rootly-mcp-server 2.2.16__tar.gz → 2.2.18__tar.gz

{rootly_mcp_server-2.2.16 → rootly_mcp_server-2.2.18}/CHANGELOG.md

@@ -5,6 +5,50 @@ All notable changes to the Rootly MCP Server will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.2.18] - Released 2026-04-15
+
+### Features
+
+- **Workflow Task Tools**: Added complete workflow task management tools to enable creation, listing, retrieval, and updating of workflow actions/tasks
+- **Enhanced Workflow Functionality**: Users can now build complete functional workflows instead of just workflow shells
+
+### New Tools
+
+- `createWorkflowTask` - Create new workflow actions (POST `/v1/workflows/{workflow_id}/workflow_tasks`)
+- `listWorkflowTasks` - List all actions in a workflow (GET `/v1/workflows/{workflow_id}/workflow_tasks`)  
+- `getWorkflowTask` - Retrieve specific workflow action details (GET `/v1/workflow_tasks/{id}`)
+- `updateWorkflowTask` - Modify existing workflow actions (PUT `/v1/workflow_tasks/{id}`)
+
+### Documentation
+
+- **Tool Count Updated**: Increased from 105 to 109 tools reflecting new workflow task capabilities
+- **Tool List Updated**: Added workflow task tools to OpenAPI-generated tools section
+- **Badge Cleanup**: Removed broken Cursor install badge
+
+### Security
+
+- **Delete Operations**: `deleteWorkflowTask` remains intentionally excluded following security policy for destructive operations
+
+## [2.2.17] - Released 2026-04-14
+
+### Fixes
+
+- **Critical HTTP Streamable Transport Fix**: Fixed Route configuration where `stateless_http=False` caused `streamable_methods=None`, breaking the `/mcp` endpoint
+- **Transport Reliability**: Always allow POST and DELETE methods for HTTP streamable endpoints, resolving "streamable HTTP not working" reports
+- **Client Configuration**: Added transport flag explanation in README to prevent auto-fallback from HTTP streamable to SSE
+
+### Security
+
+- **Dependency Updates**: Updated `cryptography` from 46.0.6 to 46.0.7 (CVE fix)
+- **Testing Framework**: Updated `pytest` from 8.0.0 to 9.0.3 (CVE fix)
+- **Vulnerability Resolution**: Addressed 2 medium severity Dependabot alerts
+
+### Documentation
+
+- **Transport Recommendations**: Restored Streamable HTTP as recommended transport (now that it's fixed)
+- **Configuration Examples**: Fixed Claude Code transport option from `http-only` to `http`
+- **User Guidance**: Added explanatory notes for forcing HTTP streamable transport in clients
+
 ## [2.2.16] - Released 2026-04-13
 
 ### Enhanced

{rootly_mcp_server-2.2.16 → rootly_mcp_server-2.2.18}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rootly-mcp-server
-Version: 2.2.16
+Version: 2.2.18
 Summary: Secure Model Context Protocol server for Rootly APIs with AI SRE capabilities, comprehensive error handling, and input validation
 Project-URL: Homepage, https://github.com/Rootly-AI-Labs/Rootly-MCP-server
 Project-URL: Issues, https://github.com/Rootly-AI-Labs/Rootly-MCP-server/issues
@@ -23,7 +23,7 @@ Classifier: Topic :: System :: Systems Administration
 Requires-Python: >=3.12
 Requires-Dist: authlib>=1.6.9
 Requires-Dist: brotli>=1.2.0
-Requires-Dist: cryptography>=46.0.6
+Requires-Dist: cryptography>=46.0.7
 Requires-Dist: fastmcp[code-mode]==3.2.0
 Requires-Dist: httpx==0.28.1
 Requires-Dist: numpy>=1.24.0
@@ -46,7 +46,6 @@ Description-Content-Type: text/markdown
 [![PyPI version](https://badge.fury.io/py/rootly-mcp-server.svg)](https://pypi.org/project/rootly-mcp-server/)
 [![PyPI - Downloads](https://img.shields.io/pypi/dm/rootly-mcp-server)](https://pypi.org/project/rootly-mcp-server/)
 [![Python Version](https://img.shields.io/pypi/pyversions/rootly-mcp-server.svg)](https://pypi.org/project/rootly-mcp-server/)
-[![Install MCP Server](https://cursor.com/deeplink/mcp-install-dark.svg)](https://cursor.com/install-mcp?name=rootly&config=eyJ1cmwiOiJodHRwczovL21jcC5yb290bHkuY29tL3NzZSIsImhlYWRlcnMiOnsiQXV0aG9yaXphdGlvbiI6IkJlYXJlciA8WU9VUl9ST09UTFlfQVBJX1RPS0VOPiJ9fQ==)
 
