mindgraph-mcp 0.11.0 → 0.13.0

package/dist/cli.js

@@ -1483,6 +1483,11 @@ async function getGeneratedTools(client2) {
     const byName = /* @__PURE__ */ new Map();
     const tools = [];
     for (const d of resp.tools ?? []) {
+      if (byName.has(d.name)) {
+        throw new DuplicateGeneratedToolError(
+          `duplicate generated ontology tool name: ${d.name}`
+        );
+      }
       byName.set(d.name, d);
       tools.push({
         name: d.name,
@@ -1492,22 +1497,26 @@ async function getGeneratedTools(client2) {
     }
     cache = { tools, byName, fetchedAt: Date.now() };
     return { tools, byName };
-  } catch {
+  } catch (error) {
+    if (error instanceof DuplicateGeneratedToolError) throw error;
     cache = { tools: [], byName: /* @__PURE__ */ new Map(), fetchedAt: Date.now() };
     return { tools: cache.tools, byName: cache.byName };
   }
 }
 async function handleGeneratedTool(client2, desc, args) {
   try {
+    const ontologyClient = client2;
     switch (desc.maps_to) {
       case "search": {
         const query = args.query;
         if (!query) return err2(`query is required for ${desc.name}`);
         const limit = typeof args.limit === "number" ? args.limit : void 0;
+        const filters = Array.isArray(args.filters) ? args.filters : void 0;
         return ok2(
-          await client2.searchDomainObjects(query, {
+          await ontologyClient.searchDomainObjects(query, {
             schema_id: desc.schema_id,
             object_types: [desc.object_type],
+            filters,
             limit
           })
         );
@@ -1515,13 +1524,57 @@ async function handleGeneratedTool(client2, desc, args) {
       case "object": {
         const uid = args.uid;
         if (!uid) return err2(`uid is required for ${desc.name}`);
-        return ok2(await client2.getDomainObject(uid));
+        return ok2(await ontologyClient.getDomainObject(uid, {
+          schema_id: desc.schema_id,
+          object_type: desc.object_type
+        }));
       }
       case "object_context": {
         const uid = args.uid;
         if (!uid) return err2(`uid is required for ${desc.name}`);
         const depth = typeof args.depth === "number" ? args.depth : void 0;
-        return ok2(await client2.getDomainObjectContext(uid, depth));
+        return ok2(await ontologyClient.getDomainObjectContext(uid, depth, {
+          schema_id: desc.schema_id,
+          object_type: desc.object_type
+        }));
+      }
+      case "related": {
+        const uid = args.uid;
+        if (!uid) return err2(`uid is required for ${desc.name}`);
+        if (!desc.relation || !desc.entry_role || !desc.far_type) {
+          return err2(`invalid related descriptor: ${desc.name}`);
+        }
+        if (!ontologyClient.queryRelatedDomainObjects) {
+          return err2(
+            "related ontology tools require a graph-aware version of the mindgraph SDK"
+          );
+        }
+        return ok2(await ontologyClient.queryRelatedDomainObjects({
+          schema_id: desc.schema_id,
+          entry_type: desc.object_type,
+          uid,
+          relation: desc.relation,
+          entry_role: desc.entry_role,
+          far_type: desc.far_type,
+          where: Array.isArray(args.where) ? args.where : void 0,
+          include_provenance: args.include_provenance === true,
+          limit: typeof args.limit === "number" ? args.limit : void 0,
+          offset: typeof args.offset === "number" ? args.offset : void 0
+        }));
+      }
+      case "structured_query": {
+        const select = args.select;
+        if (!select) return err2(`select is required for ${desc.name}`);
+        if (!ontologyClient.queryDomainStructured) {
+          return err2(
+            "structured ontology tools require a graph-aware version of the mindgraph SDK"
+          );
+        }
+        return ok2(await ontologyClient.queryDomainStructured({
+          ...args,
+          schema_id: desc.schema_id,
+          select
+        }));
       }
       default:
         return err2(`unknown generated tool mapping: ${desc.maps_to}`);
@@ -1530,7 +1583,7 @@ async function handleGeneratedTool(client2, desc, args) {
     return err2(e instanceof Error ? e.message : String(e));
   }
 }
-var ok2, err2, CACHE_TTL_MS, cache;
+var ok2, err2, CACHE_TTL_MS, cache, DuplicateGeneratedToolError;
