@togglhq/mcp 1.12.6 → 1.13.0

package/README.md

@@ -2,6 +2,8 @@
 
 A local MCP (Model Context Protocol) server that connects to the Toggl 2.0 API. Works with any MCP client including Claude Code and Claude Desktop.
 
+The server supports MCP `2026-07-28` and keeps compatibility with legacy MCP clients. JSON tool results include `structuredContent` for modern clients and a text fallback for older clients.
+
 ## One-click install
 
 [![Install in VS Code](https://img.shields.io/badge/Install_in-VS_Code-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://vscode.dev/redirect/mcp/install?name=toggl&config=%7B%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22-y%22%2C%22%40togglhq%2Fmcp%22%5D%2C%22env%22%3A%7B%7D%7D)

package/build/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { a as getProductAnalyticsDistinctId, c as resolvePublicSentryDsn, i as captureToolInvocation, l as shutdownProductAnalytics, n as runMcpCli, o as initProductAnalytics, r as PUBLIC_SENTRY_PRIVACY_OPTIONS, s as resolveProductAnalyticsDistinctId } from "./src-DYYXLriL.js";
+import { a as PUBLIC_SENTRY_PRIVACY_OPTIONS, c as initProductAnalytics, d as shutdownProductAnalytics, i as runMcpCli, l as resolveProductAnalyticsDistinctId, o as captureToolInvocation, s as getProductAnalyticsDistinctId, u as resolvePublicSentryDsn } from "./src-Wi0RVSpx.js";
 import * as Sentry from "@sentry/node";
 //#region src/analytics-tool-metadata.ts
 /**
@@ -162,7 +162,7 @@ function wrapServerWithProductAnalytics(server) {
 }
 //#endregion
 //#region src/cli.ts
-const packageVersion = "1.12.6";
+const packageVersion = "1.13.0";
 let sentryEnabled = false;
 let productAnalyticsEnabled = false;
 runMcpCli({

