pulsemcp-cms-admin-mcp-server 0.9.17 → 0.9.24

package/shared/tools/save-mcp-implementation.js

@@ -1,4 +1,29 @@
 import { z } from 'zod';
+// Hosts that must never appear as canonical URLs. Source-code hosts belong in
+// `source_code_location`; aggregators are not authoritative. Mirrors the rule
+// in agents/skills/server-discovery/identify-remote-canonical-url/SKILL.md.
+export const BLOCKLISTED_CANONICAL_HOSTS = [
+    'github.com',
+    'gitlab.com',
+    'bitbucket.org',
+    'smithery.ai',
+    'glama.ai',
+];
+export function findBlocklistedCanonicalHost(url) {
+    let host;
+    try {
+        host = new URL(url).hostname.toLowerCase();
+    }
+    catch {
+        return null;
+    }
+    for (const blocked of BLOCKLISTED_CANONICAL_HOSTS) {
+        if (host === blocked || host.endsWith(`.${blocked}`)) {
+            return host;
+        }
+    }
+    return null;
+}
 // Parameter descriptions - single source of truth
 const PARAM_DESCRIPTIONS = {
     id: 'The ID of the MCP implementation to update. Omit this field to CREATE a new implementation instead of updating an existing one.',
@@ -26,11 +51,12 @@ const PARAM_DESCRIPTIONS = {
     // Remote endpoints
     remote: 'Array of remote endpoint configurations for MCP servers. Providing this replaces ALL existing remotes. Omitting leaves them unchanged. Pass an empty array to delete all. Each remote can have: id (existing remote ID or blank for new), url_direct, url_setup, transport (e.g., "sse"), host_platform (e.g., "smithery"), host_infrastructure (e.g., "cloudflare"), authentication_method (e.g., "open"), cost (e.g., "free"), status (defaults to "live"), display_name, and internal_notes.',
     // Canonical URLs
-    canonical: 'Array of canonical URL configurations. Providing this replaces ALL existing canonical URLs. Omitting leaves them unchanged. Pass an empty array to delete all. Each entry must have: url (the canonical URL), scope (one of "domain", "subdomain", or "url"), and optional note for additional context.',
+    canonical: 'Array of canonical URL configurations. Providing this replaces ALL existing canonical URLs. Omitting leaves them unchanged. Pass an empty array to delete all. Each entry must have: url (the canonical URL), scope (one of "domain", "subdomain", or "url"), and optional note for additional context. The host must NOT be one of: github.com, gitlab.com, bitbucket.org, smithery.ai, glama.ai (or any subdomain of those) — source-code repos belong in `source_code_location`, and aggregator listings are not authoritative. Calls with blocklisted canonical hosts are rejected with `CANONICAL_BLOCKLISTED_HOST`.',
     // Flags
     verified_no_remote_canonicals: 'Mark that this server has been verified to have no remote canonical URLs (true = verified no remote canonicals exist, false = reset/canonicals found)',
     // Other fields
     internal_notes: 'Admin-only notes. Not displayed publicly. Used for tracking submission sources, reviewer comments, etc.',
+    owner_tenant: 'Owner tenant of this server. Pass a tenant slug (e.g. "gram-recommended") or numeric tenant ID to link, or null to clear the link. Omit to leave unchanged. Slugs are preferred for readability; the Rails backend resolves them to a tenant ID. An unknown slug returns a validation error.',
 };
 const SaveMCPImplementationSchema = z.object({
     id: z.number().optional().describe(PARAM_DESCRIPTIONS.id),
@@ -97,6 +123,10 @@ const SaveMCPImplementationSchema = z.object({
         .describe(PARAM_DESCRIPTIONS.verified_no_remote_canonicals),
     // Other fields
     internal_notes: z.string().optional().describe(PARAM_DESCRIPTIONS.internal_notes),
+    owner_tenant: z
+        .union([z.string(), z.number(), z.null()])
+        .optional()
+        .describe(PARAM_DESCRIPTIONS.owner_tenant),
 });
 export function saveMCPImplementation(_server, clientFactory) {
     return {
@@ -314,13 +344,48 @@ Important notes:
                     type: 'string',
                     description: PARAM_DESCRIPTIONS.internal_notes,
                 },
+                // Owner tenant
+                owner_tenant: {
+                    oneOf: [{ type: 'string' }, { type: 'number' }, { type: 'null' }],
