daknode-mcp 0.3.4__tar.gz → 0.3.5__tar.gz

{daknode_mcp-0.3.4 → daknode_mcp-0.3.5}/PKG-INFO

@@ -1,9 +1,11 @@
 Metadata-Version: 2.4
 Name: daknode-mcp
-Version: 0.3.4
+Version: 0.3.5
 Summary: DakNode's email and calendar API tools over local and authenticated remote MCP.
 Project-URL: Homepage, https://daknode.com
-Project-URL: Documentation, https://daknode.com/developers
+Project-URL: Documentation, https://daknode.com/integrations/mcp/
+Project-URL: Security, https://daknode.com/security/reporting/
+Keywords: daknode,mcp,email,calendar,developer-tools
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 Requires-Dist: daknode<0.4,>=0.3.9
@@ -13,7 +15,7 @@ Requires-Dist: mcp<3,>=2.2
 
 <!-- mcp-name: io.github.Subodh103/daknode -->
 
-DakNode MCP 0.3.4 exposes 21 email and calendar API tools over **stdio**,
+DakNode MCP 0.3.5 exposes 21 email and calendar API tools over **stdio**,
 including availability, reliable booking, reminders and recurring-event edits.
 An authenticated hosted endpoint is also available at
 `https://api.daknode.com/mcp`; local installation does not connect to it or
@@ -45,8 +47,13 @@ checkout, `"command": "python", "args": ["-m", "mcp_server.server"]`.
 
 The key comes from the environment and **never from a command-line argument**:
 argv is visible to every process through `ps`, and shells record it in history.
-The server refuses to start without it, so a misconfiguration is obvious at
-launch rather than looking like a broken tool.
+Version 0.3.5 supports
+credential-free local `initialize`, `tools/list` and empty `prompts/list`, so a
+client can inspect static schemas before setup. Every operation still requires credentials and fails with structured
+`authentication_required` setup guidance if the key is missing; no API request
+is sent. Configure the key privately, then restart/reconnect the client.
+Hosted MCP authentication and permission-filtered discovery are unchanged:
+this is not anonymous access to the remote endpoint or to customer data.
 
 ## Tools
 

{daknode_mcp-0.3.4 → daknode_mcp-0.3.5}/README.md

@@ -2,7 +2,7 @@
 
 <!-- mcp-name: io.github.Subodh103/daknode -->
 
-DakNode MCP 0.3.4 exposes 21 email and calendar API tools over **stdio**,
+DakNode MCP 0.3.5 exposes 21 email and calendar API tools over **stdio**,
 including availability, reliable booking, reminders and recurring-event edits.
 An authenticated hosted endpoint is also available at
 `https://api.daknode.com/mcp`; local installation does not connect to it or
@@ -34,8 +34,13 @@ checkout, `"command": "python", "args": ["-m", "mcp_server.server"]`.
 
 The key comes from the environment and **never from a command-line argument**:
 argv is visible to every process through `ps`, and shells record it in history.
-The server refuses to start without it, so a misconfiguration is obvious at
-launch rather than looking like a broken tool.
+Version 0.3.5 supports
+credential-free local `initialize`, `tools/list` and empty `prompts/list`, so a
+client can inspect static schemas before setup. Every operation still requires credentials and fails with structured
+`authentication_required` setup guidance if the key is missing; no API request
+is sent. Configure the key privately, then restart/reconnect the client.
+Hosted MCP authentication and permission-filtered discovery are unchanged:
+this is not anonymous access to the remote endpoint or to customer data.
 
 ## Tools
 

{daknode_mcp-0.3.4 → daknode_mcp-0.3.5}/daknode_mcp.egg-info/PKG-INFO

@@ -1,9 +1,11 @@
 Metadata-Version: 2.4
 Name: daknode-mcp
-Version: 0.3.4
+Version: 0.3.5
 Summary: DakNode's email and calendar API tools over local and authenticated remote MCP.
 Project-URL: Homepage, https://daknode.com
-Project-URL: Documentation, https://daknode.com/developers
+Project-URL: Documentation, https://daknode.com/integrations/mcp/
+Project-URL: Security, https://daknode.com/security/reporting/
+Keywords: daknode,mcp,email,calendar,developer-tools
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 Requires-Dist: daknode<0.4,>=0.3.9
@@ -13,7 +15,7 @@ Requires-Dist: mcp<3,>=2.2
 
 <!-- mcp-name: io.github.Subodh103/daknode -->
 
-DakNode MCP 0.3.4 exposes 21 email and calendar API tools over **stdio**,
+DakNode MCP 0.3.5 exposes 21 email and calendar API tools over **stdio**,
 including availability, reliable booking, reminders and recurring-event edits.
 An authenticated hosted endpoint is also available at
 `https://api.daknode.com/mcp`; local installation does not connect to it or
@@ -45,8 +47,13 @@ checkout, `"command": "python", "args": ["-m", "mcp_server.server"]`.
 
 The key comes from the environment and **never from a command-line argument**:
 argv is visible to every process through `ps`, and shells record it in history.
-The server refuses to start without it, so a misconfiguration is obvious at
-launch rather than looking like a broken tool.
+Version 0.3.5 supports
+credential-free local `initialize`, `tools/list` and empty `prompts/list`, so a
+client can inspect static schemas before setup. Every operation still requires credentials and fails with structured
+`authentication_required` setup guidance if the key is missing; no API request
+is sent. Configure the key privately, then restart/reconnect the client.
+Hosted MCP authentication and permission-filtered discovery are unchanged:
+this is not anonymous access to the remote endpoint or to customer data.
 
 ## Tools
 

{daknode_mcp-0.3.4 → daknode_mcp-0.3.5}/daknode_mcp.egg-info/SOURCES.txt

@@ -21,4 +21,5 @@ daknode_mcp.egg-info/entry_points.txt
 daknode_mcp.egg-info/requires.txt
 daknode_mcp.egg-info/top_level.txt
 tests/test_calendar_scheduling.py
+tests/test_local_discovery.py
 tests/test_write_tools.py

{daknode_mcp-0.3.4 → daknode_mcp-0.3.5}/pyproject.toml

@@ -7,10 +7,11 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "daknode-mcp"
-version = "0.3.4"
+version = "0.3.5"
 description = "DakNode's email and calendar API tools over local and authenticated remote MCP."
 readme = "README.md"
 requires-python = ">=3.10"
+keywords = ["daknode", "mcp", "email", "calendar", "developer-tools"]
 dependencies = [
     "daknode>=0.3.9,<0.4",
     "mcp>=2.2,<3",
@@ -18,7 +19,8 @@ dependencies = [
 
 [project.urls]
 Homepage = "https://daknode.com"
-Documentation = "https://daknode.com/developers"
+Documentation = "https://daknode.com/integrations/mcp/"
+Security = "https://daknode.com/security/reporting/"
 
 [project.scripts]
 daknode-mcp = "daknode_mcp.server:main"

{daknode_mcp-0.3.4 → daknode_mcp-0.3.5}/server.py

@@ -172,11 +172,7 @@ def _version() -> str:
 
 
 class MissingApiKey(RuntimeError):
-    """No credential. Raised at STARTUP, not at first tool call.
-
-    A server that starts happily and then fails every call looks like a broken
-    tool rather than a missing setting, and the person debugging it is an agent.
-    """
+    """No operation credential. Static local discovery needs no SDK client."""
 
 
 def _client():
@@ -228,6 +224,15 @@ def _execute(operation, **kwargs):
     try:
         with _client() as client:
             return _result(operation(client=client, **kwargs))
+    except MissingApiKey:
+        return _failure(
+            "authentication_required",
+            "Configure DAKNODE_API_KEY privately in your MCP client's environment, "
+            "then restart or reconnect. Create an account at "
+            "https://console.daknode.com/sign-up or read "
+            "https://daknode.com/developers/. Never paste the key into chat. "
+            "No API operation was performed.",
+        )
     except httpx.TimeoutException:
         return _failure("timeout", "API timeout; write outcome may be unknown. Reuse the same idempotency key for any send retry.", retryable=True)
     except httpx.RequestError:
@@ -545,11 +550,8 @@ def build_server() -> MCPServer:
 
 
 def main() -> int:  # pragma: no cover - process entry point
-    try:
-        _client()
-    except MissingApiKey as exc:
-        print(f"daknode-mcp: {exc}", file=sys.stderr)
-        return 2
+    # Local discovery exposes static schemas only. Each operation still calls
+    # _client(), which refuses absent credentials before constructing transport.
     build_server().run()
     return 0
 

