@joy-loyalty/mcp 0.3.7 → 0.3.8

package/build/config.js

@@ -48,8 +48,22 @@ export function loadConfig(env = process.env) {
     // Writes require the merchant secret key AND an explicit opt-in flag. Having the
     // secret key alone is not consent: it is the only key a merchant has.
     const writesEnabled = mode === 'merchant' && env.JOY_MCP_ENABLE_WRITES === 'true';
+    // Configuration writes need their own opt-in on top of member writes: the
+    // blast radius is the whole storefront, not one member. Compared as a STRING
+    // because every value in an MCP client's "env" block must be quoted — a JSON
+    // boolean makes Claude Desktop reject the entire server (dogfood round 2).
+    const configWritesEnabled = writesEnabled && env.JOY_MCP_ENABLE_CONFIG_WRITES === 'true';
     // 0 is meaningful: "always dry-run every deduction" (most conservative)
     const rawThreshold = Number(env.JOY_MCP_DEDUCT_DRYRUN_THRESHOLD ?? '1000');
     const deductDryRunThreshold = Number.isFinite(rawThreshold) && rawThreshold >= 0 ? rawThreshold : 1000;
-    return { apiBaseUrl, appKey, secretKey, privateBotKey, mode, writesEnabled, deductDryRunThreshold };
+    return {
+        apiBaseUrl,
+        appKey,
+        secretKey,
+        privateBotKey,
+        mode,
+        writesEnabled,
+        configWritesEnabled,
+        deductDryRunThreshold
+    };
 }