rhombus-node-mcp 0.1.36 → 0.1.44

package/dist/api/onguard-tool-api.js

@@ -0,0 +1,44 @@
+import { postApi } from "../network/network.js";
+import { formatTimestamp } from "../util.js";
+/**
+ * Calls the webservice OnGuard event search (POST /eventSearchV2/searchOnGuardEvents) and maps the
+ * raw seekpoints to an agent-friendly shape. Typed against the generated public OpenAPI schema.
+ */
+export async function searchOnGuardEvents(args, timeZone, requestModifiers, sessionId) {
+    const body = {
+        deviceUuids: args.deviceUuids,
+        locationUuids: args.locationUuids,
+        afterMs: args.afterMs,
+        beforeMs: args.beforeMs,
+        cardholderQuery: args.cardholderQuery,
+        badgeStatus: args.badgeStatus,
+        badgeType: args.badgeType,
+        area: args.area,
+        anomalyOnly: args.anomalyOnly,
+        entryMade: args.entryMade,
+        limit: args.limit ?? 200,
+    };
+    const res = await postApi({
+        route: "/eventSearchV2/searchOnGuardEvents",
+        body,
+        modifiers: requestModifiers,
+        sessionId,
+    });
+    if (res.error) {
+        throw new Error(res.status ?? res.errorMsg ?? "OnGuard event search failed");
+    }
+    const events = (res.events ?? []).map((e) => ({
+        timestampMs: e.timestampMs ?? undefined,
+        datetime: e.timestampMs != null ? formatTimestamp(e.timestampMs, timeZone) : undefined,
+        deviceUuid: e.deviceUuid ?? undefined,
+        label: e.customDisplayName ?? undefined,
+        cardholderName: e.customDescription ?? undefined,
+        badgeStatus: e.badgeStatus ?? undefined,
+        badgeType: e.badgeType ?? undefined,
+        areaEntering: e.areaEntering ?? undefined,
+        areaExiting: e.areaExiting ?? undefined,
+        entryMade: e.entryMade ?? undefined,
+        isAnomaly: e.alert ?? undefined,
+    }));
+    return { events };
+}

package/dist/auth-context.js

@@ -0,0 +1,2 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+export const requestAuthContext = new AsyncLocalStorage();

package/dist/filtering-utils.js

@@ -295,9 +295,35 @@ export function createFilteringProxy(server, blacklist = new Set()) {
                 if (blacklist.has(name)) {
                     return target.registerTool(name, config, handler);
                 }
+                let descriptionSuffix = FILTERING_DESCRIPTION_SUFFIX;
+                if (config.outputSchema) {
+                    try {
+                        let schema;
+                        if (config.outputSchema instanceof z.ZodType) {
+                            schema = config.outputSchema;
+                        }
+                        else if (typeof config.outputSchema === "object") {
+                            schema = z.object(config.outputSchema);
+                        }
+                        else {
+                            schema = config.outputSchema;
+                        }
+                        const paths = zodToDotNotationPaths(schema);
+                        if (paths.length > 0) {
+                            const filteredPaths = [...new Set(paths.filter((p) => p !== "requestType" && p !== "error" && p.trim() !== ""))].sort();
+                            if (filteredPaths.length > 0) {
+                                descriptionSuffix += `\n\n**Available output field paths for this tool's \`includeFields\` / \`filterBy\`:**\n` +
+                                    filteredPaths.map((p) => `- \`"${p}"\``).join("\n");
+                            }
+                        }
+                    }
+                    catch (error) {
+                        // Fall back to the default description suffix on parsing failure
+                    }
+                }
                 const augmentedConfig = {
                     ...config,
-                    description: (config.description ?? "") + FILTERING_DESCRIPTION_SUFFIX,
+                    description: (config.description ?? "") + descriptionSuffix,
                     inputSchema: {
                         ...config.inputSchema,
                         includeFields: INCLUDE_FIELDS_ARG,

