@adminforth/mcp 1.1.1 → 1.1.2

package/dist/custom/McpAuthorize.vue

@@ -21,7 +21,7 @@
             {{ $t('asks to act on your behalf in {brand}: it will see and change everything you can.', { brand: brandName }) }}
           </template>
         </p>
-        <Checkbox v-if="!authorization.serverReadOnly" v-model="readOnlyChosen" class="mt-4">
+        <Checkbox v-model="readOnlyChosen" :disabled="authorization.serverReadOnly" class="mt-4">
           {{ $t('Read only: the agent can only read data') }}
         </Checkbox>
         <p v-if="authorization.loopbackRedirect" class="mt-3 text-sm font-medium text-amber-700 dark:text-amber-300">
@@ -71,8 +71,9 @@ const request = String(route.query.request);
 const authorization = ref<Authorization | null>(null);
 const error = ref('');
 const resolving = ref(false);
-const readOnlyChosen = ref(false);
-// With the plugin readOnly option every connection is read-only, so there is no choice to make.
+// Read-only is the default. With the plugin readOnly option every connection is read-only, so the checkbox stays
+// checked and locked.
+const readOnlyChosen = ref(true);
 const readOnly = computed(() => authorization.value?.serverReadOnly || readOnlyChosen.value);
 // AdminForth sends no frame protection headers, so a site sharing the admin panel domain could load this page in
 // an invisible frame and trick a click on Allow (clickjacking). The consent is never offered inside a frame.

package/dist/custom/McpSettings.vue

@@ -104,7 +104,7 @@
         <div class="mt-2">
           <Input v-model="secretName" type="text" fullWidth placeholder="Claude Code" />
         </div>
-        <Checkbox v-if="!serverReadOnly" v-model="secretReadOnly" class="mt-4">
+        <Checkbox v-model="secretReadOnly" :disabled="serverReadOnly" class="mt-4">
           {{ $t('Read only: the agent can only read data') }}
         </Checkbox>
       </div>
@@ -158,7 +158,8 @@ const authSecrets = ref<AuthSecret[]>([]);
 const loading = ref(true);
 const dialogRef = ref();
 const secretName = ref('');
-const secretReadOnly = ref(false);
+// Read-only is the default; with the plugin readOnly option the checkbox stays checked and locked.
+const secretReadOnly = ref(true);
 const serverReadOnly = ref(false);
 const createdSecret = ref('');
 const creating = ref(false);
@@ -272,7 +273,7 @@ async function loadAuthSecrets() {
 
 function openConnectDialog() {
   secretName.value = '';
-  secretReadOnly.value = false;
+  secretReadOnly.value = true;
   createdSecret.value = '';
   dialogRef.value?.open();
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adminforth/mcp",
-  "version": "1.1.1",
+  "version": "1.1.2",
   "description": "Expose AdminForth APIs as an authenticated MCP server",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",