{"_id":"@capsulesecurity/capsule-mcp-server","_rev":"3-b228d5e4b7468e27b1f02000a771bc3b","name":"@capsulesecurity/capsule-mcp-server","dist-tags":{"latest":"0.3.0"},"versions":{"0.1.0":{"name":"@capsulesecurity/capsule-mcp-server","version":"0.1.0","license":"UNLICENSED","_id":"@capsulesecurity/capsule-mcp-server@0.1.0","maintainers":[{"name":"lidanhazoutcapsule","email":"lidan@capsule.security"}],"homepage":"https://github.com/capsulesecurity/capsule#readme","bugs":{"url":"https://github.com/capsulesecurity/capsule/issues"},"nx":{"name":"mcp-server","targets":{"lint":{"options":{"eslintConfig":"libs/mcp-server/eslint.config.mjs","lintFilePatterns":["libs/mcp-server/**/*.ts"]},"executor":"@nx/eslint:lint"},"build":{"options":{"cwd":"{projectRoot}","command":"node esbuild.mjs"},"outputs":["{projectRoot}/dist"],"executor":"nx:run-commands","dependsOn":["codegen"]},"codegen":{"cache":true,"inputs":["{workspaceRoot}/libs/database-entities/src/graphql/**/*.graphql","{projectRoot}/scripts/generate-schema-chunks.mjs"],"options":{"cwd":"{projectRoot}","command":"node scripts/generate-schema-chunks.mjs"},"outputs":["{projectRoot}/src/generated"],"executor":"nx:run-commands"},"typecheck":{"options":{"cwd":"{projectRoot}","command":"tsc --noEmit -p tsconfig.lib.json"},"executor":"nx:run-commands"},"prettier:run":{"options":{"cwd":"{workspaceRoot}","command":"prettier --write {projectRoot}"},"executor":"nx:run-commands"},"prettier:check":{"options":{"cwd":"{workspaceRoot}","command":"prettier --check {projectRoot}"},"executor":"nx:run-commands"}},"sourceRoot":"libs/mcp-server/src","projectType":"library"},"bin":{"capsule-mcp":"dist/index.js"},"dist":{"shasum":"cd79983496477b9b689d3ab4ea08b396058548ac","tarball":"https://registry.npmjs.org/@capsulesecurity/capsule-mcp-server/-/capsule-mcp-server-0.1.0.tgz","fileCount":3,"integrity":"sha512-jqwebl3yKMYwG3/0tikQXsOS37oLtaCJbDVp+zgntkO6f6l3QqSBwMRyuluLjCQ6Entm79Jvv4/Ev/E/YIjVRQ==","signatures":[{"sig":"MEQCIEXaxjA+L2TYJfCyDYv+xxUYa2LAAJ+Q0BcXuNALzE5GAiAZv0oPpArOGucvqoTmAS95reB+BO1sdNAN8AVMqAzMvg==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":217472},"main":"./dist/index.js","type":"module","_from":"file:capsulesecurity-capsule-mcp-server-0.1.0.tgz","engines":{"node":">=20"},"_npmUser":{"name":"lidanhazoutcapsule","email":"lidan@capsule.security"},"_resolved":"/private/var/folders/95/wdx7ytrj5yb59mw4nn9r9nhc0000gn/T/8966a2ae758c8f34d374776e2ca5be0f/capsulesecurity-capsule-mcp-server-0.1.0.tgz","_integrity":"sha512-jqwebl3yKMYwG3/0tikQXsOS37oLtaCJbDVp+zgntkO6f6l3QqSBwMRyuluLjCQ6Entm79Jvv4/Ev/E/YIjVRQ==","repository":{"url":"git+https://github.com/capsulesecurity/capsule.git","type":"git","directory":"libs/mcp-server"},"_npmVersion":"10.9.8","description":"Query your Capsule tenant from any MCP-compatible AI client","directories":{},"_nodeVersion":"22.23.1","dependencies":{"zod":"4.4.3","graphql":"16.14.0","@modelcontextprotocol/sdk":"1.30.0"},"_hasShrinkwrap":false,"devDependencies":{"esbuild":"0.28.1","@graphql-tools/merge":"9.1.9"},"_npmOperationalInternal":{"tmp":"tmp/capsule-mcp-server_0.1.0_1787171623764_0.8110697426759261","host":"s3://npm-registry-packages-npm-production"}},"0.2.0":{"name":"@capsulesecurity/capsule-mcp-server","version":"0.2.0","license":"UNLICENSED","_id":"@capsulesecurity/capsule-mcp-server@0.2.0","maintainers":[{"name":"lidanhazoutcapsule","email":"lidan@capsule.security"}],"homepage":"https://github.com/capsulesecurity/capsule#readme","bugs":{"url":"https://github.com/capsulesecurity/capsule/issues"},"nx":{"name":"mcp-server","targets":{"lint":{"options":{"eslintConfig":"libs/mcp-server/eslint.config.mjs","lintFilePatterns":["libs/mcp-server/**/*.ts"]},"executor":"@nx/eslint:lint"},"build":{"options":{"cwd":"{projectRoot}","command":"node