robodev 0.51.1 → 0.52.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "robodev",
-  "version": "0.51.1",
+  "version": "0.52.0",
   "description": "CLI for Robodev Starbase — create, auth, link, deploy, load, and run a project locally with robodev dev",
   "type": "module",
   "license": "MIT",
@@ -26,8 +26,8 @@
     "embedded-postgres": "17.10.0-beta.17",
     "fastify": "^5.12.1",
     "tsx": "^4.20.5",
-    "@robodev-ai/sdk": "0.15.1",
-    "@robodev-ai/runtime": "0.11.1"
+    "@robodev-ai/runtime": "0.12.0",
+    "@robodev-ai/sdk": "0.16.0"
   },
   "devDependencies": {
     "@types/node": "^24.3.0",

package/src/collect-files.ts

@@ -149,7 +149,8 @@ function isBackendPath(path: string): boolean {
     inner.startsWith("api/") ||
     inner.startsWith("jobs/") ||
     inner.startsWith("hooks/") ||
-    inner.startsWith("sockets/")
+    inner.startsWith("sockets/") ||
+    inner.startsWith("mcp/")
   ) {
     return inner.endsWith(".ts") && !isBackendTestPath(inner);
   }
@@ -175,13 +176,18 @@ export function mixedBackendLayoutError(paths: Iterable<string>): string | null
   const hasNewDb = list.includes("robodev/database.ts");
   const hasLegacyDb = list.includes("database.ts");
   const hasLegacyApiJobs = list.some(
-    (path) => path.startsWith("api/") || path.startsWith("jobs/") || path.startsWith("sockets/"),
+    (path) =>
+      path.startsWith("api/") ||
+      path.startsWith("jobs/") ||
+      path.startsWith("sockets/") ||
+      path.startsWith("mcp/"),
   );
   const hasNewApiJobs = list.some(
     (path) =>
       path.startsWith("robodev/api/") ||
       path.startsWith("robodev/jobs/") ||
-      path.startsWith("robodev/sockets/"),
+      path.startsWith("robodev/sockets/") ||
+      path.startsWith("robodev/mcp/"),
   );
   if (hasNewDb && (hasLegacyDb || hasLegacyApiJobs)) {
     return "Do not mix robodev/ backend files with root database.ts, api/, or jobs/";

package/src/dev-inspect.test.ts

@@ -429,3 +429,18 @@ test("pdf inspect records byte length and format, not HTML text", () => {
   assert.equal(event.error, "pdf_failed");
   assert.equal(JSON.stringify(event).includes("secret invoice"), false);
 });
+
+test("dashboard links the MCP endpoint only when the project has tools", async () => {
+  const runtime = {
+    routes: [{ method: "get", path: "/api/planets", file: "api/planets.ts" }],
+    jobs: [],
+  };
+  const without = await buildDashboardState({ inspect: createDevInspect(), runtime });
+  assert.equal(without.overview.links.mcp, undefined);
+  const withTools = await buildDashboardState({
+    inspect: createDevInspect(),
+    runtime: { ...runtime, mcpTools: [{ name: "get_planets" }] },
+  });
+  assert.equal(withTools.overview.links.mcp, "/_robodev/mcp");
+  assert.equal(isHistogramExcludedPath("/_robodev/mcp"), true);
+});

package/src/dev-inspect.ts

@@ -42,6 +42,7 @@ const HISTOGRAM_EXCLUDED_PATHS = new Set([
   "/openapi.json",
   "/robodev-enterprise-spec.json",
   "/_robodev/ready",
+  "/_robodev/mcp",
 ]);
 
 export const RESERVED_AUTH_ROUTES: Array<{ method: string; path: string; file: string }> = [
@@ -214,7 +215,14 @@ export type DashboardState = {
     google: DashboardGoogle;
     requestHistogram: RequestHistogramBucket[];
     jobHistogram: JobHistogramBucket[];
-    links: { swagger: string; scalar: string; openapi: string; enterprise: string };
+    links: {
+      swagger: string;
+      scalar: string;
+      openapi: string;
+      enterprise: string;
+      /** Present when the project has MCP tools. */
+      mcp?: string;
+    };
   };
   routes: Array<{ method: string; path: string; file: string }>;
   calls: Array<{ at: number; method: string; path: string; status: number; durationMs: number }>;
@@ -246,6 +254,7 @@ export type DashboardRuntime = {
   routes: Array<{ method: string; path: string; file: string }>;
   jobs: Array<{ name: string; file: string; def: { cron?: string } }>;
   sockets?: Array<{ name: string; path: string; file: string; def: { auth?: ApiAuth } }>;
+  mcpTools?: Array<{ name: string }>;
   pool?: {
     query: <R extends Record<string, unknown> = Record<string, unknown>>(
       sql: string,
@@ -602,6 +611,7 @@ export async function buildDashboardState(input: {
         scalar: "/_robodev/scalar",
         openapi: "/openapi.json",
         enterprise: "/robodev-enterprise-spec.json",
+        ...(input.runtime?.mcpTools?.length ? { mcp: "/_robodev/mcp" } : {}),
       },
     },
     routes,
@@ -1076,6 +1086,9 @@ export function inspectHtml(): string {
           { href: state.overview.links.openapi, label: "openapi.json" },
           { href: state.overview.links.enterprise, label: "Enterprise spec" }
         ];
+        if (state.overview.links.mcp) {
+          items.push({ href: state.overview.links.mcp, label: "MCP (POST)" });
+        }
         for (var i = 0; i < items.length; i++) {
           var a = document.createElement("a");
           a.href = items[i].href;

package/src/dev-project.ts

@@ -7,14 +7,14 @@ export type DevFile = { path: string; content: string };
 export type DevProject = {
   /** Where `.robodev/dev/` and the root `package.json` live. */
   root: string;
-  /** Absolute directory holding `database.ts` plus `api/`, `jobs/`, `hooks/`, `sockets/`. */
+  /** Absolute directory holding `database.ts` plus `api/`, `jobs/`, `hooks/`, `sockets/`, `mcp/`. */
   backendDir: string;
   /** Backend layout that was matched, for the startup banner. */
   layout: "root" | "robodev" | "packages/be";
 };
 
 /** Directories under the backend root that hold compilable project code. */
-export const BACKEND_DIRS = ["api", "jobs", "hooks", "sockets"] as const;
+export const BACKEND_DIRS = ["api", "jobs", "hooks", "sockets", "mcp"] as const;
 
 const SKIP_DIRS = new Set(["node_modules", "dist", ".git", ".robodev"]);
 const MAX_BACKEND_FILES = 400;

package/src/dev-server.ts

@@ -1,3 +1,4 @@
+import { createHash } from "node:crypto";
 import { Readable } from "node:stream";
 import cors from "@fastify/cors";
 import websocket from "@fastify/websocket";
@@ -13,7 +14,25 @@ import {
   buildOpenApi,
   buildEnterpriseSpec,
   handleLocalAuth,
+  handleProjectMcpHttp,
+  handleProjectOAuth,
   isLocalAuthPath,
+  isProjectMcpPath,
+  isProjectOAuthRequestPath,
+  localPasswordSignIn,
+  localPasswordSignUp,
+  authenticateProjectMcpToken,
+  isProjectMcpAccessToken,
+  projectGoogleOverrideMode,
+  projectMcpResource,
+  revokeRefresh,
+  runMcpOp,
+  runtimeVersion,
+  verifyProjectUserToken,
+  type McpCaller,
+  type OAuthHttpResponse,
+  type ProjectMcpHttpResponse,
+  type RuntimeMcpTool,
   isReservedStoragePath,
   ENTERPRISE_SPEC_PATH,
   matchProjectRoute,
@@ -53,6 +72,7 @@ export type DevRuntime = {
   routes: RuntimeRoute[];
   jobs: RuntimeJob[];
   sockets: RuntimeSocket[];
+  mcpTools: RuntimeMcpTool[];
   openapi: Record<string, unknown>;
 };
 
@@ -70,13 +90,76 @@ export type DevServerOptions = {
   googleClientSecret?: string;
   storageDir: string;
   projectRoot?: string;
+  /** Shown on the MCP consent page and as the MCP server name. */
+  projectName?: string;
 };
 
 const SWAGGER_PATHS = new Set(["/_robodev/docs", "/_robodev/swagger", "/docs", "/swagger"]);
 const SCALAR_PATHS = new Set(["/_robodev/scalar", "/scalar"]);
 
