rootly-mcp-server 2.3.0__tar.gz → 2.3.2__tar.gz

{rootly_mcp_server-2.3.0 → rootly_mcp_server-2.3.2}/CHANGELOG.md

@@ -5,6 +5,29 @@ All notable changes to the Rootly MCP Server will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.3.2] - Released 2026-04-23
+
+### Fixed
+
+- **Generated Write Payload Forwarding**: Normalized generated OpenAPI write-tool payloads to unwrap top-level `body` envelopes before forwarding to the Rootly API, fixing failures such as `createWorkflow` returning `Invalid payload ({data: "Expected hash"})`
+
+### Testing
+
+- **Request-Path Regression Coverage**: Added transport regression tests that assert write requests forward unwrapped JSON payloads and preserve already-correct non-envelope payloads
+
+## [2.3.1] - Released 2026-04-23
+
+### Fixed
+
+- **Create Operations Restored**: Restored missing create operations for workflows, schedules, and configuration resources by expanding `DEFAULT_WRITE_ALLOWED_PATHS` to include collection/base paths (not only `/{id}` update paths)
+- **Write Surface Completeness**: Re-enabled create + update parity across key families including workflows, workflow groups, schedules, escalation policies, services, teams, environments, dashboards, playbooks, monitoring, retrospectives, communications, causes, and catalogs
+- **Test Accuracy**: Corrected alert source tool-name assertions in unit tests (`createAlertSource` / `updateAlertSource`) to prevent false confidence
+
+### Notes
+
+- `createWorkflow` remains the correct tool name (singular), not `createWorkflows`
+- Security exclusions for sensitive families remain unchanged
+
 ## [2.3.0] - Released 2026-04-23
 
 ### Features

{rootly_mcp_server-2.3.0 → rootly_mcp_server-2.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rootly-mcp-server
-Version: 2.3.0
+Version: 2.3.2
 Summary: Secure Model Context Protocol server for Rootly APIs with AI SRE capabilities, comprehensive error handling, and input validation
 Project-URL: Homepage, https://github.com/Rootly-AI-Labs/Rootly-MCP-server
 Project-URL: Issues, https://github.com/Rootly-AI-Labs/Rootly-MCP-server/issues

{rootly_mcp_server-2.3.0 → rootly_mcp_server-2.3.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "rootly-mcp-server"
-version = "2.3.0"
+version = "2.3.2"
 description = "Secure Model Context Protocol server for Rootly APIs with AI SRE capabilities, comprehensive error handling, and input validation"
 readme = "README.md"
 requires-python = ">=3.12"

{rootly_mcp_server-2.3.0 → rootly_mcp_server-2.3.2}/src/rootly_mcp_server/server_defaults.py

@@ -333,52 +333,98 @@ SECURITY_EXCLUDED_PATHS = [
 # write tools are explicitly enabled. This keeps the default surface focused on
 # read-only workflows and avoids exposing broader admin/config writes.
 DEFAULT_WRITE_ALLOWED_PATHS = [
-    # Core incident and infrastructure updates
-    "/alert_events/{id}",
+    # Core incident and infrastructure - create + update
+    "/environments",
     "/environments/{environment_id}",
-    "/escalation_levels/{escalation_level_id}",
-    "/escalation_paths/{escalation_policy_path_id}",
-    "/escalation_policies/{escalation_policy_id}",
+    "/functionalities",
     "/functionalities/{functionality_id}",
+    "/incident_types",
+    "/incident_types/{incident_type_id}",
+    "/services",
+    "/services/{service_id}",
+    "/severities",
+    "/severities/{severity_id}",
+    "/teams",
+    "/teams/{team_id}",
+    # Incident mutations
+    "/alert_events/{id}",
     "/incidents/{incident_id}/action_items",
     "/incidents/{incident_id}/form_field_selections",
     "/incident_form_field_selections/{id}",
-    "/incident_types/{incident_type_id}",
-    "/on_call_roles/{on_call_role_id}",
-    "/on_call_shadows/{on_call_shadow_id}",
-    "/override_shifts/{override_shift_id}",
+    # On-call schedules - create + update
+    "/schedules",
     "/schedules/{schedule_id}",
+    "/schedules/{schedule_id}/schedule_rotations",
     "/schedule_rotations/{schedule_rotation_id}",
-    "/services/{service_id}",
-    "/severities/{severity_id}",
-    "/teams/{team_id}",
+    "/schedules/{schedule_id}/override_shifts",
+    "/override_shifts/{override_shift_id}",
+    "/schedules/{schedule_id}/on_call_shadows",
+    "/on_call_shadows/{on_call_shadow_id}",
+    "/on_call_roles",
+    "/on_call_roles/{on_call_role_id}",
+    # Escalation policies - create + update
+    "/escalation_policies",
+    "/escalation_policies/{escalation_policy_id}",
+    "/escalation_policies/{escalation_policy_id}/escalation_paths",
+    "/escalation_paths/{escalation_policy_path_id}",
+    "/escalation_paths/{escalation_policy_path_id}/escalation_levels",
+    "/escalation_levels/{escalation_level_id}",
+    # Workflows - create + update
+    "/workflows",
     "/workflows/{workflow_id}",
+    "/workflow_groups",
     "/workflows/{workflow_id}/workflow_tasks",
     "/workflow_tasks/{id}",
-    # Communications and templates
-    "/communications_groups/{id}",
-    "/communications_stages/{id}",
-    "/communications_templates/{id}",
-    "/communications_types/{id}",
-    # Dashboards and analytics
+    "/workflows/{workflow_id}/form_field_conditions",
+    # Dashboards - create + update
+    "/dashboards",
     "/dashboards/{id}",
+    "/dashboards/{dashboard_id}/panels",
     "/dashboard_panels/{id}",
-    # Playbooks and operational procedures
+    # Playbooks - create + update
+    "/playbooks",
     "/playbooks/{id}",
+    "/playbooks/{playbook_id}/playbook_tasks",
     "/playbook_tasks/{id}",
-    # Post-incident and retrospectives
+    # Monitoring - create + update
+    "/heartbeats",
+    "/heartbeats/{id}",
+    "/pulses",
+    "/pulses/{id}",
+    "/live_call_routers",
+    "/live_call_routers/{id}",
+    # Post-incident and retrospectives - create + update
     "/post_incident_reviews/{id}",
+    "/retrospective_processes",
     "/retrospective_processes/{id}",
+    "/retrospective_processes/{retrospective_process_id}/groups",
     "/retrospective_process_groups/{id}",
+    "/retrospective_processes/{retrospective_process_id}/retrospective_steps",
     "/retrospective_steps/{id}",
     "/postmortem_templates/{id}",
-    # Monitoring and health checks
-    "/heartbeats/{id}",
-    "/pulses/{id}",
-    "/live_call_routers/{id}",
-    # User notification preferences (safe user updates)
+    # Communications - create + update
+    "/communications_groups",
+    "/communications_groups/{id}",
+    "/communications_stages",
+    "/communications_stages/{id}",
+    "/communications_templates",
+    "/communications_templates/{id}",
+    "/communications_types",
+    "/communications_types/{id}",
+    # Causes and catalog - create + update
+    "/causes",
+    "/catalogs",
+    "/catalogs/{catalog_id}/entities",
+    # Sub-statuses - create + update
+    "/sub_statuses",
+    "/sub_statuses/{id}",
+    "/incident_sub_statuses/{id}",
+    # User notification preferences - create + update
+    "/users/{user_id}/notification_rules",
     "/user_notification_rules/{id}",
+    "/users/{user_id}/email_addresses",
     "/user_email_addresses/{id}",
+    "/users/{user_id}/phone_numbers",
     "/user_phone_numbers/{id}",
     # Extended incident management
     "/incident_events/{id}",
@@ -386,17 +432,17 @@ DEFAULT_WRITE_ALLOWED_PATHS = [
     "/incident_postmortems/{id}",
     "/incident_retrospective_steps/{id}",
     "/incident_status_pages/{id}",
-    # Advanced form and field management
+    # Form and field management - create + update
+    "/custom_fields",
     "/custom_fields/{id}",
     "/custom_field_options/{id}",
+    "/form_sets",
     "/form_sets/{id}",
     "/form_field_placements/{id}",
     "/form_field_placement_conditions/{id}",
     "/form_set_conditions/{id}",
-    # Status and sub-status management
+    # Status page templates
     "/status_page_templates/{id}",
-    "/sub_statuses/{id}",
-    "/incident_sub_statuses/{id}",
 ]
 
