@chrischall/myatriumhealth-mcp 0.1.1 → 0.2.0

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Angi — find home-service pros by trade and city, read ratings, reviews and pro profiles. Angi serves its pages only to a real browser, so requests route through the user's own angi.com tab via the fetchproxy browser extension, reusing their existing session. The trade/city taxonomy is read from Angi's public sitemaps directly.",
-    "version": "0.1.1"
+    "version": "0.2.0"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "MyAtriumHealth",
       "source": "./",
       "description": "Read MyAtriumHealth (Epic MyChart) records — test results, medications, allergies, immunizations, health issues, visits — by relaying requests through the user's signed-in browser tab via the fetchproxy bridge.",
-      "version": "0.1.1",
+      "version": "0.2.0",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "myatriumhealth-mcp",
   "displayName": "MyAtriumHealth",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "MyAtriumHealth (Epic MyChart) access for Claude — test results, medications, allergies, immunizations, visits",
   "author": {
     "name": "Chris Hall",

package/dist/bundle.js

@@ -39884,6 +39884,7 @@ var MyAtriumHealthAuth = class {
     if (/SecondaryValidation/i.test(nextLocation) || /SecondaryValidation/i.test(landing.body)) {
       const ctx = await this.challengeContext();
       this.mfaPending = true;
+      this.persist();
       throw new MfaRequiredError(ctx?.channels ?? ["sms", "email"], {
         ...ctx?.displayEmail !== void 0 ? { email: ctx.displayEmail } : {},
         ...ctx?.displayPhone !== void 0 ? { phone: ctx.displayPhone } : {}
@@ -49417,7 +49418,7 @@ function registerVisitTools(server, client2) {
 }
 
 // src/version.ts
-var VERSION = "0.1.1";
+var VERSION = "0.2.0";
 
 // src/index.ts
 var username = readEnvVar("MAH_USERNAME");

package/mint.yaml

@@ -21,34 +21,98 @@ slug: myatriumhealth
 # does.
 
 env:
-  - name: MAH_USERNAME
-    secret: true
-    required: true
-    help: >-
-      MyAtriumHealth portal username. Required together with MAH_PASSWORD — a
-      hosted registration cannot use the browser-bridge fallback, so without both
-      the child boots but every tool fails.
-  - name: MAH_PASSWORD
-    secret: true
-    required: true
-    help: >-
-      Portal password. Setting only one of the pair falls back to bridge mode
-      (the server warns on stderr), which is not usable when hosted.
+  # MAH_USERNAME / MAH_PASSWORD are deliberately NOT here: they are collected
+  # from each connector user at connect time (see `auth.fields` below), and an
+  # auth field may not name a host-set variable. Set them in .env only for a
+  # local, single-user install.
   - name: MAH_DEVICE_FILE
     required: false
     help: >-
       Override the session-state file path. Defaults to device.json under the
-      data directory, which is where it belongs when hosted.
+      data directory, which is where it belongs when hosted — and with
+      per-user children each caller gets their own.
   - name: MAH_WS_PORT
     required: false
     help: >-
       fetchproxy WebSocket concentrator port (default 37149). Only meaningful for
       the browser-bridge fallback; ignored on the credential path.
 
+identity:
+  # One child per caller. Required for `auth` below, and right on its own merits:
+  # these are personal health records, so two people sharing one child would
+  # share one signed-in session.
+  perUserChild: true
+
+auth:
+  # Collected once, on the connector's authorize page, before any tool runs.
+  fields:
+    - name: MAH_USERNAME
+      label: MyAtriumHealth username
+      type: text
+      required: true
+      help: The username you use at my.atriumhealth.org — not your email, unless that is your username.
+    - name: MAH_PASSWORD
+      label: Password
+      type: password
+      required: true
+      help: >-
+        Your MyAtriumHealth password. It is stored as a per-user secret and is
+        never shown again. The portal counts failed sign-ins and escalates to a
+        captcha, so nothing here retries for you.
+
+  # The portal challenges every fresh sign-in, so the connection cannot finish
+  # on username and password alone — hence a flow. There is no `capture`: the
+  # child persists its own session under its per-user data directory, so there
+  # is no durable credential to hand back.
+  flow:
+    steps:
+      - tool: mah_sign_in
+        title: Sign in to MyAtriumHealth
+        description: >-
+          Sends the username and password you just entered. MyAtriumHealth
+          challenges a sign-in from a new device, so expect to be asked for a
+          verification code next. Your password is not what the remaining steps
+          are about.
+      - tool: mah_send_verification_code
+        args:
+          channel: { from: channel }
+        prompt:
+          - name: channel
+            label: Where should MyAtriumHealth send your code?
+            type: choice
+            options:
+              - { value: sms, label: Text message }
+              - { value: email, label: Email }
+            help: >-
+              It goes to the number or address on your MyAtriumHealth account.
+              Codes are short-lived, so pick the one you can read right now.
+        title: Choose where your code goes
+        description: >-
+          If a channel is refused it is not configured on your account — start
+          the connection again and choose the other one.
+      - tool: mah_verify_code
+        args:
+          code: { from: code }
+        prompt:
+          - name: code
+            label: Verification code
+            type: text
+            help: >-
+              The code MyAtriumHealth just sent you. Codes are single-use and
+              expire quickly; if yours has lapsed, start the connection again
+              and a fresh one will be sent.
+        title: Enter the code
+        description: >-
+          This finishes the connection and stores the session, so restarts
+          resume without signing in again. When the session eventually lapses,
+          the same three steps run in the conversation — nothing needs
+          reconnecting.
+
 state:
   dataDir: true
   reason: >-
-    Holds device.json, which stores the LIVE SESSION COOKIE JAR (plus the portal's
+    Holds device.json — one per caller, since identity.perUserChild is set —
+    which stores the LIVE SESSION COOKIE JAR (plus the portal's
     device-trust token, recorded but never sent). That jar is what lets a restart
     resume an existing session. Without persistence every cold start signs in
     again and, because this portal challenges a fresh sign-in, prompts the account

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrischall/myatriumhealth-mcp",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "MCP server for MyAtriumHealth (Atrium Health's Epic MyChart patient portal) via the fetchproxy browser bridge.",
   "type": "module",
   "bin": {

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/myatriumhealth-mcp",
     "source": "github"
   },
-  "version": "0.1.1",
+  "version": "0.2.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@chrischall/myatriumhealth-mcp",
-      "version": "0.1.1",
+      "version": "0.2.0",
       "transport": {
         "type": "stdio"
       },