mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-11 05:42:19 +00:00
Marc-André Bombeck
6de61de010
Register two write tools — log_measurement and log_mood — only for a
health:write-scoped session; a read-only session never sees them advertised.
Each write mirrors the proven Telegram capture path (same range guard,
canonical unit, cache invalidation and rollup recompute) pinned to the MCP
source, and is idempotent on a hashed externalId derived from a client key, so
a retried call is a no-op rather than a duplicate.
Because the remote wire is stateless (no elicitation), the tools carry a
protocol-level confirm gate: without confirm:true they write nothing and
return the exact record they would write plus an instruction to confirm the
value with the user and re-call with the same idempotency key. Commits run
under a tighter per-credential write budget on top of the per-binding request
limiter.
Harden the resource-server audience binding: a token whose scopes are all in
{health:read, health:write} is bound to the MCP surface and refused on every
REST write/delete. A health:write token therefore admits the in-process MCP
write tools only and can never become a general REST write credential; admin
stays unreachable (cookie-only). Refuse, by construction, any medication, lab,
delete/update, or data-export tool on this surface.
48 lines
1.3 KiB
TypeScript
48 lines
1.3 KiB
TypeScript
/**
|
|
* HealthLog MCP server — barrel.
|
|
*
|
|
* A read-only-by-default Model Context Protocol surface that re-exports
|
|
* HealthLog's existing server-authoritative read paths over the MCP wire, so a
|
|
* user can query their own health data from any MCP-capable assistant. The tool
|
|
* / resource layer here is transport-agnostic; transports (stdio now, remote
|
|
* `/mcp` later) attach to `createMcpServer(ctx)`.
|
|
*/
|
|
export { createMcpServer, MCP_SERVER_NAME, MCP_SERVER_VERSION } from "./server";
|
|
export { resolveMcpAuthContext, type McpAuthContext } from "./auth";
|
|
export { MCP_TOOLS, MCP_TOOL_NAMES, type McpToolDefinition } from "./tools";
|
|
export { MCP_WRITE_TOOLS, MCP_WRITE_TOOL_NAMES } from "./write-tools";
|
|
export {
|
|
logMcpMeasurement,
|
|
logMcpMood,
|
|
type McpMeasurementResult,
|
|
type McpMoodResult,
|
|
} from "./writes";
|
|
export {
|
|
MCP_RESOURCES,
|
|
MCP_RESOURCE_URIS,
|
|
type McpResourceDefinition,
|
|
} from "./resources";
|
|
export {
|
|
MCP_PROMPTS,
|
|
MCP_PROMPT_NAMES,
|
|
type McpPromptDefinition,
|
|
type McpPromptResult,
|
|
type McpPromptMessage,
|
|
} from "./prompts";
|
|
export {
|
|
getCorrelation,
|
|
compareMetric,
|
|
getMetricBaseline,
|
|
detectChangepoints,
|
|
resolveRichMetric,
|
|
type RichMetric,
|
|
} from "./rich-reads";
|
|
export {
|
|
SCOPE_HEALTH_READ,
|
|
SCOPE_HEALTH_WRITE,
|
|
SCOPE_WILDCARD,
|
|
tokenAllowsRead,
|
|
tokenAllowsWrite,
|
|
sessionBinding,
|
|
} from "./scopes";
|