@casys/mcp-erpnext 3.1.0-beta.4 → 3.1.0-beta.6

package/README.md

@@ -6,15 +6,17 @@ English | [繁體中文](README.zh-TW.md)
 [![npm](https://img.shields.io/npm/v/@casys/mcp-erpnext?logo=npm&color=cb3837)](https://www.npmjs.com/package/@casys/mcp-erpnext)
 [![CI](https://github.com/Casys-AI/mcp-erpnext/actions/workflows/test.yml/badge.svg)](https://github.com/Casys-AI/mcp-erpnext/actions/workflows/test.yml)
 [![MCP](https://img.shields.io/badge/MCP-server-1f6feb?logo=modelcontextprotocol&logoColor=white)](https://modelcontextprotocol.io)
+[![M8ven Score](https://m8ven.ai/badge/mcp/casys-ai-mcp-erpnext-1kev4k)](https://m8ven.ai/mcp/casys-ai-mcp-erpnext-1kev4k)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 
 > [!IMPORTANT]
-> **Installing the 3.1 beta:** pin the prerelease while this UX is being
-> validated. For npm/Node use `npx -y @casys/mcp-erpnext@3.1.0-beta.3`; for Deno
-> use `deno run -A jsr:@casys/mcp-erpnext@3.1.0-beta.3/server`. The moving npm
-> alias is `@next`. The beta adds the generic document viewer and attachment
-> workflows, so test it with the MCP host your users actually run before
-> replacing a stable deployment.
+> **Installing the 3.1 beta:** for npm/Node use
+> `npx -y @casys/mcp-erpnext@next`; for Deno use
+> `deno run -A jsr:@casys/mcp-erpnext@^3.1.0-beta/server`. Both follow the
+> current prerelease — JSR has no dist-tags, hence the range there. Exact
+> versions are in the [CHANGELOG](CHANGELOG.md). The beta adds the generic
+> document viewer and attachment workflows, so test it with the MCP host your
+> users actually run before replacing a stable deployment.
 
 Let any MCP-compatible AI agent operate your [ERPNext](https://erpnext.com) /
 Frappe instance — documents, workflows, and interactive viewers inside the host
@@ -266,9 +268,9 @@ Quotation, which retain the specialized invoice surface.
 - **Manufacturing** — BOMs, Work Orders, and Job Cards.
 - **CRM** — Leads, Opportunities, Contacts, and Campaigns.
 - **Assets** — Assets, Movements, Maintenance records, and Categories.
-- **Operations** — Generic CRUD, native assignment, and attachment listing,
-  upload, or host-mediated download for any DocType (`erpnext_doc_*`,
-  `erpnext_file_*`).
+- **Operations** — Generic CRUD, native assignment, attachment listing, upload,
+  host-mediated download, and deny-by-default Frappe method calls
+  (`erpnext_doc_*`, `erpnext_file_*`, `erpnext_method_call`).
 - **Kanban** — Read-write boards for Task, Opportunity, and Issue with
   drag-and-drop.
 - **Analytics** — Charts (bar, area, treemap, radar, scatter, P&L…), KPIs with
@@ -286,6 +288,7 @@ Full per-tool reference with parameters: [`docs/tools.md`](docs/tools.md).
 | `ERPNEXT_API_SECRET`         | Yes      | API Secret from User Settings                                                                                                    |
 | `ERPNEXT_MAX_UPLOAD_BYTES`   | No       | Maximum decoded file-upload size in bytes (positive integer; default: 10 MiB)                                                    |
 | `ERPNEXT_MAX_DOWNLOAD_BYTES` | No       | Maximum attachment-download size in bytes (positive integer; default: 10 MiB)                                                    |
+| `ERPNEXT_METHOD_ALLOWLIST`   | No       | Comma-separated exact method paths or `prefix.*`; unset means `erpnext_method_call` denies every method, while `*` allows all    |
 | `MCP_MRTR_SIGNING_KEY`       | No       | Exactly 64 lowercase hex characters; enables signed ambiguous-link elicitation. **Single-instance deployments only** — see below |
 
 MRTR is opt-in. Without this key, or when the client does not advertise