evrex-mcp 0.9.0 → 0.10.0

package/README.md

@@ -64,6 +64,30 @@ re-rendered from the transcript and marked authoritative over the summary).
 | `EVREX_API_BASE_URL` | no | Point at a self-hosted evrex backend. Defaults to the hosted one. |
 | `ANTHROPIC_MODEL` | no | Defaults to `claude-opus-5`. |
 
+## Hosted mode
+
+The same tools over HTTPS, for agents that run in someone else's cloud and can only attach a remote MCP server.
+That includes Claude Tag in Slack, Cursor cloud agents, the Copilot coding agent, Devin and CI.
+Evrex runs it at `https://api.evrex.ai/mcp`. Mint a read-only token at https://app.evrex.ai/agents and give the agent:
+
+- `Authorization: Bearer evx_…` (required)
+- `X-Evrex-Repo: owner/name` (optional), or the full git remote URL for a repo not on github.com. This is the repo to
+  search when a tool call names none. Without it, a call searches every repo your team has indexed. A value that names
+  no repo is refused with a 400.
+
+Where a config reads the token from the environment, keep it in `EVREX_MCP_TOKEN`, never `EVREX_TOKEN`: on a machine
+that captures sessions, `EVREX_TOKEN` takes precedence over the enrolled capture credential, so a read-only agent
+token there makes every capture upload fail.
+
+To run your own copy:
+
+```sh
+PORT=3100 EVREX_API_BASE_URL=https://api.evrex.ai npx -y evrex-mcp serve
+```
+
+It is stateless (POST `/mcp` only) and keeps no data. Each request's token makes that request's calls to the backend.
+`EVREX_MCP_ALLOWED_ORIGINS` (comma-separated) replaces the default list of browser origins it admits.
+
 ## No API credits needed to query
 
 The tools return the recorded context — constraints, rejected approaches, prior

package/dist/account.js

@@ -3,21 +3,42 @@
 // src/account.ts
 import { statSync, openSync, readSync, closeSync } from "node:fs";
 
+// src/request-context.ts
+import { AsyncLocalStorage } from "node:async_hooks";
+var storage = new AsyncLocalStorage();
+function currentRequest() {
+  return storage.getStore();
+}
+
 // src/client.ts
 var DEFAULT_API_BASE_URL = "https://api.evrex.ai";
 var API_BASE_URL = (process.env.EVREX_API_BASE_URL ?? process.env.EVREX_API_URL ?? DEFAULT_API_BASE_URL).replace(/\/+$/, "");
 var EVREX_TOKEN = process.env.EVREX_TOKEN ?? process.env.EVREX_API_TOKEN ?? null;
+function token() {
+  return currentRequest()?.token ?? EVREX_TOKEN;
+}
 function headers() {
   const base = { "Content-Type": "application/json" };
-  if (EVREX_TOKEN) base.Authorization = `Bearer ${EVREX_TOKEN}`;
+  const credential = token();
+  if (credential) base.Authorization = `Bearer ${credential}`;
   return base;
 }
 function describeFailure(method, path, status, statusText) {
   if (status === 401 || status === 403) {
+    if (currentRequest()) {
+      return `${method} ${path} -> ${status}: the Evrex token this connection carries was rejected, or lacks the scope this needs. Mint a read token at https://app.evrex.ai/agents.`;
+    }
     return EVREX_TOKEN ? `${method} ${path} -> ${status}: the EVREX_TOKEN this server was started with was rejected. It may be revoked or expired.` : `${method} ${path} -> ${status}: this evrex backend requires a credential, but no EVREX_TOKEN is set for this MCP server.`;
   }
   return `${method} ${path} -> ${status} ${statusText}`;
 }
+var EvrexApiError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+    this.name = "EvrexApiError";
+  }
+};
 async function request(method, path, { body, absentIsAnswer } = {}) {
   const res = await fetch(`${API_BASE_URL}${path}`, {
     method,
@@ -25,7 +46,7 @@ async function request(method, path, { body, absentIsAnswer } = {}) {
     ...body === void 0 ? {} : { body: JSON.stringify(body) }
   });
   if (res.status === 404 && absentIsAnswer) return null;
-  if (!res.ok) throw new Error(describeFailure(method, path, res.status, res.statusText));
+  if (!res.ok) throw new EvrexApiError(describeFailure(method, path, res.status, res.statusText), res.status);
   return await res.json();
 }
 var get = (path) => request("GET", path);
@@ -34,6 +55,7 @@ var post = (path, body) => request("POST", path, { body });
 var evrexApi = {
   baseUrl: API_BASE_URL,
   repos: () => get("/repos"),
+  me: () => get("/auth/me"),
   commits: (repoPath) => get(`/commits?repoPath=${encodeURIComponent(repoPath)}`),
   // Abbreviated shas resolve server-side, so a value pasted from `git log`
   // works here (apps/backend/src/reads/reads.service.ts#resolveSha).

package/dist/capture.js

@@ -3368,18 +3368,39 @@ var init_src = __esm({
   }
 });
 
+// src/request-context.ts
+import { AsyncLocalStorage } from "node:async_hooks";
+function currentRequest() {
+  return storage.getStore();
+}
+var storage;
+var init_request_context = __esm({
+  "src/request-context.ts"() {
+    "use strict";
+    storage = new AsyncLocalStorage();
+  }
+});
+
 // src/client.ts
 var client_exports = {};
 __export(client_exports, {
+  EvrexApiError: () => EvrexApiError,
   evrexApi: () => evrexApi
 });
+function token() {
+  return currentRequest()?.token ?? EVREX_TOKEN;
+}
 function headers() {
   const base = { "Content-Type": "application/json" };
-  if (EVREX_TOKEN) base.Authorization = `Bearer ${EVREX_TOKEN}`;
+  const credential = token();
+  if (credential) base.Authorization = `Bearer ${credential}`;
   return base;
 }
 function describeFailure(method, path, status, statusText) {
   if (status === 401 || status === 403) {
+    if (currentRequest()) {
+      return `${method} ${path} -> ${status}: the Evrex token this connection carries was rejected, or lacks the scope this needs. Mint a read token at https://app.evrex.ai/agents.`;
+    }
     return EVREX_TOKEN ? `${method} ${path} -> ${status}: the EVREX_TOKEN this server was started with was rejected. It may be revoked or expired.` : `${method} ${path} -> ${status}: this evrex backend requires a credential, but no EVREX_TOKEN is set for this MCP server.`;
   }
   return `${method} ${path} -> ${status} ${statusText}`;
@@ -3391,22 +3412,31 @@ async function request(method, path, { body, absentIsAnswer } = {}) {
     ...body === void 0 ? {} : { body: JSON.stringify(body) }
   });
   if (res.status === 404 && absentIsAnswer) return null;
-  if (!res.ok) throw new Error(describeFailure(method, path, res.status, res.statusText));
+  if (!res.ok) throw new EvrexApiError(describeFailure(method, path, res.status, res.statusText), res.status);
   return await res.json();
 }
-var DEFAULT_API_BASE_URL, API_BASE_URL, EVREX_TOKEN, get, getOrNull, post, evrexApi;
+var DEFAULT_API_BASE_URL, API_BASE_URL, EVREX_TOKEN, EvrexApiError, get, getOrNull, post, evrexApi;
 var init_client = __esm({
   "src/client.ts"() {
     "use strict";
+    init_request_context();
     DEFAULT_API_BASE_URL = "https://api.evrex.ai";
     API_BASE_URL = (process.env.EVREX_API_BASE_URL ?? process.env.EVREX_API_URL ?? DEFAULT_API_BASE_URL).replace(/\/+$/, "");
     EVREX_TOKEN = process.env.EVREX_TOKEN ?? process.env.EVREX_API_TOKEN ?? null;
+    EvrexApiError = class extends Error {
+      constructor(message, status) {
+        super(message);
+        this.status = status;
+        this.name = "EvrexApiError";
+      }
+    };
     get = (path) => request("GET", path);
     getOrNull = (path) => request("GET", path, { absentIsAnswer: true });
     post = (path, body) => request("POST", path, { body });
     evrexApi = {
       baseUrl: API_BASE_URL,
       repos: () => get("/repos"),
+      me: () => get("/auth/me"),
       commits: (repoPath) => get(`/commits?repoPath=${encodeURIComponent(repoPath)}`),
       // Abbreviated shas resolve server-side, so a value pasted from `git log`
       // works here (apps/backend/src/reads/reads.service.ts#resolveSha).
@@ -3500,11 +3530,13 @@ evrex will not fall back to writing the credential in a plain file.`
         if (!await this.available()) throw new NoKeychainError(this.runner.platform);
         switch (this.runner.platform) {
           case "darwin": {
+            if (/["\\\r\n]/.test(secret)) {
+              throw new Error("Keychain write refused: the credential has a character `security -i` cannot carry.");
+            }
             const result = await this.runner.run(
               "security",
-              ["add-generic-password", "-a", ACCOUNT, "-s", SERVICE, "-U", "-w"],
-              `${secret}
-${secret}
+              ["-i"],
+              `add-generic-password -a "${ACCOUNT}" -s "${SERVICE}" -U -w "${secret}"
 `
             );
             if (result.code !== 0) throw new Error(`Keychain write failed: ${result.stderr.trim()}`);
@@ -3860,8 +3892,8 @@ async function main() {
     return;
   }
   const { evrexApi: evrexApi2 } = await Promise.resolve().then(() => (init_client(), client_exports));
-  let token;
-  const credential = () => token ??= captureToken(process.env, async () => {
+  let token2;
+  const credential = () => token2 ??= captureToken(process.env, async () => {
     const { CredentialStore: CredentialStore2 } = await Promise.resolve().then(() => (init_credential_store(), credential_store_exports));
     return new CredentialStore2().retrieve();
   });

package/dist/continuity.js

@@ -5,21 +5,42 @@ import { execFileSync as execFileSync2 } from "node:child_process";
 import { closeSync, openSync, readSync, statSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
+// src/request-context.ts
+import { AsyncLocalStorage } from "node:async_hooks";
+var storage = new AsyncLocalStorage();
+function currentRequest() {
+  return storage.getStore();
+}
+
 // src/client.ts
 var DEFAULT_API_BASE_URL = "https://api.evrex.ai";
 var API_BASE_URL = (process.env.EVREX_API_BASE_URL ?? process.env.EVREX_API_URL ?? DEFAULT_API_BASE_URL).replace(/\/+$/, "");
 var EVREX_TOKEN = process.env.EVREX_TOKEN ?? process.env.EVREX_API_TOKEN ?? null;
+function token() {
+  return currentRequest()?.token ?? EVREX_TOKEN;
+}
 function headers() {
   const base = { "Content-Type": "application/json" };
-  if (EVREX_TOKEN) base.Authorization = `Bearer ${EVREX_TOKEN}`;
+  const credential = token();
+  if (credential) base.Authorization = `Bearer ${credential}`;
   return base;
 }
 function describeFailure(method, path, status, statusText) {
   if (status === 401 || status === 403) {
+    if (currentRequest()) {
+      return `${method} ${path} -> ${status}: the Evrex token this connection carries was rejected, or lacks the scope this needs. Mint a read token at https://app.evrex.ai/agents.`;
+    }
     return EVREX_TOKEN ? `${method} ${path} -> ${status}: the EVREX_TOKEN this server was started with was rejected. It may be revoked or expired.` : `${method} ${path} -> ${status}: this evrex backend requires a credential, but no EVREX_TOKEN is set for this MCP server.`;
   }
   return `${method} ${path} -> ${status} ${statusText}`;
 }
+var EvrexApiError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+    this.name = "EvrexApiError";
+  }
+};
 async function request(method, path, { body, absentIsAnswer } = {}) {
   const res = await fetch(`${API_BASE_URL}${path}`, {
     method,
@@ -27,7 +48,7 @@ async function request(method, path, { body, absentIsAnswer } = {}) {
     ...body === void 0 ? {} : { body: JSON.stringify(body) }
   });
   if (res.status === 404 && absentIsAnswer) return null;
-  if (!res.ok) throw new Error(describeFailure(method, path, res.status, res.statusText));
+  if (!res.ok) throw new EvrexApiError(describeFailure(method, path, res.status, res.statusText), res.status);
   return await res.json();
 }
 var get = (path) => request("GET", path);
@@ -36,6 +57,7 @@ var post = (path, body) => request("POST", path, { body });
 var evrexApi = {
   baseUrl: API_BASE_URL,
   repos: () => get("/repos"),
+  me: () => get("/auth/me"),
   commits: (repoPath) => get(`/commits?repoPath=${encodeURIComponent(repoPath)}`),
   // Abbreviated shas resolve server-side, so a value pasted from `git log`
   // works here (apps/backend/src/reads/reads.service.ts#resolveSha).

package/dist/hook.js

@@ -3,21 +3,42 @@
 // src/hook.ts
 import { pathToFileURL } from "node:url";
 
+// src/request-context.ts
+import { AsyncLocalStorage } from "node:async_hooks";
+var storage = new AsyncLocalStorage();
+function currentRequest() {
+  return storage.getStore();
+}
+
 // src/client.ts
 var DEFAULT_API_BASE_URL = "https://api.evrex.ai";
 var API_BASE_URL = (process.env.EVREX_API_BASE_URL ?? process.env.EVREX_API_URL ?? DEFAULT_API_BASE_URL).replace(/\/+$/, "");
 var EVREX_TOKEN = process.env.EVREX_TOKEN ?? process.env.EVREX_API_TOKEN ?? null;
+function token() {
+  return currentRequest()?.token ?? EVREX_TOKEN;
+}
 function headers() {
   const base = { "Content-Type": "application/json" };
-  if (EVREX_TOKEN) base.Authorization = `Bearer ${EVREX_TOKEN}`;
+  const credential = token();
+  if (credential) base.Authorization = `Bearer ${credential}`;
   return base;
 }
 function describeFailure(method, path, status, statusText) {
   if (status === 401 || status === 403) {
+    if (currentRequest()) {
+      return `${method} ${path} -> ${status}: the Evrex token this connection carries was rejected, or lacks the scope this needs. Mint a read token at https://app.evrex.ai/agents.`;
+    }
     return EVREX_TOKEN ? `${method} ${path} -> ${status}: the EVREX_TOKEN this server was started with was rejected. It may be revoked or expired.` : `${method} ${path} -> ${status}: this evrex backend requires a credential, but no EVREX_TOKEN is set for this MCP server.`;
   }
   return `${method} ${path} -> ${status} ${statusText}`;
 }
+var EvrexApiError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+    this.name = "EvrexApiError";
+  }
+};
 async function request(method, path, { body, absentIsAnswer } = {}) {
   const res = await fetch(`${API_BASE_URL}${path}`, {
     method,
@@ -25,7 +46,7 @@ async function request(method, path, { body, absentIsAnswer } = {}) {
     ...body === void 0 ? {} : { body: JSON.stringify(body) }
   });
   if (res.status === 404 && absentIsAnswer) return null;
-  if (!res.ok) throw new Error(describeFailure(method, path, res.status, res.statusText));
+  if (!res.ok) throw new EvrexApiError(describeFailure(method, path, res.status, res.statusText), res.status);
   return await res.json();
 }
 var get = (path) => request("GET", path);
@@ -34,6 +55,7 @@ var post = (path, body) => request("POST", path, { body });
 var evrexApi = {
   baseUrl: API_BASE_URL,
   repos: () => get("/repos"),
+  me: () => get("/auth/me"),
   commits: (repoPath) => get(`/commits?repoPath=${encodeURIComponent(repoPath)}`),
   // Abbreviated shas resolve server-side, so a value pasted from `git log`
   // works here (apps/backend/src/reads/reads.service.ts#resolveSha).

package/dist/import.js

@@ -3368,18 +3368,39 @@ var init_src = __esm({
   }
 });
 
+// src/request-context.ts
+import { AsyncLocalStorage } from "node:async_hooks";
+function currentRequest() {
+  return storage.getStore();
+}
+var storage;
+var init_request_context = __esm({
+  "src/request-context.ts"() {
+    "use strict";
+    storage = new AsyncLocalStorage();
+  }
+});
+
 // src/client.ts
 var client_exports = {};
 __export(client_exports, {
+  EvrexApiError: () => EvrexApiError,
   evrexApi: () => evrexApi
 });
+function token() {
+  return currentRequest()?.token ?? EVREX_TOKEN;
+}
 function headers() {
   const base = { "Content-Type": "application/json" };
-  if (EVREX_TOKEN) base.Authorization = `Bearer ${EVREX_TOKEN}`;
+  const credential = token();
+  if (credential) base.Authorization = `Bearer ${credential}`;
   return base;
 }
 function describeFailure(method, path, status, statusText) {
   if (status === 401 || status === 403) {
+    if (currentRequest()) {
+      return `${method} ${path} -> ${status}: the Evrex token this connection carries was rejected, or lacks the scope this needs. Mint a read token at https://app.evrex.ai/agents.`;
+    }
     return EVREX_TOKEN ? `${method} ${path} -> ${status}: the EVREX_TOKEN this server was started with was rejected. It may be revoked or expired.` : `${method} ${path} -> ${status}: this evrex backend requires a credential, but no EVREX_TOKEN is set for this MCP server.`;
   }
   return `${method} ${path} -> ${status} ${statusText}`;
@@ -3391,22 +3412,31 @@ async function request(method, path, { body, absentIsAnswer } = {}) {
     ...body === void 0 ? {} : { body: JSON.stringify(body) }
   });
   if (res.status === 404 && absentIsAnswer) return null;
-  if (!res.ok) throw new Error(describeFailure(method, path, res.status, res.statusText));
+  if (!res.ok) throw new EvrexApiError(describeFailure(method, path, res.status, res.statusText), res.status);
   return await res.json();
 }
-var DEFAULT_API_BASE_URL, API_BASE_URL, EVREX_TOKEN, get, getOrNull, post, evrexApi;
+var DEFAULT_API_BASE_URL, API_BASE_URL, EVREX_TOKEN, EvrexApiError, get, getOrNull, post, evrexApi;
 var init_client = __esm({
   "src/client.ts"() {
     "use strict";
+    init_request_context();
     DEFAULT_API_BASE_URL = "https://api.evrex.ai";
     API_BASE_URL = (process.env.EVREX_API_BASE_URL ?? process.env.EVREX_API_URL ?? DEFAULT_API_BASE_URL).replace(/\/+$/, "");
     EVREX_TOKEN = process.env.EVREX_TOKEN ?? process.env.EVREX_API_TOKEN ?? null;
+    EvrexApiError = class extends Error {
+      constructor(message, status) {
+        super(message);
+        this.status = status;
+        this.name = "EvrexApiError";
+      }
+    };
     get = (path) => request("GET", path);
     getOrNull = (path) => request("GET", path, { absentIsAnswer: true });
     post = (path, body) => request("POST", path, { body });
     evrexApi = {
       baseUrl: API_BASE_URL,
       repos: () => get("/repos"),
+      me: () => get("/auth/me"),
       commits: (repoPath) => get(`/commits?repoPath=${encodeURIComponent(repoPath)}`),
       // Abbreviated shas resolve server-side, so a value pasted from `git log`
       // works here (apps/backend/src/reads/reads.service.ts#resolveSha).
@@ -3500,11 +3530,13 @@ evrex will not fall back to writing the credential in a plain file.`
         if (!await this.available()) throw new NoKeychainError(this.runner.platform);
         switch (this.runner.platform) {
           case "darwin": {
+            if (/["\\\r\n]/.test(secret)) {
+              throw new Error("Keychain write refused: the credential has a character `security -i` cannot carry.");
+            }
             const result = await this.runner.run(
               "security",
-              ["add-generic-password", "-a", ACCOUNT, "-s", SERVICE, "-U", "-w"],
-              `${secret}
-${secret}
+              ["-i"],
+              `add-generic-password -a "${ACCOUNT}" -s "${SERVICE}" -U -w "${secret}"
 `
             );
             if (result.code !== 0) throw new Error(`Keychain write failed: ${result.stderr.trim()}`);
@@ -3778,8 +3810,8 @@ async function durability(target, argv) {
   };
   const minAgeDays = flag("--min-age-days", 30);
   const limit = flag("--limit", 300);
-  const token = process.env.EVREX_TOKEN ?? await new (await Promise.resolve().then(() => (init_credential_store(), credential_store_exports))).CredentialStore().retrieve().catch(() => null);
-  if (!token) {
+  const token2 = process.env.EVREX_TOKEN ?? await new (await Promise.resolve().then(() => (init_credential_store(), credential_store_exports))).CredentialStore().retrieve().catch(() => null);
+  if (!token2) {
     console.error("evrex: this machine is not enrolled.\n  Run `npx -y evrex-mcp enrol` first, or set EVREX_TOKEN.");
     process.exit(1);
   }
@@ -3796,7 +3828,7 @@ async function durability(target, argv) {
   }
   const res = await fetch(`${evrexApi2.baseUrl}/ingest/commits/durability`, {
     method: "POST",
-    headers: { "content-type": "application/json", authorization: `Bearer ${token}` },
+    headers: { "content-type": "application/json", authorization: `Bearer ${token2}` },
     body: JSON.stringify({ repoId, measurements })
   });
   if (!res.ok) {
@@ -3812,8 +3844,8 @@ async function parents(target) {
   const { deriveRepoId: deriveRepoId2 } = await Promise.resolve().then(() => (init_src(), src_exports));
   const { execFileSync: execFileSync5 } = await import("node:child_process");
   const { evrexApi: evrexApi2 } = await Promise.resolve().then(() => (init_client(), client_exports));
-  const token = process.env.EVREX_TOKEN ?? await new (await Promise.resolve().then(() => (init_credential_store(), credential_store_exports))).CredentialStore().retrieve().catch(() => null);
-  if (!token) {
+  const token2 = process.env.EVREX_TOKEN ?? await new (await Promise.resolve().then(() => (init_credential_store(), credential_store_exports))).CredentialStore().retrieve().catch(() => null);
+  if (!token2) {
     console.error("evrex: this machine is not enrolled.\n  Run `npx -y evrex-mcp enrol` first, or set EVREX_TOKEN.");
     process.exit(1);
   }
@@ -3828,7 +3860,7 @@ async function parents(target) {
   for (let i = 0; i < rows.length; i += 500) {
     const res = await fetch(`${evrexApi2.baseUrl}/ingest/commits/parents`, {
       method: "POST",
-      headers: { "content-type": "application/json", authorization: `Bearer ${token}` },
+      headers: { "content-type": "application/json", authorization: `Bearer ${token2}` },
       body: JSON.stringify({ repoId, commits: rows.slice(i, i + 500) })
     });
     if (!res.ok) {
@@ -3853,8 +3885,8 @@ async function main() {
   const target = resolve(process.argv[3] ?? process.cwd());
   const { evrexApi: evrexApi2 } = await Promise.resolve().then(() => (init_client(), client_exports));
   const { CredentialStore: CredentialStore2 } = await Promise.resolve().then(() => (init_credential_store(), credential_store_exports));
-  const token = process.env.EVREX_TOKEN ?? await new CredentialStore2().retrieve().catch(() => null);
-  if (!token) {
+  const token2 = process.env.EVREX_TOKEN ?? await new CredentialStore2().retrieve().catch(() => null);
+  if (!token2) {
     console.error(
       "evrex: this machine is not enrolled.\n  Run `npx -y evrex-mcp enrol` first, or set EVREX_TOKEN."
     );
@@ -3873,7 +3905,7 @@ async function main() {
           method: "POST",
           headers: {
             "content-type": "application/json",
-            authorization: `Bearer ${token}`
+            authorization: `Bearer ${token2}`
           },
           body: JSON.stringify(body)
         });