diff --git a/README.md b/README.md index bb1b3f1..9d9bf92 100644 --- a/README.md +++ b/README.md @@ -50,6 +50,10 @@ clone or fork it to run your own CRM. - **Public REST API** (`/api/v1`) with scoped, revocable API keys — build your own automations on top of your CRM. See [docs/public-api.md](./docs/public-api.md). +- **MCP server** — drive your CRM from Claude, Cursor, and other AI + assistants over the [Model Context Protocol](https://modelcontextprotocol.io). + Read-only by default, opt-in writes. See [docs/mcp.md](./docs/mcp.md) + (server in [`mcp-server/`](./mcp-server)). ## Why fork this? diff --git a/docs/mcp.md b/docs/mcp.md new file mode 100644 index 0000000..640d410 --- /dev/null +++ b/docs/mcp.md @@ -0,0 +1,58 @@ +# MCP server + +wacrm ships a [Model Context Protocol](https://modelcontextprotocol.io) +server so you can drive your CRM from AI assistants — Claude Desktop, +Claude Code, Cursor, and any other MCP client — in natural language: + +> "How many conversations are still open today?" +> "Show the last five messages with +1 415 555 0123." +> "Send the `order_update` template to that contact." + +It lives in [`mcp-server/`](../mcp-server) and is published to npm as +[`wacrm-mcp`](https://www.npmjs.com/package/wacrm-mcp). Under the hood +it's a thin wrapper over the [public API](./public-api.md), so every +request is authenticated and scoped by your instance exactly like any +other API call. + +## Quick start + +1. Create an API key in the dashboard: **Settings → API keys**. Grant + only the scopes your assistant needs (a read-only assistant only + needs the `*:read` scopes). +2. Add the server to your MCP client config: + + ```jsonc + { + "mcpServers": { + "wacrm": { + "command": "npx", + "args": ["-y", "wacrm-mcp"], + "env": { + "WACRM_BASE_URL": "https://crm.example.com", + "WACRM_API_KEY": "wacrm_live_xxxxxxxxxxxxxxxxxxxxxxxx" + } + } + } + } + ``` + +That's **read-only** — the safe default. To let the assistant change +data or send messages, add `"WACRM_ENABLE_WRITES": "true"` (and +`"WACRM_ENABLE_BROADCASTS": "true"` for mass sends) to `env`. + +## What it exposes + +- **Reads (always on):** `whoami`, contacts (list/get), conversations + (list/get), messages (list), broadcast status. +- **Writes (opt-in):** send a message, create/update a contact. +- **Broadcasts (opt-in):** launch a template broadcast — requires an + explicit `confirm` and is marked destructive. + +## Safety + +Because sending WhatsApp messages is a real side effect, the server is +**read-only until you opt in**, layered on top of the API key's own +scopes. Give an assistant a read-only key and read-only config and it +physically cannot send anything. See the +[server README](../mcp-server/README.md) for the full tool list and +safety model. diff --git a/mcp-server/.env.example b/mcp-server/.env.example new file mode 100644 index 0000000..9c96a35 --- /dev/null +++ b/mcp-server/.env.example @@ -0,0 +1,19 @@ +# The base URL of your wacrm instance (no trailing slash). +WACRM_BASE_URL=https://your-crm.example.com + +# A wacrm API key. Create one in the dashboard: +# Settings → API keys → New API key. +# The key's scopes decide what the server can do — grant the minimum. +WACRM_API_KEY=wacrm_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx + +# --- Write guards (opt-in) ------------------------------------------ +# By default the server is READ-ONLY: it never exposes tools that +# change data or send messages, no matter what the API key allows. +# Turn these on deliberately. + +# Expose contact create/update and single-message sending. +# WACRM_ENABLE_WRITES=true + +# Expose the broadcast tool (mass sends — highest risk). Requires +# WACRM_ENABLE_WRITES as well. +# WACRM_ENABLE_BROADCASTS=true diff --git a/mcp-server/.gitignore b/mcp-server/.gitignore new file mode 100644 index 0000000..e537e12 --- /dev/null +++ b/mcp-server/.gitignore @@ -0,0 +1,4 @@ +node_modules +dist +*.log +.env diff --git a/mcp-server/README.md b/mcp-server/README.md new file mode 100644 index 0000000..9f05749 --- /dev/null +++ b/mcp-server/README.md @@ -0,0 +1,114 @@ +# wacrm MCP server + +A [Model Context Protocol](https://modelcontextprotocol.io) server for +**[wacrm](https://github.com/ArnasDon/wacrm)** — the self-hostable +WhatsApp CRM. It lets MCP clients (Claude Desktop, Claude Code, Cursor, +and others) drive your CRM in natural language: + +> "How many conversations are still open?" +> "Find the contact for +1 415 555 0123 and show the last few messages." +> "Draft and send an order-update template to Jane." + +It's a thin wrapper over wacrm's public [`/api/v1`](../docs/public-api.md) +REST API. All auth, scoping, and rate limiting are enforced by your +wacrm instance — this server just exposes the API as MCP tools. + +## Prerequisites + +1. A running wacrm instance (your own self-hosted deploy). +2. An API key: in the dashboard go to **Settings → API keys → New API + key** and grant only the scopes you need. The key is shown once. + +## Install & configure + +The server reads two required environment variables and two optional +write guards: + +| Variable | Required | Purpose | +| ------------------------- | -------- | -------------------------------------------------------------- | +| `WACRM_BASE_URL` | yes | Your instance URL, e.g. `https://crm.example.com` | +| `WACRM_API_KEY` | yes | An API key from the dashboard | +| `WACRM_ENABLE_WRITES` | no | `true` to expose contact writes + message sending | +| `WACRM_ENABLE_BROADCASTS` | no | `true` to expose mass broadcasts (needs `WACRM_ENABLE_WRITES`) | + +### Claude Desktop / Claude Code / Cursor + +Add to your MCP client config (e.g. `claude_desktop_config.json`, or +`.mcp.json` for Claude Code): + +```jsonc +{ + "mcpServers": { + "wacrm": { + "command": "npx", + "args": ["-y", "wacrm-mcp"], + "env": { + "WACRM_BASE_URL": "https://crm.example.com", + "WACRM_API_KEY": "wacrm_live_xxxxxxxxxxxxxxxxxxxxxxxx" + } + } + } +} +``` + +That configuration is **read-only** — the safe default. To let the +assistant change data or send messages, add the write guards: + +```jsonc +"env": { + "WACRM_BASE_URL": "https://crm.example.com", + "WACRM_API_KEY": "wacrm_live_xxxxxxxxxxxxxxxxxxxxxxxx", + "WACRM_ENABLE_WRITES": "true", + "WACRM_ENABLE_BROADCASTS": "true" +} +``` + +## Tools + +Read tools are always available. Write and broadcast tools appear only +when their guard is set. + +| Tool | Group | Scope needed | What it does | +| -------------------- | --------- | -------------------- | ----------------------------------------------- | +| `whoami` | read | _(any valid key)_ | Show the account + scopes the key carries | +| `list_contacts` | read | `contacts:read` | List/search contacts (paginated) | +| `get_contact` | read | `contacts:read` | Read one contact | +| `list_conversations` | read | `conversations:read` | List conversations, filter by status/contact | +| `get_conversation` | read | `conversations:read` | Read one conversation | +| `list_messages` | read | `messages:read` | List a conversation's messages | +| `get_broadcast` | read | `broadcasts:send` | Poll a broadcast's delivery status | +| `send_message` | write | `messages:send` | Send a WhatsApp message (text/template/media) | +| `create_contact` | write | `contacts:write` | Create (find-or-create) a contact | +| `update_contact` | write | `contacts:write` | Update a contact / replace its tags | +| `send_broadcast` | broadcast | `broadcasts:send` | Launch a template broadcast (requires `confirm`)| + +## Safety model + +Sending WhatsApp messages through an LLM is a real-world side effect, so +the server layers three guards: + +1. **Read-only by default.** Write and broadcast tools are not even + registered — the model can't see them — unless you opt in via + `WACRM_ENABLE_WRITES` / `WACRM_ENABLE_BROADCASTS`. +2. **API-key scopes.** Whatever the guards allow, your wacrm instance + still enforces the key's scopes. A call without the right scope + returns a clean `forbidden` error. Issue a read-only key for a + read-only assistant. +3. **Explicit broadcast confirmation.** `send_broadcast` refuses to run + unless called with `confirm: true`, and is marked `destructive` so + compliant clients prompt the user first. + +## Development + +```bash +npm install +npm run build # compile to dist/ +npm run typecheck +npm start # run the compiled server (needs the env vars) +``` + +Logs go to **stderr** — stdout is reserved for the MCP protocol. + +## License + +MIT — same as wacrm. diff --git a/mcp-server/glama.json b/mcp-server/glama.json new file mode 100644 index 0000000..d6044d7 --- /dev/null +++ b/mcp-server/glama.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://glama.ai/mcp/schemas/server.json", + "maintainers": [ + "ArnasDon" + ] +} diff --git a/mcp-server/package-lock.json b/mcp-server/package-lock.json new file mode 100644 index 0000000..730f2ea --- /dev/null +++ b/mcp-server/package-lock.json @@ -0,0 +1,1219 @@ +{ + "name": "wacrm-mcp", + "version": "0.1.0", + "lockfileVersion": 3, + "requires": true, + "packages": { + "": { + "name": "wacrm-mcp", + "version": "0.1.0", + "license": "MIT", + "dependencies": { + "@modelcontextprotocol/sdk": "^1.18.0", + "zod": "^3.25.0" + }, + "bin": { + "wacrm-mcp": "dist/index.js" + }, + "devDependencies": { + "@types/node": "^20.19.0", + "typescript": "^5.7.0" + }, + "engines": { + "node": ">=20.0.0" + } + }, + "node_modules/@hono/node-server": { + "version": "1.19.14", + "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.14.tgz", + "integrity": "sha512-GwtvgtXxnWsucXvbQXkRgqksiH2Qed37H9xHZocE5sA3N8O8O8/8FA3uclQXxXVzc9XBZuEOMK7+r02FmSpHtw==", + "license": "MIT", + "engines": { + "node": ">=18.14.1" + }, + "peerDependencies": { + "hono": "^4" + } + }, + "node_modules/@modelcontextprotocol/sdk": { + "version": "1.29.0", + "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.29.0.tgz", + "integrity": "sha512-zo37mZA9hJWpULgkRpowewez1y6ML5GsXJPY8FI0tBBCd77HEvza4jDqRKOXgHNn867PVGCyTdzqpz0izu5ZjQ==", + "license": "MIT", + "dependencies": { + "@hono/node-server": "^1.19.9", + "ajv": "^8.17.1", + "ajv-formats": "^3.0.1", + "content-type": "^1.0.5", + "cors": "^2.8.5", + "cross-spawn": "^7.0.5", + "eventsource": "^3.0.2", + "eventsource-parser": "^3.0.0", + "express": "^5.2.1", + "express-rate-limit": "^8.2.1", + "hono": "^4.11.4", + "jose": "^6.1.3", + "json-schema-typed": "^8.0.2", + "pkce-challenge": "^5.0.0", + "raw-body": "^3.0.0", + "zod": "^3.25 || ^4.0", + "zod-to-json-schema": "^3.25.1" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "@cfworker/json-schema": "^4.1.1", + "zod": "^3.25 || ^4.0" + }, + "peerDependenciesMeta": { + "@cfworker/json-schema": { + "optional": true + }, + "zod": { + "optional": false + } + } + }, + "node_modules/@types/node": { + "version": "20.19.43", + "resolved": "https://registry.npmjs.org/@types/node/-/node-20.19.43.tgz", + "integrity": "sha512-6oYBAi5ikg4Pl+kGsoYtawUMBT2zZMCvPNF7pVLnHZfd1zf38DRiWn/gT01RYCdUqkv7Fhr+C9ot4/tb+2sVvA==", + "dev": true, + "license": "MIT", + "dependencies": { + "undici-types": "~6.21.0" + } + }, + "node_modules/accepts": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/accepts/-/accepts-2.0.0.tgz", + "integrity": "sha512-5cvg6CtKwfgdmVqY1WIiXKc3Q1bkRqGLi+2W/6ao+6Y7gu/RCwRuAhGEzh5B4KlszSuTLgZYuqFqo5bImjNKng==", + "license": "MIT", + "dependencies": { + "mime-types": "^3.0.0", + "negotiator": "^1.0.0" + }, + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/ajv": { + "version": "8.20.0", + "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz", + "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==", + "license": "MIT", + "dependencies": { + "fast-deep-equal": "^3.1.3", + "fast-uri": "^3.0.1", + "json-schema-traverse": "^1.0.0", + "require-from-string": "^2.0.2" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/epoberezkin" + } + }, + "node_modules/ajv-formats": { + "version": "3.0.1", + "resolved": "https://registry.npmjs.org/ajv-formats/-/ajv-formats-3.0.1.tgz", + "integrity": "sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ==", + "license": "MIT", + "dependencies": { + "ajv": "^8.0.0" + }, + "peerDependencies": { + "ajv": "^8.0.0" + }, + "peerDependenciesMeta": { + "ajv": { + "optional": true + } + } + }, + "node_modules/body-parser": { + "version": "2.3.0", + "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz", + "integrity": "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==", + "license": "MIT", + "dependencies": { + "bytes": "^3.1.2", + "content-type": "^2.0.0", + "debug": "^4.4.3", + "http-errors": "^2.0.1", + "iconv-lite": "^0.7.2", + "on-finished": "^2.4.1", + "qs": "^6.15.2", + "raw-body": "^3.0.2", + "type-is": "^2.1.0" + }, + "engines": { + "node": ">=18" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, + "node_modules/body-parser/node_modules/content-type": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.0.0.tgz", + "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==", + "license": "MIT", + "engines": { + "node": ">=18" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, + "node_modules/bytes": { + "version": "3.1.2", + "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz", + "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==", + "license": "MIT", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/call-bind-apply-helpers": { + "version": "1.0.2", + "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz", + "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==", + "license": "MIT", + "dependencies": { + "es-errors": "^1.3.0", + "function-bind": "^1.1.2" + }, + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/call-bound": { + "version": "1.0.4", + "resolved": "https://registry.npmjs.org/call-bound/-/call-bound-1.0.4.tgz", + "integrity": "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==", + "license": "MIT", + "dependencies": { + "call-bind-apply-helpers": "^1.0.2", + "get-intrinsic": "^1.3.0" + }, + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/content-disposition": { + "version": "1.1.0", + "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-1.1.0.tgz", + "integrity": "sha512-5jRCH9Z/+DRP7rkvY83B+yGIGX96OYdJmzngqnw2SBSxqCFPd0w2km3s5iawpGX8krnwSGmF0FW5Nhr0Hfai3g==", + "license": "MIT", + "engines": { + "node": ">=18" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, + "node_modules/content-type": { + "version": "1.0.5", + "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.5.tgz", + "integrity": "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==", + "license": "MIT", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/cookie": { + "version": "0.7.2", + "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz", + "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==", + "license": "MIT", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/cookie-signature": { + "version": "1.2.2", + "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.2.2.tgz", + "integrity": "sha512-D76uU73ulSXrD1UXF4KE2TMxVVwhsnCgfAyTg9k8P6KGZjlXKrOLe4dJQKI3Bxi5wjesZoFXJWElNWBjPZMbhg==", + "license": "MIT", + "engines": { + "node": ">=6.6.0" + } + }, + "node_modules/cors": { + "version": "2.8.6", + "resolved": "https://registry.npmjs.org/cors/-/cors-2.8.6.tgz", + "integrity": "sha512-tJtZBBHA6vjIAaF6EnIaq6laBBP9aq/Y3ouVJjEfoHbRBcHBAHYcMh/w8LDrk2PvIMMq8gmopa5D4V8RmbrxGw==", + "license": "MIT", + "dependencies": { + "object-assign": "^4", + "vary": "^1" + }, + "engines": { + "node": ">= 0.10" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, + "node_modules/cross-spawn": { + "version": "7.0.6", + "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz", + "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==", + "license": "MIT", + "dependencies": { + "path-key": "^3.1.0", + "shebang-command": "^2.0.0", + "which": "^2.0.1" + }, + "engines": { + "node": ">= 8" + } + }, + "node_modules/debug": { + "version": "4.4.3", + "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz", + "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==", + "license": "MIT", + "dependencies": { + "ms": "^2.1.3" + }, + "engines": { + "node": ">=6.0" + }, + "peerDependenciesMeta": { + "supports-color": { + "optional": true + } + } + }, + "node_modules/depd": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz", + "integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==", + "license": "MIT", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/dunder-proto": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz", + "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==", + "license": "MIT", + "dependencies": { + "call-bind-apply-helpers": "^1.0.1", + "es-errors": "^1.3.0", + "gopd": "^1.2.0" + }, + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/ee-first": { + "version": "1.1.1", + "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz", + "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==", + "license": "MIT" + }, + "node_modules/encodeurl": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz", + "integrity": "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==", + "license": "MIT", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/es-define-property": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz", + "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==", + "license": "MIT", + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/es-errors": { + "version": "1.3.0", + "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz", + "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==", + "license": "MIT", + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/es-object-atoms": { + "version": "1.1.2", + "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.2.tgz", + "integrity": "sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==", + "license": "MIT", + "dependencies": { + "es-errors": "^1.3.0" + }, + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/escape-html": { + "version": "1.0.3", + "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz", + "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==", + "license": "MIT" + }, + "node_modules/etag": { + "version": "1.8.1", + "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz", + "integrity": "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==", + "license": "MIT", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/eventsource": { + "version": "3.0.7", + "resolved": "https://registry.npmjs.org/eventsource/-/eventsource-3.0.7.tgz", + "integrity": "sha512-CRT1WTyuQoD771GW56XEZFQ/ZoSfWid1alKGDYMmkt2yl8UXrVR4pspqWNEcqKvVIzg6PAltWjxcSSPrboA4iA==", + "license": "MIT", + "dependencies": { + "eventsource-parser": "^3.0.1" + }, + "engines": { + "node": ">=18.0.0" + } + }, + "node_modules/eventsource-parser": { + "version": "3.1.0", + "resolved": "https://registry.npmjs.org/eventsource-parser/-/eventsource-parser-3.1.0.tgz", + "integrity": "sha512-kJezFj9YFAMLeORyi7aCLxLbD5/qWMQnoMVlVPyHIll7lgRJCc3JVln9Vgl9nwQi0YkMnhdGTMNn7CkRRAptMg==", + "license": "MIT", + "engines": { + "node": ">=18.0.0" + } + }, + "node_modules/express": { + "version": "5.2.1", + "resolved": "https://registry.npmjs.org/express/-/express-5.2.1.tgz", + "integrity": "sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw==", + "license": "MIT", + "peer": true, + "dependencies": { + "accepts": "^2.0.0", + "body-parser": "^2.2.1", + "content-disposition": "^1.0.0", + "content-type": "^1.0.5", + "cookie": "^0.7.1", + "cookie-signature": "^1.2.1", + "debug": "^4.4.0", + "depd": "^2.0.0", + "encodeurl": "^2.0.0", + "escape-html": "^1.0.3", + "etag": "^1.8.1", + "finalhandler": "^2.1.0", + "fresh": "^2.0.0", + "http-errors": "^2.0.0", + "merge-descriptors": "^2.0.0", + "mime-types": "^3.0.0", + "on-finished": "^2.4.1", + "once": "^1.4.0", + "parseurl": "^1.3.3", + "proxy-addr": "^2.0.7", + "qs": "^6.14.0", + "range-parser": "^1.2.1", + "router": "^2.2.0", + "send": "^1.1.0", + "serve-static": "^2.2.0", + "statuses": "^2.0.1", + "type-is": "^2.0.1", + "vary": "^1.1.2" + }, + "engines": { + "node": ">= 18" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, + "node_modules/express-rate-limit": { + "version": "8.5.2", + "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.5.2.tgz", + "integrity": "sha512-5Kb34ipNX694DH48vN9irak1Qx30nb0PLYHXfJgw4YEjiC3ZEmZJhwOp+VfiCYwFzvFTdB9QkArYS5kXa2cx2A==", + "license": "MIT", + "dependencies": { + "ip-address": "^10.2.0" + }, + "engines": { + "node": ">= 16" + }, + "funding": { + "url": "https://github.com/sponsors/express-rate-limit" + }, + "peerDependencies": { + "express": ">= 4.11" + } + }, + "node_modules/fast-deep-equal": { + "version": "3.1.3", + "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz", + "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==", + "license": "MIT" + }, + "node_modules/fast-uri": { + "version": "3.1.3", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.3.tgz", + "integrity": "sha512-i70LwGWUduXqzicKXWshooq+sWL1K3WUU5rKZNG/0i3a1OSoX3HqhH5WbWwTmqWfor4urUakGPiRQcleRZTwOg==", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/fastify" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/fastify" + } + ], + "license": "BSD-3-Clause" + }, + "node_modules/finalhandler": { + "version": "2.1.1", + "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-2.1.1.tgz", + "integrity": "sha512-S8KoZgRZN+a5rNwqTxlZZePjT/4cnm0ROV70LedRHZ0p8u9fRID0hJUZQpkKLzro8LfmC8sx23bY6tVNxv8pQA==", + "license": "MIT", + "dependencies": { + "debug": "^4.4.0", + "encodeurl": "^2.0.0", + "escape-html": "^1.0.3", + "on-finished": "^2.4.1", + "parseurl": "^1.3.3", + "statuses": "^2.0.1" + }, + "engines": { + "node": ">= 18.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, + "node_modules/forwarded": { + "version": "0.2.0", + "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz", + "integrity": "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==", + "license": "MIT", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/fresh": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/fresh/-/fresh-2.0.0.tgz", + "integrity": "sha512-Rx/WycZ60HOaqLKAi6cHRKKI7zxWbJ31MhntmtwMoaTeF7XFH9hhBp8vITaMidfljRQ6eYWCKkaTK+ykVJHP2A==", + "license": "MIT", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/function-bind": { + "version": "1.1.2", + "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz", + "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==", + "license": "MIT", + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/get-intrinsic": { + "version": "1.3.0", + "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz", + "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==", + "license": "MIT", + "dependencies": { + "call-bind-apply-helpers": "^1.0.2", + "es-define-property": "^1.0.1", + "es-errors": "^1.3.0", + "es-object-atoms": "^1.1.1", + "function-bind": "^1.1.2", + "get-proto": "^1.0.1", + "gopd": "^1.2.0", + "has-symbols": "^1.1.0", + "hasown": "^2.0.2", + "math-intrinsics": "^1.1.0" + }, + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/get-proto": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz", + "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==", + "license": "MIT", + "dependencies": { + "dunder-proto": "^1.0.1", + "es-object-atoms": "^1.0.0" + }, + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/gopd": { + "version": "1.2.0", + "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz", + "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==", + "license": "MIT", + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/has-symbols": { + "version": "1.1.0", + "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz", + "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==", + "license": "MIT", + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/hasown": { + "version": "2.0.4", + "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz", + "integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==", + "license": "MIT", + "dependencies": { + "function-bind": "^1.1.2" + }, + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/hono": { + "version": "4.12.28", + "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.28.tgz", + "integrity": "sha512-YwUvVpSF7m1yOblFPrU3Hbo8XhPheBoiyfGuII6z19LnOr6JpDnyyp7LFNrfV56wS8tpvtBFGRISHN02pDdLOA==", + "license": "MIT", + "peer": true, + "engines": { + "node": ">=16.9.0" + } + }, + "node_modules/http-errors": { + "version": "2.0.1", + "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz", + "integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==", + "license": "MIT", + "dependencies": { + "depd": "~2.0.0", + "inherits": "~2.0.4", + "setprototypeof": "~1.2.0", + "statuses": "~2.0.2", + "toidentifier": "~1.0.1" + }, + "engines": { + "node": ">= 0.8" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, + "node_modules/iconv-lite": { + "version": "0.7.3", + "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.3.tgz", + "integrity": "sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ==", + "license": "MIT", + "dependencies": { + "safer-buffer": ">= 2.1.2 < 3.0.0" + }, + "engines": { + "node": ">=0.10.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, + "node_modules/inherits": { + "version": "2.0.4", + "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz", + "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==", + "license": "ISC" + }, + "node_modules/ip-address": { + "version": "10.2.0", + "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz", + "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==", + "license": "MIT", + "engines": { + "node": ">= 12" + } + }, + "node_modules/ipaddr.js": { + "version": "1.9.1", + "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz", + "integrity": "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==", + "license": "MIT", + "engines": { + "node": ">= 0.10" + } + }, + "node_modules/is-promise": { + "version": "4.0.0", + "resolved": "https://registry.npmjs.org/is-promise/-/is-promise-4.0.0.tgz", + "integrity": "sha512-hvpoI6korhJMnej285dSg6nu1+e6uxs7zG3BYAm5byqDsgJNWwxzM6z6iZiAgQR4TJ30JmBTOwqZUw3WlyH3AQ==", + "license": "MIT" + }, + "node_modules/isexe": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz", + "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==", + "license": "ISC" + }, + "node_modules/jose": { + "version": "6.2.3", + "resolved": "https://registry.npmjs.org/jose/-/jose-6.2.3.tgz", + "integrity": "sha512-YYVDInQKFJfR/xa3ojUTl8c2KoTwiL1R5Wg9YCydwH0x0B9grbzlg5HC7mMjCtUJjbQ/YnGEZIhI5tCgfTb4Hw==", + "license": "MIT", + "funding": { + "url": "https://github.com/sponsors/panva" + } + }, + "node_modules/json-schema-traverse": { + "version": "1.0.0", + "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz", + "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==", + "license": "MIT" + }, + "node_modules/json-schema-typed": { + "version": "8.0.2", + "resolved": "https://registry.npmjs.org/json-schema-typed/-/json-schema-typed-8.0.2.tgz", + "integrity": "sha512-fQhoXdcvc3V28x7C7BMs4P5+kNlgUURe2jmUT1T//oBRMDrqy1QPelJimwZGo7Hg9VPV3EQV5Bnq4hbFy2vetA==", + "license": "BSD-2-Clause" + }, + "node_modules/math-intrinsics": { + "version": "1.1.0", + "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz", + "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==", + "license": "MIT", + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/media-typer": { + "version": "1.1.0", + "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-1.1.0.tgz", + "integrity": "sha512-aisnrDP4GNe06UcKFnV5bfMNPBUw4jsLGaWwWfnH3v02GnBuXX2MCVn5RbrWo0j3pczUilYblq7fQ7Nw2t5XKw==", + "license": "MIT", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/merge-descriptors": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-2.0.0.tgz", + "integrity": "sha512-Snk314V5ayFLhp3fkUREub6WtjBfPdCPY1Ln8/8munuLuiYhsABgBVWsozAG+MWMbVEvcdcpbi9R7ww22l9Q3g==", + "license": "MIT", + "engines": { + "node": ">=18" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/mime-db": { + "version": "1.54.0", + "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz", + "integrity": "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==", + "license": "MIT", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/mime-types": { + "version": "3.0.2", + "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-3.0.2.tgz", + "integrity": "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==", + "license": "MIT", + "dependencies": { + "mime-db": "^1.54.0" + }, + "engines": { + "node": ">=18" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, + "node_modules/ms": { + "version": "2.1.3", + "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz", + "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==", + "license": "MIT" + }, + "node_modules/negotiator": { + "version": "1.0.0", + "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-1.0.0.tgz", + "integrity": "sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg==", + "license": "MIT", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/object-assign": { + "version": "4.1.1", + "resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz", + "integrity": "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==", + "license": "MIT", + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/object-inspect": { + "version": "1.13.4", + "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.4.tgz", + "integrity": "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==", + "license": "MIT", + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/on-finished": { + "version": "2.4.1", + "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz", + "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==", + "license": "MIT", + "dependencies": { + "ee-first": "1.1.1" + }, + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/once": { + "version": "1.4.0", + "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz", + "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==", + "license": "ISC", + "dependencies": { + "wrappy": "1" + } + }, + "node_modules/parseurl": { + "version": "1.3.3", + "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz", + "integrity": "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==", + "license": "MIT", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/path-key": { + "version": "3.1.1", + "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz", + "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==", + "license": "MIT", + "engines": { + "node": ">=8" + } + }, + "node_modules/path-to-regexp": { + "version": "8.4.2", + "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-8.4.2.tgz", + "integrity": "sha512-qRcuIdP69NPm4qbACK+aDogI5CBDMi1jKe0ry5rSQJz8JVLsC7jV8XpiJjGRLLol3N+R5ihGYcrPLTno6pAdBA==", + "license": "MIT", + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, + "node_modules/pkce-challenge": { + "version": "5.0.1", + "resolved": "https://registry.npmjs.org/pkce-challenge/-/pkce-challenge-5.0.1.tgz", + "integrity": "sha512-wQ0b/W4Fr01qtpHlqSqspcj3EhBvimsdh0KlHhH8HRZnMsEa0ea2fTULOXOS9ccQr3om+GcGRk4e+isrZWV8qQ==", + "license": "MIT", + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/proxy-addr": { + "version": "2.0.7", + "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz", + "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==", + "license": "MIT", + "dependencies": { + "forwarded": "0.2.0", + "ipaddr.js": "1.9.1" + }, + "engines": { + "node": ">= 0.10" + } + }, + "node_modules/qs": { + "version": "6.15.3", + "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.3.tgz", + "integrity": "sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==", + "license": "BSD-3-Clause", + "dependencies": { + "es-define-property": "^1.0.1", + "side-channel": "^1.1.1" + }, + "engines": { + "node": ">=0.6" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/range-parser": { + "version": "1.3.0", + "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.3.0.tgz", + "integrity": "sha512-hek2mFQpPuI4E1BBKrSto+BU3e3x4xuarsbiwr3+lf7p44juvFMV0XFWQAP3xUyqXA4RrXLIoaSUGbSt056ZMw==", + "license": "MIT", + "engines": { + "node": ">= 0.6" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, + "node_modules/raw-body": { + "version": "3.0.2", + "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-3.0.2.tgz", + "integrity": "sha512-K5zQjDllxWkf7Z5xJdV0/B0WTNqx6vxG70zJE4N0kBs4LovmEYWJzQGxC9bS9RAKu3bgM40lrd5zoLJ12MQ5BA==", + "license": "MIT", + "dependencies": { + "bytes": "~3.1.2", + "http-errors": "~2.0.1", + "iconv-lite": "~0.7.0", + "unpipe": "~1.0.0" + }, + "engines": { + "node": ">= 0.10" + } + }, + "node_modules/require-from-string": { + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz", + "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==", + "license": "MIT", + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/router": { + "version": "2.2.0", + "resolved": "https://registry.npmjs.org/router/-/router-2.2.0.tgz", + "integrity": "sha512-nLTrUKm2UyiL7rlhapu/Zl45FwNgkZGaCpZbIHajDYgwlJCOzLSk+cIPAnsEqV955GjILJnKbdQC1nVPz+gAYQ==", + "license": "MIT", + "dependencies": { + "debug": "^4.4.0", + "depd": "^2.0.0", + "is-promise": "^4.0.0", + "parseurl": "^1.3.3", + "path-to-regexp": "^8.0.0" + }, + "engines": { + "node": ">= 18" + } + }, + "node_modules/safer-buffer": { + "version": "2.1.2", + "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz", + "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==", + "license": "MIT" + }, + "node_modules/send": { + "version": "1.2.1", + "resolved": "https://registry.npmjs.org/send/-/send-1.2.1.tgz", + "integrity": "sha512-1gnZf7DFcoIcajTjTwjwuDjzuz4PPcY2StKPlsGAQ1+YH20IRVrBaXSWmdjowTJ6u8Rc01PoYOGHXfP1mYcZNQ==", + "license": "MIT", + "dependencies": { + "debug": "^4.4.3", + "encodeurl": "^2.0.0", + "escape-html": "^1.0.3", + "etag": "^1.8.1", + "fresh": "^2.0.0", + "http-errors": "^2.0.1", + "mime-types": "^3.0.2", + "ms": "^2.1.3", + "on-finished": "^2.4.1", + "range-parser": "^1.2.1", + "statuses": "^2.0.2" + }, + "engines": { + "node": ">= 18" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, + "node_modules/serve-static": { + "version": "2.2.1", + "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-2.2.1.tgz", + "integrity": "sha512-xRXBn0pPqQTVQiC8wyQrKs2MOlX24zQ0POGaj0kultvoOCstBQM5yvOhAVSUwOMjQtTvsPWoNCHfPGwaaQJhTw==", + "license": "MIT", + "dependencies": { + "encodeurl": "^2.0.0", + "escape-html": "^1.0.3", + "parseurl": "^1.3.3", + "send": "^1.2.0" + }, + "engines": { + "node": ">= 18" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, + "node_modules/setprototypeof": { + "version": "1.2.0", + "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz", + "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==", + "license": "ISC" + }, + "node_modules/shebang-command": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz", + "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==", + "license": "MIT", + "dependencies": { + "shebang-regex": "^3.0.0" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/shebang-regex": { + "version": "3.0.0", + "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz", + "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==", + "license": "MIT", + "engines": { + "node": ">=8" + } + }, + "node_modules/side-channel": { + "version": "1.1.1", + "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.1.tgz", + "integrity": "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==", + "license": "MIT", + "dependencies": { + "es-errors": "^1.3.0", + "object-inspect": "^1.13.4", + "side-channel-list": "^1.0.1", + "side-channel-map": "^1.0.1", + "side-channel-weakmap": "^1.0.2" + }, + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/side-channel-list": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.1.tgz", + "integrity": "sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==", + "license": "MIT", + "dependencies": { + "es-errors": "^1.3.0", + "object-inspect": "^1.13.4" + }, + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/side-channel-map": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/side-channel-map/-/side-channel-map-1.0.1.tgz", + "integrity": "sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==", + "license": "MIT", + "dependencies": { + "call-bound": "^1.0.2", + "es-errors": "^1.3.0", + "get-intrinsic": "^1.2.5", + "object-inspect": "^1.13.3" + }, + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/side-channel-weakmap": { + "version": "1.0.2", + "resolved": "https://registry.npmjs.org/side-channel-weakmap/-/side-channel-weakmap-1.0.2.tgz", + "integrity": "sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==", + "license": "MIT", + "dependencies": { + "call-bound": "^1.0.2", + "es-errors": "^1.3.0", + "get-intrinsic": "^1.2.5", + "object-inspect": "^1.13.3", + "side-channel-map": "^1.0.1" + }, + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/statuses": { + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz", + "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==", + "license": "MIT", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/toidentifier": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz", + "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==", + "license": "MIT", + "engines": { + "node": ">=0.6" + } + }, + "node_modules/type-is": { + "version": "2.1.0", + "resolved": "https://registry.npmjs.org/type-is/-/type-is-2.1.0.tgz", + "integrity": "sha512-faYHw0anBbc/kWF3zFTEnxSFOAGUX9GFbOBthvDdLsIlEoWOFOtS0zgCiQYwIskL9iGXZL3kAXD8OoZ4GmMATA==", + "license": "MIT", + "dependencies": { + "content-type": "^2.0.0", + "media-typer": "^1.1.0", + "mime-types": "^3.0.0" + }, + "engines": { + "node": ">= 18" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, + "node_modules/type-is/node_modules/content-type": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.0.0.tgz", + "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==", + "license": "MIT", + "engines": { + "node": ">=18" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, + "node_modules/typescript": { + "version": "5.9.3", + "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz", + "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==", + "dev": true, + "license": "Apache-2.0", + "bin": { + "tsc": "bin/tsc", + "tsserver": "bin/tsserver" + }, + "engines": { + "node": ">=14.17" + } + }, + "node_modules/undici-types": { + "version": "6.21.0", + "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz", + "integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==", + "dev": true, + "license": "MIT" + }, + "node_modules/unpipe": { + "version": "1.0.0", + "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz", + "integrity": "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==", + "license": "MIT", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/vary": { + "version": "1.1.2", + "resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz", + "integrity": "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==", + "license": "MIT", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/which": { + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz", + "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==", + "license": "ISC", + "dependencies": { + "isexe": "^2.0.0" + }, + "bin": { + "node-which": "bin/node-which" + }, + "engines": { + "node": ">= 8" + } + }, + "node_modules/wrappy": { + "version": "1.0.2", + "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz", + "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==", + "license": "ISC" + }, + "node_modules/zod": { + "version": "3.25.76", + "resolved": "https://registry.npmjs.org/zod/-/zod-3.25.76.tgz", + "integrity": "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==", + "license": "MIT", + "peer": true, + "funding": { + "url": "https://github.com/sponsors/colinhacks" + } + }, + "node_modules/zod-to-json-schema": { + "version": "3.25.2", + "resolved": "https://registry.npmjs.org/zod-to-json-schema/-/zod-to-json-schema-3.25.2.tgz", + "integrity": "sha512-O/PgfnpT1xKSDeQYSCfRI5Gy3hPf91mKVDuYLUHZJMiDFptvP41MSnWofm8dnCm0256ZNfZIM7DSzuSMAFnjHA==", + "license": "ISC", + "peerDependencies": { + "zod": "^3.25.28 || ^4" + } + } + } +} diff --git a/mcp-server/package.json b/mcp-server/package.json new file mode 100644 index 0000000..10abe57 --- /dev/null +++ b/mcp-server/package.json @@ -0,0 +1,49 @@ +{ + "name": "wacrm-mcp", + "version": "0.1.0", + "mcpName": "io.github.arnasdon/wacrm-mcp", + "description": "Model Context Protocol (MCP) server for wacrm — drive your self-hosted WhatsApp CRM from Claude, Cursor, and other MCP clients.", + "license": "MIT", + "author": "Arnas Donauskas", + "homepage": "https://github.com/ArnasDon/wacrm", + "repository": { + "type": "git", + "url": "git+https://github.com/ArnasDon/wacrm.git", + "directory": "mcp-server" + }, + "keywords": [ + "mcp", + "model-context-protocol", + "wacrm", + "whatsapp", + "crm", + "claude", + "ai" + ], + "type": "module", + "engines": { + "node": ">=20.0.0" + }, + "bin": { + "wacrm-mcp": "./dist/index.js" + }, + "files": [ + "dist", + "README.md" + ], + "scripts": { + "build": "tsc", + "start": "node dist/index.js", + "dev": "tsc --watch", + "typecheck": "tsc --noEmit", + "prepublishOnly": "npm run build" + }, + "dependencies": { + "@modelcontextprotocol/sdk": "^1.18.0", + "zod": "^3.25.0" + }, + "devDependencies": { + "@types/node": "^20.19.0", + "typescript": "^5.7.0" + } +} diff --git a/mcp-server/server.json b/mcp-server/server.json new file mode 100644 index 0000000..f7fec5a --- /dev/null +++ b/mcp-server/server.json @@ -0,0 +1,51 @@ +{ + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "name": "io.github.arnasdon/wacrm-mcp", + "description": "Drive a self-hosted wacrm WhatsApp CRM (contacts, conversations, messages, broadcasts) from MCP clients.", + "repository": { + "url": "https://github.com/ArnasDon/wacrm", + "source": "github", + "subfolder": "mcp-server" + }, + "version": "0.1.0", + "packages": [ + { + "registryType": "npm", + "identifier": "wacrm-mcp", + "version": "0.1.0", + "transport": { + "type": "stdio" + }, + "environmentVariables": [ + { + "name": "WACRM_BASE_URL", + "description": "Base URL of your wacrm instance, e.g. https://crm.example.com", + "isRequired": true, + "isSecret": false, + "format": "string" + }, + { + "name": "WACRM_API_KEY", + "description": "wacrm