@checkbox-site/mcp 0.2.2 → 0.2.4

package/dist/key-file.d.ts

@@ -17,5 +17,18 @@ export declare const ENV_FILE = ".env.local";
 export declare const FALLBACK_FILE = ".checkbox/keys.env";
 /** Writes the issued keys to the project's git-ignored env file. Never throws. */
 export declare function saveKeysToProject(root: string, keys: KeysToSave): SavedKeys;
+/**
+ * The value of NAME in a dotenv-style text: `NAME=value`, `export NAME=value`, quoted or not, with an optional trailing
+ * comment; the last assignment wins, as in dotenv loaders.
+ *
+ * Round 29 (pilot 28 item 10, security-reviewer): the reader only accepted [A-Za-z0-9_], but keys are base64url
+ * (packages/db/src/repos/api-v1.ts newKeyString), so about half contain "-". Those keys were saved and then never read
+ * back: each restart of checkbox-mcp started without a key and asked for a new device login.
+ */
+export declare function readEnvValue(text: string, name: string): string | undefined;
+/** Every key an earlier device login saved in this folder (.env.local, then .checkbox/keys.env), per variable. */
+export declare function readSavedKeys(root: string): Partial<KeysToSave> & {
+    file?: string;
+};
 /** The CHECKBOX_SECRET_KEY saved by an earlier device login in this folder (.env.local, then .checkbox/keys.env). */
 export declare function readSavedKey(root: string): string | undefined;

package/dist/key-file.js

@@ -42,9 +42,10 @@ function upsertLines(existing, entries, header) {
     let text = existing ?? '';
     const missing = [];
     for (const [k, v] of entries) {
-        const re = new RegExp(`^${k}=.*$`, 'm');
+        const re = new RegExp(`^[ \\t]*(?:export[ \\t]+)?${k}[ \\t]*=.*$`, 'gm');
+        // A function replacement: a value is never read as a "$&" pattern. Every earlier assignment gets the new value.
         if (re.test(text))
-            text = text.replace(re, `${k}=${v}`);
+            text = text.replace(re, () => `${k}=${v}`);
         else
             missing.push([k, v]);
     }
@@ -106,13 +107,45 @@ export function saveKeysToProject(root, keys) {
         return { ok: false, error: err instanceof Error ? err.message : String(err) };
     }
 }
-/** The CHECKBOX_SECRET_KEY saved by an earlier device login in this folder (.env.local, then .checkbox/keys.env). */
-export function readSavedKey(root) {
+/**
+ * The value of NAME in a dotenv-style text: `NAME=value`, `export NAME=value`, quoted or not, with an optional trailing
+ * comment; the last assignment wins, as in dotenv loaders.
+ *
+ * Round 29 (pilot 28 item 10, security-reviewer): the reader only accepted [A-Za-z0-9_], but keys are base64url
+ * (packages/db/src/repos/api-v1.ts newKeyString), so about half contain "-". Those keys were saved and then never read
+ * back: each restart of checkbox-mcp started without a key and asked for a new device login.
+ */
+export function readEnvValue(text, name) {
+    const re = new RegExp(`^[ \\t]*(?:export[ \\t]+)?${name}[ \\t]*=[ \\t]*(?:"([^"\\r\\n]*)"|'([^'\\r\\n]*)'|([^\\s#]*))[ \\t]*(?:#.*)?$`, 'gm');
+    let found;
+    for (let m = re.exec(text); m; m = re.exec(text))
+        found = (m[1] ?? m[2] ?? m[3] ?? '').trim();
+    return found || undefined;
+}
+/** Every key an earlier device login saved in this folder (.env.local, then .checkbox/keys.env), per variable. */
+export function readSavedKeys(root) {
     for (const file of [ENV_FILE, FALLBACK_FILE]) {
         const text = read(join(root, file));
-        const m = text ? /^CHECKBOX_SECRET_KEY=["']?([A-Za-z0-9_]+)["']?\s*$/m.exec(text) : null;
-        if (m?.[1])
-            return m[1];
+        if (!text)
+            continue;
+        const secret = readEnvValue(text, 'CHECKBOX_SECRET_KEY');
+        if (!secret)
+            continue;
+        const out = { secret_key: secret, file };
+        const pk = readEnvValue(text, 'CHECKBOX_PUBLISHABLE_KEY');
+        const live = readEnvValue(text, 'CHECKBOX_LIVE_SECRET_KEY');
+        const livePk = readEnvValue(text, 'CHECKBOX_LIVE_PUBLISHABLE_KEY');
+        if (pk)
+            out.publishable_key = pk;
+        if (live)
+            out.live_secret_key = live;
+        if (livePk)
+            out.live_publishable_key = livePk;
+        return out;
     }
-    return undefined;
+    return {};
+}
+/** The CHECKBOX_SECRET_KEY saved by an earlier device login in this folder (.env.local, then .checkbox/keys.env). */
+export function readSavedKey(root) {
+    return readSavedKeys(root).secret_key;
 }

