@systemdox/mcp-server 0.1.55 → 0.1.57

package/README.md

@@ -25,8 +25,10 @@ MCP-compatible tool read that context — and write decisions back.
 
 1. SystemDox is in private preview. [Request early access](https://www.systemdox.com)
    to get a workspace.
-2. Connect a GitHub repository and generate an API key (workspace settings).
-3. Add the server to your tool — hosted (Option A) or local (Option B) below.
+2. Connect a GitHub repository.
+3. Paste `https://<your-workspace>.mcp.systemdox.com/connect` into Claude and
+   sign in, or generate an API key (workspace settings) and add the server to
+   your tool — hosted (Option A) or local (Option B) below.
 
 Docs: [MCP setup guide](https://www.systemdox.com/guides/mcp-setup) ·
 [Documentation standard](https://www.systemdox.com/guides/documentation-standard) ·
@@ -34,9 +36,27 @@ Docs: [MCP setup guide](https://www.systemdox.com/guides/mcp-setup) ·
 
 ---
 
-There are two ways to run it. Both authenticate with a SystemDox API key
-(generate one on your SystemDox settings page) and act strictly as the caller —
-every tool call is scoped to that key's tenant.
+## Connect by signing in
+
+Your workspace has its own address. Paste it into Claude's Settings → Connectors,
+or run:
+
+```bash
+claude mcp add --transport http systemdox https://<your-workspace>.mcp.systemdox.com/connect
+```
+
+Your browser opens SystemDox. Sign in with your second factor and approve. It only
+reads unless you choose to allow writes. Claude holds a token for an hour, renewed
+for you, and the API key behind the connection stays with SystemDox. Only an owner
+or admin of the workspace can connect this way for now, and an account that signs
+in only with Google or Apple cannot.
+
+## With an API key
+
+There are two more ways to run it, for scripts, CI and other tools. Both
+authenticate with a SystemDox API key (generate one on your SystemDox settings
+page) and act strictly as the caller — every tool call is scoped to that key's
+tenant.
 
 ## Option A — Hosted endpoint (no install)
 

package/dist/cli.js

@@ -267,6 +267,17 @@ var init_cache = __esm({
 });
 
 // src/lib/api-client.ts
+function unescapedPath(path) {
+  let current = path.split(/[?#]/, 1)[0];
+  for (; ; ) {
+    const next = current.replace(/[\t\n\r]/g, "").replace(/%(?:2e|2f|5c|25|09|0a|0d)/gi, (escape) => decodeURIComponent(escape));
+    if (next === current) return current;
+    current = next;
+  }
+}
+function walksThePath(path) {
+  return unescapedPath(path).split(/[/\\]/).some((segment) => segment === "." || segment === "..");
+}
 var SystemDoxApiError, TEAM_SETUP, seg, SystemDoxApiClient;
 var init_api_client = __esm({
   "src/lib/api-client.ts"() {
@@ -327,7 +338,7 @@ var init_api_client = __esm({
       }
       async mutate(method, path, body) {
         const url = this.buildUrl(path);
-        const res = await fetch(url, {
+        const res = await this.call(url, {
           method,
           headers: {
             // The API Gateway authorizer only reads the Authorization header;
@@ -377,7 +388,7 @@ var init_api_client = __esm({
       /** getPluginZip: the zip's bytes as served, and its X-Content-SHA256
        * header. The caller checks the BYTES against the hash it was given. */
       async getPluginZip(workspace, version) {
-        const res = await fetch(
+        const res = await this.call(
           this.buildUrl(`${TEAM_SETUP}/${seg(workspace)}/plugin/versions/${seg(version)}/zip`),
           {
             headers: {
@@ -443,6 +454,10 @@ var init_api_client = __esm({
       buildUrl(path, params) {
         const base = this.config.apiUrl.replace(/\/+$/, "");
         const url = new URL(`${base}${path.startsWith("/") ? "" : "/"}${path}`);
+        const { origin, pathname } = new URL(base);
+        if (walksThePath(path) || url.origin !== origin || !url.pathname.startsWith(`${pathname.replace(/\/+$/, "")}/`)) {
+          throw new Error("Refused: this id leaves the API's own path.");
+        }
         if (params) {
           for (const [key, value] of Object.entries(params)) {
             url.searchParams.set(key, value);
@@ -452,7 +467,7 @@ var init_api_client = __esm({
       }
       async fetchRaw(path, params, signal) {
         const url = this.buildUrl(path, params);
-        return fetch(url, {
+        return this.call(url, {
           headers: {
             Authorization: `Bearer ${this.config.apiKey}`,
             "X-API-Key": this.config.apiKey,
@@ -461,6 +476,16 @@ var init_api_client = __esm({
           signal
         });
       }
+      /** Every call of this client, so `onAnswer` hears each answer. */
+      async call(url, init) {
+        const res = await fetch(url, init);
+        const { onAnswer } = this.config;
+        if (onAnswer) {
+          const refused2 = res.ok ? void 0 : new SystemDoxApiError(res.status, await res.clone().text());
+          onAnswer({ status: res.status, code: refused2?.code });
+        }
+        return res;
+      }
     };
   }
 });
@@ -2889,7 +2914,7 @@ function registerGetSpecs(server, apiClient2) {
     async ({ draft_id, status, search }) => {
       if (draft_id) {
         const spec = await apiClient2.get(
-          `/v1/specs/${draft_id}`
+          `/v1/specs/${encodeURIComponent(draft_id)}`
         );
         const sections = [`# ${spec.name}
 
