mcpserver

package
v1.0.2 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 28, 2026 License: Apache-2.0 Imports: 30 Imported by: 0

Documentation

Overview

Package mcpserver is the Model Context Protocol endpoint (/mcp): the tools an AI agent uses to draft, publish and inspect a site. Every tool calls the same internal services as the HTTP API (no HTTP self-calls), is gated by the calling API key's scopes, and is audit-logged.

Index

Constants

This section is empty.

Variables

View Source
var ErrRenderUnavailable = errors.New("page rendering is not available on this site")

ErrRenderUnavailable is what Deps.RenderPage returns when the site has no render engine (page rendering is off).

Functions

func ExtractJSONLD

func ExtractJSONLD(html []byte) [][]byte

ExtractJSONLD returns the contents of every JSON-LD script block in html.

func JoinCSS

func JoinCSS(m map[string]string) string

JoinCSS renders a node CSS map (id -> rules) as one stylesheet, in key order.

func New

func New(d Deps, version string) http.Handler

New builds the MCP server and returns its HTTP handler (streamable HTTP; every request must carry an API key as "Authorization: Bearer <key>").

Types

type AuditEntry

type AuditEntry struct {
	KeyID   uuid.UUID
	KeyName string
	Tool    string
	Args    json.RawMessage
	Err     error
}

AuditEntry is one tool call.

type Auditor

type Auditor interface {
	Record(ctx context.Context, e AuditEntry)
}

Auditor records tool calls.

type Deps

type Deps struct {
	Keys           KeyService
	Limiter        Limiter
	Entities       *entity.Service
	PublicEntities *entity.PostgresPublicRepository
	Media          *media.Service
	Menus          *menu.Service
	Taxonomy       *taxonomy.Service
	Redirects      *redirect.Service
	Crawlers       *agents.StatsRepository
	Referrals      *analytics.Reader
	Audit          Auditor
	Logger         *slog.Logger

	// ClientIP is the caller's address as the API sees it (trusted-proxy
	// aware). Defaults to the connection's remote address.
	ClientIP func(*http.Request) string
	// PublicOrigin is the site's public origin (scheme://host from
	// PUBLIC_BASE_URL); a browser request carrying an Origin header must
	// match it or one of AllowedOrigins. Requests without Origin (non-browser
	// clients) are always allowed.
	PublicOrigin   string
	AllowedOrigins []string

	// Fetch serves a public GET path in process (sitemaps, llms.txt, pages).
	Fetch func(ctx context.Context, path string) (Response, error)
	// PageURL is the public path of an entity.
	PageURL func(ctx context.Context, e *entity.Entity) string
	// Changed drops cached pages and sitemaps after a write the entity
	// events do not cover (menus, redirects, terms).
	Changed func(ctx context.Context)

	// The builder tools. BuilderEntities defaults to Entities; the others
	// are optional and the tools that need one say so when it is nil.
	BuilderEntities entity.BuilderStore
	// Design resolves the site's design tokens and presets (builder_design).
	Design func(ctx context.Context) (DesignInfo, error)
	// Templates is the section template store (builder_templates_list).
	Templates TemplateStore
	// RenderPage renders a document in the page's context (builder_render).
	RenderPage func(ctx context.Context, req RenderRequest) (RenderResult, error)
}

Deps are the services the tools call. Every field but Limiter is required.

type DesignInfo

type DesignInfo struct {
	// Colors by name (primary bg text surface muted accent), Space by step
	// ("0".."12") and FS by name (xs..4xl); the values style keys accept as tokens.
	Colors, Space, FS map[string]string
	Presets           []DesignPreset
}

DesignInfo is the site's resolved design: the palette the Style tab shows and the named style presets.

type DesignPreset

type DesignPreset struct {
	Name  string                       `json:"name"`
	Label string                       `json:"label"`
	S     map[string]map[string]string `json:"s"`
}

DesignPreset is a named bundle of style entries a node can apply.

type JSONLDNode

type JSONLDNode struct {
	Type     string   `json:"type"`
	Errors   []string `json:"errors,omitempty"`
	Warnings []string `json:"warnings,omitempty"`
}

JSONLDNode is one typed object found in the page.

type JSONLDReport

type JSONLDReport struct {
	Valid  bool         `json:"valid"` // no errors (warnings allowed)
	Blocks int          `json:"blocks"`
	Nodes  []JSONLDNode `json:"nodes"`
	Errors []string     `json:"errors,omitempty"` // block-level problems
}

JSONLDReport is the result of checking a page's JSON-LD.

func ValidateJSONLD

func ValidateJSONLD(blocks [][]byte) JSONLDReport

ValidateJSONLD checks each block: it must parse, carry @context (top level) and a typed node, and each known type its required fields. Unknown types only get a note: schema.org has hundreds and the checker is a guard against broken output, not a full schema.org validator.

type KeyService

type KeyService interface {
	ValidateKey(ctx context.Context, plainKey string) (*hmauth.APIKey, error)
	RecordUsage(ctx context.Context, keyID uuid.UUID, ipAddress string) error
}

KeyService validates API keys (auth.APIKeyService).

type Limiter

type Limiter interface {
	Allow(keyID uuid.UUID, rateLimit int) bool
}

Limiter is the per-key rate limiter (middleware.APIKeyRateLimiter).

type PostgresAuditor

type PostgresAuditor struct {
	// contains filtered or unexported fields
}

PostgresAuditor writes hatamoto_mcp_audit and mirrors each row to the log.

func NewPostgresAuditor

func NewPostgresAuditor(db *database.DB, logger *slog.Logger) *PostgresAuditor

NewPostgresAuditor creates the audit writer.

func (*PostgresAuditor) Record

func (a *PostgresAuditor) Record(ctx context.Context, e AuditEntry)

Record stores the entry; a failed insert is logged, never returned: an audit outage must not turn a finished write into an error for the agent.

type RenderRequest

type RenderRequest struct {
	Entity *entity.Entity
	Doc    []byte
	IDs    []string
}

RenderRequest asks for the page rendered with Doc as its page_doc (nothing is stored). IDs, when set, limit the output to those nodes.

type RenderResult

type RenderResult struct {
	HTML, CSS string
}

RenderResult is the rendered markup and the builder CSS it needs.

type Response

type Response struct {
	Status int
	Body   []byte
}

Response is an in-process answer of the public site.

type Server

type Server struct {
	// contains filtered or unexported fields
}

Server holds the registered tools.

type TemplateStore

type TemplateStore interface {
	List(ctx context.Context, f *sectiontemplate.ListFilter, limit, offset int) (*sectiontemplate.ListResult, error)
	Get(ctx context.Context, id uuid.UUID) (*sectiontemplate.SectionTemplate, error)
}

TemplateStore is the section template service as the builder tools use it.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL