@pixel-normal-edit/mcp 2.0.2 → 2.0.4

package/README.md

@@ -16,6 +16,14 @@ This bridge solves that by using Firebase Firestore as a real-time message bus:
 3. **Browser** listens to that Firestore document, executes the command on the canvas, and writes the result back.
 4. **Bridge** reads the result and returns it to the AI Agent.
 
+## Security Information
+
+You might notice that the Firebase API keys (`VITE_FIREBASE_API_KEY`, etc.) are included directly in the source code of this package. This is completely safe and by design:
+
+* **API Keys are Routing Identifiers:** In the context of Firebase Web SDK, these keys are NOT secret passwords. They merely act as a "public address" to tell the bridge which Firebase project to connect to.
+* **Firestore Security Rules:** Real security is enforced on the server-side via `firestore.rules`. The rules ensure that connections can only be established using a valid, unguessable UUID (the Session ID). 
+* **Zero User Data Access:** The bridge only has access to its designated `mcp_sessions` sandbox. It is explicitly blocked from reading or writing any user accounts, passwords, or other collections.
+
 ## Usage (For Users)
 
 You do not need to download or clone this repository manually to use it! 
@@ -24,7 +32,7 @@ To connect your AI, simply open Pixel Normal Edit, go to **Settings > Account >
 
 For example, to run it via `npx`:
 ```bash
-npx -y @pixel-normal-edit/mcp YOUR_SESSION_ID
+npx -y @pixel-normal-edit/mcp@latest YOUR_SESSION_ID
 ```
 *(Replace `YOUR_SESSION_ID` with the ID provided in your app).*
 
@@ -37,9 +45,12 @@ Add this to your `claude_desktop_config.json`:
       "command": "npx",
       "args": [
         "-y",
-        "@pixel-normal-edit/mcp",
+        "@pixel-normal-edit/mcp@latest",
         "YOUR_SESSION_ID"
-      ]
+      ],
+      "env": {
+        "DOTENV_CONFIG_QUIET": "true"
+      }
     }
   }
 }

package/index.js

@@ -26,12 +26,12 @@ const http = require('http');
 dotenv.config({ path: path.join(__dirname, '..', '.env') });
 
 const db = getFirestore(initializeApp({
-  apiKey: process.env.VITE_FIREBASE_API_KEY,
-  authDomain: process.env.VITE_FIREBASE_AUTH_DOMAIN,
-  projectId: process.env.VITE_FIREBASE_PROJECT_ID,
-  storageBucket: process.env.VITE_FIREBASE_STORAGE_BUCKET,
-  messagingSenderId: process.env.VITE_FIREBASE_MESSAGING_SENDER_ID,
-  appId: process.env.VITE_FIREBASE_APP_ID,
+  apiKey: 'AIzaSyBSrvCt58Jhsh14wbC2bD2KLFUUVbAVim0',
+  authDomain: 'pixel-normal-edit.firebaseapp.com',
+  projectId: 'pixel-normal-edit',
+  storageBucket: 'pixel-normal-edit.firebasestorage.app',
+  messagingSenderId: '397075334229',
+  appId: '1:397075334229:web:b02eede3fc7b41d02f80dc',
 }));
 
 const SESSION = process.argv[2] || process.env.MCP_SESSION || 'default-session';
@@ -489,9 +489,8 @@ const HTTP_PORT = process.env.HTTP_PORT || (process.argv.includes('--http') ? 34
 async function startStdio() {
   const transport = new StdioServerTransport();
   await server.connect(transport);
-  console.error('✅ Pixel Normal Edit MCP Bridge v2 (stdio mode)');
-  console.error(`   Session : ${SESSION}`);
-  console.error(`   Editor  : http://localhost:5173?mcp_session=${SESSION}`);
+  // Disabled console.error output because some MCP clients merge stdout and stderr,
+  // causing JSON parsing errors (e.g. invalid character 'â' looking for beginning of value)
 }
 
 async function startHttp(port) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pixel-normal-edit/mcp",
-  "version": "2.0.2",
+  "version": "2.0.4",
   "description": "MCP server for Pixel Normal Edit canvas - enables AI agents to draw pixel art",
   "main": "index.js",
   "bin": {
@@ -28,4 +28,4 @@
     "jimp": "^1.6.1",
     "zod": "^4.4.3"
   }
-}
+}