calibreweb-mcp 0.1.3 → 0.2.0

package/README.md

@@ -2,23 +2,30 @@
 
 [![CI](https://img.shields.io/github/actions/workflow/status/ni-c/calibreweb-mcp/ci.yml?branch=main&label=CI)](https://github.com/ni-c/calibreweb-mcp/actions/workflows/ci.yml)
 [![npm version](https://img.shields.io/npm/v/calibreweb-mcp)](https://www.npmjs.com/package/calibreweb-mcp)
+[![npm downloads](https://img.shields.io/npm/dm/calibreweb-mcp)](https://www.npmjs.com/package/calibreweb-mcp)
 [![node](https://img.shields.io/node/v/calibreweb-mcp)](https://nodejs.org)
 [![license](https://img.shields.io/npm/l/calibreweb-mcp)](LICENSE)
-[![container](https://img.shields.io/badge/ghcr.io-ni--c%2Fcalibreweb--mcp-2496ed?logo=docker&logoColor=white)](https://github.com/ni-c/calibreweb-mcp/pkgs/container/calibreweb-mcp)
-[![docs](https://img.shields.io/badge/docs-calibreweb--mcp.ni--c.de-4f46e5)](https://calibreweb-mcp.ni-c.de)
+[![container](https://img.shields.io/badge/ghcr.io-ni--c%2Fcalibreweb--mcp-blue)](https://github.com/ni-c/calibreweb-mcp/pkgs/container/calibreweb-mcp)
+[![docs](https://img.shields.io/badge/docs-calibreweb--mcp.ni--c.de-informational)](https://calibreweb-mcp.ni-c.de)
 [![sponsor](https://img.shields.io/badge/sponsor-ni--c-ea4aaa?logo=githubsponsors&logoColor=white)](https://github.com/sponsors/ni-c)
 
-A read-only [Model Context Protocol](https://modelcontextprotocol.io) server for
+A read-only [Model Context Protocol](https://modelcontextprotocol.io) (MCP) server for
 [Calibre-Web](https://github.com/janeczku/calibre-web) (and
 [Calibre-Web Automated](https://github.com/crocodilestick/Calibre-Web-Automated)),
 the self-hosted ebook library web UI.
 
-Calibre-Web has no REST API — its only stable machine-readable interface is the
-OPDS catalog feed it serves for e-reader apps. This server speaks that feed:
-Atom XML with HTTP Basic auth in, structured book data out. Search the library,
-browse the curated views and shelves, follow per-format download links, and pull
-cover images straight into the conversation. It never writes anything: every
-tool is a GET against the OPDS routes.
+Lets MCP clients like Claude Code, Claude Desktop or Codex search your library,
+browse the curated views and shelves, follow per-format download links and pull cover
+images straight into the conversation. It never writes anything: every tool is a GET.
+
+Six tools is the ceiling, not the floor: `CALIBRE_WEB_ALLOW_TOOLS=essential`
+registers a curated five instead, and a model picks the right tool far more
+reliably from five than from six — see
+[choosing which tools load](#choosing-which-tools-load).
+
+Calibre-Web has no REST API — its only stable machine-readable interface is the OPDS
+catalog feed it serves for e-reader apps. This server speaks that feed: Atom XML with
+HTTP Basic auth in, structured book data out.
 
 <!-- <picture> is resolved against the colour scheme of the page showing it, so GitHub
      picks the variant that matches its own theme toggle. npm strips <picture> and
@@ -35,8 +42,6 @@ tool is a GET against the OPDS routes.
 