 An MCP server for the [Rootly API](https://docs.rootly.com/api-reference/overview) for Cursor, Windsurf, Claude, and other MCP clients.
 
@@ -59,7 +58,7 @@ Use the hosted MCP server. No local installation required.
 ### Hosted Transport Options
 
 - **Streamable HTTP (recommended):** `https://mcp.rootly.com/mcp`
-- **SSE (fallback):** `https://mcp.rootly.com/sse`
+- **SSE (stable alternative):** `https://mcp.rootly.com/sse`
 - **Code Mode:** `https://mcp.rootly.com/mcp-codemode`
 
 ### General Remote Setup
@@ -79,7 +78,7 @@ Default remote config (HTTP streamable):
 }
 ```
 
-SSE fallback:
+SSE (alternative):
 
 ```json
 {
@@ -130,7 +129,7 @@ claude mcp add rootly-codemode --transport http https://mcp.rootly.com/mcp-codem
   --header "Authorization: Bearer YOUR_ROOTLY_API_TOKEN"
 ```
 
-SSE fallback:
+SSE (alternative):
 
 ```bash
 claude mcp add --transport sse rootly-sse https://mcp.rootly.com/sse \
@@ -145,8 +144,8 @@ Create `.mcp.json` in your project root:
 {
   "mcpServers": {
     "rootly": {
-      "type": "sse",
-      "url": "https://mcp.rootly.com/sse",
+      "type": "http",
+      "url": "https://mcp.rootly.com/mcp",
       "headers": {
         "Authorization": "Bearer YOUR_ROOTLY_API_TOKEN"
       }
@@ -254,6 +253,8 @@ bearer_token_env_var = "ROOTLY_API_TOKEN"
 
 Add to `claude_desktop_config.json`:
 
+> **Note:** The `--transport http` flag ensures HTTP streamable transport is used instead of auto-falling back to SSE.
+
 ```json
 {
   "mcpServers": {
@@ -263,6 +264,8 @@ Add to `claude_desktop_config.json`:
         "-y",
         "mcp-remote",
         "https://mcp.rootly.com/mcp",
+        "--transport",
+        "http",
         "--header",
         "Authorization: Bearer <YOUR_ROOTLY_API_TOKEN>"
       ]
@@ -273,6 +276,36 @@ Add to `claude_desktop_config.json`:
 
 </details>
 
+## ChatGPT App Starter
+
+The server now includes a built-in ChatGPT app surface for incident exploration.
+
+- **Model-visible app tool:** `open_rootly_incident_workbench`
+- **App-only detail tool:** `get_rootly_incident_detail`
+- **UI resource:** `ui://rootly/incident-workbench.html`
+
+This gives ChatGPT a visual Rootly incident workbench without needing a separate backend.
+
+### What it does
+
+- Applies structured incident filters such as team, time range, severity, and status
+- Collects a bounded set of incident summaries for the widget
+- Lets the widget open a detailed incident pane without exposing the detail tool to the model
+
+### Try it in ChatGPT Developer Mode
+
+Once the MCP server is connected in ChatGPT Developer Mode, try prompts like:
+
+- `Open the Rootly incident workbench for Infrastructure incidents from the last 7 days`
+- `Show me resolved critical incidents for Infrastructure from April 1 through April 13`
+- `Open the Rootly incident workbench for database timeout incidents`
+
+### Production auth note
+
+For internal testing and developer-mode setups, the existing bearer-token flow is enough.
+
+For a public ChatGPT app that exposes customer-specific data or write actions, plan to add OAuth 2.1 support on the MCP side before submission. The current Rootly MCP server forwards bearer tokens, but public Apps SDK submissions expect OAuth 2.1-compatible MCP authorization metadata and token verification.
+
 ## Rootly CLI
 
 Standalone CLI for incidents, alerts, services, and on-call operations.
@@ -394,7 +427,7 @@ docker run -p 8000:8000 \
 ## Features
 
 - **Dynamic Tool Generation**: Automatically creates MCP resources from Rootly's OpenAPI (Swagger) specification
-- **Smart Pagination**: Defaults to 10 items per request for incident endpoints to prevent context window overflow
+- **Smart Pagination**: Uses bounded pagination and compact incident responses to prevent context window overflow
 - **API Filtering**: Limits exposed API endpoints for security and performance
 - **Intelligent Incident Analysis**: Smart tools that analyze historical incident data
   - **`find_related_incidents`**: Uses TF-IDF similarity analysis to find historically similar incidents
@@ -405,12 +438,13 @@ docker run -p 8000:8000 \
 
 ## Supported Tools
 
-The default server configuration exposes **105 tools**.
+The default server configuration exposes **110 tools**.
 
 ### Custom Agentic Tools
 
 - `check_oncall_health_risk`
 - `check_responder_availability`
+- `collect_incidents`
 - `create_override_recommendation`
 - `find_related_incidents`
 - `getIncident` - retrieve a single incident for direct verification, including PIR-related fields
@@ -421,7 +455,9 @@ The default server configuration exposes **105 tools**.
 - `get_server_version`
 - `get_shift_incidents`
 - `list_endpoints`
+- `list_incidents`
 - `list_shifts`
+- `open_rootly_incident_workbench`
 - `search_incidents`
 - `suggest_solutions`
 - `updateIncident` - scoped incident update tool for `summary` and `retrospective_progress_status`
@@ -438,6 +474,7 @@ createEscalationPath
 createEscalationPolicy
 createFunctionality
 createIncidentActionItem
+createIncidentFormFieldSelection
 createIncidentType
 createOnCallRole
 createOnCallShadow
@@ -450,6 +487,7 @@ createService
 createSeverity
 createTeam
 createWorkflow
+createWorkflowTask
 deleteEscalationLevel
 deleteEscalationPath
 deleteEscalationPolicy
@@ -462,6 +500,7 @@ getEscalationLevel
 getEscalationPath
 getEscalationPolicy
 getFunctionality
+getIncidentFormFieldSelection
 getIncidentType
 getOnCallRole
 getOnCallShadow
@@ -474,6 +513,7 @@ getSeverity
 getTeam
 getUser
 getWorkflow
+getWorkflowTask
 listAlerts
 listEnvironments
 listEscalationLevels
@@ -483,6 +523,7 @@ listEscalationPolicies
 listFunctionalities
 listIncidentActionItems
 listIncidentAlerts
+listIncidentFormFieldSelections
 listIncident_Types
 listOnCallRoles
 listOnCallShadows
@@ -497,12 +538,14 @@ listShifts
 listTeams
 listUsers
 listWorkflows
+listWorkflowTasks
 updateAlert
 updateEnvironment
 updateEscalationLevel
 updateEscalationPath
 updateEscalationPolicy
 updateFunctionality
+updateIncidentFormFieldSelection
 updateIncidentType
 updateOnCallRole
 updateOnCallShadow
@@ -514,6 +557,7 @@ updateSeverity
 updateTeam
 updateUser
 updateWorkflow
+updateWorkflowTask
 ```
 
