@xano/xanoscript-language-server 12.18.0 → 12.20.0

package/lexer/mcp.js

@@ -3,7 +3,8 @@ import { createTokenByName } from "./utils.js";
 
 // MCP 2026-07-28 authoring keywords: the `prompt` and `resource` object kinds,
 // the tool/prompt/resource metadata keys, and the `mcp.elicit` / `mcp.progress`
-// statements. Grounded against cloud-client's schema DSL
+// statements, plus the per-server `oauth` block and the `mcp.oauth.complete` /
+// `mcp.oauth.request` / `mcp.oauth.revoke` statements. Grounded against cloud-client's schema DSL
 // (`script/kind/schema/core/{prompt,resource,tool,mcp_server}.yaml` and
 // `script/kind/schema/statement/mcp.{elicit,progress}.yaml`).
 //
@@ -71,6 +72,24 @@ export const ProgressToken = createTokenByName("progress", {
   categories: [Identifier],
 });
 
+// "oauth" (the mcp_server `oauth` block and the `mcp.oauth.*` statements)
+export const OauthToken = createTokenByName("oauth", {
+  longer_alt: Identifier,
+  categories: [Identifier],
+});
+
+// "complete" (mcp.oauth.complete)
+export const CompleteToken = createTokenByName("complete", {
+  longer_alt: Identifier,
+  categories: [Identifier],
+});
+
+// "revoke" (mcp.oauth.revoke)
+export const RevokeToken = createTokenByName("revoke", {
+  longer_alt: Identifier,
+  categories: [Identifier],
+});
+
 export const McpObjectTokens = [
   PromptsToken,
   PromptToken,
@@ -82,6 +101,9 @@ export const McpObjectTokens = [
   MimeTypeToken,
   ElicitToken,
   ProgressToken,
+  OauthToken,
+  CompleteToken,
+  RevokeToken,
 ];
 
 /**
@@ -99,9 +121,12 @@ export function mapTokenToType(token) {
     case IconsToken.name:
     case UriToken.name:
     case MimeTypeToken.name:
+    case OauthToken.name:
       return "variable";
     case ElicitToken.name:
     case ProgressToken.name:
+    case CompleteToken.name:
+    case RevokeToken.name:
       return "function";
     default:
       return null;

package/onHover/functions.md

@@ -446,6 +446,8 @@ api.call "account/{account_id}" verb=POST {
 
 Calls an internal Xano API endpoint from within a `workflow_test` or `test` clause. This allows you to invoke internal APIs as part of your end-to-end workflow tests or unit tests within queries, functions, and tasks.
 
+To call the endpoint as a logged-in user, pass a token with `auth = {token: "...", ignore_expiration: true}` (a literal token) or an `Authorization` header (`headers = ["Authorization: Bearer " ~ $token]`).
+
 # trigger.call
 
 ```xs
@@ -512,6 +514,49 @@ Sends an MCP `notifications/progress` update to the client while a tool, prompt
 - `total`: optional. The expected final value.
 - `message`: optional. A short status line.
 
+# mcp.oauth.complete
+
+```xs
+mcp.oauth.complete {
+  request = $input.mcp_request
+  decision = $input.decision
+} as $continue_url
+```
+
+Finishes a hosted-mode MCP sign-in from your login endpoint and returns the single-use URL your login page sends the browser to. Your login page is the consent screen: it shows the request (see `mcp.oauth.request`) and passes the user's answer here.
+
+- `request`: required. The `mcp_request` value your login page received.
+- `decision`: required. `approve` signs the user in; `deny` refuses the sign-in.
+- `unsafe_user_id`: optional and DANGEROUS. Signs in that auth-table row directly, skipping the `$auth` and session-age checks. Use it only in a login flow whose own stack has already proven who the user is.
+
+By default the user is the endpoint's `$auth`: a row of the server's auth table whose session token was issued moments ago, so mint a fresh token at login.
+
+# mcp.oauth.request
+
+```xs
+mcp.oauth.request {
+  request = $input.mcp_request
+} as $sign_in
+```
+
+Returns the verified details of a pending hosted-mode MCP sign-in request (`client_name`, `client_logo`, `callback_host`, `client_verified`, `server_name`) for the consent screen on your login page. It reads the request without consuming it.
+
+- `request`: required. The `mcp_request` value your login page received.
+
+# mcp.oauth.revoke
+
+```xs
+mcp.oauth.revoke {
+  mcp_server = "my_server"
+  user_id = $input.user_id
+} as $revoked
+```
+
+Ends hosted-mode MCP sign-ins on an MCP server of this workspace and branch. Returns `{revoked: <count>}`.
+
+- `mcp_server`: required. The MCP server's name.
+- Then exactly one of `user_id` (every grant of that auth-table row), `grant_id` (one grant) or `all = true` (every grant of the server).
+
 # api.lambda
 
