drupal-mcp-connector 2.0.0 → 2.1.0

package/.claude/commands/drupal-bulk-update.md

@@ -1,12 +1,12 @@
 ---
-description: "Update many entities of a single type + bundle in one call. Permission is checked once; each item is updated independently, so the batch continues past individual failures (partial success). Each item requires an 'id' (UUID); items missing an id are reported as per-item failures. Returns per-item { index, success, id | error } and a summary { updated, failed }."
+description: "Update many entities of a single type + bundle in one call. Permission is checked once; each item is updated independently, so the batch continues past individual failures (partial success). Each item requires an 'id' (UUID); items missing an id are reported as per-item failures. Published moderated targets without an explicit attributes.moderation_state default to moderation_state 'draft' (forward revision) so bulk edits do not mutate live default revisions. Returns per-item { index, success, id | error } and a summary { updated, failed }."
 argument-hint: "<entityType> <bundle> <items> [site]"
 allowed-tools: mcp__drupal__drupal_bulk_update
 ---
 
 Call the `mcp__drupal__drupal_bulk_update` MCP tool.
 
-Update many entities of a single type + bundle in one call. Permission is checked once; each item is updated independently, so the batch continues past individual failures (partial success). Each item requires an 'id' (UUID); items missing an id are reported as per-item failures. Returns per-item { index, success, id | error } and a summary { updated, failed }.
+Update many entities of a single type + bundle in one call. Permission is checked once; each item is updated independently, so the batch continues past individual failures (partial success). Each item requires an 'id' (UUID); items missing an id are reported as per-item failures. Published moderated targets without an explicit attributes.moderation_state default to moderation_state 'draft' (forward revision) so bulk edits do not mutate live default revisions. Returns per-item { index, success, id | error } and a summary { updated, failed }.
 
 Parse the request in `$ARGUMENTS` into this tool's parameters:
 

package/.claude/commands/drupal-create-media.md

@@ -16,7 +16,7 @@ Parse the request in `$ARGUMENTS` into this tool's parameters:
 
 **Optional:**
 - `site` (string): omit for the default site
-- `status` (boolean (true/false))
+- `status` (boolean (true/false)): Published flag. Defaults to false (unpublished). Requires allowPublish when true.
 - `fields` (object (pass as JSON)): Additional field values — include the source field (e.g. field_media_oembed_video: 'https://youtu.be/...')
 
 If a required parameter is missing from `$ARGUMENTS`, ask before calling — do not invent values. Coerce each value to its JSON type (booleans → true/false, numbers → numeric, object/array → parse JSON), then make the single tool call and summarize the result.

package/.claude/commands/drupal-entity-update.md

@@ -1,12 +1,12 @@
 ---
-description: "Update an existing entity of any Drupal entity type. Only include attributes/relationships you want to change."
+description: "Update an existing entity of any Drupal entity type. Only include attributes/relationships you want to change. Published moderated targets without an explicit attributes.moderation_state default to moderation_state 'draft' (forward revision)."
 argument-hint: "<entityType> <bundle> <id> [site] [attributes] [relationships] [dryRun] [returning]"
 allowed-tools: mcp__drupal__drupal_entity_update
 ---
 
 Call the `mcp__drupal__drupal_entity_update` MCP tool.
 
-Update an existing entity of any Drupal entity type. Only include attributes/relationships you want to change.
+Update an existing entity of any Drupal entity type. Only include attributes/relationships you want to change. Published moderated targets without an explicit attributes.moderation_state default to moderation_state 'draft' (forward revision).
 
 Parse the request in `$ARGUMENTS` into this tool's parameters:
 

package/.claude/commands/drupal-update-node.md

@@ -1,12 +1,12 @@
 ---
-description: "Update an existing node. Only include fields you want to change. For moderated content types, use moderationState (e.g. 'published') rather than status. Entity-reference fields go in `relationships`, not `fields`."
+description: "Update an existing node. Only include fields you want to change. For moderated content types, use moderationState (e.g. 'published') rather than status. When the target is published and moderated and you omit moderationState, the connector defaults the write to moderation_state 'draft' (forward revision) so live default revisions are not mutated by accident. Entity-reference fields go in `relationships`, not `fields`."
 argument-hint: "<type> <id> [site] [title] [body] [summary] [status] [moderationState] [fields] [relationships] [dryRun] [returning]"
 allowed-tools: mcp__drupal__drupal_update_node
 ---
 
 Call the `mcp__drupal__drupal_update_node` MCP tool.
 
-Update an existing node. Only include fields you want to change. For moderated content types, use moderationState (e.g. 'published') rather than status. Entity-reference fields go in `relationships`, not `fields`.
+Update an existing node. Only include fields you want to change. For moderated content types, use moderationState (e.g. 'published') rather than status. When the target is published and moderated and you omit moderationState, the connector defaults the write to moderation_state 'draft' (forward revision) so live default revisions are not mutated by accident. Entity-reference fields go in `relationships`, not `fields`.
 
 Parse the request in `$ARGUMENTS` into this tool's parameters:
 
@@ -20,7 +20,7 @@ Parse the request in `$ARGUMENTS` into this tool's parameters:
 - `body` (string)
 - `summary` (string)
 - `status` (boolean (true/false)): Published flag for NON-moderated types: true = publish, false = unpublish. Ignored if moderationState is set.
-- `moderationState` (string): Moderation state transition for content_moderation types, e.g. 'draft', 'published', 'archived'. Takes precedence over status.
+- `moderationState` (string): Moderation state transition for content_moderation types, e.g. 'draft', 'published', 'archived'. Takes precedence over status. Required to keep or re-publish a live node — omitting it on a published moderated node defaults the write to 'draft'.
 - `fields` (object (pass as JSON)): Scalar/attribute field values keyed by machine name. Entity-reference fields go in `relationships`, not here.
 - `relationships` (object (pass as JSON)): Entity-reference fields as JSON:API relationships, keyed by field machine name. Single-value uses { data: { type, id } }; multi-value uses { data: [{ type, id }, …] }.
 - `dryRun` (boolean (true/false)): Validate and return a preview of the update without committing.

package/.claude/commands/drupal-upload-file-and-create-media.md

@@ -1,17 +1,17 @@
 ---
-description: "Convenience tool: upload a local file and immediately create a Media entity in one step. Best for the common 'add an image' workflow."
+description: "Convenience tool: upload a local file and immediately create a Media entity in one step. Best for the common 'add an image' workflow. Media defaults to unpublished."
 argument-hint: "<filePath> <mediaType> <fieldName> [site] [mediaName] [altText] [status]"
 allowed-tools: mcp__drupal__drupal_upload_file_and_create_media
 ---
 
 Call the `mcp__drupal__drupal_upload_file_and_create_media` MCP tool.
 
-Convenience tool: upload a local file and immediately create a Media entity in one step. Best for the common 'add an image' workflow.
+Convenience tool: upload a local file and immediately create a Media entity in one step. Best for the common 'add an image' workflow. Media defaults to unpublished.
 
 Parse the request in `$ARGUMENTS` into this tool's parameters:
 
 **Required:**
-- `filePath` (string): Absolute local path to the file
+- `filePath` (string): Local path to the file (must resolve under MCP_UPLOAD_ROOT or the connector working directory)
 - `mediaType` (string): Media type machine name, e.g. 'image'
 - `fieldName` (string): Source field machine name, e.g. 'field_media_image'
 
@@ -19,6 +19,6 @@ Parse the request in `$ARGUMENTS` into this tool's parameters:
 - `site` (string): omit for the default site
 - `mediaName` (string): Name for the media entity (defaults to filename)
 - `altText` (string): Alt text for image media
-- `status` (boolean (true/false))
+- `status` (boolean (true/false)): Published flag. Defaults to false. Requires allowPublish when true.
 
 If a required parameter is missing from `$ARGUMENTS`, ask before calling — do not invent values. Coerce each value to its JSON type (booleans → true/false, numbers → numeric, object/array → parse JSON), then make the single tool call and summarize the result.

package/.claude/commands/drupal-upload-file.md

@@ -11,7 +11,7 @@ Upload a local file to Drupal and create a File entity. Returns the file UUID to
 Parse the request in `$ARGUMENTS` into this tool's parameters:
 
 **Required:**
-- `filePath` (string): Absolute local path to the file to upload
+- `filePath` (string): Local path to the file (must resolve under MCP_UPLOAD_ROOT or the connector working directory)
 - `bundle` (string): Bundle machine name, e.g. 'image', 'article'
 - `fieldName` (string): Field machine name, e.g. 'field_media_image', 'field_image'
 

package/CHANGELOG.md

@@ -5,8 +5,67 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [2.1.0] - 2026-07-31
+
+### Security
+- **Specialized tools honor entity allowlists/denylists (#138).**
+  `drupal_*_node`, media, and taxonomy tools now call the same
+  `assertReadAllowed` / `assertWriteAllowed` / `assertDeleteAllowed` gates as
+  `drupal_entity_*`, so a denied type (e.g. `media`) cannot be reached by
+  switching tool names.
+- **Upload path allowlist and path segment hardening (#137).** File uploads
+  must resolve under `MCP_UPLOAD_ROOT` (or the connector cwd by default);
+  entity/bundle/field path segments are machine-name validated and encoded;
+  Content-Disposition filenames are sanitized. Sensitive paths (`.env*`,
+  `.ssh`, connector `config.json`) are refused even under an allowed root.
+- **Media no longer publishes by default (#139).** `drupal_create_media` and
+  upload-and-create default to `status: false` and honor `assertPublishAllowed`.
+  `moderation_state: published` and `drupal_set_moderation_state` to published
+  are treated as publish-bearing.
+- **HTTPS fails closed without auth when non-loopback (#141).** Binding beyond
+  loopback requires `MCP_AUTH_TOKEN` unless `MCP_ALLOW_UNAUTHENTICATED=1`.
+  Non-loopback HTTPS defaults to 120 req/min rate limiting when
+  `MCP_RATE_LIMIT` is unset.
+- **Link-checker does not follow redirects (#143).** Live checks use
+  `redirect: "manual"` to avoid SSRF via 302 to private/metadata targets.
+- **auditor / production-strict apply SENSITIVE_DENY** (partial #140). Secrets,
+  governance, and account entity types stay denied on those presets. Default
+  when `security` is omitted remains `development` (tracked in #140).
+
+### Fixed
+- **Published moderated updates default to a draft forward revision (#131).**
+  `drupal_update_node`, `drupal_bulk_update`, and `drupal_entity_update` now
+  sniff the target entity: when it is published under content_moderation and
+  the caller omitted `moderation_state` / `moderationState`, the write is sent
+  as `moderation_state: draft` instead of omitting the field. That keeps bulk
+  relationship-wiring and field edits as reviewable forward revisions rather
+  than live default-revision mutations if a server-side publish gate
+  mis-classifies the write. Callers that want a same-state save must pass an
+  explicit moderation state.
+
+### Added
+- **Provider-agnostic agent instructions.** Root `AGENTS.md` is the only
+  committed agent rule file (any coding agent). No vendor-specific
+  `.grok/` / `CLAUDE.md` / parallel rule trees. Generated slash stubs under
+  `.claude/commands/` remain client ergonomics for MCP operators, not project
+  development rules.
+
+### Documentation
+- Security, hardening, deployment, tools-reference, threat-model, and
+  architecture docs updated for the 2.1 controls (fail-closed HTTPS, upload
+  roots, publish/draft defaults, GraphQL policy caveat).
+
 ## [2.0.0] - 2026-07-29
 
+### Fixed
+- **Re-pushing a release tag no longer fails the publish job.** The workflow
+  now skips publishing a version already on the registry. Moving or recreating
+  a tag is a normal recovery operation, and npm's E403 "cannot publish over the
+  previously published version" reads as a broken release when the registry is
+  in exactly the state you wanted.
+
 ### Changed
 - **BREAKING: `drupal_drush_sql_query` no longer runs ungoverned SQL, and is off
   by default.** It called `drush sql:query`, which executes below Drupal's

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drupal-mcp-connector",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "description": "A secure, multi-site Model Context Protocol (MCP) connector for Drupal — dual-protocol JSON:API and GraphQL.",
   "type": "module",
   "main": "src/index.js",

package/scripts/generate-commands.js

@@ -8,6 +8,10 @@
  * `mcp__drupal__<tool>` and instructs the model to parse `$ARGUMENTS` into the
  * tool's parameters before making a single call.
  *
+ * These files are *client ergonomics* for operators using Claude Code as an MCP
+ * client against this server — not provider-specific project rules. Development
+ * instructions for any agent live only in AGENTS.md.
+ *
  * Driven from the same tool definitions as the server (src/tools/index.js), so the
  * command set never drifts from the tools. Run: `npm run generate:commands`.
  *

package/src/index.js

@@ -384,6 +384,7 @@ if (transport === "stdio") {
 
   const authToken   = process.env.MCP_AUTH_TOKEN || "";
   const checkAuth   = makeBearerCheck(authToken);
+  const allowUnauth = process.env.MCP_ALLOW_UNAUTHENTICATED === "1";
   if (!authToken) {
     console.error(
       "[drupal-mcp-connector] WARNING: the /mcp endpoint is UNAUTHENTICATED. " +
@@ -450,11 +451,33 @@ if (transport === "stdio") {
     return mcpTransport;
   }
 
-  // Optional fixed-window rate limiting on /mcp, keyed by client IP. Off unless
-  // MCP_RATE_LIMIT > 0. Counts are per-process; for multi-replica deployments
-  // prefer rate limiting at the reverse proxy.
-  const rateLimit     = Number(process.env.MCP_RATE_LIMIT || 0);
+  const hasTls   = Boolean(tlsCfg.certPath && tlsCfg.keyPath);
+  // Unauthenticated plain HTTP must never bind beyond loopback. A non-loopback
+  // bind is allowed only alongside TLS, via an explicit MCP_BIND_HOST opt-in.
+  const bindHost = hasTls ? (process.env.MCP_BIND_HOST || "0.0.0.0") : "127.0.0.1";
+  const isLoopbackBind = bindHost === "127.0.0.1" || bindHost === "::1" || bindHost === "localhost";
+
+  // #141: fail closed when HTTPS is network-facing without a bearer token.
+  // Loopback binds and explicit MCP_ALLOW_UNAUTHENTICATED=1 remain for local/proxy setups.
+  if (!authToken && !isLoopbackBind && !allowUnauth) {
+    console.error(
+      "[drupal-mcp-connector] FATAL: MCP_AUTH_TOKEN is required when binding beyond loopback.\n" +
+      "  Set MCP_AUTH_TOKEN, bind to 127.0.0.1 (default without MCP_BIND_HOST), or set\n" +
+      "  MCP_ALLOW_UNAUTHENTICATED=1 only behind a trusted auth boundary."
+    );
+    process.exit(1);
+  }
+
+  // Optional fixed-window rate limiting on /mcp, keyed by client IP.
+  // HTTPS non-loopback defaults to 120 req/min when MCP_RATE_LIMIT is unset (#141).
+  // Set MCP_RATE_LIMIT=0 to disable. Counts are per-process; multi-replica should
+  // also rate-limit at the reverse proxy.
   const rateWindowSec = Number(process.env.MCP_RATE_WINDOW_SEC || 60);
+  const rateLimitEnv  = process.env.MCP_RATE_LIMIT;
+  const rateLimitDefault = (hasTls && !isLoopbackBind) ? 120 : 0;
+  const rateLimit = rateLimitEnv === undefined || rateLimitEnv === ""
+    ? rateLimitDefault
+    : Number(rateLimitEnv);
   const rateLimiter   = rateLimit > 0
     ? createRateLimiter({ limit: rateLimit, windowMs: rateWindowSec * 1000 })
     : null;
@@ -474,11 +497,6 @@ if (transport === "stdio") {
 
   const nodeServer = createNodeServer(requestHandler);
 
