@chrischall/myatriumhealth-mcp 1.3.3 → 1.3.5

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for MyAtriumHealth (Atrium Health's Epic MyChart patient portal) — test results, medications, allergies, immunizations, health issues, visits and messages. Requests relay through the user's own signed-in browser tab via the ContextMint Bridge extension, reusing their existing session.",
-    "version": "1.3.3"
+    "version": "1.3.5"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "MyAtriumHealth",
       "source": "./",
       "description": "Read MyAtriumHealth (Epic MyChart) records — test results, medications, allergies, immunizations, health issues, visits — by relaying requests through the user's signed-in browser tab via the ContextMint Bridge extension.",
-      "version": "1.3.3",
+      "version": "1.3.5",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "myatriumhealth-mcp",
   "displayName": "MyAtriumHealth",
-  "version": "1.3.3",
+  "version": "1.3.5",
   "description": "MyAtriumHealth (Epic MyChart) access for Claude — test results, medications, allergies, immunizations, visits",
   "author": {
     "name": "Chris Hall",

package/README.md

@@ -125,7 +125,8 @@ first call prints a pair code — approve it once in the ContextMint Bridge popu
 | `MAH_DEVICE_FILE` | `~/.myatriumhealth-mcp/device.json` | Session state (0600). Holds the **live cookie jar** as well as the device token — treat as a credential. |
 | `MAH_WS_PORT` | `37149` | fetchproxy concentrator port (bridge mode only). The whole fleet shares this one port; override only when hosting. |
 | `MAH_READ_ONLY` | `false` | `true` refuses `mah_reply_message` sends (previews still work). The tool stays listed either way. |
-| `MCP_CONFIRM_MODE` | `ask-user` | What a reply does on a client that cannot show a confirmation prompt (claude.ai, Claude Desktop). `ask-user`: two steps — the first call sends nothing and returns a preview plus a token, and the model must get your approval in chat before calling again with it. `auto`: the same two steps, but the model may use the token after reviewing the preview itself. `refuse`: replies are refused on such clients. A client that can show prompts (Claude Code) always gets the real prompt. An unrecognised value is treated as `refuse`. |
+| `MCP_CONFIRM_MODE` | `ask-user` | What a reply does on a client that cannot show a confirmation prompt (claude.ai, Claude Desktop). `ask-user`: two steps — the first call sends nothing and returns a preview plus a token, and the model must get your approval in chat before calling again with it. `auto`: the same two steps, but the model may use the token after reviewing the preview itself. `refuse`: replies are refused on such clients. A client that can show prompts (Claude Code) always gets the real prompt, unless `MCP_CONFIRM_ELICITATION=off`. An unrecognised value is treated as `refuse`. |
+| `MCP_CONFIRM_ELICITATION` | `on` | `off` never shows a confirmation prompt, so every client gets the `MCP_CONFIRM_MODE` path. Set it for a client that claims to support prompts but never shows one (the reply hangs — opencode 2.0.x). Any other value stays `on`, with a warning on stderr. |
 | `MCP_CONFIRM_TTL_SECONDS` | `600` | How long a token stays valid. |
 | `MCP_CONFIRM_SECRET` | random per process | Signing key; set it only if tokens must survive a server restart. |
 
@@ -213,7 +214,8 @@ local organization returns HTTP 500. The client assembles this from
 `body`, and optionally `attachments`. It replies **as whichever patient is active**.
 
 - **It asks before it sends.** A client that can show a confirmation prompt (Claude
-  Code) gets one with the thread, recipients, body and attachments. Elsewhere the first
+  Code) gets one with the thread, recipients, body and attachments, unless
+  `MCP_CONFIRM_ELICITATION=off`. Elsewhere the first
   call sends nothing and returns that preview plus a `confirmToken`; only a repeat call
   with the same arguments and that token sends. `MCP_CONFIRM_MODE` (above) decides
   whether the model must get your approval in chat before using it (`ask-user`, the

package/dist/bundle.js

@@ -20693,8 +20693,8 @@ var require_schemas2 = __commonJS({
       return core._stringFormat(exports.ZodCustomStringFormat, "currency_code", regexes.currencyCode, _params);
     }
     function hash2(alg, params) {
-      const enc6 = params?.enc ?? "hex";
-      const format = `${alg}_${enc6}`;
+      const enc7 = params?.enc ?? "hex";
+      const format = `${alg}_${enc7}`;
       const regex = core.regexes[format];
       if (!regex)
         throw new Error(`Unrecognized hash format: ${format}`);
@@ -25993,11 +25993,23 @@ var require_websocket = __commonJS({
           this._isServer = false;
           this._redirects = 0;
           if (protocols === void 0) {
-            protocols = [];
+            if (!options || options.protocols === void 0) {
+              protocols = [];
+            } else if (Array.isArray(options.protocols)) {
+              protocols = options.protocols;
+            } else {
+              protocols = [options.protocols];
+            }
           } else if (!Array.isArray(protocols)) {
             if (typeof protocols === "object" && protocols !== null) {
               options = protocols;
-              protocols = [];
+              if (options.protocols === void 0) {
+                protocols = [];
+              } else if (Array.isArray(options.protocols)) {
+                protocols = options.protocols;
+              } else {
+                protocols = [options.protocols];
+              }
             } else {
               protocols = [protocols];
             }
@@ -26194,7 +26206,6 @@ var require_websocket = __commonJS({
           }
           return;
         }
-        this._readyState = _WebSocket.CLOSING;
         this._sender.close(code2, data, !this._isServer, (err) => {
           if (err) return;
           this._closeFrameSent = true;
@@ -26202,6 +26213,7 @@ var require_websocket = __commonJS({
             this._socket.end();
           }
         });
+        this._readyState = _WebSocket.CLOSING;
         setCloseTimer(this);
       }
       /**
@@ -26426,6 +26438,7 @@ var require_websocket = __commonJS({
         socketPath: void 0,
         hostname: void 0,
         protocol: void 0,
+        protocols: void 0,
         timeout: void 0,
         method: "GET",
         host: void 0,
@@ -28408,7 +28421,7 @@ var OAuthTokenRevocationRequestSchema = z.object({
   token_type_hint: z.string().optional()
 }).strip();
 
