mcp-server-appwrite 2.1.1__tar.gz → 2.1.3__tar.gz

{mcp_server_appwrite-2.1.1 → mcp_server_appwrite-2.1.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: mcp-server-appwrite
-Version: 2.1.1
+Version: 2.1.3
 Summary: Build and deploy application backends. Add authentication, PostgreSQL/MySQL databases, vector databases, storage, serverless functions, realtime, messaging, hosting, domains, CDN and firewall.
 License-File: LICENSE
 Requires-Python: >=3.12

{mcp_server_appwrite-2.1.1 → mcp_server_appwrite-2.1.3}/src/mcp_server_appwrite/apps/resource.py

@@ -2,6 +2,10 @@
 
 One HTML document (``assets/view.html``, plain JavaScript with no build step)
 renders every view; it picks one from the tool result's ``structuredContent``.
+Hosts cache UI resources by URI, so the tools point at
+``ui://appwrite/view/<hash of the HTML>``: a release that changes the view
+changes the URI, and hosts fetch it again. The bare ``ui://appwrite/view``
+still serves the current HTML for tool lists cached before versioning.
 It declares no CSP domains, so hosts apply SEP-1865's restrictive default: no
 network access and no external scripts. Every Appwrite read and write it makes
 is a ``tools/call`` the host proxies to this server under the user's own
@@ -11,6 +15,7 @@ credentials.
 from __future__ import annotations
 
 from functools import cache
+from hashlib import sha256
 from importlib.resources import files
 from typing import Any
 
@@ -23,14 +28,30 @@ from .protocol import MIME_TYPE
 META: dict[str, Any] = {"ui": {"csp": {}, "prefersBorder": True}}
 
 
+VERSION_LENGTH = 12
+"""Hex digits of the HTML's SHA-256 in the URI: enough that two releases
+never collide."""
+
+
 @cache
 def html() -> str:
     return files("mcp_server_appwrite.assets").joinpath("view.html").read_text()
 
 
+@cache
+def uri() -> str:
+    """The URI the tools point at, versioned by the HTML it serves."""
+    digest = sha256(html().encode("utf-8")).hexdigest()[:VERSION_LENGTH]
+    return f"{VIEW_URI}/{digest}"
+
+
+def serves(requested: str) -> bool:
+    return requested in (uri(), VIEW_URI)
+
+
 def resource() -> types.Resource:
     return types.Resource(
-        uri=VIEW_URI,
+        uri=uri(),
         name="Appwrite view",
         description=(
             "Interactive Appwrite view: table rows and deployment build logs."

{mcp_server_appwrite-2.1.1 → mcp_server_appwrite-2.1.3}/src/mcp_server_appwrite/apps/views.py

@@ -27,7 +27,8 @@ from typing import Any
 import mcp.types as types
 from appwrite_console.query import Query
 
-from ..constants import SHOW_TOOL_NAME, VIEW_URI, VIEW_WRITE_TOOL_NAME
+from ..constants import SHOW_TOOL_NAME, VIEW_WRITE_TOOL_NAME
+from . import resource
 
 Run = Callable[[dict[str, Any], bool], list[Any]]
 """Runs a hidden catalog tool from raw call arguments (``tool_name``,
@@ -278,10 +279,10 @@ def _show_tool() -> types.Tool:
             "additionalProperties": False,
         },
         _meta={
-            "ui": {"resourceUri": VIEW_URI, "visibility": ["model", "app"]},
+            "ui": {"resourceUri": resource.uri(), "visibility": ["model", "app"]},
             # The flat key hosts read before ``ui.resourceUri``; SEP-1865 drops
             # it at GA.
-            "ui/resourceUri": VIEW_URI,
+            "ui/resourceUri": resource.uri(),
         },
     )
 
@@ -307,7 +308,7 @@ def _write_tool() -> types.Tool:
             "required": ["tool_name", "arguments", "confirm_write"],
             "additionalProperties": False,
         },
-        _meta={"ui": {"resourceUri": VIEW_URI, "visibility": ["app"]}},
+        _meta={"ui": {"resourceUri": resource.uri(), "visibility": ["app"]}},
     )
 
 

{mcp_server_appwrite-2.1.1 → mcp_server_appwrite-2.1.3}/src/mcp_server_appwrite/data/docs_index.npz

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
-name: mcp_server_appwrite-2.1.1/src/mcp_server_appwrite/data/docs_index.npz
+name: mcp_server_appwrite-2.1.3/src/mcp_server_appwrite/data/docs_index.npz
 size: 35543664 bytes
 sha256: 61d266fdb9a958b272d1b351cc6ebd6e824b0d0fe294483703e0795e4b0580df

{mcp_server_appwrite-2.1.1 → mcp_server_appwrite-2.1.3}/src/mcp_server_appwrite/operator.py

