@mushi-mushi/mcp 0.18.1 → 0.18.2

package/README.md

@@ -87,9 +87,9 @@ Add to `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS)
 Restart Claude Desktop. You should see a hammer icon in the chat input — click it to see the Mushi Mushi tools.
 
 > **Where do I find these values?**
-> - **`MUSHI_API_KEY`**: [Admin console](https://kensaur.us/mushi-mushi/settings) → **Settings → API Keys**
+> - **`MUSHI_API_KEY`**: [Admin → Connect](https://kensaur.us/mushi-mushi/admin/connect) or **MCP** setup — mint an `mcp:read` / `mcp:write` key. This is **not** the SDK ingest key from **Setup → Verify** (`report:write`) and **not** a BYOK key from **Settings → API Keys**.
 > - **`MUSHI_PROJECT_ID`**: [Admin console](https://kensaur.us/mushi-mushi/projects) → click your project → copy the UUID below the project name (e.g. `542b34e0-019e-41fe-b900-7b637717bb86`)
-> - **`MUSHI_API_ENDPOINT`**: [Admin console](https://kensaur.us/mushi-mushi/settings) → **Settings → API Keys** — shown alongside your key
+> - **`MUSHI_API_ENDPOINT`**: Shown when you mint the MCP key, or use your project's API base (`https://<ref>.supabase.co/functions/v1/api`)
 >
 > Or visit **Admin → MCP** in the console for a one-click pre-filled config snippet.
 
@@ -105,9 +105,9 @@ Then set the same three environment variables:
 
 | Variable | Where to find it |
 |---|---|
-| `MUSHI_API_KEY` | Admin console → Settings → API Keys |
+| `MUSHI_API_KEY` | **Connect** or **MCP** tab — mint `mcp:read` / `mcp:write` (not Setup → Verify ingest key; not Settings → BYOK) |
 | `MUSHI_PROJECT_ID` | Admin console → Projects → click project → UUID below the name |
-| `MUSHI_API_ENDPOINT` | Admin console → Settings → API Keys (shown alongside your key) |
+| `MUSHI_API_ENDPOINT` | Shown at key mint, or your Supabase `.../functions/v1/api` base |
 
 Without `MUSHI_PROJECT_ID` the server starts but scoped tools return an empty result with a message pointing you here.
 

package/dist/catalog.js

@@ -5,7 +5,7 @@ import {
   RESOURCE_CATALOG,
   TDD_TOOL_CATALOG,
   TOOL_CATALOG
-} from "./chunk-TJSPX5CD.js";
+} from "./chunk-DSOPGMDX.js";
 export {
   ALL_SCOPES,
   CODEBASE_TOOL_CATALOG,

package/dist/{chunk-TJSPX5CD.js → chunk-DSOPGMDX.js}

@@ -192,7 +192,7 @@ var TOOL_CATALOG = [
   {
     name: "merge_fix",
     title: "Merge fix PR",
-    description: "Squash-merge the GitHub PR for a fix attempt, mark the linked report fixed, and notify the reporter. Re-readies the PR first if it is still a draft. Returns { merged, reportStatus }. Write; destructive (mutates the target repo's default branch); idempotent \u2014 re-running an already-merged attempt is a safe no-op. Prerequisite: CI green (check with refresh_ci). Use to ship a fix opened by dispatch_fix; use transition_status to change state without merging.",
+    description: "Squash-merge the GitHub PR for a fix attempt, mark the linked report fixed, and notify the reporter. Re-readies the PR first if it is still a draft. Returns { merged, reportStatus }. Write; destructive and irreversible from Mushi's side \u2014 once GitHub merges into the target repo's default branch there is no unmerge endpoint, only a manual revert PR outside this tool. Idempotent \u2014 re-running an already-merged attempt is a safe no-op. Prerequisite: CI green (check with refresh_ci); confirm the diff and CI status with the user before calling on a PR you have not reviewed. Use to ship a fix opened by dispatch_fix; use transition_status to change state without merging.",
     scope: "mcp:write",
     hints: { readOnly: false, destructive: true, idempotent: true, openWorld: true },
     useCase: "Merge the draft PR and notify the reporter."
@@ -225,17 +225,17 @@ var TOOL_CATALOG = [
   {
     name: "award_bonus_points",
     title: "Award bonus points",
-    description: "Award ad-hoc bonus points to a contributor by their external user id (as passed to Mushi.identify()). Points are applied server-side, audit-logged, and trigger tier re-evaluation. Requires mcp:write scope. Use this to thank a contributor who found a critical bug or to run a one-off promotional campaign.",
+    description: "Award ad-hoc bonus points (1-50000, positive only \u2014 there is no way to subtract via this tool) to a contributor by their external user id (as passed to Mushi.identify()). Points post immediately to their total and are audit-logged as bonus_manual. Destructive and effectively irreversible: there is no reversal endpoint, so confirm the amount and recipient with the user before calling. Tier re-evaluation (and any host-side reward_webhooks grant tied to crossing a threshold) is NOT immediate \u2014 it only runs on the contributor's next tracked activity, not on this call. Requires mcp:write scope. Use this to thank a contributor who found a critical bug or to run a one-off promotional campaign.",
     scope: "mcp:write",
-    hints: { readOnly: false, destructive: false, idempotent: false, openWorld: true },
+    hints: { readOnly: false, destructive: true, idempotent: false, openWorld: true },
     useCase: "Give this contributor 500 bonus points for the critical bug they found."
   },
   {
     name: "set_tier",
     title: "Override contributor tier",
-    description: `Override a contributor's tier by tier slug (e.g. "champion"). This is an admin escape hatch for manual promotions \u2014 normal tier transitions happen automatically via point thresholds. The override is logged in end_user_activity with action=tier_override_manual. Requires mcp:write scope.`,
+    description: `Override a contributor's tier by tier slug (e.g. "champion"), bypassing the normal points-threshold logic entirely. This is an admin escape hatch for manual promotions \u2014 normal tier transitions happen automatically via point thresholds instead. Destructive: it is a label-only override that does NOT replay the automatic tier-evaluation path, so any host_credit_payload grant (Stripe perk, badge, etc.) normally tied to reaching that tier via points will NOT fire \u2014 confirm with the user whether they also need the perk granted another way. The override persists until another set_tier call changes it; the prior override stays in the end_user_activity audit trail either way, logged as tier_override_manual. Requires mcp:write scope.`,
     scope: "mcp:write",
-    hints: { readOnly: false, destructive: false, idempotent: true, openWorld: true },
+    hints: { readOnly: false, destructive: true, idempotent: true, openWorld: true },
     useCase: "Manually promote this user to Champion tier as a thank-you."
   },
   {

