@shipstatic/mcp 0.4.5 → 0.4.8

package/README.md

@@ -52,9 +52,11 @@ Same config format — `npx @shipstatic/mcp` via stdio. Works with any MCP-compa
 
 Ask your AI agent to deploy a site. No API key, no sign-up, no configuration.
 
-You get a live, shareable URL on `*.shipstatic.com` instantly.
+Your site is live instantly on `*.shipstatic.com`.
 
-Deployments without an API key are public and expire in 3 days.
+Deployments without an API key are public and expire in 3 days. The response includes a **claim URL** — always show it to the user so they can keep the site permanently.
+
+Want a private site? Ask your agent to set a password when deploying — visitors will be prompted to unlock before viewing, on the deployment URL and on any custom domains pointing at it.
 
 ## All Tools — Free API Key
 
@@ -68,9 +70,9 @@ claude mcp add shipstatic -e SHIP_API_KEY=ship-... -- npx @shipstatic/mcp
 
 | Tool | Description |
 |------|-------------|
-| `deployments_upload` | Publish files and get a live URL instantly |
-| `deployments_list` | List all your deployed sites with their URLs, status, and labels |
-| `deployments_get` | Get details for a specific deployment including URL, status, and file count |
+| `deployments_upload` | Publish files and get a live URL instantly, optionally protected by a password |
+| `deployments_list` | List all deployments with their URLs, status, labels, and password protection state |
+| `deployments_get` | Get deployment details including URL, status, file count, size, labels, and password protection state |
 | `deployments_set` | Update the labels on a deployment for organization and filtering |
 | `deployments_remove` | Permanently remove a deployment and all its files |
 
@@ -79,8 +81,8 @@ claude mcp add shipstatic -e SHIP_API_KEY=ship-... -- npx @shipstatic/mcp
 | Tool | Description |
 |------|-------------|
 | `domains_set` | Connect a custom domain to your site, switch deployments, or update labels |
-| `domains_list` | List all your custom domains with their linked sites and verification status |
-| `domains_get` | Get details for a specific domain including its linked site and DNS status |
+| `domains_list` | List all domains with their linked deployments and verification status |
+| `domains_get` | Get domain details including linked deployment, verification status, and labels |
 | `domains_records` | Get the DNS records you need to configure at your DNS provider |
 | `domains_dns` | Look up which DNS provider hosts a domain (e.g. Cloudflare, Namecheap) |
 | `domains_share` | Get a shareable link so someone else can see the required DNS records |

package/dist/call.js

@@ -14,11 +14,14 @@ export async function call(fn) {
 function handleError(error) {
     if (isShipError(error)) {
         let message = error.message;
-        if (error.isType(ErrorType.Authentication) && !message.includes('Too many requests')) {
+        if (error.isType(ErrorType.Authentication)) {
             message += '\n\nHint: Set a free SHIP_API_KEY environment variable in your MCP server configuration.';
         }
+        if (error.isType(ErrorType.Forbidden)) {
+            message += '\n\nHint: This action is not permitted. Likely cause: plan limits reached or the account is terminated. Stop retrying — the user needs to upgrade or contact support at https://my.shipstatic.com.';
+        }
         if (error.isType(ErrorType.Validation) && error.details) {
-            message += `\n\nDetails: ${JSON.stringify(error.details)}`;
+            message += `\n\nDetails: ${safeStringify(error.details)}`;
         }
         return {
             content: [{ type: 'text', text: message }],
@@ -31,3 +34,11 @@ function handleError(error) {
         isError: true,
     };
 }
+function safeStringify(value) {
+    try {
+        return JSON.stringify(value);
+    }
+    catch {
+        return String(value);
+    }
+}

package/dist/index.js

@@ -2,9 +2,10 @@
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import Ship from '@shipstatic/ship';
 import { createServer } from './server.js';
-const apiKey = process.env.SHIP_API_KEY;
 async function main() {
-    const ship = apiKey ? new Ship({ apiKey }) : new Ship({});
+    // SHIP_API_KEY is optional — without it, deployments are public (3-day expiry).
+    // The SDK coerces empty strings to undefined, so we can pass through directly.
+    const ship = new Ship({ apiKey: process.env.SHIP_API_KEY });
     const server = createServer(ship);
     const transport = new StdioServerTransport();
     await server.connect(transport);

package/dist/server.js

@@ -1,14 +1,17 @@
+import { LABEL_CONSTRAINTS, PASSWORD_CONSTRAINTS } from '@shipstatic/ship';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { createRequire } from 'node:module';
 import { z } from 'zod';
 import { call } from './call.js';
+const { version } = createRequire(import.meta.url)('../package.json');
 const OPEN_WORLD = { openWorldHint: true };
 const READ = { readOnlyHint: true, destructiveHint: false, idempotentHint: true, ...OPEN_WORLD };
-const CREATE = { destructiveHint: false, ...OPEN_WORLD };
-const WRITE = { destructiveHint: false, idempotentHint: true, ...OPEN_WORLD };
-const DESTRUCTIVE = { destructiveHint: true, idempotentHint: true, ...OPEN_WORLD };
+const CREATE = { readOnlyHint: false, destructiveHint: false, ...OPEN_WORLD };
+const WRITE = { readOnlyHint: false, destructiveHint: false, idempotentHint: true, ...OPEN_WORLD };
+const DESTRUCTIVE = { readOnlyHint: false, destructiveHint: true, idempotentHint: true, ...OPEN_WORLD };
 const INSTRUCTIONS = `ShipStatic deploys static websites instantly. No account required.
 
-To deploy: call deployments_upload with the build output directory path. The site is live immediately.
+To deploy: call deployments_upload with the build output directory path. The site is live immediately. To make the site private, pass \`password\` — visitors must unlock before viewing, including on any custom domains pointing at it.
 
 Without SHIP_API_KEY, deployments are public and expire in 3 days. The response includes a claim URL — always show the deployment URL and the claim URL to the user so they can keep the site permanently.
 
@@ -22,25 +25,26 @@ To add a custom domain: domains_validate → domains_set → domains_records (sh
 export function createServer(ship) {
     const server = new McpServer({
         name: 'shipstatic',
-        version: '0.4.3',
+        version,
     }, {
         instructions: INSTRUCTIONS,
     });
     // Deployments
     server.registerTool('deployments_upload', {
-        description: 'Deploy a static site instantly. No account or API key required. Returns the live URL, file count, and size. Without SHIP_API_KEY, the response includes a claim URL (site expires in 3 days) — always show both the deployment URL and claim URL to the user.',
+        description: 'Deploy a static site instantly. No account or API key required. Returns the live URL, file count, and size. Without SHIP_API_KEY, the response includes a claim URL (site expires in 3 days) — always show both the deployment URL and claim URL to the user. To make the site private, pass `password`; always show the password to the user if you set one.',
         annotations: CREATE,
         inputSchema: {
             path: z.string().describe('Absolute path to the build output directory to deploy (e.g. "/Users/me/project/dist")'),
-            labels: z.array(z.string()).optional().describe('Labels for organizing deployments (e.g. ["production", "v1.2"]). Lowercase, 3-25 chars, allows . _ - separators.'),
+            labels: z.array(z.string()).optional().describe(`Labels for organizing deployments (e.g. ["production", "v1.2"]). Lowercase, ${LABEL_CONSTRAINTS.MIN_LENGTH}-${LABEL_CONSTRAINTS.MAX_LENGTH} chars, allows . _ - separators.`),
+            password: z.string().optional().describe(`Optional password to gate the deployment behind an unlock prompt (${PASSWORD_CONSTRAINTS.MIN_LENGTH}–${PASSWORD_CONSTRAINTS.MAX_LENGTH} characters; whitespace significant). Visitors must enter this password before viewing the site, including on any custom domains pointing at it.`),
         },
-    }, ({ path, labels }) => call(() => ship.deployments.upload(path, { labels, via: 'mcp' })));
+    }, ({ path, labels, password }) => call(() => ship.deployments.upload(path, { labels, password, via: 'mcp' })));
     server.registerTool('deployments_list', {
-        description: 'List all deployments with their URLs, status, and labels.',
+        description: 'List all deployments with their URLs, status, labels, and password protection state.',
         annotations: READ,
     }, () => call(() => ship.deployments.list()));
     server.registerTool('deployments_get', {
-        description: 'Get deployment details including URL, status, file count, size, and labels.',
+        description: 'Get deployment details including URL, status, file count, size, labels, and password protection state.',
         annotations: READ,
         inputSchema: {
             deployment: z.string().describe('Deployment hostname (e.g. "happy-cat-abc1234.shipstatic.com"). Returned by deployments_upload or deployments_list.'),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shipstatic/mcp",
-  "version": "0.4.5",
+  "version": "0.4.8",
   "mcpName": "com.shipstatic/mcp",
   "description": "Free, no account needed — deploy static websites, landing pages, and prototypes instantly from AI agents",
   "type": "module",
@@ -45,11 +45,11 @@
   "license": "MIT",
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@shipstatic/ship": "^0.8.9",
+    "@shipstatic/ship": "^0.9.6",
     "zod": "^4.3.6"
   },
   "devDependencies": {
-    "@shipstatic/types": "^0.8.7",
+    "@shipstatic/types": "^0.9.8",
     "@types/node": "^25.6.0",
     "husky": "^9.1.7",
     "typescript": "^6.0.2",
@@ -58,6 +58,7 @@
   "scripts": {
     "build": "tsc",
     "clean": "rm -rf dist",
-    "test": "vitest"
+    "test": "vitest",
+    "typecheck": "tsc --noEmit -p tsconfig.test.json"
   }
 }