-export function buildDevOpenApi(projectName: string, routes: RuntimeRoute[]) {
-  return buildOpenApi({ title: `${projectName} APIs`, projectId: "local", routes });
+export function buildDevOpenApi(
+  projectName: string,
+  routes: RuntimeRoute[],
+  mcpTools: RuntimeMcpTool[] = [],
+) {
+  return buildOpenApi({ title: `${projectName} APIs`, projectId: "local", routes, mcpTools });
+}
+
+/** The URL MCP clients connect to, printed in the banner. */
+export function devMcpUrl(listenOrigin: string): string {
+  return `${listenOrigin}/_robodev/mcp`;
+}
+
+function devOAuthSecret(options: DevServerOptions): string {
+  return createHash("sha256")
+    .update(`${options.jwtSecret}:${options.projectId}:project-mcp-oauth`)
+    .digest("base64url");
+}
+
+async function sendRuntimeResponse(
+  reply: FastifyReply,
+  response: ProjectMcpHttpResponse | OAuthHttpResponse,
+): Promise<void> {
+  reply.code(response.status);
+  for (const [name, value] of Object.entries(response.headers)) reply.header(name, value);
+  await (response.body === undefined ? reply.send() : reply.send(response.body));
+}
+
+/**
+ * `robodev dev` has no project Auth settings store: Auth is on, password sign-in and sign-up
+ * are on, and Google is on unless the project `.env` sets only one of its two keys.
+ */
+function devOAuthSettings(options: DevServerOptions) {
+  return {
+    enabled: true,
+    emailPasswordEnabled: true,
+    allowSignups: true,
+    googleEnabled:
+      projectGoogleOverrideMode(options.googleClientId, options.googleClientSecret) !== "one",
+  };
+}
+
+async function devMcpCaller(
+  options: DevServerOptions,
+  runtime: DevRuntime,
+  token: string,
+): Promise<McpCaller> {
+  if (isProjectMcpAccessToken(token)) {
+    const principal = await authenticateProjectMcpToken(
+      runtime.pool,
+      token,
+      projectMcpResource(options.listenOrigin),
+    );
+    return principal
+      ? { user: principal.user, via: "mcp_token", invalid: false }
+      : { user: null, via: null, invalid: true };
+  }
+  try {
+    const user = await verifyProjectUserToken(token, options.projectId, options.jwtSecret);
+    return { user, via: "project_jwt", invalid: false };
+  } catch {
+    return { user: null, via: null, invalid: true };
+  }
 }
 
 function pathnameOf(url: string): string {
@@ -453,6 +536,8 @@ export async function startDevServer(
     origin: true,
     credentials: true,
     methods: ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"],
+    // Browser MCP clients (MCP Inspector) read the 401 challenge to find the OAuth server.
+    exposedHeaders: ["WWW-Authenticate", "Mcp-Session-Id"],
   });
   await app.register(websocket);
   app.get("/sockets/*", { websocket: true }, (socket, request) => {
@@ -631,6 +716,108 @@ export async function startDevServer(
         return;
       }
 
+      if (isProjectMcpPath(pathname)) {
+        const headers = request.headers as Record<string, string | string[] | undefined>;
+        const clients = () => routeClients(options, getRuntime);
+        const response = await handleProjectMcpHttp(
+          { method: request.method, headers, body: request.body },
+          {
+            tools: runtime.mcpTools,
+            serverName: options.projectName ?? "robodev-dev",
+            serverVersion: runtimeVersion(),
+            authEnabled: true,
+            origin: options.listenOrigin,
+            resolveCaller: (token) => devMcpCaller(options, runtime, token),
+            verifyTools: async (names, requestHeaders) => {
+              const outcome = await runMcpOp({
+                db: runtime.db,
+                mcpTools: runtime.mcpTools,
+                op: { op: "verify", tools: names },
+                headers: requestHeaders,
+                clients,
+              });
+              const payload = outcome.kind === "ok" ? outcome.encoded.payload : null;
+              return Array.isArray(payload) ? payload.map(Boolean) : names.map(() => false);
+            },
+            invokeRoute: async (input) => {
+              const started = Date.now();
+              const outcome = await runRoute({
+                db: runtime.db,
+                routes: runtime.routes,
+                method: input.method,
+                pathname: input.pathname,
+                query: input.query,
+                body: input.body,
+                headers: input.headers,
+                authorization: request.headers.authorization,
+                resolveUser: async () => null,
+                user: input.user,
+                clients,
+                mapError: (error) => codedErrorBody(error),
+              });
+              const status = outcome.kind === "ok" ? outcome.encoded.status : outcome.status;
+              const durationMs = Date.now() - started;
+              options.inspect.record({
+                kind: "request",
+                method: input.method.toUpperCase(),
+                path: input.pathname,
+                status,
+                durationMs,
+              });
+              console.log(
+                `${input.method.toUpperCase()} ${input.pathname} ${status} ${durationMs}ms (mcp ${input.tool.name})`,
+              );
+              return outcome;
+            },
+            invokeTool: (input) =>
+              runMcpOp({
+                db: runtime.db,
+                mcpTools: runtime.mcpTools,
+                op: { op: "tool", tool: input.tool.name, input: input.input, user: input.user },
+                headers: input.headers,
+                clients,
+                mapError: (error) => codedErrorBody(error),
+              }),
+          },
+        );
+        await sendRuntimeResponse(reply, response);
+        return;
+      }
+
+      if (isProjectOAuthRequestPath(pathname)) {
+        const response = await handleProjectOAuth(
+          {
+            method: request.method,
+            pathname,
+            query: (request.query ?? {}) as Record<string, unknown>,
+            body: request.body,
+            headers: request.headers as Record<string, string | string[] | undefined>,
+          },
+          {
+            db: runtime.pool,
+            projectName: options.projectName ?? "robodev dev",
+            origin: options.listenOrigin,
+            secret: devOAuthSecret(options),
+            settings: devOAuthSettings(options),
+            signIn: (input) => localPasswordSignIn(runtime.pool, input),
+            signUp: (input) => localPasswordSignUp(runtime.pool, input),
+            verifyAppAccessToken: async (token) => {
+              try {
+                return await verifyProjectUserToken(token, options.projectId, options.jwtSecret);
+              } catch {
+                return null;
+              }
+            },
+            revokeAppRefreshToken: (token) => revokeRefresh(runtime.pool, token),
+            clientIp: request.ip,
+          },
+        );
+        if (response) {
+          await sendRuntimeResponse(reply, response);
+          return;
+        }
+      }
+
       if (isLocalAuthPath(pathname)) {
         const result = await handleLocalAuth(
           {

package/src/dev.ts

@@ -36,7 +36,7 @@ import { externalDevPostgres, startDevPostgres, type DevPostgres } from "./dev-p
 import { starbaseUrl } from "./config.js";
 import { devRouteClients } from "./dev-clients.js";
 import { createDevInspect } from "./dev-inspect.js";
-import { buildDevOpenApi, startDevServer, type DevRuntime } from "./dev-server.js";
+import { buildDevOpenApi, devMcpUrl, startDevServer, type DevRuntime } from "./dev-server.js";
 
 export type DevArgs = {
   port: number;
@@ -162,6 +162,7 @@ export async function main(args: string[]): Promise<void> {
   await mkdir(storageDir, { recursive: true });
 
   let current: DevRuntime | null = null;
+  let projectName = "robodev dev";
   let lastSchemaSource = "";
   let closing = false;
 
@@ -266,8 +267,10 @@ export async function main(args: string[]): Promise<void> {
       routes: loaded.routes,
       jobs: loaded.jobs,
       sockets: loaded.sockets,
-      openapi: buildDevOpenApi(loaded.database.name, loaded.routes),
+      mcpTools: loaded.mcpTools,
+      openapi: buildDevOpenApi(loaded.database.name, loaded.routes, loaded.mcpTools),
     };
+    projectName = loaded.database.name;
     setProjectSocketNames(
       DEV_PROJECT_ID,
       loaded.sockets.map((socket) => socket.name),
@@ -287,6 +290,9 @@ export async function main(args: string[]): Promise<void> {
     for (const socket of loaded.sockets) {
       log(`  WS ${socket.path}`);
     }
+    for (const tool of loaded.mcpTools) {
+      log(`  MCP ${tool.name}`);
+    }
     if (previous) {
       await previous.pool.end().catch(() => undefined);
     }
@@ -316,6 +322,7 @@ export async function main(args: string[]): Promise<void> {
         googleClientSecret: env.GOOGLE_CLIENT_SECRET,
         storageDir,
         projectRoot: project.root,
+        projectName,
       },
       () => current,
     );
@@ -340,6 +347,9 @@ export async function main(args: string[]): Promise<void> {
   console.log(`API       ${apiUrl}`);
   console.log(`Swagger   ${apiUrl}/_robodev/docs`);
   console.log(`Dashboard  ${apiUrl}/_robodev`);
+  if ((current as DevRuntime | null)?.mcpTools.length) {
+    console.log(`MCP       ${devMcpUrl(apiUrl)}`);
+  }
   console.log(
     `Project   ${relative(process.cwd(), project.backendDir) || "."} (${project.layout})`,
   );

