drupal-mcp-connector 2.18.0 → 2.19.1

package/.agents/commands/drupal-codegen-diff.md

@@ -1,11 +1,11 @@
 ---
-description: "Compare the live graphql_compose schema to the last gqcc:generate snapshot (`drush graphql-compose-codegen:diff`). Requires the module and drushSsh. Missing command fails loud. If allowedCommands is set, include graphql-compose-codegen:diff."
+description: "Compare the live graphql_compose schema to the last gqcc:generate snapshot (`drush graphql-compose-codegen:diff`). Uses the configured module binding; unbound sites require the module and drushSsh. Missing command fails loud. If allowedCommands is set, include graphql-compose-codegen:diff."
 argument-hint: "[site] [bundles] [skipFields]"
 ---
 
 Call the MCP tool `drupal_codegen_diff`.
 
-Compare the live graphql_compose schema to the last gqcc:generate snapshot (`drush graphql-compose-codegen:diff`). Requires the module and drushSsh. Missing command fails loud. If allowedCommands is set, include graphql-compose-codegen:diff.
+Compare the live graphql_compose schema to the last gqcc:generate snapshot (`drush graphql-compose-codegen:diff`). Uses the configured module binding; unbound sites require the module and drushSsh. Missing command fails loud. If allowedCommands is set, include graphql-compose-codegen:diff.
 
 Parse the arguments supplied with this command into this tool's parameters:
 

package/.agents/commands/drupal-codegen-generate.md

@@ -1,11 +1,11 @@
 ---
-description: "Return TypeScript/GraphQL scaffold artefacts from graphql_compose_codegen as text (`drush graphql-compose-codegen:generate --dry-run`). Never writes on the Drupal host (no --output-dir). Copy artefacts locally. Requires the module and drushSsh. Missing command fails loud. If allowedCommands is set, include graphql-compose-codegen:generate."
+description: "Return TypeScript/GraphQL scaffold artefacts from graphql_compose_codegen as text (`drush graphql-compose-codegen:generate --dry-run`). Never writes on the Drupal host (no --output-dir). Copy artefacts locally. Uses the configured module binding; unbound sites require the module and drushSsh. Missing command fails loud. If allowedCommands is set, include graphql-compose-codegen:generate."
 argument-hint: "[site] [bundles] [skipFields]"
 ---
 
 Call the MCP tool `drupal_codegen_generate`.
 
-Return TypeScript/GraphQL scaffold artefacts from graphql_compose_codegen as text (`drush graphql-compose-codegen:generate --dry-run`). Never writes on the Drupal host (no --output-dir). Copy artefacts locally. Requires the module and drushSsh. Missing command fails loud. If allowedCommands is set, include graphql-compose-codegen:generate.
+Return TypeScript/GraphQL scaffold artefacts from graphql_compose_codegen as text (`drush graphql-compose-codegen:generate --dry-run`). Never writes on the Drupal host (no --output-dir). Copy artefacts locally. Uses the configured module binding; unbound sites require the module and drushSsh. Missing command fails loud. If allowedCommands is set, include graphql-compose-codegen:generate.
 
 Parse the arguments supplied with this command into this tool's parameters:
 

package/.agents/commands/drupal-codegen-inspect.md

@@ -1,11 +1,11 @@
 ---
-description: "List node and paragraph bundles and extra fields from graphql_compose_codegen (`drush graphql-compose-codegen:inspect`). Requires the module and drushSsh. Missing command fails loud. If allowedCommands is set, include graphql-compose-codegen:inspect. Does not write files."
+description: "List node and paragraph bundles and extra fields from graphql_compose_codegen (`drush graphql-compose-codegen:inspect`). Uses the configured module binding; unbound sites require the module and drushSsh. Missing command fails loud. If allowedCommands is set, include graphql-compose-codegen:inspect. Does not write files."
 argument-hint: "[site] [bundles] [skipFields]"
 ---
 
 Call the MCP tool `drupal_codegen_inspect`.
 