package/dist/index.js

@@ -199,7 +199,7 @@ var TOOL_CATALOG = [
   {
     name: "merge_fix",
     title: "Merge fix PR",
-    description: "Squash-merge the GitHub PR for a fix attempt, mark the linked report fixed, and notify the reporter. Re-readies the PR first if it is still a draft. Returns { merged, reportStatus }. Write; destructive (mutates the target repo's default branch); idempotent \u2014 re-running an already-merged attempt is a safe no-op. Prerequisite: CI green (check with refresh_ci). Use to ship a fix opened by dispatch_fix; use transition_status to change state without merging.",
+    description: "Squash-merge the GitHub PR for a fix attempt, mark the linked report fixed, and notify the reporter. Re-readies the PR first if it is still a draft. Returns { merged, reportStatus }. Write; destructive and irreversible from Mushi's side \u2014 once GitHub merges into the target repo's default branch there is no unmerge endpoint, only a manual revert PR outside this tool. Idempotent \u2014 re-running an already-merged attempt is a safe no-op. Prerequisite: CI green (check with refresh_ci); confirm the diff and CI status with the user before calling on a PR you have not reviewed. Use to ship a fix opened by dispatch_fix; use transition_status to change state without merging.",
     scope: "mcp:write",
     hints: { readOnly: false, destructive: true, idempotent: true, openWorld: true },
     useCase: "Merge the draft PR and notify the reporter."
@@ -232,17 +232,17 @@ var TOOL_CATALOG = [
   {
     name: "award_bonus_points",
     title: "Award bonus points",
-    description: "Award ad-hoc bonus points to a contributor by their external user id (as passed to Mushi.identify()). Points are applied server-side, audit-logged, and trigger tier re-evaluation. Requires mcp:write scope. Use this to thank a contributor who found a critical bug or to run a one-off promotional campaign.",
+    description: "Award ad-hoc bonus points (1-50000, positive only \u2014 there is no way to subtract via this tool) to a contributor by their external user id (as passed to Mushi.identify()). Points post immediately to their total and are audit-logged as bonus_manual. Destructive and effectively irreversible: there is no reversal endpoint, so confirm the amount and recipient with the user before calling. Tier re-evaluation (and any host-side reward_webhooks grant tied to crossing a threshold) is NOT immediate \u2014 it only runs on the contributor's next tracked activity, not on this call. Requires mcp:write scope. Use this to thank a contributor who found a critical bug or to run a one-off promotional campaign.",
     scope: "mcp:write",
-    hints: { readOnly: false, destructive: false, idempotent: false, openWorld: true },
+    hints: { readOnly: false, destructive: true, idempotent: false, openWorld: true },
     useCase: "Give this contributor 500 bonus points for the critical bug they found."
   },
   {
     name: "set_tier",
     title: "Override contributor tier",
-    description: `Override a contributor's tier by tier slug (e.g. "champion"). This is an admin escape hatch for manual promotions \u2014 normal tier transitions happen automatically via point thresholds. The override is logged in end_user_activity with action=tier_override_manual. Requires mcp:write scope.`,
+    description: `Override a contributor's tier by tier slug (e.g. "champion"), bypassing the normal points-threshold logic entirely. This is an admin escape hatch for manual promotions \u2014 normal tier transitions happen automatically via point thresholds instead. Destructive: it is a label-only override that does NOT replay the automatic tier-evaluation path, so any host_credit_payload grant (Stripe perk, badge, etc.) normally tied to reaching that tier via points will NOT fire \u2014 confirm with the user whether they also need the perk granted another way. The override persists until another set_tier call changes it; the prior override stays in the end_user_activity audit trail either way, logged as tier_override_manual. Requires mcp:write scope.`,
     scope: "mcp:write",
-    hints: { readOnly: false, destructive: false, idempotent: true, openWorld: true },
+    hints: { readOnly: false, destructive: true, idempotent: true, openWorld: true },
     useCase: "Manually promote this user to Champion tier as a thank-you."
   },
   {

package/dist/server.js

@@ -2,7 +2,7 @@ import {
   CODEBASE_TOOL_CATALOG,
   TDD_TOOL_CATALOG,
   TOOL_CATALOG
-} from "./chunk-TJSPX5CD.js";
+} from "./chunk-DSOPGMDX.js";
 import {
   MUSHI_SERVER_METADATA
 } from "./chunk-EANW5YTI.js";

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@mushi-mushi/mcp",
   "mcpName": "io.github.kensaurus/mushi-mushi",
-  "version": "0.18.1",
+  "version": "0.18.2",
   "license": "MIT",
   "description": "MCP server for Mushi Mushi — triage user-felt bugs, pull evidence (screenshots, console logs, network requests), check blast radius, and dispatch fix PRs, all from your AI coding agent",
   "type": "module",
@@ -48,7 +48,7 @@
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@sentry/node": "^10.57.0",
     "zod": "^4.4.3",
-    "@mushi-mushi/core": "^1.22.2"
+    "@mushi-mushi/core": "^1.22.5"
   },
   "devDependencies": {
     "@types/node": "^22.19.21",