package/dist/network/network.js

@@ -1,5 +1,5 @@
 import { logger } from "../logger.js";
-import { authStore } from "../transports/streamable-http.js";
+import { requestAuthContext } from "../auth-context.js";
 export const RHOMBUS_API_KEY = process.env.RHOMBUS_API_KEY;
 export const serverUrl = process.env.RHOMBUS_API_SERVER || "api2.rhombussystems.com";
 export const BASE_URL = `https://${serverUrl}/api`;
@@ -26,50 +26,48 @@ export const appendQueryParams = (url, params) => {
     const queryString = existingSearchParams.toString();
     return queryString ? `${baseUrl}?${queryString}` : baseUrl;
 };
-export function constructRequestHeaders(url, modifiers, sessionId) {
-    // construct auth headers
+export function constructRequestHeaders(url, modifiers, sessionId // kept for API compatibility; ignored — always uses AsyncLocalStorage
+) {
+    // construct auth headers from async context (stateless: set per-request by the transport handler)
     let authHeaders = {};
-    if (!sessionId) {
-        // if no sessionId, we fall back to the api key in our environment variables
-        authHeaders = AUTH_HEADERS;
-    }
-    else {
-        // use sessionId to get auth
-        const auth = authStore.get(sessionId);
-        if (!auth) {
-            logger.error(`No auth found for sessionId: ${sessionId}`);
-            throw new Error(`No auth found for sessionId: ${sessionId}`);
-        }
-        if ("oauthToken" in auth) {
+    const contextAuth = requestAuthContext.getStore();
+    if (contextAuth) {
+        if ("oauthBearer" in contextAuth) {
+            // The Bearer is an opaque Rhombus access token issued by the Rhombus
+            // OAuth 2.1 authorization server. api2 validates it directly.
             authHeaders = {
-                Authorization: `Bearer ${auth.oauthToken}`,
+                "x-auth-access-token": contextAuth.oauthBearer,
                 "x-auth-scheme": "api-oauth-token",
             };
         }
-        else if ("apiKey" in auth) {
+        else if ("apiKey" in contextAuth) {
             authHeaders = {
-                "x-auth-apikey": auth.apiKey,
+                "x-auth-apikey": contextAuth.apiKey,
                 "x-auth-scheme": "api-token",
             };
         }
-        else if ("sessionId" in auth) {
+        else if ("sessionId" in contextAuth) {
             authHeaders = {
-                "x-auth-session": auth.sessionId,
-                "x-auth-chat": auth.latestRecordUuid,
+                "x-auth-session": contextAuth.sessionId,
+                "x-auth-chat": contextAuth.latestRecordUuid,
                 "x-auth-scheme": "chatbot",
             };
-            url = appendQueryParams(url, { _rs: auth.sessionId });
+            url = appendQueryParams(url, { _rs: contextAuth.sessionId });
         }
-        else if ("cookie" in auth) {
+        else if ("cookie" in contextAuth) {
             authHeaders = {
                 "x-auth-scheme": "web2",
-                cookie: auth.cookie,
+                cookie: contextAuth.cookie,
             };
-            if ("sessionAlias" in auth) {
-                url = appendQueryParams(url, { _rs: auth.sessionAlias });
+            if (contextAuth.sessionAlias) {
+                url = appendQueryParams(url, { _rs: contextAuth.sessionAlias });
             }
         }
     }
+    else {
+        // no async context — fall back to env API key (local dev / stdio)
+        authHeaders = AUTH_HEADERS;
+    }
     // merge headers
     const requestHeaders = {
         ...STATIC_HEADERS,

