@thalovant/mcp-server 0.1.6 → 0.1.8

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.1.8
+
+- Tightened memory tool input validation to match the control-plane API exactly: `title` max 160, `content` max 4096, `source` max 64, `consentScope` max 128, `consentVersion` max 64, `retentionPolicy` max 64 on create/update, and list `query` max 240, so invalid values fail with a clear client-side error instead of an opaque API 422.
+- Capped `thalovant_list_public_hubs` `limit` at 48 to match the public hubs endpoint, which silently clamps larger page sizes; authenticated `thalovant_list_hubs` keeps its limit of 100.
+- Corrected `thalovant_get_hub` and `thalovant_create_client_identity` descriptions: the authenticated hub routes require a hub UUID; slugs are only accepted by the public hub tools.
+
+## 0.1.7
+
+- Updated the MCP transport SDK to 1.30.0, removing the affected Hono adapter dependency range.
+- Updated the Thalovant Node SDK compatibility floor to 0.2.21 and refreshed the JOSE runtime dependency.
+- Included the dependency and transitive security updates merged after 0.1.6.
+
 ## 0.1.6
 
 - Publish the exact npm tarball with a durable CycloneDX SBOM and GitHub provenance and SBOM attestations.

package/dist/index.js

@@ -14,10 +14,11 @@ import { mkdir } from "node:fs/promises";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { createRemoteJWKSet, jwtVerify } from "jose";
 import { z } from "zod";
-const VERSION = "0.1.6";
+const VERSION = "0.1.8";
 const DEFAULT_TIMEOUT_MS = 30_000;
 const MAX_TIMEOUT_MS = 300_000;
 const MAX_LIMIT = 100;
+const MAX_PUBLIC_HUBS_LIMIT = 48;
 const DEFAULT_HTTP_BODY_LIMIT_BYTES = 1_048_576;
 const DEFAULT_HTTP_RATE_LIMIT_MAX = 120;
 const DEFAULT_HTTP_RATE_LIMIT_WINDOW_MS = 60_000;
@@ -48,7 +49,14 @@ const SECRET_KEYS = [
     "secret",
 ];
 const protocolSchema = z.enum(["wss", "https", "mqtt"]);
-const limitSchema = z.number().int().min(1).max(MAX_LIMIT).default(25);
+const limitSchema = z.number().int().min(1).max(MAX_LIMIT).default(25).describe("Page size, 1-100.");
+const publicHubsLimitSchema = z
+    .number()
+    .int()
+    .min(1)
+    .max(MAX_PUBLIC_HUBS_LIMIT)
+    .default(25)
+    .describe("Page size, 1-48. The public hubs endpoint caps page size at 48.");
 const optionalCursorSchema = z.string().min(1).optional();
 const jsonRecordSchema = z.record(z.unknown());
 const controlPlaneSchema = {
@@ -897,9 +905,9 @@ export function createServer() {
     }));
     registerThalovantTool(server, "thalovant_list_public_hubs", {
         title: "List Public Hubs",
-        description: "List Thalovant public hubs. This read-only discovery call does not require authentication.",
+        description: "List Thalovant public hubs. This read-only discovery call does not require authentication. Page size is capped at 48.",
         inputSchema: {
-            limit: limitSchema,
+            limit: publicHubsLimitSchema,
             cursor: optionalCursorSchema,
             apiUrl: controlPlaneSchema.apiUrl,
         },
@@ -946,10 +954,13 @@ export function createServer() {
     });
     registerThalovantTool(server, "thalovant_get_hub", {
         title: "Get Hub",
-        description: "Fetch one authenticated Thalovant hub by id.",
+        description: "Fetch one authenticated Thalovant hub by UUID.",
         inputSchema: {
             ...controlPlaneSchema,
-            hubId: z.string().min(1),
+            hubId: z
+                .string()
+                .min(1)
+                .describe("Hub UUID. This authenticated route rejects slugs; slugs are only accepted by the public hub tools (thalovant_get_public_hub)."),
         },
         annotations: {
             readOnlyHint: true,
@@ -965,7 +976,10 @@ export function createServer() {
         description: "Create a Thalovant client identity for a hub. The identity is secret; output is redacted unless savePath is used.",
         inputSchema: {
             ...controlPlaneSchema,
-            hubId: z.string().min(1).describe("Hub id or slug accepted by the Thalovant SDK."),
+            hubId: z
+                .string()
+                .min(1)
+                .describe("Hub UUID. This authenticated route rejects slugs; slugs are only accepted by the public hub tools (thalovant_get_public_hub)."),
