rootly-mcp-server 2.3.1__tar.gz → 2.3.3__tar.gz

{rootly_mcp_server-2.3.1 → rootly_mcp_server-2.3.3}/CHANGELOG.md

@@ -5,6 +5,16 @@ All notable changes to the Rootly MCP Server will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.3.2] - Released 2026-04-23
+
+### Fixed
+
+- **Generated Write Payload Forwarding**: Normalized generated OpenAPI write-tool payloads to unwrap top-level `body` envelopes before forwarding to the Rootly API, fixing failures such as `createWorkflow` returning `Invalid payload ({data: "Expected hash"})`
+
+### Testing
+
+- **Request-Path Regression Coverage**: Added transport regression tests that assert write requests forward unwrapped JSON payloads and preserve already-correct non-envelope payloads
+
 ## [2.3.1] - Released 2026-04-23
 
 ### Fixed

{rootly_mcp_server-2.3.1 → rootly_mcp_server-2.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rootly-mcp-server
-Version: 2.3.1
+Version: 2.3.3
 Summary: Secure Model Context Protocol server for Rootly APIs with AI SRE capabilities, comprehensive error handling, and input validation
 Project-URL: Homepage, https://github.com/Rootly-AI-Labs/Rootly-MCP-server
 Project-URL: Issues, https://github.com/Rootly-AI-Labs/Rootly-MCP-server/issues

{rootly_mcp_server-2.3.1 → rootly_mcp_server-2.3.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "rootly-mcp-server"
-version = "2.3.1"
+version = "2.3.3"
 description = "Secure Model Context Protocol server for Rootly APIs with AI SRE capabilities, comprehensive error handling, and input validation"
 readme = "README.md"
 requires-python = ">=3.12"

{rootly_mcp_server-2.3.1 → rootly_mcp_server-2.3.3}/src/rootly_mcp_server/server_defaults.py

@@ -373,6 +373,7 @@ DEFAULT_WRITE_ALLOWED_PATHS = [
     "/workflows",
     "/workflows/{workflow_id}",
     "/workflow_groups",
+    "/workflow_groups/{id}",
     "/workflows/{workflow_id}/workflow_tasks",
     "/workflow_tasks/{id}",
     "/workflows/{workflow_id}/form_field_conditions",
@@ -394,6 +395,7 @@ DEFAULT_WRITE_ALLOWED_PATHS = [
     "/live_call_routers",
     "/live_call_routers/{id}",
     # Post-incident and retrospectives - create + update
+    "/post_incident_reviews",
     "/post_incident_reviews/{id}",
     "/retrospective_processes",
     "/retrospective_processes/{id}",
@@ -401,6 +403,7 @@ DEFAULT_WRITE_ALLOWED_PATHS = [
     "/retrospective_process_groups/{id}",
     "/retrospective_processes/{retrospective_process_id}/retrospective_steps",
     "/retrospective_steps/{id}",
+    "/postmortem_templates",
     "/postmortem_templates/{id}",
     # Communications - create + update
     "/communications_groups",
@@ -413,11 +416,15 @@ DEFAULT_WRITE_ALLOWED_PATHS = [
     "/communications_types/{id}",
     # Causes and catalog - create + update
     "/causes",
+    "/causes/{id}",
     "/catalogs",
+    "/catalogs/{id}",
     "/catalogs/{catalog_id}/entities",
+    "/catalog_entities/{id}",
     # Sub-statuses - create + update
     "/sub_statuses",
     "/sub_statuses/{id}",
+    "/incident_sub_statuses",
     "/incident_sub_statuses/{id}",
     # User notification preferences - create + update
     "/users/{user_id}/notification_rules",
@@ -435,13 +442,18 @@ DEFAULT_WRITE_ALLOWED_PATHS = [
     # Form and field management - create + update
     "/custom_fields",
     "/custom_fields/{id}",
+    "/custom_field_options",
     "/custom_field_options/{id}",
     "/form_sets",
     "/form_sets/{id}",
     "/form_field_placements/{id}",
     "/form_field_placement_conditions/{id}",
     "/form_set_conditions/{id}",
+    # Status pages - create + update
+    "/status-pages",
+    "/status-pages/{id}",
     # Status page templates
+    "/status_page_templates",
     "/status_page_templates/{id}",
 ]
 

{rootly_mcp_server-2.3.1 → rootly_mcp_server-2.3.3}/src/rootly_mcp_server/spec_transform.py

@@ -493,22 +493,30 @@ def _filter_openapi_spec(
                             }
                         )
 
-    # Also clean up any remaining broken references in components
+    # Also clean up any remaining broken references in components.
+    # Schemas with broken $refs are patched in-place (broken refs replaced with generic objects)
+    # rather than removed, so that write tools like createWorkflow retain their field structure.
     if "components" in filtered_spec and "schemas" in filtered_spec["components"]:
         schemas = filtered_spec["components"]["schemas"]
-        # Remove or fix any schemas that reference missing components
         schemas_to_remove = []
         for schema_name, schema_def in schemas.items():
             if isinstance(schema_def, dict) and _has_broken_references(schema_def):
-                schemas_to_remove.append(schema_name)
+                patched = _patch_broken_refs(schema_def)
+                if _has_broken_references(patched):
+                    # Still broken after patching — remove it entirely
+                    schemas_to_remove.append(schema_name)
+                else:
+                    schemas[schema_name] = patched
+                    logger.debug(f"Patched broken references in schema: {schema_name}")
 
         for schema_name in schemas_to_remove:
             logger.debug(f"Removing schema with broken references: {schema_name}")
             del schemas[schema_name]
 
-    # Clean up any operation-level references to removed schemas
-    removed_schemas = set()
+    # Clean up operation-level references to schemas that were fully removed (not just patched)
+    removed_schemas: set[str] = set()
     if "components" in filtered_spec and "schemas" in filtered_spec["components"]:
+        existing = set(filtered_spec["components"]["schemas"].keys())
         removed_schemas = {
             "new_workflow",
             "update_workflow",
@@ -520,7 +528,7 @@ def _filter_openapi_spec(
             "update_workflow_task",
             "workflow_task_response",
             "workflow_task_list",
-        }
+        } - existing  # Only replace refs to schemas that were actually removed
 
     for path, path_item in filtered_spec.get("paths", {}).items():
         for method, operation in path_item.items():
@@ -747,3 +755,26 @@ def _has_broken_references(schema_def: dict[str, Any]) -> bool:
                     return True
 
     return False
+
+
+def _patch_broken_refs(schema_def: dict[str, Any]) -> dict[str, Any]:
+    """Recursively replace broken $refs with a generic object schema.
+
+    This preserves the parent schema's field structure (e.g. new_workflow keeps
+    name/description/etc.) while neutralising unresolvable nested references like
+    incident_trigger_params.
+    """
+    if "$ref" in schema_def and _has_broken_references(schema_def):
+        return {"type": "object", "additionalProperties": True}
+
+    result: dict[str, Any] = {}
+    for key, value in schema_def.items():
+        if isinstance(value, dict):
+            result[key] = _patch_broken_refs(value)
+        elif isinstance(value, list):
+            result[key] = [
+                _patch_broken_refs(item) if isinstance(item, dict) else item for item in value
+            ]
+        else:
+            result[key] = value
+    return result

{rootly_mcp_server-2.3.1 → rootly_mcp_server-2.3.3}/src/rootly_mcp_server/transport.py

@@ -651,6 +651,8 @@ class AuthenticatedHTTPXClient:
         # Transform query parameters
         if "params" in kwargs:
             kwargs["params"] = self._transform_params(kwargs["params"])
+        if "json" in kwargs:
+            kwargs["json"] = self._normalize_request_json_payload(method, kwargs["json"])
 
         # Log incoming headers for debugging (before transformation)
         incoming_headers = kwargs.get("headers", {})
@@ -720,9 +722,89 @@ class AuthenticatedHTTPXClient:
         response = self._maybe_normalize_incident_form_field_selection_response(
             method, url, response
         )
+        response = self._maybe_annotate_404_response(method, url, response)
 
         return response
 
+    @staticmethod
+    def _normalize_request_json_payload(method: str, payload: Any) -> Any:
+        """Normalize JSON payloads forwarded by generated tools.
+
+        Some generated write tools expose a top-level `body` parameter, which can
+        result in JSON payloads of shape `{"body": {...}}`. Rootly API write
+        endpoints expect the inner object as the actual request body.
+        """
+        if method.upper() not in {"POST", "PUT", "PATCH"}:
+            return payload
+        if not isinstance(payload, dict):
+            return payload
+        body = payload.get("body")
+        if len(payload) == 1 and isinstance(body, dict):
+            return body
+        return payload
+
+    # Matches UUID v4 format: 8-4-4-4-12 lowercase hex chars
+    _UUID_RE = re.compile(
+        r"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", re.IGNORECASE
+    )
+
+    @staticmethod
+    def _path_has_id_segment(url: str) -> bool:
+        """Return True if the URL path ends with what looks like an ID segment.
+
+        Collection paths (/v1/heartbeats, /v1/status-pages) return False.
+        Individual-resource paths (/v1/heartbeats/123) return True.
+
+        Hyphenated resource names like 'status-pages' must not be confused with
+        UUID-style IDs — the UUID check requires strict hex-only segments.
+        """
+        path = AuthenticatedHTTPXClient._path_for_url(url)
+        last = path.rstrip("/").rsplit("/", 1)[-1]
+        return bool(last and (last.isdigit() or AuthenticatedHTTPXClient._UUID_RE.match(last)))
+
+    @staticmethod
+    def _maybe_annotate_404_response(
+        method: str, url: str, response: httpx.Response
+    ) -> httpx.Response:
+        """Append a plan-gating hint to 404 responses.
+
+        Rootly returns 404 for endpoints that are locked to a specific subscription
+        tier, even when the request is valid. The response body uses the generic
+        title "Not found or unauthorized" with no plan-specific discriminator.
+
+        Heuristic: a 404 on a collection path (no trailing ID) is almost certainly
+        plan gating regardless of method.  A 404 on an ID path during a write is
+        ambiguous — the resource may simply not exist — so the hint is softened.
+        """
+        if response.status_code != 404:
+            return response
+        has_id = AuthenticatedHTTPXClient._path_has_id_segment(url)
+        is_write = method.upper() in {"POST", "PUT", "PATCH"}
+        # Skip GET on ID paths — those are ordinary "resource not found" responses
+        if has_id and not is_write:
+            return response
+        try:
+            body = response.json()
+            if not has_id:
+                hint = (
+                    "This 404 most likely means the feature is not enabled on your Rootly plan. "
+                    "Contact Rootly support to enable it for your organisation."
+                )
+            else:
+                hint = (
+                    "This 404 may mean the resource does not exist, or that the feature is not "
+                    "enabled on your Rootly plan. Contact Rootly support if the resource exists "
+                    "and the error persists."
+                )
+            if isinstance(body, dict):
+                body.setdefault("_plan_gating_hint", hint)
+            else:
+                body = {"original_response": body, "_plan_gating_hint": hint}
+            response._content = json.dumps(body).encode()  # noqa: SLF001
+        except Exception:  # nosec B110 - Safe fallback; annotation is best-effort
+            pass
+        return response
+
     @staticmethod
     def _is_alert_endpoint(url: str) -> bool:
         """Check if a URL is an alert endpoint (but not alert sub-resources like events)."""

{rootly_mcp_server-2.3.1 → rootly_mcp_server-2.3.3}/tests/unit/test_transport_module.py

@@ -523,6 +523,54 @@ class TestTransportModule:
         assert error_context["upstream_path"] == "/v1/alerts"
         assert error_context["upstream_log_level"] == "error"
 
+    @pytest.mark.asyncio
+    async def test_authenticated_client_unwraps_body_envelope_on_write_requests(self):
+        response = httpx.Response(
+            200,
+            request=httpx.Request("POST", "https://api.rootly.com/v1/workflows"),
+            content=b'{"data":{"id":"wf-1"}}',
+        )
+
+        with patch.object(
+            transport.AuthenticatedHTTPXClient, "_get_api_token", return_value="token"
+        ):
+            client = transport.AuthenticatedHTTPXClient(hosted=False, transport="stdio")
+            client.client.request = AsyncMock(return_value=response)
+
+            await client.request(
+                "POST",
+                "/v1/workflows",
+                json={"body": {"genius_workflow": {"name": "MCP verification workflow"}}},
+            )
+
+            _, kwargs = client.client.request.call_args
+            assert kwargs["json"] == {"genius_workflow": {"name": "MCP verification workflow"}}
+
+    @pytest.mark.asyncio
+    async def test_authenticated_client_preserves_non_envelope_payload_on_update_requests(self):
+        response = httpx.Response(
+            200,
+            request=httpx.Request("PATCH", "https://api.rootly.com/v1/workflows/wf-1"),
+            content=b'{"data":{"id":"wf-1"}}',
+        )
+
+        with patch.object(
+            transport.AuthenticatedHTTPXClient, "_get_api_token", return_value="token"
+        ):
+            client = transport.AuthenticatedHTTPXClient(hosted=False, transport="stdio")
+            client.client.request = AsyncMock(return_value=response)
+
+            await client.request(
+                "PATCH",
+                "/v1/workflows/wf-1",
+                json={"data": {"type": "workflows", "attributes": {"name": "Updated"}}},
+            )
+
+            _, kwargs = client.client.request.call_args
+            assert kwargs["json"] == {
+                "data": {"type": "workflows", "attributes": {"name": "Updated"}}
+            }
+
     def test_sanitize_log_excerpt_redacts_tokens_and_paths(self):
         excerpt = transport._sanitize_log_excerpt(
             'Bearer rootly_1234567890 File "/Users/spencercheng/app.py" failed'
@@ -560,6 +608,29 @@ class TestTransportModule:
         assert result["data"][0]["relationships"]["alerts"] == {"count": 2}
         assert "included" not in result
 
+    def test_normalize_request_json_payload_unwraps_body_for_write_methods(self):
+        payload = {"body": {"genius_workflow": {"name": "workflow-name"}}}
+
+        result = transport.AuthenticatedHTTPXClient._normalize_request_json_payload("POST", payload)
+
+        assert result == {"genius_workflow": {"name": "workflow-name"}}
+
+    def test_normalize_request_json_payload_does_not_unwrap_for_get(self):
+        payload = {"body": {"query": "database timeout"}}
+
+        result = transport.AuthenticatedHTTPXClient._normalize_request_json_payload("GET", payload)
+
+        assert result == payload
+
+    def test_normalize_request_json_payload_keeps_non_envelope_dict(self):
+        payload = {"data": {"type": "incidents"}, "body": {"ignored": True}}
+
+        result = transport.AuthenticatedHTTPXClient._normalize_request_json_payload(
+            "PATCH", payload
+        )
+
+        assert result == payload
+
     def test_strip_heavy_user_data_keeps_profile_essentials(self):
         data = {
             "data": [