drupal-mcp-connector 2.1.1 → 2.2.1

package/.claude/commands/drupal-create-node.md

@@ -1,6 +1,6 @@
 ---
 description: "Create a new content node. Returns the new node UUID, integer ID, and URL. For content types under an editorial (content_moderation) workflow, set moderationState (e.g. 'draft'/'published') instead of status. Entity-reference fields (taxonomy terms, related content, media) go in `relationships`, not `fields`."
-argument-hint: "<type> <title> [site] [body] [summary] [status] [moderationState] [fields] [relationships] [dryRun] [returning]"
+argument-hint: "<type> <title> [site] [body] [summary] [format] [status] [moderationState] [fields] [relationships] [dryRun] [returning]"
 allowed-tools: mcp__drupal__drupal_create_node
 ---
 
@@ -17,7 +17,8 @@ Parse the request in `$ARGUMENTS` into this tool's parameters:
 **Optional:**
 - `site` (string): omit for the default site
 - `body` (string): Body field HTML
-- `summary` (string): Body summary / teaser
+- `summary` (string): Body summary/teaser — writes the `summary` property of the body field (core `text_with_summary`). Many headless sites instead use a dedicated summary/deck field for teasers and meta descriptions; on those, set that field in `fields` — a value written here will be stored but may never be rendered.
+- `format` (string): Text format machine name for the body, e.g. 'basic_html'. Defaults to the site config's `defaultTextFormat`, then 'full_html'. Set this when the site's formats do not include full_html, or to avoid writing content into a more permissive format than intended.
 - `status` (boolean (true/false)): Published flag for NON-moderated types. true to publish immediately. Ignored if moderationState is set; on a moderated type it is dropped automatically.
 - `moderationState` (string): Moderation state for content_moderation types, e.g. 'draft' or 'published'. Takes precedence over status.
 - `fields` (object (pass as JSON)): Scalar/attribute field values keyed by Drupal machine name. Do NOT put entity-reference fields here — Drupal rejects them as attributes; use `relationships`.

package/.claude/commands/drupal-graphql-introspect.md

@@ -1,12 +1,12 @@
 ---
-description: "Introspect the Drupal GraphQL schema. Omit typeName for a full schema overview; provide typeName to get detailed fields and args for a specific type."
+description: "Introspect the Drupal GraphQL schema. Omit typeName for a full schema overview; provide typeName to get detailed fields and args for a specific type. Requires security.allowGraphql (off outside the development preset by default)."
 argument-hint: "[site] [typeName]"
 allowed-tools: mcp__drupal__drupal_graphql_introspect
 ---
 
 Call the `mcp__drupal__drupal_graphql_introspect` MCP tool.
 
-Introspect the Drupal GraphQL schema. Omit typeName for a full schema overview; provide typeName to get detailed fields and args for a specific type.
+Introspect the Drupal GraphQL schema. Omit typeName for a full schema overview; provide typeName to get detailed fields and args for a specific type. Requires security.allowGraphql (off outside the development preset by default).
 
 Parse the request in `$ARGUMENTS` into this tool's parameters:
 

package/.claude/commands/drupal-graphql.md

@@ -1,5 +1,5 @@
 ---
-description: "Execute a GraphQL query against a Drupal site. Requires the GraphQL Compose module (drupal.org/project/graphql_compose), which exposes a read-only schema; mutations are gated by \"allowGraphqlMutations\". Use drupal_graphql_introspect first to discover available types and fields. Example query: query GetArticle($id: String!) { nodeById(id: $id) { title ... on NodeArticle { body { value } } } } Example mutation (only if your GraphQL Compose schema enables mutations): mutation CreateArticle($title: String!, $body: String!) { createNodeArticle(data: { title: $title, body: { value: $body, format: \"full_html\" } }) { entity { title uuid } errors { message } } }"
+description: "Execute a GraphQL query against a Drupal site. Requires the GraphQL Compose module (drupal.org/project/graphql_compose), which exposes a read-only schema. GraphQL is off unless security.allowGraphql is true (development preset only by default) because raw results bypass entity allowlists and field redaction. Mutations also require allowGraphqlMutations. Use drupal_graphql_introspect first to discover available types and fields. Example query: query GetArticle($id: String!) { nodeById(id: $id) { title ... on NodeArticle { body { value } } } } Example mutation (only if your GraphQL Compose schema enables mutations): mutation CreateArticle($title: String!, $body: String!) { createNodeArticle(data: { title: $title, body: { value: $body, format: \"full_html\" } }) { entity { title uuid } errors { message } } }"
 argument-hint: "<query> [site] [variables] [operationName]"
 allowed-tools: mcp__drupal__drupal_graphql
 ---
@@ -8,7 +8,9 @@ Call the `mcp__drupal__drupal_graphql` MCP tool.
 
