@productmaker/mcp 8.2.0 → 8.3.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +10 -1
- package/dist/http.js +478 -182
- package/dist/stdio.js +286 -56
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -64,7 +64,7 @@ their connector immediately. New connections should always use OAuth; once the
|
|
|
64
64
|
client supports it, replace the saved connection with the clean URL above.
|
|
65
65
|
|
|
66
66
|
In claude.ai: _Settings → Integrations → Add MCP server_.
|
|
67
|
-
In ChatGPT:
|
|
67
|
+
In ChatGPT: _Plugins (sidebar) → Add → Create MCP app_ (OAuth).
|
|
68
68
|
In Claude Desktop: _Settings → Connectors → Add custom connector_.
|
|
69
69
|
|
|
70
70
|
If your saved connection still uses an API key, it continues to use the latest
|
|
@@ -268,6 +268,15 @@ The `base64` field was removed. MCP JSON-RPC transports truncate large tool argu
|
|
|
268
268
|
|
|
269
269
|
## Version history
|
|
270
270
|
|
|
271
|
+
### 8.3.1 — Refresh token garantizado
|
|
272
|
+
|
|
273
|
+
- OAuth alojado: el proxy `/oauth/authorize` añade `offline_access` al scope antes de redirigir a Auth0. Los hosts que siguen el spec piden solo `mcp:access` (lo que anuncian el challenge y la metadata del recurso) y sin esto Auth0 nunca emitía refresh token.
|
|
274
|
+
|
|
275
|
+
### 8.3.0 — Idempotencia de tools pagadas + refresh OAuth
|
|
276
|
+
|
|
277
|
+
- Tools pagadas (`create_product_task`, `create_service_video`, `generate_video_creative`, `generate_free_video`, `generate_image_creatives`, `generate_landing`, `create_creative_variant`): envían un `Idempotency-Key` derivado de los argumentos semánticos (ventana de 15 min). Un reintento con los mismos argumentos devuelve la misma tarea (`replayed: true`) sin segundo cargo; una tarea en `error` sí se reintenta.
|
|
278
|
+
- OAuth alojado: se anuncia `offline_access` + grant `refresh_token`; un token a punto de expirar responde `401` + `WWW-Authenticate` para que el host refresque en silencio (`MCP_SUBJECT_TOKEN_REAUTH_WINDOW_MS`, por defecto 180000; `0` lo desactiva).
|
|
279
|
+
|
|
271
280
|
### 8.2.0 — Fase 3 (modelos)
|
|
272
281
|
|
|
273
282
|
- Imagen: `generate_image_creatives` (setup guiado) acepta `image:1k` / `image:2k`; `gpt-image-2-5:*` y `gpt-image-2:*` se siguen aceptando.
|