@taiga-ai/mcp-server 0.26.0-rc.530 → 0.26.1-dev.542

package/README.md

@@ -13,7 +13,7 @@ It runs locally over stdio and calls the Taiga API with your API key.
 1. Create an API key in Taiga under **Settings > Account > API keys**.
 2. The key acts as you. It can do what your role can do, within the key's scopes.
 
-The examples pin a release (`@taiga-ai/mcp-server@0.26.0`), so an install runs the version you chose rather than whatever `latest` is at the next start. Taiga's settings page shows the snippet for your environment.
+The examples pin a release (`@taiga-ai/mcp-server@0.26.1`), so an install runs the version you chose rather than whatever `latest` is at the next start. Taiga's settings page shows the snippet for your environment.
 
 ## Install
 
@@ -22,7 +22,7 @@ The examples pin a release (`@taiga-ai/mcp-server@0.26.0`), so an install runs t
 Paste your key when the command waits for it; it is read without echo and stays out of your shell history:
 
 ```sh
-read -rs TAIGA_API_KEY && claude mcp add taiga -e TAIGA_API_KEY="$TAIGA_API_KEY" -- npx -y @taiga-ai/mcp-server@0.26.0
+read -rs TAIGA_API_KEY && claude mcp add taiga -e TAIGA_API_KEY="$TAIGA_API_KEY" -- npx -y @taiga-ai/mcp-server@0.26.1
 ```
 
 ### Claude Desktop
@@ -34,7 +34,7 @@ In `claude_desktop_config.json`:
   "mcpServers": {
     "taiga": {
       "command": "npx",
-      "args": ["-y", "@taiga-ai/mcp-server@0.26.0"],
+      "args": ["-y", "@taiga-ai/mcp-server@0.26.1"],
       "env": { "TAIGA_API_KEY": "your-key-here" }
     }
   }
@@ -56,7 +56,7 @@ In `.vscode/mcp.json`. VS Code reads `servers`, and can prompt for the key once
     "taiga": {
       "type": "stdio",
       "command": "npx",
-      "args": ["-y", "@taiga-ai/mcp-server@0.26.0"],
+      "args": ["-y", "@taiga-ai/mcp-server@0.26.1"],
       "env": { "TAIGA_API_KEY": "${input:taiga-api-key}" }
     }
   }
@@ -70,7 +70,7 @@ In `~/.codex/config.toml`:
 ```toml
 [mcp_servers.taiga]
 command = "npx"
-args = ["-y", "@taiga-ai/mcp-server@0.26.0"]
+args = ["-y", "@taiga-ai/mcp-server@0.26.1"]
 env = { TAIGA_API_KEY = "your-key-here" }
 ```
 
@@ -80,11 +80,11 @@ env = { TAIGA_API_KEY = "your-key-here" }
 | ---------------- | -------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
 | `TAIGA_API_KEY`  | Yes                              | Your API key.                                                                                                                                |
 | `TAIGA_API_URL`  | For `@dev` and `@staging` builds | The Taiga API. A release defaults to `https://api.eu.tai.ga`. It must be https (plain http only for `localhost`), with no query or fragment. |
-| `TAIGA_TOOLSETS` | No                               | Toolsets to turn on besides the default, comma-separated, or `all`. See [Toolsets](#toolsets).                                               |
+| `TAIGA_TOOLSETS` | No                               | Overrides the key's toolsets for this server, comma-separated, or `all`. See [Toolsets](#toolsets).                                          |
 
 ## Toolsets
 
-The tools come in five toolsets, so an assistant sees the ones for the job rather than all of them.
+The tools come in five toolsets. Every toolset is on unless you choose otherwise for the key.
 
 | Toolset     | For                                                                          |
 | ----------- | ---------------------------------------------------------------------------- |
@@ -94,7 +94,7 @@ The tools come in five toolsets, so an assistant sees the ones for the job rathe
 | `observe`   | Deployments, monitoring, delivery metrics, packages and the SBOM.            |
 | `documents` | Factory documents, writing and publishing documents, and the knowledge base. |
 
-A key with the viewer role gets every toolset, which for it holds only reads. Every other role gets `core` and `operate`. Set `TAIGA_TOOLSETS` to turn on more, for example `setup` or `setup,observe`, or `all`, then restart the server; it adds to the default, never takes from it. A toolset never adds a tool your key does not allow. `taiga_whoami` lists the toolsets that are on and the tools in the ones that are off.
+Choose a key's toolsets in Taiga when you connect a tool under Settings › Account › AI tools, or change them later under Settings › Account › API keys, then restart your AI tool; the server reads them when it starts. `TAIGA_TOOLSETS` in the server's config overrides them for that server. A toolset never adds a tool your key does not allow: your role and the key's scopes decide what it may do. `taiga_whoami` lists the toolsets that are on and the tools in the ones that are off.
 
 ## First steps
 
@@ -124,3 +124,7 @@ Organization administration stays in the web. That covers members and roles, SSO
 - **"Failed to validate API key":** the key is wrong, revoked or expired. Create a new one.
 - **"The Taiga API at ... is older than @taiga-ai/mcp-server ... needs":** run the release your Taiga environment names on its settings page.
 - **"This is a pre-release build":** `@dev` and `@staging` builds are for Taiga's own environments and need `TAIGA_API_URL`.
+
+## License
+
+Proprietary. This package is provided for use with a Taiga account; it is not open source.

package/dist/index.js

@@ -1970,6 +1970,20 @@ const ENVIRONMENT_TYPES = [
 	"load_test",
 	"custom"
 ];
+//#endregion
+//#region ../../packages/types/dist/api-keys.js
+/**
+* The groups the MCP server's tools come in (PRO-2838). A key may name the ones
+* its AI tool sees; null is every one. This is focus, not security: a tool the
+* key's role or scopes do not allow is never offered, whatever is named here.
+*/
+const MCP_TOOLSETS = [
+	"core",
+	"operate",
+	"setup",
+	"observe",
+	"documents"
+];
 [...TURN_EVENT_TRIGGERS];
 //#endregion
 //#region ../../packages/types/dist/maintenance.js
@@ -2081,11 +2095,12 @@ const MAINTENANCE_IGNORE_REASONS = [
 *   alone is shipped, and `dev` + `optional` (devOptional) is left undecided.
 * - pnpm-lock.yaml: `dev` comes from a per-package `dev: true` that lockfile
 *   v9 no longer writes, so an empty list says nothing; `dev` still means dev.
-*   For a package a workspace declares under `dependencies` or
-*   `optionalDependencies`, the sweep adds Taiga's own `prod`, so that copy
-*   reads runtime. A `devDependencies` declaration is not turned into `dev`:
-*   a runtime dependency's snapshot may pull the same copy in, which only the
-*   `snapshots` graph could rule out, so it stays unknown.
+*   From a v9 lockfile the sweep walks the `snapshots` graph (PRO-2943): a
+*   copy reachable from any workspace's `dependencies` or
+*   `optionalDependencies` gets Taiga's own `prod` and reads runtime; one
+*   reachable only from `devDependencies` gets `dev`. From an older lockfile
+*   only a copy a workspace declares under `dependencies` or
+*   `optionalDependencies` gets `prod`, and the rest stays unknown.
 * - poetry.lock: group names with `main` dropped; a non-main, non-optional
 *   group is not in the runtime install. Poetry 1.x lockfiles carry no groups
 *   at all, so an empty list says nothing.
@@ -2544,20 +2559,16 @@ function apiLevelProblem(introspection, apiUrl, required = 4, version = SERVER_V
 //#endregion
 //#region src/tools/toolsets.ts
 /**
-* Toolsets (PRO-2846 goal, 2026-10-12): the tools an agent sees by default, by what the person does.
+* Toolsets (PRO-2846, PRO-2838): the tools an AI tool sees, grouped by what the person does.
 *
-* Every review ranked the catalogue's size first, and an owner's key saw all of it. A role decides what a key MAY
-* do (the API enforces it, and tools a key cannot use are never registered); a toolset decides what it SEES by
-* default. A toolset never adds a tool the key's capabilities do not allow. The tool list stays the same for every
-* connection of one server (MCP 2026-07-28), so toolsets are chosen in the server's config, not mid-session.
+* A role decides what a key MAY do (the API enforces it, and tools a key cannot use are never registered); a toolset
+* decides what it SEES. A toolset never adds a tool the key's capabilities do not allow. Every toolset is on unless
+* the key says otherwise: the person chooses them for the key in Taiga's settings, and the server reads them at
+* start. Toolsets alone barely changed what the task test cost in Claude Code, which loads tool details on demand,
+* so the default is everything rather than a short list someone has to know how to widen. The tool list stays the
+* same for every connection of one server (MCP 2026-07-28), so the set is fixed at start, not mid-session.
 */
-const TOOLSETS = [
-	"core",
-	"operate",
-	"setup",
-	"observe",
-	"documents"
-];
+const TOOLSETS = MCP_TOOLSETS;
 /** What each toolset is for, as whoami says it. */
 const TOOLSET_PURPOSE = {
 	core: "where products, initiatives, runs, policies and findings stand",
@@ -2644,13 +2655,6 @@ const TOOLSET_OF = {
 	taiga_retry_knowledge: "documents"
 };
 /**
-* The toolsets a key sees when its config names none: a viewer can only read, so it sees every read it may use;
-* everyone else sees where things stand and the work they move, and opts into setup, observe and documents.
-*/
-function defaultToolsets(role) {
-	return role === "viewer" ? TOOLSETS : ["core", "operate"];
-}
-/**
 * TAIGA_TOOLSETS as written: comma-separated names, or "all"; a name it does not know is said, not ignored, and so
 * is a value that names none.
 */
@@ -2660,10 +2664,15 @@ function parseToolsets(raw) {
 	if (unknown.length > 0 || names.length === 0) return { problem: `TAIGA_TOOLSETS ${unknown.length > 0 ? `names ${unknown.join(", ")}, which is no toolset` : "names no toolset"}: use ${TOOLSETS.join(", ")} or all.` };
 	return { toolsets: names.includes("all") ? TOOLSETS : [...new Set(names)] };
 }
-/** The toolsets a server turns on: the role's default, and any the config adds. A toolset only widens. */
-function activeToolsets(role, added) {
-	const on = /* @__PURE__ */ new Set([...defaultToolsets(role), ...added ?? []]);
-	return TOOLSETS.filter((toolset) => on.has(toolset));
+/**
+* The toolsets a server turns on: TAIGA_TOOLSETS when the server's config names some, else the ones the key names,
+* else every one. A name the server does not know (a key set by a newer Taiga) is passed over; a key that names
+* none this server knows sees every one, rather than starting with no tools.
+*/
+function activeToolsets(fromKey, fromConfig) {
+	const named = fromConfig ?? fromKey?.filter((name) => TOOLSETS.includes(name));
+	if (!named || named.length === 0) return [...TOOLSETS];
+	return TOOLSETS.filter((toolset) => named.includes(toolset));
 }
 //#endregion
 //#region src/config.ts
@@ -3379,6 +3388,7 @@ const PACKAGE_ROW_FIELDS = [
 	"licenses",
 	"scope",
 	"relation",
+	"introducedBy",
 	"sourcePath",
 	"productRepositoryId",
 	"detectedAt"
@@ -3702,7 +3712,7 @@ function registerMaintenanceTools(server, client) {
 	}));
 	server.registerTool("taiga_list_packages", {
 		title: "List the package inventory",
-		description: "List every package a product's code uses, with version, license and whether it is direct or dev only. The first page summarizes licenses against the allowed list. Filter by license, name or repository. NOT_FOUND where the licenses feature is off.",
+		description: "List every package a product's code uses, with version, license, whether it is direct or dev only, and what pulls a transitive one in. The first page summarizes licenses against the allowed list. Filter by license, name or repository. NOT_FOUND where the licenses feature is off.",
 		inputSchema: z.object({
 			productId,
 			license: z.string().min(1).max(MAINTENANCE_LICENSE_FILTER_MAX).optional().describe("Only packages carrying exactly this SPDX string"),
@@ -23406,7 +23416,7 @@ function withToolsetNote(result, left) {
 		...answer,
 		content: [...answer.content, {
 			type: "text",
-			text: `Not on in this server: ${where}. taiga_whoami says how to turn a toolset on (TAIGA_TOOLSETS).`
+			text: `Not on in this server: ${where}. taiga_whoami says how to turn a toolset on.`
 		}]
 	};
 }
@@ -23608,7 +23618,7 @@ function registerAllTools(server, client, options = {}) {
 function registerWhoami(server, client, registered, toolsets, left) {
 	server.registerTool("taiga_whoami", {
 		title: "Who am I",
-		description: "See who this API key acts as and what it can do: role, capabilities, its tools split into reads, writes and ask-first writes, and the toolsets: which are on, and which tools the others hold (TAIGA_TOOLSETS turns them on).",
+		description: "See who this API key acts as and what it can do: role, capabilities, its tools split into reads, writes and ask-first writes, and the toolsets: which are on, which tools the others hold, and how to turn them on.",
 		inputSchema: z.object({}),
 		annotations: READ_ONLY
 	}, () => runTool(async () => {
@@ -23633,7 +23643,7 @@ function registerWhoami(server, client, registered, toolsets, left) {
 					for: TOOLSET_PURPOSE[set],
 					tools: [...left].filter(([, s]) => s === set).map(([n]) => n)
 				}]).filter(([, entry]) => entry.tools.length > 0)),
-				...left.size > 0 ? { howToTurnOn: "Add them to TAIGA_TOOLSETS in this server's config (comma-separated, or all), then restart the server." } : {}
+				...left.size > 0 ? { howToTurnOn: "Change this key's toolsets in Taiga (Settings, Account, API keys), then restart your AI tool. If TAIGA_TOOLSETS is set in this server's config, it chooses them instead: change or remove it, then restart." } : {}
 			}
 		});
 	}));
@@ -23720,7 +23730,7 @@ async function main() {
 		process.exit(1);
 	}
 	console.error(`Taiga MCP server started (${introspection.capabilities.length} capabilities, role: ${introspection.role})`);
-	const toolsets = activeToolsets(introspection.role, config.toolsets);
+	const toolsets = activeToolsets(introspection.mcpToolsets, config.toolsets);
 	serveStdio(() => createServer(client, { toolsets }), { onerror: (error) => console.error("Taiga MCP server error:", error) });
 }
 main().catch((error) => {

package/package.json

@@ -1,8 +1,9 @@
 {
   "name": "@taiga-ai/mcp-server",
-  "version": "0.26.0-rc.530",
+  "version": "0.26.1-dev.542",
   "description": "Taiga for AI coding assistants: read products, policies, initiatives and runs, and operate the line, over MCP",
   "mcpName": "ga.tai/mcp-server",
+  "license": "UNLICENSED",
   "type": "module",
   "main": "./dist/index.js",
   "bin": {