daknode_mcp-0.3.5/tests/test_local_discovery.py

@@ -0,0 +1,148 @@
+"""Credential-free local metadata; operations and remote access stay protected."""
+import asyncio
+import json
+import os
+from pathlib import Path
+import sys
+
+import pytest
+from mcp import ClientSession, StdioServerParameters
+from mcp.client.stdio import stdio_client
+
+from mcp_server import server
+
+ID = "11111111-1111-4111-8111-111111111111"
+IDS = {"inbox_id": ID, "event_id": ID}
+WINDOW = {"start": "2030-11-04T09:00:00Z", "end": "2030-11-04T17:00:00Z"}
+EVENT = {"title": "Synthetic test", "timezone": "UTC", "starts_at": WINDOW["start"], "ends_at": WINDOW["end"]}
+ARGS = {
+    "create_inbox": {"alias": "synthetic"},
+    "list_threads": {"inbox_id": ID}, "list_messages": {"inbox_id": ID},
+    "get_thread": {"thread_id": ID}, "get_message": {"message_id": ID},
+    "search": {"query": "private-input-sentinel"},
+    "send": {"inbox_id": ID, "to": "synthetic@example.test", "subject": "Synthetic", "body_text": "No send", "idempotency_key": "synthetic-operation"},
+    "get_calendar_event": IDS,
+    "create_calendar_event": {"inbox_id": ID, "event": EVENT, "idempotency_key": "synthetic-operation"},
+    "update_calendar_event": {**IDS, "revision": 1, "patch": {"description": "Synthetic"}},
+    "cancel_calendar_event": {**IDS, "revision": 1},
+    "respond_calendar_event": {**IDS, "revision": 1, "response": "accepted"},
+    "send_calendar_invitations": {**IDS, "revision": 1, "idempotency_key": "synthetic-operation"},
+    "list_calendar_events": {"inbox_id": ID},
+    "get_calendar_agenda": {"inbox_id": ID, **WINDOW},
+    "get_calendar_free_busy": {"inbox_id": ID, "request": WINDOW},
+    "get_calendar_availability": {"inbox_id": ID, "request": {**WINDOW, "timezone": "UTC", "working_hours": [{"weekday": 0, "start": "09:00", "end": "17:00"}], "duration_minutes": 30, "step_minutes": 15}},
+    "book_calendar_event": {"inbox_id": ID, "booking": {"event": EVENT}, "idempotency_key": "synthetic-operation"},
+    "get_calendar_reminders": IDS,
+    "set_calendar_reminders": {**IDS, "revision": 1, "minutes_before_start": [15]},
+    "edit_calendar_series": {**IDS, "revision": 1, "edit": {"scope": "series", "changes": {"description": "Synthetic"}}, "idempotency_key": "synthetic-operation"},
+}
+
+
+def assert_setup_refusal(result):
+    assert result.is_error, result
+    payload = json.loads(result.content[0].text)
+    assert payload["error"]["code"] == "authentication_required"
+    assert "https://console.daknode.com/sign-up" in payload["error"]["message"]
+    assert "privately" in payload["error"]["message"]
+    assert "private-input-sentinel" not in result.content[0].text
+
+
+def test_no_new_tool_or_fake_prompt_is_introduced(monkeypatch):
+    monkeypatch.delenv("DAKNODE_API_KEY", raising=False)
+    def forbidden(*args, **kwargs):
+        pytest.fail("Discovery constructed an authenticated client")
+    monkeypatch.setattr(server, "_client", forbidden)
+    async def run():
+        adapter = server.build_server()
+        assert {tool.name for tool in await adapter.list_tools()} == set(ARGS) == server.TOOL_NAMES
+        assert await adapter.list_prompts() == []
+    asyncio.run(run())
+
+
+@pytest.mark.parametrize("name", sorted(ARGS))
+@pytest.mark.parametrize("key", [None, "", " \t\n"])
+def test_every_valid_operation_refuses_missing_credentials_before_transport(monkeypatch, name, key):
+    if key is None:
+        monkeypatch.delenv("DAKNODE_API_KEY", raising=False)
+    else:
+        monkeypatch.setenv("DAKNODE_API_KEY", key)
+    def forbidden(*args, **kwargs):
+        pytest.fail("No key must mean no HTTP transport")
+    monkeypatch.setattr(server, "BoundedTransport", forbidden)
+    result = asyncio.run(server.build_server().call_tool(name, ARGS[name]))
+    assert_setup_refusal(result)
+
+