 Execute a GraphQL query against a Drupal site.
 Requires the GraphQL Compose module (drupal.org/project/graphql_compose), which
-exposes a read-only schema; mutations are gated by "allowGraphqlMutations".
+exposes a read-only schema. GraphQL is off unless security.allowGraphql is true
+(development preset only by default) because raw results bypass entity allowlists
+and field redaction. Mutations also require allowGraphqlMutations.
 Use drupal_graphql_introspect first to discover available types and fields.
 
 Example query:

package/.claude/commands/drupal-update-node.md

@@ -1,6 +1,6 @@
 ---
 description: "Update an existing node. Only include fields you want to change. For moderated content types, use moderationState (e.g. 'published') rather than status. When the target is published and moderated and you omit moderationState, the connector defaults the write to moderation_state 'draft' (forward revision) so live default revisions are not mutated by accident. Entity-reference fields go in `relationships`, not `fields`."
-argument-hint: "<type> <id> [site] [title] [body] [summary] [status] [moderationState] [fields] [relationships] [dryRun] [returning]"
+argument-hint: "<type> <id> [site] [title] [body] [summary] [format] [status] [moderationState] [fields] [relationships] [dryRun] [returning]"
 allowed-tools: mcp__drupal__drupal_update_node
 ---
 
@@ -18,7 +18,8 @@ Parse the request in `$ARGUMENTS` into this tool's parameters:
 - `site` (string): omit for the default site
 - `title` (string)
 - `body` (string)
-- `summary` (string)
+- `summary` (string): Body summary/teaser — writes the `summary` property of the body field (core `text_with_summary`). Many headless sites instead use a dedicated summary/deck field for teasers and meta descriptions; on those, set that field in `fields` — a value written here will be stored but may never be rendered.
+- `format` (string): Text format machine name for the body, e.g. 'basic_html'. Defaults to the site config's `defaultTextFormat`, then 'full_html'. Set this when the site's formats do not include full_html, or to avoid writing content into a more permissive format than intended.
 - `status` (boolean (true/false)): Published flag for NON-moderated types: true = publish, false = unpublish. Ignored if moderationState is set.
 - `moderationState` (string): Moderation state transition for content_moderation types, e.g. 'draft', 'published', 'archived'. Takes precedence over status. Required to keep or re-publish a live node — omitting it on a published moderated node defaults the write to 'draft'.
 - `fields` (object (pass as JSON)): Scalar/attribute field values keyed by machine name. Entity-reference fields go in `relationships`, not here.

