@prowl-ai/prowl-skill 0.6.0 → 0.6.1

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## v0.6.1 – 2026-10-11
+
+Package `@prowl-ai/prowl-skill` 0.6.1 · plugins `prowl` 0.5.1, `prowl-cli` 0.3.0.
+
+### Security
+
+- **The API key is no longer in a process's arguments.** The bundled launcher used to
+  start `mcp-remote … --header "Authorization: Bearer <key>"`, so the key sat in argv,
+  where any process of the same user reads it with `ps` or `pgrep -fl` — and two Prowl
+  keys leaked from one machine exactly that way (2026-10-04, 2026-10-09). The launcher
+  now exports `PROWL_MCP_AUTH="Bearer <key>"` and passes the literal
+  `Authorization:${PROWL_MCP_AUTH}`, which `mcp-remote` expands from its own
+  environment. Key sources and their order are unchanged. `test/mcp_launch_test.js`
+  asserts no argument carries the key from any source; `negative-self-test.js` plants
+  the old form and watches that assertion fire. Verified live against prowl.chat with
+  `mcp-remote` 0.14.3: `initialize` and `tools/list` (23 tools) succeed, the argv shows
+  only the placeholder.
+- **Restart running sessions after updating.** An `mcp-remote` already running keeps
+  its old argv until its session restarts; rotate a key that was exposed.
+
 ## v0.6.0 – 2026-09-29
 
 Package `@prowl-ai/prowl-skill` 0.6.0 · plugins `prowl` 0.5.0, `prowl-cli` 0.3.0.

package/README.md

@@ -97,7 +97,7 @@ codex plugin marketplace add https://github.com/PROWL-AI/prowl-skill
 
 Then ensure `[plugins."prowl@prowl"] enabled = true` in `${CODEX_HOME:-$HOME/.codex}/config.toml` and restart.
 
-The bundled `.mcp.json` connects to `https://prowl.chat/mcp` via `mcp-remote`, reading the token from `PROWL_MCP_TOKEN` or `~/.prowl/prowl_mcp_token`.
+The bundled `.mcp.json` connects to `https://prowl.chat/mcp` via `mcp-remote`, reading the token from `PROWL_MCP_TOKEN` or `~/.prowl/prowl_mcp_token`. The token never appears in a process's arguments: the launcher hands it to `mcp-remote` in the `PROWL_MCP_AUTH` environment variable and passes only the placeholder `Authorization:${PROWL_MCP_AUTH}`, which `mcp-remote` expands itself — so `ps` and `pgrep -fl` show no key.
 
 With no key in either place the server **refuses to start** — it prints the two ways to supply one and exits `78` (`EX_CONFIG`). It deliberately does not fall through to `mcp-remote`'s OAuth: that opens a browser and waits on a `localhost` callback, and an MCP server started by an agent is killed long before the consent screen comes back, leaving the operator holding a redirect into a dead port.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prowl-ai/prowl-skill",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "The Prowl plugin: install/usage skills, the hosted MCP config, and the live status widget that makes a running Prowl call, its progress and its cost visible in the terminal. This package is the installer CLI.",
   "keywords": [
     "prowl",

package/plugins/prowl/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "prowl",
   "displayName": "Prowl",
   "description": "Real-world market data for your agents: the Prowl skill backed by the hosted Prowl MCP server (444 market data tools across 17 providers), with a status widget that makes a running call, its progress and its cost visible in the terminal.",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "author": {
     "name": "Prowl",
     "email": "support@prowl.chat",

package/plugins/prowl/.codex-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "prowl",
   "displayName": "Prowl",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Real-world market data for your agents: the Prowl skill backed by the hosted Prowl MCP server (444 market data tools across 17 providers), with a status widget that makes a running call, its progress and its cost visible in the terminal.",
   "author": {
     "name": "Prowl",

package/plugins/prowl/.mcp.json

@@ -4,7 +4,7 @@
       "command": "sh",
       "args": [
         "-lc",
-        "TOKEN=\"$(printf %s \"${PROWL_MCP_TOKEN:-}\" | tr -d \"[:space:]\")\"; if [ -z \"$TOKEN\" ] && [ -f \"$HOME/.prowl/prowl_mcp_token\" ]; then TOKEN=\"$(tr -d \"[:space:]\" < \"$HOME/.prowl/prowl_mcp_token\")\"; fi; if [ -z \"$TOKEN\" ] && [ -f \"$HOME/.codex/prowl_mcp_token\" ]; then TOKEN=\"$(tr -d \"[:space:]\" < \"$HOME/.codex/prowl_mcp_token\")\"; fi; if [ -z \"$TOKEN\" ]; then echo 'prowl: no API key; the MCP server will not start.' >&2; echo 'prowl: store one with:  npx @prowl-ai/prowl-skill token' >&2; echo 'prowl: or set PROWL_MCP_TOKEN in the environment.' >&2; echo 'prowl: not falling back to OAuth - browser consent cannot finish inside MCP startup.' >&2; exit 78; fi; exec npx -y mcp-remote https://prowl.chat/mcp --header \"Authorization: Bearer $TOKEN\" --transport http-first --silent"
+        "TOKEN=\"$(printf %s \"${PROWL_MCP_TOKEN:-}\" | tr -d \"[:space:]\")\"; if [ -z \"$TOKEN\" ] && [ -f \"$HOME/.prowl/prowl_mcp_token\" ]; then TOKEN=\"$(tr -d \"[:space:]\" < \"$HOME/.prowl/prowl_mcp_token\")\"; fi; if [ -z \"$TOKEN\" ] && [ -f \"$HOME/.codex/prowl_mcp_token\" ]; then TOKEN=\"$(tr -d \"[:space:]\" < \"$HOME/.codex/prowl_mcp_token\")\"; fi; if [ -z \"$TOKEN\" ]; then echo 'prowl: no API key; the MCP server will not start.' >&2; echo 'prowl: store one with:  npx @prowl-ai/prowl-skill token' >&2; echo 'prowl: or set PROWL_MCP_TOKEN in the environment.' >&2; echo 'prowl: not falling back to OAuth - browser consent cannot finish inside MCP startup.' >&2; exit 78; fi; PROWL_MCP_AUTH=\"Bearer $TOKEN\"; export PROWL_MCP_AUTH; unset TOKEN; exec npx -y mcp-remote https://prowl.chat/mcp --header 'Authorization:${PROWL_MCP_AUTH}' --transport http-first --silent"
       ]
     }
   }

package/plugins/prowl/skills/prowl/SKILL.md

@@ -5,7 +5,7 @@ license: MIT
 compatibility: Requires network access to prowl.chat and a Prowl API token; speaks MCP protocol 2025-06-18 over Streamable HTTP; the bundled MCP config runs `npx mcp-remote` (needs Node.js 18+).
 metadata:
   author: prowl.chat
-  version: "0.5.0"
+  version: "0.5.1"
 ---
 
 # Prowl – real-world market data for your agents