connectkit 0.1.0__tar.gz → 0.1.2__tar.gz

{connectkit-0.1.0 → connectkit-0.1.2}/.gitignore

@@ -3,5 +3,6 @@ __pycache__/
 *.egg-info/
 dist/
 .venv/
+.env
 .pytest_cache/
 *.db

{connectkit-0.1.0 → connectkit-0.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: connectkit
-Version: 0.1.0
+Version: 0.1.2
 Summary: Connect AI agents to SaaS — one YAML file per service. OAuth, token vault, tool discovery.
 Author: Eddy Xu
 License: MIT
@@ -19,6 +19,7 @@ Requires-Python: >=3.11
 Requires-Dist: cryptography>=41.0
 Requires-Dist: fastapi>=0.129
 Requires-Dist: httpx>=0.28
+Requires-Dist: mcp>=1.0.0
 Requires-Dist: pydantic>=2.0
 Requires-Dist: pyyaml>=6.0
 Provides-Extra: dev

{connectkit-0.1.0 → connectkit-0.1.2}/connectkit/bridge.py

@@ -85,11 +85,16 @@ class ConnectKitBridge:
         return self._vault
 
     async def discover(self) -> None:
-        self._tools = self._runtime.get_tools()
+        await self._runtime.refresh_all()
+        self._tools = await self._runtime.get_tools()
         logger.info(
             f"connectkit.discover user={self.user_id} tools={len(self._tools)}"
         )
 
+    async def refresh_all(self) -> None:
+        """Refresh all expired OAuth tokens."""
+        await self._runtime.refresh_all()
+
     def get_tool_definitions(self) -> list[dict[str, Any]]:
         return self._tools
 
@@ -97,7 +102,6 @@ class ConnectKitBridge:
         return self._runtime.list_available()
 
     def list_available_specs(self) -> list[ConnectorSpec]:
-        """Return full ConnectorSpec objects for all known connectors."""
         return self._runtime.get_specs()
 
     def health(self) -> dict[str, Any]:

connectkit-0.1.2/connectkit/runtime.py

@@ -0,0 +1,302 @@
+"""ConnectorRuntime — load specs, check connections, discover tools, refresh tokens."""
+
+import asyncio
+import json
+import logging
+import os
+from datetime import UTC, datetime
+from pathlib import Path
+from typing import Any
+
+import httpx
+
+from connectkit.backends.cli import CLIAdapter
+from connectkit.backends.mcp import MCPAdapter
+from connectkit.spec import AuthType, ConnectorSpec, ToolSourceType
+from connectkit.vault import CredentialVault
+
+logger = logging.getLogger("connectkit")
+
+logger = logging.getLogger("connectkit")
+
+
+class ConnectorRuntime:
+    """Orchestrates: YAML specs → auth check → backend → tool dicts.
+
+    Usage:
+        runtime = ConnectorRuntime(
+            spec_dir="./connectors",
+            vault=CredentialVault("./data/users/alice"),
+            user_id="alice",
+        )
+        tools = await runtime.get_tools()  # async for MCP discovery
+        available = runtime.list_available()
+        health = runtime.health()
+    """
+
+    def __init__(
+        self,
+        spec_dir: str | Path,
+        vault: CredentialVault,
+        user_id: str,
+    ):
+        self.spec_dir = Path(spec_dir)
+        self.vault = vault
+        self.user_id = user_id
+        self._specs: list[ConnectorSpec] = []
+        self._load_specs()
+
+    def _load_specs(self) -> None:
+        if self.spec_dir.exists():
+            self._specs = ConnectorSpec.from_yaml_dir(self.spec_dir)
+
+    def get_specs(self) -> list[ConnectorSpec]:
+        return list(self._specs)
+
+    def reload(self) -> None:
+        self._load_specs()
+
+    async def try_refresh_token(self, spec: ConnectorSpec) -> None:
+        """Refresh an OAuth2 token if it has a refresh_token and has expired."""
+        if spec.auth.type != AuthType.OAUTH2:
+            return
+        if not self.vault.is_expired(spec.name):
+            return
+
+        token = self.vault.get_token(spec.name)
+        if not token:
+            return
+        refresh_token = token.get("refresh_token")
+        if not refresh_token:
+            logger.warning(
+                f"Token for '{spec.name}' is expired and has no refresh_token. "
+                f"Reconnect required."
+            )
+            return
+
+        oauth2 = spec.auth.oauth2
+        if not oauth2:
+            return
+
+        client_id = token.get("client_id", "")
+        client_secret = token.get("client_secret", "")
+        logger.info(f"Refreshing token for '{spec.name}'...")
+
+        try:
+            async with httpx.AsyncClient(timeout=15) as client:
+                body = {
+                    "grant_type": "refresh_token",
+                    "refresh_token": refresh_token,
+                    "client_id": client_id,
+                }
+                if client_secret:
+                    body["client_secret"] = client_secret
+
+                resp = await client.post(oauth2.token_url, data=body)
+                resp.raise_for_status()
+                new_token = resp.json()
+
+                # Preserve the refresh_token if the provider didn't issue a new one
+                if "refresh_token" not in new_token:
+                    new_token["refresh_token"] = refresh_token
+                new_token["client_id"] = client_id
+                new_token["client_secret"] = client_secret
+
+                self.vault.store_token(spec.name, "oauth2", new_token)
+                logger.info(f"Token refreshed for '{spec.name}'")
+        except Exception as e:
+            logger.warning(
+                f"Failed to refresh token for '{spec.name}': {e}. "
+                f"Reconnect required."
+            )
+
+    async def refresh_all(self) -> None:
+        """Refresh all connected OAuth2 tokens that are expired."""
+        for spec in self._specs:
+            if self.vault.is_connected(spec.name):
+                await self.try_refresh_token(spec)
+
+    def list_available(self) -> list[dict[str, Any]]:
+        connected = set(self.vault.list_connected())
+        return [
+            {
+                "name": s.name,
+                "display": s.display,
+                "icon": s.icon,
+                "category": s.category,
+                "description": s.description,
+                "setup_guide_url": s.setup_guide_url,
+                "connected": s.name in connected,
+                "auth_type": s.auth.type.value,
+                "required_fields": [
+                    f.model_dump() for f in s.auth.required_fields
+                ],
+            }
+            for s in self._specs
+        ]
+
+    async def get_tools(self) -> list[dict[str, Any]]:
+        """Discover tools for all connected connectors. Async — MCP servers are spawned per-spec."""
+        tools: list[dict[str, Any]] = []
+
+        for spec in self._specs:
+            if not self.vault.is_connected(spec.name):
+                continue
+
+            mcp_sources = spec.get_mcp_sources()
+            if mcp_sources:
+                try:
+                    adapter_tools = await _discover_mcp_tools(spec, self.vault, self.user_id)
+                    tools.extend(adapter_tools)
+                except Exception:
+                    logger.warning(f"Failed to load MCP connector '{spec.name}'", exc_info=True)
+                continue
+
+            try:
+                adapter_tools = self._load_cli_connector(spec)
+                tools.extend(adapter_tools)
+            except Exception:
+                logger.warning(f"Failed to load connector '{spec.name}'", exc_info=True)
