pulsemcp-cms-admin-mcp-server 0.4.3 → 0.5.0

package/README.md

@@ -32,7 +32,7 @@ This is an MCP ([Model Context Protocol](https://modelcontextprotocol.io/)) Serv
 
 **MCP Implementation Search**: Search for MCP servers and clients in the PulseMCP registry.
 
-**Toolgroups**: Enable/disable tool groups (newsletter, server_queue_readonly, server_queue_all, official_queue_readonly, official_queue_all) via environment variable.
+**Tool Groups**: Enable/disable tool groups via `TOOL_GROUPS` environment variable. Each group has a base variant (full access) and a `_readonly` variant (read-only access).
 
 **Draft Control**: Manage draft posts before publishing to the newsletter.
 
@@ -40,38 +40,95 @@ This is an MCP ([Model Context Protocol](https://modelcontextprotocol.io/)) Serv
 
 This server is built and tested on macOS with Claude Desktop. It should work with other MCP clients as well.
 
-| Tool Name                              | Tool Group              | Description                                                                  |
-| -------------------------------------- | ----------------------- | ---------------------------------------------------------------------------- |
-| `get_newsletter_posts`                 | newsletter              | List newsletter posts with search, sorting, and pagination options.          |
-| `get_newsletter_post`                  | newsletter              | Retrieve a specific newsletter post by its unique slug.                      |
-| `draft_newsletter_post`                | newsletter              | Create a new draft newsletter post with title, body, and metadata.           |
-| `update_newsletter_post`               | newsletter              | Update an existing newsletter post's content and metadata (except status).   |
-| `upload_image`                         | newsletter              | Upload an image and attach it to a specific newsletter post.                 |
-| `get_authors`                          | newsletter              | Get a list of authors with optional search and pagination.                   |
-| `search_mcp_implementations`           | server_queue_readonly   | Search for MCP servers and clients in the PulseMCP registry.                 |
-| `get_draft_mcp_implementations`        | server_queue_readonly   | Retrieve paginated list of draft MCP implementations needing review.         |
-| `find_providers`                       | server_queue_readonly   | Search for providers by ID, name, URL, or slug.                              |
-| `save_mcp_implementation`              | server_queue_all        | Update an MCP implementation (replicates Admin panel "Save Changes" button). |
-| `send_impl_posted_notif`               | server_queue_all        | Send email notification when MCP implementation goes live.                   |
-| `get_official_mirror_queue_items`      | official_queue_readonly | List and filter official mirror queue entries with pagination and search.    |
-| `get_official_mirror_queue_item`       | official_queue_readonly | Get detailed information about a single official mirror queue entry.         |
-| `approve_official_mirror_queue_item`   | official_queue_all      | Approve a queue entry and link it to an existing MCP server (async).         |
-| `approve_mirror_no_modify`             | official_queue_all      | Approve without updating the linked server.                                  |
-| `reject_official_mirror_queue_item`    | official_queue_all      | Reject a queue entry (async operation).                                      |
-| `add_official_mirror_to_regular_queue` | official_queue_all      | Convert a queue entry to a draft MCP implementation (async).                 |
-| `unlink_official_mirror_queue_item`    | official_queue_all      | Unlink a queue entry from its linked MCP server.                             |
+| Tool Name                              | Tool Group     | Read/Write | Description                                                                  |
+| -------------------------------------- | -------------- | ---------- | ---------------------------------------------------------------------------- |
+| `get_newsletter_posts`                 | newsletter     | read       | List newsletter posts with search, sorting, and pagination options.          |
+| `get_newsletter_post`                  | newsletter     | read       | Retrieve a specific newsletter post by its unique slug.                      |
+| `draft_newsletter_post`                | newsletter     | write      | Create a new draft newsletter post with title, body, and metadata.           |
+| `update_newsletter_post`               | newsletter     | write      | Update an existing newsletter post's content and metadata (except status).   |
+| `upload_image`                         | newsletter     | write      | Upload an image and attach it to a specific newsletter post.                 |
+| `get_authors`                          | newsletter     | read       | Get a list of authors with optional search and pagination.                   |
+| `search_mcp_implementations`           | server_queue   | read       | Search for MCP servers and clients in the PulseMCP registry.                 |
+| `get_draft_mcp_implementations`        | server_queue   | read       | Retrieve paginated list of draft MCP implementations needing review.         |
+| `find_providers`                       | server_queue   | read       | Search for providers by ID, name, URL, or slug.                              |
+| `save_mcp_implementation`              | server_queue   | write      | Update an MCP implementation (replicates Admin panel "Save Changes" button). |
+| `send_impl_posted_notif`               | server_queue   | write      | Send email notification when MCP implementation goes live.                   |
+| `get_official_mirror_queue_items`      | official_queue | read       | List and filter official mirror queue entries with pagination and search.    |
+| `get_official_mirror_queue_item`       | official_queue | read       | Get detailed information about a single official mirror queue entry.         |
+| `approve_official_mirror_queue_item`   | official_queue | write      | Approve a queue entry and link it to an existing MCP server (async).         |
+| `approve_mirror_no_modify`             | official_queue | write      | Approve without updating the linked server.                                  |
+| `reject_official_mirror_queue_item`    | official_queue | write      | Reject a queue entry (async operation).                                      |
+| `add_official_mirror_to_regular_queue` | official_queue | write      | Convert a queue entry to a draft MCP implementation (async).                 |
+| `unlink_official_mirror_queue_item`    | official_queue | write      | Unlink a queue entry from its linked MCP server.                             |
 
 # Tool Groups
 
-This server organizes tools into groups that can be selectively enabled or disabled:
+This server organizes tools into groups that can be selectively enabled or disabled. Each group has two variants:
 
-- **newsletter** (6 tools): Newsletter management, image uploads, and author retrieval
-- **server_queue_readonly** (3 tools): Read-only MCP implementation tools (search, draft retrieval, provider lookup)
-- **server_queue_all** (5 tools): All MCP implementation tools including write operations (search, draft retrieval, provider lookup, update, and email notification)
-- **official_queue_readonly** (2 tools): Read-only official mirror queue tools (list, get details)
-- **official_queue_all** (7 tools): All official mirror queue tools including approve, reject, unlink, and add to regular queue
+- **Base group** (e.g., `newsletter`): Full read + write access
+- **Readonly group** (e.g., `newsletter_readonly`): Read-only access
 
-You can control which tool groups are available by setting the `PULSEMCP_ADMIN_ENABLED_TOOLGROUPS` environment variable as a comma-separated list (e.g., `newsletter,server_queue_readonly`). If not set, all tool groups are enabled by default.
+## Available Groups
+
+| Group                     | Tools | Description                                  |
+| ------------------------- | ----- | -------------------------------------------- |
+| `newsletter`              | 6     | Full newsletter management (read + write)    |
+| `newsletter_readonly`     | 3     | Newsletter read-only (get posts, authors)    |
+| `server_queue`            | 5     | Full MCP implementation queue (read + write) |
+| `server_queue_readonly`   | 3     | MCP implementation queue read-only           |
+| `official_queue`          | 7     | Full official mirror queue (read + write)    |
+| `official_queue_readonly` | 2     | Official mirror queue read-only              |
+
+### Tools by Group
+
+- **newsletter** / **newsletter_readonly**:
+  - Read-only: `get_newsletter_posts`, `get_newsletter_post`, `get_authors`
+  - Write: `draft_newsletter_post`, `update_newsletter_post`, `upload_image`
+- **server_queue** / **server_queue_readonly**:
+  - Read-only: `search_mcp_implementations`, `get_draft_mcp_implementations`, `find_providers`
+  - Write: `save_mcp_implementation`, `send_impl_posted_notif`
+- **official_queue** / **official_queue_readonly**:
+  - Read-only: `get_official_mirror_queue_items`, `get_official_mirror_queue_item`
+  - Write: `approve_official_mirror_queue_item`, `approve_mirror_no_modify`, `reject_official_mirror_queue_item`, `add_official_mirror_to_regular_queue`, `unlink_official_mirror_queue_item`
+
+## Environment Variables
+
+| Variable      | Description                                 | Default                                                    |
+| ------------- | ------------------------------------------- | ---------------------------------------------------------- |
+| `TOOL_GROUPS` | Comma-separated list of enabled tool groups | `newsletter,server_queue,official_queue` (all base groups) |
+
+## Examples
+
+Enable all tools with full access (default):
+
+```bash
+# No environment variables needed - all base groups enabled
+```
+
+Enable only newsletter tools:
+
+```bash
+TOOL_GROUPS=newsletter
+```
+
+Enable server_queue with read-only access:
+
+```bash
+TOOL_GROUPS=server_queue_readonly
+```
+
+Enable all groups with read-only access:
+
+```bash
+TOOL_GROUPS=newsletter_readonly,server_queue_readonly,official_queue_readonly
+```
+
+Mix full and read-only access per group:
+
+```bash
+# Full newsletter access, read-only server_queue, no official_queue
+TOOL_GROUPS=newsletter,server_queue_readonly
+```
 
 # Usage Tips
 
@@ -83,7 +140,8 @@ You can control which tool groups are available by setting the `PULSEMCP_ADMIN_E
 - Use author slugs when creating posts (e.g., "sarah-chen", "john-doe")
 - Use MCP server/client slugs for featured content (e.g., "github-mcp", "claude-desktop")
 - Use `search_mcp_implementations` to discover MCP servers and clients in the PulseMCP registry
-- Enable or disable specific toolgroups by setting `PULSEMCP_ADMIN_ENABLED_TOOLGROUPS` environment variable
+- Enable or disable specific tool groups by setting `TOOL_GROUPS` environment variable
+- Use `_readonly` suffixes to restrict groups to read-only operations (e.g., `server_queue_readonly`)
 - Use the `remote` array parameter in `save_mcp_implementation` to configure remote endpoints for MCP servers (transport, host_platform, authentication_method, etc.)
 - Use the `canonical` array parameter in `save_mcp_implementation` to set canonical URLs with scope (domain, subdomain, subfolder, or url)
 - Remote endpoints allow specifying how MCP servers can be accessed (direct URL, setup URL, authentication method, cost, etc.)
@@ -194,7 +252,24 @@ Add to your Claude Desktop configuration:
       "args": ["/path/to/pulsemcp-cms-admin/local/build/index.js"],
       "env": {
         "PULSEMCP_ADMIN_API_KEY": "your-api-key-here",
-        "PULSEMCP_ADMIN_ENABLED_TOOLGROUPS": "newsletter,server_queue_readonly,server_queue_all,official_queue_readonly,official_queue_all"
+        "TOOL_GROUPS": "newsletter,server_queue,official_queue"
+      }
+    }
+  }
+}
+```
+
+For read-only access:
+
+```json
+{
+  "mcpServers": {
+    "pulsemcp-cms-admin-readonly": {
+      "command": "node",
+      "args": ["/path/to/pulsemcp-cms-admin/local/build/index.js"],
+      "env": {
+        "PULSEMCP_ADMIN_API_KEY": "your-api-key-here",
+        "TOOL_GROUPS": "newsletter_readonly,server_queue_readonly,official_queue_readonly"
       }
     }
   }

package/build/shared/src/pulsemcp-admin-client/lib/create-post.js

@@ -65,7 +65,13 @@ export async function createPost(apiKey, baseUrl, params) {
         }
         if (response.status === 422) {
             const errorData = (await response.json());
-            const errors = errorData.errors || ['Validation failed'];
+            // Handle both array format and single error string format from Rails
+            // Also handle empty arrays - an empty array should fall back to the default message
+            const errors = errorData.errors && errorData.errors.length > 0
+                ? errorData.errors
+                : errorData.error
+                    ? [errorData.error]
+                    : ['Unknown validation error'];
             throw new Error(`Validation failed: ${errors.join(', ')}`);
         }
         throw new Error(`Failed to create post: ${response.status} ${response.statusText}`);

package/build/shared/src/pulsemcp-admin-client/lib/save-mcp-implementation.js

@@ -154,7 +154,13 @@ export async function saveMCPImplementation(apiKey, baseUrl, id, params) {
         }
         if (response.status === 422) {
             const errorData = (await response.json());
-            const errors = errorData.errors || ['Validation failed'];
+            // Handle both array format and single error string format from Rails
+            // Also handle empty arrays - an empty array should fall back to the default message
+            const errors = errorData.errors && errorData.errors.length > 0
+                ? errorData.errors
+                : errorData.error
+                    ? [errorData.error]
+                    : ['Unknown validation error'];
             throw new Error(`Validation failed: ${errors.join(', ')}`);
         }
         throw new Error(`Failed to save MCP implementation: ${response.status} ${response.statusText}`);

package/build/shared/src/pulsemcp-admin-client/lib/send-email.js

@@ -25,16 +25,19 @@ export async function sendEmail(apiKey, baseUrl, params) {
         let errorMessage;
         try {
             const errorData = JSON.parse(errorBody);
-            if (errorData.errors) {
-                errorMessage = Array.isArray(errorData.errors)
-                    ? errorData.errors.join(', ')
-                    : JSON.stringify(errorData.errors);
+            // Handle both array format and single error string format from Rails
+            // Also handle empty arrays - an empty array should fall back to checking other fields
+            if (Array.isArray(errorData.errors) && errorData.errors.length > 0) {
+                errorMessage = errorData.errors.join(', ');
+            }
+            else if (errorData.errors && typeof errorData.errors === 'object') {
+                errorMessage = JSON.stringify(errorData.errors);
             }
             else if (errorData.error) {
                 errorMessage = errorData.error;
             }
             else {
-                errorMessage = errorBody;
+                errorMessage = errorBody || 'Unknown validation error';
             }
         }
         catch {

package/build/shared/src/pulsemcp-admin-client/lib/update-post.js

@@ -71,7 +71,13 @@ export async function updatePost(apiKey, baseUrl, slug, params) {
         }
         if (response.status === 422) {
             const errorData = (await response.json());
-            const errors = errorData.errors || ['Validation failed'];
+            // Handle both array format and single error string format from Rails
+            // Also handle empty arrays - an empty array should fall back to the default message
+            const errors = errorData.errors && errorData.errors.length > 0
+                ? errorData.errors
+                : errorData.error
+                    ? [errorData.error]
+                    : ['Unknown validation error'];
             throw new Error(`Validation failed: ${errors.join(', ')}`);
         }
         throw new Error(`Failed to update post: ${response.status} ${response.statusText}`);

package/build/shared/src/tools.js

@@ -18,65 +18,94 @@ import { rejectOfficialMirrorQueueItem } from './tools/reject-official-mirror-qu
 import { addOfficialMirrorToRegularQueue } from './tools/add-official-mirror-to-regular-queue.js';
 import { unlinkOfficialMirrorQueueItem } from './tools/unlink-official-mirror-queue-item.js';
 const ALL_TOOLS = [
-    { factory: getNewsletterPosts, groups: ['newsletter'] },
-    { factory: getNewsletterPost, groups: ['newsletter'] },
-    { factory: draftNewsletterPost, groups: ['newsletter'] },
-    { factory: updateNewsletterPost, groups: ['newsletter'] },
-    { factory: uploadImage, groups: ['newsletter'] },
-    { factory: getAuthors, groups: ['newsletter'] },
-    { factory: searchMCPImplementations, groups: ['server_queue_readonly', 'server_queue_all'] },
-    { factory: getDraftMCPImplementations, groups: ['server_queue_readonly', 'server_queue_all'] },
-    { factory: saveMCPImplementation, groups: ['server_queue_all'] },
-    { factory: sendMCPImplementationPostingNotification, groups: ['server_queue_all'] },
-    { factory: findProviders, groups: ['server_queue_readonly', 'server_queue_all'] },
-    // Official mirror queue tools
+    // Newsletter tools (all are write operations except get_newsletter_posts/post and get_authors)
+    { factory: getNewsletterPosts, group: 'newsletter', isWriteOperation: false },
+    { factory: getNewsletterPost, group: 'newsletter', isWriteOperation: false },
+    { factory: draftNewsletterPost, group: 'newsletter', isWriteOperation: true },
+    { factory: updateNewsletterPost, group: 'newsletter', isWriteOperation: true },
+    { factory: uploadImage, group: 'newsletter', isWriteOperation: true },
+    { factory: getAuthors, group: 'newsletter', isWriteOperation: false },
+    // Server queue tools
+    { factory: searchMCPImplementations, group: 'server_queue', isWriteOperation: false },
+    { factory: getDraftMCPImplementations, group: 'server_queue', isWriteOperation: false },
+    { factory: saveMCPImplementation, group: 'server_queue', isWriteOperation: true },
     {
-        factory: getOfficialMirrorQueueItems,
-        groups: ['official_queue_readonly', 'official_queue_all'],
+        factory: sendMCPImplementationPostingNotification,
+        group: 'server_queue',
+        isWriteOperation: true,
     },
+    { factory: findProviders, group: 'server_queue', isWriteOperation: false },
+    // Official mirror queue tools
+    { factory: getOfficialMirrorQueueItems, group: 'official_queue', isWriteOperation: false },
+    { factory: getOfficialMirrorQueueItem, group: 'official_queue', isWriteOperation: false },
+    { factory: approveOfficialMirrorQueueItem, group: 'official_queue', isWriteOperation: true },
     {
-        factory: getOfficialMirrorQueueItem,
-        groups: ['official_queue_readonly', 'official_queue_all'],
+        factory: approveOfficialMirrorQueueItemWithoutModifying,
+        group: 'official_queue',
+        isWriteOperation: true,
     },
-    { factory: approveOfficialMirrorQueueItem, groups: ['official_queue_all'] },
-    { factory: approveOfficialMirrorQueueItemWithoutModifying, groups: ['official_queue_all'] },
-    { factory: rejectOfficialMirrorQueueItem, groups: ['official_queue_all'] },
-    { factory: addOfficialMirrorToRegularQueue, groups: ['official_queue_all'] },
-    { factory: unlinkOfficialMirrorQueueItem, groups: ['official_queue_all'] },
+    { factory: rejectOfficialMirrorQueueItem, group: 'official_queue', isWriteOperation: true },
+    { factory: addOfficialMirrorToRegularQueue, group: 'official_queue', isWriteOperation: true },
+    { factory: unlinkOfficialMirrorQueueItem, group: 'official_queue', isWriteOperation: true },
+];
+/**
+ * All valid tool groups (base groups and their _readonly variants)
+ */
+const VALID_TOOL_GROUPS = [
+    'newsletter',
+    'newsletter_readonly',
+    'server_queue',
+    'server_queue_readonly',
+    'official_queue',
+    'official_queue_readonly',
 ];
+/**
+ * Base groups (without _readonly suffix) - used for default "all groups" behavior
+ */
+const BASE_TOOL_GROUPS = ['newsletter', 'server_queue', 'official_queue'];
 /**
  * Parse enabled tool groups from environment variable or parameter
- * @param enabledGroupsParam - Comma-separated list of tool groups (e.g., "newsletter,server_queue_all")
+ * @param enabledGroupsParam - Comma-separated list of tool groups (e.g., "newsletter,server_queue_readonly")
  * @returns Array of enabled tool groups
