npm - davinci-resolve-mcp - Versions diffs - 2.35.2 → 2.36.0 - Mend

davinci-resolve-mcp 2.35.2 → 2.36.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (8) hide show

package/CHANGELOG.md +16 -0
package/README.md +1 -1
package/install.py +1 -1
package/package.json +1 -1
package/src/analysis_dashboard.py +128 -1
package/src/granular/common.py +1 -1
package/src/server.py +18 -1
package/src/utils/mcp_transport.py +128 -0

package/CHANGELOG.md CHANGED Viewed

@@ -2,6 +2,22 @@
 Release history for the DaVinci Resolve MCP Server. The latest release is summarized in the root README; older entries live here to keep the README focused.
+## What's New in v2.36.0
+Optional networked transport — run the MCP server over the network, safely, with
+control-panel management. Local stdio remains the default and is unchanged.
+- **Added** `--transport stdio|sse|streamable-http` (default `stdio`). The networked
+  modes bind to **loopback (127.0.0.1) by default** and **require a bearer token** on
+  every request (from `$DAVINCI_MCP_TOKEN`, or generated + logged at startup). A
+  non-loopback bind logs a loud security warning. stdio is untouched; you can run a
+  local stdio instance and a networked instance against the same Resolve at once.
+- **Added** control-panel management (Setup → MCP): a Transport card showing the live
+  mode / URL / token / loopback status, with Start/Stop buttons (loopback-only). Backed
+  by `/api/mcp/transport/{start,stop}` and a transport field on `/api/mcp/status`.
+- The page-switch lock (v2.34.1) already serializes concurrent page switches across the
+  local and networked instances.
 ## What's New in v2.35.2
 Verification observability and a validator consolidation.

package/README.md CHANGED Viewed

@@ -1,6 +1,6 @@
 # DaVinci Resolve MCP Server
-[![Version](https://img.shields.io/badge/version-2.35.2-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-2.36.0-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
 [![Tools](https://img.shields.io/badge/MCP%20Tools-32%20(341%20full)-blue.svg)](#server-modes)

package/install.py CHANGED Viewed

@@ -35,7 +35,7 @@ from src.utils.update_check import (
 # ─── Version ──────────────────────────────────────────────────────────────────
-VERSION = "2.35.2"
+VERSION = "2.36.0"
 # Only hard floor: mcp[cli] requires Python 3.10+. There is no upper bound —
 # Resolve's scripting bridge loads into newer interpreters on recent builds
 # (Python 3.14 verified against Resolve Studio 20.3.2). Older Resolve builds

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "davinci-resolve-mcp",
-  "version": "2.35.2",
+  "version": "2.36.0",
   "description": "NPM bootstrapper for the DaVinci Resolve MCP Server.",
   "license": "MIT",
   "author": "Samuel Gursky <samgursky@gmail.com>",

