drupal-mcp-connector 2.6.0 → 2.6.1

package/CHANGELOG.md

@@ -7,6 +7,22 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.6.1] - 2026-08-17
+
+### Fixed
+- **A process no longer starts when every secret named by the active config
+  is unset (#199).** After 2.6.0, a client that spawned `node src/index.js`
+  (skipping the launcher) or whose `config.json` still used older
+  `clientSecretEnv` names could start with zero resolved sites and advertise
+  only `drupal_list_sites` and `drupal_governance_status`. The diagnostic
+  then told the operator to provide an oauth block that was already there.
+  2.6.1 loads `config/secrets.map` (or the shipped example table) inside
+  `node`; names the unset variable; classifies
+  `drupal_governance_status` failures; and **refuses to start** when every
+  named secret is missing. On 2.6.0 the same recovery is: launch via
+  `bin/drupal-mcp-launch.sh` with a `config/secrets.map`
+  (`ENV_VAR=keychain-item`), then restart the MCP client.
+
 ## [2.6.0] - 2026-08-15
 
 ### Added

package/README.md

@@ -9,6 +9,8 @@
 
 Built by **Jeremy Michael Cerda** (opensource@wilkesliberty.com). Maintained by [Wilkes & Liberty, LLC](https://github.com/Wilkes-Liberty).
 
+**If the client only shows `drupal_list_sites` and `drupal_governance_status`**, the secret env vars named in `config.json` are unset. Upgrade to **2.6.1**, or stay on 2.6.0 and launch via `bin/drupal-mcp-launch.sh` with a `config/secrets.map` (`ENV_VAR=keychain-item`). Then restart the MCP server. See [#199](https://github.com/Wilkes-Liberty/drupal-mcp-connector/issues/199).
+
 ---
 
 ## What It Does

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drupal-mcp-connector",
-  "version": "2.6.0",
+  "version": "2.6.1",
   "description": "A secure, multi-site Model Context Protocol (MCP) connector for Drupal \u2014 dual-protocol JSON:API and GraphQL.",
   "type": "module",
   "main": "src/index.js",

package/src/index.js

@@ -32,6 +32,7 @@ import { serveStdio } from "@modelcontextprotocol/server/stdio";
 import { toNodeHandler } from "@modelcontextprotocol/node";
 
 import { listSiteNames, getTlsConfig, CLIENT_VERSION } from "./lib/config.js";
+import { loadLocalSecrets, secretLoadFatalMessage } from "./lib/load-secrets.js";
 import { makeBearerCheck } from "./lib/http-auth.js";
 import { createLegacySessionHandler, createMcpRequestHandler } from "./lib/http-handler.js";
 import { createConnectorServerFactory } from "./lib/mcp-server.js";
@@ -43,6 +44,22 @@ import { filterDiscoverableTools } from "./lib/governance.js";
 import { allDefinitions, allHandlers, definitionsByName } from "./tools/index.js";
 import { buildToolPrompts, getToolPromptMessages } from "./lib/tool-prompts.js";
 
+// Apply config/secrets.map (or the shipped example table) before any site
+// resolution. MCP clients spawn this file directly; the shell launcher is
+// not guaranteed to have run.
+const secretLoad = loadLocalSecrets();
+const secretFatal = secretLoadFatalMessage(secretLoad);
+if (secretFatal) {
+  console.error(`[drupal-mcp-connector] FATAL: ${secretFatal}`);
+  process.exit(1);
+}
+if (secretLoad.unset.length) {
+  console.error(
+    "[drupal-mcp-connector] WARNING: config.json names secret env vars that are unset: " +
+    `${secretLoad.unset.join(", ")}. Those sites will fail closed.`
+  );
+}
+
 // ---------------------------------------------------------------------------
 // MCP Resources — browsable, always-fresh site context
 // ---------------------------------------------------------------------------

package/src/lib/config.js

@@ -85,8 +85,26 @@ export function assertSecureAuth(site) {
     throw new SecurityError(`Site "${site._name}": requireSecureAuth is set but baseUrl is not HTTPS.`);
   }
   if (!site.apiToken && !hasValidOauth(site)) {
+    const siteName = site._name ?? "";
+    if (site.oauth?.clientSecretEnv && !site.oauth.clientSecret) {
+      throw new SecurityError(
+        `Site "${siteName}": requireSecureAuth is set but oauth.clientSecretEnv ` +
+        `"${site.oauth.clientSecretEnv}" is not set in the environment.`
+      );
+    }
+    if (site.apiTokenEnv && !site.apiToken) {
+      throw new SecurityError(
+        `Site "${siteName}": requireSecureAuth is set but apiTokenEnv ` +
+        `"${site.apiTokenEnv}" is not set in the environment.`
+      );
+    }
+    if (site.oauth && !site.oauth.clientId) {
+      throw new SecurityError(
+        `Site "${siteName}": requireSecureAuth is set but the oauth block has no clientId.`
+      );
+    }
     throw new SecurityError(
-      `Site "${site._name}": requireSecureAuth is set but no Bearer apiToken or OAuth2 client ` +
+      `Site "${siteName}": requireSecureAuth is set but no Bearer apiToken or OAuth2 client ` +
       "credentials are configured (anonymous and basic auth are not permitted). " +
       "Provide apiToken/apiTokenEnv or an oauth block."
     );

package/src/lib/load-secrets.js

@@ -0,0 +1,158 @@
+/**
+ * Load connector secrets the same way for every entry point.
+ *
+ * MCP clients often spawn `node src/index.js` directly. The shell launcher
+ * cannot be the only place that applies `config/secrets.map`, or a process
+ * that skipped the launcher starts, resolves zero sites, and advertises only
+ * diagnostic tools — the 2.6.0/#180 failure on this machine.
+ *
+ * The default table matches config/config.example.json. A gitignored
+ * config/secrets.map replaces that table for a deployment whose env-var
+ * names differ. Per-item Keychain misses stay silent (inert break-glass).
+ * If the active config.json names secret env vars and none of them are set
+ * after this step, the caller must refuse to start.
+ */
+
+import { execFileSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+/** Shipped env-var → Keychain-item pairs. Matches config/config.example.json. */
+export const DEFAULT_SECRET_PAIRS = Object.freeze([
+  ["MCP_CONTENT_PRODUCTION_SECRET", "drupal-mcp-content-production"],
+  ["MCP_CONTENT_STAGING_SECRET", "drupal-mcp-content-staging"],
+  ["MCP_DEVELOPER_DEVELOPMENT_SECRET", "drupal-mcp-developer-development"],
+  ["MCP_ADMIN_BREAKGLASS_SECRET", "drupal-mcp-admin-breakglass"],
+]);
+
+/**
+ * Parse a secrets.map body. `#` comments and malformed lines are ignored.
+ * @param {string} text
+ * @returns {Array<[string, string]>}
+ */
+export function parseSecretMap(text) {
+  const pairs = [];
+  for (const raw of String(text).split(/\r?\n/)) {
+    const line = raw.replace(/#.*$/, "").trim();
+    if (!line || !line.includes("=")) continue;
+    const eq = line.indexOf("=");
+    const varName = line.slice(0, eq).trim();
+    const item = line.slice(eq + 1).trim();
+    if (varName && item) pairs.push([varName, item]);
+  }
+  return pairs;
+}
+
+/**
+ * Collect clientSecretEnv / apiTokenEnv names from a parsed config object.
+ * @param {object} cfg
+ * @returns {string[]}
+ */
+export function namedSecretEnvVars(cfg) {
+  const names = [];
+  const seen = new Set();
+  const walk = (value) => {
+    if (!value || typeof value !== "object") return;
+    if (Array.isArray(value)) {
+      value.forEach(walk);
+      return;
+    }
+    for (const [key, val] of Object.entries(value)) {
+      if (key.startsWith("_")) continue;
+      if ((key === "clientSecretEnv" || key === "apiTokenEnv") && typeof val === "string") {
+        const name = val.trim();
+        if (name && !seen.has(name)) {
+          seen.add(name);
+          names.push(name);
+        }
+        continue;
+      }
+      walk(val);
+    }
+  };
+  walk(cfg);
+  return names;
+}
+
+/**
+ * Look up one macOS Keychain generic password. Returns "" when missing or
+ * when not on Darwin. Never throws. Never logs the value.
+ * @param {string} item
+ * @returns {string}
+ */
+export function lookupKeychainItem(item) {
+  if (process.platform !== "darwin" || !item) return "";
+  try {
+    const value = execFileSync("security", ["find-generic-password", "-s", item, "-w"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+    });
+    return String(value).replace(/\n$/, "");
+  } catch {
+    return "";
+  }
+}
+
+/**
+ * Apply the secret table and report how the active config lines up with env.
+ *
+ * @param {object} [options]
+ * @param {string} [options.cwd]
+ * @param {NodeJS.ProcessEnv} [options.env] Mutated when a lookup succeeds.
+ * @param {typeof readFileSync} [options.readFile]
+ * @param {(item: string) => string} [options.lookup]
+ * @returns {{pairs: number, resolved: number, named: string[], unset: string[]}}
+ */
+export function loadLocalSecrets({
+  cwd = process.cwd(),
+  env = process.env,
+  readFile = readFileSync,
+  lookup = lookupKeychainItem,
+} = {}) {
+  let pairs;
+  try {
+    pairs = parseSecretMap(readFile(join(cwd, "config", "secrets.map"), "utf8"));
+  } catch {
+    pairs = DEFAULT_SECRET_PAIRS;
+  }
+
+  let resolved = 0;
+  for (const [varName, item] of pairs) {
+    const current = new Map(Object.entries(env)).get(varName);
+    if (current) continue;
+    const value = lookup(item);
+    if (!value) continue;
+    Object.defineProperty(env, varName, {
+      value,
+      writable: true,
+      enumerable: true,
+      configurable: true,
+    });
+    resolved += 1;
+  }
+
+  let named = [];
+  try {
+    named = namedSecretEnvVars(JSON.parse(readFile(join(cwd, "config", "config.json"), "utf8")));
+  } catch {
+    named = [];
+  }
+
+  const envMap = new Map(Object.entries(env));
+  const unset = named.filter((name) => !envMap.get(name));
+  return { pairs: pairs.length, resolved, named, unset };
+}
+
+/**
+ * Refuse to boot a server that can only advertise diagnostic tools.
+ * @param {{named: string[], unset: string[]}} loaded
+ * @returns {string|null} Fatal message, or null when start is allowed.
+ */
+export function secretLoadFatalMessage(loaded) {
+  if (!loaded.named.length || loaded.unset.length !== loaded.named.length) return null;
+  return (
+    `every clientSecretEnv/apiTokenEnv named in config.json is unset (${loaded.unset.join(", ")}). ` +
+    "Refusing to start. Map those names in config/secrets.map (ENV_VAR=keychain-item) " +
+    "or export them before launch."
+  );
+}

package/src/tools/site.js

@@ -58,9 +58,38 @@ async function listConfiguredSites() {
  * @param {object} args - { site? } (a named site narrows the report).
  * @returns {Promise<{sites: object[]}>} required/ok/reason per site.
  */
+/**
+ * Classify a getSiteConfig failure so the diagnostic reason matches the cause.
+ * @param {string} message
+ * @returns {string}
+ */
+export function classifySiteResolutionFailure(message) {
+  if (message.includes("Unknown site:")) return "unknown_site";
+  if (message.includes("baseUrl is not HTTPS")) return "insecure_base_url";
+  if (message.includes("is not set in the environment")) return "credential_unresolved";
+  return "site_unresolved";
+}
+
 async function getGovernanceStatus({ site: siteName } = {}) {
   const names = siteName ? [siteName] : listSiteNames();
-  return { sites: await governanceStatus(names.map((n) => getSiteConfig(n))) };
+  const resolved = [];
+  const unresolved = [];
+  for (const name of names) {
+    try {
+      resolved.push(getSiteConfig(name));
+    } catch (error) {
+      const detail = error instanceof Error ? error.message : "site could not be resolved";
+      unresolved.push({
+        site: name,
+        required: null,
+        ok: false,
+        reason: classifySiteResolutionFailure(detail),
+        detail,
+        checkedAt: null,
+      });
+    }
+  }
+  return { sites: [...unresolved, ...(await governanceStatus(resolved))] };
 }
 
 // ---------------------------------------------------------------------------
@@ -102,6 +131,8 @@ export const definitions = [
   },
 ];
 
+export { getGovernanceStatus };
+
 export const handlers = {
   drupal_site_info:          getSiteInfo,
   drupal_list_content_types: listContentTypes,