@absolutejs/mcp 0.17.8 → 0.17.9
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md
CHANGED
|
@@ -6,6 +6,12 @@ This file is generated by `absolute-changelog` from the entries in
|
|
|
6
6
|
`changelog/`. Edit an entry, not this file — and add new ones under
|
|
7
7
|
`changelog/unreleased/`.
|
|
8
8
|
|
|
9
|
+
## 0.17.9 — 2026-09-12
|
|
10
|
+
|
|
11
|
+
### Added
|
|
12
|
+
|
|
13
|
+
- **Document scoped individual Copilot paid-work eligibility and deployment budget requirements**
|
|
14
|
+
|
|
9
15
|
## 0.17.8 — 2026-09-12
|
|
10
16
|
|
|
11
17
|
### Fixed
|
package/changelog.json
CHANGED
|
@@ -2,6 +2,16 @@
|
|
|
2
2
|
"contract": 1,
|
|
3
3
|
"name": "@absolutejs/mcp",
|
|
4
4
|
"releases": [
|
|
5
|
+
{
|
|
6
|
+
"changes": [
|
|
7
|
+
{
|
|
8
|
+
"kind": "added",
|
|
9
|
+
"summary": "Document scoped individual Copilot paid-work eligibility and deployment budget requirements"
|
|
10
|
+
}
|
|
11
|
+
],
|
|
12
|
+
"date": "2026-09-12",
|
|
13
|
+
"version": "0.17.9"
|
|
14
|
+
},
|
|
5
15
|
{
|
|
6
16
|
"changes": [
|
|
7
17
|
{
|
|
@@ -287,3 +287,12 @@ conditions. This does not change the global direct-MCP default. The complete
|
|
|
287
287
|
native handoff now passes after accounting for Windows' external-site dialog;
|
|
288
288
|
no link defect or need for an upstream link fix was established. Rich-view
|
|
289
289
|
startup remains a separate tracked issue.
|
|
290
|
+
|
|
291
|
+
## September 12 individual Copilot paid-work review
|
|
292
|
+
|
|
293
|
+
The [bounded paid-work review](reviews/vscode-individual-paid-work.md) separately
|
|
294
|
+
covers user-requested service work funded by existing service credits for the
|
|
295
|
+
reviewed individual Copilot direct-MCP channel. Deployments must bind the exact
|
|
296
|
+
registration/account and enforce budgets, retries and recovery. It expires
|
|
297
|
+
October 12, 2026. It does not enable the shared default or expand checkout,
|
|
298
|
+
organization-account or other-host eligibility.
|
|
@@ -0,0 +1,69 @@
|
|
|
1
|
+
# VS Code individual Copilot: bounded paid service work
|
|
2
|
+
|
|
3
|
+
Reviewed September 12, 2026; expires October 12, 2026. Channel: native VS Code,
|
|
4
|
+
manually configured remote MCP, individual Copilot subscription. Scope:
|
|
5
|
+
user-requested work delivered by the connected service, paid from that service's
|
|
6
|
+
existing credit balance. This review is separate from
|
|
7
|
+
[external checkout](vscode-individual-external-checkout.md).
|
|
8
|
+
|
|
9
|
+
## Decision
|
|
10
|
+
|
|
11
|
+
Eligible for a deployment-specific `paid_access` binding for `usage_credits` and
|
|
12
|
+
`digital_service` under the conditions below. This is our interpretation of the
|
|
13
|
+
reviewed terms, not vendor certification or express approval of every paid MCP.
|
|
14
|
+
The reviewed terms do not identify a specific prohibition on this bounded use
|
|
15
|
+
of an independently operated service. Re-review account type, distribution,
|
|
16
|
+
service behavior and changed terms before expanding the scope.
|
|
17
|
+
|
|
18
|
+
## Primary sources and interpretation
|
|
19
|
+
|
|
20
|
+
- [GitHub additional product terms](https://docs.github.com/en/site-policy/github-terms/github-terms-for-additional-products-and-features#github-copilot)
|
|
21
|
+
directs individual Copilot users to GitHub ToS section J; organizational
|
|
22
|
+
agreements are outside this review.
