@vectros-ai/mcp-server 0.18.0 → 0.18.1

package/dist/index.d.mts

@@ -95,8 +95,8 @@ interface VectrosMCPServerOptions {
     resources?: ResourceName[];
     /**
      * Vectros API base URL. Default: https://api.vectros.ai. The SDK
-     * calls this `environment`; we keep the docs-aligned name on our
-     * surface to match the design doc.
+     * calls this `environment`; we keep the more descriptive `apiBaseUrl`
+     * on our surface.
      */
     apiBaseUrl?: string;
     /** Provide a logger to capture server output. Default: pino → stderr. */

package/dist/index.d.ts

@@ -95,8 +95,8 @@ interface VectrosMCPServerOptions {
     resources?: ResourceName[];
     /**
      * Vectros API base URL. Default: https://api.vectros.ai. The SDK
-     * calls this `environment`; we keep the docs-aligned name on our
-     * surface to match the design doc.
+     * calls this `environment`; we keep the more descriptive `apiBaseUrl`
+     * on our surface.
      */
     apiBaseUrl?: string;
     /** Provide a logger to capture server output. Default: pino → stderr. */

package/dist/index.js

@@ -42,7 +42,7 @@ module.exports = __toCommonJS(index_exports);
 // src/server.ts
 var import_server = require("@modelcontextprotocol/sdk/server/index.js");
 