-// node_modules/@modelcontextprotocol/server/dist/src-BHSMhZ_W.mjs
+// node_modules/@modelcontextprotocol/server/dist/src-Cqbh3MYc.mjs
 var z2 = __toESM(require_v4(), 1);
 var BRANDS = /* @__PURE__ */ Symbol.for("mcp.sdk.errorBrands");
 function stampErrorBrands(instance, ctor) {
@@ -30652,7 +30665,8 @@ function build() {
     ListResourceTemplatesResultResponseSchema: wireResultResponse(ListResourceTemplatesResultSchema$1),
     ReadResourceResultResponseSchema: wireResultResponse(z2.union([ReadResourceResultSchema$1, InputRequiredResultSchema])),
     CompleteResultResponseSchema: wireResultResponse(CompleteResultSchema$1),
-    DiscoverResultResponseSchema: wireResultResponse(DiscoverResultSchema$1)
+    DiscoverResultResponseSchema: wireResultResponse(DiscoverResultSchema$1),
+    SubscriptionsListenResultResponseSchema: wireResultResponse(SubscriptionsListenResultSchema$1)
   };
 }
 var memo;
@@ -31160,6 +31174,9 @@ function isSpecRequestMethod(method) {
 function isSpecNotificationMethod(method) {
   return ALL_CODECS.some((codec2) => codec2.hasNotificationMethod(method));
 }
+function isExtensionReusedRequestMethod(method) {
+  return method === "tasks/get" || method === "tasks/cancel";
+}
 var ALL_CODECS = [rev2025Codec, rev2026Codec];
 function isPlainObject$3(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -32168,6 +32185,8 @@ var Protocol = class {
   _transport;
   _requestMessageId = 0;
   _requestHandlers = /* @__PURE__ */ new Map();
+  /** Methods registered with an explicit schema; the era gate in `_onrequest` reads it for the Tasks extension names. */
+  _customSchemaRequestMethods = /* @__PURE__ */ new Set();
   _requestHandlerAbortControllers = /* @__PURE__ */ new Map();
   _notificationHandlers = /* @__PURE__ */ new Map();
   _responseHandlers = /* @__PURE__ */ new Map();
@@ -32451,7 +32470,7 @@ var Protocol = class {
         return;
       }
     }
-    if (isSpecRequestMethod(request.method) && !codec2.hasRequestMethod(request.method)) {
+    if (isSpecRequestMethod(request.method) && !codec2.hasRequestMethod(request.method) && !(isExtensionReusedRequestMethod(request.method) && this._customSchemaRequestMethods.has(request.method))) {
       sendErrorResponse(ProtocolErrorCode.MethodNotFound, "Method not found");
       return;
     }
@@ -32584,8 +32603,11 @@ var Protocol = class {
   }
   request(request, schemaOrOptions, maybeOptions) {
     const codec2 = this._resolveOutboundCodec(request.method);
+    if (isStandardSchema(schemaOrOptions)) {
+      if (!isExtensionReusedRequestMethod(request.method)) this._assertOutboundRequestInEra(codec2, request.method);
+      return this._requestWithSchemaViaCodec(codec2, request, schemaOrOptions, maybeOptions);
+    }
     this._assertOutboundRequestInEra(codec2, request.method);
-    if (isStandardSchema(schemaOrOptions)) return this._requestWithSchemaViaCodec(codec2, request, schemaOrOptions, maybeOptions);
     const validate2 = codecResultValidator(codec2, request.method);
     if (validate2 === void 0) throw new TypeError(`'${request.method}' is not a spec method; pass a result schema as the second argument to request().`);
     return this._requestWithSchemaViaCodec(codec2, request, validate2, schemaOrOptions);
@@ -32829,6 +32851,8 @@ var Protocol = class {
       return maybeHandler(parsed.data, ctx);
     };
     else throw new TypeError("setRequestHandler: handler is required");
+    if (typeof schemasOrHandler === "function") this._customSchemaRequestMethods.delete(method);
+    else this._customSchemaRequestMethods.add(method);
     this._requestHandlers.set(method, this._wrapHandler(method, stored));
   }
   /**
@@ -32858,6 +32882,7 @@ var Protocol = class {
   */
   removeRequestHandler(method) {
     this._requestHandlers.delete(method);
+    this._customSchemaRequestMethods.delete(method);
   }
   /**
   * Asserts that a request handler has not already been set for the given method, in preparation for a new one being automatically installed.
@@ -40100,7 +40125,7 @@ var Ajv = import_ajv.Ajv;
 // node_modules/@modelcontextprotocol/server/dist/shimsNode.mjs
 import process2 from "node:process";
 
