@topolo/mcp 0.2.1 → 0.2.3

package/README.md

@@ -27,7 +27,8 @@ Either:
 - **Long-lived**: mint an API key at the Topolo Developers console
   (`TOPOLO_API_KEY=topo_live_...`). Preferred for persistent agent installs.
 - **Short-lived**: `topolo auth login` with the CLI, then copy the access token
-  from `~/.config/topolo/config.json`. Useful for dev and testing.
+  from `~/.config/topolo/config.json`. Useful for dev and testing. MCP does
+  not read the CLI config directly; pass the token in `TOPOLO_ACCESS_TOKEN`.
 
 ## Register with an MCP client
 
@@ -94,17 +95,24 @@ Startup is synchronous and fast (< 500 ms typical). If the credential is
 rejected, the process logs the error to stderr and exits non-zero — host
 clients surface that as a failed server launch.
 
-## Tools (Phase 1)
-
-| Tool                         | Required scopes       | Destructive |
-| ---------------------------- | --------------------- | ----------- |
-| `topolo_whoami`              | (none)                | no          |
-| `topolo_crm_list_contacts`   | `crm.contacts:read`   | no          |
-| `topolo_crm_get_contact`     | `crm.contacts:read`   | no          |
-
-Phase 1 is intentionally read-only. Write tools will be added per-domain in
-later phases alongside typed SDK modules, each annotated with
-`destructiveHint: true` so host clients can surface confirmation UI.
+## Tools
+
+| Tool                         | Required scopes       | Destructive hint |
+| ---------------------------- | --------------------- | ---------------- |
+| `topolo_whoami`              | (none)                | no               |
+| `topolo_list_services`       | (none)                | no               |
+| `topolo_list_applications`   | (none)                | no               |
+| `topolo_get_application`     | (none)                | no               |
+| `topolo_list_application_requirements` | (none)      | no               |
+| `topolo_audit_applications`  | (none)                | no               |
+| `topolo_crm_list_contacts`   | `crm.contacts:read`   | no               |
+| `topolo_crm_get_contact`     | `crm.contacts:read`   | no               |
+| `topolo_api_call`            | (service-enforced)    | yes              |
+
+`topolo_api_call` is the escape hatch for endpoints without typed MCP tools
+yet. GET requests work without confirmation; mutating HTTP methods must pass
+`confirm: true` or the SDK rejects the call. Backing services still enforce
+permissions for every request.
 
 ## Safety rails
 
@@ -159,8 +167,6 @@ build, verify the tag matches `package.json`, and publish to npm via the
 
 ## Phase 2 (planned)
 
-- Accept OAuth 2.1 access tokens minted via authorization-code + device grants
-  in TopoloAuth.
-- Dynamic tool registration as more `@topolo/sdk` modules ship.
+- More typed tools as `@topolo/sdk` modules ship.
 - HTTP transport in addition to stdio, for hosted (non-subprocess) deployments.
 - Optional `--provenance` on npm publish once the repo is public.