liberrex-mcp-server 0.1.0__tar.gz

liberrex_mcp_server-0.1.0/LICENSE

@@ -0,0 +1,28 @@
+Liberrex MCP server — Proprietary License
+
+Copyright (c) 2026 Liberrex. All rights reserved.
+
+1. Grant. Subject to these terms, Liberrex grants you a non-exclusive, non-transferable, revocable license to install and use
+   this software, unmodified or modified, solely to integrate your own applications with the Liberrex platform while you
+   (or the organisation you act for) hold a valid Liberrex subscription or a written evaluation agreement with Liberrex.
+
+2. Restrictions. You may not (a) use this software to access any service other than the Liberrex platform; (b) sell,
+   sublicense, rent or distribute it on its own, except as an unmodifiable part of your application delivered to your end
+   users; (c) remove or alter this notice; (d) use it to build a product that competes with the Liberrex platform.
+
+3. Ownership. Liberrex retains all rights, title and interest in this software. No other rights are granted, by implication
+   or otherwise.
+
+4. Termination. This license ends automatically when your Liberrex subscription or evaluation ends, or if you breach these
+   terms. On termination you must stop using the software.
+
+5. No warranty. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT.
+
+6. Limitation of liability. TO THE MAXIMUM EXTENT PERMITTED BY LAW, LIBERREX SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL,
+   SPECIAL OR CONSEQUENTIAL DAMAGES ARISING FROM THE USE OF THE SOFTWARE.
+
+7. Your agreement with Liberrex. If you have a signed agreement with Liberrex that covers this software, that agreement
+   prevails over these terms.
+
+Contact: https://ai.liberrex.com

