId,
         title: s.name,
-        listLine: `- **${s.name}** \u2014 \`spec_id: ${s.specId}\` (${s.status}, ${s.requirementCount} requirements)`,
-        fetchHint: `get_specs(spec_id="${s.specId}")`
+        listLine: `- **${s.name}** \u2014 \`draft_id: ${s.draftId}\` (${s.status}, ${s.requirementCount} requirements)`,
+        fetchHint: `get_specs(draft_id="${s.draftId}")`
       });
       return {
         type: "spec",
-        id: s.specId,
+        id: s.draftId,
         title: s.name,
         content: formatSpecHeadline(s),
         updatedAt: s.updatedAt
@@ -1620,7 +1620,7 @@ function registerUpdateSpec(server2, apiClient2) {
       title: "Update Spec",
       description: "Update an existing SystemDox spec's proposal, tasks, or requirements. Only draft specs can be modified \u2014 published specs must be versioned first.",
       inputSchema: {
-        spec_id: z8.string().describe("ID of the spec to update"),
+        draft_id: z8.string().describe("ID of the spec to update"),
         section: z8.enum(["proposal", "tasks", "requirements"]).describe("Which section to update"),
         content: z8.string().describe(
           "New markdown content for the section. For requirements, provide the full requirement content."
@@ -1633,8 +1633,8 @@ function registerUpdateSpec(server2, apiClient2) {
         readOnlyHint: false
       }
     },
-    async ({ spec_id, section, content, requirement_name }) => {
-      const spec = await apiClient2.get(`/v1/specs/${spec_id}`);
+    async ({ draft_id, section, content, requirement_name }) => {
+      const spec = await apiClient2.get(`/v1/specs/${draft_id}`);
       if (spec.status !== "draft") {
         return {
           content: [
@@ -1659,8 +1659,8 @@ function registerUpdateSpec(server2, apiClient2) {
         };
         body.requirements = [...existing, newReq];
       }
-      await apiClient2.put(`/v1/specs/${spec_id}`, body);
-      apiClient2.invalidateCache(`/v1/specs/${spec_id}`);
+      await apiClient2.put(`/v1/specs/${draft_id}`, body);
+      apiClient2.invalidateCache(`/v1/specs/${draft_id}`);
       apiClient2.invalidateCache("/v1/specs");
       return {
         content: [
@@ -1724,7 +1724,7 @@ ${decision}
 ## Consequences
 
 ${consequences}` + relatedSection;
-      await apiClient2.put(`/v1/specs/${created.specId}`, {
+      await apiClient2.put(`/v1/specs/${created.draftId}`, {
         proposalContent: adrContent
       });
       apiClient2.invalidateCache("/v1/specs");
@@ -1732,7 +1732,7 @@ ${consequences}` + relatedSection;
         content: [
           {
             type: "text",
-            text: `Architecture decision recorded: **${adrTitle}** (spec id: ${created.specId})
+            text: `Architecture decision recorded: **${adrTitle}** (spec id: ${created.draftId})
 
 Status: draft \u2014 review in SystemDox before publishing.`
           }
@@ -2000,7 +2000,7 @@ var init_server = __esm({
     init_create_project_rule();
     init_get_prompt_templates();
     init_create_prompt_template();
-    SERVER_VERSION = true ? "0.1.28" : "0.0.0-dev";
+    SERVER_VERSION = true ? "0.1.30" : "0.0.0-dev";
   }
 });
 

package/dist/http.js

@@ -117,6 +117,25 @@ var SystemDoxApiClient = class {
   }
 };
 
