@tokenlabai/mcp-server 0.6.22 → 0.6.24

package/README.md

@@ -4,21 +4,21 @@
 [![npm](https://img.shields.io/npm/v/%40tokenlabai%2Fmcp-server)](https://www.npmjs.com/package/@tokenlabai/mcp-server)
 [![npm downloads](https://img.shields.io/npm/dm/%40tokenlabai%2Fmcp-server)](https://www.npmjs.com/package/@tokenlabai/mcp-server)
 
-OpenAPI-generated Model Context Protocol server for TokenLab public model discovery, pricing, native LLM endpoints, multimodal generation, async tasks, files, embeddings, rerank, translation, resources, prompts, and the broader developer API.
+OpenAPI-generated Model Context Protocol server for TokenLab public model discovery, pricing, native LLM endpoints, typed decisions, multimodal generation, async tasks, files, embeddings, rerank, translation, resources, prompts, and the broader developer API.
 
-It exposes public catalog tools for agents that need to choose models, inspect supported request formats, or compare pricing before calling TokenLab APIs. Credentialed tools cover text inference, image generation and editing, video, music, 3D, async task polling, embeddings, rerank, and text translation.
+It exposes public catalog tools for agents that need to choose models, inspect supported request formats, or compare pricing before calling TokenLab APIs. Credentialed tools cover text inference, image generation and editing, video, music, 3D, async task polling, embeddings, rerank, typed decisions, and text translation.
 
 ## Generated Tool Profiles
 
-The checked-in `generated/tools.json` manifest is generated from TokenLab's public OpenAPI document plus the small MCP-only overlay in `contract/mcp-overlay.json`. Version 0.6.22 generates 78 endpoint tools; with the two MCP-only composite discovery tools, the full profile returns 80 tools from `tools/list`.
+The checked-in `generated/tools.json` manifest is generated from TokenLab's public OpenAPI document plus the small MCP-only overlay in `contract/mcp-overlay.json`. Version 0.6.24 generates 87 endpoint tools; with the two MCP-only composite discovery tools, the full profile returns 89 tools from `tools/list`.
 
 | Profile | Endpoint tools | Total registered tools | Model-facing schema | Coverage |
 | --- | ---: | ---: | --- | --- |
 | `catalog` | 4 | 6 | Exact | Public model discovery and pricing only; no API key required |
-| `core` (default) | 29 | 31 | Portable | Catalog and pricing; Chat Completions, Responses, Anthropic Messages, Gemini generateContent; images, video, music, 3D, speech and transcription; async tasks; files; embeddings, rerank, and translation |
-| `full` | 78 | 80 | Portable | Every allowlisted developer API operation in the checked-in OpenAPI snapshot, including core plus response lifecycle, batches, worlds, and native model discovery |
+| `core` (default) | 30 | 32 | Portable | Catalog and pricing; Chat Completions, Responses, Anthropic Messages, Gemini generateContent; System One typed decisions; images, video, music, 3D, speech and transcription; async tasks; files; embeddings, rerank, and translation |
+| `full` | 87 | 89 | Portable | Every allowlisted developer API operation in the checked-in OpenAPI snapshot, including core plus response lifecycle, batches, worlds, and native model discovery |
 
-The total registered count is the number returned by `tools/list`. All profiles include `compare_models` and `get_api_overview`, producing totals of 6, 31, and 80 tools. Realtime and streaming-only operations are excluded because stdio MCP tool calls return one final result. API operations that accept `stream` fix it internally to `false` without exposing a boolean `const` to provider adapters, and the Gemini query-string API key is intentionally hidden from tool arguments.
+The total registered count is the number returned by `tools/list`. All profiles include `compare_models` and `get_api_overview`, producing totals of 6, 32, and 89 tools. Realtime and streaming-only operations are excluded because stdio MCP tool calls return one final result. API operations that accept `stream` fix it internally to `false` without exposing a boolean `const` to provider adapters, and the Gemini query-string API key is intentionally hidden from tool arguments.
 
 The portable projection keeps every top-level argument but bounds deeply nested model-facing shapes. The server still validates calls against the complete generated OpenAPI schema before issuing an API request. Compatibility budgets keep `core` at no more than 60 KB and depth 8, and `full` at no more than 100 KB and depth 8 for the complete `tools/list` response. Tests also run the full profile through the Google AI SDK version used by the observed OpenCode/Gemini failure.
 