+                    description: PARAM_DESCRIPTIONS.owner_tenant,
+                },
             },
         },
         handler: async (args) => {
             const validatedArgs = SaveMCPImplementationSchema.parse(args);
+            if (validatedArgs.canonical) {
+                for (const entry of validatedArgs.canonical) {
+                    const blockedHost = findBlocklistedCanonicalHost(entry.url);
+                    if (blockedHost) {
+                        return {
+                            content: [
+                                {
+                                    type: 'text',
+                                    text: `CANONICAL_BLOCKLISTED_HOST: ${blockedHost} is not a valid canonical URL host. Use the actual project homepage instead.`,
+                                },
+                            ],
+                            isError: true,
+                        };
+                    }
+                }
+            }
             const client = clientFactory();
             try {
-                const { id, type, ...restParams } = validatedArgs;
+                const { id, type, owner_tenant, ...restParams } = validatedArgs;
+                // Translate owner_tenant (string slug | number id | null clear) into the
+                // explicit owner_tenant_slug / owner_tenant_id fields the admin client
+                // forwards to Rails.
+                if (owner_tenant !== undefined) {
+                    if (typeof owner_tenant === 'string') {
+                        restParams.owner_tenant_slug = owner_tenant;
+                    }
+                    else if (typeof owner_tenant === 'number') {
+                        restParams.owner_tenant_id = owner_tenant;
+                    }
+                    else {
+                        restParams.owner_tenant_id = null;
+                    }
+                }
                 // Determine if this is a create or update operation
                 const isCreate = id === undefined;
                 if (isCreate) {
@@ -386,6 +451,15 @@ Important notes:
                             content += `  - ${r.display_name || r.url_direct || `ID ${r.id}`}\n`;
                         });
                     }
+                    const createOwnerSlug = implementation.mcp_server?.owner_tenant_slug;
+                    const createOwnerId = implementation.mcp_server?.owner_tenant_id;
+                    if (createOwnerSlug || createOwnerId) {
+                        content += `**Owner Tenant:** ${createOwnerSlug ?? '(no slug)'}`;
+                        if (createOwnerId) {
+                            content += ` (id: ${createOwnerId})`;
+                        }
+                        content += '\n';
+                    }
                     if (implementation.created_at) {
                         content += `**Created:** ${new Date(implementation.created_at).toLocaleDateString()}\n`;
                     }
@@ -459,6 +533,19 @@ Important notes:
                             content += `  - ${r.display_name || r.url_direct || `ID ${r.id}`}\n`;
                         });
                     }
+                    const updateOwnerSlug = implementation.mcp_server?.owner_tenant_slug;
+                    const updateOwnerId = implementation.mcp_server?.owner_tenant_id;
+                    if (updateOwnerSlug || updateOwnerId) {
+                        content += `**Owner Tenant:** ${updateOwnerSlug ?? '(no slug)'}`;
+                        if (updateOwnerId) {
+                            content += ` (id: ${updateOwnerId})`;
+                        }
+                        content += '\n';
+                    }
+                    else if (implementation.mcp_server?.owner_tenant_id === null &&
+                        implementation.mcp_server?.owner_tenant_slug === null) {
+                        content += `**Owner Tenant:** (none)\n`;
+                    }
                     if (implementation.updated_at) {
                         content += `**Updated:** ${new Date(implementation.updated_at).toLocaleDateString()}\n`;
                     }

package/shared/tools/update-mcp-server.d.ts

@@ -183,6 +183,12 @@ export declare function updateMCPServer(_server: Server, clientFactory: ClientFa
                 type: string;
                 description: "Admin-only internal notes";
             };
+            owner_tenant: {
+                oneOf: {
+                    type: string;
+                }[];
+                description: "Owner tenant of this server. Pass a tenant slug (e.g. \"gram-recommended\") or numeric tenant ID to link, or null to clear the link. Omit to leave unchanged. Slugs are preferred for readability; the Rails backend resolves them to a tenant ID. An unknown slug returns a validation error.";
+            };
         };
         required: string[];
     };

package/shared/tools/update-mcp-server.js

@@ -22,6 +22,7 @@ const PARAM_DESCRIPTIONS = {
     canonical_urls: 'Authoritative URLs for the server. Providing this replaces ALL existing canonical URLs. Omitting leaves them unchanged. Pass an empty array to delete all.',
     remotes: 'Remote endpoints for the server. Providing this replaces ALL existing remotes. Omitting leaves them unchanged. Pass an empty array to delete all.',
     internal_notes: 'Admin-only internal notes',
+    owner_tenant: 'Owner tenant of this server. Pass a tenant slug (e.g. "gram-recommended") or numeric tenant ID to link, or null to clear the link. Omit to leave unchanged. Slugs are preferred for readability; the Rails backend resolves them to a tenant ID. An unknown slug returns a validation error.',
 };
 const CanonicalUrlSchema = z.object({
     url: z.string().describe('The canonical URL'),
@@ -95,6 +96,10 @@ const UpdateMCPServerSchema = z.object({
         .describe(PARAM_DESCRIPTIONS.canonical_urls),
     remotes: z.array(RemoteEndpointSchema).optional().describe(PARAM_DESCRIPTIONS.remotes),
     internal_notes: z.string().optional().describe(PARAM_DESCRIPTIONS.internal_notes),
+    owner_tenant: z
+        .union([z.string(), z.number(), z.null()])
+        .optional()
+        .describe(PARAM_DESCRIPTIONS.owner_tenant),
 });
 export function updateMCPServer(_server, clientFactory) {
     return {
@@ -284,6 +289,10 @@ Create new provider:
                     description: PARAM_DESCRIPTIONS.remotes,
                 },
                 internal_notes: { type: 'string', description: PARAM_DESCRIPTIONS.internal_notes },
+                owner_tenant: {
+                    oneOf: [{ type: 'string' }, { type: 'number' }, { type: 'null' }],
+                    description: PARAM_DESCRIPTIONS.owner_tenant,
+                },
             },
             required: ['implementation_id'],
         },
@@ -335,6 +344,16 @@ Create new provider:
                 if (server.verified_no_remote_canonicals !== undefined) {
                     content += `**Verified No Remote Canonicals:** ${server.verified_no_remote_canonicals ? 'Yes' : 'No'}\n`;
                 }
+                if (server.owner_tenant_slug || server.owner_tenant_id) {
+                    content += `**Owner Tenant:** ${server.owner_tenant_slug ?? '(no slug)'}`;
+                    if (server.owner_tenant_id) {
+                        content += ` (id: ${server.owner_tenant_id})`;
+                    }
+                    content += '\n';
+                }
+                else if (server.owner_tenant_id === null && server.owner_tenant_slug === null) {
+                    content += `**Owner Tenant:** (none)\n`;
+                }
                 if (server.updated_at) {
                     content += `**Updated:** ${server.updated_at}\n`;
                 }