package/dist/tools-console/onguard-tool.js

@@ -0,0 +1,55 @@
+import { searchOnGuardEvents } from "../api/onguard-tool-api.js";
+import { OUTPUT_SCHEMA, TOOL_ARGS } from "../types/onguard-tool-types.js";
+import { createToolStructuredContent, extractFromToolExtra } from "../util.js";
+const TOOL_NAME = "onguard-events-tool";
+const TOOL_DESCRIPTION = `
+Searches Honeywell OnGuard (Lenel) badge / access-control events for the organization. Use this to answer
+"who entered WHERE and WHEN" questions, e.g. "who entered the back office yesterday".
+
+Each returned event includes:
+- cardholderName: the person's name
+- deviceUuid: the camera that saw the event
+- timestampMs / datetime: when it happened
+- label: e.g. "OnGuard: Badge Authorized" (a grant) or an anomaly label
+- badgeStatus, badgeType, areaEntering, areaExiting, entryMade, isAnomaly
+
+Filters (all optional): area, locationUuids, deviceUuids, cardholderQuery, badgeStatus, badgeType,
+anomalyOnly, entryMade, startTime, endTime, limit. Resolve relative times like "yesterday" to ISO 8601
+first (use the timestamp tool), then pass startTime/endTime.
+
+IMPORTANT — to show pictures and video of each person so the user can visually identify them: after this
+returns, for each event (or the most relevant ones) call the camera-tool (requestType "image",
+cameraUuid = the event's deviceUuid, timestamp = the event's time) to get a still you can see, and/or the
+clips-tool (requestType "createClip") with a short window around the timestamp for video. Issue those
+per-event media calls in PARALLEL.
+`;
+const TOOL_HANDLER = async (args, _extra) => {
+    const { requestModifiers, sessionId } = extractFromToolExtra(_extra);
+    try {
+        const result = await searchOnGuardEvents({
+            area: args.area ?? undefined,
+            locationUuids: args.locationUuids ?? undefined,
+            deviceUuids: args.deviceUuids ?? undefined,
+            cardholderQuery: args.cardholderQuery ?? undefined,
+            badgeStatus: args.badgeStatus ?? undefined,
+            badgeType: args.badgeType ?? undefined,
+            anomalyOnly: args.anomalyOnly ?? undefined,
+            entryMade: args.entryMade ?? undefined,
+            afterMs: args.startTime ? new Date(args.startTime).getTime() : undefined,
+            beforeMs: args.endTime ? new Date(args.endTime).getTime() : undefined,
+            limit: args.limit ?? undefined,
+        }, args.timeZone ?? "UTC", requestModifiers, sessionId);
+        return createToolStructuredContent(result);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : "Unknown error";
+        return createToolStructuredContent({ error: message });
+    }
+};
+export function createTool(server) {
+    server.registerTool(TOOL_NAME, {
+        description: TOOL_DESCRIPTION,
+        inputSchema: TOOL_ARGS,
+        outputSchema: OUTPUT_SCHEMA.shape,
+    }, TOOL_HANDLER);
+}

package/dist/transports/streamable-http.js

@@ -1,215 +1,188 @@
-import crypto from "node:crypto";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
-import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
 import cors from "cors";
 import express from "express";
-import { clearAccessibleAppsCache } from "../api/get-accessible-apps.js";
+import { requestAuthContext } from "../auth-context.js";
 import createServer from "../createServer.js";
 import { logger } from "../logger.js";
+// ---------------------------------------------------------------------------
+// x-auth-* header extraction (internal chatbot / API key clients) — UNCHANGED
+// ---------------------------------------------------------------------------
 var AuthScheme;
 (function (AuthScheme) {
-    AuthScheme["OAUTH"] = "oauth";
     AuthScheme["API_TOKEN"] = "api-token";
     AuthScheme["CHATBOT"] = "chatbot";
     AuthScheme["WEB2"] = "web2";
 })(AuthScheme || (AuthScheme = {}));
-export const authStore = new Map();
-const transports = new Map();
-/**
- * Populate authStore for the given sessionId based on the request headers.
- * Done up-front (before createServer) so resolveAccessibleApps can read auth
- * during tool registration. Returns true on success.
- */
-function populateAuthStore(req, sessionId) {
-    const oauthToken = req.headers["x-auth-access-token"];
-    const authScheme = req.headers["x-auth-scheme"] ?? AuthScheme.API_TOKEN;
-    if (oauthToken && typeof oauthToken === "string") {
-        authStore.set(sessionId, { oauthToken, createdMs: Date.now() });
-        logger.info(`🔒 MCP request authenticated with oauth token (session ${sessionId})`);
-        return true;
+function extractAuth(req) {
+    const scheme = req.headers["x-auth-scheme"] ?? AuthScheme.API_TOKEN;
+    if (scheme === AuthScheme.API_TOKEN) {
+        const apiKey = req.headers["x-auth-apikey"] ?? process.env.RHOMBUS_API_KEY;
+        if (!apiKey)
+            return null;
+        return { apiKey };
     }
-    if (authScheme === AuthScheme.API_TOKEN) {
-        const apiKey = "x-auth-apikey" in req.headers
-            ? req.headers["x-auth-apikey"]
-            : process.env.RHOMBUS_API_KEY;
-        if (!apiKey) {
-            logger.warn("populateAuthStore: API_TOKEN scheme but no api key found");
-            return false;
-        }
-        logger.info(`🔒 MCP request authenticated with api key (session ${sessionId})`);
-        authStore.set(sessionId, { apiKey, createdMs: Date.now() });
-        return true;
+    if (scheme === AuthScheme.CHATBOT) {
+        const sessionId = req.headers["x-auth-session"];
+        const latestRecordUuid = req.headers["x-auth-chat"];
+        if (!sessionId || !latestRecordUuid)
+            return null;
+        return { sessionId, latestRecordUuid };
     }
-    if (authScheme === AuthScheme.CHATBOT &&
-        "x-auth-session" in req.headers &&
-        "x-auth-chat" in req.headers) {
-        logger.info(`🔒 MCP request authenticated with x-auth-session: ${req.headers["x-auth-session"]} and x-auth-chat: ${req.headers["x-auth-chat"]}`);
-        authStore.set(sessionId, {
-            sessionId: req.headers["x-auth-session"],
-            latestRecordUuid: req.headers["x-auth-chat"],
-            createdMs: Date.now(),
-        });
-        return true;
+    if (scheme === AuthScheme.WEB2) {
+        const cookie = req.headers["x-auth-cookie"];
+        if (!cookie)
+            return null;
+        return { cookie, sessionAlias: req.headers["x-auth-session-alias"] };
     }
-    if (authScheme === AuthScheme.WEB2 && "x-auth-cookie" in req.headers) {
-        logger.info(`🔒 MCP request authenticated with x-auth-cookie (session ${sessionId})`);
-        authStore.set(sessionId, {
-            cookie: req.headers["x-auth-cookie"],
-            sessionAlias: req.headers["x-auth-session-alias"],
-            createdMs: Date.now(),
-        });
-        return true;
-    }
-    logger.warn(`populateAuthStore: invalid auth scheme. x-auth-scheme: ${req.headers["x-auth-scheme"]}, x-auth-session: ${req.headers["x-auth-session"]}, x-auth-chat: ${req.headers["x-auth-chat"]}`);
-    return false;
+    return null;
 }
+// ---------------------------------------------------------------------------
+// Transport
+//
+// Pure RFC 9728 OAuth 2.1 Resource Server. The Rhombus authorization server
+// (RFC 8414 issuer) is configured via OAUTH_AS_ISSUER_URL — e.g. set it to
+// the Rhombus auth host whose /.well-known/oauth-authorization-server
+// document advertises /authorize, /token, /register, /revoke per
+// RFC 6749 + 7636 + 7591 + 7009.
+//
+// The AS issues opaque Rhombus access tokens, so the MCP server does no
+// local validation — it just forwards the Bearer to api2 as
+// x-auth-access-token, which api2 already knows how to validate.
+//
+// The legacy x-auth-* dispatch for internal callers (chatbot, API-key, web2)
+// is unchanged.
+// ---------------------------------------------------------------------------
 export default function streamableHttpTransport() {
     const app = express();
     app.use(express.json());
+    const oauthAsIssuerUrl = process.env.OAUTH_AS_ISSUER_URL;
+    const mcpServerUrl = process.env.MCP_SERVER_URL;
