@topolo/mcp 0.13.2 → 0.13.3

package/dist/index.js

@@ -4968,6 +4968,10 @@ function audienceFor(context) {
   }
   return `app_topolo_${service.replace(/-/g, "_")}`;
 }
+function scopeFor(context, audience) {
+  if (context.service === "auth" && context.path === "/api/auth/me") return "app_topolo_auth:identity";
+  return `${audience}:actions:execute`;
+}
 function responseData(value) {
   if (!value || typeof value !== "object") return {};
   const record2 = value;
@@ -4985,22 +4989,24 @@ async function resolveExternalAgentInstallationCredential(environment, installat
   const fetchImpl = options.fetch ?? fetch;
   const now = options.now ?? Date.now;
   const authBaseUrl = resolveServiceUrl("auth", options.serviceUrls);
-  const tokenUrl = new URL("/api/developer-oauth/token", authBaseUrl).toString();
+  const tokenUrl = new URL("/oauth/token", authBaseUrl).toString();
   const cache = /* @__PURE__ */ new Map();
   const credentialProvider = async (context) => {
     const audience = audienceFor(context);
+    const scope = scopeFor(context, audience);
     const resource = context.resource ?? {
       resourceType: "organization",
       resourceId: stored.installation.organizationId
     };
     const boundTaskId = context.taskId?.trim() || taskId;
-    const key = JSON.stringify({ audience, taskId: boundTaskId, resource });
+    const key = JSON.stringify({ audience, scope, taskId: boundTaskId, resource });
     const cached = cache.get(key);
     if (cached && cached.expiresAt - 15e3 > now()) return cached.credential;
     const body = new URLSearchParams({
       grant_type: "client_credentials",
       client_id: stored.installation.clientId,
       client_secret: stored.secret.clientSecret,
+      scope,
       audience,
       task_id: boundTaskId,
       resource_type: resource.resourceType,

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@topolo/mcp",
   "packageManager": "pnpm@10.17.1",
-  "version": "0.13.2",
-  "topoloPublishedVersion": "0.13.2",
+  "version": "0.13.3",
+  "topoloPublishedVersion": "0.13.3",
   "description": "Model Context Protocol server for the Topolo platform. Exposes scope-gated tools that third-party agents (Claude, Codex, etc.) can call natively.",
   "license": "UNLICENSED",
   "author": "Topolo",