drupal-mcp-connector 2.7.2 → 2.7.3

package/CHANGELOG.md

@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.7.3] - 2026-08-18
+
+### Fixed
+- **Launcher and startup name a secret-table / config mismatch (#211).**
+  The shipped Keychain table matches `config/config.example.json`. A
+  `config.json` that uses different `clientSecretEnv` names without a
+  `config/secrets.map` left the table and the config each valid and
+  jointly inert. Per-item Keychain misses stay silent (break-glass).
+  When the table matches **no** named secret, `bin/drupal-mcp-launch.sh`
+  and `src/lib/load-secrets.js` now print one stderr line that names
+  the unmapped variables and says `secrets.map` is absent (or that the
+  map does not name them). Fail-closed start when every named secret is
+  unset is unchanged.
+
 ## [2.7.2] - 2026-08-18
 
 ### Fixed

package/README.md

@@ -9,7 +9,7 @@
 
 Built by **Jeremy Michael Cerda** (opensource@wilkesliberty.com). Maintained by [Wilkes & Liberty, LLC](https://github.com/Wilkes-Liberty).
 
-**If the client only shows `drupal_list_sites` and `drupal_governance_status`**, the secret env vars named in `config.json` are unset. Upgrade to **2.7.2** (or at least 2.6.1), or stay on 2.6.0 and launch via `bin/drupal-mcp-launch.sh` with a `config/secrets.map` (`ENV_VAR=keychain-item`). Then restart the MCP server. See [#199](https://github.com/Wilkes-Liberty/drupal-mcp-connector/issues/199).
+**If the client only shows `drupal_list_sites` and `drupal_governance_status`**, the secret env vars named in `config.json` are unset. Upgrade to **2.7.3** (or at least 2.6.1), or stay on 2.6.0 and launch via `bin/drupal-mcp-launch.sh` with a `config/secrets.map` (`ENV_VAR=keychain-item`). Then restart the MCP server. See [#199](https://github.com/Wilkes-Liberty/drupal-mcp-connector/issues/199).
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drupal-mcp-connector",
-  "version": "2.7.2",
+  "version": "2.7.3",
   "description": "A secure, multi-site Model Context Protocol (MCP) connector for Drupal — dual-protocol JSON:API and GraphQL.",
   "type": "module",
   "main": "src/index.js",

package/src/index.js

@@ -34,7 +34,7 @@ import { serveStdio } from "@modelcontextprotocol/server/stdio";
 import { toNodeHandler } from "@modelcontextprotocol/node";
 
 import { listSiteNames, getTlsConfig, loadConfig, CLIENT_VERSION } from "./lib/config.js";
-import { loadLocalSecrets, secretLoadFatalMessage } from "./lib/load-secrets.js";
+import { loadLocalSecrets, secretLoadFatalMessage, secretTableMismatchMessage } from "./lib/load-secrets.js";
 import {
   makeBearerCheck,
   resolveInboundAuthConfig,
@@ -68,7 +68,10 @@ if (secretFatal) {
   console.error(`[drupal-mcp-connector] FATAL: ${secretFatal}`);
   process.exit(1);
 }
-if (secretLoad.unset.length) {
+const secretMismatch = secretTableMismatchMessage(secretLoad);
+if (secretMismatch) {
+  console.error(`[drupal-mcp-connector] WARNING: ${secretMismatch}`);
+} else if (secretLoad.unset.length) {
   console.error(
     "[drupal-mcp-connector] WARNING: config.json names secret env vars that are unset: " +
     `${secretLoad.unset.join(", ")}. Those sites will fail closed.`

package/src/lib/load-secrets.js

@@ -9,8 +9,10 @@
  * The default table matches config/config.example.json. A gitignored
  * config/secrets.map replaces that table for a deployment whose env-var
  * names differ. Per-item Keychain misses stay silent (inert break-glass).
- * If the active config.json names secret env vars and none of them are set
- * after this step, the caller must refuse to start.
+ * Zero overlap between the table and the names in config.json is a
+ * distinct case — the two files are jointly inert — and the caller should
+ * say so. If every named secret is still unset after this step, the caller
+ * must refuse to start.
  */
 
 import { execFileSync } from "node:child_process";
@@ -101,7 +103,7 @@ export function lookupKeychainItem(item) {
  * @param {NodeJS.ProcessEnv} [options.env] Mutated when a lookup succeeds.
  * @param {typeof readFileSync} [options.readFile]
  * @param {(item: string) => string} [options.lookup]
- * @returns {{pairs: number, resolved: number, named: string[], unset: string[]}}
+ * @returns {{pairs: number, resolved: number, named: string[], unset: string[], tableVars: string[], source: "map"|"default"}}
  */
 export function loadLocalSecrets({
   cwd = process.cwd(),
@@ -109,11 +111,13 @@ export function loadLocalSecrets({
   readFile = readFileSync,
   lookup = lookupKeychainItem,
 } = {}) {
+  let source = "map";
   let pairs;
   try {
     pairs = parseSecretMap(readFile(join(cwd, "config", "secrets.map"), "utf8"));
   } catch {
     pairs = DEFAULT_SECRET_PAIRS;
+    source = "default";
   }
 
   let resolved = 0;
@@ -140,16 +144,47 @@ export function loadLocalSecrets({
 
   const envMap = new Map(Object.entries(env));
   const unset = named.filter((name) => !envMap.get(name));
-  return { pairs: pairs.length, resolved, named, unset };
+  const tableVars = pairs.map(([varName]) => varName);
+  return { pairs: pairs.length, resolved, named, unset, tableVars, source };
+}
+
+/**
+ * One-line diagnosis when the secret table and config.json share no names.
+ * Null when there is any overlap, or when config names no secrets.
+ * Per-item Keychain misses are not a mismatch.
+ * @param {{named: string[], tableVars?: string[], source?: "map"|"default"}} loaded
+ * @returns {string|null}
+ */
+export function secretTableMismatchMessage(loaded) {
+  if (!loaded.named.length) return null;
+  const table = new Set(loaded.tableVars || []);
+  const unmapped = loaded.named.filter((name) => !table.has(name));
+  if (unmapped.length !== loaded.named.length) return null;
+  const source = loaded.source === "map"
+    ? "config/secrets.map does not name them"
+    : "using shipped defaults; config/secrets.map is absent";
+  const unset = Array.isArray(loaded.unset) ? loaded.unset : [];
+  const closer = unset.length
+    ? "Unset: " + unset.join(", ") + ". Those sites will fail closed."
+    : "Named secrets already in the environment stay set; the table will not populate any of them.";
+  return (
+    "no secret-table entries match clientSecretEnv/apiTokenEnv names in config.json " +
+    "(" + unmapped.join(", ") + "); " + source + ". " +
+    closer
+  );
 }
 
 /**
  * Refuse to boot a server that can only advertise diagnostic tools.
- * @param {{named: string[], unset: string[]}} loaded
+ * @param {{named: string[], unset: string[], tableVars?: string[], source?: "map"|"default"}} loaded
  * @returns {string|null} Fatal message, or null when start is allowed.
  */
 export function secretLoadFatalMessage(loaded) {
   if (!loaded.named.length || loaded.unset.length !== loaded.named.length) return null;
+  const mismatch = secretTableMismatchMessage(loaded);
+  if (mismatch) {
+    return mismatch + " Refusing to start. Map those names in config/secrets.map (ENV_VAR=keychain-item) or export them before launch.";
+  }
   return (
     `every clientSecretEnv/apiTokenEnv named in config.json is unset (${loaded.unset.join(", ")}). ` +
     "Refusing to start. Map those names in config/secrets.map (ENV_VAR=keychain-item) " +