@finchagentic/mcp 4.7.3 → 4.7.4

package/README.md

@@ -29,13 +29,13 @@ Always pin the version. Never use `@latest`.
 
 ```bash
 # One-command installer (detects common MCP clients)
-npx -y -p @finchagentic/mcp@4.7.3 finch install
+npx -y -p @finchagentic/mcp@4.7.4 finch install
 ```
 
 ### Claude Code
 
 ```bash
-claude mcp add finch -s user -- npx -y -p @finchagentic/mcp@4.7.3 finch-mcp
+claude mcp add finch -s user -- npx -y -p @finchagentic/mcp@4.7.4 finch-mcp
 ```
 
 ### Cursor / Windsurf / Claude Desktop
@@ -45,7 +45,7 @@ claude mcp add finch -s user -- npx -y -p @finchagentic/mcp@4.7.3 finch-mcp
   "mcpServers": {
     "finch": {
       "command": "npx",
-      "args": ["-y", "-p", "@finchagentic/mcp@4.7.3", "finch-mcp"]
+      "args": ["-y", "-p", "@finchagentic/mcp@4.7.4", "finch-mcp"]
     }
   }
 }
@@ -59,7 +59,7 @@ claude mcp add finch -s user -- npx -y -p @finchagentic/mcp@4.7.3 finch-mcp
     "finch": {
       "type": "stdio",
       "command": "npx",
-      "args": ["-y", "-p", "@finchagentic/mcp@4.7.3", "finch-mcp"]
+      "args": ["-y", "-p", "@finchagentic/mcp@4.7.4", "finch-mcp"]
     }
   }
 }
@@ -124,7 +124,7 @@ Default palette is `core` (lighter context). Full set:
 Finch is the runtime. **Your LLM is the brain. Your data stays yours.**
 
 ```bash
-npx -y -p @finchagentic/mcp@4.7.3 finch setup
+npx -y -p @finchagentic/mcp@4.7.4 finch setup
 # enable local vault (and optional local memory)
 ```
 
@@ -156,7 +156,7 @@ Scheduled/cloud features still need an account. Core memory, vault, and public-d
 Guided setup:
 
 ```bash
-npx -y -p @finchagentic/mcp@4.7.3 finch setup
+npx -y -p @finchagentic/mcp@4.7.4 finch setup
 ```
 
 ## Security
@@ -165,7 +165,7 @@ npx -y -p @finchagentic/mcp@4.7.3 finch setup
 |:-:|----------|------|
 | 1 | Prompt injection | External content is data only — never instructions |
 | 2 | Mainnet confirm | Estimate → preview → confirm → execute |
-| 3 | Pinned install | Always `@finchagentic/mcp@4.7.3`, never `@latest` |
+| 3 | Pinned install | Always `@finchagentic/mcp@4.7.4`, never `@latest` |
 | 4 | Credential vault | Never paste secrets into prompts or third-party tools |
 | 5 | Data disclosure | Know what leaves the machine (LLM, Firecrawl, GitHub, chain RPCs) |
 | 6 | Server monitors | Scheduled jobs need explicit confirmation |

package/dist/config.js

@@ -88,9 +88,8 @@ function writeConfig(patch) {
     fs.writeFileSync(CONFIG_FILE, JSON.stringify(updated, null, 2), { mode: 0o600 });
 }
 function getSavedToken() {
-    // FINCH_API_KEY (persistent finch_sk_* key) wins - MCP clients should hold
-    // a key, not a session token that expires and silently disconnects them.
-    return process.env.FINCH_API_KEY ?? env("FINCH_SESSION_TOKEN", "FINCH_SESSION_TOKEN") ?? readConfig().sessionToken;
+    // env var always wins over saved config
+    return env("FINCH_SESSION_TOKEN", "FINCH_SESSION_TOKEN") ?? readConfig().sessionToken;
 }
 /** Accept finch_sk_* (new) and noel_sk_* (backend still issues these). */
 function isApiKey(value) {

package/dist/convex.js

@@ -42,13 +42,24 @@ noRetry = false) {
     const url = `${exports.CONVEX_SITE}${path}`;
     const headers = { "Content-Type": "application/json" };
     const apiKey = process.env.FINCH_API_KEY;
-    const sessionToken = (0, config_js_1.getSavedToken)(); // env var → saved config fallback
-    // Prefer session token (resolved by backend) over API key for Convex API calls
-    const authHeader = sessionToken
-        ? `Bearer ${sessionToken}`
+    // getSavedToken() falls back to ~/.finch/config.json's cached sessionToken
+    // (written by a past `finch login`) when FINCH_SESSION_TOKEN isn't set.
+    // That cached value can go stale for months without anyone noticing - a
+    // user who later configures FINCH_API_KEY fresh in their MCP client
+    // (the documented, intentional way to authenticate) got it silently
+    // shadowed by the old cached token, which then failed on every call. An
+    // EXPLICIT env var - either kind, set deliberately for this run - always
+    // wins over a cached file value; only fall back to the cached session
+    // token when neither env var is present.
+    const explicitSessionToken = process.env.FINCH_SESSION_TOKEN;
+    const cachedSessionToken = explicitSessionToken ? undefined : (0, config_js_1.getSavedToken)();
+    const authHeader = explicitSessionToken
+        ? `Bearer ${explicitSessionToken}`
         : apiKey
             ? `Bearer ${apiKey}`
-            : null;
+            : cachedSessionToken
+                ? `Bearer ${cachedSessionToken}`
+                : null;
     if (authHeader) {
         headers["Authorization"] = authHeader;
     }

