@tacitai/mcp-server 0.1.1 → 0.2.0

package/dist/tools/web-url.d.ts

@@ -0,0 +1,57 @@
+import { z } from 'zod';
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export interface ToolRequest {
+    execute(): Promise<{
+        content: Array<{
+            type: 'text';
+            text: string;
+        }>;
+        isError?: boolean;
+    }>;
+}
+export declare const webUrlInputSchema: z.ZodObject<{
+    entity_type: z.ZodEnum<["artifact", "kb_article", "dossier", "dossier_summary", "dossier_scorecard", "dossier_deliverable", "guest", "knowledge"]>;
+    id: z.ZodString;
+    collection_id: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    id: string;
+    entity_type: "artifact" | "kb_article" | "dossier" | "dossier_summary" | "dossier_scorecard" | "dossier_deliverable" | "guest" | "knowledge";
+    collection_id?: string | undefined;
+}, {
+    id: string;
+    entity_type: "artifact" | "kb_article" | "dossier" | "dossier_summary" | "dossier_scorecard" | "dossier_deliverable" | "guest" | "knowledge";
+    collection_id?: string | undefined;
+}>;
+export type WebUrlInput = z.infer<typeof webUrlInputSchema>;
+export declare const WEB_URL_TOOL_DEF: {
+    name: "tacit_web_url";
+    description: string;
+    inputSchema: {
+        type: "object";
+        properties: {
+            entity_type: {
+                type: string;
+                enum: ("artifact" | "kb_article" | "dossier" | "dossier_summary" | "dossier_scorecard" | "dossier_deliverable" | "guest" | "knowledge")[];
+                description: string;
+            };
+            id: {
+                type: string;
+                description: string;
+            };
+            collection_id: {
+                type: string;
+                description: string;
+            };
+        };
+        required: string[];
+    };
+};
+export declare function buildWebUrlRequest(input: WebUrlInput): ToolRequest;
+export declare function handleWebUrl(args: unknown): Promise<{
+    content: Array<{
+        type: 'text';
+        text: string;
+    }>;
+    isError?: boolean;
+}>;
+export declare function registerWebUrlTools(server: McpServer): void;

package/dist/tools/web-url.js

@@ -0,0 +1,74 @@
+// SPDX-License-Identifier: MIT
+import { z } from 'zod';
+import { getClient } from '../client.js';
+const ENTITY_TYPES = [
+    'artifact',
+    'kb_article',
+    'dossier',
+    'dossier_summary',
+    'dossier_scorecard',
+    'dossier_deliverable',
+    'guest',
+    'knowledge',
+];
+export const webUrlInputSchema = z.object({
+    entity_type: z.enum(ENTITY_TYPES).describe('Entity type: artifact, kb_article, dossier, dossier_summary, dossier_scorecard, dossier_deliverable, guest, knowledge'),
+    id: z.string().min(1).describe('UUID of the entity'),
+    collection_id: z.string().optional().describe('Required for kb_article (the parent collection UUID) and dossier_deliverable (the parent dossier UUID)'),
+});
+export const WEB_URL_TOOL_DEF = {
+    name: 'tacit_web_url',
+    description: 'Get the TACIT web app URL for an entity. Returns a direct browser link. ' +
+        'Requires TACIT_APP_URL to be configured. For kb_article, collection_id is required.',
+    inputSchema: {
+        type: 'object',
+        properties: {
+            entity_type: {
+                type: 'string',
+                enum: [...ENTITY_TYPES],
+                description: 'Entity type',
+            },
+            id: { type: 'string', description: 'UUID of the entity' },
+            collection_id: { type: 'string', description: 'Parent collection UUID (required for kb_article, dossier_deliverable)' },
+        },
+        required: ['entity_type', 'id'],
+    },
+};
+export function buildWebUrlRequest(input) {
+    return {
+        async execute() {
+            const client = getClient();
+            const url = client.webUrl(input.entity_type, input.id, {
+                collectionId: input.collection_id,
+            });
+            if (!url) {
+                return {
+                    content: [{
+                            type: 'text',
+                            text: 'TACIT_APP_URL is not configured. Set it in the MCP server environment or profile to enable web URLs.',
+                        }],
+                    isError: true,
+                };
+            }
+            return {
+                content: [{ type: 'text', text: JSON.stringify({ web_url: url, entity_type: input.entity_type, id: input.id }) }],
+            };
+        },
+    };
+}
+export async function handleWebUrl(args) {
+    const parsed = webUrlInputSchema.safeParse(args);
+    if (!parsed.success) {
+        return { content: [{ type: 'text', text: `Invalid input: ${parsed.error.message}` }], isError: true };
+    }
+    return buildWebUrlRequest(parsed.data).execute();
+}
+export function registerWebUrlTools(server) {
+    server.tool('tacit_web_url', 'Get the TACIT web app URL for an entity.', {
+        entity_type: z.enum(ENTITY_TYPES).describe('Entity type'),
+        id: z.string().min(1).describe('UUID of the entity'),
+        collection_id: z.string().optional().describe('Parent collection UUID (required for kb_article, dossier_deliverable)'),
+    }, async (args) => {
+        return buildWebUrlRequest(args).execute();
+    });
+}

package/dist/tools/workspaces.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { TacitClient } from '../client.js';
+export declare function registerWorkspaceTools(server: McpServer, getClient: () => Promise<TacitClient>): void;

package/dist/tools/workspaces.js

@@ -0,0 +1,47 @@
+import { z } from 'zod';
+import { TacitApiError } from '../client.js';
+import { success, error } from './errors.js';
+export function registerWorkspaceTools(server, getClient) {
+    server.tool('tacit_list_workspaces', 'List all workspaces accessible to the authenticated user.', {}, async () => {
+        try {
+            const client = await getClient();
+            const data = await client.request('GET', '/api/v1/workspaces/mine');
+            return success(data);
+        }
+        catch (e) {
+            if (e instanceof TacitApiError)
+                return error(e.message);
+            return error(`Unexpected error: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    });
+    server.tool('tacit_switch_workspace', 'Switch the active workspace. All subsequent tool calls will operate on the new workspace.', {
+        workspace_id: z.string().uuid().describe('UUID of the workspace to switch to'),
+    }, async (args) => {
+        try {
+            const client = await getClient();
+            const result = await client.switchWorkspace(args.workspace_id);
+            return success({
+                message: `Switched to workspace: ${result.name}`,
+                workspace_id: result.workspace_id,
+                name: result.name,
+            });
+        }
+        catch (e) {
+            if (e instanceof TacitApiError)
+                return error(e.message);
+            return error(`Unexpected error: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    });
+    server.tool('tacit_current_workspace', 'Get the currently active workspace ID and name.', {}, async () => {
+        try {
+            const client = await getClient();
+            return success({
+                workspace_id: client.workspaceId,
+                name: client.workspaceName,
+            });
+        }
+        catch (e) {
+            return error(`Unexpected error: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    });
+}

package/dist/transport.d.ts

@@ -0,0 +1,9 @@
+/**
+ * HTTPS (Streamable HTTP) transport for external MCP clients.
+ *
+ * Stateless: a fresh transport per request, caller's bearer token bound via
+ * AsyncLocalStorage. Requests are serialized because a single McpServer can
+ * only be attached to one transport at a time.
+ */
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function startHttpTransport(server: McpServer): Promise<void>;

package/dist/transport.js

@@ -0,0 +1,209 @@
+// SPDX-License-Identifier: MIT
+/**
+ * HTTPS (Streamable HTTP) transport for external MCP clients.
+ *
+ * Stateless: a fresh transport per request, caller's bearer token bound via
+ * AsyncLocalStorage. Requests are serialized because a single McpServer can
+ * only be attached to one transport at a time.
+ */
+import * as http from 'node:http';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { RateLimiter, resolveAuth } from './auth.js';
+import { getBlockedReason, isBlockedOnHttps } from './tools/registry.js';
+import { runWithRequestContext } from './client.js';
+import { createHash } from 'node:crypto';
+import { isOAuthEnabled, handleAuthorizeGet, handleAuthorizePost, handleTokenExchange, handleClientRegistration, handleDiscovery, handleProtectedResource, startCleanupInterval, } from './oauth.js';
+const MAX_BODY_BYTES = 1_000_000;
+function setCors(res, allowGet = false) {
+    res.setHeader('Access-Control-Allow-Origin', '*');
+    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, Accept');
+    res.setHeader('Access-Control-Allow-Methods', allowGet ? 'GET, POST, OPTIONS' : 'POST, OPTIONS');
+}
+function sendJson(res, status, body) {
+    if (res.headersSent)
+        return;
+    res.writeHead(status, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(body));
+}
+function send401(res, message, invalidToken = false) {
+    if (res.headersSent)
+        return;
+    const wwwAuth = invalidToken
+        ? 'Bearer error="invalid_token", error_description="The access token is expired or invalid"'
+        : 'Bearer';
+    res.writeHead(401, {
+        'Content-Type': 'application/json',
+        'WWW-Authenticate': wwwAuth,
+    });
+    res.end(JSON.stringify({ error: message }));
+}
+function rpcError(id, code, message) {
+    return { jsonrpc: '2.0', id: id ?? null, error: { code, message } };
+}
+function readBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let size = 0;
+        req.on('data', (chunk) => {
+            size += chunk.length;
+            if (size > MAX_BODY_BYTES) {
+                reject(new Error('body too large'));
+                req.destroy();
+                return;
+            }
+            chunks.push(chunk);
+        });
+        req.on('end', () => resolve(Buffer.concat(chunks).toString('utf-8')));
+        req.on('error', reject);
+    });
+}
+function blockedToolCall(parsed) {
+    const messages = Array.isArray(parsed) ? parsed : [parsed];
+    for (const msg of messages) {
+        if (msg && typeof msg === 'object' && msg['method'] === 'tools/call') {
+            const m = msg;
+            const name = typeof m.params?.name === 'string' ? m.params.name : '';
+            if (isBlockedOnHttps(name))
+                return { id: m.id, tool: name, reason: getBlockedReason(name) ?? 'unknown_tool' };
+        }
+    }
+    return null;
+}
+function getClientIp(req) {
+    return req.headers['cf-connecting-ip']
+        ?? req.headers['x-forwarded-for']?.split(',')[0]?.trim()
+        ?? req.socket.remoteAddress
+        ?? 'unknown';
+}
+export async function startHttpTransport(server) {
+    const port = Number.parseInt(process.env['MCP_HTTPS_PORT'] ?? '8319', 10);
+    const apiUrl = (process.env['TACIT_API_URL'] ?? 'http://127.0.0.1:7473').replace(/\/$/, '');
+    const externalUrl = (process.env['MCP_EXTERNAL_URL'] ?? `http://127.0.0.1:${port}`).replace(/\/$/, '');
+    const limiter = new RateLimiter();
+    if (isOAuthEnabled()) {
+        startCleanupInterval();
+    }
+    let queue = Promise.resolve();
+    const handle = async (req, res) => {
+        const pathname = (req.url ?? '/').split('?')[0];
+        process.stderr.write(`[tacit-mcp-http] ${req.method} ${pathname}\n`);
+        // ── OPTIONS (all paths) ─────────────────────────────────────────────
+        if (req.method === 'OPTIONS') {
+            const isOAuthPath = pathname === '/authorize' || pathname.startsWith('/.well-known/');
+            setCors(res, isOAuthPath);
+            res.writeHead(204);
+            res.end();
+            return;
+        }
+        // ── Health ───────────────────────────────────────────────────────────
+        if (req.method === 'GET' && pathname === '/health') {
+            sendJson(res, 200, { status: 'ok' });
+            return;
+        }
+        // ── Rate limit (all endpoints) ──────────────────────────────────────
+        const ip = getClientIp(req);
+        if (!limiter.tryConsume(ip)) {
+            sendJson(res, 429, { error: 'rate limit exceeded' });
+            return;
+        }
+        // ── OAuth endpoints (bypass serialization queue) ────────────────────
+        if (isOAuthEnabled()) {
+            if (pathname === '/.well-known/oauth-authorization-server' && req.method === 'GET') {
+                setCors(res, true);
+                handleDiscovery(res, externalUrl);
+                return;
+            }
+            if (pathname === '/.well-known/oauth-protected-resource' && req.method === 'GET') {
+                setCors(res, true);
+                handleProtectedResource(res, `${externalUrl}/mcp`, externalUrl);
+                return;
+            }
+            if (pathname === '/authorize' && req.method === 'GET') {
+                setCors(res, true);
+                await handleAuthorizeGet(req, res);
+                return;
+            }
+            if (pathname === '/authorize' && req.method === 'POST') {
+                await handleAuthorizePost(req, res, apiUrl);
+                return;
+            }
+            if (pathname === '/token' && req.method === 'POST') {
+                await handleTokenExchange(req, res);
+                return;
+            }
+            if (pathname === '/register' && req.method === 'POST') {
+                setCors(res);
+                await handleClientRegistration(req, res);
+                return;
+            }
+        }
+        // ── MCP endpoint ────────────────────────────────────────────────────
+        if (pathname !== '/mcp' || req.method !== 'POST') {
+            setCors(res);
+            sendJson(res, 404, { error: 'not found' });
+            return;
+        }
+        setCors(res);
+        const auth = resolveAuth(req);
+        if (!auth) {
+            send401(res, 'missing or empty Bearer token');
+            return;
+        }
+        if (auth.type === 'invalid_token') {
+            send401(res, 'invalid or expired OAuth token', true);
+            return;
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(await readBody(req));
+        }
+        catch {
+            sendJson(res, 400, rpcError(null, -32700, 'Parse error'));
+            return;
+        }
+        const blocked = blockedToolCall(parsed);
+        if (blocked) {
+            sendJson(res, 200, rpcError(blocked.id, -32601, `Tool not available over HTTPS: ${blocked.tool} (reason: ${blocked.reason})`));
+            return;
+        }
+        const requestToken = auth.type === 'oauth' ? auth.info.tacit_token : auth.token;
+        const principal = auth.type === 'oauth'
+            ? auth.info.user_email
+            : createHash('sha256').update(auth.token).digest('hex').slice(0, 16);
+        const run = async () => {
+            const transport = new StreamableHTTPServerTransport({
+                sessionIdGenerator: undefined,
+                enableJsonResponse: true,
+            });
+            const done = new Promise((resolve) => res.on('close', () => resolve()));
+            try {
+                await server.connect(transport);
+                await runWithRequestContext(requestToken, apiUrl, () => transport.handleRequest(req, res, parsed), principal);
+                await done;
+            }
+            catch (err) {
+                process.stderr.write(`[tacit-mcp-http] request error: ${err instanceof Error ? err.message : String(err)}\n`);
+                sendJson(res, 500, rpcError(null, -32603, 'Internal error'));
+            }
+            finally {
+                await transport.close().catch(() => undefined);
+            }
+        };
+        const next = queue.then(run, run);
+        queue = next.catch(() => undefined);
+        await next;
+    };
+    const httpServer = http.createServer((req, res) => {
+        handle(req, res).catch((err) => {
+            process.stderr.write(`[tacit-mcp-http] fatal: ${err instanceof Error ? err.message : String(err)}\n`);
+            sendJson(res, 500, { error: 'internal error' });
+        });
+    });
+    await new Promise((resolve, reject) => {
+        httpServer.once('error', reject);
+        httpServer.listen(port, '127.0.0.1', () => {
+            process.stderr.write(`[tacit-mcp-http] listening on 127.0.0.1:${port}\n`);
+            resolve();
+        });
+    });
+}

package/package.json

@@ -1,19 +1,20 @@
 {
   "name": "@tacitai/mcp-server",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "stdio MCP server wrapping Tacit /api/v1 REST/SSE API",
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/scottkmcmillan/tacit.git",
+    "url": "git+https://github.com/scottkmcmillan/tacit.git",
     "directory": "packages/tacit-mcp-server"
   },
   "publishConfig": {
     "access": "public"
   },
+  "type": "module",
   "main": "dist/index.js",
   "bin": {
-    "tacit-mcp-server": "./dist/index.js"
+    "tacit-mcp-server": "dist/index.js"
   },
   "files": [
     "dist",
@@ -31,7 +32,7 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.0.0",
+    "@modelcontextprotocol/sdk": "^1.12.0",
     "semver": "^7.6.0",
     "zod": "^3.22.0"
   },