  */
 export function parseEnabledToolGroups(enabledGroupsParam) {
-    const groupsStr = enabledGroupsParam || process.env.PULSEMCP_ADMIN_ENABLED_TOOLGROUPS || '';
+    const groupsStr = enabledGroupsParam || process.env.TOOL_GROUPS || '';
     if (!groupsStr) {
-        // Default: all groups enabled
-        return [
-            'newsletter',
-            'server_queue_readonly',
-            'server_queue_all',
-            'official_queue_readonly',
-            'official_queue_all',
-        ];
+        // Default: all base groups enabled (full read+write access)
+        return [...BASE_TOOL_GROUPS];
     }
     const groups = groupsStr.split(',').map((g) => g.trim());
     const validGroups = [];
     for (const group of groups) {
-        if (group === 'newsletter' ||
-            group === 'server_queue_readonly' ||
-            group === 'server_queue_all' ||
-            group === 'official_queue_readonly' ||
-            group === 'official_queue_all') {
+        if (VALID_TOOL_GROUPS.includes(group) &&
+            !validGroups.includes(group)) {
             validGroups.push(group);
         }
-        else {
+        else if (!VALID_TOOL_GROUPS.includes(group)) {
             console.warn(`Unknown tool group: ${group}`);
         }
     }
     return validGroups;
 }
+/**
+ * Check if a tool should be included based on enabled groups
+ * @param toolDef - The tool definition to check
+ * @param enabledGroups - Array of enabled tool groups
+ * @returns true if the tool should be included
+ */
+function shouldIncludeTool(toolDef, enabledGroups) {
+    const baseGroup = toolDef.group;
+    const readonlyGroup = `${baseGroup}_readonly`;
+    // Check if the base group (full access) is enabled
+    if (enabledGroups.includes(baseGroup)) {
+        return true;
+    }
+    // Check if the readonly group is enabled (only include read operations)
+    if (enabledGroups.includes(readonlyGroup) && !toolDef.isWriteOperation) {
+        return true;
+    }
+    return false;
+}
 /**
  * Creates a function to register all tools with the server.
  * This pattern uses individual tool files for better modularity and testability.
@@ -84,16 +113,17 @@ export function parseEnabledToolGroups(enabledGroupsParam) {
  * Each tool is defined in its own file under the `tools/` directory and follows
  * a factory pattern that accepts the server and clientFactory as parameters.
  *
- * Tool groups can be enabled/disabled via the PULSEMCP_ADMIN_ENABLED_TOOLGROUPS
- * environment variable (comma-separated list, e.g., "newsletter,server_queue_readonly").
- * If not set, all tool groups are enabled by default.
+ * Tool groups can be enabled/disabled via the TOOL_GROUPS environment variable
+ * (comma-separated list, e.g., "newsletter,server_queue_readonly"). If not set, all
+ * base tool groups are enabled by default (full read+write access).
  *
  * Available tool groups:
- * - newsletter: All newsletter-related tools
- * - server_queue_readonly: Read-only server queue tools (search, get drafts)
- * - server_queue_all: All server queue tools including write operations
- * - official_queue_readonly: Read-only official mirror queue tools (list, get)
- * - official_queue_all: All official mirror queue tools including write operations
+ * - newsletter: All newsletter-related tools (read + write)
+ * - newsletter_readonly: Newsletter tools (read only)
+ * - server_queue: MCP implementation queue tools (read + write)
+ * - server_queue_readonly: MCP implementation queue tools (read only)
+ * - official_queue: Official mirror queue tools (read + write)
+ * - official_queue_readonly: Official mirror queue tools (read only)
  *
  * @param clientFactory - Factory function that creates client instances
  * @param enabledGroups - Optional comma-separated list of enabled tool groups (overrides env var)
@@ -103,7 +133,7 @@ export function createRegisterTools(clientFactory, enabledGroups) {
     return (server) => {
         const enabledToolGroups = parseEnabledToolGroups(enabledGroups);
         // Filter tools based on enabled groups
-        const enabledTools = ALL_TOOLS.filter((toolDef) => toolDef.groups.some((group) => enabledToolGroups.includes(group)));
+        const enabledTools = ALL_TOOLS.filter((toolDef) => shouldIncludeTool(toolDef, enabledToolGroups));
         // Create tool instances
         const tools = enabledTools.map((toolDef) => toolDef.factory(server, clientFactory));
         // List available tools

