@topolo/mcp 0.4.0 → 0.4.2

package/README.md

@@ -112,7 +112,11 @@ clients surface that as a failed server launch.
 `topolo_api_call` is the escape hatch for endpoints without typed MCP tools
 yet. GET requests work without confirmation; mutating HTTP methods must pass
 `confirm: true` or the SDK rejects the call. Backing services still enforce
-permissions for every request.
+permissions for every request. The tool schema intentionally does not embed a
+large service enum; agents should call `topolo_list_services` first, then pass a
+service ID/slug from that credential-scoped result. New services become callable
+without an MCP release once Auth grants the organization and credential the
+relevant permissions.
 
 ## Safety rails
 
@@ -121,6 +125,9 @@ permissions for every request.
   to see Org B's data.
 - **Scope-gated tool advertisement.** Agents never see tools they can't use —
   fewer wasted attempts and less prompt noise.
+- **Credential-scoped catalog discovery.** `topolo_list_services` and
+  `topolo_list_applications` use TopoloAuth's live organization/permission
+  catalog. They do not expose the global generated platform catalog.
 - **Audit headers.** Every request sends `X-Topolo-Client: topolo-mcp/<ver>`,
   `X-Topolo-Agent: <label>`, `X-Topolo-Request-Id: <uuid>`.
 - **Write-action confirmation.** The SDK refuses mutating HTTP methods unless
@@ -159,11 +166,12 @@ waiting for JSON-RPC on stdin. To drive it manually, use the MCP Inspector:
 npx @modelcontextprotocol/inspector node dist/index.js
 ```
 
-## Release flow
+## Release Flow
 
-Pushing a `v<x.y.z>` tag to `main` triggers GitHub Actions to typecheck, test,
-build, verify the tag matches `package.json`, and publish to npm via the
-`NPM_TOKEN` secret. No developer-machine credentials involved.
+Preferred flow: push a `v<x.y.z>` tag to `main`; GitHub Actions typechecks,
+tests, builds, verifies the tag matches `package.json`, and publishes to npm via
+the `NPM_TOKEN` secret. Operators may publish directly with an npm token only
+after running the same package checks and `npm pack --dry-run`.
 
 ## Phase 2 (planned)
 

package/dist/dispatch.js

@@ -52,7 +52,6 @@ function splitService(servicePart) {
 
 // src/tools.ts
 var APPLICATION_IDS = Object.keys(APPLICATIONS).sort();
-var SERVICE_IDS = Object.keys(DEFAULT_SERVICE_URLS).sort();
 var HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
 var TOOLS = [
   {
@@ -71,7 +70,7 @@ var TOOLS = [
   {
     name: "topolo_list_services",
     title: "List every Topolo service the agent can reach",
-    description: "Returns the service registry the SDK knows about: one entry per platform service with its stable service ID and current base URL. Use this to discover what `topolo_api_call` can address \u2014 the service IDs returned here are the exact values accepted by that tool. Pure metadata: no credential introspection, no permission check, no external call.",
+    description: "Returns the credential-scoped service registry: one entry per platform service the current credential can use in its organization, with granted permissions and base URL. Use this to discover what `topolo_api_call` can address. This is not the global platform catalog.",
     requiredScopes: [],
     destructive: false,
     inputSchema: {
@@ -79,12 +78,21 @@ var TOOLS = [
       properties: {},
       additionalProperties: false
     },
-    handler: async () => {
-      const services = Object.keys(DEFAULT_SERVICE_URLS).sort().map((id) => ({
-        id,
-        defaultUrl: DEFAULT_SERVICE_URLS[id],
-        effectiveUrl: resolveServiceUrl(id)
-      }));
+    handler: async (topolo) => {
+      const services = (await topolo.client.listServices()).map((entry) => {
+        const id = displayServiceId(entry);
+        return {
+          id,
+          serviceId: entry.serviceId,
+          slug: entry.slug,
+          name: entry.name,
+          baseUrl: entry.baseUrl,
+          effectiveUrl: resolveServiceUrl(id) || entry.baseUrl,
+          surfaceKind: entry.surfaceKind,
+          launchable: entry.launchable,
+          permissions: [...entry.permissions]
+        };
+      }).sort((left, right) => left.id.localeCompare(right.id));
       return { services };
     }
   },
@@ -131,9 +139,9 @@ var TOOLS = [
         (e) => e.serviceId.toLowerCase() === needle || e.slug && e.slug.toLowerCase() === needle || e.name && e.name.toLowerCase() === needle
       );
       if (!match) {
-        const known = catalog.map((e) => e.slug || e.serviceId).sort().join(", ");
+        const known = catalog.map((e) => e.slug || e.serviceId).sort().filter((value) => typeof value === "string" && value.length > 0);
         throw new Error(
-          `Unknown application "${application}". Known: ${known}`
+          `Unknown application "${application}". ${formatKnownValues(known, "applications")}`
         );
       }
       return { application: match };
@@ -150,7 +158,6 @@ var TOOLS = [
       properties: {
         application: {
