yontrack-mcp 1.0.0

package/README.md

@@ -0,0 +1,305 @@
+# yontrack-mcp
+
+MCP server for [Yontrack](https://ontrack.nemerosa.net) (Ontrack CI/CD monitoring platform). It exposes Yontrack's GraphQL API as MCP tools so that AI assistants such as Claude can query and manage your CI/CD pipelines through natural language.
+
+The server uses the [Streamable HTTP transport](https://modelcontextprotocol.io/specification/2025-03-26/basic/transports#streamable-http) (`POST /mcp`) and is available as a pre-built Docker image.
+
+## Features
+
+- **Read-only by default** — only query tools are active unless mutations are explicitly enabled
+- **Mutation tools** — create projects, branches, builds, validation stamps/runs, promotion levels/runs, and build links (opt-in via `YONTRACK_MUTATIONS_ENABLED=true`)
+- **Raw GraphQL access** — `graphql_query` tool for queries not covered by the dedicated tools
+- **OAuth2 support** — required for claude.ai; enabled by setting two environment variables
+- **Docker image** — published to Docker Hub on every release (`nemerosa/yontrack-mcp:latest`)
+- **Helm chart** — OCI chart for Kubernetes deployments with full secret management support
+
+## Available Tools
+
+By default only read-only tools are available. Set `YONTRACK_MUTATIONS_ENABLED=true` to also expose the tools marked with ✎ below.
+
+| Category | Read-only tools | Mutation tools (✎) |
+|---|---|---|
+| Projects | `list_projects` | `create_project` |
+| Branches | `list_branches` | `create_branch` |
+| Builds | `list_builds`, `find_build`, `get_build_duration` | `create_build` |
+| Validation stamps | `list_validation_stamps` | `create_validation_stamp` |
+| Validation runs | `get_validation_runs` | `create_validation_run` |
+| Promotion levels | `list_promotion_levels`, `get_promotion_level_image` | `create_promotion_level` |
+| Promotion runs | `get_promotion_runs` | `promote_build` |
+| Build links | `get_build_links` | `set_build_links` |
+| Search | `search` | — |
+| GraphQL | `graphql_query` ✝ | — |
+
+> ✝ `graphql_query` is always registered but rejects requests whose query string starts with `mutation` when `YONTRACK_MUTATIONS_ENABLED` is not set.
+
+## Installation
+
+### Cursor
+
+Create or edit `.cursor/mcp.json` in your project (or `~/.cursor/mcp.json` for a global configuration):
+
+```json
+{
+  "mcpServers": {
+    "yontrack": {
+      "command": "npx",
+      "args": ["-y", "yontrack-mcp@latest", "stdio"],
+      "env": {
+        "YONTRACK_URL": "https://your-ontrack-instance",
+        "YONTRACK_TOKEN": "your-api-token"
+      }
+    }
+  }
+}
+```
+
+Cursor will start the server automatically as a subprocess when needed.
+
+### VSCode and IntelliJ
+
+**VSCode** — create or edit `.vscode/mcp.json` in your project:
+
+```json
+{
+  "servers": {
+    "yontrack": {
+      "type": "stdio",
+      "command": "npx",
+      "args": ["-y", "yontrack-mcp@latest", "stdio"],
+      "env": {
+        "YONTRACK_URL": "https://your-ontrack-instance",
+        "YONTRACK_TOKEN": "your-api-token"
+      }
+    }
+  }
+}
+```
+
+**IntelliJ IDEA** — open **Settings → Tools → AI Assistant → Model Context Protocol (MCP)**, click **+**, and configure:
+- Command: `npx`
+- Arguments: `-y yontrack-mcp@latest stdio`
+- Environment: `YONTRACK_URL=https://your-ontrack-instance`, `YONTRACK_TOKEN=your-api-token`
+
+### Claude Desktop
+
+Add the server to your Claude Desktop configuration file (`claude_desktop_config.json`):
+
+```json
+{
+  "mcpServers": {
+    "yontrack": {
+      "command": "npx",
+      "args": ["-y", "yontrack-mcp@latest", "stdio"],
+      "env": {
+        "YONTRACK_URL": "https://your-ontrack-instance",
+        "YONTRACK_TOKEN": "your-api-token"
+      }
+    }
+  }
+}
+```
+
+### Helm
+
+A Helm chart is published to Docker Hub as an OCI image alongside every release:
+
+```
+oci://registry-1.docker.io/nemerosa/yontrack-mcp-chart
+```
+
+#### Install
+
+```bash
+helm install yontrack-mcp \
+  oci://registry-1.docker.io/nemerosa/yontrack-mcp-chart \
+  --version <version> \
+  --set yontrack.url=https://your-ontrack-instance \
+  --set yontrack.token=your-api-token
+```
+
+#### Configuration
+
+| Value | Description | Default |
+|---|---|---|
+| `yontrack.url` | URL of the Yontrack instance | `""` |
+| `yontrack.token` | Yontrack API token | `""` |
+| `yontrack.mutationsEnabled` | Enable mutation tools (create/promote/link operations) | `false` |
+| `oauth.serverUrl` | Public HTTPS URL of this server — enables OAuth2 when set with `oauth.authPassword` | `""` |
+| `oauth.authPassword` | Password for the browser authorization form — enables OAuth2 when set with `oauth.serverUrl` | `""` |
+| `persistence.enabled` | Create a PVC and mount it at `/data`; sets the clients file to `/data/clients.json` | `true` |
+| `persistence.size` | PVC size | `10Mi` |
+| `persistence.storageClass` | Storage class name (empty = cluster default) | `""` |
+| `persistence.accessMode` | PVC access mode | `ReadWriteOnce` |
+| `existingSecret` | Name of a pre-existing Secret (skips Secret creation) | `""` |
+| `externalSecrets.enabled` | Render an `ExternalSecret` CRD instead of creating a Secret | `false` |
+| `externalSecrets.refreshInterval` | How often ESO refreshes credentials from the backend | `"1h"` |
+| `externalSecrets.secretStoreRef.name` | Name of the `SecretStore` or `ClusterSecretStore` | `""` |
+| `externalSecrets.secretStoreRef.kind` | Kind of the store (`SecretStore` or `ClusterSecretStore`) | `SecretStore` |
+| `externalSecrets.data.yontrackToken.key` | Backend path for `YONTRACK_TOKEN` | `""` |
+| `externalSecrets.data.yontrackToken.property` | Sub-field within the backend entry (leave empty for the whole value) | `""` |
+| `externalSecrets.data.authPassword.key` | Backend path for `YONTRACK_MCP_AUTH_PASSWORD` (OAuth2 only) | `""` |
+| `externalSecrets.data.authPassword.property` | Sub-field within the backend entry (leave empty for the whole value) | `""` |
+| `service.type` | Kubernetes Service type | `ClusterIP` |
+| `service.port` | Service port | `3000` |
+| `ingress.enabled` | Enable Ingress resource | `false` |
+| `ingress.className` | Ingress class name | `""` |
+| `ingress.hosts` | Ingress host rules | see `values.yaml` |
+| `replicaCount` | Number of pod replicas | `1` |
+| `image.tag` | Image tag override (defaults to chart `appVersion`) | `""` |
+| `resources` | Pod resource requests/limits | `{}` |
+
+#### Secret management
+
+The chart supports three mutually exclusive modes for injecting credentials. `existingSecret` takes precedence over `externalSecrets.enabled`; if neither is set the chart creates the Secret itself.
+
+**Chart-managed Secret (default)**
+
+Credentials are taken from `yontrack.token` and `oauth.authPassword` in `values.yaml` and written into a Kubernetes Secret by the chart:
+
+```bash
+helm install yontrack-mcp \
+  oci://registry-1.docker.io/nemerosa/yontrack-mcp-chart \
+  --version <version> \
+  --set yontrack.url=https://your-ontrack-instance \
+  --set yontrack.token=your-api-token
+```
+
+**Existing Secret**
+
+Point the chart to a pre-created Secret (e.g. created by Sealed Secrets or manually). The Secret must contain:
+
+- `YONTRACK_TOKEN`
+- `YONTRACK_MCP_AUTH_PASSWORD` (when OAuth2 is enabled)
+
+```bash
+helm install yontrack-mcp \
+  oci://registry-1.docker.io/nemerosa/yontrack-mcp-chart \
+  --version <version> \
+  --set yontrack.url=https://your-ontrack-instance \
+  --set existingSecret=my-yontrack-secret
+```
+
+**External Secrets Operator (ESO)**
+
+When [ESO](https://external-secrets.io) is installed in the cluster, the chart can render an `ExternalSecret` CRD that instructs ESO to fetch credentials from an external backend (e.g. HashiCorp Vault, AWS Secrets Manager) and write them into a Kubernetes Secret automatically.
