@kkauto/kkauto-mcp 0.3.3 → 0.3.4

package/README.md

@@ -1,8 +1,10 @@
 # kkAuto MCP Adapter
 
-Local stdio MCP server for kkAuto API v2 content tools. It exposes a thin tool layer over existing `/api/v2/*` routes and never writes directly to the database.
+`@kkauto/kkauto-mcp` connects MCP-compatible AI clients to kkAuto automation services at `https://kkauto.net`.
 
-This package is the MCP bridge for `kkauto.net` social-media automation services and compatible tenant/selfhost kkAuto deployments. It lets AI clients operate tenant-scoped kkAuto workflows for source-post intake, source workflow claiming, source crawler management, and Facebook post operations through the existing API v2 surface instead of custom direct integrations.
+It runs as a local stdio MCP server and turns AI tool calls into authenticated kkAuto API v2 requests. Use it to operate tenant-scoped social-media automation workflows from AI clients, including source-post intake, source workflow claiming, source crawler management, and Facebook post operations.
+
+The adapter stays thin by design: it uses the same `/api/v2/*` routes as normal kkAuto clients, works with compatible tenant/selfhost deployments, and never writes directly to the database.
 
 ## Supported Scope
 
@@ -17,11 +19,11 @@ This package is the MCP bridge for `kkauto.net` social-media automation services
 - Node.js 20 or newer.
 - Active kkAuto API token from `/wtadmin/mcp` or `/wtadmin/token?type=api`.
 - Tenant-aware base URL for SaaS, or the selfhost app base URL.
-- npm/npx access to `@kkauto/kkauto-mcp@0.3.3` after publish, or a local checkout for development.
+- npm/npx access to `@kkauto/kkauto-mcp@0.3.4` after publish, or a local checkout for development.
 
 ## Client Setup With npx
 
-The package release target is `@kkauto/kkauto-mcp@0.3.3`, so MCP clients can run it with `npx` without copying the website repository after publish:
+The package release target is `@kkauto/kkauto-mcp@0.3.4`, so MCP clients can run it with `npx` without copying the website repository after publish:
 
 Recommended setup:
 
@@ -110,9 +112,9 @@ With `npx`, the MCP client machine only needs Node.js/npm plus access to the pac
 Prepared package release:
 
 - Name: `@kkauto/kkauto-mcp`
-- Version: `0.3.3`
+- Version: `0.3.4`
 - Binary: `kkauto-mcp -> dist/server.js`
-- Expected tarball after publish: `https://registry.npmjs.org/@kkauto/kkauto-mcp/-/kkauto-mcp-0.3.3.tgz`
+- Expected tarball after publish: `https://registry.npmjs.org/@kkauto/kkauto-mcp/-/kkauto-mcp-0.3.4.tgz`
 
 Package settings:
 
@@ -127,23 +129,44 @@ npm view @kkauto/kkauto-mcp version
 npm view @kkauto/kkauto-mcp bin dist.tarball
 ```
 
-Publish the prepared `0.3.3` scoped release:
+### Trusted Publisher
+
+Future releases should publish through GitHub Actions Trusted Publisher instead of long-lived npm tokens. Configure npmjs.com package settings for `@kkauto/kkauto-mcp`:
+
+| Field | Value |
+| --- | --- |
+| Provider | GitHub Actions |
+| Organization or user | `vthuan1889` |
+| Repository | `kk-website` |
+| Workflow filename | `npm-publish-mcp.yml` |
+| Environment name | blank |
+| Allowed actions | `npm publish` |
+
+The repo-side workflow is `.github/workflows/npm-publish-mcp.yml`. It uses GitHub-hosted runners, `permissions.id-token: write`, Node 24, and installs npm 11 because Trusted Publisher requires npm 11.5.1+ so npm can exchange the OIDC token automatically. Trusted Publisher releases do not need `NODE_AUTH_TOKEN` or an OTP in GitHub Actions.
+
+Release-triggered publishes require publishing a GitHub Release whose tag starts with `mcp-v`, for example `mcp-v0.3.4`. Pushing a tag alone does not publish. The release tag must match the package version as `mcp-v<version>`, and the workflow refuses to publish if that package version already exists on npm. Manual workflow dispatch is also available from `main` only and requires confirming `@kkauto/kkauto-mcp` as the publish target.
+
+After one successful OIDC publish, prefer npm package settings that require 2FA and disallow token publishing.
+
+Trusted Publisher release flow:
 
 ```bash
 cd mcp
 npm install
+npm version patch --no-git-tag-version
 npm test
 npm pack --dry-run
-npm publish --access public
 ```
 
-After the scoped package is published and verified, deprecate the old unscoped package while keeping it installable:
+Commit the version bump, push to `main`, then publish a GitHub Release tagged `mcp-v<version>`. The workflow installs dependencies, tests, dry-runs the package, and runs `npm publish --access public` via OIDC.
+
+Legacy package status: the old unscoped package remains installable and `kkauto-mcp<=0.3.2` is deprecated with migration guidance. To correct that deprecation message if needed:
 
 ```bash
 npm deprecate kkauto-mcp@"<=0.3.2" "Package moved to @kkauto/kkauto-mcp. Use: npx -y @kkauto/kkauto-mcp"
 ```
 
-For the next release after `0.3.3`, bump the package version first, then publish.
+For the next release after `0.3.4`, bump the package version first, then publish.
 
 Use `npm publish --registry <private-registry-url>` for a private registry.
 

package/dist/server.js

@@ -13,7 +13,7 @@ async function main() {
     const client = new KkAutoApiClient(config);
     const server = new McpServer({
         name: 'kkauto-mcp',
-        version: '0.3.3',
+        version: '0.3.4',
     });
     registerFbPostTools(server, client, config);
     registerSourcePostTools(server, client, config);

package/package.json

@@ -1,8 +1,13 @@
 {
   "name": "@kkauto/kkauto-mcp",
-  "version": "0.3.3",
+  "version": "0.3.4",
   "type": "module",
   "description": "MCP stdio adapter for kkAuto API v2 content tools.",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/vthuan1889/kk-website.git",
+    "directory": "mcp"
+  },
   "main": "dist/server.js",
   "bin": {
     "kkauto-mcp": "dist/server.js"