@topolo/mcp 0.4.9 → 0.4.10

package/dist/index.js

@@ -2360,8 +2360,9 @@ var TopoloClient = class _TopoloClient {
     return entries;
   }
   /**
-   * List callable actions from the live Auth catalog. The response is scoped to
-   * the caller's organization and effective permissions; no bundled/static app
+   * List callable actions from the live registry-canonical catalog (definitions
+   * from the Catalog registry, scoping from Auth). The response is scoped to the
+   * caller's organization and effective permissions; no bundled/static app
    * action list is used as an authorization source.
    */
   async listActions(options = {}) {
@@ -2370,7 +2371,7 @@ var TopoloClient = class _TopoloClient {
       return this.actionCatalogCache.entries;
     }
     const res = await this.request({
-      service: "auth",
+      service: "developers",
       method: "GET",
       path: "/api/actions/catalog",
       ...options.service ? { query: { service: options.service } } : {}
@@ -2605,6 +2606,7 @@ function normalizeActionCatalogEntry(item) {
     readOnly: Boolean(a.read_only ?? a.readOnly),
     destructive: Boolean(a.destructive),
     requiresConfirmation: Boolean(a.requires_confirmation ?? a.requiresConfirmation),
+    agentAccess: pickAgentAccess(a.agent_access ?? a.agentAccess),
     status: pickActionString(a.status),
     sourceRevision: pickActionString(a.source_revision) ?? pickActionString(a.sourceRevision)
   };
@@ -2615,6 +2617,9 @@ function isHttpMethod(value) {
 function pickActionString(value) {
   return typeof value === "string" && value.trim() ? value.trim() : null;
 }
+function pickAgentAccess(value) {
+  return value === "auto" || value === "confirm" || value === "off" ? value : null;
+}
 function plainObject(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
@@ -2706,7 +2711,6 @@ var CrmModule = class {
   constructor(client) {
     this.client = client;
   }
-  client;
   async listContacts(options = {}) {
     const res = await this.client.request({
       service: "crm",
@@ -2752,7 +2756,6 @@ var IdentityModule = class {
   constructor(client) {
     this.client = client;
   }
-  client;
   /** Returns the resolved user, organization, and permission set for the
    *  current credential. Equivalent to `TopoloClient.introspect()` — exposed
    *  on this module for symmetry with the other domain modules. */
@@ -3128,14 +3131,20 @@ async function buildTopoloTools(topolo, scopes, tools = TOOLS) {
   const actionTools = actionsToToolDefs(actions);
   return filterToolsByScopes([...baseTools, ...actionTools], scopes);
 }
+function effectiveAgentAccess(a) {
+  if (a.agentAccess) return a.agentAccess;
+  if (a.destructive) return "off";
+  if (a.readOnly && !a.requiresConfirmation) return "auto";
+  return "confirm";
+}
 function actionsToToolDefs(actions) {
-  return actions.map((action) => ({
+  return actions.map((action) => ({ action, access: effectiveAgentAccess(action) })).filter(({ access }) => access !== "off").map(({ action, access }) => ({
     name: action.toolName || toolNameForAction(action),
     title: action.title,
     description: action.description,
     requiredScopes: action.requiredPermission ? [action.requiredPermission] : [],
-    destructive: action.destructive || action.requiresConfirmation || action.method !== "GET",
-    inputSchema: actionInputSchema(action),
+    destructive: access === "confirm",
+    inputSchema: actionInputSchema(action, access),
     handler: async (topolo, args) => {
       const confirm = Boolean(args["confirm"]);
       const input = { ...args };
@@ -3149,7 +3158,7 @@ function toolNameForAction(action) {
   const name = action.name.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
   return ["topolo", service, name].filter(Boolean).join("_").slice(0, 96);
 }
-function actionInputSchema(action) {
+function actionInputSchema(action, access = "auto") {
   const schema = {
     type: "object",
     properties: {},
@@ -3157,7 +3166,7 @@ function actionInputSchema(action) {
     ...action.inputSchema
   };
   const properties = schema.properties && typeof schema.properties === "object" && !Array.isArray(schema.properties) ? { ...schema.properties } : {};
-  if (action.requiresConfirmation || action.method !== "GET") {
+  if (access === "confirm") {
     properties.confirm = {
       type: "boolean",
       description: "Required for mutating actions. Explicit human-in-the-loop acknowledgement."

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@topolo/mcp",
-  "version": "0.4.9",
+  "version": "0.4.10",
   "description": "Model Context Protocol server for the Topolo platform. Exposes scope-gated tools that third-party agents (Claude, Codex, etc.) can call natively.",
   "type": "module",
   "bin": {
@@ -10,32 +10,36 @@
     "./dispatch": {
       "types": "./dist/dispatch.d.ts",
       "import": "./dist/dispatch.js"
+    },
+    "./http": {
+      "types": "./dist/http.d.ts",
+      "import": "./dist/http.js"
     }
   },
   "files": [
     "dist"
   ],
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "typecheck": "tsc --noEmit",
+    "start": "node dist/index.js",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "coverage": "vitest run --coverage"
+  },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0"
   },
   "devDependencies": {
+    "@topolo/sdk": "workspace:*",
     "@types/node": "^20.12.0",
     "@vitest/coverage-v8": "^2.1.0",
     "tsup": "^8.0.0",
     "typescript": "^5.4.0",
-    "vitest": "^2.1.0",
-    "@topolo/sdk": "0.4.9"
+    "vitest": "^2.1.0"
   },
   "engines": {
     "node": ">=20"
-  },
-  "scripts": {
-    "build": "tsup",
-    "dev": "tsup --watch",
-    "typecheck": "tsc --noEmit",
-    "start": "node dist/index.js",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "coverage": "vitest run --coverage"
   }
-}
+}