qyl-mcp-server 1.1.0 → 1.1.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/README.md +47 -23
  2. package/dist/mcp-app.html +1 -1
  3. package/dist/mcp-dashboard.html +1 -1
  4. package/dist/mcp-home.html +1 -1
  5. package/dist/observe-graph.html +1 -1
  6. package/package.json +4 -3
package/README.md CHANGED
@@ -1,49 +1,73 @@
1
1
  # qyl-mcp-server
2
2
 
3
- qyl telemetry MCP server: trace explorer, MCP dashboard, log search, and CI-run
4
- inspection for a live [qyl](https://github.com/ANcpLua/qyl) collector — or an
5
- explicit, visibly labelled demo mode.
3
+ MCP tools over a live [qyl](https://github.com/ANcpLua/qyl) collector — traces,
4
+ logs, sessions, CI runs, and a graph view of agent runs you can watch while they
5
+ execute.
6
6
 
7
7
  ```bash
8
8
  npx qyl-mcp-server --stdio # stdio MCP server
9
- npx qyl-mcp-server # Streamable HTTP on loopback
9
+ npx qyl-mcp-server # Streamable HTTP on 127.0.0.1:3001
10
10
  ```
11
11
 
12
- Works standalone with any MCP client. Point `QYL_COLLECTOR_URL` and
13
- `QYL_OTLP_ENDPOINT` at a local or hosted Qyl collector; MCP process supervision
14
- and interactive connections belong to the qyl.mcp workbench runner.
12
+ Works with any MCP client. Point it at a collector:
15
13
 
16
- The HTTP server publishes a product and setup page at `/`; the protocol remains
17
- available only at `/mcp`.
14
+ ```bash
15
+ export QYL_COLLECTOR_URL=http://127.0.0.1:5100
16
+ export QYL_API_KEY='your-collector-key' # omit for an unsecured local collector
17
+ ```
18
+
19
+ `QYL_API_KEY` is an *outgoing* collector credential — it does not authenticate
20
+ incoming MCP clients, which is why the local server binds to loopback only.
18
21
 
19
- The server uses the MCP v2 serving entries. Streamable HTTP uses
20
- `createMcpHandler` and stdio uses `serveStdio`; both accept only protocol
21
- revision `2026-07-28`.
22
+ There is also a hosted instance at `https://mcp.qyl.at/mcp` needing no install.
23
+ It is an OAuth 2.1 resource server, so an unauthenticated request answers `401`
24
+ with an RFC 9728 protected-resource document that a stock MCP client follows on
25
+ its own.
26
+
27
+ Both accept only protocol revision `2026-07-28`, on MCP TypeScript SDK 2.0.0 —
28
+ Streamable HTTP through `createMcpHandler`, stdio through `serveStdio`.
29
+ The HTTP server serves a product page at `/`; `/mcp` is the only protocol
30
+ endpoint.
22
31
 
23
32
  ## Tools
24
33
 
25
- `fetch_telemetry`, `list_traces`, `get_trace`, `list_sessions`, `search_logs`,
26
- `display_traces`, `display_mcp_dashboard`, `ci_log` — all published with
27
- read-only safety annotations. The two `display_*` tools return MCP Apps UI
28
- resources (single-file viewers).
34
+ **Telemetry** — `list_traces`, `get_trace`, `list_sessions`, `search_logs`,
35
+ `ci_log`, `display_traces`, `display_mcp_dashboard`.
36
+
37
+ **Workflow graph** — `list_workflow_runs`, `get_workflow_graph`,
38
+ `display_workflow_graph`, `control_workflow_run`.
29
39
 
30
- Every inbound `tools/call` is recorded natively: validated result, lifecycle,
31
- duration, redacted JSON-RPC timeline, and trace/span correlation are persisted
40
+ **App-only** — `fetch_telemetry` and `fetch_workflow_graph_updates` are called by
41
+ the bundled MCP Apps, not by a model.
42
+
43
+ All are read-only except **`control_workflow_run`**, which steers, interrupts, or
44
+ resumes a run. It is approval-gated and, on the hosted server, requires the
45
+ `qyl:control` scope in addition to `qyl:read`.
46
+
47
+ The `display_*` tools return MCP Apps UI resources as single-file viewers.
48
+
49
+ Every inbound `tools/call` is recorded natively — validated result, lifecycle,
50
+ duration, redacted JSON-RPC timeline, and trace/span correlation — persisted
32
51
  atomically to `~/.qyl/mcp-native-executions.json`.
33
52
 
34
53
  ## Configuration
35
54
 
36
55
  | Variable | Meaning |
37
56
  | --- | --- |
38
- | `QYL_COLLECTOR_URL` | qyl read API base; default `http://127.0.0.1:5100`. Also the OTLP base when set. |
39
- | `QYL_API_KEY` | Collector read and OTLP credential. |
57
+ | `QYL_COLLECTOR_URL` | Collector read API base; default `http://127.0.0.1:5100`. Also the OTLP base when set. |
58
+ | `QYL_API_KEY` | Collector read and OTLP credential. Outgoing only. |
59
+ | `QYL_PROJECT` | Server-owned collector project scope; defaults to `default`. Never accepted as tool input. |
40
60
  | `QYL_OTLP_ENDPOINT` | Optional OTLP base for self-telemetry. |
41
- | `QYL_DEMO=1` | Explicit generated demo telemetry. Collector failure never silently substitutes demo data. |
61
+ | `QYL_DEMO=1` | Explicit, visibly labelled demo telemetry. A collector failure never silently substitutes demo data. |
42
62
  | `QYL_MCP_TELEMETRY=0` | Disable MCP spans, metrics, and operation logs. |
43
- | `QYL_MCP_CAPTURE_CONTENT=1` | Include redacted, size-bounded request and response bodies in MCP operation logs. Disabled by default. |
63
+ | `QYL_MCP_CAPTURE_CONTENT=1` | Include redacted, size-bounded request and response bodies in operation logs. Off by default. |
44
64
  | `QYL_MCP_NATIVE_STATE_PATH` | Override the native execution-evidence path. |
65
+ | `PORT` | HTTP listener port; default `3001`. |
45
66
 
46
67
  Secrets are redacted before results reach the model, structured content, or
47
68
  durable evidence.
48
69
 
49
- Full documentation: [github.com/ANcpLua/qyl.mcp](https://github.com/ANcpLua/qyl.mcp)
70
+ Requires Node.js 24.
71
+
72
+ Full documentation, the workbench, and self-hosting:
73
+ [github.com/ANcpLua/qyl.mcp](https://github.com/ANcpLua/qyl.mcp)