iit-mcp-autotask 0.7.0 → 0.7.1

package/README.md

@@ -8,10 +8,10 @@ context into one call, a generic read layer for the long tail, one result envelo
 packaged playbooks, strong security boundaries, and predictable per-tenant in-process state (pooled
 client + SDK-owned TTL caches).
 
-> **Package status (2026-10-17):** the runtime dependency `node-autotask` is published to public npm
-> at `0.16.0`; the committed `pnpm-lock.yaml` pins that
+> **Package status (2026-10-18):** the runtime dependency `node-autotask` is published to public npm
+> at `0.17.0`; the committed `pnpm-lock.yaml` pins that
 > release with its integrity hash, so installs resolve deterministically. The dependency is always npm
-> (node-autotask pinned exactly at `0.16.0`) — never a `file:`, `git:`, `link:` or workspace reference
+> (node-autotask pinned exactly at `0.17.0`) — never a `file:`, `git:`, `link:` or workspace reference
 > to a local checkout.
 
 > **0.6.0 is a breaking release** (unreleased): tool names, result shapes and configuration all
@@ -42,9 +42,28 @@ its contract, `autotask_read` runs it.
   (`companies.unbilledWork`), contract profitability (`contracts.profitability`), aggregates
   (`operations.aggregate`) and SLA health (`tickets.slaHealthCheck`) run here; `autotask_guide`
   holds their recipes.
-- `autotask_guide` serves the packaged playbooks: `ticket-triage`, `company-360`,
-  `unbilled-work-review`, `contract-profitability`, `invoice-export`, and on the operator profile
-  `log-time-entry`.
+- `autotask_guide` serves the packaged playbooks — the server's skill layer (below).
+
+### `autotask_guide`: the packaged playbooks (the server's skill layer)
+
+Six outcome playbooks ship with the server — `skills/*.md`, part of the npm tarball — and are
+served by `autotask_guide` as **static text**: it never interpolates API data and never calls the
+vendor, so loading a playbook costs no wire and adds no injection surface.
+
+- No args: the index (one line per skill).
+- `{skill}`: one playbook in full (frontmatter included).
+- `{skill, section}`: one of its `## ` sections.
+
+Skills: `ticket-triage`, `company-360`, `unbilled-work-review`, `contract-profitability`,
+`invoice-export`, and on the operator profile `log-time-entry`.
+
+The playbooks are discoverable in both directions:
+
+- The guide is the only tool that carries `_meta: { "anthropic/alwaysLoad": true }`, so hosts
+  that defer tool loading still surface it — it is the entry point to the recipes.
+- Each skill's frontmatter `ops` list (`<tool>:<operation>` entries) feeds a reverse index:
+  `autotask_describe` for an operation answers with the `playbooks[]` that use it, so a model
+  that lands on an operation is pointed at the recipe.
 
 Composites bound **each part independently** (every part reads its own declared limit argument); a
 part miss never fails the call (typed `absent`); only a missing root record fails the composite.
@@ -636,7 +655,7 @@ independent review with its resolutions, [`docs/reviews/0.6.0.md`](docs/reviews/
 
 ## SDK dependency
 
-`iit-mcp-autotask` depends on **`node-autotask` from npm at exactly `0.16.0`** (an exact pin —
+`iit-mcp-autotask` depends on **`node-autotask` from npm at exactly `0.17.0`** (an exact pin —
 no range operator; subpaths `.` / `/capabilities` / `/operations` / `/resources` / `/types` /
 `/pool`) — the only **vendor** dependency; the other two runtime dependencies are
 `@modelcontextprotocol/server` (the MCP framework) and `zod` (schema validation). It never
@@ -646,7 +665,7 @@ user — the published tarball ships no lockfile) must resolve to the release th
 reviewed against, or the plan-hash boot check refuses to start.
 
