drupal-mcp-connector 1.2.0 → 1.3.0

package/CHANGELOG.md

@@ -7,6 +7,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.3.0] - 2026-06-27
+
+### Fixed
+- `drupal_mcp_whoami` no longer over-reports configuration capabilities. Capabilities are
+  now the intersection of the connector security preset **and** the token's effective OAuth
+  scopes: `configRead` / `configWrite` require the dedicated `mcp_config` scope (config-editor
+  / Developer tier), and `write` / `delete` require `mcp_write`. Previously a content-tier
+  token (`mcp_read` / `mcp_write`) was reported with `configRead: true` even though the server
+  denies every `config_*` tool without `mcp_config`. When a site declares no OAuth scopes,
+  behaviour is unchanged (preset-only).
+
+### Changed
+- The config tools (`config_get` / `config_list` / `config_set`) now check for the
+  `mcp_config` scope up front (when OAuth scopes are configured) and fail fast with a clear
+  message instead of dispatching a call the governed server will deny — keeping connector
+  behaviour consistent with `drupal_mcp_whoami`. Aligns with mcp_sentinel isolating the config
+  tools under the dedicated `mcp_config` scope.
+
 ## [1.2.0] - 2026-06-27
 
 ### Changed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drupal-mcp-connector",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "A secure, multi-site Model Context Protocol (MCP) connector for Drupal — dual-protocol JSON:API and GraphQL.",
   "type": "module",
   "main": "src/index.js",

package/src/lib/security.js

@@ -323,6 +323,41 @@ export function assertConfigWriteAllowed(secConfig) {
   }
 }
 
+/**
+ * Whether the site's OAuth token carries a given scope. When the site declares
+ * no OAuth scopes (no agent channel configured), scope gating is a no-op and
+ * this returns true so preset-only (non-OAuth) setups are unaffected.
+ * @param {object} site Resolved site config.
+ * @param {string} scope OAuth scope machine id (e.g. "mcp_config").
+ * @returns {boolean} True if the scope is present, or no scopes are configured.
+ */
+export function hasScope(site, scope) {
+  const scopes = site?.oauth?.scopes ?? [];
+  return scopes.length === 0 || scopes.includes(scope);
+}
+
+/**
+ * Gate the config tools (get/list/set) on the dedicated `mcp_config` OAuth
+ * scope, which the governed server requires for every config_* tool. When OAuth
+ * scopes are configured but `mcp_config` is absent, fail fast with a clear
+ * message instead of dispatching a call the server will deny — keeping the
+ * connector's behaviour and its drupal_mcp_whoami report consistent with what
+ * the token can actually exercise.
+ * @param {object} site Resolved site config.
+ * @param {string} operationLabel Label used in the error message.
+ * @returns {void}
+ * @throws {SecurityError} if scopes are configured and `mcp_config` is missing.
+ */
+export function assertConfigScope(site, operationLabel) {
+  if (!hasScope(site, "mcp_config")) {
+    throw new SecurityError(
+      "Config tools require the 'mcp_config' OAuth scope (config-editor / " +
+      "Developer tier); this token does not carry it. " +
+      `Operation blocked: ${operationLabel}.`
+    );
+  }
+}
+
 /**
  * @param {object} secConfig Resolved security config.
  * @param {string} entityType Entity type targeted by the delete.

package/src/tools/config.js

@@ -18,6 +18,8 @@ import {
   assertNotReadOnly,
   assertConfigReadAllowed,
   assertConfigWriteAllowed,
+  assertConfigScope,
+  hasScope,
 } from "../lib/security.js";
 import { callServerTool, SERVER_TOOLS } from "../lib/server-tools.js";
 
@@ -33,6 +35,7 @@ import { callServerTool, SERVER_TOOLS } from "../lib/server-tools.js";
  */
 async function configGet({ site: siteName, name }) {
   const site = getSiteConfig(siteName);
+  assertConfigScope(site, `config:get ${name}`);
   assertConfigReadAllowed(resolveSecurityConfig(site));
   return callServerTool(site, SERVER_TOOLS.configGet, { name });
 }
@@ -45,6 +48,7 @@ async function configGet({ site: siteName, name }) {
  */
 async function configList({ site: siteName, prefix }) {
   const site = getSiteConfig(siteName);
+  assertConfigScope(site, "config:list");
   assertConfigReadAllowed(resolveSecurityConfig(site));
   const args = prefix ? { prefix } : {};
   return callServerTool(site, SERVER_TOOLS.configList, args);
@@ -60,6 +64,7 @@ async function configList({ site: siteName, prefix }) {
 async function configSet({ site: siteName, name, value }) {
   const site = getSiteConfig(siteName);
   const sec = resolveSecurityConfig(site);
+  assertConfigScope(site, `config:set ${name}`);
   assertNotReadOnly(sec, `config:set ${name}`);
   assertConfigWriteAllowed(sec);
   return callServerTool(site, SERVER_TOOLS.configSet, { name, value });
@@ -100,6 +105,13 @@ async function whoami({ site: siteName }) {
   const site = getSiteConfig(siteName);
   const sec = resolveSecurityConfig(site);
   const summary = getSecuritySummary(site);
+  // Effective capability = connector preset AND the scope the server demands.
+  // Reporting the preset alone over-states what the token can do — e.g. the
+  // content-editor preset allows config reads locally, but every config_* tool
+  // is gated server-side on mcp_config, which the content tier does not hold.
+  // When no OAuth scopes are configured, hasScope() is a no-op (preset-only).
+  const canWrite  = !sec.readOnly && hasScope(site, "mcp_write");
+  const canConfig = hasScope(site, "mcp_config");
   return {
     site: site._name,
     tier: inferTier(site, sec),
@@ -108,11 +120,11 @@ async function whoami({ site: siteName }) {
     api: site.api ?? "auto",
     serverToolsConfigured: Boolean(site.serverTools?.url),
     capabilities: {
-      read:        true,
-      write:       !sec.readOnly,
-      delete:      sec.allowDestructive && !sec.readOnly,
-      configRead:  sec.allowConfigRead,
-      configWrite: sec.allowConfigWrite && !sec.readOnly,
+      read:        hasScope(site, "mcp_read"),
+      write:       canWrite,
+      delete:      sec.allowDestructive && canWrite,
+      configRead:  sec.allowConfigRead  && canConfig,
+      configWrite: sec.allowConfigWrite && !sec.readOnly && canConfig,
       // Publishing is always gated server-side (editorial workflow); the agent
       // never holds the publish transition. Surfaced here so it is explicit.
       publish:     false,