@@ -4617,7 +4642,8 @@ function registerUpdateSpec(server, apiClient2) {
       }
     },
     async ({ draft_id, section, content, requirement_name }) => {
-      const spec = await apiClient2.get(`/v1/specs/${draft_id}`);
+      const specPath = `/v1/specs/${encodeURIComponent(draft_id)}`;
+      const spec = await apiClient2.get(specPath);
       if (spec.status !== "draft") {
         return {
           content: [
@@ -4642,8 +4668,8 @@ function registerUpdateSpec(server, apiClient2) {
         };
         body.requirements = [...existing, newReq];
       }
-      await apiClient2.put(`/v1/specs/${draft_id}`, body);
-      apiClient2.invalidateCache(`/v1/specs/${draft_id}`);
+      await apiClient2.put(specPath, body);
+      apiClient2.invalidateCache(specPath);
       apiClient2.invalidateCache("/v1/specs");
       return {
         content: [
@@ -4707,7 +4733,7 @@ ${decision}
 ## Consequences
 
 ${consequences}` + relatedSection;
-      await apiClient2.put(`/v1/specs/${created.draftId}`, {
+      await apiClient2.put(`/v1/specs/${encodeURIComponent(created.draftId)}`, {
         proposalContent: adrContent
       });
       apiClient2.invalidateCache("/v1/specs");
@@ -5294,14 +5320,25 @@ var init_team_setup = __esm({
 
 // src/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-function createServer(apiClient2, { localFiles = false, instructions, keyProblem: keyProblem2 } = {}) {
-  const server = new McpServer(
+function offering(server, access) {
+  const offered = new Set(access === "write" ? [...READ_TOOLS, ...WRITE_TOOLS] : READ_TOOLS);
+  return new Proxy(server, {
+    get(target, property) {
+      const value = Reflect.get(target, property, target);
+      if (property !== "registerTool") return typeof value === "function" ? value.bind(target) : value;
+      return (name, ...rest) => offered.has(name) ? target.registerTool(name, ...rest) : void 0;
+    }
+  });
+}
+function createServer(apiClient2, { localFiles = false, instructions, keyProblem: keyProblem2, access } = {}) {
+  const mcpServer = new McpServer(
     {
       name: "systemdox-mcp-server",
       version: SERVER_VERSION
     },
     instructions ? { instructions } : void 0
   );
+  const server = access ? offering(mcpServer, access) : mcpServer;
   registerGetGuardrails(server, apiClient2);
   registerGetSpecs(server, apiClient2);
   registerGetDocs(server, apiClient2);
@@ -5321,9 +5358,9 @@ function createServer(apiClient2, { localFiles = false, instructions, keyProblem
   registerCreatePromptTemplate(server, apiClient2);
   registerSkillTools(server, apiClient2, { localFiles });
   registerTeamSetupTools(server, apiClient2, { localFiles });
-  return server;
+  return mcpServer;
 }
-var SERVER_VERSION;
+var SERVER_VERSION, READ_TOOLS, WRITE_TOOLS;
 var init_server = __esm({
   "src/server.ts"() {
     "use strict";
@@ -5346,7 +5383,37 @@ var init_server = __esm({
     init_create_prompt_template();
     init_skills2();
     init_team_setup();
-    SERVER_VERSION = true ? "0.1.55" : "0.0.0-dev";
+    SERVER_VERSION = true ? "0.1.57" : "0.0.0-dev";
+    READ_TOOLS = [
+      "get_context",
+      "get_checks",
+      "get_guardrails",
+      "get_project_rules",
+      "get_prompt_templates",
+      "get_specs",
+      "get_docs",
+      "get_tech_stack",
+      "get_planning_context",
+      "get_plan_board",
+      "get_change",
+      "get_team_setup",
+      "get_document_links",
+      "trace_document_path",
+      "get_graph_stats",
+      "list_skills",
+      "install_skill",
+      "resolve_person"
+    ];
+    WRITE_TOOLS = [
+      "create_check",
+      "create_guardrail",
+      "create_project_rule",
+      "create_prompt_template",
+      "update_spec",
+      "report_decision",
+      "publish_skill",
+      "publish_setup_part"
+    ];
   }
 });