+    const allowedHost = process.env.ALLOWED_HOST;
+    const allowedHosts = allowedHost
+        ? allowedHost
+            .split(",")
+            .map(h => h.trim())
+            .filter(Boolean)
+        : [];
     app.use(cors({
-        // TODO: domain
         origin: ["*"],
         exposedHeaders: ["mcp-session-id"],
-        allowedHeaders: ["Content-Type", "mcp-session-id"],
+        allowedHeaders: [
+            "Content-Type",
+            "Authorization",
+            "mcp-session-id",
+            "x-auth-scheme",
+            "x-auth-apikey",
+            "x-auth-session",
+            "x-auth-chat",
+            "x-auth-cookie",
+            "x-auth-session-alias",
+        ],
     }));
-    /**
-     * STATEFUL ENDPOINT
-     */
-    app.post("/mcp", async (req, res) => {
-        logger.info(`Received MCP request`, JSON.stringify(req.body, null, 2));
-        // Check for existing session ID
-        const sessionId = req.headers["mcp-session-id"];
-        let transport;
-        if (sessionId && transports.has(sessionId)) {
-            // Reuse existing transport
-            const _transport = transports.get(sessionId);
-            if (!_transport) {
-                throw new Error(`Transport not found for sessionId: ${sessionId}`);
-            }
-            transport = _transport;
+    app.get("/health", (_, res) => {
+        res.status(200).json({ status: "ok" });
+    });
+    if (oauthAsIssuerUrl) {
+        logger.info(`OAuth Resource Server — AS at ${oauthAsIssuerUrl}`);
+    }
+    else {
+        logger.info("OAUTH_AS_ISSUER_URL not set — Bearer tokens will be rejected. Set this to the Rhombus authorization server issuer URL (e.g. https://auth-web.<env>.rhombussystems.com/).");
+    }
+    // RFC 9728 — Protected Resource Metadata. Points clients at the Rhombus AS.
+    // Preserves the issuer URL verbatim so the value matches the `issuer` field
+    // strict OAuth clients (Claude Desktop, etc.) read from the AS metadata.
+    app.get("/.well-known/oauth-protected-resource", (req, res) => {
+        if (!oauthAsIssuerUrl) {
+            res.status(404).json({ error: "oauth_not_configured" });
+            return;
         }
-        else if (!sessionId && isInitializeRequest(req.body)) {
-            // New initialization request — mint our sessionId up front so we can
-            // populate authStore and gate tool registration BEFORE the SDK calls
-            // onsessioninitialized.
-            const newSessionId = crypto.randomUUID();
-            const authOk = populateAuthStore(req, newSessionId);
-            // Reject the initialize itself when auth couldn't be populated. Letting
-            // the session through without an authStore entry only defers the failure:
-            // any later /customer/getCurrentUser (during tool registration) or tool
-            // call will throw "No auth found for sessionId" from network.ts, which
-            // is harder to diagnose than an upfront 401 here.
-            if (!authOk) {
-                logger.error(`Auth could not be populated for ${req.body.method}; rejecting`);
-                res
-                    .status(401)
-                    .setHeader("WWW-Authenticate", `Bearer realm="${process.env.REALM}", error="invalid_token", error_description="The access token is missing or invalid"`)
-                    .send("Unauthorized");
-                return;
+        res.json({
+            resource: mcpServerUrl ?? `${getSelfOrigin(req, mcpServerUrl)}/mcp`,
+            authorization_servers: [oauthAsIssuerUrl],
+            scopes_supported: ["rhombus:access"],
+            bearer_methods_supported: ["header"],
+        });
+    });
+    const handleMcpRequest = async (req, res) => {
+        logger.info("Received MCP request");
+        let auth = null;
+        const authHeader = req.headers.authorization;
+        if (authHeader?.startsWith("Bearer ")) {
+            if (!oauthAsIssuerUrl) {
+                return reject401(req, res, mcpServerUrl, "OAuth not configured: set OAUTH_AS_ISSUER_URL");
             }
-            transport = new StreamableHTTPServerTransport({
-                sessionIdGenerator: () => newSessionId,
-                onsessioninitialized: sessionId => {
-                    transports.set(sessionId, transport);
-                    logger.info(`🔒 MCP request initialized with sessionId: ${sessionId}`);
-                },
-                // DNS rebinding protection is disabled by default for backwards compatibility. If you are running this server
-                // locally, make sure to set:
-                // enableDnsRebindingProtection: true,
-                // allowedHosts: ['127.0.0.1'],
-            });
-            // Clean up transport when closed
-            transport.onclose = () => {
-                if (transport.sessionId) {
-                    transports.delete(transport.sessionId);
-                    authStore.delete(transport.sessionId);
-                    clearAccessibleAppsCache(transport.sessionId);
-                }
-            };
-            // newSessionId is already in authStore; createServer can resolve
-            // accessibleRhombusApps and pick the right tool set.