 var init_generated_tools = __esm({
   "src/generated-tools.ts"() {
     "use strict";
@@ -1543,6 +1596,101 @@ var init_generated_tools = __esm({
     });
     CACHE_TTL_MS = 5 * 60 * 1e3;
     cache = null;
+    DuplicateGeneratedToolError = class extends Error {
+    };
+  }
+});
+
+// src/governance.ts
+function headers(apiKey, orgId) {
+  const value = {
+    authorization: `Bearer ${apiKey}`,
+    "content-type": "application/json"
+  };
+  if (orgId) value["x-mindgraph-org"] = orgId;
+  return value;
+}
+function unsupportedResponse(status, body) {
+  if (status === 404 || status === 405) return true;
+  if (status !== 400) return false;
+  const lower = body.toLowerCase();
+  return lower.includes("unknown governance action") || lower.includes("unknown action") || lower.includes("invalid_governance_action");
+}
+async function checkMcpGovernance(toolName, args, config) {
+  if (config.disabled || capability === "unsupported") return { allowed: true };
+  const fetchImpl = config.fetchImpl ?? fetch;
+  let response;
+  let body;
+  try {
+    response = await fetchImpl(`${config.baseUrl.replace(/\/$/, "")}/agent/governance`, {
+      method: "POST",
+      headers: headers(config.apiKey, config.orgId),
+      body: JSON.stringify({
+        action: "check",
+        act: "tool_invoke",
+        agent_id: String(args.agent_id || config.agentId),
+        target: { tool_name: toolName },
+        context: { adapter: "mindgraph-mcp" },
+        tier: "checkpoint"
+      })
+    });
+    body = await response.text();
+  } catch (error) {
+    return {
+      allowed: false,
+      message: `MindGraph governance could not establish permission: ${error instanceof Error ? error.message : String(error)}`
+    };
+  }
+  if (!response.ok) {
+    if (capability === "unknown" && unsupportedResponse(response.status, body)) {
+      capability = "unsupported";
+      return { allowed: true };
+    }
+    return {
+      allowed: false,
+      message: `MindGraph governance check failed (${response.status})`
+    };
+  }
+  capability = "supported";
+  let decision;
+  try {
+    decision = JSON.parse(body);
+  } catch {
+    return { allowed: false, message: "MindGraph governance returned an invalid decision" };
+  }
+  const obligations = Array.isArray(decision.obligations) ? decision.obligations : [];
+  const unknownDuty = obligations.find((obligation) => {
+    if (!obligation || typeof obligation !== "object") return true;
+    const duty = obligation.duty;
+    return typeof duty !== "string" || !KNOWN_DUTIES.has(duty);
+  });
+  if (unknownDuty) {
+    return {
+      allowed: false,
+      decision: String(decision.decision || "conditional"),
+      message: "MindGraph governance returned an obligation this adapter cannot safely enforce"
+    };
+  }
+  const verdict = String(decision.decision || "deny");
+  if (verdict === "permit") return { allowed: true };
+  const fired = Array.isArray(decision.fired_policies) ? decision.fired_policies : [];
+  const first = fired[0];
+  const policy = first && typeof first.name === "string" ? first.name : void 0;
+  const approvalUid = typeof decision.approval_uid === "string" ? decision.approval_uid : void 0;
+  return {
+    allowed: false,
+    decision: verdict,
+    approval_uid: approvalUid,
+    policy,
+    message: verdict === "conditional" ? `Approval is required${policy ? ` by policy ${policy}` : ""}${approvalUid ? ` (approval ${approvalUid})` : ""}` : `Denied by MindGraph governance${policy ? ` policy ${policy}` : ""}`
+  };
+}
+var capability, KNOWN_DUTIES;
+var init_governance = __esm({
+  "src/governance.ts"() {
+    "use strict";
+    capability = "unknown";
+    KNOWN_DUTIES = /* @__PURE__ */ new Set(["log", "require_approval"]);
   }
 });
 
@@ -1565,6 +1713,7 @@ var init_src = __esm({
     import_mindgraph = require("mindgraph");
     init_tools();
     init_generated_tools();
+    init_governance();
     API_KEY = process.env.MINDGRAPH_API_KEY;
     BASE_URL = process.env.MINDGRAPH_BASE_URL || "https://api.mindgraph.cloud";
     AGENT_ID = process.env.MINDGRAPH_AGENT_ID || "mcp";
@@ -1578,7 +1727,11 @@ var init_src = __esm({
     client = new import_mindgraph.MindGraph({
       baseUrl: BASE_URL,
       apiKey: API_KEY,
-      orgId: ORG_ID
+      orgId: ORG_ID,
+      // Available in the companion mindgraph SDK from the D6 telemetry batch.
