@topolo/mcp 0.4.1 → 0.4.2

package/README.md

@@ -114,8 +114,9 @@ yet. GET requests work without confirmation; mutating HTTP methods must pass
 `confirm: true` or the SDK rejects the call. Backing services still enforce
 permissions for every request. The tool schema intentionally does not embed a
 large service enum; agents should call `topolo_list_services` first, then pass a
-service ID/slug. The SDK can resolve live Auth-catalog API/technical service
-surfaces for newly registered services before the next MCP package release.
+service ID/slug from that credential-scoped result. New services become callable
+without an MCP release once Auth grants the organization and credential the
+relevant permissions.
 
 ## Safety rails
 
@@ -124,6 +125,9 @@ surfaces for newly registered services before the next MCP package release.
   to see Org B's data.
 - **Scope-gated tool advertisement.** Agents never see tools they can't use —
   fewer wasted attempts and less prompt noise.
+- **Credential-scoped catalog discovery.** `topolo_list_services` and
+  `topolo_list_applications` use TopoloAuth's live organization/permission
+  catalog. They do not expose the global generated platform catalog.
 - **Audit headers.** Every request sends `X-Topolo-Client: topolo-mcp/<ver>`,
   `X-Topolo-Agent: <label>`, `X-Topolo-Request-Id: <uuid>`.
 - **Write-action confirmation.** The SDK refuses mutating HTTP methods unless

package/dist/dispatch.js

@@ -70,7 +70,7 @@ var TOOLS = [
   {
     name: "topolo_list_services",
     title: "List every Topolo service the agent can reach",
-    description: "Returns the service registry the SDK knows about: one entry per platform service with its stable service ID and current base URL. Use this to discover what `topolo_api_call` can address \u2014 the service IDs returned here are the exact values accepted by that tool. Pure metadata: no credential introspection, no permission check, no external call.",
+    description: "Returns the credential-scoped service registry: one entry per platform service the current credential can use in its organization, with granted permissions and base URL. Use this to discover what `topolo_api_call` can address. This is not the global platform catalog.",
     requiredScopes: [],
     destructive: false,
     inputSchema: {
@@ -78,12 +78,21 @@ var TOOLS = [
       properties: {},
       additionalProperties: false
     },
-    handler: async () => {
-      const services = Object.keys(DEFAULT_SERVICE_URLS).sort().map((id) => ({
-        id,
-        defaultUrl: DEFAULT_SERVICE_URLS[id],
-        effectiveUrl: resolveServiceUrl(id)
-      }));
+    handler: async (topolo) => {
+      const services = (await topolo.client.listServices()).map((entry) => {
+        const id = displayServiceId(entry);
+        return {
+          id,
+          serviceId: entry.serviceId,
+          slug: entry.slug,
+          name: entry.name,
+          baseUrl: entry.baseUrl,
+          effectiveUrl: resolveServiceUrl(id) || entry.baseUrl,
+          surfaceKind: entry.surfaceKind,
+          launchable: entry.launchable,
+          permissions: [...entry.permissions]
+        };
+      }).sort((left, right) => left.id.localeCompare(right.id));
       return { services };
     }
   },
@@ -375,6 +384,27 @@ function statusesAtOrWorse(threshold) {
   if (threshold === "needs_review") return ["missing", "needs_review"];
   return ["missing", "needs_review", "partial"];
 }
+function displayServiceId(entry) {
+  for (const value of [entry.slug, entry.name, entry.serviceId]) {
+    if (typeof value !== "string" || !value.trim()) continue;
+    for (const candidate of serviceIdCandidates(value)) {
+      if (Object.prototype.hasOwnProperty.call(DEFAULT_SERVICE_URLS, candidate)) {
+        return candidate;
+      }
+    }
+  }
+  return serviceIdCandidates(entry.slug || entry.serviceId)[0] || entry.serviceId;
+}
+function serviceIdCandidates(value) {
+  const normalized = value.trim().toLowerCase().replace(/\s+/g, "-");
+  const withoutTopolo = normalized.startsWith("topolo-") ? normalized.slice("topolo-".length) : normalized;
+  return [.../* @__PURE__ */ new Set([
+    normalized,
+    normalized.replace(/-/g, "_"),
+    withoutTopolo,
+    withoutTopolo.replace(/-/g, "_")
+  ])].filter(Boolean);
+}
 function formatKnownValues(values, label) {
   const sorted = [...values].sort();
   const preview = sorted.slice(0, 25).join(", ");

