feat: add CHORUS_TOOL_MODE for readonly/all tool filtering AND fix: resolve 20 high severity vulnerabilities and relax node engine

package.json

@@ -12,7 +12,7 @@
     "dist"
   ],
   "engines": {
-    "node": "^20.9.0 || ^22.0.0 || ^24.0.0",
+    "node": ">=18",
     "npm": ">=9.0.0"
   },
   "scripts": {
@@ -47,6 +47,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.26.0",
+    "@opensourceops/chorus-mcp": "^0.1.0",
     "axios": "^1.7.9",
     "express": "^4.21.0",
     "zod": "^3.23.8"
@@ -59,5 +60,9 @@
     "ts-jest": "^29.1.1",
     "tsx": "^4.19.2",
     "typescript": "^5.7.2"
+  },
+  "overrides": {
+    "minimatch": ">=10.2.1",
+    "glob": ">=11.0.0"
   }
 }

src/index.ts

@@ -10,22 +10,24 @@ import { registerUserTools } from "./tools/users.js";
 import { registerTeamTools } from "./tools/teams.js";
 import { registerScorecardTools } from "./tools/scorecards.js";
 import { registerPlaylistTools } from "./tools/playlists.js";
-import { registerMomentTools } from "./tools/moments.js";
+import { registerMomentTools, registerMomentWriteTools } from "./tools/moments.js";
 import { registerEmailTools } from "./tools/emails.js";
 import { registerEngagementTools } from "./tools/engagements.js";
 import { registerReportTools } from "./tools/reports.js";
 import { registerSavedSearchTools } from "./tools/saved-searches.js";
-import { registerVideoConferenceTools } from "./tools/video-conferences.js";
+import { registerVideoConferenceTools, registerVideoConferenceWriteTools } from "./tools/video-conferences.js";
 import { registerIntegrationTools } from "./tools/integrations.js";
 import { registerResources } from "./resources/index.js";
 import { registerPrompts } from "./prompts/index.js";
 
+const toolMode = process.env.CHORUS_TOOL_MODE || "readonly";
+
 const server = new McpServer({
   name: "chorus-mcp-server",
   version: "1.0.0",
 });
 
-// Register all tools
+// Register read-only tools (always)
 registerConversationTools(server);
 registerUserTools(server);
 registerTeamTools(server);
@@ -39,14 +41,20 @@ registerSavedSearchTools(server);
 registerVideoConferenceTools(server);
 registerIntegrationTools(server);
 
+// Register write tools only when mode is "all"
+if (toolMode === "all") {
+  registerMomentWriteTools(server);
+  registerVideoConferenceWriteTools(server);
+}
+
 // Register resources and prompts
 registerResources(server);
 registerPrompts(server);
 
 async function runStdio(): Promise<void> {
   const transport = new StdioServerTransport();
   await server.connect(transport);
-  console.error("Chorus MCP server running via stdio");
+  console.error(`Chorus MCP server running via stdio (tool mode: ${toolMode})`);
 }
 
 async function runHTTP(): Promise<void> {
@@ -67,7 +75,7 @@ async function runHTTP(): Promise<void> {
 
   const port = parseInt(process.env.PORT || "3000");
   app.listen(port, () => {
-    console.error(`Chorus MCP server running on http://localhost:${port}/mcp`);
+    console.error(`Chorus MCP server running on http://localhost:${port}/mcp (tool mode: ${toolMode})`);
   });
 }
 

src/tools/moments.ts

@@ -117,6 +117,9 @@ Returns: Moment with timestamp, title, description, type, and transcript text.`,
     }
   );
 
+}
+
+export function registerMomentWriteTools(server: McpServer): void {
   server.registerTool(
     "chorus_create_moment",
     {

src/tools/video-conferences.ts

@@ -103,6 +103,9 @@ Returns: Conference details with title, date, participants, recording URL, and d
     }
   );
 
+}
+
+export function registerVideoConferenceWriteTools(server: McpServer): void {
   server.registerTool(
     "chorus_upload_recording",
     {