@@ -105,7 +105,7 @@ Use `delivery.mode` instead of assuming all image requests are synchronous. For
 ## Environment
 
 - `TOKENLAB_API_BASE`: optional, defaults to `https://api.tokenlab.sh`
-- `TOKENLAB_API_KEY`: optional; required for text inference, multimodal generation, async task, embedding, rerank, and translation tools
+- `TOKENLAB_API_KEY`: optional; required for text inference, multimodal generation, async task, embedding, rerank, decision, and translation tools
 - `TOKENLAB_MCP_TOOL_PROFILE`: optional, `catalog`, `core` (default), or `full`
 - `TOKENLAB_MCP_SCHEMA_MODE`: optional, `portable`, `exact`, or `strict`; defaults to the selected profile's tested mode
 - `TOKENLAB_REQUEST_TIMEOUT_MS`: optional request timeout in milliseconds, defaults to `120000`
@@ -134,7 +134,7 @@ This repository includes `server.json` for the official MCP Registry.
 
 Release metadata:
 
-- npm package: `@tokenlabai/mcp-server@0.6.22`
+- npm package: `@tokenlabai/mcp-server@0.6.24`
 - MCP registry name: `io.github.hedging8563/tokenlab`
 - `package.json.mcpName`: `io.github.hedging8563/tokenlab`
 
@@ -157,3 +157,11 @@ Use the `catalog` profile when no credentialed tools are needed. Keep `TOKENLAB_
 - OpenAPI: https://docs.tokenlab.sh/openapi.json
 - Model catalog: https://api.tokenlab.sh/v1/models
 - Skills: https://github.com/hedging8563/tokenlab-skills
+
+## Webhook management
+
+Use the `full` profile to configure workspace webhooks with `list_webhooks`, `create_webhook`, `get_webhook`, `update_webhook`, `delete_webhook`, `rotate_webhook_secret`, `test_webhook` and `list_webhook_deliveries`.
+
+Set `TOKENLAB_MANAGEMENT_TOKEN=mt-...` separately from `TOKENLAB_API_KEY=sk-...`. Create the management token at [Dashboard → API → Management Tokens](https://tokenlab.sh/dashboard/api?tab=tokens). It authorizes management operations only within its workspace and is not limited to webhooks. The inference key cannot substitute for it; the `whsec_...` returned by creation/rotation is for receiver signature verification only. Keep all credentials out of tool arguments and prompts.
+
+Webhook notifications avoid continuous task polling. On a polling fallback, stop on terminal status, 401/403/404 or `retryable: false`; back off on transient failures. See the [complete webhook guide](https://docs.tokenlab.sh/guides/webhooks) for payloads, signing, deduplication and delivery history.

package/contract/mcp-overlay.json

@@ -21,7 +21,7 @@
     "core": {
       "schema_mode": "portable",
       "compatibility_budget": {
-        "max_endpoint_tools": 29,
+        "max_endpoint_tools": 30,
         "max_input_schema_bytes": 48000,
         "max_input_schema_depth": 8,
         "max_tools_list_bytes": 60000
@@ -35,6 +35,7 @@
         "createResponse",
         "createAnthropicMessage",
         "geminiGenerateContent",
+        "createSystemOneDecision",
         "createEmbedding",
         "createMultimodalEmbedding",
         "rerankDocuments",
@@ -59,10 +60,10 @@
     "full": {
       "schema_mode": "portable",
       "compatibility_budget": {
-        "max_endpoint_tools": 78,
-        "max_input_schema_bytes": 72000,
+        "max_endpoint_tools": 87,
+        "max_input_schema_bytes": 78000,
         "max_input_schema_depth": 8,
-        "max_tools_list_bytes": 100000
+        "max_tools_list_bytes": 115000
       },
       "include_tags": [
         "Chat",
@@ -78,8 +79,10 @@
         "Files",
         "Batches",
         "Text",
+        "Decisions",
         "Worlds",
-        "Seedance Volc Compatible"
+        "Seedance Volc Compatible",
+        "Webhooks"
       ],
       "exclude_operations": [
         "geminiStreamGenerateContent",
@@ -134,7 +137,11 @@
     "composite_tools": [
       {
         "name": "compare_models",
-        "profiles": ["catalog", "core", "full"],
+        "profiles": [
+          "catalog",
+          "core",
+          "full"
+        ],
         "auth": "optional",
         "annotations": {
           "readOnlyHint": true,
@@ -145,7 +152,11 @@
       },
       {
         "name": "get_api_overview",
-        "profiles": ["catalog", "core", "full"],
+        "profiles": [
+          "catalog",
+          "core",
+          "full"
+        ],
         "auth": "optional",
         "annotations": {
           "readOnlyHint": true,
@@ -160,26 +171,68 @@
         "id": "discover",
         "authentication": "none",
         "tool_rows": [
-          ["list_models", "get_model", "get_pricing"],
-          ["get_model_pricing", "compare_models", "get_api_overview"]
+          [
+            "list_models",
+            "get_model",
+            "get_pricing"
+          ],
+          [
+            "get_model_pricing",
+            "compare_models",
+            "get_api_overview"
+          ]
         ]
       },
       {
         "id": "create",
         "authentication": "api_key",
         "tool_rows": [
-          ["create_chat_completion", "create_response", "create_anthropic_message", "create_gemini_content"],
-          ["create_image", "create_image_file", "edit_image", "edit_image_file"],
-          ["create_video", "create_music", "create_3d_model", "create_speech", "transcribe_audio", "translate_audio"]
+          [
+            "create_chat_completion",
+            "create_response",
+            "create_anthropic_message",
+            "create_gemini_content"
+          ],
+          [
+            "create_image",
+            "create_image_file",
+            "edit_image",
+            "edit_image_file"
+          ],
+          [
+            "create_video",
+            "create_music",
+            "create_3d_model",
+            "create_speech",
+            "transcribe_audio",
+            "translate_audio"
+          ]
         ]
       },
       {
         "id": "operate",
         "authentication": "api_key",
         "tool_rows": [
-          ["upload_file", "list_files", "retrieve_file"],
-          ["retrieve_file_content", "delete_file", "get_task_status", "cancel_task"],
-          ["create_embedding", "create_multimodal_embedding", "rerank_documents", "translate_text"]
+          [
+            "upload_file",
+            "list_files",
+            "retrieve_file"
+          ],
+          [
+            "retrieve_file_content",
+            "delete_file",
+            "get_task_status",
+            "cancel_task"
+          ],
+          [
+            "create_embedding",
+            "create_multimodal_embedding",
+            "rerank_documents",
+            "translate_text"
+          ],
+          [
+            "evaluate_decisions"
+          ]
         ]
       }
     ],
@@ -263,7 +316,9 @@
     },
     "geminiGenerateContent": {
       "tool_name": "create_gemini_content",
-      "omit_arguments": ["key"]
+      "omit_arguments": [
+        "key"
+      ]
     },
     "createChatCompletion": {
       "description": "Create an OpenAI-compatible chat completion. For inline image_url data URLs, declare the byte-accurate image MIME type. The MCP boundary corrects recognized PNG, JPEG, WebP, and GIF payloads declared as application/octet-stream and rejects unrecognized generic binary image payloads before sending a billable request.",
@@ -285,22 +340,46 @@
       "tool_name": "get_task_status",
       "task": {
         "mode": "status",
-        "id_fields": ["task_id", "id"],
+        "id_fields": [
+          "task_id",
+          "id"
+        ],
         "status_field": "status",
         "poll_url_field": "poll_url",
-        "terminal_statuses": ["completed", "succeeded", "failed", "cancelled", "canceled", "expired"]
+        "terminal_statuses": [
+          "completed",
+          "succeeded",
+          "failed",
+          "cancelled",
+          "canceled",
+          "expired"
+        ]
       }
     },
     "cancelAsyncTask": {
       "tool_name": "cancel_task",
       "task": {
         "mode": "status",
-        "id_fields": ["task_id", "id"],
+        "id_fields": [
+          "task_id",
+          "id"
+        ],
         "status_field": "status",
         "poll_url_field": "poll_url",
-        "terminal_statuses": ["completed", "succeeded", "failed", "cancelled", "canceled", "expired"]
+        "terminal_statuses": [
+          "completed",
+          "succeeded",
+          "failed",
+          "cancelled",
+          "canceled",
+          "expired"
+        ]
       }
     },
+    "createSystemOneDecision": {
+      "tool_name": "evaluate_decisions",
