@cookiemunch/mcp 0.4.0 → 0.5.0

package/dist/bin.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   createCookieMunchMcp
-} from "./chunk-SKCEQX3L.js";
+} from "./chunk-IQLCPEWI.js";
 
 // src/bin.ts
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
@@ -12,7 +12,7 @@ async function main() {
     process.exit(1);
   }
   const baseUrl = process.env.COOKIEMUNCH_BASE_URL ?? "https://api.cookiemunch.net";
-  const server = createCookieMunchMcp({ apiKey, baseUrl });
+  const server = createCookieMunchMcp({ apiKey, baseUrl, ...process.env.COOKIEMUNCH_USER_AGENT ? { userAgent: process.env.COOKIEMUNCH_USER_AGENT } : {} });
   const transport = new StdioServerTransport();
   await server.connect(transport);
 }

package/dist/bin.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/bin.ts"],"sourcesContent":["#!/usr/bin/env node\n/**\n * stdio entry point for the Cookie Munch MCP server. Reads COOKIEMUNCH_API_KEY\n * (required) and COOKIEMUNCH_BASE_URL (optional) from the environment, builds the\n * server, and serves it over stdio — the transport Claude Desktop / Claude Code use\n * to spawn local MCP servers.\n */\n\nimport { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';\nimport { createCookieMunchMcp } from './index.js';\n\nasync function main(): Promise<void> {\n  const apiKey = process.env.COOKIEMUNCH_API_KEY;\n  if (!apiKey) {\n    console.error('COOKIEMUNCH_API_KEY is required.');\n    process.exit(1);\n  }\n  const baseUrl = process.env.COOKIEMUNCH_BASE_URL ?? 'https://api.cookiemunch.net';\n  const server = createCookieMunchMcp({ apiKey, baseUrl });\n  const transport = new StdioServerTransport();\n  await server.connect(transport);\n  // The process now stays alive serving MCP requests over stdio.\n}\n\nmain().catch((err) => {\n  console.error('cookiemunch-mcp failed to start:', err);\n  process.exit(1);\n});\n"],"mappings":";;;;;;AAQA,SAAS,4BAA4B;AAGrC,eAAe,OAAsB;AACnC,QAAM,SAAS,QAAQ,IAAI;AAC3B,MAAI,CAAC,QAAQ;AACX,YAAQ,MAAM,kCAAkC;AAChD,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,QAAM,UAAU,QAAQ,IAAI,wBAAwB;AACpD,QAAM,SAAS,qBAAqB,EAAE,QAAQ,QAAQ,CAAC;AACvD,QAAM,YAAY,IAAI,qBAAqB;AAC3C,QAAM,OAAO,QAAQ,SAAS;AAEhC;AAEA,KAAK,EAAE,MAAM,CAAC,QAAQ;AACpB,UAAQ,MAAM,oCAAoC,GAAG;AACrD,UAAQ,KAAK,CAAC;AAChB,CAAC;","names":[]}
+{"version":3,"sources":["../src/bin.ts"],"sourcesContent":["#!/usr/bin/env node\n/**\n * stdio entry point for the Cookie Munch MCP server. Reads COOKIEMUNCH_API_KEY\n * (required) and COOKIEMUNCH_BASE_URL (optional) from the environment, builds the\n * server, and serves it over stdio — the transport Claude Desktop / Claude Code use\n * to spawn local MCP servers.\n */\n\nimport { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';\nimport { createCookieMunchMcp } from './index.js';\n\nasync function main(): Promise<void> {\n  const apiKey = process.env.COOKIEMUNCH_API_KEY;\n  if (!apiKey) {\n    console.error('COOKIEMUNCH_API_KEY is required.');\n    process.exit(1);\n  }\n  const baseUrl = process.env.COOKIEMUNCH_BASE_URL ?? 'https://api.cookiemunch.net';\n  const server = createCookieMunchMcp({ apiKey, baseUrl, ...(process.env.COOKIEMUNCH_USER_AGENT ? { userAgent: process.env.COOKIEMUNCH_USER_AGENT } : {}) });\n  const transport = new StdioServerTransport();\n  await server.connect(transport);\n  // The process now stays alive serving MCP requests over stdio.\n}\n\nmain().catch((err) => {\n  console.error('cookiemunch-mcp failed to start:', err);\n  process.exit(1);\n});\n"],"mappings":";;;;;;AAQA,SAAS,4BAA4B;AAGrC,eAAe,OAAsB;AACnC,QAAM,SAAS,QAAQ,IAAI;AAC3B,MAAI,CAAC,QAAQ;AACX,YAAQ,MAAM,kCAAkC;AAChD,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,QAAM,UAAU,QAAQ,IAAI,wBAAwB;AACpD,QAAM,SAAS,qBAAqB,EAAE,QAAQ,SAAS,GAAI,QAAQ,IAAI,yBAAyB,EAAE,WAAW,QAAQ,IAAI,uBAAuB,IAAI,CAAC,EAAG,CAAC;AACzJ,QAAM,YAAY,IAAI,qBAAqB;AAC3C,QAAM,OAAO,QAAQ,SAAS;AAEhC;AAEA,KAAK,EAAE,MAAM,CAAC,QAAQ;AACpB,UAAQ,MAAM,oCAAoC,GAAG;AACrD,UAAQ,KAAK,CAAC;AAChB,CAAC;","names":[]}

