@attrkit/mcp 0.3.2 → 0.4.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Clashware Sàrl
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -133,6 +133,16 @@ Environment-variable interpolation differs between clients, so follow the
 client's secret-handling documentation. `ATTRKIT_API_URL` is optional and
 defaults to `https://attrikit.io`.
 
+## Field naming
+
+Tool input schemas are snake_case (`bundle_id`, `store_url`, `campaign_id`) and
+double as REST documentation: the Management API accepts the same snake_case
+field names in query strings and JSON request bodies (camelCase also works),
+and responses are always snake_case. Field-level detail is returned under
+`error.fields` when a validation failure can be attributed to specific fields.
+Malformed JSON has no field to name. Self-identifying rejections such as
+`invalid_cursor`, `invalid_url`, and `ssrf_blocked` return the code alone.
+
 ## Test it locally
 
 ```bash
@@ -167,9 +177,10 @@ surface.
 - App creation, management-key creation, and webhook creation return secret
   values once. Capture them from the tool result; list tools only return masked
   metadata.
-- Mutation tools accept an optional `idempotency_key`. Reuse the same value only
-  for an exact retry. One-time secret responses are encrypted at rest and safely
-  replayed.
+- Non-removal mutation tools accept an optional `idempotency_key`. Reuse the
+  same value only for an exact retry. One-time secret responses are encrypted at
+  rest and safely replayed. Removal tools do not accept this parameter because
+  their DELETE operations cannot apply the removal more than once.
 - Management keys are protected by distributed per-key global, mutation, and
   expensive-operation limits. A `429` response includes `Retry-After`; wait at
   least that many seconds before retrying.
@@ -177,3 +188,7 @@ surface.
 - MCP clients store environment values in local configuration. Never commit a
   configuration containing a key. Restrict access to the file and revoke any
   key that is exposed.
+
+## License
+
+MIT. See [LICENSE](./LICENSE).