@taiga-ai/mcp-server 0.14.0-rc.426 → 0.16.0-dev.430

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@taiga-ai/mcp-server",
-  "version": "0.14.0-rc.426",
+  "version": "0.16.0-dev.430",
   "description": "MCP server for Taiga -- gives AI assistants access to documents and products",
   "type": "module",
   "main": "./dist/index.js",
@@ -13,6 +13,9 @@
       "default": "./dist/index.js"
     }
   },
+  "engines": {
+    "node": ">=20"
+  },
   "scripts": {
     "build": "tsc --noEmit && node scripts/build.mjs",
     "typecheck": "tsc --noEmit",
@@ -22,10 +25,11 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.30.0",
+    "@modelcontextprotocol/server": "^2.3.1",
     "zod": "^4.4.3"
   },
   "devDependencies": {
+    "@modelcontextprotocol/client": "^2.3.1",
     "@tsconfig/strictest": "^2.0.8",
     "@types/mdast": "^4.0.4",
     "@types/node": "^22.20.1",

package/scripts/build.mjs

@@ -9,10 +9,10 @@ const SHEBANG = '#!/usr/bin/env node';
  *
  * The published npm artifact must not reference private workspace packages, so
  * `@taiga/*` (notably `@taiga/feature-flags`, a runtime value) is inlined. The
- * genuinely-published deps — the MCP SDK and zod — stay external and are
+ * genuinely-published deps — the MCP server SDK and zod — stay external and are
  * installed normally by consumers. Node built-ins are external via platform.
  */
-const external = [/^@modelcontextprotocol\/sdk(\/|$)/, /^zod(\/|$)/, /^node:/];
+const external = [/^@modelcontextprotocol\/server(\/|$)/, /^zod(\/|$)/, /^node:/];
 
 const bundle = await rolldown({
   input: 'src/index.ts',

package/src/client.ts

@@ -45,6 +45,8 @@ export class TaigaApiError extends Error {
   readonly status: number;
   readonly code: string | undefined;
   readonly apiMessage: string | undefined;
+  /** A refusal's structured reason, when the API sent one: `{ reason, ... }` (a 409's discriminator and its data). */
+  readonly details: Record<string, unknown> | undefined;
 
   constructor(method: string, path: string, status: number, body: string) {
     const parsed = parseErrorBody(body);
@@ -53,6 +55,7 @@ export class TaigaApiError extends Error {
     this.status = status;
     this.code = parsed.code;
     this.apiMessage = parsed.message;
+    this.details = parsed.details;
   }
 }
 
@@ -84,7 +87,7 @@ function query(params: Record<string, string | number | boolean | null | undefin
   return text ? `?${text}` : '';
 }
 
-function parseErrorBody(body: string): { code?: string; message?: string } {
+function parseErrorBody(body: string): { code?: string; message?: string; details?: Record<string, unknown> } {
   try {
     const json = JSON.parse(body) as { code?: unknown; message?: unknown; details?: unknown };
     const message = typeof json.message === 'string' ? json.message : undefined;
@@ -97,9 +100,16 @@ function parseErrorBody(body: string): { code?: string; message?: string } {
           )
           .filter(Boolean)
       : [];
+    // A service refusal names its gate in an object (`reason`, and what it
+    // found, such as the documents still missing); the model needs both.
+    const structured =
+      typeof json.details === 'object' && json.details !== null && !Array.isArray(json.details)
+        ? (json.details as Record<string, unknown>)
+        : undefined;
     return {
       ...(typeof json.code === 'string' ? { code: json.code } : {}),
       ...(message ? { message: details.length ? `${message}: ${details.join('; ')}` : message } : {}),
+      ...(structured ? { details: structured } : {}),
     };
   } catch {
     return {};
@@ -753,7 +763,15 @@ export class TaigaClient {
 