package/dist/{chunk-SKCEQX3L.js → chunk-IQLCPEWI.js}

@@ -1509,6 +1509,21 @@ ${JSON.stringify(r, null, 2)}` : r;
     { subjectId: z5.string() },
     (a) => client.preferences.get(a.subjectId)
   );
+  tool(
+    "mint_preference_center_token",
+    "Mint a hosted preference-centre token for one visitor (POST /v1/preference-center/tokens), for a page to pass to CookieMunch.setSubjectToken. Give exactly one of email (resolved as the emailed preference link resolves it; an unknown address is subject_not_found) or subjectId. The token is a credential that opens that person\u2019s subscriptions and profile until expiresAt: never paste it into a shared URL, a ticket or a log, and keep ttlSeconds short (default 3600, max 86400). Needs subscriptions:write and profile:write, plus identity:read by email.",
+    {
+      cbid: z5.string().describe("A site of your organisation."),
+      email: z5.string().optional().describe("The visitor\u2019s address. Give this or subjectId, not both."),
+      subjectId: z5.string().optional().describe("The subject id. Give this or email, not both."),
+      ttlSeconds: z5.number().int().min(1).max(86400).optional()
+    },
+    (a) => client.preferenceCenter.mintToken({
+      cbid: a.cbid,
+      ...a.email !== void 0 ? { email: a.email } : { subjectId: a.subjectId },
+      ...a.ttlSeconds !== void 0 ? { ttlSeconds: a.ttlSeconds } : {}
+    })
+  );
   tool(
     "issue_api_key",
     "Issue a new API key. The secret is returned once and never again. Prefer the least privilege the job needs: `scopes` limits what it can do, `cbids` locks it to specific sites (it then cannot reach anything org-wide), `expiresInDays` retires it. Omitting all three mints a full-access, org-wide, non-expiring key.",
@@ -1608,7 +1623,7 @@ ${JSON.stringify(r, null, 2)}` : r;
   );
   tool(
     "list_cookie_presets",
-    "Declaration presets for the platforms a site is built on (atlas, forumulate, chatly, cookiemunch): each one\u2019s parameters, what it has declared on this site, and whether the vendor\u2019s live manifest can be imported yet. Read-only.",
+    "Declaration presets for the platforms a site is built on (atlas, forumulate, chatly, cookiemunch, referally): each one\u2019s parameters, what it has declared on this site, and whether the vendor\u2019s live manifest can be imported yet. Read-only.",
     { cbid: z5.string() },
     (a) => client.sites.cookiePresets(a.cbid)
   );
@@ -1617,24 +1632,26 @@ ${JSON.stringify(r, null, 2)}` : r;
     "Apply (or re-sync) a vendor preset: declares exactly what that platform writes \u2014 cookies and browser storage, with domain and lifetime \u2014 marked as declared by that vendor. Re-applying removes keys the vendor no longer writes. Names the owner declared are kept (skipped). Atlas needs frontendApiHost (and crossSubdomainCookies, default true); Chatly needs publicId.",
     {
       cbid: z5.string(),
-      vendor: z5.enum(["atlas", "forumulate", "chatly", "cookiemunch"]),
+      vendor: z5.enum(["atlas", "forumulate", "chatly", "cookiemunch", "referally"]),
       frontendApiHost: z5.string().optional().describe("Atlas: your frontend API host, e.g. auth.example.com."),
       crossSubdomainCookies: z5.boolean().optional().describe("Atlas: default true \u2014 the cookies live on the parent domain."),
       publicId: z5.string().optional().describe("Chatly: the channel public id (ch_web_\u2026)."),
       dragging: z5.boolean().optional().describe("Chatly: the launcher can be dragged (adds the drag-position key)."),
-      category: z5.string().optional().describe("Chatly: the category for its keys. Default necessary."),
+      category: z5.string().optional().describe("Chatly: the category for its keys (default necessary). Referally: default the site's referrals category, else marketing."),
+      cookieDomain: z5.string().optional().describe("Referally: the domain aff.js sets referally_ctx on, e.g. .example.com. Default the site domain."),
+      cookieDays: z5.number().int().min(1).max(400).optional().describe("Referally: how long the cookie lives, 1 to 400 days. Default 60."),
       dryRun: dryRunArg
     },
     (a) => {
       const params = {};
-      for (const k of ["frontendApiHost", "crossSubdomainCookies", "publicId", "dragging", "category"]) if (a[k] !== void 0) params[k] = a[k];
+      for (const k of ["frontendApiHost", "crossSubdomainCookies", "publicId", "dragging", "category", "cookieDomain", "cookieDays"]) if (a[k] !== void 0) params[k] = a[k];
       return client.sites.applyCookiePreset(a.cbid, a.vendor, params, a.dryRun ? { dryRun: true } : void 0);
     }
   );
   tool(
     "remove_cookie_preset",
