drupal-mcp-connector 2.13.0 → 2.14.0

package/.agents/commands/drupal-entity-update.md

@@ -1,11 +1,11 @@
 ---
-description: "Update an existing entity of any Drupal entity type. Only include attributes/relationships you want to change. Published moderated targets without an explicit attributes.moderation_state default to moderation_state 'draft' (forward revision). Paragraph / ERR identifiers are resolved to include meta.target_revision_id before PATCH; the write fails if any ref cannot be resolved. On moderated targets an id-mismatch PATCH preflight runs first (including dryRun) against the same URL the write will hit. An addressable working copy is PATCHed via ?resourceVersion=rel:working-copy (#166); a stray revision with no addressable working copy still fails with revision-surgery language (#201). Preflight does not un-orphan paragraphs already created — probe the host before creating dependents."
+description: "Update an existing entity of any Drupal entity type. Only include attributes/relationships you want to change. Published moderated targets without an explicit attributes.moderation_state default to moderation_state 'draft' (forward revision). Paragraph / ERR identifiers are resolved to include meta.target_revision_id before PATCH; the write fails if any ref cannot be resolved. On moderated targets a non-saving PATCH preflight runs first (including dryRun) against the same URL the write will hit. An addressable node draft uses Sentinel's governed draft endpoint with live/working revision preconditions (#166); a stray revision with no addressable working copy still fails with revision-surgery language (#201). Preflight does not un-orphan paragraphs already created — probe the host before creating dependents."
 argument-hint: "<entityType> <bundle> <id> [site] [attributes] [relationships] [dryRun] [returning]"
 ---
 
 Call the MCP tool `drupal_entity_update`.
 
-Update an existing entity of any Drupal entity type. Only include attributes/relationships you want to change. Published moderated targets without an explicit attributes.moderation_state default to moderation_state 'draft' (forward revision). Paragraph / ERR identifiers are resolved to include meta.target_revision_id before PATCH; the write fails if any ref cannot be resolved. On moderated targets an id-mismatch PATCH preflight runs first (including dryRun) against the same URL the write will hit. An addressable working copy is PATCHed via ?resourceVersion=rel:working-copy (#166); a stray revision with no addressable working copy still fails with revision-surgery language (#201). Preflight does not un-orphan paragraphs already created — probe the host before creating dependents.
+Update an existing entity of any Drupal entity type. Only include attributes/relationships you want to change. Published moderated targets without an explicit attributes.moderation_state default to moderation_state 'draft' (forward revision). Paragraph / ERR identifiers are resolved to include meta.target_revision_id before PATCH; the write fails if any ref cannot be resolved. On moderated targets a non-saving PATCH preflight runs first (including dryRun) against the same URL the write will hit. An addressable node draft uses Sentinel's governed draft endpoint with live/working revision preconditions (#166); a stray revision with no addressable working copy still fails with revision-surgery language (#201). Preflight does not un-orphan paragraphs already created — probe the host before creating dependents.
 
 Parse the arguments supplied with this command into this tool's parameters:
 
@@ -18,7 +18,7 @@ Parse the arguments supplied with this command into this tool's parameters:
 - `site` (string): Named site from connector config. Omit only on reads: multi-site configs fall back to defaultSite (often local/dev, not production). Writes require an explicit site when more than one site is configured. Every response includes `_target` { name, baseUrl, source } (`hint` when you passed site, `default` when you did not).
 - `attributes` (object (pass as JSON))
 - `relationships` (object (pass as JSON))
-- `dryRun` (boolean (true/false)): Validate, resolve ERR identifiers, and (on moderated targets) run the core PATCH-guard probe against Drupal, then return a preview without the real write. The probe uses a non-matching data.id so Drupal does not save, and hits the same URL as the real write (canonical, or ?resourceVersion=rel:working-copy when a draft is addressable). A working-copy 400 fails the dryRun.
+- `dryRun` (boolean (true/false)): Validate, resolve ERR identifiers, and (on moderated targets) run the core PATCH-guard probe against Drupal, then return a preview without the real write. An existing node draft uses Sentinel's non-saving draft endpoint with the real payload and revision preconditions. Otherwise an id-mismatch core PATCH probes writability without saving. Any refusal fails the dryRun.
 - `returning` (string): Response verbosity. "full" (default) returns the complete saved entity; "minimal" returns just identity + state (id, type, bundle, title, status, changed, url) — much smaller, recommended for bulk writes where the echoed body would dominate the response.
 
 If a required parameter is missing, ask before calling — do not invent values. Coerce each value to its JSON type (booleans → true/false, numbers → numeric, object/array → parse JSON), then make the single tool call and summarize the result.

package/.agents/commands/drupal-update-node.md

@@ -1,11 +1,11 @@
 ---
-description: "Update an existing node. Only include fields you want to change. For moderated content types, use moderationState (e.g. 'published') rather than status. When the target is published and moderated and you omit moderationState, the connector defaults the write to moderation_state 'draft' (forward revision) so live default revisions are not mutated by accident. Entity-reference fields go in `relationships`, not `fields`. Paragraph / ERR identifiers are resolved to include meta.target_revision_id before PATCH; the write fails if any ref cannot be resolved (an unresolved identifier persists as an empty field). On moderated targets an id-mismatch PATCH preflight runs first — including on dryRun — against the same URL the write will hit. An addressable working copy is PATCHed via ?resourceVersion=rel:working-copy (#166); dryRun uses that same target. workingCopy:null from drupal_list_revisions is not proof the node is writable (possiblyPatchBlocked / #201). Preflight here does not un-orphan paragraphs already created; probe the host before creating dependents."
+description: "Update an existing node. Only include fields you want to change. For moderated content types, use moderationState (e.g. 'published') rather than status. When the target is published and moderated and you omit moderationState, the connector defaults the write to moderation_state 'draft' (forward revision) so live default revisions are not mutated by accident. Entity-reference fields go in `relationships`, not `fields`. Paragraph / ERR identifiers are resolved to include meta.target_revision_id before PATCH; the write fails if any ref cannot be resolved (an unresolved identifier persists as an empty field). On moderated targets a non-saving PATCH preflight runs first — including on dryRun — against the same URL the write will hit. An addressable node draft uses Sentinel's governed draft endpoint with live/working revision preconditions (#166); dryRun uses that same target. workingCopy:null from drupal_list_revisions is not proof the node is writable (possiblyPatchBlocked / #201). Preflight here does not un-orphan paragraphs already created; probe the host before creating dependents."
 argument-hint: "<type> <id> [site] [title] [body] [summary] [format] [status] [moderationState] [fields] [relationships] [dryRun] [returning]"
 ---
 
 Call the MCP tool `drupal_update_node`.
 
-Update an existing node. Only include fields you want to change. For moderated content types, use moderationState (e.g. 'published') rather than status. When the target is published and moderated and you omit moderationState, the connector defaults the write to moderation_state 'draft' (forward revision) so live default revisions are not mutated by accident. Entity-reference fields go in `relationships`, not `fields`. Paragraph / ERR identifiers are resolved to include meta.target_revision_id before PATCH; the write fails if any ref cannot be resolved (an unresolved identifier persists as an empty field). On moderated targets an id-mismatch PATCH preflight runs first — including on dryRun — against the same URL the write will hit. An addressable working copy is PATCHed via ?resourceVersion=rel:working-copy (#166); dryRun uses that same target. workingCopy:null from drupal_list_revisions is not proof the node is writable (possiblyPatchBlocked / #201). Preflight here does not un-orphan paragraphs already created; probe the host before creating dependents.
+Update an existing node. Only include fields you want to change. For moderated content types, use moderationState (e.g. 'published') rather than status. When the target is published and moderated and you omit moderationState, the connector defaults the write to moderation_state 'draft' (forward revision) so live default revisions are not mutated by accident. Entity-reference fields go in `relationships`, not `fields`. Paragraph / ERR identifiers are resolved to include meta.target_revision_id before PATCH; the write fails if any ref cannot be resolved (an unresolved identifier persists as an empty field). On moderated targets a non-saving PATCH preflight runs first — including on dryRun — against the same URL the write will hit. An addressable node draft uses Sentinel's governed draft endpoint with live/working revision preconditions (#166); dryRun uses that same target. workingCopy:null from drupal_list_revisions is not proof the node is writable (possiblyPatchBlocked / #201). Preflight here does not un-orphan paragraphs already created; probe the host before creating dependents.
 
 Parse the arguments supplied with this command into this tool's parameters:
 
@@ -23,7 +23,7 @@ Parse the arguments supplied with this command into this tool's parameters:
 - `moderationState` (string): Moderation state transition for content_moderation types, e.g. 'draft', 'published', 'archived'. Takes precedence over status. Required to keep or re-publish a live node — omitting it on a published moderated node defaults the write to 'draft'.
 - `fields` (object (pass as JSON)): Scalar/attribute field values keyed by machine name. Formatted text: a string or { value, format?, summary? }. format must be in the field's allowed_formats; a single allowed format is used when omitted. Entity-reference fields go in `relationships`, not here.
 - `relationships` (object (pass as JSON)): Entity-reference fields as JSON:API relationships, keyed by field machine name. Single-value uses { data: { type, id } }; multi-value uses { data: [{ type, id }, …] }. Paragraph / ERR items must carry meta.target_revision_id — the connector injects it when missing, and fails the write if it cannot.
-- `dryRun` (boolean (true/false)): Validate, resolve ERR identifiers, and (on moderated targets) run the core PATCH-guard probe against Drupal, then return a preview without the real write. The probe uses a non-matching data.id so Drupal does not save, and hits the same URL as the real write (canonical, or ?resourceVersion=rel:working-copy when a draft is addressable). A working-copy 400 fails the dryRun.
+- `dryRun` (boolean (true/false)): Validate, resolve ERR identifiers, and (on moderated targets) run the core PATCH-guard probe against Drupal, then return a preview without the real write. An existing node draft uses Sentinel's non-saving draft endpoint with the real payload and revision preconditions. Otherwise an id-mismatch core PATCH probes writability without saving. Any refusal fails the dryRun.
 - `returning` (string): Response verbosity. "full" (default) returns the complete saved entity; "minimal" returns just identity + state (id, type, bundle, title, status, changed, url) — much smaller, recommended for bulk writes where the echoed body would dominate the response.
 
 If a required parameter is missing, ask before calling — do not invent values. Coerce each value to its JSON type (booleans → true/false, numbers → numeric, object/array → parse JSON), then make the single tool call and summarize the result.

package/CHANGELOG.md

@@ -7,6 +7,58 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.14.0] - 2026-09-06
+
+### Added
+- **Laboratory tenant offboarding on the relay edge (#267).**
+  `offboardTenant` fail-closes unless a tenant-scoped assessor snapshot
+  can be taken, then overwrite-removes the channel digest, drops the
+  grant and session, and tombstones the principal. Revoke and destroy
+  rows are independently anchored only after that teardown succeeds.
+  `GET /assessor` cites P9.9 only when those anchored rows match the
+  digest frozen at export. The held pack stays independently verifiable
+  after access is removed. A former principal sees `offboarded`; a
+  stranger stays `not_entitled`. The pack never writes `passed`.
+  Lab/loopback only — not a hosted-service or design-partner admission
+  claim.
+- **Laboratory tenant onboarding on the relay edge (#265).** Optional
+  `auth.approvalRequiredTools` issues a one-use approval before fan-down
+  for named tools; a later `tools/call` with `arguments.approvalId`
+  consumes it (stripped before the tenant sees it). `GET /assessor` cites
+  P9.8 when one tenant pack holds anchored allow, deny, and
+  approval-gated executions against the live policy digest. Omit the
+  list to keep the prior path. A table the edge cannot read refuses
+  startup. Lab/loopback only — not a hosted-service or design-partner
+  admission claim.
+
+### Security
+- **Independently verifiable evidence on the relay edge (#261).** Optional
+  `auth.evidenceAnchor` (`url` + pinned Ed25519 `publicKey`) submits a
+  minimized receipt digest to a notary process (`drupal-mcp-anchor`) whose
+  private key the edge never holds. One governed execution reconciles by
+  stable identifiers (identity, delegation, decision, obligations,
+  approval, local execution, target revision, receipt — explicit `none:*`
+  absences count). `GET /assessor` serves the caller's own tenant pack:
+  data-minimized, bound to the live policy digest, controls cite evidence
+  ids or stay `residual`, never `passed`. A table the edge cannot pin, or
+  a ledger without a pin, refuses startup. Omitting the table keeps the
+  2.13.0 path (`/assessor` is 404). Lab/loopback only — not a hosted-service
+  or design-partner admission claim. Audit Chain NDJSON remains the
+  off-system stream, not this anchor.
+
+## [2.13.1] - 2026-09-05
+
+### Fixed
+- Existing node drafts use Sentinel's governed draft-continuation endpoint
+  instead of a revision-selected core PATCH, which Drupal rejects (#166).
+  Preflight sends the actual fields and revision preconditions without saving.
+  An unavailable server endpoint fails closed without discarding the draft.
+
+### Changed
+- Comments, test names, lab notes, and older changelog entries now reference
+  GitHub issues, release versions, or plain descriptions instead of internal
+  tracker keys (#258). No behaviour change.
+
 ## [2.13.0] - 2026-09-02
 
 ### Security
@@ -124,7 +176,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   credentials never appear in any frame crossing the tunnel. The lab
   README now states plainly that the lab northbound does not authenticate
   the caller (the lab credential authenticates the agent channel) — the
-  product edge's northbound OAuth is DEV-294 work, not this harness.
+  product edge's northbound OAuth is #232 work, not this harness.
 
 ### Added
 - **Deployment documentation for the relay edge and tenant-agent entry
@@ -149,13 +201,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   window. The frame codec lives at `src/lib/relay/frames.js` with hard size,
   teardown, and timeout bounds. These are entry points and libraries only;
   nothing here is a hosted service.
-- **Lab-only outbound-relay harness (DEV-293).** Isolated under
+- **Lab-only outbound-relay harness.** Isolated under
   `lab/outbound-relay/` with tests in `tests/lab/`. A tenant agent dials out
   to a loopback relay; one MCP 2026-07-28 Streamable-HTTP request (stateless,
   no `Mcp-Session-Id`) reaches an in-process stub private Drupal; reconnect
   keeps the same tunnel identity; revocation is checked per request (next
   request denied, no grace window). This is not a public surface, not a
-  hosted-service claim, and not DEV-294. Hosted MCP is unstarted.
+  hosted-service claim, and not the product edge (#232). Hosted MCP is unstarted.
 
 ## [2.9.0] - 2026-08-26
 
@@ -935,7 +987,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.5.1] - 2026-06-29
 
 ### Fixed
-- **Node URL aliases set via the connector now actually persist (DEV-116).** Setting an
+- **Node URL aliases set via the connector now actually persist.** Setting an
   alias with `drupal_update_node` (`fields.path = { alias, pathauto: 0 }`) returned
   success but silently reverted, causing nav 404s. Root cause: JSON:API deserialized the
   `path` field without the existing alias's **`pid`**, so Drupal's `PathItem::postSave`
@@ -943,7 +995,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   in place. The connector now reads the current alias's `pid` (new
   `backend.getPathInfo`) and round-trips it, so the alias is **updated in place** — one
   canonical alias, no duplicate. Verified end-to-end over JSON:API on Drupal 11.
-- **Path-less updates no longer create duplicate aliases.** The DEV-114 "preserve" path
+- **Path-less updates no longer create duplicate aliases.** The 1.5.0 "preserve" path
   re-pinned the current alias *without* its `pid`, hitting the same duplicate bug; it now
   round-trips the `pid` too.
 - **Honest write responses.** `drupal_create_node` / `drupal_update_node` now **re-read**
@@ -973,29 +1025,29 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 - **`drupal_update_paragraph`** — update an existing Paragraph entity's field values
   in place (partial JSON:API PATCH) by bundle + UUID, so component / key-capability
-  paragraphs can be maintained end-to-end without re-embedding (DEV-114).
+  paragraphs can be maintained end-to-end without re-embedding.
 - **`drupal_update_menu_link`** — update a menu link by UUID (rename, re-weight,
   re-target, re-parent, enable/disable). `enabled` is preserved across edits unless
-  passed explicitly (DEV-114).
+  passed explicitly.
 - **`drupal_create_menu_link`** now accepts **`parent`** (nest under a parent link
   plugin id) and **`enabled`** on create, and creates links **enabled by default** so
   they render immediately — closing the "menu links created disabled / no parent on
-  create" gap (DEV-114).
+  create" gap.
 
 ### Fixed
 - **Menu links no longer silently regress to disabled.** Every menu-link write now
   asserts `enabled` explicitly (default true on create; the current value re-pinned on
   update), so an unrelated edit can't drop a live link to disabled through the JSON:API
-  write path (DEV-114).
+  write path.
 - **Node updates preserve the existing URL alias.** When `drupal_update_node` is called
   without a `path`, the connector reads the current alias and re-pins it
   (`{ alias, pathauto: 0 }`) so a save can't let Pathauto revert the alias to a stale
-  value. Pass `fields.path` to set the alias explicitly (DEV-114).
+  value. Pass `fields.path` to set the alias explicitly.
 - **Intermittent `drupal_create_menu_link` 422 "path '/…' is inaccessible".** This is a
   transient path-validator/access-cache race in Drupal's `LinkAccessConstraint`; menu-link
   create/update now retries once after a short delay when it hits that specific error.
   Prefer an `entity:node/<id>` target over `internal:/<alias>` to avoid the alias
-  resolution step entirely (DEV-114).
+  resolution step entirely.
 
 ## [1.4.0] - 2026-06-29
 
@@ -1011,7 +1063,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   its status code via a partial update — the path to activate/fix a redirect that
   isn't firing. Both are governed by the per-site security policy (redirect writes /
   `administer redirects`). Resolves the gap where connector-created redirects were
-  inactive and could not be enabled (DEV-111).
+  inactive and could not be enabled.
 
 ## [1.3.2] - 2026-06-27
 
@@ -1418,6 +1470,8 @@ The connector is now **dual-protocol**: every tool runs against an abstract back
 - User tools gained explicit PII-access assertions.
 - Whole tree lint-clean (`npm run lint`) with object-injection sinks rewritten to safe lookups.
 
+[2.14.0]: https://github.com/Wilkes-Liberty/drupal-mcp-connector/releases/tag/v2.14.0
+[2.13.1]: https://github.com/Wilkes-Liberty/drupal-mcp-connector/releases/tag/v2.13.1
 [2.13.0]: https://github.com/Wilkes-Liberty/drupal-mcp-connector/releases/tag/v2.13.0
 [2.12.0]: https://github.com/Wilkes-Liberty/drupal-mcp-connector/releases/tag/v2.12.0
 [2.11.0]: https://github.com/Wilkes-Liberty/drupal-mcp-connector/releases/tag/v2.11.0

package/bin/drupal-mcp-anchor.js

@@ -0,0 +1,52 @@
+#!/usr/bin/env node
+/**
+ * drupal-mcp-anchor — independent Ed25519 notary (#261).
+ *
+ * Separate process from the relay edge. Holds the private key and never
+ * shares it. Prints the public pin the edge must configure in
+ * `auth.evidenceAnchor.publicKey`. Loopback only. Not a hosted-service
+ * or design-partner admission claim. Audit Chain NDJSON is the off-system
+ * stream, not this process.
+ *
+ * Environment variables:
+ *   MCP_ANCHOR_PORT   Listen port (default 0 = ephemeral; printed).
+ *   MCP_ANCHOR_BIND   Bind host (default 127.0.0.1). Non-loopback refused.
+ */
+
+import process from "node:process";
+import { createNotary, startAnchorServer } from "../src/lib/anchor.js";
+
+function fatal(message) {
+  console.error(`[drupal-mcp-anchor] FATAL: ${message}`);
+  process.exit(1);
+}
+
+const bindHost = process.env.MCP_ANCHOR_BIND || "127.0.0.1";
+const loopback = bindHost === "127.0.0.1" || bindHost === "::1" || bindHost === "localhost";
+if (!loopback) {
+  fatal(
+    "The notary binds loopback only. Set MCP_ANCHOR_BIND to 127.0.0.1 "
+    + "(or omit it). A separately administered production host is not chosen here.",
+  );
+}
+
+const portRaw = process.env.MCP_ANCHOR_PORT;
+const port = portRaw === undefined || portRaw === "" ? 0 : Number(portRaw);
+if (!Number.isInteger(port) || port < 0) {
+  fatal("MCP_ANCHOR_PORT must be a non-negative integer (0 = ephemeral).");
+}
+
+const notary = createNotary();
+const server = await startAnchorServer({ notary, bindHost, port });
+
+console.error(
+  `[drupal-mcp-anchor] Listening ${server.url} · keyId ${notary.keyId}`,
+);
+console.error("[drupal-mcp-anchor] Pin this public key on the edge (auth.evidenceAnchor.publicKey):");
+console.error(notary.publicPin);
+
+function shutdown() {
+  server.close().then(() => process.exit(0), () => process.exit(1));
+}
+process.on("SIGINT", shutdown);
+process.on("SIGTERM", shutdown);

package/bin/drupal-mcp-edge.js

@@ -51,13 +51,21 @@
  * to the tenant agent and requires a matching local attestation. Optional
  * auth.quotas (tenant / principal request windows plus an abuse lock)
  * fails closed at the edge with zero frames on any refusal; a table the
- * edge cannot read refuses startup.
+ * edge cannot read refuses startup. Optional auth.evidenceAnchor
+ * ({ url, publicKey }) pins an independent Ed25519 notary; GET /assessor
+ * then serves one tenant-scoped pack bound to the live policy digest. A
+ * pin the edge cannot read refuses startup. Omit to keep the prior path
+ * (404 on /assessor). Optional auth.approvalRequiredTools issues a
+ * one-use approval before fan-down for named tools. Lab/loopback only —
+ * not a hosted-service claim.
  */
 
 import { readFileSync } from "node:fs";
 import process from "node:process";
 import {
   getInboundActors,
+  getInboundApprovalRequiredTools,
+  getInboundEvidenceAnchor,
   getInboundGrants,
   getInboundPolicies,
   getInboundPromotions,
@@ -168,6 +176,7 @@ if (usageRaw !== undefined && usageRaw !== null) {
 }
 const usage = usageMaxRecords > 0 ? createUsageLedger({ maxRecords: usageMaxRecords }) : null;
 const quotas = getInboundQuotas();
+const evidenceAnchor = getInboundEvidenceAnchor();
 
 let edge;
 try {
@@ -180,6 +189,8 @@ try {
     promotions: getInboundPromotions(),
     quotas,
     usage,
+    evidenceAnchor,
+    approvalRequiredTools: getInboundApprovalRequiredTools(),
     sites,
     defaultSite: config.defaultSite,
     channelCredentials: createChannelCredentialStore({ filePath: channelFile }),
@@ -215,3 +226,8 @@ if (usage) {
 if (quotas) {
   console.error("[drupal-mcp-edge] Quotas: auth.quotas in force; unlisted tenants / principals are refused.");
 }
+if (evidenceAnchor) {
+  console.error(
+    "[drupal-mcp-edge] Evidence: independent notary pin in force; GET /assessor serves one tenant pack.",
+  );
+}

package/config/config.example.json

@@ -47,6 +47,12 @@
     "quotas": {
       "_comment": "Optional, drupal-mcp-edge only. { tenants: { \"<agent id>\": { requests, windowSec } }, principals: { \"<sub or client_id>\": { requests, windowSec } }, abuse: { denials, windowSec, lockSec } }. When a tenants or principals table names any id, an id without a row is not_entitled; an exhausted window is 429 quota_exceeded with Retry-After; a principal that earns `denials` refusals inside windowSec is 429 abuse_locked for lockSec. Every refusal is zero frames on any tunnel. A shared tenant window running out never feeds an individual principal's abuse lock. A table the edge cannot read refuses startup and names the offending path. Omit to keep the prior path (no quota at the edge). Counting is measured usage, not pricing."
     },
+    "evidenceAnchor": {
+      "_comment": "Optional, drupal-mcp-edge only. Independent Ed25519 notary the edge never holds the private key for: { url, publicKey } (publicKey is SPKI DER, standard base64; url is https, or http on loopback). When present, every settled receipt is reconciled by stable identifiers and submitted to that notary; GET /assessor serves one tenant-scoped, data-minimized pack bound to the live policy digest. A table the edge cannot pin refuses startup. Omit to keep the prior path (404 on /assessor). Lab/loopback only — not a hosted-service or design-partner admission claim. Run `drupal-mcp-anchor` to mint a pin."
+    },
+    "approvalRequiredTools": {
+      "_comment": "Optional, drupal-mcp-edge only. Array of tool names that require a one-use approval the edge issues before fan-down, e.g. [\"drupal_create_node\"]. A later tools/call with arguments.approvalId consumes that ticket (stripped before the tenant sees it). Omit to keep the prior path (no edge approval gate). A table the edge cannot read refuses startup. Lab/loopback only — not a hosted-service or design-partner admission claim."
+    },
     "revocationFile": "",
     "introspectionUrl": "",
     "introspectionClientIdEnv": "",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drupal-mcp-connector",
-  "version": "2.13.0",
+  "version": "2.14.0",
   "description": "A secure, multi-site Model Context Protocol (MCP) connector for Drupal — dual-protocol JSON:API and GraphQL.",
   "type": "module",
   "main": "src/index.js",
@@ -8,7 +8,8 @@
     "drupal-mcp-connector": "src/index.js",
     "drupal-mcp-verify": "bin/drupal-mcp-verify.js",
     "drupal-mcp-edge": "bin/drupal-mcp-edge.js",
-    "drupal-mcp-agent": "bin/drupal-mcp-agent.js"
+    "drupal-mcp-agent": "bin/drupal-mcp-agent.js",
+    "drupal-mcp-anchor": "bin/drupal-mcp-anchor.js"
   },
   "files": [
     "src/",