 ![Demo: listing the tools, searching the library and reading the stats through the MCP Inspector CLI](https://calibreweb-mcp.ni-c.de/demo.gif)
 
-**📖 Full documentation: [calibreweb-mcp.ni-c.de](https://calibreweb-mcp.ni-c.de)**
-
 ## Requirements
 
 - Node.js 22 or newer
@@ -55,6 +60,8 @@ tool is a GET against the OPDS routes.
 | `CALIBRE_WEB_USERNAME`     | yes¹     | Username of the Calibre-Web account.                                                                    |
 | `CALIBRE_WEB_PASSWORD`     | yes¹     | Password of that account (the web login password).                                                      |
 | `CALIBRE_WEB_INSECURE_TLS` | no       | `true` to accept self-signed certificates — scoped to the configured host only.                         |
+| `CALIBRE_WEB_ALLOW_TOOLS`  | no       | Comma-separated tool names, `list_*` prefixes, or `essential` for a curated preset                      |
+| `CALIBRE_WEB_DENY_TOOLS`   | no       | Same syntax; removed from whatever `CALIBRE_WEB_ALLOW_TOOLS` left                                       |
 
 ¹ Leave **both** unset for an instance that allows anonymous browsing; setting
 only one of them is a configuration error.
@@ -174,3 +181,24 @@ See [CONTRIBUTING.md](CONTRIBUTING.md).
 ## License
 
 [MIT](LICENSE)
+
+### Choosing which tools load
+
+`CALIBRE_WEB_ALLOW_TOOLS` and `CALIBRE_WEB_DENY_TOOLS` take comma-separated tool names;
+a trailing `*` matches a whole family. `essential` is a curated preset of
+five: `search_books`, `list_books`, `list_shelves`, `get_shelf_books`, `get_stats`.
+
+```sh
+CALIBRE_WEB_ALLOW_TOOLS=essential
+CALIBRE_WEB_ALLOW_TOOLS=search_books,list_shelves
+CALIBRE_WEB_DENY_TOOLS=get_cover
+```
+
+An entry that matches no tool aborts startup and names it, so a typo cannot
+silently hide a tool — an absent tool is not something anyone traces back to an
+environment variable. A filtered tool is never registered, so it is absent from
+`tools/list` and unknown to `tools/call` alike.
+
+If you run several of these servers at once, [mcp-hub](https://mcp-hub.ni-c.de)
+is the other answer — its `/hub` endpoint replaces every server's tools with six
+meta-tools.

package/dist/config.d.ts

@@ -9,7 +9,15 @@ export interface Config {
     username: string | undefined;
     /** The normal web-login password of the Calibre-Web user (OPDS uses HTTP Basic auth). */
     password: string | undefined;
-    insecureTls: boolean;
+    insecureTls: boolean; /**
+     * Raw value of `CALIBRE_WEB_ALLOW_TOOLS` — comma-separated tool names, `list_*`
+     * prefixes, or `essential`. Kept unparsed on purpose: this file is a mirror of
+     * the environment, and the names can only be checked against the tool
+     * catalogue, which `buildToolFilter` does.
+     */
+    allowTools: string | undefined;
+    /** Raw value of `CALIBRE_WEB_DENY_TOOLS`, same shape, subtracted from the above. */
+    denyTools: string | undefined;
 }
 /** Shown when the configuration is incomplete — at startup and on every API call. */
 export declare function missingConfigMessage(missing: string[]): string;

package/dist/config.js

@@ -39,6 +39,8 @@ export function loadConfig(env = process.env) {
     const username = env.CALIBRE_WEB_USERNAME;
     const password = env.CALIBRE_WEB_PASSWORD;
     const insecureTls = env.CALIBRE_WEB_INSECURE_TLS === 'true';
+    const allowTools = env.CALIBRE_WEB_ALLOW_TOOLS;
+    const denyTools = env.CALIBRE_WEB_DENY_TOOLS;
     // Don't keep the password in process.env for the process lifetime: it would be
     // inherited by child processes and show up in env dumps. (The kernel's
     // /proc/<pid>/environ snapshot is NOT rewritten by this — it always keeps the
@@ -47,7 +49,14 @@ export function loadConfig(env = process.env) {
     delete env.CALIBRE_WEB_PASSWORD;
     if (!url) {
         console.error(`calibreweb-mcp: ${missingConfigMessage(['CALIBRE_WEB_URL'])}`);
-        return { url: undefined, username, password, insecureTls };
+        return {
+            url: undefined,
+            username,
+            password,
+            insecureTls,
+            allowTools,
+            denyTools,
+        };
     }
     if (!username !== !password) {
         console.error('calibreweb-mcp: CALIBRE_WEB_USERNAME and CALIBRE_WEB_PASSWORD must be ' +
@@ -84,6 +93,8 @@ export function loadConfig(env = process.env) {
         username,
         password,
         insecureTls,
+        allowTools,
+        denyTools,
     };
 }
 function isLoopbackHost(hostname) {

