@mushi-mushi/mcp 0.20.0 → 0.20.1

package/README.md

@@ -146,7 +146,7 @@ The Mushi backend now exposes the same tool catalog over the **Streamable HTTP**
 
 ### Feature groups (`?features=` / `MUSHI_FEATURES`)
 
-Full catalog is **69 tools** (stdio / `MUSHI_FEATURES=all`). The hosted HTTP
+Full catalog is **71 tools** (stdio / `MUSHI_FEATURES=all`). The hosted HTTP
 endpoint exposes a leaner subset filtered by feature groups (see
 `mcp-hosted-tool-manifest.json`). New installs now default to the lean
 `triage,fixes,inventory,setup,docs` set automatically (stdio: when
@@ -390,7 +390,7 @@ Spawns `dist/index.js` with a dummy unreachable endpoint and confirms it adverti
 pnpm --filter @mushi-mushi/mcp build
 pnpm --filter @mushi-mushi/mcp test:smoke
 # OK; prints live tool/resource/prompt counts from the catalog
-# (see packages/mcp/src/catalog.ts — currently 69 tools / 8 resources / 4 prompts)
+# (see packages/mcp/src/catalog.ts — currently 71 tools / 8 resources / 4 prompts)
 ```
 
 ### Layer 3; Full localhost E2E (real binary + real backend behaviour)
@@ -484,4 +484,4 @@ MIT
 <!-- mushi-readme-stats-footer -->
 ---
 
-<sub>Monorepo scale (July 2026): 55 edge functions · 328 SQL migrations · 13 outbound plugins · 11 inbound adapters · 19 pipeline agents. Canonical counts: <a href="https://github.com/kensaurus/mushi-mushi/blob/master/docs/stats.md">docs/stats.md</a> · <code>pnpm docs-stats</code></sub>
+<sub>Monorepo scale (July 2026): 55 edge functions · 331 SQL migrations · 13 outbound plugins · 11 inbound adapters · 19 pipeline agents. Canonical counts: <a href="https://github.com/kensaurus/mushi-mushi/blob/master/docs/stats.md">docs/stats.md</a> · <code>pnpm docs-stats</code></sub>

package/dist/catalog.js

@@ -6,7 +6,7 @@ import {
   TDD_TOOL_CATALOG,
   TOOL_CATALOG,
   USE_MUSHI_INTENTS
-} from "./chunk-OZJEY3QR.js";
+} from "./chunk-TP2QQWDJ.js";
 export {
   ALL_SCOPES,
   CODEBASE_TOOL_CATALOG,

package/dist/{chunk-OZJEY3QR.js → chunk-TP2QQWDJ.js}

@@ -449,7 +449,7 @@ var TDD_TOOL_CATALOG = [
   {
     name: "list_byok_keys",
     title: "List your API key pool",
-    description: "List the project's BYOK API keys grouped by provider (anthropic | openai | firecrawl | browserbase | cursor). Returns { keys: [{ id, provider, label, priority, status, cooldownUntil }] } \u2014 metadata only, never the raw secret. Read-only. Use to see which keys are active vs rate-limited/exhausted; use add_byok_key to add one.",
+    description: "List the project's BYOK API keys grouped by provider (anthropic | openai | firecrawl | browserbase | cursor). Returns pooled { keys: [{ id, provider_slug, label, priority, status, cooldown_until, test_status, key_hint, base_url, last_tested_at, last_used_at }] } plus read-only { legacyKeys } metadata for credentials saved before the pooled lifecycle \u2014 never the raw secret. Read-only. Use to see which keys are validated, active, pending, legacy, or rate-limited; use add_byok_key to add one.",
     scope: "mcp:read",
     hints: { readOnly: true, idempotent: true, openWorld: true },
     useCase: "Which API keys are active and which are rate-limited?"
@@ -457,11 +457,27 @@ var TDD_TOOL_CATALOG = [
   {
     name: "add_byok_key",
     title: "Add an API key",
-    description: "Add a BYOK API key to the project pool for a provider (anthropic | openai | firecrawl | browserbase | cursor), with a label and priority for failover ordering. The raw key is stored encrypted in Supabase Vault and never returned. Returns { id, provider, label }. Write; NOT idempotent \u2014 adds a new row each call. Use to register a backup/rotated key; use list_byok_keys to review the pool.",