 Delete operations are intentionally scoped to screenshot coverage paths:
@@ -532,7 +576,7 @@ Set the `ONCALLHEALTH_API_KEY` environment variable:
   "mcpServers": {
     "rootly": {
       "command": "uvx",
-      "args": ["rootly-mcp-server"],
+      "args": ["--from", "rootly-mcp-server", "rootly-mcp-server"],
       "env": {
         "ROOTLY_API_TOKEN": "your_rootly_token",
         "ONCALLHEALTH_API_KEY": "och_live_your_key"

{rootly_mcp_server-2.2.16 → rootly_mcp_server-2.2.18}/README.md

@@ -4,7 +4,6 @@
 [![PyPI version](https://badge.fury.io/py/rootly-mcp-server.svg)](https://pypi.org/project/rootly-mcp-server/)
 [![PyPI - Downloads](https://img.shields.io/pypi/dm/rootly-mcp-server)](https://pypi.org/project/rootly-mcp-server/)
 [![Python Version](https://img.shields.io/pypi/pyversions/rootly-mcp-server.svg)](https://pypi.org/project/rootly-mcp-server/)
-[![Install MCP Server](https://cursor.com/deeplink/mcp-install-dark.svg)](https://cursor.com/install-mcp?name=rootly&config=eyJ1cmwiOiJodHRwczovL21jcC5yb290bHkuY29tL3NzZSIsImhlYWRlcnMiOnsiQXV0aG9yaXphdGlvbiI6IkJlYXJlciA8WU9VUl9ST09UTFlfQVBJX1RPS0VOPiJ9fQ==)
 
 An MCP server for the [Rootly API](https://docs.rootly.com/api-reference/overview) for Cursor, Windsurf, Claude, and other MCP clients.
 
@@ -17,7 +16,7 @@ Use the hosted MCP server. No local installation required.
 ### Hosted Transport Options
 
 - **Streamable HTTP (recommended):** `https://mcp.rootly.com/mcp`
-- **SSE (fallback):** `https://mcp.rootly.com/sse`
+- **SSE (stable alternative):** `https://mcp.rootly.com/sse`
 - **Code Mode:** `https://mcp.rootly.com/mcp-codemode`
 
 ### General Remote Setup
@@ -37,7 +36,7 @@ Default remote config (HTTP streamable):
 }
 ```
 
-SSE fallback:
+SSE (alternative):
 
 ```json
 {
@@ -88,7 +87,7 @@ claude mcp add rootly-codemode --transport http https://mcp.rootly.com/mcp-codem
   --header "Authorization: Bearer YOUR_ROOTLY_API_TOKEN"
 ```
 
-SSE fallback:
+SSE (alternative):
 
 ```bash
 claude mcp add --transport sse rootly-sse https://mcp.rootly.com/sse \
@@ -103,8 +102,8 @@ Create `.mcp.json` in your project root:
 {
   "mcpServers": {
     "rootly": {
-      "type": "sse",
-      "url": "https://mcp.rootly.com/sse",
+      "type": "http",
+      "url": "https://mcp.rootly.com/mcp",
       "headers": {
         "Authorization": "Bearer YOUR_ROOTLY_API_TOKEN"
       }
@@ -212,6 +211,8 @@ bearer_token_env_var = "ROOTLY_API_TOKEN"
 
 Add to `claude_desktop_config.json`:
 
+> **Note:** The `--transport http` flag ensures HTTP streamable transport is used instead of auto-falling back to SSE.
+
 ```json
 {
   "mcpServers": {
@@ -221,6 +222,8 @@ Add to `claude_desktop_config.json`:
         "-y",
         "mcp-remote",
         "https://mcp.rootly.com/mcp",
+        "--transport",
+        "http",
         "--header",
         "Authorization: Bearer <YOUR_ROOTLY_API_TOKEN>"
       ]
@@ -231,6 +234,36 @@ Add to `claude_desktop_config.json`:
 
 </details>
 
+## ChatGPT App Starter
+
+The server now includes a built-in ChatGPT app surface for incident exploration.
+
+- **Model-visible app tool:** `open_rootly_incident_workbench`
+- **App-only detail tool:** `get_rootly_incident_detail`
+- **UI resource:** `ui://rootly/incident-workbench.html`
+
+This gives ChatGPT a visual Rootly incident workbench without needing a separate backend.
+
+### What it does
+
+- Applies structured incident filters such as team, time range, severity, and status
+- Collects a bounded set of incident summaries for the widget
+- Lets the widget open a detailed incident pane without exposing the detail tool to the model
+
+### Try it in ChatGPT Developer Mode
+
+Once the MCP server is connected in ChatGPT Developer Mode, try prompts like:
+
+- `Open the Rootly incident workbench for Infrastructure incidents from the last 7 days`
+- `Show me resolved critical incidents for Infrastructure from April 1 through April 13`
+- `Open the Rootly incident workbench for database timeout incidents`
+
+### Production auth note
+
+For internal testing and developer-mode setups, the existing bearer-token flow is enough.
+
+For a public ChatGPT app that exposes customer-specific data or write actions, plan to add OAuth 2.1 support on the MCP side before submission. The current Rootly MCP server forwards bearer tokens, but public Apps SDK submissions expect OAuth 2.1-compatible MCP authorization metadata and token verification.
+
 ## Rootly CLI
 
 Standalone CLI for incidents, alerts, services, and on-call operations.
@@ -352,7 +385,7 @@ docker run -p 8000:8000 \
 ## Features
 
 - **Dynamic Tool Generation**: Automatically creates MCP resources from Rootly's OpenAPI (Swagger) specification
-- **Smart Pagination**: Defaults to 10 items per request for incident endpoints to prevent context window overflow
+- **Smart Pagination**: Uses bounded pagination and compact incident responses to prevent context window overflow
 - **API Filtering**: Limits exposed API endpoints for security and performance
 - **Intelligent Incident Analysis**: Smart tools that analyze historical incident data
   - **`find_related_incidents`**: Uses TF-IDF similarity analysis to find historically similar incidents
@@ -363,12 +396,13 @@ docker run -p 8000:8000 \
 
 ## Supported Tools
 
-The default server configuration exposes **105 tools**.
+The default server configuration exposes **110 tools**.
 
 ### Custom Agentic Tools
 
 - `check_oncall_health_risk`
 - `check_responder_availability`
+- `collect_incidents`
 - `create_override_recommendation`
 - `find_related_incidents`
 - `getIncident` - retrieve a single incident for direct verification, including PIR-related fields
@@ -379,7 +413,9 @@ The default server configuration exposes **105 tools**.
 - `get_server_version`
 - `get_shift_incidents`
 - `list_endpoints`
+- `list_incidents`
 - `list_shifts`
+- `open_rootly_incident_workbench`
 - `search_incidents`
 - `suggest_solutions`
 - `updateIncident` - scoped incident update tool for `summary` and `retrospective_progress_status`
@@ -396,6 +432,7 @@ createEscalationPath
 createEscalationPolicy
 createFunctionality
 createIncidentActionItem
+createIncidentFormFieldSelection
 createIncidentType
 createOnCallRole
 createOnCallShadow
@@ -408,6 +445,7 @@ createService
 createSeverity
 createTeam
 createWorkflow
+createWorkflowTask
 deleteEscalationLevel
 deleteEscalationPath
 deleteEscalationPolicy
@@ -420,6 +458,7 @@ getEscalationLevel
 getEscalationPath
 getEscalationPolicy
 getFunctionality
+getIncidentFormFieldSelection
 getIncidentType
 getOnCallRole
 getOnCallShadow
@@ -432,6 +471,7 @@ getSeverity
 getTeam
 getUser
 getWorkflow
+getWorkflowTask
 listAlerts
 listEnvironments
 listEscalationLevels
@@ -441,6 +481,7 @@ listEscalationPolicies
 listFunctionalities
 listIncidentActionItems
 listIncidentAlerts
+listIncidentFormFieldSelections
 listIncident_Types
 listOnCallRoles
 listOnCallShadows
@@ -455,12 +496,14 @@ listShifts
 listTeams
 listUsers
 listWorkflows
+listWorkflowTasks
 updateAlert
 updateEnvironment
 updateEscalationLevel
 updateEscalationPath
 updateEscalationPolicy
 updateFunctionality
+updateIncidentFormFieldSelection
 updateIncidentType
 updateOnCallRole
 updateOnCallShadow
@@ -472,6 +515,7 @@ updateSeverity
 updateTeam
 updateUser
 updateWorkflow
+updateWorkflowTask
 ```
 