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAgBnD,qFAAqF;AACrF,MAAM,UAAU,oBAAoB,CAAC,OAAiB;IACpD,OAAO,CACL,6CAA6C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QACnE,8DAA8D;QAC9D,8CAA8C;QAC9C,2EAA2E;QAC3E,4EAA4E;QAC5E,qDAAqD;QACrD,4EAA4E,CAC7E,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,GAAG;QAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,CAAC,IAAI,CACV,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,sBAAsB,CACnE,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,eAAe,CAAC;IAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,oBAAoB,CAAC;IAC1C,MAAM,QAAQ,GAAG,GAAG,CAAC,oBAAoB,CAAC;IAC1C,MAAM,WAAW,GAAG,GAAG,CAAC,wBAAwB,KAAK,MAAM,CAAC;IAE5D,+EAA+E;IAC/E,uEAAuE;IACvE,8EAA8E;IAC9E,8EAA8E;IAC9E,oBAAoB;IACpB,OAAO,GAAG,CAAC,oBAAoB,CAAC;IAEhC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,CAAC,KAAK,CACX,mBAAmB,oBAAoB,CAAC,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAC/D,CAAC;QACF,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,QAAQ,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CACX,wEAAwE;YACtE,2EAA2E,CAC9E,CAAC;IACJ,CAAC;IAED,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,6EAA6E;QAC7E,sEAAsE;QACtE,0EAA0E;QAC1E,qEAAqE;QACrE,OAAO,CAAC,KAAK,CACX,uDAAuD,oBAAoB,CAAC,GAAG,CAAC,EAAE,CACnF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,OAAO,CAAC,KAAK,CACX,qEAAqE,MAAM,CAAC,QAAQ,GAAG,CACxF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,2EAA2E;IAC3E,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACvC,OAAO,CAAC,KAAK,CACX,qEAAqE;YACnE,+CAA+C,CAClD,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpE,OAAO,CAAC,KAAK,CACX,0EAA0E;YACxE,qEAAqE,CACxE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC5B,QAAQ;QACR,QAAQ;QACR,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,oEAAoE;IACpE,6EAA6E;IAC7E,qEAAqE;IACrE,OAAO,gBAAgB,CAAC,QAAQ,CAAC,KAAK,UAAU,CAAC;AACnD,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAwBnD,qFAAqF;AACrF,MAAM,UAAU,oBAAoB,CAAC,OAAiB;IACpD,OAAO,CACL,6CAA6C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QACnE,8DAA8D;QAC9D,8CAA8C;QAC9C,2EAA2E;QAC3E,4EAA4E;QAC5E,qDAAqD;QACrD,4EAA4E,CAC7E,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,GAAG;QAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,CAAC,IAAI,CACV,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,sBAAsB,CACnE,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,eAAe,CAAC;IAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,oBAAoB,CAAC;IAC1C,MAAM,QAAQ,GAAG,GAAG,CAAC,oBAAoB,CAAC;IAC1C,MAAM,WAAW,GAAG,GAAG,CAAC,wBAAwB,KAAK,MAAM,CAAC;IAC5D,MAAM,UAAU,GAAG,GAAG,CAAC,uBAAuB,CAAC;IAC/C,MAAM,SAAS,GAAG,GAAG,CAAC,sBAAsB,CAAC;IAE7C,+EAA+E;IAC/E,uEAAuE;IACvE,8EAA8E;IAC9E,8EAA8E;IAC9E,oBAAoB;IACpB,OAAO,GAAG,CAAC,oBAAoB,CAAC;IAEhC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,CAAC,KAAK,CACX,mBAAmB,oBAAoB,CAAC,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAC/D,CAAC;QACF,OAAO;YACL,GAAG,EAAE,SAAS;YACd,QAAQ;YACR,QAAQ;YACR,WAAW;YACX,UAAU;YACV,SAAS;SACV,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CACX,wEAAwE;YACtE,2EAA2E,CAC9E,CAAC;IACJ,CAAC;IAED,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,6EAA6E;QAC7E,sEAAsE;QACtE,0EAA0E;QAC1E,qEAAqE;QACrE,OAAO,CAAC,KAAK,CACX,uDAAuD,oBAAoB,CAAC,GAAG,CAAC,EAAE,CACnF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,OAAO,CAAC,KAAK,CACX,qEAAqE,MAAM,CAAC,QAAQ,GAAG,CACxF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,2EAA2E;IAC3E,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACvC,OAAO,CAAC,KAAK,CACX,qEAAqE;YACnE,+CAA+C,CAClD,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpE,OAAO,CAAC,KAAK,CACX,0EAA0E;YACxE,qEAAqE,CACxE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC5B,QAAQ;QACR,QAAQ;QACR,WAAW;QACX,UAAU;QACV,SAAS;KACV,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,oEAAoE;IACpE,6EAA6E;IAC7E,qEAAqE;IACrE,OAAO,gBAAgB,CAAC,QAAQ,CAAC,KAAK,UAAU,CAAC;AACnD,CAAC"}