liberrex_mcp_server-0.1.0/PKG-INFO

@@ -0,0 +1,212 @@
+Metadata-Version: 2.4
+Name: liberrex-mcp-server
+Version: 0.1.0
+Summary: Publish a platform's tools on the Liberrex MCP mesh (peer keys, per-call user identity, permissions), plus the Liberrex AI MCP server.
+Author: Liberrex
+License: Liberrex MCP server — Proprietary License
+        
+        Copyright (c) 2026 Liberrex. All rights reserved.
+        
+        1. Grant. Subject to these terms, Liberrex grants you a non-exclusive, non-transferable, revocable license to install and use
+           this software, unmodified or modified, solely to integrate your own applications with the Liberrex platform while you
+           (or the organisation you act for) hold a valid Liberrex subscription or a written evaluation agreement with Liberrex.
+        
+        2. Restrictions. You may not (a) use this software to access any service other than the Liberrex platform; (b) sell,
+           sublicense, rent or distribute it on its own, except as an unmodifiable part of your application delivered to your end
+           users; (c) remove or alter this notice; (d) use it to build a product that competes with the Liberrex platform.
+        
+        3. Ownership. Liberrex retains all rights, title and interest in this software. No other rights are granted, by implication
+           or otherwise.
+        
+        4. Termination. This license ends automatically when your Liberrex subscription or evaluation ends, or if you breach these
+           terms. On termination you must stop using the software.
+        
+        5. No warranty. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY,
+           FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT.
+        
+        6. Limitation of liability. TO THE MAXIMUM EXTENT PERMITTED BY LAW, LIBERREX SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL,
+           SPECIAL OR CONSEQUENTIAL DAMAGES ARISING FROM THE USE OF THE SOFTWARE.
+        
+        7. Your agreement with Liberrex. If you have a signed agreement with Liberrex that covers this software, that agreement
+           prevails over these terms.
+        
+        Contact: https://ai.liberrex.com
+        
+Project-URL: Homepage, https://ai.liberrex.com
+Keywords: liberrex,mcp,model-context-protocol,ai,agents,integration
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Operating System :: OS Independent
+Classifier: Intended Audience :: Developers
+Classifier: Typing :: Typed
+Classifier: License :: Other/Proprietary License
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: mcp<3,>=2.3
+Requires-Dist: httpx>=0.27
+Requires-Dist: pydantic>=2
+Requires-Dist: uvicorn>=0.30
+Provides-Extra: dev
+Requires-Dist: pytest>=7; extra == "dev"
+Requires-Dist: pytest-asyncio>=0.23; extra == "dev"
+Requires-Dist: respx>=0.21; extra == "dev"
+Requires-Dist: uvicorn>=0.30; extra == "dev"
+Dynamic: license-file
+
+# liberrex-mcp-server (Python)
+
+Publish a platform's tools on the **Liberrex MCP mesh**, so that Liberrex AI, Animatoria, the ERP and any other
+platform of the ecosystem can call them. It follows the shared [mesh conventions](../../MCP_MESH.md): peer keys,
+per-call user identity, permissions, write control and `[code]` errors. The package also ships the **Liberrex AI
+platform server** (`liberrex-mcp-server`): agents, copilot and sales intelligence (next best action, next best
+product…) as tools.
+
+- Python ≥ 3.10, built on the official `mcp` SDK v2. Stateless Streamable HTTP (any instance answers any call) or stdio.
+- Pair it with [`liberrex-mcp-client`](../../mcp-client/python) on the calling side.
+- TypeScript equivalent: [`@liberrex/mcp-server`](../typescript).
+
+```bash
+pip install liberrex-mcp-server
+```
+
+## Publish your platform's tools
+
+```python
+from typing import Optional
+from liberrex_mcp_server import PeerRegistry, PlatformError, PlatformServer, ToolContext
+
+server = PlatformServer("erp", title="Acme ERP", peers=PeerRegistry.from_env())
+
+@server.tool(permission="invoices.read", category="finance")
+def overdue_invoices(ctx: ToolContext, customer: Optional[str] = None, limit: int = 20) -> dict:
+    """Overdue invoices the user can see, oldest first."""
+    user = ctx.require_identity()            # who the call acts for: user_id, tenant_id, roles, locale
+    rows = invoices.overdue(tenant=user.tenant_id, user=user.user_id, customer=customer, limit=limit)
+    if rows is None:
+        raise PlatformError("not_found", "Unknown customer")      # → "[not_found] Unknown customer"
+    return {"items": rows}
+
+@server.tool(permission="invoices.write", write=True)
+async def send_reminder(ctx: ToolContext, invoice_id: str) -> dict:
+    """Send a payment reminder."""
+    ...
+```
+
+Then serve it:
+
+```python
+app.mount("/mcp", server.asgi())       # FastAPI / Starlette; the endpoint answers at /mcp/
+server.run_http(port=8765)             # standalone, at /mcp
+server.run_stdio()                     # local desktop clients
+```
+
+The SDK checks these before your function runs:
+
+| check | refusal |
+|---|---|
+| The `Authorization: Bearer` key is a valid (not expired) key of a configured peer | HTTP 401 `[unauthorized]` |
+| At most `rate_per_minute × 10` HTTP requests per minute from that peer (flood guard) | HTTP 429 + `Retry-After` |
+| At most `rate_per_minute` tool calls per minute from that peer | `[rate_limited]` |
+| The identity's tenant is one the peer may act in | `[tenant_not_allowed]` |
+| The identity's roles, capped by the peer's `roles`, include the tool's `permission` | `[forbidden]` / `[identity_required]` |
+| `write=True` tools only for peers with `writes` | `[writes_disabled]` |
+| At most 4 platform hops | `[too_many_hops]` |
+| Any other exception: logged, and not leaked to the caller | `[internal_error] <tool> failed` |
+
+Sync functions run in a worker thread, so they may block, for example on a database call. Use
+`ctx.forward_meta()` when a tool calls another platform: the same person and trace go along, with `hops + 1`.
+
+### Already integrated with the Liberrex copilot?
+
+Publish every tool you declared with `liberrex_copilot` in one line. The schemas, permission checks and error codes stay
+the same:
+
+```python
+from liberrex_mcp_server.copilot import publish_copilot
+publish_copilot(server, copilot, user=lambda identity: load_user_with_roles(identity))
+```
+
+This is how Animatoria publishes its 43 tools at `/mcp`. The `user` callback lets your platform compute the user's
+roles itself, rather than trust the roles the caller sends.
+
+### Tools that already have a JSON Schema
+
+```python
+server.raw_tool("lookup", description="…", input_schema={"type": "object", "properties": {...}},
+                handler=lambda ctx, arguments: ...)
+```
+
+## Peers (who may call)
+
+```bash
+liberrex-mcp-server new-key liberrex-ai     # prints a key for the caller and the sha256 entry for you
+```
+
+```bash
+LIBERREX_MCP_PEERS='{"liberrex-ai": {"keys": [{"key": "sha256:…", "expires": "2027-01-31"}, "sha256:…"],
+                                     "tenants": "*", "writes": false, "rate_per_minute": 300},
+                     "erp": {"key": "sha256:…", "tenants": ["acme"], "roles": ["invoices.read"]}}'
+LIBERREX_MCP_PEERS_FILE=/etc/erp/mcp-peers.json    # or: the same JSON in a file, re-read when it changes
+```
+
+| field | meaning | default |
+|---|---|---|
+| `key` / `keys` | `sha256:<64 hex>` (preferred) or the raw key (24 characters at least); or `{"key", "expires": "YYYY-MM-DD"}`: valid until the end of that UTC day | required |
+| `tenants` | `"*"` or the tenant ids the peer may act in | `"*"` |
+| `writes` | may call `write=True` tools | `false` |
+| `roles` | ceiling: the identity's roles are intersected with it | none |
+| `rate_per_minute` | tool calls per minute (1 to 10,000), per process; HTTP requests are capped at 10× that | `120` |
+
+Keep only hashes on the server, give each caller its own key, and grant `writes` only where needed. Rotate with an
+overlap: add the new hash to `keys`, give the caller the new key, then remove the old hash (or let its `expires` pass).
+`python -m liberrex_mcp_server.keys <peer>` also prints a key and its hash.
+
+With `LIBERREX_MCP_PEERS_FILE` (`FilePeerRegistry`), the file is re-read when its mtime changes (checked at most every
+2 s): revoke a caller without a restart. Invalid at startup → `PeerConfigError`; invalid later → logged, the previous
+peers stay; missing → no caller is accepted.
+
+### Audit
+
+Every tool call (`ok` / `refused` / `error`) and every refused HTTP request (`unauthorized`, `rate_limited`) produces one
+event for `PlatformServer(..., audit=fn)` (default: a JSON line on the `liberrex_mcp_server.audit` logger; `None`: off):
+`at`, `platform`, `event`, `tool`, `write`, `peer`, `user`, `tenant`, `trace_id`, `origin`, `hops`, `status`, `code`,
+`duration_ms` (and `client` for HTTP events). Tool arguments are never included. The fields are the same in the
+TypeScript server; see [MCP_MESH.md §6](../../MCP_MESH.md).
+
+## The Liberrex AI platform server
+
+```bash
+liberrex-mcp-server --check                     # credentials, peers, tools
+liberrex-mcp-server --transport http --port 8765   # the mesh endpoint at /mcp (needs LIBERREX_MCP_PEERS)
+liberrex-mcp-server                              # stdio for Claude Desktop / Cursor (acts as LIBERREX_USER_ID)
+```
+
+| Variable | Meaning |
+|---|---|
+| `LIBERREX_API_URL` | Liberrex API (default `https://ai-api.liberrex.com`) |
+| `LIBERREX_API_KEY` | Developer API key `key_id:secret`: agents, conversations, usage (company-wide tools) |
+| `LIBERREX_SECRET_KEY` | Embedded copilot key `lxsk_…`: copilot and surfaces, **for the identity of each call** |
+| `LIBERREX_SURFACES` | `next_best_action=nba-queue,next_best_product=nbp-queue`: modes of `sales_recommendations` |
+| `LIBERREX_MCP_PEERS` / `LIBERREX_MCP_PEERS_FILE` | Platforms allowed to call (see above) |
+| `LIBERREX_USER_ID`, `LIBERREX_TENANT_ID`, `LIBERREX_USER_ROLES`, `LIBERREX_LOCALE` | stdio only: the user a desktop client acts as |
+| `LIBERREX_MCP_READ_ONLY` | `1` leaves out confirm_action, create_action_batch and end_conversation |
+
+The 20 tools are:
+
+| Group | Tools |
+|---|---|
+| Agents | whoami, list_agents, get_agent, ask_agent, list_copilot_agents, start_agent_group, ask_agent_group, get_agent_group, list_conversations, get_conversation, end_conversation, get_usage |
+| Copilot | copilot_ask, copilot_list_threads, copilot_get_thread |
+| Sales intelligence | sales_recommendations, render_surface, suggest_field, run_surface_action, create_action_batch, confirm_action, cancel_action, record_feedback |
+| Billing | get_copilot_usage |
+
+Each calling user gets their own copilot session, minted for the `user.id` and `tenant.id` the calling platform sends.
+Recommendations are therefore computed from that user's own data, under their own roles.
+
+## Development
+
+```bash
+python3.12 -m venv .venv && .venv/bin/pip install -e ".[dev]" -e ../../mcp-client/python -e ../../python
+.venv/bin/pytest      # 39 tests, including server ↔ client end to end over HTTP
+```

liberrex_mcp_server-0.1.0/README.md

@@ -0,0 +1,156 @@
+# liberrex-mcp-server (Python)
+
+Publish a platform's tools on the **Liberrex MCP mesh**, so that Liberrex AI, Animatoria, the ERP and any other
+platform of the ecosystem can call them. It follows the shared [mesh conventions](../../MCP_MESH.md): peer keys,
+per-call user identity, permissions, write control and `[code]` errors. The package also ships the **Liberrex AI
+platform server** (`liberrex-mcp-server`): agents, copilot and sales intelligence (next best action, next best
+product…) as tools.
+
+- Python ≥ 3.10, built on the official `mcp` SDK v2. Stateless Streamable HTTP (any instance answers any call) or stdio.
+- Pair it with [`liberrex-mcp-client`](../../mcp-client/python) on the calling side.
+- TypeScript equivalent: [`@liberrex/mcp-server`](../typescript).
+
+```bash
+pip install liberrex-mcp-server
+```
+
+## Publish your platform's tools
+
+```python
+from typing import Optional
+from liberrex_mcp_server import PeerRegistry, PlatformError, PlatformServer, ToolContext
+
+server = PlatformServer("erp", title="Acme ERP", peers=PeerRegistry.from_env())
+
+@server.tool(permission="invoices.read", category="finance")
+def overdue_invoices(ctx: ToolContext, customer: Optional[str] = None, limit: int = 20) -> dict:
+    """Overdue invoices the user can see, oldest first."""
+    user = ctx.require_identity()            # who the call acts for: user_id, tenant_id, roles, locale
+    rows = invoices.overdue(tenant=user.tenant_id, user=user.user_id, customer=customer, limit=limit)
+    if rows is None:
+        raise PlatformError("not_found", "Unknown customer")      # → "[not_found] Unknown customer"
+    return {"items": rows}
+
+@server.tool(permission="invoices.write", write=True)
+async def send_reminder(ctx: ToolContext, invoice_id: str) -> dict:
+    """Send a payment reminder."""
+    ...
+```
+
+Then serve it:
+
+```python
+app.mount("/mcp", server.asgi())       # FastAPI / Starlette; the endpoint answers at /mcp/
+server.run_http(port=8765)             # standalone, at /mcp
+server.run_stdio()                     # local desktop clients
+```
+
+The SDK checks these before your function runs:
+
+| check | refusal |
+|---|---|
+| The `Authorization: Bearer` key is a valid (not expired) key of a configured peer | HTTP 401 `[unauthorized]` |
+| At most `rate_per_minute × 10` HTTP requests per minute from that peer (flood guard) | HTTP 429 + `Retry-After` |
+| At most `rate_per_minute` tool calls per minute from that peer | `[rate_limited]` |
+| The identity's tenant is one the peer may act in | `[tenant_not_allowed]` |
+| The identity's roles, capped by the peer's `roles`, include the tool's `permission` | `[forbidden]` / `[identity_required]` |
+| `write=True` tools only for peers with `writes` | `[writes_disabled]` |
+| At most 4 platform hops | `[too_many_hops]` |
+| Any other exception: logged, and not leaked to the caller | `[internal_error] <tool> failed` |
+
+Sync functions run in a worker thread, so they may block, for example on a database call. Use
+`ctx.forward_meta()` when a tool calls another platform: the same person and trace go along, with `hops + 1`.
+
+### Already integrated with the Liberrex copilot?
+
+Publish every tool you declared with `liberrex_copilot` in one line. The schemas, permission checks and error codes stay
+the same:
+
+```python
+from liberrex_mcp_server.copilot import publish_copilot
+publish_copilot(server, copilot, user=lambda identity: load_user_with_roles(identity))
+```
+
+This is how Animatoria publishes its 43 tools at `/mcp`. The `user` callback lets your platform compute the user's
+roles itself, rather than trust the roles the caller sends.
+
+### Tools that already have a JSON Schema
+
+```python
+server.raw_tool("lookup", description="…", input_schema={"type": "object", "properties": {...}},
+                handler=lambda ctx, arguments: ...)
+```
+
+## Peers (who may call)
+
+```bash
+liberrex-mcp-server new-key liberrex-ai     # prints a key for the caller and the sha256 entry for you
+```
+
+```bash
+LIBERREX_MCP_PEERS='{"liberrex-ai": {"keys": [{"key": "sha256:…", "expires": "2027-01-31"}, "sha256:…"],