package/CHANGELOG.md

@@ -7,6 +7,80 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.2.1] - 2026-08-02
+
+### Fixed
+- **The body text format is no longer hardcoded to `full_html`.** Node writes
+  that used the `body` convenience parameter always sent `format: "full_html"`,
+  so the connector could not write a body at all on a site whose text formats
+  omit it — and on sites that do define it, content was silently written into
+  the most permissive core format. Writes now resolve the format explicitly: a
+  new per-call `format` argument, then the site config's `defaultTextFormat`,
+  then `full_html` as the unchanged last-resort fallback. A text format is
+  Drupal's HTML-filtering boundary, so it should be a decision rather than an
+  assumption.
+- **A body-only update no longer blanks an existing body summary.** The body
+  descriptor set `summary: ""` whenever no summary was supplied, so updating
+  just the body erased the summary as a side effect. The property is now sent
+  only when the caller supplies it; passing `summary: ""` still clears it
+  deliberately.
+
+### Changed
+- **`summary` documents what it actually targets.** The parameter writes the
+  `summary` property of the core `text_with_summary` body field. Headless sites
+  commonly use a dedicated summary/deck field for teasers and meta descriptions
+  instead; on those, the value written here is stored but may never be rendered.
+  Both node tools now say so, and point at `fields` for the dedicated field.
+
+### Added
+- **`@claude` GitHub Action (inline).** Maintainers can tag `@claude` on an
+  issue or PR and Claude acts on the repo and opens a PR. Only
+  owner/member/collaborator authors trigger it; bot actors are excluded; the
+  job runs on `ubuntu-latest`, stops at opening a PR, and adds no AI
+  attribution. Inert until the Claude GitHub App is installed and the
+  `CLAUDE_CODE_OAUTH_TOKEN` org secret is made visible to this repo.
+- **CI: No AI attribution gate.** Pull requests fail when commits, the
+  PR title, or the PR body credit AI with authorship (shared Wilkes & Liberty
+  drop-in). Covers server-side paths that local hooks cannot see.
+
+### Changed
+- **CI: the attribution gate reads its scripts from the base commit.** A
+  pull request can no longer supply the code that decides whether it passes.
+
+### Fixed
+- **CI: the `@claude` workflow can fetch its OIDC token.** The action exchanges
+  a GitHub OIDC token for its app credentials in every auth mode; without
+  `id-token: write` the first activation run failed before reaching Claude.
+- **CI: the attribution gate no longer fails on clean commits.** The stripper
+  compared each commit message against a copy that had gained a trailing newline,
+  so every commit looked modified and the run ended with `strip count > 0 but tip
+  unchanged`.
+
+
+## [2.2.0] - 2026-07-30
+
+### Security
+- **Default security preset is `production-strict` (#140).** Omitting `security`
+  or passing `{}` no longer opens the site under the `development` preset.
+  Local and integration work must set `"preset": "development"` (or another
+  explicit preset) deliberately. Migration: add
+  `"security": { "preset": "development" }` to any site config that relied on
+  the old open default.
+- **GraphQL tools fail closed (#142).** `drupal_graphql` and
+  `drupal_graphql_introspect` require `security.allowGraphql` (true only on the
+  `development` preset). Mutations still need `allowGraphqlMutations` as well.
+  When GraphQL is opted in, results remain raw (no entity allowlist/redaction
+  on that path); prefer JSON:API entity tools for policy-bound reads.
+- **Dependency advisories cleared (#128).** Bump
+  `@modelcontextprotocol/sdk` to `^1.30.0` and pin overrides for
+  `@hono/node-server` `^2.0.5` and `postcss` `^8.5.18` so `npm audit` reports
+  zero vulnerabilities.
+
+### Documentation
+- README, security guide, threat model, architecture, tools reference, and
+  SECURITY.md updated for the secure default, GraphQL gate, and residual-risk
+  table.
+
 ## [2.1.1] - 2026-07-31
 
 ### Documentation

package/README.md

@@ -44,6 +44,13 @@ Each site declares which backend(s) it exposes via the `api` key:
   `{ id, entityType, bundle, title, status, langcode, created, changed, url, fields, relationships, _backend }`, so tool output is identical regardless of protocol.
 - **Capability-aware.** Each backend advertises what it supports (read, write, delete, server-side filter/sort, revisions). GraphQL via GraphQL Compose is **read-only** (no mutations) and has no server-side field filter, so filters are applied client-side over a bounded fetch and flagged `approximate`/`truncated`. Write tools against a read-only backend return a clear capability error rather than failing silently.
 - **Writes go through JSON:API.** Use a JSON:API-enabled site as the write plane; keep GraphQL as a read plane where that suits your architecture.
+- **`defaultTextFormat` sets the body text format** used by the `body` convenience
+  parameter on node writes, e.g. `{ "baseUrl": "…", "defaultTextFormat": "basic_html" }`.
+  Individual calls can override it with `format`. Without either, the connector falls
+  back to `full_html`, which many governed sites deliberately do not define — and which
+  is the most permissive core format, so setting this per site is the safer posture. A
+  text format is Drupal's HTML-filtering boundary, so it is worth choosing deliberately
+  rather than inheriting.
 
 See **[docs/architecture.md](docs/architecture.md)** for the backend abstraction and **[docs/graphql-local-setup.md](docs/graphql-local-setup.md)** for the GraphQL specifics.
 