             name: z.string().min(1).max(128),
             siteId: z.string().min(1).optional(),
             ownerId: z.string().min(1).optional(),
@@ -1259,7 +1273,7 @@ export function createServer() {
             kind: z.enum(["note", "preference", "fact"]).optional(),
             ownerId: z.string().min(1).optional(),
             hubId: z.string().min(1).optional(),
-            query: z.string().min(1).optional(),
+            query: z.string().min(1).max(240).optional(),
             includeDeleted: z.boolean().optional(),
             includeExpired: z.boolean().optional(),
             limit: limitSchema,
@@ -1314,16 +1328,16 @@ export function createServer() {
             ...controlPlaneSchema,
             scope: z.enum(["personal", "workspace", "hub"]).optional(),
             kind: z.enum(["note", "preference", "fact"]).optional(),
-            title: z.string().max(512).nullable().optional(),
-            content: z.string().min(1).max(20_000),
+            title: z.string().max(160).nullable().optional(),
+            content: z.string().min(1).max(4_096),
             tags: z.array(z.string().min(1)).optional(),
             ownerId: z.string().min(1).optional(),
             hubId: z.string().min(1).optional(),
-            source: z.string().min(1).optional(),
+            source: z.string().min(1).max(64).optional(),
             metadata: jsonRecordSchema.optional(),
-            consentScope: z.string().min(1).optional(),
-            consentVersion: z.string().nullable().optional(),
-            retentionPolicy: z.string().min(1).optional(),
+            consentScope: z.string().min(1).max(128).optional(),
+            consentVersion: z.string().max(64).nullable().optional(),
+            retentionPolicy: z.string().min(1).max(64).optional(),
             expiresAt: z.string().nullable().optional(),
         },
         annotations: {
@@ -1345,13 +1359,13 @@ export function createServer() {
             ...controlPlaneSchema,
             memoryId: z.string().min(1),
             kind: z.enum(["note", "preference", "fact"]).optional(),
-            title: z.string().max(512).nullable().optional(),
-            content: z.string().min(1).max(20_000).optional(),
+            title: z.string().max(160).nullable().optional(),
+            content: z.string().min(1).max(4_096).optional(),
             tags: z.array(z.string().min(1)).optional(),
             metadata: jsonRecordSchema.optional(),
-            consentScope: z.string().min(1).optional(),
-            consentVersion: z.string().nullable().optional(),
-            retentionPolicy: z.string().min(1).optional(),
+            consentScope: z.string().min(1).max(128).optional(),
+            consentVersion: z.string().max(64).nullable().optional(),
+            retentionPolicy: z.string().min(1).max(64).optional(),
             expiresAt: z.string().nullable().optional(),
             clearExpiresAt: z.boolean().optional(),
         },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thalovant/mcp-server",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "description": "Stdio and Streamable HTTP MCP server for Thalovant control-plane and hub runtime APIs.",
   "license": "MIT",
   "type": "module",
@@ -63,11 +63,14 @@
     "node": ">=20"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.29.0",
-    "@thalovant/sdk": "^0.2.15",
-    "jose": "^6.2.3",
+    "@modelcontextprotocol/sdk": "^1.30.0",
+    "@thalovant/sdk": "^0.2.21",
+    "jose": "^6.2.8",
     "zod": "^3.25.76"
   },
+  "overrides": {
+    "fast-uri": "3.1.5"
+  },
   "devDependencies": {
     "@types/node": "^22.18.12",
     "typescript": "^5.9.3",

package/server.json

@@ -7,19 +7,19 @@
     "url": "https://github.com/thalovant/thalovant-mcp",
     "source": "github"
   },
-  "version": "0.1.6",
+  "version": "0.1.8",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@thalovant/mcp-server",
-      "version": "0.1.6",
+      "version": "0.1.8",
       "transport": {
         "type": "stdio"
       }
     },
     {
       "registryType": "oci",
-      "identifier": "ghcr.io/thalovant/thalovant-mcp:0.1.6",
+      "identifier": "ghcr.io/thalovant/thalovant-mcp:0.1.8",
       "transport": {
         "type": "streamable-http",
         "url": "http://127.0.0.1:3000/mcp"