 Delete operations are intentionally scoped to screenshot coverage paths:
@@ -490,7 +534,7 @@ Set the `ONCALLHEALTH_API_KEY` environment variable:
   "mcpServers": {
     "rootly": {
       "command": "uvx",
-      "args": ["rootly-mcp-server"],
+      "args": ["--from", "rootly-mcp-server", "rootly-mcp-server"],
       "env": {
         "ROOTLY_API_TOKEN": "your_rootly_token",
         "ONCALLHEALTH_API_KEY": "och_live_your_key"

{rootly_mcp_server-2.2.16 → rootly_mcp_server-2.2.18}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "rootly-mcp-server"
-version = "2.2.16"
+version = "2.2.18"
 description = "Secure Model Context Protocol server for Rootly APIs with AI SRE capabilities, comprehensive error handling, and input validation"
 readme = "README.md"
 requires-python = ">=3.12"
@@ -38,7 +38,7 @@ classifiers = [
 dependencies = [
     "fastmcp[code-mode]==3.2.0",  # Pin to patched version with Code Mode support
     "authlib>=1.6.9",  # Override vulnerable transitive authlib from fastmcp
-    "cryptography>=46.0.6",  # Override vulnerable transitive cryptography
+    "cryptography>=46.0.7",  # Override vulnerable transitive cryptography
     "Pygments>=2.20.0",  # Override vulnerable transitive Pygments
     "requests==2.33.1", # Pin to patched version
     "httpx==0.28.1",   # Pin to specific version
@@ -85,7 +85,7 @@ dev = [
 dev-dependencies = [
     "pyright>=1.1.404",
     "ruff>=0.7.3",
-    "pytest>=8.0.0",
+    "pytest>=9.0.3",
     "pytest-cov>=4.0.0", # Coverage reporting
     "pytest-asyncio>=0.23.0", # Async testing support
     "pytest-mock>=3.12.0", # Mocking utilities

{rootly_mcp_server-2.2.16 → rootly_mcp_server-2.2.18}/src/rootly_mcp_server/__main__.py

@@ -203,8 +203,10 @@ def get_server():
     )
 
 
-# Create the server instance for FastMCP CLI (follows quickstart pattern)
-mcp = get_server()
+# Create the server instance for FastMCP CLI (follows quickstart pattern).
+# Avoid eager construction when executing `python -m rootly_mcp_server`, because
+# CLI flags like `--hosted` and `--transport` are parsed later in `main()`.
+mcp = get_server() if __name__ != "__main__" else None
 
 
 def run_dual_http_server(
@@ -254,7 +256,8 @@ def run_dual_http_server(
         stateless=stateless_http,
     )
     streamable_http_app = StreamableHTTPASGIApp(session_manager)
-    streamable_methods = ["POST", "DELETE"] if stateless_http else None
+    # Always allow POST for streamable HTTP - stateless mode only affects session persistence
+    streamable_methods = ["POST", "DELETE"]
 
     routes = [
         Route(sse_path, endpoint=sse_endpoint, methods=["GET"]),