@checkbox-site/mcp 0.2.7 → 0.2.9

package/dist/format.d.ts

@@ -47,13 +47,18 @@ export interface ToolOutput {
     next?: NextAction | null;
     /** Mark the result as an error the model should act on (still a normal result). */
     isError?: boolean;
+    /**
+     * Round 36 (pilot 35 item 18: setup and plan responses ran to 20-44 KB): print the JSON without indentation. The tools
+     * with a `verbose` argument use it by default.
+     */
+    compactJson?: boolean;
 }
 /**
  * Round-3 pilot (nextjs, sveltekit): output was cut at 60 KB in the middle of the JSON, which agents then failed to
  * parse. Output is always valid JSON: an oversized list is paged (the first items that fit, plus `_page` naming the
  * ids of the rest to fetch one by one), never cut mid-value.
  */
-export declare function fitJson(data: unknown, max?: number): {
+export declare function fitJson(data: unknown, max?: number, flatFirst?: boolean): {
     json: string;
     page?: string;
 };

package/dist/format.js

@@ -296,7 +296,12 @@ function fitNestedLists(data, arr, max) {
  * parse. Output is always valid JSON: an oversized list is paged (the first items that fit, plus `_page` naming the
  * ids of the rest to fetch one by one), never cut mid-value.
  */
-export function fitJson(data, max = MAX_JSON_CHARS) {
+export function fitJson(data, max = MAX_JSON_CHARS, flatFirst = false) {
+    if (flatFirst) {
+        const flat = JSON.stringify(data);
+        if (flat.length <= max)
+            return { json: flat };
+    }
     const pretty = JSON.stringify(data, null, 2);
     if (pretty.length <= max)
         return { json: pretty };
@@ -349,7 +354,7 @@ export function renderOutput(out) {
     // Round 23 (pilot 22 item 27, agent-discovery: a result with no "Next:" line): every result names what comes next.
     lines.push(next ?? (out.isError ? FALLBACK_NEXT_ERROR : FALLBACK_NEXT));
     if (out.data !== undefined) {
-        const fitted = fitJson(forMcp(out.data));
+        const fitted = fitJson(forMcp(out.data), MAX_JSON_CHARS, out.compactJson === true);
         if (fitted.page)
             lines.push(`- ${fitted.page}`);
         lines.push('', '```json', fitted.json, '```');

package/dist/server.d.ts

@@ -5,7 +5,7 @@ import type { KeyContext } from './permissions.ts';
 import { type IssuedKeys, type ToolContext, type ToolDef } from './tools.ts';
 export declare const SERVER_NAME = "checkbox";
 /** Kept equal to packages/mcp/package.json "version" (@checkbox-site/mcp); mcp.test.ts checks it. */
-export declare const SERVER_VERSION = "0.2.7";
+export declare const SERVER_VERSION = "0.2.9";
 export declare const DEFAULT_MCP_URL = "https://app.checkbox.site/mcp";
 /** The coverage phrase used across Checkbox (the API docs tests check the count against the rules catalog). */
 export declare const COVERAGE_PHRASE = "federal law, 27 states, DC and New York City";

package/dist/server.js

@@ -9,7 +9,7 @@ import { likelyMisspelling, unknownArgumentsMessage, unknownKeysParams } from ".
 import { outdatedNotice } from "./version-check.js";
 export const SERVER_NAME = 'checkbox';
 /** Kept equal to packages/mcp/package.json "version" (@checkbox-site/mcp); mcp.test.ts checks it. */
-export const SERVER_VERSION = '0.2.7';
+export const SERVER_VERSION = '0.2.9';
 export const DEFAULT_MCP_URL = 'https://app.checkbox.site/mcp';
 /** The coverage phrase used across Checkbox (the API docs tests check the count against the rules catalog). */
 export const COVERAGE_PHRASE = 'federal law, 27 states, DC and New York City';

package/dist/tools.d.ts

@@ -139,6 +139,20 @@ export declare function sitePlansNote(plans: unknown): string | null;
  * and complete_setup carry them in full), and once the Stripe key is stored its permission checklist is dropped. Pure.
