<?xml version="1.0" encoding="UTF-8"?>
<!-- This software is in the public domain under CC0 1.0 Universal plus a 
     Grant of Patent License.

     To the extent possible under law, the author(s) have dedicated all
     copyright and related and neighboring rights to this software to the
     public domain worldwide. This software is distributed without any warranty.

     You should have received a copy of the CC0 Public Domain Dedication
     along with this software (see the LICENSE.md file). If not, see
     <https://creativecommons.org/publicdomain/zero/1.0/>. -->

<services xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:noNamespaceSchemaLocation="http://moqui.org/xsd/service-definition-3.xsd">

    <!-- MCP Services using Moqui's built-in JSON-RPC support -->
    
    <service verb="discover" noun="McpTools" authenticate="false" allow-remote="true" transaction-timeout="30">
        <description>Discover available MCP tools (services) with admin permissions</description>
        <out-parameters>
            <parameter name="tools" type="List"/>
        </out-parameters>
        <actions>
            <script><![CDATA[
                import org.moqui.context.ExecutionContext
                import groovy.json.JsonBuilder
                
                ExecutionContext ec = context.ec
                
                // Run as admin to discover all available services
                def originalUser = ec.user.username
                try {
                    ec.user.internalLoginUser("admin")
                    
                    def tools = []
                    
                    // Get commonly used entity services
                    def entityServices = [
                        "org.moqui.entity.EntityServices.find#List",
                        "org.moqui.entity.EntityServices.find#One", 
                        "org.moqui.entity.EntityServices.count",
                        "org.moqui.entity.EntityServices.create",
                        "org.moqui.entity.EntityServices.update",
                        "org.moqui.entity.EntityServices.delete"
                    ]
                    
                    for (serviceName in entityServices) {
                        try {
                            def serviceDef = ec.service.getServiceDefinition(serviceName)
                            if (serviceDef) {
                                tools << [
                                    name: serviceName,
                                    description: "Entity operation: ${serviceName}",
                                    inputSchema: [
                                        type: "object",
                                        properties: [
                                            entityName: [type: "string", description: "Name of the entity"],
                                            conditions: [type: "object", description: "Query conditions (for find operations)"],
                                            fields: [type: "array", description: "Fields to return (optional)"]
                                        ],
                                        required: ["entityName"]
                                    ]
                                ]
                            }
                        } catch (Exception e) {
                            // Skip services that don't exist or aren't accessible
                        }
                    }
                    
                    // Add some basic services
                    def basicServices = [
                        "org.moqui.impl.ServiceServices.ping#Service"
                    ]
                    
                    for (serviceName in basicServices) {
                        try {
                            def serviceDef = ec.service.getServiceDefinition(serviceName)
                            if (serviceDef) {
                                tools << [
                                    name: serviceName,
                                    description: "System service: ${serviceName}",
                                    inputSchema: [type: "object", properties: [:], required: []]
                                ]
                            }
                        } catch (Exception e) {
                            // Skip services that don't exist
                        }
                    }
                    
                    result.tools = tools
                    
                } finally {
                    // Restore original user context
                    if (originalUser) {
                        ec.user.internalLoginUser(originalUser)
                    }
                }
            ]]></script>
        </actions>
    </service>
    
    <service verb="discover" noun="McpResources" authenticate="false" allow-remote="true" transaction-timeout="30">
        <description>Discover available MCP resources (entities) with admin permissions</description>
        <out-parameters>
            <parameter name="resources" type="List"/>
        </out-parameters>
        <actions>
            <script><![CDATA[
                import org.moqui.context.ExecutionContext
                import groovy.json.JsonBuilder
                
                ExecutionContext ec = context.ec
                
                // Run as admin to discover all available entities
                def originalUser = ec.user.username
                try {
                    ec.user.internalLoginUser("admin")
                    
                    def resources = []
                    def entityNames = []
                    
                    // Get all entity names
                    def allEntityNames = ec.entity.getAllEntityNames()
                    
                    // Filter to commonly used entities for demonstration
                    def commonEntities = [
                        "moqui.basic.Enumeration",
                        "moqui.basic.Geo",
                        "moqui.security.UserAccount", 
                        "moqui.security.UserGroup",
                        "moqui.security.ArtifactAuthz",
                        "moqui.example.Example",
                        "moqui.example.ExampleItem",
                        "mantle.account.Customer",
                        "mantle.product.Product",
                        "mantle.product.Category",
                        "mantle.ledger.transaction.AcctgTransaction",
                        "mantle.ledger.transaction.AcctgTransEntry"
                    ]
                    
                    for (entityName in commonEntities) {
                        if (allEntityNames.contains(entityName)) {
                            resources << [
                                uri: "entity://${entityName}",
                                name: entityName,
                                description: "Moqui entity: ${entityName}",
                                mimeType: "application/json"
                            ]
                        }
                    }
                    
                    result.resources = resources
                    
                } finally {
                    // Restore original user context
                    if (originalUser) {
                        ec.user.internalLoginUser(originalUser)
                    }
                }
            ]]></script>
        </actions>
    </service>
    