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pulsemcp-cms-admin-mcp-server",
-  "version": "0.4.3",
+  "version": "0.5.0",
   "description": "Local implementation of PulseMCP CMS Admin MCP server",
   "mcpName": "com.pulsemcp.servers/pulsemcp-cms-admin",
   "main": "build/index.js",

package/shared/pulsemcp-admin-client/lib/create-post.js

@@ -65,7 +65,13 @@ export async function createPost(apiKey, baseUrl, params) {
         }
         if (response.status === 422) {
             const errorData = (await response.json());
-            const errors = errorData.errors || ['Validation failed'];
+            // Handle both array format and single error string format from Rails
+            // Also handle empty arrays - an empty array should fall back to the default message
+            const errors = errorData.errors && errorData.errors.length > 0
+                ? errorData.errors
+                : errorData.error
+                    ? [errorData.error]
+                    : ['Unknown validation error'];
             throw new Error(`Validation failed: ${errors.join(', ')}`);
         }
         throw new Error(`Failed to create post: ${response.status} ${response.statusText}`);

package/shared/pulsemcp-admin-client/lib/save-mcp-implementation.js

@@ -154,7 +154,13 @@ export async function saveMCPImplementation(apiKey, baseUrl, id, params) {
         }
         if (response.status === 422) {
             const errorData = (await response.json());
-            const errors = errorData.errors || ['Validation failed'];
+            // Handle both array format and single error string format from Rails
+            // Also handle empty arrays - an empty array should fall back to the default message
+            const errors = errorData.errors && errorData.errors.length > 0
+                ? errorData.errors
+                : errorData.error
+                    ? [errorData.error]
+                    : ['Unknown validation error'];
             throw new Error(`Validation failed: ${errors.join(', ')}`);
         }
         throw new Error(`Failed to save MCP implementation: ${response.status} ${response.statusText}`);

package/shared/pulsemcp-admin-client/lib/send-email.js

@@ -25,16 +25,19 @@ export async function sendEmail(apiKey, baseUrl, params) {
         let errorMessage;
         try {
             const errorData = JSON.parse(errorBody);
-            if (errorData.errors) {
-                errorMessage = Array.isArray(errorData.errors)
-                    ? errorData.errors.join(', ')
-                    : JSON.stringify(errorData.errors);
+            // Handle both array format and single error string format from Rails
+            // Also handle empty arrays - an empty array should fall back to checking other fields
+            if (Array.isArray(errorData.errors) && errorData.errors.length > 0) {
+                errorMessage = errorData.errors.join(', ');
+            }
+            else if (errorData.errors && typeof errorData.errors === 'object') {
+                errorMessage = JSON.stringify(errorData.errors);
             }
             else if (errorData.error) {
                 errorMessage = errorData.error;
             }
             else {
-                errorMessage = errorBody;
+                errorMessage = errorBody || 'Unknown validation error';
             }
         }
         catch {

package/shared/pulsemcp-admin-client/lib/update-post.js

@@ -71,7 +71,13 @@ export async function updatePost(apiKey, baseUrl, slug, params) {
         }
         if (response.status === 422) {
             const errorData = (await response.json());
-            const errors = errorData.errors || ['Validation failed'];
+            // Handle both array format and single error string format from Rails
+            // Also handle empty arrays - an empty array should fall back to the default message
+            const errors = errorData.errors && errorData.errors.length > 0
+                ? errorData.errors
+                : errorData.error
+                    ? [errorData.error]
+                    : ['Unknown validation error'];
             throw new Error(`Validation failed: ${errors.join(', ')}`);
         }
         throw new Error(`Failed to update post: ${response.status} ${response.statusText}`);

package/shared/tools.d.ts

@@ -3,16 +3,19 @@ import { ClientFactory } from './server.js';
 /**
  * Tool group definitions - groups of related tools that can be enabled/disabled together
  *
- * - newsletter: All newsletter-related tools (posts, authors, images)
- * - server_queue_readonly: Read-only server queue tools (search, get drafts)
- * - server_queue_all: All server queue tools including write operations (search, get drafts, save)
- * - official_queue_readonly: Read-only official mirror queue tools (list, get)
- * - official_queue_all: All official mirror queue tools including write operations (approve, reject, unlink)
+ * Each group has two variants:
+ * - Base group (e.g., 'newsletter'): Includes all tools (read + write operations)
+ * - Readonly group (e.g., 'newsletter_readonly'): Includes only read operations
+ *
+ * Groups:
+ * - newsletter / newsletter_readonly: Newsletter-related tools (posts, authors, images)
+ * - server_queue / server_queue_readonly: Server queue tools (search, drafts, providers, save, notifications)
+ * - official_queue / official_queue_readonly: Official mirror queue tools (list, get, approve, reject, unlink)
  */
-export type ToolGroup = 'newsletter' | 'server_queue_readonly' | 'server_queue_all' | 'official_queue_readonly' | 'official_queue_all';
+export type ToolGroup = 'newsletter' | 'newsletter_readonly' | 'server_queue' | 'server_queue_readonly' | 'official_queue' | 'official_queue_readonly';
 /**
  * Parse enabled tool groups from environment variable or parameter
- * @param enabledGroupsParam - Comma-separated list of tool groups (e.g., "newsletter,server_queue_all")
+ * @param enabledGroupsParam - Comma-separated list of tool groups (e.g., "newsletter,server_queue_readonly")
  * @returns Array of enabled tool groups
  */
 export declare function parseEnabledToolGroups(enabledGroupsParam?: string): ToolGroup[];
@@ -23,16 +26,17 @@ export declare function parseEnabledToolGroups(enabledGroupsParam?: string): Too
  * Each tool is defined in its own file under the `tools/` directory and follows
  * a factory pattern that accepts the server and clientFactory as parameters.
  *
- * Tool groups can be enabled/disabled via the PULSEMCP_ADMIN_ENABLED_TOOLGROUPS
- * environment variable (comma-separated list, e.g., "newsletter,server_queue_readonly").
- * If not set, all tool groups are enabled by default.
+ * Tool groups can be enabled/disabled via the TOOL_GROUPS environment variable
+ * (comma-separated list, e.g., "newsletter,server_queue_readonly"). If not set, all
+ * base tool groups are enabled by default (full read+write access).
  *
  * Available tool groups:
- * - newsletter: All newsletter-related tools
- * - server_queue_readonly: Read-only server queue tools (search, get drafts)
- * - server_queue_all: All server queue tools including write operations
- * - official_queue_readonly: Read-only official mirror queue tools (list, get)
- * - official_queue_all: All official mirror queue tools including write operations
+ * - newsletter: All newsletter-related tools (read + write)
+ * - newsletter_readonly: Newsletter tools (read only)
+ * - server_queue: MCP implementation queue tools (read + write)
+ * - server_queue_readonly: MCP implementation queue tools (read only)
+ * - official_queue: Official mirror queue tools (read + write)
+ * - official_queue_readonly: Official mirror queue tools (read only)
  *
  * @param clientFactory - Factory function that creates client instances
  * @param enabledGroups - Optional comma-separated list of enabled tool groups (overrides env var)

