@blazium-games/skills 0.1.11 → 0.1.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blazium-games/skills",
-  "version": "0.1.11",
+  "version": "0.1.12",
   "description": "Agent skills for the Blazium Games platform.",
   "repository": "https://github.com/blazium-games/games_skill",
   "license": "MIT",

package/skills/blazium-games-get-started/references/auth.md

@@ -6,7 +6,7 @@ The server at `https://mcp.blazium.games/mcp` accepts OAuth 2.1 access tokens or
 
 - Discovery: `https://mcp.blazium.games/.well-known/oauth-protected-resource/mcp` and `/.well-known/oauth-authorization-server` (player server: the same paths ending in `/player`)
 - PKCE `S256` (verifier 43-128 characters), dynamic client registration, and client ID metadata documents are supported
-- Scopes: `mcp:read`, `mcp:write`, and the narrower `mcp:catalog.write`, `mcp:build.write`, `mcp:crash.read`, `mcp:analytics.read`, `mcp:keys.manage`, `mcp:money`
+- Scopes: `mcp:read`, `mcp:write`, and the narrower `mcp:catalog.write`, `mcp:build.write`, `mcp:crash.read`, `mcp:crash.write`, `mcp:analytics.read`, `mcp:bugs.read`, `mcp:bugs.write`, `mcp:steam.manage`, `mcp:keys.manage`, `mcp:money`, `mcp:anticheat`
 - Access tokens last 1 hour. Refresh tokens rotate on every use, so the client renews silently, but the sign-in still ends 30 days after it started
 - Each refresh token works once. Reusing a spent one revokes the whole sign-in; the user then reconnects
 - Details: https://docs.blazium.games/docs/mcp/oauth
@@ -17,7 +17,7 @@ On the consent page the user picks:
 |--------|--------|
 | Account | All games the user owns or admins, plus account tools |
 | Single project | Only that game. Account tools (`get_profile`, `get_setup`, `list_mcp_keys`, `request_mcp_key`, `create_game`, `get_account`, approvals, payments, `blazium-games://me`) and other games return `403` code `4030` |
-| Preset | **Store page**, **CI**, **Crash triage**, **Keys**, **Money**, or **Full access**. A tool outside the preset returns `4073` |
+| Preset | **Store page**, **CI**, **Crash triage**, **Keys**, **Money**, **Anticheat**, or **Full access**. A tool outside the preset returns `4073`. **Full access** does not include anticheat. **Anticheat** grants only `mcp:anticheat` |
 | Read-only access | Only `mcp:read` is granted. Any write returns `403` code `4031` "This token is read-only" |
 
 Revoke grants at https://blazium.games/settings/mcp.