+      // Cast keeps this repository buildable during the cross-package release
+      // window where npm may still resolve the preceding SDK declaration file.
+      telemetrySurface: "mcp"
     });
     INSTRUCTIONS = `You have access to a persistent knowledge graph via MindGraph (7 tools).
 
@@ -1658,7 +1811,7 @@ Capture knowledge when the user shares something worth remembering:
     server = new import_server.Server(
       {
         name: "mindgraph",
-        version: "0.10.0"
+        version: "0.12.0"
       },
       {
         capabilities: {
@@ -1679,6 +1832,19 @@ Capture knowledge when the user shares something worth remembering:
       if (!toolArgs.agent_id) {
         toolArgs.agent_id = AGENT_ID;
       }
+      const governance = await checkMcpGovernance(name, toolArgs, {
+        baseUrl: BASE_URL,
+        apiKey: API_KEY,
+        orgId: ORG_ID,
+        agentId: AGENT_ID,
+        disabled: process.env.MINDGRAPH_GOVERNANCE === "off"
+      });
+      if (!governance.allowed) {
+        return {
+          content: [{ type: "text", text: JSON.stringify({ error: governance.message, ...governance }) }],
+          isError: true
+        };
+      }
       const generated = await getGeneratedTools(client);
       const desc = generated.byName.get(name);
       if (desc) {

package/dist/index.js

@@ -1452,6 +1452,8 @@ var err2 = (message) => ({
 });
 var CACHE_TTL_MS = 5 * 60 * 1e3;
 var cache = null;
+var DuplicateGeneratedToolError = class extends Error {
+};
 async function getGeneratedTools(client2) {
   if (cache && Date.now() - cache.fetchedAt < CACHE_TTL_MS) {
     return { tools: cache.tools, byName: cache.byName };
@@ -1466,6 +1468,11 @@ async function getGeneratedTools(client2) {
     const byName = /* @__PURE__ */ new Map();
     const tools = [];
     for (const d of resp.tools ?? []) {
+      if (byName.has(d.name)) {
+        throw new DuplicateGeneratedToolError(
+          `duplicate generated ontology tool name: ${d.name}`
+        );
+      }
       byName.set(d.name, d);
       tools.push({
         name: d.name,
@@ -1475,22 +1482,26 @@ async function getGeneratedTools(client2) {
     }
     cache = { tools, byName, fetchedAt: Date.now() };
     return { tools, byName };
-  } catch {
+  } catch (error) {
+    if (error instanceof DuplicateGeneratedToolError) throw error;
     cache = { tools: [], byName: /* @__PURE__ */ new Map(), fetchedAt: Date.now() };
     return { tools: cache.tools, byName: cache.byName };
   }
 }
 async function handleGeneratedTool(client2, desc, args) {
   try {
+    const ontologyClient = client2;
     switch (desc.maps_to) {
       case "search": {
         const query = args.query;
         if (!query) return err2(`query is required for ${desc.name}`);
         const limit = typeof args.limit === "number" ? args.limit : void 0;
+        const filters = Array.isArray(args.filters) ? args.filters : void 0;
         return ok2(
-          await client2.searchDomainObjects(query, {
+          await ontologyClient.searchDomainObjects(query, {
             schema_id: desc.schema_id,
             object_types: [desc.object_type],
+            filters,
             limit
           })
         );
@@ -1498,13 +1509,57 @@ async function handleGeneratedTool(client2, desc, args) {
       case "object": {
         const uid = args.uid;
         if (!uid) return err2(`uid is required for ${desc.name}`);
-        return ok2(await client2.getDomainObject(uid));
+        return ok2(await ontologyClient.getDomainObject(uid, {
+          schema_id: desc.schema_id,
+          object_type: desc.object_type
+        }));
       }
       case "object_context": {
         const uid = args.uid;
         if (!uid) return err2(`uid is required for ${desc.name}`);