-// node_modules/@modelcontextprotocol/server/dist/mcp-DYuW2ZSs.mjs
+// node_modules/@modelcontextprotocol/server/dist/mcp-DIH4cS6P.mjs
 var COMPLETABLE_SYMBOL = /* @__PURE__ */ Symbol.for("mcp.completable");
 function isCompletable(schema) {
   return !!schema && typeof schema === "object" && COMPLETABLE_SYMBOL in schema;
@@ -40165,7 +40190,7 @@ var StdioListenRouter = class {
   _serverCapabilities;
   /**
   * The serving instance's identity, stamped onto the graceful-close
-  * results' `_meta` (the spec's `SubscriptionsListenResultMeta` extends
+  * results' `_meta` (the spec's `SubscriptionsListenResultMetaObject` extends
   * `ResultMetaObject`). Handed over together with the capabilities.
   */
   _serverInfo;
@@ -40497,6 +40522,11 @@ var Server = class extends Protocol {
     if (modernProtocolVersions(this._supportedProtocolVersions).length > 0) this.setRequestHandler("server/discover", () => this._ondiscover());
     if (this._capabilities.logging) this._registerLoggingHandler();
   }
+  /** Attaches to the given transport; rejects while this instance is connected to another one. */
+  async connect(transport2) {
+    if (this.transport !== void 0) throw new SdkError(SdkErrorCode.AlreadyConnected, "Use a separate Server instance per connection: this instance is already connected to a transport. To connect it to a new transport, call close() first.");
+    await super.connect(transport2);
+  }
   /**
   * Registers the built-in `logging/setLevel` request handler.
   *
@@ -41050,21 +41080,41 @@ var Server = class extends Protocol {
 function discoverAdvertisedCapabilities(capabilities) {
   return { ...capabilities };
 }
+function toolInputElementCount(value, max) {
+  let count = 0;
+  const stack = [value];
+  while (stack.length > 0) {
+    const node2 = stack.pop();
+    if (node2 === null || typeof node2 !== "object") continue;
+    if (Array.isArray(node2)) for (const child of node2) {
+      if (++count > max) return count;
+      if (child !== null && typeof child === "object") stack.push(child);
+    }
+    else for (const key in node2) {
+      if (!Object.prototype.hasOwnProperty.call(node2, key)) continue;
+      if (++count > max) return count;
+      const child = node2[key];
+      if (child !== null && typeof child === "object") stack.push(child);
+    }
+  }
+  return count;
+}
+function resolveMaxToolInputElements(value) {
+  if (value === void 0 || value === Infinity) return void 0;
+  if (typeof value !== "number" || Number.isNaN(value) || value < 1) throw new RangeError(`maxToolInputElements must be a number of at least 1, or Infinity, got ${String(value)}`);
+  return value;
+}
 var McpServer = class {
   /**
   * The underlying {@linkcode Server} instance, useful for advanced operations like sending notifications.
   */
   server;
+  _maxToolInputElements;
   _registeredResources = {};
   _registeredResourceTemplates = {};
   _registeredTools = {};
   _registeredPrompts = {};
-  /**
-  * Per-tool JSON-converted `inputSchema`, memoized so the SEP-2243
-  * registration-time scan and the pre-dispatch validation step share one
-  * conversion instead of paying it twice per request under the
-  * per-request-factory `createMcpHandler` model.
-  */
+  /** Per-tool JSON-converted `inputSchema`, filled on first use by `toolInputSchemaJson()`. */
   _toolInputSchemaJson = {};
   /**
   * The JSON-serialized `inputSchema` of a registered tool, or `undefined`
@@ -41089,6 +41139,7 @@ var McpServer = class {
   }
   constructor(serverInfo, options) {
     this.server = new Server(serverInfo, options);
+    this._maxToolInputElements = resolveMaxToolInputElements(options?.maxToolInputElements);
     if (options?.capabilities?.tools) this.setToolRequestHandlers();
     if (options?.capabilities?.resources) this.setResourceRequestHandlers();
     if (options?.capabilities?.prompts) this.setPromptRequestHandlers();
@@ -41161,7 +41212,7 @@ var McpServer = class {
         name,
         title: tool.title,
         description: tool.description,
-        inputSchema: tool.inputSchema ? standardSchemaToJsonSchema(tool.inputSchema, "input") : EMPTY_OBJECT_JSON_SCHEMA,
+        inputSchema: tool.inputSchema ? convertListedInputSchema(name, tool.inputSchema) : EMPTY_OBJECT_JSON_SCHEMA,
         annotations: tool.annotations,
         icons: tool.icons,
         execution: tool.execution,
@@ -41206,6 +41257,7 @@ var McpServer = class {
   * Validates tool input arguments against the tool's input schema.
   */
   async validateToolInput(tool, args, toolName) {
+    if (this._maxToolInputElements !== void 0 && toolInputElementCount(args, this._maxToolInputElements) > this._maxToolInputElements) throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Invalid arguments for tool ${toolName}: arguments contain more than the maximum of ${this._maxToolInputElements} elements`);
     if (!tool.inputSchema) return;
     const parseResult = await validateStandardSchema(tool.inputSchema, args ?? {});
     if (!parseResult.success) throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Input validation error: Invalid arguments for tool ${toolName}: ${parseResult.error}`);
@@ -41480,20 +41532,19 @@ var McpServer = class {
   }
   _createRegisteredTool(name, title, description, inputSchema, outputSchema, annotations, icons, execution, scopeChallenge, _meta, handler) {
     validateAndWarnToolName(name);
-    if (inputSchema !== void 0) try {
-      const json2 = standardSchemaToJsonSchema(inputSchema, "input");
-      this._toolInputSchemaJson[name] = json2;
-      const scan = scanXMcpHeaderDeclarations(json2);
-      if (!scan.valid) console.warn(`[mcp-sdk] tool '${name}' carries an invalid x-mcp-header declaration and will be excluded by conforming Streamable HTTP clients: ${scan.reason}`);
-    } catch {
-    }
     let currentHandler = handler;
+    let outputSchemaJson;
     const registeredTool = {
       title,
       description,
       inputSchema,
       outputSchema,
-      outputSchemaJson: convertOutputSchemaJson(outputSchema),
+      get outputSchemaJson() {
+        return outputSchemaJson ??= convertOutputSchemaJson(registeredTool.outputSchema);
+      },
+      set outputSchemaJson(value) {
+        outputSchemaJson = value;
+      },
       annotations,
       icons,
       execution,
@@ -41620,6 +41671,12 @@ var EMPTY_OBJECT_JSON_SCHEMA = {
   type: "object",
   properties: {}
 };
+function convertListedInputSchema(name, inputSchema) {
+  const json2 = standardSchemaToJsonSchema(inputSchema, "input");
+  const scan = scanXMcpHeaderDeclarations(json2);
+  if (!scan.valid) console.warn(`[mcp-sdk] tool '${name}' carries an invalid x-mcp-header declaration and will be excluded by conforming Streamable HTTP clients: ${scan.reason}`);
+  return json2;
+}
 function convertOutputSchemaJson(outputSchema) {
   if (outputSchema === void 0) return void 0;
   try {
@@ -41632,7 +41689,7 @@ function createPromptHandler(name, argsSchema, callback) {
   if (argsSchema) {
     const typedCallback = callback;
     return async (args, ctx) => {
-      const parseResult = await validateStandardSchema(argsSchema, args);
+      const parseResult = await validateStandardSchema(argsSchema, args ?? {});
       if (!parseResult.success) throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Invalid arguments for prompt ${name}: ${parseResult.error}`);
       return typedCallback(parseResult.data, ctx);
     };
@@ -59989,8 +60046,8 @@ function currencyCode2(_params) {
   return _stringFormat(ZodCustomStringFormat, "currency_code", currencyCode, _params);
 }
 function hash(alg, params) {
-  const enc6 = params?.enc ?? "hex";
-  const format = `${alg}_${enc6}`;
+  const enc7 = params?.enc ?? "hex";
+  const format = `${alg}_${enc7}`;
   const regex = regexes_exports[format];
   if (!regex)
     throw new Error(`Unrecognized hash format: ${format}`);
@@ -62065,6 +62122,7 @@ function escapeKey(key) {
 var DEFAULT_REQUEST_KEY = "confirmation";
 var DEFAULT_CONFIRMATION_LABEL = "Confirm this action should proceed.";
 var UNSUPPORTED_NOTE = "Nothing was done because this client cannot show a confirmation prompt (it declares no MCP elicitation capability), and this action is never taken without one";
+var DISABLED_NOTE = "Nothing was done because confirmation prompts are turned off for this server, and this action is never taken without one";
 var STATE_PREFIX = "mcpu.confirm.v1.";
 function bindingKey(binding) {
   if (binding.ttlSeconds !== void 0 && !(Number.isFinite(binding.ttlSeconds) && binding.ttlSeconds > 0)) {
@@ -62137,6 +62195,15 @@ ${JSON.stringify(preview, null, 2)}`,
   };
   const response = inputResponse(ctx.mcpReq.inputResponses, requestKey);
   const accepted = acceptedContent(ctx.mcpReq.inputResponses, requestKey, confirmationSchema);
+  if (options.elicitation === false) {
+    return textResult({
+      confirmed: false,
+      dispatched: false,
+      action: options.action,
+      reason: "confirmation-unsupported",
+      note: options.unsupportedNote ? `${DISABLED_NOTE}. ${options.unsupportedNote}` : `${DISABLED_NOTE}.`
+    });
+  }
   if (response.kind === "missing") {
     if (callerAcceptsFormElicitation(ctx) === false) {
       return textResult({
@@ -62331,7 +62398,7 @@ async function tokenConfirmation(action, fb) {
 }
 async function requireConfirmationWithFallback(ctx, options) {
   const { tokenFallback, ...confirmation } = options;
-  if (tokenFallback && callerAcceptsFormElicitation(ctx) === false) {
+  if (tokenFallback && (options.elicitation === false || callerAcceptsFormElicitation(ctx) === false)) {
     return tokenConfirmation(options.action, tokenFallback);
   }
   return requireConfirmation(ctx, confirmation);
@@ -62490,6 +62557,20 @@ function readConfirmMode(env = process.env) {
   }
   return "refuse";
 }
+function readConfirmElicitation(env = process.env) {
+  const raw = readEnvVar("MCP_CONFIRM_ELICITATION", { env })?.trim().toLowerCase();
+  if (!raw || raw === "on")
+    return "on";
+  if (raw === "off")
+    return "off";
+  const key = `elicitation:${raw}`;
+  if (!warned.has(key)) {
+    warned.add(key);
+    process.stderr.write(`MCP_CONFIRM_ELICITATION="${raw}" is not one of on, off; treating it as on.
+`);
+  }
+  return "on";
+}
 function readConfirmTtl(env) {
   const raw = readEnvVar("MCP_CONFIRM_TTL_SECONDS", { env })?.trim();
   if (!raw)
@@ -62534,6 +62615,7 @@ function spentTokenStoreFromEnv(env = process.env) {
 }
 var CONFIRM_TOKEN_AUTO_INSTRUCTION = "Nothing has been done yet. Review this preview; if it is what was intended, call again with the same arguments plus confirmToken. (This server runs with MCP_CONFIRM_MODE=auto, so the user's approval in chat is not required.)";
 var REFUSE_HINT = "Set MCP_CONFIRM_MODE=ask-user on the server to allow two-step confirmation instead.";
+var ELICITATION_OFF_HINT = "MCP_CONFIRM_ELICITATION=off on the server turns confirmation prompts off.";
 var BAD_TTL_HINT = "MCP_CONFIRM_TTL_SECONDS on the server is not a positive whole number of seconds; fix it to allow two-step confirmation.";
 function boundArgs(args) {
   if (args === null || typeof args !== "object" || Array.isArray(args) || !("confirmToken" in args))
@@ -62547,10 +62629,13 @@ function confirmationFromEnv(options) {
   const spent = callerSpent ?? spentTokenStoreFromEnv(env);
   const mode = readConfirmMode(env);
   const ttlSeconds = readConfirmTtl(env);
+  const elicitationOff = readConfirmElicitation(env) === "off";
   const bound = args === void 0 ? void 0 : boundArgs(args);
-  const confirmation = bound === void 0 || rest.binding ? rest : { ...rest, binding: { key: confirmKeyFromEnv(env), args: bound, ttlSeconds: ttlSeconds ?? DEFAULT_TTL_SECONDS2 } };
+  const bindingAdded = bound === void 0 || rest.binding ? rest : { ...rest, binding: { key: confirmKeyFromEnv(env), args: bound, ttlSeconds: ttlSeconds ?? DEFAULT_TTL_SECONDS2 } };
+  const confirmation = elicitationOff ? { ...bindingAdded, elicitation: false } : bindingAdded;
   if (mode === "refuse" || ttlSeconds === void 0) {
-    const hint = mode === "refuse" ? REFUSE_HINT : BAD_TTL_HINT;
+    const reason = mode === "refuse" ? REFUSE_HINT : BAD_TTL_HINT;
+    const hint = elicitationOff ? `${ELICITATION_OFF_HINT} ${reason}` : reason;
     return {
       ...confirmation,
       unsupportedNote: confirmation.unsupportedNote ? `${confirmation.unsupportedNote} ${hint}` : hint
@@ -62659,7 +62744,10 @@ function surfaceToolHints(server) {
   ));
 }
 async function createMcpServer(opts) {
-  const server = new McpServer({ name: opts.name, version: opts.version }, { supportedProtocolVersions: [...SERVER_PROTOCOL_VERSIONS] });
+  const server = new McpServer({ name: opts.name, version: opts.version }, {
+    supportedProtocolVersions: [...SERVER_PROTOCOL_VERSIONS],
+    ...opts.maxToolInputElements !== void 0 ? { maxToolInputElements: opts.maxToolInputElements } : {}
+  });
   if (opts.surfaceHints !== false)
     surfaceToolHints(server);
   if (opts.banner !== void 0) {
@@ -64482,6 +64570,60 @@ var KNOWN_CAPABILITIES = /* @__PURE__ */ new Set([
   "graphql",
   "write_cookies"
 ]);
+var ACCOUNT_KEY_FRAME = "account-key";
+var ACCOUNT_ATTEST_FRAME = "account-attest";
+var BRIDGE_ROLE_FRAME = "bridge-role";
+var BRIDGE_SERVE_FRAME = "bridge-serve";
+var ROOM_PING_FRAME = "room-ping";
+var ROOM_PONG_FRAME = "room-pong";
+var BRIDGE_ROLE_LABEL_MAX = 64;
+var ROOM_FRAME_ACCEPTS = Object.freeze({
+  [BRIDGE_ROLE_FRAME]: BRIDGE_ROLE_FRAME,
+  [BRIDGE_SERVE_FRAME]: BRIDGE_SERVE_FRAME,
+  [ROOM_PING_FRAME]: ROOM_PING_FRAME,
+  [ROOM_PONG_FRAME]: ROOM_PING_FRAME
+});
+
+// node_modules/@fetchproxy/protocol/dist/mcp-id.js
+var ID_RE = /^([^:]+):([^:]+):([0-9a-f]{16})$/;
+function generateMcpId(serverName, version2) {
+  if (serverName.includes(":")) {
+    throw new Error(`serverName cannot contain ':': ${serverName}`);
+  }
+  if (version2.includes(":")) {
+    throw new Error(`version cannot contain ':': ${version2}`);
+  }
+  const rand = randomHex(8);
+  return `${serverName}:${version2}:${rand}`;
+}
+function isValidMcpId(id) {
+  return typeof id === "string" && ID_RE.test(id);
+}
+function randomHex(bytes) {
+  const arr = new Uint8Array(bytes);
+  globalThis.crypto.getRandomValues(arr);
+  return Array.from(arr, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+
+// node_modules/@fetchproxy/protocol/dist/account-attest.js
+var ACCOUNT_ATTEST_CONSENTS = Object.freeze([
+  "silent",
+  "confirm",
+  "confirm-each"
+]);
+var NO_SCOPE_DIGEST = "0".repeat(64);
+var ACCOUNT_ID_RE = /^[A-Za-z0-9_.\-]{1,128}$/;
+var HEX64_RE = /^[0-9a-f]{64}$/;
+var ACCOUNT_KID_RE = /^[0-9a-f]{16}$/;
+var enc2 = new TextEncoder();
+
+// node_modules/@fetchproxy/protocol/dist/awaiting-approval.js
+var AWAITING_APPROVAL_REASON_PREFIX = "awaiting-approval:";
+function parseAwaitingApprovalReason(reason) {
+  if (!reason.startsWith(AWAITING_APPROVAL_REASON_PREFIX))
+    return null;
+  return reason.slice(AWAITING_APPROVAL_REASON_PREFIX.length).trim();
+}
 
 // node_modules/@fetchproxy/protocol/dist/capability-availability.js
 var CAPABILITY_UNAVAILABLE_CODE = "capability_unavailable";
@@ -64507,27 +64649,6 @@ function parseUnsupportedCapabilityReason(reason) {
   return rest.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
 }
 
-// node_modules/@fetchproxy/protocol/dist/mcp-id.js
-var ID_RE = /^([^:]+):([^:]+):([0-9a-f]{16})$/;
-function generateMcpId(serverName, version2) {
-  if (serverName.includes(":")) {
-    throw new Error(`serverName cannot contain ':': ${serverName}`);
-  }
-  if (version2.includes(":")) {
-    throw new Error(`version cannot contain ':': ${version2}`);
-  }
-  const rand = randomHex(8);
-  return `${serverName}:${version2}:${rand}`;
-}
-function isValidMcpId(id) {
-  return typeof id === "string" && ID_RE.test(id);
-}
-function randomHex(bytes) {
-  const arr = new Uint8Array(bytes);
-  globalThis.crypto.getRandomValues(arr);
-  return Array.from(arr, (b) => b.toString(16).padStart(2, "0")).join("");
-}
-
 // node_modules/@fetchproxy/protocol/dist/json-pointer.js
 function matchesDeclaredKey(requested, declared) {
   for (const decl of declared) {
@@ -65123,6 +65244,16 @@ function validateFrame(raw) {
     return { type: "extension-disconnected" };
   if (t === "peer-gone")
     return validatePeerGone(raw);
+  if (t === ACCOUNT_KEY_FRAME)
+    return validateAccountKey(raw);
+  if (t === ACCOUNT_ATTEST_FRAME)
+    return validateAccountAttest(raw);
+  if (t === BRIDGE_ROLE_FRAME)
+    return validateBridgeRole(raw);
+  if (t === BRIDGE_SERVE_FRAME || t === ROOM_PING_FRAME || t === ROOM_PONG_FRAME) {
+    assertExactFields(raw, TYPE_ONLY_FIELDS, t);
+    return { type: t };
+  }
   throw new ProtocolError3(`unknown frame type: ${String(t)}`);
 }
 function validateHello(raw) {
@@ -65326,6 +65457,165 @@ function validateHelloRejected(raw) {
   }
   return { type: "hello-rejected", mcpId: raw.mcpId, reason: raw.reason };
 }
+var DISPLAY_FORBIDDEN_RE = /[\u0000-\u001f\u007f-\u009f\u200e\u200f\u202a-\u202e\u2066-\u2069]/;
+function assertExactFields(raw, allowed, label) {
+  for (const k of Object.keys(raw)) {
+    if (!allowed.includes(k)) {
+      throw new ProtocolError3(`${label}: unexpected field ${JSON.stringify(k)}`);
+    }
+  }
+}
+function assertMatch(x, re, label, what) {
+  assertString(x, label);
+  if (!re.test(x))
+    throw new ProtocolError3(`${label}: must be ${what}`);
+}
+function assertPositiveSafeInt(x, label) {
+  if (typeof x !== "number" || !Number.isSafeInteger(x) || x <= 0) {
+    throw new ProtocolError3(`${label}: expected positive safe integer`);
+  }
+}
+function assertDisplayString(x, label, min, max) {
+  assertString(x, label);
+  if (x.length < min || x.length > max) {
+    throw new ProtocolError3(`${label}: must be ${min}-${max} characters`);
+  }
+  if (DISPLAY_FORBIDDEN_RE.test(x)) {
+    throw new ProtocolError3(`${label}: control or bidi-override character`);
+  }
+}
+var ACCOUNT_KEY_FIELDS = [
+  "type",
+  "accountId",
+  "slug",
+  "displayName",
+  "confirmedBy",
+  "tokenId",
+  "kid",
+  "publicKey",
+  "generation",
+  "bridgedRegistrations"
+];
+function validateAccountKey(raw) {
+  const L = "account-key";
+  assertMatch(raw.accountId, ACCOUNT_ID_RE, `${L}.accountId`, "an account id");
+  assertMatch(raw.slug, ACCOUNT_ID_RE, `${L}.slug`, "a slug");
+  assertDisplayString(raw.displayName, `${L}.displayName`, 0, 128);
+  assertDisplayString(raw.confirmedBy, `${L}.confirmedBy`, 1, 256);
+  assertMatch(raw.tokenId, ACCOUNT_ID_RE, `${L}.tokenId`, "a token id");
+  assertMatch(raw.kid, ACCOUNT_KID_RE, `${L}.kid`, "16 lowercase hex");
+  assertBase64Bytes(raw.publicKey, `${L}.publicKey`, 32);
+  assertPositiveSafeInt(raw.generation, `${L}.generation`);
+  const n = raw.bridgedRegistrations;
+  if (typeof n !== "number" || !Number.isSafeInteger(n) || n < 0) {
+    throw new ProtocolError3(`${L}.bridgedRegistrations: expected non-negative safe integer`);
+  }
+  assertExactFields(raw, ACCOUNT_KEY_FIELDS, L);
+  return {
+    type: ACCOUNT_KEY_FRAME,
+    accountId: raw.accountId,
+    slug: raw.slug,
+    displayName: raw.displayName,
+    confirmedBy: raw.confirmedBy,
+    tokenId: raw.tokenId,
+    kid: raw.kid,
+    publicKey: raw.publicKey,
+    generation: raw.generation,
+    bridgedRegistrations: n
+  };
+}
+var ACCOUNT_ATTEST_FIELDS = [
+  "type",
+  "mcpId",
+  "accountId",
+  "generation",
+  "tokenId",
+  "kid",
+  "registrationId",
+  "slug",
+  "identityHash",
+  "identityEd25519Pub",
+  "scopeDigest",
+  "consent",
+  "notAfter",
+  "sig"
+];
+function validateAccountAttest(raw) {
+  const L = "account-attest";
+  if (!isValidMcpId(raw.mcpId))
+    throw new ProtocolError3(`${L}.mcpId: invalid format`);
+  assertMatch(raw.accountId, ACCOUNT_ID_RE, `${L}.accountId`, "an account id");
+  assertPositiveSafeInt(raw.generation, `${L}.generation`);
+  assertMatch(raw.tokenId, ACCOUNT_ID_RE, `${L}.tokenId`, "a token id");
+  assertMatch(raw.kid, ACCOUNT_KID_RE, `${L}.kid`, "16 lowercase hex");
+  assertMatch(raw.registrationId, ACCOUNT_ID_RE, `${L}.registrationId`, "a registration id");
+  assertMatch(raw.slug, ACCOUNT_ID_RE, `${L}.slug`, "a slug");
+  assertMatch(raw.identityHash, HEX64_RE, `${L}.identityHash`, "64 lowercase hex");
+  assertBase64Bytes(raw.identityEd25519Pub, `${L}.identityEd25519Pub`, 32);
+  assertMatch(raw.scopeDigest, HEX64_RE, `${L}.scopeDigest`, "64 lowercase hex");
+  assertString(raw.consent, `${L}.consent`);
+  const consent = raw.consent;
+  const known = ACCOUNT_ATTEST_CONSENTS.find((c) => c === consent);
+  if (known === void 0) {
+    throw new ProtocolError3(`${L}.consent: must be one of ${ACCOUNT_ATTEST_CONSENTS.join(", ")}`);
+  }
+  assertPositiveSafeInt(raw.notAfter, `${L}.notAfter`);
+  assertBase64Bytes(raw.sig, `${L}.sig`, 64);
+  assertExactFields(raw, ACCOUNT_ATTEST_FIELDS, L);
+  return {
+    type: ACCOUNT_ATTEST_FRAME,
+    mcpId: raw.mcpId,
+    accountId: raw.accountId,
+    generation: raw.generation,
+    tokenId: raw.tokenId,
+    kid: raw.kid,
+    registrationId: raw.registrationId,
+    slug: raw.slug,
+    identityHash: raw.identityHash,
+    identityEd25519Pub: raw.identityEd25519Pub,
+    scopeDigest: raw.scopeDigest,
+    consent: known,
+    notAfter: raw.notAfter,
+    sig: raw.sig
+  };
+}
+var TYPE_ONLY_FIELDS = ["type"];
+var BRIDGE_ROLE_FIELDS = ["type", "role", "canServe", "serving"];
+var BRIDGE_ROLE_SERVING_FIELDS = ["label", "since"];
+function validateBridgeRole(raw) {
+  const L = BRIDGE_ROLE_FRAME;
+  const role = raw.role;
+  if (role !== "serving" && role !== "standby") {
+    throw new ProtocolError3(`${L}.role: must be one of serving, standby`);
+  }
+  const canServe = raw.canServe;
+  assertBoolean(canServe, `${L}.canServe`);
+  assertExactFields(raw, BRIDGE_ROLE_FIELDS, L);
+  const serving = raw.serving;
+  if (role === "serving") {
+    if (serving !== void 0) {
+      throw new ProtocolError3(`${L}.serving: must be absent when role is serving`);
+    }
+    return { type: BRIDGE_ROLE_FRAME, role, canServe };
+  }
+  if (serving === void 0) {
+    throw new ProtocolError3(`${L}.serving: required when role is standby`);
+  }
+  assertObject(serving, `${L}.serving`);
+  const label = serving.label;
+  assertDisplayString(label, `${L}.serving.label`, 1, BRIDGE_ROLE_LABEL_MAX);
+  const since = serving.since;
+  if (typeof since !== "number" || !Number.isSafeInteger(since) || since < 0) {
+    throw new ProtocolError3(`${L}.serving.since: expected non-negative safe integer (Unix ms)`);
+  }
+  assertExactFields(serving, BRIDGE_ROLE_SERVING_FIELDS, `${L}.serving`);
+  return {
+    type: BRIDGE_ROLE_FRAME,
+    role,
+    canServe,
+    serving: { label, since }
+  };
+}
 function validateInnerFrame(raw) {
   assertObject(raw, "inner");
   const t = raw.type;
@@ -65793,10 +66083,10 @@ function validateInnerResponse(raw) {
 }
 
