@awesomate/hosting-mcp 0.7.1 → 0.7.2

package/README.md

@@ -14,14 +14,24 @@ which redeems a setup code for a scoped access token (stored at
 (Support Plus+), and registers this server. The **`awesomate-hosting` skill**
 (bundled under `skill/`) makes Claude plan-aware and enforces snapshot-before-change.
 
-Manual registration:
-
-```bash
-claude mcp add awesomate-hosting --env AWESOMATE_PAT=amt_pat_... -- npx -y @awesomate/hosting-mcp
+Manual registration — add to `~/.claude.json` under `mcpServers` (the
+bootstrap does this automatically; never bake `AWESOMATE_PAT` into the env,
+that pins the registration to one stale account forever):
+
+```json
+"awesomate-hosting": {
+  "command": "npx",
+  "args": ["-y", "--package=@awesomate/hosting-mcp", "awesomate-hosting-mcp"]
+}
 ```
 
-Config resolution: `AWESOMATE_PAT` / `AWESOMATE_API_BASE` env vars, falling
-back to `~/.awesomate/credentials.json` (`{ "pat": "...", "apiBase": "..." }`).
+If you use `claude mcp add` instead, keep the `--package=` form — the claude
+CLI pre-scans the whole argv for its own global `-p`/`--print` flag (even
+after `--`), so a bare `-p <pkg>` breaks its option parsing.
+
+Account resolution: `AWESOMATE_PAT` env → `AWESOMATE_ACCOUNT` env →
+`.awesomate.json` folder pin → sole/default profile in
+`~/.awesomate/credentials.json` (multi-account since 0.7.0).
 
 ## Tools (v0.1 — read-only)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awesomate/hosting-mcp",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "description": "Awesomate MCP server — lets Claude manage your Awesomate WordPress hosting, plan, limits, and n8n automations",
   "license": "UNLICENSED",
   "type": "module",

package/skill/awesomate-hosting/SKILL.md

@@ -215,7 +215,9 @@ Git skills drive the Git workflow; this skill just deploys the result.
   effort) generates an SSH keypair and registers the public key. If the SSH
   step fails (e.g. hosting not fully provisioned), the token + skill + MCP are
   still set up. The Connect-Claude-Code prompt from the hub runs this via
-  `npx -p @awesomate/hosting-mcp awesomate-hosting-bootstrap`.
+  `npx -y --package=@awesomate/hosting-mcp awesomate-hosting-bootstrap`.
+  (Always the `--package=` form — a bare `-p` breaks the claude CLI's argv
+  pre-scan if the command is ever wrapped in `claude mcp add`.)
 - `ssh-connect.sh` — open a jailed SSH session (or run one remote command).
 - `wp.sh` — run a WP-CLI command against a live site over that SSH.
 - `deploy.sh` — snapshot-first Studio→live deploy (files, optional DB).

package/skill/awesomate-hosting/scripts/bootstrap.mjs

@@ -287,9 +287,16 @@ function installSkill() {
   return true;
 }
 
+// --package= (with the =) instead of -p: the claude CLI pre-scans the FULL
+// argv for its own global -p/--print flag — even after the `--` separator —
+// so any `claude mcp add … -- npx -y -p pkg bin` flips it into print mode and
+// it rejects the scope flag as "unknown option" (marlins bug report,
+// 2026-07-28). npx treats both forms identically at runtime; the = form keeps
+// the value glued to the token so these args are safe to copy anywhere.
+// The explicit package must stay: this package ships two bins.
 const CLEAN_ENTRY = {
   command: 'npx',
-  args: ['-y', '-p', '@awesomate/hosting-mcp', 'awesomate-hosting-mcp'],
+  args: ['-y', '--package=@awesomate/hosting-mcp', 'awesomate-hosting-mcp'],
 };
 const MANUAL_ADD_JSON = JSON.stringify({ mcpServers: { 'awesomate-hosting': CLEAN_ENTRY } }, null, 2);
 
@@ -349,7 +356,15 @@ function ensureMcpRegistration() {
     }
   }
 
-  if (changed) writeJsonFile(claudeJsonPath, cfg);
+  if (changed) {
+    writeJsonFile(claudeJsonPath, cfg);
+    // Read back and verify — never trust a write (or a CLI exit code) alone.
+    const verify = readJsonFile(claudeJsonPath);
+    const written = verify?.mcpServers?.['awesomate-hosting'];
+    if (!written || written.command !== CLEAN_ENTRY.command || !JSON.stringify(written.args ?? []).includes('awesomate-hosting-mcp')) {
+      throw new Error(`wrote ${claudeJsonPath} but the awesomate-hosting entry did not verify on read-back`);
+    }
+  }
 
   // Project-scope .mcp.json in cwd.
   const mcpJsonPath = join(cwd, '.mcp.json');