@jclvsh/iris 0.5.4 → 0.6.0

package/dist/client.js

@@ -41,9 +41,12 @@ export class IrisClient {
                 "Get a valid API key from https://iris-ai.dev/settings/api-keys");
         }
         this.apiKey = apiKey;
-        // Default to www host. iris-ai.dev apex 307s to www.iris-ai.dev, and fetch
-        // strips Authorization across the host change → every call returned APIKEY_001.
-        this.baseUrl = (process.env.IRIS_API_URL || "https://www.iris-ai.dev/api/v1").replace(/\/+$/, "");
+        // Default to api.iris-ai.dev (Stripe/GitHub/OpenAI convention). The api host
+        // rewrites /<resource> → /api/v1/<resource> via middleware (see iris/src/proxy.ts),
+        // so callers no longer pass the /api/v1/ prefix. Override via IRIS_API_URL if needed.
+        // Older versions (≤0.5.5) defaulted to https://www.iris-ai.dev/api/v1 — that host
+        // still responds, but the api host is canonical going forward.
+        this.baseUrl = (process.env.IRIS_API_URL || "https://api.iris-ai.dev").replace(/\/+$/, "");
     }
     async get(path, params) {
         const url = new URL(`${this.baseUrl}${path}`);

package/dist/tools/keys.js

@@ -1,7 +1,13 @@
 import { z } from "zod";
 // Five-verb scope vocabulary. iris uses soft-deletes everywhere, so DELETE
 // routes gate on `write` — there is no separate `delete` scope.
-const SCOPES = ["read", "write", "generate", "send", "admin"];
+//
+// `*` is also accepted at the API as a wildcard sentinel (expands to all 5
+// scopes). It must be the SOLE element of the array — mixing it with named
+// scopes was a privilege-escalation footgun (round-6 audit). Same rule as the
+// API route schema in src/app/api/v1/keys/route.ts.
+const NAMED_SCOPES = ["read", "write", "generate", "send", "admin"];
+const SCOPES_WITH_WILDCARD = [...NAMED_SCOPES, "*"];
 export function registerKeyTools(server, client) {
     server.tool("get_current_api_key", "get details about the currently authenticated API key.", {}, async () => {
         try {
@@ -45,11 +51,12 @@ export function registerKeyTools(server, client) {
     server.tool("create_api_key", "create a new API key. requires admin scope.", {
         name: z.string().min(1).max(100).describe("key name for identification"),
         scopes: z
-            .array(z.enum(SCOPES))
+            .array(z.enum(SCOPES_WITH_WILDCARD))
             .min(1, "scopes must be a non-empty array; omit the field for all scopes")
+            .refine((s) => !s.includes("*") || s.length === 1, "wildcard scope \"*\" must be the only element; mixing it with named scopes is rejected to prevent accidental privilege escalation")
             .optional()
-            .describe("permission scopes (any of: read, write, generate, send, admin). omit for all scopes; empty array is rejected with 422"),
-        expires_at: z.string().optional().describe("expiration date in ISO 8601 format"),
+            .describe("permission scopes — any subset of [read, write, generate, send, admin], or [\"*\"] for all. omit the field for all scopes. empty array and mixed wildcard (e.g. [\"read\", \"*\"]) are rejected with 422."),
+        expires_at: z.string().optional().describe("expiration date in ISO 8601 format (must be in the future)"),
     }, async (args) => {
         try {
             const result = await client.post("/keys", args);

package/dist/tools/webhooks.js

@@ -154,7 +154,7 @@ export function registerWebhookTools(server, client) {
             };
         }
     });
-    server.tool("rotate_webhook_secret", "rotate the signing secret for a webhook. the new secret is returned in the response. the old secret is invalidated immediately — receivers must update their HMAC verification before the next delivery. requires write scope.", {
+    server.tool("rotate_webhook_secret", "rotate the signing secret for a webhook. the new secret is returned in the response. the old secret is invalidated immediately — receivers must update their HMAC verification before the next delivery. requires admin scope.", {
         id: z.string().uuid().describe("webhook ID"),
     }, async ({ id }) => {
         try {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@jclvsh/iris",
-	"version": "0.5.4",
+	"version": "0.6.0",
 	"description": "MCP server for the Iris API",
 	"type": "module",
 	"main": "dist/index.js",