@mushi-mushi/mcp 0.16.1 → 0.16.2

package/CONTRIBUTING.md

@@ -27,12 +27,24 @@ pnpm build
 
 ```bash
 pnpm dev          # Start all dev servers (admin on :6464)
+```
+
+| Surface | URL |
+| --- | --- |
+| Admin console | http://localhost:6464 |
+| Docs site | http://localhost:3000 |
+| CLI console override | `MUSHI_CONSOLE_URL=http://localhost:6464` |
+
+```bash
 pnpm test         # Run Vitest across all packages
 pnpm typecheck    # TypeScript checks
 pnpm lint         # ESLint
 pnpm format       # Prettier
+pnpm smoke:cli-setup   # Playwright: onboarding ?setup=cli + success panel (skips headless if unsigned)
 ```
 
+Set `CLI_SETUP_SMOKE_STRICT=1` to fail the smoke script when Playwright is not signed in (CI gate).
+
 Ad-hoc screenshots captured during UI reviews can live temporarily at the repo
 root, but root-level `*.png` files are intentionally ignored. Canonical
 screenshots that should be versioned belong under `docs/screenshots/`.
@@ -58,7 +70,7 @@ packages/
   react-native/  React Native SDK (MIT)
   cli/           CLI tool (MIT)
   mcp/           MCP server for coding agents (MIT)
-  server/        Supabase Edge Functions (AGPLv3)
+  server/        Supabase Edge Functions (AGPLv3; ee/ is commercial)
   agents/        Agentic fix pipeline (AGPLv3)
   verify/        Fix verification (AGPLv3)
 apps/
@@ -69,6 +81,18 @@ tooling/
   tsconfig/      Shared TypeScript configs
 ```
 
+## What we don't accept
+
+Knowing this upfront saves everyone time.
+
+- **Automated / bulk / AI-slop PRs** — any PR that was opened by a script, an LLM agent acting without meaningful human review, or as part of a parallel bounty-farming sweep is closed on sight. The commit history, branch name, or helper scripts included in the PR make this obvious.
+- **PRs that target the wrong base** — all PRs must branch from and target `master`. PRs targeting `main` or any other branch are closed (and will show an inflated diff that is not your work).
+- **One PR per issue, one issue per PR** — splitting or duplicating work just to collect acknowledgements isn't welcome.
+- **Good-first-issues without claiming first** — comment on the issue to claim it before starting. If two people open PRs for the same issue, the one that commented first is prioritised.
+- **Documentation-only PRs that merely duplicate existing content** — if the information already exists (e.g. in another file in this repo), adding a redundant copy adds noise without value.
+
+If a PR violates these policies it will be closed with a brief explanation. No hard feelings — a genuine contribution on the same issue is always welcome.
+
 ## Making Changes
 
 1. Create a feature branch from `master`
@@ -187,7 +211,7 @@ chore: bump dependencies
 ## License
 
 - SDK packages are MIT — your contributions will be MIT-licensed
-- Server/agents/verify are AGPLv3 — contributions to those packages fall under AGPLv3
+- Server/agents/verify are AGPLv3 — contributions to those packages fall under AGPLv3. A [commercial license](./COMMERCIAL-LICENSE.md) is available for hosted-SaaS use cases that cannot publish modifications. The `packages/server/ee/` directory is source-available but commercial (production use needs a license); contributions there are accepted under the same EE terms.
 
 ## Questions?
 

package/SECURITY.md

@@ -113,7 +113,7 @@ What we treat as in-scope attacker capabilities, and what we don't.
 | Compromised Supabase service-role key | ❌ | Treated as a tier-0 incident; would require key rotation and audit-log forensics. Not defendable in software. |
 | Compromise of `kensaurus@gmail.com` | ❌ | Treated as a project-fork event; downstream consumers should pin to the last known-good version and follow the new release channel. |
 | Physical / OS-level attacker on an end-user device | ❌ | Out of scope. |
-| Malicious fork using the Mushi name to ship malware | ❌ (technical) ✅ (legal) | The MIT/BSL grant lets the fork exist; the trademark policy (`TRADEMARK.md`) makes shipping it under the Mushi name an infringement we will pursue. |
+| Malicious fork using the Mushi name to ship malware | ❌ (technical) ✅ (legal) | The MIT / AGPLv3 grant lets the fork exist; the trademark policy (`TRADEMARK.md`) makes shipping it under the Mushi name an infringement we will pursue. |
 
 ## Data handling and PII
 

package/dist/catalog.js

@@ -5,7 +5,7 @@ import {
   RESOURCE_CATALOG,
   TDD_TOOL_CATALOG,
   TOOL_CATALOG
-} from "./chunk-UYZEIJ5G.js";
+} from "./chunk-MM3IMFM4.js";
 export {
   ALL_SCOPES,
   CODEBASE_TOOL_CATALOG,

package/dist/{chunk-UYZEIJ5G.js → chunk-MM3IMFM4.js}

@@ -534,6 +534,15 @@ var TDD_TOOL_CATALOG = [
     hints: { readOnly: false, destructive: false, idempotent: false, openWorld: true },
     useCase: 'Did "Add to Slack" work? Send a test ping to confirm.'
