@kaddo/mcp 3.101.0 → 3.103.0

package/README.md

@@ -34,7 +34,7 @@ directory set via the `KADDO_PROJECT_DIR` environment variable).
 }
 ```
 
-`cwd` must point to the project that contains `.kaddo/`, `knowledge/` and (optionally) `external/`.
+`cwd` must point to the project that contains `.kaddo/` and `knowledge/`.
 
 ## Resources
 
@@ -47,7 +47,7 @@ directory set via the `KADDO_PROJECT_DIR` environment variable).
 | `kaddo://graph-hints` | `.kaddo/graph-hints.md` + `.json` | weak/missing relationships |
 | `kaddo://work-items` | `knowledge/delivery/work-items/` | summarized Work Items |
 | `kaddo://roadmap` | `knowledge/delivery/roadmap.md` | delivery roadmap |
-| `kaddo://capsules` | `.kaddo/external.yml` + `external/` | external Knowledge Capsules |
+| `kaddo://capsules` | `.kaddo/external.yml` + `knowledge/external/` | external Knowledge Capsules |
 | `kaddo://agents` | `knowledge/agents/` | installed agent prompts |
 | `kaddo://skills` | `knowledge/skills/` | installed reusable skills (empty if none) |
 | `kaddo://skills/<id>` | `knowledge/skills/<id>/skill.md` | one reusable skill |
@@ -66,7 +66,7 @@ directory set via the `KADDO_PROJECT_DIR` environment variable).
 
 When a derived artifact is missing or stale, these tools regenerate it in place using the same core
 logic as the CLI — so the agent never has to leave the flow. They are deterministic (no LLM) and
-**only write under `.kaddo/`**; they never touch `knowledge/`, `src/`, `external/`,
+**only write under `.kaddo/`**; they never touch `knowledge/`, `src/`,
 `.kaddo/external.yml` or git.
 
 | Tool | Writes | CLI equivalent |
@@ -78,7 +78,7 @@ logic as the CLI — so the agent never has to leave the flow. They are determin
 | `kaddo_generate_capsule_draft` | `.kaddo/exports/<project>.capsule.md` + `.json` | `kaddo capsule export` |
 
 `kaddo_generate_capsule_draft` writes a **draft only** — it never registers/imports a capsule
-(`external/`, `.kaddo/external.yml` stay untouched; use the CLI `kaddo capsule add` for that).
+(`knowledge/external/`, `.kaddo/external.yml` stay untouched; use the CLI `kaddo capsule add` for that).
 
 Each tool returns `{ status, files_written, summary, warnings, next_suggested_resources }`. All
 writes pass through a central allowlist (`assertMcpDerivedWritePath`) that blocks any path outside
@@ -103,7 +103,7 @@ regenerate artifacts **only under `.kaddo/`**; everything else is read-only.
 
 ## Security
 
-The server only reads `.kaddo/`, `knowledge/` and `external/`. It never reads `src/`, `.git/`,
+The server only reads `.kaddo/` and `knowledge/`. It never reads `src/`, `.git/`,
 `node_modules/`, `dist/`, `build/` or `coverage/`, blocks path traversal, and never exposes
 secrets, tokens, env values, source code or PII.
 

package/dist/index.js

@@ -96,7 +96,7 @@ import matter from "gray-matter";
 import fs from "fs";
 import path from "path";
 import { parse as parseYaml } from "yaml";
-var ALLOWED_ROOTS = [".kaddo", "knowledge", "external"];
+var ALLOWED_ROOTS = [".kaddo", "knowledge"];
 var KaddoMcpError = class extends Error {
 };
 function projectRoot() {
@@ -464,7 +464,9 @@ var configSchema = z.object({
   guard: z.unknown().optional(),
   scan: z.unknown().optional(),
   telemetry: z.object({
-    enabled: z.boolean().default(false)
+    consent: z.enum(["enabled", "disabled"]).optional(),
+    consentVersion: z.number().optional(),
+    enabled: z.boolean().optional()
   }).passthrough().optional()
 }).passthrough();
 function configPathFor(dir) {
@@ -10501,7 +10503,7 @@ var RESOURCES = [
   {
     uri: "kaddo://capsules",
     name: "Kaddo knowledge capsules",
-    description: "External Knowledge Capsules from .kaddo/external.yml and external/.",
+    description: "External Knowledge Capsules from .kaddo/external.yml and knowledge/external/.",
     mimeType: "application/json",
     read: (root) => [
       {
@@ -10895,7 +10897,9 @@ var configSchema2 = z3.object({
   guard: z3.unknown().optional(),
   scan: z3.unknown().optional(),
   telemetry: z3.object({
-    enabled: z3.boolean().default(false)
+    consent: z3.enum(["enabled", "disabled"]).optional(),
+    consentVersion: z3.number().optional(),
+    enabled: z3.boolean().optional()
   }).passthrough().optional()
 }).passthrough();
 function configPathFor2(dir) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kaddo/mcp",
-  "version": "3.101.0",
+  "version": "3.103.0",
   "description": "MCP server for Kaddo project knowledge: read-only resources/tools/prompts plus safe derived generation under .kaddo/.",
   "license": "MIT",
   "repository": {