 // node_modules/@fetchproxy/protocol/dist/pair-code.js
-var enc2 = new TextEncoder();
+var enc3 = new TextEncoder();
 var PAIR_LABEL = "fetchproxy/4/pair";
 async function pairTranscript(mcpIdentityPub, extIdentityPub, mcpNonce, extNonce, mcpSessionPub) {
-  const label = enc2.encode(PAIR_LABEL);
+  const label = enc3.encode(PAIR_LABEL);
   const parts = [mcpIdentityPub, extIdentityPub, mcpNonce, extNonce, mcpSessionPub];
   const out = new Uint8Array(label.length + 1 + parts.reduce((n, p) => n + p.length, 0));
   out.set(label, 0);
@@ -65817,7 +66107,7 @@ function digits(hash2) {
 }
 
 // node_modules/@fetchproxy/protocol/dist/seal.js
-var enc3 = new TextEncoder();
+var enc4 = new TextEncoder();
 var dec = new TextDecoder();
 function randomIv() {
   const iv = new Uint8Array(12);
@@ -65830,14 +66120,14 @@ function base64Length(byteLength) {
   return Math.ceil(byteLength / 3) * 4;
 }
 function encodeInnerFrame(inner) {
-  return enc3.encode(JSON.stringify(inner));
+  return enc4.encode(JSON.stringify(inner));
 }
 function plaintextOf(inner) {
   return inner instanceof Uint8Array ? inner : encodeInnerFrame(inner);
 }
 function sealedFrameWireBytes(mcpId, seq, inner) {
   const plaintext = plaintextOf(inner).length;
-  const envelope = enc3.encode(JSON.stringify({ type: "frame", mcpId, seq, iv: "", ciphertext: "" })).length;
+  const envelope = enc4.encode(JSON.stringify({ type: "frame", mcpId, seq, iv: "", ciphertext: "" })).length;
   return envelope + IV_B64_BYTES + base64Length(plaintext + AES_GCM_TAG_BYTES);
 }
 var MAX_FRAME_BYTES = 42 * 1024 * 1024;
@@ -66177,14 +66467,23 @@ var FetchproxyHelloRejectedError = class extends Error {
   platform;
   /**
    * #418: the remedy, when the reason is one this package knows how to
-   * explain — today only `unsupported-capability`, which blames the browser
-   * rather than the MCP. `null` otherwise.
+   * explain — `unsupported-capability`, which blames the browser rather than
+   * the MCP, and (D12) `awaiting-approval`, which says to approve in the
+   * browser. `null` otherwise.
    */
   hint;
+  /**
+   * D12: `true` only for an `awaiting-approval:` refusal — the extension has
+   * queued an approval card and nobody is at the browser yet, so the same call
+   * succeeds once the person approves. Every other refusal is the extension's
+   * final answer, and retrying unchanged is refused the same way.
+   */
+  retryable;
   constructor(info) {
     const unavailable = parseUnsupportedCapabilityReason(info.reason);
+    const awaiting = parseAwaitingApprovalReason(info.reason);
     const platform = info.platform ?? null;
-    const hint = unavailable !== null ? `${platform ? `this browser (${platform})` : "this browser"} cannot serve any of the capabilities this MCP needs (${unavailable.join(", ")}) \u2014 ContextMint Bridge checked for the browser APIs and they are missing. Nothing is wrong with the MCP or your pairing, and updating will not change it: use this MCP from a browser that provides them (for example Chrome).` : null;
+    const hint = awaiting !== null ? `The extension is waiting for you to approve this MCP` + (awaiting !== "" ? ` (${awaiting})` : "") + ` \u2014 open ContextMint Bridge in your browser, approve it there, then retry. Nothing is wrong with the MCP or your sign-in.` : unavailable !== null ? `${platform ? `this browser (${platform})` : "this browser"} cannot serve any of the capabilities this MCP needs (${unavailable.join(", ")}) \u2014 ContextMint Bridge checked for the browser APIs and they are missing. Nothing is wrong with the MCP or your pairing, and updating will not change it: use this MCP from a browser that provides them (for example Chrome).` : null;
     super(`fetchproxy: the extension refused the connection for "${info.mcpId}": ${info.reason}. ` + (hint !== null ? hint : `This is the extension's own reason \u2014 it is not a timeout, and retrying unchanged will be refused the same way.`));
     this.name = "FetchproxyHelloRejectedError";
     this.mcpId = info.mcpId;
@@ -66192,6 +66491,7 @@ var FetchproxyHelloRejectedError = class extends Error {
     this.unavailableCapabilities = unavailable ?? [];
     this.platform = platform;
     this.hint = hint;
+    this.retryable = awaiting !== null;
     Object.setPrototypeOf(this, new.target.prototype);
   }
 };
@@ -66744,7 +67044,7 @@ function originVerdict(origin, allowLocal) {
 }
 var HANDSHAKE_TIMEOUT_MS = 15e3;
 var MAX_PAYLOAD_BYTES = MAX_FRAME_BYTES;
-var enc4 = new TextEncoder();
+var enc5 = new TextEncoder();
 var OWN_DECRYPT_FAILURES_BEFORE_REHANDSHAKE = 3;
 async function startHost(opts) {
   const allowLocalOrigins = envAllowsLocalOrigins();
@@ -66815,10 +67115,20 @@ async function startHost(opts) {
   let resolveOwnSession;
   let rejectOwnSession;
   let ownSessionReady;
+  let ownRetryableRefusal = false;
+  let ownSessionSettled = false;
   function resetSessionPromise() {
+    ownRetryableRefusal = false;
+    ownSessionSettled = false;
     ownSessionReady = new Promise((resolve2, reject) => {
-      resolveOwnSession = resolve2;
-      rejectOwnSession = reject;
+      resolveOwnSession = (st) => {
+        ownSessionSettled = true;
+        resolve2(st);
+      };
+      rejectOwnSession = (e) => {
+        ownSessionSettled = true;
+        reject(e);
+      };
     });
     ownSessionReady.catch(() => {
     });
@@ -67085,13 +67395,15 @@ async function startHost(opts) {
             const extPub = fromB64(frame.extensionSessionPub);
             const shared = await ecdhX25519(held.priv, extPub);
             const salt = await transcriptHash(held.nonce, extNonce, held.pub, extPub);
-            const key = await hkdfSha256(shared, salt, enc4.encode(HKDF_SESSION_INFO), 32);
+            const key = await hkdfSha256(shared, salt, enc5.encode(HKDF_SESSION_INFO), 32);
             if (extensionWs !== ws)
               return;
             ownSession = new SessionState(key);
             ownSessionInfo = sessionInfoFromHello(verifiedHello);
             ownDecryptFailures = 0;
             ownPendingPairCode = null;
+            if (ownRetryableRefusal)
+              resetSessionPromise();
             resolveOwnSession(ownSession);
           } else {
             const slot = peers.get(frame.mcpId);
@@ -67160,11 +67472,17 @@ async function startHost(opts) {
         }
         if (frame.type === "hello-rejected" && identified === "extension") {
           if (frame.mcpId === opts.ownMcpId) {
-            rejectOwnSession(new FetchproxyHelloRejectedError({
+            const refusal = new FetchproxyHelloRejectedError({
               mcpId: frame.mcpId,
               reason: frame.reason,
               platform: extensionHello?.platform ?? null
-            }));
+            });
+            if (ownRetryableRefusal)
+              resetSessionPromise();
+            const settlesPending = !ownSessionSettled;
+            rejectOwnSession(refusal);
+            if (refusal.retryable && settlesPending)
+              ownRetryableRefusal = true;
           } else {
             const slot = peers.get(frame.mcpId);
             if (slot?.helloFrame.accepts?.includes("hello-rejected")) {
@@ -67280,7 +67598,7 @@ async function startHost(opts) {
 
