@kolbo/mcp 1.17.2 → 1.18.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kolbo/mcp",
-  "version": "1.17.2",
+  "version": "1.18.0",
   "description": "Kolbo AI MCP Server - Generate images, videos, music, speech, and sound effects from Claude Code",
   "main": "src/index.js",
   "bin": {

package/src/client.js

@@ -144,11 +144,21 @@ function readCliAuthKey() {
 // ---------------------------------------------------------------------------
 
 class KolboClient {
-  constructor() {
-    this.baseUrl = resolveApiBase();
+  /**
+   * @param {object} [opts]
+   * @param {string} [opts.apiKey]  Explicit key. Takes precedence over env +
+   *   auth store. Used by a remote HTTP host that injects the caller's key per
+   *   request (one KolboClient per request) instead of reading a process-wide
+   *   env var. When set, the auth-store 401 refresh path is disabled — the host
+   *   owns the key lifecycle.
+   * @param {string} [opts.apiBase] Explicit API base URL override.
+   */
+  constructor(opts = {}) {
+    this.baseUrl = opts.apiBase ? String(opts.apiBase).replace(/\/$/, '') : resolveApiBase();
+    this._explicitKey = opts.apiKey || null;
     this._envKey = process.env.KOLBO_API_KEY || null;
     this._authStoreKey = null; // lazy-loaded
-    this.apiKey = this._envKey || this._readAuthStore();
+    this.apiKey = this._explicitKey || this._envKey || this._readAuthStore();
 
     if (!this.apiKey) {
       // No key in env OR auth store. The Kolbo Code parent process should
@@ -171,6 +181,9 @@ class KolboClient {
    * since the MCP server started. Returns true if a new key was found.
    */
   _tryRefreshKey() {
+    // Host-injected per-request key is authoritative — never override it from
+    // the local CLI auth store (which may not even exist in a server context).
+    if (this._explicitKey) return false;
     if (this._envKey) {
       // Env var is set but invalid — can't override it, but try auth store
       const fresh = readCliAuthKey();

package/src/index.js

@@ -70,8 +70,20 @@ const { registerAppBuilderTools } = require('./tools/app_builder');
 const { registerArtifactTools } = require('./tools/artifacts');
 const { registerProjectTools } = require('./tools/projects');
 
-async function main() {
-  const client = new KolboClient();
+/**
+ * Build a fully-configured Kolbo MCP server (all tool groups registered)
+ * WITHOUT connecting a transport. This is the reusable core shared by:
+ *   - the stdio entrypoint below (npx / Kolbo Code), and
+ *   - a remote HTTP host (kolbo-api) that creates one server per request with
+ *     the caller's key injected via `opts.apiKey`.
+ *
+ * @param {object} [opts]
+ * @param {string} [opts.apiKey]   Per-instance Kolbo API key (overrides env).
+ * @param {string} [opts.apiBase]  API base URL override.
+ * @returns {McpServer} a server ready to `.connect(transport)`.
+ */
+function createServer(opts = {}) {
+  const client = new KolboClient(opts);
 
   const server = new McpServer({
     name: 'kolbo',
@@ -90,12 +102,18 @@ async function main() {
   registerArtifactTools(server, client);
   registerProjectTools(server, client);
 
+  return server;
+}
+
+async function main() {
+  const server = createServer();
+
   // Start the server with stdio transport
   const transport = new StdioServerTransport();
   await server.connect(transport);
 }
 
-module.exports = { main };
+module.exports = { main, createServer };
 
 // Auto-run when invoked directly (e.g. `node src/index.js` or via the published
 // bin/kolbo-mcp.js wrapper). Consumers that `require()` this module to embed it