API key (Settings → API keys). Its scopes decide what is allowed.", + "isRequired": true, + "isSecret": true, + "format": "string" + }, + { + "name": "WACRM_ENABLE_WRITES", + "description": "Set to true to expose contact create/update and message sending. Read-only when unset.", + "isRequired": false, + "isSecret": false, + "format": "string" + }, + { + "name": "WACRM_ENABLE_BROADCASTS", + "description": "Set to true to expose the mass-broadcast tool. Requires WACRM_ENABLE_WRITES.", + "isRequired": false, + "isSecret": false, + "format": "string" + } + ] + } + ] +} diff --git a/mcp-server/src/client.ts b/mcp-server/src/client.ts new file mode 100644 index 0000000..269f49a --- /dev/null +++ b/mcp-server/src/client.ts @@ -0,0 +1,179 @@ +// ============================================================ +// wacrm public API client. +// +// A thin wrapper over the `/api/v1` REST surface. It attaches the +// bearer key, unwraps the `{ data }` / `{ error }` envelope, and +// turns API failures into a typed WacrmApiError the tools can render +// cleanly. Nothing here knows about MCP — it's just the CRM API. +// ============================================================ + +import type { Config } from './config.js'; + +/** A structured error from the wacrm API envelope (`{ error: { code, message } }`). */ +export class WacrmApiError extends Error { + readonly status: number; + readonly code: string; + + constructor(status: number, code: string, message: string) { + super(message); + this.name = 'WacrmApiError'; + this.status = status; + this.code = code; + } +} + +export interface Paginated { + data: T[]; + next_cursor: string | null; +} + +export class WacrmClient { + private readonly baseUrl: string; + private readonly apiKey: string; + + constructor(config: Pick) { + this.baseUrl = config.baseUrl; + this.apiKey = config.apiKey; + } + + private async request( + method: string, + path: string, + options: { query?: Record; body?: unknown } = {}, + ): Promise<{ data: T; meta?: { next_cursor: string | null } }> { + const url = new URL(`${this.baseUrl}/api/v1${path}`); + if (options.query) { + for (const [key, value] of Object.entries(options.query)) { + if (value !== undefined && value !== null && value !== '') { + url.searchParams.set(key, String(value)); + } + } + } + + const headers: Record = { + Authorization: `Bearer ${this.apiKey}`, + Accept: 'application/json', + }; + if (options.body !== undefined) { + headers['Content-Type'] = 'application/json'; + } + + let res: Response; + try { + res = await fetch(url, { + method, + headers, + body: options.body !== undefined ? JSON.stringify(options.body) : undefined, + }); + } catch (err) { + throw new WacrmApiError( + 0, + 'network_error', + `Could not reach wacrm at ${this.baseUrl}: ${(err as Error).message}`, + ); + } + + // 429s carry a Retry-After we surface to the model. + let payload: unknown = undefined; + const text = await res.text(); + if (text) { + try { + payload = JSON.parse(text); + } catch { + // Non-JSON body (e.g. an upstream proxy error page). + if (!res.ok) { + throw new WacrmApiError(res.status, 'internal', text.slice(0, 500)); + } + } + } + + if (!res.ok) { + const envelope = payload as { error?: { code?: string; message?: string } } | undefined; + const code = envelope?.error?.code ?? 'internal'; + let message = envelope?.error?.message ?? `Request failed with status ${res.status}`; + if (res.status === 429) { + const retryAfter = res.headers.get('Retry-After'); + if (retryAfter) message += ` (retry after ${retryAfter}s)`; + } + throw new WacrmApiError(res.status, code, message); + } + + const envelope = payload as { data: T; meta?: { next_cursor: string | null } }; + return { data: envelope.data, meta: envelope.meta }; + } + + private async list( + path: string, + query: Record, + ): Promise> { + const res = await this.request('GET', path, { query }); + return { data: res.data, next_cursor: res.meta?.next_cursor ?? null }; + } + + // --- Identity ----------------------------------------------------- + + me(): Promise<{ data: unknown }> { + return this.request('GET', '/me'); + } + + // --- Messages ----------------------------------------------------- + + sendMessage(body: unknown): Promise<{ data: unknown }> { + return this.request('POST', '/messages', { body }); + } + + // --- Contacts ----------------------------------------------------- + + listContacts(query: { + limit?: number; + cursor?: string; + search?: string; + tag?: string; + }): Promise> { + return this.list('/contacts', query); + } + + getContact(id: string): Promise<{ data: unknown }> { + return this.request('GET', `/contacts/${encodeURIComponent(id)}`); + } + + createContact(body: unknown): Promise<{ data: unknown }> { + return this.request('POST', '/contacts', { body }); + } + + updateContact(id: string, body: unknown): Promise<{ data: unknown }> { + return this.request('PATCH', `/contacts/${encodeURIComponent(id)}`, { body }); + } + + // --- Conversations ------------------------------------------------ + + listConversations(query: { + limit?: number; + cursor?: string; + status?: string; + contact_id?: string; + }): Promise> { + return this.list('/conversations', query); + } + + getConversation(id: string): Promise<{ data: unknown }> { + return this.request('GET', `/conversations/${encodeURIComponent(id)}`); + } + + listConversationMessages( + id: string, + query: { limit?: number; cursor?: string }, + ): Promise> { + return this.list(`/conversations/${encodeURIComponent(id)}/messages`, query); + } + + // --- Broadcasts --------------------------------------------------- + + sendBroadcast(body: unknown): Promise<{ data: unknown }> { + return this.request('POST', '/broadcasts', { body }); + } + + getBroadcast(id: string): Promise<{ data: unknown }> { + return this.request('GET', `/broadcasts/${encodeURIComponent(id)}`); + } +} diff --git a/mcp-server/src/config.ts b/mcp-server/src/config.ts new file mode 100644 index 0000000..7aed002 --- /dev/null +++ b/mcp-server/src/config.ts @@ -0,0 +1,64 @@ +// ============================================================ +// Configuration — read once at startup from the environment. +// +// The server needs the URL of a wacrm instance and an API key. +// Two opt-in flags decide whether write / broadcast tools are +// registered at all: by default the server is READ-ONLY, so an +// MCP client can never see a tool that mutates data or sends a +// message unless the operator turns it on deliberately. The API +// key's own scopes are still enforced server-side on top of this — +// this is a second, client-side guard, not a replacement. +// ============================================================ + +export interface Config { + baseUrl: string; + apiKey: string; + enableWrites: boolean; + enableBroadcasts: boolean; +} + +function truthy(value: string | undefined): boolean { + if (!value) return false; + const v = value.trim().toLowerCase(); + return v === '1' || v === 'true' || v === 'yes' || v === 'on'; +} + +export function loadConfig(): Config { + const baseUrlRaw = process.env.WACRM_BASE_URL?.trim(); + const apiKey = process.env.WACRM_API_KEY?.trim(); + + const missing: string[] = []; + if (!baseUrlRaw) missing.push('WACRM_BASE_URL'); + if (!apiKey) missing.push('WACRM_API_KEY'); + if (missing.length > 0) { + throw new Error( + `Missing required environment variable(s): ${missing.join(', ')}. ` + + `Set WACRM_BASE_URL to your instance URL (e.g. https://crm.example.com) ` + + `and WACRM_API_KEY to a key from Settings → API keys.`, + ); + } + + // Normalise: strip a trailing slash so path joins are predictable. + const baseUrl = baseUrlRaw!.replace(/\/+$/, ''); + if (!/^https?:\/\//.test(baseUrl)) { + throw new Error( + `WACRM_BASE_URL must start with http:// or https:// (got "${baseUrl}").`, + ); + } + + const enableWrites = truthy(process.env.WACRM_ENABLE_WRITES); + const enableBroadcasts = truthy(process.env.WACRM_ENABLE_BROADCASTS); + + if (enableBroadcasts && !enableWrites) { + throw new Error( + 'WACRM_ENABLE_BROADCASTS requires WACRM_ENABLE_WRITES to also be set.', + ); + } + + return { + baseUrl, + apiKey: apiKey!, + enableWrites, + enableBroadcasts, + }; +} diff --git a/mcp-server/src/index.ts b/mcp-server/src/index.ts new file mode 100644 index 0000000..ae8f600 --- /dev/null +++ b/mcp-server/src/index.ts @@ -0,0 +1,45 @@ +#!/usr/bin/env node +// ============================================================ +// wacrm MCP server — entry point. +// +// A stdio Model Context Protocol server that exposes the wacrm +// public API (`/api/v1`) as MCP tools, so an MCP client (Claude +// Desktop, Cursor, etc.) can drive a self-hosted WhatsApp CRM in +// natural language. +// +// Transport is stdio: logs MUST go to stderr, never stdout (stdout +// is the protocol channel). Configuration comes from the environment +// — see .env.example / README.md. +// ============================================================ + +import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'; +import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'; +import { loadConfig } from './config.js'; +import { WacrmClient } from './client.js'; +import { registerTools } from './tools/index.js'; + +// package.json version, kept in sync manually with the manifest. +const VERSION = '0.1.0'; + +async function main(): Promise { + const config = loadConfig(); + const client = new WacrmClient(config); + + const server = new McpServer({ name: 'wacrm-mcp', version: VERSION }); + const groups = registerTools(server, client, config); + + const transport = new StdioServerTransport(); + await server.connect(transport); + + // Stderr only — stdout is reserved for the MCP protocol. + console.error( + `wacrm MCP server v${VERSION} ready — instance ${config.baseUrl}, ` + + `tool groups: ${groups.join(', ')}` + + (config.enableWrites ? '' : ' (read-only; set WACRM_ENABLE_WRITES to allow changes)'), + ); +} + +main().catch((err) => { + console.error(`Failed to start wacrm MCP server: ${(err as Error).message}`); + process.exit(1); +}); diff --git a/mcp-server/src/tools/broadcast.ts b/mcp-server/src/tools/broadcast.ts new file mode 100644 index 0000000..8be5da1 --- /dev/null +++ b/mcp-server/src/tools/broadcast.ts @@ -0,0 +1,63 @@ +// ============================================================ +// Broadcast tool — the highest-risk action. +// +// Registered only when BOTH WACRM_ENABLE_WRITES and +// WACRM_ENABLE_BROADCASTS are set. A single call can message up to +// 1000 people, so on top of the env gate the tool requires an +// explicit `confirm: true` argument — the model must consciously opt +// in, and a client that echoes tool args gives the user a last look. +// Marked destructive so hosts prompt before running it. +// ============================================================ + +import { z } from 'zod'; +import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'; +import type { WacrmClient } from '../client.js'; +import { errorResult, handle, jsonResult } from './shared.js'; + +export function registerBroadcastTools(server: McpServer, client: WacrmClient): void { + server.registerTool( + 'send_broadcast', + { + title: 'Send broadcast', + description: + 'Launch a template broadcast to a list of recipients (up to 1000). This sends a real WhatsApp template message to every recipient — a mass, irreversible action. You MUST set confirm=true, and you should show the full recipient list and template to the user for approval before calling. The call returns fast; poll get_broadcast for delivery progress.', + inputSchema: { + name: z.string().describe('A name for this broadcast campaign (for your own reference).'), + template_name: z.string().describe('Meta-approved template name.'), + template_language: z.string().describe('Template language code, e.g. "en_US".'), + recipients: z + .array( + z.object({ + to: z.string().describe('Recipient phone number in E.164 format.'), + params: z + .array(z.string()) + .optional() + .describe('Positional template body variables for this recipient.'), + }), + ) + .min(1) + .max(1000) + .describe('Recipients (1–1000). Invalid numbers are dropped and counted as rejected.'), + confirm: z + .boolean() + .describe('Must be true to actually send. A safety gate against accidental mass sends.'), + }, + annotations: { + title: 'Send broadcast', + readOnlyHint: false, + destructiveHint: true, + openWorldHint: true, + }, + }, + handle(async ({ confirm, ...body }) => { + if (confirm !== true) { + return errorResult( + 'Refusing to send: confirm must be true. This launches a mass broadcast to ' + + `${body.recipients.length} recipient(s). Confirm the recipient list and template ` + + 'with the user, then call again with confirm=true.', + ); + } + return jsonResult(await client.sendBroadcast(body)); + }), + ); +} diff --git a/mcp-server/src/tools/index.ts b/mcp-server/src/tools/index.ts new file mode 100644 index 0000000..4c5026e --- /dev/null +++ b/mcp-server/src/tools/index.ts @@ -0,0 +1,29 @@ +// ============================================================ +// Tool registration — decides which tools exist for this process +// based on the write guards. Reads are always on; writes and +// broadcasts are opt-in (see config.ts). +// ============================================================ + +import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'; +import type { WacrmClient } from '../client.js'; +import type { Config } from '../config.js'; +import { registerReadTools } from './read.js'; +import { registerWriteTools } from './write.js'; +import { registerBroadcastTools } from './broadcast.js'; + +export function registerTools(server: McpServer, client: WacrmClient, config: Config): string[] { + const enabled: string[] = ['read']; + registerReadTools(server, client); + + if (config.enableWrites) { + registerWriteTools(server, client); + enabled.push('write'); + } + + if (config.enableBroadcasts) { + registerBroadcastTools(server, client); + enabled.push('broadcast'); + } + + return enabled; +} diff --git a/mcp-server/src/tools/read.ts b/mcp-server/src/tools/read.ts new file mode 100644 index 0000000..4b7ee11 --- /dev/null +++ b/mcp-server/src/tools/read.ts @@ -0,0 +1,127 @@ +// ============================================================ +// Read-only tools — always registered. +// +// whoami + list/read of contacts, conversations, messages, and +// broadcast status. None of these change state, so they're safe to +// expose unconditionally. Each carries readOnlyHint so clients can +// surface them without a confirmation prompt. +// ============================================================ + +import { z } from 'zod'; +import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'; +import type { WacrmClient } from '../client.js'; +import { handle, jsonResult } from './shared.js'; + +const READ_ONLY = { readOnlyHint: true, openWorldHint: true } as const; + +export function registerReadTools(server: McpServer, client: WacrmClient): void { + server.registerTool( + 'whoami', + { + title: 'Who am I', + description: + 'Verify the API key and show which wacrm account it is bound to and what scopes it carries. Call this first to discover what actions are possible.', + inputSchema: {}, + annotations: { ...READ_ONLY, title: 'Who am I' }, + }, + handle(async () => jsonResult(await client.me())), + ); + + server.registerTool( + 'list_contacts', + { + title: 'List contacts', + description: + 'List contacts in the CRM, newest first. Optionally filter by a free-text search (matches name or phone) or by a tag id. Results are paginated: pass the returned next_cursor to fetch the next page.', + inputSchema: { + search: z.string().optional().describe('Free-text search over name or phone number.'), + tag: z.string().optional().describe('Tag id to filter by.'), + limit: z + .number() + .int() + .min(1) + .max(100) + .optional() + .describe('Page size, 1–100 (default 50).'), + cursor: z.string().optional().describe('Opaque pagination cursor from a previous response.'), + }, + annotations: { ...READ_ONLY, title: 'List contacts' }, + }, + handle(async (args) => jsonResult(await client.listContacts(args))), + ); + + server.registerTool( + 'get_contact', + { + title: 'Get contact', + description: 'Read a single contact by its id.', + inputSchema: { + id: z.string().describe('Contact id.'), + }, + annotations: { ...READ_ONLY, title: 'Get contact' }, + }, + handle(async ({ id }) => jsonResult(await client.getContact(id))), + ); + + server.registerTool( + 'list_conversations', + { + title: 'List conversations', + description: + 'List conversations, newest first. Optionally filter by status (open / pending / closed) or by contact id. Paginated.', + inputSchema: { + status: z.enum(['open', 'pending', 'closed']).optional().describe('Conversation status filter.'), + contact_id: z.string().optional().describe('Only conversations for this contact.'), + limit: z.number().int().min(1).max(100).optional().describe('Page size, 1–100 (default 50).'), + cursor: z.string().optional().describe('Opaque pagination cursor.'), + }, + annotations: { ...READ_ONLY, title: 'List conversations' }, + }, + handle(async (args) => jsonResult(await client.listConversations(args))), + ); + + server.registerTool( + 'get_conversation', + { + title: 'Get conversation', + description: 'Read a single conversation by id, including its contact and tags.', + inputSchema: { + id: z.string().describe('Conversation id.'), + }, + annotations: { ...READ_ONLY, title: 'Get conversation' }, + }, + handle(async ({ id }) => jsonResult(await client.getConversation(id))), + ); + + server.registerTool( + 'list_messages', + { + title: 'List messages', + description: + 'List the messages in a conversation, newest first. Each message includes its direction (inbound/outbound), delivery status, and content. Paginated.', + inputSchema: { + conversation_id: z.string().describe('The conversation to read messages from.'), + limit: z.number().int().min(1).max(100).optional().describe('Page size, 1–100 (default 50).'), + cursor: z.string().optional().describe('Opaque pagination cursor.'), + }, + annotations: { ...READ_ONLY, title: 'List messages' }, + }, + handle(async ({ conversation_id, limit, cursor }) => + jsonResult(await client.listConversationMessages(conversation_id, { limit, cursor })), + ), + ); + + server.registerTool( + 'get_broadcast', + { + title: 'Get broadcast status', + description: + 'Read a broadcast campaign by id — its status and delivered / read / rejected counts. Use this to poll progress after launching one.', + inputSchema: { + id: z.string().describe('Broadcast id.'), + }, + annotations: { ...READ_ONLY, title: 'Get broadcast status' }, + }, + handle(async ({ id }) => jsonResult(await client.getBroadcast(id))), + ); +} diff --git a/mcp-server/src/tools/shared.ts b/mcp-server/src/tools/shared.ts new file mode 100644 index 0000000..b66407d --- /dev/null +++ b/mcp-server/src/tools/shared.ts @@ -0,0 +1,45 @@ +// ============================================================ +// Shared helpers for tool handlers. +// +// Every tool returns MCP `content`. On success we hand back the JSON +// payload as pretty text (models read it fine and it keeps the tool +// layer dumb). On a WacrmApiError we return an `isError` result with +// the stable error code, so the model can reason about *why* it +// failed (missing scope, rate limit, not found) instead of seeing a +// stack trace. +// ============================================================ + +import type { CallToolResult } from '@modelcontextprotocol/sdk/types.js'; +import { WacrmApiError } from '../client.js'; + +export function jsonResult(payload: unknown): CallToolResult { + return { + content: [{ type: 'text', text: JSON.stringify(payload, null, 2) }], + }; +} + +export function errorResult(message: string): CallToolResult { + return { + content: [{ type: 'text', text: message }], + isError: true, + }; +} + +/** + * Wrap a tool handler so any WacrmApiError becomes a clean, model- + * readable error result and unexpected throws don't crash the server. + */ +export function handle( + fn: (args: A) => Promise, +): (args: A) => Promise { + return async (args: A) => { + try { + return await fn(args); + } catch (err) { + if (err instanceof WacrmApiError) { + return errorResult(`wacrm API error [${err.code}]: ${err.message}`); + } + return errorResult(`Unexpected error: ${(err as Error).message}`); + } + }; +} diff --git a/mcp-server/src/tools/write.ts b/mcp-server/src/tools/write.ts new file mode 100644 index 0000000..272e226 --- /dev/null +++ b/mcp-server/src/tools/write.ts @@ -0,0 +1,95 @@ +// ============================================================ +// Write tools — registered only when WACRM_ENABLE_WRITES is set. +// +// These change data or send a WhatsApp message. They are gated so a +// read-only deployment never exposes them to the model at all. (The +// API key's scopes are still enforced server-side; a call without the +// right scope returns a clean `forbidden` error.) +// ============================================================ + +import { z } from 'zod'; +import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'; +import type { WacrmClient } from '../client.js'; +import { handle, jsonResult } from './shared.js'; + +const templateSchema = z + .object({ + name: z.string().describe('Meta-approved template name.'), + language: z.string().describe('Template language code, e.g. "en_US".'), + params: z + .array(z.string()) + .optional() + .describe('Positional body variables, in order.'), + }) + .describe('Template payload — required when type is "template".'); + +export function registerWriteTools(server: McpServer, client: WacrmClient): void { + server.registerTool( + 'send_message', + { + title: 'Send WhatsApp message', + description: + 'Send a WhatsApp message to a phone number (E.164, e.g. +14155550123). The contact and conversation are found-or-created automatically. Use type "text" for a free-form message (only valid inside the 24-hour customer-service window), or "template" to send an approved template (required to open a new conversation). Media types (image/video/document/audio) require a media_url. This sends a real message to a real person — confirm the recipient and content with the user before calling.', + inputSchema: { + to: z.string().describe('Recipient phone number in E.164 format, e.g. +14155550123.'), + type: z + .enum(['text', 'template', 'image', 'video', 'document', 'audio']) + .default('text') + .describe('Message type. Defaults to "text".'), + text: z + .string() + .optional() + .describe('Message body for "text", or the caption for a media type.'), + media_url: z + .string() + .url() + .optional() + .describe('Publicly reachable URL of the media file (required for media types).'), + filename: z.string().optional().describe('File name for a "document" send.'), + template: templateSchema.optional(), + reply_to_message_id: z + .string() + .optional() + .describe('Optional id of a message in the same conversation to reply to.'), + }, + annotations: { title: 'Send WhatsApp message', readOnlyHint: false, openWorldHint: true }, + }, + handle(async (args) => jsonResult(await client.sendMessage(args))), + ); + + server.registerTool( + 'create_contact', + { + title: 'Create contact', + description: + 'Create a contact by phone number (E.164, required). Find-or-create: if a contact with that phone already exists it is returned unchanged. Optional: name, email, company, and tags (tag names, created if missing).', + inputSchema: { + phone: z.string().describe('Phone number in E.164 format, e.g. +14155550123.'), + name: z.string().optional(), + email: z.string().email().optional(), + company: z.string().optional(), + tags: z.array(z.string()).optional().describe('Tag names; created if they do not exist.'), + }, + annotations: { title: 'Create contact', readOnlyHint: false, openWorldHint: true }, + }, + handle(async (args) => jsonResult(await client.createContact(args))), + ); + + server.registerTool( + 'update_contact', + { + title: 'Update contact', + description: + 'Update an existing contact. Only the fields you pass are changed. Pass tags (an array of tag names) to replace the contact’s tags entirely.', + inputSchema: { + id: z.string().describe('Contact id.'), + name: z.string().optional(), + email: z.string().email().optional(), + company: z.string().optional(), + tags: z.array(z.string()).optional().describe('Replaces the contact’s tags.'), + }, + annotations: { title: 'Update contact', readOnlyHint: false, openWorldHint: true }, + }, + handle(async ({ id, ...body }) => jsonResult(await client.updateContact(id, body))), + ); +} diff --git a/mcp-server/tsconfig.json b/mcp-server/tsconfig.json new file mode 100644 index 0000000..aef3e69 --- /dev/null +++ b/mcp-server/tsconfig.json @@ -0,0 +1,19 @@ +{ + "compilerOptions": { + "target": "ES2022", + "module": "NodeNext", + "moduleResolution": "NodeNext", + "lib": ["ES2022"], + "outDir": "./dist", + "rootDir": "./src", + "strict": true, + "esModuleInterop": true, + "skipLibCheck": true, + "forceConsistentCasingInFileNames": true, + "declaration": true, + "sourceMap": true, + "resolveJsonModule": true + }, + "include": ["src/**/*"], + "exclude": ["node_modules", "dist"] +}