@kaneo/mcp 0.1.3 → 0.1.5

package/README.md

@@ -2,7 +2,7 @@
 
 `@kaneo/mcp` is a local MCP server for Kaneo.
 
-It runs over stdio, signs in with Kaneo's device flow, and then calls the Kaneo API with a bearer token. The package lives in `apps/mcp` in this monorepo and exposes the `kaneo-mcp` CLI.
+It runs over stdio, signs in with Kaneo's device flow, and then calls the Kaneo API with a bearer token. The package lives in `packages/mcp` in this monorepo and exposes the `kaneo-mcp` CLI.
 
 ## Prerequisites
 
@@ -69,7 +69,7 @@ See all options:
 kaneo-mcp install --help
 ```
 
-If you are currently inside the local `apps/mcp` package directory, npm may resolve the local workspace package instead of the published one and fail to expose the bin. In that case, either run `npx` from outside `apps/mcp`, or use a local build:
+If you are currently inside the local `packages/mcp` package directory, npm may resolve the local workspace package instead of the published one and fail to expose the bin. In that case, either run `npx` from outside `packages/mcp`, or use a local build:
 
 ```bash
 node dist/index.js
@@ -91,7 +91,7 @@ pnpm --filter @kaneo/mcp run test
 Or run it from the package directory:
 
 ```bash
-pnpm -C apps/mcp run build
+pnpm -C packages/mcp run build
 ```
 
 The CLI entry points to `./dist/index.js`. Use `npx @kaneo/mcp` or `kaneo-mcp` after a global install so your IDE config points at the resolved path.

package/dist/auth/auth-service.js

@@ -4,6 +4,7 @@ import { clearCredentials, loadCredentials, saveCredentials, } from "./token-sto
 export class AuthService {
     baseUrl;
     clientId;
+    activeGetAccessTokenPromise;
     constructor(options) {
         this.baseUrl = options.baseUrl;
         this.clientId = options.clientId;
@@ -13,8 +14,10 @@ export class AuthService {
     }
     async validateAccessToken(token) {
         try {
+            const signal = AbortSignal.timeout(10_000);
             const res = await fetch(`${this.baseUrl}/api/auth/get-session`, {
                 headers: { Authorization: `Bearer ${token}` },
+                signal,
             });
             if (res.status === 401) {
                 return "invalid";
@@ -36,34 +39,49 @@ export class AuthService {
      * Returns a valid access token, running the device authorization flow if needed.
      */
     async getAccessToken() {
-        const cached = await loadCredentials();
-        if (cached &&
-            cached.baseUrl === this.baseUrl &&
-            cached.clientId === this.clientId &&
-            cached.accessToken) {
-            const validation = await this.validateAccessToken(cached.accessToken);
-            if (validation === "valid" || validation === "unknown") {
-                return cached.accessToken;
-            }
-            await this.clearToken();
+        if (this.activeGetAccessTokenPromise) {
+            return await this.activeGetAccessTokenPromise;
         }
-        const code = await requestDeviceCode(this.baseUrl, this.clientId);
-        const verifyUrl = code.verification_uri_complete || code.verification_uri;
-        this.log(`Open ${verifyUrl} and approve this device. User code: ${code.user_code}`);
+        this.activeGetAccessTokenPromise = (async () => {
+            const cached = await loadCredentials();
+            if (cached &&
+                cached.baseUrl === this.baseUrl &&
+                cached.clientId === this.clientId &&
+                cached.accessToken) {
+                const validation = await this.validateAccessToken(cached.accessToken);
+                // Fail-open for "unknown": validateAccessToken returns "unknown" on transient HTTP/network
+                // errors or ambiguous responses. Treating "unknown" like "valid" avoids clearToken() and a full
+                // device re-auth so flaky connectivity does not wipe cached.accessToken; only "invalid" forces
+                // a fresh login. Tests should cover both unknown and invalid paths.
+                if (validation === "valid" || validation === "unknown") {
+                    return cached.accessToken;
+                }
+                await this.clearToken();
+            }
+            const code = await requestDeviceCode(this.baseUrl, this.clientId);
+            const verifyUrl = code.verification_uri_complete || code.verification_uri;
+            this.log(`Open ${verifyUrl} and approve this device. User code: ${code.user_code}`);
+            try {
+                await open(verifyUrl);
+            }
+            catch {
+                this.log("Could not open a browser automatically; use the URL above.");
+            }
+            const accessToken = await pollDeviceAccessToken(this.baseUrl, this.clientId, code.device_code, code.interval, { log: (m) => this.log(m) });
+            const toStore = {
+                version: 1,
+                baseUrl: this.baseUrl,
+                clientId: this.clientId,
+                accessToken,
+            };
+            await saveCredentials(toStore);
+            return accessToken;
+        })();
         try {
-            await open(verifyUrl);
+            return await this.activeGetAccessTokenPromise;
         }
-        catch {
-            this.log("Could not open a browser automatically; use the URL above.");
+        finally {
+            this.activeGetAccessTokenPromise = undefined;
         }
-        const accessToken = await pollDeviceAccessToken(this.baseUrl, this.clientId, code.device_code, code.interval, { log: (m) => this.log(m) });
-        const toStore = {
-            version: 1,
-            baseUrl: this.baseUrl,
-            clientId: this.clientId,
-            accessToken,
-        };
-        await saveCredentials(toStore);
-        return accessToken;
     }
 }

package/dist/auth/device-flow.js

@@ -1,20 +1,77 @@
+const REQUEST_TIMEOUT_MS = 10_000;
 function sleep(ms) {
     return new Promise((r) => setTimeout(r, ms));
 }
+function isAbortError(err) {
+    return err instanceof DOMException
+        ? err.name === "AbortError"
+        : err instanceof Error && err.name === "AbortError";
+}
+function isObjectRecord(value) {
+    return value !== null && typeof value === "object";
+}
+async function fetchWithTimeout(input, init, timeoutMs = REQUEST_TIMEOUT_MS) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        return await fetch(input, { ...init, signal: controller.signal });
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
 export async function requestDeviceCode(baseUrl, clientId) {
-    const res = await fetch(`${baseUrl}/api/auth/device/code`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ client_id: clientId }),
-    });
-    const body = (await res.json().catch(() => ({})));
+    let res;
+    try {
+        res = await fetchWithTimeout(`${baseUrl}/api/auth/device/code`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ client_id: clientId }),
+        });
+    }
+    catch (err) {
+        if (isAbortError(err)) {
+            throw new Error("device/code request timed out after 10s.");
+        }
+        throw err;
+    }
+    const parsedBody = await res.json().catch(() => ({}));
+    if (!isObjectRecord(parsedBody)) {
+        throw new Error(`device/code: unexpected response ${JSON.stringify(parsedBody)}`);
+    }
+    const body = parsedBody;
     if (!res.ok) {
         throw new Error(`device/code failed (${res.status}): ${JSON.stringify(body)}`);
     }
-    if (!("device_code" in body) || typeof body.device_code !== "string") {
+    if (typeof body.device_code !== "string") {
         throw new Error(`device/code: unexpected response ${JSON.stringify(body)}`);
     }
-    return body;
+    if (typeof body.user_code !== "string" ||
+        typeof body.verification_uri !== "string") {
+        throw new Error(`device/code: missing user_code or verification_uri ${JSON.stringify(body)}`);
+    }
+    const interval = toFiniteNumber(body.interval);
+    const expiresIn = toFiniteNumber(body.expires_in);
+    if (interval === undefined || expiresIn === undefined) {
+        throw new Error(`device/code: invalid interval or expires_in ${JSON.stringify(body)}`);
+    }
+    return {
+        ...body,
+        interval,
+        expires_in: expiresIn,
+    };
+}
+function toFiniteNumber(v) {
+    if (typeof v === "number" && Number.isFinite(v)) {
+        return v;
+    }
+    if (typeof v === "string" && v.trim() !== "") {
+        const n = Number(v);
+        if (Number.isFinite(n)) {
+            return n;
+        }
+    }
+    return undefined;
 }
 /**
  * Polls `/api/auth/device/token` until success or terminal error.
@@ -28,21 +85,41 @@ export async function pollDeviceAccessToken(baseUrl, clientId, deviceCode, initi
     for (let attempt = 0; Date.now() - started < maxWait; attempt++) {
         if (attempt > 0) {
             await sleep(intervalMs);
+            if (Date.now() - started >= maxWait) {
+                break;
+            }
         }
-        const res = await fetch(`${baseUrl}/api/auth/device/token`, {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({
-                grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-                device_code: deviceCode,
-                client_id: clientId,
-            }),
-        });
-        const body = (await res.json().catch(() => ({})));
+        let res;
+        try {
+            res = await fetchWithTimeout(`${baseUrl}/api/auth/device/token`, {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({
+                    grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+                    device_code: deviceCode,
+                    client_id: clientId,
+                }),
+            });
+        }
+        catch (err) {
+            if (isAbortError(err)) {
+                log("Device token poll request timed out; retrying.");
+                continue;
+            }
+            throw err;
+        }
+        if (Date.now() - started >= maxWait) {
+            throw new Error("Device authorization timed out waiting for approval.");
+        }
+        const parsedBody = await res.json().catch(() => ({}));
+        if (!isObjectRecord(parsedBody)) {
+            throw new Error(`device/token failed (${res.status}): ${JSON.stringify(parsedBody)}`);
+        }
+        const body = parsedBody;
         if (res.ok && typeof body.access_token === "string") {
             return body.access_token;
         }
-        const err = body.error;
+        const err = typeof body.error === "string" ? body.error : undefined;
         if (err === "authorization_pending") {
             log("Waiting for device approval…");
             continue;

