@chaindaddy/mcp 0.6.10 → 0.6.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chaindaddy/mcp",
-  "version": "0.6.10",
+  "version": "0.6.12",
   "description": "MCP server for Chain Daddy: search tickers, launch a token or verify ownership of one, and run its creator store",
   "mcpName": "io.chaindaddy/mcp",
   "homepage": "https://docs.chaindaddy.io/developer/store-and-rewards#tools-for-agents",

package/skills/sign-in-with-chain-daddy/SKILL.md

@@ -27,7 +27,7 @@ Use discovery: `https://api.chaindaddy.io/.well-known/openid-configuration`
 
 Any site can sign people in without registering anything.
 
-Replace `YOUR_SITE` with the site's host, such as `example.com`. Nothing is registered with Chain Daddy. The site must be public, on https, even while you build (a tunnel such as `cloudflared tunnel --url http://localhost:3000`, which needs no account, or a preview deployment): Chain Daddy's server fetches `client.json`, so `localhost` cannot be a client id.
+Replace `YOUR_SITE` with the site's host, such as `example.com`. Nothing is registered with Chain Daddy. **Start on `http://localhost` with nothing hosted**, using the built-in development client: skip `client.json` (step 1), set the button's `client-id` to `chaindaddy-dev` and its `redirect-uri` to `http://localhost:3000/callback.html`, and set the server's `audience` to `'chaindaddy-dev'`. `GET https://api.chaindaddy.io/api/v2/oauth/snippet?origin=http://localhost:3000` (the `get_sign_in_snippet` tool) returns those three pieces filled in. The development client asks every time, its `sub` matches no real site's, and it answers nothing about holdings or crowns, so a holders-only route refuses everyone there; put your own values back before you ship. The live site must be public, on https: Chain Daddy's server fetches `client.json`, so `localhost` cannot be your own client id. To try your real `client.json` or a coin gate before the site is live, use a tunnel such as `cloudflared tunnel --url http://localhost:3000`, which needs no account, or a preview deployment.
 
 1. Host this at `https://YOUR_SITE/client.json` (served 200, no redirect; `client_id` must equal its own URL):
 
@@ -134,7 +134,7 @@ app.post('/session', async (req, res) => {
   }
   const id = randomUUID();
   sessions.set(id, { sub: payload.sub, wallet: payload.wallets?.[0], expires: Date.now() + DAY });
-  res.cookie('session', id, { httpOnly: true, secure: true, sameSite: 'lax', maxAge: DAY });
+  res.cookie('session', id, { httpOnly: true, secure: req.hostname !== 'localhost', sameSite: 'lax', maxAge: DAY });
   res.json({ ok: true });
 });
 
@@ -185,8 +185,8 @@ The token address is `tokenAddress` in `GET https://api.chaindaddy.io/api/v2/pub
 
 ## 1b. Or register a client (the human does this)
 
-Only needed for a **server client with a secret**, the consent screen's **Verified** mark for a coin's own
-site, or `http://localhost` redirects during development. Needs Developer Beta Program membership (any paid
+Only needed for a **server client with a secret** or the consent screen's **Verified** mark for a coin's own
+site. Trying sign-in on `http://localhost` needs no registration (the development client above). Needs Developer Beta Program membership (any paid
 plan and the signed agreement; a client costs nothing more). Easiest: the developer portal,
 https://chaindaddy.io/_developer → **Sign-in** → **New client**. Or: