@xen-orchestra/rest-api 0.31.1 → 0.32.0

package/dist/acl-privileges/acl-privilege.controller.mjs

@@ -7,7 +7,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Body, Delete, Example, Get, Middlewares, Patch, Path, Post, Query, Request, Response, Route, Security, SuccessResponse, Tags, } from 'tsoa';
+import { Body, Delete, Example, Extension, Get, Middlewares, Patch, Path, Post, Query, Request, Response, Route, Security, SuccessResponse, Tags, } from 'tsoa';
 import { provide } from 'inversify-binding-decorators';
 import { json } from 'express';
 import { acl, actionsFromBody } from '../middlewares/acl.middleware.mjs';
@@ -98,6 +98,7 @@ let AclPrivilegeController = class AclPrivilegeController extends XoController {
 __decorate([
     Example(aclPrivilegeIds),
     Example(partialAclPrivileges),
+    Extension('x-mcp-exposure', 'allow'),
     Get(''),
     Security('*', ['acl']),
     __param(0, Request()),
@@ -108,6 +109,7 @@ __decorate([
 ], AclPrivilegeController.prototype, "getAclV2Privileges", null);
 __decorate([
     Example(entityId),
+    Extension('x-mcp-exposure', 'confirm'),
     Post(''),
     Middlewares([json(), acl({ resource: 'acl-privilege', action: 'create', object: ({ req }) => req.body })]),
     SuccessResponse(createdResp.status, createdResp.description),
@@ -118,6 +120,7 @@ __decorate([
 ], AclPrivilegeController.prototype, "createAclV2Privilege", null);
 __decorate([
     Example(aclPrivilege),
+    Extension('x-mcp-exposure', 'allow'),
     Get('{id}'),
     Middlewares(acl({
         resource: 'acl-privilege',
@@ -130,6 +133,7 @@ __decorate([
     __param(0, Path())
 ], AclPrivilegeController.prototype, "getAclV2Privilege", null);
 __decorate([
+    Extension('x-mcp-exposure', 'confirm'),
     Delete('{id}'),
     Middlewares(acl({
         resource: 'acl-privilege',
@@ -143,6 +147,7 @@ __decorate([
     __param(0, Path())
 ], AclPrivilegeController.prototype, "deleteAclV2Privilege", null);
 __decorate([
+    Extension('x-mcp-exposure', 'confirm'),
     Patch('{id}'),
     Middlewares([
         json(),
@@ -165,7 +170,7 @@ AclPrivilegeController = __decorate([
     Security('*'),
     Response(badRequestResp.status, badRequestResp.description),
     Response(unauthorizedResp.status, unauthorizedResp.description),
-    Tags('acls'),
+    Tags('rbacs'),
     provide(AclPrivilegeController),
     __param(0, inject(RestApi))
 ], AclPrivilegeController);