package/dist/server.d.ts

@@ -5,7 +5,7 @@ import type { KeyContext } from './permissions.ts';
 import { type IssuedKeys, type ToolContext, type ToolDef } from './tools.ts';
 export declare const SERVER_NAME = "checkbox";
 /** Kept equal to packages/mcp/package.json "version" (@checkbox-site/mcp); mcp.test.ts checks it. */
-export declare const SERVER_VERSION = "0.2.2";
+export declare const SERVER_VERSION = "0.2.4";
 export declare const DEFAULT_MCP_URL = "https://app.checkbox.site/mcp";
 /** The coverage phrase used across Checkbox (the API docs tests check the count against the rules catalog). */
 export declare const COVERAGE_PHRASE = "federal law, 27 states, DC and New York City";

package/dist/server.js

@@ -9,7 +9,7 @@ import { likelyMisspelling, unknownArgumentsMessage, unknownKeysParams } from ".
 import { outdatedNotice } from "./version-check.js";
 export const SERVER_NAME = 'checkbox';
 /** Kept equal to packages/mcp/package.json "version" (@checkbox-site/mcp); mcp.test.ts checks it. */
-export const SERVER_VERSION = '0.2.2';
+export const SERVER_VERSION = '0.2.4';
 export const DEFAULT_MCP_URL = 'https://app.checkbox.site/mcp';
 /** The coverage phrase used across Checkbox (the API docs tests check the count against the rules catalog). */
 export const COVERAGE_PHRASE = 'federal law, 27 states, DC and New York City';

package/dist/stdio.d.ts

@@ -22,6 +22,15 @@ export declare function buildApi(cfg: {
 }, f?: typeof fetch): Promise<CheckboxApi>;
 /** Confirms the key and learns its mode / permissions (retrieveAccount). Falls back to the key prefix. */
 export declare function describeKey(api: CheckboxApi, apiKey: string | undefined, readOnly: boolean): Promise<KeyContext>;
+/**
+ * The key this server starts with: the configured one (flag / env), else the one an earlier device login saved in this
+ * project. Round 29 (pilot 28 item 18): a rejected configured key falls back to the project's saved key before the
+ * server starts without a key (which sends the agent to device login).
+ */
+export declare function startupKey(cfg: ResolvedConfig, cwd: string, log: (line: string) => void, f?: typeof fetch): Promise<{
+    api: CheckboxApi;
+    key: KeyContext;
+}>;
 /** Round 27 (pilot 26 item 22): the stderr note when --read-only is on but the key itself can still write. */
 export declare function readOnlyNote(readOnly: boolean, key: KeyContext): string | null;
 export declare function runStdio(opts?: StdioOptions): Promise<void>;

