@chrischall/myatriumhealth-mcp 0.1.0 → 0.2.0

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Angi — find home-service pros by trade and city, read ratings, reviews and pro profiles. Angi serves its pages only to a real browser, so requests route through the user's own angi.com tab via the fetchproxy browser extension, reusing their existing session. The trade/city taxonomy is read from Angi's public sitemaps directly.",
-    "version": "0.1.0"
+    "version": "0.2.0"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "MyAtriumHealth",
       "source": "./",
       "description": "Read MyAtriumHealth (Epic MyChart) records — test results, medications, allergies, immunizations, health issues, visits — by relaying requests through the user's signed-in browser tab via the fetchproxy bridge.",
-      "version": "0.1.0",
+      "version": "0.2.0",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "myatriumhealth-mcp",
   "displayName": "MyAtriumHealth",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "MyAtriumHealth (Epic MyChart) access for Claude — test results, medications, allergies, immunizations, visits",
   "author": {
     "name": "Chris Hall",

package/dist/bundle.js

@@ -39884,6 +39884,7 @@ var MyAtriumHealthAuth = class {
     if (/SecondaryValidation/i.test(nextLocation) || /SecondaryValidation/i.test(landing.body)) {
       const ctx = await this.challengeContext();
       this.mfaPending = true;
+      this.persist();
       throw new MfaRequiredError(ctx?.channels ?? ["sms", "email"], {
         ...ctx?.displayEmail !== void 0 ? { email: ctx.displayEmail } : {},
         ...ctx?.displayPhone !== void 0 ? { phone: ctx.displayPhone } : {}
@@ -49417,7 +49418,7 @@ function registerVisitTools(server, client2) {
 }
 
 // src/version.ts
-var VERSION = "0.1.0";
+var VERSION = "0.2.0";
 
 // src/index.ts
 var username = readEnvVar("MAH_USERNAME");

package/mint.yaml

@@ -2,33 +2,127 @@ version: 1
 name: MyAtriumHealth
 slug: myatriumhealth
 
-# Browser-bridge MCP: every request is relayed through the user's signed-in
-# my.atriumhealth.org tab, because all MyChart cookies are HttpOnly and login
-# is MFA-gated, so the session cannot be replayed from Node. Hosting therefore
-# requires a BRIDGED registration — `bridge: true` plus
-# `bridgePortEnv: MAH_WS_PORT`, on `runtime: fly-shared`. Those are
-# registration fields set over the control API; this manifest has no column
-# for them. See mcp-host docs/BROWSER-BRIDGE.md, which currently describes
-# bridge hosting as built but unproven over the WAN.
+# This server has TWO transports and the hosted one is the bridge-less path:
+# with MAH_USERNAME/MAH_PASSWORD set it signs in server-side with its own cookie
+# jar, so no browser, extension or bridge is involved and this registers like any
+# other credential MCP.
+#
+# Without those credentials it falls back to the fetchproxy browser bridge, which
+# relays through the user's signed-in tab. Hosting THAT would additionally need
+# `bridge: true` + `bridgePortEnv: MAH_WS_PORT` on `runtime: fly-shared` — set
+# over the control API, since this manifest has no column for them — and
+# mcp-host's docs/BROWSER-BRIDGE.md still calls bridge hosting built but
+# unproven over the WAN. Prefer the credential path.
+#
+# Verification is human-in-the-loop and cannot be automated away: when the portal
+# challenges, the connector reports the available channels, the portal sends a
+# code to the ACCOUNT HOLDER, and they supply it. Expect that on first use and
+# again whenever the stored session lapses. Nothing needs reconnecting when it
+# does.
 