@@ -127,9 +134,9 @@ prompts above.
 ### Security Model
 
 Defense-in-depth presets, enforced connector-side and complemented by Drupal-side
-governance (MCP Sentinel). **Set an explicit preset on every non-dev site** —
-if `security` is omitted, the connector still defaults to `development` (tracked
-for change in issue #140).
+governance (MCP Sentinel). **Default when `security` is omitted:**
+`production-strict` (read-only, sensitive types denied). Local development must
+set `"preset": "development"` explicitly.
 
 ```json
 "security": { "preset": "auditor" }
@@ -137,20 +144,20 @@ for change in issue #140).
 
 | Preset | What it does |
 |--------|-------------|
-| `development` | Everything allowed — local development only |
+| `development` | Everything allowed, including GraphQL — local development only |
 | `content-editor` | Create/edit content + structural entities; no deletes; no publishing; secrets/governance/account types denied |
 | `config-editor` | content-editor + site-building config read + governed config write (developer tier) |
 | `auditor` | Read-only; secrets/governance/account types denied; user PII redacted when user is allowed |
-| `production-strict` | Read-only; same sensitive denylist as auditor; broad PII field redaction |
-| `write-plane` | Create/update content set for agents; no deletes; no GraphQL mutations; publish off by default |
+| `production-strict` | Read-only; same sensitive denylist as auditor; broad PII field redaction (**default**) |
+| `write-plane` | Create/update content set for agents; no deletes; no GraphQL; publish off by default |
 
-Additional connector-side gates (2.1+):
+Additional connector-side gates (2.1+ / 2.2+):
 
 - **Entity allowlists** apply to specialized tools (`drupal_*_node`, media, taxonomy), not only `drupal_entity_*`.
 - **Publish gate:** `status: true` and `moderation_state: "published"` require `allowPublish`. Media create defaults **unpublished**. Published moderated node updates without a moderation state default to **draft** (forward revision).
 - **Uploads** only from `MCP_UPLOAD_ROOT` (or the process cwd); sensitive paths (`.env*`, `.ssh`, connector `config.json`) are refused.
 - **HTTPS:** non-loopback binds require `MCP_AUTH_TOKEN` (or `MCP_ALLOW_UNAUTHENTICATED=1` behind a trusted proxy); non-loopback TLS defaults to 120 req/min rate limiting.
-- **GraphQL caveat:** `drupal_graphql` returns raw query data — connector allowlists/redaction do not apply to that path (issue #142).
+- **GraphQL is off by default.** `drupal_graphql` / introspect require `security.allowGraphql` (true only on the `development` preset). Raw GraphQL results still bypass entity allowlists and field redaction — prefer JSON:API entity tools when connector policy must hold. Mutations also need `allowGraphqlMutations`.
 
 Full detail: **[docs/security.md](docs/security.md)** and **[docs/security-hardening.md](docs/security-hardening.md)**.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drupal-mcp-connector",
-  "version": "2.1.1",
+  "version": "2.2.1",
   "description": "A secure, multi-site Model Context Protocol (MCP) connector for Drupal — dual-protocol JSON:API and GraphQL.",
   "type": "module",
   "main": "src/index.js",
@@ -58,16 +58,20 @@
     "syntax-check": "for f in src/lib/*.js src/tools/*.js src/index.js; do node --input-type=module --check < $f && echo \"$f ✓\"; done"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.0.0",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "graphql": "^17.0.0",
     "node-fetch": "^3.3.2",
     "ssh2": "^1.16.0"
   },
   "devDependencies": {
     "eslint": "^10.4.1",
-    "eslint-plugin-security": "^4.0.0",
     "eslint-plugin-n": "^18.1.0",
+    "eslint-plugin-security": "^4.0.0",
     "globals": "^17.6.0",
     "vitest": "^4.1.8"
+  },
+  "overrides": {
+    "@hono/node-server": "^2.0.5",
+    "postcss": "^8.5.18"
   }
 }

package/src/lib/security.js

@@ -12,13 +12,14 @@ import { parse } from "graphql";
  *
  * ─── Quick presets ────────────────────────────────────────────────────────
  *
- *   "preset": "development"        Everything allowed. Default if no security key.
+ *   "preset": "development"        Everything allowed. Opt-in only — set explicitly.
  *   "preset": "content-editor"     Create/edit content (nodes, media, terms, paragraphs, blocks,
  *                                  menu links, redirects, aliases, files). No deletes. Config read-only.
  *   "preset": "config-editor"      content-editor + site-building config READ + governed config
  *                                  read/write (Developer tier). Model changes go via the config bridge.
- *   "preset": "auditor"            Read-only. All entity types. User fields redacted.
- *   "preset": "production-strict"  Read-only. Explicit allowlist required. Redacts PII.
+ *   "preset": "auditor"            Read-only. Sensitive entity types denied. User fields redacted.
+ *   "preset": "production-strict"  Read-only. Sensitive types denied. Redacts PII. **Default** when
+ *                                  security is omitted or has no preset (#140).
  *   "preset": "write-plane"        Governed writes (no delete/mutations) on the content set
  *                                  (node, term, media + structural content entities).
  *
@@ -31,7 +32,8 @@ import { parse } from "graphql";
  *
  *  readOnly            true  → reject all create/update/delete/graphql-mutation calls
  *  allowDestructive    false → reject all delete operations
- *  allowPublish        false → reject a write carrying status:true (publishing)
+ *  allowPublish        false → reject a write carrying status:true / moderation_state:published
+ *  allowGraphql        false → reject drupal_graphql + introspect (raw GraphQL is policy-free, #142)
  *  allowGraphqlMutations false → reject drupal_graphql when mutation is detected
  *  allowConfigRead     false → reject drupal_config_get / drupal_config_list
  *  allowConfigWrite    false → reject drupal_config_set
@@ -118,6 +120,7 @@ const PRESETS = {
     readOnly: false,
     allowDestructive: true,
     allowPublish: true,               // mirrors allowDestructive: everything allowed
+    allowGraphql: true,               // raw GraphQL allowed only in open mode (#142)
     allowGraphqlMutations: true,
     allowConfigRead: true,
     allowConfigWrite: true,
@@ -130,6 +133,7 @@ const PRESETS = {
   "content-editor": {
     readOnly: false,
     allowDestructive: false,          // no deletes
+    allowGraphql: false,              // freeform GraphQL bypasses entity denylists (#142)
     allowGraphqlMutations: false,
     allowConfigRead: true,            // config read-only
     allowConfigWrite: false,
@@ -151,6 +155,7 @@ const PRESETS = {
     // The Drupal-side governance layer remains authoritative; this is defence in depth.
     readOnly: false,
     allowDestructive: false,          // no deletes
+    allowGraphql: false,
     allowGraphqlMutations: false,
     allowConfigRead: true,
     allowConfigWrite: true,           // governed config writes via drupal_config_set
@@ -171,6 +176,7 @@ const PRESETS = {
   auditor: {
     readOnly: true,
     allowDestructive: false,
+    allowGraphql: false,
     allowGraphqlMutations: false,
     allowConfigRead: true,            // read-only inspection of config
     allowConfigWrite: false,
@@ -189,6 +195,7 @@ const PRESETS = {
   "production-strict": {
     readOnly: true,
     allowDestructive: false,
+    allowGraphql: false,
     allowGraphqlMutations: false,
     allowConfigRead: false,           // nothing implicit; opt in per site
     allowConfigWrite: false,
@@ -203,6 +210,7 @@ const PRESETS = {
     // Drupal-side governance layer remains authoritative; this is defence in depth.
     readOnly: false,
     allowDestructive: false,          // no deletes
+    allowGraphql: false,              // JSON:API write plane; GraphQL is policy-free (#142)
     allowGraphqlMutations: false,     // writes go through the JSON:API plane
     allowConfigRead: true,            // config read-only
     allowConfigWrite: false,
@@ -225,15 +233,22 @@ const PRESETS = {
  * @param {object} site Site config (reads site.security).
  * @returns {object} Effective security config used by the assert/redact helpers.
  */
+/** Default when `security.preset` is omitted — least privilege, not open mode (#140). */
+export const DEFAULT_SECURITY_PRESET = "production-strict";
+
 export function resolveSecurityConfig(site) {
   const raw = site.security ?? {};
-  const preset = PRESETS[raw.preset ?? "development"] ?? PRESETS.development;
+  // Explicit preset wins; bare {} / missing security → production-strict (#140).
+  // Open mode requires `preset: "development"` (or another named preset).
+  const presetName = raw.preset ?? DEFAULT_SECURITY_PRESET;
+  const preset = PRESETS[presetName] ?? PRESETS[DEFAULT_SECURITY_PRESET];
 
   // Merge: explicit keys in site.security override the preset
   return {
     readOnly:              raw.readOnly              ?? preset.readOnly,
     allowDestructive:      raw.allowDestructive      ?? preset.allowDestructive,
     allowPublish:          raw.allowPublish          ?? preset.allowPublish          ?? false,
+    allowGraphql:          raw.allowGraphql          ?? preset.allowGraphql          ?? false,
     allowGraphqlMutations: raw.allowGraphqlMutations ?? preset.allowGraphqlMutations,
     allowConfigRead:       raw.allowConfigRead       ?? preset.allowConfigRead       ?? false,
     allowConfigWrite:      raw.allowConfigWrite      ?? preset.allowConfigWrite      ?? false,
@@ -450,7 +465,30 @@ function graphqlHasMutation(query) {
  * @returns {void} No-op for read-only (query) documents.
  * @throws {SecurityError} if the document is a mutation and writes/mutations are disabled.
  */
+/**
+ * Gate GraphQL queries and schema introspection. Freeform GraphQL returns raw
+ * data that does not pass through entity allowlists or field redaction (#142),
+ * so it is off by default outside the development preset. Opt in with
+ * `security.allowGraphql: true`.
+ *
+ * @param {object} secConfig Resolved security config.
+ * @param {string} [operationLabel] Label for the error message.
+ * @returns {void}
+ * @throws {SecurityError} if GraphQL is disabled for this site.
+ */
+export function assertGraphqlAllowed(secConfig, operationLabel = "graphql") {
+  if (secConfig.allowGraphql) return;
+  throw new SecurityError(
+    "GraphQL tools are disabled for this site (allowGraphql: false). " +
+    "Raw GraphQL responses bypass connector entity allowlists and field redaction. " +
+    `Blocked: ${operationLabel}. ` +
+    "Set security.allowGraphql = true to enable (prefer development preset or an explicit opt-in)."
+  );
+}
+
 export function assertGraphqlMutationAllowed(secConfig, query) {
+  // Queries still require allowGraphql (#142); mutations require both flags.
+  assertGraphqlAllowed(secConfig, "graphql mutation");
   const isMutation = graphqlHasMutation(query);
   if (!isMutation) return;
 
@@ -681,9 +719,11 @@ export function getSecuritySummary(site) {
   const cfg = resolveSecurityConfig(site);
   return {
     site:                  site._name,
-    preset:                site.security?.preset ?? "development (default)",
+    preset:                site.security?.preset ?? `${DEFAULT_SECURITY_PRESET} (default)`,
     readOnly:              cfg.readOnly,
     allowDestructive:      cfg.allowDestructive,
+    allowPublish:          cfg.allowPublish,
+    allowGraphql:          cfg.allowGraphql,
     allowGraphqlMutations: cfg.allowGraphqlMutations,
     allowConfigRead:       cfg.allowConfigRead,
     allowConfigWrite:      cfg.allowConfigWrite,

package/src/tools/graphql.js

@@ -3,9 +3,12 @@
  *
  * Raw GraphQL execution and schema introspection against a Drupal site. Require
  * the GraphQL Compose module (drupal.org/project/graphql_compose), which
- * exposes a read-only schema (no mutations); any mutation in a query is
- * additionally gated by the per-site "allowGraphqlMutations" security flag,
- * enforced by the middleware in index.js before the handler runs.
+ * exposes a read-only schema (no mutations).
+ *
+ * Policy: responses are raw GraphQL data — they do **not** pass connector entity
+ * allowlists or field redaction (#142). Tools are gated by `allowGraphql`
+ * (false outside the development preset unless opted in). Mutations also require
+ * `allowGraphqlMutations` (enforced in the handler and by index.js middleware).
  *
  * Per-site config: set "graphqlEndpoint" to override "/graphql".
  * Auth reuses the same credentials as the JSON:API tools.
@@ -13,6 +16,9 @@
 
 import { getSiteConfig } from "../lib/config.js";
 import { drupalGraphqlFetch } from "../lib/drupal-fetch.js";
+import {
+  resolveSecurityConfig, assertGraphqlAllowed, assertGraphqlMutationAllowed,
+} from "../lib/security.js";
 
 // ---------------------------------------------------------------------------
 // Implementations
@@ -29,6 +35,9 @@ import { drupalGraphqlFetch } from "../lib/drupal-fetch.js";
  */
 async function runGraphql({ site: siteName, query, variables = {}, operationName }) {
   const site = getSiteConfig(siteName);
+  const sec = resolveSecurityConfig(site);
+  assertGraphqlAllowed(sec, "drupal_graphql");
+  assertGraphqlMutationAllowed(sec, query);
   const json = await drupalGraphqlFetch(site, { query, variables, operationName });
 
   if (json.errors?.length) {
@@ -54,6 +63,7 @@ async function runGraphql({ site: siteName, query, variables = {}, operationName
  */
 async function introspectGraphql({ site: siteName, typeName }) {
   const site = getSiteConfig(siteName);
+  assertGraphqlAllowed(resolveSecurityConfig(site), "drupal_graphql_introspect");
 
   // If a specific type is requested, get detailed field info for it.
   if (typeName) {
@@ -128,7 +138,9 @@ export const definitions = [
     name: "drupal_graphql",
     description: `Execute a GraphQL query against a Drupal site.
 Requires the GraphQL Compose module (drupal.org/project/graphql_compose), which
-exposes a read-only schema; mutations are gated by "allowGraphqlMutations".
+exposes a read-only schema. GraphQL is off unless security.allowGraphql is true
+(development preset only by default) because raw results bypass entity allowlists
+and field redaction. Mutations also require allowGraphqlMutations.
 Use drupal_graphql_introspect first to discover available types and fields.
 
 Example query:
@@ -158,7 +170,7 @@ Example mutation (only if your GraphQL Compose schema enables mutations):
   },
   {
     name: "drupal_graphql_introspect",
-    description: "Introspect the Drupal GraphQL schema. Omit typeName for a full schema overview; provide typeName to get detailed fields and args for a specific type.",
+    description: "Introspect the Drupal GraphQL schema. Omit typeName for a full schema overview; provide typeName to get detailed fields and args for a specific type. Requires security.allowGraphql (off outside the development preset by default).",
     inputSchema: {
       type: "object",
       properties: {

package/src/tools/nodes.js

@@ -127,18 +127,43 @@ async function createRenameRedirect(backend, sec, redirect) {
   }
 }
 
+/**
+ * Fallback text format when neither the call nor the site config names one.
+ *
+ * Retained for backward compatibility only. A site whose text formats do not
+ * include `full_html` — or whose agent account may not use it — must set
+ * `defaultTextFormat` in its site config or pass `format` per call.
+ */
+const FALLBACK_TEXT_FORMAT = "full_html";
+
 /**
  * Build a Drupal body field descriptor from plain HTML + optional summary.
  *
+ * The text format is a security boundary in Drupal (it decides which HTML
+ * survives filtering), so it is resolved explicitly rather than assumed:
+ * an explicit `format` argument wins, then the site's `defaultTextFormat`,
+ * then the historical fallback.
+ *
+ * `summary` is only included when the caller supplied it. Sending an empty
+ * string on every write would blank an existing body summary whenever a
+ * caller updated the body alone.
+ *
  * @param {string} [body]    - Body HTML; when undefined the field is omitted.
- * @param {string} [summary] - Teaser/summary text.
- * @returns {{value: string, format: string, summary: string}|undefined}
+ * @param {string} [summary] - Teaser/summary text; omitted when undefined.
+ * @param {string} [format]  - Text format machine name.
+ * @param {object} [site]    - Site config, read for `defaultTextFormat`.
+ * @returns {{value: string, format: string, summary?: string}|undefined}
  *   A body attribute object, or undefined when no body was supplied (so callers
  *   can skip the field on update rather than blanking it).
  */
-function buildBodyAttribute(body, summary) {
+function buildBodyAttribute(body, summary, format, site) {
   if (body === undefined) return undefined;
-  return { value: body, format: "full_html", summary: summary ?? "" };
+  const attr = {
+    value: body,
+    format: format ?? site?.defaultTextFormat ?? FALLBACK_TEXT_FORMAT,
+  };
+  if (summary !== undefined) attr.summary = summary;
+  return attr;
 }
 
 /**
@@ -228,10 +253,10 @@ async function searchContent({ site: siteName, query, type, status, limit = 10 }
  * `relationships` (JSON:API shape), not `fields`; Drupal rejects reference fields
  * sent as attributes (#115).
  *
- * @param {object} args - { site?, type, title, body?, summary?, status?, moderationState?, fields?, relationships? }.
+ * @param {object} args - { site?, type, title, body?, summary?, format?, status?, moderationState?, fields?, relationships? }.
  * @returns {Promise<object>} The created node descriptor from the backend.
  */
-async function createNode({ site: siteName, type, title, body, summary, status, moderationState, fields = {}, relationships = {}, dryRun = false, returning = "full" }) {
+async function createNode({ site: siteName, type, title, body, summary, format, status, moderationState, fields = {}, relationships = {}, dryRun = false, returning = "full" }) {
   const site = getSiteConfig(siteName);
   const sec = resolveSecurityConfig(site);
   assertWriteAllowed(sec, "create", "node", type);
@@ -241,7 +266,7 @@ async function createNode({ site: siteName, type, title, body, summary, status,
   } else {
     attributes.status = status === undefined ? false : status;
   }
-  const bodyAttr = buildBodyAttribute(body, summary);
+  const bodyAttr = buildBodyAttribute(body, summary, format, site);
   if (bodyAttr) attributes.body = bodyAttr;
   assertPublishAllowed(sec, attributes);
   if (dryRun) return { dryRun: true, operation: "create", entityType: "node", bundle: type, attributes, relationships };
@@ -279,10 +304,10 @@ async function createNode({ site: siteName, type, title, body, summary, status,
  *
  * Entity-reference fields go in `relationships` (JSON:API shape), not `fields` (#115).
  *
- * @param {object} args - { site?, type, id, title?, body?, summary?, status?, moderationState?, fields?, relationships? }.
+ * @param {object} args - { site?, type, id, title?, body?, summary?, format?, status?, moderationState?, fields?, relationships? }.
  * @returns {Promise<object>} The updated node descriptor.
  */
-async function updateNode({ site: siteName, type, id, title, body, summary, status, moderationState, fields = {}, relationships = {}, dryRun = false, returning = "full" }) {
+async function updateNode({ site: siteName, type, id, title, body, summary, format, status, moderationState, fields = {}, relationships = {}, dryRun = false, returning = "full" }) {
   const site = getSiteConfig(siteName);
   const sec = resolveSecurityConfig(site);
   assertWriteAllowed(sec, "update", "node", type);
@@ -291,7 +316,7 @@ async function updateNode({ site: siteName, type, id, title, body, summary, stat
   if (title !== undefined) attributes.title = title;
   if (moderationState !== undefined) attributes.moderation_state = moderationState;
   else if (status !== undefined) attributes.status = status;
-  const bodyAttr = buildBodyAttribute(body, summary);
+  const bodyAttr = buildBodyAttribute(body, summary, format, site);
   if (bodyAttr) attributes.body = bodyAttr;
   // #131: published moderated nodes without an explicit state → draft forward revision.
   // Runs before the publish gate and on dryRun so previews match the real write.
@@ -390,7 +415,8 @@ export const definitions = [
         type:    { type: "string", description: "Content type machine name" },
         title:   { type: "string" },
         body:    { type: "string", description: "Body field HTML" },
-        summary: { type: "string", description: "Body summary / teaser" },
+        summary: { type: "string", description: "Body summary/teaser — writes the `summary` property of the body field (core `text_with_summary`). Many headless sites instead use a dedicated summary/deck field for teasers and meta descriptions; on those, set that field in `fields` — a value written here will be stored but may never be rendered." },
+        format:  { type: "string", description: "Text format machine name for the body, e.g. 'basic_html'. Defaults to the site config's `defaultTextFormat`, then 'full_html'. Set this when the site's formats do not include full_html, or to avoid writing content into a more permissive format than intended." },
         status:  { type: "boolean", default: false, description: "Published flag for NON-moderated types. true to publish immediately. Ignored if moderationState is set; on a moderated type it is dropped automatically." },
         moderationState: { type: "string", description: "Moderation state for content_moderation types, e.g. 'draft' or 'published'. Takes precedence over status." },
         fields:  { type: "object", description: "Scalar/attribute field values keyed by Drupal machine name. Do NOT put entity-reference fields here — Drupal rejects them as attributes; use `relationships`." },
@@ -411,7 +437,8 @@ export const definitions = [
         id:      { type: "string", description: "Node UUID" },
         title:   { type: "string" },
         body:    { type: "string" },
-        summary: { type: "string" },
+        summary: { type: "string", description: "Body summary/teaser — writes the `summary` property of the body field (core `text_with_summary`). Many headless sites instead use a dedicated summary/deck field for teasers and meta descriptions; on those, set that field in `fields` — a value written here will be stored but may never be rendered." },
+        format:  { type: "string", description: "Text format machine name for the body, e.g. 'basic_html'. Defaults to the site config's `defaultTextFormat`, then 'full_html'. Set this when the site's formats do not include full_html, or to avoid writing content into a more permissive format than intended." },
         status:  { type: "boolean", description: "Published flag for NON-moderated types: true = publish, false = unpublish. Ignored if moderationState is set." },
         moderationState: { type: "string", description: "Moderation state transition for content_moderation types, e.g. 'draft', 'published', 'archived'. Takes precedence over status. Required to keep or re-publish a live node — omitting it on a published moderated node defaults the write to 'draft'." },
         fields:  { type: "object", description: "Scalar/attribute field values keyed by machine name. Entity-reference fields go in `relationships`, not here." },