rhombus-node-mcp 0.1.46 → 0.1.48

package/dist/api/get-accessible-apps.js

@@ -1,16 +1,13 @@
 import { logger } from "../logger.js";
 import { postApi } from "../network/network.js";
 /**
- * Fetches `user.accessibleRhombusApps` from getCurrentUser for the given session.
- * Successful results are cached in-memory for the lifetime of the session;
- * failures are NOT cached so transient errors don't poison the session.
- * Returns null on error or missing session; callers should fall back to a
- * permissive default.
+ * Single cached `getCurrentUser` fetch per session. Both `resolveAccessibleApps`
+ * and `resolveSessionIdentity` read from this cache, so identity for tracing
+ * costs no extra API call. Successful results are cached for the lifetime of
+ * the session; failures are NOT cached so transient errors don't poison it.
  */
 const cache = new Map();
-export async function resolveAccessibleApps(sessionId) {
-    if (!sessionId)
-        return null;
+async function fetchSession(sessionId) {
     const cached = cache.get(sessionId);
     if (cached !== undefined)
         return cached;
@@ -24,16 +21,43 @@ export async function resolveAccessibleApps(sessionId) {
             logger.warn(`resolveAccessibleApps: getCurrentUser failed for session ${sessionId}`);
             return null;
         }
-        const apps = (res.user?.accessibleRhombusApps ?? []).filter((a) => a !== null && a !== undefined);
-        cache.set(sessionId, apps);
+        const user = res.user;
+        const apps = (user?.accessibleRhombusApps ?? []).filter((a) => a !== null && a !== undefined);
+        const identity = {
+            userId: user?.uuid ?? user?.rhombusUserUuid ?? undefined,
+            orgUuid: user?.orgUuid ?? undefined,
+            email: user?.email ?? undefined,
+        };
+        const entry = { apps, identity };
+        cache.set(sessionId, entry);
         logger.info(`resolveAccessibleApps: session ${sessionId} -> [${apps.join(", ")}]`);
-        return apps;
+        return entry;
     }
     catch (e) {
         logger.warn(`resolveAccessibleApps: error for session ${sessionId}: ${String(e)}`);
         return null;
     }
 }
+/**
+ * Fetches `user.accessibleRhombusApps` from getCurrentUser for the given session.
+ * Returns null on error or missing session; callers should fall back to a
+ * permissive default.
+ */
+export async function resolveAccessibleApps(sessionId) {
+    if (!sessionId)
+        return null;
+    return (await fetchSession(sessionId))?.apps ?? null;
+}
+/**
+ * Fetches identity (user uuid, org uuid, email) from getCurrentUser for the
+ * given session, reusing the same cached response as `resolveAccessibleApps`.
+ * Returns null on error or missing session.
+ */
+export async function resolveSessionIdentity(sessionId) {
+    if (!sessionId)
+        return null;
+    return (await fetchSession(sessionId))?.identity ?? null;
+}
 /** Drop the cached entry — call when a session ends. */
 export function clearAccessibleAppsCache(sessionId) {
     cache.delete(sessionId);

package/dist/createServer.js

@@ -1,5 +1,6 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import path from "path";
+import { createTracingProxy } from "./telemetry/tracingProxy.js";
 import { resolveAccessibleApps } from "./api/get-accessible-apps.js";
 import { logger } from "./logger.js";
 import { createFilteringProxy } from "./util.js";
@@ -105,7 +106,10 @@ export default async function createServer({ sessionId } = {}) {
     const toolsToRegister = pickToolsForSession(apps);
     logDevToolRegistration(sessionId, apps, toolsToRegister);
     logger.info(`🔒 Session ${sessionId ?? "(none)"}: apps=[${apps?.join(", ") ?? "unknown"}] — registering ${toolsToRegister.length} tools`);
-    const filteredServer = createFilteringProxy(server, new Set(["time-tool", "count-tool", "time-conversion-tool"]));
+    // Tracing wraps every tool handler; filtering wraps on top so handlers are
+    // timed after includeFields/filterBy are stripped (keeping them out of
+    // mcp.tool.arg_keys). Spans are no-ops unless a host registers an OTel SDK.
+    const filteredServer = createFilteringProxy(createTracingProxy(server), new Set(["time-tool", "count-tool", "time-conversion-tool"]));
     for (const tool of toolsToRegister) {
         try {
             await tool.create(filteredServer);