+      "description": "Evaluate typed Noul probability, Choice, and Score questions against shared state using the native System One endpoint. Discover a decision model with list_models/get_model first. Returns synchronous structured decisions, not chat text. A decision does not authorize an external action."
+    },
     "createTranslation": {
       "tool_name": "translate_text"
     },
@@ -321,10 +400,20 @@
       },
       "task": {
         "mode": "hybrid",
-        "id_fields": ["task_id", "id"],
+        "id_fields": [
+          "task_id",
+          "id"
+        ],
         "status_field": "status",
         "poll_url_field": "poll_url",
-        "terminal_statuses": ["completed", "succeeded", "failed", "cancelled", "canceled", "expired"]
+        "terminal_statuses": [
+          "completed",
+          "succeeded",
+          "failed",
+          "cancelled",
+          "canceled",
+          "expired"
+        ]
       }
     },
     "editImage": {
@@ -338,57 +427,147 @@
       },
       "task": {
         "mode": "hybrid",
-        "id_fields": ["task_id", "id"],
+        "id_fields": [
+          "task_id",
+          "id"
+        ],
         "status_field": "status",
         "poll_url_field": "poll_url",
-        "terminal_statuses": ["completed", "succeeded", "failed", "cancelled", "canceled", "expired"]
+        "terminal_statuses": [
+          "completed",
+          "succeeded",
+          "failed",
+          "cancelled",
+          "canceled",
+          "expired"
+        ]
       }
     },
     "createVideo": {
       "task": {
         "mode": "async",
-        "id_fields": ["task_id", "id"],
+        "id_fields": [
+          "task_id",
+          "id"
+        ],
         "status_field": "status",
         "poll_url_field": "poll_url",
-        "terminal_statuses": ["completed", "succeeded", "failed", "cancelled", "canceled", "expired"]
+        "terminal_statuses": [
+          "completed",
+          "succeeded",
+          "failed",
+          "cancelled",
+          "canceled",
+          "expired"
+        ]
       }
     },
     "createMusic": {
       "task": {
         "mode": "async",
-        "id_fields": ["task_id", "id"],
+        "id_fields": [
+          "task_id",
+          "id"
+        ],
         "status_field": "status",
         "poll_url_field": "poll_url",
-        "terminal_statuses": ["completed", "succeeded", "failed", "cancelled", "canceled", "expired"]
+        "terminal_statuses": [
+          "completed",
+          "succeeded",
+          "failed",
+          "cancelled",
+          "canceled",
+          "expired"
+        ]
       }
     },
     "create3D": {
       "tool_name": "create_3d_model",
       "task": {
         "mode": "async",
-        "id_fields": ["task_id", "id"],
+        "id_fields": [
+          "task_id",
+          "id"
+        ],
         "status_field": "status",
         "poll_url_field": "poll_url",
-        "terminal_statuses": ["completed", "succeeded", "failed", "cancelled", "canceled", "expired"]
+        "terminal_statuses": [
+          "completed",
+          "succeeded",
+          "failed",
+          "cancelled",
+          "canceled",
+          "expired"
+        ]
       }
     },
     "createWorld": {
       "task": {
         "mode": "async",
-        "id_fields": ["task_id", "id"],
+        "id_fields": [
+          "task_id",
+          "id"
+        ],
         "status_field": "status",
         "poll_url_field": "poll_url",
-        "terminal_statuses": ["completed", "succeeded", "failed", "cancelled", "canceled", "expired"]
+        "terminal_statuses": [
+          "completed",
+          "succeeded",
+          "failed",
+          "cancelled",
+          "canceled",
+          "expired"
+        ]
       }
     },
     "getWorldStatus": {
       "task": {
         "mode": "status",
-        "id_fields": ["task_id", "id"],
+        "id_fields": [
+          "task_id",
+          "id"
+        ],
         "status_field": "status",
         "poll_url_field": "poll_url",
-        "terminal_statuses": ["completed", "succeeded", "failed", "cancelled", "canceled", "expired"]
+        "terminal_statuses": [
+          "completed",
+          "succeeded",
+          "failed",
+          "cancelled",
+          "canceled",
+          "expired"
+        ]
       }
+    },
+    "rotateWebhookSecret": {
+      "annotations": {
+        "readOnlyHint": false,
+        "destructiveHint": true,
+        "idempotentHint": false,
+        "openWorldHint": true
+      },
+      "description": "Replace the signing secret and return the new secret once. In-flight deliveries may use the previous secret. Requires TOKENLAB_MANAGEMENT_TOKEN (mt-...) for the workspace; sk-... keys are not accepted."
+    },
+    "listWebhooks": {
+      "description": "List workspace webhooks. Requires TOKENLAB_MANAGEMENT_TOKEN (mt-...) for the workspace; sk-... keys are not accepted."
+    },
+    "createWebhook": {
+      "description": "Create a workspace webhook; save the returned signing secret. Requires TOKENLAB_MANAGEMENT_TOKEN (mt-...) for the workspace; sk-... keys are not accepted."
+    },
+    "getWebhook": {
+      "description": "Read a webhook without revealing its secret. Requires TOKENLAB_MANAGEMENT_TOKEN (mt-...) for the workspace; sk-... keys are not accepted."
+    },
+    "updateWebhook": {
+      "description": "Update URL, events, description or active state. Resuming resets failures. Requires TOKENLAB_MANAGEMENT_TOKEN (mt-...) for the workspace; sk-... keys are not accepted."
+    },
+    "deleteWebhook": {
+      "description": "Delete a webhook and its delivery history. Requires TOKENLAB_MANAGEMENT_TOKEN (mt-...) for the workspace; sk-... keys are not accepted."
+    },
+    "testWebhook": {
+      "description": "Send webhook.test; inspect outcome to confirm receipt. Requires TOKENLAB_MANAGEMENT_TOKEN (mt-...) for the workspace; sk-... keys are not accepted."
+    },
+    "listWebhookDeliveries": {
+      "description": "List delivery outcomes, HTTP statuses and cumulative attempts. Requires TOKENLAB_MANAGEMENT_TOKEN (mt-...) for the workspace; sk-... keys are not accepted."
     }
   }
 }