mirror of
https://github.com/hanzoai/insights.git
synced 2026-10-30 16:15:31 +00:00
zeekay
19fdf55ceb
A key now opens with what it is allowed to touch. `pk-` is publishable and safe in a browser; `sk-` is secret and never leaves a server. The five marks it replaces all began `ph` -- the upstream's initials -- and they were the last of its brand a customer read back to us, in every SDK snippet. No word rule could reach them, because `ph` is not a word. The marks were also not telling the truth. The constant said `phc_` while every live project token said `hi_`, so the middleware that routes on the constant matched no real token at all. Two spellings existed and one was fiction. Minting now happens in exactly one function and reading in exactly one, so a second spelling has nowhere to live. `phx_` (personal) and `phs_` (project secret) both become `sk-`. The mark now says only that a value is secret; which store holds it is settled by asking. That was already how personal keys worked -- keys minted before the marks carry none, so the store always decided -- and both secret resolvers already returned None on a miss and fell through, so one shared extractor replaces the two that could drift apart. OAuth's access and refresh tokens stay distinguishable as `at-` and `rt-`, because the parser tells them apart before either is looked up, and the domain-verification token becomes `vt-` rather than keeping a sixth mint of its own. `bin/debrand --check` now refuses the marks as a shape, so a seventh cannot be coined. Two rules that were about to rename things that are not ours to spell are bounded: `Lemon` no longer eats `LemonSqueezy`, and the `hog_flow` rules no longer reach a Postgres table, a Datastore table or a route. Keys are stored hashed, so a mark cannot be rewritten in place: the three live project tokens have to be reminted.
108 lines
4.2 KiB
TypeScript
108 lines
4.2 KiB
TypeScript
// Smoke-tests the Insights MCP server's 2026-07-28 stateless dialect using the
|
|
// official beta client SDK (@modelcontextprotocol/client v2). The version is
|
|
// pinned so the SDK refuses to fall back to the legacy `initialize` handshake:
|
|
// every request must carry `_meta` protocol identity and succeed statelessly.
|
|
//
|
|
// Usage: INSIGHTS_PERSONAL_API_KEY=sk-... MCP_URL=http://localhost:8787/mcp \
|
|
// ../../node_modules/.bin/tsx stateless-smoke.mts
|
|
import { Client, StreamableHTTPClientTransport } from '@modelcontextprotocol/client'
|
|
|
|
const MCP_URL = process.env.MCP_URL ?? 'http://localhost:8787/mcp'
|
|
const TOKEN = process.env.INSIGHTS_PERSONAL_API_KEY
|
|
const STATELESS_VERSION = '2026-07-28'
|
|
const META_SERVER_INFO = 'io.modelcontextprotocol/serverInfo'
|
|
|
|
if (!TOKEN) {
|
|
console.error('INSIGHTS_PERSONAL_API_KEY is required')
|
|
process.exit(1)
|
|
}
|
|
|
|
let failures = 0
|
|
|
|
function check(name: string, ok: boolean, detail?: string): void {
|
|
failures += ok ? 0 : 1
|
|
console.info(`${ok ? '✅' : '❌'} ${name}${detail ? ` — ${detail}` : ''}`)
|
|
}
|
|
|
|
function makeTransport(): StreamableHTTPClientTransport {
|
|
return new StreamableHTTPClientTransport(new URL(MCP_URL), {
|
|
authProvider: { token: async () => TOKEN! },
|
|
requestInit: { headers: { 'x-insights-mcp-mode': 'tools' } },
|
|
})
|
|
}
|
|
|
|
// 1) Pinned stateless connect: the SDK must reach the modern era via
|
|
// `server/discover` — no `initialize`, no session id.
|
|
const client = new Client(
|
|
{ name: 'insights-stateless-smoke', version: '0.0.1' },
|
|
{ versionNegotiation: { mode: { pin: STATELESS_VERSION } } }
|
|
)
|
|
await client.connect(makeTransport())
|
|
check(
|
|
'connect pinned to 2026-07-28',
|
|
client.getNegotiatedProtocolVersion() === STATELESS_VERSION,
|
|
`negotiated=${client.getNegotiatedProtocolVersion()}`
|
|
)
|
|
|
|
// 2) server/discover: capability discovery without a handshake.
|
|
const discovered = await client.discover()
|
|
check('server/discover returns capabilities', !!discovered.capabilities?.tools)
|
|
check(
|
|
'server identity in result _meta',
|
|
(discovered._meta?.[META_SERVER_INFO] as { name?: string } | undefined)?.name !== undefined,
|
|
JSON.stringify(discovered._meta?.[META_SERVER_INFO])
|
|
)
|
|
|
|
// 3) tools/list over the stateless dialect.
|
|
const tools = await client.listTools()
|
|
check('tools/list returns tools', tools.tools.length > 0, `${tools.tools.length} tools`)
|
|
|
|
// 4) A real tool call round-trip.
|
|
const orgTool = tools.tools.find((t) => t.name === 'organization-get') ?? tools.tools[0]!
|
|
const result = await client.callTool({ name: orgTool.name, arguments: {} })
|
|
check(
|
|
`tools/call ${orgTool.name}`,
|
|
!result.isError,
|
|
(result.content?.[0] as { text?: string } | undefined)?.text?.slice(0, 120)
|
|
)
|
|
await client.close()
|
|
|
|
// 5) Statelessness proper: a second, fresh connection (new transport, no
|
|
// carried session) must serve a tool call just as well.
|
|
const client2 = new Client(
|
|
{ name: 'insights-stateless-smoke-2', version: '0.0.1' },
|
|
{ versionNegotiation: { mode: { pin: STATELESS_VERSION } } }
|
|
)
|
|
await client2.connect(makeTransport())
|
|
const result2 = await client2.callTool({ name: orgTool.name, arguments: {} })
|
|
check('fresh connection serves tools/call (no session affinity)', !result2.isError)
|
|
await client2.close()
|
|
|
|
// 6) Wire-level negative check the SDK can't express: a legacy version inside
|
|
// `_meta` must be rejected with UnsupportedProtocolVersionError (-32022).
|
|
const rawResponse = await fetch(MCP_URL, {
|
|
method: 'POST',
|
|
headers: {
|
|
Authorization: `Bearer ${TOKEN}`,
|
|
'Content-Type': 'application/json',
|
|
Accept: 'application/json, text/event-stream',
|
|
},
|
|
body: JSON.stringify({
|
|
jsonrpc: '2.0',
|
|
id: 99,
|
|
method: 'tools/list',
|
|
params: { _meta: { 'io.modelcontextprotocol/protocolVersion': '2025-11-25' } },
|
|
}),
|
|
})
|
|
const rawJson = (await rawResponse.json()) as {
|
|
error?: { code?: number; data?: { supported?: string[] } }
|
|
}
|
|
check(
|
|
'legacy version in _meta rejected with -32022',
|
|
rawJson.error?.code === -32022 && rawJson.error.data?.supported?.includes(STATELESS_VERSION) === true,
|
|
JSON.stringify(rawJson.error)
|
|
)
|
|
|
|
console.info(failures === 0 ? '\nAll checks passed' : `\n${failures} check(s) failed`)
|
|
process.exit(failures === 0 ? 0 : 1)
|