   async updateProduct(
     productId: string,
-    body: { autoMerge?: boolean | null | undefined; autoBuild?: boolean | undefined }
+    body: {
+      autoMerge?: boolean | null | undefined;
+      autoBuild?: boolean | undefined;
+      name?: string | undefined;
+      ownsInfrastructure?: boolean | null | undefined;
+      ownsDeployment?: boolean | null | undefined;
+      deploymentNotes?: string | null | undefined;
+      emitDesignStandards?: boolean | null | undefined;
+    }
   ) {
     return this.request<{ data: unknown }>('PATCH', `/products/${seg(productId)}`, body);
   }
@@ -777,4 +795,114 @@ export class TaigaClient {
     const qs = params.toString();
     return this.request<{ data: unknown[]; nextCursor: string | null }>('GET', `/factories${qs ? `?${qs}` : ''}`);
   }
+
+  async createFactory(body: { name: string }) {
+    return this.request<{ data: unknown }>('POST', '/factories', body);
+  }
+
+  async updateFactory(factoryId: string, body: { name?: string | undefined }) {
+    return this.request<{ data: unknown }>('PATCH', `/factories/${seg(factoryId)}`, body);
+  }
+
+  // ---------------------------------------------------------------------------
+  // Setting a product up
+  // ---------------------------------------------------------------------------
+
+  async createProduct(body: {
+    name: string;
+    factoryId: string;
+    projectType?: 'brownfield' | undefined;
+    ownsInfrastructure?: boolean | null | undefined;
+    ownsDeployment?: boolean | null | undefined;
+    deploymentNotes?: string | undefined;
+  }) {
+    return this.request<{ data: unknown }>('POST', '/products', body);
+  }
+
+  async previewProductMove(productId: string, factoryId: string) {
+    return this.request<{ data: unknown }>('GET', `/products/${seg(productId)}/factory/preview${query({ factoryId })}`);
+  }
+
+  async moveProduct(productId: string, body: { factoryId: string; stopLine?: boolean | undefined }) {
+    return this.request<Record<string, unknown>>('PUT', `/products/${seg(productId)}/factory`, body);
+  }
+
+  async startImport(productId: string) {
+    return this.request<{ data: { jobId: string } }>('POST', `/products/${seg(productId)}/brownfield-import`);
+  }
+
+  async refreshRealityDocuments(productId: string, docTypes?: readonly string[] | undefined) {
+    return this.request<{ data: { jobId: string } }>(
+      'POST',
+      `/products/${seg(productId)}/documents/refresh-reality`,
+      docTypes ? { docTypes } : undefined
+    );
+  }
+
+  async completeSetup(productId: string) {
+    return this.request<{ data: unknown }>('POST', `/products/${seg(productId)}/setup/complete`);
+  }
+
+  async reopenSetup(productId: string) {
+    return this.request<{ data: unknown }>('POST', `/products/${seg(productId)}/setup/reopen`);
+  }
+
+  // ---------------------------------------------------------------------------
+  // Repositories
+  // ---------------------------------------------------------------------------
+
+  /** Every connected GitHub account, page by page: a later account must be findable by its id too. */
+  async listGithubInstallations() {
+    const data: unknown[] = [];
+    let cursor: string | undefined;
+    do {
+      const result = await this.request<{ data: unknown[]; nextCursor: string | null }>(
+        'GET',
+        `/github/installations${query({ limit: 100, cursor })}`
+      );
+      data.push(...result.data);
+      cursor = result.nextCursor ?? undefined;
+    } while (cursor);
+    return { data };
+  }
+
+  async listInstallationRepositories(
+    installationId: string,
+    opts: { q?: string | undefined; limit?: number | undefined; cursor?: string | undefined }
+  ) {
+    return this.request<{ data: unknown[]; nextCursor: string | null }>(
+      'GET',
+      `/github/installations/${seg(installationId)}/repositories${query({ ...opts })}`
+    );
+  }
+
+  async linkRepository(
+    productId: string,
+    body: { githubRepositoryId: string; replacesRepositoryId?: string | undefined }
+  ) {
+    return this.request<{ data: unknown }>('POST', `/products/${seg(productId)}/repositories`, body);
+  }
+
+  async updateRepository(
+    productId: string,
+    repositoryId: string,
+    body: { baseBranch?: string | null | undefined; label?: string | null | undefined }
+  ) {
+    return this.request<{ data: unknown }>(
+      'PATCH',
+      `/products/${seg(productId)}/repositories/${seg(repositoryId)}`,
+      body
+    );
+  }
+
+  async listRepositoryBranches(productId: string, repositoryId: string) {
+    return this.request<{ data: unknown[]; truncated: boolean }>(
+      'GET',
+      `/products/${seg(productId)}/repositories/${seg(repositoryId)}/branches`
+    );
+  }
+
+  async unlinkRepository(productId: string, repositoryId: string) {
+    return this.request<null>('DELETE', `/products/${seg(productId)}/repositories/${seg(repositoryId)}`);
+  }
 }

package/src/index.ts

@@ -1,12 +1,9 @@
 #!/usr/bin/env node
 
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { serveStdio } from '@modelcontextprotocol/server/stdio';
 import { TaigaClient } from './client.js';
 import { readConfig } from './config.js';
-import { registerAllTools } from './tools/index.js';
-import { SERVER_INSTRUCTIONS } from './tools/instructions.js';
-import { SERVER_VERSION } from './version.js';
+import { createServer } from './server.js';
 
 async function main() {
   const config = readConfig();
@@ -26,27 +23,20 @@ async function main() {
     process.exit(1);
   });
 
-  // Create MCP server with dynamic tool registration and instructions
-  const server = new McpServer(
-    {
-      name: 'taiga',
-      version: SERVER_VERSION,
-    },
-    {
-      instructions: SERVER_INSTRUCTIONS,
-    }
-  );
-
-  registerAllTools(server, client);
-
   const toolCount = introspection.capabilities.length;
   console.error(
     `Taiga MCP server started (${toolCount} capabilities, user: ${introspection.email}, role: ${introspection.role})`
   );
 
-  // Connect via stdio transport
-  const transport = new StdioServerTransport();
-  await server.connect(transport);
+  // serveStdio owns the protocol revision: a client that opens with
+  // server/discover is served 2026-07-28, one that opens with initialize the
+  // 2025 revision it asks for, from the same instance. Tools are registered
+  // from the key's capabilities, so a key never sees a tool it cannot use.
+  // Errors outside a request (the stream failing, a message that cannot be
+  // read) go to stderr, which the client shows in its server log.
+  serveStdio(() => createServer(client), {
+    onerror: (error) => console.error('Taiga MCP server error:', error),
+  });
 }
 
 main().catch((error) => {

package/src/modern.integration.test.ts

@@ -0,0 +1,153 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { Client, InMemoryTransport } from '@modelcontextprotocol/client';
+import { serveStdio } from '@modelcontextprotocol/server/stdio';
+import { TaigaClient } from './client.js';
+import { createServer } from './server.js';
+
+/**
+ * The same server over the 2026-07-28 revision. serveStdio picks the
+ * revision from the client's opening exchange, so a client pinned to
+ * 2026-07-28 opens with server/discover and every call after it carries the
+ * modern envelope. server.integration.test.ts covers the tools in depth over
+ * the 2025 handshake; this proves the catalogue, a read, a write, the server
+ * instructions, and a wait's progress and cancellation on the new revision.
+ */
+
+const ITEM_ID = '0199a1b2-c3d4-7e5f-8a9b-0c1d2e3f4a5e';
+const PRODUCT_ID = '0199a1b2-c3d4-7e5f-8a9b-0c1d2e3f4a5c';
+const JOB_ID = '0199a1b2-c3d4-7e5f-8a9b-0c1d2e3f4b10';
+
+let close: (() => Promise<void>) | undefined;
+
+const json = (body: unknown, status = 200) =>
+  new Response(JSON.stringify(body), { status, headers: { 'Content-Type': 'application/json' } });
+
+async function bootModern(capabilities: string[], routes: Record<string, (url: string, init: RequestInit) => unknown>) {
+  vi.stubGlobal(
+    'fetch',
+    vi.fn(async (url: string, init: RequestInit = {}) => {
+      const { pathname } = new URL(url);
+      if (pathname === '/v1/auth/introspect') {
+        return json({ data: { userId: 'u', tenantId: 't', email: 'dev@test.com', role: 'member', capabilities } });
+      }
+      const route = routes[`${init.method ?? 'GET'} ${pathname}`];
+      return route ? route(url, init) : json({ code: 'NOT_FOUND', message: 'No route' }, 404);
+    })
+  );
+  const taiga = new TaigaClient({ baseUrl: 'https://api.test.com', apiKey: 'taiga_sk_live_test' });
+  await taiga.introspect();
+
+  const [clientSide, serverSide] = InMemoryTransport.createLinkedPair();
+  const handle = serveStdio(() => createServer(taiga, { wait: { pollIntervalMs: 5 } }), { transport: serverSide });
+  const client = new Client(
+    { name: 'modern-test', version: '0.0.1' },
+    { versionNegotiation: { mode: { pin: '2026-07-28' } } }
+  );
+  await client.connect(clientSide);
+  close = async () => {
+    await client.close();
+    await handle.close();
+  };
+  return { client };
+}
+afterEach(async () => {
+  await close?.();
+  close = undefined;
+  vi.unstubAllGlobals();
+});
+
+describe('the server on the 2026-07-28 revision', () => {
+  it('negotiates 2026-07-28 and lists the same catalogue, with the server instructions', async () => {
+    const { client } = await bootModern(['products:read', 'backlog:read', 'backlog:write', 'products:write'], {});
+
+    expect(client.getProtocolEra()).toBe('modern');
+    expect(client.getInstructions()).toContain('Taiga');
+    const names = (await client.listTools()).tools.map((t) => t.name);
+    expect(names).toContain('taiga_get_product');
+    expect(names).toContain('taiga_request_initiatives');
+  });
+
+  it('reads, writes and refuses an unknown argument as it does on the 2025 revision', async () => {
+    let posted: unknown;
+    const { client } = await bootModern(['products:read', 'products:write'], {
+      [`GET /v1/products/${PRODUCT_ID}`]: () => json({ data: { id: PRODUCT_ID, name: 'Web', slug: 'web' } }),
+      'POST /v1/agent-jobs': (_url, init) => {
+        posted = JSON.parse(init.body as string);
+        return json({ data: { id: JOB_ID, type: 'generate_backlog', status: 'pending' } });
+      },
+    });
+
+    const product = await client.callTool({ name: 'taiga_get_product', arguments: { productId: PRODUCT_ID } });
+    const requested = await client.callTool({
+      name: 'taiga_request_initiatives',
+      arguments: { productId: PRODUCT_ID, title: 'Health endpoint' },
+    });
+    const stray = await client.callTool({
+      name: 'taiga_get_product',
+      arguments: { productId: PRODUCT_ID, note: 'not an argument' },
+    });
+
+    expect(JSON.parse((product.content as { text: string }[])[0]!.text)).toMatchObject({ id: PRODUCT_ID, name: 'Web' });
+    expect(posted).toMatchObject({ scope: 'product', type: 'generate_backlog', targetId: PRODUCT_ID });
+    expect(JSON.parse((requested.content as { text: string }[])[0]!.text)).toMatchObject({ id: JOB_ID });
+    expect(stray.isError).toBe(true);
+    expect((stray.content as { text: string }[])[0]!.text).toMatch(/Unrecognized key/);
+  });
+
+  it('reports progress while a wait runs, and ends the read in flight when the call is cancelled', async () => {
+    let reads = 0;
+    let hung: AbortSignal | undefined;
+    const job = (status: string) => json({ data: { id: JOB_ID, type: 'refresh_reality', status } });
+    const { client } = await bootModern(['products:read', 'backlog:read'], {
+      [`GET /v1/agent-jobs/${JOB_ID}`]: () => job(++reads < 3 ? 'processing' : 'completed'),
+      [`GET /v1/backlog/${ITEM_ID}`]: (_url, init) => {
+        hung = init.signal!;
+        return new Promise((_resolve, reject) =>
+          init.signal!.addEventListener('abort', () => reject(init.signal!.reason))
+        );
+      },
+    });
+    const onprogress = vi.fn();
+
+    const waited = await client.callTool({ name: 'taiga_wait_for_job', arguments: { jobId: JOB_ID } }, { onprogress });
+    expect(JSON.parse((waited.content as { text: string }[])[0]!.text)).toMatchObject({ reached: true });
+    expect(onprogress).toHaveBeenCalledWith(expect.objectContaining({ message: 'Still waiting' }));
+
+    const controller = new AbortController();
+    const pending = client.callTool(
+      { name: 'taiga_wait_for_backlog_item', arguments: { itemId: ITEM_ID, until: 'planned', timeoutSeconds: 60 } },
+      { signal: controller.signal }
+    );
+    await vi.waitFor(() => expect(hung).toBeDefined());
+    controller.abort();
+    await expect(pending).rejects.toThrow();
+    await vi.waitFor(() => expect(hung!.aborted).toBe(true));
+  });
+
+  it('reads a resource, gets a prompt and refuses a missing document with invalid params', async () => {
+    const policy = {
+      id: 'doc-1',
+      type: 'policy_security',
+      name: 'Security Policy',
+      version: 3,
+      isDraft: false,
+      data: { version: '1.0.0', sections: { summary: { source: 'template', priority: 'core', content: 'Encrypt' } } },
+    };
+    const { client } = await bootModern(['tenant:documents:read'], {
+      'GET /v1/tenants/current/documents/policy_security': () => json({ data: policy }),
+      'GET /v1/tenants/current/documents': () => json({ data: [policy], nextCursor: null }),
+    });
+
+    const { contents } = await client.readResource({ uri: 'taiga://documents/policy_security' });
+    const prompt = await client.getPrompt({
+      name: 'taiga_review_against_policies',
+      arguments: { policyType: 'policy_security' },
+    });
+    const missing = await client.readResource({ uri: 'taiga://documents/tone_of_voice' }).catch((e: unknown) => e);
+
+    expect((contents[0] as { text: string }).text).toContain('# Security Policy');
+    expect((prompt.messages[0]!.content as { text: string }).text).toContain('# Security Policy');
+    expect(missing).toMatchObject({ code: -32602 });
+    expect(String((missing as Error).message)).toMatch(/^No published tone_of_voice/);
+  });
+});