package/dist/install/index.js

@@ -1,10 +1,17 @@
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
 import { dirname } from "node:path";
 import { stdin as input, stdout as output } from "node:process";
 import { mergeMcpServerEntry } from "./merge-config.js";
 import { resolvePackageEntryPath } from "./resolve-entry.js";
-import { resolveTargetConfigPath } from "./targets.js";
+import { INSTALL_TARGETS, resolveTargetConfigPath, validateCustomConfigPathInput, } from "./targets.js";
 import { promptConfirmOverwrite, promptCustomConfigPath, promptTargetSelect, } from "./wizard.js";
+/** True if `v` looks like a CLI flag (`--long` or single-letter `-y`), not a value like `-my-server`. */
+function isFlagLikeToken(v) {
+    if (v.startsWith("--")) {
+        return true;
+    }
+    return /^-[A-Za-z]$/.test(v);
+}
 export function parseInstallArgs(argv) {
     let target;
     let output;
@@ -28,7 +35,7 @@ export function parseInstallArgs(argv) {
         }
         if (a === "--target") {
             const v = argv[i + 1];
-            if (!v || v.startsWith("-")) {
+            if (!v || isFlagLikeToken(v)) {
                 throw new Error("--target requires a value");
             }
             target = v;
@@ -41,7 +48,7 @@ export function parseInstallArgs(argv) {
         }
         if (a === "--output") {
             const v = argv[i + 1];
-            if (!v || v.startsWith("-")) {
+            if (!v || isFlagLikeToken(v)) {
                 throw new Error("--output requires a value");
             }
             output = v;
@@ -54,7 +61,7 @@ export function parseInstallArgs(argv) {
         }
         if (a === "--name") {
             const v = argv[i + 1];
-            if (!v || v.startsWith("-")) {
+            if (!v || isFlagLikeToken(v)) {
                 throw new Error("--name requires a value");
             }
             name = v;
@@ -67,7 +74,7 @@ export function parseInstallArgs(argv) {
         }
         if (a === "--api-url") {
             const v = argv[i + 1];
-            if (!v || v.startsWith("-")) {
+            if (!v || isFlagLikeToken(v)) {
                 throw new Error("--api-url requires a value");
             }
             apiUrl = v;
@@ -80,7 +87,7 @@ export function parseInstallArgs(argv) {
         }
         if (a === "--project-dir") {
             const v = argv[i + 1];
-            if (!v || v.startsWith("-")) {
+            if (!v || isFlagLikeToken(v)) {
                 throw new Error("--project-dir requires a value");
             }
             projectDir = v;
@@ -114,12 +121,7 @@ function hasExistingServerEntry(jsonText, serverName) {
         return false;
     }
 }
-const VALID_TARGETS = [
-    "cursor-user",
-    "cursor-project",
-    "claude-desktop",
-    "custom",
-];
+const VALID_TARGETS = INSTALL_TARGETS.map((t) => t.id);
 function isInstallTargetId(s) {
     return VALID_TARGETS.includes(s);
 }
@@ -161,7 +163,7 @@ export async function runInstall(argv) {
         process.exitCode = 1;
         return;
     }
-    let customPath = parsed.output;
+    let customPath = parsed.output?.trim();
     if (targetIds.includes("custom")) {
         if (!customPath) {
             if (input.isTTY && output.isTTY) {
@@ -173,6 +175,15 @@ export async function runInstall(argv) {
                 return;
             }
         }
+        else {
+            const validation = validateCustomConfigPathInput(customPath);