-            const server = await createServer({ sessionId: newSessionId });
-            // Connect to the MCP server
-            await server.connect(transport);
-            logger.info(`🔗 Transport connected with sessionId: ${newSessionId}`);
+            const token = authHeader.slice(7).trim();
+            if (!token) {
+                return reject401(req, res, mcpServerUrl, "empty Bearer token");
+            }
+            auth = { oauthBearer: token };
+            logger.info("MCP request authenticated via Bearer (opaque, forwarded to api2)");
         }
         else {
-            // Invalid request
-            res.status(400).json({
-                jsonrpc: "2.0",
-                error: {
-                    code: -32000,
-                    message: "Bad Request: No valid session ID provided",
-                },
-                id: null,
-            });
-            return;
+            auth = extractAuth(req);
+            if (!auth) {
+                return reject401(req, res, mcpServerUrl, "no credentials presented");
+            }
+            logger.info("MCP request authenticated via x-auth-* headers");
         }
-        await transport.handleRequest(req, res, req.body);
-    });
-    app.get("/mcp", async (_, res) => {
-        logger.warn("Received Not Allowed GET MCP request");
-        res.writeHead(405).end(JSON.stringify({
-            jsonrpc: "2.0",
-            error: {
-                code: -32000,
-                message: "Method not allowed.",
-            },
-            id: null,
-        }));
-    });
-    app.delete("/mcp", async (req, res) => {
-        logger.warn("Received Not Allowed DELETE MCP request");
-        res.writeHead(405).end(JSON.stringify({
-            jsonrpc: "2.0",
-            error: {
-                code: -32000,
-                message: "Method not allowed.",
-            },
-            id: null,
-        }));
-    });
-    /**
-     * STATELESS ENDPOINT
-     */
-    app.post("/mcp-stateless", async (req, res) => {
-        logger.info(`Received stateless MCP request`, req.body);
-        let transport;
-        transport = new StreamableHTTPServerTransport({
-            sessionIdGenerator: undefined,
+        await requestAuthContext.run(auth, async () => {
+            const transport = new StreamableHTTPServerTransport({
+                sessionIdGenerator: undefined,
+                ...(allowedHosts.length > 0 ? { enableDnsRebindingProtection: true, allowedHosts } : {}),
+            });
+            const server = await createServer();
+            await server.connect(transport);
+            logger.info("🔗 Stateless MCP Transport connected");
+            await transport.handleRequest(req, res, req.body);
         });
-        const server = await createServer();
-        // Connect to the MCP server
-        await server.connect(transport);
-        logger.info(`🔗 Stateless Transport connected`);
-        // Handle the request
-        await transport.handleRequest(req, res, req.body);
-    });
-    app.get("/mcp-stateless", async (req, res) => {
-        logger.warn("Received Not Allowed GET MCP request");
+    };
+    app.post("/mcp", handleMcpRequest);
+    app.get("/mcp", (_, res) => {
         res.writeHead(405).end(JSON.stringify({
             jsonrpc: "2.0",
-            error: {
-                code: -32000,
-                message: "Method not allowed.",
-            },
+            error: { code: -32000, message: "Method not allowed." },
             id: null,
         }));
     });
-    app.delete("/mcp-stateless", async (req, res) => {
-        logger.warn("Received Not Allowed DELETE MCP request");
+    app.delete("/mcp", (_, res) => {
         res.writeHead(405).end(JSON.stringify({
             jsonrpc: "2.0",
-            error: {
-                code: -32000,
-                message: "Method not allowed.",
-            },
+            error: { code: -32000, message: "Method not allowed." },
             id: null,
         }));
     });
-    // Start the server
-    const PORT = process.env.PORT || 3000;
+    const PORT = process.env.PORT ?? 3000;
     app.listen(PORT, () => {
         logger.info(`rhombus-node-mcp listening on port ${PORT}`);
     });
 }
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function reject401(req, res, mcpServerUrl, msg) {
+    const resourceMetadataUrl = `${getSelfOrigin(req, mcpServerUrl)}/.well-known/oauth-protected-resource`;
+    res
+        .status(401)
+        .set("WWW-Authenticate", `Bearer error="invalid_token", error_description="${escapeWwwAuth(msg)}", resource_metadata="${resourceMetadataUrl}"`)
+        .json({
+        jsonrpc: "2.0",
+        error: { code: -32000, message: `Unauthorized: ${msg}` },
+        id: null,
+    });
+}
+function getSelfOrigin(req, mcpServerUrl) {
+    if (mcpServerUrl) {
+        try {
+            return new URL(mcpServerUrl).origin;
+        }
+        catch {
+            // fall through
+        }
+    }
+    const proto = req.headers["x-forwarded-proto"] ?? req.protocol;
+    const host = req.headers.host ?? "localhost";
+    return `${proto}://${host}`;
+}
+function escapeWwwAuth(s) {
+    return s.replace(/["\r\n]/g, "");
+}