package/dist/index.js

@@ -2,12 +2,25 @@
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { loadConfig } from './config.js';
 import { createServer } from './server.js';
+import { ToolFilterError } from './tool-filter.js';
 async function main() {
     const config = loadConfig();
     if (config.insecureTls) {
         console.error('calibreweb-mcp: CALIBRE_WEB_INSECURE_TLS=true — TLS certificate validation is disabled for the Calibre-Web connection');
     }
-    const server = createServer(config);
+    let server;
+    try {
+        server = createServer(config);
+    }
+    catch (error) {
+        // A bad tool list is operator feedback, not a crash: print the
+        // sentence on its own rather than behind "fatal error:".
+        if (error instanceof ToolFilterError) {
+            console.error(`calibreweb-mcp: ${error.message}`);
+            process.exit(1);
+        }
+        throw error;
+    }
     // stdout belongs to the protocol; everything human-readable goes to stderr.
     await server.connect(new StdioServerTransport());
     console.error(config.url

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAEjF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAE5B,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CACX,uHAAuH,CACxH,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACpC,4EAA4E;IAC5E,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,KAAK,CACX,MAAM,CAAC,GAAG;QACR,CAAC,CAAC,wCAAwC,MAAM,CAAC,GAAG,EAAE;QACtD,CAAC,CAAC,6FAA6F,CAClG,CAAC;AACJ,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IAC9B,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;IACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAEjF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAE5B,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CACX,uHAAuH,CACxH,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,+DAA+D;QAC/D,yDAAyD;QACzD,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;YACrC,OAAO,CAAC,KAAK,CAAC,mBAAmB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,4EAA4E;IAC5E,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,KAAK,CACX,MAAM,CAAC,GAAG;QACR,CAAC,CAAC,wCAAwC,MAAM,CAAC,GAAG,EAAE;QACtD,CAAC,CAAC,6FAA6F,CAClG,CAAC;AACJ,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IAC9B,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;IACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/server.js

