@tokenfactory/acc-mcp-server 0.1.0-internal

package/README.md

@@ -0,0 +1,66 @@
+# @tokenfactory/acc-mcp-server
+
+Agent Control Center MCP server. Stdio-transport subprocess spawned by
+`@tokenfactory/acc-runner` alongside each Claude Code session. Exposes
+six read-only ACC tools (`query_tasks`, `query_prs`, `query_cost`,
+`query_decisions`, `query_runners`, `query_approvals`) over the Model
+Context Protocol and telemeters every tool call to `acc.mcp_tool_calls`.
+
+## How agents reach it
+
+The runner writes a `.mcp.json` into the task working directory before
+spawning Claude Code:
+
+```json
+{
+  "mcpServers": {
+    "acc": {
+      "command": "npx",
+      "args": [
+        "-y", "@tokenfactory/acc-mcp-server",
+        "--task-id", "T-12345",
+        "--runner-id", "local-priyas-mbp",
+        "--access-token", "<runner JWT>"
+      ]
+    }
+  }
+}
+```
+
+Claude Code auto-discovers the server, lists the tools at session
+start, and the agent can call any of the six during a task. Each call
+writes one row to `acc.mcp_tool_calls` (latency, request args, response
+summary) via `POST /api/mcp/record-tool-call` — service-role only, so
+the agent surface cannot fabricate telemetry.
+
+## Tool catalog
+
+The catalog is a duplicate of `api/chat/_tools.ts` (the Ask-ACC chat
+contract). A parity test in `tests/tools.test.ts` cross-checks the two
+arrays so additions in one place fail CI in the other.
+
+## Environment
+
+| Var | Notes |
+| --- | --- |
+| `SUPABASE_URL` / `ACC_SUPABASE_URL` | Project URL |
+| `SUPABASE_ANON_KEY` / `ACC_SUPABASE_ANON_KEY` | Anon key for the user-scoped client |
+| `ACC_PUBLIC_URL` | ACC API host. Defaults to `https://acc.techarch.dev`. Overridable via `--public-url`. |
+| `ACC_MCP_ACCESS_TOKEN` | Runner JWT. Overridable via `--access-token` (visible in `ps`). |
+
+## Security notes
+
+- The runner's JWT is passed as a CLI arg. Visible in `ps` output for
+  the subprocess lifetime — acceptable for v0.5-C1 because the runner
+  itself owns the process tree, but tracked for v0.6 hardening (env-only
+  handoff or token-broker pattern).
+- Telemetry writes go through `POST /api/mcp/record-tool-call`, which
+  validates the JWT and uses the service-role to call
+  `acc.record_mcp_tool_call`. Direct RPC access is denied.
+
+## Versioning
+
+Pin `@modelcontextprotocol/sdk` exactly — MCP SDK churns on minor
+releases. Update via the standard checklist in
+`docs/acc/MCP_SERVER.md` (peer-dep cycle, schema-shape diff, parity
+test against the latest Claude Code release).

package/dist/cli.d.ts

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+interface ParsedArgs {
+    taskId: string | null;
+    runnerId: string | null;
+    accessToken: string;
+    publicUrl: string;
+}
+export declare function parseArgs(argv: string[]): ParsedArgs;
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAwBA,UAAU,UAAU;IAClB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CA0BpD"}

package/dist/cli.js

@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+/**
+ * acc-mcp-server entrypoint.
+ *
+ * Invoked by Claude Code (which reads .mcp.json from the runner CWD)
+ * as a child stdio subprocess. We parse argv + env, build a Supabase
+ * user-scoped client, and wire up the MCP Server on a
+ * StdioServerTransport.
+ *
+ * argv contract:
+ *   --task-id <id>        Optional. The ACC task this server is bound to.
+ *   --runner-id <id>      Optional. The runner that spawned us.
+ *   --access-token <jwt>  Optional. Falls back to ACC_MCP_ACCESS_TOKEN.
+ *   --public-url <url>    Optional. Falls back to ACC_PUBLIC_URL.
+ *
+ * The access token is the runner's user JWT; visible in `ps` output for
+ * the subprocess lifetime — see MCP_SERVER.md "Security notes" for the
+ * v0.6 hardening plan.
+ */
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { buildServer } from "./server.js";
+import { createMcpClient, resolveSupabaseConfig } from "./supabase.js";
+export function parseArgs(argv) {
+    const out = {};
+    for (let i = 0; i < argv.length; i += 1) {
+        const k = argv[i];
+        if (!k.startsWith("--"))
+            continue;
+        const key = k.slice(2);
+        const v = argv[i + 1];
+        if (v === undefined || v.startsWith("--")) {
+            out[key] = "";
+        }
+        else {
+            out[key] = v;
+            i += 1;
+        }
+    }
+    const accessToken = out["access-token"] || process.env.ACC_MCP_ACCESS_TOKEN || "";
+    const publicUrl = out["public-url"] ||
+        process.env.ACC_PUBLIC_URL ||
+        "https://acc.techarch.dev";
+    return {
+        taskId: out["task-id"] || null,
+        runnerId: out["runner-id"] || null,
+        accessToken,
+        publicUrl,
+    };
+}
+async function main() {
+    const args = parseArgs(process.argv.slice(2));
+    if (!args.accessToken) {
+        process.stderr.write("acc-mcp-server: --access-token (or ACC_MCP_ACCESS_TOKEN) is required\n");
+        process.exit(2);
+    }
+    const ctx = {
+        taskId: args.taskId,
+        runnerId: args.runnerId,
+        publicUrl: args.publicUrl,
+        accessToken: args.accessToken,
+    };
+    const sbCfg = resolveSupabaseConfig(args.accessToken);
+    const sb = createMcpClient(sbCfg);
+    const server = buildServer(ctx, sb);
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    process.stderr.write(`[acc-mcp-server] online (task=${ctx.taskId ?? "-"} runner=${ctx.runnerId ?? "-"})\n`);
+}
+// Only run when executed directly. Importers (tests) get the parse helper
+// and `main` without side effects.
+const isDirectRun = import.meta.url === `file://${process.argv[1]}` ||
+    import.meta.url.endsWith(process.argv[1] ?? "");
+if (isDirectRun) {
+    main().catch((err) => {
+        process.stderr.write(`[acc-mcp-server] fatal: ${err.message ?? String(err)}\n`);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAUvE,MAAM,UAAU,SAAS,CAAC,IAAc;IACtC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QAClC,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACb,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GACf,GAAG,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAC;IAChE,MAAM,SAAS,GACb,GAAG,CAAC,YAAY,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,cAAc;QAC1B,0BAA0B,CAAC;IAC7B,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI;QAC9B,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI;QAClC,WAAW;QACX,SAAS;KACV,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,wEAAwE,CACzE,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,GAAkB;QACzB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC;IACF,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACtD,MAAM,EAAE,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iCAAiC,GAAG,CAAC,MAAM,IAAI,GAAG,WAAW,GAAG,CAAC,QAAQ,IAAI,GAAG,KAAK,CACtF,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,mCAAmC;AACnC,MAAM,WAAW,GACf,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IAC/C,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAClD,IAAI,WAAW,EAAE,CAAC;IAChB,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,2BAA4B,GAAa,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CACrE,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/server.d.ts

@@ -0,0 +1,21 @@
+/**
+ * MCP server wiring. Builds an @modelcontextprotocol/sdk Server with
+ * two request handlers — tools/list returns our 6-tool catalog;
+ * tools/call dispatches to runTool() and telemeters the outcome.
+ *
+ * Exposed as a factory so tests can drive the protocol surface
+ * in-process (StdioServerTransport ↔ Client) without spawning a real
+ * subprocess.
+ */
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import type { SupabaseClient } from "@supabase/supabase-js";
+import { type RecordPayload } from "./telemetry.js";
+import type { ServerContext } from "./types.js";
+export declare const SERVER_NAME = "acc-mcp-server";
+export declare const SERVER_VERSION = "0.1.0";
+export interface BuildServerOptions {
+    /** Override the telemetry sink — tests pass an in-memory collector. */
+    recordCall?: (ctx: ServerContext, payload: RecordPayload) => Promise<void>;
+}
+export declare function buildServer(ctx: ServerContext, sb: SupabaseClient, opts?: BuildServerOptions): Server;
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAKnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,eAAO,MAAM,WAAW,mBAAmB,CAAC;AAC5C,eAAO,MAAM,cAAc,UAAU,CAAC;AAEtC,MAAM,WAAW,kBAAkB;IACjC,uEAAuE;IACvE,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5E;AAED,wBAAgB,WAAW,CACzB,GAAG,EAAE,aAAa,EAClB,EAAE,EAAE,cAAc,EAClB,IAAI,GAAE,kBAAuB,GAC5B,MAAM,CAgDR"}