package/shared/tools.js

@@ -18,65 +18,94 @@ import { rejectOfficialMirrorQueueItem } from './tools/reject-official-mirror-qu
 import { addOfficialMirrorToRegularQueue } from './tools/add-official-mirror-to-regular-queue.js';
 import { unlinkOfficialMirrorQueueItem } from './tools/unlink-official-mirror-queue-item.js';
 const ALL_TOOLS = [
-    { factory: getNewsletterPosts, groups: ['newsletter'] },
-    { factory: getNewsletterPost, groups: ['newsletter'] },
-    { factory: draftNewsletterPost, groups: ['newsletter'] },
-    { factory: updateNewsletterPost, groups: ['newsletter'] },
-    { factory: uploadImage, groups: ['newsletter'] },
-    { factory: getAuthors, groups: ['newsletter'] },
-    { factory: searchMCPImplementations, groups: ['server_queue_readonly', 'server_queue_all'] },
-    { factory: getDraftMCPImplementations, groups: ['server_queue_readonly', 'server_queue_all'] },
-    { factory: saveMCPImplementation, groups: ['server_queue_all'] },
-    { factory: sendMCPImplementationPostingNotification, groups: ['server_queue_all'] },
-    { factory: findProviders, groups: ['server_queue_readonly', 'server_queue_all'] },
-    // Official mirror queue tools
+    // Newsletter tools (all are write operations except get_newsletter_posts/post and get_authors)
+    { factory: getNewsletterPosts, group: 'newsletter', isWriteOperation: false },
+    { factory: getNewsletterPost, group: 'newsletter', isWriteOperation: false },
+    { factory: draftNewsletterPost, group: 'newsletter', isWriteOperation: true },
+    { factory: updateNewsletterPost, group: 'newsletter', isWriteOperation: true },
+    { factory: uploadImage, group: 'newsletter', isWriteOperation: true },
+    { factory: getAuthors, group: 'newsletter', isWriteOperation: false },
+    // Server queue tools
+    { factory: searchMCPImplementations, group: 'server_queue', isWriteOperation: false },
+    { factory: getDraftMCPImplementations, group: 'server_queue', isWriteOperation: false },
+    { factory: saveMCPImplementation, group: 'server_queue', isWriteOperation: true },
     {
-        factory: getOfficialMirrorQueueItems,
-        groups: ['official_queue_readonly', 'official_queue_all'],
+        factory: sendMCPImplementationPostingNotification,
+        group: 'server_queue',
+        isWriteOperation: true,
     },
+    { factory: findProviders, group: 'server_queue', isWriteOperation: false },
+    // Official mirror queue tools
+    { factory: getOfficialMirrorQueueItems, group: 'official_queue', isWriteOperation: false },
+    { factory: getOfficialMirrorQueueItem, group: 'official_queue', isWriteOperation: false },
+    { factory: approveOfficialMirrorQueueItem, group: 'official_queue', isWriteOperation: true },
     {
-        factory: getOfficialMirrorQueueItem,
-        groups: ['official_queue_readonly', 'official_queue_all'],
+        factory: approveOfficialMirrorQueueItemWithoutModifying,
+        group: 'official_queue',
+        isWriteOperation: true,
     },
-    { factory: approveOfficialMirrorQueueItem, groups: ['official_queue_all'] },
-    { factory: approveOfficialMirrorQueueItemWithoutModifying, groups: ['official_queue_all'] },
-    { factory: rejectOfficialMirrorQueueItem, groups: ['official_queue_all'] },
-    { factory: addOfficialMirrorToRegularQueue, groups: ['official_queue_all'] },
-    { factory: unlinkOfficialMirrorQueueItem, groups: ['official_queue_all'] },
+    { factory: rejectOfficialMirrorQueueItem, group: 'official_queue', isWriteOperation: true },
+    { factory: addOfficialMirrorToRegularQueue, group: 'official_queue', isWriteOperation: true },
+    { factory: unlinkOfficialMirrorQueueItem, group: 'official_queue', isWriteOperation: true },
+];
+/**
+ * All valid tool groups (base groups and their _readonly variants)
+ */
+const VALID_TOOL_GROUPS = [
+    'newsletter',
+    'newsletter_readonly',
+    'server_queue',
+    'server_queue_readonly',
+    'official_queue',
+    'official_queue_readonly',
 ];
+/**
+ * Base groups (without _readonly suffix) - used for default "all groups" behavior
+ */
+const BASE_TOOL_GROUPS = ['newsletter', 'server_queue', 'official_queue'];
 /**
  * Parse enabled tool groups from environment variable or parameter
- * @param enabledGroupsParam - Comma-separated list of tool groups (e.g., "newsletter,server_queue_all")
+ * @param enabledGroupsParam - Comma-separated list of tool groups (e.g., "newsletter,server_queue_readonly")
  * @returns Array of enabled tool groups
  */
 export function parseEnabledToolGroups(enabledGroupsParam) {
-    const groupsStr = enabledGroupsParam || process.env.PULSEMCP_ADMIN_ENABLED_TOOLGROUPS || '';
+    const groupsStr = enabledGroupsParam || process.env.TOOL_GROUPS || '';
     if (!groupsStr) {
-        // Default: all groups enabled
-        return [
-            'newsletter',
-            'server_queue_readonly',
-            'server_queue_all',
-            'official_queue_readonly',
-            'official_queue_all',
-        ];
+        // Default: all base groups enabled (full read+write access)
+        return [...BASE_TOOL_GROUPS];
     }
     const groups = groupsStr.split(',').map((g) => g.trim());
     const validGroups = [];
     for (const group of groups) {
-        if (group === 'newsletter' ||
-            group === 'server_queue_readonly' ||
-            group === 'server_queue_all' ||
-            group === 'official_queue_readonly' ||
-            group === 'official_queue_all') {
+        if (VALID_TOOL_GROUPS.includes(group) &&
+            !validGroups.includes(group)) {
             validGroups.push(group);
         }
-        else {
+        else if (!VALID_TOOL_GROUPS.includes(group)) {
             console.warn(`Unknown tool group: ${group}`);
         }
     }
     return validGroups;
 }
+/**
+ * Check if a tool should be included based on enabled groups
+ * @param toolDef - The tool definition to check
+ * @param enabledGroups - Array of enabled tool groups
+ * @returns true if the tool should be included
+ */
+function shouldIncludeTool(toolDef, enabledGroups) {
+    const baseGroup = toolDef.group;
+    const readonlyGroup = `${baseGroup}_readonly`;
+    // Check if the base group (full access) is enabled
+    if (enabledGroups.includes(baseGroup)) {
+        return true;
+    }
+    // Check if the readonly group is enabled (only include read operations)
+    if (enabledGroups.includes(readonlyGroup) && !toolDef.isWriteOperation) {
+        return true;
+    }
+    return false;
+}
 /**
  * Creates a function to register all tools with the server.
  * This pattern uses individual tool files for better modularity and testability.
@@ -84,16 +113,17 @@ export function parseEnabledToolGroups(enabledGroupsParam) {
  * Each tool is defined in its own file under the `tools/` directory and follows
  * a factory pattern that accepts the server and clientFactory as parameters.
  *
- * Tool groups can be enabled/disabled via the PULSEMCP_ADMIN_ENABLED_TOOLGROUPS
- * environment variable (comma-separated list, e.g., "newsletter,server_queue_readonly").
- * If not set, all tool groups are enabled by default.
+ * Tool groups can be enabled/disabled via the TOOL_GROUPS environment variable
+ * (comma-separated list, e.g., "newsletter,server_queue_readonly"). If not set, all
+ * base tool groups are enabled by default (full read+write access).
  *
  * Available tool groups:
- * - newsletter: All newsletter-related tools
- * - server_queue_readonly: Read-only server queue tools (search, get drafts)
- * - server_queue_all: All server queue tools including write operations
- * - official_queue_readonly: Read-only official mirror queue tools (list, get)
- * - official_queue_all: All official mirror queue tools including write operations
+ * - newsletter: All newsletter-related tools (read + write)
+ * - newsletter_readonly: Newsletter tools (read only)
+ * - server_queue: MCP implementation queue tools (read + write)
+ * - server_queue_readonly: MCP implementation queue tools (read only)
+ * - official_queue: Official mirror queue tools (read + write)
+ * - official_queue_readonly: Official mirror queue tools (read only)
  *
  * @param clientFactory - Factory function that creates client instances
  * @param enabledGroups - Optional comma-separated list of enabled tool groups (overrides env var)
@@ -103,7 +133,7 @@ export function createRegisterTools(clientFactory, enabledGroups) {
     return (server) => {
         const enabledToolGroups = parseEnabledToolGroups(enabledGroups);
         // Filter tools based on enabled groups
-        const enabledTools = ALL_TOOLS.filter((toolDef) => toolDef.groups.some((group) => enabledToolGroups.includes(group)));
+        const enabledTools = ALL_TOOLS.filter((toolDef) => shouldIncludeTool(toolDef, enabledToolGroups));
         // Create tool instances
         const tools = enabledTools.map((toolDef) => toolDef.factory(server, clientFactory));
         // List available tools