@aicommander/mcp 1.0.16 → 1.0.17

package/README.md

@@ -7,7 +7,7 @@ Use this package to connect any MCP client that speaks **stdio** (Codex CLI, Cla
 > Using **Claude Code**? You don't need this package — add the relay directly:
 > `claude mcp add --transport http aicommander https://aicommander.dev/mcp`
 >
-> No login or token is required to connect. Only add `--header "Authorization: Bearer <api-key>"` if you want the optional accounts/alias features — generate an **account API key** for free at [aicommander.dev](https://aicommander.dev). By default an API key only works while its owner has signed in to the dashboard within the last **24h** (a sign-in or the dashboard "Reactivate" button re-arms it; opt-out per account) — if it lapses, tool calls return a friendly "sign in to reactivate" message instead of acting.
+> No login or token is required to connect. Only add `--header "Authorization: Bearer <api-key>"` if you want the optional accounts/alias features — generate an **account API key** for free at [aicommander.dev](https://aicommander.dev). By default an API key only works while its owner has opened the dashboard within the last **24h** (just opening it — or a fresh sign-in, or the dashboard "Reactivate" button — re-arms it; opt-out per account) — if it lapses, tool calls return a friendly "open the dashboard to reactivate" message instead of acting.
 
 ## Tools
 
@@ -25,7 +25,7 @@ Two environment variables:
 
 | Variable | Required | Default | Description |
 |---|---|---|---|
-| `AICOMMANDER_TOKEN` | no | — | **Account API key** (or OAuth access token) for the optional accounts/alias features — saved machines, aliases, account access. Generate one for free at [aicommander.dev](https://aicommander.dev). An API key stays active only while its account has signed in to the dashboard within the last 24h (default; opt-out per account); OAuth access tokens are not gated this way. |
+| `AICOMMANDER_TOKEN` | no | — | **Account API key** (or OAuth access token) for the optional accounts/alias features — saved machines, aliases, account access. Generate one for free at [aicommander.dev](https://aicommander.dev). An API key stays active only while its account has opened the dashboard within the last 24h (default; opt-out per account); OAuth access tokens are not gated this way. |
 | `AICOMMANDER_SERVER` | no | `https://aicommander.dev` | Base URL of the AI Commander relay. Defaults to the hosted service; only set this to point at a different endpoint. |
 
 ## Usage

package/dist/bin/mcp.js

@@ -8,9 +8,14 @@ const SERVER_URL = process.env["AICOMMANDER_SERVER"] ?? "https://aicommander.dev
 // access. Without it the bridge works anonymously and you drive machines by their
 // session code (AIC-…) inside the code's 1-hour freshness window.
 const ACCOUNT_TOKEN = process.env["AICOMMANDER_TOKEN"];
+// The /mcp endpoint is account-bound by default (it 401s an unauthenticated caller
+// to drive the OAuth flow). This stdio bridge authenticates with a Bearer token when
+// AICOMMANDER_TOKEN is set; without one it uses the explicit anonymous opt-in
+// (?anonymous=1) so the AIC-code path keeps working.
+const MCP_URL = ACCOUNT_TOKEN ? `${SERVER_URL}/mcp` : `${SERVER_URL}/mcp?anonymous=1`;
 const server = new McpServer({
     name: "aicommander",
-    version: "1.0.15",
+    version: "1.0.17",
 }, {
     instructions: "AI Commander — remote command execution / remote shell over an outbound-only agent. " +
         "Use these tools for any SSH-style remote access: connect to a computer/machine/server, " +
@@ -66,7 +71,7 @@ server.registerTool("remote_exec", {
             .describe("Timeout in milliseconds. Default 300000 (5 min), max 3600000 (1 hr)"),
     },
 }, async ({ code, command, cwd, timeout_ms }) => {
-    const res = await fetch(`${SERVER_URL}/mcp`, {
+    const res = await fetch(MCP_URL, {
         method: "POST",
         headers: {
             "Content-Type": "application/json",
@@ -140,7 +145,7 @@ server.registerTool("session_status", {
             .describe("How the user named the machine, passed exactly as given: an AIC- session code (e.g. AIC-XYZ-1234), or — with an API key — a saved alias/hostname like 'wearfits-m3' or 'aic-wearfits'."),
     },
 }, async ({ code }) => {
-    const res = await fetch(`${SERVER_URL}/mcp`, {
+    const res = await fetch(MCP_URL, {
         method: "POST",
         headers: {
             "Content-Type": "application/json",
@@ -173,7 +178,7 @@ server.registerTool("list_machines", {
     description: "List ALL of the user's machines (the computers/servers linked to their AI Commander account) with each one's live status. USE THIS for fleet-wide questions rather than one named machine — e.g. \"what machines do I have?\", \"which of my computers are online?\", \"list my servers/hosts\" — or when the user wants to act on a machine but hasn't said which yet (call this first to discover the options). Requires an API key (set AICOMMANDER_TOKEN); without it there is no account to list and it returns an error — fall back to session_status with a specific AIC- code. Each entry gives the machine's alias (pass it as `code` to the other tools), whether its agent is online right now, when it was last seen, and whether the link is still awaiting the machine operator's approval. Takes no arguments.",
     inputSchema: {},
 }, async () => {
-    const res = await fetch(`${SERVER_URL}/mcp`, {
+    const res = await fetch(MCP_URL, {
         method: "POST",
         headers: {
             "Content-Type": "application/json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aicommander/mcp",
-  "version": "1.0.16",
+  "version": "1.0.17",
   "mcpName": "dev.aicommander/mcp",
   "description": "MCP server for remote command execution — run shell/bash commands on remote machines, servers and laptops from your AI agent (Claude, Codex, any stdio MCP client). An SSH / Ansible alternative with no exposed SSH, open ports or VPN; drive machines by AIC-… session code or saved alias/hostname.",
   "keywords": [