 # DELETE operations are only exposed for these high-priority screenshot families.

{rootly_mcp_server-2.3.0 → rootly_mcp_server-2.3.2}/src/rootly_mcp_server/transport.py

@@ -651,6 +651,8 @@ class AuthenticatedHTTPXClient:
         # Transform query parameters
         if "params" in kwargs:
             kwargs["params"] = self._transform_params(kwargs["params"])
+        if "json" in kwargs:
+            kwargs["json"] = self._normalize_request_json_payload(method, kwargs["json"])
 
         # Log incoming headers for debugging (before transformation)
         incoming_headers = kwargs.get("headers", {})
@@ -723,6 +725,23 @@ class AuthenticatedHTTPXClient:
 
         return response
 
+    @staticmethod
+    def _normalize_request_json_payload(method: str, payload: Any) -> Any:
+        """Normalize JSON payloads forwarded by generated tools.
+
+        Some generated write tools expose a top-level `body` parameter, which can
+        result in JSON payloads of shape `{"body": {...}}`. Rootly API write
+        endpoints expect the inner object as the actual request body.
+        """
+        if method.upper() not in {"POST", "PUT", "PATCH"}:
+            return payload
+        if not isinstance(payload, dict):
+            return payload
+        body = payload.get("body")
+        if len(payload) == 1 and isinstance(body, dict):
+            return body
+        return payload
+
     @staticmethod
     def _is_alert_endpoint(url: str) -> bool:
         """Check if a URL is an alert endpoint (but not alert sub-resources like events)."""

{rootly_mcp_server-2.3.0 → rootly_mcp_server-2.3.2}/tests/unit/test_server.py

@@ -371,14 +371,9 @@ class TestBundledIncidentFormFieldSelectionTools:
         assert "listCauses" in tool_names
         assert "getCause" in tool_names
 
-        # Keep broader writes on these families disabled
+        # Workflow creates now enabled, but workflow runs remain excluded
         assert "createWorkflowRun" not in tool_names
-        assert "createWorkflowGroup" not in tool_names
-        assert "updateWorkflowGroup" not in tool_names
-        assert "createStatusPage" not in tool_names
-        assert "updateStatusPage" not in tool_names
-        assert "createStatusPageTemplate" not in tool_names
-        assert "updateStatusPageTemplate" not in tool_names
+        # Alert configuration writes remain excluded (connects to external systems)
         assert "createAlertGroup" not in tool_names
         assert "updateAlertGroup" not in tool_names
         assert "createAlertRoutingRule" not in tool_names
@@ -387,12 +382,11 @@ class TestBundledIncidentFormFieldSelectionTools:
         assert "updateAlertSource" not in tool_names
         assert "createAlertUrgency" not in tool_names
         assert "updateAlertUrgency" not in tool_names
+        # Custom form/field creation excluded (schema-level configuration)
         assert "createCustomForm" not in tool_names
         assert "updateCustomForm" not in tool_names
         assert "createFormField" not in tool_names
         assert "updateFormField" not in tool_names
-        assert "createCatalog" not in tool_names
-        assert "updateCatalog" not in tool_names
 
     async def test_enable_write_tools_exposes_curated_generated_write_tools(
         self, mock_environment_token