package/shared/tools.d.ts

@@ -18,7 +18,8 @@ import { ClientFactory } from './server.js';
  * - official_queue / official_queue_readonly: Official mirror queue tools (list, get, approve, reject, unlink)
  * - unofficial_mirrors / unofficial_mirrors_readonly: Unofficial mirror CRUD tools
  * - official_mirrors_readonly: Official mirrors read-only tools (REST API)
- * - tenants / tenants_readonly: Tenant management tools (CRUD + API key provisioning)
+ * - tenants / tenants_readonly: Tenant management tools (CRUD + API key provisioning, including revoke_api_key for rolling keys after re-issuance)
+ * - tenants_destructive: Destructive tenant tools (delete_tenant, delete_api_key). NOT enabled by default — operators must opt in via TOOL_GROUPS. Each tool requires MCP elicitation user approval before execution.
  * - mcp_jsons / mcp_jsons_readonly: MCP JSON configuration tools
  * - mcp_servers / mcp_servers_readonly: Unified MCP server tools (abstracted interface)
  * - redirects / redirects_readonly: URL redirect management tools
@@ -28,7 +29,7 @@ import { ClientFactory } from './server.js';
  * - moz / moz_readonly: MOZ SEO metrics tools (live URL metrics, backlinks, stored historical data)
  * - notifications: Notification email tools (send_impl_posted_notif). Separated from server_directory so notification capability can be granted independently.
  */
-export type ToolGroup = 'newsletter' | 'newsletter_readonly' | 'server_directory' | 'server_directory_readonly' | 'official_queue' | 'official_queue_readonly' | 'unofficial_mirrors' | 'unofficial_mirrors_readonly' | 'official_mirrors' | 'official_mirrors_readonly' | 'tenants' | 'tenants_readonly' | 'mcp_jsons' | 'mcp_jsons_readonly' | 'mcp_servers' | 'mcp_servers_readonly' | 'redirects' | 'redirects_readonly' | 'good_jobs' | 'good_jobs_readonly' | 'proctor' | 'proctor_readonly' | 'discovered_urls' | 'discovered_urls_readonly' | 'moz' | 'moz_readonly' | 'notifications';
+export type ToolGroup = 'newsletter' | 'newsletter_readonly' | 'server_directory' | 'server_directory_readonly' | 'official_queue' | 'official_queue_readonly' | 'unofficial_mirrors' | 'unofficial_mirrors_readonly' | 'official_mirrors' | 'official_mirrors_readonly' | 'tenants' | 'tenants_readonly' | 'tenants_destructive' | 'mcp_jsons' | 'mcp_jsons_readonly' | 'mcp_servers' | 'mcp_servers_readonly' | 'redirects' | 'redirects_readonly' | 'good_jobs' | 'good_jobs_readonly' | 'proctor' | 'proctor_readonly' | 'discovered_urls' | 'discovered_urls_readonly' | 'moz' | 'moz_readonly' | 'notifications';
 /**
  * Parse enabled tool groups from environment variable or parameter
  * @param enabledGroupsParam - Comma-separated list of tool groups (e.g., "newsletter,server_directory_readonly")
@@ -60,8 +61,9 @@ export declare function parseEnabledToolGroups(enabledGroupsParam?: string): Too
  * - unofficial_mirrors: Unofficial mirror CRUD tools (read + write)
  * - unofficial_mirrors_readonly: Unofficial mirror tools (read only)
  * - official_mirrors_readonly: Official mirrors REST API tools (read only)
- * - tenants: Tenant management tools including API key provisioning (read + write)
+ * - tenants: Tenant management tools including API key provisioning + revoke_api_key (read + write). revoke_api_key is gated by MCP elicitation user approval before execution.
  * - tenants_readonly: Tenant tools (read only)
+ * - tenants_destructive: Destructive tenant tools (delete_tenant, delete_api_key). NOT enabled by default; operators must opt in via TOOL_GROUPS. Each tool requires MCP elicitation user approval before execution.
  * - mcp_jsons: MCP JSON configuration tools (read + write)
  * - mcp_jsons_readonly: MCP JSON tools (read only)
  * - mcp_servers: Unified MCP server tools with abstracted interface (read + write)

