@fruition/fcp-mcp-server 1.27.0 → 1.27.1

package/dist/index.js

@@ -203,6 +203,9 @@ const TOOL_PERMISSIONS = {
 // Resolved role for the current API key. Cached only on successful lookup so
 // transient FCP outages don't pin us to 'none' for the rest of the session.
 let cachedUserRole;
+// The API key owner's email, as reported by /api/mcp/me. Used as the fallback
+// identity for "my"-scoped queries when FCP_USER_EMAIL is not configured.
+let cachedUserEmail;
 async function fetchUserRole() {
     if (cachedUserRole !== undefined)
         return cachedUserRole;
@@ -227,6 +230,8 @@ async function fetchUserRole() {
         const data = await res.json();
         const role = data?.role ?? 'none';
         cachedUserRole = role;
+        if (data?.email)
+            cachedUserEmail = data.email;
         console.error(`[MCP Server] Resolved user role: ${role} (${data?.email ?? 'unknown'})`);
         return role;
     }
@@ -235,6 +240,17 @@ async function fetchUserRole() {
         return 'none';
     }
 }
+// Resolve the acting user's email for "my"-scoped queries (e.g. unroo_get_my_tasks).
+// Precedence: FCP_USER_EMAIL (the per-developer identity) -> the API key owner's
+// email from /api/mcp/me (the shared key's creator, honoring the "based on API
+// key" contract). Returns '' if neither resolves, so callers can surface a clear
+// "set FCP_USER_EMAIL" message rather than silently returning the org-wide list.
+async function resolveActingEmail() {
+    if (FCP_USER_EMAIL)
+        return FCP_USER_EMAIL;
+    await fetchUserRole(); // populates cachedUserEmail as a side effect
+    return cachedUserEmail ?? '';
+}
 function isRoleAtLeast(actual, required) {
     if (actual === 'none')
         return required === 'none';
@@ -2051,17 +2067,17 @@ const TOOLS = [
     },
     {
         name: 'unroo_get_my_tasks',
-        description: 'Get tasks assigned to the current user (based on API key). Useful for finding your work items.',
+        description: 'Get tasks assigned to you. "You" resolves from FCP_USER_EMAIL (your Fruition email), falling back to the FCP API key owner if FCP_USER_EMAIL is unset. Returns an error asking you to set FCP_USER_EMAIL if neither can be resolved.',
         inputSchema: {
             type: 'object',
             properties: {
                 status: {
                     type: 'string',
-                    description: 'Filter by status (comma-separated for multiple)',
+                    description: 'Filter by status: To Do, In Progress, Done, Blocked (case-sensitive, comma-separated for multiple)',
                 },
                 limit: {
                     type: 'number',
-                    description: 'Maximum number of tasks to return',
+                    description: 'Maximum number of tasks to return (default 50)',
                 },
             },
         },
@@ -4425,9 +4441,30 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             }
             case 'unroo_get_my_tasks': {
                 const { status, limit } = args;
-                // Note: The API key determines the user, tasks are filtered server-side
+                // "My tasks" must be scoped by an explicit assignee_email filter. There is
+                // NO server-side auto-scoping: GET /api/external/fcp/tasks returns every
+                // task unless assignee_email is supplied, and the shared FCP_API_TOKEN
+                // resolves to the key creator (not the developer running Claude Code), so
+                // the key alone cannot identify "me". Resolve the acting user's email and
+                // pass it as the filter.
+                const assignee_email = await resolveActingEmail();
+                if (!assignee_email) {
+                    return {
+                        content: [
+                            {
+                                type: 'text',
+                                text: JSON.stringify({
+                                    total: 0,
+                                    tasks: [],
+                                    error: 'Could not determine your identity. Set FCP_USER_EMAIL (your Fruition email) in your MCP server env config so "my tasks" can be scoped to you.',
+                                }, null, 2),
+                            },
+                        ],
+                    };
+                }
                 const result = await unrooClient.listTasks({
                     status,
+                    assignee_email,
                     limit: limit || 50,
                 });
                 return {
@@ -4436,6 +4473,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                             type: 'text',
                             text: JSON.stringify({
                                 total: result.tasks.length,
+                                assignee_email,
                                 tasks: result.tasks,
                             }, null, 2),
                         },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fruition/fcp-mcp-server",
-  "version": "1.27.0",
+  "version": "1.27.1",
   "description": "MCP Server for FCP Launch Coordination System - enables Claude Code to interact with FCP launches and track development time",
   "main": "dist/index.js",
   "type": "module",