@linkbunny/mcp 0.1.5 → 0.1.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/README.md +38 -8
  2. package/dist/index.js +1255 -90
  3. package/dist/skill.md +44 -24
  4. package/npm-shrinkwrap.json +2 -2
  5. package/package.json +2 -2
package/README.md CHANGED
@@ -1,16 +1,16 @@
1
1
  # LinkBunny MCP
2
2
 
3
- A local stdio MCP server that lets your coding agent run LinkBunny nofollow link exchanges for sites you control. Requires Node.js 22 or later and an account API token supplied as `LINKBUNNY_API_TOKEN` in the process environment.
3
+ A local stdio MCP server that lets your coding agent run LinkBunny nofollow link exchanges for sites you control. Requires Node.js 22 or later and either a saved browser sign-in from `linkbunny-mcp login` or an account API token supplied as `LINKBUNNY_API_TOKEN`.
4
4
 
5
5
  Its official MCP Registry name is `com.getlinkbunny/exchange`.
6
6
 
7
- These examples pin the `0.1.5` release.
7
+ These examples pin the `0.1.7` release.
8
8
 
9
9
  ```sh
10
- npx -y @linkbunny/mcp@0.1.5
10
+ npx -y @linkbunny/mcp@0.1.7
11
11
  ```
12
12
 
13
- Your MCP client starts this process and communicates over stdin/stdout. Running the command alone waits for protocol input. npm hosts package files; no LinkBunny MCP process is hosted. API requests go only to `https://api.getlinkbunny.com/v1` over HTTPS. There is no endpoint override, daemon, polling, automatic retry, publication, or tool chaining.
13
+ Your MCP client starts this process and communicates over stdin/stdout. Running the command alone waits for protocol input. npm hosts package files; no LinkBunny MCP process is hosted. API requests go only to `https://api.getlinkbunny.com/v1` over HTTPS. The only endpoint override is the development pair described under [Sign in with your browser](#sign-in-with-your-browser), which applies to a saved sign-in, never to an API token. There is no daemon, polling, automatic retry, publication, or tool chaining.
14
14
 
15
15
  ## Configure a client
16
16
 
@@ -25,7 +25,7 @@ For [Codex](https://developers.openai.com/codex/mcp), after authorization merge
25
25
  ```toml
26
26
  [mcp_servers.linkbunny]
27
27
  command = "npx"
28
- args = ["-y", "@linkbunny/mcp@0.1.5", "--token-file", "/absolute/project/.env.linkbunny"]
28
+ args = ["-y", "@linkbunny/mcp@0.1.7", "--token-file", "/absolute/project/.env.linkbunny"]
29
29
  ```
30
30
 
31
31
  Run `codex mcp list` from the intended project to check registration. Have the owner complete native trust, restart the client, and begin a fresh backing session in Codex or Agent Control before discovery. Same-process hot reload is not proven. Use `/mcp` to check the active server.
@@ -40,7 +40,7 @@ For [Claude Code](https://code.claude.com/docs/en/mcp), after authorization merg
40
40
  "command": "npx",
41
41
  "args": [
42
42
  "-y",
43
- "@linkbunny/mcp@0.1.5",
43
+ "@linkbunny/mcp@0.1.7",
44
44
  "--token-file",
45
45
  "/absolute/project/.env.linkbunny"
46
46
  ]
@@ -59,7 +59,7 @@ For [VS Code](https://code.visualstudio.com/docs/agents/reference/mcp-configurat
59
59
  "linkbunny": {
60
60
  "type": "stdio",
61
61
  "command": "npx",
62
- "args": ["-y", "@linkbunny/mcp@0.1.5"],
62
+ "args": ["-y", "@linkbunny/mcp@0.1.7"],
63
63
  "envFile": "${workspaceFolder}/.env.linkbunny"
64
64
  }
65
65
  }
@@ -78,11 +78,41 @@ Use one single-line assignment, optionally prefixed with `export`, with an unquo
78
78
 
79
79
  An explicit file takes precedence over an inherited token; invalid files never fall back to that token. Without the flag, the server still accepts a token supplied through an approved process environment. Restart the MCP process after token rotation.
80
80
 