package/dist/server.js

@@ -0,0 +1,60 @@
+/**
+ * MCP server wiring. Builds an @modelcontextprotocol/sdk Server with
+ * two request handlers — tools/list returns our 6-tool catalog;
+ * tools/call dispatches to runTool() and telemeters the outcome.
+ *
+ * Exposed as a factory so tests can drive the protocol surface
+ * in-process (StdioServerTransport ↔ Client) without spawning a real
+ * subprocess.
+ */
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
+import { TOOLS, runTool } from "./tools.js";
+import { buildResponseSummary, recordToolCall, safeArgsJson, } from "./telemetry.js";
+export const SERVER_NAME = "acc-mcp-server";
+export const SERVER_VERSION = "0.1.0";
+export function buildServer(ctx, sb, opts = {}) {
+    const record = opts.recordCall ?? recordToolCall;
+    const server = new Server({ name: SERVER_NAME, version: SERVER_VERSION }, { capabilities: { tools: {} } });
+    server.setRequestHandler(ListToolsRequestSchema, async () => ({
+        tools: TOOLS.map((t) => ({
+            name: t.name,
+            description: t.description,
+            inputSchema: t.inputSchema,
+        })),
+    }));
+    server.setRequestHandler(CallToolRequestSchema, async (req) => {
+        const toolName = req.params.name;
+        const rawArgs = req.params.arguments ?? {};
+        const startMs = Date.now();
+        let output;
+        let errorMsg = null;
+        try {
+            output = await runTool(toolName, rawArgs, sb);
+            if (output && typeof output === "object" && "error" in output) {
+                errorMsg = String(output.error);
+            }
+        }
+        catch (err) {
+            errorMsg = err.message ?? "tool_failed";
+            output = { error: errorMsg };
+        }
+        const text = JSON.stringify(output);
+        const summary = buildResponseSummary(startMs, output, Buffer.byteLength(text, "utf8"));
+        // Fire-and-forget: never block the agent on telemetry.
+        void record(ctx, {
+            task_id: ctx.taskId,
+            runner_id: ctx.runnerId,
+            tool_name: toolName,
+            request_args: safeArgsJson(rawArgs),
+            response_summary: summary,
+            error: errorMsg,
+        });
+        return {
+            content: [{ type: "text", text }],
+            isError: errorMsg !== null,
+        };
+    });
+    return server;
+}
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,YAAY,GAEb,MAAM,gBAAgB,CAAC;AAGxB,MAAM,CAAC,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAC5C,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AAOtC,MAAM,UAAU,WAAW,CACzB,GAAkB,EAClB,EAAkB,EAClB,OAA2B,EAAE;IAE7B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,IAAI,cAAc,CAAC;IACjD,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,EAC9C,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;IAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5D,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACvB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CAAC;KACJ,CAAC,CAAC,CAAC;IAEJ,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC5D,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QACjC,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,MAAe,CAAC;QACpB,IAAI,QAAQ,GAAkB,IAAI,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;YAC9C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,IAAK,MAAkC,EAAE,CAAC;gBAC3F,QAAQ,GAAG,MAAM,CAAE,MAA6B,CAAC,KAAK,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,GAAI,GAAa,CAAC,OAAO,IAAI,aAAa,CAAC;YACnD,MAAM,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QAC/B,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACvF,uDAAuD;QACvD,KAAK,MAAM,CAAC,GAAG,EAAE;YACf,OAAO,EAAE,GAAG,CAAC,MAAM;YACnB,SAAS,EAAE,GAAG,CAAC,QAAQ;YACvB,SAAS,EAAE,QAAQ;YACnB,YAAY,EAAE,YAAY,CAAC,OAAO,CAAC;YACnC,gBAAgB,EAAE,OAAO;YACzB,KAAK,EAAE,QAAQ;SAChB,CAAC,CAAC;QACH,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACjC,OAAO,EAAE,QAAQ,KAAK,IAAI;SAC3B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/supabase.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Supabase client factory for the MCP server. The runner forwards its
+ * OAuth access token (the same JWT it uses to talk to acc.* RPCs) on
+ * the CLI; we feed it to a user-scoped client so RLS sees the right
+ * `auth.uid()` and tools only return data the operator is allowed to
+ * see.
+ *
+ * The ACC public URL doubles as the Supabase URL host for the
+ * @supabase/supabase-js client *only* when invoked via the API
+ * — here we hit Supabase directly so we accept SUPABASE_URL via env
+ * as the canonical, with a public-URL fallback that the runner sets
+ * when spawning us.
+ */
+import { type SupabaseClient } from "@supabase/supabase-js";
+export interface SupabaseConfig {
+    supabaseUrl: string;
+    anonKey: string;
+    accessToken: string;
+}
+export declare function createMcpClient(cfg: SupabaseConfig): SupabaseClient;
+export declare function resolveSupabaseConfig(accessToken: string): SupabaseConfig;
+//# sourceMappingURL=supabase.d.ts.map

