Help us shape the future of Go! Take the 2026 Go Developer Survey

mcpserver

package
v1.0.2 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 28, 2026 License: Apache-2.0 Imports: 30 Imported by: 0

Documentation

Overview

Package mcpserver is the Model Context Protocol endpoint (/mcp): the tools an AI agent uses to draft, publish and inspect a site. Every tool calls the same internal services as the HTTP API (no HTTP self-calls), is gated by the calling API key's scopes, and is audit-logged.

Index

Constants

This section is empty.

Variables

View Source
var ErrRenderUnavailable = errors.New("page rendering is not available on this site")

ErrRenderUnavailable is what Deps.RenderPage returns when the site has no render engine (page rendering is off).

Functions

func ExtractJSONLD

func ExtractJSONLD(html []byte) [][]byte

ExtractJSONLD returns the contents of every JSON-LD script block in html.

func JoinCSS

func JoinCSS(m map[string]string) string

JoinCSS renders a node CSS map (id -> rules) as one stylesheet, in key order.

func New

func New(d Deps, version string) http.Handler

New builds the MCP server and returns its HTTP handler (streamable HTTP; every request must carry an API key as "Authorization: Bearer <key>").

Types

type AuditEntry

type AuditEntry struct {
	KeyID   uuid.UUID
	KeyName string
	Tool    string
	Args    json.RawMessage
	Err     error
}

AuditEntry is one tool call.

type Auditor

type Auditor interface {
	Record(ctx context.Context, e AuditEntry)
}

Auditor records tool calls.

type Deps

type Deps struct {
	Keys           KeyService
	Limiter        Limiter
	Entities       *entity.Service
	PublicEntities *entity.PostgresPublicRepository
	Media          *media.Service
	Menus          *menu.Service
	Taxonomy       *taxonomy.Service
	Redirects      *redirect.Service
	Crawlers       *agents.StatsRepository
	Referrals      *analytics.Reader
	Audit          Auditor
	Logger         *slog.Logger

	// ClientIP is the caller's address as the API sees it (trusted-proxy
	// aware). Defaults to the connection's remote address.
	ClientIP func(*http.Request) string
	// PublicOrigin is the site's public origin (scheme://host from
	// PUBLIC_BASE_URL); a browser request carrying an Origin header must
	// match it or one of AllowedOrigins. Requests without Origin (non-browser
	// clients) are always allowed.
	PublicOrigin   string
	AllowedOrigins []string

	// Fetch serves a public GET path in process (sitemaps, llms.txt, pages).
	Fetch func(ctx context.Context, path string) (Response, error)
	// PageURL is the public path of an entity.
	PageURL func(ctx context.Context, e *entity.Entity) string
	// Changed drops cached pages and sitemaps after a write the entity
	// events do not cover (menus, redirects, terms).
	Changed func(ctx context.Context)

	// The builder tools. BuilderEntities defaults to Entities; the others
	// are optional and the tools that need one say so when it is nil.
	BuilderEntities entity.BuilderStore
	// Design resolves the site's design tokens and presets (builder_design).
	Design func(ctx context.Context) (DesignInfo, error)
	// Templates is the section template store (builder_templates_list).
	Templates TemplateStore
	// RenderPage renders a document in the page's context (builder_render).
	RenderPage func(ctx context.Context, req RenderRequest) (RenderResult, error)
}

Deps are the services the tools call. Every field but Limiter is required.

type DesignInfo

type DesignInfo struct {
	// Colors by name (primary bg text surface muted accent), Space by step
	// ("0".."12") and FS by name (xs..4xl); the values style keys accept as tokens.
	Colors, Space, FS map[string]string
	Presets           []DesignPreset
}

DesignInfo is the site's resolved design: the palette the Style tab shows and the named style presets.

type DesignPreset

type DesignPreset struct {
	Name  string                       `json:"name"`
	Label string                       `json:"label"`
	S     map[string]map[string]string `json:"s"`
}

DesignPreset is a named bundle of style entries a node can apply.

type JSONLDNode

type JSONLDNode struct {
	Type     string   `json:"type"`
	Errors   []string `json:"errors,omitempty"`
	Warnings []string `json:"warnings,omitempty"`
}

JSONLDNode is one typed object found in the page.

type JSONLDReport

type JSONLDReport struct {
	Valid  bool         `json:"valid"` // no errors (warnings allowed)
	Blocks int          `json:"blocks"`
	Nodes  []JSONLDNode `json:"nodes"`
	Errors []string     `json:"errors,omitempty"` // block-level problems
}

JSONLDReport is the result of checking a page's JSON-LD.

func ValidateJSONLD

func ValidateJSONLD(blocks [][]byte) JSONLDReport

ValidateJSONLD checks each block: it must parse, carry @context (top level) and a typed node, and each known type its required fields. Unknown types only get a note: schema.org has hundreds and the checker is a guard against broken output, not a full schema.org validator.

type KeyService

type KeyService interface {
	ValidateKey(ctx context.Context, plainKey string) (*hmauth.APIKey, error)
	RecordUsage(ctx context.Context, keyID uuid.UUID, ipAddress string) error
}

KeyService validates API keys (auth.APIKeyService).

type Limiter

type Limiter interface {
	Allow(keyID uuid.UUID, rateLimit int) bool
}

Limiter is the per-key rate limiter (middleware.APIKeyRateLimiter).

type PostgresAuditor

type PostgresAuditor struct {
	// contains filtered or unexported fields
}

PostgresAuditor writes hatamoto_mcp_audit and mirrors each row to the log.

func NewPostgresAuditor

func NewPostgresAuditor(db *database.DB, logger *slog.Logger) *PostgresAuditor

NewPostgresAuditor creates the audit writer.

func (*PostgresAuditor) Record

func (a *PostgresAuditor) Record(ctx context.Context, e AuditEntry)

Record stores the entry; a failed insert is logged, never returned: an audit outage must not turn a finished write into an error for the agent.

type RenderRequest

type RenderRequest struct {
	Entity *entity.Entity
	Doc    []byte
	IDs    []string
}

RenderRequest asks for the page rendered with Doc as its page_doc (nothing is stored). IDs, when set, limit the output to those nodes.

type RenderResult

type RenderResult struct {
	HTML, CSS string
}

RenderResult is the rendered markup and the builder CSS it needs.

type Response

type Response struct {
	Status int
	Body   []byte
}

Response is an in-process answer of the public site.

type Server

type Server struct {
	// contains filtered or unexported fields
}

Server holds the registered tools.

type TemplateStore

type TemplateStore interface {
	List(ctx context.Context, f *sectiontemplate.ListFilter, limit, offset int) (*sectiontemplate.ListResult, error)
	Get(ctx context.Context, id uuid.UUID) (*sectiontemplate.SectionTemplate, error)
}

TemplateStore is the section template service as the builder tools use it.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL