wolfpack-mcp 1.0.101 → 1.0.103

package/dist/index.js

@@ -805,6 +805,8 @@ class WolfpackMCPServer {
     server;
     client;
     capabilities = [];
+    /** The key's scopes, or null while they are unknown — see `stdioTools` (#2428). */
+    permissions = null;
     capabilitiesLoaded = false;
     capabilitiesFetch = null;
     constructor() {
@@ -830,7 +832,7 @@ class WolfpackMCPServer {
             }
             return {
                 tools: [
-                    ...stdioTools(this.capabilities),
+                    ...stdioTools(this.capabilities, this.permissions),
                     ...(this.capabilities.includes('agent_self') ? AGENT_SELF_TOOLS : []),
                     ...(this.capabilities.includes('agent_memory') ? AGENT_MEMORY_TOOLS : []),
                     ...(this.capabilities.includes('agent_observer') ? AGENT_OBSERVE_TOOLS : []),
@@ -2032,6 +2034,7 @@ class WolfpackMCPServer {
             .getCapabilities()
             .then((caps) => {
             this.capabilities = caps.capabilities;
+            this.permissions = caps.permissions ?? null;
             this.capabilitiesLoaded = true;
             if (this.capabilities.length > 0) {
                 console.error(`Capabilities: ${this.capabilities.join(', ')}`);

package/dist/stdioToolPermissions.test.js

@@ -0,0 +1,78 @@
+import { describe, it, expect, afterEach } from 'vitest';
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
+import { createServer } from 'http';
+import { fileURLToPath } from 'url';
+/**
+ * #2428 — the tool list a key is actually served, over a real stdio transport.
+ *
+ * `stdioTools` filtering in isolation proves nothing about what an agent sees:
+ * the defect was that `index.ts` never asked the backend for the key's scopes
+ * and never passed them on. So this drives the real server the way a client
+ * does, against a stub standing in for `/api/mcp/capabilities`, and reads the
+ * tool list off `listTools()`.
+ */
+const entryPoint = fileURLToPath(new URL('./index.ts', import.meta.url));
+let backend;
+/** A backend answering `/capabilities` with `body`, or failing when it is null. */
+const stubBackend = async (body) => {
+    backend = createServer((req, res) => {
+        if (body && req.url?.endsWith('/capabilities')) {
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify(body));
+            return;
+        }
+        if (req.url?.endsWith('/teams')) {
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ teams: [] }));
+            return;
+        }
+        res.writeHead(503).end();
+    });
+    await new Promise((resolve) => backend.listen(0, '127.0.0.1', resolve));
+    return `http://127.0.0.1:${backend.address().port}/api/mcp`;
+};
+const toolNamesFrom = async (apiUrl) => {
+    const client = new Client({ name: 'test', version: '1.0.0' });
+    const transport = new StdioClientTransport({
+        // tsx directly, not via npx: the transport kills the process it spawned,
+        // and an npx wrapper would leave the server orphaned behind it.
+        command: process.execPath,
+        args: ['--import', 'tsx', entryPoint],
+        env: {
+            ...process.env,
+            WOLFPACK_API_KEY: 'wfp_sk_test',
+            WOLFPACK_API_URL: apiUrl,
+            WOLFPACK_PROJECT_SLUG: '',
+            WOLFPACK_TEAM_SLUG: '',
+            WOLFPACK_ORG_SLUG: '',
+        },
+    });
+    await client.connect(transport);
+    try {
+        return (await client.listTools()).tools.map((t) => t.name);
+    }
+    finally {
+        await client.close();
+    }
+};
+afterEach(async () => {
+    await new Promise((resolve) => backend?.close(() => resolve()) ?? resolve());
+    backend = undefined;
+});
+describe('the tool list served over stdio', () => {
+    it('offers a read-only key the tools it may call and not the ones it may not', async () => {
+        const names = await toolNamesFrom(await stubBackend({ capabilities: ['project'], permissions: ['mcp:work_items:read'] }));
+        expect(names).toContain('list_work_items');
+        expect(names).not.toContain('update_work_item');
+        expect(names).not.toContain('create_work_item_comment');
+    }, 60_000);
+    it('is not stripped when the capabilities round trip fails', async () => {
+        // #1488 the other way up: a gateway outage means the key's scopes are
+        // unknown, not that the key holds none. Stripping the list on a 503 would
+        // be a worse regression than the one this item fixes.
+        const names = await toolNamesFrom(await stubBackend(null));
+        expect(names).toContain('list_work_items');
+        expect(names).toContain('update_work_item');
+    }, 60_000);
+});

package/dist/toolCatalogue.js

@@ -1547,7 +1547,9 @@ export const TOOL_CATALOGUE = [
         name: 'list_team_members',
         permission: 'mcp:team:read',
         description: 'List all members in a project/team. Returns user IDs, names, usernames, roles, and whether the member is an agent. ' +
-            'Use this to look up user IDs when assigning work items or issues.',
+            'Use this to look up user IDs when assigning work items or issues. ' +
+            'Agents an operator has switched off are left out, so every agent listed is one that can currently act. ' +
+            'Note the "Disabled" role is a zero-permission membership role, not an agent being switched off.',
         inputSchema: {
             type: 'object',
             properties: {
@@ -2135,9 +2137,24 @@ const toTool = ({ name, description, inputSchema }) => ({
     description,
     inputSchema,
 });
-/** The catalogue tools the stdio transport offers a key holding `capabilities`. */
-export function stdioTools(capabilities) {
-    return TOOL_CATALOGUE.filter((t) => !t.capability || capabilities.includes(t.capability)).map(toTool);
+/**
+ * Whether `permissions` carries `required`, read exactly as the backend reads it
+ * in `checkMcpPermission` — an exact match, or a `…:*` wildcard above it.
+ */
+const holdsScope = (permissions, required) => permissions.some((p) => p === required || (p.endsWith(':*') && required.startsWith(p.slice(0, -1))));
+/**
+ * The catalogue tools the stdio transport offers a key holding `capabilities`
+ * and `permissions`.
+ *
+ * `permissions` absent means the key's scopes are not known — the `/capabilities`
+ * round trip has not succeeded yet (#1488), or the backend predates #2428 — and
+ * everything the capabilities allow is advertised, as it always was. An empty
+ * array is the opposite: a key that holds no scopes, and is offered only the
+ * tools that deliberately require none.
+ */
+export function stdioTools(capabilities, permissions) {
+    return TOOL_CATALOGUE.filter((t) => (!t.capability || capabilities.includes(t.capability)) &&
+        (!t.permission || !permissions || holdsScope(permissions, t.permission))).map(toTool);
 }
 /** The names a capability gates, for routing a call to that family's handler. */
 export function toolNamesFor(capability) {

package/dist/toolCatalogue.test.js

@@ -66,6 +66,32 @@ describe('the MCP tool catalogue', () => {
         // Gating is the only difference: nothing else drops out.
         expect(withProcedures.length - without.length).toBe(TOOL_CATALOGUE.filter((t) => t.capability === 'procedures').length);
     });
+    it('offers a tool over stdio only to a key holding its scope', () => {
+        // #2428 — the list told an agent it could do things the 403 then refused.
+        const readOnly = stdioTools(['project'], ['mcp:work_items:read']).map((t) => t.name);
+        expect(readOnly).toContain('list_work_items');
+        expect(readOnly).not.toContain('update_work_item');
+        expect(readOnly).not.toContain('create_issue');
+    });
+    it('keeps a tool that deliberately requires no scope of its own', () => {
+        // `permission: null` is a decision, not a gap, so an empty key still gets these.
+        const unscoped = TOOL_CATALOGUE.filter((t) => t.permission === null).map((t) => t.name);
+        expect(unscoped.length).toBeGreaterThan(0);
+        expect(stdioTools([], []).map((t) => t.name)).toEqual(unscoped);
+    });
+    it('honours a wildcard the way the server does when it checks the call', () => {
+        // Filtering has to read a scope exactly as `checkMcpPermission` does, or a
+        // key on `mcp:*` loses tools it is entitled to call.
+        expect(stdioTools([], ['mcp:*']).map((t) => t.name)).toEqual(stdioTools([]).map((t) => t.name));
+        expect(stdioTools([], ['mcp:work_items:*']).map((t) => t.name)).toContain('update_work_item');
+        expect(stdioTools([], ['mcp:work_items:*']).map((t) => t.name)).not.toContain('create_issue');
+    });
+    it("advertises everything when the key's scopes are unknown", () => {
+        // A `/capabilities` round trip that has not succeeded yet (#1488) must not
+        // strip the list — an outage is not an answer about what the key may do.
+        expect(stdioTools(['project']).map((t) => t.name)).toEqual(stdioTools(['project'], null).map((t) => t.name));
+        expect(stdioTools(['project'], null).map((t) => t.name)).toContain('update_work_item');
+    });
     it('takes the remote override only where one is set', () => {
         // upload_image is the single tool whose two clients cannot share a contract.
         const overridden = TOOL_CATALOGUE.filter((t) => t.remote).map((t) => t.name);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wolfpack-mcp",
-  "version": "1.0.101",
+  "version": "1.0.103",
   "description": "MCP server for Wolfpack AI-enhanced software delivery tools",
   "main": "dist/index.js",
   "type": "module",