@topolo/mcp 0.2.1 → 0.2.2

package/README.md

@@ -27,7 +27,8 @@ Either:
 - **Long-lived**: mint an API key at the Topolo Developers console
   (`TOPOLO_API_KEY=topo_live_...`). Preferred for persistent agent installs.
 - **Short-lived**: `topolo auth login` with the CLI, then copy the access token
-  from `~/.config/topolo/config.json`. Useful for dev and testing.
+  from `~/.config/topolo/config.json`. Useful for dev and testing. MCP does
+  not read the CLI config directly; pass the token in `TOPOLO_ACCESS_TOKEN`.
 
 ## Register with an MCP client
 
@@ -94,17 +95,20 @@ Startup is synchronous and fast (< 500 ms typical). If the credential is
 rejected, the process logs the error to stderr and exits non-zero — host
 clients surface that as a failed server launch.
 
-## Tools (Phase 1)
+## Tools
 
-| Tool                         | Required scopes       | Destructive |
-| ---------------------------- | --------------------- | ----------- |
-| `topolo_whoami`              | (none)                | no          |
-| `topolo_crm_list_contacts`   | `crm.contacts:read`   | no          |
-| `topolo_crm_get_contact`     | `crm.contacts:read`   | no          |
+| Tool                         | Required scopes       | Destructive hint |
+| ---------------------------- | --------------------- | ---------------- |
+| `topolo_whoami`              | (none)                | no               |
+| `topolo_list_services`       | (none)                | no               |
+| `topolo_crm_list_contacts`   | `crm.contacts:read`   | no               |
+| `topolo_crm_get_contact`     | `crm.contacts:read`   | no               |
+| `topolo_api_call`            | (service-enforced)    | yes              |
 
-Phase 1 is intentionally read-only. Write tools will be added per-domain in
-later phases alongside typed SDK modules, each annotated with
-`destructiveHint: true` so host clients can surface confirmation UI.
+`topolo_api_call` is the escape hatch for endpoints without typed MCP tools
+yet. GET requests work without confirmation; mutating HTTP methods must pass
+`confirm: true` or the SDK rejects the call. Backing services still enforce
+permissions for every request.
 
 ## Safety rails
 
@@ -159,8 +163,6 @@ build, verify the tag matches `package.json`, and publish to npm via the
 
 ## Phase 2 (planned)
 
-- Accept OAuth 2.1 access tokens minted via authorization-code + device grants
-  in TopoloAuth.
-- Dynamic tool registration as more `@topolo/sdk` modules ship.
+- More typed tools as `@topolo/sdk` modules ship.
 - HTTP transport in addition to stdio, for hosted (non-subprocess) deployments.
 - Optional `--provenance` on npm publish once the repo is public.

package/dist/index.js

@@ -391,7 +391,10 @@ function hasScope(set, required) {
     "*",
     serviceId ? `${serviceId}.*` : null,
     serviceId && resource && actionPart ? `${serviceId}.${resource}:*` : null,
-    resource && actionPart ? `${resource}:*` : null
+    serviceId && resource && actionPart ? `${serviceId}.${resource}.${actionPart}` : null,
+    resource && actionPart ? `${resource}:*` : null,
+    resource && actionPart ? `${resource}.${actionPart}` : null,
+    resource && actionPart ? `${resource}:${actionPart}` : null
   ].filter((v) => v !== null));
   return set.permissions.some((granted) => candidates.has(granted));
 }
@@ -569,7 +572,7 @@ function filterToolsByScopes(tools, scopes) {
 }
 
 // src/version.ts
-var MCP_VERSION = "0.1.0";
+var MCP_VERSION = "0.2.2";
 
 // src/server.ts
 function buildServer(topolo, scopes, tools = TOOLS) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@topolo/mcp",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Model Context Protocol server for the Topolo platform. Exposes scope-gated tools that third-party agents (Claude, Codex, etc.) can call natively.",
   "type": "module",
   "bin": {