forta-mcp 1.1.0 → 1.2.0

package/AGENTS.md

@@ -114,11 +114,26 @@ be a Forta **super-admin** — the token does not bypass that.
 |-------|-------|
 | Health & identity | `forta_health`, `forta_get_self` |
 | Users | list, get, update, delete |
-| Platforms | list, get, create, update, delete, rotate credentials |
+| Platforms | list, get, create, update, delete, rotate credentials. `create`/`update` carry **`backchannel_logout_uri`** — see the warning below |
 | Roles | list, get, create, update, delete |
 | Grants | list, create, revoke, check |
 | Tokens | introspect, list/create/revoke API tokens |
 
+### Setting `backchannel_logout_uri` — order matters
+
+Forta POSTs a signed `logout_token` to this URL the instant a grant is revoked, so the consumer
+ends the session immediately instead of waiting up to five minutes for its introspection poll.
+
+⚠️ **Only set it once the platform actually serves the endpoint.** Until then every notification
+404s, is retried six times on a backoff, and is marked `exhausted` — which looks in the logs like
+a broken receiver rather than one that was never built. Deploy first, register second.
+
+Pass `null` to clear it. Absent is the normal state for a platform that has not implemented the
+receiver, and it is never an error — such a platform is simply skipped by the sender.
+
+`https` only; the emitter refuses anything else at send time and logs
+`FORTA_BACKCHANNEL_BAD_ENDPOINT`.
+
 ### Two behaviours that are easy to get wrong
 
 **1. `/oauth/introspect` is a resource-server endpoint, not an admin one.** It requires the
@@ -148,6 +163,12 @@ description says so; do not "fix" it by sending both.
 
 - **Published to npm** as `forta-mcp` (public). `npx -y` resolves the latest, so **publishing
   is deployment**.
+- **Bump the version in TWO places before publishing** — `package.json` *and* the `McpServer({
+  version })` literal in `index.js`. npm refuses to republish an existing version, so forgetting
+  `package.json` fails loudly (`cannot publish over the previously published versions`), but
+  forgetting the one in `index.js` fails SILENTLY: the server then reports a version it is not,
+  and a client debugging "which build am I talking to" is misled by the only field that answers
+  that question.
 - **Publishing requires 2FA via passkey** and must run from an interactive terminal — npm's web
   auth flow needs a browser, and from a non-TTY subprocess it degrades to demanding an OTP a
   passkey-only account cannot produce.
@@ -198,5 +219,7 @@ Update this AGENTS.md in the same change when you:
 - **Change `api()` or its `opts`** → update *How code is written here*.
 - **Discover a `forta-api` behaviour that contradicts a tool description** → fix both, and
   record it under *Two behaviours that are easy to get wrong* if it is non-obvious.
+- **Add/change a tool parameter** → bump the minor version in BOTH places (see *Operations*) in
+  the same change, so the commit that adds the capability is the commit that can be published.
 - **Publish** → note the version and what changed.
 - Also keep `README.md`'s tool tables in sync.

package/index.js

@@ -158,7 +158,7 @@ function body(obj) {
 
 const server = new McpServer({
     name: "forta",
-    version: "1.1.0",
+    version: "1.2.0",
 });
 
 // --- Health & identity ---
@@ -233,6 +233,7 @@ server.tool("forta_create_platform", "Register a new OAuth platform. Returns the
     description: z.string().optional().describe("Description"),
     redirect_uris: z.array(z.string()).optional().describe("Allowed OAuth redirect URIs"),
     logout_redirect_uris: z.array(z.string()).optional().describe("Allowed post-logout redirect URIs"),
+    backchannel_logout_uri: z.string().nullable().optional().describe("OIDC Back-Channel Logout 1.0 endpoint on the platform (https only). Forta POSTs a signed logout_token here the moment a grant is revoked, instead of the consumer waiting up to 5 minutes for its introspection poll. Pass null to clear. ⚠️ Only set this once the platform actually serves the endpoint — until then every notification 404s, retries 6 times and is marked exhausted"),
     allowed_origins: z.array(z.string()).optional().describe("Allowed CORS origins"),
     is_first_party: z.boolean().optional().describe("First-party app (skips the consent screen)"),
     internal_resource: z.boolean().optional().describe("Internal resource, hidden from the app launcher"),
@@ -254,6 +255,7 @@ server.tool("forta_update_platform", "Update a platform's configuration. Only th
     platform_type: z.enum(["WEB", "SPA", "SERVICE", "MOBILE"]).optional(),
     redirect_uris: z.array(z.string()).optional(),
     logout_redirect_uris: z.array(z.string()).optional(),
+    backchannel_logout_uri: z.string().nullable().optional().describe("OIDC Back-Channel Logout 1.0 endpoint on the platform (https only). Forta POSTs a signed logout_token here the moment a grant is revoked, instead of the consumer waiting up to 5 minutes for its introspection poll. Pass null to clear. ⚠️ Only set this once the platform actually serves the endpoint — until then every notification 404s, retries 6 times and is marked exhausted"),
     allowed_origins: z.array(z.string()).optional(),
     is_first_party: z.boolean().optional(),
     internal_resource: z.boolean().optional(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forta-mcp",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "MCP server for the Forta OAuth2 identity provider",
   "type": "module",
   "main": "index.js",