package/skills/blazium-games-get-started/references/tools.md

@@ -8,6 +8,8 @@ All tools call the Blazium Games API on behalf of the connected user. `uid` acce
 | `get_setup` | none | account | Account, games, public URLs, and key prefixes. No secrets |
 | `list_games` | none | | Games the user owns or admins, plus pending admin invites |
 | `get_game` | `uid` | | One game's settings and store page fields |
+| `get_lobby` | `uid` | | Lobby settings and published packs: enabled, relay or scripted, TURN, the active checksum, and pack history |
+| `set_lobby` | `uid` (required), `enabled`, `lobby_type` (`relay` or `scripted`), `ice_enabled` | write | Only the fields you pass change |
 | `create_game` | `name` (required), `tagline`, `description`, `visibility`, `asset_type`, `vanity_name`, `adult`, `indexable`, `parent` | account, write | Create a store page. Tools, mods and plugins need a `parent` before they can go public. Needs developer mode on the account (`4105`) |
 | `update_game` | `uid` (required), `name`, `tagline`, `description`, `visibility`, `asset_type`, `adult`, `indexable`, `parent` | write | Update a store page; only passed fields change. An empty `parent` object clears it |
 | `get_game_analytics` | `uid`, optional `build` | | Visitor analytics plus registered funnel events: count, unique devices, and a daily series |
@@ -23,7 +25,7 @@ All tools call the Blazium Games API on behalf of the connected user. `uid` acce
 | `request_server_key` | `uid`, `role` | | Returns a game_server or private_server secret once |
 | `revoke_server_key` | `uid`, `key_id` | | Revokes one game server key |
 | `get_web_player` | `uid` | | Browser player settings, including the Discord application id and public key |
-| `set_web_player` | `uid` | `enabled`, `full_build_id`, `demo_build_id`, `discord_enabled`, `application_id`, `public_key` | Choose the full build, an optional demo, and Discord activity hosting. Hosting stays off unless `discord_enabled` is set, and it still requires the player to be on plus both values. Needs mcp:build.write |
+| `set_web_player` | `uid` | `enabled`, `full_build_id`, `demo_build_id`, `width`, `height`, `fullscreen`, `mobile`, `click_to_play`, `embed_enabled`, `embed_domains`, `discord_enabled`, `application_id`, `public_key` | Choose the full build, an optional demo, the player size and embed settings, and Discord activity hosting. Hosting stays off unless `discord_enabled` is set, and it still requires the player to be on plus both values. Needs mcp:build.write |
 | `list_game_crashes` | `uid` | | Recent crash reports |
 | `get_crash` | `uid`, `crash_id` | | One crash with metadata, analysis, and stack availability |
 | `request_crash_download` | `uid`, `crash_id`, `kind` (`dump`, `log`, or `stack`; default `dump`) | | Private download URL valid for 1 hour |
@@ -37,11 +39,18 @@ All tools call the Blazium Games API on behalf of the connected user. `uid` acce
 | `promote_build` | `uid`, `channel`, `build_id`, `expires_in_hours`, `idempotency_key` | write | Point a channel at a clean build. `stable` waits for the human's approval |
 | `rollback_channel` | `uid`, `channel` | write | Move a channel back to its previous build |
 | `list_crash_groups` | `uid` | | Up to 100 crash groups by cause, most recently seen first, with counts per build and a sample crash id |
+| `get_crash_reporter` / `set_crash_reporter` | `uid`, and for set: `enabled`, `webhooks`, `refresh_signing_key` | `mcp:crash.read` / `mcp:crash.write` | Per-game crash webhooks. The signing key is not the bug reporter key |
 | `get_build_provenance` | `uid`, `file_uid` | | Uploader, deploy key reference, upload time, checksum, and scan history of a file |
 | `list_reviews` | `uid`, `unreplied`, `page` | | Player reviews with the summary (enjoyed, quality average and counts, would play with friends) |
 | `reply_to_review` | `uid`, `review_uid`, `text` | write | Public reply to a review; empty text removes it |
 | `list_bug_tickets` | `uid`, `status` | | Player bug tickets with counts by status; attachments carry a `crash_id` |
-| `update_bug_ticket` | `uid`, `bug_uid`, `status` (`open`, `fixed`, `closed`) | write | Mark a ticket fixed or closed, or reopen it; covered by `mcp:crash.read` |
+| `update_bug_ticket` | `uid`, `bug_uid`, `status` (`open`, `fixed`, `closed`) | `mcp:bugs.write` | Mark a ticket fixed or closed, or reopen it |
+| `get_bug_reporter` / `set_bug_reporter` | `uid`, and for set: `enabled`, `daily_cap`, `webhooks`, `refresh_signing_key` | `mcp:bugs.read` / `mcp:bugs.write` | Per-game in-game reporter. The signing key is unique to the game |
+| `get_review_reporter` | `uid` | `mcp:read` | New-review webhooks: enabled, webhook URLs, and that game's signing key. The key is not the sale, crash, or bug reporter key |
+| `set_review_reporter` | `uid`, optional `enabled`, `webhooks`, `refresh_signing_key` | `mcp:catalog.write` | Turns new-review webhooks on, replaces up to five https URLs, or refreshes the signing key. An edit or a delete does not send |
+| `get_sale_reporter` | `uid` | `mcp:money` | Sale and refund webhooks: enabled, webhook URLs, and that game's signing key. The key is not the review, crash, or bug reporter key |
+| `set_sale_reporter` | `uid`, optional `enabled`, `webhooks`, `refresh_signing_key` | `mcp:money` | Turns sale and refund webhooks on, replaces up to five https URLs, or refreshes the signing key |
+| `get_steam_auth` / `set_steam_auth` | `uid`, and for set: `app_id`, `web_api_key`, `ticket_secret`, `enabled`, `confirm` | `mcp:steam.manage` | Write-only Web API key and ticket secret. Disable deletes both only when `confirm` is true |
 | `list_copyright_notices` | none | | Paid copyright (DMCA) notices about the account's content, with status and how many of its links each names |
 | `get_copyright_notice` | `uid` | | One notice: claimant, work, statements, the account's named links, staff messages, decision, and `reply_to`. Read only; the human replies by email with the reference in the subject |
 | `get_game_chat` | `uid` | | The game's IRC channel (`irc_channel`), whether guests may join (`chat_guests`), and who is banned or muted with when each mute ends |
@@ -177,3 +186,28 @@ Tool errors come back as `API <status>: <body>`. Common bodies:
 | `4234` | Invalid mod settings |
 | `4235` | Invalid press kit |
 | `4238` | Invalid store link: wrong site, not https, or a store listed twice |
+
+## Anticheat
+
+These tools need `mcp:anticheat`. `mcp:read`, `mcp:write`, and **Full access** do not include them. They are not on the player server. Reports, keys, and settings stay closed until staff record a signed NDA and a signed contract for that game. `request_anticheat` is the exception: the owner uses it to start that request. Do not describe how a check decides. Profiles are `generic`, `platformer`, and `fps`. Public description: [Anticheat](https://docs.blazium.games/docs/anticheat).
+
+| Tool | Inputs | Access | What it does |
+|------|--------|--------|--------------|
+| `request_anticheat` | `uid`, contact email, `confirm` | `mcp:anticheat` | Owner only. `confirm` must be true. Staff write to that email |
+| `get_anticheat` | `uid` | `mcp:anticheat` | Request status, then the profile and its settings after access is granted |
+| `update_anticheat` | `uid`, `profile`, settings for that profile | `mcp:anticheat` | Rejects a setting from the other profile. Shutting admins out is owner-only |
+| `list_anticheat_keys` | `uid` | `mcp:anticheat` | Names and prefixes. Never the secret |
+| `create_anticheat_key` | `uid`, name, `confirm` | `mcp:anticheat` | `confirm` must be true. Secret once, for the dedicated server only |
+| `rotate_anticheat_key` | `uid`, key id, `confirm` | `mcp:anticheat` | `confirm` must be true. New secret once |
+| `revoke_anticheat_key` | `uid`, key id, `confirm` | `mcp:anticheat` | `confirm` must be true |
+| `list_anticheat_events` | `uid`, optional origin | `mcp:anticheat` | Reports. Origin is the client or a server key's name |
+| `list_anticheat_bans` | `uid` | `mcp:anticheat` | Bans for that game |
+| `ban_anticheat_player` | `uid`, player | `mcp:anticheat` | Ban a player on that game |
+| `unban_anticheat_player` | `uid`, player | `mcp:anticheat` | Lift that ban |
+| `list_anticheat_mutes` | `uid` | `mcp:anticheat` | Mutes for that game |
+| `mute_anticheat_player` | `uid`, player | `mcp:anticheat` | Mute a player on that game |
+| `unmute_anticheat_player` | `uid`, player | `mcp:anticheat` | Lift that mute |
+| `list_anticheat_notes` | `uid` | `mcp:anticheat` | Notes the game's developers kept |
+| `add_anticheat_note` | `uid`, note | `mcp:anticheat` | Add a note |
+| `enqueue_anticheat_action` | `uid`, action, player id, `confirm` | `mcp:anticheat` | `confirm` must be true. Warn, mute, kick, ban, or a screenshot |
+| `list_anticheat_audit` | `uid` | `mcp:anticheat` | Who changed settings, keys, or actions |

package/skills/blazium-games-lobby-pack/SKILL.md

@@ -1,10 +1,13 @@
 ---
 name: blazium-games-lobby-pack
 description: Publish a Luau lobby pack with chauffeur and check it on the Scripted lobby tab.
+license: MIT
 ---
 
 # Lobby packs
 
+`chauffeur lobby set` turns the lobby on, chooses `relay` or `scripted`, and switches TURN. Pass at least one of `--enabled`, `--type`, or `--ice`.
+
 `chauffeur lobby publish --dir <path>` packs `.lua` files, refuses any other script, and uploads through the uploader. `chauffeur lobby list` and `chauffeur lobby status` show the stored packs and the checksum the next lobby loads. The game editor Scripted lobby tab shows the same history. The page does not upload the pack.
 
 A seated pack can call these on `lobby`. The host performs them. The pack never sees the host token.

package/skills/blazium-games-module/SKILL.md

@@ -1,8 +1,11 @@
 ---
 name: blazium-games-module
 description: Blazium engine games call the games module for login, scripted lobbies, and ICE.
+license: MIT
 ---
 
 # Blazium Games module
 
 Blazium games call the engine module. Official DLL auth stays in the launcher pipe. The other auth is the private login websocket at `wss://login.blazium.online/api/v1/connect` (`getid`, `getlogin`, JWT, then the socket closes). Lobby create and join, and ICE fetch, run only after that token exists.
+
+Inside a Discord activity, the module sends API, login, and lobby traffic through `{applicationId}.discordsays.com`. Unity and Unreal do not.

package/skills/blazium-games-player/SKILL.md

@@ -49,7 +49,8 @@ The player server acts for one player. It sees the account, wallet, and library,
 | Report a bug | `report_bug` with what happened and how to reproduce it. If they have a crash dump or log, set `include_dump` / `include_log` and upload the file with `PUT` to the returned URL |
 | "What are my friends playing?" | `games_friends_play`; live games come first, then the last 14 days |
 | Add or answer a friend | `send_friend_request` with the username they gave you, or `list_friends` then `respond_friend_request`. Only send requests the human asked for |
-| Use game chat in their own IRC client | `get_chat_token_status` for the client settings. Only if they ask for a token, `request_chat_token` with `confirm: true` and give it to them straight away; it can't be shown again, and replacing it disconnects clients using the old one. Username is their Blazium Games username, password is the token, SASL PLAIN on `irc.blazium.online:6697` with TLS, then `/quote GAMEJOIN <game uid>`. Chat follows https://blazium.games/chat-rules |
+| Use game chat in their own IRC client | `get_chat_token_status` for the client settings. Only if they ask for a token, `request_chat_token` with `confirm: true` and give it to them straight away; it can't be shown again, and replacing it disconnects clients using the old one. Username is their Blazium Games username, password is the token, SASL PLAIN on `irc.blazium.online:6697` with TLS, then `/quote GAMEJOIN <game uid>`. Clients without SASL send `GAMEAUTH <token>` before `NICK`/`USER`. Chat follows https://blazium.games/chat-rules. Guide: https://docs.blazium.games/docs/chat |
+| Read a game's chat without talking | After signing in, `LFGSUB <game uid>` spectates (no voice, up to 10 games); `LFGUNSUB <game uid>` leaves. Same access rules as joining |
 | Revoke a leaked chat token | `revoke_chat_token` with `confirm: true` when they ask |
 | Redeem a key or gift link | `redeem_key` with the code or link they gave you. `4084` means they already own it and the key is still unused |
 | Install a game they own or a free game | `why_should_i_trust_this` first. Pass its facts on, and do not call a file safe. Then `install_build` and give them the `blazium://install/<uid>` link. If it fails because the scan isn't clean, don't offer another way to download that file |

package/skills/blazium-games-player/references/tools.md

@@ -47,7 +47,7 @@ Server: `https://mcp.blazium.games/player`. Scopes: `player:read`, `player:write
 | `send_friend_request` | write | Send a request by username (20 per day, verified email). Accepts theirs if they already asked |
 | `respond_friend_request` | write | Accept or decline an incoming request |
 | `redeem_key` | write | Redeem a game key or gift link the human gave you; a game they already own leaves the key unused |
-| `get_chat_connection` | write | Sign in to game chat yourself: host, TLS port 6697, the browser websocket, and a SASL PLAIN token that works for 10 minutes. Then `GAMEJOIN <game uid>`. Chat follows https://blazium.games/chat-rules |
+| `get_chat_connection` | write | Sign in to game chat yourself: host, TLS port 6697, the browser websocket, and a SASL PLAIN token that works for 10 minutes. Then `GAMEJOIN <game uid>`, or `LFGSUB <game uid>` to read without talking. Commands and replies: https://docs.blazium.games/docs/chat/commands. Chat follows https://blazium.games/chat-rules |
 | `get_chat_token_status` | read | Whether the human has a chat token for IRC clients (prefix and times, never the token), whether the account is locked out of chat, and the client settings |
 | `request_chat_token` | write | Only when the human asks, with `confirm: true`: creates or replaces their IRC client chat token. It comes back once; hand it straight to the human. Replacing it disconnects clients using the old one. Up to 10 changes an hour (`4290`) |
 | `revoke_chat_token` | write | Only when the human asks, with `confirm: true`: revokes the chat token and disconnects clients using it |

package/skills/blazium-games-plugin/SKILL.md

@@ -1,8 +1,11 @@
 ---
 name: blazium-games-plugin
 description: Godot-based engines other than Blazium use the public games_plugin addon.
+license: MIT
 ---
 
 # games_plugin
 
 Other Godot engines vendor `addons/blazium_games/`. Auth is the login websocket only. The addon never loads the official DLL. After the JWT arrives, `BlaziumLobby` and `BlaziumIce` use that token. Set project setting `blazium/game/game_uid`.
+
+Inside a Discord activity, the addon sends API, login, and lobby traffic through `{applicationId}.discordsays.com`. Unity and Unreal do not.

package/skills/blazium-games-store-page/SKILL.md

@@ -30,6 +30,8 @@ Create and edit the public page at `https://<username>.blazium.games/<vanity_nam
    - `description`: markdown, two short paragraphs, facts only. Its first plain line is the share description when there is no tagline
 3. Confirm the copy with the user.
 
+If the game is already on Steam, the user can copy its store page instead at https://blazium.games/import/steam. That needs their Steamworks Web API key, so it is website-only: never ask for the key or accept it in chat. See https://docs.blazium.games/docs/steam-import
+
 ## 2. Create
 
 Call `create_game`:
@@ -93,6 +95,7 @@ Videos and changelogs are managed on the website or through builds (`blazium-gam
 - https://docs.blazium.games/docs/listings
 - https://docs.blazium.games/docs/content-rules
 - https://docs.blazium.games/docs/press-kit
+- https://docs.blazium.games/docs/steam-import
 - https://docs.blazium.games/docs/seo-and-indexing
 - https://docs.blazium.games/docs/developer-mode
 - https://docs.blazium.games/docs/mcp/reference