+                continue
+
+        return tools
+
+    def get_tools_sync(self) -> list[dict[str, Any]]:
+        """Sync fallback — only discovers CLI tools. MCP sources are skipped."""
+        tools: list[dict[str, Any]] = []
+        for spec in self._specs:
+            if not self.vault.is_connected(spec.name):
+                continue
+            if spec.get_mcp_sources():
+                continue
+            try:
+                adapter_tools = self._load_cli_connector(spec)
+                tools.extend(adapter_tools)
+            except Exception:
+                continue
+        return tools
+
+    def _load_cli_connector(self, spec: ConnectorSpec) -> list[dict[str, Any]]:
+        namespace = spec.name.replace("-", "_")
+        all_tools: list[dict[str, Any]] = []
+
+        for source in spec.get_tool_sources():
+            try:
+                if source.type == ToolSourceType.CLI:
+                    adapter = CLIAdapter(spec, self.vault, self.user_id)
+                    if not adapter.is_available():
+                        logger.warning(
+                            f"CLI not available for {spec.name}. "
+                            f"Install: {source.install}"
+                        )
+                        continue
+                    all_tools.extend(adapter.discover_tools(namespace))
+            except Exception:
+                logger.warning(
+                    f"Failed to load tool source '{source.type}' for '{spec.name}'",
+                    exc_info=True,
+                )
+                continue
+
+        return all_tools
+
+    async def health(self) -> dict[str, Any]:
+        result: dict[str, Any] = {"status": "ok", "connectors": {}}
+        connected_count = 0
+        error_count = 0
+
+        for spec in self._specs:
+            if not self.vault.is_connected(spec.name):
+                result["connectors"][spec.name] = {"status": "not_connected"}
+                continue
+
+            connected_count += 1
+            try:
+                if spec.get_mcp_sources():
+                    mcp_tools = await _discover_mcp_tools(spec, self.vault, self.user_id)
+                    tools = mcp_tools
+                else:
+                    tools = self._load_cli_connector(spec)
+                result["connectors"][spec.name] = {
+                    "status": "ok",
+                    "tools": len(tools),
+                }
+            except Exception as e:
+                error_count += 1
+                result["connectors"][spec.name] = {
+                    "status": "error",
+                    "error": str(e),
+                }
+
+        if error_count > 0:
+            result["status"] = "broken" if error_count == connected_count else "partial"
+
+        return result
+
+
+def _make_mcp_invoker(command: str, env: dict[str, str], tool_name: str):
+    """Factory: returns async function that spawns MCP server, calls tool, returns result."""
+    async def ainvoke(**kwargs: Any) -> str:
+        from mcp import ClientSession, StdioServerParameters
+        from mcp.client.stdio import stdio_client
+
+        parts = command.split()
+        sp = StdioServerParameters(command=parts[0], args=parts[1:], env=env)
+        async with stdio_client(sp) as (read, write):
+            async with ClientSession(read, write) as session:
+                await session.initialize()
+                result = await session.call_tool(tool_name, arguments=kwargs)
+                return json.dumps(
+                    {c.type: c.text for c in result.content}
+                )
+    return ainvoke
+
+
+async def _discover_mcp_tools(
+    spec: ConnectorSpec, vault: CredentialVault, user_id: str
+) -> list[dict[str, Any]]:
+    """Spawn MCP server, list_tools(), convert to ConnectKit tool dicts."""
+    from mcp import ClientSession, StdioServerParameters
+    from mcp.client.stdio import stdio_client
+
+    adapter = MCPAdapter(spec, vault, user_id)
+    env = adapter.build_server_env()
+    namespace = spec.name.replace("-", "_")
+    parts = adapter.command.split()
+    server_params = StdioServerParameters(
+        command=parts[0], args=parts[1:], env=env
+    )
+
+    async with stdio_client(server_params) as (read, write):
+        async with ClientSession(read, write) as session:
+            await session.initialize()
+            result = await session.list_tools()
+
+            tools: list[dict[str, Any]] = []
+            for mcp_tool in result.tools:
+                input_schema = mcp_tool.inputSchema or {
+                    "type": "object",
+                    "properties": {},
+                }
+                tool_name = f"{namespace}__{mcp_tool.name}"
+                tools.append(
+                    {
+                        "name": tool_name,
+                        "description": mcp_tool.description or "",
+                        "parameters": input_schema,
+                        "function": None,
+                        "ainvoke": _make_mcp_invoker(
+                            adapter.command, env, mcp_tool.name
+                        ),
+                        "annotations": {
+                            "read_only": False,
+                            "destructive": False,
+                            "idempotent": False,
+                            "title": tool_name,
+                            "mcp_server": adapter.server_name,
+                            "_mcp_connector": spec.name,
+                        },
+                    }
+                )
+            return tools
+