-List node and paragraph bundles and extra fields from graphql_compose_codegen (`drush graphql-compose-codegen:inspect`). Requires the module and drushSsh. Missing command fails loud. If allowedCommands is set, include graphql-compose-codegen:inspect. Does not write files.
+List node and paragraph bundles and extra fields from graphql_compose_codegen (`drush graphql-compose-codegen:inspect`). Uses the configured module binding; unbound sites require the module and drushSsh. Missing command fails loud. If allowedCommands is set, include graphql-compose-codegen:inspect. Does not write files.
 
 Parse the arguments supplied with this command into this tool's parameters:
 

package/.agents/commands/drupal-drush-sql-query.md

@@ -1,11 +1,11 @@
 ---
-description: "Run a single read-only SELECT through mcp_sentinel's governed command (`drush mcp-sentinel:sql-query`). Requires the site to set drushSsh.rawSql=\"governed\" AND the site's policy profile to set allow_raw_sql; both are off by default. The server refuses statements touching a denied entity type, a non-entity table, or a redacted field, and records every attempt in the tamper-evident audit log. Use the site-context or entity-schema tools for schema introspection."
+description: "Run a single read-only SELECT through the configured sqlQuery module binding, or the legacy governed Drush command on unbound sites. Requires the site to set drushSsh.rawSql=\"governed\" AND the site's policy profile to set allow_raw_sql; both are off by default. The server refuses statements touching a denied entity type, a non-entity table, or a redacted field, and records every attempt in the tamper-evident audit log. Use the site-context or entity-schema tools for schema introspection."
 argument-hint: "<query> [site]"
 ---
 
 Call the MCP tool `drupal_drush_sql_query`.
 
-Run a single read-only SELECT through mcp_sentinel's governed command (`drush mcp-sentinel:sql-query`). Requires the site to set drushSsh.rawSql="governed" AND the site's policy profile to set allow_raw_sql; both are off by default. The server refuses statements touching a denied entity type, a non-entity table, or a redacted field, and records every attempt in the tamper-evident audit log. Use the site-context or entity-schema tools for schema introspection.
+Run a single read-only SELECT through the configured sqlQuery module binding, or the legacy governed Drush command on unbound sites. Requires the site to set drushSsh.rawSql="governed" AND the site's policy profile to set allow_raw_sql; both are off by default. The server refuses statements touching a denied entity type, a non-entity table, or a redacted field, and records every attempt in the tamper-evident audit log. Use the site-context or entity-schema tools for schema introspection.
 
 Parse the arguments supplied with this command into this tool's parameters:
 

package/CHANGELOG.md

@@ -7,6 +7,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.19.1] - 2026-09-17
+
+### Changed
+- **Remove leftover Sentinel facades (#328).** `draft-write.js` and
+  `node-draft-inventory.js` were re-exports of `sentinel-draft.js`. Tests
+  import the client directly. Unused exports (`toolMessage`, `redactResponse`)
+  are gone; `DIAGNOSTIC_TOOLS` and `POLICY_DIGEST` each live in one place.
+- README and docs now report **123 tools across 27 modules** and **128 prompts**
+  (one per tool plus 5 workflow prompts). Codegen (`drupal_codegen_*`) shipped
+  in 2.16.0 but was missing from the public counts and the npm project page.
+
+## [2.19.0] - 2026-09-16
+
+### Added
+- Codegen and governed SQL compatibility commands can use module-owned Tool API
+  actions through explicit bindings (#317). Configured calls validate fresh
+  schemas and never fall back to SSH on failure. Core and third-party commands
+  remain available; unbound sites retain their existing migration path.
+
 ## [2.18.0] - 2026-09-16
 
 ### Fixed
@@ -1671,6 +1690,9 @@ The connector is now **dual-protocol**: every tool runs against an abstract back
 - User tools gained explicit PII-access assertions.
 - Whole tree lint-clean (`npm run lint`) with object-injection sinks rewritten to safe lookups.
 