package/build/index.d.ts

@@ -1,4 +1,4 @@
-//#region ../../node_modules/.pnpm/@modelcontextprotocol+server@2.0.0/node_modules/@modelcontextprotocol/server/dist/types-DUs7mGBv.d.mts
+//#region ../../node_modules/.pnpm/@modelcontextprotocol+server@2.3.0/node_modules/@modelcontextprotocol/server/dist/types-DUs7mGBv.d.mts
 //#region ../../node_modules/.pnpm/json-schema-typed@8.0.2/node_modules/json-schema-typed/draft_2020_12.d.ts
 type MaybeReadonlyArray<T> = Array<T> | ReadonlyArray<T>;
 type ValueOf<T> = T[keyof T];
@@ -3195,7 +3195,7 @@ interface ZodISODateTime extends ZodStringFormat {
 }
 declare const ZodISODateTime: $constructor<ZodISODateTime>;
 //#endregion
-//#region ../../node_modules/.pnpm/@modelcontextprotocol+core@2.0.0/node_modules/@modelcontextprotocol/core/dist/auth-BWdKR39I.d.mts
+//#region ../../node_modules/.pnpm/@modelcontextprotocol+core@2.3.0/node_modules/@modelcontextprotocol/core/dist/auth-Anm-lwWi.d.mts
 //#region src/types.d.ts
 type JSONValue = string | number | boolean | null | JSONObject | JSONArray;
 type JSONObject = {
@@ -3261,6 +3261,24 @@ declare const NotificationSchema: ZodObject<{
  * and intended for display, logging, and debugging). The getter defers the
  * `ImplementationSchema` reference, which is declared later in this file.
  */
+declare const ResultMetaObjectSchema: ZodObject<{
+  readonly "io.modelcontextprotocol/serverInfo": ZodCatch<ZodOptional<ZodObject<{
+    version: ZodString;
+    websiteUrl: ZodOptional<ZodString>;
+    description: ZodOptional<ZodString>;
+    icons: ZodOptional<ZodArray<ZodObject<{
+      src: ZodString;
+      mimeType: ZodOptional<ZodString>;
+      sizes: ZodOptional<ZodArray<ZodString>>;
+      theme: ZodOptional<ZodEnum<{
+        light: "light";
+        dark: "dark";
+      }>>;
+    }, $strip>>>;
+    name: ZodString;
+    title: ZodOptional<ZodString>;
+  }, $strip>>>;
+}, $loose>;
 declare const ResultSchema: ZodObject<{
   /**
    * See [MCP specification](https://modelcontextprotocol.io/specification/2026-07-28/basic/index#general-fields)
@@ -7027,7 +7045,7 @@ declare const ServerNotificationSchema: ZodUnion<readonly [ZodObject<{
   }, $strip>;
 }, $strip>]>;
 //#endregion
-//#region ../../node_modules/.pnpm/@modelcontextprotocol+server@2.0.0/node_modules/@modelcontextprotocol/server/dist/createMcpHandler-CLhGwQTn.d.mts
+//#region ../../node_modules/.pnpm/@modelcontextprotocol+server@2.3.0/node_modules/@modelcontextprotocol/server/dist/createMcpHandler-D4NN8WsG.d.mts
 //#endregion
 //#region ../core-internal/src/errors/sdkErrors.d.ts
 /**
@@ -7153,7 +7171,17 @@ declare class SdkError extends Error {
    * silently matching nothing).
    */
   static isInstance<T$1 extends abstract new (...args: never[]) => unknown>(this: T$1, value: unknown): value is InstanceType<T$1>;
-  constructor(code: SdkErrorCode, message: string, data?: unknown | undefined);
+  /**
+   * @param code - Stable string code identifying the failure ({@linkcode SdkErrorCode}).
+   * @param message - Human-readable description.
+   * @param data - Optional structured payload (for example the HTTP status carried by
+   * {@linkcode SdkHttpError}). Opaque to the SDK: a `cause` key inside `data` is not
+   * promoted to `Error.cause`.
+   * @param options - Standard `ErrorOptions`, forwarded to `Error`. Pass the underlying
+   * failure as `{ cause }` so it is reachable through the `Error.cause` chain that
+   * loggers and error trackers walk.
+   */
+  constructor(code: SdkErrorCode, message: string, data?: unknown | undefined, options?: ErrorOptions);
 }
 /**
  * Typed shape for HTTP error data carried by {@linkcode SdkHttpError}.
@@ -7446,6 +7474,18 @@ interface AuthInfo {
    * If set, this MUST match the MCP server's resource identifier (minus hash fragment).
    */
   resource?: URL;
+  /**
+   * URL of the RFC 9728 Protected Resource Metadata document for the
+   * resource server that accepted this token.
+   *
+   * The bearer-auth helpers stamp their configured `resourceMetadataUrl`
+   * here when verification succeeds, so challenge responses built after
+   * authentication (for example per-operation `insufficient_scope` scope
+   * challenges) can advertise the same document as the authentication
+   * gate's own challenges without separate configuration. Verifiers may
+   * also populate it directly; a verifier-set value wins.
+   */
+  resourceMetadataUrl?: string;
   /**
    * Additional data associated with the token.
    * This field should be used for any additional data that needs to be attached to the auth info.
@@ -7504,6 +7544,11 @@ interface MessageExtraInfo {
    */
   closeStandaloneSSEStream?: () => void;
 }
+/**
+ * The contents of a result's `_meta` field (the 2026-07-28 `ResultMetaObject`):
+ * loose, with the optional self-reported serverInfo key typed when present.
+ */
+type ResultMetaObject = Infer<typeof ResultMetaObjectSchema>;
 /**
  * {@linkcode CreateMessageRequestParams} without tools - for backwards-compatible overload.
  * Excludes tools/toolChoice to indicate they should not be provided.
@@ -7599,7 +7644,8 @@ type DecodedResult = {
    * discriminated payload to it.
    */
   inputRequests: Record<string, unknown>;
-  requestState?: string;
+  requestState?: string; /** Result-level `_meta`, carried through so a manual caller sees it. */
+  _meta?: ResultMetaObject;
 } | {
   kind: 'invalid';
   error: SdkError;
@@ -8236,6 +8282,8 @@ declare abstract class Protocol<ContextT extends BaseContext> {
   private _transport?;
   private _requestMessageId;
   private _requestHandlers;
+  /** Methods registered with an explicit schema; the era gate in `_onrequest` reads it for the Tasks extension names. */
+  private _customSchemaRequestMethods;
   private _requestHandlerAbortControllers;
   private _notificationHandlers;
   private _responseHandlers;
@@ -8634,6 +8682,25 @@ declare class UriTemplate {
  * `StreamableHTTPClientTransport` against a local server URL.
  */
 //#endregion
+//#region src/server/scopeChallenge.d.ts
+/** OAuth scopes to request before handling an MCP request. */
+interface ScopeChallenge {
+  /** The exact, complete scope set to include in the challenge. Each scope must satisfy the OAuth `scope-token` grammar. */
+  scopes: readonly [string, ...string[]];
+  /** Optional human-readable detail satisfying the RFC 6750 `error-description` grammar. */
+  errorDescription?: string;
+}
+/** Determines whether an MCP request needs an OAuth scope challenge. */
+type ScopeChallengeHandler = (context: {
+  request: JSONRPCRequest;
+  authInfo?: AuthInfo;
+}) => ScopeChallenge | undefined | Promise<ScopeChallenge | undefined>;
+/**
+ * Creates a handler that requires every supplied scope exactly.
+ *
+ * Requests without authentication are left to the server's authentication gate.
+ */
+//#endregion
 //#region src/server/server.d.ts
 type ServerOptions = ProtocolOptions & {
   /**
@@ -8775,6 +8842,8 @@ declare class Server extends Protocol<ServerContext> {
    * Initializes this server with the given name and version information.
    */
   constructor(_serverInfo: Implementation, options?: ServerOptions);
+  /** Attaches to the given transport; rejects while this instance is connected to another one. */
+  connect(transport: Transport): Promise<void>;
   /**
    * Registers the built-in `logging/setLevel` request handler.
    *
@@ -9032,6 +9101,16 @@ declare class Server extends Protocol<ServerContext> {
   sendPromptListChanged(): Promise<void>;
 } //#endregion
 //#region src/server/mcp.d.ts
+/**
+ * Options for {@linkcode McpServer}: everything {@linkcode ServerOptions} accepts, plus `maxToolInputElements`.
+ */
+type McpServerOptions = ServerOptions & {
+  /**
+   * Largest combined number of array elements and object members a single `tools/call` `arguments` payload may contain.
+   * A number of at least 1; unset or `Infinity` means no limit.
+   */
+  maxToolInputElements?: number;
+};
 /**
  * High-level MCP server that provides a simpler API for working with resources, tools, and prompts.
  * For advanced usage (like sending notifications or setting custom request handlers), use the underlying
@@ -9050,16 +9129,12 @@ declare class McpServer {
    * The underlying {@linkcode Server} instance, useful for advanced operations like sending notifications.
    */
   readonly server: Server;
+  private readonly _maxToolInputElements;
   private _registeredResources;
   private _registeredResourceTemplates;
   private _registeredTools;
   private _registeredPrompts;
-  /**
-   * Per-tool JSON-converted `inputSchema`, memoized so the SEP-2243
-   * registration-time scan and the pre-dispatch validation step share one
-   * conversion instead of paying it twice per request under the
-   * per-request-factory `createMcpHandler` model.
-   */
+  /** Per-tool JSON-converted `inputSchema`, filled on first use by `toolInputSchemaJson()`. */
   private _toolInputSchemaJson;
   /**
    * The JSON-serialized `inputSchema` of a registered tool, or `undefined`
@@ -9070,7 +9145,7 @@ declare class McpServer {
    * @internal
    */
   toolInputSchemaJson(name: string): Record<string, unknown> | undefined;
-  constructor(serverInfo: Implementation, options?: ServerOptions);
+  constructor(serverInfo: Implementation, options?: McpServerOptions);
   /**
    * Attaches to the given transport, starts it, and starts listening for messages.
    *
@@ -9088,6 +9163,8 @@ declare class McpServer {
    * Closes the connection.
    */
   close(): Promise<void>;
+  /** @internal */
+  resolveScopeChallenge: ScopeChallengeHandler;
   private _toolHandlersInitialized;
   private setToolRequestHandlers;
   /**
@@ -9138,9 +9215,11 @@ declare class McpServer {
    */
   registerResource(name: string, uriOrTemplate: string, config: ResourceMetadata & {
     cacheHint?: CacheHint;
+    scopeChallenge?: ScopeChallengeHandler;
   }, readCallback: ReadResourceCallback): RegisteredResource;
   registerResource(name: string, uriOrTemplate: ResourceTemplate, config: ResourceMetadata & {
     cacheHint?: CacheHint;
+    scopeChallenge?: ScopeChallengeHandler;
   }, readCallback: ReadResourceTemplateCallback): RegisteredResourceTemplate;
   private _createRegisteredResource;
   private _createRegisteredResourceTemplate;
@@ -9178,7 +9257,8 @@ declare class McpServer {
     inputSchema?: InputArgs;
     outputSchema?: OutputArgs;
     annotations?: ToolAnnotations;
-    icons?: Icon[];
+    icons?: Icon[]; /** Determines whether this tool call needs an OAuth scope challenge. */
+    scopeChallenge?: ScopeChallengeHandler;
     _meta?: Record<string, unknown>;
   }, cb: ToolCallback<InputArgs>): RegisteredTool;
   /** @deprecated Wrap with `z.object({...})` instead. Raw-shape form: `inputSchema`/`outputSchema` may be a plain `{ field: z.string() }` record; it is auto-wrapped with `z.object()`. */
@@ -9189,6 +9269,7 @@ declare class McpServer {
     outputSchema?: OutputArgs;
     annotations?: ToolAnnotations;
     icons?: Icon[];
+    scopeChallenge?: ScopeChallengeHandler;
     _meta?: Record<string, unknown>;
   }, cb: LegacyToolCallback<InputArgs>): RegisteredTool;
   /**
@@ -9217,11 +9298,20 @@ declare class McpServer {
    * );
    * ```
    */
+  registerPrompt(name: string, config: {
+    title?: string;
+    description?: string;
+    argsSchema?: undefined;
+    icons?: Icon[]; /** Determines whether this prompt retrieval needs an OAuth scope challenge. */
+    scopeChallenge?: ScopeChallengeHandler;
+    _meta?: Record<string, unknown>;
+  }, cb: PromptCallback): RegisteredPrompt;
   registerPrompt<Args extends StandardSchemaWithJSON>(name: string, config: {
     title?: string;
     description?: string;
     argsSchema?: Args;
-    icons?: Icon[];
+    icons?: Icon[]; /** Determines whether this prompt retrieval needs an OAuth scope challenge. */
+    scopeChallenge?: ScopeChallengeHandler;
     _meta?: Record<string, unknown>;
   }, cb: PromptCallback<Args>): RegisteredPrompt;
   /** @deprecated Wrap with `z.object({...})` instead. Raw-shape form: `argsSchema` may be a plain `{ field: z.string() }` record; it is auto-wrapped with `z.object()`. */
@@ -9230,6 +9320,7 @@ declare class McpServer {
     description?: string;
     argsSchema?: Args;
     icons?: Icon[];
+    scopeChallenge?: ScopeChallengeHandler;
     _meta?: Record<string, unknown>;
   }, cb: LegacyPromptCallback<Args>): RegisteredPrompt;