+
+```yaml
+externalSecrets:
+  enabled: true
+  refreshInterval: "1h"
+  secretStoreRef:
+    name: vault-store        # name of your SecretStore / ClusterSecretStore
+    kind: SecretStore        # or ClusterSecretStore
+  data:
+    yontrackToken:
+      key: secret/yontrack   # path in the backend
+      property: token        # sub-field (omit if the whole entry is the value)
+    authPassword:            # only needed when OAuth2 is enabled
+      key: secret/yontrack
+      property: authPassword
+```
+
+The `ExternalSecret` targets the same Secret name the chart would otherwise create, so the Deployment references it transparently.
+
+#### Ingress example
+
+**Without OAuth2** — expose only the `/mcp` endpoint:
+
+```yaml
+ingress:
+  enabled: true
+  className: nginx
+  hosts:
+    - host: mcp.example.com
+      paths:
+        - path: /mcp
+          pathType: Prefix
+  tls:
+    - secretName: mcp-tls
+      hosts:
+        - mcp.example.com
+```
+
+**With OAuth2** — all paths must be reachable (OAuth2 discovery, `/authorize`, `/token`, etc.):
+
+```yaml
+oauth:
+  serverUrl: https://mcp.example.com
+  authPassword: some-strong-password
+
+ingress:
+  enabled: true
+  className: nginx
+  hosts:
+    - host: mcp.example.com
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - secretName: mcp-tls
+      hosts:
+        - mcp.example.com
+```
+
+The MCP endpoint is available at `https://mcp.example.com/mcp`.
+
+### Claude AI
+
+Claude.ai requires OAuth2 for remote MCP servers. Start the server with the two additional OAuth environment variables:
+
+```bash
+docker run -d --name yontrack-mcp \
+  -e YONTRACK_URL=https://your-ontrack-instance \
+  -e YONTRACK_TOKEN=your-api-token \
+  -e YONTRACK_MCP_SERVER_URL=https://mcp.example.com \
+  -e YONTRACK_MCP_AUTH_PASSWORD=some-strong-password \
+  -p 3000:3000 \
+  nemerosa/yontrack-mcp:latest
+```
+
+Both `YONTRACK_MCP_SERVER_URL` and `YONTRACK_MCP_AUTH_PASSWORD` must be set together; either alone is ignored and the server starts without authentication.
+
+**First-time connection flow:**
+
+1. In Claude.ai go to **Settings → Integrations** and add `https://mcp.example.com/mcp` as a new integration.
+2. Claude.ai auto-discovers the OAuth2 endpoints via `/.well-known/oauth-authorization-server`.
+3. Claude.ai registers itself as a client automatically (dynamic client registration — no manual client ID/secret needed).
+4. You are redirected to the server's authorization page where you enter the configured password.
+5. After approval, Claude.ai receives a Bearer token valid for 1 hour (refresh tokens last 30 days).
+6. Subsequent requests use the token silently; you re-authorize only after the refresh token expires.
+
+> **HTTPS required.** `YONTRACK_MCP_SERVER_URL` must use `https://`. For local testing only, `http://localhost` is also accepted.
+
+> **Tokens are in-memory.** All issued tokens are lost when the server restarts. Users will be prompted to re-authorize after a restart.
+
+## Configuration
+
+### Read-only mode
+
+By default the server runs in read-only mode: only query tools are registered and no data can be modified. This is the recommended mode when the AI assistant only needs to inspect CI/CD state.
+
+To also expose the mutation tools (create projects, branches, builds, validation stamps/runs, promotion levels/runs, and build links), set:
+
+```bash
+YONTRACK_MUTATIONS_ENABLED=true
+```
+
+### Yontrack API token
+
+An API token is required to authenticate against Yontrack. To generate one, log in to your Yontrack instance, open your user menu, and go to **User information > User profile**. Create a new token and copy it — it will not be shown again.