+// src/lib/config.ts
+var API_URL_DEFAULT = "https://api.puglieseweb.com/systemdox";
+function requireHttpsApiUrl(apiUrl) {
+  let parsed;
+  try {
+    parsed = new URL(apiUrl);
+  } catch {
+    throw new Error(
+      `SYSTEMDOX_API_URL is not a valid URL: ${apiUrl}`
+    );
+  }
+  if (parsed.protocol !== "https:") {
+    throw new Error(
+      `SYSTEMDOX_API_URL must use https:// \u2014 refusing to send the API key over ${parsed.protocol}// in cleartext. Got: ${apiUrl}`
+    );
+  }
+  return apiUrl;
+}
+
 // src/lib/metrics.ts
 var NAMESPACE = "SystemDox/Mcp";
 var METRIC_NAME = "McpToolCall";
@@ -347,15 +366,15 @@ function registerGetSpecs(server, apiClient) {
       title: "Get Specs",
       description: "Retrieve SystemDox specifications (proposal, requirements with RFC 2119 keywords, Given/When/Then scenarios). Get a specific spec by ID, filter by status, or search by keyword.",
       inputSchema: {
-        spec_id: z2.string().optional().describe("Specific spec ID to retrieve with full content"),
+        draft_id: z2.string().optional().describe("Specific spec ID to retrieve with full content"),
         status: z2.enum(["draft", "ready", "archived"]).optional().describe("Filter by status"),
         search: z2.string().optional().describe("Keyword search across spec names")
       }
     },
-    async ({ spec_id, status, search }) => {
-      if (spec_id) {
+    async ({ draft_id, status, search }) => {
+      if (draft_id) {
         const spec = await apiClient.get(
-          `/v1/specs/${spec_id}`
+          `/v1/specs/${draft_id}`
         );
         const sections = [`# ${spec.name}
 
@@ -404,7 +423,7 @@ ${spec.taskContent}`);
         };
       }
       const text = filtered.map(
-        (s) => `- **${s.name}** (${s.specId}) \u2014 ${s.status}, ${s.requirementCount} requirements` + (s.repoFullName ? `, repo: ${s.repoFullName}` : "")
+        (s) => `- **${s.name}** (${s.draftId}) \u2014 ${s.status}, ${s.requirementCount} requirements` + (s.repoFullName ? `, repo: ${s.repoFullName}` : "")
       ).join("\n");
       return {
         content: [
@@ -1045,7 +1064,7 @@ ${g.fix}
 }
 function formatSpecHeadline(s) {
   return `### ${s.name}
-\`spec_id: ${s.specId}\` \xB7 ${s.status} \xB7 ${s.requirementCount} requirements`;
+\`draft_id: ${s.draftId}\` \xB7 ${s.status} \xB7 ${s.requirementCount} requirements`;
 }
 function formatDocHeadline(d) {
   return `### ${d.title}
@@ -1077,9 +1096,9 @@ function formatRules(rules) {
 
 ${text.trim()}`;
 }
-async function fetchSpecBody(api, specId) {
+async function fetchSpecBody(api, draftId) {
   const spec = await api.get(
-    `/v1/specs/${encodeURIComponent(specId)}`
+    `/v1/specs/${encodeURIComponent(draftId)}`
   );
   const parts = [];
   if (spec.proposalContent) {
@@ -1195,16 +1214,16 @@ async function buildContext(api, { taskDescription, filePaths = [], maxTokens })
       updatedAt: g.updatedAt
     })),
     ...specs.filter((s) => s.status !== "archived").map((s) => {
-      refs.set(key("spec", s.specId), {
+      refs.set(key("spec", s.draftId), {
         type: "spec",
-        id: s.specId,
+        id: s.draftId,
         title: s.name,
-        listLine: `- **${s.name}** \u2014 \`spec_id: ${s.specId}\` (${s.status}, ${s.requirementCount} requirements)`,
-        fetchHint: `get_specs(spec_id="${s.specId}")`
+        listLine: `- **${s.name}** \u2014 \`draft_id: ${s.draftId}\` (${s.status}, ${s.requirementCount} requirements)`,
+        fetchHint: `get_specs(draft_id="${s.draftId}")`
       });
       return {
         type: "spec",
-        id: s.specId,
+        id: s.draftId,
         title: s.name,
         content: formatSpecHeadline(s),
         updatedAt: s.updatedAt
@@ -1518,7 +1537,7 @@ function registerUpdateSpec(server, apiClient) {
       title: "Update Spec",
       description: "Update an existing SystemDox spec's proposal, tasks, or requirements. Only draft specs can be modified \u2014 published specs must be versioned first.",
       inputSchema: {
-        spec_id: z8.string().describe("ID of the spec to update"),
+        draft_id: z8.string().describe("ID of the spec to update"),
         section: z8.enum(["proposal", "tasks", "requirements"]).describe("Which section to update"),
         content: z8.string().describe(
           "New markdown content for the section. For requirements, provide the full requirement content."
@@ -1531,8 +1550,8 @@ function registerUpdateSpec(server, apiClient) {
         readOnlyHint: false
       }
     },
-    async ({ spec_id, section, content, requirement_name }) => {
-      const spec = await apiClient.get(`/v1/specs/${spec_id}`);
+    async ({ draft_id, section, content, requirement_name }) => {
+      const spec = await apiClient.get(`/v1/specs/${draft_id}`);
       if (spec.status !== "draft") {
         return {
           content: [
@@ -1557,8 +1576,8 @@ function registerUpdateSpec(server, apiClient) {
         };
         body.requirements = [...existing, newReq];
       }
-      await apiClient.put(`/v1/specs/${spec_id}`, body);
-      apiClient.invalidateCache(`/v1/specs/${spec_id}`);
+      await apiClient.put(`/v1/specs/${draft_id}`, body);
+      apiClient.invalidateCache(`/v1/specs/${draft_id}`);
       apiClient.invalidateCache("/v1/specs");
       return {
         content: [
@@ -1617,7 +1636,7 @@ ${decision}
 ## Consequences
 
 ${consequences}` + relatedSection;
-      await apiClient.put(`/v1/specs/${created.specId}`, {
+      await apiClient.put(`/v1/specs/${created.draftId}`, {
         proposalContent: adrContent
       });
       apiClient.invalidateCache("/v1/specs");
@@ -1625,7 +1644,7 @@ ${consequences}` + relatedSection;
         content: [
           {
             type: "text",
-            text: `Architecture decision recorded: **${adrTitle}** (spec id: ${created.specId})
+            text: `Architecture decision recorded: **${adrTitle}** (spec id: ${created.draftId})
 
 Status: draft \u2014 review in SystemDox before publishing.`
           }
@@ -1825,7 +1844,7 @@ function registerCreatePromptTemplate(server, apiClient) {
 }
 
 // src/server.ts
-var SERVER_VERSION = true ? "0.1.28" : "0.0.0-dev";
+var SERVER_VERSION = true ? "0.1.30" : "0.0.0-dev";
 function createServer(apiClient) {
   const server = new McpServer({
     name: "systemdox-mcp-server",
@@ -1896,9 +1915,16 @@ async function handler(event) {
   }
   const rawBody = event.isBase64Encoded ? Buffer.from(event.body ?? "", "base64").toString("utf8") : event.body ?? "";
   emitMcpToolCalls(keyTenant, rawBody);
+  let apiUrl;
+  try {
+    apiUrl = requireHttpsApiUrl(process.env.SYSTEMDOX_API_URL ?? API_URL_DEFAULT);
+  } catch (err) {
+    console.error("Refusing to proxy MCP tool calls:", err);
+    return jsonError(500, "Server misconfigured: API URL must use https://");
+  }
   const apiClient = new SystemDoxApiClient({
     apiKey,
-    apiUrl: process.env.SYSTEMDOX_API_URL ?? "https://api.puglieseweb.com/systemdox",
+    apiUrl,
     cacheTtlMs: 0,
     // per-request client; never cache across invocations
     defaultOrg: void 0

package/dist/index.js

@@ -348,15 +348,15 @@ function registerGetSpecs(server2, apiClient2) {
       title: "Get Specs",
       description: "Retrieve SystemDox specifications (proposal, requirements with RFC 2119 keywords, Given/When/Then scenarios). Get a specific spec by ID, filter by status, or search by keyword.",
       inputSchema: {
-        spec_id: z2.string().optional().describe("Specific spec ID to retrieve with full content"),
+        draft_id: z2.string().optional().describe("Specific spec ID to retrieve with full content"),
         status: z2.enum(["draft", "ready", "archived"]).optional().describe("Filter by status"),
         search: z2.string().optional().describe("Keyword search across spec names")
       }
     },
-    async ({ spec_id, status, search }) => {
-      if (spec_id) {
+    async ({ draft_id, status, search }) => {
+      if (draft_id) {
         const spec = await apiClient2.get(
-          `/v1/specs/${spec_id}`
+          `/v1/specs/${draft_id}`
         );
         const sections = [`# ${spec.name}
 
@@ -405,7 +405,7 @@ ${spec.taskContent}`);
         };
       }
       const text = filtered.map(
-        (s) => `- **${s.name}** (${s.specId}) \u2014 ${s.status}, ${s.requirementCount} requirements` + (s.repoFullName ? `, repo: ${s.repoFullName}` : "")
+        (s) => `- **${s.name}** (${s.draftId}) \u2014 ${s.status}, ${s.requirementCount} requirements` + (s.repoFullName ? `, repo: ${s.repoFullName}` : "")
       ).join("\n");
       return {
         content: [
@@ -1046,7 +1046,7 @@ ${g.fix}
 }
 function formatSpecHeadline(s) {
   return `### ${s.name}
-\`spec_id: ${s.specId}\` \xB7 ${s.status} \xB7 ${s.requirementCount} requirements`;
+\`draft_id: ${s.draftId}\` \xB7 ${s.status} \xB7 ${s.requirementCount} requirements`;
 }
 function formatDocHeadline(d) {
   return `### ${d.title}
@@ -1078,9 +1078,9 @@ function formatRules(rules) {
 
 ${text.trim()}`;
 }
-async function fetchSpecBody(api, specId) {
+async function fetchSpecBody(api, draftId) {
   const spec = await api.get(
-    `/v1/specs/${encodeURIComponent(specId)}`
+    `/v1/specs/${encodeURIComponent(draftId)}`
   );
   const parts = [];
   if (spec.proposalContent) {
@@ -1196,16 +1196,16 @@ async function buildContext(api, { taskDescription, filePaths = [], maxTokens })
       updatedAt: g.updatedAt
     })),
     ...specs.filter((s) => s.status !== "archived").map((s) => {
-      refs.set(key("spec", s.specId), {
+      refs.set(key("spec", s.draftId), {
         type: "spec",
-        id: s.specId,
+        id: s.draftId,
         title: s.name,
-        listLine: `- **${s.name}** \u2014 \`spec_id: ${s.specId}\` (${s.status}, ${s.requirementCount} requirements)`,
-        fetchHint: `get_specs(spec_id="${s.specId}")`
+        listLine: `- **${s.name}** \u2014 \`draft_id: ${s.draftId}\` (${s.status}, ${s.requirementCount} requirements)`,
+        fetchHint: `get_specs(draft_id="${s.draftId}")`
       });
       return {
         type: "spec",
-        id: s.specId,
+        id: s.draftId,
         title: s.name,
         content: formatSpecHeadline(s),
         updatedAt: s.updatedAt
@@ -1519,7 +1519,7 @@ function registerUpdateSpec(server2, apiClient2) {
       title: "Update Spec",
       description: "Update an existing SystemDox spec's proposal, tasks, or requirements. Only draft specs can be modified \u2014 published specs must be versioned first.",
       inputSchema: {
-        spec_id: z8.string().describe("ID of the spec to update"),
+        draft_id: z8.string().describe("ID of the spec to update"),
         section: z8.enum(["proposal", "tasks", "requirements"]).describe("Which section to update"),
         content: z8.string().describe(
           "New markdown content for the section. For requirements, provide the full requirement content."
@@ -1532,8 +1532,8 @@ function registerUpdateSpec(server2, apiClient2) {
         readOnlyHint: false
       }
     },
-    async ({ spec_id, section, content, requirement_name }) => {
-      const spec = await apiClient2.get(`/v1/specs/${spec_id}`);
+    async ({ draft_id, section, content, requirement_name }) => {
+      const spec = await apiClient2.get(`/v1/specs/${draft_id}`);
       if (spec.status !== "draft") {
         return {
           content: [
@@ -1558,8 +1558,8 @@ function registerUpdateSpec(server2, apiClient2) {
         };
         body.requirements = [...existing, newReq];
       }
-      await apiClient2.put(`/v1/specs/${spec_id}`, body);
-      apiClient2.invalidateCache(`/v1/specs/${spec_id}`);
+      await apiClient2.put(`/v1/specs/${draft_id}`, body);
+      apiClient2.invalidateCache(`/v1/specs/${draft_id}`);
       apiClient2.invalidateCache("/v1/specs");
       return {
         content: [
@@ -1618,7 +1618,7 @@ ${decision}
 ## Consequences
 
 ${consequences}` + relatedSection;
-      await apiClient2.put(`/v1/specs/${created.specId}`, {
+      await apiClient2.put(`/v1/specs/${created.draftId}`, {
         proposalContent: adrContent
       });
       apiClient2.invalidateCache("/v1/specs");
@@ -1626,7 +1626,7 @@ ${consequences}` + relatedSection;
         content: [
           {
             type: "text",
-            text: `Architecture decision recorded: **${adrTitle}** (spec id: ${created.specId})
+            text: `Architecture decision recorded: **${adrTitle}** (spec id: ${created.draftId})
 
 Status: draft \u2014 review in SystemDox before publishing.`
           }
@@ -1826,7 +1826,7 @@ function registerCreatePromptTemplate(server2, apiClient2) {
 }
 
 // src/server.ts
-var SERVER_VERSION = true ? "0.1.28" : "0.0.0-dev";
+var SERVER_VERSION = true ? "0.1.30" : "0.0.0-dev";
 function createServer(apiClient2) {
   const server2 = new McpServer({
     name: "systemdox-mcp-server",

package/dist/lib/context-builder.d.ts

@@ -17,7 +17,7 @@ export interface Guardrail {
     updatedAt: string;
 }
 export interface SpecSummary {
-    specId: string;
+    draftId: string;
     name: string;
     status: string;
     requirementCount: number;

package/dist/lib/context-builder.js

@@ -279,7 +279,7 @@ ${g.fix}
 }
 function formatSpecHeadline(s) {
   return `### ${s.name}
-\`spec_id: ${s.specId}\` \xB7 ${s.status} \xB7 ${s.requirementCount} requirements`;
+\`draft_id: ${s.draftId}\` \xB7 ${s.status} \xB7 ${s.requirementCount} requirements`;
 }
 function formatDocHeadline(d) {
   return `### ${d.title}
@@ -311,9 +311,9 @@ function formatRules(rules) {
 
 ${text.trim()}`;
 }
-async function fetchSpecBody(api, specId) {
+async function fetchSpecBody(api, draftId) {
   const spec = await api.get(
-    `/v1/specs/${encodeURIComponent(specId)}`
+    `/v1/specs/${encodeURIComponent(draftId)}`
   );
   const parts = [];
   if (spec.proposalContent) {
@@ -429,16 +429,16 @@ async function buildContext(api, { taskDescription, filePaths = [], maxTokens })
       updatedAt: g.updatedAt
     })),
     ...specs.filter((s) => s.status !== "archived").map((s) => {
-      refs.set(key("spec", s.specId), {
+      refs.set(key("spec", s.draftId), {
         type: "spec",
-        id: s.specId,
+        id: s.draftId,
         title: s.name,
-        listLine: `- **${s.name}** \u2014 \`spec_id: ${s.specId}\` (${s.status}, ${s.requirementCount} requirements)`,
-        fetchHint: `get_specs(spec_id="${s.specId}")`
+        listLine: `- **${s.name}** \u2014 \`draft_id: ${s.draftId}\` (${s.status}, ${s.requirementCount} requirements)`,
+        fetchHint: `get_specs(draft_id="${s.draftId}")`
       });
       return {
         type: "spec",
-        id: s.specId,
+        id: s.draftId,
         title: s.name,
         content: formatSpecHeadline(s),
         updatedAt: s.updatedAt

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@systemdox/mcp-server",
-  "version": "0.1.28",
+  "version": "0.1.30",
   "mcpName": "io.github.puglieseweb/systemdox",
   "type": "module",
   "description": "Give AI coding agents your architecture context over MCP — checks, specs, ADRs, project rules, and docs from SystemDox, delivered at write time",