+    description: "Add and immediately validate a BYOK API key for anthropic | openai | firecrawl | browserbase | cursor. The raw key is stored encrypted in Supabase Vault and never returned; failed probes remain quarantined. Optional baseUrl is accepted only for allow-listed OpenAI-compatible HTTPS providers. Write; NOT idempotent.",
     scope: "mcp:write",
     hints: { readOnly: false, destructive: false, idempotent: false, openWorld: true },
     useCase: "Add a backup Anthropic key to the pool."
   },
+  {
+    name: "test_byok_key",
+    title: "Test an API key",
+    description: "Re-test one pooled BYOK credential by key id. A successful provider probe activates the key; auth, quota, and network failures keep it out of the runtime pool. Returns the sanitized validation result and updated key metadata. Write; idempotent.",
+    scope: "mcp:write",
+    hints: { readOnly: false, destructive: false, idempotent: true, openWorld: true },
+    useCase: "Re-test a quarantined OpenAI key after fixing its account quota."
+  },
+  {
+    name: "remove_byok_key",
+    title: "Remove an API key",
+    description: "Permanently remove one pooled BYOK credential by key id from the authenticated project, including its Vault secret. Write; destructive; idempotent.",
+    scope: "mcp:write",
+    hints: { readOnly: false, destructive: true, idempotent: true, openWorld: true },
+    useCase: "Remove a rotated or compromised provider key from the runtime pool."
+  },
   {
     name: "list_pending_review_stories",
     title: "List QA stories pending review",
@@ -635,7 +651,9 @@ var USE_MUSHI_INTENTS = {
       "activation_status",
       "get_backend_health",
       "list_byok_keys",
-      "add_byok_key"
+      "add_byok_key",
+      "test_byok_key",
+      "remove_byok_key"
     ],
     hint: "Call mushi_setup first \u2014 it diagnoses setup gaps and returns the next command to run."
   },
@@ -665,12 +683,7 @@ var USE_MUSHI_INTENTS = {
   },
   audit: {
     label: "Audit / health check",
-    tools: [
-      "run_fullstack_audit",
-      "get_backend_health",
-      "get_dashboard",
-      "get_usage"
-    ],
+    tools: ["run_fullstack_audit", "get_backend_health", "get_dashboard", "get_usage"],
     hint: "Call run_fullstack_audit for a full-stack health scorecard."
   }
 };

package/dist/{chunk-VBXXUK5G.js → chunk-ZSVRLSW5.js}

@@ -98,8 +98,10 @@ var TOOL_FEATURE_MAP = {
   start_skill_pipeline: "skills",
   get_pipeline_run: "skills",
   checkin_pipeline_step: "skills",
-  list_byok_keys: "skills",
-  add_byok_key: "skills",
+  list_byok_keys: "setup",
+  add_byok_key: "setup",
+  test_byok_key: "setup",
+  remove_byok_key: "setup",
   // audit
   run_fullstack_audit: "audit",
   get_backend_health: "audit",

package/dist/clients.d.ts

@@ -46,7 +46,7 @@ import { FeatureGroup } from './feature-groups.js';
  * editor launch. Synced to package.json by `scripts/sync-mcp-pin.mjs` — never
  * hand-edit the version.
  */
-declare const MCP_PIN_SPEC = "@mushi-mushi/mcp@0.20.0";
+declare const MCP_PIN_SPEC = "@mushi-mushi/mcp@0.20.1";
 interface StdioConfig {
     command: string;
     args: string[];

package/dist/clients.js

@@ -5,10 +5,10 @@ import {
   DEFAULT_FEATURE_GROUPS,
   appendFeaturesToUrl,
   featuresQueryString
-} from "./chunk-VBXXUK5G.js";
+} from "./chunk-ZSVRLSW5.js";
 
 // src/clients.ts
-var MCP_PIN_SPEC = "@mushi-mushi/mcp@0.20.0";
+var MCP_PIN_SPEC = "@mushi-mushi/mcp@0.20.1";
 function projectServerName(projectId, projectName) {
   const nameSlug = projectName.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 22);
   const idSuffix = projectId.replace(/-/g, "").slice(0, 6);

package/dist/feature-groups.js

@@ -9,7 +9,7 @@ import {
   parseFeaturesCsv,
   parseFeaturesParam,
   toolMatchesFeatures
-} from "./chunk-VBXXUK5G.js";
+} from "./chunk-ZSVRLSW5.js";
 export {
   ALL_FEATURE_GROUPS,
   DEFAULT_FEATURE_GROUPS,