@tacitai/mcp-server 0.1.1 → 0.3.0

package/dist/tools/synthesize.js

@@ -1,4 +1,3 @@
-"use strict";
 // SPDX-License-Identifier: MIT
 /**
  * tacit_synthesize — canonical synthesis tool
@@ -9,18 +8,20 @@
  * Aliases: tacit_ask / tacit_compose route to this same handler.
  * stream:true selects the SSE variant and returns aggregated chunks.
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.SYNTHESIZE_TOOL_DEF = exports.synthesizeInputSchema = void 0;
-exports.buildSynthesizeRequest = buildSynthesizeRequest;
-exports.handleSynthesize = handleSynthesize;
-const zod_1 = require("zod");
-const client_js_1 = require("../client.js");
-exports.synthesizeInputSchema = zod_1.z.object({
-    query: zod_1.z.string().min(1).describe('Question or synthesis prompt'),
-    scope: zod_1.z.string().optional().describe('Optional scope filter (e.g. portfolio or program id)'),
-    stream: zod_1.z.boolean().optional().describe('If true, use SSE stream variant (/mind/synthesize/stream)'),
+import { z } from 'zod';
+import { getClient, TacitApiError, TokenExpiredError } from '../client.js';
+export const synthesizeInputSchema = z.object({
+    query: z.string().min(1).describe('Question or synthesis prompt'),
+    scope: z.string().optional().describe('Optional scope filter (e.g. portfolio or program id)'),
+    stream: z.boolean().optional().describe('If true, use SSE stream variant (/mind/synthesize/stream)'),
+    workspace_id: z.string().optional().describe('Optional workspace UUID'),
+    collection_ids: z.array(z.string()).optional().describe('Optional collection UUIDs to scope synthesis to'),
+    program_ids: z.array(z.string()).optional().describe('Optional program UUIDs to scope synthesis to'),
+    origin: z.string().optional().describe('Optional origin filter (e.g., PYRAMID, LAKE_SYNC, MANUAL) to scope results'),
+    synthesis_mode: z.enum(['burst', 'orbit', 'crew_compose']).optional().describe('Synthesis mode: burst (fast retrieval), orbit (agentic multi-turn), crew_compose (crew artifact generation). Default: burst.'),
+    max_turns: z.number().int().min(1).optional().describe('Max agentic loop iterations for orbit/crew_compose mode (1-12 for orbit, 1-54 for crew_compose).'),
 });
-exports.SYNTHESIZE_TOOL_DEF = {
+export const SYNTHESIZE_TOOL_DEF = {
     name: 'tacit_synthesize',
     description: 'Synthesize knowledge from the Tacit workspace. ' +
         'stream:false (default) → POST /api/v1/mind/synthesize (JSON). ' +
@@ -31,6 +32,12 @@ exports.SYNTHESIZE_TOOL_DEF = {
             query: { type: 'string', description: 'Question or synthesis prompt' },
             scope: { type: 'string', description: 'Optional scope filter' },
             stream: { type: 'boolean', description: 'Use SSE stream variant if true' },
+            workspace_id: { type: 'string', description: 'Optional workspace UUID' },
+            collection_ids: { type: 'array', items: { type: 'string' }, description: 'Optional collection UUIDs to scope synthesis to' },
+            program_ids: { type: 'array', items: { type: 'string' }, description: 'Optional program UUIDs to scope synthesis to' },
+            origin: { type: 'string', description: 'Optional origin filter (e.g., PYRAMID, LAKE_SYNC, MANUAL) to scope results' },
+            synthesis_mode: { type: 'string', enum: ['burst', 'orbit', 'crew_compose'], description: 'Synthesis mode: burst (fast retrieval), orbit (agentic multi-turn), crew_compose (crew artifact generation). Default: burst.' },
+            max_turns: { type: 'integer', minimum: 1, description: 'Max agentic loop iterations for orbit/crew_compose mode (1-12 for orbit, 1-54 for crew_compose).' },
         },
         required: ['query'],
     },
@@ -39,29 +46,53 @@ exports.SYNTHESIZE_TOOL_DEF = {
  * Build a synthesize request object. Call .execute() to perform the HTTP call.
  * Exported for testability (allows injecting a mock TacitClient).
  */
-function buildSynthesizeRequest(client, input) {
+export function buildSynthesizeRequest(client, input) {
     return {
         async execute() {
-            const { query, scope, stream } = input;
+            const { query, scope, stream, workspace_id, collection_ids, program_ids, origin, synthesis_mode, max_turns } = input;
             const body = { query };
             if (scope)
                 body['scope'] = scope;
+            if (workspace_id)
+                body['workspace_id'] = workspace_id;
+            if (collection_ids)
+                body['collection_ids'] = collection_ids;
+            if (program_ids)
+                body['program_ids'] = program_ids;
+            if (origin)
+                body['origin'] = origin;
+            if (synthesis_mode)
+                body['synthesis_mode'] = synthesis_mode;
+            if (max_turns)
+                body['max_turns'] = max_turns;
             try {
                 if (stream) {
                     // SSE path: POST /api/v1/mind/synthesize/stream
                     const chunks = [];
+                    let structuredAnswer = null;
                     for await (const chunk of client.postSSE('/api/v1/mind/synthesize/stream', body)) {
+                        try {
+                            const parsed = JSON.parse(chunk);
+                            if (parsed.type === 'structured_answer') {
+                                structuredAnswer = parsed.data;
+                                continue;
+                            }
+                        }
+                        catch {
+                            // not JSON — raw text chunk
+                        }
                         chunks.push(chunk);
                     }
-                    if (chunks.length === 0) {
+                    if (chunks.length === 0 && !structuredAnswer) {
                         return {
                             content: [{ type: 'text', text: JSON.stringify({ chunks: 0, text: '' }) }],
                         };
                     }
-                    // Aggregate: return all chunks as content items for D7 chunk counting.
-                    return {
-                        content: chunks.map((c) => ({ type: 'text', text: c })),
-                    };
+                    const contentItems = chunks.map((c) => ({ type: 'text', text: c }));
+                    if (structuredAnswer) {
+                        contentItems.push({ type: 'text', text: JSON.stringify({ structured_answer: structuredAnswer }) });
+                    }
+                    return { content: contentItems };
                 }
                 else {
                     // JSON path: POST /api/v1/mind/synthesize
@@ -72,7 +103,13 @@ function buildSynthesizeRequest(client, input) {
                 }
             }
             catch (err) {
-                if (err instanceof client_js_1.TacitApiError) {
+                if (err instanceof TokenExpiredError) {
+                    return {
+                        content: [{ type: 'text', text: err.message }],
+                        isError: true,
+                    };
+                }
+                if (err instanceof TacitApiError) {
                     return { content: [{ type: 'text', text: `API error ${err.statusCode}: ${err.body}` }], isError: true };
                 }
                 const msg = err instanceof Error ? err.message : String(err);
@@ -81,13 +118,33 @@ function buildSynthesizeRequest(client, input) {
         },
     };
 }
-async function handleSynthesize(args) {
-    const parsed = exports.synthesizeInputSchema.safeParse(args);
+export async function handleSynthesize(args) {
+    const parsed = synthesizeInputSchema.safeParse(args);
     if (!parsed.success) {
         return {
             content: [{ type: 'text', text: `Invalid input: ${parsed.error.message}` }],
             isError: true,
         };
     }
-    return buildSynthesizeRequest((0, client_js_1.getClient)(), parsed.data).execute();
+    return buildSynthesizeRequest(getClient(), parsed.data).execute();
+}
+const SYNTH_SCHEMA = {
+    query: z.string().min(1).describe('Question or synthesis prompt'),
+    scope: z.string().optional().describe('Optional scope filter (e.g. portfolio or program id)'),
+    stream: z.boolean().optional().describe('If true, use SSE stream variant (/mind/synthesize/stream)'),
+    workspace_id: z.string().optional().describe('Optional workspace UUID'),
+    collection_ids: z.array(z.string()).optional().describe('Optional collection UUIDs to scope synthesis to'),
+    program_ids: z.array(z.string()).optional().describe('Optional program UUIDs to scope synthesis to'),
+    origin: z.string().optional().describe('Optional origin filter (e.g., PYRAMID, LAKE_SYNC, MANUAL) to scope results'),
+    synthesis_mode: z.enum(['burst', 'orbit', 'crew_compose']).optional().describe('Synthesis mode: burst (fast retrieval), orbit (agentic multi-turn), crew_compose (crew artifact generation). Default: burst.'),
+    max_turns: z.number().int().min(1).optional().describe('Max agentic loop iterations for orbit/crew_compose mode (1-12 for orbit, 1-54 for crew_compose).'),
+};
+export function registerSynthesizeTools(server, getClientFn) {
+    const handler = async (args) => {
+        const client = await getClientFn();
+        return buildSynthesizeRequest(client, args).execute();
+    };
+    server.tool('tacit_synthesize', 'Synthesize knowledge from the Tacit workspace. synthesis_mode: burst (default, fast retrieval), orbit (agentic multi-turn), crew_compose (crew artifact generation). stream:false → JSON, stream:true → SSE.', SYNTH_SCHEMA, handler);
+    server.tool('tacit_ask', 'Ask a question against the Tacit workspace. Supports synthesis_mode: burst (default), orbit (agentic), crew_compose.', SYNTH_SCHEMA, handler);
+    server.tool('tacit_compose', 'Compose knowledge from the Tacit workspace. Supports synthesis_mode: burst (default), orbit (agentic), crew_compose.', SYNTH_SCHEMA, handler);
 }

package/dist/tools/web-url.d.ts

@@ -0,0 +1,57 @@
+import { z } from 'zod';
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export interface ToolRequest {
+    execute(): Promise<{
+        content: Array<{
+            type: 'text';
+            text: string;
+        }>;
+        isError?: boolean;
+    }>;
+}
+export declare const webUrlInputSchema: z.ZodObject<{
+    entity_type: z.ZodEnum<["artifact", "kb_article", "dossier", "dossier_summary", "dossier_scorecard", "dossier_deliverable", "guest", "knowledge"]>;
+    id: z.ZodString;
+    collection_id: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    id: string;
+    entity_type: "artifact" | "kb_article" | "dossier" | "dossier_summary" | "dossier_scorecard" | "dossier_deliverable" | "guest" | "knowledge";
+    collection_id?: string | undefined;
+}, {
+    id: string;
+    entity_type: "artifact" | "kb_article" | "dossier" | "dossier_summary" | "dossier_scorecard" | "dossier_deliverable" | "guest" | "knowledge";
+    collection_id?: string | undefined;
+}>;
+export type WebUrlInput = z.infer<typeof webUrlInputSchema>;
+export declare const WEB_URL_TOOL_DEF: {
+    name: "tacit_web_url";
+    description: string;
+    inputSchema: {
+        type: "object";
+        properties: {
+            entity_type: {
+                type: string;
+                enum: ("artifact" | "kb_article" | "dossier" | "dossier_summary" | "dossier_scorecard" | "dossier_deliverable" | "guest" | "knowledge")[];
+                description: string;
+            };
+            id: {
+                type: string;
+                description: string;
+            };
+            collection_id: {
+                type: string;
+                description: string;
+            };
+        };
+        required: string[];
+    };
+};
+export declare function buildWebUrlRequest(input: WebUrlInput): ToolRequest;
+export declare function handleWebUrl(args: unknown): Promise<{
+    content: Array<{
+        type: 'text';
+        text: string;
+    }>;
+    isError?: boolean;
+}>;
+export declare function registerWebUrlTools(server: McpServer): void;

