@theronap/cortex-mcp 0.4.3 → 0.4.4

package/lib/capture.mjs

@@ -65,7 +65,7 @@ export async function runCapture() {
     const j = await res.json().catch(() => ({}))
     process.stderr.write(`cortex: ${j.inserted ? 'captured' : 'updated'} "${j.title ?? repo}" → ${repo}\n`)
   } else {
-    const d = classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id'))
+    const d = classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id'), res.headers.get('x-deny-reason'))
     process.stderr.write(`cortex: ingest failed — ${d.message}\n`)
   }
 }

package/lib/diagnose.mjs

@@ -6,8 +6,10 @@
 // to tell the truth about WHAT failed.
 //
 // KEY SIGNAL: the Cortex app ALWAYS returns JSON ({ error: ... }). So a NON-JSON body on a
-// 4xx/5xx means infrastructure handled the request, not Cortex auth — re-running setup or
-// regenerating the token will not help; it is usually transient and worth a retry.
+// 4xx/5xx means something else handled the request, not Cortex auth — re-running setup or
+// regenerating the token will not help. Two cases: (1) an egress allowlist block
+// (x-deny-reason: host_not_allowed) — NOT retriable, the host must be added to the allowlist;
+// (2) a transient infrastructure hiccup — retriable.
 
 export const isUuid = (s) =>
   /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(s ?? '')
@@ -39,10 +41,11 @@ export function resolveBase(rawUrl) {
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms))
 
 // A non-OK response → an actionable diagnosis: { kind, retriable, message }.
-//   kind: 'auth'  → token bad/revoked/wrong-deployment (NOT retriable)
-//         'infra' → blocked by infrastructure, non-JSON body (retriable, usually transient)
-//         'app'   → a real Cortex API error with a JSON message (retriable only if 5xx)
-export function classify(status, contentType, bodyText, requestId) {
+//   kind: 'auth'   → token bad/revoked/wrong-deployment (NOT retriable)
+//         'egress' → blocked by network egress allowlist (NOT retriable, not a Cortex/Vercel issue)
+//         'infra'  → blocked by infrastructure, non-JSON body (retriable, usually transient)
+//         'app'    → a real Cortex API error with a JSON message (retriable only if 5xx)
+export function classify(status, contentType, bodyText, requestId, denyReason) {
   const isJson = (contentType ?? '').includes('application/json')
   let appError = null
   if (isJson) { try { appError = JSON.parse(bodyText)?.error ?? null } catch { /* not json after all */ } }
@@ -56,6 +59,15 @@ export function classify(status, contentType, bodyText, requestId) {
         `the Cortex console → Connect your AI, then re-run setup.${rid}`,
     }
   }
+  if (denyReason === 'host_not_allowed' || /host (not in allowlist|not allowed)/i.test(bodyText ?? '')) {
+    return {
+      kind: 'egress', retriable: false,
+      message: `Blocked by your network's egress allowlist (HTTP ${status}: ${denyReason ?? 'host_not_allowed'}). ` +
+        `The request never left this environment — this is NOT a Cortex, token, or Vercel issue. ` +
+        `Add ${CANONICAL_BASE} to your environment's outbound allowlist, or run from a machine with open egress. ` +
+        `Re-running setup or regenerating the token will not help.${rid}`,
+    }
+  }
   if (!isJson) {
     return {
       kind: 'infra', retriable: true,
@@ -79,10 +91,11 @@ export async function fetchCortex(url, opts = {}, { retries = 2, baseDelayMs = 4
     try {
       const res = await fetch(url, opts)
       const ct = res.headers.get('content-type') ?? ''
+      const denyReason = res.headers.get('x-deny-reason') ?? ''
       const transient =
         res.status === 429 ||
         res.status >= 500 ||
-        (res.status === 403 && !ct.includes('application/json')) // infra block, not app authz
+        (res.status === 403 && !ct.includes('application/json') && !denyReason) // egress block is not transient
       if (transient && attempt < retries) {
         await sleep(baseDelayMs * 2 ** attempt)
         continue
@@ -122,7 +135,7 @@ export async function checkToken(token, base) {
   const contentType = res.headers.get('content-type')
   const body = await res.text()
   if (!res.ok) {
-    return { ok: false, status: res.status, requestId, diagnosis: classify(res.status, contentType, body, requestId) }
+    return { ok: false, status: res.status, requestId, diagnosis: classify(res.status, contentType, body, requestId, res.headers.get('x-deny-reason')) }
   }
   let projectCount
   try {

package/lib/server.mjs

@@ -25,7 +25,7 @@ export async function runServer(version) {
     const res = await fetchCortex(`${BASE}/api/mcp-context`, { headers: { Authorization: `Bearer ${TOKEN}` } })
     if (!res.ok) {
       const body = await res.text()
-      throw new Error(classify(res.status, res.headers.get('content-type'), body, res.headers.get('x-vercel-id')).message)
+      throw new Error(classify(res.status, res.headers.get('content-type'), body, res.headers.get('x-vercel-id'), res.headers.get('x-deny-reason')).message)
     }
     const { context } = await res.json()
     cache = { text: context, ts: now }
@@ -92,7 +92,7 @@ export async function runServer(version) {
         return { content: [{ type: 'text', text: `Could not assemble story: ${e.message}` }] }
       }
       if (!res.ok) {
-        const d = classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id'))
+        const d = classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id'), res.headers.get('x-deny-reason'))
         return { content: [{ type: 'text', text: `Could not assemble story: ${d.message}` }] }
       }
       const { answer, sourceCount, sources } = await res.json()
@@ -124,7 +124,7 @@ export async function runServer(version) {
         return { content: [{ type: 'text', text: `Could not set privacy: ${e.message}` }] }
       }
       if (!res.ok) {
-        const d = classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id'))
+        const d = classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id'), res.headers.get('x-deny-reason'))
         return { content: [{ type: 'text', text: `Could not set privacy: ${d.message}` }] }
       }
       const out = await res.json()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theronap/cortex-mcp",
-  "version": "0.4.3",
+  "version": "0.4.4",
   "description": "Connect your AI assistant to Cortex — your org's projects, activity, gaps, and directives, scoped to you.",
   "type": "module",
   "bin": {