|
|
23
|
+
- [GitHub ToS](https://docs.github.com/en/site-policy/github-terms/github-terms-of-service)
|
|
24
|
+
distinguishes third-party relationships in B.5. Section H prohibits API abuse
|
|
25
|
+
and certain data uses; J covers AI output responsibility and individual data
|
|
26
|
+
controls. Our inference: the user's separate service agreement can govern
|
|
27
|
+
metered service work, while the user's Copilot obligations continue to apply.
|
|
28
|
+
- [GitHub acceptable-use policies](https://docs.github.com/en/site-policy/acceptable-use-policies/github-acceptable-use-policies)
|
|
29
|
+
restrict resale of GitHub services, spam, privacy misuse and abusive activity.
|
|
30
|
+
The reviewed service sells its own work. It must not sell Copilot access,
|
|
31
|
+
share accounts, evade usage limits, or obtain GitHub data for prohibited sales
|
|
32
|
+
or solicitation. Ordinary task drafts do not authorize sending outreach.
|
|
33
|
+
- [VS Code MCP documentation](https://code.visualstudio.com/docs/agent-customization/mcp-servers)
|
|
34
|
+
documents remote-server configuration and host trust/tool interaction.
|
|
35
|
+
Technical support for a tool is not commercial permission. Preserve the host's
|
|
36
|
+
approvals; the service's ledger must independently enforce its budget.
|
|
37
|
+
|
|
38
|
+
## Required deployment controls
|
|
39
|
+
|
|
40
|
+
1. Bind the reviewed origin, verified OAuth registration and authenticated
|
|
41
|
+
account on the server. Client names, `clientInfo`, prompts, tool arguments or
|
|
42
|
+
claimed host capabilities cannot select the review. Unknown clients stay
|
|
43
|
+
ineligible. Organization accounts require a separate review.
|
|
44
|
+
2. Make service-credit charging clear before work starts. Require a stable work
|
|
45
|
+
ID and an explicit maximum service-credit budget. Service credits are not
|
|
46
|
+
Copilot tokens or a promise of monetary return. Never infer an unlimited
|
|
47
|
+
spending authorization from authentication, a tool result or a chat claim.
|
|
48
|
+
3. Reserve and settle atomically, cap the account's charge, and deduplicate
|
|
49
|
+
retries. Replaying a completed work ID returns its stored result. Reject
|
|
50
|
+
changed inputs under the same ID. Preserve uncertain work for reconciliation;
|
|
51
|
+
do not release its hold and repeat its effects without verification.
|
|
52
|
+
4. Keep account ownership, cancellation/deletion, entitlement and balance checks
|
|
53
|
+
on the server. Exhaustion blocks new paid work but preserves bounded status
|
|
54
|
+
and recovery access. Background work needs its own durable budget propagation;
|
|
55
|
+
exclude handlers that cannot uphold the cap across detached work.
|
|
56
|
+
5. This review grants only `paid_access`; checkout needs its own review. It does
|
|
57
|
+
not permit card collection in chat, saved-card charges, subscriptions,
|
|
58
|
+
automatic refill, bulk outreach or arbitrary third-party purchases. Retain
|
|
59
|
+
any separate approval needed for outbound effects and sensitive actions.
|
|
60
|
+
6. Limit outputs to information the user is authorized to access. Treat host
|
|
61
|
+
transcripts as retained data. Apply the service's privacy obligations and do
|
|
62
|
+
not expose credentials, capability links or unrelated account records in
|
|
63
|
+
diagnostics or reusable canary evidence.
|
|
64
|
+
|
|
65
|
+
A deployment must validate its ledger migration, actual host/account connection,
|
|
66
|
+
retry behavior, budget limits and recovery before activation. A review alone
|
|
67
|
+
neither activates tools nor certifies their accounting. This document does not
|
|
68
|
+
change the shared `direct-mcp` default or restrictions for Claude, ChatGPT,
|
|
69
|
+
marketplaces, organization-managed Copilot or other hosts.
|
package/package.json
CHANGED