@decionis/mcp 0.2.0 → 0.3.0

package/README.md

@@ -62,8 +62,30 @@ and re-evaluates. The handlers are the hosted MCP's own, bound to the in-process
 the local loop is the hosted loop. Both call `presence.decionis.com` (`openWorldHint:
 true`). Production enforcement is sales-assisted.
 
-The `shield.*` tools register only when `DECIONIS_SHIELD_API_KEY` and
-`DECIONIS_SHIELD_APP_ID` are configured.
+### Shield — the user's own spending rules (consumer)
+
+The `shield.*` tools ask a person's Decionis Shield before an assistant
+spends their money: `shield.request_purchase` returns ALLOW, ASK or BLOCK
+against the limits the person set in the Shield app, with a signed Dispute
+Passport behind every hold. Two ways to bind:
+
+- **Pair from the app (ten minutes, no keys).** In the Shield app, open *AI
+  spending allowance → Bind your own agent*; it shows a six-character code.
+  Tell your assistant *"pair with Shield, code ABC123"* — it calls
+  `shield.pair`, which claims the code and keeps the production credential in
+  `~/.decionis/shield-credential.json` (`0600`; `DECIONIS_SHIELD_CREDENTIAL_FILE`
+  moves it). The app then lists the assistant with what it was allowed to
+  spend this week, and can revoke it. Pairing again from the same computer
+  rotates the credential rather than binding a second agent.
+- **Configure a key (integrators).** `DECIONIS_SHIELD_API_KEY` and
+  `DECIONIS_SHIELD_APP_ID` from `POST /v1/consumer/shield/integrations` win
+  over the paired file. `DECIONIS_SHIELD_API_URL` defaults to
+  `https://api.shield.decionis.com`.
+
+The six tools are always advertised. Until the server is paired or configured,
+every `shield.*` call fails closed with `SHIELD_MCP_CONFIGURATION_REQUIRED`
+and tells the model to ask the user for the code — an error is never
+permission to execute.
 
 ### Kubernetes execution-authority tools
 

package/dist/AgentHookCli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   AgentHookCommand
-} from "./chunk-7QNV7MXC.js";
-import "./chunk-NF5JL6QR.js";
+} from "./chunk-ABHNQFWI.js";
+import "./chunk-LIVLO4MV.js";
 
 // src/AgentHookCli.ts
 void AgentHookCommand.run(process.argv.slice(2)).then((exitCode) => {