tavus-cli 0.3.0__tar.gz → 0.3.2__tar.gz

{tavus_cli-0.3.0 → tavus_cli-0.3.2}/.github/workflows/deploy-cloudflare-worker.yml

@@ -12,20 +12,26 @@ on:
           - test
           - stg
           - prod
+  push:
+    branches:
+      - main
 
 permissions:
   contents: read
 
+concurrency:
+  group: deploy-tavus-mcp-worker-${{ github.event_name == 'workflow_dispatch' && inputs.environment || 'prod' }}
+  cancel-in-progress: true
+
 jobs:
   deploy:
     runs-on: ubuntu-latest
-    environment: ${{ inputs.environment }}
+    # Manual dispatch picks the requested environment; merges to main deploy prod.
+    environment: ${{ github.event_name == 'workflow_dispatch' && inputs.environment || 'prod' }}
     env:
       CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
       CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-      CLOUDFLARE_ENV: ${{ inputs.environment }}
-      TAVUS_API_KEY: ${{ secrets.TAVUS_API_KEY }}
-      MCP_BEARER_TOKEN: ${{ secrets.MCP_BEARER_TOKEN }}
+      CLOUDFLARE_ENV: ${{ github.event_name == 'workflow_dispatch' && inputs.environment || 'prod' }}
     defaults:
       run:
         working-directory: workers/tavus-mcp
@@ -41,6 +47,17 @@ jobs:
           cache: npm
           cache-dependency-path: workers/tavus-mcp/package-lock.json
 
+      - name: Validate deployment secrets
+        run: |
+          if [ -z "${CLOUDFLARE_API_TOKEN:-}" ]; then
+            echo "::error::Missing CLOUDFLARE_API_TOKEN GitHub secret for environment '$CLOUDFLARE_ENV'."
+            exit 1
+          fi
+          if [ -z "${CLOUDFLARE_ACCOUNT_ID:-}" ]; then
+            echo "::error::Missing CLOUDFLARE_ACCOUNT_ID GitHub secret for environment '$CLOUDFLARE_ENV'."
+            exit 1
+          fi
+
       - name: Install dependencies
         run: npm ci
 
@@ -50,19 +67,5 @@ jobs:
       - name: Test
         run: npm run test
 
-      - name: Configure legacy shared-token fallback secrets
-        run: |
-          if [ -n "${TAVUS_API_KEY:-}" ]; then
-            printf '%s' "$TAVUS_API_KEY" | npx wrangler secret put TAVUS_API_KEY --env "$CLOUDFLARE_ENV"
-          else
-            echo "Skipping TAVUS_API_KEY; OAuth user bearer tokens do not require the legacy fallback."
-          fi
-
-          if [ -n "${MCP_BEARER_TOKEN:-}" ]; then
-            printf '%s' "$MCP_BEARER_TOKEN" | npx wrangler secret put MCP_BEARER_TOKEN --env "$CLOUDFLARE_ENV"
-          else
-            echo "Skipping MCP_BEARER_TOKEN; OAuth user bearer tokens do not require the legacy fallback."
-          fi
-
       - name: Deploy Worker
         run: npx wrangler deploy --env "$CLOUDFLARE_ENV"

{tavus_cli-0.3.0 → tavus_cli-0.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tavus-cli
-Version: 0.3.0
+Version: 0.3.2
 Summary: Tavus CLI and MCP server for agentic PAL creation and editing.
 Requires-Python: >=3.11
 Requires-Dist: fastmcp>=2.0.0
@@ -156,7 +156,7 @@ endpoints so MCP clients can authenticate through Tavus browser auth.
 Claude Code example:
 
 ```bash
-claude mcp add -s user --transport http tavus https://mcp.tavus-preview.io/mcp
+claude mcp add -s user --transport http tavus https://mcp.tavus.io/mcp
 ```
 
 The OAuth authorize step redirects to Tavus developer portal
@@ -181,25 +181,38 @@ Keep the Worker environment aligned with the portal environment that minted the
 key. For example, a TEST key from a local or dev portal must hit a Worker running
 with `--env test`, otherwise downstream Tavus API calls will return 401.
 