{rootly_mcp_server-2.3.0 → rootly_mcp_server-2.3.2}/tests/unit/test_transport_module.py

@@ -523,6 +523,54 @@ class TestTransportModule:
         assert error_context["upstream_path"] == "/v1/alerts"
         assert error_context["upstream_log_level"] == "error"
 
+    @pytest.mark.asyncio
+    async def test_authenticated_client_unwraps_body_envelope_on_write_requests(self):
+        response = httpx.Response(
+            200,
+            request=httpx.Request("POST", "https://api.rootly.com/v1/workflows"),
+            content=b'{"data":{"id":"wf-1"}}',
+        )
+
+        with patch.object(
+            transport.AuthenticatedHTTPXClient, "_get_api_token", return_value="token"
+        ):
+            client = transport.AuthenticatedHTTPXClient(hosted=False, transport="stdio")
+            client.client.request = AsyncMock(return_value=response)
+
+            await client.request(
+                "POST",
+                "/v1/workflows",
+                json={"body": {"genius_workflow": {"name": "MCP verification workflow"}}},
+            )
+
+            _, kwargs = client.client.request.call_args
+            assert kwargs["json"] == {"genius_workflow": {"name": "MCP verification workflow"}}
+
+    @pytest.mark.asyncio
+    async def test_authenticated_client_preserves_non_envelope_payload_on_update_requests(self):
+        response = httpx.Response(
+            200,
+            request=httpx.Request("PATCH", "https://api.rootly.com/v1/workflows/wf-1"),
+            content=b'{"data":{"id":"wf-1"}}',
+        )
+
+        with patch.object(
+            transport.AuthenticatedHTTPXClient, "_get_api_token", return_value="token"
+        ):
+            client = transport.AuthenticatedHTTPXClient(hosted=False, transport="stdio")
+            client.client.request = AsyncMock(return_value=response)
+
+            await client.request(
+                "PATCH",
+                "/v1/workflows/wf-1",
+                json={"data": {"type": "workflows", "attributes": {"name": "Updated"}}},
+            )
+
+            _, kwargs = client.client.request.call_args
+            assert kwargs["json"] == {
+                "data": {"type": "workflows", "attributes": {"name": "Updated"}}
+            }
+
     def test_sanitize_log_excerpt_redacts_tokens_and_paths(self):
         excerpt = transport._sanitize_log_excerpt(
             'Bearer rootly_1234567890 File "/Users/spencercheng/app.py" failed'
@@ -560,6 +608,29 @@ class TestTransportModule:
         assert result["data"][0]["relationships"]["alerts"] == {"count": 2}
         assert "included" not in result
 
+    def test_normalize_request_json_payload_unwraps_body_for_write_methods(self):
+        payload = {"body": {"genius_workflow": {"name": "workflow-name"}}}
+
+        result = transport.AuthenticatedHTTPXClient._normalize_request_json_payload("POST", payload)
+
+        assert result == {"genius_workflow": {"name": "workflow-name"}}
+
+    def test_normalize_request_json_payload_does_not_unwrap_for_get(self):
+        payload = {"body": {"query": "database timeout"}}
+
+        result = transport.AuthenticatedHTTPXClient._normalize_request_json_payload("GET", payload)
+
+        assert result == payload
+
+    def test_normalize_request_json_payload_keeps_non_envelope_dict(self):
+        payload = {"data": {"type": "incidents"}, "body": {"ignored": True}}
+
+        result = transport.AuthenticatedHTTPXClient._normalize_request_json_payload(
+            "PATCH", payload
+        )
+
+        assert result == payload
+
     def test_strip_heavy_user_data_keeps_profile_essentials(self):
         data = {
             "data": [

{rootly_mcp_server-2.3.0 → rootly_mcp_server-2.3.2}/uv.lock

@@ -1715,7 +1715,7 @@ wheels = [
 
 [[package]]
 name = "rootly-mcp-server"
-version = "2.2.24"
+version = "2.3.1"
 source = { editable = "." }
 dependencies = [
     { name = "authlib" },