package/dist/types/onguard-tool-types.js

@@ -0,0 +1,70 @@
+import { z } from "zod";
+import { createUuidSchema } from "../types.js";
+import { ISOTimestampFormatDescription } from "../utils/timestampInput.js";
+export const TOOL_ARGS = {
+    area: z
+        .string()
+        .nullable()
+        .describe('Filter to events whose entered area matches this, e.g. "back office". Full-text match.'),
+    locationUuids: z
+        .array(createUuidSchema())
+        .nullable()
+        .describe("Filter to these Rhombus location UUIDs. Use the location-tool to resolve names to UUIDs."),
+    deviceUuids: z
+        .array(createUuidSchema())
+        .nullable()
+        .describe("Filter to these camera UUIDs (the camera that saw the badge event)."),
+    cardholderQuery: z
+        .string()
+        .nullable()
+        .describe("Match the cardholder's name (full-text), e.g. a person you are looking for."),
+    badgeStatus: z.string().nullable().describe("Filter by badge status, e.g. Active or Lost."),
+    badgeType: z.string().nullable().describe("Filter by badge type."),
+    anomalyOnly: z
+        .boolean()
+        .nullable()
+        .describe("Only return anomaly events: an inactive/lost badge was used, or access was granted but no entry was made (possible tailgating)."),
+    entryMade: z
+        .boolean()
+        .nullable()
+        .describe("Filter by whether access was granted AND entry was actually made."),
+    startTime: z
+        .string()
+        .datetime({ message: "Invalid datetime string. Expected ISO 8601 format.", offset: true })
+        .nullable()
+        .describe("Only events at or after this time (inclusive). " + ISOTimestampFormatDescription),
+    endTime: z
+        .string()
+        .datetime({ message: "Invalid datetime string. Expected ISO 8601 format.", offset: true })
+        .nullable()
+        .describe("Only events at or before this time (inclusive). " + ISOTimestampFormatDescription),
+    limit: z
+        .number()
+        .nullable()
+        .describe("Maximum number of events to return (default 200; the server caps at 1000)."),
+    timeZone: z
+        .string()
+        .nullable()
+        .describe("IANA timezone used to format event times, e.g. America/New_York. Defaults to UTC."),
+};
+const TOOL_ARGS_SCHEMA = z.object(TOOL_ARGS);
+export const OnGuardEventSchema = z.object({
+    timestampMs: z.number().optional(),
+    datetime: z.string().optional().describe("Human-readable event time in the requested timezone."),
+    deviceUuid: z
+        .string()
+        .optional()
+        .describe("The camera that saw this event. Pass to camera-tool (requestType image) or clips-tool (createClip) to get a still/video."),
+    label: z.string().optional().describe('Event label, e.g. "OnGuard: Badge Authorized" or an anomaly label.'),
+    cardholderName: z.string().optional().describe("The cardholder (person) name."),
+    badgeStatus: z.string().optional(),
+    badgeType: z.string().optional(),
+    areaEntering: z.string().optional(),
+    areaExiting: z.string().optional(),
+    entryMade: z.boolean().optional(),
+    isAnomaly: z.boolean().optional().describe("True if this is an alerting/anomalous event."),
+});
+export const OUTPUT_SCHEMA = z.object({
+    events: z.array(OnGuardEventSchema).optional(),
+    error: z.string().optional(),
+});

package/dist/types/zod-schemas.js

@@ -5855,6 +5855,12 @@ const Camera_GetCustomFootageSeekpointsV2WSRequest = z.object({
 });
 const SeekpointType = z.string();
 const SeekpointIndexType = z.object({
+    alert: z.boolean().optional(),
+    areaEntering: z.string().optional(),
+    areaExiting: z.string().optional(),
+    badgeStatus: z.string().optional(),
+    badgeType: z.string().optional(),
+    entryMade: z.boolean().optional(),
     compositComponentUuid: z.string().optional(),
     customDescription: z.string().optional(),
     customDisplayName: z.string().optional(),
@@ -10818,6 +10824,25 @@ const Eventsearch_GetEventSeekpointsWSResponse = z.object({
     errorMsg: z.string().optional(),
     warningMsg: z.string().optional()
 });
+const Eventsearch_SearchOnGuardEventsWSRequest = z.object({
+    afterMs: z.number().int().optional(),
+    anomalyOnly: z.boolean().optional(),
+    area: z.string().optional(),
+    badgeStatus: z.string().optional(),
+    badgeType: z.string().optional(),
+    beforeMs: z.number().int().optional(),
+    cardholderQuery: z.string().optional(),
+    deviceUuids: z.array(z.string()).optional(),
+    entryMade: z.boolean().optional(),
+    limit: z.number().int().optional(),
+    locationUuids: z.array(z.string()).optional()
+});
+const Eventsearch_SearchOnGuardEventsWSResponse = z.object({
+    error: z.boolean().optional(),
+    errorMsg: z.string().optional(),
+    events: z.array(SeekpointIndexType).optional(),
+    warningMsg: z.string().optional()
+});
 const Export_ExportAuditEventsWSRequest = z.object({
     endInterval: z.number().int().optional(),
     excludeActions: z.array(z.string()).optional(),
@@ -21985,6 +22010,8 @@ export const schemas = {
     Eventsearch_VideoFootageWSRequest,
     Eventsearch_GetEventSeekpointsWSRequest,
     Eventsearch_GetEventSeekpointsWSResponse,
+    Eventsearch_SearchOnGuardEventsWSRequest,
+    Eventsearch_SearchOnGuardEventsWSResponse,
     Export_ExportAuditEventsWSRequest,
     Export_ExportClimateEventsWSRequest,
     Export_ExportCountReportsWSRequest,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rhombus-node-mcp",
-  "version": "0.1.36",
+  "version": "0.1.44",
   "description": "MCP server for Rhombus API",
   "keywords": [
     "ai",
@@ -56,9 +56,7 @@
     "cors": "^2.8.5",
     "dotenv": "^16.5.0",
     "express": "^5.1.0",
-    "express-jwt": "^8.5.1",
     "faiss-node": "^0.5.1",
-    "jsonwebtoken": "^9.0.2",
     "langchain": "^0.3.30",
     "log4js": "^6.9.1",
     "luxon": "^3.6.1",
@@ -69,7 +67,6 @@
   "devDependencies": {
     "@types/cors": "^2.8.19",
     "@types/express": "^5.0.3",
-    "@types/jwt-express": "^1.1.6",
     "@types/luxon": "^3.6.2",
     "@types/node": "^22.14.0",
     "openapi-typescript-codegen": "^0.29.0",