@chrischall/gemini-mcp 2.1.4 → 2.3.0

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Google Gemini image generation and editing — generate and edit images via the Gemini API",
-    "version": "2.1.4"
+    "version": "2.3.0"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Gemini Images",
       "source": "./",
       "description": "Generate and edit images with Google Gemini image models (Nano Banana / Nano Banana Pro) via natural language prompts",
-      "version": "2.1.4",
+      "version": "2.3.0",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "gemini-mcp",
   "displayName": "Gemini Images",
-  "version": "2.1.4",
+  "version": "2.3.0",
   "description": "MCP server for Google Gemini image generation and editing — generate and edit images via the Gemini API",
   "author": {
     "name": "Chris Hall",

package/README.md

@@ -16,10 +16,28 @@ Developed and maintained by AI (Claude Code).
 | `GEMINI_IMAGE_MODEL` | No | Override the default image model (default: `gemini-3.1-flash-image`) |
 | `GEMINI_OUTPUT_DIR` | No | Default directory for generated images (default: current working directory) |
 | `GEMINI_INPUT_DIR` | No | Directory to resolve bare input-image filenames against (so `images: ["foo.jpg"]` works) |
+| `GEMINI_UPLOAD_DIR` | No | Restrict local files streamed to the Gemini Files API (`gemini_upload_file` `path`, `video_path`) to these directories — one or more, separated by `:` (`;` on Windows); `~` allowed. A path outside is refused before any upload. Unset: no restriction |
 | `GEMINI_TIMEOUT_MS` | No | Upstream request timeout in ms (default: `60000`, or `120000` for `image_size: "4K"`); each generation tool also takes a per-call `timeout_ms` |
 | `GEMINI_HEARTBEAT_MS` | No | Progress-notification cadence in ms while a generation runs (default: `10000`; `0` disables) — keeps MCP hosts that reset their timeout on progress from timing out long generations |
 | `GEMINI_CHAIN_RETRY_MS` | No | How long to wait out interactions-store lag when a chained call 404s (default: `120000`; `0` disables retrying) |
 
+### Confirmations
+
+Sending a **local file** to Google (the `images` / `master_images` / `video_path` inputs, or
+`gemini_upload_file`'s `path`) and every **delete** ask for confirmation first. A client that can
+show a confirmation prompt (Claude Code) gets the real prompt. Elsewhere the first call does
+nothing and returns a preview (the resolved local paths with their MIME types and sizes, or the
+method/path being deleted) plus a `confirmToken`; only a repeat call with the same arguments and
+that token proceeds. The token is single-use, expires, and is bound to the exact arguments — a
+changed prompt or a swapped file between the two calls is refused. Pure text prompts, URLs,
+`files/` references and base64 inputs are not gated.
+
+| variable | default | |
+|---|---|---|
+| `MCP_CONFIRM_MODE` | `ask-user` | What a write does on a client that cannot show a confirmation prompt (claude.ai, Claude Desktop). `ask-user`: two steps — the first call does nothing and returns a preview plus a token, and the model must get your approval in chat before calling again with it. `auto`: the same two steps, but the model may use the token after reviewing the preview itself. `refuse`: writes are refused on such clients. A client that can show prompts (Claude Code) always gets the real prompt. An unrecognised value is treated as `refuse`. |
+| `MCP_CONFIRM_TTL_SECONDS` | `600` | How long a token stays valid. |
+| `MCP_CONFIRM_SECRET` | random per process | Signing key; set it only if tokens must survive a server restart. |
+
 ### Long generations and client timeouts
 
 4K / Pro-model generations can outrun an MCP host's own `tools/call` timeout (error `-32001`).
@@ -86,7 +104,7 @@ progress), two guards make re-issuing safe and unnecessary:
 | `gemini_token_usage` | Token usage and an estimated USD cost for this session so far. Call it before and after a workflow and subtract to attribute that workflow's spend. Priced per call against each call's own model from a dated rate card (`GEMINI_RATE_CARD` overrides it); there is no account-balance endpoint to read, so this is how spend is attributed |
 | `gemini_upload_file` | Upload an image (or video/audio) to the Gemini Files API once — from a `url`, `data_base64`, or a local `path` — and get a reusable `files/<id>` reference |
 | `gemini_list_files` | List the files currently uploaded under this API key, with MIME types and expiry times |
-| `gemini_delete_file` | Delete an uploaded file before its ~48h expiry (confirm-gated) |
+| `gemini_delete_file` | Delete an uploaded file before its ~48h expiry (confirmed first — see [Confirmations](#confirmations)) |
 | `gemini_sign_media` | *(hosted deployments only)* Mint a fresh signed URL for generated media from its `r2_key` — an expired link is not a dead end |
 | `gemini_view_media` | *(hosted deployments only)* Return a generated image as an inline image block from its `r2_key`, so a model can actually see what it made before refining it |
 | `gemini_get_upload_url` | *(hosted deployments only)* Mint a short-lived signed PUT URL so a shell can upload a reference image with no auth header; the PUT returns an `r2_key` usable in `images_r2_keys`, `gemini_save_character`, or `gemini_upload_file` |
@@ -172,6 +190,15 @@ safe form, and a markdown link is a reasonable enhancement where you know it ren
 Signed-URL lifetime is clamped to `MEDIA_TTL_DAYS`, so a link never outlives the object it
 points at.
 
+**Prompts are stored too.** Each generated object on a hosted deployment gets a small JSON
+record beside it holding the prompt (first 500 characters), model and interaction id — that is
+what `gemini_list_recent_media` shows and what lets a lost turn be recovered. The record lives
+and is swept with its object, so it is kept for the same `MEDIA_TTL_DAYS` window, not longer.
+Locally, `gemini_interact` writes an `<image>.json` sidecar (model, interaction id, options and
+any text the model replied with — not the prompt itself) next to each image in the output dir;
+those files are yours to keep or delete and never expire on their own. If your
+prompts describe real people, bear in mind they sit in your bucket for the retention window.
+
 ## Sending reference images without burning context
 
 Every tool that takes a reference image — `gemini_image_generate`, `gemini_image_edit`,