@linkbunny/mcp 0.1.3 → 0.1.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/README.md +6 -6
  2. package/dist/index.js +1 -1
  3. package/dist/skill.md +32 -2
  4. package/npm-shrinkwrap.json +2 -2
  5. package/package.json +1 -1
package/README.md CHANGED
@@ -4,10 +4,10 @@ A local stdio MCP server that lets your coding agent run LinkBunny nofollow link
4
4
 
5
5
  Its official MCP Registry name is `com.getlinkbunny/exchange`.
6
6
 
7
- These examples pin the `0.1.3` release.
7
+ These examples pin the `0.1.5` release.
8
8
 
9
9
  ```sh
10
- npx -y @linkbunny/mcp@0.1.3
10
+ npx -y @linkbunny/mcp@0.1.5
11
11
  ```
12
12
 
13
13
  Your MCP client starts this process and communicates over stdin/stdout. Running the command alone waits for protocol input. npm hosts package files; no LinkBunny MCP process is hosted. API requests go only to `https://api.getlinkbunny.com/v1` over HTTPS. There is no endpoint override, daemon, polling, automatic retry, publication, or tool chaining.
@@ -25,7 +25,7 @@ For [Codex](https://developers.openai.com/codex/mcp), after authorization merge
25
25
  ```toml
26
26
  [mcp_servers.linkbunny]
27
27
  command = "npx"
28
- args = ["-y", "@linkbunny/mcp@0.1.3", "--token-file", "/absolute/project/.env.linkbunny"]
28
+ args = ["-y", "@linkbunny/mcp@0.1.5", "--token-file", "/absolute/project/.env.linkbunny"]
29
29
  ```
30
30
 
31
31
  Run `codex mcp list` from the intended project to check registration. Have the owner complete native trust, restart the client, and begin a fresh backing session in Codex or Agent Control before discovery. Same-process hot reload is not proven. Use `/mcp` to check the active server.
@@ -40,7 +40,7 @@ For [Claude Code](https://code.claude.com/docs/en/mcp), after authorization merg
40
40
  "command": "npx",
41
41
  "args": [
42
42
  "-y",
43
- "@linkbunny/mcp@0.1.3",
43
+ "@linkbunny/mcp@0.1.5",
44
44
  "--token-file",
45
45
  "/absolute/project/.env.linkbunny"
46
46
  ]
@@ -59,7 +59,7 @@ For [VS Code](https://code.visualstudio.com/docs/agents/reference/mcp-configurat
59
59
  "linkbunny": {
60
60
  "type": "stdio",
61
61
  "command": "npx",
62
- "args": ["-y", "@linkbunny/mcp@0.1.3"],
62
+ "args": ["-y", "@linkbunny/mcp@0.1.5"],
63
63
  "envFile": "${workspaceFolder}/.env.linkbunny"
64
64
  }
65
65
  }
@@ -82,7 +82,7 @@ An explicit file takes precedence over an inherited token; invalid files never f
82
82
 
83
83
  A package cached or downloaded by npm is not proof that a server is registered. Check initialization separately after saving the registration. Tokens saved in a secret store or repository environment file are not automatically loaded by the client.
84
84
 
85
- In the fresh session, ask the configured client to perform `initialize`, `tools/list`, `resources/list`, and `resources/read` for `linkbunny://guidance/skill`, then call `get_status` once. Expect server version `0.1.3`, exactly the six tools below, the guidance text, and a status result. `get_status` is read-only and proves token admission without reserving anything. Do not call any other tool to test configuration: even `check_in` can reserve an assignment. If a client cannot list or read resources, report that part as unverified; reading the web skill does not verify MCP resource access.
85
+ In the fresh session, ask the configured client to perform `initialize`, `tools/list`, `resources/list`, and `resources/read` for `linkbunny://guidance/skill`, then call `get_status` once. Expect server version `0.1.5`, exactly the six tools below, the guidance text, and a status result. `get_status` is read-only and proves token admission without reserving anything. Do not call any other tool to test configuration: even `check_in` can reserve an assignment. If a client cannot list or read resources, report that part as unverified; reading the web skill does not verify MCP resource access.
86
86
 
87
87
  Discovery and resource reads make no LinkBunny API requests. Startup validates token format locally, so only `get_status` proves API token admission and shows subscription state. For isolated discovery-only testing, use the synthetic example `LINKBUNNY_API_TOKEN=synthetic-discovery-only-not-a-real-token-00000000`. It passes the local format check but cannot authorize real API activity. Never substitute a production token merely to test package startup. Discovery-only tests must not invoke `create_profile`, `update_profile`, `check_in`, `report_assignment`, or `reject_assignment`.
88
88
 
package/dist/index.js CHANGED
@@ -18,7 +18,7 @@ var STATUS_PAGE_LIMIT = 100;
18
18
  var REQUEST_TIMEOUT_MS = 1e4;
19
19
  var MAX_RESPONSE_BYTES = 1048576;
20
20
  var SKILL_URI = "linkbunny://guidance/skill";
21
- var VERSION = "0.1.3";
21
+ var VERSION = "0.1.5";
22
22
 
