@cookiemunch/mcp 0.6.0 → 0.7.1

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 Every published release, newest first. Dates are the day the version was cut. Each release tracks the same-numbered `@cookiemunch/sdk`.
 
+## 0.7.1 (2026-10-24)
+
+- Changed: tool descriptions name each vendor's own embed manifest (`/.well-known/<product>-embed.json`); built on `@cookiemunch/sdk` 0.7.1.
+
+## 0.7.0 (2026-10-24)
+
+- Added: `get_sandbox`, `create_sandbox` (erasing a sandbox stays a person's `cookiemunch sandbox delete`), `list_api_versions`, `set_own_api_version`.
+- Changed: built on `@cookiemunch/sdk` 0.7.0.
+
 ## 0.6.0 (2026-10-24)
 
 - Added: `open_dsar_case`, `get_dsar_case`, `cancel_dsar_case`, `get_dsar_case_receipt`, `find_dsar_by_trace`, `get_dsar_settings`, `set_dsar_settings`, `get_subject_card`, `run_executor_conformance`, `roll_executor_completion_secret`. The grace period is opt-in for existing sites (they read `graceDays: 0` until set).

package/dist/bin.cjs

@@ -805,7 +805,7 @@ function registerIntegrationTools(tool, client) {
   );
   tool(
     "get_embed_manifest",
-    "A site\u2019s embed manifest (the tenant variant of /.well-known/forgedeck-embed.json): every origin the Cookie Munch embed touches on that site, by CSP directive (non-origin sources such as 'unsafe-inline' under requires), every cookie and browser-storage key it writes with category and lifetime, the checkers\u2019 User-Agent, and the hosts of the site\u2019s rights page and preference centre. Use it to build a Content-Security-Policy. Read-only.",
+    "A site\u2019s embed manifest (the tenant variant of /.well-known/cookiemunch-embed.json): every origin the Cookie Munch embed touches on that site, by CSP directive (non-origin sources such as 'unsafe-inline' under requires), every cookie and browser-storage key it writes with category and lifetime, the checkers\u2019 User-Agent, and the hosts of the site\u2019s rights page and preference centre. Use it to build a Content-Security-Policy. Read-only.",
     { cbid: import_zod3.z.string() },
     (a) => client.embedManifest(a.cbid)
   );
@@ -870,6 +870,30 @@ function registerKeyAndTagTools(tool, client) {
     {},
     () => client.keys.self()
   );
+  tool(
+    "list_api_versions",
+    "The dated API versions, what each one changed, and the version the key this server runs with is pinned to (`yours`). Read-only.",
+    {},
+    () => client.versions()
+  );
+  tool(
+    "set_own_api_version",
+    "Re-pin the key this server runs with to another dated API version (from list_api_versions). It changes how the API behaves for this key (for example strict request bodies from 2026-10-24), never what the key may do.",
+    { apiVersion: import_zod4.z.string().describe("A version from list_api_versions, e.g. 2026-10-24.") },
+    (a) => client.keys.updateSelf({ apiVersion: a.apiVersion })
+  );
+  tool(
+    "get_sandbox",
+    "The organisation\u2019s sandbox (a separate test organisation with the same people and plan features, never billed), or null. Read-only.",
+    {},
+    () => client.sandbox.get()
+  );
+  tool(
+    "create_sandbox",
+    "Make a sandbox of the organisation, or return the one it has, with a new test-format key for it (shown once). Everything in a sandbox is test data: its keys are cookiemunch_test_ keys and every rights request filed there is a test. Needs a full-access key or orgs:create.",
+    { keyName: import_zod4.z.string().min(1).max(100).optional().describe('A name for the new key. Default "sandbox".') },
+    (a) => client.sandbox.create(a.keyName !== void 0 ? { keyName: a.keyName } : {})
+  );
   tool(
     "list_api_keys_standard",
     "The organisation\u2019s keys in the suite-standard shape (id, owner, kind, env, scopes, resources, created_at, expires_at, last_used_at, last_used_ip, status). Needs a full-access key. Read-only.",
@@ -1944,7 +1968,7 @@ ${JSON.stringify(r, null, 2)}` : r;
   );
   tool(
     "import_cookie_manifest",
-    'Declare ANY vendor\u2019s cookies and browser storage from its embed manifest (/.well-known/forgedeck-embed.json): give its https URL (re-read hourly afterwards) or the manifest document. The vendor id is the manifest\u2019s product; rows are marked source "manifest". An invalid manifest is refused with each broken rule named. Use dryRun first; remove it with remove_cookie_preset and the product id.',
+    'Declare ANY vendor\u2019s cookies and browser storage from its embed manifest (/.well-known/<product>-embed.json): give its https URL (re-read hourly afterwards) or the manifest document. The vendor id is the manifest\u2019s product; rows are marked source "manifest". An invalid manifest is refused with each broken rule named. Use dryRun first; remove it with remove_cookie_preset and the product id.',
     {
       cbid: import_zod6.z.string(),
       url: import_zod6.z.string().optional().describe("An https:// embed manifest URL."),
@@ -2401,7 +2425,7 @@ ${JSON.stringify(r, null, 2)}` : r;
 }
 
 // src/index.ts
-var MCP_VERSION = "0.6.0";
+var MCP_VERSION = "0.7.1";
 function createCookieMunchMcp(opts) {
   const client = opts.client ?? (0, import_sdk.createCookieMunch)({ apiKey: opts.apiKey, baseUrl: opts.baseUrl, userAgent: opts.userAgent ?? `cookiemunch-mcp/${MCP_VERSION}` });
   const server = new import_mcp.McpServer({ name: "cookiemunch", version: "1.0.0" });