@formstr/mcp 0.4.0 → 0.5.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +19 -6
- package/dist/index.js +216 -84
- package/dist/index.js.map +1 -1
- package/package.json +14 -13
package/README.md
CHANGED
|
@@ -32,8 +32,8 @@ npm registry for a newer release:
|
|
|
32
32
|
|
|
33
33
|
```text
|
|
34
34
|
$ formstr-mcp version
|
|
35
|
-
@formstr/mcp 0.
|
|
36
|
-
Update available: 0.
|
|
35
|
+
@formstr/mcp 0.5.0
|
|
36
|
+
Update available: 0.6.0 (you have 0.5.0).
|
|
37
37
|
Upgrade: npm install -g @formstr/mcp@latest
|
|
38
38
|
Or just re-run via: npx -y @formstr/mcp@latest
|
|
39
39
|
```
|
|
@@ -41,7 +41,7 @@ Or just re-run via: npx -y @formstr/mcp@latest
|
|
|
41
41
|
The update check is best-effort — if you're offline or the registry is unreachable it
|
|
42
42
|
prints the installed version and a note, never an error. If you run the server via
|
|
43
43
|
`npx -y @formstr/mcp` you already get the latest published version on each launch; pin a
|
|
44
|
-
version (`@formstr/mcp@0.
|
|
44
|
+
version (`@formstr/mcp@0.5.0`) in your host config if you'd rather control upgrades.
|
|
45
45
|
|
|
46
46
|
## Sign-in
|
|
47
47
|
|
|
@@ -89,6 +89,12 @@ After `login`, no key belongs in the config:
|
|
|
89
89
|
Add `"--allow-writes"` to `args` to enable the gated (destructive/outward) tools, and
|
|
90
90
|
`"--relays", "wss://a,wss://b"` to override relays.
|
|
91
91
|
|
|
92
|
+
> **Note:** the default (no `--allow-writes`) is _not_ read-only. Create/import tools
|
|
93
|
+
> (`create_form`, `create_calendar_event`, `create_calendar`, `create_poll`, `create_page`,
|
|
94
|
+
> `import_form_from_naddr`) are always enabled and publish events on your identity. The
|
|
95
|
+
> flag gates the tools that modify or delete existing data or act toward other people
|
|
96
|
+
> (update / delete / share / submit / RSVP).
|
|
97
|
+
|
|
92
98
|
### Passing the ncryptsec passphrase
|
|
93
99
|
|
|
94
100
|
If your active account is an `ncryptsec` key (Create / Import login), the server needs its
|
|
@@ -224,9 +230,16 @@ actions; see the source under `src/tools/`.
|
|
|
224
230
|
Destructive / outward tools are **not registered** unless `--allow-writes` (or
|
|
225
231
|
`FORMSTR_ALLOW_WRITES=true`) is set, AND each such call additionally requires
|
|
226
232
|
`"confirm": true`. Without `confirm`, the tool returns a structured "confirmation
|
|
227
|
-
required" message naming the irreversible effect instead of executing.
|
|
228
|
-
|
|
229
|
-
|
|
233
|
+
required" message naming the irreversible effect instead of executing.
|
|
234
|
+
|
|
235
|
+
**Create tools are always on.** `--allow-writes` gates updates, deletions, shares,
|
|
236
|
+
submissions, and RSVPs — not creation. Creating a new form/event/calendar/poll/page
|
|
237
|
+
(and importing a form) publishes to relays on your identity even without the flag,
|
|
238
|
+
because a fresh entity can't clobber existing data. If you need a strictly read-only
|
|
239
|
+
server, don't connect an identity that matters.
|
|
240
|
+
|
|
241
|
+
`share_form` distributes only the view key (read access) — never the signing key.
|
|
242
|
+
Logging goes to stderr (stdout is the MCP transport).
|
|
230
243
|
|
|
231
244
|
## Tests
|
|
232
245
|
|