+            if (!validation.ok) {
+                console.error(`Invalid --output: ${validation.message}`);
+                process.exitCode = 1;
+                return;
+            }
+            customPath = validation.path;
+        }
     }
     const entryPath = resolvePackageEntryPath();
     const env = parsed.apiUrl !== undefined && parsed.apiUrl.length > 0
@@ -184,6 +195,7 @@ export async function runInstall(argv) {
         ...(env ? { env } : {}),
     };
     const writtenPaths = [];
+    const pending = [];
     for (const targetId of targetIds) {
         const configPath = resolveTargetConfigPath(targetId, {
             cwd: parsed.projectDir,
@@ -193,13 +205,24 @@ export async function runInstall(argv) {
         try {
             existingText = await readFile(configPath, "utf8");
         }
-        catch {
-            existingText = null;
+        catch (err) {
+            const code = err &&
+                typeof err === "object" &&
+                "code" in err &&
+                typeof err.code === "string"
+                ? err.code
+                : undefined;
+            if (code === "ENOENT") {
+                existingText = null;
+            }
+            else {
+                throw err;
+            }
         }
         const already = hasExistingServerEntry(existingText, parsed.name);
         if (already && !parsed.yes) {
             if (input.isTTY && output.isTTY) {
-                const ok = await promptConfirmOverwrite(parsed.name);
+                const ok = await promptConfirmOverwrite(parsed.name, configPath);
                 if (!ok) {
                     console.log(`Skipped:\n  ${configPath}`);
                     continue;
@@ -211,18 +234,33 @@ export async function runInstall(argv) {
                 return;
             }
         }
+        pending.push({ configPath, existingText });
+    }
+    const mergedWrites = [];
+    for (const p of pending) {
         let merged;
         try {
-            merged = mergeMcpServerEntry(existingText, parsed.name, serverConfig);
+            merged = mergeMcpServerEntry(p.existingText, parsed.name, serverConfig);
         }
-        catch {
-            console.error(`Cannot update config (invalid JSON or merge error): ${configPath}`);
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            const stack = err instanceof Error ? err.stack : undefined;
+            console.error(`Cannot update config at ${p.configPath}: ${message}${stack ? `\n${stack}` : ""}`);
             process.exitCode = 1;
             return;
         }
-        await mkdir(dirname(configPath), { recursive: true });
-        await writeFile(configPath, merged, { encoding: "utf8", mode: 0o600 });
-        writtenPaths.push(configPath);
+        mergedWrites.push({ configPath: p.configPath, merged });
+    }
+    for (const w of mergedWrites) {
+        await mkdir(dirname(w.configPath), { recursive: true });
+        await writeFile(w.configPath, w.merged, { encoding: "utf8", mode: 0o600 });
+        try {
+            await chmod(w.configPath, 0o600);
+        }
+        catch {
+            /* ignore chmod failures on some FS */
+        }
+        writtenPaths.push(w.configPath);
     }
     if (writtenPaths.length === 0) {
         console.log("No config files were updated.");
@@ -243,7 +281,7 @@ Usage:
 Without options, runs interactively (pick Cursor / Claude / custom path).
 
