@bicharts/chart-mcp 0.6.74 → 0.6.75

package/README.md

@@ -138,7 +138,7 @@ Example (a semantic-model query result):
 **Nothing to configure.** The first call that needs an account opens your browser on the
 BIC sign-in page, waits for you, and then finishes the call it was making — no second
 command, no retry. No account yet? The page leads with **Create a free account**, and a
-new account starts a free trial. **A trial or paid BIC account is required — no freemium.**
+new account starts a free trial. **A trial or paid BIC account is required.**
 
 - The sign-in link is printed to the server's log before the browser opens (and sent as a
   log message to clients that show them), so on a machine where no browser opens you can
@@ -238,9 +238,6 @@ config), over putting secrets in a repo-committed `.mcp.json`. On a machine with
 browser, set `BIC_SIGNIN=off` too, so a missing key fails at once instead of waiting
 for a sign-in nobody can finish.
 
-Note: this package deliberately does NOT contain the freemium key-mint secret —
-consistent with trial/paid-only access, and safe if the folder is ever published.
-
 ### Credit charges
 
 Each `generate_chart` call spends credits on your account, exactly like the Power BI
@@ -258,20 +255,28 @@ That's the whole bill: a chart you've generated costs nothing to keep, run or sh
 
 ## Telemetry
 
-The server tells the BIC service three things, and nothing else:
+Beyond the requests your tool calls make, the server tells the BIC service two things, and nothing
+else:
 
-- **A usage counter** for each call of `list_eligible_charts` and `generate_chart` that reaches the
-  service: the tool's name, this server's client version and a random nonce. No data, no account,
-  no machine identity.
 - **One row when `generate_chart` returns code**, joined to the generation the service already
   logged (by its output hash) and marked as delivered through the MCP: the call's duration, the
   row count, the requested language and this server's build. It records that the code was handed
   over, never that anyone drew it.
 - **One row when a generation fails after the service answered**, carrying the service's own message.
 
+There's no usage counter: the service counts calls from the requests it receives.
 `assess_data_shape` never sends anything - it profiles your data locally, telemetry on or off.
 
-Set `BIC_MCP_TELEMETRY=0` in the server's environment to turn all of it off.
+Set `BIC_MCP_TELEMETRY=0` in the server's environment to turn both rows off.
+
+Three other things leave your machine, none of them telemetry:
+
+- **Signing in sends this computer's name** (its hostname), so the sign-in shows up on your account
+  page and you can sign that machine out on its own.
+- **`check_app` asks the npm registry** for the latest versions of the packages your app uses.
+  Pass `check_npm: false` to skip that.
+- **`preview.html` loads d3 and mermaid from cdn.jsdelivr.net** when you open it in a browser. It's
+  only written when you pass `preview_html: true`.
 
 ## Hosted server (`--http`)