@@ -1,6 +1,7 @@
 import { createRequire } from 'node:module';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { CalibreWebApi } from './api.js';
+import { buildToolFilter, installToolFilter } from './tool-filter.js';
 import { registerBookTools } from './tools/books.js';
 import { registerCoverTools } from './tools/covers.js';
 import { registerShelfTools } from './tools/shelves.js';
@@ -16,11 +17,17 @@ function packageVersion() {
     }
 }
 export function createServer(config) {
+    // Before anything is built: an unusable tool list should fail on the
+    // way in, not leave a server running with tools quietly missing.
+    const filter = buildToolFilter(config);
     const api = new CalibreWebApi(config);
     const server = new McpServer({
         name: 'calibreweb-mcp',
         version: packageVersion(),
     });
+    // Wraps server.registerTool, so it has to sit before the first
+    // register call and does not care how they are organised.
+    installToolFilter(server, filter);
     // Every tool is read-only: the OPDS feed has no write surface, so there is
     // no read-only mode to configure and nothing destructive to confirm.
     registerBookTools(server, api);

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,SAAS,cAAc;IACrB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAwB,CAAC;QAC9D,OAAO,GAAG,CAAC,OAAO,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,MAAM,GAAG,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;IAEtC,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,cAAc,EAAE;KAC1B,CAAC,CAAC;IAEH,2EAA2E;IAC3E,qEAAqE;IACrE,iBAAiB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/B,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChC,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChC,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAEhC,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAEtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,SAAS,cAAc;IACrB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAwB,CAAC;QAC9D,OAAO,GAAG,CAAC,OAAO,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,qEAAqE;IACrE,iEAAiE;IACjE,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAEvC,MAAM,GAAG,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;IAEtC,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,cAAc,EAAE;KAC1B,CAAC,CAAC;IAEH,+DAA+D;IAC/D,0DAA0D;IAC1D,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAElC,2EAA2E;IAC3E,qEAAqE;IACrE,iBAAiB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/B,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChC,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChC,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAEhC,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/tool-filter.d.ts

@@ -0,0 +1,43 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+/**
+ * A tool list that names something this server does not have.
+ *
+ * Thrown rather than `process.exit(1)`: `createServer` is called in-process by
+ * the tests, and an exiting constructor cannot be tested. `src/index.ts` turns
+ * it back into an exit code.
+ */
+export declare class ToolFilterError extends Error {
+    constructor(message: string);
+}
+export interface ToolFilter {
+    /** False when neither variable was set — then nothing is wrapped at all. */
+    readonly active: boolean;
+    /** The tools that survive. Only meaningful while `active`. */
+    readonly selected: ReadonlySet<string>;
+}
+/**
+ * Reads `CALIBRE_WEB_ALLOW_TOOLS` / `CALIBRE_WEB_DENY_TOOLS` and works out which
+ * tools survive.
+ *
+ * Every entry has to match at least one tool in the catalogue. An entry that
+ * matches nothing is fatal rather than ignored, because the failure it produces
+ * otherwise — a tool quietly missing from `tools/list` — is invisible: nobody
+ * looks for the cause of an absence in an environment variable.
+ */
+export declare function buildToolFilter(config: {
+    allowTools: string | undefined;
+    denyTools: string | undefined;
+}): ToolFilter;
+/**
+ * Makes `server` register only the tools the filter selected.
+ *
+ * The tool is registered and then removed again rather than skipped. Skipping
+ * looks cheaper and breaks one case: the SDK installs its `tools/list` handler
+ * from inside the registration path, so a server whose every tool was skipped
+ * would answer `tools/list` with "method not found" instead of an empty list.
+ * `remove()` deletes the entry from the SDK's tool map outright, which makes a
+ * filtered tool answer `Tool X not found`. `disable()` would be wrong: it hides
+ * the tool from `tools/list` but still answers a call with "disabled", which is
+ * the advertising-a-refusal this server avoids everywhere else.
+ */
+export declare function installToolFilter(server: McpServer, filter: ToolFilter): void;