 env:
+  # MAH_USERNAME / MAH_PASSWORD are deliberately NOT here: they are collected
+  # from each connector user at connect time (see `auth.fields` below), and an
+  # auth field may not name a host-set variable. Set them in .env only for a
+  # local, single-user install.
+  - name: MAH_DEVICE_FILE
+    required: false
+    help: >-
+      Override the session-state file path. Defaults to device.json under the
+      data directory, which is where it belongs when hosted — and with
+      per-user children each caller gets their own.
   - name: MAH_WS_PORT
     required: false
     help: >-
-      Override the fetchproxy WebSocket concentrator port (default 37149). A
-      hosted registration must set this so the runner can inject a
-      per-registration port.
+      fetchproxy WebSocket concentrator port (default 37149). Only meaningful for
+      the browser-bridge fallback; ignored on the credential path.
+
+identity:
+  # One child per caller. Required for `auth` below, and right on its own merits:
+  # these are personal health records, so two people sharing one child would
+  # share one signed-in session.
+  perUserChild: true
+
+auth:
+  # Collected once, on the connector's authorize page, before any tool runs.
+  fields:
+    - name: MAH_USERNAME
+      label: MyAtriumHealth username
+      type: text
+      required: true
+      help: The username you use at my.atriumhealth.org — not your email, unless that is your username.
+    - name: MAH_PASSWORD
+      label: Password
+      type: password
+      required: true
+      help: >-
+        Your MyAtriumHealth password. It is stored as a per-user secret and is
+        never shown again. The portal counts failed sign-ins and escalates to a
+        captcha, so nothing here retries for you.
+
+  # The portal challenges every fresh sign-in, so the connection cannot finish
+  # on username and password alone — hence a flow. There is no `capture`: the
+  # child persists its own session under its per-user data directory, so there
+  # is no durable credential to hand back.
+  flow:
+    steps:
+      - tool: mah_sign_in
+        title: Sign in to MyAtriumHealth
+        description: >-
+          Sends the username and password you just entered. MyAtriumHealth
+          challenges a sign-in from a new device, so expect to be asked for a
+          verification code next. Your password is not what the remaining steps
+          are about.
+      - tool: mah_send_verification_code
+        args:
+          channel: { from: channel }
+        prompt:
+          - name: channel
+            label: Where should MyAtriumHealth send your code?
+            type: choice
+            options:
+              - { value: sms, label: Text message }
+              - { value: email, label: Email }
+            help: >-
+              It goes to the number or address on your MyAtriumHealth account.
+              Codes are short-lived, so pick the one you can read right now.
+        title: Choose where your code goes
+        description: >-
+          If a channel is refused it is not configured on your account — start
+          the connection again and choose the other one.
+      - tool: mah_verify_code
+        args:
+          code: { from: code }
+        prompt:
+          - name: code
+            label: Verification code
+            type: text
+            help: >-
+              The code MyAtriumHealth just sent you. Codes are single-use and
+              expire quickly; if yours has lapsed, start the connection again
+              and a fresh one will be sent.
+        title: Enter the code
+        description: >-
+          This finishes the connection and stores the session, so restarts
+          resume without signing in again. When the session eventually lapses,
+          the same three steps run in the conversation — nothing needs
+          reconnecting.
 
 state:
   dataDir: true
   reason: >-
-    The fetchproxy identity lives at $HOME/.fetchproxy/identity/myatriumhealth-mcp.json
-    and the pair code derives from it. Without persistence every cold start mints a
-    fresh identity and re-prompts pairing in the user's browser. The API also requires
-    dataDir for any bridged registration.
+    Holds device.json — one per caller, since identity.perUserChild is set —
+    which stores the LIVE SESSION COOKIE JAR (plus the portal's
+    device-trust token, recorded but never sent). That jar is what lets a restart
+    resume an existing session. Without persistence every cold start signs in
+    again and, because this portal challenges a fresh sign-in, prompts the account
+    holder for a verification code — on a scale-to-zero machine, repeatedly. The
+    file is written 0600 and is credential-equivalent: anyone who can read it can
+    act as the account until the session lapses.
 
 egress:
-  # Server-side fetches all go through the bridge to this host. No other host is
-  # contacted: the client fetches only paths under my.atriumhealth.org/myatriumhealth.
+  # The only host contacted. On the credential path the server fetches paths under
+  # my.atriumhealth.org/myatriumhealth directly; on the bridge fallback the same
+  # host is reached through the user's tab. No other host appears as a fetch base.
   allow:
     - my.atriumhealth.org

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrischall/myatriumhealth-mcp",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "MCP server for MyAtriumHealth (Atrium Health's Epic MyChart patient portal) via the fetchproxy browser bridge.",
   "type": "module",
   "bin": {

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/myatriumhealth-mcp",
     "source": "github"
   },
-  "version": "0.1.0",
+  "version": "0.2.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@chrischall/myatriumhealth-mcp",
-      "version": "0.1.0",
+      "version": "0.2.0",
       "transport": {
         "type": "stdio"
       },