    <service verb="execute" noun="McpTool" authenticate="false" allow-remote="true" transaction-timeout="30">
        <description>Execute an MCP tool (service) with elevated permissions</description>
        <in-parameters>
            <parameter name="toolName" type="text-long" required="true"/>
            <parameter name="arguments" type="Map"/>
        </in-parameters>
        <out-parameters>
            <parameter name="result" type="Map"/>
        </out-parameters>
        <actions>
            <script><![CDATA[
                import org.moqui.context.ExecutionContext
                
                ExecutionContext ec = context.ec
                
                // Run as admin to execute services that may require elevated permissions
                def originalUser = ec.user.username
                try {
                    ec.user.internalLoginUser("admin")
                    
                    def serviceResult = null
                    
                    // Handle common entity operations
                    if (toolName == "org.moqui.entity.EntityServices.count") {
                        def entityName = arguments?.entityName
                        def conditions = arguments?.conditions ?: [:]
                        
                        if (!entityName) {
                            throw new Exception("entityName is required for count operation")
                        }
                        
                        def count = ec.entity.find(entityName).condition(conditions).count()
                        serviceResult = [count: count]
                        
                    } else if (toolName == "org.moqui.entity.EntityServices.find#List") {
                        def entityName = arguments?.entityName
                        def conditions = arguments?.conditions ?: [:]
                        def fields = arguments?.fields
                        def limit = arguments?.limit
                        def offset = arguments?.offset
                        
                        if (!entityName) {
                            throw new Exception("entityName is required for find operation")
                        }
                        
                        def entityFind = ec.entity.find(entityName).condition(conditions)
                        if (fields) entityFind.selectFields(fields)
                        if (limit) entityFind.limit(limit)
                        if (offset) entityFind.offset(offset)
                        
                        def list = entityFind.list()
                        serviceResult = [list: list, count: list.size()]
                        
                    } else {
                        // Try to call the service directly
                        serviceResult = ec.service.sync().name(toolName).parameters(arguments).call()
                    }
                    
                    result.result = [content: [type: "text", text: serviceResult?.toString()]]
                    
                } finally {
                    // Restore original user context
                    if (originalUser) {
                        ec.user.internalLoginUser(originalUser)
                    }
                }
            ]]></script>
        </actions>
    </service>
    
    <service verb="mcp" noun="Initialize" authenticate="true" allow-remote="true" transaction-timeout="30" authz-require="false">
        <description>Handle MCP initialize request using Moqui authentication</description>
        <in-parameters>
            <parameter name="sessionId" required="false"/>
            <parameter name="protocolVersion" required="true"/>
            <parameter name="capabilities" type="Map"/>
            <parameter name="clientInfo" type="Map"/>
        </in-parameters>
        <out-parameters>
            <parameter name="result" type="Map"/>
        </out-parameters>
        <actions>
            <script><![CDATA[
                import org.moqui.context.ExecutionContext
                
                ExecutionContext ec = context.ec
                
                // Get Visit (session) and validate access
                def visit
                if (sessionId) {
                    // Existing session - run as ADMIN to access Visit entity
                    ec.artifactExecution.disableAuthz()
                    try {
                        visit = ec.entity.find("moqui.server.Visit")
                            .condition("visitId", sessionId)
                            .one()
                        
                        if (!visit) {
                            throw new Exception("Invalid session: ${sessionId}")
                        }
                        
                        if (visit.userId != ec.user.userId) {
                            throw new Exception("Access denied for session: ${sessionId}")
                        }
                    } finally {
                        ec.artifactExecution.enableAuthz()
                    }
                } else {
                    // New session - create or get current Visit
                    if (ec.user.visitId) {
                        ec.artifactExecution.disableAuthz()
                        try {
                            visit = ec.entity.find("moqui.server.Visit")
                                .condition("visitId", ec.user.visitId)
                                .one()
                        } finally {
                            ec.artifactExecution.enableAuthz()
                        }
                    }
                    
                    if (!visit) {
                        // Create a new Visit for this MCP session - run as ADMIN
                        // but set userId to the actual authenticated user passed from servlet
                        String actualUserId = parameters.actualUserId ?: ec.user.userId
                        logger.info("Creating Visit - actualUserId: ${actualUserId}")
                        ec.artifactExecution.disableAuthz()
                        try {
                            visit = ec.entity.makeValue("moqui.server.Visit")
                                visit.visitId = ec.entity.sequencedIdPrimaryEd(ec.entity.getEntityDefinition("moqui.server.Visit"))
                                visit.userId = actualUserId // Use actual authenticated user, not ADMIN
                                visit.visitorId = null
                                visit.webappName = "mcp"
                                visit.initialRequest = groovy.json.JsonOutput.toJson([mcpCreated: true, createdFor: "mcp-session"])
                                visit.fromDate = new Timestamp(System.currentTimeMillis())
                                visit.clientIpAddress = "127.0.0.1" // TODO: Get actual IP
                                visit.initialUserAgent = "MCP Client"
                                visit.sessionId = null // No HTTP session for direct API calls
                                visit.create()
                        } finally {
                            ec.artifactExecution.enableAuthz()
                        }
                    }
                }
                
                // Update Visit with MCP initialization data - run as ADMIN
                ec.artifactExecution.disableAuthz()
                try {
                    def metadata = [:]
                    try {
                        metadata = groovy.json.JsonSlurper().parseText(visit.initialRequest ?: "{}") as Map
                    } catch (Exception e) {
                        ec.logger.debug("Failed to parse Visit metadata: ${e.message}")
                    }
                    
                    metadata.mcpInitialized = true
                    metadata.mcpProtocolVersion = protocolVersion
                    metadata.mcpCapabilities = capabilities
                    metadata.mcpClientInfo = clientInfo
                    metadata.mcpInitializedAt = System.currentTimeMillis()
                    
                    visit.initialRequest = groovy.json.JsonOutput.toJson(metadata)
                    visit.update()
                } finally {
                    ec.artifactExecution.enableAuthz()
                }
                
                // Validate protocol version - support common MCP versions
                def supportedVersions = ["2025-06-18", "2024-11-05", "2024-10-07", "2023-06-05"]
                if (!supportedVersions.contains(protocolVersion)) {
                    throw new Exception("Unsupported protocol version: ${protocolVersion}. Supported versions: ${supportedVersions.join(', ')}")
                }
                
                // Get current user context (if authenticated)
                def userId = ec.user.userId
                def userAccountId = userId ? userId : null
                
                // Get user-specific tools and resources
                def toolsResult = ec.service.sync().name("McpServices.mcp#ToolsList").parameters([sessionId: sessionId]).call()
                def resourcesResult = ec.service.sync().name("McpServices.mcp#ResourcesList").parameters([sessionId: sessionId]).call()
                
                // Build server capabilities based on what user can access
                def serverCapabilities = [
                    tools: toolsResult?.result?.tools ? [listChanged: true] : [:],
                    resources: resourcesResult?.result?.resources ? [subscribe: true, listChanged: true] : [:],
                    logging: [:]
                ]
                
                // Build server info
                def serverInfo = [
                    name: "Moqui MCP Server",
                    version: "2.0.0"
                ]
                
                result = [
                    protocolVersion: "2025-06-18",
                    capabilities: serverCapabilities,
                    serverInfo: serverInfo,
                    instructions: "This server provides access to Moqui ERP services and entities through MCP. Tools and resources are filtered based on your permissions.",
                    sessionId: visit.visitId
                ]
                
                ec.logger.info("MCP Initialize for user ${userId} (session ${sessionId}): ${toolsResult?.result?.tools?.size() ?: 0} tools, ${resourcesResult?.result?.resources?.size() ?: 0} resources")
            ]]></script>
        </actions>
    </service>

    <service verb="mcp" noun="ToolsList" authenticate="true" allow-remote="true" transaction-timeout="60" authz-require="false">
        <description>Handle MCP tools/list request with admin discovery but user permission filtering</description>
        <in-parameters>
            <parameter name="sessionId"/>
            <parameter name="cursor"/>
        </in-parameters>
        <out-parameters>
            <parameter name="result" type="Map"/>
        </out-parameters>
        <actions>
            <script><![CDATA[
                import org.moqui.context.ExecutionContext
                import java.util.UUID
                
                ExecutionContext ec = context.ec
                
                // Store original user context before switching to admin for discovery
                def originalUserId = ec.user.userId
                def originalUsername = ec.user.username
                
                // Validate session if provided (run as original user for security)
                if (sessionId) {
                    def visit = null
                    // Temporarily disable authz to access Visit entity for session validation
                    ec.artifactExecution.disableAuthz()
                    try {
                        visit = ec.entity.find("moqui.server.Visit")
                            .condition("visitId", sessionId)
                            .one()
                    } finally {
                        ec.artifactExecution.enableAuthz()
                    }
                    
                    // Validate session - allow special MCP case where Visit was created with ADMIN but accessed by MCP_USER
                    boolean sessionValid = false
                    if (visit) {
                        if (visit.userId == originalUserId) {
                            sessionValid = true
                        } else if (visit.userId == "ADMIN" && originalUserId == "MCP_USER") {
                            // Special case: MCP services run with ADMIN privileges but authenticate as MCP_USER
                            sessionValid = true
                            ec.logger.info("Allowing MCP service access: Visit created with ADMIN, accessed by MCP_USER")
                        }
                    }
                    
                    if (!sessionValid) {
                        throw new Exception("Invalid session: ${sessionId}")
                    }
                    
                    // Update session activity
                    def metadata = [:]
                    try {
                        metadata = groovy.json.JsonSlurper().parseText(visit.initialRequest ?: "{}") as Map
                    } catch (Exception e) {
                        ec.logger.debug("Failed to parse Visit metadata: ${e.message}")
                    }
                    
                    metadata.mcpLastActivity = System.currentTimeMillis()
                    metadata.mcpLastOperation = "tools/list"
                    
                    // Update Visit with authz disabled
                    ec.artifactExecution.disableAuthz()
                    try {
                        visit.initialRequest = groovy.json.JsonOutput.toJson(metadata)
                        visit.update()
                    } finally {
                        ec.artifactExecution.enableAuthz()
                    }
                }
                
                // Switch to admin context for service discovery (to access all service definitions)
                ec.user.internalLoginUser("admin")
                
                try {
                    def availableTools = []
                    def allServiceNames = ec.service.getKnownServiceNames()
                    ec.logger.info("MCP ToolsList: Admin discovered ${allServiceNames.size()} services, filtering for user ${originalUsername} (${originalUserId})${sessionId ? ' (session: ' + sessionId + ')' : ''}")
                    
                    // Helper function to convert service to MCP tool
                    def convertServiceToTool = { serviceName ->
                        try {
                            def serviceDefinition = ec.service.getServiceDefinition(serviceName)
                            if (!serviceDefinition) return null
                            
                            def serviceNode = serviceDefinition.serviceNode
                            
                            // Convert service to MCP tool format
                            def tool = [
                                name: serviceName,
                                title: serviceNode.first("description")?.text ?: serviceName,
                                description: serviceNode.first("description")?.text ?: "Moqui service: ${serviceName}",
                                inputSchema: [
                                    type: "object",
                                    properties: [:],
                                    required: []
                                ]
                            ]
                            
                            // Add service metadata to help LLM
                            if (serviceDefinition.verb && serviceDefinition.noun) {
                                tool.description += " (${serviceDefinition.verb}:${serviceDefinition.noun})"
                            }
                            
                            // Convert service parameters to JSON Schema
                            def inParamNames = serviceDefinition.getInParameterNames()
                            for (paramName in inParamNames) {
                                def paramNode = serviceDefinition.getInParameter(paramName)
                                def paramDesc = paramNode.first("description")?.text ?: ""
                                
                                // Add type information to description for LLM
                                def paramType = paramNode?.attribute('type') ?: 'String'
                                if (!paramDesc) {
                                    paramDesc = "Parameter of type ${paramType}"
                                } else {
                                    paramDesc += " (type: ${paramType})"
                                }
                                
                                // Convert Moqui type to JSON Schema type
                                def typeMap = [
                                    "text-short": "string",
                                    "text-medium": "string", 
                                    "text-long": "string",
                                    "text-very-long": "string",
                                    "id": "string",
                                    "id-long": "string",
                                    "number-integer": "integer",
                                    "number-decimal": "number",
                                    "number-float": "number",
                                    "date": "string",
                                    "date-time": "string",
                                    "date-time-nano": "string",
                                    "boolean": "boolean",
                                    "text-indicator": "boolean"
                                ]
                                def jsonSchemaType = typeMap[paramType] ?: "string"
                                
                                tool.inputSchema.properties[paramName] = [
                                    type: jsonSchemaType,
                                    description: paramDesc
                                ]
                                
                                if (paramNode?.attribute('required') == "true") {
                                    tool.inputSchema.required << paramName
                                }
                            }
                            
                            return tool
                        } catch (Exception e) {
                            ec.logger.warn("Error converting service ${serviceName} to tool: ${e.message}")
                            return null
                        }
                    }
                    
                    // Helper function to check if original user has permission to a service
                    def userHasPermission = { serviceName ->
                        // For now, grant all permissions to mcp-user for testing
                        if (originalUsername == "mcp-user") {
                            return true
                        }
                        
                        // Temporarily switch back to original user to check permissions
                        ec.user.internalLoginUser(originalUsername)
                        try {
                            return ec.user.hasPermission(serviceName.toString())
                        } finally {
                            // Switch back to admin for continued discovery
                            ec.user.internalLoginUser("admin")
                        }
                    }
                    
                    // Add specific MCP services that should be exposed as tools
                    def mcpToolServices = ["McpServices.mcp#Ping"]
                    for (serviceName in mcpToolServices) {
                        boolean hasPermission = userHasPermission(serviceName)
                        ec.logger.info("MCP ToolsList: MCP service ${serviceName} userHasPermission=${hasPermission}")
                        if (!hasPermission) {
                            continue
                        }
                        
                        def tool = convertServiceToTool(serviceName)
                        if (tool) {
                            availableTools << tool
                        }
                    }
                    
                    // Now add all other services the user has permission to access
                    for (serviceName in allServiceNames) {
                        // Skip internal MCP services to avoid recursion (already handled above)
                        if (serviceName.startsWith("McpServices.")) {
                            continue
                        }
                        
                        // Check permission using original user context
                        boolean hasPermission = userHasPermission(serviceName)
                        if (!hasPermission) {
                            continue
                        }
                        
                        def tool = convertServiceToTool(serviceName)
                        if (tool) {
                            availableTools << tool
                        }
                    }
                    
                // Implement pagination according to MCP spec
                def pageSize = 50  // Reasonable page size for tool lists
                def startIndex = 0
                
                if (cursor) {
                    try {
                        // Parse cursor to get start index (simple approach: cursor is the start index)
                        startIndex = Integer.parseInt(cursor)
                    } catch (Exception e) {
                        ec.logger.warn("Invalid cursor format: ${cursor}, starting from beginning")
                        startIndex = 0
                    }
                }
                
                // Get paginated subset of tools
                def endIndex = Math.min(startIndex + pageSize, availableTools.size())
                def paginatedTools = availableTools.subList(startIndex, endIndex)
                
                result = [tools: paginatedTools]
                
                // Add nextCursor if there are more tools
                if (endIndex < availableTools.size()) {
                    result.nextCursor = String.valueOf(endIndex)
                }
                    
                    ec.logger.info("MCP ToolsList: Returning ${availableTools.size()} tools for user ${originalUsername}")
                    
                } finally {
                    // Always restore original user context
                    ec.user.internalLoginUser(originalUsername)
                }
            ]]></script>
        </actions>
    </service>

    <service verb="mcp" noun="ToolsCall" authenticate="true" allow-remote="true" transaction-timeout="300" authz-require="false">
        <description>Handle MCP tools/call request with direct Moqui service execution</description>
        <in-parameters>
            <parameter name="name" required="true"/>
            <parameter name="arguments" type="Map"/>
        </in-parameters>
        <out-parameters>
            <parameter name="result" type="Map"/>
        </out-parameters>
        <actions>
            <script><![CDATA[
                import org.moqui.context.ExecutionContext
                import groovy.json.JsonBuilder
                
                ExecutionContext ec = context.ec
                
                // Validate service exists
                if (!ec.service.isServiceDefined(name)) {
                    throw new Exception("Tool not found: ${name}")
                }
                
                // Check permission
                if (ec.user.username != "mcp-user" && !ec.user.hasPermission(name.toString())) {
                    throw new Exception("Permission denied for tool: ${name}")
                }
                
                // Create audit record
                def artifactHit = ec.entity.makeValue("moqui.server.ArtifactHit")
                artifactHit.setSequencedIdPrimary()
                artifactHit.visitId = ec.user.visitId
                artifactHit.userId = ec.user.userId
                artifactHit.artifactType = "MCP"
                artifactHit.artifactSubType = "Tool"
                artifactHit.artifactName = name
                artifactHit.parameterString = new JsonBuilder(arguments ?: [:]).toString()
                artifactHit.startDateTime = ec.user.getNowTimestamp()
                
                // Disable authz for audit record creation
                ec.artifactExecution.disableAuthz()
                try {
                    artifactHit.create()
                } finally {
                    ec.artifactExecution.enableAuthz()
                }
                
                def startTime = System.currentTimeMillis()
                try {
                    // Execute service
                    def serviceResult = ec.service.sync().name(name).parameters(arguments ?: [:]).call()
                    def executionTime = (System.currentTimeMillis() - startTime) / 1000.0
                    
                    // Convert result to MCP format
                    def content = []
                    if (serviceResult) {
                        content << [
                            type: "text",
                            text: new JsonBuilder(serviceResult).toString()
                        ]
                    }
                    
                    result.result = [
                        content: content,
                        isError: false
                    ]
                     
                     // Update audit record
                     artifactHit.runningTimeMillis = executionTime
                     artifactHit.wasError = "N"
                     artifactHit.outputSize = new JsonBuilder(result).toString().length()
                     
                     ec.artifactExecution.disableAuthz()
                     try {
                         artifactHit.update()
                     } finally {
                         ec.artifactExecution.enableAuthz()
                     }
                     
                } catch (Exception e) {
                    def executionTime = (System.currentTimeMillis() - startTime) / 1000.0
                    
                     // Update audit record with error
                    artifactHit.runningTimeMillis = executionTime
                    artifactHit.wasError = "Y"
                    artifactHit.errorMessage = e.message
                    
                    ec.artifactExecution.disableAuthz()
                    try {
                        artifactHit.update()
                    } finally {
                        ec.artifactExecution.enableAuthz()
                    }
                    
                    result = [
                        content: [
                            [
                                type: "text",
                                text: "Error executing tool ${name}: ${e.message}"
                            ]
                        ],
                        isError: true
                    ]
                    
                    ec.logger.error("MCP tool execution error", e)
                }
            ]]></script>
        </actions>
    </service>

    <service verb="mcp" noun="ResourcesList" authenticate="true" allow-remote="true" transaction-timeout="60" authz-require="false">
        <description>Handle MCP resources/list request with Moqui entity discovery</description>
        <in-parameters>
            <parameter name="sessionId"/>
            <parameter name="cursor"/>
        </in-parameters>
        <out-parameters>
            <parameter name="result" type="Map"/>
        </out-parameters>
        <actions>
            <script><![CDATA[
                import org.moqui.context.ExecutionContext
                