package/dist/index.js

@@ -2197,12 +2197,16 @@ var TopoloClient = class _TopoloClient {
     if (!serviceKey) {
       throw new TopoloSdkError("unknown_service", "service is required");
     }
-    const overrideUrl = resolveConfiguredServiceUrl(serviceKey, this.serviceUrls);
-    if (overrideUrl) return { serviceKey, baseUrl: overrideUrl };
-    const staticUrl = DEFAULT_SERVICE_URLS[serviceKey];
-    if (staticUrl) return { serviceKey, baseUrl: staticUrl };
+    if (serviceKey === "auth") {
+      const overrideUrl = resolveConfiguredServiceUrl(serviceKey, this.serviceUrls);
+      if (overrideUrl) return { serviceKey, baseUrl: overrideUrl };
+      return { serviceKey, baseUrl: DEFAULT_SERVICE_URLS.auth };
+    }
     const live = await this.resolveLiveCallableService(serviceKey);
-    if (live) return live;
+    if (live) {
+      const overrideUrl = resolveConfiguredServiceUrl(serviceKey, this.serviceUrls);
+      return overrideUrl ? { ...live, baseUrl: overrideUrl } : live;
+    }
     throw new TopoloSdkError(
       "unknown_service",
       `Unknown Topolo service "${service}". Run service discovery first and pass a callable service id or slug.`
@@ -2212,10 +2216,7 @@ var TopoloClient = class _TopoloClient {
     const catalog = await this.listServices();
     const match = catalog.find((entry) => catalogEntryMatches(entry, serviceKey));
     if (!match?.baseUrl || !isCallableCatalogEntry(match)) return null;
-    return {
-      serviceKey: normalizeLookupKey(match.slug || match.name || match.serviceId) || serviceKey,
-      baseUrl: match.baseUrl
-    };
+    return { serviceKey, baseUrl: match.baseUrl };
   }
   /**
    * Resolve a service-slug → opaque service-id via caller config or TopoloAuth.
@@ -2277,53 +2278,55 @@ var TopoloClient = class _TopoloClient {
   /**
    * List the platform service catalog from the live registry
    * (`GET /api/services/catalog` on TopoloAuth). Credential-aware: the
-   * caller's credential is attached, so an authenticated caller in an
-   * entitled org also receives the `developer_only` services its role
-   * permits; an unauthenticated/agent caller receives `active` only.
+   * caller's credential is attached, so the result only includes services the
+   * credential's organization and effective permissions can use.
    *
-   * Resilient: on any network/HTTP failure this falls back to the
-   * build-time generated `APPLICATIONS` snapshot so offline/degraded
-   * callers still get a usable (if static) catalog. The live result is
-   * authoritative; the snapshot is a floor, not a cap.
+   * Security boundary: this never falls back to the generated global snapshot.
+   * The live Auth catalog is the authority because it is scoped to the caller's
+   * organization and effective permissions.
    */
   async listServices() {
     const now = Date.now();
     if (this.serviceCatalogCache && this.serviceCatalogCache.expiresAt > now) {
       return this.serviceCatalogCache.entries;
     }
-    try {
-      const res = await this.request({ service: "auth", method: "GET", path: "/api/services/catalog" });
-      const raw = res.data?.services ?? res.services;
-      if (Array.isArray(raw) && raw.length > 0) {
-        const entries = [];
-        for (const item of raw) {
-          const s = item;
-          const serviceId = typeof s.service_id === "string" ? s.service_id : typeof s.id === "string" ? s.id : null;
-          if (!serviceId) continue;
-          entries.push({
-            serviceId,
-            slug: typeof s.app_slug === "string" ? s.app_slug : null,
-            name: typeof s.name === "string" ? s.name : null,
-            description: typeof s.description === "string" ? s.description : null,