-// node_modules/@vectros-ai/sdk/dist/index.mjs
+// ../../node_modules/@vectros-ai/sdk/dist/index.mjs
 var __defProp2 = Object.defineProperty;
 var __export2 = (target, all) => {
   for (var name in all)
@@ -2472,7 +2472,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/auth/jwks");
   }
   /**
-   * Returns a page of per-subject PHI read-access rows: who read which subject's PHI, when, against which record, and whether any sensitive value was actually revealed in plaintext. Metadata only — never the PHI itself. This is the disclosure-accounting surface from which a covered entity derives its HIPAA §164.528 accounting of disclosures. Provide at least one query axis: a subject (`subjectType` + `subjectId`) within a `contextId` for the primary accounting query; `resourceId` within a `contextId` for 'who read this record'; `callerKeyId` for 'what did this credential read' (account-wide forensic); or `contextId` alone to enumerate a whole context. `from`/`to` bound the time window. Results are scoped to your account, derived from your token — never from input. Requires the `access-log:r` scope.
+   * Returns a page of per-subject PHI read-access rows: who read which subject's PHI, when, against which record, and whether any sensitive value was actually revealed in plaintext. Metadata only — never the PHI itself. Rows exist only where read-access logging is enabled. Provide at least one query axis: a subject (`subjectType` + `subjectId`) within a `contextId` for the primary accounting query; `resourceId` within a `contextId` for 'who read this record'; `callerKeyId` for 'what did this credential read' (account-wide forensic); or `contextId` alone to enumerate a whole context. `from`/`to` bound the time window. Results are scoped to your account, derived from your token — never from input. Requires the `access-log:r` scope.
    *
    * @param {Vectros.GetAccessLogRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -4177,7 +4177,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/auth/issuers/{issuerId}");
   }
   /**
-   * Updates the mutable fields of a registered issuer: `subClaim`, `emailClaim`, `userinfoUri`, `capturedClaims`, `restrictedToDomain` (a new non-blank value must already be a VERIFIED domain for your account; an empty string clears it back to domain-less; see `IssuerUpdateRequest.restrictedToDomain` for the full semantics), `status` (`active`/`suspended` — a registration awaiting verification (`pending_verification`) accepts no status change until it is verified; a suspended issuer's tokens are rejected identically to an unregistered issuer at exchange time), and `selfSignupPolicies`. Fields omitted from the body are left unchanged (partial update). `issuer`, `jwksUri`, `audience`, and `contextId` are trust-anchor / routing-pin fields and are immutable via this route — supplying a value that differs from the current registration is rejected with 400; supplying the current value back is a no-op. Rotating a trust anchor requires deleting and re-registering the issuer, which is itself refused while any user is bound through it. **`subClaim` is identity-determining, not merely cosmetic**: it names which verified JWT claim is read as the federated user's identifier, so changing it on an issuer that already has bound users would silently re-identify (or, under self-signup, orphan) every one of them — changing it is therefore refused once any user has bound through this issuer, the same guard `DELETE` already applies, and is only free before the first real login. Requires a root API key or the bootstrap's provisioning capability, gated identically to every other operation on this surface. A credential confined to one app context may only update an issuer registered in that context; naming one registered in another context returns 404, identically to a nonexistent issuerId. A root API key may update any issuer.
+   * Updates the mutable fields of a registered issuer: `subClaim`, `emailClaim`, `userinfoUri`, `capturedClaims`, `restrictedToDomain` (a new non-blank value must already be a VERIFIED domain for your account; an empty string clears it where permitted; see `IssuerUpdateRequest.restrictedToDomain` for the full semantics), `status` (`active`/`suspended` — a registration awaiting verification (`pending_verification`) accepts no status change until it is verified; a suspended issuer's tokens are rejected identically to an unregistered issuer at exchange time), and `selfSignupPolicies`. Fields omitted from the body are left unchanged (partial update). `issuer`, `jwksUri`, `audience`, and `contextId` are trust-anchor / routing-pin fields and are immutable via this route — supplying a value that differs from the current registration is rejected with 400; supplying the current value back is a no-op. Rotating a trust anchor requires deleting and re-registering the issuer, which is itself refused while any user is bound through it. **`subClaim` is identity-determining, not merely cosmetic**: it names which verified JWT claim is read as the federated user's identifier, so changing it on an issuer that already has bound users would silently re-identify (or, under self-signup, orphan) every one of them — changing it is therefore refused once any user has bound through this issuer, the same guard `DELETE` already applies, and is only free before the first real login. Requires a root API key or the bootstrap's provisioning capability, gated identically to every other operation on this surface. A credential confined to one app context may only update an issuer registered in that context; naming one registered in another context returns 404, identically to a nonexistent issuerId. A root API key may update any issuer.
    *
    * @param {Vectros.IssuerUpdateRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -4987,7 +4987,7 @@ var ComplianceClient = class {
     this._options = normalizeClientOptionsWithAuth(options);
   }
   /**
-   * Submits a right-to-erasure request for a single end-subject (a user, or an identity entity in any namespace). Erasure removes exactly the data the subject solely owns across the declared contexts, plus its identity and lookup rows when all contexts are covered. It never touches another account's data and never cascades into another subject's data. The request is asynchronous: it returns 202 with a `requestId`; poll `GET /v1/erasure-requests/{id}` until the job completes to obtain the completion certificate. Requires a root API key — a scoped credential is rejected with 403.
+   * Submits an erasure request for a single end-subject (a user, or an identity entity in any namespace). Erasure deletes the records, documents, folders and record schemas the subject solely owns across the declared contexts (and, for a user, its access profiles there), plus its identity and lookup rows when all contexts are covered. Rows co-owned with another owner scope or principal are kept; read-access log entries are not erased. The request is asynchronous: it returns 202 with a `requestId`; poll `GET /v1/erasure-requests/{id}` until the job completes to obtain the completion certificate. Requires a root API key — a scoped credential is rejected with 403.
    *
    * @param {Vectros.ErasureRequest} request
    * @param {ComplianceClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -5050,7 +5050,7 @@ var ComplianceClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/erasure-requests");
   }
   /**
-   * Polls an erasure request by id. While the job is still running this returns its status only; once it completes, the response also includes the verifiable completion certificate (which contexts were swept, per-context deletion counts, whether the identity was kept, and reports of dangling references and shared rows left intact). Requires a root API key.
+   * Polls an erasure request by id. While the job is still running this returns its status only; once it completes, the response also includes the completion certificate (which contexts were swept, per-context deletion counts, whether the identity was kept, and reports of dangling references and shared rows left intact). Requires a root API key.
    *
    * @param {Vectros.GetErasureRequestRequest} request
    * @param {ComplianceClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -7869,6 +7869,8 @@ var InferenceClient = class {
           throw new PaymentRequiredError(_response.error.body, _response.rawResponse);
         case 403:
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 413:
+          throw new ContentTooLargeError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -8008,6 +8010,8 @@ var InferenceClient = class {
           throw new PaymentRequiredError(_response.error.body, _response.rawResponse);
         case 403:
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 413:
+          throw new ContentTooLargeError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         case 500:
@@ -10292,7 +10296,7 @@ function warnOnSuboptimalKey(key, log) {
   if (key.prefix === "sk") {
     log.warn(
       { prefix: key.prefix, env: key.env },
-      'wildcard-scope key (sk_*) on a desktop MCP server is overly broad. For production, prefer a scoped ssk_* key bound to a narrowed AccessProfile. See the Vectros scoped-token documentation ("Recommended AccessProfile for MCP").'
+      'wildcard-scope key (sk_*) on a desktop MCP server is overly broad. For production, prefer a scoped ssk_* key bound to a narrowed AccessProfile: `npx -y @vectros-ai/cli bootstrap` mints one, and the "Recommended credential" section of this package\'s README describes it.'
     );
   } else if (key.prefix === "st") {
     log.warn(
@@ -10304,8 +10308,8 @@ function warnOnSuboptimalKey(key, log) {
 
 // src/build-info.ts
 var BUILD_INFO = {
-  mcpServer: true ? "0.18.0" : "dev",
-  sdk: true ? "0.46.0" : "dev"
+  mcpServer: true ? "0.18.1" : "dev",
+  sdk: true ? "0.47.0" : "dev"
 };
 
 // src/log.ts
@@ -11351,7 +11355,7 @@ var import_zod10 = require("zod");
 // src/tools/provider-alias.ts
 var import_zod9 = require("zod");
 var providerAliasInput = import_zod9.z.string().min(1, "providerAlias must be non-empty when supplied").optional().describe(
-  "Route THIS call through your own model provider instead of the platform-hosted default, by the alias of a provider config your account has activated. It works only after your account has set up that provider and signed the platform's risk-acceptance waiver; without both, the platform refuses the call with a 403, which is returned to you as written. A call served by your own provider leaves the platform-hosted Bedrock path, and Vectros's AWS BAA boundary. Omit it (the default) to use the platform-hosted path. When set, `model` names the model on your provider's own id space, and falls back to that provider config's default model when omitted."
+  "Route THIS call through your own model provider instead of the platform-hosted default, by the alias of a provider config your account has activated. It works only after your account has set up that provider and signed the platform's risk-acceptance waiver; without both, the platform refuses the call with a 403, which is returned to you as written. If your account has accepted the Business Associate Agreement with Vectros in the developer portal, an account owner must also have attested that provider config in the developer portal (Model Providers); until then the platform refuses the call with a 403 that says it needs a BAA-holder attestation. A call served by your own provider leaves the Vectros perimeter. Omit it (the default) to use the platform-hosted path. When set, `model` names the model on your provider's own id space, and falls back to that provider config's default model when omitted."
 );
 
 // src/tools/rag_ask.ts
@@ -11363,7 +11367,7 @@ var inputSchema9 = {
     'System prompt that overrides the default for the generation step \u2014 e.g. "answer only from the provided context, cite sources, be concise". Default: a generic answer-from-context instruction.'
   ),
   model: import_zod10.z.string().optional().describe(
-    "Inference model alias (e.g. claude-haiku-4-5, claude-sonnet-5, claude-opus-5-5). Default = tier-appropriate Haiku. See GET /v1/models for the catalog the calling key can reach. When `providerAlias` is set, this instead names the model on that provider's own id space."
+    "Inference model alias (e.g. claude-haiku-5-5, claude-sonnet-5-5, claude-opus-5-5). Omit it to use the platform default, which GET /v1/models reports as `defaultModel`; that endpoint also lists the catalog the calling key can reach. When `providerAlias` is set, this instead names the model on that provider's own id space."
   ),
   providerAlias: providerAliasInput,
   search: import_zod10.z.object({
@@ -11394,13 +11398,17 @@ var inputSchema9 = {
     createdBefore: import_zod10.z.string().optional().describe("Same creation-time basis as createdAfter, bounding at/before this ISO 8601 UTC value."),
     requireComplete: import_zod10.z.boolean().optional().describe("Fail closed (503) on a degraded search backend instead of grounding on partial results. Default false.")
   }).optional().describe("Retrieval params + scoping. Default mode HYBRID, limit " + SEARCH_MCP_DEFAULT_LIMIT + "."),
-  maxTokens: import_zod10.z.number().int().min(1).optional().describe("Max output tokens."),
-  temperature: import_zod10.z.number().min(0).max(1).optional().describe("Sampling temperature (0.0\u20131.0). Default 0.3 \u2014 lower favors deterministic, retrieval-grounded answers.")
+  maxTokens: import_zod10.z.number().int().min(1).optional().describe(
+    "Max output tokens. claude-haiku-5-5, claude-sonnet-5, claude-sonnet-5-5 and claude-opus-5-5 can reason before they answer; when they do, the reasoning counts against this limit, so a small value can return little or no text. Leave headroom: 1024 or more for a short answer."
+  ),
+  temperature: import_zod10.z.number().min(0).max(1).optional().describe(
+    "Sampling temperature (0.0\u20131.0). Default 0.3 \u2014 lower favors deterministic, retrieval-grounded answers. The platform ignores it for claude-haiku-5-5, claude-sonnet-5, claude-sonnet-5-5 and claude-opus-5-5, which sample at their own default; it applies to models that accept a temperature, such as claude-haiku-4-5."
+  )
 };
 var ragAsk = ({ client, log }) => ({
   name: "rag_ask",
   title: "RAG ask (corpus-wide)",
-  description: "Ask a question grounded against your tenant's indexed content. Vectros performs a hybrid search, injects the top-K passages into the prompt, and streams a model answer back. Scope retrieval with `search` (ownership \u2014 `scope` for one ownership dimension or `scopeFilters` for several at once, e.g. one client within one org \u2014 folder, type, metadata filters, date window) to ground on a subset \u2014 e.g. one patient or one folder \u2014 and steer generation with `instructions` / `temperature`. The full answer is returned as a single response; progress notifications keep the call alive during the 30-45s generation window. Calls without `providerAlias` are served by platform-hosted AWS Bedrock. A call that sets `providerAlias` goes to your own model provider, outside Vectros's AWS BAA boundary.",
+  description: "Ask a question grounded against your tenant's indexed content. Vectros performs a hybrid search, injects the top-K passages into the prompt, and streams a model answer back. Scope retrieval with `search` (ownership \u2014 `scope` for one ownership dimension or `scopeFilters` for several at once, e.g. one client within one org \u2014 folder, type, metadata filters, date window) to ground on a subset \u2014 e.g. one patient or one folder \u2014 and steer generation with `instructions` (and `temperature`, for the models that accept one). The full answer is returned as a single response; progress notifications keep the call alive during the 30-45s generation window. Calls without `providerAlias` are served by platform-hosted AWS Bedrock. A call that sets `providerAlias` goes to your own model provider, outside Vectros's AWS BAA boundary.",
   inputSchema: inputSchema9,
   // NOT a pure read: this call reserves an atomic hold against the caller's prepaid inference
   // balance before generation starts, then debits it on completion — a real financial side