 **Publishing `node-autotask` is the maintainer's action, done manually.** It is published on the
-public registry at `0.16.0` (published 2026-10-17); the
+public registry at `0.17.0` (published 2026-10-18); the
 exact pin and the committed `pnpm-lock.yaml` (with `pnpm-workspace.yaml`) pin the real published
 tarball with its integrity hash, so installs resolve to exactly that release — the lockfile
 freezes the pnpm/git/Docker paths, the pin freezes the npm/npx paths. The docs are written against this

package/dist/tools/server.d.ts

@@ -28,7 +28,7 @@ import { type TokenStore } from '../http-guard.js';
 import type { WriteRuntime } from '../write/runtime.js';
 /** The wire identity of this server (the initialize answer + the `/metadata` payload). */
 export declare const SERVER_NAME = "iit-mcp-autotask";
-export declare const SERVER_VERSION = "0.7.0";
+export declare const SERVER_VERSION = "0.7.1";
 export declare const SERVER_TITLE = "Autotask MCP Server";
 /**
  * The MCP protocol era this server advertises (the `/metadata` stamp, both levels).
@@ -60,7 +60,7 @@ export declare function serverInstructions(config: Pick<Config, 'AUTOTASK_PROFIL
 /** The full identity stamp (the `/metadata` build block — the era pair, FR-2). */
 export declare const SERVER_IDENTITY: {
     readonly name: "iit-mcp-autotask";
-    readonly version: "0.7.0";
+    readonly version: "0.7.1";
     readonly mcpProtocolBaseline: "2026-07-28";
     readonly legacyProtocolFallback: "2025-11-25";
 };

package/dist/tools/server.js

@@ -29,7 +29,7 @@ import { registerTools } from './register.js';
 import { configForToken } from '../http-guard.js';
 /** The wire identity of this server (the initialize answer + the `/metadata` payload). */
 export const SERVER_NAME = 'iit-mcp-autotask';
-export const SERVER_VERSION = '0.7.0';
+export const SERVER_VERSION = '0.7.1';
 export const SERVER_TITLE = 'Autotask MCP Server';
 /**
  * The MCP protocol era this server advertises (the `/metadata` stamp, both levels).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "iit-mcp-autotask",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "MCP server for the Autotask (Datto) PSA domain, built on the node-autotask SDK",
   "license": "MIT",
   "author": "Max Soukhomlinov",
@@ -35,25 +35,9 @@
   "engines": {
     "node": ">=24.0.0"
   },
-  "scripts": {
-    "build": "tsc",
-    "start": "node dist/main.js",
-    "dev": "tsx src/main.ts",
-    "typecheck": "tsc --noEmit",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "lint": "eslint src test",
-    "lint:fix": "eslint src test --fix",
-    "clean": "rimraf dist coverage",
-    "fresh-install-check": "bash scripts/fresh-install-check.sh",
-    "build:capabilities": "node scripts/build-capabilities.mjs",
-    "build:skills": "node scripts/build-skills.mjs",
-    "prepublish-check": "node scripts/prepublish-check.mjs",
-    "prepublishOnly": "npm run clean && npm run build && npm test && node scripts/prepublish-check.mjs"
-  },
   "dependencies": {
     "@modelcontextprotocol/server": "^2.2.0",
-    "node-autotask": "0.16.0",
+    "node-autotask": "0.17.0",
     "zod": "^4.6.7"
   },
   "devDependencies": {
@@ -66,5 +50,20 @@
     "typescript": "^6.0.3",
     "typescript-eslint": "^8.71.2",
     "vitest": "^5.0.4"
+  },
+  "scripts": {
+    "build": "tsc",
+    "start": "node dist/main.js",
+    "dev": "tsx src/main.ts",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "lint": "eslint src test",
+    "lint:fix": "eslint src test --fix",
+    "clean": "rimraf dist coverage",
+    "fresh-install-check": "bash scripts/fresh-install-check.sh",
+    "build:capabilities": "node scripts/build-capabilities.mjs",
+    "build:skills": "node scripts/build-skills.mjs",
+    "prepublish-check": "node scripts/prepublish-check.mjs"
   }
-}
+}

package/server.json

@@ -1,6 +1,6 @@
 {
   "name": "iit-mcp-autotask",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "MCP server for the Autotask (Datto) PSA API, powered by the node-autotask SDK",
   "mcpProtocolBaseline": "2026-07-28",
   "legacyProtocolFallback": "2025-11-25",
@@ -63,7 +63,7 @@
   "capabilitiesManifest": "capabilities.json",
   "sdk": {
     "package": "node-autotask",
-    "versionRange": "0.16.0"
+    "versionRange": "0.17.0"
   },
   "vendorExtensions": false,
   "credentialModelNote": "per-request; server-held under stdio or, on HTTP, only behind AUTOTASK_HTTP_AUTH=tokens; operator plans and the ledger are keyed by principal and tenant id, never by credential, and an apply uses the credential on the apply request"