23
23
  // src/privacy.ts
24
24
  function redact({
package/dist/skill.md CHANGED
@@ -30,6 +30,34 @@ billing, credential, site, assignment, publication, report, or rejection actions
30
30
  carry out an authorized website action only when it has explicitly authorized browser control, and
31
31
  may carry out an authorized API or site action only within the approval given.
32
32
 
33
+ ### Before the owner has an account
34
+
35
+ When the owner asks you to set up LinkBunny and has no account or API token yet:
36
+
37
+ 1. Plan locally. Inspect the project and propose one HTTPS target URL and one HTTPS area of the
38
+ site where nofollow links can go, both on the same registrable domain. Tell the owner the price
39
+ ($20/month for up to 10 sites, no per-link fees), that profiles are reviewed before they can
40
+ match, that some check-ins return no request, and which later steps need their approval. Make
41
+ no LinkBunny API call while there is no token.
42
+ 2. With the owner's OK, open `https://getlinkbunny.com/login?redirect=%2Faccount%3Fsetup%3Dagent`
43
+ in their browser, or print it when you cannot open a browser (for example in a cloud or remote
44
+ session). Opening the link is not browser control: do not read, click, fill, or otherwise
45
+ operate the page. The owner signs in, subscribes, and creates the API token there.
46
+ 3. With the owner's OK, create a project file `.env.linkbunny` containing only an empty
47
+ `LINKBUNNY_API_TOKEN=` line and make sure Git ignores it, or use another secret store the owner
48
+ chooses. The owner pastes the token there. Never ask for the token in chat, and never print,
49
+ log, or commit the file's contents.
50
+ 4. When the owner says the token is saved, make one read-only `GET /me` (see "Status"). Keep the
51
+ token out of command arguments and output, for example:
52
+ `tr -d '\r' < .env.linkbunny | sed -nE 's/^(export )?LINKBUNNY_API_TOKEN="?([A-Za-z0-9._~-]+)"?$/header = "Authorization: Bearer \2"/p' | curl -sS -w '\nHTTP %{http_code}\n' --config - https://api.getlinkbunny.com/v1/me`.
53
+ If the LinkBunny MCP server is already configured with that token file, its `get_status` tool
54
+ makes the same read. `subscriptionActive: true` confirms setup. `401` means the token is missing
55
+ or wrong in the file; `subscriptionActive: false` means the subscription is not confirmed yet,
56
+ so ask the owner to finish or refresh it on the account page. Do not poll; wait until the owner
57
+ says it is done again.
58
+ 5. Only after `subscriptionActive: true`, continue with "A — Create a profile". Ask the owner
59
+ before registering the site.
60
+
33
61
  ## Activation and approval gates
34
62
 
35
63
  Use LinkBunny only when the owner explicitly asks you to onboard, register an owned site, check that
@@ -55,7 +83,8 @@ plain-language descriptions are enough.
55
83
  ## Safety contract
56
84
 
57
85
  - API base: `https://api.getlinkbunny.com/v1`.
58
- - Put the account token in `Authorization: Bearer <token>`.
86
+ - Put the account token in `Authorization: Bearer <token>`. With curl, pass that header through
87
+ standard input (`--config -`), as in the examples, so the token never appears in command arguments.
59
88
  - Keep tokens in an owner-approved secret store. Never print, echo, log, paste into chat, include in screenshots, write to source/config tracked by Git, or commit them.
60
89
  - Register only sites the owner is authorized to manage.
61
90
  - Never send repository, hosting, deployment, or provider credentials to LinkBunny.
@@ -156,7 +185,8 @@ calendar day. Pending, rejected, and expired/unreported assignments do not consu
156
185
  capacity; eligibility resets at the next UTC midnight.
157
186
 
158
187
  ```sh
159
- curl -X POST -H "Authorization: Bearer $LINKBUNNY_API_TOKEN" \
188
+ printf 'header = "Authorization: Bearer %s"\n' "$LINKBUNNY_API_TOKEN" |
189
+ curl -X POST --config - \
160
190
  "https://api.getlinkbunny.com/v1/profiles/$LINKBUNNY_PROFILE_ID/check-in"
161
191
  ```
162
192
 
package/npm-shrinkwrap.json CHANGED
@@ -1,12 +1,12 @@
1
1
  {
2
2
  "name": "@linkbunny/mcp",
3
- "version": "0.1.3",
3
+ "version": "0.1.5",
4
4
  "lockfileVersion": 2,
5
5
  "requires": true,
6
6
  "packages": {
7
7
  "": {
8
8
  "name": "@linkbunny/mcp",
9
- "version": "0.1.3",
9
+ "version": "0.1.5",
10
10
  "license": "MIT",
11
11
  "dependencies": {
12
12
  "@modelcontextprotocol/server": "2.0.0",
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@linkbunny/mcp",
3
- "version": "0.1.3",
3
+ "version": "0.1.5",
4
4
  "mcpName": "com.getlinkbunny/exchange",
5
5
  "description": "Local stdio MCP server for LinkBunny nofollow link exchanges. Requires a LinkBunny account API token.",
6
6
  "type": "module",