package/shared/tools.js

@@ -31,6 +31,12 @@ import { getTenants } from './tools/get-tenants.js';
 import { getTenant } from './tools/get-tenant.js';
 import { createTenant } from './tools/create-tenant.js';
 import { createApiKey } from './tools/create-api-key.js';
+import { revokeApiKey } from './tools/revoke-api-key.js';
+import { deleteTenant } from './tools/delete-tenant.js';
+import { deleteApiKey } from './tools/delete-api-key.js';
+import { listTenantServers } from './tools/list-tenant-servers.js';
+import { addServersToTenant } from './tools/add-servers-to-tenant.js';
+import { removeServersFromTenant } from './tools/remove-servers-from-tenant.js';
 // MCP JSON tools
 import { getMcpJsons } from './tools/get-mcp-jsons.js';
 import { getMcpJson } from './tools/get-mcp-json.js';
@@ -178,6 +184,19 @@ const ALL_TOOLS = [
     { factory: getTenant, groups: ['tenants'], isWriteOperation: false },
     { factory: createTenant, groups: ['tenants'], isWriteOperation: true },
     { factory: createApiKey, groups: ['tenants'], isWriteOperation: true },
+    // revoke_api_key lives in the regular `tenants` group (not `tenants_destructive`) so
+    // it's exposed to read-write tenant management workflows like sub-registry credential
+    // re-issuance. The tool gates each call with MCP elicitation; if the connected client
+    // supports neither native elicitation nor an HTTP fallback, the elicitation library
+    // throws at runtime rather than silently destroying the key.
+    { factory: revokeApiKey, groups: ['tenants'], isWriteOperation: true },
+    // Destructive tenant tools — opt-in only, NOT in BASE_TOOL_GROUPS
+    { factory: deleteTenant, groups: ['tenants_destructive'], isWriteOperation: true },
+    { factory: deleteApiKey, groups: ['tenants_destructive'], isWriteOperation: true },
+    // Tenant -> recommended MCP server association tools
+    { factory: listTenantServers, groups: ['tenants'], isWriteOperation: false },
+    { factory: addServersToTenant, groups: ['tenants'], isWriteOperation: true },
+    { factory: removeServersFromTenant, groups: ['tenants'], isWriteOperation: true },
     // MCP JSON tools (CRUD) (also in server_directory)
     {
         factory: getMcpJsons,
@@ -277,6 +296,7 @@ const VALID_TOOL_GROUPS = [
     'official_mirrors_readonly',
     'tenants',
     'tenants_readonly',
+    'tenants_destructive',
     'mcp_jsons',
     'mcp_jsons_readonly',
     'mcp_servers',
@@ -382,8 +402,9 @@ function shouldIncludeTool(toolDef, enabledGroups) {
  * - unofficial_mirrors: Unofficial mirror CRUD tools (read + write)
  * - unofficial_mirrors_readonly: Unofficial mirror tools (read only)
  * - official_mirrors_readonly: Official mirrors REST API tools (read only)
- * - tenants: Tenant management tools including API key provisioning (read + write)
+ * - tenants: Tenant management tools including API key provisioning + revoke_api_key (read + write). revoke_api_key is gated by MCP elicitation user approval before execution.
  * - tenants_readonly: Tenant tools (read only)
+ * - tenants_destructive: Destructive tenant tools (delete_tenant, delete_api_key). NOT enabled by default; operators must opt in via TOOL_GROUPS. Each tool requires MCP elicitation user approval before execution.
  * - mcp_jsons: MCP JSON configuration tools (read + write)
  * - mcp_jsons_readonly: MCP JSON tools (read only)
  * - mcp_servers: Unified MCP server tools with abstracted interface (read + write)