         const depth = typeof args.depth === "number" ? args.depth : void 0;
-        return ok2(await client2.getDomainObjectContext(uid, depth));
+        return ok2(await ontologyClient.getDomainObjectContext(uid, depth, {
+          schema_id: desc.schema_id,
+          object_type: desc.object_type
+        }));
+      }
+      case "related": {
+        const uid = args.uid;
+        if (!uid) return err2(`uid is required for ${desc.name}`);
+        if (!desc.relation || !desc.entry_role || !desc.far_type) {
+          return err2(`invalid related descriptor: ${desc.name}`);
+        }
+        if (!ontologyClient.queryRelatedDomainObjects) {
+          return err2(
+            "related ontology tools require a graph-aware version of the mindgraph SDK"
+          );
+        }
+        return ok2(await ontologyClient.queryRelatedDomainObjects({
+          schema_id: desc.schema_id,
+          entry_type: desc.object_type,
+          uid,
+          relation: desc.relation,
+          entry_role: desc.entry_role,
+          far_type: desc.far_type,
+          where: Array.isArray(args.where) ? args.where : void 0,
+          include_provenance: args.include_provenance === true,
+          limit: typeof args.limit === "number" ? args.limit : void 0,
+          offset: typeof args.offset === "number" ? args.offset : void 0
+        }));
+      }
+      case "structured_query": {
+        const select = args.select;
+        if (!select) return err2(`select is required for ${desc.name}`);
+        if (!ontologyClient.queryDomainStructured) {
+          return err2(
+            "structured ontology tools require a graph-aware version of the mindgraph SDK"
+          );
+        }
+        return ok2(await ontologyClient.queryDomainStructured({
+          ...args,
+          schema_id: desc.schema_id,
+          select
+        }));
       }
       default:
         return err2(`unknown generated tool mapping: ${desc.maps_to}`);
@@ -1514,6 +1569,93 @@ async function handleGeneratedTool(client2, desc, args) {
   }
 }
 
+// src/governance.ts
+var capability = "unknown";
+var KNOWN_DUTIES = /* @__PURE__ */ new Set(["log", "require_approval"]);
+function headers(apiKey, orgId) {
+  const value = {
+    authorization: `Bearer ${apiKey}`,
+    "content-type": "application/json"
+  };
+  if (orgId) value["x-mindgraph-org"] = orgId;
+  return value;
+}
+function unsupportedResponse(status, body) {
+  if (status === 404 || status === 405) return true;
+  if (status !== 400) return false;
+  const lower = body.toLowerCase();
+  return lower.includes("unknown governance action") || lower.includes("unknown action") || lower.includes("invalid_governance_action");
+}
+async function checkMcpGovernance(toolName, args, config) {
+  if (config.disabled || capability === "unsupported") return { allowed: true };
+  const fetchImpl = config.fetchImpl ?? fetch;
+  let response;
+  let body;
+  try {
+    response = await fetchImpl(`${config.baseUrl.replace(/\/$/, "")}/agent/governance`, {
+      method: "POST",
+      headers: headers(config.apiKey, config.orgId),
+      body: JSON.stringify({
+        action: "check",
+        act: "tool_invoke",
+        agent_id: String(args.agent_id || config.agentId),
+        target: { tool_name: toolName },
+        context: { adapter: "mindgraph-mcp" },
+        tier: "checkpoint"
+      })
+    });
+    body = await response.text();
+  } catch (error) {
+    return {
+      allowed: false,
+      message: `MindGraph governance could not establish permission: ${error instanceof Error ? error.message : String(error)}`
+    };
+  }
+  if (!response.ok) {
+    if (capability === "unknown" && unsupportedResponse(response.status, body)) {
+      capability = "unsupported";
+      return { allowed: true };
+    }
+    return {
+      allowed: false,
+      message: `MindGraph governance check failed (${response.status})`
+    };
+  }
+  capability = "supported";
+  let decision;
+  try {
+    decision = JSON.parse(body);
+  } catch {
+    return { allowed: false, message: "MindGraph governance returned an invalid decision" };
+  }
+  const obligations = Array.isArray(decision.obligations) ? decision.obligations : [];
+  const unknownDuty = obligations.find((obligation) => {
+    if (!obligation || typeof obligation !== "object") return true;
+    const duty = obligation.duty;
+    return typeof duty !== "string" || !KNOWN_DUTIES.has(duty);
+  });
+  if (unknownDuty) {
+    return {
+      allowed: false,
+      decision: String(decision.decision || "conditional"),
+      message: "MindGraph governance returned an obligation this adapter cannot safely enforce"
+    };
+  }
+  const verdict = String(decision.decision || "deny");
+  if (verdict === "permit") return { allowed: true };
+  const fired = Array.isArray(decision.fired_policies) ? decision.fired_policies : [];
+  const first = fired[0];
+  const policy = first && typeof first.name === "string" ? first.name : void 0;
+  const approvalUid = typeof decision.approval_uid === "string" ? decision.approval_uid : void 0;
+  return {
+    allowed: false,
+    decision: verdict,
+    approval_uid: approvalUid,
+    policy,
+    message: verdict === "conditional" ? `Approval is required${policy ? ` by policy ${policy}` : ""}${approvalUid ? ` (approval ${approvalUid})` : ""}` : `Denied by MindGraph governance${policy ? ` policy ${policy}` : ""}`
+  };
+}
+
 // src/index.ts
 var API_KEY = process.env.MINDGRAPH_API_KEY;
 var BASE_URL = process.env.MINDGRAPH_BASE_URL || "https://api.mindgraph.cloud";
@@ -1528,7 +1670,11 @@ if (!API_KEY) {
 var client = new import_mindgraph.MindGraph({
   baseUrl: BASE_URL,
   apiKey: API_KEY,
-  orgId: ORG_ID
+  orgId: ORG_ID,
+  // Available in the companion mindgraph SDK from the D6 telemetry batch.
+  // Cast keeps this repository buildable during the cross-package release
+  // window where npm may still resolve the preceding SDK declaration file.
+  telemetrySurface: "mcp"
 });
 var INSTRUCTIONS = `You have access to a persistent knowledge graph via MindGraph (7 tools).
 
@@ -1608,7 +1754,7 @@ Capture knowledge when the user shares something worth remembering:
 var server = new import_server.Server(
   {
     name: "mindgraph",
-    version: "0.10.0"
+    version: "0.12.0"
   },
   {
     capabilities: {
@@ -1629,6 +1775,19 @@ server.setRequestHandler(import_types.CallToolRequestSchema, async (request) =>
   if (!toolArgs.agent_id) {
     toolArgs.agent_id = AGENT_ID;
   }
+  const governance = await checkMcpGovernance(name, toolArgs, {
+    baseUrl: BASE_URL,
+    apiKey: API_KEY,
+    orgId: ORG_ID,
+    agentId: AGENT_ID,
+    disabled: process.env.MINDGRAPH_GOVERNANCE === "off"
+  });
+  if (!governance.allowed) {
+    return {
+      content: [{ type: "text", text: JSON.stringify({ error: governance.message, ...governance }) }],
+      isError: true
+    };
+  }
   const generated = await getGeneratedTools(client);
   const desc = generated.byName.get(name);
   if (desc) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mindgraph-mcp",
-  "version": "0.11.0",
+  "version": "0.13.0",
   "description": "MCP server for MindGraph — connect Claude Desktop, Claude Code, and any MCP client to your knowledge graph",
   "repository": {
     "type": "git",
@@ -32,7 +32,7 @@
   "license": "MIT",
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.12.1",
-    "mindgraph": "^0.12.0"
+    "mindgraph": "^0.13.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",