{connectkit-0.1.0 → connectkit-0.1.2}/connectkit/vault.py

@@ -1,4 +1,4 @@
-"""CredentialVault — encrypted per-user token storage.
+"""CredentialVault — encrypted per-user token storage with OAuth2 refresh.
 
 Schema:
     CREATE TABLE credentials (
@@ -6,7 +6,8 @@ Schema:
         auth_type TEXT NOT NULL,
         encrypted_data TEXT NOT NULL,
         created_at TEXT NOT NULL,
-        updated_at TEXT NOT NULL
+        updated_at TEXT NOT NULL,
+        expires_at TEXT  -- nullable; set when OAuth tokens have an expiry
     );
 
     CREATE TABLE oauth_states (
@@ -20,23 +21,42 @@ Schema:
 """
 
 import json
+import logging
 import os
 import secrets
 import sqlite3
 import threading
 import warnings
-from contextlib import contextmanager
 from collections.abc import Generator
+from contextlib import contextmanager
 from datetime import UTC, datetime, timedelta
 from pathlib import Path
+from typing import Any
 
+import httpx
 from cryptography.fernet import Fernet
 
+logger = logging.getLogger("connectkit.vault")
+
 
 def _now_iso() -> str:
     return datetime.now(UTC).isoformat()
 
 
+def _parse_expiry(token_data: dict) -> str | None:
+    """Extract ISO expiry string from token data (expires_in or expires_at)."""
+    expires_in = token_data.get("expires_in")
+    if expires_in:
+        expires_at = datetime.now(UTC) + timedelta(seconds=int(expires_in))
+        return expires_at.isoformat()
+    expires_at = token_data.get("expires_at")
+    if expires_at:
+        if isinstance(expires_at, (int, float)):
+            expires_at = datetime.fromtimestamp(expires_at, tz=UTC).isoformat()
+        return str(expires_at)
+    return None
+
+
 def _get_or_create_key() -> bytes:
     import base64
     import hashlib
@@ -91,7 +111,8 @@ class CredentialVault:
                     auth_type TEXT NOT NULL,
                     encrypted_data TEXT NOT NULL,
                     created_at TEXT NOT NULL,
-                    updated_at TEXT NOT NULL
+                    updated_at TEXT NOT NULL,
+                    expires_at TEXT
                 )
             """)
             cur.execute("""
@@ -114,14 +135,15 @@ class CredentialVault:
     def store_token(self, service_name: str, auth_type: str, token_data: dict) -> None:
         now = _now_iso()
         encrypted = self._encrypt(token_data)
+        expires_at = _parse_expiry(token_data)
         with self._connect() as cur:
             cur.execute(
                 "INSERT OR REPLACE INTO credentials "
-                "(service_name, auth_type, encrypted_data, created_at, updated_at) "
+                "(service_name, auth_type, encrypted_data, created_at, updated_at, expires_at) "
                 "VALUES (?, ?, ?, COALESCE(("
                 "SELECT created_at FROM credentials WHERE service_name = ?"
-                "), ?), ?)",
-                (service_name, auth_type, encrypted, service_name, now, now),
+                "), ?), ?, ?)",
+                (service_name, auth_type, encrypted, service_name, now, now, expires_at),
             )
 
     def get_token(self, service_name: str) -> dict | None:
@@ -135,6 +157,30 @@ class CredentialVault:
             return None
         return self._decrypt(row["encrypted_data"])
 
+    def get_token_with_expiry(self, service_name: str) -> tuple[dict | None, str | None]:
+        """Return (token_data, expires_at_iso) or (None, None)."""
+        with self._connect() as cur:
+            cur.execute(
+                "SELECT encrypted_data, expires_at FROM credentials WHERE service_name = ?",
+                (service_name,),
+            )
+            row = cur.fetchone()
+        if not row:
+            return None, None
+        return self._decrypt(row["encrypted_data"]), row["expires_at"]
+
+    def is_expired(self, service_name: str) -> bool:
+        """Check if a token is past its expiry threshold (30s buffer)."""
+        _, expires_at = self.get_token_with_expiry(service_name)
+        if not expires_at:
+            return False
+        try:
+            expires_dt = datetime.fromisoformat(expires_at)
+            # 30-second buffer to avoid racing expiry
+            return datetime.now(UTC) >= (expires_dt - timedelta(seconds=30))
+        except Exception:
+            return False
+
     def delete_token(self, service_name: str) -> bool:
         with self._connect() as cur:
             cur.execute(

{connectkit-0.1.0 → connectkit-0.1.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "connectkit"
-version = "0.1.0"
+version = "0.1.2"
 description = "Connect AI agents to SaaS — one YAML file per service. OAuth, token vault, tool discovery."
 requires-python = ">=3.11"
 readme = "README.md"
@@ -27,6 +27,7 @@ dependencies = [
     "cryptography>=41.0",
     "httpx>=0.28",
     "fastapi>=0.129",
+    "mcp>=1.0.0",
 ]
 
 [project.optional-dependencies]

{connectkit-0.1.0 → connectkit-0.1.2}/tests/test_runtime.py

@@ -98,7 +98,6 @@ class TestInit:
         _write_specs(spec_dir, [_make_cli_spec("github")])
 
         rt = ConnectorRuntime(spec_dir, vault, "alice")
-        assert len(rt.get_specs()) == 1
 
         _write_specs(spec_dir, [_make_cli_spec("github"), _make_cli_spec("slack")])
         rt.reload()
@@ -134,15 +133,17 @@ class TestListAvailable:
 
 
 class TestGetTools:
-    def test_returns_nothing_when_nothing_connected(self, temp_dir, vault):
+    @pytest.mark.asyncio
+    async def test_returns_nothing_when_nothing_connected(self, temp_dir, vault):
         spec_dir = Path(temp_dir) / "connectors"
         _write_specs(spec_dir, [_make_cli_spec("github")])
 
         rt = ConnectorRuntime(spec_dir, vault, "alice")
-        tools = rt.get_tools()
+        tools = await rt.get_tools()
         assert tools == []
 
-    def test_returns_tools_for_connected_cli(self, temp_dir, vault):
+    @pytest.mark.asyncio
+    async def test_returns_tools_for_connected_cli(self, temp_dir, vault):
         spec_dir = Path(temp_dir) / "connectors"
         _write_specs(spec_dir, [_make_cli_spec("github")])
 
@@ -152,27 +153,26 @@ class TestGetTools:
 
         with patch("connectkit.backends.cli.CLIAdapter.list_commands",
                    return_value=["repo:list", "issue:create"]):
-            tools = rt.get_tools()
+            tools = await rt.get_tools()
 
         assert len(tools) == 2
         names = {t["name"] for t in tools}
         assert "github__repo_list" in names
         assert "github__issue_create" in names
 
-    def test_returns_mcp_placeholder(self, temp_dir, vault):
+    @pytest.mark.asyncio
+    async def test_skips_mcp_without_token(self, temp_dir, vault):
+        """MCP source without a stored token should be skipped (not connected)."""
         spec_dir = Path(temp_dir) / "connectors"
         _write_specs(spec_dir, [_make_mcp_spec("dropbox")])
 
-        vault.store_token("dropbox", "oauth2", {"access_token": "sl.123"})
-
         rt = ConnectorRuntime(spec_dir, vault, "alice")
-        tools = rt.get_tools()
+        tools = await rt.get_tools()
 
-        assert len(tools) == 1
-        assert tools[0]["name"] == "dropbox__mcp_status"
-        assert tools[0]["_is_mcp_placeholder"] is True
+        assert tools == []  # not connected, so skipped
 
-    def test_skips_broken_connector(self, temp_dir, vault):
+    @pytest.mark.asyncio
+    async def test_skips_broken_connector(self, temp_dir, vault):
         spec_dir = Path(temp_dir) / "connectors"
         _write_specs(spec_dir, [_make_cli_spec("github"), _make_cli_spec("slack")])
 
@@ -181,8 +181,7 @@ class TestGetTools:
 
         rt = ConnectorRuntime(spec_dir, vault, "alice")
 
-        # Let github work but make slack crash
-        original_load = rt._load_connector
+        original_load = rt._load_cli_connector
 
         call_count = 0
 
@@ -193,30 +192,31 @@ class TestGetTools:
                 raise RuntimeError("Slack adapter crash")
             return original_load(spec)
 
-        with patch.object(rt, "_load_connector", side_effect=mock_load):
-            tools = rt.get_tools()
+        with patch.object(rt, "_load_cli_connector", side_effect=mock_load):
+            tools = await rt.get_tools()
 
-        # Should return github tools only, not crash
         assert len(tools) >= 0
 
 
 class TestHealth:
-    def test_all_not_connected(self, temp_dir, vault):
+    @pytest.mark.asyncio
+    async def test_all_not_connected(self, temp_dir, vault):
         spec_dir = Path(temp_dir) / "connectors"
         _write_specs(spec_dir, [_make_cli_spec("github")])
 
         rt = ConnectorRuntime(spec_dir, vault, "alice")
-        h = rt.health()
+        h = await rt.health()
         assert h["status"] == "ok"
         assert h["connectors"]["github"]["status"] == "not_connected"
 
-    def test_connected_ok(self, temp_dir, vault):
+    @pytest.mark.asyncio
+    async def test_connected_ok(self, temp_dir, vault):
         spec_dir = Path(temp_dir) / "connectors"
         _write_specs(spec_dir, [_make_cli_spec("github")])
 
         vault.store_token("github", "api_key", {"api_key": "ghp_123"})
 
         rt = ConnectorRuntime(spec_dir, vault, "alice")
-        h = rt.health()
+        h = await rt.health()
         assert h["connectors"]["github"]["status"] == "ok"
-        assert h["connectors"]["github"]["tools"] >= 0
+        assert h["connectors"]["github"]["tools"] >= 0