-            baseUrl: typeof s.base_url === "string" ? s.base_url : null,
-            status: typeof s.status === "string" ? s.status : null,
-            surfaceKind: typeof s.surface_kind === "string" ? s.surface_kind : null,
-            launchable: s.launchable === true
-          });
-        }
-        if (entries.length > 0) {
-          this.serviceCatalogCache = {
-            entries,
-            expiresAt: now + CATALOG_CACHE_TTL_MS
-          };
-          return entries;
-        }
-      }
-    } catch {
+    const res = await this.request({ service: "auth", method: "GET", path: "/api/services/catalog" });
+    const raw = res.data?.services ?? res.services;
+    if (!Array.isArray(raw)) {
+      throw new TopoloSdkError(
+        "service_catalog_unavailable",
+        "TopoloAuth did not return a service catalog for the current credential."
+      );
+    }
+    const entries = [];
+    for (const item of raw) {
+      const s = item;
+      const serviceId = typeof s.service_id === "string" ? s.service_id : typeof s.id === "string" ? s.id : null;
+      if (!serviceId) continue;
+      const permissions = Array.isArray(s.granted_permissions) ? s.granted_permissions.filter((permission) => typeof permission === "string" && permission.trim().length > 0) : [];
+      entries.push({
+        serviceId,
+        slug: typeof s.app_slug === "string" ? s.app_slug : null,
+        name: typeof s.name === "string" ? s.name : null,
+        description: typeof s.description === "string" ? s.description : null,
+        baseUrl: typeof s.base_url === "string" ? s.base_url : null,
+        status: typeof s.status === "string" ? s.status : null,
+        surfaceKind: typeof s.surface_kind === "string" ? s.surface_kind : null,
+        launchable: s.launchable === true,
+        permissions
+      });
     }
-    return this.generatedCatalogFallback();
+    this.serviceCatalogCache = {
+      entries,
+      expiresAt: now + CATALOG_CACHE_TTL_MS
+    };
+    return entries;
   }
-  generatedCatalogFallback() {
+  /**
+   * Bundled generated registry for tooling that audits platform packaging, not
+   * for deciding what the current credential may use.
+   */
+  listBundledServices() {
     const apps = Object.values(APPLICATIONS);
     return apps.map((app) => ({
       serviceId: app.id,
@@ -2331,9 +2334,10 @@ var TopoloClient = class _TopoloClient {
       name: app.name ?? app.id,
       description: null,
       baseUrl: app.productionUrl ?? null,
-      status: "active",
+      status: "bundled",
       surfaceKind: "application",
-      launchable: Boolean(app.productionUrl)
+      launchable: Boolean(app.productionUrl),
+      permissions: []
     }));
   }
   /**
@@ -2403,7 +2407,7 @@ function serviceKeyCandidates(slug) {
   ])];
 }
 function normalizeLookupKey(value) {
-  return String(value || "").trim().toLowerCase();
+  return String(value || "").trim().toLowerCase().replace(/\s+/g, "-");
 }
 function catalogEntryMatches(entry, needle) {
   return catalogEntryLookupKeys(entry).includes(needle);
@@ -2414,12 +2418,8 @@ function catalogEntryLookupKeys(entry) {
   for (const value of values) {
     const normalized = normalizeLookupKey(value);
     if (!normalized) continue;
-    keys.add(normalized);
-    keys.add(normalized.replace(/-/g, "_"));
-    if (normalized.startsWith("topolo-")) {
-      const withoutTopolo = normalized.slice("topolo-".length);
-      keys.add(withoutTopolo);
-      keys.add(withoutTopolo.replace(/-/g, "_"));
+    for (const candidate of serviceKeyCandidates(normalized)) {
+      keys.add(candidate);
     }
   }
   return [...keys];
@@ -2427,7 +2427,9 @@ function catalogEntryLookupKeys(entry) {
 function isCallableCatalogEntry(entry) {
   const kind = normalizeLookupKey(entry.surfaceKind || "");
   if (kind === "api" || kind === "technical_service" || kind === "service") return true;
-  return Boolean(entry.slug && Object.prototype.hasOwnProperty.call(DEFAULT_SERVICE_URLS, catalogEntryLookupKeys(entry)[0] ?? ""));
+  return Boolean(
+    entry.baseUrl && catalogEntryLookupKeys(entry).some((key) => Object.prototype.hasOwnProperty.call(DEFAULT_SERVICE_URLS, key))
+  );
 }
 function describeError(body, fallback) {
   if (body && typeof body === "object") {
@@ -2612,7 +2614,7 @@ var TOOLS = [
   {
     name: "topolo_list_services",
     title: "List every Topolo service the agent can reach",
-    description: "Returns the service registry the SDK knows about: one entry per platform service with its stable service ID and current base URL. Use this to discover what `topolo_api_call` can address \u2014 the service IDs returned here are the exact values accepted by that tool. Pure metadata: no credential introspection, no permission check, no external call.",
+    description: "Returns the credential-scoped service registry: one entry per platform service the current credential can use in its organization, with granted permissions and base URL. Use this to discover what `topolo_api_call` can address. This is not the global platform catalog.",
     requiredScopes: [],
     destructive: false,
     inputSchema: {
@@ -2620,12 +2622,21 @@ var TOOLS = [
       properties: {},
       additionalProperties: false
     },
-    handler: async () => {
-      const services = Object.keys(DEFAULT_SERVICE_URLS).sort().map((id) => ({
-        id,
-        defaultUrl: DEFAULT_SERVICE_URLS[id],
-        effectiveUrl: resolveServiceUrl(id)
-      }));
+    handler: async (topolo) => {
+      const services = (await topolo.client.listServices()).map((entry) => {
+        const id = displayServiceId(entry);
+        return {
+          id,
+          serviceId: entry.serviceId,
+          slug: entry.slug,
+          name: entry.name,
+          baseUrl: entry.baseUrl,
+          effectiveUrl: resolveServiceUrl(id) || entry.baseUrl,
+          surfaceKind: entry.surfaceKind,
+          launchable: entry.launchable,
+          permissions: [...entry.permissions]
+        };
+      }).sort((left, right) => left.id.localeCompare(right.id));
       return { services };
     }
   },
@@ -2917,6 +2928,27 @@ function statusesAtOrWorse(threshold) {
   if (threshold === "needs_review") return ["missing", "needs_review"];
   return ["missing", "needs_review", "partial"];
 }
+function displayServiceId(entry) {
+  for (const value of [entry.slug, entry.name, entry.serviceId]) {
+    if (typeof value !== "string" || !value.trim()) continue;
+    for (const candidate of serviceIdCandidates(value)) {
+      if (Object.prototype.hasOwnProperty.call(DEFAULT_SERVICE_URLS, candidate)) {
+        return candidate;
+      }
+    }
+  }
+  return serviceIdCandidates(entry.slug || entry.serviceId)[0] || entry.serviceId;
+}
+function serviceIdCandidates(value) {
+  const normalized = value.trim().toLowerCase().replace(/\s+/g, "-");
+  const withoutTopolo = normalized.startsWith("topolo-") ? normalized.slice("topolo-".length) : normalized;
+  return [.../* @__PURE__ */ new Set([
+    normalized,
+    normalized.replace(/-/g, "_"),
+    withoutTopolo,
+    withoutTopolo.replace(/-/g, "_")
+  ])].filter(Boolean);
+}
 function formatKnownValues(values, label) {
   const sorted = [...values].sort();
   const preview = sorted.slice(0, 25).join(", ");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@topolo/mcp",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Model Context Protocol server for the Topolo platform. Exposes scope-gated tools that third-party agents (Claude, Codex, etc.) can call natively.",
   "type": "module",
   "bin": {