+def test_main_does_not_construct_a_client_or_write_protocol_noise(monkeypatch, capsys):
+    monkeypatch.delenv("DAKNODE_API_KEY", raising=False)
+    ran = []
+    class Adapter:
+        def run(self):
+            ran.append(True)
+    monkeypatch.setattr(server, "build_server", Adapter)
+    monkeypatch.setattr(server, "_client", lambda: pytest.fail("Startup must not build an operation client"))
+    assert server.main() == 0
+    assert ran == [True]
+    captured = capsys.readouterr()
+    assert captured.out == captured.err == ""
+
+
+def test_actual_stdio_initialize_discovery_and_refusal_without_key(monkeypatch):
+    monkeypatch.delenv("DAKNODE_API_KEY", raising=False)
+    # A real child process, not the already-installed public0.3.4 entry point.
+    # Deny sockets so this can never hit a real API even if the guard regresses.
+    bootstrap = (
+        "import runpy,socket; "
+        "socket.socket.connect=lambda *a,**k: (_ for _ in ()).throw(RuntimeError('Network forbidden in discovery test')); "
+        "runpy.run_module('mcp_server.server',run_name='__main__')"
+    )
+    params = StdioServerParameters(command=sys.executable, args=["-c", bootstrap],
+        cwd=str(Path(__file__).resolve().parents[2]), env={"PATH": os.defpath})
+    async def run():
+        async with stdio_client(params) as (reader, writer):
+            async with ClientSession(reader, writer) as client:
+                await client.initialize()
+                tools = await client.list_tools()
+                assert {tool.name for tool in tools.tools} == server.TOOL_NAMES
+                assert (await client.list_prompts()).prompts == []
+                for name in ("list_messages", "send", "book_calendar_event"):
+                    assert_setup_refusal(await client.call_tool(name, ARGS[name]))
+                assert len((await client.list_tools()).tools) == 21
+    asyncio.run(run())
+
+
+@pytest.mark.parametrize("status", [200, 403])
+def test_actual_stdio_first_read_uses_authenticated_sdk_and_preserves_refusal(status):
+    """Real MCP wire and generated client, synthetic HTTP only, no sockets."""
+    bootstrap = f'''
+import httpx, socket
+from mcp_server import server
+socket.socket.connect = lambda *a, **k: (_ for _ in ()).throw(RuntimeError("Network forbidden"))
+def handle(request):
+    assert request.method == "GET"
+    assert str(request.url) == "https://api.daknode.com/v1/inboxes/{ID}/messages?limit=5"
+    assert request.headers["authorization"] == "Bearer synthetic-onboarding-only"
+    assert request.headers["accept-encoding"] == "identity"
+    return httpx.Response({status}, json={{"items": [], "has_more": False, "next_cursor": None}} if {status} == 200 else {{"error": {{"code": "forbidden"}}}})
+server.BoundedTransport = lambda: httpx.MockTransport(handle)
+server.main()
+'''
+    params = StdioServerParameters(command=sys.executable, args=["-c", bootstrap],
+        cwd=str(Path(__file__).resolve().parents[2]),
+        env={"PATH": os.defpath, "DAKNODE_API_KEY": "synthetic-onboarding-only"})
+
+    async def run():
+        async with stdio_client(params) as (reader, writer):
+            async with ClientSession(reader, writer) as client:
+                await client.initialize()
+                assert "list_messages" in {tool.name for tool in (await client.list_tools()).tools}
+                result = await client.call_tool("list_messages", {"inbox_id": ID, "limit": 5})
+                text = " ".join(block.text for block in result.content if hasattr(block, "text"))
+                assert "synthetic-onboarding-only" not in text
+                if status == 200:
+                    assert not result.is_error
+                    assert json.loads(text)["items"] == []
+                else:
+                    assert result.is_error
+                    assert "403" in text
+    asyncio.run(run())