@@ -33,7 +33,6 @@ from .constants import (
     SEARCH_TOOL_NAME,
     UPDATE_HINTS,
     VERBS,
-    VIEW_URI,
     WRITE_TOOL_NAME,
 )
 from .docs_search import DocsSearch
@@ -437,7 +436,7 @@ class Operator:
         if uri == CATALOG_URI:
             return [ReadResourceContents(self._cached_catalog_json, "application/json")]
 
-        if apps and uri == VIEW_URI:
+        if apps and view_resource.serves(uri):
             return [view_resource.read()]
 
         if (

{mcp_server_appwrite-2.1.1 → mcp_server_appwrite-2.1.3}/src/mcp_server_appwrite/server.py

@@ -988,8 +988,11 @@ def _perform_bounded_binary_client_call(
     if method.lower() != "get" or response_type != "json":
         raise RuntimeError(f"Unsupported bounded binary request for {tool_name}.")
 
+    # Merge by lowercased name: the SDK repeats the project header in the call's
+    # own headers with different casing, and both copies would be sent, which
+    # Appwrite reads as one comma-joined project ID that does not exist.
     request_headers = {
-        key: value
+        key.lower(): value
         for key, value in {**client._global_headers, **(headers or {})}.items()
         if value
     }

{mcp_server_appwrite-2.1.1 → mcp_server_appwrite-2.1.3}/tests/e2e/support.py

@@ -1027,6 +1027,11 @@ SCOPES = frozenset(
 APPS_SCOPES = frozenset({"rows.read", "rows.write", "functions.write", "sites.write"})
 """The scopes the MCP Apps views need on top of :data:`SCOPES`."""
 
+PNG = base64.b64decode(
+    "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAEhQGAhKmMIQAAAABJRU5ErkJggg=="
+)
+"""A 1x1 PNG: what Appwrite's image previews return, in miniature."""
+
 CUSTOM_ID = re.compile(r"[A-Za-z0-9][A-Za-z0-9._-]{0,35}")
 
 AUTH_PASSWORD_MAX = 2048
@@ -1122,17 +1127,27 @@ class Cloud:
             def _serve(self) -> None:
                 length = int(self.headers.get("Content-Length", "0") or 0)
                 body = self.rfile.read(length) if length else b""
-                headers = {name.lower(): value for name, value in self.headers.items()}
+                # A header sent twice reaches Appwrite as one comma-joined
+                # value, as the proxies in front of it combine them.
+                headers: dict[str, str] = {}
+                for name, value in self.headers.items():
+                    name = name.lower()
+                    headers[name] = (
+                        f"{headers[name]}, {value}" if name in headers else value
+                    )
                 status, payload = cloud._handle(self.command, self.path, headers, body)
-                content = b"" if payload is None else json.dumps(payload).encode()
+                if isinstance(payload, bytes):
+                    content, kind = payload, "image/png"
+                else:
+                    content = b"" if payload is None else json.dumps(payload).encode()
+                    # Appwrite answers 204 with an HTML content type, which the
+                    # Python SDK returns as raw bytes.
+                    kind = (
+                        "text/html; charset=UTF-8"
+                        if payload is None
+                        else "application/json"
+                    )
                 self.send_response(status)
-                # Appwrite answers 204 with an HTML content type, which the
-                # Python SDK returns as raw bytes.
-                kind = (
-                    "text/html; charset=UTF-8"
-                    if payload is None
-                    else "application/json"
-                )
                 self.send_header("Content-Type", kind)
                 self.send_header("Content-Length", str(len(content)))
                 self.end_headers()
@@ -1396,6 +1411,13 @@ class Cloud:
                 "bytesMax": 0,
                 "bytesUsed": 0,
             }
+        if match := re.fullmatch(
+            r"/v1/storage/buckets/([^/]+)/files/([^/]+)/preview", path
+        ):
+            need("files.read")
+            if match.group(1) not in project.buckets:
+                raise _Refusal(404, "storage_bucket_not_found", "Bucket not found")
+            return 200, PNG
         if match := re.fullmatch(r"/v1/storage/buckets/([^/]+)", path):
             need("buckets.read")
             if match.group(1) not in project.buckets:

{mcp_server_appwrite-2.1.1 → mcp_server_appwrite-2.1.3}/tests/e2e/test_apps.py

@@ -8,7 +8,9 @@ the view pages, refreshes, follows a build and saves an edit.
 checked to have reached no Appwrite write at all.
 """
 
+import hashlib
 import json
+import re
 import unittest
 from typing import Any
 
@@ -164,15 +166,18 @@ class AppsFlow(unittest.TestCase):
 
         listed = tools(self.host)
         show = listed["appwrite_show"]
+        # Hosts cache UI resources by URI, so the URI carries the HTML's hash:
+        # a release that changes the view makes hosts fetch it again.
+        uri = show["_meta"]["ui"]["resourceUri"]
+        self.assertRegex(uri, rf"^{re.escape(VIEW_URI)}/[0-9a-f]{{12}}$")
         self.assertEqual(
-            show["_meta"]["ui"],
-            {"resourceUri": VIEW_URI, "visibility": ["model", "app"]},
+            show["_meta"]["ui"], {"resourceUri": uri, "visibility": ["model", "app"]}
         )
-        self.assertEqual(show["_meta"]["ui/resourceUri"], VIEW_URI)
+        self.assertEqual(show["_meta"]["ui/resourceUri"], uri)
         self.assertTrue(show["annotations"]["readOnlyHint"])
         write = listed["appwrite_view_write"]
         self.assertEqual(
-            write["_meta"]["ui"], {"resourceUri": VIEW_URI, "visibility": ["app"]}
+            write["_meta"]["ui"], {"resourceUri": uri, "visibility": ["app"]}
         )
         self.assertTrue(write["annotations"]["destructiveHint"])
         # The operator tools are unchanged.
@@ -182,12 +187,13 @@ class AppsFlow(unittest.TestCase):
 
         _, response = self.host.call("resources/list")
         view = next(
-            each for each in response["result"]["resources"] if each["uri"] == VIEW_URI
+            each for each in response["result"]["resources"] if each["uri"] == uri
         )
         self.assertEqual(view["mimeType"], MIME_TYPE)
 
-        _, response = self.host.call("resources/read", {"uri": VIEW_URI})
+        _, response = self.host.call("resources/read", {"uri": uri})
         (contents,) = response["result"]["contents"]
+        self.assertEqual(contents["uri"], uri)
         self.assertEqual(contents["mimeType"], MIME_TYPE)
         # No CSP domains: the host's restrictive default, no network access.
         self.assertEqual(contents["_meta"]["ui"], {"csp": {}, "prefersBorder": True})
@@ -197,6 +203,12 @@ class AppsFlow(unittest.TestCase):
         # Appwrite data reaches the DOM as text only.
         self.assertNotIn("innerHTML", html)
         self.assertNotIn("insertAdjacentHTML", html)
+        digest = hashlib.sha256(html.encode("utf-8")).hexdigest()[:12]
+        self.assertEqual(uri, f"{VIEW_URI}/{digest}")
+
+        # Tool lists cached before the URI was versioned still resolve.
+        _, response = self.host.call("resources/read", {"uri": VIEW_URI})
+        self.assertEqual(response["result"]["contents"][0]["text"], html)
 
     def test_hosts_without_apps_are_not_offered_the_view(self):
         with self.server.client() as plain:
@@ -205,7 +217,7 @@ class AppsFlow(unittest.TestCase):
             self.assertNotIn("appwrite_view_write", listed)
             _, response = plain.call("resources/list")
             uris = {each["uri"] for each in response["result"]["resources"]}
-            self.assertNotIn(VIEW_URI, uris)
+            self.assertFalse(any(each.startswith(VIEW_URI) for each in uris))
 
         # A 2025-era client on the stateless transport lists tools without a
         # session, so its capabilities are unknown and the view is offered.

{mcp_server_appwrite-2.1.1 → mcp_server_appwrite-2.1.3}/tests/e2e/test_tools.py

@@ -10,10 +10,11 @@ anything else, ``appwrite_call_write_tool`` is destructive and refuses reads.
 so a refused call is checked to have made no Appwrite request at all.
 """
 
+import base64
 import unittest
 from typing import Any
 
-from support import TOKEN, Client, Cloud, Project, Server, collector
+from support import PNG, SCOPES, TOKEN, Client, Cloud, Project, Server, collector
 
 PROJECT = "6630f1a2b3c4d5e6f7a8"
 HINTS = ("readOnlyHint", "destructiveHint", "idempotentHint", "openWorldHint")
@@ -40,8 +41,8 @@ cloud: Cloud
 def setUpModule() -> None:
     global cloud
     cloud = Cloud()
-    cloud.add(Project(PROJECT))
-    cloud.grant(TOKEN, {PROJECT})
+    cloud.add(Project(PROJECT, buckets={"photos"}))
+    cloud.grant(TOKEN, {PROJECT}, SCOPES | {"files.read"})
 
 
 def tearDownModule() -> None:
@@ -210,6 +211,23 @@ class ToolsFlow(unittest.TestCase):
             wrong + 2,
         )
 
+    def test_binary_reads_reach_the_project(self):
+        # The SDK sends the project header in the call's own headers too; sent
+        # twice, Appwrite reads "id, id" and finds no such project.
+        result = self.call(
+            "appwrite_call_tool",
+            {
+                "tool_name": "storage_get_file_preview",
+                "project_id": PROJECT,
+                "arguments": {"bucket_id": "photos", "file_id": "sunrise", "width": 64},
+            },
+        )
+        self.assertFalse(result.get("isError"), result)
+        (image,) = result["content"]
+        self.assertEqual(image["type"], "image")
+        self.assertEqual(image["mimeType"], "image/png")
+        self.assertEqual(base64.b64decode(image["data"]), PNG)
+
 
 if __name__ == "__main__":
     unittest.main()