@chaindaddy/mcp 0.6.10 → 0.6.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chaindaddy/mcp",
-  "version": "0.6.10",
+  "version": "0.6.11",
   "description": "MCP server for Chain Daddy: search tickers, launch a token or verify ownership of one, and run its creator store",
   "mcpName": "io.chaindaddy/mcp",
   "homepage": "https://docs.chaindaddy.io/developer/store-and-rewards#tools-for-agents",

package/skills/sign-in-with-chain-daddy/SKILL.md

@@ -27,7 +27,7 @@ Use discovery: `https://api.chaindaddy.io/.well-known/openid-configuration`
 
 Any site can sign people in without registering anything.
 
-Replace `YOUR_SITE` with the site's host, such as `example.com`. Nothing is registered with Chain Daddy. The site must be public, on https, even while you build (a tunnel such as `cloudflared tunnel --url http://localhost:3000`, which needs no account, or a preview deployment): Chain Daddy's server fetches `client.json`, so `localhost` cannot be a client id.
+Replace `YOUR_SITE` with the site's host, such as `example.com`. Nothing is registered with Chain Daddy. The site must be public, on https: Chain Daddy's server fetches `client.json`, so `localhost` cannot be your own client id. To build on `http://localhost` first with nothing hosted, use the built-in development client: skip `client.json`, set the button's `client-id` to `chaindaddy-dev` and its `redirect-uri` to `http://localhost:3000/callback.html`, and set the server's `audience` to `'chaindaddy-dev'`. It asks every time, its `sub` matches no real site's, and it answers nothing about holdings or crowns, so put your own values back before you ship. To try your real `client.json` or a coin gate before the site is live, use a tunnel such as `cloudflared tunnel --url http://localhost:3000`, which needs no account, or a preview deployment.
 
 1. Host this at `https://YOUR_SITE/client.json` (served 200, no redirect; `client_id` must equal its own URL):
 
@@ -134,7 +134,7 @@ app.post('/session', async (req, res) => {
   }
   const id = randomUUID();
   sessions.set(id, { sub: payload.sub, wallet: payload.wallets?.[0], expires: Date.now() + DAY });
-  res.cookie('session', id, { httpOnly: true, secure: true, sameSite: 'lax', maxAge: DAY });
+  res.cookie('session', id, { httpOnly: true, secure: req.hostname !== 'localhost', sameSite: 'lax', maxAge: DAY });
   res.json({ ok: true });
 });