-For Tavus deployment, configure these Cloudflare/GitHub environment secrets:
+For Tavus deployment, configure these GitHub environment secrets for each
+deployable environment (`test`, `stg`, `prod`):
 
 - `CLOUDFLARE_API_TOKEN`
 - `CLOUDFLARE_ACCOUNT_ID`
-- `TAVUS_API_KEY` and `MCP_BEARER_TOKEN` only if you need the legacy shared-token fallback
 
-Then run the `Deploy Tavus MCP Worker` workflow for `test`, `stg`, or `prod`.
-The `prod` Wrangler route is configured as a custom domain on `mcp.tavus.io`;
-use `https://mcp.tavus-preview.io/mcp` as the Cloudflare-owned endpoint until
-`mcp.tavus.io` DNS resolves.
+Worker runtime secrets, such as the legacy `TAVUS_API_KEY` or
+`MCP_BEARER_TOKEN` fallback, should be set in Cloudflare with
+`wrangler secret put <NAME> --env <environment>`. They persist across deploys;
+the GitHub workflow does not read or overwrite them.
+
+Merges to `main` automatically run the `Deploy Tavus MCP Worker` workflow for
+`prod`. You can also run the workflow manually for `test`, `stg`, or `prod`.
+The public MCP endpoint is always `https://mcp.tavus.io/mcp`. The
+`mcp.tavus-preview.io` custom domain belongs only to the `stg` Worker and must
+not be published as a production fallback.
+
+| Deployment | Worker | Hosted endpoint | Tavus API |
+| --- | --- | --- | --- |
+| `test` | `tavus-mcp-test` | Workers.dev URL | `https://test.rqh.tavusapi.com/v2` |
+| `stg` | `tavus-mcp-stg` | `https://mcp.tavus-preview.io/mcp` | `https://stg.rqh.tavusapi.com/v2` |
+| `prod` | `tavus-mcp-prod` | `https://mcp.tavus.io/mcp` | `https://tavusapi.com/v2` |
+
 For direct Wrangler usage, the default config targets production; use
 `wrangler deploy --env test` or `wrangler dev --env test` to point at TEST.
 
 Useful production checks:
 
 ```bash
-curl https://mcp.tavus-preview.io/.well-known/oauth-protected-resource/mcp
-curl https://mcp.tavus-preview.io/.well-known/oauth-authorization-server
-curl -i https://mcp.tavus-preview.io/mcp
+curl https://mcp.tavus.io/.well-known/oauth-protected-resource/mcp
+curl https://mcp.tavus.io/.well-known/oauth-authorization-server
+curl -i https://mcp.tavus.io/mcp
 ```
 
 Unauthenticated `/mcp` should return `401` with a `WWW-Authenticate` header that

{tavus_cli-0.3.0 → tavus_cli-0.3.2}/README.md

@@ -136,7 +136,7 @@ endpoints so MCP clients can authenticate through Tavus browser auth.
 Claude Code example:
 
 ```bash
-claude mcp add -s user --transport http tavus https://mcp.tavus-preview.io/mcp
+claude mcp add -s user --transport http tavus https://mcp.tavus.io/mcp
 ```
 
 The OAuth authorize step redirects to Tavus developer portal
@@ -161,25 +161,38 @@ Keep the Worker environment aligned with the portal environment that minted the
 key. For example, a TEST key from a local or dev portal must hit a Worker running
 with `--env test`, otherwise downstream Tavus API calls will return 401.
 
-For Tavus deployment, configure these Cloudflare/GitHub environment secrets:
+For Tavus deployment, configure these GitHub environment secrets for each
+deployable environment (`test`, `stg`, `prod`):
 
 - `CLOUDFLARE_API_TOKEN`
 - `CLOUDFLARE_ACCOUNT_ID`
-- `TAVUS_API_KEY` and `MCP_BEARER_TOKEN` only if you need the legacy shared-token fallback
 