package/dist/supabase.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase.d.ts","sourceRoot":"","sources":["../src/supabase.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE1E,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAMD,wBAAgB,eAAe,CAAC,GAAG,EAAE,cAAc,GAAG,cAAc,CAMnE;AAED,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,cAAc,CAYzE"}

package/dist/supabase.js

@@ -0,0 +1,36 @@
+/**
+ * Supabase client factory for the MCP server. The runner forwards its
+ * OAuth access token (the same JWT it uses to talk to acc.* RPCs) on
+ * the CLI; we feed it to a user-scoped client so RLS sees the right
+ * `auth.uid()` and tools only return data the operator is allowed to
+ * see.
+ *
+ * The ACC public URL doubles as the Supabase URL host for the
+ * @supabase/supabase-js client *only* when invoked via the API
+ * — here we hit Supabase directly so we accept SUPABASE_URL via env
+ * as the canonical, with a public-URL fallback that the runner sets
+ * when spawning us.
+ */
+import { createClient } from "@supabase/supabase-js";
+// The MCP server speaks the acc schema. Supabase's generic types model
+// the default schema name in their type parameters, so we cast through
+// `unknown` to land on the canonical SupabaseClient<...> type that the
+// tool impls consume.
+export function createMcpClient(cfg) {
+    return createClient(cfg.supabaseUrl, cfg.anonKey, {
+        db: { schema: "acc" },
+        auth: { persistSession: false, autoRefreshToken: false },
+        global: { headers: { Authorization: `Bearer ${cfg.accessToken}` } },
+    });
+}
+export function resolveSupabaseConfig(accessToken) {
+    const supabaseUrl = process.env.SUPABASE_URL ?? process.env.ACC_SUPABASE_URL ?? "";
+    const anonKey = process.env.SUPABASE_ANON_KEY ??
+        process.env.ACC_SUPABASE_ANON_KEY ??
+        "";
+    if (!supabaseUrl || !anonKey) {
+        throw new Error("acc-mcp-server: SUPABASE_URL and SUPABASE_ANON_KEY (or ACC_SUPABASE_*) must be set");
+    }
+    return { supabaseUrl, anonKey, accessToken };
+}
+//# sourceMappingURL=supabase.js.map

package/dist/supabase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase.js","sourceRoot":"","sources":["../src/supabase.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,YAAY,EAAuB,MAAM,uBAAuB,CAAC;AAQ1E,uEAAuE;AACvE,uEAAuE;AACvE,uEAAuE;AACvE,sBAAsB;AACtB,MAAM,UAAU,eAAe,CAAC,GAAmB;IACjD,OAAO,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,OAAO,EAAE;QAChD,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACrB,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;QACxD,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,CAAC,WAAW,EAAE,EAAE,EAAE;KACpE,CAA8B,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,WAAmB;IACvD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC;IACnF,MAAM,OAAO,GACX,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,OAAO,CAAC,GAAG,CAAC,qBAAqB;QACjC,EAAE,CAAC;IACL,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;AAC/C,CAAC"}

package/dist/telemetry.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Telemetry sink. Every tool call writes one row to acc.mcp_tool_calls.
+ *
+ * The MCP server runs under the runner's user JWT; the
+ * acc.record_mcp_tool_call RPC is service-role only (telemetry must be
+ * un-forgeable from the agent surface). So we post through the ACC
+ * server: POST {publicUrl}/api/mcp/record-tool-call which forwards the
+ * Bearer JWT, validates the user, and inserts via the service-role.
+ *
+ * The sink is fire-and-forget *for the agent*: a failed telemetry write
+ * is logged to stderr but never bubbled to the model, so a transient
+ * network blip doesn't poison the agent loop.
+ */
+import type { ResponseSummary, ServerContext } from "./types.js";
+export declare function buildResponseSummary(startMs: number, response: unknown, bytes: number): ResponseSummary;
+export declare function safeArgsJson(args: unknown): unknown;
+export interface RecordPayload {
+    task_id: string | null;
+    runner_id: string | null;
+    tool_name: string;
+    request_args: unknown;
+    response_summary: ResponseSummary;
+    error: string | null;
+}
+type Fetcher = typeof fetch;
+export declare function recordToolCall(ctx: ServerContext, payload: RecordPayload, fetcher?: Fetcher): Promise<void>;
+export {};
+//# sourceMappingURL=telemetry.d.ts.map

package/dist/telemetry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.d.ts","sourceRoot":"","sources":["../src/telemetry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAIjE,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,OAAO,EACjB,KAAK,EAAE,MAAM,GACZ,eAAe,CAkBjB;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAQnD;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,OAAO,CAAC;IACtB,gBAAgB,EAAE,eAAe,CAAC;IAClC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,KAAK,OAAO,GAAG,OAAO,KAAK,CAAC;AAE5B,wBAAsB,cAAc,CAClC,GAAG,EAAE,aAAa,EAClB,OAAO,EAAE,aAAa,EACtB,OAAO,GAAE,OAAe,GACvB,OAAO,CAAC,IAAI,CAAC,CAsBf"}

package/dist/telemetry.js

@@ -0,0 +1,51 @@
+const REQUEST_ARGS_CAP = 4 * 1024;
+export function buildResponseSummary(startMs, response, bytes) {
+    const latency_ms = Math.max(0, Math.round(Date.now() - startMs));
+    const rowCount = Array.isArray(response)
+        ? response.length
+        : typeof response === "object" && response !== null && Array.isArray(response.rows)
+            ? (response.rows.length)
+            : 0;
+    const hasResults = rowCount > 0 ||
+        (typeof response === "object" &&
+            response !== null &&
+            !("error" in response));
+    return {
+        row_count: rowCount,
+        has_results: hasResults,
+        response_size_bytes: bytes,
+        latency_ms,
+    };
+}
+export function safeArgsJson(args) {
+    try {
+        const s = JSON.stringify(args ?? {});
+        if (s.length <= REQUEST_ARGS_CAP)
+            return args;
+        return { _truncated: true, preview: s.slice(0, REQUEST_ARGS_CAP) };
+    }
+    catch {
+        return { _unserializable: true };
+    }
+}
+export async function recordToolCall(ctx, payload, fetcher = fetch) {
+    const url = `${ctx.publicUrl.replace(/\/+$/, "")}/api/mcp/record-tool-call`;
+    try {
+        const res = await fetcher(url, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Authorization: `Bearer ${ctx.accessToken}`,
+            },
+            body: JSON.stringify(payload),
+        });
+        if (!res.ok) {
+            const body = await res.text().catch(() => "");
+            process.stderr.write(`[acc-mcp-server] telemetry POST failed ${res.status}: ${body.slice(0, 200)}\n`);
+        }
+    }
+    catch (err) {
+        process.stderr.write(`[acc-mcp-server] telemetry POST threw: ${err.message}\n`);
+    }
+}
+//# sourceMappingURL=telemetry.js.map

package/dist/telemetry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.js","sourceRoot":"","sources":["../src/telemetry.ts"],"names":[],"mappings":"AAeA,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,CAAC;AAElC,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,QAAiB,EACjB,KAAa;IAEb,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QACtC,CAAC,CAAC,QAAQ,CAAC,MAAM;QACjB,CAAC,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAE,QAA+B,CAAC,IAAI,CAAC;YACzG,CAAC,CAAC,CAAE,QAAgC,CAAC,IAAI,CAAC,MAAM,CAAC;YACjD,CAAC,CAAC,CAAC,CAAC;IACR,MAAM,UAAU,GACd,QAAQ,GAAG,CAAC;QACZ,CAAC,OAAO,QAAQ,KAAK,QAAQ;YAC3B,QAAQ,KAAK,IAAI;YACjB,CAAC,CAAC,OAAO,IAAK,QAAoC,CAAC,CAAC,CAAC;IACzD,OAAO;QACL,SAAS,EAAE,QAAQ;QACnB,WAAW,EAAE,UAAU;QACvB,mBAAmB,EAAE,KAAK;QAC1B,UAAU;KACX,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAa;IACxC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,CAAC,MAAM,IAAI,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAC9C,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,EAAE,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IACnC,CAAC;AACH,CAAC;AAaD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAkB,EAClB,OAAsB,EACtB,UAAmB,KAAK;IAExB,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,2BAA2B,CAAC;IAC5E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YAC7B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,GAAG,CAAC,WAAW,EAAE;aAC3C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;SAC9B,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0CAA0C,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAChF,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0CAA2C,GAAa,CAAC,OAAO,IAAI,CACrE,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/tools.d.ts