package/src/analysis_dashboard.py CHANGED Viewed

@@ -5495,7 +5495,36 @@ HTML = r"""<!doctype html>
             <span>${apiOk && libOk ? 'Auto-detected from standard install paths' : 'Install via install.py if paths cannot be detected'}</span>
           </div>
         </div>`;
-      setHtml('diagnosticsMcpServer', serverCard + resolveCard);
+      const tr = data.transport || { networked: false, mode: 'stdio (local)' };
+      const trPill = tr.networked
+        ? (tr.loopback ? statusPill('pill-ok', 'Networked · loopback')
+                       : statusPill('pill-warn', 'Networked · EXPOSED'))
+        : statusPill('pill-ok', 'Local (stdio)');
+      const transportCard = `
+        <div class="diag-card">
+          <div class="diag-card-header">
+            <div class="diag-card-title">${DIAG_ICONS.connection}Transport</div>
+            ${trPill}
+          </div>
+          <div class="diag-card-rows">
+            ${diagRow('Mode', tr.mode || 'stdio (local)')}
+            ${tr.networked ? diagRow('URL', tr.url || '—') : ''}
+            ${tr.networked ? diagRow('Auth', tr.has_token ? 'Bearer token required' : 'NONE') : ''}
+            ${tr.networked && tr.token ? diagRow('Token', tr.token) : ''}
+          </div>
+          <div class="diag-card-footer">
+            <span>${tr.networked
+              ? (tr.loopback ? 'Reachable on this machine only; every request needs the bearer token.'
+                             : 'WARNING: bound to a non-loopback host — exposed on the network.')
+              : 'Default. Networked access is opt-in (launch with --transport sse|streamable-http).'}</span>
+            <button class="secondary transport-toggle-btn" data-transport-action="${tr.networked ? 'stop' : 'start'}">
+              ${tr.networked ? 'Stop networked' : 'Start networked'}</button>
+          </div>
+        </div>`;
+      setHtml('diagnosticsMcpServer', serverCard + resolveCard + transportCard);
+      serverEl.querySelectorAll('.transport-toggle-btn').forEach(btn => {
+        btn.addEventListener('click', () => toggleTransport(btn.dataset.transportAction, btn).catch(alertError));
+      });
       const clients = data.clients || [];
       if (!clients.length) {
@@ -5592,6 +5621,28 @@ HTML = r"""<!doctype html>
       }
     }
+    async function toggleTransport(action, btn) {
+      if (action === 'start') {
+        const proceed = await brandedConfirm({
+          kicker: 'MCP Transport',
+          title: 'Start networked transport?',
+          body: 'Starts a second MCP server instance over streamable-http, bound to loopback (127.0.0.1) and protected by a bearer token. Local stdio is unaffected. The connection URL + token will appear here.',
+          confirmLabel: 'Start',
+          cancelLabel: 'Cancel',
+        });
+        if (!proceed) return;
+      }
+      const original = btn?.textContent;
+      if (btn) { btn.disabled = true; btn.textContent = action === 'start' ? 'Starting…' : 'Stopping…'; }
+      try {
+        const ep = action === 'start' ? '/api/mcp/transport/start' : '/api/mcp/transport/stop';
+        await api(ep, { method: 'POST', body: '{}' });
+      } finally {
+        if (btn) { btn.disabled = false; btn.textContent = original; }
+        await refreshMcpStatus();
+      }
+    }
     function renderControlPanels() {
       renderOverview();
       renderDiagnostics();
@@ -13483,9 +13534,73 @@ def _mcp_status_payload() -> Dict[str, Any]:
             "resolve_lib_detected": bool(paths.get("lib_path")),
         },
         "clients": clients_out,
+        "transport": _transport_status(),
     }
+def _transport_status() -> Dict[str, Any]:
+    """Live networked-transport status (or local-only) for the MCP diagnostics card."""
+    try:
+        from src.utils.mcp_transport import read_transport_state
+    except Exception:
+        return {"networked": False, "mode": "stdio (local)"}
+    state = read_transport_state()
+    if not state:
+        return {"networked": False, "mode": "stdio (local)"}
+    return {
+        "networked": True,
+        "mode": state.get("transport"),
+        "url": state.get("url"),
+        "loopback": state.get("loopback", True),
+        "has_token": bool(state.get("token")),
+        "token": state.get("token"),
+        "pid": state.get("pid"),
+    }
+def _transport_start() -> Dict[str, Any]:
+    """Spawn a networked MCP instance (streamable-http, loopback + token)."""
+    import subprocess as _sp
+    from src.utils.mcp_transport import read_transport_state
+    if read_transport_state():
+        return {"success": False, "error": "A networked transport instance is already running."}
+    paths = _resolve_mcp_paths()
+    py, script = paths.get("python_path"), paths.get("server_path")
+    if not py or not script:
+        return {"success": False, "error": "Could not resolve the Python interpreter or server script path."}
+    try:
+        _sp.Popen(
+            [py, script, "--transport", "streamable-http"],
+            stdin=_sp.DEVNULL, stdout=_sp.DEVNULL, stderr=_sp.DEVNULL,
+            start_new_session=True,
+        )
+    except OSError as exc:
+        return {"success": False, "error": f"Failed to launch: {exc}"}
+    import time as _t
+    for _ in range(15):
+        _t.sleep(0.2)
+        if read_transport_state():
+            return {"success": True, "transport": _transport_status()}
+    return {"success": True, "note": "Launch initiated; status will appear shortly."}
+def _transport_stop() -> Dict[str, Any]:
+    """Stop the running networked MCP instance via its state-file PID."""
+    import signal as _sig
+    from src.utils.mcp_transport import read_transport_state, clear_transport_state
+    state = read_transport_state()
+    if not state:
+        return {"success": True, "note": "No networked transport running."}
+    pid = state.get("pid")
+    if isinstance(pid, int):
+        try:
+            os.kill(pid, _sig.SIGTERM)
+        except (OSError, ProcessLookupError):
+            pass
+    clear_transport_state()
+    return {"success": True}
 def _mcp_install_payload(client_id: str) -> Dict[str, Any]:
     """Write the MCP entry for one client by delegating to install.write_client_config."""
     installer, error = _load_installer_module()
@@ -14304,6 +14419,18 @@ class Handler(BaseHTTPRequestHandler):
                 return
             self._json(_mcp_uninstall_payload(client_id))
             return
+        if path == "/api/mcp/transport/start":
+            if not _request_is_loopback(self):
+                self._json({"success": False, "error": "Transport management is loopback-only."}, HTTPStatus.FORBIDDEN)
+                return
+            self._json(_transport_start())
+            return
+        if path == "/api/mcp/transport/stop":
+            if not _request_is_loopback(self):
+                self._json({"success": False, "error": "Transport management is loopback-only."}, HTTPStatus.FORBIDDEN)
+                return
+            self._json(_transport_stop())
+            return
         if path == "/api/jobs":
             paths = body.get("paths") or []
             if isinstance(paths, str):