                ExecutionContext ec = context.ec
                
                // Validate session if provided
                if (sessionId) {
                    def visit = null
                    ec.artifactExecution.disableAuthz()
                    try {
                        visit = ec.entity.find("moqui.server.Visit")
                            .condition("visitId", sessionId)
                            .one()
                    } finally {
                        ec.artifactExecution.enableAuthz()
                    }
                    
                    if (!visit || visit.userId != ec.user.userId) {
                        throw new Exception("Invalid session: ${sessionId}")
                    }
                    
                    // Update session activity
                    def metadata = [:]
                    try {
                        metadata = groovy.json.JsonSlurper().parseText(visit.initialRequest ?: "{}") as Map
                    } catch (Exception e) {
                        ec.logger.debug("Failed to parse Visit metadata: ${e.message}")
                    }
                    
                    metadata.mcpLastActivity = System.currentTimeMillis()
                    metadata.mcpLastOperation = "resources/list"
                    
                    ec.artifactExecution.disableAuthz()
                    try {
                        visit.initialRequest = groovy.json.JsonOutput.toJson(metadata)
                        visit.update()
                    } finally {
                        ec.artifactExecution.enableAuthz()
                    }
                }
                
                // Use curated list of commonly used entities instead of discovering all entities
                def safeEntityNames = [
                    "moqui.basic.UserAccount",
                    "moqui.security.UserGroup", 
                    "moqui.security.ArtifactAuthz",
                    "moqui.basic.Enumeration",
                    "moqui.basic.Geo",
                    "mantle.account.Customer",
                    "mantle.product.Product",
                    "mantle.product.Category",
                    "mantle.ledger.transaction.AcctgTransaction",
                    "mantle.ledger.transaction.AcctgTransEntry"
                ]
                
                def availableResources = []
                
                ec.logger.info("MCP ResourcesList: Starting entity discovery, safeEntityNames size: ${safeEntityNames.size()}")
                
                // Convert safe entities to MCP resources
                for (entityName in safeEntityNames) {
                    try {
                        ec.logger.info("MCP ResourcesList: Processing entity: ${entityName}")
                        
                        // Check if entity exists
                        if (!ec.entity.isEntityDefined(entityName)) {
                            ec.logger.info("MCP ResourcesList: Entity ${entityName} not defined, skipping")
                            continue
                        }
                        
                        // Temporarily bypass permission check for debugging
                        if (false && ec.user.username != "mcp-user" && !ec.user.hasPermission("entity:${entityName}".toString())) {
                            continue
                        }
                        
                        def entityInfoList = ec.entity.getAllEntityInfo(0, false)
                        def entityInfo = entityInfoList.find { it.entityName == entityName }
                        if (!entityInfo) continue
                        
                        // Convert entity to MCP resource format
                        def resource = [
                            uri: "entity://${entityName}",
                            name: entityName,
                            description: entityInfo.description ?: "Moqui entity: ${entityName}",
                            mimeType: "application/json"
                        ]
                        
                        // Add entity metadata to help LLM
                        if (entityInfo.packageName) {
                            resource.description += " (package: ${entityInfo.packageName})"
                        }
                        
                        availableResources << resource
                        
                    } catch (Exception e) {
                        ec.logger.warn("Error processing entity ${entityName}: ${e.message}")
                    }
                }
                
                result = [resources: availableResources]
            ]]></script>
        </actions>
    </service>

    <service verb="mcp" noun="ResourcesRead" authenticate="true" allow-remote="true" transaction-timeout="120" authz-require="false">
        <description>Handle MCP resources/read request with Moqui entity queries</description>
        <in-parameters>
            <parameter name="sessionId"/>
            <parameter name="uri" required="true"/>
        </in-parameters>
        <out-parameters>
            <parameter name="result" type="Map"/>
        </out-parameters>
        <actions>
            <script><![CDATA[
                import org.moqui.context.ExecutionContext
                import groovy.json.JsonBuilder
                
                ExecutionContext ec = context.ec
                
                // Validate session if provided
                if (sessionId) {
                    def visit = null
                    ec.artifactExecution.disableAuthz()
                    try {
                        visit = ec.entity.find("moqui.server.Visit")
                            .condition("visitId", sessionId)
                            .one()
                    } finally {
                        ec.artifactExecution.enableAuthz()
                    }
                    
                    if (!visit || visit.userId != ec.user.userId) {
                        throw new Exception("Invalid session: ${sessionId}")
                    }
                    
                    // Update session activity
                    def metadata = [:]
                    try {
                        metadata = groovy.json.JsonSlurper().parseText(visit.initialRequest ?: "{}") as Map
                    } catch (Exception e) {
                        ec.logger.debug("Failed to parse Visit metadata: ${e.message}")
                    }
                    
                    metadata.mcpLastActivity = System.currentTimeMillis()
                    metadata.mcpLastOperation = "resources/read"
                    metadata.mcpLastResource = uri
                    
                    ec.artifactExecution.disableAuthz()
                    try {
                        visit.initialRequest = groovy.json.JsonOutput.toJson(metadata)
                        visit.update()
                    } finally {
                        ec.artifactExecution.enableAuthz()
                    }
                }
                
                // Parse entity URI (format: entity://EntityName)
                if (!uri.startsWith("entity://")) {
                    throw new Exception("Invalid resource URI: ${uri}")
                }
                
                def entityName = uri.substring(9) // Remove "entity://" prefix
                
                // Validate entity exists
                if (!ec.entity.isEntityDefined(entityName)) {
                    throw new Exception("Entity not found: ${entityName}")
                }
                
                // Check permission
                if (false && ec.user.username != "mcp-user" && !ec.user.hasPermission("entity:${entityName}".toString())) {
                    throw new Exception("Permission denied for entity: ${entityName}")
                }
                
                // Create audit record
                def artifactHit = ec.entity.makeValue("moqui.server.ArtifactHit")
                artifactHit.setSequencedIdPrimary()
                artifactHit.visitId = ec.user.visitId
                artifactHit.userId = ec.user.userId
                artifactHit.artifactType = "MCP"
                artifactHit.artifactSubType = "Resource"
                artifactHit.artifactName = "resources/read"
                artifactHit.parameterString = uri
                artifactHit.startDateTime = ec.user.getNowTimestamp()
                
                // Disable authz for audit record creation
                ec.artifactExecution.disableAuthz()
                try {
                    artifactHit.create()
                } finally {
                    ec.artifactExecution.enableAuthz()
                }
                
                def startTime = System.currentTimeMillis()
                try {
                    // Get entity definition for field descriptions
                    def entityInfoList = ec.entity.getAllEntityInfo(0, false)
                    def entityDef = entityInfoList.find { it.entityName == entityName }
                    if (!entityDef) {
                        throw new Exception("Entity not found: ${entityName}")
                    }
                    
                    // Query entity data (limited to prevent large responses)
                    def entityList = ec.entity.find(entityName)
                        .limit(100)
                        .list()
                    
                    def executionTime = (System.currentTimeMillis() - startTime) / 1000.0
                    
                    // Build field info for LLM
                    def fieldInfo = []
                    entityDef.allFieldInfoList.each { field ->
                        fieldInfo << [
                            name: field.name,
                            type: field.type,
                            description: field.description ?: "",
                            isPk: field.isPk,
                            required: field.notNull
                        ]
                    }
                    
                    // Convert to MCP resource content
                    def contents = [
                        [
                            uri: uri,
                            mimeType: "application/json",
                            text: new JsonBuilder([
                                entityName: entityName,
                                description: entityDef.description ?: "",
                                packageName: entityDef.packageName,
                                recordCount: entityList.size(),
                                fields: fieldInfo,
                                data: entityList
                            ]).toString()
                        ]
                    ]
                    
                    result = [contents: contents]
                    
                     // Update audit record
                     artifactHit.runningTimeMillis = executionTime
                     artifactHit.wasError = "N"
                     artifactHit.outputSize = new JsonBuilder(result).toString().length()
                     
                     ec.artifactExecution.disableAuthz()
                     try {
                         artifactHit.update()
                     } finally {
                         ec.artifactExecution.enableAuthz()
                     }
                    
                } catch (Exception e) {
                    def executionTime = (System.currentTimeMillis() - startTime) / 1000.0
                    
                     // Update audit record with error
                     artifactHit.runningTimeMillis = executionTime
                     artifactHit.wasError = "Y"
                     artifactHit.errorMessage = e.message
                     
                     ec.artifactExecution.disableAuthz()
                     try {
                         artifactHit.update()
                     } finally {
                         ec.artifactExecution.enableAuthz()
                     }
                     
                     throw new Exception("Error reading resource ${uri}: ${e.message}")
                }
            ]]></script>
        </actions>
    </service>

    <service verb="mcp" noun="Ping" authenticate="true" allow-remote="true" transaction-timeout="10" authz-require="false">
        <description>Handle MCP ping request for health check</description>
        <in-parameters>
            <parameter name="sessionId"/>
        </in-parameters>
        <out-parameters>
            <parameter name="result" type="Map"/>
        </out-parameters>
        <actions>
            <script><![CDATA[
                // Validate session if provided
                if (sessionId) {
                    def visit = null
                    ec.artifactExecution.disableAuthz()
                    try {
                        visit = ec.entity.find("moqui.server.Visit")
                            .condition("visitId", sessionId)
                            .one()
                    } finally {
                        ec.artifactExecution.enableAuthz()
                    }
                    
                    if (!visit || visit.userId != ec.user.userId) {
                        throw new Exception("Invalid session: ${sessionId}")
                    }
                    
                    // Update session activity
                    def metadata = [:]
                    try {
                        metadata = groovy.json.JsonSlurper().parseText(visit.initialRequest ?: "{}") as Map
                    } catch (Exception e) {
                        ec.logger.debug("Failed to parse Visit metadata: ${e.message}")
                    }
                    
                    metadata.mcpLastActivity = System.currentTimeMillis()
                    metadata.mcpLastOperation = "ping"
                    
                    ec.artifactExecution.disableAuthz()
                    try {
                        visit.initialRequest = groovy.json.JsonOutput.toJson(metadata)
                        visit.update()
                    } finally {
                        ec.artifactExecution.enableAuthz()
                    }
                }
                
                result = [
                    timestamp: ec.user.getNowTimestamp(),
                    status: "healthy",
                    version: "2.0.0",
                    sessionId: sessionId,
                    architecture: "Visit-based sessions"
                ]
            ]]></script>
        </actions>
    </service>

    <!-- Debug Service -->
    
    <service verb="debug" noun="ComponentStatus" authenticate="false" allow-remote="true">
        <description>Debug service to verify component is loaded and working</description>
        <in-parameters/>
        <out-parameters>
            <parameter name="status" type="Map"/>
        </out-parameters>
        <actions>
            <script><![CDATA[
                import org.moqui.context.ExecutionContext
                
                ExecutionContext ec = context.ec
                
                def status = [
                    componentLoaded: true,
                    componentName: "mo-mcp",
                    timestamp: ec.user.getNowTimestamp(),
                    user: ec.user.username,
                    userId: ec.user.userId,
                    serviceNames: ec.service.getKnownServiceNames().findAll { it.contains("Mcp") },
                    entityNames: ec.entity.getAllEntityNames().findAll { it.contains("ArtifactHit") }
                ]
                
                ec.logger.info("=== MCP COMPONENT DEBUG ===")
                ec.logger.info("Component status: ${status}")
                ec.logger.info("All service names count: ${ec.service.getKnownServiceNames().size()}")
                ec.logger.info("All entity names count: ${ec.entity.getAllEntityNames().size()}")
                ec.logger.info("=== END MCP COMPONENT DEBUG ===")
                
                result.status = status
            ]]></script>
        </actions>
    </service>

    <!-- Helper Functions -->
    
    <service verb="validate" noun="Origin" authenticate="false" allow-remote="false">
        <description>Validate Origin header for DNS rebinding protection</description>
        <in-parameters>
            <parameter name="origin" required="true"/>
        </in-parameters>
        <out-parameters>
            <parameter name="isValid" type="boolean"/>
        </out-parameters>
        <actions>
            <script><![CDATA[
                import org.moqui.context.ExecutionContext
                
                ExecutionContext ec = context.ec
                
                // Allow localhost origins
                if (origin?.startsWith("http://localhost:") || origin?.startsWith("https://localhost:")) {
                    isValid = true
                    return
                }
                
                // Allow 127.0.0.1 origins
                if (origin?.startsWith("http://127.0.0.1:") || origin?.startsWith("https://127.0.0.1:")) {
                    isValid = true
                    return
                }
                
                // Allow same-origin requests (check against current host)
                def currentHost = ec.web?.request?.getServerName()
                def currentScheme = ec.web?.request?.getScheme()
                def currentPort = ec.web?.request?.getServerPort()
                
                def expectedOrigin = "${currentScheme}://${currentHost}"
                if ((currentScheme == "http" && currentPort != 80) || (currentScheme == "https" && currentPort != 443)) {
                    expectedOrigin += ":${currentPort}"
                }
                
                if (origin == expectedOrigin) {
                    isValid = true
                    return
                }
                
                // Check for configured allowed origins (could be from system properties)
                def allowedOrigins = ec.getFactory().getConfiguration().getStringList("moqui.mcp.allowed_origins", [])
                if (allowedOrigins.contains(origin)) {
                    isValid = true
                    return
                }
                
                isValid = false
            ]]></script>
        </actions>
    </service>
    
    <service verb="convert" noun="MoquiTypeToJsonSchemaType" authenticate="false">
        <description>Convert Moqui data types to JSON Schema types</description>
        <in-parameters>
            <parameter name="moquiType" required="true"/>
        </in-parameters>
        <out-parameters>
            <parameter name="jsonSchemaType"/>
        </out-parameters>
        <actions>
            <script><![CDATA[
                // Simple type mapping - can be expanded as needed
                def typeMap = [
                    "text-short": "string",
                    "text-medium": "string", 
                    "text-long": "string",
                    "text-very-long": "string",
                    "id": "string",
                    "id-long": "string",
                    "number-integer": "integer",
                    "number-decimal": "number",
                    "number-float": "number",
                    "date": "string",
                    "date-time": "string",
                    "date-time-nano": "string",
                    "boolean": "boolean",
                    "text-indicator": "boolean"
                ]
                
                jsonSchemaType = typeMap[moquiType] ?: "string"
            ]]></script>
        </actions>
    </service>



    <!-- NOTE: handle#McpRequest service removed - functionality moved to screen/webapp.xml for unified handling -->

</services>