package/templates/auth-chat/package.json

@@ -9,10 +9,10 @@
     "rules:gen": "rulesync generate"
   },
   "dependencies": {
-    "@robodev-ai/sdk": "^0.15.1"
+    "@robodev-ai/sdk": "^0.16.0"
   },
   "devDependencies": {
-    "robodev": "^0.51.1",
+    "robodev": "^0.52.0",
     "rulesync": "^8.18.0",
     "typescript": "^5.9.2"
   }

package/templates/backend/package.json

@@ -8,10 +8,10 @@
     "deploy": "robodev deploy"
   },
   "dependencies": {
-    "@robodev-ai/sdk": "^0.15.1"
+    "@robodev-ai/sdk": "^0.16.0"
   },
   "devDependencies": {
-    "robodev": "^0.51.1",
+    "robodev": "^0.52.0",
     "typescript": "^5.9.2"
   }
 }

package/templates/empty/package.json

@@ -10,13 +10,13 @@
     "build": "vite build"
   },
   "dependencies": {
-    "@robodev-ai/sdk": "^0.15.1",
+    "@robodev-ai/sdk": "^0.16.0",
     "@robodev-ai/client": "^0.5.0",
     "react": "^18.3.1",
     "react-dom": "^18.3.1"
   },
   "devDependencies": {
-    "robodev": "^0.51.1",
+    "robodev": "^0.52.0",
     "typescript": "^5.9.2",
     "vite": "^6.0.0"
   }

package/templates/marketplace/package.json

@@ -9,10 +9,10 @@
     "rules:gen": "rulesync generate"
   },
   "dependencies": {
-    "@robodev-ai/sdk": "^0.15.1"
+    "@robodev-ai/sdk": "^0.16.0"
   },
   "devDependencies": {
-    "robodev": "^0.51.1",
+    "robodev": "^0.52.0",
     "rulesync": "^8.18.0",
     "typescript": "^5.9.2"
   }

package/templates/povio/package.json

@@ -9,10 +9,10 @@
     "rules:gen": "rulesync generate"
   },
   "dependencies": {
-    "@robodev-ai/sdk": "^0.15.1"
+    "@robodev-ai/sdk": "^0.16.0"
   },
   "devDependencies": {
-    "robodev": "^0.51.1",
+    "robodev": "^0.52.0",
     "rulesync": "^8.18.0",
     "typescript": "^5.9.2"
   }

package/templates/shadcn/package.json

@@ -11,7 +11,7 @@
     "generate:api": "orval"
   },
   "dependencies": {
-    "@robodev-ai/sdk": "^0.15.1",
+    "@robodev-ai/sdk": "^0.16.0",
     "@robodev-ai/client": "^0.5.0",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
@@ -21,7 +21,7 @@
     "@types/react": "^18.3.12",
     "@types/react-dom": "^18.3.1",
     "orval": "^7.11.2",
-    "robodev": "^0.51.1",
+    "robodev": "^0.52.0",
     "typescript": "^5.9.2",
     "vite": "^6.0.0"
   }

package/templates/space/package.json

@@ -9,10 +9,10 @@
     "rules:gen": "rulesync generate"
   },
   "dependencies": {
-    "@robodev-ai/sdk": "^0.15.1"
+    "@robodev-ai/sdk": "^0.16.0"
   },
   "devDependencies": {
-    "robodev": "^0.51.1",
+    "robodev": "^0.52.0",
     "rulesync": "^8.18.0",
     "typescript": "^5.9.2"
   }