package/shared/types.d.ts

@@ -126,6 +126,8 @@ export interface MCPServer {
     mcp_server_remotes_count?: number;
     recommended?: boolean;
     verified_no_remote_canonicals?: boolean;
+    owner_tenant_id?: number | null;
+    owner_tenant_slug?: string | null;
     tags?: MCPServerTag[];
     remotes?: MCPServerRemote[];
 }
@@ -196,6 +198,8 @@ export interface SaveMCPImplementationParams {
     implementation_language?: string;
     mcp_server_id?: number | null;
     mcp_client_id?: number | null;
+    owner_tenant_id?: number | null;
+    owner_tenant_slug?: string | null;
     provider_id?: string | number;
     provider_slug?: string;
     provider_url?: string;
@@ -247,6 +251,8 @@ export interface CreateMCPImplementationParams {
     remote?: RemoteEndpointParams[];
     canonical?: CanonicalUrlParams[];
     internal_notes?: string;
+    owner_tenant_id?: number | null;
+    owner_tenant_slug?: string | null;
 }
 export interface Provider {
     id: number;
@@ -427,6 +433,68 @@ export interface TenantsResponse {
         limit?: number;
     };
 }
+export interface TenantServer {
+    id: number;
+    tenant_id: number;
+    mcp_server_id: number;
+    mcp_server_slug: string;
+    status: 'active' | 'deleted';
+    server_json_selection: string;
+    first_touched_at?: string | null;
+    touched: boolean;
+    created_at?: string;
+    updated_at?: string;
+}
+export interface ListTenantServersResponse {
+    data: TenantServer[];
+    pagination: {
+        current_page: number;
+        total_pages: number;
+        total_count: number;
+        has_next: boolean;
+        limit: number;
+    };
+}
+export interface BulkUpdateTenantServersParams {
+    add_server_identifiers?: Array<number | string>;
+    remove_server_identifiers?: Array<number | string>;
+    restore_association_ids?: number[];
+}
+export interface BulkUpdateAddedItem {
+    mcp_server_id: number;
+    mcp_server_slug: string;
+    association_id: number;
+    outcome: 'created' | 'restored_from_deleted';
+}
+export interface BulkUpdateRemovedItem {
+    mcp_server_id: number;
+    mcp_server_slug: string;
+    association_id: number | null;
+    outcome: 'hard_deleted' | 'soft_deleted';
+}
+export interface BulkUpdateRestoredItem {
+    mcp_server_id: number;
+    mcp_server_slug: string;
+    association_id: number;
+}
+export interface BulkUpdateSkippedItem {
+    mcp_server_id?: number;
+    mcp_server_slug?: string;
+    association_id?: number;
+    reason: 'no_unofficial_mirror' | 'already_active' | string;
+}
+export interface BulkUpdateTenantServersResponse {
+    status: 'success';
+    tenant: {
+        id: number;
+        slug: string;
+    };
+    added: BulkUpdateAddedItem[];
+    removed: BulkUpdateRemovedItem[];
+    restored: BulkUpdateRestoredItem[];
+    skipped: BulkUpdateSkippedItem[];
+    unresolved_identifiers: Array<number | string>;
+}
 export interface McpJson {
     id: number;
     mcp_servers_unofficial_mirror_id: number;
@@ -529,6 +597,8 @@ export interface UnifiedMCPServer {
     downloads_estimate_last_30_days?: number;
     downloads_estimate_total?: number;
     internal_notes?: string;
+    owner_tenant_id?: number | null;
+    owner_tenant_slug?: string | null;
     created_at?: string;
     updated_at?: string;
     created_on_override?: string;
@@ -575,6 +645,7 @@ export interface UpdateUnifiedMCPServerParams {
     canonical_urls?: CanonicalUrl[];
     remotes?: RemoteEndpoint[];
     internal_notes?: string;
+    owner_tenant?: string | number | null;
 }
 export type RedirectStatus = 'draft' | 'active' | 'paused' | 'archived';
 export interface Redirect {
@@ -805,6 +876,18 @@ export interface CreateApiKeyParams {
     name?: string;
     permission_level?: ApiKeyPermissionLevel;
 }
+export interface DeleteTenantParams {
+    id_or_slug: number | string;
+    force?: boolean;
+}
+export interface DeleteTenantResponse {
+    success: boolean;
+    message: string;
+}
+export interface DeleteApiKeyResponse {
+    success: boolean;
+    message: string;
+}
 export interface RecacheMCPServerResponse {
     message: string;
 }