package/dist/acl-roles/acl-role.controller.mjs

@@ -7,7 +7,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Body, Delete, Example, Get, Middlewares, Patch, Path, Post, Put, Query, Request, Response, Route, Security, SuccessResponse, Tags, } from 'tsoa';
+import { Body, Delete, Example, Extension, Get, Middlewares, Patch, Path, Post, Put, Query, Request, Response, Route, Security, SuccessResponse, Tags, } from 'tsoa';
 import { provide } from 'inversify-binding-decorators';
 import { json } from 'express';
 import { acl, actionsFromBody } from '../middlewares/acl.middleware.mjs';
@@ -201,6 +201,7 @@ let AclRoleController = class AclRoleController extends XoController {
 __decorate([
     Example(aclRoleIds),
     Example(partialAclRoles),
+    Extension('x-mcp-exposure', 'allow'),
     Get(''),
     Security('*', ['acl']),
     __param(0, Request()),
@@ -211,6 +212,7 @@ __decorate([
 ], AclRoleController.prototype, "getAclV2Roles", null);
 __decorate([
     Example(entityId),
+    Extension('x-mcp-exposure', 'confirm'),
     Post(''),
     Middlewares([
         json(),
@@ -227,6 +229,7 @@ __decorate([
 ], AclRoleController.prototype, "createAclV2Role", null);
 __decorate([
     Example(aclRole),
+    Extension('x-mcp-exposure', 'allow'),
     Get('{id}'),
     Middlewares(acl({
         resource: 'acl-role',
@@ -239,6 +242,7 @@ __decorate([
     __param(0, Path())
 ], AclRoleController.prototype, "getAclV2Role", null);
 __decorate([
+    Extension('x-mcp-exposure', 'confirm'),
     Delete('{id}'),
     Middlewares(acl({
         resource: 'acl-role',
@@ -252,6 +256,7 @@ __decorate([
     __param(0, Path())
 ], AclRoleController.prototype, "deleteAclV2Role", null);
 __decorate([
+    Extension('x-mcp-exposure', 'confirm'),
     Patch('{id}'),
     Middlewares([
         json(),
@@ -271,6 +276,7 @@ __decorate([
 ], AclRoleController.prototype, "updateAclV2Role", null);
 __decorate([
     Example(taskLocation),
+    Extension('x-mcp-exposure', 'confirm'),
     Post('{id}/actions/copy'),
     Middlewares([
         json(),
@@ -304,6 +310,7 @@ __decorate([
 __decorate([
     Example(aclPrivilegeIds),
     Example(partialAclPrivileges),
+    Extension('x-mcp-exposure', 'allow'),
     Get('{id}/privileges'),
     Security('*', ['acl']),
     Response(notFoundResp.status, notFoundResp.description),
@@ -315,6 +322,7 @@ __decorate([
     __param(5, Query())
 ], AclRoleController.prototype, "getAclV2RolePrivileges", null);
 __decorate([
+    Extension('x-mcp-exposure', 'confirm'),
     Put('{id}/groups/{groupId}'),
     Middlewares(acl({
         resource: 'acl-role',
@@ -330,6 +338,7 @@ __decorate([
     __param(1, Path())
 ], AclRoleController.prototype, "attachAclV2Group", null);
 __decorate([
+    Extension('x-mcp-exposure', 'confirm'),
     Delete('{id}/groups/{groupId}'),
     Middlewares(acl({
         resource: 'acl-role',
@@ -344,6 +353,7 @@ __decorate([
     __param(1, Path())
 ], AclRoleController.prototype, "detachAclV2Group", null);
 __decorate([
+    Extension('x-mcp-exposure', 'confirm'),
     Put('{id}/users/{userId}'),
     Middlewares(acl({
         resource: 'acl-role',
@@ -359,6 +369,7 @@ __decorate([
     __param(1, Path())
 ], AclRoleController.prototype, "attachAclV2User", null);
 __decorate([
+    Extension('x-mcp-exposure', 'confirm'),
     Delete('{id}/users/{userId}'),
     Middlewares(acl({
         resource: 'acl-role',
@@ -377,7 +388,7 @@ AclRoleController = __decorate([
     Security('*'),
     Response(badRequestResp.status, badRequestResp.description),
     Response(unauthorizedResp.status, unauthorizedResp.description),
-    Tags('acls'),
+    Tags('rbacs'),
     provide(AclRoleController),
     __param(0, inject(RestApi))
 ], AclRoleController);

package/dist/alarms/alarm.controller.mjs

@@ -7,7 +7,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Example, Get, Middlewares, Path, Query, Request, Response, Route, Security, Tags } from 'tsoa';
+import { Example, Extension, Get, Middlewares, Path, Query, Request, Response, Route, Security, Tags } from 'tsoa';
 import { inject } from 'inversify';
 import { provide } from 'inversify-binding-decorators';
 import { alarm, alarmIds, partialAlarms } from '../open-api/oa-examples/alarm.oa-example.mjs';
@@ -61,6 +61,7 @@ let AlarmController = class AlarmController extends XapiXoController {
 __decorate([
     Example(alarmIds),
     Example(partialAlarms),
+    Extension('x-mcp-exposure', 'allow'),
     Get(''),
     Security('*', ['acl']),
     __param(0, Request()),
@@ -72,6 +73,7 @@ __decorate([
 ], AlarmController.prototype, "getAlarms", null);
 __decorate([
     Example(alarm),
+    Extension('x-mcp-exposure', 'allow'),
     Get('{id}'),
     Middlewares(acl({
         resource: 'alarm',

package/dist/backup-archives/backup-archive.controller.mjs

@@ -7,7 +7,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Example, Get, Middlewares, Path, Query, Request, Response, Route, Security, Tags } from 'tsoa';
+import { Example, Extension, Get, Middlewares, Path, Query, Request, Response, Route, Security, Tags } from 'tsoa';
 import { inject } from 'inversify';
 import { provide } from 'inversify-binding-decorators';
 import { badRequestResp, forbiddenOperationResp, notFoundResp, unauthorizedResp, } from '../open-api/common/response.common.mjs';
@@ -76,6 +76,7 @@ let BackupArchiveController = class BackupArchiveController extends XoController
 __decorate([
     Example(backupArchiveIds),
     Example(partialBackupArchives),
+    Extension('x-mcp-exposure', 'allow'),
     Get(''),
     Security('*', ['acl']),
     Response(notFoundResp.status, notFoundResp.description),
@@ -89,6 +90,7 @@ __decorate([
 ], BackupArchiveController.prototype, "getBackupArchives", null);
 __decorate([
     Example(backupArchive),
+    Extension('x-mcp-exposure', 'allow'),
     Get('{id}'),
     Middlewares(acl({
         resource: 'backup-archive',

package/dist/backup-jobs/backup-job.controller.mjs

@@ -10,7 +10,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 import { createLogger } from '@xen-orchestra/log';
 import { inject } from 'inversify';
 import { noSuchObject } from 'xo-common/api-errors.js';
-import { Deprecated, Example, Get, Hidden, Middlewares, Path, Query, Request, Response, Route, Security, Tags, } from 'tsoa';
+import { Deprecated, Example, Extension, Get, Hidden, Middlewares, Path, Query, Request, Response, Route, Security, Tags, } from 'tsoa';
 import { provide } from 'inversify-binding-decorators';
 import { acl, autoBindService } from '../middlewares/acl.middleware.mjs';
 import { backupLog, backupLogIds, partialBackupLogs } from '../open-api/oa-examples/backup-log.oa-example.mjs';
@@ -67,6 +67,7 @@ let BackupJobController = class BackupJobController extends XoController {
 __decorate([
     Example(vmBackupJobIds),
     Example(partialVmBackupJobs),
+    Extension('x-mcp-exposure', 'allow'),
     Get(''),
     Security('*', ['acl']),
     __param(0, Request()),
@@ -78,6 +79,7 @@ __decorate([
 ], BackupJobController.prototype, "getBackupJobs", null);
 __decorate([
     Example(vmBackupJob),
+    Extension('x-mcp-exposure', 'allow'),
     Get('{id}'),
     Middlewares(acl({
         resource: 'backup-job',
@@ -236,6 +238,7 @@ __decorate([
     Example(vmBackupJobIds),
     Example(partialVmBackupJobs),
     Deprecated(),
+    Extension('x-mcp-exposure', 'allow'),
     Get('jobs/vm'),
     Security('*', ['acl']),
     Tags('backup-jobs'),
@@ -248,6 +251,7 @@ __decorate([
 ], DeprecatedBackupController.prototype, "getVmBackupJobs", null);
 __decorate([
     Hidden(),
+    Extension('x-mcp-exposure', 'allow'),
     Get('jobs/{id}'),
     Tags('backup-jobs'),
     __param(0, Request()),
@@ -257,6 +261,7 @@ __decorate([
     Example(vmBackupJob),
     Deprecated(),
     Response(notFoundResp.status, notFoundResp.description),
+    Extension('x-mcp-exposure', 'allow'),
     Get('jobs/vm/{id}'),
     Tags('backup-jobs'),
     __param(0, Path())
@@ -265,6 +270,7 @@ __decorate([
     Example(metadataBackupJobIds),
     Example(partialMetadataBackupJobs),
     Deprecated(),
+    Extension('x-mcp-exposure', 'allow'),
     Get('jobs/metadata'),
     Security('*', ['acl']),
     Tags('backup-jobs'),
@@ -279,6 +285,7 @@ __decorate([
     Example(metadataBackupJob),
     Deprecated(),
     Response(notFoundResp.status, notFoundResp.description),
+    Extension('x-mcp-exposure', 'allow'),
     Get('jobs/metadata/{id}'),
     Tags('backup-jobs'),
     __param(0, Path())
@@ -287,6 +294,7 @@ __decorate([
     Example(mirrorBackupJobIds),
     Example(partialMirrorBackupJobs),
     Deprecated(),
+    Extension('x-mcp-exposure', 'allow'),
     Get('jobs/mirror'),
     Security('*', ['acl']),
     Tags('backup-jobs'),
@@ -301,6 +309,7 @@ __decorate([
     Example(mirrorBackupJob),
     Deprecated(),
     Response(notFoundResp.status, notFoundResp.description),
+    Extension('x-mcp-exposure', 'allow'),
     Get('jobs/mirror/{id}'),
     Tags('backup-jobs'),
     __param(0, Path())
@@ -309,6 +318,7 @@ __decorate([
     Example(backupLogIds),
     Example(partialBackupLogs),
     Deprecated(),
+    Extension('x-mcp-exposure', 'allow'),
     Get('logs'),
     Security('*', ['acl']),
     Tags('backup-logs'),
@@ -322,6 +332,7 @@ __decorate([
 __decorate([
     Example(backupLog),
     Deprecated(),
+    Extension('x-mcp-exposure', 'allow'),
     Get('logs/{id}'),
     Tags('backup-logs'),
     __param(0, Path())

package/dist/backup-logs/backup-log.controller.mjs

@@ -7,7 +7,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Example, Get, Middlewares, Path, Query, Request, Response, Route, Security, Tags } from 'tsoa';
+import { Example, Extension, Get, Middlewares, Path, Query, Request, Response, Route, Security, Tags } from 'tsoa';
 import { inject } from 'inversify';
 import { provide } from 'inversify-binding-decorators';
 import { backupLog, backupLogIds, partialBackupLogs } from '../open-api/oa-examples/backup-log.oa-example.mjs';
@@ -56,6 +56,7 @@ let BackupLogController = class BackupLogController extends XoController {
 __decorate([
     Example(backupLogIds),
     Example(partialBackupLogs),
+    Extension('x-mcp-exposure', 'allow'),
     Get(''),
     Security('*', ['acl']),
     __param(0, Request()),
@@ -67,6 +68,7 @@ __decorate([
 ], BackupLogController.prototype, "getBackupLogs", null);
 __decorate([
     Example(backupLog),
+    Extension('x-mcp-exposure', 'allow'),
     Get('{id}'),
     Middlewares(acl({
         resource: 'backup-log',

package/dist/backup-repositories/backup-repositories.controller.mjs

@@ -7,7 +7,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Example, Get, Middlewares, Path, Query, Request, Response, Route, Security, Tags } from 'tsoa';
+import { Example, Extension, Get, Middlewares, Path, Query, Request, Response, Route, Security, Tags } from 'tsoa';
 import { inject } from 'inversify';
 import { provide } from 'inversify-binding-decorators';
 import { acl } from '../middlewares/acl.middleware.mjs';
@@ -53,6 +53,7 @@ let BackupRepositoryController = class BackupRepositoryController extends XoCont
 __decorate([
     Example(backupRepositoryIds),
     Example(partialBackupRepositories),
+    Extension('x-mcp-exposure', 'allow'),
     Get(''),
     Security('*', ['acl']),
     __param(0, Request()),
@@ -64,6 +65,7 @@ __decorate([
 ], BackupRepositoryController.prototype, "getRepositories", null);
 __decorate([
     Example(backupRepository),
+    Extension('x-mcp-exposure', 'allow'),
     Get('{id}'),
     Middlewares(acl({
         resource: 'backup-repository',

package/dist/events/event.controller.mjs

@@ -7,7 +7,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Body, Controller, Example, Delete, Get, Middlewares, Path, Post, Request, Response, Route, Security, SuccessResponse, Tags, } from 'tsoa';
+import { Body, Controller, Delete, Example, Extension, Get, Middlewares, Path, Post, Request, Response, Route, Security, SuccessResponse, Tags, } from 'tsoa';
 import { badRequestResp, createdResp, noContentResp, notFoundResp, unauthorizedResp, } from '../open-api/common/response.common.mjs';
 import { provide } from 'inversify-binding-decorators';
 import { inject } from 'inversify';
@@ -69,6 +69,7 @@ let EventController = class EventController extends Controller {
     }
 };
 __decorate([
+    Extension('x-mcp-exposure', 'allow'),
     Get(''),
     Security('*', ['acl']),
     SuccessResponse(200, 'OK'),
@@ -76,6 +77,7 @@ __decorate([
 ], EventController.prototype, "openSseConnection", null);
 __decorate([
     Example(addSubscription),
+    Extension('x-mcp-exposure', 'confirm'),
     Post('{id}/subscriptions'),
     Security('*', ['acl']),
     Middlewares(json()),
@@ -85,6 +87,7 @@ __decorate([
     __param(1, Body())
 ], EventController.prototype, "addSubscription", null);
 __decorate([
+    Extension('x-mcp-exposure', 'confirm'),
     Delete('{id}/subscriptions/{subscriptionId}'),
     Security('*', ['acl']),
     SuccessResponse(noContentResp.status, noContentResp.description),

package/dist/groups/group.controller.mjs

@@ -7,7 +7,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Body, Delete, Example, Get, Middlewares, Patch, Path, Post, Put, Query, Request, Response, Route, Security, SuccessResponse, Tags, } from 'tsoa';
+import { Body, Delete, Example, Extension, Get, Middlewares, Patch, Path, Post, Put, Query, Request, Response, Route, Security, SuccessResponse, Tags, } from 'tsoa';
 import { inject } from 'inversify';
 import { json } from 'express';
 import { provide } from 'inversify-binding-decorators';
@@ -167,6 +167,7 @@ let GroupController = class GroupController extends XoController {
 __decorate([
     Example(groupIds),
     Example(partialGroups),
+    Extension('x-mcp-exposure', 'allow'),
     Get(''),
     Security('*', ['acl']),
     __param(0, Request()),
@@ -178,6 +179,7 @@ __decorate([
 ], GroupController.prototype, "getGroups", null);
 __decorate([
     Example(group),
+    Extension('x-mcp-exposure', 'allow'),
     Get('{id}'),
     Middlewares(acl({
         resource: 'group',
@@ -190,6 +192,7 @@ __decorate([
     __param(0, Path())
 ], GroupController.prototype, "getGroup", null);
 __decorate([
+    Extension('x-mcp-exposure', 'confirm'),
     Patch('{id}'),
     Middlewares([
         json(),
@@ -209,6 +212,7 @@ __decorate([
 ], GroupController.prototype, "updateGroup", null);
 __decorate([
     Example(groupId),
+    Extension('x-mcp-exposure', 'confirm'),
     Post(''),
     Middlewares([json(), acl({ resource: 'group', action: 'create', object: ({ req }) => req.body })]),
     SuccessResponse(createdResp.status, createdResp.description),
@@ -218,6 +222,7 @@ __decorate([
     __param(0, Body())
 ], GroupController.prototype, "createGroup", null);
 __decorate([
+    Extension('x-mcp-exposure', 'confirm'),
     Delete('{id}'),
     Middlewares(acl({
         resource: 'group',
@@ -231,6 +236,7 @@ __decorate([
     __param(0, Path())
 ], GroupController.prototype, "deleteGroup", null);
 __decorate([
+    Extension('x-mcp-exposure', 'confirm'),
     Delete('{id}/users/{userId}'),
     Middlewares(acl({
         resource: 'group',
@@ -245,6 +251,7 @@ __decorate([
     __param(1, Path())
 ], GroupController.prototype, "removeUserFromGroup", null);
 __decorate([
+    Extension('x-mcp-exposure', 'confirm'),
     Put('{id}/users/{userId}'),
     Middlewares(acl({
         resource: 'group',
@@ -261,6 +268,7 @@ __decorate([
 __decorate([
     Example(userIds),
     Example(partialUsers),
+    Extension('x-mcp-exposure', 'allow'),
     Get('{id}/users'),
     Security('*', ['acl']),
     Tags('users'),
@@ -276,6 +284,7 @@ __decorate([
 __decorate([
     Example(taskIds),
     Example(partialTasks),
+    Extension('x-mcp-exposure', 'allow'),
     Get('{id}/tasks'),
     Security('*', ['acl']),
     Tags('tasks'),

package/dist/hosts/host.controller.mjs

@@ -7,7 +7,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Body, Delete, Example, Get, Middlewares, Path, Post, Put, Query, Request, Response, Route, Security, SuccessResponse, Tags, } from 'tsoa';
+import { Body, Delete, Example, Extension, Get, Middlewares, Path, Post, Put, Query, Request, Response, Route, Security, SuccessResponse, Tags, } from 'tsoa';
 import { asyncEach } from '@vates/async-each';
 import { defer } from 'golike-defer';
 import { json } from 'express';
@@ -317,6 +317,7 @@ let HostController = class HostController extends XapiXoController {
 __decorate([
     Example(hostIds),
     Example(partialHosts),
+    Extension('x-mcp-exposure', 'allow'),
     Get(''),
     Security('*', ['acl']),
     __param(0, Request()),
@@ -328,6 +329,7 @@ __decorate([
 ], HostController.prototype, "getHosts", null);
 __decorate([
     Example(host),
+    Extension('x-mcp-exposure', 'allow'),
     Get('{id}'),
     Middlewares(acl({ resource: 'host', action: 'read', objectId: 'params.id' })),
     Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
@@ -336,6 +338,7 @@ __decorate([
 ], HostController.prototype, "getHost", null);
 __decorate([
     Example(hostStats),
+    Extension('x-mcp-exposure', 'deny'),
     Get('{id}/stats'),
     Middlewares(acl({ resource: 'host', action: 'read', objectId: 'params.id' })),
     Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
@@ -346,6 +349,7 @@ __decorate([
     __param(1, Query())
 ], HostController.prototype, "getHostStats", null);
 __decorate([
+    Extension('x-mcp-exposure', 'deny'),
     Get('{id}/audit.txt'),
     Middlewares(acl({ resource: 'host', action: 'export:logs', objectId: 'params.id' })),
     SuccessResponse(200, 'Download started', 'application/octet-stream'),
@@ -356,6 +360,7 @@ __decorate([
     __param(1, Path())
 ], HostController.prototype, "getAuditLog", null);
 __decorate([
+    Extension('x-mcp-exposure', 'deny'),
     Get('{id}/logs.tgz'),
     Middlewares(acl({ resource: 'host', action: 'export:logs', objectId: 'params.id' })),
     SuccessResponse(200, 'Download started', 'application/gzip'),
@@ -367,6 +372,7 @@ __decorate([
 ], HostController.prototype, "getHostLogs", null);
 __decorate([
     Example(genericAlarmsExample),
+    Extension('x-mcp-exposure', 'allow'),
     Get('{id}/alarms'),
     Security('*', ['acl']),
     Tags('alarms'),
@@ -381,6 +387,7 @@ __decorate([
 ], HostController.prototype, "getHostAlarms", null);
 __decorate([
     Example(hostSmt),
+    Extension('x-mcp-exposure', 'allow'),
     Get('{id}/smt'),
     Middlewares(acl({ resource: 'host', action: 'read', objectId: 'params.id' })),
     Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
@@ -390,6 +397,7 @@ __decorate([
 ], HostController.prototype, "gethostSmt", null);
 __decorate([
     Example(hostMissingPatches),
+    Extension('x-mcp-exposure', 'allow'),
     Get('{id}/missing_patches'),
     Middlewares(acl({ resource: 'host', action: 'read', objectId: 'params.id' })),
     Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
@@ -400,6 +408,7 @@ __decorate([
 __decorate([
     Example(messageIds),
     Example(partialMessages),
+    Extension('x-mcp-exposure', 'allow'),
     Get('{id}/messages'),
     Security('*', ['acl']),
     Tags('messages'),
@@ -415,6 +424,7 @@ __decorate([
 __decorate([
     Example(taskIds),
     Example(partialTasks),
+    Extension('x-mcp-exposure', 'allow'),
     Get('{id}/tasks'),
     Security('*', ['acl']),
     Tags('tasks'),
@@ -428,6 +438,7 @@ __decorate([
     __param(6, Query())
 ], HostController.prototype, "getHostTasks", null);
 __decorate([
+    Extension('x-mcp-exposure', 'confirm'),
     Put('{id}/tags/{tag}'),
     Middlewares(acl({ resource: 'host', action: 'update:tags', objectId: 'params.id' })),
     SuccessResponse(noContentResp.status, noContentResp.description),
@@ -437,6 +448,7 @@ __decorate([
     __param(1, Path())
 ], HostController.prototype, "putHostTag", null);
 __decorate([
+    Extension('x-mcp-exposure', 'confirm'),
     Delete('{id}/tags/{tag}'),
     Middlewares(acl({ resource: 'host', action: 'update:tags', objectId: 'params.id' })),
     SuccessResponse(noContentResp.status, noContentResp.description),
@@ -447,6 +459,7 @@ __decorate([
 ], HostController.prototype, "deleteHostTag", null);
 __decorate([
     Example(taskLocation),
+    Extension('x-mcp-exposure', 'confirm'),
     Post('{id}/actions/management_reconfigure'),
     Middlewares([json(), acl({ resource: 'pif', action: 'update:management', objectId: 'body.pif' })]),
     SuccessResponse(asynchronousActionResp.status, asynchronousActionResp.description),
@@ -462,6 +475,7 @@ __decorate([
 ], HostController.prototype, "managementReconfigure", null);
 __decorate([
     Example(taskLocation),
+    Extension('x-mcp-exposure', 'confirm'),
     Post('{id}/actions/disable'),
     Middlewares([
         json(),
@@ -489,6 +503,7 @@ __decorate([
 ], HostController.prototype, "disable", null);
 __decorate([
     Example(taskLocation),
+    Extension('x-mcp-exposure', 'confirm'),
     Post('{id}/actions/enable'),
     Middlewares(acl({ resource: 'host', action: 'enable', objectId: 'params.id' })),
     SuccessResponse(asynchronousActionResp.status, asynchronousActionResp.description),

package/dist/index.mjs

@@ -6,6 +6,7 @@ import { RegisterRoutes } from './open-api/routes/routes.js';
 import { setupContainer } from './ioc/ioc.mjs';
 import { setupApiContext } from './middlewares/authentication.middleware.mjs';
 import { logMiddleware } from './middlewares/log.middleware.mjs';
+import { mcpGateMiddleware } from './middlewares/mcp-gate.middleware.mjs';
 import { createExternalRouter, sendObjects } from './router/external-router.mjs';
 export { sendObjects };
 // Avoid using "import from" to import a json file as this requires assert/with and will break compatibility with recent node versions
@@ -40,6 +41,7 @@ export default function setupRestApi(express, xoApp) {
     const { mountExternalRoute, externalRouter } = createExternalRouter(swaggerOpenApiSpec);
     express.use(BASE_URL, setupApiContext(xoApp));
     express.use(BASE_URL, logMiddleware);
+    express.use(BASE_URL, mcpGateMiddleware);
     RegisterRoutes(express);
     express.use(BASE_URL, externalRouter);
     express.get(`${BASE_URL}/docs/swagger.json`, (_req, res) => {

package/dist/mcp/mcp.controller.mjs

@@ -0,0 +1,59 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Controller, Example, Get, Response, Route, Security, SuccessResponse, Tags } from 'tsoa';
+import { inject } from 'inversify';
+import { provide } from 'inversify-binding-decorators';
+import { ApiError } from '../helpers/error.helper.mjs';
+import { isMcpEnabled, MCP_DISABLED_ERROR } from './mcp.helper.mjs';
+import { RestApi } from '../rest-api/rest-api.mjs';
+const ENABLED_RESPONSE = {
+    status: 200,
+    description: 'MCP is enabled',
+};
+const DISABLED_RESPONSE = {
+    status: 503,
+    description: 'MCP is disabled by administrator',
+};
+let McpController = class McpController extends Controller {
+    #restApi;
+    constructor(restApi) {
+        super();
+        this.#restApi = restApi;
+    }
+    /**
+     * Returns whether MCP is currently enabled on this XO server.
+     *
+     * The route is publicly reachable (no authentication required) so the
+     * `@xen-orchestra/mcp` binary can check the kill-switch at startup,
+     * before any credentials have been configured.
+     */
+    getMcpStatus() {
+        if (!isMcpEnabled(this.#restApi)) {
+            throw new ApiError(DISABLED_RESPONSE.description, DISABLED_RESPONSE.status, {
+                data: { error: MCP_DISABLED_ERROR },
+            });
+        }
+        return { enabled: true };
+    }
+};
+__decorate([
+    Security('none'),
+    Example({ enabled: true }),
+    Get('status'),
+    SuccessResponse(ENABLED_RESPONSE.status, ENABLED_RESPONSE.description),
+    Response(DISABLED_RESPONSE.status, DISABLED_RESPONSE.description)
+], McpController.prototype, "getMcpStatus", null);
+McpController = __decorate([
+    Route('mcp'),
+    Tags('mcp'),
+    provide(McpController),
+    __param(0, inject(RestApi))
+], McpController);
+export { McpController };