@velaro/mcp-server 0.6.58 → 0.6.60

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@velaro/mcp-server",
-  "version": "0.6.58",
+  "version": "0.6.60",
   "description": "Velaro MCP server — connect Claude and other AI agents directly to your Velaro account: KB, workflows, bots, conversations, contacts, routing, and more.",
   "type": "module",
   "bin": {

package/server.js

@@ -245,19 +245,73 @@ function mcpFindUnresolved(value) {
     .map(([k]) => k);
 }
 
+// The hosted gateway requires an initialized session (Mcp-Session-Id + MCP-Protocol-Version) on
+// every call after "initialize". Cache one per process and re-initialize when it expires (404).
+let gatewaySession = null;
+async function gatewayInit() {
+  const res = await fetch(`${API_BASE}/mcp`, {
+    method: 'POST',
+    headers: { Authorization: authHeader(), 'Content-Type': 'application/json' },
+    body: JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'initialize', params: { protocolVersion: '2025-11-25', capabilities: {}, clientInfo: { name: 'velaro-mcp-server', version: '1' } } }),
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => '');
+    throw new Error(`Velaro MCP gateway initialize -> ${res.status}: ${text.slice(0, 300)}`);
+  }
+  const sid = res.headers.get('mcp-session-id');
+  if (!sid) throw new Error('Velaro MCP gateway initialize returned no Mcp-Session-Id');
+  gatewaySession = { sid, version: res.headers.get('mcp-protocol-version') || '2025-11-25' };
+  return gatewaySession;
+}
+
+// Tools served by velaro-messaging's admin-tools gateway (McpAdminGatewayController, POST /mcp/v1/admin-tools/call,
+// no session). The admin /mcp gateway only serves kb_* tools, so these used to fail there.
+const MESSAGING_ADMIN_TOOLS = new Set([
+  'workflow_create', 'workflow_list', 'workflow_get', 'workflow_toggle',
+  'bot_create', 'bot_list', 'bot_get', 'bot_update_prompt', 'bot_set_knowledge',
+  'ai_config_attach_index', 'call_pop_settings_get', 'call_pop_settings_set',
+  'agent_list', 'team_list', 'conversation_list', 'conversation_get', 'conversation_search',
+  'contact_search', 'contact_get', 'routing_list', 'routing_get', 'site_info',
+  'ms_bookings_cancel_appointment', 'ms_bookings_check_availability_range', 'ms_bookings_reschedule_appointment',
+  'outlook_calendar_cancel', 'outlook_calendar_get_available_range',
+]);
+
+async function messagingAdminRpc(toolName, args) {
+  if (!MESSAGING_API) throw new Error('VELARO_MESSAGING_API is not configured.');
+  const res = await fetch(`${MESSAGING_API}/mcp/v1/admin-tools/call`, {
+    method: 'POST',
+    headers: { Authorization: authHeader(), 'Content-Type': 'application/json' },
+    body: JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/call', params: { name: toolName, arguments: args ?? {} } }),
+    signal: AbortSignal.timeout(30000),
+  });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok || data.error) {
+    throw new Error(`Velaro admin-tools ${toolName} -> ${res.status}: ${data.error?.message || JSON.stringify(data).slice(0, 300)}`);
+  }
+  const content = data.result?.content?.[0]?.text;
+  if (content === undefined) throw new Error('Empty response from admin-tools gateway');
+  return content;
+}
+
 // Call the hosted MCP gateway (JSON-RPC) for tools that are dispatched server-side.
 async function rpc(toolName, args) {
+  if (MESSAGING_ADMIN_TOOLS.has(toolName)) return messagingAdminRpc(toolName, args);
   const body = {
     jsonrpc: '2.0',
     id: 1,
     method: 'tools/call',
     params: { name: toolName, arguments: args ?? {} },
   };
-  const res = await fetch(`${API_BASE}/mcp`, {
-    method: 'POST',
-    headers: { Authorization: authHeader(), 'Content-Type': 'application/json' },
-    body: JSON.stringify(body),
-  });
+  const send = async () => {
+    const s = gatewaySession || await gatewayInit();
+    return fetch(`${API_BASE}/mcp`, {
+      method: 'POST',
+      headers: { Authorization: authHeader(), 'Content-Type': 'application/json', 'Mcp-Session-Id': s.sid, 'MCP-Protocol-Version': s.version },
+      body: JSON.stringify(body),
+    });
+  };
+  let res = await send();
+  if (res.status === 404) { gatewaySession = null; res = await send(); }
   if (!res.ok) {
     const text = await res.text().catch(() => '');
     throw new Error(`Velaro MCP gateway ${toolName} -> ${res.status}: ${text.slice(0, 300)}`);
@@ -581,6 +635,12 @@ const TOOLS = [
     },
   },
 
+  {
+    name: 'scraper_verify_token',
+    description: "Show the calling site's web-scraper verification header (name + value), the scraper IP, and ready-to-send instructions for allowlisting Velaro's crawler with the customer's web host/WAF. Wraps GET ScraperJobs/VerifyToken. Site comes from auth context, never a parameter.",
+    inputSchema: { type: 'object', properties: {} },
+  },
+
   // ── Startup migration diagnostics (AdminStartupDiagnostics canary table) ──
   {
     name: 'admin_startup_diagnostics',
@@ -2962,6 +3022,21 @@ For multiSelect dynamic options: the variable named in dynamicOptionsVariable mu
       required: [],
     },
   },
+  {
+    name: 'ai_spend_report',
+    description: 'SuperAdmin AI spend report: logged AI cost for prod and/or staging over a window, by site, model, key source (platform/copilot/byok) and site x feature, with cache-read ratio, QA share, top movers vs the previous period and anomalies. Also records/lists provider reconciliation (console total vs logged). Breaker trips are not in AiCostLogs so are reported as not available.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        env:  { type: 'string', enum: ['both', 'prod', 'staging'], description: 'Environment. Default both.' },
+        days: { type: 'number', description: 'Trailing window in days. Default 7, max 92.' },
+        reconcile_entered_usd: { type: 'number', description: 'If set, records a reconciliation for the window with this provider console total in USD instead of only reading the report.' },
+        provider: { type: 'string', description: 'Provider for reconciliation. Default Anthropic.' },
+        key_bucket: { type: 'string', description: 'Per-key bucket for reconciliation: platform, copilot or byok. Omit for provider total.' },
+      },
+      required: [],
+    },
+  },
   {
     name: 'signalr_diagnostics',
     description: 'Check health, connection counts, hub stats, and recent errors for Velaro\'s Azure SignalR Service instances. Covers both the infra-prod instance (velaro-eastus-prd-signalr, Premium P1) and the legacy prod instance (velaro-prod-us). Use this to diagnose "hub down", connection storms, capacity issues, or capacity saturation alerts.',
@@ -4756,6 +4831,11 @@ async function handleTool(name, args) {
       return JSON.stringify(result, null, 2);
     }
 
+    case 'scraper_verify_token': {
+      const result = await api('GET', 'ScraperJobs/VerifyToken');
+      return JSON.stringify(result, null, 2);
+    }
+
     case 'site_scraper_usage': {
       const result = await api('GET', `ScraperJobs/StaffUsage/${encodeURIComponent(args.siteId)}`);
       return JSON.stringify(result, null, 2);
@@ -7352,6 +7432,22 @@ async function handleTool(name, args) {
     case 'velaro_diagnostic_start':
       return DIAGNOSTIC_RUNBOOK;
 
+    case 'ai_spend_report': {
+      const days = Math.min(Math.max(Number(args.days) || 7, 1), 92);
+      const to = new Date();
+      const from = new Date(to.getTime() - days * 86400000);
+      const env = args.env || 'both';
+      if (args.reconcile_entered_usd !== undefined && args.reconcile_entered_usd !== null) {
+        const row = await api('POST', '/SuperAdmin/AiSpend/Reconciliations', {
+          periodStartUtc: from.toISOString(), periodEndUtc: to.toISOString(), environment: env,
+          provider: args.provider || 'Anthropic', keyLabel: args.key_bucket || null, enteredUsd: Number(args.reconcile_entered_usd),
+        });
+        return JSON.stringify(row, null, 2);
+      }
+      const data = await api('GET', `/SuperAdmin/AiSpend/Report?env=${env}&from=${encodeURIComponent(from.toISOString())}&to=${encodeURIComponent(to.toISOString())}`);
+      return JSON.stringify(data, null, 2);
+    }
+
     case 'signalr_diagnostics': {
       // Parse a SignalR connection string into { endpoint, accessKey }
       function parseSignalRConn(conn) {
@@ -8207,7 +8303,7 @@ async function handleTool(name, args) {
     }
 
     case 'billing_plan_status': {
-      const s = await api('GET', '/BillingPayment/plan-status');
+      const s = await api('GET', '/BillingPayment/plan-status', undefined, MESSAGING_API);
       const lines = [`Site ${s.siteId} — Subscription Status`];
       if (s.subscription) {
         lines.push(`Seats: ${s.subscription.maxLicensedSeats}  |  Conv/mo: ${s.subscription.maxConversationsPerMonth || '∞'}  |  Self-serve: ${s.subscription.enableSelfServeSeats ? 'YES' : 'no'}`);