     "Remove every declaration a vendor preset made on this site.",
-    { cbid: z5.string(), vendor: z5.enum(["atlas", "forumulate", "chatly", "cookiemunch"]), dryRun: dryRunArg },
+    { cbid: z5.string(), vendor: z5.enum(["atlas", "forumulate", "chatly", "cookiemunch", "referally"]), dryRun: dryRunArg },
     (a) => client.sites.removeCookiePreset(a.cbid, a.vendor, a.dryRun ? { dryRun: true } : void 0)
   );
   tool(
@@ -1736,6 +1753,37 @@ ${JSON.stringify(r, null, 2)}` : r;
       return { removed: true };
     }
   );
+  tool(
+    "get_org_controller",
+    "The organisation\u2019s own data-controller identity: who every rights notice names, before any site config controller block. `set: false` when there is none. Read-only.",
+    {},
+    () => client.org.controller.get()
+  );
+  tool(
+    "set_org_controller",
+    "Set the organisation\u2019s data-controller identity. Replaces it: a field left out is removed. Needed for a notice on a rights request filed without a cbid when the organisation has several sites. Needs an unscoped key or rights:write. Audited.",
+    {
+      legalName: z5.string().describe("Required: the legal name of the data controller."),
+      contactEmail: z5.string().optional().describe("Where people reach the controller about their data."),
+      address: z5.string().optional(),
+      dpoContact: z5.string().optional().describe("The Data Protection Officer: a name, an email address, or both.")
+    },
+    (a) => client.org.controller.set({
+      legalName: a.legalName,
+      ...a.contactEmail !== void 0 ? { contactEmail: a.contactEmail } : {},
+      ...a.address !== void 0 ? { address: a.address } : {},
+      ...a.dpoContact !== void 0 ? { dpoContact: a.dpoContact } : {}
+    })
+  );
+  tool(
+    "remove_org_controller",
+    "Remove the organisation\u2019s data-controller identity. Notices then name the request\u2019s site config controller block; a request without a cbid in an organisation with several sites gets no notice.",
+    {},
+    async () => {
+      await client.org.controller.remove();
+      return { removed: true };
+    }
+  );
   const CAPTCHA_OFF = "Off removes spam protection beyond the hidden spam-trap field, the rate limits and the email code: expect more spam requests. Own keys are recommended.";
   const captchaInput = {
     mode: z5.enum(["own", "off"]).describe(`own: your own captcha provider keys (recommended). off: no captcha. ${CAPTCHA_OFF}`),
@@ -1751,6 +1799,24 @@ ${JSON.stringify(r, null, 2)}` : r;
     ...a.secret !== void 0 ? { secret: a.secret } : {},
     ...a.minScore !== void 0 ? { minScore: a.minScore } : {}
   });
+  tool(
+    "get_consent_sync_secret",
+    "Whether hosted consent sync is set up for a site: `configured`, `secretLast4`, `createdAt`. Never returns the secret. Read-only.",
+    { cbid: z5.string() },
+    (a) => client.consentSyncSecret.get(a.cbid)
+  );
+  tool(
+    "rotate_consent_sync_secret",
+    "Mint a site\u2019s consent-sync signing secret, or rotate it. The answer carries `secret` this once; the site owner\u2019s server signs consent-sync tokens with it (mintConsentSyncToken in @cookiemunch/sdk). Rotating stops the old secret at once, so every page holding a token signed with it stops syncing until it gets a new token. Never put the secret in a page. Needs sites:write and consent:write.",
+    { cbid: z5.string() },
+    (a) => client.consentSyncSecret.rotate(a.cbid)
+  );
+  tool(
+    "remove_consent_sync_secret",
+    "Remove a site\u2019s consent-sync secret: hosted consent sync stops until a new one is minted. Needs sites:write and consent:write.",
+    { cbid: z5.string() },
+    (a) => client.consentSyncSecret.remove(a.cbid)
+  );
   tool(
     "get_rights_captcha",
     "The captcha on a site\u2019s hosted rights page: its own setting, else the organisation default, else off (`source` says which). Never returns the secret. Read-only.",
@@ -1992,8 +2058,9 @@ ${JSON.stringify(r, null, 2)}` : r;
 }
 
 // src/index.ts
+var MCP_VERSION = "0.5.0";
 function createCookieMunchMcp(opts) {
-  const client = opts.client ?? createCookieMunch({ apiKey: opts.apiKey, baseUrl: opts.baseUrl });
+  const client = opts.client ?? createCookieMunch({ apiKey: opts.apiKey, baseUrl: opts.baseUrl, userAgent: opts.userAgent ?? `cookiemunch-mcp/${MCP_VERSION}` });
   const server = new McpServer({ name: "cookiemunch", version: "1.0.0" });
   registerTools(server, client);
   return server;
@@ -2001,6 +2068,7 @@ function createCookieMunchMcp(opts) {
 
 export {
   registerTools,
+  MCP_VERSION,
   createCookieMunchMcp
 };
-//# sourceMappingURL=chunk-SKCEQX3L.js.map
+//# sourceMappingURL=chunk-IQLCPEWI.js.map