           type: "string",
-          enum: APPLICATION_IDS,
           description: "Optional application ID from topolo_list_applications."
         }
       },
@@ -168,7 +175,7 @@ var TOOLS = [
       }
       if (typeof application !== "string" || !APPLICATION_IDS.includes(application)) {
         throw new Error(
-          `Unknown application "${String(application)}". Known: ${APPLICATION_IDS.join(", ")}`
+          `Unknown application "${String(application)}". ${formatKnownValues(APPLICATION_IDS, "applications")}`
         );
       }
       const app = APPLICATIONS[application];
@@ -191,7 +198,6 @@ var TOOLS = [
       properties: {
         application: {
           type: "string",
-          enum: APPLICATION_IDS,
           description: "Optional application ID from topolo_list_applications."
         },
         failOn: {
@@ -216,7 +222,7 @@ var TOOLS = [
       }
       if (typeof application !== "string" || !APPLICATION_IDS.includes(application)) {
         throw new Error(
-          `Unknown application "${String(application)}". Known: ${APPLICATION_IDS.join(", ")}`
+          `Unknown application "${String(application)}". ${formatKnownValues(APPLICATION_IDS, "applications")}`
         );
       }
       report = auditAllApplicationRequirements([application]);
@@ -249,7 +255,7 @@ var TOOLS = [
   {
     name: "topolo_api_call",
     title: "Call any Topolo platform service",
-    description: `Low-level passthrough to any Topolo service. Use when no domain-specific tool exists for the operation you need. The request is signed with the current credential and scoped to the caller's organization \u2014 the target service will return 403 if your scopes do not permit the operation, even though this tool is advertised. Mutating calls (non-GET methods) require confirm:true. Known services: ${SERVICE_IDS.join(", ")}.`,
+    description: "Low-level passthrough to any Topolo service. Use when no domain-specific tool exists for the operation you need. The request is signed with the current credential and scoped to the caller's organization \u2014 the target service will return 403 if your scopes do not permit the operation, even though this tool is advertised. Mutating calls (non-GET methods) require confirm:true. Call topolo_list_services first to discover callable service IDs; the SDK can also resolve live Auth-catalog service ids/slugs for newly registered API surfaces.",
     requiredScopes: [],
     destructive: true,
     inputSchema: {
@@ -257,7 +263,6 @@ var TOOLS = [
       properties: {
         service: {
           type: "string",
-          enum: SERVICE_IDS,
           description: "Target service ID from the platform registry."
         },
         method: {
@@ -290,8 +295,8 @@ var TOOLS = [
     handler: async (topolo, args) => {
       const service = args["service"];
       const path = args["path"];
-      if (typeof service !== "string" || !SERVICE_IDS.includes(service)) {
-        throw new Error(`Unknown service "${String(service)}". Known: ${SERVICE_IDS.join(", ")}`);
+      if (typeof service !== "string" || !service.trim()) {
+        throw new Error("service is required. Call topolo_list_services first to discover callable services.");
       }
       if (typeof path !== "string" || !path) {
         throw new Error("path is required");
@@ -306,7 +311,7 @@ var TOOLS = [
         Object.entries(query).map(([k, v]) => [k, String(v)])
       ) : void 0;
       return topolo.client.request({
-        service,
+        service: service.trim(),
         method,
         path,
         body: args["body"],
@@ -379,6 +384,33 @@ function statusesAtOrWorse(threshold) {
   if (threshold === "needs_review") return ["missing", "needs_review"];
   return ["missing", "needs_review", "partial"];
 }
+function displayServiceId(entry) {
+  for (const value of [entry.slug, entry.name, entry.serviceId]) {
+    if (typeof value !== "string" || !value.trim()) continue;
+    for (const candidate of serviceIdCandidates(value)) {
+      if (Object.prototype.hasOwnProperty.call(DEFAULT_SERVICE_URLS, candidate)) {
+        return candidate;
+      }
+    }
+  }
+  return serviceIdCandidates(entry.slug || entry.serviceId)[0] || entry.serviceId;
+}
+function serviceIdCandidates(value) {
+  const normalized = value.trim().toLowerCase().replace(/\s+/g, "-");
+  const withoutTopolo = normalized.startsWith("topolo-") ? normalized.slice("topolo-".length) : normalized;
+  return [.../* @__PURE__ */ new Set([
+    normalized,
+    normalized.replace(/-/g, "_"),
+    withoutTopolo,
+    withoutTopolo.replace(/-/g, "_")
+  ])].filter(Boolean);
+}
+function formatKnownValues(values, label) {
+  const sorted = [...values].sort();
+  const preview = sorted.slice(0, 25).join(", ");
+  const suffix = sorted.length > 25 ? `, ... +${sorted.length - 25} more` : "";
+  return `Run discovery for the full ${label} list. Known snapshot sample: ${preview}${suffix}`;
+}
 
 // src/dispatch.ts
 function listAvailableTopoloTools(scopes, tools = TOOLS) {