-Then run the `Deploy Tavus MCP Worker` workflow for `test`, `stg`, or `prod`.
-The `prod` Wrangler route is configured as a custom domain on `mcp.tavus.io`;
-use `https://mcp.tavus-preview.io/mcp` as the Cloudflare-owned endpoint until
-`mcp.tavus.io` DNS resolves.
+Worker runtime secrets, such as the legacy `TAVUS_API_KEY` or
+`MCP_BEARER_TOKEN` fallback, should be set in Cloudflare with
+`wrangler secret put <NAME> --env <environment>`. They persist across deploys;
+the GitHub workflow does not read or overwrite them.
+
+Merges to `main` automatically run the `Deploy Tavus MCP Worker` workflow for
+`prod`. You can also run the workflow manually for `test`, `stg`, or `prod`.
+The public MCP endpoint is always `https://mcp.tavus.io/mcp`. The
+`mcp.tavus-preview.io` custom domain belongs only to the `stg` Worker and must
+not be published as a production fallback.
+
+| Deployment | Worker | Hosted endpoint | Tavus API |
+| --- | --- | --- | --- |
+| `test` | `tavus-mcp-test` | Workers.dev URL | `https://test.rqh.tavusapi.com/v2` |
+| `stg` | `tavus-mcp-stg` | `https://mcp.tavus-preview.io/mcp` | `https://stg.rqh.tavusapi.com/v2` |
+| `prod` | `tavus-mcp-prod` | `https://mcp.tavus.io/mcp` | `https://tavusapi.com/v2` |
+
 For direct Wrangler usage, the default config targets production; use
 `wrangler deploy --env test` or `wrangler dev --env test` to point at TEST.
 
 Useful production checks:
 
 ```bash
-curl https://mcp.tavus-preview.io/.well-known/oauth-protected-resource/mcp
-curl https://mcp.tavus-preview.io/.well-known/oauth-authorization-server
-curl -i https://mcp.tavus-preview.io/mcp
+curl https://mcp.tavus.io/.well-known/oauth-protected-resource/mcp
+curl https://mcp.tavus.io/.well-known/oauth-authorization-server
+curl -i https://mcp.tavus.io/mcp
 ```
 
 Unauthenticated `/mcp` should return `401` with a `WWW-Authenticate` header that

{tavus_cli-0.3.0 → tavus_cli-0.3.2}/docs/gemini-enterprise/README.md

@@ -10,9 +10,7 @@ workflow for adding Tavus to a Gemini Enterprise instance.
 | Field | Value |
 | --- | --- |
 | MCP transport | Streamable HTTP (no SSE) |
-| Production MCP URL | `https://mcp.tavus.io/mcp` (Cloudflare-owned mirror: `https://mcp.tavus-preview.io/mcp`) |
-| Staging MCP URL | `https://tavus-mcp-stg.<workers-dev>/mcp` |
-| Test MCP URL | `https://tavus-mcp-test.<workers-dev>/mcp` |
+| Production MCP URL | `https://mcp.tavus.io/mcp` |
 | Auth | OAuth 2.1 Authorization Code + PKCE (S256), 3LO via Tavus dev portal |
 | Tool annotations | Every tool declares `readOnlyHint` / `destructiveHint` |
 | Public spec | This document |
@@ -156,12 +154,17 @@ pal or conversation ID.
 4. Run any of the queries in [test-queries.md](./test-queries.md) to confirm
    tools execute end-to-end.
 
-## Test environments
+## Review environments
 
-| Env | MCP URL | API base | Dev portal | Test account |
+Public documentation and customer integrations must use only
+`https://mcp.tavus.io/mcp`. Tavus supplies non-production MCP endpoints and
+credentials privately for connector certification; they are not production
+mirrors or customer-facing fallbacks.
+
+| Env | MCP access | API base | Dev portal | Test account |
 | --- | --- | --- | --- | --- |
-| Test | `https://tavus-mcp-test.<workers-dev>/mcp` | `https://test.rqh.tavusapi.com/v2` | `https://dev.platform.tavus.io` | provided privately |
-| Staging | `https://tavus-mcp-stg.<workers-dev>/mcp` | `https://stg.rqh.tavusapi.com/v2` | `https://stage.platform.tavus.io` | provided privately |
+| Test | provided privately | `https://test.rqh.tavusapi.com/v2` | `https://dev.platform.tavus.io` | provided privately |
+| Staging | provided privately | `https://stg.rqh.tavusapi.com/v2` | `https://stage.platform.tavus.io` | provided privately |
 | Production | `https://mcp.tavus.io/mcp` | `https://tavusapi.com/v2` | `https://platform.tavus.io` | provided privately |
 
