@topolo/mcp 0.4.9 → 0.5.0

package/dist/dispatch.js

@@ -22,13 +22,13 @@ function hasScope(set, required) {
   if (set.permissions.includes("*")) return true;
   const [servicePart, actionPart] = splitPermission(required);
   if (!servicePart) return set.permissions.includes(required);
-  const [serviceId, resource] = splitService(servicePart);
+  const [appId, resource] = splitService(servicePart);
   const candidates = new Set([
     required,
     "*",
-    serviceId ? `${serviceId}.*` : null,
-    serviceId && resource && actionPart ? `${serviceId}.${resource}:*` : null,
-    serviceId && resource && actionPart ? `${serviceId}.${resource}.${actionPart}` : null,
+    appId ? `${appId}.*` : null,
+    appId && resource && actionPart ? `${appId}.${resource}:*` : null,
+    appId && resource && actionPart ? `${appId}.${resource}.${actionPart}` : null,
     resource && actionPart ? `${resource}:*` : null,
     resource && actionPart ? `${resource}.${actionPart}` : null,
     resource && actionPart ? `${resource}:${actionPart}` : null
@@ -80,10 +80,10 @@ var TOOLS = [
     },
     handler: async (topolo) => {
       const services = (await topolo.client.listServices()).map((entry) => {
-        const id = displayServiceId(entry);
+        const id = displayAppId(entry);
         return {
           id,
-          serviceId: entry.serviceId,
+          appId: entry.appId,
           slug: entry.slug,
           name: entry.name,
           apiBaseUrl: entry.apiBaseUrl,
@@ -110,7 +110,7 @@ var TOOLS = [
       properties: {
         service: {
           type: "string",
-          description: "Optional service id, slug, or name filter."
+          description: "Optional app id, slug, or name filter."
         }
       },
       additionalProperties: false
@@ -139,7 +139,7 @@ var TOOLS = [
   {
     name: "topolo_get_application",
     title: "Describe one Topolo platform application",
-    description: "Returns one live application catalog entry (service id, slug, name, API URL, launch URL, status). Accepts the service id, slug, or name. Resolved against the live registry so newly-registered apps work without a client rebuild.",
+    description: "Returns one live application catalog entry (app id, slug, name, API URL, launch URL, status). Accepts the app id, slug, or name. Resolved against the live registry so newly-registered apps work without a client rebuild.",
     requiredScopes: [],
     destructive: false,
     inputSchema: {
@@ -147,7 +147,7 @@ var TOOLS = [
       properties: {
         application: {
           type: "string",
-          description: "Application identifier: service id, slug, or name from topolo_list_applications."
+          description: "Application identifier: app id, slug, or name from topolo_list_applications."
         }
       },
       required: ["application"],
@@ -161,10 +161,10 @@ var TOOLS = [
       const needle = application.trim().toLowerCase();
       const catalog = await topolo.client.listServices();
       const match = catalog.find(
-        (e) => e.serviceId.toLowerCase() === needle || e.slug && e.slug.toLowerCase() === needle || e.name && e.name.toLowerCase() === needle
+        (e) => e.appId.toLowerCase() === needle || e.slug && e.slug.toLowerCase() === needle || e.name && e.name.toLowerCase() === needle
       );
       if (!match) {
-        const known = catalog.map((e) => e.slug || e.serviceId).sort().filter((value) => typeof value === "string" && value.length > 0);
+        const known = catalog.map((e) => e.slug || e.appId).sort().filter((value) => typeof value === "string" && value.length > 0);
         throw new Error(
           `Unknown application "${application}". ${formatKnownValues(known, "applications")}`
         );
@@ -347,14 +347,20 @@ async function buildTopoloTools(topolo, scopes, tools = TOOLS) {
   const actionTools = actionsToToolDefs(actions);
   return filterToolsByScopes([...baseTools, ...actionTools], scopes);
 }
+function effectiveAgentAccess(a) {
+  if (a.agentAccess) return a.agentAccess;
+  if (a.destructive) return "off";
+  if (a.readOnly && !a.requiresConfirmation) return "auto";
+  return "confirm";
+}
 function actionsToToolDefs(actions) {
-  return actions.map((action) => ({
+  return actions.map((action) => ({ action, access: effectiveAgentAccess(action) })).filter(({ access }) => access !== "off").map(({ action, access }) => ({
     name: action.toolName || toolNameForAction(action),
     title: action.title,
     description: action.description,
     requiredScopes: action.requiredPermission ? [action.requiredPermission] : [],
-    destructive: action.destructive || action.requiresConfirmation || action.method !== "GET",
-    inputSchema: actionInputSchema(action),
+    destructive: access === "confirm",
+    inputSchema: actionInputSchema(action, access),
     handler: async (topolo, args) => {
       const confirm = Boolean(args["confirm"]);
       const input = { ...args };
@@ -364,11 +370,11 @@ function actionsToToolDefs(actions) {
   }));
 }
 function toolNameForAction(action) {
-  const service = (action.serviceSlug || action.serviceId || "service").replace(/^topolo-/, "").toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+  const service = (action.serviceSlug || action.appId || "service").replace(/^topolo-/, "").toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
   const name = action.name.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
   return ["topolo", service, name].filter(Boolean).join("_").slice(0, 96);
 }
-function actionInputSchema(action) {
+function actionInputSchema(action, access = "auto") {
   const schema = {
     type: "object",
     properties: {},
@@ -376,7 +382,7 @@ function actionInputSchema(action) {
     ...action.inputSchema
   };
   const properties = schema.properties && typeof schema.properties === "object" && !Array.isArray(schema.properties) ? { ...schema.properties } : {};
-  if (action.requiresConfirmation || action.method !== "GET") {
+  if (access === "confirm") {
     properties.confirm = {
       type: "boolean",
       description: "Required for mutating actions. Explicit human-in-the-loop acknowledgement."
@@ -425,18 +431,18 @@ function statusesAtOrWorse(threshold) {
   if (threshold === "needs_review") return ["missing", "needs_review"];
   return ["missing", "needs_review", "partial"];
 }
-function displayServiceId(entry) {
-  for (const value of [entry.slug, entry.name, entry.serviceId]) {
+function displayAppId(entry) {
+  for (const value of [entry.slug, entry.name, entry.appId]) {
     if (typeof value !== "string" || !value.trim()) continue;
-    for (const candidate of serviceIdCandidates(value)) {
+    for (const candidate of appIdCandidates(value)) {
       if (Object.prototype.hasOwnProperty.call(DEFAULT_SERVICE_URLS, candidate)) {
         return candidate;
       }
     }
   }
-  return serviceIdCandidates(entry.slug || entry.serviceId)[0] || entry.serviceId;
+  return appIdCandidates(entry.slug || entry.appId)[0] || entry.appId;
 }
-function serviceIdCandidates(value) {
+function appIdCandidates(value) {
   const normalized = value.trim().toLowerCase().replace(/\s+/g, "-");
   const withoutTopolo = normalized.startsWith("topolo-") ? normalized.slice("topolo-".length) : normalized;
   return [.../* @__PURE__ */ new Set([