+                                     "tenants": "*", "writes": false, "rate_per_minute": 300},
+                     "erp": {"key": "sha256:…", "tenants": ["acme"], "roles": ["invoices.read"]}}'
+LIBERREX_MCP_PEERS_FILE=/etc/erp/mcp-peers.json    # or: the same JSON in a file, re-read when it changes
+```
+
+| field | meaning | default |
+|---|---|---|
+| `key` / `keys` | `sha256:<64 hex>` (preferred) or the raw key (24 characters at least); or `{"key", "expires": "YYYY-MM-DD"}`: valid until the end of that UTC day | required |
+| `tenants` | `"*"` or the tenant ids the peer may act in | `"*"` |
+| `writes` | may call `write=True` tools | `false` |
+| `roles` | ceiling: the identity's roles are intersected with it | none |
+| `rate_per_minute` | tool calls per minute (1 to 10,000), per process; HTTP requests are capped at 10× that | `120` |
+
+Keep only hashes on the server, give each caller its own key, and grant `writes` only where needed. Rotate with an
+overlap: add the new hash to `keys`, give the caller the new key, then remove the old hash (or let its `expires` pass).
+`python -m liberrex_mcp_server.keys <peer>` also prints a key and its hash.
+
+With `LIBERREX_MCP_PEERS_FILE` (`FilePeerRegistry`), the file is re-read when its mtime changes (checked at most every
+2 s): revoke a caller without a restart. Invalid at startup → `PeerConfigError`; invalid later → logged, the previous
+peers stay; missing → no caller is accepted.
+
+### Audit
+
+Every tool call (`ok` / `refused` / `error`) and every refused HTTP request (`unauthorized`, `rate_limited`) produces one
+event for `PlatformServer(..., audit=fn)` (default: a JSON line on the `liberrex_mcp_server.audit` logger; `None`: off):
+`at`, `platform`, `event`, `tool`, `write`, `peer`, `user`, `tenant`, `trace_id`, `origin`, `hops`, `status`, `code`,
+`duration_ms` (and `client` for HTTP events). Tool arguments are never included. The fields are the same in the
+TypeScript server; see [MCP_MESH.md §6](../../MCP_MESH.md).
+
+## The Liberrex AI platform server
+
+```bash
+liberrex-mcp-server --check                     # credentials, peers, tools
+liberrex-mcp-server --transport http --port 8765   # the mesh endpoint at /mcp (needs LIBERREX_MCP_PEERS)
+liberrex-mcp-server                              # stdio for Claude Desktop / Cursor (acts as LIBERREX_USER_ID)
+```
+
+| Variable | Meaning |
+|---|---|
+| `LIBERREX_API_URL` | Liberrex API (default `https://ai-api.liberrex.com`) |
+| `LIBERREX_API_KEY` | Developer API key `key_id:secret`: agents, conversations, usage (company-wide tools) |
+| `LIBERREX_SECRET_KEY` | Embedded copilot key `lxsk_…`: copilot and surfaces, **for the identity of each call** |
+| `LIBERREX_SURFACES` | `next_best_action=nba-queue,next_best_product=nbp-queue`: modes of `sales_recommendations` |
+| `LIBERREX_MCP_PEERS` / `LIBERREX_MCP_PEERS_FILE` | Platforms allowed to call (see above) |
+| `LIBERREX_USER_ID`, `LIBERREX_TENANT_ID`, `LIBERREX_USER_ROLES`, `LIBERREX_LOCALE` | stdio only: the user a desktop client acts as |
+| `LIBERREX_MCP_READ_ONLY` | `1` leaves out confirm_action, create_action_batch and end_conversation |
+
+The 20 tools are:
+
+| Group | Tools |
+|---|---|
+| Agents | whoami, list_agents, get_agent, ask_agent, list_copilot_agents, start_agent_group, ask_agent_group, get_agent_group, list_conversations, get_conversation, end_conversation, get_usage |
+| Copilot | copilot_ask, copilot_list_threads, copilot_get_thread |
+| Sales intelligence | sales_recommendations, render_surface, suggest_field, run_surface_action, create_action_batch, confirm_action, cancel_action, record_feedback |
+| Billing | get_copilot_usage |
+
+Each calling user gets their own copilot session, minted for the `user.id` and `tenant.id` the calling platform sends.
+Recommendations are therefore computed from that user's own data, under their own roles.
+
+## Development
+
+```bash
+python3.12 -m venv .venv && .venv/bin/pip install -e ".[dev]" -e ../../mcp-client/python -e ../../python
+.venv/bin/pytest      # 39 tests, including server ↔ client end to end over HTTP
+```

liberrex_mcp_server-0.1.0/pyproject.toml

@@ -0,0 +1,45 @@
+[build-system]
+requires = ["setuptools>=61", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "liberrex-mcp-server"
+version = "0.1.0"
+description = "Publish a platform's tools on the Liberrex MCP mesh (peer keys, per-call user identity, permissions), plus the Liberrex AI MCP server."
+readme = "README.md"
+requires-python = ">=3.10"
+license = { file = "LICENSE" }
+authors = [{ name = "Liberrex" }]
+keywords = ["liberrex", "mcp", "model-context-protocol", "ai", "agents", "integration"]
+classifiers = [
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3 :: Only",
+  "Operating System :: OS Independent",
+  "Intended Audience :: Developers",
+  "Typing :: Typed",
+  "License :: Other/Proprietary License",
+]
+dependencies = ["mcp>=2.3,<3", "httpx>=0.27", "pydantic>=2", "uvicorn>=0.30"]
+
+[project.optional-dependencies]
+dev = ["pytest>=7", "pytest-asyncio>=0.23", "respx>=0.21", "uvicorn>=0.30"]
+
+[project.scripts]
+liberrex-mcp-server = "liberrex_mcp_server.liberrex.cli:main"
+
+[project.urls]
+Homepage = "https://ai.liberrex.com"
+
+[tool.setuptools]
+package-dir = { "" = "src" }
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-data]
+liberrex_mcp_server = ["py.typed"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+addopts = "-q"
+asyncio_mode = "auto"

liberrex_mcp_server-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

liberrex_mcp_server-0.1.0/src/liberrex_mcp_server/__init__.py

@@ -0,0 +1,10 @@
+"""liberrex-mcp-server — publish a platform's tools on the Liberrex MCP mesh (and the Liberrex AI server itself)."""
+
+__version__ = "0.1.0"
+
+from .mesh import META_IDENTITY, META_TOOL, META_TRACE, Identity, PlatformError, Trace  # noqa: E402
+from .peers import Peer, PeerConfigError, PeerRegistry, new_key  # noqa: E402
+from .server import PlatformServer, ToolContext  # noqa: E402
+
+__all__ = ["__version__", "PlatformServer", "ToolContext", "Identity", "Trace", "PlatformError", "Peer", "PeerRegistry",
+           "PeerConfigError", "new_key", "META_IDENTITY", "META_TRACE", "META_TOOL"]

liberrex_mcp_server-0.1.0/src/liberrex_mcp_server/__main__.py

@@ -0,0 +1,3 @@
+from .liberrex.cli import main
+
+raise SystemExit(main())

liberrex_mcp_server-0.1.0/src/liberrex_mcp_server/copilot.py

@@ -0,0 +1,66 @@
+"""
+Publish the tools a platform already declared for the Liberrex copilot (``liberrex_copilot.Copilot``) on the mesh.
+
+    from liberrex_copilot import Copilot
+    from liberrex_mcp_server import PlatformServer, PeerRegistry
+    from liberrex_mcp_server.copilot import publish_copilot
+
+    server = PlatformServer("animatoria", peers=PeerRegistry.from_env())
+    publish_copilot(server, copilot, user=lambda identity: {...})   # every copilot tool, same schema, same checks
+
+Each mesh call becomes a local copilot call (``copilot.execute``) for the identity it carries: the copilot's own
+permission check (``tool.permission`` against the user's roles), argument coercion, result size limits and error codes
+apply unchanged. ``user(identity)`` maps the mesh identity to the copilot user — typically the platform loads the user
+and computes its roles itself instead of trusting roles sent by the caller. Write tools (``kind="write"``) are mesh
+write tools: peers need ``writes``, and the caller must have the human's approval (there is no confirmation card here).
+"""
+from __future__ import annotations
+
+from typing import Any, Callable, Dict, Iterable, Optional
+
+from .mesh import ERROR_CODES, Identity, PlatformError
+from .server import PlatformServer, ToolContext
+
+CODE_MAP = {"invalid_arguments": "invalid_request", "unknown_tool": "not_found", "timeout": "upstream_error",
+            "not_configured": "upstream_error", "ambiguous": "invalid_request"}
+
+
+def default_user(identity: Identity) -> Dict[str, Any]:
+    user: Dict[str, Any] = {"id": identity.user_id, "roles": list(identity.roles)}
+    for key in ("name", "email", "locale"):
+        if getattr(identity, key):
+            user[key] = getattr(identity, key)
+    return user
+
+
+def publish_copilot(server: PlatformServer, copilot: Any, *, user: Optional[Callable[[Identity], Dict[str, Any]]] = None,
+                    include: Optional[Iterable[str]] = None, exclude: Iterable[str] = (), writes: bool = True) -> list:
+    """Register the copilot's enabled tools on ``server``; returns their names. ``writes=False`` leaves out write tools."""
+    to_user = user or default_user
+    wanted = set(include) if include is not None else None
+    skipped = set(exclude)
+    names = []
+    for tool in copilot.tools.values():
+        if not tool.enabled or tool.name in skipped or (wanted is not None and tool.name not in wanted):
+            continue
+        write = tool.kind == "write"
+        if write and not writes:
+            continue
+
+        def handler(ctx: ToolContext, arguments: Dict[str, Any], _name: str = tool.name) -> Any:
+            identity = ctx.require_identity()
+            call = {"call_id": ctx.trace.id or "mesh", "tool": _name, "arguments": arguments, "user": to_user(identity),
+                    "tenant": {"id": identity.tenant_id, **({"name": identity.tenant_name} if identity.tenant_name else {})},
+                    "session_id": "mesh:%s" % (ctx.peer.name), "thread_id": None, "locale": identity.locale}
+            result = copilot.execute(call)
+            if not result.get("ok"):
+                error = result.get("error") or {}
+                code = CODE_MAP.get(error.get("code"), error.get("code"))
+                raise PlatformError(code if code in ERROR_CODES else "upstream_error", error.get("message") or "The tool failed")
+            data = result.get("data")
+            return data if data is not None else {"ok": True}
+
+        server.raw_tool(tool.name, description=tool.description or tool.name, input_schema=tool.input_schema, handler=handler,
+                        write=write, destructive=write, category=tool.output_hint)
+        names.append(tool.name)
+    return names

liberrex_mcp_server-0.1.0/src/liberrex_mcp_server/keys.py

@@ -0,0 +1,17 @@
+"""``python -m liberrex_mcp_server.keys [peer-name]``: a new peer key and the hash to configure on the server."""
+import json
+import sys
+
+from .peers import new_key
+
+
+def main() -> int:
+    name = sys.argv[1] if len(sys.argv) > 1 else "my-platform"
+    key, digest = new_key()
+    print("Give this key to %s (its LIBERREX_MCP_PLATFORMS entry), it is shown once:\n  %s\n" % (name, key))
+    print("Add this to the server's LIBERREX_MCP_PEERS:\n  %s" % json.dumps({name: {"key": digest, "tenants": "*", "writes": False}}))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

liberrex_mcp_server-0.1.0/src/liberrex_mcp_server/liberrex/__init__.py

@@ -0,0 +1,5 @@
+"""The Liberrex AI platform server (agents, copilot, sales intelligence) built on PlatformServer."""
+
+from .client import LiberrexClient, LiberrexError  # noqa: F401
+from .config import ConfigurationError, Settings  # noqa: F401
+from .tools import PLATFORM, build_server  # noqa: F401

liberrex_mcp_server-0.1.0/src/liberrex_mcp_server/liberrex/cli.py

@@ -0,0 +1,102 @@
+"""
+``liberrex-mcp-server``: run the Liberrex AI platform server.
+
+  liberrex-mcp-server                      stdio, for a desktop MCP client (acts as LIBERREX_USER_ID / LIBERREX_TENANT_ID)
+  liberrex-mcp-server --transport http     the mesh endpoint at /mcp, for the other platforms (LIBERREX_MCP_PEERS)
+  liberrex-mcp-server --check              check the credentials, list the tools
+  liberrex-mcp-server new-key <platform>   a key for a calling platform and the hash to put in LIBERREX_MCP_PEERS
+"""
+from __future__ import annotations
+
+import argparse
+import asyncio
+import json
+import logging
+import os
+import sys
+from typing import Optional, Sequence
+
+from .. import __version__
+from ..peers import PeerConfigError, PeerRegistry, new_key, peers_dict
+from .client import LiberrexClient, LiberrexError
+from .config import ConfigurationError, Settings, mask
+
+
+def _parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(prog="liberrex-mcp-server",
+                                     description="Liberrex AI on the Liberrex MCP mesh. Configuration: LIBERREX_* environment variables.")
+    parser.add_argument("command", nargs="?", choices=("serve", "new-key"), default="serve")
+    parser.add_argument("name", nargs="?", help="new-key: the calling platform's name")
+    parser.add_argument("--transport", choices=("stdio", "http"), default=os.environ.get("LIBERREX_MCP_TRANSPORT", "stdio"))
+    parser.add_argument("--host", default=os.environ.get("LIBERREX_MCP_HOST", "127.0.0.1"))
+    parser.add_argument("--port", type=int, default=int(os.environ.get("LIBERREX_MCP_PORT", "8765")))
+    parser.add_argument("--path", default="/mcp", help="HTTP path of the MCP endpoint")
+    parser.add_argument("--base-url", help="Liberrex API URL (default: LIBERREX_API_URL or https://ai-api.liberrex.com)")
+    parser.add_argument("--read-only", action="store_true", default=None, help="Leave out the tools that change data")
+    parser.add_argument("--check", action="store_true", help="Check the credentials and peers, list the tools, and exit")
+    parser.add_argument("--version", action="version", version="liberrex-mcp-server " + __version__)
+    return parser
+
+
+def main(argv: Optional[Sequence[str]] = None) -> int:
+    args = _parser().parse_args(argv)
+    logging.basicConfig(level=os.environ.get("LIBERREX_MCP_LOG_LEVEL", "WARNING"), stream=sys.stderr,
+                        format="%(asctime)s %(name)s %(levelname)s %(message)s")
+    if args.command == "new-key":
+        key, digest = new_key()
+        name = args.name or "my-platform"
+        print("Key for %s (shown once; put it in its LIBERREX_MCP_PLATFORMS entry):\n  %s\n" % (name, key))
+        print("Entry for this server's LIBERREX_MCP_PEERS:\n  %s" % json.dumps({name: {"key": digest, "tenants": "*", "writes": False}}))
+        return 0
+    try:
+        settings = Settings.from_env(base_url=args.base_url, read_only=args.read_only)
+        peers = PeerRegistry.from_env()
+    except (ConfigurationError, PeerConfigError) as failure:
+        print("liberrex-mcp-server: " + str(failure), file=sys.stderr)
+        return 2
+    from .tools import build_server
+    server = build_server(settings, peers)
+    if args.check:
+        return asyncio.run(_check(settings, peers, server))
+    if args.transport == "stdio":
+        server.run_stdio()
+        return 0
+    if not len(peers):
+        print("liberrex-mcp-server: set LIBERREX_MCP_PEERS (the platforms allowed to call this server)", file=sys.stderr)
+        return 2
+    print("liberrex-mcp-server %s on http://%s:%s%s — peers: %s" % (
+        __version__, args.host, args.port, args.path, ", ".join(p.name for p in peers)), file=sys.stderr)
+    server.run_http(args.host, args.port, args.path)
+    return 0
+
+
+async def _check(settings: Settings, peers: PeerRegistry, server) -> int:
+    ok = True
+    print("Liberrex API: %s" % settings.base_url)
+    async with LiberrexClient(settings) as client:
+        if client.api:
+            try:
+                me = await client.api.request("GET", "/me")
+                print("✓ developer API key %s — %s (%s), plan %s" % (
+                    mask(settings.api_key), (me.get("company") or {}).get("name"), me["owner"]["email"], me.get("plan")))
+            except LiberrexError as failure:
+                ok = False
+                print("✗ developer API key %s — %s" % (mask(settings.api_key), failure))
+        if client.copilot:
+            identity = settings.default_identity
+            if identity:
+                try:
+                    await client.copilot.token(identity)
+                    print("✓ copilot key %s — session for %s in tenant %s" % (mask(settings.secret_key), identity.user_id, identity.tenant_id))
+                except LiberrexError as failure:
+                    ok = False
+                    print("✗ copilot key %s — %s" % (mask(settings.secret_key), failure))
+            else:
+                print("· copilot key %s — not checked (no LIBERREX_USER_ID / LIBERREX_TENANT_ID; mesh calls bring their own user)"
+                      % mask(settings.secret_key))
+            for mode, key in settings.surfaces.items():
+                print("  mode %s → surface %s" % (mode, key))
+    print("peers: %s" % (json.dumps(peers_dict(peers)) if len(peers) else "none (stdio only)"))
+    tools = await server.mcp.list_tools()
+    print("%d tools: %s" % (len(tools), ", ".join(t.name for t in tools)))
+    return 0 if ok else 1