@vorim/mcp-server 1.1.6 → 1.1.8

package/build/index.js

@@ -35,19 +35,32 @@ import { z } from "zod";
 //      kills exactly one installation.
 const API_KEY = process.env.VORIM_API_KEY || "";
 const BASE_URL = (process.env.VORIM_BASE_URL || "https://api.vorim.ai").replace(/\/$/, "");
+// The 7 canonical permission scopes (must match the API's VALID_SCOPES).
+const SCOPE_ENUM = z.enum([
+    "agent:read", "agent:write", "agent:execute", "agent:transact",
+    "agent:communicate", "agent:delegate", "agent:elevate",
+]);
 if (!API_KEY) {
     console.error("Error: VORIM_API_KEY environment variable is required");
     process.exit(1);
 }
 // ─── HTTP Client ──────────────────────────────────────────────────────────
-// Read the package version once so the User-Agent string and the MCP
-// server's advertised version stay in sync with package.json. The
-// hardcoded fallback is the last-known version — operators see a
-// loud-fail if it ever drifts in CI because `npm test` re-reads
-// package.json and compares.
+// Read the package version once so the User-Agent string and the
+// MCP server's advertised version stay in sync with package.json.
+//
+// Caveats:
+//   1. Bundlers (esbuild / webpack) that inline the source can break
+//      the readFileSync path because import.meta.url no longer points
+//      at the npm install layout. The fallback constant below is the
+//      last-known version and MUST be bumped in lockstep with
+//      package.json — there is NO CI assertion enforcing this today.
+//   2. If readFileSync succeeds but JSON.parse fails (corrupt file),
+//      we log a warning so operators see the silent drift rather
+//      than discovering it via a User-Agent grep weeks later.
 import { readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
+const MCP_VERSION_FALLBACK = "1.1.8";
 function readMcpVersion() {
     try {
         const here = dirname(fileURLToPath(import.meta.url));
@@ -55,9 +68,16 @@ function readMcpVersion() {
         const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
         if (typeof pkg.version === "string")
             return pkg.version;
+        // eslint-disable-next-line no-console
+        console.warn(`[vorim-mcp-server] package.json missing version field — using fallback ${MCP_VERSION_FALLBACK}`);
+    }
+    catch (err) {
+        // eslint-disable-next-line no-console
+        console.warn(`[vorim-mcp-server] could not read package.json (${err.message ?? err}) — ` +
+            `using fallback ${MCP_VERSION_FALLBACK}. If this is a bundled build, bump ` +
+            `MCP_VERSION_FALLBACK in lockstep with the published package.`);
     }
-    catch { /* fall through */ }
-    return "1.1.6"; // hardcoded fallback; bump alongside package.json
+    return MCP_VERSION_FALLBACK;
 }
 const MCP_VERSION = readMcpVersion();
 /**
@@ -117,6 +137,24 @@ async function vorimRequest(method, path, body) {
 async function vorimGet(path) {
     return vorimRequest("GET", path);
 }
+// List endpoints return { data, meta } and vorimRequest unwraps to data,
+// dropping pagination meta. For list tools, fetch the full envelope so the
+// caller can paginate (page/total/total_pages).
+async function vorimGetEnvelope(path) {
+    const response = await fetch(`${BASE_URL}/v1${path}`, {
+        headers: {
+            "Authorization": `Bearer ${API_KEY}`,
+            "User-Agent": `vorim-mcp-server/${MCP_VERSION}`,
+        },
+    });
+    if (!response.ok) {
+        const j = await response.json().catch(() => ({}));
+        const err = j.error;
+        throw new Error(err?.message || `HTTP ${response.status}`);
+    }
+    const json = await response.json();
+    return { data: json.data, meta: json.meta };
+}
 async function vorimPost(path, body) {
     return vorimRequest("POST", path, body);
 }
@@ -193,17 +231,19 @@ server.registerTool("vorim_list_agents", {
     if (status)
         params.set("status", status);
     const qs = params.toString();
-    const result = await vorimGet(`/agents${qs ? "?" + qs : ""}`);
-    return text(result);
+    const { data, meta } = await vorimGetEnvelope(`/agents${qs ? "?" + qs : ""}`);
+    return text({ agents: data, meta });
 });
 server.registerTool("vorim_update_agent", {
-    description: "Update an agent's metadata (name, description, status, capabilities).",
+    description: "Update an agent's metadata (name, description, status).",
     inputSchema: {
         agent_id: z.string().describe("The agent identifier"),
         name: z.string().optional().describe("New name"),
         description: z.string().optional().describe("New description"),
-        status: z.string().optional().describe("New status: active, suspended"),
-        capabilities: z.array(z.string()).optional().describe("New capabilities list"),
+        status: z.enum(["pending", "active", "suspended", "revoked", "expired"]).optional()
+            .describe("New status"),
+        // capabilities are set at registration only; the update API does not
+        // change them, so the field is intentionally omitted.
     },
 }, async ({ agent_id, ...updates }) => {
     const body = Object.fromEntries(Object.entries(updates).filter(([, v]) => v !== undefined));
@@ -225,7 +265,7 @@ server.registerTool("vorim_check_permission", {
     description: "Check if an agent has a specific permission scope. Returns allowed (boolean), reason if denied, and remaining quota. Sub-5ms via Redis cache.",
     inputSchema: {
         agent_id: z.string().describe("The agent identifier"),
-        scope: z.string().describe("Permission scope to check (e.g. agent:read, agent:execute)"),
+        scope: SCOPE_ENUM.describe("Permission scope to check"),
     },
     annotations: { readOnlyHint: true },
 }, async ({ agent_id, scope }) => {
@@ -236,7 +276,7 @@ server.registerTool("vorim_grant_permission", {
     description: "Grant a permission scope to an agent. Optionally set expiry and rate limits.",
     inputSchema: {
         agent_id: z.string().describe("The agent identifier"),
-        scope: z.string().describe("Permission scope to grant"),
+        scope: SCOPE_ENUM.describe("Permission scope to grant"),
         valid_until: z.string().optional().describe("Expiry timestamp (ISO 8601)"),
         rate_limit_max: z.number().optional().describe("Maximum uses per window"),
         rate_limit_window: z.string().optional().describe("Rate limit window: 1m, 1h, or 1d"),
@@ -265,7 +305,7 @@ server.registerTool("vorim_revoke_permission", {
     description: "Revoke a specific permission scope from an agent.",
     inputSchema: {
         agent_id: z.string().describe("The agent identifier"),
-        scope: z.string().describe("Permission scope to revoke"),
+        scope: SCOPE_ENUM.describe("Permission scope to revoke"),
     },
     annotations: { destructiveHint: true, idempotentHint: true, readOnlyHint: false },
 }, async ({ agent_id, scope }) => {
@@ -277,11 +317,13 @@ server.registerTool("vorim_emit_event", {
     description: "Log an audit event for an agent action. Every agent action should be logged for compliance and traceability. NOTE: events emitted via the MCP server are sent unsigned because the MCP server does not hold the agent's private key. For tamper-evident audit trails sign client-side via @vorim/sdk before emit.",
     inputSchema: {
         agent_id: z.string().describe("The agent that performed the action"),
-        event_type: z.string().describe("Event category: tool_call, api_request, message_sent, permission_change, status_change"),
+        event_type: z.enum(["tool_call", "api_request", "message_sent", "permission_change", "status_change", "key_rotation", "login", "export"])
+            .describe("Event category"),
         action: z.string().describe("What the agent did (e.g. 'search_documents', 'send_email')"),
-        result: z.string().describe("Outcome: success, denied, or error"),
+        result: z.enum(["success", "denied", "error"]).describe("Outcome"),
         resource: z.string().optional().describe("Target resource identifier"),
-        permission: z.string().optional().describe("Permission scope used"),
+        permission: z.enum(["agent:read", "agent:write", "agent:execute", "agent:transact", "agent:communicate", "agent:delegate", "agent:elevate"])
+            .optional().describe("Permission scope used"),
         latency_ms: z.number().optional().describe("Execution time in milliseconds"),
         error_code: z.string().optional().describe("Error code if result is 'error'"),
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vorim/mcp-server",
-  "version": "1.1.6",
+  "version": "1.1.8",
   "mcpName": "io.github.Kzino/vorim-mcp-server",
   "description": "MCP server for Vorim AI — AI agent identity, permissions, and audit trails",
   "type": "module",