iit-mcp-autotask 0.7.0 → 0.7.2

package/README.md

@@ -8,10 +8,10 @@ context into one call, a generic read layer for the long tail, one result envelo
 packaged playbooks, strong security boundaries, and predictable per-tenant in-process state (pooled
 client + SDK-owned TTL caches).
 
-> **Package status (2026-10-17):** the runtime dependency `node-autotask` is published to public npm
-> at `0.16.0`; the committed `pnpm-lock.yaml` pins that
+> **Package status (2026-10-19):** the runtime dependency `node-autotask` is published to public npm
+> at `0.18.0`; the committed `pnpm-lock.yaml` pins that
 > release with its integrity hash, so installs resolve deterministically. The dependency is always npm
-> (node-autotask pinned exactly at `0.16.0`) — never a `file:`, `git:`, `link:` or workspace reference
+> (node-autotask pinned exactly at `0.18.0`) — never a `file:`, `git:`, `link:` or workspace reference
 > to a local checkout.
 
 > **0.6.0 is a breaking release** (unreleased): tool names, result shapes and configuration all
@@ -42,9 +42,28 @@ its contract, `autotask_read` runs it.
   (`companies.unbilledWork`), contract profitability (`contracts.profitability`), aggregates
   (`operations.aggregate`) and SLA health (`tickets.slaHealthCheck`) run here; `autotask_guide`
   holds their recipes.
-- `autotask_guide` serves the packaged playbooks: `ticket-triage`, `company-360`,
-  `unbilled-work-review`, `contract-profitability`, `invoice-export`, and on the operator profile
-  `log-time-entry`.
+- `autotask_guide` serves the packaged playbooks — the server's skill layer (below).
+
+### `autotask_guide`: the packaged playbooks (the server's skill layer)
+
+Six outcome playbooks ship with the server — `skills/*.md`, part of the npm tarball — and are
+served by `autotask_guide` as **static text**: it never interpolates API data and never calls the
+vendor, so loading a playbook costs no wire and adds no injection surface.
+
+- No args: the index (one line per skill).
+- `{skill}`: one playbook in full (frontmatter included).
+- `{skill, section}`: one of its `## ` sections.
+
+Skills: `ticket-triage`, `company-360`, `unbilled-work-review`, `contract-profitability`,
+`invoice-export`, and on the operator profile `log-time-entry`.
+
+The playbooks are discoverable in both directions:
+
+- The guide is the only tool that carries `_meta: { "anthropic/alwaysLoad": true }`, so hosts
+  that defer tool loading still surface it — it is the entry point to the recipes.
+- Each skill's frontmatter `ops` list (`<tool>:<operation>` entries) feeds a reverse index:
+  `autotask_describe` for an operation answers with the `playbooks[]` that use it, so a model
+  that lands on an operation is pointed at the recipe.
 
 Composites bound **each part independently** (every part reads its own declared limit argument); a
 part miss never fails the call (typed `absent`); only a missing root record fails the composite.
@@ -636,7 +655,7 @@ independent review with its resolutions, [`docs/reviews/0.6.0.md`](docs/reviews/
 
 ## SDK dependency
 
-`iit-mcp-autotask` depends on **`node-autotask` from npm at exactly `0.16.0`** (an exact pin —
+`iit-mcp-autotask` depends on **`node-autotask` from npm at exactly `0.18.0`** (an exact pin —
 no range operator; subpaths `.` / `/capabilities` / `/operations` / `/resources` / `/types` /
 `/pool`) — the only **vendor** dependency; the other two runtime dependencies are
 `@modelcontextprotocol/server` (the MCP framework) and `zod` (schema validation). It never
@@ -646,7 +665,7 @@ user — the published tarball ships no lockfile) must resolve to the release th
 reviewed against, or the plan-hash boot check refuses to start.
 
 **Publishing `node-autotask` is the maintainer's action, done manually.** It is published on the
-public registry at `0.16.0` (published 2026-10-17); the
+public registry at `0.18.0` (published 2026-10-19); the
 exact pin and the committed `pnpm-lock.yaml` (with `pnpm-workspace.yaml`) pin the real published
 tarball with its integrity hash, so installs resolve to exactly that release — the lockfile
 freezes the pnpm/git/Docker paths, the pin freezes the npm/npx paths. The docs are written against this

package/dist/tools/catalog-data.d.ts

@@ -96,7 +96,7 @@ export declare function cacheOptionsForPreset(preset: 'on' | 'off', fieldCacheTt
  * fails the boot (or the CI test) instead of quietly shipping a tool surface that no longer
  * describes the SDK behind it.
  */
-export declare const BUILT_AGAINST_PLAN_HASH = "bd88648453f58ede018062ce66acefacb672fecaa450af89f421057809971e14";
+export declare const BUILT_AGAINST_PLAN_HASH = "5176d37fc9bae34139c151ae0ea8336dab63a30382f04acbcaed0e24cdd71d5f";
 /**
  * Fail fast when the installed SDK's plan has moved out from under this surface.
  * Called at boot (main.ts) and safe to call repeatedly (pure comparison).

package/dist/tools/catalog-data.js

@@ -159,7 +159,7 @@ export function cacheOptionsForPreset(preset, fieldCacheTtlMs) {
  * fails the boot (or the CI test) instead of quietly shipping a tool surface that no longer
  * describes the SDK behind it.
  */
-export const BUILT_AGAINST_PLAN_HASH = 'bd88648453f58ede018062ce66acefacb672fecaa450af89f421057809971e14';
+export const BUILT_AGAINST_PLAN_HASH = '5176d37fc9bae34139c151ae0ea8336dab63a30382f04acbcaed0e24cdd71d5f';
 /**
  * Fail fast when the installed SDK's plan has moved out from under this surface.
  * Called at boot (main.ts) and safe to call repeatedly (pure comparison).

package/dist/tools/server.d.ts

@@ -28,7 +28,7 @@ import { type TokenStore } from '../http-guard.js';
 import type { WriteRuntime } from '../write/runtime.js';
 /** The wire identity of this server (the initialize answer + the `/metadata` payload). */
 export declare const SERVER_NAME = "iit-mcp-autotask";
-export declare const SERVER_VERSION = "0.7.0";
+export declare const SERVER_VERSION = "0.7.2";
 export declare const SERVER_TITLE = "Autotask MCP Server";
 /**
  * The MCP protocol era this server advertises (the `/metadata` stamp, both levels).
@@ -60,7 +60,7 @@ export declare function serverInstructions(config: Pick<Config, 'AUTOTASK_PROFIL
 /** The full identity stamp (the `/metadata` build block — the era pair, FR-2). */
 export declare const SERVER_IDENTITY: {
     readonly name: "iit-mcp-autotask";
-    readonly version: "0.7.0";
+    readonly version: "0.7.2";
     readonly mcpProtocolBaseline: "2026-07-28";
     readonly legacyProtocolFallback: "2025-11-25";
 };

package/dist/tools/server.js

@@ -29,7 +29,7 @@ import { registerTools } from './register.js';
 import { configForToken } from '../http-guard.js';
 /** The wire identity of this server (the initialize answer + the `/metadata` payload). */
 export const SERVER_NAME = 'iit-mcp-autotask';
-export const SERVER_VERSION = '0.7.0';
+export const SERVER_VERSION = '0.7.2';
 export const SERVER_TITLE = 'Autotask MCP Server';
 /**
  * The MCP protocol era this server advertises (the `/metadata` stamp, both levels).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "iit-mcp-autotask",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "description": "MCP server for the Autotask (Datto) PSA domain, built on the node-autotask SDK",
   "license": "MIT",
   "author": "Max Soukhomlinov",
@@ -53,7 +53,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/server": "^2.2.0",
-    "node-autotask": "0.16.0",
+    "node-autotask": "0.18.0",
     "zod": "^4.6.7"
   },
   "devDependencies": {

package/server.json

@@ -1,6 +1,6 @@
 {
   "name": "iit-mcp-autotask",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "description": "MCP server for the Autotask (Datto) PSA API, powered by the node-autotask SDK",
   "mcpProtocolBaseline": "2026-07-28",
   "legacyProtocolFallback": "2025-11-25",
@@ -63,7 +63,7 @@
   "capabilitiesManifest": "capabilities.json",
   "sdk": {
     "package": "node-autotask",
-    "versionRange": "0.16.0"
+    "versionRange": "0.18.0"
   },
   "vendorExtensions": false,
   "credentialModelNote": "per-request; server-held under stdio or, on HTTP, only behind AUTOTASK_HTTP_AUTH=tokens; operator plans and the ledger are keyed by principal and tenant id, never by credential, and an apply uses the credential on the apply request"