package/dist/telemetry/tracingProxy.js

@@ -0,0 +1,106 @@
+import { SpanStatusCode, trace } from "@opentelemetry/api";
+import { resolveSessionIdentity } from "../api/get-accessible-apps.js";
+import { logger } from "../logger.js";
+import { extractFromToolExtra } from "../util.js";
+const TRACER_NAME = "rhombus-node-mcp";
+const TOOL_CALL_SPAN = "mcp.tool.call";
+function setArgKeys(span, args) {
+    if (args && typeof args === "object") {
+        const keys = Object.keys(args);
+        span.setAttribute("mcp.tool.arg_keys", keys.join(","));
+        const requestType = args.requestType;
+        if (typeof requestType === "string") {
+            span.setAttribute("mcp.tool.request_type", requestType);
+        }
+    }
+}
+async function attachSessionIdentity(span, extra) {
+    try {
+        const { sessionId } = extractFromToolExtra(extra);
+        if (!sessionId)
+            return;
+        span.setAttribute("mcp.session.id", sessionId);
+        const identity = await resolveSessionIdentity(sessionId);
+        if (identity?.userId)
+            span.setAttribute("enduser.id", identity.userId);
+        if (identity?.orgUuid)
+            span.setAttribute("mcp.org.uuid", identity.orgUuid);
+    }
+    catch (error) {
+        logger.debug(`tracing: attachSessionIdentity failed: ${String(error)}`);
+    }
+}
+/** Wrap a tool handler so each invocation emits an `mcp.tool.call` span. */
+function wrapHandler(toolName, handler) {
+    return async (args, extra) => {
+        const tracer = trace.getTracer(TRACER_NAME);
+        return tracer.startActiveSpan(TOOL_CALL_SPAN, async (span) => {
+            const start = Date.now();
+            span.setAttribute("mcp.tool.name", toolName);
+            span.setAttribute("mcp.transport", process.env.TRANSPORT_TYPE ?? "stdio");
+            setArgKeys(span, args);
+            try {
+                await attachSessionIdentity(span, extra);
+                const result = await handler(args, extra);
+                const isError = result && typeof result === "object" && result.isError;
+                span.setAttribute("mcp.tool.success", !isError);
+                if (isError) {
+                    span.setStatus({
+                        code: SpanStatusCode.ERROR,
+                        message: "tool returned isError",
+                    });
+                }
+                return result;
+            }
+            catch (error) {
+                span.setAttribute("mcp.tool.success", false);
+                span.recordException(error instanceof Error ? error : new Error(String(error)));
+                span.setStatus({
+                    code: SpanStatusCode.ERROR,
+                    message: error instanceof Error ? error.message : String(error),
+                });
+                throw error;
+            }
+            finally {
+                span.setAttribute("mcp.tool.duration_ms", Date.now() - start);
+            }
+        });
+    };
+}
+/**
+ * Returns a Proxy over an `McpServer` that wraps every tool handler with an
+ * OpenTelemetry span. Both registration methods are intercepted: `registerTool`
+ * (most tools) and the legacy `tool` (a handful, including the
+ * filtering-blacklisted ones), so coverage is complete.
+ *
+ * Uses only `@opentelemetry/api` — spans are no-ops unless a host process (e.g.
+ * Rhombus EB deploy with `otel-init.mjs`) registers a tracer provider.
+ *
+ * Compose it *inside* the filtering proxy —
+ * `createFilteringProxy(createTracingProxy(server))` — so handlers are traced
+ * after filtering strips `includeFields`/`filterBy`, keeping those synthetic
+ * args out of `mcp.tool.arg_keys`.
+ */
+export function createTracingProxy(server) {
+    return new Proxy(server, {
+        get(target, prop, receiver) {
+            if (prop === "registerTool") {
+                // biome-ignore lint/suspicious/noExplicitAny: proxy intercept
+                return (name, config, handler) => target.registerTool(name, config, wrapHandler(name, handler));
+            }
+            if (prop === "tool") {
+                // Legacy signature: tool(name, [description], [paramsSchema], [annotations], handler).
+                // biome-ignore lint/suspicious/noExplicitAny: proxy intercept
+                return (...toolArgs) => {
+                    const name = toolArgs[0];
+                    const lastIdx = toolArgs.length - 1;
+                    if (typeof toolArgs[lastIdx] === "function") {
+                        toolArgs[lastIdx] = wrapHandler(name, toolArgs[lastIdx]);
+                    }
+                    return target.tool(...toolArgs);
+                };
+            }
+            return Reflect.get(target, prop, receiver);
+        },
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rhombus-node-mcp",
-  "version": "0.1.46",
+  "version": "0.1.48",
   "description": "MCP server for Rhombus API",
   "keywords": [
     "ai",
@@ -50,6 +50,7 @@
   ],
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.27.1",
+    "@opentelemetry/api": "^1.9.0",
     "axios": "^1.11.0",
     "cheerio": "^1.1.2",
     "chrono-node": "^2.8.0",