+
+### Environment variables
+
+| Variable | Required | Default | Description |
+|---|---|---|---|
+| `YONTRACK_URL` | Yes | — | URL of the Yontrack instance (e.g. `https://ontrack.example.com`) |
+| `YONTRACK_TOKEN` | Yes | — | API token for authenticating against Yontrack |
+| `YONTRACK_MUTATIONS_ENABLED` | No | `false` | Set to `true` to enable mutation tools (create/promote/link operations). When unset or `false`, only read-only query tools are registered. |
+| `YONTRACK_MCP_SERVER_URL` | No | — | Public HTTPS URL of this server. When set together with `YONTRACK_MCP_AUTH_PASSWORD`, enables OAuth2 (required for claude.ai). |
+| `YONTRACK_MCP_AUTH_PASSWORD` | No | — | Password users must enter in the browser authorization form. Required together with `YONTRACK_MCP_SERVER_URL` to enable OAuth2. |
+| `YONTRACK_MCP_CLIENTS_FILE` | No | `./yontrack-mcp-clients.json` | File path where registered OAuth2 clients are persisted so they survive restarts. The Helm chart sets this automatically to `/data/clients.json` when `persistence.enabled` is true. |
+| `PORT` | No | `3000` | Port the HTTP server listens on |
+
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) for development setup, running tests, and interactive testing with MCP Inspector.

package/build/auth.js

@@ -0,0 +1,228 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import { InvalidGrantError, InvalidScopeError, InvalidTokenError, } from "@modelcontextprotocol/sdk/server/auth/errors.js";
+function log(msg) {
+    process.stderr.write(`[oauth] ${msg}\n`);
+}
+const ACCESS_TOKEN_TTL_S = 3600; // 1 hour
+const REFRESH_TOKEN_TTL_S = 30 * 24 * 3600; // 30 days
+const AUTH_CODE_TTL_S = 600; // 10 minutes
+// Path to persist registered clients across restarts.
+// Configure via YONTRACK_MCP_CLIENTS_FILE; defaults to the current directory.
+// In Kubernetes, mount a PVC at the chosen path to survive pod replacements.
+const CLIENTS_FILE = process.env.YONTRACK_MCP_CLIENTS_FILE ?? "./yontrack-mcp-clients.json";
+// Registered clients are persisted to disk so they survive restarts.
+// Tokens and auth codes remain in-memory (short-lived, re-auth is fast).
+const clients = new Map(loadClients());
+const authCodes = new Map();
+const accessTokens = new Map();
+const refreshTokens = new Map();
+function loadClients() {
+    try {
+        const raw = fs.readFileSync(CLIENTS_FILE, "utf-8");
+        const entries = JSON.parse(raw);
+        log(`Loaded ${entries.length} client(s) from ${CLIENTS_FILE}`);
+        return entries;
+    }
+    catch {
+        log(`No existing clients file at ${CLIENTS_FILE}, starting fresh`);
+        return [];
+    }
+}
+function persistClients() {
+    try {
+        fs.writeFileSync(CLIENTS_FILE, JSON.stringify([...clients]), "utf-8");
+        log(`Persisted ${clients.size} client(s) to ${CLIENTS_FILE}`);
+    }
+    catch (err) {
+        log(`ERROR: Failed to persist OAuth clients: ${err}`);
+    }
+}
+function generateToken() {
+    return crypto.randomBytes(32).toString("hex");
+}
+export function generateAuthCode(params) {
+    const code = generateToken();
+    authCodes.set(code, {
+        ...params,
+        expiresAt: Math.floor(Date.now() / 1000) + AUTH_CODE_TTL_S,
+    });
+    return code;
+}
+export const clientsStore = {
+    async getClient(clientId) {
+        const client = clients.get(clientId);
+        if (!client)
+            log(`Client not found: ${clientId}`);
+        return client;
+    },
+    async registerClient(client) {
+        clients.set(client.client_id, client);
+        log(`Registered client: ${client.client_id} (${client.client_name ?? "unnamed"})`);
+        persistClients();
+        return client;
+    },
+};
+function escHtml(s) {
+    return s
+        .replace(/&/g, "&")
+        .replace(/"/g, """)
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;");
+}
+export function renderAuthFormHtml(opts) {
+    return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Authorize — Yontrack MCP</title>
+  <style>
+    body { font-family: system-ui, sans-serif; max-width: 400px; margin: 80px auto; padding: 0 1rem; color: #111; }
+    h1 { font-size: 1.4rem; margin-bottom: .5rem; }