package/dist/tools/web-url.js

@@ -0,0 +1,74 @@
+// SPDX-License-Identifier: MIT
+import { z } from 'zod';
+import { getClient } from '../client.js';
+const ENTITY_TYPES = [
+    'artifact',
+    'kb_article',
+    'dossier',
+    'dossier_summary',
+    'dossier_scorecard',
+    'dossier_deliverable',
+    'guest',
+    'knowledge',
+];
+export const webUrlInputSchema = z.object({
+    entity_type: z.enum(ENTITY_TYPES).describe('Entity type: artifact, kb_article, dossier, dossier_summary, dossier_scorecard, dossier_deliverable, guest, knowledge'),
+    id: z.string().min(1).describe('UUID of the entity'),
+    collection_id: z.string().optional().describe('Required for kb_article (the parent collection UUID) and dossier_deliverable (the parent dossier UUID)'),
+});
+export const WEB_URL_TOOL_DEF = {
+    name: 'tacit_web_url',
+    description: 'Get the TACIT web app URL for an entity. Returns a direct browser link. ' +
+        'Requires TACIT_APP_URL to be configured. For kb_article, collection_id is required.',
+    inputSchema: {
+        type: 'object',
+        properties: {
+            entity_type: {
+                type: 'string',
+                enum: [...ENTITY_TYPES],
+                description: 'Entity type',
+            },
+            id: { type: 'string', description: 'UUID of the entity' },
+            collection_id: { type: 'string', description: 'Parent collection UUID (required for kb_article, dossier_deliverable)' },
+        },
+        required: ['entity_type', 'id'],
+    },
+};
+export function buildWebUrlRequest(input) {
+    return {
+        async execute() {
+            const client = getClient();
+            const url = client.webUrl(input.entity_type, input.id, {
+                collectionId: input.collection_id,
+            });
+            if (!url) {
+                return {
+                    content: [{
+                            type: 'text',
+                            text: 'TACIT_APP_URL is not configured. Set it in the MCP server environment or profile to enable web URLs.',
+                        }],
+                    isError: true,
+                };
+            }
+            return {
+                content: [{ type: 'text', text: JSON.stringify({ web_url: url, entity_type: input.entity_type, id: input.id }) }],
+            };
+        },
+    };
+}
+export async function handleWebUrl(args) {
+    const parsed = webUrlInputSchema.safeParse(args);
+    if (!parsed.success) {
+        return { content: [{ type: 'text', text: `Invalid input: ${parsed.error.message}` }], isError: true };
+    }
+    return buildWebUrlRequest(parsed.data).execute();
+}
+export function registerWebUrlTools(server) {
+    server.tool('tacit_web_url', 'Get the TACIT web app URL for an entity.', {
+        entity_type: z.enum(ENTITY_TYPES).describe('Entity type'),
+        id: z.string().min(1).describe('UUID of the entity'),
+        collection_id: z.string().optional().describe('Parent collection UUID (required for kb_article, dossier_deliverable)'),
+    }, async (args) => {
+        return buildWebUrlRequest(args).execute();
+    });
+}

package/dist/tools/workspaces.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { TacitClient } from '../client.js';
+export declare function registerWorkspaceTools(server: McpServer, getClient: () => Promise<TacitClient>): void;

package/dist/tools/workspaces.js

@@ -0,0 +1,47 @@
+import { z } from 'zod';
+import { TacitApiError } from '../client.js';
+import { success, error } from './errors.js';
+export function registerWorkspaceTools(server, getClient) {
+    server.tool('tacit_list_workspaces', 'List all workspaces accessible to the authenticated user.', {}, async () => {
+        try {
+            const client = await getClient();
+            const data = await client.request('GET', '/api/v1/workspaces/mine');
+            return success(data);
+        }
+        catch (e) {
+            if (e instanceof TacitApiError)
+                return error(e.message);
+            return error(`Unexpected error: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    });
+    server.tool('tacit_switch_workspace', 'Switch the active workspace. All subsequent tool calls will operate on the new workspace.', {
+        workspace_id: z.string().uuid().describe('UUID of the workspace to switch to'),
+    }, async (args) => {
+        try {
+            const client = await getClient();
+            const result = await client.switchWorkspace(args.workspace_id);
+            return success({
+                message: `Switched to workspace: ${result.name}`,
+                workspace_id: result.workspace_id,
+                name: result.name,
+            });
+        }
+        catch (e) {
+            if (e instanceof TacitApiError)
+                return error(e.message);
+            return error(`Unexpected error: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    });
+    server.tool('tacit_current_workspace', 'Get the currently active workspace ID and name.', {}, async () => {
+        try {
+            const client = await getClient();
+            return success({
+                workspace_id: client.workspaceId,
+                name: client.workspaceName,
+            });
+        }
+        catch (e) {
+            return error(`Unexpected error: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    });
+}

package/dist/transport.d.ts

@@ -0,0 +1,9 @@
+/**
+ * HTTPS (Streamable HTTP) transport for external MCP clients.
+ *
+ * Stateless: a fresh transport per request, caller's bearer token bound via
+ * AsyncLocalStorage. Requests are serialized because a single McpServer can
+ * only be attached to one transport at a time.
+ */
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function startHttpTransport(server: McpServer): Promise<void>;

package/dist/transport.js

@@ -0,0 +1,209 @@
+// SPDX-License-Identifier: MIT
+/**
+ * HTTPS (Streamable HTTP) transport for external MCP clients.
+ *
+ * Stateless: a fresh transport per request, caller's bearer token bound via
+ * AsyncLocalStorage. Requests are serialized because a single McpServer can
+ * only be attached to one transport at a time.
+ */
+import * as http from 'node:http';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { RateLimiter, resolveAuth } from './auth.js';
+import { getBlockedReason, isBlockedOnHttps } from './tools/registry.js';
+import { runWithRequestContext } from './client.js';
+import { createHash } from 'node:crypto';
+import { isOAuthEnabled, handleAuthorizeGet, handleAuthorizePost, handleTokenExchange, handleClientRegistration, handleDiscovery, handleProtectedResource, startCleanupInterval, } from './oauth.js';
+const MAX_BODY_BYTES = 1_000_000;
+function setCors(res, allowGet = false) {
+    res.setHeader('Access-Control-Allow-Origin', '*');
+    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, Accept');
+    res.setHeader('Access-Control-Allow-Methods', allowGet ? 'GET, POST, OPTIONS' : 'POST, OPTIONS');
+}
+function sendJson(res, status, body) {
+    if (res.headersSent)
+        return;
+    res.writeHead(status, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(body));
+}
+function send401(res, message, invalidToken = false) {
+    if (res.headersSent)
+        return;
+    const wwwAuth = invalidToken
+        ? 'Bearer error="invalid_token", error_description="The access token is expired or invalid"'
+        : 'Bearer';
+    res.writeHead(401, {
+        'Content-Type': 'application/json',
+        'WWW-Authenticate': wwwAuth,
+    });
+    res.end(JSON.stringify({ error: message }));
+}
+function rpcError(id, code, message) {
+    return { jsonrpc: '2.0', id: id ?? null, error: { code, message } };
+}
+function readBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let size = 0;
+        req.on('data', (chunk) => {
+            size += chunk.length;
+            if (size > MAX_BODY_BYTES) {
+                reject(new Error('body too large'));
+                req.destroy();
+                return;
+            }
+            chunks.push(chunk);
+        });
+        req.on('end', () => resolve(Buffer.concat(chunks).toString('utf-8')));
+        req.on('error', reject);
+    });
+}
+function blockedToolCall(parsed) {
+    const messages = Array.isArray(parsed) ? parsed : [parsed];
+    for (const msg of messages) {
+        if (msg && typeof msg === 'object' && msg['method'] === 'tools/call') {
+            const m = msg;
+            const name = typeof m.params?.name === 'string' ? m.params.name : '';
+            if (isBlockedOnHttps(name))
+                return { id: m.id, tool: name, reason: getBlockedReason(name) ?? 'unknown_tool' };
+        }
+    }
+    return null;
+}
+function getClientIp(req) {
+    return req.headers['cf-connecting-ip']
+        ?? req.headers['x-forwarded-for']?.split(',')[0]?.trim()
+        ?? req.socket.remoteAddress
+        ?? 'unknown';
+}
+export async function startHttpTransport(server) {
+    const port = Number.parseInt(process.env['MCP_HTTPS_PORT'] ?? '8319', 10);
+    const apiUrl = (process.env['TACIT_API_URL'] ?? 'http://127.0.0.1:7473').replace(/\/$/, '');
+    const externalUrl = (process.env['MCP_EXTERNAL_URL'] ?? `http://127.0.0.1:${port}`).replace(/\/$/, '');
+    const limiter = new RateLimiter();
+    if (isOAuthEnabled()) {
+        startCleanupInterval();
+    }
+    let queue = Promise.resolve();
+    const handle = async (req, res) => {
+        const pathname = (req.url ?? '/').split('?')[0];
+        process.stderr.write(`[tacit-mcp-http] ${req.method} ${pathname}\n`);
+        // ── OPTIONS (all paths) ─────────────────────────────────────────────
+        if (req.method === 'OPTIONS') {
+            const isOAuthPath = pathname === '/authorize' || pathname.startsWith('/.well-known/');
+            setCors(res, isOAuthPath);
+            res.writeHead(204);
+            res.end();
+            return;
+        }
+        // ── Health ───────────────────────────────────────────────────────────
+        if (req.method === 'GET' && pathname === '/health') {
+            sendJson(res, 200, { status: 'ok' });
+            return;
+        }
+        // ── Rate limit (all endpoints) ──────────────────────────────────────
+        const ip = getClientIp(req);
+        if (!limiter.tryConsume(ip)) {
+            sendJson(res, 429, { error: 'rate limit exceeded' });
+            return;
+        }
+        // ── OAuth endpoints (bypass serialization queue) ────────────────────
+        if (isOAuthEnabled()) {
+            if (pathname === '/.well-known/oauth-authorization-server' && req.method === 'GET') {
+                setCors(res, true);
+                handleDiscovery(res, externalUrl);
+                return;
+            }
+            if (pathname === '/.well-known/oauth-protected-resource' && req.method === 'GET') {
+                setCors(res, true);
+                handleProtectedResource(res, `${externalUrl}/mcp`, externalUrl);
+                return;
+            }
+            if (pathname === '/authorize' && req.method === 'GET') {
+                setCors(res, true);
+                await handleAuthorizeGet(req, res);
+                return;
+            }
+            if (pathname === '/authorize' && req.method === 'POST') {
+                await handleAuthorizePost(req, res, apiUrl);
+                return;
+            }
+            if (pathname === '/token' && req.method === 'POST') {
+                await handleTokenExchange(req, res);
+                return;
+            }
+            if (pathname === '/register' && req.method === 'POST') {
+                setCors(res);
+                await handleClientRegistration(req, res);
+                return;
+            }
+        }
+        // ── MCP endpoint ────────────────────────────────────────────────────
+        if (pathname !== '/mcp' || req.method !== 'POST') {
+            setCors(res);
+            sendJson(res, 404, { error: 'not found' });
+            return;
+        }
+        setCors(res);
+        const auth = resolveAuth(req);
+        if (!auth) {
+            send401(res, 'missing or empty Bearer token');
+            return;
+        }
+        if (auth.type === 'invalid_token') {
+            send401(res, 'invalid or expired OAuth token', true);
+            return;
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(await readBody(req));
+        }
+        catch {
+            sendJson(res, 400, rpcError(null, -32700, 'Parse error'));
+            return;
+        }
+        const blocked = blockedToolCall(parsed);
+        if (blocked) {
+            sendJson(res, 200, rpcError(blocked.id, -32601, `Tool not available over HTTPS: ${blocked.tool} (reason: ${blocked.reason})`));
+            return;
+        }
+        const requestToken = auth.type === 'oauth' ? auth.info.tacit_token : auth.token;
+        const principal = auth.type === 'oauth'
+            ? auth.info.user_email
+            : createHash('sha256').update(auth.token).digest('hex').slice(0, 16);
+        const run = async () => {
+            const transport = new StreamableHTTPServerTransport({
+                sessionIdGenerator: undefined,
+                enableJsonResponse: true,
+            });
+            const done = new Promise((resolve) => res.on('close', () => resolve()));
+            try {
+                await server.connect(transport);
+                await runWithRequestContext(requestToken, apiUrl, () => transport.handleRequest(req, res, parsed), principal);
+                await done;
+            }
+            catch (err) {
+                process.stderr.write(`[tacit-mcp-http] request error: ${err instanceof Error ? err.message : String(err)}\n`);
+                sendJson(res, 500, rpcError(null, -32603, 'Internal error'));
+            }
+            finally {
+                await transport.close().catch(() => undefined);
+            }
+        };
+        const next = queue.then(run, run);
+        queue = next.catch(() => undefined);
+        await next;
+    };
+    const httpServer = http.createServer((req, res) => {
+        handle(req, res).catch((err) => {
+            process.stderr.write(`[tacit-mcp-http] fatal: ${err instanceof Error ? err.message : String(err)}\n`);
+            sendJson(res, 500, { error: 'internal error' });
+        });
+    });
+    await new Promise((resolve, reject) => {
+        httpServer.once('error', reject);
+        httpServer.listen(port, '127.0.0.1', () => {
+            process.stderr.write(`[tacit-mcp-http] listening on 127.0.0.1:${port}\n`);
+            resolve();
+        });
+    });
+}

package/package.json

@@ -1,19 +1,20 @@
 {
   "name": "@tacitai/mcp-server",
-  "version": "0.1.1",
+  "version": "0.3.0",
   "description": "stdio MCP server wrapping Tacit /api/v1 REST/SSE API",
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/scottkmcmillan/tacit.git",
+    "url": "git+https://github.com/scottkmcmillan/tacit.git",
     "directory": "packages/tacit-mcp-server"
   },
   "publishConfig": {
     "access": "public"
   },
+  "type": "module",
   "main": "dist/index.js",
   "bin": {
-    "tacit-mcp-server": "./dist/index.js"
+    "tacit-mcp-server": "dist/index.js"
   },
   "files": [
     "dist",
@@ -31,7 +32,7 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.0.0",
+    "@modelcontextprotocol/sdk": "^1.12.0",
     "semver": "^7.6.0",
     "zod": "^3.22.0"
   },