@shipstatic/mcp 2.3.4 → 2.4.1-beta.1

package/README.md

@@ -47,14 +47,14 @@ Install [ShipStatic for VS Code](https://marketplace.visualstudio.com/items?item
 
 ### Then just ask
 
-> "Put my site online."
+> "Publish this with ShipStatic."
 
 Your agent publishes the files and answers with two links:
 
 - **The live site** — a real URL you can share right away.
 - **A claim link** — the site stays live for 3 days; open the claim link to keep it forever. A free account is all it takes.
 
-Want the site private? Ask for a password — visitors must enter it before they can see anything.
+Want the site private? Say "publish this with ShipStatic's built-in password protection". Visitors must enter the password before they can see anything, and saying "built-in" keeps your agent from writing a password page of its own.
 
 ### Then connect, if you want more
 
@@ -183,7 +183,7 @@ Published to the [MCP Registry](https://registry.modelcontextprotocol.io/v0.1/se
 | **[VS Code](https://marketplace.visualstudio.com/items?itemName=shipstatic.shipstatic)** | Search "ShipStatic" in the Marketplace |
 | **[Gemini CLI](https://github.com/shipstatic/plugin)** | `gemini extensions install https://github.com/shipstatic/plugin` |
 | **[n8n](https://www.npmjs.com/package/n8n-nodes-shipstatic)** | Search "ShipStatic" in n8n's node panel |
-| **[GitHub Action](https://github.com/shipstatic/action)** | `shipstatic/action@v2` |
+| **[GitHub Action](https://github.com/shipstatic/action)** | `shipstatic/action@v3` |
 | **[Agent Skill](https://www.shipstatic.com/SKILL.md)** | One file, for any skills-aware tool |
 
 ## License

package/dist/server.js

@@ -11,7 +11,7 @@ const D = DESCRIPTION_BLOCKS;
 // stdio's: how files arrive (a filesystem path) and how a caller
 // authenticates (`SHIP_TOKEN`). The hosted transport composes the same blocks
 // around its own two.
-const INSTRUCTIONS = `${B.opening}
+const INSTRUCTIONS = `${B.opening} ${B.accountLater}
 
 To deploy: call ${UPLOAD_TOOL_NAME} with the build output directory path. ${B.live} ${B.password}
 

package/dist/tools.d.ts

@@ -185,6 +185,7 @@ export declare const ACCOUNT_SUMMARY: z.ZodObject<{
         platformDomains: z.ZodInt;
         customDomains: z.ZodInt;
         members: z.ZodInt;
+        invitations: z.ZodInt;
     }, z.core.$strip>;
     caps: z.ZodObject<{
         deployments: z.ZodInt;

package/dist/vocabulary.d.ts

@@ -108,8 +108,8 @@ export declare const PUBLIC_EXPIRY: string;
  * One row per tool lives in the registry (`tools.ts`, `TOOLS`), and every
  * other statement about the tool is derived from it: the MCP annotations
  * (`annotate`), the account-tool set (and so the hosted door's
- * `securitySchemes` and challenge scope), the listing justifications in
- * `integrations/gpt`, and the catalogue tests. Until 1.11.0 these facts had
+ * `securitySchemes` and challenge scope), the hint table
+ * `integrations/gpt`'s preflight checks, and the catalogue tests. Until 1.11.0 these facts had
  * three owners: four annotation classes here, a hand-written name list for
  * the auth need, and the upload tool annotated by hand on both transports.
  * Three owners for facts about one tool is how the classes came to spread
@@ -188,6 +188,14 @@ export declare function titled<C extends {
  */
 export declare const INSTRUCTION_BLOCKS: {
     readonly opening: "ShipStatic deploys static websites instantly. Free, no account required.";
+    /**
+     * Publishing first, on every door. A host that can connect an account may
+     * reach for an account tool before the deploy the user asked for, and a
+     * sign-in between a person and their first link is the friction the
+     * no-account promise exists to remove. The account comes up when the user
+     * asks for something only an account holds.
+     */
+    readonly accountLater: "Publishing needs no account, so deploy straight away; bring up an account only when the user asks to see or manage their sites, or to use their own domain.";
     readonly live: "The site is live immediately.";
     /**
      * A block of its own rather than a clause of `live`: two sentences, two
@@ -198,6 +206,23 @@ export declare const INSTRUCTION_BLOCKS: {
      * one place a server may say what an agent should do. A tool description
      * describes the tool; both listing reviews reject one that instructs the
      * model, and the catalogue tests grep for it.
+     *
+     * HELD UNTIL THE DIRECTORY APPROVALS LAND (operator, 2026-10-06). The text
+     * below is the one both listings reviewed, kept word for word while the
+     * Claude directory review is open. The version to switch to names the
+     * feature the way every page and mail does ("built-in password
+     * protection") and tells the agent not to write a password page of its
+     * own, which is what an agent asked only to "add a password" tends to do.
+     * To switch: replace the string below with this one, release the package,
+     * and walk the convoy (root `backlog.md` has the steps).
+     *
+     *   "To make the site private, pass `password`: that is ShipStatic's
+     *   built-in password protection, checked before any file is served. When
+     *   the user asks for a password or a private site, use it, and do not
+     *   build a password page or script into the site itself. Visitors must
+     *   unlock before viewing, including on any custom domains pointing at it.
+     *   Tell the user any password you set, since one they never see locks
+     *   them out."
      */
     readonly password: "To make the site private, pass `password`; visitors must unlock before viewing, including on any custom domains pointing at it. Tell the user any password you set, since one they never see locks them out.";
     readonly claim: "The response includes a claim URL — always show the deployment URL and the claim URL to the user so they can keep the site permanently.";

