/** * The COMPLIANCE MCP server — the DPP Assistant's in-house endpoint. * * Served at `/compliance/mcp`. Answers EU Digital Product Passport scope, * field, registry and change questions through nine small, single-purpose * tools. Unlike the action-based tools on /mcp ("one tool, many actions"), * here each tool answers exactly one kind of question — the simpler surface * makes tool selection more accurate for the model. * * Auth: SAME as /mcp — OAuth 2.0 or a tp_ API key forwarded to the platform. * The compliance endpoint DOES have an auth gate and a WWW-Authenticate * challenge, unlike the supplier endpoint (suppliers have no account). Its * challenge points to a per-path protected-resource metadata document at * /.well-known/oauth-protected-resource/compliance/mcp, whose `resource` * is exactly `https://ai.tracepass.eu/compliance/mcp`. * * Channel: every platform call carries `X-Source: assistant` (not "mcp") so * the platform logs answers under channel "assistant" and applies the * assistant-channel account gate (email verified, not a disposable domain). * * Nine tools: * scope_check — is a passport required? (read-only POST) * required_fields — which data must the passport hold? * what_changed — what has changed in EU law for these categories? * registry_guidance — identifiers, carriers, formats, registration * create_draft_passport — hand-off: create a draft passport in TracePass * report_answer — flag a wrong or unclear answer * get_profile — read stored company facts * update_profile — save or correct company facts * delete_profile — remove all stored company facts */ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js"; import { z } from "zod"; import { TracePassClient } from "./api-client.js"; import { type ToolResult } from "./result.js"; import type { ToolAnnotations } from "./tools.js"; export declare const COMPLIANCE_SERVER_INFO: { readonly name: "tracepass-compliance"; readonly version: "1.19.1"; }; export interface CreateComplianceMcpServerConfig { baseUrl: string; /** The caller's bearer token — a tp_ API key or an OAuth access token. * Forwarded verbatim to the v1 API, which decides validity. */ apiKey: string; } /** * Add the envelope's disclaimer as its own closing instruction. Left inside the * JSON, models drop it from most answers; a separate line next to the data is * what they keep. */ export declare function withClosingDisclaimer(result: ToolResult, body: unknown): ToolResult; /** * Turn a platform response into a ToolResult for the compliance channel. * * The compliance channel adds two 403 sub-cases (account gate) and the * 429 scope_answer_cap. Everything else falls through to the generic * cases. */ export declare function complianceResult(res: { status: number; ok: boolean; body: unknown; }): ToolResult; interface ComplianceTool { name: string; title: string; description: string; inputSchema: z.ZodRawShape; annotations: ToolAnnotations; handler: (args: Record) => Promise; } /** Build the nine compliance tools bound to a client. */ export declare function buildComplianceTools(client: TracePassClient): ComplianceTool[]; /** Build the compliance `McpServer`. The caller connects it to a transport. */ export declare function createComplianceMcpServer(config: CreateComplianceMcpServerConfig): McpServer; export {}; //# sourceMappingURL=compliance-server.d.ts.map