@@ -0,0 +1,21 @@
+/**
+ * MCP tool catalog + implementations.
+ *
+ * MIRROR of api/chat/_tools.ts — that file is the canonical contract
+ * (input schema, response shape) for ACC's read-only tools across
+ * BOTH the Ask-ACC chat path and the MCP-server-for-agents path.
+ *
+ * When you add or change a tool here, change api/chat/_tools.ts in the
+ * same PR. tests/tools.test.ts cross-checks that the two catalogs are
+ * structurally identical and fails CI if they drift.
+ *
+ * Why duplicate? The MCP server is published as a standalone npm
+ * package (workspaces don't survive `npm publish`). The api/_lib path
+ * isn't reachable at runtime from `npx -y @tokenfactory/acc-mcp-server`,
+ * so we keep two source-of-truth copies and enforce parity via test.
+ */
+import type { SupabaseClient } from "@supabase/supabase-js";
+import type { ToolDef } from "./types.js";
+export declare const TOOLS: ToolDef[];
+export declare function runTool(name: string, rawArgs: unknown, sb: SupabaseClient): Promise<unknown>;
+//# sourceMappingURL=tools.d.ts.map

package/dist/tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAQ1C,eAAO,MAAM,KAAK,EAAE,OAAO,EAwD1B,CAAC;AAQF,wBAAsB,OAAO,CAC3B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,OAAO,EAChB,EAAE,EAAE,cAAc,GACjB,OAAO,CAAC,OAAO,CAAC,CAqFlB"}

package/dist/tools.js

@@ -0,0 +1,154 @@
+const obj = (properties, required = []) => ({
+    type: "object",
+    properties,
+    ...(required.length ? { required } : {}),
+});
+export const TOOLS = [
+    {
+        name: "query_tasks",
+        description: "List tasks. Filter by status ('queued', 'running', 'blocked', 'needs-review', ...), runner id, ISO since timestamp, and limit.",
+        inputSchema: obj({
+            status: { type: "string" },
+            runner_id: { type: "string" },
+            since: { type: "string", description: "ISO-8601 timestamp" },
+            limit: { type: "integer", minimum: 1, maximum: 100 },
+        }),
+    },
+    {
+        name: "query_prs",
+        description: "List pull requests. Filter by state ('open', 'merged', 'closed', 'draft'), repo (owner/name), or ISO since timestamp.",
+        inputSchema: obj({
+            state: { type: "string" },
+            repo: { type: "string" },
+            since: { type: "string" },
+        }),
+    },
+    {
+        name: "query_cost",
+        description: "Sum cost in USD cents over a scope. scope='task' requires scope_id; 'user' and 'org' aggregate across cost_events visible to the caller.",
+        inputSchema: obj({
+            scope: { type: "string", enum: ["task", "user", "org"] },
+            scope_id: { type: "string" },
+            since: { type: "string" },
+            until: { type: "string" },
+        }, ["scope"]),
+    },
+    {
+        name: "query_decisions",
+        description: "List decisions. Filter by kind (e.g. 'task-status', 'merge-approval'), actor user id, or ISO since timestamp.",
+        inputSchema: obj({
+            kind: { type: "string" },
+            actor_id: { type: "string" },
+            since: { type: "string" },
+        }),
+    },
+    {
+        name: "query_runners",
+        description: "List all known runners with current status and last heartbeat.",
+        inputSchema: obj({}),
+    },
+    {
+        name: "query_approvals",
+        description: "List approval requests. Filter by state ('pending', 'approved', 'denied').",
+        inputSchema: obj({ state: { type: "string" } }),
+    },
+];
+function clampInt(raw, min, max, fallback) {
+    const n = typeof raw === "number" ? raw : Number(raw);
+    if (!Number.isFinite(n))
+        return fallback;
+    return Math.max(min, Math.min(max, Math.floor(n)));
+}
+export async function runTool(name, rawArgs, sb) {
+    const args = (rawArgs && typeof rawArgs === "object"
+        ? rawArgs
+        : {});
+    switch (name) {
+        case "query_tasks": {
+            let q = sb
+                .from("tasks")
+                .select("id, title, status, agent_id, runner_id, branch, priority, risk, pr_number, repo, created_at, updated_at")
+                .order("updated_at", { ascending: false })
+                .limit(clampInt(args.limit, 1, 100, 25));
+            if (typeof args.status === "string")
+                q = q.eq("status", args.status);
+            if (typeof args.runner_id === "string")
+                q = q.eq("runner_id", args.runner_id);
+            if (typeof args.since === "string")
+                q = q.gte("updated_at", args.since);
+            const { data, error } = await q;
+            return error ? { error: error.message } : (data ?? []);
+        }
+        case "query_prs": {
+            let q = sb
+                .from("prs")
+                .select("number, title, state, branch, base_branch, ci, typecheck, github_url, task_id, agent_id, created_at, merged_at")
+                .order("created_at", { ascending: false })
+                .limit(50);
+            if (typeof args.state === "string")
+                q = q.eq("state", args.state);
+            if (typeof args.repo === "string")
+                q = q.eq("repo", args.repo);
+            if (typeof args.since === "string")
+                q = q.gte("created_at", args.since);
+            const { data, error } = await q;
+            return error ? { error: error.message } : (data ?? []);
+        }
+        case "query_cost": {
+            const scope = String(args.scope ?? "");
+            let q = sb.from("cost_events").select("usd_cents, recorded_at, task_id, model");
+            if (scope === "task") {
+                if (typeof args.scope_id !== "string")
+                    return { error: "scope_id required for task scope" };
+                q = q.eq("task_id", args.scope_id);
+            }
+            if (typeof args.since === "string")
+                q = q.gte("recorded_at", args.since);
+            if (typeof args.until === "string")
+                q = q.lte("recorded_at", args.until);
+            const { data, error } = await q;
+            if (error)
+                return { error: error.message };
+            const rows = (data ?? []);
+            const total = rows.reduce((acc, r) => acc + (r.usd_cents ?? 0), 0);
+            return { total_usd_cents: total, event_count: rows.length };
+        }
+        case "query_decisions": {
+            let q = sb
+                .from("decisions")
+                .select("id, kind, text, target, by_user_id, by_agent_id, system_actor, created_at")
+                .order("created_at", { ascending: false })
+                .limit(50);
+            if (typeof args.kind === "string")
+                q = q.eq("kind", args.kind);
+            if (typeof args.actor_id === "string")
+                q = q.eq("by_user_id", args.actor_id);
+            if (typeof args.since === "string")
+                q = q.gte("created_at", args.since);
+            const { data, error } = await q;
+            return error ? { error: error.message } : (data ?? []);
+        }
+        case "query_runners": {
+            // MCP server runs with the user's JWT; the "members read runners"
+            // RLS policy (0012) grants the full listing without admin escalation.
+            const { data, error } = await sb
+                .from("runners")
+                .select("id, name, owner, status, type, heartbeat_at, last_seen_version, current_task_id")
+                .order("status");
+            return error ? { error: error.message } : (data ?? []);
+        }
+        case "query_approvals": {
+            let q = sb
+                .from("approvals")
+                .select("id, kind, severity, title, subtitle, target, state, created_at")
+                .order("created_at", { ascending: false })
+                .limit(50);
+            if (typeof args.state === "string")
+                q = q.eq("state", args.state);
+            const { data, error } = await q;
+            return error ? { error: error.message } : (data ?? []);
+        }
+    }
+    return { error: `unknown_tool: ${name}` };
+}
+//# sourceMappingURL=tools.js.map

package/dist/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAmBA,MAAM,GAAG,GAAG,CAAC,UAAmC,EAAE,WAAqB,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7E,IAAI,EAAE,QAAQ;IACd,UAAU;IACV,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CACzC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,KAAK,GAAc;IAC9B;QACE,IAAI,EAAE,aAAa;QACnB,WAAW,EACT,gIAAgI;QAClI,WAAW,EAAE,GAAG,CAAC;YACf,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC7B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE;YAC5D,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE;SACrD,CAAC;KACH;IACD;QACE,IAAI,EAAE,WAAW;QACjB,WAAW,EACT,uHAAuH;QACzH,WAAW,EAAE,GAAG,CAAC;YACf,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACxB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;SAC1B,CAAC;KACH;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EACT,0IAA0I;QAC5I,WAAW,EAAE,GAAG,CACd;YACE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;YACxD,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;SAC1B,EACD,CAAC,OAAO,CAAC,CACV;KACF;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACT,+GAA+G;QACjH,WAAW,EAAE,GAAG,CAAC;YACf,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACxB,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;SAC1B,CAAC;KACH;IACD;QACE,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,gEAAgE;QAC7E,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC;KACrB;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,4EAA4E;QACzF,WAAW,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;KAChD;CACF,CAAC;AAEF,SAAS,QAAQ,CAAC,GAAY,EAAE,GAAW,EAAE,GAAW,EAAE,QAAgB;IACxE,MAAM,CAAC,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC;IACzC,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,IAAY,EACZ,OAAgB,EAChB,EAAkB;IAElB,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAClD,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,EAAE,CAA4B,CAAC;IAEnC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,IAAI,CAAC,GAAG,EAAE;iBACP,IAAI,CAAC,OAAO,CAAC;iBACb,MAAM,CACL,yGAAyG,CAC1G;iBACA,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;iBACzC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;YAC3C,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;gBAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACrE,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;gBAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAC9E,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;gBAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACxE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,CAAC;YAChC,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,IAAI,CAAC,GAAG,EAAE;iBACP,IAAI,CAAC,KAAK,CAAC;iBACX,MAAM,CACL,gHAAgH,CACjH;iBACA,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;iBACzC,KAAK,CAAC,EAAE,CAAC,CAAC;YACb,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;gBAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YAClE,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;gBAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/D,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;gBAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACxE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,CAAC;YAChC,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YACvC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,wCAAwC,CAAC,CAAC;YAChF,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;gBACrB,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;oBACnC,OAAO,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC;gBACvD,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrC,CAAC;YACD,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;gBAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACzE,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;gBAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACzE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,CAAC;YAChC,IAAI,KAAK;gBAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAiC,CAAC;YAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACnE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QAC9D,CAAC;QACD,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,IAAI,CAAC,GAAG,EAAE;iBACP,IAAI,CAAC,WAAW,CAAC;iBACjB,MAAM,CAAC,2EAA2E,CAAC;iBACnF,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;iBACzC,KAAK,CAAC,EAAE,CAAC,CAAC;YACb,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;gBAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/D,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;gBAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7E,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;gBAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACxE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,CAAC;YAChC,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,kEAAkE;YAClE,sEAAsE;YACtE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE;iBAC7B,IAAI,CAAC,SAAS,CAAC;iBACf,MAAM,CACL,iFAAiF,CAClF;iBACA,KAAK,CAAC,QAAQ,CAAC,CAAC;YACnB,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,IAAI,CAAC,GAAG,EAAE;iBACP,IAAI,CAAC,WAAW,CAAC;iBACjB,MAAM,CAAC,gEAAgE,CAAC;iBACxE,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;iBACzC,KAAK,CAAC,EAAE,CAAC,CAAC;YACb,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;gBAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YAClE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,CAAC;YAChC,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,iBAAiB,IAAI,EAAE,EAAE,CAAC;AAC5C,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Shared types for the acc-mcp-server package.
+ *
+ * The CLI populates a `ServerContext` from argv + env and threads it
+ * through to every tool handler so each call can telemeter the right
+ * (task_id, runner_id, user_id) tuple.
+ */
+export interface ServerContext {
+    taskId: string | null;
+    runnerId: string | null;
+    publicUrl: string;
+    accessToken: string;
+}
+export type ToolName = "query_tasks" | "query_prs" | "query_cost" | "query_decisions" | "query_runners" | "query_approvals";
+export interface ToolDef {
+    name: ToolName;
+    description: string;
+    inputSchema: Record<string, unknown>;
+}
+export interface ResponseSummary {
+    row_count: number;
+    has_results: boolean;
+    response_size_bytes: number;
+    latency_ms: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,QAAQ,GAChB,aAAa,GACb,WAAW,GACX,YAAY,GACZ,iBAAiB,GACjB,eAAe,GACf,iBAAiB,CAAC;AAEtB,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,QAAQ,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;CACpB"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,34 @@
+{
+  "name": "@tokenfactory/acc-mcp-server",
+  "version": "0.1.0-internal",
+  "description": "Agent Control Center MCP server. Stdio-transport subprocess spawned by acc-runner alongside Claude Code; exposes read-only ACC tools and telemeters every call to acc.mcp_tool_calls.",
+  "license": "UNLICENSED",
+  "private": false,
+  "type": "module",
+  "bin": {
+    "acc-mcp-server": "./dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=20.6.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint .",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "1.29.0",
+    "@supabase/supabase-js": "^2.105.3",
+    "zod": "^3.25.28"
+  },
+  "devDependencies": {
+    "@types/node": "^25.6.0",
+    "typescript": "^5.6.3",
+    "vitest": "^1.6.1"
+  }
+}