gnubok_search_tools matched only English tool names and descriptions, so
Swedish queries like "bankkonto" or "lönekörning" returned zero hits.
Adds an optional keywords field on tool definitions, folded into the
search matcher (name + description + keywords, case-insensitive, same
ranking family as name matches) and seeds Swedish domain terms on 152
tools. Keywords are matcher-side only: they are never serialized into
tools/list or search_tools output, since that payload budget has zero
headroom. Guarded by new tests in search-tools.test.ts and
lazy-auth.test.ts.
Claude-Session: https://claude.ai/code/session_018zGah8Yy49esAwpnKGxiGy
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* feat(mcp): lazy authentication so a client can connect before an account exists
Second PR of agent-first onboarding (#1814). A client with no token may
now initialize, list the default catalog and call the three documentation
tools (search_tools, list_skills, load_skill). Every other request keeps
the transport-level 401 + WWW-Authenticate, which is what Claude, Claude
Code and Codex turn into their Connect prompt; with #1855 the account is
created inside that prompt, so the first protected tool call is the whole
signup trigger.
- The JSON-RPC body is parsed before auth so the method and tool name can
decide whether a token is required. A tokenless unparseable body keeps
the old 401 answer.
- Anonymous callers get an 'anonymous' actor, an empty scope set, a
not-connected variant of the initialize instructions, and the full
default catalog from tools/list (the agent has to be able to name a
protected tool to trigger the challenge).
- Anonymous traffic is rate-limited per truncated IP via checkRateLimit;
truncateIp moves to lib/api/ip.ts so the MCP server can use it without
importing the v1 wrapper (which pulls lib/init and would cycle).
- gnubok_list_skills is now company-independent and skips its two context
lookups when there is no company (anonymous or not yet onboarded).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018wCdzRTatKiDByKB8hCNT6
* fix(mcp): gnubok_list_skills keeps its company_id argument as an optional-company tool
Making list_skills company-independent (so anonymous callers can run it)
silently dropped its company_id argument: a multi-company user asking
for another company's skill list got the key default instead. Optional-
company tools now advertise company_id and resolve (membership-checked)
it when an authenticated caller names one; anonymous callers cannot.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018wCdzRTatKiDByKB8hCNT6
---------
Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
