@bicharts/chart-mcp 0.6.70 → 0.6.72

package/README.md

@@ -42,9 +42,10 @@ The main tools:
   call to the engine and therefore **metered** — see Signing in).
   By default it **auto-detects the project's language** (JS/TS vs Python from the
   working dir) and returns the charts for THAT language — **scoped to its renderers
-  and ranked by the picker's chart-type×renderer weights** (best first), each tagged
+  and ordered by how well each type fits this data** (best first), each tagged
   with its **source language** (JavaScript for D3/Vega, Python for Plotly/matplotlib),
-  its renderer, and a 0–100 score. Pass `language: "javascript"|"python"` to force it,
+  its renderer, and a 0–100 score. `order: "variety"` orders the same list for variety
+  instead (newer and less-common types first), for when you want to explore. Pass `language: "javascript"|"python"` to force it,
   `renderer: "D3"/"PLOTLY"/…` to rank one specific renderer, or `renderer: ""` for the
   full **renderer-agnostic** eligibility across all renderers (unranked — the wide "what
   *can* render" net). `top: N` trims to the best N. If the language can't be auto-detected
@@ -272,6 +273,36 @@ The server tells the BIC service three things, and nothing else:
 
 Set `BIC_MCP_TELEMETRY=0` in the server's environment to turn all of it off.
 
+## Hosted server (`--http`)
+
+The same server can also run as a remote MCP endpoint over Streamable HTTP, for clients that only take a URL (chat
+connectors, notebook and dashboard tools). It's how the hosted chart server runs behind the RegiaBI site, which
+checks each caller's sign-in before a request reaches it.
+
+```bash
+npx -y @bicharts/chart-mcp --http --host 127.0.0.1 --port 8799
+```
+
+`BIC_MCP_HOSTED=1` starts it the same way, and `BIC_MCP_HTTP_PORT` sets the port. It answers MCP on `POST /mcp`
+and `GET /healthz`. What's different from the local server:
+
+- **Every request needs `Authorization: Bearer <access token>`** (a request without one gets a 401), and that token is
+  the only credential its calls send. A license key in the environment or `~/.bic/credentials.json` isn't used, and no
+  browser sign-in opens. When the service turns the token away, the tool's answer says to reconnect; your MCP
+  client signs in again.
+- **It's stateless:** each request gets a fresh server and no session, so `GET` and `DELETE` on `/mcp` answer 405,
+  and a question a tool would ask the client (hover drop lines on a 3D scatter) goes to the agent instead.
+- **Five tools:** `assess_data_shape`, `list_eligible_charts`, `generate_chart`, `preview_request` and `get_guide`. The
+  tools that work in your project folder (`check_chart`, `check_app`, `setup_fabric_app`, `query_semantic_model`,
+  `suggest_charts`) need the local server, since a remote server can't see your machine.
+- **Tables travel in the request,** as `data` or `csv_text`; `csv_path`, `out_dir`, `preview_html` and `project_dir`
+  are refused with a one-line reason. The server profiles the table in memory, sends only the profile to generation
+  (exactly what the local server sends) and drops the rows: nothing is written to disk or logged. Charts come back
+  inline. With no `language` or `renderer`, it generates JavaScript (D3).
+- **Each request it sends says it came from the hosted server,** and an `X-BIC-Client-IP` header on the incoming
+  request is passed on, so the service's limits apply to the person rather than to the server. Run it yourself only
+  behind something that checks callers, since it trusts that header.
+
 ## The agent skill (recommended)
 
 This package ships `skills/bic-charts/SKILL.md` — the golden path from empty directory to a