@linkbunny/mcp 0.1.4 → 0.1.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/README.md +6 -6
  2. package/dist/index.js +1 -1
  3. package/dist/skill.md +4 -2
  4. package/npm-shrinkwrap.json +2 -2
  5. package/package.json +1 -1
package/README.md CHANGED
@@ -4,10 +4,10 @@ A local stdio MCP server that lets your coding agent run LinkBunny nofollow link
4
4
 
5
5
  Its official MCP Registry name is `com.getlinkbunny/exchange`.
6
6
 
7
- These examples pin the `0.1.4` release.
7
+ These examples pin the `0.1.5` release.
8
8
 
9
9
  ```sh
10
- npx -y @linkbunny/mcp@0.1.4
10
+ npx -y @linkbunny/mcp@0.1.5
11
11
  ```
12
12
 
13
13
  Your MCP client starts this process and communicates over stdin/stdout. Running the command alone waits for protocol input. npm hosts package files; no LinkBunny MCP process is hosted. API requests go only to `https://api.getlinkbunny.com/v1` over HTTPS. There is no endpoint override, daemon, polling, automatic retry, publication, or tool chaining.
@@ -25,7 +25,7 @@ For [Codex](https://developers.openai.com/codex/mcp), after authorization merge
25
25
  ```toml
26
26
  [mcp_servers.linkbunny]
27
27
  command = "npx"
28
- args = ["-y", "@linkbunny/mcp@0.1.4", "--token-file", "/absolute/project/.env.linkbunny"]
28
+ args = ["-y", "@linkbunny/mcp@0.1.5", "--token-file", "/absolute/project/.env.linkbunny"]
29
29
  ```
30
30
 
31
31
  Run `codex mcp list` from the intended project to check registration. Have the owner complete native trust, restart the client, and begin a fresh backing session in Codex or Agent Control before discovery. Same-process hot reload is not proven. Use `/mcp` to check the active server.
@@ -40,7 +40,7 @@ For [Claude Code](https://code.claude.com/docs/en/mcp), after authorization merg
40
40
  "command": "npx",
41
41
  "args": [
42
42
  "-y",
43
- "@linkbunny/mcp@0.1.4",
43
+ "@linkbunny/mcp@0.1.5",
44
44
  "--token-file",
45
45
  "/absolute/project/.env.linkbunny"
46
46
  ]
@@ -59,7 +59,7 @@ For [VS Code](https://code.visualstudio.com/docs/agents/reference/mcp-configurat
59
59
  "linkbunny": {
60
60
  "type": "stdio",
61
61
  "command": "npx",
62
- "args": ["-y", "@linkbunny/mcp@0.1.4"],
62
+ "args": ["-y", "@linkbunny/mcp@0.1.5"],
63
63
  "envFile": "${workspaceFolder}/.env.linkbunny"
64
64
  }
65
65
  }
@@ -82,7 +82,7 @@ An explicit file takes precedence over an inherited token; invalid files never f
82
82
 
83
83
  A package cached or downloaded by npm is not proof that a server is registered. Check initialization separately after saving the registration. Tokens saved in a secret store or repository environment file are not automatically loaded by the client.
84
84
 
85
- In the fresh session, ask the configured client to perform `initialize`, `tools/list`, `resources/list`, and `resources/read` for `linkbunny://guidance/skill`, then call `get_status` once. Expect server version `0.1.4`, exactly the six tools below, the guidance text, and a status result. `get_status` is read-only and proves token admission without reserving anything. Do not call any other tool to test configuration: even `check_in` can reserve an assignment. If a client cannot list or read resources, report that part as unverified; reading the web skill does not verify MCP resource access.
85
+ In the fresh session, ask the configured client to perform `initialize`, `tools/list`, `resources/list`, and `resources/read` for `linkbunny://guidance/skill`, then call `get_status` once. Expect server version `0.1.5`, exactly the six tools below, the guidance text, and a status result. `get_status` is read-only and proves token admission without reserving anything. Do not call any other tool to test configuration: even `check_in` can reserve an assignment. If a client cannot list or read resources, report that part as unverified; reading the web skill does not verify MCP resource access.
86
86
 
87
87
  Discovery and resource reads make no LinkBunny API requests. Startup validates token format locally, so only `get_status` proves API token admission and shows subscription state. For isolated discovery-only testing, use the synthetic example `LINKBUNNY_API_TOKEN=synthetic-discovery-only-not-a-real-token-00000000`. It passes the local format check but cannot authorize real API activity. Never substitute a production token merely to test package startup. Discovery-only tests must not invoke `create_profile`, `update_profile`, `check_in`, `report_assignment`, or `reject_assignment`.
88
88
 
package/dist/index.js CHANGED
@@ -18,7 +18,7 @@ var STATUS_PAGE_LIMIT = 100;
18
18
  var REQUEST_TIMEOUT_MS = 1e4;
19
19
  var MAX_RESPONSE_BYTES = 1048576;
20
20
  var SKILL_URI = "linkbunny://guidance/skill";
21
- var VERSION = "0.1.4";
21
+ var VERSION = "0.1.5";
22
22
 
23
23
  // src/privacy.ts
24
24
  function redact({
package/dist/skill.md CHANGED
@@ -83,7 +83,8 @@ plain-language descriptions are enough.
83
83
  ## Safety contract
84
84
 
85
85
  - API base: `https://api.getlinkbunny.com/v1`.
86
- - Put the account token in `Authorization: Bearer <token>`.
86
+ - Put the account token in `Authorization: Bearer <token>`. With curl, pass that header through
87
+ standard input (`--config -`), as in the examples, so the token never appears in command arguments.
87
88
  - Keep tokens in an owner-approved secret store. Never print, echo, log, paste into chat, include in screenshots, write to source/config tracked by Git, or commit them.
88
89
  - Register only sites the owner is authorized to manage.
89
90
  - Never send repository, hosting, deployment, or provider credentials to LinkBunny.
@@ -184,7 +185,8 @@ calendar day. Pending, rejected, and expired/unreported assignments do not consu
184
185
  capacity; eligibility resets at the next UTC midnight.
185
186
 
186
187
  ```sh
187
- curl -X POST -H "Authorization: Bearer $LINKBUNNY_API_TOKEN" \
188
+ printf 'header = "Authorization: Bearer %s"\n' "$LINKBUNNY_API_TOKEN" |
189
+ curl -X POST --config - \
188
190
  "https://api.getlinkbunny.com/v1/profiles/$LINKBUNNY_PROFILE_ID/check-in"
189
191
  ```
190
192
 
package/npm-shrinkwrap.json CHANGED
@@ -1,12 +1,12 @@
1
1
  {
2
2
  "name": "@linkbunny/mcp",
3
- "version": "0.1.4",
3
+ "version": "0.1.5",
4
4
  "lockfileVersion": 2,
5
5
  "requires": true,
6
6
  "packages": {
7
7
  "": {
8
8
  "name": "@linkbunny/mcp",
9
- "version": "0.1.4",
9
+ "version": "0.1.5",
10
10
  "license": "MIT",
11
11
  "dependencies": {
12
12
  "@modelcontextprotocol/server": "2.0.0",
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@linkbunny/mcp",
3
- "version": "0.1.4",
3
+ "version": "0.1.5",
4
4
  "mcpName": "com.getlinkbunny/exchange",
5
5
  "description": "Local stdio MCP server for LinkBunny nofollow link exchanges. Requires a LinkBunny account API token.",
6
6
  "type": "module",