 ```xs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xano/xanoscript-language-server",
-  "version": "12.18.0",
+  "version": "12.20.0",
   "description": "Language Server Protocol implementation for XanoScript",
   "type": "module",
   "main": "server.js",

package/parser/functions/api/apiCallFn.js

@@ -56,6 +56,10 @@ export function apiCallFn($) {
         fnToken,
         {
           api_group: "[string]",
+          // The endpoint's credential, as the server's transform reads it:
+          // a literal token (the parser refuses a computed one; use an
+          // Authorization header for that), and ignore_expiration.
+          "auth?": { token: "[string]", "ignore_expiration?": "[boolean]" },
           "description?": "[string]",
           "disabled?": "[boolean]",
           "headers?": "[expression]",

package/parser/functions/mcp/mcpOauthFn.js

@@ -0,0 +1,140 @@
+import { RequestToken } from "../../../lexer/api.js";
+import { RCurly } from "../../../lexer/control.js";
+import { StringLiteral } from "../../../lexer/literal.js";
+import { CompleteToken, OauthToken, RevokeToken } from "../../../lexer/mcp.js";
+import { DotToken, NewlineToken } from "../../../lexer/tokens.js";
+import { getVarName } from "../../generic/utils.js";
+
+// The values cloud-client's mvp:mcp_oauth_complete accepts for `decision`.
+const DECISIONS = ["approve", "deny"];
+
+/**
+ * `decision` takes any expression (usually `$input.decision`), but a plain
+ * string literal is checked against the enum here so a typo is caught in the
+ * editor rather than refused at run time.
+ * @param {import('../../base_parser.js').XanoBaseParser} $
+ * @param {import('chevrotain').IToken} identifier
+ */
+function decisionValue($, identifier) {
+  const first = $.LA(1);
+  const next = $.LA(2);
+  if (
+    first.tokenType === StringLiteral &&
+    (next.tokenType === NewlineToken || next.tokenType === RCurly)
+  ) {
+    const value = getVarName(first);
+    if (!DECISIONS.includes(value)) {
+      $.addInvalidValueError(
+        first,
+        `Invalid value "${value}". Must be one of: ${DECISIONS.map(
+          (v) => `"${v}"`
+        ).join(", ")}`
+      );
+    }
+  }
+  $.SUBRULE5($.expressionFn, { ARGS: [identifier, {}] });
+}
+
+// The `mcp.oauth.*` login hand-off statements (cloud-client
+// mvp:mcp_oauth_{complete,request,revoke}, kind schemas
+// statement/mcp.oauth.{complete,request,revoke}.yaml). Each takes an optional
+// `as $var` binding.
+
+/**
+ * mcp.oauth.complete, mcp.oauth.request, mcp.oauth.revoke
+ * (the leading "mcp." is consumed by mcpFn)
+ * @param {import('../../base_parser.js').XanoBaseParser} $
+ */
+export function mcpOauthFn($) {
+  return () => {
+    $.sectionStack.push("mcpOauthFn");
+    $.CONSUME(OauthToken); // "oauth"
+    $.CONSUME(DotToken); // "."
+    $.OR([
+      { ALT: () => $.SUBRULE($.mcpOauthCompleteFn) }, // "complete"
+      { ALT: () => $.SUBRULE($.mcpOauthRequestFn) }, // "request"
+      { ALT: () => $.SUBRULE($.mcpOauthRevokeFn) }, // "revoke"
+    ]);
+    $.sectionStack.pop();
+  };
+}
+
+// mcp.oauth.complete {
+//   request = $input.mcp_request     // required: the opaque request handle
+//   decision = "approve"             // required: approve | deny
