@topolo/mcp 0.3.0 → 0.4.0

package/dist/dispatch.js

@@ -91,7 +91,7 @@ var TOOLS = [
   {
     name: "topolo_list_applications",
     title: "List every Topolo platform application",
-    description: "Returns the generated Topolo application catalog, including pages-only apps, tooling apps, and API-backed apps. Use this before choosing a service-specific or generic API operation. Pure metadata: no credential introspection, no permission check, no external call.",
+    description: "Returns the live Topolo application catalog from the platform registry. Reflects apps as they are registered/removed with no client rebuild. Authenticated callers in an entitled org also see the developer_only apps their role permits. Falls back to a bundled snapshot only if the registry is unreachable.",
     requiredScopes: [],
     destructive: false,
     inputSchema: {
@@ -99,14 +99,14 @@ var TOOLS = [
       properties: {},
       additionalProperties: false
     },
-    handler: async () => ({
-      applications: APPLICATION_IDS.map((id) => APPLICATIONS[id])
+    handler: async (topolo) => ({
+      applications: await topolo.client.listServices()
     })
   },
   {
     name: "topolo_get_application",
     title: "Describe one Topolo platform application",
-    description: "Returns one application catalog entry with its package name, production URL, deploy targets, and SDK service IDs when the app has callable APIs. Pure metadata: no credential introspection, no permission check, no external call.",
+    description: "Returns one live application catalog entry (service id, slug, name, base URL, status). Accepts the service id, slug, or name. Resolved against the live registry so newly-registered apps work without a client rebuild.",
     requiredScopes: [],
     destructive: false,
     inputSchema: {
@@ -114,21 +114,29 @@ var TOOLS = [
       properties: {
         application: {
           type: "string",
-          enum: APPLICATION_IDS,
-          description: "Application ID from topolo_list_applications."
+          description: "Application identifier: service id, slug, or name from topolo_list_applications."
         }
       },
       required: ["application"],
       additionalProperties: false
     },
-    handler: async (_topolo, args) => {
+    handler: async (topolo, args) => {
       const application = args["application"];
-      if (typeof application !== "string" || !APPLICATION_IDS.includes(application)) {
+      if (typeof application !== "string" || !application.trim()) {
+        throw new Error("`application` must be a non-empty string.");
+      }
+      const needle = application.trim().toLowerCase();
+      const catalog = await topolo.client.listServices();
+      const match = catalog.find(
+        (e) => e.serviceId.toLowerCase() === needle || e.slug && e.slug.toLowerCase() === needle || e.name && e.name.toLowerCase() === needle
+      );
+      if (!match) {
+        const known = catalog.map((e) => e.slug || e.serviceId).sort().join(", ");
         throw new Error(
-          `Unknown application "${String(application)}". Known: ${APPLICATION_IDS.join(", ")}`
+          `Unknown application "${application}". Known: ${known}`
         );
       }
-      return { application: APPLICATIONS[application] };
+      return { application: match };
     }
   },
   {

