YATTA
DocsCompare
API reference

yatta/mcp

An MCP server whose tools come from your collections.

9 exported symbols and 20 members, read from src/func/mcp.ts.

Construct

createMCPHandler

function

Build the HTTP handler for the MCP endpoint.

createMCPHandler(options: McpOptions)

Returns A `(req) => Promise<Response>` for a router or `Bun.serve`.

isSensitiveCollection

function

Whether a collection name is on the never-expose list.

Case and punctuation are ignored, so `verification_tokens` is refused for the same reason `verificationTokens` is.

isSensitiveCollection(name: string): boolean

surfaceFromTables

function

Build a surface from raw collections, leaving the sensitive ones out.

This is the safe default: a table not named here cannot be exposed by accident, because exposure is opt-in per collection rather than a filter applied afterwards.

surfaceFromTables(tables: Record<string, McpTable>, functions?: McpFunction[]): McpSurface
functions
Tools to add alongside the generated collection tools.

Types

McpFunction

interface

A tool you write yourself.

Use one when a collection tool is too blunt: a function gets the caller's user id, so it can enforce who may see what.

interface McpFunction

4 members

  • nameproperty
    name: string
  • descriptionproperty
    description: string
  • inputSchemaproperty
    inputSchema: Record<string, unknown>
  • callproperty
    call: (args: Record<string, unknown>, ctx: { userId: string; }) => Promise<unknown> | unknown

McpOptions

interface
interface McpOptions

8 members

  • resolveUserproperty
    resolveUser: (req: Request) => Promise<string | null>

    Finds the signed-in user for a request, or null when nobody is signed

  • getSurfaceproperty
    getSurface: () => Promise<McpSurface> | McpSurface

    The app surface, read fresh on every request, so a collection added

  • authorizeproperty
    authorize?: (info: { userId: string; collection: string; action: CollectionAction; }) => Promise<boolean> | boolean

    Decide per call whether this user may do this to this collection.

    This is the only place row-level rules can live; the generated tools themselves have no idea who owns what.

  • allowedOriginsproperty
    allowedOrigins?: string[]

    Browser origins allowed to call /mcp, like `["https://app.example.com"]`.

  • pathproperty
    path?: string

    Where the handler is mounted. Default `/mcp`.

  • serverNameproperty
    serverName?: string

    Reported to clients in `initialize`. Default `yatta`.

  • serverVersionproperty
    serverVersion?: string

    Reported to clients in `initialize`. Default is the framework version.

  • instructionsproperty
    instructions?: string

    Sent to clients in `initialize`, and worth using: a sentence about what the tools are for.

McpSurface

interface

Everything this app exposes to MCP: collections plus hand-written tools.

interface McpSurface

2 members

  • tablesproperty
    tables: Record<string, McpTable>
  • functionsproperty
    functions: McpFunction[]

McpTable

interface

The slice of a database collection MCP needs.

Yatta's own collections satisfy this as they are; anything else with the same five methods can be exposed. Nothing here is called unless a client invokes the matching tool.

interface McpTable

6 members

  • primaryKeyColumnproperty
    primaryKeyColumn?: string
  • findMany
    findMany(options: { take?: number; skip?: number; }): Promise<unknown[]> | unknown[]
  • findFirst
    findFirst(options: { where: Record<string, unknown>; }): Promise<unknown | null> | unknown | null
  • insert
    insert(data: Record<string, unknown>): Promise<unknown> | unknown
  • update
    update(options: { where: Record<string, unknown>; data: Record<string, unknown>; }): Promise<{ changes: number; }> | { changes: number; }
  • delete
    delete(options: { where: Record<string, unknown>; }): Promise<{ changes: number; }> | { changes: number; }

CollectionAction

type

The five operations a collection gets, as seen by `authorize`.

type CollectionAction = "list" | "get" | "create" | "update" | "delete"

MCPHandler

type

The handler `createMCPHandler` returns.

type MCPHandler = ReturnType<typeof createMCPHandler>
Tip
Most of the types above are inferred. You rarely import AuthConfig or JobPayload — declaring your schema once is enough for the rest to follow. See Typed keys.