package/dist/tool-filter.js

@@ -0,0 +1,138 @@
+import { ALL_TOOLS, ESSENTIAL_TOOLS } from './tools/catalogue.js';
+/**
+ * A tool list that names something this server does not have.
+ *
+ * Thrown rather than `process.exit(1)`: `createServer` is called in-process by
+ * the tests, and an exiting constructor cannot be tested. `src/index.ts` turns
+ * it back into an exit code.
+ */
+export class ToolFilterError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'ToolFilterError';
+    }
+}
+/** The `essential` preset is spelled out here so it cannot collide with a tool name. */
+const PRESET = 'essential';
+/**
+ * Splits a comma-separated value into entries.
+ *
+ * Empty entries are dropped, so `a,,b` and a trailing comma are both fine, and
+ * a value that is empty or only whitespace counts as *unset* — `X_ALLOW_TOOLS=`
+ * in a compose file must not mean "allow nothing". Entries are lowercased: the
+ * catalogue is entirely lowercase, so this is lossless, and a shell that
+ * upper-cased a name should not take the server down.
+ */
+function entriesOf(raw) {
+    if (raw === undefined)
+        return undefined;
+    const entries = raw
+        .split(',')
+        .map((entry) => entry.trim().toLowerCase())
+        .filter((entry) => entry.length > 0);
+    return entries.length > 0 ? entries : undefined;
+}
+/**
+ * Expands one entry to the catalogue tools it names.
+ *
+ * A pattern is a literal prefix plus exactly one trailing `*`. Anything else is
+ * rejected outright: `*_thing` and `list_*_x` look plausible, match nothing, and
+ * would otherwise be silent forever.
+ */
+function expand(entry, variable) {
+    const star = entry.indexOf('*');
+    if (star !== -1) {
+        if (star !== entry.length - 1) {
+            throw new ToolFilterError(`${variable}: "${entry}" is not a valid entry — a pattern is a prefix ` +
+                'followed by a single trailing "*", for example "list_*". Everything ' +
+                'else is an exact tool name.');
+        }
+        const prefix = entry.slice(0, -1);
+        return ALL_TOOLS.filter((tool) => tool.startsWith(prefix));
+    }
+    return ALL_TOOLS.filter((tool) => tool === entry);
+}
+/** The full catalogue, for the "these are the names that exist" half of an error. */
+function catalogueList() {
+    return [...ALL_TOOLS].sort().join(', ');
+}
+/**
+ * Reads `CALIBRE_WEB_ALLOW_TOOLS` / `CALIBRE_WEB_DENY_TOOLS` and works out which
+ * tools survive.
+ *
+ * Every entry has to match at least one tool in the catalogue. An entry that
+ * matches nothing is fatal rather than ignored, because the failure it produces
+ * otherwise — a tool quietly missing from `tools/list` — is invisible: nobody
+ * looks for the cause of an absence in an environment variable.
+ */
+export function buildToolFilter(config) {
+    const allow = entriesOf(config.allowTools);
+    const deny = entriesOf(config.denyTools);
+    if (allow === undefined && deny === undefined) {
+        return { active: false, selected: new Set() };
+    }
+    let selected;
+    if (allow === undefined) {
+        selected = new Set(ALL_TOOLS);
+    }
+    else {
+        selected = new Set();
+        for (const entry of allow) {
+            if (entry === PRESET) {
+                for (const tool of ESSENTIAL_TOOLS)
+                    selected.add(tool);
+                continue;
+            }
+            const matches = expand(entry, 'CALIBRE_WEB_ALLOW_TOOLS');
+            if (matches.length === 0) {
+                throw new ToolFilterError(`CALIBRE_WEB_ALLOW_TOOLS: no tool matches "${entry}". ` +
+                    `Valid tools: ${catalogueList()}. "${PRESET}" selects the curated preset.`);
+            }
+            for (const tool of matches)
+                selected.add(tool);
+        }
+    }
+    for (const entry of deny ?? []) {
+        const matches = expand(entry, 'CALIBRE_WEB_DENY_TOOLS');
+        if (matches.length === 0) {
+            throw new ToolFilterError(`CALIBRE_WEB_DENY_TOOLS: no tool matches "${entry}". Valid tools: ${catalogueList()}.`);
+        }
+        for (const tool of matches)
+            selected.delete(tool);
+    }
+    if (selected.size === 0) {
+        throw new ToolFilterError('CALIBRE_WEB_ALLOW_TOOLS/CALIBRE_WEB_DENY_TOOLS leave no tools registered — the ' +
+            'server would start with an empty tool list.');
+    }
+    return { active: true, selected };
+}
+/**
+ * Makes `server` register only the tools the filter selected.
+ *
+ * The tool is registered and then removed again rather than skipped. Skipping
+ * looks cheaper and breaks one case: the SDK installs its `tools/list` handler
+ * from inside the registration path, so a server whose every tool was skipped
+ * would answer `tools/list` with "method not found" instead of an empty list.
+ * `remove()` deletes the entry from the SDK's tool map outright, which makes a
+ * filtered tool answer `Tool X not found`. `disable()` would be wrong: it hides
+ * the tool from `tools/list` but still answers a call with "disabled", which is
+ * the advertising-a-refusal this server avoids everywhere else.
+ */
+export function installToolFilter(server, filter) {
+    if (!filter.active)
+        return;
+    const register = server.registerTool.bind(server);
+    // An object literal rather than a plain function so the method picks up the
+    // SDK's generic signature by contextual typing — the call sites keep their
+    // typed handler arguments and nothing needs a cast.
+    const wrapper = {
+        registerTool(name, config, cb) {
+            const tool = register(name, config, cb);
+            if (!filter.selected.has(name))
+                tool.remove();
+            return tool;
+        },
+    };
+    server.registerTool = wrapper.registerTool;
+}
+//# sourceMappingURL=tool-filter.js.map

package/dist/tool-filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-filter.js","sourceRoot":"","sources":["../src/tool-filter.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAElE;;;;;;GAMG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AASD,wFAAwF;AACxF,MAAM,MAAM,GAAG,WAAW,CAAC;AAE3B;;;;;;;;GAQG;AACH,SAAS,SAAS,CAAC,GAAuB;IACxC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,OAAO,GAAG,GAAG;SAChB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAC1C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,MAAM,CAAC,KAAa,EAAE,QAAgB;IAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;QAChB,IAAI,IAAI,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,eAAe,CACvB,GAAG,QAAQ,MAAM,KAAK,iDAAiD;gBACrE,sEAAsE;gBACtE,6BAA6B,CAChC,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAClC,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;AACpD,CAAC;AAED,qFAAqF;AACrF,SAAS,aAAa;IACpB,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,MAG/B;IACC,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;IAChD,CAAC;IAED,IAAI,QAAqB,CAAC;IAC1B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,QAAQ,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YAC1B,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;gBACrB,KAAK,MAAM,IAAI,IAAI,eAAe;oBAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACvD,SAAS;YACX,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC;YACzD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,eAAe,CACvB,6CAA6C,KAAK,KAAK;oBACrD,gBAAgB,aAAa,EAAE,MAAM,MAAM,+BAA+B,CAC7E,CAAC;YACJ,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,OAAO;gBAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC;QACxD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,eAAe,CACvB,4CAA4C,KAAK,mBAAmB,aAAa,EAAE,GAAG,CACvF,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,OAAO;YAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,eAAe,CACvB,iFAAiF;YAC/E,6CAA6C,CAChD,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAiB,EAAE,MAAkB;IACrE,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO;IAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClD,4EAA4E;IAC5E,2EAA2E;IAC3E,oDAAoD;IACpD,MAAM,OAAO,GAAoC;QAC/C,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YAC3B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;IACF,MAAM,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;AAC7C,CAAC"}

package/dist/tools/catalogue.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The tools this server can register, declared rather than discovered.
+ *
+ * Declared, because the tool filter has to answer "is this a name you have?"
+ * *before* anything is registered — and in read-only mode the write tools are
+ * never registered at all. Deriving the catalogue from what actually reached
+ * `registerTool` would make `CALIBRE_WEB_ALLOW_TOOLS=get_thing` report
+ * "unknown tool" under `CALIBRE_WEB_READ_ONLY=true`, which is the one answer that
+ * is wrong.
+ *
+ * This is also the full tool surface, hard-coded on purpose: a tool that appears
+ * or disappears by accident is a change to the server's contract and has to be a
+ * deliberate edit here. `test/tool-filter.test.ts` asserts that these lists and
+ * the tools the server really registers are the same set.
+ */
+/** Every tool. This server never writes, so there is no split to make. */
+export declare const ALL_TOOLS_LIST: readonly ["get_cover", "get_shelf_books", "get_stats", "list_books", "list_shelves", "search_books"];
+/** Every tool, read-only mode aside. */
+export declare const ALL_TOOLS: readonly string[];
+/**
+ * What `CALIBRE_WEB_ALLOW_TOOLS=essential` selects: find a book, see the shelves.
+ *
+ * 5 of 6. Left out on purpose: `get_cover`, which returns a base64 image that floods the context window
+ * and is almost never the answer to a question.
+ */
+export declare const ESSENTIAL_TOOLS: readonly string[];

package/dist/tools/catalogue.js

@@ -0,0 +1,40 @@
+/**
+ * The tools this server can register, declared rather than discovered.
+ *
+ * Declared, because the tool filter has to answer "is this a name you have?"
+ * *before* anything is registered — and in read-only mode the write tools are
+ * never registered at all. Deriving the catalogue from what actually reached
+ * `registerTool` would make `CALIBRE_WEB_ALLOW_TOOLS=get_thing` report
+ * "unknown tool" under `CALIBRE_WEB_READ_ONLY=true`, which is the one answer that
+ * is wrong.
+ *
+ * This is also the full tool surface, hard-coded on purpose: a tool that appears
+ * or disappears by accident is a change to the server's contract and has to be a
+ * deliberate edit here. `test/tool-filter.test.ts` asserts that these lists and
+ * the tools the server really registers are the same set.
+ */
+/** Every tool. This server never writes, so there is no split to make. */
+export const ALL_TOOLS_LIST = [
+    'get_cover',
+    'get_shelf_books',
+    'get_stats',
+    'list_books',
+    'list_shelves',
+    'search_books',
+];
+/** Every tool, read-only mode aside. */
+export const ALL_TOOLS = [...ALL_TOOLS_LIST];
+/**
+ * What `CALIBRE_WEB_ALLOW_TOOLS=essential` selects: find a book, see the shelves.
+ *
+ * 5 of 6. Left out on purpose: `get_cover`, which returns a base64 image that floods the context window
+ * and is almost never the answer to a question.
+ */
+export const ESSENTIAL_TOOLS = [
+    'search_books',
+    'list_books',
+    'list_shelves',
+    'get_shelf_books',
+    'get_stats',
+];
+//# sourceMappingURL=catalogue.js.map

package/dist/tools/catalogue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalogue.js","sourceRoot":"","sources":["../../src/tools/catalogue.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,0EAA0E;AAC1E,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,WAAW;IACX,iBAAiB;IACjB,WAAW;IACX,YAAY;IACZ,cAAc;IACd,cAAc;CACN,CAAC;AAEX,wCAAwC;AACxC,MAAM,CAAC,MAAM,SAAS,GAAsB,CAAC,GAAG,cAAc,CAAC,CAAC;AAEhE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,cAAc;IACd,YAAY;IACZ,cAAc;IACd,iBAAiB;IACjB,WAAW;CACZ,CAAC"}

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "calibreweb-mcp",
-  "version": "0.1.3",
+  "version": "0.2.0",
   "mcpName": "io.github.ni-c/calibreweb-mcp",
-  "description": "MCP server for Calibre-Web — read-only library access via the OPDS feed",
+  "description": "MCP server for Calibre-Web \u2014 read-only library access via the OPDS feed",
   "keywords": [
     "mcp",
     "model-context-protocol",