-  const hasTls   = Boolean(tlsCfg.certPath && tlsCfg.keyPath);
-  // Unauthenticated plain HTTP must never bind beyond loopback. A non-loopback
-  // bind is allowed only alongside TLS, via an explicit MCP_BIND_HOST opt-in.
-  const bindHost = hasTls ? (process.env.MCP_BIND_HOST || "0.0.0.0") : "127.0.0.1";
-
   nodeServer.listen(port, bindHost, () => {
     const proto = hasTls ? "https" : "http";
     console.error(

package/src/lib/drupal-fetch.js

@@ -7,6 +7,11 @@ import { createReadStream, statSync } from "fs";
 import { basename } from "path";
 import { authHeadersAsync, clientHeaders } from "./config.js";
 import { clearToken } from "./oauth.js";
+import {
+  assertUploadPathAllowed,
+  sanitizeUploadFilename,
+  validateMachineName,
+} from "./validate.js";
 
 const JSON_API_CONTENT_TYPE = "application/vnd.api+json";
 
@@ -115,10 +120,15 @@ export async function drupalGraphqlFetch(site, body) {
  * @throws {Error} on any non-2xx response.
  */
 export async function drupalUploadFile(site, entityType, bundle, fieldName, filePath) {
-  const filename = basename(filePath);
-  // eslint-disable-next-line security/detect-non-literal-fs-filename -- filePath is a caller-supplied local upload path (validated upstream); fs access is the intended behavior
-  const stat = statSync(filePath);
-  const url = `${site.baseUrl}/jsonapi/${entityType}/${bundle}/${fieldName}`;
+  // #137: machine-name segments + path allowlist before any FS or network I/O.
+  validateMachineName(entityType, "entityType");
+  validateMachineName(bundle, "bundle");
+  validateMachineName(fieldName, "fieldName");
+  const safePath = assertUploadPathAllowed(filePath);
+  const filename = sanitizeUploadFilename(basename(safePath));
+  // eslint-disable-next-line security/detect-non-literal-fs-filename -- path allowlisted via assertUploadPathAllowed
+  const stat = statSync(safePath);
+  const url = `${site.baseUrl}/jsonapi/${encodeURIComponent(entityType)}/${encodeURIComponent(bundle)}/${encodeURIComponent(fieldName)}`;
 
   const res = await fetch(url, {
     method: "POST",
@@ -129,8 +139,8 @@ export async function drupalUploadFile(site, entityType, bundle, fieldName, file
       ...clientHeaders(),
       ...(await authHeadersAsync(site)),
     },
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- filePath is a caller-supplied local upload path (validated upstream); fs access is the intended behavior
-    body: createReadStream(filePath),
+    // eslint-disable-next-line security/detect-non-literal-fs-filename -- path allowlisted via assertUploadPathAllowed
+    body: createReadStream(safePath),
     // node-fetch requires explicit size for streams to set Content-Length
     size: stat.size,
   });

package/src/lib/link-checker.js

@@ -190,7 +190,9 @@ async function timedFetch(url, method, { timeoutMs, fetchImpl }) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
   try {
-    const res = await fetchImpl(url, { method, redirect: "follow", signal: controller.signal });
+    // #143: never auto-follow redirects — a public allowlisted host can 302 to
+    // private/metadata. Report the redirect status; do not chase Location.
+    const res = await fetchImpl(url, { method, redirect: "manual", signal: controller.signal });
     return { status: res.status, error: null };
   } catch (err) {
     const reason = err?.name === "AbortError" ? `timeout after ${timeoutMs}ms` : (err?.message || "request failed");

package/src/lib/moderation-default.js

@@ -0,0 +1,106 @@
+/**
+ * Safe draft default for updates of published, moderated entities (#131).
+ *
+ * When a PATCH targets a *published* entity under content_moderation and the
+ * caller did not pass an explicit `moderation_state`, the write can land on the
+ * live default revision if a server-side publish gate mis-classifies it as "no
+ * transition". Defaulting to `moderation_state: draft` forces a forward
+ * (reviewable) revision instead.
+ *
+ * Callers that genuinely want a same-state save on a published node must opt in
+ * by passing `moderation_state` (or the tool-level `moderationState`) explicitly.
+ *
+ * Detection is best-effort from the existing entity payload: the entity is
+ * treated as moderated when a `moderation_state` field is present on it, and as
+ * published when `status === true`. If the entity cannot be read, attributes
+ * are left unchanged (fail open for non-moderated bundles; server-side gate
+ * remains authoritative).
+ */
+
+/** Default moderation state applied when none was supplied for a published moderated entity. */
+export const SAFE_DRAFT_STATE = "draft";
+
+/**
+ * Whether a canonical entity exposes a content_moderation state field.
+ * @param {?object} entity Canonical entity (or null).
+ * @returns {boolean}
+ */
+export function entityLooksModerated(entity) {
+  if (!entity) return false;
+  if (entity.fields && Object.prototype.hasOwnProperty.call(entity.fields, "moderation_state")) {
+    return true;
+  }
+  // Tolerate a top-level promotion if a backend ever surfaces it that way.
+  return Object.prototype.hasOwnProperty.call(entity, "moderation_state");
+}
+
+/**
+ * Whether a canonical entity is currently published.
+ * @param {?object} entity Canonical entity (or null).
+ * @returns {boolean}
+ */
+export function isPublishedEntity(entity) {
+  return entity?.status === true;
+}
+
+/**
+ * Whether the write attributes already carry an explicit moderation state.
+ * @param {?object} attributes Attribute map about to be sent.
+ * @returns {boolean}
+ */
+export function hasExplicitModerationState(attributes) {
+  return Boolean(attributes && Object.prototype.hasOwnProperty.call(attributes, "moderation_state"));
+}
+
+/**
+ * Decide whether a draft default should be injected for this update.
+ * Pure helper — no I/O.
+ *
+ * @param {{attributes?: object, entity?: ?object}} input
+ * @returns {boolean}
+ */
+export function shouldDefaultPublishedUpdateToDraft({ attributes, entity }) {
+  if (hasExplicitModerationState(attributes)) return false;
+  if (!isPublishedEntity(entity)) return false;
+  if (!entityLooksModerated(entity)) return false;
+  return true;
+}
+
+/**
+ * Apply the safe draft default when updating a published moderated entity.
+ * Returns a new attributes object when a default is applied; otherwise returns
+ * the original attributes reference unchanged.
+ *
+ * @param {object} args
+ * @param {object} args.backend Backend with `getEntity`.
+ * @param {string} args.entityType
+ * @param {string} args.bundle
+ * @param {string} args.id Entity UUID.
+ * @param {object} [args.attributes={}] Attribute map for the write.
+ * @param {?object} [args.existingEntity] Pre-fetched entity; when omitted a get is issued.
+ * @returns {Promise<object>} Attributes to send (possibly with moderation_state: draft).
+ */
+export async function applySafeDraftDefault({
+  backend,
+  entityType,
+  bundle,
+  id,
+  attributes = {},
+  existingEntity,
+}) {
+  if (hasExplicitModerationState(attributes)) return attributes;
+
+  let entity = existingEntity;
+  if (entity === undefined) {
+    try {
+      entity = await backend.getEntity({ entityType, bundle, id });
+    } catch {
+      // Fail open: without a readable target we cannot sniff moderation.
+      return attributes;
+    }
+  }
+  if (!shouldDefaultPublishedUpdateToDraft({ attributes, entity })) {
+    return attributes;
+  }
+  return { ...attributes, moderation_state: SAFE_DRAFT_STATE };
+}