package/dist/index.js

@@ -1516,12 +1516,12 @@ var APPLICATION_REQUIREMENTS = [
     summary: "Applications must derive identity, organization, scopes, and service entitlement from TopoloAuth rather than inventing parallel auth state.",
     appliesTo: ["browser", "api", "tooling", "agent_surface"],
     evidence: [
-      "@topolo/auth-client or @topolo/auth-middleware is used where applicable",
+      "@topolo/auth-client or @topolo-io/worker-runtime is used where applicable",
       "No public command, tool, or SDK method accepts orgId",
       "Service slug and Auth service registration are documented for protected services"
     ],
     implementation: [
-      "Use shared auth packages instead of copying token parsing or browser storage flows",
+      "Use shared auth/runtime packages instead of copying token parsing, gateway, or browser storage flows",
       "Derive organization from the credential on every request",
       "Route OAuth, refresh, logout, and SSO paths according to the shared Auth contract"
     ]
@@ -2062,6 +2062,58 @@ var TopoloClient = class _TopoloClient {
     });
     return value;
   }
+  /**
+   * List the platform service catalog from the live registry
+   * (`GET /api/services/catalog` on TopoloAuth). Credential-aware: the
+   * caller's credential is attached, so an authenticated caller in an
+   * entitled org also receives the `developer_only` services its role
+   * permits; an unauthenticated/agent caller receives `active` only.
+   *
+   * Resilient: on any network/HTTP failure this falls back to the
+   * build-time generated `APPLICATIONS` snapshot so offline/degraded
+   * callers still get a usable (if static) catalog. The live result is
+   * authoritative; the snapshot is a floor, not a cap.
+   */
+  async listServices() {
+    try {
+      const res = await this.request({ service: "auth", method: "GET", path: "/api/services/catalog" });
+      const raw = res.data?.services ?? res.services;
+      if (Array.isArray(raw) && raw.length > 0) {
+        const entries = [];
+        for (const item of raw) {
+          const s = item;
+          const serviceId = typeof s.service_id === "string" ? s.service_id : typeof s.id === "string" ? s.id : null;
+          if (!serviceId) continue;
+          entries.push({
+            serviceId,
+            slug: typeof s.app_slug === "string" ? s.app_slug : null,
+            name: typeof s.name === "string" ? s.name : null,
+            description: typeof s.description === "string" ? s.description : null,
+            baseUrl: typeof s.base_url === "string" ? s.base_url : null,
+            status: typeof s.status === "string" ? s.status : null,
+            surfaceKind: typeof s.surface_kind === "string" ? s.surface_kind : null,
+            launchable: s.launchable === true
+          });
+        }
+        if (entries.length > 0) return entries;
+      }
+    } catch {
+    }
+    return this.generatedCatalogFallback();
+  }
+  generatedCatalogFallback() {
+    const apps = Object.values(APPLICATIONS);
+    return apps.map((app) => ({
+      serviceId: app.id,
+      slug: app.id,
+      name: app.name ?? app.id,
+      description: null,
+      baseUrl: app.productionUrl ?? null,
+      status: "active",
+      surfaceKind: "application",
+      launchable: Boolean(app.productionUrl)
+    }));
+  }
   /**
    * Introspect the current credential. Returns the caller's resolved identity,
    * organization, and permission set. Used by CLI `whoami` and by MCP to gate
@@ -2322,7 +2374,7 @@ var TOOLS = [
   {
     name: "topolo_list_applications",
     title: "List every Topolo platform application",
-    description: "Returns the generated Topolo application catalog, including pages-only apps, tooling apps, and API-backed apps. Use this before choosing a service-specific or generic API operation. Pure metadata: no credential introspection, no permission check, no external call.",
+    description: "Returns the live Topolo application catalog from the platform registry. Reflects apps as they are registered/removed with no client rebuild. Authenticated callers in an entitled org also see the developer_only apps their role permits. Falls back to a bundled snapshot only if the registry is unreachable.",
     requiredScopes: [],
     destructive: false,
     inputSchema: {
@@ -2330,14 +2382,14 @@ var TOOLS = [
       properties: {},
       additionalProperties: false
     },
-    handler: async () => ({
-      applications: APPLICATION_IDS.map((id) => APPLICATIONS[id])
+    handler: async (topolo) => ({
+      applications: await topolo.client.listServices()
     })
   },
   {
     name: "topolo_get_application",
     title: "Describe one Topolo platform application",
-    description: "Returns one application catalog entry with its package name, production URL, deploy targets, and SDK service IDs when the app has callable APIs. Pure metadata: no credential introspection, no permission check, no external call.",
+    description: "Returns one live application catalog entry (service id, slug, name, base URL, status). Accepts the service id, slug, or name. Resolved against the live registry so newly-registered apps work without a client rebuild.",
     requiredScopes: [],
     destructive: false,
     inputSchema: {
@@ -2345,21 +2397,29 @@ var TOOLS = [
       properties: {
         application: {
           type: "string",
-          enum: APPLICATION_IDS,
-          description: "Application ID from topolo_list_applications."
+          description: "Application identifier: service id, slug, or name from topolo_list_applications."
         }
       },
       required: ["application"],
       additionalProperties: false
     },
-    handler: async (_topolo, args) => {
+    handler: async (topolo, args) => {
       const application = args["application"];
-      if (typeof application !== "string" || !APPLICATION_IDS.includes(application)) {
+      if (typeof application !== "string" || !application.trim()) {
+        throw new Error("`application` must be a non-empty string.");
+      }
+      const needle = application.trim().toLowerCase();
+      const catalog = await topolo.client.listServices();
+      const match = catalog.find(
+        (e) => e.serviceId.toLowerCase() === needle || e.slug && e.slug.toLowerCase() === needle || e.name && e.name.toLowerCase() === needle
+      );
+      if (!match) {
+        const known = catalog.map((e) => e.slug || e.serviceId).sort().join(", ");
         throw new Error(
-          `Unknown application "${String(application)}". Known: ${APPLICATION_IDS.join(", ")}`
+          `Unknown application "${application}". Known: ${known}`
         );
       }
-      return { application: APPLICATIONS[application] };
+      return { application: match };
     }
   },
   {
@@ -2604,7 +2664,7 @@ function statusesAtOrWorse(threshold) {
 }
 
 // src/version.ts
-var MCP_VERSION = "0.3.0";
+var MCP_VERSION = "0.4.0";
 
 // src/server.ts
 function buildServer(topolo, scopes, tools = TOOLS) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@topolo/mcp",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Model Context Protocol server for the Topolo platform. Exposes scope-gated tools that third-party agents (Claude, Codex, etc.) can call natively.",
   "type": "module",
   "bin": {
@@ -21,7 +21,8 @@
     "typecheck": "tsc --noEmit",
     "start": "node dist/index.js",
     "test": "vitest run",
-    "test:watch": "vitest"
+    "test:watch": "vitest",
+    "coverage": "vitest run --coverage"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0"
@@ -29,6 +30,7 @@
   "devDependencies": {
     "@topolo/sdk": "workspace:*",
     "@types/node": "^20.12.0",
+    "@vitest/coverage-v8": "^2.1.0",
     "tsup": "^8.0.0",
     "typescript": "^5.4.0",
     "vitest": "^2.1.0"