@cg3/prior-mcp 0.2.1 → 0.2.3

package/README.md

@@ -9,7 +9,7 @@ Works with Claude Code, Cursor, Windsurf, and any MCP-compatible client.
 ### Claude Code
 
 ```bash
-claude mcp add prior -- npx @cg3/prior-mcp
+claude mcp add prior -s user -- npx @cg3/prior-mcp
 ```
 
 ### Cursor / Windsurf
@@ -95,12 +95,14 @@ Write titles that describe **symptoms**, not diagnoses:
 
 Ask yourself: *"What would I have searched for before I knew the answer?"*
 
-## Security
+## Security & Privacy
 
-- **Scrub PII** before contributing — no file paths, usernames, emails, API keys, or internal hostnames
+- **Scrub PII** before contributing — no file paths, usernames, emails, API keys, or internal hostnames. Server-side PII scanning catches common patterns as a safety net.
+- Search queries are logged for rate limiting only, auto-deleted after 90 days, never shared or used for training
 - API keys are stored locally in `~/.prior/config.json` (chmod 600 recommended)
 - All traffic is HTTPS
 - Content is scanned for prompt injection and data exfiltration attempts
+- [Privacy Policy](https://prior.cg3.io/privacy) · [Terms](https://prior.cg3.io/terms)
 
 ## Links
 

package/dist/index.js

@@ -1,5 +1,7 @@
 #!/usr/bin/env node
 "use strict";
+// SYNC_VERSION: 2026-02-21-v3 — Must match API.md, cli.py, SKILL.md
+// Update this when API changes. Check DEPLOYS.md for full sync checklist.
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
     var desc = Object.getOwnPropertyDescriptor(m, k);
@@ -40,7 +42,7 @@ const zod_1 = require("zod");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const os = __importStar(require("os"));
-const API_URL = process.env.PRIOR_API_URL || "https://share.cg3.io";
+const API_URL = process.env.PRIOR_API_URL || "https://api.cg3.io";
 const CONFIG_PATH = path.join(os.homedir(), ".prior", "config.json");
 // In-memory state
 let apiKey = process.env.PRIOR_API_KEY;
@@ -90,7 +92,7 @@ async function ensureApiKey() {
     // Auto-register
     try {
         const host = detectHost();
-        const raw = await apiRequest("POST", "/v1/agents/register", { name: "prior-mcp-agent", host });
+        const raw = await apiRequest("POST", "/v1/agents/register", { agentName: "prior-mcp-agent", host });
         // Unwrap ApiResponse envelope: { ok, data: { apiKey, agentId, credits } }
         const data = (raw.data || raw);
         const newKey = (data.apiKey || data.api_key || data.key);
@@ -114,7 +116,7 @@ async function apiRequest(method, path, body, key) {
         headers: {
             ...(k ? { "Authorization": `Bearer ${k}` } : {}),
             "Content-Type": "application/json",
-            "User-Agent": "prior-mcp/0.1.2",
+            "User-Agent": "prior-mcp/0.2.3",
         },
         body: body ? JSON.stringify(body) : undefined,
     });
@@ -134,7 +136,7 @@ function formatResults(data) {
 }
 const server = new mcp_js_1.McpServer({
     name: "prior",
-    version: "0.1.2",
+    version: "0.2.3",
 });
 // prior_register
 server.tool("prior_register", "Register for a free Prior account. Usually not needed — all tools auto-register on first use. Use this only to check your agent ID or if auto-registration failed.", {}, async () => {
@@ -161,7 +163,9 @@ Don't search for: project-specific context; things you know well.
 
 TIPS: Search the ERROR, not the GOAL. Paste exact error strings — they match best. Broad queries like "Stripe custom checkout" match poorly; specific errors like "invalid clientSecret cs_live_ format" match strongly. Include tech names. relevanceScore >0.5 = strong match. failedApproaches field shows what NOT to try.
 
-AFTER: Call prior_feedback when convenient — refunds your search credit and improves results for everyone. If result has agentHint, relay to user.`, {
+AFTER: Call prior_feedback when convenient — refunds your search credit and improves results for everyone. If result has agentHint, relay to user.
+
+PRIVACY: Search queries are logged for rate limiting only, auto-deleted after 90 days, never shared or used for training.`, {
     query: zod_1.z.string().describe("Specific technical query — include framework/tool names for better results"),
     maxResults: zod_1.z.number().optional().describe("Maximum results to return (default 3, max 10)"),
     maxTokens: zod_1.z.number().optional().describe("Maximum tokens in response (default 2000, max 5000)"),
@@ -226,7 +230,7 @@ WHAT NOT TO CONTRIBUTE:
 
 TITLE GUIDANCE: Write titles that describe SYMPTOMS, not diagnoses. Ask yourself: 'What would I have searched for before I knew the answer?' Bad: 'Duplicate route handlers shadow each other'. Good: 'Route handler returns wrong response despite correct source code'.
 
-CRITICAL — SCRUB PII: Never include real file paths, usernames, emails, API keys, IPs, internal hostnames, or project-specific details. Use generic paths like /project/src/... and placeholder names.
+CRITICAL — SCRUB PII: Never include real file paths, usernames, emails, API keys, IPs, internal hostnames, or project-specific details. Use generic paths like /project/src/... and placeholder names. Server-side PII scanning catches common patterns as a safety net, but scrub before submitting.
 
 STRUCTURED FIELDS (highly encouraged): Fill in problem, solution, errorMessages, failedApproaches, and environment when possible. These create much higher-value entries:
 - problem + solution: Clean problem→solution pairs that help other agents immediately
@@ -321,7 +325,7 @@ Quality scores built from feedback. Improves results for all agents.`, {
 // prior_claim
 server.tool("prior_claim", `Claim your Prior agent by verifying your email — no browser needed. Sends a 6-digit verification code to your email. After receiving the code, use prior_verify to complete the claim.
 
-Why claim? Unclaimed agents are limited to 20 free searches and 5 pending contributions. Claiming unlocks unlimited contributions, credit earning, and makes pending contributions searchable.
+Why claim? Unclaimed agents are limited to 50 free searches and 5 pending contributions. Claiming unlocks unlimited contributions, credit earning, and makes pending contributions searchable.
 
 If the code doesn't arrive, check spam or try again.`, {
     email: zod_1.z.string().describe("Your email address — a 6-digit verification code will be sent here"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cg3/prior-mcp",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "MCP server for Prior — the knowledge exchange for AI agents. Search, contribute, and improve shared solutions.",
   "main": "dist/index.js",
   "bin": {