 Options:
-  --target <id>       cursor-user | cursor-project | claude-desktop | custom
+  --target <id>       ${VALID_TARGETS.join(" | ")}
   --output <path>     Required for --target custom (absolute path to JSON file)
   --project-dir <dir> Base directory for cursor-project (default: current dir)
   --name <string>     MCP server key under mcpServers (default: kaneo)

package/dist/install/merge-config.js

@@ -1,23 +1,45 @@
+const RESERVED_MCP_SERVER_KEYS = new Set([
+    "__proto__",
+    "constructor",
+    "prototype",
+]);
+function isPlainObject(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
 /**
  * Merges or replaces `mcpServers[serverName]` and returns formatted JSON.
  * Preserves other top-level keys and other MCP server entries.
  */
 export function mergeMcpServerEntry(existingJson, serverName, serverConfig) {
+    if (RESERVED_MCP_SERVER_KEYS.has(serverName)) {
+        throw new Error(`Refusing MCP server name "${serverName}" (reserved key; use a different --name).`);
+    }
     let root = {};
-    if (existingJson) {
-        const parsed = JSON.parse(existingJson);
-        if (typeof parsed === "object" &&
-            parsed !== null &&
-            !Array.isArray(parsed)) {
-            root = { ...parsed };
+    if (existingJson !== null) {
+        let parsed;
+        try {
+            parsed = JSON.parse(existingJson);
+        }
+        catch {
+            throw new Error("Existing MCP config is not valid JSON.");
+        }
+        if (!isPlainObject(parsed)) {
+            throw new Error("Existing MCP config must be a JSON object (not an array or primitive).");
         }
+        root = { ...parsed };
     }
     const mcpServers = (() => {
+        const map = Object.create(null);
         const raw = root.mcpServers;
         if (typeof raw === "object" && raw !== null && !Array.isArray(raw)) {
-            return { ...raw };
+            for (const key of Object.keys(raw)) {
+                if (RESERVED_MCP_SERVER_KEYS.has(key)) {
+                    continue;
+                }
+                map[key] = raw[key];
+            }
         }
-        return {};
+        return map;
     })();
     mcpServers[serverName] = serverConfig;
     root.mcpServers = mcpServers;

package/dist/install/targets.js

@@ -1,5 +1,22 @@
 import { homedir } from "node:os";
-import { join } from "node:path";
+import path, { join } from "node:path";
+/**
+ * Validates a non-interactive custom MCP config path (same rules as the install wizard).
+ * Returns the trimmed absolute path on success.
+ */
+export function validateCustomConfigPathInput(raw) {
+    const trimmed = raw.trim();
+    if (trimmed.length === 0) {
+        return { ok: false, message: "Path is required" };
+    }
+    if (!path.isAbsolute(trimmed)) {
+        return { ok: false, message: "Path must be absolute" };
+    }
+    if (!trimmed.toLowerCase().endsWith(".json")) {
+        return { ok: false, message: "Path must end with .json" };
+    }
+    return { ok: true, path: trimmed };
+}
 export const INSTALL_TARGETS = [
     {
         id: "cursor-user",
@@ -45,11 +62,11 @@ export function resolveTargetConfigPath(id, options) {
         case "claude-desktop":
             return getClaudeDesktopConfigPath();
         case "custom": {
-            const p = options.customPath?.trim();
-            if (!p) {
-                throw new Error("Custom target requires a file path");
+            const result = validateCustomConfigPathInput(options.customPath ?? "");
+            if (!result.ok) {
+                throw new Error(result.message);
             }
-            return p;
+            return result.path;
         }
     }
 }

package/dist/install/wizard.js

@@ -1,5 +1,5 @@
 import prompts from "prompts";
-import { INSTALL_TARGETS } from "./targets.js";
+import { INSTALL_TARGETS, validateCustomConfigPathInput, } from "./targets.js";
 function onCancel() {
     console.log("\nCancelled.");
     process.exit(0);
@@ -30,20 +30,24 @@ export async function promptCustomConfigPath() {
         type: "text",
         name: "path",
         message: "Absolute path to the JSON config file (create or update):",
-        validate: (v) => typeof v === "string" && v.trim().length > 0
-            ? true
-            : "Path is required",
+        validate: (v) => {
+            if (typeof v !== "string") {
+                return "Path is required";
+            }
+            const result = validateCustomConfigPathInput(v);
+            return result.ok ? true : result.message;
+        },
     }, { onCancel });
     if (answer.path === undefined) {
         onCancel();
     }
     return String(answer.path).trim();
 }
-export async function promptConfirmOverwrite(serverName) {
+export async function promptConfirmOverwrite(serverName, configPath) {
     const answer = await prompts({
         type: "confirm",
         name: "overwrite",
-        message: `MCP server "${serverName}" is already in this file. Overwrite it?`,
+        message: `MCP server "${serverName}" is already in this file (${configPath}). Overwrite it?`,
         initial: false,
     }, { onCancel });
     if (answer.overwrite === undefined) {

package/dist/kaneo/client.js

@@ -13,7 +13,11 @@ export class KaneoClient {
             headers.set("Content-Type", "application/json");
         }
         const url = `${this.baseUrl}${path.startsWith("/") ? path : `/${path}`}`;
-        const res = await fetch(url, { ...init, headers });
+        const timeoutSignal = AbortSignal.timeout(10_000);
+        const signal = init?.signal
+            ? AbortSignal.any([init.signal, timeoutSignal])
+            : timeoutSignal;
+        const res = await fetch(url, { ...init, headers, signal });
         if (res.status === 401 && !didRetry) {
             await this.auth.clearToken();
             return this.authorizedFetch(path, init, true);

package/dist/kaneo/task-helpers.js

@@ -42,6 +42,9 @@ export function buildFullTaskUpdateBody(existing, patch) {
     if (!projectId) {
         throw new Error("Cannot update task: missing projectId.");
     }
+    // When patch.userId is explicitly null, we set userId to "" so the API clears assignee; the API
+    // treats "" as unassigned (userId || null). When patch.userId is undefined, keep existing.userId
+    // unchanged (leave assignee as-is).
     const userId = patch.userId !== undefined
         ? patch.userId === null
             ? ""

package/dist/tools/register.js

@@ -73,25 +73,51 @@ export function registerTools(server, ctx) {
         }),
     })));
     server.registerTool("update_project", {
-        description: "Update project metadata.",
+        description: "Update project metadata (PATCH-style: only provided fields are changed).",
         inputSchema: z.object({
             id: nonEmptyString,
-            name: nonEmptyString,
-            icon: nonEmptyString,
-            slug: nonEmptyString,
-            description: z.string(),
-            isPublic: z.boolean(),
-        }),
-    }, async (args) => run(() => client.json(`/api/project/${encodeURIComponent(args.id)}`, {
-        method: "PUT",
-        body: JSON.stringify({
-            name: args.name,
-            icon: args.icon,
-            slug: args.slug,
-            description: args.description,
-            isPublic: args.isPublic,
+            name: optionalNonEmptyString,
+            icon: z.string().optional(),
+            slug: optionalNonEmptyString,
+            description: z.string().optional(),
+            isPublic: z.boolean().optional(),
         }),
-    })));
+    }, async (args) => {
+        const { id, ...patch } = args;
+        return run(async () => {
+            const existing = (await client.json(`/api/project/${encodeURIComponent(id)}`, { method: "GET" }));
+            const name = patch.name ??
+                (typeof existing.name === "string" ? existing.name : "");
+            if (!name) {
+                throw new Error("Cannot update project: missing name.");
+            }
+            const icon = patch.icon !== undefined
+                ? patch.icon
+                : typeof existing.icon === "string"
+                    ? existing.icon
+                    : "Layout";
+            const slug = patch.slug ??
+                (typeof existing.slug === "string" ? existing.slug : "");
+            if (!slug) {
+                throw new Error("Cannot update project: missing slug.");
+            }
+            const description = patch.description !== undefined
+                ? patch.description
+                : typeof existing.description === "string"
+                    ? existing.description
+                    : "";
+            const isPublic = patch.isPublic !== undefined
+                ? patch.isPublic
+                : typeof existing.isPublic === "boolean"
+                    ? existing.isPublic
+                    : false;
+            const body = { name, icon, slug, description, isPublic };
+            return client.json(`/api/project/${encodeURIComponent(id)}`, {
+                method: "PUT",
+                body: JSON.stringify(body),
+            });
+        });
+    });
     const listTasksSchema = z.object({
         projectId: nonEmptyString,
         status: optionalNonEmptyString,

package/dist/utils/mcp-result.js

@@ -1,9 +1,10 @@
 export function textResult(data, isError = false) {
+    const text = typeof data === "string" ? data : (JSON.stringify(data, null, 2) ?? "");
     return {
         content: [
             {
                 type: "text",
-                text: typeof data === "string" ? data : JSON.stringify(data, null, 2),
+                text,
             },
         ],
         isError,

package/package.json

@@ -1,12 +1,13 @@
 {
 	"name": "@kaneo/mcp",
-	"version": "0.1.3",
+	"version": "0.1.5",
 	"description": "Model Context Protocol (stdio) server for Kaneo — tasks, projects, labels, and device authorization",
 	"license": "MIT",
 	"homepage": "https://github.com/usekaneo/kaneo/",
 	"repository": {
 		"type": "git",
-		"url": "https://github.com/usekaneo/kaneo/"
+		"url": "https://github.com/usekaneo/kaneo/",
+		"directory": "packages/mcp"
 	},
 	"type": "module",
 	"bin": {
@@ -28,7 +29,7 @@
 	],
 	"scripts": {
 		"build": "tsc -p tsconfig.json",
-		"prepublishOnly": "npm run build",
+		"prepublishOnly": "pnpm run build",
 		"dev": "tsx watch src/index.ts",
 		"lint": "biome check --write .",
 		"start": "node dist/index.js",