package/dist/stdio.js

@@ -62,6 +62,49 @@ export async function describeKey(api, apiKey, readOnly) {
         return base; // restricted key without account:read, or the API is unreachable right now
     }
 }
+/**
+ * The key this server starts with: the configured one (flag / env), else the one an earlier device login saved in this
+ * project. Round 29 (pilot 28 item 18): a rejected configured key falls back to the project's saved key before the
+ * server starts without a key (which sends the agent to device login).
+ */
+export async function startupKey(cfg, cwd, log, f) {
+    // Round 25 (pilot 24 item 12): a key an earlier device login saved in this folder (never shown in the transcript).
+    if (!cfg.apiKey) {
+        const saved = readSavedKey(cwd);
+        if (saved)
+            cfg.apiKey = saved;
+    }
+    let api = await buildApi(cfg, f);
+    let key;
+    try {
+        key = await describeKey(api, cfg.apiKey, cfg.readOnly);
+    }
+    catch (err) {
+        // Round 29 (pilot 28 item 18): a rejected configured key falls back to the key saved in this project before any
+        // device login.
+        const saved = readSavedKey(cwd);
+        let adopted;
+        if (saved && saved !== cfg.apiKey) {
+            try {
+                const savedApi = await buildApi({ ...cfg, apiKey: saved }, f);
+                adopted = await describeKey(savedApi, saved, cfg.readOnly);
+                api = savedApi;
+                cfg.apiKey = saved;
+                log(`checkbox-mcp: the configured API key was rejected (${err.message}); using the key saved in this project instead.`);
+            }
+            catch {
+                adopted = undefined;
+            }
+        }
+        if (adopted)
+            key = adopted;
+        else {
+            log(`checkbox-mcp: the API key was rejected (${err.message}). Starting without a key: use setup_checkbox to get a new one.`);
+            key = keyContextFromPrefix(undefined, cfg.readOnly);
+        }
+    }
+    return { api, key };
+}
 /** Round 27 (pilot 26 item 22): the stderr note when --read-only is on but the key itself can still write. */
 export function readOnlyNote(readOnly, key) {
     if (!readOnly || !key.authenticated || key.kind !== 'secret' || key.role === 'viewer')
@@ -84,21 +127,7 @@ export async function runStdio(opts = {}) {
     }
     const cfg = resolveConfig(env, argv);
     const cwd = opts.cwd ?? process.cwd();
-    // Round 25 (pilot 24 item 12): a key an earlier device login saved in this folder (never shown in the transcript).
-    if (!cfg.apiKey) {
-        const saved = readSavedKey(cwd);
-        if (saved)
-            cfg.apiKey = saved;
-    }
-    const api = await buildApi(cfg, opts.fetch);
-    let key;
-    try {
-        key = await describeKey(api, cfg.apiKey, cfg.readOnly);
-    }
-    catch (err) {
-        log(`checkbox-mcp: the API key was rejected (${err.message}). Starting without a key: use setup_checkbox to get a new one.`);
-        key = keyContextFromPrefix(undefined, cfg.readOnly);
-    }
+    const { api, key } = await startupKey(cfg, cwd, log, opts.fetch);
     // Round 27 (pilot 26 item 22, security-reviewer): --read-only only hides tools in this server. Say so when the key can
     // still write, so nobody mistakes it for a limit on the key.
     const note = readOnlyNote(cfg.readOnly, key);

package/dist/tools.d.ts

@@ -242,6 +242,14 @@ export declare function shopifyLines(sh: SiteShopifyLite | null | undefined, sit
  * each with its full summary). Each update keeps its first changes in short form, with the total.
  */
 export declare function lawUpdateItem(u: Record<string, unknown>): Record<string, unknown>;
+/**
+ * Round 29 (pilot 28 item 25): next_actions name an operation_id, but call_api only took method + path, so agents
+ * looked the path up in openapi.json. call_api now also takes { operation_id, path_params } and fills in both.
+ */
+export declare function resolveCallApiTarget(args: Record<string, unknown>): {
+    method: 'GET' | 'POST' | 'DELETE';
+    path: string;
+};
 /** Every tool, in the order clients list them. */
 /**
  * Round 12 (pilot 11, nextjs + agent users): setup_checkbox dropped unknown fields silently; the homepage prompt says

