mcp-google-multi 6.0.0-alpha.69 → 6.0.0-alpha.70

package/dist/compose.d.ts

@@ -1,8 +1,15 @@
-import type { McpServer } from "@modelcontextprotocol/server";
+import { McpServer } from "@modelcontextprotocol/server";
 import type { ServerTarget } from './http-transport.js';
 import { ToolRegistry, type DiscoveryMode } from './registry.js';
 import { type IdentityContext } from './identity.js';
 import type { Metrics } from './usage-metrics.js';
+export interface McpServerOptions {
+    /** Sent in the initialize result; omitted entirely when absent or blank. */
+    instructions?: string;
+}
+/** The one place the MCP server is constructed, so an embedding host can pass
+ * per-session `instructions` without re-deriving the server identity. */
+export declare function createMcpServer(version: string, opts?: McpServerOptions): McpServer;
 export declare function buildRegistry(server: McpServer, ctx: IdentityContext, mode?: DiscoveryMode, metrics?: Metrics | null): ToolRegistry;
 /** The per-request hooks bound to one registry: argument shapes, unknown-
  * argument screening and the account a validation envelope names. Both

package/dist/compose.js

@@ -3,6 +3,7 @@
 // module must stay free of import-time side effects of its own: no argv
 // parsing, no process.exit, no prints (accounts.js module-load resolution is
 // the one inherited, pre-existing exception on the import chain).
+import { McpServer } from "@modelcontextprotocol/server";
 import { GENERATED_SERVICES } from './tools/generated/index.js';
 import { GENERATED_GATES, SERVICES, servicesAwaitingRestart, unknownToolMessage } from './services.js';
 import { argNormalizationEnabled } from './arg-normalize.js';
@@ -16,6 +17,12 @@ import { registerAccountWizardTools } from './tools/account-wizard.js';
 import { getToolsets, toolsetEnabled } from './toolsets.js';
 import { isOwnerContext } from './identity.js';
 import { resolveScopesForAccount } from './auth.js';
+/** The one place the MCP server is constructed, so an embedding host can pass
+ * per-session `instructions` without re-deriving the server identity. */
+export function createMcpServer(version, opts = {}) {
+    const instructions = opts.instructions?.trim() ? opts.instructions : undefined;
+    return new McpServer({ name: 'mcp-google-multi', version }, instructions ? { instructions } : undefined);
+}
 export function buildRegistry(server, ctx, mode, metrics = null) {
     const policy = ctx.policy;
     // The registry's account view IS the context's: fan-out expansion,

package/dist/index.js

@@ -7,11 +7,10 @@ import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import path from 'node:path';
 import { StdioServerTransport } from "@modelcontextprotocol/server/stdio";
-import { McpServer } from "@modelcontextprotocol/server";
 import { resolveDiscoveryMode } from './registry.js';
 import { isAllowed, describePolicy } from './write-control.js';
 import { buildIdentityContext } from './identity.js';
-import { buildRegistry, requestHooksFor } from './compose.js';
+import { buildRegistry, createMcpServer, requestHooksFor } from './compose.js';
 import { registerSetupPrompt } from './setup-prompt.js';
 import { applyNetTuning } from './net-tuning.js';
 import { withArgNormalization, withValidationEnvelope } from './arg-normalize.js';
@@ -81,7 +80,7 @@ async function main() {
     if (process.argv.includes('config') && process.argv.includes('check')) {
         const ctx = buildIdentityContext();
         const policy = ctx.policy;
-        const registry = buildRegistry(new McpServer({ name: 'mcp-google-multi', version: pkg.version }), ctx);
+        const registry = buildRegistry(createMcpServer(pkg.version), ctx);
         const cud = registry.tools.filter((t) => t.cud !== 'read');
         const disabled = cud.filter((t) => !isAllowed(t, policy));
         const counts = registry.visibleCount();
@@ -190,7 +189,7 @@ async function main() {
     // Build one McpServer + registry per transport at boot (P1 / BV gap #4:
     // never rebuilt per request); `both` runs the two concurrently.
     if (wantStdio) {
-        const server = new McpServer({ name: 'mcp-google-multi', version: pkg.version });
+        const server = createMcpServer(pkg.version);
         const stdioMetrics = initMetricsFor('stdio', resolveDiscoveryMode());
         const stdioCtx = buildIdentityContext(process.env, { transport: 'stdio' });
         const registry = buildRegistry(server, stdioCtx, undefined, stdioMetrics);
@@ -239,7 +238,7 @@ async function main() {
         if (configuredMode && configuredMode !== 'curated') {
             process.stderr.write(`GOOGLE_DISCOVERY="${configuredMode}" is ignored over HTTP; the stateless transport forces "curated".\n`);
         }
-        const httpServer = new McpServer({ name: 'mcp-google-multi', version: pkg.version });
+        const httpServer = createMcpServer(pkg.version);
         const httpMetrics = initMetricsFor('http', 'curated');
         const httpCtx = buildIdentityContext(process.env, { transport: 'http' });
         const registry = buildRegistry(httpServer, httpCtx, 'curated', httpMetrics);

package/dist/registry.js

@@ -47,6 +47,10 @@ export function serviceOf(name) {
 }
 // read tools that write local files — same savePath fanned across accounts would clobber
 const FANOUT_EXCLUDE = new Set(['gmail_download_attachment', 'drive_download', 'drive_export']);
+/** cud=read for gating/fan-out, yet they write (local files, the account
+ * registry, an MCP-client config): advertised as writes so annotation-keyed
+ * clients prompt instead of auto-running them. */
+const WRITES_DESPITE_READ = new Set([...FANOUT_EXCLUDE, 'account_add', 'account_reauth', 'account_write_config']);
 /** Account-management tools: the `account` they take is the SUBJECT of the
  * operation, not the identity it runs as, so injecting the configured default
  * would silently retarget them. `account_add` would adopt the default as the
@@ -130,12 +134,14 @@ export class ToolRegistry {
         this.registerTool = ((name, config, handler) => {
             const service = serviceOf(name);
             const cud = config.cud ?? inferCud(name);
-            // destructiveHint=false claims "additive only" (MCP spec) — updates overwrite, so they stay true.
+            // Every write is destructive: clients key per-call approval on it, and a
+            // create (send, share, upload) is no less consequential than an update.
             // idempotent: reads trivially, deletes (already-gone = same), updates
             // (overwrite converges); creates are not (send twice = two emails).
+            const writes = cud !== 'read' || WRITES_DESPITE_READ.has(name);
             const annotations = {
-                readOnlyHint: cud === 'read',
-                destructiveHint: cud === 'delete' || cud === 'update',
+                readOnlyHint: !writes,
+                destructiveHint: writes,
                 idempotentHint: cud !== 'create',
                 ...config.annotations,
             };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-google-multi",
-  "version": "6.0.0-alpha.69",
+  "version": "6.0.0-alpha.70",
   "mcpName": "io.github.bakissation/mcp-google-multi",
   "description": "Local MCP server for Google Workspace (Gmail, Drive, Calendar, Sheets, Docs, Contacts, Tasks, Meet, Search Console, +Forms/Chat/Admin) across multiple accounts — OAuth-only, encrypted token storage, deny-by-default writes.",
   "type": "module",