+    label { display: block; margin: 1.2rem 0 .3rem; font-weight: 600; }
+    input[type=password] { width: 100%; padding: .5rem .6rem; box-sizing: border-box; border: 1px solid #bbb; border-radius: 4px; font-size: 1rem; }
+    .actions { margin-top: 1.5rem; }
+    button { width: 100%; padding: .65rem; border: none; border-radius: 4px; cursor: pointer; font-size: 1rem; background: #0066cc; color: #fff; }
+    button:hover { background: #0052a3; }
+    .error { color: #c00; background: #fff0f0; border: 1px solid #fcc; border-radius: 4px; padding: .5rem .8rem; margin-top: 1rem; }
+  </style>
+</head>
+<body>
+  <h1>Authorize Access</h1>
+  <p><strong>${escHtml(opts.clientName)}</strong> is requesting access to Yontrack MCP.</p>
+  ${opts.error ? `<div class="error">${escHtml(opts.error)}</div>` : ""}
+  <form method="POST" action="${escHtml(opts.serverUrl)}/authorize/login">
+    <input type="hidden" name="client_id" value="${escHtml(opts.clientId)}">
+    <input type="hidden" name="redirect_uri" value="${escHtml(opts.redirectUri)}">
+    <input type="hidden" name="code_challenge" value="${escHtml(opts.codeChallenge)}">
+    <input type="hidden" name="scopes" value="${escHtml(opts.scopes)}">
+    <input type="hidden" name="state" value="${escHtml(opts.state)}">
+    <label for="password">Server password</label>
+    <input type="password" id="password" name="password" required autofocus>
+    <div class="actions">
+      <button type="submit">Authorize</button>
+    </div>
+  </form>
+</body>
+</html>`;
+}
+export function createOAuthProvider(serverUrl) {
+    return {
+        get clientsStore() {
+            return clientsStore;
+        },
+        async authorize(client, params, res) {
+            log(`Authorize request for client: ${client.client_id} (${client.client_name ?? "unnamed"})`);
+            const html = renderAuthFormHtml({
+                serverUrl,
+                clientName: client.client_name ?? client.client_id,
+                clientId: client.client_id,
+                redirectUri: params.redirectUri,
+                codeChallenge: params.codeChallenge,
+                scopes: (params.scopes ?? []).join(" "),
+                state: params.state ?? "",
+            });
+            res.setHeader("Content-Type", "text/html; charset=utf-8");
+            res.end(html);
+        },
+        async challengeForAuthorizationCode(client, authorizationCode) {
+            const record = authCodes.get(authorizationCode);
+            if (!record || record.clientId !== client.client_id) {
+                log(`ERROR: Auth code not found or client mismatch for client ${client.client_id}`);
+                throw new InvalidGrantError("Invalid authorization code");
+            }
+            return record.codeChallenge;
+        },
+        async exchangeAuthorizationCode(client, authorizationCode) {
+            const record = authCodes.get(authorizationCode);
+            if (!record || record.clientId !== client.client_id) {
+                log(`ERROR: Auth code exchange failed — code not found for client ${client.client_id}`);
+                throw new InvalidGrantError("Invalid authorization code");
+            }
+            if (record.expiresAt < Date.now() / 1000) {
+                authCodes.delete(authorizationCode);
+                log(`ERROR: Auth code expired for client ${client.client_id}`);
+                throw new InvalidGrantError("Authorization code has expired");
+            }
+            authCodes.delete(authorizationCode);
+            log(`Auth code exchanged for client ${client.client_id}`);
+            const now = Math.floor(Date.now() / 1000);
+            const accessToken = generateToken();
+            const refreshToken = generateToken();
+            accessTokens.set(accessToken, {
+                clientId: client.client_id,
+                scopes: record.scopes,
+                expiresAt: now + ACCESS_TOKEN_TTL_S,
+            });
+            refreshTokens.set(refreshToken, {
+                clientId: client.client_id,
+                scopes: record.scopes,
+                expiresAt: now + REFRESH_TOKEN_TTL_S,
+            });