package/dist/tools.js

@@ -7,6 +7,7 @@ import { planTodo, todoLine } from "./todo.js";
 import { CheckboxApiError } from "./api.js";
 import { ciHint, nextActionOf, untrusted } from "./format.js";
 import { keyAllows } from "./permissions.js";
+import { OPERATIONS } from '@checkbox-site/node';
 /** A failure the tool explains itself (not an API error): rendered as an error result with a next step. */
 export class ToolError extends Error {
     next;
@@ -728,7 +729,7 @@ const getSetupStatus = {
             const pl = sitePlansNote(res.setup_session?.site_plans);
             if (pl)
                 notes.push(pl);
-            return { headline: `Re-checked setup session ${id}.`, ...(notes.length ? { notes } : {}), data: withoutLegacyScore(res), next: nextActionOf(res) ?? nextActionOf(res.session) };
+            return { headline: `Re-checked setup session ${id}.`, ...(notes.length ? { notes } : {}), data: withoutLegacyScore(res), next: nextActionOf(res) ?? nextActionOf(res.setup_session) ?? nextActionOf(res.session) };
         }
         const session = await api.request('GET', `/v1/setup_sessions/${enc(id)}`);
         const open = (session.steps ?? []).filter((s) => s.status && !['done', 'skipped', 'not_applicable'].includes(s.status));
@@ -753,7 +754,7 @@ const updateSetup = {
     input: {
         setup_session: z.string().max(100).optional().describe('Setup session id (setup_…). Default: the newest one.'),
         ...setupFactsShape,
-        snippet_installed_in: z.string().max(500).optional().describe('File you added the Checkbox snippet tag to, e.g. "app/layout.tsx".'),
+        snippet_installed_in: z.union([z.string().max(500), z.array(z.string().max(300)).max(20)]).optional().describe('File(s) you added the Checkbox snippet tag to, e.g. "app/layout.tsx".'),
         env_written: z.string().max(500).optional().describe('File you wrote the keys to, e.g. ".env.local".'),
         live_site: z.string().max(100).optional().describe('Live-mode site id (site_…) if you created one with a live key.'),
         refetch_policies: z.boolean().optional().describe('Fetch the policy pages again even if their URLs did not change (after editing them).'),
@@ -763,6 +764,15 @@ const updateSetup = {
     async run(args, { api }) {
         const id = await resolveSetupSession(api, args.setup_session);
         const body = pick(args, [...Object.keys(setupFactsShape), 'snippet_installed_in', 'env_written', 'live_site', 'refetch_policies']);
+        // Round 29 (pilot 28 item 25, sveltekit-cursor): a snippet in several files was refused as an array; the API keeps one
+        // string, so a list is sent as "a, b".
+        if (Array.isArray(body.snippet_installed_in)) {
+            const files = body.snippet_installed_in.map((f) => f.trim()).filter(Boolean);
+            if (files.length)
+                body.snippet_installed_in = files.join(', ').slice(0, 500);
+            else
+                delete body.snippet_installed_in;
+        }
         const session = await api.request('POST', `/v1/setup_sessions/${enc(id)}`, { body });
         // Round 20 (pilot 19 item 6): a plans change re-evaluates the site; say where the new plan's tasks show up.
         const notes = Array.isArray(args.plans) && args.plans.length
@@ -963,7 +973,7 @@ const verifyTask = {
             .describe('Email tasks: the new template (passes when it matches one plan fully).'),
         plan: z.string().min(1).max(200).optional().describe('Email tasks: only this plan (name).'),
         price_id: z.string().min(1).max(200).optional().describe('Email tasks: only this plan (Price id).'),
-        recheck: z.boolean().optional().describe('true re-checks a task that is already done (evaluates again now and queues a scan) instead of returning its last result.'),
+        recheck: z.boolean().optional().describe('Not needed: a done task is always re-checked now; one closed with nothing observed passing is not_checked.'),
         wait,
     },
     scopes: ['compliance_plans:write'],
@@ -1107,8 +1117,9 @@ const startTestRun = {
     description: [
         'Observes the WHOLE subscription lifecycle, not just the checkout: in the billing platform\'s TEST mode Checkbox subscribes a test customer (card 4242…) whose email is a Checkbox inbox, waits for your acknowledgment email, fast-forwards a Stripe test clock through every legal notice window before trial end and renewal (collecting reminder emails), then cancels online and waits for the cancellation confirmation. Nothing is charged.',
         'Needs a Stripe TEST-mode restricted key (rk_test_…) stored for the site: store it yourself with store_stripe_test_key (one key for checks, fixes and test runs; live keys stay with the human in the dashboard). Never ask the human to paste a key into the chat. If missing, the error\'s next_action says so. For non-Stripe sites use type "generic".',
-        'Usually 2-4 minutes: poll get_test_run (its next_action says when). Each step reports observations, check results and agent-readable fixes; apply them and run again.',
+        'Usually 1-2 minutes (real_checkout: a few): poll get_test_run (its next_action says when, and minutes_left estimates the rest). Each step reports observations, check results and agent-readable fixes; apply them and run again.',
         'mode "real_checkout" is the PROOF run: the shopper buys through the merchant\'s own checkout on its test deployment (stripe.checkout_url or stripe.payment_link), so the merchant\'s webhook handlers and email code fire; give stripe.test_account + stripe.cancel_url when customers cancel in the app. A step is "passed" only with evidence; "warning" means needs review.',
+        'Cancel: stripe.cancel_via "stripe_portal" (default) or "merchant_flow" (cancel_url + cancel_steps; behind a login, test_account { login_url, email, password }).',
     ].join('\n'),
     input: {
         site: siteId.optional(),
@@ -1247,7 +1258,7 @@ const checkStripeCheckoutSession = {
     name: 'check_stripe_checkout_session',
     title: 'Check Stripe Checkout Session params (returns corrected params)',
     description: [
-        'Before shipping Stripe Checkout code: pass EXACTLY the object your code passes to stripe.checkout.sessions.create (mode "subscription"). Checkbox evaluates it against automatic-renewal laws and returns correction.corrected_params — the full params with the fix applied, ready to paste — plus an RFC 6902 JSON patch and before/after verification per check.',
+        'Before shipping Stripe Checkout code: pass, as params, EXACTLY the object your code passes to stripe.checkout.sessions.create (mode "subscription"). Checkbox evaluates it against automatic-renewal laws and returns correction.corrected_params — the full params with the fix applied, ready to paste — plus an RFC 6902 JSON patch and before/after verification per check.',
         'With a Price id (price_…) in line_items, pass site (its plans are used) or merchant { price, interval, trial_days, merchant_name, cancel_url }.',
         'Note: Stripe styles custom_text itself, so "clear and conspicuous" stays needs_review here; the plan shows it as a note, never a fix.',
     ].join('\n'),
@@ -2231,26 +2242,59 @@ const getNoticeTemplates = {
 // ---------------------------------------------------------------------------------------------------------------------
 // Escape hatch
 // ---------------------------------------------------------------------------------------------------------------------
+/**
+ * Round 29 (pilot 28 item 25): next_actions name an operation_id, but call_api only took method + path, so agents
+ * looked the path up in openapi.json. call_api now also takes { operation_id, path_params } and fills in both.
+ */
+export function resolveCallApiTarget(args) {
+    const opId = typeof args.operation_id === 'string' ? args.operation_id.trim() : '';
+    if (!opId) {
+        if (typeof args.path !== 'string' || !args.method)
+            throw new ToolError('Give method and path, or operation_id (with path_params for the ids in its path).');
+        return { method: args.method, path: args.path };
+    }
+    const ops = OPERATIONS;
+    const op = Object.prototype.hasOwnProperty.call(ops, opId) ? ops[opId] : undefined;
+    if (!op) {
+        const lower = opId.toLowerCase();
+        const close = Object.keys(ops).filter((k) => k.toLowerCase().includes(lower) || lower.includes(k.toLowerCase())).slice(0, 5);
+        throw new ToolError(`Unknown operation_id "${opId}".${close.length ? ` Did you mean ${close.join(', ')}?` : ''} Operation ids are in https://app.checkbox.site/v1/openapi.json.`);
+    }
+    if (args.method && args.method !== op.httpMethod)
+        throw new ToolError(`${opId} is ${op.httpMethod} ${op.path}, not ${String(args.method)}: leave method out.`);
+    const given = (args.path_params && typeof args.path_params === 'object' ? args.path_params : {});
+    const missing = op.pathParams.filter((p) => typeof given[p] !== 'string' || !given[p].trim());
+    if (missing.length)
+        throw new ToolError(`${opId} (${op.httpMethod} ${op.path}) needs path_params ${missing.map((m) => `"${m}"`).join(', ')}, e.g. {"path_params":{${op.pathParams.map((p) => `"${p}":"…"`).join(',')}}}.`);
+    const extra = Object.keys(given).filter((k) => !op.pathParams.includes(k));
+    if (extra.length)
+        throw new ToolError(`${opId} (${op.httpMethod} ${op.path}) has no path parameter ${extra.join(', ')}${op.pathParams.length ? `; it takes ${op.pathParams.join(', ')}` : ''}. Put other fields in body or query.`);
+    const path = op.path.replace(/\{([A-Za-z0-9_]+)\}/g, (_m, name) => encodeURIComponent(String(given[name]).trim()));
+    if (typeof args.path === 'string' && args.path && args.path !== path)
+        throw new ToolError(`operation_id ${opId} gives the path ${path}, but path is ${args.path}: give one of them.`);
+    return { method: op.httpMethod, path };
+}
 const callApi = {
     name: 'call_api',
     title: 'Call any Checkbox API endpoint',
     description: [
         'For a next_action whose operation has no dedicated tool (e.g. createStripeCheckoutConfig, updateTask, updateNoticeSettings, listConsents). Calls the Checkbox /v1 API with this server\'s connection; paths and bodies are in https://app.checkbox.site/v1/openapi.json.',
-        'Examples: {"method":"GET","path":"/v1/account"} ; {"method":"POST","path":"/v1/sites/site_123/domain_verification/check"}.',
+        'Examples: {"method":"GET","path":"/v1/account"} ; {"method":"POST","path":"/v1/sites/site_123/domain_verification/check"} ; {"operation_id":"createStripeCheckoutConfig","path_params":{"site":"site_123"},"body":{…}}.',
         'Never send API keys or Stripe keys through it, except a Stripe TEST restricted key via store_stripe_test_key (not call_api). Live keys are added by the human in the Checkbox dashboard, never pasted into the chat.',
         'GET is read-only. POST/DELETE change data: only do what the user or a next_action asked for. DELETE archives or removes objects — confirm with the user first.',
     ].join('\n'),
     input: {
-        method: z.enum(['GET', 'POST', 'DELETE']).describe('HTTP method.'),
-        path: z.string().max(500).describe('Path starting with /v1/, e.g. "/v1/sites/site_123/domain_verification/check".'),
+        method: z.enum(['GET', 'POST', 'DELETE']).optional().describe('HTTP method (not needed with operation_id).'),
+        path: z.string().max(500).optional().describe('Path starting with /v1/, e.g. "/v1/sites/site_123/domain_verification/check". Give this or operation_id.'),
+        operation_id: z.string().max(100).optional().describe('Instead of method + path: a next_action\'s operation_id.'),
+        path_params: z.record(z.string(), z.string().max(200)).optional().describe('With operation_id: ids in its path, e.g. {"site":"site_123"}.'),
         query: z.record(z.string(), z.union([z.string(), z.number(), z.boolean()])).optional().describe('Query parameters.'),
         body: z.record(z.string(), z.unknown()).optional().describe('JSON body (POST).'),
     },
     scopes: [],
     annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true, title: 'Call API' },
     async run(args, { api, key }) {
-        const method = args.method;
-        const path = String(args.path);
+        const { method, path } = resolveCallApiTarget(args);
         if (!/^\/v1\/[A-Za-z0-9_\-./{}]*$/.test(path) || path.includes('..') || /[{}]/.test(path)) {
             throw new ToolError('path must be a concrete /v1/… path (fill in ids; no {placeholders}, query strings or "..").');
         }