@@ -11502,10 +11510,12 @@ var inputSchema10 = {
   documentId: import_zod11.z.string().min(1, "documentId is required").describe("ID of the document to ask against."),
   prompt: import_zod11.z.string().min(1, "prompt is required").describe("Question to ask about the document."),
   model: import_zod11.z.string().optional().describe(
-    "Inference model alias. Default = tier-appropriate Haiku. See GET /v1/models for the catalog the calling key can reach. When `providerAlias` is set, this instead names the model on that provider's own id space."
+    "Inference model alias. Omit it to use the platform default, which GET /v1/models reports as `defaultModel`; that endpoint also lists the catalog the calling key can reach. When `providerAlias` is set, this instead names the model on that provider's own id space."
   ),
   providerAlias: providerAliasInput,
-  maxTokens: import_zod11.z.number().int().min(1).optional().describe("Max output tokens.")
+  maxTokens: import_zod11.z.number().int().min(1).optional().describe(
+    "Max output tokens. claude-haiku-5-5, claude-sonnet-5, claude-sonnet-5-5 and claude-opus-5-5 can reason before they answer; when they do, the reasoning counts against this limit, so a small value can return little or no text. Leave headroom: 1024 or more for a short answer."
+  )
 };
 var documentAsk = ({ client, log }) => ({
   name: "document_ask",
@@ -12093,7 +12103,7 @@ var inputSchema19 = {
 var folderDelete = ({ client, log }) => ({
   name: "folder_delete",
   title: "Delete a folder",
-  description: 'Permanently delete a folder by id. The folder must be EMPTY first \u2014 it must contain no documents, no records, and no sub-folders \u2014 and a non-empty folder is refused, which is the most common way this call fails. Use record_query with this folderId, and document_query, to see what is in it. Clearing it differs by content type: a document can be moved out (document_update with a different folderId) or deleted. A RECORD can also be re-filed into another folder \u2014 the API supports it \u2014 but THIS SERVER does not expose that yet: record_update has no folderId argument, so from here your only option is record_delete (needs records:d). Do NOT read that as "the record cannot be moved" and delete partner data on that basis: if the record should be kept, move it with the Vectros API/SDK directly rather than deleting it here. A sub-folder cannot be re-parented at all, so nested folders have to be emptied and deleted innermost-first. Note the emptiness check counts everything in the folder, INCLUDING items your credential cannot read \u2014 so a refusal you cannot account for from what you can list is expected behaviour, not a bug, and retrying will not clear it. Requires the key to allow folders:d \u2014 a key without it gets a permission error. Protected folders (e.g. a context root) cannot be deleted at all, however empty.',
+  description: 'Permanently delete a folder by id. The folder must be EMPTY first \u2014 it must contain no documents, no records, and no sub-folders \u2014 and a non-empty folder is refused, which is the most common way this call fails. Use record_query with this folderId, and document_query, to see what is in it. Clearing it differs by content type: a document can be moved out (document_update with a different folderId) or deleted. A RECORD can also be re-filed into another folder \u2014 the API supports it \u2014 but THIS SERVER does not expose that yet: record_update has no folderId argument, so from here your only option is record_delete (needs records:d). Do NOT read that as "the record cannot be moved" and delete the record on that basis: if the record should be kept, tell the user to move it with the Vectros API/SDK directly rather than deleting it here. A sub-folder cannot be re-parented at all, so nested folders have to be emptied and deleted innermost-first. Note the emptiness check counts everything in the folder, INCLUDING items your credential cannot read \u2014 so a refusal you cannot account for from what you can list is expected behaviour, not a bug, and retrying will not clear it. Requires the key to allow folders:d \u2014 a key without it gets a permission error. Protected folders (e.g. a context root) cannot be deleted at all, however empty.',
   inputSchema: inputSchema19,
   // Deletes. Idempotent in the standard REST sense: the end state ("this id no longer
   // resolves") is the same whether this is the first delete or a repeat of one.