+            return {
+                access_token: accessToken,
+                token_type: "bearer",
+                expires_in: ACCESS_TOKEN_TTL_S,
+                refresh_token: refreshToken,
+                scope: record.scopes.join(" ") || undefined,
+            };
+        },
+        async exchangeRefreshToken(client, refreshToken, scopes) {
+            const record = refreshTokens.get(refreshToken);
+            if (!record || record.clientId !== client.client_id) {
+                log(`ERROR: Refresh token not found for client ${client.client_id} (likely lost after restart — user must re-authorize)`);
+                throw new InvalidGrantError("Invalid refresh token");
+            }
+            if (record.expiresAt < Date.now() / 1000) {
+                refreshTokens.delete(refreshToken);
+                log(`ERROR: Refresh token expired for client ${client.client_id}`);
+                throw new InvalidGrantError("Refresh token has expired");
+            }
+            log(`Refresh token exchanged for client ${client.client_id}`);
+            const requestedScopes = scopes?.length ? scopes : record.scopes;
+            const invalid = requestedScopes.filter((s) => !record.scopes.includes(s));
+            if (invalid.length > 0) {
+                throw new InvalidScopeError("Requested scopes exceed original grant");
+            }
+            refreshTokens.delete(refreshToken);
+            const now = Math.floor(Date.now() / 1000);
+            const newAccessToken = generateToken();
+            const newRefreshToken = generateToken();
+            accessTokens.set(newAccessToken, {
+                clientId: client.client_id,
+                scopes: requestedScopes,
+                expiresAt: now + ACCESS_TOKEN_TTL_S,
+            });
+            refreshTokens.set(newRefreshToken, {
+                clientId: client.client_id,
+                scopes: requestedScopes,
+                expiresAt: now + REFRESH_TOKEN_TTL_S,
+            });
+            return {
+                access_token: newAccessToken,
+                token_type: "bearer",
+                expires_in: ACCESS_TOKEN_TTL_S,
+                refresh_token: newRefreshToken,
+                scope: requestedScopes.join(" ") || undefined,
+            };
+        },
+        async verifyAccessToken(token) {
+            const record = accessTokens.get(token);
+            if (!record) {
+                log(`ERROR: Access token not found (likely lost after restart — user must re-authorize)`);
+                throw new InvalidTokenError("Invalid access token");
+            }
+            return {
+                token,
+                clientId: record.clientId,
+                scopes: record.scopes,
+                expiresAt: record.expiresAt,
+            };
+        },
+        async revokeToken(_client, request) {
+            accessTokens.delete(request.token);
+            refreshTokens.delete(request.token);
+        },
+    };
+}

package/build/client.js

@@ -0,0 +1,5 @@
+import { GraphQLClient } from "graphql-request";
+import { config } from "./config.js";
+export const gqlClient = new GraphQLClient(`${config.YONTRACK_URL}/graphql`, {
+    headers: { "X-Ontrack-Token": config.YONTRACK_TOKEN },
+});

package/build/config.js

@@ -0,0 +1,23 @@
+import { z } from "zod";
+const ConfigSchema = z.object({
+    YONTRACK_URL: z.string().url(),
+    YONTRACK_TOKEN: z.string().min(1),
+    YONTRACK_MUTATIONS_ENABLED: z
+        .string()
+        .optional()
+        .transform((v) => v === "true"),
+});
+let _config;
+try {
+    _config = ConfigSchema.parse(process.env);
+}
+catch (err) {
+    process.stderr.write("Missing required environment variables: YONTRACK_URL and YONTRACK_TOKEN\n");
+    process.exit(1);
+}
+export const config = _config;
+export const mutationsEnabled = _config.YONTRACK_MUTATIONS_ENABLED;
+// OAuth2 is enabled when both SERVER_URL and AUTH_PASSWORD are provided
+const serverUrl = process.env.YONTRACK_MCP_SERVER_URL;
+const authPassword = process.env.YONTRACK_MCP_AUTH_PASSWORD;
+export const oauthConfig = serverUrl && authPassword ? { serverUrl, authPassword } : null;