   },
+  // ── Billing / usage tools ─────────────────────────────────────────────────
+  {
+    name: "get_usage",
+    title: "Usage & billing summary",
+    description: 'Read-only diagnoses quota and billing summary for the current project: diagnoses used / limit / percentage, spend cap, period start/end, plan name, and whether the project is approaching or over its quota. Use this to answer "how many diagnoses do I have left?" or "am I close to my spend cap?".',
+    scope: "mcp:read",
+    hints: { readOnly: true, idempotent: true, openWorld: false },
+    useCase: "How many diagnoses do I have left this month?"
+  },
   // ── Skill Pipeline tools ─────────────────────────────────────────────────────
   {
     name: "list_skills",

package/dist/{chunk-B2QEG35D.js → chunk-ZX3XIJ7S.js}

@@ -10,6 +10,7 @@ var FEATURE_GROUPS = [
   "admin",
   "audit",
   "docs",
+  "usage",
   /** Deprecated aliases kept for one release — hidden unless `legacy` or `all`. */
   "legacy"
 ];
@@ -82,6 +83,8 @@ var TOOL_FEATURE_MAP = {
   project_settings: "admin",
   privacy_status: "admin",
   evolution_history: "admin",
+  // usage / billing
+  get_usage: "usage",
   // qa / tdd
   map_user_stories: "qa",
   get_map_run_status: "qa",

package/dist/feature-groups.d.ts

@@ -4,7 +4,7 @@
  * When `features` is omitted → all tools (backward compatible).
  * New installs default to DEFAULT_FEATURE_GROUPS via deeplink / docs.
  */
-declare const FEATURE_GROUPS: readonly ["triage", "fixes", "inventory", "setup", "qa", "skills", "rewards", "admin", "audit", "docs", "legacy"];
+declare const FEATURE_GROUPS: readonly ["triage", "fixes", "inventory", "setup", "qa", "skills", "rewards", "admin", "audit", "docs", "usage", "legacy"];
 type FeatureGroup = (typeof FEATURE_GROUPS)[number];
 /** Lean default for new Cursor installs (~45 tools vs 70 full). */
 declare const DEFAULT_FEATURE_GROUPS: readonly FeatureGroup[];

package/dist/feature-groups.js

@@ -9,7 +9,7 @@ import {
   parseFeaturesCsv,
   parseFeaturesParam,
   toolMatchesFeatures
-} from "./chunk-B2QEG35D.js";
+} from "./chunk-ZX3XIJ7S.js";
 export {
   ALL_FEATURE_GROUPS,
   DEFAULT_FEATURE_GROUPS,

package/dist/index.js

@@ -457,6 +457,15 @@ var TDD_TOOL_CATALOG = [
     hints: { readOnly: false, destructive: false, idempotent: false, openWorld: true },
     useCase: 'Did "Add to Slack" work? Send a test ping to confirm.'
   },
+  // ── Billing / usage tools ─────────────────────────────────────────────────
+  {
+    name: "get_usage",
+    title: "Usage & billing summary",
+    description: 'Read-only diagnoses quota and billing summary for the current project: diagnoses used / limit / percentage, spend cap, period start/end, plan name, and whether the project is approaching or over its quota. Use this to answer "how many diagnoses do I have left?" or "am I close to my spend cap?".',
+    scope: "mcp:read",
+    hints: { readOnly: true, idempotent: true, openWorld: false },
+    useCase: "How many diagnoses do I have left this month?"
+  },
   // ── Skill Pipeline tools ─────────────────────────────────────────────────────
   {
     name: "list_skills",
@@ -603,6 +612,7 @@ var FEATURE_GROUPS = [
   "admin",
   "audit",
   "docs",
+  "usage",
   /** Deprecated aliases kept for one release — hidden unless `legacy` or `all`. */
   "legacy"
 ];
@@ -668,6 +678,8 @@ var TOOL_FEATURE_MAP = {
   project_settings: "admin",
   privacy_status: "admin",
   evolution_history: "admin",
+  // usage / billing
+  get_usage: "usage",
   // qa / tdd
   map_user_stories: "qa",
   get_map_run_status: "qa",
@@ -2699,6 +2711,23 @@ Be specific. No generic advice.`
       return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
     }
   );
+  server.registerTool(
+    "get_usage",
+    {
+      title: titleOf("get_usage"),
+      description: descOf("get_usage"),
+      annotations: annotationsFor("get_usage"),
+      inputSchema: {
+        project_id: z.string().optional().describe("Project ID. Defaults to the configured project.")
+      }
+    },
+    async ({ project_id }) => {
+      const pid = project_id ?? config.projectId;
+      const path = pid ? `/v1/admin/billing/stats?project_id=${pid}` : "/v1/admin/billing/stats";
+      const data = await apiCall(path);
+      return jsonText(data);
+    }
+  );
   server.registerTool(
     "list_skills",
     {
@@ -3020,6 +3049,32 @@ Be specific. No generic advice.`
       }
     }
   }
+  const _nativeFetch = globalThis.fetch;
+  let _firstToolCallSignalled = false;
+  const _signalFirstToolCall = () => {
+    if (_firstToolCallSignalled || !projectId) return;
+    _firstToolCallSignalled = true;
+    void _nativeFetch(`${apiEndpoint}/v1/cli/funnel`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "X-Mushi-Api-Key": apiKey,
+        "X-Mushi-Project": projectId
+      },
+      body: JSON.stringify({ event: "mcp_first_tool_call" }),
+      signal: AbortSignal.timeout(4e3)
+    }).catch(() => {
+    });
+  };
+  const llServer = server.server;
+  const existingToolsCallHandler = llServer?._requestHandlers?.get("tools/call");
+  if (typeof existingToolsCallHandler === "function") {
+    llServer._requestHandlers.set("tools/call", async (...args) => {
+      const result = await existingToolsCallHandler(...args);
+      _signalFirstToolCall();
+      return result;
+    });
+  }
   return server;
 }
 

package/dist/server.js

@@ -2,13 +2,13 @@ import {
   CODEBASE_TOOL_CATALOG,
   TDD_TOOL_CATALOG,
   TOOL_CATALOG
-} from "./chunk-UYZEIJ5G.js";
+} from "./chunk-MM3IMFM4.js";
 import {
   MUSHI_SERVER_METADATA
 } from "./chunk-EHB2BGWX.js";
 import {
   toolMatchesFeatures
-} from "./chunk-B2QEG35D.js";
+} from "./chunk-ZX3XIJ7S.js";
 
 // src/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -1977,6 +1977,23 @@ Be specific. No generic advice.`
       return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
     }
   );
+  server.registerTool(
+    "get_usage",
+    {
+      title: titleOf("get_usage"),
+      description: descOf("get_usage"),
+      annotations: annotationsFor("get_usage"),
+      inputSchema: {
+        project_id: z.string().optional().describe("Project ID. Defaults to the configured project.")
+      }
+    },
+    async ({ project_id }) => {
+      const pid = project_id ?? config.projectId;
+      const path = pid ? `/v1/admin/billing/stats?project_id=${pid}` : "/v1/admin/billing/stats";
+      const data = await apiCall(path);
+      return jsonText(data);
+    }
+  );
   server.registerTool(
     "list_skills",
     {
@@ -2298,6 +2315,32 @@ Be specific. No generic advice.`
       }
     }
   }
+  const _nativeFetch = globalThis.fetch;
+  let _firstToolCallSignalled = false;
+  const _signalFirstToolCall = () => {
+    if (_firstToolCallSignalled || !projectId) return;
+    _firstToolCallSignalled = true;
+    void _nativeFetch(`${apiEndpoint}/v1/cli/funnel`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "X-Mushi-Api-Key": apiKey,
+        "X-Mushi-Project": projectId
+      },
+      body: JSON.stringify({ event: "mcp_first_tool_call" }),
+      signal: AbortSignal.timeout(4e3)
+    }).catch(() => {
+    });
+  };
+  const llServer = server.server;
+  const existingToolsCallHandler = llServer?._requestHandlers?.get("tools/call");
+  if (typeof existingToolsCallHandler === "function") {
+    llServer._requestHandlers.set("tools/call", async (...args) => {
+      const result = await existingToolsCallHandler(...args);
+      _signalFirstToolCall();
+      return result;
+    });
+  }
   return server;
 }
 export {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@mushi-mushi/mcp",
   "mcpName": "io.github.kensaurus/mushi-mushi",
-  "version": "0.16.1",
+  "version": "0.16.2",
   "license": "MIT",
   "description": "MCP server for Mushi Mushi — triage user-felt bugs, pull evidence (screenshots, console logs, network requests), check blast radius, and dispatch fix PRs, all from your AI coding agent",
   "type": "module",
@@ -42,15 +42,15 @@
   ],
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "zod": "^4.4.2",
-    "@mushi-mushi/core": "^1.16.0"
+    "zod": "^4.4.3",
+    "@mushi-mushi/core": "^1.20.0"
   },
   "devDependencies": {
-    "@types/node": "^22.19.17",
-    "eslint": "^10.3.0",
+    "@types/node": "^22.19.21",
+    "eslint": "^10.4.1",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.5",
+    "vitest": "^4.1.8",
     "@mushi-mushi/eslint-config": "0.0.0"
   },
   "repository": {
@@ -58,8 +58,8 @@
     "url": "https://github.com/kensaurus/mushi-mushi.git",
     "directory": "packages/mcp"
   },
-  "author": "Kenji Sakuramoto",
-  "homepage": "https://github.com/kensaurus/mushi-mushi/tree/main/packages/mcp#readme",
+  "author": "Kenji Sakuramoto (https://bsky.app/profile/mushimushi.dev)",
+  "homepage": "https://kensaur.us/mushi-mushi",
   "bugs": {
     "url": "https://github.com/kensaurus/mushi-mushi/issues"
   },
@@ -94,6 +94,10 @@
   "engines": {
     "node": ">=20"
   },
+  "funding": {
+    "type": "github",
+    "url": "https://github.com/sponsors/kensaurus"
+  },
   "scripts": {
     "build": "tsup",
     "clean:types": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\"",