81
+ ## Sign in with your browser
82
+
83
+ Available from `0.1.7`. Instead of copying an API token, sign in once:
84
+
85
+ ```sh
86
+ npx -y @linkbunny/mcp@0.1.7 login
87
+ ```
88
+
89
+ The command opens your browser at `https://getlinkbunny.com/oauth/authorize`, where you sign in and allow access. LinkBunny then returns to a one-time listener on `http://127.0.0.1:<random port>/callback` that accepts only the response for this sign-in (PKCE and a random `state`). Use `--no-browser` to print the URL instead. Sign-in times out after 5 minutes; Ctrl+C cancels it.
90
+
91
+ The MCP server then needs no token in its configuration, for example `"args": ["-y", "@linkbunny/mcp@0.1.7"]`. It sends a 24-hour access key and renews it with a 90-day renewal key that LinkBunny replaces on every use. MCP processes that share a sign-in take turns renewing so a replaced renewal key is never sent again. Apart from one retry within a minute, LinkBunny treats a replaced renewal key that comes back as stolen and ends the sign-in.
92
+
93
+ | Command | Effect |
94
+ | ------------------------------- | ---------------------------------------------------------------------------------------------------- |
95
+ | `linkbunny-mcp login` | Signs in. Refuses if already signed in; run `logout` first to switch accounts. |
96
+ | `linkbunny-mcp status [--json]` | Shows where the sign-in is stored and whether the server will use it. Exits 1 when not signed in. |
97
+ | `linkbunny-mcp logout` | Revokes the sign-in at LinkBunny, then deletes it locally. You can also disconnect it on `/account`. |
98
+
99
+ Where the sign-in is stored:
100
+
101
+ - macOS: the login Keychain (item `LinkBunny CLI`), written through `/usr/bin/security` with the value on stdin.
102
+ - Linux: the Secret Service through `secret-tool` (libsecret), with the value on stdin. Without a running Secret Service, sign-in fails rather than falling back.
103
+ - Other systems, or when you choose it: `login --insecure-storage` keeps the keys **unencrypted** in `credentials.json` (mode 0600, directory 0700) in `$XDG_CONFIG_HOME/linkbunny` (default `~/.config/linkbunny`; `%APPDATA%\linkbunny` on Windows). Anyone who can read your files as you can use it. The server refuses that file if other users can read it.
104
+
105
+ `logins.json` beside it holds only non-secret details (storage, API URL, sign-in time). `LINKBUNNY_CONFIG_DIR` changes this directory.
106
+
107
+ Which credential the server uses: `--token-file` or a non-empty `LINKBUNNY_API_TOKEN` always wins, exactly as before, and the server says on stderr that a saved sign-in exists but is unused. Otherwise it uses the saved sign-in. Signing in never edits your client configuration or token files.
108
+
109
+ For local development only, set both `LINKBUNNY_ISSUER` (HTTPS origin) and `LINKBUNNY_API_URL` (HTTPS URL) for `login`, `status`, `logout`, and the server. A sign-in is saved per issuer, and the server uses it only with the API URL it was saved with.
110
+
81
111
  ## Verify safely
82
112
 
83
113
  A package cached or downloaded by npm is not proof that a server is registered. Check initialization separately after saving the registration. Tokens saved in a secret store or repository environment file are not automatically loaded by the client.
84
114
 
85
- In the fresh session, ask the configured client to perform `initialize`, `tools/list`, `resources/list`, and `resources/read` for `linkbunny://guidance/skill`, then call `get_status` once. Expect server version `0.1.5`, exactly the six tools below, the guidance text, and a status result. `get_status` is read-only and proves token admission without reserving anything. Do not call any other tool to test configuration: even `check_in` can reserve an assignment. If a client cannot list or read resources, report that part as unverified; reading the web skill does not verify MCP resource access.
115
+ In the fresh session, ask the configured client to perform `initialize`, `tools/list`, `resources/list`, and `resources/read` for `linkbunny://guidance/skill`, then call `get_status` once. Expect server version `0.1.7`, exactly the six tools below, the guidance text, and a status result. `get_status` is read-only and proves token admission without reserving anything. Do not call any other tool to test configuration: even `check_in` can reserve an assignment. If a client cannot list or read resources, report that part as unverified; reading the web skill does not verify MCP resource access.
86
116
 
87
117
  Discovery and resource reads make no LinkBunny API requests. Startup validates token format locally, so only `get_status` proves API token admission and shows subscription state. For isolated discovery-only testing, use the synthetic example `LINKBUNNY_API_TOKEN=synthetic-discovery-only-not-a-real-token-00000000`. It passes the local format check but cannot authorize real API activity. Never substitute a production token merely to test package startup. Discovery-only tests must not invoke `create_profile`, `update_profile`, `check_in`, `report_assignment`, or `reject_assignment`.
88
118