   /**
@@ -9340,7 +9431,7 @@ type RegisteredTool = {
   outputSchema?: StandardSchemaWithJSON;
   /**
    * @hidden
-   * The converted JSON Schema of `outputSchema`, memoised at registration (and on
+   * The converted JSON Schema of `outputSchema`, memoised on first use (and on
    * `update({outputSchema})`) so the `tools/call` handler passes the SAME advertised schema
    * `tools/list` emits to the wire codec's `projectCallToolResult` — the SEP-2106 `{result:…}`
    * wrap predicate follows the schema's root, never the runtime value shape. `undefined` when
@@ -9350,6 +9441,7 @@ type RegisteredTool = {
   annotations?: ToolAnnotations;
   icons?: Icon[];
   execution?: ToolExecution;
+  scopeChallenge?: ScopeChallengeHandler;
   _meta?: Record<string, unknown>;
   handler: AnyToolHandler<StandardSchemaWithJSON | undefined>; /** @hidden */
   executor: ToolExecutor;
@@ -9364,6 +9456,7 @@ type RegisteredTool = {
     outputSchema?: StandardSchemaWithJSON;
     annotations?: ToolAnnotations;
     icons?: Icon[];
+    scopeChallenge?: ScopeChallengeHandler | null;
     _meta?: Record<string, unknown>;
     callback?: ToolCallback<StandardSchemaWithJSON>;
     enabled?: boolean;
@@ -9387,6 +9480,7 @@ type RegisteredResource = {
   title?: string;
   metadata?: ResourceMetadata; /** Cache hint applied to this resource's `resources/read` results on the 2026-07-28 revision. */
   cacheHint?: CacheHint;
+  scopeChallenge?: ScopeChallengeHandler;
   readCallback: ReadResourceCallback;
   enabled: boolean;
   enable(): void;
@@ -9396,6 +9490,7 @@ type RegisteredResource = {
     title?: string;
     uri?: string | null;
     metadata?: ResourceMetadata;
+    scopeChallenge?: ScopeChallengeHandler | null;
     callback?: ReadResourceCallback;
     enabled?: boolean;
   }): void;
@@ -9410,6 +9505,7 @@ type RegisteredResourceTemplate = {
   title?: string;
   metadata?: ResourceMetadata; /** Cache hint applied to this template's `resources/read` results on the 2026-07-28 revision. */
   cacheHint?: CacheHint;
+  scopeChallenge?: ScopeChallengeHandler;
   readCallback: ReadResourceTemplateCallback;
   enabled: boolean;
   enable(): void;
@@ -9419,6 +9515,7 @@ type RegisteredResourceTemplate = {
     title?: string;
     template?: ResourceTemplate;
     metadata?: ResourceMetadata;
+    scopeChallenge?: ScopeChallengeHandler | null;
     callback?: ReadResourceTemplateCallback;
     enabled?: boolean;
   }): void;
@@ -9435,6 +9532,7 @@ type RegisteredPrompt = {
   description?: string;
   argsSchema?: StandardSchemaWithJSON;
   icons?: Icon[];
+  scopeChallenge?: ScopeChallengeHandler;
   _meta?: Record<string, unknown>; /** @hidden */
   handler: PromptHandler;
   enabled: boolean;
@@ -9446,6 +9544,7 @@ type RegisteredPrompt = {
     description?: string;
     argsSchema?: Args;
     icons?: Icon[];
+    scopeChallenge?: ScopeChallengeHandler | null;
     _meta?: Record<string, unknown>;
     callback?: PromptCallback<Args>;
     enabled?: boolean;
@@ -9468,6 +9567,8 @@ type RegisteredPrompt = {
  */
 //#endregion
 //#region src/index.d.ts
+declare const MCP_CACHE_TTL_MS: number;
+declare const MCP_MAX_TOOL_INPUT_ELEMENTS = 10000;
 interface McpBootstrapUrls {
   focusApiUrl: string;
   accountsApiUrl: string;
@@ -9481,5 +9582,5 @@ interface McpBootstrapOptions {
 declare function runMcpCli(options?: McpBootstrapOptions): void;
 declare function bootstrapServer(options?: McpBootstrapOptions): void;
 //#endregion
-export { McpBootstrapOptions, McpBootstrapUrls, bootstrapServer, runMcpCli };
+export { MCP_CACHE_TTL_MS, MCP_MAX_TOOL_INPUT_ELEMENTS, McpBootstrapOptions, McpBootstrapUrls, bootstrapServer, runMcpCli };
 //# sourceMappingURL=index.d.ts.map

package/build/index.js

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
-import { n as runMcpCli, t as bootstrapServer } from "./src-DYYXLriL.js";
-export { bootstrapServer, runMcpCli };
+import { i as runMcpCli, n as MCP_MAX_TOOL_INPUT_ELEMENTS, r as bootstrapServer, t as MCP_CACHE_TTL_MS } from "./src-Wi0RVSpx.js";
+export { MCP_CACHE_TTL_MS, MCP_MAX_TOOL_INPUT_ELEMENTS, bootstrapServer, runMcpCli };