drupal-mcp-connector 2.17.0 → 2.19.0

package/.agents/commands/drupal-codegen-diff.md

@@ -1,11 +1,11 @@
 ---
-description: "Compare the live graphql_compose schema to the last gqcc:generate snapshot (`drush graphql-compose-codegen:diff`). Requires the module and drushSsh. Missing command fails loud. If allowedCommands is set, include graphql-compose-codegen:diff."
+description: "Compare the live graphql_compose schema to the last gqcc:generate snapshot (`drush graphql-compose-codegen:diff`). Uses the configured module binding; unbound sites require the module and drushSsh. Missing command fails loud. If allowedCommands is set, include graphql-compose-codegen:diff."
 argument-hint: "[site] [bundles] [skipFields]"
 ---
 
 Call the MCP tool `drupal_codegen_diff`.
 
-Compare the live graphql_compose schema to the last gqcc:generate snapshot (`drush graphql-compose-codegen:diff`). Requires the module and drushSsh. Missing command fails loud. If allowedCommands is set, include graphql-compose-codegen:diff.
+Compare the live graphql_compose schema to the last gqcc:generate snapshot (`drush graphql-compose-codegen:diff`). Uses the configured module binding; unbound sites require the module and drushSsh. Missing command fails loud. If allowedCommands is set, include graphql-compose-codegen:diff.
 
 Parse the arguments supplied with this command into this tool's parameters:
 

package/.agents/commands/drupal-codegen-generate.md

@@ -1,11 +1,11 @@
 ---
-description: "Return TypeScript/GraphQL scaffold artefacts from graphql_compose_codegen as text (`drush graphql-compose-codegen:generate --dry-run`). Never writes on the Drupal host (no --output-dir). Copy artefacts locally. Requires the module and drushSsh. Missing command fails loud. If allowedCommands is set, include graphql-compose-codegen:generate."
+description: "Return TypeScript/GraphQL scaffold artefacts from graphql_compose_codegen as text (`drush graphql-compose-codegen:generate --dry-run`). Never writes on the Drupal host (no --output-dir). Copy artefacts locally. Uses the configured module binding; unbound sites require the module and drushSsh. Missing command fails loud. If allowedCommands is set, include graphql-compose-codegen:generate."
 argument-hint: "[site] [bundles] [skipFields]"
 ---
 
 Call the MCP tool `drupal_codegen_generate`.
 
-Return TypeScript/GraphQL scaffold artefacts from graphql_compose_codegen as text (`drush graphql-compose-codegen:generate --dry-run`). Never writes on the Drupal host (no --output-dir). Copy artefacts locally. Requires the module and drushSsh. Missing command fails loud. If allowedCommands is set, include graphql-compose-codegen:generate.
+Return TypeScript/GraphQL scaffold artefacts from graphql_compose_codegen as text (`drush graphql-compose-codegen:generate --dry-run`). Never writes on the Drupal host (no --output-dir). Copy artefacts locally. Uses the configured module binding; unbound sites require the module and drushSsh. Missing command fails loud. If allowedCommands is set, include graphql-compose-codegen:generate.
 
 Parse the arguments supplied with this command into this tool's parameters:
 

package/.agents/commands/drupal-codegen-inspect.md

@@ -1,11 +1,11 @@
 ---
-description: "List node and paragraph bundles and extra fields from graphql_compose_codegen (`drush graphql-compose-codegen:inspect`). Requires the module and drushSsh. Missing command fails loud. If allowedCommands is set, include graphql-compose-codegen:inspect. Does not write files."
+description: "List node and paragraph bundles and extra fields from graphql_compose_codegen (`drush graphql-compose-codegen:inspect`). Uses the configured module binding; unbound sites require the module and drushSsh. Missing command fails loud. If allowedCommands is set, include graphql-compose-codegen:inspect. Does not write files."
 argument-hint: "[site] [bundles] [skipFields]"
 ---
 
 Call the MCP tool `drupal_codegen_inspect`.
 
-List node and paragraph bundles and extra fields from graphql_compose_codegen (`drush graphql-compose-codegen:inspect`). Requires the module and drushSsh. Missing command fails loud. If allowedCommands is set, include graphql-compose-codegen:inspect. Does not write files.
+List node and paragraph bundles and extra fields from graphql_compose_codegen (`drush graphql-compose-codegen:inspect`). Uses the configured module binding; unbound sites require the module and drushSsh. Missing command fails loud. If allowedCommands is set, include graphql-compose-codegen:inspect. Does not write files.
 
 Parse the arguments supplied with this command into this tool's parameters:
 

package/.agents/commands/drupal-drush-sql-query.md

@@ -1,11 +1,11 @@
 ---
-description: "Run a single read-only SELECT through mcp_sentinel's governed command (`drush mcp-sentinel:sql-query`). Requires the site to set drushSsh.rawSql=\"governed\" AND the site's policy profile to set allow_raw_sql; both are off by default. The server refuses statements touching a denied entity type, a non-entity table, or a redacted field, and records every attempt in the tamper-evident audit log. Use the site-context or entity-schema tools for schema introspection."
+description: "Run a single read-only SELECT through the configured sqlQuery module binding, or the legacy governed Drush command on unbound sites. Requires the site to set drushSsh.rawSql=\"governed\" AND the site's policy profile to set allow_raw_sql; both are off by default. The server refuses statements touching a denied entity type, a non-entity table, or a redacted field, and records every attempt in the tamper-evident audit log. Use the site-context or entity-schema tools for schema introspection."
 argument-hint: "<query> [site]"
 ---
 
 Call the MCP tool `drupal_drush_sql_query`.
 
-Run a single read-only SELECT through mcp_sentinel's governed command (`drush mcp-sentinel:sql-query`). Requires the site to set drushSsh.rawSql="governed" AND the site's policy profile to set allow_raw_sql; both are off by default. The server refuses statements touching a denied entity type, a non-entity table, or a redacted field, and records every attempt in the tamper-evident audit log. Use the site-context or entity-schema tools for schema introspection.
+Run a single read-only SELECT through the configured sqlQuery module binding, or the legacy governed Drush command on unbound sites. Requires the site to set drushSsh.rawSql="governed" AND the site's policy profile to set allow_raw_sql; both are off by default. The server refuses statements touching a denied entity type, a non-entity table, or a redacted field, and records every attempt in the tamper-evident audit log. Use the site-context or entity-schema tools for schema introspection.
 
 Parse the arguments supplied with this command into this tool's parameters:
 

package/CHANGELOG.md

@@ -7,6 +7,47 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.19.0] - 2026-09-16
+
+### Added
+- Codegen and governed SQL compatibility commands can use module-owned Tool API
+  actions through explicit bindings (#317). Configured calls validate fresh
+  schemas and never fall back to SSH on failure. Core and third-party commands
+  remain available; unbound sites retain their existing migration path.
+
+## [2.18.0] - 2026-09-16
+
+### Fixed
+- **Nullable module inputs (#320).** The generic registry accepts composed nullable
+  schemas while retaining runtime type, length, required and unknown-field checks.
+
+### Added
+- **Module compatibility bindings (#317).** Existing config commands and reports
+  can use locally approved module tools through generic discovery and schema
+  validation. Configured bindings never fall back after a refusal. The live
+  verifier probes the configured source tool directly.
+- **Module-owned tools (#317).** An opt-in registry discovers typed Drupal MCP
+  tools and routes them through explicit site, scope and operation policy. Module
+  actions need no dedicated JavaScript handler. Catalog revisions, schema checks,
+  bounded results and refusal without a valid source prevent silent fallbacks.
+
+### Changed
+- Server-tool sessions are bounded and isolated by endpoint, credential and caller.
+  Module writes do not automatically retry after an authentication/session refusal.
+- **Remaining writes use `prepareGuardedPatch`.** `langcode` always resolves
+  Sentinel inventory and draft-preflights, including unmoderated media.
+  `drupal_update_media` + `langcode`, unscoped `drupal_set_moderation_state`,
+  and `drupal_revert_revision` share the same preflight / `writeDraft` path
+  as node updates. `revisions.js` uses the shared `changedAheadOfRevision`.
+- **One Sentinel HTTP client and fail-closed inventory policy.** Draft,
+  translation, and inventory requests share `src/lib/sentinel-draft.js`
+  (paths, If-Match, lang/state headers, missing-endpoint classifiers,
+  validated inventory). Missing 404/405 stays unavailable / no canonical
+  langcode PATCH. Permission, 5xx, and malformed inventory now throw from
+  `resolveNodeTranslationPair` instead of falling through to
+  `rel:working-copy`. JSON:API advertises `capabilities().sentinelDraft`;
+  GraphQL `rawQuery` does not count as Sentinel-capable.
+
 ## [2.17.0] - 2026-09-11
 
 ### Added

package/README.md

@@ -31,6 +31,11 @@ The connector speaks **two Drupal backends interchangeably** — Drupal core's *
 
 ## Dual-Protocol Backends
 
+Drupal modules can also supply their own typed MCP actions through an opt-in
+[module-tool registry](docs/module-tools.md). The module owns business rules and
+schemas; the connector discovers and forwards approved tools under Sentinel and
+connector policy. Existing built-in tools remain available during migration.
+
 Each site declares which backend(s) it exposes via the `api` key:
 
 ```json

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drupal-mcp-connector",
-  "version": "2.17.0",
+  "version": "2.19.0",
   "description": "Drupal MCP Connector — multi-site MCP server for Drupal with JSON:API and GraphQL, governed writes, draft translations, content tools, audit reports, and an SSH Drush bridge.",
   "type": "module",
   "main": "src/index.js",
@@ -68,6 +68,8 @@
   "dependencies": {
     "@modelcontextprotocol/node": "^2.0.0",
     "@modelcontextprotocol/server": "^2.0.0",
+    "ajv": "^8.20.0",
+    "ajv-formats": "^3.0.1",
     "graphql": "^17.0.0",
     "jose": "^6.2.9",
     "node-fetch": "^3.3.2",

package/src/index.js

@@ -58,6 +58,7 @@ import {
 
 // Tools — aggregated (single source of truth, side-effect-free) and per-tool prompts
 import { allDefinitions, allHandlers, definitionsByName } from "./tools/index.js";
+import { createModuleToolRegistry, isModuleTool } from "./lib/module-tools.js";
 import { buildToolPrompts, getToolPromptMessages } from "./lib/tool-prompts.js";
 
 // Apply config/secrets.map (or the shipped example table) before any site
@@ -104,6 +105,18 @@ const RESOURCES = [
   },
 ];
 
+const moduleTools = createModuleToolRegistry();
+
+async function discoverableTools() {
+  const sites = listResolvableSiteConfigs();
+  const identity = getRequestIdentity();
+  const governed = await filterDiscoverableTools(allDefinitions, sites);
+  return [
+    ...filterToolsByPrincipal(governed, sites, identity),
+    ...await moduleTools.list({ sites, identity }),
+  ];
+}
+
 /**
  * Resolve a resource URI to its JSON payload. URIs are matched in order; the
  * templated forms (content-types, security-policy) capture the site name and
@@ -114,13 +127,6 @@ const RESOURCES = [
  * @returns {Promise<object>} The resource data (later JSON-serialized).
  * @throws {Error} If the URI matches no known resource.
  */
-async function discoverableTools() {
-  const sites = listResolvableSiteConfigs();
-  const identity = getRequestIdentity();
-  const governed = await filterDiscoverableTools(allDefinitions, sites);
-  return filterToolsByPrincipal(governed, sites, identity);
-}
-
 async function readResource(uri) {
   const identity = getRequestIdentity();
   const sites = listResolvableSiteConfigs();
@@ -295,7 +301,9 @@ const buildConnectorServer = createConnectorServerFactory({
   tools: {
     definitions: allDefinitions,
     list: discoverableTools,
-    call: callTool,
+    call: (name, args, context) => isModuleTool(name)
+      ? moduleTools.call(name, args, context)
+      : callTool(name, args, context),
   },
   resources: {
     definitions: RESOURCES,

package/src/lib/backends/backend-interface.js

@@ -23,6 +23,9 @@
  * @property {"full"|"enum"|"none"} sort Server-side sort support: arbitrary
  *   fields ("full"), a fixed enum of keys ("enum"), or none ("none").
  * @property {boolean} revisions Adapter exposes entity revisions.
+ * @property {boolean} [sentinelDraft] Adapter can issue Sentinel's JSON:API
+ *   `/mcp-draft` and `/mcp-translations` routes (`rawQuery({ path, options })`
+ *   plus `resourcePath`). GraphQL `rawQuery({ query })` must be false.
  * @property {((entityType: string, bundle: string) => string[])|null} fieldAvailability
  *   Optional resolver returning the known field names for a bundle, or null
  *   when the adapter cannot cheaply enumerate fields.

package/src/lib/backends/graphql.js

@@ -65,6 +65,7 @@ export class GraphqlBackend extends Backend {
     return {
       read: true, write: false, delete: false,
       count: false, filter: false, sort: "enum", revisions: false,
+      sentinelDraft: false,
       fieldAvailability: (entityType, bundle) => this._fieldNames(entityType, bundle),
     };
   }

package/src/lib/backends/jsonapi.js

@@ -228,6 +228,7 @@ export class JsonApiBackend extends Backend {
     return {
       read: true, write: true, delete: true,
       count: true, filter: true, sort: "full", revisions: true,
+      sentinelDraft: true,
       fieldAvailability: null,
     };
   }

package/src/lib/dispatch.js

@@ -18,6 +18,7 @@ import { inferOperation } from "./operations.js";
 import { assertSourceGovernance, GovernanceError, GOVERNANCE_DIAGNOSTIC_TOOLS } from "./governance.js";
 import {
   assertPrincipalEntitlement, callerTargetHints, getRequestIdentity,
+  principalHasScope, resolveAuthoritativeTarget,
 } from "./principal.js";
 import { assertExplicitSiteForWrite, withResolvedTarget } from "./site-target.js";
 import { buildDataFlowContext, consumeBudgetIfEnforced, runWithDataFlow } from "./data-flow.js";
@@ -62,6 +63,15 @@ export function resolveCallTarget(toolName, rawArgs, context = {}) {
 
   const identity = context.identity !== undefined ? context.identity : getRequestIdentity();
   if (identity) {
+    if (context.moduleTool) {
+      if (!principalHasScope(identity, context.moduleTool.scope)) {
+        throw new SecurityError("Not entitled to invoke this module tool.");
+      }
+      return resolveAuthoritativeTarget(rawArgs, identity,
+        context.sites ?? listResolvableSiteConfigs(), {
+          grants: context.grants, defaultSite: context.defaultSite,
+        });
+    }
     return assertPrincipalEntitlement({
       toolName,
       args: rawArgs,