vantage-peers-mcp 2.14.1 → 2.15.0

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 2.14.2 — 2026-06-30
+
+- fix(oauth): DCR `/register` rejects empty/missing/malformed `redirect_uris` (RFC 7591 §3.2.2 `invalid_redirect_uri`). Closes zombie-client class — clients with empty `redirectUris` arrays can no longer be created. Defense-in-depth: same guard at Convex `registerPublicClient`. TDD-strict RED-then-GREEN.
+
 ## [Unreleased]
 
 ### Added

package/README.md

@@ -171,7 +171,7 @@ VantagePeers ships a built-in OAuth 2.1 authorization server so Claude.ai web ca
 |--------|------|-------------|
 | `GET` | `/.well-known/oauth-authorization-server` | Authorization Server Metadata (RFC 8414) — advertises supported grant types, endpoints, and capabilities |
 | `GET` | `/.well-known/oauth-protected-resource` | Protected Resource Metadata (RFC 9728) — links back to the authorization server |
-| `POST` | `/register` | Dynamic Client Registration (RFC 7591) — Claude.ai registers itself automatically on first connect |
+| `POST` | `/register` | Dynamic Client Registration (RFC 7591) — Claude.ai registers itself automatically on first connect. `redirect_uris` MUST be a non-empty array of valid `https://` URIs (or `http://localhost` / `http://127.0.0.1` for dev); absent, empty, non-string, unparseable, non-https, or fragment-bearing entries are rejected with `invalid_redirect_uri` (RFC 7591 §3.2.2, commit `2f3e653`). |
 | `GET` | `/authorize` | Authorization endpoint — redirects the user to grant access |
 | `POST` | `/token` | Token endpoint — issues access tokens per OAuth 2.1 |
 
@@ -373,6 +373,12 @@ Same two advisory VP-Sources doctrine paragraphs appended after the existing des
 - `search_components_by_keyword` (alias `search_components`) — keyword search over components
 - `hybrid_search` — RRF-fused vector + BM25 search; VP-Sources doctrine applies
 
+Knowledge Base document upload is a two-step flow (see `docs/cloud/kb-ingest.md`):
+1. `generate_upload_url` — mints a signed Convex storage upload URL (Convex mutation `kbMutations:generateUploadUrl`, requires a Clerk JWT with `org_id`). `POST` the binary to that URL to obtain a `storageId`.
+2. `store_document_chunked` — with the `storageId`, extracts text, chunks (~512 tokens), and schedules RAG embedding per chunk at write time.
+
+Ingested documents are then fully retrievable through `recall`, `text_search`, and `hybrid_search` like any other memory (Day 122 indexing fix + Day 123 `generate_upload_url` — the previously-missing upload entrypoint that made the KB end-to-end usable).
+
 #### `recall` — VP-Sources doctrine (PR-H)
 
 Alias of `search_memories_by_semantic`. Exports `RECALL_TOOL_DESCRIPTION` from `mcp-server/src/tools.ts`.

package/dist/server-http.js

@@ -27,11 +27,11 @@
 import { readFileSync } from "node:fs";
 import { McpServer, ResourceTemplate, } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
+import { timingSafeEqual } from "@vantageos/cloud-identity";
 import { ConvexHttpClient } from "convex/browser";
 import { Hono } from "hono";
 import { cors } from "hono/cors";
 import { bearerAuthMiddleware, internalClient, masterOnlyMiddleware, sha256Base64Url, sha256Hex, } from "./src/auth.js";
-import { timingSafeEqual } from "@vantageos/cloud-identity";
 import { registerTools } from "./src/tools.js";
 import { listUiResources, readUiResource } from "./src/ui-resources/index.js";
 let pkg;
@@ -262,9 +262,54 @@ app.post("/register", async (c) => {
     catch {
         // allow empty body — Claude sometimes posts nothing
     }
-    const redirectUris = Array.isArray(body.redirect_uris)
-        ? body.redirect_uris
-        : [];
+    // RFC 7591 §2: redirect_uris is REQUIRED for authorization_code grant.
+    // RFC 7591 §3.2.2: invalid_redirect_uri is the canonical error code for
+    // bad, missing, or empty redirect_uris. Reject here so zombie clients
+    // (e.g. prod 87abdf5c-616b-4767-8a96-5ca04db88d9f) can never be created.
+    if (!Array.isArray(body.redirect_uris) ||
+        body.redirect_uris.length === 0) {
+        return c.json({
+            error: "invalid_redirect_uri",
+            error_description: "redirect_uris is required and must be a non-empty array of valid HTTPS URIs",
+        }, 400);
+    }
+    // Validate each URI: must be parseable and https: scheme (or http://localhost
+    // for dev). Reject file://, javascript:, data:, fragments, etc.
+    for (const uri of body.redirect_uris) {
+        if (typeof uri !== "string") {
+            return c.json({
+                error: "invalid_redirect_uri",
+                error_description: "redirect_uris is required and must be a non-empty array of valid HTTPS URIs",
+            }, 400);
+        }
+        let parsed;
+        try {
+            parsed = new URL(uri);
+        }
+        catch {
+            return c.json({
+                error: "invalid_redirect_uri",
+                error_description: "redirect_uris is required and must be a non-empty array of valid HTTPS URIs",
+            }, 400);
+        }
+        const isHttpsScheme = parsed.protocol === "https:";
+        const isLocalhostHttp = parsed.protocol === "http:" &&
+            (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1");
+        if (!isHttpsScheme && !isLocalhostHttp) {
+            return c.json({
+                error: "invalid_redirect_uri",
+                error_description: "redirect_uris is required and must be a non-empty array of valid HTTPS URIs",
+            }, 400);
+        }
+        // Reject URIs with fragments (RFC 6749 §3.1.2)
+        if (parsed.hash) {
+            return c.json({
+                error: "invalid_redirect_uri",
+                error_description: "redirect_uris is required and must be a non-empty array of valid HTTPS URIs",
+            }, 400);
+        }
+    }
+    const redirectUris = body.redirect_uris;
     const clientId = crypto.randomUUID();
     const clientSecret = randomOpaqueToken();
     const clientSecretHash = await sha256Hex(clientSecret);

package/dist/src/tools/kbIngest.d.ts

@@ -58,6 +58,8 @@ export declare const SOFT_DELETE_DOCUMENT_TOOL_DESCRIPTION: string;
 export declare const softDeleteDocumentArgsSchema: z.ZodObject<{
     docId: z.ZodString;
 }, z.core.$strip>;
+export declare const GENERATE_UPLOAD_URL_TOOL_DESCRIPTION: string;
+export declare const generateUploadUrlArgsSchema: z.ZodObject<{}, z.core.$strip>;
 /**
  * Register store_document_chunked + soft_delete_document MCP tools.
  *

package/dist/src/tools/kbIngest.js

@@ -76,6 +76,15 @@ export const softDeleteDocumentArgsSchema = z.object({
         .describe("Document ID returned by store_document_chunked. " +
         "All chunks at namespace team/<orgId>/<docId> will be soft-deleted."),
 });
+export const GENERATE_UPLOAD_URL_TOOL_DESCRIPTION = "Mint a Convex storage upload URL for the Knowledge Base ingest flow. " +
+    "The caller's org (from the Clerk JWT) is bound implicitly — no client args required. " +
+    "POST the file binary to the returned URL to obtain a storageId, then call " +
+    "store_document_chunked with that storageId. " +
+    "Requires Clerk JWT with org_id — no-org bearers are rejected. " +
+    "Default limit: 1 URL per call. cap: 1 URL. " +
+    "Returns the upload URL as plain text. " +
+    "EXAMPLE: generate_upload_url (no args) → 'https://…convex.cloud/api/storage/upload?...'.";
+export const generateUploadUrlArgsSchema = z.object({});
 // ─────────────────────────────────────────────────────────────────────────────
 // Registration
 // ─────────────────────────────────────────────────────────────────────────────
@@ -177,4 +186,33 @@ export function registerKbIngestTools(server, convex, oauthCtx) {
             throw new McpError(ErrorCode.InternalError, message);
         }
     });
+    // ── generate_upload_url ─────────────────────────────────────────────────────
+    server.tool("generate_upload_url", GENERATE_UPLOAD_URL_TOOL_DESCRIPTION, generateUploadUrlArgsSchema.shape, {
+        readOnlyHint: false,
+        openWorldHint: false,
+        destructiveHint: false,
+        title: "Generate Knowledge Base upload URL",
+    }, async () => {
+        try {
+            const { orgId, namespacePrefix } = resolveOrgContext();
+            const url = (await convex.mutation("kbMutations:generateUploadUrl", { orgId, namespace: namespacePrefix }));
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: url,
+                    },
+                ],
+            };
+        }
+        catch (error) {
+            if (error instanceof McpError)
+                throw error;
+            const message = error instanceof Error ? error.message : String(error);
+            console.error("[generate_upload_url] mutation failed", {
+                errorMessage: message,
+            });
+            throw new McpError(ErrorCode.InternalError, message);
+        }
+    });
 }

