@thallylabs/mcp 0.10.33 → 0.10.34

package/README.md

@@ -46,6 +46,12 @@ site over HTTP.
 imports content. To preserve an existing Thally runtime and import content in
 place, the caller must explicitly choose `import_docs`.
 
+Migration imports and static checks do not authorize source execution. Set
+`trustSource: true` only after the user explicitly approves local dependency
+installation and build execution of that source. Otherwise the production
+build is skipped and the migration report remains unverified. Imported MDX and
+components are executable code; static analysis is not a sandbox.
+
 ## License
 
 MIT

package/dist/index.js

@@ -447,7 +447,8 @@ var migrationSourceShape = {
   docsDir: z7.string().optional().describe("Docs subdirectory in repo (default: auto-detect)"),
   apiKey: z7.string().optional().describe("Anthropic API key for non-Markdown file conversion"),
   maxPages: z7.number().int().min(1).max(1e3).optional().describe("Maximum public URL pages to import"),
-  platform: z7.enum(["mintlify", "docusaurus"]).optional().describe("Source platform (default: auto-detect)")
+  platform: z7.enum(["mintlify", "docusaurus"]).optional().describe("Source platform (default: auto-detect)"),
+  trustSource: z7.boolean().optional().describe("Only set true after the user explicitly authorizes executing this source locally. Enables dependency installation and production build; imported MDX/components are executable code, not sandboxed data. Default false, even for unattended runs.")
 };
 var migrateDocsSchema = z7.object({
   ...migrationSourceShape,
@@ -470,16 +471,22 @@ async function runMigration(input, isInPlaceImport) {
     docsDir: input.docsDir,
     maxPages: input.maxPages,
     platform: input.platform,
-    yes: true
+    yes: true,
+    trustSource: input.trustSource === true
   });
 }
 async function handleMigrateDocs(input) {
   const result = await runMigration(input, false);
-  return `Migration complete! Created a fresh Thally template at ${result.projectDir} and imported ${result.pagesWritten} pages.`;
+  return `Created a fresh Thally template at ${result.projectDir} and imported ${result.pagesWritten} pages. ${validationSummary(result)}`;
 }
 async function handleImportDocs(input) {
   const result = await runMigration(input, true);
-  return `Import complete! Imported ${result.pagesWritten} pages into the existing Thally project at ${result.projectDir}.`;
+  return `Imported ${result.pagesWritten} pages into the existing Thally project at ${result.projectDir}. ${validationSummary(result)}`;
+}
+function validationSummary(result) {
+  const { validation } = result;
+  const status = validation.content === "passed" && validation.build === "passed" ? "Content and production build passed." : "Validation is incomplete; review the failures or skipped checks before publishing.";
+  return `${status} ${result.warnings.length} migration warning(s). Report: ${result.reportPath}`;
 }
 
 // src/tools/search-docs.ts

package/dist/tools.js

@@ -438,7 +438,8 @@ var migrationSourceShape = {
   docsDir: z7.string().optional().describe("Docs subdirectory in repo (default: auto-detect)"),
   apiKey: z7.string().optional().describe("Anthropic API key for non-Markdown file conversion"),
   maxPages: z7.number().int().min(1).max(1e3).optional().describe("Maximum public URL pages to import"),
-  platform: z7.enum(["mintlify", "docusaurus"]).optional().describe("Source platform (default: auto-detect)")
+  platform: z7.enum(["mintlify", "docusaurus"]).optional().describe("Source platform (default: auto-detect)"),
+  trustSource: z7.boolean().optional().describe("Only set true after the user explicitly authorizes executing this source locally. Enables dependency installation and production build; imported MDX/components are executable code, not sandboxed data. Default false, even for unattended runs.")
 };
 var migrateDocsSchema = z7.object({
   ...migrationSourceShape,
@@ -461,16 +462,22 @@ async function runMigration(input, isInPlaceImport) {
     docsDir: input.docsDir,
     maxPages: input.maxPages,
     platform: input.platform,
-    yes: true
+    yes: true,
+    trustSource: input.trustSource === true
   });
 }
 async function handleMigrateDocs(input) {
   const result = await runMigration(input, false);
-  return `Migration complete! Created a fresh Thally template at ${result.projectDir} and imported ${result.pagesWritten} pages.`;
+  return `Created a fresh Thally template at ${result.projectDir} and imported ${result.pagesWritten} pages. ${validationSummary(result)}`;
 }
 async function handleImportDocs(input) {
   const result = await runMigration(input, true);
-  return `Import complete! Imported ${result.pagesWritten} pages into the existing Thally project at ${result.projectDir}.`;
+  return `Imported ${result.pagesWritten} pages into the existing Thally project at ${result.projectDir}. ${validationSummary(result)}`;
+}
+function validationSummary(result) {
+  const { validation } = result;
+  const status = validation.content === "passed" && validation.build === "passed" ? "Content and production build passed." : "Validation is incomplete; review the failures or skipped checks before publishing.";
+  return `${status} ${result.warnings.length} migration warning(s). Report: ${result.reportPath}`;
 }
 
 // src/tools/search-docs.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thallylabs/mcp",
-  "version": "0.10.33",
+  "version": "0.10.34",
   "description": "MCP server for managing Thally docs and tracing product changes into evidence-backed updates for human review.",
   "type": "module",
   "engines": {
@@ -38,7 +38,7 @@
   "dependencies": {
     "@anthropic-ai/sdk": "^0.36.0",
     "@modelcontextprotocol/sdk": "^1.15.0",
-    "create-thally-docs": "0.10.31",
+    "create-thally-docs": "0.10.32",
     "p-limit": "^6.1.0",
     "yaml": "^2.8.2",
     "zod": "^3.0.0"