package/src/lib/security.js

@@ -175,7 +175,8 @@ const PRESETS = {
     allowConfigRead: true,            // read-only inspection of config
     allowConfigWrite: false,
     allowedEntityTypes: null,         // read any entity type
-    deniedEntityTypes: [],
+    // Secrets / governance / account entities stay denied even on broad read (#140).
+    deniedEntityTypes: [...SENSITIVE_DENY],
     entityRules: {
       user: {
         allowedOperations: ["read"],
@@ -192,7 +193,7 @@ const PRESETS = {
     allowConfigRead: false,           // nothing implicit; opt in per site
     allowConfigWrite: false,
     allowedEntityTypes: null,         // set an explicit allowlist in your config
-    deniedEntityTypes: ["user"],      // no user data at all
+    deniedEntityTypes: [...SENSITIVE_DENY], // includes user + secrets/governance
     entityRules: {},
     globalRedactedFields: ["pass", "mail", "field_private", "field_api_key", "field_token"],
   },
@@ -379,23 +380,33 @@ export function assertDestructiveAllowed(secConfig, entityType, id) {
 }
 
 /**
- * Whether a set of write attributes carries a publish action. Deliberately
- * limited to the unambiguous, entity-agnostic signal `status === true`; a site's
- * moderation-workflow state names are not knowable from a site-agnostic
- * connector, so publishing via `moderation_state` stays gated server-side.
+ * Whether a set of write attributes carries a publish action.
+ *
+ * Recognized signals:
+ *   - `status === true` (non-moderated publish)
+ *   - `moderation_state` equal to `"published"` (case-insensitive) — the common
+ *     core content_moderation publish state (#139)
+ *
+ * Other workflow state names are site-specific and remain server-gated.
  * @param {object} [attributes] Attribute map for the write.
  * @returns {boolean}
  */
 export function isPublishBearing(attributes = {}) {
-  return attributes?.status === true;
+  if (attributes?.status === true) return true;
+  // Common core content_moderation publish state. Site-specific publish state
+  // names remain server-gated; this closes the obvious connector-layer hole (#139).
+  const mod = attributes?.moderation_state;
+  if (typeof mod === "string" && mod.toLowerCase() === "published") return true;
+  return false;
 }
 
 /**
  * Local, fail-fast publish gate, symmetric with assertDestructiveAllowed. When
  * the connector is not permitted to publish (allowPublish false — the default in
- * every preset except `development`), a write carrying `status: true` is refused
- * before the round-trip, rather than being silently dropped by a moderated-bundle
- * retry or a server-side gate (see #111/#114). Client-side convenience only — the
+ * every preset except `development`), a write that is publish-bearing
+ * (`status: true` or `moderation_state: "published"`) is refused before the
+ * round-trip, rather than being silently dropped by a moderated-bundle retry or
+ * a server-side gate (see #111/#114/#139). Client-side convenience only — the
  * remote Drupal's own permissions remain the real authority.
  * @param {object} secConfig Resolved security config.
  * @param {object} [attributes] Attribute map for the write.
@@ -407,9 +418,8 @@ export function assertPublishAllowed(secConfig, attributes = {}) {
   if (isPublishBearing(attributes)) {
     throw new SecurityError(
       "Publishing is disabled for this connector (allowPublish: false). " +
-      "Blocked: a write carrying status:true. " +
-      "To enable, set security.allowPublish = true in your config; otherwise publish " +
-      "via an operator/server-gated path (e.g. a moderation transition)."
+      "Blocked: a write carrying status:true or moderation_state:published. " +
+      "To enable, set security.allowPublish = true in your config."
     );
   }
 }

package/src/lib/validate.js

@@ -8,6 +8,8 @@
  * coerce values in ways that could hide injection attempts.
  */
 
+import { existsSync, realpathSync } from "fs";
+import { basename, resolve, sep } from "path";
 import { SecurityError } from "./security.js";
 
 // ---------------------------------------------------------------------------
@@ -214,6 +216,120 @@ export function clampLimit(value, defaultVal = 20) {
   return Math.min(n, MAX_PAGE_LIMIT);
 }
 
+// ---------------------------------------------------------------------------
+// Local file upload path allowlist (#137 / audit C1)
+// ---------------------------------------------------------------------------
+//
+// Upload tools must not be able to read arbitrary process-readable files
+// (SSH keys, .env, connector config). Paths must resolve under an allowed
+// root. Default root is process.cwd(); operators expand with MCP_UPLOAD_ROOT
+// (colon- or semicolon-separated absolute paths).
+
+/**
+ * Resolve an absolute path, following symlinks when the target exists.
+ * @param {string} p Path to resolve.
+ * @returns {string} Canonical absolute path.
+ */
+function resolveExistingPath(p) {
+  const abs = resolve(p);
+  try {
+    // eslint-disable-next-line security/detect-non-literal-fs-filename -- operator-configured upload root or cwd
+    return realpathSync(abs);
+  } catch {
+    return abs;
+  }
+}
+
+/**
+ * Allowed upload roots. From MCP_UPLOAD_ROOT when set; otherwise process.cwd().
+ * @returns {string[]} Absolute root paths (realpath when possible).
+ */
+export function getUploadRoots() {
+  const raw = process.env.MCP_UPLOAD_ROOT;
+  if (raw && String(raw).trim()) {
+    return String(raw)
+      .split(/[:;]/)
+      .map((s) => s.trim())
+      .filter(Boolean)
+      .map(resolveExistingPath);
+  }
+  return [resolveExistingPath(process.cwd())];
+}
+
+/**
+ * Sanitize a filename for Content-Disposition (no CR/LF/quotes; bounded length).
+ * @param {string} name Raw filename (often basename of a path).
+ * @returns {string} Safe filename for the header.
+ */
+export function sanitizeUploadFilename(name) {
+  const base = basename(String(name || "upload"));
+  const cleaned = base
+    .replace(/[\r\n"\\]/g, "")
+    .replace(/[^\w.\- ()[\]]+/g, "_")
+    .replace(/^\.+/, "")
+    .slice(0, 200);
+  return cleaned || "upload.bin";
+}
+
+/**
+ * Whether a resolved path sits under a sensitive location that must never
+ * be uploaded even when it is inside an allowed root.
+ * @param {string} real Absolute real path.
+ * @returns {boolean}
+ */
+function isSensitiveUploadPath(real) {
+  const n = real.split(sep).join("/");
+  if (n.includes("/.ssh/") || n.endsWith("/.ssh") || n.includes("/.gnupg/")) return true;
+  const base = basename(real);
+  if (base === "id_rsa" || base === "id_ed25519" || base === "id_ecdsa" || base === "id_dsa") return true;
+  if (base.startsWith(".env")) return true;
+  if (n.endsWith("/config/config.json")) return true;
+  return false;
+}
+
+/**
+ * Validate that a local file path may be uploaded: exists, under an allowed
+ * root, and not a known secret path. Returns the resolved real path for use
+ * with fs streams.
+ *
+ * @param {string} filePath Caller-supplied path.
+ * @returns {string} Real absolute path safe to read for upload.
+ * @throws {Error} if the path is missing or not a string.
+ * @throws {SecurityError} if the path is outside roots or sensitive.
+ */
+export function assertUploadPathAllowed(filePath) {
+  if (typeof filePath !== "string" || !filePath.trim()) {
+    throw new Error("filePath must be a non-empty string.");
+  }
+  const abs = resolve(filePath);
+  // eslint-disable-next-line security/detect-non-literal-fs-filename -- path is caller-supplied; allowlist enforced after realpath
+  if (!existsSync(abs)) {
+    throw new Error(`Upload path does not exist: ${filePath}`);
+  }
+  let real;
+  try {
+    // eslint-disable-next-line security/detect-non-literal-fs-filename -- path is caller-supplied; allowlist enforced next
+    real = realpathSync(abs);
+  } catch {
+    throw new Error(`Upload path is not readable: ${filePath}`);
+  }
+  const roots = getUploadRoots();
+  const allowed = roots.some((root) => real === root || real.startsWith(root.endsWith(sep) ? root : root + sep));
+  if (!allowed) {
+    throw new SecurityError(
+      "Upload path is outside allowed roots. Set MCP_UPLOAD_ROOT to an absolute " +
+      "directory (or several, colon-separated), or place the file under the " +
+      `connector working directory. Denied: ${filePath}`
+    );
+  }
+  if (isSensitiveUploadPath(real)) {
+    throw new SecurityError(
+      "Upload of sensitive paths (SSH keys, .env*, connector config.json) is not allowed."
+    );
+  }
+  return real;
+}
+
 // ---------------------------------------------------------------------------
 // Field name sanitization (prevent crafted field names in JSON:API filters)
 // ---------------------------------------------------------------------------

package/src/tools/bulk.js

@@ -14,6 +14,7 @@
 import { getSiteConfig } from "../lib/config.js";
 import { resolveBackend } from "../lib/backends/index.js";
 import { resolveSecurityConfig, assertWriteAllowed, assertPublishAllowed } from "../lib/security.js";
+import { applySafeDraftDefault } from "../lib/moderation-default.js";
 
 /**
  * Normalize an unknown thrown value into a human-readable message.
@@ -67,6 +68,11 @@ async function bulkCreate({ site: siteName, entityType, bundle, items = [] }) {
  * each item is updated independently so the batch continues past failures. An
  * item missing an id is reported as a per-item failure rather than aborting.
  *
+ * Safe default (#131): each published moderated target without an explicit
+ * `moderation_state` is rewritten to `moderation_state: draft` before the
+ * PATCH, so bulk relationship-wiring and field edits become forward revisions
+ * rather than live default-revision mutations.
+ *
  * @param {object} args - { site?, entityType, bundle, items: [{ id, attributes?, relationships? }] }.
  * @returns {Promise<{results: object[], summary: {updated: number, failed: number}}>}
  *   Per-item { index, success, id? | error } plus a roll-up summary.
@@ -85,10 +91,14 @@ async function bulkUpdate({ site: siteName, entityType, bundle, items = [] }) {
     const item = rawItem || {};
     try {
       if (!item.id) throw new Error("Missing 'id' for update item");
-      assertPublishAllowed(sec, item.attributes ?? {});
+      const attributes = await applySafeDraftDefault({
+        backend, entityType, bundle, id: item.id,
+        attributes: item.attributes ?? {},
+      });
+      assertPublishAllowed(sec, attributes);
       const entity = await backend.updateEntity({
         entityType, bundle, id: item.id,
-        attributes: item.attributes ?? {},
+        attributes,
         relationships: item.relationships ?? {},
       });
       updated += 1;
@@ -130,7 +140,7 @@ export const definitions = [
   },
   {
     name: "drupal_bulk_update",
-    description: "Update many entities of a single type + bundle in one call. Permission is checked once; each item is updated independently, so the batch continues past individual failures (partial success). Each item requires an 'id' (UUID); items missing an id are reported as per-item failures. Returns per-item { index, success, id | error } and a summary { updated, failed }.",
+    description: "Update many entities of a single type + bundle in one call. Permission is checked once; each item is updated independently, so the batch continues past individual failures (partial success). Each item requires an 'id' (UUID); items missing an id are reported as per-item failures. Published moderated targets without an explicit attributes.moderation_state default to moderation_state 'draft' (forward revision) so bulk edits do not mutate live default revisions. Returns per-item { index, success, id | error } and a summary { updated, failed }.",
     inputSchema: {
       type: "object", required: ["entityType", "bundle", "items"],
       properties: {

package/src/tools/entities.js

@@ -11,6 +11,7 @@
 import { getSiteConfig } from "../lib/config.js";
 import { resolveBackend } from "../lib/backends/index.js";
 import { shapeWriteResponse, RETURNING_SCHEMA } from "../lib/entity-response.js";
+import { applySafeDraftDefault } from "../lib/moderation-default.js";
 import {
   resolveSecurityConfig, assertReadAllowed, assertWriteAllowed, assertDeleteAllowed, assertPublishAllowed,
   redactCanonicalEntity, getSecuritySummary,
@@ -70,6 +71,10 @@ async function createEntity({ site: siteName, entityType, bundle, attributes = {
 /**
  * Update an entity of any type/bundle (partial — only supplied fields are sent).
  *
+ * Safe default (#131): published moderated targets without an explicit
+ * `moderation_state` get `moderation_state: draft` so the write is a forward
+ * revision rather than a live default-revision mutation.
+ *
  * @param {object} args - { site?, entityType, bundle, id, attributes?, relationships? }.
  * @returns {Promise<object>} The updated entity descriptor.
  * @throws {SecurityError} If updating the type/bundle is not permitted.
@@ -78,10 +83,13 @@ async function updateEntity({ site: siteName, entityType, bundle, id, attributes
   const site = getSiteConfig(siteName);
   const sec = resolveSecurityConfig(site);
   assertWriteAllowed(sec, "update", entityType, bundle);
-  assertPublishAllowed(sec, attributes);
-  if (dryRun) return { dryRun: true, operation: "update", entityType, bundle, id, attributes, relationships };
   const backend = await resolveBackend(site);
-  return shapeWriteResponse(await backend.updateEntity({ entityType, bundle, id, attributes, relationships }), returning);
+  const safeAttributes = await applySafeDraftDefault({
+    backend, entityType, bundle, id, attributes,
+  });
+  assertPublishAllowed(sec, safeAttributes);
+  if (dryRun) return { dryRun: true, operation: "update", entityType, bundle, id, attributes: safeAttributes, relationships };
+  return shapeWriteResponse(await backend.updateEntity({ entityType, bundle, id, attributes: safeAttributes, relationships }), returning);
 }
 
 /**
@@ -222,7 +230,7 @@ export const definitions = [
   },
   {
     name: "drupal_entity_update",
-    description: "Update an existing entity of any Drupal entity type. Only include attributes/relationships you want to change.",
+    description: "Update an existing entity of any Drupal entity type. Only include attributes/relationships you want to change. Published moderated targets without an explicit attributes.moderation_state default to moderation_state 'draft' (forward revision).",
     inputSchema: {
       type: "object", required: ["entityType", "bundle", "id"],
       properties: {

package/src/tools/media.js

@@ -8,7 +8,10 @@
 
 import { getSiteConfig } from "../lib/config.js";
 import { resolveBackend } from "../lib/backends/index.js";
-import { resolveSecurityConfig, redactCanonicalEntity } from "../lib/security.js";
+import {
+  resolveSecurityConfig, redactCanonicalEntity,
+  assertReadAllowed, assertWriteAllowed, assertDeleteAllowed, assertPublishAllowed,
+} from "../lib/security.js";
 
 /**
  * List all media types (bundles of the media entity type).
@@ -17,6 +20,7 @@ import { resolveSecurityConfig, redactCanonicalEntity } from "../lib/security.js
  */
 async function listMediaTypes({ site: siteName }) {
   const site = getSiteConfig(siteName);
+  assertReadAllowed(resolveSecurityConfig(site), "media");
   const backend = await resolveBackend(site);
   return backend.listBundles("media");
 }
@@ -32,11 +36,13 @@ async function listMediaTypes({ site: siteName }) {
 async function listMedia({ site: siteName, type, status, name, limit = 20, offset = 0 }) {
   const site = getSiteConfig(siteName);
   const sec = resolveSecurityConfig(site);
+  const bundle = type || "image";
+  assertReadAllowed(sec, "media", bundle);
   const backend = await resolveBackend(site);
   const filters = [];
   if (status !== undefined) filters.push({ field: "status", op: "eq", value: status });
   if (name) filters.push({ field: "name", op: "contains", value: name });
-  const res = await backend.listEntities({ entityType: "media", bundle: type || "image", filters, sort: [{ field: "changed", dir: "desc" }], page: { limit, offset } });
+  const res = await backend.listEntities({ entityType: "media", bundle, filters, sort: [{ field: "changed", dir: "desc" }], page: { limit, offset } });
   const items = res.entities.map((e) => redactCanonicalEntity(e, sec, "media"));
   return { total: res.page?.total ?? items.length, approximate: res.approximate ?? false, offset, nextOffset: offset + items.length, media: items };
 }
@@ -49,6 +55,7 @@ async function listMedia({ site: siteName, type, status, name, limit = 20, offse
 async function getMedia({ site: siteName, type, id }) {
   const site = getSiteConfig(siteName);
   const sec = resolveSecurityConfig(site);
+  assertReadAllowed(sec, "media", type);
   const backend = await resolveBackend(site);
   const entity = await backend.getEntity({ entityType: "media", bundle: type, id });
   return entity ? redactCanonicalEntity(entity, sec, "media") : null;
@@ -56,15 +63,23 @@ async function getMedia({ site: siteName, type, id }) {
 
 /**
  * Create a media entity. Caller `fields` are spread into attributes; name and
- * status are layered on top.
+ * status are layered on top. Defaults to unpublished (`status: false`) so
+ * media is never auto-published under non-publishing presets (#139).
  *
  * @param {object} args - { site?, type, name, status?, fields? }.
  * @returns {Promise<object>} The created media descriptor.
  */
-async function createMedia({ site: siteName, type, name, status = true, fields = {} }) {
+async function createMedia({ site: siteName, type, name, status = false, fields = {} }) {
   const site = getSiteConfig(siteName);
+  const sec = resolveSecurityConfig(site);
+  assertWriteAllowed(sec, "create", "media", type);
+  const attributes = { name, status, ...fields };
+  // Layer name/status after fields so they win, matching prior behaviour.
+  attributes.name = name;
+  attributes.status = status;
+  assertPublishAllowed(sec, attributes);
   const backend = await resolveBackend(site);
-  return backend.createEntity({ entityType: "media", bundle: type, attributes: { name, status, ...fields } });
+  return backend.createEntity({ entityType: "media", bundle: type, attributes });
 }
 
 /**
@@ -74,10 +89,13 @@ async function createMedia({ site: siteName, type, name, status = true, fields =
  */
 async function updateMedia({ site: siteName, type, id, name, status, fields = {} }) {
   const site = getSiteConfig(siteName);
-  const backend = await resolveBackend(site);
+  const sec = resolveSecurityConfig(site);
+  assertWriteAllowed(sec, "update", "media", type);
   const attributes = { ...fields };
   if (name !== undefined) attributes.name = name;
   if (status !== undefined) attributes.status = status;
+  assertPublishAllowed(sec, attributes);
+  const backend = await resolveBackend(site);
   return backend.updateEntity({ entityType: "media", bundle: type, id, attributes });
 }
 
@@ -90,6 +108,7 @@ async function updateMedia({ site: siteName, type, id, name, status, fields = {}
  */
 async function deleteMedia({ site: siteName, type, id }) {
   const site = getSiteConfig(siteName);
+  assertDeleteAllowed(resolveSecurityConfig(site), "media", type, id);
   const backend = await resolveBackend(site);
   await backend.deleteEntity({ entityType: "media", bundle: type, id });
   return { success: true, deletedId: id };
@@ -104,6 +123,10 @@ async function deleteMedia({ site: siteName, type, id }) {
  */
 async function uploadFile({ site: siteName, filePath, entityType = "media", bundle, fieldName }) {
   const site = getSiteConfig(siteName);
+  const sec = resolveSecurityConfig(site);
+  // Host entity field write + file create (both required for JSON:API upload).
+  assertWriteAllowed(sec, "create", entityType, bundle);
+  assertWriteAllowed(sec, "create", "file");
   const backend = await resolveBackend(site);
   return backend.uploadFile({ entityType, bundle, fieldName, filePath });
 }
@@ -118,8 +141,14 @@ async function uploadFile({ site: siteName, filePath, entityType = "media", bund
  * @returns {Promise<{file: {id: string, filename: string}, media: object}>}
  * @throws {BackendCapabilityError} If the backend cannot upload files.
  */
-async function uploadFileAndCreateMedia({ site: siteName, filePath, mediaType, mediaName, fieldName, altText, status = true }) {
+async function uploadFileAndCreateMedia({ site: siteName, filePath, mediaType, mediaName, fieldName, altText, status = false }) {
   const site = getSiteConfig(siteName);
+  const sec = resolveSecurityConfig(site);
+  assertWriteAllowed(sec, "create", "media", mediaType);
+  assertWriteAllowed(sec, "create", "file");
+  const attributes = { name: mediaName || undefined, status };
+  // Gate publish before any upload I/O so a blocked publish does not leave an orphan file.
+  assertPublishAllowed(sec, attributes);
   const backend = await resolveBackend(site);
   const file = await backend.uploadFile({ entityType: "media", bundle: mediaType, fieldName, filePath });
   const fileData = altText
@@ -144,8 +173,9 @@ async function uploadFileAndCreateMedia({ site: siteName, filePath, mediaType, m
 async function findOrphanedMedia({ site: siteName, type, limit = 50 }) {
   const site = getSiteConfig(siteName);
   const sec = resolveSecurityConfig(site);
-  const backend = await resolveBackend(site);
   const bundle = type || "image";
+  assertReadAllowed(sec, "media", bundle);
+  const backend = await resolveBackend(site);
   const map = (res, method, note) => ({
     method, ...(note ? { note } : {}), count: res.entities.length,
     media: res.entities.map((e) => redactCanonicalEntity(e, sec, "media")),
@@ -208,7 +238,7 @@ export const definitions = [
         site:   { type: "string" },
         type:   { type: "string", description: "Media type machine name" },
         name:   { type: "string", description: "Media entity name / label" },
-        status: { type: "boolean", default: true },
+        status: { type: "boolean", default: false, description: "Published flag. Defaults to false (unpublished). Requires allowPublish when true." },
         fields: { type: "object", description: "Additional field values — include the source field (e.g. field_media_oembed_video: 'https://youtu.be/...')" },
       },
     },
@@ -247,7 +277,7 @@ export const definitions = [
       type: "object", required: ["filePath", "bundle", "fieldName"],
       properties: {
         site:       { type: "string" },
-        filePath:   { type: "string", description: "Absolute local path to the file to upload" },
+        filePath:   { type: "string", description: "Local path to the file (must resolve under MCP_UPLOAD_ROOT or the connector working directory)" },
         entityType: { type: "string", default: "media", description: "Drupal entity type (usually 'media' or 'node')" },
         bundle:     { type: "string", description: "Bundle machine name, e.g. 'image', 'article'" },
         fieldName:  { type: "string", description: "Field machine name, e.g. 'field_media_image', 'field_image'" },
@@ -256,17 +286,17 @@ export const definitions = [
   },
   {
     name: "drupal_upload_file_and_create_media",
-    description: "Convenience tool: upload a local file and immediately create a Media entity in one step. Best for the common 'add an image' workflow.",
+    description: "Convenience tool: upload a local file and immediately create a Media entity in one step. Best for the common 'add an image' workflow. Media defaults to unpublished.",
     inputSchema: {
       type: "object", required: ["filePath", "mediaType", "fieldName"],
       properties: {
         site:      { type: "string" },
-        filePath:  { type: "string", description: "Absolute local path to the file" },
+        filePath:  { type: "string", description: "Local path to the file (must resolve under MCP_UPLOAD_ROOT or the connector working directory)" },
         mediaType: { type: "string", description: "Media type machine name, e.g. 'image'" },
         mediaName: { type: "string", description: "Name for the media entity (defaults to filename)" },
         fieldName: { type: "string", description: "Source field machine name, e.g. 'field_media_image'" },
         altText:   { type: "string", description: "Alt text for image media" },
-        status:    { type: "boolean", default: true },
+        status:    { type: "boolean", default: false, description: "Published flag. Defaults to false. Requires allowPublish when true." },
       },
     },
   },

package/src/tools/moderation.js

@@ -16,7 +16,10 @@
 
 import { getSiteConfig } from "../lib/config.js";
 import { resolveBackend } from "../lib/backends/index.js";
-import { resolveSecurityConfig, assertReadAllowed, assertWriteAllowed, redactCanonicalEntity } from "../lib/security.js";
+import {
+  resolveSecurityConfig, assertReadAllowed, assertWriteAllowed, assertPublishAllowed,
+  redactCanonicalEntity,
+} from "../lib/security.js";
 
 /** Read a node's moderation_state from a canonical entity, tolerating shapes. */
 function moderationStateOf(entity) {
@@ -37,8 +40,10 @@ async function setModerationState({ site: siteName, type, id, state }) {
   const site = getSiteConfig(siteName);
   const sec = resolveSecurityConfig(site);
   assertWriteAllowed(sec, "update", "node", type);
+  const attributes = { moderation_state: state };
+  assertPublishAllowed(sec, attributes);
   const backend = await resolveBackend(site);
-  const entity = await backend.updateEntity({ entityType: "node", bundle: type, id, attributes: { moderation_state: state } });
+  const entity = await backend.updateEntity({ entityType: "node", bundle: type, id, attributes });
   return redactCanonicalEntity(entity, sec, "node");
 }
 

package/src/tools/nodes.js

@@ -9,7 +9,11 @@
 
 import { getSiteConfig } from "../lib/config.js";
 import { resolveBackend } from "../lib/backends/index.js";
-import { resolveSecurityConfig, redactCanonicalEntity, assertWriteAllowed, assertPublishAllowed } from "../lib/security.js";
+import {
+  resolveSecurityConfig, redactCanonicalEntity,
+  assertReadAllowed, assertWriteAllowed, assertDeleteAllowed, assertPublishAllowed,
+} from "../lib/security.js";
+import { applySafeDraftDefault } from "../lib/moderation-default.js";
 import { shapeWriteResponse, RETURNING_SCHEMA } from "../lib/entity-response.js";
 import { buildRedirectAttributes, REDIRECT_ENTITY_TYPE } from "./redirects.js";
 
@@ -156,6 +160,7 @@ function pageOf({ limit = 20, offset = 0 }) {
 async function getNode({ site: siteName, type, id }) {
   const site = getSiteConfig(siteName);
   const sec = resolveSecurityConfig(site);
+  assertReadAllowed(sec, "node", type);
   const backend = await resolveBackend(site);
   const entity = await backend.getEntity({ entityType: "node", bundle: type, id });
   return entity ? redactCanonicalEntity(entity, sec, "node") : null;
@@ -172,6 +177,7 @@ async function getNode({ site: siteName, type, id }) {
 async function listNodes({ site: siteName, type, status, filters = [], limit = 20, offset = 0, sort = [{ field: "changed", dir: "desc" }] }) {
   const site = getSiteConfig(siteName);
   const sec = resolveSecurityConfig(site);
+  assertReadAllowed(sec, "node", type);
   const backend = await resolveBackend(site);
   const allFilters = [...filters];
   if (status !== undefined) allFilters.push({ field: "status", op: "eq", value: status });
@@ -195,10 +201,12 @@ async function listNodes({ site: siteName, type, status, filters = [], limit = 2
 async function searchContent({ site: siteName, query, type, status, limit = 10 }) {
   const site = getSiteConfig(siteName);
   const sec = resolveSecurityConfig(site);
+  const bundle = type || "article";
+  assertReadAllowed(sec, "node", bundle);
   const backend = await resolveBackend(site);
   const filters = [{ field: "title", op: "contains", value: query }];
   if (status !== undefined) filters.push({ field: "status", op: "eq", value: status });
-  const res = await backend.listEntities({ entityType: "node", bundle: type || "article", filters, sort: [{ field: "changed", dir: "desc" }], page: { limit } });
+  const res = await backend.listEntities({ entityType: "node", bundle, filters, sort: [{ field: "changed", dir: "desc" }], page: { limit } });
   return res.entities.map((e) => redactCanonicalEntity(e, sec, "node"));
 }
 
@@ -225,6 +233,8 @@ async function searchContent({ site: siteName, query, type, status, limit = 10 }
  */
 async function createNode({ site: siteName, type, title, body, summary, status, moderationState, fields = {}, relationships = {}, dryRun = false, returning = "full" }) {
   const site = getSiteConfig(siteName);
+  const sec = resolveSecurityConfig(site);
+  assertWriteAllowed(sec, "create", "node", type);
   const attributes = { title, ...fields };
   if (moderationState !== undefined) {
     attributes.moderation_state = moderationState;
@@ -233,7 +243,7 @@ async function createNode({ site: siteName, type, title, body, summary, status,
   }
   const bodyAttr = buildBodyAttribute(body, summary);
   if (bodyAttr) attributes.body = bodyAttr;
-  assertPublishAllowed(resolveSecurityConfig(site), attributes);
+  assertPublishAllowed(sec, attributes);
   if (dryRun) return { dryRun: true, operation: "create", entityType: "node", bundle: type, attributes, relationships };
   const backend = await resolveBackend(site);
   // Alias handling: an explicit `path.alias` is set as a manual alias; otherwise
@@ -256,6 +266,11 @@ async function createNode({ site: siteName, type, title, body, summary, status,
  * bundles (sends `moderation_state`, omits `status`) or `status` for non-moderated
  * types. `moderationState` takes precedence; both are optional on update.
  *
+ * Safe default (#131): when the target is a *published* moderated node and the
+ * caller did not pass `moderationState` / `moderation_state`, the write is
+ * forced to `moderation_state: draft` so it becomes a forward revision rather
+ * than mutating the live default revision. Opt out by passing an explicit state.
+ *
  * Alias hardening: a partial update that doesn't touch `path` can still lose the
  * node's URL alias when a module (e.g. Pathauto, in automatic mode) regenerates
  * it on save. To preserve the existing alias, when the caller supplies no `path`
@@ -269,16 +284,22 @@ async function createNode({ site: siteName, type, title, body, summary, status,
  */
 async function updateNode({ site: siteName, type, id, title, body, summary, status, moderationState, fields = {}, relationships = {}, dryRun = false, returning = "full" }) {
   const site = getSiteConfig(siteName);
-  const attributes = { ...fields };
+  const sec = resolveSecurityConfig(site);
+  assertWriteAllowed(sec, "update", "node", type);
+  const backend = await resolveBackend(site);
+  let attributes = { ...fields };
   if (title !== undefined) attributes.title = title;
   if (moderationState !== undefined) attributes.moderation_state = moderationState;
   else if (status !== undefined) attributes.status = status;
   const bodyAttr = buildBodyAttribute(body, summary);
   if (bodyAttr) attributes.body = bodyAttr;
-  assertPublishAllowed(resolveSecurityConfig(site), attributes);
+  // #131: published moderated nodes without an explicit state → draft forward revision.
+  // Runs before the publish gate and on dryRun so previews match the real write.
+  attributes = await applySafeDraftDefault({
+    backend, entityType: "node", bundle: type, id, attributes,
+  });
+  assertPublishAllowed(sec, attributes);
   if (dryRun) return { dryRun: true, operation: "update", entityType: "node", bundle: type, id, attributes, relationships };
-  const backend = await resolveBackend(site);
-  const sec = resolveSecurityConfig(site);
   // Alias handling (DEV-116): an explicit `path.alias` is set in place by
   // round-tripping the existing alias's pid (no duplicate); a path-less update
   // re-pins the current alias *with its pid* so the save can't revert/duplicate
@@ -304,6 +325,8 @@ async function updateNode({ site: siteName, type, id, title, body, summary, stat
  */
 async function deleteNode({ site: siteName, type, id, dryRun = false }) {
   const site = getSiteConfig(siteName);
+  const sec = resolveSecurityConfig(site);
+  assertDeleteAllowed(sec, "node", type, id);
   if (dryRun) return { dryRun: true, operation: "delete", entityType: "node", bundle: type, id };
   const backend = await resolveBackend(site);
   await backend.deleteEntity({ entityType: "node", bundle: type, id });
@@ -379,7 +402,7 @@ export const definitions = [
   },
   {
     name: "drupal_update_node",
-    description: "Update an existing node. Only include fields you want to change. For moderated content types, use moderationState (e.g. 'published') rather than status. Entity-reference fields go in `relationships`, not `fields`.",
+    description: "Update an existing node. Only include fields you want to change. For moderated content types, use moderationState (e.g. 'published') rather than status. When the target is published and moderated and you omit moderationState, the connector defaults the write to moderation_state 'draft' (forward revision) so live default revisions are not mutated by accident. Entity-reference fields go in `relationships`, not `fields`.",
     inputSchema: {
       type: "object", required: ["type", "id"],
       properties: {
@@ -390,7 +413,7 @@ export const definitions = [
         body:    { type: "string" },
         summary: { type: "string" },
         status:  { type: "boolean", description: "Published flag for NON-moderated types: true = publish, false = unpublish. Ignored if moderationState is set." },
-        moderationState: { type: "string", description: "Moderation state transition for content_moderation types, e.g. 'draft', 'published', 'archived'. Takes precedence over status." },
+        moderationState: { type: "string", description: "Moderation state transition for content_moderation types, e.g. 'draft', 'published', 'archived'. Takes precedence over status. Required to keep or re-publish a live node — omitting it on a published moderated node defaults the write to 'draft'." },
         fields:  { type: "object", description: "Scalar/attribute field values keyed by machine name. Entity-reference fields go in `relationships`, not here." },
         relationships: { type: "object", description: "Entity-reference fields as JSON:API relationships, keyed by field machine name. Single-value uses { data: { type, id } }; multi-value uses { data: [{ type, id }, …] }." },
         dryRun:  { type: "boolean", default: false, description: "Validate and return a preview of the update without committing." },

package/src/tools/taxonomy.js

@@ -8,7 +8,10 @@
 
 import { getSiteConfig } from "../lib/config.js";
 import { resolveBackend } from "../lib/backends/index.js";
-import { resolveSecurityConfig, redactCanonicalEntity } from "../lib/security.js";
+import {
+  resolveSecurityConfig, redactCanonicalEntity,
+  assertReadAllowed, assertWriteAllowed, assertDeleteAllowed,
+} from "../lib/security.js";
 
 // ---------------------------------------------------------------------------
 // Implementations
@@ -22,6 +25,7 @@ import { resolveSecurityConfig, redactCanonicalEntity } from "../lib/security.js
  */
 async function listVocabularies({ site: siteName }) {
   const site = getSiteConfig(siteName);
+  assertReadAllowed(resolveSecurityConfig(site), "taxonomy_term");
   const backend = await resolveBackend(site);
   return backend.listBundles("taxonomy_term");
 }
@@ -35,6 +39,7 @@ async function listVocabularies({ site: siteName }) {
 async function getTaxonomyTerms({ site: siteName, vocabulary, limit = 50, offset = 0 }) {
   const site = getSiteConfig(siteName);
   const sec = resolveSecurityConfig(site);
+  assertReadAllowed(sec, "taxonomy_term", vocabulary);
   const backend = await resolveBackend(site);
   const res = await backend.listEntities({
     entityType: "taxonomy_term", bundle: vocabulary,
@@ -56,6 +61,7 @@ async function getTaxonomyTerms({ site: siteName, vocabulary, limit = 50, offset
 async function getTaxonomyTerm({ site: siteName, vocabulary, id }) {
   const site = getSiteConfig(siteName);
   const sec = resolveSecurityConfig(site);
+  assertReadAllowed(sec, "taxonomy_term", vocabulary);
   const backend = await resolveBackend(site);
   const entity = await backend.getEntity({ entityType: "taxonomy_term", bundle: vocabulary, id });
   return entity ? redactCanonicalEntity(entity, sec, "taxonomy_term") : null;
@@ -70,6 +76,7 @@ async function getTaxonomyTerm({ site: siteName, vocabulary, id }) {
  */
 async function createTaxonomyTerm({ site: siteName, vocabulary, name, description, weight = 0, parentId }) {
   const site = getSiteConfig(siteName);
+  assertWriteAllowed(resolveSecurityConfig(site), "create", "taxonomy_term", vocabulary);
   const backend = await resolveBackend(site);
   const attributes = { name, weight };
   if (description !== undefined) attributes.description = { value: description, format: "plain_text" };
@@ -88,6 +95,7 @@ async function createTaxonomyTerm({ site: siteName, vocabulary, name, descriptio
  */
 async function updateTaxonomyTerm({ site: siteName, vocabulary, id, name, description, weight }) {
   const site = getSiteConfig(siteName);
+  assertWriteAllowed(resolveSecurityConfig(site), "update", "taxonomy_term", vocabulary);
   const backend = await resolveBackend(site);
   const attributes = {};
   if (name !== undefined) attributes.name = name;
@@ -105,6 +113,7 @@ async function updateTaxonomyTerm({ site: siteName, vocabulary, id, name, descri
  */
 async function deleteTaxonomyTerm({ site: siteName, vocabulary, id }) {
   const site = getSiteConfig(siteName);
+  assertDeleteAllowed(resolveSecurityConfig(site), "taxonomy_term", vocabulary, id);
   const backend = await resolveBackend(site);
   await backend.deleteEntity({ entityType: "taxonomy_term", bundle: vocabulary, id });
   return { success: true, deletedId: id };