  */
 export declare function compactSetupDoc<T>(doc: T): T;
+/**
+ * Round 36 (pilot 35 item 18, new-app / dev-approver: setup responses of 20-40 KB): the default setup response. On top of
+ * compactSetupDoc, the latest check's top findings become a count (get_compliance_plan and list_findings have them) and
+ * finished checklist steps keep only key, title and status. Every open step, id, status and next_action stays. Pure.
+ */
+export declare function compactSetupResponse<T>(doc: T): T;
+/** A task's next_action without what an MCP agent does not use: the CLI command, and the endpoint when a tool performs it. Pure. */
+export declare function slimNextAction(na: unknown, taskId?: string): unknown;
+/**
+ * Round 36 (pilot 35 item 18: get_compliance_plan answered with 28-44 KB): the default plan. Open tasks as slimPlan,
+ * with `why` shortened and next_action without the CLI command; closed tasks as id, key, title, status, tier and why
+ * they closed; go_live as its summary (the notes list each step). verbose=true returns the API's full plan. Pure.
+ */
+export declare function compactPlan(plan: PlanLite): PlanLite;
 /**
  * Pilot round 9 (nextjs): setup_checkbox still showed `insurable: false` and `score: 26.8` next to the status label.
  * The API keeps both (deprecated) for backward compatibility; agents see only the one status.

package/dist/tools.js

@@ -87,7 +87,6 @@ const listLimit = z.number().int().min(1).max(100).optional().describe('How many
 const startingAfter = z.string().max(100).optional().describe('Pagination cursor: the last id of the previous page (when has_more was true).');
 /** Plan fields agents reach for, mapped to the setup field (plans[] amounts are minor units). */
 const PLAN_FIELD_HINTS = Object.freeze({
-    price: 'amount (minor units: 800 = $8.00)',
     price_cents: 'amount (minor units: 800 = $8.00)',
     amount_cents: 'amount',
     unit_amount: 'amount',
@@ -99,15 +98,15 @@ const PLAN_FIELD_HINTS = Object.freeze({
     cancel_url: 'account_url (a site field, not a plan field)',
 });
 const setupFactsShape = {
-    site_url: z.string().max(2048).optional().describe('Public URL of the site (production, or a preview deployment), e.g. "https://acme.example".'),
-    checkout_url: z.string().max(2048).optional().describe('Page where customers subscribe (pricing or checkout page).'),
+    site_url: z.string().max(2048).optional().describe('Public URL of the site (production or a preview), e.g. "https://acme.example".'),
+    checkout_url: z.string().max(2048).optional().describe('Pricing or checkout page.'),
     account_url: z.string().max(2048).nullable().optional().describe('Account page where subscribers manage / cancel (null clears a URL).'),
     terms_url: z.string().max(2048).nullable().optional().describe('Terms of service URL. Checkbox fetches and checks it.'),
     privacy_url: z.string().max(2048).nullable().optional().describe('Privacy policy URL.'),
     refund_url: z.string().max(2048).nullable().optional().describe('Refund policy URL.'),
     cancellation_url: z.string().max(2048).nullable().optional().describe('Cancellation policy URL, if separate from the Terms.'),
     support_email: z.string().max(320).optional().describe('Support address for subscribers.'),
-    merchant_name: z.string().max(100).optional().describe('The brand subscribers know (names the seller in generated disclosures), e.g. from the <title> or package.json (also accepted as "brand"). Default: the host name, which the plan then asks you to replace.'),
+    merchant_name: z.string().max(100).optional().describe('The brand subscribers know (names the seller in generated disclosures), e.g. from the <title> or package.json Default: the host name, which the plan asks you to replace.'),
     billing_platform: z
         .enum(['stripe', 'shopify', 'recharge', 'chargebee', 'recurly', 'paddle', 'lemon_squeezy', 'woocommerce', 'custom'])
         .optional()
@@ -126,10 +125,13 @@ const setupFactsShape = {
         intro_amount_off: z.number().int().positive().optional(),
         intro_periods: z.number().int().min(1).max(36).optional(),
         price_id: z.string().max(200).optional().describe('Stripe Price id.'),
+        // Round 36 (pilot 35 item 21, codex / dev-approver: the first call sent plans[].price in dollars and was refused).
+        // The API takes it as amount in MAJOR units and refuses a price that disagrees with amount.
+        price: z.number().positive().optional().describe('Or major units (19 = $19).'),
     }, 'plans[]', PLAN_FIELD_HINTS))
         .max(50)
         .optional()
-        .describe('Plans and prices found in the code, e.g. [{"name":"Pro","amount":1900,"currency":"usd","interval":"month","trial_days":14}]; a promo adds intro_percent_off and intro_periods. They decide which laws apply and what generated copy states.'),
+        .describe('Plans and prices found in the code, e.g. [{"name":"Pro","amount":1900,"currency":"usd","interval":"month","trial_days":14}]; a promo adds intro_percent_off and intro_periods. They decide which laws apply.'),
     project: z
         .object({
         name: z.string().max(200).optional().describe('package.json name.'),
@@ -422,7 +424,7 @@ export function sitePlansNote(plans) {
  * (site_url) and the first checks run in the same call (homepage + snippet, policies fetched and checked, evaluation,
  * first scan), exactly like the end of the device-login path.
  */
-async function setupOverOAuth(api, session, ctx) {
+async function setupOverOAuth(api, session, ctx, verbose = false) {
     const notes = [
         `Connected to Checkbox through ${ctx.key.appName ?? ctx.clientName ?? 'this app'} with the human's approval (${ctx.key.mode} mode${ctx.key.kind === 'restricted' ? ', read-only' : ''}). No API key is needed: do not ask the human for one.`,
     ];
@@ -457,11 +459,13 @@ async function setupOverOAuth(api, session, ctx) {
     return {
         headline: `Setup session ${session.id} started${session.business?.site_url ? ` for ${untrusted(session.business.site_url, 100)}` : ''}${session.site ? ` (test-mode site ${session.site})` : ''}.`,
         notes,
+        compactJson: !verbose,
         ...(next ? { next } : {}),
         data: (() => {
             const doc = { ...session, ...(fresh ?? {}) };
             const keys = labelledPublicKeys(doc.install?.snippet_key, doc.publishable_key);
-            return compactSetupDoc(withoutLegacyScore({ ...doc, ...(keys.length ? { public_keys: keys } : {}), ...(firstCheck ? { first_check: firstCheck } : {}) }));
+            const out = withoutLegacyScore({ ...doc, ...(keys.length ? { public_keys: keys } : {}), ...(firstCheck ? { first_check: firstCheck } : {}) });
+            return verbose ? out : compactSetupResponse(out);
         })(),
     };
 }
@@ -476,7 +480,7 @@ export function compactSetupDoc(doc) {
     const d = { ...doc };
     const g = d.go_live;
     if (g && typeof g === 'object' && Array.isArray(g.steps))
-        d.go_live = { summary: g.summary ?? null, steps: g.steps.length, full: 'get_compliance_plan (go_live) or complete_setup' };
+        d.go_live = { summary: g.summary ?? null, steps: g.steps.length, full: 'the go-live notes of get_compliance_plan, complete_setup, or verbose=true' };
     const st = d.stripe;
     if (st && st.test_credential_stored === true && st.restricted_key && Array.isArray(st.restricted_key.permissions)) {
         const { permissions: _p, ...rk } = st.restricted_key;
@@ -484,6 +488,67 @@ export function compactSetupDoc(doc) {
     }
     return d;
 }
+/** `verbose` on the setup and plan tools (round 36, pilot 35 item 18). */
+const verboseArg = z.boolean().optional().describe('true: the full JSON object.');
+const CLOSED_STEPS = new Set(['done', 'skipped', 'not_applicable']);
+/**
+ * Round 36 (pilot 35 item 18, new-app / dev-approver: setup responses of 20-40 KB): the default setup response. On top of
+ * compactSetupDoc, the latest check's top findings become a count (get_compliance_plan and list_findings have them) and
+ * finished checklist steps keep only key, title and status. Every open step, id, status and next_action stays. Pure.
+ */
+export function compactSetupResponse(doc) {
+    if (!doc || typeof doc !== 'object')
+        return doc;
+    const d = compactSetupDoc({ ...doc });
+    const c = d.compliance;
+    if (c && typeof c === 'object' && Array.isArray(c.top_findings)) {
+        const { top_findings: top, ...rest } = c;
+        d.compliance = { ...rest, top_findings_count: top.length };
+    }
+    if (Array.isArray(d.steps)) {
+        d.steps = d.steps.map((st) => {
+            const x = st;
+            return x && typeof x === 'object' && typeof x.status === 'string' && CLOSED_STEPS.has(x.status) ? { key: x.key, title: x.title, status: x.status } : st;
+        });
+    }
+    for (const k of ['setup_session', 'session'])
+        if (d[k] && typeof d[k] === 'object')
+            d[k] = compactSetupResponse(d[k]);
+    return d;
+}
+/** A task's next_action without what an MCP agent does not use: the CLI command, and the endpoint when a tool performs it. Pure. */
+export function slimNextAction(na, taskId) {
+    if (!na || typeof na !== 'object' || Array.isArray(na))
+        return na;
+    const { command: _command, ...rest } = na;
+    if (taskId && rest.task === taskId)
+        delete rest.task;
+    if (typeof rest.mcp_tool === 'string' && rest.mcp_tool !== 'call_api')
+        delete rest.endpoint;
+    return rest;
+}
+/**
+ * Round 36 (pilot 35 item 18: get_compliance_plan answered with 28-44 KB): the default plan. Open tasks as slimPlan,
+ * with `why` shortened and next_action without the CLI command; closed tasks as id, key, title, status, tier and why
+ * they closed; go_live as its summary (the notes list each step). verbose=true returns the API's full plan. Pure.
+ */
+export function compactPlan(plan) {
+    const slim = slimPlan(plan);
+    const full = new Map((plan.tasks ?? []).map((t) => [t.id, t]));
+    const tasks = (slim.tasks ?? []).map((t) => {
+        const x = t;
+        if (t.status === 'done' || t.status === 'wont_fix') {
+            const f = full.get(t.id) ?? {};
+            return { id: t.id, key: x.key, title: t.title, status: t.status, tier: t.tier, compliance_status: x.compliance_status, closed_reason: f.closed_reason ?? null };
+        }
+        return { ...x, why: clipWords(x.why, 200), next_action: slimNextAction(x.next_action, t.id) };
+    });
+    const out = { ...slim, tasks };
+    const g = out.go_live;
+    if (g && typeof g === 'object' && Array.isArray(g.steps))
+        out.go_live = { summary: g.summary ?? null, steps: g.steps.length, full: 'the notes above, or verbose=true' };
+    return out;
+}
 /**
  * Pilot round 9 (nextjs): setup_checkbox still showed `insurable: false` and `score: 26.8` next to the status label.
  * The API keeps both (deprecated) for backward compatibility; agents see only the one status.
@@ -544,6 +609,7 @@ const setupCheckbox = {
         device_code: z.string().max(200).optional().describe('From an earlier setup_checkbox call: poll that browser approval instead of starting a new one.'),
         live: z.boolean().optional().describe('Also request live-mode keys (live mode activates after domain verification). Default false: test mode only.'),
         agent: z.string().max(100).optional().describe('Which AI agent is doing this, shown to the human on the approval page, e.g. "Claude Code".'),
+        verbose: verboseArg,
     },
     scopes: ['setup_sessions:write'],
     public: true,
@@ -630,6 +696,7 @@ const setupCheckbox = {
             return {
                 headline: `Approved. Checkbox account ready${site ? ` with test-mode site ${site}` : ''}; setup session ${res.setup_session ?? '(none)'}.`,
                 notes,
+                compactJson: !args.verbose,
                 ...(next ? { next } : {}),
                 data: {
                     ...(saved ? withoutSecrets(res) : res),
@@ -677,7 +744,7 @@ const setupCheckbox = {
         body.client = { name: 'checkbox-mcp', version: ctx.serverVersion, ...(args.agent || ctx.key.appName || ctx.clientName ? { agent: String(args.agent ?? ctx.key.appName ?? ctx.clientName).slice(0, 100) } : {}) };
         const session = await api.request('POST', '/v1/setup_sessions', { body });
         if (ctx.key.auth === 'oauth')
-            return setupOverOAuth(api, session, ctx);
+            return setupOverOAuth(api, session, ctx, args.verbose === true);
         const notes = session.review_url ? [`Human review page: ${session.review_url}`] : [];
         if (session.next_action?.type === 'verify_domain')
             notes.push(firstCheckNote(session.next_action));
@@ -687,9 +754,11 @@ const setupCheckbox = {
         return {
             headline: `Setup session ${session.id} started${session.business?.site_url ? ` for ${untrusted(session.business.site_url, 100)}` : ''}${session.site ? ` (test-mode site ${session.site})` : ''}.`,
             notes,
+            compactJson: !args.verbose,
             data: (() => {
                 const keys = labelledPublicKeys(session.install?.snippet_key, session.publishable_key);
-                return compactSetupDoc(keys.length ? { ...withoutLegacyScore(session), public_keys: keys } : withoutLegacyScore(session));
+                const out = keys.length ? { ...withoutLegacyScore(session), public_keys: keys } : withoutLegacyScore(session);
+                return args.verbose ? out : compactSetupResponse(out);
             })(),
         };
     },
@@ -750,7 +819,7 @@ const getSetupStatus = {
             const pl = sitePlansNote(res.setup_session?.site_plans);
             if (pl)
                 notes.push(pl);
-            return { headline: `Re-checked setup session ${id}.`, ...(notes.length ? { notes } : {}), data: withoutLegacyScore(res), next: nextActionOf(res) ?? nextActionOf(res.setup_session) ?? nextActionOf(res.session) };
+            return { headline: `Re-checked setup session ${id}.`, ...(notes.length ? { notes } : {}), compactJson: true, data: compactSetupResponse(withoutLegacyScore(res)), next: nextActionOf(res) ?? nextActionOf(res.setup_session) ?? nextActionOf(res.session) };
         }
         const session = await api.request('GET', `/v1/setup_sessions/${enc(id)}`);
         const open = (session.steps ?? []).filter((s) => s.status && !['done', 'skipped', 'not_applicable'].includes(s.status));
@@ -760,7 +829,8 @@ const getSetupStatus = {
             headline: `Setup session ${session.id}: ${session.status}; ${open.length} checklist step(s) open.`,
             // The policies step says what an unverified preview read (or that the pages wait for domain verification).
             notes: [...open.slice(0, 8).map((s) => `${s.status}: ${s.title ?? s.key}${s.key === 'policies' && s.summary ? ` (${s.summary.slice(0, 240)})` : ''}`), ...(ro ? [ro] : []), ...(plansLine ? [plansLine] : []), ...(session.next_action?.type === 'done' ? goLiveNotes(session.go_live) : [])],
-            data: withoutLegacyScore(session),
+            compactJson: true,
+            data: compactSetupResponse(withoutLegacyScore(session)),
         };
     },
 };
@@ -799,7 +869,7 @@ const updateSetup = {
         const notes = Array.isArray(args.plans) && args.plans.length
             ? ['Plans saved: Checkbox re-evaluates the site with them now, so get_compliance_plan lists each plan\'s tasks (e.g. the trial reminder of a plan with a trial). If one seems missing, call verify_site to re-check at once.']
             : [];
-        return { headline: `Updated setup session ${session.id}.`, notes, data: withoutLegacyScore(session) };
+        return { headline: `Updated setup session ${session.id}.`, notes, compactJson: true, data: compactSetupResponse(withoutLegacyScore(session)) };
     },
 };
 /** Round 13 (pilot 12, codex: "sent" while nothing new arrived): the summary email's real delivery status, with when. */
@@ -899,12 +969,12 @@ const getCompliancePlan = {
     title: 'Get the compliance plan (ordered tasks)',
     description: [
         'The main tool after setup. Returns the ordered tasks that make the site pass the automatic-renewal checks, recomputed from the latest observations.',
-        'Each task has: requirement + legal citation, why (what Checkbox observed), where (file / component / URL / CSS selector / Stripe object), change (exact unified-diff template, copy text or Stripe params), and verify (how to check).',
+        'Each task here is a summary (id, status, why, where, change type, next_action); get_task has the full change (diff, copy or Stripe params) and its legal citation.',
         'Plan status: action_required (apply open tasks), verifying (waiting for confirming observations), compliant (done: the checks pass — "pending_live_check" tasks count as passing: they complete on their own or with a proof run), blocked (only human questions — "Your call" — left).',
-        'Tasks are tagged tier required / recommended / extra. Only required tasks matter for compliance; recommended and extra tasks are optional suggestions (mention them once, do not push them).',
+        'Only tier "required" tasks count; "recommended" and "extra" tasks are optional suggestions (mention them once, do not push them).',
         'Loop: apply the first open required task in the code → verify_task → get_compliance_plan → … until the checks pass (status compliant). Tasks with status "manual" carry a question with a recommended answer: ask the HUMAN, then answer_task. Never invent answers.',
     ].join('\n'),
-    input: { site: siteId.optional() },
+    input: { site: siteId.optional(), verbose: verboseArg },
     scopes: ['compliance_plans:read'],
     annotations: { ...ro, title: 'Compliance plan' },
     async run(args, { api }) {
@@ -945,15 +1015,17 @@ const getCompliancePlan = {
                 ...(plan.status === 'compliant' ? await reviewHint(api, site, 'plan_compliant') : []),
             ],
             // Normal-round pilot (sveltekit): the full plan (53K characters) was cut mid-JSON by the client. The plan here is a
-            // compact summary of every task; get_task returns one task in full.
-            data: slimPlan(shown),
+            // compact summary of every task; get_task returns one task in full. Round 36 (pilot 35 item 18): compact JSON by
+            // default, the API's full plan with verbose=true.
+            compactJson: !args.verbose,
+            data: args.verbose ? shown : compactPlan(shown),
         };
     },
 };
 const getTask = {
     name: 'get_task',
     title: 'Get one compliance task',
-    description: 'One task of the compliance plan with the full change to apply (unified-diff template with machine-applicable edits, copy, or Stripe params), where to apply it, the legal requirement, its last verification and next_action. Use it when the plan JSON was truncated or before applying a task.',
+    description: 'One plan task in full: the change to apply (unified-diff template with machine-applicable edits, copy or Stripe params), where, the legal requirement, its last verification and next_action. Call it before applying a task.',
     input: { task: z.string().max(100).describe('Task id (task_…) from get_compliance_plan.') },
     scopes: ['compliance_plans:read'],
     annotations: { ...ro, title: 'Task' },
@@ -1263,7 +1335,7 @@ const getTestRun = {
         const progress = w ? [w.step && w.steps_total ? `step ${w.step} of ${w.steps_total}` : '', w.minutes_left ? `about ${w.minutes_left} min left` : ''].filter(Boolean).join(', ') : '';
         const waiting = w ? `Waiting for: ${w.what}${w.until ? ` (until ${new Date(w.until * 1000).toISOString().slice(0, 16).replace('T', ' ')} UTC at the latest)` : ''}${progress ? ` [${progress}]` : ''}` : null;
         return {
-            headline: `Test run ${run.id}: ${run.status_label ?? statusLine(run.status)}${run.phase && run.status !== 'succeeded' && run.status !== 'failed' ? ` (phase ${run.phase})` : ''}.`,
+            headline: `Test run ${run.id}: ${run.status_label ?? statusLine(run.status)}${run.phase && run.status !== 'succeeded' && run.status !== 'failed' ? ` (phase ${run.phase})` : ''}.${run.plan_status_label ? ` Plan after this run: ${run.plan_status_label}.` : ''}`,
             notes: [...(waiting ? [waiting] : []), ...(run.steps ?? []).map((s) => `${s.status ?? '?'}: ${s.title ?? s.key}${s.code ? ` (${s.code})` : ''}`)].slice(0, 13),
             data: run,
             ...(next ? { next } : {}),
@@ -1393,12 +1465,12 @@ const checkPageHtml = {
     title: 'Check a checkout / pricing page (HTML or URL)',
     description: [
         'Checks a whole checkout or pricing page: finds the purchase button, the renewal disclosure, consent checkboxes and terms/cancel links, and evaluates them. Send html = the RENDERED page (after JavaScript; for React/Next pages, render it or paste the server output) — this is how to check a page before deploying.',
-        'Or send url to fetch a live public page (live mode on an activated account only; test keys must send html).',
+        'Or send url to fetch a public page (live keys; test keys: your registered site\'s origin).',
         'Static HTML cannot measure styling, so placement/styling passes come back as needs_review until a scan confirms; failures are real. When it fails, replacement holds verified drop-in markup.',
     ].join('\n'),
     input: {
         html: z.string().max(1_000_000).optional().describe('Rendered checkout page HTML. Give html or url.'),
-        url: z.string().max(2048).optional().describe('Live public page URL to fetch instead (live, activated accounts).'),
+        url: z.string().max(2048).optional().describe('Public page URL to fetch instead.'),
         page_kind: z.enum(['checkout', 'pricing']).optional().describe('Default checkout.'),
         terms: planTerms.optional().describe('The plan sold on the page. merchant_name / cancel_url alone are fine (no price compared).'),
         plans: z.array(strictObject(planTermsShape, 'plans[]')).max(20).optional().describe('Multi-plan pricing page: EVERY plan it sells (price, interval, trial_days each). Each plan card is judged against its own plan; plan_replacements gives each plan its own markup for its own button.'),
@@ -1698,7 +1770,7 @@ const updateSite = {
     name: 'update_site',
     title: 'Update a site\'s settings (write)',
     description: [
-        'WRITE: updates a site — the fields plan tasks of change.type "config" ask for (their change.content is this tool\'s input): checkout_url, checkout_steps, test_account { login_url, email, password } (stored encrypted; the response echoes it without the password), name (the merchant name in generated legal copy), platform, jurisdictions, monitoring_interval_minutes, protection_level (minimum = legal floor only; balanced = + recommended suggestions, the default; maximum = + extras; only required items ever affect compliance).',
+        'WRITE: updates a site — the fields plan tasks of change.type "config" ask for (their change.content is this tool\'s input): checkout_url, checkout_steps, checkout_pages, test_account { login_url, email, password } (stored encrypted; the response echoes it without the password), name (the merchant name in generated legal copy), platform, jurisdictions, monitoring_interval_minutes, protection_level.',
         'The response is the site; check checkout.url / checkout.test_account to confirm. Then verify_task the task that asked for it.',
     ].join('\n'),
     input: {
@@ -1706,6 +1778,7 @@ const updateSite = {