package/src/granular/common.py CHANGED Viewed

@@ -80,7 +80,7 @@ if not logging.getLogger().handlers:
         handlers=[logging.StreamHandler()],
     )
-VERSION = "2.35.2"
+VERSION = "2.36.0"
 logger = logging.getLogger("davinci-resolve-mcp")
 logger.info(f"Starting DaVinci Resolve MCP Server v{VERSION}")
 logger.info(f"Detected platform: {get_platform()}")

package/src/server.py CHANGED Viewed

@@ -11,7 +11,7 @@ Usage:
     python src/server.py --full       # Start the 341-tool granular server instead
 """
-VERSION = "2.35.2"
+VERSION = "2.36.0"
 import base64
 import os
@@ -21041,5 +21041,22 @@ if __name__ == "__main__":
         run_fastmcp_stdio(granular_mcp)
         sys.exit(0)
+    # --transport stdio (default) | sse | streamable-http. Networked modes bind
+    # loopback by default and require a bearer token (see src/utils/mcp_transport).
+    transport = "stdio"
+    if "--transport" in sys.argv:
+        _i = sys.argv.index("--transport")
+        if _i + 1 < len(sys.argv):
+            transport = sys.argv[_i + 1]
+            del sys.argv[_i:_i + 2]
+    if transport in ("sse", "streamable-http"):
+        from src.utils.mcp_transport import run_networked
+        logger.info(f"Starting DaVinci Resolve MCP Server ({transport} transport)")
+        run_networked(mcp, transport)
+        sys.exit(0)
+    if transport != "stdio":
+        logger.error(f"Unknown --transport {transport!r}; use stdio|sse|streamable-http")
+        sys.exit(2)
     logger.info(f"Starting DaVinci Resolve MCP Server (32 compound tools)")
     run_fastmcp_stdio(mcp)

package/src/utils/mcp_transport.py ADDED Viewed

@@ -0,0 +1,128 @@
+"""Networked transport for the MCP server (opt-in via --transport).
+stdio remains the default. The `sse` and `streamable-http` modes bind to
+loopback (127.0.0.1) by default and REQUIRE a bearer token on every request, so
+turning networking on never silently exposes Resolve. The token comes from
+``$DAVINCI_MCP_TOKEN`` or is generated and logged at startup. A small state file
+lets the control panel show the live connection URL + token.
+Security posture:
+- Default host is loopback; a non-loopback bind logs a loud warning.
+- Every HTTP request must carry ``Authorization: Bearer <token>`` (constant-time
+  compared); otherwise 401.
+- stdio (the default transport) is unaffected by anything here.
+"""
+import json
+import logging
+import os
+import secrets
+import tempfile
+import time
+logger = logging.getLogger("davinci-resolve-mcp")
+TRANSPORT_STATE_PATH = os.path.join(
+    tempfile.gettempdir(), "davinci_resolve_mcp_transport.json"
+)
+LOOPBACK_HOSTS = {"127.0.0.1", "localhost", "::1"}
+def resolve_token():
+    """Return (token, was_generated). Honors $DAVINCI_MCP_TOKEN."""
+    tok = os.environ.get("DAVINCI_MCP_TOKEN")
+    if tok:
+        return tok, False
+    return secrets.token_urlsafe(24), True
+def _auth_middleware_cls(token):
+    from starlette.middleware.base import BaseHTTPMiddleware
+    from starlette.responses import JSONResponse
+    expected = f"Bearer {token}"
+    class BearerAuth(BaseHTTPMiddleware):
+        async def dispatch(self, request, call_next):
+            provided = request.headers.get("authorization", "")
+            if not secrets.compare_digest(provided, expected):
+                return JSONResponse(
+                    {"error": "unauthorized: Authorization: Bearer <token> required"},
+                    status_code=401,
+                )
+            return await call_next(request)
+    return BearerAuth
+def write_transport_state(transport, host, port, token):
+    try:
+        with open(TRANSPORT_STATE_PATH, "w", encoding="utf-8") as fh:
+            json.dump({
+                "transport": transport,
+                "host": host,
+                "port": port,
+                "url": f"http://{host}:{port}",
+                "token": token,
+                "loopback": host in LOOPBACK_HOSTS,
+                "pid": os.getpid(),
+                "started_at": time.time(),
+            }, fh)
+    except OSError as exc:
+        logger.warning("could not write transport state: %s", exc)
+def clear_transport_state():
+    try:
+        os.remove(TRANSPORT_STATE_PATH)
+    except OSError:
+        pass
+def read_transport_state():
+    """Return the live transport state dict, or None if no networked instance.
+    Treats a state file whose pid is no longer alive as stale (returns None).
+    """
+    try:
+        with open(TRANSPORT_STATE_PATH, encoding="utf-8") as fh:
+            state = json.load(fh)
+    except (OSError, ValueError):
+        return None
+    pid = state.get("pid")
+    if isinstance(pid, int):
+        try:
+            os.kill(pid, 0)
+        except (OSError, ProcessLookupError):
+            return None
+    return state
+def run_networked(mcp, transport):
+    """Serve `mcp` over an authenticated HTTP transport ('sse'|'streamable-http')."""
+    import uvicorn
+    host = os.environ.get("DAVINCI_MCP_HOST") or mcp.settings.host or "127.0.0.1"
+    port = int(os.environ.get("DAVINCI_MCP_PORT") or mcp.settings.port or 8000)
+    mcp.settings.host = host
+    mcp.settings.port = port
+    token, generated = resolve_token()
+    app = mcp.sse_app() if transport == "sse" else mcp.streamable_http_app()
+    app.add_middleware(_auth_middleware_cls(token))
+    if host not in LOOPBACK_HOSTS:
+        logger.warning(
+            "SECURITY: MCP %s transport bound to NON-loopback host %r — Resolve "
+            "control is exposed on the network. Ensure this is intended.",
+            transport, host,
+        )
+    logger.info("MCP %s transport: http://%s:%s (bearer token required)",
+                transport, host, port)
+    if generated:
+        logger.info("Generated bearer token (set $DAVINCI_MCP_TOKEN to pin it): %s", token)
+    write_transport_state(transport, host, port, token)
+    try:
+        uvicorn.run(app, host=host, port=port, log_level="warning")
+    finally:
+        clear_transport_state()