mirror of
https://github.com/bilawalsidhu/gods-eye-view.git
synced 2026-11-04 02:14:01 +00:00
jibraaanandClaude Opus 5.5
e363b6a14f
Fixes bilawalsidhu/gods-eye-view#927. Each stdio MCP server made its own random panel key, and panel_request accepts only the key in the panel page. A client that starts two server processes for one connection and reads the page from one while sending the page's requests to the other (seen in Claude Desktop on Windows) therefore always got "Only the God's Eye View panel may make this request". The stdio entry now passes a key shared by the install, created once in .gev-cache/mcp-panel-key. The file is staged 0600 and published with link(), so processes starting together agree on one key and never read a half-written one. If it cannot be stored, the process keeps a key of its own, as before. createLocalMcpServer still makes a fresh key unless given one, so in-process servers (the /mcp HTTP plugin, tests) are unchanged. Co-Authored-By: Claude Opus 5.5 <[email protected]>
54 lines
2.0 KiB
JavaScript
54 lines
2.0 KiB
JavaScript
/** The local MCP server: Core's tools over services backed by a running app. */
|
|
|
|
import { randomBytes } from 'node:crypto';
|
|
import { readFileSync } from 'node:fs';
|
|
import {
|
|
composeCatalog,
|
|
coreTools,
|
|
catalogForSurface,
|
|
} from '../../src/tools/index.js';
|
|
import {
|
|
createGlobePanelResource,
|
|
panelRuntime,
|
|
} from '../../src/tools/panel.js';
|
|
import { createMcpServer } from '../../src/tools/mcp/index.js';
|
|
import { DEFAULT_API_BASE, createLocalToolServices } from './services.js';
|
|
|
|
const INSTRUCTIONS =
|
|
"Tools answer questions from God's Eye View's live public data. Location " +
|
|
'tools take an area: a place name, a bbox, or lat/lon with radius_km. ' +
|
|
'Results are capped; check truncated and total before concluding there is nothing more. ' +
|
|
"Answers that can be shown in God's Eye View include data.view; to show one, call " +
|
|
'show_in_gods_eye_view with that view, adding layers, style, a camera or marks as ' +
|
|
"needed. It shows live God's Eye View where the client displays apps and " +
|
|
'returns a link everywhere.';
|
|
|
|
/** Construct the local MCP server for Core's tools. */
|
|
export function createLocalMcpServer({
|
|
apiBase = DEFAULT_API_BASE,
|
|
fetchImpl,
|
|
panelKey = randomBytes(32).toString('base64url'),
|
|
} = {}) {
|
|
const { version } = JSON.parse(
|
|
readFileSync(new URL('../../package.json', import.meta.url), 'utf8'),
|
|
);
|
|
// Unless given one, each server makes a new key for its panel. The panel's
|
|
// page carries it and panel_request requires it; any client may read the
|
|
// page, so it keeps the tool from clients that only list it, and is not
|
|
// access control. The stdio entry passes the install's shared key
|
|
// (panelKey.js), so separate processes of one client agree.
|
|
return createMcpServer({
|
|
catalog: catalogForSurface(
|
|
composeCatalog({
|
|
tools: coreTools,
|
|
services: createLocalToolServices({ apiBase, fetchImpl, panelKey }),
|
|
}),
|
|
'mcp',
|
|
),
|
|
name: 'gods-eye-view',
|
|
version,
|
|
instructions: INSTRUCTIONS,
|
|
resources: [createGlobePanelResource({ runtime: panelRuntime, panelKey })],
|
|
});
|
|
}
|