 Each env has a dedicated `gemini-enterprise-test@tavus.io` account pre-seeded

tavus_cli-0.3.2/docs/usage-observability.md

@@ -0,0 +1,65 @@
+# MCP and CLI usage observability
+
+The Tavus CLI, local MCP server, and hosted MCP Worker identify their downstream
+Tavus API requests with a source-specific user agent:
+
+| Surface | User agent |
+| --- | --- |
+| CLI | `tavus-cli/<version>` |
+| Local MCP server | `tavus-mcp/<version>` |
+| Hosted MCP Worker | `tavus-mcp-worker/0.1.0` |
+
+They also send the matching low-cardinality `X-Tavus-Client-Source` header. The
+header is available for future structured attribution; the user agent works with
+request-handler's current access logging today.
+
+## SigNoz data path
+
+Request-handler already exports an access-log pair for each authenticated Tavus
+API request. Both records share an OpenTelemetry trace ID:
+
+- `log_request_data` records URL, method, request body, and the tagged user agent.
+- `after_request_logging` records route, HTTP status, auth type, and authenticated
+  `user_id`.
+
+In SigNoz, scope the logs to `service.name = request-handler` and
+`deployment.environment = prod`, select request records whose body contains one
+of the user-agent prefixes above, and join the response record on `trace_id`.
+
+That joined dataset supports the usage dashboard:
+
+| Question | Signal |
+| --- | --- |
+| How many people use it? | distinct authenticated `user_id`, split by surface |
+| How much is it used? | request count and requests per user over time |
+| How successful is it? | 2xx/3xx share versus 4xx/5xx share |
+| What query types run? | normalized HTTP method and Tavus API route |
+| How large are queries? | byte length of the logged request-body field |
+| Which errors occur? | response status distribution, split by route and surface |
+
+The existing [MCP Dashboard](https://tavus.us.signoz.cloud/dashboard/019affed-8fd9-756e-a889-d5da6157c976)
+only contains five legacy `mcp.*` latency panels. Those metrics had no matching
+data in the 30 days checked on July 31, 2026, and the dashboard does not currently
+measure adoption or CLI usage. Replace them with this production-only layout:
+
+- KPI row: API requests, unique users, success rate, and requests per user.
+- Hourly trends: requests and unique users, each split by CLI, local MCP, and
+  hosted MCP.
+- Tables: method plus normalized route family, request-body size percentiles,
+  and HTTP 4xx/5xx codes.
+
+The ClickHouse queries for that layout were dry-run against the current
+request-handler log schema. The final `tavus-*` filters are expected to return no
+historical rows until this source tagging is released.
+
+## Boundaries
+
+- Collection starts when this change is deployed/released; it does not recreate
+  reliable historical surface attribution.
+- Counts are downstream Tavus API requests, not top-level MCP tool calls or CLI
+  invocations. Local-only operations such as help, auth status, path listing, and
+  embed scaffolding do not generate an API request and are not counted.
+- No API key, prompt, or request body is added to telemetry by this change. The
+  source tags contain only the product surface and package version. Request-handler
+  continues applying its existing API-key truncation and 64 KiB body-redaction
+  policy.

{tavus_cli-0.3.0 → tavus_cli-0.3.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "tavus-cli"
-version = "0.3.0"
+version = "0.3.2"
 description = "Tavus CLI and MCP server for agentic PAL creation and editing."
 readme = "README.md"
 requires-python = ">=3.11"

{tavus_cli-0.3.0 → tavus_cli-0.3.2}/src/tavus_mcp/__init__.py

@@ -1,4 +1,4 @@
 """Tavus CLI and MCP server package."""
 
 __all__ = ["__version__"]
-__version__ = "0.1.1"
+__version__ = "0.3.2"