@attrkit/mcp 0.3.4 → 0.4.1

package/README.md

@@ -133,6 +133,16 @@ Environment-variable interpolation differs between clients, so follow the
 client's secret-handling documentation. `ATTRKIT_API_URL` is optional and
 defaults to `https://attrikit.io`.
 
+## Field naming
+
+Tool input schemas are snake_case (`bundle_id`, `store_url`, `campaign_id`) and
+double as REST documentation: the Management API accepts the same snake_case
+field names in query strings and JSON request bodies (camelCase also works),
+and responses are always snake_case. Field-level detail is returned under
+`error.fields` when a validation failure can be attributed to specific fields.
+Malformed JSON has no field to name. Self-identifying rejections such as
+`invalid_cursor`, `invalid_url`, and `ssrf_blocked` return the code alone.
+
 ## Test it locally
 
 ```bash
@@ -167,9 +177,10 @@ surface.
 - App creation, management-key creation, and webhook creation return secret
   values once. Capture them from the tool result; list tools only return masked
   metadata.
-- Mutation tools accept an optional `idempotency_key`. Reuse the same value only
-  for an exact retry. One-time secret responses are encrypted at rest and safely
-  replayed.
+- Non-removal mutation tools accept an optional `idempotency_key`. Reuse the
+  same value only for an exact retry. One-time secret responses are encrypted at
+  rest and safely replayed. Removal tools do not accept this parameter because
+  their DELETE operations cannot apply the removal more than once.
 - Management keys are protected by distributed per-key global, mutation, and
   expensive-operation limits. A `429` response includes `Retry-After`; wait at
   least that many seconds before retrying.