package/package.json

@@ -1,16 +1,26 @@
 {
   "name": "@checkbox-site/mcp",
-  "version": "0.2.2",
-  "description": "Checkbox MCP server: subscription-law compliance tools for AI agents (remote at https://app.checkbox.site/mcp, or local stdio).",
+  "version": "0.2.4",
+  "description": "Checkbox MCP server: auto-renewal law and subscription compliance checks for AI agents (FTC ROSCA, California ARL, New York and other states) on Stripe Checkout params, pricing pages, disclosures and emails. Remote at https://app.checkbox.site/mcp, or local stdio.",
   "keywords": [
+    "checkbox",
+    "mcp",
+    "mcp-server",
+    "model-context-protocol",
+    "ai-agent",
+    "stripe",
+    "stripe-checkout",
     "subscription",
     "subscription-compliance",
     "auto-renewal",
-    "autorenewal",
     "automatic-renewal",
     "compliance",
     "rosca",
     "click-to-cancel",
+    "ci",
+    "subscription compliance",
+    "auto renewal",
+    "autorenewal",
     "california-arl",
     "auto-renewal-law",
     "auto-renewal-compliance",
@@ -19,14 +29,8 @@
     "stripe-subscriptions",
     "ftc",
     "negative-option",
-    "stripe",
-    "stripe-checkout",
     "checkout",
-    "cancellation",
-    "mcp",
-    "model-context-protocol",
-    "mcp-server",
-    "ai-agent"
+    "cancellation"
   ],
   "mcpName": "site.checkbox/checkbox",
   "license": "MIT",
@@ -73,7 +77,7 @@
     "prepack": "npm run build"
   },
   "dependencies": {
-    "@checkbox-site/node": "^0.2.2",
+    "@checkbox-site/node": "^0.2.4",
     "@modelcontextprotocol/sdk": "^1.32.2",
     "zod": "^4.6.7"
   }