+[2.19.1]: https://github.com/Wilkes-Liberty/drupal-mcp-connector/releases/tag/v2.19.1
+[2.19.0]: https://github.com/Wilkes-Liberty/drupal-mcp-connector/releases/tag/v2.19.0
+[2.18.0]: https://github.com/Wilkes-Liberty/drupal-mcp-connector/releases/tag/v2.18.0
 [2.17.0]: https://github.com/Wilkes-Liberty/drupal-mcp-connector/releases/tag/v2.17.0
 [2.16.0]: https://github.com/Wilkes-Liberty/drupal-mcp-connector/releases/tag/v2.16.0
 [2.15.2]: https://github.com/Wilkes-Liberty/drupal-mcp-connector/releases/tag/v2.15.2

package/README.md

@@ -68,7 +68,7 @@ See **[docs/architecture.md](docs/architecture.md)** for the backend abstraction
 
 ## Features
 
-### 120 Tools Across 26 Modules
+### 123 Tools Across 27 Modules
 
 | Module | Tools |
 |--------|-------|
@@ -77,6 +77,7 @@ See **[docs/architecture.md](docs/architecture.md)** for the backend abstraction
 | **Users** | List, get, create, update, block/unblock, role management (PII-gated) |
 | **Media** | List types, CRUD, file upload, orphaned-media detection |
 | **GraphQL** | Execute a query, schema introspection (mutation-gated) |
+| **Codegen** | Optional graphql_compose_codegen inspect/diff/generate (generate is `--dry-run` text) |
 | **Entities** | Generic CRUD for *any* Drupal entity type (paragraphs, commerce, webforms, …) |
 | **Site** | Site info, content-type discovery, configured-site listing |
 | **Reports** | Content summary, stale content, field completeness, SEO/accessibility audits, taxonomy usage, user activity, revision hotspots (10 read-only reports) |
@@ -308,7 +309,7 @@ an operator channel: keep the agent's credentials off it, and pin
 | [OAuth client_credentials](docs/oauth-client-credentials.md) | Production OAuth deploy: scope→role mapping, JSON:API writes, config persistence, secret handling, troubleshooting |
 | [Architecture](docs/architecture.md) | Backend abstraction, canonical model, and how to extend it |
 | [GraphQL Setup](docs/graphql-local-setup.md) | GraphQL Compose backend + local TLS notes |
-| [Tools Reference](docs/tools-reference.md) | Full reference for all 120 tools |
+| [Tools Reference](docs/tools-reference.md) | Full reference for all 123 tools |
 | [Security Guide](docs/security.md) | Presets, entity access control, field redaction |
 | [Security Hardening](docs/security-hardening.md) | Optional transport, identity, and secrets controls |
 | [Verification](docs/verification.md) | Prove a secure install: static + live checks, negative probes, evidence artefact, managed residuals |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drupal-mcp-connector",
-  "version": "2.18.0",
+  "version": "2.19.1",
   "description": "Drupal MCP Connector — multi-site MCP server for Drupal with JSON:API and GraphQL, governed writes, draft translations, content tools, audit reports, and an SSH Drush bridge.",
   "type": "module",
   "main": "src/index.js",

package/src/lib/dispatch.js

@@ -15,10 +15,10 @@ import { resolveSecurityConfig, assertNotReadOnly,
 import { toolError, toolResult } from "./errors.js";
 import { BackendCapabilityError, BackendResolutionError } from "./backends/errors.js";
 import { inferOperation } from "./operations.js";
-import { assertSourceGovernance, GovernanceError, GOVERNANCE_DIAGNOSTIC_TOOLS } from "./governance.js";
+import { assertSourceGovernance, GovernanceError } from "./governance.js";
 import {
-  assertPrincipalEntitlement, callerTargetHints, getRequestIdentity,
-  principalHasScope, resolveAuthoritativeTarget,
+  assertPrincipalEntitlement, callerTargetHints, DIAGNOSTIC_TOOLS,
+  getRequestIdentity, principalHasScope, resolveAuthoritativeTarget,
 } from "./principal.js";
 import { assertExplicitSiteForWrite, withResolvedTarget } from "./site-target.js";
 import { buildDataFlowContext, consumeBudgetIfEnforced, runWithDataFlow } from "./data-flow.js";
@@ -55,7 +55,7 @@ export function listResolvableSiteConfigs() {
  * @returns {?{site: object, source: string, name: string}}
  * @throws {SecurityError}
  */
-export function resolveCallTarget(toolName, rawArgs, context = {}) {
+function resolveCallTarget(toolName, rawArgs, context = {}) {
   if (toolName === "drupal_list_sites") return null;
   if (toolName === "drupal_governance_status" && callerTargetHints(rawArgs).length === 0) {
     return null;
@@ -157,7 +157,7 @@ export async function securityMiddleware(toolName, args, handler, context = {})
   const assertCallAllowed = async () => {
     // Source-governance gate (#176). The diagnostic tools stay callable while
     // governance fails — they are how an operator learns which condition failed.
-    if (!GOVERNANCE_DIAGNOSTIC_TOOLS.has(toolName)) {
+    if (!DIAGNOSTIC_TOOLS.has(toolName)) {
       await assertSourceGovernance(site);
     }
 
@@ -188,7 +188,7 @@ export async function securityMiddleware(toolName, args, handler, context = {})
     await assertCallAllowed();
     // Charge only after governance and policy gates pass, so an outage or a
     // local deny cannot exhaust the window. Diagnostics do not consume.
-    if (!GOVERNANCE_DIAGNOSTIC_TOOLS.has(toolName)) {
+    if (!DIAGNOSTIC_TOOLS.has(toolName)) {
       consumeBudgetIfEnforced("chained_action");
     }
     return handler(nextArgs);

package/src/lib/errors.js

@@ -25,14 +25,3 @@ export function toolResult(data) {
     content: [{ type: "text", text: JSON.stringify(data, null, 2) }],
   };
 }
-
-/**
- * Wrap a plain string message (for confirmations, warnings, etc.).
- * @param {string} text Message text.
- * @returns {{content: Array<{type: string, text: string}>}}
- */
-export function toolMessage(text) {
-  return {
-    content: [{ type: "text", text }],
-  };
-}

package/src/lib/evidence.js

@@ -36,12 +36,6 @@ export const EXECUTION_IDS = Object.freeze([
   "receiptId",
 ]);
 
-export const RECONCILE_STATES = Object.freeze([
-  "settled",
-  "incomplete",
-  "mismatched",
-]);
-
 const DEFAULT_MAX_RECORDS = 10_000;
 
 const FORBIDDEN_EXPORT_KEYS = new Set([

package/src/lib/governance.js

@@ -18,6 +18,7 @@
 
 import fetch from "node-fetch";
 import { authHeadersAsync, clientHeaders } from "./config.js";
+import { DIAGNOSTIC_TOOLS } from "./principal.js";
 
 /** How long a passing verification stays fresh before it must be re-proven. */
 export const OK_TTL_MS = 60_000;
@@ -25,13 +26,6 @@ export const OK_TTL_MS = 60_000;
 /** How long a failed verification is held before the next attempt re-checks. */
 export const FAIL_TTL_MS = 5_000;
 
-/** Tools that stay discoverable and callable while governance is failing —
- * the diagnostic surface an operator needs to see WHY it is failing. */
-export const GOVERNANCE_DIAGNOSTIC_TOOLS = new Set([
-  "drupal_list_sites",
-  "drupal_governance_status",
-]);
-
 /** Denial for a governed path whose source-governance contract is not verified. */
 export class GovernanceError extends Error {
   /**
@@ -203,5 +197,5 @@ export async function filterDiscoverableTools(definitions, sites) {
   const verdicts = await Promise.all(sites.map(async (site) =>
     !requiresGovernance(site) || (await verifySourceGovernance(site)).ok));
   if (verdicts.some(Boolean)) return definitions;
-  return definitions.filter((d) => GOVERNANCE_DIAGNOSTIC_TOOLS.has(d.name));
+  return definitions.filter((d) => DIAGNOSTIC_TOOLS.has(d.name));
 }

package/src/lib/link-checker.js

@@ -18,11 +18,11 @@
 import nodeFetch from "node-fetch";
 
 /** Default per-request timeout (ms). */
-export const DEFAULT_TIMEOUT_MS = 5000;
+const DEFAULT_TIMEOUT_MS = 5000;
 /** Default number of concurrent in-flight checks. */
-export const DEFAULT_CONCURRENCY = 5;
+const DEFAULT_CONCURRENCY = 5;
 /** Default hard ceiling on URLs checked in one call. */
-export const DEFAULT_MAX_LINKS = 200;
+const DEFAULT_MAX_LINKS = 200;
 
 /**
  * Hostnames that must never be probed regardless of allowlist — loopback and

package/src/lib/operations.js

@@ -12,7 +12,7 @@
 
 import { graphqlHasMutation } from "./security.js";
 
-export const WRITE_PREFIXES = ["drupal_create_", "drupal_update_", "drupal_upload_",
+const WRITE_PREFIXES = ["drupal_create_", "drupal_update_", "drupal_upload_",
   "drupal_block_",  "drupal_drush_cache", "drupal_drush_cron",
   "drupal_drush_config_export", "drupal_drush_config_import",
   "drupal_drush_updatedb", "drupal_drush_module_enable",
@@ -22,7 +22,7 @@ export const WRITE_PREFIXES = ["drupal_create_", "drupal_update_", "drupal_uploa
   // Governed config write (also gated inside the handler by the config-write cap):
   "drupal_config_set"];
 
-export const DESTRUCTIVE_PREFIXES = ["drupal_delete_", "drupal_drush_module_disable"];
+const DESTRUCTIVE_PREFIXES = ["drupal_delete_", "drupal_drush_module_disable"];
 
 /**
  * Classify a tool's operation intent from its name prefix.

package/src/lib/policy-enforcement.js

@@ -11,11 +11,11 @@
 import { createHash, createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import { SEAL_PREFIX } from "./policy-promotion.js";
 
-export const POLICY_BUNDLE_VERSION = 1;
+const POLICY_BUNDLE_VERSION = 1;
 
-export const DEFAULT_BUNDLE_TTL = 86400 * 30;
+const DEFAULT_BUNDLE_TTL = 86400 * 30;
 
-export const EMERGENCY_DENY = "*";
+const EMERGENCY_DENY = "*";
 
 export const EMERGENCY_DIGEST = "emergency-deny";
 
@@ -43,7 +43,7 @@ function normalize(value) {
  * @param {object} claims
  * @returns {string}
  */
-export function canonicalJson(claims) {
+function canonicalJson(claims) {
   return JSON.stringify(normalize(claims));
 }
 

package/src/lib/principal.js

@@ -15,6 +15,7 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import { getDefaultSiteName, getInboundGrants } from "./config.js";
 import { inferOperation } from "./operations.js";
+import { POLICY_DIGEST } from "./policy-promotion.js";
 import { resolveSecurityConfig, SecurityError } from "./security.js";
 
 const identityStore = new AsyncLocalStorage();
@@ -23,7 +24,6 @@ const identityStore = new AsyncLocalStorage();
 export const TARGET_HINT_KEYS = Object.freeze(["site", "environment", "tenant", "target"]);
 
 const ACTOR_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-const POLICY_DIGEST = /^[0-9a-f]{64}$/i;
 
 function tableHasKeys(table) {
   return Object.keys(table).some((key) => {
@@ -129,7 +129,7 @@ function grantNameList(values) {
  * @param {object|null} actors
  * @returns {object|null}
  */
-export function normalizeActors(actors) {
+function normalizeActors(actors) {
   if (!actors || typeof actors !== "object" || Array.isArray(actors)) return null;
   const entries = [];
   for (const [rawKey, value] of Object.entries(actors)) {
@@ -201,7 +201,7 @@ export function resolveActor({ identity = null, actors = null } = {}) {
  * @param {object|null} policies
  * @returns {object|null}
  */
-export function normalizePolicies(policies) {
+function normalizePolicies(policies) {
   if (!policies || typeof policies !== "object" || Array.isArray(policies)) return null;
   const entries = [];
   for (const [rawKey, value] of Object.entries(policies)) {

package/src/lib/relay/edge.js

@@ -348,7 +348,7 @@ function callerApprovalHint(args = {}) {
  * @param {unknown} raw
  * @returns {string[]|{invalid: true, reason: string}}
  */
-export function normalizeApprovalRequiredTools(raw) {
+function normalizeApprovalRequiredTools(raw) {
   if (raw === null || raw === undefined) return [];
   if (Array.isArray(raw)) {
     return [...new Set(
@@ -415,7 +415,7 @@ export class EdgeStartupError extends Error {
  * @param {Record<string, string|string[]>} [headers]
  * @returns {Record<string, string>}
  */
-export function fanDownHeaders(headers = {}) {
+function fanDownHeaders(headers = {}) {
   const entries = [];
   for (const [name, value] of Object.entries(forwardHeaders(headers))) {
     const key = String(name).toLowerCase();

package/src/lib/security.js

@@ -387,7 +387,7 @@ export function hasScope(site, scope) {
  * @param {object} site Resolved site config.
  * @returns {boolean}
  */
-export function isGovernedSetup(site) {
+function isGovernedSetup(site) {
   return site?.requireGovernance === true || Boolean(site?.oauth);
 }
 
@@ -723,23 +723,6 @@ export function redactCanonicalEntity(entity, secConfig, entityType) {
   return { ...entity, fields: redactedFields, ...baseOverrides };
 }
 
-/**
- * Redact a full JSON:API response by redacting each item under `.data`.
- * @param {?object} response JSON:API response with a `data` object or array.
- * @param {object} secConfig Resolved security config.
- * @param {string} entityType Entity type for the response data.
- * @returns {?object} New response; original is not mutated.
- */
-export function redactResponse(response, secConfig, entityType) {
-  if (!response?.data) return response;
-  return {
-    ...response,
-    data: Array.isArray(response.data)
-      ? response.data.map((r) => redactResource(r, secConfig, entityType))
-      : redactResource(response.data, secConfig, entityType),
-  };
-}
-
 // ---------------------------------------------------------------------------
 // Security summary tool (exposed as drupal_security_info)
 // ---------------------------------------------------------------------------

package/src/lib/tool-prompts.js

@@ -29,7 +29,7 @@ export const promptNameToToolName = (name) => name.replace(/-/g, "_");
  * @param {object} spec - A JSON-Schema property spec.
  * @returns {string} e.g. "string", "boolean (true/false)", "object (pass as JSON)".
  */
-export function typeHint(spec) {
+function typeHint(spec) {
   const t = Array.isArray(spec?.type) ? spec.type[0] : spec?.type;
   switch (t) {
     case "boolean":       return "boolean (true/false)";
@@ -84,7 +84,7 @@ export function buildToolPrompts(definitions) {
  * @param {object} args - Arguments supplied to the prompt (all strings per MCP).
  * @returns {string} A user-role instruction message body.
  */
-export function renderToolInstruction(def, args = {}) {
+function renderToolInstruction(def, args = {}) {
   const params   = paramList(def.inputSchema);
   const required = params.filter((p) => p.required);
   const optional = params.filter((p) => !p.required);

package/src/lib/usage.js

@@ -31,15 +31,6 @@ export const USAGE_DECISIONS = Object.freeze(["allow", "deny"]);
  */
 export const RECEIPT_OUTCOMES = Object.freeze(["ok", "failed", "unknown"]);
 
-/** Reconciliation states over one request / decision / receipt chain. */
-export const RECONCILE_STATES = Object.freeze([
-  "settled",
-  "denied",
-  "missing",
-  "duplicate",
-  "uncertain",
-]);
-
 const PHASE_SET = new Set(USAGE_PHASES);
 const DECISION_SET = new Set(USAGE_DECISIONS);
 const OUTCOME_SET = new Set(RECEIPT_OUTCOMES);

package/src/lib/verify.js

@@ -30,9 +30,9 @@ import { resolveInboundAuthConfig, resolveInboundAuthMode } from "./http-auth.js
  * and does not fail it: a verifier a secure install can never pass is a
  * verifier people stop running.
  */
-export const PASS = "pass";
-export const FAIL = "fail";
-export const SKIPPED = "skipped";
+const PASS = "pass";
+const FAIL = "fail";
+const SKIPPED = "skipped";
 export const NOT_APPLICABLE = "n/a";
 
 /** Every static check, in report order. */

package/src/tools/codegen.js

@@ -1,7 +1,8 @@
 /**
  * Tool group: GraphQL Compose Codegen (TypeScript / Next.js scaffolds).
  *
- * Thin Drush wrappers around `drupal/graphql_compose_codegen`. The generator
+ * Compatibility adapters through configured module bindings, or legacy Drush.
+ * Thin wrappers around `drupal/graphql_compose_codegen`. The generator
  * lives on the Drupal site; this connector does not reimplement it and does
  * not run GraphQL Code Generator against the SDL.
  *
@@ -16,6 +17,7 @@
 
 import { getSiteConfig } from "../lib/config.js";
 import { sshDrush } from "./drush.js";
+import { callBoundModuleTool, toolResultData } from "../lib/server-tools.js";
 import { SecurityError } from "../lib/security.js";
 import { validateMachineName } from "../lib/validate.js";
 
@@ -75,6 +77,18 @@ async function runGqcc(
   const site = getSiteConfig(siteName);
   const names = parseMachineNameList(bundles, "bundles");
   const skip = parseMachineNameList(skipFields, "skipFields");
+  if (site.serverTools?.bindings !== undefined) {
+    const binding = new Map([
+      [INSPECT, "codegenInspect"], [DIFF, "codegenDiff"], [GENERATE, "codegenPreview"],
+    ]).get(subcommand);
+    const result = toolResultData(await callBoundModuleTool(site, binding, {
+      bundles: names, skip_fields: skip,
+    }, { operation: "read", scope: "mcp_config", capabilities: ["configRead"] }));
+    if (result?.success !== true || !result.data || typeof result.data !== "object" || Array.isArray(result.data)) {
+      throw new SecurityError("Codegen module returned an invalid result. No SSH fallback was attempted.");
+    }
+    return { output: JSON.stringify(result.data), command: `module:${binding}`, wroteFiles: false };
+  }
   const args = [subcommand];
   if (names.length) args.push(`--bundles=${names.join(",")}`);
   if (skip.length) args.push(`--skip-fields=${skip.join(",")}`);
@@ -126,19 +140,19 @@ export const definitions = [
   {
     name: "drupal_codegen_inspect",
     description:
-      "List node and paragraph bundles and extra fields from graphql_compose_codegen (`drush graphql-compose-codegen:inspect`). Requires the module and drushSsh. Missing command fails loud. If allowedCommands is set, include graphql-compose-codegen:inspect. Does not write files.",
+      "List node and paragraph bundles and extra fields from graphql_compose_codegen (`drush graphql-compose-codegen:inspect`). Uses the configured module binding; unbound sites require the module and drushSsh. Missing command fails loud. If allowedCommands is set, include graphql-compose-codegen:inspect. Does not write files.",
     inputSchema: { type: "object", properties: LIST_PROPS },
   },
   {
     name: "drupal_codegen_diff",
     description:
-      "Compare the live graphql_compose schema to the last gqcc:generate snapshot (`drush graphql-compose-codegen:diff`). Requires the module and drushSsh. Missing command fails loud. If allowedCommands is set, include graphql-compose-codegen:diff.",
+      "Compare the live graphql_compose schema to the last gqcc:generate snapshot (`drush graphql-compose-codegen:diff`). Uses the configured module binding; unbound sites require the module and drushSsh. Missing command fails loud. If allowedCommands is set, include graphql-compose-codegen:diff.",
     inputSchema: { type: "object", properties: LIST_PROPS },
   },
   {
     name: "drupal_codegen_generate",
     description:
-      "Return TypeScript/GraphQL scaffold artefacts from graphql_compose_codegen as text (`drush graphql-compose-codegen:generate --dry-run`). Never writes on the Drupal host (no --output-dir). Copy artefacts locally. Requires the module and drushSsh. Missing command fails loud. If allowedCommands is set, include graphql-compose-codegen:generate.",
+      "Return TypeScript/GraphQL scaffold artefacts from graphql_compose_codegen as text (`drush graphql-compose-codegen:generate --dry-run`). Never writes on the Drupal host (no --output-dir). Copy artefacts locally. Uses the configured module binding; unbound sites require the module and drushSsh. Missing command fails loud. If allowedCommands is set, include graphql-compose-codegen:generate.",
     inputSchema: { type: "object", properties: LIST_PROPS },
   },
 ];

package/src/tools/drush.js

@@ -20,6 +20,7 @@
  * Requires per-site "drushSsh" config block — tools fail gracefully if absent.
  */
 
+import { callBoundModuleTool, toolResultData } from "../lib/server-tools.js";
 import { Client }        from "ssh2";
 import { readFileSync }  from "fs";
 import { homedir }       from "os";
@@ -456,6 +457,15 @@ async function sqlQuery({ site: siteName, query }) {
   assertGovernedRawSql(sshCfg, site._name);
   // Fast local reject only; mcp_sentinel's guard is the authority.
   validateSqlQuery(query);
+  if (site.serverTools?.bindings !== undefined) {
+    const result = toolResultData(await callBoundModuleTool(site, "sqlQuery", { query }, {
+      operation: "read", scope: "mcp_admin", capabilities: ["rawSql"],
+    }));
+    if (result?.success !== true || !result.data || !Array.isArray(result.data.rows)) {
+      throw new SecurityError("SQL module returned an invalid governed result. No SSH fallback was attempted.");
+    }
+    return result.data;
+  }
   const out = await sshDrush(site, ["mcp-sentinel:sql-query", query]);
   // The command emits a JSON object; a non-JSON reply means the command was
   // not found (mcp_sentinel absent or too old), which must not be reported as
@@ -534,7 +544,7 @@ export const definitions = [
   },
   {
     name: "drupal_drush_sql_query",
-    description: "Run a single read-only SELECT through mcp_sentinel's governed command (`drush mcp-sentinel:sql-query`). Requires the site to set drushSsh.rawSql=\"governed\" AND the site's policy profile to set allow_raw_sql; both are off by default. The server refuses statements touching a denied entity type, a non-entity table, or a redacted field, and records every attempt in the tamper-evident audit log. Use the site-context or entity-schema tools for schema introspection.",
+    description: "Run a single read-only SELECT through the configured sqlQuery module binding, or the legacy governed Drush command on unbound sites. Requires the site to set drushSsh.rawSql=\"governed\" AND the site's policy profile to set allow_raw_sql; both are off by default. The server refuses statements touching a denied entity type, a non-entity table, or a redacted field, and records every attempt in the tamper-evident audit log. Use the site-context or entity-schema tools for schema introspection.",
     inputSchema: { type: "object", required: ["query"], properties: { site: { type: "string" }, query: { type: "string" } } },
   },
   {

package/src/tools/moderation.js

@@ -39,7 +39,7 @@ const SAMPLE_CAP = 500;
  * @param {unknown} err
  * @returns {boolean}
  */
-export function isUnfilterableModerationState(err) {
+function isUnfilterableModerationState(err) {
   const msg = String(err?.message || "");
   if (!/moderation_state/i.test(msg)) return false;
   return /not found/i.test(msg) || /not filterable/i.test(msg) || /invalid filter/i.test(msg);

package/src/tools/paragraphs.js

@@ -57,7 +57,7 @@ import {
  * @param {number|string|null|undefined} [revisionId] Current revision id.
  * @returns {{type: string, id: string, meta?: {target_revision_id: number}}}
  */
-export function embedRef(bundle, id, revisionId) {
+function embedRef(bundle, id, revisionId) {
   return embedParagraphRef(bundle, id, revisionId);
 }
 

package/src/lib/draft-write.js

@@ -1,19 +0,0 @@
-/**
- * Compatibility facade for the Sentinel HTTP client.
- * New call sites should import from `./sentinel-draft.js`.
- */
-
-export {
-  assertDraftLangcode,
-  assertInventoryDraftLanguage,
-  createTranslationDraft,
-  isMissingDraftEndpoint,
-  isMissingTranslationEndpoint,
-  readDraftTranslation,
-  readNodeDraftInventory,
-  readTranslationInventory,
-  resolveNodeTranslationPair,
-  rewriteTranslationWorkingRevisionError,
-  supportsSentinelDraft,
-  writeDraft,
-} from "./sentinel-draft.js";

package/src/lib/node-draft-inventory.js

@@ -1,5 +0,0 @@
-/** Sentinel discovery for translation-only node revisions (#297). */
-export {
-  assertInventoryDraftLanguage,
-  readNodeDraftInventory,
-} from "./sentinel-draft.js";