powerautomate-mcp 0.7.4 → 0.7.6

package/README.md

@@ -20,13 +20,16 @@ An MCP (Model Context Protocol) server that connects Claude to Microsoft Power A
 - Microsoft 365 work account with Power Automate access
 - **Linux only**: libsecret for secure token storage
   ```bash
-  # Ubuntu/Debian
-  sudo apt-get install libsecret-1-dev gnome-keyring
+  # Ubuntu/Debian runtime
+  sudo apt-get install libsecret-1-0 gnome-keyring
 
-  # Fedora/RHEL
-  sudo dnf install libsecret-devel gnome-keyring
+  # Fedora/RHEL runtime
+  sudo dnf install libsecret gnome-keyring
   ```
 
+  If setup fails with `libsecret-1.so.0: cannot open shared object file`, the
+  runtime package above is missing.
+
 ### Installation
 
 ```bash
@@ -215,7 +218,7 @@ npm run build
 
 This server implements defense-in-depth security:
 
-- **Secure Token Storage**: DPAPI (Windows), Keychain (macOS), libsecret (Linux) — no plaintext fallback
+- **Secure Token Storage**: DPAPI (Windows), Keychain (macOS), libsecret on Linux when available, with a 0o600 file-cache fallback when it is not
 - **Input Validation**: GUID validation on all IDs, OData injection protection (ASCII-only), path traversal blocking (including URL-encoded), SharePoint hostname allowlist
 - **SSRF Prevention**: Domain allowlists on Dataverse URLs, resource links, and token resources
 - **Injection Prevention**: Power Automate expression injection blocking (`@{`/`}@`), OData filter sanitization, command injection prevention (`execFile` over `exec`)

package/dist/index.js

@@ -13,7 +13,6 @@ import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/
 import { ListToolsRequestSchema, CallToolRequestSchema, ListResourceTemplatesRequestSchema, ListResourcesRequestSchema, ReadResourceRequestSchema, ListPromptsRequestSchema, GetPromptRequestSchema } from '@modelcontextprotocol/sdk/types.js';
 import { PublicClientApplication, LogLevel } from '@azure/msal-node';
 import { execFile } from 'child_process';
-import { PersistenceCreator, DataProtectionScope, PersistenceCachePlugin } from '@azure/msal-node-extensions';
 import { request } from 'undici';
 import Database from 'better-sqlite3';
 import { fileURLToPath } from 'url';
@@ -25,7 +24,13 @@ var EnvironmentSchema = z.object({
   /** Azure region (e.g., "unitedstates", "europe") */
   region: z.string().min(1),
   /** Human-readable name */
-  displayName: z.string().optional()
+  displayName: z.string().optional(),
+  /**
+   * Optional override for the Dataverse hostname (e.g. "contoso.crm.dynamics.com").
+   * When omitted, the MCP resolves it at startup via the BAP admin API and falls
+   * back to a region-based guess if that call fails.
+   */
+  dataverseUrl: z.string().optional()
 });
 var AuthConfigSchema = z.object({
   /** Microsoft Entra application (client) ID */
@@ -423,7 +428,8 @@ function resolveEnvironment(config, envNameOrId) {
       name: envKey,
       id: envConfig.id,
       region: envConfig.region,
-      displayName: envConfig.displayName
+      displayName: envConfig.displayName,
+      dataverseUrl: envConfig.dataverseUrl
     };
   }
   {
@@ -610,6 +616,19 @@ function validateRowId(id) {
   }
   return id;
 }
+function validateFlowRunId(id) {
+  if (typeof id !== "string" || id.length < 10 || id.length > 128) {
+    throw new ConfigurationError(
+      `Invalid flow run ID format: expected alphanumeric identifier (10-128 chars)`
+    );
+  }
+  if (!/^[0-9A-Za-z]+$/.test(id)) {
+    throw new ConfigurationError(
+      `Invalid flow run ID format: expected alphanumeric identifier (10-128 chars)`
+    );
+  }
+  return id;
+}
 function validateSharePointHostname(hostname) {
   const validPattern = /^[a-z0-9-]+\.sharepoint\.(com|us|de|cn)$/i;
   if (!validPattern.test(hostname)) {
@@ -725,6 +744,23 @@ function validateEnvironmentId(envId) {
   }
   return envId;
 }
+var msalNodeExtensionsPromise = null;
+async function loadMsalNodeExtensions() {
+  if (!msalNodeExtensionsPromise) {
+    msalNodeExtensionsPromise = import('@azure/msal-node-extensions').then((mod) => {
+      const moduleWithOptionalDefault = mod;
+      const resolved = moduleWithOptionalDefault.default ?? moduleWithOptionalDefault;
+      if (!resolved || !("PersistenceCreator" in resolved)) {
+        throw new Error("msal-node-extensions did not expose the expected exports");
+      }
+      return resolved;
+    });
+  }
+  return msalNodeExtensionsPromise;
+}
+function formatError(error) {
+  return error instanceof Error ? error.message : String(error);
+}
 var NativeFileCachePlugin = class {
   cachePath;
   constructor(cachePath) {
@@ -765,6 +801,11 @@ async function createPersistentCachePlugin(cachePath) {
   logger.debug({ cacheLocation, platform: platform }, "Creating persistent token cache");
   if (platform === "win32" || platform === "darwin") {
     try {
+      const {
+        DataProtectionScope,
+        PersistenceCreator,
+        PersistenceCachePlugin
+      } = await loadMsalNodeExtensions();
       const persistence = await PersistenceCreator.createPersistence({
         cachePath: cacheLocation,
         dataProtectionScope: platform === "win32" ? DataProtectionScope.CurrentUser : void 0,
@@ -777,11 +818,15 @@ async function createPersistentCachePlugin(cachePath) {
     } catch (err) {
       logger.error({ err, cacheLocation }, "Failed to create persistent cache");
       throw new Error(
-        `Failed to initialize token cache at ${cacheLocation}: ${err instanceof Error ? err.message : String(err)}`
+        `Failed to initialize token cache at ${cacheLocation}: ${formatError(err)}`
       );
     }
   }
   try {
+    const {
+      PersistenceCreator,
+      PersistenceCachePlugin
+    } = await loadMsalNodeExtensions();
     const persistence = await PersistenceCreator.createPersistence({
       cachePath: cacheLocation,
       serviceName: "powerautomate-mcp",
@@ -793,7 +838,7 @@ async function createPersistentCachePlugin(cachePath) {
     return new PersistenceCachePlugin(persistence);
   } catch (libsecretError) {
     logger.warn(
-      { err: libsecretError instanceof Error ? libsecretError.message : String(libsecretError) },
+      { err: formatError(libsecretError) },
       "libsecret unavailable \u2014 using native file cache fallback (0o600 permissions)"
     );
     logger.info({ cacheLocation }, "Persistent token cache initialized (native file)");
@@ -1411,7 +1456,7 @@ var FlowManagementApi = class {
   async getFlowRunActions(flowId, runId, environmentId) {
     const envId = environmentId ?? this.defaultEnvironmentId;
     const safeFlowId = validateRowId(flowId);
-    const safeRunId = validateRowId(runId);
+    const safeRunId = validateFlowRunId(runId);
     apiLogger.debug({ flowId: safeFlowId, runId: safeRunId, envId }, "Getting flow run actions");
     const url = this.buildUrl(envId, `/flows/${safeFlowId}/runs/${safeRunId}/actions`);
     const headers = await this.getAuthHeaders();
@@ -1489,7 +1534,7 @@ var FlowManagementApi = class {
   async resubmitRun(flowId, runId, environmentId) {
     const envId = environmentId ?? this.defaultEnvironmentId;
     const safeFlowId = validateRowId(flowId);
-    const safeRunId = validateRowId(runId);
+    const safeRunId = validateFlowRunId(runId);
     apiLogger.info({ flowId: safeFlowId, runId: safeRunId, envId }, "Resubmitting flow run");
     const flow = await this.getFlow(safeFlowId, envId);
     const triggers = flow.properties.definition?.triggers ?? {};
@@ -1512,7 +1557,7 @@ var FlowManagementApi = class {
   async cancelRun(flowId, runId, environmentId) {
     const envId = environmentId ?? this.defaultEnvironmentId;
     const safeFlowId = validateRowId(flowId);
-    const safeRunId = validateRowId(runId);
+    const safeRunId = validateFlowRunId(runId);
     apiLogger.info({ flowId: safeFlowId, runId: safeRunId, envId }, "Cancelling flow run");
     const url = this.buildUrl(envId, `/flows/${safeFlowId}/runs/${safeRunId}/cancel`);
     const headers = await this.getAuthHeaders();
@@ -3582,15 +3627,18 @@ var DataverseApi = class {
     const select = "$select=LogicalName,DisplayName,EntitySetName,Description,IsCustomEntity,IsManaged,SchemaName,PrimaryIdAttribute,PrimaryNameAttribute";
     const parts = [select];
     if (options.filter) parts.push(`$filter=${validateODataFilter(options.filter)}`);
-    parts.push(`$top=${options.top ?? 100}`);
-    parts.push("$orderby=LogicalName asc");
     const url = this.buildUrl("EntityDefinitions", parts.join("&"));
     const headers = await this.getAuthHeaders();
+    const cap = options.top ?? 100;
     return wrapApiCall(async () => {
       const response = await request(url, { method: "GET", headers });
       const data = await this.handleResponse(response, "List tables");
-      logger2.info({ count: data.value.length }, "Listed Dataverse tables");
-      return data.value;
+      const sorted = [...data.value].sort(
+        (a, b) => a.LogicalName.localeCompare(b.LogicalName)
+      );
+      const limited = sorted.slice(0, cap);
+      logger2.info({ count: limited.length, total: data.value.length }, "Listed Dataverse tables");
+      return limited;
     }, "List tables");
   }
   /**
@@ -3722,8 +3770,12 @@ var DataverseApi = class {
   // Environment Discovery
   // ==========================================================================
   /**
-   * Discover Dataverse environment URL from Power Platform environment
-   * This is needed because Dataverse URL format differs from Flow API
+   * Construct a best-guess Dataverse hostname from an environment GUID + region.
+   *
+   * WARNING: this is a last-resort fallback. The real Dataverse hostname is the
+   * org's `domainName` (exposed as `linkedEnvironmentMetadata.instanceUrl` on the
+   * BAP admin API) which usually does NOT match the environment GUID. Prefer
+   * resolving instanceUrl from BAP, or set `dataverseUrl` in the env config.
    */
   static getDataverseUrl(environmentId, region = "crm") {
     const regionMap = {
@@ -14541,15 +14593,34 @@ async function createMcpServer(serverConfig) {
   });
   let dataverseApi = null;
   try {
-    const dataverseUrl = DataverseApi.getDataverseUrl(
-      defaultEnv.id,
-      defaultEnv.region
-    );
+    let dataverseUrl;
+    let source = "fallback";
+    if (defaultEnv.dataverseUrl) {
+      dataverseUrl = defaultEnv.dataverseUrl;
+      source = "config";
+    } else {
+      try {
+        const envDetail = await adminApi.getEnvironment(defaultEnv.id);
+        const instanceUrl = envDetail.properties?.linkedEnvironmentMetadata?.instanceUrl;
+        if (instanceUrl) {
+          dataverseUrl = instanceUrl;
+          source = "bap";
+        }
+      } catch (err) {
+        logger.warn(
+          { err: err instanceof Error ? err.message : String(err) },
+          "BAP admin API did not return a Dataverse instanceUrl \u2014 falling back to region guess (may fail DNS)"
+        );
+      }
+    }
+    if (!dataverseUrl) {
+      dataverseUrl = DataverseApi.getDataverseUrl(defaultEnv.id, defaultEnv.region);
+    }
     dataverseApi = new DataverseApi({
       authProvider,
       environmentUrl: dataverseUrl
     });
-    logger.info({ dataverseUrl }, "Dataverse API initialized");
+    logger.info({ dataverseUrl, source }, "Dataverse API initialized");
   } catch (error) {
     logger.warn({ error }, "Failed to initialize Dataverse API \u2014 Dataverse tools will return guidance");
   }
@@ -15134,6 +15205,7 @@ var c = {
 var icons = {
   check: `${c.green}\u2713${c.reset}`,
   cross: `${c.red}\u2717${c.reset}`,
+  info: `${c.blue}i${c.reset}`,
   arrow: `${c.cyan}\u2192${c.reset}`,
   bullet: `${c.dim}\u2022${c.reset}`,
   star: `${c.yellow}\u2605${c.reset}`