@tryvira/mcp 0.1.22 → 0.1.25

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 Vira / Esad Türkel
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 Vira / Esad Türkel
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,79 +1,79 @@
-# @tryvira/mcp
-
-MIT-licensed MCP client/server package. The Vira service, application, and
-backend remain proprietary and are governed separately.
-
-An npx-ready MCP server for Vira's existing scoped authority boundary.
-
-## Run it
-
-```bash
-npx @tryvira/mcp
-```
-
-The default transport is the official MCP transport. The legacy custom transport is an
-explicit migration option only: `VIRA_MCP_PROTOCOL_MODE=legacy npx @tryvira/mcp`.
-
-The launcher reads environment variables from its parent process. It does not automatically load a
-`.env` file. For a local shell, export the variables first; for an MCP client, put them in the
-client's `env` configuration:
-
-```dotenv
-VIRA_API_URL=http://127.0.0.1:4185
-VIRA_API_KEY=vira_dev_local.local-development-only-32chars
-VIRA_MCP_AUTH_TOKEN=replace-with-a-long-random-mcp-token
-VIRA_ORGANIZATION_ID=local-org
-VIRA_PROJECT_ID=local-project
-VIRA_ENVIRONMENT_ID=local
-```
-
-For example, an MCP client configuration uses the same names:
-
-```json
-{"env":{"VIRA_API_URL":"https://api.example","VIRA_API_KEY":"<customer-api-key>","VIRA_MCP_AUTH_TOKEN":"<mcp-token>","VIRA_ORGANIZATION_ID":"<org>","VIRA_PROJECT_ID":"<project>","VIRA_ENVIRONMENT_ID":"<environment>"}}
-```
-
-The default launcher uses MCP stdio. To run the optional HTTP transport explicitly, use
-`npx @tryvira/mcp --http`; it binds to `127.0.0.1` by default and requires `Authorization: Bearer
-<VIRA_MCP_AUTH_TOKEN>`. Effectful MCP tools are denied by default. Local-only effectful
-execution requires the explicit `VIRA_MCP_ALLOW_EFFECTFUL=true` opt-in; production never
-accepts that shortcut. Set `VIRA_MCP_BIND_PUBLIC=true` only when an authenticated reverse
-proxy or equivalent network boundary is present.
-
-Effectful MCP tools remain authority-gated; the launcher does not create a second execution or telemetry path.
-
-## What a client can discover
-
-After `initialize`, call `tools/list`. Read-only tools such as `resolve_semantic` may return
-semantic candidates. Effectful tools such as `resolve_runtime`, pack installation/release
-and Strategy execution call the configured authority endpoint and can be denied by scope,
-role, release state or policy.
-
-## Minimal MCP client configuration
-
-```json
-{
-  "mcpServers": {
-    "vira": {
-      "command": "npx",
-      "args": ["-y", "@tryvira/mcp"],
-      "env": {
-        "VIRA_API_URL": "https://api.example.invalid",
-        "VIRA_API_KEY": "<customer-api-key>",
-        "VIRA_MCP_AUTH_TOKEN": "<mcp-auth-token>",
-        "VIRA_MCP_AUTHORITY_URL": "https://api.example.invalid/v1/mcp/authorize",
-        "VIRA_ORGANIZATION_ID": "<organization>",
-        "VIRA_PROJECT_ID": "<project>",
-        "VIRA_ENVIRONMENT_ID": "<environment>"
-      }
-    }
-  }
-}
-```
-
-Never paste real credentials into a checked-in client configuration. For local-only effectful
-testing, use the local stack and its documented development credentials; the production
-authority path does not accept the local bypass.
-
-See [`docs/MCP_GUIDE.md`](../../docs/MCP_GUIDE.md) for JSON-RPC discovery, tool examples and
-authority/error behavior.
+# @tryvira/mcp
+
+MIT-licensed MCP client/server package. The Vira service, application, and
+backend remain proprietary and are governed separately.
+
+An npx-ready MCP server for Vira's existing scoped authority boundary.
+
+## Run it
+
+```bash
+npx @tryvira/mcp
+```
+
+The default transport is the official MCP transport. The legacy custom transport is an
+explicit migration option only: `VIRA_MCP_PROTOCOL_MODE=legacy npx @tryvira/mcp`.
+
+The launcher reads environment variables from its parent process. It does not automatically load a
+`.env` file. For a local shell, export the variables first; for an MCP client, put them in the
+client's `env` configuration:
+
+```dotenv
+VIRA_API_URL=http://127.0.0.1:4185
+VIRA_API_KEY=vira_dev_local.local-development-only-32chars
+VIRA_MCP_AUTH_TOKEN=replace-with-a-long-random-mcp-token
+VIRA_ORGANIZATION_ID=local-org
+VIRA_PROJECT_ID=local-project
+VIRA_ENVIRONMENT_ID=local
+```
+
+For example, an MCP client configuration uses the same names:
+
+```json
+{"env":{"VIRA_API_URL":"https://api.example","VIRA_API_KEY":"<customer-api-key>","VIRA_MCP_AUTH_TOKEN":"<mcp-token>","VIRA_ORGANIZATION_ID":"<org>","VIRA_PROJECT_ID":"<project>","VIRA_ENVIRONMENT_ID":"<environment>"}}
+```
+
+The default launcher uses MCP stdio. To run the optional HTTP transport explicitly, use
+`npx @tryvira/mcp --http`; it binds to `127.0.0.1` by default and requires `Authorization: Bearer
+<VIRA_MCP_AUTH_TOKEN>`. Effectful MCP tools are denied by default. Local-only effectful
+execution requires the explicit `VIRA_MCP_ALLOW_EFFECTFUL=true` opt-in; production never
+accepts that shortcut. Set `VIRA_MCP_BIND_PUBLIC=true` only when an authenticated reverse
+proxy or equivalent network boundary is present.
+
+Effectful MCP tools remain authority-gated; the launcher does not create a second execution or telemetry path.
+
+## What a client can discover
+
+After `initialize`, call `tools/list`. Read-only tools such as `resolve_semantic` may return
+semantic candidates. Effectful tools such as `resolve_runtime`, pack installation/release
+and Strategy execution call the configured authority endpoint and can be denied by scope,
+role, release state or policy.
+
+## Minimal MCP client configuration
+
+```json
+{
+  "mcpServers": {
+    "vira": {
+      "command": "npx",
+      "args": ["-y", "@tryvira/mcp"],
+      "env": {
+        "VIRA_API_URL": "https://api.example.invalid",
+        "VIRA_API_KEY": "<customer-api-key>",
+        "VIRA_MCP_AUTH_TOKEN": "<mcp-auth-token>",
+        "VIRA_MCP_AUTHORITY_URL": "https://api.example.invalid/v1/mcp/authorize",
+        "VIRA_ORGANIZATION_ID": "<organization>",
+        "VIRA_PROJECT_ID": "<project>",
+        "VIRA_ENVIRONMENT_ID": "<environment>"
+      }
+    }
+  }
+}
+```
+
+Never paste real credentials into a checked-in client configuration. For local-only effectful
+testing, use the local stack and its documented development credentials; the production
+authority path does not accept the local bypass.
+
+See [`docs/MCP_GUIDE.md`](../../docs/MCP_GUIDE.md) for JSON-RPC discovery, tool examples and
+authority/error behavior.

package/dist/cli.js

@@ -826,7 +826,7 @@ function resolveViraMcpConfig(environment = process.env) {
   if (!apiKey) throw new Error("VIRA_API_KEY_REQUIRED_IN_PRODUCTION");
   const authorityUrl = environment.VIRA_MCP_AUTHORITY_URL;
   return { baseUrl, apiKey, authorityUrl, serverName: environment.VIRA_MCP_SERVER_NAME ?? "vira-behavior-control", requestAuthToken: environment.VIRA_MCP_AUTH_TOKEN, ...authorityUrl ? { authorizeEffectful: async (input) => {
-    const response = await fetch(`${authorityUrl}`, { method: "POST", headers: { authorization: `Bearer ${apiKey}`, "content-type": "application/json" }, body: JSON.stringify(input) });
+    const response = await fetch(`${authorityUrl}`, { method: "POST", headers: { authorization: `Bearer ${apiKey}`, "x-vira-api-key": apiKey, "content-type": "application/json" }, body: JSON.stringify(input) });
     const payload = await response.json().catch(() => null);
     return { allowed: response.ok && payload?.allowed === true, decisionDigest: payload?.decisionDigest ?? "", ...payload?.reason ? { reason: payload.reason } : {} };
   } } : {} };
@@ -841,7 +841,7 @@ function createViraMcpOptions(config) {
   if (!config.baseUrl?.trim() || !config.apiKey?.trim()) throw new Error("VIRA_MCP_CONFIG_REQUIRED");
   const fetcher = config.fetcher ?? fetch;
   const api = async (path, body, requestId, method) => {
-    const response = await fetcher(`${config.baseUrl.replace(/\/$/, "")}${path}`, { method: method ?? (body ? "POST" : "GET"), headers: { authorization: `Bearer ${config.apiKey}`, "content-type": "application/json", "idempotency-key": requestId }, ...body ? { body: JSON.stringify(body) } : {} });
+    const response = await fetcher(`${config.baseUrl.replace(/\/$/, "")}${path}`, { method: method ?? (body ? "POST" : "GET"), headers: { authorization: `Bearer ${config.apiKey}`, "x-vira-api-key": config.apiKey, "content-type": "application/json", "idempotency-key": requestId }, ...body ? { body: JSON.stringify(body) } : {} });
     const payload = await response.json().catch(() => null);
     if (!response.ok) return { error: `VIRA_API_${response.status}`, result: payload };
     return { result: payload };
@@ -1570,6 +1570,16 @@ async function openProductionSqlite({ databaseUrl = process.env.DATABASE_URL } =
   } catch (error) {
     if (!String(error).includes("duplicate column name")) throw error;
   }
+  database.run(`CREATE TABLE IF NOT EXISTS decision_authority_program_pointers (
+    organization_id TEXT NOT NULL,
+    project_id TEXT NOT NULL,
+    environment_id TEXT NOT NULL,
+    pointer_key TEXT NOT NULL,
+    bundle_id TEXT NOT NULL,
+    bundle_digest TEXT NOT NULL,
+    version INTEGER NOT NULL,
+    PRIMARY KEY (organization_id, project_id, environment_id, pointer_key)
+  )`);
   database.run("CREATE TABLE IF NOT EXISTS session_handoff_approvals (id TEXT PRIMARY KEY, source_session_id TEXT NOT NULL, target_session_id TEXT NOT NULL, organization_id TEXT NOT NULL, project_id TEXT NOT NULL, application_id TEXT, environment_id TEXT NOT NULL, status TEXT NOT NULL CHECK (status IN ('PENDING','APPROVED','REJECTED','CONSUMED')), requested_at TEXT NOT NULL, decided_at TEXT, expires_at TEXT NOT NULL, decision_digest TEXT NOT NULL UNIQUE)");
   database.run(`CREATE TABLE IF NOT EXISTS release_manifests (
     id TEXT PRIMARY KEY,