@chrischall/myatriumhealth-mcp 1.2.1 → 1.3.0

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Angi — find home-service pros by trade and city, read ratings, reviews and pro profiles. Angi serves its pages only to a real browser, so requests route through the user's own angi.com tab via the fetchproxy browser extension, reusing their existing session. The trade/city taxonomy is read from Angi's public sitemaps directly.",
-    "version": "1.2.1"
+    "version": "1.3.0"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "MyAtriumHealth",
       "source": "./",
       "description": "Read MyAtriumHealth (Epic MyChart) records — test results, medications, allergies, immunizations, health issues, visits — by relaying requests through the user's signed-in browser tab via the fetchproxy bridge.",
-      "version": "1.2.1",
+      "version": "1.3.0",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "myatriumhealth-mcp",
   "displayName": "MyAtriumHealth",
-  "version": "1.2.1",
+  "version": "1.3.0",
   "description": "MyAtriumHealth (Epic MyChart) access for Claude — test results, medications, allergies, immunizations, visits",
   "author": {
     "name": "Chris Hall",

package/README.md

@@ -112,6 +112,9 @@ call prints a pair code — approve it once in the Transporter popup.
 | `MAH_DEVICE_FILE` | `~/.myatriumhealth-mcp/device.json` | Session state (0600). Holds the **live cookie jar** as well as the device token — treat as a credential. |
 | `MAH_WS_PORT` | `37149` | fetchproxy concentrator port (bridge mode only). The whole fleet shares this one port; override only when hosting. |
 | `MAH_READ_ONLY` | `false` | `true` refuses `mah_reply_message` sends (previews still work). The tool stays listed either way. |
+| `MCP_CONFIRM_MODE` | `ask-user` | What a reply does on a client that cannot show a confirmation prompt (claude.ai, Claude Desktop). `ask-user`: two steps — the first call sends nothing and returns a preview plus a token, and the model must get your approval in chat before calling again with it. `auto`: the same two steps, but the model may use the token after reviewing the preview itself. `refuse`: replies are refused on such clients. A client that can show prompts (Claude Code) always gets the real prompt. An unrecognised value is treated as `refuse`. |
+| `MCP_CONFIRM_TTL_SECONDS` | `600` | How long a token stays valid. |
+| `MCP_CONFIRM_SECRET` | random per process | Signing key; set it only if tokens must survive a server restart. |
 
 ## Tools
 
@@ -135,7 +138,7 @@ stated rather than inferred.
 | `mah_get_health_summary` | Health-summary header and action plans |
 | `mah_list_message_folders` | Message Center folders with unread counts |
 | `mah_list_messages` | Message Center conversations for a folder, each with the `conversationId` to reply to |
-| `mah_reply_message` | Reply to a conversation as the active patient — previews unless `confirm: true` *(irreversible)* |
+| `mah_reply_message` | Reply to a conversation as the active patient — asks you to confirm first: a prompt where the client supports one, otherwise a preview and a `confirmToken` *(irreversible)* |
 | `mah_list_insurance` | Insurance coverages on file |
 | `mah_list_care_team` | Care team providers, internal and external |
 | `mah_list_billing_accounts` | Billing accounts and balances (parsed from HTML) |
@@ -147,7 +150,7 @@ stated rather than inferred.
 | `mah_verify_code` | Submit the code the user received *(needs credentials)* |
 | `mah_list_patients` | The patients this login can open — the account holder and any proxy subjects |
 | `mah_get_patient_context` | Which patient the readers are serving, confirmed with the portal |
-| `mah_set_active_patient` | Point every reader at one of those patients; survives restarts |
+| `mah_set_active_patient` | Point every reader at one of those patients; survives restarts. Through the browser bridge this switches your own tab too, and a read refuses rather than switching it back if you change patients there |
 
 Every reading tool takes `view`: `compact` (the default) or `full`. The raw envelopes
 are large — test results ~33 KB, medications ~30 KB — so `compact` is what you want for
@@ -194,8 +197,22 @@ local organization returns HTTP 500. The client assembles this from
 `mah_reply_message` takes a `conversationId` from `mah_list_messages`, a plain-text
 `body`, and optionally `attachments`. It replies **as whichever patient is active**.
 
-- **It previews by default.** Without `confirm: true` it returns the thread, recipients
-  and body and sends nothing. The send itself is irreversible and provider-visible.
+- **It asks before it sends.** A client that can show a confirmation prompt (Claude
+  Code) gets one with the thread, recipients, body and attachments. Elsewhere the first
+  call sends nothing and returns that preview plus a `confirmToken`; only a repeat call
+  with the same arguments and that token sends. `MCP_CONFIRM_MODE` (above) decides
+  whether the model must get your approval in chat before using it (`ask-user`, the
+  default), may use it itself (`auto`), or is refused (`refuse`). The send itself is
+  irreversible and provider-visible.
+- **A send must follow its own preview.** The token is bound to the patient, thread,
+  recipients, body and attachments the preview showed (the fleet's shared mechanism from
+  `@chrischall/mcp-utils`). Anything else is refused: a different reply or thread
+  (`DRAFT_CHANGED`, with the new preview and a fresh token), after 10 minutes
+  (`TOKEN_EXPIRED`), a token already used (`TOKEN_REUSED`) or not issued for this reply
+  (`TOKEN_INVALID`). Each preview authorizes one send, and the token is spent once the send
+  is authorized, so any retry, even after a failure before anything went out, needs a
+  fresh preview. So message text the model has read cannot talk it into a one-call send
+  the user never saw.
 - **`MAH_READ_ONLY=true` refuses every send.** The tool stays registered — a hosted
   connector publishes the tool list of a child with no env of its own, so a tool that
   registered only when writes were allowed would disappear for everyone.