package/dist/vocabulary.js

@@ -167,6 +167,14 @@ export function titled(config) {
  */
 export const INSTRUCTION_BLOCKS = {
     opening: 'ShipStatic deploys static websites instantly. Free, no account required.',
+    /**
+     * Publishing first, on every door. A host that can connect an account may
+     * reach for an account tool before the deploy the user asked for, and a
+     * sign-in between a person and their first link is the friction the
+     * no-account promise exists to remove. The account comes up when the user
+     * asks for something only an account holds.
+     */
+    accountLater: 'Publishing needs no account, so deploy straight away; bring up an account only when the user asks to see or manage their sites, or to use their own domain.',
     live: 'The site is live immediately.',
     /**
      * A block of its own rather than a clause of `live`: two sentences, two
@@ -177,6 +185,23 @@ export const INSTRUCTION_BLOCKS = {
      * one place a server may say what an agent should do. A tool description
      * describes the tool; both listing reviews reject one that instructs the
      * model, and the catalogue tests grep for it.
+     *
+     * HELD UNTIL THE DIRECTORY APPROVALS LAND (operator, 2026-10-06). The text
+     * below is the one both listings reviewed, kept word for word while the
+     * Claude directory review is open. The version to switch to names the
+     * feature the way every page and mail does ("built-in password
+     * protection") and tells the agent not to write a password page of its
+     * own, which is what an agent asked only to "add a password" tends to do.
+     * To switch: replace the string below with this one, release the package,
+     * and walk the convoy (root `backlog.md` has the steps).
+     *
+     *   "To make the site private, pass `password`: that is ShipStatic's
+     *   built-in password protection, checked before any file is served. When
+     *   the user asks for a password or a private site, use it, and do not
+     *   build a password page or script into the site itself. Visitors must
+     *   unlock before viewing, including on any custom domains pointing at it.
+     *   Tell the user any password you set, since one they never see locks
+     *   them out."
      */
     password: 'To make the site private, pass `password`; visitors must unlock before viewing, including on any custom domains pointing at it. Tell the user any password you set, since one they never see locks them out.',
     claim: 'The response includes a claim URL — always show the deployment URL and the claim URL to the user so they can keep the site permanently.',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shipstatic/mcp",
-  "version": "2.3.4",
+  "version": "2.4.1-beta.1",
   "mcpName": "com.shipstatic/mcp",
   "description": "Deploy static websites, landing pages, and prototypes instantly from AI agents. Start with the hosted endpoint at mcp.shipstatic.com (no install, no signup, no API key), or install this package to deploy folders from your own machine. The same fifteen tools either way.",
   "type": "module",
@@ -68,8 +68,8 @@
   "license": "MIT",
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
-    "@shipstatic/ship": "3.4.0",
-    "@shipstatic/types": "3.8.0",
+    "@shipstatic/ship": "3.5.0",
+    "@shipstatic/types": "3.9.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {