forta-mcp 1.0.0 → 1.0.1

package/index.js

@@ -64,7 +64,7 @@ if (!API_URL || !API_TOKEN) {
 
 // --- HTTP helper ---
 
-async function api(method, path, params, body) {
+async function api(method, path, params, body, opts_ = {}) {
     const url = new URL(path, API_URL);
     if (params) {
         for (const [k, v] of Object.entries(params)) {
@@ -73,12 +73,16 @@ async function api(method, path, params, body) {
     }
     const opts = {
         method,
-        headers: {
-            Authorization: `Bearer ${API_TOKEN}`,
-        },
+        headers: {},
         signal: AbortSignal.timeout(30000),
     };
-    if (body) {
+    // The OAuth endpoints authenticate with client credentials, not the API
+    // token, and reject a stray Authorization header.
+    if (!opts_.noAuth) opts.headers.Authorization = `Bearer ${API_TOKEN}`;
+    if (body && opts_.form) {
+        opts.headers["Content-Type"] = "application/x-www-form-urlencoded";
+        opts.body = new URLSearchParams(body).toString();
+    } else if (body) {
         opts.headers["Content-Type"] = "application/json";
         opts.body = JSON.stringify(body);
     }
@@ -279,9 +283,9 @@ server.tool("forta_delete_role", "Delete a role. Users holding it lose its permi
 
 // --- Grants ---
 
-server.tool("forta_list_grants", "List access grants — which users can access which platforms, and with what role. Filter by platform_id or user_id; omit both to list all. This is the first place to look when a user gets a 403 from an appleby.cloud service", {
-    platform_id: z.number().optional().describe("Filter to one platform"),
-    user_id: z.number().optional().describe("Filter to one user"),
+server.tool("forta_list_grants", "List access grants — which users can access which platforms, and with what role. The first place to look when a user gets a 403 from an appleby.cloud service. Filters are mutually exclusive, not combined: pass platform_id OR user_id, or neither to list all. Passing both silently ignores user_id", {
+    platform_id: z.number().optional().describe("Filter to one platform (takes precedence over user_id)"),
+    user_id: z.number().optional().describe("Filter to one user (ignored if platform_id is also given)"),
 }, async ({ platform_id, user_id }) => {
     const res = await api("GET", "/admin/grants", { platform_id, user_id });
     return { content: text(res) };
@@ -312,10 +316,13 @@ server.tool("forta_check_grant", "Check whether the token's user holds an active
 
 // --- Token introspection ---
 
-server.tool("forta_introspect_token", "Introspect an access token (RFC 7662) — returns active, sub, exp, iat, client_id, token_type. Use this to diagnose whether a token a service rejected is expired, malformed, or bound to a different platform", {
-    token: z.string().describe("The access token to introspect"),
-}, async ({ token }) => {
-    const res = await api("POST", "/oauth/introspect", null, { token });
+server.tool("forta_introspect_token", "Introspect an access JWT (RFC 7662) — returns active, sub, exp, iat, token_type. Answers 'is the token this service rejected expired, malformed, or lacking a grant?'. Requires the calling platform's client credentials: introspection is scoped to that platform, and a token valid elsewhere returns active=false here. Only works for access JWTs — opaque frt_ API tokens always report active=false, so use forta_list_api_tokens to inspect those instead", {
+    token: z.string().describe("The access JWT to introspect"),
+    client_id: z.string().describe("Calling platform's client_id (from forta_list_platforms)"),
+    client_secret: z.string().describe("Calling platform's client_secret — shown only when the platform is created or its credentials are rotated"),
+}, async ({ token, client_id, client_secret }) => {
+    const res = await api("POST", "/oauth/introspect", null,
+        { token, client_id, client_secret }, { form: true, noAuth: true });
     return { content: text(res) };
 });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forta-mcp",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "MCP server for the Forta OAuth2 identity provider",
   "type": "module",
   "main": "index.js",
@@ -13,7 +13,10 @@
   "keywords": [
     "mcp",
     "forta",
-    "auth", "oauth", "identity", "sso",
+    "auth",
+    "oauth",
+    "identity",
+    "sso",
     "model-context-protocol"
   ],
   "author": "Aiden Appleby",