+//   unsafe_user_id = $user.id        // optional: sign in a row without $auth
+// } as $continue_url
+/**
+ * @param {import('../../base_parser.js').XanoBaseParser} $
+ */
+export function mcpOauthCompleteFn($) {
+  const requiredAttrs = ["request", "decision"];
+  const optionalAttrs = ["unsafe_user_id", "description", "disabled", "mock"];
+
+  return () => {
+    $.sectionStack.push("mcpOauthCompleteFn");
+    const fnToken = $.CONSUME(CompleteToken); // "complete"
+    $.SUBRULE($.functionAttrReq, {
+      ARGS: [
+        fnToken,
+        requiredAttrs,
+        optionalAttrs,
+        { types: { decision: decisionValue } },
+      ],
+    });
+    $.SUBRULE($.asVariable, { ARGS: [fnToken] });
+    $.sectionStack.pop();
+  };
+}
+
+// mcp.oauth.request {
+//   request = $input.mcp_request
+// } as $sign_in
+/**
+ * @param {import('../../base_parser.js').XanoBaseParser} $
+ */
+export function mcpOauthRequestFn($) {
+  const requiredAttrs = ["request"];
+  const optionalAttrs = ["description", "disabled", "mock"];
+
+  return () => {
+    $.sectionStack.push("mcpOauthRequestFn");
+    const fnToken = $.CONSUME(RequestToken); // "request"
+    $.SUBRULE($.functionAttrReq, {
+      ARGS: [fnToken, requiredAttrs, optionalAttrs],
+    });
+    $.SUBRULE($.asVariable, { ARGS: [fnToken] });
+    $.sectionStack.pop();
+  };
+}
+
+// mcp.oauth.revoke {
+//   mcp_server = "example_server"
+//   user_id = $input.user_id         // exactly ONE of user_id, grant_id or
+//   grant_id = $input.grant_id       // all = true must be in effect; that is
+//   all = true                       // checked at run time on the values
+// } as $revoked
+/**
+ * @param {import('../../base_parser.js').XanoBaseParser} $
+ */
+export function mcpOauthRevokeFn($) {
+  const requiredAttrs = ["mcp_server"];
+  const optionalAttrs = [
+    "user_id",
+    "grant_id",
+    "all",
+    "description",
+    "disabled",
+    "mock",
+  ];
+
+  return () => {
+    $.sectionStack.push("mcpOauthRevokeFn");
+    const fnToken = $.CONSUME(RevokeToken); // "revoke"
+    $.SUBRULE($.functionAttrReq, {
+      ARGS: [fnToken, requiredAttrs, optionalAttrs],
+    });
+    $.SUBRULE($.asVariable, { ARGS: [fnToken] });
+    $.sectionStack.pop();
+  };
+}

package/parser/functions/mcp/register.js

@@ -1,4 +1,10 @@
 import { mcpElicitFn } from "./mcpElicitFn.js";
+import {
+  mcpOauthCompleteFn,
+  mcpOauthFn,
+  mcpOauthRequestFn,
+  mcpOauthRevokeFn,
+} from "./mcpOauthFn.js";
 import { mcpProgressFn } from "./mcpProgressFn.js";
 
 /**
@@ -8,4 +14,8 @@ import { mcpProgressFn } from "./mcpProgressFn.js";
 export const register = ($) => {
   $.mcpElicitFn = $.RULE("mcpElicitFn", mcpElicitFn($));
   $.mcpProgressFn = $.RULE("mcpProgressFn", mcpProgressFn($));
+  $.mcpOauthCompleteFn = $.RULE("mcpOauthCompleteFn", mcpOauthCompleteFn($));
+  $.mcpOauthRequestFn = $.RULE("mcpOauthRequestFn", mcpOauthRequestFn($));
+  $.mcpOauthRevokeFn = $.RULE("mcpOauthRevokeFn", mcpOauthRevokeFn($));
+  $.mcpOauthFn = $.RULE("mcpOauthFn", mcpOauthFn($));
 };

package/parser/functions/mcpFn.js

@@ -2,7 +2,7 @@ import { McpToken } from "../../lexer/ai.js";
 import { DotToken } from "../../lexer/tokens.js";
 
 /**
- * mcp.elicit, mcp.progress
+ * mcp.elicit, mcp.progress, mcp.oauth.{complete,request,revoke}
  * @param {import('../base_parser.js').XanoBaseParser} $
  */
 export function mcpFn($) {
@@ -13,6 +13,7 @@ export function mcpFn($) {
     $.OR([
       { ALT: () => $.SUBRULE($.mcpElicitFn) }, // "mcp.elicit"
       { ALT: () => $.SUBRULE($.mcpProgressFn) }, // "mcp.progress"
+      { ALT: () => $.SUBRULE($.mcpOauthFn) }, // "mcp.oauth.*"
     ]);
     $.sectionStack.pop();
   };

package/parser/mcp_server_parser.js

@@ -1,6 +1,6 @@
 import { EqualToken, LCurly, RCurly } from "../lexer/control.js";
 import { StringLiteral } from "../lexer/literal.js";
-import { PromptsToken } from "../lexer/mcp.js";
+import { OauthToken, PromptsToken } from "../lexer/mcp.js";
 import {
   ActiveToken,
   InstructionsToken,
@@ -19,6 +19,7 @@ export function mcpServerDeclaration($) {
     let hasDocs = false;
     let hasHistory = false;
     let hasInstructions = false;
+    let hasOauth = false;
     let hasPrompts = false;
     let hasResources = false;
     let hasTags = false;
@@ -96,6 +97,52 @@ export function mcpServerDeclaration($) {
             });
           },
         },
+        {
+          // Per-server OAuth (cloud-client mcp_server.yaml `oauth`; values are
+          // validated server-side by helper/mvp/mcpoauth/OauthConfig.php).
+          // An assignment block like a channel's `publish`. mcp_server ONLY:
+          // deliberately absent from agent_parser.js. Mode-specific rules
+          // (hosted needs login_url, external needs issuer, ...) stay
+          // server-side; only the key set and the enums are checked here.
+          // There is no consent, branding or trusted_clients key: consent is
+          // the customer's own login page, which calls mcp.oauth.complete
+          // with a decision.
+          GATE: () => !hasOauth,
+          ALT: () => {
+            hasOauth = true;
+
+            const subParent = $.CONSUME(OauthToken); // "oauth"
+            $.CONSUME5(EqualToken); // "="
+            $.SUBRULE($.schemaParseObjectFn, {
+              ARGS: [
+                subParent,
+                {
+                  "mode?": ["hosted", "external"],
+                  "auth_table?": "[string]",
+                  // hosted; may be "${env.NAME}"
+                  "login_url?": "[string]",
+                  // external; may be "${env.NAME}"
+                  "issuer?": "[string]",
+                  "audience?": ["[string]"],
+                  "audience_ack?": "[boolean]",
+                  "claim?": "[string]",
+                  "claim_ack?": "[boolean]",
+                  "column?": "[string]",
+                  "preset?": [
+                    "auth0",
+                    "clerk",
+                    "workos",
+                    "entra",
+                    "okta",
+                    "cognito",
+                    "generic",
+                  ],
+                  "allowed_client_ids?": ["[string]"],
+                },
+              ],
+            });
+          },
+        },
         {
           // First-class prompts attached to the server (MCP 2026-07-28).
           // mcp_server ONLY: deliberately absent from agent_parser.js.

package/parser/policy/catalogue.js

@@ -2,7 +2,7 @@
  * The policy check catalogue the language server validates policies against.
  *
  * The platform owns the catalogue: `GET workspace/{id}/policy/check` (and `xano policy
- * catalogue -o json`) answers `{items: [check...], goals, document}`: each check with its id,
+ * catalogue -o json`) answers `{items: [check...], templates, document}`: each check with its id,
  * label, description and param schemas, and `document`, the policy file's own fields (their types,
  * value sets and defaults, retired fields, reserved blocks, the key pattern). Nothing here writes a
  * check or a field down by hand. The registry starts EMPTY, and an empty registry means the