         name: z.string().max(200).optional().describe('Merchant / brand name (used in generated disclosures).'),
         checkout_url: z.string().max(2048).optional().describe('Page with the Subscribe / Buy button.'),
         checkout_steps: z.array(z.record(z.string(), z.unknown())).max(20).optional().describe('Steps to reach the purchase button (clicks / fills), as in the API.'),
+        checkout_pages: z.array(z.record(z.string(), z.string())).max(4).optional().describe('[{url,plan}] per plan'),
         test_account: strictObject({
             login_url: z.string().max(2048),
             email: z.string().max(320),
@@ -1723,7 +1796,7 @@ const updateSite = {
     annotations: { ...write(false, true), title: 'Update site' },
     async run(args, { api }) {
         const site = await resolveSite(api, args.site);
-        const body = pick(args, ['name', 'checkout_url', 'checkout_steps', 'test_account', 'platform', 'jurisdictions', 'monitoring_interval_minutes', 'protection_level']);
+        const body = pick(args, ['name', 'checkout_url', 'checkout_steps', 'checkout_pages', 'test_account', 'platform', 'jurisdictions', 'monitoring_interval_minutes', 'protection_level']);
         if (!Object.keys(body).length)
             throw new ToolError('Pass at least one field to change (e.g. checkout_url, test_account, name).');
         const updated = await api.request('POST', `/v1/sites/${enc(site)}`, { body });
@@ -1856,7 +1929,8 @@ const listFindings = {
         const failNote = args.status === 'fail' && !list.data.length ? ' status=fail is the engine verdict only: a needs_review finding can still be counted as a fix (its label says "Needs a fix"). The fixes to make are the tasks of get_compliance_plan.' : '';
         return {
             headline: `${list.data.length}${list.has_more ? '+' : ''} finding(s).${failNote}`,
-            notes: list.data.map((f) => `${f.severity.toUpperCase()} ${f.id} [${f.compliance?.label ?? f.status}] ${f.check_id}: ${f.title}${f.requirements?.[0] ? ` [${f.requirements[0].citation}]` : ''}`),
+            // Round 35 (pilot 34 item 7): each finding with what the plan says about it (the plan decides what is left to do).
+            notes: list.data.map((f) => `${f.severity.toUpperCase()} ${f.id} [${f.compliance?.label ?? f.status}] ${f.check_id}: ${f.title}${f.requirements?.[0] ? ` [${f.requirements[0].citation}]` : ''}${f.plan_task ? ` — plan: ${f.plan_task.label} (${f.plan_task.id})` : ''}`),
             data: list,
         };
     },
@@ -1880,7 +1954,7 @@ const getFinding = {
             ? await optional(api.request('GET', `/v1/findings/${enc(id)}/fix`, { query: pick(args, ['target', 'cancel_url', 'plan']) }))
             : { unavailable: 'This key has no fixes:read permission.' };
         return {
-            headline: `${finding.severity.toUpperCase()} ${finding.id} [${finding.compliance?.label ?? finding.status}] ${finding.check_id}: ${finding.title}`,
+            headline: `${finding.severity.toUpperCase()} ${finding.id} [${finding.compliance?.label ?? finding.status}] ${finding.check_id}: ${finding.title}${finding.plan_task ? ` — plan: ${finding.plan_task.label} (${finding.plan_task.id})` : ''}`,
             notes: [complianceBullet(finding.check_id, finding.compliance, finding.status, finding.title)].filter((x) => !!x),
             data: { finding, fix },
             next: findingNext(finding, nextActionOf(fix)),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@checkbox-site/mcp",
-  "version": "0.2.7",
+  "version": "0.2.9",
   "description": "Checkbox MCP server: auto-renewal law and subscription compliance checks for AI agents (FTC ROSCA, California ARL, New York and other states) on Stripe Checkout params, pricing pages, disclosures and emails. Remote at https://app.checkbox.site/mcp, or local stdio.",
   "keywords": [
     "checkbox",
@@ -77,7 +77,7 @@
     "prepack": "npm run build"
   },
   "dependencies": {
-    "@checkbox-site/node": "^0.2.7",
+    "@checkbox-site/node": "^0.2.9",
     "@modelcontextprotocol/sdk": "^1.32.2",
     "zod": "^4.6.7"
   }