package/package.json

@@ -1,95 +1,95 @@
 {
-  "name": "vantage-peers-mcp",
-  "version": "2.14.1",
-  "description": "MCP server for VantagePeers — shared memory, messaging, and task coordination for AI agent teams",
-  "type": "module",
-  "main": "./dist/server.js",
-  "exports": {
-    ".": "./dist/server.js",
-    "./api": {
-      "types": "./dist/api.d.ts",
-      "default": "./dist/api.js"
-    }
-  },
-  "bin": {
-    "vantage-peers-mcp": "./dist/server.js"
-  },
-  "files": [
-    "dist/",
-    "README.md",
-    "CHANGELOG.md"
-  ],
-  "scripts": {
-    "generate:api": "cd .. && npx convex-helpers ts-api-spec --prod --output-file mcp-server/api.ts",
-    "build": "tsc --project tsconfig.json",
-    "prepublishOnly": "npm run build",
-    "dev": "bun run server.ts",
-    "start": "bun run dist/server-http.js",
-    "dev:http": "bun run server-http.ts",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "test:coverage": "vitest run --coverage"
-  },
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/vantageos-agency/vantage-peers.git",
-    "directory": "mcp-server"
-  },
-  "homepage": "https://vantagepeers.com/docs",
-  "bugs": {
-    "url": "https://github.com/vantageos-agency/vantage-peers/issues"
-  },
-  "keywords": [
-    "mcp",
-    "claude",
-    "convex",
-    "ai-agents",
-    "memory",
-    "messaging",
-    "tasks",
-    "multi-agent",
-    "orchestration",
-    "vantagepeers",
-    "diary",
-    "episodes",
-    "mandates",
-    "knowledge-base",
-    "rag",
-    "vector-search"
-  ],
-  "author": "VantageOS AI Orchestrator Team",
-  "contributors": [
-    "Pi (π) — Lead orchestrator",
-    "Laurent Perello — Founder, supervisor",
-    "ElPi Corp"
-  ],
-  "license": "FSL-1.1-Apache-2.0",
-  "dependencies": {
-    "@mcp-ui/server": "^6.1.0",
-    "@modelcontextprotocol/sdk": "^1.29.0",
-    "@vantageos/cloud-identity": "^0.1.0",
-    "@vantageos/mosaic": "^0.1.2",
-    "convex": ">=1.0.0",
-    "dotenv": "^17.4.2",
-    "zod": "^4.3.6"
-  },
-  "peerDependencies": {
-    "convex": ">=1.0.0"
-  },
-  "devDependencies": {
-    "@types/node": "^24.12.2",
-    "@vitest/coverage-v8": "^4.1.8",
-    "typescript": "^5.9.3",
-    "vitest": "^4.1.8"
-  },
-  "overrides": {
-    "path-to-regexp": "^8.4.0"
-  },
-  "engines": {
-    "node": ">=20"
-  },
-  "publishConfig": {
-    "access": "public",
-    "provenance": true
-  }
+	"name": "vantage-peers-mcp",
+	"version": "2.15.0",
+	"description": "MCP server for VantagePeers — shared memory, messaging, and task coordination for AI agent teams",
+	"type": "module",
+	"main": "./dist/server.js",
+	"exports": {
+		".": "./dist/server.js",
+		"./api": {
+			"types": "./dist/api.d.ts",
+			"default": "./dist/api.js"
+		}
+	},
+	"bin": {
+		"vantage-peers-mcp": "./dist/server.js"
+	},
+	"files": [
+		"dist/",
+		"README.md",
+		"CHANGELOG.md"
+	],
+	"scripts": {
+		"generate:api": "cd .. && npx convex-helpers ts-api-spec --prod --output-file mcp-server/api.ts",
+		"build": "tsc --project tsconfig.json",
+		"prepublishOnly": "npm run build",
+		"dev": "bun run server.ts",
+		"start": "bun run dist/server-http.js",
+		"dev:http": "bun run server-http.ts",
+		"test": "vitest run",
+		"test:watch": "vitest",
+		"test:coverage": "vitest run --coverage"
+	},
+	"repository": {
+		"type": "git",
+		"url": "https://github.com/vantageos-agency/vantage-peers.git",
+		"directory": "mcp-server"
+	},
+	"homepage": "https://vantagepeers.com/docs",
+	"bugs": {
+		"url": "https://github.com/vantageos-agency/vantage-peers/issues"
+	},
+	"keywords": [
+		"mcp",
+		"claude",
+		"convex",
+		"ai-agents",
+		"memory",
+		"messaging",
+		"tasks",
+		"multi-agent",
+		"orchestration",
+		"vantagepeers",
+		"diary",
+		"episodes",
+		"mandates",
+		"knowledge-base",
+		"rag",
+		"vector-search"
+	],
+	"author": "VantageOS AI Orchestrator Team",
+	"contributors": [
+		"Pi (π) — Lead orchestrator",
+		"Laurent Perello — Founder, supervisor",
+		"ElPi Corp"
+	],
+	"license": "FSL-1.1-Apache-2.0",
+	"dependencies": {
+		"@mcp-ui/server": "^6.1.0",
+		"@modelcontextprotocol/sdk": "^1.29.0",
+		"@vantageos/cloud-identity": "^0.1.0",
+		"@vantageos/mosaic": "^0.1.2",
+		"convex": ">=1.0.0",
+		"dotenv": "^17.4.2",
+		"zod": "^4.3.6"
+	},
+	"peerDependencies": {
+		"convex": ">=1.0.0"
+	},
+	"devDependencies": {
+		"@types/node": "^24.12.2",
+		"@vitest/coverage-v8": "^4.1.8",
+		"typescript": "^5.9.3",
+		"vitest": "^4.1.8"
+	},
+	"overrides": {
+		"path-to-regexp": "^8.4.0"
+	},
+	"engines": {
+		"node": ">=20"
+	},
+	"publishConfig": {
+		"access": "public",
+		"provenance": true
+	}
 }