esbuild.mjs"},"outputs":["{projectRoot}/dist"],"executor":"nx:run-commands","dependsOn":["codegen"]},"codegen":{"cache":true,"inputs":["{workspaceRoot}/libs/database-entities/src/graphql/**/*.graphql","{projectRoot}/scripts/generate-schema-chunks.mjs"],"options":{"cwd":"{projectRoot}","command":"node scripts/generate-schema-chunks.mjs"},"outputs":["{projectRoot}/src/generated"],"executor":"nx:run-commands"},"typecheck":{"options":{"cwd":"{projectRoot}","command":"tsc --noEmit -p tsconfig.lib.json"},"executor":"nx:run-commands"},"prettier:run":{"options":{"cwd":"{workspaceRoot}","command":"prettier --write {projectRoot}"},"executor":"nx:run-commands"},"prettier:check":{"options":{"cwd":"{workspaceRoot}","command":"prettier --check {projectRoot}"},"executor":"nx:run-commands"}},"sourceRoot":"libs/mcp-server/src","projectType":"library"},"bin":{"capsule-mcp":"dist/index.js"},"dist":{"shasum":"3841bc56071b62a2615310dda9377f09d40ac780","tarball":"https://registry.npmjs.org/@capsulesecurity/capsule-mcp-server/-/capsule-mcp-server-0.2.0.tgz","fileCount":3,"integrity":"sha512-a2J33xuyisRH/CpP+ckjygH31U0ienfZG9jRLO1QpjYdBNXYZyRHx26jY6pHpFXbHqjHMBSpilgnFdbFIA8ZAQ==","signatures":[{"sig":"MEUCIQDPn1k2q48cocVAlc9+EjbOIljkyOI33Aevir7oz8Jp5gIgJDfv5SHn14MDZVmGUG/q/3Fko8rGALpJX5+IkG2Z5jA=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":216950},"main":"./dist/index.js","type":"module","_from":"file:capsulesecurity-capsule-mcp-server-0.2.0.tgz","engines":{"node":">=20"},"_npmUser":{"name":"lidanhazoutcapsule","email":"lidan@capsule.security"},"_resolved":"/private/var/folders/95/wdx7ytrj5yb59mw4nn9r9nhc0000gn/T/44026937aec152cb9a1da8613859ff07/capsulesecurity-capsule-mcp-server-0.2.0.tgz","_integrity":"sha512-a2J33xuyisRH/CpP+ckjygH31U0ienfZG9jRLO1QpjYdBNXYZyRHx26jY6pHpFXbHqjHMBSpilgnFdbFIA8ZAQ==","repository":{"url":"git+https://github.com/capsulesecurity/capsule.git","type":"git","directory":"libs/mcp-server"},"_npmVersion":"10.9.8","description":"Query your Capsule tenant from any MCP-compatible AI client","directories":{},"_nodeVersion":"22.23.1","dependencies":{"zod":"4.4.3","graphql":"16.14.0","@modelcontextprotocol/sdk":"1.30.0"},"_hasShrinkwrap":false,"devDependencies":{"esbuild":"0.28.1","@graphql-tools/merge":"9.1.9"},"_npmOperationalInternal":{"tmp":"tmp/capsule-mcp-server_0.2.0_1787171996690_0.8828574980898476","host":"s3://npm-registry-packages-npm-production"}},"0.3.0":{"name":"@capsulesecurity/capsule-mcp-server","version":"0.3.0","description":"Query your Capsule tenant from any MCP-compatible AI client","license":"UNLICENSED","type":"module","bin":{"capsule-mcp":"dist/index.js"},"main":"./dist/index.js","engines":{"node":">=20"},"repository":{"type":"git","url":"git+https://github.com/capsulesecurity/capsule.git","directory":"libs/mcp-server"},"dependencies":{"@modelcontextprotocol/sdk":"1.30.0","graphql":"16.14.0","zod":"4.4.3"},"devDependencies":{"@graphql-tools/merge":"9.1.9","esbuild":"0.28.1"},"nx":{"name":"mcp-server","projectType":"library","sourceRoot":"libs/mcp-server/src","targets":{"codegen":{"executor":"nx:run-commands","cache":true,"inputs":["{workspaceRoot}/libs/database-entities/src/graphql/**/*.graphql","{projectRoot}/scripts/generate-schema-chunks.mjs"],"outputs":["{projectRoot}/src/generated"],"options":{"cwd":"{projectRoot}","command":"node scripts/generate-schema-chunks.mjs"}},"build":{"executor":"nx:run-commands","dependsOn":["codegen"],"outputs":["{projectRoot}/dist"],"options":{"cwd":"{projectRoot}","command":"node esbuild.mjs"}},"typecheck":{"executor":"nx:run-commands","options":{"cwd":"{projectRoot}","command":"tsc --noEmit -p tsconfig.lib.json"}},"lint":{"executor":"@nx/eslint:lint","options":{"eslintConfig":"libs/mcp-server/eslint.config.mjs","lintFilePatterns":["libs/mcp-server/**/*.ts"]}},"prettier:run":{"executor":"nx:run-commands","options":{"command":"prettier --write {projectRoot}","cwd":"{workspaceRoot}"}},"prettier:check":{"executor":"nx:run-commands","options":{"command":"prettier --check {projectRoot}","cwd":"{workspaceRoot}"}}}},"_id":"@capsulesecurity/capsule-mcp-server@0.3.0","bugs":{"url":"https://github.com/capsulesecurity/capsule/issues"},"homepage":"https://github.com/capsulesecurity/capsule#readme","_integrity":"sha512-mcB7aCQWtDXV9DJ/ppvxYZqJ8nS6ouu4wQ2pcF8EJk/9kSy9CYaaTz9y7gXCmKW1E3JujcmEUbHWD7mUNZK5lQ==","_resolved":"/private/var/folders/95/wdx7ytrj5yb59mw4nn9r9nhc0000gn/T/84e126f706c8d0e44a8eb526b397b4b2/capsulesecurity-capsule-mcp-server-0.3.0.tgz","_from":"file:capsulesecurity-capsule-mcp-server-0.3.0.tgz","_nodeVersion":"22.23.1","_npmVersion":"10.9.8","dist":{"integrity":"sha512-mcB7aCQWtDXV9DJ/ppvxYZqJ8nS6ouu4wQ2pcF8EJk/9kSy9CYaaTz9y7gXCmKW1E3JujcmEUbHWD7mUNZK5lQ==","shasum":"e6f09def0abd76c4faacc8ce1da25acf8bd99fbe","tarball":"https://registry.npmjs.org/@capsulesecurity/capsule-mcp-server/-/capsule-mcp-server-0.3.0.tgz","fileCount":3,"unpackedSize":217178,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIGiQ3DkmYXfOpM2PzcCYa6CY0iMLdXp+FxjweY5VxS9BAiEAowOF5DlL7zPeY2VcTRdrBA7JcWO+b7Jinf0RWZ0C0IU="}]},"_npmUser":{"name":"lidanhazoutcapsule","email":"lidan@capsule.security"},"directories":{},"maintainers":[{"name":"lidanhazoutcapsule","email":"lidan@capsule.security"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/capsule-mcp-server_0.3.0_1787172155816_0.5078402407078018"},"_hasShrinkwrap":false}},"time":{"created":"2026-08-19T20:33:43.522Z","modified":"2026-08-19T20:42:36.153Z","0.1.0":"2026-08-19T20:33:43.916Z","0.2.0":"2026-08-19T20:39:56.825Z","0.3.0":"2026-08-19T20:42:35.975Z"},"bugs":{"url":"https://github.com/capsulesecurity/capsule/issues"},"license":"UNLICENSED","homepage":"https://github.com/capsulesecurity/capsule#readme","repository":{"type":"git","url":"git+https://github.com/capsulesecurity/capsule.git","directory":"libs/mcp-server"},"description":"Query your Capsule tenant from any MCP-compatible AI client","maintainers":[{"name":"lidanhazoutcapsule","email":"lidan@capsule.security"}],"readme":"# @capsulesecurity/capsule-mcp-server\n\nAn MCP server that lets any MCP-compatible AI client query a Capsule tenant.\n\nIt runs locally over stdio and authenticates as a Capsule **service account** using the\nOAuth 2.0 `client_credentials` grant. Access is read-only and scoped to the single tenant\nthat owns the service account.\n\n## Setup\n\nCreate a service account in Capsule under Settings > Service Accounts. The client secret is\nshown only once, at creation time.