package/dist/finch-status.js

@@ -65,30 +65,47 @@ exports.FINCH_STATUS_TOOL = {
     inputSchema: { type: "object", properties: {}, additionalProperties: false },
     annotations: { title: "Finch status", readOnlyHint: true, openWorldHint: false },
 };
-async function handleFinchStatus(toolCount) {
-    const version = readPkgVersion();
-    let tokenSet = false;
-    let authState = "none";
-    let authDetail = "";
+// Mirrors convex.ts's own precedence exactly (explicit env var of either
+// kind beats a cached ~/.finch/config.json sessionToken from a past `finch
+// login`) - this tool previously only checked getSavedToken(), which never
+// considered FINCH_API_KEY at all. A user who configured FINCH_API_KEY
+// fresh (the documented way to authenticate) but still had a stale cached
+// session token file from months ago got told "not set" and pointed at
+// sign-in instructions, when a perfectly valid credential was right there.
+function resolveCredential() {
+    if (process.env.FINCH_SESSION_TOKEN)
+        return { value: process.env.FINCH_SESSION_TOKEN, kind: "session token" };
+    if (process.env.FINCH_API_KEY)
+        return { value: process.env.FINCH_API_KEY, kind: "API key" };
+    let cached;
     try {
-        tokenSet = Boolean((0, config_js_1.getSavedToken)());
+        cached = (0, config_js_1.getSavedToken)();
     }
     catch {
-        tokenSet = false;
+        cached = undefined;
     }
+    return cached ? { value: cached, kind: "session token" } : null;
+}
+async function handleFinchStatus(toolCount) {
+    const version = readPkgVersion();
+    const credential = resolveCredential();
+    const tokenSet = credential !== null;
+    const credentialLabel = credential?.kind ?? "session token";
+    let authState = "none";
+    let authDetail = "";
     if (tokenSet) {
         try {
             const data = await (0, convex_js_1.callConvex)("/memory/profile", "GET", undefined, "finch_status", 8000, true);
             authState = (data?.status === "ok") ? "valid" : "rejected";
             if (authState === "rejected") {
-                authDetail = "the session token was rejected by the backend - re-copy it from app.finchagentic.com";
+                authDetail = `the ${credentialLabel} was rejected by the backend - re-copy it from app.finchagentic.com`;
             }
         }
         catch (err) {
             const msg = String(err?.message ?? err);
             if (msg.includes("Authentication required")) {
                 authState = "invalid";
-                authDetail = "the backend rejected the token as expired or invalid - re-copy it from app.finchagentic.com";
+                authDetail = `the backend rejected the ${credentialLabel} as expired or invalid - re-copy it from app.finchagentic.com`;
             }
             else {
                 authState = "unreachable";
@@ -109,7 +126,7 @@ async function handleFinchStatus(toolCount) {
         ? [
             `**Finch MCP v${version}** - runtime layer for agentic AI`,
             "",
-            "- Session token: ✅ valid (verified against the backend)",
+            `- Auth: ✅ ${credentialLabel} valid (verified against the backend)`,
             `- Tools: **${toolCount}** registered (surface depends on FINCH_TOOLS filter)`,
             "- Resources: finch://vault/<key> - Prompts: crypto-thesis and friends",
             "- Tool presets: FINCH_PRESET=core|defi|research|memory (default core) - FINCH_TOOLS=all for everything",
@@ -120,16 +137,16 @@ async function handleFinchStatus(toolCount) {
             ? [
                 `**Finch MCP v${version}** - runtime layer for agentic AI`,
                 "",
-                `- Session token: ⚠️ configured but **${authState}**`,
+                `- Auth: ⚠️ ${credentialLabel} configured but **${authState}**`,
                 authDetail ? `- ${authDetail}` : "",
-                "- Tools are registered, but every backend-backed call will fail until the token is replaced.",
+                "- Tools are registered, but every backend-backed call will fail until it's replaced.",
                 "",
-                "**Fix:** re-copy a fresh token from app.finchagentic.com, update FINCH_SESSION_TOKEN in your MCP config, restart the client.",
+                `**Fix:** re-copy a fresh ${credentialLabel} from app.finchagentic.com, update ${credentialLabel === "API key" ? "FINCH_API_KEY" : "FINCH_SESSION_TOKEN"} in your MCP config, restart the client.`,
             ]
             : [
                 `**Finch MCP v${version}** - runtime layer for agentic AI`,
                 "",
-                "- Session token: ❌ not set",
+                "- Auth: ❌ not set",
                 "",
                 "**To sign in (60 seconds):**",
                 "",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@finchagentic/mcp",
-  "version": "4.7.3",
+  "version": "4.7.4",
   "description": "The runtime layer for Agentic AI. Persistent memory, autonomous agents, and workflows that survive every session.",
   "main": "dist/index.js",
   "bin": {
@@ -71,4 +71,4 @@
   "publishConfig": {
     "access": "public"
   }
-}
+}