 // node_modules/@fetchproxy/server/dist/peer.js
 var PEER_DIAL_TIMEOUT_MS = 5e3;
-var enc5 = new TextEncoder();
+var enc6 = new TextEncoder();
 function notSentError() {
   return new Error("fetchproxy: request not sent \u2014 the connection to the bridge host closed before it went out, so nothing reached the browser. It is safe to retry.");
 }
@@ -67380,7 +67698,9 @@ async function startPeer(opts) {
   let rejectFirstReady;
   let sessionPromise;
   let sessionPromiseSettled = false;
+  let retryableRefusal = false;
   function resetSessionPromise() {
+    retryableRefusal = false;
     sessionPromiseSettled = false;
     sessionPromise = new Promise((resolve2, reject) => {
       resolveFirstReady = (st) => {
@@ -67477,6 +67797,8 @@ async function startPeer(opts) {
       raw = JSON.parse(data.toString());
       const frame = validateFrame(raw);
       if (frame.type === "hello" && frame.role === "extension") {
+        if (retryableRefusal)
+          resetSessionPromise();
         extensionHello = frame;
         const mintedKeypair = await generateSessionKeypair();
         const mintedHello = await buildServerHello({
@@ -67506,6 +67828,8 @@ async function startPeer(opts) {
           session = null;
           if (sessionPromiseSettled)
             resetSessionPromise();
+        } else if (retryableRefusal) {
+          resetSessionPromise();
         }
         extensionDisconnectListeners.forEach((cb) => cb());
         return;
@@ -67527,7 +67851,7 @@ async function startPeer(opts) {
         const extNonce = fromB64(authenticated.sessionNonce);
         const shared = await ecdhX25519(held.priv, extPub);
         const salt = await transcriptHash(held.nonce, extNonce, held.pub, extPub);
-        const sessionKey = await hkdfSha256(shared, salt, enc5.encode(HKDF_SESSION_INFO), 32);
+        const sessionKey = await hkdfSha256(shared, salt, enc6.encode(HKDF_SESSION_INFO), 32);
         if (sessionEphemeral !== held) {
           console.warn(`[fetchproxy] ${opts.serverName}: dropping a session derived against an ephemeral that was superseded while it was being derived`);
           return;
@@ -67540,16 +67864,24 @@ async function startPeer(opts) {
         if (isRenegotiation) {
           renegotiateListeners.forEach((cb) => cb());
         } else {
+          if (retryableRefusal)
+            resetSessionPromise();
           resolveFirstReady(session);
         }
         return;
       }
       if (frame.type === "hello-rejected" && frame.mcpId === opts.mcpId) {
-        rejectFirstReady(new FetchproxyHelloRejectedError({
+        const refusal = new FetchproxyHelloRejectedError({
           mcpId: frame.mcpId,
           reason: frame.reason,
           platform: extensionHello?.platform ?? null
-        }));
+        });
+        if (retryableRefusal)
+          resetSessionPromise();
+        const settlesPending = !sessionPromiseSettled;
+        rejectFirstReady(refusal);
+        if (refusal.retryable && settlesPending)
+          retryableRefusal = true;
       }
       if (frame.type === "pair-pending" && frame.mcpId === opts.mcpId) {
         const hello2 = extensionHello;
@@ -67713,8 +68045,9 @@ function classifyFetchError(error62, code2) {
 
 // node_modules/@fetchproxy/server/dist/classify-bridge-error.js
 function classifyBridgeError(err) {
-  if (err instanceof FetchproxyHelloRejectedError)
-    return "hello_rejected";
+  if (err instanceof FetchproxyHelloRejectedError) {
+    return err.retryable ? "awaiting_approval" : "hello_rejected";
+  }
   if (err instanceof FetchproxySessionNotReadyError)
     return "session_not_ready";
   if (err instanceof FetchproxyTimeoutError)
@@ -75921,7 +76254,7 @@ function registerVisitTools(server, client2, patients2) {
 }
 
 // src/version.ts
-var VERSION = "1.3.3";
+var VERSION = "1.3.5";
 
 // src/index.ts
 var dotenvCandidates = [
@@ -76006,7 +76339,7 @@ await runMcp({
 });
 /*! Bundled license information:
 
-@modelcontextprotocol/server/dist/src-BHSMhZ_W.mjs:
+@modelcontextprotocol/server/dist/src-Cqbh3MYc.mjs:
   (*!
   * content-type
   * Copyright(c) 2015 Douglas Christopher Wilson

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrischall/myatriumhealth-mcp",
-  "version": "1.3.3",
+  "version": "1.3.5",
   "description": "MCP server for MyAtriumHealth (Atrium Health's Epic MyChart patient portal) via the fetchproxy browser bridge.",
   "type": "module",
   "bin": {
@@ -42,15 +42,15 @@
     "access": "public"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^2.13.0",
-    "@fetchproxy/server": "^3.4.1",
-    "@modelcontextprotocol/server": "^2.2.0",
+    "@chrischall/mcp-utils": "^2.15.0",
+    "@fetchproxy/server": "^3.6.0",
+    "@modelcontextprotocol/server": "^2.3.0",
     "dotenv": "^18.0.1",
     "node-html-parser": "^9.0.3",
     "zod": "^4.6.5"
   },
   "devDependencies": {
-    "@modelcontextprotocol/client": "^2.2.0",
+    "@modelcontextprotocol/client": "^2.3.0",
     "@types/node": "^26.0.0",
     "@vitest/coverage-v8": "^5.0.0",
     "esbuild": "^0.28.1",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/myatriumhealth-mcp",
     "source": "github"
   },
-  "version": "1.3.3",
+  "version": "1.3.5",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@chrischall/myatriumhealth-mcp",
-      "version": "1.3.3",
+      "version": "1.3.5",
       "transport": {
         "type": "stdio"
       },