\n\n```json\n{\n  \"mcpServers\": {\n    \"capsule\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@capsulesecurity/capsule-mcp-server\"],\n      \"env\": {\n        \"CAPSULE_CLIENT_ID\": \"<client id>\",\n        \"CAPSULE_CLIENT_SECRET\": \"<client secret>\"\n      }\n    }\n  }\n}\n```\n\n| Variable                | Required | Default                                          |\n| ----------------------- | -------- | ------------------------------------------------ |\n| `CAPSULE_CLIENT_ID`     | yes      | -                                                |\n| `CAPSULE_CLIENT_SECRET` | yes      | -                                                |\n| `CAPSULE_API_URL`       | no       | `https://portal.us-east1.capsulesecurity.io/api` |\n\n`CAPSULE_API_URL` selects the regional deployment. It defaults to US (`us-east1`); EU tenants\nmust set it to `https://portal.eu-west4.capsulesecurity.io/api`. It must be `https`, except on\n`localhost`/`127.0.0.1` for local development.\n\n## Tools\n\n`describe_type` returns the GraphQL SDL for any type, input, or enum. The schema is bundled\ninto the package, so the package version pins the schema version.\n\n`query_graphql` runs a read-only GraphQL query. Queries are parsed and validated against the\nbundled schema before they are sent, which is what makes wrong field names come back as\nspecific, correctable errors - Capsule replaces GraphQL error detail with a generic message in\nproduction. Non-query operations are rejected, and large results are trimmed with a\n`__truncated` marker carrying the original count.\n\n## Access model\n\nA service account can read everything the `VIEWER` role permits within its own tenant.\nThere is no finer-grained control: no per-tool scopes, and no way to grant one connected\nclient less access than another. Session and activity message bodies are redacted for\n`VIEWER`, so this server can read security metadata but not raw prompt or tool-output text.\n\nRequests are limited to 60 per minute per service account, so give each connected client its\nown account rather than sharing one.\n\nEverything above is enforced by the Capsule API. The package runs on the user's machine and is\ntherefore untrusted - nothing it does locally is a security control.\n\n## Rotating and revoking credentials\n\nA service account holds up to two active secrets, so a new one can be added and the\nconfiguration updated before the old one is revoked.\n\nRevoking a secret stops new access tokens from being issued immediately, but a token already\nissued stays valid until it expires, within 15 minutes. Delete the service account to cut\naccess off without waiting.\n\n## Local development\n\n```bash\npnpm nx run mcp-server:build\npnpm nx run mcp-server:test\n```\n\nPoint a client at the local build with an absolute path instead of `npx`, and set\n`CAPSULE_API_URL` to `http://localhost:4000/api`:\n\n```json\n{\n  \"mcpServers\": {\n    \"capsule\": {\n      \"command\": \"node\",\n      \"args\": [\"<repo>/libs/mcp-server/dist/index.js\"],\n      \"env\": {\n        \"CAPSULE_CLIENT_ID\": \"<client id>\",\n        \"CAPSULE_CLIENT_SECRET\": \"<client secret>\",\n        \"CAPSULE_API_URL\": \"http://localhost:4000/api\"\n      }\n    }\n  }\n}\n```\n\n## Publishing\n\nPublished to npm as [`@capsulesecurity/capsule-mcp-server`](https://www.npmjs.com/package/@capsulesecurity/capsule-mcp-server).\nReleases are cut by hand for now, from a clean checkout of `main`:\n\n```bash\npnpm nx run mcp-server:build\ncd libs/mcp-server && pnpm publish --access public\n```\n\nBump the version in `package.json` and `SERVER_VERSION` in `src/server.ts` together. The\nGraphQL schema is bundled at build time, so the published version pins the schema version\nand a schema change needs a release to reach clients.\n","readmeFilename":"README.md"}