package/dist/http.d.ts

@@ -0,0 +1,63 @@
+import { WebStandardStreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js';
+import { TopoloCredential, Topolo } from '@topolo/sdk';
+
+/**
+ * Hosted, multi-tenant MCP Streamable HTTP transport for the Topolo platform.
+ *
+ * stdio (index.ts) binds ONE env credential to the whole process. The hosted
+ * HTTP transport is the opposite: every request carries its OWN caller
+ * credential (Authorization: Bearer <jwt> or X-Api-Key: <key>). We build a
+ * per-request Topolo SDK client from THAT credential, introspect it to resolve
+ * the caller's scopes, and wire a per-session MCP server via buildServer — the
+ * exact same scope-gated tool list + dispatch path used by stdio. There is no
+ * process-wide credential fallback; a request with no/invalid credential is
+ * rejected with 401.
+ *
+ * Protocol: implemented by the SDK's WebStandardStreamableHTTPServerTransport,
+ * which speaks the MCP Streamable HTTP spec (POST JSON-RPC -> JSON or SSE,
+ * Mcp-Session-Id continuity, GET SSE stream, DELETE to terminate) over pure
+ * Web-Standard Request/Response — so it runs unchanged in a Cloudflare Worker.
+ */
+interface TopoloMcpHttpOptions {
+    /** Path the MCP endpoint is mounted at. Defaults to '/mcp'. */
+    path?: string;
+    /** Per-service URL overrides (e.g. staging). Passed through to createTopolo. */
+    serviceUrls?: Record<string, string>;
+    /** Per-service TopoloAuth app-id overrides. Passed through to createTopolo. */
+    appIds?: Record<string, string>;
+    /** Human-readable agent label for audit logs (forwarded to the SDK). */
+    agentName?: string;
+    /**
+     * Injected fetch passed to the default createTopolo factory. Defaults to the
+     * runtime global fetch. Useful in a Worker (to forward `env`-bound fetch) and
+     * in tests. Ignored when `createClient` is supplied.
+     */
+    fetch?: typeof fetch;
+    /**
+     * Build the per-request SDK client. Injectable so tests can supply a fake
+     * Topolo without real network I/O. Defaults to createTopolo. The credential
+     * is always the per-request caller credential — never an env credential.
+     */
+    createClient?: (credential: TopoloCredential) => Topolo;
+}
+interface McpSession {
+    transport: WebStandardStreamableHTTPServerTransport;
+    /** Fingerprint of the credential that created this session. */
+    fingerprint: string;
+}
+/**
+ * Create a Cloudflare-Worker-compatible fetch handler that serves the Topolo
+ * MCP over Streamable HTTP. Mount it as the Worker's default export, e.g.:
+ *
+ *   const handler = createTopoloMcpHttpHandler();
+ *   export default { fetch: handler.fetch };
+ */
+declare function createTopoloMcpHttpHandler(options?: TopoloMcpHttpOptions): {
+    /** Cloudflare Worker / fetch-compatible entrypoint. */
+    fetch: (request: Request) => Promise<Response>;
+    /** Exposed for tests/introspection. */
+    sessions: Map<string, McpSession>;
+};
+type TopoloMcpHttpHandler = ReturnType<typeof createTopoloMcpHttpHandler>;
+
+export { type TopoloMcpHttpHandler, type TopoloMcpHttpOptions, createTopoloMcpHttpHandler };